Impish update: upstream stable patchset 2021-11-22

[Kamal Mostafa]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       upstream stable patchset 2021-11-22

                Ported from the following upstream stable releases:
                        v5.10.74, v5.14.13
                        v5.10.75, v5.14.14
                        v5.10.76, v5.14.15

       from git://git.kernel.org/

ext4: check and update i_disksize properly
ext4: correct the error path of ext4_write_inline_data_end()
ASoC: Intel: sof_sdw: tag SoundWire BEs as non-atomic
HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS
netfilter: ip6_tables: zero-initialize fragment offset
HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs
ASoC: SOF: loader: release_firmware() on load failure to avoid batching
netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic
netfilter: nf_nat_masquerade: defer conntrack walk to work queue
mac80211: Drop frames from invalid MAC address in ad-hoc mode
m68k: Handle arrivals of multiple signals correctly
hwmon: (ltc2947) Properly handle errors when looking for the external clock
net: prevent user from passing illegal stab size
mac80211: check return value of rhashtable_init
vboxfs: fix broken legacy mount signature checking
net: sun: SUNVNET_COMMON should depend on INET
drm/amdgpu: fix gart.bo pin_count leak
scsi: ses: Fix unsigned comparison with less than zero
scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
perf/core: fix userpage->time_enabled of inactive events
sched: Always inline is_percpu_thread()
hwmon: (pmbus/ibm-cffps) max_power_out swap changes
ALSA: usb-audio: Unify mixer resume and reset_resume procedure
KVM: arm64: nvhe: Fix missing FORCE for hyp-reloc.S build rule
pinctrl: qcom: sc7280: Add PM suspend callbacks
net: bgmac-platform: handle mac-address deferral
scsi: qla2xxx: Fix excessive messages during device logout
io_uring: kill fasync
UBUNTU: upstream stable to v5.10.74, v5.14.13
ALSA: usb-audio: Add quirk for VF0770
ALSA: pcm: Workaround for a wrong offset in SYNC_PTR compat ioctl
ALSA: seq: Fix a potential UAF by wrong private_free call order
ALSA: hda/realtek: Enable 4-speaker output for Dell Precision 5560 laptop
ALSA: hda - Enable headphone mic on Dell Latitude laptops with ALC3254
ALSA: hda/realtek: Complete partial device name to avoid ambiguity
ALSA: hda/realtek: Add quirk for Clevo X170KM-G
ALSA: hda/realtek - ALC236 headset MIC recording issue
ALSA: hda/realtek: Add quirk for TongFang PHxTxX1
ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW
nds32/ftrace: Fix Error: invalid operands (*UND* and *UND* sections) for `^'
s390: fix strrchr() implementation
clk: socfpga: agilex: fix duplicate s2f_user0_clk
csky: don't let sigreturn play with priveleged bits of status register
csky: Fixup regs.sr broken in ptrace
arm64/hugetlb: fix CMA gigantic page order for non-4K PAGE_SIZE
drm/msm: Avoid potential overflow in timeout_to_jiffies()
btrfs: unlock newly allocated extent buffer after error
btrfs: deal with errors when replaying dir entry during log replay
btrfs: deal with errors when adding inode reference during log replay
btrfs: check for error when looking up inode during dir entry replay
btrfs: update refs for any root except tree log roots
btrfs: fix abort logic in btrfs_replace_file_extents
x86/resctrl: Free the ctrlval arrays when domain_setup_mon_state() fails
mei: me: add Ice Lake-N device id.
USB: xhci: dbc: fix tty registration race
xhci: guard accesses to ep_state in xhci_endpoint_reset()
xhci: Fix command ring pointer corruption while aborting a command
xhci: Enable trust tx length quirk for Fresco FL11 USB controller
cb710: avoid NULL pointer subtraction
efi/cper: use stack buffer for error record decoding
efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock()
usb: musb: dsps: Fix the probe error path
Input: xpad - add support for another USB ID of Nacon GC-100
USB: serial: qcserial: add EM9191 QDL support
USB: serial: option: add Quectel EC200S-CN module support
USB: serial: option: add Telit LE910Cx composition 0x1204
