The SUSE Linux Enterprise 15 SP3 kernel was updated. The following security bugs were fixed: - CVE-2022-0854: Fixed a memory leak flaw was found in the Linux kernels DMA subsystem. This flaw allowed a local user to read random memory from the kernel space. - CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution. - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel. - CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel. - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel. - CVE-2022-1055: Fixed a use-after-free in tc_new_tfilter that could allow a local attacker to gain privilege escalation. - CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock. - CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-after-free if there is a corrupted quota file. - CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. - CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c. - CVE-2022-1199: Fixed null-ptr-deref and use-after-free vulnerabilities that allow an attacker to crash the linux kernel by simulating Amateur Radio. - CVE-2022-1205: Fixed null pointer dereference and use-after-free vulnerabilities that allow an attacker to crash the linux kernel by simulating Amateur Radio. - CVE-2022-1198: Fixed an use-after-free vulnerability that allow an attacker to crash the linux kernel by simulating Amateur Radio . - CVE-2022-1195: Fixed an use-after-free vulnerability which could allow a local attacker with a user privilege to execute a denial of service. - CVE-2022-1011: Fixed an use-after-free vulnerability which could allow a local attacker to retireve /etc/shadow hashes or any other data from filesystem when he can mount a FUSE filesystems. The following non-security bugs were fixed: - ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board . - ACPI: APEI: fix return value of __setup handlers . - ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 . - ACPI: CPPC: Avoid out of bounds access when parsing _CPC data . - ACPI: docs: enumeration: Discourage to use custom _DSM methods . - ACPI: docs: enumeration: Remove redundant .owner assignment . - ACPI: docs: enumeration: Update UART serial bus resource documentation . - ACPI: properties: Consistently return -ENOENT if there are no more references . - ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU . - ALSA: cmipci: Restore aux vol on suspend/resume . - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction . - ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 . - ALSA: hda/realtek: Add quirk for ASUS GA402 . - ALSA: oss: Fix PCM OSS buffer allocation overflow . - ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec . - ALSA: pcm: Add stream lock during PCM reset ioctl operations . - ALSA: spi: Add check for clk_enable . - ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB . - ASoC: atmel_ssc_dai: Handle errors for clk_enable . - ASoC: atmel: Add missing of_node_put in at91sam9g20ek_audio_probe . - ASoC: codecs: wcd934x: Add missing of_node_put in wcd934x_codec_parse_data . - ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put . - ASoC: dmaengine: do not use a NULL prepare_slave_config callback . - ASoC: dwc-i2s: Handle errors for clk_enable . - ASoC: fsi: Add check for clk_enable . - ASoC: fsl_spdif: Disable TX clock when stop . - ASoC: imx-es8328: Fix error return code in imx_es8328_probe . - ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe . - ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare in msm8916_wcd_digital_probe . - ASoC: mxs-saif: Handle errors for clk_enable . - ASoC: mxs: Fix error handling in mxs_sgtl5000_probe . - ASoC: rt5663: check the return value of devm_kzalloc in rt5663_parse_dp . - ASoC: SOF: Add missing of_node_put in imx8m_probe . - ASoC: SOF: topology: remove redundant code . - ASoC: sti: Fix deadlock via snd_pcm_stop_xrun call . - ASoC: ti: davinci-i2s: Add check for clk_enable . - ASoC: topology: Allow TLV control to be either read or write . - ASoC: topology: Optimize soc_tplg_dapm_graph_elems_load behavior . - ASoC: wm8350: Handle error for wm8350_register_irq . - ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting . - ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32 . - block: update io_ticks when io hang . - block/wbt: fix negative inflight