linux-azure-4.15 (4.15.0-1159.174) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1159.174 -proposed tracker (LP: #2001985)

  [ Ubuntu: 4.15.0-202.213 ]

  * bionic/linux: 4.15.0-202.213 -proposed tracker (LP: #2002005)
  * CVE-2022-3643
    - xen/netback: Ensure protocol headers don't fall in the non-linear area
  * CVE-2022-45934
    - Bluetooth: L2CAP: Fix u8 overflow
  * CVE-2022-42896
    - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
    - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
  * CVE-2022-43945
    - NFSD: Cap rsize_bop result based on send buffer size

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Tue, 10 Jan 2023 23:24:38 -0300

linux-azure-4.15 (4.15.0-1158.173) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1158.173 -proposed tracker (LP: #1997851)

  * [RELEASE BLOCKER] Call trace during nvme storage performance test in
    bionic/linux-azure 4.15.0-1154 (LP: #1996093)
    - PCI: hv: Only reuse existing IRTE allocation for Multi-MSI

  [ Ubuntu: 4.15.0-201.212 ]

  * bionic/linux: 4.15.0-201.212 -proposed tracker (LP: #1997871)
  * Expose built-in trusted and revoked certificates (LP: #1996892)
    - [Packaging] Expose built-in trusted and revoked certificates
  * Bionic update: upstream stable patchset 2022-09-21 (LP: #1990434)
    - s390/archrandom: prevent CPACF trng invocations in interrupt context
  * BUG: scheduling while atomic: ip/1210/0x00000200 on xenial/hwe rumford
    (LP: #1995870)
    - tg3: prevent scheduling while atomic splat
  * Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349)
    - bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds()
    - selftests/bpf: Fix test_align verifier log patterns
    - drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg
    - platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask
    - wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
    - ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler
    - kcm: fix strp_init() order and cleanup
    - serial: fsl_lpuart: RS485 RTS polariy is inverse
    - staging: rtl8712: fix use after free bugs
    - vt: Clear selection before changing the font
    - USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id
    - binder: fix UAF of ref->proc caused by race condition
    - drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported"
    - Input: rk805-pwrkey - fix module autoloading
    - hwmon: (gpio-fan) Fix array out of bounds access
    - thunderbolt: Use the actual buffer in tb_async_error()
    - xhci: Add grace period after xHC start to prevent premature runtime suspend.
    - USB: serial: cp210x: add Decagon UCA device id
    - USB: serial: option: add support for OPPO R11 diag port
    - USB: serial: option: add Quectel EM060K modem
    - USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode
    - usb: dwc2: fix wrong order of phy_power_on and phy_init
    - USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020)
    - usb-storage: Add ignore-residue quirk for NXP PN7462AU
    - s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages
    - s390: fix nospec table alignments
    - USB: core: Prevent nested device-reset calls
    - usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
    - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
    - net: mac802154: Fix a condition in the receive path
    - ALSA: seq: oss: Fix data-race for max_midi_devs access
    - ALSA: seq: Fix data-race at module auto-loading
    - efi: capsule-loader: Fix use-after-free in efi_capsule_write
    - wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in
      il4965_rs_fill_link_cmd()
    - fs: only do a memory barrier for the first set_buffer_uptodate()
    - Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"
    - drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup.
    - drm/radeon: add a force flush to delay work when radeon
    - parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources()
    - parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines
    - fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init()
    - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
    - ALSA: aloop: Fix random zeros in capture data when using jiffies timer
    - ALSA: usb-audio: Fix an out-of-bounds bug in
      __snd_usb_parse_audio_interface()
    - kprobes: Prohibit probes in gate area
    - scsi: mpt3sas: Fix use-after-free warning
    - driver core: Don't probe devices after bus_type.match() probe deferral
    - netfilter: br_netfilter: Drop dst references before setting.
    - sch_sfb: Don't assume the skb is still around after enqueueing to child
    - tipc: fix shift wrapping bug in map_get()
    - ipv6: sr: fix out-of-bounds read when setting HMAC data.
    - tcp: fix early ETIMEDOUT after spurious non-SACK RTO
    - sch_sfb: Also store skb len before calling child enqueue
    - usb: dwc3: fix PHY disable sequence
    - USB: serial: ch341: fix lost character on LCR updates
    - USB: serial: ch341: fix disabled rx timer on older devices
    - MIPS: loongson32: ls1c: Fix hang during startup
    - SUNRPC: use _bh spinlocking on ->transport_lock
    - net: dp83822: disable false carrier interrupt
    - tcp: annotate data-race around challenge_timestamp
    - clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops
    - clk: core: Fix runtime PM sequence in clk_core_unprepare()
    - soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs
    - i40e: Fix kernel crash during module removal
    - mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
    - drm/msm/rd: Fix FIFO-full deadlock
    - HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
    - tg3: Disable tg3 device on system reboot to avoid triggering AER
    - ieee802154: cc2520: add rc code in cc2520_tx()
    - platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes
    - tracefs: Only clobber mode/uid/gid on remount if asked
    - net: dp83822: disable rx error interrupt
  * Bionic update: upstream stable patchset 2022-10-06 (LP: #1992112)
    - audit: fix potential double free on error path from fsnotify_add_inode_mark
    - parisc: Fix exception handler for fldw and fstw instructions
    - pinctrl: amd: Don't save/restore interrupt status and wake status bits
    - xfrm: fix refcount leak in __xfrm_policy_check()
    - rose: check NULL rose_loopback_neigh->loopback
    - bonding: 802.3ad: fix no transmission of LACPDUs
    - net: ipvtap - add __init/__exit annotations to module init/exit funcs
    - netfilter: ebtables: reject blobs that don't provide all entry points
    - netfilter: nft_payload: report ERANGE for too long offset and length
    - netfilter: nft_payload: do not truncate csum_offset and csum_type
    - net: Fix data-races around weight_p and dev_weight_[rt]x_bias.
    - ratelimit: Fix data-races in ___ratelimit().
    - net: Fix a data-race around sysctl_tstamp_allow_data.
    - net: Fix a data-race around sysctl_net_busy_poll.
    - net: Fix a data-race around sysctl_net_busy_read.
    - net: Fix a data-race around netdev_budget.
    - net: Fix a data-race around netdev_budget_usecs.
    - net: Fix a data-race around sysctl_somaxconn.
    - ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter
    - btrfs: check if root is readonly while setting security xattr
    - loop: Check for overflow while configuring loop
    - asm-generic: sections: refactor memory_intersects
    - mm/hugetlb: fix hugetlb not supporting softdirty tracking
    - md: call __md_stop_writes in md_stop
    - mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
    - arm64: map FDT as RW for early_init_dt_scan()
    - s390/mm: do not trigger write fault when vma does not allow VM_WRITE
    - x86/bugs: Add "unknown" reporting for MMIO Stale Data
    - kbuild: Fix include path in scripts/Makefile.modpost
    - Bluetooth: L2CAP: Fix build errors in some archs
    - media: pvrusb2: fix memory leak in pvr_probe
    - HID: hidraw: fix memory leak in hidraw_release()
    - fbdev: fb_pm2fb: Avoid potential divide by zero error
    - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is
      dead
    - neigh: fix possible DoS due to net iface start/stop loop
    - s390/hypfs: avoid error message under KVM
    - netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
    - kprobes: don't call disarm_kprobe() for disabled kprobes
    - net: neigh: don't call kfree_skb() under spin_lock_irqsave()
    - net: Fix data-races around netdev_tstamp_prequeue.
    - x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry
    - s390: fix double free of GS and RI CBs on fork() failure
    - scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
    - bpf: Fix the off-by-two error in range markings
  * CVE-2022-2663
    - netfilter: nf_conntrack_irc: Fix forged IP logic
  * CVE-2022-3061
    - video: fbdev: i740fb: Error out if 'pixclock' equals zero

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Mon, 05 Dec 2022 11:37:34 -0300

linux-azure-4.15 (4.15.0-1157.172) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1157.172 -proposed tracker (LP: #1997445)

  [ Ubuntu: 4.15.0-200.211 ]

  * bionic/linux: 4.15.0-200.211 -proposed tracker (LP: #1997465)
  * CVE-2022-3239
    - media: em28xx: initialize refcount before kref_get
  * CVE-2022-3524
    - tcp/udp: Fix memory leak in ipv6_renew_options().
  * CVE-2022-3564
    - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
  * CVE-2022-3565
    - mISDN: fix use-after-free bugs in l1oip timer handlers
  * CVE-2022-3566
    - tcp: Fix data races around icsk->icsk_af_ops.
  * CVE-2022-3567
    - ipv6: annotate some data-races around sk->sk_prot
    - ipv6: Fix data races around sk->sk_prot.
  * CVE-2022-3594
    - r8152: Rate limit overflow messages
  * CVE-2022-3621
    - nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
  * CVE-2022-42703
    - mm/rmap.c: don't reuse anon_vma if we just want a copy
    - mm: rmap: explicitly reset vma->anon_vma in unlink_anon_vmas()
    - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse

  [ Ubuntu: 4.15.0-197.208 ]

