This bug was fixed in the package linux-mtk - 5.15.0-1031.36

---------------
linux-mtk (5.15.0-1031.36) jammy; urgency=medium

  * jammy/linux-mtk: 5.15.0-1031.36 -proposed tracker (LP: #2064983)

  * [SRU] ubuntu_ltp: fs testsuite causing tainted kernel (LP: #2059057)
    - SAUCE: (no-up) ubuntu: mtk-apusys-driver: fix fs testsuite in ubuntu_ltp
      causing tainted kernel

  * [SRU] UBSAN: shift-out-of-bounds in mt6359-regulator.c:281 (LP: #2059227)
    - SAUCE: (no-up) regulator: mt6359: fix UBSAN: shift-out-of-bounds

  * [uc22][g350][g700] long install time and vblank timeout (LP: #2060936)
    - SAUCE: (no-up) drm/panel: stk-kd070: fix relaxation time between regulator
      enablement
    - SAUCE: (no-up) drm/panel: stk-kd070: fix panel not responding if set/get
      brightness earlier before pre_enable

  * [uc22][g700] Unable boot into OS and got call trace during kernel boot while
    configuring DSI + DPoC (display-dsidp.dtbo) (LP: #2063185)
    - SAUCE: (no-up) drm/panel: stk-kd070: fix deference error after panel being
      defer probed

  * [SRU] dt node backward compatibility for rxfifo (LP: #2065760)
    - SAUCE: (no-up) usb: xhci-mtk: dt node backward compatibility for rxfifo

  * [g1200] Unable boot into OS while using display-lvdshdmidp.dtbo with 1030.35
    kernel (LP: #2059233)
    - SAUCE: (no-up) drm/mediatek: dpi: fix triple display if lvds/edp is enabled

  * Packaging resync (LP: #1786013)
    - [Packaging] drop ABI data
    - [Packaging] drop getabis data

  [ Ubuntu: 5.15.0-105.115 ]

  * jammy/linux: 5.15.0-105.115 -proposed tracker (LP: #2061372)
  * Jammy update: v5.15.149 upstream stable release (LP: #2059014) // CIFS
    stopped working/is unstable with kernel update to 5.15.0-102.112
    (LP: #2060780)
    - smb3: Replace smb2pdu 1-element arrays with flex-arrays

  [ Ubuntu: 5.15.0-103.113 ]

  * jammy/linux: 5.15.0-103.113 -proposed tracker (LP: #2059683)
  * Packaging resync (LP: #1786013)
    - [Packaging] drop getabis data
  * Remove getabis scripts (LP: #2059143)
    - [Packaging] Remove getabis
  * CVE-2023-24023
    - Bluetooth: Add more enc key size check
  * CVE-2023-52600
    - jfs: fix uaf in jfs_evict_inode
  * Jammy update: v5.15.149 upstream stable release (LP: #2059014) //
    CVE-2023-52603
    - UBSAN: array-index-out-of-bounds in dtSplitRoot
  * CVE-2024-26581
    - netfilter: nft_set_rbtree: skip end interval element from gc

  [ Ubuntu: 5.15.0-102.112 ]

