linux (5.10.223-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.222 - Compiler Attributes: Add __uninitialized macro - [arm64,armhf] drm/lima: fix shared irq handling on driver remove - media: dvb: as102-fe: Fix as10x_register_addr packing - media: dvb-usb: dib0700_devices: Add missing release_firmware() - IB/core: Implement a limit on UMAD receive List - scsi: qedf: Make qedf_execute_tmf() non-preemptible - crypto: aead,cipher - zeroize key buffer after use - drm/amdgpu: Initialize timestamp for some legacy SOCs - drm/amd/display: Check index msg_id before read or write - drm/amd/display: Check pipe offset before setting vblank - drm/amd/display: Skip finding free audio for unknown engine_id - media: dw2102: Don't translate i2c read into write - sctp: prefer struct_size over open coded arithmetic - firmware: dmi: Stop decoding on broken entry - Input: ff-core - prefer struct_size over open coded arithmetic - [arm64,armhf] net: dsa: mv88e6xxx: Correct check for empty list - media: dvb-frontends: tda18271c2dd: Remove casting during div - media: s2255: Use refcount_t instead of atomic_t for num_channels - media: dvb-frontends: tda10048: Fix integer overflow - i2c: i801: Annotate apanel_addr as __ro_after_init - [powerpc*] 64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n - orangefs: fix out-of-bounds fsid access - kunit: Fix timeout message - [powerpc*] xmon: Check cpu id in commands "c#", "dp#" and "dx#" - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD - jffs2: Fix potential illegal address access in jffs2_free_inode - [s390x] pkey: Wipe sensitive data on failure - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open() - tcp_metrics: validate source addr length - wifi: wilc1000: fix ies_len type in connect path - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CVE-2024-39487) - inet_diag: Initialize pad field in struct inet_diag_req_v2 - nilfs2: fix inode number range checks - nilfs2: add missing check for inode numbers on directory entries - mm: optimize the redundant loop of mm_update_owner_next() - mm: avoid overflows in dirty throttling logic - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot - can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct - fsnotify: Do not generate events for O_PATH file descriptors - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes - drm/amdgpu/atomfirmware: silence UBSAN warning - mtd: rawnand: Bypass a couple of sanity checks during NAND identification - bnx2x: Fix multiple UBSAN array-index-out-of-bounds - bpf, sockmap: Fix sk->sk_forward_alloc warn_on in sk_stream_kill_queues - ima: Avoid blocking in RCU read-side critical section (CVE-2024-40947) - media: dw2102: fix a potential buffer overflow - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897 - nvme-multipath: find NUMA path only for online numa-node - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset - [x86] platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW 11.6" tablet - [x86] platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro - nvmet: fix a possible leak when destroy a ctrl during qp establishment - kbuild: fix short log for AS in link-vmlinux.sh - nilfs2: fix incorrect inode allocation from reserved inodes - mm: prevent derefencing NULL ptr in pfn_section_valid() - filelock: fix potential use-after-free in posix_lock_inode - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading - vfs: don't mod negative dentry count when on shrinker list - tcp: fix incorrect undo caused by DSACK of TLP retransmit - net: lantiq_etop: add blank line after declaration - net: ethernet: lantiq_etop: fix double free in detach - ppp: reject claimed-as-LCP but actually malformed packets - ethtool: netlink: do not return SQI value if link is down - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). - net/sched: Fix UAF when resolving a clash - [s390x] Mark psw in __load_psw_mask() as __unitialized - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() - tcp: avoid too many retransmit packets (CVE-2024-41007) - net: ks8851: Fix potential TX stall after interface reopen - USB: serial: option: add Telit generic core-dump composition - USB: serial: option: add Telit FN912 rmnet compositions - USB: serial: option: add Fibocom FM350-GL - USB: serial: option: add support for Foxconn T99W651 - USB: serial: option: add Netprisma LCUK54 series modules - USB: serial: option: add Rolling RW350-GL variants - USB: serial: mos7840: fix crash on resume - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor - hpet: Support 32-bit userspace - nvmem: meson-efuse: Fix return value of nvmem callbacks - ALSA: hda/realtek: Enable Mute LED on HP 250 G7 - ALSA: hda/realtek: Limit mic boost on VAIO PRO PX - libceph: fix race between delayed_work() and ceph_monc_stop() - wireguard: allowedips: avoid unaligned 64-bit memory accesses - wireguard: queueing: annotate intentional data race in cpu round robin - wireguard: send: annotate intentional data race in checking empty queue - x86/retpoline: Move a NOENDBR annotation to the SRSO dummy return thunk - ipv6: annotate data-races around cnf.disable_ipv6 - ipv6: prevent NULL dereference in ip6_output() (CVE-2024-36901) - bpf: Allow reads from uninit stack - nilfs2: fix kernel bug on rename operation of broken directory - i2c: mark HostNotify target address as used https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.223 - gcc-plugins: Rename last_stmt() for GCC 14+ - filelock: Remove locks reliably when fcntl/close race is detected (CVE-2024-41012) - scsi: qedf: Set qed_slowpath_params to zero before use - ACPI: EC: Abort address space access upon error - ACPI: EC: Avoid returning AE_OK on errors in address space handler - wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata - wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan() - Input: silead - Always support 10 fingers - net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input() - ila: block BH in ila_output() - [arm64] armv8_deprecated: Fix warning in isndep cpuhp starting process - null_blk: fix validation of block size - kconfig: gconf: give a proper initial state to the Save button - kconfig: remove wrong expr_trans_bool() - fs/file: fix the check in find_next_fd() - mei: demote client disconnect warning on suspend to debug - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check - [powerpc*] KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() - ALSA: hda/realtek: Add more codec ID to no shutup pins list - [mips*] fix compat_sys_lseek syscall - Input: elantech - fix touchpad state on resume for Lenovo N24 - Input: i8042 - add Ayaneo Kun to i8042 quirk table - [x86] bytcr_rt5640 : inverse jack detect for Archos 101 cesium - [arm*] ALSA: dmaengine: Synchronize dma channel after drop() - [armhf] ASoC: ti: davinci-mcasp: Set min period size using FIFO config - can: kvaser_usb: fix return value for hif_usb_send_regout - [s390x] sclp: Fix sclp_init() cleanup on failure - btrfs: qgroup: fix quota root leak after quota disable failure - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx - ALSA: dmaengine_pcm: terminate dmaengine before synchronize - net: usb: qmi_wwan: add Telit FN912 compositions - net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD() - [powerpc*] pseries: Whitelist dtl slub object for copying to userspace - [powerpc*] eeh: avoid possible crash when edev->pdev changes - scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed - Bluetooth: hci_core: cancel all works upon hci_unregister_dev() - fs: better handle deep ancestor chains in is_subdir() - spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices - hfsplus: fix uninit-value in copy_name - spi: mux: set ctlr->bits_per_word_mask - [arm*] 9324/1: fix get_user() broken with veneer - ACPI: processor_idle: Fix invalid comparison with insertion sort for latency - bpf: Fix overrunning reservations in ringbuf (CVE-2024-41009) - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue (CVE-2024-36938) - scsi: core: Fix a use-after-free (CVE-2022-48666) - ext4: fix error code saved on super block during file system abort - ext4: Send notifications on error - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() - net: relax socket state check at accept time. (CVE-2024-36484) - ocfs2: add bounds checking to ocfs2_check_dir_entry() - jfs: don't walk off the end of ealist - ALSA: hda/realtek: Enable headset mic on Positivo SU C1400 - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 - [arm64] dts: qcom: msm8996: Disable SS instance in Parkmode for USB - [arm*] ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is paused - filelock: Fix fcntl/close race recovery compat path - tun: add missing verification for short frame (CVE-2024-41091) - tap: add missing verification for short frame (CVE-2024-41090) [ Salvatore Bonaccorso ] * Bump ABI to 32 * fs/nfsd: Enable NFSD_V2 and NFSD_V2_ACL. Re-enable lost NFSv2 kernel support due to upstream backporting of 2f3a4b2ac2f2 ("nfsd: allow disabling NFSv2 at compile time") in 5.10.220. (Closes: #1076864) * netfilter: ipset: Add list flush to cancel_gc -- Salvatore Bonaccorso Sat, 10 Aug 2024 08:09:03 +0200 linux (5.10.221-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.219 - [x86] tsc: Trust initial offset in architectural TSC-adjust MSRs - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016) - speakup: Fix sizeof() vs ARRAY_SIZE() bug - ring-buffer: Fix a race between readers and resize checks (CVE-2024-38601) - nilfs2: fix unexpected freezing of nilfs_segctor_sync() - nilfs2: fix potential hang in nilfs_detach_log_writer() (CVE-2024-38582) - ALSA: core: Fix NULL module pointer assignment at card init (CVE-2024-38605) - wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class - net: usb: qmi_wwan: add Telit FN920C04 compositions - drm/amd/display: Set color_mgmt_changed to true on unsuspend - ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating - ASoC: dt-bindings: rt5645: add cbj sleeve gpio property - ASoC: rt715: add vendor clear control register - ASoC: da7219-aad: fix usage of device_get_named_child_node() - nvme: find numa distance only if controller has valid numa id - crypto: bcm - Fix pointer arithmetic (CVE-2024-38579) - firmware: raspberrypi: Use correct device for DMA mappings - ecryptfs: Fix buffer size for tag 66 packet (CVE-2024-38578) - nilfs2: fix out-of-range warning - [x86] crypto: ccp - drop platform ifdef checks - [x86] crypto: x86/nh-avx2 - add missing vzeroupper - [x86] crypto: x86/sha256-avx2 - add missing vzeroupper - [s390x] cio: fix tracepoint subchannel type field - jffs2: prevent xattr node from overflowing the eraseblock (CVE-2024-38599) - null_blk: Fix missing mutex_destroy() at module removal - md: fix resync softlockup when bitmap size is less than array size (CVE-2024-38598) - wifi: ath10k: poll service ready message before failing - [x86] boot: Ignore relocations in .notes sections in walk_relocs() too - qed: avoid truncating work queue length - scsi: ufs: qcom: Perform read back after writing reset bit - scsi: ufs-qcom: Fix ufs RST_n spec violation - scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US - scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0 - scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5 - scsi: ufs: qcom: Perform read back after writing unipro mode - scsi: ufs: qcom: Perform read back after writing CGC enable - scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV - scsi: ufs: core: Perform read back after disabling interrupts - scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL - irqchip/alpine-msi: Fix off-by-one in allocation error path - ACPI: disable -Wstringop-truncation - gfs2: Fix "ignore unlock failures after withdraw" - cpufreq: Reorganize checks in cpufreq_offline() - cpufreq: Split cpufreq_offline() - cpufreq: Rearrange locking in cpufreq_remove_dev() - cpufreq: exit() callback is optional - net: export inet_lookup_reuseport and inet6_lookup_reuseport - net: remove duplicate reuseport_lookup functions - udp: Avoid call to compute_score on multiple sites - scsi: libsas: Fix the failure of adding phy with zero-address to port - scsi: hpsa: Fix allocation size for Scsi_Host private data - [x86] purgatory: Switch to the position-independent small code model - wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() - wifi: ath10k: populate board data for WCN3990 - tcp: avoid premature drops in tcp_add_backlog() - net: give more chances to rcu in netdev_wait_allrefs_any() - macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" (CVE-2024-38607) - wifi: carl9170: add a proper sanity check for endpoints (CVE-2024-38567) - wifi: ar5523: enable proper endpoint verification (CVE-2024-38565) - Revert "sh: Handle calling csum_partial with misaligned data" - [amd64] HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors - scsi: bfa: Ensure the copied buf is NUL terminated (CVE-2024-38560) - scsi: qedf: Ensure the copied buf is NUL terminated (CVE-2024-38559) - wifi: mwl8k: initialize cmd->addr[] properly - usb: aqc111: stop lying about skb->truesize - net: usb: sr9700: stop lying about skb->truesize - net: ipv6: fix wrong start position when receive hop-by-hop fragment - eth: sungem: remove .ndo_poll_controller to avoid deadlocks (CVE-2024-38597) - net: ethernet: cortina: Locking fixes - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (CVE-2024-38596) - net: usb: smsc95xx: stop lying about skb->truesize - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (CVE-2024-38558) - ipv6: sr: add missing seg6_local_exit - ipv6: sr: fix incorrect unregister order - ipv6: sr: fix invalid unregister error path (CVE-2024-38612) - net/mlx5: Discard command completions in internal error (CVE-2024-38555) - drm/amd/display: Fix potential index out of bounds in color transformation function (CVE-2024-38552) - ASoC: soc-acpi: add helper to identify parent driver. - [x86] ASoC: Intel: Disable route checks for Skylake boards - mtd: rawnand: hynix: fixed typo - fbdev: shmobile: fix snprintf truncation - [arm64] drm/meson: vclk: fix calculation of 59.94 fractional rates - [powerpc*] fsl-soc: hide unused const variable - fbdev: sisfb: hide unused variables - media: ngene: Add dvb_ca_en50221_init return value check - media: radio-shark2: Avoid led_names truncations - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference (CVE-2024-38548) - fbdev: sh7760fb: allow modular build - media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries (CVE-2024-38547) - [arm64] drm/arm/malidp: fix a possible null pointer dereference (CVE-2024-36014) - [arm*] drm: vc4: Fix possible null pointer dereference (CVE-2024-38546) - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value - drm/bridge: lt9611: Don't log an error when DSI host can't be found - drm/bridge: tc358775: Don't log an error when DSI host can't be found - drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector - drm/mipi-dsi: use correct return type for the DSC functions - [arm64] RDMA/hns: Refactor the hns_roce_buf allocation flow - [arm64] RDMA/hns: Create QP with selected QPN for bank load balance - [arm64] RDMA/hns: Fix incorrect symbol types - [arm64] RDMA/hns: Fix return value in hns_roce_map_mr_sg - [arm64] RDMA/hns: Use complete parentheses in macros - [arm64] RDMA/hns: Modify the print level of CQE error (CVE-2024-38590) - clk: qcom: mmcc-msm8998: fix venus clock issue - [x86] insn: Fix PUSH instruction in x86 instruction decoder opcode map - ext4: avoid excessive credit estimate in ext4_tmpfile() - sunrpc: removed redundant procp check - ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple - ext4: fix unit mismatch in ext4_mb_new_blocks_simple - ext4: try all groups in ext4_mb_new_blocks_simple - ext4: remove unused parameter from ext4_mb_new_blocks_simple() - ext4: fix potential unnitialized variable - SUNRPC: Fix gss_free_in_token_pages() - RDMA/IPoIB: Fix format truncation compilation errors - net: qrtr: fix null-ptr-deref in qrtr_ns_remove - net: qrtr: ns: Fix module refcnt - netrom: fix possible dead-lock in nr_rt_ioctl() (CVE-2024-38589) - af_packet: do not call packet_read_pending() from tpacket_destruct_skb() - sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level - greybus: lights: check return of get_channel_from_mode (CVE-2024-38637) - f2fs: fix to wait on page writeback in __clone_blkaddrs() - soundwire: cadence: fix invalid PDI offset (CVE-2024-38635) - dmaengine: idma64: Add check for dma_set_max_seg_size - firmware: dmi-id: add a release callback function - serial: max3100: Lock port->lock when calling uart_handle_cts_change() (CVE-2024-38634) - serial: max3100: Update uart_driver_registered on driver removal (CVE-2024-38633) - serial: max3100: Fix bitwise types - greybus: arche-ctrl: move device table to its right location - serial: sc16is7xx: add proper sched.h include for sched_set_fifo() - f2fs: compress: support chksum - f2fs: add compress_mode mount option - f2fs: compress: clean up parameter of __f2fs_cluster_blocks() - f2fs: compress: remove unneeded preallocation - f2fs: introduce FI_COMPRESS_RELEASED instead of using IMMUTABLE bit - f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks() - f2fs: add cp_error check in f2fs_write_compressed_pages - f2fs: fix to force keeping write barrier for strict fsync mode - f2fs: do not allow partial truncation on pinned file - f2fs: fix typos in comments - f2fs: fix to relocate check condition in f2fs_fallocate() - f2fs: fix to check pinfile flag in f2fs_move_file_range() - iio: pressure: dps310: support negative temperature values - fpga: region: change FPGA indirect article to an - fpga: region: Rename dev to parent for parent device - docs: driver-api: fpga: avoid using UTF-8 chars - fpga: region: Use standard dev_release for class driver - fpga: region: add owner module and take its refcount - usb: gadget: u_audio: Clear uac pointer when freed. - stm class: Fix a double free in stm_register_device() (CVE-2024-38627) - ppdev: Remove usage of the deprecated ida_simple_xx() API - ppdev: Add an error check in register_device (CVE-2024-36015) - extcon: max8997: select IRQ_DOMAIN instead of depending on it - PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 - PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 - f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock - f2fs: fix to release node block count in error path of f2fs_new_node_page() - f2fs: compress: don't allow unaligned truncation on released compress inode - serial: sh-sci: protect invalidating RXDMA on shutdown - libsubcmd: Fix parse-options memory leak - [s390x] ipl: Fix incorrect initialization of len fields in nvme reipl block - [s390x] ipl: Fix incorrect initialization of nvme dump block - Input: ims-pcu - fix printf string overflow - Input: ioc3kbd - convert to platform remove callback returning void - Input: ioc3kbd - add device table - Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation - drm/msm/dpu: Always flush the slave INTF on the CTL - drm/bridge: tc358775: fix support for jeida-18 and jeida-24 - media: stk1160: fix bounds checking in stk1160_copy_video() (CVE-2024-38621) - scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy() - media: flexcop-usb: clean up endpoint sanity checks - media: flexcop-usb: fix sanity check of bNumEndpoints - [powerpc*] pseries: Add failure related checks for h_get_mpp and h_get_ppp - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh - media: cec: cec-api: add locking in cec_release() - media: core headers: fix kernel-doc warnings - media: cec: fix a deadlock situation - media: cec: call enable_adap on s_log_addrs - media: cec: abort if the current transmit was canceled - media: cec: correctly pass on reply results - media: cec: use call_op and check for !unregistered - media: cec-adap.c: drop activate_cnt, use state info instead - media: cec: core: avoid recursive cec_claim_log_addrs - media: cec: core: avoid confusing "transmit timed out" message - null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION() - regulator: bd71828: Don't overwrite runtime voltages - [x86] kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y - nfc: nci: Fix uninit-value in nci_rx_work (CVE-2024-38381) - ASoC: tas2552: Add TX path for capturing AUDIO-OUT data - sunrpc: fix NFSACL RPC retry on soft mount - rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL - ipv6: sr: fix memleak in seg6_hmac_init_algo - params: lift param_set_uint_minmax to common code - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CVE-2024-37356)). - openvswitch: Set the skbuff pkt_type for proper pmtud support. - [arm64] asm-bug: Add .align 2 to the end of __BUG_ENTRY - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails - net: fec: avoid lock evasion when reading pps_enable - tls: fix missing memory barrier in tls_init (CVE-2024-36489) - nfc: nci: Fix kcov check in nci_rx_work() - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() - netfilter: nft_payload: restore vlan q-in-q match support - spi: Don't mark message DMA mapped when no transfer in it is - nvmet: fix ns enable/disable possible hang - net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion - dma-buf/sw-sync: don't enable IRQ from sync_print_obj() (CVE-2024-38780) - bpf: Fix potential integer overflow in resolve_btfids - enic: Validate length of nl attributes in enic_set_vf_port (CVE-2024-38659) - net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM - bpf: Allow delete from sockmap/sockhash only if update is allowed (CVE-2024-38662) - net:fec: Add fec_enet_deinit() - netfilter: tproxy: bail out if IP has been disabled on the device (CVE-2024-36270) - kconfig: fix comparison to constant symbols, 'm', 'n' - spi: stm32: Don't warn about spurious interrupts - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound - hwmon: (shtc1) Fix property misspelling - ALSA: timer: Set lower bound of start tick time (CVE-2024-38618) - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (CVE-2024-31076) - media: cec: core: add adap_nb_transmit_canceled() callback - SUNRPC: Fix loop termination condition in gss_free_in_token_pages() (CVE-2024-36288) - [arm*] binder: fix max_thread type inconsistency - mmc: core: Do not force a retune before RPMB switch - io_uring: fail NOP if non-zero op flags is passed in - afs: Don't cross .backup mountpoint from backup volume - nilfs2: fix use-after-free of timer for log writer thread (CVE-2024-38583) - vxlan: Fix regression when dropping packets due to invalid src addresses - [x86] mm: Remove broken vsyscall emulation code from the page fault code - netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (CVE-2024-27019) - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() - media: lgdt3306a: Add a check against null-pointer-def - drm/amdgpu: add error handle to avoid out-of-bounds - ata: pata_legacy: make legacy_exit() work again - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx - [arm64] tegra: Correct Tegra132 I2C alias - [arm64] dts: qcom: qcs404: fix bluetooth device address - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING - wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU - wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE - wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path - [arm64] dts: hi3798cv200: fix the size of GICR - media: mc: mark the media devnode as registered from the, start - media: mxl5xx: Move xpt structures off stack - media: v4l2-core: hold videodev_lock until dev reg, finishes - mmc: core: Add mmc_gpiod_set_cd_config() function - mmc: sdhci-acpi: Sort DMI quirks alphabetically - mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working - mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A - fbdev: savage: Handle err return when savagefb_check_var failed - [arm64] KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode - crypto: ecrdsa - Fix module auto-load on add_key - [x86] crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak - net/ipv6: Fix route deleting failure when metric equals 0 - net/9p: fix uninit-value in p9_client_rpc() - [x86] intel_th: pci: Add Meteor Lake-S CPU support - watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin - kdb: Fix buffer overflow during tab-complete - kdb: Use format-strings rather than '\0' injection in kdb_read() - kdb: Fix console handling when editing and tab-completing commands - kdb: Merge identical case statements in kdb_read() - kdb: Use format-specifiers rather than memset() for padding in kdb_read() - net: fix __dst_negative_advice() race - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() - [s390x] ap: Fix crash in AP internal function modify_bitmap() - nfs: fix undefined behavior in nfs_block_bits() - NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS - scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5 - f2fs: compress: fix compression chksum - [arm64] RDMA/hns: Use mutex instead of spinlock for ida allocation - [arm64] RDMA/hns: Fix CQ and QP cache affinity https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.220 - SUNRPC: Rename svc_encode_read_payload() - NFSD: Invoke svc_encode_result_payload() in "read" NFSD encoders - NFSD: A semicolon is not needed after a switch statement. - nfsd/nfs3: remove unused macro nfsd3_fhandleres - NFSD: Clean up the show_nf_may macro - NFSD: Remove extra "0x" in tracepoint format specifier - NFSD: Add SPDX header for fs/nfsd/trace.c - nfsd: Fix error return code in nfsd_file_cache_init() - SUNRPC: Add xdr_set_scratch_page() and xdr_reset_scratch_buffer() - SUNRPC: Prepare for xdr_stream-style decoding on the server-side - NFSD: Add common helpers to decode void args and encode void results - NFSD: Add tracepoints in nfsd_dispatch() - NFSD: Add tracepoints in nfsd4_decode/encode_compound() - NFSD: Replace the internals of the READ_BUF() macro - NFSD: Replace READ* macros in nfsd4_decode_access() - NFSD: Replace READ* macros in nfsd4_decode_close() - NFSD: Replace READ* macros in nfsd4_decode_commit() - NFSD: Change the way the expected length of a fattr4 is checked - NFSD: Replace READ* macros that decode the fattr4 size attribute - NFSD: Replace READ* macros that decode the fattr4 acl attribute - NFSD: Replace READ* macros that decode the fattr4 mode attribute - NFSD: Replace READ* macros that decode the fattr4 owner attribute - NFSD: Replace READ* macros that decode the fattr4 owner_group attribute - NFSD: Replace READ* macros that decode the fattr4 time_set attributes - NFSD: Replace READ* macros that decode the fattr4 security label attribute - NFSD: Replace READ* macros that decode the fattr4 umask attribute - NFSD: Replace READ* macros in nfsd4_decode_fattr() - NFSD: Replace READ* macros in nfsd4_decode_create() - NFSD: Replace READ* macros in nfsd4_decode_delegreturn() - NFSD: Replace READ* macros in nfsd4_decode_getattr() - NFSD: Replace READ* macros in nfsd4_decode_link() - NFSD: Relocate nfsd4_decode_opaque() - NFSD: Add helpers to decode a clientid4 and an NFSv4 state owner - NFSD: Add helper for decoding locker4 - NFSD: Replace READ* macros in nfsd4_decode_lock() - NFSD: Replace READ* macros in nfsd4_decode_lockt() - NFSD: Replace READ* macros in nfsd4_decode_locku() - NFSD: Replace READ* macros in nfsd4_decode_lookup() - NFSD: Add helper to decode NFSv4 verifiers - NFSD: Add helper to decode OPEN's createhow4 argument - NFSD: Add helper to decode OPEN's openflag4 argument - NFSD: Replace READ* macros in nfsd4_decode_share_access() - NFSD: Replace READ* macros in nfsd4_decode_share_deny() - NFSD: Add helper to decode OPEN's open_claim4 argument - NFSD: Replace READ* macros in nfsd4_decode_open() - NFSD: Replace READ* macros in nfsd4_decode_open_confirm() - NFSD: Replace READ* macros in nfsd4_decode_open_downgrade() - NFSD: Replace READ* macros in nfsd4_decode_putfh() - NFSD: Replace READ* macros in nfsd4_decode_read() - NFSD: Replace READ* macros in nfsd4_decode_readdir() - NFSD: Replace READ* macros in nfsd4_decode_remove() - NFSD: Replace READ* macros in nfsd4_decode_rename() - NFSD: Replace READ* macros in nfsd4_decode_renew() - NFSD: Replace READ* macros in nfsd4_decode_secinfo() - NFSD: Replace READ* macros in nfsd4_decode_setattr() - NFSD: Replace READ* macros in nfsd4_decode_setclientid() - NFSD: Replace READ* macros in nfsd4_decode_setclientid_confirm() - NFSD: Replace READ* macros in nfsd4_decode_verify() - NFSD: Replace READ* macros in nfsd4_decode_write() - NFSD: Replace READ* macros in nfsd4_decode_release_lockowner() - NFSD: Replace READ* macros in nfsd4_decode_cb_sec() - NFSD: Replace READ* macros in nfsd4_decode_backchannel_ctl() - NFSD: Replace READ* macros in nfsd4_decode_bind_conn_to_session() - NFSD: Add a separate decoder to handle state_protect_ops - NFSD: Add a separate decoder for ssv_sp_parms - NFSD: Add a helper to decode state_protect4_a - NFSD: Add a helper to decode nfs_impl_id4 - NFSD: Add a helper to decode channel_attrs4 - NFSD: Replace READ* macros in nfsd4_decode_create_session() - NFSD: Replace READ* macros in nfsd4_decode_destroy_session() - NFSD: Replace READ* macros in nfsd4_decode_free_stateid() - NFSD: Replace READ* macros in nfsd4_decode_getdeviceinfo() - NFSD: Replace READ* macros in nfsd4_decode_layoutcommit() - NFSD: Replace READ* macros in nfsd4_decode_layoutget() - NFSD: Replace READ* macros in nfsd4_decode_layoutreturn() - NFSD: Replace READ* macros in nfsd4_decode_secinfo_no_name() - NFSD: Replace READ* macros in nfsd4_decode_sequence() - NFSD: Replace READ* macros in nfsd4_decode_test_stateid() - NFSD: Replace READ* macros in nfsd4_decode_destroy_clientid() - NFSD: Replace READ* macros in nfsd4_decode_reclaim_complete() - NFSD: Replace READ* macros in nfsd4_decode_fallocate() - NFSD: Replace READ* macros in nfsd4_decode_nl4_server() - NFSD: Replace READ* macros in nfsd4_decode_copy() - NFSD: Replace READ* macros in nfsd4_decode_copy_notify() - NFSD: Replace READ* macros in nfsd4_decode_offload_status() - NFSD: Replace READ* macros in nfsd4_decode_seek() - NFSD: Replace READ* macros in nfsd4_decode_clone() - NFSD: Replace READ* macros in nfsd4_decode_xattr_name() - NFSD: Replace READ* macros in nfsd4_decode_setxattr() - NFSD: Replace READ* macros in nfsd4_decode_listxattrs() - NFSD: Make nfsd4_ops::opnum a u32 - NFSD: Replace READ* macros in nfsd4_decode_compound() - NFSD: Remove macros that are no longer used - nfsd: only call inode_query_iversion in the I_VERSION case - nfsd: simplify nfsd4_change_info - nfsd: minor nfsd4_change_attribute cleanup - nfsd4: don't query change attribute in v2/v3 case - Revert "nfsd4: support change_attr_type attribute" - nfsd: add a new EXPORT_OP_NOWCC flag to struct export_operations - nfsd: allow filesystems to opt out of subtree checking - nfsd: close cached files prior to a REMOVE or RENAME that would replace target - exportfs: Add a function to return the raw output from fh_to_dentry() - nfsd: Fix up nfsd to ensure that timeout errors don't result in ESTALE - nfsd: Set PF_LOCAL_THROTTLE on local filesystems only - nfsd: Record NFSv4 pre/post-op attributes as non-atomic - exec: Don't open code get_close_on_exec - exec: Move unshare_files to fix posix file locking during exec - exec: Simplify unshare_files - exec: Remove reset_files_struct - kcmp: In kcmp_epoll_target use fget_task - bpf: In bpf_task_fd_query use fget_task - proc/fd: In proc_fd_link use fget_task - Revert "fget: clarify and improve __fget_files() implementation" - file: Rename __fcheck_files to files_lookup_fd_raw - file: Factor files_lookup_fd_locked out of fcheck_files - file: Replace fcheck_files with files_lookup_fd_rcu - file: Rename fcheck lookup_fd_rcu - file: Implement task_lookup_fd_rcu - proc/fd: In tid_fd_mode use task_lookup_fd_rcu - kcmp: In get_file_raw_ptr use task_lookup_fd_rcu - file: Implement task_lookup_next_fd_rcu - proc/fd: In proc_readfd_common use task_lookup_next_fd_rcu - proc/fd: In fdinfo seq_show don't use get_files_struct - file: Merge __fd_install into fd_install - file: In f_dupfd read RLIMIT_NOFILE once. - file: Merge __alloc_fd into alloc_fd - file: Rename __close_fd to close_fd and remove the files parameter - file: Replace ksys_close with close_fd - inotify: Increase default inotify.max_user_watches limit to 1048576 - fs/lockd: convert comma to semicolon - NFSD: Fix sparse warning in nfssvc.c - NFSD: Restore NFSv4 decoding's SAVEMEM functionality - SUNRPC: Make trace_svc_process() display the RPC procedure symbolically - SUNRPC: Display RPC procedure names instead of proc numbers - SUNRPC: Move definition of XDR_UNIT - NFSD: Update GETATTR3args decoder to use struct xdr_stream - NFSD: Update ACCESS3arg decoder to use struct xdr_stream - NFSD: Update READ3arg decoder to use struct xdr_stream - NFSD: Update WRITE3arg decoder to use struct xdr_stream - NFSD: Update READLINK3arg decoder to use struct xdr_stream - NFSD: Fix returned READDIR offset cookie - NFSD: Add helper to set up the pages where the dirlist is encoded - NFSD: Update READDIR3args decoders to use struct xdr_stream - NFSD: Update COMMIT3arg decoder to use struct xdr_stream - NFSD: Update the NFSv3 DIROPargs decoder to use struct xdr_stream - NFSD: Update the RENAME3args decoder to use struct xdr_stream - NFSD: Update the LINK3args decoder to use struct xdr_stream - NFSD: Update the SETATTR3args decoder to use struct xdr_stream - NFSD: Update the CREATE3args decoder to use struct xdr_stream - NFSD: Update the MKDIR3args decoder to use struct xdr_stream - NFSD: Update the SYMLINK3args decoder to use struct xdr_stream - NFSD: Update the MKNOD3args decoder to use struct xdr_stream - NFSD: Update the NFSv2 GETATTR argument decoder to use struct xdr_stream - NFSD: Update the NFSv2 READ argument decoder to use struct xdr_stream - NFSD: Update the NFSv2 WRITE argument decoder to use struct xdr_stream - NFSD: Update the NFSv2 READLINK argument decoder to use struct xdr_stream - NFSD: Add helper to set up the pages where the dirlist is encoded - NFSD: Update the NFSv2 READDIR argument decoder to use struct xdr_stream - NFSD: Update NFSv2 diropargs decoding to use struct xdr_stream - NFSD: Update the NFSv2 RENAME argument decoder to use struct xdr_stream - NFSD: Update the NFSv2 LINK argument decoder to use struct xdr_stream - NFSD: Update the NFSv2 SETATTR argument decoder to use struct xdr_stream - NFSD: Update the NFSv2 CREATE argument decoder to use struct xdr_stream - NFSD: Update the NFSv2 SYMLINK argument decoder to use struct xdr_stream - NFSD: Remove argument length checking in nfsd_dispatch() - NFSD: Update the NFSv2 GETACL argument decoder to use struct xdr_stream - NFSD: Add an xdr_stream-based decoder for NFSv2/3 ACLs - NFSD: Update the NFSv2 SETACL argument decoder to use struct xdr_stream - NFSD: Update the NFSv2 ACL GETATTR argument decoder to use struct xdr_stream - NFSD: Update the NFSv2 ACL ACCESS argument decoder to use struct xdr_stream - NFSD: Clean up after updating NFSv2 ACL decoders - NFSD: Update the NFSv3 GETACL argument decoder to use struct xdr_stream - NFSD: Update the NFSv2 SETACL argument decoder to use struct xdr_stream - NFSD: Clean up after updating NFSv3 ACL decoders - nfsd: remove unused stats counters - nfsd: protect concurrent access to nfsd stats counters - nfsd: report per-export stats - nfsd4: simplify process_lookup1 - nfsd: simplify process_lock - nfsd: simplify nfsd_renew - nfsd: rename lookup_clientid->set_client - nfsd: refactor set_client - nfsd: find_cpntf_state cleanup - nfsd: remove unused set_client argument - nfsd: simplify nfsd4_check_open_reclaim - nfsd: cstate->session->se_client -> cstate->clp - NFSv4_2: SSC helper should use its own config. - nfs: use change attribute for NFS re-exports - nfsd: skip some unnecessary stats in the v4 case - inotify, memcg: account inotify instances to kmemcg - module: unexport find_module and module_mutex - module: use RCU to synchronize find_module - kallsyms: refactor {,module_}kallsyms_on_each_symbol - kallsyms: only build {,module_}kallsyms_on_each_symbol when required - fs: add file and path permissions helpers - namei: introduce struct renamedata - NFSD: Extract the svcxdr_init_encode() helper - NFSD: Update the GETATTR3res encoder to use struct xdr_stream - NFSD: Update the NFSv3 ACCESS3res encoder to use struct xdr_stream - NFSD: Update the NFSv3 LOOKUP3res encoder to use struct xdr_stream - NFSD: Update the NFSv3 wccstat result encoder to use struct xdr_stream - NFSD: Update the NFSv3 READLINK3res encoder to use struct xdr_stream - NFSD: Update the NFSv3 READ3res encode to use struct xdr_stream - NFSD: Update the NFSv3 WRITE3res encoder to use struct xdr_stream - NFSD: Update the NFSv3 CREATE family of encoders to use struct xdr_stream - NFSD: Update the NFSv3 RENAMEv3res encoder to use struct xdr_stream - NFSD: Update the NFSv3 LINK3res encoder to use struct xdr_stream - NFSD: Update the NFSv3 FSSTAT3res encoder to use struct xdr_stream - NFSD: Update the NFSv3 FSINFO3res encoder to use struct xdr_stream - NFSD: Update the NFSv3 PATHCONF3res encoder to use struct xdr_stream - NFSD: Update the NFSv3 COMMIT3res encoder to use struct xdr_stream - NFSD: Add a helper that encodes NFSv3 directory offset cookies - NFSD: Count bytes instead of pages in the NFSv3 READDIR encoder - NFSD: Update the NFSv3 READDIR3res encoder to use struct xdr_stream - NFSD: Update NFSv3 READDIR entry encoders to use struct xdr_stream - NFSD: Remove unused NFSv3 directory entry encoders - NFSD: Reduce svc_rqst::rq_pages churn during READDIR operations - NFSD: Update the NFSv2 stat encoder to use struct xdr_stream - NFSD: Update the NFSv2 attrstat encoder to use struct xdr_stream - NFSD: Update the NFSv2 diropres encoder to use struct xdr_stream - NFSD: Update the NFSv2 READLINK result encoder to use struct xdr_stream - NFSD: Update the NFSv2 READ result encoder to use struct xdr_stream - NFSD: Update the NFSv2 STATFS result encoder to use struct xdr_stream - NFSD: Add a helper that encodes NFSv3 directory offset cookies - NFSD: Count bytes instead of pages in the NFSv2 READDIR encoder - NFSD: Update the NFSv2 READDIR result encoder to use struct xdr_stream - NFSD: Update the NFSv2 READDIR entry encoder to use struct xdr_stream - NFSD: Remove unused NFSv2 directory entry encoders - NFSD: Add an xdr_stream-based encoder for NFSv2/3 ACLs - NFSD: Update the NFSv2 GETACL result encoder to use struct xdr_stream - NFSD: Update the NFSv2 SETACL result encoder to use struct xdr_stream - NFSD: Update the NFSv2 ACL GETATTR result encoder to use struct xdr_stream - NFSD: Update the NFSv2 ACL ACCESS result encoder to use struct xdr_stream - NFSD: Clean up after updating NFSv2 ACL encoders - NFSD: Update the NFSv3 GETACL result encoder to use struct xdr_stream - NFSD: Update the NFSv3 SETACL result encoder to use struct xdr_stream - NFSD: Clean up after updating NFSv3 ACL encoders - NFSD: Add a tracepoint to record directory entry encoding - NFSD: Clean up NFSDDBG_FACILITY macro - nfsd: helper for laundromat expiry calculations - nfsd: Log client tracking type log message as info instead of warning - nfsd: Fix typo "accesible" - nfsd: COPY with length 0 should copy to end of file - nfsd: don't ignore high bits of copy count - nfsd: report client confirmation status in "info" file - SUNRPC: Export svc_xprt_received() - UAPI: nfsfh.h: Replace one-element array with flexible-array member - NFSD: Use DEFINE_SPINLOCK() for spinlock - fsnotify: allow fsnotify_{peek,remove}_first_event with empty queue - Revert "fanotify: limit number of event merge attempts" - fanotify: reduce event objectid to 29-bit hash - fanotify: mix event info and pid into merge key hash - fsnotify: use hash table for faster events merge - fanotify: limit number of event merge attempts - fanotify: configurable limits via sysfs - fanotify: support limited functionality for unprivileged users - fanotify_user: use upper_32_bits() to verify mask - nfsd: remove unused function - nfsd: removed unused argument in nfsd_startup_generic() - nfsd: hash nfs4_files by inode number - nfsd: track filehandle aliasing in nfs4_files - nfsd: reshuffle some code - nfsd: grant read delegations to clients holding writes - nfsd: Fix fall-through warnings for Clang - NFSv4.2: Remove ifdef CONFIG_NFSD from NFSv4.2 client SSC code. - NFS: fix nfs_fetch_iversion() - fanotify: fix permission model of unprivileged group - NFSD: Add an RPC authflavor tracepoint display helper - NFSD: Add nfsd_clid_cred_mismatch tracepoint - NFSD: Add nfsd_clid_verf_mismatch tracepoint - NFSD: Remove trace_nfsd_clid_inuse_err - NFSD: Add nfsd_clid_confirmed tracepoint - NFSD: Add nfsd_clid_reclaim_complete tracepoint - NFSD: Add nfsd_clid_destroyed tracepoint - NFSD: Add a couple more nfsd_clid_expired call sites - NFSD: Add tracepoints for SETCLIENTID edge cases - NFSD: Add tracepoints for EXCHANGEID edge cases - NFSD: Constify @fh argument of knfsd_fh_hash() - NFSD: Capture every CB state transition - NFSD: Drop TRACE_DEFINE_ENUM for NFSD4_CB_ macros - NFSD: Add cb_lost tracepoint - NFSD: Adjust cb_shutdown tracepoint - NFSD: Enhance the nfsd_cb_setup tracepoint - NFSD: Add an nfsd_cb_lm_notify tracepoint - NFSD: Add an nfsd_cb_offload tracepoint - NFSD: Replace the nfsd_deleg_break tracepoint - NFSD: Add an nfsd_cb_probe tracepoint - NFSD: Remove the nfsd_cb_work and nfsd_cb_done tracepoints - NFSD: Update nfsd_cb_args tracepoint - nfsd: Prevent truncation of an unlinked inode from blocking access to its directory - nfsd: move some commit_metadata()s outside the inode lock - NFSD add vfs_fsync after async copy is done - NFSD: delay unmount source's export after inter-server copy completed. - nfsd: move fsnotify on client creation outside spinlock - nfsd4: Expose the callback address and state of each NFS4 client - nfsd: fix kernel test robot warning in SSC code - NFSD: Fix error return code in nfsd4_interssc_connect() - nfsd: rpc_peeraddr2str needs rcu lock - lockd: Remove stale comments - lockd: Create a simplified .vs_dispatch method for NLM requests - lockd: Common NLM XDR helpers - lockd: Update the NLMv1 void argument decoder to use struct xdr_stream - lockd: Update the NLMv1 TEST arguments decoder to use struct xdr_stream - lockd: Update the NLMv1 LOCK arguments decoder to use struct xdr_stream - lockd: Update the NLMv1 CANCEL arguments decoder to use struct xdr_stream - lockd: Update the NLMv1 UNLOCK arguments decoder to use struct xdr_stream - lockd: Update the NLMv1 nlm_res arguments decoder to use struct xdr_stream - lockd: Update the NLMv1 SM_NOTIFY arguments decoder to use struct xdr_stream - lockd: Update the NLMv1 SHARE arguments decoder to use struct xdr_stream - lockd: Update the NLMv1 FREE_ALL arguments decoder to use struct xdr_stream - lockd: Update the NLMv1 void results encoder to use struct xdr_stream - lockd: Update the NLMv1 TEST results encoder to use struct xdr_stream - lockd: Update the NLMv1 nlm_res results encoder to use struct xdr_stream - lockd: Update the NLMv1 SHARE results encoder to use struct xdr_stream - lockd: Update the NLMv4 void arguments decoder to use struct xdr_stream - lockd: Update the NLMv4 TEST arguments decoder to use struct xdr_stream - lockd: Update the NLMv4 LOCK arguments decoder to use struct xdr_stream - lockd: Update the NLMv4 CANCEL arguments decoder to use struct xdr_stream - lockd: Update the NLMv4 UNLOCK arguments decoder to use struct xdr_stream - lockd: Update the NLMv4 nlm_res arguments decoder to use struct xdr_stream - lockd: Update the NLMv4 SM_NOTIFY arguments decoder to use struct xdr_stream - lockd: Update the NLMv4 SHARE arguments decoder to use struct xdr_stream - lockd: Update the NLMv4 FREE_ALL arguments decoder to use struct xdr_stream - lockd: Update the NLMv4 void results encoder to use struct xdr_stream - lockd: Update the NLMv4 TEST results encoder to use struct xdr_stream - lockd: Update the NLMv4 nlm_res results encoder to use struct xdr_stream - lockd: Update the NLMv4 SHARE results encoder to use struct xdr_stream - nfsd: remove redundant assignment to pointer 'this' - NFSD: Prevent a possible oops in the nfs_dirent() tracepoint - nfsd: fix NULL dereference in nfs3svc_encode_getaclres - kernel/pid.c: remove static qualifier from pidfd_create() - kernel/pid.c: implement additional checks upon pidfd_create() parameters - fanotify: minor cosmetic adjustments to fid labels - fanotify: introduce a generic info record copying helper - fanotify: add pidfd support to the fanotify API - fsnotify: replace igrab() with ihold() on attach connector - fsnotify: count s_fsnotify_inode_refs for attached connectors - fsnotify: count all objects with attached connectors - fsnotify: optimize the case of no marks of any type - NFSD: Clean up splice actor - SUNRPC: Add svc_rqst_replace_page() API - NFSD: Batch release pages during splice read - NFSD: remove vanity comments - sysctl: introduce new proc handler proc_dobool - lockd: change the proc_handler for nsm_use_hostnames - nlm: minor nlm_lookup_file argument change - nlm: minor refactoring - lockd: update nlm_lookup_file reexport comment - Keep read and write fds with each nlm_file - nfs: don't atempt blocking locks on nfs reexports - lockd: don't attempt blocking locks on nfs reexports - nfs: don't allow reexport reclaims - SUNRPC: Add svc_rqst::rq_auth_stat - SUNRPC: Set rq_auth_stat in the pg_authenticate() callout - SUNRPC: Eliminate the RQ_AUTHERR flag - NFS: Add a private local dispatcher for NFSv4 callback operations - NFS: Remove unused callback void decoder - fsnotify: fix sb_connectors leak - NLM: Fix svcxdr_encode_owner() - nfsd: Fix a warning for nfsd_file_close_inode - fsnotify: pass data_type to fsnotify_name() - fsnotify: pass dentry instead of inode data - fsnotify: clarify contract for create event hooks - fsnotify: Don't insert unmergeable events in hashtable - fanotify: Fold event size calculation to its own function - fanotify: Split fsid check from other fid mode checks - inotify: Don't force FS_IN_IGNORED - fsnotify: Add helper to detect overflow_event - fsnotify: Add wrapper around fsnotify_add_event - fsnotify: Retrieve super block from the data field - fsnotify: Protect fsnotify_handle_inode_event from no-inode events - fsnotify: Pass group argument to free_event - fanotify: Support null inode event in fanotify_dfid_inode - fanotify: Allow file handle encoding for unhashed events - fanotify: Encode empty file handle when no inode is provided - fanotify: Require fid_mode for any non-fd event - fsnotify: Support FS_ERROR event type - fanotify: Reserve UAPI bits for FAN_FS_ERROR - fanotify: Pre-allocate pool of error events - fanotify: Support enqueueing of error events - fanotify: Support merging of error events - fanotify: Wrap object_fh inline space in a creator macro - fanotify: Add helpers to decide whether to report FID/DFID - fanotify: WARN_ON against too large file handles - fanotify: Report fid info for file related file system errors - fanotify: Emit generic error info for error event - fanotify: Allow users to request FAN_FS_ERROR events - SUNRPC: Trace calls to .rpc_call_done - NFSD: Optimize DRC bucket pruning - NFSD: move filehandle format declarations out of "uapi". - NFSD: drop support for ancient filehandles - NFSD: simplify struct nfsfh - NFSD: Initialize pointer ni with NULL and not plain integer 0 - NFSD: Have legacy NFSD WRITE decoders use xdr_stream_subsegment() - SUNRPC: Replace the "__be32 *p" parameter to .pc_decode - SUNRPC: Change return value type of .pc_decode - NFSD: Save location of NFSv4 COMPOUND status - SUNRPC: Replace the "__be32 *p" parameter to .pc_encode - SUNRPC: Change return value type of .pc_encode - nfsd: update create verifier comment - NFSD:fix boolreturn.cocci warning - nfsd4: remove obselete comment - NFSD: Fix exposure in nfsd4_decode_bitmap() - NFSD: Fix READDIR buffer overflow - fsnotify: clarify object type argument - fsnotify: separate mark iterator type from object type enum - fanotify: introduce group flag FAN_REPORT_TARGET_FID - fsnotify: generate FS_RENAME event with rich information - fanotify: use macros to get the offset to fanotify_info buffer - fanotify: use helpers to parcel fanotify_info buffer - fanotify: support secondary dir fh and name in fanotify_info - fanotify: record old and new parent and name in FAN_RENAME event - fanotify: record either old name new name or both for FAN_RENAME - fanotify: report old and/or new parent+name in FAN_RENAME event - fanotify: wire up FAN_RENAME event - exit: Implement kthread_exit - exit: Rename module_put_and_exit to module_put_and_kthread_exit - NFSD: Fix sparse warning - NFSD: handle errors better in write_ports_addfd() - SUNRPC: change svc_get() to return the svc. - SUNRPC/NFSD: clean up get/put functions. - SUNRPC: stop using ->sv_nrthreads as a refcount - nfsd: make nfsd_stats.th_cnt atomic_t - SUNRPC: use sv_lock to protect updates to sv_nrthreads. - NFSD: narrow nfsd_mutex protection in nfsd thread - NFSD: Make it possible to use svc_set_num_threads_sync - SUNRPC: discard svo_setup and rename svc_set_num_threads_sync() - NFSD: simplify locking for network notifier. - lockd: introduce nlmsvc_serv - lockd: simplify management of network status notifiers - lockd: move lockd_start_svc() call into lockd_create_svc() - lockd: move svc_exit_thread() into the thread - lockd: introduce lockd_put() - lockd: rename lockd_create_svc() to lockd_get() - SUNRPC: move the pool_map definitions (back) into svc.c - SUNRPC: always treat sv_nrpools==1 as "not pooled" - lockd: use svc_set_num_threads() for thread start and stop - NFS: switch the callback service back to non-pooled. - NFSD: Remove be32_to_cpu() from DRC hash function - NFSD: Fix inconsistent indenting - NFSD: simplify per-net file cache management - NFSD: Combine XDR error tracepoints - nfsd: improve stateid access bitmask documentation - NFSD: De-duplicate nfsd4_decode_bitmap4() - nfs: block notification on fs with its own ->lock - nfsd4: add refcount for nfsd4_blocked_lock - NFSD: Fix zero-length NFSv3 WRITEs - nfsd: map EBADF - nfsd: Add errno mapping for EREMOTEIO - nfsd: Retry once in nfsd_open on an -EOPENSTALE return - NFSD: Clean up nfsd_vfs_write() - NFSD: De-duplicate net_generic(SVC_NET(rqstp), nfsd_net_id) - NFSD: De-duplicate net_generic(nf->nf_net, nfsd_net_id) - nfsd: Add a tracepoint for errors in nfsd4_clone_file_range() - NFSD: Write verifier might go backwards - NFSD: Clean up the nfsd_net::nfssvc_boot field - NFSD: Rename boot verifier functions - NFSD: Trace boot verifier resets - Revert "nfsd: skip some unnecessary stats in the v4 case" - NFSD: Move fill_pre_wcc() and fill_post_wcc() - nfsd: fix crash on COPY_NOTIFY with special stateid - fanotify: remove variable set but not used - lockd: fix server crash on reboot of client holding lock - lockd: fix failure to cleanup client locks - NFSD: Fix the behavior of READ near OFFSET_MAX - NFSD: Fix ia_size underflow - NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes - NFSD: COMMIT operations must not return NFS?ERR_INVAL - NFSD: Deprecate NFS_OFFSET_MAX - nfsd: Add support for the birth time attribute - NFSD: De-duplicate hash bucket indexing - NFSD: Skip extra computation for RC_NOCACHE case - NFSD: Streamline the rare "found" case - SUNRPC: Remove the .svo_enqueue_xprt method - SUNRPC: Merge svc_do_enqueue_xprt() into svc_enqueue_xprt() - SUNRPC: Remove svo_shutdown method - SUNRPC: Rename svc_create_xprt() - SUNRPC: Rename svc_close_xprt() - SUNRPC: Remove svc_shutdown_net() - NFSD: Remove svc_serv_ops::svo_module - NFSD: Move svc_serv_ops::svo_function into struct svc_serv - NFSD: Remove CONFIG_NFSD_V3 - NFSD: Clean up _lm_ operation names - nfsd: fix using the correct variable for sizeof() - fsnotify: fix merge with parent's ignored mask - fsnotify: optimize FS_MODIFY events with no ignored masks - fsnotify: remove redundant parameter judgment - SUNRPC: Return true/false (not 1/0) from bool functions - nfsd: Fix a write performance regression - nfsd: Clean up nfsd_file_put() - fanotify: do not allow setting dirent events in mask of non-dir - fs/lock: documentation cleanup. Replace inode->i_lock with flc_lock. - inotify: move control flags from mask to mark flags - fsnotify: pass flags argument to fsnotify_alloc_group() - fsnotify: make allow_dups a property of the group - fsnotify: create helpers for group mark_mutex lock - inotify: use fsnotify group lock helpers - nfsd: use fsnotify group lock helpers - dnotify: use fsnotify group lock helpers - fsnotify: allow adding an inode mark without pinning inode - fanotify: create helper fanotify_mark_user_flags() - fanotify: factor out helper fanotify_mark_update_flags() - fanotify: implement "evictable" inode marks - fanotify: use fsnotify group lock helpers - fanotify: enable "evictable" inode marks - fsnotify: introduce mark type iterator - fsnotify: consistent behavior for parent not watching children - fanotify: fix incorrect fmode_t casts - NFSD: Clean up nfsd_splice_actor() - NFSD: add courteous server support for thread with only delegation - NFSD: add support for share reservation conflict to courteous server - NFSD: move create/destroy of laundry_wq to init_nfsd and exit_nfsd - fs/lock: add helper locks_owner_has_blockers to check for blockers - fs/lock: add 2 callbacks to lock_manager_operations to resolve conflict - NFSD: add support for lock conflict to courteous server - NFSD: Show state of courtesy client in client info - NFSD: Clean up nfsd3_proc_create() - NFSD: Avoid calling fh_drop_write() twice in do_nfsd_create() - NFSD: Refactor nfsd_create_setattr() - NFSD: Refactor NFSv3 CREATE - NFSD: Refactor NFSv4 OPEN(CREATE) - NFSD: Remove do_nfsd_create() - NFSD: Clean up nfsd_open_verified() - NFSD: Instantiate a struct file when creating a regular NFSv4 file - NFSD: Remove dprintk call sites from tail of nfsd4_open() - NFSD: Fix whitespace - NFSD: Move documenting comment for nfsd4_process_open2() - NFSD: Trace filecache opens - NFSD: Clean up the show_nf_flags() macro - SUNRPC: Use RMW bitops in single-threaded hot paths - nfsd: Unregister the cld notifier when laundry_wq create failed - nfsd: Fix null-ptr-deref in nfsd_fill_super() - nfsd: destroy percpu stats counters after reply cache shutdown - NFSD: Modernize nfsd4_release_lockowner() - NFSD: Add documenting comment for nfsd4_release_lockowner() - NFSD: nfsd_file_put() can sleep - NFSD: Fix potential use-after-free in nfsd_file_put() - SUNRPC: Optimize xdr_reserve_space() - fanotify: refine the validation checks on non-dir inode mask - NFS: restore module put when manager exits. - NFSD: Decode NFSv4 birth time attribute - lockd: set fl_owner when unlocking files - lockd: fix nlm_close_files - fs: inotify: Fix typo in inotify comment - fanotify: prepare for setting event flags in ignore mask - fanotify: cleanups for fanotify_mark() input validations - fanotify: introduce FAN_MARK_IGNORE - fsnotify: Fix comment typo - nfsd: eliminate the NFSD_FILE_BREAK_* flags - SUNRPC: Fix xdr_encode_bool() - NLM: Defend against file_lock changes after vfs_test_lock() - NFSD: Fix space and spelling mistake - nfsd: remove redundant assignment to variable len - NFSD: Demote a WARN to a pr_warn() - NFSD: Report filecache LRU size - NFSD: Report count of calls to nfsd_file_acquire() - NFSD: Report count of freed filecache items - NFSD: Report average age of filecache items - NFSD: Add nfsd_file_lru_dispose_list() helper - NFSD: Refactor nfsd_file_gc() - NFSD: Refactor nfsd_file_lru_scan() - NFSD: Report the number of items evicted by the LRU walk - NFSD: Record number of flush calls - NFSD: Zero counters when the filecache is re-initialized - NFSD: Hook up the filecache stat file - NFSD: WARN when freeing an item still linked via nf_lru - NFSD: Trace filecache LRU activity - NFSD: Leave open files out of the filecache LRU - NFSD: Fix the filecache LRU shrinker - NFSD: Never call nfsd_file_gc() in foreground paths - NFSD: No longer record nf_hashval in the trace log - NFSD: Remove lockdep assertion from unhash_and_release_locked() - NFSD: nfsd_file_unhash can compute hashval from nf->nf_inode - NFSD: Refactor __nfsd_file_close_inode() - NFSD: nfsd_file_hash_remove can compute hashval - NFSD: Remove nfsd_file::nf_hashval - NFSD: Replace the "init once" mechanism - NFSD: Set up an rhashtable for the filecache - NFSD: Convert the filecache to use rhashtable - NFSD: Clean up unused code after rhashtable conversion - NFSD: Separate tracepoints for acquire and create - NFSD: Move nfsd_file_trace_alloc() tracepoint - NFSD: NFSv4 CLOSE should release an nfsd_file immediately - NFSD: Ensure nf_inode is never dereferenced - NFSD: refactoring v4 specific code to a helper in nfs4state.c - NFSD: keep track of the number of v4 clients in the system - NFSD: limit the number of v4 clients to 1024 per 1GB of system memory - nfsd: silence extraneous printk on nfsd.ko insertion - NFSD: Optimize nfsd4_encode_operation() - NFSD: Optimize nfsd4_encode_fattr() - NFSD: Clean up SPLICE_OK in nfsd4_encode_read() - NFSD: Add an nfsd4_read::rd_eof field - NFSD: Optimize nfsd4_encode_readv() - NFSD: Simplify starting_len - NFSD: Use xdr_pad_size() - NFSD: Clean up nfsd4_encode_readlink() - NFSD: Fix strncpy() fortify warning - NFSD: nfserrno(-ENOMEM) is nfserr_jukebox - NFSD: Shrink size of struct nfsd4_copy_notify - NFSD: Shrink size of struct nfsd4_copy - NFSD: Reorder the fields in struct nfsd4_op - NFSD: Make nfs4_put_copy() static - NFSD: Replace boolean fields in struct nfsd4_copy - NFSD: Refactor nfsd4_cleanup_inter_ssc() (1/2) - NFSD: Refactor nfsd4_cleanup_inter_ssc() (2/2) - NFSD: Refactor nfsd4_do_copy() - NFSD: Remove kmalloc from nfsd4_do_async_copy() - NFSD: Add nfsd4_send_cb_offload() - NFSD: Move copy offload callback arguments into a separate structure - NFSD: drop fh argument from alloc_init_deleg - NFSD: verify the opened dentry after setting a delegation - NFSD: introduce struct nfsd_attrs - NFSD: set attributes when creating symlinks - NFSD: add security label to struct nfsd_attrs - NFSD: add posix ACLs to struct nfsd_attrs - NFSD: change nfsd_create()/nfsd_symlink() to unlock directory before returning. - NFSD: always drop directory lock in nfsd_unlink() - NFSD: only call fh_unlock() once in nfsd_link() - NFSD: reduce locking in nfsd_lookup() - NFSD: use explicit lock/unlock for directory ops - NFSD: use (un)lock_inode instead of fh_(un)lock for file operations - NFSD: discard fh_locked flag and fh_lock/fh_unlock - lockd: detect and reject lock arguments that overflow - NFSD: fix regression with setting ACLs. - nfsd_splice_actor(): handle compound pages - NFSD: move from strlcpy with unused retval to strscpy - lockd: move from strlcpy with unused retval to strscpy - NFSD enforce filehandle check for source file in COPY - NFSD: remove redundant variable status - nfsd: Avoid some useless tests - nfsd: Propagate some error code returned by memdup_user() - NFSD: Increase NFSD_MAX_OPS_PER_COMPOUND - NFSD: Protect against send buffer overflow in NFSv2 READDIR (CVE-2022-43945) - NFSD: Protect against send buffer overflow in NFSv3 READDIR (CVE-2022-43945) - NFSD: Protect against send buffer overflow in NFSv2 READ (CVE-2022-43945) - NFSD: Protect against send buffer overflow in NFSv3 READ (CVE-2022-43945) - NFSD: drop fname and flen args from nfsd_create_locked() - NFSD: Fix handling of oversized NFSv4 COMPOUND requests - nfsd: clean up mounted_on_fileid handling - nfsd: remove nfsd4_prepare_cb_recall() declaration - NFSD: Add tracepoints to report NFSv4 callback completions - NFSD: Add a mechanism to wait for a DELEGRETURN - NFSD: Refactor nfsd_setattr() - NFSD: Make nfsd4_setattr() wait before returning NFS4ERR_DELAY - NFSD: Make nfsd4_rename() wait before returning NFS4ERR_DELAY - NFSD: Make nfsd4_remove() wait before returning NFS4ERR_DELAY - NFSD: keep track of the number of courtesy clients in the system - NFSD: add shrinker to reap courtesy clients on low memory condition - SUNRPC: Parametrize how much of argsize should be zeroed - NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing - NFSD: Refactor common code out of dirlist helpers - NFSD: Use xdr_inline_decode() to decode NFSv3 symlinks - NFSD: Clean up WRITE arg decoders - NFSD: Clean up nfs4svc_encode_compoundres() - NFSD: Remove "inline" directives on op_rsize_bop helpers - NFSD: Remove unused nfsd4_compoundargs::cachetype field - NFSD: Pack struct nfsd4_compoundres - nfsd: use DEFINE_PROC_SHOW_ATTRIBUTE to define nfsd_proc_ops - nfsd: use DEFINE_SHOW_ATTRIBUTE to define export_features_fops and supported_enctypes_fops - nfsd: use DEFINE_SHOW_ATTRIBUTE to define client_info_fops - nfsd: use DEFINE_SHOW_ATTRIBUTE to define nfsd_reply_cache_stats_fops - nfsd: use DEFINE_SHOW_ATTRIBUTE to define nfsd_file_cache_stats_fops - NFSD: Rename the fields in copy_stateid_t - NFSD: Cap rsize_bop result based on send buffer size - nfsd: only fill out return pointer on success in nfsd4_lookup_stateid - nfsd: fix comments about spinlock handling with delegations - nfsd: make nfsd4_run_cb a bool return function - nfsd: extra checks when freeing delegation stateids - fs/notify: constify path - fsnotify: remove unused declaration - fanotify: Remove obsoleted fanotify_event_has_path() - nfsd: fix nfsd_file_unhash_and_dispose - nfsd: rework hashtable handling in nfsd_do_file_acquire - NFSD: unregister shrinker when nfsd_init_net() fails - nfsd: fix net-namespace logic in __nfsd_file_cache_purge - nfsd: fix use-after-free in nfsd_file_do_acquire tracepoint - nfsd: put the export reference in nfsd4_verify_deleg_dentry - NFSD: Fix reads with a non-zero offset that don't end on a page boundary - filelock: add a new locks_inode_context accessor function - lockd: use locks_inode_context helper - nfsd: use locks_inode_context helper - NFSD: Simplify READ_PLUS - NFSD: Remove redundant assignment to variable host_err - NFSD: Finish converting the NFSv2 GETACL result encoder - NFSD: Finish converting the NFSv3 GETACL result encoder - nfsd: ignore requests to disable unsupported versions - nfsd: move nfserrno() to vfs.c - nfsd: allow disabling NFSv2 at compile time - exportfs: use pr_debug for unreachable debug statements - NFSD: Pass the target nfsd_file to nfsd_commit() - NFSD: Revert "NFSD: NFSv4 CLOSE should release an nfsd_file immediately" - NFSD: Add an NFSD_FILE_GC flag to enable nfsd_file garbage collection - NFSD: Flesh out a documenting comment for filecache.c - NFSD: Clean up nfs4_preprocess_stateid_op() call sites - NFSD: Trace stateids returned via DELEGRETURN - NFSD: Trace delegation revocations - NFSD: Use const pointers as parameters to fh_ helpers - NFSD: Update file_hashtbl() helpers - NFSD: Clean up nfsd4_init_file() - NFSD: Add a nfsd4_file_hash_remove() helper - NFSD: Clean up find_or_add_file() - NFSD: Refactor find_file() - NFSD: Use rhashtable for managing nfs4_file objects - NFSD: Fix licensing header in filecache.c - nfsd: remove the pages_flushed statistic from filecache - nfsd: reorganize filecache.c - nfsd: fix up the filecache laundrette scheduling - NFSD: Add an nfsd_file_fsync tracepoint - lockd: set other missing fields when unlocking files - nfsd: return error if nfs4_setacl fails - NFSD: Use struct_size() helper in alloc_session() - lockd: set missing fl_flags field when retrieving args - lockd: ensure we use the correct file descriptor when unlocking - lockd: fix file selection in nlmsvc_cancel_blocked - NFSD: pass range end to vfs_fsync_range() instead of count - NFSD: refactoring courtesy_client_reaper to a generic low memory shrinker - NFSD: add support for sending CB_RECALL_ANY - NFSD: add delegation reaper to react to low memory condition - NFSD: Use only RQ_DROPME to signal the need to drop a reply - NFSD: Avoid clashing function prototypes - nfsd: rework refcounting in filecache - nfsd: fix handling of cached open files in nfsd4_open codepath - Revert "SUNRPC: Use RMW bitops in single-threaded hot paths" - NFSD: Use set_bit(RQ_DROPME) - NFSD: fix use-after-free in nfsd4_ssc_setup_dul() - NFSD: register/unregister of nfsd-client shrinker at nfsd startup/shutdown time - NFSD: replace delayed_work with work_struct for nfsd_client_shrinker - nfsd: don't free files unconditionally in __nfsd_file_cache_purge - nfsd: don't destroy global nfs4_file table in per-net shutdown - NFSD: enhance inter-server copy cleanup - nfsd: allow nfsd_file_get to sanely handle a NULL pointer - nfsd: clean up potential nfsd_file refcount leaks in COPY codepath - NFSD: fix leaked reference count of nfsd4_ssc_umount_item - nfsd: don't hand out delegation on setuid files being opened for write - NFSD: fix problems with cleanup on errors in nfsd4_copy - nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open - nfsd: don't fsync nfsd_files on last close - NFSD: copy the whole verifier in nfsd_copy_write_verifier - NFSD: Protect against filesystem freezing - lockd: set file_lock start and end when decoding nlm4 testargs - nfsd: don't replace page in rq_pages if it's a continuation of last page - NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL - nfsd: call op_release, even when op_func returns an error - nfsd: don't open-code clear_and_wake_up_bit - nfsd: NFSD_FILE_KEY_INODE only needs to find GC'ed entries - nfsd: simplify test_bit return in NFSD_FILE_KEY_FULL comparator - nfsd: don't kill nfsd_files because of lease break error - nfsd: add some comments to nfsd_file_do_acquire - nfsd: don't take/put an extra reference when putting a file - nfsd: update comment over __nfsd_file_cache_purge - nfsd: allow reaping files still under writeback - NFSD: Convert filecache to rhltable - nfsd: simplify the delayed disposal list code - NFSD: Fix problem of COMMIT and NFS4ERR_DELAY in infinite loop - nfsd: make a copy of struct iattr before calling notify_change - nfsd: fix double fget() bug in __write_ports_addfd() - lockd: drop inappropriate svc_get() from locked_get() - NFSD: Add an nfsd4_encode_nfstime4() helper - nfsd: Fix creation time serialization order - nfsd: don't allow nfsd threads to be signalled. - nfsd: Simplify code around svc_exit_thread() call in nfsd() - nfsd: separate nfsd_last_thread() from nfsd_put() - Documentation: Add missing documentation for EXPORT_OP flags - NFSD: fix possible oops when nfsd/pool_stats is closed. - nfsd: call nfsd_last_thread() before final nfsd_put() - nfsd: drop the nfsd_put helper - nfsd: fix RELEASE_LOCKOWNER (CVE-2024-26629) - nfsd: don't take fi_lock in nfsd_break_deleg_cb() - nfsd: don't call locks_release_private() twice concurrently - nfsd: Fix a regression in nfsd_setattr() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.221 - null_blk: Print correct max open zones limit in null_init_zoned_dev() - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() - wifi: cfg80211: pmsr: use correct nla_get_uX functions - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64 - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids - wifi: iwlwifi: mvm: don't read past the mfuart notifcation - wifi: mac80211: correctly parse Spatial Reuse Parameter Set element - [armhf] net/ncsi: add NCSI Intel OEM command to keep PHY up - [armhf] net/ncsi: Simplify Kconfig/dts control flow - [armhf] net/ncsi: Fix the multi thread manner of NCSI driver - ipv6: sr: block BH in seg6_output_core() and seg6_input_core() - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (CVE-2024-36978) - vxlan: Fix regression when dropping packets due to invalid src addresses - tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (CVE-2024-36974) - ptp: Fix error message on failed pin verification - af_unix: Annotate data-race of sk->sk_state in unix_inq_len(). - af_unix: Annotate data-races around sk->sk_state in unix_write_space() and poll(). - af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg(). - af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG. - af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen. - af_unix: Use unix_recvq_full_lockless() in unix_stream_connect(). - af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen(). - af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill(). - ipv6: fix possible race in __fib6_drop_pcpu_from() - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete - drm/amd/display: Handle Y carry-over in VCP X.Y calculation - serial: sc16is7xx: replace hardcoded divisor value with BIT() macro - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler - btrfs: fix leak of qgroup extent records after transaction abort - nilfs2: Remove check for PageError - nilfs2: return the mapped address from nilfs_get_page() - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages - mei: me: release irq in mei_me_pci_resume error path - jfs: xattr: fix buffer overflow for invalid xattr - xhci: Set correct transferred length for cancelled bulk transfers - xhci: Apply reset resume quirk to Etron EJ188 xHCI host - xhci: Apply broken streams quirk to Etron EJ188 xHCI host - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory - [powerpc*] uaccess: Fix build errors seen with GCC 13/14 - Input: try trimming too long modalias strings - SUNRPC: return proper error from gss_wrap_req_priv - gpio: tqmx86: fix typo in Kconfig label - HID: core: remove unnecessary WARN_ON() in implement() - gpio: tqmx86: store IRQ trigger type and unmask status separately - [amd64] iommu/amd: Introduce pci segment structure - [amd64] iommu/amd: Fix sysfs leak in iommu init - iommu: Return right value in iommu_sva_bind_device() - HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode() - drm/vmwgfx: 3D disabled should not effect STDU memory limits - net: sfp: Always call `sfp_sm_mod_remove()` on remove - [arm64] net: hns3: add cond_resched() to hns3 ring buffer init process - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet - drm/komeda: check for error-valued pointer - drm/bridge/panel: Fix runtime warning on panel bridge release - tcp: fix race in tcp_v6_syn_recv_sock() - net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type - net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs parameters - net/ipv6: Fix the RT cache flush via sysctl using a previous delay - ionic: fix use after netif_napi_del() - iio: adc: ad9467: fix scan type sign - iio: dac: ad5592r: fix temperature channel scaling value - iio: imu: inv_icm42600: delete unneeded update watermark call - drivers: core: synchronize really_probe() and dev_uevent() - [armhf] drm/exynos/vidi: fix memory leak in .get_modes() - [armhf] drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found - [x86] vmci: prevent speculation leaks by sanitizing event in event_deliver() - fs/proc: fix softlockup in __read_vmcore - ocfs2: use coarse time for new created files - ocfs2: fix races between hole punching and AIO+DIO - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id - dmaengine: axi-dmac: fix possible race in remove() - remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs - [x86] intel_th: pci: Add Granite Rapids support - [x86] intel_th: pci: Add Granite Rapids SOC support - [x86] intel_th: pci: Add Sapphire Rapids SOC support - [x86] intel_th: pci: Add Meteor Lake-S support - [x86] intel_th: pci: Add Lunar Lake support - nilfs2: fix potential kernel bug due to lack of writeback flag waiting (CVE-2024-37078) - tick/nohz_full: Don't abuse smp_call_function_single() in tick_setup_device() - serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level - hugetlb_encode.h: fix undefined behaviour (34 << 26) - mptcp: ensure snd_una is properly initialized on connect - mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID - mptcp: pm: update add_addr counters after connect - remoteproc: k3-r5: Jump to error handling labels in start/stop errors - greybus: Fix use-after-free bug in gb_interface_release due to race condition. - usb-storage: alauda: Check whether the media is initialized (CVE-2024-38619) - i2c: at91: Fix the functionality flags of the slave-only interface - i2c: designware: Fix the functionality flags of the slave-only interface - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING - padata: Disable BH when taking works lock on MT path - rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment - rcutorture: Fix invalid context warning when enable srcu barrier testing - block/ioctl: prefer different overflow check - batman-adv: bypass empty buckets in batadv_purge_orig_ref() - wifi: ath9k: work around memset overflow warning - af_packet: avoid a false positive warning in packet_setsockopt() - drop_monitor: replace spin_lock by raw_spin_lock - scsi: qedi: Fix crash while reading debugfs attribute - netpoll: Fix race condition in netpoll_owner_active - HID: Add quirk for Logitech Casa touchpad - ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7 - Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl - drm/amd/display: Exit idle optimizations before HDCP execution - [x86] ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14 - [arm64,armhf] drm/lima: add mask irq callback to gp and pp - [arm64,armhf] drm/lima: mask irqs in timeout path before hard reset - [powerpc*] pseries: Enforce hcall result buffer validity and size - [powerpc*] io: Avoid clang null pointer arithmetic warnings - power: supply: cros_usbpd: provide ID table for avoiding fallback match - f2fs: remove clear SB_INLINECRYPT flag in default_options - usb: misc: uss720: check for incompatible versions of the Belkin F5U002 - udf: udftime: prevent overflow in udf_disk_stamp_to_time() - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports - [mips*] Octeon: Add PCIe link status check - serial: exar: adding missing CTI and Exar PCI ids - [mips*] Routerboard 532: Fix vendor retry check code - [mips*] bmips: BCM6358: make sure CBR is correctly set - tracing: Build event generation tests only as modules - cipso: fix total option length computation - netrom: Fix a memory leak in nr_heartbeat_expiry() - ipv6: prevent possible NULL deref in fib6_nh_init() - ipv6: prevent possible NULL dereference in rt6_probe() - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() - netns: Make get_net_ns() handle zero refcount net - qca_spi: Make interrupt remembering atomic - net/sched: act_api: rely on rcu in tcf_idr_check_alloc - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() - tipc: force a dst refcount before doing decryption - net/sched: act_ct: set 'net' pointer when creating new nf_flow_table - sched: act_ct: add netns into the key of tcf_ct_flow_table - net: stmmac: No need to calculate speed divider when offload is disabled - virtio_net: checksum offloading handling fix - netfilter: ipset: Fix suspicious rcu_dereference_protected() - net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings - regulator: core: Fix modpost error "regulator_get_regmap" undefined - dmaengine: ioat: switch from 'pci_' to 'dma_' API - dmaengine: ioat: Drop redundant pci_enable_pcie_error_reporting() - dmaengine: ioatdma: Fix leaking on version mismatch - dmaengine: ioat: use PCI core macros for PCIe Capability - dmaengine: ioatdma: Fix error path in ioat3_dma_probe() - dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe() - dmaengine: ioatdma: Fix missing kmem_cache_destroy() - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." - RDMA/mlx5: Add check for srq max_sge attribute - ALSA: hda/realtek: Limit mic boost on N14AP7 - drm/radeon: fix UBSAN warning in kv_dpm.c - gcov: add support for GCC 14 - kcov: don't lose track of remote references during softirqs - i2c: ocores: set IACK bit after core is enabled - dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller schema - drm/amd/display: revert Exit idle optimizations before HDCP execution - [armhf] dts: samsung: smdkv310: fix keypad no-autorepeat - [armhf] dts: samsung: exynos4412-origen: fix keypad no-autorepeat - [armhf] dts: samsung: smdk4412: fix keypad no-autorepeat - rtlwifi: rtl8192de: Style clean-ups - wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power - pmdomain: ti-sci: Fix duplicate PD referrals - knfsd: LOOKUP can return an illegal error value - spmi: hisi-spmi-controller: Do not override device identifier - bcache: fix variable length array abuse in btree_iter (CVE-2024-39482) - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test - [x86] cpu/vfm: Add new macros to work with (vendor/family/model) values - [x86] cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL - r8169: remove unneeded memory barrier in rtl_tx - r8169: improve rtl_tx - r8169: improve rtl8169_start_xmit - r8169: remove nr_frags argument from rtl_tx_slots_avail - r8169: remove not needed check in rtl8169_start_xmit - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586) - Revert "kheaders: substituting --sort in archive creation" - kheaders: explicitly define file modes for archived headers - perf/core: Fix missing wakeup when waiting for context reference - PCI: Add PCI_ERROR_RESPONSE and related definitions - [x86] amd_nb: Check for invalid SMN reads - cifs: missed ref-counting smb session in find - smb: client: fix deadlock in smb2_find_smb_tcon() (CVE-2024-39468) - ACPI: Add quirks for AMD Renoir/Lucienne CPUs to force the D3 hint - [x86] ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable - [x86] ACPI: x86: Add another system to quirk list for forcing StorageD3Enable - [x86] ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable - [x86] ACPI: x86: utils: Add Picasso to the list for forcing StorageD3Enable - [x86] ACPI: x86: Force StorageD3Enable on more products - Input: ili210x - fix ili251x_read_touch_data() return value - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER - [arm64,armhf] pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins - [arm64,armhf] pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins - [arm64,armhf] pinctrl/rockchip: separate struct rockchip_pin_bank to a head file - [arm64,armhf] pinctrl: rockchip: use dedicated pinctrl type for RK3328 - [arm64,armhf] pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set - drm/amdgpu: fix UBSAN warning in kv_dpm.c - netfilter: nf_tables: validate family when identifying table via handle - SUNRPC: Fix null pointer dereference in svc_rqst_free() - SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency() - SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation - SUNRPC: Fix svcxdr_init_encode's buflen calculation - nfsd: hold a lighter-weight client reference over CB_RECALL_ANY - net: dsa: microchip: fix initial port flush problem - net: phy: micrel: add Microchip KSZ 9477 to the device table - xdp: Move the rxq_info.mem clearing to unreg_mem_model() - xdp: Allow registering memory model without rxq reference - xdp: Remove WARN() from __xdp_reg_mem_model() - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep - mtd: partitions: redboot: Added conversion of operands to a larger type - bpf: Add a check for struct bpf_fib_lookup size - net/iucv: Avoid explicit cpumask var allocation on stack - net/dpaa2: Avoid explicit cpumask var allocation on stack - ALSA: emux: improve patch ioctl data validation - media: dvbdev: Initialize sbuf - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message - drm/radeon/radeon_display: Decrease the size of allocated memory - nvme: fixup comment for nvme RDMA Provider Type - drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA - gpio: davinci: Validate the obtained number of IRQs - gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1) - [x86] stop playing stack games in profile_pc() - ocfs2: fix DIO failure due to insufficient transaction credits - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos - mmc: sdhci: Do not invert write-protect twice - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro() - counter: ti-eqep: enable clock at probe - iio: adc: ad7266: Fix variable checking bug - net: usb: ax88179_178a: improve link status logs - usb: gadget: printer: SS+ support - usb: gadget: printer: fix races against disable (CVE-2024-25741) - usb: musb: da8xx: fix a resource leak in probe() - usb: atm: cxacru: fix endpoint checking in cxacru_bind() - serial: 8250_omap: Implementation of Errata i2310 - tty: mcf: MCF54418 has 10 UARTS - net: can: j1939: Initialize unused data in j1939_send_one() - net: can: j1939: recover socket queue on CAN bus error during BAM transmission - net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new - kbuild: Install dtb files as 0644 in Makefile.dtbinst - csky, hexagon: fix broken sys_sync_file_range - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes - [x86] drm/i915/gt: Fix potential UAF by revoke of fence registers - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes - batman-adv: Don't accept TT entries for out-of-spec VIDs - ata: ahci: Clean up sysfs file on error - ata: libata-core: Fix double free on error - ftruncate: pass a signed offset - syscalls: fix compat_sys_io_pgetevents_time64 usage - mtd: spinand: macronix: Add support for serial NAND flash - pwm: stm32: Refuse too small period requests - nfs: Leave pages in the pagecache if readpage failed - ipv6: annotate some data-races around sk->sk_prot - ipv6: Fix data races around sk->sk_prot. - tcp: Fix data races around icsk->icsk_af_ops. - drivers: fix typo in firmware/efi/memmap.c - efi: Correct comment on efi_memmap_alloc - efi: memmap: Move manipulation routines into x86 arch tree - efi: xen: Set EFI_PARAVIRT for Xen dom0 boot on all architectures - [x86] efi/x86: Free EFI memory map only when installing a new one. - [arm64] KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption - [arm64] dts: rockchip: Add sound-dai-cells for RK3368 - xdp: xdp_mem_allocator can be NULL in trace_mem_connect(). - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check - tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset() [ Salvatore Bonaccorso ] * Bump ABI to 31 * Refresh "fanotify: Taint on use of FANOTIFY_ACCESS_PERMISSIONS" * [rt] Refresh "sunrpc: Make svc_xprt_do_enqueue() use" * Refresh "firmware: Remove redundant log messages from drivers" * [rt] Update to 5.10.221-rt113 -- Salvatore Bonaccorso Sun, 14 Jul 2024 10:11:44 +0200 linux (5.10.218-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.217 - [arm64,armhf] dmaengine: pl330: issue_pending waits until WFP state - dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state" - wifi: nl80211: don't free NULL coalescing rule - eeprom: at24: Use dev_err_probe for nvmem register failure - eeprom: at24: Probe for DDR3 thermal sensor in the SPD case - eeprom: at24: fix memory corruption race condition (CVE-2024-35848) - [armhf] pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T - [arm64] pinctrl/meson: fix typo in PDM's pin name - pinctrl: core: delete incorrect free in pinctrl_enable() - sunrpc: add a struct rpc_stats arg to rpc_create_args - nfs: expose /proc/net/sunrpc/nfs in net namespaces - nfs: make the rpc_stat per net namespace - nfs: Handle error of rpc_proc_register() in nfs_net_init(). - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() - [s390x] mm: Fix storage key clearing for guest huge pages - [s390x] mm: Fix clearing storage keys for huge pages - bna: ensure the copied buf is NUL terminated - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). - net l2tp: drop flow hash on forward - [s390x] vdso: Add CFI for RA register to asm macro vdso_func - net: qede: sanitize 'rc' in qede_add_tc_flower_fltr() - net: qede: use return from qede_parse_flow_attr() for flower - net: qede: use return from qede_parse_flow_attr() for flow_spec - net: qede: use return from qede_parse_actions() - cxgb4: Properly lock TX queue for the selftest. - [arm64,armhf] net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341 - net: bridge: fix multicast-to-unicast with fraglist GSO - net: core: reject skb_copy(_expand) for fraglist GSO skbs - net: gro: add flush check in udp_gro_receive_segment - [arm64] clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change - [arm64] KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id - [arm64] KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() - scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic - gfs2: Fix invalid metadata access in punch_hole - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc - wifi: cfg80211: fix rdev_dump_mpp() arguments order - net: mark racy access on sk->sk_rcvbuf - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload - btrfs: return accurate error code on open failure in open_fs_devices() - ALSA: line6: Zero-initialize message buffers - net: bcmgenet: Reset RBUF on first open - ata: sata_gemini: Check clk_enable() result - firewire: ohci: mask bus reset interrupts between ISR and bottom half - btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve - btrfs: always clear PERTRANS metadata during commit - scsi: target: Fix SELinux error when systemd-modules loads the target module - blk-iocost: avoid out of bounds shift - [arm64,armhf] gpu: host1x: Do not setup DMA for virtual devices - [mips64el,mipsel]: scall: Save thread_info.syscall unconditionally on entry (Closes: #1068365) - fs/9p: only translate RWX permissions for plain 9P2000 - fs/9p: translate O_TRUNC into OTRUNC - 9p: explicitly deny setlease attempts - gpio: wcove: Use -ENOTSUPP consistently - gpio: crystalcove: Use -ENOTSUPP consistently - clk: Don't hold prepare_lock when calling kref_put() - fs/9p: drop inodes immediately on non-.L too - drm/nouveau/dp: Don't probe eDP ports twice harder - net:usb:qmi_wwan: support Rolling modules - xfrm: Preserve vlan tags for transport mode software GRO - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (CVE-2024-27398) - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (CVE-2024-27399) - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation - [x86] hwmon: (corsair-cpro) Use a separate buffer for sending commands - [x86] hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event() - [x86] hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock - phonet: fix rtm_phonet_notify() skb allocation - kcov: Remove kcov include from sched.h and move it to its users. - net: bridge: fix corrupted ethernet header on multicast-to-unicast - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() - [arm64] net: hns3: use appropriate barrier function after setting a bit value - btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send() - firewire: nosy: ensure user_length is taken into account when fetching packet contents (CVE-2024-27401) - [arm64] dts: qcom: Fix 'interrupt-map' parent address cells - usb: typec: ucsi: Check for notifications after init - usb: typec: ucsi: Fix connector check on init - usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device - usb: ohci: Prevent missed ohci interrupts - usb: gadget: composite: fix OS descriptors w_value logic - usb: gadget: f_fs: Fix a race condition when processing setup packets. - usb: xhci-plat: Don't include xhci.h - usb: dwc3: core: Prevent phy suspend during init - ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU - iio:imu: adis16475: Fix sync mode setting - iio: accel: mxc4005: Interrupt handling fixes - net: bcmgenet: synchronize use of bcmgenet_set_rx_mode() - dyndbg: fix old BUG_ON in >control parser - mei: me: add lunar lake point M DID - drm/vmwgfx: Fix invalid reads in fence signaled events - net: fix out-of-bounds access in ops_init - regulator: core: fix debugfs creation regression - keys: Fix overwrite of key expiration on instantiation - md: fix kmemleak of rdev->serial (CVE-2024-26900) https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.218 - pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin() - [x86] xen: Drop USERGS_SYSRET64 paravirt call - [arm64] net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access - [arm64] net: bcmgenet: synchronize UMAC_CMD access - ima: fix deadlock when traversing "ima_default_rules". - netlink: annotate lockless accesses to nlk->max_recvmsg_len - [x86] KVM: x86: Clear "has_error_code", not "error_code", for RM exception injection - firmware: arm_scmi: Harden accesses to the reset domains (CVE-2022-48655) - mptcp: ensure snd_nxt is properly initialized on connect - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() - drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper() (CVE-2023-52585) - usb: typec: ucsi: displayport: Fix potential deadlock - serial: kgdboc: Fix NMI-safety problems from keyboard reset code - docs: kernel_include.py: Cope with docutils 0.21 [ Salvatore Bonaccorso ] * Bump ABI to 30 -- Salvatore Bonaccorso Sat, 01 Jun 2024 11:24:36 +0200 linux (5.10.216-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.210 - units: change from 'L' to 'UL' - units: add the HZ macros - spi: introduce SPI_MODE_X_MASK macro - iio: adc: ad7091r: Set alert bit in config register - iio: adc: ad7091r: Allow users to configure device events - iio: adc: ad7091r: Enable internal vref if external vref is not supplied - dmaengine: fix NULL pointer in channel unregistration function - iio:adc:ad7091r: Move exports into IIO_AD7091R namespace. - ext4: allow for the last group to be marked as trimmed - crypto: api - Disallow identical driver names - PM: hibernate: Enforce ordering during image compression/decompression - hwrng: core - Fix page fault dead lock on mmap-ed hwrng - [s390x] crypto: s390/aes - Fix buffer overread in CTR mode - bus: mhi: host: Drop chan lock before queuing buffers - async: Split async_schedule_node_domain() - async: Introduce async_schedule_dev_nocall() - [arm64] dts: qcom: sdm845: fix USB wakeup interrupt types - [arm64] dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts - lsm: new security_file_ioctl_compat() hook - scripts/get_abi: fix source path leak - mmc: core: Use mrq.sbc in close-ended ffu - mmc: mmc_spi: remove custom DMA mapped buffers - rtc: Adjust failure return code for cmos_set_alarm() - nouveau/vmm: don't set addr on the fail path to avoid warning - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path - rename(): fix the locking of subdirectories - block: Remove special-casing of compound pages - mm: vmalloc: introduce array allocation functions - KVM: use __vcalloc for very large allocations - net/smc: fix illegal rmb_desc access in SMC-D connection dump - tcp: make sure init the accept_queue's spinlocks once - bnxt_en: Wait for FLR to complete during probe - vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING - llc: make llc_ui_sendmsg() more robust against bonding changes - llc: Drop support for ETH_P_TR_802_2. - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv (CVE-2024-23849) - tracing: Ensure visibility when inserting an element into tracing_map - afs: Hide silly-rename files from userspace - tcp: Add memory barrier to tcp_push() - netlink: fix potential sleeping issue in mqueue_flush_file - ipv6: init the accept_queue's spinlocks in inet6_create - net/mlx5: DR, Use the right GVMI number for drop action - net/mlx5e: fix a double-free in arfs_create_groups - netfilter: nf_tables: restrict anonymous set and map names to 16 bytes - netfilter: nf_tables: validate NFPROTO_* family - net: mvpp2: clear BM pool before initialization - fjes: fix memleaks in fjes_hw_setup - net: fec: fix the unhandled context fault from smmu - btrfs: ref-verify: free ref cache before clearing mount opt - btrfs: tree-checker: fix inline ref size in error messages - btrfs: don't warn if discard range is not aligned to sector - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume - rbd: don't move requests to the running list on errors - exec: Fix error handling in begin_new_exec() - wifi: iwlwifi: fix a memory corruption - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain - gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04 - drm: Don't unref the same fb many times by mistake due to deadlock handling - drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking - drm/tidss: Fix atomic_flush check - drm/bridge: nxp-ptn3460: simplify some error checking - PM: sleep: Use dev_printk() when possible - PM: sleep: Avoid calling put_device() under dpm_list_mtx - PM: core: Remove unnecessary (void *) conversions - PM: sleep: Fix possible deadlocks in core system-wide PM code - fs/pipe: move check to pipe_has_watch_queue() - pipe: wakeup wr_wait after setting max_usage - [arm64] dts: qcom: sc7180: Use pdc interrupts for USB instead of GIC interrupts - [arm64] dts: qcom: sc7180: fix USB wakeup interrupt types - mm: use __pfn_to_section() instead of open coding it - mm/sparsemem: fix race in accessing memory_section->usage - btrfs: remove err variable from btrfs_delete_subvolume - btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted - drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33] - [armhf] drm/exynos: fix accidental on-stack copy of exynos_drm_plane - [armhf] drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume - gpio: eic-sprd: Clear interrupt after set the interrupt type - spi: bcm-qspi: fix SFDP BFPT read by usig mspi read - [mips*] Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan - tick/sched: Preserve number of idle sleeps across CPU hotplug events - [x86] entry/ia32: Ensure s32 is sign extended to s64 - [powerpc*] mm: Fix null-pointer dereference in pgtable_cache_add - drivers/perf: pmuv3: don't expose SW_INCR event in sysfs - [powerpc*] Fix build error due to is_valid_bugaddr() - [powerpc*] mm: Fix build failures due to arch_reserved_kernel_pages() - [x86] boot: Ignore NMIs during very early boot - [powerpc*] pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE - [powerpc*] lib: Validate size for vector operations - [x86] mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel - perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file - debugobjects: Stop accessing objects after releasing hash bucket lock - regulator: core: Only increment use_count when enable_count changes - audit: Send netlink ACK before setting connection in auditd_set - ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop - PNP: ACPI: fix fortify warning - ACPI: extlog: fix NULL pointer dereference check - PM / devfreq: Synchronize devfreq_monitor_[start/stop] - ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree - jfs: fix slab-out-of-bounds Read in dtSearch - jfs: fix array-index-out-of-bounds in dbAdjTree - jfs: fix uaf in jfs_evict_inode - pstore/ram: Fix crash when setting number of cpus to an odd number - crypto: stm32/crc32 - fix parsing list of devices - afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu() - afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*() - rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() - jfs: fix array-index-out-of-bounds in diNewExt - [s390x] ptrace: handle setting of fpc register correctly - [s390x] KVM: s390: fix setting of fpc register - SUNRPC: Fix a suspicious RCU usage warning - ecryptfs: Reject casefold directory inodes - ext4: fix inconsistent between segment fstrim and full fstrim - ext4: unify the type of flexbg_size to unsigned int - ext4: remove unnecessary check from alloc_flex_gd() - ext4: avoid online resizing failures due to oversized flex bg - wifi: rt2x00: restart beacon queue when hardware reset - scsi: lpfc: Fix possible file string name overflow when updating firmware - PCI: Add no PM reset quirk for NVIDIA Spectrum devices - bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk - scsi: arcmsr: Support new PCI device IDs 1883 and 1886 - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() - bpf: Add map and need_defer parameters to .map_fd_put_ptr() - scsi: libfc: Don't schedule abort twice - scsi: libfc: Fix up timeout error in fc_fcp_rec_error() - bpf: Set uattr->batch.count as zero before batched update or deletion - ionic: pass opcode to devcmd_wait - block/rnbd-srv: Check for unlikely string overflow - [arm64,armhf] net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path - block: prevent an integer overflow in bvec_try_merge_hw_page - md: Whenassemble the array, consult the superblock of the freshest device - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() - wifi: cfg80211: free beacon_ies when overridden from hidden BSS - Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066 - Bluetooth: L2CAP: Fix possible multiple reject send - i40e: Fix VF disable behavior to block all traffic - f2fs: fix to check return value of f2fs_reserve_new_block() - ALSA: hda: Refer to correct stream index at loops - ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument - fast_dput(): handle underflows gracefully - RDMA/IPoIB: Fix error code return in ipoib_mcast_join - drm/amd/display: Fix tiled display misalignment - f2fs: fix write pointers on zoned device after roll forward - drm/drm_file: fix use of uninitialized variable - drm/framebuffer: Fix use of uninitialized variable - drm/mipi-dsi: Fix detach call without attach - media: stk1160: Fixed high volume of stk1160_dbg messages - [x86] PCI: add INTEL_HDA_ARL to pci_ids.h - [x86] ALSA: hda: Intel: add HDA_ARL PCI ID support - [x86] ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL - [armhf] drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time - IB/ipoib: Fix mcast list locking - media: ddbridge: fix an error code problem in ddb_probe - [arm64] drm/msm/dpu: Ratelimit framedone timeout msgs - clk: hi3620: Fix memory leak in hi3620_mmc_clk_init() - clk: mmp: pxa168: Fix memory leak in pxa168_clk_init() - watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786 - drm/amdgpu: Let KFD sync with VM fences - drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()' - leds: trigger: panic: Don't register panic notifier if creating the trigger failed - i3c: master: cdns: Update maximum prescaler value for i2c clock - xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import - mfd: ti_am335x_tscadc: Fix TI SoC dependencies - PCI: Only override AMD USB controller if required - PCI: switchtec: Fix stdev_release() crash after surprise hot remove - usb: hub: Replace hardcoded quirk value with BIT() macro - tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE - fs/kernfs/dir: obey S_ISGID - PCI/AER: Decode Requester ID when no error info found - libsubcmd: Fix memory leak in uniq() - virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings - blk-mq: fix IO hang from sbitmap wakeup race - ceph: fix deadlock or deadcode of misusing dget() - drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()' - drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()' - perf: Fix the nr_addr_filters fix - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update - drm: using mul_u32_u32() requires linux/math64.h - scsi: isci: Fix an error code problem in isci_io_request_build() - scsi: core: Introduce enum scsi_disposition - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler - ip6_tunnel: use dev_sw_netstats_rx_add() - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() - net-zerocopy: Refactor frag-is-remappable test. - tcp: add sanity checks to rx zerocopy - ixgbe: Remove non-inclusive language - ixgbe: Refactor returning internal error codes - ixgbe: Refactor overtemp event handling - ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550() - ipv6: Ensure natural alignment of const ipv6 loopback and router addresses - llc: call sock_orphan() at release time - netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations - net: ipv4: fix a memleak in ip_setup_cork - af_unix: fix lockdep positive in sk_diag_dump_icons() - net: sysfs: Fix /sys/class/net/ path - HID: apple: Add support for the 2021 Magic Keyboard - HID: apple: Add 2021 magic keyboard FN key mapping - bonding: remove print in bond_verify_device_path - uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++ - PM: sleep: Fix error handling in dpm_prepare() - dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools - dmaengine: ti: k3-udma: Report short packet errors - dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA - dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA - dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (CVE-2024-26600) - [arm64] drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case - net: stmmac: xgmac: fix handling of DPP safety error for DMA channels - tunnels: fix out of bounds access when building IPv6 PMTU error - atm: idt77252: fix a memleak in open_card_ubr0 - hwmon: (aspeed-pwm-tacho) mutex for tach reading - [x86] hwmon: (coretemp) Fix out-of-bounds memory access - [x86] hwmon: (coretemp) Fix bogus core_id to attr name mapping - inet: read sk->sk_family once in inet_recv_error() - rxrpc: Fix response to PING RESPONSE ACKs to a dead call - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() - ppp_async: limit MRU to 64K - netfilter: nft_compat: reject unused compat flag - netfilter: nft_compat: restrict match/target protocol to u16 - netfilter: nft_ct: reject direction for ct id - netfilter: nft_set_pipapo: store index in scratch maps - netfilter: nft_set_pipapo: add helper to release pcpu scratch area - netfilter: nft_set_pipapo: remove scratch_aligned pointer - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command - blk-iocost: Fix an UBSAN shift-out-of-bounds warning - net/af_iucv: clean up a try_then_request_module() - USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e - USB: serial: option: add Fibocom FM101-GL variant - USB: serial: cp210x: add ID for IMST iM871A-USB - usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK - hrtimer: Report offline hrtimer enqueue - Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU - Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID - vhost: use kzalloc() instead of kmalloc() followed by memset() - clocksource: Skip watchdog check for large watchdog intervals - net: stmmac: xgmac: use #define for string constants - net: stmmac: xgmac: fix a typo of register name in DPP safety handling - netfilter: nft_set_rbtree: skip end interval element from gc (CVE-2024-26581) - btrfs: forbid creating subvol qgroups - btrfs: do not ASSERT() if the newly created subvolume already got read (CVE-2024-23850) - btrfs: forbid deleting live subvol qgroup - btrfs: send: return EOPNOTSUPP on unknown flags - of: unittest: Fix compile in the non-dynamic case - net: openvswitch: limit the number of recursions from action sets (CVE-2024-1151) - spi: ppc4xx: Drop write-only variable - ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() - net: sysfs: Fix /sys/class/net/ path for statistics - [mips*] Add 'memory' clobber to csum_ipv6_magic() inline assembler - i40e: Fix waiting for queues of all VSIs to be disabled - tracing/trigger: Fix to return error if failed to alloc snapshot - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again - ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1 SF114-32 - ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx - HID: wacom: generic: Avoid reporting a serial of '0' to userspace - HID: wacom: Do not register input devices until after hid_hw_start - usb: ucsi_acpi: Fix command completion handling - USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT - usb: f_mass_storage: forbid async queue when shutdown happen - media: ir_toy: fix a memleak in irtoy_tx - i2c: i801: Remove i801_set_block_buffer_mode - i2c: i801: Fix block process call transactions (CVE-2024-26593) - modpost: trim leading spaces when processing source files list - scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" - lsm: fix the logic in security_inode_getsecctx() - firewire: core: correct documentation of fw_csr_string() kernel API - kbuild: Fix changing ELF file type for output of gen_btf for big endian - nfc: nci: free rx_data_reassembly skb on NCI device cleanup - net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() - xen-netback: properly sync TX responses - ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL - [arm*] binder: signal epoll threads of self-work (CVE-2024-26606) - misc: fastrpc: Mark all sessions as invalid in cb_remove - ext4: fix double-free of blocks due to wrong extents moved_len - tracing: Fix wasted memory in saved_cmdlines logic - staging: iio: ad5933: fix type mismatch regression - iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC - iio: accel: bma400: Fix a compilation problem - media: rc: bpf attach/detach requires write permission - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove - ring-buffer: Clean ring_buffer_poll_wait() error return - serial: max310x: set default value when reading clock ready bit - serial: max310x: improve crystal stable clock detection - [x86] mm/ident_map: Use gbpages only where full GB page should be mapped. - mmc: slot-gpio: Allow non-sleeping GPIO ro - ALSA: hda/conexant: Add quirk for SWS JS201D - nilfs2: fix data corruption in dsync block recovery for small block sizes - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() - crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked - nfp: use correct macro for LengthSelect in BAR config - nfp: flower: prevent re-adding mac index for bonded port - wifi: mac80211: reload info pointer in ieee80211_tx_dequeue() - irqchip/irq-brcmstb-l2: Add write memory barrier before exit - irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update - [s390x] qeth: Fix potential loss of L3-IP@ in case of network issues - ceph: prevent use-after-free in encode_cap_msg() - of: property: fix typo in io-channels - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) - pmdomain: core: Move the unused cleanup to a _sync initcall - tracing: Inform kmemleak of saved_cmdlines allocation - Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" - bus: moxtet: Add spi device table - PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support - mips: Fix max_mapnr being uninitialized on early stages - crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init - serial: Add rs485_supported to uart_port - serial: 8250_exar: Fill in rs485_supported - serial: 8250_exar: Set missing rs485_supported flag - scripts/decode_stacktrace.sh: silence stderr messages from addr2line/nm - scripts/decode_stacktrace.sh: support old bash version - scripts: decode_stacktrace: demangle Rust symbols - scripts/decode_stacktrace.sh: optionally use LLVM utilities - netfilter: ipset: fix performance regression in swap operation - netfilter: ipset: Missing gc cancellations fixed - hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range() - Revert "arm64: Stash shadow stack pointer in the task struct on interrupt" - net: prevent mss overflow in skb_segment() (CVE-2023-52435) - sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602) - nilfs2: fix potential bug in end_buffer_async_write - nilfs2: replace WARN_ONs for invalid DAT metadata block requests - dm: limit the number of targets and parameter size area (CVE-2024-23851, CVE-2023-52429) - PM: runtime: add devm_pm_runtime_enable helper - PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() - [arm64] drm/msm/dsi: Enable runtime PM - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607) - net: bcmgenet: Fix EEE implementation - PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.211 - net/sched: Retire CBQ qdisc - net/sched: Retire ATM qdisc - net/sched: Retire dsmark qdisc - smb: client: fix OOB in receive_encrypted_standard() (CVE-2024-0565) - smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434) - smb: client: fix parsing of SMB3.1.1 POSIX create context - sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset - userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb - zonefs: Improve error handling - sched/rt: Fix sysctl_sched_rr_timeslice intial value - sched/rt: Disallow writing invalid values to sched_rt_period_us - scsi: target: core: Add TMF to tmr_list handling - [arm64] dmaengine: fsl-qdma: increase size of 'irq_name' - wifi: cfg80211: fix missing interfaces when dumping - wifi: mac80211: fix race condition on enabling fast-xmit - fbdev: savage: Error out if pixclock equals zero - fbdev: sis: Error out if pixclock equals zero - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected - ahci: asm1166: correct count of reported ports - ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() - [armhf] dmaengine: ti: edma: Add some null pointer checks to the edma_probe - [arm64] regulator: pwm-regulator: Add validity checks in continuous .get_voltage - nvmet-tcp: fix nvme tcp ida memory leak - [armhf] ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616 - netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new - nvme-fc: do not wait in vain when unloading module - nvmet-fcloop: swap the list_add_tail arguments - nvmet-fc: release reference on target port - nvmet-fc: abort command when there is no binding - ext4: correct the hole length returned by ext4_map_blocks() - Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table - efi: runtime: Fix potential overflow of soft-reserved region size - efi: Don't add memblocks for soft-reserved memory - [x86] hwmon: (coretemp) Enlarge per package core count limit - scsi: lpfc: Use unsigned type for num_sge - firewire: core: send bus reset promptly on gap count error - virtio-blk: Ensure no requests in virtqueues before deleting vqs. - [mips*] irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable - media: av7110: prevent underflow in write_ts_to_decoder() - hvc/xen: prevent concurrent accesses to the shared ring - [x86] uaccess: Implement macros for CMPXCHG on user addresses - seccomp: Invalidate seccomp mode to catch death failures - block: ataflop: fix breakage introduced at blk-mq refactoring - [powerpc*] watchpoint: Workaround P10 DD1 issue with VSX-32 byte instructions - [powerpc*] watchpoints: Annotate atomic context in more places - cifs: add a warning when the in-flight count goes negative - mtd: spinand: macronix: Add support for MX35LFxGE4AD - [x86] ASoC: Intel: boards: harden codec property handling - [x86] ASoC: Intel: boards: get codec device with ACPI instead of bus search - [x86] ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use - task_stack, x86/cea: Force-inline stack helpers - btrfs: tree-checker: check for overlapping extent items - btrfs: introduce btrfs_lookup_match_dir - btrfs: unify lookup return value when dir entry is missing - btrfs: do not pin logs too early during renames - lan743x: fix for potential NULL pointer dereference with bare card - [x86] platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC - iwlwifi: mvm: do more useful queue sync accounting - iwlwifi: mvm: write queue_sync_state only for sync - jbd2: remove redundant buffer io error checks - jbd2: recheck chechpointing non-dirty buffer - jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint - [x86] drop bogus "cc" clobber from __try_cmpxchg_user_asm() - erofs: fix lz4 inplace decompression (CVE-2023-52497) - [amd64] IB/hfi1: Fix sdma.h tx->num_descs off-by-one error - [s390x] cio: fix invalid -EBUSY on ccw_device_start - dm-crypt: don't modify the data when using authenticated encryption - [arm64] KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler - [arm64] KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() - PCI/MSI: Prevent MSI hardware interrupt number truncation - l2tp: pass correct message length to ip6_append_data - [x86] Revert "x86/ftrace: Use alternative RET encoding" - [x86] text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR - [x86] ibt,paravirt: Use text_gen_insn() for paravirt_patch() - [x86] ftrace: Use alternative RET encoding - [x86] returnthunk: Allow different return thunks - [x86] Revert "x86/alternative: Make custom return thunk unconditional" - [x86] alternative: Make custom return thunk unconditional - usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs - mptcp: fix lockless access in subflow ULP diag - [amd64] IB/hfi1: Fix a memleak in init_credit_return - RDMA/bnxt_re: Return error for SRQ resize - RDMA/srpt: Support specifying the srpt_service_guid parameter - RDMA/qedr: Fix qedr_create_user_qp error flow - [arm64] dts: rockchip: set num-cs property for spi on px30 - RDMA/srpt: fix function pointer cast warnings - bpf, scripts: Correct GPL license name - scsi: jazz_esp: Only build if SCSI core is builtin - nouveau: fix function cast warnings - ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid - ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid - afs: Increase buffer size in afs_update_volume_status() - ipv6: sr: fix possible use-after-free and null-ptr-deref - packet: move from strlcpy with unused retval to strscpy - net: dev: Convert sa_data to flexible array in struct sockaddr - [s390x] use the correct count for __iowrite64_copy() - netfilter: nf_tables: set dormant flag on hook register failure - drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3 - drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set - drm/amd/display: Fix memory leak in dm_sw_fini() - block: ataflop: more blk-mq refactoring fixes - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio - arp: Prevent overflow in arp_req_get(). - ext4: regenerate buddy after block freeing failed if under fc replay (CVE-2024-26601) https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.212 - [x86] platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names - crypto: virtio/akcipher - Fix stack overflow on memcpy - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter - net: ip_tunnel: prevent perpetual headroom growth - tun: Fix xdp_rxq_info's queue_index when detaching - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() - lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected - net: usb: dm9601: fix wrong return value in dm9601_mdio_read - Bluetooth: Avoid potential use-after-free in hci_error_reset - Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR - Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST - Bluetooth: Enforce validation on max value of connection interval - netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate() - rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back - efi/capsule-loader: fix incorrect allocation size - ALSA: Drop leftover snd-rtctimer stuff from Makefile - afs: Fix endless loop in directory parsing - tomoyo: fix UAF write bug in tomoyo_write_control() (CVE-2024-26622) - gtp: fix use-after-free and null-ptr-deref in gtp_newlink() - wifi: nl80211: reject iftype change with mesh ID change - btrfs: dev-replace: properly validate device names - [arm64] dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read - [arm64] dmaengine: fsl-qdma: init irq after reg initialization - mmc: core: Fix eMMC initialization with 1-bit bus connection - [arm64] mmc: sdhci-xenon: add timeout for PHY init complete - [arm64] mmc: sdhci-xenon: fix PHY init clock stability - [arm64] pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation - [x86] cpu/intel: Detect TME keyid bits before setting MTRR mask registers - mptcp: fix possible deadlock in subflow diag - ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks() - cachefiles: fix memory leak in cachefiles_add_cache() - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (CVE-2024-0841) - gpiolib: Fix the error path order in gpiochip_add_data_with_key() - gpio: fix resource unwinding order in error path - mptcp: fix double-free on socket dismantle https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.213 - [arm64,armhf] mmc: mmci: stm32: use a buffer for unaligned DMA requests - [arm64,armhf] mmc: mmci: stm32: fix DMA API overlapping mappings warning - lan78xx: Fix white space and style issues - lan78xx: Add missing return code checks - lan78xx: Fix partial packet errors on suspend/resume - lan78xx: Fix race conditions in suspend/resume handling - net: lan78xx: fix runtime PM count underflow on link stop - ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able - i40e: disable NAPI right after disabling irqs when handling xsk_pool - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string - geneve: make sure to pull inner header in geneve_rx() - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program - net/rds: fix WARNING in rds_conn_connect_if_down - netfilter: nft_ct: fix l3num expectations with inet pseudo family - netfilter: nf_conntrack_h323: Add protection for bmp length out of range - netrom: Fix a data-race around sysctl_netrom_default_path_quality - netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser - netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser - netrom: Fix a data-race around sysctl_netrom_transport_timeout - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries - netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay - netrom: Fix a data-race around sysctl_netrom_transport_busy_delay - netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size - netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout - netrom: Fix a data-race around sysctl_netrom_routing_control - netrom: Fix a data-race around sysctl_netrom_link_fails_count - netrom: Fix data-races around sysctl_net_busy_read - xhci: remove extra loop in interrupt context - xhci: prevent double-fetch of transfer and transfer event TRBs - xhci: process isoc TD properly when there was a