Jammy update: v6.1.18 upstream stable release

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v6.1.18 upstream stable release
       from git://git.kernel.org/

Linux 6.1.18
usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
arm64: Reset KASAN tag in copy_highpage with HW tags only
arm64: mte: Fix/clarify the PG_mte_tagged semantics
arm64: efi: Make efi_rt_lock a raw_spinlock
io_uring/poll: allow some retries for poll triggering spuriously
io_uring: fix two assignments in if conditions
media: uvcvideo: Fix race condition with usb_kill_urb
drm/i915: Fix system suspend without fbdev being initialized
drm/i915/dp_mst: Add the MST topology state for modesetted CRTCs
drm/display/dp_mst: Fix payload addition on a disconnected sink
drm/display/dp_mst: Fix down message handling after a packet reception error
drm/display/dp_mst: Fix down/up message handling after sink disconnect
drm/display/dp_mst: Add drm_atomic_get_old_mst_topology_state()
vDPA/ifcvf: allocate the adapter in dev_add()
vDPA/ifcvf: manage ifcvf_hw in the mgmt_dev
vDPA/ifcvf: ifcvf_request_irq works on ifcvf_hw
vDPA/ifcvf: decouple config/dev IRQ requester and vectors allocator from the adapter
vDPA/ifcvf: decouple vq irq requester from the adapter
vDPA/ifcvf: decouple config IRQ releaser from the adapter
vDPA/ifcvf: decouple vq IRQ releasers from the adapter
vDPA/ifcvf: alloc the mgmt_dev before the adapter
vDPA/ifcvf: decouple config space ops from the adapter
vDPA/ifcvf: decouple hw features manipulators from the adapter
x86/resctl: fix scheduler confusion with 'current'
net: tls: avoid hanging tasks on the tx_lock
soundwire: cadence: Drain the RX FIFO after an IO timeout
soundwire: cadence: Remove wasted space in response_buf
iommu: Attach device group to old domain in error path
RDMA/cma: Distinguish between sockaddr_in and sockaddr_in6 by size
phy: rockchip-typec: Fix unsigned comparison with less than zero
PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
PCI: Add ACS quirk for Wangxun NICs
PCI: loongson: Add more devices that need MRRS quirk
kernel/fail_function: fix memory leak with using debugfs_lookup()
drivers: base: dd: fix memory leak with using debugfs_lookup()
drivers: base: component: fix memory leak with using debugfs_lookup()
misc: vmw_balloon: fix memory leak with using debugfs_lookup()
tty: pcn_uart: fix memory leak with using debugfs_lookup()
PCI: Distribute available resources for root buses, too
PCI: Take other bus devices into account when distributing resources
PCI: Align extra resources for hotplug bridges properly
usb: gadget: uvc: Make bSourceID read/write
usb: uvc: Enumerate valid values for color matching
USB: ene_usb6250: Allocate enough memory for full object
usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math
USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup()
USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()
USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup()
USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup()
USB: gadget: gr_udc: fix memory leak with using debugfs_lookup()
USB: isp1362: fix memory leak with using debugfs_lookup()
USB: isp116x: fix memory leak with using debugfs_lookup()
USB: fotg210: fix memory leak with using debugfs_lookup()
USB: sl811: fix memory leak with using debugfs_lookup()
USB: uhci: fix memory leak with using debugfs_lookup()
USB: ULPI: fix memory leak with using debugfs_lookup()
USB: chipidea: fix memory leak with using debugfs_lookup()
USB: dwc3: fix memory leak with using debugfs_lookup()
staging: pi433: fix memory leak with using debugfs_lookup()
PCI: loongson: Prevent LS7A MRRS increases
soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe()
media: uvcvideo: Add GUID for BGRA/X 8:8:8:8
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word()
bus: mhi: ep: Fix the debug message for MHI_PKT_TYPE_RESET_CHAN_CMD cmd
tools/iio/iio_utils:fix memory leak
mei: bus-fixup:upon error print return values of send and receive
serial: sc16is7xx: setup GPIO controller later in probe
tty: serial: fsl_lpuart: disable the CTS when send break signal
tty: fix out-of-bounds access in tty_driver_lookup_tty()
staging: emxx_udc: Add checks for dma_alloc_coherent()
cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
USB: fix memory leak with using debugfs_lookup()
media: uvcvideo: Silence memcpy() run-time false positive warnings
media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
media: uvcvideo: Handle errors from calls to usb_string
media: uvcvideo: Handle cameras with invalid descriptors
media: uvcvideo: Remove format descriptions
PCI/ACPI: Account for _S0W of the target bridge in acpi_pci_bridge_d3()
iommu/amd: Fix error handling for pdev_pri_ats_enable()
IB/hfi1: Update RMT size calculation
mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support
firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
kernel/printk/index.c: fix memory leak with using debugfs_lookup()
tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
thermal: intel: quark_dts: fix error pointer dereference
ASoC: mediatek: mt8195: add missing initialization
ASoC: zl38060 add gpiolib dependency
nvme-fabrics: show well known discovery name
nvme-tcp: don't access released socket during error recovery
nvme: bring back auto-removal of deleted namespaces during sequential scan
ASoC: apple: mca: Improve handling of unavailable DMA channels
ASoC: apple: mca: Fix SERDES reset sequence
ASoC: apple: mca: Fix final status read on SERDES reset