  * jammy/linux: 5.15.0-102.112 -proposed tracker (LP: #2055632)
  * Drop ABI checks from kernel build (LP: #2055686)
    - [Packaging] Remove in-tree abi checks
    - [Packaging] Drop abi checks from final-checks
  * Packaging resync (LP: #1786013)
    - [Packaging] drop ABI data
    - [Packaging] update annotations scripts
    - debian.master/dkms-versions -- update from kernel-versions (main/2024.03.04)
  * block/loop: No longer allows to create partitions (LP: #2056143)
    - block, loop: support partitions without scanning
  * Cranky update-dkms-versions rollout (LP: #2055685)
    - [Packaging] remove update-dkms-versions
    - Move debian/dkms-versions to debian.master/dkms-versions
    - [Packaging] Replace debian/dkms-versions with $(DEBIAN)/dkms-versions
    - [Packaging] remove update-version-dkms
  * linux: please move erofs.ko (CONFIG_EROFS for EROFS support) from linux-
    modules-extra to linux-modules (LP: #2054809)
    - UBUNTU [Packaging]: Include erofs in linux-modules instead of linux-modules-
      extra
  * linux-tools-common: man page of usbip[d] is misplaced (LP: #2054094)
    - [Packaging] rules: Put usbip manpages in the correct directory
  * CVE-2024-23851
    - dm ioctl: log an error if the ioctl structure is corrupted
    - dm: limit the number of targets and parameter size area
  * CVE-2024-23850
    - btrfs: do not ASSERT() if the newly created subvolume already got read
  * x86: performance: tsc: Extend watchdog check exemption to 4-Sockets platform
    (LP: #2054699)
    - x86/tsc: Extend watchdog check exemption to 4-Sockets platform
  * linux: please move dmi-sysfs.ko (CONFIG_DMI_SYSFS for SMBIOS support) from
    linux-modules-extra to linux-modules (LP: #2045561)
    - [Packaging] Move dmi-sysfs.ko into linux-modules
  * Fix bpf selftests build failure after v5.15.139 update (LP: #2054567)
    - Revert "selftests/bpf: Test tail call counting with bpf2bpf and data on
      stack"
  * Jammy update: v5.15.148 upstream stable release (LP: #2055145)
    - f2fs: explicitly null-terminate the xattr list
    - pinctrl: lochnagar: Don't build on MIPS
    - ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
    - mptcp: fix uninit-value in mptcp_incoming_options
    - wifi: cfg80211: lock wiphy mutex for rfkill poll
    - debugfs: fix automount d_fsdata usage
    - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
    - nvme-core: check for too small lba shift
    - ASoC: wm8974: Correct boost mixer inputs
    - ASoC: Intel: Skylake: Fix mem leak in few functions
    - ASoC: nau8822: Fix incorrect type in assignment and cast to restricted
      __be16
    - ASoC: Intel: Skylake: mem leak in skl register function
    - ASoC: cs43130: Fix the position of const qualifier
    - ASoC: cs43130: Fix incorrect frame delay configuration
    - ASoC: rt5650: add mutex to avoid the jack detection failure
    - nouveau/tu102: flush all pdbs on vmm flush
    - net/tg3: fix race condition in tg3_reset_task()
    - ASoC: da7219: Support low DC impedance headset
    - ASoC: ops: add correct range check for limiting volume
    - nvme: introduce helper function to get ctrl state
    - drm/amdgpu: Add NULL checks for function pointers
    - drm/exynos: fix a potential error pointer dereference
    - drm/exynos: fix a wrong error checking
    - hwmon: (corsair-psu) Fix probe when built-in
    - clk: rockchip: rk3128: Fix HCLK_OTG gate register
    - jbd2: correct the printing of write_flags in jbd2_write_superblock()
    - drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
    - neighbour: Don't let neigh_forced_gc() disable preemption for long
    - platform/x86: intel-vbtn: Fix missing tablet-mode-switch events
    - jbd2: fix soft lockup in journal_finish_inode_data_buffers()
    - tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
    - tracing: Add size check when printing trace_marker output
    - stmmac: dwmac-loongson: drop useless check for compatible fallback
    - MIPS: dts: loongson: drop incorrect dwmac fallback compatible
    - tracing: Fix uaf issue when open the hist or hist_debug file
    - ring-buffer: Do not record in NMI if the arch does not support cmpxchg in
      NMI
    - reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
    - Input: atkbd - skip ATKBD_CMD_GETID in translated mode
    - Input: i8042 - add nomux quirk for Acer P459-G2-M
    - s390/scm: fix virtual vs physical address confusion
    - ARC: fix spare error
    - wifi: iwlwifi: pcie: avoid a NULL pointer dereference
    - Input: xpad - add Razer Wolverine V2 support
    - ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346
    - i2c: rk3x: fix potential spinlock recursion on poll
    - net: qrtr: ns: Return 0 if server port is not present
    - ARM: sun9i: smp: fix return code check of of_property_match_string
    - drm/crtc: fix uninitialized variable use
    - ACPI: resource: Add another DMI match for the TongFang GMxXGxx
    - Revert "ASoC: atmel: Remove system clock tree configuration for
      at91sam9g20ek"
    - bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to
      pahole flags for v1.25
    - kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
    - Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
    - binder: use EPOLLERR from eventpoll.h
    - binder: fix use-after-free in shinker's callback
    - binder: fix trivial typo of binder_free_buf_locked()
    - binder: fix comment on binder_alloc_new_buf() return value
    - uio: Fix use-after-free in uio_open
    - parport: parport_serial: Add Brainboxes BAR details
    - parport: parport_serial: Add Brainboxes device IDs and geometry
    - leds: ledtrig-tty: Free allocated ttyname buffer on deactivate
    - PCI: Add ACS quirk for more Zhaoxin Root Ports
    - coresight: etm4x: Fix width of CCITMIN field
    - x86/lib: Fix overflow when counting digits
    - EDAC/thunderx: Fix possible out-of-bounds string access
    - powerpc: Mark .opd section read-only
    - powerpc/toc: Future proof kernel toc
    - powerpc: remove checks for binutils older than 2.25
    - powerpc: add crtsavres.o to always-y instead of extra-y
    - powerpc/44x: select I2C for CURRITUCK
    - powerpc/pseries/memhp: Fix access beyond end of drmem array
    - selftests/powerpc: Fix error handling in FPU/VMX preemption tests
    - powerpc/powernv: Add a null pointer check to scom_debug_init_one()
    - powerpc/powernv: Add a null pointer check in opal_event_init()
    - powerpc/powernv: Add a null pointer check in opal_powercap_init()
    - powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
    - spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
    - mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
    - ACPI: video: check for error while searching for backlight device parent
    - ACPI: LPIT: Avoid u32 multiplication overflow
    - of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
    - of: Add of_property_present() helper
    - cpufreq: Use of_property_present() for testing DT property presence
    - cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
    - calipso: fix memory leak in netlbl_calipso_add_pass()
    - efivarfs: force RO when remounting if SetVariable is not supported
    - spi: sh-msiof: Enforce fixed DTDL for R-Car H3
    - ACPI: LPSS: Fix the fractional clock divider flags
    - ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error
    - kunit: debugfs: Fix unchecked dereference in debugfs_print_results()
    - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
    - selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
    - crypto: virtio - Handle dataq logic with tasklet
    - crypto: sa2ul - Return crypto_aead_setkey to transfer the error
    - crypto: ccp - fix memleak in ccp_init_dm_workarea
    - crypto: af_alg - Disallow multiple in-flight AIO requests
    - crypto: sahara - remove FLAGS_NEW_KEY logic
    - crypto: sahara - fix cbc selftest failure
    - crypto: sahara - fix ahash selftest failure
    - crypto: sahara - fix processing requests with cryptlen < sg->length
    - crypto: sahara - fix error handling in sahara_hw_descriptor_create()
    - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
    - fs: indicate request originates from old mount API
    - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
    - crypto: virtio - Wait for tasklet to complete on device remove
    - crypto: sahara - avoid skcipher fallback code duplication
    - crypto: sahara - handle zero-length aes requests
    - crypto: sahara - fix ahash reqsize
    - crypto: sahara - fix wait_for_completion_timeout() error handling
    - crypto: sahara - improve error handling in sahara_sha_process()
    - crypto: sahara - fix processing hash requests with req->nbytes < sg->length
    - crypto: sahara - do not resize req->src when doing hash operations
    - crypto: scomp - fix req->dst buffer overflow
    - blocklayoutdriver: Fix reference leak of pnfs_device_node
    - NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
    - wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
    - bpf, lpm: Fix check prefixlen before walking trie
    - bpf: Add crosstask check to __bpf_get_stack
    - wifi: ath11k: Defer on rproc_get failure
    - wifi: libertas: stop selecting wext
    - ARM: dts: qcom: apq8064: correct XOADC register address
    - net/ncsi: Fix netlink major/minor version numbers
    - firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
    - firmware: meson_sm: populate platform devices from sm device tree data
    - wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
    - arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type
    - bpf: enforce precision of R0 on callback return
    - ARM: dts: qcom: sdx65: correct SPMI node name
    - arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered
    - arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered
    - arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered
    - arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered
    - arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered
    - bpf: fix check for attempt to corrupt spilled pointer
    - scsi: fnic: Return error if vmalloc() failed
    - arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator
    - arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
    - arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types
    - bpf: Fix verification of indirect var-off stack access
    - block: Set memalloc_noio to false on device_add_disk() error path
    - scsi: hisi_sas: Rename HISI_SAS_{RESET -> RESETTING}_BIT
    - scsi: hisi_sas: Prevent parallel FLR and controller reset
    - scsi: hisi_sas: Replace with standard error code return value
    - scsi: hisi_sas: Rollback some operations if FLR failed
    - scsi: hisi_sas: Correct the number of global debugfs registers
    - selftests/net: fix grep checking for fib_nexthop_multiprefix
    - virtio/vsock: fix logic which reduces credit update messages
    - dma-mapping: Add dma_release_coherent_memory to DMA API
    - dma-mapping: clear dev->dma_mem to NULL after freeing it
    - soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration
    - arm64: dts: qcom: sm8150-hdk: fix SS USB regulators
    - block: add check of 'minors' and 'first_minor' in device_add_disk()
    - arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent
    - wifi: rtlwifi: add calculate_bit_shift()
    - wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
    - wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request
    - wifi: iwlwifi: mvm: send TX path flush in rfkill
    - netfilter: nf_tables: mark newset as dead on transaction abort
    - Bluetooth: Fix bogus check for re-auth no supported with non-ssp
    - Bluetooth: btmtkuart: fix recv_buf() return value
    - block: make BLK_DEF_MAX_SECTORS unsigned
    - null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS
    - net/sched: act_ct: fix skb leak and crash on ooo frags
    - mlxbf_gige: Fix intermittent no ip issue
    - net: mellanox: mlxbf_gige: Replace non-standard interrupt handling
    - mlxbf_gige: Enable the GigE port in mlxbf_gige_open
    - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
    - ARM: davinci: always select CONFIG_CPU_ARM926T
    - Revert "drm/tidss: Annotate dma-fence critical section in commit path"
    - Revert "drm/omapdrm: Annotate dma-fence critical section in commit path"
    - RDMA/usnic: Silence uninitialized symbol smatch warnings
    - RDMA/hns: Fix inappropriate err code for unsupported operations
    - drm/panel-elida-kd35t133: hold panel in reset for unprepare
    - drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer
    - drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
    - drm/tilcdc: Fix irq free on unload
    - media: pvrusb2: fix use after free on context disconnection
    - drm/bridge: Fix typo in post_disable() description
    - f2fs: fix to avoid dirent corruption
    - drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
    - drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
    - drm/radeon: check return value of radeon_ring_lock()
    - ASoC: cs35l33: Fix GPIO name and drop legacy include
    - ASoC: cs35l34: Fix GPIO name and drop legacy include
    - drm/msm/mdp4: flush vblank event on disable
    - drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
    - drm/drv: propagate errors from drm_modeset_register_all()
    - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
    - drm/radeon/dpm: fix a memleak in sumo_parse_power_table
    - drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
    - drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable
    - drm/bridge: tc358767: Fix return value on error case
    - media: cx231xx: fix a memleak in cx231xx_init_isoc
    - clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config
    - media: rkisp1: Disable runtime PM in probe error path
    - f2fs: fix to check compress file in f2fs_move_file_range()
    - f2fs: fix to update iostat correctly in f2fs_filemap_fault()
    - f2fs: fix the f2fs_file_write_iter tracepoint
    - media: dvbdev: drop refcount on error path in dvb_device_open()
    - media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path
      of m88ds3103_probe()
    - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
    - drm/amd/pm: fix a double-free in si_dpm_init
    - drivers/amd/pm: fix a use-after-free in kv_parse_power_table
    - gpu/drm/radeon: fix two memleaks in radeon_vm_init
    - dt-bindings: clock: Update the videocc resets for sm8150
    - clk: qcom: videocc-sm8150: Update the videocc resets
    - clk: qcom: videocc-sm8150: Add missing PLL config property
    - drivers: clk: zynqmp: calculate closest mux rate
    - clk: zynqmp: make bestdiv unsigned
    - clk: zynqmp: Add a check for NULL pointer
    - drivers: clk: zynqmp: update divider round rate logic
    - watchdog: set cdev owner before adding
    - watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
    - watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
    - watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused
    - clk: si5341: fix an error code problem in si5341_output_clk_set_rate
    - clk: asm9260: use parent index to link the reference clock
    - clk: fixed-rate: add devm_clk_hw_register_fixed_rate
    - clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw
    - pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable
    - pwm: stm32: Use hweight32 in stm32_pwm_detect_channels
    - pwm: stm32: Fix enable count for clk in .probe()
    - ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[]
    - ALSA: scarlett2: Add missing error check to scarlett2_config_save()
    - ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config()
    - ALSA: scarlett2: Allow passing any output to line_out_remap()
    - ALSA: scarlett2: Add missing error checks to *_ctl_get()
    - ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
    - mmc: sdhci_am654: Fix TI SoC dependencies
    - [Config] update annotations for CONFIG_MMC_SDHCI_AM654
    - [Config] remove sdhci_am654 module for armhf/ppc64el
    - mmc: sdhci_omap: Fix TI SoC dependencies
    - [Config] update annotations for CONFIG_MMC_SDHCI_OMAP
    - [Config] remove sdhci-omap module for arm64/ppc64el
    - IB/iser: Prevent invalidating wrong MR
    - drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init
    - ksmbd: validate the zero field of packet header
