linux (5.15.0-121.131) jammy; urgency=medium

  * jammy/linux: 5.15.0-121.131 -proposed tracker (LP: #2076347)

  * jammy:linux bpf selftest do not build (LP: #2076334)
    - SAUCE: Revert "bpf: Allow reads from uninit stack"

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Fri, 09 Aug 2024 10:15:16 +0200

linux (5.15.0-120.130) jammy; urgency=medium

  * jammy/linux: 5.15.0-120.130 -proposed tracker (LP: #2075903)

  * Packaging resync (LP: #1786013)
    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
      (main/2024.08.05)

  * Jammy update: v5.15.163 upstream stable release (LP: #2075170)
    - Compiler Attributes: Add __uninitialized macro
    - locking/mutex: Introduce devm_mutex_init()
    - drm/lima: fix shared irq handling on driver remove
    - media: dvb: as102-fe: Fix as10x_register_addr packing
    - media: dvb-usb: dib0700_devices: Add missing release_firmware()
    - IB/core: Implement a limit on UMAD receive List
    - scsi: qedf: Make qedf_execute_tmf() non-preemptible
    - crypto: aead,cipher - zeroize key buffer after use
    - drm/amdgpu: Initialize timestamp for some legacy SOCs
    - drm/amd/display: Check index msg_id before read or write
    - drm/amd/display: Check pipe offset before setting vblank
    - drm/amd/display: Skip finding free audio for unknown engine_id
    - media: dw2102: Don't translate i2c read into write
    - sctp: prefer struct_size over open coded arithmetic
    - firmware: dmi: Stop decoding on broken entry
    - Input: ff-core - prefer struct_size over open coded arithmetic
    - wifi: mt76: replace skb_put with skb_put_zero
    - net: dsa: mv88e6xxx: Correct check for empty list
    - media: dvb-frontends: tda18271c2dd: Remove casting during div
    - media: s2255: Use refcount_t instead of atomic_t for num_channels
    - media: dvb-frontends: tda10048: Fix integer overflow
    - i2c: i801: Annotate apanel_addr as __ro_after_init
    - powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
    - orangefs: fix out-of-bounds fsid access
    - kunit: Fix timeout message
    - powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
    - igc: fix a log entry using uninitialized netdev
    - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
    - jffs2: Fix potential illegal address access in jffs2_free_inode
    - s390/pkey: Wipe sensitive data on failure
    - tools/power turbostat: Remember global max_die_id
    - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
    - tcp_metrics: validate source addr length
    - KVM: s390: fix LPSWEY handling
    - e1000e: Fix S0ix residency on corporate systems
    - net: allow skb_datagram_iter to be called from any context
    - wifi: wilc1000: fix ies_len type in connect path
    - riscv: kexec: Avoid deadlock in kexec crash path
    - netfilter: nf_tables: unconditionally flush pending work before notifier
    - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
    - selftests: fix OOM in msg_zerocopy selftest
    - selftests: make order checking verbose in msg_zerocopy selftest
    - inet_diag: Initialize pad field in struct inet_diag_req_v2
    - gpiolib: of: factor out code overriding gpio line polarity
    - gpiolib: of: add a quirk for reset line polarity for Himax LCDs
    - gpiolib: of: add polarity quirk for TSC2005
    - Revert "igc: fix a log entry using uninitialized netdev"
    - nilfs2: fix inode number range checks
    - nilfs2: add missing check for inode numbers on directory entries
    - mm: optimize the redundant loop of mm_update_owner_next()
    - mm: avoid overflows in dirty throttling logic
    - btrfs: fix adding block group to a reclaim list and the unused list during
      reclaim
    - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
    - can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct
    - fsnotify: Do not generate events for O_PATH file descriptors
    - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(),
      again"
    - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
    - drm/amdgpu/atomfirmware: silence UBSAN warning
    - mtd: rawnand: Ensure ECC configuration is propagated to upper layers
    - mtd: rawnand: Bypass a couple of sanity checks during NAND identification
    - mtd: rawnand: rockchip: ensure NVDDR timings are rejected
    - ima: Avoid blocking in RCU read-side critical section
    - media: dw2102: fix a potential buffer overflow
    - clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents
    - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
    - fs/ntfs3: Mark volume as dirty if xattr is broken
    - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
    - nvme-multipath: find NUMA path only for online numa-node
    - dma-mapping: benchmark: avoid needless copy_to_user if benchmark fails
    - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset
    - regmap-i2c: Subtract reg size from max_write
    - platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW 11.6"
      tablet
    - platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro
    - nvmet: fix a possible leak when destroy a ctrl during qp establishment
    - kbuild: fix short log for AS in link-vmlinux.sh
    - nfc/nci: Add the inconsistency check between the input data length and count
    - null_blk: Do not allow runt zone with zone capacity smaller then zone size
    - nilfs2: fix incorrect inode allocation from reserved inodes
    - mm: prevent derefencing NULL ptr in pfn_section_valid()
    - filelock: fix potential use-after-free in posix_lock_inode
    - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
    - vfs: don't mod negative dentry count when on shrinker list
    - tcp: fix incorrect undo caused by DSACK of TLP retransmit
    - skmsg: Skip zero length skb in sk_msg_recvmsg
    - octeontx2-af: Fix incorrect value output on error path in
      rvu_check_rsrc_availability()
    - net: fix rc7's __skb_datagram_iter()
    - i40e: Fix XDP program unloading while removing the driver
    - net: lantiq_etop: add blank line after declaration
    - net: ethernet: lantiq_etop: fix double free in detach
    - net: ethernet: mtk-star-emac: set mac_managed_pm when probing
    - ppp: reject claimed-as-LCP but actually malformed packets
    - ethtool: netlink: do not return SQI value if link is down
    - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
    - s390: Mark psw in __load_psw_mask() as __unitialized
    - ARM: davinci: Convert comma to semicolon
    - octeontx2-af: replace cpt slot with lf id on reg write
    - octeontx2-af: update cpt lf alloc mailbox
    - octeontx2-af: fix a issue with cpt_lf_alloc mailbox
    - octeontx2-af: fix detection of IP layer
    - octeontx2-af: extend RSS supported offload types
    - octeontx2-af: fix issue with IPv6 ext match for RSS
    - octeontx2-af: fix issue with IPv4 match for RSS
    - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
    - tcp: avoid too many retransmit packets
    - net: ks8851: Fix potential TX stall after interface reopen
    - USB: serial: option: add Telit generic core-dump composition
    - USB: serial: option: add Telit FN912 rmnet compositions
    - USB: serial: option: add Fibocom FM350-GL
    - USB: serial: option: add support for Foxconn T99W651
    - USB: serial: option: add Netprisma LCUK54 series modules
    - USB: serial: option: add Rolling RW350-GL variants
    - USB: serial: mos7840: fix crash on resume
    - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
    - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
    - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the
      descriptor
    - hpet: Support 32-bit userspace
    - nvmem: rmem: Fix return value of rmem_read()
    - nvmem: meson-efuse: Fix return value of nvmem callbacks
    - nvmem: core: only change name to fram for current attribute
    - ALSA: hda/realtek: add quirk for Clevo V5[46]0TU
    - ALSA: hda/realtek: Enable Mute LED on HP 250 G7
    - ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
    - Fix userfaultfd_api to return EINVAL as expected
    - libceph: fix race between delayed_work() and ceph_monc_stop()
    - wireguard: allowedips: avoid unaligned 64-bit memory accesses
    - wireguard: queueing: annotate intentional data race in cpu round robin
    - wireguard: send: annotate intentional data race in checking empty queue
    - ipv6: annotate data-races around cnf.disable_ipv6
    - bpf: Allow reads from uninit stack
    - nilfs2: fix kernel bug on rename operation of broken directory
    - i2c: rcar: bring hardware to known state when probing
    - i2c: mark HostNotify target address as used
    - i2c: rcar: Add R-Car Gen4 support
    - i2c: rcar: reset controller is mandatory for Gen3+
    - i2c: rcar: introduce Gen4 devices
    - i2c: rcar: ensure Gen3+ reset does not disturb local targets
    - i2c: testunit: avoid re-issued work after read message
    - i2c: rcar: clear NO_RXDMA flag after resetting
    - x86/entry/64: Remove obsolete comment on tracing vs. SYSRET
    - x86/bhi: Avoid warning in #DB handler due to BHI mitigation
    - kbuild: Make ld-version.sh more robust against version string changes
    - i2c: rcar: fix error code in probe()
    - Linux 5.15.163

  * [SRU] UBSAN warnings in bnx2x kernel driver (LP: #2074215) // Jammy update:
    v5.15.163 upstream stable release (LP: #2075170)
    - bnx2x: Fix multiple UBSAN array-index-out-of-bounds

  * Jammy update: v5.15.162 upstream stable release (LP: #2073765)
    - mmc: davinci_mmc: Convert to platform remove callback returning void
    - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
    - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
    - wifi: cfg80211: Lock wiphy in cfg80211_get_station
    - wifi: cfg80211: pmsr: use correct nla_get_uX functions
    - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
    - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
    - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
    - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
    - wifi: mac80211: correctly parse Spatial Reuse Parameter Set element
    - net/ncsi: Simplify Kconfig/dts control flow
    - net/ncsi: Fix the multi thread manner of NCSI driver
    - ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
    - bpf: Set run context for rawtp test_run callback
    - octeontx2-af: Always allocate PF entries from low prioriy zone
    - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
    - vxlan: Fix regression when dropping packets due to invalid src addresses
    - tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB
    - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
    - ptp: Fix error message on failed pin verification
    - af_unix: Set sk->sk_state under unix_state_lock() for truly disconencted
      peer.
    - af_unix: Annodate data-races around sk->sk_state for writers.
    - af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
    - af_unix: Annotate data-races around sk->sk_state in unix_write_space() and
      poll().
    - net: inline sock_prot_inuse_add()
    - net: drop nopreempt requirement on sock_prot_inuse_add()
    - af_unix: Annotate data-race of sk->sk_state in unix_stream_connect().
    - af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg().
    - af_unix: Annotate data-race of sk->sk_state in unix_stream_read_skb().
    - af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG.
    - af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen.
    - af_unix: Use unix_recvq_full_lockless() in unix_stream_connect().
    - af_unix: annotate lockless accesses to sk->sk_err
    - af_unix: Use skb_queue_empty_lockless() in unix_release_sock().
    - af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen().
    - af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
    - ipv6: fix possible race in __fib6_drop_pcpu_from()
    - usb: gadget: f_fs: use io_data->status consistently
    - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
    - iio: accel: mxc4005: Reset chip on probe() and resume()
    - drm/amd/display: Handle Y carry-over in VCP X.Y calculation
    - drm/amd/display: Clean up some inconsistent indenting
    - drm/amd/display: drop unnecessary NULL checks in debugfs
    - drm/amd/display: Fix incorrect DSC instance for MST
    - pvpanic: Keep single style across modules
    - pvpanic: Indentation fixes here and there
    - misc/pvpanic: deduplicate common code
    - misc/pvpanic-pci: register attributes via pci_driver
    - skbuff: introduce skb_pull_data
    - Bluetooth: hci_qca: mark OF related data as maybe unused
    - Bluetooth: btqca: use le32_to_cpu for ver.soc_id
    - Bluetooth: btqca: Add WCN3988 support
    - Bluetooth: qca: use switch case for soc type behavior
    - Bluetooth: qca: add support for QCA2066
    - Bluetooth: qca: fix info leak when fetching fw build id
    - serial: sc16is7xx: replace hardcoded divisor value with BIT() macro
    - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
    - x86/ibt,ftrace: Search for __fentry__ location
    - ftrace: Fix possible use-after-free issue in ftrace_location()
    - i2c: add fwnode APIs
    - i2c: acpi: Unbind mux adapters before delete
    - cma: factor out minimum alignment requirement
    - mm/cma: drop incorrect alignment check in cma_init_reserved_mem
    - selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages
    - selftests/mm: conform test to TAP format output
    - selftests/mm: compaction_test: fix bogus test success on Aarch64
    - wifi: ath10k: fix QCOM_RPROC_COMMON dependency
    - btrfs: fix leak of qgroup extent records after transaction abort
    - nilfs2: Remove check for PageError
    - nilfs2: return the mapped address from nilfs_get_page()
    - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
    - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
    - usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state
    - mei: me: release irq in mei_me_pci_resume error path
    - jfs: xattr: fix buffer overflow for invalid xattr
    - xhci: Set correct transferred length for cancelled bulk transfers
    - xhci: Apply reset resume quirk to Etron EJ188 xHCI host
    - xhci: Handle TD clearing for multiple streams case
    - xhci: Apply broken streams quirk to Etron EJ188 xHCI host
    - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
    - powerpc/uaccess: Fix build errors seen with GCC 13/14
    - Input: try trimming too long modalias strings
    - clk: sifive: Do not register clkdevs for PRCI clocks
    - SUNRPC: return proper error from gss_wrap_req_priv
    - platform/x86: dell-smbios-base: Use sysfs_emit()
    - platform/x86: dell-smbios: Fix wrong token data in sysfs
    - gpio: tqmx86: fix typo in Kconfig label
    - gpio: tqmx86: store IRQ trigger type and unmask status separately
    - HID: core: remove unnecessary WARN_ON() in implement()
    - iommu/amd: Introduce pci segment structure
    - iommu/amd: Fix sysfs leak in iommu init
    - iommu: Return right value in iommu_sva_bind_device()
    - HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
    - drm/vmwgfx: 3D disabled should not effect STDU memory limits
    - net: sfp: Always call `sfp_sm_mod_remove()` on remove
    - net: hns3: fix kernel crash problem in concurrent scenario
    - net: hns3: add cond_resched() to hns3 ring buffer init process
    - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
    - drm/komeda: check for error-valued pointer
    - drm/bridge/panel: Fix runtime warning on panel bridge release
    - tcp: fix race in tcp_v6_syn_recv_sock()
    - net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN)
      packets
    - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set
      type
    - net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs
      parameters
    - net/ipv6: Fix the RT cache flush via sysctl using a previous delay
    - ionic: fix use after netif_napi_del()
    - af_unix: Read with MSG_PEEK loops if the first unread byte is OOB
    - iio: adc: ad9467: fix scan type sign
    - iio: dac: ad5592r: fix temperature channel scaling value
    - iio: imu: inv_icm42600: delete unneeded update watermark call
    - drivers: core: synchronize really_probe() and dev_uevent()
    - drm/exynos/vidi: fix memory leak in .get_modes()
    - drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
    - mptcp: ensure snd_una is properly initialized on connect
    - tracing/selftests: Fix kprobe event name test for .isra. functions
    - null_blk: Print correct max open zones limit in null_init_zoned_dev()
    - sock_map: avoid race between sock_map_close and sk_psock_put
    - vmci: prevent speculation leaks by sanitizing event in event_deliver()
    - spmi: hisi-spmi-controller: Do not override device identifier
    - knfsd: LOOKUP can return an illegal error value
    - fs/proc: fix softlockup in __read_vmcore
    - ocfs2: use coarse time for new created files
    - ocfs2: fix races between hole punching and AIO+DIO
    - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
    - dmaengine: axi-dmac: fix possible race in remove()
    - intel_th: pci: Add Granite Rapids support
    - intel_th: pci: Add Granite Rapids SOC support
    - intel_th: pci: Add Sapphire Rapids SOC support
    - intel_th: pci: Add Meteor Lake-S support
    - intel_th: pci: Add Lunar Lake support
    - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
    - tick/nohz_full: Don't abuse smp_call_function_single() in
      tick_setup_device()
    - scsi: mpi3mr: Fix ATA NCQ priority support
    - mm/huge_memory: don't unpoison huge_zero_folio
    - serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level
    - hugetlb_encode.h: fix undefined behaviour (34 << 26)
    - mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID
    - mptcp: pm: update add_addr counters after connect
    - kbuild: Remove support for Clang's ThinLTO caching
    - greybus: Fix use-after-free bug in gb_interface_release due to race
      condition.
    - usb-storage: alauda: Check whether the media is initialized
    - i2c: at91: Fix the functionality flags of the slave-only interface
    - i2c: designware: Fix the functionality flags of the slave-only interface
    - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
    - Bluetooth: qca: Fix error code in qca_read_fw_build_info()
    - Bluetooth: qca: fix info leak when fetching board id
    - padata: Disable BH when taking works lock on MT path
    - crypto: hisilicon/sec - Fix memory leak for sec resource release
    - rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
    - rcutorture: Make stall-tasks directly exit when rcutorture tests end
    - rcutorture: Fix invalid context warning when enable srcu barrier testing
    - block/ioctl: prefer different overflow check
    - selftests/bpf: Prevent client connect before server bind in
      test_tc_tunnel.sh
    - selftests/bpf: Fix flaky test btf_map_in_map/lookup_update
    - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
    - wifi: ath9k: work around memset overflow warning
    - af_packet: avoid a false positive warning in packet_setsockopt()
    - drop_monitor: replace spin_lock by raw_spin_lock
    - scsi: qedi: Fix crash while reading debugfs attribute
    - kselftest: arm64: Add a null pointer check
    - netpoll: Fix race condition in netpoll_owner_active
    - HID: Add quirk for Logitech Casa touchpad
    - ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
    - Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
    - drm/amd/display: Exit idle optimizations before HDCP execution
    - drm/lima: add mask irq callback to gp and pp
    - drm/lima: mask irqs in timeout path before hard reset
    - powerpc/pseries: Enforce hcall result buffer validity and size
    - powerpc/io: Avoid clang null pointer arithmetic warnings
    - power: supply: cros_usbpd: provide ID table for avoiding fallback match
    - iommu/arm-smmu-v3: Free MSIs in case of ENOMEM
    - f2fs: remove clear SB_INLINECRYPT flag in default_options
    - usb: misc: uss720: check for incompatible versions of the Belkin F5U002
    - Avoid hw_desc array overrun in dw-axi-dmac
    - udf: udftime: prevent overflow in udf_disk_stamp_to_time()
    - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
    - MIPS: Octeon: Add PCIe link status check
    - serial: imx: Introduce timeout when waiting on transmitter empty
    - serial: exar: adding missing CTI and Exar PCI ids
    - MIPS: Routerboard 532: Fix vendor retry check code
    - mips: bmips: BCM6358: make sure CBR is correctly set
    - tracing: Build event generation tests only as modules
    - cipso: fix total option length computation
    - netrom: Fix a memory leak in nr_heartbeat_expiry()
    - ipv6: prevent possible NULL deref in fib6_nh_init()
    - ipv6: prevent possible NULL dereference in rt6_probe()
    - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
    - netns: Make get_net_ns() handle zero refcount net
    - qca_spi: Make interrupt remembering atomic
    - net/sched: act_api: rely on rcu in tcf_idr_check_alloc
    - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
    - tipc: force a dst refcount before doing decryption
    - net/sched: act_ct: set 'net' pointer when creating new nf_flow_table
    - sched: act_ct: add netns into the key of tcf_ct_flow_table
    - ptp: fix integer overflow in max_vclocks_store
    - net: stmmac: No need to calculate speed divider when offload is disabled
    - virtio_net: checksum offloading handling fix
    - octeontx2-pf: Add error handling to VLAN unoffload handling
    - netfilter: ipset: Fix suspicious rcu_dereference_protected()
    - seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6
      behaviors
    - bnxt_en: Restore PTP tx_avail count in case of skb_pad() error
    - net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
    - regulator: core: Fix modpost error "regulator_get_regmap" undefined
    - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
    - dmaengine: ioat: switch from 'pci_' to 'dma_' API
    - dmaengine: ioat: Drop redundant pci_enable_pcie_error_reporting()
    - dmaengine: ioatdma: Fix leaking on version mismatch
    - dmaengine: ioat: use PCI core macros for PCIe Capability
    - dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
    - dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
    - dmaengine: ioatdma: Fix missing kmem_cache_destroy()
    - regulator: bd71815: fix ramp values
    - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is
      fine."
    - RDMA/mlx5: Add check for srq max_sge attribute
    - serial: stm32: rework RX over DMA
    - net: do not leave a dangling sk pointer, when socket creation fails
    - btrfs: retry block group reclaim without infinite loop
    - KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes
    - ALSA: hda/realtek: Limit mic boost on N14AP7
    - drm/i915/mso: using joiner is not possible with eDP MSO
    - drm/radeon: fix UBSAN warning in kv_dpm.c
    - gcov: add support for GCC 14
    - kcov: don't lose track of remote references during softirqs
    - tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack()
    - i2c: ocores: set IACK bit after core is enabled
    - dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller
      schema
    - arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc
    - drm/amd/display: revert Exit idle optimizations before HDCP execution
    - perf: script: add raw|disasm arguments to --insn-trace option
    - perf script: Show also errors for --insn-trace option
    - ARM: dts: samsung: smdkv310: fix keypad no-autorepeat
    - ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat
    - ARM: dts: samsung: smdk4412: fix keypad no-autorepeat
    - rtlwifi: rtl8192de: Style clean-ups
    - wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power
    - pmdomain: ti-sci: Fix duplicate PD referrals
    - bcache: fix variable length array abuse in btree_iter
    - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
    - x86/cpu/vfm: Add new macros to work with (vendor/family/model) values
    - x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
    - ksmbd: ignore trailing slashes in share paths
    - drm/i915/gt: Only kick the signal worker if there's been an update
    - drm/i915/gt: Disarm breadcrumbs if engines are already idle
    - Revert "kheaders: substituting --sort in archive creation"
    - kheaders: explicitly define file modes for archived headers
    - riscv: mm: init: try best to use IS_ENABLED(CONFIG_64BIT) instead of #ifdef
    - riscv: fix overlap of allocated page and PTR_ERR
    - perf/core: Fix missing wakeup when waiting for context reference
    - PCI: Add PCI_ERROR_RESPONSE and related definitions
    - x86/amd_nb: Check for invalid SMN reads
    - smb: client: fix deadlock in smb2_find_smb_tcon()
    - ACPI: x86: utils: Add Picasso to the list for forcing StorageD3Enable
    - ACPI: x86: Force StorageD3Enable on more products
    - gve: Add RX context.
    - gve: Clear napi->skb before dev_kfree_skb_any()
    - Input: ili210x - fix ili251x_read_touch_data() return value
    - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
    - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
    - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
    - pinctrl: rockchip: use dedicated pinctrl type for RK3328
    - pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
    - cifs: fix typo in module parameter enable_gcm_256
    - drm/amdgpu: fix UBSAN warning in kv_dpm.c
    - net: mdio: add helpers to extract clause 45 regad and devad fields
    - net: stmmac: Assign configured channel value to EXTTS event
    - ASoC: fsl-asoc-card: set priv->pdev before using it
    - net: dsa: microchip: fix initial port flush problem
    - ibmvnic: Free any outstanding tx skbs during scrq reset
    - net: phy: micrel: add Microchip KSZ 9477 to the device table
    - xdp: Remove WARN() from __xdp_reg_mem_model()
    - tcp: Use BPF timeout setting for SYN ACK RTO
    - Fix race for duplicate reqsk on identical SYN
    - sparc: fix old compat_sys_select()
    - sparc: fix compat recv/recvfrom syscalls
    - parisc: use correct compat recv/recvfrom syscalls
    - tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO
    - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data
      registers
    - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
    - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
    - vduse: validate block features only with block devices
    - vduse: Temporarily fail if control queue feature requested
    - x86/fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup
    - mtd: partitions: redboot: Added conversion of operands to a larger type
    - bpf: Add a check for struct bpf_fib_lookup size
    - RDMA/restrack: Fix potential invalid address access
    - net/iucv: Avoid explicit cpumask var allocation on stack
    - net/dpaa2: Avoid explicit cpumask var allocation on stack
    - crypto: ecdh - explicitly zeroize private_key
    - ALSA: emux: improve patch ioctl data validation
    - media: dvbdev: Initialize sbuf
    - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
    - drm/radeon/radeon_display: Decrease the size of allocated memory
    - nvme: fixup comment for nvme RDMA Provider Type
    - drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
    - gpio: davinci: Validate the obtained number of IRQs
    - gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
    - x86: stop playing stack games in profile_pc()
    - parisc: use generic sys_fanotify_mark implementation
    - ocfs2: fix DIO failure due to insufficient transaction credits
    - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
    - mmc: sdhci: Do not invert write-protect twice
    - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
    - i2c: testunit: don't erase registers after STOP
    - i2c: testunit: discard write requests while old command is running
    - iio: adc: ad7266: Fix variable checking bug
    - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
    - iio: chemical: bme680: Fix pressure value output
    - iio: chemical: bme680: Fix calibration data variable
    - iio: chemical: bme680: Fix overflows in compensate() functions
    - iio: chemical: bme680: Fix sensor data read operation
    - net: usb: ax88179_178a: improve link status logs
    - usb: gadget: printer: SS+ support
    - usb: gadget: printer: fix races against disable
    - usb: musb: da8xx: fix a resource leak in probe()
    - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
    - usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to
      avoid deadlock
    - serial: 8250_omap: Implementation of Errata i2310
    - tty: mcf: MCF54418 has 10 UARTS
    - net: can: j1939: Initialize unused data in j1939_send_one()
    - net: can: j1939: recover socket queue on CAN bus error during BAM
      transmission
    - net: can: j1939: enhanced error handling for tightly received RTS messages
      in xtp_rx_rts_session_new
    - cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked()
    - kbuild: Install dtb files as 0644 in Makefile.dtbinst
    - sh: rework sync_file_range ABI
    - csky, hexagon: fix broken sys_sync_file_range
    - hexagon: fix fadvise64_64 calling conventions
    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
    - drm/amdgpu: avoid using null object of framebuffer
    - drm/i915/gt: Fix potential UAF by revoke of fence registers
    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
    - batman-adv: Don't accept TT entries for out-of-spec VIDs
    - ata: ahci: Clean up sysfs file on error
    - ata: libata-core: Fix double free on error
    - ftruncate: pass a signed offset
    - syscalls: fix compat_sys_io_pgetevents_time64 usage
    - syscalls: fix sys_fanotify_mark prototype
    - pwm: stm32: Refuse too small period requests
    - nfs: Leave pages in the pagecache if readpage failed
    - drivers: fix typo in firmware/efi/memmap.c
    - efi: Correct comment on efi_memmap_alloc
    - efi: memmap: Move manipulation routines into x86 arch tree
    - efi: xen: Set EFI_PARAVIRT for Xen dom0 boot on all architectures
    - efi/x86: Free EFI memory map only when installing a new one.
    - KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption
    - ARM: dts: rockchip: rk3066a: add #sound-dai-cells to hdmi node
    - arm64: dts: rockchip: fix PMIC interrupt pin on ROCK Pi E
    - arm64: dts: rockchip: Add sound-dai-cells for RK3368
    - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
    - tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()
    - Linux 5.15.162

