-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 29 Jun 2022 21:24:38 +0200
Source: linux
Architecture: source
Version: 4.19.249-1
Distribution: buster-security
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Ben Hutchings <benh@debian.org>
Closes: 922204 1006346 1013299
Changes:
linux (4.19.249-1) buster-security; urgency=high
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.236
- Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0"
- xfrm: Check if_id in xfrm_migrate
- xfrm: Fix xfrm migrate issues when address family changes
- [x86] atm: firestream: check the return value of ioremap() in fs_init()
- nl80211: Update bss channel on channel switch for P2P_CLIENT
- tcp: make tcp_read_sock() more robust
- sfc: extend the locking on mcdi->seqno
- sched/topology: Make sched_init_numa() use a set for the deduplicating
sort
- sched/topology: Fix sched_domain_topology_level alloc in sched_init_numa()
- cpuset: Fix unsafe lock order between cpuset lock and cpuslock
- mm: fix dereference a null pointer in migrate[_huge]_page_move_mapping()
- fs: sysfs_emit: Remove PAGE_SIZE alignment check
- [arm64] Preparation for mitigating Spectre-BHB:
+ Add part number for Arm Cortex-A77
+ Add Neoverse-N2, Cortex-A710 CPU part definition
+ Add Cortex-X2 CPU part definition
+ entry.S: Add ventry overflow sanity checks
- [arm64] Mitigate Spectre v2-type Branch History Buffer attacks
(CVE-2022-23960):
+ entry: Make the trampoline cleanup optional
+ entry: Free up another register on kpti's tramp_exit path
+ entry: Move the trampoline data page before the text page
+ entry: Allow tramp_alias to access symbols after the 4K boundary
+ entry: Don't assume tramp_vectors is the start of the vectors
+ entry: Move trampoline macros out of ifdef'd section
+ entry: Make the kpti trampoline's kpti sequence optional
+ entry: Allow the trampoline text to occupy multiple pages
+ entry: Add non-kpti __bp_harden_el1_vectors for mitigations
+ entry: Add vectors that have the bhb mitigation sequences
+ entry: Add macro for reading symbol addresses from the trampoline
+ Add percpu vectors for EL1
+ proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2
+ KVM: arm64: Add templates for BHB mitigation sequences
+ Mitigate spectre style branch history side channels
+ KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
+ add ID_AA64ISAR2_EL1 sys register
+ Use the clearbhb instruction in mitigations
- [arm64] crypto: qcom-rng - ensure buffer for generate is completely filled
- ocfs2: fix crash when initialize filecheck kobj fails
- efi: fix return value of __setup handlers
- net/packet: fix slab-out-of-bounds access in packet_recvmsg()
- atm: eni: Add check for dma_map_single
- [x86] hv_netvsc: Add check for kvmalloc_array
- [arm64,armhf] drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings
- net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
- [arm64,armhf] net: dsa: Add missing of_node_put() in dsa_port_parse_of
- usb: gadget: rndis: prevent integer overflow in rndis_set_response()
- usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
- Input: aiptek - properly check endpoint type
- perf symbols: Fix symbol size calculation condition
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.237
- nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
(CVE-2022-26490)
- net: ipv6: fix skb_over_panic in __ip6_append_data
- esp: Fix possible buffer overflow in ESP transformation (CVE-2022-27666)
- [x86] thermal: int340x: fix memory leak in int3400_notify()
- llc: fix netdevice reference leaks in llc_ui_bind() (CVE-2022-28356)
- ALSA: oss: Fix PCM OSS buffer allocation overflow
- ALSA: pcm: Add stream lock during PCM reset ioctl operations
- ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB
- ALSA: cmipci: Restore aux vol on suspend/resume
- ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
- [arm64] drivers: net: xgene: Fix regression in CRC stripping
- netfilter: nf_tables: initialize registers in nft_do_chain()
(CVE-2022-1016)
- [x86] ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board
