Kinetic update: v5.18.2 upstream stable release

[Andrea Righi]

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v5.18.2 upstream stable release
       from git://git.kernel.org/

Linux 5.18.2
ALSA: usb-audio: Optimize TEAC clock quirk
bpf: Do write access check for kfunc and global func
bpf: Check PTR_TO_MEM | MEM_RDONLY in check_helper_mem_access
bpf: Reject writes for PTR_TO_MAP_KEY in check_helper_mem_access
bpf: Fix excessive memory allocation in stack_map_alloc()
bpf: Fix usage of trace RCU in local storage.
bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes
bpf: Fix combination of jit blinding and pointers to bpf subprogs.
bpf: Fix potential array overflow in bpf_trampoline_get_progs()
bpf: Fill new bpf_prog_pack with illegal instructions
NFSD: Fix possible sleep during nfsd4_release_lockowner()
NFS: Memory allocation failures are not server fatal errors
docs: submitting-patches: Fix crossref to 'The canonical patch format'
tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe()
tpm: Fix buffer access in tpm2_get_tpm_pt()
media: i2c: imx412: Fix power_off ordering
media: i2c: imx412: Fix reset GPIO polarity
x86/sgx: Ensure no data in PCMD page after truncate
x86/sgx: Fix race between reclaimer and page fault handler
x86/sgx: Obtain backing storage page with enclave mutex held
x86/sgx: Mark PCMD page as dirty when modifying contents
x86/sgx: Disconnect backing page references from dirty status
HID: multitouch: add quirks to enable Lenovo X12 trackpoint
HID: multitouch: Add support for Google Whiskers Touchpad
fs/ntfs3: validate BOOT sectors_per_clusters
raid5: introduce MD_BROKEN
dm verity: set DM_TARGET_IMMUTABLE feature flag
dm stats: add cond_resched when looping over entries
dm crypt: make printing of the key constant-time
dm integrity: fix error code in dm_integrity_ctr()
ARM: dts: s5pv210: Correct interrupt name for bluetooth in Aries
Bluetooth: hci_qca: Use del_timer_sync() before freeing
ALSA: usb-audio: Configure sync endpoints before data
ALSA: usb-audio: Add missing ep_idx in fixed EP quirks
ALSA: usb-audio: Workaround for clock setup on TEAC devices
tools/memory-model/README: Update klitmus7 compat table
zsmalloc: fix races between asynchronous zspage free and page migration
crypto: qat - rework the VF2PF interrupt handling logic
crypto: ecrdsa - Fix incorrect use of vli_cmp
crypto: caam - fix i.MX6SX entropy delay value
KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak
KVM: x86/mmu: Don't rebuild page when the page is synced and no tlb flushing is required
KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2
KVM: x86: Fix the intel_pt PMI handling wrongly considered from guest
KVM: x86: avoid loading a vCPU after .vm_destroy was called
KVM: x86: avoid calling x86 emulator without a decoded instruction
KVM: x86: fix typo in __try_cmpxchg_user causing non-atomicness
KVM: x86: Use __try_cmpxchg_user() to emulate atomic accesses
KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits
x86/uaccess: Implement macros for CMPXCHG on user addresses
x86, kvm: use correct GFP flags for preemption disabled
x86/kvm: Alloc dummy async #PF token outside of raw spinlock
x86/fpu: KVM: Set the base guest FPU uABI size to sizeof(struct kvm_xsave)
KVM: PPC: Book3S HV: fix incorrect NULL check on list iterator
netfilter: conntrack: re-fetch conntrack after insertion
netfilter: nf_tables: double hook unregistration in netns path
netfilter: nf_tables: hold mutex on netns pre_exit path
netfilter: nf_tables: sanitize nft_set_desc_concat_parse()
netfilter: nft_limit: Clone packet limits' cost value
exfat: check if cluster num is valid
drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
net: ipa: compute proper aggregation limit
pipe: Fix missing lock in pipe_resize_ring()
pipe: make poll_usage boolean and annotate its access
assoc_array: Fix BUG_ON during garbage collect
i2c: ismt: prevent memory corruption in ismt_access()
netfilter: nf_tables: disallow non-stateful expression in sets earlier