SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.68 upstream stable release
from git://git.kernel.org/
mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
drm/bridge: Add stubs for devm_drm_of_get_bridge when OF is disabled
ACPI: thermal: drop an always true check
drm/vc4: hdmi: Rework power up
drm/vc4: hdmi: Depends on CONFIG_PM
firmware: tegra: bpmp: Do only aligned access to IPC memory area
crypto: lib - remove unneeded selection of XOR_BLOCKS
Drivers: hv: balloon: Support status report for larger page sizes
mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte
UBUNTU: [Config] updateconfigs for ARM64_ERRATUM_2441009
arm64: errata: Add Cortex-A510 to the repeat tlbi list
io_uring: Remove unused function req_ref_put
kbuild: Fix include path in scripts/Makefile.modpost
Bluetooth: L2CAP: Fix build errors in some archs
HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
udmabuf: Set the DMA mask for the udmabuf device (v2)
media: pvrusb2: fix memory leak in pvr_probe
HID: hidraw: fix memory leak in hidraw_release()
net: fix refcount bug in sk_psock_get (2)
fbdev: fb_pm2fb: Avoid potential divide by zero error
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
bpf: Don't redirect packets with invalid pkt_len
mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
ALSA: usb-audio: Add quirk for LH Labs Geek Out HD Audio 1V5
HID: add Lenovo Yoga C630 battery quirk
HID: AMD_SFH: Add a DMI quirk entry for Chromebooks
HID: asus: ROG NKey: Ignore portion of 0x5a report
HID: thrustmaster: Add sparco wheel and fix array length
drm/i915/gt: Skip TLB invalidations once wedged
mmc: mtk-sd: Clear interrupts when cqe off/disable
mmc: sdhci-of-dwcmshc: add reset call back for rockchip Socs
mmc: sdhci-of-dwcmshc: rename rk3568 to rk35xx
mmc: sdhci-of-dwcmshc: Re-enable support for the BlueField-3 SoC
btrfs: remove root argument from btrfs_unlink_inode()
btrfs: remove no longer needed logic for replaying directory deletes
btrfs: add and use helper for unlinking inode during log replay
btrfs: fix warning during log replay when bumping inode link count
fs/ntfs3: Fix work with fragmented xattr
ASoC: sh: rz-ssi: Improve error handling in rz_ssi_probe() error path
drm/amd/display: Avoid MPC infinite loop
drm/amd/display: Fix HDMI VSIF V3 incorrect issue
drm/amd/display: For stereo keep "FLIP_ANY_FRAME"
drm/amd/display: clear optc underflow before turn off odm clock
ksmbd: return STATUS_BAD_NETWORK_NAME error status if share is not configured
neigh: fix possible DoS due to net iface start/stop loop
s390/hypfs: avoid error message under KVM
ksmbd: don't remove dos attribute xattr on O_TRUNC open
drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid
drm/amd/display: Fix pixel clock programming
drm/amdgpu: Increase tlb flush timeout for sriov
drm/amd/display: avoid doing vm_init multiple time
netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
testing: selftests: nft_flowtable.sh: use random netns names
btrfs: move lockdep class helpers to locking.c
btrfs: fix lockdep splat with reloc root extent buffers
btrfs: tree-checker: check for overlapping extent items
kprobes: don't call disarm_kprobe() for disabled kprobes
btrfs: fix space cache corruption and potential double allocations
android: binder: fix lockdep check on clearing vma
net/af_packet: check len when min_header_len equals to 0
net: neigh: don't call kfree_skb() under spin_lock_irqsave()
Linux 5.15.65
UBUNTU: Upstream stable to v5.15.65
drm/msm/dsi: fix the inconsistent indenting
drm/msm/dp: delete DP_RECOVERED_CLOCK_OUT_EN to fix tps4
drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg
drm/msm/dsi: Fix number of regulators for SDM660
platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask
iio: adc: mcp3911: make use of the sign bit
skmsg: Fix wrong last sg check in sk_msg_recvmsg()
bpf: Restrict bpf_sys_bpf to CAP_PERFMON
bpf, cgroup: Fix kernel BUG in purge_effective_progs
ieee802154/adf7242: defer destroy_workqueue call
drm/i915/backlight: extract backlight code to a separate file
drm/i915/display: avoid warnings when registering dual panel backlight
ALSA: hda: intel-nhlt: remove use of __func__ in dev_dbg
ALSA: hda: intel-nhlt: Correct the handling of fmt_config flexible array
wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
Revert "xhci: turn off port power in shutdown"
net: sparx5: fix handling uneven length packets in manual extraction
net: smsc911x: Stop and start PHY during suspend and resume
openvswitch: fix memory leak at failed datapath creation
net: dsa: xrs700x: Use irqsave variant for u64 stats update
net: sched: tbf: don't call qdisc_put() while holding tree lock
net/sched: fix netdevice reference leaks in attach_default_qdiscs()
ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler
mlxbf_gige: compute MDIO period based on i1clk
kcm: fix strp_init() order and cleanup
sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb
tcp: annotate data-race around challenge_timestamp
