Impish update: upstream stable patchset 2022-01-18

[Kamal Mostafa]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       upstream stable patchset 2022-01-18

                Ported from the following upstream stable releases:
                        v5.10.86, v5.15.9
                        v5.10.87, v5.15.10
                        v5.10.88, v5.15.11

       from git://git.kernel.org/

netfilter: selftest: conntrack_vrf.sh: fix file permission
UBUNTU: upstream stable to v5.10.86, v5.15.9
nfc: fix segfault in nfc_genl_dump_devices_done
drm/msm/dsi: set default num_data_lanes
KVM: arm64: Save PSTATE early on exit
s390/test_unwind: use raw opcode instead of invalid instruction
Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
net/mlx4_en: Update reported link modes for 1/10G
ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P
parisc/agp: Annotate parisc agp init functions with __init
i2c: rk3x: Handle a spurious start completion interrupt flag
net: netlink: af_netlink: Prevent empty skb by adding a check on len.
drm/amd/display: Fix for the no Audio bug with Tiled Displays
drm/amd/display: add connector type check for CRC source set
tracing: Fix a kmemleak false positive in tracing_map
staging: most: dim2: use device release method
fuse: make sure reclaim doesn't write the inode
hwmon: (dell-smm) Fix warning on /proc/i8k creation error
ethtool: do not perform operations on net devices being unregistered
perf inject: Fix itrace space allowed for new attributes
memblock: free_unused_memmap: use pageblock units instead of MAX_ORDER
memblock: align freed memory map on pageblock boundaries with SPARSEMEM
memblock: ensure there is no overflow in memblock_overlaps_region()
arm: extend pfn_valid to take into account freed memory map alignment
arm: ioremap: don't abuse pfn_valid() to check if pfn is in RAM
hwmon: (corsair-psu) fix plain integer used as NULL pointer
perf bpf_skel: Do not use typedef to avoid error on old clang
netfs: Fix lockdep warning from taking sb_writers whilst holding mmap_lock
ice: fix FDIR init missing when reset VF
drm/msm/dp: Avoid unpowered AUX xfers that caused crashes
UBUNTU: upstream stable to v5.10.87, v5.15.10
KVM: selftests: Make sure kvm_create_max_vcpus test won't hit RLIMIT_NOFILE
KVM: downgrade two BUG_ONs to WARN_ON_ONCE
mac80211: fix regression in SSN handling of addba tx
mac80211: mark TX-during-stop for TX in in_reconfig
mac80211: send ADDBA requests using the tid/queue of the aggregation session
mac80211: validate extended element ID is present
firmware: arm_scpi: Fix string overflow in SCPI genpd driver
bpf: Fix signed bounds propagation after mov32
bpf: Make 32->64 bounds propagation slightly more robust
bpf, selftests: Add test case trying to taint map value pointer
virtio_ring: Fix querying of maximum DMA mapping size for virtio device
vdpa: check that offsets are within bounds
recordmcount.pl: look for jgnop instruction as well as bcrl on s390
dm btree remove: fix use after free in rebalance_children()
audit: improve robustness of the audit queue handling
arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from rk3399-khadas-edge
arm64: dts: rockchip: fix rk3308-roc-cc vcc-sd supply
arm64: dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
arm64: dts: rockchip: fix audio-supply for Rock Pi 4
mac80211: track only QoS data frames for admission control
tee: amdtee: fix an IS_ERR() vs NULL bug
ceph: fix duplicate increment of opened_inodes metric
ceph: initialize pathlen variable in reconnect_caps_cb
ARM: socfpga: dts: fix qspi node compatible
clk: Don't parent clks until the parent is fully registered
soc: imx: Register SoC device only on i.MX boards
virtio/vsock: fix the transport to work with VMADDR_CID_ANY
selftests: net: Correct ping6 expected rc from 2 to 1
s390/kexec_file: fix error handling when applying relocations
sch_cake: do not call cake_destroy() from cake_init()
inet_diag: fix kernel-infoleak for UDP sockets
net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
selftests: Add duplicate config only for MD5 VRF tests
selftests: Fix raw socket bind tests with VRF
selftests: Fix IPv6 address bind tests
dmaengine: st_fdma: fix MODULE_ALIAS
net/sched: sch_ets: don't remove idle classes from the round-robin list
selftest/net/forwarding: declare NETIFS p9 p10
drm/ast: potential dereference of null pointer
mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock
mac80211: fix lookup when adding AddBA extension element
flow_offload: return EOPNOTSUPP for the unsupported mpls action type
rds: memory leak in __rds_conn_create()
drm/amd/pm: fix a potential gpu_metrics_table memory leak
mptcp: clear 'kern' flag from fallback sockets
soc/tegra: fuse: Fix bitwise vs. logical OR warning
igb: Fix removal of unicast MAC filters of VFs
igbvf: fix double free in `igbvf_probe`
igc: Fix typo in i225 LTR functions
ixgbe: Document how to enable NBASE-T support
ixgbe: set X550 MDIO speed before talking to PHY
netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc
net/packet: rx_owner_map depends on pg_vec
sfc_ef100: potential dereference of null pointer
net: Fix double 0x prefix print in SKB dump