- [x86] ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3
- [x86] ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU
- [x86] crypto: qat - disable registration of algorithms
- mac80211: fix potential double free on mesh join
- llc: only change llc->dev when bind() succeeds
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.238
- USB: serial: pl2303: add IBM device IDs
- USB: serial: simple: add Nokia phone driver
- netdevice: add the case if dev is NULL
- xfrm: fix tunnel model fragmentation behavior
- virtio_console: break out of buf poll on remove
- ethernet: sun: Free the coherent when failing in probing
- spi: Fix invalid sgs value
- spi: Fix erroneous sgs value with min_t()
- af_key: add __GFP_ZERO flag for compose_sadb_supported in function
pfkey_register (CVE-2022-1353)
- fuse: fix pipe buffer lifetime for direct_io (CVE-2022-1011)
- tpm: fix reference counting for struct tpm_chip
- block: Add a helper to validate the block size
- virtio-blk: Use blk_validate_block_size() to validate block size
- USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
- xhci: make xhci_handshake timeout for xhci_reset() adjustable
- iio: inkern: apply consumer scale on IIO_VAL_INT cases
- iio: inkern: apply consumer scale when no channel scale is available
- iio: inkern: make a best effort on offset calculation
- ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
(CVE-2022-30594)
- Documentation: add link to stable release candidate tree
- Documentation: update stable tree link
- SUNRPC: avoid race between mod_timer() and del_timer_sync()
- NFSD: prevent underflow in nfssvc_decode_writeargs()
- NFSD: prevent integer overflow on 32 bit systems
- f2fs: fix to unlock page correctly in error path of is_alive()
- [armhf] pinctrl: samsung: drop pin banks references on error paths
- can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error
path (CVE-2022-28390)
- jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
- jffs2: fix memory leak in jffs2_do_mount_fs
- jffs2: fix memory leak in jffs2_scan_medium
- mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
- mm: invalidate hwpoison page cache page in fault path
- mempolicy: mbind_range() set_policy() after vma_merge()
- scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
- qed: display VF trust config
- qed: validate and restrict untrusted VFs vlan promisc mode
- Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
- [i386] ALSA: cs4236: fix an incorrect NULL check on list iterator
- ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020
- mm,hwpoison: unmap poisoned page before invalidation
- drbd: fix potential silent data corruption
- [powerpc*] kvm: Fix kvm_use_magic_page
- ACPI: properties: Consistently return -ENOENT if there are no more
references
- drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
(CVE-2022-1198)
- block: don't merge across cgroup boundaries if blkcg is enabled
- drm/edid: check basic audio support on CEA extension block
- [armhf] dts: exynos: add missing HDMI supplies on SMDK5250
- [armhf] dts: exynos: add missing HDMI supplies on SMDK5420
- carl9170: fix missing bit-wise or operator for tx_params
- [x86] thermal: int340x: Increase bitmap size
- brcmfmac: firmware: Allocate space for default boardrev in nvram
- brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
- PCI: pciehp: Clear cmd_busy bit in polling mode
- [arm64] regulator: qcom_smd: fix for_each_child.cocci warnings
- crypto: authenc - Fix sleep in atomic context in decrypt_tail
- [arm64,armhf] spi: tegra114: Add missing IRQ check in tegra_spi_probe
- [arm64] spi: pxa2xx-pci: Balance reference count for PCI DMA device
- hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
- block: don't delete queue kobject before its children
- PM: hibernate: fix __setup handler error handling
- PM: suspend: fix return value of __setup handler
- clocksource/drivers/timer-of: Check return value of of_iomap in
timer_of_base_init()
- ACPI: APEI: fix return value of __setup handlers
- [x86] crypto: ccp - ccp_dmaengine_unregister release dma channels
