Ubuntu
linux-oem-6.1 package

Jammy update: v6.1.47 upstream stable release

Bug #2033642 reported by Timo Aaltonen on 2023-08-31

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	linux-oem-6.1 (Ubuntu)	Invalid	Undecided	Unassigned
	Jammy	Fix Released	Undecided	Unassigned

Bug Description

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

v6.1.47 upstream stable release
from git://git.kernel.org/

Linux 6.1.47
mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create
af_unix: Fix null-ptr-deref in unix_stream_sendpage().
drm/amdgpu: keep irq count in amdgpu_irq_disable_all
drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11
arm64/ptrace: Ensure that SME is set up for target when writing SSVE state
netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
hugetlb: do not clear hugetlb dtor until allocating vmemmap
drm/amd/display: Implement workaround for writing to OTG_PIXEL_RATE_DIV register
sched/fair: Remove capacity inversion detection
sched/fair: unlink misfit task from cpu overutilized
zsmalloc: allow only one active pool compaction context
drm/amd/display: disable RCO for DCN314
ASoC: amd: vangogh: select CONFIG_SND_AMD_ACP_CONFIG
drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7
drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix
drm/amd: flush any delayed gfxoff on suspend entry
drm/i915/sdvo: fix panel_type initialization
drm/qxl: fix UAF on handle creation
mmc: block: Fix in_flight[issue_type] value error
mmc: wbsd: fix double mmc_free_host() in wbsd_init()
blk-crypto: dynamically allocate fallback profile
arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards
virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case
cifs: Release folio lock on fscache read hit.
ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
serial: 8250: Fix oops for port->pm on uart_change_pm()
riscv: uaccess: Return the number of bytes effectively not copied
ALSA: hda/realtek - Remodified 3k pull low procedure
soc: aspeed: socinfo: Add kfree for kstrdup
soc: aspeed: uart-routing: Use __sysfs_match_string
ALSA: hda/realtek: Add quirks for HP G11 Laptops
ASoC: meson: axg-tdm-formatter: fix channel slot allocation
ASoC: rt5665: add missed regulator_bulk_disable
arm64: dts: imx93: Fix anatop node size
ARM: dts: imx: Set default tuning step for imx6sx usdhc
arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration
ARM: dts: imx6: phytec: fix RTC interrupt level
ARM: dts: imx: align LED node names with dtschema
arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+
arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict
bus: ti-sysc: Flush posted write on enable before reset
ice: Block switchdev mode when ADQ is active and vice versa
qede: fix firmware halt over suspend and resume
net: do not allow gso_size to be set to GSO_BY_FRAGS
sock: Fix misuse of sk_under_memory_pressure()
sfc: don't unregister flow_indr if it was never registered
net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
i40e: fix misleading debug logs
iavf: fix FDIR rule fields masks validation
net: openvswitch: reject negative ifindex
team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
net: phy: broadcom: stub c45 read/write for 54810
netfilter: nft_dynset: disallow object maps
ipvs: fix racy memcpy in proc_do_sync_threshold
netfilter: nf_tables: deactivate catchall elements in next generation
netfilter: nf_tables: fix false-positive lockdep splat
octeon_ep: cancel tx_timeout_task later in remove sequence
net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source
drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
selftests: mirror_gre_changes: Tighten up the TTL test match
net: phy: fix IRQ-based wake-on-lan over hibernate / power off
net: pcs: Add missing put_device call in miic_create
virtio-net: set queues after driver_ok
virtio_net: notify MAC address change on device initialization
xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
xfrm: add NULL check in xfrm_update_ae_params
ip_vti: fix potential slab-use-after-free in decode_session6
ip6_vti: fix slab-use-after-free in decode_session6
xfrm: fix slab-use-after-free in decode_session6
net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
net: af_key: fix sadb_x_filter validation
net: xfrm: Fix xfrm_address_filter OOB read
i2c: designware: Handle invalid SMBus block data response length value
i2c: designware: Correct length byte validation logic
btrfs: fix BUG_ON condition in btrfs_cancel_balance
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range
tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms
tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
vdpa: Enable strict validation for netlinks ops
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
vdpa: Add features attr to vdpa_nl_policy for nlattr length check
powerpc/rtas_flash: allow user copy to flash block cache objects
fbdev: mmp: fix value check in mmphw_probe()
i2c: tegra: Fix i2c-tegra DMA config option processing
i2c: hisi: Only handle the interrupt of the driver's transfer
i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
cifs: fix potential oops in cifs_oplock_break
vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary
vdpa/mlx5: Fix mr->initialized semantics
vduse: Use proper spinlock for IRQ injection
virtio-mmio: don't break lifecycle of vm_dev
btrfs: fix use-after-free of new block group that became unused
btrfs: convert btrfs_block_group::seq_zone to runtime flag
btrfs: convert btrfs_block_group::needs_free_space to runtime flag
btrfs: move out now unused BG from the reclaim list
video/aperture: Only remove sysfb on the default vga pci device
fbdev/hyperv-fb: Do not set struct fb_info.apertures
ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption
drm/amd/display: fix access hdcp_workqueue assert
drm/amd/display: phase3 mst hdcp for multiple displays
drm/amd/display: save restore hdcp state when display is unplugged from mst hub
igc: read before write to SRRCTL register
ring-buffer: Do not swap cpu_buffer during resize process
Bluetooth: MGMT: Use correct address for memcpy()
powerpc/kasan: Disable KCOV in KASAN code
ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V
ALSA: hda/realtek: Add quirk for ASUS ROG GA402X
ALSA: hda/realtek: Add quirk for ASUS ROG GX650P
ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted
fs: ntfs3: Fix possible null-pointer dereferences in mi_read()
fs/ntfs3: Enhance sanity check while generating attr_list
drm/amdgpu: Fix potential fence use-after-free v2
ceph: try to dump the msgs when decoding fails
Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
Bluetooth: L2CAP: Fix use-after-free
watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)
firewire: net: fix use after free in fwnet_finish_incoming_packet()
thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth
thunderbolt: Add Intel Barlow Ridge PCI ID
pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
gfs2: Fix possible data races in gfs2_show_options()
usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
usb: chipidea: imx: don't request QoS for imx8ulp
thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx()
media: platform: mediatek: vpu: fix NULL ptr dereference
usb: gadget: uvc: queue empty isoc requests if no video buffer is available
usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250
media: v4l2-mem2mem: add lock to protect parameter num_rdy
led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node() loops
serial: stm32: Ignore return value of uart_remove_one_port() in .remove()
cifs: fix session state check in reconnect to avoid use-after-free issue
smb: client: fix warning in cifs_smb3_do_mount()
ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio
HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID
ASoC: SOF: core: Free the firmware trace before calling snd_sof_shutdown()
drm/amd/display: Enable dcn314 DPP RCO
drm/amd/display: Skip DPP DTO update if root clock is gated
RDMA/mlx5: Return the firmware result upon destroying QP/RQ
drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz
drm/amdgpu: install stub fence into potential unused fence pointers
iommu/amd: Introduce Disable IRTE Caching Support
HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard
accel/habanalabs: add pci health check during heartbeat
dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion
iopoll: Call cpu_relax() in busy loops
ASoC: Intel: sof_sdw: Add support for Rex soundwire
ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in _exit
ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
ASoC: amd: vangogh: Add check for acp config flags in vangogh platform
drm: rcar-du: remove R-Car H3 ES1.* workarounds
drm/stm: ltdc: fix late dereference check
ASoC: SOF: amd: Add pci revision id check
PCI: tegra194: Fix possible array out of bounds access
ASoC: Intel: sof_sdw: add quirk for LNL RVP
ASoC: Intel: sof_sdw: add quirk for MTL RVP
drm/amdgpu: fix memory leak in mes self test
drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
drm/amdgpu: fix calltrace warning in amddrm_buddy_fini
net: phy: at803x: fix the wol setting functions
net: phy: at803x: Use devm_regulator_get_enable_optional()
net/smc: Fix setsockopt and sysctl to specify same buffer size again
net/smc: replace mutex rmbs_lock and sndbufs_lock with rw_semaphore
selftests: forwarding: tc_actions: Use ncat instead of nc
selftests: forwarding: tc_actions: cleanup temporary files when test is aborted
zsmalloc: fix races between modifications of fullness and isolated
zsmalloc: consolidate zs_pool's migrate_lock and size_class's locks
cpuidle: psci: Move enabling OSI mode after power domains creation
cpuidle: psci: Extend information in log about OSI/PC mode
mmc: sdhci-f-sdh30: Replace with sdhci_pltfm

Tags:

