linux 5.15.0-48.54 source package in Ubuntu

Changelog

linux (5.15.0-48.54) jammy; urgency=medium

  * jammy/linux: 5.15.0-48.54 -proposed tracker (LP: #1987775)

  * System freeze after resuming from suspend due to PCI ASPM settings
    (LP: #1980829)
    - SAUCE: PCI/ASPM: Save/restore L1SS Capability for suspend/resume
    - SAUCE: whitelist platforms that needs save/restore ASPM L1SS for
      suspend/resume

  * [SRU][J/OEM-5.17][PATCH 0/1] Fix oled brightness set above frame-average
    luminance (LP: #1978986)
    - SAUCE: drm: New function to get luminance range based on static hdr metadata
    - SAUCE: drm/amdgpu_dm: Rely on split out luminance calculation function
    - SAUCE: drm/i915: Use luminance range calculated during edid parsing

  * Jammy: Add OVS Internal Port HW Offload to mlx5 driver (LP: #1983498)
    - net/mlx5e: Refactor rx handler of represetor device
    - net/mlx5e: Use generic name for the forwarding dev pointer
    - net/mlx5: E-Switch, Add ovs internal port mapping to metadata support
    - net/mlx5e: Support accept action
    - net/mlx5e: Accept action skbedit in the tc actions list
    - net/mlx5e: Offload tc rules that redirect to ovs internal port
    - net/mlx5e: Offload internal port as encap route device
    - net/mlx5e: Enable TC offload for ingress MACVLAN
    - net/mlx5e: Add indirect tc offload of ovs internal port
    - net/mlx5e: Term table handling of internal port rules
    - net/mlx5: Support internal port as decap route device
    - net/mlx5: Fix some error handling paths in 'mlx5e_tc_add_fdb_flow()'
    - net/mlx5e: TC, Fix memory leak with rules with internal port
    - net/mlx5e: Fix skb memory leak when TC classifier action offloads are
      disabled
    - net/mlx5e: Fix nullptr on deleting mirroring rule
    - net/mlx5e: Avoid implicit modify hdr for decap drop rule
    - net/mlx5e: Fix wrong source vport matching on tunnel rule
    - net/mlx5e: TC, fix decap fallback to uplink when int port not supported

  * Remove unused variable from i915 psr (LP: #1986798)
    - SAUCE: drm/i915/display/psr: Remove unused variable

  * refactoring of overlayfs fix to properly support shiftfs (LP: #1983640)
    - SAUCE: overlayfs: remove CONFIG_AUFS_FS dependency