transaction error mid TD. - xhci: handle isoc Babble and Buffer Overrun events properly - net: Change sock_getsockopt() to take the sk ptr instead of the sock ptr - bpf: net: Change sk_getsockopt() to take the sockptr_t argument - lsm: make security_socket_getpeersec_stream() sockptr_t safe - lsm: fix default return value of the socket_getpeersec_*() hooks - ext4: make ext4_es_insert_extent() return void - ext4: refactor ext4_da_map_blocks() - ext4: convert to exclusive lock while inserting delalloc extents - [x86] Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening - [x86] hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening - [x86] hv_netvsc: Wait for completion on request SWITCH_DATA_PATH - [x86] hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove - [x86] hv_netvsc: Make netvsc/VF binding check both MAC and serial number - [x86] hv_netvsc: use netif_is_bond_master() instead of open code - [x86] hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed - mm/hugetlb: change hugetlb_reserve_pages() to type bool - mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE - getrusage: add the "signal_struct *sig" local variable - getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand() - getrusage: use __for_each_thread() - getrusage: use sig->stats_lock rather than lock_task_sighand() - [x86] Drivers: hv: vmbus: Drop error message when 'No request id available' - regmap: allow to define reg_update_bits for no bus configuration - regmap: Add bulk read/write callbacks into regmap_config https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.214 - io_uring/unix: drop usage of io_uring socket - io_uring: drop any code related to SCM_RIGHTS - rcu-tasks: Provide rcu_trace_implies_rcu_gp() - bpf: Defer the free of inner map when necessary (CVE-2023-52447) - ASoC: rt5645: Make LattePanda board DMI match more precise - [x86] xen: Add some null pointer checking to smp.c - [mips*] Clear Cause.BD in instruction_pointer_set - HID: multitouch: Add required quirk for Synaptics 0xcddc device - gen_compile_commands: fix invalid escape sequence warning - RDMA/mlx5: Fix fortify source warning while accessing Eth segment - RDMA/mlx5: Relax DEVX access upon modify commands - [x86] mm: Move is_vsyscall_vaddr() into asm/vsyscall.h - [x86] mm: Disallow vsyscall page read for copy_from_kernel_nofault() - net/iucv: fix the allocation size of iucv_path_table array - block: sed-opal: handle empty atoms when parsing response - dm-verity, dm-crypt: align "struct bvec_iter" correctly - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security (CVE-2024-22099) - firewire: core: use long bus reset on gap count error - [x86] ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet - Input: gpio_keys_polled - suppress deferred probe error for gpio - [x86] paravirt: Fix build due to __text_gen_insn() backport - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak - nbd: null check for nla_nest_start - fs/select: rework stack allocation hack for clang - block: add a new set_read_only method - md: implement ->set_read_only to hook into BLKROSET processing - md: Don't clear MD_CLOSING when the raid is about to stop - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts (CVE-2023-6270) - timekeeping: Fix cross-timestamp interpolation on counter wrap - timekeeping: Fix cross-timestamp interpolation corner case decision - timekeeping: Fix cross-timestamp interpolation for non-x86 - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (CVE-2023-7042) - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled - wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled - wifi: b43: Stop correct queue in DMA worker when QoS is disabled - wifi: b43: Disable QoS for bcm4331 - wifi: wilc1000: fix declarations ordering - wifi: wilc1000: fix RCU usage in connect path - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work - wifi: wilc1000: fix multi-vif management when deleting a vif - wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir() - cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value - sock_diag: annotate data-races around sock_diag_handlers[family] - inet_diag: annotate data-races around inet_diag_table[] - bpftool: Silence build warning about calloc() - af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc(). - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete - wifi: iwlwifi: dbg-tlv: ensure NUL termination - wifi: iwlwifi: fix EWRD table validity check - net: blackhole_dev: fix build warning for ethh set but not used - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() - bpf: Factor out bpf_spin_lock into helpers. - bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly - wireless: Remove redundant 'flush_workqueue()' calls - wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() - [amd64] iommu/amd: Mark interrupt as managed - wifi: brcmsmac: avoid function pointer casts - net: ena: Remove ena_select_queue - ACPI: scan: Fix device check notification handling - [x86] relocs: Ignore relocations in .notes section (CVE-2024-26816) - SUNRPC: fix some memleaks in gssx_dec_option_array - mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function - wifi: rtw88: 8821c: Fix false alarm count - PCI: Make pci_dev_is_disconnected() helper public for other drivers - [amd64] iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected - igb: move PEROUT and EXTTS isr logic to separate functions - igb: Fix missing time sync events - Bluetooth: Remove superfluous call to hci_conn_check_pending() - Bluetooth: hci_core: Fix possible buffer overflow - sr9800: Add check for usbnet_get_endpoints (CVE-2024-26651) - bpf: Eliminate rlimit-based memory accounting for devmap maps - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches - bpf: Fix hashtab overflow check on 32-bit arches - bpf: Fix stackmap overflow check on 32-bit arches - ipv6: fib6_rules: flush route cache when rule is changed - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() - net: phy: fix phy_get_internal_delay accessing an empty array - net: hns3: fix port duplex configure error in IMP reset - net: phy: DP83822: enable rgmii mode if phy_interface_is_rgmii - net: phy: dp83822: Fix RGMII TX delay configuration - OPP: debugfs: Fix warning around icc_get_name() - tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function - net/ipv4: Replace one-element array with flexible-array member - net/ipv4: Revert use of struct_size() helper - net/ipv4/ipv6: Replace one-element arraya with flexible-array members - bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument - ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function - l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function - udp: fix incorrect parameter validation in the udp_lib_getsockopt() function - net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function - nfp: flower: handle acti_netdevs allocation failure - dm raid: fix false positive for requeue needed during reshape - dm: call the resume method on internal suspend - [arm64,armhf] drm/tegra: dsi: Add missing check for of_find_device_by_node - [arm64,armhf] drm/tegra: dsi: Make use of the helper function dev_err_probe() - [arm64,armhf] drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe() - [arm64,armhf] drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe() - [arm64,armhf] drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe() - drm/rockchip: inno_hdmi: Fix video timing - drm: Don't treat 0 as -1 in drm_fixp2int_ceil - drm/rockchip: lvds: do not overwrite error code - drm/rockchip: lvds: do not print scary message when probing defer - drm/lima: fix a memleak in lima_heap_alloc - dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA - media: tc358743: register v4l2 async device only after successful setup - PCI/DPC: Print all TLP Prefixes, not just the first - perf record: Fix possible incorrect free in record__switch_output() - HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' - drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()' - perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample() - media: em28xx: annotate unchecked call to media_device_register() - media: v4l2-tpg: fix some memleaks in tpg_alloc - media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity - media: edia: dvbdev: fix a use-after-free - pinctrl: mediatek: Drop bogus slew rate register range for MT8192 - [arm64] clk: qcom: reset: Commonize the de/assert functions - [arm64] clk: qcom: reset: Ensure write completion on reset de/assertion - quota: simplify drop_dquot_ref() - quota: Fix potential NULL pointer dereference - quota: Fix rcu annotations of inode dquot pointers - PCI: switchtec: Fix an error handling path in switchtec_pci_probe() - crypto: xilinx - call finalize with bh disabled - perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str() - drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode() - ALSA: seq: fix function cast warnings - perf stat: Avoid metric-only segv - media: sun8i-di: Fix coefficient writes - media: sun8i-di: Fix power on/off sequences - media: sun8i-di: Fix chroma difference threshold - media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak - media: go7007: add check of return value of go7007_read_addr() - media: pvrusb2: remove redundant NULL check - media: pvrusb2: fix pvr2_stream_callback casts - PCI: Mark 3ware-9650SE Root Port Extended Tags as broken - [arm64] clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister() - [arm64,armhf] drm/tegra: put drm_gem_object ref on error in tegra_fb_create - mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref - mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref - crypto: arm/sha - fix function cast warnings - drm/tidss: Fix initial plane zpos values - mtd: maps: physmap-core: fix flash size larger than 32-bit - mtd: rawnand: lpc32xx_mlc: fix irq handler prototype - drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int() - media: pvrusb2: fix uaf in pvr2_context_set_notify - media: dvb-frontends: avoid stack overflow warnings with clang - media: go7007: fix a memleak in go7007_load_encoder - media: ttpci: fix two memleaks in budget_av_attach - media: mediatek: vcodec: avoid -Wcast-function-type-strict warning - powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks - [arm64] drm/msm/dpu: add division of drm_display_mode's hskew parameter - [powerpc*] embedded6xx: Fix no previous prototype for avr_uart_send() etc. - leds: aw2013: Unlock mutex before destroying it - leds: sgm3140: Add missing timer cleanup and flash gpio control - backlight: lm3630a: Initialize backlight_properties on init - backlight: lm3630a: Don't set bl->props.brightness in get_brightness - backlight: da9052: Fully initialize backlight_properties during probe - backlight: lm3639: Fully initialize backlight_properties during probe - backlight: lp8788: Fully initialize backlight_properties during probe - clk: Fix clk_core_get NULL dereference - ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops - ALSA: usb-audio: Stop parsing channels bits when all channels are found. - RDMA/srpt: Do not register event handler until srpt device is fully setup - f2fs: compress: fix to check unreleased compressed cluster - scsi: csiostor: Avoid function pointer casts - RDMA/device: Fix a race between mad_client and cm_client init - scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn - net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 - NFSv4.2: fix listxattr maximum XDR buffer size - watchdog: stm32_iwdg: initialize default timeout - NFS: Fix an off by one in root_nfs_cat() - afs: Revert "afs: Hide silly-rename files from userspace" - [armhf] remoteproc: stm32: Constify st_rproc_ops - [armhf] remoteproc: Add new get_loaded_rsc_table() to rproc_ops - [armhf] remoteproc: stm32: Move resource table setup to rproc_ops - [armhf] remoteproc: stm32: use correct format strings on 64-bit - [armhf] remoteproc: stm32: Fix incorrect type in assignment for va - [armhf] remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef - tty: vt: fix 20 vs 0x20 typo in EScsiignore - serial: max310x: fix syntax error in IRQ error message - tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT - kconfig: fix infinite loop when expanding a macro at the end of file - rtc: mt6397: select IRQ_DOMAIN instead of depending on it - serial: 8250_exar: Don't remove GPIO device on suspend - staging: greybus: fix get_channel_from_mode() failure path - usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin - io_uring: don't save/restore iowait state - [s390x] vtime: fix average steal time calculation - soc: fsl: dpio: fix kcalloc() argument order - hsr: Fix uninit-value access in hsr_get_node() - packet: annotate data-races around ignore_outgoing - net: dsa: mt7530: prevent possible incorrect XTAL frequency selection - wireguard: receive: annotate data-race around receiving_counter.counter - rds: introduce acquire/release ordering in acquire/release_in_xmit() - hsr: Handle failures in module init - net/bnx2x: Prevent access to a freed page in page_pool - netfilter: nft_set_pipapo: release elements in clone only from destroy path (CVE-2024-26809) - scsi: fc: Update formal FPIN descriptor definitions - netfilter: nf_tables: do not compare internal table flags on updates - rcu: add a helper to report consolidated flavor QS - bpf: report RCU QS in cpumap kthread - spi: spi-mt65xx: Fix NULL pointer access in interrupt handler - regmap: Add missing map->bus check - [armhf] remoteproc: stm32: fix phys_addr_t format string https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.215 - amdkfd: use calloc instead of kzalloc to avoid integer overflow (CVE-2024-26817) - Documentation/hw-vuln: Update spectre doc - [x86] cpu: Support AMD Automatic IBRS - [x86] bugs: Use sysfs_emit() - timers: Update kernel-doc for various functions - timers: Use del_timer_sync() even on UP - timers: Rename del_timer_sync() to timer_delete_sync() - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach (CVE-2023-47233) - [armhf] dts: marvell: Fix maxium->maxim typo in brownstone dts - [x86] drm/vmwgfx: stop using ttm_bo_create v2 - [x86] drm/vmwgfx: switch over to the new pin interface v2 - [x86] drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' - [x86] drm/vmwgfx: Fix some static checker warnings - [x86] drm/vmwgfx: Fix possible null pointer derefence with invalid contexts - media: xc4000: Fix atomicity violation in xc4000_get_frequency (CVE-2024-24861) - KVM: Always flush async #PF workqueue when vCPU is being destroyed - [x86] crypto: qat - fix double free during reset - [x86] crypto: qat - resolve race condition during AER recovery - ext4: correct best extent lstart adjustment logic - block: introduce zone_write_granularity limit - block: Clear zone limits for a non-zoned stacked queue - bounds: support non-power-of-two CONFIG_NR_CPUS - fat: fix uninitialized field in nostale filehandles - ubifs: Set page uptodate in the correct place - ubi: Check for too small LEB size in VTBL code - ubi: correct the calculation of fastmap size - mtd: rawnand: meson: fix scrambling mode value in command macro - PM: suspend: Set mem_sleep_current during kernel command line setup - [powerpc*] fsl: Fix mfpmr build errors with newer binutils - USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB - USB: serial: add device ID for VeriFone adapter - USB: serial: cp210x: add ID for MGP Instruments PDS100 - USB: serial: option: add MeiG Smart SLM320 product - USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M - PM: sleep: wakeirq: fix wake irq warning in system suspend - mmc: tmio: avoid concurrent runs of mmc_request_done() - fuse: fix root lookup with nonzero generation - fuse: don't unhash root - usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros - printk/console: Split out code that enables default console - serial: Lock console when calling into driver before registration - btrfs: fix off-by-one chunk length calculation at contains_pending_extent() - PCI: Drop pci_device_remove() test of pci_dev->driver - PCI/PM: Drain runtime-idle callbacks before driver removal - PCI/ERR: Cache RCEC EA Capability offset in pci_init_capabilities() - PCI: Cache PCIe Device Capabilities register - PCI: Work around Intel I210 ROM BAR overlap defect - PCI/ASPM: Make Intel DG2 L1 acceptable latency unlimited - PCI/DPC: Quirk PIO log size for certain Intel Root Ports - PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"" - dm-raid: fix lockdep waring in "pers->hot_add_disk" - mac802154: fix llsec key resources release in mac802154_llsec_key_del - mm: swap: fix race between free_swap_and_cache() and swapoff() - mmc: core: Fix switch on gp3 partition - [armhf] drm/etnaviv: Restore some id values - hwmon: (amc6821) add of_match table - ext4: fix corruption during on-line resize - nvmem: meson-efuse: fix function pointer type mismatch - slimbus: core: Remove usage of the deprecated ida_simple_xx() API - [arm64,armhf] phy: tegra: xusb: Add API to retrieve the port number of phy - usb: gadget: tegra-xudc: Use dev_err_probe() - usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic - speakup: Fix 8bit characters from direct synth - PCI/ERR: Clear AER status only when we control AER - PCI/AER: Block runtime suspend when handling errors - nfs: fix UAF in direct writes - kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 - PCI: dwc: endpoint: Fix advertised resizable BAR size - vfio/platform: Disable virqfds on cleanup - ring-buffer: Fix waking up ring buffer readers - ring-buffer: Do not set shortest_full when full target is hit - ring-buffer: Fix resetting of shortest_full - ring-buffer: Fix full_waiters_pending in poll - [s390x] zcrypt: fix reference counting on zcrypt card objects - drm/panel: do not return negative error codes from drm_panel_get_modes() - [armhf] drm/exynos: do not return negative values from .get_modes() - drm/imx/ipuv3: do not return negative values from .get_modes() - drm/vc4: hdmi: do not return negative values from .get_modes() - nilfs2: fix failure to detect DAT corruption in btree and direct mappings - nilfs2: prevent kernel bug at submit_bh_wbc() - cpufreq: dt: always allocate zeroed cpumask - [x86] CPU/AMD: Update the Zenbleed microcode revisions - net: hns3: tracing: fix hclgevf trace event strings - wireguard: netlink: check for dangling peer via is_dead instead of empty list - wireguard: netlink: access device through ctx instead of peer - ahci: asm1064: correct count of reported ports - ahci: asm1064: asm1166: don't limit reported ports - drm/amd/display: Return the correct HDCP error code - drm/amd/display: Fix noise issue on HDMI AV mute - dm snapshot: fix lockup in dm_exception_table_exit - vxge: remove unnecessary cast in kfree() - [x86] stackprotector/32: Make the canary into a regular percpu variable - [x86] pm: Work around false positive kmemleak report in msr_build_context() - scripts: kernel-doc: Fix syntax error due to undeclared args variable (Closes: #1064035) - comedi: comedi_test: Prevent timers rescheduling during deletion - cpufreq: brcmstb-avs-cpufreq: fix up "add check for cpufreq_cpu_get's return value" - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643) - netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642) - netfilter: nf_tables: reject constant set with timeout - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory - xfrm: Avoid clang fortify warning in copy_to_user_tmpl() - [x86] KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() - ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command - usb: gadget: ncm: Fix handling of zero block length packets - usb: port: Don't try to peer unused USB ports based on location - tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled - mei: me: add arrow lake point S DID - mei: me: add arrow lake point H DID - vt: fix unicode buffer corruption when deleting characters - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion - tee: optee: Fix kernel panic caused by incorrect error handling - xen/events: close evtchn after mapping cleanup (CVE-2024-26687) - printk: Update @console_may_schedule in console_trylock_spinning() - btrfs: allocate btrfs_ioctl_defrag_range_args on stack - [x86] asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix - [x86] bugs: Add asm helpers for executing VERW - [x86] entry_64: Add VERW just before userspace transition - [x86] entry_32: Add VERW just before userspace transition - [x86] bugs: Use ALTERNATIVE() instead of mds_user_clear static key - [x86] KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH - [x86] KVM/VMX: Move VERW closer to VMentry for MDS mitigation - [x86] Mitigate Register File Data Sampling (RFDS) vulnerability (CVE-2023-28746): + [x86] mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set + Documentation/hw-vuln: Add documentation for RFDS + [x86] rfds: Mitigate Register File Data Sampling (RFDS) + [x86] KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests - perf/core: Fix reentry problem in perf_output_read_group() - efivarfs: Request at most 512 bytes for variable names - [powerpc*] xor_vmx: Add '-mhard-float' to CFLAGS - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO (CVE-2023-52488) - mm/memory-failure: fix an incorrect use of tail pages - mm/migrate: set swap entry values of THP tail pages properly. - init: open /initrd.image with O_LARGEFILE - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes - exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack() - mmc: core: Initialize mmc_blk_ioc_data - mmc: core: Avoid negative index with array access - net: ll_temac: platform_get_resource replaced by wrong function - usb: cdc-wdm: close race between read and workqueue - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs (CVE-2024-26654) - scsi: core: Fix unremoved procfs host directory regression - [arm*] staging: vc04_services: changen strncpy() to strscpy_pad() - [arm*] staging: vc04_services: fix information leak in create_component() - USB: core: Add hub_get() and hub_put() routines - [arm*] usb: dwc2: host: Fix remote wakeup from hibernation - [arm*] usb: dwc2: host: Fix hibernation flow - [arm*] usb: dwc2: host: Fix ISOC flow in DDMA mode - [arm*] usb: dwc2: gadget: LPM flow fix - usb: udc: remove warning when queue disabled ep - usb: typec: ucsi: Ack unsupported commands - usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset - scsi: qla2xxx: Split FCE|EFT trace control - scsi: qla2xxx: Fix command flush on cable pull - scsi: qla2xxx: Delay I/O Abort on PCI error - [x86] cpu: Enable STIBP on AMD if Automatic IBRS is enabled - PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports - scsi: lpfc: Correct size for wqe for memset() - USB: core: Fix deadlock in usb_deauthorize_interface() - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet - ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa() - tcp: properly terminate timers for kernel sockets - ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields() - bpf: Protect against int overflow for stack access size - dm integrity: fix out-of-range warning - r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d - [x86] cpufeatures: Add new word for scattered features - Bluetooth: hci_event: set the conn encrypted before conn establishes - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CVE-2024-24857, CVE-2024-24858) - netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620) - net/rds: fix possible cp null dereference - vfio/pci: Disable auto-enable of exclusive INTx IRQ (CVE-2024-27437) - vfio/pci: Lock external INTx masking ops (CVE-2024-26810) - vfio: Introduce interface to flush virqfd inject workqueue - vfio/pci: Create persistent INTx handler (CVE-2024-26812) - vfio/platform: Create persistent IRQ handlers (CVE-2024-26813) - vfio/fsl-mc: Block calling interrupt handler without trigger (CVE-2024-26814) - io_uring: ensure '0' is returned on file registration success - Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped." - mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations - [x86] srso: Add SRSO mitigation for Hygon processors (CVE-2023-52482) - block: add check that partition length needs to be aligned with block size (CVE-2023-52458) - netfilter: nf_tables: reject new basechain after table flag update - netfilter: nf_tables: flush pending destroy work before exit_net release - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() - netfilter: validate user input for expected length - vboxsf: Avoid an spurious warning if load_nls_xxx() fails - bpf, sockmap: Prevent lock inversion deadlock in map delete elem - net/sched: act_skbmod: prevent kernel-infoleak - net: stmmac: fix rx queue priority assignment - erspan: make sure erspan_base_hdr is present in skb->head - ipv6: Fix infinite recursion in fib6_dump_done(). - udp: do not transition UDP GRO fraglist partial checksums to unnecessary - i40e: fix i40e_count_filters() to count only active/new filters - i40e: fix vf may be used uninitialized in this function warning - scsi: qla2xxx: Update manufacturer details - scsi: qla2xxx: Update manufacturer detail - Revert "usb: phy: generic: Get the vbus supply" - udp: do not accept non-tunnel GSO skbs landing in a tunnel - net: ravb: Always process TX descriptor ring - [arm64] dts: qcom: sc7180: Remove clock for bluetooth on Trogdor - [arm64] dts: qcom: sc7180-trogdor: mark bluetooth address as broken - ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw - ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit - scsi: mylex: Fix sysfs buffer lengths - ata: sata_mv: Fix PCI device ID table declaration compilation warning - ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone - driver core: Introduce device_link_wait_removal() - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals - [x86] mce: Make sure to grab mce_sysfs_mutex in set_bank() - [s390x] entry: align system call table on 8 bytes - [x86] bugs: Fix the SRSO mitigation on Zen3/4 - [x86] retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO - mptcp: don't account accept() of non-MPC client as fallback to TCP - [x86] cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word - objtool: Add asm version of STACK_FRAME_NON_STANDARD - wifi: ath9k: fix LNA selection in ath_ant_try_scan() - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() - panic: Flush kernel log buffer at the end - [arm64] dts: rockchip: fix rk3328 hdmi ports node - [arm64] dts: rockchip: fix rk3399 hdmi ports node - ionic: set adminq irq affinity - pstore/zone: Add a null pointer check to the psz_kmsg_read - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() - btrfs: export: handle invalid inode or root reference in btrfs_get_parent() - btrfs: send: handle path ref underflow in header iterate_inode_ref() - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() - Bluetooth: btintel: Fix null ptr deref in btintel_read_version - Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails - pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs - sysv: don't call sb_bread() with pointers_lock held - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() - isofs: handle CDs with bad root inode but good Joliet root directory - media: sta2x11: fix irq handler cast - ext4: add a hint for block bitmap corrupt state in mb_groups - ext4: forbid commit inconsistent quota data when errors=remount-ro - drm/amd/display: Fix nanosec stat overflow - SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int - Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default" - libperf evlist: Avoid out-of-bounds access - block: prevent division by zero in blk_rq_stat_sum() - RDMA/cm: add timeout to cm_destroy_id wait - Input: allocate keycode for Display refresh rate toggle - [x86] platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment - tools: iio: replace seekdir() in iio_generic_buffer - usb: typec: tcpci: add generic tcpci fallback compatible - usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined - fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 - drivers/nvme: Add quirks for device 126f:2262 - fbmon: prevent division by zero in fb_videomode_from_videomode() - netfilter: nf_tables: release batch on table validation from abort path - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (CVE-2024-26925) - netfilter: nf_tables: discard table flag update with pending basechain deletion - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc - virtio: reenable config if freezing device failed - [x86] mm/pat: fix VM_PAT handling in COW mappings - [x86] drm/i915/gt: Reset queue_priority_hint on parking - Bluetooth: btintel: Fixe build regression - [x86] VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() - kbuild: dummy-tools: adjust to stricter stackprotector check - scsi: sd: Fix wrong zone_write_granularity value during revalidate - [x86] retpoline: Add NOENDBR annotation to the SRSO dummy return thunk - [x86] head/64: Re-enable stack protection https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.216 - batman-adv: Avoid infinite loop trying to resize local TT - Bluetooth: Fix memory leak in hci_req_sync_complete() - media: cec: core: remove length check of Timer Status - nouveau: fix function cast warning - net: openvswitch: fix unwanted error log on timeout policy probing - u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING - geneve: fix header validation in geneve[6]_xmit_skb - ipv6: fib: hide unused 'pn' variable - ipv4/route: avoid unused-but-set-variable warning - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr - Bluetooth: SCO: Fix not validating setsockopt user input - netfilter: complete validation of user input - net/mlx5: Properly link new fs rules into the tree - af_unix: Do not use atomic ops for unix_sk(sk)->inflight. - af_unix: Fix garbage collector racing against connect() (CVE-2024-26923) - net: ena: Fix potential sign extension issue - net: ena: Wrong missing IO completions check order - net: ena: Fix incorrect descriptor free behavior - [amd64] iommu/vt-d: Allocate local memory for page request queue - [arm64] mailbox: imx: fix suspend failue - btrfs: qgroup: correctly model root qgroup rsv in convert - drm/client: Fully protect modes[] with dev->mode_config.mutex - vhost: Add smp_rmb() in vhost_vq_avail_empty() - [x86] cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n - [x86] apic: Force native_apic_mem_read() to use the MOV instruction - irqflags: Explicitly ignore lockdep_hrtimer_exit() argument - btrfs: record delayed inode root in transaction - kprobes: Fix possible use-after-free issue on kprobe registration - Revert "tracing/trigger: Fix to return error if failed to alloc snapshot" - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (CVE-2024-27020) - netfilter: nft_set_pipapo: do not free live element (CVE-2024-26924) - tun: limit printing rate when illegal packet received by tun dev (CVE-2024-27013) - RDMA/rxe: Fix the problem "mutex_destroy missing" - RDMA/cm: Print the old state when cm_destroy_id gets timeout - RDMA/mlx5: Fix port number for counter query in multi-port configuration - drm: nv04: Fix out of bounds access (CVE-2024-27008) - drm/panel: visionox-rm69299: don't unregister DSI device - clk: Remove prepare_lock hold assertion in __clk_release() - clk: Mark 'all_lists' as const - clk: remove extra empty line - clk: Print an info line before disabling unused clocks - clk: Initialize struct clk_core kref earlier - clk: Get runtime PM before walking tree during disable_unused (CVE-2024-27004) - [x86] cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ - [arm*] binder: check offset alignment in binder_get_object() (CVE-2024-26926) - [x86] thunderbolt: Avoid notify PM core about runtime PM resume - [x86] thunderbolt: Fix wake configurations after device unplug - [x86] comedi: vmk80xx: fix incomplete endpoint checking (CVE-2024-27001) - USB: serial: option: add Fibocom FM135-GL variants - USB: serial: option: add support for Fibocom FM650/FG650 - USB: serial: option: add Lonsung U8300/U9300 product - USB: serial: option: support Quectel EM060K sub-models - USB: serial: option: add Rolling RW101-GL and RW135-GL support - USB: serial: option: add Telit FN920C04 rmnet compositions - Revert "usb: cdc-wdm: close race between read and workqueue" - usb: dwc2: host: Fix dereference issue in DDMA completion flow. (CVE-2024-26997) - usb: Disable USB3 LPM at shutdown - mei: me: disable RPL-S on SPS and IGN firmwares - speakup: Avoid crash on very long word (CVE-2024-26994) - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993) - init/main.c: Fix potential static_command_line memory overflow (CVE-2024-26988) - drm/amdgpu: validate the parameters of bo mapping operations more clearly (CVE-2024-26922) - nouveau: fix instmem race condition around ptr stores (CVE-2024-26984) - nilfs2: fix OOB in nilfs_set_de_type (CVE-2024-26981) - wifi: iwlwifi: mvm: remove old PASN station when adding a new one - vxlan: drop packets from invalid src-address - ipv4: check for NULL idev in ip_route_use_hint() - net: usb: ax88179_178a: stop lying about skb->truesize - net: gtp: Fix Use-After-Free in gtp_dellink - ipvs: Fix checksumming on GSO of SCTP packets - net: openvswitch: Fix Use-After-Free in ovs_ct_exit - netfilter: nf_tables: honor table dormant flag from netdev release event path - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue - i40e: Report MFS in decimal base instead of hex - iavf: Fix TC config comparison with existing adapter TC config - net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets - af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). - serial: core: Provide port lock wrappers - Revert "crypto: api - Disallow identical driver names" - net/mlx5e: Fix a race in command alloc flow - tracing: Show size of requested perf buffer - tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together - PM / devfreq: Fix buffer overflow in trans_stat_show (CVE-2023-52614) - Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 - btrfs: fix information leak in btrfs_ioctl_logical_to_ino() - cpu: Re-enable CPU mitigations by default for !X86 architectures - drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 - drm/amdgpu: Fix leak when GPU memory allocation fails - irqchip/gic-v3-its: Prevent double free on error - ethernet: Add helper for assigning packet type when dest address does not match device address - net: b44: set pause params only when interface is up - stackdepot: respect __GFP_NOLOCKDEP allocation flag - mtd: diskonchip: work around ubsan link failure - tcp: Clean up kernel listener's reqsk in inet_twsk_purge() - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() - [x86] idma64: Don't try to serve interrupts when device is powered off - i2c: smbus: fix NULL function pointer dereference - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up - bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS - udp: preserve the connected status if only UDP cmsg - serial: core: fix kernel-doc for uart_port_unlock_irqrestore() [ Salvatore Bonaccorso ] * Bump ABI to 29 * [rt] Refresh "sched/vtime: Consolidate IRQ time accounting" * [rt] Update to 5.10.215-rt107 * [rt] Refresh "u64_stats: Disable preemption on 32bit-UP/SMP with RT during updates" * drivers/tty: Disable N_GSM * tipc: fix UAF in error path * tipc: fix a possible memleak in tipc_buf_append -- Salvatore Bonaccorso Fri, 03 May 2024 14:40:24 +0200 linux (5.10.209-2) bullseye; urgency=medium * netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-1086) -- Salvatore Bonaccorso Wed, 31 Jan 2024 22:14:09 +0100 linux (5.10.209-1) bullseye; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.206 - ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE - smb: client: fix OOB in smb2_query_reparse_point() - [armhf] OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init - reset: Fix crash when freeing non-existent optional resets - [s390x] vx: fix save/restore of fpu kernel context - wifi: mac80211: mesh_plink: fix matches_local logic - Revert "net/mlx5e: fix double free of encap_header" - net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() - net/mlx5: Fix fw tracer first block check - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors - net: sched: ife: fix potential use-after-free - ethernet: atheros: fix a memleak in atl1e_setup_ring_resources - net/rose: fix races in rose_kill_by_device() - net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() - afs: Fix the dynamic root's d_delete to always delete unused dentries - afs: Fix dynamic root lookup DNS check - net: warn if gso_type isn't set for a GSO SKB - net: check dev->gso_max_size in gso_features_check() - keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry - afs: Fix overwriting of result of DNS query - [armhf] i2c: aspeed: Handle the coalesced stop conditions with the start conditions. - ALSA: hda/hdmi: Add quirk to force pin connectivity on NUC10 - ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB - smb: client: fix NULL deref in asn1_ber_decoder() - btrfs: do not allow non subvolume root targets for snapshot - iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw - scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() - iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table - wifi: cfg80211: Add my certificate - wifi: cfg80211: fix certs build to not depend on file order - USB: serial: ftdi_sio: update Actisense PIDs constant names - USB: serial: option: add Quectel EG912Y module support - USB: serial: option: add Foxconn T99W265 with new baseline - USB: serial: option: add Quectel RM500Q R13 firmware support - Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent - Bluetooth: L2CAP: Send reject on command corrupted request - [x86] Input: soc_button_array - add mapping for airplane mode button - net: 9p: avoid freeing uninit memory in p9pdu_vreadf - net: rfkill: gpio: set GPIO direction - tracing / synthetic: Disable events after testing in synth_event_gen_test_init() - bus: ti-sysc: Flush posted write only after srst_udelay - lib/vsprintf: Fix %pfwf when current node refcount == 0 - [x86] alternatives: Sync core before enabling interrupts - 9p/net: fix possible memory leak in p9_check_errors() - ARM: dts: Fix occasional boot hang for am3 usb - Bluetooth: SMP: Convert BT_ERR/BT_DBG to bt_dev_err/bt_dev_dbg - Bluetooth: use inclusive language in SMP - Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE - usb: fotg210-hcd: delete an incorrect bounds test - smb: client: fix OOB in SMB2_query_info_init() - smb: client: fix OOB in smbCalcSize() (CVE-2023-6606) - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg (CVE-2023-51779) - scsi: core: Add scsi_prot_ref_tag() helper - scsi: core: Introduce scsi_get_sector() - scsi: core: Make scsi_get_lba() return the LBA - scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request - scsi: core: Use a structure member to track the SCSI command submitter - scsi: core: Always send batch on reset or error handling command - ring-buffer: Fix wake ups when buffer_percent is set to 100 - tracing: Fix blocked reader of snapshot buffer - dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() - Bluetooth: SMP: Fix crash when receiving new connection when debug is enabled https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.207 - Revert "scsi: core: Always send batch on reset or error handling command" - Revert "scsi: core: Use a structure member to track the SCSI command submitter" - Revert "scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request" - Revert "scsi: core: Make scsi_get_lba() return the LBA" - Revert "scsi: core: Introduce scsi_get_sector()" - Revert "scsi: core: Add scsi_prot_ref_tag() helper" - scsi: core: Always send batch on reset or error handling command https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.208 - keys, dns: Fix missing size check of V1 server-list header - block: Don't invalidate pagecache for invalid falloc modes - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6 - nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local - [x86] drm/i915/dp: Fix passing the correct DPCD_REV for drm_dp_set_phy_test_pattern - i40e: Fix filter input checks to prevent config with invalid values - net: sched: em_text: fix possible memory leak in em_text_destroy() - [armhf] sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init - sfc: fix a double-free bug in efx_probe_filters - [arm64] net: bcmgenet: Fix FCS generation for fragmented skbuffs - netfilter: nftables: add loop check helper function - netfilter: nft_immediate: drop chain reference counter on error - net: Save and restore msg_namelen in sock_sendmsg - i40e: fix use-after-free in i40e_aqc_add_filters() - i40e: Restore VF MSI-X state during PCI reset - net/qla3xxx: switch from 'pci_' to 'dma_' API - net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues - asix: Add check for usbnet_get_endpoints - bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters() - net: Implement missing SO_TIMESTAMPING_NEW cmsg support - mm/memory-failure: check the mapcount of the precise page - firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards - [x86] kprobes: fix incorrect return address calculation in kprobe_emulate_call_indirect - mm: fix unmap_mapping_range high bits shift bug - mmc: core: Cancel delayed work before releasing host - [powerpc*] update ppc_save_regs to save current r1 in pt_regs - net: tls, update curr on splice as well (CVE-2024-0646) - ipv6: remove max_size check inline with ipv4 (CVE-2023-52340) - drm/qxl: fix UAF on handle creation (CVE-2023-39198) - netfilter: nf_tables: Reject tables of unsupported family (CVE-2023-6040) - PCI: Extract ATS disabling to a helper function - PCI: Disable ATS for specific Intel IPU E2000 devices - Revert "nvme: use command_id instead of req->tag in trace_nvme_complete_rq()" https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.209 - f2fs: explicitly null-terminate the xattr list - ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro - debugfs: fix automount d_fsdata usage - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer - nvme-core: check for too small lba shift - [x86] ASoC: Intel: Skylake: Fix mem leak in few functions - [x86] ASoC: Intel: Skylake: mem leak in skl register function - ASoC: rt5650: add mutex to avoid the jack detection failure - nouveau/tu102: flush all pdbs on vmm flush - net/tg3: fix race condition in tg3_reset_task() - ASoC: da7219: Support low DC impedance headset - nvme: introduce helper function to get ctrl state - [armhf] drm/exynos: fix a potential error pointer dereference - [armhf] drm/exynos: fix a wrong error checking - [armhf] clk: rockchip: rk3128: Fix HCLK_OTG gate register - jbd2: correct the printing of write_flags in jbd2_write_superblock() - drm/crtc: Fix uninit-value bug in drm_mode_setcrtc - neighbour: Don't let neigh_forced_gc() disable preemption for long - jbd2: fix soft lockup in journal_finish_inode_data_buffers() - tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing - tracing: Add size check when printing trace_marker output - ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI - [arm64] reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning - Input: atkbd - skip ATKBD_CMD_GETID in translated mode - Input: i8042 - add nomux quirk for Acer P459-G2-M - [s390x] scm: fix virtual vs physical address confusion - Input: xpad - add Razer Wolverine V2 support - [arm64,armhf] i2c: rk3x: fix potential spinlock recursion on poll - ida: Fix crash in ida_free when the bitmap is empty (CVE-2023-6915) - net: qrtr: ns: Return 0 if server port is not present - [armhf] sun9i: smp: fix return code check of of_property_match_string - drm/crtc: fix uninitialized variable use - ACPI: resource: Add another DMI match for the TongFang GMxXGxx - [arm*] binder: use EPOLLERR from eventpoll.h - [arm*] binder: fix trivial typo of binder_free_buf_locked() - [arm*] binder: fix comment on binder_alloc_new_buf() return value - uio: Fix use-after-free in uio_open - parport: parport_serial: Add Brainboxes BAR details - parport: parport_serial: Add Brainboxes device IDs and geometry - PCI: Add ACS quirk for more Zhaoxin Root Ports - [x86] lib: Fix overflow when counting digits - [arm64] EDAC/thunderx: Fix possible out-of-bounds string access - [powerpc*] add crtsavres.o to always-y instead of extra-y - [powerpc*] Remove in_kernel_text() - [powerpc*] 44x: select I2C for CURRITUCK - [powerpc*] pseries/memhotplug: Quieten some DLPAR operations - [powerpc*] pseries/memhp: Fix access beyond end of drmem array - [powerpc*] powernv: Add a null pointer check to scom_debug_init_one() - [powerpc*] powernv: Add a null pointer check in opal_event_init() - [powerpc*] powernv: Add a null pointer check in opal_powercap_init() - [powerpc*] imc-pmu: Add a null pointer check in update_events_in_group() - spi: spi-zynqmp-gqspi: fix driver kconfig dependencies - ACPI: video: check for error while searching for backlight device parent - [amd64] ACPI: LPIT: Avoid u32 multiplication overflow - of: property: define of_property_read_u{8,16,32,64}_array() unconditionally - of: Add of_property_present() helper - cpufreq: Use of_property_present() for testing DT property presence - cpufreq: scmi: process the result of devm_of_clk_add_hw_provider() - net: netlabel: Fix kerneldoc warnings - netlabel: remove unused parameter in netlbl_netlink_auditinfo() - calipso: fix memory leak in netlbl_calipso_add_pass() - efivarfs: force RO when remounting if SetVariable is not supported - ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier - selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket - virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC - virtio-crypto: introduce akcipher service - virtio-crypto: implement RSA algorithm - virtio-crypto: change code style - virtio-crypto: use private buffer for control request - virtio-crypto: wait ctrl queue instead of busy polling - crypto: virtio - Handle dataq logic with tasklet - [x86] crypto: ccp - fix memleak in ccp_init_dm_workarea - crypto: af_alg - Disallow multiple in-flight AIO requests - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() - fs: indicate request originates from old mount API - Revert "gfs2: Don't reject a supposedly full bitmap if we have blocks reserved" - gfs2: Also reflect single-block allocations in rgd->rd_extfail_pt - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump - crypto: virtio - Wait for tasklet to complete on device remove - crypto: scomp - fix req->dst buffer overflow - blocklayoutdriver: Fix reference leak of pnfs_device_node - NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT - wifi: rtw88: fix RX filter in FIF_ALLMULTI flag - bpf, lpm: Fix check prefixlen before walking trie - bpf: Add crosstask check to __bpf_get_stack - wifi: ath11k: Defer on rproc_get failure - wifi: libertas: stop selecting wext - ncsi: internal.h: Fix a spello - [armhf] net/ncsi: Fix netlink major/minor version numbers - [arm64] firmware: meson_sm: populate platform devices from sm device tree data - wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior - bpf: fix check for attempt to corrupt spilled pointer - scsi: fnic: Return error if vmalloc() failed - [arm64] dts: qcom: qrb5165-rb5: correct LED panic indicator - [arm64] dts: qcom: sdm845-db845c: correct LED panic indicator - bpf: Fix verification of indirect var-off stack access - [arm64] scsi: hisi_sas: Replace with standard error code return value - virtio/vsock: fix logic which reduces credit update messages - dma-mapping: Add dma_release_coherent_memory to DMA API - dma-mapping: clear dev->dma_mem to NULL after freeing it - wifi: rtlwifi: add calculate_bit_shift() - wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() - wifi: rtlwifi: rtl8192c: using calculate_bit_shift() - wifi: rtlwifi: rtl8192cu: using calculate_bit_shift() - wifi: rtlwifi: rtl8192ce: using calculate_bit_shift() - rtlwifi: rtl8192de: make arrays static const, makes object smaller - wifi: rtlwifi: rtl8192de: using calculate_bit_shift() - wifi: rtlwifi: rtl8192ee: using calculate_bit_shift() - wifi: rtlwifi: rtl8192se: using calculate_bit_shift() - netfilter: nf_tables: mark newset as dead on transaction abort - Bluetooth: Fix bogus check for re-auth no supported with non-ssp - Bluetooth: btmtkuart: fix recv_buf() return value - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() - RDMA/usnic: Silence uninitialized symbol smatch warnings - rcu: Create an unrcu_pointer() to remove __rcu from a pointer - drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer - drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function - media: pvrusb2: fix use after free on context disconnection - drm/bridge: Fix typo in post_disable() description - f2fs: fix to avoid dirent corruption - drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() - drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() - drm/radeon: check return value of radeon_ring_lock() - [arm64] drm/msm/mdp4: flush vblank event on disable - [arm64] drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks - drm/drv: propagate errors from drm_modeset_register_all() - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() - drm/radeon/dpm: fix a memleak in sumo_parse_power_table - drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table - drm/bridge: tc358767: Fix return value on error case - media: cx231xx: fix a memleak in cx231xx_init_isoc - f2fs: fix to check compress file in f2fs_move_file_range() - f2fs: fix to update iostat correctly in f2fs_filemap_fault() - media: dvbdev: drop refcount on error path in dvb_device_open() - media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe() - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL - drm/amd/pm: fix a double-free in si_dpm_init - drivers/amd/pm: fix a use-after-free in kv_parse_power_table - gpu/drm/radeon: fix two memleaks in radeon_vm_init - dt-bindings: clock: Update the videocc resets for sm8150 - [arm64] drivers: clk: zynqmp: calculate closest mux rate - [arm64] clk: zynqmp: make bestdiv unsigned - [arm64] clk: zynqmp: Add a check for NULL pointer - [arm64] drivers: clk: zynqmp: update divider round rate logic - watchdog: set cdev owner before adding - watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO - watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling - watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused - clk: fixed-rate: add devm_clk_hw_register_fixed_rate - clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw - IB/iser: Prevent invalidating wrong MR - of: Fix double free in of_parse_phandle_with_args_map - of: unittest: Fix of_count_phandle_with_args() expected value message - keys, dns: Fix size check of V1 server-list header - [arm*] binder: fix async space check for 0-sized buffers - [arm*] binder: fix unused alloc->free_async_space - [arm*] binder: fix use-after-free in shinker's callback - Input: atkbd - use ab83 as id when skipping the getid command - dma-mapping: Fix build error unused-value - virtio-crypto: fix memory-leak - virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session() - kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list - xen-netback: don't produce zero-size SKB frags (CVE-2023-46838) - [arm*] binder: fix race between mmput() and do_exit() - tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug - [armhf] usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() - [arm64,armhf] usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart - [arm64,armhf] Revert "usb: dwc3: Soft reset phy on probe for host" - [arm64,armhf] Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only" - [arm64,armhf] usb: chipidea: wait controller resume finished for wakeup irq - Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs" - usb: typec: class: fix typec_altmode_put_partner to put plugs - usb: mon: Fix atomicity violation in mon_bin_vma_fault - [arm64,armhf] serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock - ALSA: oxygen: Fix right channel of capture volume mixer - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx - fbdev: flush deferred work in fb_deferred_io_fsync() - io_uring/rw: ensure io->bytes_done is always initialized - rootfs: Fix support for rootfstype= when root= is given - Bluetooth: Fix atomicity violation in {min,max}_key_size_set - [arm64,armhf] iommu/arm-smmu-qcom: Add missing GMU entry to match table - wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code - wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors - wifi: mwifiex: configure BSSID consistently when starting AP - [x86] kvm: Do not try to disable kvmclock if it was not enabled - [arm64] KVM: arm64: vgic-v4: Restore pending state on host userspace write - [arm64] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache - iio: adc: ad7091r: Pass iio_dev to event handler - HID: wacom: Correct behavior when processing some confidence == false touches - mfd: syscon: Fix null pointer dereference in of_syscon_register() - [mips*] dmi: Fix early remap on MIPS32 - [mips*] Fix incorrect max_low_pfn adjustment - [arm64] power: supply: cw2015: correct time_to_empty units in sysfs - libapi: Add missing linux/types.h header to get the __u64 type on io.h - acpi: property: Let args be NULL in __acpi_node_get_property_reference - software node: Let args be NULL in software_node_get_reference_args - [arm64,armhf] serial: imx: fix tx statemachine deadlock - iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify - iio: adc: ad9467: fix reset gpio handling - iio: adc: ad9467: don't ignore error codes - iio: adc: ad9467: fix scale setting - perf genelf: Set ELF program header addresses properly - tty: change tty_write_lock()'s ndelay parameter to bool - tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK - tty: don't check for signal_pending() in send_break() - tty: use 'if' in send_break() instead of 'goto' - usb: cdc-acm: return correct error code on unsupported break - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length - nvmet-tcp: fix a crash in nvmet_req_complete() - perf env: Avoid recursively taking env->bpf_progs.lock - apparmor: avoid crash when parsed profile name is empty - [arm64,armhf] serial: imx: Correct clock error message in function probe() - nvmet-tcp: Fix the H2C expected PDU len calculation - [s390x] pci: fix max size calculation in zpci_memcpy_toio() - net: phy: micrel: populate .soft_reset for KSZ9131 - netfilter: nf_tables: do not allow mismatch field size and set key length - netfilter: nf_tables: skip dead set elements in netlink dump - netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description - ipvs: avoid stat macros calls from preemptible context - kdb: Fix a potential buffer overflow in kdb_local() - ethtool: netlink: Add missing ethnl_ops_begin/complete - [armhf] i2c: s3c24xx: fix read transfers in polling mode - [armhf] i2c: s3c24xx: fix transferring more than one message in polling mode - [arm64] dts: armada-3720-turris-mox: set irq type for RTC [ Salvatore Bonaccorso ] * Bump ABI to 28 * stddef: Introduce DECLARE_FLEX_ARRAY() helper * smb3: Replace smb2pdu 1-element arrays with flex-arrays -- Salvatore Bonaccorso Wed, 31 Jan 2024 21:01:59 +0100 linux (5.10.205-2) bullseye-security; urgency=high * Revert "MIPS: Loongson64: Enable DMA noncoherent support" (fixes FTBFS) -- Salvatore Bonaccorso Sun, 31 Dec 2023 16:46:35 +0100 linux (5.10.205-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.198 - NFS: Use the correct commit info in nfs_join_page_group() - NFS/pNFS: Report EINVAL errors from connect() to the server - SUNRPC: Mark the cred for revalidation if the server rejects it - tracing: Increase trace array ref count on enable and filter files - ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones - ata: libahci: clear pending interrupt status - ext4: remove the 'group' parameter of ext4_trim_extent - ext4: add new helper interface ext4_try_to_trim_range() - ext4: scope ret locally in ext4_try_to_trim_range() - ext4: change s_last_trim_minblks type to unsigned long - ext4: mark group as trimmed only if it was fully scanned - ext4: replace the traditional ternary conditional operator with with max()/min() - ext4: move setting of trimmed bit into ext4_try_to_trim_range() - ext4: do not let fstrim block system suspend - tracing: Have event inject files inc the trace array ref count - bpf: Avoid deadlock when using queue and stack maps from NMI - i40e: Fix VF VLAN offloading when port VLAN is configured - [powerpc*] perf/hv-24x7: Update domain value check - dccp: fix dccp_v4_err()/dccp_v6_err() again - [x86] platform/x86: intel_scu_ipc: Check status after timeout in busy_loop() - [x86] platform/x86: intel_scu_ipc: Check status upon timeout in ipc_wait_for_interrupt() - [x86] platform/x86: intel_scu_ipc: Don't override scu in intel_scu_ipc_dev_simple_command() - [x86] platform/x86: intel_scu_ipc: Fail IPC send if still busy - [x86] srso: Fix srso_show_state() side effect - [x86] srso: Fix SBPB enablement for spec_rstack_overflow=off - [arm64] net: hns3: only enable unicast promisc when mac table full - [arm64] net: hns3: add 5ms delay before clear firmware reset irq source - net: bridge: use DEV_STATS_INC() - team: fix null-ptr-deref when team device type is changed - seqlock: avoid -Wshadow warnings - seqlock: Rename __seqprop() users - seqlock: Prefix internal seqcount_t-only macros with a "do_" - locking/seqlock: Do the lockdep annotation before locking in do_write_seqcount_begin_nested() - bnxt_en: Flush XDP for bnxt_poll_nitroa0()'s NAPI - net: rds: Fix possible NULL-pointer dereference - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe() - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() - Input: i8042 - rename i8042-x86ia64io.h to i8042-acpipnpio.h - Input: i8042 - add quirk for TUXEDO Gemini 17 Gen1/Clevo PD70PN - [arm64] media: venus: core: Add io base variables for each block - [arm64] media: venus: hfi,pm,firmware: Convert to block relative addressing - [arm64] media: venus: hfi: Define additional 6xx registers - [arm64] media: venus: core: Add differentiator IS_V6(core) - [arm64] media: venus: hfi: Add a 6xx boot logic - [arm64] media: venus: hfi_venus: Write to VIDC_CTRL_INIT after unmasking interrupts - netfilter: use actual socket sk for REJECT action - netfilter: nft_exthdr: Support SCTP chunks - netfilter: nf_tables: add and use nft_sk helper - netfilter: nf_tables: add and use nft_thoff helper - netfilter: nft_exthdr: break evaluation if setting TCP option fails - netfilter: exthdr: add support for tcp option removal - netfilter: nft_exthdr: Fix non-linear header modification - ata: libata: Rename link flag ATA_LFLAG_NO_DB_DELAY - ata: ahci: Add support for AMD A85 FCH (Hudson D4) - ata: ahci: Rename board_ahci_mobile - ata: ahci: Add Elkhart Lake AHCI controller - btrfs: reset destination buffer when read_extent_buffer() gets invalid range - [armhf] bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset() - [armhf] bus: ti-sysc: Fix missing AM35xx SoC matching - [armhf] ARM: dts: omap: correct indentation - [armhf] bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up - gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip - i2c: npcm7xx: Fix callback completion ordering - scsi: qedf: Add synchronization between I/O completions and abort - ring-buffer: Avoid softlockup in ring_buffer_resize() - ring-buffer: Do not attempt to read past "commit" - scsi: pm80xx: Use phy-specific SAS address when sending PHY_START command - scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset() - bpf: Clarify error expectations from bpf_clone_redirect - media: vb2: frame_vector.c: replace WARN_ONCE with a comment - [powerpc*] watchpoints: Disable preemption in thread_change_pc() - [armhf] ncsi: Propagate carrier gain/loss events to the NCSI controller - sched/cpuacct: Fix user/system in shown cpuacct.usage* - sched/cpuacct: Fix charge percpu cpuusage - sched/cpuacct: Optimize away RCU read lock - cgroup: Fix suspicious rcu_dereference_check() usage warning - ACPI: Check StorageD3Enable _DSD property in ACPI code - nvme-pci: factor the iod mempool creation into a helper - nvme-pci: factor out a nvme_pci_alloc_dev helper - nvme-pci: do not set the NUMA node of device if it has none - watchdog: iTCO_wdt: No need to stop the timer in probe - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running - netfilter: nft_exthdr: Search chunks in SCTP packets only - netfilter: nft_exthdr: Fix for unsafe packet data read - nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev - Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" - serial: 8250_port: Check IRQ data before use - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() - netfilter: nf_tables: disallow rule removal from chain binding (CVE-2023-5197) - ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES - i2c: i801: unregister tco_pdev in i801_probe() error path - Revert "SUNRPC dont update timeout value on connection reset" - proc: nommu: /proc//maps: release mmap read lock - ring-buffer: Update "shortest_full" in polling - btrfs: properly report 0 avail for very full file systems - bpf: Fix BTF_ID symbol generation collision - bpf: Fix BTF_ID symbol generation collision in tools/ - net: thunderbolt: Fix TCPv6 GSO checksum calculation - ata: libata-core: Fix ata_port_request_pm() locking - ata: libata-core: Fix port and device removal - ata: libata-core: Do not register PM operations for SAS ports - ata: libata-sata: increase PMP SRST timeout to 10s - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC - NFS: Cleanup unused rpc_clnt variable - NFS: rename nfs_client_kset to nfs_kset - NFSv4: Fix a state manager thread deadlock regression - ring-buffer: remove obsolete comment for free_buffer_page() - ring-buffer: Fix bytes info in per_cpu buffer stats - rbd: move rbd_dev_refresh() definition - rbd: decouple header read-in from updating rbd_dev->header - rbd: decouple parent info read-in from updating rbd_dev - rbd: take header_rwsem in rbd_dev_refresh() only when updating - block: fix use-after-free of q->q_usage_counter - Revert "clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz" - Revert "PCI: qcom: Disable write access to read only registers for IP v2.3.3" - scsi: zfcp: Fix a double put in zfcp_port_enqueue() - wifi: mwifiex: Fix tlv_buf_left calculation - net: replace calls to sock->ops->connect() with kernel_connect() - net: prevent rewrite of msg_name in sock_sendmsg() - [arm64] Add Cortex-A520 CPU part definition - ubi: Refuse attaching if mtd's erasesize is 0 - wifi: iwlwifi: dbg_ini: fix structure packing - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet - bpf: Fix tr dereferencing - drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() - wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling - regmap: rbtree: Fix wrong register marked as in-cache when creating new node - ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig - scsi: target: core: Fix deadlock due to recursive locking - ima: rework CONFIG_IMA dependency block - NFSv4: Fix a nfs4_state_manager() race - modpost: add missing else to the "of" check - net: fix possible store tearing in neigh_periodic_work() - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() - [arm64,armhf] net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg - net: nfc: llcp: Add lock when modifying device list - net: ethernet: ti: am65-cpsw: Fix error code in am65_cpsw_nuss_init_tx_chns() - netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp - netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure - [armhf] net: stmmac: dwmac-stm32: fix resume on STM32 MCU - tipc: fix a potential deadlock on &tx->lock - tcp: fix quick-ack counting to count actual ACKs of new data - tcp: fix delayed ACKs for MSS boundary condition - sctp: update transport state when processing a dupcook packet - sctp: update hb timer immediately after users change hb_interval - cpupower: add Makefile dependencies for install targets - dm zoned: free dmz->ddev array in dmz_put_zoned_devices - RDMA/core: Require admin capabilities to set system parameters - of: dynamic: Fix potential memory leak in of_changeset_action() - IB/mlx4: Fix the size of a buffer in add_port_entries() - [armhf] gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() - RDMA/cma: Initialize ib_sa_multicast structure to 0 when join - RDMA/cma: Fix truncation compilation warning in make_cma_ports - RDMA/uverbs: Fix typo of sizeof argument - RDMA/siw: Fix connection failure handling - RDMA/mlx5: Fix NULL string error - netfilter: nf_tables: fix kdoc warnings after gc rework - netfilter: nftables: exthdr: fix 4-byte stack OOB write - xen/events: replace evtchn_rwlock with RCU (CVE-2023-34324) https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.199 - RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent - RDMA/srp: Do not call scsi_done() from srp_abort() - RDMA/cxgb4: Check skb value for failure to allocate - [arm64] perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7 - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect - quota: Fix slow quotaoff - net: prevent address rewrite in kernel_bind() - [arm64] drm/msm/dp: do not reinitialize phy unless retry during link training - [arm64] drm/msm/dsi: skip the wait for video mode done if not applicable - [arm64] drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow - xen-netback: use default TX queue size for vifs - [x86] drm/vmwgfx: fix typo of sizeof argument - net: macsec: indicate next pn update when offloading - net: phy: mscc: macsec: reject PN update requests - ixgbe: fix crash with empty VF macvlan list - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() - nfc: nci: assert requested protocol is valid - workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() - net: add sysctl accept_ra_min_rtr_lft - net: change accept_ra_min_rtr_lft to affect all RA lifetimes - net: release reference to inet6_dev pointer - [armhf] dmaengine: stm32-mdma: abort resume if no ongoing transfer - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read - [arm64,armhf] usb: dwc3: Soft reset phy on probe for host - usb: musb: Get the musb_qh poniter after musb_giveback - usb: musb: Modify the "HWVers" register address - iio: pressure: bmp280: Fix NULL pointer exception - iio: pressure: dps310: Adjust Timeout Settings - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug - [x86] cpu: Fix AMD erratum #1485 on Zen4-based CPUs - mcb: remove is_added flag from mcb_device struct - [x86] thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding - libceph: use kernel_connect() - ceph: fix incorrect revoked caps assert in ceph_fill_file_size() - ceph: fix type promotion bug on 32bit systems - Input: powermate - fix use-after-free in powermate_config_complete - Input: psmouse - fix fast_reconnect function for PS/2 mode - Input: xpad - add PXN V900 support - Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table - Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case - tee: amdtee: fix use-after-free vulnerability in amdtee_close_session - cgroup: Remove duplicates in cgroup v1 tasks file - pinctrl: avoid unsafe code pattern in find_pinctrl() - counter: microchip-tcb-capture: Fix the use of internal GCLK logic - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call - [powerpc*] 8xx: Fix pte_access_permitted() for PAGE_NONE - [powerpc*] 64e: Fix wrong test in __ptep_test_and_clear_young() - [x86] alternatives: Disable KASAN in apply_alternatives() - [arm64] report EL1 UNDEFs better - [arm64] die(): pass 'err' as long - [arm64] consistently pass ESR_ELx to die() - [arm64] rework FPAC exception handling - [arm64] rework BTI exception handling - [arm64] allow kprobes on EL0 handlers - [arm64] split EL0/EL1 UNDEF handlers - [arm64] factor out EL1 SSBS emulation hook - [arm64] factor insn read out of call_undef_hook() - [arm64] rework EL0 MRS emulation - [arm64] armv8_deprecated: fold ops into insn_emulation - [arm64] armv8_deprecated move emulation functions - [arm64] armv8_deprecated: move aarch32 helper earlier - [arm64] armv8_deprecated: rework deprected instruction handling - [arm64] armv8_deprecated: fix unused-function error - RDMA/srp: Set scmnd->result only when scmnd is not NULL - RDMA/srp: Fix srp_abort() - ravb: Fix use-after-free issue in ravb_tx_timeout_work() (CVE-2023-35827) - dev_forward_skb: do not scrub skb mark within the same name space - lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default - mm/memory_hotplug: rate limit page migration warnings - Documentation: sysctl: align cells in second content column - usb: hub: Guard against accesses to uninitialized BOS descriptors - Bluetooth: hci_event: Ignore NULL link key - Bluetooth: Reject connection with the device which has same BD_ADDR - Bluetooth: Fix a refcnt underflow problem for hci_conn - Bluetooth: vhci: Fix race when opening vhci device - Bluetooth: hci_event: Fix coding style - Bluetooth: avoid memcmp() out of bounds warning - ice: fix over-shifted variable - ice: reset first in crash dump kernels - nfc: nci: fix possible NULL pointer dereference in send_acknowledge() - regmap: fix NULL deref on lookup - [x86] KVM: x86: Mask LVTPC when handling a PMI - [x86] sev: Disable MMIO emulation from user mode (CVE-2023-46813) - [x86] sev: Check IOBM for IOIO exceptions from user-space (CVE-2023-46813) - [x86] sev: Check for user-space IOIO pointing to kernel space (CVE-2023-46813) - tcp: check mptcp-level constraints for backlog coalescing - netfilter: nft_payload: fix wrong mac header matching - nvmet-tcp: Fix a possible UAF in queue intialization setup (CVE-2023-5178) - [x86] drm/i915: Retry gtt fault when out of fence registers - qed: fix LL2 RX buffer allocation - xfrm: fix a data-race in xfrm_gen_index() - xfrm: interface: use DEV_STATS_INC() - net: ipv4: fix return value check in esp_remove_trailer - net: ipv6: fix return value check in esp_remove_trailer - net: rfkill: gpio: prevent value glitch during probe - tcp: fix excessive TLP and RACK timeouts from HZ rounding - tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb - tun: prevent negative ifindex - ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr - net: usb: smsc95xx: Fix an error code in smsc95xx_reset() - i40e: prevent crash on probe if hw registers have invalid values - net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register() - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve - netfilter: nft_set_rbtree: .deactivate fails if element has expired - net: pktgen: Fix interface flags printing - [x86] thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge - resource: Add irqresource_disabled() - ACPI: Drop acpi_dev_irqresource_disabled() - ACPI: resources: Add DMI-based legacy IRQ override quirk - ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA - ACPI: resource: Add ASUS model S5402ZA to quirks - ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA - ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks - ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA - usb: core: Track SuperSpeed Plus GenXxY - xhci: cleanup xhci_hub_control port references - xhci: move port specific items such as state completions to port structure - xhci: rename resume_done to resume_timestamp - xhci: clear usb2 resume related variables in one place. - xhci: decouple usb2 port resume and get_port_status request handling - xhci: track port suspend state correctly in unsuccessful resume cases - serial: 8250: omap: Fix imprecise external abort for omap_8250_pm() - serial: 8250_omap: Fix errors with no_console_suspend - drm/amd/display: only check available pipe to disable vbios mode. - drm/amd/display: Don't set dpms_off for seamless boot - drm/connector: Give connector sysfs devices there own device_type - drm/connector: Add a fwnode pointer to drm_connector and register with ACPI (v2) - drm/connector: Add drm_connector_find_by_fwnode() function (v3) - drm/connector: Add support for out-of-band hotplug notification (v3) - usb: typec: altmodes/displayport: Notify drm subsys of hotplug events - usb: typec: altmodes/displayport: Signal hpd low when exiting mode - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone - btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 - btrfs: initialize start_slot in btrfs_log_prealloc_extents - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter - overlayfs: set ctime when setting mtime and atime - gpio: timberdale: Fix potential deadlock on &tgpio->lock - ata: libata-eh: Fix compilation warning in ata_eh_link_report() - tracing: relax trace_event_eval_update() execution with cond_resched() - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event - Bluetooth: Avoid redundant authentication - Bluetooth: hci_core: Fix build warnings - wifi: cfg80211: Fix 6GHz scan configuration - wifi: mac80211: allow transmitting EAPOL frames with tainted key - wifi: cfg80211: avoid leaking stack data into trace - regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" - sky2: Make sure there is at least one frag_addr available - ipv4/fib: send notify when delete source address routes - drm: panel-orientation-quirks: Add quirk for One Mix 2S - btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c - HID: multitouch: Add required quirk for Synaptics 0xcd7e device - [x86] platform/x86: touchscreen_dmi: Add info for the Positivo C4128B - net/mlx5: Handle fw tracer change ownership event based on MTRC - Bluetooth: hci_event: Fix using memcmp when comparing keys - mtd: physmap-core: Restore map_rom fallback - mmc: core: sdio: hold retuning if sdio in 1-bit mode - mmc: core: Capture correct oemid-bits for eMMC cards - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" - pNFS: Fix a hang in nfs4_evict_inode() - ACPI: irq: Fix incorrect return value in acpi_register_gsi() - nvme-pci: add BOGUS_NID for Intel 0a54 device - nvme-rdma: do not try to stop unallocated queues - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition - USB: serial: option: add entry for Sierra EM9191 with new firmware - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL - perf: Disallow mis-matched inherited group reads (CVE-2023-5717) - [s390x] pci: fix iommu bitmap allocation - [x86] platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e - [x86] platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events - Bluetooth: hci_sock: fix slab oob read in create_monitor_event - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name - xfrm6: fix inet6_dev refcount underflow problem https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.200 - virtio_balloon: Fix endless deflation and inflation on arm64 - virtio-mmio: fix memory leak of vm_dev - mm/page_alloc: correct start page when guard page debug is enabled - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() - r8169: fix the KCSAN reported data-race in rtl_tx while reading TxDescArray[entry].opts1 - r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1 - treewide: Spelling fix in comment - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry - neighbour: fix various data-races - igc: Fix ambiguity in the ethtool advertising - net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show() - net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg - r8152: Increase USB control msg timeout to 5000ms as per spec - r8152: Run the unload routine if we have errors during probe - r8152: Cancel hw_phy_work if we have an error in probe - r8152: Release firmware if we have an error in probe - tcp: fix wrong RTO timeout when received SACK reneging - gtp: uapi: fix GTPA_MAX - gtp: fix fragmentation needed check with gso - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR - [armhf] i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() - [armhf] i2c: stm32f7: Fix PEC handling in case of SMBUS transfers - [armhf] i2c: aspeed: Fix i2c bus hang in slave read - tracing/kprobes: Fix the description of variable length arguments - [arm64,armhf] nvmem: imx: correct nregs for i.MX6ULL - [arm64,armhf] nvmem: imx: correct nregs for i.MX6SLL - [arm64,armhf] nvmem: imx: correct nregs for i.MX6UL - perf/core: Fix potential NULL deref - clk: Sanitize possible_parent_show to Handle Return Value of of_clk_get_parent_name - [x86] i8259: Skip probing when ACPI/MADT advertises PCAT compatibility - kobject: Fix slab-out-of-bounds in fill_kobj_path() (CVE-2023-45863) - f2fs: fix to do sanity check on inode type during garbage collection (CVE-2021-44879) - [x86] mm: Simplify RESERVE_BRK() - [x86] mm: Fix RESERVE_BRK() for older binutils - ext4: add two helper functions extent_logical_end() and pa_logical_end() - ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow - ext4: avoid overlapping preallocations due to overflow - [x86] objtool/x86: add missing embedded_insn check - driver: platform: Add helper for safer setting of driver_override - [arm64] rpmsg: Constify local variable in field store macro - rpmsg: Fix kfree() of static memory on setting driver_override - rpmsg: Fix calling device_lock() on non-initialized device - [arm64] rpmsg: glink: Release driver_override - [arm64] rpmsg: Fix possible refcount leak in rpmsg_register_device_override() - [x86] Fix .brk attribute in linker script - net: sched: cls_u32: Fix allocation size in u32_init() - [armhf] irqchip/stm32-exti: add missing DT IRQ flag translation - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport - fbdev: atyfb: only use ioremap_uc() on i386 and ia64 - netfilter: nfnetlink_log: silence bogus compiler warning - ASoC: rt5650: fix the wrong result of key button - [x86] fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() - scsi: mpt3sas: Fix in error path - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw - [powerpc*] mm: Fix boot crash with FLATMEM - can: isotp: change error format from decimal to symbolic error names - can: isotp: add symbolic error message to isotp_module_init() - can: isotp: Add error message if txqueuelen is too small - can: isotp: set max PDU size to 64 kByte - can: isotp: isotp_bind(): return -EINVAL on incorrect CAN ID formatting - can: isotp: check CAN address family in isotp_bind() - can: isotp: handle wait_event_interruptible() return values - can: isotp: add local echo tx processing and tx without FC - can: isotp: isotp_bind(): do not validate unused address information - can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility - usb: raw-gadget: properly handle interrupted requests - tty: 8250: Remove UC-257 and UC-431 - tty: 8250: Add support for additional Brainboxes UC cards - tty: 8250: Add support for Brainboxes UP cards - tty: 8250: Add support for Intashield IS-100 - ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.201 - [x86] iov_iter, x86: Be consistent about the __user tag on copy_mc_to_user() - sched/uclamp: Ignore (util == 0) optimization in feec() when p_util_max = 0 - vfs: fix readahead(2) on block devices - [x86] srso: Fix SBPB enablement for (possible) future fixed HW - futex: Don't include process MM in futex key on no-MMU - [x86] boot: Fix incorrect startup_gdt_descr.size - pstore/platform: Add check for kstrdup - genirq/matrix: Exclude managed interrupts in irq_matrix_allocated() - i40e: fix potential memory leaks in i40e_remove() - udp: add missing WRITE_ONCE() around up->encap_rcv - tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed - overflow: Implement size_t saturating arithmetic helpers - gve: Use size_add() in call to struct_size() - tipc: Use size_add() in calls to struct_size() - wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file() - tcp_metrics: add missing barriers on delete - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() - tcp_metrics: do not create an entry from tcp_init_metrics() - wifi: rtlwifi: fix EDCA limit set by BT coexistence - can: dev: can_restart(): don't crash kernel if carrier is OK - can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on() - PM / devfreq: rockchip-dfi: Make pmu regmap mandatory - thermal: core: prevent potential string overflow - r8169: use tp_to_dev instead of open code - r8169: fix rare issue with broken rx after link-down on RTL8125 - tcp: fix cookie_init_timestamp() overflows - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() - ipv6: avoid atomic fragment on GSO packets - net: add DEV_STATS_READ() helper - ipvlan: properly track tx_errors - regmap: debugfs: Fix a erroneous check after snprintf() - [arm64] clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies - [arm64] clk: qcom: mmcc-msm8998: Add hardware clockgating registers to some clks - [arm64] clk: qcom: mmcc-msm8998: Don't check halt bit on some branch clks - [arm64] clk: qcom: mmcc-msm8998: Set bimc_smmu_gdsc always on - [arm64] clk: qcom: mmcc-msm8998: Fix the SMMU GDSC - [arm64] clk: qcom: gcc-sm8150: use ARRAY_SIZE instead of specifying num_parents - [arm64] clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src - [arm64] clk: imx: imx8mq: correct error handling path - clk: asm9260: use parent index to link the reference clock - clk: linux/clk-provider.h: fix kernel-doc warnings and typos - [arm64] spi: nxp-fspi: use the correct ioremap function - [armhf] clk: ti: Add ti_dt_clk_name() helper to use clock-output-names - [armhf] clk: ti: Update pll and clockdomain clocks to use ti_dt_clk_name() - [armhf] clk: ti: Update component clocks to use ti_dt_clk_name() - [armhf] clk: ti: change ti_clk_register[_omap_hw]() API - [armhf] clk: ti: fix double free in of_ti_divider_clk_setup() - [x86] platform/x86: wmi: Fix probe failure when failing to register WMI devices - [x86] platform/x86: wmi: remove unnecessary initializations - [x86] platform/x86: wmi: Fix opening of char device - hwmon: (coretemp) Fix potentially truncated sysfs attribute name - [arm64,armhf] drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs - [arm64,armhf] drm/rockchip: vop: Fix call to crtc reset helper - drm/radeon: possible buffer overflow - [arm64] drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe() - [arm64,armhf] drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map() - xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled - [arm64] dts: qcom: msm8916: Fix iommu local address range - [arm64] dts: qcom: sdm845-mtp: fix WiFi configuration - [i386] hwrng: geode - fix accessing registers - libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value - nd_btt: Make BTT lanes preemptible - [arm64] crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure - [arm64] crypto: caam/jr - fix Chacha20 + Poly1305 self test failure - [x86] crypto: qat - mask device capabilities with soft straps - [x86] crypto: qat - increase size of buffers - hid: cp2112: Fix duplicate workqueue initialization - [armel,armhf] 9321/1: memset: cast the constant byte to unsigned char - ext4: move 'ix' sanity check to corrent position - IB/mlx5: Fix rdma counter binding for RAW QP - [arm64] RDMA/hns: Fix uninitialized ucmd in hns_roce_create_qp_common() - [arm64] RDMA/hns: Fix signed-unsigned mixed comparisons - scsi: ufs: core: Leave space for '\0' in utf8 desc string - [amd64] RDMA/hfi1: Workaround truncation compilation error - hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip - Revert "HID: logitech-hidpp: add a module parameter to keep firmware gestures" - HID: logitech-hidpp: Remove HIDPP_QUIRK_NO_HIDINPUT quirk - HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only - HID: logitech-hidpp: Revert "Don't restart communication if not necessary" - HID: logitech-hidpp: Move get_wireless_feature_index() check to hidpp_connect_event() - [x86] ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails - padata: Convert from atomic_t to refcount_t on parallel_data->refcnt - padata: Fix refcnt handling in padata_free_shell() - mfd: core: Un-constify mfd_cell.of_reg - mfd: core: Ensure disabled devices are skipped without aborting - mfd: dln2: Fix double put in dln2_probe - leds: pwm: Don't disable the PWM when the LED should be off - leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu' - tty: tty_jobctrl: fix pid memleak in disassociate_ctty() - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency - dmaengine: ti: edma: handle irq_of_parse_and_map() errors - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() - USB: usbip: fix stub_dev hub disconnect - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() - f2fs: fix to initialize map.m_pblk in f2fs_precache_extents() - modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host - [powerpc*] 40x: Remove stale PTE_ATOMIC_UPDATES macro - [powerpc*] xive: Fix endian conversion size - [powerpc*] imc-pmu: Use the correct spinlock initializer. - [powerpc*] pseries: fix potential memory leak in init_cpu_associativity() - xhci: Loosen RPM as default policy to cover for AMD xHC 1.1 - usb: host: xhci-plat: fix possible kernel oops while resuming - perf machine: Avoid out of bounds LBR memory read - perf hist: Add missing puts to hist__account_cycles - i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs - rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call - pcmcia: cs: fix possible hung task and memory leak pccardd() - pcmcia: ds: fix refcount leak in pcmcia_device_add() - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() - media: i2c: max9286: Fix some redundant of_node_put() calls - media: bttv: fix use after free error due to btv->timeout timer - media: s3c-camif: Avoid inappropriate kfree() - media: vidtv: psi: Add check for kstrdup - media: vidtv: mux: Add check and kfree for kstrdup - media: cedrus: Fix clock/reset sequence - media: dvb-usb-v2: af9035: fix missing unlock - regmap: prevent noinc writes from clobbering cache - pwm: sti: Avoid conditional gotos - pwm: sti: Reduce number of allocations and drop usage of chip_data - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() - llc: verify mac len before reading mac header - hsr: Prevent use after free in prp_create_tagged_frame() - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING - inet: shrink struct flowi_common - dccp: Call security_inet_conn_request() after setting IPv4 addresses. - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. - net: r8169: Disable multicast filter for RTL8168H and RTL8107E - Fix termination state for idr_for_each_entry_ul() - net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs - net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT - net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc - net/smc: put sk reference if close work was canceled - tg3: power down device only on SYSTEM_POWER_OFF - r8169: respect userspace disabling IFF_MULTICAST - netfilter: xt_recent: fix (increase) ipv6 literal buffer length - netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate eval call-backs - netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses - [x86] Share definition of __is_canonical_address() - [x86] sev-es: Allow copy_from_kernel_nofault() in earlier boot - drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE - fbdev: imsttfb: Fix error path of imsttfb_probe() - fbdev: imsttfb: fix a resource leak in probe - fbdev: fsl-diu-fb: mark wr_reg_wa() static - tracing/kprobes: Fix the order of argument descriptions - Revert "mmc: core: Capture correct oemid-bits for eMMC cards" - btrfs: use u64 for buffer sizes in the tree search ioctls https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.202 - perf/core: Bail out early if the request AUX area is out of bound - [armhf] clocksource/drivers/timer-imx-gpt: Fix potential memory leak - [x86] mm: Drop the 4 MB restriction on minimal NUMA node memory size - wifi: mac80211_hwsim: fix clang-specific fortify warning - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() - bpf: Detect IP == ksym.end as part of BPF program - wifi: ath9k: fix clang-specific fortify warnings - wifi: ath10k: fix clang-specific fortify warning - net: annotate data-races around sk->sk_tx_queue_mapping - net: annotate data-races around sk->sk_dst_pending_confirm - wifi: ath10k: Don't touch the CE interrupt registers after power up - Bluetooth: btusb: Add date->evt_skb is NULL check - Bluetooth: Fix double free in hci_conn_cleanup - [x86] platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e - [arm64] drm/msm/dp: skip validity check for DP CTS EDID checksum - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga - drm/amdgpu: Fix potential null pointer derefernce - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL - ASoC: soc-card: Add storage for PCI SSID - crypto: pcrypt - Fix hungtask for PADATA_RESET - [amd64] RDMA/hfi1: Use FIELD_GET() to extract Link Width - fs/jfs: Add check for negative db_l2nbperpage - fs/jfs: Add validity check for db_maxag and db_agpref - jfs: fix array-index-out-of-bounds in dbFindLeaf - jfs: fix array-index-out-of-bounds in diAlloc - HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround - [armel,armhf] 9320/1: fix stack depot IRQ stack filter - ALSA: hda: Fix possible null-ptr-deref when assigning a stream - atm: iphase: Do PCI error checks on own line - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() - HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W - exfat: support handle zero-size directory - usb: gadget: f_ncm: Always set current gadget in ncm_bind() - 9p/trans_fd: Annotate data-racy writes to file::f_flags - [armhf] i2c: sun6i-p2wi: Prevent potential division by zero - media: gspca: cpia1: shift-out-of-bounds in set_flicker - media: vivid: avoid integer overflow - gfs2: ignore negated quota changes - gfs2: fix an oops in gfs2_permission - media: imon: fix access to invalid resource for the second interface - drm/amd/display: Avoid NULL dereference of timing generator - [armhf] ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings - drm/amdgpu: fix software pci_unplug on some chips - pwm: Fix double shift bug - wifi: iwlwifi: Use FW rate for non-data frames - xhci: turn cancelled td cleanup to its own function - SUNRPC: ECONNRESET might require a rebind - SUNRPC: Add an IS_ERR() check back to where it was - NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries - gfs2: Silence "suspicious RCU usage in gfs2_permission" warning - ipvlan: add ipvlan_route_v6_outbound() helper - tty: Fix uninit-value access in ppp_sync_receive() - [arm64] net: hns3: fix variable may not initialized problem in hns3_init_mac_addr() - [arm64] net: hns3: fix VF reset fail issue - tipc: Fix kernel-infoleak due to uninitialized TLV value - ppp: limit MRU to 64K - xen/events: fix delayed eoi list handling - ptp: annotate data-race around q->head and q->tail - bonding: stop the device in bond_setup_by_slave() - netfilter: nf_conntrack_bridge: initialize err to 0 - net: stmmac: fix rx budget limit check - net/mlx5e: fix double free of encap_header - net/mlx5_core: Clean driver version and name - net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors - macvlan: Don't propagate promisc change to lower dev in passthru - cifs: spnego: add ';' in HOST_KEY_LEN - cifs: fix check of rc in function generate_smb3signingkey - [arm64] media: venus: hfi: add checks to perform sanity on queue pointers - [powerpc*] perf: Fix disabling BHRB and instruction sampling - bpf: Fix check_stack_write_fixed_off() to correctly spill imm - bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END - scsi: mpt3sas: Fix loop logic - scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers - [x86] cpu/hygon: Fix the CPU topology evaluation for real - [x86] KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space - [x86] KVM: x86: Ignore MSR_AMD64_TW_CFG access - audit: don't take task_lock() in audit_exe_compare() code path - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() - tty/sysrq: replace smp_processor_id() with get_cpu() - hvc/xen: fix console unplug - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver - PCI/sysfs: Protect driver's D3cold preference from user space - watchdog: move softlockup_panic back to early_param - ACPI: resource: Do IRQ override on TongFang GMxXGxx - [arm64] Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer - mmc: vub300: fix an error code - mmc: sdhci_am654: fix start loop index for TAP value parsing - PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common() - [arm64] dts: qcom: ipq6018: Fix hwlock index for SMEM - PM: hibernate: Use __get_safe_page() rather than touching the list - PM: hibernate: Clean up sync_read handling in snapshot_write_next() - rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects - btrfs: don't arbitrarily slow down delalloc if we're committing - [arm64] firmware: qcom_scm: use 64-bit calling convention only when client is 64-bit - ima: detect changes to the backing overlay file - wifi: ath11k: fix temperature event locking - wifi: ath11k: fix dfs radar event locking - wifi: ath11k: fix htt pktlog locking - mmc: meson-gx: Remove setting of CMD_CFG_ERROR - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware - jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev - quota: explicitly forbid quota files from being encrypted - kernel/reboot: emergency_restart: Set correct system_state - i2c: core: Run atomic i2c xfer when !preemptible - mcb: fix error handling for different scenarios when parsing - [armhf] dmaengine: stm32-mdma: correct desc prep when channel running - mm/cma: use nth_page() in place of direct struct page manipulation - mm/memory_hotplug: use pfn math in place of direct struct page manipulation - mtd: cfi_cmdset_0001: Byte swap OTP info - xhci: Enable RPM on controllers that support low-power states - ALSA: info: Fix potential deadlock at disconnection - ALSA: hda/realtek - Add Dell ALC295 to pin fall back table - ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC - serial: meson: remove redundant initialization of variable id - tty: serial: meson: retrieve port FIFO size from DT - serial: meson: Use platform_get_irq() to get the interrupt - tty: serial: meson: fix hard LOCKUP on crtscts mode - cpufreq: stats: Fix buffer overflow detection in trans_stats() - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559 - bluetooth: Add device 0bda:887b to device tables - bluetooth: Add device 13d3:3571 to device tables - Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables - Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE - Revert ncsi: Propagate carrier gain/loss events to the NCSI controller - lsm: fix default return value for vm_enough_memory - lsm: fix default return value for inode_getsecctx - i2c: designware: Disable TX_EMPTY irq while waiting for block length byte - net: phylink: initialize carrier state at creation - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte - f2fs: avoid format-overflow warning - media: lirc: drop trailing space from scancode transmit - media: sharp: fix sharp encoding - [arm64] media: venus: hfi_parser: Add check to keep the number of codecs within range - [arm64] media: venus: hfi: fix the check to handle session buffer requirement - [arm64] media: venus: hfi: add checks to handle capabilities from firmware - nfsd: fix file memleak on client_opens_release - mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors - Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E" - ext4: apply umask if ACL support is disabled - ext4: correct offset of gdb backup in non meta_bg group to update_backups - ext4: correct return value of ext4_convert_meta_bg - ext4: correct the start block of counting reserved clusters - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks - drm/amd/pm: Handle non-terminated overdrive commands. - drm/amdgpu: fix error handling in amdgpu_bo_list_get() - drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox - io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid (CVE-2023-46862) - tracing: Have trace_event_file have ref counters - netfilter: nftables: update table flags from the commit phase - netfilter: nf_tables: fix table flag updates - netfilter: nf_tables: disable toggling dormant table state more than once https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.203 - RDMA/irdma: Prevent zero-length STAG registration (CVE-2023-25775) - afs: Fix afs_server_list to be cleaned up with RCU - afs: Make error on cell lookup failure consistent with OpenAFS - [arm64,armhf] drm/panel: simple: Fix Innolux G101ICE-L01 bus flags - [arm64,armhf] drm/panel: simple: Fix Innolux G101ICE-L01 timings - wireguard: use DEV_STATS_INC() - ata: pata_isapnp: Add missing error check for devm_ioport_map() - [arm64,armhf] drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full - HID: core: store the unique system identifier in hid_device - HID: fix HID device resource race between HID core and debugging support - ipv4: Correct/silence an endian warning in __ip_do_redirect - net: usb: ax88179_178a: fix failed operations during ax88179_reset - net/smc: avoid data corruption caused by decline - [armhf] xen: fix xen_vcpu_info allocation alignment - [amd64,arm64] amd-xgbe: handle corner-case during sfp hotplug - [amd64,arm64] amd-xgbe: handle the corner-case during tx completion - [amd64,arm64] amd-xgbe: propagate the correct speed and duplex status - afs: Return ENOENT if no cell DNS record can be found - afs: Fix file locking on R/O volumes to operate in local mode - nvmet: remove unnecessary ctrl parameter - nvmet: nul-terminate the NQNs passed in the connect command (CVE-2023-6121) - [arm64] USB: dwc3: qcom: fix resource leaks on probe deferral - [arm64] USB: dwc3: qcom: fix ACPI platform device leak - lockdep: Fix block chain corruption - ext4: add a new helper to check if es must be kept - ext4: factor out __es_alloc_extent() and __es_free_extent() - ext4: use pre-allocated es in __es_insert_extent() - ext4: use pre-allocated es in __es_remove_extent() - ext4: using nofail preallocation in ext4_es_remove_extent() - ext4: using nofail preallocation in ext4_es_insert_delayed_block() - ext4: using nofail preallocation in ext4_es_insert_extent() - ext4: fix slab-use-after-free in ext4_es_insert_extent() - ext4: make sure allocate pending entry not fail - nfsd: lock_rename() needs both directories to live on the same fs - [arm*] ASoC: simple-card: fixup asoc_simple_probe() error handling - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA - swiotlb-xen: provide the "max_mapping_size" method - bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() - bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race - [s390x] dasd: protect device queue against concurrent access - USB: serial: option: add Luat Air72*U series products - [x86] hv_netvsc: Fix race of register_netdevice_notifier and VF register - [x86] hv_netvsc: Mark VF as slave before exposing it to user-mode - dm-delay: fix a race between delay_presuspend and delay_bio - bcache: check return value from btree_node_alloc_replacement() - bcache: prevent potential division by zero error - bcache: fixup init dirty data errors - bcache: fixup lock c->root error - USB: serial: option: add Fibocom L7xx modules - USB: serial: option: fix FM101R-GL defines - USB: serial: option: don't claim interface 4 for ZTE MF290 - [arm*] USB: dwc2: write HCINT with INTMASK applied - [arm64,armhf] usb: dwc3: Fix default mode initialization - [arm64,armhf] usb: dwc3: set the dma max_seg_size - [arm64,armhf] USB: dwc3: qcom: fix wakeup after probe deferral - io_uring: fix off-by one bvec index - pinctrl: avoid reload of p state in list iteration - firewire: core: fix possible memory leak in create_units() - mmc: block: Do not lose cache flush during CQE error recovery - ALSA: hda: Disable power-save on KONTRON SinglePC - ALSA: hda/realtek: Headset Mic VREF to 100% - ALSA: hda/realtek: Add supported ALC257 for ChromeOS - dm-verity: align struct dm_verity_fec_io properly - dm verity: don't perform FEC for failed readahead IO - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR - [amd64] iommu/vt-d: Add MTL to quirk list to skip TE disabling - [powerpc*] Don't clobber f0/vs0 during fp|altivec register save (Closes: #1032104) - btrfs: add dmesg output for first mount and last unmount of a filesystem - btrfs: ref-verify: fix memory leaks in btrfs_ref_tree_mod() - btrfs: fix off-by-one when checking chunk map includes logical address - btrfs: send: ensure send_fd is writable - btrfs: make error messages more clear when getting a chunk map - Input: xpad - add HyperX Clutch Gladiate Support - [x86] hv_netvsc: fix race of netvsc and VF register_netdevice - USB: core: Change configuration warnings to notices - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (CVE-2023-6932) - [arm64] dpaa2-eth: increase the needed headroom to account for alignment - net: stmmac: xgmac: Disable FPE MMC interrupts - Revert "workqueue: remove unused cancel_work()" - r8169: prevent potential deadlock in rtl8169_close - smb3: fix touch -h of symlink - [x86] ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header - [x86] ASoC: SOF: sof-pci-dev: use community key on all Up boards - [x86] ASoC: SOF: sof-pci-dev: add parameter to override topology filename - [x86] ASoC: SOF: sof-pci-dev: don't use the community key on APL Chromebooks - [x86] ASoC: SOF: sof-pci-dev: Fix community key quirk detection - [s390x] mm: fix phys vs virt confusion in mark_kernel_pXd() functions family - [s390x] cmma: fix detection of DAT pages - ima: annotate iint mutex to avoid lockdep false positive warnings - driver core: Move the "removable" attribute from USB to core - drm/amdgpu: don't use ATRM for external devices - fs: add ctime accessors infrastructure - smb3: fix caching of ctime on setxattr - scsi: core: Introduce the scsi_cmd_to_rq() function - scsi: qla2xxx: Use scsi_cmd_to_rq() instead of scsi_cmnd.request - scsi: qla2xxx: Fix system crash due to bad pointer access - [armhf] cpufreq: imx6q: don't warn for disabling a non-existing frequency - [armhf] cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily - mmc: cqhci: Increase recovery halt timeout - mmc: cqhci: Warn of halt or task clear failure - mmc: cqhci: Fix task clearing in CQE error recovery - mmc: core: convert comma to semicolon - mmc: block: Retry commands in CQE error recovery - mmc: core: add helpers mmc_regulator_enable/disable_vqmmc - r8169: disable ASPM in case of tx timeout - r8169: fix deadlock on RTL8125 in jumbo mtu mode - driver core: Release all resources during unbind before updating device links https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.204 - hrtimers: Push pending hrtimers away from outgoing CPU earlier - i2c: designware: Fix corrupted memory seen in the ISR - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test - tg3: Move the [rt]x_dropped counters to tg3_napi - tg3: Increment tx_dropped in tg3_tso_bug() - kconfig: fix memory leak from range properties - drm/amdgpu: correct chunk_ptr to a pointer to chunk. - [x86] platform/x86: asus-wmi: Add support for SW_TABLET_MODE on UX360 - [x86] platform/x86: asus-nb-wmi: Allow configuring SW_TABLET_MODE method with a module option - [x86] platform/x86: asus-nb-wmi: Add tablet_mode_sw=lid-flip quirk for the TP200s - [x86] asus-wmi: Add dgpu disable method - [x86] platform/x86: asus-wmi: Adjust tablet/lidflip handling to use enum - [x86] platform/x86: asus-wmi: Add support for ROG X13 tablet mode - [x86] platform/x86: asus-wmi: Simplify tablet-mode-switch probing - [x86] platform/x86: asus-wmi: Simplify tablet-mode-switch handling - [x86] platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code - of: base: Fix some formatting issues and provide missing descriptions - of: Fix kerneldoc output formatting - of: Add missing 'Return' section in kerneldoc comments - of: dynamic: Fix of_reconfig_get_state_change() return value documentation - ipv6: fix potential NULL deref in fib6_add() - hv_netvsc: rndis_filter needs to select NLS - net: arcnet: com20020 fix error handling - arcnet: restoring support for multiple Sohard Arcnet cards - i40e: Fix unexpected MFS warning message - net: bnxt: fix a potential use-after-free in bnxt_init_tc - ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit() - [arm64] net: hns: fix fake link up on xge port - netfilter: xt_owner: Fix for unsafe access of sk->sk_socket - tcp: do not accept ACK of bytes we never sent - bpf: sockmap, updating the sg structure should also update curr - [arm64] tee: optee: Fix supplicant based device enumeration - RDMA/bnxt_re: Correct module description string - [x86] hwmon: (acpi_power_meter) Fix 4.29 MW bug - tracing: Fix a warning when allocating buffered events fails - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() - [armhf] imx: Check return value of devm_kasprintf in imx_mmdc_perf_init - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names - ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5 - nilfs2: fix missing error check for sb_set_blocksize call - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() - checkstack: fix printed address - tracing: Always update snapshot buffer size - tracing: Disable snapshot buffer when stopping instance tracers - tracing: Fix incomplete locking when disabling buffered events - tracing: Fix a possible race when disabling buffered events - packet: Move reference count in packet_sock to atomic_long_t - [x86] misc: mei: client.c: return negative error code in mei_cl_write - [x86] misc: mei: client.c: fix problem of return '-EOVERFLOW' in mei_cl_write - ring-buffer: Force absolute timestamp on discard of event - tracing: Set actual size after ring buffer resize - tracing: Stop current tracer when resizing buffer - perf/core: Add a new read format to get a number of lost samples - perf: Fix perf_event_validate_size() (CVE-2023-6931) - gpiolib: sysfs: Fix error handling on failed export - drm/amdgpu: correct the amdgpu runtime dereference usage count - usb: gadget: f_hid: fix report descriptor allocation - parport: Add support for Brainboxes IX/UC/PX parallel cards - Revert "xhci: Loosen RPM as default policy to cover for AMD xHC 1.1" - usb: typec: class: fix typec_altmode_put_partner to put plugs - [arm*] PL011: Fix DMA support - [x86] CPU/AMD: Check vendor in the AMD microcode callback - [s390x] KVM: s390/mm: Properly reset no-dat - [mips*] Loongson64: Reserve vgabios memory on boot - [mips*] Loongson64: Enable DMA noncoherent support - io_uring/af_unix: disable sending io_uring over sockets (CVE-2023-6531) - netlink: don't call ->netlink_bind with table lock held - genetlink: add CAP_NET_ADMIN test for multicast bind - psample: Require 'CAP_NET_ADMIN' when joining "packets" group - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group - netfilter: nft_set_pipapo: skip inactive elements during set walk (CVE-2023-6817) - [x86] platform/x86: asus-wmi: Fix kbd_dock_devid tablet-switch reporting - [x86] platform/x86: asus-wmi: Document the dgpu_disable sysfs attribute - mmc: block: Be sure to wait while busy in CQE error recovery - Revert "btrfs: add dmesg output for first mount and last unmount of a filesystem" - cifs: Fix non-availability of dedup breaking generic/304 - smb: client: fix potential NULL deref in parse_dfs_referrals() - devcoredump : Serialize devcd_del work - devcoredump: Send uevent once devcd is ready - r8169: fix rtl8125b PAUSE frames blasting when suspended https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.205 - netfilter: nf_tables: fix 'exist' matching on bigendian arches - afs: Fix refcount underflow from error handling race (Closes: #1052304) - HID: lenovo: Restrict detection of patched firmware only to USB cptkbd - net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX - atm: solos-pci: Fix potential deadlock on &cli_queue_lock - atm: solos-pci: Fix potential deadlock on &tx_queue_lock - net: vlan: introduce skb_vlan_eth_hdr() - net: fec: correct queue selection - atm: Fix Use-After-Free in do_vcc_ioctl (CVE-2023-51780) - net/rose: Fix Use-After-Free in rose_ioctl (CVE-2023-51782) - qed: Fix a potential use-after-free in qed_cxt_tables_alloc - net: Remove acked SYN flag from packet in the transmit queue correctly - net: ena: Destroy correct number of xdp queues upon failure - net: ena: Fix XDP redirection error - sign-file: Fix incorrect return values check - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() - net: stmmac: use dev_err_probe() for reporting mdio bus registration failure - net: stmmac: Handle disabled MDIO busses from devicetree - appletalk: Fix Use-After-Free in atalk_ioctl (CVE-2023-51781) - net: atlantic: fix double free in ring reinit logic - cred: switch to using atomic_long_t - fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() - ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants - ALSA: hda/realtek: Apply mute LED quirk for HP15-db - Revert "PCI: acpiphp: Reassign resources on bridge if necessary" - PCI: loongson: Limit MRRS to 256 (Closes: #1035587) - usb: aqc111: check packet for fixup for true limit - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" - bcache: avoid oversize memory allocation by small stripe_size - bcache: remove redundant assignment to variable cur_idx - bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() - bcache: avoid NULL checking to c->root in run_cache_set() - [x86] platform/x86: intel_telemetry: Fix kernel doc descriptions - HID: glorious: fix Glorious Model I HID report - HID: add ALWAYS_POLL quirk for Apple kb - HID: hid-asus: reset the backlight brightness level on resume - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation - net: usb: qmi_wwan: claim interface 4 for ZTE MF290 - HID: hid-asus: add const to read-only outgoing usb buffer - perf: Fix perf_event_validate_size() lockdep splat - soundwire: stream: fix NULL pointer dereference for multi_link - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS - [arm64] mm: Always make sw-dirty PTEs hw-dirty in pte_modify - team: Fix use-after-free when an option instance allocation fails - ring-buffer: Fix memory leak of free page - tracing: Update snapshot buffer on resize if it is allocated - ring-buffer: Have saved event hold the entire event - ring-buffer: Fix writing to the buffer with max_data_size - ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs - USB: gadget: core: adjust uevent timing on gadget unbind - tty: n_gsm: fix tty registration before control channel open - tty: n_gsm, remove duplicates of parameters - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() - [powerpc*] ftrace: Create a dummy stackframe to fix stack unwind - [powerpc*] ftrace: Fix stack teardown in ftrace_no_trace [ Salvatore Bonaccorso ] * Bump ABI to 27 * [rt] Refresh "net: Properly annotate the try-lock for the seqlock" Adapt to changes from upstream a8dd21118b0f ("seqlock: Prefix internal seqcount_t-only macros with a "do_"") in 5.10.198. * Refresh "arm64: compat: Implement misalignment fixups for multiword loads" * Do not enable DEBUG_PREEMPT (not enabled by default since 5.10.199) * [rt] Update to 5.10.201-rt98 * [rt] Update to 5.10.204-rt100 * [arm64] drivers/vfio: Don't enable VFIO_NOIOMMU. This is a breach of the integrity lockdown requirement of secure boot and thus cannot be enabled. Thanks to Bastian Blank and Ben Hutchings * netfilter: nf_tables: skip set commit for deleted/destroyed sets -- Salvatore Bonaccorso Sat, 30 Dec 2023 10:41:34 +0100 linux (5.10.197-1) bullseye; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.192 - [arm64] mmc: sdhci-f-sdh30: Replace with sdhci_pltfm - macsec: Fix traffic counters/statistics - macsec: use DEV_STATS_INC() - net/mlx5: Refactor init clock function - net/mlx5: Move all internal timer metadata into a dedicated struct - net/mlx5: Skip clock update work when device is in error state - drm/radeon: Fix integer overflow in radeon_cs_parser_init - ALSA: emu10k1: roll up loops in DSP setup code for Audigy - [x86] ASoC: Intel: sof_sdw: add quirk for MTL RVP - [x86] ASoC: Intel: sof_sdw: add quirk for LNL RVP - [armhf] dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings - [x86] ASoC: Intel: sof_sdw: Add support for Rex soundwire - iopoll: Call cpu_relax() in busy loops - quota: Properly disable quotas when add_dquot_ref() fails - quota: fix warning in dqgrab() - dma-remap: use kvmalloc_array/kvfree for larger dma memory remap - drm/amdgpu: install stub fence into potential unused fence pointers - HID: add quirk for 03f0:464a HP Elite Presenter Mouse - RDMA/mlx5: Return the firmware result upon destroying QP/RQ - ovl: check type and offset of struct vfsmount in ovl_entry - udf: Fix uninitialized array access for some pathnames - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev - FS: JFS: Fix null-ptr-deref Read in txBegin - FS: JFS: Check for read-only mounted filesystem in txBegin - media: v4l2-mem2mem: add lock to protect parameter num_rdy - usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push - [arm64,armhf] usb: chipidea: imx: don't request QoS for imx8ulp - [arm64,armhf] usb: chipidea: imx: add missing USB PHY DPDM wakeup setting - gfs2: Fix possible data races in gfs2_show_options() - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() - Bluetooth: L2CAP: Fix use-after-free - Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally - drm/amdgpu: Fix potential fence use-after-free v2 - ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 - ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() - ring-buffer: Do not swap cpu_buffer during resize process - bus: mhi: Add MHI PCI support for WWAN modems - bus: mhi: Add MMIO region length to controller structure - bus: mhi: Move host MHI code to "host" directory - bus: mhi: host: Range check CHDBOFF and ERDBOFF - [mips*] irqchip/mips-gic: Get rid of the reliance on irq_cpu_online() - [mips*] irqchip/mips-gic: Use raw spinlock for gic_lock - usb: gadget: udc: core: Introduce check_config to verify USB configuration - usb: cdns3: allocate TX FIFO size according to composite EP number - usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM - [arm64] USB: dwc3: qcom: fix NULL-deref on suspend - [arm*] mmc: bcm2835: fix deferred probing - [arm64,armhf] mmc: sunxi: fix deferred probing - mmc: core: add devm_mmc_alloc_host - [arm64] mmc: meson-gx: use devm_mmc_alloc_host - [arm64] mmc: meson-gx: fix deferred probing - tracing/probes: Have process_fetch_insn() take a void * instead of pt_regs - tracing/probes: Fix to update dynamic data counter if fetcharg uses it - virtio-mmio: Use to_virtio_mmio_device() to simply code - virtio-mmio: don't break lifecycle of vm_dev - i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue - fbdev: mmp: fix value check in mmphw_probe() - [powerpc*] rtas_flash: allow user copy to flash block cache objects - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux - tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms - btrfs: fix BUG_ON condition in btrfs_cancel_balance - i2c: designware: Handle invalid SMBus block data response length value - net: xfrm: Fix xfrm_address_filter OOB read - net: af_key: fix sadb_x_filter validation - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure - xfrm: fix slab-use-after-free in decode_session6 - ip6_vti: fix slab-use-after-free in decode_session6 - ip_vti: fix potential slab-use-after-free in decode_session6 - xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-3772) - xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH (CVE-2023-3773) - selftests: mirror_gre_changes: Tighten up the TTL test match - ipvs: fix racy memcpy in proc_do_sync_threshold - netfilter: nft_dynset: disallow object maps - net: phy: broadcom: stub c45 read/write for 54810 - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves - i40e: fix misleading debug logs - net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset - sock: Fix misuse of sk_under_memory_pressure() - net: do not allow gso_size to be set to GSO_BY_FRAGS - bus: ti-sysc: Flush posted write on enable before reset - ALSA: hda/realtek - Remodified 3k pull low procedure - serial: 8250: Fix oops for port->pm on uart_change_pm() - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. - cifs: Release folio lock on fscache read hit. - mmc: wbsd: fix double mmc_free_host() in wbsd_init() - mmc: block: Fix in_flight[issue_type] value error - netfilter: set default timeout to 3 secs for sctp shutdown send and recv state - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-4622) - virtio-net: set queues after driver_ok - net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled - [arm64] mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove - [x86] cpu: Fix __x86_return_thunk symbol type - [x86] cpu: Fix up srso_safe_ret() and __x86_return_thunk() - [x86] alternative: Make custom return thunk unconditional - objtool: Add frame-pointer-specific function ignore - [x86] ibt: Add ANNOTATE_NOENDBR - [x86] cpu: Clean up SRSO return thunk mess - [x86] cpu: Rename original retbleed methods - [x86] cpu: Rename srso_(.