  * Fix L2CAP/LE/CPU/BI-02-C bluetooth certification failure  (LP: #2072858) //
    Jammy update: v5.15.162 upstream stable release (LP: #2073765)
    - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ

  * net/sched: Fix conntrack use-after-free (LP: #2073092)
    - net/sched: Fix UAF when resolving a clash

  * Jammy update: v5.15.161 upstream stable release (LP: #2072617)
    - x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
    - tty: n_gsm: fix missing receive state reset after mode switch
    - speakup: Fix sizeof() vs ARRAY_SIZE() bug
    - serial: 8250_bcm7271: use default_mux_rate if possible
    - Revert "r8169: don't try to disable interrupts if NAPI is, scheduled
      already"
    - r8169: Fix possible ring buffer corruption on fragmented Tx packets.
    - ring-buffer: Fix a race between readers and resize checks
    - tools/latency-collector: Fix -Wformat-security compile warns
    - net: smc91x: Fix m68k kernel compilation for ColdFire CPU
    - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
    - nilfs2: fix potential hang in nilfs_detach_log_writer()
    - fs/ntfs3: Remove max link count info display during driver init
    - fs/ntfs3: Taking DOS names into account during link counting
    - fs/ntfs3: Fix case when index is reused during tree transformation
    - fs/ntfs3: Break dir enumeration if directory contents error
    - ALSA: core: Fix NULL module pointer assignment at card init
    - wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt
      class
    - dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node
    - net: usb: qmi_wwan: add Telit FN920C04 compositions
    - drm/amd/display: Set color_mgmt_changed to true on unsuspend
    - selftests: sud_test: return correct emulated syscall value on RISC-V
    - regulator: irq_helpers: duplicate IRQ name
    - ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
    - ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
    - regulator: vqmmc-ipq4019: fix module autoloading
    - ASoC: rt715: add vendor clear control register
    - ASoC: rt715-sdca: volume step modification
    - softirq: Fix suspicious RCU usage in __do_softirq()
    - ASoC: da7219-aad: fix usage of device_get_named_child_node()
    - drm/amdkfd: Flush the process wq before creating a kfd_process
    - x86/mm: Remove broken vsyscall emulation code from the page fault code
    - nvme: find numa distance only if controller has valid numa id
    - epoll: be better about file lifetimes
    - openpromfs: finish conversion to the new mount API
    - crypto: bcm - Fix pointer arithmetic
    - mm/slub, kunit: Use inverted data to corrupt kmem cache
    - firmware: raspberrypi: Use correct device for DMA mappings
    - ecryptfs: Fix buffer size for tag 66 packet
    - nilfs2: fix out-of-range warning
    - parisc: add missing export of __cmpxchg_u8()
    - crypto: ccp - drop platform ifdef checks
    - crypto: x86/nh-avx2 - add missing vzeroupper
    - crypto: x86/sha256-avx2 - add missing vzeroupper
    - crypto: x86/sha512-avx2 - add missing vzeroupper
    - s390/cio: fix tracepoint subchannel type field
    - jffs2: prevent xattr node from overflowing the eraseblock
    - soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE
    - null_blk: Fix missing mutex_destroy() at module removal
    - md: fix resync softlockup when bitmap size is less than array size
    - wifi: ath10k: poll service ready message before failing
    - x86/boot: Ignore relocations in .notes sections in walk_relocs() too
    - sched/fair: Add EAS checks before updating root_domain::overutilized
    - qed: avoid truncating work queue length
    - bpf: Pack struct bpf_fib_lookup
    - scsi: ufs: qcom: Perform read back after writing reset bit
    - scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
    - scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0
    - scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5
    - scsi: ufs: qcom: Perform read back after writing unipro mode
    - scsi: ufs: qcom: Perform read back after writing CGC enable
    - scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
    - scsi: ufs: core: Perform read back after disabling interrupts
    - scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
    - irqchip/alpine-msi: Fix off-by-one in allocation error path
    - irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
    - ACPI: disable -Wstringop-truncation
    - gfs2: Don't forget to complete delayed withdraw
    - gfs2: Fix "ignore unlock failures after withdraw"
    - selftests/bpf: Fix umount cgroup2 error in test_sockmap
    - cpufreq: Reorganize checks in cpufreq_offline()
    - cpufreq: Split cpufreq_offline()
    - cpufreq: Rearrange locking in cpufreq_remove_dev()
    - cpufreq: exit() callback is optional
    - net: export inet_lookup_reuseport and inet6_lookup_reuseport
    - net: remove duplicate reuseport_lookup functions
    - udp: Avoid call to compute_score on multiple sites
    - cppc_cpufreq: Fix possible null pointer dereference
    - scsi: libsas: Fix the failure of adding phy with zero-address to port
    - scsi: hpsa: Fix allocation size for Scsi_Host private data
    - x86/purgatory: Switch to the position-independent small code model
    - thermal/drivers/tsens: Fix null pointer dereference
    - wifi: ath10k: Fix an error code problem in
      ath10k_dbg_sta_write_peer_debug_trigger()
    - wifi: ath10k: populate board data for WCN3990
    - net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset
      handlers
    - net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family
      switches
    - tcp: avoid premature drops in tcp_add_backlog()
    - pwm: sti: Convert to platform remove callback returning void
    - pwm: sti: Prepare removing pwm_chip from driver data
    - pwm: sti: Simplify probe function using devm functions
    - net: give more chances to rcu in netdev_wait_allrefs_any()
    - macintosh/via-macii: Fix "BUG: sleeping function called from invalid
      context"
    - wifi: carl9170: add a proper sanity check for endpoints
    - wifi: ar5523: enable proper endpoint verification
    - sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
    - Revert "sh: Handle calling csum_partial with misaligned data"
    - selftests/binderfs: use the Makefile's rules, not Make's implicit rules
    - selftests/resctrl: fix clang build failure: use LOCAL_HDRS
    - HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
    - scsi: bfa: Ensure the copied buf is NUL terminated
    - scsi: qedf: Ensure the copied buf is NUL terminated
    - scsi: qla2xxx: Fix debugfs output for fw_resource_count
    - wifi: mwl8k: initialize cmd->addr[] properly
    - usb: aqc111: stop lying about skb->truesize
    - net: usb: sr9700: stop lying about skb->truesize
    - m68k: Fix spinlock race in kernel thread creation
    - m68k: mac: Fix reboot hang on Mac IIci
    - net: ipv6: fix wrong start position when receive hop-by-hop fragment
    - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
    - net: ethernet: cortina: Locking fixes
    - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
    - net: usb: smsc95xx: stop lying about skb->truesize
    - net: openvswitch: fix overwriting ct original tuple for ICMPv6
    - ipv6: sr: add missing seg6_local_exit
    - ipv6: sr: fix incorrect unregister order
    - ipv6: sr: fix invalid unregister error path
    - net/mlx5: Discard command completions in internal error
    - s390/bpf: Emit a barrier for BPF_FETCH instructions
    - mptcp: SO_KEEPALIVE: fix getsockopt support
    - printk: Let no_printk() use _printk()
    - dev_printk: Add and use dev_no_printk()
    - drm/amd/display: Fix potential index out of bounds in color transformation
      function
    - ASoC: Intel: Disable route checks for Skylake boards
    - mtd: core: Report error if first mtd_otp_size() call fails in
      mtd_otp_nvmem_add()
    - mtd: rawnand: hynix: fixed typo
    - fbdev: shmobile: fix snprintf truncation
    - ASoC: kirkwood: Fix potential NULL dereference
    - drm/meson: vclk: fix calculation of 59.94 fractional rates
    - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
    - powerpc/fsl-soc: hide unused const variable
    - fbdev: sisfb: hide unused variables
    - media: ngene: Add dvb_ca_en50221_init return value check
    - media: radio-shark2: Avoid led_names truncations
    - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
    - media: ipu3-cio2: Use temporary storage for struct device pointer
    - media: ipu3-cio2: Request IRQ earlier
    - media: dt-bindings: ovti,ov2680: Fix the power supply names
    - fbdev: sh7760fb: allow modular build
    - media: atomisp: ssh_css: Fix a null-pointer dereference in
      load_video_binaries
    - drm/arm/malidp: fix a possible null pointer dereference
    - drm: vc4: Fix possible null pointer dereference
    - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
    - drm/bridge: lt8912b: Don't log an error when DSI host can't be found
    - drm/bridge: lt9611: Don't log an error when DSI host can't be found
    - drm/bridge: tc358775: Don't log an error when DSI host can't be found
    - drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
    - drm/mipi-dsi: use correct return type for the DSC functions
    - RDMA/mlx5: Adding remote atomic access flag to updatable flags
    - RDMA/hns: Fix return value in hns_roce_map_mr_sg
    - RDMA/hns: Fix deadlock on SRQ async events.
    - RDMA/hns: Fix GMV table pagesize
    - RDMA/hns: Use complete parentheses in macros
    - RDMA/hns: Modify the print level of CQE error
    - clk: qcom: mmcc-msm8998: fix venus clock issue
    - x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
    - ext4: avoid excessive credit estimate in ext4_tmpfile()
    - virt: acrn: Prefer array_size and struct_size over open coded arithmetic
    - virt: acrn: stop using follow_pfn
    - drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
    - sunrpc: removed redundant procp check
    - ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple
    - ext4: fix unit mismatch in ext4_mb_new_blocks_simple
    - ext4: try all groups in ext4_mb_new_blocks_simple
    - ext4: remove unused parameter from ext4_mb_new_blocks_simple()
    - ext4: fix potential unnitialized variable
    - SUNRPC: Fix gss_free_in_token_pages()
    - selftests/kcmp: Make the test output consistent and clear
    - selftests/kcmp: remove unused open mode
    - RDMA/IPoIB: Fix format truncation compilation errors
    - selftests: net: bridge: increase IGMP/MLD exclude timeout membership
      interval
    - net: qrtr: ns: Fix module refcnt
    - netrom: fix possible dead-lock in nr_rt_ioctl()
    - af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
    - sched/fair: Allow disabling sched_balance_newidle with
      sched_relax_domain_level
    - sched/core: Fix incorrect initialization of the 'burst' parameter in
      cpu_max_write()
    - greybus: lights: check return of get_channel_from_mode
    - f2fs: Delete f2fs_copy_page() and replace with memcpy_page()
    - f2fs: fix to wait on page writeback in __clone_blkaddrs()
    - soundwire: cadence: fix invalid PDI offset
    - dmaengine: idma64: Add check for dma_set_max_seg_size
    - firmware: dmi-id: add a release callback function
    - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
    - serial: max3100: Update uart_driver_registered on driver removal
    - serial: max3100: Fix bitwise types
    - greybus: arche-ctrl: move device table to its right location
    - PCI: tegra194: Fix probe path for Endpoint mode
    - serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
    - dt-bindings: PCI: rcar-pci-host: Add optional regulators
    - dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties
    - f2fs: compress: fix to relocate check condition in
      f2fs_{release,reserve}_compress_blocks()
    - f2fs: convert to use sbi directly
    - f2fs: compress: fix to relocate check condition in
      f2fs_ioc_{,de}compress_file()
    - f2fs: do not allow partial truncation on pinned file
    - f2fs: fix typos in comments
    - f2fs: fix to relocate check condition in f2fs_fallocate()
    - f2fs: fix to check pinfile flag in f2fs_move_file_range()
    - coresight: etm4x: Fix unbalanced pm_runtime_enable()
    - iio: pressure: dps310: support negative temperature values
    - coresight: etm4x: Do not hardcode IOMEM access for register restore
    - coresight: etm4x: Do not save/restore Data trace control registers
    - coresight: no-op refactor to make INSTP0 check more idiomatic
    - coresight: etm4x: Cleanup TRCIDR0 register accesses
    - coresight: etm4x: Safe access for TRCQCLTR
    - coresight: etm4x: Fix access to resource selector registers
    - fpga: region: Use standard dev_release for class driver
    - fpga: region: add owner module and take its refcount
    - microblaze: Remove gcc flag for non existing early_printk.c file
    - microblaze: Remove early printk call from cpuinfo-static.c
    - dt-bindings: pinctrl: mediatek: mt7622: fix array properties
    - watchdog: bd9576_wdt: switch to using devm_fwnode_gpiod_get()
    - watchdog: bd9576: Drop "always-running" property
    - usb: gadget: u_audio: Clear uac pointer when freed.
    - stm class: Fix a double free in stm_register_device()
    - ppdev: Remove usage of the deprecated ida_simple_xx() API
    - ppdev: Add an error check in register_device
    - extcon: max8997: select IRQ_DOMAIN instead of depending on it
    - PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
    - PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
    - f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem
      lock
    - f2fs: fix to release node block count in error path of f2fs_new_node_page()
    - f2fs: compress: don't allow unaligned truncation on released compress inode
    - serial: sh-sci: protect invalidating RXDMA on shutdown
    - libsubcmd: Fix parse-options memory leak
    - s390/vdso: filter out mno-pic-data-is-text-relative cflag
    - s390/vdso64: filter out munaligned-symbols flag for vdso
    - s390/vdso: Generate unwind information for C modules
    - s390/vdso: Use standard stack frame layout
    - s390/ipl: Fix incorrect initialization of len fields in nvme reipl block
    - s390/ipl: Fix incorrect initialization of nvme dump block
    - s390/boot: Remove alt_stfle_fac_list from decompressor
    - Input: ims-pcu - fix printf string overflow
    - Input: ioc3kbd - convert to platform remove callback returning void
    - Input: ioc3kbd - add device table
    - mmc: sdhci_am654: Add tuning algorithm for delay chain
    - mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
    - mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel
    - mmc: sdhci_am654: Add OTAP/ITAP delay enable
    - mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
    - mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
    - Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
    - drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk
    - drm/msm/dpu: Always flush the slave INTF on the CTL
    - um: Fix return value in ubd_init()
    - um: vector: fix bpfflash parameter evaluation
    - fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
    - fs/ntfs3: Use variable length array instead of fixed size
    - drm/bridge: tc358775: fix support for jeida-18 and jeida-24
    - media: stk1160: fix bounds checking in stk1160_copy_video()
    - scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
    - Input: cyapa - add missing input core locking to suspend/resume functions
    - media: flexcop-usb: clean up endpoint sanity checks
    - media: flexcop-usb: fix sanity check of bNumEndpoints
    - powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
    - um: Fix the -Wmissing-prototypes warning for __switch_mm
    - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
    - media: cec: cec-api: add locking in cec_release()
    - media: cec: call enable_adap on s_log_addrs
    - media: cec: abort if the current transmit was canceled
    - media: cec: correctly pass on reply results
    - media: cec: use call_op and check for !unregistered
    - media: cec-adap.c: drop activate_cnt, use state info instead
    - media: cec: core: avoid recursive cec_claim_log_addrs
    - media: cec: core: avoid confusing "transmit timed out" message
    - null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
    - ASoC: mediatek: mt8192: fix register configuration for tdm
    - regulator: bd71828: Don't overwrite runtime voltages
    - x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when
      UNWINDER_FRAME_POINTER=y
    - [Config] Update CONFIG_ARCH_WANT_FRAME_POINTERS
    - net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled
    - ipv6: sr: fix missing sk_buff release in seg6_input_core
    - nfc: nci: Fix uninit-value in nci_rx_work
    - ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
    - NFSv4: Fixup smatch warning for ambiguous return
    - sunrpc: fix NFSACL RPC retry on soft mount
    - rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
    - af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
    - ipv6: sr: fix memleak in seg6_hmac_init_algo
    - tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
    - openvswitch: Set the skbuff pkt_type for proper pmtud support.
    - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
    - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
    - riscv: stacktrace: Make walk_stackframe cross pt_regs frame
    - riscv: stacktrace: fixed walk_stackframe()
    - net: fec: avoid lock evasion when reading pps_enable
    - tls: fix missing memory barrier in tls_init
    - nfc: nci: Fix kcov check in nci_rx_work()
    - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
    - ice: Interpret .set_channels() input differently
    - netfilter: nfnetlink_queue: acquire rcu_read_lock() in
      instance_destroy_rcu()
    - netfilter: nft_payload: restore vlan q-in-q match support
    - spi: Don't mark message DMA mapped when no transfer in it is
    - dma-mapping: benchmark: fix node id validation
    - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
    - nvmet: fix ns enable/disable possible hang
    - net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061
    - net/mlx5e: Fix IPsec tunnel mode offload feature check
    - net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer
      exhaustion
    - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
    - bpf: Fix potential integer overflow in resolve_btfids
    - enic: Validate length of nl attributes in enic_set_vf_port
    - net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
    - bpf: Allow delete from sockmap/sockhash only if update is allowed
    - net:fec: Add fec_enet_deinit()
    - netfilter: nft_payload: move struct nft_payload_set definition where it
      belongs
    - netfilter: nft_payload: rebuild vlan header when needed
    - netfilter: nft_payload: rebuild vlan header on h_proto access
    - netfilter: nft_payload: skbuff vlan metadata mangle support
    - netfilter: tproxy: bail out if IP has been disabled on the device
    - kconfig: fix comparison to constant symbols, 'm', 'n'
    - spi: stm32: Don't warn about spurious interrupts
    - net: ena: Add capabilities field with support for ENI stats capability
    - net: ena: Extract recurring driver reset code into a function
    - net: ena: Do not waste napi skb cache
    - net: ena: Add dynamic recycling mechanism for rx buffers
    - net: ena: Reduce lines with longer column width boundary
    - net: ena: Fix redundant device NUMA node override
    - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
    - hwmon: (shtc1) Fix property misspelling
    - ALSA: timer: Set lower bound of start tick time
    - KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID
    - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
    - net: ena: Fix DMA syncing in XDP path when SWIOTLB is on
    - media: cec: core: add adap_nb_transmit_canceled() callback
    - SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
    - drm: Check output polling initialized before disabling
    - drm: Check polling initialized before enabling in
      drm_helper_probe_single_connector_modes
    - mmc: core: Do not force a retune before RPMB switch
    - io_uring: fail NOP if non-zero op flags is passed in
    - afs: Don't cross .backup mountpoint from backup volume
    - nilfs2: fix use-after-free of timer for log writer thread
    - mptcp: fix full TCP keep-alive support
    - vxlan: Fix regression when dropping packets due to invalid src addresses
    - net: dsa: sja1105: always enable the INCL_SRCPT option
    - net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT
    - scripts/gdb: fix SB_* constants parsing
    - sunrpc: exclude from freezer when waiting for requests:
    - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
    - media: lgdt3306a: Add a check against null-pointer-def
    - drm/amdgpu: add error handle to avoid out-of-bounds
    - ata: pata_legacy: make legacy_exit() work again
    - thermal/drivers/qcom/lmh: Check for SCM availability at probe
    - soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request
    - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
    - arm64: tegra: Correct Tegra132 I2C alias
    - arm64: dts: qcom: qcs404: fix bluetooth device address
    - md/raid5: fix deadlock that raid5d() wait for itself to clear
      MD_SB_CHANGE_PENDING
    - wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
    - wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE
    - wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path
    - arm64: dts: hi3798cv200: fix the size of GICR
    - media: mc: mark the media devnode as registered from the, start
    - media: mxl5xx: Move xpt structures off stack
    - media: v4l2-core: hold videodev_lock until dev reg, finishes
    - mmc: core: Add mmc_gpiod_set_cd_config() function
    - mmc: sdhci-acpi: Sort DMI quirks alphabetically
    - mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working
    - mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A
    - fbdev: savage: Handle err return when savagefb_check_var failed
    - drm/amdgpu/atomfirmware: add intergrated info v2.3 table
    - KVM: arm64: Fix AArch32 register narrowing on userspace write
    - KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
    - crypto: ecdsa - Fix module auto-load on add-key
    - crypto: ecrdsa - Fix module auto-load on add_key
    - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
    - net/ipv6: Fix route deleting failure when metric equals 0
    - net/9p: fix uninit-value in p9_client_rpc()
    - intel_th: pci: Add Meteor Lake-S CPU support
    - sparc64: Fix number of online CPUs
    - watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin
    - kdb: Fix buffer overflow during tab-complete
    - kdb: Use format-strings rather than '0' injection in kdb_read()
    - kdb: Fix console handling when editing and tab-completing commands
    - kdb: Merge identical case statements in kdb_read()
    - kdb: Use format-specifiers rather than memset() for padding in kdb_read()
    - net: fix __dst_negative_advice() race
    - sparc: move struct termio to asm/termios.h
    - ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow
    - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
    - s390/ap: Fix crash in AP internal function modify_bitmap()
    - s390/cpacf: Split and rework cpacf query functions
    - s390/cpacf: Make use of invalid opcode produce a link error
    - i3c: master: svc: fix invalidate IBI type and miss call client IBI handler
    - EDAC/igen6: Convert PCIBIOS_* return codes to errnos
    - nfs: fix undefined behavior in nfs_block_bits()
    - NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS
    - scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5
    - Linux 5.15.161