  * bionic/linux: 4.15.0-197.208 -proposed tracker (LP: #1994998)
  * Memory leak while using NFQUEUE to delegate the decision on TCP packets to
    userspace processes (LP: #1991774)
    - SAUCE: netfilter: nf_queue: Fix memory leak in nf_queue_entry_get_refs
  * Bionic update: upstream stable patchset 2022-09-23 (LP: #1990698)
    - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
    - ntfs: fix use-after-free in ntfs_ucsncmp()
    - ARM: crypto: comment out gcc warning that breaks clang builds
    - mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
    - ACPI: video: Force backlight native for some TongFang devices
    - macintosh/adb: fix oob read in do_adb_query() function
    - Makefile: link with -z noexecstack --no-warn-rwx-segments
    - x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments
    - ALSA: bcd2000: Fix a UAF bug on the error path of probing
    - add barriers to buffer_uptodate and set_buffer_uptodate
    - HID: wacom: Don't register pad_input for touch switch
    - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
    - KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
    - KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
    - ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
    - ALSA: hda/cirrus - support for iMac 12,1 model
    - vfs: Check the truncate maximum size in inode_newsize_ok()
    - fs: Add missing umask strip in vfs_tmpfile
    - usbnet: Fix linkwatch use-after-free on disconnect
    - parisc: Fix device names in /proc/iomem
    - drm/nouveau: fix another off-by-one in nvbios_addr
    - drm/amdgpu: Check BO's requested pinning domains against its
      preferred_domains
    - iio: light: isl29028: Fix the warning in isl29028_remove()
    - fuse: limit nsec
    - md-raid10: fix KASAN warning
    - ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
    - PCI: Add defines for normal and subtractive PCI bridges
    - powerpc/fsl-pci: Fix Class Code of PCIe Root Port
    - powerpc/powernv: Avoid crashing if rng is NULL
    - MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
    - USB: HCD: Fix URB giveback issue in tasklet function
    - netfilter: nf_tables: fix null deref due to zeroed list head
    - arm64: Do not forget syscall when starting a new thread.
    - arm64: fix oops in concurrently setting insn_emulation sysctls
    - ext2: Add more validity checks for inode counts
    - ARM: dts: imx6ul: add missing properties for sram
    - ARM: dts: imx6ul: fix qspi node compatible
    - ARM: OMAP2+: display: Fix refcount leak bug
    - ACPI: PM: save NVS memory for Lenovo G40-45
    - ACPI: LPSS: Fix missing check in register_device_clock()
    - PM: hibernate: defer device probing when resuming from hibernation
    - selinux: Add boundary check in put_entry()
    - ARM: findbit: fix overflowing offset
    - ARM: bcm: Fix refcount leak in bcm_kona_smc_init
    - x86/pmem: Fix platform-device leak in error path
    - ARM: dts: ast2500-evb: fix board compatible
    - soc: fsl: guts: machine variable might be unset
    - cpufreq: zynq: Fix refcount leak in zynq_get_revision
    - ARM: dts: qcom: pm8841: add required thermal-sensor-cells
    - arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
    - regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
    - thermal/tools/tmon: Include pthread and time headers in tmon.h
    - dm: return early from dm_pr_call() if DM device is suspended
    - drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
    - drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function
    - i2c: Fix a potential use after free
    - wifi: iwlegacy: 4965: fix potential off-by-one overflow in
      il4965_rs_fill_link_cmd()
    - drm: bridge: adv7511: Add check for mipi_dsi_driver_register
    - media: hdpvr: fix error value returns in hdpvr_read
    - drm/vc4: dsi: Correct DSI divider calculations
    - drm/rockchip: vop: Don't crash for invalid duplicate_state()
    - drm/mediatek: dpi: Remove output format of YUV
    - drm: bridge: sii8620: fix possible off-by-one
    - media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment
    - tcp: make retransmitted SKB fit into the send window
    - selftests: timers: valid-adjtimex: build fix for newer toolchains
    - selftests: timers: clocksource-switch: fix passing errors from child
    - fs: check FMODE_LSEEK to control internal pipe splicing
    - wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
    - wifi: p54: Fix an error handling path in p54spi_probe()
    - wifi: p54: add missing parentheses in p54_flush()
    - can: pch_can: do not report txerr and rxerr during bus-off
    - can: rcar_can: do not report txerr and rxerr during bus-off
    - can: sja1000: do not report txerr and rxerr during bus-off
    - can: hi311x: do not report txerr and rxerr during bus-off
    - can: sun4i_can: do not report txerr and rxerr during bus-off
    - can: usb_8dev: do not report txerr and rxerr during bus-off
    - can: error: specify the values of data[5..7] of CAN error frames
    - can: pch_can: pch_can_error(): initialize errc before using it
    - Bluetooth: hci_intel: Add check for platform_driver_register
    - i2c: cadence: Support PEC for SMBus block read
    - i2c: mux-gpmux: Add of_node_put() when breaking out of loop
    - wifi: wil6210: debugfs: fix uninitialized variable use in
      `wil_write_file_wmi()`
    - wifi: libertas: Fix possible refcount leak in if_usb_probe()
    - net: rose: fix netdev reference changes
    - dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
    - mtd: maps: Fix refcount leak in of_flash_probe_versatile
    - mtd: maps: Fix refcount leak in ap_flash_init
    - mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
    - mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path
    - fpga: altera-pr-ip: fix unsigned comparison with less than zero
    - usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
    - usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
    - misc: rtsx: Fix an error handling path in rtsx_pci_probe()
    - mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch
    - memstick/ms_block: Fix some incorrect memory allocation
    - memstick/ms_block: Fix a memory leak
    - mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
    - scsi: smartpqi: Fix DMA direction for RAID requests
    - usb: gadget: udc: amd5536 depends on HAS_DMA
    - RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
    - gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
    - mmc: cavium-octeon: Add of_node_put() when breaking out of loop
    - mmc: cavium-thunderx: Add of_node_put() when breaking out of loop
    - USB: serial: fix tty-port initialized comments
    - platform/olpc: Fix uninitialized data in debugfs write
    - mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
    - RDMA/rxe: Fix error unwind in rxe_create_qp()
    - ext4: recover csum seed of tmp_inode after migrating to extents
    - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
    - ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
    - ASoC: codecs: da7210: add check for i2c_add_driver
    - ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe
    - profiling: fix shift too large makes kernel panic
    - tty: n_gsm: fix non flow control frames during mux flow off
    - tty: n_gsm: fix packet re-transmission without open control channel
    - tty: n_gsm: fix race condition in gsmld_write()
    - remoteproc: qcom: wcnss: Fix handling of IRQs
    - vfio/ccw: Do not change FSM state in subchannel event
    - tty: n_gsm: fix wrong T1 retry count handling
    - tty: n_gsm: fix DM command
    - iommu/exynos: Handle failed IOMMU device registration properly
    - kfifo: fix kfifo_to_user() return type
    - mfd: t7l66xb: Drop platform disable callback
    - iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop
    - s390/zcore: fix race when reading from hardware system area
    - video: fbdev: amba-clcd: Fix refcount leak bugs
    - video: fbdev: sis: fix typos in SiS_GetModeID()
    - powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and
      alias
    - powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader
    - powerpc/xive: Fix refcount leak in xive_get_max_prio
    - powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
    - kprobes: Forbid probing on trampoline and BPF code areas
    - powerpc/pci: Fix PHB numbering when using opal-phbid
    - genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO
    - x86/numa: Use cpumask_available instead of hardcoded NULL check
    - video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()
    - tools/thermal: Fix possible path truncations
    - video: fbdev: vt8623fb: Check the size of screen before memset_io()
    - video: fbdev: arkfb: Check the size of screen before memset_io()
    - video: fbdev: s3fb: Check the size of screen before memset_io()
    - scsi: zfcp: Fix missing auto port scan and thus missing target ports
    - x86/olpc: fix 'logical not is only applied to the left hand side'
    - spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
    - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
    - ext4: make sure ext4_append() always allocates new block
    - ext4: fix use-after-free in ext4_xattr_set_entry
    - ext4: update s_overhead_clusters in the superblock during an on-line resize
    - ext4: fix extent status tree race in writeback error recovery path
    - ext4: correct max_inline_xattr_value_size computing
    - ext4: correct the misjudgment in ext4_iget_extra_inode
    - intel_th: pci: Add Raptor Lake-S CPU support
    - intel_th: pci: Add Raptor Lake-S PCH support
