linux (4.15.0-162.170) bionic; urgency=medium

  * bionic/linux: 4.15.0-162.170 -proposed tracker (LP: #1947293)

  * Add final-checks to check certificates (LP: #1947174)
    - [Packaging] Add system trusted and revocation keys final check

  * CVE-2020-36385
    - RDMA/cma: Add missing locking to rdma_accept()
    - RDMA/ucma: Fix the locking of ctx->file
    - RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy

  * CVE-2021-28950
    - fuse: fix live lock in fuse_iget()

  * CVE-2020-36322
    - fuse: fix bad inode

  * Bionic update: upstream stable patchset 2021-10-13 (LP: #1947011)
    - rcu: Fix missed wakeup of exp_wq waiters
    - apparmor: remove duplicate macro list_entry_is_head()
    - crypto: talitos - fix max key size for sha384 and sha512
    - sctp: validate chunk size in __rcv_asconf_lookup
    - sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
    - dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
    - thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
    - 9p/trans_virtio: Remove sysfs file on probe failure
    - prctl: allow to setup brk for et_dyn executables
    - profiling: fix shift-out-of-bounds bugs
    - pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was
      registered
    - Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH
    - parisc: Move pci_dev_is_behind_card_dino to where it is used
    - dmaengine: ioat: depends on !UML
    - dmaengine: xilinx_dma: Set DMA mask for coherent APIs
    - ceph: lockdep annotations for try_nonblocking_invalidate
    - nilfs2: fix memory leak in nilfs_sysfs_create_device_group
    - nilfs2: fix NULL pointer in nilfs_##name##_attr_release
    - nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group
    - nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group
    - nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group
    - nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
    - pwm: rockchip: Don't modify HW state in .remove() callback
    - blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
    - drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV
    - nilfs2: use refcount_dec_and_lock() to fix potential UAF
    - drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION()

  * Invalid backport to v4.15: missing pgtable_l5_enabled (LP: #1946464)
    - SAUCE: Revert "x86/mm: Don't free P4D table when it is folded at runtime"

  * CVE-2021-38199
    - NFSv4: Initialise connection to the server in nfs4_alloc_client()

  * CVE-2019-19449
    - f2fs: fix wrong total_sections check and fsmeta check
    - f2fs: fix to do sanity check on segment/section count

  * vrf: fix refcnt leak with vxlan slaves (LP: #1945180)
    - ipv4: Fix device used for dst_alloc with local routes

  * Check for changes relevant for security certifications (LP: #1945989)
    - [Packaging] Add a new fips-checks script
    - [Packaging] Add fips-checks as part of finalchecks