  * Jammy update: v5.15.53 upstream stable release (LP: #1986728)
    - Revert "drm/amdgpu/display: set vblank_disable_immediate for DC"
    - drm/amdgpu: To flush tlb for MMHUB of RAVEN series
    - ksmbd: set the range of bytes to zero without extending file size in
      FSCTL_ZERO_DATA
    - ksmbd: check invalid FileOffset and BeyondFinalZero in FSCTL_ZERO_DATA
    - ksmbd: use vfs_llseek instead of dereferencing NULL
    - ipv6: take care of disable_policy when restoring routes
    - net: phy: Don't trigger state machine while in suspend
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG SX6000LNP (AKA SPECTRIX
      S40G)
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA IM2P33F8ABR1
    - nvdimm: Fix badblocks clear off-by-one error
    - powerpc/prom_init: Fix kernel config grep
    - powerpc/book3e: Fix PUD allocation size in map_kernel_page()
    - powerpc/bpf: Fix use of user_pt_regs in uapi
    - dm raid: fix accesses beyond end of raid member array
    - dm raid: fix KASAN warning in raid5_add_disks
    - s390/archrandom: simplify back to earlier design and initialize earlier
    - SUNRPC: Fix READ_PLUS crasher
    - net: rose: fix UAF bugs caused by timer handler
    - net: usb: ax88179_178a: Fix packet receiving
    - virtio-net: fix race between ndo_open() and virtio_device_ready()
    - selftests/net: pass ipv6_args to udpgso_bench's IPv6 TCP test
    - net: dsa: bcm_sf2: force pause link settings
    - net: tun: unlink NAPI from device on destruction
    - net: tun: stop NAPI when detaching queues
    - net: dp83822: disable false carrier interrupt
    - net: dp83822: disable rx error interrupt
    - RDMA/qedr: Fix reporting QP timeout attribute
    - RDMA/cm: Fix memory leak in ib_cm_insert_listen
    - linux/dim: Fix divide by 0 in RDMA DIM
    - net: usb: asix: do not force pause frames support
    - usbnet: fix memory allocation in helpers
    - selftests: mptcp: more stable diag tests
    - net: ipv6: unexport __init-annotated seg6_hmac_net_init()
    - NFSD: restore EINVAL error translation in nfsd_commit()
    - vfs: fix copy_file_range() regression in cross-fs copies
    - caif_virtio: fix race between virtio_device_ready() and ndo_open()
    - PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events
    - vdpa/mlx5: Update Control VQ callback information
    - s390: remove unneeded 'select BUILD_BIN2C'
    - netfilter: nft_dynset: restore set element counter when failing to update
    - net/dsa/hirschmann: Add missing of_node_get() in hellcreek_led_setup()
    - net/sched: act_api: Notify user space if any actions were flushed before
      error
    - net: asix: fix "can't send until first packet is send" issue
    - net: bonding: fix possible NULL deref in rlb code
    - net: phy: ax88772a: fix lost pause advertisement configuration
    - net: bonding: fix use-after-free after 802.3ad slave unbind
    - powerpc/memhotplug: Add add_pages override for PPC
    - nfc: nfcmrvl: Fix irq_of_parse_and_map() return value
    - NFC: nxp-nci: Don't issue a zero length i2c_master_read()
    - tipc: move bc link creation back to tipc_node_create
    - epic100: fix use after free on rmmod
    - io_uring: ensure that send/sendmsg and recv/recvmsg check sqe->ioprio
    - ACPI: video: Change how we determine if brightness key-presses are handled
    - tunnels: do not assume mac header is set in skb_tunnel_check_pmtu()
    - ipv6/sit: fix ipip6_tunnel_get_prl return value
    - ipv6: fix lockdep splat in in6_dump_addrs()
    - mlxsw: spectrum_router: Fix rollback in tunnel next hop init
    - net: tun: avoid disabling NAPI twice
    - MAINTAINERS: add Leah as xfs maintainer for 5.15.y
    - tcp: add a missing nf_reset_ct() in 3WHS handling
    - selftests/bpf: Add test_verifier support to fixup kfunc call insns
    - selftests/rseq: remove ARRAY_SIZE define from individual tests
