Package linux-cloud-tools-common

Version	Arch	MTime	Size
5.4.0-190.210	all	August 2nd, 2024 11:11	74.00 KiB

linux (5.4.0-190.210) focal; urgency=medium

  * focal/linux: 5.4.0-190.210 -proposed tracker (LP: #2072108)

  * CVE-2024-36016
    - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()

  * CVE-2022-48655
    - firmware: arm_scmi: Harden accesses to the reset domains

  * CVE-2024-26907
    - RDMA/mlx5: Fix fortify source warning while accessing Eth segment

  * CVE-2024-26585
    - tls: fix race between tx work scheduling and socket close

  * CVE-2024-26584
    - net: tls: handle backlogging of crypto requests

  * CVE-2024-26583
    - net/tls: Replace TLS_RX_SYNC_RUNNING with RCU
    - net/tls: Fix use-after-free after the TLS device goes down and up
    - tls: splice_read: fix record type check
    - tls splice: remove inappropriate flags checking for MSG_PEEK
    - tls: splice_read: fix accessing pre-processed records
    - tls: Fix context leak on tls_device_down
    - net/tls: Check for errors in tls_device_init
    - net/tls: Remove the context from the list in tls_device_down
    - net/tls: pass context to tls_device_decrypted()
    - net/tls: Perform immediate device ctx cleanup when possible
    - net/tls: Multi-threaded calls to TX tls_dev_del
    - net: tls: avoid discarding data on record close
    - tls: rx: don't store the record type in socket context
    - tls: rx: don't store the decryption status in socket context
    - tls: rx: don't issue wake ups when data is decrypted
    - tls: rx: refactor decrypt_skb_update()
    - tls: hw: rx: use return value of tls_device_decrypted() to carry status
    - tls: rx: drop unnecessary arguments from tls_setup_from_iter()
    - tls: rx: don't report text length from the bowels of decrypt
    - tls: rx: wrap decryption arguments in a structure
    - tls: rx: factor out writing ContentType to cmsg
    - tls: rx: don't track the async count
    - tls: rx: assume crypto always calls our callback
    - tls: rx: use async as an in-out argument
    - tls: decrement decrypt_pending if no async completion will be called
    - net: tls: fix async vs NIC crypto offload
    - tls: rx: simplify async wait
    - tls: extract context alloc/initialization out of tls_set_sw_offload
    - net: tls: factor out tls_*crypt_async_wait()
    - tls: fix race between async notify and socket close

 -- Manuel Diewald <manuel.diewald@canonical.com>  Fri, 05 Jul 2024 17:04:36 +0200

linux (5.4.0-189.209) focal; urgency=medium

  * focal/linux: 5.4.0-189.209 -proposed tracker (LP: #2068454)

  * Focal update: v5.4.275 upstream stable release (LP: #2067865)
    - batman-adv: Avoid infinite loop trying to resize local TT
    - Bluetooth: Fix memory leak in hci_req_sync_complete()
    - nouveau: fix function cast warning
    - net: openvswitch: fix unwanted error log on timeout policy probing
    - u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
    - geneve: fix header validation in geneve[6]_xmit_skb
    - ipv6: fib: hide unused 'pn' variable
    - ipv4/route: avoid unused-but-set-variable warning
    - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
    - net/mlx5: Properly link new fs rules into the tree
    - net: ena: Fix potential sign extension issue
    - btrfs: qgroup: correctly model root qgroup rsv in convert
    - drm/client: Fully protect modes[] with dev->mode_config.mutex
    - vhost: Add smp_rmb() in vhost_vq_avail_empty()
    - selftests: timers: Fix abs() warning in posix_timers test
    - x86/apic: Force native_apic_mem_read() to use the MOV instruction
    - btrfs: record delayed inode root in transaction
    - selftests/ftrace: Limit length in subsystem-enable tests
    - kprobes: Fix possible use-after-free issue on kprobe registration
    - Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
    - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
    - tun: limit printing rate when illegal packet received by tun dev
    - RDMA/rxe: Fix the problem "mutex_destroy missing"
    - RDMA/mlx5: Fix port number for counter query in multi-port configuration
    - drm: nv04: Fix out of bounds access
    - clk: Remove prepare_lock hold assertion in __clk_release()
    - clk: Mark 'all_lists' as const
    - clk: remove extra empty line
    - clk: Print an info line before disabling unused clocks
    - clk: Initialize struct clk_core kref earlier
    - clk: Get runtime PM before walking tree during disable_unused
    - x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
    - comedi: vmk80xx: fix incomplete endpoint checking
    - serial/pmac_zilog: Remove flawed mitigation for rx irq flood
    - USB: serial: option: add Fibocom FM135-GL variants
    - USB: serial: option: add support for Fibocom FM650/FG650
    - USB: serial: option: add Lonsung U8300/U9300 product
    - USB: serial: option: support Quectel EM060K sub-models
    - USB: serial: option: add Rolling RW101-GL and RW135-GL support
    - USB: serial: option: add Telit FN920C04 rmnet compositions
    - usb: dwc2: host: Fix dereference issue in DDMA completion flow.
    - speakup: Avoid crash on very long word
    - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
    - nouveau: fix instmem race condition around ptr stores
    - nilfs2: fix OOB in nilfs_set_de_type
    - KVM: async_pf: Cleanup kvm_setup_async_pf()
    - arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
    - arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
    - arm64: dts: mediatek: mt7622: fix IR nodename
    - arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
    - arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
    - arm64: dts: mt2712: add ethernet device node
    - arm64: dts: mediatek: mt2712: fix validation errors
    - ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
    - vxlan: drop packets from invalid src-address
    - mlxsw: core: Unregister EMAD trap using FORWARD action
    - NFC: trf7970a: disable all regulators on removal
    - net: usb: ax88179_178a: stop lying about skb->truesize
    - net: gtp: Fix Use-After-Free in gtp_dellink
    - ipvs: Fix checksumming on GSO of SCTP packets
    - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
    - mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
    - mlxsw: spectrum_acl_tcam: Rate limit error message
    - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
    - mlxsw: spectrum_acl_tcam: Fix warning during rehash
    - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
    - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
    - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
    - iavf: Fix TC config comparison with existing adapter TC config
    - af_unix: Suppress false-positive lockdep splat for spin_lock() in
      __unix_gc().
    - serial: core: Provide port lock wrappers
    - serial: mxs-auart: add spinlock around changing cts state
    - Revert "crypto: api - Disallow identical driver names"
    - net/mlx5e: Fix a race in command alloc flow
    - tracing: Show size of requested perf buffer
    - tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker
      together
    - Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
    - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
    - arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
    - drm/amdgpu: Fix leak when GPU memory allocation fails
    - irqchip/gic-v3-its: Prevent double free on error
    - ethernet: Add helper for assigning packet type when dest address does not
      match device address
    - net: b44: set pause params only when interface is up
    - stackdepot: respect __GFP_NOLOCKDEP allocation flag
    - mtd: diskonchip: work around ubsan link failure
    - tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
    - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
    - dmaengine: owl: fix register access functions
    - idma64: Don't try to serve interrupts when device is powered off
    - i2c: smbus: fix NULL function pointer dereference
    - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
    - bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
    - udp: preserve the connected status if only UDP cmsg
    - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
    - Linux 5.4.275

  * Focal update: v5.4.274 upstream stable release (LP: #2067857)
    - amdkfd: use calloc instead of kzalloc to avoid integer overflow
    - Documentation/hw-vuln: Update spectre doc
    - x86/cpu: Support AMD Automatic IBRS
    - x86/bugs: Use sysfs_emit()
    - timers: Update kernel-doc for various functions
    - timers: Use del_timer_sync() even on UP
    - timers: Rename del_timer_sync() to timer_delete_sync()
    - media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
    - clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
    - smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
    - smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
    - ARM: dts: mmp2-brownstone: Don't redeclare phandle references
    - arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
    - serial: max310x: fix NULL pointer dereference in I2C instantiation
    - KVM: Always flush async #PF workqueue when vCPU is being destroyed
    - sparc64: NMI watchdog: fix return value of __setup handler
    - sparc: vDSO: fix return value of __setup handler
    - crypto: qat - fix double free during reset
    - crypto: qat - resolve race condition during AER recovery
    - selftests/mqueue: Set timeout to 180 seconds
    - ext4: correct best extent lstart adjustment logic
    - fat: fix uninitialized field in nostale filehandles
    - ubifs: Set page uptodate in the correct place
    - ubi: Check for too small LEB size in VTBL code
    - ubi: correct the calculation of fastmap size
    - mtd: rawnand: meson: fix scrambling mode value in command macro
    - parisc: Do not hardcode registers in checksum functions
    - parisc: Fix ip_fast_csum
    - parisc: Fix csum_ipv6_magic on 32-bit systems
    - parisc: Fix csum_ipv6_magic on 64-bit systems
    - parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
    - PM: suspend: Set mem_sleep_current during kernel command line setup
    - clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
    - clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
    - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
    - powerpc/fsl: Fix mfpmr build errors with newer binutils
    - USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
    - USB: serial: add device ID for VeriFone adapter
    - USB: serial: cp210x: add ID for MGP Instruments PDS100
    - USB: serial: option: add MeiG Smart SLM320 product
    - USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
    - PM: sleep: wakeirq: fix wake irq warning in system suspend
    - mmc: tmio: avoid concurrent runs of mmc_request_done()
    - fuse: don't unhash root
    - btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
    - PCI: Drop pci_device_remove() test of pci_dev->driver
    - PCI/PM: Drain runtime-idle callbacks before driver removal
    - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
    - dm-raid: fix lockdep waring in "pers->hot_add_disk"
    - mmc: core: Fix switch on gp3 partition
    - hwmon: (amc6821) add of_match table
    - ext4: fix corruption during on-line resize
    - firmware: meson_sm: Rework driver as a proper platform driver
    - nvmem: meson-efuse: fix function pointer type mismatch
    - slimbus: core: Remove usage of the deprecated ida_simple_xx() API
    - speakup: Fix 8bit characters from direct synth
    - kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
    - vfio/platform: Disable virqfds on cleanup
    - ring-buffer: Fix resetting of shortest_full
    - ring-buffer: Fix full_waiters_pending in poll
    - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
    - soc: fsl: qbman: Add helper for sanity checking cgr ops
    - soc: fsl: qbman: Add CGR update function
    - soc: fsl: qbman: Use raw spinlock for cgr_lock
    - s390/zcrypt: fix reference counting on zcrypt card objects
    - drm/exynos: do not return negative values from .get_modes()
    - drm/imx/ipuv3: do not return negative values from .get_modes()
    - drm/vc4: hdmi: do not return negative values from .get_modes()
    - memtest: use {READ,WRITE}_ONCE in memory scanning
    - nilfs2: fix failure to detect DAT corruption in btree and direct mappings
    - nilfs2: use a more common logging style
    - nilfs2: prevent kernel bug at submit_bh_wbc()
    - x86/CPU/AMD: Update the Zenbleed microcode revisions
    - ahci: asm1064: correct count of reported ports
    - ahci: asm1064: asm1166: don't limit reported ports
    - dm snapshot: fix lockup in dm_exception_table_exit
    - comedi: comedi_test: Prevent timers rescheduling during deletion
    - netfilter: nf_tables: reject constant set with timeout
    - xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
    - ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897
      platform
    - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
    - usb: gadget: ncm: Fix handling of zero block length packets
    - usb: port: Don't try to peer unused USB ports based on location
    - tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
    - vt: fix unicode buffer corruption when deleting characters
    - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
    - objtool: is_fentry_call() crashes if call has no destination
    - objtool: Add support for intra-function calls
    - x86/speculation: Support intra-function call validation
    - xen/events: close evtchn after mapping cleanup
    - printk: Update @console_may_schedule in console_trylock_spinning()
    - btrfs: allocate btrfs_ioctl_defrag_range_args on stack
    - Revert "loop: Check for overflow while configuring loop"
    - loop: Call loop_config_discard() only after new config is applied
    - loop: Remove sector_t truncation checks
    - loop: Factor out setting loop device size
    - loop: Refactor loop_set_status() size calculation
    - loop: Factor out configuring loop from status
    - loop: Check for overflow while configuring loop
    - loop: loop_set_status_from_info() check before assignment
    - perf/core: Fix reentry problem in perf_output_read_group()
    - efivarfs: Request at most 512 bytes for variable names
    - powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
    - bounds: support non-power-of-two CONFIG_NR_CPUS
    - vt: fix memory overlapping when deleting chars in the buffer
    - mm/memory-failure: fix an incorrect use of tail pages
    - mm/migrate: set swap entry values of THP tail pages properly.
    - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
    - exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
    - mmc: core: Initialize mmc_blk_ioc_data
    - mmc: core: Avoid negative index with array access
    - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
    - scsi: core: Fix unremoved procfs host directory regression
    - usb: dwc2: host: Fix remote wakeup from hibernation
    - usb: dwc2: host: Fix hibernation flow
    - usb: dwc2: host: Fix ISOC flow in DDMA mode
    - usb: dwc2: gadget: LPM flow fix
    - usb: udc: remove warning when queue disabled ep
    - scsi: qla2xxx: Fix command flush on cable pull
    - x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled
    - scsi: lpfc: Correct size for wqe for memset()
    - USB: core: Fix deadlock in usb_deauthorize_interface()
    - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
    - ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
    - tcp: properly terminate timers for kernel sockets
    - dm integrity: fix out-of-range warning
    - r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
    - Bluetooth: hci_event: set the conn encrypted before conn establishes
    - Bluetooth: Fix TOCTOU in HCI debugfs implementation
    - netfilter: nf_tables: disallow timeout for anonymous sets
    - net/rds: fix possible cp null dereference
    - vfio/pci: Disable auto-enable of exclusive INTx IRQ
    - vfio/pci: Lock external INTx masking ops
    - vfio: Introduce interface to flush virqfd inject workqueue
    - vfio/pci: Create persistent INTx handler
    - vfio/platform: Create persistent IRQ handlers
    - Revert "x86/mm/ident_map: Use gbpages only where full GB page should be
      mapped."
    - mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL
      allocations
    - netfilter: nf_tables: flush pending destroy work before exit_net release
    - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
    - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
    - net/sched: act_skbmod: prevent kernel-infoleak
    - net: stmmac: fix rx queue priority assignment
    - selftests: reuseaddr_conflict: add missing new line at the end of the output
    - ipv6: Fix infinite recursion in fib6_dump_done().
    - i40e: fix vf may be used uninitialized in this function warning
    - staging: mmal-vchiq: Allocate and free components as required
    - staging: mmal-vchiq: Fix client_component for 64 bit kernel
    - staging: vc04_services: changen strncpy() to strscpy_pad()
    - staging: vc04_services: fix information leak in create_component()
    - fs: add a vfs_fchown helper
    - fs: add a vfs_fchmod helper
    - initramfs: switch initramfs unpacking to struct file based APIs
    - init: open /initrd.image with O_LARGEFILE
    - erspan: Add type I version 0 support.
    - erspan: make sure erspan_base_hdr is present in skb->head
    - net: ravb: Always process TX descriptor ring
    - ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
    - ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
    - scsi: mylex: Fix sysfs buffer lengths
    - ata: sata_mv: Fix PCI device ID table declaration compilation warning
    - ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with
      microphone
    - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
    - s390/entry: align system call table on 8 bytes
    - wifi: ath9k: fix LNA selection in ath_ant_try_scan()
    - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
    - panic: Flush kernel log buffer at the end
    - arm64: dts: rockchip: fix rk3328 hdmi ports node
    - arm64: dts: rockchip: fix rk3399 hdmi ports node
    - ionic: set adminq irq affinity
    - tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
    - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
    - btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
    - btrfs: send: handle path ref underflow in header iterate_inode_ref()
    - Bluetooth: btintel: Fix null ptr deref in btintel_read_version
    - Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
    - sysv: don't call sb_bread() with pointers_lock held
    - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
    - isofs: handle CDs with bad root inode but good Joliet root directory
    - media: sta2x11: fix irq handler cast
    - drm/amd/display: Fix nanosec stat overflow
    - SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned
      int
    - Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
    - block: prevent division by zero in blk_rq_stat_sum()
    - Input: allocate keycode for Display refresh rate toggle
    - ktest: force $buildonly = 1 for 'make_warnings_file' test type
    - tools: iio: replace seekdir() in iio_generic_buffer
    - usb: typec: tcpci: add generic tcpci fallback compatible
    - usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
    - fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
    - fbmon: prevent division by zero in fb_videomode_from_videomode()
    - netfilter: nf_tables: reject new basechain after table flag update
    - netfilter: nf_tables: discard table flag update with pending basechain
      deletion
    - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
    - drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()
    - virtio: reenable config if freezing device failed
    - x86/mm/pat: fix VM_PAT handling in COW mappings
    - drm/i915/gt: Reset queue_priority_hint on parking
    - x86/alternative: Don't call text_poke() in lazy TLB mode
    - Bluetooth: btintel: Fixe build regression
    - VMCI: Fix possible memcpy() run-time warning in
      vmci_datagram_invoke_guest_handler()
    - erspan: Check IFLA_GRE_ERSPAN_VER is set.
    - ip_gre: do not report erspan version on GRE interface
    - firmware: meson_sm: fix to avoid potential NULL pointer dereference
    - Linux 5.4.274

  * CVE-2024-26586
    - mlxsw: spectrum_acl_tcam: Fix stack corruption

  * CVE-2024-26923
    - af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
    - af_unix: Fix garbage collector racing against connect()

