Jammy update: v6.1.11 upstream stable release

[Timo Aaltonen]

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v6.1.11 upstream stable release
       from git://git.kernel.org/

Linux 6.1.11
bpf: Skip invalid kfunc call in backtrack_insn
gfs2: Always check inode size of inline inodes
gfs2: Cosmetic gfs2_dinode_{in,out} cleanup
wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
f2fs: fix to do sanity check on i_extra_isize in is_alive()
fbdev: smscufx: fix error handling code in ufx_usb_probe
f2fs: initialize locks earlier in f2fs_fill_super()
ovl: Use "buf" flexible array for memcpy() destination
fs/ntfs3: Validate attribute data and valid sizes
powerpc/imc-pmu: Revert nest_init_lock to being a mutex
powerpc/64s: Fix local irq disable when PMIs are disabled
powerpc/64s/radix: Fix crash with unaligned relocated kernel
iio:adc:twl6030: Enable measurement of VAC
ASoC: SOF: sof-audio: prepare_widgets: Check swidget for NULL on sink failure
platform/x86/amd: pmc: add CONFIG_SERIO dependency
serial: 8250_dma: Fix DMA Rx rearm race
serial: 8250_dma: Fix DMA Rx completion race
phy: qcom-qmp-combo: fix runtime suspend
nvmem: core: fix return value
nvmem: core: fix cell removal on error
nvmem: core: fix device node refcounting
nvmem: core: fix registration vs use race
nvmem: core: fix cleanup after dev_set_name()
nvmem: core: remove nvmem_config wp_gpio
nvmem: core: initialise nvmem->id early
drm/amdgpu: update wave data type to 3 for gfx11
drm/amd/pm: drop unneeded dpm features disablement for SMU 13.0.4/11
drm/amd: Fix initialization for nbio 4.3.0
drm/i915: Fix potential bit_17 double-free
drm/i915: Avoid potential vm use-after-free
serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler
dma-buf: actually set signaling bit for private stub fences
migrate: hugetlb: check for hugetlb shared PMD in node migration
maple_tree: fix mas_empty_area_rev() lower bound validation
Squashfs: fix handling and sanity checking of xattr_ids count
ia64: fix build error due to switch case label appearing next to declaration
highmem: round down the address passed to kunmap_flush_on_unmap()
mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups
mm, mremap: fix mremap() expanding for vma's with vm_ops->close()
mm/khugepaged: fix ->anon_vma race
mm/swapfile: add cond_resched() in get_swap_pages()
mm/uffd: fix pte marker when fork() without fork event
fpga: stratix10-soc: Fix return value check in s10_ops_write_init()
fpga: m10bmc-sec: Fix probe rollback
x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses
HV: hv_balloon: fix memory leak with using debugfs_lookup()
kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup()
usb: gadget: udc: do not clear gadget driver.bus
usb: typec: ucsi: Don't attempt to resume the ports before they exist
usb: gadget: f_uac2: Fix incorrect increment of bNumEndpoints
mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()
mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
mm: multi-gen LRU: fix crash during cgroup migration
Revert "mm: kmemleak: alloc gray object for reserved region with direct map"
riscv: disable generation of unwind tables
parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case
parisc: Replace hardcoded value with PRIV_USER constant in ptrace.c
parisc: Fix return code of pdc_iodc_print()
nvmem: qcom-spmi-sdam: fix module autoloading
nvmem: sunxi_sid: Always use 32-bit MMIO reads
nvmem: brcm_nvram: Add check for kzalloc
iio: imu: fxos8700: fix MAGN sensor scale and unit
iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN
iio: imu: fxos8700: fix failed initialization ODR mode assignment
iio: imu: fxos8700: fix incorrect ODR mode readback
iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback
iio: imu: fxos8700: fix map label of channel type to MAGN sensor
iio: imu: fxos8700: fix IMU data bits returned to user space
iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback
iio: imu: fxos8700: fix ACCEL measurement range selection
iio: light: cm32181: Fix PM support on system with 2 I2C resources
iio:adc:twl6030: Enable measurements of VUSB, VBAT and others
iio: imx8qxp-adc: fix irq flood when call imx8qxp_adc_read_raw()
iio: adc: berlin2-adc: Add missing of_node_put() in error path
iio: adc: xilinx-ams: fix devm_krealloc() return value check
iio: hid: fix the retval in gyro_3d_capture_sample
iio: hid: fix the retval in accel_3d_capture_sample
rtc: efi: Enable SET/GET WAKEUP services as optional
efi: Accept version 2 of memory attributes table
ASoC: SOF: keep prepare/unprepare widgets in sink path
ASoC: SOF: sof-audio: skip prepare/unprepare if swidget is NULL
ASoC: SOF: sof-audio: unprepare when swidget->use_count > 0
ASoC: codecs: wsa883x: correct playback min/max rates
ALSA: hda/realtek: fix mute/micmute LEDs, speaker don't work for a HP platform
ALSA: hda/realtek: Add Acer Predator PH315-54
watchdog: diag288_wdt: fix __diag288() inline assembly
watchdog: diag288_wdt: do not use stack buffers for hardware data
can: isotp: handle wait_event_interruptible() return values
can: isotp: split tx timer into transmission and timeout
net: qrtr: free memory on error path in radix_tree_insert()
ARM: dts: imx7d-smegw01: Fix USB host over-current polarity
hv_netvsc: Fix missed pagebuf entries in netvsc_dma_map/unmap()
cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()
fbcon: Check font dimension limits
vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
usb: dwc3: qcom: enable vbus override when in OTG dr-mode
iio: adc: stm32-dfsdm: fill module aliases
bcache: Silence memcpy() run-time false positive warnings
drm/amd/display: Fix timing not changning when freesync video is enabled
net/x25: Fix to not accept on connected socket
platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN
platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF
platform/x86: hp-wmi: Handle Omen Key event
platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table