    - selftests/rseq: introduce own copy of rseq uapi header
    - selftests/rseq: Remove useless assignment to cpu variable
    - selftests/rseq: Remove volatile from __rseq_abi
    - selftests/rseq: Introduce rseq_get_abi() helper
    - selftests/rseq: Introduce thread pointer getters
    - selftests/rseq: Uplift rseq selftests for compatibility with glibc-2.35
    - selftests/rseq: Fix ppc32: wrong rseq_cs 32-bit field pointer on big endian
    - selftests/rseq: Fix ppc32 missing instruction selection "u" and "x" for
      load/store
    - selftests/rseq: Fix ppc32 offsets by using long rather than off_t
    - selftests/rseq: Fix warnings about #if checks of undefined tokens
    - selftests/rseq: Remove arm/mips asm goto compiler work-around
    - selftests/rseq: Fix: work-around asm goto compiler bugs
    - selftests/rseq: x86-64: use %fs segment selector for accessing rseq thread
      area
    - selftests/rseq: x86-32: use %gs segment selector for accessing rseq thread
      area
    - selftests/rseq: Change type of rseq_offset to ptrdiff_t
    - xen/blkfront: fix leaking data in shared pages
    - xen/netfront: fix leaking data in shared pages
    - xen/netfront: force data bouncing when backend is untrusted
    - xen/blkfront: force data bouncing when backend is untrusted
    - xen-netfront: restore __skb_queue_tail() positioning in
      xennet_get_responses()
    - xen/arm: Fix race in RB-tree based P2M accounting
    - net: usb: qmi_wwan: add Telit 0x1070 composition
    - clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from
      ixp4xx_timer_setup()
    - fsi: occ: Force sequence numbering per OCC
    - net: fix IFF_TX_SKB_NO_LINEAR definition
    - drm/i915/gem: add missing else
    - drm/msm/gem: Fix error return on fence id alloc fail
    - drivers: cpufreq: Add missing of_node_put() in qoriq-cpufreq.c
    - platform/x86: panasonic-laptop: de-obfuscate button codes
    - platform/x86: panasonic-laptop: sort includes alphabetically
    - platform/x86: panasonic-laptop: revert "Resolve hotkey double trigger bug"
    - platform/x86: panasonic-laptop: don't report duplicate brightness key-
      presses
    - platform/x86: panasonic-laptop: filter out duplicate volume up/down/mute
      keypresses
    - drm/fourcc: fix integer type usage in uapi header
    - hwmon: (occ) Remove sequence numbering and checksum calculation
    - hwmon: (occ) Prevent power cap command overwriting poll response
    - hwmon: (ibmaem) don't call platform_device_del() if platform_device_add()
      fails
    - Linux 5.15.53

  * Jammy update: v5.15.52 upstream stable release (LP: #1986724)
    - tick/nohz: unexport __init-annotated tick_nohz_full_setup()
    - xfs: use kmem_cache_free() for kmem_cache objects
    - xfs: punch out data fork delalloc blocks on COW writeback failure
    - xfs: Fix the free logic of state in xfs_attr_node_hasname
    - xfs: remove all COW fork extents when remounting readonly
    - xfs: check sb_meta_uuid for dabuf buffer recovery
    - xfs: prevent UAF in xfs_log_item_in_current_chkpt
    - xfs: only bother with sync_filesystem during readonly remount
    - powerpc/ftrace: Remove ftrace init tramp once kernel init is complete
    - fs: add is_idmapped_mnt() helper
    - fs: move mapping helpers
    - fs: tweak fsuidgid_has_mapping()
    - fs: account for filesystem mappings
    - docs: update mapping documentation
    - fs: use low-level mapping helpers
    - fs: remove unused low-level mapping helpers
    - fs: port higher-level mapping helpers
    - fs: add i_user_ns() helper
    - fs: support mapped mounts of mapped filesystems
    - fs: fix acl translation
    - fs: account for group membership
    - rtw88: 8821c: support RFE type4 wifi NIC
    - rtw88: rtw8821c: enable rfe 6 devices
    - net: mscc: ocelot: allow unregistered IP multicast flooding to CPU
    - io_uring: fix not locked access to fixed buf table
    - Linux 5.15.52