    - intel_th: pci: Add Meteor Lake-P support
    - dm raid: fix address sanitizer warning in raid_resume
    - dm raid: fix address sanitizer warning in raid_status
    - btrfs: reject log replay if there is unsupported RO compat flag
    - KVM: Add infrastructure and macro to mark VM as bugged
    - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
    - KVM: x86: Avoid theoretical NULL pointer dereference in
      kvm_irq_delivery_to_apic_fast()
    - tcp: fix over estimation in sk_forced_mem_schedule()
    - scsi: sg: Allow waiting for commands to complete on removed device
    - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
    - net/9p: Initialize the iounit field during fid creation
    - net_sched: cls_route: disallow handle of 0
    - powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E
    - ALSA: info: Fix llseek return value when using callback
    - rds: add missing barrier to release_refill
    - ata: libata-eh: Add missing command name
    - btrfs: fix lost error handling when looking up extended ref on log replay
    - can: ems_usb: fix clang's -Wunaligned-access warning
    - apparmor: fix quiet_denied for file rules
    - apparmor: Fix failed mount permission check error message
    - apparmor: fix aa_label_asxprint return check
    - apparmor: fix reference count leak in aa_pivotroot()
    - NFSv4: Fix races in the legacy idmapper upcall
    - NFSv4.1: RECLAIM_COMPLETE must handle EACCES
    - SUNRPC: Reinitialise the backchannel request buffers before reuse
    - pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map
    - pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
    - ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool
    - geneve: do not use RT_TOS for IPv6 flowlabel
    - vsock: Fix memory leak in vsock_connect()
    - vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout()
    - tools build: Switch to new openssl API for test-libcrypto
    - xen/xenbus: fix return type in xenbus_file_read()
    - atm: idt77252: fix use-after-free bugs caused by tst_timer
    - nios2: page fault et.al. are *not* restartable syscalls...
    - nios2: don't leave NULLs in sys_call_table[]
    - nios2: traced syscall does need to check the syscall number
    - nios2: fix syscall restart checks
    - nios2: restarts apply only to the first sigframe we build...
    - nios2: add force_successful_syscall_return()
    - netfilter: nf_tables: really skip inactive sets when allocating name
    - powerpc/pci: Fix get_phb_number() locking
    - i40e: Fix to stop tx_timeout recovery if GLOBR fails
    - fec: Fix timer capture timing in `fec_ptp_enable_pps()`
    - igb: Add lock to avoid data race
    - kbuild: clear LDFLAGS in the top Makefile
    - btrfs: only write the sectors in the vertical stripe which has data stripes
    - btrfs: raid56: don't trust any cached sector in __raid56_parity_recover()
    - drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()
    - PCI: Add ACS quirk for Broadcom BCM5750x NICs
    - irqchip/tegra: Fix overflow implicit truncation warnings
    - usb: host: ohci-ppc-of: Fix refcount leak bug
    - clk: qcom: ipq8074: dont disable gcc_sleep_clk_src
    - gadgetfs: ep_io - wait until IRQ finishes
    - cxl: Fix a memory leak in an error handling path
    - drivers:md:fix a potential use-after-free bug
    - ext4: avoid remove directory when directory is corrupted
    - ext4: avoid resizing to a partial cluster size
    - tty: serial: Fix refcount leak bug in ucc_uart.c
    - vfio: Clear the caps->buf to NULL after free
    - mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
    - ALSA: core: Add async signal helpers
    - ALSA: timer: Use deferred fasync helper
    - smb3: check xattr value length earlier
    - powerpc/64: Init jump labels before parse_early_param()
    - video: fbdev: i740fb: Check the argument of i740_calc_vclk()
    - MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
    - meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
    - ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init
    - nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt()
    - media: tw686x: Register the irq at the end of probe
    - HID: cp2112: prevent a buffer overflow in cp2112_xfer()
    - staging: rtl8192u: Fix sleep in atomic context bug in
      dm_fsync_timer_callback
    - HID: alps: Declare U1_UNICORN_LEGACY support
    - tty: n_gsm: fix missing corner cases in gsmld_poll()
    - rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge
    - gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file
  * Bionic update: upstream stable patchset 2022-09-21 (LP: #1990434)
    - xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE
    - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in
      xfrm_bundle_lookup()
    - power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
    - perf/core: Fix data race between perf_event_set_output() and
      perf_mmap_close()
    - ip: Fix a data-race around sysctl_fwmark_reflect.
    - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
    - tcp: Fix a data-race around sysctl_tcp_probe_threshold.
    - tcp: Fix a data-race around sysctl_tcp_probe_interval.
    - i2c: cadence: Change large transfer count reset logic to be unconditional
    - net: stmmac: fix dma queue left shift overflow issue
    - igmp: Fix data-races around sysctl_igmp_llm_reports.
    - igmp: Fix a data-race around sysctl_igmp_max_memberships.
    - tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
    - be2net: Fix buffer overflow in be_get_module_eeprom
    - Revert "Revert "char/random: silence a lockdep splat with printk()""
    - mm/mempolicy: fix uninit-value in mpol_rebind_policy()
    - bpf: Make sure mac_header was set before using it
    - drm/tilcdc: Remove obsolete crtc_mode_valid() hack
    - tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
    - ALSA: memalloc: Align buffer allocations in page size
    - Bluetooth: Add bt_skb_sendmsg helper
    - Bluetooth: Add bt_skb_sendmmsg helper
    - Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg
    - Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg
    - Bluetooth: Fix passing NULL to PTR_ERR
    - Bluetooth: SCO: Fix sco_send_frame returning skb->len
    - Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks
    - tty: drivers/tty/, stop using tty_schedule_flip()
    - tty: the rest, stop using tty_schedule_flip()
    - tty: drop tty_schedule_flip()
    - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
    - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
    - PCI: hv: Fix multi-MSI to allow more than one MSI vector
    - PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI
    - PCI: hv: Reuse existing IRTE allocation in compose_msi_msg()
    - PCI: hv: Fix interrupt mapping for multi-MSI
    - ip: Fix data-races around sysctl_ip_fwd_use_pmtu.
    - ip: Fix data-races around sysctl_ip_nonlocal_bind.
    - tcp: Fix data-races around sysctl_tcp_mtu_probing.
    - tcp: Fix data-races around sysctl_tcp_reordering.
    - tcp: Fix data-races around some timeout sysctl knobs.
    - tcp: Fix a data-race around sysctl_tcp_tw_reuse.
    - tcp: Fix data-races around sysctl_tcp_fastopen.
    - tcp: Fix a data-race around sysctl_tcp_early_retrans.
    - tcp: Fix data-races around sysctl_tcp_recovery.
    - tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.
    - tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.
    - tcp: Fix a data-race around sysctl_tcp_retrans_collapse.
    - tcp: Fix a data-race around sysctl_tcp_stdurg.
    - tcp: Fix a data-race around sysctl_tcp_rfc1337.
    - tcp: Fix data-races around sysctl_tcp_max_reordering.
    - ima: remove the IMA_TEMPLATE Kconfig option
    - [Config] updateconfigs for IMA_TEMPLATE
    - tcp: Fix data-races around sysctl_tcp_dsack.
    - tcp: Fix a data-race around sysctl_tcp_app_win.
    - tcp: Fix a data-race around sysctl_tcp_adv_win_scale.
    - tcp: Fix a data-race around sysctl_tcp_frto.
    - tcp: Fix a data-race around sysctl_tcp_nometrics_save.
    - scsi: ufs: host: Hold reference returned by of_parse_phandle()
    - tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit.
    - net: ping6: Fix memleak in ipv6_renew_options().
    - igmp: Fix data-races around sysctl_igmp_qrv.
    - net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
    - tcp: Fix a data-race around sysctl_tcp_min_tso_segs.
    - tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen.
    - tcp: Fix a data-race around sysctl_tcp_autocorking.
    - tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit.
    - Documentation: fix sctp_wmem in ip-sysctl.rst
    - i40e: Fix interface init with MSI interrupts (no MSI-X)
    - sctp: fix sleep in atomic context bug in timer handlers
    - perf symbol: Correct address for bss symbols
    - scsi: core: Fix race between handling STS_RESOURCE and completion
    - ACPI: video: Shortening quirk list by identifying Clevo by board_name only
  * unprivileged users may trigger page cache invalidation WARN (LP: #1989144)
    - iomap: fix WARN_ON_ONCE() from unprivileged users
  * Users belonging to video group may trigger a deadlock WARN (LP: #1990690)
    - SAUCE: fbdev: remove redundant lock_fb_info
  * ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel
    systems (LP: #1990985)
    - ACPI: processor_idle: Skip dummy wait if kernel is in guest
    - ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel
      systems
  * CVE-2022-3028
    - af_key: Do not call xfrm_probe_algs in parallel
  * CVE-2022-2978
    - fs: fix UAF/GPF bug in nilfs_mdt_destroy
  * CVE-2022-40768
    - scsi: stex: Properly zero out the passthrough command structure