  * Focal update: v5.4.273 upstream stable release (LP: #2064561)
    - io_uring/unix: drop usage of io_uring socket
    - io_uring: drop any code related to SCM_RIGHTS
    - selftests: tls: use exact comparison in recv_partial
    - ASoC: rt5645: Make LattePanda board DMI match more precise
    - x86/xen: Add some null pointer checking to smp.c
    - MIPS: Clear Cause.BD in instruction_pointer_set
    - HID: multitouch: Add required quirk for Synaptics 0xcddc device
    - RDMA/mlx5: Relax DEVX access upon modify commands
    - net/iucv: fix the allocation size of iucv_path_table array
    - parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
    - block: sed-opal: handle empty atoms when parsing response
    - dm-verity, dm-crypt: align "struct bvec_iter" correctly
    - btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
    - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
    - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
    - firewire: core: use long bus reset on gap count error
    - ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
    - Input: gpio_keys_polled - suppress deferred probe error for gpio
    - ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
    - ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
    - ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
    - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
    - fs/select: rework stack allocation hack for clang
    - timekeeping: Fix cross-timestamp interpolation on counter wrap
    - timekeeping: Fix cross-timestamp interpolation corner case decision
    - timekeeping: Fix cross-timestamp interpolation for non-x86
    - wifi: ath10k: fix NULL pointer dereference in
      ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
    - b43: dma: Fix use true/false for bool type variable
    - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
    - wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
    - b43: main: Fix use true/false for bool type
    - wifi: b43: Stop correct queue in DMA worker when QoS is disabled
    - wifi: b43: Disable QoS for bcm4331
    - wifi: wilc1000: fix declarations ordering
    - wifi: wilc1000: fix RCU usage in connect path
    - wifi: mwifiex: debugfs: Drop unnecessary error check for
      debugfs_create_dir()
    - sock_diag: annotate data-races around sock_diag_handlers[family]
    - af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
    - net: blackhole_dev: fix build warning for ethh set but not used
    - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
    - arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
    - bpf: Add typecast to bpf helpers to help BTF generation
    - bpf: Factor out bpf_spin_lock into helpers.
    - bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
    - arm64: dts: qcom: db820c: Move non-soc entries out of /soc
    - arm64: dts: qcom: msm8996: Use node references in db820c
    - arm64: dts: qcom: msm8996: Move regulator consumers to db820c
    - arm64: dts: qcom: msm8996: Pad addresses
    - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
    - bus: tegra-aconnect: Update dependency to ARCH_TEGRA
    - [Config]: Update tegra configs
    - iommu/amd: Mark interrupt as managed
    - wifi: brcmsmac: avoid function pointer casts
    - net: ena: Remove ena_select_queue
    - ARM: dts: arm: realview: Fix development chip ROM compatible value
    - ARM: dts: imx6dl-yapp4: Move phy reset into switch node
    - ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
    - ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
    - ACPI: scan: Fix device check notification handling
    - x86, relocs: Ignore relocations in .notes section
    - SUNRPC: fix some memleaks in gssx_dec_option_array
    - mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove
      function
    - igb: move PEROUT and EXTTS isr logic to separate functions
    - igb: Fix missing time sync events
    - Bluetooth: Remove superfluous call to hci_conn_check_pending()
    - sr9800: Add check for usbnet_get_endpoints
    - bpf: Fix hashtab overflow check on 32-bit arches
    - bpf: Fix stackmap overflow check on 32-bit arches
    - ipv6: fib6_rules: flush route cache when rule is changed
    - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
    - net: hns3: fix port duplex configure error in IMP reset
    - tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
    - l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt()
      function
    - udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
    - net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
    - net/x25: fix incorrect parameter validation in the x25_getsockopt() function
    - nfp: flower: handle acti_netdevs allocation failure
    - dm raid: fix false positive for requeue needed during reshape
    - dm: call the resume method on internal suspend
    - drm/tegra: dsi: Add missing check for of_find_device_by_node
    - gpu: host1x: mipi: Update tegra_mipi_request() to be node based
    - drm/tegra: dsi: Make use of the helper function dev_err_probe()
    - drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
    - drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path
      of tegra_dsi_probe()
    - drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths
      of tegra_output_probe()
    - drm/rockchip: inno_hdmi: Fix video timing
    - drm: Don't treat 0 as -1 in drm_fixp2int_ceil
    - drm/rockchip: lvds: do not overwrite error code
    - dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
    - media: tc358743: register v4l2 async device only after successful setup
    - PCI/DPC: Print all TLP Prefixes, not just the first
    - perf record: Fix possible incorrect free in record__switch_output()
    - drm/amd/display: Fix potential NULL pointer dereferences in
      'dcn10_set_output_transfer_func()'
    - perf evsel: Fix duplicate initialization of data->id in
      evsel__parse_sample()
    - media: em28xx: annotate unchecked call to media_device_register()
    - media: v4l2-tpg: fix some memleaks in tpg_alloc
    - media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
    - media: edia: dvbdev: fix a use-after-free
    - clk: qcom: reset: Allow specifying custom reset delay
    - clk: qcom: reset: support resetting multiple bits
    - clk: qcom: reset: Commonize the de/assert functions
    - clk: qcom: reset: Ensure write completion on reset de/assertion
    - quota: simplify drop_dquot_ref()
    - quota: Fix potential NULL pointer dereference
    - quota: Fix rcu annotations of inode dquot pointers
    - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
    - perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
    - drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
    - ALSA: seq: fix function cast warnings
    - perf stat: Avoid metric-only segv
    - media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
    - media: go7007: add check of return value of go7007_read_addr()
    - media: pvrusb2: remove redundant NULL check
    - media: pvrusb2: fix pvr2_stream_callback casts
    - clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
    - drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
    - PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
    - clk: hisilicon: hi3519: Release the correct number of gates in
      hi3519_clk_unregister()
    - drm/tegra: put drm_gem_object ref on error in tegra_fb_create
    - mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
    - mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a
      ref
    - crypto: arm/sha - fix function cast warnings
    - mtd: maps: physmap-core: fix flash size larger than 32-bit
    - mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
    - ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
    - drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
    - media: pvrusb2: fix uaf in pvr2_context_set_notify
    - media: dvb-frontends: avoid stack overflow warnings with clang
    - media: go7007: fix a memleak in go7007_load_encoder
    - media: v4l2-core: correctly validate video and metadata ioctls
    - media: rename VFL_TYPE_GRABBER to _VIDEO
    - media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO
    - media: ttpci: fix two memleaks in budget_av_attach
    - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
    - powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
    - drm/msm/dpu: add division of drm_display_mode's hskew parameter
    - powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
    - backlight: lm3630a: Initialize backlight_properties on init
    - backlight: lm3630a: Don't set bl->props.brightness in get_brightness
    - backlight: da9052: Fully initialize backlight_properties during probe
    - backlight: lm3639: Fully initialize backlight_properties during probe
    - backlight: lp8788: Fully initialize backlight_properties during probe
    - sparc32: Fix section mismatch in leon_pci_grpci
    - clk: Fix clk_core_get NULL dereference
    - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
    - scsi: csiostor: Avoid function pointer casts
    - RDMA/device: Fix a race between mad_client and cm_client init
    - scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
    - net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
    - watchdog: stm32_iwdg: initialize default timeout
    - NFS: Fix an off by one in root_nfs_cat()
    - afs: Revert "afs: Hide silly-rename files from userspace"
    - tty: vt: fix 20 vs 0x20 typo in EScsiignore
    - serial: max310x: fix syntax error in IRQ error message
    - tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
    - kconfig: fix infinite loop when expanding a macro at the end of file
    - rtc: mt6397: select IRQ_DOMAIN instead of depending on it
    - serial: 8250_exar: Don't remove GPIO device on suspend
    - staging: greybus: fix get_channel_from_mode() failure path
    - usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
    - octeontx2-af: Use matching wake_up API variant in CGX command interface
    - s390/vtime: fix average steal time calculation
    - hsr: Fix uninit-value access in hsr_get_node()
    - packet: annotate data-races around ignore_outgoing
    - rds: introduce acquire/release ordering in acquire/release_in_xmit()
    - hsr: Handle failures in module init
    - net/bnx2x: Prevent access to a freed page in page_pool
    - octeontx2-af: Use separate handlers for interrupts
    - ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and
      vcc1v2
    - netfilter: nf_tables: do not compare internal table flags on updates
    - rcu: add a helper to report consolidated flavor QS
    - bpf: report RCU QS in cpumap kthread
    - spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
    - regmap: Add missing map->bus check
    - Linux 5.4.273

  * Focal update: v5.4.272 upstream stable release (LP: #2064555)
    - lan78xx: Fix white space and style issues
    - lan78xx: Add missing return code checks
    - lan78xx: Fix partial packet errors on suspend/resume
    - lan78xx: Fix race conditions in suspend/resume handling
    - net: lan78xx: fix runtime PM count underflow on link stop
    - ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
    - geneve: make sure to pull inner header in geneve_rx()
    - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
    - net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
    - net/rds: fix WARNING in rds_conn_connect_if_down
    - netfilter: nft_ct: fix l3num expectations with inet pseudo family
    - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
    - netrom: Fix a data-race around sysctl_netrom_default_path_quality
    - netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
    - netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
    - netrom: Fix a data-race around sysctl_netrom_transport_timeout
    - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
    - netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
    - netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
    - netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
    - netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
    - netrom: Fix a data-race around sysctl_netrom_routing_control
    - netrom: Fix a data-race around sysctl_netrom_link_fails_count
    - netrom: Fix data-races around sysctl_net_busy_read
    - selftests: mm: fix map_hugetlb failure on 64K page size systems
    - um: allow not setting extra rpaths in the linux binary
    - serial: max310x: Use devm_clk_get_optional() to get the input clock
    - serial: max310x: Try to get crystal clock rate from property
    - serial: max310x: fail probe if clock crystal is unstable
    - serial: max310x: Make use of device properties
    - serial: max310x: use regmap methods for SPI batch operations
    - serial: max310x: use a separate regmap for each port
    - serial: max310x: prevent infinite while() loop in port startup
    - Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
    - hv_netvsc: Make netvsc/VF binding check both MAC and serial number
    - hv_netvsc: use netif_is_bond_master() instead of open code
    - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
    - y2038: rusage: use __kernel_old_timeval
    - getrusage: add the "signal_struct *sig" local variable
    - getrusage: move thread_group_cputime_adjusted() outside of
      lock_task_sighand()
    - getrusage: use __for_each_thread()
    - getrusage: use sig->stats_lock rather than lock_task_sighand()
    - serial: max310x: Unprepare and disable clock in error path
    - regmap: allow to define reg_update_bits for no bus configuration
    - regmap: Add bulk read/write callbacks into regmap_config
    - serial: max310x: make accessing revision id interface-agnostic
    - serial: max310x: implement I2C support
    - serial: max310x: fix IO data corruption in batched operations
    - arm64: dts: qcom: add PDC interrupt controller for SDM845
    - arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
    - Linux 5.4.272

  * CVE-2024-23307
    - md/raid5: fix atomicity violation in raid5_cache_count

  * CVE-2024-26889
    - Bluetooth: hci_core: Fix possible buffer overflow

  * CVE-2024-26828
    - cifs: fix underflow in parse_server_interfaces()

  * CVE-2024-24861
    - media: xc4000: Fix atomicity violation in xc4000_get_frequency

  * CVE-2023-6270
    - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts

  * CVE-2024-26642
    - netfilter: nf_tables: disallow anonymous set with timeout flag

  * CVE-2024-26926
    - binder: check offset alignment in binder_get_object()

  * CVE-2024-26922
    - drm/amdgpu: validate the parameters of bo mapping operations more clearly

  * CVE-2024-26925
    - netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()
    - netfilter: nf_tables: release batch on table validation from abort path
    - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path

  * CVE-2024-26643
    - netfilter: nf_tables: mark set as dead when unbinding anonymous set with
      timeout

  * CVE-2024-2201
    - x86/cpufeatures: Add new word for scattered features
    - x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
    - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file
    - x86/bhi: Add support for clearing branch history at syscall entry
    - x86/bhi: Define SPEC_CTRL_BHI_DIS_S
    - x86/bhi: Enumerate Branch History Injection (BHI) bug
    - x86/bhi: Add BHI mitigation knob
    - x86/bhi: Mitigate KVM by default
    - [Config] updateconfigs for CONFIG_BHI_{AUTO|ON|OFF}
    - x86/bugs: Fix BHI documentation
    - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES
    - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr'
    - x86/bugs: Fix BHI handling of RRSBA
    - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation
    - x86/bugs: Fix BHI retpoline check

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 07 Jun 2024 15:07:46 +0200

linux (5.4.0-186.206) focal; urgency=medium

  * focal/linux: 5.4.0-186.206 -proposed tracker (LP: #2063812)

  * Mount CIFS fails with Permission denied (LP: #2061986)
    - cifs: fix ntlmssp auth when there is no key exchange

  * USB stick can't be detected (LP: #2040948)
    - usb: Disable USB3 LPM at shutdown

  * CVE-2024-26733
    - net: dev: Convert sa_data to flexible array in struct sockaddr
    - arp: Prevent overflow in arp_req_get().
    - stddef: Introduce DECLARE_FLEX_ARRAY() helper

  * CVE-2024-26712
    - powerpc/kasan: Fix addr error caused by page alignment

  * CVE-2023-52530
    - wifi: mac80211: fix potential key use-after-free

  * CVE-2021-47063
    - drm: bridge/panel: Cleanup connector on bridge detach

  * [Ubuntu 22.04.4/linux-image-6.5.0-26-generic] Kernel output "UBSAN: array-
    index-out-of-bounds in /build/linux-hwe-6.5-34pCLi/linux-
    hwe-6.5-6.5.0/drivers/net/hyperv/netvsc.c:1445:41" multiple times,
    especially during boot. (LP: #2058477)
    - hv: hyperv.h: Replace one-element array with flexible-array member

  * CVE-2024-26614
    - tcp: make sure init the accept_queue's spinlocks once
    - ipv6: init the accept_queue's spinlocks in inet6_create

  * Focal update: v5.4.271 upstream stable release (LP: #2060216)
    - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
    - net: ip_tunnel: prevent perpetual headroom growth
    - tun: Fix xdp_rxq_info's queue_index when detaching
    - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
    - lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is
      detected
    - net: usb: dm9601: fix wrong return value in dm9601_mdio_read
    - Bluetooth: Avoid potential use-after-free in hci_error_reset
    - Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
    - Bluetooth: Enforce validation on max value of connection interval
    - netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
    - rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
    - efi/capsule-loader: fix incorrect allocation size
    - power: supply: bq27xxx-i2c: Do not free non existing IRQ
    - ALSA: Drop leftover snd-rtctimer stuff from Makefile
    - afs: Fix endless loop in directory parsing
    - gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
    - wifi: nl80211: reject iftype change with mesh ID change
    - btrfs: dev-replace: properly validate device names
    - dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
    - dmaengine: fsl-qdma: init irq after reg initialization
    - mmc: core: Fix eMMC initialization with 1-bit bus connection
    - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers
    - cachefiles: fix memory leak in cachefiles_add_cache()
    - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
    - gpio: 74x164: Enable output pins after registers are reset
    - Linux 5.4.271

  * Focal update: v5.4.270 upstream stable release (LP: #2060019)
    - KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
    - KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
    - net/sched: Retire CBQ qdisc
    - [Config] updateconfigs for NET_SCH_CBQ
    - net/sched: Retire ATM qdisc
    - [Config] updateconfigs for NET_SCH_ATM
    - net/sched: Retire dsmark qdisc
    - [Config] updateconfigs for NET_SCH_DSMARK
    - sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
    - memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock()
    - nilfs2: replace WARN_ONs for invalid DAT metadata block requests
    - userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
    - sched/rt: Fix sysctl_sched_rr_timeslice intial value
    - sched/rt: Disallow writing invalid values to sched_rt_period_us
    - scsi: target: core: Add TMF to tmr_list handling
    - dmaengine: shdma: increase size of 'dev_id'
    - dmaengine: fsl-qdma: increase size of 'irq_name'
    - wifi: cfg80211: fix missing interfaces when dumping
    - wifi: mac80211: fix race condition on enabling fast-xmit
    - fbdev: savage: Error out if pixclock equals zero
    - fbdev: sis: Error out if pixclock equals zero
    - ahci: asm1166: correct count of reported ports
    - ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
    - ext4: avoid allocating blocks from corrupted group in
      ext4_mb_try_best_found()
    - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
    - regulator: pwm-regulator: Add validity checks in continuous .get_voltage
    - nvmet-tcp: fix nvme tcp ida memory leak
    - ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
    - netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in
      sctp_new
    - nvmet-fc: abort command when there is no binding
    - hwmon: (coretemp) Enlarge per package core count limit
    - scsi: lpfc: Use unsigned type for num_sge
    - firewire: core: send bus reset promptly on gap count error
    - virtio-blk: Ensure no requests in virtqueues before deleting vqs.
    - s390/qeth: Fix potential loss of L3-IP@ in case of network issues
    - pmdomain: renesas: r8a77980-sysc: CR7 must be always on
    - tcp: factor out __tcp_close() helper
    - tcp: return EPOLLOUT from tcp_poll only when notsent_bytes is half the limit
    - tcp: add annotations around sk->sk_shutdown accesses
    - pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours
    - pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
    - spi: mt7621: Fix an error message in mt7621_spi_probe()
    - net: bridge: clear bridge's private skb space on xmit
    - selftests/bpf: Avoid running unprivileged tests with alignment requirements
    - Revert "drm/sun4i: dsi: Change the start delay calculation"
    - drm/amdgpu: Check for valid number of registers to read
    - x86/alternatives: Disable KASAN in apply_alternatives()
    - dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
    - iomap: Set all uptodate bits for an Uptodate page
    - drm/amdgpu: Fix type of second parameter in trans_msg() callback
    - arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
    - PCI: tegra: Fix reporting GPIO error value
    - PCI: tegra: Fix OF node reference leak
    - IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
    - dm-crypt: don't modify the data when using authenticated encryption
    - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
    - PCI/MSI: Prevent MSI hardware interrupt number truncation
    - l2tp: pass correct message length to ip6_append_data
    - ARM: ep93xx: Add terminator to gpiod_lookup_table
    - usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
    - usb: cdns3: fix memory double free when handle zero packet
    - usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
    - usb: roles: don't get/set_role() when usb_role_switch is unregistered
    - IB/hfi1: Fix a memleak in init_credit_return
    - RDMA/bnxt_re: Return error for SRQ resize
    - RDMA/srpt: Make debug output more detailed
    - RDMA/srpt: fix function pointer cast warnings
    - scripts/bpf: teach bpf_helpers_doc.py to dump BPF helper definitions
    - bpf, scripts: Correct GPL license name
    - scsi: jazz_esp: Only build if SCSI core is builtin
    - nouveau: fix function cast warnings
    - ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
    - ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
    - afs: Increase buffer size in afs_update_volume_status()
    - ipv6: sr: fix possible use-after-free and null-ptr-deref
    - packet: move from strlcpy with unused retval to strscpy
    - s390: use the correct count for __iowrite64_copy()
    - tls: rx: jump to a more appropriate label
    - tls: rx: drop pointless else after goto
    - tls: stop recv() if initial process_rx_list gave us non-DATA
    - netfilter: nf_tables: set dormant flag on hook register failure
    - drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
    - drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
    - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
    - scripts/bpf: Fix xdp_md forward declaration typo
    - Linux 5.4.270

  * CVE-2023-47233
    - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach

  * CVE-2021-47070
    - uio: uio_hv_generic: use devm_kzalloc() for private data alloc
    - uio_hv_generic: Fix another memory leak in error handling paths

  * CVE-2024-26622
    - tomoyo: fix UAF write bug in tomoyo_write_control()

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Fri, 26 Apr 2024 14:01:17 +0200

linux (5.4.0-181.201) focal; urgency=medium

  * focal/linux: 5.4.0-181.201 -proposed tracker (LP: #2059549)

  * Packaging resync (LP: #1786013)
    - [Packaging] drop getabis data

  * Drop fips-checks script from trees (LP: #2055083)
    - [Packaging] Remove fips-checks script