  * Jammy update: v5.15.51 upstream stable release (LP: #1986718)
    - random: schedule mix_interrupt_randomness() less often
    - random: quiet urandom warning ratelimit suppression message
    - ALSA: hda/via: Fix missing beep setup
    - ALSA: hda/conexant: Fix missing beep setup
    - ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop
    - ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly
    - ALSA: hda/realtek: Add quirk for Clevo PD70PNT
    - ALSA: hda/realtek: Add quirk for Clevo NS50PU
    - net: openvswitch: fix parsing of nw_proto for IPv6 fragments
    - 9p: Fix refcounting during full path walks for fid lookups
    - 9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl
    - 9p: fix fid refcount leak in v9fs_vfs_get_link
    - btrfs: fix hang during unmount when block group reclaim task is running
    - btrfs: prevent remounting to v1 space cache for subpage mount
    - btrfs: add error messages to all unrecognized mount options
    - scsi: ibmvfc: Store vhost pointer during subcrq allocation
    - scsi: ibmvfc: Allocate/free queue resource only during probe/remove
    - mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing
    - mmc: mediatek: wait dma stop bit reset to 0
    - xen/gntdev: Avoid blocking in unmap_grant_pages()
    - MAINTAINERS: Add new IOMMU development mailing list
    - ata: libata: add qc->flags in ata_qc_complete_template tracepoint
    - dm era: commit metadata in postsuspend after worker stops
    - dm mirror log: clear log bits up to BITS_PER_LONG boundary
    - tracing/kprobes: Check whether get_kretprobe() returns NULL in
      kretprobe_dispatcher()
    - drm/i915: Implement w/a 22010492432 for adl-s
    - USB: serial: pl2303: add support for more HXN (G) types
    - USB: serial: option: add Telit LE910Cx 0x1250 composition
    - USB: serial: option: add Quectel EM05-G modem
    - USB: serial: option: add Quectel RM500K module support
    - drm/msm: Ensure mmap offset is initialized
    - drm/msm: Fix double pm_runtime_disable() call
    - netfilter: use get_random_u32 instead of prandom
    - scsi: scsi_debug: Fix zone transition to full condition
    - drm/msm: Switch ordering of runpm put vs devfreq_idle
    - scsi: iscsi: Exclude zero from the endpoint ID range
    - xsk: Fix generic transmit when completion queue reservation fails
    - drm/msm: use for_each_sgtable_sg to iterate over scatterlist
    - bpf: Fix request_sock leak in sk lookup helpers
    - drm/sun4i: Fix crash during suspend after component bind failure
    - bpf, x86: Fix tail call count offset calculation on bpf2bpf call
    - scsi: storvsc: Correct reporting of Hyper-V I/O size limits
    - phy: aquantia: Fix AN when higher speeds than 1G are not advertised
    - KVM: arm64: Prevent kmemleak from accessing pKVM memory
    - net: Write lock dev_base_lock without disabling bottom halves.
    - net: fix data-race in dev_isalive()
    - tipc: fix use-after-free Read in tipc_named_reinit
    - igb: fix a use-after-free issue in igb_clean_tx_ring
    - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
    - ethtool: Fix get module eeprom fallback
    - net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
    - drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf
    - drm/msm/dp: check core_initialized before disable interrupts at
      dp_display_unbind()
    - drm/msm/dp: Drop now unused hpd_high member
    - drm/msm/dp: dp_link_parse_sink_count() return immediately if aux read failed
    - drm/msm/dp: do not initialize phy until plugin interrupt received
    - drm/msm/dp: force link training for display resolution change
    - perf arm-spe: Don't set data source if it's not a memory operation
    - erspan: do not assume transport header is always set
    - net/tls: fix tls_sk_proto_close executed repeatedly
    - udmabuf: add back sanity check
    - selftests: netfilter: correct PKTGEN_SCRIPT_PATHS in nft_concat_range.sh
    - xen-blkfront: Handle NULL gendisk
    - x86/xen: Remove undefined behavior in setup_features()
    - MIPS: Remove repetitive increase irq_err_count
    - afs: Fix dynamic root getattr
    - ice: ethtool: advertise 1000M speeds properly
    - regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips
    - regmap-irq: Fix offset/index mismatch in read_sub_irq_data()
    - virtio_net: fix xdp_rxq_info bug after suspend/resume
    - Revert "net/tls: fix tls_sk_proto_close executed repeatedly"
    - sock: redo the psock vs ULP protection check
    - nvme-pci: add NO APST quirk for Kioxia device
    - nvme: move the Samsung X5 quirk entry to the core quirks
    - gpio: winbond: Fix error code in winbond_gpio_get()
    - s390/cpumf: Handle events cycles and instructions identical
    - iio: mma8452: fix probe fail when device tree compatible is used.
    - iio: magnetometer: yas530: Fix memchr_inv() misuse
    - iio: adc: vf610: fix conversion mode sysfs node name
    - usb: typec: wcove: Drop wrong dependency to INTEL_SOC_PMIC
    - xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI
    - xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI
    - usb: gadget: Fix non-unique driver names in raw-gadget driver
    - USB: gadget: Fix double-free bug in raw_gadget driver
    - usb: chipidea: udc: check request status before setting device address
    - dt-bindings: usb: ohci: Increase the number of PHYs
    - dt-bindings: usb: ehci: Increase the number of PHYs
    - btrfs: don't set lock_owner when locking extent buffer for reading
    - btrfs: fix deadlock with fsync+fiemap+transaction commit
    - f2fs: attach inline_data after setting compression
    - iio:humidity:hts221: rearrange iio trigger get and register
    - iio:chemical:ccs811: rearrange iio trigger get and register
    - iio:accel:kxcjk-1013: rearrange iio trigger get and register
    - iio:accel:bma180: rearrange iio trigger get and register
    - iio:accel:mxc4005: rearrange iio trigger get and register
    - iio: accel: mma8452: ignore the return value of reset operation
    - iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up()
    - iio: trigger: sysfs: fix use-after-free on remove
    - iio: adc: stm32: fix maximum clock rate for stm32mp15x
    - iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value)
    - iio: afe: rescale: Fix boolean logic bug
    - iio: adc: stm32: Fix ADCs iteration in irq handler
    - iio: adc: stm32: Fix IRQs on STM32F4 by removing custom spurious IRQs
      message
    - iio: adc: axp288: Override TS pin bias current for some models
    - iio: adc: rzg2l_adc: add missing fwnode_handle_put() in
      rzg2l_adc_parse_properties()
    - iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client
    - iio: adc: ti-ads131e08: add missing fwnode_handle_put() in
      ads131e08_alloc_channels()
    - xtensa: xtfpga: Fix refcount leak bug in setup
    - xtensa: Fix refcount leak bug in time.c
    - parisc/stifb: Fix fb_is_primary_device() only available with CONFIG_FB_STI
    - parisc: Enable ARCH_HAS_STRICT_MODULE_RWX
    - powerpc/microwatt: wire up rng during setup_arch()
    - powerpc: Enable execve syscall exit tracepoint
    - powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address
    - powerpc/powernv: wire up rng during setup_arch
    - drm/msm/dp: Always clear mask bits to disable interrupts at
      dp_ctrl_reset_irq_ctrl()
    - ARM: dts: imx7: Move hsic_phy power domain to HSIC PHY node
    - ARM: dts: imx6qdl: correct PU regulator ramp delay
    - arm64: dts: ti: k3-am64-main: Remove support for HS400 speed mode
    - ARM: exynos: Fix refcount leak in exynos_map_pmu
    - soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe
    - ARM: Fix refcount leak in axxia_boot_secondary
    - memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings
    - ARM: cns3xxx: Fix refcount leak in cns3xxx_init
    - modpost: fix section mismatch check for exported init/exit sections
    - ARM: dts: bcm2711-rpi-400: Fix GPIO line names
    - random: update comment from copy_to_user() -> copy_to_iter()
    - perf build-id: Fix caching files with a wrong build ID
    - dma-direct: use the correct size for dma_set_encrypted()
    - kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS (2nd attempt)
    - powerpc/pseries: wire up rng during setup_arch()
    - Linux 5.15.51

