This bug was fixed in the package linux - 4.15.0-162.170 --------------- linux (4.15.0-162.170) bionic; urgency=medium * bionic/linux: 4.15.0-162.170 -proposed tracker (LP: #1947293) * Add final-checks to check certificates (LP: #1947174) - [Packaging] Add system trusted and revocation keys final check * CVE-2020-36385 - RDMA/cma: Add missing locking to rdma_accept() - RDMA/ucma: Fix the locking of ctx->file - RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy * CVE-2021-28950 - fuse: fix live lock in fuse_iget() * CVE-2020-36322 - fuse: fix bad inode * Bionic update: upstream stable patchset 2021-10-13 (LP: #1947011) - rcu: Fix missed wakeup of exp_wq waiters - apparmor: remove duplicate macro list_entry_is_head() - crypto: talitos - fix max key size for sha384 and sha512 - sctp: validate chunk size in __rcv_asconf_lookup - sctp: add param size validation for SCTP_PARAM_SET_PRIMARY - dmaengine: acpi: Avoid comparison GSI with Linux vIRQ - thermal/drivers/exynos: Fix an error code in exynos_tmu_probe() - 9p/trans_virtio: Remove sysfs file on probe failure - prctl: allow to setup brk for et_dyn executables - profiling: fix shift-out-of-bounds bugs - pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered - Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH - parisc: Move pci_dev_is_behind_card_dino to where it is used - dmaengine: ioat: depends on !UML - dmaengine: xilinx_dma: Set DMA mask for coherent APIs - ceph: lockdep annotations for try_nonblocking_invalidate - nilfs2: fix memory leak in nilfs_sysfs_create_device_group - nilfs2: fix NULL pointer in nilfs_##name##_attr_release - nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group - nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group - nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group - nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group - pwm: rockchip: Don't modify HW state in .remove() callback - blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() - drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV - nilfs2: use refcount_dec_and_lock() to fix potential UAF - drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION() * Invalid backport to v4.15: missing pgtable_l5_enabled (LP: #1946464) - SAUCE: Revert "x86/mm: Don't free P4D table when it is folded at runtime" * CVE-2021-38199 - NFSv4: Initialise connection to the server in nfs4_alloc_client() * CVE-2019-19449 - f2fs: fix wrong total_sections check and fsmeta check - f2fs: fix to do sanity check on segment/section count * vrf: fix refcnt leak with vxlan slaves (LP: #1945180) - ipv4: Fix device used for dst_alloc with local routes * Check for changes relevant for security certifications (LP: #1945989) - [Packaging] Add a new fips-checks script - [Packaging] Add fips-checks as part of finalchecks * CVE-2021-3759 - memcg: enable accounting of ipc resources * Bionic update: upstream stable patchset 2021-09-27 (LP: #1945224) - ARC: Fix CONFIG_STACKDEPOT - can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters - Revert "USB: serial: ch341: fix character loss at high transfer rates" - USB: serial: option: add new VID/PID to support Fibocom FG150 - usb: dwc3: gadget: Fix dwc3_calc_trbs_left() - usb: dwc3: gadget: Stop EP0 transfers during pullup disable - IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs() - e1000e: Fix the max snoop/no-snoop latency for 10M - ip_gre: add validation for csum_start - xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()' - net: marvell: fix MVNETA_TX_IN_PRGRS bit number - usb: gadget: u_audio: fix race condition on endpoint stop - opp: remove WARN when no valid OPPs remain - virtio: Improve vq->broken access to avoid any compiler optimization - vringh: Use wiov->used to check for read/write desc order - drm: Copy drm_wait_vblank to user before returning - drm/nouveau/disp: power down unused DP links during init - net/rds: dma_map_sg is entitled to merge entries - vt_kdsetmode: extend console locking - fbmem: add margin check to fb_check_caps() - KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs - Revert "floppy: reintroduce O_NDELAY fix" - net: qrtr: fix another OOB Read in qrtr_endpoint_post - net: hns3: fix get