  * Remove getabis scripts (LP: #2059143)
    - [Packaging] Remove getabis

  * Focal update: v5.4.269 upstream stable release (LP: #2058948)
    - PCI: mediatek: Clear interrupt status before dispatching handler
    - include/linux/units.h: add helpers for kelvin to/from Celsius conversion
    - units: Add Watt units
    - units: change from 'L' to 'UL'
    - units: add the HZ macros
    - serial: sc16is7xx: set safe default SPI clock frequency
    - spi: introduce SPI_MODE_X_MASK macro
    - serial: sc16is7xx: add check for unsupported SPI modes during probe
    - ext4: allow for the last group to be marked as trimmed
    - crypto: api - Disallow identical driver names
    - PM: hibernate: Enforce ordering during image compression/decompression
    - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
    - rpmsg: virtio: Free driver_override when rpmsg_remove()
    - parisc/firmware: Fix F-extend for PDC addresses
    - arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
    - mmc: core: Use mrq.sbc in close-ended ffu
    - nouveau/vmm: don't set addr on the fail path to avoid warning
    - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
    - rename(): fix the locking of subdirectories
    - block: Remove special-casing of compound pages
    - mtd: spinand: macronix: Fix MX35LFxGE4AD page size
    - fs: add mode_strip_sgid() helper
    - fs: move S_ISGID stripping into the vfs_*() helpers
    - powerpc: Use always instead of always-y in for crtsavres.o
    - x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum
    - net/smc: fix illegal rmb_desc access in SMC-D connection dump
    - vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
    - llc: make llc_ui_sendmsg() more robust against bonding changes
    - llc: Drop support for ETH_P_TR_802_2.
    - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
    - tracing: Ensure visibility when inserting an element into tracing_map
    - afs: Hide silly-rename files from userspace
    - tcp: Add memory barrier to tcp_push()
    - netlink: fix potential sleeping issue in mqueue_flush_file
    - net/mlx5: DR, Use the right GVMI number for drop action
    - net/mlx5: Use kfree(ft->g) in arfs_create_groups()
    - net/mlx5e: fix a double-free in arfs_create_groups
    - netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
    - netfilter: nf_tables: validate NFPROTO_* family
    - fjes: fix memleaks in fjes_hw_setup
    - net: fec: fix the unhandled context fault from smmu
    - btrfs: ref-verify: free ref cache before clearing mount opt
    - btrfs: tree-checker: fix inline ref size in error messages
    - btrfs: don't warn if discard range is not aligned to sector
    - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
    - rbd: don't move requests to the running list on errors
    - gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
    - drm: Don't unref the same fb many times by mistake due to deadlock handling
    - drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
    - drm/bridge: nxp-ptn3460: simplify some error checking
    - drm/exynos: fix accidental on-stack copy of exynos_drm_plane
    - drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
    - gpio: eic-sprd: Clear interrupt after set the interrupt type
    - spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
    - mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
    - tick/sched: Preserve number of idle sleeps across CPU hotplug events
    - x86/entry/ia32: Ensure s32 is sign extended to s64
    - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
    - powerpc: Fix build error due to is_valid_bugaddr()
    - powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
    - powerpc: pmd_move_must_withdraw() is only needed for
      CONFIG_TRANSPARENT_HUGEPAGE
    - powerpc/lib: Validate size for vector operations
    - x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
    - perf/core: Fix narrow startup race when creating the perf nr_addr_filters
      sysfs file
    - regulator: core: Only increment use_count when enable_count changes
    - audit: Send netlink ACK before setting connection in auditd_set
    - ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
    - PNP: ACPI: fix fortify warning
    - ACPI: extlog: fix NULL pointer dereference check
    - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
    - jfs: fix slab-out-of-bounds Read in dtSearch
    - jfs: fix array-index-out-of-bounds in dbAdjTree
    - pstore/ram: Fix crash when setting number of cpus to an odd number
    - crypto: stm32/crc32 - fix parsing list of devices
    - afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
    - rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
    - jfs: fix array-index-out-of-bounds in diNewExt
    - s390/ptrace: handle setting of fpc register correctly
    - KVM: s390: fix setting of fpc register
    - SUNRPC: Fix a suspicious RCU usage warning
    - ecryptfs: Reject casefold directory inodes
    - ext4: fix inconsistent between segment fstrim and full fstrim
    - ext4: unify the type of flexbg_size to unsigned int
    - ext4: remove unnecessary check from alloc_flex_gd()
    - ext4: avoid online resizing failures due to oversized flex bg
    - wifi: rt2x00: restart beacon queue when hardware reset
    - selftests/bpf: satisfy compiler by having explicit return in btf test
    - selftests/bpf: Fix pyperf180 compilation failure with clang18
    - scsi: lpfc: Fix possible file string name overflow when updating firmware
    - PCI: Add no PM reset quirk for NVIDIA Spectrum devices
    - bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
    - ARM: dts: imx7d: Fix coresight funnel ports
    - ARM: dts: imx7s: Fix lcdif compatible
    - ARM: dts: imx7s: Fix nand-controller #size-cells
    - wifi: ath9k: Fix potential array-index-out-of-bounds read in
      ath9k_htc_txstatus()
    - bpf: Add map and need_defer parameters to .map_fd_put_ptr()
    - scsi: libfc: Don't schedule abort twice
    - scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
    - ARM: dts: rockchip: fix rk3036 hdmi ports node
    - ARM: dts: imx25/27-eukrea: Fix RTC node name
    - ARM: dts: imx: Use flash@0,0 pattern
    - ARM: dts: imx27: Fix sram node
    - ARM: dts: imx1: Fix sram node
    - ARM: dts: imx25/27: Pass timing0
    - ARM: dts: imx27-apf27dev: Fix LED name
    - ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
    - ARM: dts: imx23/28: Fix the DMA controller node name
    - block: prevent an integer overflow in bvec_try_merge_hw_page
    - md: Whenassemble the array, consult the superblock of the freshest device
    - arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
    - arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
    - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
    - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
    - wifi: cfg80211: free beacon_ies when overridden from hidden BSS
    - f2fs: fix to check return value of f2fs_reserve_new_block()
    - ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
    - fast_dput(): handle underflows gracefully
    - RDMA/IPoIB: Fix error code return in ipoib_mcast_join
    - drm/drm_file: fix use of uninitialized variable
    - drm/framebuffer: Fix use of uninitialized variable
    - drm/mipi-dsi: Fix detach call without attach
    - media: stk1160: Fixed high volume of stk1160_dbg messages
    - media: rockchip: rga: fix swizzling for RGB formats
    - PCI: add INTEL_HDA_ARL to pci_ids.h
    - ALSA: hda: Intel: add HDA_ARL PCI ID support
    - drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
    - IB/ipoib: Fix mcast list locking
    - media: ddbridge: fix an error code problem in ddb_probe
    - drm/msm/dpu: Ratelimit framedone timeout msgs
    - clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
    - clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
    - drm/amdgpu: Let KFD sync with VM fences
    - drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
    - leds: trigger: panic: Don't register panic notifier if creating the trigger
      failed
    - um: Fix naming clash between UML and scheduler
    - um: Don't use vfprintf() for os_info()
    - um: net: Fix return type of uml_net_start_xmit()
    - i3c: master: cdns: Update maximum prescaler value for i2c clock
    - mfd: ti_am335x_tscadc: Fix TI SoC dependencies
    - [Config] updateconfigs for MFD_TI_AM335X_TSCADC
    - PCI: Only override AMD USB controller if required
    - PCI: switchtec: Fix stdev_release() crash after surprise hot remove
    - usb: hub: Replace hardcoded quirk value with BIT() macro
    - fs/kernfs/dir: obey S_ISGID
    - PCI/AER: Decode Requester ID when no error info found
    - libsubcmd: Fix memory leak in uniq()
    - virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region
      of size 10" warnings
    - blk-mq: fix IO hang from sbitmap wakeup race
    - ceph: fix deadlock or deadcode of misusing dget()
    - drm/amdgpu: Release 'adev->pm.fw' before return in
      'amdgpu_device_need_post()'
    - perf: Fix the nr_addr_filters fix
    - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
    - scsi: isci: Fix an error code problem in isci_io_request_build()
    - net: remove unneeded break
    - ixgbe: Remove non-inclusive language
    - ixgbe: Refactor returning internal error codes
    - ixgbe: Refactor overtemp event handling
    - ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
    - ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
    - llc: call sock_orphan() at release time
    - netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
    - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom
      expectations
    - net: ipv4: fix a memleak in ip_setup_cork
    - af_unix: fix lockdep positive in sk_diag_dump_icons()
    - SAUCE: Sync apparmor copy of af_unix.c
    - net: sysfs: Fix /sys/class/net/<iface> path
    - HID: apple: Add support for the 2021 Magic Keyboard
    - HID: apple: Swap the Fn and Left Control keys on Apple keyboards
    - HID: apple: Add 2021 magic keyboard FN key mapping
    - bonding: remove print in bond_verify_device_path
    - dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
    - dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
    - phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
    - dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
    - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
    - net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
    - selftests: net: avoid just another constant wait
    - atm: idt77252: fix a memleak in open_card_ubr0
    - hwmon: (aspeed-pwm-tacho) mutex for tach reading
    - hwmon: (coretemp) Fix out-of-bounds memory access
    - hwmon: (coretemp) Fix bogus core_id to attr name mapping
    - inet: read sk->sk_family once in inet_recv_error()
    - rxrpc: Fix response to PING RESPONSE ACKs to a dead call
    - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
    - ppp_async: limit MRU to 64K
    - netfilter: nft_compat: reject unused compat flag
    - netfilter: nft_compat: restrict match/target protocol to u16
    - netfilter: nft_ct: reject direction for ct id
    - net/af_iucv: clean up a try_then_request_module()
    - USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
    - USB: serial: option: add Fibocom FM101-GL variant
    - USB: serial: cp210x: add ID for IMST iM871A-USB
    - hrtimer: Report offline hrtimer enqueue
    - Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
    - net: stmmac: xgmac: use #define for string constants
    - net: stmmac: xgmac: fix a typo of register name in DPP safety handling
    - btrfs: forbid creating subvol qgroups
    - btrfs: forbid deleting live subvol qgroup
    - btrfs: send: return EOPNOTSUPP on unknown flags
    - of: unittest: add overlay gpio test to catch gpio hog problem
    - of: unittest: Fix compile in the non-dynamic case
    - spi: ppc4xx: Drop write-only variable
    - ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
    - MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
    - i40e: Fix waiting for queues of all VSIs to be disabled
    - tracing/trigger: Fix to return error if failed to alloc snapshot
    - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
    - HID: wacom: generic: Avoid reporting a serial of '0' to userspace
    - HID: wacom: Do not register input devices until after hid_hw_start
    - USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
    - usb: f_mass_storage: forbid async queue when shutdown happen
    - i2c: i801: Remove i801_set_block_buffer_mode
    - i2c: i801: Fix block process call transactions
    - scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
    - firewire: core: correct documentation of fw_csr_string() kernel API
    - kbuild: Fix changing ELF file type for output of gen_btf for big endian
    - nfc: nci: free rx_data_reassembly skb on NCI device cleanup
    - xen-netback: properly sync TX responses
    - ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
    - binder: signal epoll threads of self-work
    - misc: fastrpc: Mark all sessions as invalid in cb_remove
    - ext4: fix double-free of blocks due to wrong extents moved_len
    - tracing: Fix wasted memory in saved_cmdlines logic
    - staging: iio: ad5933: fix type mismatch regression
    - iio: magnetometer: rm3100: add boundary check for the value read from
      RM3100_REG_TMRC
    - ring-buffer: Clean ring_buffer_poll_wait() error return
    - serial: max310x: set default value when reading clock ready bit
    - serial: max310x: improve crystal stable clock detection
    - x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
    - x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
    - mmc: slot-gpio: Allow non-sleeping GPIO ro
    - ALSA: hda/conexant: Add quirk for SWS JS201D
    - nilfs2: fix data corruption in dsync block recovery for small block sizes
    - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
    - nfp: use correct macro for LengthSelect in BAR config
    - nfp: flower: prevent re-adding mac index for bonded port
    - irqchip/irq-brcmstb-l2: Add write memory barrier before exit
    - can: j1939: Fix UAF in j1939_sk_match_filter during
      setsockopt(SO_J1939_FILTER)
    - pmdomain: core: Move the unused cleanup to a _sync initcall
    - tracing: Inform kmemleak of saved_cmdlines allocation
    - Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
    - bus: moxtet: Add spi device table
    - arch, mm: remove stale mentions of DISCONIGMEM
    - mips: Fix max_mapnr being uninitialized on early stages
    - KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
    - netfilter: ipset: fix performance regression in swap operation
    - netfilter: ipset: Missing gc cancellations fixed
    - net: prevent mss overflow in skb_segment()
    - sched/membarrier: reduce the ability to hammer on sys_membarrier
    - nilfs2: fix potential bug in end_buffer_async_write
    - PM: runtime: add devm_pm_runtime_enable helper
    - PM: runtime: Have devm_pm_runtime_enable() handle
      pm_runtime_dont_use_autosuspend()
    - drm/msm/dsi: Enable runtime PM
    - lsm: new security_file_ioctl_compat() hook
    - Revert "Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting""
    - net: bcmgenet: Fix EEE implementation
    - of: unittest: fix EXPECT text for gpio hog errors
    - of: gpio unittest kfree() wrong object
    - Linux 5.4.269

  * Focal update: v5.4.269 upstream stable release (LP: #2058948) //
    CVE-2023-52603
    - UBSAN: array-index-out-of-bounds in dtSplitRoot

  * CVE-2023-52600
    - jfs: fix uaf in jfs_evict_inode

  * CVE-2023-24023
    - Bluetooth: Add more enc key size check

  * CVE-2024-26581
    - netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure
    - netfilter: nft_set_rbtree: skip end interval element from gc

  * CVE-2024-26589
    - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Thu, 28 Mar 2024 15:36:38 +0100

linux (5.4.0-176.196) focal; urgency=medium

  * focal/linux: 5.4.0-176.196 -proposed tracker (LP: #2058756)

  * Problems with HVCS and hotplugging (LP: #2056373)
    - powerpc/pseries: Fix bad drc_index_start value parsing of drc-info entry
    - powerpc/pseries: Fix of_read_drc_info_cell() to point at next record
    - hvcs: Fix hvcs port reference counting
    - hvcs: Use dev_groups to manage hvcs device attributes
    - hvcs: Use driver groups to manage driver attributes
    - hvcs: Get reference to tty in remove
    - hvcs: Use vhangup in hotplug remove
    - hvcs: Synchronize hotplug remove with port free

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Fri, 22 Mar 2024 17:05:57 +0100

linux (5.4.0-175.195) focal; urgency=medium

  * focal/linux: 5.4.0-175.195 -proposed tracker (LP: #2055684)

  * Packaging resync (LP: #1786013)
    - [Packaging] drop ABI data
    - [Packaging] update annotations scripts
    - debian.master/dkms-versions -- update from kernel-versions (main/2024.03.04)

  * Drop ABI checks from kernel build (LP: #2055686)
    - [Packaging] Remove in-tree abi checks
    - [Packaging] Bring back install-<flavour> prerequisite for checks-<flavour>
    - [Packaging] Remove abi-check from final-checks

  * Cranky update-dkms-versions rollout (LP: #2055685)
    - [Packaging] remove update-dkms-versions
    - Move debian/dkms-versions to debian.master/dkms-versions
    - [Packaging] Replace debian/dkms-versions with $(DEBIAN)/dkms-versions
    - [Packaging] remove update-version-dkms

  * linux-tools-common: man page of usbip[d] is misplaced (LP: #2054094)
    - [Packaging] rules: Put usbip manpages in the correct directory

  * CVE-2024-23851
    - dm ioctl: log an error if the ioctl structure is corrupted
    - dm: limit the number of targets and parameter size area