counter when remove scsi device . - bpf: Fix comment for helper bpf_current_task_under_cgroup . - bpf: Remove config check to enable bpf support for branch records . - btrfs: avoid unnecessary lock and leaf splits when updating inode in the log . - btrfs: avoid unnecessary log mutex contention when syncing log . - btrfs: avoid unnecessary logging of xattrs during fast fsyncs . - btrfs: check error value from btrfs_update_inode in tree log . - btrfs: check if a log root exists before locking the log_mutex on unlink . - btrfs: check if a log tree exists at inode_logged . - btrfs: do not commit delayed inode when logging a file in full sync mode . - btrfs: do not log new dentries when logging that a new name exists . - btrfs: eliminate some false positives when checking if inode was logged . - btrfs: fix race leading to unnecessary transaction commit when logging inode . - btrfs: fix race that causes unnecessary logging of ancestor inodes . - btrfs: fix race that makes inode logging fallback to transaction commit . - btrfs: fix race that results in logging old extents during a fast fsync . - btrfs: fixup error handling in fixup_inode_link_counts . - btrfs: remove no longer needed full sync flag check at inode_logged . - btrfs: Remove unnecessary check from join_running_log_trans . - btrfs: remove unnecessary directory inode item update when deleting dir entry . - btrfs: remove unnecessary list head initialization when syncing log . - btrfs: skip unnecessary searches for xattrs when logging an inode . - can: ems_usb: ems_usb_start_xmit: fix double dev_kfree_skb in error path . - can: mcba_usb: mcba_usb_start_xmit: fix double dev_kfree_skb in error path . - can: mcba_usb: properly check endpoint type . - can: rcar_canfd: rcar_canfd_channel_probe: register the CAN device when fully ready . - cifs: use the correct max-length for dentry_path_raw . - clk: actions: Terminate clk_div_table with sentinel element . - clk: bcm2835: Remove unused variable . - clk: clps711x: Terminate clk_div_table with sentinel element . - clk: imx7d: Remove audio_mclk_root_clk . - clk: Initialize orphan req_rate . - clk: loongson1: Terminate clk_div_table with sentinel element . - clk: nxp: Remove unused variable . - clk: qcom: clk-rcg2: Update logic to calculate D value for RCG . - clk: qcom: clk-rcg2: Update the frac table for pixel clock . - clk: qcom: gcc-msm8994: Fix gpll4 width . - clk: qcom: ipq8074: Use floor ops for SDCC1 clock . - clk: tegra: tegra124-emc: Fix missing put_device call in emc_ensure_emc_driver . - clk: uniphier: Fix fixed-rate initialization . - clocksource: acpi_pm: fix return value of __setup handler . - clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init . - cpufreq: schedutil: Destroy mutex before kobject_put frees - crypto: authenc - Fix sleep in atomic context in decrypt_tail . - crypto: cavium/nitrox - do not cast parameter in bit operations . - crypto: ccp - ccp_dmaengine_unregister release dma channels . - crypto: ccree - do not attempt 0 len DMA mappings . - crypto: mxs-dcp - Fix scatterlist processing . - crypto: qat - do not cast parameter in bit operations . - crypto: rsa-pkcs1pad - correctly get hash from source scatterlist . - crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete . - crypto: rsa-pkcs1pad - restore signature length check . - crypto: vmx - add missing dependencies . - dma/pool: create dma atomic pool only if dma zone has managed pages . - driver core: dd: fix return value of __setup handler . - drm: add a locked version of drm_is_current_master . - drm: bridge: adv7511: Fix ADV7535 HPD enablement . - drm: drm_file struct kABI compatibility workaround . - drm: protect drm_master pointers in drm_lease.c . - drm: serialize drm_file.master with a new spinlock . - drm: use the lookup lock in drm_is_current_master . - drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug . - drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function . - drm/bridge: dw-hdmi: use safe format when first in bridge chain . - drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe . - drm/doc: overview before functions for drm_writeback.c . - drm/i915: Fix dbuf slice config lookup . - drm/i915/gem: add missing boundary check in vm_access . - drm/imx: parallel-display: Remove