Kinetic update: upstream stable patchset 2023-05-23

[Kamal Mostafa]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       upstream stable patchset 2023-05-23

                Ported from the following upstream stable releases:
                        v5.15.100, v6.1.17
                        v5.15.101, v6.1.18
                        v5.15.102, v6.1.19

       from git://git.kernel.org/

auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()
fs/jfs: fix shift exponent db_agl2size negative
objtool: Fix memory leak in create_static_call_sections()
pwm: sifive: Reduce time the controller lock is held
pwm: sifive: Always let the first pwm_apply_state succeed
pwm: stm32-lp: fix the check on arr and cmp registers update
f2fs: use memcpy_{to,from}_page() where possible
fs: f2fs: initialize fsdata in pagecache_write()
f2fs: allow set compression option of files without blocks
um: vector: Fix memory leak in vector_config
ubi: ensure that VID header offset + VID header size <= alloc, size
ubifs: Fix build errors as symbol undefined
ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
ubifs: Rectify space budget for ubifs_xrename()
ubifs: Fix wrong dirty space budget for dirty inode
ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
ubifs: Reserve one leb for each journal head while doing budget
ubi: Fix use-after-free when volume resizing failed
ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
ubifs: Fix memory leak in alloc_wbufs()
ubi: Fix possible null-ptr-deref in ubi_free_volume()
ubifs: Re-statistic cleaned znode count if commit failed
ubifs: ubifs_writepage: Mark page dirty after writing inode failed
ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
f2fs: fix to avoid potential memory corruption in __update_iostat_latency()
ext4: use ext4_fc_tl_mem in fast-commit replay path
netfilter: nf_tables: allow to fetch set elements when table has an owner
x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
um: virtio_uml: free command if adding to virtqueue failed
um: virtio_uml: mark device as unregistered when breaking it
um: virtio_uml: move device breaking into workqueue
um: virt-pci: properly remove PCI device from bus
watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path
watchdog: Fix kmemleak in watchdog_cdev_register
watchdog: pcwd_usb: Fix attempting to access uninitialized memory
watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
netfilter: ebtables: fix table blob use-after-free
netfilter: x_tables: fix percpu counter block leak on error path when creating new netns
ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
octeontx2-pf: Use correct struct reference in test condition
net: fix __dev_kfree_skb_any() vs drop monitor
9p/xen: fix version parsing
9p/xen: fix connection sequence
9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
net/mlx5e: Verify flow_source cap before using it
net/mlx5: Geneve, Fix handling of Geneve object id as error code
nfc: fix memory leak of se_io context in nfc_genl_se_io
net/sched: transition act_pedit to rcu and percpu stats
net/sched: act_pedit: fix action bind logic
net/sched: act_mpls: fix action bind logic
net/sched: act_sample: fix action bind logic
ARM: dts: spear320-hmi: correct STMPE GPIO compatible
tcp: tcp_check_req() can be called from process context
vc_screen: modify vcs_size() handling in vcs_read()
rtc: sun6i: Always export the internal oscillator
genirq: Refactor accessors to use irq_data_get_affinity_mask
genirq: Add and use an irq_data_update_affinity helper
scsi: ipr: Work around fortify-string warning
rtc: allow rtc_read_alarm without read_alarm callback
loop: loop_set_status_from_info() check before assignment
ASoC: adau7118: don't disable regulators on device unbind
ASoC: zl38060 add gpiolib dependency
ASoC: mediatek: mt8195: add missing initialization
thermal: intel: quark_dts: fix error pointer dereference
thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
kernel/printk/index.c: fix memory leak with using debugfs_lookup()
firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support
mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
IB/hfi1: Update RMT size calculation
iommu/amd: Fix error handling for pdev_pri_ats_enable()
media: uvcvideo: Remove format descriptions
media: uvcvideo: Handle cameras with invalid descriptors
media: uvcvideo: Handle errors from calls to usb_string
media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
media: uvcvideo: Silence memcpy() run-time false positive warnings
USB: fix memory leak with using debugfs_lookup()
staging: emxx_udc: Add checks for dma_alloc_coherent()
tty: fix out-of-bounds access in tty_driver_lookup_tty()
tty: serial: fsl_lpuart: disable the CTS when send break signal
serial: sc16is7xx: setup GPIO controller later in probe
mei: bus-fixup:upon error print return values of send and receive
tools/iio/iio_utils:fix memory leak
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word()
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe()
PCI: loongson: Prevent LS7A MRRS increases
USB: dwc3: fix memory leak with using debugfs_lookup()
USB: chipidea: fix memory leak with using debugfs_lookup()
USB: uhci: fix memory leak with using debugfs_lookup()
USB: sl811: fix memory leak with using debugfs_lookup()
USB: fotg210: fix memory leak with using debugfs_lookup()
USB: isp116x: fix memory leak with using debugfs_lookup()
USB: isp1362: fix memory leak with using debugfs_lookup()
USB: gadget: gr_udc: fix memory leak with using debugfs_lookup()
USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup()
USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup()
USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()
USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup()
usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math
USB: ene_usb6250: Allocate enough memory for full object
usb: uvc: Enumerate valid values for color matching
usb: gadget: uvc: Make bSourceID read/write
PCI: Align extra resources for hotplug bridges properly
PCI: Take other bus devices into account when distributing resources
tty: pcn_uart: fix memory leak with using debugfs_lookup()
misc: vmw_balloon: fix memory leak with using debugfs_lookup()
drivers: base: component: fix memory leak with using debugfs_lookup()
drivers: base: dd: fix memory leak with using debugfs_lookup()
kernel/fail_function: fix memory leak with using debugfs_lookup()
PCI: loongson: Add more devices that need MRRS quirk
PCI: Add ACS quirk for Wangxun NICs
phy: rockchip-typec: Fix unsigned comparison with less than zero
soundwire: cadence: Remove wasted space in response_buf
soundwire: cadence: Drain the RX FIFO after an IO timeout
net: tls: avoid hanging tasks on the tx_lock
x86/resctl: fix scheduler confusion with 'current'
drm/display/dp_mst: Fix down/up message handling after sink disconnect
drm/display/dp_mst: Fix down message handling after a packet reception error
media: uvcvideo: Fix race condition with usb_kill_urb
drm/virtio: Fix error code in virtio_gpu_object_shmem_init()
Revert "scsi: mpt3sas: Fix return value check of dma_get_required_mask()"
scsi: mpt3sas: Don't change DMA mask while reallocating pools
scsi: mpt3sas: re-do lost mpt3sas DMA mask fix
scsi: mpt3sas: Remove usage of dma_get_required_mask() API
usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
Revert "drm/i915: Don't use BAR mappings for ring buffers with LLC"
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext"
staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script
staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh
driver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event()
f2fs: don't rely on F2FS_MAP_* in f2fs_iomap_begin
soc: mediatek: mtk-pm-domains: Allow mt8186 ADSP default power on
memory: renesas-rpc-if: Split-off private data from struct rpcif
memory: renesas-rpc-if: Move resource acquisition to .probe()
f2fs: introduce trace_f2fs_replace_atomic_write_block
f2fs: fix to abort atomic write only during do_exist()
ubifs: Fix memory leak in ubifs_sysfs_init()
ubifs: dirty_cow_znode: Fix memleak in error handling path
ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process
soc: qcom: stats: Populate all subsystem debugfs files
ext4: don't show commit interval if it is zero
watchdog: rzg2l_wdt: Issue a reset before we put the PM clocks
netfilter: xt_length: use skb len to match in length_mt6
netfilter: ctnetlink: make event listener tracking global
ptp: vclock: use mutex to fix "sleep on atomic" bug
drm/i915: move a Kconfig symbol to unbreak the menu presentation
spi: tegra210-quad: Fix validate combined sequence
ext4: fix incorrect options show of original mount_opt and extend mount_opt2
net: dsa: seville: ignore mscc-miim read errors from Lynx PCS
spi: tegra210-quad: Fix iterator outside loop
genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
scsi: mpi3mr: Use number of bits to manage bitmap sizes
nvme-fabrics: show well known discovery name
arm64: efi: Make efi_rt_lock a raw_spinlock
arm64: Reset KASAN tag in copy_highpage with HW tags only
UBUNTU: Upstream stable to v5.15.102, v6.1.19