  * Focal update: v5.4.268 upstream stable release (LP: #2055075)
    - f2fs: explicitly null-terminate the xattr list
    - pinctrl: lochnagar: Don't build on MIPS
    - ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
    - ASoC: Intel: Skylake: Fix mem leak in few functions
    - ASoC: nau8822: Fix incorrect type in assignment and cast to restricted
      __be16
    - ASoC: Intel: Skylake: mem leak in skl register function
    - ASoC: cs43130: Fix the position of const qualifier
    - ASoC: cs43130: Fix incorrect frame delay configuration
    - ASoC: rt5650: add mutex to avoid the jack detection failure
    - nouveau/tu102: flush all pdbs on vmm flush
    - net/tg3: fix race condition in tg3_reset_task()
    - ASoC: da7219: Support low DC impedance headset
    - nvme: introduce helper function to get ctrl state
    - drm/exynos: fix a potential error pointer dereference
    - drm/exynos: fix a wrong error checking
    - clk: rockchip: rk3128: Fix HCLK_OTG gate register
    - jbd2: correct the printing of write_flags in jbd2_write_superblock()
    - drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
    - neighbour: Don't let neigh_forced_gc() disable preemption for long
    - tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
    - tracing: Add size check when printing trace_marker output
    - ring-buffer: Do not record in NMI if the arch does not support cmpxchg in
      NMI
    - reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
    - Input: atkbd - skip ATKBD_CMD_GETID in translated mode
    - Input: i8042 - add nomux quirk for Acer P459-G2-M
    - s390/scm: fix virtual vs physical address confusion
    - ARC: fix spare error
    - Input: xpad - add Razer Wolverine V2 support
    - ARM: sun9i: smp: fix return code check of of_property_match_string
    - drm/crtc: fix uninitialized variable use
    - ACPI: resource: Add another DMI match for the TongFang GMxXGxx
    - binder: use EPOLLERR from eventpoll.h
    - binder: fix trivial typo of binder_free_buf_locked()
    - binder: fix comment on binder_alloc_new_buf() return value
    - uio: Fix use-after-free in uio_open
    - parport: parport_serial: Add Brainboxes BAR details
    - parport: parport_serial: Add Brainboxes device IDs and geometry
    - coresight: etm4x: Fix width of CCITMIN field
    - x86/lib: Fix overflow when counting digits
    - EDAC/thunderx: Fix possible out-of-bounds string access
    - powerpc: add crtsavres.o to always-y instead of extra-y
    - powerpc/44x: select I2C for CURRITUCK
    - powerpc/pseries/memhotplug: Quieten some DLPAR operations
    - powerpc/pseries/memhp: Fix access beyond end of drmem array
    - selftests/powerpc: Fix error handling in FPU/VMX preemption tests
    - powerpc/powernv: Add a null pointer check to scom_debug_init_one()
    - powerpc/powernv: Add a null pointer check in opal_event_init()
    - powerpc/powernv: Add a null pointer check in opal_powercap_init()
    - powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
    - mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
    - ACPI: video: check for error while searching for backlight device parent
    - ACPI: LPIT: Avoid u32 multiplication overflow
    - net: netlabel: Fix kerneldoc warnings
    - netlabel: remove unused parameter in netlbl_netlink_auditinfo()
    - calipso: fix memory leak in netlbl_calipso_add_pass()
    - spi: sh-msiof: Enforce fixed DTDL for R-Car H3
    - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
    - selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
    - crypto: virtio - Handle dataq logic with tasklet
    - crypto: virtio - don't use 'default m'
    - virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
    - crypto: ccp - fix memleak in ccp_init_dm_workarea
    - crypto: af_alg - Disallow multiple in-flight AIO requests
    - crypto: sahara - remove FLAGS_NEW_KEY logic
    - crypto: sahara - fix ahash selftest failure
    - crypto: sahara - fix processing requests with cryptlen < sg->length
    - crypto: sahara - fix error handling in sahara_hw_descriptor_create()
    - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
    - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
    - crypto: virtio - Wait for tasklet to complete on device remove
    - crypto: sahara - fix ahash reqsize
    - crypto: sahara - fix wait_for_completion_timeout() error handling
    - crypto: sahara - improve error handling in sahara_sha_process()
    - crypto: sahara - fix processing hash requests with req->nbytes < sg->length
    - crypto: sahara - do not resize req->src when doing hash operations
    - crypto: scomp - fix req->dst buffer overflow
    - blocklayoutdriver: Fix reference leak of pnfs_device_node
    - NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
    - wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
    - bpf, lpm: Fix check prefixlen before walking trie
    - wifi: libertas: stop selecting wext
    - ARM: dts: qcom: apq8064: correct XOADC register address
    - ncsi: internal.h: Fix a spello
    - net/ncsi: Fix netlink major/minor version numbers
    - firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
    - rtlwifi: Use ffs in <foo>_phy_calculate_bit_shift
    - wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
    - scsi: fnic: Return error if vmalloc() failed
    - arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
    - scsi: hisi_sas: Replace with standard error code return value
    - selftests/net: fix grep checking for fib_nexthop_multiprefix
    - virtio/vsock: fix logic which reduces credit update messages
    - dma-mapping: clear dev->dma_mem to NULL after freeing it
    - wifi: rtlwifi: add calculate_bit_shift()
    - wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
    - rtlwifi: rtl8192de: make arrays static const, makes object smaller
    - wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
    - netfilter: nf_tables: mark newset as dead on transaction abort
    - Bluetooth: Fix bogus check for re-auth no supported with non-ssp
    - Bluetooth: btmtkuart: fix recv_buf() return value
    - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
    - ARM: davinci: always select CONFIG_CPU_ARM926T
    - RDMA/usnic: Silence uninitialized symbol smatch warnings
    - media: pvrusb2: fix use after free on context disconnection
    - drm/bridge: Fix typo in post_disable() description
    - f2fs: fix to avoid dirent corruption
    - drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
    - drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
    - drm/radeon: check return value of radeon_ring_lock()
    - ASoC: cs35l33: Fix GPIO name and drop legacy include
    - ASoC: cs35l34: Fix GPIO name and drop legacy include
    - drm/msm/mdp4: flush vblank event on disable
    - drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
    - drm/drv: propagate errors from drm_modeset_register_all()
    - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
    - drm/radeon/dpm: fix a memleak in sumo_parse_power_table
    - drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
    - drm/bridge: tc358767: Fix return value on error case
    - media: cx231xx: fix a memleak in cx231xx_init_isoc
    - media: dvbdev: drop refcount on error path in dvb_device_open()
    - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
    - drm/amd/pm: fix a double-free in si_dpm_init
    - drivers/amd/pm: fix a use-after-free in kv_parse_power_table
    - gpu/drm/radeon: fix two memleaks in radeon_vm_init
    - drivers: clk: zynqmp: calculate closest mux rate
    - watchdog: set cdev owner before adding
    - watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
    - watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
    - clk: si5341: fix an error code problem in si5341_output_clk_set_rate
    - mmc: sdhci_omap: Fix TI SoC dependencies
    - [Config] update annotations for CONFIG_MMC_SDHCI_OMAP
    - [Config] remove sdhci-omap module for arm64/ppc64el
    - of: Fix double free in of_parse_phandle_with_args_map
    - of: unittest: Fix of_count_phandle_with_args() expected value message
    - binder: fix async space check for 0-sized buffers
    - binder: fix use-after-free in shinker's callback
    - Input: atkbd - use ab83 as id when skipping the getid command
    - Revert "ASoC: atmel: Remove system clock tree configuration for
      at91sam9g20ek"
    - binder: fix race between mmput() and do_exit()
    - binder: fix unused alloc->free_async_space
    - tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
    - usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
    - usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
    - Revert "usb: dwc3: Soft reset phy on probe for host"
    - Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-
      only"
    - usb: chipidea: wait controller resume finished for wakeup irq
    - Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
    - usb: typec: class: fix typec_altmode_put_partner to put plugs
    - usb: mon: Fix atomicity violation in mon_bin_vma_fault
    - ALSA: oxygen: Fix right channel of capture volume mixer
    - fbdev: flush deferred work in fb_deferred_io_fsync()
    - rootfs: Fix support for rootfstype= when root= is given
    - wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
    - wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
    - wifi: mwifiex: configure BSSID consistently when starting AP
    - x86/kvm: Do not try to disable kvmclock if it was not enabled
    - HID: wacom: Correct behavior when processing some confidence == false
      touches
    - mips: Fix incorrect max_low_pfn adjustment
    - MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
    - MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
    - serial: 8250: omap: Don't skip resource freeing if
      pm_runtime_resume_and_get() failed
    - acpi: property: Let args be NULL in __acpi_node_get_property_reference
    - software node: Let args be NULL in software_node_get_reference_args
    - perf genelf: Set ELF program header addresses properly
    - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
    - nvmet-tcp: fix a crash in nvmet_req_complete()
    - perf env: Add perf_env__numa_node()
    - perf record: Move sb_evlist to 'struct record'
    - perf top: Move sb_evlist to 'struct perf_top'
    - perf bpf: Decouple creating the evlist from adding the SB event
    - perf env: Avoid recursively taking env->bpf_progs.lock
    - apparmor: avoid crash when parsed profile name is empty
    - serial: imx: Correct clock error message in function probe()
    - nvmet-tcp: Fix the H2C expected PDU len calculation
    - PCI: keystone: Fix race condition when initializing PHYs
    - s390/pci: fix max size calculation in zpci_memcpy_toio()
    - net: qualcomm: rmnet: fix global oob in rmnet_policy
    - net: phy: micrel: populate .soft_reset for KSZ9131
    - net: ravb: Fix dma_addr_t truncation in error case
    - net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
    - netfilter: nf_tables: skip dead set elements in netlink dump
    - ipvs: avoid stat macros calls from preemptible context
    - kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ
    - kdb: Fix a potential buffer overflow in kdb_local()
    - mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
    - i2c: s3c24xx: fix read transfers in polling mode
    - i2c: s3c24xx: fix transferring more than one message in polling mode
    - perf top: Skip side-band event setup if HAVE_LIBBPF_SUPPORT is not set
    - arm64: dts: armada-3720-turris-mox: set irq type for RTC
    - Linux 5.4.268

  * CVE-2024-24855
    - scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan()

  * Focal update: v5.4.267 upstream stable release (LP: #2054406)
    - nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to
      llcp_local
    - i40e: Fix filter input checks to prevent config with invalid values
    - net: sched: em_text: fix possible memory leak in em_text_destroy()
    - can: raw: add support for SO_TXTIME/SCM_TXTIME
    - can: raw: add support for SO_MARK
    - net-timestamp: extend SOF_TIMESTAMPING_OPT_ID to HW timestamps
    - ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init
    - net: bcmgenet: Fix FCS generation for fragmented skbuffs
    - net: Save and restore msg_namelen in sock_sendmsg
    - i40e: fix use-after-free in i40e_aqc_add_filters()
    - ASoC: meson: g12a: extract codec-to-codec utils
    - [Config] Update annotations for CONFIG_SND_MESON_CODEC_GLUE
    - ASoC: meson: g12a-tohdmitx: Validate written enum values
    - ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux
    - i40e: Restore VF MSI-X state during PCI reset
    - net/qla3xxx: switch from 'pci_' to 'dma_' API
    - net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues
    - asix: Add check for usbnet_get_endpoints
    - bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters()
    - net: Implement missing SO_TIMESTAMPING_NEW cmsg support
    - mm/memory-failure: check the mapcount of the precise page
    - firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and
      ASM108x/VT630x PCIe cards
    - i2c: core: Fix atomic xfer check for non-preempt config
    - mm: fix unmap_mapping_range high bits shift bug
    - mmc: rpmb: fixes pause retune on all RPMB partitions.
    - mmc: core: Cancel delayed work before releasing host
    - mmc: sdhci-sprd: Fix eMMC init failure after hw reset
    - ath10k: Wait until copy complete is actually done before completing
    - ath10k: Add interrupt summary based CE processing
    - ath10k: Keep track of which interrupts fired, don't poll them
    - ath10k: Get rid of "per_ce_irq" hw param
    - PCI: Extract ATS disabling to a helper function
    - PCI: Disable ATS for specific Intel IPU E2000 devices
    - net/dst: use a smaller percpu_counter batch for dst entries accounting
    - ipv6: make ip6_rt_gc_expire an atomic_t
    - ipv6: remove max_size check inline with ipv4
    - ASoC: meson: codec-glue: fix pcm format cast warning
    - Linux 5.4.267

  * CVE-2023-23000
    - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function

  * CVE-2023-23004
    - malidp: Fix NULL vs IS_ERR() checking

  * CVE-2023-46838
    - xen-netback: don't produce zero-size SKB frags

  * CVE-2024-1086
    - netfilter: nf_tables: reject QUEUE/DROP verdict parameters

  * Focal update: v5.4.266 upstream stable release (LP: #2051655)
    - ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
    - ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE
    - ARM: OMAP2+: Fix null pointer dereference and memory leak in
      omap_soc_device_init
    - reset: Fix crash when freeing non-existent optional resets
    - s390/vx: fix save/restore of fpu kernel context
    - wifi: mac80211: mesh_plink: fix matches_local logic
    - net/mlx5: improve some comments
    - net/mlx5: Fix fw tracer first block check
    - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used
      by representors
    - net: sched: ife: fix potential use-after-free
    - ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
    - net/rose: fix races in rose_kill_by_device()
    - net: check vlan filter feature in vlan_vids_add_by_dev() and
      vlan_vids_del_by_dev()
    - afs: Fix the dynamic root's d_delete to always delete unused dentries
    - afs: Fix dynamic root lookup DNS check
    - net: warn if gso_type isn't set for a GSO SKB
    - net: check dev->gso_max_size in gso_features_check()
    - afs: Fix overwriting of result of DNS query
    - i2c: aspeed: Handle the coalesced stop conditions with the start conditions.
    - pinctrl: at91-pio4: use dedicated lock class for IRQ
    - ALSA: hda/hdmi: Add quirk to force pin connectivity on NUC10
    - ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB
    - smb: client: fix NULL deref in asn1_ber_decoder()
    - btrfs: do not allow non subvolume root targets for snapshot
    - interconnect: Treat xlate() returning NULL node as an error
    - iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
    - Input: ipaq-micro-keys - add error handling for devm_kmemdup
    - scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
    - iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
    - iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
    - wifi: cfg80211: Add my certificate
    - wifi: cfg80211: fix certs build to not depend on file order
    - USB: serial: ftdi_sio: update Actisense PIDs constant names
    - USB: serial: option: add Quectel EG912Y module support
    - USB: serial: option: add Foxconn T99W265 with new baseline
    - USB: serial: option: add Quectel RM500Q R13 firmware support
    - Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
    - net: 9p: avoid freeing uninit memory in p9pdu_vreadf
    - net: rfkill: gpio: set GPIO direction
    - x86/alternatives: Sync core before enabling interrupts
    - usb: fotg210-hcd: delete an incorrect bounds test
    - ring-buffer: Fix wake ups when buffer_percent is set to 100
    - block: Don't invalidate pagecache for invalid falloc modes
    - Linux 5.4.266

  * CVE-2024-0607
    - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Thu, 07 Mar 2024 17:43:37 +0100

linux (5.4.0-173.191) focal; urgency=medium

  * focal/linux: 5.4.0-173.191 -proposed tracker (LP: #2052135)

  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2024.02.05)

  * CVE-2023-0340
    - vhost: use kzalloc() instead of kmalloc() followed by memset()

  * CVE-2023-6915
    - ida: Fix crash in ida_free when the bitmap is empty

  * Focal update: v5.4.265 upstream stable release (LP: #2051644)
    - afs: Fix refcount underflow from error handling race
    - net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX
    - qca_debug: Prevent crash on TX ring changes
    - qca_debug: Fix ethtool -G iface tx behavior
    - qca_spi: Fix reset behavior
    - atm: solos-pci: Fix potential deadlock on &cli_queue_lock
    - atm: solos-pci: Fix potential deadlock on &tx_queue_lock
    - atm: Fix Use-After-Free in do_vcc_ioctl
    - qed: Fix a potential use-after-free in qed_cxt_tables_alloc
    - net: Remove acked SYN flag from packet in the transmit queue correctly
    - sign-file: Fix incorrect return values check
    - vsock/virtio: Fix unsigned integer wrap around in
      virtio_transport_has_space()
    - net: stmmac: use dev_err_probe() for reporting mdio bus registration failure
    - net: stmmac: Handle disabled MDIO busses from devicetree
    - cred: switch to using atomic_long_t
    - ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants
    - usb: aqc111: check packet for fixup for true limit
    - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock
      required!"
    - bcache: avoid oversize memory allocation by small stripe_size
    - bcache: add code comments for bch_btree_node_get() and
      __bch_btree_node_alloc()
    - bcache: avoid NULL checking to c->root in run_cache_set()
    - platform/x86: intel_telemetry: Fix kernel doc descriptions
    - HID: add ALWAYS_POLL quirk for Apple kb
    - HID: hid-asus: reset the backlight brightness level on resume
    - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad
    - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation
    - net: usb: qmi_wwan: claim interface 4 for ZTE MF290
    - HID: hid-asus: add const to read-only outgoing usb buffer
    - soundwire: stream: fix NULL pointer dereference for multi_link
    - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS
    - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify
    - team: Fix use-after-free when an option instance allocation fails
    - ring-buffer: Fix memory leak of free page
    - mmc: block: Be sure to wait while busy in CQE error recovery
    - powerpc/ftrace: Create a dummy stackframe to fix stack unwind
    - powerpc/ftrace: Fix stack teardown in ftrace_no_trace
    - Linux 5.4.265

  * Focal update: v5.4.264 upstream stable release (LP: #2049935)
    - hrtimers: Push pending hrtimers away from outgoing CPU earlier
    - netfilter: ipset: fix race condition between swap/destroy and kernel side
      add/del/test
    - tg3: Move the [rt]x_dropped counters to tg3_napi
    - tg3: Increment tx_dropped in tg3_tso_bug()
    - kconfig: fix memory leak from range properties
    - drm/amdgpu: correct chunk_ptr to a pointer to chunk.
    - of: base: Add of_get_cpu_state_node() to get idle states for a CPU node
    - ACPI/IORT: Make iort_get_device_domain IRQ domain agnostic
    - ACPI/IORT: Make iort_msi_map_rid() PCI agnostic
    - of/iommu: Make of_map_rid() PCI agnostic
    - of/irq: make of_msi_map_get_device_domain() bus agnostic
    - of/irq: Make of_msi_map_rid() PCI bus agnostic
    - of: base: Fix some formatting issues and provide missing descriptions
    - of: Fix kerneldoc output formatting
    - of: Add missing 'Return' section in kerneldoc comments
    - of: dynamic: Fix of_reconfig_get_state_change() return value documentation
    - ipv6: fix potential NULL deref in fib6_add()
    - hv_netvsc: rndis_filter needs to select NLS
    - net: arcnet: Fix RESET flag handling
    - net: arcnet: com20020 fix error handling
    - arcnet: restoring support for multiple Sohard Arcnet cards
    - ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
    - net: hns: fix fake link up on xge port
    - netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
    - tcp: do not accept ACK of bytes we never sent
    - bpf: sockmap, updating the sg structure should also update curr
    - RDMA/bnxt_re: Correct module description string
    - hwmon: (acpi_power_meter) Fix 4.29 MW bug
    - ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate
    - tracing: Fix a warning when allocating buffered events fails
    - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle()
    - ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init
    - ARM: dts: imx: make gpt node name generic
    - ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt
    - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names
    - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
    - tracing: Always update snapshot buffer size
    - tracing: Fix incomplete locking when disabling buffered events
    - tracing: Fix a possible race when disabling buffered events
    - packet: Move reference count in packet_sock to atomic_long_t
    - arm64: dts: mediatek: mt7622: fix memory node warning check
    - arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names
    - gpiolib: sysfs: Fix error handling on failed export
    - mmc: core: add helpers mmc_regulator_enable/disable_vqmmc
    - mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled
    - usb: gadget: f_hid: fix report descriptor allocation
    - parport: Add support for Brainboxes IX/UC/PX parallel cards
    - usb: typec: class: fix typec_altmode_put_partner to put plugs
    - ARM: PL011: Fix DMA support
    - serial: sc16is7xx: address RX timeout interrupt errata
    - serial: 8250_omap: Add earlycon support for the AM654 UART controller
    - x86/CPU/AMD: Check vendor in the AMD microcode callback
    - KVM: s390/mm: Properly reset no-dat
    - nilfs2: fix missing error check for sb_set_blocksize call
    - io_uring/af_unix: disable sending io_uring over sockets
    - netlink: don't call ->netlink_bind with table lock held
    - genetlink: add CAP_NET_ADMIN test for multicast bind
    - psample: Require 'CAP_NET_ADMIN' when joining "packets" group
    - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group
    - tools headers UAPI: Sync linux/perf_event.h with the kernel sources
    - cifs: Fix non-availability of dedup breaking generic/304
    - smb: client: fix potential NULL deref in parse_dfs_referrals()
    - devcoredump : Serialize devcd_del work
    - devcoredump: Send uevent once devcd is ready
    - Linux 5.4.264

  * CVE-2024-0646
    - net: tls, update curr on splice as well

  * CVE-2024-0565
    - smb: client: fix OOB in receive_encrypted_standard()