- [x86] clocksource: acpi_pm: fix return value of __setup handler
- sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
- perf/core: Fix address filter parser for multiple filters
- [x86] perf/x86/intel/pt: Fix address filter config for 32-bit kernel
- video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
- video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
- media: em28xx: initialize refcount before kref_get
- media: usb: go7007: s2250-board: fix leak in probe()
- [x86] ASoC: rt5663: check the return value of devm_kzalloc() in
rt5663_parse_dp()
- printk: fix return value of printk.devkmsg __setup handler
- [armhf] memory: emif: Add check for setup_interrupts
- [armhf] memory: emif: check the pointer temp in get_device_details()
- ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
- media: stk1160: If start stream fails, return buffers with
VB2_BUF_STATE_QUEUED
- [arm*] ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
- [armhf] ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
- ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern
- Bluetooth: hci_serdev: call init_rwsem() before p->open()
- drm/edid: Don't clear formats if using deep color
- drm/amd/display: Fix a NULL pointer dereference in
amdgpu_dm_connector_add_common_modes()
- ath9k_htc: fix uninit value bugs
- [powerpc*] KVM: PPC: Fix vmx/vsx mixup in mmio emulation
- [x86] ray_cs: Check ioremap return value
- HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
- iwlwifi: Fix -EIO error code that is never returned
- scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
- scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
- scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
- scsi: pm8001: Fix abort all task initialization
- TOMOYO: fix __setup handlers return values
- [arm64,armhf] drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
- [x86] power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong
false return
- [powerpc*] Makefile: Don't pass -mcpu=powerpc64 when building 32-bit
- [x86] KVM: x86: Fix emulation in writing cr8
- [x86] KVM: x86/emulator: Defer not-present segment check in
__load_segment_descriptor()
- [x86] hv_balloon: rate-limit "Unhandled message" warning
- PCI: Reduce warnings on possible RW1C corruption
- [armhf] mfd: mc13xxx: Add check for mc13xxx_irq_request
- vxcan: enable local echo for sent CAN frames
- USB: storage: ums-realtek: fix error code in rts51x_read_mem()
- af_netlink: Fix shift out of bounds in group mask calculation
- tcp: ensure PMTU updates are processed during fastopen
- [x86] mxser: fix xmit_buf leak in activate when LSR == 0xff
- [x86] serial: 8250_mid: Balance reference count for PCI DMA device
- serial: 8250: Fix race condition in RTS-after-send handling
- [arm64] clk: qcom: clk-rcg2: Update the frac table for pixel clock
- [armhf] clk: tegra: tegra124-emc: Fix missing put_device() call in
emc_ensure_emc_driver
- NFS: remove unneeded check in decode_devicenotify_args()
- [arm64,armhf] pinctrl/rockchip: Add missing of_node_put() in
rockchip_pinctrl_probe
- [s390x] tty: hvc: fix return value of __setup handler
- jfs: fix divide error in dbNextAG
- netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
- xen: fix is_xen_pmu()
- net: phy: broadcom: Fix brcm_fet_config_init()
- NFSv4/pNFS: Fix another issue with a list iterator pointing to the head
- selinux: use correct type for context length
- loop: use sysfs_emit() in the sysfs xxx show()
- Fix incorrect type in assignment of ipv6 port for audit
- bfq: fix use-after-free in bfq_dispatch_request
- ACPICA: Avoid walking the ACPI Namespace if it is not there
- Revert "Revert "block, bfq: honor already-setup queue merges""
- ACPI/APEI: Limit printable size of BERT table data
- PM: core: keep irq flags in device_pm_check_callbacks()
- [arm64] spi: tegra20: Use of_device_get_match_data()
- ext4: don't BUG if someone dirty pages without asking ext4 first
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
- video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit
- ASoC: soc-core: skip zero num_dai component in searching dai name
- media: cx88-mpeg: clear interrupt status register before streaming video
- media: Revert "media: em28xx: add missing em28xx_close_extension"
- media: hdpvr: initialize dev->worker at hdpvr_register_videodev
- mmc: host: Return an error when ->enable_sdio_irq() ops is missing
- [powerpc*] lib/sstep: Fix 'sthcx' instruction
- scsi: qla2xxx: Fix stuck session in gpdb
- scsi: qla2xxx: Fix warning for missing error code
- scsi: qla2xxx: Check for firmware dump already collected
- scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
- scsi: qla2xxx: Fix incorrect reporting of task management failure
- scsi: qla2xxx: Fix hang due to session stuck
- scsi: qla2xxx: Reduce false trigger to login
- scsi: qla2xxx: Use correct feature type field during RFF_ID processing
- KVM: Prevent module exit until all VMs are freed
- [x86] KVM: x86: fix sending PV IPI
- ubifs: rename_whiteout: Fix double free for whiteout_ui->data
- ubifs: Fix deadlock in concurrent rename whiteout and inode writeback
- ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
- ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
- ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()
- ubifs: rename_whiteout: correct old_dir size computing
- can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error
path (CVE-2022-28389)
- can: mcba_usb: properly check endpoint type
- gfs2: Make sure FITRIM minlen is rounded up to fs block size
- pinctrl: pinconf-generic: Print arguments for bias-pull-*
- ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
- [amd64,arm64] ACPI: CPPC: Avoid out of bounds access when parsing _CPC
data
- mm/mmap: return 1 from stack_guard_gap __setup() handler
- mm/memcontrol: return 1 from cgroup.memory __setup() handler
- mm/usercopy: return 1 from hardened_usercopy __setup() handler
- bpf: Fix comment for helper bpf_current_task_under_cgroup()
- [x86] ASoC: topology: Allow TLV control to be either read or write
- openvswitch: Fixed nd target mask field in the flow dump.
- [x86] KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't
activated (CVE-2022-2153)
- ubifs: Rectify space amount budget for mkdir/tmpfile operations
- [x86] KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs
- drm: Add orientation quirk for GPD Win Max
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
- drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
- ptp: replace snprintf with sysfs_emit
- scsi: mvsas: Replace snprintf() with sysfs_emit()
- scsi: bfa: Replace snprintf() with sysfs_emit()
- [arm64,armhf] power: supply: axp20x_battery: properly report current when
discharging
- [powerpc*] Set crashkernel offset to mid of RMA region
- [arm64] PCI: aardvark: Fix support for MSI interrupts
- [arm64] iommu/arm-smmu-v3: fix event handling soft lockup
- usb: ehci: add pci device support for Aspeed platforms
- PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
- ipv4: Invalidate neighbour for broadcast address upon address addition
- dm ioctl: prevent potential spectre v1 gadget
- scsi: pm8001: Fix pm8001_mpi_task_abort_resp()
- scsi: aha152x: Fix aha152x_setup() __setup handler return value
- net/smc: correct settings of RMB window update limit
- macvtap: advertise link netns via netlink
- bnxt_en: Eliminate unintended link toggle during FW reset
- [mips*] fix fortify panic when copying asm exception handlers
- scsi: libfc: Fix use after free in fc_exch_abts_resp()
- [armhf] usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on
omap5evm
- Bluetooth: Fix use after free in hci_send_acl
- init/main.c: return 1 from handled __setup() functions
- minix: fix bug when opening a file with O_DIRECT
- w1: w1_therm: fixes w1_seq for ds28ea00 sensors
- NFSv4: Protect the state recovery thread against direct reclaim
- xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32
- clk: Enforce that disjoints limits are invalid
- SUNRPC/call_alloc: async tasks mustn't block waiting for memory
- NFS: swap IO handling is slightly different for O_DIRECT IO
- NFS: swap-out must always use STABLE writes.
