Jammy update: v6.0.8 upstream stable release

[Timo Aaltonen]

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v6.0.8 upstream stable release
       from git://git.kernel.org/

Linux 6.0.8
wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
drm/i915/sdvo: Setup DDC fully before output init
drm/i915/sdvo: Filter out invalid outputs more sensibly
drm/amd/display: Update DSC capabilitie for DCN314
drm/amd/display: Update latencies on DCN321
drm/amdgpu: disable GFXOFF during compute for GFX11
drm/rockchip: dsi: Force synchronous probe
drm/rockchip: dsi: Clean up 'usage_mode' when failing to attach
cifs: fix regression in very old smb1 mounts
ext4,f2fs: fix readahead of verity data
KVM: x86: emulator: update the emulation mode after CR0 write
KVM: x86: emulator: update the emulation mode after rsm
KVM: x86: emulator: introduce emulator_recalc_and_set_mode
KVM: x86: emulator: em_sysexit should update ctxt->mode
KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format
KVM: arm64: Fix SMPRI_EL1/TPIDR2_EL0 trapping on VHE
KVM: arm64: Fix bad dereference on MTE-enabled systems
KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache
KVM: Initialize gfn_to_pfn_cache locks in dedicated helper
KVM: VMX: fully disable SGX if SECONDARY_EXEC_ENCLS_EXITING unavailable
KVM: VMX: Ignore guest CPUID for host userspace writes to DEBUGCTL
KVM: VMX: Fold vmx_supported_debugctl() into vcpu_supported_debugctl()
KVM: VMX: Advertise PMU LBRs if and only if perf supports LBRs
KVM: x86: Mask off reserved bits in CPUID.8000001FH
KVM: x86: Mask off reserved bits in CPUID.80000001H
KVM: x86: Mask off reserved bits in CPUID.80000008H
KVM: x86: Mask off reserved bits in CPUID.8000001AH
KVM: x86: Mask off reserved bits in CPUID.80000006H
x86/syscall: Include asm/ptrace.h in syscall_wrapper header
x86/tdx: Panic on bad configs that #VE on "private" memory access
x86/tdx: Prepare for using "INFO" call for a second purpose
ext4: update the backup superblock's at the end of the online resize
ext4: fix BUG_ON() when directory entry has invalid rec_len
ext4: fix warning in 'ext4_da_release_space'
parisc: Avoid printing the hardware path twice
parisc: Export iosapic_serial_irq() symbol for serial port driver
parisc: Make 8250_gsc driver dependend on CONFIG_PARISC
net: also flag accepted sockets supporting msghdr originated zerocopy
net: remove SOCK_SUPPORT_ZC from sockmap
perf/x86/intel: Fix pebs event constraints for SPR
perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[]
perf/x86/intel: Fix pebs event constraints for ICL
ARM: dts: imx6dl-yapp4: Do not allow PM to switch PU regulator off on Q/QP
arm64: entry: avoid kprobe recursion
net/ulp: remove SOCK_SUPPORT_ZC from tls sockets
efi: efivars: Fix variable writes with unsupported query_variable_store()
efi: random: Use 'ACPI reclaim' memory for random seed
efi: random: reduce seed size to 32 bytes
selftests/landlock: Build without static libraries
fuse: fix readdir cache race
fuse: add file_modified() to fallocate
capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
tracing/histogram: Update document for KEYS_MAX size
tools/nolibc/string: Fix memcmp() implementation
ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()
kprobe: reverse kp->flags when arm_kprobe failed
tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd()
fprobe: Check rethook_alloc() return in rethook initialization
tracing/fprobe: Fix to check whether fprobe is registered correctly
ftrace: Fix use-after-free for dynamic ftrace_ops
cxl/region: Fix 'distance' calculation with passthrough ports
cxl/region: Fix cxl_region leak, cleanup targets at region delete
cxl/region: Fix region HPA ordering validation
cxl/region: Fix decoder allocation crash
cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak
ACPI: NUMA: Add CXL CFMWS 'nodes' to the possible nodes set
btrfs: fix a memory allocation failure test in btrfs_submit_direct
btrfs: don't use btrfs_chunk::sub_stripes from disk
btrfs: fix type of parameter generation in btrfs_get_dentry
btrfs: fix tree mod log mishandling of reallocated nodes
btrfs: fix lost file sync on direct IO write with nowait and dsync iocb
clk: renesas: r8a779g0: Add SASYNCPER clocks
fscrypt: fix keyring memory leak on mount failure
fscrypt: stop using keyrings subsystem for fscrypt_master_key
Bluetooth: L2CAP: Fix attempting to access uninitialized memory
Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
i2c: piix4: Fix adapter not be removed in piix4_remove()
arm64: dts: juno: Add thermal critical trip points
firmware: arm_scmi: Fix deferred_tx_wq release on error paths
firmware: arm_scmi: Fix devres allocation device in virtio transport
firmware: arm_scmi: Make Rx chan_setup fail on memory errors
firmware: arm_scmi: Suppress the driver's bind attributes
ARM: dts: ux500: Add trips to battery thermal zones
blk-mq: Fix kmemleak in blk_mq_init_allocated_queue
block: Fix possible memory leak for rq_wb on add_disk failure
ublk_drv: return flag of UBLK_F_URING_CMD_COMP_IN_TASK in case of module
drm/i915: stop abusing swiotlb_max_segment
drm/rockchip: fix fbdev on non-IOMMU devices
drm/rockchip: dw_hdmi: filter regulator -EPROBE_DEFER error messages
arm64: dts: ls208xa: specify clock frequencies for the MDIO controllers
arm64: dts: ls1088a: specify clock frequencies for the MDIO controllers
arm64: dts: lx2160a: specify clock frequencies for the MDIO controllers
arm64: dts: imx93: correct gpio-ranges
arm64: dts: imx93: add gpio clk
