linux-signed-amd64 (6.12.90+2) trixie-security; urgency=high

  * Sign kernel from linux 6.12.90-2

  * smb: client: reject userspace cifs.spnego descriptions
  * net/rds: reset op_nents when zerocopy page pin fails (CVE-2026-43494)

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 27 May 2026 09:38:07 +0200

linux (6.12.90-1) trixie-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.89
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.90
    - HID: playstation: Clamp num_touch_reports
    - media: uvcvideo: Enable VB2_DMABUF for metadata stream
    - [arm64] dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
    - [arm64] regulator: mt6357: fix OF node reference imbalance
    - [arm64,armhf] regulator: rk808: fix OF node reference imbalance
    - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
    - [amd64] media: intel/ipu6: fix error pointer dereference
    - media: saa7164: add ioremap return checks and cleanups
    - spi: aspeed-smc: fix controller deregistration
    - [amd64] platform/x86: hp-wmi: Ignore backlight and FnLock events
    - vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to
      copy
    - [arm64] drm/msm/gem: fix error handling in
      msm_ioctl_gem_info_get_metadata()
    - [amd64] drm/i915/psr: Init variable to avoid early exit from et alignment
      loop
    - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
    - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
    - drm/amdgpu: gate VM CPU HDP flush on reset lock
    - drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
    - drm/amdkfd: Add upper bound check for num_of_nodes
    - drm/amdgpu: Add bounds checking to ib_{get,set}_value
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
    - drm/amdgpu/vce: Prevent partial address patches
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
    - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
    - drm/amd/display: Change dither policy for 10 bpc output back to dithering
    - drm/gem: Fix inconsistent plane dimension calculation in
      drm_gem_fb_init_with_funcs()
    - drm/amdkfd: validate SVM ioctl nattr against buffer size
    - drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
    - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
    - drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
    - drm/radeon: add missing revision check for CI
    - drm/amdgpu: zero-initialize GART table on allocation
    - drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
    - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
    - drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
    - drm/amdkfd: Make all TLB-flushes heavy-weight
    - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
    - drm/amdgpu/pm: add missing revision check for CI
    - drm/amdgpu/pm: align Hawaii mclk workaround with radeon
    - [arm64] dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
    - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
    - batman-adv: fix integer overflow on buff_pos
    - batman-adv: reject new tp_meter sessions during teardown
    - batman-adv: stop caching unowned originator pointers in BAT IV
    - batman-adv: bla: prevent use-after-free when deleting claims
    - batman-adv: bla: only purge non-released claims
    - batman-adv: bla: put backbone reference on failed claim hash insert
    - usb: typec: tcpm: reset internal port states on soft reset AMS
    - usb: dwc3: Move GUID programming after PHY initialization
    - ALSA: hda: cs35l56: Propagate ASP TX source control errors
    - ALSA: misc: Use guard() for spin locks
    - ALSA: core: Serialize deferred fasync state checks
    - ALSA: seq: Notify client and port info changes
    - ALSA: seq: Fix UMP group 16 filtering
    - Bluetooth: hci_conn: fix potential UAF in create_big_sync
    - [arm64,armhf] spi: tegra20-sflash: fix controller deregistration
    - [arm64,armhf] spi: tegra114: fix controller deregistration
    - mm/hugetlb_cma: round up per_node before logging it
    - block: cleanup blkdev_report_zones()
    - block: reorganize struct blk_zone_wplug
    - block: fix zone write plug removal
    - tracefs: Fix default permissions not being applied on initial mount
    - fbcon: Avoid OOB font access if console rotation fails
    - mm/damon/core: disallow time-quota setting zero esz
    - mm/damon/core: implement damon_kdamond_pid()
    - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
    - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
    - bonding: fix use-after-free due to enslave fail after slave array update
      (CVE-2026-23171)
    - io_uring/kbuf: support min length left for incremental buffers
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
    - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
    - btrfs: fix double free in create_space_info_sub_group() error path
    - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
      info-leak
    - tracing/probes: Limit size of event probe to 3K
    - batman-adv: stop tp_meter sessions during mesh teardown
    - batman-adv: tp_meter: fix tp_num leak on kmalloc failure
    - vsock: fix buffer size clamping order
    - vsock/virtio: fix length and offset in tap skb for split packets
    - vsock/virtio: fix empty payload in tap skb for non-linear buffers
    - vsock/virtio: fix accept queue count leak on transport mismatch
    - drm/amdgpu/vcn3: Avoid overflow on msg bound check
    - drm/amdgpu/vcn4: Avoid overflow on msg bound check

  [ Salvatore Bonaccorso ]
  * Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (Closes: #1136790)
  * net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300)
  * net: skbuff: propagate shared-frag marker through frag-transfer helpers

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 22 May 2026 21:01:16 +0200

linux (6.12.88-1) trixie-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.87
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.88
    - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
    - ipmi: Add limits to event and receive message requests
    - ipmi: Check event message buffer response for bad data
    - ipmi:si: Return state to normal if message allocation fails
    - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
    - ACPI: scan: Use acpi_dev_put() in object add error paths
    - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
    - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
    - ACPI: video: force native backlight on HP OMEN 16 (8A44)
    - ASoC: SOF: Don't allow pointer operations on unconfigured streams
    - spi: rockchip: fix controller deregistration
    - ksmbd: rewrite stop_sessions() with restartable iteration
    - mm: convert mm_lock_seq to a proper seqcount
    - [amd64] x86: shadow stacks: proper error handling for mmap lock
      (CVE-2026-43109)
    - [amd64] x86/shstk: Prevent deadlock during shstk sigreturn
    - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
    - [amd64] iommu/amd: Use atomic64_inc_return() in iommu.c
    - [amd64] iommu/amd: serialize sequence allocation under concurrent TLB
      invalidations (CVE-2026-43220) (Closes: #1135313)
    - flow_dissector: do not dissect PPPoE PFC frames
    - net: txgbe: fix RTNL assertion warning when remove module
    - net: af_key: zero aligned sockaddr tail in PF_KEY exports (CVE-2026-43088)
    - [amd64] KVM: SVM: check validity of VMCB controls when returning from SMM
    - net/sched: sch_red: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked
    - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (CVE-2026-31499)
    - exit: prevent preemption of oopsing TASK_DEAD task
    - wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
    - wifi: mt76: mt7925: fix incorrect length field in txpower command
    - wifi: mt76: mt7921: fix a potential clc buffer length underflow
    - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
    - wifi: b43legacy: enforce bounds check on firmware key index in RX path
    - wifi: mac80211: drop stray 'static' from fast-RX rx_result
    - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
    - wifi: mac80211: use safe list iteration in radar detect work
    - wifi: ath5k: do not access array OOB (Closes: #1119093)
    - wifi: mac80211: remove station if connection prep fails
    - wifi: b43: enforce bounds check on firmware key index in b43_rx()
    - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog
      task
    - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
    - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
    - ALSA: usb-audio: midi2: Restart output URBs on resume
    - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
    - ALSA: usb-audio: Fix UAC3 cluster descriptor size check
    - USB: omap_udc: DMA: Don't enable burst 4 mode
    - USB: serial: option: add Telit Cinterion LE910Cx compositions
    - usb: ulpi: fix memory leak on ulpi_register() error paths
    - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
    - ALSA: firewire-tascam: Do not drop unread control events
    - xfrm: provide message size for XFRM_MSG_MAPPING
    - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
    - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
    - xfrm: ah: account for ESN high bits in async callbacks
    - selinux: don't reserve xattr slot when we won't fill it
    - selinux: shrink critical section in sel_write_load()
    - selinux: prune /sys/fs/selinux/disable
    - Bluetooth: virtio_bt: clamp rx length before skb_put
    - Bluetooth: virtio_bt: validate rx pkt_type header length
    - Bluetooth: btmtk: validate WMT event SKB length before struct access
    - Bluetooth: hci_event: Fix OOB read and infinite loop in
      hci_le_create_big_complete_evt
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
    - [armhf] spi: sun4i: fix controller deregistration
    - [armhf] spi: ti-qspi: fix controller deregistration
    - spi: sun6i: fix controller deregistration
    - fanotify: fix false positive on permission events
    - [arm64] KVM: arm64: Fix kvm_vcpu_initialized() macro parameter
    - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
    - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
      rtnl_fill_vfinfo
    - sound: ua101: fix division by zero at probe
    - net: libwx: fix VF illegal register access
    - ip6_gre: Use cached t->net in ip6erspan_changelink().
    - net/rds: handle zerocopy send cleanup before the message is queued
    - net: wwan: t7xx: validate port_count against message length in
      t7xx_port_enum_msg_handler
    - hwmon: (ltc2992) Clamp threshold writes to hardware range
    - hwmon: (ltc2992) Fix u32 overflow in power read path
    - clk: rk808: fix OF node reference imbalance
    - hwmon: (corsair-psu) Close HID device on probe errors
    - af_unix: Reject SIOCATMARK on non-stream sockets
    - block: add pgmap check to biovec_phys_mergeable
    - cifs: abort open_cached_dir if we don't request leases
    - cifs: change_conf needs to be called for session setup
    - extcon: ptn5150: handle pending IRQ events during system resume
    - gpio: of: clear OF_POPULATED on hog nodes in remove path
    - hv_sock: fix ARM64 support
    - ibmveth: Disable GSO for packets with small MSS
    - ice: fix double free in ice_sf_eth_activate() error path
    - spi: microchip-core-qspi: fix controller deregistration
    - udf: reject descriptors with oversized CRC length
    - thermal: core: Free thermal zone ID later during removal
    - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
    - thermal/drivers/sprd: Fix raw temperature clamping in
      sprd_thm_rawdata_to_temp
    - spi: topcliff-pch: fix controller deregistration
    - spi: topcliff-pch: fix use-after-free on unbind
    - clk: imx: imx8-acm: fix flags for acm clocks
    - clk: microchip: mpfs-ccc: fix out of bounds access during output
      registration
    - cpuidle: powerpc: avoid double clear when breaking snooze
    - [amd64] ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in
      quirk table
    - [arm64] ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
    - [arm64] ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
    - [arm64] ASoC: qcom: q6apm: remove child devices when apm is removed
    - btrfs: fix double free in create_space_info() error path
    - dm-thin: fix metadata refcount underflow
    - dm: don't report warning when doing deferred remove
    - dm: fix a buffer overflow in ioctl processing
    - eventfs: Hold eventfs_mutex and SRCU when remount walks events
    - dm-verity-fec: correctly reject too-small FEC devices
    - dm-verity-fec: correctly reject too-small hash devices
    - isofs: validate Rock Ridge CE continuation extent against volume size
    - isofs: validate block number from NFS file handle in isofs_export_iget
    - [arm64] iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update
    - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
    - lib/scatterlist: fix length calculations in extract_kvec_to_sg
    - lib/scatterlist: fix temp buffer in extract_user_to_sg()
    - libceph: Fix slab-out-of-bounds access in auth message processing
    - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
    - nvme-apple: drop invalid put of admin queue reference count
    - nvmet-tcp: fix race between ICReq handling and queue teardown
    - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
    - openvswitch: vport: fix self-deadlock on release of tunnel ports
    - pmdomain: core: Fix detach procedure for virtual devices in genpd
    - [arm64] RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
    - [s390x] debug: Reject zero-length input in debug_input_flush_fn()
    - smb/client: fix out-of-bounds read in smb2_compound_op()
    - smb/client: fix out-of-bounds read in symlink_data()
    - smb: client: use kzalloc to zero-initialize security descriptor buffer
    - smb: client: validate dacloffset before building DACL pointers
    - [amd64] KVM: x86: check for nEPT/nNPT in slow flush hypercalls
    - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
    - PCI: Update saved_config_space upon resource assignment (Closes: #1131025)
    - PCI/AER: Clear only error bits in PCIe Device Status
    - PCI/AER: Stop ruling out unbound devices as error source
    - PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
    - power: supply: max17042: avoid overflow when determining health
    - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
    - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
    - RDMA/mana: Validate rx_hash_key_len
    - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
    - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
    - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
    - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
    - RDMA/rxe: Reject unknown opcodes before ICRC processing
    - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
    - mptcp: fastclose msk when linger time is 0
    - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
    - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
    - mptcp: sockopt: set timestamp flags on subflow socket, not msk
    - mptcp: fix scheduling with atomic in timestamp sockopt
    - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
    - f2fs: fix fiemap boundary handling when read extent cache is incomplete
    - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
    - f2fs: fix node_cnt race between extent node destroy and writeback
    - f2fs: fix uninitialized kobject put in f2fs_init_sysfs()
    - [arm64] KVM: arm64: vgic: Fix IIDR revision field extracted from wrong
      value
    - [arm64] KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
    - bpf: Fix use-after-free in arena_vm_close on fork
    - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
    - fs: prepare for adding LSM blob to backing_file
    - dma-mapping: drop unneeded includes from dma-mapping.h
    - dma-mapping: add __dma_from_device_group_begin()/end()
    - hwmon: (powerz) Avoid cacheline sharing for DMA buffer
    - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
    - udf: fix partition descriptor append bookkeeping
    - mtd: spinand: winbond: Declare the QE bit on W25NxxJW
    - hfsplus: fix uninit-value by validating catalog record size
    - hfsplus: fix held lock freed on hfsplus_fill_super()
    - erofs: move {in,out}pages into struct z_erofs_decompress_req
    - erofs: tidy up z_erofs_lz4_handle_overlap()
    - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
    - gtp: disable BH before calling udp_tunnel_xmit_skb()
    - printk: add print_hex_dump_devel()
    - crypto: caam - guard HMAC key hex dumps in hash_digest_key
    - ALSA: aloop: Fix peer runtime UAF during format-change stop
    - net: stmmac: avoid shadowing global buf_sz
    - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
    - net: stmmac: Prevent NULL deref when RX memory exhausted
    - wifi: mt76: mt7925: fix incorrect TLV length in CLC command
    - tracepoint: balance regfunc() on func_add() failure in
      tracepoint_add_func()
    - [arm64] KVM: arm64: Wake-up from WFI when iqrchip is in userspace
    - [amd64] x86/CPU/AMD: Prevent improper isolation of shared resources in
      Zen2's op cache
    - ksmbd: validate inherited ACE SID length

  [ Salvatore Bonaccorso ]
  * ptrace: slightly saner 'get_dumpable()' logic

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 15 May 2026 11:52:56 +0200

linux (6.12.86-1) trixie-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.86
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
    - ALSA: usb-audio: Avoid false E-MU sample-rate notifications
    - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
    - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
    - usb: chipidea: otg: not wait vbus drop if use role_switch
    - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
    - ALSA: usb-audio: Evaluate packsize caps at the right place
    - LoongArch: Add spectre boundry for syscall dispatch table
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
    - leds: qcom-lpg: Check for array overflow when selecting the high
      resolution
    - greybus: gb-beagleplay: bound bootloader receive buffering
    - greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()
    - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
    - ibmasm: fix OOB reads in command_file_write due to missing size checks
    - ibmasm: fix heap over-read in ibmasm_send_i2o_message()
    - driver core: Don't let a device probe until it's ready
    - drm/nouveau: fix nvkm_device leak on aperture removal failure
    - kbuild: rust: allow `clippy::uninlined_format_args`
    - firmware: google: framebuffer: Do not mark framebuffer as busy
    - arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
    - padata: Fix pd UAF once and for all (CVE-2025-38584)
    - padata: Remove comment for reorder_work
    - rust: init: fix `clippy::undocumented_unsafe_blocks` warnings
    - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
      (CVE-2026-23468)
    - device property: Make modifications of fwnode "flags" thread safe
    - ocfs2: split transactions in dio completion to avoid credit exhaustion
    - zram: do not forget to endio for partial discard requests
    - wifi: rtw88: check for PCI upstream bridge existence
    - vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
    - vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
    - um: drivers: call kernel_strrchr() explicitly in cow_user.c
    - spi: imx: fix use-after-free on unbind
    - spi: ch341: fix memory leaks on probe failures
    - mm/memory_hotplug: fix hwpoisoned large folio handling in
      do_migrate_range()
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
    - of: unittest: fix use-after-free in of_unittest_changeset()
    - of: unittest: fix use-after-free in testdrv_probe()
    - hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
    - media: amphion: Fix race between m2m job_abort and device_run
    - ALSA: control: Validate buf_len before strnlen() in
      snd_ctl_elem_init_enum_names()
    - net: caif: clear client service pointer on teardown
    - net: strparser: fix skb_head leak in strp_abort_strp()
    - media: mtk-jpeg: fix use-after-free in release path due to uncancelled
      work
    - crypto: atmel-sha204a - Fix OTP sysfs read and error handling
    - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
    - Revert "ALSA: usb: Increase volume range that triggers a warning"
    - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
    - lib/ts_kmp: fix integer overflow in pattern length calculation
    - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in
      imx219_probe()
    - net: qrtr: ns: Fix use-after-free in driver remove()
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
    - ALSA: aoa: i2sbus: fix OF node lifetime handling
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF
    - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke()
    - md/raid10: fix deadlock with check operation and nowait requests
    - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
    - mtd: docg3: fix use-after-free in docg3_release()
    - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
    - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
    - parisc: _llseek syscall is only available for 32-bit userspace
    - remoteproc: xlnx: Only access buffer information if IPI is buffered
    - sched: Use u64 for bandwidth ratio calculations
    - rbd: fix null-ptr-deref when device_add_disk() fails
    - block: fix zone write plugs refcount handling in
      disk_zone_wplug_schedule_bio_work()
    - io_uring/timeout: check unused sqe fields
    - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
    - io_uring/poll: fix signed comparison in io_poll_get_ownership()
    - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
    - ALSA: core: Fix potential data race at fasync handling
    - ALSA: caiaq: Fix control_put() result and cache rollback
    - ALSA: caiaq: Handle probe errors properly
    - ALSA: 6fire: Fix input volume change detection
    - ALSA: pcmtest: fix reference leak on failed device registration
    - ALSA: pcmtest: Fix resource leaks in module init error paths
    - iio: adc: ad7768-1: fix one-shot mode data acquisition
    - rxrpc: Fix memory leaks in rxkad_verify_response()
    - rxrpc: Fix rxkad crypto unalignment handling
    - rxrpc: Fix re-decryption of RESPONSE packets
    - tools/accounting: handle truncated taskstats netlink messages
    - arm64: dts: marvell: uDPU: add ethernet aliases
    - net: qrtr: ns: Free the node during ctrl_cmd_bye()
    - net: rds: fix MR cleanup on copy error
    - net: txgbe: fix firmware version check
    - net/smc: avoid early lgr access in smc_clc_wait_msg
    - net: ks8851: Reinstate disabling of BHs around IRQ handler
    - netconsole: avoid out-of-bounds access on empty string in trim_newline()
    - net: ks8851: Avoid excess softirq scheduling
    - drm/arcpgu: fix device node leak
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
    - ipv4: icmp: validate reply type before using icmp_pointers
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
    - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
    - tpm: avoid -Wunused-but-set-variable
    - LoongArch: Show CPU vulnerabilites correctly
    - power: supply: axp288_charger: Do not cancel work before initializing it
    - hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()
    - randomize_kstack: Maintain kstack_offset per task
    - mmc: block: use single block write in retry
    - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
    - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
    - xfs: fix a resource leak in xfs_alloc_buftarg()
    - firmware: google: framebuffer: Do not unregister platform device
    - crypto: talitos - fix SEC1 32k ahash request limitation
    - crypto: talitos - rename first/last to first_desc/last_desc
    - pwm: imx-tpm: Count the number of enabled channels in probe
    - tpm: Fix auth session leak in tpm2_get_random() error path
    - tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
    - tpm: tpm_tis: add error logging for data transfer
    - tpm: tpm_tis: stop transmit if retries are exhausted
    - rtc: ntxec: fix OF node reference imbalance
    - mm/damon/core: use time_in_range_open() for damos quota window start
    - userfaultfd: allow registration of ranges below mmap_min_addr
    - KVM: x86: Defer non-architectural deliver of exception payload to
      userspace read
    - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
    - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
    - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
    - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
    - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
    - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
    - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
    - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
    - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
    - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
    - KVM: nSVM: Add missing consistency check for nCR3 validity
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
    - KVM: nSVM: Always intercept VMMCALL when L2 is active
    - io_uring/poll: fix multishot recv missing EOF on wakeup race
    - perf annotate: Use jump__delete when freeing LoongArch jumps
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
    - mtd: spi-nor: sst: Fix write enable before AAI sequence
    - amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
    - md/raid5: fix soft lockup in retry_aligned_read()
    - md/raid5: validate payload size before accessing journal metadata
    - check-uapi: link into shared objects
    - HID: apple: ensure the keyboard backlight is off if suspending
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
    - x86/cpu: Disable FRED when PTI is forced on
    - wifi: rtl8xxxu: fix potential use of uninitialized value
    - tcp: call sk_data_ready() after listener migration
    - taskstats: set version in TGID exit notifications
    - mfd: core: Preserve OF node when ACPI handle is present
    - apparmor: use target task's context in apparmor_getprocattr()
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
    - bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays
    - can: ucan: fix devres lifetime
    - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
    - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
    - crypto: atmel-ecc - Release client on allocation failure
    - crypto: hisilicon - Fix dma_unmap_single() direction
    - crypto: ccree - fix a memory leak in cc_mac_digest()
    - crypto: atmel-tdes - fix DMA sync direction
    - crypto: atmel-sha204a - Fix error codes in OTP reads
    - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
    - crypto: atmel-sha204a - Fix uninitialized data access on OTP read error
    - crypto: nx - Fix packed layout in struct nx842_crypto_header
    - dm mirror: fix integer overflow in create_dirty_log()
    - ceph: only d_add() negative dentries when they are unhashed
    - IB/core: Fix zero dmac race in neighbor resolution
    - ktest: Fix the month in the name of the failure directory
    - ntfs3: add buffer boundary checks to run_unpack()
    - ntfs3: fix integer overflow in run_unpack() volume boundary check
    - rtmutex: Use waiter::task instead of current in remove_waiter()
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
    - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
    - smb: client: validate the whole DACL before rewriting it in cifsacl
      (CVE-2026-31709)
    - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in
      f2fs_write_end_io() (CVE-2026-31715)
    - lib: test_hmm: evict device pages on file close to avoid use-after-free
    - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
    - ksmbd: use msleep instaed of schedule_timeout_interruptible()
    - ksmbd: replace connection list with hash table
    - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
    - thermal: core: Fix thermal zone governor cleanup issues
    - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
    - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
    - mm/migrate: factor out movable_ops page handling into
      migrate_movable_ops_page()
    - mm/migrate: move movable_ops page handling out of move_to_new_folio()
    - mm: migrate: requeue destination folio on deferred split queue
    - ALSA: aoa: Use guard() for mutex locks
    - ALSA: aoa: i2sbus: clear stale prepared state
    - mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()
    - media: rc: ttusbir: respect DMA coherency rules
    - ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
    - media: rc: igorplugusb: heed coherency rules
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy
    - block: relax pgmap check in bio_add_page for compatible zone device pages
    - iio: frequency: admv1013: add dev variable
    - iio: frequency: admv1013: fix NULL pointer dereference on str
    - rxrpc: Fix potential UAF after skb_unshare() failure
    - net: qrtr: ns: Limit the maximum server registration per node
    - net: qrtr: ns: Limit the maximum number of lookups
    - net: bridge: use a stable FDB dst snapshot in RCU readers
    - net: mctp: fix don't require received header reserved bits to be zero
    - net: qrtr: ns: Limit the total number of nodes
    - spi: fix resource leaks on device setup failure
    - mm: prevent droppable mappings from being locked
    - crypto: authencesn - reject short ahash digests during instance creation
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419)
    - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
    - ALSA: caiaq: Don't abort when no input device is available
    - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
    - drm/amdgpu: fix zero-size GDS range init on RDNA4
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
    - netfilter: reject zero shift in nft_bitwise

  [ Ben Hutchings ]
  * Fix ordering of kernel version strings for multiple Debian revisions
    (Closes: #1113728)
  * rxrpc: Fix conn-level packet handling to unshare RESPONSE packets

  [ Salvatore Bonaccorso ]
  * xfrm: esp: avoid in-place decrypt on shared skb frags
  * rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 08 May 2026 08:54:02 +0200