net/smc: Prevent smc_release() from long blocking
net: systemport: Add global locking for descriptor lifecycle
sit: do not call ipip6_dev_free() from sit_init_net()
bpf, selftests: Fix racing issue in btf_skc_cls_ingress test
powerpc/85xx: Fix oops when CONFIG_FSL_PMC=n
USB: gadget: bRequestType is a bitfield, not a enum
Revert "usb: early: convert to readl_poll_timeout_atomic()"
KVM: x86: Drop guest CPUID check for host initiated writes to MSR_IA32_PERF_CAPABILITIES
tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous
USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04)
usb: dwc2: fix STM ID/VBUS detection startup delay in dwc2_driver_probe
PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
PCI/MSI: Mask MSI-X vectors only on success
usb: xhci: Extend support for runtime power management for AMD's Yellow carp.
USB: serial: cp210x: fix CP2105 GPIO registration
USB: serial: option: add Telit FN990 compositions
btrfs: fix memory leak in __add_inode_ref()
btrfs: fix double free of anon_dev after failure to create subvolume
zonefs: add MODULE_ALIAS_FS
iocost: Fix divide-by-zero on donation from low hweight cgroup
serial: 8250_fintek: Fix garbled text for console
timekeeping: Really make sure wall_to_monotonic isn't positive
libata: if T_LENGTH is zero, dma direction should be DMA_NONE
drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE
Input: touchscreen - avoid bitwise vs logical OR warning
ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
xsk: Do not sleep in poll() when need_wakeup set
media: mxl111sf: change mutex_init() location
fuse: annotate lock in fuse_reverse_inval_entry()
ovl: fix warning in ovl_create_real()
scsi: scsi_debug: Don't call kcalloc() if size arg is zero
scsi: scsi_debug: Fix type in min_t to avoid stack OOB
scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
rcu: Mark accesses to rcu_state.n_force_qs
bus: ti-sysc: Fix variable set but not used warning for reinit_modules
Revert "xsk: Do not sleep in poll() when need_wakeup set"
xen/blkfront: harden blkfront against event channel storms
xen/netfront: harden netfront against event channel storms
xen/console: harden hvc_xen against event channel storms
xen/netback: fix rx queue stall detection
xen/netback: don't queue unlimited number of packages
KVM: VMX: clear vmx_x86_ops.sync_pir_to_irr if APICv is disabled
x86/kvm: remove unused ack_notifier callbacks
bpf: Fix kernel address leakage in atomic fetch
bpf, selftests: Add test case for atomic fetch on spilled pointer
bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg
bpf, selftests: Update test case for atomic cmpxchg on r0 with pointer
s390/entry: fix duplicate tracking of irq nesting level
ceph: fix up non-directory creation in SGID directories
btrfs: convert latest_bdev type to btrfs_device and rename
btrfs: use latest_dev in btrfs_show_devname
btrfs: update latest_dev when we create a sprout device
btrfs: remove stale comment about the btrfs_show_devname
drm/i915/hdmi: convert intel_hdmi_to_dev to intel_hdmi_to_i915
drm/i915/hdmi: Turn DP++ TMDS output buffers back on in encoder->shutdown()
pinctrl: amd: Fix wakeups when IRQ is shared with SCI
arm64: dts: rockchip: fix poweroff on helios64
dmaengine: idxd: add halt interrupt support
dmaengine: idxd: fix calling wq quiesce inside spinlock
arm64: dts: imx8mq: remove interconnect property from lcdif
iwlwifi: mvm: don't crash on invalid rate w/o STA
vdpa: Consider device id larger than 31
netdevsim: don't overwrite read only ethtool parms
dmaengine: idxd: fix missed completion on abort path
net: dsa: mv88e6xxx: Unforce speed & duplex in mac_link_down()
mptcp: never allow the PM to close a listener subflow
cfg80211: Acquire wiphy mutex on regulatory work
net: stmmac: fix tc flower deletion for VLAN priority Rx steering
mptcp: remove tcp ulp setsockopt support
mptcp: fix deadlock in __mptcp_push_pending()
dsa: mv88e6xxx: fix debug print for SPEED_UNFORCED
arm64: kexec: Fix missing error code 'ret' warning in load_other_segments()
bpf: Fix extable fixup offset.
usb: cdnsp: Fix incorrect status for control request
usb: cdnsp: Fix incorrect calling of cdnsp_died function
usb: cdnsp: Fix issue in cdnsp_log_ep trace event
usb: cdnsp: Fix lack of spin_lock_irqsave/spin_lock_restore
usb: typec: tcpm: fix tcpm unregister port but leave a pending timer
selinux: fix sleeping function called from invalid context
btrfs: check WRITE_ERR when trying to read an extent buffer
btrfs: fix missing blkdev_put() call in btrfs_scan_one_device()
cifs: sanitize multiple delimiters in prepath
riscv: dts: unleashed: Add gpio card detect to mmc-spi-slot
riscv: dts: unmatched: Add gpio card detect to mmc-spi-slot
perf inject: Fix segfault due to close without open
drm/amdgpu: don't override default ECO_BITs setting
drm/amd/pm: fix reading SMU FW version from amdgpu_firmware_info on YC
can: m_can: make custom bittiming fields const
can: m_can: pci: use custom bit timings for Elkhart Lake
xsk: Do not sleep in poll() when need_wakeup set
mptcp: add missing documented NL params
USB: core: Make do_proc_control() and do_proc_bulk() killable
UBUNTU: upstream stable to v5.10.88, v5.15.11

