Mantic update: upstream stable patchset 2024-02-01

[Manuel Diewald]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       upstream stable patchset 2024-02-01

                Ported from the following upstream stable releases:
                        v6.1.69, v6.6.8

       from git://git.kernel.org/

r8152: add vendor/device ID pair for D-Link DUB-E250
r8152: add vendor/device ID pair for ASUS USB-C2500
ext4: fix warning in ext4_dio_write_end_io()
ksmbd: fix memory leak in smb2_lock()
afs: Fix refcount underflow from error handling race
HID: lenovo: Restrict detection of patched firmware only to USB cptkbd
net/mlx5e: Fix possible deadlock on mlx5e_tx_timeout_work
net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX
qca_debug: Prevent crash on TX ring changes
qca_debug: Fix ethtool -G iface tx behavior
qca_spi: Fix reset behavior
bnxt_en: Fix wrong return value check in bnxt_close_nic()
bnxt_en: Fix HWTSTAMP_FILTER_ALL packet timestamp logic
atm: solos-pci: Fix potential deadlock on &cli_queue_lock
atm: solos-pci: Fix potential deadlock on &tx_queue_lock
net: fec: correct queue selection
octeontx2-af: fix a use-after-free in rvu_nix_register_reporters
octeontx2-pf: Fix promisc mcam entry action
octeontx2-af: Update RSS algorithm index
atm: Fix Use-After-Free in do_vcc_ioctl
iavf: Introduce new state machines for flow director
iavf: Handle ntuple on/off based on new state machines for flow director
qed: Fix a potential use-after-free in qed_cxt_tables_alloc
net: Remove acked SYN flag from packet in the transmit queue correctly
net: ena: Destroy correct number of xdp queues upon failure
net: ena: Fix xdp drops handling due to multibuf packets
net: ena: Fix XDP redirection error
stmmac: dwmac-loongson: Make sure MDIO is initialized before use
sign-file: Fix incorrect return values check
vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space()
dpaa2-switch: fix size of the dma_unmap
dpaa2-switch: do not ask for MDB, VLAN and FDB replay
net: stmmac: Handle disabled MDIO busses from devicetree
net: atlantic: fix double free in ring reinit logic
cred: switch to using atomic_long_t
fuse: dax: set fc->dax to NULL in fuse_dax_conn_free()
ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB
ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants
ALSA: hda/realtek: Apply mute LED quirk for HP15-db
PCI: loongson: Limit MRRS to 256
ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE
drm/mediatek: Add spinlock for setting vblank event in atomic_begin
x86/hyperv: Fix the detection of E820_TYPE_PRAM in a Gen2 VM
usb: aqc111: check packet for fixup for true limit
stmmac: dwmac-loongson: Add architecture dependency
UBUNTU: [Config] updateconfigs for DWMAC_LOONGSON
blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!"
blk-cgroup: bypass blkcg_deactivate_policy after destroying
bcache: avoid oversize memory allocation by small stripe_size
bcache: remove redundant assignment to variable cur_idx
bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc()
bcache: avoid NULL checking to c->root in run_cache_set()
nbd: fold nbd config initialization into nbd_alloc_config()
nvme-auth: set explanation code for failure2 msgs
nvme: catch errors from nvme_configure_metadata()
selftests/bpf: fix bpf_loop_bench for new callback verification scheme
LoongArch: Add dependency between vmlinuz.efi and vmlinux.efi
LoongArch: Implement constant timer shutdown interface
platform/x86: intel_telemetry: Fix kernel doc descriptions
HID: glorious: fix Glorious Model I HID report
HID: add ALWAYS_POLL quirk for Apple kb
nbd: pass nbd_sock to nbd_read_reply() instead of index
HID: hid-asus: reset the backlight brightness level on resume
HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad
asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation
net: usb: qmi_wwan: claim interface 4 for ZTE MF290
arm64: add dependency between vmlinuz.efi and Image
HID: hid-asus: add const to read-only outgoing usb buffer
btrfs: do not allow non subvolume root targets for snapshot
soundwire: stream: fix NULL pointer dereference for multi_link
ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS
arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify
team: Fix use-after-free when an option instance allocation fails
drm/amdgpu/sdma5.2: add begin/end_use ring callbacks
dmaengine: stm32-dma: avoid bitfield overflow assertion
mm/mglru: fix underprotected page cache
mm/shmem: fix race in shmem_undo_range w/THP
btrfs: free qgroup reserve when ORDERED_IOERR is set
btrfs: don't clear qgroup reserved bit in release_folio
drm/amdgpu: fix tear down order in amdgpu_vm_pt_free
drm/amd/display: Disable PSR-SU on Parade 0803 TCON again
drm/i915: Fix remapped stride with CCS on ADL+
smb: client: fix NULL deref in asn1_ber_decoder()
smb: client: fix OOB in smb2_query_reparse_point()
ring-buffer: Fix memory leak of free page
tracing: Update snapshot buffer on resize if it is allocated
ring-buffer: Do not update before stamp when switching sub-buffers
ring-buffer: Have saved event hold the entire event
ring-buffer: Fix writing to the buffer with max_data_size
ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs
ring-buffer: Do not try to put back write_stamp
ring-buffer: Have rb_time_cmpxchg() set the msb counter too
net/mlx5e: Honor user choice of IPsec replay window size
net/mlx5e: Ensure that IPsec sequence packet number starts from 1
RDMA/mlx5: Send events from IB driver about device affiliation state
net/mlx5e: Disable IPsec offload support if not FW steering
net/mlx5e: TC, Don't offload post action rule if not supported
net/mlx5: Nack sync reset request when HotPlug is enabled
net/mlx5e: Check netdev pointer before checking its net ns
net/mlx5: Fix a NULL vs IS_ERR() check
bnxt_en: Fix skb recycling logic in bnxt_deliver_skb()
net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table
octeon_ep: explicitly test for firmware ready value
octeontx2-af: Fix pause frame configuration
iavf: Fix iavf_shutdown to call iavf_remove instead iavf_close
net: ena: Fix DMA syncing in XDP path when SWIOTLB is on
net: stmmac: dwmac-qcom-ethqos: Fix drops in 10M SGMII RX
cred: get rid of CONFIG_DEBUG_CREDENTIALS
UBUNTU: [Config] updateconfigs for DEBUG_CREDENTIALS
HID: i2c-hid: Add IDEA5002 to i2c_hid_acpi_blacklist[]
HID: Add quirk for Labtec/ODDOR/aikeec handbrake
fuse: share lookup state between submount and its parent
io_uring/cmd: fix breakage in SOCKET_URING_OP_SIOC* implementation
PCI/ASPM: Add pci_enable_link_state_locked()
PCI: vmd: Fix potential deadlock when enabling ASPM
drm/mediatek: fix kernel oops if no crtc is found
drm/i915/selftests: Fix engine reset count storage for multi-tile
drm/i915: Use internal class when counting engine resets
selftests/mm: cow: print ksft header before printing anything else
rxrpc: Fix some minor issues with bundle tracing
nbd: factor out a helper to get nbd_config without holding 'config_lock'
nbd: fix null-ptr-dereference while accessing 'nbd->config'
LoongArch: Record pc instead of offset in la_abs relocation
LoongArch: Silence the boot warning about 'nokaslr'
HID: mcp2221: Set driver data before I2C adapter add
HID: mcp2221: Allow IO to start during probe
HID: apple: add Jamesdonkey and A3R to non-apple keyboards list
nfc: virtual_ncidev: Add variable to check if ndev is running
scripts/checkstack.pl: match all stack sizes for s390
eventfs: Do not allow NULL parent to eventfs_start_creating()
cxl/hdm: Fix dpa translation locking
Revert "selftests: error out if kernel header files are not yet built"
drm/mediatek: Fix access violation in mtk_drm_crtc_dma_dev_get
mm/mglru: try to stop at high watermarks
mm/mglru: respect min_ttl_ms with memcgs
mm/mglru: reclaim offlined memcgs harder
btrfs: fix qgroup_free_reserved_data int overflow
drm/edid: also call add modes in EDID connector update fallback
drm/i915: Fix ADL+ tiled plane stride when the POT stride is smaller than the original
drm/i915: Fix intel_atomic_setup_scalers() plane_state handling
smb: client: fix potential OOBs in smb2_parse_contexts()
x86/speculation, objtool: Use absolute relocations for annotations
RDMA/mlx5: Change the key being sent for MPV device affiliation
UBUNTU: Upstream stable to v6.1.69, v6.6.8

[Roxana Nicolescu (roxanan)]

Commit "eventfs: Do not allow NULL parent to eventfs_start_creating()" had to be dropped.
This introduced a warning: "WARNING: CPU: 17 PID: 1 at fs/tracefs/inode.c:408 start_creating+0xe9/0x110" that can be seen during boot testing. The check itself would not be an issue, but the commit was removes the following in start_creating:
```
- /* If the parent is not specified, we create it in the root.
- * We need the root dentry to do this, which is in the super
- * block. A pointer to that is in the struct vfsmount that we
- * have around.
- */
- if (!parent)
- parent = tracefs_mount->mnt_root;
-
```
This is used a lot for entries that are created in the root directory, therefore these entries cannot be created anymore.

```
root@mantic:/home/ubuntu# ll /sys/kernel/tracing/
total 0
drwx------ 2 root root 0 Mar 7 14:29 ./
drwxr-xr-x 16 root root 0 Mar 7 14:29 ../
```

I would keep the warning entry, but this would create a bit of confusion because we'll deviate from upstream. Therefore, I'll drop the commit

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 6.5.0-27.28

---------------
linux (6.5.0-27.28) mantic; urgency=medium

  * mantic/linux: 6.5.0-27.28 -proposed tracker (LP: #2055584)

  * Packaging resync (LP: #1786013)
    - [Packaging] drop ABI data
    - [Packaging] update annotations scripts
    - debian.master/dkms-versions -- update from kernel-versions (main/2024.03.04)

  * CVE-2024-26597
    - net: qualcomm: rmnet: fix global oob in rmnet_policy

  * CVE-2024-26599
    - pwm: Fix out-of-bounds access in of_pwm_single_xlate()

  * Drop ABI checks from kernel build (LP: #2055686)
    - [Packaging] Remove in-tree abi checks

  * Cranky update-dkms-versions rollout (LP: #2055685)
    - [Packaging] remove update-dkms-versions
    - Move debian/dkms-versions to debian.master/dkms-versions
    - [Packaging] Replace debian/dkms-versions with $(DEBIAN)/dkms-versions

  * linux: please move erofs.ko (CONFIG_EROFS for EROFS support) from linux-
    modules-extra to linux-modules (LP: #2054809)
    - UBUNTU [Packaging]: Include erofs in linux-modules instead of linux-modules-
      extra

  * performance: Scheduler: ratelimit updating of load_avg (LP: #2053251)
    - sched/fair: Ratelimit update to tg->load_avg

  * IB peer memory feature regressed in 6.5 (LP: #2055082)
    - SAUCE: RDMA/core: Introduce peer memory interface

  * linux-tools-common: man page of usbip[d] is misplaced (LP: #2054094)
    - [Packaging] rules: Put usbip manpages in the correct directory

  * CVE-2024-23851
    - dm: limit the number of targets and parameter size area

  * CVE-2024-23850
    - btrfs: do not ASSERT() if the newly created subvolume already got read

  * x86: performance: tsc: Extend watchdog check exemption to 4-Sockets platform
    (LP: #2054699)
    - x86/tsc: Extend watchdog check exemption to 4-Sockets platform

  * linux: please move dmi-sysfs.ko (CONFIG_DMI_SYSFS for SMBIOS support) from
    linux-modules-extra to linux-modules (LP: #2045561)
    - [Packaging] Move dmi-sysfs.ko into linux-modules

  * Fix AMD brightness issue on AUO panel (LP: #2054773)
    - drm/amdgpu: make damage clips support configurable

  * Mantic update: upstream stable patchset 2024-02-28 (LP: #2055199)
    - f2fs: explicitly null-terminate the xattr list
    - pinctrl: lochnagar: Don't build on MIPS
    - ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
    - mptcp: fix uninit-value in mptcp_incoming_options
    - wifi: cfg80211: lock wiphy mutex for rfkill poll
    - wifi: avoid offset calculation on NULL pointer
    - wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap
    - debugfs: fix automount d_fsdata usage
    - nvme-core: fix a memory leak in nvme_ns_info_from_identify()
    - drm/amd/display: update dcn315 lpddr pstate latency
    - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
    - smb: client, common: fix fortify warnings
    - blk-mq: don't count completed flush data request as inflight in case of
      quiesce
    - nvme-core: check for too small lba shift
    - hwtracing: hisi_ptt: Handle the interrupt in hardirq context
    - hwtracing: hisi_ptt: Don't try to attach a task
    - ASoC: wm8974:...