  * CVE-2021-3759
    - memcg: enable accounting of ipc resources

  * Bionic update: upstream stable patchset 2021-09-27 (LP: #1945224)
    - ARC: Fix CONFIG_STACKDEPOT
    - can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX
      and TX error counters
    - Revert "USB: serial: ch341: fix character loss at high transfer rates"
    - USB: serial: option: add new VID/PID to support Fibocom FG150
    - usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
    - usb: dwc3: gadget: Stop EP0 transfers during pullup disable
    - IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
    - e1000e: Fix the max snoop/no-snoop latency for 10M
    - ip_gre: add validation for csum_start
    - xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()'
    - net: marvell: fix MVNETA_TX_IN_PRGRS bit number
    - usb: gadget: u_audio: fix race condition on endpoint stop
    - opp: remove WARN when no valid OPPs remain
    - virtio: Improve vq->broken access to avoid any compiler optimization
    - vringh: Use wiov->used to check for read/write desc order
    - drm: Copy drm_wait_vblank to user before returning
    - drm/nouveau/disp: power down unused DP links during init
    - net/rds: dma_map_sg is entitled to merge entries
    - vt_kdsetmode: extend console locking
    - fbmem: add margin check to fb_check_caps()
    - KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs
    - Revert "floppy: reintroduce O_NDELAY fix"
    - net: qrtr: fix another OOB Read in qrtr_endpoint_post
    - net: hns3: fix get wrong pfc_en when query PFC configuration
    - xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
    - qed: Fix the VF msix vectors flow
    - net: macb: Add a NULL check on desc_ptp
    - qede: Fix memset corruption
    - perf/x86/intel/pt: Fix mask of num_address_ranges
    - perf/x86/amd/ibs: Work around erratum #1197
    - cryptoloop: add a deprecation warning
    - ARM: 8918/2: only build return_address() if needed
    - ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
    - clk: fix build warning for orphan_list
    - media: stkwebcam: fix memory leak in stk_camera_probe
    - igmp: Add ip_mc_list lock in ip_check_mc_rcu
    - USB: serial: mos7720: improve OOM-handling in read_mos_reg()
    - f2fs: fix potential overflow
    - ath10k: fix recent bandwidth conversion bug
    - ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing
      table (v2)
    - crypto: talitos - reduce max key size for SEC1
    - powerpc/module64: Fix comment in R_PPC64_ENTRY handling
    - powerpc/boot: Delete unneeded .globl _zimage_start
    - net: ll_temac: Remove left-over debug message
    - mm/page_alloc: speed up the iteration of max_order
    - Revert "btrfs: compression: don't try to compress if we don't have enough
      pages"
    - usb: host: xhci-rcar: Don't reload firmware after the completion
    - x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
    - PCI: Call Max Payload Size-related fixup quirks early
    - regmap: fix the offset of register error log
    - crypto: mxs-dcp - Check for DMA mapping errors
    - power: supply: axp288_fuel_gauge: Report register-address on readb / writeb
      errors
    - crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
    - udf: Check LVID earlier
    - isofs: joliet: Fix iocharset=utf8 mount option
    - nvme-rdma: don't update queue count when failing to set io queues
    - power: supply: max17042_battery: fix typo in MAx17042_TOFF
    - s390/cio: add dev_busid sysfs entry for each subchannel
    - libata: fix ata_host_start()
    - crypto: qat - do not ignore errors from enable_vf2pf_comms()
    - crypto: qat - handle both source of interrupt in VF ISR
    - crypto: qat - fix reuse of completion variable
    - crypto: qat - fix naming for init/shutdown VF to PF notifications
    - crypto: qat - do not export adf_iov_putmsg()
    - udf_get_extendedattr() had no boundary checks.
    - m68k: emu: Fix invalid free in nfeth_cleanup()
    - spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
    - spi: spi-pic32: Fix issue with uninitialized dma_slave_config
    - clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock
      source channel
    - crypto: qat - use proper type for vf_mask
    - certs: Trigger creation of RSA module signing key if it's not an RSA key
    - soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
    - media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
    - media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
    - media: go7007: remove redundant initialization
    - Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
    - tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
    - net: cipso: fix warnings in netlbl_cipsov4_add_std
    - i2c: highlander: add IRQ check
    - media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
    - PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
    - PCI: PM: Enable PME if it can be signaled from D3cold
    - soc: qcom: smsm: Fix missed interrupts if state changes while masked
    - Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
    - arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
    - Bluetooth: fix repeated calls to sco_sock_kill
    - drm/msm/dsi: Fix some reference counted resource leaks
    - usb: gadget: udc: at91: add IRQ check
    - usb: phy: fsl-usb: add IRQ check
    - usb: phy: twl6030: add IRQ checks
    - Bluetooth: Move shutdown callback before flushing tx and rx queue
    - usb: host: ohci-tmio: add IRQ check
    - usb: phy: tahvo: add IRQ check
    - mac80211: Fix insufficient headroom issue for AMSDU
    - usb: gadget: mv_u3d: request_irq() after initializing UDC
    - Bluetooth: add timeout sanity check to hci_inquiry
    - i2c: iop3xx: fix deferred probing
    - i2c: s3c2410: fix IRQ check
    - mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
    - mmc: moxart: Fix issue with uninitialized dma_slave_config
    - CIFS: Fix a potencially linear read overflow
    - i2c: mt65xx: fix IRQ check
    - usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
    - usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA
      config is available
    - tty: serial: fsl_lpuart: fix the wrong mapbase value
    - ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
    - bcma: Fix memory leak for internally-handled cores
    - ipv4: make exception cache less predictible
    - net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
    - net: qualcomm: fix QCA7000 checksum handling
    - netns: protect netns ID lookups with RCU
    - tty: Fix data race between tiocsti() and flush_to_ldisc()
    - x86/resctrl: Fix a maybe-uninitialized build warning treated as error
    - KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is
      adjusted
    - IMA: remove -Wmissing-prototypes warning
    - backlight: pwm_bl: Improve bootloader/kernel device handover
    - clk: kirkwood: Fix a clocking boot regression
    - fbmem: don't allow too huge resolutions
    - rtc: tps65910: Correct driver module alias
    - blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
    - blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
    - PCI/MSI: Skip masking MSI-X on Xen PV
    - powerpc/perf/hv-gpci: Fix counter value parsing
    - xen: fix setting of max_pfn in shared_info
    - include/linux/list.h: add a macro to test if entry is pointing to the head
    - 9p/xen: Fix end of loop tests for list_for_each_entry
    - soc: aspeed: lpc-ctrl: Fix boundary check for mmap
    - crypto: public_key: fix overflow during implicit conversion
    - block: bfq: fix bfq_set_next_ioprio_data()
    - power: supply: max17042: handle fails of reading status register
    - dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()
    - VMCI: fix NULL pointer dereference when unmapping queue pair
    - media: uvc: don't do DMA on stack
    - media: rc-loopback: return number of emitters rather than error
    - libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
    - ARM: 9105/1: atags_to_fdt: don't warn about stack size
    - PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
    - PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
    - PCI: xilinx-nwl: Enable the clock through CCF
    - PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response
    - PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
    - HID: input: do not report stylus battery state as "full"
    - RDMA/iwcm: Release resources if iw_cm module initialization fails
    - docs: Fix infiniband uverbs minor number
    - pinctrl: samsung: Fix pinctrl bank pin count
    - vfio: Use config not menuconfig for VFIO_NOIOMMU
    - openrisc: don't printk() unconditionally
    - pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
    - scsi: qedi: Fix error codes in qedi_alloc_global_queues()
    - MIPS: Malta: fix alignment of the devicetree buffer
    - media: dib8000: rewrite the init prbs logic
    - crypto: mxs-dcp - Use sg_mapping_iter to copy data
    - PCI: Use pci_update_current_state() in pci_enable_device_flags()
    - iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
    - ARM: dts: qcom: apq8064: correct clock names
    - video: fbdev: kyro: fix a DoS bug by restricting user input
    - netlink: Deal with ESRCH error in nlmsg_notify()
    - Smack: Fix wrong semantics in smk_access_entry()
    - usb: host: fotg210: fix the endpoint's transactional opportunities
      calculation
    - usb: host: fotg210: fix the actual_length of an iso packet
    - usb: gadget: u_ether: fix a potential null pointer dereference
    - usb: gadget: composite: Allow bMaxPower=0 if self-powered
    - staging: board: Fix uninitialized spinlock when attaching genpd
    - tty: serial: jsm: hold port lock when reporting modem line changes
    - bpf/tests: Fix copy-and-paste error in double word test
    - bpf/tests: Do not PASS tests without actually testing the result
    - video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
    - video: fbdev: kyro: Error out if 'pixclock' equals zero
    - video: fbdev: riva: Error out if 'pixclock' equals zero
    - ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
    - flow_dissector: Fix out-of-bounds warnings
    - s390/jump_label: print real address in a case of a jump label bug
    - serial: 8250: Define RX trigger levels for OxSemi 950 devices
    - xtensa: ISS: don't panic in rs_init
    - hvsi: don't panic on tty_register_driver failure
    - serial: 8250_pci: make setup_port() parameters explicitly unsigned
    - staging: ks7010: Fix the initialization of the 'sleep_status' structure
    - ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()
    - Bluetooth: skip invalid hci_sync_conn_complete_evt
    - ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the
      matching in-/output
    - media: v4l2-dv-timings.c: fix wrong condition in two for-loops
    - arm64: dts: qcom: sdm660: use reg value for memory node
    - net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe()
    - Bluetooth: avoid circular locks in sco_sock_connect
    - gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable
      access in amdgpu_i2c_router_select_ddc_port()
    - ARM: tegra: tamonten: Fix UART pad setting
    - rpc: fix gss_svc_init cleanup on failure
    - staging: rts5208: Fix get_ms_information() heap buffer size
    - gfs2: Don't call dlm after protocol is unmounted
    - mmc: sdhci-of-arasan: Check return value of non-void funtions
    - mmc: rtsx_pci: Fix long reads when clock is prescaled
    - selftests/bpf: Enlarge select() timeout for test_maps
    - cifs: fix wrong release in sess_alloc_buffer() failed path
    - Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST
      quirk set"
    - usb: musb: musb_dsps: request_irq() after initializing musb
    - usbip: give back URBs for unsent unlink requests during cleanup
    - usbip:vhci_hcd USB port can get stuck in the disabled state
    - ASoC: rockchip: i2s: Fix regmap_ops hang
    - ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B
    - parport: remove non-zero check on count
    - ath9k: fix OOB read ar9300_eeprom_restore_internal
    - ath9k: fix sleeping in atomic context
    - net: fix NULL pointer reference in cipso_v4_doi_free
    - net: w5100: check return value after calling platform_get_resource()
    - parisc: fix crash with signals and alloca
    - scsi: BusLogic: Fix missing pr_cont() use
    - scsi: qla2xxx: Sync queue idx with queue_pair_map idx
    - cpufreq: powernv: Fix init_chip_info initialization in numa=off
    - mm/hugetlb: initialize hugetlb_usage in mm_init
    - memcg: enable accounting for pids in nested pid namespaces
    - platform/chrome: cros_ec_proto: Send command again when timeout occurs
    - xen: reset legacy rtc flag for PV domU
    - bnx2x: Fix enabling network interfaces without VFs
    - PM: base: power: don't try to use non-existing RTC for storing data
    - x86/mm: Fix kern_addr_valid() to cope with existing but not present entries
    - net-caif: avoid user-triggerable WARN_ON(1)
    - ptp: dp83640: don't define PAGE0
    - net/l2tp: Fix reference count leak in l2tp_udp_recv_core
    - r6040: Restore MDIO clock frequency after MAC reset
    - tipc: increase timeout in tipc_sk_enqueue()
    - events: Reuse value read using READ_ONCE instead of re-reading it
    - net/af_unix: fix a data-race in unix_dgram_poll
    - tcp: fix tp->undo_retrans accounting in tcp_sacktag_one()
    - mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range()
    - dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation
    - mfd: Don't use irq_create_mapping() to resolve a mapping
    - PCI: Add ACS quirks for Cavium multi-function devices
    - net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920
    - ethtool: Fix an error code in cxgb2.c
    - PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n
    - mtd: rawnand: cafe: Fix a resource leak in the error handling path of
      'cafe_nand_probe()'
    - ARC: export clear_user_page() for modules
    - net: dsa: b53: Fix calculating number of switch ports
    - netfilter: socket: icmp6: fix use-after-scope
    - qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom
    - net: renesas: sh_eth: Fix freeing wrong tx descriptor
    - SUNRPC/nfs: Fix return value for nfs4_callback_compound()
    - usb: mtu3: use @mult for HS isoc or intr
    - usb: mtu3: fix the wrong HS mult value
    - lib/mpi: use kcalloc in mpi_resize
    - media: venus: venc: Fix potential null pointer dereference on pointer fmt
    - platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from
      run_smbios_call
    - f2fs: fix to unmap pages from userspace process in punch_hole()
    - userfaultfd: prevent concurrent API initialization
    - arm64/sve: Use correct size when reinitialising SVE state
    - perf machine: Initialize srcline string member in add_location struct
    - net/mlx5: Fix potential sleeping in atomic context
    - net: hns3: pad the short tunnel frame before sending to hardware
    - mfd: axp20x: Update AXP288 volatile ranges
    - KVM: arm64: Handle PSCI resets before userspace touches vCPU state
    - ip_gre: validate csum_start only on pull

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Mon, 18 Oct 2021 12:35:58 +0200

linux (4.15.0-161.169) bionic; urgency=medium

  * bionic/linux: 4.15.0-161.169 -proposed tracker (LP: #1947358)

  * Bionic/linux-aws Boot failure downgrading from Bionic/linux-aws-5.4 on
    r5.metal (LP: #1946149)
    - SAUCE: Revert "PCI/MSI: Enforce MSI[X] entry updates to be visible"
    - SAUCE: Revert "PCI/MSI: Enforce that MSI-X table entry is masked for update"

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 15 Oct 2021 15:16:33 +0200

linux (4.15.0-160.168) bionic; urgency=medium

  * bionic/linux: 4.15.0-160.168 -proposed tracker (LP: #1944933)

  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2021.09.27)

  * ext4 journal recovery fails w/ data=journal + mmap (LP: #1847340)
    - jbd2: introduce/export functions
      jbd2_journal_submit|finish_inode_data_buffers()
    - jbd2, ext4, ocfs2: introduce/use journal callbacks
      j_submit|finish_inode_data_buffers()
    - ext4: data=journal: fixes for ext4_page_mkwrite()
    - ext4: data=journal: write-protect pages on j_submit_inode_data_buffers()
    - ext4: fix mmap write protection for data=journal mode

  * CVE-2021-40490
    - ext4: fix race writing to an inline_data file while its xattrs are changing

