Jammy update: v6.1.22 upstream stable release

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v6.1.22 upstream stable release
       from git://git.kernel.org/

Linux 6.1.22
drm/amdkfd: Fix the memory overrun
drm/amdkfd: add GC 11.0.4 KFD support
drm/amdkfd: Fix the warning of array-index-out-of-bounds
drm/amdkfd: introduce dummy cache info for property asic
sched/fair: Sanitize vruntime of entity being migrated
sched/fair: sanitize vruntime of entity being placed
dm crypt: avoid accessing uninitialized tasklet
dm crypt: add cond_resched() to dmcrypt_write()
dm stats: check for and propagate alloc_percpu failure
i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
bus: imx-weim: fix branch condition evaluates to a garbage value
mm/ksm: fix race with VMA iteration and mm_struct teardown
soc: qcom: llcc: Fix slice configuration values for SC8280XP
arm64: dts: qcom: sm8150: Fix the iommu mask used for PCIe controllers
arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent
firmware: arm_scmi: Fix device node validation for mailbox transport
tee: amdtee: fix race condition in amdtee_open_session
riscv: Handle zicsr/zifencei issues between clang and binutils
riscv: mm: Fix incorrect ASID argument when flushing TLB
drm/amdgpu: reposition the gpu reset checking for reuse
drm/amdgpu: skip ASIC reset for APUs when go to S4
drm/i915: Preserve crtc_state->inherited during state clearing
drm/i915/active: Fix missing debug object activation
drm/amdgpu/nv: Apply ASPM quirk on Intel ADL + AMD Navi
drm/meson: fix missing component unbind on bind errors
drm/amd/display: fix wrong index used in dccg32_set_dpstreamclk
drm/bridge: lt8912b: return EPROBE_DEFER if bridge is not found
nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
wifi: mac80211: fix qos on mesh interfaces
ksmbd: return unsupported error on smb1 mount
ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect
ksmbd: don't terminate inactive sessions after a few seconds
ksmbd: set FILE_NAMED_STREAMS attribute in FS_ATTRIBUTE_INFORMATION
ksmbd: fix wrong signingkey creation when encryption is AES256
maple_tree: fix mas_skip_node() end slot detection
test_maple_tree: add more testing for mas_empty_area()
Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare"
io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()
io_uring/net: avoid sending -ECONNABORTED on repeated connection requests
kfence: avoid passing -g for test
mm: kfence: fix using kfence_metadata without initialization in show_object()
usb: ucsi_acpi: Increase the command completion timeout
usb: ucsi: Fix NULL pointer deref in ucsi_connector_change()
usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC
usb: chipidea: core: fix possible concurrent when switch role
usb: chipdea: core: fix return -EINVAL if request role is the same with current role
usb: cdnsp: changes PCI Device ID to fix conflict with CNDS3 driver
usb: cdnsp: Fixes issue with redundant Status Stage
usb: cdns3: Fix issue with using incorrect PCI device function
usb: typec: tcpm: fix warning when handle discover_identity message
usb: typec: tcpm: fix create duplicate source-capabilities file
dm thin: fix deadlock when swapping to thin device
igb: revert rtnl_lock() that causes deadlock
arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name
lockd: set file_lock start and end when decoding nlm4 testargs
fsverity: Remove WQ_UNBOUND from fsverity read workqueue
fscrypt: destroy keyring after security_sb_delete()
mm/slab: Fix undefined init_cache_node_node() for NUMA and !SMP
efi: sysfb_efi: Fix DMI quirks not working for simpledrm
Bluetooth: Fix race condition in hci_cmd_sync_clear
btrfs: zoned: fix btrfs_can_activate_zone() to support DUP profile
usb: gadget: u_audio: don't let userspace block driver unbind
usb: dwc2: fix a devres leak in hw_enable upon suspend resume
usb: dwc2: drd: fix inconsistent mode if role-switch-default-mode="host"
usb: misc: onboard-hub: add support for Microchip USB2517 USB 2.0 hub
scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
selftests/x86/amx: Add a ptrace test
x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf()
cifs: fix dentry lookups in directory handle cache
cifs: print session id while listing open files
cifs: dump pending mids for all channels in DebugData