USB: serial: option: add prod. id for Quectel EG91
misc: fastrpc: Add missing lock before accessing find_vma()
virtio: write back F_VERSION_1 before validate
EDAC/armada-xp: Fix output of uncorrectable error counter
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically
powerpc/xive: Discard disabled interrupts in get_irqchip_state()
iio: adc: aspeed: set driver data when adc probe.
drivers: bus: simple-pm-bus: Add support for probing simple bus only devices
driver core: Reject pointless SYNC_STATE_ONLY device links
iio: adc: ad7192: Add IRQ flag
iio: adc: ad7780: Fix IRQ flag
iio: adc: ad7793: Fix IRQ flag
iio: adc128s052: Fix the error handling path of 'adc128_probe()'
iio: adc: max1027: Fix wrong shift with 12-bit devices
iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED
iio: light: opt3001: Fixed timeout error when 0 lux
iio: adc: max1027: Fix the number of max1X31 channels
iio: ssp_sensors: add more range checking in ssp_parse_dataframe()
iio: ssp_sensors: fix error code in ssp_print_mcu_debug()
iio: dac: ti-dac5571: fix an error code in probe()
tee: optee: Fix missing devices unregister during optee_remove
ARM: dts: bcm2711-rpi-4-b: Fix usb's unit address
ARM: dts: bcm2711: fix MDIO #address- and #size-cells
ARM: dts: bcm2711-rpi-4-b: fix sd_io_1v8_reg regulator states
ARM: dts: bcm2711-rpi-4-b: Fix pcie0's unit address formatting
nvme-pci: Fix abort command id
sctp: account stream padding length for reconf chunk
gpio: pca953x: Improve bias setting
net: arc: select CRC32
net: korina: select CRC32
net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path
net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp
net: stmmac: fix get_hw_feature() on old hardware
net: dsa: microchip: Added the condition for scheduling ksz_mib_read_work
net: encx24j600: check error in devm_regmap_init_encx24j600
ethernet: s2io: fix setting mac address during resume
vhost-vdpa: Fix the wrong input in config_cb
nfc: fix error handling of nfc_proto_register()
NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
pata_legacy: fix a couple uninitialized variable bugs
ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators()
mlxsw: thermal: Fix out-of-bounds memory accesses
platform/mellanox: mlxreg-io: Fix argument base in kstrtou32() call
platform/mellanox: mlxreg-io: Fix read access of n-bytes size attributes
spi: bcm-qspi: clear MSPI spifie interrupt during probe
drm/panel: olimex-lcd-olinuxino: select CRC32
drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read
drm/msm: Fix null pointer dereference on pointer edp
drm/msm/mdp5: fix cursor-related warnings
drm/msm/a6xx: Track current ctx by seqno
drm/msm/dsi: Fix an error code in msm_dsi_modeset_init()
drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
acpi/arm64: fix next_platform_timer() section mismatch error
platform/x86: intel_scu_ipc: Fix busy loop expiry time
mqprio: Correct stats in mqprio_dump_class_stats().
qed: Fix missing error code in qed_slowpath_start()
r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256
nfp: flow_offload: move flow_indr_dev_register from app init to app start
net: mscc: ocelot: warn when a PTP IRQ is raised for an unknown skb
ionic: don't remove netdev->dev_addr when syncing uc list
net: dsa: mv88e6xxx: don't use PHY_DETECT on internal PHY's
platform/x86: gigabyte-wmi: add support for B550 AORUS ELITE AX V2
platform/x86: amd-pmc: Add alternative acpi id for PMC controller
mtd: rawnand: qcom: Update code word value for raw read
dm: fix mempool NULL pointer race when completing IO
drm/nouveau/fifo: Reinstate the correct engine bit programming
module: fix clang CFI with MODULE_UNLOAD=n
mei: hbm: drop hbm responses on early shutdown
xhci: add quirk for host controllers that don't update endpoint DCS
virtio-blk: remove unneeded "likely" statements
iio: adis16480: fix devices that do not support sleep mode
iio: adis16475: fix deadlock on frequency set
net/smc: improved fix wait on already cleared link
net/mlx5e: Switchdev representors are not vlan challenged
net: phy: Do not shutdown PHYs in READY state