linux (6.12.85-1) trixie-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.75
    - RDMA/siw: Fix potential NULL pointer dereference in header processing
    - RDMA/umad: Reject negative data_len in ib_umad_write
    - auxdisplay: arm-charlcd: fix release_mem_region() size
    - hfsplus: return error when node already exists in hfs_bnode_create
    - rcu: Refactor expedited handling check in rcu_read_unlock_special()
    - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler()
    - rcu: Fix rcu_read_unlock() deadloop due to softirq
    - audit: move the compat_xxx_class[] extern declarations to audit_arch.h
    - i3c: Move device name assignment after i3c_bus_init
    - fs: add <linux/init_task.h> for 'init_fs'
    - i3c: master: Update hot-join flag only on success
    - gfs2: Retries missing in gfs2_{rename,exchange}
    - gfs2: Fix slab-use-after-free in qd_put
    - gfs2: Fix use-after-free in iomap inline data write path
    - i3c: dw: Initialize spinlock to avoid upsetting lockdep
    - i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers()
    - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
    - tpm: st33zp24: Fix missing cleanup on get_burstcount() error
    - erofs: get rid of raw bi_end_io() usage
    - erofs: handle end of filesystem properly for file-backed mounts
    - btrfs: qgroup: return correct error when deleting qgroup relation item
    - btrfs: fix block_group_tree dirty_list corruption
    - smb: client: fix potential UAF and double free in smb2_open_file()
    - block: add a bio_add_virt_nofail helper
    - rnbd-srv: use bio_add_virt_nofail
    - rnbd-srv: Fix server side setting of bi_size for special IOs
    - xen/virtio: Don't use grant-dma-ops when running as Dom0
    - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
    - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
    - io_uring/sync: validate passed in offset
    - cpuidle: governors: menu: Always check timers with tick stopped
    - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature
    - md/raid5: fix raid5_run() to return error when log_init() fails
    - md/raid10: fix any_working flag handling in raid10_sync_request
    - OPP: Return correct value in dev_pm_opp_get_level
    - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id()
    - iomap: fix submission side handling of completion side errors
    - thermal/of: Fix reference leak in thermal_of_cm_lookup()
    - ublk: Validate SQE128 flag before accessing the cmd
    - Partial revert "x86/xen: fix balloon target initialization for PVH dom0"
    - md/raid1: fix memory leak in raid1_run() if no active rdev
    - md/raid1: fix memory leak in raid1_run()
    - PM: wakeup: Handle empty list in wakeup_sources_walk_start()
    - perf: arm_spe: Properly set hw.state on failures
    - cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not
      possible
    - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
    - [s390x] cio: Fix device lifecycle handling in css_alloc_subchannel()
    - [amd64] perf/x86/core: Do not set bit width for unavailable counters
    - crypto: qat - fix warning on adf_pfvf_pf_proto.c
    - libbpf: Fix OOB read in btf_dump_get_bitfield_value
    - [armhf] VDSO: Patch out __vdso_clock_getres() if unavailable
    - [arm64] crypto: cavium - fix dma_free_coherent() size
    - bpf: Preserve id of register in sync_linked_regs()
    - hrtimer: Fix trace oddity
    - [amd64] crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls
    - [amd64] crypto: ccp - narrow scope of snp_range_list
    - bpf, sockmap: Fix incorrect copied_seq calculation
    - bpf, sockmap: Fix FIONREAD for sockmap
    - tracing: Add a comment about ftrace_regs definition
    - ftrace: Make ftrace_regs abstract from direct use
    - ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs
    - ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros
    - ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value
    - fgraph: Replace fgraph_ret_regs with ftrace_regs
    - tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs
    - tracing: Add ftrace_fill_perf_regs() for perf event
    - [amd64] x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return
      probe
    - [amd64] x86/fgraph,bpf: Switch kprobe_multi program stack unwind to
      hw_regs path
    - [arm64] crypto: caam - fix netdev memory leak in dpaa2_caam_probe
    - bpf: Fix bpf_xdp_store_bytes proto for read-only arg
    - genirq: Set IRQF_COND_ONESHOT in devm_request_irq().
    - [amd64] platform/x86: int0002: Remove IRQF_ONESHOT from request_irq()
    - Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler
    - scsi: efct: Use IRQF_ONESHOT and default primary handler
    - EDAC/altera: Remove IRQF_ONESHOT
    - mfd: wm8350-core: Use IRQF_ONESHOT
    - media: pci: mg4b: Use IRQF_NO_THREAD
    - sched/deadline: Clear the defer params
    - sched/rt: Skip currently executing CPU in rto_next_cpu()
    - hwrng: core - Allow runtime disabling of the HW RNG
    - hwrng: core - use RCU and work_struct to fix race condition
    - pstore/ram: fix buffer overflow in persistent_ram_save_old()
    - soc: qcom: smem: handle ENOMEM error during probe
    - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
    - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
    - firmware: arm_ffa: Correct 32-bit response handling in
      NOTIFICATION_INFO_GET
    - [arm64] dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings
    - [arm64] dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings
    - [arm64] clk: qcom: Return correct error code in qcom_cc_probe_by_index()
    - [arm64] dts: qcom: sdm630: fix gpu_speed_bin size
    - [arm64] dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on
    - [arm64] dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on
    - [arm64] dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks
    - [arm64] dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of
      AD7147
    - [armhf] dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
    - [powerpc*] uaccess: Move barrier_nospec() out of
      allow_read_{from/write}_user()
    - [arm64] soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in
      cmd_db_dev_probe
    - [arm64] soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
    - [powerpc*] eeh: fix recursive pci_lock_rescan_remove locking in EEH event
      handling
    - [arm64] dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node
    - [arm64] dts: amlogic: s4: assign mmc b clock to 24MHz
    - [arm64] dts: amlogic: s4: fix mmc clock assignment
    - [arm64] dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order
    - [arm64] dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog
      instances for j784s4
    - hwspinlock: omap: Handle devm_pm_runtime_enable() errors
    - [arm64] dts: amlogic: c3: assign the MMC signal clocks
    - [arm64] dts: amlogic: axg: assign the MMC signal clocks
    - [arm64] dts: amlogic: gx: assign the MMC signal clocks
    - [arm64] dts: amlogic: g12: assign the MMC B and C signal clocks
    - [arm64] dts: amlogic: g12: assign the MMC A signal clock
    - [arm64] dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm
    - [arm64] dts: qcom: sdm845-db845c: drop CS from SPIO0
    - [arm64] dts: qcom: sdm845-db845c: specify power for WiFi CH1
    - [arm64] dts: qcom: x1e: bus is 40-bits (fix 64GB models)
    - [arm64] dts: qcom: agatti: Add CX_MEM/DBGC GPU regions
    - [arm64] dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions
    - [arm64] drm/panthor: Recover from panthor_gpu_flush_caches() failures
    - [arm64] drm/panthor: Fix the full_tick check
    - [arm64] drm/panthor: Fix the group priority rotation logic
    - [arm64] drm/panthor: Fix immediate ticking on a disabled tick
    - [arm64] drm/panthor: Fix the logic that decides when to stop ticking
    - [arm64] drm/panthor: Make sure we resume the tick when new jobs are
      submitted
    - workqueue: Factor out assign_rescuer_work()
    - workqueue: Only assign rescuer work when really needed
    - workqueue: Process rescuer work items one-by-one using a cursor
    - drm/panel: sw43408: Remove manual invocation of unprepare at remove
    - ALSA: pcm: use new array-copying-wrapper
    - ALSA: pcm: Relax __free() variable declarations
    - ALSA: vmaster: Relax __free() variable declarations
    - [arm64] drm/panthor: Evict groups before VM termination
    - [amd64] ASoC: nau8821: Consistently clear interrupts before unmasking
    - [amd64] ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
    - [amd64] ASoC: nau8821: Fixup nau8821_enable_jack_detect()
    - media: chips-media: wave5: Fix memory leak on codec_info allocation
      failure
    - drm/amd: Drop "amdgpu kernel modesetting enabled" message
    - drm/amdkfd: Fix signal_eviction_fence() bool return value
    - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
    - [arm64] drm/msm/disp/dpu: add merge3d support for sc7280
    - [arm64] drm/msm/dpu: Set vsync source irrespective of mdp top support
    - [arm64] drm/msm/dpu: fix WD timer handling on DPU 8.x
    - regulator: core: move supply check earlier in set_machine_constraints()
    - HID: playstation: Add missing check for input_ff_create_memless
    - [arm64] drm/msm/disp: set num_planes to 1 for interleaved YUV formats
    - [arm64] drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x
    - media: ccs: Accommodate C-PHY into the calculation
    - [arm64] drm/msm/a2xx: fix pixel shader start on A225
    - drm/buddy: release free_trees array on buddy mm teardown
    - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev
    - media: uvcvideo: Fix allocation for small frame sizes
    - evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac()
    - drm/xe: Unregister drm device on probe error
    - platform/chrome: cros_ec_lightbar: Fix response size initialization
    - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
    - spi: tools: Add include folder to .gitignore
    - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
    - hwmon: pmbus: mpq8785: Prepare driver for multiple device support
    - hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio
      configuration
    - hwmon: pmbus: mpq8785: Add support for MPM82504
    - hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification
    - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
    - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
    - PCI/PM: Avoid redundant delays on D3hot->D3cold
    - wifi: cfg80211: Fix use_for flag update on BSS refresh
    - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
    - docs: fix WARNING document not included in any toctree
    - Documentation: trace: Refactor toctree
    - Documentation: tracing: Add PCI tracepoint documentation
    - PCI: Do not attempt to set ExtTag for VFs
    - PCI/portdrv: Fix potential resource leak
    - dm: fix unlocked test for dm_suspended_md
    - dm: use READ_ONCE in dm_blk_report_zones
    - quota: fix livelock between quotactl and freeze_super
    - net: mctp-i2c: fix duplicate reception of old data
    - mctp i2c: initialise event handler read bytes
    - wifi: cfg80211: stop NAN and P2P in cfg80211_leave
    - netfilter: nf_tables: reset table validation state on abort
    - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
    - netfilter: nf_conncount: increase the connection clean up limit to 64
    - netfilter: nft_compat: add more restrictions on netlink attributes
    - netfilter: nf_conncount: fix tracking of connections from localhost
    - module: add helper function for reading module_buildid()
    - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()
    - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
    - [amd64] iommu/vt-d: Flush cache for PASID table before using it
    - [amd64] iommu/vt-d: Separate page request queue from SVM
    - [amd64] iommu/vt-d: Drain PRQs when domain removed from RID
    - [amd64] iommu/vt-d: Avoid draining PRQ in sva mm release path
    - [amd64] iommu/vt-d: Clear Present bit before tearing down PASID entry
    - dm: use bio_clone_blkg_association
    - xdrgen: Fix struct prefix for typedef types in program wrappers
    - NFS: NFSERR_INVAL is not defined by NFSv2
    - xdrgen: Initialize data pointer for zero-length items
    - nfsd: never defer requests during idmap lookup
    - fat: avoid parent link count underflow in rmdir
    - tcp: tcp_tx_timestamp() must look at the rtx queue
    - PCI: Check parent for NULL in of_pci_bus_release_domain_nr()
    - wifi: ath10k: sdio: add missing lock protection in
      ath10k_sdio_fw_crashed_dump()
    - PCI: Initialize RCB from pci_configure_device()
    - PCI: Add defines for bridge window indexing
    - PCI/ACPI: Restrict program_hpx_type2() to AER bits
    - ipc: don't audit capability check in ipc_permissions()
    - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
    - mptcp: fix receive space timestamp initialization
    - octeontx2-af: Fix PF driver crash with kexec kernel booting
    - bonding: only set speed/duplex to unknown, if getting speed failed
    - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
    - nfc: hci: shdlc: Stop timers and work before freeing context
    - netfilter: nfnetlink_queue: optimize verdict lookup with hash table
    - netfilter: nfnetlink_queue: do shared-unconfirmed check before
      segmentation
    - netfilter: nft_set_hash: fix get operation on big endian
    - netfilter: nft_counter: fix reset of counters on 32bit archs
    - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null
      interval
    - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
    - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]
    - [arm64] net: hns3: fix double free issue for tx spare buffer
    - procfs: fix missing RCU protection when reading real_parent in
      do_task_stat()
    - smb: client: correct value for smbd_max_fragmented_recv_size
    - net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
    - net: sunhme: Fix sbus regression
    - net: Add skb_dstref_steal and skb_dstref_restore
    - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input
      callers
    - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
    - serial: caif: fix use-after-free in caif_serial ldisc_close()
    - octeon_ep: disable per ring interrupts
    - octeon_ep: ensure dbell BADDR updation
    - octeon_ep_vf: ensure dbell BADDR updation
    - ionic: Rate limit unknown xcvr type messages
    - octeontx2-pf: Unregister devlink on probe failure
    - RDMA/rtrs: server: remove dead code
    - IB/cache: update gid cache on client reregister event
    - RDMA/hns: Fix WQ_MEM_RECLAIM warning
    - RDMA/hns: Fix RoCEv1 failure due to DSCP
    - RDMA/hns: Notify ULP of remaining soft-WCs during reset
    - power: supply: ab8500: Fix use-after-free in power_supply_changed()
    - power: supply: act8945a: Fix use-after-free in power_supply_changed()
    - power: supply: bq256xx: Fix use-after-free in power_supply_changed()
    - power: supply: bq25980: Fix use-after-free in power_supply_changed()
    - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()
    - power: supply: goldfish: Fix use-after-free in power_supply_changed()
    - power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()
    - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()
    - power: supply: rt9455: Fix use-after-free in power_supply_changed()
    - power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
    - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write
    - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
    - power: supply: wm97xx: Fix NULL pointer dereference in
      power_supply_changed()
    - RDMA/rtrs-srv: fix SG mapping
    - RDMA/rxe: Fix double free in rxe_srq_from_init
    - RDMA/iwcm: Fix workqueue list corruption by removing work_list
    - tools/power/x86/intel-speed-select: Fix file descriptor leak in
      isolate_cpus()
    - RDMA/mlx5: Fix UMR hang in LAG error state unload
    - IB/mlx5: Fix port speed query for representors
    - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper
    - vfio/pci: Lock upstream bridge for vfio_pci_core_disable()
    - [amd64] platform/x86/amd/pmf: Prevent TEE errors after hibernate
    - [amd64] crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails
    - [amd64] crypto: ccp - Add an S4 restore flow
    - [amd64] crypto: ccp - Factor out ring destroy handling to a helper
    - [amd64] crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when
      PSP_CMD_TEE_RING_INIT fails
    - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
    - nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx
    - NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit
    - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
    - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler
    - RDMA/rxe: Fix race condition in QP timer handlers
    - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
    - cxl: Fix premature commit_end increment on decoder commit failure
    - mtd: parsers: ofpart: fix OF node refcount leak in
      parse_fixed_partitions()
    - mtd: spinand: Fix kernel doc
    - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler
    - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer
    - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
    - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
    - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
    - scsi: ufs: host: mediatek: Require CONFIG_PM
    - scsi: csiostor: Fix dereference of null pointer rn
    - nvdimm: virtio_pmem: serialize flush requests
    - fs/nfs: Fix readdir slow-start regression
    - tracing: Properly process error handling in event_hist_trigger_parse()
    - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
    - fbdev: of_display_timing: Fix device node reference leak in
      of_get_display_timings()
    - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
    - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
    - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs
    - clk: qcom: rcg2: compute 2d using duty fraction directly
    - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
    - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
    - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc
    - clk: qcom: gcc-ipq5018: flag sleep clock as critical
    - clk: Move clk_{save,restore}_context() to COMMON_CLK section
    - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
    - clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src
    - clk: qcom: gfx3d: add parent to parent request map
    - clk: mediatek: Fix error handling in runtime PM setup
    - interconnect: mediatek: Don't hijack parent device
    - interconnect: mediatek: Aggregate bandwidth with saturating add
    - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
    - dma: dma-axi-dmac: fix SW cyclic transfers
    - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue
    - soundwire: intel_ace2x: add SND_HDA_CORE dependency
    - iio: test: drop dangling symbol in gain-time-scale helpers
    - staging: greybus: lights: avoid NULL deref
    - serial: imx: change SERIAL_IMX_CONSOLE to bool
    - serial: SH_SCI: improve "DMA support" prompt
    - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
    - iio: pressure: mprls0025pa: fix spi_transfer struct initialisation
    - iio: pressure: mprls0025pa: fix SPI CS delay violation
    - iio: pressure: mprls0025pa: fix interrupt flag
    - iio: pressure: mprls0025pa: fix scan_type struct
    - iio: pressure: mprls0025pa: fix pressure calculation
    - watchdog: starfive-wdt: Fix PM reference leak in probe error path
    - coresight: etm3x: Fix cpulocked warning on cpuhp
    - phy: freescale: imx8qm-hsio: fix NULL pointer dereference
    - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
    - mfd: arizona: Fix regulator resource leak on
      wm5102_clear_write_sequencer() failure
    - mfd: simple-mfd-i2c: Add MAX77705 support
    - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA
    - mfd: simple-mfd-i2c: Add SpacemiT P1 support
    - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order
    - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
    - drivers: iio: mpu3050: use dev_err_probe for regulator request
    - usb: bdc: fix sleep during atomic
    - pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
    - ovl: Fix uninit-value in ovl_fill_real
    - iio: sca3000: Fix a resource leak in sca3000_probe()
    - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
    - pinctrl: single: fix refcount leak in pcs_add_gpio_func()
    - leds: qcom-lpg: Check the return value of regmap_bulk_write()
    - backlight: qcom-wled: Support ovp values for PMI8994
    - backlight: qcom-wled: Change PM8950 WLED configurations
    - dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
    - drbd: always set BLK_FEAT_STABLE_WRITES
    - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
    - fs/ntfs3: Initialize new folios before use
    - fs/ntfs3: prevent infinite loops caused by the next valid being the same
    - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
    - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs
    - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check
    - kbuild: Add objtool to top-level clean target
    - objpool: fix the overestimation of object pooling metadata size
    - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO
    - cpuidle: Skip governor when only one idle state is available
    - net: sparx5/lan969x: fix DWRR cost max to match hardware register width
    - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper
    - net: mscc: ocelot: split xmit into FDMA and register injection paths
    - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
    - ipv6: Fix out-of-bound access in fib6_add_rt2node().
    - net: sparx5/lan969x: fix PTP clock max_adj value
    - net: usb: catc: enable basic endpoint checking
    - xen-netback: reject zero-queue configuration from guest
    - net/rds: rds_sendmsg should not discard payload_len
    - net: bridge: mcast: always update mdb_n_entries for vlan contexts
    - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
    - ipvs: do not keep dest_dst if dev is going down
    - net: remove WARN_ON_ONCE when accessing forward path array
    - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
      (CVE-2026-23231)
    - ipv6: fix a race in ip6_sock_set_v6only()
    - bpftool: Fix truncated netlink dumps
    - ping: annotate data-races in ping_lookup()
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error
      path
    - icmp: prevent possible overflow in icmp_global_allow()
    - inet: move icmp_global_{credit,stamp} to a separate cache line
    - octeontx2-af: Fix default entries mcam entry action
    - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
    - net/mlx5: Fix multiport device check over light SFs
    - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels
    - apparmor: fix NULL sock in aa_sock_file_perm
    - AppArmor: Allow apparmor to handle unaligned dfa tables
    - apparmor: Fix & Optimize table creation from possibly unaligned memory
    - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure
    - apparmor: fix rlimit for posix cpu timers
    - apparmor: remove apply_modes_to_perms from label_match
    - apparmor: make label_match return a consistent value
    - apparmor: avoid per-cpu hold underflow in aa_get_buffer
    - apparmor: fix invalid deref of rawdata when export_binary is unset
    - apparmor: fix aa_label to return state from compount and component match
    - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
    - drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()
    - drm/amdgpu: Fix memory leak in amdgpu_ras_init()
    - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
    - [amd64] drm/i915/acpi: free _DSM package when no connectors
    - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init
    - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
    - drm/amd/display: Reject cursor plane on DCE when scaled differently than
      primary
    - drm/amd/display: Fix out-of-bounds stream encoder index v3
    - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()
    - [s390x] kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
    - drm/xe: Move forcewake to 'gt.pm' substructure
    - drm/xe: Create dedicated xe_mmio structure
    - drm/xe: Clarify size of MMIO region
    - drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio'
    - drm/xe: Populate GT's mmio iomap from tile during init
    - drm/xe: Switch mmio_ext to use 'struct xe_mmio'
    - drm/xe: Add xe_tile backpointer to xe_mmio
    - drm/xe: Adjust mmio code to pass VF substructure to SRIOV code
    - drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt
    - drm/xe/mmio: Avoid double-adjust in 64-bit reads
    - drm/xe/ptl: Apply Wa_13011645652
    - drm/xe/xe2_hpg: Add set of workarounds
    - drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138
    - efi: Fix reservation of unaccepted memory table
    - btrfs: use the correct type to initialize block reserve for delayed refs
    - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not
      found
    - [amd64] x86/hyperv: Fix error pointer dereference
    - [arm64] ASoC: rockchip: i2s-tdm: Use param rate if not provided by
      set_sysclk
    - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats
    - ext4: subdivide EXT4_EXT_DATA_VALID1
    - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
    - ext4: don't cache extent during splitting extent
    - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
    - ext4: drop extent cache when splitting extent fails
    - ext4: fix memory leak in ext4_ext_shift_extents()
    - ext4: fix e4b bitmap inconsistency reports
    - ext4: fix dirtyclusters double decrement on fs shutdown
    - ext4: use optimized mballoc scanning regardless of inode format
    - ata: pata_ftide010: Fix some DMA timings
    - ata: libata-scsi: refactor ata_scsi_translate()
    - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT
    - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
    - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
    - dt-bindings: phy: qcom-edp: Add missing clock for X Elite
    - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false
    - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names
    - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names
    - perf test stat: Update test expectations and events
    - perf test stat tests: Fix for virtualized machines
    - perf unwind-libdw: Fix invalid reference counts
    - perf callchain: Fix srcline printing with inlines
    - libsubcmd: Fix null intersection case in exclude_cmds()
    - perf maps: Fix reference count leak in maps__find_ams()
    - perf annotate: Fix memcpy size in arch__grow_instructions()
    - perf vendor events amd: Fix Zen 5 MAB allocation events
    - libperf: Don't remove -g when EXTRA_CFLAGS are used
    - libperf build: Always place libperf includes first
    - rtc: interface: Alarm race handling should not discard preceding error
    - statmount: permission check should return EPERM
    - audit: add fchmodat2() to change attributes class
    - hfsplus: fix volume corruption issue for generic/498
    - fs/buffer: add alert in try_to_free_buffers() for folios without buffers
    - audit: add missing syscalls to read class
    - hfsplus: pretend special inodes as regular files
    - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
    - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
    - minix: Add required sanity checking to minix_check_superblock()
    - dlm: validate length in dlm_search_rsb_tree
    - btrfs: fallback to buffered IO if the data profile has duplication
    - btrfs: handle user interrupt properly in btrfs_trim_fs()
    - smb: client: add proper locking around ses->iface_last_update
    - gfs2: fiemap page fault fix
    - smb: client: prevent races in ->query_interfaces()
    - tools/power cpupower: Reset errno before strtoull()
    - [s390x] purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
    - [arm64] Add support for TSV110 Spectre-BHB mitigation
    - rnbd-srv: Zero the rsp buffer before using it
    - [amd64] x86/xen/pvh: Enable PAE mode for 32-bit guest only when
      CONFIG_X86_PAE is set
    - EFI/CPER: don't dump the entire memory region
    - APEI/GHES: ensure that won't go past CPER allocated record
    - APEI/GHES: ARM processor Error: don't go past allocated memory
    - EFI/CPER: don't go past the ARM processor CPER record buffer
    - ACPI: processor: Fix NULL-pointer dereference in
      acpi_processor_errata_piix4()
    - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
    - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
    - powercap: intel_rapl: Add PL4 support for Ice Lake
    - alpha: fix user-space corruption during memory compaction
    - md-cluster: fix NULL pointer dereference in process_metadata_update
    - cpufreq: dt-platdev: Block the driver from probing on more QC platforms
    - [s390x] perf: Disable register readout on sampling events
    - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
    - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
    - ACPI: battery: fix incorrect charging status when current is zero
    - xenbus: Use .freeze/.thaw to handle xenbus devices
    - blk-mq-debugfs: add missing debugfs_mutex in
      blk_mq_debugfs_register_hctxs()
    - block: decouple secure erase size limit from discard size limit
    - bpf: verifier improvement in 32bit shift sign extension pattern
    - [amd64] perf/x86/msr: Add Airmont NP
    - [amd64] perf/x86/cstate: Add Airmont NP
    - bpf: crypto: Use the correct destructor kfunc type
    - bpf: Recognize special arithmetic shift in the verifier
    - clocksource/drivers/sh_tmu: Always leave device running after probe
    - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on
      OF
    - PCI/MSI: Unmap MSI-X region on error
    - crypto: hisilicon/qm - move the barrier before writing to the mailbox
      register
    - mailbox: bcm-ferxrm-mailbox: Use default primary handler
    - char: tpm: cr50: Remove IRQF_ONESHOT
    - sched/debug: Fix updating of ppos on server write ops
    - pstore: ram_core: fix incorrect success return when vmap() fails
    - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
    - [arm64] Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
    - [arm64] tegra: smaug: Add usb-role-switch support
    - drm/display/dp_mst: Add protection against 0 vcpi
    - gpu/panel-edp: add AUO panel entry for B140HAN06.4
    - drm/amdgpu: fix NULL pointer issue buffer funcs
    - drm/amdkfd: Handle GPU reset and drain retry fault race
    - spi-geni-qcom: initialize mode related registers to 0
    - spi-geni-qcom: use xfer->bits_per_word for can_dma()
    - drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32
    - [amd64] ASoC: SOF: ipc4: Support for sending payload along with
      LARGE_CONFIG_GET
    - media: dvb-core: dmxdevfilter must always flush bufs
    - spi: stm32: fix Overrun issue at < 8bpw
    - drm/v3d: Set DMA segment size to avoid debug warnings
    - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
    - media: omap3isp: isppreview: always clamp in preview_try_format()
    - media: omap3isp: set initial format
    - media: chips-media: wave5: Fix conditional in start_streaming
    - media: chips-media: wave5: Process ready frames when CMD_STOP sent to
      Encoder
    - media: mediatek: vcodec: Don't try to decode 422/444 VP9
    - drm/amdgpu: add support for HDP IP version 6.1.1
    - drm/amd/display: Fix dsc eDP issue
    - drm/amdgpu: avoid a warning in timedout job handler
    - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
    - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
    - drm/amdgpu: Skip loading SDMA_RS64 in VF
    - drm/amd/display: only power down dig on phy endpoints
    - drm/xe: Only toggle scheduling in TDR if GuC is running
    - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
    - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug
    - spi: spi-mem: Limit octal DTR constraints to octal DTR situations
    - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
    - drm/panel: Fix a possible null-pointer dereference in
      jdi_panel_dsi_remove()
    - media: adv7180: fix frame interval in progressive mode
    - media: pvrusb2: fix URB leak in pvr2_send_request_ex
    - media: solo6x10: Check for out of bounds chip_id
    - media: cx25821: Fix a resource leak in cx25821_dev_setup()
    - media: v4l2-async: Fix error handling on steps after finding a match
    - media: mt9m114: Avoid a reset low spike during probe()
    - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
    - media: ipu6: Ensure stream_mutex is acquired when dealing with node list
    - media: ipu6: Close firmware streams on streaming enable failure
    - media: ipu6: Always close firmware stream
    - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
    - drm/amdkfd: Relax size checking during queue buffer get
    - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
    - drm: Account property blob allocations to memcg
    - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
    - virt: vbox: uapi: Mark inner unions in packed structs as packed
    - [amd64] ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to
      aggregated
    - PCI: Add Intel Nova Lake audio Device ID
    - drm/amd/display: Disable FEC when powering down encoders
    - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
    - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional
      parts
    - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
    - media: rkisp1: Fix filter mode register configuration
    - HID: multitouch: add eGalaxTouch EXC3188 support
    - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
    - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
    - ALSA: hda/realtek: fix LG Gram Style 14 speakers
    - gpio: aspeed-sgpio: Change the macro to support deferred probe
    - [arm64] ASoC: sunxi: sun50i-dmic: Add missing check for
      devm_regmap_init_mmio
    - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
    - drm/amd/display: Fix GFX12 family constant checks
    - drm/amd/display: avoid dig reg access timeout on usb4 link training fail
    - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in
      max98390_i2c_probe()
    - hwmon: (dell-smm) Add support for Dell OptiPlex 7080
    - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
    - hwmon: (f71882fg) Add F81968 support
    - HID: logitech-hidpp: Add support for Logitech K980
    - ASoC: es8328: Add error unwind in resume
    - modpost: Amend ppc64 save/restfpr symnames for -Os build
    - power: sequencing: fix missing state_lock in pwrseq_power_on() error path
    - [amd64] ASoC: SOF: Intel: hda: Fix NULL pointer dereference
    - spi: geni-qcom: Fix abort sequence execution for serial engine errors
    - ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe
    - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
    - ALSA: mixer: oss: Add card disconnect checkpoints
    - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
    - jfs: Add missing set_freezable() for freezable kthread
    - jfs: nlink overflow in jfs_rename
    - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
    - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
    - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
    - wifi: rtw89: 8922a: set random mac if efuse contains zeroes
    - wifi: rtw89: ser: enable error IMR after recovering from L1
    - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
    - wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band
      data
    - dm: replace -EEXIST with -EBUSY
    - dm: remove fake timeout to avoid leak request
    - [arm64] iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
    - net: wwan: mhi: Add network support for Foxconn T99W760
    - wifi: libertas: fix WARNING in usb_tx_block
    - [amd64] iommu/amd: move wait_on_sem() out of spinlock
    - wifi: rtw89: mac: correct page number for CSI response
    - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
    - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
    - wifi: ath11k: Fix failure to connect to a 6 GHz AP
    - wifi: ath12k: fix preferred hardware mode calculation
    - wifi: cfg80211: allow only one NAN interface, also in multi radio
    - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
    - ipv6: annotate data-races over sysctl.flowlabel_reflect
    - ipv6: exthdrs: annotate data-race over multiple sysctl
    - ext4: mark group add fast-commit ineligible
    - ext4: move ext4_percpu_param_init() before ext4_mb_init()
    - ext4: mark group extend fast-commit ineligible
    - ext4: use reserved metadata blocks when splitting extent on endio
    - netfilter: nf_conntrack: Add allow_clash to generic protocol handler
    - netfilter: xt_tcpmss: check remaining length before reading optlen
    - net: usb: r8152: fix transmit queue timeout
    - wifi: iwlwifi: mvm: check the validity of noa_len
    - wifi: rtw89: fix unable to receive probe responses under MLO connection
    - wifi: rtw89: 8922a: add digital compensation for 2GHz
    - net/rds: No shortcut out of RDS_CONN_ERROR
    - ext4: propagate flags to convert_initialized_extent()
    - gro: change the BUG_ON() in gro_pull_from_frag0()
    - ipv4: igmp: annotate data-races around idev->mr_maxdelay
    - [arm64] net: hns3: extend HCLGE_FD_AD_QID to 11 bits
    - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
    - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()
    - ipv4: fib: Annotate access to struct fib_alias.fa_state.
    - Bluetooth: btusb: Add support for MediaTek7920 0489:e158
    - Bluetooth: hci_conn: Set link_policy on incoming ACL connections
    - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
    - Bluetooth: btusb: Add new VID/PID for RTL8852CE
    - Bluetooth: btusb: Add device ID for Realtek RTL8761BU
    - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
    - net: sfp: add quirk for Lantech 8330-265D
    - wifi: rtw89: pci: restore LDO setting after device resume
    - wifi: ath10k: fix lock protection in
      ath10k_wmi_event_peer_sta_ps_state_chg()
    - bnxt_en: Allow ntuple filters for drops
    - net: usb: sr9700: remove code to drive nonexistent multicast filter
    - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
    - net/rds: Clear reconnect pending bit
    - PCI: Mark ASM1164 SATA controller to avoid bus reset
    - PCI/AER: Clear stale errors on reporting agents upon probe
    - PCI: Fix pci_slot_lock () device locking
    - PCI: Enable ACS after configuring IOMMU for OF platforms
    - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
    - PCI: Mark Nvidia GB10 to avoid bus reset
    - myri10ge: avoid uninitialized variable use
    - nfc: nxp-nci: remove interrupt trigger type
    - RDMA/rtrs-clt: For conn rejection use actual err number
    - ata: libata: avoid long timeouts on hot-unplugged SATA DAS
    - hisi_acc_vfio_pci: update status after RAS error
    - scsi: buslogic: Reduce stack usage
    - vhost: fix caching attributes of MMIO regions by setting them explicitly
    - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event
    - [riscv64] vector: init vector context with proper vlenb
    - tracing: Fix false sharing in hwlat get_sample()
    - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX
      channel is uninitialized
    - mailbox: pcc: Remove spurious IRQF_ONESHOT usage
    - mailbox: imx: Skip the suspend flag for i.MX7ULP
    - mailbox: sprd: mask interrupts that are not handled
    - remoteproc: mediatek: Break lock dependency to `prepare_lock`
    - mailbox: sprd: clear delivery flag before handling TX done
    - clk: microchip: core: correct return value on *_get_parent()
    - HID: i2c-hid: Add FocalTech FT8112
    - 9p/xen: protect xen_9pfs_front_free against concurrent calls
    - dmaengine: stm32-dma3: use module_platform_driver
    - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15)
    - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
    - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure
    - serial: 8250_dw: handle clock enable errors in runtime_resume
    - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
    - fpga: of-fpga-region: Fail if any bridge is missing
    - most: core: fix resource leak in most_register_interface error paths
    - dmaengine: sun6i: Choose appropriate burst length under maxburst
    - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings
    - phy: ti: phy-j721e-wiz: restore mux selection during resume
    - phy: cadence-torrent: restore parent clock for refclk during resume
    - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
    - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
    - usb: gadget: f_fs: fix DMA-BUF OUT queues
    - usb: gadget: f_fs: Fix ioctl error handling
    - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
    - staging: rtl8723bs: fix memory leak on failure path
    - serial: 8250: 8250_omap.c: Add support for handling UART error conditions
    - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
      termination is done
    - fix it87_wdt early reboot by reporting running timer
    - [arm*] binder: don't use %pK through printk
    - watchdog: imx7ulp_wdt: handle the nowayout option
    - phy: mvebu-cp110-utmi: fix dr_mode property read from dts
    - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
    - Revert "mfd: da9052-spi: Change read-mask to write-mask"
    - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
    - iio: Use IRQF_NO_THREAD
    - iio: magnetometer: Remove IRQF_ONESHOT
    - fs: ntfs3: check return value of indx_find to avoid infinite loop
    - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
      metadata
    - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
    - fs/ntfs3: drop preallocated clusters for sparse and compressed files
    - fs/ntfs3: avoid calling run_get_entry() when run == NULL in
      ntfs_read_run_nb_ra()
    - ceph: supply snapshot context in ceph_uninline_data()
    - libceph: define and enforce CEPH_MAX_KEY_LEN
    - thermal: int340x: Fix sysfs group leak on DLVR registration failure
    - [amd64] ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
    - include: uapi: netfilter_bridge.h: Cover for musl libc
    - drm/amd/display: Fix writeback on DCN 3.2+
    - drm/amd/display: Fix system resume lag issue
    - drm/amd/display: Avoid updating surface with the same surface under MPO
    - drm/amdgpu: Adjust usleep_range in fence wait
    - ALSA: usb-audio: Update the number of packets properly at receiving
    - drm/amdgpu: Add HAINAN clock adjustment
    - drm/amd/display: bypass post csc for additional color spaces in dal
    - spi: spidev: fix lock inversion between spi_lock and buf_lock
    - drm/radeon: Add HAINAN clock adjustment
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing
    - btrfs: replace BUG() with error handling in __btrfs_balance()
    - [arm64] hugetlbpage: avoid unused-but-set-parameter warning (gcc-16)
    - drm/amd/display: Remove conditional for shaper 3DLUT power-on
    - rtc: zynqmp: correct frequency value
    - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
    - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
    - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
    - xfrm: skip templates check for packet offload tunnel mode
    - ipmi: ipmb: initialise event handler read bytes
    - xfrm: always flush state and policy upon NETDEV_UNREGISTER event
    - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239)
    - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
    - net: usb: lan78xx: scan all MDIO addresses on LAN7801
    - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()
    - net: ethernet: xscale: Check for PTP support properly
    - bnxt_en: Fix RSS context delete logic
    - bnxt_en: Fix deleting of Ntuple filters
    - wifi: cfg80211: wext: fix IGTK key ID off-by-one
    - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option
    - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
    - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short
    - Bluetooth: hci_qca: Cleanup on all setup failures
    - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
    - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on
      L2CAP_ECRED_CONN_REQ
    - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
    - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240)
    - kcm: fix zero-frag skb in frag_list on partial sendmsg error
    - tipc: fix duplicate publication key in tipc_service_insert_publ()
    - RDMA/core: Fix stale RoCE GIDs during netdev events at registration
    - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
    - RDMA/efa: Fix typo in efa_alloc_mr()
    - net: usb: pegasus: enable basic endpoint checking
    - RDMA/umem: Fix double dma_buf_unpin in failure path
    - net/mlx5: DR, Fix circular locking dependency in dump
    - net/mlx5: E-switch, Clear legacy flag when moving to switchdev
    - net/mlx5: Fix missing devlink lock in SRIOV enable error path
    - net/mlx5e: Separate address related variables to be in struct
    - net/mlx5e: Support routed networks during IPsec MACs initialization
    - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
    - net: consume xmit errors of GSO frames
    - dpaa2-switch: validate num_ifs to prevent out-of-bounds write
    - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
    - rpmsg: core: fix race in driver_override_show() and use core helper
    - [arm64] clk: renesas: rzg2l: Fix intin variable size
    - [arm64] clk: renesas: rzg2l: Select correct div round macro
    - [amd64] ASoC: SOF: ipc4-control: If there is no data do not send bytes
      update
    - [amd64] ASoC: SOF: ipc4-topology: Correct the allocation size for bytes
      controls
    - [amd64] ASoC: SOF: ipc4-control: Use the correct size for
      scontrol->ipc_control_data
    - [amd64] ASoC: SOF: ipc4-control: Keep the payload size up to date
    - fpga: dfl: use subsys_initcall to allow built-in drivers to be added
    - Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global
      IRQ' is supported"
    - phy: qcom: edp: Make the number of clocks flexible
    - dm-verity: correctly handle dm_bufio_client_create() failure
    - media: mediatek: encoder: Fix uninitialized scalar variable issue
    - media: mtk-mdp: Fix error handling in probe function
    - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
    - media: chips-media: wave5: Fix kthread worker destruction in polling mode
    - media: chips-media: wave5: Fix device cleanup order to prevent kernel
      panic
    - media: verisilicon: AV1: Fix enable cdef computation
    - media: verisilicon: AV1: Fix tx mode bit setting
    - [arm64] dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs
    - [armhf] omap2: Fix reference count leaks in omap_control_init()
    - [amd64] KVM: x86: Return "unsupported" instead of "invalid" on access to
      unsupported PV MSR
    - [amd64] KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3()
      succeeding
    - [arm64] Disable branch profiling for all arm64 code
    - HID: hid-pl: handle probe errors
    - HID: magicmouse: Do not crash on missing msc->input
    - HID: prodikeys: Check presence of pm->input_ep82
    - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
    - [arm64] dts: apple: t8112-j473: Keep the HDMI port powered on
    - media: amphion: Drop min_queued_buffers assignment
    - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
    - media: verisilicon: AV1: Set IDR flag for intra_only frame type
    - media: radio-keene: fix memory leak in error path
    - media: cx88: Add missing unmap in snd_cx88_hw_params()
    - media: cx23885: Add missing unmap in snd_cx23885_hw_params()
    - media: cx25821: Add missing unmap in snd_cx25821_hw_params()
    - media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
    - media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
    - media: i2c: ov01a10: Fix the horizontal flip control
    - media: i2c: ov01a10: Fix reported pixel-rate value
    - media: i2c: ov01a10: Fix analogue gain range
    - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls
    - media: i2c: ov01a10: Fix passing stream instead of pad to
      v4l2_subdev_state_get_format()
    - media: i2c: ov01a10: Fix test-pattern disabling
    - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
    - media: ccs: Avoid possible division by zero
    - media: i2c: ov5647: Initialize subdev before controls
