Jammy update: v6.1.31 upstream stable release

[Timo Aaltonen]

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v6.1.31 upstream stable release
       from git://git.kernel.org/

Linux 6.1.31
net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE
3c589_cs: Fix an error handling path in tc589_probe()
net/smc: Reset connection when trying to use SMCRv2 fails.
regulator: mt6359: add read check for PMIC MT6359
firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors
arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay
net/mlx5: Devcom, serialize devcom registration
net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
net/mlx5: Collect command failures data only for known commands
net/mlx5: Fix error message when failing to allocate device memory
net/mlx5: DR, Check force-loopback RC QP capability independently from RoCE
net/mlx5: Handle pairing of E-switch via uplink un/load APIs
net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs
net/mlx5e: do as little as possible in napi poll when budget is 0
net/mlx5e: Use correct encap attribute during invalidation
net/mlx5e: Fix deadlock in tc route query code
net/mlx5e: Fix SQ wake logic in ptp napi_poll context
platform/mellanox: mlxbf-pmc: fix sscanf() error checking
forcedeth: Fix an error handling path in nv_probe()
sctp: fix an issue that plpmtu can never go to complete state
cxl: Wait Memory_Info_Valid before access memory related info
ASoC: Intel: avs: Access path components under lock
ASoC: Intel: avs: Fix declaration of enum avs_channel_config
ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg
x86/show_trace_log_lvl: Ensure stack pointer is aligned, again
xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
x86/pci/xen: populate MSI sysfs entries
ARM: dts: imx6qdl-mba6: Add missing pvcie-supply regulator
coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet()
platform/x86: ISST: Remove 8 socket limit
regulator: pca9450: Fix BUCK2 enable_mask
fs: fix undefined behavior in bit shift for SB_NOUSER
firmware: arm_ffa: Fix FFA device names for logical partitions
firmware: arm_ffa: Check if ffa_driver remove is present before executing
optee: fix uninited async notif value
power: supply: sbs-charger: Fix INHIBITED bit for Status reg
power: supply: bq24190: Call power_supply_changed() after updating input current
power: supply: bq25890: Call power_supply_changed() after updating input current or voltage
power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes
power: supply: bq27xxx: Move bq27xxx_battery_update() down
power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status()
power: supply: bq27xxx: Fix poll_interval handling and races on remove
power: supply: bq27xxx: Fix I2C IRQ race on remove
power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition
power: supply: mt6360: add a check of devm_work_autocancel in mt6360_charger_probe
power: supply: leds: Fix blink to LED on transition
cifs: mapchars mount option ignored
ipv6: Fix out-of-bounds access in ipv6_find_tlv()
lan966x: Fix unloading/loading of the driver
bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps
bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields
octeontx2-pf: Fix TSOv6 offload
selftests: fib_tests: mute cleanup error message
drm: fix drmm_mutex_init()
net: fix skb leak in __skb_tstamp_tx()
ASoC: lpass: Fix for KASAN use_after_free out of bounds
media: radio-shark: Add endpoint checks
USB: sisusbvga: Add endpoint checks
USB: core: Add routines for endpoint checks in old drivers
udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
net: fix stack overflow when LRO is disabled for virtual interfaces
fbdev: udlfb: Fix endpoint check
debugobjects: Don't wake up kswapd from fill_pool()
irqchip/mips-gic: Use raw spinlock for gic_lock
irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms
perf/x86/uncore: Correct the number of CHAs on SPR
drm/amd/amdgpu: limit one queue per gang
selftests/memfd: Fix unknown type name build failure
binder: fix UAF of alloc->vma in race with munmap()
binder: fix UAF caused by faulty buffer cleanup
binder: add lockless binder_alloc_(set|get)_vma()
Revert "android: binder: stop saving a pointer to the VMA"
Revert "binder_alloc: add missing mmap_lock calls when using the VMA"
drm/amd/pm: Fix output of pp_od_clk_voltage
drm/amd/pm: add missing NotifyPowerSource message mapping for SMU13.0.7
drm/radeon: reintroduce radeon_dp_work_func content
drm/mgag200: Fix gamma lut not initialized.
dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type
btrfs: use nofs when cleaning up aborted transactions
gpio: mockup: Fix mode of debugfs files
parisc: Handle kprobes breakpoints only in kernel context
parisc: Enable LOCKDEP support
parisc: Allow to reboot machine after system halt
parisc: Fix flush_dcache_page() for usage from irq context
parisc: Handle kgdb breakpoints only in kernel context
parisc: Use num_present_cpus() in alternative patching code
xtensa: add __bswap{si,di}2 helpers
xtensa: fix signal delivery to FDPIC process
m68k: Move signal frame following exception on 68020/030
net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
ASoC: rt5682: Disable jack detection interrupt during suspend
power: supply: bq25890: Fix external_power_changed race
power: supply: axp288_fuel_gauge: Fix external_power_changed race
mmc: block: ensure error propagation for non-blk
mmc: sdhci-esdhc-imx: make "no-mmc-hs400" works
SUNRPC: Don't change task->tk_status after the call to rpc_exit_task
ALSA: hda/realtek: Enable headset onLenovo M70/M90
ALSA: hda: Fix unhandled register update during auto-suspend period
ALSA: hda/ca0132: add quirk for EVGA X299 DARK
platform/x86/intel/ifs: Annotate work queue on stack so object debug does not complain
x86/mm: Avoid incomplete Global INVLPG flushes
arm64: Also reset KASAN tag if page is not PG_mte_tagged
ocfs2: Switch to security_inode_init_security()
drm/amd/display: hpd rx irq not working with eDP interface
net: dsa: mv88e6xxx: Add RGMII delay to 88E6320
platform/x86: hp-wmi: Fix cast to smaller integer type warning
skbuff: Proactively round up to kmalloc bucket size
drm/amdgpu/mes11: enable reg active poll
drm/amd/amdgpu: update mes11 api def
watchdog: sp5100_tco: Immediately trigger upon starting.
tpm: Prevent hwrng from activating during resume
tpm: Re-enable TPM chip boostrapping non-tpm_tis TPM drivers
tpm, tpm_tis: startup chip before testing for interrupts
tpm_tis: Use tpm_chip_{start,stop} decoration inside tpm_tis_resume
tpm, tpm_tis: Only handle supported interrupts
tpm, tpm_tis: Avoid cache incoherency in test for interrupts
usb: dwc3: fix gadget mode suspend interrupt handler issue