net: dsa: fix spurious error message when unoffloaded port leaves bridge
drm/msm/submit: fix overflow check on 64-bit architectures
drm/msm/a4xx: fix error handling in a4xx_gpu_init()
drm/msm/a3xx: fix error handling in a3xx_gpu_init()
drm/msm/dsi: dsi_phy_14nm: Take ready-bit into account in poll_for_ready
block/rnbd-clt-sysfs: fix a couple uninitialized variable bugs
net: mscc: ocelot: make use of all 63 PTP timestamp identifiers
net: mscc: ocelot: avoid overflowing the PTP timestamp FIFO
net: mscc: ocelot: deny TX timestamping of non-PTP packets
net: mscc: ocelot: cross-check the sequence id from the timestamp FIFO with the skb PTP header
net: dsa: felix: break at first CPU port during init and teardown
UBUNTU: upstream stable to v5.10.75, v5.14.14
parisc: math-emu: Fix fall-through warnings
arm: dts: vexpress-v2p-ca9: Fix the SMB unit-address
ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default
block: decode QUEUE_FLAG_HCTX_ACTIVE in debugfs output
xen/x86: prevent PVH type from getting clobbered
drm/amdgpu/display: fix dependencies for DRM_AMD_DC_SI
xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF
xtensa: xtfpga: Try software restart before simulating CPU reset
NFSD: Keep existing listeners on portlist error
netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value
dma-debug: fix sg checks in debug_dma_map_sg()
ASoC: wm8960: Fix clock configuration on slave mode
ice: fix getting UDP tunnel entry
netfilter: ip6t_rt: fix rt0_hdr parsing in rt_mt6
netfilter: ipvs: make global sysctl readonly in non-init netns
lan78xx: select CRC32
tcp: md5: Fix overlap between vrf and non-vrf keys
ipv6: When forwarding count rx stats on the orig netdev
net: dsa: lantiq_gswip: fix register definition
NIOS2: irqflags: rename a redefined register name
powerpc/smp: do not decrement idle task preempt count in CPU offline
net: hns3: reset DWRR of unused tc to zero
net: hns3: add limit ets dwrr bandwidth cannot be 0
net: hns3: schedule the polling again when allocation fails
net: hns3: fix vf reset workqueue cannot exit
net: hns3: disable sriov before unload hclge layer
net: stmmac: Fix E2E delay mechanism
e1000e: Fix packet loss on Tiger Lake and later
ice: Add missing E810 device ids
drm/panel: ilitek-ili9881c: Fix sync for Feixin K101-IM2BYL02 panel
net: enetc: fix ethtool counter name for PM0_TERR
can: rcar_can: fix suspend/resume
can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification
can: peak_pci: peak_pci_remove(): fix UAF
can: isotp: isotp_sendmsg(): fix return error on FC timeout on TX path
can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible()
can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer
can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with error length
can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes
ceph: skip existing superblocks that are blocklisted or shut down when mounting
ceph: fix handling of "meta" errors
ocfs2: fix data corruption after conversion from inline format
ocfs2: mount fails with buffer overflow in strlen
userfaultfd: fix a race between writeprotect and exit_mmap()
elfcore: correct reference to CONFIG_UML
ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
ALSA: hda/realtek: Add quirk for Clevo PC50HS
ASoC: DAPM: Fix missing kctl change notifications
audit: fix possible null-pointer dereference in audit_filter_rules
net: dsa: mt7530: correct ds->num_ports
KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()
KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest
powerpc/idle: Don't corrupt back chain when going idle
mm, slub: fix mismatch between reconstructed freelist depth and cnt
mm, slub: fix potential memoryleak in kmem_cache_open()
mm, slub: fix incorrect memcg slab count for bulk free
KVM: nVMX: promptly process interrupts delivered while in guest mode
nfc: nci: fix the UAF of rf_conn_info object
isdn: cpai: check ctr->cnr to avoid array index out of bound
netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
selftests: netfilter: remove stray bash debug line
net: bridge: mcast: use multicast_membership_interval for IGMPv3