  * CVE-2023-51781
    - appletalk: Fix Use-After-Free in atalk_ioctl

  * CVE-2023-51782
    - net/rose: Fix Use-After-Free in rose_ioctl

  * Focal update: v5.4.263 upstream stable release (LP: #2049084)
    - driver core: Release all resources during unbind before updating device
      links
    - RDMA/irdma: Prevent zero-length STAG registration
    - PCI: keystone: Drop __init from ks_pcie_add_pcie_{ep,port}()
    - afs: Make error on cell lookup failure consistent with OpenAFS
    - drm/panel: simple: Fix Innolux G101ICE-L01 bus flags
    - drm/panel: simple: Fix Innolux G101ICE-L01 timings
    - ata: pata_isapnp: Add missing error check for devm_ioport_map()
    - drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
    - HID: core: store the unique system identifier in hid_device
    - HID: fix HID device resource race between HID core and debugging support
    - ipv4: Correct/silence an endian warning in __ip_do_redirect
    - net: usb: ax88179_178a: fix failed operations during ax88179_reset
    - arm/xen: fix xen_vcpu_info allocation alignment
    - amd-xgbe: handle corner-case during sfp hotplug
    - amd-xgbe: handle the corner-case during tx completion
    - amd-xgbe: propagate the correct speed and duplex status
    - net: axienet: Fix check for partial TX checksum
    - afs: Return ENOENT if no cell DNS record can be found
    - afs: Fix file locking on R/O volumes to operate in local mode
    - nvmet: remove unnecessary ctrl parameter
    - nvmet: nul-terminate the NQNs passed in the connect command
    - MIPS: KVM: Fix a build warning about variable set but not used
    - ext4: add a new helper to check if es must be kept
    - ext4: factor out __es_alloc_extent() and __es_free_extent()
    - ext4: use pre-allocated es in __es_insert_extent()
    - ext4: use pre-allocated es in __es_remove_extent()
    - ext4: using nofail preallocation in ext4_es_remove_extent()
    - ext4: using nofail preallocation in ext4_es_insert_delayed_block()
    - ext4: using nofail preallocation in ext4_es_insert_extent()
    - ext4: fix slab-use-after-free in ext4_es_insert_extent()
    - ext4: make sure allocate pending entry not fail
    - arm64: cpufeature: Extract capped perfmon fields
    - KVM: arm64: limit PMU version to PMUv3 for ARMv8.1
    - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA
    - bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in
      btree_gc_coalesce()
    - s390/dasd: protect device queue against concurrent access
    - USB: serial: option: add Luat Air72*U series products
    - hv_netvsc: Fix race of register_netdevice_notifier and VF register
    - hv_netvsc: Mark VF as slave before exposing it to user-mode
    - dm-delay: fix a race between delay_presuspend and delay_bio
    - bcache: check return value from btree_node_alloc_replacement()
    - bcache: prevent potential division by zero error
    - USB: serial: option: add Fibocom L7xx modules
    - USB: serial: option: fix FM101R-GL defines
    - USB: serial: option: don't claim interface 4 for ZTE MF290
    - USB: dwc2: write HCINT with INTMASK applied
    - usb: dwc3: set the dma max_seg_size
    - USB: dwc3: qcom: fix resource leaks on probe deferral
    - USB: dwc3: qcom: fix wakeup after probe deferral
    - io_uring: fix off-by one bvec index
    - pinctrl: avoid reload of p state in list iteration
    - firewire: core: fix possible memory leak in create_units()
    - mmc: block: Do not lose cache flush during CQE error recovery
    - ALSA: hda: Disable power-save on KONTRON SinglePC
    - ALSA: hda/realtek: Headset Mic VREF to 100%
    - ALSA: hda/realtek: Add supported ALC257 for ChromeOS
    - dm-verity: align struct dm_verity_fec_io properly
    - dm verity: don't perform FEC for failed readahead IO
    - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
    - powerpc: Don't clobber f0/vs0 during fp|altivec register save
    - btrfs: fix off-by-one when checking chunk map includes logical address
    - btrfs: send: ensure send_fd is writable
    - btrfs: make error messages more clear when getting a chunk map
    - Input: xpad - add HyperX Clutch Gladiate Support
    - net: stmmac: xgmac: Disable FPE MMC interrupts
    - ravb: Fix races between ravb_tx_timeout_work() and net related ops
    - net: ravb: Use pm_runtime_resume_and_get()
    - net: ravb: Start TX queues after HW initialization succeeded
    - smb3: fix touch -h of symlink
    - s390/mm: fix phys vs virt confusion in mark_kernel_pXd() functions family
    - s390/cmma: fix detection of DAT pages
    - mtd: cfi_cmdset_0001: Support the absence of protection registers
    - mtd: cfi_cmdset_0001: Byte swap OTP info
    - fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
    - ima: annotate iint mutex to avoid lockdep false positive warnings
    - ovl: skip overlayfs superblocks at global sync
    - ima: detect changes to the backing overlay file
    - scsi: qla2xxx: Simplify the code for aborting SCSI commands
    - scsi: core: Introduce the scsi_cmd_to_rq() function
    - scsi: qla2xxx: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
    - scsi: qla2xxx: Fix system crash due to bad pointer access
    - cpufreq: imx6q: don't warn for disabling a non-existing frequency
    - cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
    - mmc: cqhci: Increase recovery halt timeout
    - mmc: cqhci: Warn of halt or task clear failure
    - mmc: cqhci: Fix task clearing in CQE error recovery
    - mmc: core: convert comma to semicolon
    - mmc: block: Retry commands in CQE error recovery
    - Linux 5.4.263

  * Focal update: v5.4.262 upstream stable release (LP: #2049069)
    - locking/ww_mutex/test: Fix potential workqueue corruption
    - perf/core: Bail out early if the request AUX area is out of bound
    - clocksource/drivers/timer-imx-gpt: Fix potential memory leak
    - clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
    - x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
    - wifi: mac80211_hwsim: fix clang-specific fortify warning
    - wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
    - wifi: ath9k: fix clang-specific fortify warnings
    - wifi: ath10k: fix clang-specific fortify warning
    - net: annotate data-races around sk->sk_tx_queue_mapping
    - net: annotate data-races around sk->sk_dst_pending_confirm
    - wifi: ath10k: Don't touch the CE interrupt registers after power up
    - Bluetooth: Fix double free in hci_conn_cleanup
    - platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
    - drm/komeda: drop all currently held locks if deadlock happens
    - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
    - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
    - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
    - selftests/efivarfs: create-read: fix a resource leak
    - crypto: pcrypt - Fix hungtask for PADATA_RESET
    - RDMA/hfi1: Use FIELD_GET() to extract Link Width
    - fs/jfs: Add check for negative db_l2nbperpage
    - fs/jfs: Add validity check for db_maxag and db_agpref
    - jfs: fix array-index-out-of-bounds in dbFindLeaf
    - jfs: fix array-index-out-of-bounds in diAlloc
    - ARM: 9320/1: fix stack depot IRQ stack filter
    - ALSA: hda: Fix possible null-ptr-deref when assigning a stream
    - PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields
    - atm: iphase: Do PCI error checks on own line
    - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
    - HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
    - tty: vcc: Add check for kstrdup() in vcc_probe()
    - usb: gadget: f_ncm: Always set current gadget in ncm_bind()
    - i2c: sun6i-p2wi: Prevent potential division by zero
    - media: gspca: cpia1: shift-out-of-bounds in set_flicker
    - media: vivid: avoid integer overflow
    - gfs2: ignore negated quota changes
    - media: cobalt: Use FIELD_GET() to extract Link Width
    - drm/amd/display: Avoid NULL dereference of timing generator
    - kgdb: Flush console before entering kgdb on panic
    - ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
    - pwm: Fix double shift bug
    - wifi: iwlwifi: Use FW rate for non-data frames
    - NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
    - ipvlan: add ipvlan_route_v6_outbound() helper
    - tty: Fix uninit-value access in ppp_sync_receive()
    - net: hns3: fix variable may not initialized problem in hns3_init_mac_addr()
    - tipc: Fix kernel-infoleak due to uninitialized TLV value
    - ppp: limit MRU to 64K
    - xen/events: fix delayed eoi list handling
    - ptp: annotate data-race around q->head and q->tail
    - bonding: stop the device in bond_setup_by_slave()
    - net: ethernet: cortina: Fix max RX frame define
    - net: ethernet: cortina: Handle large frames
    - net: ethernet: cortina: Fix MTU max setting
    - netfilter: nf_conntrack_bridge: initialize err to 0
    - net: stmmac: Rework stmmac_rx()
    - net: stmmac: fix rx budget limit check
    - net/mlx5_core: Clean driver version and name
    - net/mlx5e: Check return value of snprintf writing to fw_version buffer for
      representors
    - macvlan: Don't propagate promisc change to lower dev in passthru
    - tools/power/turbostat: Fix a knl bug
    - cifs: spnego: add ';' in HOST_KEY_LEN
    - media: venus: hfi: add checks to perform sanity on queue pointers
    - randstruct: Fix gcc-plugin performance mode to stay in group
    - bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
    - scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for
      selected registers
    - x86/cpu/hygon: Fix the CPU topology evaluation for real
    - KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space
    - KVM: x86: Ignore MSR_AMD64_TW_CFG access
    - audit: don't take task_lock() in audit_exe_compare() code path
    - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
    - hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
    - PCI/sysfs: Protect driver's D3cold preference from user space
    - ACPI: resource: Do IRQ override on TongFang GMxXGxx
    - mmc: meson-gx: Remove setting of CMD_CFG_ERROR
    - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
    - PCI: keystone: Don't discard .remove() callback
    - PCI: keystone: Don't discard .probe() callback
    - parisc/pdc: Add width field to struct pdc_model
    - clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks
    - mmc: vub300: fix an error code
    - PM: hibernate: Use __get_safe_page() rather than touching the list
    - PM: hibernate: Clean up sync_read handling in snapshot_write_next()
    - btrfs: don't arbitrarily slow down delalloc if we're committing
    - jbd2: fix potential data lost in recovering journal raced with synchronizing
      fs bdev
    - quota: explicitly forbid quota files from being encrypted
    - kernel/reboot: emergency_restart: Set correct system_state
    - i2c: core: Run atomic i2c xfer when !preemptible
    - mcb: fix error handling for different scenarios when parsing
    - dmaengine: stm32-mdma: correct desc prep when channel running
    - mm/cma: use nth_page() in place of direct struct page manipulation
    - i3c: master: cdns: Fix reading status register
    - parisc: Prevent booting 64-bit kernels on PA1.x machines
    - parisc/pgtable: Do not drop upper 5 address bits of physical address
    - ALSA: info: Fix potential deadlock at disconnection
    - ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
    - serial: meson: remove redundant initialization of variable id
    - tty: serial: meson: retrieve port FIFO size from DT
    - serial: meson: Use platform_get_irq() to get the interrupt
    - tty: serial: meson: fix hard LOCKUP on crtscts mode
    - Bluetooth: btusb: add Realtek 8822CE to usb_device_id table
    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559
    - bluetooth: Add device 0bda:887b to device tables
    - bluetooth: Add device 13d3:3571 to device tables
    - Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables
    - Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE
    - Revert ncsi: Propagate carrier gain/loss events to the NCSI controller
    - net: dsa: lan9303: consequently nested-lock physical MDIO
    - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
    - media: lirc: drop trailing space from scancode transmit
    - media: sharp: fix sharp encoding
    - media: venus: hfi_parser: Add check to keep the number of codecs within
      range
    - media: venus: hfi: fix the check to handle session buffer requirement
    - media: venus: hfi: add checks to handle capabilities from firmware
    - nfsd: fix file memleak on client_opens_release
    - ext4: apply umask if ACL support is disabled
    - ext4: correct offset of gdb backup in non meta_bg group to update_backups
    - ext4: correct return value of ext4_convert_meta_bg
    - ext4: correct the start block of counting reserved clusters
    - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
    - drm/amdgpu: fix error handling in amdgpu_bo_list_get()
    - tracing: Have trace_event_file have ref counters
    - netfilter: nf_tables: pass context to nft_set_destroy()
    - netfilter: nftables: rename set element data activation/deactivation
      functions
    - netfilter: nf_tables: drop map element references from preparation phase
    - netfilter: nft_set_rbtree: Switch to node list walk for overlap detection
    - netfilter: nft_set_rbtree: fix null deref on element insertion
    - netfilter: nft_set_rbtree: fix overlap expiration walk
    - netfilter: nf_tables: don't skip expired elements during walk
    - netfilter: nf_tables: GC transaction API to avoid race with control plane
    - netfilter: nf_tables: adapt set backend to use GC transaction API
    - netfilter: nft_set_hash: mark set element as dead when deleting from packet
      path
    - netfilter: nf_tables: remove busy mark and gc batch API
    - netfilter: nf_tables: fix GC transaction races with netns and netlink event
      exit path
    - netfilter: nf_tables: GC transaction race with netns dismantle
    - netfilter: nf_tables: GC transaction race with abort path
    - netfilter: nf_tables: use correct lock to protect gc_list
    - netfilter: nf_tables: defer gc run if previous batch is still pending
    - netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
    - netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
    - netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
    - netfilter: nf_tables: fix memleak when more than 255 elements expired
    - netfilter: nf_tables: unregister flowtable hooks on netns exit
    - netfilter: nf_tables: double hook unregistration in netns path
    - netfilter: nftables: update table flags from the commit phase
    - netfilter: nf_tables: fix table flag updates
    - netfilter: nf_tables: disable toggling dormant table state more than once
    - netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush (for
      5.4)
    - Linux 5.4.262

  * Focal update: v5.4.261 upstream stable release (LP: #2049049)
    - vfs: fix readahead(2) on block devices
    - genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()
    - i40e: fix potential memory leaks in i40e_remove()
    - tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed
    - wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
    - wifi: mt76: mt7603: rework/fix rx pse hang check
    - tcp_metrics: add missing barriers on delete
    - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics()
    - tcp_metrics: do not create an entry from tcp_init_metrics()
    - wifi: rtlwifi: fix EDCA limit set by BT coexistence
    - can: dev: can_restart(): don't crash kernel if carrier is OK
    - can: dev: can_restart(): fix race condition between controller restart and
      netif_carrier_on()
    - thermal: core: prevent potential string overflow
    - r8169: use tp_to_dev instead of open code
    - r8169: fix rare issue with broken rx after link-down on RTL8125
    - chtls: fix tp->rcv_tstamp initialization
    - tcp: Remove one extra ktime_get_ns() from cookie_init_timestamp
    - tcp: fix cookie_init_timestamp() overflows
    - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias()
    - ipv6: avoid atomic fragment on GSO packets
    - net: add DEV_STATS_READ() helper
    - ipvlan: properly track tx_errors
    - regmap: debugfs: Fix a erroneous check after snprintf()
    - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies
    - clk: qcom: gcc-sm8150: use ARRAY_SIZE instead of specifying num_parents
    - clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src
    - clk: imx: Select MXC_CLK for CLK_IMX8QXP
    - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks
    - clk: npcm7xx: Fix incorrect kfree
    - clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
    - platform/x86: wmi: Fix probe failure when failing to register WMI devices
    - platform/x86: wmi: remove unnecessary initializations
    - platform/x86: wmi: Fix opening of char device
    - hwmon: (coretemp) Fix potentially truncated sysfs attribute name
    - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs
    - drm/rockchip: vop: Fix call to crtc reset helper
    - drm/radeon: possible buffer overflow
    - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe()
    - arm64: dts: qcom: sdm845-mtp: fix WiFi configuration
    - ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator
    - soc: qcom: llcc cleanup to get rid of sdm845 specific driver file
    - [Config] remove CONFIG_QCOM_SDM845_LLCC
    - soc: qcom: Rename llcc-slice to llcc-qcom
    - [Config] remove llcc-slice module
    - soc: qcom: llcc: Handle a second device without data corruption
    - firmware: ti_sci: Replace HTTP links with HTTPS ones
    - firmware: ti_sci: Mark driver as non removable
    - clk: scmi: Free scmi_clk allocated when the clocks with invalid info are
      skipped
    - hwrng: geode - fix accessing registers
    - libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return
      value
    - sched/rt: Provide migrate_disable/enable() inlines
    - nd_btt: Make BTT lanes preemptible
    - crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure
    - crypto: caam/jr - fix Chacha20 + Poly1305 self test failure
    - HID: cp2112: Use irqchip template
    - hid: cp2112: Fix duplicate workqueue initialization
    - ARM: 9321/1: memset: cast the constant byte to unsigned char
    - ext4: move 'ix' sanity check to corrent position
    - scsi: ufs: core: Leave space for '0' in utf8 desc string
    - RDMA/hfi1: Workaround truncation compilation error
    - sh: bios: Revive earlyprintk support
    - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails
    - ASoC: ams-delta.c: use component after check
    - mfd: dln2: Fix double put in dln2_probe
    - leds: pwm: simplify if condition
    - leds: pwm: convert to atomic PWM API
    - leds: pwm: Don't disable the PWM when the LED should be off
    - ledtrig-cpu: Limit to 8 CPUs
    - leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu'
    - tty: tty_jobctrl: fix pid memleak in disassociate_ctty()
    - usb: dwc2: fix possible NULL pointer dereference caused by driver
      concurrency
    - dmaengine: ti: edma: handle irq_of_parse_and_map() errors
    - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave()
    - tools: iio: privatize globals and functions in iio_generic_buffer.c file
    - tools: iio: iio_generic_buffer: Fix some integer type and calculation
    - tools: iio: iio_generic_buffer ensure alignment
    - USB: usbip: fix stub_dev hub disconnect
    - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc()
    - f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()
    - modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host
    - powerpc/xive: Fix endian conversion size
    - powerpc/imc-pmu: Use the correct spinlock initializer.
    - powerpc/pseries: fix potential memory leak in init_cpu_associativity()
    - i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs
    - rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call
    - pcmcia: cs: fix possible hung task and memory leak pccardd()
    - pcmcia: ds: fix refcount leak in pcmcia_device_add()
    - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()
    - media: bttv: fix use after free error due to btv->timeout timer
    - media: s3c-camif: Avoid inappropriate kfree()
    - media: dvb-usb-v2: af9035: fix missing unlock
    - regmap: prevent noinc writes from clobbering cache
    - pwm: sti: Avoid conditional gotos
    - pwm: sti: Reduce number of allocations and drop usage of chip_data
    - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume
    - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
    - llc: verify mac len before reading mac header
    - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
    - inet: shrink struct flowi_common
    - dccp: Call security_inet_conn_request() after setting IPv4 addresses.
    - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
    - Fix termination state for idr_for_each_entry_ul()
    - net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs
    - net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT
    - tg3: power down device only on SYSTEM_POWER_OFF
    - r8169: respect userspace disabling IFF_MULTICAST
    - netfilter: xt_recent: fix (increase) ipv6 literal buffer length
    - netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate
      eval call-backs
    - netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
    - drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE
    - spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies
    - fbdev: imsttfb: Fix error path of imsttfb_probe()
    - fbdev: imsttfb: fix a resource leak in probe
    - fbdev: fsl-diu-fb: mark wr_reg_wa() static
    - Revert "mmc: core: Capture correct oemid-bits for eMMC cards"
    - btrfs: use u64 for buffer sizes in the tree search ioctls
    - Linux 5.4.261

