Kinetic update: upstream stable patchset 2023-01-27

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       upstream stable patchset 2023-01-27

                Ported from the following upstream stable releases:
                        v5.15.81, v6.0.11
                        v5.15.82, v6.0.12

       from git://git.kernel.org/

ASoC: fsl_sai: use local device pointer
serial: Add rs485_supported to uart_port
serial: fsl_lpuart: Fill in rs485_supported
x86/sgx: Create utility to validate user provided offset and length
x86/sgx: Add overflow check in sgx_validate_offset_length()
binder: validate alloc->mm in ->mmap() handler
ceph: Use kcalloc for allocating multiple elements
ceph: fix NULL pointer dereference for req->r_session
wifi: mac80211: fix memory free error when registering wiphy fail
wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
riscv: dts: sifive unleashed: Add PWM controlled LEDs
audit: fix undefined behavior in bit shift for AUDIT_BIT
wifi: airo: do not assign -1 to unsigned char
wifi: mac80211: Fix ack frame idr leak when mesh has no route
wifi: ath11k: Fix QCN9074 firmware boot on x86
spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run
selftests/bpf: Add verifier test for release_reference()
Revert "net: macsec: report real_dev features when HW offloading is enabled"
platform/x86: ideapad-laptop: Disable touchpad_switch
platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 2-in-1
platform/x86/intel/pmt: Sapphire Rapids PMT errata fix
scsi: ibmvfc: Avoid path failures during live migration
scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC
drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017)
block, bfq: fix null pointer dereference in bfq_bio_bfqg()
arm64/syscall: Include asm/ptrace.h in syscall_wrapper header.
nvmet: fix memory leak in nvmet_subsys_attr_model_store_locked
Revert "drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10 properly""
ALSA: usb-audio: add quirk to fix Hamedal C20 disconnect issue
RISC-V: vdso: Do not add missing symbols to version section in linker script
MIPS: pic32: treat port as signed integer
xfrm: fix "disable_policy" on ipv4 early demux
xfrm: replay: Fix ESN wrap around for GSO
af_key: Fix send_acquire race with pfkey_register
ARM: dts: am335x-pcm-953: Define fixed regulators in root node
ASoC: hdac_hda: fix hda pcm buffer overflow issue
ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove
ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open()
x86/hyperv: Restore VP assist page after cpu offlining/onlining
scsi: storvsc: Fix handling of srb_status and capacity change events
ASoC: max98373: Add checks for devm_kcalloc
regulator: core: fix kobject release warning and memory leak in regulator_register()
spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld()
regulator: core: fix UAF in destroy_regulator()
bus: sunxi-rsb: Remove the shutdown callback
bus: sunxi-rsb: Support atomic transfers
tee: optee: fix possible memory leak in optee_register_device()
ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl
selftests: mptcp: fix mibit vs mbit mix up
net: liquidio: simplify if expression
rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975]
net: dsa: sja1105: disallow C45 transactions on the BASE-TX MDIO bus
nfc/nci: fix race with opening and closing
net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
9p/fd: fix issue of list_del corruption in p9_fd_cancel()
netfilter: conntrack: Fix data-races around ct mark
netfilter: nf_tables: do not set up extensions for end interval
iavf: Fix a crash during reset task
iavf: Do not restart Tx queues after reset task failure
iavf: Fix race condition between iavf_shutdown and iavf_remove
ARM: mxs: fix memory leak in mxs_machine_init()
ARM: dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties
net: ethernet: mtk_eth_soc: fix error handling in mtk_open()
net/mlx4: Check retval of mlx4_bitmap_init
net: mvpp2: fix possible invalid pointer dereference
net/qla3xxx: fix potential memleak in ql3xxx_send()
octeontx2-af: debugsfs: fix pci device refcount leak
net: pch_gbe: fix pci device refcount leak while module exiting
nfp: fill splittable of devlink_port_attrs correctly
nfp: add port from netdev validation for EEPROM access
macsec: Fix invalid error code set
Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()
Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
netfilter: ipset: regression in ip_set_hash_ip.c
net/mlx5: Do not query pci info while pci disabled
net/mlx5: Fix FW tracer timestamp calculation
net/mlx5: Fix handling of entry refcount when command is not issued to FW
tipc: set con sock in tipc_conn_alloc
tipc: add an extra conn_get in tipc_conn_alloc
tipc: check skb_linearize() return value in tipc_disc_rcv()
xfrm: Fix oops in __xfrm_state_delete()
xfrm: Fix ignored return value in xfrm6_init()
net: wwan: iosm: use ACPI_FREE() but not kfree() in ipc_pcie_read_bios_cfg()
sfc: fix potential memleak in __ef100_hard_start_xmit()
net: sparx5: fix error handling in sparx5_port_open()
net: sched: allow act_ct to be built without NF_NAT
NFC: nci: fix memory leak in nci_rx_data_packet()
regulator: twl6030: re-add TWL6032_SUBCLASS
bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending()
dma-buf: fix racing conflict of dma_heap_add()
netfilter: ipset: restore allowing 64 clashing elements in hash:net,iface
netfilter: flowtable_offload: add missing locking
fs: do not update freeing inode i_io_list
dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
ipv4: Fix error return code in fib_table_insert()
arcnet: fix potential memory leak in com20020_probe()
s390/dasd: fix no record found for raw_track_access
nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION
nfc: st-nci: fix memory leaks in EVT_TRANSACTION
nfc: st-nci: fix incorrect sizing calculations in EVT_TRANSACTION
net: enetc: cache accesses to &priv->si->hw
net: enetc: preserve TX ring priority across reconfiguration
octeontx2-pf: Add check for devm_kcalloc
octeontx2-af: Fix reference count issue in rvu_sdp_init()
net: thunderx: Fix the ACPI memory leak
s390/crashdump: fix TOD programmable field size
lib/vdso: use "grep -E" instead of "egrep"
UBUNTU: [Config] updateconfigs for CC_HAS_ASM_GOTO_TIED_OUTPUT
init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash
nios2: add FORCE for vmlinuz.gz
KVM: arm64: pkvm: Fixup boot mode to reflect that the kernel resumes from EL1
usb: dwc3: exynos: Fix remove() function
usb: cdnsp: Fix issue with Clear Feature Halt Endpoint
usb: cdnsp: fix issue with ZLP - added TD_SIZE = 1
ext4: fix use-after-free in ext4_ext_shift_extents
arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency
iio: light: apds9960: fix wrong register for gesture gain
iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
bus: ixp4xx: Don't touch bit 7 on IXP42x
usb: dwc3: gadget: conditionally remove requests
usb: dwc3: gadget: Return -ESHUTDOWN on ep disable
usb: dwc3: gadget: Clear ep descriptor last
nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
gcov: clang: fix the buffer overflow issue
mm: vmscan: fix extreme overreclaim and swap floods
KVM: x86: nSVM: leave nested mode on vCPU free
KVM: x86: forcibly leave nested mode on vCPU reset
KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while still in use
KVM: x86: add kvm_leave_nested
KVM: x86: remove exit_int_info warning in svm_handle_exit
x86/tsx: Add a feature bit for TSX control MSR support
x86/pm: Add enumeration check before spec MSRs save/restore setup
x86/ioremap: Fix page aligned size calculation in __ioremap_caller()
Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode
ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01
tools: iio: iio_generic_buffer: Fix read size
serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
Input: goodix - try resetting the controller when no config is set
Input: soc_button_array - add use_low_level_irq module parameter
Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[]
Input: i8042 - apply probe defer to more ASUS ZenBook models
ASoC: stm32: dfsdm: manage cb buffers cleanup
xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too
xen/platform-pci: add missing free_irq() in error path
platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()
platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017)
drm/amdgpu: disable BACO support on more cards
zonefs: fix zone report size in __zonefs_io_error()
platform/x86: hp-wmi: Ignore Smart Experience App event
platform/x86: ideapad-laptop: Fix interrupt storm on fn-lock toggle on some Yoga laptops
UBUNTU: [Config] updateconfigs for INET_TABLE_PERTURB_ORDER
tcp: configurable source port perturb table size
net: usb: qmi_wwan: add Telit 0x103a composition
scsi: iscsi: Fix possible memory leak when device_register() failed
gpu: host1x: Avoid trying to use GART on Tegra20
dm integrity: flush the journal on suspend
dm integrity: clear the journal on suspend
fuse: lock inode unconditionally in fuse_fallocate()
wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute
wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute
wifi: wilc1000: validate number of channels
btrfs: free btrfs_path before copying root refs to userspace
btrfs: free btrfs_path before copying fspath to userspace
btrfs: free btrfs_path before copying subvol info to userspace
btrfs: zoned: fix missing endianness conversion in sb_write_pointer
btrfs: use kvcalloc in btrfs_get_dev_zone_info
btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()
drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN
drm/amd/display: No display after resume from WB/CB
drm/amdgpu: Enable Aldebaran devices to report CU Occupancy
drm/amdgpu: always register an MMU notifier for userptr
drm/i915: fix TLB invalidation for Gen12 video and compute engines
wifi: cfg80211: Fix bitrates overflow issue
spi: tegra210-quad: Don't initialise DMA if not supported
s390/zcrypt: fix warning about field-spanning write
selftests/net: give more time to udpgro bg processes to complete startup
ACPI: video: Add backlight=native DMI quirk for Dell G15 5515
drm: panel-orientation-quirks: Add quirk for Nanote UMPC-01
s390: always build relocatable kernel
nvme: quiet user passthrough command errors
net: wwan: iosm: fix kernel test robot reported errors
drm/amdgpu: Drop eviction lock when allocating PT BO
arm64: dts: rockchip: fix quartz64-a bluetooth configuration
power: supply: ip5xxx: Fix integer overflow in current_now calculation
power: supply: ab8500: Defer thermal zone probe
arm64: dts: rockchip: Fix Pine64 Quartz4-B PMIC interrupt
regulator: rt5759: fix OOB in validate_desc()
spi: tegra210-quad: Fix duplicate resource error
selftests: mptcp: gives slow test-case more time
selftests: mptcp: run mptcp_sockopt from a new netns
bonding: fix ICMPv6 header handling when receiving IPv6 messages
drm/i915: Fix warn in intel_display_power_*_domain() functions
net/mlx5: SF: Fix probing active SFs during driver probe phase
net/mlx5: cmdif, Print info on any firmware cmd failure to tracepoint
net/mlx5: E-Switch, Set correctly vport destination
net/mlx5e: Offload rule only when all encaps are valid
net: phy: at803x: fix error return code in at803x_probe()
zonefs: Fix race between modprobe and mount
tsnep: Fix rotten packets
blk-mq: fix queue reference leak on blk_mq_alloc_disk_for_queue failure
test_kprobes: fix implicit declaration error of test_kprobes
net: ethernet: mtk_eth_soc: fix resource leak in error path
net: dm9051: Fix missing dev_kfree_skb() in dm9051_loop_rx()
s390/ap: fix memory leak in ap_init_qci_info()
fscache: fix OOB Read in __fscache_acquire_volume
net: wwan: t7xx: Fix the ACPI memory leak
virtio_net: Fix probe failed when modprobe virtio_net
can: gs_usb: remove dma allocations
cifs: fix missing unlock in cifs_file_copychunk_range()
cifs: Use after free in debug code
iio: adc: aspeed: Remove the trim valid dts property.
dt-bindings: iio: adc: Remove the property "aspeed,trim-data-valid"
mm/damon/sysfs-schemes: skip stats update if the scheme directory is removed
virt/sev-guest: Prevent IV reuse in the SNP guest driver
zonefs: Fix active zone accounting
spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock
spi: spi-imx: spi_imx_transfer_one(): check for DMA transfer first
mm/cgroup/reclaim: fix dirty pages throttling on cgroup v1
KVM: x86/mmu: Fix race condition in direct_page_fault
KVM: x86/xen: Only do in-kernel acceleration of hypercalls for guest CPL0
KVM: x86/xen: Validate port number in SCHEDOP_poll
drm/i915/gvt: Get reference to KVM iff attachment to VM is successful
KVM: Update gfn_to_pfn_cache khva when it moves within the same page
mm: fix unexpected changes to {failslab|fail_page_alloc}.attr
mm: correctly charge compressed memory to its memcg
LoongArch: Clear FPU/SIMD thread info flags for kernel thread
LoongArch: Set _PAGE_DIRTY only if _PAGE_WRITE is set in {pmd,pte}_mkdirty()
ASoC: amd: yc: Add Alienware m17 R5 AMD into DMI table
ASoC: Intel: soc-acpi: add ES83x6 support to IceLake
ASoC: hda: intel-dsp-config: add ES83x6 quirk for IceLake
ASoC: SOF: ipc3-topology: use old pipeline teardown flow with SOF2.1 and older
Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
Revert "tty: n_gsm: replace kicktimer with delayed_work"
ASoC: sof_es8336: reduce pop noise on speaker
pinctrl: qcom: sc8280xp: Rectify UFS reset pins
platform/x86: thinkpad_acpi: Enable s2idle quirk for 21A1 machine type
platform/x86: ideapad-laptop: Add module parameters to match DMI quirk tables
block: make blk_set_default_limits() private
scsi: mpi3mr: Suppress command reply debug prints
btrfs: free btrfs_path before copying inodes to userspace
btrfs: do not modify log tree while holding a leaf from fs tree locked
drm/i915/ttm: never purge busy objects
drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code
drm/amdgpu/psp: don't free PSP buffers on suspend
drm/amd/amdgpu: reserve vm invalidation engine for firmware
drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read"
UBUNTU: Upstream stable to v5.15.81, v6.0.11
btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino
btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
iio: health: afe4403: Fix oob read in afe4403_read_raw
iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
iio: light: rpr0521: add missing Kconfig dependencies
bpf, perf: Use subprog name when reporting subprog ksymbol
scripts/faddr2line: Fix regression in name resolution on ppc64le
ARM: at91: rm9200: fix usb device clock id
libbpf: Handle size overflow for ringbuf mmap
hwmon: (ltc2947) fix temperature scaling
hwmon: (ina3221) Fix shunt sum critical calculation
hwmon: (i5500_temp) fix missing pci_disable_device()
hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
bpf: Do not copy spin lock field from user in bpf_selem_alloc
nvmem: rmem: Fix return value check in rmem_read()
of: property: decrement node refcount in of_fwnode_get_reference_args()
ixgbevf: Fix resource leak in ixgbevf_init_module()
i40e: Fix error handling in i40e_init_module()
fm10k: Fix error handling in fm10k_init_module()
iavf: Fix error handling in iavf_init_module()
e100: Fix possible use after free in e100_xmit_prepare
net/mlx5: DR, Fix uninitialized var warning
net/mlx5: Fix uninitialized variable bug in outlen_write()
net/mlx5e: Fix use-after-free when reverting termination table
can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
can: cc770: cc770_isa_probe(): add missing free_cc770dev()
can: etas_es58x: es58x_init_netdev(): free netdev when register_candev()
can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods
can: m_can: Add check for devm_clk_get
qlcnic: fix sleep-in-atomic-context bugs caused by msleep
aquantia: Do not purge addresses when setting the number of rings
wifi: cfg80211: fix buffer overflow in elem comparison
wifi: cfg80211: don't allow multi-BSSID in S1G
wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
net: phy: fix null-ptr-deref while probe() failed
net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe()
net: net_netdev: Fix error handling in ntb_netdev_init_module()
net/9p: Fix a potential socket leak in p9_socket_open
net: ethernet: nixge: fix NULL dereference
net: wwan: iosm: fix kernel test robot reported error
net: wwan: iosm: fix dma_alloc_coherent incompatible pointer type
dsa: lan9303: Correct stat name
tipc: re-fetch skb cb after tipc_msg_validate
net: hsr: Fix potential use-after-free
net: mdiobus: fix unbalanced node reference count
afs: Fix fileserver probe RTT handling
net: tun: Fix use-after-free in tun_detach()
packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
sctp: fix memory leak in sctp_stream_outq_migrate()
net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed
hwmon: (coretemp) Check for null before removing sysfs attrs
hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
riscv: vdso: fix section overlapping under some conditions
riscv: mm: Proper page permissions after initmem free
ALSA: dice: fix regression for Lexicon I-ONIX FW810S
error-injection: Add prompt for function error injection
tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3
pinctrl: intel: Save and restore pins in "direct IRQ" mode
v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
net: stmmac: Set MAC's flow control register to reflect current settings
mmc: mmc_test: Fix removal of debugfs file
mmc: core: Fix ambiguous TRIM and DISCARD arg
mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check
mmc: sdhci-sprd: Fix no reset data and command after voltage switch
mmc: sdhci: Fix voltage switch delay
drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame
drm/amdgpu: enable Vangogh VCN indirect sram mode
drm/i915: Fix negative value passed as remaining time
drm/i915: Never return 0 if not all requests retired
tracing/osnoise: Fix duration type
tracing: Fix race where histograms can be called before the event
tracing: Free buffers when a used dynamic event is removed
io_uring: cmpxchg for poll arm refs release
io_uring/poll: fix poll_refs race with cancelation
ASoC: ops: Fix bounds check for _sx controls
pinctrl: single: Fix potential division by zero
riscv: Sync efi page table's kernel mappings before switching
riscv: fix race when vmap stack overflow
riscv: kexec: Fixup irq controller broken in kexec crash path
nvme: fix SRCU protection of nvme_ns_head list
iommu/vt-d: Fix PCI device refcount leak in has_external_pci()
iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
mm: migrate: fix THP's mapcount on isolation
Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference
ipv4: Fix route deletion when nexthop info is not specified
i2c: npcm7xx: Fix error handling in npcm_i2c_init()
i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set
ACPI: HMAT: remove unnecessary variable initialization
ACPI: HMAT: Fix initiator registration for single-initiator systems
Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend"
char: tpm: Protect tpm_pm_suspend with locks
Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
ipc/sem: Fix dangling sem_array access in semtimedop race
clk: samsung: exynos7885: Correct "div4" clock parents
libbpf: Use correct return pointer in attach_raw_tp
clocksource/drivers/arm_arch_timer: Fix XGene-1 TVAL register math error
clk: qcom: gcc-sc8280xp: add cxo as parent for three ufs ref clks
vfs: fix copy_file_range() averts filesystem freeze protection
net: wwan: iosm: fix crash in peek throughput test
net: wwan: iosm: fix incorrect skb length
mptcp: don't orphan ssk in mptcp_close()
mptcp: fix sleep in atomic at close time
hwmon: (asus-ec-sensors) Add checks for devm_kcalloc
ASoC: tlv320adc3xxx: Fix build error for implicit function declaration
mm/damon/sysfs: fix wrong empty schemes assumption under online tuning in damon_sysfs_set_schemes()
i2c: Restore initial power state if probe fails
i2c: qcom-geni: fix error return code in geni_i2c_gpi_xfer
powerpc/bpf/32: Fix Oops on tail call tests
UBUNTU: Upstream stable to v5.15.82, v6.0.12