  [ Ubuntu: 4.15.0-196.207 ]

  * bionic/linux: 4.15.0-196.207 -proposed tracker (LP: #1994992)
  * [UBUNTU 18.04] Ubuntu 18.04 kernel 4.15.0-194 crashes on IPL (LP: #1994601)
    - SAUCE: Revert "s390/archrandom: simplify back to earlier design and
      initialize earlier"

 -- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 25 Nov 2022 11:54:25 -0300

linux-azure-4.15 (4.15.0-1154.169) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1154.169 -proposed tracker (LP: #1992077)

  * Bionic update: upstream stable patchset 2022-09-21 (LP: #1990434)
    - [Config] updateconfigs for IMA_TEMPLATE

  [ Ubuntu: 4.15.0-195.206 ]

  * bionic/linux: 4.15.0-195.206 -proposed tracker (LP: #1992097)
  * Memory leak while using NFQUEUE to delegate the decision on TCP packets to
    userspace processes (LP: #1991774)
    - SAUCE: netfilter: nf_queue: Fix memory leak in nf_queue_entry_get_refs
  * Bionic update: upstream stable patchset 2022-09-23 (LP: #1990698)
    - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
    - ntfs: fix use-after-free in ntfs_ucsncmp()
    - ARM: crypto: comment out gcc warning that breaks clang builds
    - mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
    - ACPI: video: Force backlight native for some TongFang devices
    - macintosh/adb: fix oob read in do_adb_query() function
    - Makefile: link with -z noexecstack --no-warn-rwx-segments
    - x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments
    - ALSA: bcd2000: Fix a UAF bug on the error path of probing
    - add barriers to buffer_uptodate and set_buffer_uptodate
    - HID: wacom: Don't register pad_input for touch switch
    - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
    - KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
    - KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
    - ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
    - ALSA: hda/cirrus - support for iMac 12,1 model
    - vfs: Check the truncate maximum size in inode_newsize_ok()
    - fs: Add missing umask strip in vfs_tmpfile
    - usbnet: Fix linkwatch use-after-free on disconnect
    - parisc: Fix device names in /proc/iomem
    - drm/nouveau: fix another off-by-one in nvbios_addr
    - drm/amdgpu: Check BO's requested pinning domains against its
      preferred_domains
    - iio: light: isl29028: Fix the warning in isl29028_remove()
    - fuse: limit nsec
    - md-raid10: fix KASAN warning
    - ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
    - PCI: Add defines for normal and subtractive PCI bridges
    - powerpc/fsl-pci: Fix Class Code of PCIe Root Port
    - powerpc/powernv: Avoid crashing if rng is NULL
    - MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
    - USB: HCD: Fix URB giveback issue in tasklet function
    - netfilter: nf_tables: fix null deref due to zeroed list head
    - arm64: Do not forget syscall when starting a new thread.
    - arm64: fix oops in concurrently setting insn_emulation sysctls
    - ext2: Add more validity checks for inode counts
    - ARM: dts: imx6ul: add missing properties for sram
    - ARM: dts: imx6ul: fix qspi node compatible
    - ARM: OMAP2+: display: Fix refcount leak bug
    - ACPI: PM: save NVS memory for Lenovo G40-45
    - ACPI: LPSS: Fix missing check in register_device_clock()
    - PM: hibernate: defer device probing when resuming from hibernation
    - selinux: Add boundary check in put_entry()
    - ARM: findbit: fix overflowing offset
    - ARM: bcm: Fix refcount leak in bcm_kona_smc_init
    - x86/pmem: Fix platform-device leak in error path
    - ARM: dts: ast2500-evb: fix board compatible
    - soc: fsl: guts: machine variable might be unset
    - cpufreq: zynq: Fix refcount leak in zynq_get_revision
    - ARM: dts: qcom: pm8841: add required thermal-sensor-cells
    - arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
    - regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
    - thermal/tools/tmon: Include pthread and time headers in tmon.h
    - dm: return early from dm_pr_call() if DM device is suspended
    - drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
    - drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function
    - i2c: Fix a potential use after free
    - wifi: iwlegacy: 4965: fix potential off-by-one overflow in
      il4965_rs_fill_link_cmd()
    - drm: bridge: adv7511: Add check for mipi_dsi_driver_register
    - media: hdpvr: fix error value returns in hdpvr_read
    - drm/vc4: dsi: Correct DSI divider calculations
    - drm/rockchip: vop: Don't crash for invalid duplicate_state()
    - drm/mediatek: dpi: Remove output format of YUV
    - drm: bridge: sii8620: fix possible off-by-one
    - media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment
    - tcp: make retransmitted SKB fit into the send window
    - selftests: timers: valid-adjtimex: build fix for newer toolchains
    - selftests: timers: clocksource-switch: fix passing errors from child
    - fs: check FMODE_LSEEK to control internal pipe splicing
    - wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
    - wifi: p54: Fix an error handling path in p54spi_probe()
    - wifi: p54: add missing parentheses in p54_flush()
    - can: pch_can: do not report txerr and rxerr during bus-off
    - can: rcar_can: do not report txerr and rxerr during bus-off
    - can: sja1000: do not report txerr and rxerr during bus-off
    - can: hi311x: do not report txerr and rxerr during bus-off
    - can: sun4i_can: do not report txerr and rxerr during bus-off
    - can: usb_8dev: do not report txerr and rxerr during bus-off
    - can: error: specify the values of data[5..7] of CAN error frames
    - can: pch_can: pch_can_error(): initialize errc before using it
    - Bluetooth: hci_intel: Add check for platform_driver_register
    - i2c: cadence: Support PEC for SMBus block read
    - i2c: mux-gpmux: Add of_node_put() when breaking out of loop
    - wifi: wil6210: debugfs: fix uninitialized variable use in
      `wil_write_file_wmi()`
    - wifi: libertas: Fix possible refcount leak in if_usb_probe()
    - net: rose: fix netdev reference changes
    - dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
    - mtd: maps: Fix refcount leak in of_flash_probe_versatile
    - mtd: maps: Fix refcount leak in ap_flash_init
    - mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
    - mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path
    - fpga: altera-pr-ip: fix unsigned comparison with less than zero
    - usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
    - usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
    - misc: rtsx: Fix an error handling path in rtsx_pci_probe()
    - mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch
    - memstick/ms_block: Fix some incorrect memory allocation
    - memstick/ms_block: Fix a memory leak
    - mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
    - scsi: smartpqi: Fix DMA direction for RAID requests
    - usb: gadget: udc: amd5536 depends on HAS_DMA
    - RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
    - gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
    - mmc: cavium-octeon: Add of_node_put() when breaking out of loop
    - mmc: cavium-thunderx: Add of_node_put() when breaking out of loop
    - USB: serial: fix tty-port initialized comments
    - platform/olpc: Fix uninitialized data in debugfs write
    - mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
    - RDMA/rxe: Fix error unwind in rxe_create_qp()
    - ext4: recover csum seed of tmp_inode after migrating to extents
    - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
    - ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
    - ASoC: codecs: da7210: add check for i2c_add_driver
    - ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe
    - profiling: fix shift too large makes kernel panic
    - tty: n_gsm: fix non flow control frames during mux flow off
    - tty: n_gsm: fix packet re-transmission without open control channel
    - tty: n_gsm: fix race condition in gsmld_write()
    - remoteproc: qcom: wcnss: Fix handling of IRQs
    - vfio/ccw: Do not change FSM state in subchannel event
    - tty: n_gsm: fix wrong T1 retry count handling
    - tty: n_gsm: fix DM command
    - iommu/exynos: Handle failed IOMMU device registration properly
    - kfifo: fix kfifo_to_user() return type
    - mfd: t7l66xb: Drop platform disable callback
    - iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop
    - s390/zcore: fix race when reading from hardware system area
    - video: fbdev: amba-clcd: Fix refcount leak bugs
    - video: fbdev: sis: fix typos in SiS_GetModeID()
    - powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and
      alias
    - powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader
    - powerpc/xive: Fix refcount leak in xive_get_max_prio
    - powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
    - kprobes: Forbid probing on trampoline and BPF code areas
    - powerpc/pci: Fix PHB numbering when using opal-phbid
    - genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO
    - x86/numa: Use cpumask_available instead of hardcoded NULL check
    - video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()
    - tools/thermal: Fix possible path truncations
    - video: fbdev: vt8623fb: Check the size of screen before memset_io()
    - video: fbdev: arkfb: Check the size of screen before memset_io()
    - video: fbdev: s3fb: Check the size of screen before memset_io()
    - scsi: zfcp: Fix missing auto port scan and thus missing target ports
    - x86/olpc: fix 'logical not is only applied to the left hand side'
    - spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
    - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
    - ext4: make sure ext4_append() always allocates new block
    - ext4: fix use-after-free in ext4_xattr_set_entry
    - ext4: update s_overhead_clusters in the superblock during an on-line resize