  * Focal update: v5.4.260 upstream stable release (LP: #2049024)
    - mtd: rawnand: marvell: Ensure program page operations are successful
    - selftests/ftrace: Add new test case which checks non unique symbol
    - mcb: Return actual parsed size when reading chameleon table
    - mcb-lpc: Reallocate memory region to avoid memory overlapping
    - virtio_balloon: Fix endless deflation and inflation on arm64
    - virtio-mmio: fix memory leak of vm_dev
    - r8169: fix the KCSAN reported data-race in rtl_tx while reading
      TxDescArray[entry].opts1
    - r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
    - treewide: Spelling fix in comment
    - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
    - neighbour: fix various data-races
    - igc: Fix ambiguity in the ethtool advertising
    - net: ieee802154: adf7242: Fix some potential buffer overflow in
      adf7242_stats_show()
    - r8152: Increase USB control msg timeout to 5000ms as per spec
    - r8152: Run the unload routine if we have errors during probe
    - r8152: Cancel hw_phy_work if we have an error in probe
    - tcp: fix wrong RTO timeout when received SACK reneging
    - gtp: uapi: fix GTPA_MAX
    - gtp: fix fragmentation needed check with gso
    - iio: exynos-adc: request second interupt only when touchscreen mode is used
    - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
    - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
    - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
    - i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
    - i2c: aspeed: Fix i2c bus hang in slave read
    - nvmem: imx: correct nregs for i.MX6ULL
    - nvmem: imx: correct nregs for i.MX6SLL
    - nvmem: imx: correct nregs for i.MX6UL
    - perf/core: Fix potential NULL deref
    - clk: Sanitize possible_parent_show to Handle Return Value of
      of_clk_get_parent_name
    - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
    - x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
    - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
    - arm64: fix a concurrency issue in emulation_proc_handler()
    - smbdirect: missing rc checks while waiting for rdma events
    - f2fs: fix to do sanity check on inode type during garbage collection
    - nfsd: lock_rename() needs both directories to live on the same fs
    - x86/mm: Simplify RESERVE_BRK()
    - x86/mm: Fix RESERVE_BRK() for older binutils
    - ext4: add two helper functions extent_logical_end() and pa_logical_end()
    - ext4: avoid overlapping preallocations due to overflow
    - ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
    - driver: platform: Add helper for safer setting of driver_override
    - rpmsg: Constify local variable in field store macro
    - rpmsg: Fix kfree() of static memory on setting driver_override
    - rpmsg: Fix calling device_lock() on non-initialized device
    - rpmsg: glink: Release driver_override
    - rpmsg: Fix possible refcount leak in rpmsg_register_device_override()
    - x86: Fix .brk attribute in linker script
    - Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
    - irqchip/stm32-exti: add missing DT IRQ flag translation
    - dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
    - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
    - fbdev: atyfb: only use ioremap_uc() on i386 and ia64
    - spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
    - netfilter: nfnetlink_log: silence bogus compiler warning
    - ASoC: rt5650: fix the wrong result of key button
    - fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
    - scsi: mpt3sas: Fix in error path
    - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
    - platform/mellanox: mlxbf-tmfifo: Fix a warning message
    - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
    - ata: ahci: fix enum constants for gcc-13
    - remove the sx8 block driver
    - [Config] remove CONFIG_BLK_DEV_SX8
    - Revert "ARM: dts: Move am33xx and am43xx mmc nodes to sdhci-omap driver"
    - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
    - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top"
      compatibility
    - tty: 8250: Remove UC-257 and UC-431
    - tty: 8250: Add support for additional Brainboxes UC cards
    - tty: 8250: Add support for Brainboxes UP cards
    - tty: 8250: Add support for Intashield IS-100
    - Linux 5.4.260

  * CVE-2023-51779
    - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg

  * CVE-2023-22995
    - usb: dwc3: dwc3-qcom: Add missing platform_device_put() in
      dwc3_qcom_acpi_register_core

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 02 Feb 2024 14:22:27 +0100

linux (5.4.0-171.189) focal; urgency=medium

  * focal/linux: 5.4.0-171.189 -proposed tracker (LP: #2048282)

  * Packaging resync (LP: #1786013)
    - [Packaging] remove helper scripts
    - [Packaging] update annotations scripts
    - debian/dkms-versions -- update from kernel-versions (main/2024.01.08)

  * Page fault in RDMA ODP triggers BUG_ON during MMU notifier registration
    (LP: #2046534)
    - RDMA/odp: Ensure the mm is still alive before creating an implicit child

  * Hotplugging SCSI disk in QEMU VM fails (LP: #2047382)
    - Revert "PCI: acpiphp: Reassign resources on bridge if necessary"

  * CVE-2023-6040
    - netfilter: nf_tables: Reject tables of unsupported family

  * kernel_selftests failures on kernel-P10d-LPAR10.ppc64el.10
    (LP: #2032641)
    - selftests: Skip TM tests on synthetic TM implementations

  * [Debian] autoreconstruct - Do not generate chmod -x for deleted  files
    (LP: #2045562)
    - [Debian] autoreconstruct - Do not generate chmod -x for deleted files

  * CVE-2023-6931
    - perf/core: Add a new read format to get a number of lost samples
    - perf: Fix perf_event_validate_size()
    - perf: Fix perf_event_validate_size() lockdep splat

  * CVE-2023-6932
    - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet

  * CVE-2023-6606
    - smb: client: fix OOB in smbCalcSize()

  * CVE-2023-45863
    - kobject: Fix slab-out-of-bounds in fill_kobj_path()

  * Focal update: v5.4.259 upstream stable release (LP: #2043724)
    - RDMA/cxgb4: Check skb value for failure to allocate
    - lib/test_meminit: fix off-by-one error in test_pages()
    - pwm: hibvt: Explicitly set .polarity in .get_state()
    - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
    - quota: Fix slow quotaoff
    - net: prevent address rewrite in kernel_bind()
    - drm: etvnaviv: fix bad backport leading to warning
    - drm/msm/dsi: skip the wait for video mode done if not applicable
    - ravb: Fix up dma_free_coherent() call in ravb_remove()
    - ieee802154: ca8210: Fix a potential UAF in ca8210_probe
    - mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type
    - xen-netback: use default TX queue size for vifs
    - drm/vmwgfx: fix typo of sizeof argument
    - ixgbe: fix crash with empty VF macvlan list
    - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
    - nfc: nci: assert requested protocol is valid
    - workqueue: Override implicit ordered attribute in
      workqueue_apply_unbound_cpumask()
    - dmaengine: stm32-mdma: abort resume if no ongoing transfer
    - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
    - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
    - usb: dwc3: Soft reset phy on probe for host
    - usb: musb: Get the musb_qh poniter after musb_giveback
    - usb: musb: Modify the "HWVers" register address
    - iio: pressure: bmp280: Fix NULL pointer exception
    - iio: pressure: dps310: Adjust Timeout Settings
    - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
    - mcb: remove is_added flag from mcb_device struct
    - libceph: use kernel_connect()
    - ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
    - Input: powermate - fix use-after-free in powermate_config_complete
    - Input: psmouse - fix fast_reconnect function for PS/2 mode
    - Input: xpad - add PXN V900 support
    - cgroup: Remove duplicates in cgroup v1 tasks file
    - pinctrl: avoid unsafe code pattern in find_pinctrl()
    - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
    - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
    - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
    - dmaengine: mediatek: Fix deadlock caused by synchronize_irq()
    - powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE
    - powerpc/64e: Fix wrong test in __ptep_test_and_clear_young()
    - ravb: Fix use-after-free issue in ravb_tx_timeout_work()
    - Documentation: sysctl: align cells in second content column
    - usb: hub: Guard against accesses to uninitialized BOS descriptors
    - Bluetooth: hci_event: Ignore NULL link key
    - Bluetooth: Reject connection with the device which has same BD_ADDR
    - Bluetooth: Fix a refcnt underflow problem for hci_conn
    - Bluetooth: vhci: Fix race when opening vhci device
    - Bluetooth: hci_event: Fix coding style
    - Bluetooth: avoid memcmp() out of bounds warning
    - ice: fix over-shifted variable
    - nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
    - regmap: fix NULL deref on lookup
    - KVM: x86: Mask LVTPC when handling a PMI
    - netfilter: nft_payload: fix wrong mac header matching
    - qed: fix LL2 RX buffer allocation
    - xfrm: fix a data-race in xfrm_gen_index()
    - xfrm: interface: use DEV_STATS_INC()
    - net: ipv4: fix return value check in esp_remove_trailer
    - net: ipv6: fix return value check in esp_remove_trailer
    - net: rfkill: gpio: prevent value glitch during probe
    - tcp: fix excessive TLP and RACK timeouts from HZ rounding
    - tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb
    - tun: prevent negative ifindex
    - ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
    - net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
    - i40e: prevent crash on probe if hw registers have invalid values
    - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
    - neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section
    - netfilter: nft_set_rbtree: .deactivate fails if element has expired
    - net: pktgen: Fix interface flags printing
    - resource: Add irqresource_disabled()
    - ACPI: Drop acpi_dev_irqresource_disabled()
    - ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
    - ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
    - ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
    - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
    - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
    - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
    - btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1
    - btrfs: initialize start_slot in btrfs_log_prealloc_extents
    - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
    - overlayfs: set ctime when setting mtime and atime
    - gpio: timberdale: Fix potential deadlock on &tgpio->lock
    - ata: libata-eh: Fix compilation warning in ata_eh_link_report()
    - tracing: relax trace_event_eval_update() execution with cond_resched()
    - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
    - Bluetooth: Avoid redundant authentication
    - Bluetooth: hci_core: Fix build warnings
    - wifi: mac80211: allow transmitting EAPOL frames with tainted key
    - wifi: cfg80211: avoid leaking stack data into trace
    - regulator/core: Revert "fix kobject release warning and memory leak in
      regulator_register()"
    - sky2: Make sure there is at least one frag_addr available
    - drm: panel-orientation-quirks: Add quirk for One Mix 2S
    - btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
    - HID: multitouch: Add required quirk for Synaptics 0xcd7e device
    - Bluetooth: hci_event: Fix using memcmp when comparing keys
    - mtd: rawnand: qcom: Unmap the right resource upon probe failure
    - mtd: spinand: micron: correct bitmask for ecc status
    - mtd: physmap-core: Restore map_rom fallback
    - mmc: core: sdio: hold retuning if sdio in 1-bit mode
    - mmc: core: Capture correct oemid-bits for eMMC cards
    - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
    - ACPI: irq: Fix incorrect return value in acpi_register_gsi()
    - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
    - USB: serial: option: add entry for Sierra EM9191 with new firmware
    - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
    - s390/pci: fix iommu bitmap allocation
    - gpio: vf610: set value before the direction to avoid a glitch
    - ASoC: pxa: fix a memory leak in probe()
    - phy: mapphone-mdm6600: Fix runtime disable on probe
    - phy: mapphone-mdm6600: Fix runtime PM for remove
    - phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins
    - Bluetooth: hci_sock: fix slab oob read in create_monitor_event
    - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
    - xfrm6: fix inet6_dev refcount underflow problem
    - Linux 5.4.259

  * Focal update: v5.4.258 upstream stable release (LP: #2042107)
    - NFS/pNFS: Report EINVAL errors from connect() to the server
    - SUNRPC: Mark the cred for revalidation if the server rejects it
    - tracing: Increase trace array ref count on enable and filter files
    - ata: libahci: clear pending interrupt status
    - ext4: remove the 'group' parameter of ext4_trim_extent
    - ext4: add new helper interface ext4_try_to_trim_range()
    - ext4: scope ret locally in ext4_try_to_trim_range()
    - ext4: change s_last_trim_minblks type to unsigned long
    - ext4: mark group as trimmed only if it was fully scanned
    - ext4: replace the traditional ternary conditional operator with with
      max()/min()
    - ext4: move setting of trimmed bit into ext4_try_to_trim_range()
    - ext4: do not let fstrim block system suspend
    - ASoC: meson: spdifin: start hw on dai probe
    - netfilter: nf_tables: disallow element removal on anonymous sets
    - bpf: Avoid deadlock when using queue and stack maps from NMI
    - selftests/tls: Add {} to avoid static checker warning
    - selftests: tls: swap the TX and RX sockets in some tests
    - ASoC: imx-audmix: Fix return error with devm_clk_get()
    - i40e: Fix for persistent lldp support
    - SAUCE: Revert "UBUNTU: SAUCE: i40e Fix GPF when deleting VMs"
    - i40e: Remove scheduling while atomic possibility
    - i40e: Fix warning message and call stack during rmmod i40e driver
    - i40e: Fix VF VLAN offloading when port VLAN is configured
    - powerpc/perf/hv-24x7: Update domain value check
    - dccp: fix dccp_v4_err()/dccp_v6_err() again
    - net: hns3: add 5ms delay before clear firmware reset irq source
    - net: bridge: use DEV_STATS_INC()
    - team: fix null-ptr-deref when team device type is changed
    - net: rds: Fix possible NULL-pointer dereference
    - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
    - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
    - Input: i8042 - add quirk for TUXEDO Gemini 17 Gen1/Clevo PD70PN
    - scsi: qla2xxx: Fix update_fcport for current_topology
    - scsi: qla2xxx: Fix deletion race condition
    - drm/amd/display: Reinstate LFC optimization
    - drm/amd/display: Fix LFC multiplier changing erratically
    - drm/amd/display: prevent potential division by zero errors
    - ata: libata: disallow dev-initiated LPM transitions to unsupported states
    - MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled
    - clk: tegra: fix error return case for recalc_rate
    - ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot
    - bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up
    - xtensa: add default definition for XCHAL_HAVE_DIV32
    - xtensa: iss/network: make functions static
    - xtensa: boot: don't add include-dirs
    - xtensa: boot/lib: fix function prototypes
    - gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip
    - parisc: sba: Fix compile warning wrt list of SBA devices
    - parisc: iosapic.c: Fix sparse warnings
    - parisc: drivers: Fix sparse warning
    - parisc: irq: Make irq_stack_union static to avoid sparse warning
    - selftests/ftrace: Correctly enable event in instance-event.tc
    - ring-buffer: Avoid softlockup in ring_buffer_resize()
    - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
    - spi: nxp-fspi: reset the FLSHxCR1 registers
    - bpf: Clarify error expectations from bpf_clone_redirect
    - powerpc/watchpoints: Annotate atomic context in more places
    - ncsi: Propagate carrier gain/loss events to the NCSI controller
    - fbdev/sh7760fb: Depend on FB=y
    - nvme-pci: do not set the NUMA node of device if it has none
    - watchdog: iTCO_wdt: No need to stop the timer in probe
    - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running
    - i40e: improve locking of mac_filter_hash
    - i40e: always propagate error value in i40e_set_vsi_promisc()
    - i40e: fix return of uninitialized aq_ret in i40e_set_vsi_promisc
    - smack: Record transmuting in smk_transmuted
    - smack: Retrieve transmuting information in smack_inode_getsecurity()
    - Smack:- Use overlay inode label in smack_inode_copy_up()
    - serial: 8250_port: Check IRQ data before use
    - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
    - ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre
      M70q
    - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES
    - i2c: i801: unregister tco_pdev in i801_probe() error path
    - ring-buffer: Update "shortest_full" in polling
    - btrfs: properly report 0 avail for very full file systems
    - net: thunderbolt: Fix TCPv6 GSO checksum calculation
    - ata: libata-core: Fix ata_port_request_pm() locking
    - ata: libata-core: Fix port and device removal
    - ata: libata-core: Do not register PM operations for SAS ports
    - ata: libata-sata: increase PMP SRST timeout to 10s
    - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC
    - rbd: move rbd_dev_refresh() definition
    - rbd: decouple header read-in from updating rbd_dev->header
    - rbd: decouple parent info read-in from updating rbd_dev
    - rbd: take header_rwsem in rbd_dev_refresh() only when updating
    - Revert "PCI: qcom: Disable write access to read only registers for IP
      v2.3.3"
    - scsi: zfcp: Fix a double put in zfcp_port_enqueue()
    - qed/red_ll2: Fix undefined behavior bug in struct qed_ll2_info
    - wifi: mwifiex: Fix tlv_buf_left calculation
    - net: replace calls to sock->ops->connect() with kernel_connect()
    - net: prevent rewrite of msg_name in sock_sendmsg()
    - wifi: iwlwifi: dbg_ini: fix structure packing
    - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
    - drivers/net: process the result of hdlc_open() and add call of hdlc_close()
      in uhdlc_close()
    - wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling
    - regmap: rbtree: Fix wrong register marked as in-cache when creating new node
    - ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig
    - scsi: target: core: Fix deadlock due to recursive locking
    - NFS4: Trace state recovery operation
    - NFS: Add a helper nfs_client_for_each_server()
    - NFSv4: Fix a nfs4_state_manager() race
    - modpost: add missing else to the "of" check
    - net: fix possible store tearing in neigh_periodic_work()
    - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
    - net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent
    - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
    - net: nfc: llcp: Add lock when modifying device list
    - netfilter: handle the connecting collision properly in
      nf_conntrack_proto_sctp
    - net: stmmac: dwmac-stm32: fix resume on STM32 MCU
    - tcp: fix quick-ack counting to count actual ACKs of new data
    - tcp: fix delayed ACKs for MSS boundary condition
    - sctp: update transport state when processing a dupcook packet
    - sctp: update hb timer immediately after users change hb_interval
    - cpupower: add Makefile dependencies for install targets
    - RDMA/core: Require admin capabilities to set system parameters
    - IB/mlx4: Fix the size of a buffer in add_port_entries()
    - gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config()
    - gpio: pxa: disable pinctrl calls for MMP_GPIO
    - RDMA/cma: Fix truncation compilation warning in make_cma_ports
    - RDMA/uverbs: Fix typo of sizeof argument
    - RDMA/siw: Fix connection failure handling
    - RDMA/mlx5: Fix NULL string error
    - parisc: Restore __ldcw_align for PA-RISC 2.0 processors
    - NFS: Fix a race in __nfs_list_for_each_server()
    - ima: rework CONFIG_IMA dependency block
    - [Config] Update IMA_BLACKLIST_KEYRING and IMA_LOAD_X509
    - xen/events: replace evtchn_rwlock with RCU
    - Linux 5.4.258

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Fri, 05 Jan 2024 14:59:41 +0100

linux (5.4.0-169.187) focal; urgency=medium

  * focal/linux: 5.4.0-169.187 -proposed tracker (LP: #2044375)

  * USB bus error after upgrading to proposed kernel on lunar, jammy and focal
    (LP: #2043197)
    - USB: core: Fix oversight in SuperSpeed initialization

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
    - [Packaging] resync update-dkms-versions helper
    - [Packaging] update annotations scripts

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Thu, 23 Nov 2023 14:04:39 +0100

linux (5.4.0-168.186) focal; urgency=medium

  * focal/linux: 5.4.0-168.186 -proposed tracker (LP: #2041652)