  * Virtualbox Guru meditation on VM start caused by kernel commit in v6.9-rc4
    (LP: #2073267)
    - SAUCE: Revert "randomize_kstack: Improve entropy diffusion"

  * CVE-2024-26921
    - inet: inet_defrag: prevent sk release while still in use

  * Jammy update: v5.15.162 upstream stable release (LP: #2073765) //
    CVE-2024-39484
    - mmc: davinci: Don't strip remove function when driver is builtin

  * CVE-2024-39292
    - um: Add winch to winch_handlers before registering winch IRQ

  * CVE-2024-36901
    - ipv6: prevent NULL dereference in ip6_output()

  * CVE-2024-26830
    - i40e: Do not allow untrusted VF to remove administratively set MAC

  * CVE-2024-26680
    - net: atlantic: Fix DMA mapping for PTP hwts ring

  * CVE-2023-52760
    - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc

  * CVE-2023-52629
    - sh: push-switch: Reorder cleanup operations to avoid use-after-free bug

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Fri, 02 Aug 2024 20:11:12 +0200

linux (5.15.0-118.128) jammy; urgency=medium

  * jammy/linux: 5.15.0-118.128 -proposed tracker (LP: #2072255)

  * Jammy update: v5.15.160 upstream stable release (LP: #2070292)
    - drm/amd/display: Fix division by zero in setup_dsc_config
    - pinctrl: core: handle radix_tree_insert() errors in
      pinctrl_register_one_pin()
    - nfsd: don't allow nfsd threads to be signalled.
    - KEYS: trusted: Fix memory leak in tpm2_key_encode()
    - Revert "selftests: mm: fix map_hugetlb failure on 64K page size systems"
    - net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
    - net: bcmgenet: synchronize UMAC_CMD access
    - netlink: annotate lockless accesses to nlk->max_recvmsg_len
    - netlink: annotate data-races around sk->sk_err
    - KVM: x86: Clear "has_error_code", not "error_code", for RM exception
      injection
    - drm/amdgpu: Fix possible NULL dereference in
      amdgpu_ras_query_error_status_helper()
    - binder: fix max_thread type inconsistency
    - usb: typec: ucsi: displayport: Fix potential deadlock
    - serial: kgdboc: Fix NMI-safety problems from keyboard reset code
    - remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
    - KEYS: trusted: Do not use WARN when encode fails
    - admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET
    - docs: kernel_include.py: Cope with docutils 0.21
    - Linux 5.15.160

  * Jammy update: v5.15.159 upstream stable release (LP: #2070028)
    - dmaengine: pl330: issue_pending waits until WFP state
    - dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
    - wifi: nl80211: don't free NULL coalescing rule
    - ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
    - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
    - ksmbd: clear RENAME_NOREPLACE before calling vfs_rename
    - eeprom: at24: Use dev_err_probe for nvmem register failure
    - eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
    - eeprom: at24: fix memory corruption race condition
    - pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
    - pinctrl/meson: fix typo in PDM's pin name
    - pinctrl: core: delete incorrect free in pinctrl_enable()
    - pinctrl: mediatek: paris: Rework mtk_pinconf_{get,set} switch/case logic
    - pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
    - pinctrl: mediatek: paris: Rework support for
      PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
    - sunrpc: add a struct rpc_stats arg to rpc_create_args
    - nfs: expose /proc/net/sunrpc/nfs in net namespaces
    - nfs: make the rpc_stat per net namespace
    - nfs: Handle error of rpc_proc_register() in nfs_net_init().
    - power: rt9455: hide unused rt9455_boost_voltage_values
    - power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
    - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
    - regulator: mt6360: De-capitalize devicetree regulator subnodes
    - bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
    - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
    - bpf: Fix a verifier verbose message
    - spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
    - s390/mm: Fix storage key clearing for guest huge pages
    - s390/mm: Fix clearing storage keys for huge pages
    - xdp: Move conversion to xdp_frame out of map functions
    - xdp: Add xdp_do_redirect_frame() for pre-computed xdp_frames
    - xdp: use flags field to disambiguate broadcast redirect
    - bna: ensure the copied buf is NUL terminated
    - octeontx2-af: avoid off-by-one read from userspace
    - nsh: Restore skb->{protocol,data,mac_header} for outer header in
      nsh_gso_segment().
    - net l2tp: drop flow hash on forward
    - s390/vdso: Add CFI for RA register to asm macro vdso_func
    - net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
    - net: qede: use return from qede_parse_flow_attr() for flower
    - net: qede: use return from qede_parse_flow_attr() for flow_spec
    - net: qede: use return from qede_parse_actions()
    - ASoC: meson: axg-fifo: use FIELD helpers
    - ASoC: meson: axg-fifo: use threaded irq to check periods
    - ASoC: meson: axg-card: make links nonatomic
    - ASoC: meson: axg-tdm-interface: manage formatters in trigger
    - ASoC: meson: cards: select SND_DYNAMIC_MINORS
    - ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
    - s390/cio: Ensure the copied buf is NUL terminated
    - cxgb4: Properly lock TX queue for the selftest.
    - net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
    - net: bridge: fix multicast-to-unicast with fraglist GSO
    - net: core: reject skb_copy(_expand) for fraglist GSO skbs
    - tipc: fix a possible memleak in tipc_buf_append
    - s390/qeth: don't keep track of Input Queue count
    - s390/qeth: Fix kernel panic after setting hsuid
    - drm/panel: ili9341: Respect deferred probe
    - drm/panel: ili9341: Use predefined error codes
    - net: gro: add flush check in udp_gro_receive_segment
    - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
    - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
    - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
    - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
    - scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
    - scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
    - gfs2: Fix invalid metadata access in punch_hole
    - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
    - wifi: cfg80211: fix rdev_dump_mpp() arguments order
    - net: mark racy access on sk->sk_rcvbuf
    - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
    - btrfs: return accurate error code on open failure in open_fs_devices()
    - kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
    - ALSA: line6: Zero-initialize message buffers
    - net: bcmgenet: Reset RBUF on first open
    - ata: sata_gemini: Check clk_enable() result
    - firewire: ohci: mask bus reset interrupts between ISR and bottom half
    - tools/power turbostat: Fix added raw MSR output
    - tools/power turbostat: Fix Bzy_MHz documentation typo
    - btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
    - btrfs: always clear PERTRANS metadata during commit
    - scsi: target: Fix SELinux error when systemd-modules loads the target module
    - blk-iocost: avoid out of bounds shift
    - gpu: host1x: Do not setup DMA for virtual devices
    - MIPS: scall: Save thread_info.syscall unconditionally on entry
    - selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
    - iommu: mtk: fix module autoloading
    - fs/9p: only translate RWX permissions for plain 9P2000
    - fs/9p: translate O_TRUNC into OTRUNC
    - 9p: explicitly deny setlease attempts
    - gpio: wcove: Use -ENOTSUPP consistently
    - gpio: crystalcove: Use -ENOTSUPP consistently
    - clk: Don't hold prepare_lock when calling kref_put()
    - fs/9p: drop inodes immediately on non-.L too
    - drm/nouveau/dp: Don't probe eDP ports twice harder
    - net:usb:qmi_wwan: support Rolling modules
    - bpf, sockmap: TCP data stall on recv before accept
    - bpf, sockmap: Handle fin correctly
    - bpf, sockmap: Convert schedule_work into delayed_work
    - bpf, sockmap: Reschedule is now done through backlog
    - bpf, sockmap: Improved check for empty queue
    - qibfs: fix dentry leak
    - xfrm: Preserve vlan tags for transport mode software GRO
    - ARM: 9381/1: kasan: clear stale stack poison
    - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
    - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
    - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
    - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
    - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
    - hwmon: (corsair-cpro) Use a separate buffer for sending commands
    - hwmon: (corsair-cpro) Use complete_all() instead of complete() in
      ccp_raw_event()
    - hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
    - phonet: fix rtm_phonet_notify() skb allocation
    - net: bridge: fix corrupted ethernet header on multicast-to-unicast
    - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
    - net: hns3: PF support get unicast MAC address space assigned by firmware
    - net: hns3: using user configure after hardware reset
    - net: hns3: add log for workqueue scheduled late
    - net: hns3: add query vf ring and vector map relation
    - net: hns3: refactor function hclge_mbx_handler()
    - net: hns3: direct return when receive a unknown mailbox message
    - net: hns3: refactor hns3 makefile to support hns3_common module
    - net: hns3: create new cmdq hardware description structure hclge_comm_hw
    - net: hns3: create new set of unified hclge_comm_cmd_send APIs
    - net: hns3: refactor hclge_cmd_send with new hclge_comm_cmd_send API
    - net: hns3: change type of numa_node_mask as nodemask_t
    - net: hns3: use appropriate barrier function after setting a bit value
    - net: hns3: split function hclge_init_vlan_config()
    - net: hns3: fix port vlan filter not disabled issue
    - drm/meson: dw-hdmi: power up phy on device init
    - drm/meson: dw-hdmi: add bandgap setting for g12
    - drm/connector: Add n to message about demoting connector force-probes
    - drm/amd/display: Atom Integrated System Info v2_2 for DCN35
    - Revert "Revert "ACPI: CPPC: Use access_width over bit_width for system
      memory accesses""
    - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
    - ACPI: CPPC: Fix access width used for PCC registers
    - btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()
    - firewire: nosy: ensure user_length is taken into account when fetching
      packet contents
    - Reapply "drm/qxl: simplify qxl_fence_wait"
    - arm64: dts: qcom: Fix 'interrupt-map' parent address cells
    - usb: typec: ucsi: Check for notifications after init
    - usb: typec: ucsi: Fix connector check on init
    - usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed
      device
    - usb: ohci: Prevent missed ohci interrupts
    - usb: gadget: composite: fix OS descriptors w_value logic
    - usb: gadget: f_fs: Fix a race condition when processing setup packets.
    - usb: xhci-plat: Don't include xhci.h
    - usb: dwc3: core: Prevent phy suspend during init
    - ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
    - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
    - mptcp: ensure snd_nxt is properly initialized on connect
    - dt-bindings: iio: health: maxim,max30102: fix compatible check
    - iio:imu: adis16475: Fix sync mode setting
    - iio: accel: mxc4005: Interrupt handling fixes
    - tipc: fix UAF in error path
    - net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
    - ASoC: tegra: Fix DSPK 16-bit playback
    - ASoC: ti: davinci-mcasp: Fix race condition during probe
    - dyndbg: fix old BUG_ON in >control parser
    - slimbus: qcom-ngd-ctrl: Add timeout for wait operation
    - mei: me: add lunar lake point M DID
    - drm/vmwgfx: Fix invalid reads in fence signaled events
    - net: fix out-of-bounds access in ops_init
    - hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
    - regulator: core: fix debugfs creation regression
    - Bluetooth: qca: add missing firmware sanity checks
    - Bluetooth: qca: fix NVM configuration parsing
    - Bluetooth: qca: fix firmware check error path
    - keys: Fix overwrite of key expiration on instantiation
    - md: fix kmemleak of rdev->serial
    - Linux 5.15.159

  * Freezing user space processes failed after 20.008 seconds (1 tasks refusing
    to freeze, wq_busy=0) (LP: #2061091)
    - ALSA: Fix deadlocks with kctl removals at disconnection

  * CVE-2024-27017
    - netfilter: nft_set_pipapo: constify lookup fn args where possible
    - netfilter: nft_set_pipapo: walk over current view on netlink dump
    - netfilter: nf_tables: missing iterator type in lookup walk

  * CVE-2024-26952
    - ksmbd: fix potencial out-of-bounds when buffer offset is invalid

  * CVE-2024-26886
    - Bluetooth: af_bluetooth: Fix deadlock

  * CVE-2023-52752
    - smb: client: fix use-after-free bug in cifs_debug_data_proc_show()

  * CVE-2024-25742
    - x86/sev: Harden #VC instruction emulation somewhat
    - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler

  * CVE-2024-36016
    - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 05 Jul 2024 10:53:52 +0200

linux (5.15.0-116.126) jammy; urgency=medium

  * jammy/linux: 5.15.0-116.126 -proposed tracker (LP: #2071603)

  * idxd: NULL pointer dereference reading wq op_config attribute (LP: #2069081)
    - SAUCE: dmaengine: idxd: set is_visible member of idxd_wq_attribute_group

  * AMD GPUs fail with null pointer dereference when IOMMU enabled, leading to
    black screen (LP: #2068738)
    - SAUCE: Revert "drm/amdgpu: init iommu after amdkfd device init"

 -- Stefan Bader <stefan.bader@canonical.com>  Mon, 01 Jul 2024 11:13:30 +0200

linux (5.15.0-115.125) jammy; urgency=medium

  * jammy/linux: 5.15.0-115.125 -proposed tracker (LP: #2068396)

  * Packaging resync (LP: #1786013)
    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
      (main/2024.06.10)

  * Jammy update: v5.15.158 upstream stable release (LP: #2067974)
    - smb: client: fix rename(2) regression against samba
    - cifs: reinstate original behavior again for forceuid/forcegid
    - HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc
    - HID: logitech-dj: allow mice to use all types of reports
    - arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 Puma
    - arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
    - arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
    - arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts
    - arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg
    - arm64: dts: mediatek: mt7622: add support for coherent DMA
    - arm64: dts: mediatek: mt7622: introduce nodes for Wireless Ethernet Dispatch
    - arm64: dts: mediatek: mt7622: fix clock controllers
    - arm64: dts: mediatek: mt7622: fix IR nodename
    - arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
    - arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
    - arm64: dts: mediatek: mt2712: fix validation errors
    - ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
    - wifi: iwlwifi: mvm: remove old PASN station when adding a new one
    - wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd
    - vxlan: drop packets from invalid src-address
    - mlxsw: core: Unregister EMAD trap using FORWARD action
    - icmp: prevent possible NULL dereferences from icmp_build_probe()
    - bridge/br_netlink.c: no need to return void function
    - NFC: trf7970a: disable all regulators on removal
    - ipv4: check for NULL idev in ip_route_use_hint()
    - net: usb: ax88179_178a: stop lying about skb->truesize
    - net: gtp: Fix Use-After-Free in gtp_dellink
    - ipvs: Fix checksumming on GSO of SCTP packets
    - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
    - mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
    - mlxsw: spectrum_acl_tcam: Rate limit error message
    - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
    - mlxsw: spectrum_acl_tcam: Fix warning during rehash
    - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
    - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
    - netfilter: nf_tables: honor table dormant flag from netdev release event
      path
    - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
    - i40e: Report MFS in decimal base instead of hex
    - iavf: Fix TC config comparison with existing adapter TC config
    - net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets
    - af_unix: Suppress false-positive lockdep splat for spin_lock() in
      __unix_gc().
    - serial: core: Provide port lock wrappers
    - serial: mxs-auart: add spinlock around changing cts state
    - drm-print: add drm_dbg_driver to improve namespace symmetry
    - drm/vmwgfx: Fix crtc's atomic check conditional
    - Revert "crypto: api - Disallow identical driver names"
    - net/mlx5e: Fix a race in command alloc flow
    - tracing: Show size of requested perf buffer
    - tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker
      together
    - x86/cpu: Fix check for RDPKRU in __show_regs()
    - Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
    - Bluetooth: qca: fix NULL-deref on non-serdev suspend
    - mmc: sdhci-msm: pervent access to suspended controller
    - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
    - cpu: Re-enable CPU mitigations by default for !X86 architectures
    - [Configs] Update CPU mitigation configs
    - arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
    - drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3
    - drm/amdgpu: Fix leak when GPU memory allocation fails
    - irqchip/gic-v3-its: Prevent double free on error
    - ethernet: Add helper for assigning packet type when dest address does not
      match device address
    - net: b44: set pause params only when interface is up
    - stackdepot: respect __GFP_NOLOCKDEP allocation flag
    - mtd: diskonchip: work around ubsan link failure
    - tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
    - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
    - dmaengine: owl: fix register access functions
    - idma64: Don't try to serve interrupts when device is powered off
    - dma: xilinx_dpdma: Fix locking
    - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
    - riscv: fix VMALLOC_START definition
    - riscv: Fix TASK_SIZE on 64-bit NOMMU
    - i2c: smbus: fix NULL function pointer dereference
    - fbdev: fix incorrect address computation in deferred IO
    - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
    - bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
    - udp: preserve the connected status if only UDP cmsg
    - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
    - Linux 5.15.158

  * Jammy update: v5.15.157 upstream stable release (LP: #2067959)
    - ksmbd: don't send oplock break if rename fails
    - ksmbd: validate payload size in ipc response
    - ksmbd: do not set SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1
    - btrfs: record delayed inode root in transaction
    - SUNRPC: Fix rpcgss_context trace event acceptor field
    - selftests/ftrace: Limit length in subsystem-enable tests
    - bpf: Extend kfunc with PTR_TO_CTX, PTR_TO_MEM argument support
    - bpf: Generalize check_ctx_reg for reuse with other types
    - bpf: Generally fix helper register offset check
    - bpf: Fix out of bounds access for ringbuf helpers
    - bpf: Fix ringbuf memory type confusion when passing to helpers
    - kprobes: Fix possible use-after-free issue on kprobe registration
    - Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
    - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
    - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
    - netfilter: br_netfilter: skip conntrack input hook for promisc packets
    - netfilter: nf_flow_table: count pending offload workqueue tasks
    - [Config] update configs to enable new NF_FLOW_TABLE_PROCFS
    - netfilter: flowtable: validate pppoe header
    - netfilter: flowtable: incorrect pppoe tuple
    - af_unix: Call manage_oob() for every skb in unix_stream_read_generic().
    - af_unix: Don't peek OOB data without MSG_OOB.
    - tun: limit printing rate when illegal packet received by tun dev
    - net: dsa: mt7530: fix mirroring frames received on local port
    - net: ethernet: ti: am65-cpsw-nuss: cleanup DMA Channels before using them
    - RDMA/rxe: Fix the problem "mutex_destroy missing"
    - RDMA/cm: Print the old state when cm_destroy_id gets timeout
    - RDMA/mlx5: Fix port number for counter query in multi-port configuration
    - s390/qdio: handle deferred cc1
    - s390/cio: fix race condition during online processing
    - drm: nv04: Fix out of bounds access
    - drm/panel: visionox-rm69299: don't unregister DSI device
    - clk: Remove prepare_lock hold assertion in __clk_release()
    - clk: Mark 'all_lists' as const
    - clk: remove extra empty line
    - clk: Print an info line before disabling unused clocks
    - clk: Initialize struct clk_core kref earlier
    - clk: Get runtime PM before walking tree during disable_unused
    - x86/bugs: Fix BHI retpoline check
    - x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
    - thunderbolt: Avoid notify PM core about runtime PM resume
    - thunderbolt: Fix wake configurations after device unplug
    - comedi: vmk80xx: fix incomplete endpoint checking
    - serial/pmac_zilog: Remove flawed mitigation for rx irq flood
    - USB: serial: option: add Fibocom FM135-GL variants
    - USB: serial: option: add support for Fibocom FM650/FG650
    - USB: serial: option: add Lonsung U8300/U9300 product
    - USB: serial: option: support Quectel EM060K sub-models
    - USB: serial: option: add Rolling RW101-GL and RW135-GL support
    - USB: serial: option: add Telit FN920C04 rmnet compositions
    - usb: dwc2: host: Fix dereference issue in DDMA completion flow.
    - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport
      error
    - mei: me: disable RPL-S on SPS and IGN firmwares
    - speakup: Avoid crash on very long word
    - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
    - KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible
    - KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms
    - arm64: hibernate: Fix level3 translation fault in swsusp_save()
    - init/main.c: Fix potential static_command_line memory overflow
    - drm/vmwgfx: Sort primary plane formats by order of preference
    - nouveau: fix instmem race condition around ptr stores
    - nilfs2: fix OOB in nilfs_set_de_type
    - net: dsa: mt7530: set all CPU ports in MT7531_CPU_PMAP
    - net: dsa: introduce preferred_default_local_cpu_port and use on MT7530
    - net: dsa: mt7530: fix improper frames on all 25MHz and 40MHz XTAL MT7530
    - net: dsa: mt7530: fix enabling EEE on MT7531 switch on all boards
    - Linux 5.15.157

  * [SRU][22.04.4]: megaraid_sas: Critical Bug Fixes (LP: #2046722)
    - scsi: megaraid_sas: Log message when controller reset is requested but not
      issued
    - scsi: megaraid_sas: Driver version update to 07.727.03.00-rc1