ASoC: adau7118: don't disable regulators on device unbind
loop: loop_set_status_from_info() check before assignment
io_uring: fix size calculation when registering buf ring
rtc: allow rtc_read_alarm without read_alarm callback
scsi: mpi3mr: Use number of bits to manage bitmap sizes
scsi: mpi3mr: Fix an issue found by KASAN
scsi: ipr: Work around fortify-string warning
genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
rtc: sun6i: Always export the internal oscillator
spi: tegra210-quad: Fix iterator outside loop
vc_screen: modify vcs_size() handling in vcs_read()
tcp: tcp_check_req() can be called from process context
ARM: dts: spear320-hmi: correct STMPE GPIO compatible
net: dsa: felix: fix internal MDIO controller resource length
net: dsa: seville: ignore mscc-miim read errors from Lynx PCS
net/sched: act_sample: fix action bind logic
net/sched: act_mpls: fix action bind logic
net/sched: act_pedit: fix action bind logic
net/sched: transition act_pedit to rcu and percpu stats
nfc: fix memory leak of se_io context in nfc_genl_se_io
ext4: fix incorrect options show of original mount_opt and extend mount_opt2
net/mlx5: Geneve, Fix handling of Geneve object id as error code
net/mlx5e: Verify flow_source cap before using it
net/mlx5: ECPF, wait for VF pages only after disabling host PFs
mlx5: fix possible ptp queue fifo use-after-free
mlx5: fix skb leak while fifo resync and push
spi: tegra210-quad: Fix validate combined sequence
9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
9p/xen: fix connection sequence
9p/xen: fix version parsing
net: fix __dev_kfree_skb_any() vs drop monitor
octeontx2-pf: Use correct struct reference in test condition
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
net: sunhme: Fix region request
octeontx2-pf: Recalculate UDP checksum for ptp 1-step sync packet
ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
drm/i915: move a Kconfig symbol to unbreak the menu presentation
ptp: vclock: use mutex to fix "sleep on atomic" bug
netfilter: x_tables: fix percpu counter block leak on error path when creating new netns
netfilter: ctnetlink: make event listener tracking global
netfilter: xt_length: use skb len to match in length_mt6
netfilter: ebtables: fix table blob use-after-free
netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
netfilter: conntrack: fix rmmod double-free race
netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
watchdog: pcwd_usb: Fix attempting to access uninitialized memory
watchdog: Fix kmemleak in watchdog_cdev_register
watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path
watchdog: rzg2l_wdt: Handle TYPE-B reset for RZ/V2M
watchdog: rzg2l_wdt: Issue a reset before we put the PM clocks
f2fs: synchronize atomic write aborts
um: virt-pci: properly remove PCI device from bus
um: virtio_uml: move device breaking into workqueue
um: virtio_uml: mark device as unregistered when breaking it
um: virtio_uml: free command if adding to virtqueue failed
x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
netfilter: nf_tables: allow to fetch set elements when table has an owner
ext4: don't show commit interval if it is zero
ext4: use ext4_fc_tl_mem in fast-commit replay path
soc: qcom: stats: Populate all subsystem debugfs files
f2fs: fix to avoid potential memory corruption in __update_iostat_latency()
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap
ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process
ubifs: ubifs_writepage: Mark page dirty after writing inode failed
ubifs: dirty_cow_znode: Fix memleak in error handling path
ubifs: Re-statistic cleaned znode count if commit failed
ubi: Fix possible null-ptr-deref in ubi_free_volume()
ubifs: Fix memory leak in alloc_wbufs()
ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
ubi: Fix use-after-free when volume resizing failed
ubifs: Reserve one leb for each journal head while doing budget
ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
ubifs: Fix wrong dirty space budget for dirty inode
ubifs: Rectify space budget for ubifs_xrename()
ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
ubifs: Fix memory leak in ubifs_sysfs_init()
ubifs: Fix build errors as symbol undefined
ubi: ensure that VID header offset + VID header size <= alloc, size
um: vector: Fix memory leak in vector_config
f2fs: fix to abort atomic write only during do_exist()
f2fs: allow set compression option of files without blocks
fs: f2fs: initialize fsdata in pagecache_write()
soc: mediatek: mtk-svs: Use pm_runtime_resume_and_get() in svs_init01()
soc: mediatek: mtk-svs: reset svs when svs_resume() fail
soc: mediatek: mtk-svs: restore default voltages when svs_init02() fail
f2fs: clear atomic_write_task in f2fs_abort_atomic_write()
f2fs: correct i_size change for atomic writes
f2fs: introduce trace_f2fs_replace_atomic_write_block
pwm: stm32-lp: fix the check on arr and cmp registers update
pwm: sifive: Always let the first pwm_apply_state succeed
soc: mediatek: mtk-svs: Enable the IRQ later
memory: renesas-rpc-if: Move resource acquisition to .probe()
memory: renesas-rpc-if: Split-off private data from struct rpcif
soc: mediatek: mtk-pm-domains: Allow mt8186 ADSP default power on
objtool: Fix memory leak in create_static_call_sections()
f2fs: fix to avoid potential deadlock
f2fs: don't rely on F2FS_MAP_* in f2fs_iomap_begin
driver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event()
fs/jfs: fix shift exponent db_agl2size negative
auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()
net/sched: Retire tcindex classifier