bus flags check in imx_pd_bridge_atomic_check . - drm/meson: Fix error handling when afbcd.ops-greater than init fails . - drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops . - drm/msm/dpu: add DSPP blocks teardown . - drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl . - drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings . - drm/vc4: crtc: Fix runtime_pm reference counting . - drm/vc4: crtc: Make sure the HDMI controller is powered when disabling . - drm/vrr: Set VRR capable prop only if it is attached to connector . - ecryptfs: fix kernel panic with null dev_name . - ecryptfs: Fix typo in message . - ext2: correct max file size computing . - firmware: google: Properly state IOMEM dependency . - firmware: qcom: scm: Remove reassignment to desc following initializer . - fscrypt: do not ignore minor_hash when hash is 0 . - HID: multitouch: fix Dell Precision 7550 and 7750 button type . - hwmon: Add mutex to regulator ops . - hwmon: Add Vin unit off handling . - hwmon: Replace WDOG_ACTIVE with WDOG_HW_RUNNING . - hwrng: atmel - disable trng on failure path . - i915_vma: Rename vma_lookup to i915_vma_lookup . - ibmvnic: fix race between xmit and reset . - iio: accel: mma8452: use the correct logic to get mma8452_data . - iio: adc: Add check for devm_request_threaded_irq . - iio: afe: rescale: use s64 for temporary scale calculations . - iio: inkern: apply consumer scale on IIO_VAL_INT cases . - iio: inkern: apply consumer scale when no channel scale is available . - iio: inkern: make a best effort on offset calculation . - Input: aiptek - properly check endpoint type . - iwlwifi: do not advertise TWT support . - KVM: SVM: Do not flush cache if hardware enforces cache coherency across encryption domains . - llc: fix netdevice reference leaks in llc_ui_bind . - mac80211: fix potential double free on mesh join . - mac80211: refuse aggregations sessions before authorized . - media: aspeed: Correct value for h-total-pixels . - media: bttv: fix WARNING regression on tunerless devices . - media: coda: Fix missing put_device call in coda_get_vdoa_data . - media: davinci: vpif: fix unbalanced runtime PM get . - media: em28xx: initialize refcount before kref_get . - media: hantro: Fix overfill bottom register field name . - media: Revert 'media: em28xx: add missing em28xx_close_extension' . - media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED . - media: usb: go7007: s2250-board: fix leak in probe . - media: video/hdmi: handle short reads of hdmi info frame . - membarrier: Execute SYNC_CORE on the calling thread - membarrier: Explicitly sync remote cores when SYNC_CORE is - memory: emif: Add check for setup_interrupts . - memory: emif: check the pointer temp in get_device_details . - misc: alcor_pci: Fix an error handling path . - misc: sgi-gru: Do not cast parameter in bit operations . - mm_zone: add function to check if managed dma zone exists . - mm: add vma_lookup, update find_vma_intersection comments . - mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages . - mmc: davinci_mmc: Handle error for clk_enable . - net: dsa: mv88e6xxx: override existent unicast portvec in port_fdb_add . - net: enetc: initialize the RFS and RSS memories . - net: hns3: add a check for tqp_index in hclge_get_ring_chain_from_mbx . - net: phy: broadcom: Fix brcm_fet_config_init . - net: phy: marvell: Fix invalid comparison in the resume and suspend functions . - net: stmmac: set TxQ mode back to DCB after disabling CBS . - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup . - net: watchdog: hold device global xmit lock during tx disable . - net/smc: Fix loop in smc_listen . - net/smc: fix using of uninitialized completions . - net/smc: fix wrong list_del in smc_lgr_cleanup_early . - net/smc: Make sure the link_id is unique . - net/smc: Reset conn-greater than lgr when link group registration fails . - netfilter: conntrack: do not refresh sctp entries in closed state . - netxen_nic: fix MSI/MSI-x interrupts . - NFS: Avoid duplicate uncached readdir calls on eof . - NFS: Do not report writeback errors in nfs_getattr . - NFS: Do not skip directory entries when doing uncached readdir . - NFS: Ensure the server had an up to date ctime before hardlinking . - NFS: Fix initialisation of