arm64: dts: imx8: correct clock order
ARM: dts: imx6qdl-gw59{10,13}: fix user pushbutton GPIO offset
arm64: dts: imx8mn: Correct the usb power domain
arm64: dts: imx8mn: remove otg1 power domain dependency on hsio
arm64: dts: imx8mm: correct usb power domains
arm64: dts: imx8mm: remove otg1/2 power domain dependency on hsio
arm64: dts: verdin-imx8mp: fix ctrl_sleep_moci
clk: qcom: Update the force mem core bit for GPU clocks
clk: renesas: r8a779g0: Fix HSCIF parent clocks
efi/tpm: Pass correct address to memblock_reserve
arm64: dts: imx8mm: Enable CPLD_Dn pull down resistor on MX8Menlo
clk: rs9: Fix I2C accessors
bio: safeguard REQ_ALLOC_CACHE bio put
i2c: xiic: Add platform module alias
nvme-pci: disable write zeroes on various Kingston SSD
drm/amdgpu: dequeue mes scheduler during fini
drm/amdgpu: Program GC registers through RLCG interface in gfx_v11/gmc_v11
drm/amdkfd: Fix type of reset_type parameter in hqd_destroy() callback
drm/amd/pm: skip loading pptable from driver on secure board for smu_v13_0_10
drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in SRIOV case
HID: saitek: add madcatz variant of MMO7 mouse device ID
scsi: core: Restrict legal sdev_state transitions via sysfs
io_uring: don't iopoll from io_ring_ctx_wait_and_kill()
hwrng: bcm2835 - use hwrng_msleep() instead of cpu_relax()
ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()
drm/vc4: hdmi: Check the HSM rate at runtime_resume
media: v4l: subdev: Fail graciously when getting try data for NULL state
media: hantro: HEVC: Fix chroma offset computation
media: hantro: HEVC: Fix auxilary buffer size calculation
media: hantro: Store HEVC bit depth in context
media: meson: vdec: fix possible refcount leak in vdec_probe()
media: platform: cros-ec: Add Kuldax to the match table
media: dvb-frontends/drxk: initialize err to 0
media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE
media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
media: rkisp1: Zero v4l2_subdev_format fields in when validating links
media: rkisp1: Use correct macro for gradient registers
media: rkisp1: Initialize color space on resizer sink and source pads
media: rkisp1: Don't pass the quantization to rkisp1_csm_config()
media: rkisp1: Fix source pad format configuration
iio: adc: stm32-adc: fix channel sampling time init
vsock: fix possible infinite sleep in vsock_connectible_wait_data()
ipv6: fix WARNING in ip6_route_net_exit_late()
bridge: Fix flushing of dynamic FDB entries
net, neigh: Fix null-ptr-deref in neigh_table_clear()
net/smc: Fix possible leaked pernet namespace in smc_init()
stmmac: dwmac-loongson: fix invalid mdio_node
ibmvnic: Free rwi on reset success
net: mdio: fix undefined behavior in bit shift for __mdiobus_register
Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect
Bluetooth: L2CAP: Fix memory leak in vhci_write
Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
Bluetooth: virtio_bt: Use skb_put to set length
Bluetooth: hci_conn: Fix CIS connection dst_type handling
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
netfilter: ipset: enforce documented limit to prevent allocating huge memory
btrfs: fix ulist leaks in error paths of qgroup self tests
btrfs: fix inode list leak during backref walking at find_parent_nodes()
btrfs: fix inode list leak during backref walking at resolve_indirect_refs()
isdn: mISDN: netjet: fix wrong check of device registration
mISDN: fix possible memory leak in mISDN_register_device()
rose: Fix NULL pointer dereference in rose_send_frame()
ipvs: fix WARNING in ip_vs_app_net_cleanup()
ipvs: fix WARNING in __ip_vs_cleanup_batch()
ipvs: use explicitly signed chars
net: lan966x: Fix unmapping of received frames using FDMA
net: lan966x: Fix FDMA when MTU is changed
net: lan966x: Adjust maximum frame size when vlan is enabled/disabled
net: lan966x: Fix the MTU calculation
nfsd: fix net-namespace logic in __nfsd_file_cache_purge
nfsd: fix nfsd_file_unhash_and_dispose
sfc: Fix an error handling path in efx_pci_probe()
netfilter: nf_tables: release flow rule object from commit path
netfilter: nf_tables: netlink notifier might race to release objects
net: tun: fix bugs for oversize packet when napi frags enabled
net: sched: Fix use after free in red_enqueue()
ata: palmld: fix return value check in palmld_pata_probe()
ata: pata_legacy: fix pdc20230_set_piomode()
net: fec: fix improper use of NETDEV_TX_BUSY
nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
nfc: nxp-nci: Fix potential memory leak in nxp_nci_send()
nfc: fdp: Fix potential memory leak in fdp_nci_send()
net: dsa: fall back to default tagger if we can't load the one from DT
tools/nolibc: Fix missing strlen() definition and infinite loop with gcc-12
RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
net: dsa: Fix possible memory leaks in dsa_loop_init()
nfs4: Fix kmemleak when allocate slot failed
NFSv4.2: Fixup CLONE dest file size for zero-length count
SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed
NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
NFSv4: Fix a potential state reclaim deadlock
RDMA/rxe: Fix mr leak in RESPST_ERR_RNR
docs/process/howto: Replace C89 with C11
RDMA/hns: Fix NULL pointer problem in free_mr_init()
RDMA/hns: Disable local invalidate operation
IB/hfi1: Correctly move list in sc_disable()
RDMA/cma: Use output interface for net_dev check
usb: dwc3: gadget: Don't delay End Transfer on delayed_status
usb: dwc3: gadget: Force sending delayed status during soft disconnect

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-oem-6.0/6.0.0-1008.8 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem-6.0 - 6.0.0-1008.8

---------------
linux-oem-6.0 (6.0.0-1008.8) jammy; urgency=medium

  * jammy/linux-oem-6.0: 6.0.0-1008.8 -proposed tracker (LP: #1996347)

  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2022.11.14)

  * Fix a race condition with AMD PMF and Thinkpad-ACPI (LP: #1993242)
    - platform/x86/amd/pmf: Fix undefined reference to platform_profile
    - platform/x86/amd/pmf: Fix clang unused variable warning
    - platform/x86/amd/pmf: install notify handler after acpi init

  * Screen freeze after resuming from suspend (nvme0: I/O timeout)
    (LP: #1996048)
    - SAUCE: PCI: vmd: Disable MSI remapping after suspend

  * Fibocom WWAN FM350-GL suspend error (notebook not suspend) (LP: #1990700)
    - net: wwan: t7xx: Add AP CLDMA

  * Add some ACPI device IDs for Intel HID device (LP: #1995453)
    - platform/x86/intel/hid: Add some ACPI device IDs

  * amd_sfh modprobe fails when no sensor reported from AMD MP2 (LP: #1993240)
    - HID: amd_sfh: Change dev_err to dev_dbg for additional debug info

  * Jammy update: v6.0.9 upstream stable release (LP: #1996785)
    - drm/i915/gvt: Add missing vfio_unregister_group_dev() call
    - m68k: Rework BI_VIRT_RNG_SEED as BI_RNG_SEED
    - KVM: debugfs: Return retval of simple_attr_open() if it fails
    - drm/i915: Allow more varied alternate fixed modes for panels
    - drm/i915: Simplify intel_panel_add_edid_alt_fixed_modes()
    - drm/i915/sdvo: Grab mode_config.mutex during LVDS init to avoid WARNs
    - drm/amd/display: Acquire FCLK DPM levels on DCN32
    - drm/amd/display: Limit dcn32 to 1950Mhz display clock
    - drm/amd/display: Set memclk levels to be at least 1 for dcn32
    - drm/amdkfd: handle CPU fault on COW mapping
    - drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram()
    - cxl/region: Recycle region ids
    - HID: wacom: Fix logic used for 3rd barrel switch emulation
    - hwspinlock: qcom: correct MMIO max register for newer SoCs
    - phy: stm32: fix an error code in probe
    - wifi: cfg80211: silence a sparse RCU warning
    - wifi: cfg80211: fix memory leak in query_regdb_file()
    - soundwire: qcom: reinit broadcast completion
    - soundwire: qcom: check for outanding writes before doing a read
    - ALSA: arm: pxa: pxa2xx-ac97-lib: fix return value check of
      platform_get_irq()
    - spi: mediatek: Fix package division error
    - bpf, verifier: Fix memory leak in array reallocation for stack state
    - bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues
    - wifi: mac80211: fix general-protection-fault in ieee80211_subif_start_xmit()
    - wifi: mac80211: Set TWT Information Frame Disabled bit as 1
    - bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without
      FILE
    - HID: hyperv: fix possible memory leak in mousevsc_probe()
    - drm/vc4: hdmi: Fix HSM clock too low on Pi4
    - bpf, sock_map: Move cancel_work_sync() out of sock lock
    - PCI: hv: Fix the definition of vector in hv_compose_msi_msg()
    - bpf: Add helper macro bpf_for_each_reg_in_vstate
    - bpf: Fix wrong reg type conversi...