  * Jammy update: v5.15.156 upstream stable release (LP: #2065857)
    - batman-adv: Avoid infinite loop trying to resize local TT
    - ring-buffer: Only update pages_touched when a new page is touched
    - Bluetooth: Fix memory leak in hci_req_sync_complete()
    - media: cec: core: remove length check of Timer Status
    - arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order
    - Revert "drm/qxl: simplify qxl_fence_wait"
    - nouveau: fix function cast warning
    - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()
    - net: openvswitch: fix unwanted error log on timeout policy probing
    - u64_stats: Disable preemption on 32bit UP+SMP PREEMPT_RT during updates.
    - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
    - geneve: fix header validation in geneve[6]_xmit_skb
    - af_unix: Clear stale u->oob_skb.
    - octeontx2-af: Fix NIX SQ mode and BP config
    - ipv6: fib: hide unused 'pn' variable
    - ipv4/route: avoid unused-but-set-variable warning
    - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
    - netfilter: complete validation of user input
    - net/mlx5: Properly link new fs rules into the tree
    - net: sparx5: fix wrong config being used when reconfiguring PCS
    - net: dsa: mt7530: trap link-local frames regardless of ST Port State
    - af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
    - af_unix: Fix garbage collector racing against connect()
    - net: ena: Fix potential sign extension issue
    - net: ena: Wrong missing IO completions check order
    - net: ena: Fix incorrect descriptor free behavior
    - tracing: hide unused ftrace_event_id_fops
    - iommu/vt-d: Allocate local memory for page request queue
    - btrfs: qgroup: correctly model root qgroup rsv in convert
    - drm/client: Fully protect modes[] with dev->mode_config.mutex
    - vhost: Add smp_rmb() in vhost_vq_avail_empty()
    - perf/x86: Fix out of range data
    - x86/cpu: Actually turn off mitigations by default for
      SPECULATION_MITIGATIONS=n
    - selftests: timers: Fix abs() warning in posix_timers test
    - x86/apic: Force native_apic_mem_read() to use the MOV instruction
    - irqflags: Explicitly ignore lockdep_hrtimer_exit() argument
    - x86/bugs: Fix return type of spectre_bhi_state()
    - x86/bugs: Fix BHI documentation
    - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES
    - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr'
    - x86/bugs: Fix BHI handling of RRSBA
    - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation
    - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto
    - [Config] updateconfigs to remove obsolete SPECTRE_BHI_AUTO
    - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with
      CONFIG_MITIGATION_SPECTRE_BHI
    - [Config] updateconfigs to enable new MITIGATION_SPECTRE_BHI
    - drm/i915/cdclk: Fix CDCLK programming order when pipes are active
    - Linux 5.15.156

  * Jammy update: v5.15.155 upstream stable release (LP: #2065805)
    - amdkfd: use calloc instead of kzalloc to avoid integer overflow
    - net: dsa: fix panic when DSA master device unbinds on shutdown
    - wifi: ath9k: fix LNA selection in ath_ant_try_scan()
    - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
    - panic: Flush kernel log buffer at the end
    - cpuidle: Avoid potential overflow in integer multiplication
    - arm64: dts: rockchip: fix rk3328 hdmi ports node
    - arm64: dts: rockchip: fix rk3399 hdmi ports node
    - ionic: set adminq irq affinity
    - pstore/zone: Add a null pointer check to the psz_kmsg_read
    - tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
    - net: pcs: xpcs: Return EINVAL in the internal methods
    - wifi: ath11k: decrease MHI channel buffer length to 8KB
    - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
    - btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
    - btrfs: send: handle path ref underflow in header iterate_inode_ref()
    - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
    - Bluetooth: btintel: Fix null ptr deref in btintel_read_version
    - Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
    - pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs
    - sysv: don't call sb_bread() with pointers_lock held
    - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
    - isofs: handle CDs with bad root inode but good Joliet root directory
    - media: sta2x11: fix irq handler cast
    - ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block
      counter
    - ext4: add a hint for block bitmap corrupt state in mb_groups
    - ext4: forbid commit inconsistent quota data when errors=remount-ro
    - drm/amd/display: Fix nanosec stat overflow
    - SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned
      int
    - Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
    - libperf evlist: Avoid out-of-bounds access
    - block: prevent division by zero in blk_rq_stat_sum()
    - RDMA/cm: add timeout to cm_destroy_id wait
    - Input: allocate keycode for Display refresh rate toggle
    - platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi
      Vi8 tablet
    - ktest: force $buildonly = 1 for 'make_warnings_file' test type
    - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent
      environment
    - tools: iio: replace seekdir() in iio_generic_buffer
    - usb: typec: tcpci: add generic tcpci fallback compatible
    - usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
    - ASoC: soc-core.c: Skip dummy codec when adding platforms
    - fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
    - drivers/nvme: Add quirks for device 126f:2262
    - fbmon: prevent division by zero in fb_videomode_from_videomode()
    - netfilter: nf_tables: release batch on table validation from abort path
    - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
    - netfilter: nf_tables: discard table flag update with pending basechain
      deletion
    - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
    - gcc-plugins/stackleak: Ignore .noinstr.text and .entry.text
    - gcc-plugins/stackleak: Avoid .head.text section
    - virtio: reenable config if freezing device failed
    - x86/mm/pat: fix VM_PAT handling in COW mappings
    - randomize_kstack: Improve entropy diffusion
    - platform/x86: intel-vbtn: Update tablet mode switch at end of probe
    - Bluetooth: btintel: Fixe build regression
    - VMCI: Fix possible memcpy() run-time warning in
      vmci_datagram_invoke_guest_handler()
    - Linux 5.15.155