  * Bionic update: upstream stable patchset 2021-09-22 (LP: #1944600)
    - iio: humidity: hdc100x: Add margin to the conversion time
    - iio: adc: Fix incorrect exit of for-loop
    - ASoC: intel: atom: Fix reference to PCM buffer address
    - i2c: dev: zero out array used for i2c reads from userspace
    - ACPI: NFIT: Fix support for virtual SPA ranges
    - ASoC: cs42l42: Correct definition of ADC Volume control
    - ASoC: cs42l42: Don't allow SND_SOC_DAIFMT_LEFT_J
    - ASoC: cs42l42: Fix inversion of ADC Notch Switch control
    - ASoC: cs42l42: Remove duplicate control for WNF filter frequency
    - net: dsa: mt7530: add the missing RxUnicast MIB counter
    - ppp: Fix generating ifname when empty IFLA_IFNAME is specified
    - psample: Add a fwd declaration for skbuff
    - net: Fix memory leak in ieee802154_raw_deliver
    - net: bridge: fix memleak in br_add_if()
    - tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B
      packets
    - xen/events: Fix race in set_evtchn_to_irq
    - vsock/virtio: avoid potential deadlock when vsock device remove
    - powerpc/kprobes: Fix kprobe Oops happens in booke
    - x86/tools: Fix objdump version check again
    - x86/resctrl: Fix default monitoring groups reporting
    - PCI/MSI: Enable and mask MSI-X early
    - PCI/MSI: Do not set invalid bits in MSI mask
    - PCI/MSI: Correct misleading comments
    - PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()
    - PCI/MSI: Protect msi_desc::masked for multi-MSI
    - PCI/MSI: Mask all unused MSI-X entries
    - PCI/MSI: Enforce that MSI-X table entry is masked for update
    - PCI/MSI: Enforce MSI[X] entry updates to be visible
    - vmlinux.lds.h: Handle clang's module.{c,d}tor sections
    - mac80211: drop data frames without key on encrypted links
    - x86/fpu: Make init_fpstate correct with optimized XSAVE
    - ath: Use safer key clearing with key cache entries
    - ath9k: Clear key cache explicitly on disabling hardware
    - ath: Export ath_hw_keysetmac()
    - ath: Modify ath_key_delete() to not need full key entry
    - ath9k: Postpone key cache entry deletion for TXQ frames reference it
    - dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe()
    - ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218
    - dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not
      yet available
    - scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()
    - scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()
    - scsi: core: Avoid printing an error if target_alloc() returns -ENXIO
    - ARM: dts: nomadik: Fix up interrupt controller node names
    - net: usb: lan78xx: don't modify phy_device state concurrently
    - Bluetooth: hidp: use correct wait queue when removing ctrl_wait
    - dccp: add do-while-0 stubs for dccp_pr_debug macros
    - vhost: Fix the calculation in vhost_overflow()
    - bnxt: don't lock the tx queue from napi poll
    - net: 6pack: fix slab-out-of-bounds in decode_data
    - ptp_pch: Restore dependency on PCI
    - net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
    - net: mdio-mux: Don't ignore memory allocation errors
    - net: mdio-mux: Handle -EPROBE_DEFER correctly
    - mmc: dw_mmc: Fix hang on data CRC error
    - ALSA: hda - fix the 'Capture Switch' value change notifications
    - ipack: tpci200: fix many double free issues in tpci200_pci_probe
    - btrfs: prevent rename2 from exchanging a subvol with a directory from
      different parents
    - ASoC: intel: atom: Fix breakage for PCM buffer address setup
    - locks: print a warning when mount fails due to lack of "mand" support
    - fs: warn about impending deprecation of mandatory locks
    - netfilter: nft_exthdr: fix endianness of tcp option cast
    - KVM: X86: MMU: Use the correct inherited permissions to get shadow page
    - ASoC: cs42l42: Fix LRCLK frame start edge
    - net: igmp: fix data-race in igmp_ifc_timer_expire()
    - net: dsa: lan9303: fix broken backpressure in .port_fdb_dump
    - genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP
    - x86/msi: Force affinity setup before startup
    - x86/ioapic: Force affinity setup before startup
    - genirq/msi: Ensure deactivation on teardown

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 24 Sep 2021 14:37:18 +0200

linux (4.15.0-159.167) bionic; urgency=medium

  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2021.09.06)

  * dell300x: rsi wifi and bluetooth crash after suspend and resume
    (LP: #1940488)
    - Revert "rsi: Use resume_noirq for SDIO"

  *  LRMv5: switch primary version handling to kernel-versions data set
    (LP: #1928921)
    - [Packaging] switch to kernel-versions

  * kvm_unit_tests: emulator test fails on 4.4 / 4.15 kernel, timeout
    (LP: #1932966)
    - kvm: Add emulation for movups/movupd

  * memory leaking when removing a profile (LP: #1939915)
    - security/apparmor/label.c: Clean code by removing redundant instructions
    - apparmor: Fix memory leak of profile proxy

  * ubunut_kernel_selftests: memory-hotplug: avoid spamming logs with
    dump_page() (LP: #1941829)
    - selftests: memory-hotplug: avoid spamming logs with dump_page(), ratio limit
      hot-remove error test

  * Bionic update: upstream stable patchset 2021-08-27 (LP: #1941916)
    - btrfs: mark compressed range uptodate only if all bio succeed
    - regulator: rt5033: Fix n_voltages settings for BUCK and LDO
    - r8152: Fix potential PM refcount imbalance
    - qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union()
    - net: Fix zero-copy head len calculation.
    - Revert "Bluetooth: Shutdown controller after workqueues are flushed or
      cancelled"
    - KVM: do not allow mapping valid but non-reference-counted pages
    - Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout"
    - spi: mediatek: Fix fifo transfer
    - padata: validate cpumask without removed CPU during offline
    - Revert "ACPICA: Fix memory leak caused by _CID repair function"
    - ALSA: seq: Fix racy deletion of subscriber
    - clk: stm32f4: fix post divisor setup for I2S/SAI PLLs
    - omap5-board-common: remove not physically existing vdds_1v8_main fixed-
      regulator
    - scsi: sr: Return correct event when media event code is 3
    - media: videobuf2-core: dequeue if start_streaming fails
    - net: natsemi: Fix missing pci_disable_device() in probe and remove
    - nfp: update ethtool reporting of pauseframe control
    - mips: Fix non-POSIX regexp
    - bnx2x: fix an error code in bnx2x_nic_load()
    - net: pegasus: fix uninit-value in get_interrupt_interval
    - net: fec: fix use-after-free in fec_drv_remove
    - net: vxge: fix use-after-free in vxge_device_unregister
    - Bluetooth: defer cleanup of resources in hci_unregister_dev()
    - USB: usbtmc: Fix RCU stall warning
    - USB: serial: option: add Telit FD980 composition 0x1056
    - USB: serial: ch341: fix character loss at high transfer rates
    - USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2
    - usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers
    - usb: gadget: f_hid: fixed NULL pointer dereference
    - usb: gadget: f_hid: idle uses the highest byte for duration
    - usb: otg-fsm: Fix hrtimer list corruption
    - scripts/tracing: fix the bug that can't parse raw_trace_func
    - staging: rtl8723bs: Fix a resource leak in sd_int_dpc
    - media: rtl28xxu: fix zero-length control request
    - pipe: increase minimum default pipe size to 2 pages
    - ext4: fix potential htree corruption when growing large_dir directories
    - serial: 8250: Mask out floating 16/32-bit bus bits
    - MIPS: Malta: Do not byte-swap accesses to the CBUS UART
    - pcmcia: i82092: fix a null pointer dereference bug
    - spi: meson-spicc: fix memory leak in meson_spicc_remove
    - perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest
    - qmi_wwan: add network device usage statistics for qmimux devices
    - libata: fix ata_pio_sector for CONFIG_HIGHMEM
    - reiserfs: add check for root_inode in reiserfs_fill_super
    - reiserfs: check directory items on read from disk
    - alpha: Send stop IPI to send to online CPUs
    - net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and
      ql_adapter_reset
    - USB:ehci:fix Kunpeng920 ehci hardware problem
    - ppp: Fix generating ppp unit id when ifname is not specified
    - ovl: prevent private clone if bind mount is not allowed
    - net: xilinx_emaclite: Do not print real IOMEM pointer
    - KVM: x86: accept userspace interrupt only if no event is injected
    - KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds

  * Bionic update: upstream stable patchset 2021-08-17 (LP: #1940315)
    - selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c
    - KVM: x86: determine if an exception has an error code only when injecting
      it.
    - net: split out functions related to registering inflight socket files
    - [Config] updateconfigs for UNIX_SCM
    - af_unix: fix garbage collect vs MSG_PEEK
    - net/802/mrp: fix memleak in mrp_request_join()
    - net/802/garp: fix memleak in garp_request_join()
    - net: annotate data race around sk_ll_usec
    - sctp: move 198 addresses from unusable to private scope
    - hfs: add missing clean-up in hfs_fill_super
    - hfs: fix high memory mapping in hfs_bnode_read
    - hfs: add lock nesting notation to hfs_find_init
    - ARM: dts: versatile: Fix up interrupt controller node names
    - virtio_net: Do not pull payload in skb->head
    - gro: ensure frag0 meets IP header alignment
    - x86/kvm: fix vcpu-id indexed array sizes
    - ocfs2: fix zero out valid data
    - ocfs2: issue zeroout to EOF blocks
    - can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
    - can: mcba_usb_start(): add missing urb->transfer_dma initialization
    - can: usb_8dev: fix memory leak
    - can: ems_usb: fix memory leak
    - can: esd_usb2: fix memory leak
    - NIU: fix incorrect error return, missed in previous revert
    - nfc: nfcsim: fix use after free during module unload
    - x86/asm: Ensure asm/proto.h can be included stand-alone
    - cfg80211: Fix possible memory leak in function cfg80211_bss_update
    - netfilter: conntrack: adjust stop timestamp to real expiry value
    - netfilter: nft_nat: allow to specify layer 4 protocol NAT only
    - tipc: fix sleeping in tipc accept routine
    - mlx4: Fix missing error code in mlx4_load_one()
    - net: llc: fix skb_over_panic
    - net/mlx5: Fix flow table chaining
    - sctp: fix return value check in __sctp_rcv_asconf_lookup
    - tulip: windbond-840: Fix missing pci_disable_device() in probe and remove
    - sis900: Fix missing pci_disable_device() in probe and remove
    - can: hi311x: fix a signedness bug in hi3110_cmd()
    - i40e: Fix log TC creation failure when max num of queues is exceeded
    - i40e: Add additional info to PHY type error

  * Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913)
    - ARM: dts: gemini: add device_type on pci
    - ARM: dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288
    - arm64: dts: rockchip: fix pinctrl sleep nodename for rk3399.dtsi
    - ARM: dts: rockchip: Fix the timer clocks order
    - ARM: dts: rockchip: Fix power-controller node names for rk3288
    - arm64: dts: rockchip: Fix power-controller node names for rk3328
    - reset: ti-syscon: fix to_ti_syscon_reset_data macro
    - ARM: brcmstb: dts: fix NAND nodes names
    - ARM: Cygnus: dts: fix NAND nodes names
    - ARM: NSP: dts: fix NAND nodes names
    - ARM: dts: BCM63xx: Fix NAND nodes names
    - ARM: dts: imx6: phyFLEX: Fix UART hardware flow control
    - ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info
    - ARM: dts: stm32: fix RCC node name on stm32f429 MCU
    - arm64: dts: juno: Update SCPI nodes as per the YAML schema
    - arm64: dts: ls208xa: remove bus-num from dspi node
    - thermal/core: Correct function name thermal_zone_device_unregister()
    - kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set
    - rtc: max77686: Do not enforce (incorrect) interrupt trigger type
    - scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
    - scsi: libfc: Fix array index out of bound exception
    - sched/fair: Fix CFS bandwidth hrtimer expiry type
    - net: ipv6: fix return value of ip6_skb_dst_mtu
    - netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo
    - net: bridge: sync fdb to new unicast-filtering ports
    - net: bcmgenet: Ensure all TX/RX queues DMAs are disabled
    - net: moxa: fix UAF in moxart_mac_probe
    - net: qcom/emac: fix UAF in emac_remove
    - net: ti: fix UAF in tlan_remove_one
    - net: send SYNACK packet with accepted fwmark
    - net: validate lwtstate->data before returning from skb_tunnel_info()
    - dma-buf/sync_file: Don't leak fences on merge failure
    - tcp: annotate data races around tp->mtu_info
    - ipv6: tcp: drop silly ICMPv6 packet too big messages
    - igb: Fix use-after-free error during reset
    - ixgbe: Fix an error handling path in 'ixgbe_probe()'
    - igb: Fix an error handling path in 'igb_probe()'
    - fm10k: Fix an error handling path in 'fm10k_probe()'
    - e1000e: Fix an error handling path in 'e1000_probe()'
    - iavf: Fix an error handling path in 'iavf_probe()'
    - igb: Check if num of q_vectors is smaller than max before array access
    - perf probe: Fix dso->nsinfo refcounting
    - perf lzma: Close lzma stream on exit
    - perf test bpf: Free obj_buf
    - perf probe-file: Delete namelist in del_events() on the error path
    - spi: mediatek: fix fifo rx mode
    - liquidio: Fix unintentional sign extension issue on left shift of u16
    - s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1]
    - net: fix uninit-value in caif_seqpkt_sendmsg
    - net: decnet: Fix sleeping inside in af_decnet
    - netrom: Decrease sock refcount when sock timers expire
    - scsi: iscsi: Fix iface sysfs attr detection
    - scsi: target: Fix protect handling in WRITE SAME(32)
    - spi: cadence: Correct initialisation of runtime PM again
    - Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem"
    - proc: Avoid mixing integer types in mem_rw()
    - s390/ftrace: fix ftrace_update_ftrace_func implementation
    - ALSA: sb: Fix potential ABBA deadlock in CSP driver
    - xhci: Fix lost USB 2 remote wake
    - KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow
    - usb: hub: Disable USB 3 device initiated lpm if exit latency is too high
    - USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS
    - usb: max-3421: Prevent corruption of freed memory
    - usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()
    - USB: serial: option: add support for u-blox LARA-R6 family
    - USB: serial: cp210x: fix comments for GE CS1000
    - USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
    - usb: dwc2: gadget: Fix sending zero length packet in DDMA mode.
    - tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
    - media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
    - ixgbe: Fix packet corruption due to missing DMA sync
    - selftest: use mmap instead of posix_memalign to allocate memory
    - drm: Return -ENOTTY for non-drm ioctls
    - net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear
    - iio: accel: bma180: Use explicit member assignment
    - iio: accel: bma180: Fix BMA25x bandwidth register values
    - btrfs: compression: don't try to compress if we don't have enough pages
    - spi: spi-fsl-dspi: Fix a resource leak in an error handling path
    - xhci: add xhci_get_virt_ep() helper
    - bpftool: Properly close va_list 'ap' by va_end() on error
    - net: ip_tunnel: fix mtu calculation for ETHER tunnel devices
    - nvme-pci: do not call nvme_dev_remove_admin from nvme_remove
    - perf dso: Fix memory leak in dso__new_map()
    - net/tcp_fastopen: fix data races around tfo_active_disable_stamp
    - nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
    - drm/panel: raspberrypi-touchscreen: Prevent double-free
    - KVM: do not assume PTE is writable after follow_pfn
    - KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped()
    - net: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz
    - workqueue: fix UAF in pwq_unbound_release_workfn()
    - upstream stable to v4.14.241, v4.19.200

 -- Kelsey Skunberg <kelsey.skunberg@canonical.com>  Mon, 20 Sep 2021 16:11:14 -0600

linux (4.15.0-158.166) bionic; urgency=medium

  * s390x BPF JIT vulnerabilities (LP: #1943960)
    - SAUCE: s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant
    - SAUCE: s390/bpf: Fix optimizing out zero-extensions

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 17 Sep 2021 13:44:16 -0300

linux (4.15.0-156.163) bionic; urgency=medium

  * bionic/linux: 4.15.0-156.163 -proposed tracker (LP: #1940162)

  * linux (LP: #1940564)
    - SAUCE: Revert "scsi: core: Cap scsi_host cmd_per_lun at can_queue"

  * fails to launch linux L2 guests on AMD (LP: #1940134) // CVE-2021-3653
    - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl
      (CVE-2021-3653)

  * fails to launch linux L2 guests on AMD (LP: #1940134)
    - SAUCE: Revert "UBUNTU: SAUCE: KVM: nSVM: avoid picking up unsupported bits
      from L2 in int_ctl"

 -- Kelsey Skunberg <kelsey.skunberg@canonical.com>  Thu, 19 Aug 2021 16:30:31 -0600

linux (4.15.0-155.162) bionic; urgency=medium

  * bionic/linux: 4.15.0-155.162 -proposed tracker (LP: #1939833)

  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2021.08.16)

  * CVE-2021-3656
    - SAUCE: KVM: nSVM: always intercept VMLOAD/VMSAVE when nested

  * CVE-2021-3653
    - SAUCE: KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl

  * dev_forward_skb: do not scrub skb mark within the same name space
    (LP: #1935040)
    - dev_forward_skb: do not scrub skb mark within the same name space

  * 'ptrace trace' needed to readlink() /proc/*/ns/* files on older kernels
    (LP: #1890848)
    - apparmor: fix ptrace read check

