Jammy update: v6.1.60 upstream stable release

[Timo Aaltonen]

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v6.1.60 upstream stable release
       from git://git.kernel.org/

Linux 6.1.60
selftests: mptcp: join: no RST when rm subflow/addr
selftests: mptcp: join: correctly check for no RST
mptcp: avoid sending RST when closing the initial subflow
Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
Bluetooth: hci_sock: fix slab oob read in create_monitor_event
net: move altnames together with the netdevice
phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins
phy: mapphone-mdm6600: Fix runtime PM for remove
phy: mapphone-mdm6600: Fix runtime disable on probe
gpio: vf610: mask the gpio irq in system suspend and support wakeup
gpio: vf610: make irq_chip immutable
tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols
kallsyms: Add helper kallsyms_on_each_match_symbol()
kallsyms: Reduce the memory occupied by kallsyms_seqs_of_names[]
serial: 8250: omap: convert to modern PM ops
serial: 8250: omap: Move uart_write() inside PM section
drm/bridge: ti-sn65dsi86: Associate DSI device lifetime with auxiliary device
ASoC: pxa: fix a memory leak in probe()
gpio: vf610: set value before the direction to avoid a glitch
platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events
platform/x86: asus-wmi: Only map brightness codes when using asus-wmi backlight control
platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
platform/x86: intel-uncore-freq: Conditionally create attribute for read frequency
platform/surface: platform_profile: Propagate error if profile registration fails
s390/cio: fix a memleak in css_alloc_subchannel
selftests/ftrace: Add new test case which checks non unique symbol
s390/pci: fix iommu bitmap allocation
perf: Disallow mis-matched inherited group reads
USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
USB: serial: option: add entry for Sierra EM9191 with new firmware
USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
HID: input: map battery system charging
KVM: x86/mmu: Stop zapping invalidated TDP MMU roots asynchronously
nvme-rdma: do not try to stop unallocated queues
nvmet-auth: complete a request only after freeing the dhchap pointers
nvme-pci: add BOGUS_NID for Intel 0a54 device
nvme: sanitize metadata bounce buffer for reads
nfs42: client needs to strip file mode's suid/sgid bit after ALLOCATE op
ACPI: irq: Fix incorrect return value in acpi_register_gsi()
NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server
pNFS/flexfiles: Check the layout validity in ff_layout_mirror_prepare_stats
pNFS: Fix a hang in nfs4_evict_inode()
Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
mmc: core: Capture correct oemid-bits for eMMC cards
mmc: core: sdio: hold retuning if sdio in 1-bit mode
mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw
mmc: sdhci-pci-gli: fix LPM negotiation so x86/S0ix SoCs can suspend
dt-bindings: mmc: sdhci-msm: correct minimum number of clocks
mtd: physmap-core: Restore map_rom fallback
mtd: spinand: micron: correct bitmask for ecc status
mtd: rawnand: arasan: Ensure program page operations are successful
mtd: rawnand: marvell: Ensure program page operations are successful
mtd: rawnand: pl353: Ensure program page operations are successful
mtd: rawnand: qcom: Unmap the right resource upon probe failure
net/smc: fix smc clc failed issue when netdevice not in init_net
tcp_bpf: properly release resources on error paths
selftests: openvswitch: Add version check for pyroute2
Bluetooth: hci_event: Fix using memcmp when comparing keys
ice: Remove redundant pci_enable_pcie_error_reporting()
tcp: allow again tcp_disconnect() when threads are waiting
net/tls: split tls_rx_reader_lock
net/mlx5e: Don't offload internal port if filter device is out device
net/mlx5: Handle fw tracer change ownership event based on MTRC
net/mlx5: E-switch, register event handler before arming the event
xfrm6: fix inet6_dev refcount underflow problem
net: xfrm: skip policies marked as dead while reinserting policies
fprobe: Fix to ensure the number of active retprobes is not zero
fprobe: Add nr_maxactive to specify rethook_node pool size
fprobe: Pass entry_data to handlers
cpufreq: schedutil: Update next_freq when cpufreq_limits change
platform/x86: touchscreen_dmi: Add info for the Positivo C4128B
HID: nintendo: reinitialize USB Pro Controller after resuming from suspend
HID: multitouch: Add required quirk for Synaptics 0xcd7e device
drm/amd/pm: add unique_id for gc 11.0.3
btrfs: error out when reallocating block for defrag using a stale transaction
btrfs: error when COWing block from a root that is being deleted
btrfs: error out when COWing block using a stale transaction
btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
drm: panel-orientation-quirks: Add quirk for One Mix 2S
ipv4/fib: send notify when delete source address routes
sky2: Make sure there is at least one frag_addr available
regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()"
wifi: cfg80211: avoid leaking stack data into trace
wifi: mac80211: allow transmitting EAPOL frames with tainted key
wifi: mac80211: work around Cisco AP 9115 VHT MPDU length
wifi: cfg80211: Fix 6GHz scan configuration
Bluetooth: hci_core: Fix build warnings
Bluetooth: Avoid redundant authentication
Bluetooth: btusb: add shutdown function for QCA6174
HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
HID: logitech-hidpp: Add Bluetooth ID for the Logitech M720 Triathlon mouse
wifi: iwlwifi: Ensure ack flag is properly cleared.
wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
tracing: relax trace_event_eval_update() execution with cond_resched()
ata: libata-eh: Fix compilation warning in ata_eh_link_report()
ata: libata-core: Fix compilation warning in ata_dev_config_ncq()
gpio: timberdale: Fix potential deadlock on &tgpio->lock
overlayfs: set ctime when setting mtime and atime
i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
btrfs: initialize start_slot in btrfs_log_prealloc_extents
btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1
btrfs: prevent transaction block reserve underflow when starting transaction
fs-writeback: do not requeue a clean inode having skipped pages
ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
pwr-mlxbf: extend Kconfig to include gpio-mlxbf3 dependency
iio: adc: ad7192: Correct reference voltage
iio: adc: ad7192: Simplify using devm_regulator_get_enable()
iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()
iio: core: introduce iio_device_{claim|release}_buffer_mode() APIs
serial: 8250_omap: Fix errors with no_console_suspend
serial: 8250: omap: Fix imprecise external abort for omap_8250_pm()
serial: Reduce spinlocked portion of uart_rs485_config()
serial: Rename uart_change_speed() to uart_change_line_settings()
serial: Move uart_change_speed() earlier
usb: misc: onboard_hub: add support for Microchip USB2412 USB 2.0 hub
usb: misc: onboard_usb_hub: add Genesys Logic GL3523 hub support
usb: misc: onboard_usb_hub: add Genesys Logic GL852G hub support
usb: misc: onboard_usb_hub: add Genesys Logic GL850G hub support
selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error
net: check for altname conflicts when changing netdev's netns
net: fix ifname in netlink ntf during netns move
net: avoid UAF on deleted altname
net: pktgen: Fix interface flags printing
net: phy: bcm7xxx: Add missing 16nm EPHY statistics
netfilter: nf_tables: revert do not remove elements if set backend implements .abort
netfilter: nf_tables: do not remove elements if set backend implements .abort
netlink: Correct offload_xstats size
netfilter: nft_set_rbtree: .deactivate fails if element has expired
selftests: netfilter: Run nft_audit.sh in its own netns
selftests: openvswitch: Catch cases where the tests are killed
neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section
net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
bonding: Return pointer to data after pull on skb
net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register()
i40e: prevent crash on probe if hw registers have invalid values
octeon_ep: update BQL sent bytes before ringing doorbell
net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
tun: prevent negative ifindex
tcp: Fix listen() warning with v4-mapped-v6 address.
tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb
tcp: fix excessive TLP and RACK timeouts from HZ rounding
net: rfkill: gpio: prevent value glitch during probe
net: ipv6: fix return value check in esp_remove_trailer
net: ipv4: fix return value check in esp_remove_trailer
wifi: cfg80211: use system_unbound_wq for wiphy work
xfrm: interface: use DEV_STATS_INC()
xfrm: fix a data-race in xfrm_gen_index()
xfrm: fix a data-race in xfrm_lookup_with_ifid()
qed: fix LL2 RX buffer allocation
ASoC: codecs: wcd938x: fix resource leaks on bind errors
ASoC: codecs: wcd938x: fix unbind tear down order
ASoC: codecs: wcd938x: drop bogus bind error handling
ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors
ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind
ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx
ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV
ALSA: hda/realtek - Fixed ASUS platform headset Mic issue
drm/mediatek: Correctly free sg_table in gem prime vmap
drm/i915: Retry gtt fault when out of fence registers
nvmet-tcp: Fix a possible UAF in queue intialization setup
netfilter: nft_payload: fix wrong mac header matching
fs/ntfs3: fix deadlock in mark_as_free_ex
fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea()
fs/ntfs3: Fix possible null-pointer dereference in hdr_find_e()
mptcp: more conservative check for zero probes
tcp: check mptcp-level constraints for backlog coalescing
audit,io_uring: io_uring openat triggers audit reference count underflow
x86: KVM: SVM: refresh AVIC inhibition in svm_leave_nested()
x86: KVM: SVM: add support for Invalid IPI Vector interception
KVM: x86: Constrain guest-supported xfeatures only at KVM_GET_XSAVE{2}
x86/fpu: Allow caller to constrain xfeatures when copying to uabi buffer
x86/sev: Check for user-space IOIO pointing to kernel space
x86/sev: Check IOBM for IOIO exceptions from user-space
x86/sev: Disable MMIO emulation from user mode
KVM: x86: Mask LVTPC when handling a PMI
regmap: fix NULL deref on lookup
nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
btrfs: fix stripe length calculation for non-zoned data chunk allocation
net/smc: return the right falback reason when prefix checks fail
ice: reset first in crash dump kernels
ice: fix over-shifted variable
Bluetooth: avoid memcmp() out of bounds warning
Bluetooth: hci_event: Fix coding style
Bluetooth: vhci: Fix race when opening vhci device
Bluetooth: Fix a refcnt underflow problem for hci_conn
Bluetooth: Reject connection with the device which has same BD_ADDR
Bluetooth: hci_event: Ignore NULL link key
igc: Fix race condition in PTP tx code
igc: Add condition for qbv_config_change_errors counter
igc: Add qbv_config_change_errors counter
igc: Remove reset adapter task for i226 during disable tsn config
igc: enable Qbv configuration for 2nd GCL
igc: remove I226 Qbv BaseTime restriction
lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem-6.1 - 6.1.0-1027.27

---------------
linux-oem-6.1 (6.1.0-1027.27) jammy; urgency=medium

  * jammy/linux-oem-6.1: 6.1.0-1027.27 -proposed tracker (LP: #2041604)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
    - [Packaging] resync update-dkms-versions helper
    - [Packaging] update variants

  * RTL8111EPP: Fix the network lost after resume with DASH (LP: #2043786)
    - r8169: add handling DASH when DASH is disabled
    - r8169: fix network lost after resume on DASH systems

  * System hang after unplug/plug DP monitor with AMD W7500 card (LP: #2042912)
    - SAUCE: drm/amd/pm: Fix error of MACO flag setting code

  * Fix after-suspend-mediacard/sdhc-insert test failed (LP: #2042500)
    - Revert "PCI/ASPM: Save L1 PM Substates Capability for suspend/resume"
    - SAUCE: PCI/ASPM: Add back L1 PM Substate save and restore

  * Jammy update: v6.1.61 upstream stable release (LP: #2042580)
    - Revert "Revert "clk: ti: Stop using legacy clkctrl names for omap4 and 5""
    - KVM: x86/pmu: Truncate counter value to allowed width on write
    - mmc: core: Align to common busy polling behaviour for mmc ioctls
    - mmc: block: ioctl: do write error check for spi
    - mmc: core: Fix error propagation for some ioctl commands
    - ASoC: codecs: wcd938x: Convert to platform remove callback returning void
    - ASoC: codecs: wcd938x: Simplify with dev_err_probe
    - ASoC: codecs: wcd938x: fix regulator leaks on probe errors
    - ASoC: codecs: wcd938x: fix runtime PM imbalance on remove
    - pinctrl: qcom: lpass-lpi: fix concurrent register updates
    - mcb: Return actual parsed size when reading chameleon table
    - mcb-lpc: Reallocate memory region to avoid memory overlapping
    - virtio_balloon: Fix endless deflation and inflation on arm64
    - virtio-mmio: fix memory leak of vm_dev
    - virtio-crypto: handle config changed by work queue
    - virtio_pci: fix the common cfg map size
    - vsock/virtio: initialize the_virtio_vsock before using VQs
    - vhost: Allow null msg.size on VHOST_IOTLB_INVALIDATE
    - arm64: dts: rockchip: Add i2s0-2ch-bus-bclk-off pins to RK3399
    - arm64: dts: rockchip: Fix i2s0 pin conflict on ROCK Pi 4 boards
    - mm: fix vm_brk_flags() to not bail out while holding lock
    - hugetlbfs: clear resv_map pointer if mmap fails
    - mm/page_alloc: correct start page when guard page debug is enabled
    - mm/migrate: fix do_pages_move for compat pointers
    - hugetlbfs: extend hugetlb_vma_lock to private VMAs
    - maple_tree: add GFP_KERNEL to allocations in mas_expected_entries()
    - nfsd: lock_rename() needs both directories to live on the same fs
    - drm/i915/pmu: Check if pmu is closed before stopping event
    - drm/amd: Disable ASPM for VI w/ all Intel systems
    - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
    - ARM: OMAP: timer32K: fix all kernel-doc warnings
    - firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()
    - clk: ti: Fix missing omap4 mcbsp functional clock and aliases
    - clk: ti: Fix missing omap5 mcbsp functional clock and aliases
    - r8169: fix the KCSAN reporte...