Jammy update: v6.1.59 upstream stable release

[Timo Aaltonen]

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v6.1.59 upstream stable release
       from git://git.kernel.org/

Linux 6.1.59
ALSA: hda/realtek - Fixed two speaker platform
powerpc/64e: Fix wrong test in __ptep_test_and_clear_young()
powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE
dmaengine: mediatek: Fix deadlock caused by synchronize_irq()
dmaengine: idxd: use spin_lock_irqsave before wait_event_lock_irq
x86/alternatives: Disable KASAN in apply_alternatives()
usb: cdnsp: Fixes issue with dequeuing not queued requests
usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
usb: typec: ucsi: Clear EVENT_PENDING bit if ucsi_send_command fails
usb: typec: altmodes/displayport: Signal hpd low when exiting mode
counter: microchip-tcb-capture: Fix the use of internal GCLK logic
counter: chrdev: fix getting array extensions
scsi: ufs: core: Correct clear TM error log
pinctrl: avoid unsafe code pattern in find_pinctrl()
dma-buf: add dma_fence_timestamp helper
cgroup: Remove duplicates in cgroup v1 tasks file
usb: typec: ucsi: Use GET_CAPABILITY attributes data to set power supply scope
nfp: flower: avoid rmmod nfp crash issues
mctp: perform route lookups under a RCU read-side lock
tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case
Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
Input: xpad - add PXN V900 support
Input: psmouse - fix fast_reconnect function for PS/2 mode
Input: powermate - fix use-after-free in powermate_config_complete
ceph: fix type promotion bug on 32bit systems
ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
libceph: use kernel_connect()
powerpc/47x: Fix 47x syscall return crash
thunderbolt: Restart XDomain discovery handshake after failure
thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding
thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge
mcb: remove is_added flag from mcb_device struct
x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
perf/x86/lbr: Filter vsyscall addresses
ksmbd: not allow to open file if delelete on close bit is set
ACPI: EC: Add quirk for the HP Pavilion Gaming 15-dk1xxx
ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
drm/amd/display: Don't set dpms_off for seamless boot
drm/amdgpu: add missing NULL check
drm/atomic-helper: relax unregistered connector check
arm64: dts: mediatek: mt8195-demo: update and reorder reserved memory regions
arm64: dts: mediatek: mt8195-demo: fix the memory size to 8GB
iio: addac: Kconfig: update ad74413r selections
iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
iio: pressure: dps310: Adjust Timeout Settings
iio: admv1013: add mixer_vgate corner cases
iio: dac: ad3552r: Correct device IDs
iio: adc: imx8qxp: Fix address for command buffer registers
iio: imu: bno055: Fix missing Kconfig dependencies
iio: pressure: bmp280: Fix NULL pointer exception
usb: musb: Modify the "HWVers" register address
usb: musb: Get the musb_qh poniter after musb_giveback
usb: hub: Guard against accesses to uninitialized BOS descriptors
usb: cdns3: Modify the return value of cdns_set_active () to void when CONFIG_PM_SLEEP is disabled
usb: dwc3: Soft reset phy on probe for host
net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
dmaengine: stm32-mdma: set in_flight_bytes in case CRQA flag is set
dmaengine: stm32-mdma: use Link Address Register to compute residue
dmaengine: stm32-dma: fix residue in case of MDMA chaining
dmaengine: stm32-dma: fix stm32_dma_prep_slave_sg in case of MDMA chaining
dmaengine: stm32-mdma: abort resume if no ongoing transfer
tcp: enforce receive buffer memory limits by allowing the tcp window to shrink
workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()
nfc: nci: assert requested protocol is valid
pinctrl: renesas: rzn1: Enable missing PINMUX
net/smc: Fix pos miscalculation in statistics
net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
net/mlx5e: Again mutually exclude RX-FCS and RX-port-timestamp
ixgbe: fix crash with empty VF macvlan list
net/mlx5e: macsec: use update_pn flag instead of PN comparation
net: phy: mscc: macsec: reject PN update requests
net: macsec: indicate next pn update when offloading
net: refine debug info in skb_checksum_help()
bpf: Fix verifier log for async callback return values
drm/vmwgfx: fix typo of sizeof argument
riscv, bpf: Sign-extend return values
riscv, bpf: Factor out emit_call for kernel and bpf context
xen-netback: use default TX queue size for vifs
mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type
ieee802154: ca8210: Fix a potential UAF in ca8210_probe
ravb: Fix use-after-free issue in ravb_tx_timeout_work()
ravb: Fix up dma_free_coherent() call in ravb_remove()
arm64: dts: mediatek: mt8195: Set DSU PMU status to fail
can: sun4i_can: Only show Kconfig if ARCH_SUNXI is set
can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior
net: dsa: qca8k: fix potential MDIO bus conflict when accessing internal PHYs via management frames
phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers
phy: lynx-28g: lock PHY while performing CDR lock workaround
phy: lynx-28g: cancel the CDR check work item on the remove path
drm/msm/dp: Add newlines to debug printks
drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow
drm/msm/dsi: fix irq_of_parse_and_map() error checking
drm/msm/dsi: skip the wait for video mode done if not applicable
drm/msm/dp: do not reinitialize phy unless retry during link training
pinctrl: nuvoton: wpcm450: fix out of bounds write
ALSA: hda/realtek - ALC287 merge RTK codec with CS CS35L41 AMP
ALSA: hda/realtek - ALC287 I2S speaker platform support
ALSA: hda/realtek: Add quirk for mute LEDs on HP ENVY x360 15-eu0xxx
ALSA: hda/realtek: Add quirk for HP Victus 16-d1xxx to enable mute LED
ASoC: fsl_sai: Don't disable bitclock for i.MX8MP
ASoC: fsl_sai: MCLK bind with TX/RX enable bit
ASoC: Use of_property_read_bool() for boolean properties
ASoC: Intel: soc-acpi: Add entry for sof_es8336 in MTL match table.
ASoC: Intel: sof_sdw: add support for SKU 0B14
ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support in MTL match table
ASoC: simple-card-utils: fixup simple_util_startup() error handling
ASoC: SOF: amd: fix for firmware reload failure after playback
ALSA: hda/realtek: Change model for Intel RVP board
ALSA: usb-audio: Fix microphone sound on Nexigo webcam.
ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset
KEYS: trusted: Remove redundant static calls usage
irqchip: renesas-rzg2l: Fix logic to clear TINT interrupt source
dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Update description for '#interrupt-cells' property
arm64: dts: qcom: sm8150: extend the size of the PDC resource
net: prevent address rewrite in kernel_bind()
ata: libata-scsi: Disable scsi device manage_system_start_stop
ASoC: amd: yc: Fix non-functional mic on Lenovo 82YM
quota: Fix slow quotaoff
HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
scsi: Do not rescan devices with a suspended queue
platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning
platform/x86: think-lmi: Fix reference leak
perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7
RDMA/cxgb4: Check skb value for failure to allocate
drm/i915: Don't set PIPE_CONTROL_FLUSH_L3 for aux inval
mptcp: fix delegated action races
net: mana: Fix TX CQE error handling

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem-6.1 - 6.1.0-1027.27

---------------
linux-oem-6.1 (6.1.0-1027.27) jammy; urgency=medium

  * jammy/linux-oem-6.1: 6.1.0-1027.27 -proposed tracker (LP: #2041604)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
    - [Packaging] resync update-dkms-versions helper
    - [Packaging] update variants

  * RTL8111EPP: Fix the network lost after resume with DASH (LP: #2043786)
    - r8169: add handling DASH when DASH is disabled
    - r8169: fix network lost after resume on DASH systems

  * System hang after unplug/plug DP monitor with AMD W7500 card (LP: #2042912)
    - SAUCE: drm/amd/pm: Fix error of MACO flag setting code

  * Fix after-suspend-mediacard/sdhc-insert test failed (LP: #2042500)
    - Revert "PCI/ASPM: Save L1 PM Substates Capability for suspend/resume"
    - SAUCE: PCI/ASPM: Add back L1 PM Substate save and restore

  * Jammy update: v6.1.61 upstream stable release (LP: #2042580)
    - Revert "Revert "clk: ti: Stop using legacy clkctrl names for omap4 and 5""
    - KVM: x86/pmu: Truncate counter value to allowed width on write
    - mmc: core: Align to common busy polling behaviour for mmc ioctls
    - mmc: block: ioctl: do write error check for spi
    - mmc: core: Fix error propagation for some ioctl commands
    - ASoC: codecs: wcd938x: Convert to platform remove callback returning void
    - ASoC: codecs: wcd938x: Simplify with dev_err_probe
    - ASoC: codecs: wcd938x: fix regulator leaks on probe errors
    - ASoC: codecs: wcd938x: fix runtime PM imbalance on remove
    - pinctrl: qcom: lpass-lpi: fix concurrent register updates
    - mcb: Return actual parsed size when reading chameleon table
    - mcb-lpc: Reallocate memory region to avoid memory overlapping
    - virtio_balloon: Fix endless deflation and inflation on arm64
    - virtio-mmio: fix memory leak of vm_dev
    - virtio-crypto: handle config changed by work queue
    - virtio_pci: fix the common cfg map size
    - vsock/virtio: initialize the_virtio_vsock before using VQs
    - vhost: Allow null msg.size on VHOST_IOTLB_INVALIDATE
    - arm64: dts: rockchip: Add i2s0-2ch-bus-bclk-off pins to RK3399
    - arm64: dts: rockchip: Fix i2s0 pin conflict on ROCK Pi 4 boards
    - mm: fix vm_brk_flags() to not bail out while holding lock
    - hugetlbfs: clear resv_map pointer if mmap fails
    - mm/page_alloc: correct start page when guard page debug is enabled
    - mm/migrate: fix do_pages_move for compat pointers
    - hugetlbfs: extend hugetlb_vma_lock to private VMAs
    - maple_tree: add GFP_KERNEL to allocations in mas_expected_entries()
    - nfsd: lock_rename() needs both directories to live on the same fs
    - drm/i915/pmu: Check if pmu is closed before stopping event
    - drm/amd: Disable ASPM for VI w/ all Intel systems
    - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
    - ARM: OMAP: timer32K: fix all kernel-doc warnings
    - firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()
    - clk: ti: Fix missing omap4 mcbsp functional clock and aliases
    - clk: ti: Fix missing omap5 mcbsp functional clock and aliases
    - r8169: fix the KCSAN reporte...