  * Jammy update: v5.15.154 upstream stable release (LP: #2065435)
    - Documentation/hw-vuln: Update spectre doc
    - x86/cpu: Support AMD Automatic IBRS
    - media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
    - clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
    - smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
    - smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
    - arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
    - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts
    - pci_iounmap(): Fix MMIO mapping leak
    - KVM: Always flush async #PF workqueue when vCPU is being destroyed
    - sparc64: NMI watchdog: fix return value of __setup handler
    - sparc: vDSO: fix return value of __setup handler
    - crypto: qat - fix double free during reset
    - crypto: qat - resolve race condition during AER recovery
    - selftests/mqueue: Set timeout to 180 seconds
    - ext4: correct best extent lstart adjustment logic
    - block: Clear zone limits for a non-zoned stacked queue
    - kasan: test: add memcpy test that avoids out-of-bounds write
    - kasan/test: avoid gcc warning for intentional overflow
    - bounds: support non-power-of-two CONFIG_NR_CPUS
    - fat: fix uninitialized field in nostale filehandles
    - ubifs: Set page uptodate in the correct place
    - ubi: Check for too small LEB size in VTBL code
    - ubi: correct the calculation of fastmap size
    - mtd: rawnand: meson: fix scrambling mode value in command macro
    - parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt
      macros
    - parisc: Fix ip_fast_csum
    - parisc: Fix csum_ipv6_magic on 32-bit systems
    - parisc: Fix csum_ipv6_magic on 64-bit systems
    - parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
    - PM: suspend: Set mem_sleep_current during kernel command line setup
    - clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
    - clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
    - clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
    - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
    - usb: xhci: Add error handling in xhci_map_urb_for_dma
    - powerpc/fsl: Fix mfpmr build errors with newer binutils
    - USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
    - USB: serial: add device ID for VeriFone adapter
    - USB: serial: cp210x: add ID for MGP Instruments PDS100
    - USB: serial: option: add MeiG Smart SLM320 product
    - USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
    - PM: sleep: wakeirq: fix wake irq warning in system suspend
    - mmc: tmio: avoid concurrent runs of mmc_request_done()
    - fuse: fix root lookup with nonzero generation
    - fuse: don't unhash root
    - usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros
    - printk/console: Split out code that enables default console
    - serial: Lock console when calling into driver before registration
    - btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
    - PCI: Drop pci_device_remove() test of pci_dev->driver
    - PCI/PM: Drain runtime-idle callbacks before driver removal
    - PCI: Work around Intel I210 ROM BAR overlap defect
    - PCI/ASPM: Make Intel DG2 L1 acceptable latency unlimited
    - PCI/DPC: Quirk PIO log size for certain Intel Root Ports
    - PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports
    - dm-raid: fix lockdep waring in "pers->hot_add_disk"
    - mac802154: fix llsec key resources release in mac802154_llsec_key_del
    - swap: comments get_swap_device() with usage rule
    - mm: swap: fix race between free_swap_and_cache() and swapoff()
    - mmc: core: Fix switch on gp3 partition
    - drm/etnaviv: Restore some id values
    - landlock: Warn once if a Landlock action is requested while disabled
    - hwmon: (amc6821) add of_match table
    - ext4: fix corruption during on-line resize
    - nvmem: meson-efuse: fix function pointer type mismatch
    - slimbus: core: Remove usage of the deprecated ida_simple_xx() API
    - phy: tegra: xusb: Add API to retrieve the port number of phy
    - usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic
    - speakup: Fix 8bit characters from direct synth
    - PCI/AER: Block runtime suspend when handling errors
    - nfs: fix UAF in direct writes
    - kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
    - PCI: dwc: endpoint: Fix advertised resizable BAR size
    - vfio/platform: Disable virqfds on cleanup
    - ksmbd: retrieve number of blocks using vfs_getattr in
      set_file_allocation_info
    - ring-buffer: Fix waking up ring buffer readers
    - ring-buffer: Do not set shortest_full when full target is hit
    - ring-buffer: Fix resetting of shortest_full
    - ring-buffer: Fix full_waiters_pending in poll
    - ring-buffer: Use wait_event_interruptible() in ring_buffer_wait()
    - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
    - soc: fsl: qbman: Add helper for sanity checking cgr ops
    - soc: fsl: qbman: Add CGR update function
    - soc: fsl: qbman: Use raw spinlock for cgr_lock
    - s390/zcrypt: fix reference counting on zcrypt card objects
    - drm/panel: do not return negative error codes from drm_panel_get_modes()
    - drm/exynos: do not return negative values from .get_modes()
    - drm/imx/ipuv3: do not return negative values from .get_modes()
    - drm/vc4: hdmi: do not return negative values from .get_modes()
    - memtest: use {READ,WRITE}_ONCE in memory scanning
    - nilfs2: fix failure to detect DAT corruption in btree and direct mappings
    - nilfs2: prevent kernel bug at submit_bh_wbc()
    - cpufreq: dt: always allocate zeroed cpumask
    - x86/CPU/AMD: Update the Zenbleed microcode revisions
    - NFSD: Fix nfsd_clid_class use of __string_len() macro
    - net: hns3: tracing: fix hclgevf trace event strings
    - wireguard: netlink: check for dangling peer via is_dead instead of empty
      list
    - wireguard: netlink: access device through ctx instead of peer
    - ahci: asm1064: correct count of reported ports
    - ahci: asm1064: asm1166: don't limit reported ports
    - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
    - drm/amd/display: Return the correct HDCP error code
    - drm/amd/display: Fix noise issue on HDMI AV mute
    - dm snapshot: fix lockup in dm_exception_table_exit
    - x86/pm: Work around false positive kmemleak report in msr_build_context()
    - net: ravb: Add R-Car Gen4 support
    - cpufreq: brcmstb-avs-cpufreq: fix up "add check for cpufreq_cpu_get's return
      value"
    - netfilter: nf_tables: reject constant set with timeout
    - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of
      memory
    - xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
    - KVM: SVM: Flush pages under kvm->lock to fix UAF in
      svm_register_enc_region()
    - tracing: Use .flush() call to wake up readers
    - drm/i915: Check before removing mm notifier
    - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
    - usb: gadget: ncm: Fix handling of zero block length packets
    - usb: port: Don't try to peer unused USB ports based on location
    - tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
    - mei: me: add arrow lake point S DID
    - mei: me: add arrow lake point H DID
    - vt: fix unicode buffer corruption when deleting characters
    - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
    - tee: optee: Fix kernel panic caused by incorrect error handling
    - i2c: i801: Avoid potential double call to gpiod_remove_lookup_table
    - xen/events: close evtchn after mapping cleanup
    - clocksource/drivers/arm_global_timer: Fix maximum prescaler value
    - entry: Respect changes to system call number by trace_sys_enter()
    - minmax: add umin(a, b) and umax(a, b)
    - swiotlb: Fix alignment checks when both allocation and DMA masks are present
    - dma-mapping: add dma_opt_mapping_size()
    - dma-iommu: add iommu_dma_opt_mapping_size()
    - iommu/dma: Force swiotlb_max_mapping_size on an untrusted device
    - printk: Update @console_may_schedule in console_trylock_spinning()
    - tty: serial: imx: Fix broken RS485
    - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix
    - x86/bugs: Add asm helpers for executing VERW
    - x86/entry_64: Add VERW just before userspace transition
    - x86/entry_32: Add VERW just before userspace transition
    - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key
    - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH
    - KVM/VMX: Move VERW closer to VMentry for MDS mitigation
    - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set
    - Documentation/hw-vuln: Add documentation for RFDS
    - x86/rfds: Mitigate Register File Data Sampling (RFDS)
    - [Config] updateconfigs for MITIGATION_RFDS
    - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests
    - arch: Introduce CONFIG_FUNCTION_ALIGNMENT
    - [Config] updateconfigs for FUNCTION_ALIGNMENT
    - x86/asm: Differentiate between code and function alignment
    - x86/alternatives: Introduce int3_emulate_jcc()
    - x86/alternatives: Teach text_poke_bp() to patch Jcc.d32 instructions
    - x86/static_call: Add support for Jcc tail-calls
    - fsnotify: pass data_type to fsnotify_name()
    - fsnotify: pass dentry instead of inode data
    - fsnotify: clarify contract for create event hooks
    - fsnotify: Don't insert unmergeable events in hashtable
    - fanotify: Fold event size calculation to its own function
    - fanotify: Split fsid check from other fid mode checks
    - inotify: Don't force FS_IN_IGNORED
    - fsnotify: Add helper to detect overflow_event
    - fsnotify: Add wrapper around fsnotify_add_event
    - fsnotify: Retrieve super block from the data field
    - fsnotify: Protect fsnotify_handle_inode_event from no-inode events
    - fsnotify: Pass group argument to free_event
    - fanotify: Support null inode event in fanotify_dfid_inode
    - fanotify: Allow file handle encoding for unhashed events
    - fanotify: Encode empty file handle when no inode is provided
    - fanotify: Require fid_mode for any non-fd event
    - fsnotify: Support FS_ERROR event type
    - fanotify: Reserve UAPI bits for FAN_FS_ERROR
    - fanotify: Pre-allocate pool of error events
    - fanotify: Support enqueueing of error events
    - fanotify: Support merging of error events
    - fanotify: Wrap object_fh inline space in a creator macro
    - fanotify: Add helpers to decide whether to report FID/DFID
    - fanotify: WARN_ON against too large file handles
    - fanotify: Report fid info for file related file system errors
    - fanotify: Emit generic error info for error event
    - fanotify: Allow users to request FAN_FS_ERROR events
    - ext4: Send notifications on error
    - docs: Document the FAN_FS_ERROR event
    - NFS: Remove unnecessary TRACE_DEFINE_ENUM()s
    - SUNRPC: Tracepoints should display tk_pid and cl_clid as a fixed-size field
    - NFS: Move generic FS show macros to global header
    - NFS: Move NFS protocol display macros to global header
    - NFSD: Optimize DRC bucket pruning
    - NFSD: move filehandle format declarations out of "uapi".
    - NFSD: drop support for ancient filehandles
    - NFSD: simplify struct nfsfh
    - NFSD: Initialize pointer ni with NULL and not plain integer 0
    - SUNRPC: Replace the "__be32 *p" parameter to .pc_decode
    - SUNRPC: Change return value type of .pc_decode
    - NFSD: Save location of NFSv4 COMPOUND status
    - SUNRPC: Replace the "__be32 *p" parameter to .pc_encode
    - SUNRPC: Change return value type of .pc_encode
    - nfsd: update create verifier comment
    - NFSD:fix boolreturn.cocci warning
    - nfsd4: remove obselete comment
    - ext4: fix error code saved on super block during file system abort
    - fsnotify: clarify object type argument
    - fsnotify: separate mark iterator type from object type enum
    - fanotify: introduce group flag FAN_REPORT_TARGET_FID
    - fsnotify: generate FS_RENAME event with rich information
    - fanotify: use macros to get the offset to fanotify_info buffer
    - fanotify: use helpers to parcel fanotify_info buffer
    - fanotify: support secondary dir fh and name in fanotify_info
    - fanotify: record old and new parent and name in FAN_RENAME event
    - fanotify: record either old name new name or both for FAN_RENAME
    - fanotify: report old and/or new parent+name in FAN_RENAME event
    - fanotify: wire up FAN_RENAME event
    - exit: Implement kthread_exit
    - exit: Rename module_put_and_exit to module_put_and_kthread_exit
    - NFSD: handle errors better in write_ports_addfd()
    - SUNRPC: change svc_get() to return the svc.
    - SUNRPC/NFSD: clean up get/put functions.
    - SUNRPC: stop using ->sv_nrthreads as a refcount
    - nfsd: make nfsd_stats.th_cnt atomic_t
    - SUNRPC: use sv_lock to protect updates to sv_nrthreads.
    - NFSD: narrow nfsd_mutex protection in nfsd thread
    - NFSD: Make it possible to use svc_set_num_threads_sync
    - SUNRPC: discard svo_setup and rename svc_set_num_threads_sync()
    - NFSD: simplify locking for network notifier.
    - lockd: introduce nlmsvc_serv
    - lockd: simplify management of network status notifiers
    - lockd: move lockd_start_svc() call into lockd_create_svc()
    - lockd: move svc_exit_thread() into the thread
    - lockd: introduce lockd_put()
    - lockd: rename lockd_create_svc() to lockd_get()
    - SUNRPC: move the pool_map definitions (back) into svc.c
    - SUNRPC: always treat sv_nrpools==1 as "not pooled"
    - lockd: use svc_set_num_threads() for thread start and stop
    - NFS: switch the callback service back to non-pooled.
    - NFSD: Remove be32_to_cpu() from DRC hash function
    - NFSD: Fix inconsistent indenting
    - NFSD: simplify per-net file cache management
    - NFSD: Combine XDR error tracepoints
    - nfsd: improve stateid access bitmask documentation
    - NFSD: De-duplicate nfsd4_decode_bitmap4()
    - nfs: block notification on fs with its own ->lock
    - nfsd4: add refcount for nfsd4_blocked_lock
    - nfsd: map EBADF
    - nfsd: Add errno mapping for EREMOTEIO
    - nfsd: Retry once in nfsd_open on an -EOPENSTALE return
    - NFSD: Clean up nfsd_vfs_write()
    - NFSD: De-duplicate net_generic(SVC_NET(rqstp), nfsd_net_id)
    - nfsd: Add a tracepoint for errors in nfsd4_clone_file_range()
    - NFSD: Write verifier might go backwards
    - NFSD: Clean up the nfsd_net::nfssvc_boot field
    - NFSD: Rename boot verifier functions
    - NFSD: Trace boot verifier resets
    - NFSD: Move fill_pre_wcc() and fill_post_wcc()
    - fsnotify: invalidate dcache before IN_DELETE event
    - NFSD: Deprecate NFS_OFFSET_MAX
    - nfsd: Add support for the birth time attribute
    - orDate: Thu Sep 30 19:19:57 2021 -0400
    - NFSD: Skip extra computation for RC_NOCACHE case
    - NFSD: Streamline the rare "found" case
    - NFSD: Remove NFSD_PROC_ARGS_* macros
    - SUNRPC: Remove the .svo_enqueue_xprt method
    - SUNRPC: Merge svc_do_enqueue_xprt() into svc_enqueue_xprt()
    - SUNRPC: Remove svo_shutdown method
    - SUNRPC: Rename svc_create_xprt()
    - SUNRPC: Rename svc_close_xprt()
    - SUNRPC: Remove svc_shutdown_net()
    - NFSD: Remove svc_serv_ops::svo_module
    - NFSD: Move svc_serv_ops::svo_function into struct svc_serv
    - NFSD: Remove CONFIG_NFSD_V3
    - [Config] updateconfigs for NFSD_V3
    - NFSD: Clean up _lm_ operation names
    - nfsd: fix using the correct variable for sizeof()
    - fsnotify: fix merge with parent's ignored mask
    - fsnotify: optimize FS_MODIFY events with no ignored masks
    - fsnotify: remove redundant parameter judgment
    - nfsd: Fix a write performance regression
    - nfsd: Clean up nfsd_file_put()
    - fanotify: do not allow setting dirent events in mask of non-dir
    - fs/lock: documentation cleanup. Replace inode->i_lock with flc_lock.
    - inotify: move control flags from mask to mark flags
    - fsnotify: pass flags argument to fsnotify_alloc_group()
    - fsnotify: make allow_dups a property of the group
    - fsnotify: create helpers for group mark_mutex lock
    - inotify: use fsnotify group lock helpers
    - nfsd: use fsnotify group lock helpers
    - dnotify: use fsnotify group lock helpers
    - fsnotify: allow adding an inode mark without pinning inode
    - fanotify: create helper fanotify_mark_user_flags()
    - fanotify: factor out helper fanotify_mark_update_flags()
    - fanotify: implement "evictable" inode marks
    - fanotify: use fsnotify group lock helpers
    - fanotify: enable "evictable" inode marks
    - fsnotify: introduce mark type iterator
    - fsnotify: consistent behavior for parent not watching children
    - fanotify: fix incorrect fmode_t casts
    - NFSD: Clean up nfsd_splice_actor()
    - NFSD: add courteous server support for thread with only delegation
    - NFSD: add support for share reservation conflict to courteous server
    - NFSD: move create/destroy of laundry_wq to init_nfsd and exit_nfsd
    - fs/lock: add helper locks_owner_has_blockers to check for blockers
    - fs/lock: add 2 callbacks to lock_manager_operations to resolve conflict
    - NFSD: add support for lock conflict to courteous server
    - NFSD: Show state of courtesy client in client info
    - NFSD: Clean up nfsd3_proc_create()
    - NFSD: Avoid calling fh_drop_write() twice in do_nfsd_create()
    - NFSD: Refactor nfsd_create_setattr()
    - NFSD: Refactor NFSv3 CREATE
    - NFSD: Refactor NFSv4 OPEN(CREATE)
    - NFSD: Remove do_nfsd_create()
    - NFSD: Clean up nfsd_open_verified()
    - NFSD: Instantiate a struct file when creating a regular NFSv4 file
    - NFSD: Remove dprintk call sites from tail of nfsd4_open()
    - NFSD: Fix whitespace
    - NFSD: Move documenting comment for nfsd4_process_open2()
    - NFSD: Trace filecache opens
    - SUNRPC: Use RMW bitops in single-threaded hot paths
    - nfsd: Unregister the cld notifier when laundry_wq create failed
    - nfsd: Fix null-ptr-deref in nfsd_fill_super()
    - NFSD: Modernize nfsd4_release_lockowner()
    - NFSD: Add documenting comment for nfsd4_release_lockowner()
    - NFSD: nfsd_file_put() can sleep
    - NFSD: Fix potential use-after-free in nfsd_file_put()
    - NFS: restore module put when manager exits.
    - fanotify: refine the validation checks on non-dir inode mask
    - NFSD: Decode NFSv4 birth time attribute
    - fs: inotify: Fix typo in inotify comment
    - fanotify: prepare for setting event flags in ignore mask
    - fanotify: cleanups for fanotify_mark() input validations
    - fanotify: introduce FAN_MARK_IGNORE
    - fsnotify: Fix comment typo
    - NLM: Defend against file_lock changes after vfs_test_lock()
    - NFSD: Instrument fh_verify()
    - NFSD: Fix space and spelling mistake
    - nfsd: remove redundant assignment to variable len
    - NFSD: Demote a WARN to a pr_warn()
    - NFSD: Report filecache LRU size
    - NFSD: Report count of calls to nfsd_file_acquire()
    - NFSD: Report count of freed filecache items
    - NFSD: Report average age of filecache items
    - NFSD: Add nfsd_file_lru_dispose_list() helper
    - NFSD: Refactor nfsd_file_gc()
    - NFSD: Refactor nfsd_file_lru_scan()
    - NFSD: Report the number of items evicted by the LRU walk
    - NFSD: Record number of flush calls
    - NFSD: Zero counters when the filecache is re-initialized
    - NFSD: Hook up the filecache stat file
    - NFSD: WARN when freeing an item still linked via nf_lru
    - NFSD: Trace filecache LRU activity
    - NFSD: Leave open files out of the filecache LRU
    - NFSD: Fix the filecache LRU shrinker
    - NFSD: Never call nfsd_file_gc() in foreground paths
    - NFSD: No longer record nf_hashval in the trace log
    - NFSD: Remove lockdep assertion from unhash_and_release_locked()
    - NFSD: nfsd_file_unhash can compute hashval from nf->nf_inode
    - NFSD: Refactor __nfsd_file_close_inode()
    - NFSD: nfsd_file_hash_remove can compute hashval
    - NFSD: Remove nfsd_file::nf_hashval
    - NFSD: Replace the "init once" mechanism
    - NFSD: Set up an rhashtable for the filecache
    - NFSD: Convert the filecache to use rhashtable
    - NFSD: Clean up unused code after rhashtable conversion
    - NFSD: Separate tracepoints for acquire and create
    - NFSD: Move nfsd_file_trace_alloc() tracepoint
    - NFSD: NFSv4 CLOSE should release an nfsd_file immediately
    - NFSD: Ensure nf_inode is never dereferenced
    - NFSD: refactoring v4 specific code to a helper in nfs4state.c
    - NFSD: keep track of the number of v4 clients in the system
    - NFSD: limit the number of v4 clients to 1024 per 1GB of system memory
    - nfsd: silence extraneous printk on nfsd.ko insertion
    - NFSD: Optimize nfsd4_encode_operation()
    - NFSD: Optimize nfsd4_encode_fattr()
    - NFSD: Clean up SPLICE_OK in nfsd4_encode_read()
    - NFSD: Add an nfsd4_read::rd_eof field
    - NFSD: Optimize nfsd4_encode_readv()
    - NFSD: Simplify starting_len
    - NFSD: Use xdr_pad_size()
    - NFSD: Clean up nfsd4_encode_readlink()
    - NFSD: Fix strncpy() fortify warning
    - NFSD: nfserrno(-ENOMEM) is nfserr_jukebox
    - NFSD: Shrink size of struct nfsd4_copy_notify
    - NFSD: Shrink size of struct nfsd4_copy
    - NFSD: Reorder the fields in struct nfsd4_op
    - NFSD: Make nfs4_put_copy() static
    - NFSD: Replace boolean fields in struct nfsd4_copy
    - NFSD: Refactor nfsd4_cleanup_inter_ssc() (1/2)
    - NFSD: Refactor nfsd4_cleanup_inter_ssc() (2/2)
    - NFSD: Refactor nfsd4_do_copy()
    - NFSD: Remove kmalloc from nfsd4_do_async_copy()
    - NFSD: Add nfsd4_send_cb_offload()
    - NFSD: Move copy offload callback arguments into a separate structure
    - NFSD: drop fh argument from alloc_init_deleg
    - NFSD: verify the opened dentry after setting a delegation
    - NFSD: introduce struct nfsd_attrs
    - NFSD: set attributes when creating symlinks
    - NFSD: add security label to struct nfsd_attrs
    - NFSD: add posix ACLs to struct nfsd_attrs
    - NFSD: change nfsd_create()/nfsd_symlink() to unlock directory before
      returning.
    - NFSD: always drop directory lock in nfsd_unlink()
    - NFSD: only call fh_unlock() once in nfsd_link()
    - NFSD: reduce locking in nfsd_lookup()
    - NFSD: use explicit lock/unlock for directory ops
    - NFSD: use (un)lock_inode instead of fh_(un)lock for file operations
    - NFSD: discard fh_locked flag and fh_lock/fh_unlock
    - NFSD: fix regression with setting ACLs.
    - nfsd_splice_actor(): handle compound pages
    - NFSD: move from strlcpy with unused retval to strscpy
    - lockd: move from strlcpy with unused retval to strscpy
    - NFSD enforce filehandle check for source file in COPY
    - NFSD: remove redundant variable status
    - nfsd: Avoid some useless tests
    - nfsd: Propagate some error code returned by memdup_user()
    - NFSD: Increase NFSD_MAX_OPS_PER_COMPOUND
    - NFSD: drop fname and flen args from nfsd_create_locked()
    - nfsd: clean up mounted_on_fileid handling
    - nfsd: remove nfsd4_prepare_cb_recall() declaration
    - NFSD: Replace dprintk() call site in fh_verify()
    - NFSD: Trace NFSv4 COMPOUND tags
    - NFSD: Add tracepoints to report NFSv4 callback completions
    - NFSD: Add a mechanism to wait for a DELEGRETURN
    - NFSD: Refactor nfsd_setattr()
    - NFSD: Make nfsd4_setattr() wait before returning NFS4ERR_DELAY
    - NFSD: Make nfsd4_rename() wait before returning NFS4ERR_DELAY
    - NFSD: Make nfsd4_remove() wait before returning NFS4ERR_DELAY
    - NFSD: keep track of the number of courtesy clients in the system
    - NFSD: add shrinker to reap courtesy clients on low memory condition
    - SUNRPC: Parametrize how much of argsize should be zeroed
    - NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing
    - NFSD: Refactor common code out of dirlist helpers
    - NFSD: Use xdr_inline_decode() to decode NFSv3 symlinks
    - NFSD: Clean up WRITE arg decoders
    - NFSD: Clean up nfs4svc_encode_compoundres()
    - NFSD: Remove unused nfsd4_compoundargs::cachetype field
    - NFSD: Pack struct nfsd4_compoundres
    - nfsd: use DEFINE_PROC_SHOW_ATTRIBUTE to define nfsd_proc_ops
    - nfsd: use DEFINE_SHOW_ATTRIBUTE to define export_features_fops and
      supported_enctypes_fops
    - nfsd: use DEFINE_SHOW_ATTRIBUTE to define client_info_fops
    - nfsd: use DEFINE_SHOW_ATTRIBUTE to define nfsd_reply_cache_stats_fops
    - nfsd: use DEFINE_SHOW_ATTRIBUTE to define nfsd_file_cache_stats_fops
    - NFSD: Rename the fields in copy_stateid_t
    - nfsd: only fill out return pointer on success in nfsd4_lookup_stateid
    - nfsd: fix comments about spinlock handling with delegations
    - nfsd: make nfsd4_run_cb a bool return function
    - nfsd: extra checks when freeing delegation stateids
    - fs/notify: constify path
    - fsnotify: remove unused declaration
    - fanotify: Remove obsoleted fanotify_event_has_path()
    - nfsd: fix nfsd_file_unhash_and_dispose
    - nfsd: rework hashtable handling in nfsd_do_file_acquire
    - NFSD: unregister shrinker when nfsd_init_net() fails
    - nfsd: ensure we always call fh_verify_error tracepoint
    - nfsd: fix net-namespace logic in __nfsd_file_cache_purge
    - nfsd: fix use-after-free in nfsd_file_do_acquire tracepoint
    - nfsd: put the export reference in nfsd4_verify_deleg_dentry
    - NFSD: Fix trace_nfsd_fh_verify_err() crasher
    - NFSD: Fix reads with a non-zero offset that don't end on a page boundary
    - lockd: use locks_inode_context helper
    - nfsd: use locks_inode_context helper
    - NFSD: Simplify READ_PLUS
    - NFSD: Remove redundant assignment to variable host_err
    - NFSD: Finish converting the NFSv3 GETACL result encoder
    - nfsd: ignore requests to disable unsupported versions
    - nfsd: move nfserrno() to vfs.c
    - nfsd: allow disabling NFSv2 at compile time
    - [Config] updateconfigs for NFSD_V2
    - exportfs: use pr_debug for unreachable debug statements
    - NFSD: Pass the target nfsd_file to nfsd_commit()
    - NFSD: Revert "NFSD: NFSv4 CLOSE should release an nfsd_file immediately"
    - NFSD: Add an NFSD_FILE_GC flag to enable nfsd_file garbage collection
    - NFSD: Flesh out a documenting comment for filecache.c
    - NFSD: Clean up nfs4_preprocess_stateid_op() call sites
    - NFSD: Trace stateids returned via DELEGRETURN
    - NFSD: Trace delegation revocations
    - NFSD: Use const pointers as parameters to fh_ helpers
    - NFSD: Update file_hashtbl() helpers
    - NFSD: Clean up nfsd4_init_file()
    - NFSD: Add a nfsd4_file_hash_remove() helper
    - NFSD: Clean up find_or_add_file()
    - NFSD: Refactor find_file()
    - NFSD: Use rhashtable for managing nfs4_file objects
    - NFSD: Fix licensing header in filecache.c
    - nfsd: remove the pages_flushed statistic from filecache
    - nfsd: reorganize filecache.c
    - filelock: add a new locks_inode_context accessor function
    - nfsd: fix up the filecache laundrette scheduling
    - NFSD: Add an nfsd_file_fsync tracepoint
    - nfsd: return error if nfs4_setacl fails
    - NFSD: Use struct_size() helper in alloc_session()
    - lockd: set missing fl_flags field when retrieving args
    - lockd: ensure we use the correct file descriptor when unlocking
    - lockd: fix file selection in nlmsvc_cancel_blocked
    - trace: Relocate event helper files
    - NFSD: refactoring courtesy_client_reaper to a generic low memory shrinker
    - NFSD: add support for sending CB_RECALL_ANY
    - NFSD: add delegation reaper to react to low memory condition
    - NFSD: add CB_RECALL_ANY tracepoints
    - NFSD: Use only RQ_DROPME to signal the need to drop a reply
    - NFSD: Avoid clashing function prototypes
    - nfsd: rework refcounting in filecache
    - nfsd: fix handling of cached open files in nfsd4_open codepath
    - Revert "SUNRPC: Use RMW bitops in single-threaded hot paths"
    - NFSD: Use set_bit(RQ_DROPME)
    - NFSD: register/unregister of nfsd-client shrinker at nfsd startup/shutdown
      time
    - NFSD: replace delayed_work with work_struct for nfsd_client_shrinker
    - nfsd: don't free files unconditionally in __nfsd_file_cache_purge
    - nfsd: don't destroy global nfs4_file table in per-net shutdown
    - NFSD: enhance inter-server copy cleanup
    - nfsd: allow nfsd_file_get to sanely handle a NULL pointer
    - nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
    - NFSD: fix leaked reference count of nfsd4_ssc_umount_item
    - nfsd: don't hand out delegation on setuid files being opened for write
    - NFSD: fix problems with cleanup on errors in nfsd4_copy
    - nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open
    - nfsd: don't fsync nfsd_files on last close
    - NFSD: copy the whole verifier in nfsd_copy_write_verifier
    - NFSD: Protect against filesystem freezing
    - nfsd: don't replace page in rq_pages if it's a continuation of last page
    - nfsd: call op_release, even when op_func returns an error
    - nfsd: don't open-code clear_and_wake_up_bit
    - nfsd: NFSD_FILE_KEY_INODE only needs to find GC'ed entries
    - nfsd: simplify test_bit return in NFSD_FILE_KEY_FULL comparator
    - nfsd: don't kill nfsd_files because of lease break error
    - nfsd: add some comments to nfsd_file_do_acquire
    - nfsd: don't take/put an extra reference when putting a file
    - nfsd: update comment over __nfsd_file_cache_purge
    - nfsd: allow reaping files still under writeback
    - NFSD: Convert filecache to rhltable
    - nfsd: simplify the delayed disposal list code
    - NFSD: Fix problem of COMMIT and NFS4ERR_DELAY in infinite loop
    - nfsd: make a copy of struct iattr before calling notify_change
    - nfsd: fix double fget() bug in __write_ports_addfd()
    - lockd: drop inappropriate svc_get() from locked_get()
    - NFSD: Add an nfsd4_encode_nfstime4() helper
    - nfsd: Fix creation time serialization order
    - nfsd: Simplify code around svc_exit_thread() call in nfsd()
    - nfsd: separate nfsd_last_thread() from nfsd_put()
    - Documentation: Add missing documentation for EXPORT_OP flags
    - NFSD: fix possible oops when nfsd/pool_stats is closed.
    - nfsd: call nfsd_last_thread() before final nfsd_put()
    - nfsd: drop the nfsd_put helper
    - nfsd: fix RELEASE_LOCKOWNER
    - nfsd: don't take fi_lock in nfsd_break_deleg_cb()
    - nfsd: don't call locks_release_private() twice concurrently
    - nfsd: Fix a regression in nfsd_setattr()
    - perf/core: Fix reentry problem in perf_output_read_group()
    - efivarfs: Request at most 512 bytes for variable names
    - powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
    - selftests: mptcp: diag: return KSFT_FAIL not test_cnt
    - vfio/pci: Disable auto-enable of exclusive INTx IRQ
    - vfio/pci: Lock external INTx masking ops
    - vfio: Introduce interface to flush virqfd inject workqueue
    - vfio/pci: Create persistent INTx handler
    - vfio/platform: Create persistent IRQ handlers
    - vfio/fsl-mc: Block calling interrupt handler without trigger
    - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
    - mm/migrate: set swap entry values of THP tail pages properly.
    - init: open /initrd.image with O_LARGEFILE
    - btrfs: zoned: use zone aware sb location for scrub
    - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
    - exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
    - hexagon: vmlinux.lds.S: handle attributes section
    - mmc: core: Initialize mmc_blk_ioc_data
    - mmc: core: Avoid negative index with array access
    - net: ll_temac: platform_get_resource replaced by wrong function
    - drm/i915/gt: Reset queue_priority_hint on parking
    - drm/amdgpu: Use drm_mode_copy()
    - drm/amd/display: Preserve original aspect ratio in create stream
    - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
    - scsi: core: Fix unremoved procfs host directory regression
    - staging: vc04_services: changen strncpy() to strscpy_pad()
    - staging: vc04_services: fix information leak in create_component()
    - USB: core: Add hub_get() and hub_put() routines
    - usb: dwc2: host: Fix remote wakeup from hibernation
    - usb: dwc2: host: Fix hibernation flow
    - usb: dwc2: host: Fix ISOC flow in DDMA mode
    - usb: dwc2: gadget: Fix exiting from clock gating
    - usb: dwc2: gadget: LPM flow fix
    - usb: udc: remove warning when queue disabled ep
    - usb: typec: ucsi: Ack unsupported commands
    - usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset
    - scsi: qla2xxx: Prevent command send on chip reset
    - scsi: qla2xxx: Fix N2N stuck connection
    - scsi: qla2xxx: Split FCE|EFT trace control
    - scsi: qla2xxx: NVME|FCP prefer flag not being honored
    - scsi: qla2xxx: Fix command flush on cable pull
    - scsi: qla2xxx: Fix double free of fcport
    - scsi: qla2xxx: Change debug message during driver unload
    - scsi: qla2xxx: Delay I/O Abort on PCI error
    - x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled
    - PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports
    - scsi: lpfc: Correct size for wqe for memset()
    - USB: core: Fix deadlock in usb_deauthorize_interface()
    - scsi: usb: Call scsi_done() directly
    - scsi: usb: Stop using the SCSI pointer
    - USB: UAS: return ENODEV when submit urbs fail with device not attached
    - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
    - mlxbf_gige: stop PHY during open() error paths
    - iwlwifi: mvm: rfi: use kmemdup() to replace kzalloc + memcpy
    - wifi: iwlwifi: mvm: rfi: fix potential response leaks
    - ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
    - s390/qeth: handle deferred cc1
    - tcp: properly terminate timers for kernel sockets
    - ACPICA: debugger: check status of acpi_evaluate_object() in
      acpi_db_walk_for_fields()
    - mlxbf_gige: call request_irq() after NAPI initialized
    - bpf: Protect against int overflow for stack access size
    - Octeontx2-af: fix pause frame configuration in GMP mode
    - dm integrity: fix out-of-range warning
    - r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
    - x86/cpufeatures: Add new word for scattered features
    - x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
    - arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken
    - Bluetooth: hci_event: set the conn encrypted before conn establishes
    - Bluetooth: Fix TOCTOU in HCI debugfs implementation
    - xen-netfront: Add missing skb_mark_for_recycle
    - net/rds: fix possible cp null dereference
    - locking/rwsem: Disable preemption while trying for rwsem lock
    - io_uring: ensure '0' is returned on file registration success
    - Revert "x86/mm/ident_map: Use gbpages only where full GB page should be
      mapped."
    - mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL
      allocations
    - thermal: devfreq_cooling: Fix perf state when calculate dfc res_util
    - KVM: x86: Bail to userspace if emulation of atomic user access faults
    - KVM: x86: Mark target gfn of emulated atomic instruction as dirty
    - netfilter: nf_tables: reject new basechain after table flag update
    - netfilter: nf_tables: flush pending destroy work before exit_net release
    - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
    - netfilter: validate user input for expected length
    - vboxsf: Avoid an spurious warning if load_nls_xxx() fails
    - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
    - net/sched: act_skbmod: prevent kernel-infoleak
    - net: stmmac: fix rx queue priority assignment
    - selftests: net: gro fwd: update vxlan GRO test expectations
    - erspan: make sure erspan_base_hdr is present in skb->head
    - selftests: reuseaddr_conflict: add missing new line at the end of the output
    - ipv6: Fix infinite recursion in fib6_dump_done().
    - mlxbf_gige: stop interface during shutdown
    - udp: do not accept non-tunnel GSO skbs landing in a tunnel
    - udp: do not transition UDP GRO fraglist partial checksums to unnecessary
    - udp: prevent local UDP tunnel packets from being GROed
    - octeontx2-af: Fix issue with loading coalesced KPU profiles
    - octeontx2-pf: check negative error code in otx2_open()
    - i40e: fix i40e_count_filters() to count only active/new filters
    - i40e: fix vf may be used uninitialized in this function warning
    - scsi: qla2xxx: Update manufacturer details
    - scsi: qla2xxx: Update manufacturer detail
    - Revert "usb: phy: generic: Get the vbus supply"
    - i40e: Store the irq number in i40e_q_vector
    - i40e: Remove _t suffix from enum type names
    - i40e: Enforce software interrupt during busy-poll exit
    - net: usb: asix: suspend embedded PHY if external is used
    - drivers: net: convert to boolean for the mac_managed_pm flag
    - net: fec: Set mac_managed_pm during probe
    - net: ravb: Always process TX descriptor ring
    - ASoC: rt5682-sdw: fix locking sequence
    - ASoC: rt711-sdca: fix locking sequence
    - ASoC: rt711-sdw: fix locking sequence
    - ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
    - ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
    - scsi: mylex: Fix sysfs buffer lengths
    - ata: sata_mv: Fix PCI device ID table declaration compilation warning
    - nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
    - HID: uhid: Use READ_ONCE()/WRITE_ONCE() for ->running
    - openrisc: Fix pagewalk usage in arch_dma_{clear, set}_uncached
    - fs/pipe: Fix lockdep false-positive in watchqueue pipe_write()
    - ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with
      microphone
    - driver core: Introduce device_link_wait_removal()
    - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
    - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
    - s390/entry: align system call table on 8 bytes
    - riscv: Fix spurious errors from __get/put_kernel_nofault
    - riscv: process: Fix kernel gp leakage
    - x86/bugs: Fix the SRSO mitigation on Zen3/4
    - x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for
      !SRSO
    - mptcp: don't account accept() of non-MPC client as fallback to TCP
    - mm/secretmem: fix GUP-fast succeeding on secretmem folios
    - gro: fix ownership transfer
    - nvme: fix miss command type check
    - x86: set SPECTRE_BHI_ON as default
    - Linux 5.15.154

  * CVE-2024-23307
    - md/raid5: fix atomicity violation in raid5_cache_count

  * CVE-2024-26828
    - cifs: fix underflow in parse_server_interfaces()

  * CVE-2024-24861
    - media: xc4000: Fix atomicity violation in xc4000_get_frequency

  * CVE-2024-26642
    - netfilter: nf_tables: disallow anonymous set with timeout flag

  * CVE-2024-26926
    - binder: check offset alignment in binder_get_object()

  * CVE-2024-26922
    - drm/amdgpu: validate the parameters of bo mapping operations more clearly

  * CVE-2023-6039
    - timers: Silently ignore timers with a NULL function

  * CVE-2024-26924
    - netfilter: nft_set_pipapo: do not free live element

  * CVE-2024-26643
    - netfilter: nf_tables: mark set as dead when unbinding anonymous set with
      timeout

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 07 Jun 2024 15:06:00 +0200

linux (5.15.0-112.122) jammy; urgency=medium

  * jammy/linux: 5.15.0-112.122 -proposed tracker (LP: #2065898)

  * CVE-2024-21823
    - dmanegine: idxd: reformat opcap output to match bitmap_parse() input
    - dmaengine: idxd: add WQ operation cap restriction support
    - dmaengine: idxd: add knob for enqcmds retries
    - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist
    - dmaengine: idxd: add a new security check to deal with a hardware erratum
    - dmaengine: idxd: add a write() method for applications to submit work