  * Bionic update: upstream stable patchset 2021-08-03 (LP: #1938824)
    - ALSA: usb-audio: fix rate on Ozone Z90 USB headset
    - media: dvb-usb: fix wrong definition
    - Input: usbtouchscreen - fix control-request directions
    - net: can: ems_usb: fix use-after-free in ems_usb_disconnect()
    - usb: gadget: eem: fix echo command packet response issue
    - USB: cdc-acm: blacklist Heimann USB Appset device
    - ntfs: fix validity check for file name attribute
    - iov_iter_fault_in_readable() should do nothing in xarray case
    - Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl
    - ARM: dts: at91: sama5d4: fix pinctrl muxing
    - btrfs: send: fix invalid path for unlink operations after parent
      orphanization
    - btrfs: clear defrag status of a root if starting transaction fails
    - ext4: cleanup in-core orphan list if ext4_truncate() failed to get a
      transaction handle
    - ext4: fix kernel infoleak via ext4_extent_header
    - ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit
    - ext4: remove check for zero nr_to_scan in ext4_es_scan()
    - ext4: fix avefreec in find_group_orlov
    - ext4: use ext4_grp_locked_error in mb_find_extent
    - can: gw: synchronize rcu operations before removing gw job entry
    - can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in
      TX path
    - SUNRPC: Fix the batch tasks count wraparound.
    - SUNRPC: Should wake up the privileged task firstly.
    - s390/cio: dont call css_wait_for_slow_path() inside a lock
    - rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path
    - iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and PS_DATA
      as volatile, too
    - iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR
    - iio: ltr501: ltr501_read_ps(): add missing endianness conversion
    - serial: sh-sci: Stop dmaengine transfer in sci_stop_tx()
    - serial_cs: Add Option International GSM-Ready 56K/ISDN modem
    - serial_cs: remove wrong GLOBETROTTER.cis entry
    - ath9k: Fix kernel NULL pointer dereference during ath_reset_internal()
    - ssb: sdio: Don't overwrite const buffer if block_write fails
    - rsi: Assign beacon rate settings to the correct rate_info descriptor field
    - seq_buf: Make trace_seq_putmem_hex() support data longer than 8
    - fuse: check connected before queueing on fpq->io
    - spi: Make of_register_spi_device also set the fwnode
    - spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf'
    - spi: spi-topcliff-pch: Fix potential double free in
      pch_spi_process_messages()
    - spi: omap-100k: Fix the length judgment problem
    - crypto: nx - add missing MODULE_DEVICE_TABLE
    - media: cpia2: fix memory leak in cpia2_usb_probe
    - media: cobalt: fix race condition in setting HPD
    - media: pvrusb2: fix warning in pvr2_i2c_core_done
    - crypto: qat - check return code of qat_hal_rd_rel_reg()
    - crypto: qat - remove unused macro in FW loader
    - media: em28xx: Fix possible memory leak of em28xx struct
    - media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release
    - media: bt8xx: Fix a missing check bug in bt878_probe
    - media: st-hva: Fix potential NULL pointer dereferences
    - media: dvd_usb: memory leak in cinergyt2_fe_attach
    - mmc: via-sdmmc: add a check against NULL pointer dereference
    - crypto: shash - avoid comparing pointers to exported functions under CFI
    - media: dvb_net: avoid speculation from net slot
    - media: siano: fix device register error path
    - btrfs: fix error handling in __btrfs_update_delayed_inode
    - btrfs: abort transaction if we fail to update the delayed inode
    - btrfs: disable build on platforms having page size 256K
    - regulator: da9052: Ensure enough delay time for .set_voltage_time_sel
    - HID: do not use down_interruptible() when unbinding devices
    - ACPI: processor idle: Fix up C-state latency if not ordered
    - hv_utils: Fix passing zero to 'PTR_ERR' warning
    - lib: vsprintf: Fix handling of number field widths in vsscanf
    - ACPI: EC: Make more Asus laptops use ECDT _GPE
    - block_dump: remove block_dump feature in mark_inode_dirty()
    - fs: dlm: cancel work sync othercon
    - random32: Fix implicit truncation warning in prandom_seed_state()
    - fs: dlm: fix memory leak when fenced
    - ACPICA: Fix memory leak caused by _CID repair function
    - ACPI: bus: Call kobject_put() in acpi_init() error path
    - platform/x86: toshiba_acpi: Fix missing error code in
      toshiba_acpi_setup_keyboard()
    - ACPI: tables: Add custom DSDT file as makefile prerequisite
    - HID: wacom: Correct base usage for capacitive ExpressKey status bits
    - ia64: mca_drv: fix incorrect array size calculation
    - media: s5p_cec: decrement usage count if disabled
    - crypto: ixp4xx - dma_unmap the correct address
    - crypto: ux500 - Fix error return code in hash_hw_final()
    - sata_highbank: fix deferred probing
    - pata_rb532_cf: fix deferred probing
    - media: I2C: change 'RST' to "RSET" to fix multiple build errors
    - pata_octeon_cf: avoid WARN_ON() in ata_host_activate()
    - crypto: ccp - Fix a resource leak in an error handling path
    - pata_ep93xx: fix deferred probing
    - media: exynos4-is: Fix a use after free in isp_video_release
    - media: tc358743: Fix error return code in tc358743_probe_of()
    - media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2()
    - mmc: usdhi6rol0: fix error return code in usdhi6_probe()
    - media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx
    - hwmon: (max31722) Remove non-standard ACPI device IDs
    - hwmon: (max31790) Fix fan speed reporting for fan7..12
    - btrfs: clear log tree recovering status if starting transaction fails
    - spi: spi-sun6i: Fix chipselect/clock bug
    - crypto: nx - Fix RCU warning in nx842_OF_upd_status
    - ACPI: sysfs: Fix a buffer overrun problem with description_show()
    - ocfs2: fix snprintf() checking
    - net: pch_gbe: Propagate error from devm_gpio_request_one()
    - drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in
      cdn_dp_grf_write()
    - ehea: fix error return code in ehea_restart_qps()
    - RDMA/rxe: Fix failure during driver load
    - drm: qxl: ensure surf.data is ininitialized
    - wireless: carl9170: fix LEDS build errors & warnings
    - brcmsmac: mac80211_if: Fix a resource leak in an error handling path
    - ath10k: Fix an error code in ath10k_add_interface()
    - netlabel: Fix memory leak in netlbl_mgmt_add_common
    - netfilter: nft_exthdr: check for IPv6 packet before further processing
    - samples/bpf: Fix the error return code of xdp_redirect's main()
    - net: ethernet: aeroflex: fix UAF in greth_of_remove
    - net: ethernet: ezchip: fix UAF in nps_enet_remove
    - net: ethernet: ezchip: fix error handling
    - pkt_sched: sch_qfq: fix qfq_change_class() error path
    - vxlan: add missing rcu_read_lock() in neigh_reduce()
    - net: bcmgenet: Fix attaching to PYH failed on RPi 4B
    - i40e: Fix error handling in i40e_vsi_open
    - Revert "ibmvnic: remove duplicate napi_schedule call in open function"
    - Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid
    - writeback: fix obtain a reference to a freeing memcg css
    - net: sched: fix warning in tcindex_alloc_perfect_hash
    - tty: nozomi: Fix a resource leak in an error handling function
    - mwifiex: re-fix for unaligned accesses
    - iio: adis_buffer: do not return ints in irq handlers
    - iio: accel: bma180: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: accel: bma220: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: accel: hid: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: accel: kxcjk-1013: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: accel: stk8312: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: accel: stk8ba50: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: adc: ti-ads1015: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: adc: vf610: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: gyro: bmg160: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: humidity: am2315: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: prox: srf08: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: prox: pulsed-light: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: prox: as3935: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: light: isl29125: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: light: tcs3414: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - iio: potentiostat: lmp91000: Fix alignment of buffer in
      iio_push_to_buffers_with_timestamp()
    - ASoC: hisilicon: fix missing clk_disable_unprepare() on error in
      hi6210_i2s_startup()
    - Input: hil_kbd - fix error return code in hil_dev_connect()
    - char: pcmcia: error out if 'num_bytes_read' is greater than 4 in
      set_protocol()
    - tty: nozomi: Fix the error handling path of 'nozomi_card_init()'
    - scsi: FlashPoint: Rename si_flags field
    - s390: appldata depends on PROC_SYSCTL
    - eeprom: idt_89hpesx: Put fwnode in matching case during ->probe()
    - iio: adc: mxs-lradc: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - staging: gdm724x: check for buffer overflow in gdm_lte_multi_sdu_pkt()
    - staging: gdm724x: check for overflow in gdm_lte_netif_rx()
    - ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK
    - of: Fix truncation of memory sizes on 32-bit platforms
    - scsi: mpt3sas: Fix error return value in _scsih_expander_add()
    - phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()
    - extcon: sm5502: Drop invalid register write in sm5502_reg_data
    - extcon: max8997: Add missing modalias string
    - configfs: fix memleak in configfs_release_bin_file
    - leds: as3645a: Fix error return code in as3645a_parse_node()
    - leds: ktd2692: Fix an error handling path
    - mm/huge_memory.c: don't discard hugepage if other processes are mapping it
    - selftests/vm/pkeys: fix alloc_random_pkey() to make it really, really random
    - mmc: vub3000: fix control-request direction
    - scsi: core: Retry I/O for Notify (Enable Spinup) Required error
    - drm/mxsfb: Don't select DRM_KMS_FB_HELPER
    - drm/zte: Don't select DRM_KMS_FB_HELPER
    - drm/amd/amdgpu/sriov disable all ip hw status by default
    - net: pch_gbe: Use proper accessors to BE data in pch_ptp_match()
    - hugetlb: clear huge pte during flush function on mips platform
    - atm: iphase: fix possible use-after-free in ia_module_exit()
    - mISDN: fix possible use-after-free in HFC_cleanup()
    - atm: nicstar: Fix possible use-after-free in nicstar_cleanup()
    - net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT
    - reiserfs: add check for invalid 1st journal block
    - drm/virtio: Fix double free on probe failure
    - udf: Fix NULL pointer dereference in udf_symlink function
    - e100: handle eeprom as little endian
    - clk: renesas: r8a77995: Add ZA2 clock
    - clk: tegra: Ensure that PLLU configuration is applied properly
    - ipv6: use prandom_u32() for ID generation
    - RDMA/cxgb4: Fix missing error code in create_qp()
    - dm space maps: don't reset space map allocation cursor when committing
    - virtio_net: Remove BUG() to avoid machine dead
    - net: bcmgenet: check return value after calling platform_get_resource()
    - net: micrel: check return value after calling platform_get_resource()
    - fjes: check return value after calling platform_get_resource()
    - selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC
    - xfrm: Fix error reporting in xfrm_state_construct.
    - wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP
    - wl1251: Fix possible buffer overflow in wl1251_cmd_scan
    - cw1200: add missing MODULE_DEVICE_TABLE
    - atm: nicstar: use 'dma_free_coherent' instead of 'kfree'
    - atm: nicstar: register the interrupt handler in the right place
    - vsock: notify server to shutdown when client has pending signal
    - RDMA/rxe: Don't overwrite errno from ib_umem_get()
    - iwlwifi: mvm: don't change band on bound PHY contexts
    - sfc: avoid double pci_remove of VFs
    - sfc: error code if SRIOV cannot be disabled
    - wireless: wext-spy: Fix out-of-bounds warning
    - RDMA/cma: Fix rdma_resolve_route() memory leak
    - Bluetooth: Fix the HCI to MGMT status conversion table
    - Bluetooth: Shutdown controller after workqueues are flushed or cancelled
    - Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
    - sctp: validate from_addr_param return
    - sctp: add size validation when walking chunks
    - fscrypt: don't ignore minor_hash when hash is 0
    - bdi: Do not use freezable workqueue
    - fuse: reject internal errno
    - powerpc/barrier: Avoid collision with clang's __lwsync macro
    - usb: gadget: f_fs: Fix setting of device and driver data cross-references
    - drm/radeon: Add the missed drm_gem_object_put() in
      radeon_user_framebuffer_create()
    - pinctrl/amd: Add device HID for new AMD GPIO controller
    - mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode
    - mmc: core: clear flags before allowing to retune
    - mmc: core: Allow UHS-I voltage switch for SDSC cards if supported
    - ata: ahci_sunxi: Disable DIPM
    - cpu/hotplug: Cure the cpusets trainwreck
    - ASoC: tegra: Set driver_name=tegra for all machine drivers
    - qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute
    - ipmi/watchdog: Stop watchdog timer when the current action is 'none'
    - power: supply: ab8500: Fix an old bug
    - seq_buf: Fix overflow in seq_buf_putmem_hex()
    - tracing: Simplify & fix saved_tgids logic
    - ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe
    - dm btree remove: assign new_root only when removal succeeds
    - media: dtv5100: fix control-request directions
    - media: zr364xx: fix memory leak in zr364xx_start_readpipe
    - media: gspca/sq905: fix control-request direction
    - media: gspca/sunplus: fix zero-length control requests
    - jfs: fix GPF in diFree
    - smackfs: restrict bytes count in smk_set_cipso()
    - KVM: x86: Use guest MAXPHYADDR from CPUID.0x8000_0008 iff TDP is enabled
    - KVM: X86: Disable hardware breakpoints unconditionally before kvm_x86->run()
    - scsi: core: Fix bad pointer dereference when ehandler kthread is invalid
    - tracing: Do not reference char * as a string in histograms
    - PCI: aardvark: Don't rely on jiffies while holding spinlock
    - PCI: aardvark: Fix kernel panic during PIO transfer
    - tty: serial: fsl_lpuart: fix the potential risk of division or modulo by
      zero
    - misc/libmasm/module: Fix two use after free in ibmasm_init_one
    - Revert "ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro"
    - w1: ds2438: fixing bug that would always get page0
    - scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology
    - scsi: lpfc: Fix crash when lpfc_sli4_hba_setup() fails to initialize the
      SGLs
    - scsi: core: Cap scsi_host cmd_per_lun at can_queue
    - tty: serial: 8250: serial_cs: Fix a memory leak in error handling path
    - fs/jfs: Fix missing error code in lmLogInit()
    - scsi: iscsi: Add iscsi_cls_conn refcount helpers
    - scsi: iscsi: Fix shost->max_id use
    - scsi: qedi: Fix null ref during abort handling
    - mfd: da9052/stmpe: Add and modify MODULE_DEVICE_TABLE
    - s390/sclp_vt220: fix console name to match device
    - ALSA: sb: Fix potential double-free of CSP mixer elements
    - powerpc/ps3: Add dma_mask to ps3_dma_region
    - gpio: zynq: Check return value of pm_runtime_get_sync
    - ALSA: ppc: fix error return code in snd_pmac_probe()
    - selftests/powerpc: Fix "no_handler" EBB selftest
    - ASoC: soc-core: Fix the error return code in
      snd_soc_of_parse_audio_routing()
    - ALSA: bebob: add support for ToneWeal FW66
    - usb: gadget: f_hid: fix endianness issue with descriptors
    - usb: gadget: hid: fix error return code in hid_bind()
    - powerpc/boot: Fixup device-tree on little endian
    - backlight: lm3630a: Fix return code of .update_status() callback
    - ALSA: hda: Add IRQ check for platform_get_irq()
    - staging: rtl8723bs: fix macro value for 2.4Ghz only device
    - intel_th: Wait until port is in reset before programming it
    - i2c: core: Disable client irq on reboot/shutdown
    - lib/decompress_unlz4.c: correctly handle zero-padding around initrds.
    - pwm: spear: Don't modify HW state in .remove callback
    - power: supply: ab8500: Avoid NULL pointers
    - power: supply: max17042: Do not enforce (incorrect) interrupt trigger type
    - power: reset: gpio-poweroff: add missing MODULE_DEVICE_TABLE
    - ARM: 9087/1: kprobes: test-thumb: fix for LLVM_IAS=1
    - watchdog: Fix possible use-after-free in wdt_startup()
    - watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()
    - watchdog: Fix possible use-after-free by calling del_timer_sync()
    - watchdog: iTCO_wdt: Account for rebooting on second timeout
    - x86/fpu: Return proper error codes from user access functions
    - orangefs: fix orangefs df output.
    - ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty
    - NFS: nfs_find_open_context() may only select open files
    - power: supply: charger-manager: add missing MODULE_DEVICE_TABLE
    - power: supply: ab8500: add missing MODULE_DEVICE_TABLE
    - pwm: tegra: Don't modify HW state in .remove callback
    - ACPI: AMBA: Fix resource name in /proc/iomem
    - ACPI: video: Add quirk for the Dell Vostro 3350
    - virtio-blk: Fix memory leak among suspend/resume procedure
    - virtio_net: Fix error handling in virtnet_restore()
    - virtio_console: Assure used length from device is limited
    - f2fs: add MODULE_SOFTDEP to ensure crc32 is included in the initramfs
    - PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun
    - power: supply: rt5033_battery: Fix device tree enumeration
    - um: fix error return code in slip_open()
    - um: fix error return code in winch_tramp()
    - watchdog: aspeed: fix hardware timeout calculation
    - nfs: fix acl memory leak of posix_acl_create()
    - ubifs: Set/Clear I_LINKABLE under i_lock for whiteout inode
    - x86/fpu: Limit xstate copy size in xstateregs_set()
    - ALSA: isa: Fix error return code in snd_cmi8330_probe()
    - NFSv4/pNFS: Don't call _nfs4_pnfs_v3_ds_connect multiple times
    - hexagon: use common DISCARDS macro
    - reset: a10sr: add missing of_match_table reference
    - ARM: dts: exynos: fix PWM LED max brightness on Odroid XU/XU3
    - ARM: dts: exynos: fix PWM LED max brightness on Odroid XU4
    - memory: atmel-ebi: add missing of_node_put for loop iteration
    - rtc: fix snprintf() checking in is_rtc_hctosys()
    - ARM: dts: r8a7779, marzen: Fix DU clock names
    - ARM: dts: BCM5301X: Fixup SPI binding
    - reset: bail if try_module_get() fails
    - memory: fsl_ifc: fix leak of IO mapping on probe failure
    - memory: fsl_ifc: fix leak of private memory on probe failure
    - ARM: dts: am335x: align ti,pindir-d0-out-d1-in property with dt-shema
    - scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe()
    - mips: always link byteswap helpers into decompressor
    - mips: disable branch profiling in boot/decompress.o
    - MIPS: vdso: Invalid GIC access through VDSO
    - net: bridge: multicast: fix PIM hello router port marking race
    - ALSA: usb-audio: Fix OOB access at proc output
    - iio: light: tcs3472: do not free unallocated IRQ
    - rsi: fix AP mode with WPA failure due to encrypted EAPOL
    - evm: Execute evm_inode_init_security() only when an HMAC key is loaded
    - evm: fix writing <securityfs>/evm overflow
    - wcn36xx: Move hal_buf allocation to devm_kmalloc in probe
    - ssb: Fix error return code in ssb_bus_scan()
    - brcmfmac: fix setting of station info chains bitmask
    - ipv6: exthdrs: do not blindly use init_net
    - i40e: Fix autoneg disabling for non-10GBaseT links
    - ipv6: fix out-of-bound access in ip6_parse_tlv()
    - iio: light: tcs3472: Fix buffer alignment in
      iio_push_to_buffers_with_timestamp()
    - ASoC: rsnd: tidyup loop on rsnd_adg_clk_query()
    - visorbus: fix error return code in visorchipset_init()
    - serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates
    - powerpc: Offline CPU in stop_this_cpu()
    - serial: mvebu-uart: correctly calculate minimal possible baudrate
    - arm64: dts: marvell: armada-37xx: Fix reg for standard variant of UART
    - vfio/pci: Handle concurrent vma faults
    - clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround
    - coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
    - PCI: Leave Apple Thunderbolt controllers on for s2idle or standby
    - media: subdev: disallow ioctl for saa6588/davinci
    - PCI: iproc: Fix multi-MSI base vector number allocation
    - PCI: iproc: Support multi-MSI only on uniprocessor kernel
    - virtio_net: move tx vq operation under tx queue lock
    - ARM: dts: exynos: fix PWM LED max brightness on Odroid HC1
    - ARM: dts: am437x: align ti,pindir-d0-out-d1-in property with dt-shema