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem-6.1 - 6.1.0-1016.16

---------------
linux-oem-6.1 (6.1.0-1016.16) jammy; urgency=medium

  * jammy/linux-oem-6.1: 6.1.0-1016.16 -proposed tracker (LP: #2024462)

  * Jammy update: v6.1.34 upstream stable release (LP: #2024166)
    - scsi: megaraid_sas: Add flexible array member for SGLs
    - net: sfp: fix state loss when updating state_hw_mask
    - spi: mt65xx: make sure operations completed before unloading
    - platform/surface: aggregator: Allow completion work-items to be executed in
      parallel
    - platform/surface: aggregator_tabletsw: Add support for book mode in KIP
      subsystem
    - spi: qup: Request DMA before enabling clocks
    - afs: Fix setting of mtime when creating a file/dir/symlink
    - wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll
    - bpf, sockmap: Avoid potential NULL dereference in
      sk_psock_verdict_data_ready()
    - neighbour: fix unaligned access to pneigh_entry
    - net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methods
    - net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294
    - bpf: Fix UAF in task local storage
    - bpf: Fix elem_size not being set for inner maps
    - net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down
    - net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT
    - net: enetc: correct the statistics of rx bytes
    - net: enetc: correct rx_bytes statistics of XDP
    - net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values
    - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER
    - Bluetooth: Fix l2cap_disconnect_req deadlock
    - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left
    - Bluetooth: L2CAP: Add missing checks for invalid DCID
    - wifi: mac80211: use correct iftype HE cap
    - wifi: cfg80211: reject bad AP MLD address
    - wifi: mac80211: mlme: fix non-inheritence element
    - wifi: mac80211: don't translate beacon/presp addrs
    - qed/qede: Fix scheduling while atomic
    - wifi: cfg80211: fix locking in sched scan stop work
    - selftests/bpf: Verify optval=NULL case
    - selftests/bpf: Fix sockopt_sk selftest
    - netfilter: nft_bitwise: fix register tracking
    - netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper
    - netfilter: ipset: Add schedule point in call_ad().
    - netfilter: nf_tables: out-of-bound check in chain blob
    - ipv6: rpl: Fix Route of Death.
    - tcp: gso: really support BIG TCP
    - rfs: annotate lockless accesses to sk->sk_rxhash
    - rfs: annotate lockless accesses to RFS sock flow table
    - net: sched: add rcu annotations around qdisc->qdisc_sleeping
    - drm/i915/selftests: Stop using kthread_stop()
    - drm/i915/selftests: Add some missing error propagation
    - net: sched: move rtm_tca_policy declaration to include file
    - net: sched: act_police: fix sparse errors in tcf_police_dump()
    - net: sched: fix possible refcount leak in tc_chain_tmplt_add()
    - bpf: Add extra path pointer check to d_path helper
    - drm/amdgpu: fix Null pointer dereference error in amdgpu_device_recover_vram
    - lib: cpu_rmap: Fix potential use-after-free in i...