Focal update: v5.4.204 upstream stable release

[Kamal Mostafa]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v5.4.204 upstream stable release
       from git://git.kernel.org/

ipv6: take care of disable_policy when restoring routes
nvdimm: Fix badblocks clear off-by-one error
powerpc/prom_init: Fix kernel config grep
powerpc/bpf: Fix use of user_pt_regs in uapi
dm raid: fix accesses beyond end of raid member array
dm raid: fix KASAN warning in raid5_add_disks
s390/archrandom: simplify back to earlier design and initialize earlier
SUNRPC: Fix READ_PLUS crasher
net: rose: fix UAF bugs caused by timer handler
net: usb: ax88179_178a: Fix packet receiving
virtio-net: fix race between ndo_open() and virtio_device_ready()
selftests/net: pass ipv6_args to udpgso_bench's IPv6 TCP test
net: tun: unlink NAPI from device on destruction
net: tun: stop NAPI when detaching queues
RDMA/qedr: Fix reporting QP timeout attribute
linux/dim: Fix divide by 0 in RDMA DIM
usbnet: fix memory allocation in helpers
net: ipv6: unexport __init-annotated seg6_hmac_net_init()
caif_virtio: fix race between virtio_device_ready() and ndo_open()
PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events
s390: remove unneeded 'select BUILD_BIN2C'
netfilter: nft_dynset: restore set element counter when failing to update
net/sched: act_api: Notify user space if any actions were flushed before error
net: bonding: fix possible NULL deref in rlb code
net: bonding: fix use-after-free after 802.3ad slave unbind
nfc: nfcmrvl: Fix irq_of_parse_and_map() return value
NFC: nxp-nci: Don't issue a zero length i2c_master_read()
net: tun: avoid disabling NAPI twice
xen/gntdev: Avoid blocking in unmap_grant_pages()
hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails
net: dsa: bcm_sf2: force pause link settings
sit: use min
ipv6/sit: fix ipip6_tunnel_get_prl return value
rseq/selftests,x86_64: Add rseq_offset_deref_addv()
selftests/rseq: remove ARRAY_SIZE define from individual tests
selftests/rseq: introduce own copy of rseq uapi header
selftests/rseq: Remove useless assignment to cpu variable
selftests/rseq: Remove volatile from __rseq_abi
selftests/rseq: Introduce rseq_get_abi() helper
selftests/rseq: Introduce thread pointer getters
selftests/rseq: Uplift rseq selftests for compatibility with glibc-2.35
selftests/rseq: Fix ppc32: wrong rseq_cs 32-bit field pointer on big endian
selftests/rseq: Fix ppc32 missing instruction selection "u" and "x" for load/store
selftests/rseq: Fix ppc32 offsets by using long rather than off_t
selftests/rseq: Fix warnings about #if checks of undefined tokens
selftests/rseq: Remove arm/mips asm goto compiler work-around
selftests/rseq: Fix: work-around asm goto compiler bugs
selftests/rseq: x86-64: use %fs segment selector for accessing rseq thread area
selftests/rseq: x86-32: use %gs segment selector for accessing rseq thread area
selftests/rseq: Change type of rseq_offset to ptrdiff_t
xen/blkfront: fix leaking data in shared pages
xen/netfront: fix leaking data in shared pages
xen/netfront: force data bouncing when backend is untrusted
xen/blkfront: force data bouncing when backend is untrusted
xen/arm: Fix race in RB-tree based P2M accounting
net: usb: qmi_wwan: add Telit 0x1060 composition
net: usb: qmi_wwan: add Telit 0x1070 composition
clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup()
Linux 5.4.204
UBUNTU: Upstream stable to v5.4.204

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.4.0-128.144

---------------
linux (5.4.0-128.144) focal; urgency=medium

  * focal/linux: 5.4.0-128.144 -proposed tracker (LP: #1990152)

  * CVE-2022-3176
    - io_uring: disable polling pollfree files

  * ip/nexthop: fix default address selection for connected nexthop
    (LP: #1988809)
    - selftests/net: test nexthop without gw

  * ip/nexthop: fix default address selection for connected nexthop
    (LP: #1988809) // icmp_redirect.sh in ubuntu_kernel_selftests failed on
    Jammy 5.15.0-49.55 (LP: #1990124)
    - ip: fix triggering of 'icmp redirect'

linux (5.4.0-127.143) focal; urgency=medium

  * focal/linux: 5.4.0-127.143 -proposed tracker (LP: #1989892)

  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2022.09.19)

  * [UBUNTU 20.04] mlx5 driver crashes on accessing device attributes during
    recovery (LP: #1987287)
    - net/mlx5: Avoid processing commands before cmdif is ready

  * Focal update: v5.4.210 upstream stable release (LP: #1989230)
    - thermal: Fix NULL pointer dereferences in of_thermal_ functions
    - ACPI: video: Force backlight native for some TongFang devices
    - ACPI: video: Shortening quirk list by identifying Clevo by board_name only
    - ACPI: APEI: Better fix to avoid spamming the console with old error logs
    - bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds()
    - selftests/bpf: Extend verifier and bpf_sock tests for dst_port loads
    - bpf: Test_verifier, #70 error message updates for 32-bit right shift
    - KVM: Don't null dereference ops->destroy
    - selftests: KVM: Handle compiler optimizations in ucall
    - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls
    - macintosh/adb: fix oob read in do_adb_query() function
    - x86/speculation: Add RSB VM Exit protections
    - x86/speculation: Add LFENCE to RSB fill sequence
    - Linux 5.4.210

  * Focal update: v5.4.209 upstream stable release (LP: #1989228)
    - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
    - ntfs: fix use-after-free in ntfs_ucsncmp()
    - s390/archrandom: prevent CPACF trng invocations in interrupt context
    - tcp: Fix data-races around sysctl_tcp_dsack.
    - tcp: Fix a data-race around sysctl_tcp_app_win.
    - tcp: Fix a data-race around sysctl_tcp_adv_win_scale.
    - tcp: Fix a data-race around sysctl_tcp_frto.
    - tcp: Fix a data-race around sysctl_tcp_nometrics_save.
    - ice: check (DD | EOF) bits on Rx descriptor rather than (EOP | RS)
    - ice: do not setup vlan for loopback VSI
    - scsi: ufs: host: Hold reference returned by of_parse_phandle()
    - tcp: Fix a data-race around sysctl_tcp_limit_output_bytes.
    - tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit.
    - net: ping6: Fix memleak in ipv6_renew_options().
    - ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
    - igmp: Fix data-races around sysctl_igmp_qrv.
    - net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
    - tcp: Fix a data-race around sysctl_tcp_min_tso_segs.
    - tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen.
    -...

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-xilinx-zynqmp/5.4.0-1019.22 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!