CVE References

2023-20569

Timo Aaltonen (tjaalton) on 2023-08-31

Changed in linux-oem-6.1 (Ubuntu):
status:	New → Confirmed
tags:	added: kernel-stable-tracking-bug

Timo Aaltonen (tjaalton) on 2023-09-15

Changed in linux-oem-6.1 (Ubuntu Jammy):
status:	New → Fix Committed
Changed in linux-oem-6.1 (Ubuntu):
status:	Confirmed → Invalid

Revision history for this message

Launchpad Janitor (janitor) wrote on 2023-10-04:

Download full text (60.3 KiB)

This bug was fixed in the package linux-oem-6.1 - 6.1.0-1023.23

---------------
linux-oem-6.1 (6.1.0-1023.23) jammy; urgency=medium

* jammy/linux-oem-6.1: 6.1.0-1023.23 -proposed tracker (LP: #2033827)

This bug was fixed in the package linux-oem-6.1 - 6.1.0-1023.23

---------------
linux-oem-6.1 (6.1.0-1023.23) jammy; urgency=medium

* jammy/linux-oem-6.1: 6.1.0-1023.23 -proposed tracker (LP: #2033827)

* Jammy update: v6.1.53 upstream stable release (LP: #2035359)
    - Revert "bridge: Add extack warning when enabling STP in netns."
    - Partially revert "drm/amd/display: Fix possible underflow for displays with
      large vblank"
    - scsi: ufs: Try harder to change the power mode
    - Revert "Revert drm/amd/display: Enable Freesync Video Mode by default"
    - ARM: dts: imx: Set default tuning step for imx7d usdhc
    - powerpc/boot: Disable power10 features after BOOTAFLAGS assignment
    - media: uapi: HEVC: Add num_delta_pocs_of_ref_rps_idx field
    - Revert "MIPS: unhide PATA_PLATFORM"
    - phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code
    - media: amphion: use dev_err_probe
    - media: pulse8-cec: handle possible ping error
    - media: pci: cx23885: fix error handling for cx23885 ATSC boards
    - 9p: virtio: fix unlikely null pointer deref in handle_rerror
    - 9p: virtio: make sure 'offs' is initialized in zc_request
    - ksmbd: fix out of bounds in smb3_decrypt_req()
    - ksmbd: validate session id and tree id in compound request
    - ksmbd: no response from compound read
    - ksmbd: fix out of bounds in init_smb2_rsp_hdr()
    - ASoC: da7219: Flush pending AAD IRQ when suspending
    - ASoC: da7219: Check for failure reading AAD IRQ events
    - ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect
    - ethernet: atheros: fix return value check in atl1c_tso_csum()
    - m68k: Fix invalid .section syntax
    - s390/dasd: use correct number of retries for ERP requests
    - s390/dasd: fix hanging device after request requeue
    - fs/nls: make load_nls() take a const parameter
    - ASoC: rt5682-sdw: fix for JD event handling in ClockStop Mode0
    - ASoc: codecs: ES8316: Fix DMIC config
    - ASoC: rt711: fix for JD event handling in ClockStop Mode0
    - ASoC: rt711-sdca: fix for JD event handling in ClockStop Mode0
    - ASoC: atmel: Fix the 8K sample parameter in I2SC master
    - ALSA: usb-audio: Add quirk for Microsoft Modern Wireless Headset
    - platform/x86: intel: hid: Always call BTNL ACPI method
    - platform/x86/intel/hid: Add HP Dragonfly G2 to VGBS DMI quirks
    - platform/x86: think-lmi: Use kfree_sensitive instead of kfree
    - platform/x86: asus-wmi: Fix setting RGB mode on some TUF laptops
    - platform/x86: huawei-wmi: Silence ambient light sensor
    - drm/amd/smu: use AverageGfxclkFrequency* to replace previous GFX Curr Clock
    - drm/amd/display: Guard DCN31 PHYD32CLK logic against chip family
    - drm/amd/display: Exit idle optimizations before attempt to access PHY
    - ovl: Always reevaluate the file signature for IMA
    - ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer()
    - ALSA: usb-audio: Update for native DSD support quirks
    - staging: fbtft: ili9341: use macro FBTFT_REGISTER_SPI_DRIVER
    - security: keys: perform capable check only on privileged operations
    - kprobes: Prohibit probing on CFI preamble symbol
    - clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM
    - vmbus_testing: fix wrong python syntax for integer value comparison
    - Revert "wifi: ath6k: silence false positive -Wno-dangling-pointer warning on
      GCC 12"
    - net: dsa: microchip: KSZ9477 register regmap alignment to 32 bit boundaries
    - net: annotate data-races around sk->sk_{rcv|snd}timeo
    - net: usb: qmi_wwan: add Quectel EM05GV2
    - wifi: brcmfmac: Fix field-spanning write in brcmf_scan_params_v2_to_v1()
    - powerpc/powermac: Use early_* IO variants in via_calibrate_decr()
    - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
    - platform/x86/amd/pmf: Fix unsigned comparison with less than zero
    - scsi: lpfc: Remove reftag check in DIF paths
    - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
    - net: hns3: restore user pause configure when disable autoneg
    - drm/amdgpu: Match against exact bootloader status
    - wifi: cfg80211: remove links only on AP
    - wifi: mac80211: Use active_links instead of valid_links in Tx
    - netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
    - bnx2x: fix page fault following EEH recovery
    - cifs: fix sockaddr comparison in iface_cmp
    - cifs: fix max_credits implementation
    - sctp: handle invalid error codes without calling BUG()
    - scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity
    - scsi: storvsc: Always set no_report_opcodes
    - scsi: lpfc: Fix incorrect big endian type assignment in bsg loopback path
    - LoongArch: Let pmd_present() return true when splitting pmd
    - LoongArch: Fix the write_fcsr() macro
    - ALSA: seq: oss: Fix racy open/close of MIDI devices
    - net: sfp: handle 100G/25G active optical cables in sfp_parse_support
    - tracing: Introduce pipe_cpumask to avoid race on trace_pipes
    - platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE
      notifications
    - of: property: Simplify of_link_to_phandle()
    - cpufreq: intel_pstate: set stale CPU frequency to minimum
    - crypto: rsa-pkcs1pad - Use helper to set reqsize
    - tpm: Enable hwrng only for Pluton on AMD CPUs
    - KVM: x86/mmu: Use kstrtobool() instead of strtobool()
    - KVM: x86/mmu: Add "never" option to allow sticky disabling of nx_huge_pages
    - net: Avoid address overwrite in kernel_connect
    - drm/amd/display: ensure async flips are only accepted for fast updates
    - udf: Check consistency of Space Bitmap Descriptor
    - udf: Handle error when adding extent to a file
    - Input: i8042 - add quirk for TUXEDO Gemini 17 Gen1/Clevo PD70PN
    - Revert "PCI: tegra194: Enable support for 256 Byte payload"
    - Revert "net: macsec: preserve ingress frame ordering"
    - tools lib subcmd: Add install target
    - tools lib subcmd: Make install_headers clearer
    - tools lib subcmd: Add dependency test to install_headers
    - tools/resolve_btfids: Use pkg-config to locate libelf
    - tools/resolve_btfids: Install subcmd headers
    - tools/resolve_btfids: Alter how HOSTCC is forced
    - tools/resolve_btfids: Compile resolve_btfids as host program
    - tools/resolve_btfids: Tidy HOST_OVERRIDES
    - tools/resolve_btfids: Pass HOSTCFLAGS as EXTRA_CFLAGS to prepare targets
    - tools/resolve_btfids: Fix setting HOSTCFLAGS
    - reiserfs: Check the return value from __getblk()
    - eventfd: prevent underflow for eventfd semaphores
    - fs: Fix error checking for d_hash_and_lookup()
    - iomap: Remove large folio handling in iomap_invalidate_folio()
    - tmpfs: verify {g,u}id mount options correctly
    - selftests/harness: Actually report SKIP for signal tests
    - vfs, security: Fix automount superblock LSM init problem, preventing NFS sb
      sharing
    - ARM: ptrace: Restore syscall restart tracing
    - ARM: ptrace: Restore syscall skipping for tracers
    - refscale: Fix uninitalized use of wait_queue_head_t
    - OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd()
    - selftests/resctrl: Add resctrl.h into build deps
    - selftests/resctrl: Don't leak buffer in fill_cache()
    - selftests/resctrl: Unmount resctrl FS if child fails to run benchmark
    - selftests/resctrl: Close perf value read fd on errors
    - arm64/ptrace: Clean up error handling path in sve_set_common()
    - sched/psi: Select KERNFS as needed
    - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved
    - arm64/sme: Don't use streaming mode to probe the maximum SME VL
    - arm64/fpsimd: Only provide the length to cpufeature for xCR registers
    - sched/rt: Fix sysctl_sched_rr_timeslice intial value
    - perf/imx_ddr: don't enable counter0 if none of 4 counters are used
    - selftests/futex: Order calls to futex_lock_pi
    - s390/pkey: fix/harmonize internal keyblob headers
    - s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_GENSECK2 IOCTL
    - s390/pkey: fix PKEY_TYPE_EP11_AES handling for sysfs attributes
    - s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs
    - irqchip/loongson-eiointc: Fix return value checking of eiointc_index
    - ACPI: x86: s2idle: Post-increment variables when getting constraints
    - ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table
    - thermal/of: Fix potential uninitialized value access
    - cpufreq: amd-pstate-ut: Remove module parameter access
    - cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver
    - x86/efistub: Fix PCI ROM preservation in mixed mode
    - cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
    - selftests/bpf: Fix bpf_nf failure upon test rerun
    - bpftool: use a local copy of perf_event to fix accessing :: Bpf_cookie
    - bpftool: Define a local bpf_perf_link to fix accessing its fields
    - bpftool: Use a local copy of BPF_LINK_TYPE_PERF_EVENT in pid_iter.bpf.c
    - bpftool: Use a local bpf_perf_event_value to fix accessing its fields
    - libbpf: Fix realloc API handling in zero-sized edge cases
    - bpf: Clear the probe_addr for uprobe
    - bpf: Fix an error in verifying a field in a union
    - crypto: qat - change value of default idle filter
    - tcp: tcp_enter_quickack_mode() should be static
    - hwrng: nomadik - keep clock enabled while hwrng is registered
    - hwrng: pic32 - use devm_clk_get_enabled
    - regmap: rbtree: Use alloc_flags for memory allocations
    - wifi: rtw89: debug: Fix error handling in rtw89_debug_priv_btc_manual_set()
    - wifi: mt76: mt7921: fix non-PSC channel scan fail
    - udp: re-score reuseport groups when connected sockets are present
    - bpf: reject unhashed sockets in bpf_sk_assign
    - wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH
    - spi: tegra20-sflash: fix to check return value of platform_get_irq() in
      tegra_sflash_probe()
    - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also
      in case of OOM
    - wifi: mt76: mt7915: fix power-limits while chan_switch
    - wifi: mwifiex: Fix OOB and integer underflow when rx packets
    - wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
    - selftests/bpf: fix static assert compilation issue for test_cls_*.c
    - kbuild: rust_is_available: remove -v option
    - kbuild: rust_is_available: fix version check when CC has multiple arguments
    - kbuild: rust_is_available: add check for `bindgen` invocation
    - kbuild: rust_is_available: fix confusion when a version appears in the path
    - crypto: stm32 - Properly handle pm_runtime_get failing
    - crypto: api - Use work queue in crypto_destroy_instance
    - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
    - Bluetooth: Fix potential use-after-free when clear keys
    - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor
    - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()
    - net: tcp: fix unexcepted socket die when snd_wnd is 0
    - selftests/bpf: Fix repeat option when kfunc_call verification fails
    - selftests/bpf: Clean up fmod_ret in bench_rename test script
    - net-memcg: Fix scope of sockmem pressure indicators
    - ice: ice_aq_check_events: fix off-by-one check when filling buffer
    - crypto: caam - fix unchecked return value error
    - hwrng: iproc-rng200 - Implement suspend and resume calls
    - lwt: Fix return values of BPF xmit ops
    - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
    - fs: ocfs2: namei: check return value of ocfs2_add_entry()
    - net: annotate data-races around sk->sk_lingertime
    - wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
    - wifi: mwifiex: Fix missed return in oob checks failed path
    - ARM: dts: Add .dts files missing from the build
    - samples/bpf: fix bio latency check with tracepoint
    - samples/bpf: fix broken map lookup probe
    - wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
    - wifi: ath9k: protect WMI command response buffer replacement with a lock
    - wifi: nl80211/cfg80211: add forgotten nla_policy for BSS color attribute
    - mac80211: make ieee80211_tx_info padding explicit
    - wifi: mwifiex: avoid possible NULL skb pointer dereference
    - Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave()
    - arm64: mm: use ptep_clear() instead of pte_clear() in clear_flush()
    - wifi: ath9k: use IS_ERR() with debugfs_create_dir()
    - ice: avoid executing commands on other ports when driving sync
    - net: arcnet: Do not call kfree_skb() under local_irq_disable()
    - mlxsw: i2c: Fix chunk size setting in output mailbox buffer
    - mlxsw: i2c: Limit single transaction buffer size
    - mlxsw: core_hwmon: Adjust module label names based on MTCAP sensor counter
    - hwmon: (tmp513) Fix the channel number in tmp51x_is_visible()
    - octeontx2-pf: Refactor schedular queue alloc/free calls
    - octeontx2-pf: Fix PFC TX scheduler free
    - cteonxt2-pf: Fix backpressure config for multiple PFC priorities to work
      simultaneously
    - sfc: Check firmware supports Ethernet PTP filter
    - net/sched: sch_hfsc: Ensure inner classes have fsc curve
    - netrom: Deny concurrent connect().
    - drm/bridge: tc358764: Fix debug print parameter order
    - ASoC: cs43130: Fix numerator/denominator mixup
    - quota: factor out dquot_write_dquot()
    - quota: rename dquot_active() to inode_quota_active()
    - quota: add new helper dquot_active()
    - quota: fix dqput() to follow the guarantees dquot_srcu should provide
    - drm/amd/display: Do not set drr on pipe commit
    - drm/hyperv: Fix a compilation issue because of not including screen_info.h
    - ASoC: stac9766: fix build errors with REGMAP_AC97
    - soc: qcom: ocmem: Add OCMEM hardware version print
    - soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros
    - arm64: dts: qcom: sm6350: Fix ZAP region
    - arm64: dts: qcom: sm8250: correct dynamic power coefficients
    - arm64: dts: qcom: msm8916-l8150: correct light sensor VDDIO supply
    - arm64: dts: qcom: sm8250-edo: Add gpio line names for TLMM
    - arm64: dts: qcom: sm8250-edo: Add GPIO line names for PMIC GPIOs
    - arm64: dts: qcom: sm8250-edo: Rectify gpio-keys
    - arm64: dts: qcom: sc8280xp-crd: Correct vreg_misc_3p3 GPIO
    - arm64: dts: qcom: sc8280xp: Add missing SCM interconnect
    - arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller
    - arm64: dts: qcom: sdm845-tama: Set serial indices and stdout-path
    - arm64: dts: qcom: sm8350: Fix CPU idle state residency times
    - arm64: dts: qcom: sm8350: Add missing LMH interrupts to cpufreq
    - arm64: dts: qcom: sm8350: Use proper CPU compatibles
    - arm64: dts: qcom: pm8350: fix thermal zone name
    - arm64: dts: qcom: pm8350b: fix thermal zone name
    - arm64: dts: qcom: pmr735b: fix thermal zone name
    - arm64: dts: qcom: pmk8350: fix ADC-TM compatible string
    - arm64: dts: qcom: sm8250: Mark PCIe hosts as DMA coherent
    - ARM: dts: stm32: Rename mdio0 to mdio
    - ARM: dts: stm32: YAML validation fails for Argon Boards
    - ARM: dts: stm32: adopt generic iio bindings for adc channels on emstamp-
      argon
    - ARM: dts: stm32: Add missing detach mailbox for emtrion emSBC-Argon
    - ARM: dts: stm32: YAML validation fails for Odyssey Boards
    - ARM: dts: stm32: Add missing detach mailbox for Odyssey SoM
    - ARM: dts: stm32: Update to generic ADC channel binding on DHSOM systems
    - ARM: dts: stm32: Add missing detach mailbox for DHCOM SoM
    - firmware: ti_sci: Use system_state to determine polling
    - drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar()
    - ARM: dts: BCM53573: Drop nonexistent #usb-cells
    - ARM: dts: BCM53573: Add cells sizes to PCIe node
    - ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
    - arm64: tegra: Fix HSUART for Jetson AGX Orin
    - arm64: dts: qcom: sm8250-sony-xperia: correct GPIO keys wakeup again
    - arm64: dts: qcom: pm6150l: Add missing short interrupt
    - arm64: dts: qcom: pm660l: Add missing short interrupt
    - arm64: dts: qcom: pmi8994: Add missing OVP interrupt
    - arm64: tegra: Fix HSUART for Smaug
    - drm/etnaviv: fix dumping of active MMU context
    - block: cleanup queue_wc_store
    - block: don't allow enabling a cache on devices that don't support it
    - x86/mm: Fix PAT bit missing from page protection modify mask
    - drm/bridge: anx7625: Use common macros for DP power sequencing commands
    - drm/bridge: anx7625: Use common macros for HDCP capabilities
    - ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
    - ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
    - ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
    - drm: adv7511: Fix low refresh rate register for ADV7533/5
    - ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
    - arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC
    - arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk"
    - arm64: dts: qcom: msm8996-gemini: fix touchscreen VIO supply
    - drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl'
    - md: Factor out is_md_suspended helper
    - md: Change active_io to percpu
    - md: restore 'noio_flag' for the last mddev_resume()
    - md/raid10: factor out dereference_rdev_and_rrdev()
    - md/raid10: use dereference_rdev_and_rrdev() to get devices
    - md/md-bitmap: remove unnecessary local variable in backlog_store()
    - md/md-bitmap: hold 'reconfig_mutex' in backlog_store()
    - drm/msm: Update dev core dump to not print backwards
    - drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
    - of: unittest: fix null pointer dereferencing in
      of_unittest_find_node_by_name()
    - arm64: dts: qcom: sm8150: Fix the I2C7 interrupt
    - ARM: dts: BCM53573: Fix Tenda AC9 switch CPU port
    - drm/armada: Fix off-by-one error in armada_overlay_get_property()
    - drm/repaper: Reduce temporary buffer size in repaper_fb_dirty()
    - drm/panel: simple: Add missing connector type and pixel format for AUO
      T215HVN01
    - ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig
    - drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask
    - soc: qcom: smem: Fix incompatible types in comparison
    - drm/msm/mdp5: Don't leak some plane state
    - firmware: meson_sm: fix to avoid potential NULL pointer dereference
    - drm/msm/dpu: fix the irq index in dpu_encoder_phys_wb_wait_for_commit_done
    - smackfs: Prevent underflow in smk_set_cipso()
    - drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create()
    - drm/msm/a2xx: Call adreno_gpu_init() earlier
    - audit: fix possible soft lockup in __audit_inode_child()
    - block/mq-deadline: use correct way to throttling write requests
    - io_uring: fix drain stalls by invalid SQE
    - drm/mediatek: dp: Add missing error checks in mtk_dp_parse_capabilities
    - bus: ti-sysc: Fix build warning for 64-bit build
    - drm/mediatek: Remove freeing not dynamic allocated memory
    - ARM: dts: qcom: ipq4019: correct SDHCI XO clock
    - drm/mediatek: Fix potential memory leak if vmap() fail
    - arm64: dts: qcom: apq8016-sbc: Fix ov5640 regulator supply names
    - arm64: dts: qcom: msm8998: Drop bus clock reference from MMSS SMMU
    - arm64: dts: qcom: msm8998: Add missing power domain to MMSS SMMU
    - arm64: dts: qcom: msm8996: Fix dsi1 interrupts
    - arm64: dts: qcom: sc8280xp-x13s: Unreserve NC pins
    - bus: ti-sysc: Fix cast to enum warning
    - md/raid5-cache: fix a deadlock in r5l_exit_log()
    - md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid()
    - firmware: cs_dsp: Fix new control name check
    - md: add error_handlers for raid0 and linear
    - md/raid0: Factor out helper for mapping and submitting a bio
    - md/raid0: Fix performance regression for large sequential writes
    - md: raid0: account for split bio in iostat accounting
    - ASoC: SOF: amd: clear dsp to host interrupt status
    - of: overlay: Call of_changeset_init() early
    - of: unittest: Fix overlay type in apply/revert check
    - ALSA: ac97: Fix possible error value of *rac97
    - ipmi:ssif: Add check for kstrdup
    - ipmi:ssif: Fix a memory leak when scanning for an adapter
    - clk: qcom: gpucc-sm6350: Introduce index-based clk lookup
    - clk: qcom: gpucc-sm6350: Fix clock source names
    - clk: qcom: gcc-sc8280xp: Add EMAC GDSCs
    - clk: qcom: gcc-sc8280xp: Add missing GDSC flags
    - dt-bindings: clock: qcom,gcc-sc8280xp: Add missing GDSCs
    - clk: qcom: gcc-sc8280xp: Add missing GDSCs
    - clk: rockchip: rk3568: Fix PLL rate setting for 78.75MHz
    - PCI: apple: Initialize pcie->nvecs before use
    - PCI: qcom-ep: Switch MHI bus master clock off during L1SS
    - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
    - PCI/DOE: Fix destroy_work_on_stack() race
    - clk: sunxi-ng: Modify mismatched function name
    - clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src
    - EDAC/igen6: Fix the issue of no error events
    - ext4: correct grp validation in ext4_mb_good_group
    - ext4: avoid potential data overflow in next_linear_group
    - clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src
    - kvm/vfio: Prepare for accepting vfio device fd
    - kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add()
    - clk: qcom: reset: Use the correct type of sleep/delay based on length
    - clk: qcom: gcc-sm6350: Fix gcc_sdcc2_apps_clk_src
    - PCI: microchip: Correct the DED and SEC interrupt bit offsets
    - PCI: Mark NVIDIA T4 GPUs to avoid bus reset
    - pinctrl: mcp23s08: check return value of devm_kasprintf()
    - PCI: Allow drivers to request exclusive config regions
    - PCI: Add locking to RMW PCI Express Capability Register accessors
    - PCI: pciehp: Use RMW accessors for changing LNKCTL
    - PCI/ASPM: Use RMW accessors for changing LNKCTL
    - clk: qcom: gcc-sm8450: Use floor ops for SDCC RCGs
    - clk: imx: pllv4: Fix SPLL2 MULT range
    - clk: imx: imx8ulp: update SPLL2 type
    - clk: imx8mp: fix sai4 clock
    - clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op
    - powerpc/radix: Move some functions into #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
    - vfio/type1: fix cap_migration information leak
    - nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu()
    - nvdimm: Fix dereference after free in register_nvdimm_pmu()
    - powerpc/fadump: reset dump area size if fadump memory reserve fails
    - powerpc/perf: Convert fsl_emb notifier to state machine callbacks
    - drm/amdgpu: Use RMW accessors for changing LNKCTL
    - drm/radeon: Use RMW accessors for changing LNKCTL
    - net/mlx5: Use RMW accessors for changing LNKCTL
    - wifi: ath11k: Use RMW accessors for changing LNKCTL
    - wifi: ath10k: Use RMW accessors for changing LNKCTL
    - NFSv4.2: Rework scratch handling for READ_PLUS
    - NFSv4.2: Fix READ_PLUS smatch warnings
    - NFSv4.2: Fix up READ_PLUS alignment
    - NFSv4.2: Fix READ_PLUS size calculations
    - powerpc: Don't include lppaca.h in paca.h
    - powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
    - nfs/blocklayout: Use the passed in gfp flags
    - powerpc/pseries: Fix hcall tracepoints with JUMP_LABEL=n
    - powerpc/mpc5xxx: Add missing fwnode_handle_put()
    - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
    - ext4: fix unttached inode after power cut with orphan file feature enabled
    - jfs: validate max amount of blocks before allocation.
    - fs: lockd: avoid possible wrong NULL parameter
    - NFSD: da_addr_body field missing in some GETDEVICEINFO replies
    - NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN
    - NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ
    - pNFS: Fix assignment of xprtdata.cred
    - cgroup/cpuset: Inherit parent's load balance state in v2
    - RDMA/qedr: Remove a duplicate assignment in irdma_query_ah()
    - media: ov5640: fix low resolution image abnormal issue
    - media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables
    - media: i2c: tvp5150: check return value of devm_kasprintf()
    - media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
    - iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid
      unbind
    - iommu: rockchip: Fix directory table address encoding
    - drivers: usb: smsusb: fix error handling code in smsusb_init_device
    - media: dib7000p: Fix potential division by zero
    - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
    - media: cx24120: Add retval check for cx24120_message_send()
    - RDMA/siw: Fabricate a GID on tun and loopback devices
    - scsi: hisi_sas: Fix warnings detected by sparse
    - scsi: hisi_sas: Fix normally completed I/O analysed as failed
    - dt-bindings: extcon: maxim,max77843: restrict connector properties
    - media: amphion: reinit vpu if reqbufs output 0
    - media: amphion: add helper function to get id name
    - media: mtk-jpeg: Fix use after free bug due to uncanceled work
    - media: rkvdec: increase max supported height for H.264
    - media: amphion: fix CHECKED_RETURN issues reported by coverity
    - media: amphion: fix REVERSE_INULL issues reported by coverity
    - media: amphion: fix UNINIT issues reported by coverity
    - media: amphion: fix UNUSED_VALUE issue reported by coverity
    - media: amphion: ensure the bitops don't cross boundaries
    - media: mediatek: vcodec: Return NULL if no vdec_fb is found
    - media: mediatek: vcodec: fix potential double free
    - media: mediatek: vcodec: fix resource leaks in vdec_msg_queue_init()
    - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
    - scsi: RDMA/srp: Fix residual handling
    - scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param()
    - scsi: iscsi: Add length check for nlattr payload
    - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
    - scsi: be2iscsi: Add length check when parsing nlattrs
    - scsi: qla4xxx: Add length check when parsing nlattrs
    - iio: accel: adxl313: Fix adxl313_i2c_id[] table
    - serial: sprd: Assign sprd_port after initialized to avoid wrong access
    - serial: sprd: Fix DMA buffer leak issue
    - x86/APM: drop the duplicate APM_MINOR_DEV macro
    - RDMA/rxe: Split rxe_run_task() into two subroutines
    - RDMA/rxe: Fix incomplete state save in rxe_requester
    - scsi: qedf: Do not touch __user pointer in
      qedf_dbg_stop_io_on_error_cmd_read() directly
    - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read()
      directly
    - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read()
      directly
    - RDMA/irdma: Replace one-element array with flexible-array member
    - coresight: tmc: Explicit type conversions to prevent integer overflow
    - interconnect: qcom: qcm2290: Enable sync state
    - dma-buf/sync_file: Fix docs syntax
    - driver core: test_async: fix an error code
    - driver core: Call dma_cleanup() on the test_remove path
    - kernfs: add stub helper for kernfs_generic_poll()
    - extcon: cht_wc: add POWER_SUPPLY dependency
    - iommu/mediatek: Remove unused "mapping" member from mtk_iommu_data
    - iommu/mediatek: Fix two IOMMU share pagetable issue
    - iommu/sprd: Add missing force_aperture
    - RDMA/hns: Fix port active speed
    - RDMA/hns: Fix incorrect post-send with direct wqe of wr-list
    - RDMA/hns: Fix inaccurate error label name in init instance
    - RDMA/hns: Fix CQ and QP cache affinity
    - IB/uverbs: Fix an potential error pointer dereference
    - fsi: aspeed: Reset master errors after CFAM reset
    - iommu/qcom: Disable and reset context bank before programming
    - iommu/vt-d: Fix to flush cache of PASID directory table
    - platform/x86: dell-sysman: Fix reference leak
    - media: cec: core: add adap_nb_transmit_canceled() callback
    - media: cec: core: add adap_unconfigured() callback
    - media: go7007: Remove redundant if statement
    - media: venus: hfi_venus: Only consider sys_idle_indicator on V1
    - docs: ABI: fix spelling/grammar in SBEFIFO timeout interface
    - USB: gadget: core: Add missing kerneldoc for vbus_work
    - USB: gadget: f_mass_storage: Fix unused variable warning
    - drivers: base: Free devm resources when unregistering a device
    - HID: input: Support devices sending Eraser without Invert
    - media: ov5640: Enable MIPI interface in ov5640_set_power_mipi()
    - media: ov5640: Fix initial RESETB state and annotate timings
    - media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
    - media: ov2680: Remove auto-gain and auto-exposure controls
    - media: ov2680: Fix ov2680_bayer_order()
    - media: ov2680: Fix vflip / hflip set functions
    - media: ov2680: Remove VIDEO_V4L2_SUBDEV_API ifdef-s
    - media: ov2680: Don't take the lock for try_fmt calls
    - media: ov2680: Add ov2680_fill_format() helper function
    - media: ov2680: Fix ov2680_set_fmt() which == V4L2_SUBDEV_FORMAT_TRY not
      working
    - media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors
    - media: i2c: rdacm21: Fix uninitialized value
    - f2fs: fix to avoid mmap vs set_compress_option case
    - f2fs: judge whether discard_unit is section only when have
      CONFIG_BLK_DEV_ZONED
    - f2fs: Only lfs mode is allowed with zoned block device feature
    - Revert "f2fs: fix to do sanity check on extent cache correctly"
    - cgroup:namespace: Remove unused cgroup_namespaces_init()
    - coresight: trbe: Fix TRBE potential sleep in atomic context
    - RDMA/irdma: Prevent zero-length STAG registration
    - scsi: core: Use 32-bit hostnum in scsi_host_lookup()
    - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
    - interconnect: qcom: sm8450: Enable sync_state
    - interconnect: qcom: bcm-voter: Improve enable_mask handling
    - interconnect: qcom: bcm-voter: Use enable_maks for keepalive voting
    - serial: tegra: handle clk prepare error in tegra_uart_hw_init()
    - amba: bus: fix refcount leak
    - Revert "IB/isert: Fix incorrect release of isert connection"
    - RDMA/siw: Balance the reference of cep->kref in the error path
    - RDMA/siw: Correct wrong debug message
    - RDMA/efa: Fix wrong resources deallocation order
    - HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()
    - HID: uclogic: Correct devm device reference for hidinput input_dev name
    - HID: multitouch: Correct devm device reference for hidinput input_dev name
    - platform/x86/amd/pmf: Fix a missing cleanup path
    - tick/rcu: Fix false positive "softirq work is pending" messages
    - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS
    - tracing: Remove extra space at the end of hwlat_detector/mode
    - tracing: Fix race issue between cpu buffer write and swap
    - mtd: rawnand: brcmnand: Fix mtd oobsize
    - dmaengine: idxd: Modify the dependence of attribute pasid_enabled
    - phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328
    - phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate
    - phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write
    - rpmsg: glink: Add check for kstrdup
    - leds: pwm: Fix error code in led_pwm_create_fwnode()
    - leds: multicolor: Use rounded division when calculating color components
    - leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false
    - leds: trigger: tty: Do not use LED_ON/OFF constants, use
      led_blink_set_oneshot instead
    - mtd: spi-nor: Check bus width while setting QE bit
    - mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume()
    - um: Fix hostaudio build errors
    - dmaengine: ste_dma40: Add missing IRQ check in d40_probe
    - Drivers: hv: vmbus: Don't dereference ACPI root object handle
    - cpufreq: Fix the race condition while updating the transition_task of policy
    - virtio_ring: fix avail_wrap_counter in virtqueue_add_packed
    - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
    - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for
      ip_set_hash_netportnet.c
    - netfilter: nft_exthdr: Fix non-linear header modification
    - netfilter: xt_u32: validate user space input
    - netfilter: xt_sctp: validate the flag_info count
    - skbuff: skb_segment, Call zero copy functions before using skbuff frags
    - igb: set max size RX buffer when store bad packet is enabled
    - PM / devfreq: Fix leak in devfreq_dev_release()
    - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
    - rcu: dump vmalloc memory info safely
    - printk: ringbuffer: Fix truncating buffer size min_t cast
    - scsi: core: Fix the scsi_set_resid() documentation
    - mm/vmalloc: add a safer version of find_vm_area() for debug
    - cpu/hotplug: Prevent self deadlock on CPU hot-unplug
    - media: i2c: ccs: Check rules is non-NULL
    - media: i2c: Add a camera sensor top level menu
    - PCI: rockchip: Use 64-bit mask on MSI 64-bit PCI address
    - ipmi_si: fix a memleak in try_smi_init()
    - ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
    - XArray: Do not return sibling entries from xa_load()
    - io_uring: break iopolling on signal
    - backlight/gpio_backlight: Compare against struct fb_info.device
    - backlight/bd6107: Compare against struct fb_info.device
    - backlight/lv5207lp: Compare against struct fb_info.device
    - drm/amd/display: register edp_backlight_control() for DCN301
    - xtensa: PMU: fix base address for the newer hardware
    - LoongArch: mm: Add p?d_leaf() definitions
    - i3c: master: svc: fix probe failure when no i3c device exist
    - arm64: csum: Fix OoB access in IP checksum code for negative lengths
    - ALSA: hda/cirrus: Fix broken audio on hardware with two CS42L42 codecs.
    - media: dvb: symbol fixup for dvb_attach()
    - media: venus: hfi_venus: Write to VIDC_CTRL_INIT after unmasking interrupts
    - Revert "scsi: qla2xxx: Fix buffer overrun"
    - scsi: mpt3sas: Perform additional retries if doorbell read returns 0
    - PCI: Free released resource after coalescing
    - PCI: hv: Fix a crash in hv_pci_restore_msi_msg() during hibernation
    - PCI/PM: Only read PCI_PM_CTRL register when available
    - ntb: Drop packets when qp link is down
    - ntb: Clean up tx tail index on link down
    - ntb: Fix calculation ntb_transport_tx_free_entry()
    - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
    - block: don't add or resize partition on the disk with GENHD_FL_NO_PART
    - procfs: block chmod on /proc/thread-self/comm
    - parisc: Fix /proc/cpuinfo output for lscpu
    - drm/amd/display: Add smu write msg id fail retry process
    - bpf: Fix issue in verifying allow_ptr_leaks
    - dlm: fix plock lookup when using multiple lockspaces
    - dccp: Fix out of bounds access in DCCP error handler
    - x86/sev: Make enc_dec_hypercall() accept a size instead of npages
    - X.509: if signature is unsupported skip validation
    - net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
    - fsverity: skip PKCS#7 parser when keyring is empty
    - x86/MCE: Always save CS register on AMD Zen IF Poison errors
    - platform/chrome: chromeos_acpi: print hex string for ACPI_TYPE_BUFFER
    - mmc: renesas_sdhi: register irqs before registering controller
    - pstore/ram: Check start of empty przs during init
    - arm64: sdei: abort running SDEI handlers during crash
    - s390/dcssblk: fix kernel crash with list_add corruption
    - s390/ipl: add missing secure/has_secure file to ipl type 'unknown'
    - s390/dasd: fix string length handling
    - crypto: stm32 - fix loop iterating through scatterlist for DMA
    - cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
    - of: property: fw_devlink: Add a devlink for panel followers
    - usb: typec: tcpm: set initial svdm version based on pd revision
    - usb: typec: bus: verify partner exists in typec_altmode_attention
    - USB: core: Unite old scheme and new scheme descriptor reads
    - USB: core: Change usb_get_device_descriptor() API
    - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
    - USB: core: Fix oversight in SuperSpeed initialization
    - x86/sgx: Break up long non-preemptible delays in sgx_vepc_release()
    - perf/x86/uncore: Correct the number of CHAs on EMR
    - serial: sc16is7xx: remove obsolete out_thread label
    - serial: sc16is7xx: fix regression with GPIO configuration
    - tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY
    - Revert "drm/amd/display: Do not set drr on pipe commit"
    - md: Free resources in __md_stop
    - NFSv4.2: Fix a potential double free with READ_PLUS
    - NFSv4.2: Rework scratch handling for READ_PLUS (again)
    - md: fix regression for null-ptr-deference in __md_stop()
    - clk: Mark a fwnode as initialized when using CLK_OF_DECLARE() macro
    - treewide: Fix probing of devices in DT overlays
    - clk: Avoid invalid function names in CLK_OF_DECLARE()
    - udf: initialize newblock to 0
    - Linux 6.1.53
    - upstream stable to v6.1.53

* Fix non-working I219 after system sleep (LP: #2035313)
    - mei: mei-me: resume device in prepare

* allow io_uring to be disabled in runtime (LP: #2035116)
    - io_uring: add a sysctl to disable io_uring system-wide

* Jammy update: v6.1.52 upstream stable release (LP: #2035358)
    - erofs: ensure that the post-EOF tails are all zeroed
    - ksmbd: fix wrong DataOffset validation of create context
    - ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()
    - ksmbd: replace one-element array with flex-array member in struct
      smb2_ea_info
    - ksmbd: reduce descriptor size if remaining bytes is less than request size
    - ARM: pxa: remove use of symbol_get()
    - mmc: au1xmmc: force non-modular build and remove symbol_get usage
    - net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
    - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
    - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
    - USB: serial: option: add Quectel EM05G variant (0x030e)
    - USB: serial: option: add FOXCONN T99W368/T99W373 product
    - ALSA: usb-audio: Fix init call orders for UAC1
    - usb: dwc3: meson-g12a: do post init to fix broken usb after resumption
    - usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0
    - HID: wacom: remove the battery when the EKR is off
    - staging: rtl8712: fix race condition
    - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race
      condition
    - wifi: mt76: mt7921: do not support one stream on secondary antenna only
    - wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU
    - serial: qcom-geni: fix opp vote on shutdown
    - serial: sc16is7xx: fix broken port 0 uart init
    - serial: sc16is7xx: fix bug when first setting GPIO direction
    - firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
    - fsi: master-ast-cf: Add MODULE_FIRMWARE macro
    - tcpm: Avoid soft reset when partner does not support get_status
    - dt-bindings: sc16is7xx: Add property to change GPIO function
    - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
    - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
    - usb: typec: tcpci: clear the fault status bit
    - pinctrl: amd: Don't show `Invalid config param` errors
    - Linux 6.1.52
    - upstream stable to v6.1.52

* Jammy update: v6.1.51 upstream stable release (LP: #2035357)
    - ACPI: thermal: Drop nocrt parameter
    - module: Expose module_init_layout_section()
    - arm64: module-plts: inline linux/moduleloader.h
    - arm64: module: Use module_init_layout_section() to spot init sections
    - ARM: module: Use module_init_layout_section() to spot init sections
    - lockdep: fix static memory detection even more
    - parisc: Cleanup mmap implementation regarding color alignment
    - parisc: sys_parisc: parisc_personality() is called from asm code
    - io_uring/parisc: Adjust pgoff in io_uring mmap() for parisc
    - kallsyms: Fix kallsyms_selftest failure
    - Linux 6.1.51
    - upstream stable to v6.1.51

* Jammy update: v6.1.50 upstream stable release (LP: #2035356)
    - NFSv4.2: fix error handling in nfs42_proc_getxattr
    - NFSv4: fix out path in __nfs4_get_acl_uncached
    - xprtrdma: Remap Receive buffers after a reconnect
    - drm/ast: Use drm_aperture_remove_conflicting_pci_framebuffers
    - fbdev/radeon: use pci aperture helpers
    - PCI: acpiphp: Reassign resources on bridge if necessary
    - MIPS: cpu-features: Enable octeon_cache by cpu_type
    - MIPS: cpu-features: Use boot_cpu_type for CPU type based features
    - jbd2: remove t_checkpoint_io_list
    - jbd2: remove journal_clean_one_cp_list()
    - jbd2: fix a race when checking checkpoint buffer busy
    - can: raw: fix receiver memory leak
    - can: raw: fix lockdep issue in raw_release()
    - s390/zcrypt: remove unnecessary (void *) conversions
    - s390/zcrypt: fix reply buffer calculations for CCA replies
    - drm/i915: Add the gen12_needs_ccs_aux_inv helper
    - drm/i915/gt: Ensure memory quiesced before invalidation
    - drm/i915/gt: Poll aux invalidation register bit on invalidation
    - drm/i915/gt: Support aux invalidation on all engines
    - tracing: Fix cpu buffers unavailable due to 'record_disabled' missed
    - tracing: Fix memleak due to race between current_tracer and trace
    - octeontx2-af: SDP: fix receive link config
    - devlink: move code to a dedicated directory
    - devlink: add missing unregister linecard notification
    - net: dsa: felix: fix oversize frame dropping for always closed tc-taprio
      gates
    - sock: annotate data-races around prot->memory_pressure
    - dccp: annotate data-races in dccp_poll()
    - ipvlan: Fix a reference count leak warning in ipvlan_ns_exit()
    - mlxsw: pci: Set time stamp fields also when its type is MIRROR_UTC
    - mlxsw: reg: Fix SSPR register layout
    - mlxsw: Fix the size of 'VIRT_ROUTER_MSB'
    - selftests: mlxsw: Fix test failure on Spectrum-4
    - net: dsa: mt7530: fix handling of 802.1X PAE frames
    - net: bgmac: Fix return value check for fixed_phy_register()
    - net: bcmgenet: Fix return value check for fixed_phy_register()
    - net: validate veth and vxcan peer ifindexes
    - ipv4: fix data-races around inet->inet_id
    - ice: fix receive buffer size miscalculation
    - Revert "ice: Fix ice VF reset during iavf initialization"
    - ice: Fix NULL pointer deref during VF reset
    - selftests: bonding: do not set port down before adding to bond
    - can: isotp: fix support for transmission of SF without flow control
    - igb: Avoid starting unnecessary workqueues
    - igc: Fix the typo in the PTM Control macro
    - net/sched: fix a qdisc modification with ambiguous command request
    - i40e: fix potential NULL pointer dereferencing of pf->vf
      i40e_sync_vsi_filters()
    - netfilter: nf_tables: flush pending destroy work before netlink notifier
    - netfilter: nf_tables: fix out of memory error handling
    - rtnetlink: Reject negative ifindexes in RTM_NEWLINK
    - bonding: fix macvlan over alb bond support
    - KVM: x86: Preserve TDP MMU roots until they are explicitly invalidated
    - KVM: x86/mmu: Fix an sign-extension bug with mmu_seq that hangs vCPUs
    - ASoC: amd: yc: Add VivoBook Pro 15 to quirks list for acp6x
    - ASoC: cs35l41: Correct amp_gain_tlv values
    - ibmveth: Use dcbf rather than dcbfl
    - wifi: mac80211: limit reorder_buf_filtered to avoid UBSAN warning
    - platform/x86: ideapad-laptop: Add support for new hotkeys found on ThinkBook
      14s Yoga ITL
    - NFSv4: Fix dropped lock for racing OPEN and delegation return
    - clk: Fix slab-out-of-bounds error in devm_clk_release()
    - mm,ima,kexec,of: use memblock_free_late from ima_free_kexec_buffer
    - shmem: fix smaps BUG sleeping while atomic
    - ALSA: ymfpci: Fix the missing snd_card_free() call at probe error
    - mm/gup: handle cont-PTE hugetlb pages correctly in gup_must_unshare() via
      GUP-fast
    - mm: add a call to flush_cache_vmap() in vmap_pfn()
    - mm: memory-failure: fix unexpected return value in soft_offline_page()
    - NFS: Fix a use after free in nfs_direct_join_group()
    - nfsd: Fix race to FREE_STATEID and cl_revoked
    - selinux: set next pointer before attaching to list
    - batman-adv: Trigger events for auto adjusted MTU
    - batman-adv: Don't increase MTU when set by user
    - batman-adv: Do not get eth header before batadv_check_management_packet
    - batman-adv: Fix TT global entry leak when client roamed back
    - batman-adv: Fix batadv_v_ogm_aggr_send memory leak
    - batman-adv: Hold rtnl lock during MTU update via netlink
    - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
    - riscv: Handle zicsr/zifencei issue between gcc and binutils
    - riscv: Fix build errors using binutils2.37 toolchains
    - radix tree: remove unused variable
    - of: unittest: Fix EXPECT for parse_phandle_with_args_map() test
    - of: dynamic: Refactor action prints to not use "%pOF" inside devtree_lock
    - pinctrl: amd: Mask wake bits on probe again
    - media: vcodec: Fix potential array out-of-bounds in encoder queue_setup
    - PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root
      bus
    - drm/vmwgfx: Fix shader stage validation
    - drm/display/dp: Fix the DP DSC Receiver cap size
    - x86/fpu: Invalidate FPU state correctly on exec()
    - x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4
    - hwmon: (aquacomputer_d5next) Add selective 200ms delay after sending ctrl
      report
    - selftests/net: mv bpf/nat6to4.c to net folder
    - nfs: use vfs setgid helper
    - nfsd: use vfs setgid helper
    - cgroup/cpuset: Rename functions dealing with DEADLINE accounting
    - sched/cpuset: Bring back cpuset_mutex
    - sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets
    - cgroup/cpuset: Iterate only if DEADLINE tasks are present
    - sched/deadline: Create DL BW alloc, free & check overflow interface
    - cgroup/cpuset: Free DL BW in case can_attach() fails
    - ublk: remove check IO_URING_F_SQE128 in ublk_ch_uring_cmd
    - can: raw: add missing refcount for memory leak fix
    - madvise:madvise_free_pte_range(): don't use mapcount() against large folio
      for sharing check
    - scsi: snic: Fix double free in snic_tgt_create()
    - scsi: core: raid_class: Remove raid_component_add()
    - clk: Fix undefined reference to `clk_rate_exclusive_{get,put}'
    - pinctrl: renesas: rzg2l: Fix NULL pointer dereference in
      rzg2l_dt_subnode_to_map()
    - pinctrl: renesas: rzv2m: Fix NULL pointer dereference in
      rzv2m_dt_subnode_to_map()
    - pinctrl: renesas: rza2: Add lock around
      pinctrl_generic{{add,remove}_group,{add,remove}_function}
    - dma-buf/sw_sync: Avoid recursive lock during fence signal
    - gpio: sim: dispose of irq mappings before destroying the irq_sim domain
    - gpio: sim: pass the GPIO device's software node to irq domain
    - ASoC: amd: yc: Fix a non-functional mic on Lenovo 82SJ
    - maple_tree: disable mas_wr_append() when other readers are possible
    - ASoC: amd: vangogh: select CONFIG_SND_AMD_ACP_CONFIG
    - Linux 6.1.50
    - upstream stable to v6.1.50

* Jammy update: v6.1.49 upstream stable release (LP: #2035355)
    - Revert "f2fs: don't reset unchangable mount option in f2fs_remount()"
    - Revert "f2fs: fix to set flush_merge opt and show noflush_merge"
    - Revert "f2fs: fix to do sanity check on direct node in truncate_dnode()"
    - Linux 6.1.49
    - upstream stable to v6.1.49

* Jammy update: v6.1.48 upstream stable release (LP: #2035354)
    - Linux 6.1.48
    - upstream stable to v6.1.48

* Jammy update: v6.1.47 upstream stable release (LP: #2033642)
    - mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
    - cpuidle: psci: Extend information in log about OSI/PC mode
    - cpuidle: psci: Move enabling OSI mode after power domains creation
    - zsmalloc: consolidate zs_pool's migrate_lock and size_class's locks
    - zsmalloc: fix races between modifications of fullness and isolated
    - selftests: forwarding: tc_actions: cleanup temporary files when test is
      aborted
    - selftests: forwarding: tc_actions: Use ncat instead of nc
    - net/smc: replace mutex rmbs_lock and sndbufs_lock with rw_semaphore
    - net/smc: Fix setsockopt and sysctl to specify same buffer size again
    - net: phy: at803x: Use devm_regulator_get_enable_optional()
    - net: phy: at803x: fix the wol setting functions
    - drm/amdgpu: fix calltrace warning in amddrm_buddy_fini
    - drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
    - drm/amdgpu: fix memory leak in mes self test
    - ASoC: Intel: sof_sdw: add quirk for MTL RVP
    - ASoC: Intel: sof_sdw: add quirk for LNL RVP
    - PCI: tegra194: Fix possible array out of bounds access
    - ASoC: SOF: amd: Add pci revision id check
    - drm/stm: ltdc: fix late dereference check
    - drm: rcar-du: remove R-Car H3 ES1.* workarounds
    - ASoC: amd: vangogh: Add check for acp config flags in vangogh platform
    - ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
    - ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in _exit
    - ASoC: Intel: sof_sdw: Add support for Rex soundwire
    - iopoll: Call cpu_relax() in busy loops
    - ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion
    - dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
    - accel/habanalabs: add pci health check during heartbeat
    - HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL
      Keyboard
    - iommu/amd: Introduce Disable IRTE Caching Support
    - drm/amdgpu: install stub fence into potential unused fence pointers
    - drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz
    - RDMA/mlx5: Return the firmware result upon destroying QP/RQ
    - drm/amd/display: Skip DPP DTO update if root clock is gated
    - drm/amd/display: Enable dcn314 DPP RCO
    - ASoC: SOF: core: Free the firmware trace before calling snd_sof_shutdown()
    - HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID
    - ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio
    - smb: client: fix warning in cifs_smb3_do_mount()
    - cifs: fix session state check in reconnect to avoid use-after-free issue
    - serial: stm32: Ignore return value of uart_remove_one_port() in .remove()
    - led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node()
      loops
    - media: v4l2-mem2mem: add lock to protect parameter num_rdy
    - media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250
    - usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
    - usb: gadget: uvc: queue empty isoc requests if no video buffer is available
    - media: platform: mediatek: vpu: fix NULL ptr dereference
    - thunderbolt: Read retimer NVM authentication status prior
      tb_retimer_set_inbound_sbtx()
    - usb: chipidea: imx: don't request QoS for imx8ulp
    - usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
    - gfs2: Fix possible data races in gfs2_show_options()
    - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
    - thunderbolt: Add Intel Barlow Ridge PCI ID
    - thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth
    - firewire: net: fix use after free in fwnet_finish_incoming_packet()
    - watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)
    - Bluetooth: L2CAP: Fix use-after-free
    - Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
    - ceph: try to dump the msgs when decoding fails
    - drm/amdgpu: Fix potential fence use-after-free v2
    - fs/ntfs3: Enhance sanity check while generating attr_list
    - fs: ntfs3: Fix possible null-pointer dereferences in mi_read()
    - fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted
    - ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
    - ALSA: hda: fix a possible null-pointer dereference due to data race in
      snd_hdac_regmap_sync()
    - ALSA: hda/realtek: Add quirk for ASUS ROG GX650P
    - ALSA: hda/realtek: Add quirk for ASUS ROG GA402X
    - ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V
    - powerpc/kasan: Disable KCOV in KASAN code
    - Bluetooth: MGMT: Use correct address for memcpy()
    - ring-buffer: Do not swap cpu_buffer during resize process
    - igc: read before write to SRRCTL register
    - drm/amd/display: save restore hdcp state when display is unplugged from mst
      hub
    - drm/amd/display: phase3 mst hdcp for multiple displays
    - drm/amd/display: fix access hdcp_workqueue assert
    - KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption
    - ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
    - fbdev/hyperv-fb: Do not set struct fb_info.apertures
    - btrfs: move out now unused BG from the reclaim list
    - btrfs: convert btrfs_block_group::needs_free_space to runtime flag
    - btrfs: convert btrfs_block_group::seq_zone to runtime flag
    - btrfs: fix use-after-free of new block group that became unused
    - virtio-mmio: don't break lifecycle of vm_dev
    - vduse: Use proper spinlock for IRQ injection
    - vdpa/mlx5: Fix mr->initialized semantics
    - vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary
    - cifs: fix potential oops in cifs_oplock_break
    - i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
    - i2c: hisi: Only handle the interrupt of the driver's transfer
    - i2c: tegra: Fix i2c-tegra DMA config option processing
    - fbdev: mmp: fix value check in mmphw_probe()
    - powerpc/rtas_flash: allow user copy to flash block cache objects
    - vdpa: Add features attr to vdpa_nl_policy for nlattr length check
    - vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
    - vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
    - vdpa: Enable strict validation for netlinks ops
    - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
    - tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32
      platforms
    - btrfs: fix incorrect splitting in btrfs_drop_extent_map_range
    - btrfs: fix BUG_ON condition in btrfs_cancel_balance
    - i2c: designware: Correct length byte validation logic
    - i2c: designware: Handle invalid SMBus block data response length value
    - net: xfrm: Fix xfrm_address_filter OOB read
    - net: af_key: fix sadb_x_filter validation
    - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
    - xfrm: fix slab-use-after-free in decode_session6
    - ip6_vti: fix slab-use-after-free in decode_session6
    - ip_vti: fix potential slab-use-after-free in decode_session6
    - xfrm: add NULL check in xfrm_update_ae_params
    - xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
    - virtio_net: notify MAC address change on device initialization
    - virtio-net: set queues after driver_ok
    - net: pcs: Add missing put_device call in miic_create
    - net: phy: fix IRQ-based wake-on-lan over hibernate / power off
    - selftests: mirror_gre_changes: Tighten up the TTL test match
    - drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
    - net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source
    - octeon_ep: cancel tx_timeout_task later in remove sequence
    - netfilter: nf_tables: fix false-positive lockdep splat
    - ipvs: fix racy memcpy in proc_do_sync_threshold
    - netfilter: nft_dynset: disallow object maps
    - net: phy: broadcom: stub c45 read/write for 54810
    - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
    - net: openvswitch: reject negative ifindex
    - iavf: fix FDIR rule fields masks validation
    - i40e: fix misleading debug logs
    - net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
    - sfc: don't unregister flow_indr if it was never registered
    - sock: Fix misuse of sk_under_memory_pressure()
    - net: do not allow gso_size to be set to GSO_BY_FRAGS
    - qede: fix firmware halt over suspend and resume
    - ice: Block switchdev mode when ADQ is active and vice versa
    - bus: ti-sysc: Flush posted write on enable before reset
    - arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict
    - arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
    - arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+
    - ARM: dts: imx: align LED node names with dtschema
    - ARM: dts: imx6: phytec: fix RTC interrupt level
    - arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration
    - ARM: dts: imx: Set default tuning step for imx6sx usdhc
    - arm64: dts: imx93: Fix anatop node size
    - ASoC: rt5665: add missed regulator_bulk_disable
    - ASoC: meson: axg-tdm-formatter: fix channel slot allocation
    - ALSA: hda/realtek: Add quirks for HP G11 Laptops
    - soc: aspeed: uart-routing: Use __sysfs_match_string
    - soc: aspeed: socinfo: Add kfree for kstrdup
    - ALSA: hda/realtek - Remodified 3k pull low procedure
    - riscv: uaccess: Return the number of bytes effectively not copied
    - serial: 8250: Fix oops for port->pm on uart_change_pm()
    - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback
      interfaces.
    - cifs: Release folio lock on fscache read hit.
    - virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case
    - arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards
    - blk-crypto: dynamically allocate fallback profile
    - mmc: wbsd: fix double mmc_free_host() in wbsd_init()
    - mmc: block: Fix in_flight[issue_type] value error
    - drm/qxl: fix UAF on handle creation
    - drm/i915/sdvo: fix panel_type initialization
    - drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7
    - ASoC: amd: vangogh: select CONFIG_SND_AMD_ACP_CONFIG
    - drm/amd/display: disable RCO for DCN314
    - zsmalloc: allow only one active pool compaction context
    - sched/fair: unlink misfit task from cpu overutilized
    - sched/fair: Remove capacity inversion detection
    - drm/amd/display: Implement workaround for writing to OTG_PIXEL_RATE_DIV
      register
    - hugetlb: do not clear hugetlb dtor until allocating vmemmap
    - netfilter: set default timeout to 3 secs for sctp shutdown send and recv
      state
    - arm64/ptrace: Ensure that SME is set up for target when writing SSVE state
    - drm/amdgpu: keep irq count in amdgpu_irq_disable_all
    - af_unix: Fix null-ptr-deref in unix_stream_sendpage().
    - drm/nouveau/disp: fix use-after-free in error handling of
      nouveau_connector_create
    - net: fix the RTO timer retransmitting skb every 1ms if linear option is
      enabled
    - mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
    - Linux 6.1.47
    - upstream stable to v6.1.47

* CVE-2023-20569
    - x86/cpu, kvm: Add support for CPUID_80000021_EAX
    - x86/srso: Add a Speculative RAS Overflow mitigation
    - x86/srso: Add IBPB_BRTYPE support
    - x86/srso: Add SRSO_NO support
    - x86/srso: Add IBPB
    - x86/srso: Add IBPB on VMEXIT
    - x86/srso: Fix return thunks in generated code
    - x86/srso: Add a forgotten NOENDBR annotation
    - x86/srso: Tie SBPB bit setting to microcode patch detection
    - x86: fix backwards merge of GDS/SRSO bit
    - x86/srso: Fix build breakage with the LLVM linker
    - x86/cpu: Fix __x86_return_thunk symbol type
    - x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
    - x86/alternative: Make custom return thunk unconditional
    - x86/cpu: Clean up SRSO return thunk mess
    - x86/cpu: Rename original retbleed methods
    - x86/cpu: Rename srso_(.*)_alias to srso_alias_\1
    - x86/cpu: Cleanup the untrain mess
    - x86/srso: Explain the untraining sequences a bit more
    - x86/static_call: Fix __static_call_fixup()
    - x86/retpoline: Don't clobber RFLAGS during srso_safe_ret()
    - x86/srso: Disable the mitigation on unaffected configurations
    - x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG
    - objtool/x86: Fixup frame-pointer vs rethunk
    - x86/srso: Correct the mitigation status when SMT is disabled
    - objtool/x86: Fix SRSO mess
    - Ubuntu: [Config]: enable Speculative Return Stack Overflow mitigation

* Enable ASPM for NVMe behind VMD (LP: #2034504)
    - Revert "UBUNTU: SAUCE: vmd: fixup bridge ASPM by driver name instead"
    - Revert "UBUNTU: SAUCE: PCI/ASPM: Enable LTR for endpoints behind VMD"
    - Revert "UBUNTU: SAUCE: PCI/ASPM: Enable ASPM for links under VMD domain"
    - PCI/ASPM: Add pci_enable_link_state()
    - PCI: vmd: Use PCI_VDEVICE in device list
    - PCI: vmd: Create feature grouping for client products
    - PCI: vmd: Add quirk to configure PCIe ASPM and LTR
    - SAUCE: PCI/ASPM: Allow ASPM override over FADT default
    - SAUCE: PCI: vmd: Mark ASPM override for device behind VMD bridge

* Miscellaneous Ubuntu changes
    - [Config] Update annotations after merging 6.1.53

-- Timo Aaltonen <timo.aaltonen@canonical.com>  Fri, 15 Sep 2023 15:41:43 +0300

Changed in linux-oem-6.1 (Ubuntu Jammy):
status:	Fix Committed → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntulinux-oem-6.1 package