Jammy update: v5.17.15 upstream stable release

[Paolo Pisati]

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v5.17.15 upstream stable release
       from git://git.kernel.org/

Linux 5.17.15
xsk: Fix possible crash when multiple sockets are created
net/mlx5: E-Switch, pair only capable devices
tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
dmaengine: idxd: add missing callback function to support DMA_INTERRUPT
iov_iter: fix build issue due to possible type mis-match
zonefs: fix handling of explicit_open option on mount
PCI: qcom: Fix pipe clock imbalance
block, loop: support partitions without scanning
net/sched: act_police: more accurate MTU policing
md/raid0: Ignore RAID0 layout if the second zone has only one device
random: account for arch randomness in bits
random: mark bootloader randomness code as __init
random: avoid checking crng_ready() twice in random_init()
drm/ast: Create threshold values for AST2600
powerpc/32: Fix overread/overwrite of thread_struct via ptrace
virtio-rng: make device ready before making request
drm/amdgpu: update VCN codec support for Yellow Carp
drm/amdgpu/jpeg2: Add jpeg vmid update under IB submit
drm/atomic: Force bridge self-refresh-exit on CRTC switch
drm/bridge: analogix_dp: Support PSR-exit to disable transition
powerpc: Don't select HAVE_IRQ_EXIT_ON_IRQ_STACK
mm/huge_memory: Fix xarray node memory leak
cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE
vduse: Fix NULL pointer dereference on sysfs access
Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
ixgbe: fix unexpected VLAN Rx in promisc mode on VF
ixgbe: fix bcast packets Rx on VF after promisc removal
nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION
nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION
writeback: Fix inode->i_io_list not be protected by inode->i_lock error
net: openvswitch: fix misuse of the cached connection on tuple changes
net: phy: dp83867: retrigger SGMII AN when link change
mmc: block: Fix CQE recovery reset success
ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
libata: fix translation of concurrent positioning ranges
libata: fix reading concurrent positioning ranges log
KEYS: trusted: tpm2: Fix migratable logic
scsi: sd: Fix interpretation of VPD B9h length
cifs: populate empty hostnames for extra channels
cifs: fix reconnect on smb3 mount types
cifs: return errors during session setup during reconnects
ALSA: hda/realtek: Add quirk for HP Dev One
ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021
ALSA: hda/conexant - Fix loopback issue with CX20632
ALSA: usb-audio: Set up (implicit) sync for Saffire 6
ALSA: usb-audio: Skip generic sync EP parse for secondary EP
platform/x86: hp-wmi: Use zero insize parameter only when supported
platform/x86: hp-wmi: Fix hp_wmi_read_int() reporting error (0x05)
scripts/gdb: change kernel config dumping method
platform/x86: barco-p50-gpio: Add check for platform_driver_register
vringh: Fix loop descriptors check in the indirect cases
nodemask: Fix return values to be unsigned
drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate
cifs: version operations for smb20 unneeded when legacy support disabled
s390/gmap: voluntarily schedule during key setting
Revert "PCI: brcmstb: Split brcm_pcie_setup() into two funcs"
Revert "PCI: brcmstb: Add mechanism to turn on subdev regulators"
Revert "PCI: brcmstb: Add control of subdevice voltage regulators"
Revert "PCI: brcmstb: Do not turn off WOL regulators on suspend"
nbd: fix io hung while disconnecting device
nbd: fix race between nbd_alloc_config() and module removal
nbd: call genl_unregister_family() first in nbd_cleanup()
jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds
x86/cpu: Elide KCSAN for cpu_has() and friends
modpost: fix undefined behavior of is_arm_mapping_symbol()
um: line: Use separate IRQs per line
drm/amd/pm: Fix missing thermal throttler status
drm/amd/pm: fix a potential gpu_metrics_table memory leak
drm/radeon: fix a possible null pointer dereference
drm/amd/display: Check if modulo is 0 before dividing.