*)_alias to srso_alias_\1 - [x86] cpu: Cleanup the untrain mess - [x86] srso: Explain the untraining sequences a bit more - [x86] static_call: Fix __static_call_fixup() - [x86] retpoline: Don't clobber RFLAGS during srso_safe_ret() - [x86] CPU/AMD: Fix the DIV(0) initial fix attempt (CVE-2023-20588) - [x86] srso: Disable the mitigation on unaffected configurations - [x86] retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG - [x86] objtool/x86: Fixup frame-pointer vs rethunk - [x86] srso: Correct the mitigation status when SMT is disabled https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.193 - [x86] objtool/x86: Fix SRSO mess - NFSv4: fix out path in __nfs4_get_acl_uncached - xprtrdma: Remap Receive buffers after a reconnect - PCI: acpiphp: Reassign resources on bridge if necessary - dlm: improve plock logging if interrupted - dlm: replace usage of found with dedicated list iterator variable - fs: dlm: add pid to debug log - fs: dlm: change plock interrupted message to debug again - fs: dlm: use dlm_plock_info for do_unlock_close - fs: dlm: fix mismatch of plock results from userspace - [mips*] cpu-features: Enable octeon_cache by cpu_type - [mips*] cpu-features: Use boot_cpu_type for CPU type based features - fbdev: Improve performance of sys_imageblit() - fbdev: Fix sys_imageblit() for arbitrary image widths - fbdev: fix potential OOB read in fast_imageblit() - dm integrity: increase RECALC_SECTORS to improve recalculate speed - dm integrity: reduce vmalloc space footprint on 32-bit architectures - ALSA: pcm: Fix potential data race at PCM memory allocation helpers - drm/amd/display: do not wait for mpc idle if tg is disabled - drm/amd/display: check TG is non-null before checking if enabled - libceph, rbd: ignore addr->type while comparing in some cases - rbd: make get_lock_owner_info() return a single locker or NULL - rbd: retrieve and check lock owner twice before blocklisting - rbd: prevent busy loop when requesting exclusive lock - tracing: Fix cpu buffers unavailable due to 'record_disabled' missed - tracing: Fix memleak due to race between current_tracer and trace - sock: annotate data-races around prot->memory_pressure - dccp: annotate data-races in dccp_poll() - ipvlan: Fix a reference count leak warning in ipvlan_ns_exit() - [arm64] net: bcmgenet: Fix return value check for fixed_phy_register() - net: validate veth and vxcan peer ifindexes - ice: fix receive buffer size miscalculation - igb: Avoid starting unnecessary workqueues - net/sched: fix a qdisc modification with ambiguous command request - netfilter: nf_tables: fix out of memory error handling - rtnetlink: return ENODEV when ifname does not exist and group is given - rtnetlink: Reject negative ifindexes in RTM_NEWLINK - net: remove bond_slave_has_mac_rcu() - bonding: fix macvlan over alb bond support - [powerpc*] ibmveth: Use dcbf rather than dcbfl - NFSv4: Fix dropped lock for racing OPEN and delegation return - clk: Fix slab-out-of-bounds error in devm_clk_release() - mm: add a call to flush_cache_vmap() in vmap_pfn() - NFS: Fix a use after free in nfs_direct_join_group() - nfsd: Fix race to FREE_STATEID and cl_revoked - selinux: set next pointer before attaching to list - batman-adv: Trigger events for auto adjusted MTU - batman-adv: Don't increase MTU when set by user - batman-adv: Do not get eth header before batadv_check_management_packet - batman-adv: Fix TT global entry leak when client roamed back - batman-adv: Fix batadv_v_ogm_aggr_send memory leak - batman-adv: Hold rtnl lock during MTU update via netlink - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels - [powerpc*] of: dynamic: Refactor action prints to not use "%pOF" inside devtree_lock - PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus - [x86] drm/vmwgfx: Fix shader stage validation - drm/display/dp: Fix the DP DSC Receiver cap size - [x86] fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 (Closes: #1050622) - torture: Fix hang during kthread shutdown phase - tick: Detect and fix jiffies update stall - timers/nohz: Switch to ONESHOT_STOPPED in the low-res handler when the tick is stopped - cgroup/cpuset: Rename functions dealing with DEADLINE accounting - sched/cpuset: Bring back cpuset_mutex - sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets - cgroup/cpuset: Iterate only if DEADLINE tasks are present - sched/deadline: Create DL BW alloc, free & check overflow interface - cgroup/cpuset: Free DL BW in case can_attach() fails - [x86] drm/i915: Fix premature release of request's reusable memory - ASoC: rt711: add two jack detection modes - scsi: snic: Fix double free in snic_tgt_create() - scsi: core: raid_class: Remove raid_component_add() - mm,hwpoison: refactor get_any_page - mm: fix page reference leak in soft_offline_page() - mm: memory-failure: kill soft_offline_free_page() - mm: memory-failure: fix unexpected return value in soft_offline_page() - [x86] ASoC: Intel: sof_sdw: include rt711.h for RT711 JD mode - mm,hwpoison: fix printing of page flags https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.194 - module: Expose module_init_layout_section() - [arm64] module-plts: inline linux/moduleloader.h - [arm64] module: Use module_init_layout_section() to spot init sections - [armel,armhf] module: Use module_init_layout_section() to spot init sections - mhi: pci_generic: Fix implicit conversion warning - Revert "drm/amdgpu: install stub fence into potential unused fence pointers" - rcu: Prevent expedited GP from enabling tick on offline CPU - rcu-tasks: Fix IPI failure handling in trc_wait_for_one_reader - rcu-tasks: Wait for trc_read_check_handler() IPIs - rcu-tasks: Add trc_inspect_reader() checks for exiting critical section https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.195 - erofs: ensure that the post-EOF tails are all zeroed - mmc: au1xmmc: force non-modular build and remove symbol_get usage - net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules - USB: serial: option: add Quectel EM05G variant (0x030e) - USB: serial: option: add FOXCONN T99W368/T99W373 product - [arm64,armhf] usb: dwc3: meson-g12a: do post init to fix broken usb after resumption - [arm64,armhf] usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0 - HID: wacom: remove the battery when the EKR is off - staging: rtl8712: fix race condition - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (CVE-2023-1989) - configfs: fix a race in configfs_lookup() - serial: qcom-geni: fix opp vote on shutdown - serial: sc16is7xx: fix broken port 0 uart init - serial: sc16is7xx: fix bug when first setting GPIO direction - firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe - fsi: master-ast-cf: Add MODULE_FIRMWARE macro - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse - pinctrl: amd: Don't show `Invalid config param` errors - ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire - phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code - media: pulse8-cec: handle possible ping error - media: pci: cx23885: fix error handling for cx23885 ATSC boards - 9p: virtio: make sure 'offs' is initialized in zc_request - ASoC: da7219: Flush pending AAD IRQ when suspending - ASoC: da7219: Check for failure reading AAD IRQ events - ethernet: atheros: fix return value check in atl1c_tso_csum() - vxlan: generalize vxlan_parse_gpe_hdr and remove unused args - [s390x] dasd: use correct number of retries for ERP requests - [s390x] dasd: fix hanging device after request requeue - fs/nls: make load_nls() take a const parameter - ASoc: codecs: ES8316: Fix DMIC config - [x86] platform/x86: intel: hid: Always call BTNL ACPI method - [x86] platform/x86: huawei-wmi: Silence ambient light sensor - drm/amd/display: Exit idle optimizations before attempt to access PHY - ovl: Always reevaluate the file signature for IMA - ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer() - security: keys: perform capable check only on privileged operations - kprobes: Prohibit probing on CFI preamble symbol - clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM - net: usb: qmi_wwan: add Quectel EM05GV2 - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock - netlabel: fix shift wrapping bug in netlbl_catmap_setlong() - bnx2x: fix page fault following EEH recovery - sctp: handle invalid error codes without calling BUG() - scsi: storvsc: Always set no_report_opcodes - ALSA: seq: oss: Fix racy open/close of MIDI devices - tracing: Introduce pipe_cpumask to avoid race on trace_pipes - net: Avoid address overwrite in kernel_connect - udf: Check consistency of Space Bitmap Descriptor - udf: Handle error when adding extent to a file - Revert "net: macsec: preserve ingress frame ordering" - reiserfs: Check the return value from __getblk() - eventfd: Export eventfd_ctx_do_read() - eventfd: prevent underflow for eventfd semaphores - fs: Fix error checking for d_hash_and_lookup() - tmpfs: verify {g,u}id mount options correctly - refscale: Fix uninitalized use of wait_queue_head_t - OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd() - [x86] decompressor: Don't rely on upper 32 bits of GPRs being preserved - perf/imx_ddr: don't enable counter0 if none of 4 counters are used - [s390x] pkey: fix/harmonize internal keyblob headers - [s390x] paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs - [x86] efistub: Fix PCI ROM preservation in mixed mode - [x86] cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() - bpftool: Use a local bpf_perf_event_value to fix accessing its fields - bpf: Clear the probe_addr for uprobe - tcp: tcp_enter_quickack_mode() should be static - regmap: rbtree: Use alloc_flags for memory allocations - udp: re-score reuseport groups when connected sockets are present - bpf: reject unhashed sockets in bpf_sk_assign - [arm64,armhf] spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM - wifi: mwifiex: Fix OOB and integer underflow when rx packets - wifi: mwifiex: fix error recovery in PCIE buffer descriptor management - [armhf] crypto: stm32 - Properly handle pm_runtime_get failing - crypto: api - Use work queue in crypto_destroy_instance - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() - Bluetooth: Fix potential use-after-free when clear keys - net: tcp: fix unexcepted socket die when snd_wnd is 0 - ice: ice_aq_check_events: fix off-by-one check when filling buffer - [arm64] crypto: caam - fix unchecked return value error - hwrng: iproc-rng200 - Implement suspend and resume calls - lwt: Fix return values of BPF xmit ops - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly - fs: ocfs2: namei: check return value of ocfs2_add_entry() - wifi: mwifiex: fix memory leak in mwifiex_histogram_read() - wifi: mwifiex: Fix missed return in oob checks failed path - samples/bpf: fix broken map lookup probe - wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx - wifi: ath9k: protect WMI command response buffer replacement with a lock - wifi: mwifiex: avoid possible NULL skb pointer dereference - Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave() - wifi: ath9k: use IS_ERR() with debugfs_create_dir() - net: arcnet: Do not call kfree_skb() under local_irq_disable() - mlxsw: i2c: Fix chunk size setting in output mailbox buffer - mlxsw: i2c: Limit single transaction buffer size - hwmon: (tmp513) Fix the channel number in tmp51x_is_visible() - net/sched: sch_hfsc: Ensure inner classes have fsc curve (CVE-2023-4623) - netrom: Deny concurrent connect(). - drm/bridge: tc358764: Fix debug print parameter order - quota: factor out dquot_write_dquot() - quota: rename dquot_active() to inode_quota_active() - quota: add new helper dquot_active() - quota: fix dqput() to follow the guarantees dquot_srcu should provide - ASoC: stac9766: fix build errors with REGMAP_AC97 - [arm64] dts: qcom: msm8996: Add missing interrupt to the USB2 controller - drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar() - [armel,armhf] dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name - [armel,armhf] dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch - [armel,armhf] dts: BCM53573: Drop nonexistent #usb-cells - [armel,armhf] dts: BCM53573: Add cells sizes to PCIe node - [armel,armhf] dts: BCM53573: Use updated "spi-gpio" binding properties - [armhf] drm/etnaviv: fix dumping of active MMU context - [x86] mm: Fix PAT bit missing from page protection modify mask - [armel,armhf] dts: s3c64xx: align pinctrl with dtschema - [armel,armhf] dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) - [armel,armhf] dts: s5pv210: adjust node names to DT spec - [armel,armhf] dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210 - [armel,armhf] dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) - drm: adv7511: Fix low refresh rate register for ADV7533/5 - [armel,armhf] dts: BCM53573: Fix Ethernet info for Luxul devices - [arm64] dts: qcom: sdm845: Add missing RPMh power domain to GCC - [arm64] dts: qcom: sdm845: Fix the min frequency of "ice_core_clk" - drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl' - md/bitmap: don't set max_write_behind if there is no write mostly device - md/md-bitmap: hold 'reconfig_mutex' in backlog_store() - [arm64,armhf] drm/tegra: Remove superfluous error messages around platform_get_irq() - [arm64,armhf] drm/tegra: dpaux: Fix incorrect return value of platform_get_irq - of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() - [arm64,armhf] drm/armada: Fix off-by-one error in armada_overlay_get_property() - drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01 - ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig - drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask - [arm64] drm/msm/mdp5: Don't leak some plane state - firmware: meson_sm: fix to avoid potential NULL pointer dereference - smackfs: Prevent underflow in smk_set_cipso() - drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create() - [arm64] drm/msm/a2xx: Call adreno_gpu_init() earlier - audit: fix possible soft lockup in __audit_inode_child() - bus: ti-sysc: Fix build warning for 64-bit build - bus: ti-sysc: Fix cast to enum warning - of: unittest: Fix overlay type in apply/revert check - ALSA: ac97: Fix possible error value of *rac97 - ipmi:ssif: Add check for kstrdup - ipmi:ssif: Fix a memory leak when scanning for an adapter - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() - clk: sunxi-ng: Modify mismatched function name - clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents - clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src - ext4: correct grp validation in ext4_mb_good_group - clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents - clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src - clk: qcom: reset: Use the correct type of sleep/delay based on length - PCI: Mark NVIDIA T4 GPUs to avoid bus reset - pinctrl: mcp23s08: check return value of devm_kasprintf() - PCI: pciehp: Use RMW accessors for changing LNKCTL - PCI/ASPM: Use RMW accessors for changing LNKCTL - clk: imx8mp: fix sai4 clock - clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op - vfio/type1: fix cap_migration information leak - [powerpc*] fadump: reset dump area size if fadump memory reserve fails - [powerpc*] perf: Convert fsl_emb notifier to state machine callbacks - drm/amdgpu: Use RMW accessors for changing LNKCTL - drm/radeon: Use RMW accessors for changing LNKCTL - net/mlx5: Use RMW accessors for changing LNKCTL - wifi: ath10k: Use RMW accessors for changing LNKCTL - [powerpc*] pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT - nfs/blocklayout: Use the passed in gfp flags - [powerpc*] iommu: Fix notifiers being shared by PCI and VIO buses - jfs: validate max amount of blocks before allocation. - fs: lockd: avoid possible wrong NULL parameter - NFSD: da_addr_body field missing in some GETDEVICEINFO replies - NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN - NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ - media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables - media: i2c: tvp5150: check return value of devm_kasprintf() - media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link() - drivers: usb: smsusb: fix error handling code in smsusb_init_device - media: dib7000p: Fix potential division by zero - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() - media: cx24120: Add retval check for cx24120_message_send() - [arm64] scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print - scsi: libsas: Introduce more SAM status code aliases in enum exec_status - [arm64] scsi: hisi_sas: Modify v3 HW SSP underflow error processing - [arm64] scsi: hisi_sas: Modify v3 HW SATA completion error processing - [arm64] scsi: hisi_sas: Fix warnings detected by sparse - [arm64] scsi: hisi_sas: Fix normally completed I/O analysed as failed - media: rkvdec: increase max supported height for H.264 - media: mediatek: vcodec: Return NULL if no vdec_fb is found - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() - scsi: RDMA/srp: Fix residual handling - scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param() - scsi: iscsi: Add length check for nlattr payload - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() - scsi: be2iscsi: Add length check when parsing nlattrs - scsi: qla4xxx: Add length check when parsing nlattrs - serial: sprd: Assign sprd_port after initialized to avoid wrong access - serial: sprd: Fix DMA buffer leak issue - [x86] APM: drop the duplicate APM_MINOR_DEV macro - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly - coresight: tmc: Explicit type conversions to prevent integer overflow - dma-buf/sync_file: Fix docs syntax - driver core: test_async: fix an error code - IB/uverbs: Fix an potential error pointer dereference - fsi: aspeed: Reset master errors after CFAM reset - iommu/qcom: Disable and reset context bank before programming - [amd64] iommu/vt-d: Fix to flush cache of PASID directory table - media: go7007: Remove redundant if statement - USB: gadget: f_mass_storage: Fix unused variable warning - media: ov5640: Enable MIPI interface in ov5640_set_power_mipi() - media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips - media: ov2680: Remove auto-gain and auto-exposure controls - media: ov2680: Fix ov2680_bayer_order() - media: ov2680: Fix vflip / hflip set functions - media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors - cgroup:namespace: Remove unused cgroup_namespaces_init() - scsi: core: Use 32-bit hostnum in scsi_host_lookup() - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock - serial: tegra: handle clk prepare error in tegra_uart_hw_init() - [arm*] amba: bus: fix refcount leak - Revert "IB/isert: Fix incorrect release of isert connection" - RDMA/siw: Balance the reference of cep->kref in the error path - RDMA/siw: Correct wrong debug message - HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode() - HID: multitouch: Correct devm device reference for hidinput input_dev name - [x86] speculation: Mark all Skylake CPUs as vulnerable to GDS - tracing: Fix race issue between cpu buffer write and swap - mtd: rawnand: brcmnand: Fix mtd oobsize - [arm64,armhf] phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328 - [arm64,armhf] phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate - [arm64,armhf] phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write - rpmsg: glink: Add check for kstrdup - mtd: spi-nor: Check bus width while setting QE bit - mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume() - um: Fix hostaudio build errors - dmaengine: ste_dma40: Add missing IRQ check in d40_probe - cpufreq: Fix the race condition while updating the transition_task of policy - virtio_ring: fix avail_wrap_counter in virtqueue_add_packed - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (CVE-2023-42753) - netfilter: xt_u32: validate user space input - netfilter: xt_sctp: validate the flag_info count - skbuff: skb_segment, Call zero copy functions before using skbuff frags - igb: set max size RX buffer when store bad packet is enabled - PM / devfreq: Fix leak in devfreq_dev_release() - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl - printk: ringbuffer: Fix truncating buffer size min_t cast - scsi: core: Fix the scsi_set_resid() documentation - ipmi_si: fix a memleak in try_smi_init() - [armhf] OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() - backlight/gpio_backlight: Compare against struct fb_info.device - backlight/bd6107: Compare against struct fb_info.device - backlight/lv5207lp: Compare against struct fb_info.device - [arm64] csum: Fix OoB access in IP checksum code for negative lengths - media: dvb: symbol fixup for dvb_attach() - Revert "scsi: qla2xxx: Fix buffer overrun" - scsi: mpt3sas: Perform additional retries if doorbell read returns 0 - ntb: Drop packets when qp link is down - ntb: Clean up tx tail index on link down - ntb: Fix calculation ntb_transport_tx_free_entry() - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" - procfs: block chmod on /proc/thread-self/comm - dlm: fix plock lookup when using multiple lockspaces - dccp: Fix out of bounds access in DCCP error handler - X.509: if signature is unsupported skip validation - net: handle ARPHRD_PPP in dev_is_mac_header_xmit() - fsverity: skip PKCS#7 parser when keyring is empty - pstore/ram: Check start of empty przs during init - [s390x] ipl: add missing secure/has_secure file to ipl type 'unknown' - [armhf] crypto: stm32 - fix loop iterating through scatterlist for DMA - cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug - usb: typec: bus: verify partner exists in typec_altmode_attention - USB: core: Unite old scheme and new scheme descriptor reads - USB: core: Change usb_get_device_descriptor() API - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() - USB: core: Fix oversight in SuperSpeed initialization - usb: typec: tcpci: clear the fault status bit - tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY - md/md-bitmap: remove unnecessary local variable in backlog_store() - udf: initialize newblock to 0 - net/ipv6: SKB symmetric hash should incorporate transport ports - io_uring: always lock in io_apoll_task_func - io_uring: break out of iowq iopoll on teardown - io_uring: break iopolling on signal - scsi: qla2xxx: Fix deletion race condition - scsi: qla2xxx: fix inconsistent TMF timeout - scsi: qla2xxx: Fix erroneous link up failure - scsi: qla2xxx: Turn off noisy message log - scsi: qla2xxx: Remove unsupported ql2xenabledif option - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev - drm/ast: Fix DRAM init on AST2200 - pinctrl: cherryview: fix address_space_handler() argument - dt-bindings: clock: xlnx,versal-clk: drop select:false - clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock - soc: qcom: qmi_encdec: Restrict string length in decode - NFS: Fix a potential data corruption - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info - backlight: gpio_backlight: Drop output GPIO direction check for initial power state - perf annotate bpf: Don't enclose non-debug code with an assert() - [x86] virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() - perf top: Don't pass an ERR_PTR() directly to perf_session__delete() - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load - pwm: lpc32xx: Remove handling of PWM channels - net/sched: fq_pie: avoid stalls in fq_pie_timer() - sctp: annotate data-races around sk->sk_wmem_queued - ipv4: annotate data-races around fi->fib_dead - net: read sk->sk_family once in sk_mc_loop() - [x86] drm/i915/gvt: Save/restore HW status to support GVT suspend/resume - [x86] drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt() - ipv4: ignore dst hint for multipath routes - igb: disable virtualization features on 82580 - veth: Fixing transmit return status for dropped packets - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr - af_unix: Fix data-races around user->unix_inflight. - af_unix: Fix data-race around unix_tot_inflight. - af_unix: Fix data-races around sk->sk_shutdown. - af_unix: Fix data race around sk->sk_err. - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (CVE-2023-4921) - kcm: Destroy mutex in kcm_exit_net() - igc: Change IGC_MIN to allow set rx/tx value between 64 and 80 - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 - [s390x] zcrypt: don't leak memory if dev_set_name() fails - idr: fix param name in idr_alloc_cyclic() doc - ip_tunnels: use DEV_STATS_INC() - netfilter: nfnetlink_osf: avoid OOB read - [arm64] net: hns3: fix the port information display when sfp is absent - sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory() - ext4: add correct group descriptors and reserved GDT blocks to system zone - ata: sata_gemini: Add missing MODULE_DESCRIPTION - ata: pata_ftide010: Add missing MODULE_DESCRIPTION - fuse: nlookup missing decrement in fuse_direntplus_link - btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART - btrfs: use the correct superblock to compare fsid in btrfs_validate_super - mtd: rawnand: brcmnand: Fix crash during the panic_write - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write - mtd: rawnand: brcmnand: Fix potential false time out warning - drm/amd/display: prevent potential division by zero errors - perf hists browser: Fix hierarchy mode header - perf tools: Handle old data in PERF_RECORD_ATTR - perf hists browser: Fix the number of entries for 'e' key - ACPI: APEI: explicit init of HEST and GHES in apci_init() - [arm64] sdei: abort running SDEI handlers during crash - scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry - scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe - scsi: qla2xxx: Fix crash in PCIe error handling - scsi: qla2xxx: Flush mailbox commands on chip reset - [armhf] dts: samsung: exynos4210-i9100: Fix LCD screen's physical size - net: ipv4: fix one memleak in __inet_del_ifa() - net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add - net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc() - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() - hsr: Fix uninit-value access in fill_frame_info() - r8152: check budget for r8152_poll() - kcm: Fix memory leak in error path of kcm_sendmsg() - ipv6: fix ip6_sock_set_addr_preferences() typo - ixgbe: fix timestamp configuration code - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). - drm/amd/display: Fix a bug when searching for insert_above_mpcc https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.196 - Revert "configfs: fix a race in configfs_lookup()" https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.197 - autofs: fix memory leak of waitqueues in autofs_catatonic_mode - btrfs: output extra debug info if we failed to find an inline backref - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer - kernel/fork: beware of __put_task_struct() calling context - rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() - [x86] ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 - [arm64] perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09 - [x86] ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2 - hw_breakpoint: fix single-stepping when using bpf_overflow_handler - devlink: remove reload failed checks in params get/set callbacks - crypto: lrw,xts - Replace strlcpy with strscpy - wifi: ath9k: fix fortify warnings - wifi: ath9k: fix printk specifier - wifi: mwifiex: fix fortify warning - wifi: wil6210: fix fortify warnings - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() - tpm_tis: Resend command to recover from data transfer errors - [arm64,armhf] mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450 - alx: fix OOB-read compiler warning - netfilter: ebtables: fix fortify warnings in size_entry_mwt() - wifi: mac80211_hwsim: drop short frames - ALSA: hda: intel-dsp-cfg: add LunarLake support - [armhf] drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable() - [armhf] bus: ti-sysc: Configure uart quirks for k3 SoC - md: raid1: fix potential OOB in raid1_remove_disk() - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount - [powerpc*] pseries: fix possible memory leak in ibmebus_bus_init() - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer - media: anysee: fix null-ptr-deref in anysee_master_xfer - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() - media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer - media: tuners: qt1010: replace BUG_ON with a regular error - media: pci: cx23885: replace BUG with error return - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() - serial: cpm_uart: Avoid suspicious locking - media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning - kobject: Add sanity check for kset->kobj.ktype in kset_register() - perf jevents: Make build dependency on test JSONs - perf tools: Add an option to build without libbfd - btrfs: move btrfs_pinned_by_swapfile prototype into volumes.h - btrfs: add a helper to read the superblock metadata_uuid - btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super - scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir() - scsi: lpfc: Fix the NULL vs IS_ERR() bug for debugfs_create_file() - [x86] boot/compressed: Reserve more memory for page tables - md/raid1: fix error: ISO C90 forbids mixed declarations - attr: block mode changes of symlinks - ovl: fix incorrect fdput() on aio completion - btrfs: fix lockdep splat and potential deadlock after failure running delayed items - btrfs: release path before inode lookup during the ino lookup ioctl - drm/amdgpu: fix amdgpu_cs_p1_user_fence - net/sched: Retire rsvp classifier (CVE-2023-42755) - proc: fix a dentry lock race between release_task and lookup - mm/filemap: fix infinite loop in generic_file_buffered_read() - drm/amd/display: enable cursor degamma for DCN3+ DRM legacy gamma - tracing: Have current_trace inc the trace array ref count - tracing: Have option files inc the trace array ref count - nfsd: fix change_info in NFSv4 RENAME replies - tracefs: Add missing lockdown check to tracefs_create_dir() - [armhf] i2c: aspeed: Reset the i2c controller when timeout occurs - ata: libata: disallow dev-initiated LPM transitions to unsupported states - scsi: megaraid_sas: Fix deadlock on firmware crashdump - scsi: pm8001: Setup IRQs on resume - ext4: fix rec_len verify error [ Salvatore Bonaccorso ] * [rt] Refresh "cpuset: Convert callback_lock to raw_spinlock_t" * Bump ABI to 26 * [rt] Refresh "eventfd: Make signal recursion protection a task bit" * Drop now unknown config options for IPv4 and IPv6 Resource Reservation Protocol (RSVP, RSVP6) * netfilter: nf_tables: integrate pipapo into commit protocol * netfilter: nf_tables: don't skip expired elements during walk (CVE-2023-4244) * netfilter: nf_tables: GC transaction API to avoid race with control plane (CVE-2023-4244) * netfilter: nf_tables: adapt set backend to use GC transaction API (CVE-2023-4244) * netfilter: nft_set_hash: mark set element as dead when deleting from packet path (CVE-2023-4244) * netfilter: nf_tables: remove busy mark and gc batch API (CVE-2023-4244) * netfilter: nf_tables: don't fail inserts if duplicate has expired * netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path (CVE-2023-4244) * netfilter: nf_tables: GC transaction race with netns dismantle (CVE-2023-4244) * netfilter: nf_tables: GC transaction race with abort path * netfilter: nf_tables: use correct lock to protect gc_list * netfilter: nf_tables: defer gc run if previous batch is still pending * netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction * netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention * netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails * netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration * netfilter: nf_tables: fix memleak when more than 255 elements expired * netfilter: nf_tables: disallow element removal on anonymous sets * netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP (CVE-2023-42756) * netfilter: nf_tables: unregister flowtable hooks on netns exit * netfilter: nf_tables: double hook unregistration in netns path * ipv4: fix null-deref in ipv4_link_failure -- Salvatore Bonaccorso Fri, 29 Sep 2023 06:25:15 +0200 linux (5.10.191-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.180 - seccomp: Move copy_seccomp() to no failure path. - [arm64] KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg() - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (CVE-2023-1380) - drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var - bluetooth: Perform careful capability checks in hci_sock_ioctl() (CVE-2023-2002) - [x86] fpu: Prevent FPU state corruption - USB: serial: option: add UNISOC vendor and TOZED LT70C product - driver core: Don't require dynamic_debug for initcall_debug probe timing - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750 - asm-generic/io.h: suppress endianness warnings for readq() and writeq() - wireguard: timers: cast enum limits members to int in prints - PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock - [arm64] PCI: qcom: Fix the incorrect register usage in v2.7.0 config - [arm64,armhf] USB: dwc3: fix runtime pm imbalance on probe errors - [arm64,armhf] USB: dwc3: fix runtime pm imbalance on unbind - [x86] hwmon: (k10temp) Check range scale when CUR_TEMP register is read-write - hwmon: (adt7475) Use device_property APIs when configuring polarity - posix-cpu-timers: Implement the missing timer_wait_running callback - perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into sysconf(__SC_THREAD_STACK_MIN_VALUE) - blk-mq: release crypto keyslot before reporting I/O complete - blk-crypto: make blk_crypto_evict_key() return void - blk-crypto: make blk_crypto_evict_key() more robust - ext4: use ext4_journal_start/stop for fast commit transactions - xhci: fix debugfs register accesses while suspended - tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem - [mips*] fw: Allow firmware to pass a empty env - ipmi:ssif: Add send_retries increment - ipmi: fix SSIF not responding under certain cond. - kheaders: Use array declaration instead of char - [arm64,armhf] pwm: meson: Fix axg ao mux parents - [arm64,armhf] pwm: meson: Fix g12a ao clk81 name - ring-buffer: Sync IRQ works before buffer destruction - crypto: api - Demote BUG_ON() in crypto_unregister_alg() to a WARN_ON() - [arm64] crypto: safexcel - Cleanup ring IRQ workqueues on load failure - rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed - reiserfs: Add security prefix to xattr name in reiserfs_security_write() - [x86] KVM: nVMX: Emulate NOPs in L2, and PAUSE if it's not intercepted - relayfs: fix out-of-bounds access in relay_file_read (CVE-2023-3268) - writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs - [armhf] i2c: omap: Fix standard mode false ACK readings - [amd64] iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration in IRTE - Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" - ubifs: Fix memleak when insert_old_idx() failed - ubi: Fix return value overwrite issue in try_write_vid_and_data() - ubifs: Free memory for tmpfile name - nilfs2: do not write dirty data after degenerating to read-only - nilfs2: fix infinite loop in nilfs_mdt_get_block() - md/raid10: fix null-ptr-deref in raid10_sync_request - [arm64] mailbox: zynqmp: Fix IPI isr handling - [arm64] mailbox: zynqmp: Fix typo in IPI documentation - wifi: rtl8xxxu: RTL8192EU always needs full init - [arm64,armhf] clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent - rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check - selinux: fix Makefile dependencies of flask.h - selinux: ensure av_permissions.h is built when needed - tpm, tpm_tis: Do not skip reset of original interrupt vector - tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register - tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed - tpm, tpm_tis: Claim locality before writing interrupt registers - tpm, tpm: Implement usage counter for locality - tpm, tpm_tis: Claim locality when interrupts are reenabled on resume - erofs: stop parsing non-compact HEAD index if clusterofs is invalid - erofs: fix potential overflow calculating xattr_isize - [arm64,armhf] drm/rockchip: Drop unbalanced obj unref - drm/vgem: add missing mutex_destroy - drm/probe-helper: Cancel previous job before starting new one - [arm64] drm/msm/disp/dpu: check for crtc enable rather than crtc active to release shared resources - [amd64] EDAC/skx: Fix overflows on the DRAM row address mapping arrays - [x86] MCE/AMD: Use an u64 for bank_map - [arm64] firmware: qcom_scm: Clear download bit during reboot - [arm64] drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535 - [arm64] drm/msm/adreno: Defer enabling runpm until hw_init() - [arm64] drm/msm/adreno: drop bogus pm_runtime_set_active() - [arm64] drm: msm: adreno: Disable preemption on Adreno 510 - [x86] ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 - [arm64] mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data - [arm64,armhf] drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe() - regulator: core: Consistently set mutex_owner when using ww_mutex_lock_slow() - regulator: core: Avoid lockdep reports when resolving supplies - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (CVE-2023-35824) - media: saa7134: fix use after free bug in saa7134_finidev due to race condition (CVE-2023-35823) - [x86] apic: Fix atomic update of offset in reserve_eilvt_offset() - [x86] ioapic: Don't return 0 from arch_dynirq_lower_bound() - debugobject: Prevent init race with static objects - [x86] drm/i915: Make intel_get_crtc_new_encoder() less oopsy - tick/sched: Use tick_next_period for lockless quick check - tick/sched: Reduce seqcount held scope in tick_do_update_jiffies64() - tick/sched: Optimize tick_do_update_jiffies64() further - tick: Get rid of tick_period - tick/common: Align tick period with the HZ tick. - wifi: ath6kl: minor fix for allocation size - wifi: ath9k: hif_usb: fix memory leak of remain_skbs - wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() - wifi: ath6kl: reduce WARN to dev_dbg() in callback - tools: bpftool: Remove invalid \' json escape - wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser() - wifi: rtw88: mac: Return the original error from rtw_mac_power_switch() - bpf: take into account liveness when propagating precision - bpf: fix precision propagation verbose logging - scm: fix MSG_CTRUNC setting condition for SO_PASSSEC - bpf: Remove misleading spec_v1 check on var-offset stack read - vlan: partially enable SIOCSHWTSTAMP in container - net/packet: annotate accesses to po->xmit - net/packet: convert po->origdev to an atomic flag - net/packet: convert po->auxdata to an atomic flag - scsi: target: Rename struct sense_info to sense_detail - scsi: target: Rename cmd.bad_sector to cmd.sense_info - scsi: target: Make state_list per CPU - scsi: target: Fix multiple LUN_RESET handling - scsi: target: iscsit: Fix TAS handling during conn cleanup - scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS - f2fs: handle dqget error in f2fs_transfer_project_quota() - f2fs: enforce single zone capacity - f2fs: apply zone capacity to all zone type - f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages() - [arm64] crypto: caam - Clear some memory in instantiate_rng - wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg() - wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_reg() - net: qrtr: correct types of trace event parameters - bpftool: Fix bug for long instructions in program CFG dumps - crypto: drbg - make drbg_prepare_hrng() handle jent instantiation errors - crypto: drbg - Only fail when jent is unavailable in FIPS mode - xsk: Fix unaligned descriptor validation - f2fs: fix to avoid use-after-free for cached IPU bio - scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() - [arm64,armhf] net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling - bpf, sockmap: fix deadlocks in the sockhash and sockmap - nvme: handle the persistent internal error AER - nvme: fix async event trace event - bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap - md/raid10: fix leak of 'r10bio->remaining' for recovery - md/raid10: fix memleak for 'conf->bio_split' - md/raid10: fix memleak of md thread - wifi: iwlwifi: yoyo: Fix possible division by zero - wifi: iwlwifi: fw: move memset before early return - jdb2: Don't refuse invalidation of already invalidated buffers - wifi: iwlwifi: make the loop for card preparation effective - wifi: iwlwifi: mvm: check firmware response size - wifi: iwlwifi: fw: fix memory leak in debugfs - ixgbe: Allow flow hash to be set via ethtool - ixgbe: Enable setting RSS table to default values - bpf: Don't EFAULT for getsockopt with optval=NULL - netfilter: nf_tables: don't write table validation state without mutex - net/sched: sch_fq: fix integer overflow of "credit" - ipv4: Fix potential uninit variable access bug in __ip_make_skb() - Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" - netlink: Use copy_to_user() for optval in netlink_getsockopt(). - net: amd: Fix link leak when verifying config failed - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. - pstore: Revert pmsg_lock back to a normal mutex - [arm64,armhf] usb: dwc3: gadget: Change condition for processing suspend event - fpga: bridge: fix kernel-doc parameter description - iio: light: max44009: add missing OF device matching - [armhf] spi: spi-imx: using pm_runtime_resume_and_get instead of pm_runtime_get_sync - [armhf] spi: imx: Don't skip cleanup in remove's error path - [armhf] PCI: imx6: Install the fault handler only on compatible match - ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ - ASoC: es8316: Handle optional IRQ assignment - linux/vt_buffer.h: allow either builtin or modular for macros - [arm64] spi: qup: Don't skip cleanup in remove's error path - [x86] vmci_host: fix a race condition in vmci_host_poll() causing GPF - of: Fix modalias string generation - [arm64,armhf] usb: chipidea: fix missing goto in `ci_hdrc_probe` - [arm64] tty: serial: fsl_lpuart: adjust buffer length to the intended size - serial: 8250: Add missing wakeup event reporting - [x86] staging: rtl8192e: Fix W_DISABLE# does not work after stop/start - [arm64] spmi: Add a check for remove callback when removing a SPMI driver - [powerpc*] rtas: use memmove for potentially overlapping buffer copy - perf/core: Fix hardlockup failure caused by perf throttle - [amd64] RDMA/rdmavt: Delete unnecessary NULL check - workqueue: Rename "delayed" (delayed by active management) to "inactive" - workqueue: Fix hung time report of worker pools - [armhf] rtc: omap: include header for omap_rtc_power_off_program prototype - RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() - [arm64,armhf] rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time - clk: add missing of_node_put() in "assigned-clocks" property parsing - RDMA/siw: Remove namespace check from siw_netdev_event() - RDMA/cm: Trace icm_send_rej event before the cm state is reset - RDMA/srpt: Add a check for valid 'mad_agent' pointer - [amd64] IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order - [amd64] IB/hfi1: Add AIP tx traces - [amd64] IB/hfi1: Add additional usdma traces - [amd64] IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease - [arm*] firmware: raspberrypi: Introduce devm_rpi_firmware_get() - RDMA/mlx5: Fix flow counter query via DEVX - SUNRPC: remove the maximum number of retries in call_bind_status - RDMA/mlx5: Use correct device num_ports when modify DC - ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline - [arm64] dmaengine: mv_xor_v2: Fix an error code. - [armhf] leds: tca6507: Fix error handling of using fwnode_property_read_string - [arm64,armhf] phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port - afs: Fix updating of i_size with dv jump from server - btrfs: scrub: reject unsupported scrub flags - [s390x] dasd: fix hanging blockdevice after request requeue - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path - dm flakey: fix a crash with invalid table line - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (CVE-2023-2269) - perf auxtrace: Fix address filter entire kernel size - perf intel-pt: Fix CYC timestamps after standalone CBR - [arm64] Always load shadow stack pointer directly from the task struct - [arm64] Stash shadow stack pointer in the task struct on interrupt - debugobject: Ensure pool refill (again) - scsi: target: core: Avoid smp_processor_id() in preemptible code - tty: create internal tty.h file - tty: audit: move some local functions out of tty.h - tty: move some internal tty lock enums and functions out of tty.h - tty: move some tty-only functions to drivers/tty/tty.h - tty: clean include/linux/tty.h up - tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH - ring-buffer: Ensure proper resetting of atomic variables in ring_buffer_reset_online_cpus - [amd64] crypto: ccp - Clear PSP interrupt status register before calling handler - [arm64] mailbox: zynq: Switch to flexible array to simplify code - [arm64] mailbox: zynqmp: Fix counts of child nodes - dm verity: skip redundant verity_handle_err() on I/O errors - dm verity: fix error handling for check_at_most_once on FEC - scsi: qedi: Fix use after free bug in qedi_remove() - [armhf] net/ncsi: clear Tx enable mode when handling a Config required AEN - net/sched: cls_api: remove block_cb from driver_list before freeing - sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() - [arm64,armhf] net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu - writeback: fix call of incorrect macro - [arm64,armhf] watchdog: dw_wdt: Fix the error handling path of dw_wdt_drv_probe() - net/sched: act_mirred: Add carrier check - sfc: Fix module EEPROM reporting for QSFP modules - rxrpc: Fix hard call timeout units - af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). - drm/amdgpu: add a missing lock for AMDGPU_SCHED - ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` - virtio_net: split free_unused_bufs() - virtio_net: suppress cpu stall when free_unused_bufs - [arm64] net: enetc: check the index of the SFI rather than the handle - crypto: sun8i-ss - Fix a test in sun8i_ss_setup_ivs() - btrfs: fix btrfs_prev_leaf() to not return the same key twice - btrfs: don't free qgroup space unless specified - btrfs: print-tree: parent bytenr must be aligned to sector size - cifs: fix pcchunk length type in smb2_copychunk_range - inotify: Avoid reporting event with invalid wd - [armhf] remoteproc: stm32: Call of_node_put() on iteration error - [armhf] dts: exynos: fix WM8960 clock name in Itop Elite - f2fs: fix potential corruption when moving a directory - [armhf] drm/panel: otm8009a: Set backlight parent to panel device - drm/amdgpu: fix an amdgpu_irq_put() issue in gmc_v9_0_hw_fini() - drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras - drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend - HID: wacom: Set a default resolution for older tablets - HID: wacom: insert timestamp to packed Bluetooth (BT) events - [x86] KVM: x86: do not report a vCPU as preempted outside instruction boundaries (CVE-2022-39189) - ext4: fix WARNING in mb_find_extent - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (CVE-2023-34256) - ext4: fix data races when using cached status extents - ext4: check iomap type only if ext4_iomap_begin() does not fail - ext4: improve error recovery code paths in __ext4_remount() - ext4: fix deadlock when converting an inline directory in nojournal mode - ext4: add bounds checking in get_max_inline_xattr_value_size() - ext4: bail out of ext4_xattr_ibody_get() fails for any reason - ext4: remove a BUG_ON in ext4_mb_release_group_pa() - ext4: fix invalid free tracking in ext4_xattr_move_to_block() - serial: 8250: Fix serial8250_tx_empty() race with DMA Tx - drbd: correctly submit flush bio on barrier - [x86] KVM: x86: Ensure PV TLB flush tracepoint reflects KVM behavior - [x86] KVM: x86: Fix recording of guest steal time / preempted status - [x86] KVM: Fix steal time asm constraints - [x86] KVM: x86: Remove obsolete disabling of page faults in kvm_arch_vcpu_put() - [x86] KVM: x86: do not set st->preempted when going back to user space - [x86] KVM: x86: revalidate steal time cache if MSR value changes - [x86] KVM: x86: do not report preemption if the steal time cache is stale - [x86] KVM: x86: move guest_pv_has out of user_access section - printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h - [armhf] drm/exynos: move to use request_irq by IRQF_NO_AUTOEN flag - mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock - drm/amd/display: Fix hang when skipping modeset https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.181 - driver core: add a helper to setup both the of_node and fwnode of a device - drm/mipi-dsi: Set the fwnode for mipi_dsi_device - linux/dim: Do nothing if no time delta between samples - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). - netfilter: conntrack: fix possible bug_on with enable_hooks=1 - netlink: annotate accesses to nlk->cb_running - net: annotate sk->sk_err write from do_recvmmsg() - net: deal with most data-races in sk_wait_event() - net: tap: check vlan with eth_type_vlan() method - net: add vlan_get_protocol_and_depth() helper - tcp: factor out __tcp_close() helper - tcp: add annotations around sk->sk_shutdown accesses - ipvlan:Fix out-of-bounds caused by unclear skb->cb (CVE-2023-3090) - net: datagram: fix data-races in datagram_poll() - af_unix: Fix a data race of sk->sk_receive_queue->qlen. - af_unix: Fix data races around sk->sk_shutdown. - [x86] drm/i915/dp: prevent potential div-by-zero - [x86] fbdev: arcfb: Fix error handling in arcfb_probe() - ext4: remove an unused variable warning with CONFIG_QUOTA=n - ext4: reflect error codes from ext4_multi_mount_protect() to its callers - ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled - ext4: fix lockdep warning when enabling MMP - ext4: remove redundant mb_regenerate_buddy() - ext4: drop s_mb_bal_lock and convert protected fields to atomic - ext4: add mballoc stats proc file - ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set - ext4: allow ext4_get_group_info() to fail - rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access - fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() - drm/amd/display: Use DC_LOG_DC in the trasform pixel function - regmap: cache: Return error in cache sync operations for REGCACHE_NONE - memstick: r592: Fix UAF bug in r592_remove due to race condition (CVE-2023-3141) - firmware: arm_sdei: Fix sleep from invalid context BUG - ACPI: EC: Fix oops when removing custom query handlers - [armhf] remoteproc: stm32_rproc: Add mutex protection for workqueue - [arm64,armhf] drm/tegra: Avoid potential 32-bit integer overflow - ACPICA: Avoid undefined behavior: applying zero offset to null pointer - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects - wifi: ath: Silence memcpy run-time false positive warning - bpf: Annotate data races in bpf_local_storage - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex - scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow - net: Catch invalid index in XPS mapping - scsi: target: iscsit: Free cmds before session free - lib: cpu_rmap: Avoid use after free on rmap->obj array entries - scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition - gfs2: Fix inode height consistency check - ext4: set goal start correctly in ext4_mb_normalize_request - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() - f2fs: fix to drop all dirty pages during umount() if cp_error is set - wifi: iwlwifi: pcie: fix possible NULL pointer dereference - wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf - null_blk: Always check queue mode setting from configfs - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace - wifi: ath11k: Fix SKB corruption in REO destination ring - ipvs: Update width of source for ip_vs_sync_conn_options - Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp - [x86] staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE - HID: logitech-hidpp: Don't use the USB serial for USB devices - HID: logitech-hidpp: Reconcile USB and Unifying serials - [armhf] spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 - HID: wacom: generic: Set battery quirk only when we see battery data - usb: typec: tcpm: fix multiple times discover svids error - serial: 8250: Reinit port->pm on port specific driver unbind - recordmcount: Fix memory leaks in the uwrite function - RDMA/core: Fix multiple -Warray-bounds warnings - [arm64,armhf] iommu/arm-smmu-qcom: Limit the SMR groups to 128 - [arm64] iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any - Input: xpad - add constants for GIP interface numbers - btrfs: move btrfs_find_highest_objectid/btrfs_find_free_objectid to disk-io.c - btrfs: replace calls to btrfs_find_free_ino with btrfs_find_free_objectid - btrfs: fix space cache inconsistency after error loading it from disk - xfrm: don't check the default policy if the policy allows the packet - Revert "Fix XFRM-I support for nested ESP tunnels" - [arm64] drm/msm/dp: unregister audio driver during unbind - [arm64] drm/msm/dpu: Remove duplicate register defines from INTF - cpupower: Make TSC read per CPU for Mperf monitor - af_key: Reject optional tunnel/BEET mode templates in outbound policies - [arm64,armhf] net: fec: Better handle pm_runtime_get() failing in .remove() - net: phy: dp83867: add w/a for packet errors seen with short cables - ALSA: firewire-digi00x: prevent potential use after free - ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15 - vsock: avoid to close connected socket after the timeout - ipv4/tcp: do not use per netns ctl sockets - net: Find dst with sk's xfrm policy not ctl_sk - tcp: fix possible sk_priority leak in tcp_v4_send_reset() - [armhf] serial: arc_uart: fix of_iomap leak in `arc_serial_probe` - erspan: get the proto with the md version for collect_md - [arm64] net: hns3: fix sending pfc frames after reset issue - [arm64] net: hns3: fix reset delay time to avoid configuration timeout - media: netup_unidvb: fix use-after-free at del_timer() - SUNRPC: Fix trace_svc_register() call site - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() - net/tipc: fix tipc header files for kernel-doc - tipc: add tipc_bearer_min_mtu to calculate min mtu - tipc: do not update mtu if msg_max is too small in mtu negotiation - tipc: check the bearer min mtu properly when setting it by netlink - [arm64] net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() - [arm64] net: bcmgenet: Restore phy_stop() depending upon suspend/close - wifi: mac80211: fix min center freq offset tracing - wifi: iwlwifi: mvm: don't trust firmware n_channels - [x86] scsi: storvsc: Don't pass unused PFNs to Hyper-V host - cassini: Fix a memory leak in the error handling path of cas_init_one() - igb: fix bit_shift to be in [1..8] range - vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() - netfilter: nft_set_rbtree: fix null deref on element insertion - bridge: always declare tunnel functions - ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go - USB: usbtmc: Fix direction for 0-length ioctl control messages - usb-storage: fix deadlock when a scsi command timeouts more than once - [arm64,armhf] usb: dwc3: debugfs: Resume dwc3 before accessing registers - usb: gadget: u_ether: Fix host MAC address case - usb: typec: altmodes/displayport: fix pin_assignment_show - ALSA: hda: Fix Oops by 9.1 surround channel names - ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table - ALSA: hda/realtek: Add quirk for Clevo L140AU - ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 - ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 - can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag - can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag - statfs: enforce statfs[64] structure initialization - serial: Add support for Advantech PCI-1611U card - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF - ceph: force updating the msg pointer in non-split case - tpm/tpm_tis: Disable interrupts for more Lenovo devices - [powerpc*] 64s/radix: Fix soft dirty tracking - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() - HID: wacom: Force pen out of prox if no events have been received in a while - HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs - HID: wacom: add three styli to wacom_intuos_get_tool_type - [arm64] KVM: arm64: Link position-independent string routines into .hyp.text - serial: 8250_exar: derive nr_ports from PCI ID for Acces I/O cards - serial: exar: Add support for Sealevel 7xxxC serial cards - serial: 8250_exar: Add support for USR298x PCI Modems - [s390x] qdio: get rid of register asm - [s390x] qdio: fix do_sqbs() inline assembly constraint - [x86] watchdog: sp5100_tco: Immediately trigger upon starting. - writeback, cgroup: remove extra percpu_ref_exit() - net/sched: act_mirred: refactor the handle of xmit - net/sched: act_mirred: better wording on protection against excessive stack growth - act_mirred: use the backlog for nested calls to mirred ingress (CVE-2022-4269) - ocfs2: Switch to security_inode_init_security() - ALSA: hda/ca0132: add quirk for EVGA X299 DARK - ALSA: hda: Fix unhandled register update during auto-suspend period - ALSA: hda/realtek: Enable headset onLenovo M70/M90 - net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize - btrfs: use nofs when cleaning up aborted transactions - dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type - [x86] mm: Avoid incomplete Global INVLPG flushes - [x86] topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms - debugobjects: Don't wake up kswapd from fill_pool() - fbdev: udlfb: Fix endpoint check - net: fix stack overflow when LRO is disabled for virtual interfaces - udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). - USB: core: Add routines for endpoint checks in old drivers - USB: sisusbvga: Add endpoint checks - media: radio-shark: Add endpoint checks - net: fix skb leak in __skb_tstamp_tx() - bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields - ipv6: Fix out-of-bounds access in ipv6_find_tlv() - power: supply: leds: Fix blink to LED on transition - power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition - power: supply: bq27xxx: Fix I2C IRQ race on remove - power: supply: bq27xxx: Fix poll_interval handling and races on remove - fs: fix undefined behavior in bit shift for SB_NOUSER - [x86] show_trace_log_lvl: Ensure stack pointer is aligned, again - [x86] ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg - [x86] forcedeth: Fix an error handling path in nv_probe() - net/mlx5e: do as little as possible in napi poll when budget is 0 - net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs - net/mlx5: Fix error message when failing to allocate device memory - net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device - [x86] 3c589_cs: Fix an error handling path in tc589_probe() - net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.182 - [x86] cpu: Add Raptor Lake to Intel family - [x86] cpu: Drop spurious underscore from RAPTOR_LAKE #define - power: supply: bq27xxx: fix polarity of current_now - power: supply: bq27xxx: fix sign of current_now for newer ICs - power: supply: bq27xxx: make status more robust - power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status() - power: supply: bq27xxx: expose battery data when CI=1 - power: supply: bq27xxx: Move bq27xxx_battery_update() down - power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes - power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize - power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier() - [x86] power: supply: bq24190: Call power_supply_changed() after updating input current - regulator: Add regmap helper for ramp-delay setting - net/mlx5: devcom only supports 2 ports - net/mlx5: Devcom, serialize devcom registration - net: phy: mscc: enable VSC8501/2 RGMII RX clock - bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() - [arm*] binder: fix UAF caused by faulty buffer cleanup (CVE-2023-21255) - ipv{4,6}/raw: fix output xfrm lookup wrt protocol - netfilter: ctnetlink: Support offloaded conntrack entry deletion https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.183 - [arm64,armhf] iommu/rockchip: Fix unwind goto issue - [amd64] iommu/amd: Don't block updates to GATag if guest mode is on - [arm64,armhf] dmaengine: pl330: rename _start to prevent build error - net/mlx5: fw_tracer, Fix event handling - netrom: fix info-leak in nr_write_internal() - af_packet: Fix data-races of pkt_sk(sk)->num. - [amd64,arm64] amd-xgbe: fix the false linkup in xgbe_phy_status - af_packet: do not use READ_ONCE() in packet_bind() - tcp: deny tcp_disconnect() when threads are waiting - tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set - net/sched: sch_ingress: Only create under TC_H_INGRESS - net/sched: sch_clsact: Only create under TC_H_CLSACT - net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs - net/sched: Prohibit regrafting ingress or clsact Qdiscs - net: sched: fix NULL pointer dereference in mq_attach - net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report - udp6: Fix race condition in udp6_sendmsg & connect - net/mlx5: Read embedded cpu after init bit cleared - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (CVE-2023-35788) - [arm64,armhf] net: dsa: mv88e6xxx: Increase wait after reset deactivation - [armhf] mtd: rawnand: marvell: ensure timing values are written - [armhf] mtd: rawnand: marvell: don't set the NAND frequency select - ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs. - btrfs: abort transaction when sibling keys check fails for leaves - [armel] ARM: 9295/1: unwind:fix unwind abort for uleb128 case - gfs2: Don't deref jdesc in evict (CVE-2023-3212) - fbdev: modedb: Add 1920x1080 at 60 Hz video mode - nbd: Fix debugfs_create_dir error checking - xfrm: Check if_id in inbound policy/secpath match - ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs - media: dvb_demux: fix a bug for the continuity counter - media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() - media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() - media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() - media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer - media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() - media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address - media: netup_unidvb: fix irq init by register it at the end of probe - media: dvb_ca_en50221: fix a size write bug - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() - media: dvb-core: Fix use-after-free due on race condition at dvb_net - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (CVE-2023-31084) - media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 - wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value - [arm64] mm: mark private VM_FAULT_X defines as vm_fault_t - scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed - netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT - ALSA: oss: avoid missing-prototype warnings - [arm64] drm/msm: Be more shouty if per-process pgtables aren't working - atm: hide unused procfs functions - HID: google: add jewel USB id - HID: wacom: avoid integer overflow in wacom_intuos_inout() - iio: imu: inv_icm42600: fix timestamp reset - iio: light: vcnl4035: fixed chip ID check - iio: dac: mcp4725: Fix i2c_master_send() return value handling - iio: adc: ad7192: Change "shorted" channels to differential - net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 - usb: gadget: f_fs: Add unbind event before functionfs_unbind - ata: libata-scsi: Use correct device no in ata_find_dev() - x86/boot: Wrap literal addresses in absolute_pointer() - ACPI: thermal: drop an always true check - ath6kl: Use struct_group() to avoid size-mismatched casting - eth: sun: cassini: remove dead code - mmc: vub300: fix invalid response handling - [arm64] tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK - btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds - selinux: don't use make's grouped targets feature yet - tracing/probe: trace_probe_primary_from_call(): checked list_first_entry - ext4: add EA_INODE checking to ext4_iget() - ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find() - ext4: disallow ea_inodes with extended attributes - ext4: add lockdep annotations for i_data_sem for ea_inode's - fbcon: Fix null-ptr-deref in soft_cursor - [arm64,armhf] serial: 8250_tegra: Fix an error handling path in tegra_uart_probe() - [x86] KVM: x86: Account fastpath-only VM-Exits in vCPU stats - KEYS: asymmetric: Copy sig and digest in public_key_verify_signature() - regmap: Account for register length when chunking - tpm, tpm_tis: Request threaded interrupt handler - [x86] scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD) (CVE-2023-2007) - [x86] scsi: dpt_i2o: Do not process completions with invalid addresses - [amd64] crypto: ccp: Reject SEV commands with mismatching command buffer - [amd64] crypto: ccp: Play nice with vmalloc'd memory for SEV command structs (Closes: #1036543) - ext4: enable the lazy init thread when remounting read/write https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.184 - remove the sx8 block driver - f2fs: fix iostat lock protection - blk-iocost: avoid 64-bit division in ioc_timer_fn - i40iw: fix build warning in i40iw_manage_apbvt() - i40e: fix build warnings in i40e_alloc.h - i40e: fix build warning in ice_fltr_add_mac_to_list() - [arm*] staging: vchiq_core: drop vchiq_status from vchiq_initialise - [arm64] spi: qup: Request DMA before enabling clocks - afs: Fix setting of mtime when creating a file/dir/symlink - neighbour: fix unaligned access to pneigh_entry - net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT - net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values - Bluetooth: Fix l2cap_disconnect_req deadlock - Bluetooth: L2CAP: Add missing checks for invalid DCID - qed/qede: Fix scheduling while atomic - netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper - netfilter: ipset: Add schedule point in call_ad(). - rfs: annotate lockless accesses to sk->sk_rxhash - rfs: annotate lockless accesses to RFS sock flow table - net: sched: move rtm_tca_policy declaration to include file - net: sched: fix possible refcount leak in tc_chain_tmplt_add() - bpf: Add extra path pointer check to d_path helper - lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() - bnxt_en: Don't issue AP reset during ethtool's reset operation - bnxt_en: Query default VLAN before VNIC setup on a VF - bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks - batman-adv: Broken sync while rescheduling delayed work - Input: xpad - delete a Razer DeathAdder mouse VID/PID entry - Input: psmouse - fix OOB access in Elantech protocol - ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01 - ALSA: hda/realtek: Add Lenovo P3 Tower platform - drm/amdgpu: fix xclk freq on CHIP_STONEY - can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket - can: j1939: change j1939_netdev_lock type to mutex - can: j1939: avoid possible use-after-free when j1939_can_rx_register fails - ceph: fix use-after-free bug for inodes when flushing capsnaps - [s390x] dasd: Use correct lock while counting channel queue length - Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk - Bluetooth: hci_qca: fix debugfs registration - rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting - rbd: get snapshot context after exclusive lock is ensured to be held - [arm64] pinctrl: meson-axg: add missing GPIOA_18 gpio group - usb: usbfs: Enforce page requirements for mmap - usb: usbfs: Use consistent mmap functions - [arm*] staging: vc04_services: fix gcc-13 build warning - vhost: support PACKED when setting-getting vring_base - Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled" - ext4: only check dquot_initialize_needed() when debugging - tcp: fix tcp_min_tso_segs sysctl - xfs: verify buffer contents when we skip log replay (CVE-2023-2124) - drm/atomic: Don't pollute crtc_state->mode_blob with error pointers - btrfs: check return value of btrfs_commit_transaction in relocation - btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (CVE-2023-3111) - [x86] Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE" https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.185 - lib: cleanup kstrto*() usage - kernel.h: split out kstrtox() and simple_strtox() to a separate header - power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() - [armhf] dts: vexpress: add missing cache properties - power: supply: Ratelimit no data debug output - [x86] platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0 - regulator: Fix error checking for debugfs_create_dir - [arm64,armhf] irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues - power: supply: Fix logic checking if system is running from battery - btrfs: scrub: try harder to mark RAID56 block groups read-only - btrfs: handle memory allocation failure in btrfs_csum_one_bio - ASoC: soc-pcm: test if a BE can be prepared - [mips*] Move initrd_start check after initrd address sanitisation. - xen/blkfront: Only check REQ_FUA for writes - drm:amd:amdgpu: Fix missing buffer object unlock in failure path - [arm64,armhf] irqchip/gic: Correctly validate OF quirk descriptors - io_uring: hold uring mutex around poll removal (CVE-2023-3389) - epoll: ep_autoremove_wake_function should use list_del_init_careful - ocfs2: fix use-after-free when unmounting read-only filesystem - ocfs2: check new file size on fallocate call - nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() - nilfs2: fix possible out-of-bounds segment allocation in resize ioctl - kexec: support purgatories with .text.hot sections - [x86] purgatory: remove PGO flags - [powerpc*] purgatory: remove PGO flags - nouveau: fix client work fence deletion race - RDMA/uverbs: Restrict usage of privileged QKEYs - net: usb: qmi_wwan: add support for Compal RXM-G1 - ALSA: hda/realtek: Add a quirk for Compaq N14JP6 - Remove DECnet support from kernel (CVE-2023-3338) - USB: serial: option: add Quectel EM061KGL series - [arm64,armhf] usb: dwc3: gadget: Reset num TRBs before giving back the request - [arm64] spi: fsl-dspi: avoid SCK glitches with continuous transfers - netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM - [arm64] net: enetc: correct the indexes of highest and 2nd highest TCs - ping6: Fix send to link-local addresses with VRF. - net/sched: cls_u32: Fix reference counter leak leading to overflow (CVE-2023-3609) - RDMA/rxe: Remove the unused variable obj - RDMA/rxe: Removed unused name from rxe_task struct - RDMA/rxe: Fix the use-before-initialization error of resp_pkts - iavf: remove mask from iavf_irq_enable_queues() - RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions - RDMA/cma: Always set static rate to 0 for RoCE - IB/uverbs: Fix to consider event queue closing also upon non-blocking mode - IB/isert: Fix dead lock in ib_isert - IB/isert: Fix possible list corruption in CMA handler - IB/isert: Fix incorrect release of isert connection - ipvlan: fix bound dev checking for IPv6 l3s mode - sctp: fix an error code in sctp_sf_eat_auth() - igb: fix nvm.ops.read() error handling - drm/nouveau: don't detect DSM for non-NVIDIA device - drm/nouveau/dp: check for NULL nv_connector->native_mode - drm/nouveau: add nv_encoder pointer check for NULL - ext4: drop the call to ext4_error() from ext4_get_group_info() - net/sched: cls_api: Fix lockup on flushing explicitly created chain - net: tipc: resize nlattr array to correct size - afs: Fix vlserver probe RTT handling - cgroup: always put cset in cgroup_css_set_put_fork - rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period - neighbour: Remove unused inline function neigh_key_eq16() - net: Remove unused inline function dst_hold_and_use() - net: Remove DECnet leftovers from flow.h. - neighbour: delete neigh_lookup_nodev as not used - batman-adv: Switch to kstrtox.h for kstrtou64 - mmc: block: ensure error propagation for non-blk - mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block - nilfs2: reject devices with insufficient block count - media: dvbdev: Fix memleak in dvb_register_device - media: dvbdev: fix error logic at dvb_register_device() - media: dvb-core: Fix use-after-free due to race at dvb_register_device() - [x86] drm/i915/dg1: Wait for pcode/uncore handshake at startup - [x86] drm/i915/gen11+: Only load DRAM information from pcode https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.186 - drm/amd/display: fix the system hang while disable PSR - net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs - tracing: Add tracing_reset_all_online_cpus_unlocked() function - tick/common: Align tick period during sched_timer setup - nilfs2: fix buffer corruption due to concurrent device reads - [x86] Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs - [x86] PCI: hv: Fix a race condition bug in hv_pci_query_relations() - [x86] Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally" - [x86] PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev - [x86] PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic - cgroup: Do not corrupt task iteration when rebinding subsystem - [arm64] mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916 - [arm64] mmc: meson-gx: remove redundant mmc_request_done() call from irq context - [arm64,armhf] mmc: mmci: stm32: fix max busy timeout calculation - ip_tunnels: allow VXLAN/GENEVE to inherit TOS/TTL from VLAN - regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK - writeback: fix dereferencing NULL mapping->host on writeback_page_template - io_uring/net: save msghdr->msg_control for retries - io_uring/net: clear msg_controllen on partial sendmsg retry - io_uring/net: disable partial retries for recvmsg with cmsg - nilfs2: prevent general protection fault in nilfs_clear_dirty_page() - [x86] mm: Avoid using set_pgd() outside of real PGD pages - mm/pagealloc: sysctl: change watermark_scale_factor max limit to 30% - sysctl: move some boundary constants from sysctl.c to sysctl_vals - memfd: check for non-NULL file_seals in memfd_create() syscall - ieee802154: hwsim: Fix possible memory leaks - xfrm: Treat already-verified secpath entries as optional - xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c - xfrm: Ensure policies always checked on XFRM-I input path - bpf: track immediate values written to stack by BPF_ST instruction - bpf: Fix verifier id tracking of scalars on spill - xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets - xfrm: Linearize the skb after offloading if needed. - [armel,armhf] mmc: mvsdio: fix deferred probing - [armhf] mmc: omap: fix deferred probing - [armhf] mmc: omap_hsmmc: fix deferred probing - mmc: sdhci-acpi: fix deferred probing - ipvs: align inner_mac_header for encapsulation - be2net: Extend xmit workaround to BE3 chip - netfilter: nft_set_pipapo: .walk does not deal with generations - netfilter: nf_tables: disallow element updates of bound anonymous sets - netfilter: nfnetlink_osf: fix module autoload - Revert "net: phy: dp83867: perform soft reset and retain established link" - sch_netem: acquire qdisc lock in netem_change() - gpio: Allow per-parent interrupt data - gpiolib: Fix GPIO chip IRQ initialization restriction - scsi: target: iscsi: Prevent login threads from racing between each other - HID: wacom: Add error check to wacom_parse_and_register() - [arm64] Add missing Set/Way CMO encodings - media: cec: core: don't set last_initiator if tx in progress - nfcsim.c: Fix error checking for debugfs_create_dir - [i386] usb: gadget: udc: fix NULL dereference in remove() - [x86] Input: soc_button_array - add invalid acpi_index DMI quirk handling - [s390x] cio: unregister device when the only path is gone - [arm*] ASoC: simple-card: Add missing of_node_put() in case of error - [x86] ASoC: nau8824: Add quirk to active-high jack-detect - [armhf] dts: Fix erroneous ADS touchscreen polarities - drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl - [x86] apic: Fix kernel panic when booting with intremap=off and x2apic_phys - bpf/btf: Accept function names that contain dots https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.187 https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.188 - media: atomisp: fix "variable dereferenced before check 'asd'" - [x86] smp: Use dedicated cache-line for mwait_play_dead() - can: isotp: isotp_sendmsg(): fix return error fix on TX path - video: imsttfb: check for ioremap() failures - fbdev: imsttfb: Fix use after free bug in imsttfb_probe - HID: wacom: Use ktime_t rather than int when dealing with timestamps - HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651. - drm/amdgpu: Validate VM ioctl flags. - nubus: Partially revert proc_create_single_data() conversion - fs: pipe: reveal missing function protoypes - [x86] resctrl: Only show tasks' pid in current pid namespace - blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter - md/raid10: fix overflow of md/safe_mode_delay - md/raid10: fix wrong setting of max_corr_read_errors - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request - md/raid10: fix io loss while replacement replace rdev - irqchip/jcore-aic: Kill use of irq_create_strict_mappings() - irqchip/jcore-aic: Fix missing allocation of IRQ descriptors - posix-timers: Prevent RT livelock in itimer_delete() - tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode(). - clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe - PM: domains: fix integer overflow issues in genpd_parse_state() - perf/arm-cmn: Fix DTC reset - powercap: RAPL: Fix CONFIG_IOSF_MBI dependency - cpufreq: intel_pstate: Fix energy_performance_preference for passive - thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe() - rcuscale: Console output claims too few grace periods - rcuscale: Always log error message - rcuscale: Move shutdown from wait_event() to wait_event_idle() - rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup() - rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale - perf/ibs: Fix interface via core pmu events - [x86] mm: Fix __swp_entry_to_pte() for Xen PV guests - evm: Complete description of evm_inode_setattr() - pstore/ram: Add check for kstrdup - igc: Enable and fix RX hash usage by netstack - wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation - wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx - spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG - wifi: wilc1000: fix for absent RSN capabilities WFA testcase - wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan() - bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE - sctp: add bpf_bypass_getsockopt proto callback - nfc: constify several pointers to u8, char and sk_buff - nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() - regulator: core: Fix more error checking for debugfs_create_dir() - regulator: core: Streamline debugfs operations - wifi: orinoco: Fix an error handling path in spectrum_cs_probe() - wifi: orinoco: Fix an error handling path in orinoco_cs_probe() - wifi: atmel: Fix an error handling path in atmel_probe() - wl3501_cs: Fix misspelling and provide missing documentation - net: create netdev->dev_addr assignment helpers - wl3501_cs: use eth_hw_addr_set() - wifi: wl3501_cs: Fix an error handling path in wl3501_probe() - wifi: ray_cs: Utilize strnlen() in parse_addr() - wifi: ray_cs: Drop useless status variable in parse_addr() - wifi: ray_cs: Fix an error handling path in ray_probe() - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes - wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled - wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown - watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config - watchdog/perf: more properly prevent false positives with turbo modes - kexec: fix a memory leak in crash_shrink_memory() - memstick r592: make memstick_debug_get_tpc_name() static - wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() - rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO - wifi: iwlwifi: pull from TXQs with softirqs disabled - wifi: cfg80211: rewrite merging of inherited elements - wifi: ath9k: convert msecs to jiffies where needed - igc: Fix race condition in PTP tx code - net: stmmac: fix double serdes powerdown - netlink: fix potential deadlock in netlink_set_err() - netlink: do not hard code device address lenth in fdb dumps - gtp: Fix use-after-free in __gtp_encap_destroy(). - net: axienet: Move reset before 64-bit DMA detection - sfc: fix crash when reading stats while NIC is resetting - nfc: llcp: simplify llcp_sock_connect() error paths - net: nfc: Fix use-after-free caused by nfc_llcp_find_local (CVE-2023-3863) - lib/ts_bm: reset initial match offset for every block of text - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one - netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. - ipvlan: Fix return value of ipvlan_queue_xmit() - netlink: Add __sock_i_ino() for __netlink_diag_dump(). - radeon: avoid double free in ci_dpm_init() - drm/amd/display: Explicitly specify update type per plane info change - Input: drv260x - sleep between polling GO bit - drm/bridge: tc358768: always enable HS video mode - drm/bridge: tc358768: fix PLL parameters computation - drm/bridge: tc358768: fix PLL target frequency - drm/bridge: tc358768: fix TCLK_ZEROCNT computation - drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation - drm/bridge: tc358768: fix TCLK_TRAILCNT computation - drm/bridge: tc358768: fix THS_ZEROCNT computation - drm/bridge: tc358768: fix TXTAGOCNT computation - drm/bridge: tc358768: fix THS_TRAILCNT computation - drm/vram-helper: fix function names in vram helper doc - Input: adxl34x - do not hardcode interrupt trigger type - drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks` - drm/panel: sharp-ls043t1le01: adjust mode settings - bus: ti-sysc: Fix dispc quirk masking bool variables - [arm64] dts: microchip: sparx5: do not use PSCI on reference boards - RDMA/bnxt_re: Disable/kill tasklet only if it is enabled - RDMA/bnxt_re: Fix to remove unnecessary return labels - RDMA/bnxt_re: Use unique names while registering interrupts - RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid - RDMA/bnxt_re: Fix to remove an unnecessary log - ARM: dts: gta04: Move model property out of pinctrl node - [arm64] dts: qcom: msm8916: correct camss unit address - [arm64] dts: qcom: msm8994: correct SPMI unit address - [arm64] dts: qcom: msm8996: correct camss unit address - drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H - ARM: ep93xx: fix missing-prototype warnings - ARM: omap2: fix missing tick_broadcast() prototype - [arm64] dts: qcom: apq8096: fix fixed regulator name property - ARM: dts: stm32: Shorten the AV96 HDMI sound card name - memory: brcmstb_dpfe: fix testing array offset after use - ASoC: es8316: Increment max value for ALC Capture Target Volume control - ASoC: es8316: Do not set rate constraints for unsupported MCLKs - ARM: dts: meson8: correct uart_B and uart_C clock references - soc/fsl/qe: fix usb.c build errors - IB/hfi1: Use bitmap_zalloc() when applicable - IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors - IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate - RDMA: Remove uverbs_ex_cmd_mask values that are linked to functions - RDMA/hns: Fix coding style issues - RDMA/hns: Use refcount_t APIs for HEM - RDMA/hns: Clean the hardware related code for HEM - RDMA/hns: Fix hns_roce_table_get return value - ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier - fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() - [arm64] dts: ti: k3-j7200: Fix physical address of pin - ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 - ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx - hwmon: (gsc-hwmon) fix fan pwm temperature scaling - hwmon: (adm1275) enable adm1272 temperature reporting - hwmon: (adm1275) Allow setting sample averaging - hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272 - ARM: dts: BCM5301X: fix duplex-full => full-duplex - drm/radeon: fix possible division-by-zero errors - amdgpu: validate offset_in_bo of drm_amdgpu_gem_va - RDMA/bnxt_re: wraparound mbox producer index - RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context - clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe - clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() - clk: tegra: tegra124-emc: Fix potential memory leak - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer - drm/msm/dpu: do not enable color-management if DSPPs are not available - drm/msm/dp: Free resources after unregistering them - clk: vc5: check memory returned by kasprintf() - clk: cdce925: check return value of kasprintf() - clk: si5341: Allow different output VDD_SEL values - clk: si5341: Add sysfs properties to allow checking/resetting device faults - clk: si5341: return error if one synth clock registration fails - clk: si5341: check return value of {devm_}kasprintf() - clk: si5341: free unused memory on probe failure - clk: keystone: sci-clk: check return value of kasprintf() - clk: ti: clkctrl: check return value of kasprintf() - drivers: meson: secure-pwrc: always enable DMA domain - ovl: update of dentry revalidate flags after copy up - ASoC: imx-audmix: check return value of devm_kasprintf() - PCI: cadence: Fix Gen2 Link Retraining process - scsi: qedf: Fix NULL dereference in error handling - pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors - PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free - scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() - PCI: pciehp: Cancel bringup sequence if card is not present - PCI: ftpci100: Release the clock resources - PCI: Add pci_clear_master() stub for non-CONFIG_PCI - perf bench: Use unbuffered output when pipe/tee'ing to a file - perf bench: Add missing setlocale() call to allow usage of %'d style formatting - pinctrl: cherryview: Return correct value if pin in push-pull mode - perf dwarf-aux: Fix off-by-one in die_get_varname() - pinctrl: at91-pio4: check return value of devm_kasprintf() - [powerpc*] powernv/sriov: perform null check on iov before dereferencing iov - mm: rename pud_page_vaddr to pud_pgtable and make it return pmd_t * - mm: rename p4d_page_vaddr to p4d_pgtable and make it return pud_t * - [powerpc*] book3s64/mm: Fix DirectMap stats in /proc/meminfo - [powerpc*] mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary - hwrng: virtio - add an internal buffer - hwrng: virtio - don't wait on cleanup - hwrng: virtio - don't waste entropy - hwrng: virtio - always add a pending request - hwrng: virtio - Fix race on data_avail and actual data - crypto: nx - fix build warnings when DEBUG_FS is not enabled - modpost: fix section mismatch message for R_ARM_ABS32 - modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} - crypto: marvell/cesa - Fix type mismatch warning - modpost: fix off by one in is_executable_section() - NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION - dax: Fix dax_mapping_release() use after free - dax: Introduce alloc_dev_dax_id() - hwrng: st - keep clock enabled while hwrng is registered - io_uring: ensure IOPOLL locks around deferred work (CVE-2023-21400) - USB: serial: option: add LARA-R6 01B PIDs - usb: dwc3: gadget: Propagate core init errors to UDC during pullup - phy: tegra: xusb: Clear the driver reference in usb-phy dev - block: fix signed int overflow in Amiga partition support - block: change all __u32 annotations to __be32 in affs_hardblocks.h - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() - w1: w1_therm: fix locking behavior in convert_t - w1: fix loop in w1_fini() - serial: 8250: omap: Fix freeing of resources on failed register - clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks - media: usb: Check az6007_read() return value - media: videodev2.h: Fix struct v4l2_input tuner index comment - media: usb: siano: Fix warning due to null work_func_t function pointer (CVE-2023-4132) - clk: qcom: reset: Allow specifying custom reset delay - clk: qcom: reset: support resetting multiple bits - clk: qcom: ipq6018: fix networking resets - usb: dwc3: qcom: Fix potential memory leak - usb: gadget: u_serial: Add null pointer check in gserial_suspend - extcon: Fix kernel doc of property fields to avoid warnings - extcon: Fix kernel doc of property capability fields to avoid warnings - usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() - usb: hide unused usbfs_notify_suspend/resume functions - serial: 8250: lock port for stop_rx() in omap8250_irq() - serial: 8250: lock port for UART_IER access in omap8250_irq() - kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR - coresight: Fix loss of connection info when a module is unloaded - mfd: rt5033: Drop rt5033-battery sub-device - media: venus: helpers: Fix ALIGN() of non power of two - media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var() - [s390x] KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes - usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() - usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() - usb: common: usb-conn-gpio: Set last role to unknown before initial detection - usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe() - mfd: intel-lpss: Add missing check for platform_get_resource - Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection" - serial: 8250_omap: Use force_suspend and resume for system suspend - mfd: stmfx: Fix error path in stmfx_chip_init - mfd: stmfx: Nullify stmfx->vdd in case of error - [s390x] KVM: s390: vsie: fix the length of APCB bitmap - mfd: stmpe: Only disable the regulators if they are enabled - phy: tegra: xusb: check return value of devm_kzalloc() - pwm: imx-tpm: force 'real_period' to be zero in suspend - pwm: sysfs: Do not apply state to already disabled PWMs - rtc: st-lpc: Release some resources in st_rtc_probe() in case of error - media: cec: i2c: ch7322: also select REGMAP - sctp: fix potential deadlock on &net->sctp.addr_wq_lock - Add MODULE_FIRMWARE() for FIRMWARE_TG357766. - net: dsa: vsc73xx: fix MTU configuration - spi: bcm-qspi: return error if neither hif_mspi nor mspi is available - mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 - f2fs: fix error path handling in truncate_dnode() - octeontx2-af: Fix mapping for NIX block from CGX connection - [powerpc*] allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y - net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode - tcp: annotate data races in __tcp_oow_rate_limited() - xsk: Honor SO_BINDTODEVICE on bind - net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX - pptp: Fix fib lookup calls. - net: dsa: tag_sja1105: fix MAC DA patching from meta frames - [s390x] qeth: Fix vipa deletion - apparmor: fix missing error check for rhashtable_insert_fast - i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process() - i2c: xiic: Don't try to handle more interrupt events after error - ALSA: jack: Fix mutex call in snd_jack_report() - i2c: qup: Add missing unwind goto in qup_i2c_probe() - NFSD: add encoding of op_recall flag for write delegation - io_uring: wait interruptibly for request completions on exit - mmc: core: disable TRIM on Kingston EMMC04G-M627 - mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M - mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS - mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used. - bcache: fixup btree_cache_wait list damage - bcache: Remove unnecessary NULL point check in node allocations - bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent - integrity: Fix possible multiple allocation in integrity_inode_get() - autofs: use flexible array in ioctl structure - shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs - jffs2: reduce stack usage in jffs2_build_xattr_subsystem() - fs: avoid empty option when generating legacy mount string - ext4: Remove ext4 locking of moved directory - Revert "f2fs: fix potential corruption when moving a directory" - fs: Establish locking order for unrelated directories - fs: Lock moved directories - btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile - btrfs: fix race when deleting quota root from the dirty cow roots list - ARM: orion5x: fix d2net gpio initialization - leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename - fs: no need to check source - fanotify: disallow mount/sb marks on kernel internal pseudo fs - tpm, tpm_tis: Claim locality in interrupt handler - block: add overflow checks for Amiga partition support - netfilter: nf_tables: use net_generic infra for transaction data - netfilter: nf_tables: add rescheduling points during loop detection walks - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain - netfilter: nf_tables: reject unbound anonymous set before commit phase - netfilter: nf_tables: reject unbound chain set before commit phase - netfilter: nftables: rename set element data activation/deactivation functions - netfilter: nf_tables: drop map element references from preparation phase - netfilter: nf_tables: unbind non-anonymous set if rule construction fails - netfilter: nf_tables: fix scheduling-while-atomic splat - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free - wireguard: queueing: use saner cpu selection wrapping - wireguard: netlink: send staged packets when setting initial private key - tty: serial: fsl_lpuart: add earlycon for imx8ulp platform - rcu-tasks: Mark ->trc_reader_nesting data races - rcu-tasks: Mark ->trc_reader_special.b.need_qs data races - rcu-tasks: Simplify trc_read_check_handler() atomic operations - block/partition: fix signedness issue for Amiga partitions - io_uring: Use io_schedule* in cqring wait - io_uring: add reschedule point to handle_tw_list() - net: lan743x: Don't sleep in atomic context - workqueue: clean up WORK_* constant types, clarify masking - drm/panel: simple: Add connector_type for innolux_at043tn24 - drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags - igc: Remove delay during TX ring configuration - net/mlx5e: fix double free in mlx5e_destroy_flow_table - net/mlx5e: Check for NOT_READY flag state after locking - igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings - scsi: qla2xxx: Fix error code in qla2x00_start_sp() - net: mvneta: fix txq_map in case of txq_number==1 - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (CVE-2023-3776) - gve: Set default duplex configuration to full - ionic: remove WARN_ON to prevent panic_on_warn - net: bgmac: postpone turning IRQs off to avoid SoC hangs - net: prevent skb corruption on frag list segmentation - icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). - udp6: fix udp6_ehashfn() typo - ntb: idt: Fix error handling in idt_pci_driver_init() - NTB: amd: Fix error handling in amd_ntb_pci_driver_init() - ntb: intel: Fix error handling in intel_ntb_pci_driver_init() - NTB: ntb_transport: fix possible memory leak while device_register() fails - NTB: ntb_tool: Add check for devm_kcalloc - ipv6/addrconf: fix a potential refcount underflow for idev - [x86] platform/x86: wmi: remove unnecessary argument - [x86] platform/x86: wmi: use guid_t and guid_equal() - [x86] platform/x86: wmi: move variables - [x86] platform/x86: wmi: Break possible infinite loop when parsing GUID - igc: Fix launchtime before start of cycle - igc: Fix inserting of empty frame for launchtime - riscv: bpf: Move bpf_jit_alloc_exec() and bpf_jit_free_exec() to core - erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF - wifi: airo: avoid uninitialized warning in airo_get_rate() - net/sched: flower: Ensure both minimum and maximum ports are specified - netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write() - net/sched: make psched_mtu() RTNL-less safe - net/sched: sch_qfq: refactor parsing of netlink parameters - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (CVE-2023-3611) - nvme-pci: fix DMA direction of unmapping integrity data - f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io() (CVE-2023-2898) - pinctrl: amd: Fix mistake in handling clearing pins at startup - pinctrl: amd: Detect internal GPIO0 debounce handling - pinctrl: amd: Only use special debounce behavior for GPIO 0 - tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation - mtd: rawnand: meson: fix unaligned DMA buffers handling - net: bcmgenet: Ensure MDIO unregistration has clocks enabled - [powerpc*] Fail build if using recordmcount with binutils v2.37 - misc: fastrpc: Create fastrpc scalar with correct buffer count - erofs: fix compact 4B support for 16k block size - ext4: Fix reusing stale buffer heads from last failed mounting - ext4: fix wrong unit use in ext4_mb_clear_bb - ext4: get block from bh in ext4_free_blocks for fast commit replay - ext4: fix wrong unit use in ext4_mb_new_blocks - ext4: only update i_reserved_data_blocks on successful block allocation - jfs: jfs_dmap: Validate db_l2nbperpage while mounting - hwrng: imx-rngc - fix the timeout for init and self check - PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold - PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 - PCI: qcom: Disable write access to read only registers for IP v2.3.3 - PCI: rockchip: Assert PCI Configuration Enable bit after probe - PCI: rockchip: Write PCI Device ID to correct register - PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked - PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core - PCI: rockchip: Use u32 variable to access 32-bit registers - PCI: rockchip: Set address alignment for endpoint mode - misc: pci_endpoint_test: Free IRQs before removing the device - misc: pci_endpoint_test: Re-init completion for every test - md/raid0: add discard support for the 'original' layout - fs: dlm: return positive pid value for F_GETLK - drm/atomic: Allow vblank-enabled + self-refresh "disable" - drm/rockchip: vop: Leave vblank enabled in self-refresh - drm/amd/display: Correct `DMUB_FW_VERSION` macro - serial: atmel: don't enable IRQs prematurely - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk - firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool() - ceph: don't let check_caps skip sending responses for revoke msgs - xhci: Fix resume issue of some ZHAOXIN hosts - xhci: Fix TRB prefetch issue of ZHAOXIN hosts - xhci: Show ZHAOXIN xHCI root hub speed correctly - meson saradc: fix clock divider mask length - Revert "8250: add support for ASIX devices with a FIFO bug" - [s390x] decompressor: fix misaligned symbol build error - tracing/histograms: Add histograms to hist_vars if they have referenced variables - net: ena: fix shift-out-of-bounds in exponential backoff - ring-buffer: Fix deadloop issue on reading trace_pipe - tracing: Fix null pointer dereference in tracing_err_log_open() - tracing/probes: Fix not to count error code to total length - scsi: qla2xxx: Wait for io return on terminate rport - scsi: qla2xxx: Array index may go out of bound - scsi: qla2xxx: Fix buffer overrun - scsi: qla2xxx: Fix potential NULL pointer dereference - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() - scsi: qla2xxx: Correct the index of array - scsi: qla2xxx: Pointer may be dereferenced - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue - net/sched: sch_qfq: reintroduce lmax bound check for MTU - RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests - drm/atomic: Fix potential use-after-free in nonblocking commits - ALSA: hda/realtek - remove 3k pull low procedure - ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx - keys: Fix linking a duplicate key to a keyring's assoc_array - perf probe: Add test for regression introduced by switch to die_get_decl_file() - btrfs: fix warning when putting transaction with qgroups enabled after abort - fuse: revalidate: don't invalidate if interrupted - regmap: Drop initial version of maximum transfer length fixes - regmap: Account for register length in SMBus I/O limits - can: bcm: Fix UAF in bcm_proc_show() - drm/client: Fix memory leak in drm_client_target_cloned - drm/client: Fix memory leak in drm_client_modeset_probe - ASoC: fsl_sai: Disable bit clock with transmitter - ext4: correct inline offset when handling xattrs in inode body - debugobjects: Recheck debug_objects_enabled before reporting - nbd: Add the maximum limit of allocated index in nbd_dev_add - md: fix data corruption for raid456 when reshape restart while grow up - md/raid10: prevent soft lockup while flush writes - posix-timers: Ensure timer ID search-loop limit is valid - btrfs: add xxhash to fast checksum implementations - ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A - ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3 - ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version) - [arm64] set __exception_irq_entry with __irq_entry as a default - [arm64] mm: fix VA-range sanity check - sched/fair: Don't balance task to its current running CPU - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range - bpf: Address KCSAN report on bpf_lru_list - devlink: report devlink_port_type_warn source device - wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() - wifi: iwlwifi: mvm: avoid baid size integer overflow - igb: Fix igb_down hung on surprise removal - spi: bcm63xx: fix max prepend length - fbdev: imxfb: warn about invalid left/right margin - pinctrl: amd: Use amd_pinconf_set() for all config options - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field() - bridge: Add extack warning when enabling STP in netns. - iavf: Fix use-after-free in free_netdev - iavf: Fix out-of-bounds when setting channels on remove - security: keys: Modify mismatched function name - octeontx2-pf: Dont allocate BPIDs for LBK interfaces - tcp: annotate data-races around tcp_rsk(req)->ts_recent - net: ipv4: Use kfree_sensitive instead of kfree - net:ipv6: check return value of pskb_trim() - Revert "tcp: avoid the lookup process failing to get sk in ehash table" - fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe - llc: Don't drop packet from non-root netns. - netfilter: nf_tables: fix spurious set element insertion failure - netfilter: nf_tables: can't schedule in nft_chain_validate - netfilter: nft_set_pipapo: fix improper element removal (CVE-2023-4004) - netfilter: nf_tables: skip bound chain in netns release path - netfilter: nf_tables: skip bound chain on rule flush - tcp: annotate data-races around tp->tcp_tx_delay - tcp: annotate data-races around tp->keepalive_time - tcp: annotate data-races around tp->keepalive_intvl - tcp: annotate data-races around tp->keepalive_probes - net: Introduce net.ipv4.tcp_migrate_req. - tcp: Fix data-races around sysctl_tcp_syn(ack)?