    - ext4: fix extent status tree race in writeback error recovery path
    - ext4: correct max_inline_xattr_value_size computing
    - ext4: correct the misjudgment in ext4_iget_extra_inode
    - intel_th: pci: Add Raptor Lake-S CPU support
    - intel_th: pci: Add Raptor Lake-S PCH support
    - intel_th: pci: Add Meteor Lake-P support
    - dm raid: fix address sanitizer warning in raid_resume
    - dm raid: fix address sanitizer warning in raid_status
    - btrfs: reject log replay if there is unsupported RO compat flag
    - KVM: Add infrastructure and macro to mark VM as bugged
    - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
    - KVM: x86: Avoid theoretical NULL pointer dereference in
      kvm_irq_delivery_to_apic_fast()
    - tcp: fix over estimation in sk_forced_mem_schedule()
    - scsi: sg: Allow waiting for commands to complete on removed device
    - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
    - net/9p: Initialize the iounit field during fid creation
    - net_sched: cls_route: disallow handle of 0
    - powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E
    - ALSA: info: Fix llseek return value when using callback
    - rds: add missing barrier to release_refill
    - ata: libata-eh: Add missing command name
    - btrfs: fix lost error handling when looking up extended ref on log replay
    - can: ems_usb: fix clang's -Wunaligned-access warning
    - apparmor: fix quiet_denied for file rules
    - apparmor: Fix failed mount permission check error message
    - apparmor: fix aa_label_asxprint return check
    - apparmor: fix reference count leak in aa_pivotroot()
    - NFSv4: Fix races in the legacy idmapper upcall
    - NFSv4.1: RECLAIM_COMPLETE must handle EACCES
    - SUNRPC: Reinitialise the backchannel request buffers before reuse
    - pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map
    - pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
    - ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool
    - geneve: do not use RT_TOS for IPv6 flowlabel
    - vsock: Fix memory leak in vsock_connect()
    - vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout()
    - tools build: Switch to new openssl API for test-libcrypto
    - xen/xenbus: fix return type in xenbus_file_read()
    - atm: idt77252: fix use-after-free bugs caused by tst_timer
    - nios2: page fault et.al. are *not* restartable syscalls...
    - nios2: don't leave NULLs in sys_call_table[]
    - nios2: traced syscall does need to check the syscall number
    - nios2: fix syscall restart checks
    - nios2: restarts apply only to the first sigframe we build...
    - nios2: add force_successful_syscall_return()
    - netfilter: nf_tables: really skip inactive sets when allocating name
    - powerpc/pci: Fix get_phb_number() locking
    - i40e: Fix to stop tx_timeout recovery if GLOBR fails
    - fec: Fix timer capture timing in `fec_ptp_enable_pps()`
    - igb: Add lock to avoid data race
    - kbuild: clear LDFLAGS in the top Makefile
    - btrfs: only write the sectors in the vertical stripe which has data stripes
    - btrfs: raid56: don't trust any cached sector in __raid56_parity_recover()
    - drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()
    - PCI: Add ACS quirk for Broadcom BCM5750x NICs
    - irqchip/tegra: Fix overflow implicit truncation warnings
    - usb: host: ohci-ppc-of: Fix refcount leak bug
    - clk: qcom: ipq8074: dont disable gcc_sleep_clk_src
    - gadgetfs: ep_io - wait until IRQ finishes
    - cxl: Fix a memory leak in an error handling path
    - drivers:md:fix a potential use-after-free bug
    - ext4: avoid remove directory when directory is corrupted
    - ext4: avoid resizing to a partial cluster size
    - tty: serial: Fix refcount leak bug in ucc_uart.c
    - vfio: Clear the caps->buf to NULL after free
    - mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
    - ALSA: core: Add async signal helpers
    - ALSA: timer: Use deferred fasync helper
    - smb3: check xattr value length earlier
    - powerpc/64: Init jump labels before parse_early_param()
    - video: fbdev: i740fb: Check the argument of i740_calc_vclk()
    - MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
    - meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
    - ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init
    - nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt()
    - media: tw686x: Register the irq at the end of probe
    - HID: cp2112: prevent a buffer overflow in cp2112_xfer()
    - staging: rtl8192u: Fix sleep in atomic context bug in
      dm_fsync_timer_callback
    - HID: alps: Declare U1_UNICORN_LEGACY support
    - tty: n_gsm: fix missing corner cases in gsmld_poll()
    - rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge
    - gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file
  * Bionic update: upstream stable patchset 2022-09-21 (LP: #1990434)
    - xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE
    - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in
      xfrm_bundle_lookup()
    - power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
    - perf/core: Fix data race between perf_event_set_output() and
      perf_mmap_close()
    - ip: Fix a data-race around sysctl_fwmark_reflect.
    - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
    - tcp: Fix a data-race around sysctl_tcp_probe_threshold.
    - tcp: Fix a data-race around sysctl_tcp_probe_interval.
    - i2c: cadence: Change large transfer count reset logic to be unconditional
    - net: stmmac: fix dma queue left shift overflow issue
    - igmp: Fix data-races around sysctl_igmp_llm_reports.
    - igmp: Fix a data-race around sysctl_igmp_max_memberships.
    - tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
    - be2net: Fix buffer overflow in be_get_module_eeprom
    - Revert "Revert "char/random: silence a lockdep splat with printk()""
    - mm/mempolicy: fix uninit-value in mpol_rebind_policy()
    - bpf: Make sure mac_header was set before using it
    - drm/tilcdc: Remove obsolete crtc_mode_valid() hack
    - tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
    - ALSA: memalloc: Align buffer allocations in page size
    - Bluetooth: Add bt_skb_sendmsg helper
    - Bluetooth: Add bt_skb_sendmmsg helper
    - Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg
    - Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg
    - Bluetooth: Fix passing NULL to PTR_ERR
    - Bluetooth: SCO: Fix sco_send_frame returning skb->len
    - Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks
    - tty: drivers/tty/, stop using tty_schedule_flip()
    - tty: the rest, stop using tty_schedule_flip()
    - tty: drop tty_schedule_flip()
    - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
    - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
    - PCI: hv: Fix multi-MSI to allow more than one MSI vector
    - PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI
    - PCI: hv: Reuse existing IRTE allocation in compose_msi_msg()
    - PCI: hv: Fix interrupt mapping for multi-MSI
    - ip: Fix data-races around sysctl_ip_fwd_use_pmtu.
    - ip: Fix data-races around sysctl_ip_nonlocal_bind.
    - tcp: Fix data-races around sysctl_tcp_mtu_probing.
    - tcp: Fix data-races around sysctl_tcp_reordering.
    - tcp: Fix data-races around some timeout sysctl knobs.
    - tcp: Fix a data-race around sysctl_tcp_tw_reuse.
    - tcp: Fix data-races around sysctl_tcp_fastopen.
    - tcp: Fix a data-race around sysctl_tcp_early_retrans.
    - tcp: Fix data-races around sysctl_tcp_recovery.
    - tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.
    - tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.
    - tcp: Fix a data-race around sysctl_tcp_retrans_collapse.
    - tcp: Fix a data-race around sysctl_tcp_stdurg.
    - tcp: Fix a data-race around sysctl_tcp_rfc1337.
    - tcp: Fix data-races around sysctl_tcp_max_reordering.
    - ima: remove the IMA_TEMPLATE Kconfig option
    - [Config] updateconfigs for IMA_TEMPLATE
    - s390/archrandom: prevent CPACF trng invocations in interrupt context
    - tcp: Fix data-races around sysctl_tcp_dsack.
    - tcp: Fix a data-race around sysctl_tcp_app_win.
    - tcp: Fix a data-race around sysctl_tcp_adv_win_scale.
    - tcp: Fix a data-race around sysctl_tcp_frto.
    - tcp: Fix a data-race around sysctl_tcp_nometrics_save.
    - scsi: ufs: host: Hold reference returned by of_parse_phandle()
    - tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit.
    - net: ping6: Fix memleak in ipv6_renew_options().
    - igmp: Fix data-races around sysctl_igmp_qrv.
    - net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
    - tcp: Fix a data-race around sysctl_tcp_min_tso_segs.
    - tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen.
    - tcp: Fix a data-race around sysctl_tcp_autocorking.
    - tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit.
    - Documentation: fix sctp_wmem in ip-sysctl.rst
    - i40e: Fix interface init with MSI interrupts (no MSI-X)
    - sctp: fix sleep in atomic context bug in timer handlers
    - perf symbol: Correct address for bss symbols
    - scsi: core: Fix race between handling STS_RESOURCE and completion
    - ACPI: video: Shortening quirk list by identifying Clevo by board_name only
  * unprivileged users may trigger page cache invalidation WARN (LP: #1989144)
    - iomap: fix WARN_ON_ONCE() from unprivileged users
  * Users belonging to video group may trigger a deadlock WARN (LP: #1990690)
    - SAUCE: fbdev: remove redundant lock_fb_info
  * ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel
    systems (LP: #1990985)
    - ACPI: processor_idle: Skip dummy wait if kernel is in guest
    - ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel
      systems
  * CVE-2022-3028
    - af_key: Do not call xfrm_probe_algs in parallel
  * CVE-2022-2978
    - fs: fix UAF/GPF bug in nilfs_mdt_destroy
  * CVE-2022-40768
    - scsi: stex: Properly zero out the passthrough command structure