wrong pfc_en when query PFC configuration - xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG - qed: Fix the VF msix vectors flow - net: macb: Add a NULL check on desc_ptp - qede: Fix memset corruption - perf/x86/intel/pt: Fix mask of num_address_ranges - perf/x86/amd/ibs: Work around erratum #1197 - cryptoloop: add a deprecation warning - ARM: 8918/2: only build return_address() if needed - ALSA: pcm: fix divide error in snd_pcm_lib_ioctl - clk: fix build warning for orphan_list - media: stkwebcam: fix memory leak in stk_camera_probe - igmp: Add ip_mc_list lock in ip_check_mc_rcu - USB: serial: mos7720: improve OOM-handling in read_mos_reg() - f2fs: fix potential overflow - ath10k: fix recent bandwidth conversion bug - ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) - crypto: talitos - reduce max key size for SEC1 - powerpc/module64: Fix comment in R_PPC64_ENTRY handling - powerpc/boot: Delete unneeded .globl _zimage_start - net: ll_temac: Remove left-over debug message - mm/page_alloc: speed up the iteration of max_order - Revert "btrfs: compression: don't try to compress if we don't have enough pages" - usb: host: xhci-rcar: Don't reload firmware after the completion - x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions - PCI: Call Max Payload Size-related fixup quirks early - regmap: fix the offset of register error log - crypto: mxs-dcp - Check for DMA mapping errors - power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors - crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() - udf: Check LVID earlier - isofs: joliet: Fix iocharset=utf8 mount option - nvme-rdma: don't update queue count when failing to set io queues - power: supply: max17042_battery: fix typo in MAx17042_TOFF - s390/cio: add dev_busid sysfs entry for each subchannel - libata: fix ata_host_start() - crypto: qat - do not ignore errors from enable_vf2pf_comms() - crypto: qat - handle both source of interrupt in VF ISR - crypto: qat - fix reuse of completion variable - crypto: qat - fix naming for init/shutdown VF to PF notifications - crypto: qat - do not export adf_iov_putmsg() - udf_get_extendedattr() had no boundary checks. - m68k: emu: Fix invalid free in nfeth_cleanup() - spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config - spi: spi-pic32: Fix issue with uninitialized dma_slave_config - clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel - crypto: qat - use proper type for vf_mask - certs: Trigger creation of RSA module signing key if it's not an RSA key - soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally - media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init - media: dvb-usb: fix uninit-value in vp702x_read_mac_addr - media: go7007: remove redundant initialization - Bluetooth: sco: prevent information leak in sco_conn_defer_accept() - tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos - net: cipso: fix warnings in netlbl_cipsov4_add_std - i2c: highlander: add IRQ check - media: em28xx-input: fix refcount bug in em28xx_usb_disconnect - PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently - PCI: PM: Enable PME if it can be signaled from D3cold - soc: qcom: smsm: Fix missed interrupts if state changes while masked - Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow - arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 - Bluetooth: fix repeated calls to sco_sock_kill - drm/msm/dsi: Fix some reference counted resource leaks - usb: gadget: udc: at91: add IRQ check - usb: phy: fsl-usb: add IRQ check - usb: phy: twl6030: add IRQ checks - Bluetooth: Move shutdown callback before flushing tx and rx queue - usb: host: ohci-tmio: add IRQ check - usb: phy: tahvo: add IRQ check - mac80211: Fix insufficient headroom issue for AMSDU - usb: gadget: mv_u3d: request_irq() after initializing UDC - Bluetooth: add timeout sanity check to hci_inquiry - i2c: iop3xx: fix deferred probing - i2c: s3c2410: fix IRQ check - mmc: dw_mmc: Fix issue with uninitialized dma_slave_config - mmc: moxart: Fix issue with uninitialized dma_slave_config - CIFS: Fix a potencially linear read overflow - i2c: mt65xx: fix IRQ check - usb: ehci-orion: Handle errors of clk_prepare_enable() in probe - usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available - tty: serial: fsl_lpuart: fix the wrong mapbase value - ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() - bcma: Fix memory leak for internally-handled cores - ipv4: make exception cache less predictible - net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed - net: qualcomm: fix QCA7000 checksum handling - netns: protect netns ID lookups with RCU - tty: Fix data race between tiocsti() and flush_to_ldisc() - x86/resctrl: Fix a maybe-uninitialized build warning treated as error - KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted - IMA: remove -Wmissing-prototypes warning - backlight: pwm_bl: Improve bootloader/kernel device handover - clk: kirkwood: Fix a clocking boot regression - fbmem: don't allow too huge resolutions - rtc: tps65910: Correct driver module alias - blk-zoned: allow zone management send operations without CAP_SYS_ADMIN - blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN - PCI/MSI: Skip masking MSI-X on Xen PV - powerpc/perf/hv-gpci: Fix counter value parsing - xen: fix setting of max_pfn in shared_info - include/linux/list.h: add a macro to test if entry is pointing to the head - 9p/xen: Fix end of loop tests for list_for_each_entry - soc: aspeed: lpc-ctrl: Fix boundary check for mmap - crypto: public_key: fix overflow during implicit conversion - block: bfq: fix bfq_set_next_ioprio_data() - power: supply: max17042: handle fails of reading status register - dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() - VMCI: fix NULL pointer dereference when unmapping queue pair - media: uvc: don't do DMA on stack - media: rc-loopback: return number of emitters rather than error - libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs - ARM: 9105/1: atags_to_fdt: don't warn about stack size - PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported - PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure - PCI: xilinx-nwl: Enable the clock through CCF - PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response - PCI: aardvark: Fix masking and unmasking legacy INTx interrupts - HID: input: do not report stylus battery state as "full" - RDMA/iwcm: Release resources if iw_cm module initialization fails - docs: Fix infiniband uverbs minor number - pinctrl: samsung: Fix pinctrl bank pin count - vfio: Use config not menuconfig for VFIO_NOIOMMU - openrisc: don't printk() unconditionally - pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() - scsi: qedi: Fix error codes in qedi_alloc_global_queues() - MIPS: Malta: fix alignment of the devicetree buffer - media: dib8000: rewrite the init prbs logic - crypto: mxs-dcp - Use sg_mapping_iter to copy data - PCI: Use pci_update_current_state() in pci_enable_device_flags() - iio: dac: ad5624r: Fix incorrect handling of an optional regulator. - ARM: dts: qcom: apq8064: correct clock names - video: fbdev: kyro: fix a DoS bug by restricting user input - netlink: Deal with ESRCH error in nlmsg_notify() - Smack: Fix wrong semantics in smk_access_entry() - usb: host: fotg210: fix the endpoint's transactional opportunities calculation - usb: host: fotg210: fix the actual_length of an iso packet - usb: gadget: u_ether: fix a potential null pointer dereference - usb: gadget: composite: Allow bMaxPower=0 if self-powered - staging: board: Fix uninitialized spinlock when attaching genpd - tty: serial: jsm: hold port lock when reporting modem line changes - bpf/tests: Fix copy-and-paste error in double word test - bpf/tests: Do not PASS tests without actually testing the result - video: fbdev: asiliantfb: Error out if 'pixclock' equals zero - video: fbdev: kyro: Error out if 'pixclock' equals zero - video: fbdev: riva: Error out if 'pixclock' equals zero - ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() - flow_dissector: Fix out-of-bounds warnings - s390/jump_label: print real address in a case of a jump label bug - serial: 8250: Define RX trigger levels for OxSemi 950 devices - xtensa: ISS: don't panic in rs_init - hvsi: don't panic on tty_register_driver failure - serial: 8250_pci: make setup_port() parameters explicitly unsigned - staging: ks7010: Fix the initialization