_retries. - tcp: annotate data-races around icsk->icsk_syn_retries - tcp: annotate data-races around tp->linger2 - tcp: annotate data-races around rskq_defer_accept - tcp: annotate data-races around tp->notsent_lowat - tcp: annotate data-races around icsk->icsk_user_timeout - tcp: annotate data-races around fastopenq.max_qlen - net: phy: prevent stale pointer dereference in phy_init() - tracing/histograms: Return an error if we fail to add histogram to hist_vars list - tracing: Fix memory leak of iter->temp when reading trace_pipe - ftrace: Store the order of pages allocated in ftrace_page - ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.189 - xen/netback: Fix buffer overrun triggered by unusual packet (CVE-2023-34319) - [x86] fix backwards merge of GDS/SRSO bit https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.190 - [s390x] KVM: s390: pv: fix index value of replaced ASCE - io_uring: don't audit the capability check in io_uring_create() - btrfs: fix race between quota disable and relocation - btrfs: fix extent buffer leak after tree mod log failure at split_node() - i2c: Delete error messages for failed memory allocations - i2c: Improve size determinations - PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link() - PCI/ASPM: Factor out pcie_wait_for_retrain() - PCI/ASPM: Avoid link retraining race - dlm: cleanup plock_op vs plock_xop - dlm: rearrange async condition return - fs: dlm: interrupt posix locks only when process is killed - drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2 - drm/ttm: never consider pinned BOs for eviction&swap - tracing: Show real address for trace event arguments - [arm64,armhf] pwm: meson: Simplify duplicated per-channel tracking - [arm64,armhf] pwm: meson: fix handling of period/duty if greater than UINT_MAX - ext4: fix to check return value of freeze_bdev() in ext4_shutdown() - i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() - net: phy: marvell10g: fix 88x3310 power up - [arm64] net: hns3: reconstruct function hclge_ets_validate() - [arm64] net: hns3: fix wrong bw weight of disabled tc issue - vxlan: move to its own directory - vxlan: calculate correct header length for GPE - phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() - ethernet: atheros: fix return value check in atl1e_tso_csum() - ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address - tcp: Reduce chance of collisions in inet6_hashfn(). (CVE-2023-1206) - ice: Fix memory management in ice_ethtool_fdir.c - bonding: reset bond's flags when down link is P2P device - team: reset team's flags when down link is P2P device - [x86] platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 - netfilter: nft_set_rbtree: fix overlap expiration walk - netfilter: nftables: add helper function to validate set element data - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (CVE-2023-4147) - net/sched: mqprio: refactor nlattr parsing to a separate function - net/sched: mqprio: add extack to mqprio_parse_nlattr() - net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 - benet: fix return value check in be_lancer_xmit_workarounds() - tipc: check return value of pskb_trim() - tipc: stop tipc crypto on failure in tipc_node_create - RDMA/mlx4: Make check for invalid flags stricter - drm/msm/dpu: drop enum dpu_core_perf_data_bus_id - drm/msm/adreno: Fix snapshot BINDLESS_DATA size - RDMA/mthca: Fix crash when polling CQ for shared QPs - drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb() - [armhf] ASoC: fsl_spdif: Silence output on stop - block: Fix a source code comment in include/uapi/linux/blkzoned.h - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths - dm raid: clean up four equivalent goto tags in raid_ctr() - dm raid: protect md_stop() with 'reconfig_mutex' - ata: pata_ns87415: mark ns87560_tf_read static - ring-buffer: Fix wrong stat of cpu_buffer->read - tracing: Fix warning in trace_buffered_event_disable() - Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()" - USB: gadget: Fix the memory leak in raw_gadget driver - serial: 8250_dw: Preserve original value of DLF register - USB: serial: option: support Quectel EM060K_128 - USB: serial: option: add Quectel EC200A module support - USB: serial: simple: add Kaufmann RKS+CAN VCP - USB: serial: simple: sort driver entries - can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED - Revert "usb: dwc3: core: Enable AutoRetry feature in the controller" - usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy - usb: dwc3: don't reset device side if dwc3 was configured as host-only - usb: ohci-at91: Fix the unhandle interrupt when resume - USB: quirks: add quirk for Focusrite Scarlett - usb: xhci-mtk: set the dma max_seg_size - Revert "usb: xhci: tegra: Fix error check" - Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group - Documentation: security-bugs.rst: clarify CVE handling - staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() - tty: n_gsm: fix UAF in gsm_cleanup_mux - ALSA: hda/relatek: Enable Mute LED on HP 250 G8 - hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled - btrfs: check for commit error at btrfs_attach_transaction_barrier() - file: always lock position for FMODE_ATOMIC_POS - nfsd: Remove incorrect check in nfsd4_validate_stateid - tpm_tis: Explicitly check for error code - [arm64,armhf] irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation - [x86] KVM: VMX: Invert handling of CR0.WP for EPT without unrestricted guest - [x86] KVM: VMX: Fold ept_update_paging_mode_cr0() back into vmx_set_cr0() - [x86] KVM: nVMX: Do not clear CR3 load/store exiting bits if L1 wants 'em - [x86] KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest - staging: rtl8712: Use constants from - staging: r8712: Fix memory leak in _r8712_init_xmit_priv() - btrfs: check if the transaction was aborted at btrfs_wait_for_commit() - virtio-net: fix race between set queues and probe - [s390x] dasd: fix hanging device after quiesce/resume - [arm64] ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register - ceph: never send metrics if disable_send_metrics is set - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress - drm/ttm: make ttm_bo_unpin more defensive - ACPI: processor: perflib: Use the "no limit" frequency QoS - ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily - [x86] cpufreq: intel_pstate: Drop ACPI _PSS states table patching - io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq - [armel,armhf] ASoC: cs42l51: fix driver to properly autoload with automatic module loading - [x86] kprobes/x86: Fix fall-through warnings for Clang - [x86] kprobes: Do not decode opcode in resume_execution() - [x86] kprobes: Retrieve correct opcode for group instruction - [x86] kprobes: Identify far indirect JMP correctly - [x86] kprobes: Use int3 instead of debug trap for single-step - [x86] kprobes: Fix to identify indirect jmp and others using range case - [x86] kprobes: Move 'inline' to the beginning of the kprobe_is_ss() declaration - [x86] kprobes: Update kcb status flag after singlestepping - [x86] kprobes: Fix JNG/JNLE emulation - io_uring: gate iowait schedule on having pending requests - perf: Fix function pointer case - loop: Select I/O scheduler 'none' from inside add_disk() - [arm64] dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux - word-at-a-time: use the same return type for has_zero regardless of endianness - [s390x] KVM: s390: fix sthyi error handling - wifi: cfg80211: Fix return value in scan logic - net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx - net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() - bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing - rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length - [armhf] net: dsa: fix value check in bcm_sf2_sw_probe() - net: sched: cls_u32: Fix match key mis-addressing - mISDN: hfcpci: Fix potential deadlock on &hc->lock - net: annotate data-races around sk->sk_max_pacing_rate - net: add missing READ_ONCE(sk->sk_rcvlowat) annotation - net: add missing READ_ONCE(sk->sk_sndbuf) annotation - net: add missing READ_ONCE(sk->sk_rcvbuf) annotation - net: add missing data-race annotations around sk->sk_peek_off - net: add missing data-race annotation for sk_ll_usec - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (CVE-2023-4128) - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (CVE-2023-4128) - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (CVE-2023-4128) - bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire - net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode - net: dcb: choose correct policy to parse DCB_ATTR_BCN - [s390x] qeth: Don't call dev_close/dev_open (DOWN/UP) - ip6mr: Fix skb_under_panic in ip6mr_cache_report() - vxlan: Fix nexthop hash size - net/mlx5: fs_core: Make find_closest_ft more generic - net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio - tcp_metrics: fix addr_same() helper - tcp_metrics: annotate data-races around tm->tcpm_stamp - tcp_metrics: annotate data-races around tm->tcpm_lock - tcp_metrics: annotate data-races around tm->tcpm_vals[] - tcp_metrics: annotate data-races around tm->tcpm_net - tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen - scsi: zfcp: Defer fc_rport blocking until after ADISC response - libceph: fix potential hang in ceph_osdc_notify() - USB: zaurus: Add ID for A-300/B-500/C-700 - ceph: defer stopping mdsc delayed_work - exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree - exfat: release s_lock before calling dir_emit() - [arm64] dts: stratix10: fix incorrect I2C property for SCL signal - net: tun_chr_open(): set sk_uid from current_fsuid() (CVE-2023-4194) - net: tap_open(): set sk_uid from current_fsuid() (CVE-2023-4194) - bpf: Disable preemption in bpf_event_output - open: make RESOLVE_CACHED correctly test for O_TMPFILE - drm/ttm: check null pointer before accessing when swapping - file: reinstate f_pos locking optimization for regular files - tracing: Fix sleeping while atomic in kdb ftdump - fs/sysv: Null check to prevent null-ptr-deref bug - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (CVE-2023-40283) - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb - fs: Protect reconfiguration of sb read-write from racing writes - [powerpc*] mm/altmap: Fix altmap boundary check - soundwire: bus: add better dev_dbg to track complete() calls - soundwire: bus: pm_runtime_request_resume on peripheral attachment - soundwire: fix enumeration completion - PM / wakeirq: support enabling wake-up irq after runtime_suspend called - PM: sleep: wakeirq: fix wake irq arming - exfat: speed up iterate/lookup by fixing start point of traversing cluster chain - exfat: support dynamic allocate bh for exfat_entry_set_cache - exfat: check if filename entries exceeds max filename length (CVE-2023-4273) - mt76: move band capabilities in mt76_phy - mt76: mt7615: Fix fall-through warnings for Clang - wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC) - [x86] CPU/AMD: Do not leak quotient data after a division by 0 (CVE-2023-20588) https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.191 - wireguard: allowedips: expand maximum node depth - ipv6: adjust ndisc_is_useropt() to also return true for PIO - bpf: allow precision tracking for programs with subprogs - bpf: stop setting precise in current state - bpf: aggressively forget precise markings during state checkpointing - [arm64,armhf] dmaengine: pl330: Return DMA_PAUSED when transaction is paused - drm/nouveau/gr: enable memory loads on helper invocation on all channels - drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap() - drm/amd/display: check attr flag before set cursor degamma on DCN3+ - [x86] x86/pkeys: Revert a5eff7259790 ("x86/pkeys: Add PKRU value to init_fpstate") (Closes: #1044518) - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput - io_uring: correct check for O_TMPFILE - [arm64] iio: cros_ec: Fix the allocation size for cros_ec_command - [arm*] binder: fix memory leak in binder_init() - usb-storage: alauda: Fix uninit-value in alauda_check_media() - [arm64,armhf] usb: dwc3: Properly handle processing of pending events - [arm64,armhf] usb: common: usb-conn-gpio: Prevent bailing out if initial role is none - [x86] cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 - [x86] mm: Fix VDSO and VVAR placement on 5-level paging machines - [x86] speculation: Add cpu_show_gds() prototype - [x86] Move gds_ucode_mitigated() declaration to header - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes - mISDN: Update parameter type of dsp_cmx_send() - net/packet: annotate data-races around tp->status - tunnels: fix kasan splat when generating ipv4 pmtu error - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves - dccp: fix data-race around dp->dccps_mss_cache - drivers: net: prevent tun_build_skb() to exceed the packet size limit - [amd64] IB/hfi1: Fix possible panic during hotplug remove - wifi: cfg80211: fix sband iftype data lookup for AP_VLAN - net: phy: at803x: remove set/get wol callbacks for AR8032 - [arm64] net: hns3: refactor hclge_mac_link_status_wait for interface reuse - [arm64] net: hns3: add wait until mac link down - net/mlx5: Allow 0 for total host VFs - btrfs: don't stop integrity writeback too early - btrfs: set cache_block_group_error if we find an error - nvme-tcp: fix potential unbalanced freeze & unfreeze - nvme-rdma: fix potential unbalanced freeze & unfreeze - netfilter: nf_tables: report use refcount overflow - scsi: core: Fix legacy /proc parsing buffer overflow - [x86] scsi: storvsc: Fix handling of virtual Fibre Channel timeouts - scsi: snic: Fix possible memory leak if device_add() fails - scsi: core: Fix possible memory leak if device_add() fails - scsi: qedi: Fix firmware halt over suspend and resume - scsi: qedf: Fix firmware halt over suspend and resume - sch_netem: fix issues in netem_change() vs get_dist_table() [ Ben Hutchings ] * d/b/test-patches: Fix installability; improve robustness and efficiency (Closes: #871216, #1035359): - d/b/gencontrol.py: Add optional extra config dir debian/config.local - d/b/gencontrol.py: Add support for noudeb build profile - d/b/test-patches: Change ABI name to make packages co-installable - d/b/test-patches: Make debug info optional and disabled by default - d/b/test-patches: Build a linux-headers-common package as well - d/b/test-patches: Tolerate missing d/control, d/rules.gen, or d/p/test - d/b/test-patches: Detect flavour correctly when running backported kernel - Add pkg.linux.mintools profile for building minimal userland tools - d/b/test-patches: Build linux-{kbuild,bootwrapper} packages [ Salvatore Bonaccorso ] * [rt] Update to 5.10.180-rt88 * Bump ABI to 25 * Drop unknown config setting NET_CLS_TCINDEX * Drop unknown config setting BLK_DEV_SX8 * [rt] Update to 5.10.184-rt90 * Drop "decnet: Disable auto-loading as mitigation against local exploits" * Drop now unknown config options for DECnet support * [rt] Update to 5.10.186-rt91 -- Salvatore Bonaccorso Wed, 16 Aug 2023 22:52:03 +0200 linux (5.10.179-5) bullseye-security; urgency=high * Fix "init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init()" backport -- Salvatore Bonaccorso Tue, 08 Aug 2023 13:22:46 +0200 linux (5.10.179-4) bullseye-security; urgency=high [ Salvatore Bonaccorso ] * [x86] Add mitigations for Gather Data Sampling (GDS) (CVE-2022-40982) - init: Provide arch_cpu_finalize_init() - x86/cpu: Switch to arch_cpu_finalize_init() - ARM: cpu: Switch to arch_cpu_finalize_init() - ia64/cpu: Switch to arch_cpu_finalize_init() - m68k/cpu: Switch to arch_cpu_finalize_init() - mips/cpu: Switch to arch_cpu_finalize_init() - sh/cpu: Switch to arch_cpu_finalize_init() - sparc/cpu: Switch to arch_cpu_finalize_init() - um/cpu: Switch to arch_cpu_finalize_init() - init: Remove check_bugs() leftovers - init: Invoke arch_cpu_finalize_init() earlier - init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() - x86/fpu: Remove cpuinfo argument from init functions - x86/fpu: Mark init functions __init - x86/fpu: Move FPU initialization into arch_cpu_finalize_init() - x86/speculation: Add Gather Data Sampling mitigation - x86/speculation: Add force option to GDS mitigation - x86/speculation: Add Kconfig option for GDS - KVM: Add GDS_NO support to KVM - x86/xen: Fix secondary processors' FPU initialization - x86/mm: fix poking_init() for Xen PV guests - x86/mm: Use mm_alloc() in poking_init() - mm: Move mm_cachep initialization to mm_init() - x86/mm: Initialize text poking earlier [ Ben Hutchings ] * Documentation/x86: Fix backwards on/off logic about YMM support * [x86] Add a Speculative RAS Overflow (SRSO) mitigation (CVE-2023-20569) - x86/cpu: Add VM page flush MSR availablility as a CPUID feature - x86/cpufeatures: Assign dedicated feature word for CPUID_0x8000001F[EAX] - tools headers cpufeatures: Sync with the kernel sources - x86/bugs: Increase the x86 bugs vector size to two u32s - x86/cpu, kvm: Add support for CPUID_80000021_EAX - x86/srso: Add a Speculative RAS Overflow mitigation - x86/srso: Add IBPB_BRTYPE support - x86/srso: Add SRSO_NO support - x86/srso: Add IBPB - x86/srso: Add IBPB on VMEXIT - x86/srso: Fix return thunks in generated code - x86/srso: Tie SBPB bit setting to microcode patch detection * Bump ABI to 24 -- Ben Hutchings Tue, 08 Aug 2023 02:33:54 +0200 linux (5.10.179-3) bullseye-security; urgency=high [ Salvatore Bonaccorso ] * [x86] microcode/AMD: Load late on both threads too * [x86] cpu/amd: Move the errata checking functionality up * [x86] cpu/amd: Add a Zenbleed fix (CVE-2023-20593) * netfilter: nftables: statify nft_parse_register() * netfilter: nf_tables: validate registers coming from userspace. * netfilter: nf_tables: hold mutex on netns pre_exit path * netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (CVE-2023-3390) * Ignore ABI changes for nft_parse_register (dropped with 08a01c11a5bb ("netfilter: nftables: statify nft_parse_register()")) [ Ben Hutchings ] * netfilter: nf_tables: fix chain binding transaction logic (CVE-2023-3610) -- Salvatore Bonaccorso Fri, 28 Jul 2023 00:17:15 +0200 linux (5.10.179-2) bullseye-security; urgency=high * ipv6: rpl: Fix Route of Death. (CVE-2023-2156) * netfilter: nf_tables: do not ignore genmask when looking up chain by id (CVE-2023-31248) * netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (CVE-2023-35001) -- Salvatore Bonaccorso Fri, 14 Jul 2023 22:24:08 +0200 linux (5.10.179-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.179 - [arm64] dts: qcom: ipq8074-hk01: enable QMP device, not the PHY node - netfilter: br_netfilter: fix recent physdev match breakage - [arm64,armhf] regulator: fan53555: Explicitly include bits header - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (CVE-2023-31436) - virtio_net: bugfix overflow inside xdp_linearize_page() - sfc: Split STATE_READY in to STATE_NET_DOWN and STATE_NET_UP. - sfc: Fix use-after-free due to selftest_work - netfilter: nf_tables: fix ifdef to also consider nf_tables=m - i40e: fix accessing vsi->active_filters without holding lock - i40e: fix i40e_setup_misc_vector() error handling - mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() - net: rpl: fix rpl header size calculation - bpf: Fix incorrect verifier pruning due to missing register precision taints - e1000e: Disable TSO on i219-LM card to increase speed - f2fs: Fix f2fs_truncate_partial_nodes ftrace event - Input: i8042 - add quirk for Fujitsu Lifebook A574/H - scsi: megaraid_sas: Fix fw_crash_buffer_show() - scsi: core: Improve scsi_vpd_inquiry() checks - [s390x] ptrace: fix PTRACE_GET_LAST_BREAK error handling - nvme-tcp: fix a possible UAF when failing to allocate an io queue - xen/netback: use same error messages for same errors - xfs: drop submit side trans alloc for append ioends - iio: light: tsl2772: fix reading proximity-diodes from device tree - nilfs2: initialize unused bytes in segment summary blocks - memstick: fix memory leak if card device is never registered - kernel/sys.c: fix and improve control flow in __sys_setres[ug]id() - mm/khugepaged: check again on anon uffd-wp during isolation - sched/uclamp: Make task_fits_capacity() use util_fits_cpu() - sched/uclamp: Fix fits_capacity() check in feec() - sched/uclamp: Make select_idle_capacity() use util_fits_cpu() - sched/uclamp: Make asym_fits_capacity() use util_fits_cpu() - sched/uclamp: Make cpu_overutilized() use util_fits_cpu() - sched/uclamp: Cater for uclamp in find_energy_efficient_cpu()'s early exit condition - sched/fair: Detect capacity inversion - sched/fair: Consider capacity inversion in util_fits_cpu() - sched/uclamp: Fix a uninitialized variable warnings - sched/fair: Fixes for capacity inversion detection - virtiofs: clean up error handling in virtio_fs_get_tree() - virtiofs: split requests that exceed virtqueue size - fuse: check s_root when destroying sb - fuse: fix attr version comparison in fuse_read_update_size() - fuse: always revalidate rename target dentry - fuse: fix deadlock between atomic O_TRUNC and page invalidation - Revert "ext4: fix use-after-free in ext4_xattr_set_entry" - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() - ext4: fix use-after-free in ext4_xattr_set_entry - udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). - tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). - inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). - dccp: Call inet6_destroy_sock() via sk->sk_destruct(). - sctp: Call inet6_destroy_sock() via sk->sk_destruct(). - [arm64,armhf] pwm: meson: Explicitly set .polarity in .get_state() - ASN.1: Fix check for strdup() success [ Salvatore Bonaccorso ] * netfilter: nf_tables: deactivate anonymous set from preparation phase (CVE-2023-32233) * [rt] Refresh "sched/hotplug: Ensure only per-cpu kthreads run during hotplug" * Bump ABI to 23 * ovl: fail on invalid uid/gid mapping at copy up (CVE-2023-0386) * [x86] KVM: x86: hyper-v: Avoid calling kvm_make_vcpus_request_mask() with vcpu_mask==NULL (Closes: #1035779) -- Salvatore Bonaccorso Fri, 12 May 2023 06:08:40 +0200 linux (5.10.178-3) bullseye; urgency=medium * [mips*] Define RUNTIME_DISCARD_EXIT in LD script -- Salvatore Bonaccorso Sat, 22 Apr 2023 14:24:15 +0200 linux (5.10.178-2) bullseye; urgency=medium * docs: futex: Fix kernel-doc references after code split-up preparation * powerpc/doc: Fix htmldocs errors -- Salvatore Bonaccorso Sat, 22 Apr 2023 00:51:39 +0200 linux (5.10.178-1) bullseye; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.163 - [arm64,armhf] usb: musb: remove extra check in musb_gadget_vbus_draw - [arm64] dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins - [armhf] dts: stm32: Drop stm32mp15xc.dtsi from Avenger96 - [arm64] perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() - [arm64] dts: armada-3720-turris-mox: Add missing interrupt for RTC - pstore/ram: Fix error return code in ramoops_probe() - [armhf] mmp: fix timer_read delay - pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP - sched/fair: Cleanup task_util and capacity type - sched/uclamp: Fix relationship between uclamp and migration margin - cpuidle: dt: Return the correct numbers of parsed idle states - PM: hibernate: Fix mistake in kerneldoc comment - fs: don't audit the capability check in simple_xattr_list() - perf: Fix possible memleak in pmu_dev_alloc() - [x86] platform/x86: huawei-wmi: fix return value calculation - timerqueue: Use rb_entry_safe() in timerqueue_getnext() - lib/fonts: fix undefined behavior in bit shift for get_default_font - ocfs2: fix memory leak in ocfs2_stack_glue_init() - PNP: fix name memory leak in pnp_alloc_dev() - [x86] perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() - [x86] perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() - [x86] perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box() - [arm64] platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() - [arm64] irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() - [amd64] EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() - nfsd: don't call nfsd_file_put from client states seqfile display - genirq/irqdesc: Don't try to remove non-existing sysfs files - [x86] cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() - libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value - lib/notifier-error-inject: fix error when writing -errno to debugfs file - docs: fault-injection: fix non-working usage of negative values - debugfs: fix error when writing negative value to atomic_t debugfs file - ocfs2: ocfs2_mount_volume does cleanup job before return error - ocfs2: rewrite error handling of ocfs2_fill_super - ocfs2: fix memory leak in ocfs2_mount_volume() - rapidio: fix possible name leaks when rio_add_device() fails - rapidio: rio: fix possible name leak in rio_register_mport() - futex: Move to kernel/futex/ - futex: Resend potentially swallowed owner death notification - cpu/hotplug: Make target_store() a nop when target == state - [armhf] clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock() - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() - [x86] uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix - [x86] xen: Fix memory leak in xen_smp_intr_init{_pv}() - [x86] xen: Fix memory leak in xen_init_lock_cpu() - xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() - PM: runtime: Improve path in rpm_idle() when no callback - PM: runtime: Do not call __rpm_callback() from rpm_idle() - [x86] platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() - [x86] platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register() - fs: sysv: Fix sysv_nblocks() returns wrong value - rapidio: fix possible UAF when kfifo_alloc() fails - eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD - relay: fix type mismatch when allocating memory in relay_create_buf() - hfs: Fix OOB Write in hfs_asc2mac - rapidio: devices: fix missing put_device in mport_cdev_open - wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() - wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() - wifi: rtl8xxxu: Fix reading the vendor of combo chips - [arm64] drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge - [armhf] media: coda: jpeg: Add check for kmalloc - [arm64] venus: pm_helpers: Fix error check in vcodec_domains_get() - can: kvaser_usb: do not increase tx statistics when sending error message frames - can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device - can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event - can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT - can: kvaser_usb_leaf: Set Warning state even without bus errors - can: kvaser_usb_leaf: Fix improved state not being reported - can: kvaser_usb_leaf: Fix wrong CAN state after stopping - can: kvaser_usb_leaf: Fix bogus restart events - can: kvaser_usb: Add struct kvaser_usb_busparams - can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming - spi: Update reference to struct spi_controller - ima: Fix fall-through warnings for Clang - ima: Handle -ESTALE returned by ima_filter_rule_match() - [arm64] drm/msm/hdmi: switch to drm_bridge_connector - [arm64] drm/msm/hdmi: drop unused GPIO support - bpf: Fix slot type check in check_stack_write_var_off - media: vivid: fix compose size exceed boundary - bpf: propagate precision in ALU/ALU64 operations - bpf: Check the other end of slot_type for STACK_SPILL - bpf: propagate precision across all frames, not just the last one - mtd: Fix device name leak when register device failed in add_mtd_device() - wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port - rxrpc: Fix ack.bufferSize to be 0 when generating an ack - drm/radeon: Add the missed acpi_put_table() to fix memory leak - regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() - amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() - drm/fourcc: Add packed 10bit YUV 4:2:0 format - drm/fourcc: Fix vsub/hsub for Q410 and Q401 - integrity: Fix memory leakage in keyring allocation error path - ima: Fix misuse of dereference of pointer in template_desc_init_fields() - wifi: ath10k: Fix return value in ath10k_pci_init() - mtd: lpddr2_nvm: Fix possible null-ptr-deref - Input: elants_i2c - properly handle the reset GPIO when power is off - media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init() - media: solo6x10: fix possible memory leak in solo_sysfs_init() - inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict() - bpf: Move skb->len == 0 checks into __bpf_redirect - HID: hid-sensor-custom: set fixed size for custom attributes - ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT - ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT - regulator: core: use kfree_const() to free space conditionally - [arm64,armhf] clk: rockchip: Fix memory leak in rockchip_clk_register_pll() - drm/amdgpu: fix pci device refcount leak - bonding: fix link recovery in mode 2 when updelay is nonzero - drbd: fix an invalid memory access caused by incorrect use of list iterator - media: imon: fix a race condition in send_packet() - [arm64] clk: imx: replace osc_hdmi with dummy - pinctrl: pinconf-generic: add missing of_node_put() - media: dvb-core: Fix ignored return value in dvb_register_frontend() - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() (CVE-2023-28328) - [arm64,armhf] drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() - ASoC: dt-bindings: wcd9335: fix reset line polarity in example - NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding - NFSv4.2: Fix a memory stomp in decode_attr_security_label - NFSv4.2: Fix initialisation of struct nfs4_label - NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn - NFS: Fix an Oops in nfs_d_automount() - [x86] ALSA: asihpi: fix missing pci_disable_device() - wifi: iwlwifi: mvm: fix double free on tx path. - drm/amd/pm/smu11: BACO is supported when it's in BACO state - drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() - drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() - netfilter: conntrack: set icmpv6 redirects as RELATED - bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data - bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect - bonding: uninitialized variable in bond_miimon_inspect() - spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE - wifi: mac80211: fix memory leak in ieee80211_if_add() - wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails - regulator: core: fix module refcount leak in set_supply() - regulator: core: fix resource leak in regulator_register() - hwmon: (jc42) Convert register access and caching to regmap/regcache - hwmon: (jc42) Restore the min/max/critical temperatures on resume - bpf, sockmap: fix race in sock_map_free() - ALSA: pcm: Set missing stop_operating flag at undoing trigger start - media: saa7164: fix missing pci_disable_device() - ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt - xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() - SUNRPC: Fix missing release socket in rpc_sockname() - NFSv4.x: Fail client initialisation if state manager thread can't run - [armhf] media: coda: Add check for dcoda_iram_alloc - [armhf] media: coda: Add check for kmalloc - [armhf] clk: samsung: Fix memory leak in _samsung_clk_register_pll() - [armhf] spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode - wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h - wifi: rtl8xxxu: Fix the channel width reporting - wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() - blktrace: Fix output non-blktrace event when blk_classic option enabled - [armhf] clk: socfpga: clk-pll: Remove unused variable 'rc' - [armhf] clk: socfpga: use clk_hw_register for a5/c5 - [armhf] clk: socfpga: Fix memory leak in socfpga_gate_init() - [x86] net: vmw_vsock: vmci: Check memcpy_from_msg() - net: defxx: Fix missing err handling in dfx_init() - drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() - of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() - ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() - net: farsync: Fix kmemleak when rmmods farsync - net/tunnel: wait until all sk_user_data reader finish before releasing the sock - hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() - [i386] net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() - [amd64,arm64] net: amd-xgbe: Fix logic around active and passive cables - [amd64,arm64] net: amd-xgbe: Check only the minimum speed for active/passive cables - sctp: sysctl: make extra pointers netns aware - Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() - Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() - Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() - Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() - Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() - Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() - Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() - stmmac: fix potential division by 0 - apparmor: fix a memleak in multi_transaction_new() - apparmor: fix lockdep warning when removing a namespace - apparmor: Fix abi check to include v8 abi - [arm64] crypto: nitrox - avoid double free on error path in nitrox_sriov_init() - scsi: core: Fix a race between scsi_done() and scsi_timeout() - apparmor: Use pointer to struct aa_label for lbs_cred - [arm64,armhf] PCI: dwc: Fix n_fts[] array overrun - RDMA/core: Fix order of nldev_exit call - f2fs: Fix the race condition of resize flag between resizefs - apparmor: Fix memleak in alloc_ns() - f2fs: fix normal discard process - RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port - scsi: scsi_debug: Fix a warning in resp_write_scat() - crypto: cryptd - Use request context instead of stack for sub-request - [arm64] RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data() - [arm64] RDMA/hns: Fix ext_sge num error when post send - PCI: Check for alloc failure in pci_request_irq() - [amd64] RDMA/hfi: Decrease PCI device reference count in error path - [arm64] RDMA/hns: fix memory leak in hns_roce_alloc_mr() - RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed - scsi: hpsa: Fix possible memory leak in hpsa_init_one() - crypto: tcrypt - Fix multibuffer skcipher speed test mem leak - padata: Always leave BHs disabled when running ->parallel() - padata: Fix list iterator in padata_do_serial() - scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() - scsi: hpsa: Fix error handling in hpsa_add_sas_host() - scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() - scsi: scsi_debug: Fix a warning in resp_verify() - scsi: scsi_debug: Fix a warning in resp_report_zones() - scsi: fcoe: Fix possible name leak when device_register() fails - scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper() - scsi: ipr: Fix WARNING in ipr_init() - scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails - scsi: snic: Fix possible UAF in snic_tgt_create() - RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() - f2fs: avoid victim selection from previous victim section - RDMA/nldev: Fix failure to send large messages - [arm64,armhf] crypto: amlogic - Remove kcalloc without check - [amd64] RDMA/hfi1: Fix error return code in parse_platform_config() - RDMA/srp: Fix error return code in srp_parse_options() - orangefs: Fix sysfs not cleanup when dev init failed - [arm64] RDMA/hns: Fix PBL page MTR find - [arm64] RDMA/hns: Fix page size cap from firmware - [x86] hwrng: amd - Fix PCI device refcount leak - [i386] hwrng: geode - Fix PCI device refcount leak - IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces - [arm64,armhf] serial: tegra: Read DMA status before terminating - class: fix possible memory leak in __class_register() - vfio: platform: Do not pass return buffer to ACPI _RST method - usb: typec: Check for ops->exit instead of ops->enter in altmode_exit - usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() - usb: typec: tipd: Fix spurious fwnode_handle_put in error path - [arm*] serial: amba-pl011: avoid SBSA UART accessing DMACR register - [arm*] serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. - [i386] serial: pch: Fix PCI device refcount leak in pch_request_dma() - tty: serial: clean up stop-tx part in altera_uart_tx_chars() - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (CVE-2022-3424) - [arm*] firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() - iio: temperature: ltc2983: make bulk write buffer DMA-safe - genirq: Add IRQF_NO_AUTOEN for request_irq/nmi() - iio:imu:adis: Use IRQF_NO_AUTOEN instead of irq request then disable - iio: adis: handle devices that cannot unmask the drdy pin - iio: adis: stylistic changes - iio:imu:adis: Move exports into IIO_ADISLIB namespace - iio: adis: add '__adis_enable_irq()' implementation - usb: roles: fix of node refcount leak in usb_role_switch_is_parent() - usb: gadget: f_hid: optional SETUP/SET_REPORT mode - usb: gadget: f_hid: fix f_hidg lifetime vs cdev - usb: gadget: f_hid: fix refcount leak on error path - chardev: fix error handling in cdev_device_add() - [i386] i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe - [x86] staging: rtl8192u: Fix use after free in ieee80211_rx() - [x86] staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() - gpiolib: Get rid of redundant 'else' - gpiolib: cdev: fix NULL-pointer dereferences - usb: storage: Add check for kcalloc - tracing/hist: Fix issue of losting command info in error_log - fbdev: pm2fb: fix missing pci_disable_device() - [x86] fbdev: via: Fix error in via_core_init() - [x86] fbdev: vermilion: decrease reference count in error path - [x86] fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() - [armhf] HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() - [armhf] HSI: omap_ssi_core: fix possible memory leak in ssi_probe() - power: supply: fix residue sysfs file in error handle route of __power_supply_register() - perf trace: Return error if a system call doesn't exist - perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number - perf trace: Handle failure when trace point folder is missed - perf symbol: correction while adjusting symbol - [armhf] HSI: omap_ssi_core: Fix error handling in ssi_init() - power: supply: fix null pointer dereferencing in power_supply_get_battery_info - [arm64,armhf] pwm: tegra: Improve required rate calculation - dmaengine: idxd: Fix crc_val field for completion record - rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0 - rtc: cmos: Fix event handler registration ordering issue - rtc: cmos: Fix wake alarm breakage - rtc: cmos: fix build on non-ACPI platforms - rtc: cmos: Call cmos_wake_setup() from cmos_do_probe() - rtc: cmos: Call rtc_wake_setup() from cmos_do_probe() - rtc: cmos: Eliminate forward declarations of some functions - rtc: cmos: Rename ACPI-related functions - rtc: cmos: Disable ACPI RTC event on removal - [armhf] rtc: snvs: Allow a time difference on clock register read - [arm64] rtc: pcf85063: Fix reading alarm - [amd64] iommu/amd: Fix pci device refcount leak in ppr_notifier() - [powerpc*] xmon: Enable breakpoints on 8xx - [powerpc*] xmon: Fix -Wswitch-unreachable warning in bpt_cmds - [powerpc*] xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() - kbuild: remove unneeded mkdir for external modules_install - kbuild: unify modules(_install) for in-tree and external modules - kbuild: refactor single builds of *.ko - [powerpc*] perf: callchain validate kernel stack pointer bounds - [powerpc*] hv-gpci: Fix hv_gpci event list - [powerpc*] eeh: Drop redundant spinlock initialization - [powerpc*] pseries/eeh: use correct API for error log size - netfilter: flowtable: really fix NAT IPv6 offload - [arm64] rtc: pcf85063: fix pcf85063_clkout_control - NFSD: Remove spurious cb_setup_err tracepoint - nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure - net: macsec: fix net device access prior to holding a lock - mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() - mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() - mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() - nfc: pn533: Clear nfc_target before being used - r6040: Fix kmemleak in probe and remove - net: switch to storing KCOV handle directly in sk_buff - net: add inline function skb_csum_is_sctp - net: igc: use skb_csum_is_sctp instead of protocol check - net: add a helper to avoid issues with HW TX timestamping and SO_TXTIME - igc: Enhance Qbv scheduling by using first flag bit - igc: Use strict cycles for Qbv scheduling - igc: Add checking for basetime less than zero - igc: recalculate Qbv end_time by considering cycle time - igc: Lift TAPRIO schedule restriction - igc: Set Qbv start_time and end_time to end_time if not being configured in GCL - openvswitch: Fix flow lookup to use unmasked key - skbuff: Account for tail adjustment during pull operations - [arm64] mailbox: zynq-ipi: fix error handling while device_register() fails - net_sched: reject TCF_EM_SIMPLE case for complex ematch module - rxrpc: Fix missing unlock in rxrpc_do_sendmsg() - myri10ge: Fix an error handling path in myri10ge_probe() - net: stream: purge sk_error_queue in sk_stream_kill_queues() - rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() - [arm64] make is_ttbrX_addr() noinstr-safe - video: hyperv_fb: Avoid taking busy spinlock on panic path - [x86] hyperv: Remove unregister syscore call from Hyper-V cleanup - binfmt_misc: fix shift-out-of-bounds in check_special_flags - fs: jfs: fix shift-out-of-bounds in dbAllocAG - udf: Avoid double brelse() in udf_rename() - fs: jfs: fix shift-out-of-bounds in dbDiscardAG - ACPICA: Fix error code path in acpi_ds_call_control_method() - nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() - nilfs2: fix shift-out-of-bounds due to too large exponent of block size - acct: fix potential integer overflow in encode_comp_t() - hfs: fix OOB Read in __hfs_brec_find - [armhf] drm/etnaviv: add missing quirks for GC300 - brcmfmac: return error when getting invalid max_flowrings from dongle - wifi: ath9k: verify the expected usb_endpoints are present - wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out - ipmi: fix memleak when unload ipmi driver - drm/amd/display: prevent memory leak - qed (gcc13): use u16 for fid to be big enough - bpf: make sure skb->len != 0 when redirecting to a tunneling device - hamradio: baycom_epp: Fix return type of baycom_send_packet() - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() - igb: Do not free q_vector unless new one was allocated - drm/amdgpu: Fix type of second parameter in trans_msg() callback - drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback - [s390x] ctcm: Fix return type of ctc{mp,}m_tx() - [s390x] netiucv: Fix return type of netiucv_tx() - [s390x] lcs: Fix return type of lcs_start_xmit() - [arm64] drm/msm: Use drm_mode_copy() - [arm64] drm/rockchip: Use drm_mode_copy() - drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() - md/raid1: stop mdx_raid1 thread when raid1 array run failed - drm/amd/display: fix array index out of bound error in bios parser - net: add atomic_long_t to net_device_stats fields - mrp: introduce active flags to prevent UAF when applicant uninit - ppp: associate skb with a device at tx - bpf: Prevent decl_tag from being referenced in func_proto arg - ethtool: avoiding integer overflow in ethtool_phys_id() - media: dvb-frontends: fix leak of memory fw - media: dvbdev: adopts refcnt to avoid UAF - media: dvb-usb: fix memory leak in dvb_usb_adapter_init() - blk-mq: fix possible memleak when register 'hctx' failed - regulator: core: fix use_count leakage when handling boot-on - [arm64] mmc: f-sdh30: Add quirks for broken timeout clock capability - media: si470x: Fix use-after-free in si470x_int_in_callback() - hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() - orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() - orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() - hwmon: (jc42) Fix missing unlock on error in jc42_write() - ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c - ALSA: hda: add snd_hdac_stop_streams() helper - [x86] ASoC: Intel: Skylake: Fix driver hang during shutdown - ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() - [x86] ASoC: rt5670: Remove unbalanced pm_runtime_put() - pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() - afs: Fix lost servers_outstanding count - pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES - ima: Simplify ima_lsm_copy_rule - ALSA: usb-audio: add the quirk for KT0206 device - ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB - ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list - [arm64,armhf] usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode - [arm64,armhf] usb: dwc3: core: defer probe on ulpi_read_id timeout - HID: wacom: Ensure bootloader PID is usable in hidraw mode - reiserfs: Add missing calls to reiserfs_security_free() - iio: adc: ad_sigma_delta: do not use internal iio_dev lock - iio: adc128s052: add proper .data members in adc128_of_match table - regulator: core: fix deadlock on regulator enable - ovl: fix use inode directly in rcu-walk mode - media: dvbdev: fix build warning due to comments - media: dvbdev: fix refcnt bug - [armhf] pwm: tegra: Fix 32 bit build - [arm64,armhf] usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init - cifs: fix oops during encryption - nvme-pci: fix doorbell buffer value endianness - nvme-pci: fix mempool alloc size - nvme-pci: fix page size checks - ata: ahci: Fix PCS quirk application for suspend - nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition - [powerpc*] rtas: avoid device tree lookups in rtas_os_term() - [powerpc*] rtas: avoid scheduling in rtas_os_term() - HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint - HID: plantronics: Additional PIDs for double volume key presses quirk - pstore/zone: Use GFP_ATOMIC to allocate zone buffer - hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount - binfmt: Fix error return code in load_elf_fdpic_binary() - ovl: Use ovl mounter's fsuid and fsgid in ovl_link() - ALSA: line6: correct midi status byte when receiving data from podxt - ALSA: line6: fix stack overflow in line6_midi_transmit - pnode: terminate at peers of source - md: fix a crash in mempool_free - mm, compaction: fix fast_isolate_around() to stay within boundaries - f2fs: should put a page when checking the summary info - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING - tpm: acpi: Call acpi_put_table() to fix memory leak - tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak - SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails - net/mlx5e: Fix nullptr in mlx5e_tc_add_fdb_flow() - wifi: rtlwifi: remove always-true condition pointed out by GCC 12 - wifi: rtlwifi: 8192de: correct checking of IQK reload - rcu: Prevent lockdep-RCU splats on lock acquisition/release - net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO - net/af_packet: make sure to pull mac header - media: stv0288: use explicitly signed char - jbd2: use the correct print format - [arm64] dts: qcom: sdm845-db845c: correct SPI2 pins drive strength - btrfs: fix resolving backrefs for inline extent followed by prealloc - [arm64] dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength - PM/devfreq: governor: Add a private governor_data for governor - cpufreq: Init completion before kobject_init_and_add() - ALSA: patch_realtek: Fix Dell Inspiron Plus 16 - ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops - dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort - dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata - dm thin: Use last transaction's pmd->root when commit failed - dm thin: resume even if in FAIL mode - dm thin: Fix UAF in run_timer_softirq() - dm integrity: Fix UAF in dm_integrity_dtr() - dm cache: Fix UAF in destroy() - dm cache: set needs_check flag after aborting metadata - tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' - perf/core: Call LSM hook after copying perf_event_attr - [x86] KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails - [x86] microcode/intel: Do not retry microcode reloading on the APs - [x86] ftrace/x86: Add back ftrace_expected for ftrace bug reports - [x86] kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK - tracing/hist: Fix wrong return value in parse_action_params() - tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line - media: dvb-core: Fix double free in dvb_register_device() - cifs: fix confusing debug message - cifs: fix missing display of three mount options - md/bitmap: Fix bitmap chunk size overflow issues - efi: Add iMac Pro 2017 to uefi skip cert quirk - wifi: wilc1000: sdio: fix module autoloading - ipmi: fix long wait in unload when IPMI disconnect - mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() - ima: Fix a potential NULL pointer access in ima_restore_measurement_list - ipmi: fix use after free in _ipmi_destroy_user() - PCI: Fix pci_device_is_present() for VFs by checking PF - PCI/sysfs: Fix double free in error path - driver core: Fix bus_type.match() error handling in __driver_attach() - [amd64] iommu/amd: Fix ivrs_acpihid cmdline parsing code - [armhf] remoteproc: core: Do pm_relax when in RPROC_OFFLINE state - device_cgroup: Roll back to original exceptions after copy failure - drm/connector: send hotplug uevent on connector cleanup - [x86] drm/i915/dsi: fix VBT send packet port selection for dual link DSI - ext4: silence the warning when evicting inode with dioread_nolock - ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop - ext4: fix use-after-free in ext4_orphan_cleanup - ext4: fix undefined behavior in bit shift for ext4_check_flag_values - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode - ext4: add helper to check quota inums - ext4: fix bug_on in __es_tree_search caused by bad quota inode - ext4: fix reserved cluster accounting in __es_remove_extent() - ext4: check and assert if marking an no_delete evicting inode dirty - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode - ext4: init quota for 'old.inode' in 'ext4_rename' - ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline - ext4: fix corruption when online resizing a 1K bigalloc fs - ext4: fix error code return to user-space in ext4_get_branch() - ext4: avoid BUG_ON when creating xattrs - ext4: fix inode leak in ext4_xattr_inode_create() on an error path - ext4: initialize quota before expanding inode in setproject ioctl - ext4: avoid unaccounted block allocation when expanding inode - ext4: allocate extended attribute value in vmalloc area - drm/amdgpu: handle polaris10/11 overlap asics (v2) - drm/amdgpu: make display pinning more flexible (v2) - [armel,armhf] renumber bits related to _TIF_WORK_MASK - [x86] perf/x86/intel/uncore: Generalize I/O stacks to PMON mapping procedure - [x86] perf/x86/intel/uncore: Clear attr_update properly - btrfs: replace strncpy() with strscpy() - [x86] mce: Get rid of msr_ops - [x86] MCE/AMD: Clear DFR errors found in THR handler - perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor - perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data - [x86] kprobes: Convert to insn_decode() - [x86] kprobes: Fix optprobe optimization check with CONFIG_RETHUNK - ext4: goto right label 'failed_mount3a' - ext4: correct inconsistent error msg in nojournal mode - mm/highmem: Lift memcpy_[to|from]_page to core - ext4: use memcpy_to_page() in pagecache_write() - fs: ext4: initialize fsdata in pagecache_write() - ext4: move functions in super.c - ext4: simplify ext4 error translation - ext4: fix various seppling typos - ext4: fix leaking uninitialized memory in fast-commit journal - ext4: use kmemdup() to replace kmalloc + memcpy - mbcache: don't reclaim used entries - mbcache: add functions to delete entry if unused - ext4: remove EA inode entry from mbcache on inode eviction - ext4: unindent codeblock in ext4_xattr_block_set() - ext4: fix race when reusing xattr blocks - mbcache: automatically delete entries from cache on freeing - ext4: fix deadlock due to mbcache entry corruption - SUNRPC: ensure the matching upcall is in-flight upon downcall - bpf: pull before calling skb_postpull_rcsum() - [arm64,armhf] drm/panfrost: Fix GEM handle creation ref-counting - [x86] vmxnet3: correctly report csum_level for encapsulated packet - veth: Fix race with AF_XDP exposing old or uninitialized descriptors - nfsd: shut down the NFSv4 state objects before the filecache - [arm64] net: hns3: add interrupts re-initialization while doing VF FLR - net: sched: fix memory leak in tcindex_set_parms - qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure - nfc: Fix potential resource leaks - vhost/vsock: Fix error handling in vhost_vsock_init() - vhost: fix range used in translate_desc() - net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path - net/mlx5: Avoid recovery in probe flows - net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default - net/mlx5e: Fix hw mtu initializing at XDP SQ allocation - [amd64,arm64] net: amd-xgbe: add missed tasklet_kill - RDMA/mlx5: Fix validation of max_rd_atomic caps for DC - [arm64] drm/meson: Reduce the FIFO lines held when AFBC is not used - filelock: new helper: vfs_inode_has_locks - ceph: switch to vfs_inode_has_locks() to fix file lock bug - netfilter: ipset: fix hash:net,port,net hang with /0 subnet - netfilter: ipset: Rework long task execution when adding/deleting entries - perf tools: Fix resources leak in perf_data__open_dir() - drivers/net/bonding/bond_3ad: return when there's no aggregator - usb: rndis_host: Secure rndis_query check against int overflow - [x86] drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() - udf: Fix extension of the last extent in the file - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet - nvme: fix multipath crash caused by flush request when blktrace is enabled - [x86] bugs: Flush IBP in ib_prctl_set() (CVE-2023-0045) - nfsd: fix handling of readdir in v4root vs. mount upcall timeout - fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB - [x86] drm/i915/gvt: fix gvt debugfs destroy - [x86] drm/i915/gvt: fix vgpu debugfs clean in remove - ext4: don't allow journal inode to have encrypt flag - hfs/hfsplus: use WARN_ON for sanity check - hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling - mbcache: Avoid nesting of cache->c_list_lock under bit locks - efi: random: combine bootloader provided RNG seed with RNG protocol output - io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res() - ext4: disable fast-commit of encrypted dir operations - ext4: don't set up encryption key during jbd2 transaction - [arm64] fsl_lpuart: Don't enable interrupts too early - serial: fixup backport of "serial: Deassert Transmit Enable on probe in driver-specific way" - net/ulp: prevent ULP without clone op from entering the LISTEN status (CVE-2023-0461) - ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list - ALSA: hda - Enable headset mic on another Dell laptop with ALC3254 https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.164 - ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx - [arm64] KVM: arm64: Fix S1PTW handling on RO memslots - efi: tpm: Avoid READ_ONCE() for accessing the event log - docs: Fix the docs build with Sphinx 6.0 - perf auxtrace: Fix address filter duplicate symbol selection - [arm64] ASoC: qcom: lpass-cpu: Fix fallback SD line index handling - [s390x] cpum_sf: add READ_ONCE() semantics to compare and swap loops - [s390x] percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() - cifs: Fix uninitialized memory read for smb311 posix symlink create - [arm64] drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer - [x86] platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe - ixgbe: fix pci device refcount leak - bus: mhi: host: Fix race between channel preparation and M0 event - [amd64] iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands - [amd64] iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options - [arm64] clk: imx8mp: Add DISP2 pixel clock - [arm64] clk: imx8mp: add clkout1/2 support - dt-bindings: clocks: imx8mp: Add ID for usb suspend clock - [arm64] clk: imx: imx8mp: add shared clk gate for usb suspend clk - xhci: Avoid parsing transfer events several times - xhci: get isochronous ring directly from endpoint structure - xhci: adjust parameters passed to cleanup_halted_endpoint() - xhci: Add xhci_reset_halted_ep() helper function - xhci: move xhci_td_cleanup so it can be called by more functions - xhci: store TD status in the td struct instead of passing it along - xhci: move and rename xhci_cleanup_halted_endpoint() - xhci: Prevent infinite loop in transaction errors recovery for streams - [arm64,armhf] usb: ulpi: defer ulpi_register on ulpi_read_id timeout - ext4: fix uninititialized value in 'ext4_evict_inode' - xfrm: fix rcu lock in xfrm_notify_userpolicy() - netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. - [powerpc*] imc-pmu: Fix use of mutex in IRQs disabled section - [x86] boot: Avoid using Intel mnemonics in AT&T syntax asm - EDAC/device: Fix period calculation in edac_device_reset_delay_period() - [arm64] ASoC: wm8904: fix wrong outputs volume after power reactivation - tipc: fix unexpected link reset due to discovery messages - hvc/xen: lock console list traversal - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() - net/sched: act_mpls: Fix warning during failed attribute validation - net/mlx5: Fix ptp max frequency adjustment range - net/mlx5e: Don't support encap rules with gbp option - mm: Always release pages to the buddy allocator in memblock_free_late(). - Documentation: KVM: add API issues section - [x86] KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID - [x86] resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI - [x86] resctrl: Fix task CLOSID/RMID update race - [arm64] atomics: remove LL/SC trampolines - [arm64] cmpxchg_double*: hazard against entire exchange variable - efi: fix NULL-deref in init error path - drm/virtio: Fix GEM handle creation UAF - io_uring/io-wq: free worker if task_work creation is canceled - io_uring/io-wq: only free worker if it was allocated for creation - Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.165 - btrfs: fix trace event name typo for FLUSH_DELAYED_REFS - pNFS/filelayout: Fix coalescing test for single DS - net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats - btrfs: always report error in run_one_delayed_ref() - [x86] asm: Fix an assembler warning with current binutils - f2fs: let's avoid panic if extent_tree is not created - wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices - wifi: mac80211: sdata can be NULL during AMPDU start - zonefs: Detect append writes at invalid locations - nilfs2: fix general protection fault in nilfs_btree_insert() - efi: fix userspace infinite retry read efivars after EFI runtime services page fault - ALSA: hda/realtek - Turn on power early - [x86] drm/i915/gt: Reset twice - Bluetooth: hci_qca: Wait for timeout during suspend - Bluetooth: hci_qca: Fix driver shutdown on closed serdev - io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL - io_uring: improve send/recv error handling - io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly - io_uring: add flag for disabling provided buffer recycling - io_uring: support MSG_WAITALL for IORING_OP_SEND(MSG) - io_uring: allow re-poll if we made progress - io_uring: fix async accept on O_NONBLOCK sockets - io_uring: check for valid register opcode earlier - io_uring: lock overflowing for IOPOLL - io_uring: fix CQ waiting timeout handling - io_uring: ensure that cached task references are always put on exit - io_uring: remove duplicated calls to io_kiocb_ppos - io_uring: update kiocb->ki_pos at execution time - io_uring: do not recalculate ppos unnecessarily - io_uring/rw: defer fsnotify calls to task context - xhci-pci: set the dma max_seg_size - usb: xhci: Check endpoint is valid before dereferencing it - xhci: Fix null pointer dereference when host dies - xhci: Add update_hub_device override for PCI xHCI hosts - xhci: Add a flag to disable USB3 lpm on a xhci root port level. - usb: acpi: add helper to check port lpm capability using acpi _DSM - xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables - prlimit: do_prlimit needs to have a speculation check (CVE-2023-0458) - USB: serial: option: add Quectel EM05-G (GR) modem - USB: serial: option: add Quectel EM05-G (CS) modem - USB: serial: option: add Quectel EM05-G (RS) modem - USB: serial: option: add Quectel EC200U modem - USB: serial: option: add Quectel EM05CN (SG) modem - USB: serial: option: add Quectel EM05CN modem - USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 - usb: core: hub: disable autosuspend for TI TUSB8041 - [x86] comedi: adv_pci1760: Fix PWM instruction handling - [arm64,armhf] mmc: sunxi-mmc: Fix clock refcount imbalance during unbind - [arm64,armhf] mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting - btrfs: fix race between quota rescan and disable leading to NULL pointer deref - cifs: do not include page data when checking signature - [x86] thunderbolt: Use correct function to calculate maximum USB3 link rate - USB: gadgetfs: Fix race between mounting and unmounting - USB: serial: cp210x: add SCALANCE LPE-9000 device id - usb: typec: altmodes/displayport: Add pin assignment helper - usb: typec: altmodes/displayport: Fix pin assignment calculation - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() - usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 - [i386] serial: pch_uart: Pass correct sg to dma_unmap_sg() - [arm64] dmaengine: tegra210-adma: fix global intr clear - [x86] mei: me: add meteor lake point M DID - [x86] drm/i915: re-disable RC6p on Sandy Bridge - drm/amd/display: Fix set scaling doesn's work - drm/amd/display: Calculate output_color_space after pixel encoding adjustment - drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix - [arm64] efi: Execute runtime services from a dedicated stack - [arm64] efi: rt-wrapper: Add missing include - Revert "drm/amdgpu: make display pinning more flexible (v2)" - [x86] fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN - tracing: Use alignof__(struct {type b;}) instead of offsetof() - io_uring: io_kiocb_update_pos() should not touch file for non -1 offset - io_uring/net: fix fast_iov assignment in io_setup_async_msg() - net/ulp: use consistent error code when blocking ULP - net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work() - Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()" - Bluetooth: hci_qca: Wait for SSR completion during suspend - Bluetooth: hci_qca: check for SSR triggered flag while suspend - Bluetooth: hci_qca: Fixed issue during suspend - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma - io_uring: Clean up a false-positive warning from GCC 9.3.0 - io_uring: fix double poll leak on repolling - io_uring/rw: ensure kiocb_end_write() is always called - io_uring/rw: remove leftover debug statement https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.166 - clk: generalize devm_clk_get() a bit - clk: Provide new devm_clk helpers for prepared and enabled clocks - [armel,armhf] memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() - [armhf] dts: imx6ul-pico-dwarf: Use 'clock-frequency' - [armhf] imx: add missing of_node_put() - [amd64] HID: intel_ish-hid: Add check for ishtp_dma_tx_map - tomoyo: fix broken dependency on *.conf.default - RDMA/core: Fix ib block iterator counter overflow - [amd64] IB/hfi1: Reject a zero-length user expected buffer - [amd64] IB/hfi1: Reserve user expected TIDs - [amd64] IB/hfi1: Fix expected receive setup error exit issues - [amd64] IB/hfi1: Immediately remove invalid memory from hardware - [amd64] IB/hfi1: Remove user expected buffer invalidate race - affs: initialize fsdata in affs_truncate() - [amd64,arm64] amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent - [amd64,arm64] amd-xgbe: Delay AN timeout during KR training - bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation - [arm64] phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() - net: nfc: Fix use-after-free in local_cleanup() - [arm64,armhf] gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid (CVE-2023-23559) - net/sched: sch_taprio: fix possible use-after-free - l2tp: Serialize access to sk_user_data with sk_callback_lock (CVE-2022-4129) - l2tp: Don't sleep and disable BH under writer-side sk_callback_lock (CVE-2022-4129) - l2tp: convert l2tp_tunnel_list to idr - l2tp: close all race conditions in l2tp_tunnel_register() - net: usb: sr9700: Handle negative len - net: mdio: validate parameter addr in mdiobus_get_phy() - HID: check empty report_list in hid_validate_values() (CVE-2023-1073) - HID: check empty report_list in bigben_probe() - net: stmmac: fix invalid call to mdiobus_get_phy() - HID: revert CHERRY_MOUSE_000C quirk - usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait - usb: gadget: f_fs: Ensure ep0req is dequeued before free_request - net: mlx5: eliminate anonymous module_init & module_exit - dmaengine: Fix double increment of client_count in dma_chan_get() - [arm64] net: macb: fix PTP TX timestamp failure due to packet padding - l2tp: prevent lockdep issue in l2tp_tunnel_register() - HID: betop: check shape of output reports - nvme-pci: fix timeout request state check - tcp: avoid the lookup process failing to get sk in ehash table - w1: fix deadloop in __w1_remove_master_device() - w1: fix WARNING after calling w1_process() - driver core: Fix test_async_probe_init saves device in wrong array - tcp: fix rate_app_limited to default to 1 - scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace - [arm64,armhf] cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist - drm: Add orientation quirk for Lenovo ideapad D330-10IGL - [arm64] cpufreq: armada-37xx: stop using 0 as NULL pointer - [armhf] ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC - spi: spidev: remove debug messages that access spidev->spi without locking - [s390x] KVM: s390: interrupt: use READ_ONCE() before cmpxchg() - [arm64] scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id - [x86] platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD - [x86] platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK - lockref: stop doing cpu_relax in the cmpxchg loop - netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state - [x86] ACPI: cstate: Optimize C3 entry on AMD CPUs - fs: reiserfs: remove useless new_opts in reiserfs_remount - sysctl: add a new register_sysctl_init() interface - kernel/panic: move panic sysctls to its own file - panic: unset panic_on_warn inside panic() - exit: Add and use make_task_dead. - objtool: Add a missing comma to avoid string concatenation - panic: Separate sysctl logic from CONFIG_SMP - exit: Put an upper limit on how often we can oops - exit: Expose "oops_count" to sysfs - exit: Allow oops_limit to be disabled - panic: Consolidate open-coded panic_on_warn checks - panic: Introduce warn_limit - panic: Expose "warn_count" to sysfs - docs: Fix path paste-o for /sys/kernel/warn_count - exit: Use READ_ONCE() for all oops/warn limit reads - Bluetooth: hci_sync: cancel cmd_timer if hci_open failed - xhci: Set HCD flag to defer primary roothub registration - scsi: hpsa: Fix allocation size for scsi_host_alloc() - module: Don't wait for GOING modules - tracing: Make sure trace_printk() can output as soon as it can be used - trace_events_hist: add check for return value of 'create_hist_field' - ftrace/scripts: Update the instructions for ftrace-bisect.sh - cifs: Fix oops due to uncleared server->smbd_conn in reconnect - [x86] KVM: x86/vmx: Do not skip segment attributes if unusable bit is set - [x86] thermal: intel: int340x: Protect trip temperature from concurrent updates - EDAC/device: Respect any driver-supplied workqueue polling value - units: Add Watt units - units: Add SI metric prefix definitions - i2c: designware: Use DIV_ROUND_CLOSEST() macro - i2c: designware: use casting of u64 in clock multiplication to avoid overflow - netlink: prevent potential spectre v1 gadgets - net: fix UaF in netns ops registration error path - netfilter: nft_set_rbtree: Switch to node list walk for overlap detection - netfilter: nft_set_rbtree: skip elements in transaction from garbage collection - netlink: annotate data races around nlk->portid - netlink: annotate data races around dst_portid and dst_group - netlink: annotate data races around sk_state - ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() - ipv4: prevent potential spectre v1 gadget in fib_metrics_match() - netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE - netrom: Fix use-after-free of a listening socket. - net/sched: sch_taprio: do not schedule in taprio_reset() - sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074) - [x86] thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() - net/tg3: resolve deadlock in tg3_reset_task() during EEH - [arm64,armhf] net: mdio-mux-meson-g12a: force internal PHY off on mux switch - Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" - nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf (Closes: #989705) - nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted - block: fix and cleanup bio_check_ro - [x86] i8259: Mark legacy PIC interrupts with IRQ_LEVEL - netfilter: conntrack: unify established states for SCTP paths - [x86] perf/x86/amd: fix potential integer overflow on shift of a int - clk: Fix pointer casting to prevent oops in devm_clk_release() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.167 - [armhf] dts: imx: Fix pca9547 i2c-mux node name - [arm64] dts: imx8mq-thor96: fix no-mmc property for SDHCI - bpf: Skip task with pid=1 in send_signal_common() - blk-cgroup: fix missing pd_online_fn() while activating policy - [armhf] dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init - ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt - net: fix NULL pointer in skb_segment_list https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.168 - firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region - [arm64,armhf] bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() - bpf: Fix incorrect state pruning for <8B spill/fill - [powerpc*] imc-pmu: Revert nest_init_lock to being a mutex - bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() - bpf: Support <8-byte scalar spill and refill - bpf: Fix to preserve reg parent/live fields when copying range info - bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener - [arm*] drm/vc4: hdmi: make CEC adapter name unique - scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" - vhost/net: Clear the pending messages when the backend is removed - [armhf] WRITE is "data source", not destination... - fix iov_iter_bvec() "direction" argument - fix "direction" argument of iov_iter_kvec() - virtio-net: execute xdp_do_flush() before napi_complete_done() - sfc: correctly advertise tunneled IPv6 segmentation - net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices - netrom: Fix use-after-free caused by accept on already connected socket - netfilter: br_netfilter: disable sabotage_in hook after first suppression - squashfs: harden sanity check in squashfs_read_xattr_id_table - [arm64] net: phy: meson-gxl: Add generic dummy stubs for MMD register access - igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() - can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate - ata: libata: Fix sata_down_spd_limit() when no link speed is reported - virtio-net: Keep stop() to follow mirror sequence of open() - net: openvswitch: fix flow memory leak in ovs_flow_cmd_new - efi: fix potential NULL deref in efi_mem_reserve_persistent - qede: add netpoll support for qede driver - qede: execute xdp_do_flush() before napi_complete_done() - scsi: target: core: Fix warning on RT kernels - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (CVE-2023-2162) - [arm64,armhf] i2c: rk3x: fix a bunch of kernel-doc warnings - [x86] platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table - [arm64] usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API - [arm64] usb: dwc3: qcom: enable vbus override when in OTG dr-mode - usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF - Input: i8042 - move __initconst to fix code styling warning - Input: i8042 - merge quirk tables - Input: i8042 - add TUXEDO devices to i8042 quirk tables - Input: i8042 - add Clevo PCX0DX to i8042 quirk table - fbcon: Check font dimension limits - net: qrtr: free memory on error path in radix_tree_insert() - [s390x] watchdog: diag288_wdt: do not use stack buffers for hardware data - [s390x] watchdog: diag288_wdt: fix __diag288() inline assembly - ALSA: hda/realtek: Add Acer Predator PH315-54 - efi: Accept version 2 of memory attributes table - iio: hid: fix the retval in accel_3d_capture_sample - iio: imu: fxos8700: fix ACCEL measurement range selection - iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback - iio: imu: fxos8700: fix IMU data bits returned to user space - iio: imu: fxos8700: fix map label of channel type to MAGN sensor - iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback - iio: imu: fxos8700: fix incorrect ODR mode readback - iio: imu: fxos8700: fix failed initialization ODR mode assignment - iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN - iio: imu: fxos8700: fix MAGN sensor scale and unit - mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps - [x86] debug: Fix stack recursion caused by wrongly ordered DR7 accesses - mm/swapfile: add cond_resched() in get_swap_pages() - Squashfs: fix handling and sanity checking of xattr_ids count - [x86] drm/i915: Fix potential bit_17 double-free - nvmem: core: initialise nvmem->id early - nvmem: core: fix cell removal on error - serial: 8250_dma: Fix DMA Rx completion race - serial: 8250_dma: Fix DMA Rx rearm race - fbdev: smscufx: fix error handling code in ufx_usb_probe - f2fs: fix to do sanity check on i_extra_isize in is_alive() - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads - nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property - bpf: Do not reject when the stack read size is different from the tracked scalar size - mm/migration: return errno when isolate_huge_page failed - migrate: hugetlb: check for hugetlb shared PMD in node migration - btrfs: limit device extents to the device size - btrfs: zlib: zero-initialize zlib workspace - ALSA: hda/realtek: Add Positivo N14KP6-TG - ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 - tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw - of/address: Return an error when no valid dma-ranges are found (Closes: #993612) - can: j1939: do not wait 250 ms if the same addr was already claimed - [amd64] IB/hfi1: Restore allocated resources on failed copyout - IB/IPoIB: Fix legacy IPoIB due to wrong number of queues - [amd64] RDMA/usnic: use iommu_map_atomic() under spin_lock() - xfrm: fix bug with DSCP copy to v6 from v4 tunnel - bonding: fix error checking in bond_debug_reregister() - [arm64] net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY - ice: Do not use WQ_MEM_RECLAIM flag for workqueue - [arm64] net: mscc: ocelot: fix VCAP filters not matching on MAC with "protocol 802.1Q" - net/mlx5e: IPoIB, Show unknown speed instead of error - net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers - net/mlx5: fw_tracer, Zero consumer index when reloading the tracer - rds: rds_rm_zerocopy_callback() use list_first_entry() (CVE-2023-1078) - ALSA: pci: lx6464es: fix a debug loop - [armhf] pinctrl: aspeed: Fix confusing types in return value - [arm64,armhf] pinctrl: single: fix potential NULL dereference - [x86] pinctrl: intel: Restore the pins that used to be in Direct IRQ mode - cifs: Fix use-after-free in rdata->read_into_pages() - net: USB: Fix wrong-direction WARNING in plusb.c - btrfs: free device in btrfs_close_devices for a single device filesystem - usb: core: add quirk for Alcor Link AK9563 smartcard reader - usb: typec: altmodes/displayport: Fix probe pin assign check - ceph: flush cap releases when the session is flushed - Fix page corruption caused by racy check in __free_pages https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.169 - [x86] ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers - ALSA: hda: Do not unset preset when cleaning up codec - net/rose: Fix to not accept on connected socket - net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC - net: sched: sch: Bounds check priority - [s390x] decompressor: specify __decompress() buf len to avoid overflow - nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association - nvmem: core: add error handling for dev_set_name - nvmem: core: remove nvmem_config wp_gpio - nvmem: core: fix cleanup after dev_set_name() - nvmem: core: fix registration vs use race - aio: fix mremap after fork null-deref - [s390x] signal: fix endless loop in do_signal (Closes: #1031753) - ovl: remove privs in ovl_copyfile() - ovl: remove privs in ovl_fallocate() - netfilter: nft_tproxy: restrict to prerouting hook - mmc: sdio: fix possible resource leaks in some error paths - [arm64,armhf] mmc: mmc_spi: fix error handling in mmc_spi_probe() - ALSA: hda/conexant: add a new hda codec SN6180 - ALSA: hda/realtek - fixed wrong gpio assigned - sched/psi: Fix use-after-free in ep_remove_wait_queue() - hugetlb: check for undefined shift on 32 bit architectures - Revert "mm: Always release pages to the buddy allocator in memblock_free_late()." - net: Fix unwanted sign extension in netdev_stats_to_stats64() - revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" - ixgbe: allow to increase MTU to 3K with XDP enabled - i40e: add double of VLAN header when computing the max MTU - sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list - net/sched: tcindex: update imperfect hash filters respecting rcu (CVE-2023-1281) - dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions. - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path - net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() - net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence - bnxt_en: Fix mqprio and XDP ring checking logic - net: stmmac: Restrict warning on disabling DMA store and fwd mode - net: mpls: fix stale pointer if allocation fails during device rename (CVE-2023-26545) - ixgbe: add double of VLAN header when computing the max MTU - ipv6: Fix datagram socket connection with DSCP. - ipv6: Fix tcp socket connection with DSCP. - nilfs2: fix underflow in second superblock position calculations - [x86] drm/i915/gen11: Moving WAs to icl_gt_workarounds_init() - [x86] drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list - flow_offload: fill flags to action structure - net/sched: act_ctinfo: use percpu stats - i40e: Add checking for null for nlmsg_find_attr() - net/sched: tcindex: search key must be 16 bits - [x86] kvm: initialize all of the kvm_debugregs structure before sending it to userspace (CVE-2023-1513) - alarmtimer: Prevent starvation by small intervals and SIG_IGN - [x86] ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak - net: sched: sch: Fix off by one in htb_activate_prios() - nvmem: core: fix return value https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.170 - [armhf] drm/etnaviv: don't truncate physical page address - wifi: rtl8xxxu: gen2: Turn on the rate control - powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G - random: always mix cycle counter in add_latent_entropy() - [x86] KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception - [x86] KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid - [x86] KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS (CVE-2022-2196) - [x86] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry (CVE-2022-3707) - mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh - uaccess: Add speculation barrier to copy_from_user() (CVE-2023-0459) - Revert "Revert "block: nbd: add sanity check for first_minor"" - nbd: fix max value for 'first_minor' - nbd: fix possible overflow for 'first_minor' in nbd_dev_add() - nbd: fix possible overflow on 'first_minor' in nbd_dev_add() - wifi: mwifiex: Add missing compatible string for SD8787 - audit: update the mailing list in MAINTAINERS - ext4: Fix function prototype mismatch for ext4_feat_ktype - Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs" - bpf: add missing header file include https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.171 - Fix XFRM-I support for nested ESP tunnels - [arm64] dts: rockchip: drop unused LED mode property from rk3328-roc-cc - [amd64,arm64] ACPI: NFIT: fix a potential deadlock during NFIT teardown - btrfs: send: limit number of clones and allocated memory size - [amd64] IB/hfi1: Assign npages earlier - neigh: make sure used and confirmed times are valid - HID: core: Fix deadloop in hid_apply_multiplier. - bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state - net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues(). - vc_screen: don't clobber return value in vcs_read - md: Flush workqueue md_rdev_misc_wq in md_alloc() - drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init (CVE-2023-22998) - drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling (CVE-2023-22998) - USB: serial: option: add support for VW/Skoda "Carstick LTE" - usb: gadget: u_serial: Add null pointer check in gserial_resume - USB: core: Don't hold device lock while reading the "descriptors" sysfs file - io_uring: add missing lock in io_get_file_fixed (CVE-2023-1872) https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.172 - io_uring: ensure that io_init_req() passes in the right issue_flags (CVE-2023-1872) https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.173 - HID: asus: Remove check for same LED brightness on set - HID: asus: use spinlock to protect concurrent accesses - HID: asus: use spinlock to safely schedule workers (CVE-2023-1079) - [powerpc*] mm: Rearrange if-else block to avoid clang warning - [armhf] OMAP2+: Fix memory leak in realtime_counter_init() - [arm64] dts: qcom: sdm845-db845c: fix audio codec interrupt pin name - [armhf] imx: Call ida_simple_remove() for ida_simple_get - [armhf] dts: sun8i: nanopi-duo2: Fix regulator GPIO reference - blk-mq: avoid sleep in blk_mq_alloc_request_hctx - blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx - blk-mq: correct stale comment of .get_budget - [s390x] dasd: Prepare for additional path event handling - [s390x] dasd: Fix potential memleak in dasd_eckd_init() - sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity() - sched/rt: pick_next_rt_entity(): check list_entry (CVE-2023-1077) - [x86] perf/zhaoxin: Add stepping check for ZXC - block: bio-integrity: Copy flags when bio_integrity_payload is cloned - wifi: rsi: Fix memory leak in rsi_coex_attach() - wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave() - wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave() - wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave() - wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() - wifi: libertas: fix memory leak in lbs_init_adapter() - wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() - wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() - wifi: ipw2200: fix memory leak in ipw_wdev_init() - wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() - wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() - wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() - wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() - wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() - wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() - wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() - [amd64] crypto: x86/ghash - fix unaligned access in ghash_setkey() - ACPICA: Drop port I/O validation for some regions - genirq: Fix the return type of kstat_cpu_irqs_sum() - rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose - rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls - rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes() - lib/mpi: Fix buffer overrun when SG is too long - [amd64] crypto: ccp: Use the stack for small SEV command buffers - [amd64] crypto: ccp: Use the stack and common buffer for status commands - [amd64] crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak - [amd64] crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2 - ACPICA: nsrepair: handle cases without a return value correctly - [arm64] thermal/drivers/tsens: Drop msm8976-specific defines - [arm64] thermal/drivers/qcom/tsens_v1: Enable sensor 3 on MSM8976 - [arm64] thermal/drivers/tsens: Add compat string for the qcom,msm8960 - [arm64] thermal/drivers/tsens: Sort out msm8976 vs msm8956 data - wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU - wifi: orinoco: check return value of hermes_write_wordrec() - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function - ath9k: hif_usb: simplify if-if to if-else - ath9k: htc: clean up statistics macros - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() - wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup - wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data() - ACPI: battery: Fix missing NUL-termination with large strings - [amd64] crypto: ccp - Failure on re-initialization due to duplicate sysfs filename - crypto: essiv - Handle EBUSY correctly - crypto: seqiv - Handle EBUSY correctly - [x86] powercap: fix possible name leak in powercap_register_zone() - [x86] cpu: Init AP exception handling from cpu_init_secondary() - [x86] microcode: Replace deprecated CPU-hotplug functions. - [x86] Mark stop_this_cpu() __noreturn - [x86] microcode: Rip out the OLD_INTERFACE - [x86] microcode: Default-disable late loading - [x86] microcode: Print previous version of microcode after reload - [x86] microcode: Add a parameter to microcode_check() to store CPU capabilities - [x86] microcode: Check CPU capabilities after late microcode update correctly - [x86] microcode: Adjust late loading result reporting message - crypto: xts - Handle EBUSY correctly - leds: led-class: Add missing put_device() to led_put() - [amd64] crypto: ccp - Refactor out sev_fw_alloc() - [amd64] crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware - net/mlx5: Enhance debug print in page allocation failure - irqchip: Fix refcount leak in platform_irqchip_probe - irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains - irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe - irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe - [s390x] vmem: fix empty page tables cleanup under KASAN - net: add sock_init_data_uid() - tun: tun_chr_open(): correctly initialize socket uid (CVE-2023-1076) - tap: tap_open(): correctly initialize socket uid (CVE-2023-1076) - OPP: fix error checking in opp_migrate_dentry() - Bluetooth: L2CAP: Fix potential user-after-free - rds: rds_rm_zerocopy_callback() correct order for list_add_tail() - crypto: rsa-pkcs1pad - Use akcipher_request_complete - wifi: iwl3945: Add missing check for create_singlethread_workqueue - wifi: iwl4965: Add missing check for create_singlethread_workqueue() - wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() - wifi: mac80211: make rate u32 in sta_set_rate_info_rx() - [arm64] thermal/drivers/hisi: Drop second sensor hi3660 - can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error - bpf: Fix global subprog context argument resolution logic - l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() - [arm64] net: bcmgenet: fix MoCA LED control - drm: Fix potential null-ptr-deref due to drmm_mode_config_init() - drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats - [arm*] drm/vc4: dpi: Add option for inverting pixel clock and output enable - [arm*] drm/vc4: dpi: Fix format mapping for RGB565 - [armhf] gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() - [arm64] drm/msm/hdmi: Add missing check for alloc_ordered_workqueue - [armhf] pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain - [arm64,armhf] pinctrl: rockchip: add support for rk3568 - [arm64,armhf] pinctrl: rockchip: do coding style for mux route struct - [arm64,armhf] pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups - [arm*] drm/vc4: hvs: Set AXI panic modes - [arm*] drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 - [arm*] drm/vc4: hdmi: Correct interlaced timings again - [arm64] ASoC: fsl_sai: initialize is_dsp_mode flag - [arm64] drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() - ALSA: hda/ca0132: minor fix for allocation size - [arm64] drm/msm/dpu: Disallow unallocated resources to be returned - drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness - [arm64] drm/msm: use strscpy instead of strncpy - [arm64] drm/msm/dpu: Add check for cstate - [arm64] drm/msm/dpu: Add check for pstates - [arm64] drm/msm/mdp5: Add check for kzalloc - [arm*] pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback() - [x86] ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() - drm/amdgpu: fix enum odm_combine_mode mismatch - scsi: mpt3sas: Fix a memory leak - scsi: aic94xx: Add missing check for dma_map_single() - dm: remove flush_scheduled_work() during local_exit() - NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() - NFSv4: keep state manager thread active if swap is enabled - nfs4trace: fix state manager flag printing - NFS: fix disabling of swap - HID: bigben: use spinlock to protect concurrent accesses - HID: bigben_worker() remove unneeded check on report_field - HID: bigben: use spinlock to safely schedule workers (CVE-2023-25012) - hid: bigben_probe(): validate report count - nfsd: fix race to check ls_layouts - cifs: Fix lost destroy smbd connection when MR allocate failed - cifs: Fix warning and UAF when destroy the MR list - gfs2: jdata writepage fix - leds: led-core: Fix refcount leak in of_led_get() - [armhf] mtd: rawnand: sunxi: Fix the size of the last OOB region - [arm64,armhf] clk: imx: avoid memory leak - Input: ads7846 - don't report pressure for ads7845 - Input: ads7846 - convert to full duplex - Input: ads7846 - convert to one message - Input: ads7846 - always set last command to PWRDOWN - Input: ads7846 - don't check penirq immediately for 7845 - [powerpc*] powernv/ioda: Skip unallocated resources when mapping to PE - clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() - [powerpc*] perf/hv-24x7: add missing RTAS retry status handling - [powerpc*] pseries/lpar: add missing RTAS retry status handling - [powerpc*] pseries/lparcfg: add missing RTAS retry status handling - [powerpc*] rtas: make all exports GPL - [powerpc*] rtas: ensure 4KB alignment for rtas_data_buf - [powerpc*] eeh: Small refactor of eeh_handle_normal_event() - [powerpc*] eeh: Set channel state after notifying the drivers - [armhf] media: platform: ti: Add missing check for devm_regulator_get - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (CVE-2023-1118) - media: usb: siano: Fix use after free bugs caused by do_submit_urb - media: saa7134: Use video_unregister_device for radio_dev - [arm64] rpmsg: glink: Avoid infinite loop on intent for missing channel - udf: Define EFSCORRUPTED error code - blk-iocost: fix divide by 0 error in calc_lcoefs() - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() - rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks - rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() - rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug - wifi: ath11k: debugfs: fix to work with multiple PCI devices - [x86] thermal: intel: Fix unsigned comparison with less than zero - timers: Prevent union confusion from unexpected restart_syscall() - [x86] bugs: Reset speculation control settings on init - wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds - wifi: mt7601u: fix an integer underflow - inet: fix fast path in __inet_hash_connect() - ice: add missing checks for PF vsi type - ACPI: Don't build ACPICA with '-Os' - clocksource: Suspend the watchdog temporarily when high read latency detected - net: bcmgenet: Add a check for oversized packets - wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup - ACPI: video: Fix Lenovo Ideapad Z570 DMI match - net/mlx5: fw_tracer: Fix debug print - coda: Avoid partial allocation of sig_inputArgs - uaccess: Add minimum bounds check on kernel buffer size - PM: EM: fix memory leak with using debugfs_lookup() - Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE - drm/amd/display: Fix potential null-deref in dm_resume - [armhf] drm/omap: dsi: Fix excessive stack usage - HID: Add Mapping for System Microphone Mute - drm/radeon: free iio for atombios when driver shutdown - drm: amd: display: Fix memory leakage - [arm64] drm/msm/dsi: Add missing check for alloc_ordered_workqueue - [armel,armhf] ASoC: kirkwood: Iterate over array indexes instead of using pointer math - [armhf] regulator: s5m8767: Bounds check id indexing into arrays - gfs2: Improve gfs2_make_fs_rw error handling - [x86] hwmon: (coretemp) Simplify platform device handling - HID: logitech-hidpp: Don't restart communication if not necessary - drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 - dm thin: add cond_resched() to various workqueue loops - dm cache: add cond_resched() to various workqueue loops - nfsd: zero out pointers after putting nfsd_files on COPY setup error - wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu - firmware: coreboot: framebuffer: Ignore reserved pixel color bits - [arm64] rtc: pm8xxx: fix set-alarm race - ipmi_ssif: Rename idle state and check - [s390x] extmem: return correct segment type in __segment_load() - [s390x] discard .interp section - [s390x] kprobes: fix irq mask clobbering on kprobe reenter from post_handler - [s390x] kprobes: fix current_kprobe never cleared after kprobes reenter - cifs: Fix uninitialized memory read in smb3_qfs_tcon() - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create - fs: hfsplus: fix UAF issue in hfsplus_put_super - exfat: fix reporting fs error when reading dir beyond EOF - exfat: fix unexpected EOF while reading dir - exfat: redefine DIR_DELETED as the bad cluster number - exfat: fix inode->i_blocks for non-512 byte sector size device - f2fs: fix information leak in f2fs_move_inline_dirents() - f2fs: fix cgroup writeback accounting with fs-layer encryption - ocfs2: fix defrag path triggering jbd2 ASSERT - ocfs2: fix non-auto defrag path not working issue - udf: Truncate added extents on failed expansion - udf: Do not bother merging very long extents - udf: Do not update file length for failed writes to inline files - udf: Preserve link count of system files - udf: Detect system inodes linked into directory hierarchy - udf: Fix file corruption when appending just after end of preallocated extent - KVM: Destroy target device if coalesced MMIO unregistration fails - [x86] KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI - [s390x] KVM: s390: disable migration mode when dirty tracking is disabled - [x86] virt: Force GIF=1 prior to disabling SVM (for reboot flows) - [x86] crash: Disable virt in core NMI crash handler to avoid double shootdown - [x86] reboot: Disable virtualization in an emergency if SVM is supported - [x86] reboot: Disable SVM, not just VMX, when stopping CPUs - [x86] kprobes: Fix __recover_optprobed_insn check optimizing logic - [x86] kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range - [x86] microcode/amd: Remove load_microcode_amd()'s bsp parameter - [x86] microcode/AMD: Add a @cpu parameter to the reloading functions - [x86] microcode/AMD: Fix mixed steppings support - [x86] speculation: Allow enabling STIBP with legacy IBRS (CVE-2023-1998) - Documentation/hw-vuln: Document the interaction between IBRS and STIBP - brd: return 0/-error from brd_insert_page() - ima: Align ima_file_mmap() parameters with mmap_file LSM hook - irqdomain: Fix association race - irqdomain: Fix disassociation race - irqdomain: Drop bogus fwspec-mapping error handling - io_uring: handle TIF_NOTIFY_RESUME when checking for task_work - io_uring: mark task TASK_RUNNING before handling resume/task work - io_uring: add a conditional reschedule to the IOPOLL cancelation loop - io_uring/rsrc: disallow multi-source reg buffers - io_uring: remove MSG_NOSIGNAL from recvmsg - io_uring/poll: allow some retries for poll triggering spuriously - ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() - ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC - jbd2: fix data missing when reusing bh which is ready to be checkpointed - ext4: optimize ea_inode block expansion - ext4: refuse to create ea block when umounted - mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type - dm: add cond_resched() to dm_wq_work() - wifi: rtl8xxxu: Use a longer retry limit of 48 - wifi: cfg80211: Fix use after free for wext - [x86] thermal: intel: powerclamp: Fix cur_state for multi package system - dm flakey: fix logic when corrupting a bio - dm flakey: don't corrupt the zero page - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails - dax/kmem: Fix leak of memory-hotplug resources - mm: memcontrol: deprecate charge moving - mm/thp: check and bail out if page in deferred queue already - ring-buffer: Handle race between rb_move_tail and rb_check_pages - scsi: qla2xxx: Fix link failure in NPIV environment - scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests - scsi: qla2xxx: Fix erroneous link down - scsi: ses: Don't attach if enclosure has no components - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses - scsi: ses: Fix possible desc_ptr out-of-bounds accesses - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() - PCI/PM: Observe reset delay irrespective of bridge_d3 - PCI: hotplug: Allow marking devices as disconnected during bind/unbind - PCI: Avoid FLR for AMD FCH AHCI adapters - vfio/type1: prevent underflow of locked_vm via exec() - [x86] drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv - drm/radeon: Fix eDP for single-display iMac11,2 - drm/edid: fix AVI infoframe aspect ratio handling - wifi: ath9k: use proper statements in conditionals - [arm64,armhf] pinctrl: rockchip: fix mux route data for rk3568 - [arm64,armhf] pinctrl: rockchip: fix reading pull type on rk3568 - net/sched: Retire tcindex classifier (CVE-2023-1829) - fs/jfs: fix shift exponent db_agl2size negative - objtool: Fix memory leak in create_static_call_sections() - [armhf] pwm: stm32-lp: fix the check on arr and cmp registers update - f2fs: use memcpy_{to,from}_page() where possible - fs: f2fs: initialize fsdata in pagecache_write() - ubi: ensure that VID header offset + VID header size <= alloc, size - ubifs: Fix build errors as symbol undefined - ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted - ubifs: Rectify space budget for ubifs_xrename() - ubifs: Fix wrong dirty space budget for dirty inode - ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1 - ubifs: Reserve one leb for each journal head while doing budget - ubi: Fix use-after-free when volume resizing failed - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() - ubifs: Fix memory leak in alloc_wbufs() - ubi: Fix possible null-ptr-deref in ubi_free_volume() - ubifs: Re-statistic cleaned znode count if commit failed - ubifs: dirty_cow_znode: Fix memleak in error handling path - ubifs: ubifs_writepage: Mark page dirty after writing inode failed - ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed - [x86] um: vdso: Add '%rcx' and '%r11' to the syscall clobber list - watchdog: Fix kmemleak in watchdog_cdev_register - watchdog: pcwd_usb: Fix attempting to access uninitialized memory - netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() - netfilter: ebtables: fix table blob use-after-free - ipv6: Add lwtunnel encap size of all siblings in nexthop calculation - sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop - net: fix __dev_kfree_skb_any() vs drop monitor - 9p/xen: fix version parsing - 9p/xen: fix connection sequence - 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() - net/mlx5: Geneve, Fix handling of Geneve object id as error code - nfc: fix memory leak of se_io context in nfc_genl_se_io - net/sched: act_sample: fix action bind logic - tcp: tcp_check_req() can be called from process context - vc_screen: modify vcs_size() handling in vcs_read() - [arm64,armhf] rtc: sun6i: Always export the internal oscillator - scsi: ipr: Work around fortify-string warning - loop: loop_set_status_from_info() check before assignment - tracing: Add NULL checks for buffer in ring_buffer_free_read_page() - [x86] firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 - bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support - [amd64] IB/hfi1: Update RMT size calculation - media: uvcvideo: Handle cameras with invalid descriptors - media: uvcvideo: Handle errors from calls to usb_string - media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910 - media: uvcvideo: Silence memcpy() run-time false positive warnings - tty: fix out-of-bounds access in tty_driver_lookup_tty() - tty: serial: fsl_lpuart: disable the CTS when send break signal - [x86] mei: bus-fixup:upon error print return values of send and receive - iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() - iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() - [arm64,armhf] usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math - USB: ene_usb6250: Allocate enough memory for full object - usb: uvc: Enumerate valid values for color matching - usb: gadget: uvc: Make bSourceID read/write - PCI: Align extra resources for hotplug bridges properly - PCI: Take other bus devices into account when distributing resources - kernel/fail_function: fix memory leak with using debugfs_lookup() - PCI: Add ACS quirk for Wangxun NICs - [arm64] phy: rockchip-typec: Fix unsigned comparison with less than zero - soundwire: cadence: Remove wasted space in response_buf - soundwire: cadence: Drain the RX FIFO after an IO timeout - [x86] resctrl: Apply READ_ONCE/WRITE_ONCE to task_struct.{rmid,closid} - [x86] resctl: fix scheduler confusion with 'current' - drm/display/dp_mst: Fix down/up message handling after sink disconnect - drm/display/dp_mst: Fix down message handling after a packet reception error - Bluetooth: hci_sock: purge socket queues in the destruct() callback - tcp: Fix listen() regression in 5.10.163 - drm/virtio: Fix error code in virtio_gpu_object_shmem_init() - media: uvcvideo: Provide sync and async uvc_ctrl_status_event - media: uvcvideo: Fix race condition with usb_kill_urb - Revert "scsi: mpt3sas: Fix return value check of dma_get_required_mask()" - scsi: mpt3sas: Don't change DMA mask while reallocating pools - scsi: mpt3sas: re-do lost mpt3sas DMA mask fix - scsi: mpt3sas: Remove usage of dma_get_required_mask() API (Closes: #1022126) - malidp: Fix NULL vs IS_ERR() checking (CVE-2023-23004) - usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.174 - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" - [x86] staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script - [x86] staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.175 - fs: prevent out-of-bounds array speculation when closing a file descriptor - fork: allow CLONE_NEWTIME in clone3 flags - [x86] CPU/AMD: Disable XSAVES on AMD family 0x17 - drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15 - drm/connector: print max_requested_bpc in state debugfs - ext4: fix cgroup writeback accounting with fs-layer encryption - ext4: fix RENAME_WHITEOUT handling for inline directories - ext4: fix another off-by-one fsmap error on 1k block filesystems - ext4: move where set the MAY_INLINE_DATA flag is set - ext4: fix WARNING in ext4_update_inline_data - ext4: zero i_disksize when initializing the bootloader inode - nfc: change order inside nfc_se_io error path - udf: Fix off-by-one error when discarding preallocation - irq: Fix typos in comments - irqdomain: Look for existing mapping only once - irqdomain: Refactor __irq_domain_alloc_irqs() - irqdomain: Fix mapping-creation race - irqdomain: Change the type of 'size' in __irq_domain_add() to be consistent - irqdomain: Fix domain registration race - [amd64] iommu/vt-d: Fix lockdep splat in intel_pasid_get_entry() - [amd64] iommu/vt-d: Fix PASID directory pointer coherency - [arm64] efi: Make efi_rt_lock a raw_spinlock - scsi: core: Remove the /proc/scsi/${proc_name} directory earlier - ext4: Fix possible corruption when moving a directory - drm/nouveau/kms/nv50-: remove unused functions - drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype - [arm64] drm/msm: Fix potential invalid ptr free - [arm64] drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register - [arm64] drm/msm: Document and rename preempt_lock - [arm64] drm/msm/a5xx: fix the emptyness check in the preempt code - [arm64] drm/msm/a5xx: fix context faults during ring switch - ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() - net: usb: lan78xx: Remove lots of set but unused 'ret' variables - net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver - net: stmmac: add to set device wake up flag when stmmac init phy - net: phylib: get rid of unnecessary locking - bnxt_en: Avoid order-5 memory allocation for TPA data - netfilter: ctnetlink: revert to dumping mark regardless of event type - netfilter: tproxy: fix deadlock due to missing BH disable - btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR - scsi: megaraid_sas: Update max supported LD IDs to 240 - net/smc: fix fallback failed while sendmsg with fastopen - SUNRPC: Fix a server shutdown leak - ext4: Fix deadlock during directory rename - [amd64] iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter - watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths - tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address - block, bfq: fix possible uaf for 'bfqq->bic' - block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq - block/bfq-iosched.c: use "false" rather than "BLK_RW_ASYNC" - block, bfq: replace 0/1 with false/true in bic apis - block, bfq: fix uaf for bfqq in bic_set_bfqq() - PCI: Add SolidRun vendor ID - [armhf] media: rc: gpio-ir-recv: add remove function - ipmi/watchdog: replace atomic_add() and atomic_sub() - ipmi:watchdog: Set panic count to proper value on a panic - skbuff: Fix nfct leak on napi stolen - [x86] drm/i915: Don't use BAR mappings for ring buffers with LLC - ext4: refactor ext4_free_blocks() to pull out ext4_mb_clear_bb() - ext4: add ext4_sb_block_valid() refactored out of ext4_inode_block_valid() - ext4: add strict range checks while freeing blocks - ext4: block range must be validated before use in ext4_mb_clear_bb() - arch: fix broken BuildID for arm64 and riscv - [powerpc*] vmlinux.lds: Define RUNTIME_DISCARD_EXIT - [powerpc*] vmlinux.lds: Don't discard .rela* for relocatable builds - [s390x] define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 - [x86] KVM: nVMX: Don't use Enlightened MSR Bitmap for L3 - [x86] KVM: VMX: Introduce vmx_msr_bitmap_l01_changed() helper - [x86] KVM: VMX: Fix crash due to uninitialized current_vmcs - [s390x] dasd: add missing discipline function https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.176 - xfrm: Allow transport-mode states with AF_UNSPEC selector - [arm64,armhf] drm/panfrost: Don't sync rpm suspension after mmu flushing - cifs: Move the in_send statistic to __smb_send_rqst() - [arm64] drm/meson: fix 1px pink line on GXM when scaling video overlay - docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate - scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() - ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() - netfilter: nft_nat: correct length for loading protocol registers - netfilter: nft_masq: correct length for loading protocol registers - netfilter: nft_redir: correct length for loading protocol registers - netfilter: nft_redir: correct value of inet type `.maxattrs` - scsi: core: Fix a comment in function scsi_host_dev_release() - scsi: core: Fix a procfs host directory removal regression - tcp: tcp_make_synack() can be called from process context - nfc: pn533: initialize struct pn533_out_arg properly - ipvlan: Make skb->skb_iif track skb->dev for l3s mode - i40e: Fix kernel crash during reboot when adapter is in recovery mode - net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() - qed/qed_dev: guard against a possible division by zero - net: tunnels: annotate lockless accesses to dev->needed_headroom - net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails - net/smc: fix deadlock triggered by cancel_delayed_work_syn() - net: usb: smsc75xx: Limit packet length to skb->len - drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc - nvme: fix handling single range discard request - nvmet: avoid potential UAF in nvmet_req_complete() - ice: xsk: disable txq irq before flushing hw - net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290 - ipv4: Fix incorrect table ID in IOCTL path - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull - [s390x] net/iucv: Fix size of interrupt data - qed/qed_mng_tlv: correctly zero out ->min instead of ->hour - hwmon: (adt7475) Display smoothing attributes in correct order - hwmon: (adt7475) Fix masking of hysteresis registers - [arm64] hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (CVE-2023-1855) - jffs2: correct logic when creating a hole in jffs2_write_begin - ext4: fail ext4_iget if special inode unallocated - ext4: fix task hung in ext4_xattr_delete_inode - drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes - ext4: fix possible double unlock when moving a directory - [arm64] tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted - [arm64] firmware: xilinx: don't make a sleepable memory allocation from an atomic context - tracing: Make splice_read available again - tracing: Check field value in hist_field_name() - tracing: Make tracepoint lockdep check actually test something - cifs: Fix smb2_set_path_size() - [x86] KVM: nVMX: add missing consistency checks for CR0 and CR4 (CVE-2023-30456) - ALSA: hda: intel-dsp-config: add MTL PCI id - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro - drm/shmem-helper: Remove another errant put in error path - ftrace: Fix invalid address access in lookup_rec() when index is 0 - mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage - [x86] mce: Make sure logged MCEs are processed after sysfs update - [x86] mm: Fix use of uninitialized buffer in sme_enable() - [x86] drm/i915: Don't use stolen memory for ring buffers with LLC - [x86] drm/i915/active: Fix misuse of non-idle barriers as fence trackers - io_uring: avoid null-ptr-deref in io_arm_poll_handler - [s390x] ipl: add missing intersection check to ipl_report handling - PCI: Unify delay handling for reset and resume - PCI/DPC: Await readiness of secondary bus after reset - xfs: don't assert fail on perag references on teardown - xfs: purge dquots after inode walk fails during quotacheck - xfs: don't leak btree cursor when insrec fails after a split - xfs: remove XFS_PREALLOC_SYNC - xfs: fallocate() should call file_modified() - xfs: set prealloc flag in xfs_alloc_file_space() - xfs: use setattr_copy to set vfs inode attributes - fs: add mode_strip_sgid() helper - fs: move S_ISGID stripping into the vfs_*() helpers - attr: add in_group_or_capable() - fs: move should_remove_suid() - attr: add setattr_should_drop_sgid() - attr: use consistent sgid stripping checks - fs: use consistent setgid checks in is_sxid() - xfs: remove xfs_setattr_time() declaration - HID: core: Provide new max_buffer_size attribute to over-ride the default - HID: uhid: Over-ride the default maximum data buffer value with our own https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.177 - perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output - perf: fix perf_event_context->time - ipmi:ssif: make ssif_i2c_send() void - ipmi:ssif: Increase the message retry time - ipmi:ssif: resend_msg() cannot fail - ipmi:ssif: Add a timer between request retries - KVM: Clean up benign vcpu->cpu data races when kicking vCPUs - KVM: KVM: Use cpumask_available() to check for NULL cpumask when kicking vCPUs - KVM: Optimize kvm_make_vcpus_request_mask() a bit - KVM: Pre-allocate cpumasks for kvm_make_all_cpus_request_except() - KVM: Register /dev/kvm as the _very_ last thing during initialization - [arm64] serial: fsl_lpuart: Fix comment typo - [arm64] tty: serial: fsl_lpuart: fix race on RX DMA shutdown - [arm64,armhf] drm/sun4i: fix missing component unbind on bind errors - net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() (CVE-2023-28466) - [x86] power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync - [x86] power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition - [armhf] dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl - xsk: Add missing overflow check in xdp_umem_reg - iavf: fix inverted Rx hash condition leading to disabled hash - iavf: fix non-tunneled IPv6 UDP packet type and hashing - intel/igbvf: free irq on the error path in igbvf_request_msix() - igbvf: Regard vf reset nack as success - igc: fix the validation logic for taprio's gate list - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() - net: usb: smsc95xx: Limit packet length to skb->len - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info - [x86] xirc2ps_cs: Fix use after free bug in xirc2ps_detach (CVE-2023-1670) - net: phy: Ensure state transitions are processed from phy_stop() - net: mdio: fix owner field for mdio buses registered using device-tree - [arm64] net: qcom/emac: Fix use after free bug in emac_remove due to race condition - keys: Do not cache key in task struct if key is requested from kernel thread - bpf: Adjust insufficient default bpf_jit_limit - net/mlx5: Fix steering rules cleanup - net/mlx5: Read the TC mapping of all priorities on ETS query - net/mlx5: E-Switch, Fix an Oops in error handling code - atm: idt77252: fix kmemleak when rmmod idt77252 - erspan: do not use skb_mac_header() in ndo_start_xmit() - nvme-tcp: fix nvme_tcp_term_pdu to match spec - [amd64,arm64] gve: Cache link_speed value from device - [arm64] net: mdio: thunder: Add missing fwnode_handle_put() - [arm64] Bluetooth: btqcomsmd: Fix command timeout after setting BD address - Bluetooth: L2CAP: Fix not checking for maximum number of DCID - Bluetooth: L2CAP: Fix responding with wrong PDU type - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work (CVE-2023-1989) - [arm64] platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl - hwmon: fix potential sensor registration fail if of_node is missing - [x86] hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs - scsi: qla2xxx: Perform lockless command completion in abort path - [x86] thunderbolt: Use scale field when allocating USB3 bandwidth - [x86] thunderbolt: Use const qualifier for `ring_interrupt_index` - HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded - scsi: target: iscsi: Fix an error message in iscsi_check_key() - [arm64] scsi: hisi_sas: Check devm_add_action() return value - scsi: ufs: core: Add soft dependency on governor_simpleondemand - scsi: lpfc: Avoid usage of list iterator variable after loop - [x86] scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file - net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 - net: usb: qmi_wwan: add Telit 0x1080 composition - cifs: empty interface list when server doesn't support query interfaces - scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR - [arm*] usb: dwc2: fix a devres leak in hw_enable upon suspend resume - usb: gadget: u_audio: don't let userspace block driver unbind - fsverity: Remove WQ_UNBOUND from fsverity read workqueue - igb: revert rtnl_lock() that causes deadlock - dm thin: fix deadlock when swapping to thin device - [arm64,armhf] usb: chipdea: core: fix return -EINVAL if request role is the same with current role - [arm64,armhf] usb: chipidea: core: fix possible concurrent when switch role - usb: ucsi: Fix NULL pointer deref in ucsi_connector_change() - wifi: mac80211: fix qos on mesh interfaces - nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() - [x86] drm/i915/active: Fix missing debug object activation - [x86] drm/i915: Preserve crtc_state->inherited during state clearing - [arm64] i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (CVE-2023-2194) - dm stats: check for and propagate alloc_percpu failure - dm crypt: add cond_resched() to dmcrypt_write() - sched/fair: sanitize vruntime of entity being placed - sched/fair: Sanitize vruntime of entity being migrated - ocfs2: fix data corruption after failed write - xfs: shut down the filesystem if we screw up quota reservation - xfs: don't reuse busy extents on extent trim - KVM: fix memoryleak in kvm_init() - NFSD: fix use-after-free in __nfs42_ssc_open() (CVE-2022-4379) - [arm64,armhf] usb: dwc3: gadget: move cmd_endtransfer to extra function - [arm64,armhf] usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC - [arm64] drm/meson: Fix error handling when afbcd.ops->init fails - [arm64] drm/meson: fix missing component unbind on bind errors - dm crypt: avoid accessing uninitialized tasklet - fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY - md: avoid signed overflow in slot_store() - [x86] ALSA: asihpi: check pao in control_message() - ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() - sched_getaffinity: don't assume 'cpumask_size()' is fully initialized - tracing: Fix wrong return in kprobe_event_gen_test.c - sfc: ef10: don't overwrite offload features at NIC reset - scsi: megaraid_sas: Fix crash after a double completion - [arm64] ptp_qoriq: fix memory leak in probe() - r8169: fix RTL8168H and RTL8107E rx crc error - [arm*] regulator: Handle deferred clk - net/net_failover: fix txq exceeding warning - net: stmmac: don't reject VLANs when IFF_PROMISC is set - ALSA: ymfpci: Fix assignment in if condition - ALSA: ymfpci: Fix BUG_ON in probe function - i40e: fix registers dump after run ethtool adapter self test - bnxt_en: Fix typo in PCI id to device description string mapping - bnxt_en: Add missing 200G link speed reporting - [arm64,armhf] net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only - Input: alps - fix compatibility with -funsigned-char - Input: focaltech - use explicitly signed char type - cifs: prevent infinite recursion in CIFSGetDFSRefer() - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL - Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table - btrfs: fix race between quota disable and quota assign ioctls (CVE-2023-1611) - xen/netback: don't do grant copy across page boundary - pinctrl: amd: Disable and mask interrupts on resume - [powerpc*] Don't try to copy PPR for task with NULL pt_regs - NFSv4: Fix hangs when recovering open state after a server reboot - ALSA: hda/conexant: Partial revert of a quirk for Lenovo - ALSA: usb-audio: Fix regression on detection of Roland VS-100 - ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z - rcu: Fix rcu_torture_read ftrace event - [armhf] drm/etnaviv: fix reference leak when mmaping imported buffer - drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub - [s390x] uaccess: add missing earlyclobber annotations to __clear_user() - btrfs: scan device in non-exclusive mode - zonefs: Fix error message in zonefs_file_dio_append() - ext4: fix kernel BUG in 'ext4_write_inline_data_end()' - gfs2: Always check inode size of inline inodes https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.178 - [x86] Drivers: vmbus: Check for channel allocation before looking up relids - [arm64] pwm: cros-ec: Explicitly set .polarity in .get_state() - [s390x] KVM: s390: pv: fix external interruption loop not always detected - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta - icmp: guard against too small mtu - net: don't let netpoll invoke NAPI if in xmit context - sctp: check send stream number after wait_for_sndbuf - ipv6: Fix an uninit variable access bug in __ip6_make_skb() - net: stmmac: fix up RX flow hash indirection table when setting channels - sunrpc: only free unix grouplist after RCU settles - NFSD: callback request does not use correct credential for AUTH_SYS - [arm64,armhf] usb: xhci: tegra: fix sleep in atomic call - xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu - USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs - usb: typec: altmodes/displayport: Fix configure initial pin assignment - USB: serial: option: add Telit FE990 compositions - USB: serial: option: add Quectel RM500U-CN modem - iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip - iio: light: cm32181: Unregister second I2C client if present - [arm64] tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty - nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() - nilfs2: fix sysfs interface lifetime - dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs - ALSA: hda/realtek: Add quirk for Clevo X370SNW - iio: adc: ad7791: fix IRQ flags - scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() - perf/core: Fix the same task check in perf_event_set_output - ftrace: Mark get_lock_parent_ip() __always_inline - ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct() - can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access - can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events - tracing: Free error logs of tracing instances - ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots() - [arm64,armhf] drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path - drm/nouveau/disp: Support more modes by checking with lower bpc - ring-buffer: Fix race while reader and writer are on the same page - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() - ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown - bpftool: Print newline before '}' for struct with padding only fields - Revert "pinctrl: amd: Disable and mask interrupts on resume" - ALSA: emu10k1: fix capture interrupt handler unlinking - ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard - ALSA: i2c/cs8427: fix iec958 mixer control deactivation - ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() - ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} - Bluetooth: Fix race condition in hidp_session_thread - btrfs: print checksum type and implementation at mount time - btrfs: fix fast csum implementation detection - fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace - mtdblock: tolerate corrected bit-flips - [armhf] mtd: rawnand: stm32_fmc2: remove unsupported EDO mode - [armhf] mtd: rawnand: stm32_fmc2: use timings.mode instead of checking tRC_min - IB/mlx5: Add support for NDR link speed - IB/mlx5: Add support for 400G_8X lane speed - RDMA/cma: Allow UD qp_type to join multicast only - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition (CVE-2023-1859) - niu: Fix missing unwind goto in niu_alloc_channels() - sysctl: add proc_dou8vec_minmax() - ipv4: shrink netns_ipv4 with sysctl conversions - tcp: convert elligible sysctls to u8 - tcp: restrict net.ipv4.tcp_app_win - [armhf] drm/armada: Fix a potential double free in an error handling path - qlcnic: check pci_reset_function result - sctp: fix a potential overflow in sctp_ifwdtsn_skip - RDMA/core: Fix GID entry ref leak when create_ah fails - udp6: fix potential access to stale information - [arm64] net: macb: fix a memory corruption in extended buffer descriptor mode - [arm64] power: supply: cros_usbpd: reclassify "default case!" as debug - wifi: mwifiex: mark OF related data as maybe unused - [x86] efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L - drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F - [amd64] verify_pefile: relax wrapper length check - asymmetric_keys: log on fatal failures in PE/pkcs7 - net: sfp: initialize sfp->i2c_block_size at sfp allocation - scsi: ses: Handle enclosure with just a primary component gracefully - [x86] PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size - mtd: ubi: wl: Fix a couple of kernel-doc issues - ubi: Fix deadlock caused by recursively holding work_sem - [powerpc*] pseries: rename min_common_depth to primary_domain_index - [powerpc*] pseries: Rename TYPE1_AFFINITY to FORM1_AFFINITY - [powerpc*] pseries: Consolidate different NUMA distance update code paths - [powerpc*] pseries: Add a helper for form1 cpu distance - [powerpc*] pseries: Add support for FORM2 associativity - [powerpc*] papr_scm: Update the NUMA distance table for the target node - sched/fair: Move calculate of avg_load to a better location - sched/fair: Fix imbalance overflow - [x86] rtc: Remove __init for runtime functions - i2c: ocores: generate stop condition after timeout in polling mode - [arm64] watchdog: sbsa_wdog: Make sure the timeout programming is within the limits - kbuild: check the minimum assembler version in Kconfig - kbuild: Switch to 'f' variants of integrated assembler flag - kexec: move locking into do_kexec_load - kexec: turn all kexec_mutex acquisitions into trylocks - panic, kexec: make __crash_kexec() NMI safe - sysctl: Fix data-races in proc_dou8vec_minmax(). [ Salvatore Bonaccorso ] * Refresh "security,perf: Allow further restriction of perf_event_open" * [rt] Update to 5.10.165-rt81 * Bump ABI to 22 * [rt] Refresh "printk: add pr_flush()" * [rt] Update to 5.10.168-rt83 * [rt] Update to 5.10.176-rt86 -- Salvatore Bonaccorso Fri, 21 Apr 2023 13:24:45 +0200 linux (5.10.162-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.159 - [armhf] dts: rockchip: fix node name for hym8563 rtc - [armhf] dts: rockchip: fix ir-receiver node names - [arm64] dts: rockchip: fix ir-receiver node names - [armel,armhf] 9266/1: mm: fix no-MMU ZERO_PAGE() implementation - 9p/fd: Use P9_HDRSZ for header size - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event - btrfs: send: avoid unaligned encoded writes when attempting to clone range - ASoC: soc-pcm: Add NULL check in BE reparenting - [armhf] regulator: twl6030: fix get status of twl6032 regulators - fbcon: Use kzalloc() in fbcon_prepare_logo() - [arm64,armhf] usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer - 9p/xen: check logical size for buffer size - net: usb: qmi_wwan: add u-blox 0x1342 composition - mm/khugepaged: take the right locks for page table retraction - mm/khugepaged: fix GUP-fast interaction by sending IPI - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths - rtc: mc146818: Prevent reading garbage - rtc: mc146818: Detect and handle broken RTCs - rtc: mc146818: Dont test for bit 0-5 in Register D - rtc: cmos: remove stale REVISIT comments - rtc: mc146818-lib: change return values of mc146818_get_time() - rtc: Check return value from mc146818_get_time() - rtc: mc146818-lib: fix RTC presence check - rtc: mc146818-lib: extract mc146818_avoid_UIP - rtc: cmos: avoid UIP when writing alarm time - rtc: cmos: avoid UIP when reading alarm time - rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ - rtc: mc146818: Reduce spinlock section in mc146818_set_time() - media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() - media: v4l2-dv-timings.c: fix too strict blanking sanity checks - memcg: fix possible use-after-free in memcg_write_event_control() - mm/gup: fix gup_pud_range() for dax - Bluetooth: btusb: Add debug message for CSR controllers - Bluetooth: Fix crash when replugging CSR fake controllers - [s390x] KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field - [x86] drm/vmwgfx: Don't use screen objects when SEV is active - drm/shmem-helper: Remove errant put in error path - drm/shmem-helper: Avoid vm_open error paths - HID: usbhid: Add ALWAYS_POLL quirk for some mice - HID: hid-lg4ff: Add check for empty lbuf - HID: core: fix shift-out-of-bounds in hid_report_raw_event - can: af_can: fix NULL pointer dereference in can_rcv_filter - mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page (CVE-2022-3623) - rtc: cmos: Disable irq around direct invocation of cmos_interrupt() - rtc: mc146818-lib: fix locking in mc146818_set_time - rtc: mc146818-lib: fix signedness bug in mc146818_get_time() - netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one - ieee802154: cc2520: Fix error return code in cc2520_hw_init() - netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark - e1000e: Fix TX dispatch condition - igb: Allocate MSI-X vector when testing - [arm64,armhf] drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420 - af_unix: Get user_ns from in_skb in unix_diag_get_exact(). - [x86] vmxnet3: correctly report encapsulated LRO packet - Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() - Bluetooth: Fix not cleanup led when bt_init fails - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() - xen-netfront: Fix NULL sring after live migration - [arm64,armhf] net: mvneta: Prevent out of bounds read in mvneta_config_rss() - i40e: Fix not setting default xps_cpus after reset - i40e: Fix for VF MAC address 0 - i40e: Disallow ip4 and ip6 l4_4_bytes - nvme initialize core quirks before calling nvme_init_subsystem - net: stmmac: fix "snps,axi-config" node property parsing - ip_gre: do not report erspan version on GRE interface - [arm64] net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq - [arm64] net: hisilicon: Fix potential use-after-free in hisi_femac_rx() - [arm64] net: hisilicon: Fix potential use-after-free in hix5hd2_rx() - tipc: Fix potential OOB in tipc_link_proto_rcv() - ipv4: Fix incorrect route flushing when source address is deleted - ipv4: Fix incorrect route flushing when table ID 0 is used - tipc: call tipc_lxc_xmit without holding node_read_lock - [x86] net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() - ipv6: avoid use-after-free in ip6_fragment() - [arm64,armhf] net: mvneta: Fix an out of bounds check - macsec: add missing attribute validation for offload - can: esd_usb: Allow REC and TEC to return to zero https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.160 - [x86] smpboot: Move rcu_cpu_starting() earlier - vfs: fix copy_file_range() regression in cross-fs copies - vfs: fix copy_file_range() averts filesystem freeze protection - nfp: fix use-after-free in area_cache_get() (CVE-2022-3545) - fuse: always revalidate if exclusive create - io_uring: add missing item types for splice request (CVE-2022-4696) - ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() - can: mcba_usb: Fix termination command argument - [armel,armhf] ASoC: cs42l51: Correct PGA Volume minimum value - nvme-pci: clear the prp2 field when not used - ASoC: ops: Correct bounds check for second channel on SX controls https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.161 - udf: Discard preallocation before extending file with a hole - udf: Fix preallocation discarding at indirect extent boundary - udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size - udf: Fix extending file within last block - usb: gadget: uvc: Prevent buffer overflow in setup handler - USB: serial: option: add Quectel EM05-G modem - USB: serial: cp210x: add Kamstrup RF sniffer PIDs - USB: serial: f81232: fix division by zero on line-speed change - USB: serial: f81534: fix division by zero on line-speed change - xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N - igb: Initialize mailbox message for VF reset - HID: ite: Add support for Acer S1002 keyboard-dock - HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch 10E - HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 - HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk - Bluetooth: L2CAP: Fix u8 overflow (CVE-2022-45934) - net: loopback: use NET_NAME_PREDICTABLE for name_assign_type https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.162 - kernel: provide create_io_thread() helper - iov_iter: add helper to save iov_iter state - saner calling conventions for unlazy_child() - fs: add support for LOOKUP_CACHED - fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy* - Make sure nd->path.mnt and nd->path.dentry are always valid pointers - fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED - tools headers UAPI: Sync openat2.h with the kernel sources - net: provide __sys_shutdown_sock() that takes a socket - net: add accept helper not installing fd - signal: Add task_sigpending() helper - fs: make do_renameat2() take struct filename - file: Rename __close_fd_get_file close_fd_get_file - fs: provide locked helper variant of close_fd_get_file() - entry: Add support for TIF_NOTIFY_SIGNAL - task_work: Use TIF_NOTIFY_SIGNAL if available - [x86] Wire up TIF_NOTIFY_SIGNAL - [arm64] add support for TIF_NOTIFY_SIGNAL - [powerpc*] add support for TIF_NOTIFY_SIGNAL - [mips*] add support for TIF_NOTIFY_SIGNAL - [s390x] add support for TIF_NOTIFY_SIGNAL - [armel,armhf] add support for TIF_NOTIFY_SIGNAL - task_work: remove legacy TWA_SIGNAL path - kernel: remove checking for TIF_NOTIFY_SIGNAL - coredump: Limit what can interrupt coredumps - kernel: allow fork with TIF_NOTIFY_SIGNAL pending - entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set - arch: setup PF_IO_WORKER threads like PF_KTHREAD - arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() - [x86] process: setup io_threads more like normal user space threads - kernel: stop masking signals in create_io_thread() - kernel: don't call do_exit() for PF_IO_WORKER threads - task_work: add helper for more targeted task_work canceling - io_uring: import 5.15-stable io_uring - signal: kill JOBCTL_TASK_WORK - task_work: unconditionally run task_work from get_signal() - net: remove cmsg restriction from io_uring based send/recvmsg calls - Revert "proc: don't allow async path resolution of /proc/thread-self components" - Revert "proc: don't allow async path resolution of /proc/self components" - eventpoll: add EPOLL_URING_WAKE poll wakeup flag - eventfd: provide a eventfd_signal_mask() helper - io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups [ Salvatore Bonaccorso ] * linux-kbuild: Include scripts/pahole-flags.sh (Closes: #1008501) * Bump ABI to 21 * Refresh "Export symbols needed by Android drivers" * ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio (Closes: #1027430, #1027483) * ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire (Closes: #1027430, #1027483) * [rt] Update to 5.10.162-rt78 * i2c: ismt: Fix an out-of-bounds bug in ismt_access() (CVE-2022-2873) * [x86] drm/vmwgfx: Validate the box size for the snooped cursor (CVE-2022-36280) * media: dvb-core: Fix UAF due to refcount races at releasing (CVE-2022-41218) * net: sched: disallow noqueue for qdisc classes (CVE-2022-47929) * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266) * net: sched: cbq: dont intepret cls results when asked to drop (CVE-2023-23454) * net: sched: atm: dont intepret cls results when asked to drop (CVE-2023-23455) * netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits (CVE-2023-0179) * ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (CVE-2023-0394) * [rt] arm64: make _TIF_WORK_MASK bits contiguous [ Ben Hutchings ] * Disable SECURITY_LOCKDOWN_LSM and MODULE_SIG where we don't sign code (Closes: #825141) -- Salvatore Bonaccorso Sat, 21 Jan 2023 15:35:48 +0100 linux (5.10.158-2) bullseye; urgency=medium * xen/netback: fix build warning -- Salvatore Bonaccorso Tue, 13 Dec 2022 21:46:50 +0100 linux (5.10.158-1) bullseye; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.150 - ALSA: oss: Fix potential deadlock at unregistration - ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() - ALSA: usb-audio: Fix potential memory leaks - ALSA: usb-audio: Fix NULL dererence at error path - ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530 - ALSA: hda/realtek: Correct pin configs for ASUS G533Z - ALSA: hda/realtek: Add quirk for ASUS GV601R laptop - ALSA: hda/realtek: Add Intel Reference SSID to support headset keys - cifs: destage dirty pages before re-reading them for cache=none - cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message - iio: dac: ad5593r: Fix i2c read protocol requirements - iio: ltc2497: Fix reading conversion results - iio: adc: ad7923: fix channel readings for some variants - iio: pressure: dps310: Refactor startup procedure - iio: pressure: dps310: Reset chip after timeout - usb: add quirks for Lenovo OneLink+ Dock - can: kvaser_usb: Fix use of uninitialized completion - can: kvaser_usb_leaf: Fix overread with an invalid command - can: kvaser_usb_leaf: Fix TX queue out of sync after restart - can: kvaser_usb_leaf: Fix CAN state after restart - fs: dlm: fix race between test_bit() and queue_work() - fs: dlm: handle -EBUSY first in lock arg validation - HID: multitouch: Add memory barriers - quota: Check next/prev free block number after reading from quota file - [arm64,armhf] platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure - [arm64] regulator: qcom_rpm: Fix circular deferral regression - nvme-pci: set min_align_mask before calculating max_hw_sectors - drm/virtio: Check whether transferred 2D BO is shmem - drm/udl: Restore display mode on resume - block: fix inflight statistics of part0 - mm/mmap: undo ->mmap() when arch_validate_flags() fails - PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge - [x86] powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain - scsi: qedf: Populate sysfs attributes for vport - fbdev: smscufx: Fix use-after-free in ufx_ops_open() (CVE-2022-41849) - btrfs: fix race between quota enable and quota rescan ioctl - f2fs: increase the limit for reserve_root - f2fs: fix to do sanity check on destination blkaddr during recovery - f2fs: fix to do sanity check on summary info - jbd2: wake up journal waiters in FIFO order, not LIFO - jbd2: fix potential buffer head reference count leak - jbd2: fix potential use-after-free in jbd2_fc_wait_bufs - jbd2: add miss release buffer head in fc_do_one_pass() - ext4: avoid crash when inline data creation follows DIO write - ext4: fix null-ptr-deref in ext4_write_info - ext4: make ext4_lazyinit_thread freezable - ext4: don't increase iversion counter for ea_inodes - ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate - ext4: place buffer head allocation before handle start - ext4: fix miss release buffer head in ext4_fc_write_inode - ext4: fix potential memory leak in ext4_fc_record_modified_inode() - ext4: fix potential memory leak in ext4_fc_record_regions() - ext4: update 'state->fc_regions_size' after successful memory allocation - [amd64] livepatch: fix race between fork and KLP transition - ftrace: Properly unset FTRACE_HASH_FL_MOD - ring-buffer: Allow splice to read previous partially read pages - ring-buffer: Have the shortest_full queue be the shortest not longest - ring-buffer: Check pending waiters when doing wake ups as well - ring-buffer: Add ring_buffer_wake_waiters() - ring-buffer: Fix race between reset page and reading page - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t - [x86] thunderbolt: Explicitly enable lane adapter hotplug events at startup - efi: libstub: drop pointless get_memory_map() call - [arm64,armhf] media: cedrus: Set the platform driver data earlier - [x86] KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility - [x86] KVM: nVMX: Unconditionally purge queued/injected events on nested "exit" - [x86] KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS - drm/nouveau/kms/nv140-: Disable interlacing - drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() - [x86] drm/i915: Fix watermark calculations for gen12+ RC CCS modifier - [x86] drm/i915: Fix watermark calculations for gen12+ MC CCS modifier - smb3: must initialize two ACL struct fields to zero - selinux: use "grep -E" instead of "egrep" - userfaultfd: open userfaultfds with O_RDONLY - [armel,armhf] 9244/1: dump: Fix wrong pg_level in walk_pmd() - [armel,armhf] 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE - objtool: Preserve special st_shndx indexes in elf_update_symbol - nfsd: Fix a memory leak in an error handling path - wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() - wifi: mac80211: allow bw change during channel switch in mesh - bpftool: Fix a wrong type cast in btf_dumper_int - [x86] resctrl: Fix to restore to original value when re-enabling hardware prefetch register - Bluetooth: btusb: Fine-tune mt7663 mechanism. - Bluetooth: btusb: fix excessive stack usage - Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend - wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse() - [arm64] spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume() - [arm64] spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime() - wifi: rtl8xxxu: Fix skb misuse in TX queue selection - [arm64,armhf] spi: meson-spicc: do not rely on busy flag in pow2 clk ops - bpf: btf: fix truncated last_member_type_id in btf_struct_resolve - wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration - wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask - bpf: Ensure correct locking around vulnerable function find_vpid() - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure - wifi: ath11k: fix number of VHT beamformee spatial streams - [x86] microcode/AMD: Track patch allocation size explicitly - [x86] cpu: Include the header of init_ia32_feat_ctl()'s prototype - Bluetooth: hci_core: Fix not handling link timeouts propertly - netfilter: nft_fib: Fix for rpath check with VRF devices - wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM - vhost/vsock: Use kvmalloc/kvfree for larger packets. - mISDN: fix use-after-free bugs in l1oip timer handlers (CVE-2022-3565) - sctp: handle the error returned from sctp_auth_asoc_init_active_key - tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited - spi: Ensure that sg_table won't be used after being freed - net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() - bnx2x: fix potential memory leak in bnx2x_tpa_stop() (CVE-2022-3542) - net/ieee802154: reject zero-sized raw_sendmsg() - once: add DO_ONCE_SLOW() for sleepable contexts - [arm64,armhf] net: mvpp2: fix mvpp2 debugfs leak (CVE-2022-3535) - [arm64] drm: bridge: adv7511: fix CEC power down control register offset - drm/bridge: Avoid uninitialized variable warning - drm/mipi-dsi: Detach devices when removing the host - drm/dp_mst: fix drm_dp_dpcd_read return value checks - [x86] platform/chrome: fix double-free in chromeos_laptop_prepare() - [arm64] platform/chrome: fix memory corruption in ioctl - [x86] platform/x86: msi-laptop: Fix old-ec check for backlight registering - [x86] platform/x86: msi-laptop: Fix resource cleanup - ALSA: hda: beep: Simplify keep-power-at-enable behavior - [armhf] drm/omap: dss: Fix refcount leak bugs - [armhf] ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API - [arm64] drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx - [arm64] drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa() - ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() - [arm*] ALSA: dmaengine: increment buffer pointer atomically - [armhf] mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe() - ALSA: hda/hdmi: Don't skip notification handling during PM operation - [armel,armhf] memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe() - [armhf] memory: of: Fix refcount leak bug in of_get_ddr_timings() - [armhf] memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings() - [armhf] dts: turris-omnia: Fix mpp26 pin name and comment - [arm64] ftrace: fix module PLTs with mcount - [armhf] dts: exynos: fix polarity of VBUS GPIO of Origen - iio: inkern: only release the device node when done with it - iio: ABI: Fix wrong format of differential capacitance channel ABI. - usb: ch9: Add USB 3.2 SSP attributes - usb: common: Parse for USB SSP genXxY - usb: common: add function to get interval expressed in us unit - usb: common: move function's kerneldoc next to its definition - usb: common: debug: Check non-standard control requests - [arm64,armhf] clk: meson: Hold reference returned by of_get_parent() - [arm64] clk: qoriq: Hold reference returned by of_get_parent() - [arm64] clk: tegra: Fix refcount leak in tegra210_clock_init - [arm64] clk: tegra: Fix refcount leak in tegra114_clock_init - [armhf] HSI: omap_ssi: Fix refcount leak in ssi_probe - [armhf] HSI: omap_ssi_port: Fix dma_map_sg error check - [arm64] tty: xilinx_uartps: Fix the ignore_status - RDMA/rxe: Fix "kernel NULL pointer dereference" error - RDMA/rxe: Fix the error caused by qp->sk - ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() - ata: fix ata_id_has_devslp() - ata: fix ata_id_has_ncq_autosense() - ata: fix ata_id_has_dipm() - md: Replace snprintf with scnprintf - md/raid5: Ensure stripe_fill happens on non-read IO with journal - RDMA/cm: Use SLID in the work completion as the DLID in responder side - IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers - xhci: Don't show warning for reinit on known broken suspend - usb: gadget: function: fix dangling pnp_string in f_printer.c - drivers: serial: jsm: fix some leaks in probe - serial: 8250: Add an empty line and remove some useless {} - serial: 8250: Toggle IER bits on only after irq has been set up - [arm64] tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown - [arm64] phy: qualcomm: call clk_disable_unprepare in the error handling - serial: 8250: Fix restoring termios speed after suspend - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() - scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() - [armhf] fsi: core: Check error number after calling ida_simple_get - [x86] mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() - [mips*] mfd: sm501: Add check for platform_driver_register() - [amd64] dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup() - [arm64] spmi: pmic-arb: correct duplicate APID to PPID mapping logic - [arm*] clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration - [armhf] clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe - [armhf] clk: ast2600: BCLK comes from EPLL - [powerpc*] pci_dn: Add missing of_node_put() - [powerpc*] powernv: add missing of_node_put() in opal_export_attrs() - [x86] hyperv: Fix 'struct hv_enlightened_vmcs' definition - [powerpc*] 64s: Fix GENERIC_CPU build flags for PPC970 / G5 - [armhf] hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear() - cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset - crypto: akcipher - default implementation for setting a private key - [x86] crypto: ccp - Release dma channels before dmaengine unrgister - [arm64] crypto: inside-secure - Change swab to swab32 - [x86] crypto: qat - fix use of 'dma_map_single' - [x86] crypto: qat - use pre-allocated buffers in datapath - [x86] crypto: qat - fix DMA transfer direction - tracing: kprobe: Fix kprobe event gen test module on exit - tracing: kprobe: Make gen test module work in arm and riscv - [arm64] crypto: cavium - prevent integer overflow loading firmware - [arm64] thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id - ACPI: APEI: do not add task_work to kernel thread to avoid memory leak - f2fs: fix race condition on setting FI_NO_EXTENT flag - f2fs: fix to avoid REQ_TIME and CP_TIME collision - f2fs: fix to account FS_CP_DATA_IO correctly - rcu: Back off upon fill_page_cache_func() allocation failure - rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE() - [x86] ACPI: video: Add Toshiba Satellite/Portege Z830 quirk - [x86] powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue - [x86] thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash - NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data - NFSD: fix use-after-free on source server when doing inter-server copy - wifi: brcmfmac: fix invalid address access when enabling SCAN log level - bpftool: Clear errno after libcap's checks - openvswitch: Fix double reporting of drops in dropwatch - openvswitch: Fix overreporting of drops in dropwatch - tcp: annotate data-race around tcp_md5sig_pool_populated - wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() - xfrm: Update ipcomp_scratches with NULL when freed - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() - regulator: core: Prevent integer underflow - Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times - can: bcm: check the result of can_send() in bcm_can_tx() - wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 - wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 - wifi: rt2x00: set VGC gain for both chains of MT7620 - wifi: rt2x00: set SoC wmac clock register - wifi: rt2x00: correctly set BBP register 86 for MT7620 - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory - Bluetooth: L2CAP: Fix user-after-free - r8152: Rate limit overflow messages (CVE-2022-3594) - drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc() - drm: Use size_t type for len variable in drm_copy_field() - drm: Prevent drm_copy_field() to attempt copying a NULL pointer - drm/amd/display: fix overflow on MIN_I64 definition - [arm64,armhf] drm: bridge: dw_hdmi: only trigger hotplug event on link change - [arm*] drm/vc4: vec: Fix timings for VEC modes - drm: panel-orientation-quirks: Add quirk for Anbernic Win600 - [arm64,armhf] platform/chrome: cros_ec: Notify the PM of wake events during resume - [x86] platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading - [x86] ASoC: SOF: pci: Change DMI match info to support all Chrome platforms - drm/amdgpu: fix initial connector audio value - [arm64] drm/meson: explicitly remove aggregate driver at module unload time - [arm64] mmc: sdhci-msm: add compatible string check for sdm670 - drm/dp: Don't rewrite link config when setting phy test pattern - drm/amd/display: Remove interface for periodic interrupt 1 - btrfs: scrub: try to fix super block errors - [arm64] clk: zynqmp: Fix stack-out-of-bounds in strncpy` - media: cx88: Fix a null-ptr-deref bug in buffer_prepare() - [arm64] clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate - usb: host: xhci-plat: suspend and resume clocks - usb: host: xhci-plat: suspend/resume clks for brcm - scsi: 3w-9xxx: Avoid disabling device if failing to enable it - nbd: Fix hung when signal interrupts nbd_start_device_ioctl() - blk-throttle: prevent overflow while calculating wait time - ata: libahci_platform: Sanity check the DT child nodes number - bcache: fix set_at_max_writeback_rate() for multiple attached devices - soundwire: cadence: Don't overwrite msg->buf during write commands - soundwire: intel: fix error handling on dai registration issues - HID: roccat: Fix use-after-free in roccat_read() (CVE-2022-41850) - md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() - [arm64,armhf] usb: musb: Fix musb_gadget.c rxstate overflow bug - Revert "usb: storage: Add quirk for Samsung Fit flash" - staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv() - nvme: copy firmware_rev on each init - nvmet-tcp: add bounds check on Transfer Tag - usb: idmouse: fix an uninit-value in idmouse_open - [arm*] clk: bcm2835: Make peripheral PLLC critical - [arm64] topology: fix possible overflow in amu_fie_setup() - io_uring: correct pinned_vm accounting - mm: hugetlb: fix UAF in hugetlb_handle_userfault - net: ieee802154: return -EINVAL for unknown addr type - Revert "net/ieee802154: reject zero-sized raw_sendmsg()" - net/ieee802154: don't warn zero-sized raw_sendmsg() - Revert "drm/amdgpu: use dirty framebuffer helper" (Closes: #1022806) - ext4: continue to expand file system when the target size doesn't reach - inet: fully convert sk->sk_rx_dst to RCU rules - [x86] thermal: intel_powerclamp: Use first online CPU as control_cpu - f2fs: fix wrong condition to trigger background checkpoint correctly https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.151 - bpf: Generate BTF_KIND_FLOAT when linking vmlinux - kbuild: Quote OBJCOPY var to avoid a pahole call break the build - kbuild: skip per-CPU BTF generation for pahole v1.18-v1.21 - kbuild: Unify options for BTF generation for vmlinux and modules - kbuild: Add skip_encoding_btf_enum64 option to pahole https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.152 - ocfs2: clear dinode links count in case of error - ocfs2: fix BUG when iput after ocfs2_mknod fails - selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() - [x86] microcode/AMD: Apply the patch early on every logical thread - [x86] hwmon/coretemp: Handle large core ID value - [armhf] ata: ahci-imx: Fix MODULE_ALIAS - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS - kvm: Add support for arch compat vm ioctls - [arm64] KVM: arm64: vgic: Fix exit condition in scan_its_table() - media: mceusb: set timeout to at least timeout provided - [arm64] media: venus: dec: Handle the case where find_format fails - block: wbt: Remove unnecessary invoking of wbt_update_limits in wbt_init - blk-wbt: call rq_qos_add() after wb_normal is initialized - [arm64] errata: Remove AES hwcap for COMPAT tasks - r8152: add PID for the Lenovo OneLink+ Dock - btrfs: fix processing of delayed data refs during backref walking - btrfs: fix processing of delayed tree block refs during backref walking - ACPI: extlog: Handle multiple records - tipc: Fix recognition of trial period - tipc: fix an information leak in tipc_topsrv_kern_subscr - i40e: Fix DMA mappings leak - HID: magicmouse: Do not set BTN_MOUSE on double report - sfc: Change VF mac via PF as first preference if available. - net/atm: fix proc_mpc_write incorrect return value - net: phy: dp83867: Extend RX strap quirk for SGMII mode - cifs: Fix xid leak in cifs_copy_file_range() - cifs: Fix xid leak in cifs_flock() - cifs: Fix xid leak in cifs_ses_add_channel() - nvme-hwmon: rework to avoid devm allocation - nvme-hwmon: Return error code when registration fails - nvme-hwmon: consistently ignore errors from nvme_hwmon_init - nvme-hwmon: kmalloc the NVME SMART log buffer - net: sched: cake: fix null pointer access issue when cake_init() fails - net: sched: delete duplicate cleanup of backlog and qlen - net: sched: sfb: fix null pointer access issue when sfb_init() fails - sfc: include vport_id in filter spec hash and equal() - [arm64] net: hns: fix possible memory leak in hnae_ae_register() - net: sched: fix race condition in qdisc_graft() - net: phy: dp83822: disable MDI crossover status change interrupt - [amd64] iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check() - [amd64] iommu/vt-d: Clean up si_domain in the init_dmars() error path - drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb() - [armhf] dmaengine: mxs-dma: Remove the unused .id_table - [armhf] dmaengine: mxs: use platform_driver_register - tracing: Simplify conditional compilation code in tracing_set_tracer() - tracing: Do not free snapshot if tracer is on cmdline - xen: assume XENFEAT_gnttab_map_avail_bits being set for pv guests - xen/gntdev: Accommodate VMA splitting - [arm64,armhf] mmc: sdhci-tegra: Use actual clock rate for SW tuning correction - fcntl: make F_GETOWN(EX) return 0 on dead owner task - fcntl: fix potential deadlocks for &fown_struct.lock - [arm64] topology: move store_cpu_topology() to shared code - [x86] hv_netvsc: Fix race between VF offering and VF association message from host - ACPI: video: Force backlight native for more TongFang devices - mmc: core: Add SD card quirk for broken discard - blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init() - mm: /proc/pid/smaps_rollup: fix no vma's null-deref - udp: Update reuse->has_conns under reuseport_lock. https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.153 - can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb() - can: kvaser_usb: Fix possible completions during init_completion - ALSA: Use del_timer_sync() before freeing timer - ALSA: au88x0: use explicitly signed char - ALSA: rme9652: use explicitly signed char - USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM - [arm64,armhf] usb: dwc3: gadget: Stop processing more requests on IMI - [arm64,armhf] usb: dwc3: gadget: Don't set IMI for no_interrupt - usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller - [armhf] mtd: rawnand: marvell: Use correct logic for nand-keep-config - xhci: Add quirk to reset host back to default state at shutdown - xhci: Remove device endpoints from bandwidth list when freeing the device - iio: light: tsl2583: Fix module unloading - iio: temperature: ltc2983: allocate iio channels once - fbdev: smscufx: Fix several use-after-free bugs - fs/binfmt_elf: Fix memory leak in load_elf_binary() - exec: Copy oldsighand->action under spin-lock - mac802154: Fix LQI recording - scsi: qla2xxx: Use transport-defined speed mask for supported_speeds - [arm64] drm/msm/dsi: fix memory corruption with too many bridges - [arm64] drm/msm/hdmi: fix memory corruption with too many bridges - [arm64] drm/msm/dp: fix IRQ lifetime - mmc: core: Fix kernel panic when remove non-standard SDIO card - kernfs: fix use-after-free in __kernfs_remove - [s390x] futex: add missing EX_TABLE entry to __futex_atomic_op() - [s390x] pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser() - Xen/gntdev: don't ignore kernel unmapping error - xen/gntdev: Prevent leaking grants - mm/memory: add non-anonymous page check in the copy_present_page() - mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages - net: ieee802154: fix error return code in dgram_bind() - media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation - [arm64] drm/msm: Fix return type of mdp4_lvds_connector_mode_valid - [arm64] ASoC: qcom: lpass-cpu: mark HDMI TX registers as volatile - [arm64] ASoC: qcom: lpass-cpu: Mark HDMI TX parity register as volatile - ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() - [x86] perf/x86/intel/lbr: Use setup_clear_cpu_cap() instead of clear_cpu_cap() - tipc: fix a null-ptr-deref in tipc_topsrv_accept - [arm64] net: netsec: fix error handling in netsec_register_mdio() - net: hinic: fix incorrect assignment issue in hinic_set_interrupt_cfg() - net: hinic: fix memory leak when reading function table - net: hinic: fix the issue of CMDQ memory leaks - net: hinic: fix the issue of double release MBOX callback of VF - [x86] unwind/orc: Fix unreliable stack dump with gcov - [amd64,arm64] amd-xgbe: fix the SFP compliance codes check for DAC cables - [amd64,arm64] amd-xgbe: add the bit rate quirk for Molex cables - [amd64,arm64] atlantic: fix deadlock at aq_nic_stop - net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed - tcp: minor optimization in tcp_add_backlog() - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() - tcp: fix indefinite deferral of RTO with SACK reneging - can: mcp251x: mcp251x_can_probe(): add missing unregister_candev() in error path - PM: hibernate: Allow hybrid sleep to work with s2idle - media: vivid: s_fbuf: add more sanity checks - media: vivid: dev->bitmap_cap wasn't freed in all cases - media: v4l2-dv-timings: add sanity checks for blanking values - media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced' - media: vivid: set num_in/outputs to 0 if not supported - ipv6: ensure sane device mtu in tunnels - i40e: Fix ethtool rx-flow-hash setting for X722 - i40e: Fix VF hang when reset is triggered on another VF - i40e: Fix flow-type by setting GL_HASH_INSET registers - net: ksz884x: fix missing pci_disable_device() on error in pcidev_init() - PM: domains: Fix handling of unavailable/disabled idle states - [arm64,armhf] net: fec: limit register access on i.MX6UL - openvswitch: switch from WARN to pr_warn - nh: fix scope used to find saddr when adding non gw nh - net/mlx5e: Do not increment ESN when updating IPsec ESN state - net/mlx5: Fix possible use-after-free in async command interface - net/mlx5: Fix crash during sync firmware reset - [arm64] net: enetc: survive memory pressure without crashing - [arm64] Add AMPERE1 to the Spectre-BHB affected list - scsi: sd: Revert "scsi: sd: Remove a local variable" - [arm64] mm: Fix __enable_mmu() for new TGRAN range values - [arm64] kexec: Test page size support with new TGRAN range values - serial: core: move RS485 configuration tasks from drivers into core - serial: Deassert Transmit Enable on probe in driver-specific way https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.154 - serial: 8250: Let drivers request full 16550A feature probing - [x86] KVM: nVMX: Pull KVM L0's desired controls directly from vmcs01 - [x86] KVM: nVMX: Don't propagate vmcs12's PERF_GLOBAL_CTRL settings to vmcs02 - [x86] KVM: x86: Trace re-injected exceptions - [x86] KVM: x86: Treat #DBs from the emulator as fault-like (code and DR7.GD=1) - [x86] topology: Set cpu_die_id only if DIE_TYPE found - [x86] topology: Fix multiple packages shown on a single-package system - [x86] topology: Fix duplicated core ID within a package - [x86] KVM: x86: Protect the unused bits in MSR exiting flags - [x86] KVM: x86: Copy filter arg outside kvm_vm_ioctl_set_msr_filter() - [x86] KVM: x86: Add compat handler for KVM_X86_SET_MSR_FILTER - RDMA/cma: Use output interface for net_dev check - [amd64] IB/hfi1: Correctly move list in sc_disable() - NFSv4: Fix a potential state reclaim deadlock - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot - nfs4: Fix kmemleak when allocate slot failed - RDMA/core: Fix null-ptr-deref in ib_core_cleanup() - RDMA/qedr: clean up work queue on failure in qedr_alloc_resources() - [arm64,armhf] net: fec: fix improper use of NETDEV_TX_BUSY - [i386] ata: pata_legacy: fix pdc20230_set_piomode() - net: sched: Fix use after free in red_enqueue() - net: tun: fix bugs for oversize packet when napi frags enabled - netfilter: nf_tables: release flow rule object from commit path - ipvs: use explicitly signed chars - ipvs: fix WARNING in __ip_vs_cleanup_batch() - ipvs: fix WARNING in ip_vs_app_net_cleanup() - rose: Fix NULL pointer dereference in rose_send_frame() - mISDN: fix possible memory leak in mISDN_register_device() - btrfs: fix inode list leak during backref walking at resolve_indirect_refs() - btrfs: fix inode list leak during backref walking at find_parent_nodes() - btrfs: fix ulist leaks in error paths of qgroup self tests - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (CVE-2022-3564) - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (CVE-2022-3640) - net: mdio: fix undefined behavior in bit shift for __mdiobus_register - net, neigh: Fix null-ptr-deref in neigh_table_clear() - ipv6: fix WARNING in ip6_route_net_exit_late() - [arm64] drm/msm/hdmi: Remove spurious IRQF_ONESHOT flag - [arm64] drm/msm/hdmi: fix IRQ lifetime - [arm64,armhf] mmc: sdhci-esdhc-imx: Propagate ESDHC_FLAG_HS400* only on 8bit bus - mmc: sdhci-pci: Avoid comma separated statements - mmc: sdhci-pci-core: Disable ES for ASUS BIOS on Jasper Lake - xhci-pci: Set runtime PM as default policy on all xHC 1.2 or later devices - [s390x] boot: add secure boot trailer - media: dvb-frontends/drxk: initialize err to 0 - ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() - scsi: core: Restrict legal sdev_state transitions via sysfs - HID: saitek: add madcatz variant of MMO7 mouse device ID - drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in SRIOV case - efi/tpm: Pass correct address to memblock_reserve - i2c: piix4: Fix adapter not be removed in piix4_remove() - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (CVE-2022-42896) - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (CVE-2022-42895) - block, bfq: protect 'bfqd->queued' by 'bfqd->lock' - ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices - fscrypt: simplify master key locking - fscrypt: stop using keyrings subsystem for fscrypt_master_key - fscrypt: fix keyring memory leak on mount failure - tcp/udp: Fix memory leak in ipv6_renew_options(). (CVE-2022-3524) - [armhf] mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times - memcg: enable accounting of ipc resources (CVE-2021-3759) - [arm*] binder: fix UAF of alloc->vma in race with munmap() - btrfs: fix type of parameter generation in btrfs_get_dentry - ftrace: Fix use-after-free for dynamic ftrace_ops - tcp/udp: Make early_demux back namespacified. - tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd() - kprobe: reverse kp->flags when arm_kprobe failed - tracing/histogram: Update document for KEYS_MAX size - capabilities: fix potential memleak on error path from vfs_getxattr_alloc() - fuse: add file_modified() to fallocate - efi: random: reduce seed size to 32 bytes - efi: random: Use 'ACPI reclaim' memory for random seed - [x86] perf/x86/intel: Fix pebs event constraints for ICL - [x86] perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[] - ext4: fix warning in 'ext4_da_release_space' - ext4: fix BUG_ON() when directory entry has invalid rec_len - [x86] KVM: x86: Mask off reserved bits in CPUID.80000006H - [x86] KVM: x86: Mask off reserved bits in CPUID.8000001AH - [x86] KVM: x86: Mask off reserved bits in CPUID.80000008H - [x86] KVM: x86: Mask off reserved bits in CPUID.80000001H - [x86] KVM: x86: emulator: em_sysexit should update ctxt->mode - [x86] KVM: x86: emulator: introduce emulator_recalc_and_set_mode - [x86] KVM: x86: emulator: update the emulation mode after CR0 write - ext4,f2fs: fix readahead of verity data - [arm64,armhf] drm/rockchip: dsi: Force synchronous probe - [x86] drm/i915/sdvo: Filter out invalid outputs more sensibly - [x86] drm/i915/sdvo: Setup DDC fully before output init - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() (CVE-2022-3628) - ipc: remove memcg accounting for sops objects in do_semtimedop() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.155 - fuse: fix readdir cache race - [armhf] phy: stm32: fix an error code in probe - wifi: cfg80211: silence a sparse RCU warning - wifi: cfg80211: fix memory leak in query_regdb_file() - bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues - bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE - [x86] HID: hyperv: fix possible memory leak in mousevsc_probe() - bpf: Support for pointers beyond pkt_end. - bpf: Add helper macro bpf_for_each_reg_in_vstate - bpf: Fix wrong reg type conversion in release_reference() - net: gso: fix panic on frag_list with mixed head alloc types - macsec: delete new rxsc when offload fails - macsec: fix secy->n_rx_sc accounting - macsec: fix detection of RXSCs when toggling offloading - macsec: clear encryption keys from the stack after setting up offload - net: tun: Fix memory leaks of napi_get_frags - bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() - bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK - [s390x] KVM: s390x: fix SCK locking - [s390x] KVM: s390: pv: don't allow userspace to set the clock under PV - hamradio: fix issue of dev reference count leakage in bpq_device_event() - [arm*] drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register() - tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network - can: af_can: fix NULL pointer dereference in can_rx_register() - [arm64,armhf] net: stmmac: dwmac-meson8b: fix meson8b_devm_clk_prepare_enable() - tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header - [arm64] dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() - [arm64] drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() - net/mlx5: Allow async trigger completion execution on single CPU systems - net/mlx5e: E-Switch, Fix comparing termination table instance - [armhf] net: cpsw: disable napi in cpsw_ndo_open() - net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() - cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open() - net: phy: mscc: macsec: clear encryption keys when freeing a flow - [amd64,arm64] net: atlantic: macsec: clear encryption keys from the stack - ethernet: s2io: disable napi when start nic failed in s2io_card_up() - [armel,armhf] net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open() - net: macvlan: fix memory leaks of macvlan_common_newlink - [arm64] efi: Fix handling of misaligned runtime regions and drop warning - [mips*] jump_label: Fix compat branch range check - [arm64] mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI - [arm64,armhf] mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI - ALSA: hda/hdmi - enable runtime pm for more AMD display audio - ALSA: hda/ca0132: add quirk for EVGA Z390 DARK - ALSA: hda: fix potential memleak in 'add_widget_node' - ALSA: hda/realtek: Add Positivo C6300 model quirk - ALSA: usb-audio: Add quirk entry for M-Audio Micro - ALSA: usb-audio: Add DSD support for Accuphase DAC-60 - vmlinux.lds.h: Fix placement of '.data..decrypted' section - ata: libata-scsi: fix SYNCHRONIZE CACHE (16) command failure - nilfs2: fix deadlock in nilfs_count_free_blocks() - nilfs2: fix use-after-free bug of ns_writer on remount - [x86] drm/i915/dmabuf: fix sg_table handling in map_dma_buf - [x86] platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi - [arm64,armhf] mms: sdhci-esdhc-imx: Fix SDHCI_RESET_ALL for CQHCI - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() - mm/memremap.c: map FS_DAX device memory as decrypted - can: j1939: j1939_send_one(): fix missing CAN header initialization - net: tun: call napi_schedule_prep() to ensure we own a napi - [arm64,armhf] mmc: sdhci-esdhc-imx: Convert the driver to DT-only - [x86] cpu: Restore AMD's DE_CFG MSR after resume - io_uring: kill goto error handling in io_sqpoll_wait_sq() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.156 - drm/amd/display: Remove wrong pipe control lock - NFSv4: Retry LOCK on OLD_STATEID during delegation return - [arm64,armhf] i2c: tegra: Allocate DMA memory for DMA engine - [x86] i2c: i801: add lis3lv02d's I2C address for Vostro 5568 - btrfs: remove pointless and double ulist frees in error paths of qgroup tests - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm - ALSA: hda/realtek: fix speakers and micmute on HP 855 G8 - [x86] mtd: spi-nor: intel-spi: Disable write protection only if asked - [arm64,armhf] mmc: sdhci-esdhc-imx: use the correct host caps for MMC_CAP_8_BIT_DATA - drm/amd/pm: support power source switch on Sienna Cichlid - drm/amd/pm: Read BIF STRAP also for BACO check - drm/amd/pm: disable BACO entry/exit completely on several sienna cichlid cards - drm/amdgpu: disable BACO on special BEIGE_GOBY card - [armhf] spi: stm32: Print summary 'callbacks suppressed' message - ASoC: core: Fix use-after-free in snd_soc_exit() - serial: 8250: Remove serial_rs485 sanitization from em485 - [arm64,armhf] serial: imx: Add missing .thaw_noirq hook - tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() - ASoC: soc-utils: Remove __exit for snd_soc_util_exit() - sctp: remove the unnecessary sinfo_stream check in sctp_prsctp_prune_unsent - sctp: clear out_curr if all frag chunks of current msg are pruned - block: sed-opal: kmalloc the cmd/resp buffers - [arm64] Fix bit-shifting UB in the MIDR_CPU_MODEL() macro - parport_pc: Avoid FIFO port location truncation - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map - [arm64,armhf] drm/panel: simple: set bpc field for logic technologies displays - drm/drv: Fix potential memory leak in drm_dev_init() - drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() - ata: libata-transport: fix double ata_host_put() in ata_tport_add() - ata: libata-transport: fix error handling in ata_tport_add() - ata: libata-transport: fix error handling in ata_tlink_add() - ata: libata-transport: fix error handling in ata_tdev_add() - bpf: Initialize same number of free nodes for each pcpu_freelist - mISDN: fix possible memory leak in mISDN_dsp_element_register() - net: hinic: Fix error handling in hinic_module_init() - net: liquidio: release resources when liquidio driver open failed - mISDN: fix misuse of put_device() in mISDN_register_device() - net: macvlan: Use built-in RCU list checking - net: caif: fix double disconnect client in chnl_net_open() - bnxt_en: Remove debugfs when pci_register_driver failed - xen/pcpu: fix possible memory leak in register_pcpu() - net: ena: Fix error handling in ena_init() - drbd: use after free in drbd_create_device() - [x86] platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized - cifs: add check for returning value of SMB2_close_init - cifs: Fix wrong return value checking when GETFLAGS - [x86] net: thunderbolt: Fix error handling in tbnet_init() - cifs: add check for returning value of SMB2_set_info_init - ftrace: Fix the possible incorrect kernel message - ftrace: Optimize the allocation for mcount entries - ftrace: Fix null pointer dereference in ftrace_add_mod() - ring_buffer: Do not deactivate non-existant pages - tracing/ring-buffer: Have polling block on watermark - tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() - tracing: Fix wild-memory-access in register_synth_event() - tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit() - tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit() - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() - ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 - [arm64,armhf] Revert "usb: dwc3: disable USB core PHY management" - slimbus: stream: correct presence rate frequencies - speakup: fix a segfault caused by switching consoles - USB: serial: option: add Sierra Wireless EM9191 - USB: serial: option: remove old LARA-R6 PID - USB: serial: option: add u-blox LARA-R6 00B modem - USB: serial: option: add u-blox LARA-L6 modem - USB: serial: option: add Fibocom FM160 0x0111 composition - usb: add NO_LPM quirk for Realforce 87U Keyboard - dm ioctl: fix misbehavior if list_versions races with module loading - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs - serial: 8250: Flush DMA Rx on RLSI - [x86] serial: 8250_lpss: Configure DMA also w/o DMA filter - Input: iforce - invert valid length check when fetching device IDs - maccess: Fix writing offset in case of fault in strncpy_from_kernel_nofault() - [s390x] scsi: zfcp: Fix double free of FSF request when qdio send fails - [amd64] iommu/vt-d: Set SRE bit only when hardware has SRS cap - firmware: coreboot: Register bus in module init - mmc: core: properly select voltage range without power cycle - mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() - docs: update mediator contact information in CoC doc - [x86] misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() - [x86] perf/x86/intel/pt: Fix sampling using single range output - nvme: restrict management ioctls to admin - nvme: ensure subsystem reset is single threaded (CVE-2022-3169) - net: fix a concurrency bug in l2tp_tunnel_register() - ring-buffer: Include dropped pages in counting dirty patches - usbnet: smsc95xx: Fix deadlock on runtime resume - stddef: Introduce struct_group() helper macro - net: use struct_group to copy ip/ipv6 header addresses - scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() - scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper() - kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case - Input: i8042 - fix leaking of platform device on module removal - macvlan: enforce a consistent minimal mtu - tcp: cdg: allow tcp_cdg_release() to be called multiple times - kcm: avoid potential race in kcm_tx_work (CVE-2022-3521) - kcm: close race conditions on sk_receive_queue - 9p: trans_fd/p9_conn_cancel: drop client lock earlier - gfs2: Check sb_bsize_shift after reading superblock - gfs2: Switch from strlcpy to strscpy - 9p/trans_fd: always use O_NONBLOCK read/write - mm: fs: initialize fsdata passed to write_begin/write_end interface https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.157 - scsi: scsi_transport_sas: Fix error handling in sas_phy_add() - ata: libata-scsi: simplify __ata_scsi_queuecmd() - ata: libata-core: do not issue non-internal commands once EH is pending - bridge: switchdev: Notify about VLAN protocol changes - bridge: switchdev: Fix memory leaks when changing VLAN protocol - drm/display: Don't assume dual mode adaptors support i2c sub-addressing - nvme: add a bogus subsystem NQN quirk for Micron MTFDKBA2T0TFH - nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro - iio: ms5611: Simplify IO callback parameters - iio: pressure: ms5611: fixed value compensation bug - ceph: do not update snapshot context when there is no new snapshot - ceph: avoid putting the realm twice when decoding snaps fails - wifi: mac80211: fix memory free error when registering wiphy fail - wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support - audit: fix undefined behavior in bit shift for AUDIT_BIT - wifi: airo: do not assign -1 to unsigned char - wifi: mac80211: Fix ack frame idr leak when mesh has no route - [armhf] spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run - Revert "net: macsec: report real_dev features when HW offloading is enabled" - [powerpc*] scsi: ibmvfc: Avoid path failures during live migration - scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC - drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) - block, bfq: fix null pointer dereference in bfq_bio_bfqg() - [arm64] syscall: Include asm/ptrace.h in syscall_wrapper header. - [mips*] pic32: treat port as signed integer - xfrm: fix "disable_policy" on ipv4 early demux - xfrm: replay: Fix ESN wrap around for GSO - af_key: Fix send_acquire race with pfkey_register - [armhf] sgtl5000: Reset the CHIP_CLK_CTRL reg on remove - ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open() - [x86] scsi: storvsc: Fix handling of srb_status and capacity change events - regulator: core: fix kobject release warning and memory leak in regulator_register() - regulator: core: fix UAF in destroy_regulator() - [arm64,armhf] bus: sunxi-rsb: Support atomic transfers - [arm64] tee: optee: fix possible memory leak in optee_register_device() - net: liquidio: simplify if expression - rxrpc: Allow list of in-use local UDP endpoints to be viewed in /proc - rxrpc: Use refcount_t rather than atomic_t - rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975] - [i386] net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() - 9p/fd: fix issue of list_del corruption in p9_fd_cancel() - netfilter: conntrack: Fix data-races around ct mark - [armhf] dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties - net/mlx4: Check retval of mlx4_bitmap_init - net/qla3xxx: fix potential memleak in ql3xxx_send() - [i386] net: pch_gbe: fix pci device refcount leak while module exiting - nfp: fill splittable of devlink_port_attrs correctly - nfp: add port from netdev validation for EEPROM access - macsec: Fix invalid error code set - [x86] Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work() - [x86] Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() - netfilter: ipset: Limit the maximal range of consecutive elements to add/delete - netfilter: ipset: regression in ip_set_hash_ip.c - net/mlx5: Fix FW tracer timestamp calculation - net/mlx5: Fix handling of entry refcount when command is not issued to FW - tipc: set con sock in tipc_conn_alloc - tipc: add an extra conn_get in tipc_conn_alloc - tipc: check skb_linearize() return value in tipc_disc_rcv() - xfrm: Fix ignored return value in xfrm6_init() - sfc: fix potential memleak in __ef100_hard_start_xmit() - net: sched: allow act_ct to be built without NF_NAT - [armhf] regulator: twl6030: re-add TWL6032_SUBCLASS - bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() - netfilter: flowtable_offload: add missing locking - dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). - ipv4: Fix error return code in fib_table_insert() - [s390x] dasd: fix no record found for raw_track_access - net: arcnet: Fix RESET flag handling - arcnet: fix potential memory leak in com20020_probe() - [arm64] net: thunderx: Fix the ACPI memory leak - [arm64] net: enetc: manage ENETC_F_QBV in priv->active_offloads only when enabled - [arm64] net: enetc: cache accesses to &priv->si->hw - [arm64] net: enetc: preserve TX ring priority across reconfiguration - lib/vdso: use "grep -E" instead of "egrep" - [armhf] usb: dwc3: exynos: Fix remove() function - ext4: fix use-after-free in ext4_ext_shift_extents - [arm64] dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency - iio: light: apds9960: fix wrong register for gesture gain - ceph: make ceph_create_session_msg a global symbol - ceph: make iterate_sessions a global symbol - ceph: flush mdlog before umounting - ceph: flush the mdlog before waiting on unsafe reqs - ceph: fix off by one bugs in unsafe_request_wait() - ceph: put the requests/sessions when it fails to alloc memory - ceph: fix possible NULL pointer dereference for req->r_session - ceph: Use kcalloc for allocating multiple elements - ceph: fix NULL pointer dereference for req->r_session - [arm64,armhf] usb: dwc3: gadget: conditionally remove requests - [arm64,armhf] usb: dwc3: gadget: Return -ESHUTDOWN on ep disable - [arm64,armhf] usb: dwc3: gadget: Clear ep descriptor last - nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty - mm: vmscan: fix extreme overreclaim and swap floods - [x86] KVM: x86: nSVM: leave nested mode on vCPU free - [x86] KVM: x86: remove exit_int_info warning in svm_handle_exit - [x86] ioremap: Fix page aligned size calculation in __ioremap_caller() - [arm*] binder: avoid potential data leakage when copying txn - [arm*] binder: read pre-translated fds from sender buffer - [arm*] binder: defer copies of pre-patched txn data - [arm*] binder: fix pointer cast warning - [arm*] binder: Address corner cases in deferred copy and fixup - [arm*] binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 - Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode - [x86] ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01 - Input: goodix - try resetting the controller when no config is set - [x86] Input: soc_button_array - add use_low_level_irq module parameter - [x86] Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[] - xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too - xen/platform-pci: add missing free_irq() in error path - [x86] platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() - [x86] platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) - zonefs: fix zone report size in __zonefs_io_error() - [x86] platform/x86: hp-wmi: Ignore Smart Experience App event - tcp: configurable source port perturb table size - net: usb: qmi_wwan: add Telit 0x103a composition - [arm64,armhf] gpu: host1x: Avoid trying to use GART on Tegra20 - dm integrity: flush the journal on suspend - dm integrity: clear the journal on suspend - genirq/msi: Shutdown managed interrupts with unsatifiable affinities - genirq: Always limit the affinity to online CPUs - [arm64,armhf] irqchip/gic-v3: Always trust the managed affinity provided by the core code - genirq: Take the proposed affinity at face value if force==true - btrfs: free btrfs_path before copying root refs to userspace - btrfs: free btrfs_path before copying fspath to userspace - btrfs: free btrfs_path before copying subvol info to userspace - btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs() - drm/amdgpu: always register an MMU notifier for userptr - [x86] drm/i915: fix TLB invalidation for Gen12 video and compute engines (CVE-2022-4139) - fuse: lock inode unconditionally in fuse_fallocate() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.158 - btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino - btrfs: free btrfs_path before copying inodes to userspace - [armhf] spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock - btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker - drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code - drm/amdgpu: update drm_display_info correctly when the edid is read - drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read" - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() - iio: health: afe4403: Fix oob read in afe4403_read_raw - bpf, perf: Use subprog name when reporting subprog ksymbol - scripts/faddr2line: Fix regression in name resolution on ppc64le - [x86] hwmon: (i5500_temp) fix missing pci_disable_device() - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails - bpf: Do not copy spin lock field from user in bpf_selem_alloc - of: property: decrement node refcount in of_fwnode_get_reference_args() - ixgbevf: Fix resource leak in ixgbevf_init_module() - i40e: Fix error handling in i40e_init_module() - iavf: remove redundant ret variable - iavf: Fix error handling in iavf_init_module() - e100: switch from 'pci_' to 'dma_' API - e100: Fix possible use after free in e100_xmit_prepare - net/mlx5: Fix uninitialized variable bug in outlen_write() - net/mlx5e: Fix use-after-free when reverting termination table - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() - [i386] can: cc770: cc770_isa_probe(): add missing free_cc770dev() - qlcnic: fix sleep-in-atomic-context bugs caused by msleep - [amd64,arm64] aquantia: Do not purge addresses when setting the number of rings - wifi: cfg80211: fix buffer overflow in elem comparison - wifi: cfg80211: don't allow multi-BSSID in S1G - wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration - net: phy: fix null-ptr-deref while probe() failed - net/9p: Fix a potential socket leak in p9_socket_open - tipc: re-fetch skb cb after tipc_msg_validate - afs: Fix fileserver probe RTT handling - net: tun: Fix use-after-free in tun_detach() - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE - sctp: fix memory leak in sctp_stream_outq_migrate() - [x86] hwmon: (coretemp) Check for null before removing sysfs attrs - [x86] hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() - net/mlx5: DR, Fix uninitialized var warning - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() - [x86] bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 - [x86] pinctrl: intel: Save and restore pins in "direct IRQ" mode - net: stmmac: Set MAC's flow control register to reflect current settings - mmc: core: Fix ambiguous TRIM and DISCARD arg - [arm64,armhf] mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check - mmc: sdhci: Fix voltage switch delay - drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame - [x86] drm/i915: Never return 0 if not all requests retired - tracing: Free buffers when a used dynamic event is removed - io_uring: don't hold uring_lock when calling io_run_task_work* - ASoC: ops: Fix bounds check for _sx controls - [arm64,armhf] pinctrl: single: Fix potential division by zero - [amd64] iommu/vt-d: Fix PCI device refcount leak in has_external_pci() - [amd64] iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() - ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference (CVE-2022-3435) - ipv4: Fix route deletion when nexthop info is not specified - Revert "tty: n_gsm: avoid call of sleeping functions from atomic context" - [x86] tsx: Add a feature bit for TSX control MSR support - [x86] pm: Add enumeration check before spec MSRs save/restore setup - [arm64,armhf] i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set - [amd64,arm64] ACPI: HMAT: remove unnecessary variable initialization - [amd64,arm64] ACPI: HMAT: Fix initiator registration for single-initiator systems - char: tpm: Protect tpm_pm_suspend with locks - block: unhash blkdev part inode when the part is deleted - proc: avoid integer type confusion in get_proc_long (CVE-2022-4378) - proc: proc_skip_spaces() shouldn't think it is working on C strings (CVE-2022-4378) - v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails - ipc/sem: Fix dangling sem_array access in semtimedop race [ Salvatore Bonaccorso ] * Bump ABI to 20 * [rt] Drop "net: arcnet: Fix RESET flag handling" (applied upstream) * [x86] Enable AMD_MEM_ENCRYPT (Closes: #1024697) * xen/netback: Ensure protocol headers don't fall in the non-linear area (XSA-423, CVE-2022-3643) * xen/netback: do some code cleanup * xen/netback: don't call kfree_skb() with interrupts disabled (XSA-424, CVE-2022-42328, CVE-2022-42329) * [rt] Update to 5.10.158-rt77 -- Salvatore Bonaccorso Fri, 09 Dec 2022 18:14:20 +0100 linux (5.10.149-2) bullseye-security; urgency=high * Revert "drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega" (Closes: #1022025) * Revert "drm/amdgpu: make sure to init common IP before gmc" (Closes: #1022025) -- Salvatore Bonaccorso Fri, 21 Oct 2022 22:24:21 +0200 linux (5.10.149-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.149 - Revert "fs: check FMODE_LSEEK to control internal pipe splicing" [ Salvatore Bonaccorso ] * Replace patch for "io_uring/af_unix: defer registered files gc to io_uring release" with queued version -- Salvatore Bonaccorso Mon, 17 Oct 2022 21:44:25 +0200 linux (5.10.148-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.141 - [s390x] mm: do not trigger write fault when vma does not allow VM_WRITE - kbuild: Fix include path in scripts/Makefile.modpost - Bluetooth: L2CAP: Fix build errors in some archs - HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report - media: pvrusb2: fix memory leak in pvr_probe - HID: hidraw: fix memory leak in hidraw_release() - net: fix refcount bug in sk_psock_get (2) - fbdev: fb_pm2fb: Avoid potential divide by zero error - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead - drm/amd/display: Avoid MPC infinite loop - drm/amd/display: For stereo keep "FLIP_ANY_FRAME" - drm/amd/display: clear optc underflow before turn off odm clock - neigh: fix possible DoS due to net iface start/stop loop - [s390x] hypfs: avoid error message under KVM - drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid - drm/amd/display: Fix pixel clock programming - drm/amdgpu: Increase tlb flush timeout for sriov - netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y - lib/vdso: Mark do_hres_timens() and do_coarse_timens() __always_inline() - kprobes: don't call disarm_kprobe() for disabled kprobes - io_uring: disable polling pollfree files - xfs: remove infinite loop when reserving free block pool - xfs: always succeed at setting the reserve pool size - xfs: fix overfilling of reserve pool - xfs: fix soft lockup via spinning in filestream ag selection loop - xfs: revert "xfs: actually bump warning counts when we send warnings" - net: neigh: don't call kfree_skb() under spin_lock_irqsave() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.142 - [arm64] drm/msm/dsi: fix the inconsistent indenting - [arm64] drm/msm/dp: delete DP_RECOVERED_CLOCK_OUT_EN to fix tps4 - [arm64] drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg - [arm64] drm/msm/dsi: Fix number of regulators for SDM660 - [x86] platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask - iio: adc: mcp3911: make use of the sign bit - bpf, cgroup: Fix kernel BUG in purge_effective_progs - ieee802154/adf7242: defer destroy_workqueue call - ALSA: hda: intel-nhlt: remove use of __func__ in dev_dbg - ALSA: hda: intel-nhlt: Correct the handling of fmt_config flexible array - wifi: cfg80211: debugfs: fix return type in ht40allow_map_read() - Revert "xhci: turn off port power in shutdown" - net: sched: tbf: don't call qdisc_put() while holding tree lock - net/sched: fix netdevice reference leaks in attach_default_qdiscs() - sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb - tcp: annotate data-race around challenge_timestamp - Revert "sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb" - net/smc: Remove redundant refcount increase - [arm64] serial: fsl_lpuart: RS485 RTS polariy is inverse - staging: rtl8712: fix use after free bugs - [powerpc*] align syscall table for ppc32 - vt: Clear selection before changing the font - [arm64] tty: serial: lpuart: disable flow control while waiting for the transmit engine to complete - Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag - iio: ad7292: Prevent regulator double disable - iio: adc: mcp3911: use correct formula for AD conversion - USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id - [arm*] binder: fix UAF of ref->proc caused by race condition (CVE-2022-20421) - [x86] drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported" - clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops - Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops" - clk: core: Fix runtime PM sequence in clk_core_unprepare() - [arm64,armhf] clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate - [arm64,armhf] clk: bcm: rpi: Use correct order for the parameters of devm_kcalloc() - [arm64,armhf] clk: bcm: rpi: Prevent out-of-bounds access - [arm64,armhf] clk: bcm: rpi: Add missing newline - [armel,armhf] hwmon: (gpio-fan) Fix array out of bounds access - [arm64,armhf] gpio: pca953x: Add mutex_lock for regcache sync in PM - [x86] KVM: x86: Mask off unsupported and unknown bits of IA32_ARCH_CAPABILITIES - xen/grants: prevent integer overflow in gnttab_dma_alloc_pages() - mm: pagewalk: Fix race between unmap and page walker - xen-blkback: Advertise feature-persistent as user requested - xen-blkfront: Advertise feature-persistent as user requested - [x86] thunderbolt: Use the actual buffer in tb_async_error() - media: mceusb: Use new usb_control_msg_*() routines - xhci: Add grace period after xHC start to prevent premature runtime suspend. - USB: serial: cp210x: add Decagon UCA device id - USB: serial: option: add support for OPPO R11 diag port - USB: serial: option: add Quectel EM060K modem - USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode - usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles - [arm*] usb: dwc2: fix wrong order of phy_power_on and phy_init - USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020) - usb-storage: Add ignore-residue quirk for NXP PN7462AU - [s390x] hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages - [s390x] fix nospec table alignments - USB: core: Prevent nested device-reset calls - usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS - driver core: Don't probe devices after bus_type.match() probe deferral - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected - wifi: mac80211: Fix UAF in ieee80211_scan_rx() - ip: fix triggering of 'icmp redirect' - net: Use u64_stats_fetch_begin_irq() for stats fetch. - net: mac802154: Fix a condition in the receive path - ALSA: hda/realtek: Add speaker AMP init for Samsung laptops with ALC298 - ALSA: seq: oss: Fix data-race for max_midi_devs access - ALSA: seq: Fix data-race at module auto-loading - [x86] drm/i915/glk: ECS Liva Q2 needs GLK HDMI port timing quirk - btrfs: harden identification of a stale device - mmc: core: Fix UHS-I SD 1.8V workaround branch - [arm64,armhf] usb: dwc3: fix PHY disable sequence - [arm64,armhf] usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup - [arm64,armhf] usb: dwc3: disable USB core PHY management - USB: serial: ch341: fix lost character on LCR updates - USB: serial: ch341: fix disabled rx timer on older devices https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.143 - NFSD: Fix verifier returned in stable WRITEs - xen-blkfront: Cache feature_persistent value before advertisement - tty: n_gsm: initialize more members at gsm_alloc_mux() - tty: n_gsm: avoid call of sleeping functions from atomic context - efi: capsule-loader: Fix use-after-free in efi_capsule_write (CVE-2022-40307) - wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd() - fs: only do a memory barrier for the first set_buffer_uptodate() - scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX - scsi: megaraid_sas: Fix double kfree() - drm/gem: Fix GEM handle release errors - drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini - drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup. - drm/radeon: add a force flush to delay work when radeon - [arm64] cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level - net/core/skbuff: Check the return value of skb_copy_bits() - drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() - ALSA: aloop: Fix random zeros in capture data when using jiffies timer - ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() - kprobes: Prohibit probes in gate area - debugfs: add debugfs_lookup_and_remove() - nvmet: fix a use-after-free - [x86] drm/i915: Implement WaEdpLinkRateDataReload - scsi: mpt3sas: Fix use-after-free warning - scsi: lpfc: Add missing destroy_workqueue() in error path - cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree - cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() - smb3: missing inode locks in punch hole - regulator: core: Clean up on enable failure - [arm64] tee: fix compiler warning in tee_shm_register() - RDMA/cma: Fix arguments order in net device validation - [arm64] RDMA/hns: Fix supported page size - [arm64] RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift - netfilter: br_netfilter: Drop dst references before setting. - netfilter: nf_tables: clean up hook list when offload flags check fails - netfilter: nf_conntrack_irc: Fix forged IP logic (CVE-2022-2663) - ALSA: usb-audio: Inform the delayed registration more properly - ALSA: usb-audio: Register card again for iface over delayed_register option - rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2() - afs: Use the operation issue time instead of the reply time for callbacks - sch_sfb: Don't assume the skb is still around after enqueueing to child - tipc: fix shift wrapping bug in map_get() - ice: use bitmap_free instead of devm_kfree - i40e: Fix kernel crash during module removal - xen-netback: only remove 'hotplug-status' when the vif is actually destroyed - ipv6: sr: fix out-of-bounds read when setting HMAC data. - IB/core: Fix a nested dead lock as part of ODP flow - RDMA/mlx5: Set local port to one when accessing counters - nvme-tcp: fix UAF when detecting digest errors - nvme-tcp: fix regression that causes sporadic requests to time out - tcp: fix early ETIMEDOUT after spurious non-SACK RTO - sch_sfb: Also store skb len before calling child enqueue - swiotlb: avoid potential left shift overflow - [amd64] iommu/amd: use full 64-bit value in build_completion_wait() - [arm64] errata: add detection for AMEVCNTR01 incrementing incorrectly https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.144 - [armhf] dts: imx: align SPI NOR node name with dtschema - [amd64] iommu/vt-d: Correctly calculate sagaw value of IOMMU - tracefs: Only clobber mode/uid/gid on remount if asked - Input: goodix - add support for GT1158 - [arm64] drm/msm/rd: Fix FIFO-full deadlock - [amd64] hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message - tg3: Disable tg3 device on system reboot to avoid triggering AER - ieee802154: cc2520: add rc code in cc2520_tx() - Input: iforce - add support for Boeder Force Feedback Wheel - nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change() - drm/amd/amdgpu: skip ucode loading if ucode_size == 0 - [arm*] perf/arm_pmu_platform: fix tests for platform_get_irq() failure - [x86] platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes - mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() - [x86] Revert "x86/ftrace: Use alternative RET encoding" - [x86] ibt,ftrace: Make function-graph play nice - [x86] ftrace: Use alternative RET encoding - Input: goodix - add compatible string for GT1158 https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.145 - [ppc64el] KVM: PPC: Book3S HV: Context tracking exit guest context before enabling irqs - [ppc64el] KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ handling - serial: 8250: Fix reporting real baudrate value in c_ospeed field - [powerpc*] pseries/mobility: refactor node lookup during DT update - [powerpc*] pseries/mobility: ignore ibm, platform-facilities updates - [x86] platform/x86/intel: hid: add quirk to support Surface Go 3 - [arm64,armhf] net: dsa: mv88e6xxx: allow use of PHYs on CPU and DSA ports - of: fdt: fix off-by-one error in unflatten_dt_nodes() - [arm64] pinctrl: sunxi: Fix name for A100 R_PIO - NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0 - [arm64] gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx - [arm64] drm/meson: Correct OSD1 global alpha value - [arm64] drm/meson: Fix OSD1 RGB to YCbCr coefficient - tracing: hold caller_addr to hardirq_{enable,disable}_ip - of/device: Fix up of_dma_configure_id() stub - cifs: revalidate mapping when doing direct writes - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM - video: fbdev: i740fb: Error out if 'pixclock' equals zero (CVE-2022-3061) - Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field" - [x86] ASoC: nau8824: Fix semaphore unbalance at error paths - [armhf] regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe() - rxrpc: Fix local destruction being repeated - rxrpc: Fix calc of resend age - wifi: mac80211_hwsim: check length for virtio packets - ALSA: hda/sigmatel: Keep power up while beep is enabled - [arm64,armhf] ALSA: hda/tegra: Align BDL entry to 4KB boundary - net: usb: qmi_wwan: add Quectel RM520N - afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked - [misp64el,mipsel] OCTEON: irq: Fix octeon_irq_force_ciu_mapping() - mksysmap: Fix the mismatch of 'L0' symbols in System.map - video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write (CVE-2022-39842) - cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() - ALSA: hda/sigmatel: Fix unused variable warning for beep power change https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.146 - drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega - drm/amdgpu: indirect register access for nv12 sriov - drm/amdgpu: Separate vf2pf work item init from virt data exchange - drm/amdgpu: make sure to init common IP before gmc - [arm64,armhf] usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind - [arm64,armhf] usb: dwc3: Issue core soft reset before enabling run/stop - [arm64,armhf] usb: dwc3: gadget: Prevent repeat pullup() - [arm64,armhf] usb: dwc3: gadget: Refactor pullup() - [arm64,armhf] usb: dwc3: gadget: Don't modify GEVNTCOUNT in pullup() - [arm64,armhf] usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop - mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch failure - vfio/type1: Change success value of vaddr_get_pfn() - vfio/type1: Prepare for batched pinning with struct vfio_batch - vfio/type1: Unpin zero pages - USB: core: Fix RST error in hub.c - USB: serial: option: add Quectel BG95 0x0203 composition - USB: serial: option: add Quectel RM520N - ALSA: hda/tegra: set depop delay for tegra - ALSA: hda: add Intel 5 Series / 3400 PCI DID - ALSA: hda/realtek: Add quirk for Huawei WRT-WX9 - ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5570 laptop - ALSA: hda/realtek: Re-arrange quirk table entries - ALSA: hda/realtek: Add pincfg for ASUS G513 HP jack - ALSA: hda/realtek: Add pincfg for ASUS G533Z HP jack - ALSA: hda/realtek: Add quirk for ASUS GA503R laptop - ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5530 laptop - [amd64] iommu/vt-d: Check correct capability for sagaw determination - media: flexcop-usb: fix endpoint type check - [x86] efi: x86: Wipe setup_data on pure EFI boot - efi: libstub: check Shim mode using MokSBStateRT - gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully - [arm64,armhf] can: flexcan: flexcan_mailbox_read() fix return value for drop = true - mm/slub: fix to return errno if kmalloc() fails - KVM: SEV: add cache flush to solve SEV cache incoherency issues (CVE-2022-0171) - xfs: fix up non-directory creation in SGID directories (CVE-2021-4037) - xfs: reorder iunlink remove operation in xfs_ifree - xfs: validate inode fork size against fork format - [arm64] dts: rockchip: Pull up wlan wake# on Gru-Bob - netfilter: nf_conntrack_sip: fix ct_sip_walk_headers - netfilter: nf_conntrack_irc: Tighten matching on DCC message (CVE-2022-2663) - netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() - iavf: Fix cached head and tail value for iavf_get_tx_pending - ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header - net: let flow have same hash in two directions - net: core: fix flow symmetric hash - net: phy: aquantia: wait for the suspend/resume operations to finish - scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region - scsi: mpt3sas: Fix return value check of dma_get_required_mask() - net: bonding: Share lacpdu_mcast_addr definition - net: bonding: Unsync device addresses on ndo_stop - net: team: Unsync device addresses on ndo_stop - [arm64,armhf] drm/panel: simple: Fix innolux_g121i1_l01 bus_format - iavf: Fix bad page state - iavf: Fix set max MTU size with port VLAN and jumbo frames - i40e: Fix VF set max MTU size - i40e: Fix set max_tx_rate when it is lower than 1 Mbps - sfc: fix TX channel offset when using legacy interrupts - sfc: fix null pointer dereference in efx_hard_start_xmit - of: mdio: Add of_node_put() when breaking out of for_each_xx - wireguard: ratelimiter: disable timings test by default - wireguard: netlink: avoid variable-sized memcpy on sockaddr - [arm64] net: enetc: move enetc_set_psfp() out of the common enetc_set_features() - net: socket: remove register_gifconf - net/sched: taprio: avoid disabling offload when it was never enabled - net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs - netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain() - netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain() - netfilter: ebtables: fix memory leak when blob is malformed - can: gs_usb: gs_can_open(): fix race dev->can.state condition - net/smc: Stop the CLC flow if no link to map buffers on - net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD - net: sched: fix possible refcount leak in tc_new_tfilter() - drm/amd/amdgpu: fixing read wrong pf2vf data in SRIOV - serial: Create uart_xmit_advance() - [arm64,armhf] serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting - [s390x] dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup - vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external() - drm/amdgpu: Fix check for RAS support - cifs: use discard iterator to discard unneeded network data more efficiently - cifs: always initialize struct msghdr smb_msg completely - [x86] Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region - [x86] drm/gma500: Fix BUG: sleeping function called from invalid context errors - drm/amdgpu: use dirty framebuffer helper - drm/amd/display: Limit user regamma to a valid value - drm/amd/display: Mark dml30's UseMinimumDCFCLK() as noinline for stack usage - [arm64] drm/rockchip: Fix return type of cdn_dp_connector_mode_valid - workqueue: don't skip lockdep work dependency in cancel_work_sync() - [arm64,armhf] i2c: imx: If pm_runtime_get_sync() returned 1 device access is possible - [amd64,arm64] devdax: Fix soft-reservation memory description - ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 - ext4: limit the number of retries after discarding preallocations blocks - ext4: make directory inode spreading reflect flexbg size https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.147 - [x86] thunderbolt: Add support for Intel Maple Ridge - [x86] thunderbolt: Add support for Intel Maple Ridge single port controller - [arm64,armhf] ALSA: hda/tegra: Use clk_bulk helpers - [arm64,armhf] ALSA: hda/tegra: Reset hardware - ALSA: hda/hdmi: let new platforms assign the pcm slot dynamically - ALSA: hda: Fix Nvidia dp infoframe - btrfs: fix hang during unmount when stopping a space reclaim worker - [arm64,x86] usb: typec: ucsi: Remove incorrect warning - [x86] thunderbolt: Explicitly reset plug events delay back to USB4 spec value - net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 - libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205 - mm/page_alloc: fix race condition between build_all_zonelists and page allocation - mm: prevent page_frag_alloc() from corrupting the memory - mm/migrate_device.c: flush TLB while holding PTL - mm: fix madivse_pageout mishandling on non-LRU page - swiotlb: max mapping size takes min align mask into account - [arm64] scsi: hisi_sas: Revert "scsi: hisi_sas: Limit max hw sectors for v3 HW" - [arm64,armhf] soc: sunxi: sram: Actually claim SRAM regions - [arm64,armhf] soc: sunxi: sram: Prevent the driver from being unbound - [arm64,armhf] soc: sunxi_sram: Make use of the helper function devm_platform_ioremap_resource() - [arm64,armhf] soc: sunxi: sram: Fix probe function ordering issues - [arm64,armhf] soc: sunxi: sram: Fix debugfs info for A64 SRAM C - [arm64,armhf] Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time" - usbnet: Fix memory leak in usbnet_disconnect() - net: sched: act_ct: fix possible refcount leak in tcf_ct_init() - cxgb4: fix missing unlock on ETHOFLD desc collect fail path - nvme: add new line after variable declatation - nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices - net: stmmac: power up/down serdes in stmmac_open/release - [armhf] clk: imx: imx6sx: remove the SET_RATE_PARENT flag for QSPI clocks - [x86] KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest - [x86] alternative: Fix race in try_get_desc() - ALSA: hda/hdmi: fix warning about PCM count when used with SOF https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.148 - nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level() - nilfs2: fix use-after-free bug of struct nilfs_root - nilfs2: fix leak of nilfs_root in case of writer thread creation failure - nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure - ceph: don't truncate file in atomic_open - docs: update mediator information in CoC docs - xsk: Inherit need_wakeup flag for shared sockets - ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC (CVE-2022-3303) - mm: gup: fix the fast GUP race against THP collapse - [powerpc*] 64s/radix: don't need to broadcast IPI for radix pmd collapse flush - fs: fix UAF/GPF bug in nilfs_mdt_destroy - compiler_attributes.h: move __compiletime_{error|warning} - scsi: qedf: Fix a UAF bug in __qedf_probe() - net/ieee802154: fix uninit value bug in dgram_sendmsg - ALSA: hda/hdmi: Fix the converter reuse for the silent stream - net: atlantic: fix potential memory leak in aq_ndev_close() - drm/amd/display: update gamut remap if plane has changed - drm/amd/display: skip audio setup when audio stream is enabled - mmc: core: Replace with already defined values for readability - mmc: core: Terminate infinite loop in SD-UHS voltage switch - usb: mon: make mmapped memory read only - USB: serial: ftdi_sio: fix 300 bps rate for SIO - [arm64] rpmsg: qcom: glink: replace strncpy() with strscpy_pad() - Revert "clk: ti: Stop using legacy clkctrl names for omap4 and 5" - random: restore O_NONBLOCK support - random: clamp credited irq bits to maximum mixed - ALSA: hda: Fix position reporting on Poulsbo - efi: Correct Macmini DMI match in uefi cert quirk - scsi: stex: Properly zero out the passthrough command structure - USB: serial: qcserial: add new usb-id for Dell branded EM7455 - random: avoid reading two cache lines on irq randomness - random: use expired timer rather than wq for mixing fast pool - wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() (CVE-2022-41674) - wifi: cfg80211/mac80211: reject bad MBSSID elements - wifi: cfg80211: ensure length byte is present before access - wifi: cfg80211: fix BSS refcounting bugs (CVE-2022-42720) - wifi: cfg80211: avoid nontransmitted BSS list corruption (CVE-2022-42721) - wifi: mac80211_hwsim: avoid mac80211 warning on bad rate - wifi: mac80211: fix crash in beacon protection for P2P-device (CVE-2022-42722) - wifi: cfg80211: update hidden BSSes to avoid WARN_ON - Input: xpad - add supported devices as contributed on github - Input: xpad - fix wireless 360 controller breaking after suspend [ Aurelien Jarno ] * [arm64] Add support for misalignment fixups for multiword loads from next branch. Enable COMPAT_ALIGNMENT_FIXUPS. [ Salvatore Bonaccorso ] * [x86] drivers/edac: Enable EDAC_I10NM as module (Closes: #1019248) * Bump ABI to 19 * Refresh "Export symbols needed by Android drivers" * [rt] Update to 5.10.140-rt73 * io_uring/af_unix: defer registered files gc to io_uring release (CVE-2022-2602) * ext4: fix check for block being out of directory size (CVE-2022-1184) [ Uwe Kleine-König ] * mac80211: mlme: find auth challenge directly * wifi: mac80211: don't parse mbssid in assoc response * wifi: mac80211: fix MBSSID parsing use-after-free (CVE-2022-42719) -- Salvatore Bonaccorso Sun, 16 Oct 2022 23:18:41 +0200 linux (5.10.140-1) bullseye; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.137 - Makefile: link with -z noexecstack --no-warn-rwx-segments - [x86] link vdso and boot with -z noexecstack --no-warn-rwx-segments - Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING" - scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover" - ALSA: bcd2000: Fix a UAF bug on the error path of probing - ALSA: hda/realtek: Add quirk for Clevo NV45PZ - ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx - wifi: mac80211_hwsim: fix race condition in pending packet - wifi: mac80211_hwsim: add back erroneously removed cast - wifi: mac80211_hwsim: use 32-bit skb cookie - add barriers to buffer_uptodate and set_buffer_uptodate - HID: wacom: Only report rotation for art pen - HID: wacom: Don't register pad_input for touch switch - [x86] KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case - [x86] KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case - [x86] KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 - [s390x] KVM: s390: pv: don't present the ecall interrupt twice - [x86] KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value - [x86] KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks - [x86] KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP - [x86] KVM: x86: Tag kvm_mmu_x86_module_init() with __init - mm: Add kvrealloc() - xfs: only set IOMAP_F_SHARED when providing a srcmap to a write - xfs: fix I_DONTCACHE - mm/mremap: hold the rmap lock in write mode when moving page table entries. - ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model - ALSA: hda/cirrus - support for iMac 12,1 model - ALSA: hda/realtek: Add quirk for another Asus K42JZ model - ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED - tty: vt: initialize unicode screen buffer - vfs: Check the truncate maximum size in inode_newsize_ok() - fs: Add missing umask strip in vfs_tmpfile - thermal: sysfs: Fix cooling_device_stats_setup() error code path - fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters - fbcon: Fix accelerated fbdev scrolling while logo is still shown - usbnet: Fix linkwatch use-after-free on disconnect - ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh() - drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error - [arm*] drm/vc4: hdmi: Disable audio if dmas property is present but empty - drm/nouveau: fix another off-by-one in nvbios_addr - drm/nouveau: Don't pm_runtime_put_sync(), only pm_runtime_put_autosuspend() - drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from pm_runtime - drm/amdgpu: Check BO's requested pinning domains against its preferred_domains - iio: light: isl29028: Fix the warning in isl29028_remove() - scsi: sg: Allow waiting for commands to complete on removed device - scsi: qla2xxx: Fix incorrect display of max frame size - scsi: qla2xxx: Zero undefined mailbox IN registers - fuse: limit nsec - [arm64] serial: mvebu-uart: uart2 error bits clearing - md-raid: destroy the bitmap after destroying the thread - md-raid10: fix KASAN warning - PCI: Add defines for normal and subtractive PCI bridges - [powerpc*] powernv: Avoid crashing if rng is NULL - [mips64el,mipsel] cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK - usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion - USB: HCD: Fix URB giveback issue in tasklet function - [arm64,armhf] usb: dwc3: gadget: refactor dwc3_repare_one_trb - [arm64,armhf] usb: dwc3: gadget: fix high speed multiplier setting - netfilter: nf_tables: fix null deref due to zeroed list head - epoll: autoremove wakers even more aggressively - [x86] Handle idle=nomwait cmdline properly for x86_idle - [arm64] Do not forget syscall when starting a new thread. - [arm64] fix oops in concurrently setting insn_emulation sysctls - genirq: Don't return error on missing optional irq_request_resources() - [mips64el,mipsel] irqchip/mips-gic: Only register IPI domain when SMP is enabled - genirq: GENERIC_IRQ_IPI depends on SMP - [mips64el,mipsel] irqchip/mips-gic: Check the return value of ioremap() in gic_of_init() - wait: Fix __wait_event_hrtimeout for RT/DL tasks - [armhf] OMAP2+: display: Fix refcount leak bug - ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks - ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk - ACPI: PM: save NVS memory for Lenovo G40-45 - ACPI: LPSS: Fix missing check in register_device_clock() - [arm64] dts: allwinner: a64: orangepi-win: Fix LED node name - PM: hibernate: defer device probing when resuming from hibernation - selinux: Add boundary check in put_entry() - [armel,armhf] findbit: fix overflowing offset - [arm64,armhf] meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init - ACPI: processor/idle: Annotate more functions to live in cpuidle section - Input: atmel_mxt_ts - fix up inverted RESET handler - [arm64] soc: amlogic: Fix refcount leak in meson-secure-pwrc.c - [x86] pmem: Fix platform-device leak in error path - [armhf] dts: ast2500-evb: fix board compatible - [armhf] dts: ast2600-evb: fix board compatible - [arm64] cpufeature: Allow different PMU versions in ID_DFR0_EL1 - locking/lockdep: Fix lockdep_init_map_*() confusion - [arm64] soc: fsl: guts: machine variable might be unset - block: fix infinite loop for invalid zone append - [armhf] OMAP2+: Fix refcount leak in omapdss_init_of - [armhf] OMAP2+: Fix refcount leak in omap3xxx_prm_late_init - [arm64] regulator: qcom_smd: Fix pm8916_pldo range - [arm64] ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP - [arm64] bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() - erofs: avoid consecutive detection for Highmem memory - blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created - hwmon: (drivetemp) Add module alias - block: remove the request_queue to argument request based tracepoints - blktrace: Trace remapped requests correctly - regulator: of: Fix refcount leak bug in of_get_regulation_constraints() - nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() - dm: return early from dm_pr_call() if DM device is suspended - ath10k: do not enforce interrupt trigger type - wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c() - ath11k: fix netdev open race - drm/mipi-dbi: align max_chunk to 2 in spi_transfer - ath11k: Fix incorrect debug_mask mappings - drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() - virtio-gpu: fix a missing check to avoid NULL dereference - [arm64] drm: adv7511: override i2c address of cec before accessing it - net: fix sk_wmem_schedule() and sk_rmem_schedule() errors - i2c: Fix a potential use after free - media: tw686x: Register the irq at the end of probe - ath9k: fix use-after-free in ath9k_hif_usb_rx_cb (CVE-2022-1679) - wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd() - drm/radeon: fix incorrrect SPDX-License-Identifiers - [amd64] crypto: ccp - During shutdown, check SEV data pointer before using - [arm64] drm: bridge: adv7511: Add check for mipi_dsi_driver_register - media: hdpvr: fix error value returns in hdpvr_read - [arm64,armhf] media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set - media: tw686x: Fix memory leak in tw686x_video_init - [arm*] drm/vc4: plane: Remove subpixel positioning check - [arm*] drm/vc4: plane: Fix margin calculations for the right/bottom edges - [arm*] drm/vc4: dsi: Correct DSI divider calculations - [arm*] drm/vc4: dsi: Correct pixel order for DSI0 - [arm*] drm/vc4: drv: Remove the DSI pointer in vc4_drv - [arm*] drm/vc4: dsi: Use snprintf for the PHY clocks instead of an array - [arm*] drm/vc4: dsi: Introduce a variant structure - [arm*] drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type - [arm*] drm/vc4: dsi: Fix dsi0 interrupt support - [arm*] drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable iteration - [arm*] drm/vc4: hdmi: Remove firmware logic for MAI threshold setting - [arm*] drm/vc4: hdmi: Avoid full hdmi audio fifo writes - [arm*] drm/vc4: hdmi: Don't access the connector state in reset if kmalloc fails - [arm*] drm/vc4: hdmi: Limit the BCM2711 to the max without scrambling - [arm*] drm/vc4: hdmi: Fix timings for interlaced modes - [arm*] drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes - [arm64,armhf] drm/rockchip: vop: Don't crash for invalid duplicate_state() - [arm64,armhf] drm/rockchip: Fix an error handling path rockchip_dp_probe() - lib: bitmap: order includes alphabetically - lib: bitmap: provide devm_bitmap_alloc() and devm_bitmap_zalloc() - hinic: Use the bitmap API when applicable - net: hinic: fix bug that ethtool get wrong stats - net: hinic: avoid kernel hung in hinic_get_stats64() - [arm64] drm/msm/mdp5: Fix global state lock backoff - mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg - mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init() - tcp: make retransmitted SKB fit into the send window - bpf: Fix subprog names in stack traces. - fs: check FMODE_LSEEK to control internal pipe splicing - wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() - [i386] can: pch_can: do not report txerr and rxerr during bus-off - can: sja1000: do not report txerr and rxerr during bus-off - [armhf] can: sun4i_can: do not report txerr and rxerr during bus-off - can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off - can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off - can: usb_8dev: do not report txerr and rxerr during bus-off - can: error: specify the values of data[5..7] of CAN error frames - [i386] can: pch_can: pch_can_error(): initialize errc before using it - Bluetooth: hci_intel: Add check for platform_driver_register - wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` - wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue - wifi: libertas: Fix possible refcount leak in if_usb_probe() - [arm64,armhf] media: cedrus: hevc: Add check for invalid timestamp - net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version - net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS - [arm64] crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of - inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH() - tcp: sk->sk_bound_dev_if once in inet_request_bound_dev_if() - ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH() - tcp: Fix data-races around sysctl_tcp_l3mdev_accept. - net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set - iavf: Fix max_rate limiting - net: rose: fix netdev reference changes - dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock - wireguard: ratelimiter: use hrtimer in selftest - wireguard: allowedips: don't corrupt stack when detecting overflow - HID: cp2112: prevent a buffer overflow in cp2112_xfer() - mtd: partitions: Fix refcount leak in parse_redboot_of - [arm64,armhf] usb: xhci: tegra: Fix error check - netfilter: xtables: Bring SPDX identifier back - [arm64,armhf] platform/chrome: cros_ec: Always expose last resume result - KVM: Don't set Accessed/Dirty bits for ZERO_PAGE - mwifiex: Ignore BTCOEX events from the 88W8897 firmware - mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv - misc: rtsx: Fix an error handling path in rtsx_pci_probe() - driver core: fix potential deadlock in __driver_attach - usb: host: xhci: use snprintf() in xhci_decode_trb() - [arm64,armhf] PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu() - [arm64,armhf] PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists - soundwire: bus_type: fix remove and shutdown support - [arm64] KVM: arm64: Don't return from void function - [x86] intel_th: Fix a resource leak in an error handling path - [x86] intel_th: msu-sink: Potential dereference of null pointer - [x86] intel_th: msu: Fix vmalloced buffers - [x86] staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback - [arm64] mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch - mmc: block: Add single read for 4k sector cards - [s390x] KVM: s390: pv: leak the topmost page table when destroy fails - PCI/portdrv: Don't disable AER reporting in get_port_device_capability() - [arm64] PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks - scsi: smartpqi: Fix DMA direction for RAID requests - [armhf] usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc() - [arm64,armhf] usb: dwc3: core: Deprecate GCTL.CORESOFTRESET - [arm64,armhf] usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup - [arm64,armhf] usb: dwc3: qcom: fix missing optional irq warnings - RDMA/qedr: Improve error logs for rdma_alloc_tid error return - RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() - [arm64] RDMA/hns: Fix incorrect clearing of interrupt status register - [amd64] RDMA/hfi1: fix potential memory leak in setup_base_ctxt() - gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() - [mips64el,mipsel] mmc: cavium-octeon: Add of_node_put() when breaking out of loop - HID: alps: Declare U1_UNICORN_LEGACY support - USB: serial: fix tty-port initialized comments - [armhf,i386] platform/olpc: Fix uninitialized data in debugfs write - RDMA/srpt: Duplicate port name members - RDMA/srpt: Introduce a reference count in struct srpt_device - RDMA/srpt: Fix a use-after-free - mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region - RDMA/mlx5: Add missing check for return value in get namespace flow - RDMA/rxe: Fix error unwind in rxe_create_qp() - null_blk: fix ida error handling in null_add_dev() - nvme: use command_id instead of req->tag in trace_nvme_complete_rq() - jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction() - ext4: recover csum seed of tmp_inode after migrating to extents - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted - opp: Fix error check in dev_pm_opp_attach_genpd() - serial: 8250: Export ICR access helpers for internal use - serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty() - profiling: fix shift too large makes kernel panic - tty: n_gsm: Delete gsmtty open SABM frame when config requester - tty: n_gsm: fix user open not possible at responder until initiator open - tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() - tty: n_gsm: fix non flow control frames during mux flow off - tty: n_gsm: fix packet re-transmission without open control channel - tty: n_gsm: fix race condition in gsmld_write() - [arm64] ASoC: qcom: Fix missing of_node_put() in asoc_qcom_lpass_cpu_platform_probe() - vfio: Remove extra put/gets around vfio_device->group - vfio: Simplify the lifetime logic for vfio_device - vfio: Split creation of a vfio_device into init and register ops - tty: n_gsm: fix wrong T1 retry count handling - tty: n_gsm: fix DM command - tty: n_gsm: fix missing corner cases in gsmld_poll() - kfifo: fix kfifo_to_user() return type - lib/smp_processor_id: fix imbalanced instrumentation_end() call - [arm64] mfd: max77620: Fix refcount leak in max77620_initialise_fps - [arm64] iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop - [s390x] dump: fix old lowcore virtual vs physical address confusion - fuse: Remove the control interface for virtio-fs - [armhf] ASoC: audio-graph-card: Add of_node_put() in fail path - [arm64] watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() - [arm64,armhf] video: fbdev: amba-clcd: Fix refcount leak bugs - video: fbdev: sis: fix typos in SiS_GetModeID() - [powerpc*] pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias - f2fs: don't set GC_FAILURE_PIN for background GC - f2fs: write checkpoint during FG_GC - f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time - [powerpc*] xive: Fix refcount leak in xive_get_max_prio - kprobes: Forbid probing on trampoline and BPF code areas - [powerpc*] pci: Fix PHB numbering when using opal-phbid - sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy() - sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed - [amd64] x86/numa: Use cpumask_available instead of hardcoded NULL check - video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() - sched: Fix the check of nr_running at queue wakelist - video: fbdev: vt8623fb: Check the size of screen before memset_io() - video: fbdev: arkfb: Check the size of screen before memset_io() - video: fbdev: s3fb: Check the size of screen before memset_io() - [s390x] scsi: zfcp: Fix missing auto port scan and thus missing target ports - scsi: qla2xxx: Fix discovery issues in FC-AL topology - scsi: qla2xxx: Turn off multi-queue for 8G adapters - scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection - scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os - scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests - [x86] bugs: Enable STIBP for IBPB mitigated RETBleed - [x86] ftrace/x86: Add back ftrace_expected assignment - __follow_mount_rcu(): verify that mount_lock remains unchanged - spmi: trace: fix stack-out-of-bound access in SPMI tracing functions - [x86] drm/i915/dg1: Update DMC_DEBUG3 register - HID: Ignore battery for Elan touchscreen on HP Spectre X360 15-df0xxx - HID: hid-input: add Surface Go battery quirk - [arm*] drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component - usbnet: smsc95xx: Don't clear read-only PHY interrupt - usbnet: smsc95xx: Avoid link settings race on interrupt reception - [x86] intel_th: pci: Add Meteor Lake-P support - [x86] intel_th: pci: Add Raptor Lake-S PCH support - [x86] intel_th: pci: Add Raptor Lake-S CPU support - [x86] KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors - [x86] KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS) - [amd64] iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) - PCI/AER: Write AER Capability only when we control it - PCI/ERR: Bind RCEC devices to the Root Port driver - PCI/ERR: Rename reset_link() to reset_subordinates() - PCI/ERR: Simplify by using pci_upstream_bridge() - PCI/ERR: Simplify by computing pci_pcie_type() once - PCI/ERR: Use "bridge" for clarity in pcie_do_recovery() - PCI/ERR: Avoid negated conditional for clarity - PCI/ERR: Add pci_walk_bridge() to pcie_do_recovery() - PCI/ERR: Recover from RCEC AER errors - PCI/AER: Iterate over error counters instead of error strings - serial: 8250: Dissociate 4MHz Titan ports from Oxford ports - serial: 8250: Correct the clock for OxSemi PCIe devices - serial: 8250_pci: Refactor the loop in pci_ite887x_init() - serial: 8250_pci: Replace dev_*() by pci_*() macros - serial: 8250: Fold EndRun device support into OxSemi Tornado code - dm writecache: set a default MAX_WRITEBACK_JOBS - dm thin: fix use-after-free crash in dm_sm_register_threshold_callback - timekeeping: contribute wall clock to rng on time change - btrfs: reject log replay if there is unsupported RO compat flag - btrfs: reset block group chunk force if we have to wait - [amd64,arm64] ACPI: CPPC: Do not prevent CPPC from working in the future - [x86] KVM: VMX: Drop guest CPUID check for VMXE in vmx_set_cr4() - [x86] KVM: VMX: Drop explicit 'nested' check from vmx_set_cr4() - [x86] KVM: SVM: Drop VMXE check from svm_set_cr4() - [x86] KVM: x86: Move vendor CR4 validity check to dedicated kvm_x86_ops hook - [x86] KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4 - [x86] KVM: x86/pmu: preserve IA32_PERF_CAPABILITIES across CPUID refresh - [x86] KVM: x86/pmu: Use binary search to check filtered events - [x86] KVM: x86/pmu: Use different raw event masks for AMD and Intel - [x86] KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter - [x86] KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU - [x86] KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support global_ctrl - xen-blkback: fix persistent grants negotiation - xen-blkback: Apply 'feature_persistent' parameter when connect - xen-blkfront: Apply 'feature_persistent' parameter when connect - KEYS: asymmetric: enforce SM2 signature use pkey algo - tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH - tracing: Use a struct alignof to determine trace event field alignment - ext4: check if directory block is within i_size (CVE-2022-1184) - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h - ext4: fix warning in ext4_iomap_begin as race between bmap and write - ext4: make sure ext4_append() always allocates new block - ext4: fix use-after-free in ext4_xattr_set_entry - ext4: update s_overhead_clusters in the superblock during an on-line resize - ext4: fix extent status tree race in writeback error recovery path - ext4: correct max_inline_xattr_value_size computing - ext4: correct the misjudgment in ext4_iget_extra_inode - dm raid: fix address sanitizer warning in raid_resume - dm raid: fix address sanitizer warning in raid_status - KVM: Add infrastructure and macro to mark VM as bugged - [x86] KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq (CVE-2022-2153) - [x86] KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() (CVE-2022-2153) - mac80211: fix a memory leak where sta_info is not freed - tcp: fix over estimation in sk_forced_mem_schedule() - Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv" - [arm*] drm/vc4: change vc4_dma_range_matches from a global to static - Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression - [x86] kvm: x86/pmu: Fix the compare function used by the pmu event filter - [arm64] tee: add overflow check in register_shm_helper() - net/9p: Initialize the iounit field during fid creation - net_sched: cls_route: disallow handle of 0 - sched/fair: Fix fault in reweight_entity - btrfs: only write the sectors in the vertical stripe which has data stripes - btrfs: raid56: don't trust any cached sector in __raid56_parity_recover() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.138 - ALSA: info: Fix llseek return value when using callback - ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU - [x86] mm: Use proper mask when setting PUD mapping - rds: add missing barrier to release_refill - ata: libata-eh: Add missing command name - [arm64] mmc: meson-gx: Fix an error handling path in meson_mmc_probe() - btrfs: fix lost error handling when looking up extended ref on log replay - tracing: Have filter accept "common_cpu" to be consistent - ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II - can: ems_usb: fix clang's -Wunaligned-access warning - apparmor: fix quiet_denied for file rules - apparmor: fix absroot causing audited secids to begin with = - apparmor: Fix failed mount permission check error message - apparmor: fix aa_label_asxprint return check - apparmor: fix setting unconfined mode on a loaded profile - apparmor: fix overlapping attachment computation - apparmor: fix reference count leak in aa_pivotroot() - apparmor: Fix memleak in aa_simple_write_to_buffer() - Documentation: ACPI: EINJ: Fix obsolete example - NFSv4.1: Don't decrease the value of seq_nr_highest_sent - NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly - NFSv4: Fix races in the legacy idmapper upcall - NFSv4.1: RECLAIM_COMPLETE must handle EACCES - NFSv4/pnfs: Fix a use-after-free bug in open - bpf: Acquire map uref in .init_seq_private for array map iterator - bpf: Acquire map uref in .init_seq_private for hash map iterator - bpf: Acquire map uref in .init_seq_private for sock local storage map iterator - bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator - bpf: Check the validity of max_rdwr_access for sock local storage map iterator - can: mcp251x: Fix race condition on receive interrupt - [amd64,arm64] net: atlantic: fix aq_vec index out of range error - sunrpc: fix expiry of auth creds - SUNRPC: Reinitialise the backchannel request buffers before reuse - virtio_net: fix memory leak inside XPD_TX with mergeable - devlink: Fix use-after-free after a failed reload - [arm64] pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed - [arm64,armhf] pinctrl: sunxi: Add I/O bias setting for H6 R-PIO - ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool - geneve: do not use RT_TOS for IPv6 flowlabel - ipv6: do not use RT_TOS for IPv6 flowlabel - [x86] plip: avoid rcu debug splat - vsock: Fix memory leak in vsock_connect() - vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout() - dt-bindings: arm: qcom: fix MSM8916 MTP compatibles - dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources - ceph: use correct index when encoding client supported features - ceph: don't leak snap_rwsem in handle_cap_grant - nfp: ethtool: fix the display error of `ethtool -m DEVNAME` - xen/xenbus: fix return type in xenbus_file_read() - atm: idt77252: fix use-after-free bugs caused by tst_timer - geneve: fix TOS inheriting for ipv4 - [arm64] dpaa2-eth: trace the allocated address instead of page struct - iavf: Fix adminq error handling - netfilter: nf_tables: really skip inactive sets when allocating name - netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag - netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified - [powerpc*] pci: Fix get_phb_number() locking - [arm64,armhf] spi: meson-spicc: add local pow2 clock ops to preserve rate between messages - [arm64,armhf] net: dsa: mv88e6060: prevent crash on an unused port - [arm64] net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters - net: genl: fix error path memory leak in policy dumping - ice: Ignore EEXIST when setting promisc mode - [arm64,armhf] i2c: imx: Make sure to unregister adapter on remove() - regulator: pca9450: Remove restrictions for regulator-name - i40e: Fix to stop tx_timeout recovery if GLOBR fails - [arm64,armhf] fec: Fix timer capture timing in `fec_ptp_enable_pps()` - [x86] stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove() - igb: Add lock to avoid data race - kbuild: fix the modules order between drivers and libs - locking/atomic: Make test_and_*_bit() ordered on failure - [x86] ASoC: SOF: intel: move sof_intel_dsp_desc() forward - [arm64] drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() - audit: log nftables configuration change events once per table - netfilter: nftables: add helper function to set the base sequence number - netfilter: add helper function to set up the nfnetlink header and use it - [armhf] drm/sun4i: dsi: Prevent underflow when computing packet sizes - PCI: Add ACS quirk for Broadcom BCM5750x NICs - [arm64,armhf] platform/chrome: cros_ec_proto: don't show MKBP version if unsupported - usb: gadget: uvc: call uvc uvcg_warn on completed status instead of uvcg_info - [arm64,armhf] irqchip/tegra: Fix overflow implicit truncation warnings - [arm64] drm/meson: Fix overflow implicit truncation warnings - [armhf] clk: ti: Stop using legacy clkctrl names for omap4 and 5 - [arm*] usb: dwc2: gadget: remove D+ pull-up while no vbus with usb-role-switch - [x86] vboxguest: Do not use devm for irq - uacce: Handle parent device removal or parent driver module rmmod - zram: do not lookup algorithm in backends table - [arm64] clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description - scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input - gadgetfs: ep_io - wait until IRQ finishes - [x86] pinctrl: intel: Check against matching data instead of ACPI companion - [powerpc*] cxl: Fix a memory leak in an error handling path - [arm64] PCI/ACPI: Guard ARM64-specific mcfg_quirks - RDMA/rxe: Limit the number of calls to each tasklet - md: Notify sysfs sync_completed in md_reap_sync_thread() - nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown - drivers:md:fix a potential use-after-free bug - ext4: avoid remove directory when directory is corrupted - ext4: avoid resizing to a partial cluster size - lib/list_debug.c: Detect uninitialized lists - vfio: Clear the caps->buf to NULL after free - [mips64el,mipsel] cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start - modules: Ensure natural alignment for .altinstructions and __bug_table sections - watchdog: export lockup_detector_reconfigure - ALSA: core: Add async signal helpers - ALSA: timer: Use deferred fasync helper - ALSA: control: Use deferred fasync helper - f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() - f2fs: fix to do sanity check on segment type in build_sit_entries() - smb3: check xattr value length earlier - [powerpc*] 64: Init jump labels before parse_early_param() - netfilter: nftables: fix a warning message in nf_tables_commit_audit_collect() - netfilter: nf_tables: fix audit memory leak in nf_tables_commit - tracing/probes: Have kprobes and uprobes use $COMM too - can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once() - can: j1939: j1939_session_destroy(): fix memory leak of skbs - PCI/ERR: Retain status from error notification - qrtr: Convert qrtr_ports from IDR to XArray - bpf: Fix KASAN use-after-free Read in compute_effective_progs - [arm64] tee: fix memory leak in tee_shm_register() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.139 https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.140 - audit: fix potential double free on error path from fsnotify_add_inode_mark - pinctrl: amd: Don't save/restore interrupt status and wake status bits - xfs: prevent a WARN_ONCE() in xfs_ioc_attr_list() - xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP* - fs: remove __sync_filesystem - vfs: make sync_filesystem return errors from ->sync_fs - xfs: return errors in xfs_fs_sync_fs - xfs: only bother with sync_filesystem during readonly remount - kernel/sched: Remove dl_boosted flag comment - xfrm: fix refcount leak in __xfrm_policy_check() - xfrm: clone missing x->lastused in xfrm_do_migrate - af_key: Do not call xfrm_probe_algs in parallel (CVE-2022-3028) - xfrm: policy: fix metadata dst->dev xmit null pointer dereference - NFS: Don't allocate nfs_fattr on the stack in __nfs42_ssc_open() - NFSv4.2 fix problems with __nfs42_ssc_open - SUNRPC: RPC level errors should set task->tk_rpc_status - mm/huge_memory.c: use helper function migration_entry_to_page() - mm/smaps: don't access young/dirty bit if pte unpresent - rose: check NULL rose_loopback_neigh->loopback - ice: xsk: Force rings to be sized to power of 2 - ice: xsk: prohibit usage of non-balanced queue id - net/mlx5e: Properly disable vlan strip on non-UL reps - bonding: 802.3ad: fix no transmission of LACPDUs - net: ipvtap - add __init/__exit annotations to module init/exit funcs - netfilter: ebtables: reject blobs that don't provide all entry points - bnxt_en: fix NQ resource accounting during vf creation on 57500 chips - netfilter: nft_payload: report ERANGE for too long offset and length - netfilter: nft_payload: do not truncate csum_offset and csum_type - netfilter: nf_tables: do not leave chain stats enabled on error - netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families - netfilter: nft_tunnel: restrict it to netdev family - netfilter: nftables: remove redundant assignment of variable err - netfilter: nf_tables: consolidate rule verdict trace call - netfilter: nft_cmp: optimize comparison for 16-bytes - netfilter: bitwise: improve error goto labels - netfilter: nf_tables: upfront validation of data via nft_data_init() - netfilter: nf_tables: disallow jump to implicit chain from set element - netfilter: nf_tables: disallow binding to already bound chain (CVE-2022-39190) - tcp: tweak len/truesize ratio for coalesce candidates - net: Fix data-races around sysctl_[rw]mem(_offset)?. - net: Fix data-races around sysctl_[rw]mem_(max|default). - net: Fix data-races around weight_p and dev_weight_[rt]x_bias. - net: Fix data-races around netdev_max_backlog. - net: Fix data-races around netdev_tstamp_prequeue. - ratelimit: Fix data-races in ___ratelimit(). - bpf: Folding omem_charge() into sk_storage_charge() - net: Fix data-races around sysctl_optmem_max. - net: Fix a data-race around sysctl_tstamp_allow_data. - net: Fix a data-race around sysctl_net_busy_poll. - net: Fix a data-race around sysctl_net_busy_read. - net: Fix a data-race around netdev_budget. - net: Fix a data-race around netdev_budget_usecs. - net: Fix data-races around sysctl_fb_tunnels_only_for_init_net. - net: Fix data-races around sysctl_devconf_inherit_init_net. - net: Fix a data-race around sysctl_somaxconn. - ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter - rxrpc: Fix locking in rxrpc's sendmsg - btrfs: fix silent failure when deleting root reference - btrfs: replace: drop assert for suspended replace - btrfs: add info when mount fails due to stale replace target - btrfs: check if root is readonly while setting security xattr - [x86] perf/x86/lbr: Enable the branch type for the Arch LBR by default - [amd64] x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry - [x86] bugs: Add "unknown" reporting for MMIO Stale Data - loop: Check for overflow while configuring loop - asm-generic: sections: refactor memory_intersects - [s390x] fix double free of GS and RI CBs on fork() failure - [x86] ACPI: processor: Remove freq Qos request for all CPUs - xen/privcmd: fix error exit of privcmd_ioctl_dm_op() - mm/hugetlb: fix hugetlb not supporting softdirty tracking - Revert "md-raid: destroy the bitmap after destroying the thread" - md: call __md_stop_writes in md_stop - [arm64] Fix match_list for erratum 1286807 on Arm Cortex-A76 - Documentation/ABI: Mention retbleed vulnerability info file for sysfs - blk-mq: fix io hung due to missing commit_rqs - [x86] perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU - [x86] scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq - bpf: Don't use tnum_range on array range checking for poke descriptors (CVE-2022-2905) [ Salvatore Bonaccorso ] * Bump ABI to 18 * certs: Rotate to use the "Debian Secure Boot Signer 2022 - linux" certificate (Closes: #1018752) * [x86] nospec: Unwreck the RSB stuffing * [x86] nospec: Fix i386 RSB stuffing (Closes: #1017425) * mm: Force TLB flush for PFNMAP mappings before unlink_file_vma() (CVE-2022-39188) * Revert "PCI/portdrv: Don't disable AER reporting in get_port_device_capability()" * bpf: Don't redirect packets with invalid pkt_len * mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse * net/af_packet: check len when min_header_len equals to 0 -- Salvatore Bonaccorso Fri, 02 Sep 2022 15:54:53 +0200 linux (5.10.136-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.128 - MAINTAINERS: add Amir as xfs maintainer for 5.10.y - drm: remove drm_fb_helper_modinit - tick/nohz: unexport __init-annotated tick_nohz_full_setup() - bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() - xfs: use kmem_cache_free() for kmem_cache objects - xfs: punch out data fork delalloc blocks on COW writeback failure - xfs: Fix the free logic of state in xfs_attr_node_hasname - xfs: remove all COW fork extents when remounting readonly - xfs: check sb_meta_uuid for dabuf buffer recovery - [powerpc*] ftrace: Remove ftrace init tramp once kernel init is complete - [arm64] net: mscc: ocelot: allow unregistered IP multicast flooding https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.129 - drm/amdgpu: To flush tlb for MMHUB of RAVEN series - ipv6: take care of disable_policy when restoring routes - nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG SX6000LNP (AKA SPECTRIX S40G) - nvdimm: Fix badblocks clear off-by-one error - [powerpc*] bpf: Fix use of user_pt_regs in uapi - dm raid: fix accesses beyond end of raid member array - [s390x] archrandom: simplify back to earlier design and initialize earlier - SUNRPC: Fix READ_PLUS crasher (Closes: #1014793) - net: usb: ax88179_178a: Fix packet receiving - virtio-net: fix race between ndo_open() and virtio_device_ready() - [armhf] net: dsa: bcm_sf2: force pause link settings - net: tun: unlink NAPI from device on destruction - net: tun: stop NAPI when detaching queues - net: dp83822: disable false carrier interrupt - net: dp83822: disable rx error interrupt - RDMA/qedr: Fix reporting QP timeout attribute - RDMA/cm: Fix memory leak in ib_cm_insert_listen - linux/dim: Fix divide by 0 in RDMA DIM - usbnet: fix memory allocation in helpers - net: ipv6: unexport __init-annotated seg6_hmac_net_init() - NFSD: restore EINVAL error translation in nfsd_commit() - netfilter: nft_dynset: restore set element counter when failing to update - net/sched: act_api: Notify user space if any actions were flushed before error - net: bonding: fix possible NULL deref in rlb code - net: bonding: fix use-after-free after 802.3ad slave unbind - tipc: move bc link creation back to tipc_node_create - epic100: fix use after free on rmmod - io_uring: ensure that send/sendmsg and recv/recvmsg check sqe->ioprio - tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() - net: tun: avoid disabling NAPI twice - xfs: use current->journal_info for detecting transaction recursion - xfs: rename variable mp to parsing_mp - xfs: Skip repetitive warnings about mount options - xfs: ensure xfs_errortag_random_default matches XFS_ERRTAG_MAX - xfs: fix xfs_trans slab cache name - xfs: update superblock counters correctly for !lazysbcount - xfs: fix xfs_reflink_unshare usage of filemap_write_and_wait_range - tcp: add a missing nf_reset_ct() in 3WHS handling - xen/gntdev: Avoid blocking in unmap_grant_pages() - [arm64] drivers: cpufreq: Add missing of_node_put() in qoriq-cpufreq.c - sit: use min - ipv6/sit: fix ipip6_tunnel_get_prl return value - hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails - net: usb: qmi_wwan: add Telit 0x1060 composition - net: usb: qmi_wwan: add Telit 0x1070 composition https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.130 - mm/slub: add missing TID updates on slab deactivation - ALSA: hda/realtek: Add quirk for Clevo L140PU - can: bcm: use call_rcu() instead of costly synchronize_rcu() - can: gs_usb: gs_usb_open/close(): fix memory leak - bpf: Fix incorrect verifier simulation around jmp32's jeq/jne - bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals - usbnet: fix memory leak in error case - netfilter: nft_set_pipapo: release elements in clone from abort path - [amd64] iommu/vt-d: Fix PCI bus rescan device hot add - PM: runtime: Redefine pm_runtime_release_supplier() - memregion: Fix memregion_free() fallback definition - video: of_display_timing.h: include errno.h - [powerpc*] powernv: delay rng platform device creation until later in boot - can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info - can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression - can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits - xfs: remove incorrect ASSERT in xfs_rename - [armhf] meson: Fix refcount leak in meson_smp_prepare_cpus - [armhf] pinctrl: sunxi: a83t: Fix NAND function name for some pins - [arm64] dts: imx8mp-evk: correct mmc pad settings - [arm64] dts: imx8mp-evk: correct the uart2 pinctl value - [arm64] dts: imx8mp-evk: correct gpio-led pad settings - [arm64] dts: imx8mp-evk: correct I2C3 pad settings - [arm64,armhf] pinctrl: sunxi: sunxi_pconf_set: use correct offset - [arm64] dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo - xsk: Clear page contiguity bit when unmapping pool - i40e: Fix dropped jumbo frames statistics - r8169: fix accessing unset transport header - [armhf] dmaengine: imx-sdma: Allow imx8m for imx7 FW revs - misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer - misc: rtsx_usb: use separate command and response buffers - misc: rtsx_usb: set return value in rsp_buf alloc err path - dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo - ida: don't use BUG_ON() for debugging - [arm64,armhf] dmaengine: pl330: Fix lockdep warning about non-static key - [armhf] dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate - [armhf] dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.131 - [armhf] Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting" https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.132 - [x86] ALSA: hda - Add fixup for Dell Latitidue E5430 - [x86] ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model - [x86] ALSA: hda/realtek: Fix headset mic for Acer SF313-51 - [x86] ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 - [x86] ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 - [x86] ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop - xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue - fix race between exit_itimers() and /proc/pid/timers - mm: split huge PUD on wp_huge_pud fallback - tracing/histograms: Fix memory leak problem - net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer - ip: fix dflt addr selection for connected nexthop - [armhf] 9213/1: Print message about disabled Spectre workarounds only once - [armel,armhf] 9214/1: alignment: advance IT state after emulating Thumb instruction - wifi: mac80211: fix queue selection for mesh/OCB interfaces - cgroup: Use separate src/dst nodes when preloading css_sets for migration - btrfs: return -EAGAIN for NOWAIT dio reads/writes on compressed and inline extents - [arm64,armhf] drm/panfrost: Put mapping instead of shmem obj on panfrost_mmu_map_fault_addr() error - [arm64,armhf] drm/panfrost: Fix shrinker list corruption by madvise IOCTL - fs/remap: constrain dedupe of EOF blocks - nilfs2: fix incorrect masking of permission flags for symlinks - sh: convert nommu io{re,un}map() to static inline functions - Revert "evm: Fix memleak in init_desc" - ext4: fix race condition between ext4_write and ext4_convert_inline_data - [armhf] dts: imx6qdl-ts7970: Fix ngpio typo and count - [armhf] 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle - [armel,armhf] 9210/1: Mark the FDT_FIXED sections as shareable - net/mlx5e: Fix capability check for updating vnic env counters - [x86] drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() - ima: Fix a potential integer overflow in ima_appraise_measurement - [arm64,armhf] ASoC: sgtl5000: Fix noise on shutdown/remove - [x86] ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() - [x86] ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array - sysctl: Fix data races in proc_dointvec(). - sysctl: Fix data races in proc_douintvec(). - sysctl: Fix data races in proc_dointvec_minmax(). - sysctl: Fix data races in proc_douintvec_minmax(). - sysctl: Fix data races in proc_doulongvec_minmax(). - sysctl: Fix data races in proc_dointvec_jiffies(). - tcp: Fix a data-race around sysctl_tcp_max_orphans. - inetpeer: Fix data-races around sysctl. - net: Fix data-races around sysctl_mem. - cipso: Fix data-races around sysctl. - icmp: Fix data-races around sysctl. - ipv4: Fix a data-race around sysctl_fib_sync_mem. - [armhf] dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero - [x86] drm/i915/gt: Serialize TLB invalidates with GT resets - sysctl: Fix data-races in proc_dointvec_ms_jiffies(). - icmp: Fix a data-race around sysctl_icmp_ratelimit. - icmp: Fix a data-race around sysctl_icmp_ratemask. - raw: Fix a data-race around sysctl_raw_l3mdev_accept. - ipv4: Fix data-races around sysctl_ip_dynaddr. - nexthop: Fix data-races around nexthop_compat_mode. - [armhf] net: ftgmac100: Hold reference returned by of_get_child_by_name() - ima: force signature verification when CONFIG_KEXEC_SIG is configured - ima: Fix potential memory leak in ima_init_crypto() - sfc: fix use after free when disabling sriov - seg6: fix skb checksum evaluation in SRH encapsulation/insertion - seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors - seg6: bpf: fix skb checksum in bpf_push_seg6_encap() - sfc: fix kernel panic when creating VF - net: atlantic: remove deep parameter on suspend/resume functions - net: atlantic: remove aq_nic_deinit() when resume - [x86] KVM: x86: Fully initialize 'struct kvm_lapic_irq' in kvm_pv_kick_cpu_op() - net/tls: Check for errors in tls_device_init - mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE - virtio_mmio: Add missing PM calls to freeze/restore - virtio_mmio: Restore guest page size on resume - netfilter: br_netfilter: do not skip all hooks with 0 priority - [arm64] scsi: hisi_sas: Limit max hw sectors for v3 HW - [powerpc*] cpufreq: pmac32-cpufreq: Fix refcount leak bug - [x86] platform/x86: hp-wmi: Ignore Sanitization Mode event - net: tipc: fix possible refcount leak in tipc_sk_create() - nvme-tcp: always fail a request when sending it failed - nvme: fix regression when disconnect a recovering ctrl - net: sfp: fix memory leak in sfp_probe() - ASoC: ops: Fix off by one in range control validation - [armhf] pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux() - [x86] ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow - ASoC: dapm: Initialise kcontrol data for mux/demux controls - [amd64] Clear .brk area at early boot - [armhf] dts: stm32: use the correct clock source for CEC on stm32mp151 - Revert "can: xilinx_can: Limit CANFD brp to 2" - nvme-pci: phison e16 has bogus namespace ids - signal handling: don't use BUG_ON() for debugging - USB: serial: ftdi_sio: add Belimo device ids - usb: typec: add missing uevent when partner support PD - [arm64,armhf] usb: dwc3: gadget: Fix event pending check - [armhf] tty: serial: samsung_tty: set dma burst_size to 1 - vt: fix memory overlapping when deleting chars in the buffer - serial: 8250: fix return error code in serial8250_request_std_resource() - [armhf] serial: stm32: Clear prev values before setting RTS delays - [arm*] serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle - serial: 8250: Fix PM usage_count for console handover - [x86] pat: Fix x86_has_pat_wp() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.133 - [amd64] Preparation for mitigating RETbleed: + KVM/VMX: Use TEST %REG,%REG instead of CMP $0,%REG in vmenter.S + KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw + objtool: Refactor ORC section generation + objtool: Add 'alt_group' struct + objtool: Support stack layout changes in alternatives + objtool: Support retpoline jump detection for vmlinux.o + objtool: Assume only ELF functions do sibling calls + objtool: Combine UNWIND_HINT_RET_OFFSET and UNWIND_HINT_FUNC + x86/xen: Support objtool validation in xen-asm.S + x86/xen: Support objtool vmlinux.o validation in xen-head.S + x86/alternative: Merge include files + x86/alternative: Support not-feature + x86/alternative: Support ALTERNATIVE_TERNARY + x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() + x86/insn: Rename insn_decode() to insn_decode_from_regs() + x86/insn: Add a __ignore_sync_check__ marker + x86/insn: Add an insn_decode() API + x86/insn-eval: Handle return values from the decoder + x86/alternative: Use insn_decode() + x86: Add insn_decode_kernel() + x86/alternatives: Optimize optimize_nops() + x86/retpoline: Simplify retpolines + objtool: Correctly handle retpoline thunk calls + objtool: Handle per arch retpoline naming + objtool: Rework the elf_rebuild_reloc_section() logic + objtool: Add elf_create_reloc() helper + objtool: Create reloc sections implicitly + objtool: Extract elf_strtab_concat() + objtool: Extract elf_symbol_add() + objtool: Add elf_create_undef_symbol() + objtool: Keep track of retpoline call sites + objtool: Cache instruction relocs + objtool: Skip magical retpoline .altinstr_replacement + objtool/x86: Rewrite retpoline thunk calls + objtool: Support asm jump tables + x86/alternative: Optimize single-byte NOPs at an arbitrary position + objtool: Fix .symtab_shndx handling for elf_create_undef_symbol() + objtool: Only rewrite unconditional retpoline thunk calls + objtool/x86: Ignore __x86_indirect_alt_* symbols + objtool: Don't make .altinstructions writable + objtool: Teach get_alt_entry() about more relocation types + objtool: print out the symbol type when complaining about it + objtool: Remove reloc symbol type checks in get_alt_entry() + objtool: Make .altinstructions section entry size consistent + objtool: Introduce CFI hash + objtool: Handle __sanitize_cov*() tail calls + objtool: Classify symbols + objtool: Explicitly avoid self modifying code in .altinstr_replacement + objtool,x86: Replace alternatives with .retpoline_sites + x86/retpoline: Remove unused replacement symbols + x86/asm: Fix register order + x86/asm: Fixup odd GEN-for-each-reg.h usage + x86/retpoline: Move the retpoline thunk declarations to nospec-branch.h + x86/retpoline: Create a retpoline thunk array + x86/alternative: Implement .retpoline_sites support + x86/alternative: Handle Jcc __x86_indirect_thunk_\reg + x86/alternative: Try inline spectre_v2=retpoline,amd + x86/alternative: Add debug prints to apply_retpolines() + bpf,x86: Simplify computing label offsets + bpf,x86: Respect X86_FEATURE_RETPOLINE* + x86/lib/atomic64_386_32: Rename things - [amd64] Mitigate straight-line speculation: + x86: Prepare asm files for straight-line-speculation + x86: Prepare inline-asm for straight-line-speculation + x86/alternative: Relax text_poke_bp() constraint + objtool: Add straight-line-speculation validation + x86: Add straight-line-speculation mitigation + tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' + kvm/emulate: Fix SETcc emulation function offsets with SLS + objtool: Default ignore INT3 for unreachable + crypto: x86/poly1305 - Fixup SLS + objtool: Fix SLS validation for kcov tail-call replacement - objtool: Fix code relocs vs weak symbols - objtool: Fix type of reloc::addend - objtool: Fix symbol creation - x86/entry: Remove skip_r11rcx - objtool: Fix objtool regression on x32 systems - x86/realmode: build with -D__DISABLE_EXPORTS - [amd64] Add mitigations for RETbleed on AMD/Hygon (CVE-2022-29900) and Intel (CVE-2022-29901) processors: + x86/kvm/vmx: Make noinstr clean + x86/cpufeatures: Move RETPOLINE flags to word 11 + x86/retpoline: Cleanup some #ifdefery + x86/retpoline: Swizzle retpoline thunk + Makefile: Set retpoline cflags based on CONFIG_CC_IS_{CLANG,GCC} + x86/retpoline: Use -mfunction-return + x86: Undo return-thunk damage + x86,objtool: Create .return_sites + objtool: skip non-text sections when adding return-thunk sites + x86,static_call: Use alternative RET encoding + x86/ftrace: Use alternative RET encoding + x86/bpf: Use alternative RET encoding + x86/kvm: Fix SETcc emulation for return thunks + x86/vsyscall_emu/64: Don't use RET in vsyscall emulation + x86/sev: Avoid using __x86_return_thunk + x86: Use return-thunk in asm code + objtool: Treat .text.