  * Focal update: v5.4.257 upstream stable release (LP: #2040284)
    - erofs: ensure that the post-EOF tails are all zeroed
    - ARM: pxa: remove use of symbol_get()
    - mmc: au1xmmc: force non-modular build and remove symbol_get usage
    - net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
    - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
    - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
    - USB: serial: option: add Quectel EM05G variant (0x030e)
    - USB: serial: option: add FOXCONN T99W368/T99W373 product
    - HID: wacom: remove the battery when the EKR is off
    - staging: rtl8712: fix race condition
    - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race
      condition
    - serial: sc16is7xx: fix bug when first setting GPIO direction
    - firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
    - fsi: master-ast-cf: Add MODULE_FIRMWARE macro
    - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
    - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
    - pinctrl: amd: Don't show `Invalid config param` errors
    - 9p: virtio: make sure 'offs' is initialized in zc_request
    - ASoC: da7219: Flush pending AAD IRQ when suspending
    - ASoC: da7219: Check for failure reading AAD IRQ events
    - ethernet: atheros: fix return value check in atl1c_tso_csum()
    - vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
    - m68k: Fix invalid .section syntax
    - s390/dasd: use correct number of retries for ERP requests
    - s390/dasd: fix hanging device after request requeue
    - fs/nls: make load_nls() take a const parameter
    - ASoc: codecs: ES8316: Fix DMIC config
    - ASoC: atmel: Fix the 8K sample parameter in I2SC master
    - platform/x86: intel: hid: Always call BTNL ACPI method
    - platform/x86: huawei-wmi: Silence ambient light sensor
    - security: keys: perform capable check only on privileged operations
    - clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM
    - net: usb: qmi_wwan: add Quectel EM05GV2
    - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
    - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
    - netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
    - bnx2x: fix page fault following EEH recovery
    - sctp: handle invalid error codes without calling BUG()
    - cifs: add a warning when the in-flight count goes negative
    - scsi: storvsc: Always set no_report_opcodes
    - ALSA: seq: oss: Fix racy open/close of MIDI devices
    - platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE
      notifications
    - powerpc/32s: Fix assembler warning about r0
    - udf: Check consistency of Space Bitmap Descriptor
    - udf: Handle error when adding extent to a file
    - Revert "net: macsec: preserve ingress frame ordering"
    - reiserfs: Check the return value from __getblk()
    - eventfd: Export eventfd_ctx_do_read()
    - eventfd: prevent underflow for eventfd semaphores
    - new helper: lookup_positive_unlocked()
    - fs: Fix error checking for d_hash_and_lookup()
    - tmpfs: verify {g,u}id mount options correctly
    - OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd()
    - x86/asm: Make more symbols local
    - x86/boot: Annotate local functions
    - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved
    - perf/imx_ddr: don't enable counter0 if none of 4 counters are used
    - cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
    - bpf: Clear the probe_addr for uprobe
    - tcp: tcp_enter_quickack_mode() should be static
    - regmap: rbtree: Use alloc_flags for memory allocations
    - spi: tegra20-sflash: fix to check return value of platform_get_irq() in
      tegra_sflash_probe()
    - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also
      in case of OOM
    - wifi: mwifiex: Fix OOB and integer underflow when rx packets
    - mwifiex: switch from 'pci_' to 'dma_' API
    - wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
    - crypto: stm32 - Properly handle pm_runtime_get failing
    - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
    - crypto: caam - fix unchecked return value error
    - hwrng: iproc-rng200 - use semicolons rather than commas to separate
      statements
    - hwrng: iproc-rng200 - Implement suspend and resume calls
    - lwt: Fix return values of BPF xmit ops
    - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
    - fs: ocfs2: namei: check return value of ocfs2_add_entry()
    - wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
    - wifi: mwifiex: Fix missed return in oob checks failed path
    - wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
    - wifi: ath9k: protect WMI command response buffer replacement with a lock
    - wifi: mwifiex: avoid possible NULL skb pointer dereference
    - wifi: ath9k: use IS_ERR() with debugfs_create_dir()
    - net: arcnet: Do not call kfree_skb() under local_irq_disable()
    - mlxsw: i2c: Fix chunk size setting in output mailbox buffer
    - mlxsw: i2c: Limit single transaction buffer size
    - netrom: Deny concurrent connect().
    - drm/bridge: tc358764: Fix debug print parameter order
    - quota: avoid increasing DQST_LOOKUPS when iterating over dirty/inuse list
    - quota: factor out dquot_write_dquot()
    - quota: rename dquot_active() to inode_quota_active()
    - quota: add new helper dquot_active()
    - quota: fix dqput() to follow the guarantees dquot_srcu should provide
    - drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar()
    - ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger
    - ARM: dts: BCM53573: Add cells sizes to PCIe node
    - ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
    - drm/etnaviv: fix dumping of active MMU context
    - ARM: dts: s3c6410: move fixed clocks under root node in Mini6410
    - ARM: dts: s3c6410: align node SROM bus node name with dtschema in Mini6410
    - ARM: dts: s3c64xx: align pinctrl with dtschema
    - ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
    - ARM: dts: s5pv210: add RTC 32 KHz clock in SMDKV210
    - ARM: dts: s5pv210: use defines for IRQ flags in SMDKV210
    - ARM: dts: s5pv210: correct ethernet unit address in SMDKV210
    - ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
    - ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
    - drm: adv7511: Fix low refresh rate register for ADV7533/5
    - ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
    - arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC
    - drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl'
    - md/bitmap: don't set max_write_behind if there is no write mostly device
    - md/md-bitmap: hold 'reconfig_mutex' in backlog_store()
    - drm/tegra: Remove superfluous error messages around platform_get_irq()
    - drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
    - of: unittest: fix null pointer dereferencing in
      of_unittest_find_node_by_name()
    - drm/armada: Fix off-by-one error in armada_overlay_get_property()
    - drm/panel: simple: Add missing connector type and pixel format for AUO
      T215HVN01
    - ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig
    - [Config] Update annotations after CONFIG_IMA_TRUSTED_KEYRING removal
    - drm/msm/mdp5: Don't leak some plane state
    - smackfs: Prevent underflow in smk_set_cipso()
    - audit: fix possible soft lockup in __audit_inode_child()
    - drm/mediatek: Fix potential memory leak if vmap() fail
    - of: unittest: Fix overlay type in apply/revert check
    - ALSA: ac97: Fix possible error value of *rac97
    - ipmi:ssif: Add check for kstrdup
    - ipmi:ssif: Fix a memory leak when scanning for an adapter
    - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
    - clk: sunxi-ng: Modify mismatched function name
    - PCI: Mark NVIDIA T4 GPUs to avoid bus reset
    - PCI: pciehp: Use RMW accessors for changing LNKCTL
    - PCI/ASPM: Use RMW accessors for changing LNKCTL
    - clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op
    - powerpc/fadump: reset dump area size if fadump memory reserve fails
    - PCI: Add #defines for Enter Compliance, Transmit Margin
    - drm/amdgpu: Correct Transmit Margin masks
    - drm/amdgpu: Replace numbers with PCI_EXP_LNKCTL2 definitions
    - drm/amdgpu: Prefer pcie_capability_read_word()
    - drm/amdgpu: Use RMW accessors for changing LNKCTL
    - drm/radeon: Correct Transmit Margin masks
    - drm/radeon: Replace numbers with PCI_EXP_LNKCTL2 definitions
    - drm/radeon: Prefer pcie_capability_read_word()
    - drm/radeon: Use RMW accessors for changing LNKCTL
    - wifi: ath10k: Use RMW accessors for changing LNKCTL
    - nfs/blocklayout: Use the passed in gfp flags
    - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
    - jfs: validate max amount of blocks before allocation.
    - fs: lockd: avoid possible wrong NULL parameter
    - NFSD: da_addr_body field missing in some GETDEVICEINFO replies
    - NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN
    - media: v4l2-fwnode: fix v4l2_fwnode_parse_link handling
    - media: v4l2-fwnode: simplify v4l2_fwnode_parse_link
    - media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
    - drivers: usb: smsusb: fix error handling code in smsusb_init_device
    - media: dib7000p: Fix potential division by zero
    - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
    - media: cx24120: Add retval check for cx24120_message_send()
    - media: mediatek: vcodec: Return NULL if no vdec_fb is found
    - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
    - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
    - scsi: be2iscsi: Add length check when parsing nlattrs
    - scsi: qla4xxx: Add length check when parsing nlattrs
    - serial: sprd: getting port index via serial aliases only
    - serial: sprd: remove redundant sprd_port cleanup
    - serial: sprd: Assign sprd_port after initialized to avoid wrong access
    - serial: sprd: Fix DMA buffer leak issue
    - x86/APM: drop the duplicate APM_MINOR_DEV macro
    - scsi: qedf: Do not touch __user pointer in
      qedf_dbg_stop_io_on_error_cmd_read() directly
    - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read()
      directly
    - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read()
      directly
    - coresight: tmc: Explicit type conversions to prevent integer overflow
    - dma-buf/sync_file: Fix docs syntax
    - driver core: test_async: fix an error code
    - IB/uverbs: Fix an potential error pointer dereference
    - iommu/vt-d: Fix to flush cache of PASID directory table
    - media: go7007: Remove redundant if statement
    - USB: gadget: f_mass_storage: Fix unused variable warning
    - media: i2c: ov5640: Configure HVP lines in s_power callback
    - media: ov5640: Enable MIPI interface in ov5640_set_power_mipi()
    - media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
    - media: ov2680: Remove auto-gain and auto-exposure controls
    - media: ov2680: Fix ov2680_bayer_order()
    - media: ov2680: Fix vflip / hflip set functions
    - media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors
    - scsi: core: Use 32-bit hostnum in scsi_host_lookup()
    - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
    - serial: tegra: handle clk prepare error in tegra_uart_hw_init()
    - amba: bus: fix refcount leak
    - Revert "IB/isert: Fix incorrect release of isert connection"
    - RDMA/siw: Balance the reference of cep->kref in the error path
    - RDMA/siw: Correct wrong debug message
    - HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()
    - HID: multitouch: Correct devm device reference for hidinput input_dev name
    - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS
    - tracing: Fix race issue between cpu buffer write and swap
    - phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328
    - phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate
    - phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write
    - rpmsg: glink: Add check for kstrdup
    - mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume()
    - um: Fix hostaudio build errors
    - dmaengine: ste_dma40: Add missing IRQ check in d40_probe
    - cpufreq: Fix the race condition while updating the transition_task of policy
    - virtio_ring: fix avail_wrap_counter in virtqueue_add_packed
    - skbuff: skb_segment, Call zero copy functions before using skbuff frags
    - PM / devfreq: Fix leak in devfreq_dev_release()
    - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
    - ipmi_si: fix a memleak in try_smi_init()
    - ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
    - backlight/gpio_backlight: Compare against struct fb_info.device
    - backlight/bd6107: Compare against struct fb_info.device
    - backlight/lv5207lp: Compare against struct fb_info.device
    - xtensa: PMU: fix base address for the newer hardware
    - media: dvb: symbol fixup for dvb_attach()
    - ntb: Drop packets when qp link is down
    - ntb: Clean up tx tail index on link down
    - ntb: Fix calculation ntb_transport_tx_free_entry()
    - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
    - procfs: block chmod on /proc/thread-self/comm
    - parisc: Fix /proc/cpuinfo output for lscpu
    - dlm: fix plock lookup when using multiple lockspaces
    - dccp: Fix out of bounds access in DCCP error handler
    - X.509: if signature is unsupported skip validation
    - net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
    - fsverity: skip PKCS#7 parser when keyring is empty
    - pstore/ram: Check start of empty przs during init
    - s390/ipl: add missing secure/has_secure file to ipl type 'unknown'
    - crypto: stm32 - fix loop iterating through scatterlist for DMA
    - cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
    - sc16is7xx: Set iobase to device index
    - serial: sc16is7xx: fix broken port 0 uart init
    - usb: typec: tcpci: clear the fault status bit
    - udf: initialize newblock to 0
    - drm: fix double free for gbo in drm_gem_vram_init and drm_gem_vram_create
    - net/ipv6: SKB symmetric hash should incorporate transport ports
    - scsi: qla2xxx: fix inconsistent TMF timeout
    - scsi: qla2xxx: Fix erroneous link up failure
    - scsi: qla2xxx: Turn off noisy message log
    - scsi: qla2xxx: Remove unsupported ql2xenabledif option
    - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
    - drm/ast: Fix DRAM init on AST2200
    - lib/test_meminit: allocate pages up to order MAX_ORDER
    - parisc: led: Fix LAN receive and transmit LEDs
    - parisc: led: Reduce CPU overhead for disk & lan LED computation
    - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
    - soc: qcom: qmi_encdec: Restrict string length in decode
    - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
    - kconfig: fix possible buffer overflow
    - perf annotate bpf: Don't enclose non-debug code with an assert()
    - x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm()
    - perf top: Don't pass an ERR_PTR() directly to perf_session__delete()
    - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
    - pwm: lpc32xx: Remove handling of PWM channels
    - sctp: annotate data-races around sk->sk_wmem_queued
    - ipv4: annotate data-races around fi->fib_dead
    - net: read sk->sk_family once in sk_mc_loop()
    - igb: disable virtualization features on 82580
    - veth: Fixing transmit return status for dropped packets
    - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
    - af_unix: Fix data-races around user->unix_inflight.
    - af_unix: Fix data-race around unix_tot_inflight.
    - af_unix: Fix data-races around sk->sk_shutdown.
    - af_unix: Fix data race around sk->sk_err.
    - kcm: Destroy mutex in kcm_exit_net()
    - igc: Change IGC_MIN to allow set rx/tx value between 64 and 80
    - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
    - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
    - s390/zcrypt: don't leak memory if dev_set_name() fails
    - idr: fix param name in idr_alloc_cyclic() doc
    - ip_tunnels: use DEV_STATS_INC()
    - net: hns3: fix the port information display when sfp is absent
    - sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()
    - ata: sata_gemini: Add missing MODULE_DESCRIPTION
    - ata: pata_ftide010: Add missing MODULE_DESCRIPTION
    - fuse: nlookup missing decrement in fuse_direntplus_link
    - btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART
    - btrfs: use the correct superblock to compare fsid in btrfs_validate_super
    - mtd: rawnand: brcmnand: Fix crash during the panic_write
    - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
    - mtd: rawnand: brcmnand: Fix potential false time out warning
    - perf hists browser: Fix hierarchy mode header
    - perf tools: Handle old data in PERF_RECORD_ATTR
    - usb: typec: tcpm: Refactor tcpm_handle_vdm_request payload handling
    - usb: typec: tcpm: Refactor tcpm_handle_vdm_request
    - usb: typec: bus: verify partner exists in typec_altmode_attention
    - ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2
    - clk: imx8mm: Move 1443X/1416X PLL clock structure to common place
    - net: ipv4: fix one memleak in __inet_del_ifa()
    - net: ethernet: mvpp2_main: fix possible OOB write in
      mvpp2_ethtool_get_rxnfc()
    - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in
      mtk_hwlro_get_fdir_all()
    - r8152: check budget for r8152_poll()
    - kcm: Fix memory leak in error path of kcm_sendmsg()
    - platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors
    - mlxbf-tmfifo: sparse tags for config access
    - platform/mellanox: mlxbf-tmfifo: Drop jumbo frames
    - net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
    - ixgbe: fix timestamp configuration code
    - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
    - drm/amd/display: Fix a bug when searching for insert_above_mpcc
    - parisc: Drop loops_per_jiffy from per_cpu struct
    - autofs: fix memory leak of waitqueues in autofs_catatonic_mode
    - btrfs: output extra debug info if we failed to find an inline backref
    - locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock
    - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
    - kernel/fork: beware of __put_task_struct() calling context
    - ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470
    - perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09
    - hw_breakpoint: fix single-stepping when using bpf_overflow_handler
    - devlink: remove reload failed checks in params get/set callbacks
    - wifi: ath9k: fix printk specifier
    - wifi: mwifiex: fix fortify warning
    - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
    - tpm_tis: Resend command to recover from data transfer errors
    - mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450
    - alx: fix OOB-read compiler warning
    - wifi: mac80211_hwsim: drop short frames
    - drm/exynos: fix a possible null-pointer dereference due to data race in
      exynos_drm_crtc_atomic_disable()
    - bus: ti-sysc: Configure uart quirks for k3 SoC
    - md: raid1: fix potential OOB in raid1_remove_disk()
    - ext2: fix datatype of block number in ext2_xattr_set2()
    - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
    - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
    - powerpc/pseries: fix possible memory leak in ibmebus_bus_init()
    - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
    - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
    - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
    - media: anysee: fix null-ptr-deref in anysee_master_xfer
    - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
    - media: tuners: qt1010: replace BUG_ON with a regular error
    - media: pci: cx23885: replace BUG with error return
    - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
    - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
    - serial: cpm_uart: Avoid suspicious locking
    - media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning
    - kobject: Add sanity check for kset->kobj.ktype in kset_register()
    - tools features: Add feature test to check if libbfd has buildid support
    - perf jevents: Make build dependency on test JSONs
    - perf tools: Add an option to build without libbfd
    - btrfs: move btrfs_pinned_by_swapfile prototype into volumes.h
    - btrfs: add a helper to read the superblock metadata_uuid
    - btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super
    - selftests: tracing: Fix to unmount tracefs for recovering environment
    - md/raid1: fix error: ISO C90 forbids mixed declarations
    - attr: block mode changes of symlinks
    - btrfs: fix lockdep splat and potential deadlock after failure running
      delayed items
    - tracing: Have current_trace inc the trace array ref count
    - tracing: Have option files inc the trace array ref count
    - nfsd: fix change_info in NFSv4 RENAME replies
    - tracefs: Add missing lockdown check to tracefs_create_dir()
    - i2c: aspeed: Reset the i2c controller when timeout occurs
    - scsi: megaraid_sas: Fix deadlock on firmware crashdump
    - ext4: fix rec_len verify error
    - mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller
    - drm/amdgpu: fix amdgpu_cs_p1_user_fence
    - Linux 5.4.257

  * Focal update: v5.4.257 upstream stable release (LP: #2040284) //
    CVE-2023-39189
    - netfilter: nfnetlink_osf: avoid OOB read

  * CVE-2023-45871
    - igb: set max size RX buffer when store bad packet is enabled

  * CVE-2023-39193
    - netfilter: xt_sctp: validate the flag_info count

  * CVE-2023-39192
    - netfilter: xt_u32: validate user space input

  * CVE-2023-31085
    - ubi: Refuse attaching if mtd's erasesize is 0

  * CVE-2023-5717
    - perf: Disallow mis-matched inherited group reads

  * CVE-2023-5178
    - nvmet-tcp: move send/recv error handling in the send/recv methods instead of
      call-sites
    - nvmet-tcp: Fix a possible UAF in queue intialization setup

  * CVE-2023-42754
    - ipv4: fix null-deref in ipv4_link_failure

  * Focal update: v5.4.256 upstream stable release (LP: #2039446)
    - powerpc/pmac/smp: Avoid unused-variable warnings
    - powerpc/pmac/smp: Drop unnecessary volatile qualifier
    - Revert "MIPS: Alchemy: fix dbdma2"
    - Linux 5.4.256