    - of: Fix double free in of_parse_phandle_with_args_map
    - of: unittest: Fix of_count_phandle_with_args() expected value message
    - selftests/bpf: Add assert for user stacks in test_task_stack
    - binder: fix async space check for 0-sized buffers
    - binder: fix unused alloc->free_async_space
    - Input: atkbd - use ab83 as id when skipping the getid command
    - dma-mapping: Fix build error unused-value
    - virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session()
    - binder: fix race between mmput() and do_exit()
    - tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
    - usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
    - usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
    - Revert "usb: dwc3: Soft reset phy on probe for host"
    - Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-
      only"
    - usb: chipidea: wait controller resume finished for wakeup irq
    - usb: cdns3: fix uvc failure work since sg support enabled
    - usb: cdns3: fix iso transfer error when mult is not zero
    - usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled
    - Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
    - usb: typec: class: fix typec_altmode_put_partner to put plugs
    - usb: mon: Fix atomicity violation in mon_bin_vma_fault
    - serial: imx: Ensure that imx_uart_rs485_config() is called with enabled
      clock
    - ALSA: oxygen: Fix right channel of capture volume mixer
    - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx
    - fbdev: flush deferred work in fb_deferred_io_fsync()
    - scsi: mpi3mr: Refresh sdev queue depth after controller reset
    - block: add check that partition length needs to be aligned with block size
    - pwm: jz4740: Don't use dev_err_probe() in .request()
    - io_uring/rw: ensure io->bytes_done is always initialized
    - rootfs: Fix support for rootfstype= when root= is given
    - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
    - bpf: Fix re-attachment branch in bpf_tracing_prog_attach
    - iommu/arm-smmu-qcom: Add missing GMU entry to match table
    - wifi: mt76: fix broken precal loading from MTD for mt7915
    - wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
    - wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
    - wifi: mwifiex: configure BSSID consistently when starting AP
    - PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
    - PCI: mediatek: Clear interrupt status before dispatching handler
    - x86/kvm: Do not try to disable kvmclock if it was not enabled
    - KVM: arm64: vgic-v4: Restore pending state on host userspace write
    - KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
    - iio: adc: ad7091r: Pass iio_dev to event handler
    - HID: wacom: Correct behavior when processing some confidence == false
      touches
    - serial: sc16is7xx: add check for unsupported SPI modes during probe
    - serial: sc16is7xx: set safe default SPI clock frequency
    - iommu/dma: Trace bounce buffer usage when mapping buffers
    - ARM: 9330/1: davinci: also select PINCTRL
    - mfd: syscon: Fix null pointer dereference in of_syscon_register()
    - leds: aw2013: Select missing dependency REGMAP_I2C
    - mfd: intel-lpss: Fix the fractional clock divider flags
    - mips: dmi: Fix early remap on MIPS32
    - mips: Fix incorrect max_low_pfn adjustment
    - riscv: Check if the code to patch lies in the exit section
    - riscv: Fix module_alloc() that did not reset the linear mapping permissions
    - MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
    - MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
    - power: supply: cw2015: correct time_to_empty units in sysfs
    - power: supply: bq256xx: fix some problem in bq256xx_hw_init
    - serial: 8250: omap: Don't skip resource freeing if
      pm_runtime_resume_and_get() failed
    - libapi: Add missing linux/types.h header to get the __u64 type on io.h
    - software node: Let args be NULL in software_node_get_reference_args
    - serial: imx: fix tx statemachine deadlock
    - selftests/sgx: Fix uninitialized pointer dereference in error path
    - selftests/sgx: Skip non X86_64 platform
    - iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify
    - iio: adc: ad9467: fix reset gpio handling
    - iio: adc: ad9467: don't ignore error codes
    - iio: adc: ad9467: fix scale setting
    - perf genelf: Set ELF program header addresses properly
    - tty: change tty_write_lock()'s ndelay parameter to bool
    - tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK
    - tty: don't check for signal_pending() in send_break()
    - tty: use 'if' in send_break() instead of 'goto'
    - usb: cdc-acm: return correct error code on unsupported break
    - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
    - nvmet-tcp: fix a crash in nvmet_req_complete()
    - perf env: Avoid recursively taking env->bpf_progs.lock
    - apparmor: avoid crash when parsed profile name is empty
    - usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer
    - serial: imx: Correct clock error message in function probe()
    - nvmet: re-fix tracing strncpy() warning
    - nvmet-tcp: Fix the H2C expected PDU len calculation
    - PCI: keystone: Fix race condition when initializing PHYs
    - s390/pci: fix max size calculation in zpci_memcpy_toio()
    - net: qualcomm: rmnet: fix global oob in rmnet_policy
    - net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames
    - net: phy: micrel: populate .soft_reset for KSZ9131
    - mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN
    - mptcp: drop unused sk in mptcp_get_options
    - mptcp: strict validation before using mp_opt->hmac
    - mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
    - mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req()
    - net: ravb: Fix dma_addr_t truncation in error case
    - net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake
      calls
    - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
    - net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
    - netfilter: nf_tables: reject invalid set policy
    - netfilter: nft_connlimit: move stateful fields out of expression data
    - netfilter: nft_last: move stateful fields out of expression data
    - netfilter: nft_quota: move stateful fields out of expression data
    - netfilter: nft_limit: rename stateful structure
    - netfilter: nft_limit: move stateful fields out of expression data
    - netfilter: nf_tables: memcg accounting for dynamically allocated objects
    - netfilter: nft_limit: do not ignore unsupported flags
    - netfilter: nf_tables: do not allow mismatch field size and set key length
    - netfilter: nf_tables: skip dead set elements in netlink dump
    - netfilter: nf_tables: reject NFT_SET_CONCAT with not field length
      description
    - ipvs: avoid stat macros calls from preemptible context
    - kdb: Fix a potential buffer overflow in kdb_local()
    - ethtool: netlink: Add missing ethnl_ops_begin/complete
    - mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
    - mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable
    - mlxsw: spectrum_acl_tcam: Add missing mutex_destroy()
    - mlxsw: spectrum_acl_tcam: Make fini symmetric to init
    - mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations
    - mlxsw: spectrum_acl_tcam: Fix stack corruption
    - selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes
    - ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
    - i2c: s3c24xx: fix read transfers in polling mode
    - i2c: s3c24xx: fix transferring more than one message in polling mode
    - block: Remove special-casing of compound pages
    - netfilter: nf_tables: typo NULL check in _clone() function
    - netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
    - netfilter: nft_limit: fix stateful object memory leak
    - netfilter: nft_limit: Clone packet limits' cost value
    - netfilter: nft_last: copy content when cloning expression
    - netfilter: nft_quota: copy content when cloning expression
    - arm64: dts: armada-3720-turris-mox: set irq type for RTC
    - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
    - Linux 5.15.148
  * CVE-2024-24855
    - scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan()
  * performance: Scheduler: ratelimit updating of load_avg (LP: #2053251)
    - sched/fair: Ratelimit update to tg->load_avg
  * Jammy update: v5.15.147 upstream stable release (LP: #2054411)
    - block: Don't invalidate pagecache for invalid falloc modes
    - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6
    - Revert "PCI/ASPM: Remove pcie_aspm_pm_state_change()"
    - wifi: iwlwifi: pcie: don't synchronize IRQs from IRQ
    - drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer
    - nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to
      llcp_local
    - octeontx2-af: Fix marking couple of structure as __packed
    - drm/i915/dp: Fix passing the correct DPCD_REV for
      drm_dp_set_phy_test_pattern
    - i40e: Fix filter input checks to prevent config with invalid values
    - igc: Report VLAN EtherType matching back to user
    - igc: Check VLAN TCI mask
    - igc: Check VLAN EtherType mask
    - ASoC: fsl_rpmsg: Fix error handler with pm_runtime_enable
    - mlxbf_gige: fix receive packet race condition
    - net: sched: em_text: fix possible memory leak in em_text_destroy()
    - r8169: Fix PCI error on system resume
    - net: Implement missing getsockopt(SO_TIMESTAMPING_NEW)
    - can: raw: add support for SO_TXTIME/SCM_TXTIME
    - can: raw: add support for SO_MARK
    - net-timestamp: extend SOF_TIMESTAMPING_OPT_ID to HW timestamps
    - ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init
    - sfc: fix a double-free bug in efx_probe_filters
    - net: bcmgenet: Fix FCS generation for fragmented skbuffs
    - netfilter: nft_immediate: drop chain reference counter on error
    - net: Save and restore msg_namelen in sock_sendmsg
    - i40e: fix use-after-free in i40e_aqc_add_filters()
    - ASoC: meson: g12a-toacodec: Validate written enum values
    - ASoC: meson: g12a-tohdmitx: Validate written enum values
    - ASoC: meson: g12a-toacodec: Fix event generation
    - ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux
    - i40e: Restore VF MSI-X state during PCI reset
    - igc: Fix hicredit calculation
    - net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues
    - octeontx2-af: Don't enable Pause frames by default
    - octeontx2-af: Set NIX link credits based on max LMAC
    - octeontx2-af: Always configure NIX TX link credits based on max frame size
    - octeontx2-af: Re-enable MAC TX in otx2_stop processing
    - asix: Add check for usbnet_get_endpoints
    - bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters()
    - net: Implement missing SO_TIMESTAMPING_NEW cmsg support
    - selftests: secretmem: floor the memory size to the multiple of page_size
    - mm/memory-failure: check the mapcount of the precise page
    - firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and
      ASM108x/VT630x PCIe cards
    - x86/kprobes: fix incorrect return address calculation in
      kprobe_emulate_call_indirect
    - i2c: core: Fix atomic xfer check for non-preempt config
    - mm: fix unmap_mapping_range high bits shift bug
    - mmc: meson-mx-sdhc: Fix initialization frozen issue
    - mmc: rpmb: fixes pause retune on all RPMB partitions.
    - mmc: core: Cancel delayed work before releasing host
    - mmc: sdhci-sprd: Fix eMMC init failure after hw reset
    - ipv6: remove max_size check inline with ipv4
    - perf inject: Fix GEN_ELF_TEXT_OFFSET for jit
    - kallsyms: Make module_kallsyms_on_each_symbol generally available
    - tracing/kprobes: Fix symbol counting logic by looking at modules as well
    - net: usb: ax88179_178a: remove redundant init code
    - net: usb: ax88179_178a: move priv to driver_priv
    - Linux 5.15.147
  * CVE-2024-1085
    - netfilter: nf_tables: check if catch-all set element is active in next
      generation
  * CVE-2023-23000
    - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
  * performance: mm/percpu-internal.h: Re-layout pcpu_chunk to mitigate false
    sharing (LP: #2053152)
    - percpu-internal/pcpu_chunk: re-layout pcpu_chunk structure to reduce false
      sharing
  * performance: address_space: add padding for i_map and i_mmap_rwsem to
    mitigate a false sharing (LP: #2053069)
    - fs/address_space: add alignment padding for i_map and i_mmap_rwsem to
      mitigate a false sharing.
  * cpufreq: intel_pstate: Enable HWP IO boost for all servers (LP: #2052817)
    - cpufreq: intel_pstate: Enable HWP IO boost for all servers
  * performance: mm/memcontrol.c: remove the redundant updating of
    stats_flush_threshold (LP: #2052827)
    - mm/memcontrol.c: remove the redundant updating of stats_flush_threshold
  * Jammy update: v5.15.146 upstream stable release (LP: #2053212)
    - ARM: dts: dra7: Fix DRA7 L3 NoC node register size
    - ARM: OMAP2+: Fix null pointer dereference and memory leak in
      omap_soc_device_init
    - reset: Fix crash when freeing non-existent optional resets
    - s390/vx: fix save/restore of fpu kernel context
    - wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock
    - wifi: mac80211: mesh_plink: fix matches_local logic
    - net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list()
    - net/mlx5e: fix a potential double-free in fs_udp_create_groups
    - net/mlx5: Fix fw tracer first block check
    - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used
      by representors
    - net: sched: ife: fix potential use-after-free
    - ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
    - net/rose: fix races in rose_kill_by_device()
    - net: mana: select PAGE_POOL
    - net: check vlan filter feature in vlan_vids_add_by_dev() and
      vlan_vids_del_by_dev()
    - afs: Fix the dynamic root's d_delete to always delete unused dentries
    - afs: Fix dynamic root lookup DNS check
    - net: check dev->gso_max_size in gso_features_check()
    - keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
    - keys, dns: Fix missing size check of V1 server-list header
    - keys, dns: Fix size check of V1 server-list header
    - afs: Fix overwriting of result of DNS query
    - afs: Use refcount_t rather than atomic_t
    - afs: Fix use-after-free due to get/remove race in volume tree
    - ASoC: hdmi-codec: fix missing report for jack initial status
    - i2c: aspeed: Handle the coalesced stop conditions with the start conditions.
    - pinctrl: at91-pio4: use dedicated lock class for IRQ
    - gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl()
    - ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE
    - drm/i915/mtl: limit second scaler vertical scaling in ver >= 14
    - drm/i915: Relocate intel_atomic_setup_scalers()
    - drm/i915: Fix intel_atomic_setup_scalers() plane_state handling
    - smb: client: fix NULL deref in asn1_ber_decoder()
    - smb: client: fix OOB in smb2_query_reparse_point()
    - interconnect: Treat xlate() returning NULL node as an error
    - iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
    - Input: ipaq-micro-keys - add error handling for devm_kmemdup
    - scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
    - iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
    - iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
    - iio: triggered-buffer: prevent possible freeing of wrong buffer
    - ALSA: usb-audio: Increase delay in MOTU M quirk
    - wifi: cfg80211: Add my certificate
    - wifi: cfg80211: fix certs build to not depend on file order
    - USB: serial: ftdi_sio: update Actisense PIDs constant names
    - USB: serial: option: add Quectel EG912Y module support
    - USB: serial: option: add Foxconn T99W265 with new baseline
    - USB: serial: option: add Quectel RM500Q R13 firmware support
    - Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
    - Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE
    - Input: soc_button_array - add mapping for airplane mode button
    - net: 9p: avoid freeing uninit memory in p9pdu_vreadf
    - net: rfkill: gpio: set GPIO direction
    - net: ks8851: Fix TX stall caused by TX buffer overrun
    - dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp
    - scsi: core: Always send batch on reset or error handling command