  * Bionic update: upstream stable patchset 2021-07-20 (LP: #1936960)
    - include/linux/mmdebug.h: make VM_WARN* non-rvals
    - mm: add VM_WARN_ON_ONCE_PAGE() macro
    - mm/rmap: remove unneeded semicolon in page_not_mapped()
    - mm/rmap: use page_not_mapped in try_to_unmap()
    - mm/thp: try_to_unmap() use TTU_SYNC for safe splitting
    - mm/thp: fix vma_address() if virtual address below file offset
    - mm/thp: fix page_address_in_vma() on file THP tails
    - mm: thp: replace DEBUG_VM BUG with VM_WARN when unmap fails for split
    - mm: page_vma_mapped_walk(): use page for pvmw->page
    - mm: page_vma_mapped_walk(): settle PageHuge on entry
    - mm: page_vma_mapped_walk(): use pmde for *pvmw->pmd
    - mm: page_vma_mapped_walk(): prettify PVMW_MIGRATION block
    - mm: page_vma_mapped_walk(): crossing page table boundary
    - mm: page_vma_mapped_walk(): add a level of indentation
    - mm: page_vma_mapped_walk(): use goto instead of while (1)
    - mm: page_vma_mapped_walk(): get vma_address_end() earlier
    - mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes
    - mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk()
    - mm, futex: fix shared futex pgoff on shmem huge page
    - scsi: sr: Return appropriate error code when disk is ejected
    - drm/nouveau: fix dma_address check for CPU/GPU sync
    - kfifo: DECLARE_KIFO_PTR(fifo, u64) does not work on arm 32 bit
    - kthread_worker: split code for canceling the delayed work timer
    - kthread: prevent deadlock when kthread_mod_delayed_work() races with
      kthread_cancel_delayed_work_sync()
    - xen/events: reset active flag for lateeoi events later
    - ARM: dts: imx6qdl-sabresd: Remove incorrect power supply assignment
    - ARM: OMAP: replace setup_irq() by request_irq()
    - clocksource/drivers/timer-ti-dm: Add clockevent and clocksource support
    - clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue

  * Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231)
    - Revert "UBUNTU: SAUCE: Revert "proc: Check /proc/$pid/attr/ writes against
      file opener""
    - proc: Track /proc/$pid/attr/ opener mm_struct
    - net/nfc/rawsock.c: fix a permission check bug
    - ASoC: sti-sas: add missing MODULE_DEVICE_TABLE
    - isdn: mISDN: netjet: Fix crash in nj_probe:
    - bonding: init notify_work earlier to avoid uninitialized use
    - netlink: disable IRQs for netlink_lock_table()
    - net: mdiobus: get rid of a BUG_ON()
    - cgroup: disable controllers at parse time
    - wq: handle VM suspension in stall detection
    - net/qla3xxx: fix schedule while atomic in ql_sem_spinlock
    - scsi: vmw_pvscsi: Set correct residual data length
    - scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal
    - net: macb: ensure the device is available before accessing GEMGXL control
      registers
    - net: appletalk: cops: Fix data race in cops_probe1
    - MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER
    - bnx2x: Fix missing error code in bnx2x_iov_init_one()
    - powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers
    - powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c controllers
    - i2c: mpc: Make use of i2c_recover_bus()
    - i2c: mpc: implement erratum A-004447 workaround
    - drm: Fix use-after-free read in drm_getunique()
    - drm: Lock pointer access in drm_master_release()
    - kvm: avoid speculation-based attacks from out-of-range memslot accesses
    - staging: rtl8723bs: Fix uninitialized variables
    - btrfs: return value from btrfs_mark_extent_written() in case of error
    - cgroup1: don't allow 'n' in renaming
    - USB: f_ncm: ncm_bitrate (speed) is unsigned
    - usb: dwc3: ep0: fix NULL pointer exception
    - usb: typec: ucsi: Clear PPM capability data in ucsi_init() error path
    - usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind
    - USB: serial: ftdi_sio: add NovaTech OrionMX product ID
    - USB: serial: omninet: add device id for Zyxel Omni 56K Plus
    - USB: serial: quatech2: fix control-request directions
    - usb: gadget: eem: fix wrong eem header operation
    - usb: fix various gadgets null ptr deref on 10gbps cabling.
    - usb: fix various gadget panics on 10gbps cabling
    - regulator: core: resolve supply for boot-on/always-on regulators
    - regulator: max77620: Use device_set_of_node_from_dev()
    - perf: Fix data race between pin_count increment/decrement
    - NFS: Fix a potential NULL dereference in nfs_get_client()
    - perf session: Correct buffer copying when peeking events
    - kvm: fix previous commit for 32-bit builds
    - NFS: Fix use-after-free in nfs4_init_client()
    - NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error.
    - scsi: core: Fix error handling of scsi_host_alloc()
    - scsi: core: Put .shost_dev in failure path if host state changes to RUNNING
    - scsi: core: Only put parent device if host state differs from SHOST_CREATED
    - ftrace: Do not blindly read the ip address in ftrace_bug()
    - tracing: Correct the length check which causes memory corruption
    - proc: only require mm_struct for writing
    - scsi: bnx2fc: Return failure if io_req is already in ABTS processing
    - ARM: dts: imx6qdl-sabresd: Assign corresponding power supply for LDOs
    - usb: f_ncm: only first packet of aggregate needs to start timer
    - usb: pd: Set PD_T_SINK_WAIT_CAP to 310ms
    - RDMA/mlx4: Do not map the core_clock page to user space unless enabled
    - vmlinux.lds.h: Avoid orphan section with !SMP
    - sched/fair: Make sure to update tg contrib for blocked load
    - net: ieee802154: fix null deref in parse dev addr
    - HID: hid-sensor-hub: Return error for hid_set_field() failure
    - HID: Add BUS_VIRTUAL to hid_connect logging
    - HID: usbhid: fix info leak in hid_submit_ctrl
    - ARM: OMAP2+: Fix build warning when mmc_omap is not built
    - HID: gt683r: add missing MODULE_DEVICE_TABLE
    - gfs2: Fix use-after-free in gfs2_glock_shrink_scan
    - scsi: target: core: Fix warning on realtime kernels
    - ethernet: myri10ge: Fix missing error code in myri10ge_probe()
    - nvme-loop: reset queue count to 1 in nvme_loop_destroy_io_queues()
    - nvme-loop: clear NVME_LOOP_Q_LIVE when nvme_loop_configure_admin_queue()
      fails
    - nvme-loop: check for NVME_LOOP_Q_LIVE in nvme_loop_destroy_admin_queue()
    - net: ipconfig: Don't override command-line hostnames or domains
    - rtnetlink: Fix missing error code in rtnl_bridge_notify()
    - net/x25: Return the correct errno code
    - net: Return the correct errno code
    - fib: Return the correct errno code
    - dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM
    - dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM
    - dmaengine: stedma40: add missing iounmap() on error in d40_probe()
    - mm/memory-failure: make sure wait for page writeback in memory_failure
    - batman-adv: Avoid WARN_ON timing related checks
    - net: ipv4: fix memory leak in netlbl_cipsov4_add_std
    - net: rds: fix memory leak in rds_recvmsg
    - udp: fix race between close() and udp_abort()
    - rtnetlink: Fix regression in bridge VLAN configuration
    - netfilter: synproxy: Fix out of bounds when parsing TCP options
    - alx: Fix an error handling path in 'alx_probe()'
    - net: stmmac: dwmac1000: Fix extended MAC address registers definition
    - qlcnic: Fix an error handling path in 'qlcnic_probe()'
    - netxen_nic: Fix an error handling path in 'netxen_nic_probe()'
    - net: cdc_ncm: switch to eth%d interface naming
    - net: usb: fix possible use-after-free in smsc75xx_bind
    - net: ipv4: fix memory leak in ip_mc_add1_src
    - net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
    - be2net: Fix an error handling path in 'be_probe()'
    - net: hamradio: fix memory leak in mkiss_close
    - net: cdc_eem: fix tx fixup skb leak
    - icmp: don't send out ICMP messages with a source address of 0.0.0.0
    - net: ethernet: fix potential use-after-free in ec_bhf_remove
    - radeon: use memcpy_to/fromio for UVD fw upload
    - hwmon: (scpi-hwmon) shows the negative temperature properly
    - can: bcm: fix infoleak in struct bcm_msg_head
    - can: mcba_usb: fix memory leak in mcba_usb
    - usb: core: hub: Disable autosuspend for Cypress CY7C65632
    - tracing: Do not stop recording cmdlines when tracing is off
    - tracing: Do not stop recording comms if the trace file is being read
    - tracing: Do no increment trace_clock_global() by one
    - PCI: Mark TI C667X to avoid bus reset
    - PCI: Mark some NVIDIA GPUs to avoid bus reset
    - PCI: Add ACS quirk for Broadcom BCM57414 NIC
    - PCI: Work around Huawei Intelligent NIC VF FLR erratum
    - ARCv2: save ABI registers across signal handling
    - dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc
    - net: bridge: fix vlan tunnel dst null pointer dereference
    - net: bridge: fix vlan tunnel dst refcnt when egressing
    - mm/slub.c: include swab.h
    - net: fec_ptp: add clock rate zero check
    - can: bcm/raw/isotp: use per module netdevice notifier
    - inet: use bigger hash table for IP ID generation
    - usb: dwc3: core: fix kernel panic when do reboot
    - x86/fpu: Reset state for all signal restore failures
    - drm/nouveau: wait for moving fence after pinning v2
    - drm/radeon: wait for moving fence after pinning
    - ARM: 9081/1: fix gcc-10 thumb2-kernel regression
    - Makefile: Move -Wno-unused-but-set-variable out of GCC only block
    - MIPS: generic: Update node names to avoid unit addresses
    - Revert "PCI: PM: Do not read power state in pci_enable_device_flags()"
    - mac80211: remove warning in ieee80211_get_sband()
    - cfg80211: call cfg80211_leave_ocb when switching away from OCB
    - mac80211: drop multicast fragments
    - ping: Check return value of function 'ping_queue_rcv_skb'
    - inet: annotate date races around sk->sk_txhash
    - net: caif: fix memory leak in ldisc_open
    - net/packet: annotate accesses to po->bind
    - net/packet: annotate accesses to po->ifindex
    - r8152: Avoid memcpy() over-reading of ETH_SS_STATS
    - sh_eth: Avoid memcpy() over-reading of ETH_SS_STATS
    - r8169: Avoid memcpy() over-reading of ETH_SS_STATS
    - net: qed: Fix memcpy() overflow of qed_dcbx_params()
    - net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY
    - pinctrl: stm32: fix the reported number of GPIO lines per bank
    - nilfs2: fix memory leak in nilfs_sysfs_delete_device_group
    - i2c: robotfuzz-osif: fix control-request directions
    - scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V
    - net/mlx5e: Remove dependency in IPsec initialization flows
    - net: add documentation to socket.c
    - net: make get_net_ns return error if NET_NS is disabled
    - net: qrtr: fix OOB Read in qrtr_endpoint_post
    - ptp: ptp_clock: Publish scaled_ppm_to_ppb
    - ptp: improve max_adj check against unreasonable values
    - net: fec_ptp: fix issue caused by refactor the fec_devtype
    - ASoC: rt5659: Fix the lost powers for the HDA header
    - cfg80211: make certificate generation more robust
    - mm/slub: clarify verification reporting
    - net: ethtool: clear heap allocations for ethtool function
    - PCI: Add AMD RS690 quirk to enable 64-bit DMA
    - upstream stable to v4.14.238, v4.19.196