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Fri, 28 Oct 2022 09:26:09 -0300

linux-azure-4.15 (4.15.0-1153.168) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1153.168 -proposed tracker (LP: #1991818)

  * Users belonging to video group may trigger a deadlock WARN (LP: #1990690)
    - SAUCE: fbdev: remove redundant lock_fb_info

 -- Tim Gardner <tim.gardner@canonical.com>  Wed, 05 Oct 2022 09:43:19 -0600

linux-azure-4.15 (4.15.0-1152.167) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1152.167 -proposed tracker (LP: #1989915)

  * Bionic update: upstream stable patchset 2022-09-12 (LP: #1989374)
    - [Config] updateconfigs for RANDOM_TRUST_CPU, RANDOM_TRUST_BOOTLOADER
    - SAUCE: Update add_interrupt_randomness() calls due to upstream stable
      updates

  [ Ubuntu: 4.15.0-194.205 ]

  * bionic/linux: 4.15.0-194.205 -proposed tracker (LP: #1989935)
  * Bionic update: upstream stable patchset 2022-09-14 (LP: #1989625)
    - random: schedule mix_interrupt_randomness() less often
    - ata: libata: add qc->flags in ata_qc_complete_template tracepoint
    - dm era: commit metadata in postsuspend after worker stops
    - random: quiet urandom warning ratelimit suppression message
    - USB: serial: option: add Telit LE910Cx 0x1250 composition
    - USB: serial: option: add Quectel EM05-G modem
    - USB: serial: option: add Quectel RM500K module support
    - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
    - x86/xen: Remove undefined behavior in setup_features()
    - MIPS: Remove repetitive increase irq_err_count
    - igb: Make DMA faster when CPU is active on the PCIe link
    - iio: adc: vf610: fix conversion mode sysfs node name
    - usb: chipidea: udc: check request status before setting device address
    - iio:accel:bma180: rearrange iio trigger get and register
    - iio: accel: mma8452: ignore the return value of reset operation
    - iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up()
    - iio: trigger: sysfs: fix use-after-free on remove
    - iio: adc: axp288: Override TS pin bias current for some models
    - xtensa: xtfpga: Fix refcount leak bug in setup
    - xtensa: Fix refcount leak bug in time.c
    - powerpc: Enable execve syscall exit tracepoint
    - powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address
    - powerpc/powernv: wire up rng during setup_arch
    - ARM: dts: imx6qdl: correct PU regulator ramp delay
    - ARM: exynos: Fix refcount leak in exynos_map_pmu
    - ARM: Fix refcount leak in axxia_boot_secondary
    - ARM: cns3xxx: Fix refcount leak in cns3xxx_init
    - modpost: fix section mismatch check for exported init/exit sections
    - powerpc/pseries: wire up rng during setup_arch()
    - drm: remove drm_fb_helper_modinit
    - xen: unexport __init-annotated xen_xlate_map_ballooned_pages()
    - fdt: Update CRC check for rng-seed
    - kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
    - swiotlb: skip swiotlb_bounce when orig_addr is zero
    - net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
    - afs: Fix dynamic root getattr
    - iio:chemical:ccs811: rearrange iio trigger get and register
    - soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe
    - nvdimm: Fix badblocks clear off-by-one error
    - dm raid: fix accesses beyond end of raid member array
    - dm raid: fix KASAN warning in raid5_add_disks
    - s390/archrandom: simplify back to earlier design and initialize earlier
    - SUNRPC: Fix READ_PLUS crasher
    - net: rose: fix UAF bugs caused by timer handler
    - net: usb: ax88179_178a: Fix packet receiving
    - RDMA/qedr: Fix reporting QP timeout attribute
    - usbnet: fix memory allocation in helpers
    - net: ipv6: unexport __init-annotated seg6_hmac_net_init()
    - caif_virtio: fix race between virtio_device_ready() and ndo_open()
    - netfilter: nft_dynset: restore set element counter when failing to update
    - net: bonding: fix possible NULL deref in rlb code
    - net: bonding: fix use-after-free after 802.3ad slave unbind
    - nfc: nfcmrvl: Fix irq_of_parse_and_map() return value
    - NFC: nxp-nci: Don't issue a zero length i2c_master_read()
    - xen/gntdev: Avoid blocking in unmap_grant_pages()
    - hwmon: (ibmaem) don't call platform_device_del() if platform_device_add()
      fails
    - sit: use min
    - ipv6/sit: fix ipip6_tunnel_get_prl return value
    - net: Rename and export copy_skb_header
    - xen/blkfront: fix leaking data in shared pages
    - xen/netfront: fix leaking data in shared pages
    - xen/netfront: force data bouncing when backend is untrusted
    - xen/blkfront: force data bouncing when backend is untrusted
    - xen/arm: Fix race in RB-tree based P2M accounting
    - net: usb: qmi_wwan: add Telit 0x1060 composition
    - net: usb: qmi_wwan: add Telit 0x1070 composition
    - virtio-net: fix race between ndo_open() and virtio_device_ready()
    - net: tun: unlink NAPI from device on destruction
    - net: tun: stop NAPI when detaching queues
    - esp: limit skb_page_frag_refill use to a single page
    - mm/slub: add missing TID updates on slab deactivation
    - can: grcan: grcan_probe(): remove extra of_node_get()
    - can: gs_usb: gs_usb_open/close(): fix memory leak
    - usbnet: fix memory leak in error case
    - net: rose: fix UAF bug caused by rose_t0timer_expiry
    - iommu/vt-d: Fix PCI bus rescan device hot add
    - video: of_display_timing.h: include errno.h
    - powerpc/powernv: delay rng platform device creation until later in boot
    - xfs: remove incorrect ASSERT in xfs_rename
    - pinctrl: sunxi: a83t: Fix NAND function name for some pins
    - i2c: cadence: Unregister the clk notifier in error path
    - ida: don't use BUG_ON() for debugging
    - dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly
    - dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
    - dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate
    - ARM: meson: Fix refcount leak in meson_smp_prepare_cpus
    - dmaengine: pl330: Fix lockdep warning about non-static key
    - ALSA: hda - Add fixup for Dell Latitidue E5430
    - ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model
    - xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue
    - net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale
      pointer
    - ARM: 9213/1: Print message about disabled Spectre workarounds only once
    - ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction
    - cgroup: Use separate src/dst nodes when preloading css_sets for migration
    - nilfs2: fix incorrect masking of permission flags for symlinks
    - net: dsa: bcm_sf2: force pause link settings
    - ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle
    - inetpeer: Fix data-races around sysctl.
    - net: Fix data-races around sysctl_mem.
    - cipso: Fix data-races around sysctl.
    - icmp: Fix data-races around sysctl.
    - ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero
    - icmp: Fix a data-race around sysctl_icmp_ratelimit.
    - icmp: Fix a data-race around sysctl_icmp_ratemask.
    - ipv4: Fix data-races around sysctl_ip_dynaddr.
    - sfc: fix use after free when disabling sriov
    - seg6: fix skb checksum evaluation in SRH encapsulation/insertion
    - seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors
    - sfc: fix kernel panic when creating VF
    - virtio_mmio: Add missing PM calls to freeze/restore
    - virtio_mmio: Restore guest page size on resume
    - netfilter: br_netfilter: do not skip all hooks with 0 priority
    - cpufreq: pmac32-cpufreq: Fix refcount leak bug
    - platform/x86: hp-wmi: Ignore Sanitization Mode event
    - net: tipc: fix possible refcount leak in tipc_sk_create()
    - NFC: nxp-nci: don't print header length mismatch on i2c error
    - net: sfp: fix memory leak in sfp_probe()
    - ASoC: ops: Fix off by one in range control validation
    - ASoC: wm5110: Fix DRE control
    - irqchip: or1k-pic: Undefine mask_ack for level triggered hardware
    - x86: Clear .brk area at early boot
    - signal handling: don't use BUG_ON() for debugging
    - USB: serial: ftdi_sio: add Belimo device ids
    - usb: dwc3: gadget: Fix event pending check
    - tty: serial: samsung_tty: set dma burst_size to 1
    - serial: 8250: fix return error code in serial8250_request_std_resource()
    - mm: invalidate hwpoison page cache page in fault path
    - can: m_can: m_can_tx_handler(): fix use after free of skb
    - ASoC: sgtl5000: Fix noise on shutdown/remove
    - serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle
  * Bionic update: upstream stable patchset 2022-09-12 (LP: #1989374)
    - [Config] dkms-versions -- force wireguard-dkms update
    - Revert "random: Make getrandom() ready earlier"
    - 9p: missing chunk of "fs/9p: Don't update file type when updating file
      attributes"
    - crypto: chacha20 - Fix keystream alignment for chacha20_block()
    - random: always fill buffer in get_random_bytes_wait
    - random: optimize add_interrupt_randomness
    - drivers/char/random.c: remove unused dont_count_entropy
    - random: Fix whitespace pre random-bytes work
    - random: Return nbytes filled from hw RNG
    - [Config] updateconfigs for RANDOM_TRUST_CPU, RANDOM_TRUST_BOOTLOADER
    - random: add a config option to trust the CPU's hwrng
    - random: remove preempt disabled region
    - random: Make crng state queryable
    - random: make CPU trust a boot parameter
    - drivers/char/random.c: constify poolinfo_table
    - drivers/char/random.c: remove unused stuct poolinfo::poolbits
    - drivers/char/random.c: make primary_crng static
    - random: only read from /dev/random after its pool has received 128 bits
    - random: move rand_initialize() earlier
    - random: document get_random_int() family
    - latent_entropy: avoid build error when plugin cflags are not set
    - random: fix soft lockup when trying to read from an uninitialized blocking
      pool
    - random: Support freezable kthreads in add_hwgenerator_randomness()
    - fdt: add support for rng-seed
    - random: Use wait_event_freezable() in add_hwgenerator_randomness()
    - char/random: Add a newline at the end of the file
    - Revert "hwrng: core - Freeze khwrng thread during suspend"
    - crypto: Deduplicate le32_to_cpu_array() and cpu_to_le32_array()
    - crypto: blake2s - generic C library implementation and selftest
    - lib/crypto: blake2s: move hmac construction into wireguard
    - lib/crypto: sha1: re-roll loops to reduce code size
    - random: Don't wake crng_init_wait when crng_init == 1
    - random: Add a urandom_read_nowait() for random APIs that don't warn
    - random: add GRND_INSECURE to return best-effort non-cryptographic bytes
    - random: ignore GRND_RANDOM in getentropy(2)
    - random: make /dev/random be almost like /dev/urandom
    - random: fix crash on multiple early calls to add_bootloader_randomness()
    - random: remove the blocking pool
    - random: delete code to pull data into pools
    - random: remove kernel.random.read_wakeup_threshold
    - random: remove unnecessary unlikely()
    - random: convert to ENTROPY_BITS for better code readability
    - random: Add and use pr_fmt()
    - random: fix typo in add_timer_randomness()
    - random: remove some dead code of poolinfo
    - random: split primary/secondary crng init paths
    - random: avoid warnings for !CONFIG_NUMA builds
    - x86: Remove arch_has_random, arch_has_random_seed
    - powerpc: Remove arch_has_random, arch_has_random_seed
    - s390: Remove arch_has_random, arch_has_random_seed