    - tracing / synthetic: Disable events after testing in
      synth_event_gen_test_init()
    - bus: ti-sysc: Flush posted write only after srst_udelay
    - gpio: dwapb: mask/unmask IRQ when disable/enale it
    - lib/vsprintf: Fix %pfwf when current node refcount == 0
    - KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy
    - x86/alternatives: Sync core before enabling interrupts
    - fuse: share lookup state between submount and its parent
    - ksmbd: have a dependency on cifs ARC4
    - ksmbd: set epoch in create context v2 lease
    - ksmbd: set v2 lease capability
    - ksmbd: downgrade RWH lease caching state to RH for directory
    - ksmbd: send v2 lease break notification for directory
    - ksmbd: lazy v2 lease break on smb2_write()
    - ksmbd: avoid duplicate opinfo_put() call on error of smb21_lease_break_ack()
    - ksmbd: fix wrong allocation size update in smb2_open()
    - ARM: dts: Fix occasional boot hang for am3 usb
    - usb: fotg210-hcd: delete an incorrect bounds test
    - ethernet: constify references to netdev->dev_addr in drivers
    - net: usb: ax88179_178a: clean up pm calls
    - net: usb: ax88179_178a: wol optimizations
    - net: usb: ax88179_178a: avoid failed operations when device is disconnected
    - device property: Add const qualifier to device_get_match_data() parameter
    - spi: Introduce spi_get_device_match_data() helper
    - iio: imu: adis16475: add spi_device_id table
    - smb: client: fix OOB in SMB2_query_info_init()
    - mm/filemap: avoid buffered read/write race to read inconsistent data
    - ring-buffer: Fix wake ups when buffer_percent is set to 100
    - tracing: Fix blocked reader of snapshot buffer
    - ring-buffer: Remove useless update to write_stamp in rb_try_to_discard()
    - ring-buffer: Fix slowpath of interrupted event
    - dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
    - device property: Allow const parameter to dev_fwnode()
    - bpf: Fix prog_array_map_poke_run map poke update
    - Linux 5.15.146
  * CVE-2023-46838
    - xen-netback: don't produce zero-size SKB frags
  * CVE-2024-1086
    - netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  * disable Intel DMA remapping by default (LP: #1971699)
    - [Config] update tracking bug for CONFIG_INTEL_IOMMU_DEFAULT_ON
  * Validate connection interval to pass Bluetooth Test Suite (LP: #2052005)
    - Bluetooth: Enforce validation on max value of connection interval
  * Jammy update: v5.15.145 upstream stable release (LP: #2052406)
    - ksmbd: use ksmbd_req_buf_next() in ksmbd_verify_smb_message()
    - ksmdb: use cmd helper variable in smb2_get_ksmbd_tcon()
    - ksmbd: Remove redundant 'flush_workqueue()' calls
    - ksmbd: remove md4 leftovers
    - ksmbd: remove smb2_buf_length in smb2_hdr
    - ksmbd: remove smb2_buf_length in smb2_transform_hdr
    - ksmbd: change LeaseKey data type to u8 array
    - ksmbd: use oid registry functions to decode OIDs
    - ksmbd: Remove unused parameter from smb2_get_name()
    - ksmbd: Remove unused fields from ksmbd_file struct definition
    - ksmbd: set both ipv4 and ipv6 in FSCTL_QUERY_NETWORK_INTERFACE_INFO
    - ksmbd: Fix buffer_check_err() kernel-doc comment
    - ksmbd: Fix smb2_set_info_file() kernel-doc comment
    - ksmbd: Delete an invalid argument description in
      smb2_populate_readdir_entry()
    - ksmbd: Fix smb2_get_name() kernel-doc comment
    - ksmbd: register ksmbd ib client with ib_register_client()
    - ksmbd: set 445 port to smbdirect port by default
    - ksmbd: smbd: call rdma_accept() under CM handler
    - ksmbd: smbd: create MR pool
    - ksmbd: smbd: change the default maximum read/write, receive size
    - ksmbd: smbd: fix missing client's memory region invalidation
    - ksmbd: smbd: validate buffer descriptor structures
    - ksmbd: add support for key exchange
    - ksmbd: use netif_is_bridge_port
    - ksmbd: store fids as opaque u64 integers
    - ksmbd: shorten experimental warning on loading the module
    - ksmbd: Remove a redundant zeroing of memory
    - ksmbd: replace usage of found with dedicated list iterator variable
    - smb3: fix ksmbd bigendian bug in oplock break, and move its struct to
      smbfs_common
    - ksmbd: remove filename in ksmbd_file
    - ksmbd: smbd: change prototypes of RDMA read/write related functions
    - ksmbd: smbd: introduce read/write credits for RDMA read/write
    - ksmbd: smbd: simplify tracking pending packets
    - ksmbd: smbd: change the return value of get_sg_list
    - ksmbd: smbd: handle multiple Buffer descriptors
    - ksmbd: fix wrong smbd max read/write size check
    - ksmbd: Fix some kernel-doc comments
    - ksmbd: smbd: fix connection dropped issue
    - ksmbd: smbd: relax the count of sges required
    - ksmbd: smbd: Remove useless license text when SPDX-License-Identifier is
      already used
    - ksmbd: remove duplicate flag set in smb2_write
    - ksmbd: remove unused ksmbd_share_configs_cleanup function
    - ksmbd: use wait_event instead of schedule_timeout()
    - ksmbd: request update to stale share config
    - ksmbd: remove unnecessary generic_fillattr in smb2_open
    - ksmbd: don't open-code file_path()
    - ksmbd: don't open-code %pD
    - ksmbd: constify struct path
    - ksmbd: remove generic_fillattr use in smb2_open()
    - ksmbd: casefold utf-8 share names and fix ascii lowercase conversion
    - ksmbd: change security id to the one samba used for posix extension
    - ksmbd: set file permission mode to match Samba server posix extension
      behavior
    - ksmbd: fill sids in SMB_FIND_FILE_POSIX_INFO response
    - ksmbd: fix encryption failure issue for session logoff response
    - ksmbd: set NTLMSSP_NEGOTIATE_SEAL flag to challenge blob
    - ksmbd: decrease the number of SMB3 smbdirect server SGEs
    - ksmbd: reduce server smbdirect max send/receive segment sizes
    - ksmbd: hide socket error message when ipv6 config is disable
    - ksmbd: make utf-8 file name comparison work in __caseless_lookup()
    - ksmbd: call ib_drain_qp when disconnected
    - ksmbd: validate share name from share config response
    - ksmbd: replace one-element arrays with flexible-array members
    - ksmbd: set SMB2_SESSION_FLAG_ENCRYPT_DATA when enforcing data encryption for
      this share
    - ksmbd: use F_SETLK when unlocking a file
    - ksmbd: Fix resource leak in smb2_lock()
    - ksmbd: Convert to use sysfs_emit()/sysfs_emit_at() APIs
    - ksmbd: send proper error response in smb2_tree_connect()
    - ksmbd: Implements sess->rpc_handle_list as xarray
    - ksmbd: fix typo, syncronous->synchronous
    - ksmbd: Remove duplicated codes
    - ksmbd: update Kconfig to note Kerberos support and fix indentation
    - ksmbd: Fix spelling mistake "excceed" -> "exceeded"
    - ksmbd: Fix parameter name and comment mismatch
    - ksmbd: fix possible memory leak in smb2_lock()
    - ksmbd: fix wrong signingkey creation when encryption is AES256
    - ksmbd: remove unused is_char_allowed function
    - ksmbd: delete asynchronous work from list
    - ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
    - ksmbd: avoid out of bounds access in decode_preauth_ctxt()
    - ksmbd: set NegotiateContextCount once instead of every inc
    - ksmbd: avoid duplicate negotiate ctx offset increments
    - ksmbd: remove unused compression negotiate ctx packing
    - fs: introduce lock_rename_child() helper
    - ksmbd: fix racy issue from using ->d_parent and ->d_name
    - ksmbd: destroy expired sessions
    - ksmbd: block asynchronous requests when making a delay on session setup
    - ksmbd: fix racy issue from smb2 close and logoff with multichannel
    - ksmbd: fix racy issue under cocurrent smb2 tree disconnect
    - ksmbd: fix uninitialized pointer read in ksmbd_vfs_rename()
    - ksmbd: fix uninitialized pointer read in smb2_create_link()
    - ksmbd: fix multiple out-of-bounds read during context decoding
    - ksmbd: fix UAF issue from opinfo->conn
    - ksmbd: call putname after using the last component
    - ksmbd: fix out-of-bound read in deassemble_neg_contexts()
    - ksmbd: fix out-of-bound read in parse_lease_state()
    - ksmbd: fix posix_acls and acls dereferencing possible ERR_PTR()
    - ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop
    - ksmbd: validate smb request protocol id
    - ksmbd: add mnt_want_write to ksmbd vfs functions
    - ksmbd: remove unused ksmbd_tree_conn_share function
    - ksmbd: use kzalloc() instead of __GFP_ZERO
    - ksmbd: return a literal instead of 'err' in ksmbd_vfs_kern_path_locked()
    - ksmbd: Change the return value of ksmbd_vfs_query_maximal_access to void
    - ksmbd: use kvzalloc instead of kvmalloc
    - ksmbd: Replace the ternary conditional operator with min()
    - ksmbd: fix out of bounds read in smb2_sess_setup
    - ksmbd: add missing compound request handing in some commands
    - ksmbd: Use struct_size() helper in ksmbd_negotiate_smb_dialect()
    - ksmbd: Replace one-element array with flexible-array member
    - ksmbd: Fix unsigned expression compared with zero
    - ksmbd: check if a mount point is crossed during path lookup
    - ksmbd: validate session id and tree id in compound request
    - ksmbd: fix out of bounds in init_smb2_rsp_hdr()
    - ksmbd: switch to use kmemdup_nul() helper
    - ksmbd: add support for read compound
    - ksmbd: fix wrong interim response on compound
    - ksmbd: fix `force create mode' and `force directory mode'
    - ksmbd: reduce descriptor size if remaining bytes is less than request size
    - ksmbd: Fix one kernel-doc comment
    - ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()
    - ksmbd: add missing calling smb2_set_err_rsp() on error
    - ksmbd: remove experimental warning
    - ksmbd: remove unneeded mark_inode_dirty in set_info_sec()
    - ksmbd: fix passing freed memory 'aux_payload_buf'
    - ksmbd: return invalid parameter error response if smb2 request is invalid
    - ksmbd: check iov vector index in ksmbd_conn_write()
    - ksmbd: fix race condition between session lookup and expire
    - ksmbd: fix race condition with fp
    - ksmbd: fix race condition from parallel smb2 logoff requests
    - ksmbd: fix race condition from parallel smb2 lock requests
    - ksmbd: fix race condition between tree conn lookup and disconnect
    - ksmbd: fix wrong error response status by using set_smb2_rsp_status()
    - ksmbd: fix Null pointer dereferences in ksmbd_update_fstate()
    - ksmbd: fix potential double free on smb2_read_pipe() error path
    - ksmbd: Remove unused field in ksmbd_user struct
    - ksmbd: reorganize ksmbd_iov_pin_rsp()
    - ksmbd: fix kernel-doc comment of ksmbd_vfs_setxattr()
    - ksmbd: fix recursive locking in vfs helpers
    - ksmbd: fix missing RDMA-capable flag for IPoIB device in
      ksmbd_rdma_capable_netdev()
    - ksmbd: add support for surrogate pair conversion
    - ksmbd: no need to wait for binded connection termination at logoff
    - ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked()
    - ksmbd: handle malformed smb1 message
    - ksmbd: prevent memory leak on error return
    - ksmbd: fix possible deadlock in smb2_open
    - ksmbd: separately allocate ci per dentry
    - ksmbd: move oplock handling after unlock parent dir
    - ksmbd: release interim response after sending status pending response
    - ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId
    - ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error
    - tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols
    - kasan: disable kasan_non_canonical_hook() for HW tags
    - Linux 5.15.145
  * Jammy update: v5.15.144 upstream stable release (LP: #2052404)
    - r8152: add vendor/device ID pair for D-Link DUB-E250
    - r8152: add vendor/device ID pair for ASUS USB-C2500
    - netfilter: nf_tables: fix 'exist' matching on bigendian arches
    - mm/memory_hotplug: handle memblock_add_node() failures in
      add_memory_resource()
    - memblock: allow to specify flags with memblock_add_node()
    - MIPS: Loongson64: Handle more memory types passed from firmware
    - ksmbd: fix memory leak in smb2_lock()
    - afs: Fix refcount underflow from error handling race
    - HID: lenovo: Restrict detection of patched firmware only to USB cptkbd
    - net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX
    - qca_debug: Prevent crash on TX ring changes
    - qca_debug: Fix ethtool -G iface tx behavior
    - qca_spi: Fix reset behavior
    - atm: solos-pci: Fix potential deadlock on &cli_queue_lock
    - atm: solos-pci: Fix potential deadlock on &tx_queue_lock
    - net: vlan: introduce skb_vlan_eth_hdr()
    - net: fec: correct queue selection
    - octeontx2-af: fix a use-after-free in rvu_nix_register_reporters
    - octeontx2-pf: Fix promisc mcam entry action
    - octeontx2-af: Update RSS algorithm index
    - qed: Fix a potential use-after-free in qed_cxt_tables_alloc
    - net: Remove acked SYN flag from packet in the transmit queue correctly
    - net: ena: Destroy correct number of xdp queues upon failure
    - net: ena: Fix xdp drops handling due to multibuf packets
    - net: ena: Fix XDP redirection error
    - stmmac: dwmac-loongson: Make sure MDIO is initialized before use
    - sign-file: Fix incorrect return values check
    - vsock/virtio: Fix unsigned integer wrap around in
      virtio_transport_has_space()
    - dpaa2-switch: fix size of the dma_unmap
    - net: stmmac: use dev_err_probe() for reporting mdio bus registration failure
    - net: stmmac: Handle disabled MDIO busses from devicetree
    - net: atlantic: fix double free in ring reinit logic
    - cred: switch to using atomic_long_t
    - fuse: dax: set fc->dax to NULL in fuse_dax_conn_free()
    - ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB
    - ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants
    - ALSA: hda/realtek: Apply mute LED quirk for HP15-db
    - PCI: loongson: Limit MRRS to 256
    - drm/mediatek: Add spinlock for setting vblank event in atomic_begin
    - usb: aqc111: check packet for fixup for true limit
    - stmmac: dwmac-loongson: Add architecture dependency
    - [Config] updateconfigs for CONFIG_DWMAC_LOONGSON
    - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock
      required!"
    - blk-cgroup: bypass blkcg_deactivate_policy after destroying
    - bcache: avoid oversize memory allocation by small stripe_size
    - bcache: remove redundant assignment to variable cur_idx
    - bcache: add code comments for bch_btree_node_get() and
      __bch_btree_node_alloc()
    - bcache: avoid NULL checking to c->root in run_cache_set()
    - platform/x86: intel_telemetry: Fix kernel doc descriptions
    - HID: glorious: fix Glorious Model I HID report
    - HID: add ALWAYS_POLL quirk for Apple kb
    - HID: hid-asus: reset the backlight brightness level on resume
    - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad
    - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation
    - net: usb: qmi_wwan: claim interface 4 for ZTE MF290
    - HID: hid-asus: add const to read-only outgoing usb buffer
    - btrfs: do not allow non subvolume root targets for snapshot
    - soundwire: stream: fix NULL pointer dereference for multi_link
    - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS
    - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify
    - team: Fix use-after-free when an option instance allocation fails
    - drm/amdgpu/sdma5.2: add begin/end_use ring callbacks
    - ring-buffer: Fix memory leak of free page
    - tracing: Update snapshot buffer on resize if it is allocated
    - ring-buffer: Do not update before stamp when switching sub-buffers
    - ring-buffer: Have saved event hold the entire event
    - ring-buffer: Fix writing to the buffer with max_data_size
    - ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs
    - ring-buffer: Do not try to put back write_stamp
    - USB: gadget: core: adjust uevent timing on gadget unbind
    - powerpc/ftrace: Create a dummy stackframe to fix stack unwind
    - powerpc/ftrace: Fix stack teardown in ftrace_no_trace
    - r8152: avoid to change cfg for all devices
    - r8152: remove rtl_vendor_mode function
    - r8152: fix the autosuspend doesn't work
    - Linux 5.15.144
  * CVE-2023-32247
    - ksmbd: destroy expired sessions
  * CVE-2024-22705
    - ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()