- [armhf] serial: samsung_tty: do not unlock port->lock for
uart_write_wakeup()
- virtio_console: eliminate anonymous module_init & module_exit
- jfs: prevent NULL deref in diFree
- net: add missing SOF_TIMESTAMPING_OPT_ID support
- mm: fix race between MADV_FREE reclaim and blkdev direct IO read
- [arm64] KVM: arm64: Check arm64_get_bp_hardening_data() didn't return NULL
- drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire()
- [x86] Drivers: hv: vmbus: Fix potential crash on module unload
- [arm64,armhf] net: stmmac: Fix unset max_speed difference between DT and
non-DT platforms
- [armhf] drm/imx: Fix memory leak in imx_pd_connector_get_modes
- net: openvswitch: don't send internal clone attribute to the userspace.
- rxrpc: fix a race in rxrpc_exit_net()
- qede: confirm skb is allocated before using
- drbd: Fix five use after free bugs in get_initial_state
- [arm64] Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning"
- mmmremap.c: avoid pointless invalidate_range_start/end on
mremap(old_size=0)
- mm/mempolicy: fix mpol_new leak in shared_policy_replace
- [x86] pm: Save the MSR validity status at context setup
- [x86] speculation: Restore speculation related MSRs during S3 resume
- btrfs: fix qgroup reserve overflow the qgroup limit
- [arm64] patch_text: Fixup last cpu should be master
- [arm64] perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator
- [arm64,armhf] irqchip/gic-v3: Fix GICR_CTLR.RWP polling
- mm: don't skip swap entry even if zap_details specified
- [arm64] module: remove (NOLOAD) from linker script
- mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning
- cgroup: Use open-time credentials for process migraton perm checks
(CVE-2021-4197)
- cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
(CVE-2021-4197)
- cgroup: Use open-time cgroup namespace for process migration perm checks
(CVE-2021-4197)
- xfrm: policy: match with both mark and mask on user interfaces
- drm/amdgpu: Check if fd really is an amdgpu fd.
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.239
- net/sched: flower: fix parsing of ethertype following VLAN header
- veth: Ensure eth header is in skb's linear part
- gpiolib: acpi: use correct format characters
- [armhf] net: ethernet: stmmac: fix altr_tse_pcs function when using a
fixed-link
- sctp: Initialize daddr on peeled off socket
- cifs: potential buffer overflow in handling symlinks
- drm/amd: Add USBC connector ID
- [amd64] drm/amdkfd: Check for potential null return of kmalloc_array()
- [x86] Drivers: hv: vmbus: Prevent load re-ordering when reading ring
buffer
- scsi: target: tcmu: Fix possible page UAF
- [powerpc*] scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
- ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs
- [armhf] gpu: ipu-v3: Fix dev_dbg frequency output
- [arm64] alternatives: mark patch_alternative() as `noinstr`
- drm/amd/display: Fix allocate_mst_payload assert on resume
- scsi: mvsas: Add PCI ID of RocketRaid 2640
- drivers: net: slip: fix NPD bug in sl_tx_timeout()
- mm, page_alloc: fix build_zonerefs_node()
- ALSA: hda/realtek: Add quirk for Clevo PD50PNT
- ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
- ipv6: fix panic when forwarding a pkt with no in6 dev
- smp: Fix offline cpu check in flush_smp_call_function_queue()
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.240
- etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
- mm: page_alloc: fix building error on -Werror=array-compare
- tracing: Dump stacktrace trigger to the corresponding instance
- can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error
path (CVE-2022-28388)
- dm integrity: fix memory corruption when tag_size is less than digest size
- gfs2: assign rgrp glock before compute_bitstructs
- ALSA: usb-audio: Clear MIDI port active flag after draining
- tcp: fix race condition when creating child sockets from syncookies
- tcp: Fix potential use-after-free due to double kfree()
- [armhf] dmaengine: imx-sdma: Fix error checking in sdma_event_remap
- rxrpc: Restore removed timer deletion