    - media: i2c: ov5647: Correct pixel array offset
    - media: i2c: ov5647: Correct minimum VBLANK value
    - media: i2c: ov5647: Sensor should report RAW color space
    - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
    - media: ccs: Fix setting initial sub-device state
    - media: i2c: ov5647: use our own mutex for the ctrl lock
    - media: ipu6: Fix typo and wrong constant in ipu6-mmu.c
    - media: ipu6: Fix RPM reference leak in probe error paths
    - [amd64] platform/x86: ISST: Add missing write block check
    - dm-integrity: fix a typo in the code for write/discard race
    - dm: clear cloned request bio pointer when last clone bio completes
    - [arm64] soc: ti: k3-socinfo: Fix regmap leak on probe failure
    - [arm64] soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
    - [amd64] KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
    - bus: omap-ocp2scp: fix OF populate on driver rebind
    - clk: clk-apple-nco: Add "apple,t8103-nco" compatible
    - [arm64,armhf] soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON
      definition
    - [arm64,armhf] soc: rockchip: grf: Support multiple grf to be handled
    - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop
    - media: i2c: ov01a10: Fix digital gain range
    - clk: tegra: tegra124-emc: Fix potential memory leak in
      tegra124_clk_register_emc()
    - [s390x] pci: Handle futile config accesses of disabled devices directly
    - reset: gpio: suppress bind attributes in sysfs
    - dm-integrity: fix recalculation in bitmap mode
    - dm-unstripe: fix mapping bug when there are multiple targets in a table
    - [arm64] dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
    - media: venus: vdec: fix error state assignment for zero bytesused
    - media: venus: vdec: restrict EOS addr quirk to IRIS2 only
    - drm: of: drm_of_panel_bridge_remove(): fix device_node leak
    - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
    - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs
    - drm/buddy: Prevent BUG_ON by validating rounded allocation
    - drm/bridge: anx7625: Fix invalid EDID size
    - xfs: mark data structures corrupt on EIO and ENODATA
    - xfs: remove xfs_attr_leaf_hasname
    - media: verisilicon: AV1: Fix tile info buffer size
    - [amd64] iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in
      scalable mode
    - mfd: core: Add locking around 'mfd_of_node_list'
    - mfd: qcom-pm8xxx: Fix OF populate on driver rebind
    - mfd: omap-usb-host: Fix OF populate on driver rebind
    - iio: accel: adxl380: Avoid reading more entries than present in FIFO
    - xfs: delete attr leaf freemap entries when empty
    - xfs: fix freemap adjustments when adding xattrs to leaf blocks
    - xfs: fix the xattr scrub to detect freemap/entries array collisions
    - xfs: fix remote xattr valuelblk check
    - [amd64] KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
    - PCI: endpoint: Fix swapped parameters in
      pci_{primary/secondary}_epc_epf_unlink() functions
    - pinctrl: intel: Add code name documentation
    - xfs: only call xf{array,blob}_destroy if we have a valid pointer
    - xfs: check return value of xchk_scrub_create_subord
    - xfs: check for deleted cursors when revalidating two btrees
    - md/bitmap: fix GPF in write_page caused by resize race
    - nfsd: fix return error code for nfsd_map_name_to_[ug]id
    - nvmem: Drop OF node reference on nvmem_add_one_cell() failure
    - [amd64] x86/kexec: add a sanity check on previous kernel's ima kexec
      buffer
    - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node
    - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
    - io_uring/net: don't continue send bundle if poll was required for retry
    - bus: fsl-mc: fix an error handling in fsl_mc_device_add()
    - dm mpath: make pg_init_delay_msecs settable
    - [arm64] poe: fix stale POR_EL0 values for ptrace
    - tools: Fix bitfield dependency failure
    - vhost: move vdpa group bound check to vhost_vdpa
    - [powerpc*] smp: Add check for kcalloc() failure in parse_thread_groups()
    - iio: gyro: itg3200: Fix unchecked return value in read_raw
    - mtd: spinand: Disable continuous read during probe
    - mm/highmem: fix __kmap_to_page() build error
    - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
    - ocfs2: fix reflink preserve cleanup issue
    - kexec: derive purgatory entry from symbol
    - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling
      SR-IOV"
    - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
    - [arm64] Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
    - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
    - btrfs: continue trimming remaining devices on failure
    - remoteproc: imx_rproc: Fix invalid loaded resource table detection
    - perf/arm-cmn: Reject unsupported hardware configurations
    - scsi: ufs: core: Flush exception handling work when RPM level is zero
    - mm/slab: use unsigned long for orig_size to ensure proper metadata align
    - PCI: dwc: Fix msg_atu_index assignment
    - usb: dwc3: gadget: Move vbus draw to workqueue context
    - usb: dwc2: fix resume failure if dr_mode is host
    - mtd: rawnand: pl353: Fix software ECC support
    - tipc: fix RCU dereference race in tipc_aead_users_dec()
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
    - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error
      path
    - PCI: Fix pci_slot_trylock() error handling
    - staging: rtl8723bs: fix null dereference in find_network
    - kcsan, compiler_types: avoid duplicate type issues in BPF Type Format
    - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs()
    - cifs: Fix locking usage for tcon fields
    - ceph: supply snapshot context in ceph_zero_partial_object()
    - rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0
    - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
    - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
    - octeontx2-af: CGX: fix bitmap leaks
    - net: ti: icssg-prueth: Add optional dependency on HSR
    - net: macb: Fix tx/rx malfunction after phy link down and up
    - tracing: Fix to set write permission to per-cpu buffer_size_kb
    - io_uring/filetable: clamp alloc_hint to the configured alloc range
    - drm/amd/display: Increase DCN35 SR enter/exit latency
    - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
    - procfs: fix possible double mmput() in do_procmap_query()
    - net: intel: fix PCI device ID conflict between i40e and ipw2200
    - atm: fore200e: fix use-after-free in tasklets during device removal
    - function_graph: Restore direct mode when callbacks drop to one
    - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
    - mm: numa_memblks: Identify the accurate NUMA ID of CFMW
    - fbcon: check return value of con2fb_acquire_newinfo()
    - fbdev: vt8500lcdfb: fix missing dma_free_coherent()
    - fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
    - fbdev: ffb: fix corrupted video output on Sun FFB1
    - fbcon: Remove struct fbcon_display.inverse
    - cifs: some missing initializations on replay
    - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
    - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
    - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
    - [amd64] x86/kexec: Copy ACPI root pointer address from config table
    - [arm64] Force the use of CNTVCT_EL0 in __delay()
    - drm/amdgpu: keep vga memory on MacBooks with switchable graphics
    - net: nfc: nci: Fix parameter validation for packet data
    - tracing: ring-buffer: Fix to check event length before using
    - fgraph: Do not call handlers direct when not using ftrace_ops
    - tracing: Fix checking of freed trace_event_file for hist files
    - tracing: Wake up poll waiters for hist files when removing an event
    - NTB: ntb_transport: Fix too small buffer for debugfs_name
    - ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl()
    - [amd64] drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
    - xfs: fix copy-paste error in previous fix
    - [arm64] Fix sampling the "stable" virtual counter in preemptible section
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.76
    - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec
      buffer"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.77
    - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
    - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
    - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
    - [arm64] KVM: arm64: Hide S1POE from guests when not supported by the host
    - [riscv64] irqchip/sifive-plic: Fix frozen interrupt due to affinity
      setting
    - scsi: lpfc: Properly set WC for DPP mapping
    - scsi: pm8001: Fix use-after-free in pm8001_queue_command()
    - ALSA: scarlett2: Fix redeclaration of loop variable
    - ALSA: scarlett2: Fix DSP filter control array handling
    - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
    - [amd64] x86/fred: Correct speculative safety in fred_extint()
    - rseq: Clarify rseq registration rseq_size bound check comment
    - cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in
      update_cpumasks_hier()
    - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
    - ALSA: usb-audio: Cap the packet size pre-calculations
    - ALSA: usb-audio: Use inclusive terms
    - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
    - [s390x] idle: Fix cpu idle exit cpu time accounting
    - [s390x] vtime: Fix virtual timer forwarding
    - PCI: endpoint: Introduce pci_epc_function_is_valid()
    - PCI: endpoint: Introduce pci_epc_mem_map()/unmap()
    - [arm64] PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr()
      operation
    - [arm64] PCI: dwc: ep: Use align addr function for
      dw_pcie_ep_raise_{msi,msix}_irq()
    - [arm64] PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
    - drm/amdgpu: Unlock a mutex before destroying it
    - drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user
    - drm/amdgpu: Fix locking bugs in error paths
    - ALSA: pci: hda: use snd_kcontrol_chip()
    - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()
    - btrfs: fix incorrect key offset in error message in
      check_dev_extent_item()
    - btrfs: fix objectid value in error message in check_extent_data_ref()
    - btrfs: fix warning in scrub_verify_one_metadata()
    - btrfs: print correct subvol num if active swapfile prevents deletion
    - btrfs: fix compat mask in error messages in btrfs_check_features()
    - [arm64] bpf, arm64: Force 8-byte alignment for JIT buffer to prevent
      atomic tearing
    - bpf: Fix stack-out-of-bounds write in devmap
    - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value
    - [amd64] x86/acpi/boot: Correct acpi_is_processor_usable() check again
    - [arm64] memory: mtk-smi: fix device leaks on common probe
    - [arm64] memory: mtk-smi: fix device leak on larb probe
    - resource: Add resource set range and size helpers
    - PCI: Use resource_set_range() that correctly sets ->end
    - media: tegra-video: Fix memory leak in __tegra_channel_try_format()
    - media: dw9714: move power sequences to dedicated functions
    - media: dw9714: add support for powerdown pin
    - media: dw9714: Fix powerup sequence
    - [amd64] KVM: x86: Ignore -EBUSY when checking nested events from
      vcpu_block()
    - ata: libata-scsi: Refactor ata_scsi_simulate()
    - ata: libata-scsi: Refactor ata_scsiop_read_cap()
    - ata: libata-scsi: Refactor ata_scsiop_maint_in()
    - ata: libata-scsi: Document all VPD page inquiry actors
    - ata: libata-scsi: Remove struct ata_scsi_args
    - ata: libata: Remove ATA_DFLAG_ZAC device flag
    - ata: libata: Introduce ata_port_eh_scheduled()
    - ata: libata-scsi: avoid Non-NCQ command starvation
    - [arm64,armhf] drm/tegra: dsi: fix device leak on probe
    - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT
    - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting
      I/O
    - mailbox: don't protect of_parse_phandle_with_args with con_mutex
    - mailbox: sort headers alphabetically
    - mailbox: remove unused header files
    - mailbox: Use dev_err when there is error
    - mailbox: Use guard/scoped_guard for con_mutex
    - mailbox: Allow controller specific mapping using fwnode
    - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
    - ext4: add ext4_try_lock_group() to skip busy groups
    - ext4: factor out __ext4_mb_scan_group()
    - ext4: factor out ext4_mb_might_prefetch()
    - ext4: factor out ext4_mb_scan_group()
    - ext4: convert free groups order lists to xarrays
    - ext4: refactor choose group to scan group
    - ext4: implement linear-like traversal across order xarrays
    - ext4: always allocate blocks only from groups inode can use
    - workqueue: Add system_percpu_wq and system_dfl_wq
    - Input: synaptics_i2c - replace use of system_wq with system_dfl_wq
    - Input: synaptics_i2c - guard polling restart in resume
    - [amd64] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device
      without scalable mode
    - [arm64] dts: rockchip: Fix rk356x PCIe range mappings
    - [arm64] dts: rockchip: Fix rk3588 PCIe range mappings
    - [armhf] clk: tegra: tegra124-emc: fix device leak on set_rate()
    - ima: kexec: silence RCU list traversal warning
    - ima: rename variable the seq_file "file" to "ima_kexec_file"
    - ima: define and call ima_alloc_kexec_file_buf()
    - kexec: define functions to map and unmap segments
    - ima: kexec: define functions to copy IMA log at soft boot
    - ima: verify the previous kernel's IMA buffer lies in addressable RAM
    - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()
    - drm/exynos: vidi: fix to avoid directly dereferencing user pointer
    - drm/exynos/vidi: Remove redundant error handling in vidi_get_modes()
    - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member
      variables related to memory alloc/free (CVE-2026-23227)
    - uprobes: switch to RCU Tasks Trace flavor for better performance
    - uprobes: Fix incorrect lockdep condition in filter_chain()
    - btrfs: drop unused parameter fs_info from do_reclaim_sweep()
    - btrfs: get used bytes while holding lock at btrfs_reclaim_bgs_work()
    - btrfs: fix reclaimed bytes accounting after automatic block group reclaim
    - btrfs: fix periodic reclaim condition
    - btrfs: zoned: fix alloc_offset calculation for partly conventional block
      groups
    - btrfs: zoned: fixup last alloc pointer after extent removal for RAID1
    - btrfs: zoned: fixup last alloc pointer after extent removal for DUP
    - btrfs: zoned: fix stripe width calculation
    - btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros
    - btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10
    - [riscv64] usb: cdns3: remove redundant if branch
    - [riscv64] usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
    - [riscv64] usb: cdns3: fix role switching during resume
    - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()
      (Closes: #1130930)
    - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
    - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization
      induced race
    - ksmbd: check return value of xa_store() in krb5_authenticate
    - ksmbd: add chann_lock to protect ksmbd_chann_list xarray (CVE-2026-23226)
    - ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)
    - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)
    - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
    - net: arcnet: com20020-pci: fix support for 2.5Mbit cards
    - eventpoll: Fix integer overflow in ep_loop_check_proc()
    - namespace: fix proc mount iteration
    - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
    - nfc: pn533: properly drop the usb interface reference on disconnect
    - net: usb: kaweth: validate USB endpoints
    - net: usb: kalmia: validate USB endpoints
    - net: usb: pegasus: validate USB endpoints
    - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a
      message
    - can: usb: f81604: correctly anchor the urb in the read bulk callback
    - can: ucan: Fix infinite loop from zero-length messages
    - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
    - can: usb: f81604: handle short interrupt urb messages properly
    - can: usb: f81604: handle bulk write errors properly
    - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
    - [amd64] x86/efi: defer freeing of boot services memory
    - [amd64] platform/x86: dell-wmi-sysman: Don't hex dump plaintext password
      data
    - [amd64] platform/x86: dell-wmi: Add audio/mic mute key codes
    - ALSA: usb-audio: Use correct version for UAC3 header validation
    - wifi: radiotap: reject radiotap with unknown bits
    - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
    - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
    - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
    - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
    - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
    - net/sched: ets: fix divide by zero in the offload path
    - nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
    - tracing: Fix WARN_ON in tracing_buffers_mmap_close
    - scsi: target: Fix recursive locking in __configfs_open_file()
    - Squashfs: check metadata block offset is within range
    - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
    - drbd: fix null-pointer dereference on local read error
    - smb: client: fix cifs_pick_channel when channels are equally loaded
    - smb: client: fix broken multichannel with krb5+signing
    - smb: client: Don't log plaintext credentials in cifs_set_cifscreds
    - scsi: core: Fix refcount leak for tagset_refcnt
    - xattr: switch to CLASS(fd) (CVE-2024-14027)
    - btrfs: always fallback to buffered write if the inode requires checksum
    - ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with
      clang < 18
    - nvme: fix admin queue leak on controller reset
    - hwmon: (aht10) Add support for dht20
    - hwmon: (aht10) Fix initialization commands for AHT20
    - pinctrl: equilibrium: rename irq_chip function callbacks
    - pinctrl: equilibrium: fix warning trace on load
    - [amd64] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
    - HID: multitouch: add quirks for Lenovo Yoga Book 9i
    - HID: multitouch: new class MT_CLS_EGALAX_P80H84
    - [amd64] pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
    - hwmon: (it87) Check the it87_lock() return value
    - [amd64,arm64] idpf: change IRQ naming to match netdev and ethtool queue
      numbering
    - i40e: Fix preempt count leak in napi poll tracepoint
    - e1000e: clear DPG_EN after reset to avoid autonomous power-gating
    - drm/solomon: Fix page start when updating rectangle in page addressing
      mode
    - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling
      in ALE table
    - xsk: Get rid of xdp_buff_xsk::xskb_list_node
    - xsk: s/free_list_node/list_node/
    - xsk: Fix fragment node deletion to prevent buffer leak
    - xsk: Fix zero-copy AF_XDP fragment drop
    - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
    - [arm64] net: ti: icssg-prueth: Fix ping failure after offload mode setup
      when link speed is not 1G
    - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds
    - can: bcm: fix locking for bcm_op runtime updates
    - can: mcp251x: fix deadlock in error path of mcp251x_open
    - wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
    - drm/xe: Do not preempt fence signaling CS instructions
    - kunit: tool: copy caller args in run_kernel to prevent mutation
    - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
    - octeon_ep: Relocate counter updates before NAPI
    - octeon_ep: avoid compiler and IQ/OQ reordering
    - octeon_ep_vf: Relocate counter updates before NAPI
    - octeon_ep_vf: avoid compiler and IQ/OQ reordering
    - wifi: cw1200: Fix locking in error paths
    - wifi: wlcore: Fix a locking bug
    - wifi: mt76: mt7996: Fix possible oob access in
      mt7996_mac_write_txwi_80211()
    - wifi: mt76: mt7925: Fix possible oob access in
      mt7925_mac_write_txwi_80211()
    - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
    - indirect_call_wrapper: do not reevaluate function pointer
    - net/rds: Fix circular locking dependency in rds_tcp_tune
    - xen/acpi-processor: fix _CST detection using undersized evaluation buffer
    - iavf: fix netdev->max_mtu to respect actual hardware limit
    - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
    - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()
    - smb/client: fix buffer size for smb311_posix_qinfo in
      SMB311_posix_query_info()
    - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
    - net: ipv4: fix ARM64 alignment fault in multipath hash seed
    - amd-xgbe: fix sleep while atomic on suspend/resume
    - drm/sched: Fix kernel-doc warning for drm_sched_job_done()
    - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
    - drm/xe/reg_sr: Fix leak on xa_store failure
    - nvme: reject invalid pr_read_keys() num_keys values
    - nvme: fix memory allocation in nvme_pr_read_keys()
    - hwmon: (max6639) : Configure based on DT property
    - hwmon: (max6639) fix inverted polarity
    - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless
      qdiscs
    - net: nfc: nci: Fix zero-length proprietary notifications
    - net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset()
    - nfc: nci: free skb on nci_transceive early error paths
    - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
    - nfc: rawsock: cancel tx_work before socket teardown
    - net: stmmac: Fix error handling in VLAN add and delete paths
    - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
    - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in
      mtk_xdp_setup()
    - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
    - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
    - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
    - net/sched: act_ife: Fix metalist update behavior
    - xdp: use modulo operation to calculate XDP frag tailroom
    - xsk: introduce helper to determine rxq->frag_size
    - i40e: fix registering XDP RxQ info
    - i40e: use xdp.frame_sz as XDP RxQ info frag_size
    - xdp: produce a warning when calculated tailroom is negative
    - tracing: Add NULL pointer check to trigger_data_free()
    - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared
      blocks
    - ext4: fix potential null deref in ext4_mb_init()
    - ata: libata-core: fix cancellation of a port deferred qc work
    - ata: libata-eh: correctly handle deferred qc timeouts
    - ata: libata: cancel pending work after clearing deferred_qc
    - ata: libata-eh: Fix detection of deferred qc timeouts
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.78
    - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
    - [amd64] ACPI: PM: Save NVS memory on Lenovo G70-35
    - scsi: mpi3mr: Add NULL checks when resetting request and reply queues
    - ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
    - unshare: fix unshare_fs() handling
    - wifi: mac80211: set default WMM parameters on all links
    - ACPI: OSI: Add DMI quirk for Acer Aspire One D255
    - scsi: ses: Fix devices attaching to different hosts
    - [amd64] ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
    - [amd64] ASoC: cs42l43: Report insert for exotic peripherals
    - scsi: ufs: core: Fix possible NULL pointer dereference in
      ufshcd_add_command_trace()
    - scsi: ufs: core: Fix shift out of bounds when MAXQ=32
    - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
    - drm/amdgpu/vcn5: Add SMU dpm interface type
    - ALSA: usb-audio: Check max frame size for implicit feedback mode, too
    - kexec: Consolidate machine_kexec_mask_interrupts() implementation
    - kexec: Include kernel-end even without crashkernel
    - [powerpc*] kexec/core: use big-endian types for crash variables
    - [powerpc*] crash: adjust the elfcorehdr size
    - remoteproc: sysmon: Correct subsys_name_len type in QMI request
    - remoteproc: mediatek: Unprepare SCP clock during system suspend
    - [powerpc*] 83xx: km83xx: Fix keymile vendor prefix
    - smb/server: Fix another refcount leak in smb2_open()
    - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
    - [arm64] drm/msm/dsi: fix hdisplay calculation when programming dsi
      registers
    - xprtrdma: Decrement re_receiving on the early exit paths
    - btrfs: hold space_info->lock when clearing periodic reclaim ready
    - workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
    - perf disasm: Fix off-by-one bug in outside check
    - [arm64] drm/msm/dsi: fix pclk rate calculation for bonded dsi
    - drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
    - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
    - net/mlx5: IFC updates for disabled host PF
    - net/mlx5: Query to see if host PF is disabled
    - net/mlx5: Fix deadlock between devlink lock and esw->wq
    - net/mlx5: Fix crash when moving to switchdev mode
    - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
    - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL
      slave xmit (CVE-2026-23277)
    - ASoC: soc-core: drop delayed_work_pending() check before flush
    - ASoC: soc-core: flush delayed work before removing DAIs and widgets
    - ASoC: simple-card-utils: use __free(device_node) for device node
    - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
    - net: sfp: improve Huawei MA5671a fixup
    - serial: caif: hold tty->link reference in ldisc_open and ser_release
    - bnxt_en: Fix RSS table size check when changing ethtool channels
    - mctp: i2c: fix skb memory leak in receive path
    - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return
      value
    - bonding: add ESP offload features when slaves support
    - bonding: Correctly support GSO ESP offload
    - net: add a common function to compute features for upper devices
    - bonding: use common function to compute the features
    - bonding: fix type confusion in bond_setup_by_slave()
    - mctp: route: hold key->lock in mctp_flow_prepare_output()
    - [amd64,arm64] amd-xgbe: fix link status handling in xgbe_rx_adaptation
    - [amd64,arm64] amd-xgbe: prevent CRC errors during RX adaptation with AN
      disabled
    - xdp: allow attaching already registered memory model to xdp_rxq_info
    - xdp: register system page pool as an XDP memory model
    - net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276)
    - netfilter: nf_tables: always walk all pending catchall elements
      (CVE-2026-23278)
    - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
    - netfilter: x_tables: guard option walkers against 1-byte tail reads
    - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
    - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
    - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
      (CVE-2026-23274)
    - perf annotate: Fix hashmap__new() error checking
    - regulator: pca9450: Correct interrupt type
    - perf ftrace: Fix hashmap__new() error checking
    - sched: idle: Make skipping governor callbacks more consistent
    - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
    - nvme-pci: Fix race bug in nvme_poll_irqdisable()
    - i40e: fix src IP mask checks and memcpy argument names in cloud filter
    - e1000/e1000e: Fix leak in DMA error cleanup
    - net: bcmgenet: fix broken EEE by converting to phylib-managed state
    - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
    - [amd64] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock
      acquisition
    - ASoC: detect empty DMI strings
    - drm/amdkfd: Unreserve bo if queue update failed
    - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
    - [arm64] octeontx2-af: devlink: fix NIX RAS reporter recovery condition
    - [arm64] octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt
      status
    - net: prevent NULL deref in ip[6]tunnel_xmit()
    - iio: imu: inv-mpu9150: fix irq ack preventing irq storms
    - usb: gadget: f_mass_storage: Fix potential integer overflow in
      check_command_size_in_blocks()
    - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on"
    - cgroup: fix race between task migration and iteration
    - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
    - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer
      interfaces
    - net: usb: lan78xx: fix silent drop of packets with checksum errors
    - net: usb: lan78xx: fix TX byte statistics for small packets
    - net: usb: lan78xx: skip LTM configuration for LAN7850
    - ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
    - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
    - [amd64] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with
      in-kernel APIC
    - USB: add QUIRK_NO_BOS for video capture several devices
    - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
    - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
    - usb: xhci: Fix memory leak in xhci_disable_slot()
    - usb: xhci: Prevent interrupt storm on host controller error (HCE)
    - usb: yurex: fix race in probe
    - usb: dwc3: pci: add support for the Intel Nova Lake -H
    - usb: misc: uss720: properly clean up reference in uss720_probe()
    - usb: core: don't power off roothub PHYs if phy_set_mode() fails
    - usb: cdc-acm: Restore CAP_BRK functionnality to CH343
    - usb: roles: get usb role switch from parent only for usb-b-connector
    - usb: typec: altmode/displayport: set displayport signaling rate in
      configure message
    - USB: usbcore: Introduce usb_bulk_msg_killable()
    - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
    - USB: core: Limit the length of unkillable synchronous timeouts
    - usb: class: cdc-wdm: fix reordering issue in read code path
    - usb: mdc800: handle signal and read racing
    - usb: image: mdc800: kill download URB on timeout
    - mm/tracing: rss_stat: ensure curr is false from kthread context
    - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
    - mm/kfence: disable KFENCE upon KASAN HW tags enablement
    - mmc: core: Avoid bitfield RMW for claim/retune flags
    - [arm64] ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and
      start
    - tipc: fix divide-by-zero in tipc_sk_filter_connect()
    - kprobes: avoid crash when rmmod/insmod after ftrace killed
    - ceph: add a bunch of missing ceph_path_info initializers
    - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
    - libceph: reject preamble if control segment is empty
    - libceph: prevent potential out-of-bounds reads in process_message_header()
    - libceph: Use u32 for non-negative values in ceph_monmap_decode()
    - libceph: admit message frames only in CEPH_CON_S_OPEN state
    - ceph: fix i_nlink underrun during async unlink
    - ceph: fix memory leaks in ceph_mdsc_build_path()
    - time/jiffies: Mark jiffies_64_to_clock_t() notrace
    - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
    - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
    - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset
      spec
    - scsi: hisi_sas: Use macro instead of magic number
    - scsi: hisi_sas: Fix NULL pointer exception during user_scan()
    - kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17
    - Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures
    - Revert "tcpm: allow looking for role_sw device in the main node"
    - drm/amd: Disable MES LR compute W/A
    - drm/bridge: samsung-dsim: Fix memory leak in error path
    - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
    - [s390x] pfault: Fix virtual vs physical address confusion
    - nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
    - device property: Allow secondary lookup in fwnode_get_next_child_node()
    - [arm64,armhf] irqchip/gic-v3-its: Limit number of per-device MSIs to the
      range the ITS supports
    - btrfs: fix chunk map leak in btrfs_map_block() after
      btrfs_chunk_map_num_copies()
    - ice: reintroduce retry mechanism for indirect AQ
    - ixgbevf: fix link setup issue
    - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
    - staging: rtl8723bs: fix potential out-of-bounds read in
      rtw_restruct_wmm_ie
    - media: dvb-net: fix OOB access in ULE extension header tables
    - [amd64,arm64] net: mana: Ring doorbell at 4 CQ wraparounds
    - ice: fix retry for AQ command 0x06EE
    - tracing: Fix syscall events activation by ensuring refcount hits zero
    - net/tcp-ao: Fix MAC comparison to be constant-time
    - batman-adv: Avoid double-rtnl_lock ELP metric worker
    - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
    - [arm64] mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
    - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
    - [arm64] contpte: fix set_access_flags() no-op check for SMMU/ATS faults
    - pmdomain: bcm: bcm2835-power: Fix broken reset status read
    - ata: libata-core: Disable LPM on ST1000DM010-2EP102
    - drm/amd/display: Fallback to boot snapshot for dispclk
    - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
    - smb: server: fix use-after-free in smb2_open()
    - ksmbd: fix use-after-free by using call_rcu() for oplock_info
    - net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
    - net: ncsi: fix skb leak in error paths
    - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
    - net: dsa: microchip: Fix error path in PTP IRQ setup
    - drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x
    - drm/amdgpu: Fix use-after-free race in VM acquire
    - drm/amd: Set num IP blocks to 0 if discovery fails
    - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
    - [amd64] drm/i915: Fix potential overflow of shmem scatterlist length
    - [arm64] drm/msm: Fix dma_free_attrs() buffer size
    - tracing: Fix enabling multiple events on the kernel command line and
      bootconfig
    - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
    - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
    - cifs: make default value of retrans as zero
    - xfs: fix returned valued from xfs_defer_can_append
    - xfs: fix undersized l_iclog_roundoff values
    - xfs: ensure dquot item is deleted from AIL only after log shutdown
    - [s390x] dasd: Move quiesce state with pprc swap
    - [s390x] dasd: Copy detected format information to secondary device
    - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
    - scsi: core: Fix error handling for scsi_alloc_sdev()
    - [amd64] x86/apic: Disable x2apic on resume if the kernel expects so
    - lib/bootconfig: fix snprintf truncation check in
      xbc_node_compose_key_after()
    - lib/bootconfig: check bounds before writing in __xbc_open_brace()
    - smb: client: fix atomic open with O_DIRECT & O_SYNC
    - smb: client: fix in-place encryption corruption in SMB2_write()
    - smb: client: fix iface port assignment in parse_server_interfaces
    - btrfs: fix transaction abort on file creation due to name hash collision
    - btrfs: fix transaction abort on set received ioctl due to item overflow
    - btrfs: abort transaction on failure to update root in the received subvol
      ioctl
    - iio: dac: ds4424: reject -128 RAW value
    - iio: frequency: adf4377: Fix duplicated soft reset mask
    - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
    - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
    - iio: potentiometer: mcp4131: fix double application of wiper shift
    - iio: chemical: bme680: Fix measurement wait duration calculation
    - iio: buffer: Fix wait_queue not being removed
    - iio: gyro: mpu3050-core: fix pm_runtime error handling
    - iio: gyro: mpu3050-i2c: fix pm_runtime error handling
    - iio: imu: inv_icm42600: fix odr switch to the same value
    - iio: imu: inv_icm42600: fix odr switch when turning buffer off
    - iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
    - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
    - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
    - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
    - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
    - net/tcp-md5: Fix MAC comparison to be constant-time
    - ksmbd: Compare MACs in constant time (CVE-2026-23364)
    - smb: client: Compare MACs in constant time
    - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
    - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
    - spi: cadence-quadspi: Implement refcount to handle unbind during busy
      (CVE-2025-40005)
    - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
      (CVE-2026-23386)
    - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
      (CVE-2026-23368)
    - [amd64] x86/sev: Allow IBPB-on-Entry feature for SNP guests
    - [amd64] platform/x86: hp-bioscfg: Support allocations of larger data
      (Closes: #1127612)
    - wifi: libertas: fix use-after-free in lbs_free_adapter() (CVE-2026-23281)
    - [amd64] perf/x86/intel/uncore: Support more units on Granite Rapids
    - [amd64] perf/x86/intel/uncore: Add per-scheduler IMC CAS count events
    - mptcp: pm: in-kernel: always mark signal+subflow endp as used
    - mptcp: pm: avoid sending RM_ADDR over same subflow
    - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
    - kbuild: Leave objtool binary around with 'make clean'
    - net/sched: act_gate: snapshot parameters with RCU on replace
      (CVE-2026-23245)
    - xfs: Fix error pointer dereference
    - can: gs_usb: gs_can_open(): always configure bitrates before starting
      device
    - cleanup: Provide retain_and_null_ptr()
    - usb: gadget: f_ncm: Fix net_device lifecycle with device_move
    - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
    - [amd64] KVM: SVM: Limit AVIC physical max index based on configured
      max_vcpu_ids
    - [amd64] KVM: SVM: Add a helper to look up the max physical ID for AVIC
    - [amd64] KVM: SVM: Set/clear CR8 write interception when AVIC is
      (de)activated
    - [arm64,armhf] mmc: dw_mmc-rockchip: use modern PM macros
    - [arm64,armhf] mmc: dw_mmc-rockchip: Add memory clock auto-gating support
    - [arm64,armhf] mmc: dw_mmc-rockchip: Fix runtime PM support for internal
      phase support
    - mm/page_alloc: move set_page_refcounted() to callers of post_alloc_hook()
    - mm/page_alloc: sort out the alloc_contig_range() gfp flags mess
    - mm/page_alloc: forward the gfp flags from alloc_contig_range() to
      post_alloc_hook()
    - mm/kfence: fix KASAN hardware tag faults during late enablement
    - nsfs: tighten permission checks for ns iteration ioctls
    - sched_ext: Disable preemption between scx_claim_exit() and kicking helper
      work
    - sched_ext: Fix starvation of scx_enable() under fair-class saturation
    - iomap: reject delalloc mappings during writeback
    - fgraph: Fix thresh_return clear per-task notrace
    - [amd64] KVM: x86: Co-locate initialization of feature MSRs in
      kvm_arch_vcpu_create()
    - [amd64] KVM: x86: Quirk initialization of feature MSRs to KVM's max
      configuration
    - [amd64] KVM: x86: do not allow re-enabling quirks
    - [amd64] KVM: x86: Allow vendor code to disable quirks
    - [amd64] KVM: x86: Introduce supported_quirks to block disabling quirks
    - [amd64] KVM: x86: Introduce Intel specific quirk
      KVM_X86_QUIRK_IGNORE_GUEST_PAT
    - [amd64] KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET
    - [amd64] KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
    - ksmbd: Don't log keys in SMB3 signing and encryption key generation
    - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
    - net: macb: Shuffle the tx ring before enabling tx
    - cifs: open files should not hold ref on superblock
    - xfs: fix integer overflow in bmap intent sort comparator
    - drm/xe/sync: Cleanup partially initialized sync on parse failure
    - ipv6: use RCU in ip6_xmit() (CVE-2025-40135)
    - dm-verity: disable recursive forward error correction (CVE-2025-71161)
    - rxrpc: Fix recvmsg() unconditional requeue
    - btrfs: do not strictly require dirty metadata threshold for metadata
      writepages (CVE-2026-23157)
    - ice: fix devlink reload call trace (CVE-2026-23104)
    - tracing: Add recursion protection in kernel stack trace recording
      (CVE-2026-23138)
    - [amd64] Octeontx2-af: Add proper checks for fwdata (CVE-2026-23070)
    - io_uring/uring_cmd: fix too strict requirement on ioctl
    - [amd64] x86/uprobes: Fix XOL allocation failure for 32-bit tasks
    - [amd64] platform/x86/amd/pmc: Add support for Van Gogh SoC
      (CVE-2025-68334)
    - mptcp: pm: in-kernel: always set ID as avail when rm endp
    - net: stmmac: remove support for lpi_intr_o
    - f2fs: compress: change the first parameter of page_array_{alloc,free} to
      sbi
    - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
      (CVE-2025-38627)
    - f2fs: fix to avoid migrating empty section (CVE-2025-40150)
    - blk-throttle: fix access race during throttle policy activation
      (CVE-2025-40147)
    - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
      (CVE-2025-71221)
    - net: dsa: properly keep track of conduit reference (CVE-2025-71152)
    - binfmt_misc: restore write access before closing files opened by
      open_exec() (CVE-2025-68239)
    - xfs: get rid of the xchk_xfile_*_descr calls
    - erofs: fix inline data read failure for ztailpacking pclusters
    - mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
    - sched_ext: Remove redundant css_put() in scx_cgroup_init()
    - io_uring/kbuf: check if target buffer list is still legacy on recycle
    - sched/fair: Fix zero_vruntime tracking
    - [s390x] stackleak: Fix __stackleak_poison() inline assembly constraint
    - [s390x] xor: Fix xor_xc_2() inline assembly constraints
    - [amd64] drm/i915/alpm: ALPM disable fixes
    - [amd64] drm/i915/psr: Repeat Selective Update area alignment
    - drm/amd/display: Add pixel_clock to amd_pp_display_configuration
    - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
    - drm/amdgpu: Add basic validation for RAS header (CVE-2025-38426)
    - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
    - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
    - HID: bpf: prevent buffer overflow in hid_hw_request
    - sunrpc: fix cache_request leak in cache_release
    - nvdimm/bus: Fix potential use after free in asynchronous initialization
    - NFC: nxp-nci: allow GPIOs to sleep
    - net: macb: fix use-after-free access to PTP clock
    - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
    - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
    - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
    - smb: client: fix krb5 mount with username option
    - ksmbd: unset conn->binding on failed binding request
    - ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
    - [amd64] drm/i915/dsc: Add Selective Update register definitions
    - [amd64] drm/i915/dsc: Add helper for writing DSC Selective Update ET
      parameters
    - [amd64] drm/i915/psr: Write DSC parameters on Selective Update in ET mode
    - [s390x] zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
    - kprobes: Remove unneeded goto
    - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
    - btrfs: fix transaction abort when snapshotting received subvolumes
    - batman-adv: avoid OGM aggregation when skb tailroom is insufficient
    - net: macb: Introduce gem_init_rx_ring()
    - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during
      resume
    - ata: libata-core: disable LPM on ADATA SU680 SSD
    - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
    - mmc: sdhci: fix timing selection for 1-bit bus width
    - pmdomain: bcm: bcm2835-power: Increase ASB control timeout
    - spi: fix use-after-free on controller registration failure
    - spi: fix statistics allocation
    - mtd: rawnand: pl353: make sure optimal timings are applied
    - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in
      cadence_nand_init()
    - mtd: Avoid boot crash in RedBoot partition table parser
    - [amd64] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
    - serial: 8250_pci: add support for the AX99100
    - serial: 8250: Fix TX deadlock when using DMA
    - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART
      BUSY
    - serial: uartlite: fix PM runtime usage count underflow on probe
    - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
    - drm: Fix use-after-free on framebuffers and property blobs when calling
      drm_dev_unplug
    - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START,
      END}
    - drm/amdgpu/gmc9.0: add bounds checking for cid
    - drm/amdgpu/mmhub2.0: add bounds checking for cid
    - drm/amdgpu/mmhub2.3: add bounds checking for cid
    - drm/amdgpu/mmhub3.0.1: add bounds checking for cid
    - drm/amdgpu/mmhub3.0.2: add bounds checking for cid
    - drm/amdgpu/mmhub3.0: add bounds checking for cid
    - drm/amdgpu/mmhub4.1.0: add bounds checking for cid
    - drm/imagination: Fix deadlock in soft reset sequence
    - drm/radeon: apply state adjust rules to some additional HAINAN vairants
    - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
    - drm/xe/oa: Allow reading after disabling OA stream
    - drm/xe: Open-code GGTT MMIO access protection
    - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
      (CVE-2026-23395)
    - ata: libata-scsi: Return residual for emulated SCSI commands
    - ata: libata-scsi: report correct sense field pointer in
      ata_scsiop_maint_in()
    - btrfs: log new dentries when logging parent dir of a conflicting inode
    - btrfs: tree-checker: fix misleading root drop_level error message
    - [riscv64] soc: microchip: mpfs: Fix memory leak in
      mpfs_sys_controller_probe()
    - [riscv64] cache: starfive: fix device node leak in starlink_cache_init()
    - [arm64,armhf] soc: rockchip: grf: Add missing of_node_put() when returning
    - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
    - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
    - [arm64] dts: renesas: r9a09g057: Add RTC node
    - [arm64] dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes
    - [arm64] firmware: arm_scpi: Fix device_node reference leak in probe path
    - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
    - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
    - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
    - Bluetooth: ISO: Fix defer tests being unstable
    - Bluetooth: hci_sync: Fix hci_le_create_conn_sync
    - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
    - Bluetooth: HIDP: Fix possible UAF
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
    - Bluetooth: qca: fix ROM version reading on WCN3998 chips
    - bridge: cfm: Fix race condition in peer_mep deletion (CVE-2026-23393)
    - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
    - mpls: add missing unregister_netdevice_notifier to mpls_init
    - netfilter: ctnetlink: remove refcounting in expectation dumpers
      (CVE-2025-39764)
    - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
    - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in
      sip_help_tcp()
    - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
    - nf_tables: nft_dynset: fix possible stateful expression memleak in error
      path (CVE-2026-23399)
    - netfilter: nft_ct: drop pending enqueued packets on removal
    - netfilter: xt_CT: drop pending enqueued packets on template removal
      (CVE-2026-23391)
    - netfilter: xt_time: use unsigned int for monthday bit shift
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
    - net: bcmgenet: increase WoL poll timeout
    - [amd64,arm64] net: mana: fix use-after-free in mana_hwc_destroy_channel()
      by reordering teardown
    - sched: idle: Consolidate the handling of two special cases
    - PM: runtime: Fix a race condition related to device removal
    - bonding: prevent potential infinite loop in bond_header_parse()
    - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
    - net/sched: teql: Fix double-free in teql_master_xmit
    - net: airoha: read default PSE reserved pages value before updating
    - net: airoha: fix PSE memory configuration in airoha_fe_pse_ports_init()
    - net: airoha: Read completion queue data in airoha_qdma_tx_napi_poll()
    - net: airoha: Remove airoha_dev_stop() in airoha_remove()
    - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
    - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