    - linux/random.h: Remove arch_has_random, arch_has_random_seed
    - linux/random.h: Use false with bool
    - linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check
    - powerpc: Use bool in archrandom.h
    - random: add arch_get_random_*long_early()
    - random: avoid arch_get_random_seed_long() when collecting IRQ randomness
    - random: remove dead code left over from blocking pool
    - MAINTAINERS: co-maintain random.c
    - crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h>
    - crypto: blake2s - adjust include guard naming
    - random: document add_hwgenerator_randomness() with other input functions
    - random: remove unused irq_flags argument from add_interrupt_randomness()
    - random: use BLAKE2s instead of SHA1 in extraction
    - random: do not sign extend bytes for rotation when mixing
    - random: do not re-init if crng_reseed completes before primary init
    - random: mix bootloader randomness into pool
    - random: harmonize "crng init done" messages
    - random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs
    - random: initialize ChaCha20 constants with correct endianness
    - random: early initialization of ChaCha constants
    - random: avoid superfluous call to RDRAND in CRNG extraction
    - random: don't reset crng_init_cnt on urandom_read()
    - random: fix typo in comments
    - random: cleanup poolinfo abstraction
    - crypto: chacha20 - Fix chacha20_block() keystream alignment (again)
    - random: cleanup integer types
    - random: remove incomplete last_data logic
    - random: remove unused extract_entropy() reserved argument
    - random: rather than entropy_store abstraction, use global
    - random: remove unused OUTPUT_POOL constants
    - random: de-duplicate INPUT_POOL constants
    - random: prepend remaining pool constants with POOL_
    - random: cleanup fractional entropy shift constants
    - random: access input_pool_data directly rather than through pointer
    - random: simplify arithmetic function flow in account()
    - random: continually use hwgenerator randomness
    - random: access primary_pool directly rather than through pointer
    - random: only call crng_finalize_init() for primary_crng
    - random: use computational hash for entropy extraction
    - random: simplify entropy debiting
    - random: use linear min-entropy accumulation crediting
    - random: always wake up entropy writers after extraction
    - random: make credit_entropy_bits() always safe
    - random: remove use_input_pool parameter from crng_reseed()
    - random: remove batched entropy locking
    - random: fix locking in crng_fast_load()
    - random: use RDSEED instead of RDRAND in entropy extraction
    - random: inline leaves of rand_initialize()
    - random: ensure early RDSEED goes through mixer on init
    - random: do not xor RDRAND when writing into /dev/random
    - random: absorb fast pool into input pool after fast load
    - random: use hash function for crng_slow_load()
    - random: remove outdated INT_MAX >> 6 check in urandom_read()
    - random: zero buffer after reading entropy from userspace
    - random: tie batched entropy generation to base_crng generation
    - random: remove ifdef'd out interrupt bench
    - random: remove unused tracepoints
    - random: add proper SPDX header
    - random: deobfuscate irq u32/u64 contributions
    - random: introduce drain_entropy() helper to declutter crng_reseed()
    - random: remove useless header comment
    - random: remove whitespace and reorder includes
    - random: group initialization wait functions
    - random: group entropy extraction functions
    - random: group entropy collection functions
    - random: group userspace read/write functions
    - random: group sysctl functions
    - random: rewrite header introductory comment
    - random: defer fast pool mixing to worker
    - random: do not take pool spinlock at boot
    - random: unify early init crng load accounting
    - random: check for crng_init == 0 in add_device_randomness()
    - random: pull add_hwgenerator_randomness() declaration into random.h
    - random: clear fast pool, crng, and batches in cpuhp bring up
    - random: round-robin registers as ulong, not u32
    - random: only wake up writers after zap if threshold was passed
    - random: cleanup UUID handling
    - random: unify cycles_t and jiffies usage and types
    - random: do crng pre-init loading in worker rather than irq
    - random: give sysctl_random_min_urandom_seed a more sensible value
    - random: don't let 644 read-only sysctls be written to
    - random: replace custom notifier chain with standard one
    - random: use SipHash as interrupt entropy accumulator
    - random: make consistent usage of crng_ready()
    - random: reseed more often immediately after booting
    - random: check for signal and try earlier when generating entropy
    - random: skip fast_init if hwrng provides large chunk of entropy
    - random: treat bootloader trust toggle the same way as cpu trust toggle
    - random: re-add removed comment about get_random_{u32,u64} reseeding
    - random: mix build-time latent entropy into pool at init
    - random: do not split fast init input in add_hwgenerator_randomness()
    - random: do not allow user to keep crng key around on stack
    - random: check for signal_pending() outside of need_resched() check
    - random: check for signals every PAGE_SIZE chunk of /dev/[u]random
    - random: make random_get_entropy() return an unsigned long
    - random: document crng_fast_key_erasure() destination possibility
    - random: fix sysctl documentation nits
    - init: call time_init() before rand_initialize()
    - ia64: define get_cycles macro for arch-override
    - s390: define get_cycles macro for arch-override
    - parisc: define get_cycles macro for arch-override
    - alpha: define get_cycles macro for arch-override
    - powerpc: define get_cycles macro for arch-override
    - timekeeping: Add raw clock fallback for random_get_entropy()
    - m68k: use fallback for random_get_entropy() instead of zero
    - mips: use fallback for random_get_entropy() instead of just c0 random
    - arm: use fallback for random_get_entropy() instead of zero
    - nios2: use fallback for random_get_entropy() instead of zero
    - x86/tsc: Use fallback for random_get_entropy() instead of zero
    - um: use fallback for random_get_entropy() instead of zero
    - sparc: use fallback for random_get_entropy() instead of zero
    - xtensa: use fallback for random_get_entropy() instead of zero
    - random: insist on random_get_entropy() existing in order to simplify
    - random: do not use batches when !crng_ready()
    - random: do not pretend to handle premature next security model
    - random: order timer entropy functions below interrupt functions
    - random: do not use input pool from hard IRQs
    - random: help compiler out with fast_mix() by using simpler arguments
    - siphash: use one source of truth for siphash permutations
    - random: use symbolic constants for crng_init states
    - random: avoid initializing twice in credit race
    - random: remove ratelimiting for in-kernel unseeded randomness
    - random: use proper jiffies comparison macro
    - random: handle latent entropy and command line from random_init()
    - random: credit architectural init the exact amount
    - random: use static branch for crng_ready()
    - random: remove extern from functions in header
    - random: use proper return types on get_random_{int,long}_wait()
    - random: move initialization functions out of hot pages
    - random: move randomize_page() into mm where it belongs
    - random: convert to using fops->write_iter()
    - random: wire up fops->splice_{read,write}_iter()
    - random: check for signals after page of pool writes
    - Revert "random: use static branch for crng_ready()"
    - crypto: drbg - add FIPS 140-2 CTRNG for noise source
    - crypto: drbg - always seeded with SP800-90B compliant noise source
    - crypto: drbg - prepare for more fine-grained tracking of seeding state
    - crypto: drbg - track whether DRBG was seeded with !rng_is_initialized()
    - crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed()
    - crypto: drbg - always try to free Jitter RNG instance
    - crypto: drbg - make reseeding from get_random_bytes() synchronous
    - random: avoid checking crng_ready() twice in random_init()
    - random: mark bootloader randomness code as __init
    - random: account for arch randomness in bits
    - ASoC: cs42l52: Fix TLV scales for mixer controls
    - ASoC: cs53l30: Correct number of volume levels on SX controls
    - ASoC: cs42l52: Correct TLV for Bypass Volume
    - ASoC: cs42l56: Correct typo in minimum level for SX volume controls
    - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
    - ASoC: wm8962: Fix suspend while playing music
    - scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
    - scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology
    - scsi: ipr: Fix missing/incorrect resource cleanup in error case
    - scsi: pmcraid: Fix missing resource cleanup in error case
    - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration
      failed
    - nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
    - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
    - net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface
      netdev[napi]_alloc_frag
    - random: credit cpu and bootloader seeds by default
    - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE
    - i40e: Fix call trace in setup_tx_descriptors
    - tty: goldfish: Fix free_irq() on remove
    - misc: atmel-ssc: Fix IRQ check in ssc_probe
    - net: bgmac: Fix an erroneous kfree() in bgmac_remove()
    - arm64: ftrace: fix branch range checks
    - certs/blacklist_hashes.c: fix const confusion in certs blacklist
    - irqchip/gic/realview: Fix refcount leak in realview_gic_of_init
    - comedi: vmk80xx: fix expression for tx buffer size
    - USB: serial: option: add support for Cinterion MV31 with new baseline
    - USB: serial: io_ti: add Agilent E5805A support
    - usb: dwc2: Fix memory leak in dwc2_hcd_init
    - usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe
    - serial: 8250: Store to lsr_save_flags after lsr read
    - ext4: fix bug_on ext4_mb_use_inode_pa
    - ext4: make variable "count" signed
    - ext4: add reserved GDT blocks check
    - virtio-pci: Remove wrong address verification in vp_del_vqs()
    - s390/mm: use non-quiescing sske for KVM switch to keyed guest
    - usb: gadget: u_ether: fix regression in setting fixed MAC address
    - xprtrdma: fix incorrect header size calculations
    - tcp: add some entropy in __inet_hash_connect()
    - tcp: use different parts of the port_offset for index and offset
    - tcp: add small random increments to the source port
    - tcp: dynamically allocate the perturb table used by source ports
    - tcp: increase source port perturb table to 2^16
    - tcp: drop the hash_32() part from the index calculation
    - powerpc/kasan: Silence KASAN warnings in __get_wchan()
    - ASoC: es8328: Fix event generation for deemphasis control
    - ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put()
    - i40e: Fix adding ADQ filter to TC0
    - mlxsw: spectrum_cnt: Reorder counter pools
    - net: openvswitch: fix misuse of the cached connection on tuple changes
    - RISC-V: fix barrier() use in <vdso/processor.h>
    - powerpc/mm: Switch obsolete dssall to .long