  * Focal update: v5.4.255 upstream stable release (LP: #2039440)
    - mmc: sdhci_f_sdh30: convert to devm_platform_ioremap_resource
    - mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
    - selftests: forwarding: tc_flower: Relax success criterion
    - macsec: Fix traffic counters/statistics
    - macsec: use DEV_STATS_INC()
    - drm/radeon: Fix integer overflow in radeon_cs_parser_init
    - ALSA: emu10k1: roll up loops in DSP setup code for Audigy
    - quota: Properly disable quotas when add_dquot_ref() fails
    - quota: fix warning in dqgrab()
    - HID: add quirk for 03f0:464a HP Elite Presenter Mouse
    - ovl: check type and offset of struct vfsmount in ovl_entry
    - udf: Fix uninitialized array access for some pathnames
    - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
    - MIPS: dec: prom: Address -Warray-bounds warning
    - FS: JFS: Fix null-ptr-deref Read in txBegin
    - FS: JFS: Check for read-only mounted filesystem in txBegin
    - media: v4l2-mem2mem: add lock to protect parameter num_rdy
    - media: platform: mediatek: vpu: fix NULL ptr dereference
    - usb: chipidea: imx: don't request QoS for imx8ulp
    - gfs2: Fix possible data races in gfs2_show_options()
    - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
    - Bluetooth: L2CAP: Fix use-after-free
    - drm/amdgpu: Fix potential fence use-after-free v2
    - ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
    - ALSA: hda: fix a possible null-pointer dereference due to data race in
      snd_hdac_regmap_sync()
    - powerpc/kasan: Disable KCOV in KASAN code
    - IMA: allow/fix UML builds
    - iio: add addac subdirectory
    - iio: adc: stx104: Utilize iomap interface
    - iio: adc: stx104: Implement and utilize register structures
    - iio: stx104: Move to addac subdirectory
    - iio: addac: stx104: Fix race condition for stx104_write_raw()
    - iio: addac: stx104: Fix race condition when converting analog-to-digital
    - iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration in IRTE
    - PM-runtime: add tracepoints for usage_count changes
    - PM: runtime: Add pm_runtime_get_if_active()
    - ALSA: hda: Fix unhandled register update during auto-suspend period
    - irqchip/mips-gic: Get rid of the reliance on irq_cpu_online()
    - irqchip/mips-gic: Use raw spinlock for gic_lock
    - interconnect: Move internal structs into a separate file
    - interconnect: Add helpers for enabling/disabling a path
    - usb: dwc3: qcom: Add helper functions to enable,disable wake irqs
    - USB: dwc3: qcom: fix NULL-deref on suspend
    - mmc: bcm2835: fix deferred probing
    - mmc: sunxi: fix deferred probing
    - leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename
    - tracing/probes: Have process_fetch_insn() take a void * instead of pt_regs
    - tracing/probes: Fix to update dynamic data counter if fetcharg uses it
    - net/ncsi: Fix gma flag setting after response
    - nfsd4: kill warnings on testing stateids with mismatched clientids
    - nfsd: Remove incorrect check in nfsd4_validate_stateid
    - virtio-mmio: convert to devm_platform_ioremap_resource
    - virtio-mmio: Use to_virtio_mmio_device() to simply code
    - virtio-mmio: don't break lifecycle of vm_dev
    - i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
    - fbdev: mmp: fix value check in mmphw_probe()
    - powerpc/rtas_flash: allow user copy to flash block cache objects
    - tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32
      platforms
    - btrfs: fix BUG_ON condition in btrfs_cancel_balance
    - net: xfrm: Fix xfrm_address_filter OOB read
    - net: af_key: fix sadb_x_filter validation
    - xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c
    - xfrm: fix slab-use-after-free in decode_session6
    - ip6_vti: fix slab-use-after-free in decode_session6
    - ip_vti: fix potential slab-use-after-free in decode_session6
    - selftests: mirror_gre_changes: Tighten up the TTL test match
    - ipvs: fix racy memcpy in proc_do_sync_threshold
    - netfilter: nft_dynset: disallow object maps
    - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
    - i40e: fix misleading debug logs
    - net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
    - sock: Fix misuse of sk_under_memory_pressure()
    - net: do not allow gso_size to be set to GSO_BY_FRAGS
    - bus: ti-sysc: Improve reset to work with modules with no sysconfig
    - bus: ti-sysc: Flush posted write on enable before reset
    - ARM: dts: imx7s: Drop dma-apb interrupt-names
    - ARM: dts: imx: Adjust dma-apbh node name
    - ARM: dts: imx: Set default tuning step for imx7d usdhc
    - ARM: dts: imx: Set default tuning step for imx6sx usdhc
    - ASoC: rt5665: add missed regulator_bulk_disable
    - ASoC: meson: axg-tdm-formatter: fix channel slot allocation
    - serial: 8250: Fix oops for port->pm on uart_change_pm()
    - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback
      interfaces.
    - cifs: Release folio lock on fscache read hit.
    - mmc: wbsd: fix double mmc_free_host() in wbsd_init()
    - mmc: block: Fix in_flight[issue_type] value error
    - netfilter: set default timeout to 3 secs for sctp shutdown send and recv
      state
    - virtio-net: set queues after driver_ok
    - net: fix the RTO timer retransmitting skb every 1ms if linear option is
      enabled
    - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
    - mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
    - net: phy: broadcom: stub c45 read/write for 54810
    - PCI: acpiphp: Reassign resources on bridge if necessary
    - dlm: improve plock logging if interrupted
    - dlm: replace usage of found with dedicated list iterator variable
    - fs: dlm: add pid to debug log
    - fs: dlm: change plock interrupted message to debug again
    - fs: dlm: use dlm_plock_info for do_unlock_close
    - fs: dlm: fix mismatch of plock results from userspace
    - MIPS: cpu-features: Enable octeon_cache by cpu_type
    - MIPS: cpu-features: Use boot_cpu_type for CPU type based features
    - fbdev: Improve performance of sys_imageblit()
    - fbdev: Fix sys_imageblit() for arbitrary image widths
    - fbdev: fix potential OOB read in fast_imageblit()
    - dm integrity: increase RECALC_SECTORS to improve recalculate speed
    - dm integrity: reduce vmalloc space footprint on 32-bit architectures
    - ALSA: pcm: Set per-card upper limit of PCM buffer allocations
    - ALSA: pcm: Use SG-buffer only when direct DMA is available
    - ALSA: pcm: Fix potential data race at PCM memory allocation helpers
    - regmap: Account for register length in SMBus I/O limits
    - ASoC: fsl_sai: Refine enable/disable TE/RE sequence in trigger()
    - ASoC: fsl_sai: Add new added registers and new bit definition
    - ASoC: fsl_sai: Disable bit clock with transmitter
    - drm/amd/display: do not wait for mpc idle if tg is disabled
    - drm/amd/display: check TG is non-null before checking if enabled
    - tracing: Fix memleak due to race between current_tracer and trace
    - octeontx2-af: SDP: fix receive link config
    - sock: annotate data-races around prot->memory_pressure
    - dccp: annotate data-races in dccp_poll()
    - ipvlan: Fix a reference count leak warning in ipvlan_ns_exit()
    - net: bgmac: Fix return value check for fixed_phy_register()
    - net: bcmgenet: Fix return value check for fixed_phy_register()
    - net: validate veth and vxcan peer ifindexes
    - igb: Avoid starting unnecessary workqueues
    - net/sched: fix a qdisc modification with ambiguous command request
    - net: remove bond_slave_has_mac_rcu()
    - bonding: fix macvlan over alb bond support
    - ibmveth: Use dcbf rather than dcbfl
    - NFSv4: Fix dropped lock for racing OPEN and delegation return
    - clk: Fix slab-out-of-bounds error in devm_clk_release()
    - nfsd: Fix race to FREE_STATEID and cl_revoked
    - batman-adv: Trigger events for auto adjusted MTU
    - batman-adv: Don't increase MTU when set by user
    - batman-adv: Do not get eth header before batadv_check_management_packet
    - batman-adv: Fix TT global entry leak when client roamed back
    - batman-adv: Fix batadv_v_ogm_aggr_send memory leak
    - batman-adv: Hold rtnl lock during MTU update via netlink
    - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
    - radix tree: remove unused variable
    - media: vcodec: Fix potential array out-of-bounds in encoder queue_setup
    - PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root
      bus
    - drm/display/dp: Fix the DP DSC Receiver cap size
    - mm: allow a controlled amount of unfairness in the page lock
    - rtnetlink: Reject negative ifindexes in RTM_NEWLINK
    - ALSA: pcm: Fix build error on m68k and others
    - Revert "ALSA: pcm: Use SG-buffer only when direct DMA is available"
    - interconnect: Do not skip aggregation for disabled paths
    - ALSA: pcm: Check for null pointer of pointer substream before dereferencing
      it
    - Documentation/sysctl: document page_lock_unfairness
    - irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
    - scsi: snic: Fix double free in snic_tgt_create()
    - scsi: core: raid_class: Remove raid_component_add()
    - clk: Fix undefined reference to `clk_rate_exclusive_{get,put}'
    - pinctrl: renesas: rza2: Add lock around
      pinctrl_generic{{add,remove}_group,{add,remove}_function}
    - dma-buf/sw_sync: Avoid recursive lock during fence signal
    - Linux 5.4.255

  * Focal update: v5.4.254 upstream stable release (LP: #2039291)
    - mmc: moxart: read scr register without changing byte order
    - ipv6: adjust ndisc_is_useropt() to also return true for PIO
    - dmaengine: pl330: Return DMA_PAUSED when transaction is paused
    - drm/nouveau/gr: enable memory loads on helper invocation on all channels
    - radix tree test suite: fix incorrect allocation size for pthreads
    - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
    - iio: cros_ec: Fix the allocation size for cros_ec_command
    - binder: fix memory leak in binder_init()
    - usb-storage: alauda: Fix uninit-value in alauda_check_media()
    - usb: dwc3: Properly handle processing of pending events
    - usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
    - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
    - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
    - x86: Move gds_ucode_mitigated() declaration to header
    - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
    - selftests/rseq: Fix build with undefined __weak
    - mISDN: Update parameter type of dsp_cmx_send()
    - net/packet: annotate data-races around tp->status
    - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
    - dccp: fix data-race around dp->dccps_mss_cache
    - drivers: net: prevent tun_build_skb() to exceed the packet size limit
    - IB/hfi1: Fix possible panic during hotplug remove
    - wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
    - dmaengine: mcf-edma: Fix a potential un-allocated memory access
    - net/mlx5: Allow 0 for total host VFs
    - ibmvnic: Handle DMA unmapping of login buffs in release functions
    - btrfs: don't stop integrity writeback too early
    - btrfs: set cache_block_group_error if we find an error
    - nvme-tcp: fix potential unbalanced freeze & unfreeze
    - nvme-rdma: fix potential unbalanced freeze & unfreeze
    - netfilter: nf_tables: report use refcount overflow
    - scsi: core: Fix legacy /proc parsing buffer overflow
    - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
    - scsi: 53c700: Check that command slot is not NULL
    - scsi: snic: Fix possible memory leak if device_add() fails
    - scsi: core: Fix possible memory leak if device_add() fails
    - alpha: remove __init annotation from exported page_is_ram()
    - sch_netem: fix issues in netem_change() vs get_dist_table()
    - Linux 5.4.254

  * Focal update: v5.4.253 upstream stable release (LP: #2038652)
    - jbd2: fix incorrect code style
    - jbd2: fix kernel-doc markups
    - jbd2: remove redundant buffer io error checks
    - jbd2: recheck chechpointing non-dirty buffer
    - jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
    - gpio: tps68470: Make tps68470_gpio_output() always set the initial value
    - bcache: remove 'int n' from parameter list of bch_bucket_alloc_set()
    - bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
    - btrfs: qgroup: catch reserved space leaks at unmount time
    - btrfs: fix race between quota disable and relocation
    - btrfs: fix extent buffer leak after tree mod log failure at split_node()
    - ext4: rename journal_dev to s_journal_dev inside ext4_sb_info
    - ext4: Fix reusing stale buffer heads from last failed mounting
    - PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
    - PCI/ASPM: Factor out pcie_wait_for_retrain()
    - PCI/ASPM: Avoid link retraining race
    - dlm: cleanup plock_op vs plock_xop
    - dlm: rearrange async condition return
    - fs: dlm: interrupt posix locks only when process is killed
    - ftrace: Add information on number of page groups allocated
    - ftrace: Check if pages were allocated before calling free_pages()
    - ftrace: Store the order of pages allocated in ftrace_page
    - ftrace: Fix possible warning on checking all pages used in
      ftrace_process_locs()
    - pwm: meson: Remove redundant assignment to variable fin_freq
    - pwm: meson: Simplify duplicated per-channel tracking
    - pwm: meson: fix handling of period/duty if greater than UINT_MAX
    - scsi: qla2xxx: Fix inconsistent format argument type in qla_os.c
    - scsi: qla2xxx: Array index may go out of bound
    - uapi: General notification queue definitions
    - keys: Fix linking a duplicate key to a keyring's assoc_array
    - ext4: fix to check return value of freeze_bdev() in ext4_shutdown()
    - i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
    - vxlan: calculate correct header length for GPE
    - phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
    - ethernet: atheros: fix return value check in atl1e_tso_csum()
    - ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new
      temporary address
    - bonding: reset bond's flags when down link is P2P device
    - team: reset team's flags when down link is P2P device
    - platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
    - net/sched: mqprio: refactor nlattr parsing to a separate function
    - net/sched: mqprio: add extack to mqprio_parse_nlattr()
    - net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
    - benet: fix return value check in be_lancer_xmit_workarounds()
    - RDMA/mlx4: Make check for invalid flags stricter
    - drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
    - drm/msm/adreno: Fix snapshot BINDLESS_DATA size
    - drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
    - ASoC: fsl_spdif: Silence output on stop
    - block: Fix a source code comment in include/uapi/linux/blkzoned.h
    - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
    - ata: pata_ns87415: mark ns87560_tf_read static
    - ring-buffer: Fix wrong stat of cpu_buffer->read
    - tracing: Fix warning in trace_buffered_event_disable()
    - serial: 8250_dw: Preserve original value of DLF register
    - serial: sifive: Fix sifive_serial_console_setup() section
    - USB: serial: option: support Quectel EM060K_128
    - USB: serial: option: add Quectel EC200A module support
    - USB: serial: simple: add Kaufmann RKS+CAN VCP
    - USB: serial: simple: sort driver entries
    - can: gs_usb: gs_can_close(): add missing set of CAN state to
      CAN_STATE_STOPPED
    - Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
    - usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
    - usb: dwc3: don't reset device side if dwc3 was configured as host-only
    - usb: ohci-at91: Fix the unhandle interrupt when resume
    - USB: quirks: add quirk for Focusrite Scarlett
    - usb: xhci-mtk: set the dma max_seg_size
    - Revert "usb: xhci: tegra: Fix error check"
    - Documentation: security-bugs.rst: update preferences when dealing with the
      linux-distros group
    - Documentation: security-bugs.rst: clarify CVE handling
    - staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
    - hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
    - btrfs: check for commit error at btrfs_attach_transaction_barrier()
    - tpm_tis: Explicitly check for error code
    - irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
    - btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
    - virtio-net: fix race between set queues and probe
    - s390/dasd: fix hanging device after quiesce/resume
    - ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
    - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
    - ACPI: processor: perflib: Use the "no limit" frequency QoS
    - ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
    - cpufreq: intel_pstate: Drop ACPI _PSS states table patching
    - btrfs: qgroup: remove one-time use variables for quota_root checks
    - btrfs: qgroup: return ENOTCONN instead of EINVAL when quotas are not enabled
    - ASoC: cs42l51: fix driver to properly autoload with automatic module loading
    - arm64: Add AMPERE1 to the Spectre-BHB affected list
    - arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro
    - perf: Fix function pointer case
    - loop: Select I/O scheduler 'none' from inside add_disk()
    - word-at-a-time: use the same return type for has_zero regardless of
      endianness
    - KVM: s390: fix sthyi error handling
    - net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
    - net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
    - rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length
    - perf test uprobe_from_different_cu: Skip if there is no gcc
    - net: sched: cls_u32: Fix match key mis-addressing
    - mISDN: hfcpci: Fix potential deadlock on &hc->lock
    - net: annotate data-races around sk->sk_max_pacing_rate
    - net: add missing READ_ONCE(sk->sk_rcvlowat) annotation
    - net: add missing READ_ONCE(sk->sk_sndbuf) annotation
    - net: add missing READ_ONCE(sk->sk_rcvbuf) annotation
    - net: add missing data-race annotations around sk->sk_peek_off
    - net: add missing data-race annotation for sk_ll_usec
    - bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire
    - driver core: add device probe log helper
    - net: ll_temac: Switch to use dev_err_probe() helper
    - net: ll_temac: fix error checking of irq_of_parse_and_map()
    - net: dcb: choose correct policy to parse DCB_ATTR_BCN
    - ip6mr: Fix skb_under_panic in ip6mr_cache_report()
    - tcp_metrics: fix addr_same() helper
    - tcp_metrics: annotate data-races around tm->tcpm_stamp
    - tcp_metrics: annotate data-races around tm->tcpm_lock
    - tcp_metrics: annotate data-races around tm->tcpm_vals[]
    - tcp_metrics: annotate data-races around tm->tcpm_net
    - tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
    - scsi: zfcp: Defer fc_rport blocking until after ADISC response
    - libceph: fix potential hang in ceph_osdc_notify()
    - USB: zaurus: Add ID for A-300/B-500/C-700
    - mtd: spinand: toshiba: Fix ecc_get_status
    - mtd: rawnand: meson: fix OOB available bytes for ECC
    - fs/sysv: Null check to prevent null-ptr-deref bug
    - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
    - fs: Protect reconfiguration of sb read-write from racing writes
    - ext2: Drop fragment support
    - test_firmware: prevent race conditions by a correct implementation of
      locking
    - test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation
    - mtd: rawnand: omap_elm: Fix incorrect type in assignment
    - powerpc/mm/altmap: Fix altmap boundary check
    - selftests/rseq: check if libc rseq support is registered
    - selftests/rseq: Play nice with binaries statically linked against glibc
      2.35+
    - PM / wakeirq: support enabling wake-up irq after runtime_suspend called
    - PM: sleep: wakeirq: fix wake irq arming
    - ceph: show tasks waiting on caps in debugfs caps file
    - ceph: use kill_anon_super helper
    - ceph: defer stopping mdsc delayed_work
    - arm64: dts: stratix10: fix incorrect I2C property for SCL signal
    - ARM: dts: imx6sll: Make ssi node name same as other platforms
    - ARM: dts: imx: Align L2 cache-controller nodename with dtschema
    - ARM: dts: imx: add usb alias
    - ARM: dts: imx6sll: fixup of operating points
    - ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
    - driver core: Annotate dev_err_probe() with __must_check
    - driver code: print symbolic error code
    - drivers: core: fix kernel-doc markup for dev_err_probe()
    - Revert "driver core: Annotate dev_err_probe() with __must_check"
    - Linux 5.4.253
    - Upstream stable to v5.4.253

  * CVE-2023-37453
    - USB: hub: Clean up use of port initialization schemes and retries
    - USB: hub: Add Kconfig option to reduce number of port initialization retries
    - USB: core: Unite old scheme and new scheme descriptor reads
    - usb: hub: Check device descriptor before resusciation
    - USB: core: Change usb_get_device_descriptor() API
    - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Mon, 30 Oct 2023 11:52:53 +0100

# For older changelog entries, run 'apt-get changelog linux-cloud-tools-common'