  * Jammy update: v5.15.50 upstream stable release (LP: #1986715)
    - net: mana: Add handling of CQE_RX_TRUNCATED
    - zonefs: fix zonefs_iomap_begin() for reads
    - usb: gadget: u_ether: fix regression in setting fixed MAC address
    - bpf: Fix calling global functions from BPF_PROG_TYPE_EXT programs
    - selftests/bpf: Add selftest for calling global functions from freplace
    - serial: core: Initialize rs485 RTS polarity already on probe
    - arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
    - Linux 5.15.50

  * Jammy update: v5.15.49 upstream stable release (LP: #1983149)
    - Revert "drm/amd/display: Fix DCN3 B0 DP Alt Mapping"
    - nfsd: Replace use of rwsem with errseq_t
    - arm64: dts: imx8mm-beacon: Enable RTS-CTS on UART3
    - arm64: dts: imx8mn-beacon: Enable RTS-CTS on UART3
    - powerpc/kasan: Silence KASAN warnings in __get_wchan()
    - ASoC: nau8822: Add operation for internal PLL off and on
    - drm/amd/display: Read Golden Settings Table from VBIOS
    - drm/amdkfd: Use mmget_not_zero in MMU notifier
    - dma-debug: make things less spammy under memory pressure
    - ASoC: cs42l52: Fix TLV scales for mixer controls
    - ASoC: cs35l36: Update digital volume TLV
    - ASoC: cs53l30: Correct number of volume levels on SX controls
    - ASoC: cs42l52: Correct TLV for Bypass Volume
    - ASoC: cs42l56: Correct typo in minimum level for SX volume controls
    - ASoC: cs42l51: Correct minimum value for SX volume control
    - drm/amdkfd: add pinned BOs to kfd_bo_list
    - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
    - quota: Prevent memory allocation recursion while holding dq_lock
    - ASoC: wm8962: Fix suspend while playing music
    - ASoC: es8328: Fix event generation for deemphasis control
    - ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put()
    - Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to
      dmi_use_low_level_irq
    - scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
    - scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted
    - scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology
    - scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd
      completion
    - scsi: mpt3sas: Fix out-of-bounds compiler warning
    - scsi: ipr: Fix missing/incorrect resource cleanup in error case
    - scsi: pmcraid: Fix missing resource cleanup in error case
    - ALSA: hda/realtek - Add HW8326 support
    - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration
      failed
    - nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
    - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
    - net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface
      netdev[napi]_alloc_frag
    - gcc-12: disable '-Wdangling-pointer' warning for now
    - mellanox: mlx5: avoid uninitialized variable warning with gcc-12
    - MIPS: Loongson-3: fix compile mips cpu_hwmon as module build error.
    - random: credit cpu and bootloader seeds by default
    - gpio: dwapb: Don't print error on -EPROBE_DEFER
    - platform/x86: gigabyte-wmi: Add Z690M AORUS ELITE AX DDR4 support
    - platform/x86: gigabyte-wmi: Add support for B450M DS3H-CF
    - platform/x86/intel: hid: Add Surface Go to VGBS allow list
    - staging: r8188eu: fix rtw_alloc_hwxmits error detection for now
    - staging: r8188eu: Use zeroing allocator in wpa_set_encryption()
    - staging: r8188eu: Fix warning of array overflow in ioctl_linux.c
    - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE
    - pNFS: Avoid a live lock condition in pnfs_update_layout()
    - sunrpc: set cl_max_connect when cloning an rpc_clnt
    - clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()
    - i40e: Fix adding ADQ filter to TC0
    - i40e: Fix calculating the number of queue pairs
    - i40e: Fix call trace in setup_tx_descriptors
    - Drivers: hv: vmbus: Release cpu lock in error case
    - tty: goldfish: Fix free_irq() on remove
    - misc: atmel-ssc: Fix IRQ check in ssc_probe
    - io_uring: fix races with file table unregister
    - io_uring: fix races with buffer table unregister
    - drm/i915/reset: Fix error_state_read ptr + offset use
    - net: hns3: split function hclge_update_port_base_vlan_cfg()
    - net: hns3: set port base vlan tbl_sta to false before removing old vlan
    - net: hns3: don't push link state to VF if unalive
    - net: hns3: fix tm port shapping of fibre port is incorrect after driver
      initialization
    - nvme: add device name to warning in uuid_show()
    - mlxsw: spectrum_cnt: Reorder counter pools
    - net: bgmac: Fix an erroneous kfree() in bgmac_remove()
    - net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg
    - arm64: ftrace: fix branch range checks
    - arm64: ftrace: consistently handle PLTs.
    - certs/blacklist_hashes.c: fix const confusion in certs blacklist
    - init: Initialize noop_backing_dev_info early
    - block: Fix handling of offline queues in blk_mq_alloc_request_hctx()
    - faddr2line: Fix overlapping text section failures, the sequel
    - i2c: npcm7xx: Add check for platform_driver_register
    - irqchip/gic/realview: Fix refcount leak in realview_gic_of_init
    - irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions
    - irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions
    - irqchip/realtek-rtl: Fix refcount leak in map_interrupts
    - sched: Fix balance_push() vs __sched_setscheduler()
    - i2c: designware: Use standard optional ref clock implementation
    - mei: hbm: drop capability response on early shutdown
    - mei: me: add raptor lake point S DID
    - comedi: vmk80xx: fix expression for tx buffer size
    - [Config] updateconfigs for LIB_MEMNEQ
    - crypto: memneq - move into lib/
    - USB: serial: option: add support for Cinterion MV31 with new baseline
    - USB: serial: io_ti: add Agilent E5805A support
    - usb: dwc2: Fix memory leak in dwc2_hcd_init
    - usb: cdnsp: Fixed setting last_trb incorrectly
    - usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe
    - usb: gadget: f_fs: change ep->status safe in ffs_epfile_io()
    - usb: gadget: f_fs: change ep->ep safe in ffs_epfile_io()
    - tty: n_gsm: Debug output allocation must use GFP_ATOMIC
    - serial: 8250: Store to lsr_save_flags after lsr read
    - bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
    - dm mirror log: round up region bitmap size to BITS_PER_LONG
    - drm/amd/display: Cap OLED brightness per max frame-average luminance
    - cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle
    - ext4: fix super block checksum incorrect after mount
    - ext4: fix bug_on ext4_mb_use_inode_pa
    - ext4: make variable "count" signed
    - ext4: add reserved GDT blocks check
    - KVM: arm64: Don't read a HW interrupt pending state in user context
    - virtio-pci: Remove wrong address verification in vp_del_vqs()
    - powerpc/book3e: get rid of #include <generated/compile.h>
    - clk: imx8mp: fix usb_root_clk parent
    - Linux 5.15.49