of the 'sleep_status' structure - ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init() - Bluetooth: skip invalid hci_sync_conn_complete_evt - ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output - media: v4l2-dv-timings.c: fix wrong condition in two for-loops - arm64: dts: qcom: sdm660: use reg value for memory node - net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() - Bluetooth: avoid circular locks in sco_sock_connect - gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() - ARM: tegra: tamonten: Fix UART pad setting - rpc: fix gss_svc_init cleanup on failure - staging: rts5208: Fix get_ms_information() heap buffer size - gfs2: Don't call dlm after protocol is unmounted - mmc: sdhci-of-arasan: Check return value of non-void funtions - mmc: rtsx_pci: Fix long reads when clock is prescaled - selftests/bpf: Enlarge select() timeout for test_maps - cifs: fix wrong release in sess_alloc_buffer() failed path - Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" - usb: musb: musb_dsps: request_irq() after initializing musb - usbip: give back URBs for unsent unlink requests during cleanup - usbip:vhci_hcd USB port can get stuck in the disabled state - ASoC: rockchip: i2s: Fix regmap_ops hang - ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B - parport: remove non-zero check on count - ath9k: fix OOB read ar9300_eeprom_restore_internal - ath9k: fix sleeping in atomic context - net: fix NULL pointer reference in cipso_v4_doi_free - net: w5100: check return value after calling platform_get_resource() - parisc: fix crash with signals and alloca - scsi: BusLogic: Fix missing pr_cont() use - scsi: qla2xxx: Sync queue idx with queue_pair_map idx - cpufreq: powernv: Fix init_chip_info initialization in numa=off - mm/hugetlb: initialize hugetlb_usage in mm_init - memcg: enable accounting for pids in nested pid namespaces - platform/chrome: cros_ec_proto: Send command again when timeout occurs - xen: reset legacy rtc flag for PV domU - bnx2x: Fix enabling network interfaces without VFs - PM: base: power: don't try to use non-existing RTC for storing data - x86/mm: Fix kern_addr_valid() to cope with existing but not present entries - net-caif: avoid user-triggerable WARN_ON(1) - ptp: dp83640: don't define PAGE0 - net/l2tp: Fix reference count leak in l2tp_udp_recv_core - r6040: Restore MDIO clock frequency after MAC reset - tipc: increase timeout in tipc_sk_enqueue() - events: Reuse value read using READ_ONCE instead of re-reading it - net/af_unix: fix a data-race in unix_dgram_poll - tcp: fix tp->undo_retrans accounting in tcp_sacktag_one() - mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range() - dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation - mfd: Don't use irq_create_mapping() to resolve a mapping - PCI: Add ACS quirks for Cavium multi-function devices - net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 - ethtool: Fix an error code in cxgb2.c - PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n - mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' - ARC: export clear_user_page() for modules - net: dsa: b53: Fix calculating number of switch ports - netfilter: socket: icmp6: fix use-after-scope - qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom - net: renesas: sh_eth: Fix freeing wrong tx descriptor - SUNRPC/nfs: Fix return value for nfs4_callback_compound() - usb: mtu3: use @mult for HS isoc or intr - usb: mtu3: fix the wrong HS mult value - lib/mpi: use kcalloc in mpi_resize - media: venus: venc: Fix potential null pointer dereference on pointer fmt - platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call - f2fs: fix to unmap pages from userspace process in punch_hole() - userfaultfd: prevent concurrent API initialization - arm64/sve: Use correct size when reinitialising SVE state - perf machine: Initialize srcline string member in add_location struct - net/mlx5: Fix potential sleeping in atomic context - net: hns3: pad the short tunnel frame before sending to hardware - mfd: axp20x: Update AXP288 volatile ranges - KVM: arm64: Handle PSCI resets before userspace touches vCPU state - ip_gre: validate csum_start only on pull -- Kleber Sacilotto de Souza