Revert "sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb"
net/smc: Remove redundant refcount increase
soundwire: qcom: fix device status array range
serial: fsl_lpuart: RS485 RTS polariy is inverse
staging: rtl8712: fix use after free bugs
staging: r8188eu: add firmware dependency
powerpc: align syscall table for ppc32
vt: Clear selection before changing the font
musb: fix USB_MUSB_TUSB6010 dependency
tty: serial: lpuart: disable flow control while waiting for the transmit engine to complete
Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag
iio: ad7292: Prevent regulator double disable
iio: adc: mcp3911: use correct formula for AD conversion
misc: fastrpc: fix memory corruption on probe
misc: fastrpc: fix memory corruption on open
USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id
mmc: core: Fix UHS-I SD 1.8V workaround branch
mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch failure
binder: fix UAF of ref->proc caused by race condition
binder: fix alloc->vma_vm_mm null-ptr dereference
cifs: fix small mempool leak in SMB2_negotiate()
KVM: VMX: Heed the 'msr' argument in msr_write_intercepted()
drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported"
clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops
Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops"
clk: core: Fix runtime PM sequence in clk_core_unprepare()
Input: rk805-pwrkey - fix module autoloading
clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate
clk: bcm: rpi: Use correct order for the parameters of devm_kcalloc()
clk: bcm: rpi: Prevent out-of-bounds access
clk: bcm: rpi: Add missing newline
hwmon: (gpio-fan) Fix array out of bounds access
gpio: pca953x: Add mutex_lock for regcache sync in PM
KVM: x86: Mask off unsupported and unknown bits of IA32_ARCH_CAPABILITIES
xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()
mm: pagewalk: Fix race between unmap and page walker
xen-blkback: Advertise feature-persistent as user requested
xen-blkfront: Advertise feature-persistent as user requested
xen-blkfront: Cache feature_persistent value before advertisement
thunderbolt: Use the actual buffer in tb_async_error()
usb: dwc3: pci: Add support for Intel Raptor Lake
media: mceusb: Use new usb_control_msg_*() routines
xhci: Add grace period after xHC start to prevent premature runtime suspend.
USB: serial: cp210x: add Decagon UCA device id
USB: serial: option: add support for OPPO R11 diag port
USB: serial: option: add Quectel EM060K modem
USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode
usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles
usb: typec: intel_pmc_mux: Add new ACPI ID for Meteor Lake IOM device
usb: typec: tcpm: Return ENOTSUPP for power supply prop writes
usb: dwc2: fix wrong order of phy_power_on and phy_init
usb: cdns3: fix issue with rearming ISO OUT endpoint
usb: cdns3: fix incorrect handling TRB_SMM flag for ISOC transfer
USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020)
usb-storage: Add ignore-residue quirk for NXP PN7462AU
s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages
s390: fix nospec table alignments
USB: core: Prevent nested device-reset calls
usb: xhci-mtk: relax TT periodic bandwidth allocation
usb: xhci-mtk: fix bandwidth release issue
usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
driver core: Don't probe devices after bus_type.match() probe deferral
wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
wifi: mac80211: Fix UAF in ieee80211_scan_rx()
net: Use u64_stats_fetch_begin_irq() for stats fetch.
net: mac802154: Fix a condition in the receive path
ALSA: hda/realtek: Add speaker AMP init for Samsung laptops with ALC298
ALSA: seq: oss: Fix data-race for max_midi_devs access
ALSA: seq: Fix data-race at module auto-loading
drm/i915/glk: ECS Liva Q2 needs GLK HDMI port timing quirk
drm/i915: Skip wm/ddb readout for disabled pipes
tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()
kbuild: Add skip_encoding_btf_enum64 option to pahole
usb: dwc3: fix PHY disable sequence
usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup
usb: dwc3: disable USB core PHY management
USB: serial: ch341: fix lost character on LCR updates
USB: serial: ch341: fix disabled rx timer on older devices
Linux 5.15.66
UBUNTU: Upstream stable to v5.15.66
Linux 5.15.67
UBUNTU: Upstream stable to v5.15.67
net: wwan: iosm: remove pointless null check
efi: libstub: Disable struct randomization
efi: capsule-loader: Fix use-after-free in efi_capsule_write
wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd()
fs: only do a memory barrier for the first set_buffer_uptodate()
Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"
scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX
scsi: megaraid_sas: Fix double kfree()
drm/gem: Fix GEM handle release errors
drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini
drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup.