cifs: empty interface list when server doesn't support query interfaces
cifs: do not poll server interfaces too regularly
cifs: append path to open_enter trace event
cifs: lock chan_lock outside match_session
act_mirred: use the backlog for nested calls to mirred ingress
net/sched: act_mirred: better wording on protection against excessive stack growth
drm/amd: Fix initialization mistake for NBIO 7.3.0
drm/amdgpu: Fix call trace warning and hang when removing amdgpu device
sh: sanitize the flags on sigreturn
drm/amd/display: Update clock table to include highest clock setting
net: usb: qmi_wwan: add Telit 0x1080 composition
net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
platform/x86: int3472: Add GPIOs to Surface Go 3 Board data
scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file
scsi: mpi3mr: Bad drive in topology results kernel crash
scsi: mpi3mr: NVMe command size greater than 8K fails
scsi: mpi3mr: Wait for diagnostic save during controller init
scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
scsi: lpfc: Avoid usage of list iterator variable after loop
scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read()
scsi: ufs: core: Add soft dependency on governor_simpleondemand
scsi: hisi_sas: Check devm_add_action() return value
scsi: qla2xxx: Add option to disable FC2 Target support
scsi: target: iscsi: Fix an error message in iscsi_check_key()
selftests/bpf: check that modifier resolves after pointer
m68k: Only force 030 bus error if PC not in exception table
m68k: mm: Fix systems with memory at end of 32-bit address space
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
HID: logitech-hidpp: Add support for Logitech MX Master 3S mouse
ca8210: fix mac_len negative array access
HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded
drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update()
riscv: Bump COMMAND_LINE_SIZE value to 1024
ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable
ACPI: x86: Drop quirk for HP Elitebook
ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A43)
ASoC: amd: yp: Add OMEN by HP Gaming Laptop 16z-n000 to quirks
thunderbolt: Rename shadowed variables bit to interrupt_bit and auto_clear_bit
thunderbolt: Use const qualifier for `ring_interrupt_index`
thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer access
thunderbolt: Disable interrupt auto clear for rings
thunderbolt: Fix memory leak in margining
thunderbolt: Add quirk to disable CLx
thunderbolt: Call tb_check_quirks() after initializing adapters
thunderbolt: Use scale field when allocating USB3 bandwidth
uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2
smb3: fix unusable share after force unmount failure
smb3: lower default deferred close timeout to address perf regression
scsi: qla2xxx: Perform lockless command completion in abort path
scsi: qla2xxx: Synchronize the IOCB count to be in order
hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
hwmon: fix potential sensor registration fail if of_node is missing
entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up
perf/x86/amd/core: Always clear status for idx
entry: Fix noinstr warning in __enter_from_user_mode()
platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl
Bluetooth: HCI: Fix global-out-of-bounds
Bluetooth: mgmt: Fix MGMT add advmon with RSSI command
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
Bluetooth: L2CAP: Fix responding with wrong PDU type
Bluetooth: btqcomsmd: Fix command timeout after setting BD address
drm/amd/display: Set dcn32 caps.seamless_odm
net: mdio: thunder: Add missing fwnode_handle_put()
net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case
net: dsa: mt7530: move lowering TRGMII driving to mt7530_setup()
net: dsa: mt7530: move enabling disabling core clock to mt7530_pll_setup()
net: asix: fix modprobe "sysfs: cannot create duplicate filename"
gve: Cache link_speed value from device
Bluetooth: Remove "Power-on" check from Mesh feature
Bluetooth: ISO: fix timestamped HCI ISO data packet parsing
Bluetooth: btusb: Remove detection of ISO packets over bulk
Bluetooth: hci_core: Detect if an ACL packet is in fact an ISO packet
Bluetooth: hci_sync: Resume adv with no RPA when active scan
ksmbd: fix possible refcount leak in smb2_open()
ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES
ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA
hvc/xen: prevent concurrent accesses to the shared ring
mlxsw: spectrum_fid: Fix incorrect local port type
nvme-tcp: fix nvme_tcp_term_pdu to match spec
net/sonic: use dma_mapping_error() for error check
erspan: do not use skb_mac_header() in ndo_start_xmit()
atm: idt77252: fix kmemleak when rmmod idt77252
net: dsa: tag_brcm: legacy: fix daisy-chained switches
net/mlx5: E-Switch, Fix an Oops in error handling code
net/mlx5: Read the TC mapping of all priorities on ETS query
net/mlx5e: Overcome slow response for first macsec ASO WQE
net/mlx5: Fix steering rules cleanup
net/mlx5e: Block entering switchdev mode with ns inconsistency
net/mlx5e: Set uplink rep as NETNS_LOCAL
bpf: Adjust insufficient default bpf_jit_limit
i40e: fix flow director packet filter programming
iavf: fix hang on reboot with ice
ice: check if VF exists before mode check
keys: Do not cache key in task struct if key is requested from kernel thread
bootconfig: Fix testcase to increase max node
octeontx2-vf: Add missing free for alloc_percpu
net/ps3_gelic_net: Use dma_mapping_error
net/ps3_gelic_net: Fix RX sk_buff length
net: usb: lan78xx: Limit packet length to skb->len
net: qcom/emac: Fix use after free bug in emac_remove due to race condition
drm/i915/gt: perform uc late init after probe error injection
drm/i915/guc: Fix missing ecodes
drm/i915/guc: Rename GuC register state capture node to be more obvious
drm/i915/fbdev: lock the fbdev obj before vma pin
drm/i915: Print return value on error
mlxsw: core_thermal: Fix fan speed in maximum cooling state
thermal/drivers/mellanox: Use generic thermal_zone_get_trip() function
net: stmmac: Fix for mismatched host/device DMA address width
net: mdio: fix owner field for mdio buses registered using ACPI
net: mdio: fix owner field for mdio buses registered using device-tree
net: phy: Ensure state transitions are processed from phy_stop()
xirc2ps_cs: Fix use after free bug in xirc2ps_detach
qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
efi/libstub: smbios: Use length member instead of record struct size
net: usb: smsc95xx: Limit packet length to skb->len
net: dsa: b53: mmap: fix device tree support
nfsd: don't replace page in rq_pages if it's a continuation of last page
scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
i2c: hisi: Only use the completion interrupt to finish the transfer
i2c: mxs: ensure that DMA buffers are safe for DMA
i2c: imx-lpi2c: check only for enabled interrupt flags
igc: fix the validation logic for taprio's gate list
igbvf: Regard vf reset nack as success
intel/igbvf: free irq on the error path in igbvf_request_msix()
iavf: do not track VLAN 0 filters
iavf: fix non-tunneled IPv6 UDP packet type and hashing
iavf: fix inverted Rx hash condition leading to disabled hash
xsk: Add missing overflow check in xdp_umem_reg
NFS: Fix /proc/PID/io read_bytes for buffered reads
arm64: dts: imx93: add missing #address-cells and #size-cells to i2c nodes
arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes
ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl
ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl
ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl
arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio
arm64: dts: imx8dxl-evk: Disable hibernation mode of AR8031 for EQOS
power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
arm64: dts: qcom: sm8450: Mark UFS controller as cache coherent
drm/amd/display: Fix DP MST sinks removal issue
mptcp: fix UaF in listener shutdown
mptcp: use the workqueue to destroy unaccepted sockets
mptcp: refactor passive socket initialization
drm/amd/display: Remove OTG DIV register write for Virtual signals.
drm/amd/display: fix k1 k2 divider programming for phantom streams
drm/amd/display: Include virtual signal to set k1 and k2 values
tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr
perf: fix perf_event_context->time
perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output
interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT
interconnect: qcom: sm8450: switch to qcom_icc_rpmh_* function
interconnect: qcom: osm-l3: fix icc_onecell_data allocation