x86/build: Move '-mindirect-branch-cs-prefix' out of GCC-only block
Revert "gfs2: stop using generic_writepages in gfs2_ail1_start_one"
i2c: rk3x: fix a bunch of kernel-doc warnings
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
perf/x86/intel/cstate: Add Emerald Rapids
perf/x86/intel: Add Emerald Rapids
x86/aperfmperf: Erase stale arch_freq_scale values when disabling frequency invariance readings
scsi: target: core: Fix warning on RT kernels
i2c: mxs: suppress probe-deferral error message
i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU
kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a PKCS#11 URI
certs: Fix build error when PKCS#11 URI contains semicolon
rtc: sunplus: fix format string for printing resource
efi: fix potential NULL deref in efi_mem_reserve_persistent
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
virtio-net: Keep stop() to follow mirror sequence of open()
selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking
selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs
selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided
selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning
ata: libata: Fix sata_down_spd_limit() when no link speed is reported
can: mcp251xfd: mcp251xfd_ring_set_ringparam(): assign missing tx_obj_num_coalesce_irq
can: raw: fix CAN FD frame transmissions over CAN XL devices
can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
octeontx2-af: Fix devlink unregister
igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp()
riscv: kprobe: Fixup kernel panic when probing an illegal position
ip/ip6_gre: Fix non-point-to-point tunnel not generating IPv6 link local address
ip/ip6_gre: Fix changing addr gen mode not generating IPv6 link local address
drm/panel: boe-tv101wum-nl6: Ensure DSI writes succeed during disable
net: phy: meson-gxl: Add generic dummy stubs for MMD register access
sctp: do not check hb_timer.expires when resetting hb_timer
maple_tree: should get pivots boundary by type
squashfs: harden sanity check in squashfs_read_xattr_id_table
kunit: fix kunit_test_init_section_suites(...)
block: ublk: extending queue_size to fix overflow
netfilter: br_netfilter: disable sabotage_in hook after first suppression
ALSA: firewire-motu: fix unreleased lock warning in hwdep device
net/tls: tls_is_tx_ready() checked list_entry
drm/i915/adlp: Fix typo for reference clock
drm/i915: Fix up locking around dumping requests lists
drm/i915: Fix request ref counting during error capture & debugfs dump
drm/i915/guc: Fix locking when searching for a hung request
platform/x86: thinkpad_acpi: Fix thinklight LED brightness returning 255
platform/x86/amd/pmf: Ensure mutexes are initialized before use
platform/x86/amd/pmf: Fix to update SPS thermals when power supply change
platform/x86/amd/pmf: Add helper routine to check pprof is balanced
platform/x86/amd/pmf: Fix to update SPS default pprof thermals
platform/x86/amd/pmf: Add helper routine to update SPS thermals
platform/x86/amd/pmf: update to auto-mode limits only after AMT event
fscache: Use wait_on_bit() to wait for the freeing of relinquished volume
netrom: Fix use-after-free caused by accept on already connected socket
block, bfq: fix uaf for bfqq in bic_set_bfqq()
block, bfq: replace 0/1 with false/true in bic apis
net: wwan: t7xx: Fix Runtime PM initialization
net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices
sfc: correctly advertise tunneled IPv6 segmentation
skb: Do mix page pool and page referenced frags in GRO
dpaa2-eth: execute xdp_do_flush() before napi_complete_done()
dpaa_eth: execute xdp_do_flush() before napi_complete_done()
virtio-net: execute xdp_do_flush() before napi_complete_done()
qede: execute xdp_do_flush() before napi_complete_done()
ice: Prevent set_channel from changing queues while RDMA active
vhost-scsi: unbreak any layout for response
use less confusing names for iov_iter direction initializers
fix "direction" argument of iov_iter_kvec()
fix 'direction' argument of iov_iter_{init,bvec}()
fix iov_iter_bvec() "direction" argument
memcpy_real(): WRITE is "data source", not destination...
zcore: WRITE is "data source", not destination...
READ is "data destination", not source...
WRITE is "data source", not destination...
copy_oldmem_kernel() - WRITE is "data source", not destination
vhost/net: Clear the pending messages when the backend is removed
ALSA: memalloc: Workaround for Xen PV
bpf: Fix the kernel crash caused by bpf_setsockopt().
scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT"
drm/ssd130x: Init display before the SSD130X_DISPLAY_ON command
drm/vc4: hdmi: make CEC adapter name unique
arm64: dts: imx8mm-verdin: Do not power down eth-phy
arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX
bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
media: v4l2-ctrls-api.c: move ctrl->is_new = 1 to the correct line
bpf: Add missing btf_put to register_btf_id_dtor_kfuncs
ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write()
selftests/filesystems: grant executable permission to run_fat_tests.sh
bpf: Fix to preserve reg parent/live fields when copying range info
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers
bpf: Fix off-by-one error in bpf_mem_cache_idx()
ASoC: Intel: avs: Implement PCI shutdown
ASoC: Intel: sof_es8336: Drop reference count of ACPI device after use
ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after use
ASoC: Intel: bytcr_rt5640: Drop reference count of ACPI device after use
ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use
ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device after use
ASoC: amd: acp-es8336: Drop reference count of ACPI device after use
arm64: dts: freescale: imx8dxl: fix sc_pwrkey's property name linux,keycode
arm64: dts: imx8m-venice: Remove incorrect 'uart-has-rtscts'
bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem-6.1 - 6.1.0-1008.8