- net/packet: fix packet_sock xmit return value checking
- net/sched: cls_u32: fix possible leak in u32_init_knode()
- netlink: reset network and mac headers in netlink_dump()
- [x86] platform/x86: samsung-laptop: Fix an unsigned comparison which can
never be negative
- ALSA: usb-audio: Fix undefined behavior due to shift overflowing the
constant
- vxlan: fix error return code in vxlan_fdb_append
- cifs: Check the IOCB_DIRECT flag, not O_DIRECT
- mt76: Fix undefined behavior due to shift overflowing the constant
- brcmfmac: sdio: Fix undefined behavior due to shift overflowing the
constant
- [arm64] drm/msm/mdp5: check the return of kzalloc()
- [arm64] net: macb: Restart tx only if queue pointer is lagging
- stat: fix inconsistency between struct stat and struct compat_stat
- ata: pata_marvell: Check the 'bmdma_addr' beforing reading
- [arm64,armhf] drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not
initialised
- [arm64,armhf] drm/panel/raspberrypi-touchscreen: Initialise the bridge in
prepare
- [powerpc*] perf: Fix power9 event alternatives
- openvswitch: fix OOB access in reserve_sfa_size()
- ASoC: soc-dapm: fix two incorrect uses of list iterator
- e1000e: Fix possible overflow in LTR decoding
- [arm*] arm_pmu: Validate single/group leader events
- ext4: fix symlink file size not match to file content
- ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
- ext4: fix overhead calculation to account for the reserved gdt blocks
- ext4: force overhead calculation if the s_overhead_cluster makes no sense
- block/compat_ioctl: fix range check in BLKGETSIZE
- ax25: add refcount in ax25_dev to avoid UAF bugs (CVE-2022-1204)
- ax25: fix reference count leaks of ax25_dev (CVE-2022-1204)
- ax25: fix UAF bugs of net_device caused by rebinding operation
(CVE-2022-1204)
- ax25: Fix refcount leaks caused by ax25_cb_del()
- ax25: fix UAF bug in ax25_send_control() (CVE-2022-1204)
- ax25: fix NPD bug in ax25_disconnect (CVE-2022-1199)
- ax25: Fix NULL pointer dereferences in ax25 timers (CVE-2022-1205)
- ax25: Fix UAF bugs in ax25 timers (CVE-2022-1205)
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.241
- floppy: disable FDRAWCMD by default (CVE-2022-33981)
- hamradio: defer 6pack kfree after unregister_netdev (CVE-2022-1195)
- hamradio: remove needs_free_netdev to avoid UAF (CVE-2022-1195)
- net/sched: cls_u32: fix netns refcount changes in u32_change()
(CVE-2022-29581)
- [powerpc*] 64/interrupt: Temporarily save PPR on stack to fix register
corruption due to SLB miss
- [powerpc*] 64s: Unmerge EX_LR and EX_DAR
- [armhf] Revert "net: ethernet: stmmac: fix altr_tse_pcs function when
using a fixed-link"
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.242
- USB: quirks: add a Realtek card reader
- USB: quirks: add STRING quirk for VCOM device
- USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
- USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader
- USB: serial: option: add support for Cinterion MV32-WA/MV32-WB
- USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions
- xhci: stop polling roothubs after shutdown
- iio: dac: ad5446: Fix read_raw not returning set value
- [x86] iio: magnetometer: ak8975: Fix the error handling in
ak8975_power_on()
- usb: misc: fix improper handling of refcount in uss720_probe()
- usb: gadget: uvc: Fix crash when encoding data for usb request
- usb: gadget: configfs: clear deactivation flag in
configfs_composite_unbind()
- [arm64,armhf] usb: dwc3: core: Fix tx/rx threshold settings
- [arm64,armhf] usb: dwc3: gadget: Return proper request status
- [armhf] serial: imx: fix overrun interrupts in DMA mode
- serial: 8250: Also set sticky MCR bits in console restoration
- serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
- hex2bin: make the function hex_to_bin constant-time
- hex2bin: fix access beyond string end
- USB: Fix xhci event ring dequeue pointer ERDP update issue
- [armhf] phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe
- [armhf] phy: samsung: exynos5250-sata: fix missing device put in probe
error paths
- [armhf] ARM: OMAP2+: Fix refcount leak in omap_gic_of_init