  * Jammy update: v5.15.48 upstream stable release (LP: #1983146)
    - Linux 5.15.48
    - Upstream stable to v5.15.48

  * Jammy update: v5.15.47 upstream stable release (LP: #1982968)
    - pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
    - staging: greybus: codecs: fix type confusion of list iterator variable
    - iio: adc: ad7124: Remove shift from scan_type
    - lkdtm/bugs: Check for the NULL pointer after calling kmalloc
    - lkdtm/bugs: Don't expect thread termination without CONFIG_UBSAN_TRAP
    - tty: goldfish: Use tty_port_destroy() to destroy port
    - tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe
    - tty: n_tty: Restore EOF push handling behavior
    - serial: 8250_aspeed_vuart: Fix potential NULL dereference in
      aspeed_vuart_probe
    - tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id
      and ida_simple_get
    - remoteproc: imx_rproc: Ignore create mem entry for resource table
    - usb: usbip: fix a refcount leak in stub_probe()
    - usb: usbip: add missing device lock on tweak configuration cmd
    - USB: storage: karma: fix rio_karma_init return
    - usb: musb: Fix missing of_node_put() in omap2430_probe
    - staging: fieldbus: Fix the error handling path in
      anybuss_host_common_probe()
    - pwm: lp3943: Fix duty calculation in case period was clamped
    - pwm: raspberrypi-poe: Fix endianness in firmware struct
    - rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
    - usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback
    - usb: dwc3: pci: Fix pm_runtime_get_sync() error checking
    - misc: fastrpc: fix an incorrect NULL check on list iterator
    - firmware: stratix10-svc: fix a missing check on list iterator
    - usb: typec: mux: Check dev_set_name() return value
    - rpmsg: virtio: Fix possible double free in rpmsg_probe()
    - rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev()
    - rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl
    - iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check
    - iio: proximity: vl53l0x: Fix return value check of
      wait_for_completion_timeout
    - iio: adc: sc27xx: fix read big scale voltage not right
    - iio: adc: sc27xx: Fine tune the scale calibration values
    - rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails
    - pvpanic: Fix typos in the comments
    - misc/pvpanic: Convert regular spinlock into trylock on panic path
    - phy: qcom-qmp: fix pipe-clock imbalance on power-on failure
    - power: supply: axp288_fuel_gauge: Drop BIOS version check from "T3 MRD" DMI
      quirk
    - serial: sifive: Report actual baud base rather than fixed 115200
    - export: fix string handling of namespace in EXPORT_SYMBOL_NS
    - soundwire: intel: prevent pm_runtime resume prior to system suspend
    - coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
    - ksmbd: fix reference count leak in smb_check_perm_dacl()
    - extcon: ptn5150: Add queue work sync before driver release
    - soc: rockchip: Fix refcount leak in rockchip_grf_init
    - clocksource/drivers/riscv: Events are stopped during CPU suspend
    - ARM: dts: aspeed: ast2600-evb: Enable RX delay for MAC0/MAC1
    - rtc: mt6397: check return value after calling platform_get_resource()
    - rtc: ftrtc010: Use platform_get_irq() to get the interrupt
    - rtc: ftrtc010: Fix error handling in ftrtc010_rtc_probe
    - staging: r8188eu: add check for kzalloc
    - tty: n_gsm: Don't ignore write return value in gsmld_output()
    - tty: n_gsm: Fix packet data hex dump output
    - serial: meson: acquire port->lock in startup()
    - serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485
    - serial: cpm_uart: Fix build error without CONFIG_SERIAL_CPM_CONSOLE
    - serial: digicolor-usart: Don't allow CS5-6
    - serial: rda-uart: Don't allow CS5-6
    - serial: txx9: Don't allow CS5-6
    - serial: sh-sci: Don't allow CS5-6
    - serial: sifive: Sanitize CSIZE and c_iflag
    - serial: st-asc: Sanitize CSIZE and correct PARENB for CS7
    - serial: stm32-usart: Correct CSIZE, bits, and parity
    - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
    - bus: ti-sysc: Fix warnings for unbind for serial
    - driver: base: fix UAF when driver_attach failed
    - driver core: fix deadlock in __device_attach
    - watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking
    - watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe
    - blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx
    - ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition
    - clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value
    - s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
    - net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog
    - net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry()
    - net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks
    - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
    - modpost: fix removing numeric suffixes
    - jffs2: fix memory leak in jffs2_do_fill_super
    - ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty
    - ubi: ubi_create_volume: Fix use-after-free when volume creation failed
    - selftests/bpf: fix selftest after random: Urandom_read tracepoint removal
    - selftests/bpf: fix stacktrace_build_id with missing kprobe/urandom_read