    - clsact: Fix use-after-free in init/destroy rollback asymmetry
    - net: usb: aqc111: Do not perform PM inside suspend callback
    - igc: fix missing update of skb->tail in igc_xmit_frame()
    - igc: fix page fault in XDP TX timestamps handling
    - iavf: fix VLAN filter lost on add/delete race
    - wifi: mac80211: fix NULL deref in mesh_matches_local() (CVE-2026-23396)
    - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough
      headroom
    - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
    - net: macb: fix uninitialized rx_fs_lock
    - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
    - net/mlx5e: Prevent concurrent access to IPSec ASO context
    - net/mlx5e: Fix race condition during IPSec ESN update
    - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
    - net: bonding: fix NULL deref in bond_debug_rlb_hash_show
    - netfilter: bpf: defer hook memory release until rcu readers are done
    - netfilter: nf_tables: release flowtable after rcu grace period on error
      (CVE-2026-23392)
    - nfnetlink_osf: validate individual option lengths in fingerprints
      (CVE-2026-23397)
    - [arm64,armhf] net: mvpp2: guard flow control update with global_tx_fc in
      buffer switching
    - [armhf] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error
      paths
    - icmp: fix NULL pointer dereference in icmp_tag_validation()
      (CVE-2026-23398)
    - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return
      value
    - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
    - [amd64] drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
    - USB: serial: f81232: fix incomplete serial port generation
    - i2c: cp2615: fix serial string NULL-deref at probe
    - i2c: fsi: Fix a potential leak in fsi_i2c_probe()
    - i2c: pxa: defer reset on Armada 3700 when recovery is used
    - ring-buffer: Fix to update per-subbuf entries of persistent ring buffer
    - [amd64] x86/platform/uv: Handle deconfigured sockets
    - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
    - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
    - mm: shmem: fix potential data corruption during shmem swapin
    - mm: shmem: avoid unpaired folio_unlock() in shmem_swapin_folio()
    - mm/shmem, swap: improve cached mTHP handling and fix potential hang
    - mm/shmem, swap: avoid redundant Xarray lookup during swapin
    - mtd: rawnand: serialize lock/unlock against other NAND operations
    - mtd: rawnand: brcmnand: skip DMA during panic write
    - drm/amd/display: Fix DisplayID not-found handling in
      parse_edid_displayid_vrr()
    - drm/amd: fix dcn 2.01 check
    - ksmbd: fix use-after-free of share_conf in compound request
    - ksmbd: fix use-after-free in durable v2 replay of active file handles
    - [amd64] drm/i915/gt: Check set_default_submission() before deferencing
    - lib/bootconfig: check xbc_init_node() return in override path
    - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
    - hwmon: (max6639) Fix pulses-per-revolution implementation
    - [amd64] perf/x86/intel: Add missing branch counters constraint apply
    - xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)
    - xen/privcmd: add boot control for restricted usage in domU
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.79
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.80
    - cxl/port: Fix use after free of parent_port in cxl_detach_ep()
    - bpf: Fix constant blinding for PROBE_MEM32 stores (CVE-2026-23417)
      (Closes: #1132622)
    - perf: Make sure to use pmu_ctx->pmu for groups
    - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
    - hwmon: axi-fan: don't use driver_override as IRQ name
    - driver core: generalize driver_override in struct device
    - driver core: platform: use generic driver_override infrastructure
    - bpf: Release module BTF IDR before module unload
    - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
    - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
    - HID: asus: avoid memory leak in asus_report_fixup()
    - [amd64] platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to
      dmi_vgbs_allow_list
    - nvme-pci: cap queue creation to used queues
    - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
    - [amd64] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold
      16 Gen 1
    - [amd64] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix
      touchscreen on SUPI S10
    - nvme-pci: ensure we're polling a polled queue
    - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
    - HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
    - HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
    - net: usb: r8152: add TRENDnet TUC-ET2G
    - kbuild: install-extmod-build: Package resolve_btfids if necessary
    - HID: mcp2221: cancel last I2C command on read error
    - HID: asus: add xg mobile 2023 external hardware support
    - module: Fix kernel panic when a symbol st_shndx is out of bounds
    - scsi: mpi3mr: Clear reset history on ready and recheck state after timeout
    - scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP
    - dma-buf: Include ioctl.h in UAPI header
    - ALSA: hda/senary: Ensure EAPD is enabled during init
    - HID: apple: avoid memory leak in apple_report_fixup()
    - sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update
    - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
    - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
    - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
    - objtool: Handle Clang RSP musical chairs
    - nvmet: move async event work off nvmet-wq
    - drm/amdgpu: fix gpu idle power consumption issue for gfx v12
    - usb: core: new quirk to handle devices with zero configurations
    - spi: intel-pci: Add support for Nova Lake mobile SPI flash
    - ALSA: hda/realtek: add quirk for ASUS UM6702RC
    - i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter
    - xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi
    - xfrm: fix the condition on x->pcpu_num in xfrm_sa_len
    - xfrm: call xdo_dev_state_delete during state update
    - xfrm: Fix the usage of skb->sk
    - esp: fix skb leak with espintcp and async crypto
    - xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
    - xfrm: prevent policy_hthresh.work from racing with netns teardown
    - af_key: validate families in pfkey_send_migrate()
    - dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
    - erofs: set fileio bio failed in short read case
    - can: statistics: add missing atomic access in hot path
    - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
    - Bluetooth: L2CAP: Validate PDU length before reading SDU length in
      l2cap_ecred_data_rcv()
    - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing
      sock_hold
    - Bluetooth: MGMT: Fix dangling pointer on
      mgmt_add_adv_patterns_monitor_complete
    - Bluetooth: hci_ll: Fix firmware leak on error path
    - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
    - [arm64] pinctrl: mediatek: common: Fix probe failure for devices without
      EINT
    - ionic: fix persistent MAC address override on PF
    - nfc: nci: fix circular locking dependency in nci_close_device
    - net: openvswitch: Avoid releasing netdev before teardown completes
    - openvswitch: defer tunnel netdev_put to RCU release
    - openvswitch: validate MPLS set/set_masked payload length
    - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe
      buffer
    - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
    - net: bcm: asp2: fix LPI timer handling
    - net: bcm: asp2: remove tx_lpi_enabled
    - net: bcm: asp2: convert to phylib managed EEE
    - net: bcmasp: Remove support for asp-v2.0
    - net: bcmasp: streamline early exit in probe
    - net: bcmasp: fix double free of WoL irq
    - net: bcmasp: Add support for asp-v3.0
    - net: bcmasp: fix double disable of clk
    - [armhf] platform/olpc: olpc-xo175-ec: Fix overflow error message to print
      inlen
    - [amd64] platform/x86: intel-hid: disable wakeup_mode during hibernation
    - ice: fix inverted ready check for VF representors
    - ice: use ice_update_eth_stats() for representor stats
    - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
    - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions
      expire.
    - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
    - net: fix fanout UAF in packet_release() via NETDEV_UP race
    - tcp: optimize inet_use_bhash2_on_bind()
    - udp: Fix wildcard bind conflict check when using hash2
    - net: enetc: fix the output issue of 'ethtool --show-ring'
    - team: fix header_ops type confusion with non-Ethernet ports
    - net: lan743x: fix duplex configuration in mac_link_up
    - dma-mapping: add missing `inline` for `dma_free_attrs`
    - Bluetooth: L2CAP: Fix send LE flow credits in ACL link
    - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
    - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
    - Bluetooth: btusb: clamp SCO altsetting table indices
    - tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414)
    - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
    - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
    - netfilter: nf_conntrack_expect: skip expectations in other netns via proc
    - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in
      process_sdp
    - netfilter: ctnetlink: use netlink policy range checks
    - net: macb: use the current queue number for stats
    - regmap: Synchronize cache for the page selector
    - ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter
    - RDMA/rw: Fall back to direct SGE on MR pool exhaustion
    - RDMA/irdma: Initialize free_qp completion before using it
    - RDMA/irdma: Update ibqp state to error if QP is already in error state
    - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
    - RDMA/irdma: Clean up unnecessary dereference of event->cm_node
    - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
    - RDMA/irdma: Fix deadlock during netdev reset with active connections
    - RDMA/irdma: Return EINVAL for invalid arp index error
    - scsi: scsi_transport_sas: Fix the maximum channel scanning issue
    - [amd64] x86/efi: efi_unmap_boot_services: fix calculation of
      ranges_to_free size
    - [amd64] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
    - PM: hibernate: Drain trailing zero pages on userspace restore
    - spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
    - [amd64] ASoC: Intel: catpt: Fix the device initialization
    - [arm64,armhf] spi: meson-spicc: Fix double-put in remove path
    - drm/amd/display: Do not skip unrelated mode changes in DSC validation
    - spi: Group CS related fields in struct spi_device
    - spi: use generic driver_override infrastructure
    - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
    - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
    - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
    - hwmon: (pmbus/core) Fix various coding style issues
    - hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only
    - hwmon: (pmbus) Introduce the concept of "write-only" attributes
    - sysctl: fix uninitialized variable in proc_do_large_bitmap
    - [s390x] syscalls: Add spectre boundary for syscall dispatch table
    - [s390x] barrier: Make array_index_mask_nospec() __always_inline
    - [s390x] entry: Scrub r12 register on kernel entry
    - ksmbd: replace hardcoded hdr2_len with offsetof() in
      smb2_calc_max_out_buf_len()
    - ksmbd: fix potencial OOB in get_file_all_info() for compound requests
    - ksmbd: fix memory leaks and NULL deref in smb2_lock()
    - ksmbd: do not expire session on binding failure
    - ALSA: firewire-lib: fix uninitialized local variable
    - [amd64] ASoC: SOF: ipc4-topology: Allow bytes controls without initial
      payload
    - can: gw: fix OOB heap access in cgw_csum_crc8_rel()
    - can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
    - cpufreq: conservative: Reset requested_freq on limits change
    - [amd64] platform/x86: ISST: Correct locked bit width
    - [arm64] KVM: arm64: Discard PC update state on vcpu reset
    - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs
      attributes
    - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute
      temperature
    - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
    - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
    - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and
      napi_tx is false
    - erofs: add GFP_NOIO in the bio completion if needed
    - alarmtimer: Fix argument order in alarm_timer_forward()
    - [amd64] x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
    - [amd64] x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask
    - [arm64] phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4
    - ovl: fix wrong detection of 32bit inode numbers
    - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
    - scsi: ses: Handle positive SCSI error from ses_recv_diag()
    - net: macb: Move devm_{free,request}_irq() out of spin lock area
    - net: macb: Protect access to net_device::ip_ptr with RCU lock
    - net: macb: Use dev_consume_skb_any() to free TX SKBs
    - [amd64] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an
      MMIO SPTE (CVE-2026-23401)
    - jbd2: gracefully abort on checkpointing state corruptions
    - [arm64] irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
    - futex: Clear stale exiting pointer in futex_lock_pi() retry path
    - dmaengine: fsl-edma: fix channel parameter config for fixed channel
      requests
    - dmaengine: sh: rz-dmac: Protect the driver specific lists
    - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
    - drm/amdgpu: prevent immediate PASID reuse case
    - [amd64] drm/i915/dp_tunnel: Fix error handling when clearing stream BW in
      atomic state
    - xfs: stop reclaim before pushing AIL during unmount
    - xfs: save ailp before dropping the AIL lock in push callbacks
    - xfs: scrub: unlock dquot before early return in quota scrub
    - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
    - xfs: don't irele after failing to iget in xfs_attri_recover_work
    - xfs: remove file_path tracepoint data
    - ext4: fix journal credit check when setting fscrypt context
    - ext4: convert inline data to extents when truncate exceeds inline size
    - ext4: fix stale xarray tags after writeback
    - ext4: fix fsync(2) for nojournal mode
    - ext4: make recently_deleted() properly work with lazy itable
      initialization
    - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
    - ext4: validate p_idx bounds in ext4_ext_correct_indexes
    - ext4: avoid infinite loops caused by residual data
    - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
    - ext4: reject mount if bigalloc with s_first_data_block != 0
    - ext4: fix use-after-free in update_super_work when racing with umount
    - ext4: fix the might_sleep() warnings in kvfree()
    - ext4: handle wraparound when searching for blocks for indirect mapped
      blocks
    - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
    - ext4: always drain queued discard work in ext4_mb_release()
    - [arm64] dts: imx8mn-tqma8mqnl: fix LDO5 power off
    - [powerpc*] powerpc64/bpf: do not increment tailcall count when prog is
      NULL
    - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
    - tracing: Switch trace_osnoise.c code over to use guard() and __free()
    - tracing: Fix potential deadlock in cpu hotplug with osnoise
    - drm/xe: always keep track of remap prev/next
    - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
    - ovl: Use str_on_off() helper in ovl_show_options()
    - ovl: make fsync after metadata copy-up opt-in mount option
    - xfs: avoid dereferencing log items after push callbacks
    - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
    - net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)
    - landlock: Optimize file path walks and prepare for audit support
    - landlock: Fix handling of disconnected directories (CVE-2025-68736)
    - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()
      (CVE-2025-22117)
    - ice: Fix PTP NULL pointer dereference during VSI rebuild (CVE-2026-23210)
    - [amd64,arm64] idpf: check error for register_netdev() on init
    - [amd64,arm64] idpf: detach and close netdevs while handling a reset
      (CVE-2026-22981)
    - [amd64,arm64] idpf: Fix RSS LUT NULL pointer crash on early ethtool
      operations (CVE-2026-22985)
    - [amd64,arm64] idpf: Fix RSS LUT NULL ptr issue after soft reset
      (CVE-2026-22993)
    - [amd64] dmaengine: idxd: Fix not releasing workqueue on .release()
    - [amd64] dmaengine: idxd: Fix memory leak when a wq is reset
    - [amd64] dmaengine: idxd: Fix freeing the allocated ida too late
    - phy: ti: j721e-wiz: Fix device node reference leak in
      wiz_get_lane_phy_types()
    - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and
      CYCLE_BIT bits for HDMA.
    - netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
    - [amd64] dmaengine: idxd: fix possible wrong descriptor completion in
      llist_abort_desc()
    - btrfs: fix super block offset in error message in btrfs_validate_super()
    - btrfs: fix leak of kobject name for sub-group space_info
    - btrfs: fix lost error when running device stats on multiple devices fs
    - xen/privcmd: unregister xenstore notifier on module exit
    - futex: Require sys_futex_requeue() to have identical flags
    - [amd64] dmaengine: idxd: Fix leaking event log memory
    - net: bcmasp: Restore programming of TX map vector register
    - net: bcmasp: Fix network filter wake for asp-3.0
    - [amd64,arm64] idpf: nullify pointers after they are freed
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.81
    - io_uring/kbuf: remove legacy kbuf bulk allocation
    - io_uring/kbuf: remove legacy kbuf kmem cache
    - io_uring/kbuf: simplify __io_put_kbuf
    - io_uring/kbuf: remove legacy kbuf caching
    - io_uring/kbuf: open code __io_put_kbuf()
    - io_uring/kbuf: introduce io_kbuf_drop_legacy()
    - io_uring/kbuf: uninline __io_put_kbufs
    - io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments
    - io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases
    - io_uring/net: clarify io_recv_buf_select() return value
    - io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers
    - io_uring/kbuf: introduce struct io_br_sel
    - io_uring/kbuf: use struct io_br_sel for multiple buffers picking
    - io_uring/net: use struct io_br_sel->val as the recv finish value
    - io_uring/net: use struct io_br_sel->val as the send finish value
    - io_uring/kbuf: switch to storing struct io_buffer_list locally
    - io_uring: remove async/poll related provided buffer recycles
    - io_uring/net: correct type for min_not_zero() cast
    - io_uring/rw: check for NULL io_br_sel when putting a buffer
    - io_uring/kbuf: enable bundles for incrementally consumed buffers
    - io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
    - io_uring/kbuf: use READ_ONCE() for userspace-mapped memory
    - io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields
    - io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF
    - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
    - HID: logitech-hidpp: Enable MX Master 4 over bluetooth
    - wifi: mac80211: check tdls flag in ieee80211_tdls_oper
    - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
    - atm: lec: fix use-after-free in sock_def_readable()
    - btrfs: don't take device_list_mutex when querying zone info
    - tg3: replace placeholder MAC address with device property
    - HID: logitech-hidpp: Prevent use-after-free on force feedback
      initialisation failure
    - HID: multitouch: Check to ensure report responses match the request
    - btrfs: reserve enough transaction items for qgroup ioctls
    - [arm64,armhf] i2c: tegra: Don't mark devices with pins as IRQ safe
    - btrfs: reject root items with drop_progress and zero drop_level
    - [arm64] spi: geni-qcom: Check DMA interrupts early in ISR
    - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common
      property warning
    - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU
      session
    - [arm64,armhf] crypto: caam - fix DMA corruption on long hmac keys
    - [arm64,armhf] crypto: caam - fix overflow on long hmac keys
    - crypto: af-alg - fix NULL pointer dereference in scatterwalk
    - [arm64,armhf] net: fec: fix the PTP periodic output sysfs interface
    - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
    - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields
      to zero to prevent an info-leak
    - net/ipv6: ioam6: prevent schema length wraparound in trace fill
    - tg3: Fix race for querying speed/duplex
    - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
    - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
    - bridge: br_nd_send: linearize skb before parsing ND options
    - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
    - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
    - [arm64] net: enetc: check whether the RSS algorithm is Toeplitz
    - ipv6: prevent possible UaF in addrconf_permanent_addr()
    - net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()
    - net: introduce mangleid_features
    - net: use skb_header_pointer() for TCPv4 GSO frag_off check
    - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero
      to prevent an info-leak
    - NFC: pn533: bound the UART receive buffer
    - ASoC: Intel: boards: fix unmet dependency on PINCTRL
    - bpf: Fix regsafe() for pointers to packet
    - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
    - netfilter: flowtable: strictly check for maximum number of actions
    - netfilter: nfnetlink_log: account for netlink header size
    - netfilter: x_tables: ensure names are nul-terminated
    - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
    - netfilter: nf_conntrack_helper: pass helper to expect cleanup
    - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
    - netfilter: nf_conntrack_expect: honor expectation helper field
    - netfilter: nf_conntrack_expect: use expect->helper
    - netfilter: nf_conntrack_expect: store netns and zone in expectation
    - netfilter: ctnetlink: ignore explicit helper on new expectations
    - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions
      for NFPROTO_ARP
    - netfilter: nf_tables: reject immediate NF_QUEUE verdict
    - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
    - Bluetooth: SCO: fix race conditions in sco_sock_connect()
    - Bluetooth: MGMT: validate LTK enc_size on load
    - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
    - Bluetooth: hci_event: fix potential UAF in
      hci_le_remote_conn_param_req_evt
    - Bluetooth: MGMT: validate mesh send advertising payload length
    - rds: ib: reject FRMR registration before IB connection is established
    - bpf: sockmap: Fix use-after-free of sk->sk_socket in
      sk_psock_verdict_data_ready().
    - net/sched: sch_netem: fix out-of-bounds access in packet corruption
    - net: macb: fix clk handling on PCI glue driver removal
    - net: macb: properly unregister fixed rate clocks
    - net/mlx5: lag: Check for LAG device before creating debugfs
    - net/mlx5: Avoid "No data available" when FW version queries fail
    - net/mlx5: Fix switchdev mode rollback in case of failure
    - bnxt_en: Restore default stat ctxs for ULP when resource is available
    - net/x25: Fix potential double free of skb
    - net/x25: Fix overflow when accumulating packets
    - net/sched: cls_fw: fix NULL pointer dereference on shared blocks
    - net/sched: cls_flow: fix NULL pointer dereference on shared blocks
    - net: hsr: fix VLAN add unwind on slave errors
    - ipv6: avoid overflows in ip6_datagram_send_ctl()
    - bpf: reject direct access to nullable PTR_TO_BUF pointers
    - Revert "drm: Fix use-after-free on framebuffers and property blobs when
      calling drm_dev_unplug"
    - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
    - hwmon: (pxe1610) Check return value of page-select write in probe
    - hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
    - dt-bindings: gpio: fix microchip #interrupt-cells
    - hwmon: (tps53679) Fix device ID comparison and printing in
      tps53676_identify()
    - [armhf] hwmon: (occ) Fix missing newline in occ_show_extended()
    - sched/fair: Use protect_slice() instead of direct comparison
    - sched/fair: Fix zero_vruntime tracking fix
    - [amd64,arm64] drm/ioc32: stop speculation on the drm_compat_ioctl path
    - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
    - wifi: iwlwifi: mvm: fix potential out-of-bounds read in
      iwl_mvm_nd_match_info_handler()
    - USB: serial: option: add MeiG Smart SRM825WN
    - ALSA: caiaq: fix stack out-of-bounds read in init_card
    - ALSA: ctxfi: Fix missing SPDIFI1 index handling
    - io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
    - Bluetooth: SMP: derive legacy responder STK authentication from MITM state
    - Bluetooth: SMP: force responder MITM requirements before building the
      pairing response
    - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
    - ksmbd: fix OOB write in QUERY_INFO for compound requests
    - [armhf] hwmon: (occ) Fix division by zero in occ_show_power_1()
    - drm/amdgpu: fix the idr allocation flags
    - iio: adc: ti-adc161s626: fix buffer read on big-endian
    - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
    - drm/ast: dp501: Fix initialization of SCU2C
    - [amd64] drm/i915/dsi: Don't do DSC horizontal timing adjustments in
      command mode
    - [amd64] drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw
      CPU eDP
    - drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
    - drm/amdgpu/pm: drop SMU driver if version not matched messages
    - USB: serial: io_edgeport: add support for Blackbox IC135A
    - USB: serial: option: add support for Rolling Wireless RW135R-GL
    - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
    - Input: synaptics-rmi4 - fix a locking bug in an error path
    - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk
      table
    - Input: bcm5974 - recover from failed mode switch
    - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
    - Input: xpad - add support for Razer Wolverine V3 Pro
    - iio: adc: aspeed: clear reference voltage bits before configuring vref
    - iio: accel: fix ADXL355 temperature signature value
    - iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0
    - iio: dac: ad5770r: fix error return in ad5770r_read_raw()
    - iio: light: vcnl4035: fix scan buffer on big-endian
    - iio: imu: bmi160: Remove potential undefined behavior in
      bmi160_config_pin()
    - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
    - iio: gyro: mpu3050: Fix incorrect free_irq() variable
    - iio: gyro: mpu3050: Fix irq resource leak
    - iio: gyro: mpu3050: Move iio_device_register() to correct location
    - iio: gyro: mpu3050: Fix out-of-sequence free_irq()
    - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
    - usb: ulpi: fix double free in ulpi_register_interface() error path
    - usb: usbtmc: Flush anchored URBs in usbtmc_release
    - usb: ehci-brcm: fix sleep during atomic
    - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
    - usb: core: phy: avoid double use of 'usb3-phy'
    - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
    - usb: cdns3: gadget: fix state inconsistency on gadget init failure
    - bridge: br_nd_send: validate ND option lengths
    - cdc-acm: new quirk for EPSON HMD
    - [amd64] comedi: Reinit dev->spinlock between attachments to low-level
      drivers
    - [amd64] comedi: me_daq: Fix potential overrun of firmware buffer
    - [amd64] comedi: me4000: Fix potential overrun of firmware buffer
    - [riscv64] firmware: microchip: fail auto-update probe if no flash found
    - dt-bindings: connector: add pd-disable dependency
    - nvmem: imx: assign nvmem_cell_info::raw_len
    - nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
    - netfilter: ipset: drop logically empty buckets in mtype_del
    - vxlan: validate ND option lengths in vxlan_na_create
    - net: ftgmac100: fix ring allocation unwind on open failure
    - [arm64] net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
    - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error
      path
    - gpio: mxc: map Both Edge pad wakeup to Rising Edge
    - thermal: core: Fix thermal zone device registration error path
    - misc: fastrpc: possible double-free of cctx->remote_heap
    - [amd64] thunderbolt: Fix property read in nhi_wake_supported()
    - USB: dummy-hcd: Fix locking/synchronization error
    - USB: dummy-hcd: Fix interrupt synchronization error
    - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows
      partial transfer
    - usb: typec: ucsi: validate connector number in ucsi_notify_common()
    - ice: Fix memory leak in ice_set_ringparam() (CVE-2026-23389)
    - btrfs: fix the qgroup data free range for inline data extents
    - btrfs: do not free data reservation in fallback from inline due to -ENOSPC
      (CVE-2025-71269)
    - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
    - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
    - usb: gadget: uvc: fix NULL pointer dereference during unbind race
    - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
    - usb: gadget: f_rndis: Protect RNDIS options with mutex
    - usb: gadget: f_ecm: Fix net_device lifecycle with device_move
    - usb: gadget: f_eem: Fix net_device lifecycle with device_move
    - usb: gadget: f_subset: Fix net_device lifecycle with device_move
    - usb: gadget: f_rndis: Fix net_device lifecycle with device_move
    - usb: gadget: f_hid: move list and spinlock inits from bind to alloc
    - usb: gadget: f_uac1_legacy: validate control request size
    - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
    - spi: cadence-qspi: Fix exec_mem_op error handling
    - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
    - [amd64,arm64] net: mana: fix use-after-free in add_adev() error path
    - scsi: target: tcm_loop: Drain commands in target_reset handler
    - [amd64] x86/fred: Fix early boot failures on SEV-ES/SNP guests
    - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
    - mm: replace READ_ONCE() with standard page table accessors
    - mm/memory: fix PMD/PUD checks in follow_pfnmap_start()
    - drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13
    - ext4: publish jinode after initialization
    - [s390x] perf_cpum_sf: Convert to use try_cmpxchg128()
    - [s390x] cpum_sf: Cap sampling rate to prevent lsctl exception
    - MPTCP: fix lock class name family in pm_nl_create_listen_socket
    - [amd64] x86/CPU/AMD: Add additional fixed RDSEED microcode revisions
    - drm/amd/amdgpu: decouple ASPM with pcie dpm
    - drm/amd/amdgpu: disable ASPM in some situations
    - drm/amd/display: Disable fastboot on DCE 6 too
    - drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4
    - drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
    - drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
    - drm/amd/display: Disable scaling on DCE6 for now
    - drm/amd: Disable ASPM on SI
    - drm/amd/display: Correct logic check error for fastboot
    - bpf: Improve bounds when s64 crosses sign boundary
    - bpf: Add third round of bounds deduction
    - bpf: Fix u32/s32 bounds when ranges cross min/max boundary
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.82
    - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
    - usb: typec: ucsi: skip connector validation before init
    - wifi: rt2x00usb: fix devres lifetime
    - xfrm_user: fix info leak in build_report()
    - net: rfkill: prevent unlimited numbers of rfkill events from being created
    - mptcp: fix slab-use-after-free in __inet_lookup_established
    - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
    - Input: uinput - fix circular locking dependency with ff-core
    - Input: uinput - take event lock when submitting FF request "event"
    - ASoC: simple-card-utils: Don't use __free(device_node) at
      graph_util_parse_dai()
    - btrfs: make wait_on_extent_buffer_writeback() static inline
    - btrfs: remove unused define WAIT_PAGE_LOCK for extent io
    - btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait
    - btrfs: remove unused flag EXTENT_BUFFER_READAHEAD
    - btrfs: remove unused flag EXTENT_BUFFER_CORRUPT
    - btrfs: remove pointless out labels from extent-tree.c
    - btrfs: fix incorrect return value after changing leaf in
      lookup_extent_data_ref()
    - blktrace: fix __this_cpu_read/write in preemptible context
    - nfc: nci: complete pending data exchange on device close
    - misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
    - Revert "mptcp: add needs_id for netlink appending addr"
    - net: annotate data-races around sk->sk_{data_ready,write_space}
    - netfilter: nft_ct: fix use-after-free in timeout object destroy
    - workqueue: Add pool_workqueue to pending_pwqs list when unplugging
      multiple inactive works
    - xfrm: clear trailing padding in build_polexpire()
    - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
    - wifi: brcmsmac: Fix dma_free_coherent() size
    - [amd64] platform/x86/intel-uncore-freq: Handle autonomous UFS status bit
    - [arm64] Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
    - [arm64] dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
    - [arm64] dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
    - [arm64] dts: hisilicon: hi3798cv200: Add missing dma-ranges
    - nfc: pn533: allocate rx skb before consuming bytes
    - batman-adv: reject oversized global TT response buffers
    - X.509: Fix out-of-bounds access when parsing extensions
    - [amd64,arm64] EDAC/mc: Fix error path ordering in edac_mc_alloc()
    - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
    - batman-adv: hold claim backbone gateways by reference
    - [amd64] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
    - [amd64] drm/i915/psr: Do not use pipe_src as borders for SU area
    - net/mlx5: Update the list of the PCI supported devices
    - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
    - mmc: vub300: fix NULL-deref on disconnect
    - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation
      failure
    - net: stmmac: fix integer underflow in chain mode
    - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
    - [amd64,arm64] idpf: improve locking around idpf_vc_xn_push_free()
    - [amd64,arm64] idpf: set the payload size before calling the async handler
    - rxrpc: Fix anonymous key handling
    - rxrpc: Fix call removal to use RCU safe deletion
    - rxrpc: Fix key reference count leak from call->key
    - rxrpc: Only put the call ref if one was acquired
    - rxrpc: reject undecryptable rxkad response tickets
    - rxrpc: fix reference count leak in rxrpc_server_keyring()
    - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
    - rxrpc: Fix missing error checks for rxkad encryption/decryption failure
    - net: skb: fix cross-cache free of KFENCE-allocated skb head
    - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
    - [amd64] x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.83
    - RDMA/irdma: Fix double free related to rereg_user_mr
    - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
    - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
    - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
    - [arm64,armhf] media: rkvdec: reduce stack usage in
      rkvdec_init_v4l2_vp9_count_tbl()
    - ALSA: asihpi: avoid write overflow check warning
    - Bluetooth: hci_sync: annotate data-races around hdev->req_status
    - [amd64] ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
    - [amd64,arm64] ASoC: SOF: topology: reject invalid vendor array size in
      token parser
    - can: mcp251x: add error handling for power enable in open and resume
    - [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP
      GZ302EAC
    - btrfs: tracepoints: get correct superblock from dentry in event
      btrfs_sync_file()
    - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
    - drm/amdgpu: Handle GPU page faults correctly on non-4K page systems
    - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
    - ALSA: hda/realtek: add quirk for Framework F111:000F
    - wifi: wl1251: validate packet IDs before indexing tx_frames
    - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
    - ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)
    - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
    - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
    - [amd64] ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
    - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9
    - [amd64] pinctrl: intel: Fix the revision for new features (1kOhm PD, HW
      debouncer)
    - [amd64] platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
    - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
    - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
    - HID: roccat: fix use-after-free in roccat_report_event
    - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
    - wifi: brcmfmac: validate bsscfg indices in IF events
    - net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
    - [armhf] ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
    - [armhf] soc: aspeed: socinfo: Mask table entries for accurate SoC ID
      matching
    - [arm64] dts: qcom: hamoa/x1: fix idle exit latency
    - [arm64] dts: imx8mq: Set the correct gpu_ahb clock frequency
    - [arm64] dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD
    - [arm64] dts: imx93-tqma9352: improve eMMC pad configuration
    - [arm64] soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei
    - tools/power/turbostat: Fix microcode patch level output for AMD/Hygon
    - PCI: hv: Set default NUMA node to 0 for devices without affinity info
    - HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP
    - xfrm: account XFRMA_IF_ID in aevent size calculation
    - [arm*] drm/vc4: Release runtime PM reference after binding V3D
    - [arm*] drm/vc4: Fix memory leak of BO array in hang state
    - [arm*] drm/vc4: Fix a memory leak in hang state error path
    - [arm* drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
    - eventpoll: defer struct eventpoll free to RCU grace period
    - net: sched: act_csum: validate nested VLAN headers
    - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
    - ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
    - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
      (CVE-2026-31531)
    - ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
    - net: increase IP_TUNNEL_RECURSION_LIMIT to 5
    - nfc: s3fwrn5: allocate rx skb before consuming bytes
    - net: stmmac: Fix PTP ref clock for Tegra234
    - dt-bindings: net: Fix Tegra234 MGBE PTP clock
    - tracing/probe: reject non-closed empty immediate strings
    - ixgbevf: add missing negotiate_features op to Hyper-V ops table
    - e1000: check return value of e1000_read_eeprom
    - xsk: tighten UMEM headroom validation to account for tailroom and min
      frame
    - xsk: respect tailroom for ZC setups
    - xsk: fix XDP_UMEM_SG_FLAG issues
    - xsk: validate MTU against usable frame size on bind
    - xfrm: Wait for RCU readers during policy netns exit
    - xfrm: fix refcount leak in xfrm_migrate_policy_find
    - xfrm_user: fix info leak in build_mapping()
    - ipvs: fix NULL deref in ip_vs_add_service error path
    - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
    - netfilter: xt_multiport: validate range encoding in checkentry
    - netfilter: ip6t_eui64: reject invalid MAC header for all packets
    - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC ->
      GFP_KERNEL_ACCOUNT allocation
    - netfilter: nfnetlink_queue: make hash table per queue
    - net: txgbe: leave space for null terminators on property_entry
    - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
    - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
    - net: ipa: fix event ring index not programmed for IPA v5.0+
    - l2tp: Drop large packets with UDP encap
    - gpio: tegra: fix irq_release_resources calling enable instead of disable
    - crypto: af_alg - limit RX SG extraction by receive buffer budget
    - [amd64] perf/x86/intel/uncore: Skip discovery table for offline dies
    - sched/deadline: Use revised wakeup rule for dl_server
    - crypto: algif_aead - Fix minimum RX size check for decryption
    - netfilter: conntrack: add missing netlink policy validations
      (CVE-2026-31407)
    - Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads"
    - Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt"
    - thermal: core: Mark thermal zones as exiting before unregistration
    - thermal: core: Address thermal zone removal races with resume
    - ALSA: usb-audio: Improve Focusrite sample rate filtering
    - [amd64,arm64] idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC
      handling
    - nfc: llcp: add missing return after LLCP_CLOSED checks
    - can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
    - i2c: s3c24xx: check the size of the SMBUS message before using it
    - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
    - HID: alps: fix NULL pointer dereference in alps_raw_event()
    - HID: core: clamp report_size in s32ton() to avoid undefined shift
    - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
    - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
    - [arm*] drm/vc4: platform_get_irq_byname() returns an int
    - ALSA: fireworks: bound device-supplied status before string array lookup
    - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
    - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
    - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
    - usb: gadget: renesas_usb3: validate endpoint index in standard request
      handlers
    - smb: client: fix off-by-8 bounds check in check_wsl_eas()
    - ksmbd: validate EaNameLength in smb2_get_ea()
    - ksmbd: require 3 sub-authorities before reading sub_auth[2]
    - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
    - usbip: validate number_of_packets in usbip_pack_ret_submit()
    - usb: storage: Expand range of matched versions for VL817 quirks entry
    - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
    - usb: gadget: f_hid: don't call cdev_init while cdev in use
    - usb: port: add delay after usb_hub_set_port_power()
    - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
    - scripts: generate_rust_analyzer.py: avoid FD leak
    - wifi: rtw88: fix device leak on probe failure
    - staging: sm750fb: fix division by zero in ps_to_hz()
    - USB: serial: option: add Telit Cinterion FN990A MBIM composition
    - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates
      race
    - ALSA: ctxfi: Limit PTP to a single page
    - dcache: Limit the minimal number of bucket to two
    - media: vidtv: fix NULL pointer dereference in
      vidtv_channel_pmt_match_sections
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
    - ocfs2: handle invalid dinode in ocfs2_group_extend
    - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
    - [amd64] KVM: SEV: Reject attempts to sync VMSA of an
      already-launched/encrypted vCPU
    - [amd64] KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being
      created
    - [amd64] KVM: SEV: Drop WARN on large size for
      KVM_MEMORY_ENCRYPT_REG_REGION
    - gpiolib: unify two loops initializing GPIO descriptors
    - gpiolib: fix race condition for gdev->srcu (CVE-2026-22986)
    - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
    - kernel: be more careful about dup_mmap() failures and uprobe registering
    - KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay
    - [amd64] KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs
    - checkpatch: add support for Assisted-by tag
    - [amd64] x86-64: rename misleadingly named '__copy_user_nocache()' function
    - [amd64] x86: rename and clean up __copy_from_user_inatomic_nocache()
    - x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache
    - [amd64] KVM: x86: Use scratch field in MMIO fragment to hold small write
      values
    - [arm64] ASoC: qcom: q6apm: move component registration to unmanaged
      version
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
    - media: vidtv: fix nfeeds state corruption on start_streaming failure
    - media: mediatek: vcodec: fix use-after-free in encoder release path
    - media: em28xx: fix use-after-free in em28xx_v4l2_open()
    - hwmon: (powerz) Fix use-after-free on USB disconnect
    - ALSA: 6fire: fix use-after-free on disconnect
    - bcache: fix cached_dev.sb_bio use-after-free and crash
    - media: as102: fix to not free memory after the device is registered in
      as102_usb_probe()
    - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
    - media: vidtv: fix pass-by-value structs causing MSAN warnings
    - media: hackrf: fix to not free memory after the device is registered in
      hackrf_probe()
    - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
    - ocfs2: validate inline data i_size during inode read
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
    - rxrpc: Fix key quota calculation for multitoken keys
    - PCI: Fix placement of pci_save_state() in pci_bus_add_device()
    - ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
    - PCI: Revert "Enable ACS after configuring IOMMU for OF platforms"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.84
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation
    - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
    - ima: verify if the segment size has changed
    - ima: do not copy measurement list to kdump kernel
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
    - [arm64] net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU
      registers
    - drm/amdgpu: replace PASID IDR with XArray
    - mm/pagewalk: fix race between concurrent split and refault
    - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
    - scripts/dtc: Remove unused dts_version in dtc-lexer.l
    - rxrpc: only handle RESPONSE during service challenge
    - fs/ntfs3: validate rec->used in journal-replay file record check
    - f2fs: fix to avoid memory leak in f2fs_rename()
    - fuse: reject oversized dirents in page cache
    - fuse: Check for large folio with SPLICE_F_MOVE
    - fuse: quiet down complaints in fuse_conn_limit_write
    - ksmbd: require minimum ACE size in smb_check_perm_dacl()
    - smb: server: fix active_num_conn leak on transport allocation failure
    - smb: server: fix max_connections off-by-one in tcp accept path
    - smb: client: require a full NFS mode SID before reading mode bits
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
    - ksmbd: validate response sizes in ipc_validate_msg()
    - ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
    - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
    - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
    - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
    - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
    - ALSA: caiaq: take a reference on the USB device in create_card()
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
    - [amd64] crypto: ccp: Don't attempt to copy CSR to userspace if PSP command
      failed
    - [amd64] crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP
      command failed
    - [amd64] crypto: ccp: Don't attempt to copy ID to userspace if PSP command
      failed
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.85
    - crypto: scatterwalk - Backport memcpy_sglist()
    - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
    - crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
    - crypto: algif_aead - snapshot IV for async AEAD requests
    - crypto: authenc - use memcpy_sglist() instead of null skcipher
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
      decryption
    - crypto: authencesn - Fix src offset when decrypting in-place
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
    - xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
    - Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 30 Apr 2026 13:38:11 +0200