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.19.0-45.46

---------------
linux (5.19.0-45.46) kinetic; urgency=medium

  * kinetic/linux: 5.19.0-45.46 -proposed tracker (LP: #2023057)

  * Kinetic update: upstream stable patchset 2023-05-23 (LP: #2020599)
    - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext"

linux (5.19.0-44.45) kinetic; urgency=medium

  * kinetic/linux: 5.19.0-44.45 -proposed tracker (LP: #2019827)

  * Linux 5.19 amdgpu: NULL pointer on GCN2 and invalid load on GCN1
    (LP: #2018470)
    - drm/amdgpu: Fix for BO move issue

  * CVE-2023-32233
    - netfilter: nf_tables: deactivate anonymous set from preparation phase

  * CVE-2023-2612
    - SAUCE: shiftfs: prevent lock unbalance in shiftfs_create_object()

  * CVE-2023-31436
    - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg

  * CVE-2023-1380
    - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()

  * conntrack mark is not advertised via netlink (LP: #2016269)
    - netfilter: ctnetlink: revert to dumping mark regardless of event type

  * 5.19 not reporting cgroups v1 blkio.throttle.io_serviced (LP: #2016186)
    - SAUCE: blk-throttle: Fix io statistics for cgroup v1

  * [SRU] Backport request for hpwdt from upstream 6.1 to Jammy (LP: #2008751)
    - watchdog/hpwdt: Enable HP_WATCHDOG for ARM64 systems.
    - watchdog/hpwdt: Include nmi.h only if CONFIG_HPWDT_NMI_DECODING
    - [Config] Add arm64 option to CONFIG_HP_WATCHDOG

  * vmwgfx fails to reserve graphics buffer on aarch64 leading to blank display
    (LP: #2007001)
    - SAUCE: Revert "video/aperture: Disable and unregister sysfb devices via
      aperture helpers"

  * Ubuntu 22.04 raise abnormal NIC MSI-X requests with larger CPU cores (256)
    (LP: #2012335)
    - ice: Allow operation with reduced device MSI-X

  * Dell: Enable speaker mute hotkey LED indicator (LP: #2015972)
    - platform/x86: dell-laptop: Register ctl-led for speaker-mute

  * [SRU]With "Performance per Watt (DAPC)" enabled in the BIOS, Bootup time is
    taking longer than expected (LP: #2008527)
    - cpufreq: ACPI: Defer setting boost MSRs

  * [SRU][Jammy] CONFIG_PCI_MESON is not enabled (LP: #2007745)
    - [Config] arm64: Enable PCI_MESON module

  * Kinetic update: upstream stable patchset 2023-05-08 (LP: #2018948)
    - HID: asus: use spinlock to protect concurrent accesses
    - HID: asus: use spinlock to safely schedule workers
    - powerpc/mm: Rearrange if-else block to avoid clang warning
    - ARM: OMAP2+: Fix memory leak in realtime_counter_init()
    - arm64: dts: qcom: qcs404: use symbol names for PCIe resets
    - arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up
    - arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k
    - arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings
    - arm64: dts: imx8m: Align SoC unique ID node unit address
    - ARM: zynq: Fix refcount leak in zynq_early_slcr_init
    - arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
    - arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
    - arm64: dts: qcom: sc7180: correct SPMI bus addres...