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Thu, 23 May 2024 09:20:33 +0200

linux (5.15.0-111.121) jammy; urgency=medium

  * jammy/linux: 5.15.0-111.121 -proposed tracker (LP: #2063763)

  * RTL8852BE fw security fail then lost WIFI function during suspend/resume
    cycle (LP: #2063096)
    - wifi: rtw89: download firmware with five times retry

  * Mount CIFS fails with Permission denied (LP: #2061986)
    - cifs: fix ntlmssp auth when there is no key exchange

  * USB stick can't be detected (LP: #2040948)
    - usb: Disable USB3 LPM at shutdown

  * Jammy update: v5.15.153 upstream stable release (LP: #2063290)
    - io_uring/unix: drop usage of io_uring socket
    - io_uring: drop any code related to SCM_RIGHTS
    - selftests: tls: use exact comparison in recv_partial
    - ASoC: rt5645: Make LattePanda board DMI match more precise
    - x86/xen: Add some null pointer checking to smp.c
    - MIPS: Clear Cause.BD in instruction_pointer_set
    - HID: multitouch: Add required quirk for Synaptics 0xcddc device
    - gen_compile_commands: fix invalid escape sequence warning
    - RDMA/mlx5: Fix fortify source warning while accessing Eth segment
    - RDMA/mlx5: Relax DEVX access upon modify commands
    - riscv: dts: sifive: add missing #interrupt-cells to pmic
    - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h
    - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()
    - net/iucv: fix the allocation size of iucv_path_table array
    - parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
    - block: sed-opal: handle empty atoms when parsing response
    - dm-verity, dm-crypt: align "struct bvec_iter" correctly
    - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
    - ALSA: hda/realtek - ALC285 reduce pop noise from Headphone port
    - drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series
    - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
    - firewire: core: use long bus reset on gap count error
    - ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
    - Input: gpio_keys_polled - suppress deferred probe error for gpio
    - ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
    - ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
    - ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
    - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
    - s390/dasd: put block allocation in separate function
    - s390/dasd: add query PPRC function
    - s390/dasd: add copy pair setup
    - s390/dasd: add autoquiesce feature
    - s390/dasd: Use dev_*() for device log messages
    - s390/dasd: fix double module refcount decrement
    - fs/select: rework stack allocation hack for clang
    - md: Don't clear MD_CLOSING when the raid is about to stop
    - lib/cmdline: Fix an invalid format specifier in an assertion msg
    - time: test: Fix incorrect format specifier
    - rtc: test: Fix invalid format specifier.
    - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
    - timekeeping: Fix cross-timestamp interpolation on counter wrap
    - timekeeping: Fix cross-timestamp interpolation corner case decision
    - timekeeping: Fix cross-timestamp interpolation for non-x86
    - sched/fair: Take the scheduling domain into account in select_idle_core()
    - wifi: ath10k: fix NULL pointer dereference in
      ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
    - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
    - wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
    - wifi: b43: Stop correct queue in DMA worker when QoS is disabled
    - wifi: b43: Disable QoS for bcm4331
    - wifi: wilc1000: fix declarations ordering
    - wifi: wilc1000: fix RCU usage in connect path
    - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
    - wifi: wilc1000: fix multi-vif management when deleting a vif
    - wifi: mwifiex: debugfs: Drop unnecessary error check for
      debugfs_create_dir()
    - cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
    - cpufreq: Explicitly include correct DT includes
    - cpufreq: mediatek-hw: Wait for CPU supplies before probing
    - sock_diag: annotate data-races around sock_diag_handlers[family]
    - inet_diag: annotate data-races around inet_diag_table[]
    - bpftool: Silence build warning about calloc()
    - af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
    - cpufreq: mediatek-hw: Don't error out if supply is not found
    - arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL i.MX8MM
    - arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL
      board
    - arm64: dts: imx8mm-kontron: Add support for ultra high speed modes on SD
      card
    - arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card IO
      voltage
    - arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL
      board
    - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
    - wifi: iwlwifi: mvm: report beacon protection failures
    - wifi: iwlwifi: dbg-tlv: ensure NUL termination
    - wifi: iwlwifi: fix EWRD table validity check
    - arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
    - pwm: atmel-hlcdc: Convert to platform remove callback returning void
    - pwm: atmel-hlcdc: Use consistent variable naming
    - pwm: atmel-hlcdc: Fix clock imbalance related to suspend support
    - net: blackhole_dev: fix build warning for ethh set but not used
    - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
    - pwm: sti: Implement .apply() callback
    - pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan
    - wifi: iwlwifi: mvm: don't set replay counters to 0xff
    - s390/vdso: drop '-fPIC' from LDFLAGS
    - ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
    - arm64: dts: mt8183: kukui: Add Type C node
    - arm64: dts: mt8183: kukui: Split out keyboard node and describe detachables
    - arm64: dts: mt8183: Move CrosEC base detection node to kukui-based DTs
    - arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
    - bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
    - wireless: Remove redundant 'flush_workqueue()' calls
    - wifi: wilc1000: prevent use-after-free on vif when cleaning up all
      interfaces
    - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
    - bus: tegra-aconnect: Update dependency to ARCH_TEGRA
    - [Config]: update CONFIG_TEGRA_ACONNECT
    - iommu/amd: Mark interrupt as managed
    - wifi: brcmsmac: avoid function pointer casts
    - net: ena: Remove ena_select_queue
    - ARM: dts: arm: realview: Fix development chip ROM compatible value
    - arm64: dts: renesas: r8a779a0: Update to R-Car Gen4 compatible values
    - arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes
    - ARM: dts: imx6dl-yapp4: Move phy reset into switch node
    - ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
    - ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
    - arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
    - ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override
    - ACPI: resource: Do IRQ override on Lunnen Ground laptops
    - ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override
    - ACPI: scan: Fix device check notification handling
    - x86, relocs: Ignore relocations in .notes section
    - SUNRPC: fix some memleaks in gssx_dec_option_array
    - mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove
      function
    - wifi: rtw88: 8821c: Fix false alarm count
    - PCI: Make pci_dev_is_disconnected() helper public for other drivers
    - iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
    - igb: move PEROUT and EXTTS isr logic to separate functions
    - igb: Fix missing time sync events
    - Bluetooth: Remove superfluous call to hci_conn_check_pending()
    - Bluetooth: hci_qca: Add support for QTI Bluetooth chip wcn6855
    - Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()
    - Bluetooth: hci_core: Fix possible buffer overflow
    - sr9800: Add check for usbnet_get_endpoints
    - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
    - bpf: Fix hashtab overflow check on 32-bit arches
    - bpf: Fix stackmap overflow check on 32-bit arches
    - ipv6: fib6_rules: flush route cache when rule is changed
    - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
    - net: phy: fix phy_get_internal_delay accessing an empty array
    - net: hns3: fix kernel crash when 1588 is received on HIP08 devices
    - net: hns3: fix port duplex configure error in IMP reset
    - net: phy: DP83822: enable rgmii mode if phy_interface_is_rgmii
    - net: phy: dp83822: Fix RGMII TX delay configuration
    - OPP: debugfs: Fix warning around icc_get_name()
    - tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
    - net: Change sock_getsockopt() to take the sk ptr instead of the sock ptr
    - bpf: net: Change sk_getsockopt() to take the sockptr_t argument
    - bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument
    - ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt()
      function
    - l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt()
      function
    - udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
    - net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
    - net/x25: fix incorrect parameter validation in the x25_getsockopt() function
    - nfp: flower: handle acti_netdevs allocation failure
    - dm raid: fix false positive for requeue needed during reshape
    - dm: call the resume method on internal suspend
    - drm/tegra: dsi: Add missing check for of_find_device_by_node
    - drm/tegra: dpaux: Populate AUX bus
    - drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe
    - drm/tegra: dsi: Make use of the helper function dev_err_probe()
    - drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
    - drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path
      of tegra_dsi_probe()
    - drm/tegra: dc: rgb: Allow changing PLLD rate on Tegra30+
    - drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe()
    - drm/tegra: rgb: Fix missing clk_put() in the error handling paths of
      tegra_dc_rgb_probe()
    - drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths
      of tegra_output_probe()
    - drm/rockchip: inno_hdmi: Fix video timing
    - drm: Don't treat 0 as -1 in drm_fixp2int_ceil
    - drm/ttm: add ttm_resource_fini v2
    - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
    - drm/rockchip: lvds: do not overwrite error code
    - drm/rockchip: lvds: do not print scary message when probing defer
    - drm/lima: fix a memleak in lima_heap_alloc
    - dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
    - [Config]: update CONFIG_TEGRA210_ADMA
    - media: tc358743: register v4l2 async device only after successful setup
    - PCI/DPC: Print all TLP Prefixes, not just the first
    - perf record: Fix possible incorrect free in record__switch_output()
    - HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
    - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
    - drm/amd/display: Fix potential NULL pointer dereferences in
      'dcn10_set_output_transfer_func()'
    - perf evsel: Fix duplicate initialization of data->id in
      evsel__parse_sample()
    - clk: meson: Add missing clocks to axg_clk_regmaps
    - media: em28xx: annotate unchecked call to media_device_register()
    - media: v4l2-tpg: fix some memleaks in tpg_alloc
    - media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
    - media: edia: dvbdev: fix a use-after-free
    - pinctrl: mediatek: Drop bogus slew rate register range for MT8192
    - clk: qcom: reset: Commonize the de/assert functions
    - clk: qcom: reset: Ensure write completion on reset de/assertion
    - quota: simplify drop_dquot_ref()
    - quota: Fix potential NULL pointer dereference
    - quota: Fix rcu annotations of inode dquot pointers
    - PCI/P2PDMA: Fix a sleeping issue in a RCU read section
    - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
    - crypto: xilinx - call finalize with bh disabled
    - perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
    - drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
    - ALSA: seq: fix function cast warnings
    - perf stat: Avoid metric-only segv
    - ASoC: meson: Use dev_err_probe() helper
    - ASoC: meson: aiu: fix function pointer type mismatch
    - ASoC: meson: t9015: fix function pointer type mismatch
    - powerpc: Force inlining of arch_vmap_p{u/m}d_supported()
    - PCI: endpoint: Support NTB transfer between RC and EP
    - [Config]: update CONFIG_PCI_EPF_VNTB
    - NTB: EPF: fix possible memory leak in pci_vntb_probe()
    - NTB: fix possible name leak in ntb_register_device()
    - media: sun8i-di: Fix coefficient writes
    - media: sun8i-di: Fix power on/off sequences
    - media: sun8i-di: Fix chroma difference threshold
    - media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
    - media: go7007: add check of return value of go7007_read_addr()
    - media: pvrusb2: remove redundant NULL check
    - media: pvrusb2: fix pvr2_stream_callback casts
    - clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
    - drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
    - PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
    - clk: hisilicon: hi3519: Release the correct number of gates in
      hi3519_clk_unregister()
    - clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
    - drm/tegra: put drm_gem_object ref on error in tegra_fb_create
    - mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
    - mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a
      ref
    - crypto: arm/sha - fix function cast warnings
    - drm/tidss: Fix initial plane zpos values
    - mtd: maps: physmap-core: fix flash size larger than 32-bit
    - mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
    - ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
    - ASoC: meson: axg-tdm-interface: add frame rate constraint
    - HID: amd_sfh: Update HPD sensor structure elements
    - drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
    - media: pvrusb2: fix uaf in pvr2_context_set_notify
    - media: dvb-frontends: avoid stack overflow warnings with clang
    - media: go7007: fix a memleak in go7007_load_encoder
    - media: ttpci: fix two memleaks in budget_av_attach
    - media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
    - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
    - powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
    - drm/msm/dpu: add division of drm_display_mode's hskew parameter
    - module: Add support for default value for module async_probe
    - modules: wait do_free_init correctly
    - powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
    - leds: aw2013: Unlock mutex before destroying it
    - leds: sgm3140: Add missing timer cleanup and flash gpio control
    - backlight: lm3630a: Initialize backlight_properties on init
    - backlight: lm3630a: Don't set bl->props.brightness in get_brightness
    - backlight: da9052: Fully initialize backlight_properties during probe
    - backlight: lm3639: Fully initialize backlight_properties during probe
    - backlight: lp8788: Fully initialize backlight_properties during probe
    - sparc32: Fix section mismatch in leon_pci_grpci
    - clk: Fix clk_core_get NULL dereference
    - clk: zynq: Prevent null pointer dereference caused by kmalloc failure
    - ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
    - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
    - RDMA/srpt: Do not register event handler until srpt device is fully setup
    - f2fs: multidevice: support direct IO
    - f2fs: invalidate META_MAPPING before IPU/DIO write
    - f2fs: replace congestion_wait() calls with io_schedule_timeout()
    - f2fs: fix to invalidate META_MAPPING before DIO write
    - f2fs: invalidate meta pages only for post_read required inode
    - f2fs: reduce stack memory cost by using bitfield in struct f2fs_io_info
    - f2fs: compress: fix to cover normal cluster write with cp_rwsem
    - f2fs: compress: fix to check unreleased compressed cluster
    - scsi: csiostor: Avoid function pointer casts
    - RDMA/device: Fix a race between mad_client and cm_client init
    - RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
    - scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
    - net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
    - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
    - NFSv4.2: fix listxattr maximum XDR buffer size
    - watchdog: stm32_iwdg: initialize default timeout
    - NFS: Fix an off by one in root_nfs_cat()
    - f2fs: compress: fix reserve_cblocks counting error when out of space
    - afs: Revert "afs: Hide silly-rename files from userspace"
    - comedi: comedi_test: Prevent timers rescheduling during deletion
    - remoteproc: stm32: use correct format strings on 64-bit
    - remoteproc: stm32: Fix incorrect type in assignment for va
    - remoteproc: stm32: Fix incorrect type assignment returned by
      stm32_rproc_get_loaded_rsc_tablef
    - tty: vt: fix 20 vs 0x20 typo in EScsiignore
    - serial: max310x: fix syntax error in IRQ error message
    - tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
    - arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells
    - kconfig: fix infinite loop when expanding a macro at the end of file
    - rtc: mt6397: select IRQ_DOMAIN instead of depending on it
    - serial: 8250_exar: Don't remove GPIO device on suspend
    - staging: greybus: fix get_channel_from_mode() failure path
    - usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
    - io_uring: don't save/restore iowait state
    - nouveau: reset the bo resource bus info after an eviction
    - octeontx2-af: Use matching wake_up API variant in CGX command interface
    - s390/vtime: fix average steal time calculation
    - soc: fsl: dpio: fix kcalloc() argument order
    - hsr: Fix uninit-value access in hsr_get_node()
    - net: mtk_eth_soc: move MAC_MCR setting to mac_finish()
    - net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up
    - net: ethernet: mtk_eth_soc: fix PPE hanging issue
    - packet: annotate data-races around ignore_outgoing
    - net: veth: do not manipulate GRO when using XDP
    - net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
    - vdpa/mlx5: Allow CVQ size changes
    - wireguard: receive: annotate data-race around receiving_counter.counter
    - rds: introduce acquire/release ordering in acquire/release_in_xmit()
    - hsr: Handle failures in module init
    - net: phy: fix phy_read_poll_timeout argument type in genphy_loopback
    - net/bnx2x: Prevent access to a freed page in page_pool
    - octeontx2-af: Use separate handlers for interrupts
    - netfilter: nf_tables: do not compare internal table flags on updates
    - rcu: add a helper to report consolidated flavor QS
    - net: report RCU QS on threaded NAPI repolling
    - bpf: report RCU QS in cpumap kthread
    - net: dsa: mt7530: fix handling of LLDP frames
    - net: dsa: mt7530: fix handling of 802.1X PAE frames
    - net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports
    - net: dsa: mt7530: fix handling of all link-local frames
    - spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
    - regmap: Add missing map->bus check
    - remoteproc: stm32: fix incorrect optional pointers

  * Jammy update: v5.15.152 upstream stable release (LP: #2063276)
    - mmc: mmci: stm32: use a buffer for unaligned DMA requests
    - mmc: mmci: stm32: fix DMA API overlapping mappings warning
    - net: lan78xx: fix runtime PM count underflow on link stop
    - ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
    - i40e: disable NAPI right after disabling irqs when handling xsk_pool
    - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string
    - geneve: make sure to pull inner header in geneve_rx()
    - net: sparx5: Fix use after free inside sparx5_del_mact_entry
    - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
    - net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
    - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
    - net/rds: fix WARNING in rds_conn_connect_if_down
    - netfilter: nft_ct: fix l3num expectations with inet pseudo family
    - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
    - erofs: apply proper VMA alignment for memory mapped files on THP
    - netrom: Fix a data-race around sysctl_netrom_default_path_quality
    - netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
    - netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
    - netrom: Fix a data-race around sysctl_netrom_transport_timeout
    - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
    - netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
    - netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
    - netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
    - netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
    - netrom: Fix a data-race around sysctl_netrom_routing_control
    - netrom: Fix a data-race around sysctl_netrom_link_fails_count
    - netrom: Fix data-races around sysctl_net_busy_read
    - ALSA: usb-audio: Refcount multiple accesses on the single clock
    - ALSA: usb-audio: Clear fixed clock rate at closing EP
    - ALSA: usb-audio: Split endpoint setups for hw_params and prepare (take#2)
    - ALSA: usb-audio: Properly refcounting clock rate
    - ALSA: usb-audio: Apply mutex around snd_usb_endpoint_set_params()
    - ALSA: usb-audio: Correct the return code from snd_usb_endpoint_set_params()
    - ALSA: usb-audio: Avoid superfluous endpoint setup
    - ALSA: usb-audio: Add quirk for Tascam Model 12
    - ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless
    - ALSA: usb-audio: Fix microphone sound on Nexigo webcam.
    - ALSA: usb-audio: add quirk for RODE NT-USB+
    - drm/amd/display: Fix uninitialized variable usage in core_link_ 'read_dpcd()
      & write_dpcd()' functions
    - nfp: flower: add goto_chain_index for ct entry
    - nfp: flower: add hardware offload check for post ct entry
    - selftests/mm: switch to bash from sh
    - selftests: mm: fix map_hugetlb failure on 64K page size systems
    - xhci: process isoc TD properly when there was a transaction error mid TD.
    - xhci: handle isoc Babble and Buffer Overrun events properly
    - serial: max310x: use regmap methods for SPI batch operations
    - serial: max310x: use a separate regmap for each port
    - serial: max310x: prevent infinite while() loop in port startup
    - drm/amd/pm: do not expose the API used internally only in kv_dpm.c
    - drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
    - selftests: mptcp: decrease BW in simult flows
    - hv_netvsc: use netif_is_bond_master() instead of open code
    - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
    - drm/amd/display: Re-arrange FPU code structure for dcn2x
    - drm/amd/display: move calcs folder into DML
    - drm/amd/display: remove DML Makefile duplicate lines
    - drm/amd/display: Increase frame-larger-than for all display_mode_vba files
    - getrusage: add the "signal_struct *sig" local variable
    - getrusage: move thread_group_cputime_adjusted() outside of
      lock_task_sighand()
    - getrusage: use __for_each_thread()
    - getrusage: use sig->stats_lock rather than lock_task_sighand()
    - proc: Use task_is_running() for wchan in /proc/$pid/stat
    - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of
      lock_task_sighand()
    - ALSA: usb-audio: Fix wrong kfree issue in snd_usb_endpoint_free_all
    - ALSA: usb-audio: Always initialize fixed_rate in
      snd_usb_find_implicit_fb_sync_format()
    - ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum610 Wireless
    - ALSA: usb-audio: Sort quirk table entries
    - regmap: allow to define reg_update_bits for no bus configuration
    - regmap: Add bulk read/write callbacks into regmap_config
    - serial: max310x: make accessing revision id interface-agnostic
    - serial: max310x: fix IO data corruption in batched operations
    - Linux 5.15.152

  * CVE-2024-26809
    - netfilter: nft_set_pipapo: release elements in clone only from destroy path

  * CVE-2024-26792
    - btrfs: fix double free of anonymous device after snapshot creation failure

  * CVE-2023-52530
    - wifi: mac80211: fix potential key use-after-free

  * CVE-2023-52447
    - bpf: Defer the free of inner map when necessary
    - rcu-tasks: Provide rcu_trace_implies_rcu_gp()

  * Avoid creating non-working backlight sysfs knob from ASUS board
    (LP: #2060422)
    - platform/x86: asus-wmi: Consider device is absent when the read is ~0

  * [Ubuntu 22.04.4/linux-image-6.5.0-26-generic] Kernel output "UBSAN: array-
    index-out-of-bounds in /build/linux-hwe-6.5-34pCLi/linux-
    hwe-6.5-6.5.0/drivers/net/hyperv/netvsc.c:1445:41" multiple times,
    especially during boot. (LP: #2058477)
    - hv: hyperv.h: Replace one-element array with flexible-array member

  * Jammy update: v5.15.151 upstream stable release (LP: #2060209)
    - netfilter: nf_tables: disallow timeout for anonymous sets
    - mtd: spinand: gigadevice: Fix the get ecc status issue
    - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
    - net: ip_tunnel: prevent perpetual headroom growth
    - tun: Fix xdp_rxq_info's queue_index when detaching
    - cpufreq: intel_pstate: fix pstate limits enforcement for adjust_perf call
      back
    - net: veth: clear GRO when clearing XDP even when down
    - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
    - lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is
      detected
    - net: enable memcg accounting for veth queues
    - veth: try harder when allocating queue memory
    - net: usb: dm9601: fix wrong return value in dm9601_mdio_read
    - uapi: in6: replace temporary label with rfc9486
    - stmmac: Clear variable when destroying workqueue
    - Bluetooth: Avoid potential use-after-free in hci_error_reset
    - Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR
    - netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
    - netfilter: nfnetlink_queue: silence bogus compiler warning
    - netfilter: core: move ip_ct_attach indirection to struct nf_ct_hook
    - netfilter: make function op structures const
    - netfilter: let reset rules clean out conntrack entries
    - netfilter: bridge: confirm multicast packets before passing them up the
      stack
    - rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
    - igb: extend PTP timestamp adjustments to i211
    - efi/capsule-loader: fix incorrect allocation size
    - power: supply: bq27xxx-i2c: Do not free non existing IRQ
    - ALSA: Drop leftover snd-rtctimer stuff from Makefile
    - fbcon: always restore the old font data in fbcon_do_set_font()
    - afs: Fix endless loop in directory parsing
    - riscv: Sparse-Memory/vmemmap out-of-bounds fix
    - ALSA: firewire-lib: fix to check cycle continuity
    - gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
    - wifi: nl80211: reject iftype change with mesh ID change
    - btrfs: dev-replace: properly validate device names
    - dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
    - dmaengine: ptdma: use consistent DMA masks
    - dmaengine: fsl-qdma: init irq after reg initialization
    - mmc: core: Fix eMMC initialization with 1-bit bus connection
    - mmc: sdhci-xenon: add timeout for PHY init complete
    - mmc: sdhci-xenon: fix PHY init clock stability
    - pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation
    - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers
    - mptcp: move __mptcp_error_report in protocol.c
    - mptcp: process pending subflow error on close
    - mptcp: rename timer related helper to less confusing names
    - selftests: mptcp: add missing kconfig for NF Filter
    - selftests: mptcp: add missing kconfig for NF Filter in v6
    - mptcp: clean up harmless false expressions
    - mptcp: add needs_id for netlink appending addr
    - mptcp: push at DSS boundaries
    - mptcp: fix possible deadlock in subflow diag
    - cachefiles: fix memory leak in cachefiles_add_cache()
    - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
    - Revert "drm/bridge: lt8912b: Register and attach our DSI device at probe"
    - af_unix: Drop oob_skb ref before purging queue in GC.
    - gpio: 74x164: Enable output pins after registers are reset
    - gpiolib: Fix the error path order in gpiochip_add_data_with_key()
    - gpio: fix resource unwinding order in error path
    - Revert "interconnect: Fix locking for runpm vs reclaim"
    - Revert "interconnect: Teach lockdep about icc_bw_lock order"
    - bpf: Add BPF_FIB_LOOKUP_SKIP_NEIGH for bpf_fib_lookup
    - bpf: Add table ID to bpf_fib_lookup BPF helper
    - bpf: Derive source IP addr via bpf_*_fib_lookup()
    - Linux 5.15.151