drm/radeon: add a force flush to delay work when radeon
scsi: ufs: core: Reduce the power mode change timeout
Revert "parisc: Show error if wrong 32/64-bit compiler is being used"
parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources()
parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines
arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
netfilter: conntrack: work around exceeded receive window
cpufreq: check only freq_table in __resolve_freq()
net/core/skbuff: Check the return value of skb_copy_bits()
md: Flush workqueue md_rdev_misc_wq in md_alloc()
fbdev: fbcon: Destroy mutex on freeing struct fb_info
fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init()
drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly
ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
ALSA: aloop: Fix random zeros in capture data when using jiffies timer
ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
tracing: Fix to check event_mutex is held while accessing trigger list
btrfs: zoned: set pseudo max append zone limit in zone emulation mode
vfio/type1: Unpin zero pages
kprobes: Prohibit probes in gate area
debugfs: add debugfs_lookup_and_remove()
sched/debug: fix dentry leak in update_sched_domain_debugfs
drm/amd/display: fix memory leak when using debugfs_lookup()
nvmet: fix a use-after-free
drm/i915: Implement WaEdpLinkRateDataReload
scsi: mpt3sas: Fix use-after-free warning
scsi: lpfc: Add missing destroy_workqueue() in error path
NFS: Further optimisations for 'ls -l'
NFS: Save some space in the inode
NFS: Fix another fsync() issue after a server reboot
cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree
cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
ASoC: qcom: sm8250: add missing module owner
RDMA/rtrs-clt: Use the right sg_cnt after ib_dma_map_sg
RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL
ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node
soc: imx: gpcv2: Assert reset before ungating clock
regulator: core: Clean up on enable failure
tee: fix compiler warning in tee_shm_register()
RDMA/cma: Fix arguments order in net device validation
soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs
RDMA/hns: Fix supported page size
RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift
wifi: wilc1000: fix DMA on stack objects
ARM: at91: pm: fix self-refresh for sama7g5
ARM: at91: pm: fix DDR recalibration when resuming from backup and self-refresh
ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output ranges
ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges
ARM: dts: at91: sama5d27_wlsom1: don't keep ldo2 enabled all the time
ARM: dts: at91: sama5d2_icp: don't keep vdd_other enabled all the time
netfilter: br_netfilter: Drop dst references before setting.
netfilter: nf_tables: clean up hook list when offload flags check fails
netfilter: nf_conntrack_irc: Fix forged IP logic
RDMA/srp: Set scmnd->result only when scmnd is not NULL
ALSA: usb-audio: Inform the delayed registration more properly
ALSA: usb-audio: Register card again for iface over delayed_register option
rxrpc: Fix ICMP/ICMP6 error handling
rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2()
afs: Use the operation issue time instead of the reply time for callbacks
Revert "net: phy: meson-gxl: improve link-up behavior"
sch_sfb: Don't assume the skb is still around after enqueueing to child
tipc: fix shift wrapping bug in map_get()
net: introduce __skb_fill_page_desc_noacc
tcp: TX zerocopy should not sense pfmemalloc status
ice: use bitmap_free instead of devm_kfree
i40e: Fix kernel crash during module removal
iavf: Detach device during reset task
xen-netback: only remove 'hotplug-status' when the vif is actually destroyed
RDMA/siw: Pass a pointer to virt_to_page()
ipv6: sr: fix out-of-bounds read when setting HMAC data.
IB/core: Fix a nested dead lock as part of ODP flow
RDMA/mlx5: Set local port to one when accessing counters
erofs: fix pcluster use-after-free on UP platforms
nvme-tcp: fix UAF when detecting digest errors
nvme-tcp: fix regression that causes sporadic requests to time out
tcp: fix early ETIMEDOUT after spurious non-SACK RTO
nvmet: fix mar and mor off-by-one errors
RDMA/irdma: Report the correct max cqes from query device
RDMA/irdma: Return correct WC error for bind operation failure
RDMA/irdma: Report RNR NAK generation in device caps
sch_sfb: Also store skb len before calling child enqueue
perf script: Fix Cannot print 'iregs' field for hybrid systems
hwmon: (tps23861) fix byte order in resistance register
ASoC: mchp-spdiftx: remove references to mchp_i2s_caps
ASoC: mchp-spdiftx: Fix clang -Wbitfield-constant-conversion
MIPS: loongson32: ls1c: Fix hang during startup
kbuild: disable header exports for UML in a straightforward way
i40e: Refactor tc mqprio checks
i40e: Fix ADQ rate limiting for PF
swiotlb: avoid potential left shift overflow
iommu/amd: use full 64-bit value in build_completion_wait()
s390/boot: fix absolute zero lowcore corruption on boot
hwmon: (mr75203) fix VM sensor allocation when "intel,vm-map" not defined
hwmon: (mr75203) update pvt->v_num and vm_num to the actual number of used sensors
hwmon: (mr75203) fix voltage equation for negative source input
hwmon: (mr75203) fix multi-channel voltage reading
hwmon: (mr75203) enable polling for all VM channels
arm64/bti: Disable in kernel BTI when cross section thunks are broken
UBUNTU: [Config] updateconfigs for ARM64_BTI_KERNEL
iommu/vt-d: Correctly calculate sagaw value of IOMMU
UBUNTU: [Config] updateconfigs for ARM64_ERRATUM_2457168
arm64: errata: add detection for AMEVCNTR01 incrementing incorrectly
drm/bridge: display-connector: implement bus fmts callbacks
perf machine: Use path__join() to compose a path instead of snprintf(dir, '/', filename)
ARM: at91: ddr: remove CONFIG_SOC_SAMA7 dependency
Linux 5.15.68
UBUNTU: Upstream stable to v5.15.68
Skipped:
"drm/i915: Implement WaEdpLinkRateDa
"netfilter: nf_conntrack_irc: Fix forged IP logic" which is already applied for CVE-2022-2663.