__x86.* as noinstr + x86: Add magic AMD return-thunk + x86/bugs: Report AMD retbleed vulnerability + x86/bugs: Add AMD retbleed= boot parameter + x86/bugs: Enable STIBP for JMP2RET + x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value + x86/entry: Add kernel IBRS implementation + x86/bugs: Optimize SPEC_CTRL MSR writes + x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS + x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() + x86/bugs: Report Intel retbleed vulnerability + intel_idle: Disable IBRS during long idle + objtool: Update Retpoline validation + x86/xen: Rename SYS* entry points + x86/bugs: Add retbleed=ibpb + x86/bugs: Do IBPB fallback check only once + objtool: Add entry UNRET validation + x86/cpu/amd: Add Spectral Chicken + x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n + x86/speculation: Fix firmware entry SPEC_CTRL handling + x86/speculation: Fix SPEC_CTRL write on SMT state change + x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit + x86/speculation: Remove x86_spec_ctrl_mask + objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} + KVM: VMX: Flatten __vmx_vcpu_run() + KVM: VMX: Convert launched argument to flags + KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS + KVM: VMX: Fix IBRS handling after vmexit + x86/speculation: Fill RSB on vmexit for IBRS + x86/common: Stamp out the stepping madness + x86/cpu/amd: Enumerate BTC_NO + x86/retbleed: Add fine grained Kconfig knobs + x86/bugs: Add Cannon lake to RETBleed affected CPU list + x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported + x86/kexec: Disable RET on kexec + x86/speculation: Disable RRSBA behavior - x86/static_call: Serialize __static_call_fixup() properly - tools/insn: Restore the relative include paths for cross building - x86, kvm: use proper ASM macros for kvm_vcpu_is_preempted - x86/xen: Fix initialisation in hypercall_page after rethunk - x86/ftrace: Add UNWIND_HINT_FUNC annotation for ftrace_stub - x86/asm/32: Fix ANNOTATE_UNRET_SAFE use on 32-bit - x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current - efi/x86: use naked RET on mixed mode call wrapper - x86/kvm: fix FASTOP_SIZE when return thunks are enabled - KVM: emulate: do not adjust size of fastop and setcc subroutines - tools arch x86: Sync the msr-index.h copy with the kernel sources - tools headers cpufeatures: Sync with the kernel sources - x86/bugs: Remove apostrophe typo - um: Add missing apply_returns() - x86: Use -mindirect-branch-cs-prefix for RETPOLINE builds - kvm: fix objtool relocation warning - objtool: Fix elf_create_undef_symbol() endianness - tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' - again - tools headers: Remove broken definition of __LITTLE_ENDIAN https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.134 - [armhf] pinctrl: stm32: fix optional IRQ support to gpios - lockdown: Fix kexec lockdown bypass with ima policy (CVE-2022-21505) - io_uring: Use original task for req identity in io_identity_cow() - xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE - docs: net: explain struct net_device lifetime - net: make free_netdev() more lenient with unregistering devices - net: make sure devices go through netdev_wait_all_refs - net: move net_set_todo inside rollback_registered() - net: inline rollback_registered() - net: move rollback_registered_many() - net: inline rollback_registered_many() - [amd64] PCI: hv: Fix multi-MSI to allow more than one MSI vector - [amd64] PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI - [amd64] PCI: hv: Reuse existing IRTE allocation in compose_msi_msg() - [amd64] PCI: hv: Fix interrupt mapping for multi-MSI - [arm64] serial: mvebu-uart: correctly report configured baudrate value - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup() (CVE-2022-36879) - perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() - drm/amdgpu/display: add quirk handling for stutter mode - igc: Reinstate IGC_REMOVED logic and implement it properly - ip: Fix data-races around sysctl_ip_no_pmtu_disc. - ip: Fix data-races around sysctl_ip_fwd_use_pmtu. - ip: Fix data-races around sysctl_ip_fwd_update_priority. - ip: Fix data-races around sysctl_ip_nonlocal_bind. - ip: Fix a data-race around sysctl_ip_autobind_reuse. - ip: Fix a data-race around sysctl_fwmark_reflect. - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. - tcp: Fix data-races around sysctl_tcp_mtu_probing. - tcp: Fix data-races around sysctl_tcp_base_mss. - tcp: Fix data-races around sysctl_tcp_min_snd_mss. - tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor. - tcp: Fix a data-race around sysctl_tcp_probe_threshold. - tcp: Fix a data-race around sysctl_tcp_probe_interval. - net: stmmac: fix unbalanced ptp clock issue in suspend/resume flow - net: stmmac: fix dma queue left shift overflow issue - igmp: Fix data-races around sysctl_igmp_llm_reports. - igmp: Fix a data-race around sysctl_igmp_max_memberships. - igmp: Fix data-races around sysctl_igmp_max_msf. - tcp: Fix data-races around keepalive sysctl knobs. - tcp: Fix data-races around sysctl_tcp_syncookies. - tcp: Fix data-races around sysctl_tcp_reordering. - tcp: Fix data-races around some timeout sysctl knobs. - tcp: Fix a data-race around sysctl_tcp_notsent_lowat. - tcp: Fix a data-race around sysctl_tcp_tw_reuse. - tcp: Fix data-races around sysctl_max_syn_backlog. - tcp: Fix data-races around sysctl_tcp_fastopen. - tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout. - iavf: Fix handling of dummy receive descriptors - i40e: Fix erroneous adapter reinitialization during recovery process - ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero - [arm64,armhf] gpio: pca953x: only use single read/write for No AI mode - [arm64,armhf] gpio: pca953x: use the correct range when do regmap sync - [arm64,armhf] gpio: pca953x: use the correct register address when regcache sync during init - be2net: Fix buffer overflow in be_get_module_eeprom - ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh. - ip: Fix data-races around sysctl_ip_prot_sock. - udp: Fix a data-race around sysctl_udp_l3mdev_accept. - tcp: Fix data-races around sysctl knobs related to SYN option. - tcp: Fix a data-race around sysctl_tcp_early_retrans. - tcp: Fix data-races around sysctl_tcp_recovery. - tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. - tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. - tcp: Fix a data-race around sysctl_tcp_retrans_collapse. - tcp: Fix a data-race around sysctl_tcp_stdurg. - tcp: Fix a data-race around sysctl_tcp_rfc1337. - tcp: Fix data-races around sysctl_tcp_max_reordering. - [arm*] spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers - KVM: Don't null dereference ops->destroy - mm/mempolicy: fix uninit-value in mpol_rebind_policy() - bpf: Make sure mac_header was set before using it - sched/deadline: Fix BUG_ON condition for deboosted tasks - [x86] bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts - dlm: fix pending remove if msg allocation fails - bitfield.h: Fix "type of reg too small for mask" test - ALSA: memalloc: Align buffer allocations in page size - Bluetooth: Add bt_skb_sendmsg helper - Bluetooth: Add bt_skb_sendmmsg helper - Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg - Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg - Bluetooth: Fix passing NULL to PTR_ERR - Bluetooth: SCO: Fix sco_send_frame returning skb->len - Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks - [x86] amd: Use IBPB for firmware calls - [x86] alternative: Report missing return thunk details - watchqueue: make sure to serialize 'wqueue->defunct' properly - tty: drivers/tty/, stop using tty_schedule_flip() - tty: the rest, stop using tty_schedule_flip() - tty: drop tty_schedule_flip() - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push() - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() - net: usb: ax88179_178a needs FLAG_SEND_ZLP - watch-queue: remove spurious double semicolon https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.135 - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put - Revert "ocfs2: mount shared volume without ha stack" - [s390x] archrandom: prevent CPACF trng invocations in interrupt context - watch_queue: Fix missing rcu annotation - watch_queue: Fix missing locking in add_watch_to_object() - tcp: Fix data-races around sysctl_tcp_dsack. - tcp: Fix a data-race around sysctl_tcp_app_win. - tcp: Fix a data-race around sysctl_tcp_adv_win_scale. - tcp: Fix a data-race around sysctl_tcp_frto. - tcp: Fix a data-race around sysctl_tcp_nometrics_save. - tcp: Fix data-races around sysctl_tcp_no_ssthresh_metrics_save. - ice: check (DD | EOF) bits on Rx descriptor rather than (EOP | RS) - ice: do not setup vlan for loopback VSI - Revert "tcp: change pingpong threshold to 3" - tcp: Fix data-races around sysctl_tcp_moderate_rcvbuf. - tcp: Fix a data-race around sysctl_tcp_limit_output_bytes. - tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit. - net: ping6: Fix memleak in ipv6_renew_options(). - ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr - igmp: Fix data-races around sysctl_igmp_qrv. - net: sungem_phy: Add of_node_put() for reference returned by of_get_parent() - tcp: Fix a data-race around sysctl_tcp_min_tso_segs. - tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen. - tcp: Fix a data-race around sysctl_tcp_autocorking. - tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit. - Documentation: fix sctp_wmem in ip-sysctl.rst - macsec: fix NULL deref in macsec_add_rxsa - macsec: fix error message in macsec_add_rxsa and _txsa - macsec: limit replay window size with XPN - macsec: always read MACSEC_SA_ATTR_PN as a u64 - net: macsec: fix potential resource leak in macsec_add_rxsa() and macsec_add_txsa() - tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns. - tcp: Fix a data-race around sysctl_tcp_comp_sack_slack_ns. - tcp: Fix a data-race around sysctl_tcp_comp_sack_nr. - tcp: Fix data-races around sysctl_tcp_reflect_tos. - i40e: Fix interface init with MSI interrupts (no MSI-X) - sctp: fix sleep in atomic context bug in timer handlers - netfilter: nf_queue: do not allow packet truncation below transport header offset (CVE-2022-36946) - virtio-net: fix the race between refill work and close - sfc: disable softirqs for ptp TX - sctp: leave the err path free in sctp_stream_init to sctp_stream_free - page_alloc: fix invalid watermark check on a negative value - mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle. - [arm*] 9216/1: Fix MAX_DMA_ADDRESS overflow - docs/kernel-parameters: Update descriptions for "mitigations=" param with retbleed - xfs: refactor xfs_file_fsync - xfs: xfs_log_force_lsn isn't passed a LSN - xfs: prevent UAF in xfs_log_item_in_current_chkpt - xfs: fix log intent recovery ENOSPC shutdowns when inactivating inodes - xfs: force the log offline when log intent item recovery fails - xfs: hold buffer across unpin and potential shutdown processing - xfs: remove dead stale buf unpin handling code - xfs: logging the on disk inode LSN can make it go backwards - xfs: Enforce attr3 buffer recovery order - [x86] bugs: Do not enable IBPB at firmware entry when IBPB is not available - bpf: Consolidate shared test timing code - bpf: Add PROG_TEST_RUN support for sk_lookup programs https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.136 - [x86] speculation: Make all RETbleed mitigations 64-bit only - ath9k_htc: fix NULL pointer dereference at ath9k_htc_rxep() - ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet() - tun: avoid double free in tun_free_netdev - [x86] ACPI: video: Force backlight native for some TongFang devices - [x86] ACPI: video: Shortening quirk list by identifying Clevo by board_name only - ACPI: APEI: Better fix to avoid spamming the console with old error logs - [arm64] crypto: arm64/poly1305 - fix a read out-of-bound - Bluetooth: hci_bcm: Add BCM4349B1 variant - Bluetooth: hci_bcm: Add DT compatible for CYW55572 - Bluetooth: btusb: Add support of IMC Networks PID 0x3568 - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04CA:0x4007 - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04C5:0x1675 - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0CB8:0xC558 - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3587 - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3586 - [x86] Add mitigations for Post-Barrier Return Stack Buffer Prediction (PBRSB) issue (CVE-2022-26373): + x86/speculation: Add RSB VM Exit protections + x86/speculation: Add LFENCE to RSB fill sequence [ Salvatore Bonaccorso ] * Bump ABI to 17 * [rt] Update to 5.10.131-rt72 * posix-cpu-timers: Cleanup CPU timers before freeing them during exec (CVE-2022-2585) * netfilter: nf_tables: do not allow SET_ID to refer to another table (CVE-2022-2586) * netfilter: nf_tables: do not allow CHAIN_ID to refer to another table * netfilter: nf_tables: do not allow RULE_ID to refer to another chain * net_sched: cls_route: remove from list when handle is 0 (CVE-2022-2588) -- Salvatore Bonaccorso Sat, 13 Aug 2022 15:25:10 +0200 linux (5.10.127-2) bullseye-security; urgency=high * [amd64,arm64,armhf] wireguard: Clear keys after suspend despite CONFIG_ANDROID=y * netfilter: nf_tables: stricter validation of element data (CVE-2022-34918) * net: rose: fix UAF bugs caused by timer handler (CVE-2022-2318) * net: rose: fix UAF bug caused by rose_t0timer_expiry * xen/{blk,net}front: fix leaking data in shared pages (CVE-2022-26365, CVE-2022-33740) * xen/{blk,net}front: force data bouncing when backend is untrusted (CVE-2022-33741, CVE-2022-33742) * xen-netfront: restore __skb_queue_tail() positioning in xennet_get_responses() (CVE-2022-33743) * [arm64,armhf] xen/arm: Fix race in RB-tree based P2M accounting (CVE-2022-33744) * fbdev: fbmem: Fix logo center image dx issue * fbdev: Fix potential out-of-bounds writes (CVE-2021-33655): - fbmem: Check virtual screen sizes in fb_set_var() - fbcon: Disallow setting font bigger than screen size - fbcon: Prevent that screen size is smaller than font size -- Ben Hutchings Sun, 24 Jul 2022 00:32:10 +0200 linux (5.10.127-1) bullseye; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.121 - ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop - ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS - ALSA: usb-audio: Cancel pending work at closing a MIDI substream - USB: serial: option: add Quectel BG95 modem - USB: new quirk for Dell Gen 2 devices - usb: dwc3: gadget: Move null pinter check to proper place - usb: core: hcd: Add support for deferring roothub registration - cifs: when extending a file with falloc we should make files not-sparse - xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI - Fonts: Make font size unsigned in font_desc - [x86] MCE/AMD: Fix memory leak when threshold_create_bank() fails - [w86] perf/x86/intel: Fix event constraints for ICL - ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP - ptrace: Reimplement PTRACE_KILL by always sending SIGKILL - btrfs: add "0x" prefix for unsupported optional features - btrfs: repair super block num_devices automatically - [amd64] iommu/vt-d: Add RPLS to quirk list to skip TE disabling - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes - mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue - b43legacy: Fix assigning negative value to unsigned variable - b43: Fix assigning negative value to unsigned variable - ipw2x00: Fix potential NULL dereference in libipw_xmit() - ipv6: fix locking issues with loops over idev->addr_list - fbcon: Consistently protect deferred_takeover with console_lock() - [x86] platform/uv: Update TSC sync state for UV5 - ACPICA: Avoid cache flush inside virtual machines - drm/komeda: return early if drm_universal_plane_init() fails. - rcu-tasks: Fix race in schedule and flush work - rcu: Make TASKS_RUDE_RCU select IRQ_WORK - sfc: ef10: Fix assigning negative value to unsigned variable - ALSA: jack: Access input_dev under mutex - spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction - drm/amd/pm: fix double free in si_parse_power_table() - ath9k: fix QCA9561 PA bias level - media: venus: hfi: avoid null dereference in deinit - media: pci: cx23885: Fix the error handling in cx23885_initdev() - media: cx25821: Fix the warning when removing the module - md/bitmap: don't set sb values if can't pass sanity check - mmc: jz4740: Apply DMA engine limits to maximum segment size - drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit - scsi: megaraid: Fix error check return value of register_chrdev() - scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() - scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() - ath11k: disable spectral scan during spectral deinit - ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 - drm/plane: Move range check for format_count earlier - drm/amd/pm: fix the compile warning - ath10k: skip ath10k_halt during suspend for driver state RESTARTING - [arm64] compat: Do not treat syscall number as ESR_ELx for a bad syscall - drm: msm: fix error check return value of irq_of_parse_and_map() - ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL - net/mlx5: fs, delete the FTE when there are no rules attached to it - ASoC: dapm: Don't fold register value changes into notifications - mlxsw: spectrum_dcb: Do not warn about priority changes - mlxsw: Treat LLDP packets as control - drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo - HID: bigben: fix slab-out-of-bounds Write in bigben_probe - ASoC: tscs454: Add endianness flag in snd_soc_component_driver - net: remove two BUG() from skb_checksum_help() - [s390x] preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES - perf/amd/ibs: Cascade pmu init functions' return value - spi: stm32-qspi: Fix wait_cmd timeout in APM mode - dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC - ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default - ipmi:ssif: Check for NULL msg when handling events and messages - ipmi: Fix pr_fmt to avoid compilation issues - rtlwifi: Use pr_warn instead of WARN_ONCE - media: rga: fix possible memory leak in rga_probe - media: coda: limit frame interval enumeration to supported encoder frame sizes - media: imon: reorganize serialization - media: cec-adap.c: fix is_configuring state - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags - ASoC: rt5645: Fix errorenous cleanup order - nbd: Fix hung on disconnect request if socket is closed before - net: phy: micrel: Allow probing without .driver_data - media: exynos4-is: Fix compile warning - ASoC: max98357a: remove dependency on GPIOLIB - ASoC: rt1015p: remove dependency on GPIOLIB - can: mcp251xfd: silence clang's -Wunaligned-access warning - [x86] microcode: Add explicit CPU vendor dependency - rxrpc: Return an error to sendmsg if call failed - rxrpc, afs: Fix selection of abort codes - eth: tg3: silence the GCC 12 array-bounds warning - gfs2: use i_lock spin_lock for inode qadata - IB/rdmavt: add missing locks in rvt_ruc_loopback - [arm64] dts: qcom: msm8994: Fix BLSP[12]_DMA channels count - PM / devfreq: rk3399_dmc: Disable edev on remove() - crypto: ccree - use fine grained DMA mapping dir - soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc - fs: jfs: fix possible NULL pointer dereference in dbFree() - [powerpc*] fadump: Fix fadump to work with a different endian capture kernel - fat: add ratelimit to fat*_ent_bread() - pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources() - ARM: versatile: Add missing of_node_put in dcscb_init - ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM - ARM: hisi: Add missing of_node_put after of_find_compatible_node - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() - tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate - [powerpc*] powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr - [powerpc*] xics: fix refcount leak in icp_opal_init() - [powerpc*] powernv: fix missing of_node_put in uv_init() - macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled - [powerpc*] iommu: Add missing of_node_put in iommu_init_early_dart - [amd64] RDMA/hfi1: Prevent panic when SDMA is disabled - drm: fix EDID struct for old ARM OABI format - dt-bindings: display: sitronix, st7735r: Fix backlight in example - ath11k: acquire ab->base_lock in unassign when finding the peer by addr - ath9k: fix ar9003_get_eepmisc - drm/edid: fix invalid EDID extension block filtering - drm/bridge: adv7511: clean up CEC adapter when probe fails - spi: qcom-qspi: Add minItems to interconnect-names - ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe - ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe - [x86] delay: Fix the wrong asm constraint in delay_loop() - drm/ingenic: Reset pixclock rate when parent clock rate changes - drm/mediatek: Fix mtk_cec_mask() - [arm*] drm/vc4: hvs: Reset muxes at probe time - [arm*] drm/vc4: txp: Don't set TXP_VSTART_AT_EOF - [arm*] drm/vc4: txp: Force alpha to be 0xff if it's disabled - bpf: Fix excessive memory allocation in stack_map_alloc() - nl80211: show SSID for P2P_GO interfaces - drm/komeda: Fix an undefined behavior bug in komeda_plane_add() - drm: mali-dp: potential dereference of null pointer - spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout - scftorture: Fix distribution of short handler delays - net: dsa: mt7530: 1G can also support 1000BASE-X link mode - NFC: NULL out the dev->rfkill to prevent UAF - efi: Add missing prototype for efi_capsule_setup_info - target: remove an incorrect unmap zeroes data deduction - drbd: fix duplicate array initializer - EDAC/dmc520: Don't print an error for each unconfigured interrupt line - mtd: rawnand: denali: Use managed device resources - HID: hid-led: fix maximum brightness for Dream Cheeky - HID: elan: Fix potential double free in elan_input_configured - drm/bridge: Fix error handling in analogix_dp_probe - sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq - spi: img-spfi: Fix pm_runtime_get_sync() error checking - cpufreq: Fix possible race in cpufreq online error path - ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix - media: hantro: Empty encoder capture buffers by default - drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01 - ALSA: pcm: Check for null pointer of pointer substream before dereferencing it - inotify: show inotify mask flags in proc fdinfo - fsnotify: fix wrong lockdep annotations - of: overlay: do not break notify on NOTIFY_{OK|STOP} - drm/msm/dpu: adjust display_v_end for eDP and DP - scsi: ufs: qcom: Fix ufs_qcom_resume() - scsi: ufs: core: Exclude UECxx from SFR dump list - mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check() - [x86] pm: Fix false positive kmemleak report in msr_build_context() - mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe() - [x86] speculation: Add missing prototype for unpriv_ebpf_notify() - ASoC: rk3328: fix disabling mclk on pclk probe failure - perf tools: Add missing headers needed by util/data.h - drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume - drm/msm/dp: stop event kernel thread when DP unbind - drm/msm/dp: fix error check return value of irq_of_parse_and_map() - drm/msm/dsi: fix error checks and return values for DSI xmit functions - drm/msm/hdmi: check return value after calling platform_get_resource_byname() - drm/msm/hdmi: fix error check return value of irq_of_parse_and_map() - drm/msm: add missing include to msm_drv.c - drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H - drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() - perf tools: Use Python devtools for version autodetection rather than runtime - virtio_blk: fix the discard_granularity and discard_alignment queue limits - [x86] Fix return value of __setup handlers - irqchip/exiu: Fix acknowledgment of edge triggered interrupts - irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value - irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value - [x86] mm: Cleanup the control_va_addr_alignment() __setup handler - [arm64] fix types in copy_highpage() - regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET - drm/msm/dp: fix event thread stuck in wait_event after kthread_stop() - drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected - drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected - drm/msm: return an error pointer in msm_gem_prime_get_sg_table() - media: uvcvideo: Fix missing check to determine if element is found in list - iomap: iomap_write_failed fix - spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname() - Revert "cpufreq: Fix possible race in cpufreq online error path" - regulator: qcom_smd: Fix up PM8950 regulator configuration - perf/amd/ibs: Use interrupt regs ip for stack unwinding - ath11k: Don't check arvif->is_started before sending management frames - ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe - ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt - ASoC: samsung: Use dev_err_probe() helper - ASoC: samsung: Fix refcount leak in aries_audio_probe - scripts/faddr2line: Fix overlapping text section failures - media: aspeed: Fix an error handling path in aspeed_video_probe() - media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe - media: st-delta: Fix PM disable depth imbalance in delta_probe - media: exynos4-is: Change clk_disable to clk_disable_unprepare - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init - media: vsp1: Fix offset calculation for plane cropping - Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout - Bluetooth: Interleave with allowlist scan - Bluetooth: L2CAP: Rudimentary typo fixes - Bluetooth: LL privacy allow RPA - Bluetooth: use inclusive language in HCI role comments - Bluetooth: use inclusive language when filtering devices - Bluetooth: use hdev lock for accept_list and reject_list in conn req - nvme: set dma alignment to dword - lsm,selinux: pass flowi_common instead of flowi to the LSM hooks - sctp: read sk->sk_bound_dev_if once in sctp_rcv() - net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init - ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_* - media: ov7670: remove ov7670_power_off from ov7670_remove - media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource() - media: rkvdec: h264: Fix dpb_valid implementation - media: rkvdec: h264: Fix bit depth wrap in pps packet - ext4: reject the 'commit' option on ext2 filesystems - drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init - drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() - [x86] sev: Annotate stack change in the #VC handler - drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path - [x86] drm/i915: Fix CFI violation with show_dynamic_id() - thermal/drivers/bcm2711: Don't clamp temperature at zero - thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe - thermal/drivers/core: Use a char pointer for the cooling device name - thermal/core: Fix memory leak in __thermal_cooling_device_register() - thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe - ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() - NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx - ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv() - net: stmmac: selftests: Use kcalloc() instead of kzalloc() - net: stmmac: fix out-of-bounds access in a selftest - hv_netvsc: Fix potential dereference of NULL pointer - rxrpc: Fix listen() setting the bar too high for the prealloc rings - rxrpc: Don't try to resend the request if we're receiving the reply - rxrpc: Fix overlapping ACK accounting - rxrpc: Don't let ack.previousPacket regress - rxrpc: Fix decision on when to generate an IDLE ACK - net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc() - hinic: Avoid some over memory allocation - net/smc: postpone sk_refcnt increment in connect() - arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 - memory: samsung: exynos5422-dmc: Avoid some over memory allocation - ARM: dts: suniv: F1C100: fix watchdog compatible - soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc - soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc - PCI: cadence: Fix find_first_zero_bit() limit - PCI: rockchip: Fix find_first_zero_bit() limit - PCI: dwc: Fix setting error return on MSI DMA mapping failure - ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks - soc: qcom: llcc: Add MODULE_DEVICE_TABLE() - [x86] KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry - [x86] KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault - platform/chrome: cros_ec: fix error handling in cros_ec_register() - ARM: dts: imx6dl-colibri: Fix I2C pinmuxing - platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls - can: xilinx_can: mark bit timing constants as const - ARM: dts: stm32: Fix PHY post-reset delay on Avenger96 - ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT - ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C - ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED - ARM: dts: bcm2835-rpi-b: Fix GPIO line names - misc: ocxl: fix possible double free in ocxl_file_register_afu - crypto: marvell/cesa - ECB does not IV - gpiolib: of: Introduce hook for missing gpio-ranges - pinctrl: bcm2835: implement hook for missing gpio-ranges - arm: mediatek: select arch timer for mt7629 - powerpc/fadump: fix PT_LOAD segment for boot memory area - mfd: ipaq-micro: Fix error check return value of platform_get_irq() - scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() - firmware: arm_scmi: Fix list protocols enumeration in the base protocol - nvdimm: Fix firmware activation deadlock scenarios - nvdimm: Allow overwrite in the presence of disabled dimms - pinctrl: mvebu: Fix irq_of_parse_and_map() return value - drivers/base/node.c: fix compaction sysfs file leak - dax: fix cache flush on PMD-mapped pages - drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block() - powerpc/8xx: export 'cpm_setbrg' for modules - pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() - powerpc/idle: Fix return value of __setup() handler - powerpc/4xx/cpm: Fix return value of __setup() handler - ASoC: atmel-pdmic: Remove endianness flag on pdmic component - ASoC: atmel-classd: Remove endianness flag on class d component - proc: fix dentry/inode overinstantiating under /proc/${pid}/net - ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() - PCI: imx6: Fix PERST# start-up sequence - tty: fix deadlock caused by calling printk() under tty_port->lock - crypto: sun8i-ss - rework handling of IV - crypto: sun8i-ss - handle zero sized sg - crypto: cryptd - Protect per-CPU resource by disabling BH. - Input: sparcspkr - fix refcount leak in bbc_beep_probe - PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits - hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume() - [powerpc*] 64: Only WARN if __pa()/__va() called with bad addresses - [powerpc*] perf: Fix the threshold compare group constraint for power9 - macintosh: via-pmu and via-cuda need RTC_LIB - powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup - mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe() - mailbox: forward the hrtimer if not queued and under a lock - [amd64] RDMA/hfi1: Prevent use of lock before it is initialized - Input: stmfts - do not leave device disabled in stmfts_input_open - OPP: call of_node_put() on error path in _bandwidth_supported() - f2fs: fix dereference of stale list iterator after loop body - iommu/mediatek: Add list_del in mtk_iommu_remove - i2c: at91: use dma safe buffers - cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init - cpufreq: mediatek: Use module_init and add module_exit - cpufreq: mediatek: Unregister platform device on exit - [mips*] Loongson: Use hwmon_device_register_with_groups() to register hwmon - i2c: at91: Initialize dma_buf in at91_twi_xfer() - dmaengine: idxd: Fix the error handling path in idxd_cdev_register() - NFS: Do not report EINTR/ERESTARTSYS as mapping errors - NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS - NFS: Do not report flush errors in nfs_write_end() - NFS: Don't report errors from nfs_pageio_complete() more than once - NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout - video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup - dmaengine: stm32-mdma: remove GISR1 register - dmaengine: stm32-mdma: rework interrupt handler - dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler() - iommu/amd: Increase timeout waiting for GA log enablement - i2c: npcm: Fix timeout calculation - i2c: npcm: Correct register access width - i2c: npcm: Handle spurious interrupts - i2c: rcar: fix PM ref counts in probe error paths - perf c2c: Use stdio interface if slang is not supported - perf jevents: Fix event syntax error caused by ExtSel - f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() - f2fs: fix to do sanity check on block address in f2fs_do_zero_range() - f2fs: fix to clear dirty inode in f2fs_evict_inode() - f2fs: fix deadloop in foreground GC - f2fs: don't need inode lock for system hidden quota - f2fs: fix to do sanity check on total_data_blocks - f2fs: fix fallocate to use file_modified to update permissions consistently - f2fs: fix to do sanity check for inline inode - wifi: mac80211: fix use-after-free in chanctx code - iwlwifi: mvm: fix assert 1F04 upon reconfig - fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages - efi: Do not import certificates from UEFI Secure Boot for T2 Macs - bfq: Split shared queues on move between cgroups - bfq: Update cgroup information before merging bio - bfq: Track whether bfq_group is still online - ext4: fix use-after-free in ext4_rename_dir_prepare - ext4: fix warning in ext4_handle_inode_extension - ext4: fix bug_on in ext4_writepages - ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state - ext4: fix bug_on in __es_tree_search - ext4: verify dir block before splitting it (CVE-2022-1184) - ext4: avoid cycles in directory h-tree (CVE-2022-1184) - ACPI: property: Release subnode properties with data nodes - tracing: Fix potential double free in create_var_ref() - PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299 - PCI: qcom: Fix runtime PM imbalance on probe errors - PCI: qcom: Fix unbalanced PHY init on probe errors - mm, compaction: fast_find_migrateblock() should return pfn in the target zone - [s390x] perf: obtain sie_block from the right address - dlm: fix plock invalid read - dlm: fix missing lkb refcount handling - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock - scsi: dc395x: Fix a missing check on list iterator - scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. - drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem - drm/nouveau/clk: Fix an incorrect NULL check on list iterator - drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator - drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX - [x86] drm/i915/dsi: fix VBT send packet port selection for ICL+ - md: fix an incorrect NULL check in does_sb_need_changing - md: fix an incorrect NULL check in md_reload_sb - mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write - mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N - media: coda: Fix reported H264 profile - media: coda: Add more H264 levels for CODA960 - [amd64] RDMA/hfi1: Fix potential integer multiplication overflow errors - csky: patch_text: Fixup last cpu should be master - irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x - irqchip: irq-xtensa-mx: fix initial IRQ affinity - cfg80211: declare MODULE_FIRMWARE for regulatory.db - mac80211: upgrade passive scan to active scan on DFS channels after beacon rx - um: chan_user: Fix winch_tramp() return value - um: Fix out-of-bounds read in LDT setup - kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] - ftrace: Clean up hash direct_functions on register failures - iommu/msm: Fix an incorrect NULL check on list iterator - nodemask.h: fix compilation error with GCC12 - hugetlb: fix huge_pmd_unshare address update - xtensa/simdisk: fix proc_read_simdisk() - rtl818x: Prevent using not initialized queues - ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control - carl9170: tx: fix an incorrect use of list iterator - stm: ltdc: fix two incorrect NULL checks on list iterator - bcache: improve multithreaded bch_btree_check() - bcache: improve multithreaded bch_sectors_dirty_init() - bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() - bcache: avoid journal no-space deadlock by reserving 1 journal bucket - serial: pch: don't overwrite xmit->buf[0] by x_char - tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator - gma500: fix an incorrect NULL check on list iterator - arm64: dts: qcom: ipq8074: fix the sleep clock frequency - phy: qcom-qmp: fix struct clk leak on probe errors - ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries - ARM: pxa: maybe fix gpio lookup tables - SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op - docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 - dt-bindings: gpio: altera: correct interrupt-cells - vdpasim: allow to enable a vq repeatedly - blk-iolatency: Fix inflight count imbalances and IO hangs on offline - coresight: core: Fix coresight device probe failure issue - phy: qcom-qmp: fix reset-controller leak on probe errors - net: ipa: fix page free in ipa_endpoint_trans_release() - net: ipa: fix page free in ipa_endpoint_replenish_one() - xfs: set inode size after creating symlink - xfs: sync lazy sb accounting on quiesce of read-only mounts - xfs: fix chown leaking delalloc quota blocks when fssetxattr fails - xfs: fix incorrect root dquot corruption error when switching group/project quota types - xfs: restore shutdown check in mapped write fault path - xfs: force log and push AIL to clear pinned inodes when aborting mount - xfs: consider shutdown in bmapbt cursor delete assert - xfs: assert in xfs_btree_del_cursor should take into account error - kseltest/cgroup: Make test_stress.sh work if run interactively - thermal/core: fix a UAF bug in __thermal_cooling_device_register() - thermal/core: Fix memory leak in the error path - bfq: Avoid merging queues with different parents - bfq: Drop pointless unlock-lock pair - bfq: Remove pointless bfq_init_rq() calls - bfq: Get rid of __bio_blkcg() usage - bfq: Make sure bfqg for which we are queueing requests is online - block: fix bio_clone_blkg_association() to associate with proper blkcg_gq - Revert "random: use static branch for crng_ready()" - RDMA/rxe: Generate a completion for unsupported/invalid opcode - [mips*] IP27: Remove incorrect `cpu_has_fpu' override - [mips*] IP30: Remove incorrect `cpu_has_fpu' override - ext4: only allow test_dummy_encryption when supported - md: bcache: check the return value of kzalloc() in detached_dev_do_request() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.122 - pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards - staging: greybus: codecs: fix type confusion of list iterator variable - iio: adc: ad7124: Remove shift from scan_type - tty: goldfish: Use tty_port_destroy() to destroy port - tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe - tty: n_tty: Restore EOF push handling behavior - tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get - usb: usbip: fix a refcount leak in stub_probe() - usb: usbip: add missing device lock on tweak configuration cmd - USB: storage: karma: fix rio_karma_init return - usb: musb: Fix missing of_node_put() in omap2430_probe - staging: fieldbus: Fix the error handling path in anybuss_host_common_probe() - pwm: lp3943: Fix duty calculation in case period was clamped - rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value - usb: dwc3: pci: Fix pm_runtime_get_sync() error checking - misc: fastrpc: fix an incorrect NULL check on list iterator - firmware: stratix10-svc: fix a missing check on list iterator - usb: typec: mux: Check dev_set_name() return value - iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check - iio: proximity: vl53l0x: Fix return value check of wait_for_completion_timeout - iio: adc: sc27xx: fix read big scale voltage not right - iio: adc: sc27xx: Fine tune the scale calibration values - rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails - phy: qcom-qmp: fix pipe-clock imbalance on power-on failure - serial: sifive: Report actual baud base rather than fixed 115200 - coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier - extcon: ptn5150: Add queue work sync before driver release - soc: rockchip: Fix refcount leak in rockchip_grf_init - rtc: mt6397: check return value after calling platform_get_resource() - serial: meson: acquire port->lock in startup() - serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485 - serial: digicolor-usart: Don't allow CS5-6 - serial: rda-uart: Don't allow CS5-6 - serial: txx9: Don't allow CS5-6 - serial: sh-sci: Don't allow CS5-6 - serial: sifive: Sanitize CSIZE and c_iflag - serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 - serial: stm32-usart: Correct CSIZE, bits, and parity - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle - bus: ti-sysc: Fix warnings for unbind for serial - driver: base: fix UAF when driver_attach failed - driver core: fix deadlock in __device_attach - watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking - watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe - ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition - clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value - [s390x] crypto: fix scatterwalk_unmap() callers in AES-GCM - net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog - net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() - net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register - modpost: fix removing numeric suffixes - jffs2: fix memory leak in jffs2_do_fill_super - ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty - ubi: ubi_create_volume: Fix use-after-free when volume creation failed - bpf: Fix probe read error in ___bpf_prog_run() - net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *" - nfp: only report pause frame configuration for physical device - sfc: fix considering that all channels have TX queues - sfc: fix wrong tx channel offset with efx_separate_tx_channels - net/mlx5: Don't use already freed action pointer - net/mlx5: correct ECE offset in query qp output - net/mlx5e: Update netdev features after changing XDP state - net: sched: add barrier to fix packet stuck problem for lockless qdisc - tcp: tcp_rtx_synack() can be called from process context - gpio: pca953x: use the correct register address to do regcache sync - afs: Fix infinite loop found by xfstest generic/676 - scsi: sd: Fix potential NULL pointer dereference - tipc: check attribute length for bearer name - driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction - perf c2c: Fix sorting in percent_rmt_hitm_cmp() - dmaengine: idxd: set DMA_INTERRUPT cap bit - mips: cpc: Fix refcount leak in mips_cpc_default_phys_base - bootconfig: Make the bootconfig.o as a normal object file - tracing: Fix sleeping function called from invalid context on RT kernel - tracing: Avoid adding tracer option before update_tracer_options - iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() - iommu/arm-smmu-v3: check return value after calling platform_get_resource() - f2fs: remove WARN_ON in f2fs_is_valid_blkaddr - i2c: cadence: Increase timeout per message if necessary - dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type - NFSv4: Don't hold the layoutget locks across multiple RPC calls - video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1 - video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() - xprtrdma: treat all calls not a bcall when bc_serv is NULL - netfilter: nat: really support inet nat without l3 address - netfilter: nf_tables: delete flowtable hooks via transaction list - powerpc/kasan: Force thread size increase with KASAN - netfilter: nf_tables: always initialize flowtable hook list in transaction - ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe - netfilter: nf_tables: release new hooks on unsupported flowtable flags - netfilter: nf_tables: memleak flow rule from commit path - netfilter: nf_tables: bail out early if hardware offload is not supported - xen: unexport __init-annotated xen_xlate_map_ballooned_pages() - af_unix: Fix a data-race in unix_dgram_peer_wake_me(). - bpf, arm64: Clear prog->jited_len along prog->jited - net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list - net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() - net: mdio: unexport __init-annotated mdio_bus_init() - net: xfrm: unexport __init-annotated xfrm4_protocol_init() - net: ipv6: unexport __init-annotated seg6_hmac_init() - net/mlx5: Rearm the FW tracer after each tracer event - net/mlx5: fs, fail conflicting actions - ip_gre: test csum_start instead of transport header - net: altera: Fix refcount leak in altera_tse_mdio_create - drm: imx: fix compiler warning with gcc-12 - iio: dummy: iio_simple_dummy: check the return value of kstrdup() - staging: rtl8712: fix a potential memory leak in r871xu_drv_init() - iio: st_sensors: Add a local lock for protecting odr - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() - tty: Fix a possible resource leak in icom_probe - drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() - drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() - USB: host: isp116x: check return value after calling platform_get_resource() - drivers: tty: serial: Fix deadlock in sa1100_set_termios() - drivers: usb: host: Fix deadlock in oxu_bus_suspend() - USB: hcd-pci: Fully suspend across freeze/thaw cycle - sysrq: do not omit current cpu when showing backtrace of all active CPUs - usb: dwc2: gadget: don't reset gadget's driver->bus - misc: rtsx: set NULL intfdata when probe fails - extcon: Modify extcon device to be created after driver data is set - clocksource/drivers/sp804: Avoid error on multiple instances - staging: rtl8712: fix uninit-value in usb_read8() and friends - staging: rtl8712: fix uninit-value in r871xu_drv_init() - serial: msm_serial: disable interrupts in __msm_console_write() - kernfs: Separate kernfs_pr_cont_buf and rename_lock. - watchdog: wdat_wdt: Stop watchdog when rebooting the system - md: protect md_unregister_thread from reentrancy - scsi: myrb: Fix up null pointer access on myrb_cleanup() - Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" - ceph: allow ceph.dir.rctime xattr to be updatable - drm/radeon: fix a possible null pointer dereference - modpost: fix undefined behavior of is_arm_mapping_symbol() - [x86] cpu: Elide KCSAN for cpu_has() and friends - jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds - nbd: call genl_unregister_family() first in nbd_cleanup() - nbd: fix race between nbd_alloc_config() and module removal - nbd: fix io hung while disconnecting device - [s390x] gmap: voluntarily schedule during key setting - cifs: version operations for smb20 unneeded when legacy support disabled - nodemask: Fix return values to be unsigned - vringh: Fix loop descriptors check in the indirect cases - scripts/gdb: change kernel config dumping method - ALSA: hda/conexant - Fix loopback issue with CX20632 - ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021 - cifs: return errors during session setup during reconnects - cifs: fix reconnect on smb3 mount types - ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files - mmc: block: Fix CQE recovery reset success - net: phy: dp83867: retrigger SGMII AN when link change - nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling - nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION - ixgbe: fix bcast packets Rx on VF after promisc removal - ixgbe: fix unexpected VLAN Rx in promisc mode on VF - Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag - drm/bridge: analogix_dp: Support PSR-exit to disable transition - drm/atomic: Force bridge self-refresh-exit on CRTC switch - [powerpc*] 32: Fix overread/overwrite of thread_struct via ptrace (CVE-2022-32981) - [powerpc*] mm: Switch obsolete dssall to .long - interconnect: qcom: sc7180: Drop IP0 interconnects - interconnect: Restore sync state by ignoring ipa-virt in provider count - md/raid0: Ignore RAID0 layout if the second zone has only one device - PCI: qcom: Fix pipe clock imbalance - zonefs: fix handling of explicit_open option on mount - dmaengine: idxd: add missing callback function to support DMA_INTERRUPT - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.123 - [x86] Mitigate Processor MMIO Stale Data vulnerabilities (CVE-2022-21123, CVE-2022-21125, CVE-2022-21166): + Documentation: Add documentation for Processor MMIO Stale Data + x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug + x86/speculation: Add a common function for MD_CLEAR mitigation update + x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data + x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations + x86/speculation/mmio: Enable CPU Fill buffer clearing on idle + x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data + x86/speculation/srbds: Update SRBDS mitigation selection + x86/speculation/mmio: Reuse SRBDS mitigation for SBDS + KVM: x86/speculation: Disable Fill buffer clear within guests + x86/speculation/mmio: Print SMT warning https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.124 - 9p: missing chunk of "fs/9p: Don't update file type when updating file attributes" - nfsd: Replace use of rwsem with errseq_t - bpf: Fix incorrect memory charge cost calculation in stack_map_alloc() - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() - quota: Prevent memory allocation recursion while holding dq_lock - [armhf] ASoC: es8328: Fix event generation for deemphasis control - Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to dmi_use_low_level_irq - scsi: vmw_pvscsi: Expand vcpuHint to 16 bits - scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology - scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd completion - scsi: ipr: Fix missing/incorrect resource cleanup in error case - scsi: pmcraid: Fix missing resource cleanup in error case - ALSA: hda/realtek - Add HW8326 support - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg - random: credit cpu and bootloader seeds by default - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE - pNFS: Avoid a live lock condition in pnfs_update_layout() - [x86] clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() - i40e: Fix adding ADQ filter to TC0 - i40e: Fix calculating the number of queue pairs - i40e: Fix call trace in setup_tx_descriptors - [x86] Drivers: hv: vmbus: Release cpu lock in error case - [x86] drm/i915/reset: Fix error_state_read ptr + offset use - nvme: use sysfs_emit instead of sprintf - nvme: add device name to warning in uuid_show() - net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg - [arm64] ftrace: fix branch range checks - [arm64] ftrace: consistently handle PLTs. - block: Fix handling of offline queues in blk_mq_alloc_request_hctx() - faddr2line: Fix overlapping text section failures, the sequel - [arm64,armhf] irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions - [arm64,armhf] irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions - i2c: designware: Use standard optional ref clock implementation - [x86] mei: me: add raptor lake point S DID - [x86] comedi: vmk80xx: fix expression for tx buffer size - USB: serial: option: add support for Cinterion MV31 with new baseline - USB: serial: io_ti: add Agilent E5805A support - [arm*] usb: dwc2: Fix memory leak in dwc2_hcd_init - serial: 8250: Store to lsr_save_flags after lsr read - dm mirror log: round up region bitmap size to BITS_PER_LONG - drm/amd/display: Cap OLED brightness per max frame-average luminance - ext4: fix bug_on ext4_mb_use_inode_pa - ext4: make variable "count" signed - ext4: add reserved GDT blocks check - [arm64] KVM: arm64: Don't read a HW interrupt pending state in user context - [x86] KVM: x86: Account a variety of miscellaneous allocations - [x86] KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak - ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine - virtio-pci: Remove wrong address verification in vp_del_vqs() - dma-direct: don't over-decrypt memory - net/sched: act_police: more accurate MTU policing - net: openvswitch: fix misuse of the cached connection on tuple changes - Revert "PCI: Make pci_enable_ptm() private" - igc: Enable PCIe PTM - [arm64] clk: imx8mp: fix usb_root_clk parent https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.125 - [s390x] mm: use non-quiescing sske for KVM switch to keyed guest - zonefs: fix zonefs_iomap_begin() for reads - usb: gadget: u_ether: fix regression in setting fixed MAC address - tcp: add some entropy in __inet_hash_connect() - tcp: use different parts of the port_offset for index and offset (CVE-2022-1012) - tcp: add small random increments to the source port (CVE-2022-1012) - tcp: dynamically allocate the perturb table used by source ports (CVE-2022-1012) - tcp: increase source port perturb table to 2^16 (CVE-2022-1012, CVE-2022-32296) - tcp: drop the hash_32() part from the index calculation (CVE-2022-1012) - serial: core: Initialize rs485 RTS polarity already on probe - [arm64] mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer - io_uring: add missing item types for various requests https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.126 - io_uring: use separate list entry for iopoll requests https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.127 - vt: drop old FONT ioctls - random: schedule mix_interrupt_randomness() less often - random: quiet urandom warning ratelimit suppression message - ALSA: hda/via: Fix missing beep setup - ALSA: hda/conexant: Fix missing beep setup - ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop - ALSA: hda/realtek - ALC897 headset MIC no sound - ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly - ALSA: hda/realtek: Add quirk for Clevo PD70PNT - ALSA: hda/realtek: Add quirk for Clevo NS50PU - net: openvswitch: fix parsing of nw_proto for IPv6 fragments - btrfs: add error messages to all unrecognized mount options - mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing - [armhf] mtd: rawnand: gpmi: Fix setting busy timeout setting - ata: libata: add qc->flags in ata_qc_complete_template tracepoint - dm era: commit metadata in postsuspend after worker stops - dm mirror log: clear log bits up to BITS_PER_LONG boundary - USB: serial: option: add Telit LE910Cx 0x1250 composition - USB: serial: option: add Quectel EM05-G modem - USB: serial: option: add Quectel RM500K module support - [arm64] drm/msm: Fix double pm_runtime_disable() call - netfilter: nftables: add nft_parse_register_load() and use it - netfilter: nftables: add nft_parse_register_store() and use it - netfilter: use get_random_u32 instead of prandom - scsi: scsi_debug: Fix zone transition to full condition - [arm64] drm/msm: use for_each_sgtable_sg to iterate over scatterlist - bpf: Fix request_sock leak in sk lookup helpers - [arm64,armhf] drm/sun4i: Fix crash during suspend after component bind failure - [amd64] bpf, x86: Fix tail call count offset calculation on bpf2bpf call - phy: aquantia: Fix AN when higher speeds than 1G are not advertised - tipc: simplify the finalize work queue - tipc: fix use-after-free Read in tipc_named_reinit - igb: fix a use-after-free issue in igb_clean_tx_ring - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers - net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms - [arm64] drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf - [arm64] drm/msm/dp: check core_initialized before disable interrupts at dp_display_unbind() - [arm64] drm/msm/dp: fixes wrong connection state caused by failure of link train - [arm64] drm/msm/dp: deinitialize mainlink if link training failed - [arm64] drm/msm/dp: promote irq_hpd handle to handle link training correctly - [arm64] drm/msm/dp: fix connect/disconnect handled at irq_hpd - erspan: do not assume transport header is always set - x86/xen: Remove undefined behavior in setup_features() - afs: Fix dynamic root getattr - ice: ethtool: advertise 1000M speeds properly - regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips - igb: Make DMA faster when CPU is active on the PCIe link - virtio_net: fix xdp_rxq_info bug after suspend/resume - nvme: centralize setting the timeout in nvme_alloc_request - nvme: split nvme_alloc_request() - nvme: mark nvme_setup_passsthru() inline - nvme: don't check nvme_req flags for new req - nvme-pci: allocate nvme_command within driver pdu - nvme-pci: add NO APST quirk for Kioxia device - nvme: move the Samsung X5 quirk entry to the core quirks - [s390x] cpumf: Handle events cycles and instructions identical - iio: mma8452: fix probe fail when device tree compatible is used. - iio: adc: vf610: fix conversion mode sysfs node name - xhci: turn off port power in shutdown - xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI - xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI - [arm64,armhf] usb: chipidea: udc: check request status before setting device address - f2fs: attach inline_data after setting compression - iio:accel:bma180: rearrange iio trigger get and register - iio:accel:mxc4005: rearrange iio trigger get and register - iio: accel: mma8452: ignore the return value of reset operation - iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up() - iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value) - iio: adc: axp288: Override TS pin bias current for some models - iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client - [powerpc*] Enable execve syscall exit tracepoint - [powerpc*] rtas: Allow ibm,platform-dump RTAS call with null buffer address - [powerpc*] powernv: wire up rng during setup_arch - [armhf] exynos: Fix refcount leak in exynos_map_pmu - modpost: fix section mismatch check for exported init/exit sections - random: update comment from copy_to_user() -> copy_to_iter() - [powerpc*] pseries: wire up rng during setup_arch() [ Salvatore Bonaccorso ] * [rt] Update to 5.10.120-rt70 * [rt] Drop "crypto: cryptd - add a lock instead preempt_disable/local_bh_disable" patch * Bump ABI to 16 [ Ben Hutchings ] * random: Enable RANDOM_TRUST_BOOTLOADER. This can be reverted using the kernel parameter: random.trust_bootloader=off * [armel,armhf] crypto: Enable optimised implementations (see #922204): - Enable CRYPTO_SHA256_ARM, CRYPTO_SHA512_ARM as modules - [armhf] Enable SHA1_ARM_NEON, CRYPTO_SHA1_ARM_CE, CRYPTO_SHA2_ARM_CE, CRYPTO_AES_ARM_BS, CRYPTO_AES_ARM_CE, CRYPTO_GHASH_ARM_CE, CRYPTO_CRCT10DIF_ARM_CE, CRYPTO_CRC32_ARM_CE as modules -- Salvatore Bonaccorso Thu, 30 Jun 2022 21:31:30 +0200 linux (5.10.120-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.114 - USB: quirks: add a Realtek card reader - USB: quirks: add STRING quirk for VCOM device - USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS - USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader - USB: serial: option: add support for Cinterion MV32-WA/MV32-WB - USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions - xhci: Enable runtime PM on second Alderlake controller - xhci: stop polling roothubs after shutdown - xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms - iio: dac: ad5592r: Fix the missing return value. - iio: dac: ad5446: Fix read_raw not returning set value - iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on() - iio: imu: inv_icm42600: Fix I2C init possible nack - usb: misc: fix improper handling of refcount in uss720_probe() - [arm64,x86] usb: typec: ucsi: Fix reuse of completion structure - [arm64,x86] usb: typec: ucsi: Fix role swapping - usb: gadget: uvc: Fix crash when encoding data for usb request - usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() - [arm64,armhf] usb: dwc3: Try usb-role-switch first in dwc3_drd_init - [arm64,armhf] usb: dwc3: core: Fix tx/rx threshold settings - [arm64,armhf] usb: dwc3: core: Only handle soft-reset in DCTL - [arm64,armhf] usb: dwc3: gadget: Return proper request status - [arm*] usb: phy: generic: Get the vbus supply - [arm64,armhf] serial: imx: fix overrun interrupts in DMA mode - serial: 8250: Also set sticky MCR bits in console restoration - serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device - [arm64,armhf] arch_topology: Do not set llc_sibling if llc_id is invalid - hex2bin: make the function hex_to_bin constant-time - hex2bin: fix access beyond string end - iocost: don't reset the inuse weight of under-weighted debtors - video: fbdev: udlfb: properly check endpoint type - iio:imu:bmi160: disable regulator in error path - USB: Fix xhci event ring dequeue pointer ERDP update issue - [armhf] phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe - [armhf] phy: samsung: exynos5250-sata: fix missing device put in probe error paths - [armhf] OMAP2+: Fix refcount leak in omap_gic_of_init - [armhf] bus: ti-sysc: Make omap3 gpt12 quirk handling SoC specific - [armhf] phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks - [armhf] dts: am3517-evm: Fix misc pinmuxing - [armhf] dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35 - ipvs: correctly print the memory size of ip_vs_conn_tab - [armhf] pinctrl: stm32: Do not call stm32_gpio_get() for edge triggered IRQs in EOI - [arm64,armhf] net: dsa: Add missing of_node_put() in dsa_port_link_register_of - netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion - bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook - [arm64,armhf] pinctrl: rockchip: fix RK3308 pinmux bits - tcp: md5: incorrect tcp_header_len for incoming connections - [armhf] pinctrl: stm32: Keep pinctrl block clock enabled when LEVEL IRQ requested - tcp: ensure to use the most recently sent skb when filling the rate sample - wireguard: device: check for metadata_dst with skb_valid_dst() - sctp: check asoc strreset_chunk in sctp_generate_reconf_event - [arm64] dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock - [arm64] net: hns3: modify the return code of hclge_get_ring_chain_from_mbx - [arm64] net: hns3: add validity check for message data length - [arm64] net: hns3: add return value for mailbox handling in PF - net/smc: sync err code when tcp connection was refused - ip_gre: Make o_seqno start from 0 in native mode - ip6_gre: Make o_seqno start from 0 in native mode - ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode - tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT - tcp: make sure treq->af_specific is initialized - [arm64,armhf] bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create() - [arm64,armhf] clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource() - [arm64] net: bcmgenet: hide status block before TX timestamping - net: phy: marvell10g: fix return value on error - bnx2x: fix napi API usage sequence - [arm64,armhf] net: fec: add missing of_node_put() in fec_enet_init_stop_mode() - ixgbe: ensure IPsec VF<->PF compatibility - tcp: fix F-RTO may not work correctly when receiving DSACK - [x86] ASoC: Intel: soc-acpi: correct device endpoints for max98373 - ext4: fix bug_on in start_this_handle during umount filesystem - [amd64] x86: __memcpy_flushcache: fix wrong alignment if size > 2^32 - cifs: destage any unwritten data to the server before calling copychunk_write - [x86] drivers: net: hippi: Fix deadlock in rr_close() - zonefs: Fix management of open zones - zonefs: Clear inode information flags on inode creation - [x86] drm/i915: Fix SEL_FETCH_PLANE_*(PIPE_B+) register addresses - [armhf] net: ethernet: stmmac: fix write to sgmii_adapter_base - [x86] thermal: int340x: Fix attr.show callback prototype - [x86] cpu: Load microcode during restore_processor_state() - tty: n_gsm: fix restart handling via CLD command - tty: n_gsm: fix decoupled mux resource - tty: n_gsm: fix mux cleanup after unregister tty device - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 - tty: n_gsm: fix malformed counter for out of frame data - netfilter: nft_socket: only do sk lookups when indev is available - tty: n_gsm: fix insufficient txframe size - tty: n_gsm: fix wrong DLCI release order - tty: n_gsm: fix missing explicit ldisc flush - tty: n_gsm: fix wrong command retry handling - tty: n_gsm: fix wrong command frame length field encoding - tty: n_gsm: fix reset fifo race condition - tty: n_gsm: fix incorrect UA handling - tty: n_gsm: fix software flow control handling https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.115 - [mips*] Fix CP0 counter erratum detection for R4k CPUs - ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers - ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes - [arm64] mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC - mmc: core: Set HS clock speed before sending HS CMD13 - gpiolib: of: fix bounds check for 'gpio-reserved-ranges' - [x86] KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id - [amd64] iommu/vt-d: Calculate mask for non-aligned flushes - Revert "SUNRPC: attempt AF_LOCAL connect on setup" - firewire: fix potential uaf in outbound_phy_packet_callback() - firewire: remove check of list iterator against head past the loop body - firewire: core: extend card->lock in fw_core_handle_bus_reset - net: stmmac: disable Split Header (SPH) for Intel platforms - genirq: Synchronize interrupt thread startup - ASoC: da7219: Fix change notifications for tone generator frequency - [s390x] dasd: fix data corruption for ESE devices - [s390x] dasd: prevent double format of tracks for ESE devices - [s390x] dasd: Fix read for ESE with blksize < 4k - [s390x] dasd: Fix read inconsistency for ESE DASD devices - can: isotp: remove re-binding of bound socket - nfc: replace improper check device_is_registered() in netlink related functions (CVE-2022-1974) - NFC: netlink: fix sleep in atomic bug when firmware download timeout (CVE-2022-1975) - [arm64,armhf] gpio: pca953x: fix irq_stat not updated when irq is disabled (irq_mask not set) - hwmon: (adt7470) Fix warning on module removal - [arm*] ASoC: dmaengine: Restore NULL prepare_slave_config() callback - net/mlx5e: Fix trust state reset in reload - net/mlx5e: Don't match double-vlan packets if cvlan is not set - net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release - net/mlx5e: Fix the calling of update_buffer_lossy() API - net/mlx5: Avoid double clear or set of sync reset requested - NFSv4: Don't invalidate inode attributes on delegation return - [arm64,armhf] net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux() - [armhf] net: cpsw: add missing of_node_put() in cpsw_probe_dt() - hinic: fix bug of wq out of bound access - bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag - bnxt_en: Fix unnecessary dropping of RX packets - [arm64,armhf] smsc911x: allow using IRQ0 - btrfs: always log symlinks in full mode - net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() - [x86] kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU - net/mlx5: Fix slab-out-of-bounds while reading resource dump menu - [x86] kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume - [x86] KVM: x86: Do not change ICR on write to APIC_SELF_IPI - [x86] KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs - [x86] KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised - rcu: Fix callbacks processing time limit retaining cond_resched() - rcu: Apply callbacks processing time limit only on softirq - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern (CVE-2022-0494) - dm: interlock pending dm_io and dm_wait_for_bios_completion - [arm64] PCI: aardvark: Clear all MSIs at setup - [arm64] PCI: aardvark: Fix reading MSI interrupt number - mmc: rtsx: add 74 Clocks in power on flow https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.116 - regulator: consumer: Add missing stubs to regulator/consumer.h - block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit - nfp: bpf: silence bitwise vs. logical OR warning - Bluetooth: Fix the creation of hdev->name - mm: fix missing cache flush for all tail pages of compound page - mm: hugetlb: fix missing cache flush in copy_huge_page_from_user() - mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.117 - batman-adv: Don't skb_split skbuffs with frag_list - iwlwifi: iwl-dbg: Use del_timer_sync() before freeing - hwmon: (tmp401) Add OF device ID table - mac80211: Reset MBSSID parameters upon connection - net: Fix features skip in for_each_netdev_feature() - [arm64] net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted - [arm64] net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups - [arm64] net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0 - [arm64] net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters - ipv4: drop dst in multicast routing path - drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name() - netlink: do not reset transport header in netlink_recvmsg() - sfc: Use swap() instead of open coding it - net: sfc: fix memory leak due to ptp channel - mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection - nfs: fix broken handling of the softreval mount option - dim: initialize all struct fields - [s390x] ctcm: fix variable dereferenced before check - [s390x] ctcm: fix potential memory leak - [s390x] lcs: fix variable dereferenced before check - net/sched: act_pedit: really ensure the skb is writable - [arm64] net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral - [armhf] net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down() - net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending - net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe() - gfs2: Fix filesystem block deallocation for short writes - hwmon: (f71882fg) Fix negative temperature - ASoC: max98090: Reject invalid values in custom control put() - ASoC: max98090: Generate notifications on changes for custom control - ASoC: ops: Validate input values in snd_soc_put_volsw_range() - net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT - tcp: resalt the secret every 10 seconds (CVE-2022-1012) - firmware_loader: use kernel credentials when reading firmware - tty: n_gsm: fix mux activation issues in gsm_config() - usb: cdc-wdm: fix reading stuck on device close - USB: serial: pl2303: add device id for HP LM930 Display - USB: serial: qcserial: add support for Sierra Wireless EM7590 - USB: serial: option: add Fibocom L610 modem - USB: serial: option: add Fibocom MA510 modem - ceph: fix setting of xattrs on async created inodes - drm/nouveau/tegra: Stop using iommu_present() - i40e: i40e_main: fix a missing check on list iterator - [amd64,arm64] net: atlantic: always deep reset on pm op, fixing up my null deref regression - cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() - [x86] drm/vmwgfx: Initialize drm_mode_fb_cmd2 - SUNRPC: Clean up scheduling of autoclose - SUNRPC: Prevent immediate close+reconnect - SUNRPC: Don't call connect() more than once on a TCP socket - SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() (CVE-2022-28893) - net: phy: Fix race condition on link status change - [arm*] arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map - ping: fix address binding wrt vrf - usb: gadget: uvc: rename function to be more consistent - usb: gadget: uvc: allow for application to cleanly shutdown - io_uring: always use original task when preparing req identity (CVE-2022-1786) https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.118 - io_uring: always grab file table for deferred statx - floppy: use a statically allocated error counter - [x86] Revert "drm/i915/opregion: check port number bounds for SWSCI display power state" - igc: Remove _I_PHY_ID checking - igc: Remove phy->type checking - igc: Update I226_K device ID - rtc: fix use-after-free on device removal - [arm64] rtc: pcf2127: fix bug when reading alarm registers - Input: add bounds checking to input_set_capability() - nvme-pci: add quirks for Samsung X5 SSDs - gfs2: Disable page faults during lockless buffered reads - [arm64,armhf] rtc: sun6i: Fix time overflow handling - [armhf] crypto: stm32 - fix reference leak in stm32_crc_remove - [amd64] crypto: x86/chacha20 - Avoid spurious jumps to other functions - ALSA: hda/realtek: Enable headset mic on Lenovo P360 - [s390x] pci: improve zpci_dev reference counting - nvme-multipath: fix hang when disk goes live over reconnect - rtc: mc146818-lib: Fix the AltCentury for AMD platforms - fs: fix an infinite loop in iomap_fiemap - drbd: remove usage of list iterator variable after loop - [arm64] platform/chrome: cros_ec_debugfs: detach log reader wq from devm - [armel,armhf] 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() - nilfs2: fix lockdep warnings in page operations for btree nodes - nilfs2: fix lockdep warnings during disk space reclamation - Revert "swiotlb: fix info leak with DMA_FROM_DEVICE" - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE"" (CVE-2022-0854) - ALSA: usb-audio: Restore Rane SL-1 quirk - [i386] ALSA: wavefront: Proper check of get_user() error - ALSA: hda/realtek: Add quirk for TongFang devices with pop noise - perf: Fix sys_perf_event_open() race against self (CVE-2022-1729) - selinux: fix bad cleanup on error in hashtab_duplicate() - Fix double fget() in vhost_net_set_backend() - PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold - [x86] KVM: x86/mmu: Update number of zapped pages even if page list is stable - [arm64] paravirt: Use RCU read locks to guard stolen_time - [arm64] mte: Ensure the cleared tags are visible before setting the PTE - [arm64] crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ - libceph: fix potential use-after-free on linger ping and resends - drm/dp/mst: fix a possible memory leak in fetch_monitor_name() - dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace - [armhf] pinctrl: pinctrl-aspeed-g6: remove FWQSPID group in pinctrl - [arm64] net: macb: Increment rx bd head after allocating skb and buffer - net: evaluate net.ipvX.conf.all.disable_policy and disable_xfrm - xfrm: Add possibility to set the default to block if we have no policy - net: xfrm: fix shift-out-of-bounce - xfrm: make user policy API complete - xfrm: notify default policy on update - xfrm: fix dflt policy check when there is no policy configured - xfrm: rework default policy structure - xfrm: fix "disable_policy" flag use when arriving from different devices - net/sched: act_pedit: sanitize shift argument before usage - [x86] net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() - [x86] net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() - ice: fix possible under reporting of ethtool Tx and Rx statistics - net/qla3xxx: Fix a test in ql_reset_work() - net/mlx5e: Properly block LRO when XDP is enabled - net: af_key: add check for pfkey_broadcast in function pfkey_process - [armhf] 9196/1: spectre-bhb: enable for Cortex-A15 - [armel,armhf] 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 - igb: skip phy status check where unavailable - net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. - [arm*] gpio: mvebu/pwm: Refuse requests with inverted polarity - scsi: qla2xxx: Fix missed DMA unmap for aborted commands - mac80211: fix rx reordering with non explicit / psmp ack policy - nl80211: validate S1G channel width - nl80211: fix locking in nl80211_set_tx_bitrate_mask() - ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one() - [amd64,arm64] net: atlantic: fix "frag[0] not initialized" - [amd64,arm64] net: atlantic: reduce scope of is_rsc_complete - [amd64,arm64] net: atlantic: add check for MAX_SKB_FRAGS - [amd64,arm64] net: atlantic: verify hw_head_ lies within TX buffer ring - [arm64] Enable repeat tlbi workaround on KRYO4XX gold CPUs - dt-bindings: pinctrl: aspeed-g6: remove FWQSPID group - afs: Fix afs_getattr() to refetch file status if callback break occurred - include/uapi/linux/xfrm.h: Fix XFRM_MSG_MAPPING ABI breakage https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.119 - lockdown: also lock down previous kgdb use (CVE-2022-21499) - staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan() - [x86] KVM: x86: Properly handle APF vs disabled LAPIC situation - [x86] KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID (CVE-2022-1789) - tcp: change source port randomizarion at connect() time - secure_seq: use the 64 bits of the siphash for port offset calculation (CVE-2022-1012) - ACPI: sysfs: Make sparse happy about address space in use - ACPI: sysfs: Fix BERT error region memory mapping - random: avoid arch_get_random_seed_long() when collecting IRQ randomness - random: remove dead code left over from blocking pool - MAINTAINERS: co-maintain random.c - MAINTAINERS: add git tree for random.c - crypto: lib/blake2s - Move selftest prototype into header file - crypto: blake2s - define shash_alg structs using macros - [amd64] crypto: x86/blake2s - define shash_alg structs using macros - crypto: blake2s - remove unneeded includes - crypto: blake2s - move update and final logic to internal/blake2s.h - crypto: blake2s - share the "shash" API boilerplate code - crypto: blake2s - optimize blake2s initialization - crypto: blake2s - add comment for blake2s_state fields - crypto: blake2s - adjust include guard naming - crypto: blake2s - include instead of - lib/crypto: blake2s: include as built-in - lib/crypto: blake2s: move hmac construction into wireguard - lib/crypto: sha1: re-roll loops to reduce code size - lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFI - random: document add_hwgenerator_randomness() with other input functions - random: remove unused irq_flags argument from add_interrupt_randomness() - random: use BLAKE2s instead of SHA1 in extraction - random: do not sign extend bytes for rotation when mixing - random: do not re-init if crng_reseed completes before primary init - random: mix bootloader randomness into pool - random: harmonize "crng init done" messages - random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs - random: early initialization of ChaCha constants - random: avoid superfluous call to RDRAND in CRNG extraction - random: don't reset crng_init_cnt on urandom_read() - random: fix typo in comments - random: cleanup poolinfo abstraction - random: cleanup integer types - random: remove incomplete last_data logic - random: remove unused extract_entropy() reserved argument - random: rather than entropy_store abstraction, use global - random: remove unused OUTPUT_POOL constants - random: de-duplicate INPUT_POOL constants - random: prepend remaining pool constants with POOL_ - random: cleanup fractional entropy shift constants - random: access input_pool_data directly rather than through pointer - random: selectively clang-format where it makes sense - random: simplify arithmetic function flow in account() - random: continually use hwgenerator randomness - random: access primary_pool directly rather than through pointer - random: only call crng_finalize_init() for primary_crng - random: use computational hash for entropy extraction - random: simplify entropy debiting - random: use linear min-entropy accumulation crediting - random: always wake up entropy writers after extraction - random: make credit_entropy_bits() always safe - random: remove use_input_pool parameter from crng_reseed() - random: remove batched entropy locking - random: fix locking in crng_fast_load() - random: use RDSEED instead of RDRAND in entropy extraction - random: get rid of secondary crngs - random: inline leaves of rand_initialize() - random: ensure early RDSEED goes through mixer on init - random: do not xor RDRAND when writing into /dev/random - random: absorb fast pool into input pool after fast load - random: use simpler fast key erasure flow on per-cpu keys - random: use hash function for crng_slow_load() - random: make more consistent use of integer types - random: remove outdated INT_MAX >> 6 check in urandom_read() - random: zero buffer after reading entropy from userspace - random: fix locking for crng_init in crng_reseed() - random: tie batched entropy generation to base_crng generation - random: remove ifdef'd out interrupt bench - random: remove unused tracepoints - random: add proper SPDX header - random: deobfuscate irq u32/u64 contributions - random: introduce drain_entropy() helper to declutter crng_reseed() - random: remove useless header comment - random: remove whitespace and reorder includes - random: group initialization wait functions - random: group crng functions - random: group entropy extraction functions - random: group entropy collection functions - random: group userspace read/write functions - random: group sysctl functions - random: rewrite header introductory comment - random: defer fast pool mixing to worker - random: do not take pool spinlock at boot - random: unify early init crng load accounting - random: check for crng_init == 0 in add_device_randomness() - random: pull add_hwgenerator_randomness() declaration into random.h - random: clear fast pool, crng, and batches in cpuhp bring up - random: round-robin registers as ulong, not u32 - random: only wake up writers after zap if threshold was passed - random: cleanup UUID handling - random: unify cycles_t and jiffies usage and types - random: do crng pre-init loading in worker rather than irq - random: give sysctl_random_min_urandom_seed a more sensible value - random: don't let 644 read-only sysctls be written to - random: replace custom notifier chain with standard one - random: use SipHash as interrupt entropy accumulator - random: make consistent usage of crng_ready() - random: reseed more often immediately after booting - random: check for signal and try earlier when generating entropy - random: skip fast_init if hwrng provides large chunk of entropy - random: treat bootloader trust toggle the same way as cpu trust toggle - random: re-add removed comment about get_random_{u32,u64} reseeding - random: mix build-time latent entropy into pool at init - random: do not split fast init input in add_hwgenerator_randomness() - random: do not allow user to keep crng key around on stack - random: check for signal_pending() outside of need_resched() check - random: check for signals every PAGE_SIZE chunk of /dev/[u]random - random: allow partial reads if later user copies fail - random: make random_get_entropy() return an unsigned long - random: document crng_fast_key_erasure() destination possibility - random: fix sysctl documentation nits - init: call time_init() before rand_initialize() - [s390x] define get_cycles macro for arch-override - [powerpc*] define get_cycles macro for arch-override - timekeeping: Add raw clock fallback for random_get_entropy() - [mips*] use fallback for random_get_entropy() instead of just c0 random - [arm*] use fallback for random_get_entropy() instead of zero - [x86] tsc: Use fallback for random_get_entropy() instead of zero - random: insist on random_get_entropy() existing in order to simplify - random: do not use batches when !crng_ready() - random: use first 128 bits of input as fast init - random: do not pretend to handle premature next security model - random: order timer entropy functions below interrupt functions - random: do not use input pool from hard IRQs - random: help compiler out with fast_mix() by using simpler arguments - siphash: use one source of truth for siphash permutations - random: use symbolic constants for crng_init states - random: avoid initializing twice in credit race - random: move initialization out of reseeding hot path - random: remove ratelimiting for in-kernel unseeded randomness - random: use proper jiffies comparison macro - random: handle latent entropy and command line from random_init() - random: credit architectural init the exact amount - random: use static branch for crng_ready() - random: remove extern from functions in header - random: use proper return types on get_random_{int,long}_wait() - random: make consistent use of buf and len - random: move initialization functions out of hot pages - random: move randomize_page() into mm where it belongs - random: unify batched entropy implementations - random: convert to using fops->read_iter() - random: convert to using fops->write_iter() - random: wire up fops->splice_{read,write}_iter() - random: check for signals after page of pool writes - ALSA: ctxfi: Add SB046x PCI ID https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.120 - percpu_ref_init(): clean ->percpu_count_ref on failure - net: af_key: check encryption module availability consistency - nfc: pn533: Fix buggy cleanup order - [armhf] net: ftgmac100: Disable hardware checksum on AST2600 - [x86] i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging - [arm64] drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers - netfilter: nf_tables: disallow non-stateful expression in sets earlier (CVE-2022-1966) - pipe: make poll_usage boolean and annotate its access - pipe: Fix missing lock in pipe_resize_ring() (ZDI-CAN-17291) - cfg80211: set custom regdomain after wiphy registration - assoc_array: Fix BUG_ON during garbage collect - io_uring: don't re-import iovecs from callbacks - io_uring: fix using under-expanded iters - xfs: detect overflows in bmbt records - xfs: show the proper user quota options - xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks - xfs: fix an ABBA deadlock in xfs_rename - xfs: Fix CIL throttle hang when CIL space used going backwards - exfat: check if cluster num is valid - crypto: drbg - prepare for more fine-grained tracking of seeding state - crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() - crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed() - crypto: drbg - make reseeding from get_random_bytes() synchronous - netfilter: nf_tables: sanitize nft_set_desc_concat_parse() (CVE-2022-1972) - netfilter: conntrack: re-fetch conntrack after insertion - [x86] kvm: Alloc dummy async #PF token outside of raw spinlock - [x86] kvm: use correct GFP flags for preemption disabled - [x86] KVM: x86: avoid calling x86 emulator without a decoded instruction (CVE-2022-1852) - [arm64] crypto: caam - fix i.MX6SX entropy delay value - crypto: ecrdsa - Fix incorrect use of vli_cmp - zsmalloc: fix races between asynchronous zspage free and page migration - Bluetooth: hci_qca: Use del_timer_sync() before freeing - dm integrity: fix error code in dm_integrity_ctr() - dm crypt: make printing of the key constant-time - dm stats: add cond_resched when looping over entries - dm verity: set DM_TARGET_IMMUTABLE feature flag - raid5: introduce MD_BROKEN - HID: multitouch: Add support for Google Whiskers Touchpad - HID: multitouch: add quirks to enable Lenovo X12 trackpoint - tpm: Fix buffer access in tpm2_get_tpm_pt() - docs: submitting-patches: Fix crossref to 'The canonical patch format' - NFS: Memory allocation failures are not server fatal errors - NFSD: Fix possible sleep during nfsd4_release_lockowner() - bpf: Fix potential array overflow in bpf_trampoline_get_progs() - bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes [ Salvatore Bonaccorso ] * [rt] Update to 5.10.115-rt67 * Bump ABI to 15 * [rt] Drop "random: Make it work on rt" [ Mateusz Łukasik ] * [armhf] drivers/thermal: Enable SUN8I_THERMAL as module (Closes: #1007799) -- Salvatore Bonaccorso Thu, 09 Jun 2022 23:37:36 +0200 linux (5.10.113-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.107 - Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" (Closes: #1008299) - xfrm: Check if_id in xfrm_migrate - xfrm: Fix xfrm migrate issues when address family changes - mac80211: refuse aggregations sessions before authorized - [mips64el,mipsel] smp: fill in sibling and core maps earlier - [x86] atm: firestream: check the return value of ioremap() in fs_init() - iwlwifi: don't advertise TWT support - drm/vrr: Set VRR capable prop only if it is attached to connector - nl80211: Update bss channel on channel switch for P2P_CLIENT - sfc: extend the locking on mcdi->seqno https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.108 - [arm64] crypto: qcom-rng - ensure buffer for generate is completely filled - ocfs2: fix crash when initialize filecheck kobj fails - mm: swap: get rid of livelock in swapin readahead - efi: fix return value of __setup handlers - vsock: each transport cycles only on its own sockets - esp6: fix check on ipv6_skip_exthdr's return value - net: phy: marvell: Fix invalid comparison in the resume and suspend functions - net/packet: fix slab-out-of-bounds access in packet_recvmsg() - atm: eni: Add check for dma_map_single - [x86] hv_netvsc: Add check for kvmalloc_array - [armhf] drm/imx: parallel-display: Remove bus flags check in imx_pd_bridge_atomic_check() - [arm64,armhf] drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings - net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() - [arm64,armhf] net: dsa: Add missing of_node_put() in dsa_port_parse_of - net: phy: mscc: Add MODULE_FIRMWARE macros - bnx2x: fix built-in kernel driver load failure - [arm64] net: bcmgenet: skip invalid partial checksums - [arm64] net: mscc: ocelot: fix backwards compatibility with single-chain tc-flower offload - usb: gadget: rndis: prevent integer overflow in rndis_set_response() - usb: gadget: Fix use-after-free bug by not setting udc->dev.driver - usb: usbtmc: Fix bug in pipe direction for control transfers - scsi: mpt3sas: Page fault in reply q processing - Input: aiptek - properly check endpoint type - perf symbols: Fix symbol size calculation condition - net: usb: Correct PHY handling of smsc95xx - net: usb: Correct reset handling of smsc95xx - smsc95xx: Ignore -ENODEV errors when device is unplugged - esp: Fix possible buffer overflow in ESP transformation (CVE-2022-27666) https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.109 - nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION (CVE-2022-26490) - net: ipv6: fix skb_over_panic in __ip6_append_data - exfat: avoid incorrectly releasing for root inode - cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv (CVE-2021-4197) - cgroup: Use open-time cgroup namespace for process migration perm checks (CVE-2021-4197) - cgroup-v1: Correct privileges check in release_agent writes - tpm: Fix error handling in async work - llc: fix netdevice reference leaks in llc_ui_bind() (CVE-2022-28356) - ALSA: oss: Fix PCM OSS buffer allocation overflow - ALSA: hda/realtek: Add quirk for Clevo NP70PNJ - ALSA: hda/realtek: Add quirk for Clevo NP50PNJ - ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 - ALSA: hda/realtek: Add quirk for ASUS GA402 - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls (CVE-2022-1048) - ALSA: pcm: Fix races among concurrent read/write and buffer changes (CVE-2022-1048) - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls (CVE-2022-1048) - ALSA: pcm: Fix races among concurrent prealloc proc writes (CVE-2022-1048) - ALSA: pcm: Add stream lock during PCM reset ioctl operations - ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB - ALSA: cmipci: Restore aux vol on suspend/resume - ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec - [arm64] drivers: net: xgene: Fix regression in CRC stripping - netfilter: nf_tables: initialize registers in nft_do_chain() (CVE-2022-1016) - [x86] ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board - ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 - [x86] ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU - [x86] crypto: qat - disable registration of algorithms - Revert "ath: add support for special 0x0 regulatory domain" - rcu: Don't deboost before reporting expedited quiescent state - mac80211: fix potential double free on mesh join - tpm: use try_get_ops() in tpm-space.c - [arm64] wcn36xx: Differentiate wcn3660 from wcn3620 - llc: only change llc->dev when bind() succeeds https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.110 - swiotlb: fix info leak with DMA_FROM_DEVICE (CVE-2022-0854) - USB: serial: pl2303: add IBM device IDs - USB: serial: simple: add Nokia phone driver - netdevice: add the case if dev is NULL - HID: logitech-dj: add new lightspeed receiver id - xfrm: fix tunnel model fragmentation behavior - virtio_console: break out of buf poll on remove - ethernet: sun: Free the coherent when failing in probing - gpio: Revert regression in sysfs-gpio (gpiolib.c) - spi: Fix invalid sgs value - Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" - spi: Fix erroneous sgs value with min_t() - af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register (CVE-2022-1353) - [arm*] iommu/iova: Improve 32-bit free space estimate - tpm: fix reference counting for struct tpm_chip - virtio-blk: Use blk_validate_block_size() to validate block size - USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c - xhci: fix garbage USBSTS being logged in some cases - xhci: fix runtime PM imbalance in USB2 resume - xhci: make xhci_handshake timeout for xhci_reset() adjustable - xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() - [x86] mei: me: add Alder Lake N device id. - [x86] mei: avoid iterator usage outside of list_for_each_entry - iio: inkern: apply consumer scale on IIO_VAL_INT cases - iio: inkern: apply consumer scale when no channel scale is available - iio: inkern: make a best effort on offset calculation - ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE - KEYS: fix length validation in keyctl_pkey_params_get_2() - Documentation: add link to stable release candidate tree - Documentation: update stable tree link - firmware: stratix10-svc: add missing callback parameter on RSU - SUNRPC: avoid race between mod_timer() and del_timer_sync() - NFSD: prevent underflow in nfssvc_decode_writeargs() - NFSD: prevent integer overflow on 32 bit systems - f2fs: fix to unlock page correctly in error path of is_alive() - f2fs: quota: fix loop condition at f2fs_quota_sync() - f2fs: fix to do sanity check on .cp_pack_total_block_count - [armhf] remoteproc: Fix count check in rproc_coredump_write() - [armhf] pinctrl: samsung: drop pin banks references on error paths - mtd: rawnand: protect access to rawnand devices while in suspend - can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path (CVE-2022-28390) - jffs2: fix use-after-free in jffs2_clear_xattr_subsystem - jffs2: fix memory leak in jffs2_do_mount_fs - jffs2: fix memory leak in jffs2_scan_medium - mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node - mm: invalidate hwpoison page cache page in fault path - mempolicy: mbind_range() set_policy() after vma_merge() - scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands - qed: display VF trust config - qed: validate and restrict untrusted VFs vlan promisc mode - Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" - cifs: prevent bad output lengths in smb2_ioctl_query_info() - cifs: fix NULL ptr dereference in smb2_ioctl_query_info() (CVE-2022-0168) - [i386] ALSA: cs4236: fix an incorrect NULL check on list iterator - ALSA: hda: Avoid unsol event during RPM suspending - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock - ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 - mm: madvise: skip unmapped vma holes passed to process_madvise - mm: madvise: return correct bytes advised with process_madvise - Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" - mm,hwpoison: unmap poisoned page before invalidation - dm integrity: set journal entry unused when shrinking device - drbd: fix potential silent data corruption - can: isotp: sanitize CAN ID checks in isotp_bind() - [powerpc*] kvm: Fix kvm_use_magic_page - udp: call udp_encap_enable for v6 sockets when enabling encap - [arm64] signal: nofpsimd: Do not allocate fp/simd context when not available - ACPI: properties: Consistently return -ENOENT if there are no more references - coredump: Also dump first pages of non-executable ELF libraries - ext4: fix ext4_fc_stats trace point - ext4: fix fs corruption when tring to remove a non-empty directory with IO error - drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() (CVE-2022-1198) - block: limit request dispatch loop duration - block: don't merge across cgroup boundaries if blkcg is enabled - drm/edid: check basic audio support on CEA extension block - [armhf] dts: exynos: add missing HDMI supplies on SMDK5250 - [armhf] dts: exynos: add missing HDMI supplies on SMDK5420 - [x86] mgag200 fix memmapsl configuration in GCTL6 register - carl9170: fix missing bit-wise or operator for tx_params - pstore: Don't use semaphores in always-atomic-context code - [x86] thermal: int340x: Increase bitmap size - exec: Force single empty string when argv is empty - crypto: rsa-pkcs1pad - only allow with rsa - crypto: rsa-pkcs1pad - correctly get hash from source scatterlist - crypto: rsa-pkcs1pad - restore signature length check - crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() - bcache: fixup multiple threads crash - DEC: Limit PMAX memory probing to R3k systems - brcmfmac: firmware: Allocate space for default boardrev in nvram - brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path - brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio - brcmfmac: pcie: Fix crashes due to early IRQs - [x86] drm/i915/opregion: check port number bounds for SWSCI display power state - [x86] drm/i915/gem: add missing boundary check in vm_access - PCI: pciehp: Clear cmd_busy bit in polling mode - [arm64] PCI: xgene: Revert "PCI: xgene: Fix IB window setup" - [arm64] regulator: qcom_smd: fix for_each_child.cocci warnings - selinux: check return value of sel_make_avc_files - [arm64] hwrng: cavium - Check health status while reading random data - [arm64] hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER - crypto: authenc - Fix sleep in atomic context in decrypt_tail - [x86] thermal: int340x: Check for NULL after calling kmemdup() - [arm64,armhf] spi: tegra114: Add missing IRQ check in tegra_spi_probe - [arm64] mm: avoid fixmap race condition when create pud mapping - audit: log AUDIT_TIME_* records only from rules - spi: pxa2xx-pci: Balance reference count for PCI DMA device - [armhf] hwmon: (pmbus) Add mutex to regulator ops - hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING - nvme: cleanup __nvme_check_ids - block: don't delete queue kobject before its children - PM: hibernate: fix __setup handler error handling - PM: suspend: fix return value of __setup handler - [arm64] crypto: sun8i-ce - call finalize with bh disabled - [arm64,armhf] crypto: amlogic - call finalize with bh disabled - [armhf] clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix - [armhf] clocksource/drivers/exynos_mct: Refactor resources allocation - [armhf] clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts - clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() - ACPI: APEI: fix return value of __setup handlers - [x86] crypto: ccp - ccp_dmaengine_unregister release dma channels - [arm*] amba: Make the remove callback return void - [armhf] hwmon: (pmbus) Add Vin unit off handling - [x86] clocksource: acpi_pm: fix return value of __setup handler - io_uring: terminate manual loop iterator loop correctly for non-vecs - watch_queue: Fix NULL dereference in error cleanup - watch_queue: Actually free the watch - f2fs: fix to enable ATGC correctly via gc_idle sysfs interface - sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa - sched/core: Export pelt_thermal_tp - rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() - rseq: Remove broken uapi field layout on 32-bit little endian - perf/core: Fix address filter parser for multiple filters - [x86] perf/x86/intel/pt: Fix address filter config for 32-bit kernel - f2fs: fix missing free nid in f2fs_handle_failed_inode - nfsd: more robust allocation failure handling in nfsd_file_cache_init - f2fs: fix to avoid potential deadlock - btrfs: fix unexpected error path when reflinking an inline extent - f2fs: compress: remove unneeded read when rewrite whole cluster - f2fs: fix compressed file start atomic write may cause data corruption - [arm64,armhf] media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls - media: bttv: fix WARNING regression on tunerless devices - [arm*] ASoC: generic: simple-card-utils: remove useless assignment - [armhf] media: coda: Fix missing put_device() call in coda_get_vdoa_data - [armhf] media: aspeed: Correct value for h-total-pixels - video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen - video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() - video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() - [arm64] firmware: qcom: scm: Remove reassignment to desc following initializer - firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined - [armhf] dts: imx: Add missing LVDS decoder on M53Menlo - media: em28xx: initialize refcount before kref_get - media: usb: go7007: s2250-board: fix leak in probe() - [arm64,armhf] media: cedrus: H265: Fix neighbour info buffer size - [arm64,armhf] media: cedrus: h264: Fix neighbour info buffer size - [x86] ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() - printk: fix return value of printk.devkmsg __setup handler - [x86] ASoC: soc-compress: prevent the potentially use of null pointer - [armhf] memory: emif: Add check for setup_interrupts - [armhf] memory: emif: check the pointer temp in get_device_details() - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction - [arm64] dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly - media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED - media: saa7134: convert list_for_each to entry variant - media: saa7134: fix incorrect use to determine if list is empty - ivtv: fix incorrect device_caps for ivtvfb - [arm64,armhf] ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() - [arm64,armhf] ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe - ASoC: dmaengine: do not use a NULL prepare_slave_config() callback - [armhf] ASoC: fsl_spdif: Disable TX clock when stop - [armhf] ASoC: imx-es8328: Fix error return code in imx_es8328_probe() - [arm64] drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops - [arm64,armhf] drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe - [arm64] drm: bridge: adv7511: Fix ADV7535 HPD enablement - ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern - [arm64,armhf] drm/panfrost: Check for error num after setting mask - Bluetooth: hci_serdev: call init_rwsem() before p->open() - [armhf] mtd: rawnand: gpmi: fix controller timings setting - drm/edid: Don't clear formats if using deep color - drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() - drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() - drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function - ath9k_htc: fix uninit value bugs - RDMA/core: Set MR type in ib_reg_user_mr - [powerpc*] KVM: PPC: Fix vmx/vsx mixup in mmio emulation - i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb - i40e: respect metadata on XSK Rx to skb - [x86] ray_cs: Check ioremap return value - [powerpc*] KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init - [powerpc*] perf: Don't use perf_hw_context for trace IMC PMU - [arm64,armhf] net: dsa: mv88e6xxx: Enable port policy support on 6097 - [arm64] PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge - [arm64,armhf] drm/bridge: dw-hdmi: use safe format when first in bridge chain - HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports - drm/amd/pm: enable pm sysfs write for one VF mode - drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug - IB/cma: Allow XRC INI QPs to set their local ACK timeout - dax: make sure inodes are flushed before destroy cache - iwlwifi: Fix -EIO error code that is never returned - iwlwifi: mvm: Fix an error code in iwl_mvm_up() - [arm64] drm/msm/dp: populate connector of struct dp_panel - [arm64] drm/msm/dpu: add DSPP blocks teardown - [arm64] drm/msm/dpu: fix dp audio condition - scsi: pm8001: Fix command initialization in