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 13 Aug 2021 13:47:03 +0200

linux (4.15.0-154.161) bionic; urgency=medium

  * bionic/linux: 4.15.0-154.161 -proposed tracker (LP: #1938411)

  * Potential reverts of 4.19.y stable changes in 18.04 (LP: #1938537)
    - SAUCE: Revert "locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to
      signal"
    - SAUCE: Revert "drm/amd/amdgpu: fix refcount leak"

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts
    - update dkms package versions

  * btrfs: Automatic balance returns -EUCLEAN and leads to forced readonly
    filesystem (LP: #1934709) // CVE-2019-19036
    - btrfs: Validate child tree block's level and first key
    - btrfs: Detect unbalanced tree with empty leaf before crashing btree
      operations

  * btrfs: Automatic balance returns -EUCLEAN and leads to forced readonly
    filesystem (LP: #1934709)
    - Revert "btrfs: Detect unbalanced tree with empty leaf before crashing btree
      operations"
    - Revert "btrfs: Validate child tree block's level and first key"
    - btrfs: Only check first key for committed tree blocks
    - btrfs: Fix wrong first_key parameter in replace_path

  * Enable fib-onlink-tests.sh and msg_zerocopy.sh in kselftests/net on Bionic
    (LP: #1934759)
    - selftests: Add fib-onlink-tests.sh to TEST_PROGS
    - selftests: net: use TEST_PROGS_EXTENDED
    - selftests/net: enable msg_zerocopy test
    - SAUCE: selftests: Make fib-onlink-tests.sh executable

  * Kernel oops due to uninitialized list on kernfs (kernfs_kill_sb)
    (LP: #1934175)
    - kernfs: deal with kernfs_fill_super() failures
    - unfuck sysfs_mount()

  * large_dir in ext4 broken (LP: #1933074)
    - SAUCE: ext4: fix directory index node split corruption

  * btrfs: Attempting to balance a nearly full filesystem with relocated root
    nodes fails (LP: #1933172) // CVE-2019-19036
    - btrfs: reloc: fix reloc root leak and NULL pointer dereference

  * btrfs: Attempting to balance a nearly full filesystem with relocated root
    nodes fails (LP: #1933172)
    - Revert "btrfs: reloc: fix reloc root leak and NULL pointer dereference"

  * Pixel format change broken for Elgato Cam Link 4K (LP: #1932367)
    - (upstream) media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K

  * Bionic update: upstream stable patchset 2021-06-23 (LP: #1933375)
    - net: usb: cdc_ncm: don't spew notifications
    - efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared
    - efi: cper: fix snprintf() use in cper_dimm_err_location()
    - vfio/pci: Fix error return code in vfio_ecap_init()
    - vfio/pci: zap_vma_ptes() needs MMU
    - vfio/platform: fix module_put call in error flow
    - ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service
    - HID: pidff: fix error return code in hid_pidff_init()
    - HID: i2c-hid: fix format string mismatch
    - netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches
    - ieee802154: fix error return code in ieee802154_add_iface()
    - ieee802154: fix error return code in ieee802154_llsec_getparams()
    - Bluetooth: fix the erroneous flush_work() order
    - Bluetooth: use correct lock to prevent UAF of hdev object
    - net: caif: added cfserl_release function
    - net: caif: add proper error handling
    - net: caif: fix memory leak in caif_device_notify
    - net: caif: fix memory leak in cfusbl_device_notify
    - ALSA: timer: Fix master timer notification
    - ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed
    - pid: take a reference when initializing `cad_pid`
    - ocfs2: fix data corruption by fallocate
    - nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect
    - btrfs: fix error handling in btrfs_del_csums
    - btrfs: fixup error handling in fixup_inode_link_counts
    - mm, hugetlb: fix simple resv_huge_pages underflow on UFFDIO_COPY
    - selftests/bpf: make 'dubious pointer arithmetic' test useful
    - bnxt_en: Remove the setting of dev_port.
    - KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode
    - sched/fair: Optimize select_idle_cpu
    - xen-pciback: redo VF placement in the virtual topology
    - ALSA: usb: update old-style static const declaration
    - nl80211: validate key indexes for cfg80211_registered_device
    - x86/apic: Mark _all_ legacy interrupts when IO/APIC is missing
    - btrfs: return errors from btrfs_del_csums in cleanup_ref_head
    - KVM: arm64: Fix debug register indexing

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Fri, 30 Jul 2021 14:39:24 +0200

linux (4.15.0-153.160) bionic; urgency=medium

  * bionic/linux: 4.15.0-153.160 -proposed tracker (LP: #1938319)

  * 4.15.0-151 is freezing various CPUs (LP: #1938013)
    - mac80211: fix memory corruption in EAPOL handling

 -- Stefan Bader <stefan.bader@canonical.com>  Thu, 29 Jul 2021 08:26:59 +0200

linux (4.15.0-151.157) bionic; urgency=medium

  * CVE-2021-33909
    - SAUCE: seq_file: Disallow extremely large seq buffer allocations

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 09 Jul 2021 17:19:20 -0300

# For older changelog entries, run 'apt-get changelog linux-headers-4.15.0-162'