- [armhf] dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35
- ipvs: correctly print the memory size of ip_vs_conn_tab
- tcp: md5: incorrect tcp_header_len for incoming connections
- sctp: check asoc strreset_chunk in sctp_generate_reconf_event
- [arm64] net: hns3: add validity check for message data length
- ip_gre: Make o_seqno start from 0 in native mode
- tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
- [arm64,armhf] bus: sunxi-rsb: Fix the return value of
sunxi_rsb_device_create()
- [arm64,armhf] clk: sunxi: sun9i-mmc: check return value after calling
platform_get_resource()
- bnx2x: fix napi API usage sequence
- ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit()
- [amd64] x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
- cifs: destage any unwritten data to the server before calling
copychunk_write
- [x86] drivers: net: hippi: Fix deadlock in rr_close()
- [x86] cpu: Load microcode during restore_processor_state()
- tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
- tty: n_gsm: fix malformed counter for out of frame data
- netfilter: nft_socket: only do sk lookups when indev is available
- tty: n_gsm: fix insufficient txframe size
- tty: n_gsm: fix missing explicit ldisc flush
- tty: n_gsm: fix wrong command retry handling
- tty: n_gsm: fix wrong command frame length field encoding
- tty: n_gsm: fix incorrect UA handling
- drm/vgem: Close use-after-free race in vgem_gem_create (CVE-2022-1419)
- [mips*] Fix CP0 counter erratum detection for R4k CPUs
- ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
- gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
- Revert "SUNRPC: attempt AF_LOCAL connect on setup"
- firewire: fix potential uaf in outbound_phy_packet_callback()
- firewire: remove check of list iterator against head past the loop body
- firewire: core: extend card->lock in fw_core_handle_bus_reset
- genirq: Synchronize interrupt thread startup
- nfc: replace improper check device_is_registered() in netlink related
functions (CVE-2022-1974)
- NFC: netlink: fix sleep in atomic bug when firmware download timeout
(CVE-2022-1975)
- hwmon: (adt7470) Fix warning on module removal
- [arm*] ASoC: dmaengine: Restore NULL prepare_slave_config() callback
- [arm64,armhf] net: stmmac: dwmac-sun8i: add missing of_node_put() in
sun8i_dwmac_register_mdio_mux()
- [arm64,armhf] smsc911x: allow using IRQ0
- btrfs: always log symlinks in full mode
- net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
- [x86] kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
architectural PMU
- mm: fix unexpected zeroed page mapping with zram swap
- tcp: make sure treq->af_specific is initialized
- dm: fix mempool NULL pointer race when completing IO
- dm: interlock pending dm_io and dm_wait_for_bios_completion
- [arm64] PCI: aardvark: Clear all MSIs at setup
- [arm64] PCI: aardvark: Fix reading MSI interrupt number
- mmc: rtsx: add 74 Clocks in power on flow
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.243
- block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
- nfp: bpf: silence bitwise vs. logical OR warning
- Bluetooth: Fix the creation of hdev->name
- ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
(CVE-2022-1048)
- ALSA: pcm: Fix races among concurrent read/write and buffer changes
(CVE-2022-1048)
- ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
(CVE-2022-1048)
- ALSA: pcm: Fix races among concurrent prealloc proc writes (CVE-2022-1048)
- ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
- mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
- mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and
__mcopy_atomic()
- VFS: Fix memory leak caused by concurrently mounting fs with subtype
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.244
- batman-adv: Don't skb_split skbuffs with frag_list
- hwmon: (tmp401) Add OF device ID table
- net: Fix features skip in for_each_netdev_feature()
- ipv4: drop dst in multicast routing path

[continued in next message]

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)