linux (6.12.74-2) trixie-security; urgency=high

  * Refresh patchset to address multiple vulnerabilities in AppArmor

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 08 Mar 2026 20:54:04 +0100

linux (6.12.74-1) trixie-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.74
    - scsi: qla2xxx: Fix bsg_done() causing double free
    - bnxt_en: Change FW message timeout warning
    - bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code
    - [arm64] bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs
      show functions
    - [arm64] bus: fsl-mc: fix use-after-free in driver_override_show()
      (CVE-2026-23221)
    - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
    - [amd64] ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list
    - ALSA: hda/realtek: Add quirk for Inspur S14-G1
    - ALSA: hda/realtek - fixed speaker no sound
    - romfs: check sb_set_blocksize() return value
    - [arm64,armhf] drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not
      used
    - [amd64] platform/x86: classmate-laptop: Add missing NULL pointer checks
    - [amd64] ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9
    - [amd64] ASoC: amd: yc: Add quirk for HP 200 G2a 16
    - ALSA: hda/realtek: Enable headset mic for Acer Nitro 5
    - [amd64] platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro
    - [amd64] platform/x86: panasonic-laptop: Fix sysfs group leak in error path
    - [amd64] ASoC: cs42l43: Correct handling of 3-pole jack load detection
    - tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow
    - drm/amd/display: extend delta clamping logic to CM3 LUT helper
    - drm/amd/display: remove assert around dpp_base replacement
    - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
    - mm/hugetlb: fix hugetlb_pmd_shared() (CVE-2026-23100)
    - mm/hugetlb: fix two comments related to huge_pmd_unshare()
    - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using
      mmu_gather
    - Revert "wireguard: device: enable threaded NAPI"
    - cpuset: Fix missing adaptation for cpuset_is_populated
    - fbdev: smscufx: properly copy ioctl memory to kernelspace
    - f2fs: fix to add gc count stat in f2fs_gc_range
    - f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly
    - f2fs: fix out-of-bounds access in sysfs attribute read/write
    - f2fs: fix to avoid mapping wrong physical block for swapfile
    - [arm64] iommu/arm-smmu-qcom: do not register driver in probe()
    - f2fs: fix to avoid UAF in f2fs_write_end_io()
    - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent
      atomic commit and checkpoint writes
    - USB: serial: option: add Telit FN920C04 RNDIS compositions

  [ Simone Weiß ]
  * db-mok: Remove unused function, fixing compilation warning

  [ Ben Hutchings ]
  * CI: Delete support for ccache, which was removed from common pipeline
  * CI: Update build job to work after another common pipeline change

  [ Salvatore Bonaccorso ]
  * apparmor: validate DFA start states are in bounds in unpack_pdb
  * apparmor: fix memory leak in verify_header
  * apparmor: replace recursive profile removal with iterative approach
  * apparmor: fix side-effect bug in match_char() macro usage
  * apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
  * apparmor: Fix double free of ns_name in aa_replace_profiles()
  * apparmor: unprivileged local user can privilge escalate policy management
  * apparmor: fix differential encoding verification
  * apparmor: fix race on rawdata dereference

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 01 Mar 2026 13:47:48 +0100

linux (6.12.73-1) trixie-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.70
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
    - [amd64] x86/vmware: Fix hypercall clobbers
    - [amd64] x86/kfence: fix booting on 32bit non-PAE systems
    - [amd64] platform/x86: intel_telemetry: Fix swapped arrays in PSS output
    - ALSA: aloop: Fix racy access at PCM trigger
    - [arm64] pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the
      highest state
    - [arm64] pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system
      wakeup
    - [arm64,armhf] pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong
      adb400 reset
    - [arm64] pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system
      wakeup
    - [arm64] pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains
    - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single
    - ceph: fix NULL pointer dereference in ceph_mds_auth_match()
      (Closes: #1125405)
    - rbd: check for EOD after exclusive lock is ensured to be held
    - ceph: fix oops due to invalid pointer for kfree() in parse_longname()
    - gve: Fix stats report corruption on queue count change
    - gve: Correct ethtool rx_dropped calculation
    - mm, shmem: prevent infinite loop on truncate race
    - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
    - KVM: Don't clobber irqfd routing type when deassigning irqfd
    - PCI/ERR: Ensure error recoverability at all times
    - ublk: fix deadlock when reading partition table (CVE-2025-68823)
    - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (CVE-2025-40082)
    - [arm*] binder: fix BR_FROZEN_REPLY error log
    - binderfs: fix ida_alloc_max() upper bound
    - procfs: avoid fetching build ID while holding VMA lock
    - tracing: Fix ftrace event field alignments
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
    - wifi: wlcore: ensure skb headroom before skb_push
    - net: usb: sr9700: support devices with virtual driver CD
    - block,bfq: fix aux stat accumulation destination
    - smb/server: call ksmbd_session_rpc_close() on error path in
      create_smb2_pipe()
    - md: suspend array while updating raid_disks via sysfs
    - smb/server: fix refcount leak in smb2_open()
    - smb/server: fix refcount leak in parse_durable_handle_context()
    - [amd64] HID: intel-ish-hid: Update ishtp bus match to support device ID
      table
    - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
    - btrfs: fix reservation leak in some error paths when inserting inline
      extent
    - [riscv64] Sanitize syscall table indexing under speculation
    - [amd64] HID: intel-ish-hid: Reset enum_devices_done before enumeration
    - HID: playstation: Center initial joystick axes to prevent spurious events
    - ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55
    - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
    - [arm64] PCI: qcom: Remove ASPM L0s support for MSM8996 SoC
    - netfilter: replace -EEXIST with -EBUSY
    - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
    - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
    - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
    - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
    - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
    - HID: logitech: add HID++ support for Logitech MX Anywhere 3S
    - wifi: mac80211: collect station statistics earlier when disconnect
    - ASoC: simple-card-utils: Check device node before overwrite direction
    - nvme-fc: release admin tagset if init fails
    - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
    - [amd64] ASoC: amd: yc: Fix microphone on ASUS M6500RE
    - regmap: maple: free entry on mas_store_gfp() failure
    - wifi: cfg80211: Fix bitrate calculation overflow for HE rates
    - scsi: target: iscsi: Fix use-after-free in
      iscsit_dec_session_usage_count()
    - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
    - wifi: mac80211: correctly check if CSA is active
    - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
    - btrfs: reject new transactions if the fs is fully read-only
    - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio
    - [amd64] platform/x86: toshiba_haps: Fix memory leaks in add/remove
      routines
    - [amd64] platform/x86: intel_telemetry: Fix PSS event register mask
    - [amd64] platform/x86: hp-bioscfg: Skip empty attribute names
    - [amd64] platform/x86/intel/tpmi/plr: Make the file domain<n>/status
      writeable
    - smb/client: fix memory leak in smb2_open_file()
    - net: add skb_header_pointer_careful() helper
    - net/sched: cls_u32: use skb_header_pointer_careful()
    - net: liquidio: Initialize netdev pointer before queue setup
    - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
    - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
    - net: phy: add phy_interface_weight()
    - net: phy: add phy_interface_copy()
    - net: sfp: pre-parse the module support
    - net: sfp: convert sfp quirks to modify struct sfp_module_support
    - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module
    - macvlan: fix error recovery in macvlan_common_newlink()
    - net: usb: r8152: fix resume reset deadlock
    - net: don't touch dev->stats in BPF redirect paths
    - tipc: use kfree_sensitive() for session key material
    - drm/amd/display: fix wrong color value mapping on MCM shaper LUT
    - net: gro: fix outer network offset
    - [amd64] drm/mgag200: fix mgag200_bmc_stop_scanout()
    - drm/xe/query: Fix topology query pointer advance
    - drm/xe/pm: Also avoid missing outer rpm warning on system suspend
    - drm/xe/pm: Disable D3Cold for BMG only on specific platforms
    - [armhf] hwmon: (occ) Mark occ_init_attribute() as __printf
    - netfilter: nf_tables: fix inverted genmask check in
      nft_map_catchall_activate()
    - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF
    - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update()
    - [amd64] ASoC: amd: fix memory leak in acp3x pdm dma ops
    - [arm64] ipi: tegra: Fix a memory leak in tegra_slink_probe()
    - [arm64,armhf] spi: tegra114: Preserve SPI mode bits in def_command1_reg
    - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU.
    - gpiolib-acpi: Update file references in the Documentation and MAINTAINERS
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.71
    - net: tunnel: make skb_vlan_inet_prepare() return drop reasons
      (Closes: #1127597)
    - io_uring/rw: recycle buffers manually for non-mshot reads
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.72
    - smb: client: split cached_fid bitfields to avoid shared-byte RMW races
    - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error
      paths
    - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
    - driver core: enforce device_lock for driver_match_device()
    - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB
    - [amd64] crypto: iaa - Fix out-of-bounds index in
      find_empty_iaa_compression_mode
    - [armhf] crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists
      correctly
    - crypto: virtio - Add spinlock protection with virtqueue notification
    - crypto: virtio - Remove duplicated virtqueue_kick in
      virtio_crypto_skcipher_crypt_req
    - nilfs2: Fix potential block overflow that cause system hang
    - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
    - scsi: qla2xxx: Validate sp before freeing associated memory
    - scsi: qla2xxx: Allow recovery for tape devices
    - scsi: qla2xxx: Delay module unload while fabric scan in progress
    - scsi: qla2xxx: Free sp in error path to fix system crash
    - scsi: qla2xxx: Query FW again before proceeding with login
    - bus: mhi: host: pci_generic: Add Telit FE990B40 modem support
    - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169)
    - erofs: fix UAF issue for file-backed mounts w/ directio option
    - xfs: fix UAF in xchk_btree_check_block_owner
    - PCI: endpoint: Avoid creating sub-groups asynchronously
    - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
    - [armhf] gpio: omap: do not register driver in probe()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.73
    - Revert "driver core: enforce device_lock for driver_match_device()"

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 17 Feb 2026 06:47:26 +0100

linux (6.12.69-1) trixie-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.64
    - btrfs: do not skip logging new dentries when logging a new name
    - btrfs: fix a potential path leak in print_data_reloc_error()
    - [arm64] bpf, arm64: Do not audit capability check in do_jit()
    - btrfs: fix memory leak of fs_devices in degraded seed device path
    - shmem: fix recovery on rename failures
    - iomap: adjust read range correctly for non-block-aligned positions
    - iomap: account for unaligned end offsets when truncating read range
    - scripts/faddr2line: Fix "Argument list too long" error
    - [amd64] perf/x86/amd: Check event before enable to avoid GPF
    - sched/deadline: only set free_cpus for online runqueues
    - sched/fair: Revert max_newidle_lb_cost bump
    - [amd64] x86/ptrace: Always inline trivial accessors
    - ACPICA: Avoid walking the Namespace if start_node is NULL
    - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
    - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist
    - ACPI: fan: Workaround for 64-bit firmware bug
    - cpuidle: menu: Use residency threshold in polling state override decisions
    - livepatch: Match old_sympos 0 and 1 in klp_find_func()
    - fs/ntfs3: Support timestamps prior to epoch
    - kbuild: Use objtree for module signing key path
    - ntfs: set dummy blocksize to read boot_block when mounting
    - hfsplus: fix volume corruption issue for generic/070
    - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
    - hfsplus: Verify inode mode when loading from disk
    - hfsplus: fix volume corruption issue for generic/073
    - fs/ntfs3: check for shutdown in fsync
    - wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU
    - wifi: cfg80211: stop radar detection in cfg80211_leave()
    - wifi: cfg80211: use cfg80211_leave() in iftype change
    - wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC
      load
    - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
    - btrfs: scrub: always update btrfs_scrub_progress::last_physical
    - gfs2: fix remote evict for read-only filesystems
    - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad"
    - smb/server: fix return value of smb2_ioctl()
    - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
    - ksmbd: vfs: fix race on m_flags in vfs_cache
    - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV
    - Bluetooth: btusb: MT7922: Add VID/PID 0489/e170
    - Bluetooth: btusb: MT7920: Add VID/PID 0489/e135
    - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
    - Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT
    - gfs2: Fix use of bio_chain
    - [arm64,armhf] net: fec: ERR007885 Workaround for XDP TX path
    - netrom: Fix memory leak in nr_sendmsg()
    - net/sched: ets: Always remove class from active list before deleting in
      ets_qdisc_change
    - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
    - bnxt_en: Fix XDP_TX path
    - net: openvswitch: fix middle attribute validation in push_nsh() action
    - broadcom: b44: prevent uninitialized value usage
    - netfilter: nf_conncount: fix leaked ct in error paths
    - ipvs: fix ipv4 null-ptr-deref in route error path
    - net/sched: ets: Remove drr class from the active list if it changes to
      strict
    - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
    - netfilter: nf_nat: remove bogus direction check
    - netfilter: nf_tables: remove redundant chain validation on register store
    - ethtool: Avoid overflowing userspace buffer on stats query
    - net/mlx5: fw reset, clear reset requested on drain_fw_reset
    - net/mlx5: Drain firmware reset in shutdown callback
    - net/mlx5: fw_tracer, Validate format string parameters
    - net/mlx5: fw_tracer, Handle escaped percent properly
    - net/mlx5: Serialize firmware reset with devlink
    - net/handshake: duplicate handshake cancellations leak socket
    - [arm64] net: enetc: do not transmit redirected XDP frames when the link is
      down
    - [arm64] net: hns3: using the num_tqps in the vf driver to apply for
      resources
    - [arm64] net: hns3: using the num_tqps to check whether tqp_index is out of
      range when vf get ring info from mbx
    - [arm64] net: hns3: add VLAN id validation before using
    - [amd64] hwmon: (dell-smm) Limit fan multiplier to avoid overflow
    - hwmon: (ibmpex) fix use-after-free in high/low store
    - hwmon: (tmp401) fix overflow caused by default conversion rate value
    - drm/me/gsc: mei interrupt top half should be in irq disabled context
    - drm/xe: Restore engine registers before restarting schedulers after GT
      reset
    - drm/panel: sony-td4353-jdi: Enable prepare_prev_first
    - [amd64] x86/xen: Move Xen upcall handler
    - [amd64] x86/xen: Fix sparse warning in enlighten_pv.c
    - [arm64] kdump: Fix elfcorehdr overlap caused by reserved memory processing
      reorder
    - spi: cadence-quadspi: Fix clock disable on probe failure path
    - block: rnbd-clt: Fix leaked ID in init_dev()
    - drm/xe: Limit num_syncs to prevent oversized allocations
    - drm/xe/oa: Limit num_syncs to prevent oversized allocations
    - ksmbd: skip lock-range check on equal size to avoid size==0 underflow
    - ksmbd: Fix refcount leak when invalid session is found on session lookup
    - ksmbd: fix buffer validation by including null terminator size in EA
      length
    - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
    - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
    - Input: lkkbd - disable pending work before freeing device
    - Input: alps - fix use-after-free bugs caused by dev3_register_work
    - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
    - xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails
    - can: gs_usb: gs_can_open(): fix error handling
    - [arm64,armhf] soc/tegra: fuse: Do not register SoC device on ACPI boot
    - ACPI: PCC: Fix race condition by removing static qualifier
    - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
    - [arm64] mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds
    - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml
    - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
    - [amd64] x86/fpu: Fix FPU state core dump truncation on CPUs with no
      extended xfeatures
    - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
    - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
    - ALSA: usb-mixer: us16x08: validate meter packet indices
    - nfsd: update percpu_ref to manage references on nfsd_net
    - nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_
    - nfsd: fix memory leak in nfsd_create_serv error paths
    - ipmi: Fix the race between __scan_channels() and deliver_response()
    - ipmi: Fix __scan_channels() failing to rescan channels
    - [arm64,armhf] ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on
      AM33xx
    - scsi: smartpqi: Add support for Hurray Data new controller PCI device
    - [arm64] clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
      pcie_x4
    - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
    - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
    - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
    - fuse: Always flush the page cache before FOPEN_DIRECT_IO write
    - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
    - via_wdt: fix critical boot hang due to unnamed resource allocation
    - reset: fix BIT macro reference
    - exfat: fix remount failure in different process environments
    - exfat: zero out post-EOF page cache on file extension
    - usbip: Fix locking bug in RT-enabled kernels
    - usb: typec: ucsi: Handle incorrect num_connectors capability
    - [armhf] iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc
      complains
    - usb: xhci: limit run_graceperiod for only usb 3.0 devices
    - usb: usb-storage: No additional quirks need to be added to the EL-R12
      optical drive.
    - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
    - i2c: designware: Disable SMBus interrupts to prevent storms from
      mis-configured firmware
    - nvme-fc: don't hold rport lock when putting ctrl
    - nvme-fabrics: add ENOKEY to no retry criteria for authentication failures
    - [amd64] platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS
      DMI quirks
    - [amd64] scsi: scsi_debug: Fix atomic write enable module param description
    - block: rnbd-clt: Fix signedness bug in init_dev()
    - vhost/vsock: improve RCU read sections around vhost_vsock_get()
    - cifs: Fix memory and information leak in smb3_reconfigure()
    - KEYS: trusted: Fix a memory leak in tpm2_load_cmd
    - io_uring: fix filename leak in __io_openat_prep()
    - [amd64] x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD
      SMCA systems
    - [arm64] mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
    - perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister()
    - [amd64] lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
    - [s390x] dasd: Fix gendisk parent after copy pair swap
    - wifi: mt76: Fix DTS power-limits on little endian systems
    - block: rate-limit capacity change info log
    - floppy: fix for PAGE_SIZE != 4KB
    - kallsyms: Fix wrong "big" kernel symbol type read from procfs
    - fs/ntfs3: fix mount failure for sparse runs in run_unpack()
    - tpm: Cap the number of PCR banks
    - ext4: fix string copying in parse_apply_sb_mount_options()
    - ext4: xattr: fix null pointer deref in ext4_raw_inode()
    - ext4: clear i_state_flags when alloc inode
    - ext4: fix incorrect group number assertion in mb_check_buddy
    - ext4: align max orphan file size with e2fsprogs limit
    - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key
    - jbd2: use a weaker annotation in journal handling
    - media: v4l2-mem2mem: Fix outdated documentation
    - mptcp: schedule rtx timer only after pushing data
    - mptcp: avoid deadlock on fallback while reinjecting
    - usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
    - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
    - media: pvrusb2: Fix incorrect variable used in trace message
    - usb: typec: altmodes/displayport: Drop the device reference in
      dp_altmode_probe()
    - [arm64,armhf] usb: dwc3: of-simple: fix clock resource leak in
      dwc3_of_simple_probe
    - [arm64,armhf] usb: dwc3: keep susphy enabled during exit to avoid
      controller faults
    - char: applicom: fix NULL pointer dereference in ac_ioctl
    - [amd64] intel_th: Fix error handling in intel_th_output_open
    - mei: gsc: add dependency on Xe driver
    - serial: sh-sci: Check that the DMA cookie is valid
    - cpuidle: governors: teo: Drop misguided target residency check
    - cpufreq: nforce2: fix reference count leak in nforce2
    - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort
      path"
    - scsi: aic94xx: fix use-after-free in device removal path
    - NFSD: use correct reservation type in nfsd4_scsi_fence_client
    - scsi: target: Reset t_task_cdb pointer in error case
    - scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow
    - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error
    - f2fs: ensure node page reads complete before f2fs_put_super() finishes
    - f2fs: fix to avoid potential deadlock
    - f2fs: fix to avoid updating zero-sized extent in extent cache
    - f2fs: invalidate dentry cache on failed whiteout creation
    - f2fs: fix age extent cache insertion skip on counter overflow
    - f2fs: fix uninitialized one_time_gc in victim_sel_policy
    - f2fs: fix return value of f2fs_recover_fsync_data()
    - KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
    - media: vidtv: initialize local pointers upon transfer of memory ownership
    - ocfs2: fix kernel BUG in ocfs2_find_victim_chain
    - [amd64] KVM: x86: Don't clear async #PF queue when CR0.PG is disabled
      (e.g. on #SMI)
    - [amd64] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
    - scs: fix a wrong parameter in __scs_magic
    - libceph: make decode_pool() more resilient against corrupted osdmaps
    - [powerpc*] Add reloc_offset() to font bitmap pointer used for
      bootx_printf()
    - [amd64] KVM: x86: WARN if hrtimer callback for periodic APIC timer fires
      with period=0
    - [amd64] KVM: x86: Explicitly set new periodic hrtimer expiration in
      apic_timer_fn()
    - [amd64] KVM: x86: Fix VM hard lockup after prolonged inactivity with
      periodic HV timer
    - [amd64] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
    - [amd64] KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
    - [amd64] KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW
      emulation
    - [amd64] KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN
    - [amd64] KVM: nVMX: Immediately refresh APICv controls as needed on nested
      VM-Exit
    - [amd64] KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR
      (failed VMRUN)
    - [amd64] KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested
      VM-Exits
    - xfs: fix a memory leak in xfs_buf_item_init()
    - xfs: fix stupid compiler warning
    - xfs: fix a UAF problem in xattr repair
    - tracing: Do not register unsupported perf events
    - PM: runtime: Do not clear needs_force_resume with enabled runtime PM
    - r8169: fix RTL8117 Wake-on-Lan in DASH mode
    - fsnotify: do not generate ACCESS/MODIFY events on child for special files
    - net/handshake: restore destructor on submit failure
    - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
    - NFSD: NFSv4 file creation neglects setting ACL
    - nfsd: Mark variable __maybe_unused to avoid W=1 build break
    - svcrdma: return 0 on success from svc_rdma_copy_inline_range
    - svcrdma: use rc_pageoff for memcpy byte offset
    - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in
      gss_read_proxy_verf
    - [powerpc*] kexec: Enable SMT before waking offline CPUs
    - btrfs: don't log conflicting inode if it's a dir moved in the current
      transaction
    - [s390x] ipl: Clear SBP flag when bootprog is set
    - gpio: regmap: Fix memleak in error path in gpio_regmap_register()
    - io_uring/poll: correctly handle io_poll_add() return value on update
    - io_uring: fix min_wait wakeups for SQPOLL
    - Revert "drm/amd/display: Fix pbn to kbps Conversion"
    - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
    - drm/amd/display: Fix scratch registers offsets for DCN35
    - drm/amd/display: Fix scratch registers offsets for DCN351
    - drm/displayid: pass iter to drm_find_displayid_extension()
    - ALSA: hda: cs35l41: Fix NULL pointer dereference in
      cs35l41_hda_read_acpi() (CVE-2025-68345)
    - ALSA: wavefront: Use guard() for spin locks
    - ALSA: wavefront: Clear substream pointers on close
    - [arm64] pinctrl: renesas: rzg2l: Fix ISEL restore on resume
    - hsr: hold rcu and dev lock for hsr_get_port_ndev (CVE-2025-39872)
    - sched/rt: Fix race in push_rt_task (CVE-2025-38234)
    - [arm64] KVM: arm64: Initialize HCR_EL2.E2H early
    - [arm64] KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu()
    - [arm64] Revamp HCR_EL2.E2H RES1 detection
    - dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and
      resets
    - dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains
      and resets
    - dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and
      resets
    - dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and
      resets
    - dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and
      resets
    - dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and
      resets
    - dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and
      resets
    - crypto: af_alg - zero initialize memory allocated via sock_kmalloc
    - crypto: caam - Add check for kcalloc() in test_len()
    - [arm64,armhf] amba: tegra-ahb: Fix device leak on SMMU enable
    - virtio: vdpa: Fix reference count leak in octep_sriov_enable()
    - tracing: Fix fixed array of synthetic event
    - [arm64,armhf] soc: samsung: exynos-pmu: fix device leak on regmap lookup
    - [arm64] soc: qcom: ocmem: fix device leak on lookup
    - [arm64] soc: amlogic: canvas: fix device leak on lookup
    - rpmsg: glink: fix rpmsg device leak
    - [amd64] platform/x86: intel: chtwc_int33fe: don't dereference swnode args
    - i2c: amd-mp2: fix reference leak in MP2 PCI device
    - hwmon: (max16065) Use local variable to avoid TOCTOU
    - hwmon: (max6697) fix regmap leak on probe failure
    - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
    - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
    - [amd64] x86/msi: Make irq_retrigger() functional for posted MSI
    - [arm64] iommu/mediatek: fix use-after-free on probe deferral
    - fuse: fix readahead reclaim deadlock
    - wifi: rtw88: limit indirect IO under powered off for RTL8822CS
      (Closes: #1125797)
    - wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
    - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
    - wifi: mac80211: do not use old MBSSID elements
    - i40e: fix scheduling in set_rx_mode
    - i40e: validate ring_len parameter against hardware-specific values
    - iavf: fix off-by-one issues in iavf_config_rss_reg()
    - idpf: reduce mbx_task schedule delay to 300us
    - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
    - Bluetooth: btusb: revert use of devm_kzalloc in btusb
    - net: mdio: aspeed: add dummy read to avoid read-after-write issue
    - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
    - ip6_gre: make ip6gre_header() robust
    - [amd64] platform/x86: msi-laptop: add missing sysfs_remove_group()
    - [amd64] platform/x86: ibm_rtl: fix EBDA signature search pointer
      arithmetic
    - team: fix check for port enabled in
      team_queue_override_port_prio_changed()
    - [arm64,armhf] net: dsa: fix missing put_device() in
      dsa_tree_find_first_conduit()
    - amd-xgbe: reset retries and mode on RX adapt failures
    - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
    - genalloc.h: fix htmldocs warning
    - firewire: nosy: Fix dma_free_coherent() size
    - [armhf] net: dsa: b53: skip multicast entries for fdb_dump()
    - kbuild: fix compilation of dtb specified on command-line without make rule
    - net: usb: asix: validate PHY address before use
    - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
    - vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
    - [amd64] platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI
      package parsing
    - [arm64] octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
    - net: stmmac: fix the crash issue for zero copy XDP_TX action
    - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
    - ipv4: Fix reference count leak when using error routes with nexthop
      objects
    - net: rose: fix invalid array index in rose_kill_by_device()
    - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
    - RDMA/irdma: avoid invalid read in irdma_net_event
    - RDMA/efa: Remove possible negative shift
    - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
    - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
    - RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
    - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
    - RDMA/bnxt_re: Fix to use correct page size for PDE table
    - md: Fix static checker warning in analyze_sbs
    - md/raid5: fix possible null-pointer dereferences in
      raid5_store_group_thread_cnt()
    - ksmbd: Fix memory leak in get_file_all_info()
    - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
    - RDMA/bnxt_re: fix dma_free_coherent() pointer
    - blk-mq: skip CPU offline notify on unmapped hctx
    - ntfs: Do not overwrite uptodate pages
    - [armhf] ASoC: stm32: sai: fix device leak on probe
    - [armhf] ASoC: stm32: sai: fix clk prepare imbalance on probe failure
    - [armhf] ASoC: stm32: sai: fix OF node leak on probe
    - [arm64] ASoC: codecs: lpass-tx-macro: fix SM6115 support
    - [arm64] ASoC: qcom: q6apm-dai: set flags to reflect correct operation of
      appl_ptr
    - [arm64] ASoC: qcom: q6asm-dai: perform correct state check before closing
    - [arm64] ASoC: qcom: q6adm: the the copp device only during last instance
    - [arm64] ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer
      alignment.
    - [amd64] iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
    - [amd64] iommu/amd: Propagate the error code returned by __modify_irte_ga()
      in modify_irte_ga()
    - [armhf] iommu/omap: fix device leaks on probe_device()
    - [arm64] iommu/qcom: fix device leak on of_xlate()
    - [arm64,riscv64] iommu/sun50i: fix device leak on of_xlate()
    - [arm64,armhf] iommu/tegra: fix device leak on probe_device()
    - iommu: disable SVA when CONFIG_X86 is set
    - HID: logitech-dj: Remove duplicate error logging
    - fgraph: Initialize ftrace_ops->private for function graph ops
    - fgraph: Check ftrace_pids_enabled on registration for early filtering
    - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
    - [arm64] dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power
      regulator
    - [powerpc*] mm: Fix mprotect on book3s 32-bit
    - [powerpc*] 64s/slb: Fix SLB multihit issue during SLB preload
    - leds: leds-cros_ec: Skip LEDs without color components
    - leds: leds-lp50xx: Allow LED 0 to be added to module bank
    - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
    - leds: leds-lp50xx: Enable chip before any communication
    - block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs
    - [arm64,armhf] clk: samsung: exynos-clkout: Assign .num before accessing
      .hws (Closes: #1121211)
    - [arm64] mfd: max77620: Fix potential IRQ chip conflict when probing two
      devices
    - media: rc: st_rc: Fix reset control resource leak
    - media: verisilicon: Fix CPU stalls on G2 bus error
    - mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions
    - mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips
    - mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips
    - mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips
    - mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips
    - mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips
    - mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips
    - [amd64] perf/x86/amd/uncore: Fix the return value of
      amd_uncore_df_event_init() on error
    - [powerpc*] pseries/cmm: call balloon_devinfo_init() also without
      CONFIG_BALLOON_COMPACTION
    - media: adv7842: Avoid possible out-of-bounds array accesses in
      adv7842_cp_log_status()
    - firmware: stratix10-svc: Add mutex in stratix10 memory management
    - dm-ebs: Mark full buffer dirty even on partial write
    - dm-bufio: align write boundary on physical block size
    - fbdev: gbefb: fix to use physical address instead of dma address
    - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
    - fbdev: tcx.c fix mem_map to correct smem_start offset
    - media: cec: Fix debugfs leak on bus_register() failure
    - media: msp3400: Avoid possible out-of-bounds array accesses in
      msp3400c_thread()
    - media: platform: mtk-mdp3: fix device leaks at probe
    - media: renesas: rcar_drif: fix device node reference leak in
      rcar_drif_bond_enabled
    - media: samsung: exynos4-is: fix potential ABBA deadlock on init
    - media: TDA1997x: Remove redundant cancel_delayed_work in probe
    - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
    - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
    - media: vpif_capture: fix section mismatch
    - media: vpif_display: fix section mismatch
    - media: amphion: Cancel message work before releasing the VPU core
    - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
    - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
    - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
    - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_probe()
    - compiler_types.h: add "auto" as a macro for "__auto_type"
    - lockd: fix vfs_test_lock() calls
    - idr: fix idr_alloc() returning an ID out of range
    - mm/page_owner: fix memory leak in page_owner_stack_fops->release()
    - [amd64] x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix
      Halo
    - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
    - samples/ftrace: Adjust LoongArch register restore order in direct calls
    - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
    - RDMA/cm: Fix leaking the multicast GID table reference
    - e1000: fix OOB in e1000_tbi_should_accept()
    - fjes: Add missing iounmap in fjes_hw_init()
    - nfsd: Drop the client reference in client_states_open()
    - net: usb: sr9700: fix incorrect command used to write single register
    - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
    - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to
      macb_open()
    - Revert "drm/amd: Skip power ungate during suspend for VPE"
    - drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling
    - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
    - drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling
    - [arm64] drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
    - [amd64] drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
    - drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident
    - drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
    - [arm64] drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
    - [arm64] drm/mediatek: Fix probe resource leaks
    - [arm64] drm/mediatek: Fix probe memory leak
    - [arm64] drm/mediatek: Fix probe device leaks
    - drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace
    - drm/amdkfd: bump minimum vgpr size for gfx1151
    - drm/amdkfd: Trap handler support for expert scheduling mode
    - [amd64] drm/i915: Fix format string truncation warning
    - drm/ttm: Avoid NULL pointer deref for evicted BOs
    - [amd64] drm/mgag200: Fix big-endian support
    - drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table
    - drm/xe/oa: Disallow 0 OA property values
    - drm/xe: Adjust long-running workload timeslices to reasonable values
    - drm/xe: Use usleep_range for accurate long-running workload timeslicing
    - drm/xe: Drop preempt-fences when destroying imported dma-bufs.
    - [arm64] drm/msm/dpu: Add missing NULL pointer check for pingpong interface
    - [amd64] drm/i915/gem: Zero-initialize the eb.vma array in
      i915_gem_do_execbuffer
    - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
    - [riscv64] lib/crypto: riscv/chacha: Avoid s0/fp register
    - gfs2: fix freeze error handling
    - btrfs: don't rewrite ret from inode_permission
    - sched/eevdf: Fix min_vruntime vs avg_vruntime
    - erofs: fix unexpected EIO under memory pressure
    - sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks
    - jbd2: fix the inconsistency between checksum and data in memory for
      journal sb
    - tty: introduce and use tty_port_tty_vhangup() helper
    - xhci: dbgtty: fix device unregister: fixup
    - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
    - f2fs: use global inline_xattr_slab instead of per-sb slab cache
    - f2fs: drop inode from the donation list when the last file is closed
    - f2fs: fix to avoid updating compression context during writeback
    - serial: core: fix OF node leak
    - serial: core: Restore sysfs fwnode information
    - mptcp: pm: ignore unknown endpoint flags
    - mm/ksm: fix exec/fork inheritance support for prctl
    - svcrdma: bound check rq_pages index in inline path
    - block: freeze queue when updating zone resources
    - tpm2-sessions: Fix tpm2_read_public range checks
    - sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue()
    - sched_ext: Fix missing post-enqueue handling in
      move_local_task_to_local_dsq()
    - drm/displayid: add quirk to ignore DisplayID checksum errors
    - hrtimers: Introduce hrtimer_update_function()
    - [arm64] serial: xilinx_uartps: Use helper function
      hrtimer_update_function()
    - [arm64] serial: xilinx_uartps: fix rs485 delay_rts_after_send
    - f2fs: clear SBI_POR_DOING before initing inmem curseg
    - f2fs: add timeout in f2fs_enable_checkpoint()
    - f2fs: dump more information for f2fs_{enable,disable}_checkpoint()
    - f2fs: fix to propagate error from f2fs_enable_checkpoint()
    - gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list()
    - gpiolib: acpi: Handle deferred list via new API
    - gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter
    - gpiolib: acpi: Move quirks to a separate file
    - gpiolib: acpi: Add a quirk for Acer Nitro V15
    - gpiolib: acpi: Add quirk for ASUS ProArt PX13
    - gpiolib: acpi: Add quirk for Dell Precision 7780
    - netfilter: nft_ct: add seqadj extension for natted connections
      (CVE-2025-68206)
    - md/raid10: wait barrier before returning discard request with REQ_NOWAIT
      (CVE-2025-40325)
    - [arm64] drm/panthor: Flush shmem writes before mapping buffers
      CPU-uncached (CVE-2025-40276)
    - net: ipv6: ioam6: use consistent dst names
    - ipv6: adopt dst_dev() helper
    - net: use dst_dev_rcu() in sk_setup_caps()
    - usbnet: Fix using smp_processor_id() in preemptible code warnings
    - serial: core: Fix serial device initialization
    - tty: fix tty_port_tty_*hangup() kernel-doc
    - [amd64] x86/microcode/AMD: Select which microcode patch to load
    - media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio
    - wifi: mt76: mt7925: fix the unfinished command of regd_notifier before
      suspend
    - wifi: mt76: mt7925: fix CLC command timeout when suspend/resume
    - wifi: mt76: mt7925: add handler to hif suspend/resume event
    - idpf: add support for SW triggered interrupts
    - idpf: trigger SW interrupt when exiting wb_on_itr mode
    - idpf: add support for Tx refillqs in flow scheduling mode
    - idpf: improve when to set RE bit logic
    - idpf: simplify and fix splitq Tx packet rollback error path
    - idpf: replace flow scheduling buffer ring with buffer pool
    - idpf: stop Tx if there are insufficient buffer resources
    - idpf: remove obsolete stashing code
    - hrtimers: Make hrtimer_update_function() less expensive
    - gve: defer interrupt enabling until NAPI registration
    - block: handle zone management operations completions
    - soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter
    - [arm64] ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime
    - PCI: brcmstb: Reuse pcie_cfg_data structure
    - PCI: brcmstb: Set MLW based on "num-lanes" DT property if present
    - PCI: brcmstb: Fix disabling L0s capability
    - mm/balloon_compaction: we cannot have isolated pages in the balloon list
    - mm/balloon_compaction: convert balloon_page_delete() to
      balloon_page_finalize()
    - [powerpc*] pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
    - media: mediatek: vcodec: Use spinlock for context list protection lock
    - media: amphion: Add a frame flush mode for decoder
    - media: amphion: Make some vpu_v4l2 functions static
    - media: amphion: Remove vpu_vb_is_codecconfig
    - vfio/pci: Disable qword access to the PCI ROM bar
    - iomap: allocate s_dio_done_wq for async reads as well (CVE-2025-68357)
    - block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.65
    - mptcp: fallback earlier on simult connection
    - mm/page_alloc: change all pageblocks migrate type on coalescing
    - mm: simplify folio_expected_ref_count()
    - mm: consider non-anon swap cache folios in folio_expected_ref_count()
    - mptcp: ensure context reset on disconnect()
    - wifi: mac80211: Discard Beacon frames to non-broadcast address
    - [arm64] net: phy: mediatek: fix nvmem cell reference leak in
      mt798x_phy_calibration
    - drm/amdgpu: Forward VMID reservation errors
    - [amd64] cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL
      writes
    - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
    - sched/fair: Small cleanup to sched_balance_newidle()
    - sched/fair: Small cleanup to update_newidle_cost()
    - sched/fair: Proportional newidle balance
    - virtio_console: fix order of fields cols and rows
    - [armhf] pwm: stm32: Always program polarity
    - [amd64] Revert "iommu/amd: Skip enabling command/event buffers for kdump"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.66
    - NFSD: Fix permission check for read access to executable-only files
    - nfsd: provide locking for v4_end_grace
    - nfsd: use correct loop termination in nfsd4_revoke_states()
    - nfsd: check that server is running in unlock_filesystem
    - NFSD: net ref data still needs to be freed even if net hasn't startup
    - NFSD: Remove NFSERR_EAGAIN
    - atm: Fix dma_free_coherent() size
    - net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
    - [arm64] Fix cleared E0POE bit after cpu_suspend()/resume()
    - btrfs: always detect conflicting inodes when logging inode refs
    - [amd64] mei: me: add nova lake point S DID
    - lib/crypto: aes: Fix missing MMU protection for AES S-box
    - drm/amdgpu: Fix query for VPE block_type and ip_count
    - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[]
      (Closes: #1122106)
    - [arm64,armhf] gpio: rockchip: mark the GPIO controller as sleeping
    - [arm64] pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping
    - wifi: avoid kernel-infoleak from struct iw_point
    - wifi: mac80211: restore non-chanctx injection behaviour
    - libceph: prevent potential out-of-bounds reads in handle_auth_done()
    - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
    - libceph: make free_choose_arg_map() resilient to partial allocation
    - libceph: return the handler error from mon_handle_auth_done()
    - libceph: reset sparse-read state in osd_fault()
    - libceph: make calc_target() set t->paused, not just clear it
    - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
      (CVE-2025-40149)
    - drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally
    - drm/xe: Ensure GT is in C0 during resumes
    - dm-snapshot: fix 'scheduling while atomic' on real-time kernels
    - NFSv4: ensure the open stateid seqid doesn't go backwards
    - [arm64] ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again)
    - NFS: Fix up the automount fs_context to use the correct cred
    - drm/amd/display: shrink struct members
    - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
    - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
    - smb/client: fix NT_STATUS_NO_DATA_DETECTED value
    - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
    - scsi: ufs: core: Fix EH failure after W-LUN resume error
    - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
      failure scanned in again after probe failed"
    - btrfs: fix qgroup_snapshot_quick_inherit() squota bug
    - btrfs: qgroup: update all parent qgroups when doing quick inherit
    - btrfs: tracepoints: use btrfs_root_id() to get the id of a root
    - btrfs: fix NULL dereference on root when tracing inode eviction
    - drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files
    - drm/amd/display: Apply e4479aecf658 to dml
    - [arm64] dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema
      warnings
    - [amd64] crypto: qat - fix duplicate restarting msg during AER error
    - [arm64] dts: add off-on-delay-us for usdhc2 regulator
    - netfilter: nft_set_pipapo: fix range overlap detection
    - netfilter: nft_synproxy: avoid possible data-race on update operation
    - [arm64,armhf] gpio: pca953x: Add support for level-triggered interrupts
    - [arm64,armhf] gpio: pca953x: handle short interrupt pulses on PCAL devices
    - netfilter: nf_tables: fix memory leak in nf_tables_newrule()
    - netfilter: nf_conncount: update last_gc only when GC has been performed
    - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
    - [arm64] net: mscc: ocelot: Fix crash when adding interface under a lag
    - inet: ping: Fix icmp out counting
    - net: sock: fix hardened usercopy panic in sock_recv_errqueue
    - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
    - net/mlx5e: Don't print error message due to invalid module
    - net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
    - bnxt_en: Fix potential data corruption with HW GRO/LRO
    - vsock: Make accept()ed sockets use custom setsockopt()
    - btrfs: only enforce free space tree if v1 cache is required for bs < ps
      cases
    - [riscv64] pgtable: Cleanup useless VA_USER_XXX definitions
    - net: fix memory leak in skb_segment_list for GRO packets
    - idpf: keep the netdev when a reset fails
    - idpf: fix memory leak in idpf_vport_rel()
    - idpf: cap maximum Rx buffer size
    - HID: quirks: work around VID/PID conflict for appledisplay
    - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in
      qfq_reset
    - net: usb: pegasus: fix memory leak in update_eth_regs_async()
    - arp: do not assume dev_hard_header() does not change skb->head
    - erofs: don't bother with s_stack_depth increasing for now
    - erofs: fix file-backed mounts no longer working on EROFS partitions
    - ALSA: ac97bus: Use guard() for mutex locks
    - ALSA: ac97: fix a double free in snd_ac97_controller_register()
    - btrfs: fix error handling of submit_uncompressed_range()
    - btrfs: subpage: dump the involved bitmap when ASSERT() failed
    - btrfs: add extra error messages for delalloc range related errors
    - btrfs: remove btrfs_fs_info::sectors_per_page
    - btrfs: truncate ordered extent when skipping writeback past i_size
    - btrfs: use variable for end offset in extent_writepage_io()
    - btrfs: fix beyond-EOF write handling
    - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K
    - bpf: Make variables in bpf_prog_test_run_xdp less confusing
    - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN
    - bpf: Fix reference count leak in bpf_prog_test_run_xdp()
    - net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant
    - powercap: fix race condition in register_control_type()
    - powercap: fix sscanf() error return value handling
    - netfilter: nf_tables: avoid chain re-validation if possible
    - ata: libata-core: Disable LPM on ST2000DM008-2FR102
    - drm/amd/display: Fix DP no audio issue
    - [arm64] spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ
    - drm/amdkfd: Fix improper NULL termination of queue restore SMI event
      string
    - can: j1939: make j1939_session_activate() fail if device is no longer
      registered
    - ALSA: usb-audio: Update for native DSD support quirks
    - [amd64] ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025
    - ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL
    - [arm64,armhf] ASoC: fsl_sai: Add missing registers to cache default
    - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
    - spi: cadence-quadspi: Prevent lost complete() call during indirect read
    - tpm2-sessions: Fix out of range indexing in name_size (CVE-2025-68792)
    - ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.67
    - efi/cper: Fix cper_bits_to_str buffer handling and return value
    - Revert "gfs2: Fix use of bio_chain"
    - [amd64] x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
    - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
    - xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
    - pNFS: Fix a deadlock when returning a delegation during open()
    - NFS: Fix a deadlock involving nfs_release_folio()
    - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
    - pnfs/blocklayout: Fix memory leak in bl_parse_scsi()
    - drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions
    - PM: EM: Fix incorrect description of the cost field in struct
      em_perf_state
    - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
    - btrfs: send: check for inline extents in range_is_hole_in_parent()
    - net: bridge: annotate data-races around fdb->{updated,used}
    - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
    - net: update netdev_lock_{type,name}
    - macvlan: fix possible UAF in macvlan_forward_source()
    - ipv4: ip_gre: make ipgre_header() robust
    - net/mlx5e: Fix crash on profile change rollback failure
    - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
    - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
    - net/mlx5e: Restore destroying state bit after profile cleanup
    - btrfs: factor out init_space_info() from create_space_info()
    - btrfs: factor out check_removing_space_info() from
      btrfs_free_block_groups()
    - btrfs: introduce btrfs_space_info sub-group
    - btrfs: fix memory leaks in create_space_info() error paths
    - ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip
    - net: hv_netvsc: reject RSS hash key programming without RX indirection
      table
    - ipv6: Fix use-after-free in inet6_addr_del().
    - net/sched: sch_qfq: do not free existing class in qfq_change_class()
    - [amd64] ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack
      type
    - drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2
    - mm: describe @flags parameter in memalloc_flags_save()
    - textsearch: describe @list member in ts_ops search
    - mm, kfence: describe @slab parameter in __kfence_obj_info()
    - [arm64] dmaengine: tegra-adma: Fix use-after-free
    - [arm64] phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before
      using it
    - [arm64] phy: phy-snps-eusb2: refactor constructs names
    - phy: drop probe registration printks
    - [arm64] phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
    - [armhf] phy: stm32-usphyc: Fix off by one in probe()
    - [armhf] dmaengine: omap-dma: fix dma_pool resource leak in error paths
    - [arm64] i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
    - HID: usbhid: paper over wrong bNumDescriptor field (Closes: #1122193)
    - bridge: mcast: Fix use-after-free during router port configuration
      (CVE-2025-38248)
    - [arm64] ASoC: codecs: wsa883x: fix unnecessary initialisation
    - drm/amd/display: mark static functions noinline_for_stack
    - io_uring: move local task_work in exit cancel loop
    - scsi: core: Fix error handler encryption support
    - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
    - null_blk: fix kmemleak by releasing references to fault configfs items
    - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
    - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
    - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session
      upon receiving the second rts
    - xfs: Fix the return value of xfs_rtcopy_summary()
    - lib/buildid: use __kernel_read() for sleepable context
    - [arm64] phy: rockchip: inno-usb2: fix communication disruption in gadget
      mode
    - [arm64,armhf] phy: ti: gmii-sel: fix regmap leak on probe failure
    - [arm64] phy: freescale: imx8m-pcie: assert phy reset during power on
    - [arm64] phy: rockchip: inno-usb2: fix disconnection in gadget mode
    - usb: dwc3: Check for USB4 IP_NAME
    - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
    - USB: OHCI/UHCI: Add soft dependencies on ehci_platform
    - USB: serial: option: add Telit LE910 MBIM composition
    - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
    - nvme-pci: disable secondary temp for Wodposit WPBSNM8
    - [arm64] ASoC: codecs: wsa881x: fix unnecessary initialisation
    - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
    - hrtimer: Fix softirq base check in update_needs_ipi()
    - [amd64] EDAC/x38: Fix a resource leak in x38_probe1()
    - [amd64] EDAC/i3200: Fix a resource leak in i3200_probe1()
    - tcpm: allow looking for role_sw device in the main node
    - i2c: riic: Move suspend handling to NOIRQ phase
    - [amd64] x86/resctrl: Add missing resctrl initialization for Hygon
    - [amd64] x86/resctrl: Fix memory bandwidth counter width for Hygon
    - nvme: fix PCIe subsystem reset controller state transition
    - mm/zswap: fix error pointer free in zswap_cpu_comp_prepare()
    - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
    - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
    - drm/amd/display: Bump the HDMI clock to 340MHz
    - drm/amd: Clean up kfd node on surprise disconnect
    - drm/amdkfd: fix a memory leak in device_queue_manager_init()
    - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
    - [arm64,armhf] drm/panel-simple: fix connector type for DataImage
      SCF0700C48GGU18 panel
    - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
    - [arm64] dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
    - [armhf] dmaengine: stm32: dmamux: fix device leak on route allocation
    - [armhf] dmaengine: stm32: dmamux: fix OF node leak on route allocation
      failure
    - [armhf] dmaengine: ti: dma-crossbar: fix device leak on dra7x route
      allocation
    - [armhf] dmaengine: ti: dma-crossbar: fix device leak on am335x route
      allocation
    - [amd64] HID: intel-ish-hid: Use dedicated unbound workqueues to prevent
      resume blocking
    - [amd64] HID: intel-ish-hid: Fix -Wcast-function-type-strict in
      devm_ishtp_alloc_workqueue()
    - btrfs: fix deadlock in wait_current_trans() due to ignored transaction
      type
    - xfs: set max_agbno to allow sparse alloc of last full inode chunk
    - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
    - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup
      failure
    - bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)
    - mm/fake-numa: allow later numa node hotplug
    - mm: numa,memblock: include <asm/numa.h> for 'numa_nodes_parsed'
    - [arm64] phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
    - [arm64] phy: rockchip: inno-usb2: Fix a double free bug in
      rockchip_usb2phy_probe()
    - [arm64] dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure
    - mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection
    - mm/page_alloc: batch page freeing in decay_pcp_high
    - mm/page_alloc: prevent pcp corruption with SMP=n
    - mm/fake-numa: handle cases with no SRAT info
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.68
    - posix-clock: Store file pointer in struct posix_clock_context
    - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
    - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
    - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
    - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
    - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
    - [arm64] pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
    - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
    - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
    - ata: ahci: Do not read the per port area for unimplemented ports
    - ata: libata-sata: Improve link_power_management_supported sysfs attribute
    - ata: libata: Add cpr_log to ata_dev_print_features() early return
    - ata: libata-core: Introduce ata_dev_config_lpm()
    - ata: libata: Call ata_dev_config_lpm() for ATAPI devices
    - ata: libata: Print features also for ATAPI devices
    - ice: initialize ring_stats->syncp
    - ice: Avoid detrimental cleanup for bond during interface stop
    - ice: Fix incorrect timeout ice_release_res()
    - igc: Restore default Qbv schedule when changing channels
    - igc: fix race condition in TX timestamp read for register 0
    - vsock/virtio: Coalesce only linear skb
    - net: usb: dm9601: remove broken SR9700 support
    - bonding: limit BOND_MODE_8023AD to Ethernet devices
    - l2tp: Fix memleak in l2tp_udp_encap_recv().
    - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on
      usb_submit_urb() error
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
    - [amd64,arm64] amd-xgbe: avoid misleading per-packet error log
    - gue: Fix skb memleak with inner IP protocol 0.
    - fou: Don't allow 0 for FOU_ATTR_IPPROTO.
    - veth: fix data race in veth_get_ethtool_stats
    - l2tp: avoid one data-race in l2tp_tunnel_del_work()
    - ipvlan: Make the addrs_lock be per port
    - [arm64] octeontx2: cn10k: fix RX flowid TCAM mask handling
    - net/sched: Enforce that teql can only be used as root qdisc
    - net/sched: qfq: Use cl_is_active to determine whether class is active in
      qfq_rm_from_ag
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN
      spec
    - wifi: mac80211: don't perform DA check on S1G beacon
    - serial: 8250_pci: Fix broken RS485 for F81504/508/512
    - w1: therm: Fix off-by-one buffer overflow in alarms_store
    - w1: fix redundant counter decrement in w1_attach_slave_device()
    - Revert "nfc/nci: Add the inconsistency check between the input data length
      and count"
    - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
    - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
    - scsi: storvsc: Process unsupported MODE_SENSE_10
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
    - [arm64] dts: rockchip: remove dangerous max-link-speed from helios64
    - [arm64] dts: rockchip: Fix voltage threshold for volume keys for Pinephone
      Pro
    - [amd64] x86/kfence: avoid writing L1TF-vulnerable PTEs
    - [amd64] comedi: Fix getting range information for subdevices 16 to 255
    - [amd64] platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute
      names
    - [amd64] platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID
      macro
    - mm/rmap: fix two comments related to huge_pmd_unshare()
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
    - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event
      detection
    - interconnect: debugfs: initialize src_node and dst_node to empty strings
    - regmap: Fix race condition in hwspinlock irqsave routine
    - [riscv64] clocksource: Fix stimecmp update hazard on RV32
    - [amd64] platform/x86/amd: Fix memory leak in wbrf_record()
    - scsi: core: Wake up the error handler when final completions race against
      each other
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow
    - ALSA: usb: Increase volume range that triggers a warning
    - ice: Fix persistent failure in ice_get_rxfh
    - [arm64] net: hns3: fix data race in hns3_fetch_stats
    - be2net: fix data race in be_get_new_eqd
    - [arm64] net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
    - [arm64] net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
    - mISDN: annotate data-race around dev->work
    - ipv6: annotate data-race in ndisc_router_discovery()
    - usbnet: limit max_mtu based on device's hard_mtu
    - clocksource: Reduce watchdog readout delay limit to prevent false
      positives
    - sched/fair: Fix pelt clock sync when entering idle
    - drm/amd/pm: Don't clear SI SMC table when setting power limit
    - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
    - drm/nouveau: add missing DCB connector types
    - drm/nouveau: implement missing DCB connector types; gracefully handle
      unknown connectors
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
    - bonding: provide a net pointer to __skb_flow_dissect()
    - [arm64,armhf] net: dsa: fix off-by-one in maximum bridge ID determination
    - [arm64] octeontx2-af: Fix error handling
    - net: openvswitch: fix data race in ovs_vport_get_upcall_stats
    - vsock/virtio: fix potential underflow in virtio_transport_get_credit()
    - vsock/virtio: cap TX credit to local buffer size
    - net/sched: act_ife: avoid possible NULL deref
    - dpll: Prevent duplicate registrations
    - [amd64] x86: make page fault handling disable interrupts properly
    - tpm: Compare HMAC values in constant time
    - keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal
    - leds: led-class: Only Add LED to leds_list when it is fully ready
    - of: fix reference count leak in of_alias_scan()
    - of: platform: Use default match table for /firmware
    - iio: accel: iis328dq: fix gain values
    - iio: adc: ad9467: fix ad9434 vref mask
    - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc
      driver
    - iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot
    - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling
      (Closes: #1121535)
    - ALSA: scarlett2: Fix buffer overflow in config retrieval
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
    - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
    - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
    - drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)
    - wifi: ath10k: fix dma_free_coherent() pointer
    - wifi: ath12k: fix dma_free_coherent() pointer
    - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
    - wifi: rsi: Fix memory corruption due to not set vif driver data size
    - [arm64] fpsimd: signal: Allocate SSVE storage when restoring ZA
    - [arm64] Set __nocfi on swsusp_arch_resume()
    - slimbus: core: fix runtime PM imbalance on report present
    - slimbus: core: fix device reference leak on report present
    - tracing: Fix crash on synthetic stacktrace field usage
    - [amd64] intel_th: fix device leak on output open()
    - mei: trace: treat reg parameter as string
    - [s390x] ap: Fix wrong APQN fill calculation
    - netrom: fix double-free in nr_route_frame()
    - [amd64] platform/x86: hp-bioscfg: Fix automatic module loading
    - [arm64] pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq
      vpu
    - [amd64] perf/x86/intel: Do not enable BTS for guests
    - [arm64,armhf] irqchip/gic-v3-its: Avoid truncating memory addresses
    - net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
    - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
    - drm/amdgpu: remove frame cntl for gfx v12
    - gpio: cdev: Correct return code on memory allocation failure
    - migrate: correct lock ordering for hugetlb file folios
    - [arm64] dmaengine: ti: k3-udma: Enable second resource range for BCDMA and
      PKTDMA
    - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
    - bpf: Do not let BPF test infra emit invalid GSO types to stack
      (CVE-2025-68725)
    - [arm64] dts: rockchip: remove redundant max-link-speed from nanopi-r4s
    - iio: core: add missing mutex_destroy in iio_dev_release()
    - iio: core: Replace lockdep_set_class() + mutex_init() by combined call
    - iio: core: add separate lockdep class for info_exist_lock
    - [armhf] iio: adc: exynos_adc: fix OF populate on driver rebind
    - exfat: fix refcount leak in exfat_find (CVE-2025-68351)
    - sched_ext: Fix possible deadlock in the deferred_irq_workfn()
      (CVE-2025-68333)
    - fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365)
    - [amd64] accel/ivpu: Fix race condition when unbinding BOs (CVE-2025-68749)
    - btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
      (CVE-2025-68358)
    - wifi: ath11k: fix RCU stall while reaping monitor destination ring
      (CVE-2024-58097)
    - vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put()
    - vsock/virtio: Rename virtio_vsock_alloc_skb()
    - vsock/virtio: Move SKB allocation lower-bound check to callers
    - vsock/virtio: Rename virtio_vsock_skb_rx_put()
    - vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers
    - vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers
    - net: Introduce skb_copy_datagram_from_iter_full()
    - vsock/virtio: Fix message iterator handling on transmit path
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.69
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
    - Bluetooth: MGMT: Fix memory leak in set_ssp_complete
    - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
    - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
    - bonding: annotate data-races around slave->last_rx
    - [arm64,armhf] net: mvpp2: cls: Fix memory leak in
      mvpp2_ethtool_cls_rule_ins()
    - ipv6: use the right ifindex when replying to icmpv6 from localhost
    - net: wwan: t7xx: fix potential skb->frags overflow in RX path
    - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues
    - ice: stop counting UDP csum mismatch as rx_errors
    - net/mlx5e: TC, delete flows only for existing peers
    - nfc: nci: Fix race between rfkill and nci_unregister_device().
    - net: bridge: fix static key check
    - net: phy: micrel: fix clk warning when removing the driver
    - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
    - net/mlx5: Initialize events outside devlink lock
    - net/mlx5: Fix vhca_id access call trace use before alloc
    - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
    - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
    - [amd64] ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
    - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
    - gpio: virtuser: fix UAF in configfs release path
    - bcache: fix improper use of bi_end_io
    - bcache: use bio cloning for detached device requests
    - bcache: fix I/O accounting leak in detached_dev_do_request
    - dma/pool: distinguish between missing and exhausted atomic pools
    - sched/deadline: Document dl_server
    - sched/deadline: Fix 'stuck' dl_server
    - [arm64,armhf] pinctrl: meson: mark the GPIO controller as sleeping
    - [riscv64] compat: fix COMPAT_UTS_MACHINE definition
    - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
    - [amd64] ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
    - [arm64,armhf] gpio: pca953x: mask interrupts in irq shutdown
    - scsi: qla2xxx: edif: Fix dma_free_coherent() size
    - efivarfs: fix error propagation in efivar_entry_get()
    - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
      (Closes: #1122521)
    - gpio: rockchip: Stop calling pinctrl for set_direction
    - mptcp: only reset subflow errors when propagated
    - flex_proportions: make fprop_new_period() hardirq safe
    - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
    - mm/memory-failure: teach kill_accessing_process to accept hugetlb tail
      page pfn
    - mm/shmem, swap: fix race of truncate and swap entry split
    - net: fix segmentation of forwarding fraglist GRO
    - [arm64] drm/msm/a6xx: fix bogus hwcg register updates
    - drm/amdgpu/soc21: fix xclk for APUs
    - drm/amdgpu/gfx10: fix wptr reset in KGQ init
    - drm/amdgpu/gfx11: fix wptr reset in KGQ init
    - drm/amdgpu/gfx12: fix wptr reset in KGQ init
    - drm/amdgpu: fix NULL pointer dereference in
      amdgpu_gmc_filter_faults_remove
    - drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule()
    - gpiolib: acpi: Fix potential out-of-boundary left shift
    - cgroup: Fix kernfs_node UAF in css_free_rwork_fn
    - rxrpc: Fix data-race warning and potential load/store tearing
    - ksmbd: smbd: fix dma_unmap_sg() nents (CVE-2026-23093)
    - mm/kfence: randomize the freelist on initialization
    - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
      (CVE-2024-58096)
    - Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)"
    - btrfs: prevent use-after-free on folio private data in
      btrfs_subpage_clear_uptodate()
    - net/sched: act_ife: convert comma to semicolon
    - [arm64] pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and
      SWR TX pins
    - mptcp: avoid dup SUB_CLOSED events after disconnect
    - perf: Simplify get_perf_callchain() user logic
    - perf: sched: Fix perf crash with new is_user_task() helper
    - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
    - drm/amdgpu/gfx11: adjust KGQ reset sequence
    - [arm64] pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
    - net: mana: Change the function signature of mana_get_primary_netdev_rcu
    - RDMA/mana_ib: Handle net event for pointing to the current netdev