    - bpf: Fix probe read error in ___bpf_prog_run()
    - block: take destination bvec offsets into account in bio_copy_data_iter
    - riscv: read-only pages should not be writable
    - net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct
      smc_wr_tx_pend_priv *"
    - tcp: add accessors to read/set tp->snd_cwnd
    - nfp: only report pause frame configuration for physical device
    - sfc: fix considering that all channels have TX queues
    - sfc: fix wrong tx channel offset with efx_separate_tx_channels
    - block: make bioset_exit() fully resilient against being called twice
    - vdpa: Fix error logic in vdpa_nl_cmd_dev_get_doit
    - virtio: pci: Fix an error handling path in vp_modern_probe()
    - net/mlx5: Don't use already freed action pointer
    - net/mlx5: CT: Fix header-rewrite re-use for tupels
    - net/mlx5: correct ECE offset in query qp output
    - net/mlx5e: Update netdev features after changing XDP state
    - net: sched: add barrier to fix packet stuck problem for lockless qdisc
    - tcp: tcp_rtx_synack() can be called from process context
    - vdpa: ifcvf: set pci driver data in probe
    - octeontx2-af: fix error code in is_valid_offset()
    - s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST flag
    - regulator: mt6315-regulator: fix invalid allowed mode
    - gpio: pca953x: use the correct register address to do regcache sync
    - afs: Fix infinite loop found by xfstest generic/676
    - scsi: sd: Fix potential NULL pointer dereference
    - tipc: check attribute length for bearer name
    - driver core: Fix wait_for_device_probe() & deferred_probe_timeout
      interaction
    - perf c2c: Fix sorting in percent_rmt_hitm_cmp()
    - dmaengine: idxd: set DMA_INTERRUPT cap bit
    - mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
    - bootconfig: Make the bootconfig.o as a normal object file
    - tracing: Make tp_printk work on syscall tracepoints
    - tracing: Fix sleeping function called from invalid context on RT kernel
    - tracing: Avoid adding tracer option before update_tracer_options
    - iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe()
    - iommu/arm-smmu-v3: check return value after calling platform_get_resource()
    - f2fs: remove WARN_ON in f2fs_is_valid_blkaddr
    - i2c: cadence: Increase timeout per message if necessary
    - m68knommu: set ZERO_PAGE() to the allocated zeroed page
    - m68knommu: fix undefined reference to `_init_sp'
    - dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type
    - NFSv4: Don't hold the layoutget locks across multiple RPC calls
    - video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1
    - video: fbdev: pxa3xx-gcu: release the resources correctly in
      pxa3xx_gcu_probe/remove()
    - RISC-V: use memcpy for kexec_file mode
    - m68knommu: fix undefined reference to `mach_get_rtc_pll'
    - f2fs: fix to tag gcing flag on page during file defragment
    - xprtrdma: treat all calls not a bcall when bc_serv is NULL
    - drm/bridge: sn65dsi83: Fix an error handling path in sn65dsi83_probe()
    - drm/bridge: ti-sn65dsi83: Handle dsi_lanes == 0 as invalid
    - netfilter: nat: really support inet nat without l3 address
    - netfilter: nf_tables: use kfree_rcu(ptr, rcu) to release hooks in clean_net
      path
    - netfilter: nf_tables: delete flowtable hooks via transaction list
    - powerpc/kasan: Force thread size increase with KASAN
    - SUNRPC: Trap RDMA segment overflows
    - netfilter: nf_tables: always initialize flowtable hook list in transaction
    - ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
    - netfilter: nf_tables: release new hooks on unsupported flowtable flags
    - netfilter: nf_tables: memleak flow rule from commit path
    - netfilter: nf_tables: bail out early if hardware offload is not supported
    - xen: unexport __init-annotated xen_xlate_map_ballooned_pages()
    - stmmac: intel: Fix an error handling path in intel_eth_pci_probe()
    - af_unix: Fix a data-race in unix_dgram_peer_wake_me().
    - bpf, arm64: Clear prog->jited_len along prog->jited
    - net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list
    - net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure
    - i40e: xsk: Move tmp desc array from driver to pool
    - xsk: Fix handling of invalid descriptors in XSK TX batching API
    - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()
    - net: mdio: unexport __init-annotated mdio_bus_init()
    - net: xfrm: unexport __init-annotated xfrm4_protocol_init()
    - net: ipv6: unexport __init-annotated seg6_hmac_init()
    - net/mlx5: Lag, filter non compatible devices
    - net/mlx5: Fix mlx5_get_next_dev() peer device matching
    - net/mlx5: Rearm the FW tracer after each tracer event
    - net/mlx5: fs, fail conflicting actions
    - ip_gre: test csum_start instead of transport header
    - net: altera: Fix refcount leak in altera_tse_mdio_create
    - net: dsa: mv88e6xxx: use BMSR_ANEGCOMPLETE bit for filling an_complete
    - tcp: use alloc_large_system_hash() to allocate table_perturb
    - drm: imx: fix compiler warning with gcc-12
    - nfp: flower: restructure flow-key for gre+vlan combination
    - iov_iter: Fix iter_xarray_get_pages{,_alloc}()
    - iio: dummy: iio_simple_dummy: check the return value of kstrdup()
    - staging: rtl8712: fix a potential memory leak in r871xu_drv_init()