---------------
linux-oem-6.1 (6.1.0-1008.8) jammy; urgency=medium

  * jammy/linux-oem-6.1: 6.1.0-1008.8 -proposed tracker (LP: #2008352)

  * overlayfs mounts as R/O over idmapped mount (LP: #2009065)
    - SAUCE: overlayfs: handle idmapped mounts in ovl_do_(set|remove)xattr

  * Some QHD panels fail to refresh when PSR2 enabled (LP: #2009014)
    - SAUCE: drm/i915/psr: Use calculated io and fast wake lines

  * Fix mediatek wifi driver crash when loading wrong SAR table (LP: #2009118)
    - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read

  * Packaging resync (LP: #1786013)
    - [Packaging] update update.conf

  * Update dg2_dmc to 2.08 (LP: #1999375)
    - drm/i915/dmc: Update DG2 DMC version to v2.08

  * New DG2 workarounds (LP: #2006945)
    - drm/i915/dg2: Introduce Wa_18017747507
    - drm/i915/dg2: Introduce Wa_18018764978
    - drm/i915/dg2: Introduce Wa_18019271663

  * Screen backlight keeps in minimized and can't change it with amdgpu
    (LP: #2008871)
    - SAUCE: ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535

  * Remove all other acpi_video backlight interface on Dell AIO platforms
    (LP: #2008882)
    - SAUCE: ACPI: video: Dell AIO UART backlight detection

  * screen flicker after PSR2 enabled (LP: #2007516)
    - SAUCE: drm/i915/display/psr: Disable PSR2 sel fetch on panel SHP 5457

  * rtcpie in timers from ubuntu_kernel_selftests randomly failing
    (LP: #1814234)
    - SAUCE: selftest: rtcpie: Force passing unreliable subtest

  * Fix HFP mSBC support on Realtek Bluetooth USB controller (LP: #2007331)
    - Bluetooth: btrtl: Add btrealtek data struct
    - Bluetooth: btusb: Ignore zero length of USB packets on ALT 6 for specific
      chip

  * Jammy update: v6.1.14 upstream stable release (LP: #2008708)
    - drm/etnaviv: don't truncate physical page address
    - wifi: ath11k: fix warning in dma_free_coherent() of memory chunks while
      recovery
    - wifi: rtl8xxxu: gen2: Turn on the rate control
    - drm/edid: Fix minimum bpc supported with DSC1.2 for HDMI sink
    - clk: mxl: Switch from direct readl/writel based IO to regmap based IO
    - clk: mxl: Remove redundant spinlocks
    - clk: mxl: Add option to override gate clks
    - clk: mxl: Fix a clk entry by adding relevant flags
    - powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G
    - clk: mxl: syscon_node_to_regmap() returns error pointers
    - sched/psi: Stop relying on timer_pending() for poll_work rescheduling
    - random: always mix cycle counter in add_latent_entropy()
    - scsi: libsas: Add smp_ata_check_ready_type()
    - scsi: hisi_sas: Fix SATA devices missing issue during I_T nexus reset
    - spi: mediatek: Enable irq when pdata is ready
    - docs: perf: Fix PMU instance name of hisi-pcie-pmu
    - KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception
    - KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid
    - KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
    - can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len
    - powerpc: dts: t208x: Disable 10G on MAC1 and MAC2
    - spi: mediatek: ...