  [ Macpaul Lin ]
  * udeb: Add USB TYPE-C and Mux modules in usb-modules (Closes: #1109090)

  [ Salvatore Bonaccorso ]
  * fs/nfsd: Enable NFSD_SCSILAYOUT (NFSv4.1 server support for pNFS SCSI
    layouts)
  * [rt] Update to 6.12.66-rt15

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 08 Feb 2026 08:58:22 +0100

linux (6.12.63-1) trixie; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.58
    - NFSD: Fix crash in nfsd4_read_release()
    - net: usb: asix_devices: Check return value of usbnet_get_endpoints
    - fbcon: Set fb_display[i]->mode to NULL when the mode is released
    - fbdev: atyfb: Check if pll_ops->init_pll failed
    - ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
    - ACPI: button: Call input_free_device() on failing input device
      registration
    - virtio-net: drop the multi-buffer XDP packet in zerocopy
    - fbdev: bitblit: bound-check glyph index in bit_putcs*
    - Bluetooth: rfcomm: fix modem control handling
    - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP
      Mode
    - mptcp: drop bogus optimization in __mptcp_check_push()
    - mptcp: restore window probe
    - [arm64] ASoC: qdsp6: q6asm: do not sleep while atomic
    - [s390x] pci: Restore IRQ unconditionally for the zPCI device
    - smb: client: fix potential cfid UAF in smb2_query_info_compound
    - [amd64] x86/fpu: Ensure XFD state on signal delivery
    - wifi: ath10k: Fix memory leak on unsupported WMI command
    - wifi: ath11k: Add missing platform IDs for quirk table
    - wifi: ath12k: free skb during idr cleanup callback
    - wifi: ath11k: add support for MU EDCA
    - wifi: ath11k: avoid bit operation on key flags
    - [arm64] drm/msm/a6xx: Fix GMU firmware parser
    - ALSA: usb-audio: fix control pipe direction
    - wifi: mac80211: don't mark keys for inactive links as uploaded
    - wifi: mac80211: fix key tailroom accounting leak
    - bpf: Sync pending IRQ work before freeing ring buffer
    - scsi: ufs: core: Initialize value of an attribute returned by uic cmd
    - bpf: Find eligible subprogs for private stack support
    - bpf, x86: Avoid repeated usage of bpf_prog->aux->stack_depth
    - bpf: Do not audit capability check in do_jit()
    - [amd64] ASoC: Intel: avs: Unprepare a stream when XRUN occurs
    - [amd64] ASoC: Intel: avs: Disable periods-elapsed work when closing PCM
    - [arm64,armhf] ASoC: fsl_sai: fix bit order for DSD format
    - libbpf: Fix powerpc's stack register definition in bpf_tracing.h
    - usbnet: Prevents free active kevent
    - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
    - Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave
    - Bluetooth: ISO: Fix BIS connection dst_type handling
    - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
    - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
    - Bluetooth: ISO: Fix another instance of dst_type handling
    - Bluetooth: hci_core: Fix tracking of periodic advertisement
    - [arm64,armhf] drm/etnaviv: fix flush sequence logic
    - [arm64] net: hns3: return error code when function fails
    - sfc: fix potential memory leak in efx_mae_process_mport()
    - dpll: spec: add missing module-name and clock-id to pin-get reply
    - [arm64,armhf] ASoC: fsl_sai: Fix sync error in consumer mode
    - drm/radeon: Do not kfree() devres managed rdev
    - drm/radeon: Remove calls to drm_put_dev()
    - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
    - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
    - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
    - ACPI: fan: Use ACPI handle when retrieving _FST
    - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
    - block: make REQ_OP_ZONE_OPEN a write operation
    - regmap: slimbus: fix bus_context pointer in regmap init calls
    - [s390x] mm: Fix memory leak in add_marker() when kvrealloc() fails
    - drm/xe: Do not wake device during a GT reset
    - drm/sysfb: Do not dereference NULL pointer in plane reset
    - drm/sched: avoid killing parent entity on child SIGKILL
    - drm/nouveau: Fix race in nouveau_sched_fini()
    - [arm64] drm/mediatek: Fix device use-after-free on unbind
    - drm/amd: Check that VPE has reached DPM0 in idle handler
    - drm/amd/display: Fix incorrect return of vblank enable on unconfigured
      crtc (Closes: #1000966)
    - ACPI: fan: Add fan speed reporting for fans with only _FST
    - ACPI: fan: Use platform device for devres-related actions
    - sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU
    - cpuidle: governors: menu: Rearrange main loop in menu_select()
    - cpuidle: governors: menu: Select polling state in some more cases
    - [amd64] mfd: kempld: Switch back to earlier ->init() behavior
    - [amd64] x86/CPU/AMD: Add RDSEED fix for Zen5
    - usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
    - drm/sched: Optimise drm_sched_entity_push_job
    - drm/sched: Re-group and rename the entity run-queue lock
    - drm/sched: Fix race in drm_sched_entity_select_rq()
    - [s390x] pci: Avoid deadlock between PCI error recovery and mlx5 crdump
    - [s390x] Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
    - [armhf] soc: aspeed: socinfo: Add AST27xx silicon IDs
    - [arm64] firmware: qcom: scm: preserve assign_mem() error return value
    - [arm64] soc: qcom: smem: Fix endian-unaware access of num_entries
    - [arm64] soc: ti: pruss: don't use %pK through printk
    - bpf: Don't use %pK through printk
    - pinctrl: single: fix bias pull up/down handling in pin_config_set
    - [arm64] mmc: host: renesas_sdhi: Fix the actual clock
    - memstick: Add timeout to prevent indefinite waiting
    - [arm64,armhf] cpufreq: ti: Add support for AM62D2
    - bpf: Use tnums for JEQ/JNE is_branch_taken logic
    - firewire: ohci: move self_id_complete tracepoint after validating register
    - [riscv64] irqchip/sifive-plic: Respect mask state when setting affinity
    - io_uring/zctx: check chained notif contexts
    - ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object
    - ACPI: video: force native for Lenovo 82K8
    - libbpf: Fix USDT SIB argument handling causing unrecognized register error
    - cpufreq/longhaul: handle NULL policy in longhaul_exit
    - [arm64,armhf] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
    - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
    - ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU
    - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
    - thermal: gov_step_wise: Allow cooling level to be reduced earlier
    - power: supply: qcom_battmgr: add OOI chemistry
    - [amd64] hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based
      models
    - [amd64] hwmon: (k10temp) Add device ID for Strix Halo
    - power: supply: sbs-charger: Support multiple devices
    - cpufreq: ondemand: Update the efficient idle check for Intel extended
      Families
    - [arm64,armhf] soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
    - [arm64] firmware: qcom: tzmem: disable sc7180 platform
    - [arm64] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
    - pwm: pca9685: Use bulk write to atomicially update registers
    - ACPICA: dispatcher: Use acpi_ds_clear_operands() in
      acpi_ds_call_control_method()
    - [amd64,arm64] tee: allow a driver to allocate a tee_device without a pool
    - nvmet-fc: avoid scheduling association deletion twice
    - nvme-fc: use lock accessing port_state and rport state
    - bpf: Do not limit bpf_cgroup_from_id to current's namespace
    - i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C
    - video: backlight: lp855x_bl: Set correct EPROM start for LP8556
    - tools/cpupower: fix error return value in cpupower_write_sysfs()
    - power: supply: qcom_battmgr: handle charging state change notifications
    - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
    - cpuidle: Fail cpuidle device registration if there is one already
    - futex: Don't leak robust_list pointer on exec race
    - ACPI: SPCR: Support Precise Baud Rate field
    - blk-cgroup: fix possible deadlock while configuring policy
    - [riscv64] bpf: Fix uninitialized symbol 'retval_off'
    - bpf: Clear pfmemalloc flag when freeing all fragments
    - nvme: Use non zero KATO for persistent discovery connections
    - uprobe: Do not emulate/sstep original instruction when ip is changed
    - [amd64] hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
    - [amd64] hwmon: (dell-smm) Remove Dell Precision 490 custom config data
    - tools/cpupower: Fix incorrect size in cpuidle_state_disable()
    - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
    - tools/power x86_energy_perf_policy: Enhance HWP enable
    - tools/power x86_energy_perf_policy: Prefer driver HWP limits
    - [armhf] mfd: stmpe: Remove IRQ domain upon removal
    - [armhf] mfd: stmpe-i2c: Add missing MODULE_LICENSE
    - [riscv64] mfd: da9063: Split chip variant reading in two bus transactions
    - mfd: core: Increment of_node's refcount before linking it to the platform
      device
    - [amd64] mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs
    - drm/amd/display: fix condition for setting timing_adjust_pending
    - drm/amd/display: ensure committing streams is seamless
    - drm/amdgpu: add range check for RAS bad page address
    - drm/amdgpu: Check vcn sram load return value
    - drm/amd/display: Move setup_stream_attribute
    - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
    - drm/xe/guc: Add more GuC load error status codes
    - drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.
    - drm/amdgpu: Avoid rma causes GPU duplicate reset
    - drm/amd/amdgpu: Release xcp drm memory after unplug
    - drm/amdgpu: Skip poison aca bank from UE channel
    - drm/amd/display: add more cyan skillfish devices
    - drm/amd/display: update dpp/disp clock from smu clock table
    - drm/amd/pm: Use cached metrics data on aldebaran
    - drm/amd/pm: Use cached metrics data on arcturus
    - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
    - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
    - [arm64] ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks
    - drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off
    - drm/amd/display: Wait until OTG enable state is cleared
    - PCI: Disable MSI on RDC PCI to PCIe bridges
    - wifi: rtw89: print just once for unknown C2H events
    - wifi: rtw88: sdio: use indirect IO for device registers before power-on
    - drm/amdkfd: return -ENOTTY for unsupported IOCTLs
    - media: pci: ivtv: Don't create fake v4l2_fh
    - [arm64] drm/tidss: Use the crtc_* timings when programming the HW
    - [arm64] drm/tidss: Set crtc modesetting parameters with adjusted mode
    - PCI/ERR: Update device error_state already after reset
    - [amd64] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
    - net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
    - ice: Don't use %pK through printk or tracepoints
    - thunderbolt: Use is_pciehp instead of is_hotplug_bridge
    - tty: serial: ip22zilog: Use platform device for probing
    - [powerpc*] eeh: Use result of error_detected() in uevent
    - [s390x] pci: Use pci_uevent_ers() in PCI recovery
    - bridge: Redirect to backup port when port is administratively down
    - net: ipv6: fix field-spanning memcpy warning in AH output
    - media: imon: make send_packet() more robust
    - [arm64] drm/panthor: Serialize GPU cache flush operations
    - HID: pidff: Use direction fix only for conditional effects
    - HID: pidff: PERMISSIVE_CONTROL quirk autodetection
    - [arm64,armhf] drm/bridge: display-connector: don't set OP_DETECT for
      DisplayPorts
    - drm/amdgpu: fix nullptr err of vm_handle_moved
    - drm/amdkfd: Handle lack of READ permissions in SVM mapping
    - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before
      setting register
    - iio: adc: imx93_adc: load calibrated values even calibration failed
    - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
    - wifi: rtw89: wow: remove notify during WoWLAN net-detect
    - wifi: rtw89: fix BSSID comparison for non-transmitted BSSID
    - dm error: mark as DM_TARGET_PASSES_INTEGRITY
    - char: misc: Make misc_register() reentry for miscdevice who wants dynamic
      minor
    - char: misc: Does not request module for miscdevice with dynamic minor
    - net: When removing nexthops, don't call synchronize_net if it is not
      necessary
    - net: stmmac: Correctly handle Rx checksum offload errors
    - net: Call trace_sock_exceed_buf_limit() for memcg failure with
      SK_MEM_RECV.
    - f2fs: fix to detect potential corrupted nid in free_nid_list
    - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
    - bnxt_en: Add Hyper-V VF ID
    - tty: serial: Modify the use of dev_err_probe()
    - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
    - [amd64,arm64] idpf: do not linearize big TSO packets
    - rds: Fix endianness annotation for RDS_MPATH_HASH
    - media: ipu6: isys: Set embedded data type correctly for metadata formats
    - rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table
    - net: ipv4: allow directed broadcast routes to use dst hint
    - scsi: mpi3mr: Fix I/O failures during controller reset
    - scsi: mpi3mr: Fix controller init failure on fault during queue creation
    - scsi: pm80xx: Fix race condition caused by static variables
    - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
    - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
    - fuse: zero initialize inode private data
    - drm/amdgpu: Correct the counts of nr_banks and nr_errors
    - drm/amdkfd: fix vram allocation failure for a special case
    - drm/amd/display: Support HW cursor 180 rot for any number of pipe splits
    - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
    - [amd64] platform/x86/intel-uncore-freq: Fix warning in partitioned system
    - media: fix uninitialized symbol warnings
    - media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS
    - [amd64] ASoC: SOF: ipc4-pcm: Add fixup for channels
    - drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting
    - drm/amd/display: incorrect conditions for failing dto calculations
    - drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest
    - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
    - inet_diag: annotate data-races in inet_diag_bc_sk()
    - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
    - [amd64] crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
    - scsi: pm8001: Use int instead of u32 to store error codes
    - [arm64] scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset
      on suspend
    - ptp: Limit time setting of PTP clocks
    - dmaengine: sh: setup_xref error handling
    - [arm64,armhf] dmaengine: mv_xor: match alloc_wc and free_wc
    - [arm64] drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
    - [arm64] drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
    - drm/amdgpu: Allow kfd CRIU with no buffer objects
    - drm/xe/guc: Increase GuC crash dump buffer size
    - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
    - [arm64] drm/panthor: check bo offset alignment in vm bind
    - drm: panel-backlight-quirks: Make EDID match optional
    - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
    - media: adv7180: Add missing lock in suspend callback
    - media: adv7180: Do not write format to device in set_fmt
    - media: adv7180: Only validate format in querystd
    - [arm64,armhf] media: verisilicon: Explicitly disable selection api ioctls
      for decoders
    - wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower
      bands
    - ALSA: usb-audio: apply quirk for MOONDROP Quark2
    - [arm64,armhf] PCI: imx6: Enable the Vaux supply if available
    - drm/xe/guc: Set upper limit of H2G retries over CTB
    - net: call cond_resched() less often in __release_sock()
    - smsc911x: add second read of EEPROM mac when possible corruption seen
    - [amd64] iommu/amd: Skip enabling command/event buffers for kdump
    - [amd64] crypto: ccp: Skip SEV and SNP INIT for kdump boot
    - drm/amd: add more cyan skillfish PCI ids
    - drm/amdgpu: don't enable SMU on cyan skillfish
    - drm/amdgpu: add support for cyan skillfish gpu_info
    - drm/amd/display: Fix pbn_div Calculation Error
    - [arm64] net: dsa: felix: support phy-mode = "10g-qxgmii"
    - usb: gadget: f_hid: Fix zero length packet transfer
    - usb: cdns3: gadget: Use-after-free during failed initialization and exit
      of cdnsp gadget
    - tty/vt: Add missing return value for VT_RESIZE in vt_ioctl()
    - [arm64] drm/msm: make sure to not queue up recovery more than once
    - char: Use list_del_init() in misc_deregister() to reinitialize list
      pointer
    - PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs
    - wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list
    - [amd64] media: ov08x40: Fix the horizontal flip control
    - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
    - f2fs: fix wrong layout information on 16KB page
    - net: phy: marvell: Fix 88e1510 downshift counter errata
    - ntfs3: pretend $Extend records as regular files
    - wifi: mac80211: Fix HE capabilities element check
    - [arm64] phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf
      register 0
    - [arm64] drm/msm/registers: Generate _HI/LO builders for reg64
    - net: sh_eth: Disable WoL if system can not suspend
    - netfilter: nf_reject: don't reply to icmp error messages
    - [amd64] x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective
      of PV_UNHALT
    - net: devmem: expose tcp_recvmsg_locked errors
    - udp_tunnel: use netdev_warn() instead of netdev_WARN()
    - HID: asus: add Z13 folio to generic group for multitouch to work
    - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
    - [arm64] crypto: sun8i-ce - remove channel timeout field
    - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
    - [amd64] crypto: ccp - Fix incorrect payload size calculation in
      psp_poulate_hsti()
    - [arm64,armhf] crypto: caam - double the entropy delay interval for retry
    - net/cls_cgroup: Fix task_get_classid() during qdisc run
    - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
    - wifi: mt76: mt7996: Temporarily disable EPCS
    - wifi: mt76: mt76_eeprom_override to int
    - ALSA: serial-generic: remove shared static buffer
    - wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error
    - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
    - drm/amd/display: Set up pixel encoding for YCBCR422
    - drm/amd/display: fix dml ms order of operations
    - drm/amd: Avoid evicting resources at S5
    - drm/amd/display: Fix DVI-D/HDMI adapters
    - drm/amd/display: Disable VRR on DCE 6
    - drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with
      DC_FP_START
    - page_pool: always add GFP_NOWARN for ATOMIC allocations
    - ethernet: Extend device_get_mac_address() to use NVMEM
    - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
    - drm/xe/guc: Return an error code if the GuC load fails
    - drm/amdgpu: reject gang submissions under SRIOV
    - scsi: ufs: core: Disable timestamp functionality if not supported
    - scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail
    - scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted
    - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during
      TGT_RESET
    - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in
      lpfc_cleanup
    - scsi: lpfc: Define size of debugfs entry for xri rebalancing
    - scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point
      topology
    - allow finish_no_open(file, ERR_PTR(-E...))
    - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
    - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
    - f2fs: fix infinite loop in __insert_extent_tree()
    - wifi: rtw89: obtain RX path from ppdu status IE00
    - wifi: rtw89: renew a completion for each H2C command waiting C2H event
    - usb: xhci-pci: add support for hosts with zero USB3 ports
    - ipv6: np->rxpmtu race annotation
    - RDMA/irdma: Update Kconfig
    - IB/ipoib: Ignore L3 master device
    - jfs: Verify inode mode when loading from disk
    - jfs: fix uninitialized waitqueue in transaction manager
    - drm/amdgpu/atom: Check kcalloc() for WS buffer in
      amdgpu_atom_execute_table_locked()
    - [arm64] ASoC: qcom: sc8280xp: explicitly set S16LE format in
      sc8280xp_be_hw_params_fixup()
    - net: phy: clear link parameters on admin link down
    - bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state
    - [amd64] iommu/vt-d: Replace snprintf with scnprintf in
      dmar_latency_snapshot()
    - wifi: ath10k: Fix connection after GTK rekeying
    - wifi: mac80211: Track NAN interface start/stop
    - net: intel: fm10k: Fix parameter idx set but not used
    - r8169: set EEE speed down ratio to 1
    - vfio: return -ENOTTY for unsupported device feature
    - PCI/PM: Skip resuming to D0 if device is disconnected
    - remoteproc: qcom: q6v5: Avoid handling handover twice
    - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
    - [armhf] net: dsa: microchip: Set SPI as bus interface during reset for
      KSZ8463
    - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream
    - drm/amd/display: Init dispclk from bootup clock for DCN314
    - drm/amd/display: Fix for test crash due to power gating
    - drm/amd/display: change dc stream color settings only in atomic commit
    - NFSv4: handle ERR_GRACE on delegation recalls
    - NFSv4.1: fix mount hang after CREATE_SESSION failure
    - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
      dereferencing
    - net: bridge: Install FDB for bridge MAC on VLAN 0
    - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
    - [amd64] accel/habanalabs/gaudi2: fix BMON disable configuration
    - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
    - [amd64] accel/habanalabs: return ENOMEM if less than requested pages were
      pinned
    - [amd64] accel/habanalabs/gaudi2: read preboot status after recovering from
      dirty state
    - [amd64] accel/habanalabs: support mapping cb with vmalloc-backed coherent
      memory
    - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
    - ext4: increase IO priority of fastcommit
    - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
    - [armhf] ASoC: stm32: sai: manage context in set_sysclk callback
    - [armhf] ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
    - ACPI: scan: Update honor list for RPMI System MSI
    - vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices
    - net/mlx5e: Don't query FEC statistics when FEC is disabled
    - net: macb: avoid dealing with endianness in macb_set_hwaddr()
    - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
    - Bluetooth: SCO: Fix UAF on sco_conn_free
    - Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922
    - Bluetooth: bcsp: receive data only if registered
    - ALSA: usb-audio: add mono main switch to Presonus S1824c
    - net: stmmac: est: Drop frames causing HLBS error
    - exfat: limit log print for IO error
    - exfat: validate cluster allocation bits of the allocation bitmap
    - 6pack: drop redundant locking and refcounting
    - page_pool: Clamp pool size to max 16K pages
    - orangefs: fix xattr related buffer overflow...
    - ftrace: Fix softlockup in ftrace_module_enable
    - ksmbd: use sock_create_kern interface to create kernel socket
    - smb: client: transport: avoid reconnects triggered by pending task work
    - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
    - usb: xhci-pci: Fix USB2-only root hub registration
    - char: misc: restrict the dynamic range to exclude reserved minors
    - drm/amd/display: Add fallback path for YCBCR422
    - ACPICA: Update dsmethod.c to get rid of unused variable warning
    - RDMA/irdma: Fix SD index calculation
    - RDMA/irdma: Remove unused struct irdma_cq fields
    - RDMA/irdma: Set irdma_cq cq_num field during CQ create
    - [arm64] RDMA/hns: Fix recv CQ and QP cache affinity
    - [arm64] RDMA/hns: Fix the modification of max_send_sge
    - [arm64] RDMA/hns: Fix wrong WQE data when QP wraps around
    - btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation
    - btrfs: mark dirty extent range for out of bound prealloc extents
    - fs/hpfs: Fix error code for new_inode() failure in
      mkdir/create/mknod/symlink
    - clk: sunxi-ng: sun6i-rtc: Add A523 specifics
    - [arm64] rtc: pcf2127: clear minute/second interrupt
    - 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
    - [armhf] clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
    - [arm64] clk: scmi: Add duty cycle ops only when duty cycle is supported
    - 9p: fix /sys/fs/9p/caches overwriting itself
    - 9p: sysfs_init: don't hardcode error to ENOMEM
    - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
    - ACPI: property: Return present device nodes only on fwnode interface
    - tools bitmap: Add missing asm-generic/bitsperlong.h include
    - tools: lib: thermal: don't preserve owner in install
    - tools: lib: thermal: use pkg-config to locate libnl3
    - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
    - [arm64] rtc: pcf2127: fix watchdog interrupt mask on pcf2131
    - net: wwan: t7xx: add support for HP DRMR-H01
    - kbuild: uapi: Strip comments before size type check
    - [arm64,armhf] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
    - drm/amdkfd: Fix mmap write lock not release
    - ceph: add checking of wait_for_completion_killable() return value
    - ceph: fix potential race condition in ceph_ioctl_lazyio()
    - ceph: refactor wake_up_bit() pattern of calling
    - ceph: fix multifs mds auth caps issue
    - [amd64] x86: use cmov for user address masking
    - [amd64] x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro
    - [amd64] x86: uaccess: don't use runtime-const rewriting in modules
    - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
    - btrfs: ensure no dirty metadata is written back for an fs with errors
    - media: uvcvideo: Use heuristic to find stream entity
    - media: videobuf2: forbid remove_bufs when legacy fileio is active
    - [arm64] drm/mediatek: Disable AFBC support on Mediatek DRM driver
    - Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
      (Closes: #1120680)
    - ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader
      catches up
    - [riscv64] ptdump: use seq_puts() in pt_dump_seq_puts() macro
    - Bluetooth: hci_event: validate skb length for unknown CC opcode
    - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
    - [armhf] net: dsa: tag_brcm: legacy: reorganize functions
    - [armhf] net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for
      bcm63xx
    - net: vlan: sync VLAN features with lower device
    - gpio: swnode: don't use the swnode's name as the key for GPIO lookup
    - gpiolib: fix invalid pointer access in debugfs
    - [armhf] net: dsa: b53: fix resetting speed and pause on forced link
    - [armhf] net: dsa: b53: fix bcm63xx RGMII port link adjustment
    - [armhf] net: dsa: b53: fix enabling ip multicast
    - [armhf] net: dsa: b53: stop reading ARL entries if search is done
    - sctp: Hold RCU read lock while iterating over address list
    - sctp: Prevent TOCTOU out-of-bounds write
    - sctp: Hold sock lock while iterating over address list
    - net: ionic: add dma_wmb() before ringing TX doorbell
    - net: ionic: map SKB after pseudo-header checksum prep
    - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
    - bnxt_en: Fix a possible memory leak in bnxt_ptp_init
    - bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type
    - bnxt_en: Refactor bnxt_free_ctx_mem()
    - bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem()
    - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup
    - net/mlx5e: Fix return value in case of module EEPROM read error
    - [arm64] net: ti: icssg-prueth: Fix fdb hash size configuration
    - net/mlx5e: SHAMPO, Fix skb size check for 64K pages
    - [armhf] net: dsa: microchip: Fix reserved multicast address table
      programming
    - net: bridge: fix use-after-free due to MST port state bypass
    - net: bridge: fix MST static key usage
    - tracing: Fix memory leaks in create_field_var()
    - drm/amd/display: Enable mst when it's detected but yet to be initialized
    - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
    - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
    - [arm64] rtc: rx8025: fix incorrect register reference
    - [amd64] x86/microcode/AMD: Add more known models to entry sign checking
    - smb: client: validate change notify buffer before copy
    - smb: client: fix potential UAF in smb2_close_cached_fid()
    - drm/amdgpu/smu: Handle S0ix for vangogh
    - drm/amd/display: Fix NULL deref in debugfs odm_combine_segments
    - virtio-net: fix received length check in big packets
    - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
    - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
    - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel
      ADL
    - scsi: ufs: core: Add a quirk to suppress link_startup_again
    - drm/amd/display: update color on atomic commit time
    - ACPI: SPCR: Check for table version when using precise baudrate
    - drm/amdgpu: Fix unintended error log in VCN5_0_0
    - drm/amdgpu: Fix function header names in amdgpu_connectors.c
    - drm/amd/display: Fix black screen with HDMI outputs
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.59
    - [arm64] drm/mediatek: Add pm_runtime support for GCE power control
    - [amd64] drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
    - [amd64] drm/i915: Fix conversion between clock ticks and nanoseconds
    - smb: client: fix refcount leak in smb2_set_path_attr
    - drm/amd: Fix suspend failure with secure display TA
    - drm/xe/guc: Synchronize Dead CT worker with unbind
    - drm/xe: Move declarations under conditional branch
    - drm/xe: Do clean shutdown also when using flr
    - [arm64] kprobes: check the return value of set_memory_rox()
    - [riscv64] clear hot-unplugged cores from all task mm_cpumasks to avoid
      rfence errors
    - [riscv64] acpi: avoid errors caused by probing DT devices when ACPI is
      used
    - drm/amdgpu: remove two invalid BUG_ON()s
    - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
    - drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
    - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
    - NFS4: Fix state renewals missing after boot
    - NFS4: Apply delay_retrans to async operations
    - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
    - HID: nintendo: Wait longer for initial probe
    - NFS: check if suid/sgid was cleared after a write as needed
    - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
    - exfat: fix improper check of dentry.stream.valid_size
    - smb/server: fix possible memory leak in smb2_read()
    - smb/server: fix possible refcount leak in smb2_sess_setup()
    - HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL
    - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
    - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
    - erofs: avoid infinite loop due to incomplete zstd-compressed data
    - [arm64,armhf] net: fec: correct rx_bytes statistic for the case SHIFT16 is
      set
    - net: phy: micrel: Introduce lanphy_modify_page_reg
    - net: phy: micrel: Replace hardcoded pages with defines
    - net: phy: micrel: lan8814 fix reset of the QSGMII interface
    - NFSD: Skip close replay processing if XDR encoding fails
    - Bluetooth: MGMT: cancel mesh send timer when hdev removed
    - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
    - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
    - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
    - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
    - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
    - net/smc: fix mismatch between CLC header and proposal
    - net/handshake: Fix memory leak in tls_handshake_accept()
    - tipc: Fix use-after-free in tipc_mon_reinit_self().
    - net: mdio: fix resource leak in mdiobus_register_device()
    - wifi: mac80211: skip rate verification for not captured PSDUs
    - af_unix: Initialise scc_index in unix_add_edge().
    - net_sched: act_connmark: use RCU in tcf_connmark_dump()
    - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
    - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
    - net/mlx5e: Fix maxrate wraparound in threshold between units
    - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
    - net/mlx5e: Fix potentially misleading debug message
    - net_sched: limit try_bulk_dequeue_skb() batches
    - virtio-net: fix incorrect flags recording in big mode
    - hsr: Fix supervision frame sending on HSRv0
    - [amd64] ACPI: CPPC: Detect preferred core availability on online CPUs
    - [amd64] ACPI: CPPC: Check _CPC validity for only the online CPUs
    - [amd64] ACPI: CPPC: Perform fast check switch only for online CPUs
    - [amd64] ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
    - Bluetooth: L2CAP: export l2cap_chan_hold for modules
    - acpi,srat: Fix incorrect device handle check for Generic Initiator
    - regulator: fixed: fix GPIO descriptor leak on register failure
    - [arm64] ASoC: codecs: va-macro: fix resource leak in probe error path
    - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
    - ASoC: tas2781: fix getting the wrong device number
    - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
    - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
    - simplify nfs_atomic_open_v23()
    - NFSv2/v3: Fix error handling in nfs_atomic_open_v23()
    - NFS: sysfs: fix leak when nfs_client kobject add fails
    - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
    - NFS: Fix LTP test failures when timestamps are delegated
    - ALSA: usb-audio: Fix NULL pointer dereference in
      snd_usb_mixer_controls_badd
    - acpi/hmat: Fix lockdep warning for hmem_register_resource()
    - bpf: Add bpf_prog_run_data_pointers()
    - bpf: account for current allocated stack depth in
      widen_imprecise_scalars()
    - [riscv64] irqchip/riscv-intc: Add missing free() callback in
      riscv_intc_domain_ops
    - wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in
      error path
    - proc: fix the issue of proc_mem_open returning NULL
    - ext4: introduce ITAIL helper
    - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
      (CVE-2025-22121)
    - Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
    - f2fs: fix to avoid overflow while left shift operation (CVE-2025-40077)
    - hostfs: Fix only passing host root in boot stage with new mount
    - virtio-fs: fix incorrect check for fsvq->kobj
    - fs/namespace: correctly handle errors returned by grab_requested_mnt_ns
    - sched_ext: Fix unsafe locking in the scx_dump_state()
    - Revert "netfilter: nf_tables: Reintroduce shortened deletion
      notifications"
    - netfilter: nf_tables: reject duplicate device on updates (CVE-2025-38678)
    - [arm64] dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
    - [arm64] dts: rockchip: Make RK3588 GPU OPP table naming less generic
    - [armhf] dts: imx51-zii-rdu1: Fix audmux node names
    - HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
    - HID: playstation: Fix memory leak in dualshock4_get_calibration_data()
    - HID: uclogic: Fix potential memory leak in error path
    - [amd64] KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
    - nfsd: fix refcount leak in nfsd_set_fh_dentry() (CVE-2025-40212)
    - nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes
    - NFSD: free copynotify stateid in nfs4_free_ol_stateid()
    - ksmbd: close accepted socket when per-IP limit rejects connection
    - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
    - strparser: Fix signed/unsigned mismatch bug
    - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
    - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
    - nilfs2: avoid having an active sc_timer before freeing sci
    - wifi: mac80211: reject address change while connecting
    - fs/proc: fix uaf in proc_readdir_de()
    - mm/mm_init: fix hash table order logging in alloc_large_system_hash()
    - mm/shmem: fix THP allocation and fallback loop
    - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
    - mmc: dw_mmc-rockchip: Fix wrong internal phase calculate
    - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
    - cifs: client: fix memory leak in smb3_fs_context_parse_param
    - codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for
      slabobj_ext
    - crash: fix crashkernel resource shrink
    - smb: client: fix cifs_pick_channel when channel needs reconnect
    - spi: Try to get ACPI GPIO IRQ earlier
    - [amd64] x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
    - ftrace: Fix BPF fexit with livepatch
    - PM: hibernate: Emit an error when image writing fails
    - PM: hibernate: Use atomic64_t for compressed_size variable
    - btrfs: zoned: fix conventional zone capacity calculation
    - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
    - btrfs: do not update last_log_commit when logging inode due to a new name
    - btrfs: release root after error in data_reloc_print_warning_inode()
    - drm/amdkfd: relax checks for over allocation of save area
    - drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces
    - [arm64] pmdomain: arm: scmi: Fix genpd leak on provider registration
      failure
    - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_remove
    - [arm64,armhf] pmdomain: samsung: plug potential memleak during probe
    - mptcp: fix MSG_PEEK stream corruption
    - wifi: cfg80211: add an hrtimer based delayed work item
    - wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work
    - mm, percpu: do not consider sleepable allocations atomic
    - [amd64] KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn()
    - [amd64] KVM: guest_memfd: Remove RCU-protected attribute from
      slot->gmem.file
    - [amd64] KVM: guest_memfd: Remove bindings on memslot deletion when gmem is
      dying
    - net: netpoll: Individualize the skb pool
    - net: netpoll: flush skb pool during cleanup
    - net: netpoll: fix incorrect refcount handling causing incorrect cleanup
    - [amd64] KVM: VMX: Split out guts of EPT violation to common/exposed
      function
    - [amd64] KVM: VMX: Fix check for valid GVA on an EPT violation
    - ALSA: hda: Fix missing pointer check in hda_component_manager_init
      function (CVE-2025-40097)
    - io_uring/napi: fix io_napi_entry RCU accesses
    - uio_hv_generic: Set event for all channels on the device
      (Closes: #1120602)
    - mm/memory: do not populate page table entries beyond i_size
    - mm/truncate: unmap large folio on split failure
    - mm/secretmem: fix use-after-free race in fault handler
    - mm/huge_memory: do not change split_huge_page*() target order silently
    - mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
    - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
    - net: phy: micrel: Fix lan8814_config_init
    - net: netpoll: ensure skb_pool list is always initialized
    - proc: proc_maps_open allow proc_mem_open to return NULL
    - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
      (CVE-2025-40213)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.60
    - [arm64] KVM: arm64: Check the untrusted offset in FF-A memory share
    - timers: Fix NULL function pointer race in timer_shutdown_sync()
    - HID: amd_sfh: Stop sensor before starting
    - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
      (Closes: #1114557)
    - [arm64] dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5
    - mtdchar: fix integer overflow in read/write ioctls
    - isofs: check the return value of sb_min_blocksize() in isofs_fill_super
    - shmem: fix tmpfs reconfiguration (remount) when noswap is set
    - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
    - mptcp: Disallow MPTCP subflows from sockmap
    - mptcp: Fix proto fallback detection with BPF
    - ata: libata-scsi: Fix system suspend for a security locked drive
    - smb: client: introduce close_cached_dir_locked()
    - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
    - be2net: pass wrb_params in case of OS2BMC
    - [armhf] net: dsa: microchip: lan937x: Fix RGMII delay tuning
    - [arm64,armhf] Revert "drm/tegra: dsi: Clear enable register if powered by
      bootloader"
    - Input: cros_ec_keyb - fix an invalid memory access
    - Input: goodix - add support for ACPI ID GDIX1003
    - Input: pegasus-notetaker - fix potential out-of-bounds access
    - mm/mempool: fix poisoning order>0 pages with HIGHMEM
    - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
    - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
    - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
    - scsi: sg: Do not sleep in atomic context
    - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
    - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
    - mptcp: fix race condition in mptcp_schedule_work()
    - mptcp: fix ack generation for fallback msk
    - mptcp: fix duplicate reset on fastclose
    - mptcp: fix premature close in case of fallback
    - mptcp: avoid unneeded subflow-level drops
    - mptcp: decouple mptcp fastclose from tcp close
    - mptcp: do not fallback when OoO is present
    - [arm64,armhf] drm/tegra: dc: Fix reference leak in tegra_dc_couple()
    - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
    - drm/amd: Skip power ungate during suspend for VPE
    - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
    - drm/amd/display: Increase DPCD read retries
    - drm/amd/display: Move sleep into each retry for retrieve_link_cap()
    - drm/amd/display: Fix pbn to kbps Conversion
    - drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5
    - xfrm: drop SA reference in xfrm_state_update if dir doesn't match
    - xfrm: set err and extack on failure to create pcpu SA
    - xfrm: Determine inner GSO type from packet inner protocol
    - xfrm: Prevent locally generated packets from direct output in tunnel mode
    - [amd64] pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()
    - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
    - [arm64,armhf] drm/tegra: Add call to put_pid()
    - net: mlxsw: linecards: fix missing error check in
      mlxsw_linecard_devlink_info_get()
    - net: openvswitch: remove never-working support for setting nsh fields
    - nvme-multipath: fix lockdep WARN due to partition scan work
    - [s390x] ctcm: Fix double-kfree
    - [amd64] platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes
      to errnos
    - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and
      qede_tpa_end()
    - [amd64,arm64] idpf: fix possible vport_config NULL pointer deref in remove
    - ice: fix PTP cleanup on driver removal in error path
    - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
    - net/mlx5: Clean up only new IRQ glue on request_irq() failure
    - af_unix: Cache state->msg in unix_stream_read_generic().
    - af_unix: Read sk_peek_offset() again after sleeping in
      unix_stream_read_generic().
    - cifs: fix memory leak in smb3_fs_context_parse_param error path
    - vsock: Ignore signal/timeout on connect() if already established
    - bcma: don't register devices disabled in OF
    - cifs: fix typo in enable_gcm_256 module parameter
    - scsi: core: Fix a regression triggered by scsi_host_busy()
    - [amd64] x86/microcode/AMD: Limit Entrysign signature checking to known
      generations
    - net: tls: Change async resync helpers argument
    - blk-crypto: use BLK_STS_INVAL for alignment errors
    - net: tls: Cancel RX async resync request on rcd_delta overflow
    - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check
    - [arm64] KVM: arm64: Make all 32bit ID registers fully writable
    - drm/xe: Prevent BIT() overflow when handling invalid prefetch region
    - [s390x] mm: Fix __ptep_rdp() inline assembly
    - ALSA: usb-audio: fix uac2 clock source at terminal parser
    - tracing/tools: Fix incorrcet short option in usage text for --threads
    - drm/amdgpu: fix gpu page fault after hibernation on PF passthrough
    - smb: client: fix incomplete backport in cfids_invalidation_worker()
    - tty/vt: fix up incorrect backport to stable releases
    - maple_tree: fix tracepoint string pointers
    - [amd64] drm/i915/dp_mst: Disable Panel Replay
    - mptcp: fix a race in mptcp_pm_del_add_timer()
    - xfs: Replace strncpy with memcpy
    - xfs: fix out of bounds memory read error in symlink repair
    - drm/amd/display: avoid reset DTBCLK at clock init
    - drm/amd/display: disable DPP RCG before DPP CLK enable
    - drm/amd/display: Insert dccg log for easy debug
    - drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched
    - Revert "gpio: swnode: don't use the swnode's name as the key for GPIO
      lookup"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.61
    - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
    - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted
      URBs
    - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before
      accessing header
    - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before
      accessing data
    - Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso
      interface
    - Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP
    - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
    - Bluetooth: SMP: Fix not generating mackey and ltk when repairing
    - net: sched: generalize check for no-queue qdisc on TX queue
    - veth: apply qdisc backpressure on full ptr_ring to reduce TX drops
    - veth: prevent NULL pointer dereference in veth_xdp_rcv
    - veth: more robust handing of race to avoid txq getting stuck
    - veth: reduce XDP no_direct return section to fix race
    - [amd64] platform/x86: intel: punit_ipc: fix memory corruption
    - net: aquantia: Add missing descriptor cache invalidation on ATL2
    - net: lan966x: Fix the initialization of taprio
    - drm/xe: Fix conversion from clock ticks to milliseconds
    - net/mlx5e: Fix validation logic in rate limiting
    - team: Move team device type change at the end of team_port_add
    - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
    - net: wwan: mhi: Keep modem name match with Foxconn T99W640
    - net: atlantic: fix fragment overflow handling in RX path
    - [arm64,armhf] net: fec: cancel perout_timer when PEROUT is disabled
    - [arm64,armhf] net: fec: do not update PEROUT if it is enabled
    - [arm64,armhf] net: fec: do not allow enabling PPS and PEROUT
      simultaneously
    - [arm64,armhf] net: fec: do not register PPS event for PEROUT
    - iio: st_lsm6dsx: Fixed calibrated timestamp calculation
    - [arm64] mailbox: mtk-cmdq: Refine DMA address handling for the command
      buffer
    - mailbox: pcc: Refactor error handling in irq handler into separate
      function
    - mailbox: pcc: don't zero error register
    - fs/namespace: fix reference leak in grab_requested_mnt_ns
    - spi: spi-mem: Allow specifying the byte order in Octal DTR mode
    - spi: spi-mem: Extend spi-mem operations with a per-operation maximum
      frequency
    - spi: spi-mem: Add a new controller capability
    - [arm64] spi: nxp-fspi: Support per spi-mem operation frequency switches
    - [arm64] spi: spi-nxp-fspi: remove the goto in probe
    - [arm64] spi: spi-nxp-fspi: Add OCT-DTR mode support
    - [arm64] spi: nxp-fspi: Propagate fwnode in ACPI case as well
    - Revert "drm/amd/display: Move setup_stream_attribute"
    - [amd64] Revert "perf/x86: Always store regs->ip in
      perf_callchain_kernel()"
    - iio: buffer-dma: support getting the DMA channel
    - iio: buffer-dmaengine: enable .get_dma_dev()
    - iio: buffer: support getting dma channel from the buffer
    - iio: accel: bmc150: Fix irq assumption regression (Closes: #1106411)
    - tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs
    - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
    - [arm64] dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity
    - Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref
    - can: sja1000: fix max irq loop handling
    - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
    - ceph: fix crash in process_v2_sparse_read() for encrypted directories
    - dm-verity: fix unreliable memory allocation
    - drivers/usb/dwc3: fix PCI parent check
    - smb: client: fix memory leak in cifs_construct_tcon()
    - [amd64] thunderbolt: Add support for Intel Wildcat Lake
    - [arm64] slimbus: ngd: Fix reference count leak in
      qcom_slim_ngd_notify_slaves
    - nvmem: layouts: fix nvmem_layout_bus_uevent
    - firmware: stratix10-svc: fix bug in saving controller data
    - mm/memfd: fix information leak in hugetlb folios
    - mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level
    - mptcp: clear scheduled subflows on retransmit
    - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in
      mptcp_do_fastclose().
    - [arm*] serial: amba-pl011: prefer dma_mapping_error() over explicit
      address checking
    - usb: cdns3: Fix double resource release in cdns3_pci_probe
    - usb: gadget: f_eem: Fix memory leak in eem_unwrap
    - usb: storage: Fix memory leak in USB bulk transport
    - USB: storage: Remove subclass and protocol overrides from Novatek quirk
    - usb: storage: sddr55: Reject out-of-bound new_pba
    - usb: uas: fix urb unmapping issue when the uas device is remove during
      ongoing data transfer
    - [amd64,arm64] usb: dwc3: pci: add support for the Intel Nova Lake -S
    - [amd64,arm64] usb: dwc3: pci: Sort out the Intel device IDs
    - [amd64,arm64] usb: dwc3: Fix race condition between concurrent
      dwc3_remove_requests() call paths
    - xhci: fix stale flag preventig URBs after link state error is cleared
    - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
    - xhci: dbgtty: fix device unregister
    - USB: serial: ftdi_sio: add support for u-blox EVK-M101
    - USB: serial: option: add support for Rolling RW101R-GL
    - drm: sti: fix device leaks at component probe
    - drm/amd/amdgpu: reserve vm invalidation engine for uni_mes
    - drm/amd/display: Check NULL before accessing
    - drm/amd/display: Don't change brightness for disabled connectors
    - [armhf] net: dsa: microchip: common: Fix checks on irq_find_mapping()
    - [armhf] net: dsa: microchip: ptp: Fix checks on irq_find_mapping()
    - [armhf] net: dsa: microchip: Don't free uninitialized ksz_irq
    - libceph: fix potential use-after-free in have_mon_and_osd_map()
    - libceph: prevent potential out-of-bounds writes in
      handle_auth_session_key()
    - libceph: replace BUG_ON with bounds check for map->max_osd
    - staging: rtl8712: Remove driver using deprecated API wext
    - nfsd: Replace clamp_t in nfsd4_get_drc_mem()
    - usb: typec: ucsi: psy: Set max current to zero when disconnected
    - usb: udc: Add trace event for usb_gadget_set_state
    - usb: gadget: udc: fix use-after-free in usb_gadget_state_work
    - mm/huge_memory: fix NULL pointer deference when splitting folio
    - [amd64] KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts()
    - [amd64] KVM: nSVM: Always recalculate LBR MSR intercepts in
      svm_update_lbrv()
    - [amd64] KVM: nSVM: Fix and simplify LBR virtualization handling with
      nested
    - [amd64] KVM: SVM: Fix redundant updates of LBR MSR intercepts
    - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
    - [armhf] net: dsa: microchip: Do not execute PTP driver code for
      unsupported switches
    - [armhf] net: dsa: microchip: Free previously initialized ports on init
      failures
    - wifi: ath12k: correctly handle mcast packets for clients
    - Revert "ACPI: Suppress misleading SPCR console message when SPCR table is
      absent"
    - [amd64] drm/i915/dp: Initialize the source OUI write timestamp always
    - [arm64] spi: spi-nxp-fspi: Check return value of devm_mutex_init()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.62
    - xfrm: delete x->tunnel as we delete x
    - Revert "xfrm: destroy xfrm_state synchronously on net exit path"
    - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that
      were never added
    - xfrm: flush all states in xfrm_state_fini
    - Documentation: process: Also mention Sasha Levin as stable tree maintainer
    - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system
      corrupted
    - ext4: refresh inline data size before write operations
    - ksmbd: ipc: fix use-after-free in ipc_msg_send_request
    - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
    - [amd64] KVM: SVM: Don't skip unrelated instruction if INT3/INTO is
      replaced
    - USB: serial: option: add Foxconn T99W760
    - USB: serial: option: add Telit Cinterion FE910C04 new compositions
    - USB: serial: option: move Telit 0x10c7 composition in the right place
    - USB: serial: ftdi_sio: match on interface number for jtag
    - serial: add support of CPCI cards
    - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
    - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
    - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
    - [arm64,armhf] ipi: imx: keep dma request disabled before dma transfer
      setup
    - drm/vmwgfx: Use kref in vmw_bo_dirty
    - Bluetooth: btrtl: Avoid loading the config file on security chips
    - smb: fix invalid username check in smb3_fs_context_parse_param()
    - drm/amdkfd: Fix GPU mappings for APU after prefetch
    - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
    - bfs: Reconstruct file type when loading from disk
    - HID: hid-input: Extend Elan ignore battery quirk to USB
    - nvme: fix admin request_queue lifetime
    - [arm64] pinctrl: qcom: msm: Fix deadlock in pinmux configuration
    - [amd64] platform/x86: acer-wmi: Ignore backlight event
    - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
    - [amd64] platform/x86: huawei-wmi: add keys for HONOR models
    - [amd64] platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
    - [amd64] platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
    - HID: elecom: Add support for ELECOM M-XT3URBK (018F)
    - wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1
    - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
    - [amd64] comedi: check device's attached status in compat ioctls
    - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
    - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
    - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
    - bus: mhi: host: pci_generic: Add Telit FN920C04 modem support
    - bus: mhi: host: pci_generic: Add Telit FN990B40 modem support
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.63
    - [arm64,armhf] gpu: host1x: Fix race in syncpt alloc/free
    - [amd64] accel/ivpu: Prevent runtime suspend during context abort work
    - [amd64] accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume
      fail
    - [amd64] accel/ivpu: Make function parameter names consistent
    - [amd64] accel/ivpu: Fix DCT active percent format
    - drm/vgem-fence: Fix potential deadlock on release
    - USB: Fix descriptor count when handling invalid MBIM extended descriptor
    - [arm64] pinctrl: renesas: rzg2l: Fix PMC restore
    - [arm64] clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle
      callback
    - [arm64] clk: renesas: Use str_on_off() helper
    - [arm64] clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register
    - [arm64] clk: renesas: cpg-mssr: Read back reset registers to assure values
      latched
    - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
    - objtool: Fix standalone --hacks=jump_label
    - objtool: Fix weak symbol detection
    - wifi: ath10k: Avoid vdev delete timeout when firmware is already down
    - wifi: ath10k: Add missing include of export.h
    - wifi: ath10k: move recovery check logic into a new work
    - wifi: ath11k: restore register window after global reset
    - sched/fair: Forfeit vruntime on yield
    - [arm*] irqchip/irq-brcmstb-l2: Fix section mismatch
    - [arm64,armhf] irqchip/imx-mu-msi: Fix section mismatch
    - [arm64] irqchip/renesas-rzg2l: Fix section mismatch
    - [riscv64] irqchip/starfive-jh8100: Fix section mismatch
    - [arm64] irqchip/qcom-irq-combiner: Fix section mismatch
    - crypto: authenc - Correctly pass EINPROGRESS back up to the caller
    - ntfs3: fix uninit memory after failed mi_read in mi_format_new
    - ntfs3: Fix uninit buffer allocated by __getname()
    - dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets
    - dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets
    - clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets
    - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
    - inet: Avoid ehash lookup race in inet_ehash_insert()
    - inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule()
    - firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc
    - block/mq-deadline: Introduce dd_start_request()
    - block/mq-deadline: Switch back to a single dispatch list
    - [arm64] dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1
      props
    - [arm64] dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
    - [arm64] dts: imx8mp-venice-gw702x: remove off-board uart
    - [arm64] dts: imx8mp-venice-gw702x: remove off-board sdhc1
    - perf annotate: Check return value of evsel__get_arch() properly
    - [arm64] dts: exynos: gs101: fix sysreg_apm reg property
    - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
    - soc: Switch back to struct platform_driver::remove()
    - [arm64] soc: qcom: gsbi: fix double disable caused by devm
    - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
    - wifi: ath11k: fix VHT MCS assignment
    - wifi: ath11k: fix peer HE MCS assignment
    - [s390x] smp: Fix fallback CPU detection
    - [s390x] ap: Don't leak debug feature files if AP instructions are not
      available
    - [arm64] dts: ti: k3-am62p: Fix memory ranges for GPU
    - firmware: imx: scu-irq: fix OF node leak in
    - [arm64] dts: qcom: x1e80100: Fix compile warnings for USB HS controller
    - [arm64] dts: qcom: x1e80100: Add missing quirk for HS only USB controller
    - [arm64] dts: qcom: sdm845-oneplus: Correct gpio used for slider
    - [arm64] dts: qcom: sm8650: set ufs as dma coherent
    - [arm64] dts: qcom: qcm6490-shift-otter: Add missing reserved-memory
    - phy: mscc: Fix PTP for VSC8574 and VSC8572
    - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
    - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
    - Revert "mtd: rawnand: marvell: fix layouts"
    - [arm64,armhf] mtd: nand: relax ECC parameter validation check
    - perf: Remove get_perf_callchain() init_nr argument
    - bpf: Refactor stack map trace depth calculation into helper function
    - bpf: Fix stackmap overflow check in __bpf_get_stackid()
    - [amd64] perf/x86/intel/cstate: Remove PC3 support from LunarLake
    - task_work: Fix NMI race condition
    - [amd64] x86/dumpstack: Prevent KASAN false positive warnings in
      __show_regs()
    - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
    - [arm64] soc: qcom: smem: fix hwspinlock resource leak in probe error paths
    - [armhf] pinctrl: stm32: fix hwspinlock resource leak in probe function
    - i3c: fix refcount inconsistency in i3c_master_register
    - i3c: master: svc: Prevent incomplete IBI transaction
    - wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload()
    - [arm64] interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
    - [arm64] dts: qcom: msm8996: add interconnect paths to USB2 controller
    - interconnect: debugfs: Fix incorrect error handling for NULL path
    - drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource()
    - perf lock contention: Load kernel map before lookup
    - perf record: skip synthesize event when open evsel failed
    - power: supply: rt5033_charger: Fix device node reference leaks
    - power: supply: cw2015: Check devm_delayed_work_autocancel() return code
    - power: supply: max17040: Check iio_read_channel_processed() return code
    - power: supply: rt9467: Return error on failure in
      rt9467_set_value_from_ranges()
    - power: supply: rt9467: Prevent using uninitialized local variable in
      rt9467_set_value_from_ranges()
    - power: supply: wm831x: Check wm831x_set_bits() return value
    - power: supply: apm_power: only unset own apm_get_power_status
    - scsi: target: Do not write NUL characters into ASCII configfs output
    - fs/9p: Don't open remote file with APPEND mode when writeback cache is
      used
    - [arm64] drm/panthor: Handle errors returned by drm_sched_entity_init()
    - [arm64] drm/panthor: Fix group_free_queue() for partially initialized
      queues
    - [arm64] drm/panthor: Fix UAF race between device unplug and FW event
      processing
    - [arm64] drm/panthor: Fix race with suspend during unplug
    - [arm64] drm/panthor: Fix UAF on kernel BO VA nodes
    - libbpf: Fix parsing of multi-split BTF
    - [armhf] dts: am335x-netcom-plus-2xx: add missing GPIO labels
    - [armhf] dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible
    - [armhf] dts: omap3: n900: Correct obsolete TWL4030 power compatible
    - [amd64] x86/boot: Fix page table access in 5-level to 4-level paging
      transition
    - efi/libstub: Fix page table access in 5-level to 4-level paging transition
    - ext4: correct the checking of quota files before moving extents
    - [amd64] perf/x86/intel: Correct large PEBS flag check
    - regulator: core: disable supply if enabling main regulator fails
    - md: fix rcu protection in md_wakeup_thread
    - nbd: defer config put in recv_work
    - scsi: stex: Fix reboot_notifier leak in probe error path
    - scsi: smartpqi: Fix device resources accessed after device removal
    - dt-bindings: PCI: amlogic: Fix the register name of the DBI region
    - RDMA/rtrs: server: Fix error handling in get_or_create_srv
    - ntfs3: init run lock for extend inode
    - [arm64] drm/panthor: Fix potential memleak of vma structure
    - scsi: ufs: core: fix incorrect buffer duplication in
      ufshcd_read_string_desc()
    - [amd64] cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs
    - [powerpc*] kdump: Fix size calculation for hot-removed memory ranges
    - [powerpc*] 32: Fix unpaired stwcx. on interrupt exit
    - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
    - nbd: defer config unlock in nbd_genl_connect
    - coresight: Change device mode to atomic type
    - [arm64] coresight: etm4x: Correct polling IDLE bit
    - [arm64] coresight: etm4x: Extract the trace unit controlling
    - [arm64] coresight: etm4x: Add context synchronization before enabling
      trace
    - lib/vsprintf: Check pointer before dereferencing in time_and_date()
    - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
    - ACPI: property: Fix fwnode refcount leak in
      acpi_fwnode_graph_parse_endpoint()
    - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
    - leds: netxbig: Fix GPIO descriptor leak in error paths
    - bpf: Free special fields when update [lru_,]percpu_hash maps
    - PCI: keystone: Exit ks_pcie_probe() for invalid mode
    - [arm64] dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A
    - [arm64] dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
    - [arm64] dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C
    - [amd64] crypto: iaa - Fix incorrect return value in save_iaa_wq()
    - [arm64] drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype
    - ps3disk: use memcpy_{from,to}_bvec index
    - bpf: Handle return value of ftrace_set_filter_ip in register_fentry
    - bpf: Check skb->transport_header is set in bpf_skb_check_mtu
    - watchdog: wdat_wdt: Fix ACPI table leak in probe function
    - watchdog: starfive: Fix resource leak in probe error path
    - tracefs: fix a leak in eventfs_create_events_dir()
    - NFSD/blocklayout: Fix minlength check in proc_layoutget
    - block/blk-throttle: Fix throttle slice time for SSDs
    - [arm64] drm/msm/a2xx: stop over-complaining about the legacy firmware
    - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
    - bpf: Fix invalid prog->stats access when update_effective_progs fails
    - [powerpc*] 64s/hash: Restrict stress_hpt_struct memblock region to within
      RMA limit
    - [powerpc*] 64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE
      format
    - fs/ntfs3: out1 also needs to put mi
    - fs/ntfs3: Prevent memory leaks in add sub record
    - [arm64] drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
    - [arm64] drm/msm/a6xx: Flush LRZ cache before PT switch
    - [arm64] drm/msm/a6xx: Fix the gemnoc workaround
    - [arm64] drm/msm/a6xx: Improve MX rail fallback in RPMH vote init
    - ipv6: clear RA flags when adding a static route (Closes: #1117959)
    - pwm: bcm2835: Make sure the channel is enabled after pwm_request()
    - scsi: qla2xxx: Fix improper freeing of purex item
    - [amd64] iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb
    - wifi: mac80211: fix CMAC functions not handling errors
    - [arm64] mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
    - [arm64] mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
    - leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM
    - [arm64] phy: renesas: rcar-gen3-usb2: Fix an error handling path in
      rcar_gen3_phy_usb2_probe()
    - [arm64] phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth
    - [arm64] phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from
      exceeding the limits
    - net: phy: adin1100: Fix software power-down ready condition
    - cpuset: Treat cpusets in attaching as populated
    - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
    - RAS: Report all ARM processor CPER information to userspace
    - ima: Handle error code returned by ima_filter_rule_match()
    - usb: chaoskey: fix locking for O_NONBLOCK
    - usb: dwc2: disable platform lowlevel hw resources during shutdown
    - usb: dwc2: fix hang during shutdown if set as peripheral
    - usb: dwc2: fix hang during suspend if set as peripheral
    - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
    - [riscv64] KVM: Fix guest page fault within HLV* instructions
    - erofs: limit the level of fs stacking for file-backed mounts
    - RDMA/bnxt_re: Fix the inline size for GenP7 devices
    - RDMA/bnxt_re: Pass correct flag for dma mr creation
    - ASoC: tas2781: correct the wrong period
    - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
    - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
    - staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
    - [arm64] iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables
    - btrfs: fix leaf leak in an error path in btrfs_del_items()
    - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
    - drm/nouveau: restrict the flush page to a 32-bit address
    - iomap: factor out a iomap_dio_done helper
    - iomap: always run error completions in user context
    - wifi: ieee80211: correct FILS status codes
    - backlight: led-bl: Add devlink to supplier LEDs
    - backlight: lp855x: Fix lp855x.h kernel-doc warnings
    - [arm64] iommu/arm-smmu-qcom: Enable use of all SMR groups when running
      bare-metal
    - RDMA/irdma: Fix data race in irdma_sc_ccq_arm
    - RDMA/irdma: Fix data race in irdma_free_pble
    - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY
    - [arm64] drm/panthor: Avoid adding of kernel BOs to extobj list
    - gfs2: Prevent recursive memory reclaim
    - firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER
    - drm/amd/display: Fix logical vs bitwise bug in
      get_embedded_panel_info_v2_1()
    - hwmon: sy7636a: Fix regulator_enable resource leak on error path
    - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
    - ublk: prevent invalid access with DEBUG
    - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0
      validation
    - of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node
    - virtio_vdpa: fix misleading return in void function
    - virtio: fix typo in virtio_device_ready() comment
    - virtio: fix whitespace in virtio_config_ops
    - virtio: fix grammar in virtio_queue_info docs
    - virtio: fix virtqueue_set_affinity() docs
    - vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues
    - vhost: Fix kthread worker cgroup failure handling
    - vdpa/pds: use %pe for ERR_PTR() in event handler registration
    - [amd64] ASoC: Intel: catpt: Fix error path in hw_params()
    - [armhf] dts: samsung: universal_c210: turn off SDIO WLAN chip during
      system suspend
    - [armhf] dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during
      system suspend
    - [armhf] dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during
      system suspend
    - [armhf] dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during
      system suspend
    - regulator: core: Protect regulator_supply_alias_list with
      regulator_list_mutex
    - resource: replace open coded resource_intersection()
    - resource: introduce is_type_match() helper and use it
    - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
    - netfilter: flowtable: check for maximum number of encapsulations in bridge
      vlan
    - netfilter: nf_conncount: rework API to use sk_buff directly
    - netfilter: nft_connlimit: update the count if add was skipped
    - net: stmmac: fix rx limit check in stmmac_rx_zc()
    - vfio/pci: Use RCU for error/request triggers to avoid circular locking
    - net: phy: aquantia: check for NVMEM deferral
    - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
    - [arm64] remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
    - md/raid5: fix IO hang when array is broken with IO inflight
    - net: hsr: remove one synchronize_rcu() from hsr_del_port()
    - net: hsr: remove synchronize_rcu() from hsr_add_port()
    - net: hsr: Create and export hsr_get_port_ndev()
    - net: hsr: create an API to get hsr port type
    - net: dsa: xrs700x: reject unsupported HSR configurations
    - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
      (CVE-2025-68325)
    - perf tools: Mark split kallsyms DSOs as loaded
    - perf tools: Fix split kallsyms DSO counting
    - perf hist: In init, ensure mem_info is put on error paths
    - [arm64,armhf] pinctrl: single: Fix incorrect type for error return
      variable
    - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
    - 9p: fix cache/debug options printing in v9fs_show_options
    - sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the
      last task migrates out
    - [amd64] platform/x86:intel/pmc: Update Arrow Lake telemetry GUID
    - f2fs: keep POSIX_FADV_NOREUSE ranges
    - f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages
    - f2fs: fix to avoid running out of free segments
    - f2fs: add carve_out sysfs node
    - f2fs: sysfs: add encoding_flags entry
    - f2fs: introduce reserved_pin_section sysfs entry
    - f2fs: add gc_boost_gc_multiple sysfs node
    - f2fs: add gc_boost_gc_greedy sysfs node
    - f2fs: maintain one time GC mode is enabled during whole zoned GC cycle
    - NFS: Avoid changing nlink when file removes and attribute updates race
    - fs/nls: Fix utf16 to utf8 conversion
    - NFS: Initialise verifiers for visible dentries in readdir and lookup
    - NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
    - nfs/vfs: discard d_exact_alias()
    - NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state
    - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
    - Revert "nfs: ignore SB_RDONLY when remounting nfs"
    - Revert "nfs: clear SB_RDONLY before getting superblock"
    - Revert "nfs: ignore SB_RDONLY when mounting nfs"
    - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
    - Expand the type of nfs_fattr->valid
    - NFS: Fix inheritance of the block sizes when automounting
    - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
    - [amd64] platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
    - blk-mq: Abort suspend when wakeup events are pending
    - block: fix comment for op_is_zone_mgmt() to include RESET_ALL
    - block: fix memory leak in __blkdev_issue_zero_pages
    - nvme-auth: use kvfree() for memory allocated with kvcalloc()
    - drm/plane: Fix IS_ERR() vs NULL check in
      drm_plane_create_hotspot_properties()
    - regulator: fixed: Rely on the core freeing the enable GPIO
    - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
    - drm/nouveau: refactor deprecated strcpy
    - cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2
    - docs: hwmon: fix link to g762 devicetree binding
    - dma/pool: eliminate alloc_pages warning in atomic_pool_expand
    - ALSA: uapi: Fix typo in asound.h comment
    - drm/amdkfd: Use huge page size to check split svm range alignment
    - rtc: gamecube: Check the return value of ioremap()
    - ALSA: firewire-motu: add bounds check in put_user loop for DSP events
    - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of
      set->tag_list_lock
    - block: return unsigned int from queue_dma_alignment
    - dm-raid: fix possible NULL dereference with undefined raid type
    - dm log-writes: Add missing set_freezable() for freezable kthread
    - efi/cper: Add a new helper function to print bitmasks
    - efi/cper: Adjust infopfx size to accept an extra space
    - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
    - scsi: imm: Fix use-after-free bug caused by unfinished delayed work
      (CVE-2025-68324)
    - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
    - ocfs2: fix memory leak in ocfs2_merge_rec_left()
    - net: lan743x: Allocate rings outside ZONE_DMA
    - net: dst: introduce dst->dev_rcu
    - tcp_metrics: use dst_dev_net_rcu() (CVE-2025-40075)
    - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
    - usb: phy: Initialize struct usb_phy list_head
    - usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required
    - ALSA: dice: fix buffer overflow in detect_stream_formats()
    - ALSA: wavefront: Fix integer overflow in sample size validation