[Stefan Bader (smb)]

Skipped (already applied):
- net/sched: sch_ets: don't remove idle classes from the round-robin list
- net/packet: rx_owner_map depends on pg_vec

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.13.0-37.42

---------------
linux (5.13.0-37.42) impish; urgency=medium

  * impish/linux: 5.13.0-37.42 -proposed tracker (LP: #1964959)

  * CVE-2022-0742
    - ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()

linux (5.13.0-36.41) impish; urgency=medium

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - debian/dkms-versions -- update from kernel-versions (main/2022.02.21)

  * Broken network on some AWS instances with focal/impish kernels
    (LP: #1961968)
    - SAUCE: Revert "PCI/MSI: Mask MSI-X vectors only on success"

  * [SRU]PCI: vmd: Do not disable MSI-X remapping if interrupt remapping is
    enabled by IOMMU (LP: #1937295)
    - PCI: vmd: Do not disable MSI-X remapping if interrupt remapping is enabled
      by IOMMU

  * [UBUNTU 20.04] kernel: Add support for CPU-MF counter second version 7
    (LP: #1960182)
    - s390/cpumf: Support for CPU Measurement Facility CSVN 7
    - s390/cpumf: Support for CPU Measurement Sampling Facility LS bit

  * [UBUNTU 21.10] s390/cio: verify the driver availability for path_event call
    (LP: #1960875)
    - s390/cio: verify the driver availability for path_event call

  * Impish update: upstream stable patchset 2022-02-14 (LP: #1960861)
    - devtmpfs regression fix: reconfigure on each mount
    - orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()
    - remoteproc: qcom: pil_info: Don't memcpy_toio more than is provided
    - perf: Protect perf_guest_cbs with RCU
    - KVM: x86: Register Processor Trace interrupt hook iff PT enabled in guest
    - KVM: s390: Clarify SIGP orders versus STOP/RESTART
    - 9p: only copy valid iattrs in 9P2000.L setattr implementation
    - video: vga16fb: Only probe for EGA and VGA 16 color graphic cards
    - media: uvcvideo: fix division by zero at stream start
    - rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with
      interrupts enabled
    - firmware: qemu_fw_cfg: fix sysfs information leak
    - firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries
    - firmware: qemu_fw_cfg: fix kobject leak in probe error path
    - KVM: x86: remove PMU FIXED_CTR3 from msrs_to_save_all
    - ALSA: hda/realtek: Add speaker fixup for some Yoga 15ITL5 devices
    - ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after
      reboot from Windows
    - ALSA: hda: ALC287: Add Lenovo IdeaPad Slim 9i 14ITL5 speaker quirk
    - ALSA: hda/realtek: Add quirk for Legion Y9000X 2020
    - ALSA: hda/realtek: Re-order quirk entries for Lenovo
    - powerpc/pseries: Get entry and uaccess flush required bits from
      H_GET_CPU_CHARACTERISTICS
    - mtd: fixup CFI on ixp4xx
    - KVM: x86: don't print when fail to read/write pv eoi memory
    - remoteproc: qcom: pas: Add missing power-domain "mxc" for CDSP
    - perf annotate: Avoid TUI crash when navigating in the annotation of
      recursive functions
    - ALSA: hda/realtek: Use ALC285_FIXUP_HP_GPIO_LED on another HP laptop
    - ALSA: hda/tegra: Fix Tegra194 HDA reset failure

  * CVE-2022-0516
    - KVM: s390: Return error on SIDA memop on normal guest

  * CVE-2022-04...