net, neigh: Set lower cap for neigh_managed_work rearming
ceph: flush the mdlog for filesystem sync
ceph: allow ceph.dir.rctime xattr to be updatable
Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"
ASoC: rt5640: Do not manipulate pin "Platform Clock" if the "Platform Clock" is not in the DAPM
scsi: myrb: Fix up null pointer access on myrb_cleanup()
md: protect md_unregister_thread from reentrancy
ksmbd: smbd: fix connection dropped issue
watchdog: wdat_wdt: Stop watchdog when rebooting the system
kernfs: Separate kernfs_pr_cont_buf and rename_lock.
serial: msm_serial: disable interrupts in __msm_console_write()
staging: rtl8712: fix uninit-value in r871xu_drv_init()
staging: rtl8712: fix uninit-value in usb_read8() and friends
clocksource/drivers/sp804: Avoid error on multiple instances
extcon: Modify extcon device to be created after driver data is set
extcon: Fix extcon_get_extcon_dev() error handling
misc: rtsx: set NULL intfdata when probe fails
soundwire: qcom: adjust autoenumeration timeout
usb: dwc3: host: Stop setting the ACPI companion
usb: dwc2: gadget: don't reset gadget's driver->bus
sysrq: do not omit current cpu when showing backtrace of all active CPUs
char: xillybus: fix a refcount leak in cleanup_dev()
USB: hcd-pci: Fully suspend across freeze/thaw cycle
drivers: usb: host: Fix deadlock in oxu_bus_suspend()
drivers: tty: serial: Fix deadlock in sa1100_set_termios()
USB: host: isp116x: check return value after calling platform_get_resource()
drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
thunderbolt: Use different lane for second DisplayPort tunnel
tty: Fix a possible resource leak in icom_probe
tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()
drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()
lkdtm/usercopy: Expand size of "out of frame" object
iio: st_sensors: Add a local lock for protecting odr
staging: rtl8712: fix a potential memory leak in r871xu_drv_init()
iio: dummy: iio_simple_dummy: check the return value of kstrdup()
iov_iter: Fix iter_xarray_get_pages{,_alloc}()
nfp: flower: restructure flow-key for gre+vlan combination
drm: imx: fix compiler warning with gcc-12
tcp: use alloc_large_system_hash() to allocate table_perturb
net: dsa: mv88e6xxx: use BMSR_ANEGCOMPLETE bit for filling an_complete
net: altera: Fix refcount leak in altera_tse_mdio_create
ip_gre: test csum_start instead of transport header
net/mlx5: fs, fail conflicting actions
net/mlx5: Rearm the FW tracer after each tracer event
net/mlx5: Fix mlx5_get_next_dev() peer device matching
net/mlx5: Lag, filter non compatible devices
net: ipv6: unexport __init-annotated seg6_hmac_init()
net: xfrm: unexport __init-annotated xfrm4_protocol_init()
net: mdio: unexport __init-annotated mdio_bus_init()
SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()
xsk: Fix handling of invalid descriptors in XSK TX batching API
i40e: xsk: Move tmp desc array from driver to pool
net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure
net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list
bpf, arm64: Clear prog->jited_len along prog->jited
x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm()
af_unix: Fix a data-race in unix_dgram_peer_wake_me().
