Jammy update: v6.1.76 upstream stable release

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v6.1.76 upstream stable release
       from git://git.kernel.org/

Linux 6.1.76
net/mlx5e: Handle hardware IPsec limits events
serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
x86/entry/ia32: Ensure s32 is sign extended to s64
tick/sched: Preserve number of idle sleeps across CPU hotplug events
mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
cxl/region：Fix overflow issue in alloc_hpa()
MIPS: lantiq: register smp_ops on non-smp platforms
spi: fix finalize message on error return
spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
drm/bridge: anx7625: Ensure bridge is suspended in disable()
block: Move checking GENHD_FL_NO_PART to bdev_add_partition()
gpio: eic-sprd: Clear interrupt after set the interrupt type
drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
drm/exynos: fix accidental on-stack copy of exynos_drm_plane
drm/bridge: parade-ps8640: Make sure we drop the AUX mutex in the error case
drm/bridge: parade-ps8640: Ensure bridge is suspended in .post_disable()
drm/bridge: sii902x: Fix audio codec unregistration
drm/bridge: sii902x: Fix probing race issue
drm/bridge: sii902x: Use devm_regulator_bulk_get_enable()
drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
drm/bridge: parade-ps8640: Wait for HPD when doing an AUX transfer
Revert "powerpc/64s: Increase default stack size to 32KB"
drm/panel-edp: drm/panel-edp: Fix AUO B116XAK01 name and timing
btrfs: zoned: optimize hint byte for zoned allocator
btrfs: zoned: factor out prepare_allocation_zoned()
serial: sc16is7xx: fix unconditional activation of THRI interrupt
serial: sc16is7xx: Use port lock wrappers
serial: core: Provide port lock wrappers
dlm: use kernel_connect() and kernel_bind()
ARM: dts: qcom: sdx55: fix USB SS wakeup
ARM: dts: qcom: sdx55: fix USB DP/DM HS PHY interrupts
ARM: dts: qcom: sdx55: fix pdc '#interrupt-cells'
ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
ARM: dts: qcom: sdx55: fix USB wakeup interrupt types
pipe: wakeup wr_wait after setting max_usage
fs/pipe: move check to pipe_has_watch_queue()
thermal: intel: hfi: Add syscore callbacks for system-wide PM
thermal: intel: hfi: Disable an HFI instance when all its CPUs go offline
thermal: intel: hfi: Refactor enabling code into helper functions
PM: sleep: Fix possible deadlocks in core system-wide PM code
PM: core: Remove unnecessary (void *) conversions
bus: mhi: ep: Do not allocate event ring element on stack
media: ov13b10: Enable runtime PM before registering async sub-device
media: ov13b10: Support device probe in non-zero ACPI D state
erofs: fix lz4 inplace decompression
erofs: get rid of the remaining kmap_atomic()
drm/amdgpu/pm: Fix the power source flag error
drm/amd/display: Port DENTIST hang and TDR fixes to OTG disable W/A
drm/bridge: nxp-ptn3460: simplify some error checking
platform/x86: intel-uncore-freq: Fix types in sysfs callbacks
drm/amd/display: Disable PSR-SU on Parade 0803 TCON again
drm/tidss: Fix atomic_flush check
drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
drm: Don't unref the same fb many times by mistake due to deadlock handling
cpufreq: intel_pstate: Refine computation of P-state for given frequency
gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
xfs: read only mounts with fsopen mount API are busted
firmware: arm_scmi: Check mailbox/SMT channel for consistency
ksmbd: fix global oob in ksmbd_nl_policy
platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe
netfilter: nf_tables: reject QUEUE/DROP verdict parameters
netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes
wifi: iwlwifi: fix a memory corruption
exec: Fix error handling in begin_new_exec()
rbd: don't move requests to the running list on errors
btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
btrfs: don't warn if discard range is not aligned to sector
btrfs: tree-checker: fix inline ref size in error messages
btrfs: ref-verify: free ref cache before clearing mount opt
btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted
nbd: always initialize struct msghdr completely
net: fec: fix the unhandled context fault from smmu
fjes: fix memleaks in fjes_hw_setup
selftests: netdevsim: fix the udp_tunnel_nic test
net: mvpp2: clear BM pool before initialization
net: stmmac: Wait a bit for the reset to take effect
netfilter: nf_tables: validate NFPROTO_* family
netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
btrfs: fix race between reading a directory and adding entries to it
btrfs: refresh dir last index during a rewinddir(3) call
btrfs: set last dir index to the current last index when opening dir
btrfs: fix infinite directory reads
netfilter: nft_limit: reject configurations that cause integer overflow
rcu: Defer RCU kthreads wakeup when CPU is dying
net/mlx5e: fix a potential double-free in fs_any_create_groups
net/mlx5e: fix a double-free in arfs_create_groups
net/mlx5e: Allow software parsing when IPsec crypto is enabled
net/mlx5: Use mlx5 device constant for selecting CQ period mode for ASO
net/mlx5: DR, Can't go to uplink vport on RX rule
net/mlx5: DR, Use the right GVMI number for drop action
ipv6: init the accept_queue's spinlocks in inet6_create
netlink: fix potential sleeping issue in mqueue_flush_file
tcp: Add memory barrier to tcp_push()
afs: Hide silly-rename files from userspace
tracing: Ensure visibility when inserting an element into tracing_map
netfs, fscache: Prevent Oops in fscache_put_cache()
net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
net: micrel: Fix PTP frame parsing for lan8814
tun: add missing rx stats accounting in tun_xdp_act
tun: fix missing dropped counter in tun_xdp_act
net: fix removing a namespace with conflicting altnames
udp: fix busy polling
llc: Drop support for ETH_P_TR_802_2.