pm80XX_send_read_log() - scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() - scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() - scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() - scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() - scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() - scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() - scsi: pm8001: Fix NCQ NON DATA command task initialization - scsi: pm8001: Fix NCQ NON DATA command completion handling - scsi: pm8001: Fix abort all task initialization - RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR - drm/amd/display: Remove vupdate_int_entry definition - TOMOYO: fix __setup handlers return values - [arm64,armhf] drm/tegra: Fix reference leak in tegra_dsi_ganged_probe - [x86] power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return - [arm64] scsi: hisi_sas: Change permission of parameter prot_mask - [arm64] bpf, arm64: Call build_prologue() first in first JIT pass - [arm64] bpf, arm64: Feed byte-offset into bpf line info - [arm64,armhf] gpu: host1x: Fix a memory leak in 'host1x_remove()' - [powerpc*] mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() - [x86] KVM: x86: Fix emulation in writing cr8 - [x86] KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() - [x86] hv_balloon: rate-limit "Unhandled message" warning - [amd64] IB/hfi1: Allow larger MTU without AIP - PCI: Reduce warnings on possible RW1C corruption - [armhf] mfd: mc13xxx: Add check for mc13xxx_irq_request - [x86] platform/x86: huawei-wmi: check the return value of device_create_file() - vxcan: enable local echo for sent CAN frames - ath10k: Fix error handling in ath10k_setup_msa_resources - [mips*] pgalloc: fix memory leak caused by pgd_free() - RDMA/mlx5: Fix memory leak in error flow for subscribe event routine - bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full - bpf, sockmap: Fix more uncharged while msg has more_data - bpf, sockmap: Fix double uncharge the mem of sk_msg - USB: storage: ums-realtek: fix error code in rts51x_read_mem() - can: isotp: return -EADDRNOTAVAIL when reading from unbound socket - can: isotp: support MSG_TRUNC flag when reading from socket - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed - ipv4: Fix route lookups when handling ICMP redirects and PMTU updates - af_netlink: Fix shift out of bounds in group mask calculation - [arm64,armhf] i2c: meson: Fix wrong speed use from probe - PCI: Avoid broken MSI on SB600 USB devices - [arm64] net: bcmgenet: Use stronger register read/writes to assure ordering - tcp: ensure PMTU updates are processed during fastopen - openvswitch: always update flow key after nat - tipc: fix the timer expires after interval 100ms - [x86] mxser: fix xmit_buf leak in activate when LSR == 0xff - [armhf] fsi: aspeed: convert to devm_platform_ioremap_resource - [armhf] fsi: Aspeed: Fix a potential double free - soundwire: intel: fix wrong register name in intel_shim_wake - iio: mma8452: Fix probe failing when an i2c_device_id is used - [arm64,armhf] phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) - [x86] serial: 8250_mid: Balance reference count for PCI DMA device - [x86] serial: 8250_lpss: Balance reference count for PCI DMA device - NFS: Use of mapping_set_error() results in spurious errors - serial: 8250: Fix race condition in RTS-after-send handling - NFS: Return valid errors from nfs2/3_decode_dirent() - [arm64] clk: qcom: clk-rcg2: Update logic to calculate D value for RCG - [arm64] clk: qcom: clk-rcg2: Update the frac table for pixel clock - nvdimm/region: Fix default alignment for small regions - [armhf] clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver - NFS: remove unneeded check in decode_devicenotify_args() - [arm64,armhf] pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe - [s390x] tty: hvc: fix return value of __setup handler - serial: 8250: fix XOFF/XON sending when DMA is used - driver core: dd: fix return value of __setup handler - jfs: fix divide error in dbNextAG - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options - NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error - kdb: Fix the putarea helper function - clk: Initialize orphan req_rate - [amd64] xen: fix is_xen_pmu() - [arm64] net: enetc: report software timestamping via SO_TIMESTAMPING - [arm64] net: hns3: fix bug when PF set the duplicate MAC address for VFs - net: phy: broadcom: Fix brcm_fet_config_init() - NFSv4/pNFS: Fix another issue with a list iterator pointing to the head - [armhf] net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator - fs: fd tables have to be multiples of BITS_PER_LONG - fs: fix fd table size alignment properly - LSM: general protection fault in legacy_parse_param - block, bfq: don't move oom_bfqq - selinux: use correct type for context length - selinux: allow FIOCLEX and FIONCLEX with policy capability - loop: use sysfs_emit() in the sysfs xxx show() - Fix incorrect type in assignment of ipv6 port for audit - fs/binfmt_elf: Fix AT_PHDR for unusual ELF files - bfq: fix use-after-free in bfq_dispatch_request - ACPICA: Avoid walking the ACPI Namespace if it is not there - Revert "Revert "block, bfq: honor already-setup queue merges"" - ACPI/APEI: Limit printable size of BERT table data - PM: core: keep irq flags in device_pm_check_callbacks() - nvme-tcp: lockdep: annotate in-kernel sockets - [arm64] spi: tegra20: Use of_device_get_match_data() - ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb - ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit - ext4: don't BUG if someone dirty pages without asking ext4 first - f2fs: fix to do sanity check on curseg->alloc_type - NFSD: Fix nfsd_breaker_owns_lease() return values - f2fs: compress: fix to print raw data size in error path of lz4 decompression - video: fbdev: cirrusfb: check pixclock to avoid divide by zero - [armel,armhf] ftrace: avoid redundant loads or clobbering IP - video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit - ASoC: soc-core: skip zero num_dai component in searching dai name - media: cx88-mpeg: clear interrupt status register before streaming video - uaccess: fix type mismatch warnings from access_ok() - media: Revert "media: em28xx: add missing em28xx_close_extension" - media: hdpvr: initialize dev->worker at hdpvr_register_videodev - mmc: host: Return an error when ->enable_sdio_irq() ops is missing - ALSA: hda/realtek: Add alc256-samsung-headphone fixup - [x86] KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU - [powerpc*] lib/sstep: Fix 'sthcx' instruction - [powerpc*] lib/sstep: Fix build errors with newer binutils - scsi: qla2xxx: Fix stuck session in gpdb - scsi: qla2xxx: Fix scheduling while atomic - scsi: qla2xxx: Fix wrong FDMI data for 64G adapter - scsi: qla2xxx: Fix warning for missing error code - scsi: qla2xxx: Fix device reconnect in loop topology - scsi: qla2xxx: Add devids and conditionals for 28xx - scsi: qla2xxx: Check for firmware dump already collected - scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() - scsi: qla2xxx: Fix disk failure to rediscover - scsi: qla2xxx: Fix incorrect reporting of task management failure - scsi: qla2xxx: Fix hang due to session stuck - scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests - scsi: qla2xxx: Fix N2N inconsistent PLOGI - scsi: qla2xxx: Reduce false trigger to login - scsi: qla2xxx: Use correct feature type field during RFF_ID processing - [arm64] platform: chrome: Split trace include file - [x86] KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated - KVM: Prevent module exit until all VMs are freed - [x86] KVM: x86: fix sending PV IPI - [x86] KVM: SVM: fix panic on out-of-bounds guest IRQ - [x86] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM - ubifs: rename_whiteout: Fix double free for whiteout_ui->data - ubifs: Fix deadlock in concurrent rename whiteout and inode writeback - ubifs: Add missing iput if do_tmpfile() failed in rename whiteout - ubifs: setflags: Make dirtied_ino_d 8 bytes aligned - ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() - ubifs: Fix to add refcount once page is set private - ubifs: rename_whiteout: correct old_dir size computing - wireguard: queueing: use CFI-safe ptr_ring cleanup function - wireguard: socket: free skb in send6 when ipv6 is disabled - wireguard: socket: ignore v6 endpoints when ipv6 is disabled - XArray: Fix xas_create_range() when multi-order entry present - can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path (CVE-2022-28389) - can: mcba_usb: properly check endpoint type - XArray: Update the LRU list in xas_split() - rtc: check if __rtc_read_time was successful - gfs2: Make sure FITRIM minlen is rounded up to fs block size - [arm64] net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware - rxrpc: Fix call timer start racing with call destruction - [arm64] mailbox: imx: fix wakeup failure from freeze mode - watch_queue: Free the page array when watch_queue is dismantled - pinctrl: pinconf-generic: Print arguments for bias-pull-* - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl - [arm*] iop32x: offset IRQ numbers by 1 - io_uring: fix memory leak of uid in files registration - [amd64,arm64] ACPI: CPPC: Avoid out of bounds access when parsing _CPC data - [arm64] platform/chrome: cros_ec_typec: Check for EC device - can: isotp: restore accidentally removed MSG_PEEK feature - proc: bootconfig: Add null pointer check - [x86] ASoC: soc-compress: Change the check for codec_dai - batman-adv: Check ptr for NULL before reducing its refcnt - mm/mmap: return 1 from stack_guard_gap __setup() handler - mm/memcontrol: return 1 from cgroup.memory __setup() handler - mm/usercopy: return 1 from hardened_usercopy __setup() handler - bpf: Adjust BPF stack helper functions to accommodate skip > 0 - bpf: Fix comment for helper bpf_current_task_under_cgroup() - dt-bindings: mtd: nand-controller: Fix the reg property description - dt-bindings: mtd: nand-controller: Fix a comment in the examples - dt-bindings: spi: mxic: The interrupt property is not mandatory - [x86] ASoC: topology: Allow TLV control to be either read or write - docs: sysctl/kernel: add missing bit to panic_print - openvswitch: Fixed nd target mask field in the flow dump. - [x86] KVM: x86/mmu: do compare-and-exchange of gPTE via the user address (CVE-2022-1158) - can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path (CVE-2022-28388) - coredump: Snapshot the vmas in do_coredump - coredump: Remove the WARN_ON in dump_vma_snapshot - coredump/elf: Pass coredump_params into fill_note_info - coredump: Use the vma snapshot in fill_files_note - [arm64] Do not defer reserve_crashkernel() for platforms with no DMA memory zones - [arm64] PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.111 - ubifs: Rectify space amount budget for mkdir/tmpfile operations - gfs2: Check for active reservation in gfs2_release - gfs2: Fix gfs2_release for non-writers regression - gfs2: gfs2_setattr_size error path fix - [x86] KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs - [x86] KVM: x86/emulator: Emulate RDPID only if it is enabled in guest - drm: Add orientation quirk for GPD Win Max - ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 - drm/amd/display: Add signal type check when verify stream backends same - drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj - ptp: replace snprintf with sysfs_emit - [armhf] ath11k: fix kernel panic during unload/load ath11k modules - ath11k: mhi: use mhi_sync_power_up() - bpf: Make dst_port field in struct bpf_sock 16-bit wide - scsi: mvsas: Replace snprintf() with sysfs_emit() - scsi: bfa: Replace snprintf() with sysfs_emit() - [arm64,armhf] power: supply: axp20x_battery: properly report current when discharging - mt76: dma: initialize skip_unmap in mt76_dma_rx_fill - cfg80211: don't add non transmitted BSS to 6GHz scanned channels - ipv6: make mc_forwarding atomic - [powerpc*] Set crashkernel offset to mid of RMA region - drm/amdgpu: Fix recursive locking warning - [arm64] PCI: aardvark: Fix support for MSI interrupts - [arm64] iommu/arm-smmu-v3: fix event handling soft lockup - usb: ehci: add pci device support for Aspeed platforms - tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH. - PCI: pciehp: Add Qualcomm quirk for Command Completed erratum - iwlwifi: mvm: Correctly set fragmented EBS - ipv4: Invalidate neighbour for broadcast address upon address addition - dm ioctl: prevent potential spectre v1 gadget - dm: requeue IO if mapping table not yet available - scsi: pm8001: Fix pm80xx_pci_mem_copy() interface - scsi: pm8001: Fix pm8001_mpi_task_abort_resp() - scsi: pm8001: Fix task leak in pm8001_send_abort_all() - scsi: pm8001: Fix tag leaks on error - scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() - scsi: aha152x: Fix aha152x_setup() __setup handler return value - [arm64] scsi: hisi_sas: Free irq vectors in order for v3 HW - net/smc: correct settings of RMB window update limit - macvtap: advertise link netns via netlink - tuntap: add sanity checks about msg_controllen in sendmsg - Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg} - Bluetooth: use memset avoid memory leaks - bnxt_en: Eliminate unintended link toggle during FW reset - [mps64el,mipsel] fix fortify panic when copying asm exception handlers - scsi: libfc: Fix use after free in fc_exch_abts_resp() - can: isotp: set default value for N_As to 50 micro seconds - net: account alternate interface name memory - net: limit altnames to 64k total - net: sfp: add 2500base-X quirk for Lantech SFP module - [armhf] usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm - Bluetooth: Fix use after free in hci_send_acl - netlabel: fix out-of-bounds memory accesses - ceph: fix memory leak in ceph_readdir when note_last_dentry returns error - init/main.c: return 1 from handled __setup() functions - minix: fix bug when opening a file with O_DIRECT - [arm*] staging: vchiq_core: handle NULL result of find_service_by_handle - [arm64,armhf] phy: amlogic: meson8b-usb2: Use dev_err_probe() - w1: w1_therm: fixes w1_seq for ds28ea00 sensors - NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify() - NFSv4: Protect the state recovery thread against direct reclaim - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 - [armhf] clk: ti: Preserve node in ti_dt_clocks_register() - clk: Enforce that disjoints limits are invalid - SUNRPC/call_alloc: async tasks mustn't block waiting for memory - SUNRPC/xprt: async tasks mustn't block waiting for memory - SUNRPC: remove scheduling boost for "SWAPPER" tasks. - NFS: swap IO handling is slightly different for O_DIRECT IO - NFS: swap-out must always use STABLE writes. - [armhf] serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() - virtio_console: eliminate anonymous module_init & module_exit - jfs: prevent NULL deref in diFree - SUNRPC: Fix socket waits for write buffer space - NFS: nfsiod should not block forever in mempool_alloc() - NFS: Avoid writeback threads getting stuck in mempool_alloc() - mm: fix race between MADV_FREE reclaim and blkdev direct IO read - drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() - [x86] Drivers: hv: vmbus: Fix potential crash on module unload - Revert "NFSv4: Handle the special Linux file open access mode" - NFSv4: fix open failure with O_ACCMODE flag - ice: Clear default forwarding VSI during VSI release - net: ipv4: fix route with nexthop object delete warning - net: stmmac: Fix unset max_speed difference between DT and non-DT platforms - [armhf] drm/imx: imx-ldb: Check for null pointer after calling kmemdup - [armhf] drm/imx: Fix memory leak in imx_pd_connector_get_modes - sfc: Do not free an empty page_ring - RDMA/mlx5: Don't remove cache MRs when a delay is needed - [amd64] IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition - [arm64] dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe - ice: Set txq_teid to ICE_INVAL_TEID on ring creation - ice: Do not skip not enabled queues in ice_vc_dis_qs_msg - ipv6: Fix stats accounting in ip6_pkt_drop - ice: synchronize_rcu() when terminating rings - net: openvswitch: don't send internal clone attribute to the userspace. - net: openvswitch: fix leak of nested actions - rxrpc: fix a race in rxrpc_exit_net() - qede: confirm skb is allocated before using - bpf: Support dual-stack sockets in bpf_tcp_check_syncookie - drbd: Fix five use after free bugs in get_initial_state - io_uring: don't touch scm_fp_list after queueing skb - SUNRPC: Handle ENOMEM in call_transmit_status() - SUNRPC: Handle low memory situations in call_status() - SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec() - [armhf] iommu/omap: Fix regression in probe for NULL pointer dereference - [arm64] Add part number for Arm Cortex-A78AE - [arm64] Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" - [arm64,armhf] mmc: mmci: stm32: correctly check all elements of sg list - lz4: fix LZ4_decompress_safe_partial read out of bound - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) - mm/mempolicy: fix mpol_new leak in shared_policy_replace - io_uring: fix race between timeout flush and removal (CVE-2022-29582) - [x86] pm: Save the MSR validity status at context setup - [x86] speculation: Restore speculation related MSRs during S3 resume - btrfs: fix qgroup reserve overflow the qgroup limit - btrfs: prevent subvol with swapfile from being deleted - [arm64] patch_text: Fixup last cpu should be master - [amd64] RDMA/hfi1: Fix use-after-free bug for mm struct - gpio: Restrict usage of GPIO chip irq members before initialization - [arm64] perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator - [arm64,armhf] irqchip/gic-v3: Fix GICR_CTLR.RWP polling - drm/nouveau/pmu: Add missing callbacks for Tegra devices - mm: don't skip swap entry even if zap_details specified - cgroup: Use open-time credentials for process migraton perm checks (CVE-2021-4197) - [x86] Drivers: hv: vmbus: Replace smp_store_mb() with virt_store_mb() - [arm64,armhf] irqchip/gic, gic-v3: Prevent GSI to SGI translations - [powerpc*] Fix virt_addr_valid() for 64-bit Book3E & 32-bit https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.112 - [amd64] drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu - hamradio: defer 6pack kfree after unregister_netdev (CVE-2022-1195) - hamradio: remove needs_free_netdev to avoid UAF (CVE-2022-1195) - [arm64] cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function - ACPI: processor idle: Check for architectural support for LPI - btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups() - [arm64] drm/msm: Add missing put_task_struct() in debugfs path - SUNRPC: Fix the svc_deferred_event trace class - net/sched: flower: fix parsing of ethertype following VLAN header - veth: Ensure eth header is in skb's linear part - gpiolib: acpi: use correct format characters - net: mdio: Alphabetically sort header inclusion - net/sched: fix initialization order when updating chain 0 head - [arm64] net: dsa: felix: suppress -EPROBE_DEFER errors - [armhf] net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link - net/sched: taprio: Check if socket flags are valid - cfg80211: hold bss_lock while updating nontrans_list - [arm64] drm/msm: Fix range size vs end confusion - [arm64] drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init() - net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() - scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63 - scsi: pm80xx: Enable upper inbound, outbound queues - scsi: iscsi: Stop queueing during ep_disconnect - scsi: iscsi: Force immediate failure during shutdown - scsi: iscsi: Use system_unbound_wq for destroy_work - scsi: iscsi: Rel ref after iscsi_lookup_endpoint() - scsi: iscsi: Fix in-kernel conn failure handling - scsi: iscsi: Move iscsi_ep_disconnect() - scsi: iscsi: Fix offload conn cleanup when iscsid restarts - scsi: iscsi: Fix conn cleanup and stop race during iscsid restart - sctp: Initialize daddr on peeled off socket - cifs: potential buffer overflow in handling symlinks - [arm64] net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" - drm/amd: Add USBC connector ID - btrfs: fix fallocate to use file_modified to update permissions consistently - btrfs: do not warn for free space inode in cow_file_range - drm/amd/display: fix audio format not updated after edid updated - drm/amd/display: FEC check in timing validation - drm/amd/display: Update VTEM Infopacket definition - drm/amdkfd: Fix Incorrect VMIDs passed to HWS - drm/amdgpu/vcn: improve vcn dpg stop procedure - [x86] Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer - scsi: target: tcmu: Fix possible page UAF - scsi: lpfc: Fix queue failures when recovering from PCI parity error - [powerpc*] scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 - ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs - [armhf] gpu: ipu-v3: Fix dev_dbg frequency output - [arm64] alternatives: mark patch_alternative() as `noinstr` - tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry - net: usb: aqc111: Fix out-of-bounds accesses in RX fixup - myri10ge: fix an incorrect free for skb in myri10ge_sw_tso - drm/amd/display: Revert FEC check in validation - drm/amd/display: Fix allocate_mst_payload assert on resume - scsi: mvsas: Add PCI ID of RocketRaid 2640 - scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan - drivers: net: slip: fix NPD bug in sl_tx_timeout() - mm, page_alloc: fix build_zonerefs_node() - mm: fix unexpected zeroed page mapping with zram swap - [x86] KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded - ath9k: Properly clear TX status area before reporting to mac80211 - ath9k: Fix usage of driver-private space in tx_info - btrfs: fix root ref counts in error handling in btrfs_get_root_ref - btrfs: mark resumed async balance as writing - ALSA: hda/realtek: Add quirk for Clevo PD50PNT - ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers - ALSA: pcm: Test for "silence" field in struct "pcm_format_data" - nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size - ipv6: fix panic when forwarding a pkt with no in6 dev - drm/amd/display: don't ignore alpha property on pre-multiplied mode - drm/amdgpu: Enable gfxoff quirk on MacBook Pro - genirq/affinity: Consider that CPUs on nodes can be unbalanced - tick/nohz: Use WARN_ON_ONCE() to prevent console saturation - dm integrity: fix memory corruption when tag_size is less than digest size - smp: Fix offline cpu check in flush_smp_call_function_queue() - timers: Fix warning condition in __run_timers() - dma-direct: avoid redundant memory sync for swiotlb - scsi: iscsi: Fix endpoint reuse regression - scsi: iscsi: Fix unbound endpoint error handling - ax25: add refcount in ax25_dev to avoid UAF bugs (CVE-2022-1204) - ax25: fix reference count leaks of ax25_dev (CVE-2022-1204) - ax25: fix UAF bugs of net_device caused by rebinding operation (CVE-2022-1204) - ax25: Fix refcount leaks caused by ax25_cb_del() (CVE-2022-1204) - ax25: fix UAF bug in ax25_send_control() - ax25: fix NPD bug in ax25_disconnect (CVE-2022-1199) - ax25: Fix NULL pointer dereferences in ax25 timers (CVE-2022-1205) - ax25: Fix UAF bugs in ax25 timers (CVE-2022-1205) https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.113 - tracing: Dump stacktrace trigger to the corresponding instance - gfs2: assign rgrp glock before compute_bitstructs - net/sched: cls_u32: fix netns refcount changes in u32_change() - ALSA: usb-audio: Clear MIDI port active flag after draining - ALSA: hda/realtek: Add quirk for Clevo NP70PNP - dm: fix mempool NULL pointer race when completing IO - [armhf] dmaengine: imx-sdma: Fix error checking in sdma_event_remap - esp: limit skb_page_frag_refill use to a single page - igc: Fix infinite loop in release_swfw_sync - igc: Fix BUG: scheduling while atomic - rxrpc: Restore removed timer deletion - net/smc: Fix sock leak when release after smc_shutdown() - net/packet: fix packet_sock xmit return value checking - ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() - ip6_gre: Fix skb_under_panic in __gre6_xmit() - net/sched: cls_u32: fix possible leak in u32_init_knode() - l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu - ipv6: make ip6_rt_gc_expire an atomic_t - netlink: reset network and mac headers in netlink_dump() - net: stmmac: Use readl_poll_timeout_atomic() in atomic state - [arm64] mm: Remove [PUD|PMD]_TABLE_BIT from [pud|pmd]_bad() - [arm64] mm: fix p?d_leaf() - [x86] platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative - ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant - vxlan: fix error return code in vxlan_fdb_append - cifs: Check the IOCB_DIRECT flag, not O_DIRECT - [amd64,arm64] net: atlantic: Avoid out-of-bounds indexing - mt76: Fix undefined behavior due to shift overflowing the constant - brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant - [arm64] drm/msm/mdp5: check the return of kzalloc() - [arm64] net: macb: Restart tx only if queue pointer is lagging - scsi: qedi: Fix failed disconnect handling - stat: fix inconsistency between struct stat and struct compat_stat - nvme: add a quirk to disable namespace identifiers - nvme-pci: disable namespace identifiers for Qemu controllers - mm, hugetlb: allow for "high" userspace addresses - oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup - mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() - ata: pata_marvell: Check the 'bmdma_addr' beforing reading - [amd64,arm64] net: atlantic: invert deep par in pm functions, preventing null derefs - openvswitch: fix OOB access in reserve_sfa_size() - gpio: Request interrupts after IRQ is initialized - ASoC: soc-dapm: fix two incorrect uses of list iterator - e1000e: Fix possible overflow in LTR decoding - [arm*] arm_pmu: Validate single/group leader events - sched/pelt: Fix attach_entity_load_avg() corner case - [arm64,armhf] drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised - [arm64,armhf] drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare - [powerpc*] KVM: PPC: Fix TCE handling for VFIO - [arm*] drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage - [powerpc*] perf: Fix power9 event alternatives - ext4: fix fallocate to use file_modified to update permissions consistently - ext4: fix symlink file size not match to file content - ext4: fix use-after-free in ext4_search_dir - ext4: limit length to bitmap_maxbytes - blocksize in punch_hole - ext4, doc: fix incorrect h_reserved size - ext4: fix overhead calculation to account for the reserved gdt blocks - ext4: force overhead calculation if the s_overhead_cluster makes no sense - can: isotp: stop timeout monitoring when no first frame was sent - jbd2: fix a potential race while discarding reserved buffers after an abort - block/compat_ioctl: fix range check in BLKGETSIZE [ Salvatore Bonaccorso ] * Bump ABI to 14 * [rt] Drop "tcp: Remove superfluous BH-disable around" * [rt] Update "tracing: Merge irqflags + preempt counter." for upstream changes in 5.10.113 * [x86] pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests (Closes: #1006346) * floppy: disable FDRAWCMD by default -- Salvatore Bonaccorso Fri, 29 Apr 2022 11:36:50 +0200 linux (5.10.106-1) bullseye; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.104 - mac80211_hwsim: report NOACK frames in tx_status - mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work - [arm*] i2c: bcm2835: Avoid clock stretching timeouts - ASoC: rt5682: do not block workqueue if card is unbound - regulator: core: fix false positive in regulator_late_cleanup() - Input: clear BTN_RIGHT/MIDDLE on buttonpads - [arm64] KVM: arm64: vgic: Read HW interrupt pending state from the HW - tipc: fix a bit overflow in tipc_crypto_key_rcv() - cifs: fix double free race when mount fails in cifs_get_root() - net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 - usb: gadget: don't release an existing dev->buf (CVE-2022-24958) - usb: gadget: clear related members when goto fail (CVE-2022-24958) - exfat: reuse exfat_inode_info variable instead of calling EXFAT_I() - exfat: fix i_blocks for files truncated over 4 GiB - tracing: Add test for user space strings when filtering on string pointers - [armhf] serial: stm32: prevent TDR register overwrite when sending x_char - ata: pata_hpt37x: fix PCI clock detection - drm/amdgpu: check vm ready by amdgpu_vm->evicting flag - tracing: Add ustring operation to filtering string pointers - [x86] ALSA: intel_hdmi: Fix reference to PCM buffer address - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min - [amd64] iommu/amd: Recover from event log overflow - [x86] drm/i915: s/JSP2/ICP2/ PCH - xen/netfront: destroy queues before real_num_tx_queues is zeroed - mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls - xfrm: fix MTU regression - netfilter: fix use-after-free in __nf_register_net_hook() - bpf, sockmap: Do not ignore orig_len parameter - xfrm: fix the if_id check in changelink - xfrm: enforce validity of offload input flags - e1000e: Correct NVM checksum verification flow - net: fix up skbs delta_truesize in UDP GRO frag_list - netfilter: nf_queue: don't assume sk is full socket - netfilter: nf_queue: fix possible use-after-free - netfilter: nf_queue: handle socket prefetch - batman-adv: Request iflink once in batadv-on-batadv check - batman-adv: Request iflink once in batadv_get_real_netdevice - batman-adv: Don't expect inter-netns unique iflink indices - net: ipv6: ensure we call ipv6_mc_down() at most once - net: dcb: flush lingering app table entries for unregistered devices - net/smc: fix connection leak - net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error generated by client - net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server - rcu/nocb: Fix missed nocb_timer requeue - ice: Fix race conditions between virtchnl handling and VF ndo ops - ice: fix concurrent reset and removal of VFs - sched/topology: Make sched_init_numa() use a set for the deduplicating sort - sched/topology: Fix sched_domain_topology_level alloc in sched_init_numa() - mac80211: fix forwarded mesh frames AC & queue selection - net: stmmac: fix return value of __setup handler - mac80211: treat some SAE auth steps as final - iavf: Fix missing check for running netdev - net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() - ixgbe: xsk: change !netif_carrier_ok() handling in ixgbe_xmit_zc() - efivars: Respect "block" flag in efivar_entry_set_safe() - can: gs_usb: change active_channels's type from atomic_t to u8 - igc: igc_read_phy_reg_gpy: drop premature return - [armel,armhf] 9182/1: mmu: fix returns from early_param() and __setup() functions - [arm64,armhf] pinctrl: sunxi: Use unique lockdep classes for IRQs - igc: igc_write_phy_reg_gpy: drop premature return - memfd: fix F_SEAL_WRITE after shmem huge page allocated - [armhf] dts: switch timer config to common devkit8000 devicetree - [armhf] dts: Use 32KiHz oscillator on devkit8000 - [arm64] soc: fsl: guts: Revert commit 3c0d64e867ed - [arm64] soc: fsl: guts: Add a missing memory allocation failure check - [armhf] tegra: Move panels to AUX bus - net: chelsio: cxgb3: check the return value of pci_find_capability() - iavf: Refactor iavf state machine tracking - nl80211: Handle nla_memdup failures in handle_nan_filter - drm/amdgpu: fix suspend/resume hang regression - net: dcb: disable softirqs in dcbnl_flush_dev() - Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() - Input: elan_i2c - fix regulator enable count imbalance after suspend/resume - HID: add mapping for KEY_DICTATE - HID: add mapping for KEY_ALL_APPLICATIONS - tracing/histogram: Fix sorting on old "cpu" value - tracing: Fix return value of __setup handlers - btrfs: fix lost prealloc extents beyond eof after full fsync - btrfs: qgroup: fix deadlock between rescan worker and remove qgroup - btrfs: add missing run of delayed items after unlink during log replay - Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6" - hamradio: fix macro redefine warning https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.105 - [x86] bugs: Unconditionally allow spectre_v2=retpoline,amd - [armhf] report Spectre v2 status through sysfs - [armel,armhf] early traps initialisation - [armel,armhf] use LOADADDR() to get load address of sections - [armel,armhf] Spectre-BHB workaround - [armel,armhf] include unprivileged BPF status in Spectre V2 reporting - [arm64] cputype: Add CPU implementor & types for the Apple M1 cores - [arm64] Add Neoverse-N2, Cortex-A710 CPU part definition - [arm64] Add Cortex-X2 CPU part definition - [arm64] Add Cortex-A510 CPU part definition - [arm64] Add HWCAP for self-synchronising virtual counter - [arm64] add ID_AA64ISAR2_EL1 sys register - [arm64] cpufeature: add HWCAP for FEAT_AFP - [arm64] cpufeature: add HWCAP for FEAT_RPRES - [arm64] entry.S: Add ventry overflow sanity checks - [arm64] spectre: Rename spectre_v4_patch_fw_mitigation_conduit - [arm64] entry: Make the trampoline cleanup optional - [arm64] entry: Free up another register on kpti's tramp_exit path - [arm64] entry: Move the trampoline data page before the text page - [arm64] entry: Allow tramp_alias to access symbols after the 4K boundary - [arm64] entry: Don't assume tramp_vectors is the start of the vectors - [arm64] entry: Move trampoline macros out of ifdef'd section - [arm64] entry: Make the kpti trampoline's kpti sequence optional - [arm64] entry: Allow the trampoline text to occupy multiple pages - [arm64] entry: Add non-kpti __bp_harden_el1_vectors for mitigations - [arm64] entry: Add vectors that have the bhb mitigation sequences - [arm64] entry: Add macro for reading symbol addresses from the trampoline - [arm64] Add percpu vectors for EL1 - [arm64] proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 - [arm64] KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A - [arm64] Mitigate spectre style branch history side channels - [arm64] KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated - [arm64] Use the clearbhb instruction in mitigations - [arm64] proton-pack: Include unprivileged eBPF status in Spectre v2 mitigation reporting - [armel,armhf] fix co-processor register typo - [armel,armhf] Do not use NOCROSSREFS directive with ld.lld - [armhf] fix build warning in proc-v7-bugs.c - xen/xenbus: don't let xenbus_grant_ring() remove grants in error case (CVE-2022-23040, XSA-396) - xen/grant-table: add gnttab_try_end_foreign_access() (CVE-2022-23036, CVE-2022-23038, XSA-396) - xen/blkfront: don't use gnttab_query_foreign_access() for mapped status (CVE-2022-23036, XSA-396) - xen/netfront: don't use gnttab_query_foreign_access() for mapped status (CVE-2022-23037, XSA-396) - xen/scsifront: don't use gnttab_query_foreign_access() for mapped status (CVE-2022-23038, XSA-396) - xen/gntalloc: don't use gnttab_query_foreign_access() (CVE-2022-23039, XSA-396) - xen: remove gnttab_query_foreign_access() - xen/9p: use alloc/free_pages_exact() (CVE-2022-23041, XSA-396) - xen/pvcalls: use alloc/free_pages_exact() (CVE-2022-23041, XSA-396) - xen/gnttab: fix gnttab_end_foreign_access() without page specified (CVE-2022-23041, XSA-396) - xen/netfront: react properly to failing gnttab_end_foreign_access_ref() (CVE-2022-23042, XSA-396) - Revert "ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE" https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.106 - [arm64] clk: qcom: gdsc: Add support to update GDSC transition delay - [arm64] dts: armada-3720-turris-mox: Add missing ethernet0 alias - tipc: fix kernel panic when enabling bearer - mISDN: Remove obsolete PIPELINE_DEBUG debugging information - mISDN: Fix memory leak in dsp_pipeline_build() - virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero - isdn: hfcpci: check the return value of dma_set_mask() in setup_hw() - net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare() - esp: Fix BEET mode inter address family tunneling on GSO - qed: return status of qed_iov_get_link - i40e: stop disabling VFs due to PF error responses - ice: stop disabling VFs due to PF error responses - ice: Align macro names to the specification - ice: Remove unnecessary checker loop - ice: Rename a couple of variables - ice: Fix curr_link_speed advertised speed - tipc: fix incorrect order of state message data sanity check - [armhf] net: ethernet: ti: cpts: Handle error for clk_enable - ax25: Fix NULL pointer dereference in ax25_kill_by_device - net/mlx5: Fix size field in bufferx_reg struct - net/mlx5: Fix a race on command flush flow - net/mlx5e: Lag, Only handle events from highest priority multipath entry - NFC: port100: fix use-after-free in port100_send_complete - net: phy: DP83822: clear MISR2 register to disable interrupts - sctp: fix kernel-infoleak for SCTP sockets - [arm64] net: bcmgenet: Don't claim WOL when its not available - [arm64,armhf] spi: rockchip: Fix error in getting num-cs property - [arm64,armhf] spi: rockchip: terminate dma transmission when slave abort - net-sysfs: add check for netdevice being present to speed_show - [armhf] hwmon: (pmbus) Clear pmbus fault/warning bits after read - gpio: Return EPROBE_DEFER if gc->to_irq is NULL - Revert "xen-netback: remove 'hotplug-status' once it has served its purpose" - Revert "xen-netback: Check for hotplug-status existence before watching" - ipv6: prevent a possible race condition with lifetimes - tracing: Ensure trace buffer is at least 4096 bytes large - fuse: fix pipe buffer lifetime for direct_io - staging: rtl8723bs: Fix access-point mode deadlock - [arm64] net: macb: Fix lost RX packet wakeup race in NAPI receive - [arm64] mmc: meson: Fix usage of meson_mmc_post_req() - [arm64] dts: marvell: armada-37xx: Remap IO space to bus address 0x0 - virtio: unexport virtio_finalize_features - virtio: acknowledge all features before access - watch_queue, pipe: Free watchqueue state after clearing pipe ring (CVE-2022-0995) - watch_queue: Fix to release page in ->release() (CVE-2022-0995) - watch_queue: Fix to always request a pow-of-2 pipe ring size (CVE-2022-0995) - watch_queue: Fix the alloc bitmap size to reflect notes allocated (CVE-2022-0995) - watch_queue: Free the alloc bitmap when the watch_queue is torn down (CVE-2022-0995) - watch_queue: Fix lack of barrier/sync/lock between post and read (CVE-2022-0995) - watch_queue: Make comment about setting ->defunct more accurate (CVE-2022-0995) - [x86] boot: Fix memremap of setup_indirect structures - [x86] boot: Add setup_indirect support in early_memremap_is_setup_data() - [x86] traps: Mark do_int3() NOKPROBE_SYMBOL - ext4: add check to prevent attempting to resize an fs with sparse_super2 - [armel,armhf] fix Thumb2 regression with Spectre BHB - watch_queue: Fix filter limit check ((CVE-2022-0995) [ Salvatore Bonaccorso ] * Bump ABI to 13 * [rt] Update to 5.10.104-rt63 * [rt] Update to 5.10.106-rt64 * sctp: fix the processing for INIT chunk (CVE-2021-3772) * tcp: make tcp_read_sock() more robust * io_uring: return back safer resurrect * [arm64] kvm: Fix copy-and-paste error in bhb templates for v5.10 stable -- Salvatore Bonaccorso Thu, 17 Mar 2022 16:40:47 +0100 linux (5.10.103-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.93 - kbuild: Add $(KBUILD_HOSTLDFLAGS) to 'has_libelf' test - devtmpfs regression fix: reconfigure on each mount - orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() - perf: Protect perf_guest_cbs with RCU - [x86] KVM: Register Processor Trace interrupt hook iff PT enabled in guest - [s390x] KVM: Clarify SIGP orders versus STOP/RESTART - 9p: only copy valid iattrs in 9P2000.L setattr implementation - [x86] video: vga16fb: Only probe for EGA and VGA 16 color graphic cards - media: uvcvideo: fix division by zero at stream start - rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled - firmware: qemu_fw_cfg: fix sysfs information leak - firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries - firmware: qemu_fw_cfg: fix kobject leak in probe error path - [x86] KVM: remove PMU FIXED_CTR3 from msrs_to_save_all - ALSA: hda/realtek: Add speaker fixup for some Yoga 15ITL5 devices - ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after reboot from Windows - ALSA: hda: ALC287: Add Lenovo IdeaPad Slim 9i 14ITL5 speaker quirk - ALSA: hda/realtek: Add quirk for Legion Y9000X 2020 - ALSA: hda/realtek: Re-order quirk entries for Lenovo - [powerpc*] pseries: Get entry and uaccess flush required bits from H_GET_CPU_CHARACTERISTICS https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.94 - [x86] KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock - HID: uhid: Fix worker destroying device without any protection - HID: wacom: Reset expected and received contact counts at the same time - HID: wacom: Ignore the confidence flag when a touch is removed - HID: wacom: Avoid using stale array indicies to read contact count - f2fs: fix to do sanity check in is_alive() - nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() - [armhf] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings - [armhf] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 - mtd: Fixed breaking list in __mtd_del_partition. - [x86] gpu: Reserve stolen memory for first integrated Intel GPU - rtc: cmos: take rtc_lock while reading from CMOS - media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE - media: flexcop-usb: fix control-message timeouts - media: mceusb: fix control-message timeouts - media: em28xx: fix control-message timeouts - media: cpia2: fix control-message timeouts - media: s2255: fix control-message timeouts - media: dib0700: fix undefined behavior in tuner shutdown - media: redrat3: fix control-message timeouts - media: pvrusb2: fix control-message timeouts - media: stk1160: fix control-message timeouts - [armhf] media: cec-pin: fix interrupt en/disable handling - [x86] can: softing_cs: softingcs_probe(): fix memleak on registration failure - iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs - [arm64,armhf] gpu: host1x: Add back arm_iommu_detach_device() - dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() - PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller - mm_zone: add function to check if managed dma zone exists - [arm64] dma/pool: create dma atomic pool only if dma zone has managed pages - mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages - shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode - drm/ttm: Put BO in its memory manager's lru list - Bluetooth: L2CAP: Fix not initializing sk_peer_pid - [armhf] drm/bridge: display-connector: fix an uninitialized pointer in probe() - drm: fix null-ptr-deref in drm_dev_init_release() - [arm64,armhf] drm/rockchip: dsi: Fix unbalanced clock on probe error - [arm64,armhf] drm/rockchip: dsi: Hold pm-runtime across bind/unbind - [arm64,armhf] drm/rockchip: dsi: Disable PLL clock on bind error - [arm64,armhf] drm/rockchip: dsi: Reconfigure hardware on resume() - Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails - [arm*] clk: bcm-2835: Pick the closest clock rate - [arm*] clk: bcm-2835: Remove rounding up the dividers - [arm*] drm/vc4: hdmi: Set a default HSM rate - [arm64] wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan - [arm64] wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND - [arm64] wcn36xx: Fix DMA channel enable/disable cycle - [arm64] wcn36xx: Release DMA channel descriptor allocations - [arm64] wcn36xx: Put DXE block into reset before freeing memory - [arm64] wcn36xx: populate band before determining rate on RX - [arm64] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates - ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware - media: videobuf2: Fix the size printk format - [armhf] media: aspeed: fix mode-detect always time out at 2nd run - media: em28xx: fix memory leak in em28xx_init_dev - [armhf] media: aspeed: Update signal status immediately to ensure sane hw state - fs: dlm: use sk->sk_socket instead of con->sock - fs: dlm: don't call kernel_getpeername() in error_report() - Bluetooth: stop proccessing malicious adv data - ath11k: Fix ETSI regd with weather radar overlap - ath11k: clear the keys properly via DISABLE_KEY - ath11k: reset RSN/WPA present state for open BSS - [arm64] tee: fix put order in teedev_close_context() - [x86] drm/vboxvideo: fix a NULL vs IS_ERR() check - media: dmxdev: fix UAF when dvb_register_device() fails - [arm64] crypto: qce - fix uaf on qce_ahash_register_one - [arm64] crypto: qce - fix uaf on qce_skcipher_register_one - [armhf] dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco - [x86] crypto: qat - fix spelling mistake: "messge" -> "message" - [x86] crypto: qat - remove unnecessary collision prevention step in PFVF - [x86] crypto: qat - make pfvf send message direction agnostic - [x86] crypto: qat - fix undetected PFVF timeout in ACK loop - ath11k: Use host CE parameters for CE interrupts configuration - [armhf] media: imx-pxp: Initialize the spinlock prior to using it - [armhf] media: coda: fix CODA960 JPEG encoder buffer overflow - [arm64] media: venus: pm_helpers: Control core power domain manually - [arm64] media: venus: core, venc, vdec: Fix probe dependency error - [arm64] media: venus: core: Fix a potential NULL pointer dereference in an error handling path - [arm64] media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()' - [armhf] thermal/drivers/imx: Implement runtime PM support - netfilter: bridge: add support for pppoe filtering - cgroup: Trace event cgroup id fields should be u64 - ACPI: EC: Rework flushing of EC work while suspended to idle - drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() - drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() - [arm*] serial: amba-pl011: do not request memory region twice - floppy: Fix hang in watchdog when disk is ejected - [x86] staging: rtl8192e: return error code from rtllib_softmac_init() - [x86] staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib() - sched/fair: Fix detection of per-CPU kthreads waking a task - sched/fair: Fix per-CPU kthread and wakee stacking for asym CPU capacity - bpf: Adjust BTF log size limit. - bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD) - bpf: Remove config check to enable bpf support for branch records - [arm64] lib: Annotate {clear, copy}_page() as position-independent - [arm64] clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1 - media: dib8000: Fix a memleak in dib8000_init() - media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() - media: si2157: Fix "warm" tuner state detection - wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma - sched/rt: Try to restart rt period timer when rt runtime exceeded - rcu/exp: Mark current CPU as exp-QS in IPI loop second pass - mwifiex: Fix possible ABBA deadlock - xfrm: fix a small bug in xfrm_sa_len() - [x86] uaccess: Move variable into switch case statement - [armhf] crypto: stm32 - Fix last sparse warning in stm32_cryp_check_ctr_counter - [armhf] crypto: stm32/cryp - fix CTR counter carry - [armhf] crypto: stm32/cryp - fix xts and race condition in crypto_engine requests - [armhf] crypto: stm32/cryp - check early input data - [armhf] crypto: stm32/cryp - fix double pm exit - [armhf] crypto: stm32/cryp - fix lrw chaining mode - [armhf] crypto: stm32/cryp - fix bugs and crash in tests - [armhf] crypto: stm32 - Revert broken pm_runtime_resume_and_get changes - ath11k: Fix deleting uninitialized kernel timer during fragment cache flush - media: dw2102: Fix use after free - media: msi001: fix possible null-ptr-deref in msi001_probe() - [armhf] media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes - ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan() - [arm64] dts: qcom: c630: Fix soundcard setup - [arm64] drm/msm/dpu: fix safe status debugfs file - [arm64,armhf] drm/tegra: vic: Fix DMA API misuse - xfrm: interface with if_id 0 should return error - xfrm: state and policy should fail if XFRMA_IF_ID 0 - [armel,armhf] 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding - usb: ftdi-elan: fix memory leak on device disconnect - iwlwifi: mvm: fix 32-bit build in FTM - iwlwifi: mvm: test roc running status bits before removing the sta - [armhf] mmc: meson-mx-sdio: add IRQ check - selinux: fix potential memleak in selinux_add_opt() - Bluetooth: L2CAP: Fix using wrong mode - bpftool: Enable line buffering for stdout - software node: fix wrong node passed to find nargs_prop - Bluetooth: hci_qca: Stop IBS timer during BT OFF - [x86] mce/inject: Avoid out-of-bounds write when setting flags - ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes - [x86] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() - [x86] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() - netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() - bpf: Don't promote bogus looking registers after null check. - bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). - netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone - ppp: ensure minimum packet size in ppp_write() - Bluetooth: hci_bcm: Check for error irq - Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe - [arm64] usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe - HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init - HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc - HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init - HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad - debugfs: lockdown: Allow reading debugfs files that are not world readable - net/mlx5e: Fix page DMA map/unmap attributes - net/mlx5e: Don't block routes with nexthop objects in SW - Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels" - net/mlx5: Set command entry semaphore up once got index free - lib/mpi: Add the return value check of kcalloc() - Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() - [arm64,armhf] spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe - ax25: uninitialized variable in ax25_setsockopt() - netrom: fix api breakage in nr_setsockopt() - regmap: Call regmap_debugfs_exit() prior to _init() - tpm: add request_locality before write TPM_INT_ENABLE - tpm_tis: Fix an error handling path in 'tpm_tis_core_init()' - can: softing: softing_startstop(): fix set but not used variable warning - pcmcia: fix setting of kthread task states - iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing() - net: mcs7830: handle usb read errors properly - ext4: avoid trim error on fs with small groups - ALSA: jack: Add missing rwsem around snd_ctl_remove() calls - ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls - ALSA: hda: Add missing rwsem around snd_ctl_remove() calls - RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit" - [arm64] RDMA/hns: Validate the pkey index - scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd() - [arm64] clk: imx8mn: Fix imx8mn_clko1_sels - [powerpc*] prom_init: Fix improper check of prom_getprop() - dt-bindings: thermal: Fix definition of cooling-maps contribution property - [powerpc*] 64s: Convert some cpu_setup() and cpu_restore() functions to C - [powerpc*] perf: MMCR0 control for PMU registers under PMCC=00 - [powerpc*] perf: move perf irq/nmi handling details into traps.c - [powerpc*] irq: Add helper to set regs->softe - [powerpc*] perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC - clocksource: Reduce clocksource-skew threshold - clocksource: Avoid accidental unstable marking of clocksources - ALSA: oss: fix compile error when OSS_DEBUG is enabled - ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID - [arm*] binder: fix handling of error during copy - [arm64,armhf] iommu/io-pgtable-arm: Fix table descriptor paddr formatting - scsi: ufs: Fix race conditions related to driver data - RDMA/qedr: Fix reporting max_{send/recv}_wr attrs - PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() - RDMA/core: Let ib_find_gid() continue search even after empty entry - RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry - [x86] ASoC: rt5663: Handle device_property_read_u32_array error codes - [amd64] iommu/amd: Remove iommu_init_ga() - [amd64] iommu/amd: Restore GA log/tail pointer on host resume - [x86] ASoC: Intel: catpt: Test dmaengine_submit() result before moving on - iommu/iova: Fix race between FQ timeout and teardown - scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume() - [powerpc*] xive: Add missing null check after calling kmalloc - RDMA/cxgb4: Set queue pair state when being queried - of: base: Fix phandle argument length mismatch error message - [armhf] dts: omap3-n900: Fix lp5523 for multi color - Bluetooth: Fix debugfs entry leak in hci_register_dev() - fs: dlm: filter user dlm messages for kernel locks - [arm64,armhf] drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y - ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply - [arm64,armhf] drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR - drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR - batman-adv: allow netlink usage in unprivileged containers - ath11k: Fix crash caused by uninitialized TX ring - usb: gadget: f_fs: Use stream_open() for endpoint files - drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L - HID: apple: Do not reset quirks when the Fn key is not found - media: b2c2: Add missing check in flexcop_pci_isr: - drm/amdgpu/display: set vblank_disable_immediate for DC - [arm64,armhf] tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of .shutdown() - gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use - [armhf] HSI: core: Fix return freed object in hsi_new_client - crypto: jitter - consider 32 LSB for APT - rsi: Fix use-after-free in rsi_rx_done_handler() - rsi: Fix out-of-bounds read in rsi_read_pkt() - ath11k: Avoid NULL ptr access during mgmt tx cleanup - [arm64] media: venus: avoid calling core_clk_setrate() concurrently during concurrent video sessions - [x86] ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table - ACPI: Change acpi_device_always_present() into acpi_device_override_status() - [x86] ACPI / x86: Allow specifying acpi_device_override_status() quirks by path - [x86] ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win - floppy: Add max size check for user space request - [x86] mm: Flush global TLB when switching to trampoline page-table - media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() - media: m920x: don't use stack on USB reads - [x86] thunderbolt: Runtime PM activate both ends of the device link - iwlwifi: mvm: synchronize with FW after multicast commands - iwlwifi: mvm: avoid clearing a just saved session protection id - ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work - ath10k: Fix tx hanging - net-sysfs: update the queue counts in the unregistration path - net: phy: prefer 1000baseT over 1000baseKX - [armhf] gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock - ath11k: Avoid false DEADLOCK warning reported by lockdep - [x86] mce: Allow instrumentation during task work queueing - [x86] mce: Mark mce_panic() noinstr - [x86] mce: Mark mce_end() noinstr - [x86] mce: Mark mce_read_aux() noinstr - net: bonding: debug: avoid printing debug logs when bond is not notifying peers - bpf: Do not WARN in bpf_warn_invalid_xdp_action() - HID: quirks: Allow inverting the absolute X/Y values - media: igorplugusb: receiver overflow should be reported - media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() - mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO - audit: ensure userspace is penalized the same as the kernel when under pressure - [arm64] dts: ls1028a-qds: move rtc node to the correct i2c bus - PM: runtime: Add safety net to supplier device release - cpufreq: Fix initialization of min and max frequency QoS requests - usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream - rtw88: 8822c: update rx settings to prevent potential hw deadlock - iwlwifi: fix leaks/bad data after failed firmware load - iwlwifi: remove module loading failure message - iwlwifi: mvm: Fix calculation of frame length - iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ - ath11k: Fix napi related hang - Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES - xfrm: rate limit SA mapping change message to user space - [armhf] drm/etnaviv: consider completed fence seqno in hang check - jffs2: GC deadlock reading a page that is used in jffs2_write_begin() - ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions - ACPICA: Utilities: Avoid deleting the same object twice in a row - ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() - ACPICA: Fix wrong interpretation of PCC address - ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 - drm/amdgpu: fixup bad vram size on gmc v8 - ACPI: battery: Add the ThinkPad "Not Charging" quirk - btrfs: remove BUG_ON() in find_parent_nodes() - btrfs: remove BUG_ON(!eie) in find_parent_nodes - net: mdio: Demote probed message to debug print - mac80211: allow non-standard VHT MCS-10/11 - dm btree: add a defensive bounds check to insert_at() - dm space map common: add bounds check to sm_ll_lookup_bitmap() - net: phy: marvell: configure RGMII delays for 88E1118 - [arm64] regulator: qcom_smd: Align probe function with rpmh-regulator - [arm64,armhf] serial: pl010: Drop CR register reset on set_termios - serial: core: Keep mctrl register state and cached copy in sync - random: do not throw away excess input to crng_fast_load - [powerpc*] powernv: add missing of_node_put - [powerpc*] btext: add missing of_node_put - [powerpc*] watchdog: Fix missed watchdog reset due to memory ordering race - [x86] i2c: i801: Don't silently correct invalid transfer size - [powerpc*] smp: Move setup_profiling_timer() under CONFIG_PROFILING - [powerpc*] i2c: mpc: Correct I2C reset procedure - [arm64] clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB - [powerpc*] KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots - [powerpc*] KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST - w1: Misuse of get_user()/put_user() reported by sparse - nvmem: core: set size for sysfs bin file - dm: fix alloc_dax error handling in alloc_dev - scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup - ALSA: seq: Set upper limit of processed events - [powerpc*] handle kdump appropriately with crash_kexec_post_notifiers option - [powerpc*] fadump: Fix inaccurate CPU state info in vmcore generated with panic - udf: Fix error handling in udf_new_inode() - [mips64el,mipsel] OCTEON: add put_device() after of_find_device_by_node() - [arm64,armhf] irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time - [x86] i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters - scsi: sr: Don't use GFP_DMA - [arm64] rpmsg: core: Clean up resources on announce_create failure. - [armhf] crypto: stm32/crc32 - Fix kernel BUG triggered in probe() - [arm64] crypto: caam - replace this_cpu_ptr with raw_cpu_ptr - ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers - tpm: fix NPE on probe for missing device - xen/gntdev: fix unmap notification order - fuse: Pass correct lend value to filemap_write_and_wait_range() - serial: Fix incorrect rs485 polarity on uart open - cputime, cpuacct: Include guest time in user time in cpuacct.stat - tracing/kprobes: 'nmissed' not showed correctly for kretprobe - iwlwifi: mvm: Increase the scan timeout guard to 30 seconds - [s390x] mm: fix 2KB pgtable release race - device property: Fix fwnode_graph_devcon_match() fwnode leak - [armhf] drm/etnaviv: limit submit sizes - drm/nouveau/kms/nv04: use vzalloc for nv04_display - [arm64,armhf] drm/bridge: analogix_dp: Make PSR-exit block less - [powerpc*] 64s/radix: Fix huge vmap false positive - [arm64] PCI: xgene: Fix IB window setup - PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors - [arm*] PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only - [arm*] PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space - [arm*] PCI: pci-bridge-emul: Fix definitions of reserved bits - [arm*] PCI: pci-bridge-emul: Correctly set PCIe capabilities - [arm*] PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device - xfrm: fix policy lookup for ipv6 gre packets - btrfs: fix deadlock between quota enable and other quota operations - btrfs: check the root node for uptodate before returning it - btrfs: respect the max size in the header when activating swap file - ext4: make sure to reset inode lockdep class when quota enabling fails - ext4: make sure quota gets properly shutdown on error - ext4: fix a possible ABBA deadlock due to busy PA - ext4: initialize err_blk before calling __ext4_get_inode_loc - ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE - ext4: set csum seed in tmp inode while migrating to extents - ext4: Fix BUG_ON in ext4_bread when write quota data - ext4: use ext4_ext_remove_space() for fast commit replay delete range - ext4: fast commit may miss tracking unwritten range during ftruncate - ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal - ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits' - ext4: don't use the orphan list when migrating an inode - drm/radeon: fix error handling in radeon_driver_open_kms - of: base: Improve argument length mismatch error - firmware: Update Kconfig help text for Google firmware - [arm*] drm/vc4: hdmi: Make sure the device is powered with CEC - Documentation: dmaengine: Correctly describe dmatest with channel unset - Documentation: ACPI: Fix data node reference documentation - Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization - Documentation: fix firewire.rst ABI file path error - Bluetooth: hci_sync: Fix not setting adv set duration - scsi: core: Show SCMD_LAST in text form - [arm64] RDMA/hns: Modify the mapping attribute of doorbell to device - RDMA/rxe: Fix a typo in opcode name - [armhf] dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK - Revert "net/mlx5: Add retry mechanism to the command entry index allocation" - block: Fix fsync always failed if once failed - bpftool: Remove inclusion of utilities.mak from Makefiles - xdp: check prog type before updating BPF link - ipv4: update fib_info_cnt under spinlock protection - ipv4: avoid quadratic behavior in netns dismantle - [arm64] net/fsl: xgmac_mdio: Add workaround for erratum A-009885 - [arm64] net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module - f2fs: compress: fix potential deadlock of compress file - f2fs: fix to reserve space for IO align feature - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress - clk: Emit a stern warning with writable debugfs enabled - net/smc: Fix hung_task when removing SMC-R devices - virtio_ring: mark ring unused on error - taskstats: Cleanup the use of task->exit_code - inet: frags: annotate races around fqdir->dead and fqdir->high_thresh - netns: add schedule point in ops_exit_list() - xfrm: Don't accidentally set RTO_ONLINK in decode_session4() - gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst() - libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() - perf script: Fix hex dump character output - perf probe: Fix ppc64 'perf probe add events failed' case - devlink: Remove misleading internal_flags from health reporter dump - net: bonding: fix bond_xmit_broadcast return value error bug - net_sched: restore "mpu xxx" handling - [arm64] bcmgenet: add WOL IRQ check - net: sfp: fix high power modules without diagnostic monitoring - [arm64] net: mscc: ocelot: fix using match before it is set - dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property - dt-bindings: display: meson-vpu: Add missing amlogic,canvas property - dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7 - mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault - mtd: nand: bbt: Fix corner case in bad block table handling - ath10k: Fix the MTU size on QCA9377 SDIO https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.95 - bnx2x: Utilize firmware 7.13.21.0 - bnx2x: Invalidate fastpath HSI version for VFs - rcu: Tighten rcu_advance_cbs_nowake() checks - [x86] KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU - select: Fix indefinitely sleeping task in poll_schedule_timeout() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.96 - Bluetooth: refactor malicious adv data check - [arm64] media: venus: core: Drop second v4l2 device unregister - net: sfp: ignore disabled SFP node - net: stmmac: skip only stmmac_ptp_register when resume from suspend - [s390x] module: fix loading modules with a lot of relocations - [s390x] hypfs: include z/VM guests with access control group set - bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack() - [s390x] scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices - udf: Restore i_lenAlloc when inode expansion fails (CVE-2022-0617) - udf: Fix NULL ptr deref when converting from inline format (CVE-2022-0617) - efi: runtime: avoid EFIv2 runtime services on Apple x86 machines - tracing: Don't inc err_log entry count if entry allocation fails - ceph: properly put ceph_string reference after async create attempt - ceph: set pool_ns in new inode layout for async creates - fsnotify: fix fsnotify hooks in pseudo filesystems - Revert "KVM: SVM: avoid infinite loop on NPF from bad address" - [x86] perf/x86/intel/uncore: Fix CAS_COUNT_WRITE issue for ICX - [armhf] drm/etnaviv: relax submit size limits - [x86] KVM: x86: Update vCPU's runtime CPUID on write to MSR_IA32_XSS - [arm64] errata: Fix exec handling in erratum 1418040 workaround - netfilter: nft_payload: do not update layer 4 checksum when mangling fragments - serial: 8250: of: Fix mapped region size when using reg-offset property - [armhf] serial: stm32: fix software flow control transfer - tty: n_gsm: fix SW flow control encoding/handling - tty: Add support for Brainboxes UC cards. - usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge - [arm64,armhf] usb: xhci-plat: fix crash when suspend if remote wake enable - [arm64,armhf] usb: common: ulpi: Fix crash in ulpi_match() - usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS - USB: core: Fix hang in usb_kill_urb by adding memory barriers - usb: typec: tcpm: Do not disconnect while receiving VBUS off - jbd2: export jbd2_journal_[grab|put]_journal_head - ocfs2: fix a deadlock when commit trans - sched/membarrier: Fix membarrier-rseq fence command missing from query bitmask - [x86] MCE/AMD: Allow thresholding interface updates after init - i40e: Increase delay to 1 s after global EMP reset - i40e: Fix issue when maximum queues is exceeded - i40e: Fix queues reservation for XDP - i40e: Fix for failed to init adminq while VF reset - i40e: fix unsigned stat widths - scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() - ipv6_tunnel: Rate limit warning messages - net: fix information leakage in /proc/net/ptype - hwmon: (lm90) Mark alert as broken for MAX6646/6647/6649 - hwmon: (lm90) Mark alert as broken for MAX6680 - ping: fix the sk_bound_dev_if match in ping_lookup - ipv4: avoid using shared IP generator for connected sockets - hwmon: (lm90) Reduce maximum conversion rate for G781 - NFSv4: nfs_atomic_open() can race when looking up a non-regular file - net-procfs: show net devices bound packet types - [arm64] drm/msm: Fix wrong size calculation - [arm64] drm/msm/dsi: Fix missing put_device() call in dsi_get_phy - [arm64] drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable - ipv6: annotate accesses to fn->fn_sernum - NFS: Ensure the server has an up to date ctime before hardlinking - NFS: Ensure the server has an up to date ctime before renaming - [powerpc*] powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06 - netfilter: conntrack: don't increment invalid counter on NF_REPEAT - kernel: delete repeated words in comments - perf: Fix perf_event_read_local() time - sched/pelt: Relax the sync of util_sum with util_avg - net: phy: broadcom: hook up soft_reset for BCM54616S - phylib: fix potential use-after-free - rxrpc: Adjust retransmission backoff - [arm64] efi/libstub: arm64: Fix image check alignment at entry - hwmon: (lm90) Mark alert as broken for MAX6654 - [powerpc*] perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending - net: ipv4: Move ip_options_fragment() out of loop - net: ipv4: Fix the warning for dereference - ipv4: fix ip option filtering for locally generated fragments - [x86] video: hyperv_fb: Fix validation of screen resolution - [arm64] drm/msm/hdmi: Fix missing put_device() call in msm_hdmi_get_phy - [arm64] drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc - [armhf] net: cpsw: Properly initialise struct page_pool_params - [arm64] net: hns3: handle empty unknown interrupt for VF - Revert "ipv6: Honor all IPv6 PIO Valid Lifetime values" - net: bridge: vlan: fix single net device option dumping - ipv4: raw: lock the socket in raw_bind() - ipv4: tcp: send zero IPID in SYNACK messages - ipv4: remove sparse error in ip_neigh_gw4() - net: bridge: vlan: fix memory leak in __allowed_ingress - dt-bindings: can: tcan4x5x: fix mram-cfg RX FIFO config - fsnotify: invalidate dcache before IN_DELETE event - block: Fix wrong offset in bio_truncate() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.97 - PCI: pciehp: Fix infinite loop in IRQ handler upon power fault - [x86] KVM: x86: Forcibly leave nested virt when SMM state is toggled - psi: Fix uaf issue when psi trigger is destroyed while being polled - [x86] mce: Add Xeon Sapphire Rapids to list of CPUs that support PPIN - [x86] cpu: Add Xeon Icelake-D to list of CPUs that support PPIN - [arm*] drm/vc4: hdmi: Make sure the device is powered with CEC - cgroup-v1: Require capabilities to set release_agent (CVE-2022-0492) - net/mlx5e: Fix handling of wrong devices during bond netevent - net/mlx5: Use del_timer_sync in fw reset flow of halting poll - net/mlx5: E-Switch, Fix uninitialized variable modact - ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback - [amd64,arm64] net: amd-xgbe: ensure to reset the tx_timer_active flag - [amd64,arm64] net: amd-xgbe: Fix skb data length underflow - fanotify: Fix stale file descriptor in copy_event_to_user() - net: sched: fix use-after-free in tc_new_tfilter() - rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() - cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask() - af_packet: fix data-race in packet_setsockopt / packet_setsockopt - tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.98 - [arm*] Revert "drm/vc4: hdmi: Make sure the device is powered with CEC" - [arm*] Revert "drm/vc4: hdmi: Make sure the device is powered with CEC" again https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.99 - selinux: fix double free of cond_list on error paths - audit: improve audit queue handling when "audit=1" on cmdline - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() - ALSA: usb-audio: Correct quirk for VF0770 - ALSA: hda: Fix UAF of leds class devs at unbinding - ALSA: hda: realtek: Fix race at concurrent COEF updates - ALSA: hda/realtek: Add quirk for ASUS GU603 - ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks - ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) - ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows - btrfs: fix deadlock between quota disable and qgroup rescan worker - drm/nouveau: fix off by one in BIOS boundary checking - mm/pgtable: define pte_index so that preprocessor could recognize it - block: bio-integrity: Advance seed correctly for larger interval sizes - dma-buf: heaps: Fix potential spectre v1 gadget - [amd64] IB/hfi1: Fix AIP early init panic - memcg: charge fs_context and legacy_fs_context - RDMA/cma: Use correct address when leaving multicast group - RDMA/ucma: Protect mc during concurrent multicast leaves - [amd64] IB/rdmavt: Validate remote_addr during loopback atomic tests - RDMA/mlx4: Don't continue event handler after memory allocation failure - [amd64] iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() - [amd64] iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() - [arm64,armhf] spi: meson-spicc: add IRQ check in meson_spicc_probe - net: ieee802154: hwsim: Ensure proper channel selection at probe time - net: ieee802154: Return meaningful error codes from the netlink helpers - net: macsec: Fix offload support for NETDEV_UNREGISTER event - net: macsec: Verify that send_sci is on when setting Tx sci explicitly - net: stmmac: dump gmac4 DMA registers correctly - net: stmmac: ensure PTP time register reads are consistent - [x86] drm/i915/overlay: Prevent divide by zero bugs in scaling - [x86] pinctrl: intel: Fix a glitch when updating IRQ flags on a preconfigured line - [x86] pinctrl: intel: fix unexpected interrupt - [arm*] pinctrl: bcm2835: Fix a few error paths - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe - nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client. - [amd64,arm64] gve: fix the wrong AdminQ buffer queue index check - bpf: Use VM_MAP instead of VM_ALLOC for ringbuf - rtc: cmos: Evaluate century appropriate - Revert "fbcon: Disable accelerated scrolling" - fbcon: Add option to enable legacy hardware acceleration - perf stat: Fix display of grouped aliased events - [x86] perf/x86/intel/pt: Fix crash with stop filters in single-range mode - [x86] perf: Default set FREEZE_ON_SMI for all - [arm64] EDAC/xgene: Fix deferred probing - ext4: prevent used blocks from being allocated during fast commit replay - ext4: modify the logic of ext4_mb_new_blocks_simple - ext4: fix error handling in ext4_restore_inline_data() - ext4: fix error handling in ext4_fc_record_modified_inode() - ext4: fix incorrect type issue during replay_del_range - cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.100 - moxart: fix potential use-after-free on remove path (CVE-2022-0487) - crypto: api - Move cryptomgr soft dependency into algapi https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.101 - integrity: check the return value of audit_log_start() - [arm64] mmc: sdhci-of-esdhc: Check for error num after setting mask - can: isotp: fix potential CAN frame reception race in isotp_rcv() - net: phy: marvell: Fix RGMII Tx/Rx delays setting in 88e1121-compatible PHYs - net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs - NFS: Fix initialisation of nfs_client cl_flags field - NFSD: Clamp WRITE offsets - NFSD: Fix offset type in I/O trace points - drm/amdgpu: Set a suitable dev_info.gart_page_size (Closes: #990279) - NFS: change nfs_access_get_cached to only report the mask - NFSv4 only print the label when its queried - nfs: nfs4clinet: check the return value of kstrdup() - NFSv4.1: Fix uninitialised variable in devicenotify - NFSv4 remove zero number of fs_locations entries error check - NFSv4 expose nfs_parse_server_name function - NFSv4 handle port presence in fs_location server string - [x86] perf: Avoid warning for Arch LBR without XSAVE - drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer - net: sched: Clarify error message when qdisc kind is unknown - [powerpc*] fixmap: Fix VM debug warning on unmap - scsi: target: iscsi: Make sure the np under each tpg is unique - scsi: qedf: Add stag_work to all the vports - scsi: qedf: Fix refcount issue when LOGO is received during TMF - scsi: pm8001: Fix bogus FW crash for maxcpus=1 - scsi: ufs: Treat link loss as fatal error - scsi: myrs: Fix crash in error case - PM: hibernate: Remove register_nosave_region_late() - [arm*] usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend - perf: Always wake the parent event - nvme-pci: add the IGNORE_DEV_SUBNQN quirk for Intel P4500/P4600 SSDs - [arm64,armhf] net: stmmac: dwmac-sun8i: use return val of readl_poll_timeout() - KVM: eventfd: Fix false positive RCU usage warning - [x86] KVM: nVMX: eVMCS: Filter out VM_EXIT_SAVE_VMX_PREEMPTION_TIMER - [x86] KVM: nVMX: Also filter MSR_IA32_VMX_TRUE_PINBASED_CTLS when eVMCS - [x86] KVM: SVM: Don't kill SEV guest if SMAP erratum triggers in usermode - [x86] KVM: VMX: Set vmcs.PENDING_DBG.BS on #DB in STI/MOVSS blocking shadow - nvme-tcp: fix bogus request completion when failing to send AER - [arm64] ACPI/IORT: Check node revision for PMCG resources - PM: s2idle: ACPI: Fix wakeup interrupts handling - [arm64,armhf] drm/rockchip: vop: Correct RK3399 VOP register fields - [armhf] ARM: dts: Fix timer regression for beagleboard revision c - usb: f_fs: Fix use-after-free for epfile - [arm*] drm/vc4: hdmi: Allow DBLCLK modes even if horz timing is odd. - netfilter: ctnetlink: disable helper autoassign - ixgbevf: Require large buffers for build_skb on 82599VF - [arm64,armhf] drm/panel: simple: Assign data from panel_dpi_probe() correctly - ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE - bonding: pair enable_port with slave_arr_updates - [arm64,armhf] net: dsa: mv88e6xxx: don't use devres for mdiobus - [armhf] net: dsa: bcm_sf2: don't use devres for mdiobus - [arm64] net: dsa: felix: don't use devres for mdiobus - ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path - nfp: flower: fix ida_idx not being released - net: do not keep the dst cache when uncloning an skb dst and its metadata - net: fix a memleak when uncloning an skb dst and its metadata - veth: fix races around rq->rx_notify_masked - [armhf] net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE - tipc: rate limit warning for received illegal binding update - [amd64,arm64] net: amd-xgbe: disable interrupts during pci removal - [arm64] dpaa2-eth: unregister the netdev before disconnecting from the PHY - ice: fix an error code in ice_cfg_phy_fec() - ice: fix IPIP and SIT TSO offload - [arm64] net: mscc: ocelot: fix mutex lock error during ethtool stats read - [arm64,armhf] net: dsa: mv88e6xxx: fix use-after-free in mv88e6xxx_mdios_unregister - vt_ioctl: fix array_index_nospec in vt_setactivate - vt_ioctl: add array_index_nospec to VT_ACTIVATE - n_tty: wake up poll(POLLRDNORM) on receiving data - eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX - [arm*] usb: dwc2: drd: fix soft connect when gadget is unconfigured - [arm*] Revert "usb: dwc2: drd: fix soft connect when gadget is unconfigured" - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup - [arm64,armhf] usb: ulpi: Move of_node_put to ulpi_dev_release - [arm64,armhf] usb: ulpi: Call of_node_put correctly - [arm64,armhf] usb: dwc3: gadget: Prevent core from processing stale TRBs - usb: gadget: f_uac2: Define specific wTerminalType - USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 - USB: serial: option: add ZTE MF286D modem - USB: serial: ch341: add support for GW Instek USB2.0-Serial devices - USB: serial: cp210x: add NCR Retail IO box id - USB: serial: cp210x: add CPI Bulk Coin Recycler id - speakup-dectlk: Restore pitch setting - [x86] hwmon: (dell-smm) Speed up setting of fan speed - can: isotp: fix error path in isotp_sendmsg() to unlock wait queue - scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled - scsi: lpfc: Reduce log messages seen after firmware download - perf: Fix list corruption in perf_cgroup_switch() - iommu: Fix potential use-after-free during probe https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.102 - drm/nouveau/pmu/gm200-: use alternate falcon reset sequence - mm: memcg: synchronize objcg lists with a dedicated spinlock - rcu: Do not report strict GPs for outgoing CPUs - fget: clarify and improve __fget_files() implementation - fs/proc: task_mmu.c: don't read mapcount for migration entry - can: isotp: prevent race between isotp_bind() and isotp_setsockopt() - can: isotp: add SF_BROADCAST support for functional addressing - scsi: lpfc: Fix mailbox command failure during driver initialization - HID:Add support for UGTABLET WP5540 - [x86] Revert "svm: Add warning message for AVIC IPI invalid target" - mmc: block: fix read single on recovery logic - mm: don't try to NUMA-migrate COW pages that have other uses - [amd64] PCI: hv: Fix NUMA node assignment when kernel boots with custom NUMA topology - btrfs: send: in case of IO error log it - net: ieee802154: at86rf230: Stop leaking skb's - ax25: improve the incomplete fix to avoid UAF and NPD bugs - vfs: make freeze_super abort when sync_filesystem returns error - quota: make dquot_quota_sync return errors from ->sync_fs - scsi: pm8001: Fix use-after-free for aborted TMF sas_task - scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task - nvme: fix a possible use-after-free in controller reset during load - nvme-tcp: fix possible use-after-free in transport error_recovery work - nvme-rdma: fix possible use-after-free in transport error_recovery work - drm/amdgpu: fix logic inversion in check - [amd64] x86/Xen: streamline (and fix) PV CPU enumeration - Revert "module, async: async_synchronize_full() on module init iff async is used" - random: wake up /dev/random writers after zap - iwlwifi: fix use-after-free - drm/radeon: Fix backlight control on iMac 12,1 - [x86] drm/i915/opregion: check port number bounds for SWSCI display power state - vsock: remove vsock from connected table when connect is interrupted by a signal - [x86] drm/i915/gvt: Make DRM_I915_GVT depend on X86 - iwlwifi: pcie: fix locking when "HW not ready" - iwlwifi: pcie: gen2: fix locking when "HW not ready" - netfilter: nft_synproxy: unregister hooks on init error path - ipv6: per-netns exclusive flowlabel checks - net: dsa: lantiq_gswip: fix use after free in gswip_remove() - ping: fix the dif and sdif check in ping_lookup - bonding: force carrier update when releasing slave - drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit - net_sched: add __rcu annotation to netdev->qdisc - bonding: fix data-races around agg_select_timer - libsubcmd: Fix use-after-free for realloc(..., 0) - [arm64] dpaa2-eth: Initialize mutex used in one step timestamping path - ALSA: hda/realtek: Add quirk for Legion Y9000X 2019 - ALSA: hda/realtek: Fix deadlock by COEF mutex - ALSA: hda: Fix regression on forced probe mask option - ALSA: hda: Fix missing codec probe on Shenker Dock 15 - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() - [powerpc*[ lib/sstep: fix 'ptesync' build error - [armhf] mtd: rawnand: gpmi: don't leak PM reference in error path - [x86] KVM: SVM: Never reject emulation due to SMAP errata for !SEV guests (CVE-2020-36310) - block/wbt: fix negative inflight counter when remove scsi device - NFS: LOOKUP_DIRECTORY is also ok with symlinks - NFS: Do not report writeback errors in nfs_getattr() - tty: n_tty: do not look ahead for EOL character past the end of the buffer - [x86] Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj - [x86] KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id() - [x86] KVM: x86/pmu: Don't truncate the PerfEvtSeln MSR when creating a perf event - [x86] KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW - NFS: Don't set NFS_INO_INVALID_XATTR if there is no xattr cache - [armhf] OMAP2+: hwmod: Add of_node_put() before break - [armhf] OMAP2+: adjust the location of put_device() call in omapdss_init_of - netfilter: conntrack: don't refresh sctp entries in closed state - kconfig: let 'shell' return enough output for deep path names - ata: libata-core: Disable TRIM on M88V29 - [armhf] soc: aspeed: lpc-ctrl: Block error printing on probe defer cases - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create - [arm64,armhf] drm/rockchip: dw_hdmi: Do not leave clock enabled in error case - tracing: Fix tp_printk option related with tp_printk_stop_on_boot - net: usb: qmi_wwan: Add support for Dell DW5829e - [arm64] net: macb: Align the dma and coherent dma masks - kconfig: fix failing to generate auto.conf - scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop - EDAC: Fix calculation of returned address and next offset in edac_align_ptr() - net: sched: limit TC_ACT_REPEAT loops - [armhf] dmaengine: stm32-dmamux: Fix PM disable depth imbalance in stm32_dmamux_probe - copy_process(): Move fd_install() out of sighand->siglock critical section - [arm*] i2c: brcmstb: fix support for DSL and CM variants https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.103 - cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug - btrfs: tree-checker: check item_size for inode_item - btrfs: tree-checker: check item_size for dev_item - vhost/vsock: don't check owner in vhost_vsock_stop() while releasing - [x86] KVM: x86/mmu: make apf token non-zero to fix bug - drm/amdgpu: disable MMHUB PG for Picasso - [x86] drm/i915: Correctly populate use_sagv_wm for all pipes - sr9700: sanity check for packet length - USB: zaurus: support another broken Zaurus - CDC-NCM: avoid overflow in sanity checking - netfilter: nf_tables_offload: incorrect flow offload action array size (CVE-2022-25636) - [x86] fpu: Correct pkru/xstate inconsistency - [arm64] tee: export teedev_open() and teedev_close_context() - [arm64] optee: use driver internal tee_context for some rpc - ping: remove pr_err from ping_lookup - perf data: Fix double free in perf_session__delete() - bnx2x: fix driver load from initrd - bnxt_en: Fix active FEC reporting to ethtool - hwmon: Handle failure to register sensor with thermal zone correctly - bpf: Do not try bpf_msg_push_data with len 0 - bpf: Add schedule points in batch ops - io_uring: add a schedule point in io_add_buffers() - net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends - tipc: Fix end of loop tests for list_for_each_entry() - gso: do not skip outer ip header in case of ipip and net_failover - openvswitch: Fix setting ipv6 fields causing hw csum failure - drm/edid: Always set RGB444 - net/mlx5e: Fix wrong return value on ioctl EEPROM query failure - net/sched: act_ct: Fix flow table lookup after ct clear or switching zones - net: Force inlining of checksum functions in net/checksum.h - nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() - netfilter: nf_tables: fix memory leak during stateful obj update - net/smc: Use a mutex for locking "struct smc_pnettable" - udp_tunnel: Fix end of loop test in udp_tunnel_nic_unregister() - net/mlx5: Fix possible deadlock on rule deletion - net/mlx5: Fix wrong limitation of metadata match on ecpf - net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets - regmap-irq: Update interrupt clear register for proper reset - configfs: fix a race in configfs_{,un}register_subsystem() - RDMA/ib_srp: Fix a deadlock - tracing: Have traceon and traceoff trigger honor the instance - iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits - iio: imu: st_lsm6dsx: wait for settling time in st_lsm6dsx_read_oneshot - iio: Fix error handling for PM - ata: pata_hpt37x: disable primary channel on HPT371 - Revert "USB: serial: ch341: add new Product ID for CH341A" - usb: gadget: rndis: add spinlock for rndis response list - tracefs: Set the group ownership in apply_options() not parse_options() - USB: serial: option: add support for DW5829e - USB: serial: option: add Telit LE910R1 compositions - [arm*] usb: dwc2: drd: fix soft connect when gadget is unconfigured - [arm64] usb: dwc3: pci: Fix Bay Trail phy GPIO mappings - [arm64,armhf] usb: dwc3: gadget: Let the interrupt handler disable bottom halves. - xhci: re-initialize the HC during resume if HCE was set - xhci: Prevent futile URB re-submissions due to incorrect return value. - driver core: Free DMA range map when device is released - RDMA/cma: Do not change route.addr.src_addr outside state checks - [x86] thermal: int340x: fix memory leak in int3400_notify() - tty: n_gsm: fix encoding of control signal octet bit DV - tty: n_gsm: fix proper link termination after failed open - tty: n_gsm: fix NULL pointer access due to DLCI release - tty: n_gsm: fix wrong tty control line for flow control - tty: n_gsm: fix deadlock in gsmtty_open() - memblock: use kfree() to release kmalloced memblock regions [ Salvatore Bonaccorso ] * Refresh "Makefile: Do not check for libelf when building OOT module" * Bump ABI to 12 * Refresh "firmware: Remove redundant log messages from drivers" * [rt] Refresh "locking/rtmutex: add sleeping lock implementation" * [rt] Refresh "cpuset: Convert callback_lock to raw_spinlock_t" * [rt] Update to 5.10.100-rt62 * Mitigate Spectre v2-type Branch History Buffer attacks (CVE-2022-0001, CVE-2022-0002) - [x86] bugs: Unconditionally allow spectre_v2=retpoline,amd - [x86] speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE - [x86] speculation: Add eIBRS + Retpoline options - Documentation/hw-vuln: Update spectre doc - [x86] speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting - [x86] speculation: Use generic retpoline by default on AMD - [x86] speculation: Update link to AMD speculation whitepaper - [x86] speculation: Warn about Spectre v2 LFENCE mitigation - [x86] speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT -- Salvatore Bonaccorso Mon, 07 Mar 2022 22:06:21 +0100 linux (5.10.92-2) bullseye-security; urgency=high * lib/iov_iter: initialize "flags" in new pipe_buffer * [x86] mwifiex: Fix skb_over_panic in mwifiex_usb_recv() (CVE-2021-43976) * [x86] drm/i915: Flush TLBs before releasing backing store (CVE-2022-0330) * [x86] drm/vmwgfx: Fix stale file descriptors on failed usercopy (CVE-2022-22942) * NFSv4: Handle case where the lookup of a directory fails (CVE-2022-24448) * yam: fix a memory leak in yam_siocdevprivate() (CVE-2022-24959) * tipc: improve size validations for received domain records (CVE-2022-0435) * [s390x] KVM: s390: Return error on SIDA memop on normal guest (CVE-2022-0516) * USB: gadget: validate interface OS descriptor requests (CVE-2022-25258) * usb: gadget: rndis: check size of RNDIS_MSG_SET command (CVE-2022-25375) -- Salvatore Bonaccorso Mon, 28 Feb 2022 12:23:03 +0100 linux (5.10.92-1) bullseye-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.85 - usb: gadget: uvc: fix multiple opens - gcc-plugins: simplify GCC plugin-dev capability test - gcc-plugins: fix gcc 11 indigestion with plugins... - HID: quirks: Add quirk for the Microsoft Surface 3 type-cover - HID: add hid_is_usb() function to make it simpler for USB detection - HID: bigbenff: prevent null pointer dereference - HID: wacom: fix problems when device is not a valid USB device - HID: check for valid USB device for many HID drivers - [amd64] nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups - [amd64] IB/hfi1: Insure use of smp_processor_id() is preempt disabled - [amd64] IB/hfi1: Fix early init panic - [amd64] IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr - can: kvaser_usb: get CAN clock frequency from device - [x86] can: sja1000: fix use after free in ems_pcmcia_add_card() - drm/amdgpu: move iommu_resume before ip init/resume - drm/amdgpu: init iommu after amdkfd device init - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done - vrf: don't run conntrack on vrf with !dflt qdisc - bpf, x86: Fix "no previous prototype" warning - bpf: Fix the off-by-two error in range markings - ice: ignore dropped packets during init - bonding: make tx_rebalance_counter an atomic - nfp: Fix memory leak in nfp_cpp_area_cache_add() - seg6: fix the iif in the IPv6 socket control block - udp: using datalen to cap max gso segments - netfilter: conntrack: annotate data-races around ct->timeout - iavf: restore MSI state on reset - iavf: Fix reporting when setting descriptor count - [amd64] IB/hfi1: Correct guard on eager buffer deallocation - devlink: fix netns refcount leak in devlink_nl_cmd_reload() - net/sched: fq_pie: prevent dismantle issue - [x86] KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall - mm: bdi: initialize bdi_min_ratio when bdi is unregistered - ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform - ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1 - ALSA: pcm: oss: Fix negative period/buffer sizes - ALSA: pcm: oss: Limit the period size to 16MB - ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() - scsi: qla2xxx: Format log strings only if needed - btrfs: clear extent buffer uptodate when we fail to write it - btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling - md: fix update super 1.0 on rdev size change - nfsd: fix use-after-free due to delegation race (Closes: #988044) - nfsd: Fix nsfd startup race (again) - tracefs: Have new files inherit the ownership of their parent - [arm64] clk: qcom: regmap-mux: fix parent clock lookup - drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence. - [i386] can: pch_can: pch_can_rx_normal: fix use after free - libata: add horkage for ASMedia 1092 - wait: add wake_up_pollfree() - binder: use wake_up_pollfree() - signalfd: use wake_up_pollfree() - aio: keep poll requests on waitqueue until completed - aio: fix use-after-free due to missing POLLFREE handling - [arm64,armhf] net: mvpp2: fix XDP rx queues registering - tracefs: Set all files to the same group ownership as the mount option - block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) - scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc() - scsi: scsi_debug: Fix buffer size of REPORT ZONES command - qede: validate non LSO skb length - PM: runtime: Fix pm_runtime_active() kerneldoc comment - ASoC: rt5682: Fix crash due to out of scope stack vars - [arm64] RDMA/hns: Do not halt commands during reset until later - [arm64] RDMA/hns: Do not destroy QP resources in the hw resetting phase - i40e: Fix failed opcode appearing if handling messages from VF - i40e: Fix pre-set max number of queues for VF - i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc - [arm64] Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge" - Documentation/locking/locktypes: Update migrate_disable() bits. - dt-bindings: net: Reintroduce PHY no lane swap binding - net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero - [arm64,armhf] net: fec: only clear interrupt of handling queue in fec_enet_rx_queue() - net, neigh: clear whole pneigh_entry at alloc time - net/qla3xxx: fix an error code in ql_adapter_up() - USB: gadget: detect too-big endpoint 0 requests (CVE-2021-39685) - USB: gadget: zero allocate endpoint 0 buffers (CVE-2021-39685) - usb: core: config: fix validation of wMaxPacketValue entries - xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending - usb: core: config: using bit mask instead of individual bits - xhci: avoid race between disable slot command and host runtime suspend - iio: gyro: adxrs290: fix data signedness - iio: trigger: Fix reference counting - iio: stk3310: Don't return error code in interrupt handler - iio: mma8452: Fix trigger reference couting - iio: ltr501: Don't return error code in trigger handler - iio: kxsd9: Don't return error code in trigger handler - iio: itg3200: Call iio_trigger_notify_done() on error - iio: adc: axp20x_adc: fix charging current reporting on AXP22x - iio: ad7768-1: Call iio_trigger_notify_done() on error - iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove - [armhf] irqchip/aspeed-scu: Replace update_bits with write_bits. - [armhf] irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() - [armhf] irqchip/armada-370-xp: Fix support for Multi-MSI interrupts - [arm64,armhf] irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL - kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc - doc: gcc-plugins: update gcc-plugins.rst - MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal - Documentation/Kbuild: Remove references to gcc-plugin.sh https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.86 https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.87 - nfc: fix segfault in nfc_genl_dump_devices_done - [arm64] drm/msm/dsi: set default num_data_lanes - [arm64] KVM: arm64: Save PSTATE early on exit - [arm64] Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP" - net/mlx4_en: Update reported link modes for 1/10G - ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid - ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P - [arm64,armhf] i2c: rk3x: Handle a spurious start completion interrupt flag - net: netlink: af_netlink: Prevent empty skb by adding a check on len. - [x86] KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse IPI req - bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc - fuse: make sure reclaim doesn't write the inode - [x86] hwmon: (dell-smm) Fix warning on /proc/i8k creation error - ethtool: do not perform operations on net devices being unregistered - [armel,armhf] memblock: free_unused_memmap: use pageblock units instead of MAX_ORDER - [armel,armhf] memblock: align freed memory map on pageblock boundaries with SPARSEMEM - memblock: ensure there is no overflow in memblock_overlaps_region() - [armel,armhf] arm: extend pfn_valid to take into account freed memory map alignment - [armel,armhf] arm: ioremap: don't abuse pfn_valid() to check if pfn is in RAM https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.88 - KVM: downgrade two BUG_ONs to WARN_ON_ONCE - mac80211: fix regression in SSN handling of addba tx - mac80211: mark TX-during-stop for TX in in_reconfig - mac80211: send ADDBA requests using the tid/queue of the aggregation session - mac80211: validate extended element ID is present - bpf: Fix signed bounds propagation after mov32 - bpf: Make 32->64 bounds propagation slightly more robust - virtio_ring: Fix querying of maximum DMA mapping size for virtio device - dm btree remove: fix use after free in rebalance_children() - audit: improve robustness of the audit queue handling - [arm64] dts: imx8mp-evk: Improve the Ethernet PHY description - [arm64] dts: rockchip: fix rk3308-roc-cc vcc-sd supply - [arm64] dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply - mac80211: track only QoS data frames for admission control - ceph: fix duplicate increment of opened_inodes metric - ceph: initialize pathlen variable in reconnect_caps_cb - [armhf] socfpga: dts: fix qspi node compatible - clk: Don't parent clks until the parent is fully registered - [armhf] soc: imx: Register SoC device only on i.MX boards - virtio/vsock: fix the transport to work with VMADDR_CID_ANY - [s390x] kexec_file: fix error handling when applying relocations - sch_cake: do not call cake_destroy() from cake_init() - inet_diag: fix kernel-infoleak for UDP sockets - [arm64] net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg - net/sched: sch_ets: don't remove idle classes from the round-robin list - drm/ast: potential dereference of null pointer - mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock - mac80211: fix lookup when adding AddBA extension element - flow_offload: return EOPNOTSUPP for the unsupported mpls action type - rds: memory leak in __rds_conn_create() (CVE-2021-45480) - [arm64,armhf] soc/tegra: fuse: Fix bitwise vs. logical OR warning - igb: Fix removal of unicast MAC filters of VFs - igbvf: fix double free in `igbvf_probe` - igc: Fix typo in i225 LTR functions - ixgbe: Document how to enable NBASE-T support - ixgbe: set X550 MDIO speed before talking to PHY - netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc (CVE-2021-4135) - net/packet: rx_owner_map depends on pg_vec - sfc_ef100: potential dereference of null pointer - net: Fix double 0x prefix print in SKB dump - net/smc: Prevent smc_release() from long blocking - sit: do not call ipip6_dev_free() from sit_init_net() - USB: gadget: bRequestType is a bitfield, not a enum - Revert "usb: early: convert to readl_poll_timeout_atomic()" - [x86] KVM: x86: Drop guest CPUID check for host initiated writes to MSR_IA32_PERF_CAPABILITIES - [x86] tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous - USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04) - [arm*] usb: dwc2: fix STM ID/VBUS detection startup delay in dwc2_driver_probe - PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error - PCI/MSI: Mask MSI-X vectors only on success - usb: xhci: Extend support for runtime power management for AMD's Yellow carp. - USB: serial: cp210x: fix CP2105 GPIO registration - USB: serial: option: add Telit FN990 compositions - btrfs: fix memory leak in __add_inode_ref() - btrfs: fix double free of anon_dev after failure to create subvolume - zonefs: add MODULE_ALIAS_FS - iocost: Fix divide-by-zero on donation from low hweight cgroup - [x86] serial: 8250_fintek: Fix garbled text for console - timekeeping: Really make sure wall_to_monotonic isn't positive - libata: if T_LENGTH is zero, dma direction should be DMA_NONE - drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE - Input: touchscreen - avoid bitwise vs logical OR warning - xsk: Do not sleep in poll() when need_wakeup set - media: mxl111sf: change mutex_init() location - fuse: annotate lock in fuse_reverse_inval_entry() - ovl: fix warning in ovl_create_real() - scsi: scsi_debug: Don't call kcalloc() if size arg is zero - scsi: scsi_debug: Fix type in min_t to avoid stack OOB - scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() - rcu: Mark accesses to rcu_state.n_force_qs - [armhf] bus: ti-sysc: Fix variable set but not used warning for reinit_modules - Revert "xsk: Do not sleep in poll() when need_wakeup set" - xen/blkfront: harden blkfront against event channel storms (CVE-2021-28711) - xen/netfront: harden netfront against event channel storms (CVE-2021-28712) - xen/console: harden hvc_xen against event channel storms (CVE-2021-28713) - xen/netback: fix rx queue stall detection (CVE-2021-28714) - xen/netback: don't queue unlimited number of packages (CVE-2021-28715) https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.89 - net: usb: lan78xx: add Allied Telesis AT29M2-AF - ext4: prevent partial update of the extent blocks - ext4: check for out-of-order index extents in ext4_valid_extent_entries() - ext4: check for inconsistent extents between index and leaf block - HID: holtek: fix mouse probing - [arm64] dts: allwinner: orangepi-zero-plus: fix PHY mode - [arm64] spi: change clk_disable_unprepare to clk_unprepare - [amd64] IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() - [arm64] RDMA/hns: Replace kfree() with kvfree() - netfilter: fix regression in looped (broad|multi)cast's MAC handling - qlcnic: potential dereference null pointer of rx_queue->page_ring - net: accept UFOv6 packages in virtio_net_hdr_to_skb - net: skip virtio_net_hdr_set_proto if protocol already set - igb: fix deadlock caused by taking RTNL in RPM resume path - ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module - bonding: fix ad_actor_system option setting to default - [amd64] fjes: Check for error irq - [armhf] drivers: net: smc911x: Check for error irq - sfc: Check null pointer of rx_queue->page_ring - sfc: falcon: Check null pointer of rx_queue->page_ring - Input: elantech - fix stack out of bound access in elantech_change_report_id() - [arm*] pinctrl: bcm2835: Change init order for gpio hogs - hwmon: (lm90) Fix usage of CONFIG2 register in detect function - hwmon: (lm90) Add basic support for TI TMP461 - hwmon: (lm90) Introduce flag indicating extended temperature support - hwmon: (lm90) Drop critical attribute support for MAX6654 - ALSA: jack: Check the return value of kstrdup() - ALSA: drivers: opl3: Fix incorrect use of vp->state - ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6 - ALSA: hda/realtek: Add new alc285-hp-amp-init model - ALSA: hda/realtek: Fix quirk for Clevo NJ51CU - Input: atmel_mxt_ts - fix double free in mxt_read_info_block - ipmi: bail out if init_srcu_struct fails - ipmi: ssif: initialize ssif_info->client early - ipmi: fix initialization when workqueue allocation fails - [arm64] tee: handle lookup of shm with reference count 0 - [x86] pkey: Fix undefined behaviour with PKRU_WD_BIT - [x86] platform/x86: intel_pmc_core: fix memleak on registration failure - [x86] KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this vCPU - [armhf] pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines - [arm64,armhf] mmc: sdhci-tegra: Fix switch to HS400ES mode - mmc: core: Disable card detect during shutdown - [arm64,armhf] mmc: mmci: stm32: clear DLYB_CR after sending tuning command - [armel,armhf] 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling - mac80211: fix locking in ieee80211_start_ap error path - mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() - [arm64] tee: optee: Fix incorrect page free bug - f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() (CVE-2021-45469) - ceph: fix up non-directory creation in SGID directories - usb: gadget: u_ether: fix race in setting MAC address in setup phase - [x86] KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state - mm: mempolicy: fix THP allocations escaping mempolicy restrictions - [arm64] Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312 - Input: goodix - add id->model mapping for the "9111" model - ASoC: rt5682: fix the wrong jack type detected - hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681 - hwmon: (lm90) Do not report 'busy' status bit as alarm - ax25: NPD bug when detaching AX25 device - hamradio: defer ax25 kfree after unregister_netdev - hamradio: improve the incomplete fix to avoid NPD - phonet/pep: refuse to enable an unbound pipe https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.90 - Input: i8042 - add deferred probe support - Input: i8042 - enable deferred probe quirk for ASUS UM325UA - tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok(). - tomoyo: use hwight16() in tomoyo_domain_quota_is_ok() - [x86] platform/x86: apple-gmux: use resource_size() with res - memblock: fix memblock_phys_alloc() section mismatch error - selinux: initialize proto variable in selinux_ip_postroute_compat() - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() - net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources - net/mlx5e: Wrap the tx reporter dump callback to extract the sq - net/mlx5e: Fix ICOSQ recovery flow for XSK - udp: using datalen to cap ipv6 udp max gso segments - sctp: use call_rcu to free endpoint - net/smc: fix using of uninitialized completions - net: usb: pegasus: Do not drop long Ethernet frames - net/smc: improved fix wait on already cleared link - net/smc: don't send CDC/LLC message if link not ready - net/smc: fix kernel panic caused by race of smc_sock - igc: Fix TX timestamp support for non-MSI-X platforms - net/mlx5e: Fix wrong features assignment in case of error - [armhf] net/ncsi: check for error return from call to nla_put_u32 - i2c: validate user data in compat ioctl - nfc: uapi: use kernel size_t to fix user-space builds - uapi: fix linux/nfc.h userspace compilation errors - drm/amdgpu: When the VCN(1.0) block is suspended, powergating is explicitly enabled - drm/amdgpu: add support for IP discovery gc_info table v2 - xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. - usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. - [arm*] binder: fix async_free_space accounting for empty parcels - [x86] scsi: vmw_pvscsi: Set residual data length conditionally - Input: appletouch - initialize work before device registration - Input: spaceball - fix parsing of movement data packets - net: fix use-after-free in tw_timer_handler https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.91 - f2fs: quota: fix potential deadlock - tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() - tracing: Tag trace_percpu_buffer as a percpu pointer - ieee802154: atusb: fix uninit value in atusb_set_extended_addr - i40e: Fix to not show opcode msg on unsuccessful VF MAC change - iavf: Fix limit of total number of queues to active queues of VF - RDMA/core: Don't infoleak GRH fields - netrom: fix copying in user data in nr_setsockopt - RDMA/uverbs: Check for null return of kmalloc_array - mac80211: initialize variable have_higher_than_11mbit - sfc: The RX page_ring is optional - i40e: fix use-after-free in i40e_sync_filters_subtask() - i40e: Fix for displaying message regarding NVM version - i40e: Fix incorrect netdev's real number of RX/TX queues - ipv4: Check attribute length for RTA_GATEWAY in multipath route - ipv4: Check attribute length for RTA_FLOW in multipath route - ipv6: Check attribute length for RTA_GATEWAY in multipath route - ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route - lwtunnel: Validate RTA_ENCAP_TYPE attribute length - batman-adv: mcast: don't send link-local multicast to mcast routers - sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc - net: ena: Fix undefined state when tx request id is out of bounds - net: ena: Fix error handling when calculating max IO queues number - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (CVE-2021-4155) - power: supply: core: Break capacity loop - rndis_host: support Hytera digital radios - phonet: refcount leak in pep_sock_accep (CVE-2021-45095) - ipv6: Continue processing multipath route even if gateway attribute is invalid - ipv6: Do cleanup if attribute validation fails in multipath route - scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() - ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate - net: udp: fix alignment problem in udp4_seq_show() - [amd64,arm64] atlantic: Fix buff_ring OOB in aq_ring_rx_clean - mISDN: change function names to avoid conflicts - drm/amd/display: Added power down for DCN10 - ipv6: raw: check passed optlen before reading https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.92 - md: revert io stats accounting - workqueue: Fix unbind_workers() VS wq_worker_running() race - bpf: Fix out of bounds access from invalid *_or_null type verification (CVE-2022-23222) - Bluetooth: btusb: fix memory leak in btusb_mtk_submit_wmt_recv_urb() - Bluetooth: btusb: Add two more Bluetooth parts for WCN6855 - Bluetooth: btusb: Add support for Foxconn MT7922A - Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0 - Bluetooth: bfusb: fix division by zero in send path - [armhf] dts: exynos: Fix BCM4330 Bluetooth reset polarity in I9100 - USB: core: Fix bug in resuming hub's handling of wakeup requests - USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status - ath11k: Fix buffer overflow when scanning with extraie - mmc: sdhci-pci: Add PCI ID for Intel ADL - veth: Do not record rx queue hint in veth_xmit - [x86] mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() - can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data - can: isotp: convert struct tpcon::{idx,len} to unsigned int - can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} - random: fix data race on crng_node_pool - random: fix data race on crng init time - random: fix crash on multiple early calls to add_bootloader_randomness() - media: Revert "media: uvcvideo: Set unique vdev name based in type" - [x86] drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() [ Salvatore Bonaccorso ] * [arm64] drivers/net/ethernet/google: Enable GVE as module (Closes: #996974) * Refresh "Export symbols needed by Android drivers" * [rt] Update to 5.10.87-rt59 * Bump ABI to 11 * [rt] Update to 5.10.90-rt60 * vfs: fs_context: fix up param length parsing in legacy_parse_param (CVE-2022-0185) [ Andrew Balmos ] * net/can: Enable CONFIG_CAN_MCP251X as module [ Cyril Brulebois ] * arm64: dts: Add support for Raspberry Pi Compute Module 4 IO Board, producing a DTB that's almost entirely identical to what a v5.16-rc8 build produces, with lots of thanks to Uwe Kleine-König for the heavy lifting! -- Salvatore Bonaccorso Tue, 18 Jan 2022 16:54:31 +0100 linux (5.10.84-1) bullseye; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.71 - tty: Fix out-of-bound vmalloc access in imageblit - cpufreq: schedutil: Use kobject release() method to free sugov_tunables - scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS - cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory - ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops. - [amd64,arm64] ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect - fs-verity: fix signed integer overflow with i_size near S64_MAX - hwmon: (tmp421) handle I2C errors - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field - [arm64,armhf] gpio: pca953x: do not ignore i2c errors - scsi: ufs: Fix illegal offset in UPIU event trace - mac80211: fix use-after-free in CCMP/GCMP RX - [x86] kvmclock: Move this_cpu_pvti into kvmclock.h - [x86] KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect() - [x86] KVM: x86: nSVM: don't copy virt_ext from vmcb12 - [x86] KVM: nVMX: Filter out all unsupported controls when eVMCS was activated - KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest - RDMA/cma: Do not change route.addr.src_addr.ss_family - drm/amd/display: Pass PCI deviceid into DC - drm/amdgpu: correct initial cp_hqd_quantum for gfx9 - ipvs: check that ip_vs_conn_tab_bits is between 8 and 20 - bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog - IB/cma: Do not send IGMP leaves for sendonly Multicast groups - RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure - mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug - mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap - mac80211: mesh: fix potentially unaligned access - mac80211-hwsim: fix late beacon hrtimer handling - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb - hwmon: (tmp421) report /PVLD condition as fault - hwmon: (tmp421) fix rounding for negative values - [arm64] net: enetc: fix the incorrect clearing of IF_MODE bits - net: ipv4: Fix rtnexthop len when RTA_FLOW is present - smsc95xx: fix stalled rx after link change - [x86] drm/i915/request: fix early tracepoints - [arm64,armhf] dsa: mv88e6xxx: 6161: Use chip wide MAX MTU - [arm64,armhf] dsa: mv88e6xxx: Fix MTU definition - [arm64,armhf] dsa: mv88e6xxx: Include tagger overhead when setting MTU for DSA and CPU ports - e100: fix length calculation in e100_get_regs_len - e100: fix buffer overrun in e100_get_regs - [arm64] RDMA/hns: Fix inaccurate prints - bpf: Exempt CAP_BPF from checks against bpf_jit_limit - Revert "block, bfq: honor already-setup queue merges" - scsi: csiostor: Add module softdep on cxgb4 - ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup - [arm64] net: hns3: do not allow call hns3_nic_net_open repeatedly - [arm64] net: hns3: keep MAC pause mode when multiple TCs are enabled - [arm64] net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and HCLGE_FLAG_DCB_ENABLE - [arm64] net: hns3: fix show wrong state when add existing uc mac address - [arm64] net: hns3: fix prototype warning - [arm64] net: hns3: reconstruct function hns3_self_test - [arm64] net: hns3: fix always enable rx vlan filter problem after selftest - [arm64,armhf] net: phy: bcm7xxx: Fixed indirect MMD operations - net: sched: flower: protect fl_walk() with rcu - af_unix: fix races in sk_peer_pid and sk_peer_cred accesses - [x86] perf/x86/intel: Update event constraints for ICX - nvme: add command id quirk for apple controllers - elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings - debugfs: debugfs_create_file_size(): use IS_ERR to check for error - ext4: fix loff_t overflow in ext4_max_bitmap_size() - ext4: limit the number of blocks in one ADD_RANGE TLV (Closes: #995425) - ext4: fix reserved space counter leakage - ext4: add error checking to ext4_ext_replay_set_iblocks() - ext4: fix potential infinite loop in ext4_dx_readdir() - HID: u2fzero: ignore incomplete packets without data - net: udp: annotate data race around udp_sk(sk)->corkflag - ASoC: dapm: use component prefix when checking widget names - usb: hso: remove the bailout parameter - [x86] crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744, CVE-2021-3764) - HID: betop: fix slab-out-of-bounds Write in betop_probe - netfilter: ipset: Fix oversized kvmalloc() calls - mm: don't allow oversized kvmalloc() calls - HID: usbhid: free raw_report buffers in usbhid_stop - [x86] KVM: x86: Handle SRCU initialization failure during page track init - netfilter: conntrack: serialize hash resizes and cleanups - netfilter: nf_tables: Fix oversized kvmalloc() calls https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.72 - [arm64,armhf] spi: rockchip: handle zero length transfers without timing out - nfsd: back channel stuck in SEQ4_STATUS_CB_PATH_DOWN - btrfs: replace BUG_ON() in btrfs_csum_one_bio() with proper error handling - btrfs: fix mount failure due to past and transient device flush error - net: mdio: introduce a shutdown method to mdio device drivers - xen-netback: correct success/error reporting for the SKB-with-fraglist case - scsi: sd: Free scsi_disk device via put_device() - [arm*] usb: dwc2: check return value after calling platform_get_resource() - nvme-fc: update hardware queues before using them - nvme-fc: avoid race between time out and tear down - [arm64] thermal/drivers/tsens: Fix wrong check for tzd in irq handlers - scsi: ses: Retry failed Send/Receive Diagnostic commands - [arm64,armhf] irqchip/gic: Work around broken Renesas integration - smb3: correct smb3 ACL security descriptor - KVM: do not shrink halt_poll_ns below grow_start - [x86] kvm: Add AMD PMU MSRs to msrs_to_save_all[] - [x86] KVM: nSVM: restore int_vector in svm_clear_vintr - [x86] perf/x86: Reset destroy callback on event init failure - libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD. https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.73 - [arm64,armhf] usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle - USB: cdc-acm: fix racy tty buffer accesses - USB: cdc-acm: fix break reporting - usb: typec: tcpm: handle SRC_STARTUP state if cc changes - drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows - xen/privcmd: fix error handling in mmap-resource processing - [arm64] mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk - ovl: fix missing negative dentry check in ovl_rename() (CVE-2021-20321) - ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO - nfsd: fix error handling of register_pernet_subsys() in init_nfsd() - nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero - SUNRPC: fix sign error causing rpcsec_gss drops - xen/balloon: fix cancelled balloon action - [armhf] dts: omap3430-sdp: Fix NAND device node - [armhf] bus: ti-sysc: Add break in switch statement in sysc_init_soc() - [arm64] soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment - [armhf] dts: imx: Add missing pinctrl-names for panel on M53Menlo - [armhf] dts: imx: Fix USB host power regulator polarity on M53Menlo - [amd64] PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus - iwlwifi: pcie: add configuration of a Wi-Fi adapter on Dell XPS 15 - [armel,armhf] bpf, arm: Fix register clobbering in div/mod implementation - [armhf] soc: ti: omap-prm: Fix external abort for am335x pruss - bpf: Fix integer overflow in prealloc_elems_and_freelist() (CVE-2021-41864) - net/mlx5e: IPSEC RX, enable checksum complete - net/mlx5: E-Switch, Fix double allocation of acl flow counter - phy: mdio: fix memory leak - net_sched: fix NULL deref in fifo_set_limit() - [i386] ptp_pch: Load module automatically if ID matches - [armhf] imx6: disable the GIC CPU interface before calling stby-poweroff sequence - net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size() - net: bridge: fix under estimation in br_get_linkxstats_size() - net/sched: sch_taprio: properly cancel timer from taprio_destroy() - net: sfp: Fix typo in state machine debug string - netlink: annotate data races around nlk->bound - perf jevents: Tidy error handling - [armhf] bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893 - [arm64,armhf] drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup - drm/nouveau: avoid a use-after-free when BO init fails - drm/nouveau/kms/nv50-: fix file release memory leak - drm/nouveau/debugfs: fix file release memory leak - [amd64] gve: Correct available tx qpl check - [amd64] gve: Avoid freeing NULL pointer - rtnetlink: fix if_nlmsg_stats_size() under estimation - [amd64] gve: fix gve_get_stats() - [amd64] gve: report 64bit tx_bytes counter from gve_handle_report_stats() - i40e: fix endless loop under rtnl - i40e: Fix freeing of uninitialized misc IRQ vector - net: prefer socket bound to interface when not in VRF - [powerpc*] iommu: Report the correct most efficient DMA mask for PCI devices - i2c: acpi: fix resource leak in reconfiguration device addition - [s390x] bpf, s390: Fix potential memory leak about jit_data - [powerpc*] bpf: Fix BPF_SUB when imm == 0x80000000 - [powerpc*] pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init - [i386] x86/platform/olpc: Correct ifdef symbol to intended CONFIG_OLPC_XO15_SCI - [x86] entry: Correct reference to intended CONFIG_64_BIT - [x86] hpet: Use another crystalball to evaluate HPET usability https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.74 - ext4: check and update i_disksize properly - ext4: correct the error path of ext4_write_inline_data_end() - [x86] ASoC: Intel: sof_sdw: tag SoundWire BEs as non-atomic - HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS - netfilter: ip6_tables: zero-initialize fragment offset - HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs - [x86] ASoC: SOF: loader: release_firmware() on load failure to avoid batching - netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic - netfilter: nf_nat_masquerade: defer conntrack walk to work queue - mac80211: Drop frames from invalid MAC address in ad-hoc mode - net: prevent user from passing illegal stab size - mac80211: check return value of rhashtable_init - [x86] vboxfs: fix broken legacy mount signature checking - drm/amdgpu: fix gart.bo pin_count leak - scsi: ses: Fix unsigned comparison with less than zero - scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" - perf/core: fix userpage->time_enabled of inactive events - sched: Always inline is_percpu_thread() - [armhf] hwmon: (pmbus/ibm-cffps) max_power_out swap changes https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.75 - ALSA: usb-audio: Add quirk for VF0770 - ALSA: pcm: Workaround for a wrong offset in SYNC_PTR compat ioctl - ALSA: seq: Fix a potential UAF by wrong private_free call order - ALSA: hda/realtek: Enable 4-speaker output for Dell Precision 5560 laptop - ALSA: hda - Enable headphone mic on Dell Latitude laptops with ALC3254 - ALSA: hda/realtek: Complete partial device name to avoid ambiguity - ALSA: hda/realtek: Add quirk for Clevo X170KM-G - ALSA: hda/realtek - ALC236 headset MIC recording issue - ALSA: hda/realtek: Add quirk for TongFang PHxTxX1 - ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo 13s Gen2 - ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW - [s390x] fix strrchr() implementation - [arm64] hugetlb: fix CMA gigantic page order for non-4K PAGE_SIZE - drm/msm: Avoid potential overflow in timeout_to_jiffies() - btrfs: unlock newly allocated extent buffer after error - btrfs: deal with errors when replaying dir entry during log replay - btrfs: deal with errors when adding inode reference during log replay - btrfs: check for error when looking up inode during dir entry replay - btrfs: update refs for any root except tree log roots - btrfs: fix abort logic in btrfs_replace_file_extents - [x86] resctrl: Free the ctrlval arrays when domain_setup_mon_state() fails - [x86] mei: me: add Ice Lake-N device id. - xhci: guard accesses to ep_state in xhci_endpoint_reset() - xhci: Fix command ring pointer corruption while aborting a command - xhci: Enable trust tx length quirk for Fresco FL11 USB controller - cb710: avoid NULL pointer subtraction - [arm64,x86] efi/cper: use stack buffer for error record decoding - efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock() - [armhf] usb: musb: dsps: Fix the probe error path (Closes: 1000900) - Input: xpad - add support for another USB ID of Nacon GC-100 - USB: serial: qcserial: add EM9191 QDL support - USB: serial: option: add Quectel EC200S-CN module support - USB: serial: option: add Telit LE910Cx composition 0x1204 - USB: serial: option: add prod. id for Quectel EG91 - virtio: write back F_VERSION_1 before validate - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells - [powerpc*] xive: Discard disabled interrupts in get_irqchip_state() - driver core: Reject pointless SYNC_STATE_ONLY device links - iio: adc: ad7192: Add IRQ flag - iio: adc: ad7780: Fix IRQ flag - iio: adc: ad7793: Fix IRQ flag - iio: adc128s052: Fix the error handling path of 'adc128_probe()' - iio: adc: max1027: Fix wrong shift with 12-bit devices - iio: light: opt3001: Fixed timeout error when 0 lux - iio: adc: max1027: Fix the number of max1X31 channels - iio: dac: ti-dac5571: fix an error code in probe() - [arm64] tee: optee: Fix missing devices unregister during optee_remove - [armel,armhf] dts: bcm2711-rpi-4-b: Fix usb's unit address - [armel,armhf] dts: bcm2711-rpi-4-b: fix sd_io_1v8_reg regulator states - [armel,armhf] dts: bcm2711-rpi-4-b: Fix pcie0's unit address formatting - nvme-pci: Fix abort command id - sctp: account stream padding length for reconf chunk - [arm64,armhf] gpio: pca953x: Improve bias setting - net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path - net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp - net: stmmac: fix get_hw_feature() on old hardware - ethernet: s2io: fix setting mac address during resume - nfc: fix error handling of nfc_proto_register() - NFC: digital: fix possible memory leak in digital_tg_listen_mdaa() - NFC: digital: fix possible memory leak in digital_in_send_sdd_req() - [i386] pata_legacy: fix a couple uninitialized variable bugs - ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators() - drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read - [arm64] drm/msm: Fix null pointer dereference on pointer edp - [arm64] drm/msm/mdp5: fix cursor-related warnings - [arm64] drm/msm/a6xx: Track current ctx by seqno - [arm64] drm/msm/dsi: Fix an error code in msm_dsi_modeset_init() - [arm64] drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling - [arm64] acpi/arm64: fix next_platform_timer() section mismatch error - [x86] platform/x86: intel_scu_ipc: Fix busy loop expiry time - mqprio: Correct stats in mqprio_dump_class_stats(). - qed: Fix missing error code in qed_slowpath_start() - nfp: flow_offload: move flow_indr_dev_register from app init to app start - [arm64] net: mscc: ocelot: warn when a PTP IRQ is raised for an unknown skb - [arm64,armhf] net: dsa: mv88e6xxx: don't use PHY_DETECT on internal PHY's https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.76 - xhci: add quirk for host controllers that don't update endpoint DCS - io_uring: fix splice_fd_in checks backport typo - [armhf] dts: vexpress-v2p-ca9: Fix the SMB unit-address - block: decode QUEUE_FLAG_HCTX_ACTIVE in debugfs output - [x86] xen/x86: prevent PVH type from getting clobbered - NFSD: Keep existing listeners on portlist error - netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value - ice: fix getting UDP tunnel entry - netfilter: ip6t_rt: fix rt0_hdr parsing in rt_mt6 - netfilter: ipvs: make global sysctl readonly in non-init netns - tcp: md5: Fix overlap between vrf and non-vrf keys - ipv6: When forwarding count rx stats on the orig netdev - [powerpc*] smp: do not decrement idle task preempt count in CPU offline - [arm64] net: hns3: reset DWRR of unused tc to zero - [arm64] net: hns3: add limit ets dwrr bandwidth cannot be 0 - [arm64] net: hns3: schedule the polling again when allocation fails - [arm64] net: hns3: fix vf reset workqueue cannot exit - [arm64] net: hns3: disable sriov before unload hclge layer - net: stmmac: Fix E2E delay mechanism - e1000e: Fix packet loss on Tiger Lake and later - ice: Add missing E810 device ids - [arm64] net: enetc: fix ethtool counter name for PM0_TERR - can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification - can: peak_pci: peak_pci_remove(): fix UAF - can: isotp: isotp_sendmsg(): fix return error on FC timeout on TX path - can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() - can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer - can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv - can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with error length - can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes - ceph: skip existing superblocks that are blocklisted or shut down when mounting - ceph: fix handling of "meta" errors - ocfs2: fix data corruption after conversion from inline format - ocfs2: mount fails with buffer overflow in strlen - userfaultfd: fix a race between writeprotect and exit_mmap() - vfs: check fd has read access in kernel_read_file_from_fd() - ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset - ALSA: hda/realtek: Add quirk for Clevo PC50HS - ASoC: DAPM: Fix missing kctl change notifications - audit: fix possible null-pointer dereference in audit_filter_rules - [powerpc*] powerpc64/idle: Fix SP offsets when saving GPRs - [powerpc*] KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() - [powerpc*] KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest (CVE-2021-43056) - [powerpc*] idle: Don't corrupt back chain when going idle - mm, slub: fix mismatch between reconstructed freelist depth and cnt - mm, slub: fix potential memoryleak in kmem_cache_open() - mm, slub: fix incorrect memcg slab count for bulk free - [x86] KVM: nVMX: promptly process interrupts delivered while in guest mode - nfc: nci: fix the UAF of rf_conn_info object (CVE-2021-3760) - isdn: cpai: check ctr->cnr to avoid array index out of bound (CVE-2021-43389) - [arm64] net: hns3: fix the max tx size according to user manual - ALSA: hda: intel: Allow repeatedly probing on codec configuration errors - btrfs: deal with errors when checking if a dir entry exists during log replay - net: stmmac: add support for dwmac 3.40a - isdn: mISDN: Fix sleeping function called from invalid context - [x86] platform/x86: intel_scu_ipc: Update timeout value in comment - ALSA: hda: avoid write to STATESTS if controller is in reset - [x86] perf/x86/msr: Add Sapphire Rapids CPU support - scsi: iscsi: Fix set_param() handling - scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els() - sched/scs: Reset the shadow stack when idle_task_exit - [arm64] net: hns3: fix for miscalculation of rx unused desc - scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma() - can: isotp: isotp_sendmsg(): fix TX buffer concurrent access in isotp_sendmsg() - [s390x] pci: fix zpci_zdev_put() on reserve - net: mdiobus: Fix memory leak in __mdiobus_register - tracing: Have all levels of checks prevent recursion - e1000e: Separate TGP board type from SPT - [armhf] pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.77 - [armel,armhf] 9139/1: kprobes: fix arch_init_kprobes() prototype - io_uring: don't take uring_lock during iowq cancel - [powerpc*] bpf: Fix BPF_MOD when imm == 1 - [arm64] Avoid premature usercopy failure - ext4: fix possible UAF when remounting r/o a mmp-protected file system - usbnet: sanity check for maxpacket - usbnet: fix error return code in usbnet_probe() - pinctrl: amd: disable and mask interrupts on probe - ata: sata_mv: Fix the error handling of mv_chip_id() - tipc: fix size validations for the MSG_CRYPTO type (CVE-2021-43267) - nfc: port100: fix using -ERRNO as command type mask - Revert "net: mdiobus: Fix memory leak in __mdiobus_register" - mmc: vub300: fix control-message timeouts - mmc: cqhci: clear HALT state after CQE enable - [armhf] mmc: dw_mmc: exynos: fix the finding clock sample value - mmc: sdhci: Map more voltage level to SDHCI_POWER_330 - [arm64,armhf] mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit - ocfs2: fix race between searching chunks and release journal_head from buffer_head - nvme-tcp: fix H2CData PDU send accounting (again) - cfg80211: scan: fix RCU in cfg80211_add_nontrans_list() - cfg80211: fix management registrations locking - net: lan78xx: fix division by zero in send path - mm, thp: bail out early in collapse_file for writeback page - drm/ttm: fix memleak in ttm_transfered_destroy - drm/amdgpu: fix out of bounds write (CVE-2021-42327) - cgroup: Fix memory leak caused by missing cgroup_bpf_offline - tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function - bpf: Fix potential race in tail call compatibility check - bpf: Fix error usage of map_fd and fdget() in generic_map_update_batch() - [amd64] IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields - [amd64] IB/hfi1: Fix abba locking issue with sc_disable() - nvmet-tcp: fix data digest pointer calculation - nvme-tcp: fix data digest pointer calculation - nvme-tcp: fix possible req->offset corruption - RDMA/mlx5: Set user priority for DCT - [arm64] dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node - regmap: Fix possible double-free in regcache_rbtree_exit() - net: batman-adv: fix error handling - net-sysfs: initialize uid and gid before calling net_ns_get_ownership - cfg80211: correct bridge/4addr mode check - net: Prevent infinite while loop in skb_tx_hash() - RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string - net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume fails - net: ethernet: microchip: lan743x: Fix dma allocation failure by using dma_set_mask_and_coherent - phy: phy_ethtool_ksettings_get: Lock the phy for consistency - phy: phy_ethtool_ksettings_set: Move after phy_start_aneg - phy: phy_start_aneg: Add an unlocked version - phy: phy_ethtool_ksettings_set: Lock the PHY while changing settings - sctp: use init_tag from inithdr for ABORT chunk (CVE-2021-3772) - sctp: fix the processing for INIT_ACK chunk (CVE-2021-3772) - sctp: fix the processing for COOKIE_ECHO chunk (CVE-2021-3772) - sctp: add vtag check in sctp_sf_violation (CVE-2021-3772) - sctp: add vtag check in sctp_sf_do_8_5_1_E_sa (CVE-2021-3772) - sctp: add vtag check in sctp_sf_ootb (CVE-2021-3772) - lan743x: fix endianness when accessing descriptors - [s390x] KVM: clear kicked_mask before sleeping again - [s390x] KVM: preserve deliverable_mask in __airqs_kick_single_vcpu https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.78 - scsi: core: Put LLD module refcnt after SCSI device is released - Revert "io_uring: reinforce cancel on flush during exit" - sfc: Fix reading non-legacy supported link modes - vrf: Revert "Reset skb conntrack connection..." - net: ethernet: microchip: lan743x: Fix skb allocation failure - media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() (CVE-2021-42739) - Revert "xhci: Set HCD flag to defer primary roothub registration" - Revert "usb: core: hcd: Add support for deferring roothub registration" - mm: khugepaged: skip huge page collapse for special files - Revert "drm/ttm: fix memleak in ttm_transfered_destroy" - [arm*] 9120/1: Revert "amba: make use of -1 IRQs warn" - [arm64] Revert "wcn36xx: Disable bmps when encryption is disabled" - ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table - ALSA: usb-audio: Add Audient iD14 to mixer map quirk table https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.79 - [x86] Revert "x86/kvm: fix vcpu-id indexed array sizes" - [arm64,armhf] usb: musb: Balance list entry in musb_gadget_queue - usb-storage: Add compatibility quirk flags for iODD 2531/2541 - [arm*] binder: don't detect sender/target during buffer cleanup - printk/console: Allow to disable console output by using console="" or console=null - staging: rtl8712: fix use-after-free in rtl8712_dl_fw - isofs: Fix out of bound access for corrupted isofs image - [x86] comedi: dt9812: fix DMA buffers on stack - [x86] comedi: ni_usb6501: fix NULL-deref in command paths - [x86] comedi: vmk80xx: fix transfer-buffer overflows - [x86] comedi: vmk80xx: fix bulk-buffer overflow - [x86] comedi: vmk80xx: fix bulk and interrupt message timeouts - staging: r8712u: fix control-message timeout - [x86] staging: rtl8192u: fix control-message timeouts - rsi: fix control-message timeout https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.80 - xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay - usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform - [arm*] binder: use euid from cred instead of using task - [arm*] binder: use cred instead of task for selinux checks - [arm*] binder: use cred instead of task for getsecid - Input: iforce - fix control-message timeout - Input: elantench - fix misreporting trackpoint coordinates (Closes: #989285) - libata: fix read log timeout value - ocfs2: fix data corruption on truncate - scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd() - scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file - scsi: qla2xxx: Fix use after free in eh_abort path - [arm64,armhf] mmc: dw_mmc: Dont wait for DRTO on Write RSP error - exfat: fix incorrect loading of i_blocks for large files - tpm: Check for integer overflow in tpm2_map_response_body() - media: ite-cir: IR receiver stop working after receive overflow (Closes: #996672) - media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers (Closes: #994050) - media: v4l2-ioctl: Fix check_ext_ctrls - ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14 - ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED - ALSA: hda/realtek: Add quirk for Clevo PC70HS - ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ - ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N - ALSA: hda/realtek: Add quirk for ASUS UX550VE - ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED - ALSA: ua101: fix division by zero at probe - ALSA: 6fire: fix control and bulk message timeouts - ALSA: line6: fix control and interrupt message timeouts - ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk - ALSA: usb-audio: Add registration quirk for JBL Quantum 400 - ALSA: hda: Free card instance properly at probe errors - ALSA: synth: missing check for possible NULL after the call to kstrdup - ALSA: timer: Fix use-after-free problem - ALSA: timer: Unconditionally unlink slave instances, too - ext4: fix lazy initialization next schedule time computation in more granular unit - ext4: ensure enough credits in ext4_ext_shift_path_extents - ext4: refresh the ext4_ext_path struct after dropping i_data_sem. - fuse: fix page stealing - [x86] cpu: Fix migration safety with X86_BUG_NULL_SEL - [x86] irq: Ensure PI wakeup handler is unregistered before module unload - ASoC: soc-core: fix null-ptr-deref in snd_soc_del_component_unlocked() - ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers - [arm64] cavium: Return negative value when pci_alloc_irq_vectors() fails - scsi: qla2xxx: Return -ENOMEM if kzalloc() fails - scsi: qla2xxx: Fix unmap of already freed sgl - mISDN: Fix return values of the probe function - [arm64] cavium: Fix return values of the probe function - sfc: Export fibre-specific supported link modes - sfc: Don't use netif_info before net_device setup - [armhf] reset: socfpga: add empty driver allowing consumers to probe - drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 - bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT - bpf: Prevent increasing bpf_jit_limit above max - xen/netfront: stop tx queues during live migration - nvmet-tcp: fix a memory leak when releasing a queue - [armhf] spi: spl022: fix Microwire full duplex mode - net: multicast: calculate csum of looped-back and forwarded packets - [armhf] watchdog: Fix OMAP watchdog early handling - drm: panel-orientation-quirks: Add quirk for GPD Win3 - block: schedule queue restart after BLK_STS_ZONE_RESOURCE - nvmet-tcp: fix header digest verification - r8169: Add device 10ec:8162 to driver r8169 - [x86] vmxnet3: do not stop tx queues after netif_device_detach() - nfp: bpf: relax prog rejection for mtu check through max_pkt_offset - net/smc: Fix smc_link->llc_testlink_time overflow - net/smc: Correct spelling mistake to TCPF_SYN_RECV - rds: stop using dmapool - btrfs: clear MISSING device status bit in btrfs_close_one_device - btrfs: fix lost error handling when replaying directory deletes - btrfs: call btrfs_check_rw_degradable only if there is a missing device - [x86] KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup - selinux: fix race condition when computing ocontext SIDs - [armhf] regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled - [amd64] EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell - [x86] mwifiex: fix division by zero in fw download path - ath6kl: fix division by zero in send path - ath6kl: fix control-message timeout - ath10k: fix control-message timeout - ath10k: fix division by zero in send path - PCI: Mark Atheros QCA6174 to avoid bus reset - rtl8187: fix control-message timeouts - [arm64] wcn36xx: Fix HT40 capability for 2Ghz band - [arm64] wcn36xx: Fix tx_status mechanism - [arm64] wcn36xx: Fix (QoS) null data frame bitrate/modulation - PM: sleep: Do not let "syscore" devices runtime-suspend during system transitions - mwifiex: Read a PCI register after writing the TX ring write pointer - mwifiex: Try waking the firmware until we get an interrupt - libata: fix checking of DMA state - [arm64] wcn36xx: handle connection loss indication - rsi: fix occasional initialisation failure with BT coex - rsi: fix key enabled check causing unwanted encryption for vap_id > 0 - rsi: fix rate mask set leading to P2P failure - rsi: Fix module dev_oper_mode parameter description - [x86] perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server - [x86] perf/x86/intel/uncore: Fix Intel ICX IIO event constraints - RDMA/qedr: Fix NULL deref for query_qp on the GSI QP - signal: Remove the bogus sigkill_pending in ptrace_stop - [mips*] signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT - [arm64] soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id - [arm64] soc: fsl: dpio: use the combined functions to protect critical zone - [x86] power: supply: max17042_battery: Prevent int underflow in set_soc_threshold - [x86] power: supply: max17042_battery: use VFSOC for capacity when no rsns - [arm64] KVM: arm64: Extract ESR_ELx.EC only - [x86] KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use - can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport - can: j1939: j1939_can_recv(): ignore messages with invalid source address - ring-buffer: Protect ring_buffer_reset() from reentrancy - serial: core: Fix initializing and restoring termios speed - ifb: fix building without CONFIG_NET_CLS_ACT - ALSA: mixer: oss: Fix racy access to slots - ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume - xen/balloon: add late_initcall_sync() for initial ballooning done - ovl: fix use after free in struct ovl_aio_req - [arm*] PCI: pci-bridge-emul: Fix emulation of W1C bits - [arm64] PCI: aardvark: Do not clear status bits of masked interrupts - [arm64] PCI: aardvark: Fix checking for link up via LTSSM state - [arm64] PCI: aardvark: Do not unmask unused interrupts - [arm64] PCI: aardvark: Fix reporting Data Link Layer Link Active - [arm64] PCI: aardvark: Fix configuring Reference clock - [arm64] PCI: aardvark: Fix return value of MSI domain .alloc() method - [arm64] PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG - [arm64] PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated bridge - [arm64] PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge - [arm64] PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge - [arm64] PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge - quota: check block number when reading the block in quota file - quota: correct error number in free_dqentry() - pinctrl: core: fix possible memory leak in pinctrl_enable() - iio: dac: ad5446: Fix ad5622_write() return value - iio: ad5770r: make devicetree property reading consistent - USB: serial: keyspan: fix memleak on probe errors - serial: 8250: fix racy uartclk update - USB: iowarrior: fix control-message timeouts - [arm64,armhf] USB: chipidea: fix interrupt deadlock - [x86] power: supply: max17042_battery: Clear status bits in interrupt handler - dma-buf: WARN on dmabuf release with pending attachments - drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2) - drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 - drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6 - Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() (CVE-2021-3640) - Bluetooth: fix use-after-free error in lock_sock_nested() - drm/panel-orientation-quirks: add Valve Steam Deck - [x86] platform/x86: wmi: do not fail if disabling fails - locking/lockdep: Avoid RCU-induced noinstr fail - net: sched: update default qdisc visibility after Tx queue cnt changes - rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop - ath11k: Align bss_chan_info structure with firmware - [x86] Increase exception stack sizes - mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type - mwifiex: Properly initialize private structure on interface type changes - fscrypt: allow 256-bit master keys with AES-256-XTS - drm/amdgpu: Fix MMIO access page fault - ath11k: Avoid reg rules update during firmware recovery - ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED - ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets - ath10k: high latency fixes for beacon buffer - media: netup_unidvb: handle interrupt properly according to the firmware - media: uvcvideo: Set capability in s_param - media: uvcvideo: Return -EIO for control errors - media: uvcvideo: Set unique vdev name based in type - [armhf] media: imx: set a media_device bus_info string - media: mceusb: return without resubmitting URB in case of -EPROTO error. - rtw88: fix RX clock gate setting while fifo dump - brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet - ipmi: Disable some operations during a panic - fs/proc/uptime.c: Fix idle time reporting in /proc/uptime - ACPICA: Avoid evaluating methods too early during system resume - media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() - net-sysfs: try not to restart the syscall if it will fail eventually - tracefs: Have tracefs directories not set OTH permission bits by default - ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() - iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value - ACPI: battery: Accept charges over the design capacity as full - net: phy: micrel: make *-skew-ps check more lenient - [arm64] drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture() - block: bump max plugged deferred size from 16 to 32 - md: update superblock after changing rdev flags in state_store - memstick: r592: Fix a UAF bug when removing the driver - lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression - lib/xz: Validate the value before assigning it to an enum variable - workqueue: make sysfs of unbound kworker cpumask more clever - mwl8k: Fix use-after-free in mwl8k_fw_state_machine() - block: remove inaccurate requeue check - nvmet: fix use-after-free when a port is removed - nvmet-rdma: fix use-after-free when a port is removed - nvmet-tcp: fix use-after-free when a port is removed - nvme: drop scan_lock and always kick requeue list when removing namespaces - PM: hibernate: Get block device exclusively in swsusp_check() - iwlwifi: mvm: disable RX-diversity in powersave - gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE - gfs2: Cancel remote delete work asynchronously - gfs2: Fix glock_hash_walk bugs - vrf: run conntrack only in context of lower/physdev for locally generated packets - net: annotate data-race in neigh_output() - ACPI: AC: Quirk GK45 to skip reading _PSR - btrfs: reflink: initialize return value to 0 in btrfs_extent_same() - btrfs: do not take the uuid_mutex in btrfs_rm_device - [arm64] wcn36xx: Correct band/freq reporting on RX - [x86] hyperv: Protect set_hv_tscchange_cb() against getting preempted - drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled - task_stack: Fix end_of_stack() for architectures with upwards-growing stack - erofs: don't trigger WARN() when decompression fails - netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state - Bluetooth: fix init and cleanup of sco_conn.timeout_work - rcu: Fix existing exp request check in sync_sched_exp_online_cleanup() - objtool: Add xen_start_kernel() to noreturn list - [x86] xen: Mark cpu_bringup_and_idle() as dead_end_function - objtool: Fix static_call list generation - virtio-gpu: fix possible memory allocation failure - lockdep: Let lock_is_held_type() detect recursive read as read - net: net_namespace: Fix undefined member in key_remove_domain() - cgroup: Make rebind_subsystems() disable v2 controllers all at once - [arm64] wcn36xx: Fix Antenna Diversity Switching - Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync - [arm64] crypto: caam - disable pkc for non-E SoCs - rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies() - ath11k: fix some sleeping in atomic bugs - ath11k: Avoid race during regd updates - ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status - ath11k: Fix memory leak in ath11k_qmi_driver_event_work - ath10k: Fix missing frame timestamp for beacon/probe-resp - ath10k: sdio: Add missing BH locking around napi_schdule() - drm/ttm: stop calling tt_swapin in vm_access - [arm64] mm: update max_pfn after memory hotplug - drm/amdgpu: fix warning for overflow check - media: em28xx: add missing em28xx_close_extension - media: dvb-usb: fix ununit-value in az6027_rc_query - media: v4l2-ioctl: S_CTRL output the right value - media: si470x: Avoid card name truncation - [x86] media: tm6000: Avoid card name truncation - media: cx23885: Fix snd_card_free call on null card pointer - kprobes: Do not use local variable when creating debugfs file - cpuidle: Fix kobject memory leaks in error paths - media: em28xx: Don't use ops->suspend if it is NULL - ath9k: Fix potential interrupt storm on queue reset - PM: EM: Fix inefficient states detection - [amd64] EDAC/amd64: Handle three rank interleaving mode - rcu: Always inline rcu_dynticks_task*_{enter,exit}() - netfilter: nft_dynset: relax superfluous check on set updates - [x86] crypto: qat - detect PFVF collision after ACK - [x86] crypto: qat - disregard spurious PFVF interrupts - b43legacy: fix a lower bounds test - b43: fix a lower bounds test - [amd64] gve: Recover from queue stall due to missed IRQ - [armhf] mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured - [armhf] mmc: sdhci-omap: Fix context restore - memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() - net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE - hwmon: Fix possible memleak in __hwmon_device_register() - ath10k: fix max antenna gain unit - kernel/sched: Fix sched_fork() access an invalid sched_task_group - tcp: switch orphan_count to bare per-cpu counters - [arm64] drm/msm: potential error pointer dereference in init() - [arm64] drm/msm: uninitialized variable in msm_gem_import() - net: stream: don't purge sk_error_queue in sk_stream_kill_queues() - [x86] platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning - mt76: mt76x02: fix endianness warnings in mt76x02_mac.c - rsi: stop thread firstly in rsi_91x_init() error handling - mwifiex: Send DELBA requests according to spec - [arm64] net: enetc: unmap DMA in enetc_send_cmd() - phy: micrel: ksz8041nl: do not use power down mode - nvme-rdma: fix error code in nvme_rdma_setup_ctrl - PM: hibernate: fix sparse warnings - [arm64] drm/msm: Fix potential NULL dereference in DPU SSPP - bpftool: Avoid leaking the JSON writer prepared for program metadata - [s390x] gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap() - [s390x] KVM: pv: avoid double free of sida page - [s390x] KVM: pv: avoid stalls for kvm_s390_pv_init_vm - tpm: fix Atmel TPM crash caused by too frequent queries - tpm_tis_spi: Add missing SPI ID - tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() - [s390x] KVM: Fix handle_sske page fault handling - libertas_tf: Fix possible memory leak in probe and disconnect - libertas: Fix possible memory leak in probe and disconnect - [arm64] wcn36xx: add proper DMA memory barriers in rx path - [arm64] wcn36xx: Fix discarded frames due to wrong sequence number - drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits - [amd64,arm64] net: amd-xgbe: Toggle PLL settings during rate change - net: phylink: avoid mvneta warning when setting pause parameters - crypto: pcrypt - Delay write to padata->info - udp6: allow SO_MARK ctrl msg to affect routing - cgroup: Fix rootcg cpu.stat guest double counting - bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off. - bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit. - iio: st_sensors: Call st_sensors_power_enable() from bus drivers - iio: st_sensors: disable regulators after device unregistration - RDMA/bnxt_re: Fix query SRQ failure - [arm64] dts: meson-g12a: Fix the pwm regulator supply properties - [armhf] bus: ti-sysc: Fix timekeeping_suspended warning on resume - scsi: dc395: Fix error case unwinding - JFS: fix memleak in jfs_mount - ALSA: hda: Reduce udelay() at SKL+ position reporting - ALSA: hda: Release controller display power during shutdown/reboot - ALSA: hda: Fix hang during shutdown due to link reset - ALSA: hda: Use position buffer for SKL+ again - soundwire: debugfs: use controller id and link_id for debugfs - scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp() - driver core: Fix possible memory leak in device_link_add() - [x86] ASoC: SOF: topology: do not power down primary core during topology removal - [arm64,armhf] soc/tegra: Fix an error handling path in tegra_powergate_power_up() - [powerpc*] Refactor is_kvm_guest() declaration to new header - [powerpc*] Rename is_kvm_guest() to check_kvm_guest() - [powerpc*] Reintroduce is_kvm_guest() as a fast-path check - [powerpc*] Fix is_kvm_guest() / kvm_para_available() - [powerpc*] fix unbalanced node refcount in check_kvm_guest() - serial: 8250_dw: Drop wrong use of ACPI_PTR() - scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() - RDMA/mlx4: Return missed an error if device doesn't support steering - iio: adis: do not disabe IRQs in 'adis_init()' - scsi: ufs: Refactor ufshcd_setup_clocks() to remove skip_ref_clk - [arm64,armhf] serial: imx: fix detach/attach of serial console - [arm*] usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init - [arm*] usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled - [arm*] usb: dwc2: drd: reset current session before setting the new one - [arm64] firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available() - [arm64] phy: qcom-qusb2: Fix a memory leak on probe - [armhf] phy: ti: gmii-sel: check of_get_address() for failure - [arm64] serial: xilinx_uartps: Fix race condition causing stuck TX - HID: u2fzero: clarify error check and length calculations - HID: u2fzero: properly handle timeouts in usb_submit_urb - virtio_ring: check desc == NULL when using indirect with packed - [mips*] cm: Convert to bitfield API to fix out-of-bounds access - apparmor: fix error check - rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined - nfsd: don't alloc under spinlock in rpc_parse_scope_id - NFS: Fix dentry verifier races - pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds - drm/plane-helper: fix uninitialized variable reference - [arm64] PCI: aardvark: Don't spam about PIO Response Status - [arm64] PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge - opp: Fix return in _opp_add_static_v2() - NFS: Fix deadlocks in nfs_scan_commit_list() - fs: orangefs: fix error return code of orangefs_revalidate_lookup() - [arm64] mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() - mtd: core: don't remove debugfs directory if device is in use - [armhf] remoteproc: Fix a memory leak in an error handling path in 'rproc_handle_vdev()' - NFS: Fix up commit deadlocks - NFS: Fix an Oops in pnfs_mark_request_commit() - Fix user namespace leak - [arm64] soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read - netfilter: nfnetlink_queue: fix OOB when mac header was cleared - [x86] watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT - scsi: qla2xxx: Changes to support FCP2 Target - scsi: qla2xxx: Relogin during fabric disturbance - scsi: qla2xxx: Fix gnl list corruption - scsi: qla2xxx: Turn off target reset during issue_lip - NFSv4: Fix a regression in nfs_set_open_stateid_locked() - xen-pciback: Fix return in pm_ctrl_init() - [armhf] net: davinci_emac: Fix interrupt pacing disable - ethtool: fix ethtool msg len calculation for pause stats - net: vlan: fix a UAF in vlan_dev_real_dev() - ice: Fix replacing VF hardware MAC to existing MAC filter - ice: Fix not stopping Tx queues for VFs - [x86] ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses - net: phy: fix duplex out of sync problem while changing settings - bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed - mfd: core: Add missing of_node_put for loop iteration - mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() - zram: off by one in read_block_state() - llc: fix out-of-bound array index in llc_sk_dev_hash() - nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails - [arm64] pgtable: make __pte_to_phys/__phys_to_pte_val inline functions - bpf, sockmap: Remove unhash handler for BPF sockmap usage - bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding - [amd64] gve: Fix off by one in gve_tx_timeout() - seq_file: fix passing wrong private data - net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any - [arm64] net: hns3: fix kernel crash when unload VF while it is being reset - [arm64] net: hns3: allow configure ETS bandwidth of all TCs - net: stmmac: allow a tc-taprio base-time of zero - vsock: prevent unnecessary refcnt inc for nonblocking connect - net/smc: fix sk_refcnt underflow on linkdown and fallback - cxgb4: fix eeprom len when diagnostics not implemented - [armel,armhf] 9155/1: fix early early_iounmap() - [armhf] 9156/1: drop cc-option fallbacks for architecture selection - [x86] mce: Add errata workaround for Skylake SKX37 - posix-cpu-timers: Clear task::posix_cputimers_work in copy_process() - f2fs: should use GFP_NOFS for directory inodes - net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE - 9p/net: fix missing error check in p9_check_errors - memcg: prohibit unconditional exceeding the limit of dying tasks - [powerpc*] lib: Add helper to check if offset is within conditional branch range - [powerpc*] bpf: Validate branch ranges - [powerpc*] security: Add a helper to query stf_barrier type - [powerpc*] bpf: Emit stf barrier instruction sequences for BPF_NOSPEC - mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks - mm, oom: do not trigger out_of_memory from the #PF - video: backlight: Drop maximum brightness override for brightness zero - [s390x] cio: check the subchannel validity for dev_busid - [s390x] tape: fix timer initialization in tape_std_assign() - [s390x] ap: Fix hanging ioctl caused by orphaned replies - [s390x] cio: make ccw_device_dma_* more robust - [powerpc*] powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload - [arm64,armhf] drm/sun4i: Fix macros in sun8i_csc.h - PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros - [arm64] PCI: aardvark: Fix PCIe Max Payload Size setting - SUNRPC: Partial revert of commit 6f9f17287e78 - ath10k: fix invalid dma_addr_t token assignment - arch/cc: Introduce a function to check for confidential computing features - [arm64,armhf] soc/tegra: pmc: Fix imbalanced clock disabling in error code path https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.81 - block: Add a helper to validate the block size - loop: Use blk_validate_block_size() to validate block size - bootconfig: init: Fix memblock leak in xbc_make_cmdline() - net: stmmac: add clocks management for gmac driver - net: stmmac: fix missing unlock on error in stmmac_suspend() - net: stmmac: fix system hang if change mac address after interface ifdown - net: stmmac: fix issue where clk is being unprepared twice - [arm64,armhf] net: stmmac: dwmac-rk: fix unbalanced pm_runtime_enable warnings - [x86] iopl: Fake iopl(3) CLI/STI usage - PCI/MSI: Destroy sysfs before freeing entries - PCI/MSI: Deal with devices lying about their MSI mask capability - PCI: Add MSI masking quirk for Nvidia ION AHCI - erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() - erofs: fix unsafe pagevec reuse of hooked pclusters - scripts/lld-version.sh: Rewrite based on upstream ld-version.sh - perf/core: Avoid put_page() when GUP fails - thermal: Fix NULL pointer dereferences in of_thermal_ functions https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.82 - [arm64] zynqmp: Do not duplicate flash partition label property - [arm64] zynqmp: Fix serial compatible string - scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() - [armhf] bus: ti-sysc: Add quirk handling for reinit on context lost - [armhf] bus: ti-sysc: Use context lost quirk for otg - [armhf] usb: musb: tusb6010: check return value after calling platform_get_resource() - [x86] usb: typec: tipd: Remove WARN_ON in tps6598x_block_read - staging: rtl8723bs: remove possible deadlock when disconnect (v2) - [x86] ASoC: SOF: Intel: hda-dai: fix potential locking issue - [armhf] clk: imx: imx6ul: Move csi_sel mux to correct base register - [x86] ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect - scsi: advansys: Fix kernel pointer leak - ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336 codec - firmware_loader: fix pre-allocated buf built-in firmware use - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc - scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() - scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() - scsi: target: Fix ordered tag handling - scsi: target: Fix alua_tg_pt_gps_count tracking - iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr() - [i386] ALSA: gus: fix null pointer dereference on pointer block - maple: fix wrong return value of maple_bus_init(). - f2fs: fix up f2fs_lookup tracepoints - f2fs: fix to use WHINT_MODE - f2fs: compress: disallow disabling compress on non-empty compressed file - f2fs: fix incorrect return value in f2fs_sanity_check_ckpt() - [armhf] clk/ast2600: Fix soc revision for AHB - [arm64] clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk - sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() - [x86] perf/x86/vlbr: Add c->flags to vlbr event constraints - blkcg: Remove extra blkcg_bio_issue_init - perf bpf: Avoid memory leak from perf_env__insert_btf() - perf bench futex: Fix memory leak of perf_cpu_map__new() - perf tests: Remove bash construct from record+zstd_comp_decomp.sh - drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame - net-zerocopy: Copy straggler unaligned data for TCP Rx. zerocopy. - net-zerocopy: Refactor skb frag fast-forward op. - tcp: Fix uninitialized access in skb frags array for Rx 0cp. - tracing: Add length protection to histogram string copies - bnxt_en: reject indirect blk offload when hw-tc-offload is off - tipc: only accept encrypted MSG_CRYPTO msgs - net: reduce indentation level in sk_clone_lock() - sock: fix /proc/net/sockstat underflow in sk_clone_lock() - net/smc: Make sure the link_id is unique - iavf: Fix return of set the new channel count - iavf: check for null in iavf_fix_features - iavf: free q_vectors before queues in iavf_disable_vf - iavf: Fix failure to exit out from last all-multicast mode - iavf: prevent accidental free of filter structure - iavf: validate pointers - iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset - iavf: Fix for setting queues to 0 - [x86] platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()' - net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() - net/mlx5: Lag, update tracker when state change event received - net/mlx5: E-Switch, Change mode lock from mutex to rw semaphore - net/mlx5: E-Switch, return error if encap isn't supported - scsi: core: sysfs: Fix hang when device state is set via sysfs - net: sched: act_mirred: drop dst for the direction from egress to ingress - [arm64] net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove - net: virtio_net_hdr_to_skb: count transport header in UFO - i40e: Fix correct max_pkt_size on VF RX queue - i40e: Fix NULL ptr dereference on VSI filter sync - i40e: Fix changing previously set num_queue_pairs for PFs - i40e: Fix ping is lost after configuring ADq on VF - i40e: Fix warning message and call stack during rmmod i40e driver - i40e: Fix creation of first queue by omitting it if is not power of two - i40e: Fix display error code in dmesg - e100: fix device suspend/resume (Closes: #995927) - [powerpc*] KVM: PPC: Book3S HV: Use GLOBAL_TOC for kvmppc_h_set_dabr/xdabr() - [x86] perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server - [x86] perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server - [s390x] kexec: fix return code handling - [arm64,armhf] net: stmmac: dwmac-rk: Fix ethernet on rk3399 based devices - tun: fix bonding active backup with arp monitoring - tipc: check for null after calling kmemdup - ipc: WARN if trying to remove ipc object which is absent - [x86] hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails - scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id() - [s390x] kexec: fix memory leak of ipl report buffer - block: Check ADMIN before NICE for IOPRIO_CLASS_RT - [x86] KVM: nVMX: don't use vcpu->arch.efer when checking host state on nested state load - udf: Fix crash after seekdir - [armhf] net: stmmac: socfpga: add runtime suspend/resume callback for stratix10 platform - btrfs: fix memory ordering between normal and ordered work functions - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type - drm/udl: fix control-message timeout - drm/nouveau: Add a dedicated mutex for the clients list (CVE-2020-27820) - drm/nouveau: use drm_dev_unplug() during device removal (CVE-2020-27820) - drm/nouveau: clean up all clients on device removal (CVE-2020-27820) - [x86] drm/i915/dp: Ensure sink rate values are always valid - drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors - scsi: ufs: core: Fix task management completion - scsi: ufs: core: Fix task management completion timeout race - hugetlbfs: flush TLBs correctly after huge_pmd_unshare (CVE-2021-4002) - RDMA/netlink: Add __maybe_unused to static inline in C file - selinux: fix NULL-pointer dereference when hashtab allocation fails - ASoC: DAPM: Cover regression by kctl change notification fix - ice: Delete always true check of PF pointer - fs: export an inode_update_time helper - btrfs: update device path inode time instead of bd_inode - [x86] ALSA: hda: hdac_ext_stream: fix potential locking issues - ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() - Revert "perf: Rework perf_event_exit_event()" https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.83 - bpf: Fix toctou on read-only map's constant scalar tracking (CVE-2021-4001) - ACPI: Get acpi_device's parent from the parent field - USB: serial: option: add Telit LE910S1 0x9200 composition - USB: serial: option: add Fibocom FM101-GL variants - [arm*] usb: dwc2: gadget: Fix ISOC flow for elapsed frames - [arm*] usb: dwc2: hcd_queue: Fix use of floating point literal - [arm64,armhf] usb: dwc3: gadget: Ignore NoStream after End Transfer - [arm64,armhf] usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer - [arm64,armhf] usb: dwc3: gadget: Fix null pointer exception - net: nexthop: fix null pointer dereference when IPv6 is not enabled - [arm64,armhf] usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe - usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts - usb: hub: Fix usb enumeration issue due to address0 race - usb: hub: Fix locking issues with address0_mutex - [arm*] binder: fix test regression due to sender_euid change - ALSA: ctxfi: Fix out-of-range access - ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100 - ALSA: hda/realtek: Fix LED on HP ProBook 435 G7 - media: cec: copy sequence field for the reply - HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts - [x86] staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() - fuse: release pipe buf after last use - xen: don't continue xenstore initialization in case of errors - xen: detect uninitialized xenbus in xenbus_init - [powerpc*] KVM: PPC: Book3S HV: Prevent POWER7/8 TLB flush flushing SLB - tracing/uprobe: Fix uprobe_perf_open probes iteration - tracing: Fix pid filtering when triggers are attached - [arm64,armhf] mmc: sdhci-esdhc-imx: disable CMDQ support - mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB - [armhf] mdio: aspeed: Fix "Link is Down" issue - [arm64] PCI: aardvark: Deduplicate code in advk_pcie_rd_conf() - [arm64] PCI: aardvark: Update comment about disabling link training - [arm64] PCI: aardvark: Implement re-issuing config requests on CRS response - [arm64] PCI: aardvark: Simplify initialization of rootcap on virtual bridge - [arm64] PCI: aardvark: Fix link training - proc/vmcore: fix clearing user buffer by properly using clear_user() - netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY - netfilter: ctnetlink: do not erase error code with EINVAL - netfilter: ipvs: Fix reuse connection if RS weight is 0 - netfilter: flowtable: fix IPv6 tunnel addr match - [x86] ASoC: topology: Add missing rwsem around snd_ctl_remove() calls - net: ieee802154: handle iftypes as u32 - NFSv42: Don't fail clone() unless the OP_CLONE operation failed - [armhf] socfpga: Fix crash with CONFIG_FORTIRY_SOURCE - drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks - scsi: mpt3sas: Fix kernel panic during drive powercycle test - [arm*] drm/vc4: fix error code in vc4_create_object() - iavf: Prevent changing static ITR values if adaptive moderation is on - ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336 codec - [arm64,armhf] firmware: smccc: Fix check for ARCH_SOC_ID not implemented - ipv6: fix typos in __ip6_finish_output() - nfp: checking parameter process for rx-usecs/tx-usecs is invalid - net: stmmac: fix system hang caused by eee_ctrl_timer during suspend/resume - net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls - net: ipv6: add fib6_nh_release_dsts stub - net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group - ice: fix vsi->txq_map sizing - ice: avoid bpf_prog refcount underflow - scsi: core: sysfs: Fix setting device state to SDEV_RUNNING - scsi: scsi_debug: Zero clear zones at reset write pointer - erofs: fix deadlock when shrink erofs slab - net/smc: Ensure the active closing peer first closes clcsock - [arm64,armhf] net: marvell: mvpp2: increase MTU limit when XDP enabled - nvmet-tcp: fix incomplete data digest send - [armhf] net/ncsi : Add payload to be 32-bit aligned to fix dropped packets - PM: hibernate: use correct mode for swsusp_close() - drm/amd/display: Set plane update flags for all planes in reset - tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows - lan743x: fix deadlock in lan743x_phy_link_status_change() - net: phylink: Force link down and retrigger resolve on interface change - net: phylink: Force retrigger in case of latched link-fail indicator - net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() - net/smc: Fix loop in smc_listen - nvmet: use IOCB_NOWAIT only if the filesystem supports it - igb: fix netpoll exit with traffic - [mips*] loongson64: fix FTLB configuration - [mips*] use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48 - net/sched: sch_ets: don't peek at classes beyond 'nbands' - net: vlan: fix underflow for the real_dev refcnt - net/smc: Don't call clcsock shutdown twice when smc shutdown - [arm64] net: hns3: fix VF RSS failed problem after PF enable multi-TCs - [arm64] net: mscc: ocelot: don't downgrade timestamping RX filters in SIOCSHWTSTAMP - [arm64] net: mscc: ocelot: correctly report the timestamping RX filters in ethtool - tcp: correctly handle increased zerocopy args struct size - sched/scs: Reset task stack state in bringup_cpu() - f2fs: set SBI_NEED_FSCK flag when inconsistent node block found - ceph: properly handle statfs on multifs setups - smb3: do not error on fsync when readonly - [amd64] iommu/amd: Clarify AMD IOMMUv2 initialization messages - vhost/vsock: fix incorrect used length reported to the guest - tracing: Check pid filtering when creating events - xen: sync include/xen/interface/io/ring.h with Xen's newest version - xen/blkfront: read response from backend only once - xen/blkfront: don't take local copy of a request from the ring page - xen/blkfront: don't trust the backend response data blindly - xen/netfront: read response from backend only once - xen/netfront: don't read data from request on the ring page - xen/netfront: disentangle tx_skb_freelist - xen/netfront: don't trust the backend response data blindly - tty: hvc: replace BUG_ON() with negative return value - [s390x] mm: validate VMA in PGSTE manipulation functions - shm: extend forced shm destroy to support objects from several IPC nses - net: stmmac: platform: fix build warning when with !CONFIG_PM_SLEEP - drm/amdgpu/gfx9: switch to golden tsc registers for renoir+ https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.84 - NFSv42: Fix pagecache invalidation after COPY/CLONE - can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM - ovl: simplify file splice - ovl: fix deadlock in splice write - gfs2: release iopen glock early in evict - gfs2: Fix length of holes reported at end-of-file - [powerpc*] pseries/ddw: Revert "Extend upper limit for huge DMA window for persistent memory" - mac80211: do not access the IV when it was stripped - net/smc: Transfer remaining wait queue entries during fallback - [amd64,arm64] atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975) - net: return correct error code - [x86] platform/x86: thinkpad_acpi: Add support for dual fan control - [x86] platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep - [s390x] setup: avoid using memblock_enforce_memory_limit - btrfs: check-integrity: fix a warning on write caching disabled disk - thermal: core: Reset previous low and high trip during thermal zone init - scsi: iscsi: Unblock session then wake up error handler - drm/amd/amdgpu: fix potential memleak - ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile - [arm64] ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() - ipv6: check return value of ipv6_skip_exthdr - net/smc: Avoid warning of possible recursive locking - ACPI: Add stubs for wakeup handler functions - vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit - kprobes: Limit max data_size of the kretprobe instances - rt2x00: do not mark device gone on EPROTO errors during start - ipmi: Move remove_work to dedicated workqueue - cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink() - [s390x] pci: move pseudo-MMIO to prevent MIO overlap - fget: check that the fd still exists after getting a ref to it - ipv6: fix memory leak in fib6_rule_suppress - drm/amd/display: Allow DSC on supported MST branch devices - KVM: Disallow user memslot with size that exceeds "unsigned long" - [x86] KVM: nVMX: Flush current VPID (L1 vs. L2) for KVM_REQ_TLB_FLUSH_GUEST - [x86] KVM: x86: Use a stable condition around all VT-d PI paths - [arm64] KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 to 1 - [x86] KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg() - wireguard: allowedips: add missing __rcu annotation to satisfy sparse - wireguard: device: reset peer src endpoint when netns exits - wireguard: receive: use ring buffer for incoming handshakes - wireguard: receive: drop handshakes if queue lock is contended - wireguard: ratelimiter: use kvcalloc() instead of kvzalloc() - [armhf] i2c: stm32f7: flush TX FIFO upon transfer errors - [armhf] i2c: stm32f7: recover the bus on access timeout - [armhf] i2c: stm32f7: stop dma transfer in case of NACK - tcp: fix page frag corruption on page fault - net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() - net: mpls: Fix notifications when deleting a device - siphash: use _unaligned version by default - [arm64] ftrace: add missing BTIs - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() - rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() - rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() - ALSA: intel-dsp-config: add quirk for CML devices based on ES8336 codec - net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ is available - [arm64,armhf] net: marvell: mvpp2: Fix the computation of shared CPUs - [arm64] dpaa2-eth: destroy workqueue at the end of remove function - net: annotate data-races on txq->xmit_lock_owner - ipv4: convert fib_num_tclassid_users to atomic_t - net/smc: fix wrong list_del in smc_lgr_cleanup_early - net/rds: correct socket tunable error in rds_tcp_tune() - net/smc: Keep smc_close_final rc during active close - [arm64] drm/msm/a6xx: Allocate enough space for GMU registers - [arm64] drm/msm: Do hw_init() before capturing GPU state - [amd64,arm64] atlantic: Increase delay for fw transactions - [amd64,arm64] atlatnic: enable Nbase-t speeds with base-t - [amd64,arm64] atlantic: Fix to display FW bundle version instead of FW mac version. - [amd64,arm64] atlantic: Add missing DIDs and fix 115c. - [amd64,arm64] Remove Half duplex mode speed capabilities. - [amd64,arm64] atlantic: Fix statistics logic for production hardware - [amd64,arm64] atlantic: Remove warn trace message. - [x86] KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register - [x86] KVM: VMX: Set failure code in prepare_vmcs02() - [x86] entry: Use the correct fence macro after swapgs in kernel CR3 - [x86] xen: Add xenpv_restore_regs_and_return_to_usermode() - sched/uclamp: Fix rq->uclamp_max not set on first enqueue - [x86] pv: Switch SWAPGS to ALTERNATIVE - [x86] entry: Add a fence for kernel entry SWAPGS in paranoid_entry() - vgacon: Propagate console boot parameters before calling `vc_resize' - xhci: Fix commad ring abort, write all 64 bits to CRCR register. - USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub - usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect - [x86] tsc: Add a timer to make sure TSC_adjust is always checked - [x86] tsc: Disable clocksource watchdog for TSC on qualified platorms - [x86] 64/mm: Map all kernel memory into trampoline_pgd - [arm64] tty: serial: msm_serial: Deactivate RX DMA for polling support - [arm*] serial: pl011: Add ACPI SBSA UART match id - [arm64,armhf] serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30 - serial: core: fix transmit-buffer reset and memleak - serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array - serial: 8250_pci: rewrite pericom_do_set_divisor() - serial: 8250: Fix RTS modem control while in rs485 mode - iwlwifi: mvm: retry init flow if failed - ipmi: msghandler: Make symbol 'remove_work_wq' static [ Salvatore Bonaccorso ] * integrity: Drop "MODSIGN: load blacklist from MOKx" as redundant after 5.10.47. * Bump ABI to 10 * Refresh "tools/perf: pmu-events: Fix reproducibility" * [rt] Update to 5.10.73-rt54 * [rt] Refresh "tracing: Merge irqflags + preempt counter." * Refresh "Export symbols needed by Android drivers" * [rt] Refresh "printk: introduce kernel sync mode" * [rt] Refresh "printk: move console printing to kthreads" * [rt] Drop "rcutorture: Avoid problematic critical section nesting on RT" * [rt] Add new signing key for Luis Claudio R. Goncalves * [rt] Update to 5.10.83-rt58 [ Ben Hutchings ] * tools/perf: Fix warning introduced by "tools/perf: pmu-events: Fix reproducibility" -- Salvatore Bonaccorso Wed, 08 Dec 2021 17:21:12 +0100 linux (5.10.70-1) bullseye; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.47 - module: limit enabling module.sig_enforce (CVE-2021-35039) - drm: add a locked version of drm_is_current_master - drm/nouveau: wait for moving fence after pinning v2 - drm/radeon: wait for moving fence after pinning - drm/amdgpu: wait for moving fence after pinning - [arm64] mmc: meson-gx: use memcpy_to/fromio for dram-access-quirk - [arm64] Ignore any DMA offsets in the max_zone_phys() calculation - [arm64] Force NO_BLOCK_MAPPINGS if crashkernel reservation is required - [arm64] spi: spi-nxp-fspi: move the register operation after the clock enable - [arm*] drm/vc4: hdmi: Move the HSM clock enable to runtime_pm - [arm*] drm/vc4: hdmi: Make sure the controller is powered in detect - [x86] entry: Fix noinstr fail in __do_fast_syscall_32() - [amd64] x86/xen: Fix noinstr fail in exc_xen_unknown_trap() - locking/lockdep: Improve noinstr vs errors - [x86] perf/x86/lbr: Remove cpuc->lbr_xsave allocation from atomic context - [x86] perf/x86/intel/lbr: Zero the xstate buffer on allocation - [armhf] dmaengine: stm32-mdma: fix PM reference leak in stm32_mdma_alloc_chan_resourc() - mac80211: remove warning in ieee80211_get_sband() - mac80211_hwsim: drop pending frames on stop - cfg80211: call cfg80211_leave_ocb when switching away from OCB - net: ipv4: Remove unneed BUG() function - mac80211: drop multicast fragments - net: ethtool: clear heap allocations for ethtool function - inet: annotate data race in inet_send_prepare() and inet_dgram_connect() - ping: Check return value of function 'ping_queue_rcv_skb' - net: annotate data race in sock_error() - inet: annotate date races around sk->sk_txhash - net/packet: annotate data race in packet_sendmsg() - net: phy: dp83867: perform soft reset and retain established link - net/packet: annotate accesses to po->bind - net/packet: annotate accesses to po->ifindex - r8152: Avoid memcpy() over-reading of ETH_SS_STATS - r8169: Avoid memcpy() over-reading of ETH_SS_STATS - net: qed: Fix memcpy() overflow of qed_dcbx_params() - mac80211: reset profile_periodicity/ema_ap - mac80211: handle various extensible elements correctly - [x86] PCI: Add AMD RS690 quirk to enable 64-bit DMA - [x86] perf/x86: Track pmu in per-CPU cpu_hw_events - [armhf] pinctrl: stm32: fix the reported number of GPIO lines per bank - i2c: i801: Ensure that SMBHSTSTS_INUSE_STS is cleared when leaving i801_access - gpiolib: cdev: zero padding during conversion to gpioline_info_changed - scsi: sd: Call sd_revalidate_disk() for ioctl(BLKRRPART) - nilfs2: fix memory leak in nilfs_sysfs_delete_device_group - [s390x] stack: fix possible register corruption with stack switch helper - i2c: robotfuzz-osif: fix control-request directions - ceph: must hold snap_rwsem when filling inode for async create - kthread_worker: split code for canceling the delayed work timer - kthread: prevent deadlock when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync() - [x86] fpu: Preserve supervisor states in sanitize_restored_user_xstate() - [x86] fpu: Make init_fpstate correct with optimized XSAVE - mm: add VM_WARN_ON_ONCE_PAGE() macro - mm/rmap: remove unneeded semicolon in page_not_mapped() - mm/rmap: use page_not_mapped in try_to_unmap() - mm, thp: use head page in __migration_entry_wait() - mm/thp: fix __split_huge_pmd_locked() on shmem migration entry - mm/thp: make is_huge_zero_pmd() safe and quicker - mm/thp: try_to_unmap() use TTU_SYNC for safe splitting - mm/thp: fix vma_address() if virtual address below file offset - mm/thp: fix page_address_in_vma() on file THP tails - mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page() - mm: thp: replace DEBUG_VM BUG with VM_WARN when unmap fails for split - mm: page_vma_mapped_walk(): use page for pvmw->page - mm: page_vma_mapped_walk(): settle PageHuge on entry - mm: page_vma_mapped_walk(): use pmde for *pvmw->pmd - mm: page_vma_mapped_walk(): prettify PVMW_MIGRATION block - mm: page_vma_mapped_walk(): crossing page table boundary - mm: page_vma_mapped_walk(): add a level of indentation - mm: page_vma_mapped_walk(): use goto instead of while (1) - mm: page_vma_mapped_walk(): get vma_address_end() earlier - mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes - mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk() - mm, futex: fix shared futex pgoff on shmem huge page - [x86] KVM: SVM: Call SEV Guest Decommission if ASID binding fails - netfs: fix test for whether we can skip read when writing beyond EOF - Revert "drm: add a locked version of drm_is_current_master" - certs: Add EFI_CERT_X509_GUID support for dbx entries (CVE-2020-26541) - certs: Move load_system_certificate_list to a common function - certs: Add ability to preload revocation certs - integrity: Load mokx variables into the blacklist keyring https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.48 - scsi: sr: Return appropriate error code when disk is ejected - [arm64,armhf] gpio: mxc: Fix disabled interrupt wake-up support - drm/nouveau: fix dma_address check for CPU/GPU sync - RDMA/mlx5: Block FDB rules when not in switchdev mode - [x86] Revert "KVM: x86/mmu: Drop kvm_mmu_extended_role.cr4_la57 hack" https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.49 - [powerpc*] KVM: PPC: Book3S HV: Save and restore FSCR in the P9 path - media: uvcvideo: Support devices that report an OT as an entity source - xen/events: reset active flag for lateeoi events later https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.50 - Bluetooth: hci_qca: fix potential GPF - Bluetooth: btqca: Don't modify firmware contents in-place - Bluetooth: Remove spurious error message - ALSA: usb-audio: fix rate on Ozone Z90 USB headset - ALSA: usb-audio: Fix OOB access at proc output - ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire - ALSA: usb-audio: scarlett2: Fix wrong resume call - ALSA: intel8x0: Fix breakage at ac97 clock measurement - ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 - ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 - ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 - ALSA: hda/realtek: Add another ALC236 variant support - ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 - ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx - ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D - ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too - ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC - media: dvb-usb: fix wrong definition - Input: usbtouchscreen - fix control-request directions - net: can: ems_usb: fix use-after-free in ems_usb_disconnect() - usb: gadget: eem: fix echo command packet response issue - USB: cdc-acm: blacklist Heimann USB Appset device - [arm64,armhf] usb: dwc3: Fix debugfs creation flow - usb: typec: Add the missed altmode_id_remove() in typec_register_altmode() - xhci: solve a double free problem while doing s4 - gfs2: Fix underflow in gfs2_page_mkwrite - gfs2: Fix error handling in init_statfs - copy_page_to_iter(): fix ITER_DISCARD case - iov_iter_fault_in_readable() should do nothing in xarray case - [powerpc*] crypto: nx - Fix memcpy() over-reading in nonce - [amd64] crypto: ccp - Annotate SEV Firmware file names - [armel,armhf] arm_pmu: Fix write counter incorrect in ARMv7 big-endian mode - btrfs: send: fix invalid path for unlink operations after parent orphanization - btrfs: compression: don't try to compress if we don't have enough pages - btrfs: clear defrag status of a root if starting transaction fails - ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle - ext4: fix kernel infoleak via ext4_extent_header - ext4: fix overflow in ext4_iomap_alloc() - ext4: return error code when ext4_fill_flex_info() fails - ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit - ext4: remove check for zero nr_to_scan in ext4_es_scan() - ext4: fix avefreec in find_group_orlov - ext4: use ext4_grp_locked_error in mb_find_extent - can: gw: synchronize rcu operations before removing gw job entry - can: isotp: isotp_release(): omit unintended hrtimer restart on socket release - can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done - can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path - mac80211: remove iwlwifi specific workaround that broke sta NDP tx - SUNRPC: Fix the batch tasks count wraparound. - SUNRPC: Should wake up the privileged task firstly. - bus: mhi: Wait for M2 state during system resume - mm/gup: fix try_grab_compound_head() race with split_huge_page() - [arm64] perf/smmuv3: Don't trample existing events with global filter - [x86] KVM: nVMX: Handle split-lock #AC exceptions that happen in L2 - [x86] KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs - [x86] KVM: x86/mmu: Use MMU's role to detect CR4.SMEP value in nested NPT walk - [s390x] cio: dont call css_wait_for_slow_path() inside a lock - [s390x] mm: Fix secure storage access exception handling - f2fs: Prevent swap file in LFS mode - [armhf] rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path - iio: light: tcs3472: do not free unallocated IRQ - iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and PS_DATA as volatile, too - iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR - iio: ltr501: ltr501_read_ps(): add missing endianness conversion - iio: accel: bma180: Fix BMA25x bandwidth register values - [arm64] serial: mvebu-uart: fix calculation of clock divisor - [sh4] serial: sh-sci: Stop dmaengine transfer in sci_stop_tx() - serial_cs: Add Option International GSM-Ready 56K/ISDN modem - serial_cs: remove wrong GLOBETROTTER.cis entry - ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() - ssb: sdio: Don't overwrite const buffer if block_write fails - rsi: Assign beacon rate settings to the correct rate_info descriptor field - rsi: fix AP mode with WPA failure due to encrypted EAPOL - tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing - seq_buf: Make trace_seq_putmem_hex() support data longer than 8 - [powerpc*] stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi() - loop: Fix missing discard support when using LOOP_CONFIGURE - fuse: Fix crash in fuse_dentry_automount() error path - fuse: Fix crash if superblock of submount gets killed early - fuse: Fix infinite loop in sget_fc() - fuse: ignore PG_workingset after stealing - fuse: check connected before queueing on fpq->io - fuse: reject internal errno - [arm*] thermal/cpufreq_cooling: Update offline CPUs per-cpu thermal_pressure - spi: Make of_register_spi_device also set the fwnode - Add a reference to ucounts for each cred - media: marvel-ccic: fix some issues when getting pm_runtime - [i386] spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages() - sched/core: Initialize the idle task with preemption disabled - [armhf] hwrng: exynos - Fix runtime PM imbalance on error - [powerpc*] crypto: nx - add missing MODULE_DEVICE_TABLE - media: cpia2: fix memory leak in cpia2_usb_probe - [arm64,armhf] media: hevc: Fix dependent slice segment flags - media: pvrusb2: fix warning in pvr2_i2c_core_done - [armhf] media: imx: imx7_mipi_csis: Fix logging of only error event counters - [x86] crypto: qat - check return code of qat_hal_rd_rel_reg() - [x86] crypto: qat - remove unused macro in FW loader - [arm64] crypto: qce: skcipher: Fix incorrect sg count for dma transfers - [arm64] perf: Convert snprintf to sysfs_emit - sched/fair: Fix ascii art by relpacing tabs - media: bt878: do not schedule tasklet when it is not setup - media: em28xx: Fix possible memory leak of em28xx struct - media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release - media: bt8xx: Fix a missing check bug in bt878_probe - media: dvd_usb: memory leak in cinergyt2_fe_attach - memstick: rtsx_usb_ms: fix UAF - mmc: via-sdmmc: add a check against NULL pointer dereference - [arm64,armhf] spi: meson-spicc: fix a wrong goto jump for avoiding memory leak. - [arm64,armhf] spi: meson-spicc: fix memory leak in meson_spicc_probe - crypto: shash - avoid comparing pointers to exported functions under CFI - media: dvb_net: avoid speculation from net slot - media: siano: fix device register error path - [armhf] media: imx-csi: Skip first few frames from a BT.656 source - [powerpc*] KVM: PPC: Book3S HV: Fix TLB management on SMT8 POWER9 and POWER10 processors - btrfs: fix error handling in __btrfs_update_delayed_inode - btrfs: abort transaction if we fail to update the delayed inode - btrfs: sysfs: fix format string for some discard stats - btrfs: don't clear page extent mapped if we're not invalidating the full page - btrfs: disable build on platforms having page size 256K - [s390x] KVM: get rid of register asm usage - [armhf] regulator: da9052: Ensure enough delay time for .set_voltage_time_sel - [x86] ACPI: video: use native backlight for GA401/GA502/GA503 - HID: do not use down_interruptible() when unbinding devices - ACPI: processor idle: Fix up C-state latency if not ordered - [x86] hv_utils: Fix passing zero to 'PTR_ERR' warning - lib: vsprintf: Fix handling of number field widths in vsscanf - ACPI: EC: Make more Asus laptops use ECDT _GPE - block_dump: remove block_dump feature in mark_inode_dirty() - blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter - blk-mq: clear stale request in tags->rq[] before freeing one request pool - fs: dlm: cancel work sync othercon - random32: Fix implicit truncation warning in prandom_seed_state() - open: don't silently ignore unknown O-flags in openat2() - [x86] drivers: hv: Fix missing error code in vmbus_connect() - fs: dlm: fix memory leak when fenced - ACPICA: Fix memory leak caused by _CID repair function - ACPI: bus: Call kobject_put() in acpi_init() error path - ACPI: resources: Add checks for ACPI IRQ override - block: fix race between adding/removing rq qos and normal IO - [x86] platform/x86: asus-nb-wmi: Revert "Drop duplicate DMI quirk structures" - [x86] platform/x86: asus-nb-wmi: Revert "add support for ASUS ROG Zephyrus G14 and G15" - [x86] platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard() - nvme-pci: fix var. type for increasing cq_head - nvmet-fc: do not check for invalid target port in nvmet_fc_handle_fcp_rqst() - [amd64] EDAC/Intel: Do not load EDAC driver when running as a guest - [amd64] PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv() - cifs: improve fallocate emulation - ACPI: EC: trust DSDT GPE for certain HP laptop - clocksource: Retry clock read if long delays detected - clocksource: Check per-CPU clock synchronization when marked unstable - tpm_tis_spi: add missing SPI device ID entries - ACPI: tables: Add custom DSDT file as makefile prerequisite - HID: wacom: Correct base usage for capacitive ExpressKey status bits - cifs: fix missing spinlock around update to ses->status - [arm64] mailbox: qcom: Use PLATFORM_DEVID_AUTO to register platform device - block: fix discard request merge - kthread_worker: fix return value when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync() - [ia64] mca_drv: fix incorrect array size calculation - writeback, cgroup: increment isw_nr_in_flight before grabbing an inode - spi: Allow to have all native CSs in use along with GPIOs - spi: Avoid undefined behaviour when counting unused native CSs - [arm64] media: venus: Rework error fail recover logic - [armhf] sata_highbank: fix deferred probing - sched/uclamp: Fix wrong implementation of cpu.uclamp.min - sched/uclamp: Fix locking around cpu_util_update_eff() - [mips*] pata_octeon_cf: avoid WARN_ON() in ata_host_activate() - [x86] elf: Use _BITUL() macro in UAPI headers - [x86] crypto: ccp - Fix a resource leak in an error handling path - media: rc: i2c: Fix an error message - media: au0828: fix a NULL vs IS_ERR() check - media: gspca/gl860: fix zero-length control requests - media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2() - [arm64] crypto: nitrox - fix unchecked variable in nitrox_register_interrupts - [amd64] crypto: x86/curve25519 - fix cpu feature checking logic in mod_exit - [arm64[ consistently use reserved_pg_dir - [arm64] mm: Fix ttbr0 values stored in struct thread_info for software-pan - media: subdev: remove VIDIOC_DQEVENT_TIME32 handling - hwmon: (lm70) Use device_get_match_data() - hwmon: (lm70) Revert "hwmon: (lm70) Add support for ACPI" - [x86] KVM: nVMX: Sync all PGDs on nested transition with shadow paging - [x86] KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap - [x86] KVM: nVMX: Don't clobber nested MMU's A/D status on EPTP switch - [x86] KVM: x86/mmu: Fix return value in tdp_mmu_map_handle_target_level() - [arm64] perf/arm-cmn: Fix invalid pointer when access dtc object sharing the same IRQ number - [arm64] KVM: arm64: Don't zero the cycle count register when PMCR_EL0.P is set - [arm64] regulator: hi655x: Fix pass wrong pointer to config.driver_data - btrfs: clear log tree recovering status if starting transaction fails - sched/rt: Fix RT utilization tracking during policy change - sched/rt: Fix Deadline utilization tracking during policy change - sched/uclamp: Fix uclamp_tg_restrict() - [armhf] spi: spi-sun6i: Fix chipselect/clock bug - [powerpc*] crypto: nx - Fix RCU warning in nx842_OF_upd_status - psi: Fix race between psi_trigger_create/destroy - media: v4l2-async: Clean v4l2_async_notifier_add_fwnode_remote_subdev - [armhf] media: video-mux: Skip dangling endpoints - PM / devfreq: Add missing error code in devfreq_add_device() - ACPI: PM / fan: Put fan device IDs into separate header file - block: avoid double io accounting for flush request - nvme-pci: look for StorageD3Enable on companion ACPI device instead - ACPI: sysfs: Fix a buffer overrun problem with description_show() - mark pstore-blk as broken - [armhf] clocksource/drivers/timer-ti-dm: Save and restore timer TIOCP_CFG - ACPI: APEI: fix synchronous external aborts in user-mode - blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled() - blk-wbt: make sure throttle is enabled properly - ACPI: Use DEVICE_ATTR_ macros - ACPI: bgrt: Fix CFI violation - cpufreq: Make cpufreq_online() call driver->offline() on errors - blk-mq: update hctx->dispatch_busy in case of real scheduler - ocfs2: fix snprintf() checking - dax: fix ENOMEM handling in grab_mapping_entry() - swap: fix do_swap_page() race with swapoff - mm/shmem: fix shmem_swapin() race with swapoff - mm: memcg/slab: properly set up gfp flags for objcg pointer array - mm: page_alloc: refactor setup_per_zone_lowmem_reserve() - mm/page_alloc: fix counting of managed_pages - xfrm: xfrm_state_mtu should return at least 1280 for ipv6 - drm/bridge: Fix the stop condition of drm_bridge_chain_pre_enable() - drm/ast: Fix missing conversions to managed API - [arm64,armhf] net: mvpp2: Put fwnode in error case during ->probe() - [i386] net: pch_gbe: Propagate error from devm_gpio_request_one() - [x86] drm/vmwgfx: Mark a surface gpu-dirty after the SVGA3dCmdDXGenMips command - [x86] drm/vmwgfx: Fix cpu updates of coherent multisample surfaces - net: qrtr: ns: Fix error return code in qrtr_ns_init() - [arm64] clk: meson: g12a: fix gp0 and hifi ranges - [armhf] net: ftgmac100: add missing error return code in ftgmac100_probe() - [arm64,armhf] drm: rockchip: set alpha_en to 0 if it is not used - [arm64] drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in cdn_dp_grf_write() - [arm64,armhf] drm/rockchip: dsi: move all lane config except LCDC mux to bind() - [arm64] drm/rockchip: cdn-dp: fix sign extension on an int multiply for a u64 result - RDMA/srp: Fix a recently introduced memory leak - [powerpc*] ehea: fix error return code in ehea_restart_qps() - xfrm: remove the fragment check for ipv6 beet mode - net/sched: act_vlan: Fix modify to allow 0 - RDMA/core: Sanitize WQ state received from the userspace - RDMA/rxe: Fix failure during driver load - [arm*] drm/vc4: hdmi: Fix error path of hpd-gpios - drm: qxl: ensure surf.data is ininitialized - tools/bpftool: Fix error return code in do_batch() - ath10k: go to path err_unsupported when chip id is not supported - ath10k: add missing error return code in ath10k_pci_probe() - wireless: carl9170: fix LEDS build errors & warnings - ieee802154: hwsim: Fix possible memory leak in hwsim_subscribe_all_others - [arm64] clk: imx8mq: remove SYS PLL 1/2 clock gates - [arm64] wcn36xx: Move hal_buf allocation to devm_kmalloc in probe - ssb: Fix error return code in ssb_bus_scan() - brcmfmac: fix setting of station info chains bitmask - brcmfmac: correctly report average RSSI in station info - brcmfmac: Fix a double-free in brcmf_sdio_bus_reset - brcmsmac: mac80211_if: Fix a resource leak in an error handling path - ath11k: Fix an error handling path in ath11k_core_fetch_board_data_api_n() - ath10k: Fix an error code in ath10k_add_interface() - ath11k: send beacon template after vdev_start/restart during csa - netlabel: Fix memory leak in netlbl_mgmt_add_common - RDMA/mlx5: Don't add slave port to unaffiliated list - netfilter: nft_exthdr: check for IPv6 packet before further processing - netfilter: nft_osf: check for TCP packet before further processing - netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols - RDMA/rxe: Fix qp reference counting for atomic ops - xsk: Fix missing validation for skb and unaligned mode - xsk: Fix broken Tx ring validation - bpf: Fix libelf endian handling in resolv_btfids - mt76: fix possible NULL pointer dereference in mt76_tx - vrf: do not push non-ND strict packets with a source LLA through packet taps again - net: sched: add barrier to ensure correct ordering for lockless qdisc - netfilter: nf_tables_offload: check FLOW_DISSECTOR_KEY_BASIC in VLAN transfer logic - pkt_sched: sch_qfq: fix qfq_change_class() error path - xfrm: Fix xfrm offload fallback fail case - iwlwifi: increase PNVM load timeout - rtw88: 8822c: fix lc calibration timing - vxlan: add missing rcu_read_lock() in neigh_reduce() - ip6_tunnel: fix GRE6 segmentation - net/ipv4: swap flow ports when validating source - ieee802154: hwsim: Fix memory leak in hwsim_add_one - ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl() - bpf: Fix null ptr deref with mixed tail calls and subprogs - [arm64] drm/msm: Fix error return code in msm_drm_init() - [arm64] drm/msm/dpu: Fix error return code in dpu_mdss_init() - mac80211: remove iwlwifi specific workaround NDPs of null_response - net: bcmgenet: Fix attaching to PYH failed on RPi 4B - ipv6: exthdrs: do not blindly use init_net - can: j1939: j1939_sk_setsockopt(): prevent allocation of j1939 filter for optlen == 0 - bpf: Do not change gso_size during bpf_skb_change_proto() - i40e: Fix error handling in i40e_vsi_open - i40e: Fix autoneg disabling for non-10GBaseT links - i40e: Fix missing rtnl locking when setting up pf switch - RDMA/cma: Protect RMW with qp_mutex - net: macsec: fix the length used to copy the key for offloading - net: phy: mscc: fix macsec key length - ipv6: fix out-of-bound access in ip6_parse_tlv() - e1000e: Check the PCIm state - RDMA/cma: Fix incorrect Packet Lifetime calculation - [amd64] gve: Fix swapped vars when fetching max queues - Revert "be2net: disable bh with spin_lock in be_process_mcc" - Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid - Bluetooth: Fix not sending Set Extended Scan Response - Bluetooth: Fix Set Extended (Scan Response) Data - Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event - [arm64] clk: qcom: clk-alpha-pll: fix CAL_L write in alpha_pll_fabia_prepare - writeback: fix obtain a reference to a freeing memcg css - net: lwtunnel: handle MTU calculation in forwading - net: sched: fix warning in tcindex_alloc_perfect_hash - net: tipc: fix FB_MTU eat two pages - RDMA/mlx5: Don't access NULL-cleared mpi pointer - RDMA/core: Always release restrack object - [mips*] Fix PKMAP with 32-bit MIPS huge page support - [x86] ASoC: rt5682: Disable irq on shutdown - rcu: Invoke rcu_spawn_core_kthreads() from rcu_spawn_gp_kthread() - [arm64] serial: fsl_lpuart: don't modify arbitrary data on lpuart32 - [arm64] serial: fsl_lpuart: remove RTSCTS handling from get_mctrl() - tty: nozomi: Fix a resource leak in an error handling function - mwifiex: re-fix for unaligned accesses - iio: adis_buffer: do not return ints in irq handlers - iio: adis16475: do not return ints in irq handlers - [arm64] ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() - mtd: partitions: redboot: seek fis-index-block in the right node - [arm*] staging: mmal-vchiq: Fix incorrect static vchiq_instance. - char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol() - leds: class: The -ENOTSUPP should never be seen by user space - scsi: FlashPoint: Rename si_flags field - scsi: iscsi: Flush block work before unblock - [armhf] fsi: core: Fix return of error values on failures - [armhf] fsi: scom: Reset the FSI2PIB engine for any error - [armhf] fsi: occ: Don't accept response from un-initialized OCC - [armhf] fsi/sbefifo: Clean up correct FIFO when receiving reset request from SBE - [armhf] fsi/sbefifo: Fix reset timeout - [amd64] iommu/amd: Fix extended features logging - [s390x] irq: select HAVE_IRQ_EXIT_ON_IRQ_STACK - [s390x] enable HAVE_IOREMAP_PROT - [s390x] appldata depends on PROC_SYSCTL - [amd64,arm64] iommu/dma: Fix IOVA reserve dma ranges - ASoC: max98373-sdw: use first_hw_init flag on resume - ASoC: rt1308-sdw: use first_hw_init flag on resume - ASoC: rt5682-sdw: use first_hw_init flag on resume - ASoC: rt700-sdw: use first_hw_init flag on resume - ASoC: rt711-sdw: use first_hw_init flag on resume - ASoC: rt715-sdw: use first_hw_init flag on resume - ASoC: rt5682: fix getting the wrong device id when the suspend_stress_test - ASoC: rt5682-sdw: set regcache_cache_only false before reading RT5682_DEVICE_ID - usb: gadget: f_fs: Fix setting of device and driver data cross-references - [arm*] usb: dwc2: Don't reset the core after setting turnaround time - [armhf] ASoC: fsl_spdif: Fix error handler with pm_runtime_enable - staging: rtl8712: fix error handling in r871xu_drv_init - staging: rtl8712: fix memory leak in rtl871x_load_fw_cb - serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates - of: Fix truncation of memory sizes on 32-bit platforms - [armhf] mtd: rawnand: marvell: add missing clk_disable_unprepare() on error in marvell_nfc_resume() - scsi: mpt3sas: Fix error return value in _scsih_expander_add() - soundwire: stream: Fix test for DP prepare complete - [powerpc*] powernv: Fix machine check reporting of async store errors - configfs: fix memleak in configfs_release_bin_file - [x86] ASoC: Intel: sof_sdw: add SOF_RT715_DAI_ID_FIX for AlderLake - [armhf] ASoC: fsl_spdif: Fix unexpected interrupt after suspend - [powerpc*] Offline CPU in stop_this_cpu() - [powerpc*] papr_scm: Properly handle UUID types and API - [powerpc*] 64s: Fix copy-paste data exposure into newly created tasks - [powerpc*] papr_scm: Make 'perf_stats' invisible if perf-stats unavailable - ALSA: firewire-lib: Fix 'amdtp_domain_start()' when no AMDTP_OUT_STREAM stream is found - [arm64] serial: mvebu-uart: do not allow changing baudrate when uartclk is not available - [arm64] serial: mvebu-uart: correctly calculate minimal possible baudrate - vfio/pci: Handle concurrent vma faults - mm/pmem: avoid inserting hugepage PTE entry with fsdax if hugepage support is disabled - mm/huge_memory.c: remove dedicated macro HPAGE_CACHE_INDEX_MASK - mm/huge_memory.c: add missing read-only THP checking in transparent_hugepage_enabled() - mm/huge_memory.c: don't discard hugepage if other processes are mapping it - mm/hugetlb: use helper huge_page_order and pages_per_huge_page - mm/hugetlb: remove redundant check in preparing and destroying gigantic page - hugetlb: remove prep_compound_huge_page cleanup - include/linux/huge_mm.h: remove extern keyword - mm/z3fold: fix potential memory leak in z3fold_destroy_pool() - mm/z3fold: use release_z3fold_page_locked() to release locked z3fold page - lib/math/rational.c: fix divide by zero - exfat: handle wrong stream entry size in exfat_readdir() - scsi: fc: Correct RHBA attributes length - scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd() - fscrypt: don't ignore minor_hash when hash is 0 - fscrypt: fix derivation of SipHash keys on big endian CPUs - tpm: Replace WARN_ONCE() with dev_err_once() in tpm_tis_status() - erofs: fix error return code in erofs_read_superblock() - io_uring: fix blocking inline submission - mmc: block: Disable CMDQ on the ioctl path - mmc: vub3000: fix control-request direction - scsi: core: Retry I/O for Notify (Enable Spinup) Required error - [arm64] crypto: qce - fix error return code in qce_skcipher_async_req_handle() - [s390x] preempt: Fix preempt_count initialization - cred: add missing return error code when set_cred_ucounts() failed - [amd64,arm64] iommu/dma: Fix compile warning in 32-bit builds - [powerpc*] preempt: Don't touch the idle task's preempt_count during hotplug https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.51 - drm/ast: Fixed CVE for DP501 - drm/amd/amdgpu/sriov disable all ip hw status by default - [arm*] drm/vc4: fix argument ordering in vc4_crtc_get_margins() - [i386] net: pch_gbe: Use proper accessors to BE data in pch_ptp_match() - hugetlb: clear huge pte during flush function on mips platform - atm: iphase: fix possible use-after-free in ia_module_exit() - mISDN: fix possible use-after-free in HFC_cleanup() - atm: nicstar: Fix possible use-after-free in nicstar_cleanup() - net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT - reiserfs: add check for invalid 1st journal block - drm/virtio: Fix double free on probe failure - net: mdio: provide shim implementation of devm_of_mdiobus_register - net/sched: cls_api: increase max_reclassify_loop - drm/scheduler: Fix hang when sched_entity released - drm/sched: Avoid data corruptions - udf: Fix NULL pointer dereference in udf_symlink function - [arm*] drm/vc4: Fix clock source for VEC PixelValve on BCM2711 - [arm*] drm/vc4: hdmi: Fix PM reference leak in vc4_hdmi_encoder_pre_crtc_co() - e100: handle eeprom as little endian - igb: handle vlan types with checker enabled - igb: fix assignment on big endian machines - net/mlx5e: IPsec/rep_tc: Fix rep_tc_update_skb drops IPsec packet - net/mlx5: Fix lag port remapping logic - [arm64,armhf] drm: rockchip: add missing registers for RK3188 - [arm64,armhf] drm: rockchip: add missing registers for RK3066 - net: stmmac: the XPCS obscures a potential "PHY not found" error - [arm64,armhf] clk: tegra: Fix refcounting of gate clocks - [arm64,armhf] clk: tegra: Ensure that PLLU configuration is applied properly - virtio-net: Add validation for used length - ipv6: use prandom_u32() for ID generation - [mips*] cpu-probe: Fix FPU detection on Ingenic JZ4760(B) - drm/amdgpu: remove unsafe optimization to drop preamble ib - net: tcp better handling of reordering then loss cases - RDMA/cxgb4: Fix missing error code in create_qp() - dm space maps: don't reset space map allocation cursor when committing - dm writecache: don't split bios when overwriting contiguous cache content - dm: Fix dm_accept_partial_bio() relative to zone management commands - [armhf] pinctrl: mcp23s08: fix race condition in irq handler - ice: set the value of global config lock timeout longer - virtio_net: Remove BUG() to avoid machine dead - [arm64] net: bcmgenet: check return value after calling platform_get_resource() - [arm64,armhf] net: mvpp2: check return value after calling platform_get_resource() - net: phy: realtek: add delay to fix RXC generation issue - [amd64] drm/amdkfd: use allowed domain for vmbo validation - [amd64] fjes: check return value after calling platform_get_resource() - selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC - r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM - xfrm: Fix error reporting in xfrm_state_construct. - dm writecache: commit just one block, not a full page - [arm64,armhf] wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP - [arm64,armhf] wl1251: Fix possible buffer overflow in wl1251_cmd_scan - ice: fix incorrect payload indicator on PTYPE - ice: mark PTYPE 2 as reserved - mt76: mt7615: fix fixed-rate tx status reporting - net: fix mistake path for netdev_features_strings - net: sched: fix error return code in tcf_del_walker() - io_uring: fix false WARN_ONCE - drm/amdgpu: fix bad address translation for sienna_cichlid - rtl8xxxu: Fix device info for RTL8192EU devices - [mips*] add PMD table accounting into MIPS'pmd_alloc_one - [arm64,armhf] net: fec: add ndo_select_queue to fix TX bandwidth fluctuations - atm: nicstar: use 'dma_free_coherent' instead of 'kfree' - atm: nicstar: register the interrupt handler in the right place - vsock: notify server to shutdown when client has pending signal - RDMA/rxe: Don't overwrite errno from ib_umem_get() - iwlwifi: mvm: don't change band on bound PHY contexts - iwlwifi: mvm: fix error print when session protection ends - iwlwifi: pcie: free IML DMA memory allocation - iwlwifi: pcie: fix context info freeing - sfc: avoid double pci_remove of VFs - sfc: error code if SRIOV cannot be disabled - wireless: wext-spy: Fix out-of-bounds warning - cfg80211: fix default HE tx bitrate mask in 2G band - mac80211: consider per-CPU statistics if present - mac80211_hwsim: add concurrent channels scanning support over virtio - IB/isert: Align target max I/O size to initiator size - net: ip: avoid OOM kills with large UDP sends over loopback - RDMA/cma: Fix rdma_resolve_route() memory leak - Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip. - Bluetooth: Fix the HCI to MGMT status conversion table - Bluetooth: Fix alt settings for incoming SCO with transparent coding format - Bluetooth: Shutdown controller after workqueues are flushed or cancelled - Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500) - Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails - Bluetooth: L2CAP: Fix invalid access on ECRED Connection response - Bluetooth: btusb: Add support USB ALT 3 for WBS - Bluetooth: mgmt: Fix the command returns garbage parameter value - Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc. - sched/fair: Ensure _sum and _avg values stay consistent - bpf: Fix false positive kmemleak report in bpf_ringbuf_area_alloc() - flow_offload: action should not be NULL when it is referenced - [mips*] loongsoon64: Reserve memory below starting pfn to prevent Oops - [mips*] set mips32r5 for virt extensions - [mips*] MT extensions are not available on MIPS32r1 - ath11k: unlock on error path in ath11k_mac_op_add_interface() - [arm64] dts: rockchip: Enable USB3 for rk3328 Rock64 - loop: fix I/O error on fsync() in detached loop devices - mm,hwpoison: return -EBUSY when migration fails - io_uring: simplify io_remove_personalities() - io_uring: Convert personality_idr to XArray - io_uring: convert io_buffer_idr to XArray - scsi: iscsi: Fix race condition between login and sync thread - scsi: iscsi: Fix iSCSI cls conn state - [powerpc*] mm: Fix lockup on kernel exec fault - [powerpc*] barrier: Avoid collision with clang's __lwsync macro - [powerpc*] powernv/vas: Release reference to tgid during window close - drm/amdgpu: enable sdma0 tmz for Raven/Renoir(V2) - drm/radeon: Add the missed drm_gem_object_put() in radeon_user_framebuffer_create() - drm/radeon: Call radeon_suspend_kms() in radeon_pci_shutdown() for Loongson64 - [arm*] drm/vc4: txp: Properly set the possible_crtcs mask - [arm*] drm/vc4: crtc: Skip the TXP - [arm*] drm/vc4: hdmi: Prevent clock unbalance - drm/dp: Handle zeroed port counts in drm_dp_read_downstream_info() - [arm64,armhf] drm/rockchip: dsi: remove extra component_del() call - pinctrl/amd: Add device HID for new AMD GPIO controller - drm/amd/display: Reject non-zero src_y and src_x for video planes - [arm64,armhf] drm/tegra: Don't set allow_fb_modifiers explicitly - [arm64] drm/msm/mdp4: Fix modifier support enabling - [arm64] drm/arm/malidp: Always list modifiers - drm/nouveau: Don't set allow_fb_modifiers explicitly - [x86] drm/i915/display: Do not zero past infoframes.vsc - mmc: sdhci-acpi: Disable write protect detection on Toshiba Encore 2 WT8-B - mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode - mmc: core: clear flags before allowing to retune - mmc: core: Allow UHS-I voltage switch for SDSC cards if supported - [armhf] ata: ahci_sunxi: Disable DIPM - [arm64] tlb: fix the TTL value of tlb_get_level - cpu/hotplug: Cure the cpusets trainwreck - [arm64,armhf] clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround - [arm64,armhf] ASoC: tegra: Set driver_name=tegra for all machine drivers - i40e: fix PTP on 5Gb links - qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute - ipmi/watchdog: Stop watchdog timer when the current action is 'none' - [x86] thermal/drivers/int340x/processor_thermal: Fix tcc setting - ubifs: Fix races between xattr_{set|get} and listxattr operations - power: supply: ab8500: Fix an old bug - mfd: syscon: Free the allocated name field of struct regmap_config - nvmem: core: add a missing of_node_put - seq_buf: Fix overflow in seq_buf_putmem_hex() - rq-qos: fix missed wake-ups in rq_qos_throttle try two - tracing: Simplify & fix saved_tgids logic - tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT - dm zoned: check zone capacity - dm writecache: flush origin device when writing and cache is full - dm btree remove: assign new_root only when removal succeeds - PCI: Leave Apple Thunderbolt controllers on for s2idle or standby - [arm64] PCI: aardvark: Fix checking for PIO Non-posted Request - [arm64] PCI: aardvark: Implement workaround for the readback value of VEND_ID - media: subdev: disallow ioctl for saa6588/davinci - media: dtv5100: fix control-request directions - media: zr364xx: fix memory leak in zr364xx_start_readpipe - media: gspca/sq905: fix control-request direction - media: gspca/sunplus: fix zero-length control requests - media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K - io_uring: fix clear IORING_SETUP_R_DISABLED in wrong function - dm writecache: write at least 4k when committing - [armhf] pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq() - drm/ast: Remove reference to struct drm_device.pdev - jfs: fix GPF in diFree - ext4: fix memory leak in ext4_fill_super - f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.52 - cifs: handle reconnect of tcon when there is no cached dfs referral - KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio - [x86] KVM: x86: Use guest MAXPHYADDR from CPUID.0x8000_0008 iff TDP is enabled - [x86] KVM: x86/mmu: Do not apply HPA (memory encryption) mask to GPAs - [x86] KVM: nSVM: Check the value written to MSR_VM_HSAVE_PA - [x86] KVM: X86: Disable hardware breakpoints unconditionally before kvm_x86->run() - scsi: core: Fix bad pointer dereference when ehandler kthread is invalid - [s390x] scsi: zfcp: Report port fc_security as unknown early during remote cable pull - tracing: Do not reference char * as a string in histograms - [x86] drm/i915/gtt: drop the page table optimisation - [x86] drm/i915/gt: Fix -EDEADLK handling regression - cgroup: verify that source is a string - fbmem: Do not delete the mode that is still in use - drm/dp_mst: Do not set proposed vcpi directly - drm/dp_mst: Avoid to mess up payload table by ports in stale topology - drm/dp_mst: Add missing drm parameters to recently added call to drm_dbg_kms() - Revert "drm/ast: Remove reference to struct drm_device.pdev" - net: bridge: multicast: fix PIM hello router port marking race - net: bridge: multicast: fix MRD advertisement router port marking race - [x86] ASoC: Intel: sof_sdw: add mutual exclusion between PCH DMIC and RT715 - [arm64] dmaengine: fsl-qdma: check dma_set_mask return value - scsi: arcmsr: Fix the wrong CDB payload report to IOP - srcu: Fix broken node geometry after early ssp init - rcu: Reject RCU_LOCKDEP_WARN() false positives - [arm64] tty: serial: fsl_lpuart: fix the potential risk of division or modulo by zero - [arm64] serial: fsl_lpuart: disable DMA for console and fix sysrq - [x86] misc/libmasm/module: Fix two use after free in ibmasm_init_one - [x86] ASoC: intel/boards: add missing MODULE_DEVICE_TABLE - partitions: msdos: fix one-byte get_unaligned() - iio: gyro: fxa21002c: Balance runtime pm + use pm_runtime_resume_and_get(). - iio: magn: bmc150: Balance runtime pm + use pm_runtime_resume_and_get() - Revert "ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro" - [arm64,armhf] usb: common: usb-conn-gpio: fix NULL pointer dereference of charger - w1: ds2438: fixing bug that would always get page0 - scsi: arcmsr: Fix doorbell status being updated late on ARC-1886 - [arm64] scsi: hisi_sas: Propagate errors in interrupt_init_v1_hw() - scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology - scsi: lpfc: Fix crash when lpfc_sli4_hba_setup() fails to initialize the SGLs - scsi: core: Cap scsi_host cmd_per_lun at can_queue - tty: serial: 8250: serial_cs: Fix a memory leak in error handling path - scsi: mpt3sas: Fix deadlock while cancelling the running firmware event - scsi: core: Fixup calling convention for scsi_mode_sense() - scsi: scsi_dh_alua: Check for negative result value - fs/jfs: Fix missing error code in lmLogInit() - scsi: megaraid_sas: Fix resource leak in case of probe failure - scsi: megaraid_sas: Early detection of VD deletion through RaidMap update - scsi: megaraid_sas: Handle missing interrupts while re-enabling IRQs - scsi: iscsi: Add iscsi_cls_conn refcount helpers - scsi: iscsi: Fix conn use after free during resets - scsi: iscsi: Fix shost->max_id use - scsi: qedi: Fix null ref during abort handling - scsi: qedi: Fix race during abort timeouts - scsi: qedi: Fix TMF session block/unblock use - scsi: qedi: Fix cleanup session block/unblock use - [armhf] mfd: da9052/stmpe: Add and modify MODULE_DEVICE_TABLE - [armhf] fsi: Add missing MODULE_DEVICE_TABLE - [s390x] disable SSP when needed - [i386] ALSA: sb: Fix potential double-free of CSP mixer elements - [powerpc*] ps3: Add dma_mask to ps3_dma_region - [arm64,armhf] iommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get fails - [arm64,armhf] iommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation - ASoC: soc-pcm: fix the return value in dpcm_apply_symmetry() - [arm64] gpio: zynq: Check return value of pm_runtime_get_sync - [arm64] gpio: zynq: Check return value of irq_get_irq_data - [x86] scsi: storvsc: Correctly handle multiple flags in srb_status - [powerpc*] ALSA: ppc: fix error return code in snd_pmac_probe() - [arm64,armhf] gpio: pca953x: Add support for the On Semi pca9655 - [powerpc*] mm/book3s64: Fix possible build error - ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() - [s390x] processor: always inline stap() and __load_psw_mask() - [s390x] ipl_parm: fix program check new psw handling - [s390x] mem_detect: fix diag260() program check new psw handling - [s390x] mem_detect: fix tprot() program check new psw handling - ALSA: bebob: add support for ToneWeal FW66 - ALSA: usb-audio: scarlett2: Fix 18i8 Gen 2 PCM Input count - ALSA: usb-audio: scarlett2: Fix data_mutex lock - ALSA: usb-audio: scarlett2: Fix scarlett2_*_ctl_put() return values - usb: gadget: f_hid: fix endianness issue with descriptors - [powerpc*] boot: Fixup device-tree on little endian - [x86] ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20 characters - [arm64,armhf] ALSA: hda: Add IRQ check for platform_get_irq() - ALSA: usb-audio: scarlett2: Fix 6i6 Gen 2 line out descriptions - ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol - staging: rtl8723bs: fix macro value for 2.4Ghz only device - [x86] intel_th: Wait until port is in reset before programming it - i2c: core: Disable client irq on reboot/shutdown - lib/decompress_unlz4.c: correctly handle zero-padding around initrds. - kcov: add __no_sanitize_coverage to fix noinstr for all architectures - [amd64] PCI: hv: Fix a race condition when removing the device - [x86] power: supply: max17042: Do not enforce (incorrect) interrupt trigger type - power: reset: gpio-poweroff: add missing MODULE_DEVICE_TABLE - PCI/P2PDMA: Avoid pci_get_slot(), which may sleep - NFSv4: Fix delegation return in cases where we have to retry - PCI: pciehp: Ignore Link Down/Up caused by DPC - [x86] watchdog: Fix possible use-after-free in wdt_startup() - [x86] watchdog: Fix possible use-after-free by calling del_timer_sync() - watchdog: iTCO_wdt: Account for rebooting on second timeout - [x86] fpu: Return proper error codes from user access functions - [armhf] remoteproc: core: Fix cdev remove and rproc del - [arm64,armhf] PCI: tegra: Add missing MODULE_DEVICE_TABLE - orangefs: fix orangefs df output. - ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty - [x86] drm/gma500: Add the missed drm_gem_object_put() in psb_user_framebuffer_create() - NFS: nfs_find_open_context() may only select open files - [arm64,armhf] pwm: tegra: Don't modify HW state in .remove callback - [arm64] ACPI: AMBA: Fix resource name in /proc/iomem - [x86] ACPI: video: Add quirk for the Dell Vostro 3350 - [arm64] PCI: rockchip: Register IRQ handlers after device and data are ready - virtio-blk: Fix memory leak among suspend/resume procedure - virtio_net: Fix error handling in virtnet_restore() - f2fs: atgc: fix to set default age threshold - NFSD: Fix TP_printk() format specifier in nfsd_clid_class - [x86] signal: Detect and prevent an alternate signal stack overflow - f2fs: add MODULE_SOFTDEP to ensure crc32 is included in the initramfs - f2fs: compress: fix to disallow temp extension - PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun - NFSv4: Fix an Oops in pnfs_mark_request_commit() when doing O_DIRECT - ubifs: Fix off-by-one error - ubifs: journal: Fix error return code in ubifs_jnl_write_inode() - [armhf] watchdog: aspeed: fix hardware timeout calculation - SUNRPC: prevent port reuse on transports which don't request it. - nfs: fix acl memory leak of posix_acl_create() - ubifs: Set/Clear I_LINKABLE under i_lock for whiteout inode - f2fs: fix to avoid adding tab before doc section - [x86] fpu: Fix copy_xstate_to_kernel() gap handling - [x86] fpu: Limit xstate copy size in xstateregs_set() - virtio_net: move tx vq operation under tx queue lock - nvme-tcp: can't set sk_user_data without write_lock - nfsd: Reduce contention for the nfsd_file nf_rwsem - [i386] ALSA: isa: Fix error return code in snd_cmi8330_probe() - vdpa/mlx5: Clear vq ready indication upon device reset - NFSv4/pnfs: Fix the layout barrier update - NFSv4/pnfs: Fix layoutget behaviour after invalidation - NFSv4/pNFS: Don't call _nfs4_pnfs_v3_ds_connect multiple times - [armhf] exynos: add missing of_node_put for loop iteration - [armhf] dts: exynos: fix PWM LED max brightness on Odroid HC1 - [armhf] dts: exynos: fix PWM LED max brightness on Odroid XU4 - [armel,armhf] memory: pl353: Fix error return code in pl353_smc_probe() - rtc: fix snprintf() checking in is_rtc_hctosys() - dt-bindings: i2c: at91: fix example for scl-gpios - [arm64] dts: allwinner: a64-sopine-baseboard: change RGMII mode to TXID - [armhf] dts: am335x: align ti,pindir-d0-out-d1-in property with dt-shema - [arm64] firmware: turris-mox-rwtm: fix reply status decoding function - [arm64] firmware: turris-mox-rwtm: report failures better - [arm64] firmware: turris-mox-rwtm: fail probing when firmware does not support hwrng - [arm64] firmware: turris-mox-rwtm: show message about HWRNG registration - scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe() - jump_label: Fix jump_label_text_reserved() vs __init - static_call: Fix static_call_text_reserved() vs __init - [mips*] always link byteswap helpers into decompressor - [mips*] disable branch profiling in boot/decompress.o - [mips*] vdso: Invalid GIC access through VDSO - scsi: scsi_dh_alua: Fix signedness bug in alua_rtpg() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.53 - [armhf] dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288 - [armhf] imx: pm-imx5: Fix references to imx5_cpu_suspend_info - [arm64] dts: rockchip: fix regulator-gpio states array - [armhf] dts: imx6dl-riotboard: configure PHY clock and set proper EEE value - [armhf] dts: am57xx-cl-som-am57x: fix ti,no-reset-on-init flag for gpios - [armhf] dts: am335x: fix ti,no-reset-on-init flag for gpios - [armhf] dts: OMAP2+: Replace underscores in sub-mailbox node names - [arm64] dts: qcom: sc7180: Move rmtfs memory region - [armhf] memory: tegra: Fix compilation warnings on 64bit platforms - [armel,armhf] dts: bcm283x: Fix up GPIO LED node names - [armhf] dts: rockchip: fix supply properties in io-domains nodes - [armhf] OMAP2+: Block suspend for am3 and am4 if PM is not configured - [arm64,armhf] soc/tegra: fuse: Fix Tegra234-only builds - thermal/core: Correct function name thermal_zone_device_unregister() - [arm64] arch/arm64/boot/dts/marvell: fix NAND partitioning scheme - [arm64,armhf] rtc: max77686: Do not enforce (incorrect) interrupt trigger type - scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8 - scsi: libsas: Add LUN number check in .slave_alloc callback - scsi: libfc: Fix array index out of bound exception - scsi: qedf: Add check to synchronize abort and flush - sched/fair: Fix CFS bandwidth hrtimer expiry type - [x86] perf/x86/intel/uncore: Clean up error handling path of iio mapping - thermal/core/thermal_of: Stop zone device before unregistering it - [s390x] traps: do not test MONITOR CALL without CONFIG_BUG - [s390x] introduce proper type handling call_on_stack() macro - cifs: prevent NULL deref in cifs_compose_mount_options() - [arm64] firmware: turris-mox-rwtm: add marvell,armada-3700-rwtm-firmware compatible string - [arm64] dts: marvell: armada-37xx: move firmware node to generic dtsi file - Revert "swap: fix do_swap_page() race with swapoff" - f2fs: Show casefolding support only when supported - mm/thp: simplify copying of huge zero page pmd when fork - mm/userfaultfd: fix uffd-wp special cases for fork() - mm/page_alloc: fix memory map initialization for descending nodes - [arm64] net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear - [arm64,armhf] net: dsa: mv88e6xxx: enable .port_set_policy() on Topaz - [arm64,armhf] net: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz - [arm64,armhf] net: dsa: mv88e6xxx: enable .rmu_disable() on Topaz - [arm64,armhf] net: dsa: mv88e6xxx: enable devlink ATU hash param for Topaz - net: ipv6: fix return value of ip6_skb_dst_mtu - netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo - net/sched: act_ct: fix err check for nf_conntrack_confirm - [x86] vmxnet3: fix cksum offload issues for tunnels with non-default udp ports - net/sched: act_ct: remove and free nf_table callbacks - net: bridge: sync fdb to new unicast-filtering ports - [arm64] net: bcmgenet: Ensure all TX/RX queues DMAs are disabled - net: ip_tunnel: fix mtu calculation for ETHER tunnel devices - [arm64] net: qcom/emac: fix UAF in emac_remove - net: ti: fix UAF in tlan_remove_one - net: send SYNACK packet with accepted fwmark - net: validate lwtstate->data before returning from skb_tunnel_info() - Revert "mm/shmem: fix shmem_swapin() race with swapoff" - [arm64,armhf] net: dsa: properly check for the bridge_leave methods in dsa_switch_bridge_leave() - dma-buf/sync_file: Don't leak fences on merge failure - [armhf] dts: aspeed: Fix AST2600 machines line names - [armhf] dts: tacoma: Add phase corrections for eMMC - tcp: annotate data races around tp->mtu_info - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized - ipv6: tcp: drop silly ICMPv6 packet too big messages - tcp: call sk_wmem_schedule before sk_mem_charge in zerocopy path - bpf: Track subprog poke descriptors correctly and fix use-after-free - udp: annotate data races around unix_sk(sk)->gso_size https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.54 - igc: Fix use-after-free error during reset - igb: Fix use-after-free error during reset - igc: change default return of igc_read_phy_reg() - ixgbe: Fix an error handling path in 'ixgbe_probe()' - igc: Fix an error handling path in 'igc_probe()' - igb: Fix an error handling path in 'igb_probe()' - e1000e: Fix an error handling path in 'e1000_probe()' - iavf: Fix an error handling path in 'iavf_probe()' - igb: Check if num of q_vectors is smaller than max before array access - igb: Fix position of assignment to *ring - [amd64] gve: Fix an error handling path in 'gve_probe()' - bonding: fix suspicious RCU usage in bond_ipsec_add_sa() - bonding: fix null dereference in bond_ipsec_add_sa() - ixgbevf: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops - bonding: fix suspicious RCU usage in bond_ipsec_del_sa() - bonding: disallow setting nested bonding + ipsec offload - bonding: Add struct bond_ipesc to manage SA - bonding: fix suspicious RCU usage in bond_ipsec_offload_ok() - bonding: fix incorrect return value of bond_ipsec_offload_ok() - ipv6: fix 'disable_policy' for fwd packets - stmmac: platform: Fix signedness bug in stmmac_probe_config_dt() - cxgb4: fix IRQ free race during driver unload - nvme-pci: do not call nvme_dev_remove_admin from nvme_remove - [x86] KVM: x86/pmu: Clear anythread deprecated bit when 0xa leaf is unsupported on the SVM - [armhf] spi: imx: add a check for speed_hz before calculating the clock - [armhf] spi: stm32: fixes pm_runtime calls in probe/remove - bpf, test: fix NULL pointer dereference on invalid expected_attach_type - bpf: Fix tail_call_reachable rejection for interpreter when jit failed - xdp, net: Fix use-after-free in bpf_xdp_link_release - timers: Fix get_next_timer_interrupt() with no timers pending - liquidio: Fix unintentional sign extension issue on left shift of u16 - [s390x] bpf: Perform r1 range checking before accessing jit->seen_reg[r1] - bpf, sockmap: Fix potential memory leak on unlikely error case - bpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats - bpf, sockmap, udp: sk_prot needs inuse_idx set for proc stats - bpftool: Check malloc return value in mount_bpffs_for_pin - net: fix uninit-value in caif_seqpkt_sendmsg - usb: hso: fix error handling code of hso_create_net_device (CVE-2021-37159) - dma-mapping: handle vmalloc addresses in dma_common_{mmap,get_sgtable} - efi/tpm: Differentiate missing and invalid final event log table. - net: decnet: Fix sleeping inside in af_decnet - [powerpc*] KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak - net: sched: fix memory leak in tcindex_partial_destroy_work - sctp: trim optlen when it's a huge value in sctp_setsockopt - netrom: Decrease sock refcount when sock timers expire - scsi: iscsi: Fix iface sysfs attr detection - scsi: target: Fix protect handling in WRITE SAME(32) - bnxt_en: don't disable an already disabled PCI device - bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe() - bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task() - bnxt_en: Validate vlan protocol ID on RX packets - bnxt_en: Check abort error state in bnxt_half_open_nic() - net/tcp_fastopen: fix data races around tfo_active_disable_stamp - ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID - [arm64] net: hns3: fix possible mismatches resp of mailbox - [arm64] net: hns3: fix rx VLAN offload state inconsistent issue - [arm*] spi: spi-bcm2835: Fix deadlock - net/sched: act_skbmod: Skip non-Ethernet packets - ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions - ceph: don't WARN if we're still opening a session to an MDS - nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING