Focal update: v5.4.240 upstream stable release

[Luke Nowakowski-Krijger]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v5.4.240 upstream stable patchset
       from git://git.kernel.org/

net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
iavf: fix inverted Rx hash condition leading to disabled hash
iavf: fix non-tunneled IPv6 UDP packet type and hashing
intel/igbvf: free irq on the error path in igbvf_request_msix()
igbvf: Regard vf reset nack as success
i2c: imx-lpi2c: check only for enabled interrupt flags
scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
net: usb: smsc95xx: Limit packet length to skb->len
qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
net: qcom/emac: Fix use after free bug in emac_remove due to race condition
net/ps3_gelic_net: Fix RX sk_buff length
net/ps3_gelic_net: Use dma_mapping_error
keys: Do not cache key in task struct if key is requested from kernel thread
bpf: Adjust insufficient default bpf_jit_limit
net/mlx5: Read the TC mapping of all priorities on ETS query
atm: idt77252: fix kmemleak when rmmod idt77252
erspan: do not use skb_mac_header() in ndo_start_xmit()
net/sonic: use dma_mapping_error() for error check
nvme-tcp: fix nvme_tcp_term_pdu to match spec
hvc/xen: prevent concurrent accesses to the shared ring
net: mdio: thunder: Add missing fwnode_handle_put()
Bluetooth: btqcomsmd: Fix command timeout after setting BD address
platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl
hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
scsi: qla2xxx: Perform lockless command completion in abort path
uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2
thunderbolt: Use const qualifier for `ring_interrupt_index`
riscv: Bump COMMAND_LINE_SIZE value to 1024
ca8210: fix mac_len negative array access
m68k: Only force 030 bus error if PC not in exception table
selftests/bpf: check that modifier resolves after pointer
scsi: target: iscsi: Fix an error message in iscsi_check_key()
scsi: ufs: core: Add soft dependency on governor_simpleondemand
scsi: lpfc: Avoid usage of list iterator variable after loop
net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
net: usb: qmi_wwan: add Telit 0x1080 composition
sh: sanitize the flags on sigreturn
cifs: empty interface list when server doesn't support query interfaces
scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
usb: gadget: u_audio: don't let userspace block driver unbind
fsverity: Remove WQ_UNBOUND from fsverity read workqueue
igb: revert rtnl_lock() that causes deadlock
dm thin: fix deadlock when swapping to thin device
usb: cdns3: Fix issue with using incorrect PCI device function
usb: chipdea: core: fix return -EINVAL if request role is the same with current role
usb: chipidea: core: fix possible concurrent when switch role
wifi: mac80211: fix qos on mesh interfaces
nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
dm stats: check for and propagate alloc_percpu failure
dm crypt: add cond_resched() to dmcrypt_write()
sched/fair: sanitize vruntime of entity being placed
sched/fair: Sanitize vruntime of entity being migrated
tun: avoid double free in tun_free_netdev
ocfs2: fix data corruption after failed write
fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY
bus: imx-weim: fix branch condition evaluates to a garbage value
md: avoid signed overflow in slot_store()
ALSA: asihpi: check pao in control_message()
ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
fbdev: tgafb: Fix potential divide by zero
sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
fbdev: nvidia: Fix potential divide by zero
fbdev: intelfb: Fix potential divide by zero
fbdev: lxfb: Fix potential divide by zero
fbdev: au1200fb: Fix potential divide by zero
ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx()
dma-mapping: drop the dev argument to arch_sync_dma_for_*
mips: bmips: BCM6358: disable RAC flush for TP1
mtd: rawnand: meson: invalidate cache on polling ECC bit
scsi: megaraid_sas: Fix crash after a double completion
ptp_qoriq: fix memory leak in probe()
regulator: fix spelling mistake "Cant" -> "Can't"
regulator: Handle deferred clk
net/net_failover: fix txq exceeding warning
can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
s390/vfio-ap: fix memory leak in vfio_ap device driver
i40e: fix registers dump after run ethtool adapter self test
bnxt_en: Fix typo in PCI id to device description string mapping
net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
net: mvneta: make tx buffer array agnostic
pinctrl: ocelot: Fix alt mode for ocelot
Input: alps - fix compatibility with -funsigned-char
Input: focaltech - use explicitly signed char type
cifs: prevent infinite recursion in CIFSGetDFSRefer()
cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table
xen/netback: don't do grant copy across page boundary
pinctrl: at91-pio4: fix domain name assignment
NFSv4: Fix hangs when recovering open state after a server reboot
ALSA: hda/conexant: Partial revert of a quirk for Lenovo
ALSA: usb-audio: Fix regression on detection of Roland VS-100
drm/etnaviv: fix reference leak when mmaping imported buffer
btrfs: scan device in non-exclusive mode
ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
net_sched: add __rcu annotation to netdev->qdisc
net: sched: fix race condition in qdisc_graft()
firmware: arm_scmi: Fix device node validation for mailbox transport
gfs2: Always check inode size of inline inodes
Linux 5.4.240
UBUNTU: Upstream stable to v5.4.240

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.4.0-156.173

---------------
linux (5.4.0-156.173) focal; urgency=medium

  * focal/linux: 5.4.0-156.173 -proposed tracker (LP: #2026585)

  * CVE-2023-3390
    - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE

  * Focal update: v5.4.241 upstream stable release (LP: #2023930)
    - scsi: ses: Handle enclosure with just a primary component gracefully
    - x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot
    - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()
    - treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
    - smb3: fix problem with null cifs super block with previous patch
    - pinctrl: amd: Use irqchip template
    - pinctrl: amd: disable and mask interrupts on probe
    - pinctrl: amd: Disable and mask interrupts on resume
    - pwm: cros-ec: Explicitly set .polarity in .get_state()
    - pwm: sprd: Explicitly set .polarity in .get_state()
    - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded
      sta
    - icmp: guard against too small mtu
    - net: don't let netpoll invoke NAPI if in xmit context
    - sctp: check send stream number after wait_for_sndbuf
    - ipv6: Fix an uninit variable access bug in __ip6_make_skb()
    - gpio: davinci: Add irq chip flag to skip set wake
    - sunrpc: only free unix grouplist after RCU settles
    - NFSD: callback request does not use correct credential for AUTH_SYS
    - xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu
    - USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs
    - usb: typec: altmodes/displayport: Fix configure initial pin assignment
    - USB: serial: option: add Telit FE990 compositions
    - USB: serial: option: add Quectel RM500U-CN modem
    - iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip
    - iio: dac: cio-dac: Fix max DAC write value check for 12-bit
    - tty: serial: sh-sci: Fix transmit end interrupt handler
    - tty: serial: sh-sci: Fix Rx on RZ/G2L SCI
    - tty: serial: fsl_lpuart: avoid checking for transfer complete when
      UARTCTRL_SBK is asserted in lpuart32_tx_empty
    - nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
    - nilfs2: fix sysfs interface lifetime
    - ALSA: hda/realtek: Add quirk for Clevo X370SNW
    - perf/core: Fix the same task check in perf_event_set_output
    - ftrace: Mark get_lock_parent_ip() __always_inline
    - can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access
    - tracing: Free error logs of tracing instances
    - net_sched: prevent NULL dereference if default qdisc setup failed
    - drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
    - ring-buffer: Fix race while reader and writer are on the same page
    - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
    - irqdomain: Look for existing mapping only once
    - irqdomain: Refactor __irq_domain_alloc_irqs()
    - irqdomain: Fix mapping-creation race
    - Revert "pinctrl: amd: Disable and mask interrupts on resume"
    - ALSA: emu10k1: fix capture interrupt handler unlinking
    - ALSA: hd...