Jammy update: v6.1.64 upstream stable release

[Timo Aaltonen]

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v6.1.64 upstream stable release
       from git://git.kernel.org/

Linux 6.1.64
RISC-V: drop error print from riscv_hartid_to_cpuid()
cxl/port: Fix NULL pointer access in devm_cxl_add_port()
mmc: sdhci-pci-gli: GL9755: Mask the replay timer timeout of AER
Input: xpad - add VID for Turtle Beach controllers
tracing: Have trace_event_file have ref counters
powerpc/powernv: Fix fortify source warnings in opal-prd.c
drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox
drm/amd/display: Enable fast plane updates on DCN3.2 and above
drm/amd/display: fix a NULL pointer dereference in amdgpu_dm_i2c_xfer()
drm/amdgpu: lower CS errors to debug severity
drm/amdgpu: fix error handling in amdgpu_bo_list_get()
drm/amdgpu: don't use ATRM for external devices
drm/amdgpu: don't use pci_is_thunderbolt_attached()
drm/amdgpu/smu13: drop compute workload workaround
drm/amd/pm: Fix error of MACO flag setting code
drm/i915: Fix potential spectre vulnerability
drm/i915: Bump GLK CDCLK frequency when driving multiple pipes
drm/amd/pm: Handle non-terminated overdrive commands.
ext4: properly sync file size update after O_SYNC direct IO
ext4: add missed brelse in update_backups
ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
ext4: correct the start block of counting reserved clusters
ext4: correct return value of ext4_convert_meta_bg
ext4: mark buffer new if it is unwritten to avoid stale data exposure
ext4: correct offset of gdb backup in non meta_bg group to update_backups
ext4: apply umask if ACL support is disabled
Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
media: qcom: camss: Fix csid-gen2 for test pattern generator
media: qcom: camss: Fix invalid clock enable bit disjunction
media: qcom: camss: Fix missing vfe_lite clocks check
media: qcom: camss: Fix VFE-480 vfe_disable_output()
media: qcom: camss: Fix VFE-17x vfe_disable_output()
media: qcom: camss: Fix vfe_get() error jump
media: qcom: camss: Fix pm_domain_on sequence in probe
mmc: sdhci-pci-gli: GL9750: Mask the replay timer timeout of AER
r8169: add handling DASH when DASH is disabled
r8169: fix network lost after resume on DASH systems
mptcp: fix setsockopt(IP_TOS) subflow locking
mptcp: add validity check for sending RM_ADDR
mptcp: deal with large GSO size
mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors
mm: fix for negative counter: nr_file_hugepages
mmc: sdhci-pci-gli: A workaround to allow GL9750 to enter ASPM L1.2
riscv: kprobes: allow writing to x0
riscv: correct pt_level name via pgtable_l5/4_enabled
riscv: mm: Update the comment of CONFIG_PAGE_OFFSET
LoongArch: Mark __percpu functions as always inline
nfsd: fix file memleak on client_opens_release
dm-verity: don't use blocking calls from tasklets
drm/mediatek/dp: fix memory leak on ->get_edid callback error path
drm/mediatek/dp: fix memory leak on ->get_edid callback audio detection
media: ccs: Correctly initialise try compose rectangle
media: venus: hfi: add checks to handle capabilities from firmware
media: venus: hfi: fix the check to handle session buffer requirement
media: venus: hfi_parser: Add check to keep the number of codecs within range
media: sharp: fix sharp encoding
media: lirc: drop trailing space from scancode transmit
f2fs: avoid format-overflow warning
f2fs: do not return EFSCORRUPTED, but try to run online repair
i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
net: phylink: initialize carrier state at creation
net: dsa: lan9303: consequently nested-lock physical MDIO
net: ethtool: Fix documentation of ethtool_sprintf()
s390/ap: fix AP bus crash on early config change callback invocation
i2c: designware: Disable TX_EMPTY irq while waiting for block length byte
sbsa_gwdt: Calculate timeout with 64-bit math
lsm: fix default return value for inode_getsecctx
lsm: fix default return value for vm_enough_memory
Revert "i2c: pxa: move to generic GPIO recovery"
Revert ncsi: Propagate carrier gain/loss events to the NCSI controller
cxl/region: Fix x1 root-decoder granularity calculations
tools/testing/cxl: Define a fixed volatile configuration to parse
cxl/mem: Move devm_cxl_add_endpoint() from cxl_core to cxl_mem
cxl: Unify debug messages when calling devm_cxl_add_port()
i3c: master: svc: fix random hot join failure since timeout error
i3c: master: svc: add NACK check after start byte sent
cxl/region: Do not try to cleanup after cxl_region_setup_targets() fails
cxl/region: Move region-position validation to a helper
cxl/region: Cleanup target list on attach error
cxl/region: Validate region mode vs decoder mode
drm/amd/display: enable dsc_clk even if dsc_pg disabled
Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE
Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables
bluetooth: Add device 13d3:3571 to device tables
bluetooth: Add device 0bda:887b to device tables
Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559
clk: visconti: Fix undefined behavior bug in struct visconti_pll_provider
clk: visconti: remove unused visconti_pll_provider::regmap
cpufreq: stats: Fix buffer overflow detection in trans_stats()
pmdomain: imx: Make imx pgc power domain also set the fwnode
pmdomain: bcm: bcm2835-power: check if the ASB register is equal to enable
ALSA: hda/realtek: Add quirks for HP Laptops
ALSA: hda/realtek: Enable Mute LED on HP 255 G10
ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
ALSA: hda/realtek - Add Dell ALC295 to pin fall back table
ALSA: hda/realtek: Enable Mute LED on HP 255 G8
ALSA: info: Fix potential deadlock at disconnection
btrfs: zoned: wait for data BG to be finished on direct IO allocation
xfs: recovery should not clear di_flushiter unconditionally
cifs: do not reset chan_max if multichannel is not supported at mount
cifs: force interface update before a fresh session setup
cifs: reconnect helper should set reconnect for the right channel
smb: client: fix potential deadlock when releasing mids
smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
smb3: fix caching of ctime on setxattr
smb3: fix touch -h of symlink
smb3: fix creating FIFOs when mounting with "sfu" mount option
fs: add ctime accessors infrastructure
xhci: Enable RPM on controllers that support low-power states
parisc/power: Fix power soft-off when running on qemu
parisc/pgtable: Do not drop upper 5 address bits of physical address
parisc: Prevent booting 64-bit kernels on PA1.x machines
i3c: master: svc: fix SDA keep low when polling IBIWON timeout happen
i3c: master: svc: fix check wrong status register in irq handler
i3c: master: svc: fix ibi may not return mandatory data byte
i3c: master: svc: fix wrong data return when IBI happen during start frame
i3c: master: svc: fix race condition in ibi work thread
i3c: master: cdns: Fix reading status register
mtd: cfi_cmdset_0001: Byte swap OTP info
mm/memory_hotplug: use pfn math in place of direct struct page manipulation
mm/cma: use nth_page() in place of direct struct page manipulation
s390/cmma: fix detection of DAT pages
dmaengine: stm32-mdma: correct desc prep when channel running
mcb: fix error handling for different scenarios when parsing
driver core: Release all resources during unbind before updating device links
tracing: Have the user copy of synthetic event address use correct context
i2c: core: Run atomic i2c xfer when !preemptible
kernel/reboot: emergency_restart: Set correct system_state
quota: explicitly forbid quota files from being encrypted
jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev
ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix
hid: lenovo: Resend all settings on reset_resume for compact keyboards
selftests/resctrl: Reduce failures due to outliers in MBA/MBM tests
selftests/resctrl: Move _GNU_SOURCE define into Makefile
selftests/resctrl: Remove duplicate feature check from CMT test
netfilter: nf_tables: split async and sync catchall in two functions
netfilter: nf_tables: remove catchall element in GC sync path
ima: detect changes to the backing overlay file
ima: annotate iint mutex to avoid lockdep false positive warnings
mfd: qcom-spmi-pmic: Fix revid implementation
mfd: qcom-spmi-pmic: Fix reference leaks in revid helper
arm64: dts: qcom: ipq6018: Fix tcsr_mutex register size
ACPI: FPDT: properly handle invalid FPDT subtables
firmware: qcom_scm: use 64-bit calling convention only when client is 64-bit
arm64: dts: qcom: ipq8074: Fix hwlock index for SMEM
btrfs: don't arbitrarily slow down delalloc if we're committing
rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects
PM: hibernate: Clean up sync_read handling in snapshot_write_next()
PM: hibernate: Use __get_safe_page() rather than touching the list
arm64: dts: qcom: ipq6018: Fix hwlock index for SMEM
rcu/tree: Defer setting of jiffies during stall reset
svcrdma: Drop connection after an RDMA Read error
wifi: wilc1000: use vmm_table as array in wilc struct
PCI: exynos: Don't discard .remove() callback
PCI: kirin: Don't discard .remove() callback
PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common()
mmc: Add quirk MMC_QUIRK_BROKEN_CACHE_FLUSH for Micron eMMC Q2J54A
mmc: sdhci_am654: fix start loop index for TAP value parsing
mmc: vub300: fix an error code
ksmbd: fix slab out of bounds write in smb_inherit_dacl()
ksmbd: handle malformed smb1 message
clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT flag from PLL clocks
clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks
clk: socfpga: Fix undefined behavior bug in struct stratix10_clock_data
parisc/power: Add power soft-off when running on qemu
parisc/pdc: Add width field to struct pdc_model
arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
PCI: keystone: Don't discard .probe() callback
PCI: keystone: Don't discard .remove() callback
KEYS: trusted: Rollback init_trusted() consistently
KEYS: trusted: tee: Refactor register SHM usage
genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
mmc: meson-gx: Remove setting of CMD_CFG_ERROR
wifi: ath11k: fix gtk offload status event locking
wifi: ath11k: fix htt pktlog locking
wifi: ath11k: fix dfs radar event locking
wifi: ath11k: fix temperature event locking
regmap: Ensure range selector registers are updated after cache sync
ACPI: resource: Do IRQ override on TongFang GMxXGxx
mm/damon/sysfs: check error from damon_sysfs_update_target()
mm/damon: implement a function for max nr_accesses safe calculation
mm/damon/ops-common: avoid divide-by-zero during region hotness calculation
mm/damon/lru_sort: avoid divide-by-zero in hot threshold calculation
watchdog: move softlockup_panic back to early_param
mm/damon/sysfs: update monitoring target regions for online input commit
mm/damon/sysfs: remove requested targets when online-commit inputs
PCI/sysfs: Protect driver's D3cold preference from user space
hvc/xen: fix event channel handling for secondary consoles
hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
hvc/xen: fix console unplug
tty: serial: meson: fix hard LOCKUP on crtscts mode
tty/sysrq: replace smp_processor_id() with get_cpu()
proc: sysctl: prevent aliased sysctls from getting passed to init
audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
audit: don't take task_lock() in audit_exe_compare() code path
KVM: x86: Clear bit12 of ICR after APIC-write VM-exit
KVM: x86: Ignore MSR_AMD64_TW_CFG access
KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space
x86/cpu/hygon: Fix the CPU topology evaluation for real
crypto: x86/sha - load modules based on CPU features
scsi: qla2xxx: Fix system crash due to bad pointer access
scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers
scsi: mpt3sas: Fix loop logic
bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
bpf: Fix check_stack_write_fixed_off() to correctly spill imm
randstruct: Fix gcc-plugin performance mode to stay in group
powerpc/perf: Fix disabling BHRB and instruction sampling
perf intel-pt: Fix async branch flags
media: venus: hfi: add checks to perform sanity on queue pointers
i915/perf: Fix NULL deref bugs with drm_dbg() calls
cifs: fix check of rc in function generate_smb3signingkey
cifs: spnego: add ';' in HOST_KEY_LEN
tools/power/turbostat: Enable the C-state Pre-wake printing
tools/power/turbostat: Fix a knl bug
macvlan: Don't propagate promisc change to lower dev in passthru
net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors
net/mlx5e: Check return value of snprintf writing to fw_version buffer
net/mlx5e: Reduce the size of icosq_str
net/mlx5e: Fix pedit endianness
net/mlx5e: fix double free of encap_header in update funcs
net/mlx5e: fix double free of encap_header
net: stmmac: avoid rx queue overrun
net: stmmac: fix rx budget limit check
netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
netfilter: nf_conntrack_bridge: initialize err to 0
af_unix: fix use-after-free in unix_stream_read_actor()
net: ethernet: cortina: Fix MTU max setting
net: ethernet: cortina: Handle large frames
net: ethernet: cortina: Fix max RX frame define
bonding: stop the device in bond_setup_by_slave()
ptp: annotate data-race around q->head and q->tail
xen/events: fix delayed eoi list handling
ppp: limit MRU to 64K
net: mvneta: fix calls to page_pool_get_stats
tipc: Fix kernel-infoleak due to uninitialized TLV value
net: hns3: fix VF wrong speed and duplex issue
net: hns3: fix VF reset fail issue
net: hns3: fix variable may not initialized problem in hns3_init_mac_addr()
net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs
net: hns3: fix incorrect capability bit display for copper port
net: hns3: add barrier in vf mailbox reply process
net: hns3: fix add VLAN fail issue
tty: Fix uninit-value access in ppp_sync_receive()
ipvlan: add ipvlan_route_v6_outbound() helper
net: set SOCK_RCU_FREE before inserting socket into hashtable
vhost-vdpa: fix use after free in vhost_vdpa_probe()
gfs2: Silence "suspicious RCU usage in gfs2_permission" warning
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
SUNRPC: Add an IS_ERR() check back to where it was
NFSv4.1: fix handling NFS4ERR_DELAY when testing for session trunking
mtd: rawnand: meson: check return value of devm_kasprintf()
mtd: rawnand: intel: check return value of devm_kasprintf()
SUNRPC: ECONNRESET might require a rebind
sched/core: Optimize in_task() and in_interrupt() a bit
wifi: iwlwifi: Use FW rate for non-data frames
mtd: rawnand: tegra: add missing check for platform_get_irq()
pwm: Fix double shift bug
drm/amdgpu: fix software pci_unplug on some chips
ALSA: hda/realtek: Add quirk for ASUS UX7602ZM
drm/qxl: prevent memory leak
ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
i2c: dev: copy userspace array safely
kgdb: Flush console before entering kgdb on panic
drm/amd/display: Avoid NULL dereference of timing generator
media: imon: fix access to invalid resource for the second interface
media: ccs: Fix driver quirk struct documentation
media: cobalt: Use FIELD_GET() to extract Link Width
gfs2: fix an oops in gfs2_permission
gfs2: ignore negated quota changes
media: vivid: avoid integer overflow
media: gspca: cpia1: shift-out-of-bounds in set_flicker
i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data.
virtio-blk: fix implicit overflow on virtio_max_dma_size
i2c: sun6i-p2wi: Prevent potential division by zero
i2c: fix memleak in i2c_new_client_device()
i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler
9p: v9fs_listxattr: fix %s null argument warning
9p/trans_fd: Annotate data-racy writes to file::f_flags
usb: gadget: f_ncm: Always set current gadget in ncm_bind()
f2fs: fix error handling of __get_node_page
soundwire: dmi-quirks: update HP Omen match
usb: dwc3: core: configure TX/RX threshold for DWC3_IP
tty: vcc: Add check for kstrdup() in vcc_probe()
thunderbolt: Apply USB 3.x bandwidth quirk only in software connection manager
iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
mfd: intel-lpss: Add Intel Lunar Lake-M PCI IDs
exfat: support handle zero-size directory
HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
crypto: hisilicon/qm - prevent soft lockup in receive loop
ASoC: Intel: soc-acpi-cht: Add Lenovo Yoga Tab 3 Pro YT3-X90 quirk
PCI: Use FIELD_GET() in Sapphire RX 5600 XT Pulse quirk
misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller
PCI: Disable ATS for specific Intel IPU E2000 devices
PCI: Extract ATS disabling to a helper function
PCI: Use FIELD_GET() to extract Link Width
scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
PCI: Do error check on own line to split long "if" conditions
atm: iphase: Do PCI error checks on own line
PCI: mvebu: Use FIELD_PREP() with Link Width
PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields
ALSA: hda: Fix possible null-ptr-deref when assigning a stream
ARM: 9320/1: fix stack depot IRQ stack filter
HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround
jfs: fix array-index-out-of-bounds in diAlloc
jfs: fix array-index-out-of-bounds in dbFindLeaf
fs/jfs: Add validity check for db_maxag and db_agpref
fs/jfs: Add check for negative db_l2nbperpage
scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool
scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs
RDMA/hfi1: Use FIELD_GET() to extract Link Width
ASoC: SOF: ipc4: handle EXCEPTION_CAUGHT notification from firmware
crypto: pcrypt - Fix hungtask for PADATA_RESET
ASoC: SOF: Pass PCI SSID to machine driver
ASoC: soc-card: Add storage for PCI SSID
selftests/efivarfs: create-read: fix a resource leak
arm64: dts: ls208xa: use a pseudo-bus to constrain usb dma size
drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
drm/amdkfd: Fix shift out-of-bounds issue
drm/panel: st7703: Pick different reset sequence
drm/amdgpu/vkms: fix a possible null pointer dereference
drm/radeon: fix a possible null pointer dereference
drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
drm/panel: fix a possible null pointer dereference
drm/amdgpu: Fix potential null pointer derefernce
drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
drm/msm/dp: skip validity check for DP CTS EDID checksum
drm: vmwgfx_surface.c: copy user-array safely
drm_lease.c: copy user-array safely
kernel: watch_queue: copy user-array safely
kernel: kexec: copy user-array safely
string.h: add array-wrappers for (v)memdup_user()
drm/amd/display: use full update for clip size increase of large plane source
drm/amd: Update `update_pcie_parameters` functions to use uint8_t arguments
drm/amdkfd: Fix a race condition of vram buffer unref in svm code
drm/amdgpu: not to save bo in the case of RAS err_event_athub
drm/komeda: drop all currently held locks if deadlock happens
drm/gma500: Fix call trace when psb_gem_mm_init() fails
platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
platform/chrome: kunit: initialize lock for fake ec_dev
tsnep: Fix tsnep_request_irq() format-overflow warning
ACPI: EC: Add quirk for HP 250 G7 Notebook PC
Bluetooth: Fix double free in hci_conn_cleanup
Bluetooth: btusb: Add date->evt_skb is NULL check
bpf: Ensure proper register state printing for cond jumps
vsock: read from socket's error queue
wifi: ath10k: Don't touch the CE interrupt registers after power up
net: annotate data-races around sk->sk_dst_pending_confirm
net: annotate data-races around sk->sk_tx_queue_mapping
wifi: ath10k: fix clang-specific fortify warning
wifi: ath9k: fix clang-specific fortify warnings
bpf: Detect IP == ksym.end as part of BPF program
atl1c: Work around the DMA RX overflow issue
wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
wifi: mac80211_hwsim: fix clang-specific fortify warning
wifi: plfxlc: fix clang-specific fortify warning
x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
workqueue: Provide one lock class key per work_on_cpu() callsite
cpu/hotplug: Don't offline the last non-isolated CPU
smp,csd: Throw an error if a CSD lock is stuck for too long
clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
clocksource/drivers/timer-imx-gpt: Fix potential memory leak
selftests/lkdtm: Disable CONFIG_UBSAN_TRAP in test config
srcu: Fix srcu_struct node grpmask overflow on 64-bit systems
perf/core: Bail out early if the request AUX area is out of bound
lib/generic-radix-tree.c: Don't overflow in peek()
locking/ww_mutex/test: Fix potential workqueue corruption

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem-6.1 - 6.1.0-1033.33

---------------
linux-oem-6.1 (6.1.0-1033.33) jammy; urgency=medium

  * jammy/linux-oem-6.1: 6.1.0-1033.33 -proposed tracker (LP: #2051966)

  * Jammy update: v6.1.63 upstream stable release (LP: #2046577)
    - Restore "UBUNTU: SAUCE: apparmor: patch to provide compatibility with v2.x
      net rules"

 -- Timo Aaltonen <email address hidden> Thu, 01 Feb 2024 20:16:28 +0200