drm: mxsfb: Fix NULL pointer dereference crash on unload
net: hns3: fix the max tx size according to user manual
gcc-plugins/structleak: add makefile var for disabling structleak
btrfs: deal with errors when checking if a dir entry exists during log replay
net: stmmac: add support for dwmac 3.40a
ARM: dts: spear3xx: Fix gmac node
isdn: mISDN: Fix sleeping function called from invalid context
platform/x86: intel_scu_ipc: Update timeout value in comment
ALSA: hda: avoid write to STATESTS if controller is in reset
libperf tests: Fix test_stat_cpu
perf/x86/msr: Add Sapphire Rapids CPU support
Input: snvs_pwrkey - add clk handling
scsi: iscsi: Fix set_param() handling
scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()
sched/scs: Reset the shadow stack when idle_task_exit
net: hns3: fix for miscalculation of rx unused desc
scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
can: isotp: isotp_sendmsg(): fix TX buffer concurrent access in isotp_sendmsg()
s390/pci: fix zpci_zdev_put() on reserve
bpf, test, cgroup: Use sk_{alloc,free} for test cases
tracing: Have all levels of checks prevent recursion
e1000e: Separate TGP board type from SPT
selftests: bpf: fix backported ASSERT_FALSE
ARM: 9122/1: select HAVE_FUTEX_CMPXCHG
pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume()
r8152: avoid to resubmit rx immediately
drm/amdgpu: init iommu after amdkfd device init
powerpc/lib: Add helper to check if offset is within conditional branch range
powerpc/bpf: Validate branch ranges
powerpc/security: Add a helper to query stf_barrier type
ASoC: pcm512x: Mend accesses to the I2S_1 and I2S_2 registers
ASoC: fsl_xcvr: Fix channel swap issue with ARC
netfilter: nf_tables: skip netdev events generated on netns removal
ice: Print the api_patch as part of the fw.mgmt.api
sctp: fix transport encap_port update in sctp_vtag_verify
net/sched: act_ct: Fix byte count on fragmented packets
net: dsa: Fix an error handling path in 'dsa_switch_parse_ports_of()'
net: hns3: Add configuration of TM QCN error event
igc: Update I226_K device ID
drm/kmb: Work around for higher system clock
drm/kmb: Remove clearing DPHY regs
drm/kmb: Disable change of plane parameters
drm/kmb: Corrected typo in handle_lcd_irq
drm/kmb: Enable ADV bridge after modeset
net: enetc: make sure all traffic classes can send large frames
blk-cgroup: blk_cgroup_bio_start() should use irq-safe operations on blkg->iostat_cpu
ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring
ucounts: Proper error handling in set_cred_ucounts
KVM: SEV: Flush cache on non-coherent systems before RECEIVE_UPDATE_DATA
KVM: SEV-ES: rename guest_ins_data to sev_pio_data
KVM: SEV-ES: clean up kvm_sev_es_ins/outs
KVM: SEV-ES: keep INS functions together
KVM: SEV-ES: fix length of string I/O
KVM: SEV-ES: go over the sev_pio_data buffer in multiple passes if needed
KVM: SEV-ES: reduce ghcb_sa_len to 32 bits
KVM: x86: leave vcpu->arch.pio.count alone in emulator_pio_in_out
KVM: x86: check for interrupts before deciding whether to exit the fast path
KVM: x86: split the two parts of emulator_pio_in
KVM: x86: remove unnecessary arguments from complete_emulator_pio_in
KVM: SEV-ES: Set guest_state_protected after VMSA update
drm/msm/a6xx: Serialize GMU communication
iio/test-format: build kunit tests without structleak plugin
device property: build kunit tests without structleak plugin
thunderbolt: build kunit tests without structleak plugin
bitfield: build kunit tests without structleak plugin
objtool: Check for gelf_update_rel[a] failures
objtool: Update section header before relocations
platform/x86: intel_scu_ipc: Increase virtual timeout to 10s
spi: Fix deadlock when adding SPI controllers on SPI buses
spi-mux: Fix false-positive lockdep splats
libperf test evsel: Fix build error on !x86 architectures
mm/thp: decrease nr_thps in file's mapping on THP split
drm/kmb: Enable alpha blended second plane
drm/kmb: Limit supported mode to 1080p
autofs: fix wait name hash calculation in autofs_wait()
s390/pci: cleanup resources only if necessary
UBUNTU: upstream stable to v5.10.76, v5.14.15

[Stefan Bader (smb)]

Skipped "virtio: write back F_VERSION_1 before validate" when applying since that already had been applied for bug #1950144.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.13.0-23.23

---------------
linux (5.13.0-23.23) impish; urgency=medium

  * impish/linux: 5.13.0-23.23 -proposed tracker (LP: #1952263)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync update-dkms-versions helper
    - debian/dkms-versions -- update from kernel-versions (main/2021.11.29)

  * CVE-2021-4002
    - hugetlbfs: flush TLBs correctly after huge_pmd_unshare

  * [SRU][I/OEM-5.13/OEM-5.14] Add MAC passthrough support for more Lenovo docks
    (LP: #1951767)
    - net: usb: r8152: Add MAC passthrough support for more Lenovo Docks

  * Fix non-working e1000e device after resume (LP: #1951861)
    - SAUCE: Revert "e1000e: Additional PHY power saving in S0ix"
    - SAUCE: Revert "e1000e: Add polling mechanism to indicate CSME DPG exit"
    - SAUCE: Revert "e1000e: Add handshake with the CSME to support S0ix"

  * CVE-2021-43267
    - tipc: fix size validations for the MSG_CRYPTO type

  * Impish update: upstream stable patchset 2021-11-22 (LP: #1951880)
    - ext4: check and update i_disksize properly
    - ext4: correct the error path of ext4_write_inline_data_end()
    - ASoC: Intel: sof_sdw: tag SoundWire BEs as non-atomic
    - HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS
    - netfilter: ip6_tables: zero-initialize fragment offset
    - HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs
    - ASoC: SOF: loader: release_firmware() on load failure to avoid batching
    - netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic
    - netfilter: nf_nat_masquerade: defer conntrack walk to work queue
    - mac80211: Drop frames from invalid MAC address in ad-hoc mode
    - m68k: Handle arrivals of multiple signals correctly
    - hwmon: (ltc2947) Properly handle errors when looking for the external clock
    - net: prevent user from passing illegal stab size
    - mac80211: check return value of rhashtable_init
    - vboxfs: fix broken legacy mount signature checking
    - net: sun: SUNVNET_COMMON should depend on INET
    - drm/amdgpu: fix gart.bo pin_count leak
    - scsi: ses: Fix unsigned comparison with less than zero
    - scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
    - perf/core: fix userpage->time_enabled of inactive events
    - sched: Always inline is_percpu_thread()
    - hwmon: (pmbus/ibm-cffps) max_power_out swap changes
    - ALSA: usb-audio: Unify mixer resume and reset_resume procedure
    - KVM: arm64: nvhe: Fix missing FORCE for hyp-reloc.S build rule
    - pinctrl: qcom: sc7280: Add PM suspend callbacks
    - net: bgmac-platform: handle mac-address deferral
    - scsi: qla2xxx: Fix excessive messages during device logout
    - io_uring: kill fasync
    - upstream stable to v5.10.74, v5.14.13
    - ALSA: usb-audio: Add quirk for VF0770
    - ALSA: pcm: Workaround for a wrong offset in SYNC_PTR compat ioctl
    - ALSA: seq: Fix a potential UAF by wrong private_free call order
    - ALSA: hda/realtek: Enable 4-speaker output for Dell Precision 5560 laptop
    - ALSA: hda - Enable headphone mic on Dell Latitude laptops with ALC3254
    - ALSA: hda/realtek: Complete partial device nam...