    - iio: st_sensors: Add a local lock for protecting odr
    - lkdtm/usercopy: Expand size of "out of frame" object
    - drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()
    - drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()
    - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
    - tty: Fix a possible resource leak in icom_probe
    - thunderbolt: Use different lane for second DisplayPort tunnel
    - drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
    - drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
    - USB: host: isp116x: check return value after calling platform_get_resource()
    - drivers: tty: serial: Fix deadlock in sa1100_set_termios()
    - drivers: usb: host: Fix deadlock in oxu_bus_suspend()
    - USB: hcd-pci: Fully suspend across freeze/thaw cycle
    - char: xillybus: fix a refcount leak in cleanup_dev()
    - sysrq: do not omit current cpu when showing backtrace of all active CPUs
    - usb: dwc2: gadget: don't reset gadget's driver->bus
    - soundwire: qcom: adjust autoenumeration timeout
    - misc: rtsx: set NULL intfdata when probe fails
    - extcon: Fix extcon_get_extcon_dev() error handling
    - extcon: Modify extcon device to be created after driver data is set
    - clocksource/drivers/sp804: Avoid error on multiple instances
    - staging: rtl8712: fix uninit-value in usb_read8() and friends
    - staging: rtl8712: fix uninit-value in r871xu_drv_init()
    - serial: msm_serial: disable interrupts in __msm_console_write()
    - kernfs: Separate kernfs_pr_cont_buf and rename_lock.
    - watchdog: wdat_wdt: Stop watchdog when rebooting the system
    - md: protect md_unregister_thread from reentrancy
    - scsi: myrb: Fix up null pointer access on myrb_cleanup()
    - ceph: allow ceph.dir.rctime xattr to be updatable
    - ceph: flush the mdlog for filesystem sync
    - drm/amd/display: Check if modulo is 0 before dividing.
    - drm/radeon: fix a possible null pointer dereference
    - drm/amd/pm: Fix missing thermal throttler status
    - um: line: Use separate IRQs per line
    - modpost: fix undefined behavior of is_arm_mapping_symbol()
    - x86/cpu: Elide KCSAN for cpu_has() and friends
    - jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds
    - nbd: call genl_unregister_family() first in nbd_cleanup()
    - nbd: fix race between nbd_alloc_config() and module removal
    - cifs: version operations for smb20 unneeded when legacy support disabled
    - drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate
    - nodemask: Fix return values to be unsigned
    - vringh: Fix loop descriptors check in the indirect cases
    - scripts/gdb: change kernel config dumping method
    - ALSA: usb-audio: Skip generic sync EP parse for secondary EP
    - ALSA: usb-audio: Set up (implicit) sync for Saffire 6
    - ALSA: hda/conexant - Fix loopback issue with CX20632
    - ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga
      DuetITL 2021
    - ALSA: hda/realtek: Add quirk for HP Dev One
    - cifs: return errors during session setup during reconnects
    - cifs: fix reconnect on smb3 mount types
    - KEYS: trusted: tpm2: Fix migratable logic
    - ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
    - mmc: block: Fix CQE recovery reset success
    - net: phy: dp83867: retrigger SGMII AN when link change
    - writeback: Fix inode->i_io_list not be protected by inode->i_lock error
    - nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION
    - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
    - nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION
    - ixgbe: fix bcast packets Rx on VF after promisc removal
    - ixgbe: fix unexpected VLAN Rx in promisc mode on VF
    - Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
    - vduse: Fix NULL pointer dereference on sysfs access
    - powerpc: Don't select HAVE_IRQ_EXIT_ON_IRQ_STACK
    - drm/bridge: analogix_dp: Support PSR-exit to disable transition
    - drm/atomic: Force bridge self-refresh-exit on CRTC switch
    - drm/amdgpu: update VCN codec support for Yellow Carp
    - powerpc/32: Fix overread/overwrite of thread_struct via ptrace
    - powerpc/mm: Switch obsolete dssall to .long
    - drm/ast: Create threshold values for AST2600
    - random: avoid checking crng_ready() twice in random_init()
    - random: mark bootloader randomness code as __init
    - random: account for arch randomness in bits
    - md/raid0: Ignore RAID0 layout if the second zone has only one device
    - net/sched: act_police: more accurate MTU policing
    - PCI: qcom: Fix pipe clock imbalance
    - zonefs: fix handling of explicit_open option on mount
    - iov_iter: fix build issue due to possible type mis-match
    - dmaengine: idxd: add missing callback function to support DMA_INTERRUPT
    - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
    - xsk: Fix possible crash when multiple sockets are created
    - Linux 5.15.47

  * CVE-2022-36946
    - netfilter: nf_queue: do not allow packet truncation below transport header
      offset

  * CVE-2021-33655
    - fbcon: Disallow setting font bigger than screen size
    - fbcon: Prevent that screen size is smaller than font size
    - fbmem: Check virtual screen sizes in fb_set_var()

 -- Stefan Bader <email address hidden>  Fri, 26 Aug 2022 11:12:42 +0200