  * Jammy update: v5.15.151 upstream stable release (LP: #2060209) //
    CVE-2024-26782
    - mptcp: fix double-free on socket dismantle

  * Jammy update: v5.15.151 upstream stable release (LP: #2060209) // Fix
    bluetooth connections with 3.0 device (LP: #2063067)
    - Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST

  * Jammy update: v5.15.150 upstream stable release (LP: #2060142)
    - net/sched: Retire CBQ qdisc
    - [Config] updateconfigs for NET_SCH_CBQ
    - net/sched: Retire ATM qdisc
    - [Config] updateconfigs for NET_SCH_ATM
    - net/sched: Retire dsmark qdisc
    - [Config] updateconfigs for NET_SCH_DSMARK
    - smb: client: fix potential OOBs in smb2_parse_contexts()
    - smb: client: fix parsing of SMB3.1.1 POSIX create context
    - sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
    - PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq()
    - bpf: Merge printk and seq_printf VARARG max macros
    - bpf: Add struct for bin_args arg in bpf_bprintf_prepare
    - bpf: Do cleanup in bpf_bprintf_cleanup only when needed
    - bpf: Remove trace_printk_lock
    - userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
    - zonefs: Improve error handling
    - x86/fpu: Stop relying on userspace for info to fault in xsave buffer
    - sched/rt: Fix sysctl_sched_rr_timeslice intial value
    - sched/rt: Disallow writing invalid values to sched_rt_period_us
    - scsi: target: core: Add TMF to tmr_list handling
    - dmaengine: shdma: increase size of 'dev_id'
    - dmaengine: fsl-qdma: increase size of 'irq_name'
    - wifi: cfg80211: fix missing interfaces when dumping
    - wifi: mac80211: fix race condition on enabling fast-xmit
    - fbdev: savage: Error out if pixclock equals zero
    - fbdev: sis: Error out if pixclock equals zero
    - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
    - ahci: asm1166: correct count of reported ports
    - ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
    - MIPS: reserve exception vector space ONLY ONCE
    - platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet
    - ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap
      corrupt
    - ext4: avoid allocating blocks from corrupted group in
      ext4_mb_try_best_found()
    - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
    - dmaengine: ti: edma: Add some null pointer checks to the edma_probe
    - regulator: pwm-regulator: Add validity checks in continuous .get_voltage
    - nvmet-tcp: fix nvme tcp ida memory leak
    - ALSA: usb-audio: Check presence of valid altsetting control
    - ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
    - spi: sh-msiof: avoid integer overflow in constants
    - Input: xpad - add Lenovo Legion Go controllers
    - netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in
      sctp_new
    - ALSA: usb-audio: Ignore clock selector errors for single connection
    - nvme-fc: do not wait in vain when unloading module
    - nvmet-fcloop: swap the list_add_tail arguments
    - nvmet-fc: release reference on target port
    - nvmet-fc: defer cleanup using RCU properly
    - nvmet-fc: hold reference on hostport match
    - nvmet-fc: abort command when there is no binding
    - nvmet-fc: avoid deadlock on delete association path
    - nvmet-fc: take ref count on tgtport before delete assoc
    - ext4: correct the hole length returned by ext4_map_blocks()
    - Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table
    - fs/ntfs3: Modified fix directory element type detection
    - fs/ntfs3: Improve ntfs_dir_count
    - fs/ntfs3: Correct hard links updating when dealing with DOS names
    - fs/ntfs3: Print warning while fixing hard links count
    - fs/ntfs3: Fix detected field-spanning write (size 8) of single field
      "le->name"
    - fs/ntfs3: Add NULL ptr dereference checking at the end of
      attr_allocate_frame()
    - fs/ntfs3: Disable ATTR_LIST_ENTRY size check
    - fs/ntfs3: use non-movable memory for ntfs3 MFT buffer cache
    - fs/ntfs3: Prevent generic message "attempt to access beyond end of device"
    - fs/ntfs3: Correct function is_rst_area_valid
    - fs/ntfs3: Update inode->i_size after success write into compressed file
    - fs/ntfs3: Fix oob in ntfs_listxattr
    - wifi: mac80211: adding missing drv_mgd_complete_tx() call
    - efi: runtime: Fix potential overflow of soft-reserved region size
    - efi: Don't add memblocks for soft-reserved memory
    - hwmon: (coretemp) Enlarge per package core count limit
    - scsi: lpfc: Use unsigned type for num_sge
    - firewire: core: send bus reset promptly on gap count error
    - drm/amdgpu: skip to program GFXDEC registers for suspend abort
    - drm/amdgpu: reset gpu for s3 suspend abort case
    - virtio-blk: Ensure no requests in virtqueues before deleting vqs.
    - pmdomain: mediatek: fix race conditions with genpd
    - ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails
    - pmdomain: renesas: r8a77980-sysc: CR7 must be always on
    - erofs: fix lz4 inplace decompression
    - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
    - drm/ttm: Fix an invalid freeing on already freed page in error path
    - dm-crypt: don't modify the data when using authenticated encryption
    - platform/x86: intel-vbtn: Stop calling "VBDL" from notify_handler
    - platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names
    - KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
    - KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
    - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
    - PCI/MSI: Prevent MSI hardware interrupt number truncation
    - l2tp: pass correct message length to ip6_append_data
    - ARM: ep93xx: Add terminator to gpiod_lookup_table
    - Revert "x86/ftrace: Use alternative RET encoding"
    - x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR
    - x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch()
    - x86/ftrace: Use alternative RET encoding
    - x86/returnthunk: Allow different return thunks
    - Revert "x86/alternative: Make custom return thunk unconditional"
    - x86/alternative: Make custom return thunk unconditional
    - serial: amba-pl011: Fix DMA transmission in RS485 mode
    - usb: dwc3: gadget: Don't disconnect if not started
    - usb: cdnsp: blocked some cdns3 specific code
    - usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers
    - usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
    - usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
    - usb: roles: fix NULL pointer issue when put module's reference
    - usb: roles: don't get/set_role() when usb_role_switch is unregistered
    - mptcp: fix lockless access in subflow ULP diag
    - clk: imx: imx8mp: add shared clk gate for usb suspend clk
    - clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents
    - clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents
    - mtd: rawnand: sunxi: Fix the size of the last OOB region
    - RISC-V: fix funct4 definition for c.jalr in parse_asm.h
    - Input: iqs269a - drop unused device node references
    - Input: iqs269a - configure device with a single block write
    - Input: iqs269a - increase interrupt handler return delay
    - clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed
    - Input: ads7846 - don't report pressure for ads7845
    - clk: renesas: cpg-mssr: Remove superfluous check in resume code
    - clk: imx: avoid memory leak
    - Input: ads7846 - always set last command to PWRDOWN
    - Input: ads7846 - don't check penirq immediately for 7845
    - powerpc/powernv/ioda: Skip unallocated resources when mapping to PE
    - clk: qcom: gpucc-sc7180: fix clk_dis_wait being programmed for CX GDSC
    - clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC
    - clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
    - powerpc/pseries/lparcfg: add missing RTAS retry status handling
    - powerpc/perf/hv-24x7: add missing RTAS retry status handling
    - powerpc/pseries/lpar: add missing RTAS retry status handling
    - MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set
    - MIPS: vpe-mt: drop physical_memsize
    - vdpa/mlx5: Don't clear mr struct on destroy MR
    - ARM: dts: BCM53573: Drop nonexistent #usb-cells
    - RDMA/siw: Balance the reference of cep->kref in the error path
    - RDMA/siw: Correct wrong debug message
    - clk: linux/clk-provider.h: fix kernel-doc warnings and typos
    - platform/x86: asus-wmi: Document the dgpu_disable sysfs attribute
    - acpi: property: Let args be NULL in __acpi_node_get_property_reference
    - ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger
    - tools headers UAPI: Sync linux/fscrypt.h with the kernel sources
    - perf beauty: Update copy of linux/socket.h with the kernel sources
    - tools/virtio: fix build
    - drm/amdgpu: init iommu after amdkfd device init
    - f2fs: don't set GC_FAILURE_PIN for background GC
    - f2fs: write checkpoint during FG_GC
    - drm/i915/dg1: Update DMC_DEBUG3 register
    - kernel/sched: Remove dl_boosted flag comment
    - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl()
    - serial: 8250: Remove serial_rs485 sanitization from em485
    - clk: imx8mp: Add DISP2 pixel clock
    - clk: imx8mp: add clkout1/2 support
    - dt-bindings: clocks: imx8mp: Add ID for usb suspend clock
    - net: ethernet: ti: add missing of_node_put before return
    - powerpc/rtas: make all exports GPL
    - powerpc/rtas: ensure 4KB alignment for rtas_data_buf
    - powerpc/eeh: Small refactor of eeh_handle_normal_event()
    - powerpc/eeh: Set channel state after notifying the drivers
    - PM: core: Redefine pm_ptr() macro
    - PM: core: Add new *_PM_OPS macros, deprecate old ones
    - mmc: jz4740: Use the new PM macros
    - mmc: mxc: Use the new PM macros
    - PM: core: Remove static qualifier in DEFINE_SIMPLE_DEV_PM_OPS macro
    - Input: iqs269a - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr()
    - Input: iqs269a - do not poll during suspend or resume
    - Input: iqs269a - do not poll during ATI
    - net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs
    - netfilter: nf_tables: add rescheduling points during loop detection walks
    - debugobjects: Recheck debug_objects_enabled before reporting
    - nbd: Add the maximum limit of allocated index in nbd_dev_add
    - md: fix data corruption for raid456 when reshape restart while grow up
    - md/raid10: prevent soft lockup while flush writes
    - posix-timers: Ensure timer ID search-loop limit is valid
    - btrfs: add xxhash to fast checksum implementations
    - ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A
    - ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3
    - ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371
      AMD version)
    - arm64: set __exception_irq_entry with __irq_entry as a default
    - arm64: mm: fix VA-range sanity check
    - sched/fair: Don't balance task to its current running CPU
    - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel
      range
    - bpf: Address KCSAN report on bpf_lru_list
    - devlink: report devlink_port_type_warn source device
    - wifi: wext-core: Fix -Wstringop-overflow warning in
      ioctl_standard_iw_point()
    - wifi: iwlwifi: mvm: avoid baid size integer overflow
    - exfat: support dynamic allocate bh for exfat_entry_set_cache
    - arm64: dts: rockchip: fix regulator name on rk3399-rock-4
    - arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4
    - arm64: dts: rockchip: add SPDIF node for ROCK Pi 4
    - ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
    - ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2
    - ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
    - ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
    - ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
    - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
    - xhci: cleanup xhci_hub_control port references
    - xhci: move port specific items such as state completions to port structure
    - xhci: rename resume_done to resume_timestamp
    - xhci: clear usb2 resume related variables in one place.
    - xhci: decouple usb2 port resume and get_port_status request handling
    - xhci: track port suspend state correctly in unsuccessful resume cases
    - cifs: add a warning when the in-flight count goes negative
    - IB/hfi1: Fix a memleak in init_credit_return
    - RDMA/bnxt_re: Return error for SRQ resize
    - RDMA/irdma: Fix KASAN issue with tasklet
    - RDMA/irdma: Validate max_send_wr and max_recv_wr
    - RDMA/irdma: Set the CQ read threshold for GEN 1
    - RDMA/irdma: Add AE for too many RNRS
    - RDMA/srpt: Support specifying the srpt_service_guid parameter
    - RDMA/qedr: Fix qedr_create_user_qp error flow
    - arm64: dts: rockchip: set num-cs property for spi on px30
    - RDMA/srpt: fix function pointer cast warnings
    - bpf, scripts: Correct GPL license name
    - scsi: jazz_esp: Only build if SCSI core is builtin
    - nouveau: fix function cast warnings
    - net: stmmac: Fix incorrect dereference in interrupt handlers
    - ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
    - ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
    - ata: libahci_platform: Convert to using devm bulk clocks API
    - ata: libahci_platform: Introduce reset assertion/deassertion methods
    - ata: ahci_ceva: fix error handling for Xilinx GT PHY support
    - bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel
    - drm/nouveau/instmem: fix uninitialized_var.cocci warning
    - octeontx2-af: Consider the action set by PF
    - s390: use the correct count for __iowrite64_copy()
    - netfilter: nf_tables: set dormant flag on hook register failure
    - netfilter: flowtable: simplify route logic
    - netfilter: nft_flow_offload: reset dst in route object after setting up flow
    - netfilter: nft_flow_offload: release dst in case direct xmit path is used
    - drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
    - drm/amd/display: Fix memory leak in dm_sw_fini()
    - i2c: imx: Add timer for handling the stop condition
    - i2c: imx: when being a target, mark the last read as processed
    - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
    - netfilter: nf_tables: fix scheduling-while-atomic splat
    - ext4: regenerate buddy after block freeing failed if under fc replay
    - ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks()
    - netfilter: nf_tables: can't schedule in nft_chain_validate
    - r8169: use new PM macros
    - Linux 5.15.150

  * Jammy update: v5.15.150 upstream stable release (LP: #2060142) //
    CVE-2024-26733
    - packet: move from strlcpy with unused retval to strscpy
    - net: dev: Convert sa_data to flexible array in struct sockaddr
    - arp: Prevent overflow in arp_req_get().

  * Jammy update: v5.15.150 upstream stable release (LP: #2060142) //
    CVE-2024-26735
    - ipv6: sr: fix possible use-after-free and null-ptr-deref

  * Jammy update: v5.15.150 upstream stable release (LP: #2060142) //
    CVE-2024-26736
    - afs: Increase buffer size in afs_update_volume_status()

  * Jammy update: v5.15.150 upstream stable release (LP: #2060142) //
    CVE-2024-26748
    - usb: cdns3: fix memory double free when handle zero packet

  * CVE-2023-47233
    - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach

  * CVE-2024-26584
    - net: tls: handle backlogging of crypto requests

  * CVE-2024-26585
    - tls: fix race between tx work scheduling and socket close

  * CVE-2024-26583
    - tls: rx: jump to a more appropriate label
    - tls: rx: drop pointless else after goto
    - tls: stop recv() if initial process_rx_list gave us non-DATA
    - tls: rx: don't store the record type in socket context
    - tls: rx: don't store the decryption status in socket context
    - tls: rx: don't issue wake ups when data is decrypted
    - tls: rx: refactor decrypt_skb_update()
    - tls: hw: rx: use return value of tls_device_decrypted() to carry status
    - tls: rx: drop unnecessary arguments from tls_setup_from_iter()
    - tls: rx: don't report text length from the bowels of decrypt
    - tls: rx: wrap decryption arguments in a structure
    - tls: rx: factor out writing ContentType to cmsg
    - tls: rx: don't track the async count
    - tls: rx: move counting TlsDecryptErrors for sync
    - tls: rx: assume crypto always calls our callback
    - tls: rx: use async as an in-out argument
    - tls: decrement decrypt_pending if no async completion will be called
    - net: tls: fix async vs NIC crypto offload
    - Revert "tls: rx: move counting TlsDecryptErrors for sync"
    - tls: rx: simplify async wait
    - tls: rx: return the already-copied data on crypto error
    - tls: rx: allow only one reader at a time
    - tls: rx: release the sock lock on locking timeout
    - tls: extract context alloc/initialization out of tls_set_sw_offload
    - net: tls: factor out tls_*crypt_async_wait()
    - tls: fix race between async notify and socket close

  * CVE-2024-26622
    - tomoyo: fix UAF write bug in tomoyo_write_control()

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Fri, 26 Apr 2024 13:29:50 +0200

linux (5.15.0-106.116) jammy; urgency=medium

  * jammy/linux: 5.15.0-106.116 -proposed tracker (LP: #2061812)

  * CVE-2024-2201
    - x86/bugs: Use sysfs_emit()
    - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs
    - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace
    - KVM: x86: Use a switch statement and macros in __feature_translate()
    - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file
    - x86/syscall: Don't force use of indirect calls for system calls
    - x86/bhi: Add support for clearing branch history at syscall entry
    - x86/bhi: Define SPEC_CTRL_BHI_DIS_S
    - x86/bhi: Enumerate Branch History Injection (BHI) bug
    - x86/bhi: Add BHI mitigation knob
    - x86/bhi: Mitigate KVM by default
    - KVM: x86: Add BHI_NO
    - [Config] Set CONFIG_BHI to enabled (auto)

  * Drop fips-checks script from trees (LP: #2055083)
    - [Packaging] Remove fips-checks script

  * alsa/realtek: adjust max output valume for headphone on 2 LG machines
    (LP: #2058573)
    - ALSA: hda/realtek: fix the hp playback volume issue for LG machines

  * A general-proteciton exception during guest migration to unsupported PKRU
    machine (LP: #2032164)
    - x86/fpu: Allow caller to constrain xfeatures when copying to uabi buffer
    - KVM: x86: Constrain guest-supported xfeatures only at KVM_GET_XSAVE{2}

  *  [ICX] [SPR] [ipc/msg] performance: Mitigate the lock contention with percpu
    counter (LP: #2058485)
    - ipc: check checkpoint_restore_ns_capable() to modify C/R proc files
    - ipc/ipc_sysctl.c: remove fallback for !CONFIG_PROC_SYSCTL
    - ipc: Store mqueue sysctls in the ipc namespace
    - ipc: Store ipc sysctls in the ipc namespace
    - ipc: Use the same namespace to modify and validate
    - ipc: Remove extra1 field abuse to pass ipc namespace
    - ipc: Check permissions for checkpoint_restart sysctls at open time
    - percpu: add percpu_counter_add_local and percpu_counter_sub_local
    - ipc/msg: mitigate the lock contention with percpu counter