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Wed, 28 Sep 2022 17:35:16 -0300

linux-azure-4.15 (4.15.0-1151.166) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1151.166 -proposed tracker (LP: #1987885)

  [ Ubuntu: 4.15.0-193.204 ]

  * bionic/linux: 4.15.0-193.204 -proposed tracker (LP: #1987905)
  * CVE-2022-36946
    - netfilter: nf_queue: do not allow packet truncation below transport header
      offset
  * CVE-2021-33655
    - fbcon: Disallow setting font bigger than screen size
    - fbcon: Prevent that screen size is smaller than font size
    - fbmem: Check virtual screen sizes in fb_set_var()

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Tue, 06 Sep 2022 13:29:02 -0300

linux-azure-4.15 (4.15.0-1150.165) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1150.165 -proposed tracker (LP: #1983960)

  [ Ubuntu: 4.15.0-192.203 ]

  * bionic/linux: 4.15.0-192.203 -proposed tracker (LP: #1983980)
  * CVE-2021-33656
    - vt: drop old FONT ioctls
  * Bionic update: upstream stable patchset 2022-07-25 (LP: #1982782)
    - binfmt_flat: do not stop relocating GOT entries prematurely on riscv
    - USB: serial: option: add Quectel BG95 modem
    - USB: new quirk for Dell Gen 2 devices
    - ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
    - ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
    - btrfs: add "0x" prefix for unsupported optional features
    - btrfs: repair super block num_devices automatically
    - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
    - mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue
    - b43legacy: Fix assigning negative value to unsigned variable
    - b43: Fix assigning negative value to unsigned variable
    - ipw2x00: Fix potential NULL dereference in libipw_xmit()
    - ACPICA: Avoid cache flush inside virtual machines
    - ALSA: jack: Access input_dev under mutex
    - drm/amd/pm: fix double free in si_parse_power_table()
    - ath9k: fix QCA9561 PA bias level
    - media: venus: hfi: avoid null dereference in deinit
    - media: pci: cx23885: Fix the error handling in cx23885_initdev()
    - media: cx25821: Fix the warning when removing the module
    - scsi: megaraid: Fix error check return value of register_chrdev()
    - drm/amd/pm: fix the compile warning
    - ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL
    - ASoC: dapm: Don't fold register value changes into notifications
    - s390/preempt: disable __preempt_count_add() optimization for
      PROFILE_ALL_BRANCHES
    - dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC
    - ipmi:ssif: Check for NULL msg when handling events and messages
    - rtlwifi: Use pr_warn instead of WARN_ONCE
    - openrisc: start CPU timer early in boot
    - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
    - ASoC: rt5645: Fix errorenous cleanup order
    - net: phy: micrel: Allow probing without .driver_data
    - media: exynos4-is: Fix compile warning
    - rxrpc: Return an error to sendmsg if call failed
    - eth: tg3: silence the GCC 12 array-bounds warning
    - ARM: dts: ox820: align interrupt controller node name with dtschema
    - fs: jfs: fix possible NULL pointer dereference in dbFree()
    - ARM: OMAP1: clock: Fix UART rate reporting algorithm
    - fat: add ratelimit to fat*_ent_bread()
    - ARM: versatile: Add missing of_node_put in dcscb_init
    - ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM
    - ARM: hisi: Add missing of_node_put after of_find_compatible_node
    - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
    - tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate
    - powerpc/xics: fix refcount leak in icp_opal_init()
    - macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled
    - RDMA/hfi1: Prevent panic when SDMA is disabled
    - drm: fix EDID struct for old ARM OABI format
    - ath9k: fix ar9003_get_eepmisc
    - ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
    - ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
    - x86/delay: Fix the wrong asm constraint in delay_loop()
    - drm/mediatek: Fix mtk_cec_mask()
    - spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout
    - NFC: NULL out the dev->rfkill to prevent UAF
    - efi: Add missing prototype for efi_capsule_setup_info
    - HID: hid-led: fix maximum brightness for Dream Cheeky
    - spi: img-spfi: Fix pm_runtime_get_sync() error checking
    - ath9k_htc: fix potential out of bounds access with invalid
      rxstatus->rs_keyix
    - inotify: show inotify mask flags in proc fdinfo
    - fsnotify: fix wrong lockdep annotations
    - x86/pm: Fix false positive kmemleak report in msr_build_context()
    - drm/msm/dsi: fix error checks and return values for DSI xmit functions
    - drm/msm/hdmi: check return value after calling
      platform_get_resource_byname()
    - drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
    - x86: Fix return value of __setup handlers
    - irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
    - x86/mm: Cleanup the control_va_addr_alignment() __setup handler
    - drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
    - media: uvcvideo: Fix missing check to determine if element is found in list
    - ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
    - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
    - media: st-delta: Fix PM disable depth imbalance in delta_probe
    - media: exynos4-is: Change clk_disable to clk_disable_unprepare
    - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
    - Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
    - m68k: math-emu: Fix dependencies of math emulation support
    - sctp: read sk->sk_bound_dev_if once in sctp_rcv()
    - ASoC: wm2000: fix missing clk_disable_unprepare() on error in
      wm2000_anc_transition()
    - rxrpc: Fix listen() setting the bar too high for the prealloc rings
    - rxrpc: Don't try to resend the request if we're receiving the reply
    - soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc
    - soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
    - ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT
    - ARM: dts: bcm2835-rpi-b: Fix GPIO line names
    - mfd: ipaq-micro: Fix error check return value of platform_get_irq()
    - scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()
    - pinctrl: mvebu: Fix irq_of_parse_and_map() return value
    - drivers/base/node.c: fix compaction sysfs file leak
    - powerpc/8xx: export 'cpm_setbrg' for modules
    - powerpc/idle: Fix return value of __setup() handler
    - powerpc/4xx/cpm: Fix return value of __setup() handler
    - tty: fix deadlock caused by calling printk() under tty_port->lock
    - Input: sparcspkr - fix refcount leak in bbc_beep_probe
    - powerpc/perf: Fix the threshold compare group constraint for power9
    - powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
    - mailbox: forward the hrtimer if not queued and under a lock
    - iommu/mediatek: Add list_del in mtk_iommu_remove
    - video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
    - iommu/amd: Increase timeout waiting for GA log enablement
    - perf c2c: Use stdio interface if slang is not supported
    - perf jevents: Fix event syntax error caused by ExtSel
    - wifi: mac80211: fix use-after-free in chanctx code
    - iwlwifi: mvm: fix assert 1F04 upon reconfig
    - fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped
      pages
    - ext4: fix use-after-free in ext4_rename_dir_prepare
    - ext4: fix bug_on in ext4_writepages
    - ext4: verify dir block before splitting it
    - ext4: avoid cycles in directory h-tree
    - dlm: fix plock invalid read
    - dlm: fix missing lkb refcount handling
    - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
    - scsi: dc395x: Fix a missing check on list iterator
    - scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled
    - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
    - drm/nouveau/clk: Fix an incorrect NULL check on list iterator
    - drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX
    - md: fix an incorrect NULL check in does_sb_need_changing
    - md: fix an incorrect NULL check in md_reload_sb
    - RDMA/hfi1: Fix potential integer multiplication overflow errors
    - irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375,
      A38x, A39x
    - irqchip: irq-xtensa-mx: fix initial IRQ affinity
    - mac80211: upgrade passive scan to active scan on DFS channels after beacon
      rx
    - um: chan_user: Fix winch_tramp() return value
    - um: Fix out-of-bounds read in LDT setup
    - iommu/msm: Fix an incorrect NULL check on list iterator
    - nodemask.h: fix compilation error with GCC12
    - hugetlb: fix huge_pmd_unshare address update
    - rtl818x: Prevent using not initialized queues
    - ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control
    - carl9170: tx: fix an incorrect use of list iterator
    - gma500: fix an incorrect NULL check on list iterator
    - arm64: dts: qcom: ipq8074: fix the sleep clock frequency
    - phy: qcom-qmp: fix struct clk leak on probe errors
    - docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0
    - dt-bindings: gpio: altera: correct interrupt-cells
    - phy: qcom-qmp: fix reset-controller leak on probe errors
    - RDMA/rxe: Generate a completion for unsupported/invalid opcode
    - MIPS: IP27: Remove incorrect `cpu_has_fpu' override
    - pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
    - staging: greybus: codecs: fix type confusion of list iterator variable
    - tty: goldfish: Use tty_port_destroy() to destroy port
    - usb: usbip: fix a refcount leak in stub_probe()
    - usb: usbip: add missing device lock on tweak configuration cmd
    - USB: storage: karma: fix rio_karma_init return
    - pwm: lp3943: Fix duty calculation in case period was clamped
    - rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
    - coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
    - soc: rockchip: Fix refcount leak in rockchip_grf_init
    - rtc: mt6397: check return value after calling platform_get_resource()
    - serial: meson: acquire port->lock in startup()
    - serial: digicolor-usart: Don't allow CS5-6
    - serial: txx9: Don't allow CS5-6
    - serial: sh-sci: Don't allow CS5-6
    - serial: st-asc: Sanitize CSIZE and correct PARENB for CS7
    - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
    - clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value
    - net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry()
    - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
    - modpost: fix removing numeric suffixes
    - jffs2: fix memory leak in jffs2_do_fill_super
    - ubi: ubi_create_volume: Fix use-after-free when volume creation failed
    - tcp: tcp_rtx_synack() can be called from process context
    - perf c2c: Fix sorting in percent_rmt_hitm_cmp()
    - mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
    - tracing: Fix sleeping function called from invalid context on RT kernel
    - tracing: Avoid adding tracer option before update_tracer_options
    - i2c: cadence: Increase timeout per message if necessary
    - m68knommu: set ZERO_PAGE() to the allocated zeroed page
    - m68knommu: fix undefined reference to `_init_sp'
    - video: fbdev: pxa3xx-gcu: release the resources correctly in
      pxa3xx_gcu_probe/remove()
    - xprtrdma: treat all calls not a bcall when bc_serv is NULL
    - ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
    - net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure
    - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()
    - net: mdio: unexport __init-annotated mdio_bus_init()
    - net: xfrm: unexport __init-annotated xfrm4_protocol_init()
    - net: ipv6: unexport __init-annotated seg6_hmac_init()
    - net: altera: Fix refcount leak in altera_tse_mdio_create
    - drm: imx: fix compiler warning with gcc-12
    - iio: dummy: iio_simple_dummy: check the return value of kstrdup()
    - lkdtm/usercopy: Expand size of "out of frame" object
    - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
    - tty: Fix a possible resource leak in icom_probe
    - drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
    - USB: host: isp116x: check return value after calling platform_get_resource()
    - drivers: tty: serial: Fix deadlock in sa1100_set_termios()
    - drivers: usb: host: Fix deadlock in oxu_bus_suspend()
    - USB: hcd-pci: Fully suspend across freeze/thaw cycle
    - usb: dwc2: gadget: don't reset gadget's driver->bus
    - misc: rtsx: set NULL intfdata when probe fails
    - extcon: Modify extcon device to be created after driver data is set
    - clocksource/drivers/sp804: Avoid error on multiple instances
    - staging: rtl8712: fix uninit-value in r871xu_drv_init()
    - serial: msm_serial: disable interrupts in __msm_console_write()
    - kernfs: Separate kernfs_pr_cont_buf and rename_lock.
    - md: protect md_unregister_thread from reentrancy
    - drm/radeon: fix a possible null pointer dereference
    - modpost: fix undefined behavior of is_arm_mapping_symbol()
    - nbd: call genl_unregister_family() first in nbd_cleanup()
    - nbd: fix race between nbd_alloc_config() and module removal
    - nbd: fix io hung while disconnecting device
    - nodemask: Fix return values to be unsigned
    - vringh: Fix loop descriptors check in the indirect cases
    - ALSA: hda/conexant - Fix loopback issue with CX20632
    - cifs: return errors during session setup during reconnects
    - ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
    - nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION
    - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
    - ixgbe: fix bcast packets Rx on VF after promisc removal
    - ixgbe: fix unexpected VLAN Rx in promisc mode on VF
    - Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
    - powerpc/32: Fix overread/overwrite of thread_struct via ptrace
    - md/raid0: Ignore RAID0 layout if the second zone has only one device
    - mtd: cfi_cmdset_0002: Move and rename
      chip_check/chip_ready/chip_good_for_write
    - mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
    - PCI: qcom: Fix unbalanced PHY init on probe errors
    - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
    - drm/edid: fix invalid EDID extension block filtering
    - drm/bridge: adv7511: clean up CEC adapter when probe fails
    - nl80211: show SSID for P2P_GO interfaces
    - of: overlay: do not break notify on NOTIFY_{OK|STOP}
    - x86/speculation: Add missing prototype for unpriv_ebpf_notify()
    - media: vsp1: Fix offset calculation for plane cropping
    - ext4: reject the 'commit' option on ext2 filesystems
    - drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
    - NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx
    - crypto: marvell/cesa - ECB does not IV
    - dax: fix cache flush on PMD-mapped pages
    - f2fs: fix dereference of stale list iterator after loop body
    - i2c: at91: use dma safe buffers
    - dmaengine: stm32-mdma: remove GISR1 register
    - md: bcache: check the return value of kzalloc() in detached_dev_do_request()
    - usb: musb: Fix missing of_node_put() in omap2430_probe
    - usb: dwc3: pci: Fix pm_runtime_get_sync() error checking
    - rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails
    - serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485
    - serial: stm32-usart: Correct CSIZE, bits, and parity
    - s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
    - nfp: only report pause frame configuration for physical device
    - af_unix: ensure POLLOUT on remote close() for connected dgram socket
    - af_unix: Fix a data-race in unix_dgram_peer_wake_me().
    - ip_gre: test csum_start instead of transport header
    - Upstream stable to v4.14.284, v4.19.248

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Fri, 12 Aug 2022 21:02:01 -0300

linux-azure-4.15 (4.15.0-1149.164) bionic; urgency=medium

  [ Ubuntu: 4.15.0-191.202 ]

  * CVE-2022-2586
    - SAUCE: netfilter: nf_tables: do not allow SET_ID to refer to another table
    - SAUCE: netfilter: nf_tables: do not allow RULE_ID to refer to another chain
  * CVE-2022-2588
    - SAUCE: net_sched: cls_route: remove from list when handle is 0
  * CVE-2022-34918
    - netfilter: nf_tables: stricter validation of element data
  * BUG: kernel NULL pointer dereference, address: 0000000000000008
    (LP: #1981658)
    - tcp: make sure treq->af_specific is initialized

 -- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Thu, 04 Aug 2022 19:11:41 +0200

linux-azure-4.15 (4.15.0-1148.163) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1148.163 -proposed tracker (LP: #1983495)

  * BUG: kernel NULL pointer dereference, address: 0000000000000008
    (LP: #1981658)
    - tcp: make sure treq->af_specific is initialized

 -- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Wed, 03 Aug 2022 15:03:09 -0300

# For older changelog entries, run 'apt-get changelog linux-azure-4.15-tools-4.15.0-1159'
