Focal update: v5.4.150 upstream stable release

[Kamal Mostafa]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v5.4.150 upstream stable release
       from git://git.kernel.org/

ocfs2: drop acl cache for directories too
usb: gadget: r8a66597: fix a loop in set_feature()
usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave
usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA
usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()
cifs: fix incorrect check for null pointer in header_assemble
xen/x86: fix PV trap handling on secondary processors
usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter
USB: cdc-acm: fix minor-number release
binder: make sure fd closes complete
staging: greybus: uart: fix tty use after free
Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
USB: serial: mos7840: remove duplicated 0xac24 device ID
USB: serial: option: add Telit LN920 compositions
USB: serial: option: remove duplicate USB device ID
USB: serial: option: add device id for Foxconn T99W265
mcb: fix error handling in mcb_alloc_bus()
erofs: fix up erofs_lookup tracepoint
btrfs: prevent __btrfs_dump_space_info() to underflow its free space
serial: mvebu-uart: fix driver's tx_empty callback
net: hso: fix muxed tty registration
afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation
platform/x86/intel: punit_ipc: Drop wrong use of ACPI_PTR()
enetc: Fix illegal access when reading affinity_hint
bnxt_en: Fix TX timeout when TX ring size is set to the smallest
net/smc: add missing error check in smc_clc_prfx_set()
gpio: uniphier: Fix void functions to remove return value
qed: rdma - don't wait for resources under hw error recovery flow
net/mlx4_en: Don't allow aRFS for encapsulated packets
scsi: iscsi: Adjust iface sysfs attr detection
tty: synclink_gt, drop unneeded forward declarations
tty: synclink_gt: rename a conflicting function name
fpga: machxo2-spi: Return an error on failure
fpga: machxo2-spi: Fix missing error code in machxo2_write_complete()
thermal/core: Potential buffer overflow in thermal_build_list_of_policies()
cifs: fix a sign extension bug
scsi: qla2xxx: Restore initiator in dual mode
scsi: lpfc: Use correct scnprintf() limit
irqchip/goldfish-pic: Select GENERIC_IRQ_CHIP to fix build
irqchip/gic-v3-its: Fix potential VPE leak on error
md: fix a lock order reversal in md_alloc
blktrace: Fix uaf in blk_trace access after removing by sysfs
net: macb: fix use after free on rmmod
net: stmmac: allow CSR clock of 300MHz
m68k: Double cast io functions to unsigned long
ipv6: delay fib6_sernum increase in fib6_add
bpf: Add oversize check before call kvcalloc()
xen/balloon: use a kernel thread instead a workqueue
nvme-multipath: fix ANA state updates when a namespace is not present
sparc32: page align size in arch_dma_alloc
blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd
compiler.h: Introduce absolute_pointer macro
net: i825xx: Use absolute_pointer for memcpy from fixed memory location
sparc: avoid stringop-overread errors
qnx4: avoid stringop-overread errors
parisc: Use absolute_pointer() to define PAGE0
arm64: Mark __stack_chk_guard as __ro_after_init
alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile
net: 6pack: Fix tx timeout and slot time
spi: Fix tegra20 build with CONFIG_PM=n
EDAC/synopsys: Fix wrong value type assignment for edac_mode
thermal/drivers/int340x: Do not set a wrong tcc offset on resume
arm64: dts: marvell: armada-37xx: Extend PCIe MEM space
xen/balloon: fix balloon kthread freezing
qnx4: work around gcc false positive warning bug
Linux 5.4.150
UBUNTU: upstream stable to v5.4.150

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.4.0-91.102

---------------
linux (5.4.0-91.102) focal; urgency=medium

  * focal/linux: 5.4.0-91.102 -proposed tracker (LP: #1949840)

  * Packaging resync (LP: #1786013)
    - [Packaging] update Ubuntu.md
    - debian/dkms-versions -- update from kernel-versions (main/2021.11.08)

  * KVM emulation failure when booting into VM crash kernel with multiple CPUs
    (LP: #1948862)
    - KVM: x86: Properly reset MMU context at vCPU RESET/INIT

  * aufs: kernel bug with apparmor and fuseblk (LP: #1948470)
    - SAUCE: aufs: bugfix, stop omitting path->mnt

  * ebpf: bpf_redirect fails with ip6 gre interfaces (LP: #1947164)
    - net: handle ARPHRD_IP6GRE in dev_is_mac_header_xmit()

  * require CAP_NET_ADMIN to attach N_HCI ldisc (LP: #1949516)
    - Bluetooth: hci_ldisc: require CAP_NET_ADMIN to attach N_HCI ldisc

  * ACL updates on OCFS2 are not revalidated (LP: #1947161)
    - ocfs2: fix remounting needed after setfacl command

  * ppc64 BPF JIT mod by 1 will not return 0 (LP: #1948351)
    - powerpc/bpf: Fix BPF_MOD when imm == 1

  * Drop "UBUNTU: SAUCE: cachefiles: Page leaking in
    cachefiles_read_backing_file while vmscan is active" (LP: #1947709)
    - Revert "UBUNTU: SAUCE: cachefiles: Page leaking in
      cachefiles_read_backing_file while vmscan is active"

  * Reassign I/O Path of ConnectX-5 Port 1 before Port 2 causes NULL dereference
    (LP: #1943464)
    - s390/pci: fix leak of PCI device structure
    - s390/pci: fix use after free of zpci_dev
    - s390/pci: fix zpci_zdev_put() on reserve

  * [SRU][F] USB: serial: pl2303: add support for PL2303HXN (LP: #1948377)
    - USB: serial: pl2303: add support for PL2303HXN
    - USB: serial: pl2303: fix line-speed handling on newer chips

  * Focal update: v5.4.151 upstream stable release (LP: #1947888)
    - tty: Fix out-of-bound vmalloc access in imageblit
    - cpufreq: schedutil: Use kobject release() method to free sugov_tunables
    - cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
    - usb: cdns3: fix race condition before setting doorbell
    - fs-verity: fix signed integer overflow with i_size near S64_MAX
    - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary
      structure field
    - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary
      structure field
    - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary
      structure field
    - scsi: ufs: Fix illegal offset in UPIU event trace
    - mac80211: fix use-after-free in CCMP/GCMP RX
    - x86/kvmclock: Move this_cpu_pvti into kvmclock.h
    - drm/amd/display: Pass PCI deviceid into DC
    - ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
    - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced
      from sysfs
    - mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
    - mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
    - mac80211: mesh: fix potentially unaligned access
    - mac80211-hwsim: fix late beacon hrtimer handling
    - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
    - hwmon: (tmp421) report /P...