  [ Ubuntu: 5.15.0-100.110 ]

  * jammy/linux: 5.15.0-100.110 -proposed tracker (LP: #2052616)
  * i915 regression introduced with 5.5 kernel (LP: #2044131)
    - drm/i915: Skip some timing checks on BXT/GLK DSI transcoders
  * Audio balancing setting doesn't work with the cirrus codec (LP: #2051050)
    - ALSA: hda/cs8409: Suppress vmaster control for Dolphin models
  * partproke is broken on empty loopback device (LP: #2049689)
    - block: Move checking GENHD_FL_NO_PART to bdev_add_partition()
  * CVE-2023-0340
    - vhost: use kzalloc() instead of kmalloc() followed by memset()
  * CVE-2023-51780
    - atm: Fix Use-After-Free in do_vcc_ioctl
  * CVE-2023-6915
    - ida: Fix crash in ida_free when the bitmap is empty
  * CVE-2024-0646
    - net: tls, update curr on splice as well
  * CVE-2024-0565
    - smb: client: fix OOB in receive_encrypted_standard()
  * CVE-2023-51781
    - appletalk: Fix Use-After-Free in atalk_ioctl
  * Jammy update: v5.15.143 upstream stable release (LP: #2050858)
    - vdpa/mlx5: preserve CVQ vringh index
    - hrtimers: Push pending hrtimers away from outgoing CPU earlier
    - i2c: designware: Fix corrupted memory seen in the ISR
    - netfilter: ipset: fix race condition between swap/destroy and kernel side
      add/del/test
    - tg3: Move the [rt]x_dropped counters to tg3_napi
    - tg3: Increment tx_dropped in tg3_tso_bug()
    - kconfig: fix memory leak from range properties
    - drm/amdgpu: correct chunk_ptr to a pointer to chunk.
    - platform/x86: asus-wmi: Adjust tablet/lidflip handling to use enum
    - platform/x86: asus-wmi: Add support for ROG X13 tablet mode
    - platform/x86: asus-wmi: Simplify tablet-mode-switch probing
    - platform/x86: asus-wmi: Simplify tablet-mode-switch handling
    - platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code
    - of: dynamic: Fix of_reconfig_get_state_change() return value documentation
    - platform/x86: wmi: Allow duplicate GUIDs for drivers that use struct
      wmi_driver
    - platform/x86: wmi: Skip blocks with zero instances
    - ipv6: fix potential NULL deref in fib6_add()
    - octeontx2-pf: Add missing mutex lock in otx2_get_pauseparam
    - octeontx2-af: Check return value of nix_get_nixlf before using nixlf
    - hv_netvsc: rndis_filter needs to select NLS
    - r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE
    - r8152: Add RTL8152_INACCESSIBLE checks to more loops
    - r8152: Add RTL8152_INACCESSIBLE to r8156b_wait_loading_flash()
    - r8152: Add RTL8152_INACCESSIBLE to r8153_pre_firmware_1()
    - r8152: Add RTL8152_INACCESSIBLE to r8153_aldps_en()
    - mlxbf-bootctl: correctly identify secure boot with development keys
    - platform/mellanox: Add null pointer checks for devm_kasprintf()
    - platform/mellanox: Check devm_hwmon_device_register_with_groups() return
      value
    - arcnet: restoring support for multiple Sohard Arcnet cards
    - net: stmmac: fix FPE events losing
    - octeontx2-af: fix a use-after-free in rvu_npa_register_reporters
    - i40e: Fix unexpected MFS warning message
    - net: bnxt: fix a potential use-after-free in bnxt_init_tc
    - ionic: fix snprintf format length warning
    - ionic: Fix dim work handling in split interrupt mode
    - ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
    - net: hns: fix fake link up on xge port
    - octeontx2-af: Update Tx link register range
    - netfilter: nf_tables: validate family when identifying table via handle
    - netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
    - tcp: do not accept ACK of bytes we never sent
    - bpf: sockmap, updating the sg structure should also update curr
    - psample: Require 'CAP_NET_ADMIN' when joining "packets" group
    - net: add missing kdoc for struct genl_multicast_group::flags
    - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group
    - tee: optee: Fix supplicant based device enumeration
    - RDMA/hns: Fix unnecessary err return when using invalid congest control
      algorithm
    - RDMA/irdma: Do not modify to SQD on error
    - RDMA/irdma: Add wait for suspend on SQD
    - arm64: dts: rockchip: Expand reg size of vdec node for RK3399
    - RDMA/rtrs-srv: Do not unconditionally enable irq
    - RDMA/rtrs-clt: Start hb after path_up
    - RDMA/rtrs-srv: Check return values while processing info request
    - RDMA/rtrs-srv: Free srv_mr iu only when always_invalidate is true
    - RDMA/rtrs-srv: Destroy path files after making sure no IOs in-flight
    - RDMA/rtrs-clt: Fix the max_send_wr setting
    - RDMA/rtrs-clt: Remove the warnings for req in_use check
    - RDMA/bnxt_re: Correct module description string
    - hwmon: (acpi_power_meter) Fix 4.29 MW bug
    - hwmon: (nzxt-kraken2) Fix error handling path in kraken2_probe()
    - ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate
    - RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz
    - RDMA/irdma: Avoid free the non-cqp_request scratch
    - arm64: dts: imx8mq: drop usb3-resume-missing-cas from usb
    - arm64: dts: imx8mp: imx8mq: Add parkmode-disable-ss-quirk on DWC3
    - ARM: dts: imx6ul-pico: Describe the Ethernet PHY clock
    - tracing: Fix a warning when allocating buffered events fails
    - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle()
    - ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init
    - ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt
    - ARM: dts: imx28-xea: Pass the 'model' property
    - riscv: fix misaligned access handling of C.SWSP and C.SDSP
    - md: introduce md_ro_state
    - md: don't leave 'MD_RECOVERY_FROZEN' in error path of md_set_readonly()
    - kprobes: consistent rcu api usage for kretprobe holder
    - nvme-pci: Add sleep quirk for Kingston drives
    - io_uring: fix mutex_unlock with unreferenced ctx
    - ALSA: usb-audio: Add Pioneer DJM-450 mixer controls
    - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names
    - nilfs2: fix missing error check for sb_set_blocksize call
    - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
    - checkstack: fix printed address
    - tracing: Always update snapshot buffer size
    - tracing: Disable snapshot buffer when stopping instance tracers
    - tracing: Fix incomplete locking when disabling buffered events
    - tracing: Fix a possible race when disabling buffered events
    - packet: Move reference count in packet_sock to atomic_long_t
    - regmap: fix bogus error on regcache_sync success
    - platform/surface: aggregator: fix recv_buf() return value
    - arm64: dts: mediatek: mt7622: fix memory node warning check
    - arm64: dts: mediatek: mt8183-kukui-jacuzzi: fix dsi unnecessary cells
      properties
    - arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names
    - arm64: dts: mediatek: mt8183: Fix unit address for scp reserved memory
    - binder: fix memory leaks of spam and pending work
    - kallsyms: Make kallsyms_on_each_symbol generally available
    - coresight: etm4x: Make etm4_remove_dev() return void
    - coresight: etm4x: Remove bogous __exit annotation for some functions
    - misc: mei: client.c: return negative error code in mei_cl_write
    - misc: mei: client.c: fix problem of return '-EOVERFLOW' in mei_cl_write
    - ring-buffer: Force absolute timestamp on discard of event
    - tracing: Set actual size after ring buffer resize
    - tracing: Stop current tracer when resizing buffer
    - r8169: fix rtl8125b PAUSE frames blasting when suspended
    - mm: fix oops when filemap_map_pmd() without prealloc_pte
    - io_uring/af_unix: disable sending io_uring over sockets
    - platform/x86: asus-wmi: Fix kbd_dock_devid tablet-switch reporting
    - docs/process/howto: Replace C89 with C11
    - tools headers UAPI: Sync linux/perf_event.h with the kernel sources
    - arm64: dts: mediatek: align thermal zone node names with dtschema
    - arm64: dts: mediatek: mt8183: Move thermal-zones to the root node
    - arm64: dts: mediatek: add missing space before {
    - arm64: dts: mt8183: kukui: Fix underscores in node names
    - gpiolib: sysfs: Fix error handling on failed export
    - drm/amd/amdgpu: Fix warnings in amdgpu/amdgpu_display.c
    - drm/amdgpu: correct the amdgpu runtime dereference usage count
    - usb: gadget: f_hid: fix report descriptor allocation
    - parport: Add support for Brainboxes IX/UC/PX parallel cards
    - usb: typec: class: fix typec_altmode_put_partner to put plugs
    - ARM: PL011: Fix DMA support
    - serial: sc16is7xx: address RX timeout interrupt errata
    - serial: 8250: 8250_omap: Clear UART_HAS_RHR_IT_DIS bit
    - serial: 8250: 8250_omap: Do not start RX DMA on THRI interrupt
    - serial: 8250_omap: Add earlycon support for the AM654 UART controller
    - x86/CPU/AMD: Check vendor in the AMD microcode callback
    - KVM: s390/mm: Properly reset no-dat
    - KVM: SVM: Update EFER software model on CR0 trap for SEV-ES
    - MIPS: Loongson64: Reserve vgabios memory on boot
    - MIPS: Loongson64: Enable DMA noncoherent support
    - cifs: Fix non-availability of dedup breaking generic/304
    - smb: client: fix potential NULL deref in parse_dfs_referrals()
    - devcoredump : Serialize devcd_del work
    - devcoredump: Send uevent once devcd is ready
    - Linux 5.15.143
  * Intel E810-XXV - NETDEV WATCHDOG: (ice): transmit queue timed out
    (LP: #2036239)
    - ice: Add feature bitmap, helpers and a check for DSCP
    - ice: Add driver support for firmware changes for LAG
    - ice: alter feature support check for SRIOV and LAG
  * Don't WARN_ON_ONCE() for a broken discovery table (LP: #2048404)
    - perf/x86/uncore: Don't WARN_ON_ONCE() for a broken discovery table
  * Reject connection when malformed L2CAP signal packet is received
    (LP: #2047634)
    - Bluetooth: L2CAP: Send reject on command corrupted request
  * Jammy update: v5.15.142 upstream stable release (LP: #2050849)
    - pinctrl: avoid reload of p state in list iteration
    - firewire: core: fix possible memory leak in create_units()
    - mmc: cqhci: Increase recovery halt timeout
    - mmc: cqhci: Warn of halt or task clear failure
    - mmc: cqhci: Fix task clearing in CQE error recovery
    - mmc: block: Retry commands in CQE error recovery
    - mmc: block: Do not lose cache flush during CQE error recovery
    - mmc: block: Be sure to wait while busy in CQE error recovery
    - ALSA: hda: Disable power-save on KONTRON SinglePC
    - ALSA: hda/realtek: Headset Mic VREF to 100%
    - ALSA: hda/realtek: Add supported ALC257 for ChromeOS
    - dm-verity: align struct dm_verity_fec_io properly
    - dm verity: don't perform FEC for failed readahead IO
    - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
    - iommu/vt-d: Add MTL to quirk list to skip TE disabling
    - powerpc: Don't clobber f0/vs0 during fp|altivec register save
    - parisc: Drop the HP-UX ENOSYM and EREMOTERELEASE error codes
    - btrfs: ref-verify: fix memory leaks in btrfs_ref_tree_mod()
    - btrfs: fix off-by-one when checking chunk map includes logical address
    - btrfs: send: ensure send_fd is writable
    - btrfs: make error messages more clear when getting a chunk map
    - Input: xpad - add HyperX Clutch Gladiate Support
    - vlan: introduce vlan_dev_free_egress_priority
    - vlan: move dev_put into vlan_dev_uninit
    - rcu: Avoid tracing a few functions executed in stop machine
    - hv_netvsc: fix race of netvsc and VF register_netdevice
    - USB: core: Change configuration warnings to notices
    - usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
    - dpaa2-eth: increase the needed headroom to account for alignment
    - uapi: propagate __struct_group() attributes to the container union
    - selftests/net: ipsec: fix constant out of range
    - octeontx2-af: Fix possible buffer overflow
    - net: stmmac: xgmac: Disable FPE MMC interrupts
    - octeontx2-pf: Fix adding mbox work queue entry when num_vfs > 64
    - Revert "workqueue: remove unused cancel_work()"
    - r8169: prevent potential deadlock in rtl8169_close
    - ravb: Fix races between ravb_tx_timeout_work() and net related ops
    - net: ravb: Check return value of reset_control_deassert()
    - net: ravb: Use pm_runtime_resume_and_get()
    - net: ravb: Start TX queues after HW initialization succeeded
    - net: ravb: Stop DMA in case of failures on ravb_open()
    - perf intel-pt: Fix async branch flags
    - selftests/resctrl: Add missing SPDX license to Makefile
    - selftests/resctrl: Move _GNU_SOURCE define into Makefile
    - smb3: fix touch -h of symlink
    - ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
    - ASoC: SOF: sof-pci-dev: use community key on all Up boards
    - ASoC: SOF: sof-pci-dev: add parameter to override topology filename
    - ASoC: SOF: sof-pci-dev: don't use the community key on APL Chromebooks
    - ASoC: SOF: sof-pci-dev: Fix community key quirk detection
    - fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
    - fs: add ctime accessors infrastructure
    - smb3: fix caching of ctime on setxattr
    - cpufreq: imx6q: don't warn for disabling a non-existing frequency
    - cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
    - iommu/vt-d: Omit devTLB invalidation requests when TES=0
    - iommu/vt-d: Make context clearing consistent with context mapping
    - mmc: core: add helpers mmc_regulator_enable/disable_vqmmc
    - mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled
    - r8169: disable ASPM in case of tx timeout
    - r8169: fix deadlock on RTL8125 in jumbo mtu mode
    - iomap: update ki_pos a little later in iomap_dio_complete
    - Linux 5.15.142
  * Jammy update: v5.15.141 upstream stable release (LP: #2050044)
    - afs: Fix afs_server_list to be cleaned up with RCU
    - afs: Make error on cell lookup failure consistent with OpenAFS
    - drm/panel: boe-tv101wum-nl6: Fine tune the panel power sequence
    - drm/panel: auo,b101uan08.3: Fine tune the panel power sequence
    - drm/panel: simple: Fix Innolux G101ICE-L01 bus flags
    - drm/panel: simple: Fix Innolux G101ICE-L01 timings
    - wireguard: use DEV_STATS_INC()
    - octeontx2-pf: Fix memory leak during interface down
    - ata: pata_isapnp: Add missing error check for devm_ioport_map()
    - drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
    - HID: core: store the unique system identifier in hid_device
    - HID: fix HID device resource race between HID core and debugging support
    - ipv4: Correct/silence an endian warning in __ip_do_redirect
    - net: usb: ax88179_178a: fix failed operations during ax88179_reset
    - net/smc: avoid data corruption caused by decline
    - arm/xen: fix xen_vcpu_info allocation alignment
    - octeontx2-pf: Fix ntuple rule creation to direct packet to VF with higher Rx
      queue than its PF
    - amd-xgbe: handle corner-case during sfp hotplug
    - amd-xgbe: handle the corner-case during tx completion
    - amd-xgbe: propagate the correct speed and duplex status
    - net: axienet: Fix check for partial TX checksum
    - afs: Return ENOENT if no cell DNS record can be found
    - afs: Fix file locking on R/O volumes to operate in local mode
    - nvmet: nul-terminate the NQNs passed in the connect command
    - USB: dwc3: qcom: fix resource leaks on probe deferral
    - USB: dwc3: qcom: fix ACPI platform device leak
    - lockdep: Fix block chain corruption
    - MIPS: KVM: Fix a build warning about variable set but not used
    - media: camss: Replace hard coded value with parameter
    - media: camss: sm8250: Virtual channels for CSID
    - media: qcom: camss: Fix set CSI2_RX_CFG1_VC_MODE when VC is greater than 3
    - media: qcom: camss: Fix csid-gen2 for test pattern generator
    - ext4: add a new helper to check if es must be kept
    - ext4: factor out __es_alloc_extent() and __es_free_extent()
    - ext4: use pre-allocated es in __es_insert_extent()
    - ext4: use pre-allocated es in __es_remove_extent()
    - ext4: using nofail preallocation in ext4_es_remove_extent()
    - ext4: using nofail preallocation in ext4_es_insert_delayed_block()
    - ext4: using nofail preallocation in ext4_es_insert_extent()
    - ext4: fix slab-use-after-free in ext4_es_insert_extent()
    - ext4: make sure allocate pending entry not fail
    - proc: sysctl: prevent aliased sysctls from getting passed to init
    - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA
    - swiotlb-xen: provide the "max_mapping_size" method
    - bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in
      btree_gc_coalesce()
    - md: fix bi_status reporting in md_end_clone_io
    - bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race
    - io_uring/fs: consider link->flags when getting path for LINKAT
    - s390/dasd: protect device queue against concurrent access
    - USB: serial: option: add Luat Air72*U series products
    - hv_netvsc: Fix race of register_netdevice_notifier and VF register
    - hv_netvsc: Mark VF as slave before exposing it to user-mode
    - dm-delay: fix a race between delay_presuspend and delay_bio
    - bcache: check return value from btree_node_alloc_replacement()
    - bcache: prevent potential division by zero error
    - bcache: fixup init dirty data errors
    - bcache: fixup lock c->root error
    - usb: cdnsp: Fix deadlock issue during using NCM gadget
    - USB: serial: option: add Fibocom L7xx modules
    - USB: serial: option: fix FM101R-GL defines
    - USB: serial: option: don't claim interface 4 for ZTE MF290
    - usb: typec: tcpm: Skip hard reset when in error recovery
    - USB: dwc2: write HCINT with INTMASK applied
    - usb: dwc3: Fix default mode initialization
    - usb: dwc3: set the dma max_seg_size
    - USB: dwc3: qcom: fix software node leak on probe errors
    - USB: dwc3: qcom: fix wakeup after probe deferral
    - io_uring: fix off-by one bvec index
    - Linux 5.15.141
  * Jammy update: v5.15.140 upstream stable release (LP: #2050038)
    - locking/ww_mutex/test: Fix potential workqueue corruption
    - perf/core: Bail out early if the request AUX area is out of bound
    - clocksource/drivers/timer-imx-gpt: Fix potential memory leak
    - clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
    - workqueue: Provide one lock class key per work_on_cpu() callsite
    - x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
    - wifi: mac80211_hwsim: fix clang-specific fortify warning
    - wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
    - atl1c: Work around the DMA RX overflow issue
    - bpf: Detect IP == ksym.end as part of BPF program
    - wifi: ath9k: fix clang-specific fortify warnings
    - wifi: ath10k: fix clang-specific fortify warning
    - net: annotate data-races around sk->sk_tx_queue_mapping
    - net: annotate data-races around sk->sk_dst_pending_confirm
    - wifi: ath10k: Don't touch the CE interrupt registers after power up
    - Bluetooth: btusb: Add date->evt_skb is NULL check
    - Bluetooth: Fix double free in hci_conn_cleanup
    - platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
    - drm/komeda: drop all currently held locks if deadlock happens
    - drm/amdkfd: Fix a race condition of vram buffer unref in svm code
    - drm/amd/display: use full update for clip size increase of large plane
      source
    - string.h: add array-wrappers for (v)memdup_user()
    - kernel: kexec: copy user-array safely
    - kernel: watch_queue: copy user-array safely
    - drm: vmwgfx_surface.c: copy user-array safely
    - drm/msm/dp: skip validity check for DP CTS EDID checksum
    - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
    - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
    - drm/amdgpu: Fix potential null pointer derefernce
    - drm/panel: fix a possible null pointer dereference
    - drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
    - drm/amdgpu/vkms: fix a possible null pointer dereference
    - drm/panel: st7703: Pick different reset sequence
    - drm/amdkfd: Fix shift out-of-bounds issue
    - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
    - arm64: dts: ls208xa: use a pseudo-bus to constrain usb dma size
    - selftests/efivarfs: create-read: fix a resource leak
    - ASoC: soc-card: Add storage for PCI SSID
    - crypto: pcrypt - Fix hungtask for PADATA_RESET
    - RDMA/hfi1: Use FIELD_GET() to extract Link Width
    - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs
    - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool
    - fs/jfs: Add check for negative db_l2nbperpage
    - fs/jfs: Add validity check for db_maxag and db_agpref
    - jfs: fix array-index-out-of-bounds in dbFindLeaf
    - jfs: fix array-index-out-of-bounds in diAlloc
    - HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround
    - ARM: 9320/1: fix stack depot IRQ stack filter
    - ALSA: hda: Fix possible null-ptr-deref when assigning a stream
    - PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields
    - atm: iphase: Do PCI error checks on own line
    - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
    - PCI: Use FIELD_GET() to extract Link Width
    - PCI: Extract ATS disabling to a helper function
    - PCI: Disable ATS for specific Intel IPU E2000 devices
    - misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller
    - PCI: Use FIELD_GET() in Sapphire RX 5600 XT Pulse quirk
    - HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
    - exfat: support handle zero-size directory
    - tty: vcc: Add check for kstrdup() in vcc_probe()
    - usb: gadget: f_ncm: Always set current gadget in ncm_bind()
    - 9p/trans_fd: Annotate data-racy writes to file::f_flags
    - 9p: v9fs_listxattr: fix %s null argument warning
    - i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler
    - i2c: sun6i-p2wi: Prevent potential division by zero
    - virtio-blk: fix implicit overflow on virtio_max_dma_size
    - i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data.
    - media: gspca: cpia1: shift-out-of-bounds in set_flicker
    - media: vivid: avoid integer overflow
    - gfs2: ignore negated quota changes
    - gfs2: fix an oops in gfs2_permission
    - media: cobalt: Use FIELD_GET() to extract Link Width
    - media: ccs: Fix driver quirk struct documentation
    - media: imon: fix access to invalid resource for the second interface
    - drm/amd/display: Avoid NULL dereference of timing generator
    - kgdb: Flush console before entering kgdb on panic
    - i2c: dev: copy userspace array safely
    - ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
    - drm/qxl: prevent memory leak
    - drm/amdgpu: fix software pci_unplug on some chips
    - pwm: Fix double shift bug
    - wifi: iwlwifi: Use FW rate for non-data frames
    - tracing: Reuse logic from perf's get_recursion_context()
    - tracing/perf: Add interrupt_context_level() helper
    - sched/core: Optimize in_task() and in_interrupt() a bit
    - media: cadence: csi2rx: Unregister v4l2 async notifier
    - media: cec: meson: always include meson sub-directory in Makefile
    - SUNRPC: ECONNRESET might require a rebind
    - SUNRPC: Add an IS_ERR() check back to where it was
    - NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
    - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
    - gfs2: Silence "suspicious RCU usage in gfs2_permission" warning
    - mptcp: diag: switch to context structure
    - mptcp: listen diag dump support
    - net: inet: Remove count from inet_listen_hashbucket
    - net: inet: Open code inet_hash2 and inet_unhash2
    - net: inet: Retire port only listening_hash
    - net: set SOCK_RCU_FREE before inserting socket into hashtable
    - ipvlan: add ipvlan_route_v6_outbound() helper
    - tty: Fix uninit-value access in ppp_sync_receive()
    - net: hns3: fix add VLAN fail issue
    - net: hns3: refine the definition for struct hclge_pf_to_vf_msg
    - net: hns3: add byte order conversion for PF to VF mailbox message
    - net: hns3: add barrier in vf mailbox reply process
    - net: hns3: fix incorrect capability bit display for copper port
    - net: hns3: fix variable may not initialized problem in hns3_init_mac_addr()
    - net: hns3: fix VF reset fail issue
    - net: hns3: fix VF wrong speed and duplex issue
    - tipc: Fix kernel-infoleak due to uninitialized TLV value
    - ppp: limit MRU to 64K
    - xen/events: fix delayed eoi list handling
    - ptp: annotate data-race around q->head and q->tail
    - bonding: stop the device in bond_setup_by_slave()
    - net: ethernet: cortina: Fix max RX frame define
    - net: ethernet: cortina: Handle large frames
    - net: ethernet: cortina: Fix MTU max setting
    - af_unix: fix use-after-free in unix_stream_read_actor()
    - netfilter: nf_conntrack_bridge: initialize err to 0
    - netfilter: nf_tables: use the correct get/put helpers
    - netfilter: nf_tables: add and use BE register load-store helpers
    - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
    - net: stmmac: fix rx budget limit check
    - net/mlx5e: Remove incorrect addition of action fwd flag
    - net/mlx5e: Move mod hdr allocation to a single place
    - net/mlx5e: Refactor mod header management API
    - net/mlx5e: Fix pedit endianness
    - net/mlx5e: Reduce the size of icosq_str
    - net/mlx5e: Check return value of snprintf writing to fw_version buffer for
      representors
    - macvlan: Don't propagate promisc change to lower dev in passthru
    - tools/power/turbostat: Fix a knl bug
    - tools/power/turbostat: Enable the C-state Pre-wake printing
    - cifs: spnego: add ';' in HOST_KEY_LEN
    - cifs: fix check of rc in function generate_smb3signingkey
    - xfs: refactor buffer cancellation table allocation
    - xfs: don't leak xfs_buf_cancel structures when recovery fails
    - xfs: convert buf_cancel_table allocation to kmalloc_array
    - xfs: use invalidate_lock to check the state of mmap_lock
    - xfs: prevent a UAF when log IO errors race with unmount
    - xfs: flush inode gc workqueue before clearing agi bucket
    - xfs: fix use-after-free in xattr node block inactivation
    - xfs: don't leak memory when attr fork loading fails
    - xfs: fix intermittent hang during quotacheck
    - xfs: add missing cmap->br_state = XFS_EXT_NORM update
    - xfs: Fix false ENOSPC when performing direct write on a delalloc extent in
      cow fork
    - xfs: fix inode reservation space for removing transaction
    - xfs: avoid a UAF when log intent item recovery fails
    - xfs: fix exception caused by unexpected illegal bestcount in leaf dir
    - xfs: fix memory leak in xfs_errortag_init
    - xfs: Fix unreferenced object reported by kmemleak in xfs_sysfs_init()
    - i915/perf: Fix NULL deref bugs with drm_dbg() calls
    - media: venus: hfi: add checks to perform sanity on queue pointers
    - powerpc/perf: Fix disabling BHRB and instruction sampling
    - randstruct: Fix gcc-plugin performance mode to stay in group
    - bpf: Fix check_stack_write_fixed_off() to correctly spill imm
    - bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
    - scsi: mpt3sas: Fix loop logic
    - scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for
      selected registers
    - scsi: qla2xxx: Fix system crash due to bad pointer access
    - crypto: x86/sha - load modules based on CPU features
    - x86/cpu/hygon: Fix the CPU topology evaluation for real
    - KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space
    - KVM: x86: Ignore MSR_AMD64_TW_CFG access
    - audit: don't take task_lock() in audit_exe_compare() code path
    - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
    - tty/sysrq: replace smp_processor_id() with get_cpu()
    - hvc/xen: fix console unplug
    - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
    - hvc/xen: fix event channel handling for secondary consoles
    - PCI/sysfs: Protect driver's D3cold preference from user space
    - watchdog: move softlockup_panic back to early_param
    - ACPI: resource: Do IRQ override on TongFang GMxXGxx
    - arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
    - parisc/pdc: Add width field to struct pdc_model
    - clk: socfpga: Fix undefined behavior bug in struct stratix10_clock_data
    - clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks
    - clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT flag from PLL clocks
    - mmc: vub300: fix an error code
    - mmc: sdhci_am654: fix start loop index for TAP value parsing
    - PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common()
    - PCI: exynos: Don't discard .remove() callback
    - wifi: wilc1000: use vmm_table as array in wilc struct
    - svcrdma: Drop connection after an RDMA Read error
    - rcu/tree: Defer setting of jiffies during stall reset
    - arm64: dts: qcom: ipq6018: Fix hwlock index for SMEM
    - PM: hibernate: Use __get_safe_page() rather than touching the list
    - PM: hibernate: Clean up sync_read handling in snapshot_write_next()
    - rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects
    - btrfs: don't arbitrarily slow down delalloc if we're committing
    - firmware: qcom_scm: use 64-bit calling convention only when client is 64-bit
    - ACPI: FPDT: properly handle invalid FPDT subtables
    - ima: annotate iint mutex to avoid lockdep false positive warnings
    - ima: detect changes to the backing overlay file
    - wifi: ath11k: fix temperature event locking
    - wifi: ath11k: fix dfs radar event locking
    - wifi: ath11k: fix htt pktlog locking
    - mmc: meson-gx: Remove setting of CMD_CFG_ERROR
    - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
    - KEYS: trusted: Rollback init_trusted() consistently
    - PCI: keystone: Don't discard .remove() callback
    - PCI: keystone: Don't discard .probe() callback
    - netfilter: nf_tables: split async and sync catchall in two functions
    - selftests/resctrl: Remove duplicate feature check from CMT test
    - selftests/resctrl: Reduce failures due to outliers in MBA/MBM tests
    - ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix
    - jbd2: fix potential data lost in recovering journal raced with synchronizing
      fs bdev
    - quota: explicitly forbid quota files from being encrypted
    - kernel/reboot: emergency_restart: Set correct system_state
    - i2c: core: Run atomic i2c xfer when !preemptible
    - tracing: Have the user copy of synthetic event address use correct context
    - mcb: fix error handling for different scenarios when parsing
    - dmaengine: stm32-mdma: correct desc prep when channel running
    - s390/cmma: fix detection of DAT pages
    - mm/cma: use nth_page() in place of direct struct page manipulation
    - mm/memory_hotplug: use pfn math in place of direct struct page manipulation
    - mtd: cfi_cmdset_0001: Byte swap OTP info
    - i3c: master: cdns: Fix reading status register
    - i3c: master: svc: fix race condition in ibi work thread
    - i3c: master: svc: fix wrong data return when IBI happen during start frame
    - i3c: master: svc: fix ibi may not return mandatory data byte
    - i3c: master: svc: fix check wrong status register in irq handler
    - i3c: master: svc: fix SDA keep low when polling IBIWON timeout happen
    - parisc: Prevent booting 64-bit kernels on PA1.x machines
    - parisc/pgtable: Do not drop upper 5 address bits of physical address
    - xhci: Enable RPM on controllers that support low-power states
    - ALSA: info: Fix potential deadlock at disconnection
    - ALSA: hda/realtek - Add Dell ALC295 to pin fall back table
    - ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
    - serial: meson: Use platform_get_irq() to get the interrupt
    - tty: serial: meson: fix hard LOCKUP on crtscts mode
    - regmap: Ensure range selector registers are updated after cache sync
    - cpufreq: stats: Fix buffer overflow detection in trans_stats()
    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559
    - bluetooth: Add device 0bda:887b to device tables
    - bluetooth: Add device 13d3:3571 to device tables
    - Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables
    - Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE
    - ksmbd: fix slab out of bounds write in smb_inherit_dacl()
    - arm64: dts: qcom: ipq6018: switch TCSR mutex to MMIO
    - arm64: dts: qcom: ipq6018: Fix tcsr_mutex register size
    - powerpc/pseries/ddw: simplify enable_ddw()
    - Revert ncsi: Propagate carrier gain/loss events to the NCSI controller
    - Revert "i2c: pxa: move to generic GPIO recovery"
    - lsm: fix default return value for vm_enough_memory