  * Jammy update: v5.15.149 upstream stable release (LP: #2059014)
    - ksmbd: free ppace array on error in parse_dacl
    - ksmbd: don't allow O_TRUNC open on read-only share
    - ksmbd: validate mech token in session setup
    - ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
    - ksmbd: only v2 leases handle the directory
    - iio: adc: ad7091r: Set alert bit in config register
    - iio: adc: ad7091r: Allow users to configure device events
    - iio: adc: ad7091r: Enable internal vref if external vref is not supplied
    - dmaengine: fix NULL pointer in channel unregistration function
    - scsi: ufs: core: Simplify power management during async scan
    - scsi: ufs: core: Remove the ufshcd_hba_exit() call from ufshcd_async_scan()
    - iio:adc:ad7091r: Move exports into IIO_AD7091R namespace.
    - ext4: allow for the last group to be marked as trimmed
    - btrfs: sysfs: validate scrub_speed_max value
    - crypto: api - Disallow identical driver names
    - PM: hibernate: Enforce ordering during image compression/decompression
    - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
    - crypto: s390/aes - Fix buffer overread in CTR mode
    - media: imx355: Enable runtime PM before registering async sub-device
    - rpmsg: virtio: Free driver_override when rpmsg_remove()
    - media: ov9734: Enable runtime PM before registering async sub-device
    - mips: Fix max_mapnr being uninitialized on early stages
    - bus: mhi: host: Drop chan lock before queuing buffers
    - bus: mhi: host: Add spinlock to protect WP access when queueing TREs
    - parisc/firmware: Fix F-extend for PDC addresses
    - async: Split async_schedule_node_domain()
    - async: Introduce async_schedule_dev_nocall()
    - arm64: dts: qcom: sc7180: fix USB wakeup interrupt types
    - arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
    - arm64: dts: qcom: sm8150: fix USB wakeup interrupt types
    - arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
    - lsm: new security_file_ioctl_compat() hook
    - scripts/get_abi: fix source path leak
    - mmc: core: Use mrq.sbc in close-ended ffu
    - mmc: mmc_spi: remove custom DMA mapped buffers
    - rtc: Adjust failure return code for cmos_set_alarm()
    - nouveau/vmm: don't set addr on the fail path to avoid warning
    - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
    - rename(): fix the locking of subdirectories
    - ksmbd: set v2 lease version on lease upgrade
    - ksmbd: fix potential circular locking issue in smb2_set_ea()
    - ksmbd: don't increment epoch if current state and request state are same
    - ksmbd: send lease break notification on FILE_RENAME_INFORMATION
    - ksmbd: Add missing set_freezable() for freezable kthread
    - net/smc: fix illegal rmb_desc access in SMC-D connection dump
    - tcp: make sure init the accept_queue's spinlocks once
    - bnxt_en: Wait for FLR to complete during probe
    - vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
    - llc: make llc_ui_sendmsg() more robust against bonding changes
    - llc: Drop support for ETH_P_TR_802_2.
    - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
    - tracing: Ensure visibility when inserting an element into tracing_map
    - afs: Hide silly-rename files from userspace
    - tcp: Add memory barrier to tcp_push()
    - netlink: fix potential sleeping issue in mqueue_flush_file
    - ipv6: init the accept_queue's spinlocks in inet6_create
    - net/mlx5: DR, Use the right GVMI number for drop action
    - net/mlx5: DR, Align mlx5dv_dr API vport action with FW behavior
    - net/mlx5: DR, Can't go to uplink vport on RX rule
    - net/mlx5e: fix a double-free in arfs_create_groups
    - net/mlx5e: fix a potential double-free in fs_any_create_groups
    - overflow: Allow mixed type arguments
    - netfilter: nft_limit: reject configurations that cause integer overflow
    - netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
    - netfilter: nf_tables: validate NFPROTO_* family
    - net: stmmac: Wait a bit for the reset to take effect
    - net: mvpp2: clear BM pool before initialization
    - selftests: netdevsim: fix the udp_tunnel_nic test
    - fjes: fix memleaks in fjes_hw_setup
    - net: fec: fix the unhandled context fault from smmu
    - btrfs: fix infinite directory reads
    - btrfs: set last dir index to the current last index when opening dir
    - btrfs: refresh dir last index during a rewinddir(3) call
    - btrfs: fix race between reading a directory and adding entries to it
    - btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume
      being deleted
    - btrfs: ref-verify: free ref cache before clearing mount opt
    - btrfs: tree-checker: fix inline ref size in error messages
    - btrfs: don't warn if discard range is not aligned to sector
    - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
    - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
    - rbd: don't move requests to the running list on errors
    - exec: Fix error handling in begin_new_exec()
    - wifi: iwlwifi: fix a memory corruption
    - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes
    - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress
      basechain
    - firmware: arm_scmi: Check mailbox/SMT channel for consistency
    - xfs: read only mounts with fsopen mount API are busted
    - gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
    - drm: Don't unref the same fb many times by mistake due to deadlock handling
    - drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
    - drm/tidss: Fix atomic_flush check
    - drm/bridge: nxp-ptn3460: simplify some error checking
    - PM: core: Remove unnecessary (void *) conversions
    - PM: sleep: Fix possible deadlocks in core system-wide PM code
    - bus: mhi: host: Rename "struct mhi_tre" to "struct mhi_ring_element"
    - bus: mhi: host: Add alignment check for event ring read pointer
    - fs/pipe: move check to pipe_has_watch_queue()
    - pipe: wakeup wr_wait after setting max_usage
    - ARM: dts: qcom: sdx55: fix USB wakeup interrupt types
    - ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
    - ARM: dts: qcom: sdx55: fix pdc '#interrupt-cells'
    - ARM: dts: qcom: sdx55: fix USB DP/DM HS PHY interrupts
    - ARM: dts: qcom: sdx55: fix USB SS wakeup
    - media: mtk-jpeg: Fix use after free bug due to error path handling in
      mtk_jpeg_dec_device_run
    - mm: use __pfn_to_section() instead of open coding it
    - mm/sparsemem: fix race in accessing memory_section->usage
    - PM / devfreq: Fix buffer overflow in trans_stat_show
    - btrfs: add definition for EXTENT_TREE_V2
    - ksmbd: fix global oob in ksmbd_nl_policy
    - cpufreq: intel_pstate: Drop redundant intel_pstate_get_hwp_cap() call
    - cpufreq: intel_pstate: Refine computation of P-state for given frequency
    - drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
    - drm/exynos: fix accidental on-stack copy of exynos_drm_plane
    - drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
    - gpio: eic-sprd: Clear interrupt after set the interrupt type
    - spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
    - mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
    - tick/sched: Preserve number of idle sleeps across CPU hotplug events
    - x86/entry/ia32: Ensure s32 is sign extended to s64
    - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
    - arm64: irq: set the correct node for VMAP stack
    - drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
    - powerpc: Fix build error due to is_valid_bugaddr()
    - powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
    - powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping()
    - x86/boot: Ignore NMIs during very early boot
    - powerpc: pmd_move_must_withdraw() is only needed for
      CONFIG_TRANSPARENT_HUGEPAGE
    - powerpc/lib: Validate size for vector operations
    - x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
    - perf/core: Fix narrow startup race when creating the perf nr_addr_filters
      sysfs file
    - debugobjects: Stop accessing objects after releasing hash bucket lock
    - regulator: core: Only increment use_count when enable_count changes
    - audit: Send netlink ACK before setting connection in auditd_set
    - ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
    - PNP: ACPI: fix fortify warning
    - ACPI: extlog: fix NULL pointer dereference check
    - PM / devfreq: Synchronize devfreq_monitor_[start/stop]
    - ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous
      events
    - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
    - jfs: fix slab-out-of-bounds Read in dtSearch
    - jfs: fix array-index-out-of-bounds in dbAdjTree
    - pstore/ram: Fix crash when setting number of cpus to an odd number
    - crypto: octeontx2 - Fix cptvf driver cleanup
    - crypto: stm32/crc32 - fix parsing list of devices
    - afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
    - afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
    - rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
    - jfs: fix array-index-out-of-bounds in diNewExt
    - arch: consolidate arch_irq_work_raise prototypes
    - s390/ptrace: handle setting of fpc register correctly
    - KVM: s390: fix setting of fpc register
    - SUNRPC: Fix a suspicious RCU usage warning
    - ecryptfs: Reject casefold directory inodes
    - ext4: fix inconsistent between segment fstrim and full fstrim
    - ext4: unify the type of flexbg_size to unsigned int
    - ext4: remove unnecessary check from alloc_flex_gd()
    - ext4: avoid online resizing failures due to oversized flex bg
    - wifi: rt2x00: restart beacon queue when hardware reset
    - selftests/bpf: satisfy compiler by having explicit return in btf test
    - selftests/bpf: Fix pyperf180 compilation failure with clang18
    - selftests/bpf: Fix issues in setup_classid_environment()
    - scsi: lpfc: Fix possible file string name overflow when updating firmware
    - PCI: Add no PM reset quirk for NVIDIA Spectrum devices
    - bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
    - scsi: arcmsr: Support new PCI device IDs 1883 and 1886
    - ARM: dts: imx7d: Fix coresight funnel ports
    - ARM: dts: imx7s: Fix lcdif compatible
    - ARM: dts: imx7s: Fix nand-controller #size-cells
    - wifi: ath9k: Fix potential array-index-out-of-bounds read in
      ath9k_htc_txstatus()
    - bpf: Add map and need_defer parameters to .map_fd_put_ptr()
    - scsi: libfc: Don't schedule abort twice
    - scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
    - bpf: Set uattr->batch.count as zero before batched update or deletion
    - ARM: dts: rockchip: fix rk3036 hdmi ports node
    - ARM: dts: imx25/27-eukrea: Fix RTC node name
    - ARM: dts: imx: Use flash@0,0 pattern
    - ARM: dts: imx27: Fix sram node
    - ARM: dts: imx1: Fix sram node
    - ionic: pass opcode to devcmd_wait
    - block/rnbd-srv: Check for unlikely string overflow
    - ARM: dts: imx25: Fix the iim compatible string
    - ARM: dts: imx25/27: Pass timing0
    - ARM: dts: imx27-apf27dev: Fix LED name
    - ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
    - ARM: dts: imx23/28: Fix the DMA controller node name
    - net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
    - block: prevent an integer overflow in bvec_try_merge_hw_page
    - md: Whenassemble the array, consult the superblock of the freshest device
    - arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
    - arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
    - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
    - libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos
    - ALSA: usb-audio: Add delay quirk for MOTU M Series 2nd revision
    - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
    - wifi: cfg80211: free beacon_ies when overridden from hidden BSS
    - Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
    - Bluetooth: L2CAP: Fix possible multiple reject send
    - bridge: cfm: fix enum typo in br_cc_ccm_tx_parse
    - i40e: Fix VF disable behavior to block all traffic
    - octeontx2-af: Fix max NPC MCAM entry check while validating ref_entry
    - f2fs: fix to check return value of f2fs_reserve_new_block()
    - ALSA: hda: Refer to correct stream index at loops
    - ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
    - fast_dput(): handle underflows gracefully
    - RDMA/IPoIB: Fix error code return in ipoib_mcast_join
    - drm/amd/display: Fix tiled display misalignment
    - f2fs: fix write pointers on zoned device after roll forward
    - drm/drm_file: fix use of uninitialized variable
    - drm/framebuffer: Fix use of uninitialized variable
    - drm/mipi-dsi: Fix detach call without attach
    - media: stk1160: Fixed high volume of stk1160_dbg messages
    - media: rockchip: rga: fix swizzling for RGB formats
    - PCI: add INTEL_HDA_ARL to pci_ids.h
    - ALSA: hda: Intel: add HDA_ARL PCI ID support
    - ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL
    - media: rkisp1: Drop IRQF_SHARED
    - f2fs: fix to tag gcing flag on page during block migration
    - drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
    - IB/ipoib: Fix mcast list locking
    - media: ddbridge: fix an error code problem in ddb_probe
    - media: i2c: imx335: Fix hblank min/max values
    - drm/msm/dpu: Ratelimit framedone timeout msgs
    - drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap
    - clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
    - clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
    - watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
    - clk: imx: scu: Fix memory leak in __imx_clk_gpr_scu()
    - clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and phy clocks
    - drm/amdgpu: Let KFD sync with VM fences
    - drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
    - ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140
    - leds: trigger: panic: Don't register panic notifier if creating the trigger
      failed
    - um: Fix naming clash between UML and scheduler
    - um: Don't use vfprintf() for os_info()
    - um: net: Fix return type of uml_net_start_xmit()
    - um: time-travel: fix time corruption
    - i3c: master: cdns: Update maximum prescaler value for i2c clock
    - xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
    - mfd: ti_am335x_tscadc: Fix TI SoC dependencies
    - [Config] updateconfigs for MFD_TI_AM335X_TSCADC
    - mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt
    - PCI: Only override AMD USB controller if required
    - PCI: switchtec: Fix stdev_release() crash after surprise hot remove
    - perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is present
    - usb: hub: Replace hardcoded quirk value with BIT() macro
    - selftests/sgx: Fix linker script asserts
    - tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
    - fs/kernfs/dir: obey S_ISGID
    - PCI: Fix 64GT/s effective data rate calculation
    - PCI/AER: Decode Requester ID when no error info found
    - libsubcmd: Fix memory leak in uniq()
    - drm/amdkfd: Fix lock dependency warning
    - virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region
      of size 10" warnings
    - blk-mq: fix IO hang from sbitmap wakeup race
    - ceph: fix deadlock or deadcode of misusing dget()
    - drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in
      'get_platform_power_management_table()'
    - drm/amdgpu: Release 'adev->pm.fw' before return in
      'amdgpu_device_need_post()'
    - drm/amdkfd: Fix 'node' NULL check in 'svm_range_get_range_boundaries()'
    - perf: Fix the nr_addr_filters fix
    - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
    - drm: using mul_u32_u32() requires linux/math64.h
    - scsi: isci: Fix an error code problem in isci_io_request_build()
    - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
    - selftests: net: give more time for GRO aggregation
    - ip6_tunnel: use dev_sw_netstats_rx_add()
    - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
    - tcp: add sanity checks to rx zerocopy
    - ixgbe: Remove non-inclusive language
    - ixgbe: Refactor returning internal error codes
    - ixgbe: Refactor overtemp event handling
    - ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
    - ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
    - llc: call sock_orphan() at release time
    - bridge: mcast: fix disabled snooping after long uptime
    - netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
    - netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
    - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom
      expectations
    - net: ipv4: fix a memleak in ip_setup_cork
    - af_unix: fix lockdep positive in sk_diag_dump_icons()
    - SAUCE: Sync apparmor copy of af_unix.c
    - selftests: net: fix available tunnels detection
    - net: sysfs: Fix /sys/class/net/<iface> path
    - arm64: irq: set the correct node for shadow call stack
    - gve: Fix use-after-free vulnerability
    - HID: apple: Add support for the 2021 Magic Keyboard
    - HID: apple: Add 2021 magic keyboard FN key mapping
    - bonding: remove print in bond_verify_device_path
    - ASoC: codecs: lpass-wsa-macro: fix compander volume hack
    - dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools
    - dmaengine: ti: k3-udma: Report short packet errors
    - dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
    - dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
    - phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
    - dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
    - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
    - drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case
    - net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
    - selftests: net: cut more slack for gro fwd tests.
    - selftests: net: avoid just another constant wait
    - tunnels: fix out of bounds access when building IPv6 PMTU error
    - atm: idt77252: fix a memleak in open_card_ubr0
    - octeontx2-pf: Fix a memleak otx2_sq_init
    - hwmon: (aspeed-pwm-tacho) mutex for tach reading
    - hwmon: (coretemp) Fix out-of-bounds memory access
    - hwmon: (coretemp) Fix bogus core_id to attr name mapping
    - inet: read sk->sk_family once in inet_recv_error()
    - rxrpc: Fix response to PING RESPONSE ACKs to a dead call
    - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
    - af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.
    - ppp_async: limit MRU to 64K
    - netfilter: nft_compat: reject unused compat flag
    - netfilter: nft_compat: restrict match/target protocol to u16
    - drm/amd/display: Fix multiple memory leaks reported by coverity
    - drm/amd/display: Implement bounds check for stream encoder creation in
      DCN301
    - netfilter: nft_ct: reject direction for ct id
    - netfilter: nft_set_pipapo: store index in scratch maps
    - netfilter: nft_set_pipapo: add helper to release pcpu scratch area
    - netfilter: nft_set_pipapo: remove scratch_aligned pointer
    - fs/ntfs3: Fix an NULL dereference bug
    - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
    - blk-iocost: Fix an UBSAN shift-out-of-bounds warning
    - drivers: lkdtm: fix clang -Wformat warning
    - ALSA: usb-audio: Add a quirk for Yamaha YIT-W12TX transmitter
    - USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
    - USB: serial: option: add Fibocom FM101-GL variant
    - USB: serial: cp210x: add ID for IMST iM871A-USB
    - usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK
    - usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK
    - hrtimer: Report offline hrtimer enqueue
    - Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
    - Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
    - clocksource: Skip watchdog check for large watchdog intervals
    - net: stmmac: xgmac: use #define for string constants
    - net: stmmac: xgmac: fix a typo of register name in DPP safety handling
    - btrfs: forbid creating subvol qgroups
    - btrfs: forbid deleting live subvol qgroup
    - btrfs: send: return EOPNOTSUPP on unknown flags
    - of: unittest: Fix compile in the non-dynamic case
    - wifi: iwlwifi: Fix some error codes
    - net: openvswitch: limit the number of recursions from action sets
    - spi: ppc4xx: Drop write-only variable
    - ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
    - net: sysfs: Fix /sys/class/net/<iface> path for statistics
    - MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
    - i40e: Fix waiting for queues of all VSIs to be disabled
    - scs: add CONFIG_MMU dependency for vfree_atomic()
    - tracing/trigger: Fix to return error if failed to alloc snapshot
    - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
    - scsi: storvsc: Fix ring buffer size calculation
    - ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift
      1 SF114-32
    - ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx
    - HID: i2c-hid-of: fix NULL-deref on failed power up
    - HID: wacom: generic: Avoid reporting a serial of '0' to userspace
    - HID: wacom: Do not register input devices until after hid_hw_start
    - iio: hid-sensor-als: Return 0 for HID_USAGE_SENSOR_TIME_TIMESTAMP
    - usb: ucsi_acpi: Fix command completion handling
    - USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
    - usb: f_mass_storage: forbid async queue when shutdown happen
    - usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend
    - media: ir_toy: fix a memleak in irtoy_tx
    - powerpc/kasan: Fix addr error caused by page alignment
    - i2c: i801: Remove i801_set_block_buffer_mode
    - i2c: i801: Fix block process call transactions
    - modpost: trim leading spaces when processing source files list
    - mptcp: fix data re-injection from stale subflow
    - scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
    - Revert "drm/amd: flush any delayed gfxoff on suspend entry"
    - firewire: core: correct documentation of fw_csr_string() kernel API
    - kbuild: Fix changing ELF file type for output of gen_btf for big endian
    - nfc: nci: free rx_data_reassembly skb on NCI device cleanup
    - net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
    - xen-netback: properly sync TX responses
    - ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
    - ASoC: codecs: wcd938x: handle deferred probe
    - binder: signal epoll threads of self-work
    - misc: fastrpc: Mark all sessions as invalid in cb_remove
    - ext4: fix double-free of blocks due to wrong extents moved_len
    - tracing: Fix wasted memory in saved_cmdlines logic
    - staging: iio: ad5933: fix type mismatch regression
    - iio: magnetometer: rm3100: add boundary check for the value read from
      RM3100_REG_TMRC
    - iio: core: fix memleak in iio_device_register_sysfs
    - iio: accel: bma400: Fix a compilation problem
    - media: rc: bpf attach/detach requires write permission
    - drm/prime: Support page array >= 4GB
    - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
    - ring-buffer: Clean ring_buffer_poll_wait() error return
    - serial: max310x: set default value when reading clock ready bit
    - serial: max310x: improve crystal stable clock detection
    - serial: max310x: fail probe if clock crystal is unstable
    - powerpc/64: Set task pt_regs->link to the LR value on scv entry
    - x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
    - x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
    - mmc: slot-gpio: Allow non-sleeping GPIO ro
    - ALSA: hda/conexant: Add quirk for SWS JS201D
    - nilfs2: fix data corruption in dsync block recovery for small block sizes
    - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
    - crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
    - nfp: use correct macro for LengthSelect in BAR config
    - nfp: flower: prevent re-adding mac index for bonded port
    - wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
    - irqchip/irq-brcmstb-l2: Add write memory barrier before exit
    - irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update
    - net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio
    - s390/qeth: Fix potential loss of L3-IP@ in case of network issues
    - net: ethernet: ti: cpsw_new: enable mac_managed_pm to fix mdio
    - ceph: prevent use-after-free in encode_cap_msg()
    - mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE
    - of: property: fix typo in io-channels
    - can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock
    - can: j1939: Fix UAF in j1939_sk_match_filter during
      setsockopt(SO_J1939_FILTER)
    - pmdomain: core: Move the unused cleanup to a _sync initcall
    - tracing: Inform kmemleak of saved_cmdlines allocation
    - af_unix: Fix task hung while purging oob_skb in GC.
    - dma-buf: add dma_fence_timestamp helper
    - bus: moxtet: Add spi device table
    - crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
    - usb: dwc3: gadget: Wait for ep0 xfers to complete during dequeue
    - usb: dwc3: ep0: Don't prepare beyond Setup stage
    - usb: dwc3: gadget: Only End Transfer for ep0 data phase
    - usb: dwc3: gadget: Delay issuing End Transfer
    - usb: dwc3: Fix ep0 handling when getting reset while doing control transfer
    - usb: dwc3: gadget: Force sending delayed status during soft disconnect
    - usb: dwc3: gadget: Submit endxfer command if delayed during disconnect
    - usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive
    - usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API
    - usb: dwc3: gadget: Handle EP0 request dequeuing properly
    - usb: dwc3: gadget: Queue PM runtime idle on disconnect event
    - serial: 8250_exar: Fill in rs485_supported
    - serial: 8250_exar: Set missing rs485_supported flag
    - fbdev/defio: Early-out if page is already enlisted
    - fbdev: Don't sort deferred-I/O pages by default
    - fbdev: defio: fix the pagelist corruption
    - fbdev: Track deferred-I/O pages in pageref struct
    - fbdev: Rename pagelist to pagereflist for deferred I/O
    - fbdev: Fix invalid page access after closing deferred I/O devices
    - fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release()
    - fbdev: flush deferred IO before closing
    - scripts/decode_stacktrace.sh: support old bash version
    - scripts: decode_stacktrace: demangle Rust symbols
    - scripts/decode_stacktrace.sh: optionally use LLVM utilities
    - netfilter: ipset: fix performance regression in swap operation
    - hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range()
    - net: prevent mss overflow in skb_segment()
    - netfilter: ipset: Missing gc cancellations fixed
    - sched/membarrier: reduce the ability to hammer on sys_membarrier
    - nilfs2: fix potential bug in end_buffer_async_write
    - nilfs2: replace WARN_ONs for invalid DAT metadata block requests
    - arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata
    - PM: runtime: Have devm_pm_runtime_enable() handle
      pm_runtime_dont_use_autosuspend()
    - drm/msm/dsi: Enable runtime PM
    - net: bcmgenet: Fix EEE implementation
    - fs/ntfs3: Add null pointer checks
    - staging: fbtft: core: set smem_len before fb_deferred_io_init call
    - usb: dwc3: gadget: Don't delay End Transfer on delayed_status
    - usb: dwc3: gadget: Execute gadget stop after halting the controller
    - media: Revert "media: rkisp1: Drop IRQF_SHARED"
    - usb: dwc3: gadget: Ignore End Transfer delay on teardown
    - Linux 5.15.149

  * Fix headphone mic detection issue on ALC897 (LP: #2056418)
    - ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897
      platform

  * CVE-2023-6039
    - timers: Replace BUG_ON()s

  * Problems with HVCS and hotplugging (LP: #2056373)
    - hvcs: Fix hvcs port reference counting
    - hvcs: Use dev_groups to manage hvcs device attributes
    - hvcs: Use driver groups to manage driver attributes
    - hvcs: Get reference to tty in remove
    - hvcs: Use vhangup in hotplug remove
    - hvcs: Synchronize hotplug remove with port free

  * KVM: arm64: softlockups in stage2_apply_range (LP: #2056227)
    - KVM: arm64: Work out supported block level at compile time
    - KVM: arm64: Limit stage2_apply_range() batch size to largest block

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 16 Apr 2024 16:11:14 +0200

linux (5.15.0-105.115) jammy; urgency=medium

  * jammy/linux: 5.15.0-105.115 -proposed tracker (LP: #2061372)

  * Jammy update: v5.15.149 upstream stable release (LP: #2059014) // CIFS
    stopped working/is unstable with kernel update to 5.15.0-102.112
    (LP: #2060780)
    - smb3: Replace smb2pdu 1-element arrays with flex-arrays

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Mon, 15 Apr 2024 10:38:15 +0200

linux (5.15.0-103.113) jammy; urgency=medium

  * jammy/linux: 5.15.0-103.113 -proposed tracker (LP: #2059683)

  * Packaging resync (LP: #1786013)
    - [Packaging] drop getabis data

  * Remove getabis scripts (LP: #2059143)
    - [Packaging] Remove getabis

  * CVE-2023-24023
    - Bluetooth: Add more enc key size check

  * CVE-2023-52600
    - jfs: fix uaf in jfs_evict_inode

  * Jammy update: v5.15.149 upstream stable release (LP: #2059014) //
    CVE-2023-52603
    - UBSAN: array-index-out-of-bounds in dtSplitRoot

  * CVE-2024-26581
    - netfilter: nft_set_rbtree: skip end interval element from gc

 -- Manuel Diewald <manuel.diewald@canonical.com>  Thu, 28 Mar 2024 19:21:10 +0100

# For older changelog entries, run 'apt-get changelog linux-buildinfo-5.15.0-121-generic-64k'