llc: make llc_ui_sendmsg() more robust against bonding changes
vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
bnxt_en: Wait for FLR to complete during probe
tcp: make sure init the accept_queue's spinlocks once
net/smc: fix illegal rmb_desc access in SMC-D connection dump
wifi: mac80211: fix potential sta-link leak
drm/amd/display: pbn_div need be updated for hotplug event
Revert "drm/amd: Enable PCIe PME from D3"
ksmbd: Add missing set_freezable() for freezable kthread
ksmbd: send lease break notification on FILE_RENAME_INFORMATION
ksmbd: don't increment epoch if current state and request state are same
ksmbd: fix potential circular locking issue in smb2_set_ea()
ksmbd: set v2 lease version on lease upgrade
mm: page_alloc: unreserve highatomic page blocks before oom
LoongArch/smp: Call rcutree_report_cpu_starting() earlier
serial: sc16is7xx: improve do/while loop in sc16is7xx_irq()
serial: sc16is7xx: remove obsolete loop in sc16is7xx_port_irq()
serial: sc16is7xx: fix invalid sc16is7xx_lines bitfield in case of probe error
serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
serial: sc16is7xx: change EFR lock to operate on each channels
serial: sc16is7xx: remove unused line structure member
serial: sc16is7xx: remove global regmap from struct sc16is7xx_port
serial: sc16is7xx: remove wasteful static buffer in sc16is7xx_regmap_name()
serial: sc16is7xx: improve regmap debugfs by using one regmap per port
rename(): fix the locking of subdirectories
mm/sparsemem: fix race in accessing memory_section->usage
mm/rmap: fix misplaced parenthesis of a likely()
ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
nouveau/vmm: don't set addr on the fail path to avoid warning
rtc: Extend timeout for waiting for UIP to clear to 1s
rtc: Add support for configuring the UIP timeout for RTC reads
rtc: mc146818-lib: Adjust failure return code for mc146818_get_time()
rtc: Adjust failure return code for cmos_set_alarm()
rtc: cmos: Use ACPI alarm for non-Intel x86 systems too
arm64: Rename ARM64_WORKAROUND_2966298
media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
mmc: mmc_spi: remove custom DMA mapped buffers
mmc: core: Use mrq.sbc in close-ended ffu
media: videobuf2-dma-sg: fix vmap callback
scripts/get_abi: fix source path leak
docs: kernel_abi.py: fix command injection
lsm: new security_file_ioctl_compat() hook
arm64: dts: qcom: sm8150: fix USB DP/DM HS PHY interrupts
arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
arm64: dts: qcom: sc7280: fix usb_1 wakeup interrupt types
arm64: dts: qcom: sm8150: fix USB wakeup interrupt types
arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
arm64: dts: qcom: sc7180: fix USB wakeup interrupt types
scsi: ufs: core: Remove the ufshcd_hba_exit() call from ufshcd_async_scan()
dmaengine: fix NULL pointer in channel unregistration function
iio: adc: ad7091r: Enable internal vref if external vref is not supplied
async: Introduce async_schedule_dev_nocall()
async: Split async_schedule_node_domain()
parisc/power: Fix power soft-off button emulation on qemu
parisc/firmware: Fix F-extend for PDC addresses
bus: mhi: host: Add spinlock to protect WP access when queueing TREs
bus: mhi: host: Drop chan lock before queuing buffers
bus: mhi: host: Add alignment check for event ring read pointer
mips: Fix max_mapnr being uninitialized on early stages
s390/vfio-ap: let on_scan_complete() callback filter matrix and update guest's APCB
s390/vfio-ap: loop over the shadow APCB when filtering guest's AP configuration
s390/vfio-ap: always filter entire AP matrix
media: ov9734: Enable runtime PM before registering async sub-device
rpmsg: virtio: Free driver_override when rpmsg_remove()
media: imx355: Enable runtime PM before registering async sub-device
PM / devfreq: Fix buffer overflow in trans_stat_show
s390/vfio-ap: unpin pages on gisc registration failure
crypto: s390/aes - Fix buffer overread in CTR mode
hwrng: core - Fix page fault dead lock on mmap-ed hwrng
PM: hibernate: Enforce ordering during image compression/decompression
crypto: api - Disallow identical driver names
btrfs: sysfs: validate scrub_speed_max value
OPP: Pass rounded rate to _set_opp()
arm64: properly install vmlinuz.efi
ext4: allow for the last group to be marked as trimmed
iio: adc: ad7091r: Allow users to configure device events
iio: adc: ad7091r: Set alert bit in config register
Revert "nSVM: Check for reserved encodings of TLB_CONTROL in nested VMCB"
usb: dwc3: gadget: Handle EP0 request dequeuing properly
usb: dwc3: gadget: Queue PM runtime idle on disconnect event
usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API