    - lsm: fix default return value for inode_getsecctx
    - sbsa_gwdt: Calculate timeout with 64-bit math
    - i2c: designware: Disable TX_EMPTY irq while waiting for block length byte
    - s390/ap: fix AP bus crash on early config change callback invocation
    - net: ethtool: Fix documentation of ethtool_sprintf()
    - net: dsa: lan9303: consequently nested-lock physical MDIO
    - net: phylink: initialize carrier state at creation
    - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
    - f2fs: avoid format-overflow warning
    - media: lirc: drop trailing space from scancode transmit
    - media: sharp: fix sharp encoding
    - media: venus: hfi_parser: Add check to keep the number of codecs within
      range
    - media: venus: hfi: fix the check to handle session buffer requirement
    - media: venus: hfi: add checks to handle capabilities from firmware
    - media: ccs: Correctly initialise try compose rectangle
    - nfsd: fix file memleak on client_opens_release
    - riscv: kprobes: allow writing to x0
    - mmc: sdhci-pci-gli: A workaround to allow GL9750 to enter ASPM L1.2
    - mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors
    - r8169: fix network lost after resume on DASH systems
    - mmc: sdhci-pci-gli: GL9750: Mask the replay timer timeout of AER
    - media: qcom: camss: Fix pm_domain_on sequence in probe
    - media: qcom: camss: Fix vfe_get() error jump
    - media: qcom: camss: Fix VFE-17x vfe_disable_output()
    - media: qcom: camss: Fix missing vfe_lite clocks check
    - ext4: apply umask if ACL support is disabled
    - ext4: correct offset of gdb backup in non meta_bg group to update_backups
    - ext4: correct return value of ext4_convert_meta_bg
    - ext4: correct the start block of counting reserved clusters
    - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
    - ext4: add missed brelse in update_backups
    - drm/amd/pm: Handle non-terminated overdrive commands.
    - drm/i915: Fix potential spectre vulnerability
    - drm/amdgpu: don't use ATRM for external devices
    - drm/amdgpu: fix error handling in amdgpu_bo_list_get()
    - drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox
    - powerpc/powernv: Fix fortify source warnings in opal-prd.c
    - tracing: Have trace_event_file have ref counters
    - Input: xpad - add VID for Turtle Beach controllers
    - driver core: Release all resources during unbind before updating device
      links
    - Linux 5.15.140
  * CVE-2023-46862
    - io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
  * Jammy update: v5.15.139 upstream stable release (LP: #2049432)
    - iov_iter, x86: Be consistent about the __user tag on copy_mc_to_user()
    - sched/uclamp: Ignore (util == 0) optimization in feec() when p_util_max = 0
    - sched: Fix stop_one_cpu_nowait() vs hotplug
    - vfs: fix readahead(2) on block devices
    - writeback, cgroup: switch inodes with dirty timestamps to release dying
      cgwbs
    - x86/srso: Fix SBPB enablement for (possible) future fixed HW
    - futex: Don't include process MM in futex key on no-MMU
    - x86: Share definition of __is_canonical_address()
    - x86/sev-es: Allow copy_from_kernel_nofault() in earlier boot
    - x86/boot: Fix incorrect startup_gdt_descr.size
    - pstore/platform: Add check for kstrdup
    - genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()
    - i40e: fix potential memory leaks in i40e_remove()
    - selftests/bpf: Test tail call counting with bpf2bpf and data on stack
    - selftests/bpf: Correct map_fd to data_fd in tailcalls
    - udp: add missing WRITE_ONCE() around up->encap_rcv
    - tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed
    - gve: Use size_add() in call to struct_size()
    - mlxsw: Use size_mul() in call to struct_size()
    - tipc: Use size_add() in calls to struct_size()
    - net: spider_net: Use size_add() in call to struct_size()
    - wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
    - wifi: mt76: mt7603: rework/fix rx pse hang check
    - mt76: dma: use kzalloc instead of devm_kzalloc for txwi
    - mt76: add support for overriding the device used for DMA mapping
    - mt76: pass original queue id from __mt76_tx_queue_skb to the driver
    - wifi: mt76: mt7603: improve stuck beacon handling
    - tcp_metrics: add missing barriers on delete
    - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics()
    - tcp_metrics: do not create an entry from tcp_init_metrics()
    - wifi: rtlwifi: fix EDCA limit set by BT coexistence
    - can: dev: can_restart(): don't crash kernel if carrier is OK
    - can: dev: can_restart(): fix race condition between controller restart and
      netif_carrier_on()
    - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is
      accessed out of bounds
    - PM / devfreq: rockchip-dfi: Make pmu regmap mandatory
    - netfilter: nf_tables: Drop pointless memset when dumping rules
    - thermal: core: prevent potential string overflow
    - r8169: use tp_to_dev instead of open code
    - r8169: fix rare issue with broken rx after link-down on RTL8125
    - chtls: fix tp->rcv_tstamp initialization
    - tcp: fix cookie_init_timestamp() overflows
    - iwlwifi: pcie: adjust to Bz completion descriptor
    - wifi: iwlwifi: call napi_synchronize() before freeing rx/tx queues
    - wifi: iwlwifi: pcie: synchronize IRQs before NAPI
    - wifi: iwlwifi: empty overflow queue during flush
    - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias()
    - ipv6: avoid atomic fragment on GSO packets
    - net: add DEV_STATS_READ() helper
    - ipvlan: properly track tx_errors
    - regmap: debugfs: Fix a erroneous check after snprintf()
    - spi: tegra: Fix missing IRQ check in tegra_slink_probe()
    - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies
    - clk: qcom: mmcc-msm8998: Don't check halt bit on some branch clks
    - clk: qcom: mmcc-msm8998: Fix the SMMU GDSC
    - clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src
    - clk: imx: Select MXC_CLK for CLK_IMX8QXP
    - clk: imx: imx8mq: correct error handling path
    - clk: imx: imx8qxp: Fix elcdif_pll clock
    - clk: renesas: rzg2l: Simplify multiplication/shift logic
    - clk: renesas: rzg2l: Use FIELD_GET() for PLL register fields
    - clk: renesas: rzg2l: Fix computation formula
    - spi: nxp-fspi: use the correct ioremap function
    - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks
    - clk: ti: Add ti_dt_clk_name() helper to use clock-output-names
    - clk: ti: Update pll and clockdomain clocks to use ti_dt_clk_name()
    - clk: ti: Update component clocks to use ti_dt_clk_name()
    - clk: ti: change ti_clk_register[_omap_hw]() API
    - clk: ti: fix double free in of_ti_divider_clk_setup()
    - clk: npcm7xx: Fix incorrect kfree
    - clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
    - clk: qcom: config IPQ_APSS_6018 should depend on QCOM_SMEM
    - platform/x86: wmi: Fix probe failure when failing to register WMI devices
    - platform/x86: wmi: remove unnecessary initializations
    - platform/x86: wmi: Fix opening of char device
    - hwmon: (axi-fan-control) Fix possible NULL pointer dereference
    - hwmon: (coretemp) Fix potentially truncated sysfs attribute name
    - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs
    - drm/rockchip: vop: Fix call to crtc reset helper
    - drm/radeon: possible buffer overflow
    - drm/mipi-dsi: Create devm device registration
    - drm/mipi-dsi: Create devm device attachment
    - drm/bridge: lt8912b: Switch to devm MIPI-DSI helpers
    - drm/bridge: lt8912b: Register and attach our DSI device at probe
    - drm/bridge: lt8912b: Add hot plug detection
    - drm/bridge: lt8912b: Fix bridge_detach
    - drm/bridge: lt8912b: Fix crash on bridge detach
    - drm/bridge: lt8912b: Manually disable HPD only if it was enabled
    - drm/bridge: lt8912b: Add missing drm_bridge_attach call
    - drm/bridge: tc358768: Fix use of uninitialized variable
    - drm/bridge: tc358768: Disable non-continuous clock mode
    - drm/bridge: tc358768: Fix bit updates
    - drm/amdkfd: fix some race conditions in vram buffer alloc/free of svm code
    - drm/mediatek: Fix iommu fault by swapping FBs after updating plane state
    - drm/mediatek: Fix iommu fault during crtc enabling
    - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe()
    - arm64/arm: xen: enlighten: Fix KPTI checks
    - drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map()
    - xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled
    - drm/msm/dsi: use msm_gem_kernel_put to free TX buffer
    - drm: mediatek: mtk_dsi: Fix NO_EOT_PACKET settings/handling
    - perf: hisi: Fix use-after-free when register pmu fails
    - ARM: dts: renesas: blanche: Fix typo in GP_11_2 pin name
    - arm64: dts: qcom: msm8916: Fix iommu local address range
    - arm64: dts: qcom: msm8992-libra: drop duplicated reserved memory
    - arm64: dts: qcom: sc7280: Add missing LMH interrupts
    - arm64: dts: qcom: sdm845-mtp: fix WiFi configuration
    - ARM64: dts: marvell: cn9310: Use appropriate label for spi1 pins
    - arm64: dts: qcom: apq8016-sbc: Add missing ADV7533 regulators
    - ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator
    - soc: qcom: llcc: Handle a second device without data corruption
    - firmware: ti_sci: Mark driver as non removable
    - firmware: arm_ffa: Assign the missing IDR allocation ID to the FFA device
    - clk: scmi: Free scmi_clk allocated when the clocks with invalid info are
      skipped
    - arm64: dts: imx8qm-ss-img: Fix jpegenc compatible entry
    - arm64: dts: imx8mm: Add sound-dai-cells to micfil node
    - arm64: dts: imx8mn: Add sound-dai-cells to micfil node
    - selftests/pidfd: Fix ksft print formats
    - selftests/resctrl: Ensure the benchmark commands fits to its array
    - crypto: hisilicon/hpre - Fix a erroneous check after snprintf()
    - hwrng: geode - fix accessing registers
    - RDMA/core: Use size_{add,sub,mul}() in calls to struct_size()
    - scsi: ibmvfc: Fix erroneous use of rtas_busy_delay with hcall return code
    - libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return
      value
    - nd_btt: Make BTT lanes preemptible
    - crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure
    - crypto: caam/jr - fix Chacha20 + Poly1305 self test failure
    - crypto: qat - increase size of buffers
    - hid: cp2112: Fix duplicate workqueue initialization
    - ARM: 9321/1: memset: cast the constant byte to unsigned char
    - ext4: move 'ix' sanity check to corrent position
    - ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not
      described
    - IB/mlx5: Fix rdma counter binding for RAW QP
    - RDMA/hns: Fix uninitialized ucmd in hns_roce_create_qp_common()
    - RDMA/hns: Fix signed-unsigned mixed comparisons
    - RDMA/hns: The UD mode can only be configured with DCQCN
    - ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe
    - scsi: ufs: core: Leave space for '\0' in utf8 desc string
    - RDMA/hfi1: Workaround truncation compilation error
    - hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip
    - sh: bios: Revive earlyprintk support
    - Revert "HID: logitech-hidpp: add a module parameter to keep firmware
      gestures"
    - HID: logitech-hidpp: Remove HIDPP_QUIRK_NO_HIDINPUT quirk
    - HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only
    - HID: logitech-hidpp: Revert "Don't restart communication if not necessary"
    - HID: logitech-hidpp: Move get_wireless_feature_index() check to
      hidpp_connect_event()
    - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails
    - padata: Fix refcnt handling in padata_free_shell()
    - crypto: qat - fix deadlock in backlog processing
    - ASoC: ams-delta.c: use component after check
    - mfd: core: Un-constify mfd_cell.of_reg
    - mfd: core: Ensure disabled devices are skipped without aborting
    - mfd: dln2: Fix double put in dln2_probe
    - mfd: arizona-spi: Set pdata.hpdet_channel for ACPI enumerated devs
    - leds: turris-omnia: Drop unnecessary mutex locking
    - leds: turris-omnia: Do not use SMBUS calls
    - leds: pwm: Don't disable the PWM when the LED should be off
    - leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu'
    - f2fs: compress: fix to avoid use-after-free on dic
    - f2fs: compress: fix to avoid redundant compress extension
    - tty: tty_jobctrl: fix pid memleak in disassociate_ctty()
    - livepatch: Fix missing newline character in klp_resolve_symbols()
    - dmaengine: idxd: Register dsa_bus_type before registering idxd sub-drivers
    - usb: dwc2: fix possible NULL pointer dereference caused by driver
      concurrency
    - usb: chipidea: Fix DMA overwrite for Tegra
    - usb: chipidea: Simplify Tegra DMA alignment code
    - dmaengine: ti: edma: handle irq_of_parse_and_map() errors
    - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave()
    - tools: iio: iio_generic_buffer ensure alignment
    - USB: usbip: fix stub_dev hub disconnect
    - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc()
    - f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()
    - powerpc: Only define __parse_fpscr() when required
    - modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host
    - powerpc/40x: Remove stale PTE_ATOMIC_UPDATES macro
    - powerpc/xive: Fix endian conversion size
    - powerpc/imc-pmu: Use the correct spinlock initializer.
    - powerpc/pseries: fix potential memory leak in init_cpu_associativity()
    - usb: host: xhci-plat: fix possible kernel oops while resuming
    - perf machine: Avoid out of bounds LBR memory read
    - perf hist: Add missing puts to hist__account_cycles
    - 9p/net: fix possible memory leak in p9_check_errors()
    - i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs
    - cxl/mem: Fix shutdown order
    - rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call
    - pcmcia: cs: fix possible hung task and memory leak pccardd()
    - pcmcia: ds: fix refcount leak in pcmcia_device_add()
    - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()
    - media: i2c: max9286: Fix some redundant of_node_put() calls
    - media: bttv: fix use after free error due to btv->timeout timer
    - media: s3c-camif: Avoid inappropriate kfree()
    - media: vidtv: psi: Add check for kstrdup
    - media: vidtv: mux: Add check and kfree for kstrdup
    - media: cedrus: Fix clock/reset sequence
    - media: dvb-usb-v2: af9035: fix missing unlock
    - regmap: prevent noinc writes from clobbering cache
    - pwm: sti: Reduce number of allocations and drop usage of chip_data
    - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume
    - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
    - llc: verify mac len before reading mac header
    - hsr: Prevent use after free in prp_create_tagged_frame()
    - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
    - bpf: Check map->usercnt after timer->timer is assigned
    - inet: shrink struct flowi_common
    - octeontx2-pf: Fix error codes
    - octeontx2-pf: Fix holes in error code
    - dccp: Call security_inet_conn_request() after setting IPv4 addresses.
    - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
    - Fix termination state for idr_for_each_entry_ul()
    - net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs
    - selftests: pmtu.sh: fix result checking
    - net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT
    - net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc
    - net/smc: put sk reference if close work was canceled
    - tg3: power down device only on SYSTEM_POWER_OFF
    - block: remove unneeded return value of bio_check_ro()
    - blk-core: use pr_warn_ratelimited() in bio_check_ro()
    - r8169: respect userspace disabling IFF_MULTICAST
    - i2c: iproc: handle invalid slave state
    - netfilter: xt_recent: fix (increase) ipv6 literal buffer length
    - netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate
      eval call-backs
    - netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
    - drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE
    - ASoC: hdmi-codec: register hpd callback on component probe
    - spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies
    - fbdev: imsttfb: Fix error path of imsttfb_probe()
    - fbdev: imsttfb: fix a resource leak in probe
    - fbdev: fsl-diu-fb: mark wr_reg_wa() static
    - tracing/kprobes: Fix the order of argument descriptions
    - btrfs: use u64 for buffer sizes in the tree search ioctls
    - Linux 5.15.139
  * Jammy update: v5.15.138 upstream stable release (LP: #2049417)
    - ASoC: codecs: wcd938x: fix resource leaks on bind errors
    - ASoC: codecs: wcd938x: fix runtime PM imbalance on remove
    - pinctrl: qcom: lpass-lpi: fix concurrent register updates
    - tcp: remove dead code from tcp_sendmsg_locked()
    - tcp: cleanup tcp_remove_empty_skb() use
    - mptcp: more conservative check for zero probes
    - mcb: Return actual parsed size when reading chameleon table
    - mcb-lpc: Reallocate memory region to avoid memory overlapping
    - virtio_balloon: Fix endless deflation and inflation on arm64
    - virtio-mmio: fix memory leak of vm_dev
    - vhost: Allow null msg.size on VHOST_IOTLB_INVALIDATE
    - mm/page_alloc: correct start page when guard page debug is enabled
    - mm/migrate: fix do_pages_move for compat pointers
    - nfsd: lock_rename() needs both directories to live on the same fs
    - drm/i915/pmu: Check if pmu is closed before stopping event
    - vsock/virtio: factor our the code to initialize and delete VQs
    - vsock/virtio: add support for device suspend/resume
    - vsock/virtio: initialize the_virtio_vsock before using VQs
    - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
    - firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()
    - r8169: fix the KCSAN reported data-race in rtl_tx() while reading tp->cur_tx
    - r8169: fix the KCSAN reported data-race in rtl_tx while reading
      TxDescArray[entry].opts1
    - r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
    - i40e: Fix I40E_FLAG_VF_VLAN_PRUNING value
    - treewide: Spelling fix in comment
    - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
    - neighbour: fix various data-races
    - igc: Fix ambiguity in the ethtool advertising
    - net: ieee802154: adf7242: Fix some potential buffer overflow in
      adf7242_stats_show()
    - net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
    - r8152: Increase USB control msg timeout to 5000ms as per spec
    - r8152: Run the unload routine if we have errors during probe
    - r8152: Cancel hw_phy_work if we have an error in probe
    - r8152: Release firmware if we have an error in probe
    - tcp: fix wrong RTO timeout when received SACK reneging
    - gtp: uapi: fix GTPA_MAX
    - gtp: fix fragmentation needed check with gso
    - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
    - kasan: print the original fault addr when access invalid shadow
    - iio: exynos-adc: request second interupt only when touchscreen mode is used
    - iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds
    - iio: adc: xilinx-xadc: Correct temperature offset/scale for UltraScale
    - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
    - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
    - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
    - i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
    - i2c: aspeed: Fix i2c bus hang in slave read
    - tracing/kprobes: Fix the description of variable length arguments
    - misc: fastrpc: Clean buffers on remote invocation failures
    - nvmem: imx: correct nregs for i.MX6ULL
    - nvmem: imx: correct nregs for i.MX6SLL
    - nvmem: imx: correct nregs for i.MX6UL
    - perf/core: Fix potential NULL deref
    - sparc32: fix a braino in fault handling in csum_and_copy_..._user()
    - clk: Sanitize possible_parent_show to Handle Return Value of
      of_clk_get_parent_name
    - iio: afe: rescale: reorder includes
    - iio: afe: rescale: expose scale processing function
    - iio: afe: rescale: add offset support
    - iio: afe: rescale: Accept only offset channels
    - gve: Fix GFP flags when allocing pages
    - x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
    - x86/mm: Simplify RESERVE_BRK()
    - x86/mm: Fix RESERVE_BRK() for older binutils
    - ext4: add two helper functions extent_logical_end() and pa_logical_end()
    - ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
    - ext4: avoid overlapping preallocations due to overflow
    - objtool/x86: add missing embedded_insn check
    - driver: platform: Add helper for safer setting of driver_override
    - rpmsg: Constify local variable in field store macro
    - rpmsg: Fix kfree() of static memory on setting driver_override
    - rpmsg: Fix calling device_lock() on non-initialized device
    - rpmsg: glink: Release driver_override
    - rpmsg: Fix possible refcount leak in rpmsg_register_device_override()
    - x86: Fix .brk attribute in linker script
    - ASoC: simple-card: fixup asoc_simple_probe() error handling
    - net: sched: cls_u32: Fix allocation size in u32_init()
    - irqchip/riscv-intc: Mark all INTC nodes as initialized
    - irqchip/stm32-exti: add missing DT IRQ flag translation
    - dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
    - powerpc/85xx: Fix math emulation exception
    - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
    - fbdev: atyfb: only use ioremap_uc() on i386 and ia64
    - fs/ntfs3: Add ckeck in ni_update_parent()
    - fs/ntfs3: Write immediately updated ntfs state
    - fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN)
    - fs/ntfs3: Fix possible NULL-ptr-deref in ni_readpage_cmpr()
    - fs/ntfs3: Fix NULL pointer dereference on error in attr_allocate_frame()
    - fs/ntfs3: Fix directory element type detection
    - fs/ntfs3: Avoid possible memory leak
    - spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
    - netfilter: nfnetlink_log: silence bogus compiler warning
    - ASoC: rt5650: fix the wrong result of key button
    - drm/ttm: Reorder sys manager cleanup step
    - fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
    - scsi: mpt3sas: Fix in error path
    - platform/mellanox: mlxbf-tmfifo: Fix a warning message
    - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
    - r8152: Check for unplug in rtl_phy_patch_request()
    - r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en()
    - powerpc/mm: Fix boot crash with FLATMEM
    - can: isotp: set max PDU size to 64 kByte
    - can: isotp: isotp_bind(): return -EINVAL on incorrect CAN ID formatting
    - can: isotp: check CAN address family in isotp_bind()
    - can: isotp: handle wait_event_interruptible() return values
    - can: isotp: add local echo tx processing and tx without FC
    - can: isotp: isotp_bind(): do not validate unused address information
    - can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior
    - drm/amd: Move helper for dynamic speed switch check out of smu13
    - drm/amd: Disable ASPM for VI w/ all Intel systems
    - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
    - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top"
      compatibility
    - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
    - usb: raw-gadget: properly handle interrupted requests
    - tty: n_gsm: fix race condition in status line change on dead connections
    - tty: 8250: Remove UC-257 and UC-431
    - tty: 8250: Add support for additional Brainboxes UC cards
    - tty: 8250: Add support for Brainboxes UP cards
    - tty: 8250: Add support for Intashield IS-100
    - tty: 8250: Fix port count of PX-257
    - tty: 8250: Fix up PX-803/PX-857
    - tty: 8250: Add support for additional Brainboxes PX cards
    - tty: 8250: Add support for Intashield IX cards
    - tty: 8250: Add Brainboxes Oxford Semiconductor-based quirks
    - misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
    - ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
    - Linux 5.15.138
  * Jammy update: v5.15.137 upstream stable release (LP: #2049350)
    - lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default
    - Documentation: sysctl: align cells in second content column
    - xfs: don't expose internal symlink metadata buffers to the vfs
    - Bluetooth: hci_event: Ignore NULL link key
    - Bluetooth: Reject connection with the device which has same BD_ADDR
    - Bluetooth: Fix a refcnt underflow problem for hci_conn
    - Bluetooth: vhci: Fix race when opening vhci device
    - Bluetooth: hci_event: Fix coding style
    - Bluetooth: avoid memcmp() out of bounds warning
    - ice: fix over-shifted variable
    - ice: reset first in crash dump kernels
    - nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
    - regmap: fix NULL deref on lookup
    - KVM: x86: Mask LVTPC when handling a PMI
    - tcp: check mptcp-level constraints for backlog coalescing
    - fs/ntfs3: Fix possible null-pointer dereference in hdr_find_e()
    - fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea()
    - fs/ntfs3: fix deadlock in mark_as_free_ex
    - netfilter: nft_payload: fix wrong mac header matching
    - drm/i915: Retry gtt fault when out of fence registers
    - ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind
    - ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors
    - ASoC: codecs: wcd938x: drop bogus bind error handling
    - ASoC: codecs: wcd938x: fix unbind tear down order
    - qed: fix LL2 RX buffer allocation
    - xfrm: fix a data-race in xfrm_gen_index()
    - xfrm: interface: use DEV_STATS_INC()
    - net: ipv4: fix return value check in esp_remove_trailer
    - net: ipv6: fix return value check in esp_remove_trailer
    - net: rfkill: gpio: prevent value glitch during probe
    - tcp: fix excessive TLP and RACK timeouts from HZ rounding
    - tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb
    - tun: prevent negative ifindex
    - ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
    - net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
    - i40e: prevent crash on probe if hw registers have invalid values
    - net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register()
    - bonding: Return pointer to data after pull on skb
    - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
    - neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section
    - netfilter: nft_set_rbtree: .deactivate fails if element has expired
    - netfilter: nf_tables: do not remove elements if set backend implements
      .abort
    - netfilter: nf_tables: revert do not remove elements if set backend
      implements .abort
    - net: pktgen: Fix interface flags printing
    - selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and
      hugetlb_reparenting_test.sh that may cause error
    - serial: 8250: omap: Fix imprecise external abort for omap_8250_pm()
    - serial: 8250_omap: Fix errors with no_console_suspend
    - iio: Un-inline iio_buffer_enabled()
    - iio: core: Hide read accesses to iio_dev->currentmode
    - iio: core: introduce iio_device_{claim|release}_buffer_mode() APIs
    - iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()
    - iio: adc: ad7192: Correct reference voltage
    - perf: Add irq and exception return branch types
    - perf/x86: Move branch classifier
    - perf/x86/lbr: Filter vsyscall addresses
    - drm/atomic-helper: relax unregistered connector check
    - powerpc/32s: Remove capability to disable KUEP at boottime
    - powerpc/32s: Do kuep_lock() and kuep_unlock() in assembly
    - powerpc/47x: Fix 47x syscall return crash
    - mctp: Allow local delivery to the null EID
    - mctp: perform route lookups under a RCU read-side lock
    - nfp: flower: avoid rmmod nfp crash issues
    - ksmbd: not allow to open file if delelete on close bit is set
    - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
    - fs-writeback: do not requeue a clean inode having skipped pages
    - btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1
    - btrfs: initialize start_slot in btrfs_log_prealloc_extents
    - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
    - overlayfs: set ctime when setting mtime and atime
    - gpio: timberdale: Fix potential deadlock on &tgpio->lock
    - ata: libata-core: Fix compilation warning in ata_dev_config_ncq()
    - ata: libata-eh: Fix compilation warning in ata_eh_link_report()
    - tracing: relax trace_event_eval_update() execution with cond_resched()
    - wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
    - wifi: iwlwifi: Ensure ack flag is properly cleared.
    - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
    - Bluetooth: btusb: add shutdown function for QCA6174
    - Bluetooth: Avoid redundant authentication
    - Bluetooth: hci_core: Fix build warnings
    - wifi: cfg80211: Fix 6GHz scan configuration
    - wifi: mac80211: allow transmitting EAPOL frames with tainted key
    - wifi: cfg80211: avoid leaking stack data into trace
    - regulator/core: Revert "fix kobject release warning and memory leak in
      regulator_register()"
    - sky2: Make sure there is at least one frag_addr available
    - ipv4/fib: send notify when delete source address routes
    - drm: panel-orientation-quirks: Add quirk for One Mix 2S
    - btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
    - btrfs: error out when COWing block using a stale transaction
    - btrfs: error when COWing block from a root that is being deleted
    - btrfs: error out when reallocating block for defrag using a stale
      transaction
    - HID: multitouch: Add required quirk for Synaptics 0xcd7e device
    - platform/x86: touchscreen_dmi: Add info for the Positivo C4128B
    - net/mlx5: Handle fw tracer change ownership event based on MTRC
    - Bluetooth: hci_event: Fix using memcmp when comparing keys
    - net: introduce a function to check if a netdev name is in use
    - net: move from strlcpy with unused retval to strscpy
    - net: fix ifname in netlink ntf during netns move
    - mtd: rawnand: qcom: Unmap the right resource upon probe failure
    - mtd: rawnand: pl353: Ensure program page operations are successful
    - mtd: rawnand: marvell: Ensure program page operations are successful
    - mtd: rawnand: arasan: Ensure program page operations are successful
    - mtd: spinand: micron: correct bitmask for ecc status
    - mtd: physmap-core: Restore map_rom fallback
    - mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw
    - mmc: core: sdio: hold retuning if sdio in 1-bit mode
    - pNFS: Fix a hang in nfs4_evict_inode()
    - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server
    - ACPI: irq: Fix incorrect return value in acpi_register_gsi()
    - nvme-pci: add BOGUS_NID for Intel 0a54 device
    - nvme-rdma: do not try to stop unallocated queues
    - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
    - USB: serial: option: add entry for Sierra EM9191 with new firmware
    - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
    - s390/pci: fix iommu bitmap allocation
    - selftests/ftrace: Add new test case which checks non unique symbol
    - s390/cio: fix a memleak in css_alloc_subchannel
    - platform/surface: platform_profile: Propagate error if profile registration
      fails
    - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
    - platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events
    - gpio: vf610: set value before the direction to avoid a glitch
    - ASoC: pxa: fix a memory leak in probe()
    - serial: 8250: omap: Move uart_write() inside PM section
    - phy: mapphone-mdm6600: Fix runtime disable on probe
    - phy: mapphone-mdm6600: Fix runtime PM for remove
    - phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins
    - Bluetooth: hci_sock: fix slab oob read in create_monitor_event
    - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
    - xfrm6: fix inet6_dev refcount underflow problem
    - Linux 5.15.137
  * CVE-2023-51782
    - net/rose: Fix Use-After-Free in rose_ioctl
  * CVE-2023-51779
    - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
  * CVE-2023-22995
    - usb: dwc3: dwc3-qcom: Add missing platform_device_put() in
      dwc3_qcom_acpi_register_core
  * CVE-2023-4134
    - Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync()
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts

 -- Jian Hui Lee <email address hidden>  Wed, 15 May 2024 18:15:38 +0800