stmmac: intel: Fix an error handling path in intel_eth_pci_probe()
xen: unexport __init-annotated xen_xlate_map_ballooned_pages()
net: ethernet: bgmac: Fix refcount leak in bcma_mdio_mii_register
amt: fix wrong type string definition
amt: fix possible null-ptr-deref in amt_rcv()
amt: fix wrong usage of pskb_may_pull()
netfilter: nf_tables: bail out early if hardware offload is not supported
netfilter: nf_tables: memleak flow rule from commit path
netfilter: nf_tables: release new hooks on unsupported flowtable flags
ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
netfilter: nf_tables: always initialize flowtable hook list in transaction
SUNRPC: Trap RDMA segment overflows
powerpc/kasan: Force thread size increase with KASAN
netfilter: nf_tables: delete flowtable hooks via transaction list
netfilter: nf_tables: use kfree_rcu(ptr, rcu) to release hooks in clean_net path
netfilter: nat: really support inet nat without l3 address
drm/panfrost: Job should reference MMU not file_priv
drm/bridge: ti-sn65dsi83: Handle dsi_lanes == 0 as invalid
xprtrdma: treat all calls not a bcall when bc_serv is NULL
f2fs: fix to tag gcing flag on page during file defragment
rtla/Makefile: Properly handle dependencies
m68knommu: fix undefined reference to `mach_get_rtc_pll'
RISC-V: use memcpy for kexec_file mode
video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove()
video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1
NFSv4: Don't hold the layoutget locks across multiple RPC calls
dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type
m68knommu: fix undefined reference to `_init_sp'
m68knommu: set ZERO_PAGE() to the allocated zeroed page
i2c: cadence: Increase timeout per message if necessary
f2fs: remove WARN_ON in f2fs_is_valid_blkaddr
iommu/arm-smmu-v3: check return value after calling platform_get_resource()
iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe()
tracing: Avoid adding tracer option before update_tracer_options
tracing: Fix sleeping function called from invalid context on RT kernel
tracing: Make tp_printk work on syscall tracepoints
bootconfig: Make the bootconfig.o as a normal object file
mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
dmaengine: idxd: set DMA_INTERRUPT cap bit
bluetooth: don't use bitmaps for random flag accesses
Bluetooth: hci_sync: Fix attempting to suspend with unfiltered passive scan
Bluetooth: MGMT: Add conditions for setting HCI_CONN_FLAG_REMOTE_WAKEUP
perf c2c: Fix sorting in percent_rmt_hitm_cmp()
perf record: Support sample-read topdown metric group for hybrid platforms
perf parse-events: Move slots event for the hybrid platform too
perf evsel: Fixes topdown events in a weak group for the hybrid platform
driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction
tipc: check attribute length for bearer name
ax25: Fix ax25 session cleanup problems
scsi: sd: Fix potential NULL pointer dereference
drm/msm/dp: Always clear mask bits to disable interrupts at dp_ctrl_reset_irq_ctrl()
afs: Fix infinite loop found by xfstest generic/676
gpio: pca953x: use the correct register address to do regcache sync
regulator: mt6315-regulator: fix invalid allowed mode
s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST flag
macsec: fix UAF bug for real_dev
octeontx2-af: fix error code in is_valid_offset()
vdpa: ifcvf: set pci driver data in probe
tcp: tcp_rtx_synack() can be called from process context
net: sched: add barrier to fix packet stuck problem for lockless qdisc
net/mlx5e: Update netdev features after changing XDP state
net/mlx5: correct ECE offset in query qp output
net/mlx5e: Disable softirq in mlx5e_activate_rq to avoid race condition
net/mlx5: CT: Fix header-rewrite re-use for tupels
net/mlx5e: TC NIC mode, fix tc chains miss table
net/mlx5: Don't use already freed action pointer
virtio: pci: Fix an error handling path in vp_modern_probe()
vdpa: Fix error logic in vdpa_nl_cmd_dev_get_doit
blk-mq: do not update io_ticks with passthrough requests
block: make bioset_exit() fully resilient against being called twice
sfc: fix wrong tx channel offset with efx_separate_tx_channels
sfc: fix considering that all channels have TX queues
block: use bio_queue_enter instead of blk_queue_enter in bio_poll
nfp: only report pause frame configuration for physical device
tcp: add accessors to read/set tp->snd_cwnd
net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *"
riscv: read-only pages should not be writable
nbd: don't clear 'NBD_CMD_INFLIGHT' flag if request is not completed
block: take destination bvec offsets into account in bio_copy_data_iter
bpf: Fix probe read error in ___bpf_prog_run()
selftests/bpf: fix stacktrace_build_id with missing kprobe/urandom_read
selftests/bpf: fix selftest after random: Urandom_read tracepoint removal
ubi: ubi_create_volume: Fix use-after-free when volume creation failed
ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty
jffs2: fix memory leak in jffs2_do_fill_super
ep93xx: clock: Do not return the address of the freed memory
modpost: fix removing numeric suffixes
net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks
net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry()
net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog
net: lan966x: check devm_of_phy_get() for -EDEFER_PROBE
drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq()
spi: fsi: Fix spurious timeout
net/smc: set ini->smcrv2.ib_dev_v2 to NULL if SMC-Rv2 is unavailable
amt: fix possible memory leak in amt_rcv()
amt: fix return value of amt_update_handler()
s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value
ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition
blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx
watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe
watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking
driver core: fix deadlock in __device_attach
driver: base: fix UAF when driver_attach failed
bus: ti-sysc: Fix warnings for unbind for serial
firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
serial: stm32-usart: Correct CSIZE, bits, and parity
serial: st-asc: Sanitize CSIZE and correct PARENB for CS7
serial: sifive: Sanitize CSIZE and c_iflag
serial: sh-sci: Don't allow CS5-6
serial: txx9: Don't allow CS5-6
serial: rda-uart: Don't allow CS5-6
serial: digicolor-usart: Don't allow CS5-6
serial: uartlite: Fix BRKINT clearing
serial: cpm_uart: Fix build error without CONFIG_SERIAL_CPM_CONSOLE
serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485
serial: meson: acquire port->lock in startup()
staging: r8188eu: add check for kzalloc
rtc: ftrtc010: Fix error handling in ftrtc010_rtc_probe
rtc: mt6397: check return value after calling platform_get_resource()
ARM: dts: aspeed: ast2600-evb: Enable RX delay for MAC0/MAC1
clocksource/drivers/riscv: Events are stopped during CPU suspend
soc: rockchip: Fix refcount leak in rockchip_grf_init
dt-bindings: remoteproc: mediatek: Make l1tcm reg exclusive to mt819x
extcon: ptn5150: Add queue work sync before driver release
ksmbd: fix reference count leak in smb_check_perm_dacl()
coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
soundwire: intel: prevent pm_runtime resume prior to system suspend
watchdog: rzg2l_wdt: Fix reset control imbalance
watchdog: rzg2l_wdt: Fix 'BUG: Invalid wait context'
watchdog: rzg2l_wdt: Fix Runtime PM usage
watchdog: rzg2l_wdt: Fix 32bit overflow issue
export: fix string handling of namespace in EXPORT_SYMBOL_NS
serial: sifive: Report actual baud base rather than fixed 115200
power: supply: ab8500_fg: Allocate wq in probe
power: supply: axp288_fuel_gauge: Drop BIOS version check from "T3 MRD" DMI quirk
phy: qcom-qmp: fix pipe-clock imbalance on power-on failure
misc/pvpanic: Convert regular spinlock into trylock on panic path
rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails
iio: adc: sc27xx: Fine tune the scale calibration values
iio: adc: sc27xx: fix read big scale voltage not right
iio: proximity: vl53l0x: Fix return value check of wait_for_completion_timeout
iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check
rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl
rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev()
rpmsg: virtio: Fix possible double free in rpmsg_probe()
usb: typec: mux: Check dev_set_name() return value
firmware: stratix10-svc: fix a missing check on list iterator
misc: fastrpc: fix an incorrect NULL check on list iterator
scripts/get_abi: Fix wrong script file name in the help message
usb: dwc3: pci: Fix pm_runtime_get_sync() error checking
usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback
rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
pwm: raspberrypi-poe: Fix endianness in firmware struct
pwm: lp3943: Fix duty calculation in case period was clamped
staging: fieldbus: Fix the error handling path in anybuss_host_common_probe()
usb: musb: Fix missing of_node_put() in omap2430_probe
USB: storage: karma: fix rio_karma_init return
usb: usbip: add missing device lock on tweak configuration cmd
usb: usbip: fix a refcount leak in stub_probe()
phy: rockchip-inno-usb2: Fix muxed interrupt support
remoteproc: imx_rproc: Ignore create mem entry for resource table
tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get
serial: 8250_aspeed_vuart: Fix potential NULL dereference in aspeed_vuart_probe
tty: n_tty: Restore EOF push handling behavior
tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe
tty: goldfish: Use tty_port_destroy() to destroy port
lkdtm/bugs: Don't expect thread termination without CONFIG_UBSAN_TRAP
lkdtm/bugs: Check for the NULL pointer after calling kmalloc
iio: adc: ad7124: Remove shift from scan_type
staging: greybus: codecs: fix type confusion of list iterator variable
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards