Jammy update: v6.1.33 upstream stable release

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v6.1.33 upstream stable release
       from git://git.kernel.org/

Linux 6.1.33
ext4: enable the lazy init thread when remounting read/write
selftests: mptcp: join: avoid using 'cmp --bytes'
selftests: mptcp: simult flows: skip if MPTCP is not supported
selftests: mptcp: diag: skip if MPTCP is not supported
arm64: efi: Use SMBIOS processor version to key off Ampere quirk
tls: rx: strp: don't use GFP_KERNEL in softirq context
xfs: verify buffer contents when we skip log replay
drm/amd/display: Have Payload Properly Created After Resume
iommu/amd/pgtbl_v2: Fix domain max address
tpm, tpm_tis: Request threaded interrupt handler
regmap: Account for register length when chunking
fs/ntfs3: Validate MFT flags before replaying logs
KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
ksmbd: fix multiple out-of-bounds read during context decoding
ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate
ksmbd: fix incorrect AllocationSize set in smb2_get_info
ksmbd: fix UAF issue from opinfo->conn
ksmbd: fix credit count leakage
KVM: x86: Account fastpath-only VM-Exits in vCPU stats
KVM: arm64: Populate fault info for watchpoint
test_firmware: fix the memory leak of the allocated firmware buffer
test_firmware: fix a memory leak with reqs buffer
powerpc/xmon: Use KSYM_NAME_LEN in array size
serial: cpm_uart: Fix a COMPILE_TEST dependency
serial: 8250_tegra: Fix an error handling path in tegra_uart_probe()
fbcon: Fix null-ptr-deref in soft_cursor
ext4: add lockdep annotations for i_data_sem for ea_inode's
ext4: disallow ea_inodes with extended attributes
ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find()
ext4: add EA_INODE checking to ext4_iget()
mptcp: fix active subflow finalization
mptcp: fix connect timeout handling
selftests: mptcp: userspace pm: skip if MPTCP is not supported
selftests: mptcp: sockopt: skip if MPTCP is not supported
selftests: mptcp: join: skip if MPTCP is not supported
selftests: mptcp: pm nl: skip if MPTCP is not supported
selftests: mptcp: connect: skip if MPTCP is not supported
tracing/probe: trace_probe_primary_from_call(): checked list_first_entry
tracing/histograms: Allow variables to have some modifiers
tracing/timerlat: Always wakeup the timerlat thread
mtdchar: mark bits of ioctl handler noinline
selinux: don't use make's grouped targets feature yet
io_uring: undeprecate epoll_ctl support
riscv: perf: Fix callchain parse error with kernel tracepoint events
tpm, tpm_tis: correct tpm_tis_flags enumeration values
iommu/amd: Fix domain flush size when syncing iotlb
powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall
block: fix revalidate performance regression
phy: qcom-qmp-pcie-msm8996: fix init-count imbalance
phy: qcom-qmp-combo: fix init-count imbalance
btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds
tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order
mmc: vub300: fix invalid response handling
x86/mtrr: Revert 90b926e68f50 ("x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case")
drm/amd/pm: reverse mclk and fclk clocks levels for renoir
drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp
drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5
drm/amd/pm: resolve reboot exception for si oland
drm/amd/pm: reverse mclk and fclk clocks levels for vangogh
drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4
drm/amdgpu: enable tmz by default for GC 11.0.1
ata: libata-scsi: Use correct device no in ata_find_dev()
scsi: stex: Fix gcc 13 warnings
misc: fastrpc: reject new invocations during device removal
misc: fastrpc: return -EPIPE to invocations on device removal
md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk()
usb: gadget: f_fs: Add unbind event before functionfs_unbind
usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM
dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type
net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818
iio: dac: build ad5758 driver when AD5758 is selected
iio: adc: stm32-adc: skip adc-diff-channels setup if none is present
iio: adc: ad7192: Change "shorted" channels to differential
iio: addac: ad74413: fix resistance input processing
iio: dac: mcp4725: Fix i2c_master_send() return value handling
iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag
iio: adc: stm32-adc: skip adc-channels setup if none is present
iio: light: vcnl4035: fixed chip ID check
dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value
iio: imu: inv_icm42600: fix timestamp reset
HID: wacom: avoid integer overflow in wacom_intuos_inout()
HID: google: add jewel USB id
iio: adc: mxs-lradc: fix the order of two cleanup operations
iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method
media: uvcvideo: Don't expose unsupported formats to userspace
drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug
mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
media: mediatek: vcodec: Only apply 4K frame sizes on decoder formats
KVM: arm64: vgic: Fix locking comment
KVM: arm64: vgic: Wrap vgic_its_create() with config_lock
KVM: arm64: vgic: Fix a circular locking issue
block: Deny writable memory mapping if block is read-only
nvme-pci: Add quirk for Teamgroup MP33 SSD
ublk: fix AB-BA lockdep warning
drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged
ceph: silence smatch warning in reconnect_caps_cb()
atm: hide unused procfs functions
drm/msm: Be more shouty if per-process pgtables aren't working
ALSA: oss: avoid missing-prototype warnings
nvme: do not let the user delete a ctrl before a complete initialization
nvme-multipath: don't call blk_mark_disk_dead in nvme_mpath_remove_disk
netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
net: wwan: t7xx: Ensure init is completed before system sleep
wifi: b43: fix incorrect __packed annotation
scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed
wifi: iwlwifi: mvm: Add locking to the rate read flow
wifi: mac80211: recalc chanctx mindef before assigning
wifi: mac80211: consider reserved chanctx for mindef
wifi: mac80211: simplify chanctx allocation
arm64: vdso: Pass (void *) to virt_to_page()
arm64/mm: mark private VM_FAULT_X defines as vm_fault_t
ARM: dts: stm32: add pin map for CAN controller on stm32f7
wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value
ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P
s390/topology: honour nr_cpu_ids when adding CPUs
s390/pkey: zeroize key blobs
ASoC: SOF: pm: save io region state in case of errors in resume
ASoC: SOF: sof-client-probes: fix pm_runtime imbalance in error handling
ASoC: SOF: pcm: fix pm_runtime imbalance in error handling
ASoC: SOF: debug: conditionally bump runtime_pm counter on exceptions
media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
media: dvb-core: Fix use-after-free due to race at dvb_register_device()
media: dvb-core: Fix use-after-free due on race condition at dvb_net
media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table
media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
media: dvb_ca_en50221: fix a size write bug
media: netup_unidvb: fix irq init by register it at the end of probe
media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
media: dvb_demux: fix a bug for the continuity counter
ASoC: ssm2602: Add workaround for playback distortions
ALSA: hda/realtek: Add quirks for ASUS GU604V and GU603V
ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs
xfrm: Check if_id in inbound policy/secpath match
um: harddog: fix modular build
ASoC: dwc: limit the number of overrun messages
ASoC: amd: yc: Add DMI entry to support System76 Pangolin 12
nvme-pci: add quirk for missing secondary temperature thresholds
nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G
block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE
nbd: Fix debugfs_create_dir error checking
fbdev: stifb: Fix info entry in sti_struct on error path
fbdev: modedb: Add 1920x1080 at 60 Hz video mode
fbdev: imsttfb: Fix use after free bug in imsttfb_probe
drm/amdgpu: set gfx9 onwards APU atomics support to be true
gfs2: Don't deref jdesc in evict
platform/mellanox: fix potential race in mlxbf-tmfifo driver
platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield
media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE
hwmon: (k10temp) Add PCI ID for family 19, model 78h
ARM: 9295/1: unwind:fix unwind abort for uleb128 case
btrfs: abort transaction when sibling keys check fails for leaves
drm/ast: Fix ARM compatibility
mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
drm/amdgpu: Use the default reset when loading or reloading the driver
ASoC: Intel: soc-acpi-cht: Add quirk for Nextbook Ares 8A tablet
ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs.
watchdog: menz069_wdt: fix watchdog initialisation
drm/amdgpu: release gpu full access after "amdgpu_device_ip_late_init"
mptcp: add annotations around sk->sk_shutdown accesses
mptcp: fix data race around msk->first access
mptcp: consolidate passive msk socket initialization
mptcp: simplify subflow_syn_recv_sock()
mptcp: avoid unneeded address copy
mptcp: add annotations around msk->subflow accesses
mptcp: avoid unneeded __mptcp_nmpc_socket() usage
rtnetlink: call validate_linkmsg in rtnl_create_link
mtd: rawnand: marvell: don't set the NAND frequency select
mtd: rawnand: marvell: ensure timing values are written
net: dsa: mv88e6xxx: Increase wait after reset deactivation
tcp: fix mishandling when the sack compression is deferred.
net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
iommu/mediatek: Flush IOTLB completely only if domain has been attached
net/mlx5: Read embedded cpu after init bit cleared
net/mlx5e: Fix error handling in mlx5e_refresh_tirs
nvme: fix the name of Zone Append for verbose logging
nfsd: fix double fget() bug in __write_ports_addfd()
udp6: Fix race condition in udp6_sendmsg & connect
net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report
net: sched: fix NULL pointer dereference in mq_attach
net/sched: Prohibit regrafting ingress or clsact Qdiscs
net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs
net/sched: sch_clsact: Only create under TC_H_CLSACT
net/sched: sch_ingress: Only create under TC_H_INGRESS
net/smc: Don't use RMBs not mapped to new link in SMCRv2 ADD LINK
net/smc: Scan from current RMB list when no position specified
tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
tcp: deny tcp_disconnect() when threads are waiting
af_packet: do not use READ_ONCE() in packet_bind()
RDMA/irdma: Fix Local Invalidate fencing
RDMA/irdma: Prevent QP use after free
mtd: rawnand: ingenic: fix empty stub helper definitions
perf ftrace latency: Remove unnecessary "--" from --use-nsec option
amd-xgbe: fix the false linkup in xgbe_phy_status
tls: improve lockless access safety of tls_err_abort()
af_packet: Fix data-races of pkt_sk(sk)->num.
netrom: fix info-leak in nr_write_internal()
net: mellanox: mlxbf_gige: Fix skb_panic splat under memory pressure
net/mlx5e: Don't attach netdev profile while handling internal error
net/mlx5: fw_tracer, Fix event handling
net/mlx5: SF, Drain health before removing device
net/mlx5: Drain health before unregistering devlink
riscv: Fix unused variable warning when BUILTIN_DTB is set
dmaengine: pl330: rename _start to prevent build error
nfsd: make a copy of struct iattr before calling notify_change
iommu/amd: Fix up merge conflict resolution
iommu/amd: Handle GALog overflows
iommu/amd: Don't block updates to GATag if guest mode is on
iommu/rockchip: Fix unwind goto issue
RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx
RDMA/bnxt_re: Fix a possible memory leak
dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved()
RDMA/hns: Modify the value of long message loopback slice
RDMA/hns: Fix base address table allocation
RDMA/hns: Fix timeout attr in query qp for HIP08
RDMA/efa: Fix unsupported page sizes in device
phy: amlogic: phy-meson-g12a-mipi-dphy-analog: fix CNTL2_DIF_TX_CTL0 value
RDMA/bnxt_re: Fix the page_size used during the MR creation