nfs_client cl_flags field . - NFS: LOOKUP_DIRECTORY is also ok with symlinks . - NFS: Return valid errors from nfs2/3_decode_dirent . - NFS: Use of mapping_set_error results in spurious errors . - NFS: nfsd4_setclientid_confirm mistakenly expires confirmed client . - NFS: do not retry BIND_CONN_TO_SESSION on session error . - NFS: Fix another issue with a list iterator pointing to the head . - nl80211: Update bss channel on channel switch for P2P_CLIENT . - pinctrl: mediatek: Fix missing of_node_put in mtk_pctrl_init . - pinctrl: mediatek: paris: Fix 'argument' argument type for mtk_pinconf_get . - pinctrl: mediatek: paris: Fix pingroup pin config state readback . - pinctrl: nomadik: Add missing of_node_put in nmk_pinctrl_probe . - pinctrl: nuvoton: npcm7xx: Rename DS macro to DSTR . - pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE . - pinctrl: pinconf-generic: Print arguments for bias-pull-* . - pinctrl: samsung: drop pin banks references on error paths . - pinctrl/rockchip: Add missing of_node_put in rockchip_pinctrl_probe . - PM: hibernate: fix __setup handler error handling . - PM: suspend: fix return value of __setup handler . - powerpc/lib/sstep: Fix "sthcx" instruction . - powerpc/mm: Fix verification of MMU_FTR_TYPE_44x . - powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties . - powerpc/perf: Do not use perf_hw_context for trace IMC PMU . - powerpc/pseries: Fix use after free in remove_phb_dynamic . - powerpc/sysdev: fix incorrect use to determine if list is empty . - powerpc/tm: Fix more userspace r13 corruption . - powerpc/xive: fix return value of __setup handler . - printk: Add panic_in_progress helper . - printk: disable optimistic spin during panic . - pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add . - regulator: qcom_smd: fix for_each_child.cocci warnings . - remoteproc: qcom_wcnss: Add missing of_node_put in wcnss_alloc_memory_region . - remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region . - s390/bpf: Perform r1 range checking before accessing jit-greater than seen_reg . - s390/gmap: do not unconditionally call pte_unmap_unlock in __gmap_zap . - s390/gmap: validate VMA in __gmap_zap . - s390/hypfs: include z/VM guests with access control group set . - s390/kexec_file: fix error handling when applying relocations . - s390/kexec: fix memory leak of ipl report buffer . - s390/kexec: fix return code handling . - s390/mm: fix VMA and page table handling code in storage key handling functions . - s390/mm: validate VMA in PGSTE manipulation functions . - s390/module: fix loading modules with a lot of relocations . - s390/pci_mmio: fully validate the VMA before calling follow_pte . - scsi: lpfc: Copyright updates for 14.2.0.0 patches . - scsi: lpfc: Drop lpfc_no_handler . - scsi: lpfc: Fix broken SLI4 abort path . - scsi: lpfc: Fix locking for lpfc_sli_iocbq_lookup . - scsi: lpfc: Fix queue failures when recovering from PCI parity error . - scsi: lpfc: Fix typos in comments . - scsi: lpfc: Fix unload hang after back to back PCI EEH faults . - scsi: lpfc: Improve PCI EEH Error and Recovery Handling . - scsi: lpfc: Kill lpfc_bus_reset_handler . - scsi: lpfc: Reduce log messages seen after firmware download . - scsi: lpfc: Remove failing soft_wwn support . - scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled . - scsi: lpfc: Remove redundant flush_workqueue call . - scsi: lpfc: SLI path split: Introduce lpfc_prep_wqe . - scsi: lpfc: SLI path split: Refactor Abort paths . - scsi: lpfc: SLI path split: Refactor base ELS paths and the FLOGI path . - scsi: lpfc: SLI path split: Refactor BSG paths . - scsi: lpfc: SLI path split: Refactor CT paths . - scsi: lpfc: SLI path split: Refactor fast and slow paths to native SLI4 . - scsi: lpfc: SLI path split: Refactor FDISC paths . - scsi: lpfc: SLI path split: Refactor lpfc_iocbq . - scsi: lpfc: SLI path split: Refactor LS_ACC paths . - scsi: lpfc: SLI path split: Refactor LS_RJT paths . - scsi: lpfc: SLI path split: Refactor misc ELS paths . - scsi: lpfc: SLI path split: Refactor PLOGI/PRLI/ADISC/LOGO paths . - scsi: lpfc: SLI path split: Refactor SCSI paths . - scsi: lpfc: SLI path split: Refactor the RSCN/SCR/RDF/EDC/FARPR paths . - scsi: lpfc: SLI path split: Refactor VMID paths . - scsi: lpfc: Update lpfc version to 14.2.0.0 . - scsi: lpfc: Update lpfc version to 14.2.0.1 . - scsi: lpfc: Use fc_block_rport . - scsi: lpfc: Use kcalloc . - scsi: lpfc: Use rport as argument for lpfc_chk_tgt_mapped . - scsi: lpfc: Use rport as argument for lpfc_send_taskmgmt . - scsi: qla2xxx: Fix crash during module load unload test . - scsi: qla2xxx: Fix disk failure to rediscover . - scsi: qla2xxx: Fix hang due to session stuck . - scsi: qla2xxx: Fix incorrect reporting of task management failure . - scsi: qla2xxx: Fix laggy FC remote port session recovery . - scsi: qla2xxx: Fix loss of NVMe namespaces after driver reload test . - scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests . - scsi: qla2xxx: Fix N2N inconsistent PLOGI . - scsi: qla2xxx: Fix stuck session of PRLI reject . - scsi: qla2xxx: Fix typos in comments . - scsi: qla2xxx: Increase max limit of ql2xnvme_queues . - scsi: qla2xxx: Reduce false trigger to login . - scsi: qla2xxx: Stop using the SCSI pointer . - scsi: qla2xxx: Update version to 10.02.07.400-k . - scsi: qla2xxx: Use correct feature type field during RFF_ID processing . - scsi: qla2xxx: Use named initializers for port_state_str . - scsi: qla2xxx: Use named initializers for q_dev_state . - serial: 8250_lpss: Balance reference count for PCI DMA device . - serial: 8250_mid: Balance reference count for PCI DMA device . - serial: 8250: Fix race condition in RTS-after-send handling . - serial: core: Fix the definition name in the comment of UPF_* flags . - soc: qcom: aoss: remove spurious IRQF_ONESHOT flags . - soc: qcom: rpmpd: Check for null return of devm_kcalloc . - soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe . - soundwire: intel: fix wrong register name in intel_shim_wake . - spi: pxa2xx-pci: Balance reference count for PCI DMA device . - spi: tegra114: Add missing IRQ check in tegra_spi_probe . - staging:iio:adc:ad7280a: Fix handing of device address bit reversing . - tcp: add some entropy in __inet_hash_connect . - tcp: change source port randomizarion at connect time . - thermal: int340x: Check for NULL after calling kmemdup . - thermal: int340x: Increase bitmap size . - udp_tunnel: Fix end of loop test in udp_tunnel_nic_unregister . - Update config files . VIRTIO_PCI=m -greater than VIRTIO_PCI=y - usb: bdc: Adb shows offline after resuming from S2 . - usb: bdc: Fix a resource leak in the error handling path of "bdc_probe" . - usb: bdc: Fix unused assignment in bdc_probe . - usb: bdc: remove duplicated error message . - usb: bdc: Use devm_clk_get_optional . - usb: bdc: use devm_platform_ioremap_resource to simplify code . - usb: dwc3: gadget: Use list_replace_init before traversing lists . - usb: dwc3: qcom: add IRQ check . - usb: gadget: bdc: use readl_poll_timeout to simplify code . - usb: gadget: Fix use-after-free bug by not setting udc-greater than dev.driver . - usb: gadget: rndis: prevent integer overflow in rndis_set_response . - usb: usbtmc: Fix bug in pipe direction for control transfers . - VFS: filename_create: fix incorrect intent . - video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe . - video: fbdev: controlfb: Fix COMPILE_TEST build . - video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name . - video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen . - video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen . - video: fbdev: omapfb: Add missing of_node_put in dvic_probe_of . - video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe . - VMCI: Fix the description of vmci_check_host_caps . - vsprintf: Fix %pK with kptr_restrict == 0 . - wireguard: queueing: use CFI-safe ptr_ring cleanup function . - wireguard: selftests: rename DEBUG_PI_LIST to DEBUG_PLIST . - wireguard: socket: free skb in send6 when ipv6 is disabled . - wireguard: socket: ignore v6 endpoints when ipv6 is disabled . - x86/cpu: Add hardware-enforced cache coherency as a CPUID feature . - x86/mm/pat: Do not flush cache if hardware enforces cache coherency across encryption domnains . - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT . - x86/speculation: Warn about Spectre v2 LFENCE mitigation . - xhci: fix garbage USBSTS being logged in some cases . Special Instructions and Notes: Please reboot the system after installing this update.