  [ Uwe Kleine-König ]
  * [armhf] Enable LEDS_TURRIS_OMNIA as a module for Turris Omnia LED
    support.

  [ Maxwell Pevner ]
  * drivers/hid: Enable HID_UNIVERSAL_PIDFF as module (Closes: #1122144)

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 30 Dec 2025 20:37:47 +0100

linux (6.12.57-1) trixie; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.49
    - wifi: wilc1000: avoid buffer overflow in WID string configuration
    - nvme: fix PI insert on write
    - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not
      supported
    - wifi: mac80211: increase scan_ies_len for S1G
    - wifi: mac80211: fix incorrect type for ret
    - cgroup: split cgroup_destroy_wq into 3 workqueues
    - btrfs: fix invalid extref key setup when replaying dentry
    - net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
    - qed: Don't collect too many protection override GRC elements
    - bonding: set random address only when slaves already exist
    - mptcp: set remote_deny_join_id0 on SYN recv
    - mptcp: tfo: record 'deny join id0' info
    - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
    - ice: store max_frame and rx_buf_len only in ice_rx_ring
    - ice: fix Rx page leak on multi-buffer frames
    - i40e: remove redundant memory barrier when cleaning Tx descs
    - igc: don't fail igc_probe() on LED setup error
    - net/mlx5e: Harden uplink netdev access against device unbind
    - bonding: don't set oif to bond dev when getting NS target destination
    - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
    - tls: make sure to abort the stream if headers are bogus
    - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
    - net: liquidio: fix overflow in octeon_init_instr_queue()
    - cnic: Fix use-after-free bugs in cnic_delete_task
    - [arm64] octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
    - [amd64] perf/x86/intel: Fix crash in icl_update_topdown_event()
      (CVE-2025-38322)
    - ksmbd: smbdirect: validate data_offset and data_length field of
      smb_direct_data_transfer
    - ksmbd: smbdirect: verify remaining_data_length respects
      max_fragmented_recv_size
    - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
    - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
    - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
    - power: supply: bq27xxx: restrict no-battery detection to bq27000
    - dm-raid: don't set io_min and io_opt for raid1
    - dm-stripe: fix a possible integer overflow
    - gup: optimize longterm pin_user_pages() for large folio
    - mm: revert "mm: vmscan.c: fix OOM on swap stress test"
    - [amd64] iommu/vt-d: Fix __domain_mapping()'s usage of
      switch_to_super_page()
    - [amd64] iommu/amd/pgtbl: Fix possible race while increase page table level
    - btrfs: tree-checker: fix the incorrect inode ref size check
    - [arm64] ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S
      interface
    - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if
      source graph failed
    - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
    - mmc: mvsdio: Fix dma_unmap_sg() nents value
    - [amd64] KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is
      active
    - drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put
    - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
    - rds: ib: Increment i_fastreg_wrs before bailing out
    - mptcp: propagate shutdown to subflows when possible
    - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
    - io_uring/cmd: let cmds to know about dying task
    - io_uring: backport io_should_terminate_tw()
    - io_uring: include dying ring in task_work "should cancel" state
    - io_uring/msg_ring: kill alloc_cache for io_kiocb allocations
    - io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check
      (CVE-2025-39816)
    - [amd64] ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
      message
    - [amd64] ASoC: Intel: catpt: Expose correct bit depth to userspace
    - drm/xe/tile: Release kobject for the failure path
    - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
    - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
    - drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
    - smb: client: fix filename matching of deferred files
    - smb: client: let smbd_destroy() call
      disable_work_sync(&info->post_send_credits_work)
    - crypto: af_alg - Set merge to zero early in af_alg_sendmsg
    - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
    - io_uring: fix incorrect io_kiocb reference in io_link_skb
    - [amd64] platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on
      ASUS ROG Z13
    - [amd64] platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk
    - vmxnet3: unregister xdp rxq info in the reset path (CVE-2025-22106)
    - mm: add folio_expected_ref_count() for reference count calculation
    - mm/gup: check ref_count instead of lru before migration
    - mptcp: pm: nl: announce deny-join-id0 flag
    - usb: xhci: introduce macro for ring segment list iteration
    - usb: xhci: remove option to change a default ring's TRB cycle bit
    - xhci: dbc: decouple endpoint allocation from initialization
    - xhci: dbc: Fix full DbC transfer ring after several reconnects
    - rtc: pcf2127: fix SPI command byte for PCF2131 backport
    - minmax.h: add whitespace around operators and after commas
    - minmax.h: update some comments
    - minmax.h: reduce the #define expansion of min(), max() and clamp()
    - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
    - minmax.h: move all the clamp() definitions after the min/max() ones
    - minmax.h: simplify the variants of clamp()
    - minmax.h: remove some #defines that are only expanded once
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.50
    - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
    - firewire: core: fix overlooked update of subsystem ABI version
    - ALSA: usb-audio: Fix code alignment in mixer_quirks
    - ALSA: usb-audio: Fix block comments in mixer_quirks
    - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
    - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
    - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
    - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
    - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
    - ALSA: usb-audio: Convert comma to semicolon
    - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
    - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
    - usb: core: Add 0x prefix to quirks debug output
    - [arm64,armhf] net: fec: rename struct fec_devinfo fec_imx6x_info ->
      fec_imx6sx_info
    - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
    - [riscv64] mmc: sdhci-cadence: add Mobileye eyeQ support
    - i2c: designware: Add quirk for Intel Xe
    - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
    - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
    - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
    - net: sfp: add quirk for FLYPRO copper SFP+ module
    - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
    - [amd64] HID: amd_sfh: Add sync across amd sfh work functions
    - cpufreq: Initialize cpufreq-based invariance before subsys
    - smb: server: don't use delayed_work for post_recv_credits_work
    - smb: server: use disable_work_sync in transport_rdma.c
    - bpf: Check the helper function is valid in get_helper_proto
    - btrfs: don't allow adding block device of less than 1 MB
    - wifi: virt_wifi: Fix page fault on connect
    - bpf: Reject bpf_timer for PREEMPT_RT
    - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
    - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
    - [armhf] can: sun4i_can: populate ndo_change_mtu() to prevent buffer
      overflow
    - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
    - can: peak_usb: fix shift-out-of-bounds issue
    - net: tun: Update napi->skb after XDP process
    - net/smc: fix warning in smc_rx_splice() when calling get_page()
    - [arm64] ethernet: rvu-af: Remove slash from the driver name
    - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
    - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
    - vhost: Take a reference on the task in struct vhost_task.
    - bnxt_en: correct offset handling for IPv6 destination address
    - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
    - nexthop: Forbid FDB status change while nexthop is in a group
    - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
    - mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU
      batch"
    - mm: folio_may_be_lru_cached() unless folio_test_large()
    - [amd64] drm/gma500: Fix null dereference in hdmi teardown
    - futex: Prevent use-after-free during requeue-PI
    - [arm64] drm/panthor: Defer scheduler entitiy destruction to queue release
    - [amd64] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
    - smb: client: fix wrong index reference in smb2_compound_op()
    - HID: asus: add support for missing PX series fn keys
    - i40e: add validation for ring_len param
    - i40e: fix idx validation in i40e_validate_queue_map
    - i40e: fix idx validation in config queues msg
    - i40e: fix input validation logic for action_meta
    - i40e: fix validation of VF state in get resources
    - i40e: add max boundary check for VF filters
    - i40e: add mask to apply valid bits for itr_idx
    - i40e: improve VF MAC filters accounting
    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
    - tracing: dynevent: Add a missing lockdown check on dynevent
    - [armhf] dts: socfpga: sodia: Fix mdio bus probe and PHY address
    - drm/ast: Use msleep instead of mdelay for edid read
    - afs: Fix potential null pointer dereference in afs_put_server
    - fs/proc/task_mmu: check p->vec_buf for NULL
    - gpiolib: Extend software-node support to support secondary software-nodes
    - mm/hugetlb: fix folio is still mapped when deleted
    - fbcon: fix integer overflow in fbcon_do_set_font
    - fbcon: Fix OOB access in font allocation
    - iommufd: Fix race during abort for file descriptors
    - Revert "usb: xhci: remove option to change a default ring's TRB cycle bit"
    - [amd64] drm/i915/backlight: Return immediately when scale() finds invalid
      parameters
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.51
    - crypto: sha256 - fix crash at kexec
    - scsi: target: target_core_configfs: Add length check to avoid buffer
      overflow
    - media: b2c2: Fix use-after-free causing by irq_check_work in
      flexcop_pci_remove
    - media: tuner: xc5000: Fix use-after-free in xc5000_release
    - media: rc: fix races with imon_disconnect()
    - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
    - mm: swap: check for stable address space before operating on the VMA
    - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
    - [arm64] ASoC: qcom: audioreach: fix potential null pointer dereference
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.52
    - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
    - USB: serial: option: add SIMCom 8230C compositions
    - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
    - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
    - wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
    - dm-integrity: limit MAX_TAG_SIZE to 255
    - [amd64] platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042
      list
    - [amd64] platform/x86/amd/pmf: Support new ACPI ID AMDI0108
    - [amd64,arm64] ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
    - btrfs: ref-verify: handle damaged extent root tree
    - netfs: Prevent duplicate unlocking
    - can: hi311x: fix null pointer dereference when resuming from sleep before
      interface was enabled
    - [amd64] platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
      quirks list
    - drm/amd : Update MES API header file for v11 & v12
    - drm/amd/include : MES v11 and v12 API header update
    - drm/amd/include : Update MES v12 API for fence update
    - drm/amdgpu: Enable MES lr_compute_wa by default (Closes: #1118658)
    - ALSA: usb-audio: Kill timer properly at removal (CVE-2025-38105)
    - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
    - hid: fix I2C read buffer overflow in raw_event() for mcp2221
    - nvmem: layouts: fix automatic module loading
    - binder: fix double-free in dbitmap
    - driver core/PM: Set power.no_callbacks along with power.no_pm
    - crypto: rng - Ensure set_ent is always present
    - net/9p: fix double req put in p9_fd_cancelled
    - [amd64] KVM: x86: Don't (re)check L1 intercepts when completing userspace
      I/O
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.53
    - filelock: add FL_RECLAIM to show_fl_flags() macro
    - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
    - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
    - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
    - [powerpc*] 8xx: Remove left-over instruction and comments in
      DataStoreTLBMiss handler
    - [powerpc*] 603: Really copy kernel PGD entries into all PGDIRs
    - uprobes: uprobe_warn should use passed task
    - [arm64] coresight: trbe: Prevent overflow in PERF_IDX2OFF()
    - [arm64] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
    - smb: server: fix IRD/ORD negotiation with the client
    - [amd64] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
    - [amd64] x86/vdso: Fix output operand size of RDPID
    - lsm: CONFIG_LSM can depend on CONFIG_SECURITY
    - btrfs: return any hit error from extent_writepage_io()
    - [arm64] pinctrl: renesas: rzg2l: Fix invalid unsigned return in
      rzg3s_oen_read()
    - [arm64] dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
    - regmap: Remove superfluous check for !config in __regmap_init()
    - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
    - libbpf: Fix reuse of DEVMAP
    - [arm64] dts: imx93-kontron: Fix GPIO for panel regulator
    - [arm64] dts: imx93-kontron: Fix USB port assignment
    - [arm64] dts: imx95: Correct the lpuart7 and lpuart8 srcid
    - ACPI: processor: idle: Fix memory leak when register cpuidle device failed
    - [arm64] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
    - [arm64] pinctrl: meson-gxl: add missing i2c_d pinmux
    - blk-mq: check kobject state_in_sysfs before deleting in
      blk_mq_unregister_hctx
    - block: use int to store blk_stack_limits() return value
    - PM: sleep: core: Clear power.must_resume in noirq suspend error path
    - vdso: Add struct __kernel_old_timeval forward declaration to gettime.h
    - [armhf] dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
      property
    - [arm64] PM / devfreq: mtk-cci: Fix potential error pointer dereference in
      probe()
    - [arm64] power: supply: cw2015: Fix a alignment coding style issue
    - [arm64] pinctrl: renesas: Use int type to store negative error codes
    - null_blk: Fix the description of the cache_size module argument
    - nbd: restrict sockets to TCP and UDP
    - [arm64] PM / devfreq: rockchip-dfi: double count on RK3588
    - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
    - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
    - [arm64] arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
    - mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
    - [arm64] dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
    - [arm64] dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes
    - [arm64] dts: mediatek: mt8516-pumpkin: Fix machine compatible
    - [armhf] pwm: tiehrpwm: Don't drop runtime PM reference in .free()
    - [armhf] pwm: tiehrpwm: Make code comment in .free() more useful
    - [armhf] pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle
      calculation
    - [armhf] pwm: tiehrpwm: Fix corner case in clock divisor calculation
    - ACPICA: Fix largest possible resource descriptor index
    - [riscv64] bpf: Sign extend struct ops return values properly
    - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
    - i3c: master: svc: Use manual response for IBI events
    - i3c: master: svc: Recycle unused IBI slot
    - bpf: Explicitly check accesses to bpf_sock_addr
    - bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
    - smp: Fix up and expand the smp_call_function_many() kerneldoc
    - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host
      headers
    - spi: fix return code when spi device has too many chipselects
    - bpf: Mark kfuncs as __noclone
    - once: fix race by moving DO_ONCE to separate section
    - [arm64] thermal/drivers/qcom/lmh: Add missing IRQ includes
    - [arm64] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
    - i2c: designware: Fix clock issue when PM is disabled
    - i2c: designware: Add disabling clocks when probe fails
    - libbpf: Fix error when st-prefix_ops and ops from differ btf
    - bpf: Enforce expected_attach_type for tailcall compatibility
    - drm/radeon/r600_cs: clean up of dead code in r600_cs
    - f2fs: fix condition in __allow_reserved_blocks()
    - [arm64] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
    - drm/amd/display: Remove redundant semicolons
    - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
    - scsi: myrs: Fix dma_alloc_coherent() error check
    - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
    - RDMA/mlx5: Fix vport loopback forcing for MPV device
    - PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
    - ALSA: lx_core: use int type to store negative error codes
    - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
    - [arm64,armhf] coresight: Only register perf symlink for sinks with
      alloc_buffer
    - drm/amdgpu: Power up UVD 3 for FW validation (v2)
    - drm/amd/pm: Disable ULV even if unsupported (v3)
    - drm/amd/pm: Fix si_upload_smc_data (v3)
    - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
    - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
    - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
    - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
    - wifi: mwifiex: send world regulatory domain to driver
    - [arm64,armhf] PCI: tegra: Fix devm_kcalloc() argument order for port->phys
      allocation
    - tcp: fix __tcp_close() to only send RST when required
    - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
    - [armhf] usb: phy: twl6030: Fix incorrect type for ret
    - usb: gadget: configfs: Correctly set use_os_string at bind
    - tty: n_gsm: Don't block input queue by waiting MSC
    - [powerpc*] misc: genwqe: Fix incorrect cmd field being reported in error
    - pps: fix warning in pps_register_cdev when register device fail
    - wifi: iwlwifi: Remove redundant header files
    - [amd64,arm64] idpf: fix Rx descriptor ready check barrier in splitq
    - [amd64] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
    - [amd64] ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
    - [amd64] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
    - [arm64] drm/msm/dpu: fix incorrect type for ret
    - fs: ntfs3: Fix integer overflow in run_unpack()
    - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
    - iio: consumers: Fix handling of negative channel scale in
      iio_convert_raw_to_processed()
    - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
    - netfilter: ipset: Remove unused htable_bits in macro ahash_region
    - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
    - drivers/base/node: handle error properly in register_one_node()
    - RDMA/cm: Rate limit destroy CM ID timeout error message
    - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
    - wifi: mt76: mt7996: Fix RX packets configuration for primary WED device
    - wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
    - wifi: mt76: mt7915: fix mt7981 pre-calibration
    - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
    - f2fs: fix to truncate first page in error path of f2fs_truncate()
    - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
    - ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on
      PREEMPT_RT
    - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
    - scsi: qla2xxx: edif: Fix incorrect sign of error code
    - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
    - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
    - HID: hidraw: tighten ioctl command parsing
    - f2fs: fix zero-sized extent for precache extents
    - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems
      Running"
    - RDMA/core: Resolve MAC of next-hop device without ARP support
    - IB/sa: Fix sa_local_svc_timeout_ms read race
    - Documentation: trace: historgram-design: Separate sched_waking histogram
      section heading and the following diagram
    - wifi: ath12k: fix wrong logging ID used for CE
    - wifi: ath10k: avoid unnecessary wait for service ready message
    - iommu/vt-d: debugfs: Fix legacy mode page table dump logic
    - wifi: mac80211: fix Rx packet handling when pubsta information is not
      available
    - [amd64] ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
    - RDMA/rxe: Fix race in do_task() when draining
    - wifi: rtw89: avoid circular locking dependency in ser_state_run()
    - [arm64] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
    - dm vdo: return error on corrupted metadata in start_restoring_volume
      functions
    - [arm64] coresight-etm4x: Conditionally access register TRCEXTINSELR
    - [arm64,armhf] coresight: tmc: Support atclk
    - [arm64,armhf] coresight: catu: Support atclk
    - [arm64,armhf] coresight: etm4x: Support atclk
    - [arm64,armhf] coresight: trbe: Return NULL pointer for allocation failures
    - [arm64,armhf] coresight: tpda: fix the logic to setup the element size
    - [arm64] coresight: Fix incorrect handling for return value of devm_kzalloc
    - NFSv4.1: fix backchannel max_resp_sz verification check
    - ipvs: Defer ip_vs_ftp unregister during netns cleanup
    - netfilter: nfnetlink: reset nlh pointer during batch replay
    - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
    - usb: vhci-hcd: Prevent suspending virtually attached devices
    - iommu/vt-d: Disallow dirty tracking if incoherent page walk
    - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
    - ptp: Add a upper bound on max_vclocks
    - vhost: vringh: Fix copy_to_iter return value check
    - Bluetooth: MGMT: Fix not exposing debug UUID on
      MGMT_OP_READ_EXP_FEATURES_INFO
    - Bluetooth: ISO: Fix possible UAF on iso_conn_free
    - Bluetooth: ISO: free rx_skb if not consumed
    - Bluetooth: ISO: don't leak skb in ISO_CONT RX
    - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
    - KEYS: X.509: Fix Basic Constraints CA flag parsing
    - ocfs2: fix double free in user_cluster_connect()
    - drivers/base/node: fix double free in register_one_node()
    - [arm64] PCI: j721e: Fix incorrect error message in probe()
    - [amd64,arm64] idpf: fix mismatched free function for dma_alloc_coherent
    - nfp: fix RSS hash key size when RSS is not supported
    - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not
      configurable
    - net: dlink: handle copy_thresh allocation failure
    - net/mlx5: Stop polling for command response if interface goes down
    - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
    - net/mlx5: fw reset, add reset timeout work
    - smb: client: fix crypto buffers in non-linear memory
    - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
    - bpf: Reject negative offsets for ALU ops
    - tpm: Disable TPM2_TCG_HMAC by default
    - Squashfs: fix uninit-value in squashfs_get_parent
    - uio_hv_generic: Let userspace take care of interrupt mask
    - io_uring/waitid: always prune wait queue entry in io_waitid_wait()
    - [arm64] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
    - [amd64,arm64] ASoC: SOF: ipc3-topology: Fix multi-core and static
      pipelines tear down
    - fs: udf: fix OOB read in lengthAllocDescs handling
    - net: nfc: nci: Add parameter validation for packet data
    - [arm64,armhf] mfd: vexpress-sysreg: Check the return value of
      devm_gpiochip_add_data()
    - dm: fix queue start/stop imbalance under suspend/load/resume races
    - dm: fix NULL pointer dereference in __dm_suspend()
    - ksmbd: Fix race condition in RPC handle list access
    - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
    - ksmbd: add max ip connections parameter
    - ext4: fix checks for orphan inodes
    - [amd64] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't
      valid
    - fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
    - mm: hugetlb: avoid soft lockup when mprotect to large memory area
    - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
    - [arm64] misc: fastrpc: Save actual DMA size in fastrpc_map structure
    - [arm64] misc: fastrpc: Fix fastrpc_map_lookup operation
    - [arm64] misc: fastrpc: fix possible map leak in fastrpc_put_args
    - [arm64] misc: fastrpc: Skip reference for DMA handles
    - Input: atmel_mxt_ts - allow reset GPIO to sleep
    - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
    - sunrpc: fix null pointer dereference on zero-length checksum
    - [arm64] remoteproc: pru: Fix potential NULL pointer dereference in
      pru_rproc_set_ctable()
    - [amd64,arm64] tee: fix register_shm_helper()
    - pinctrl: check the return value of pinmux_ops::get_function_name()
    - bus: fsl-mc: Check return value of platform_get_resource()
    - net/9p: Fix buffer overflow in USB transport layer
    - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
    - usb: typec: tipd: Clear interrupts first
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.54
    - fs: always return zero on success from replace_fd()
    - fscontext: do not consume log entries when returning -EMSGSIZE
    - [arm64] map [_text, _stext) virtual address range non-executable+read-only
    - rseq: Protect event mask against membarrier IPI
    - listmount: don't call path_put() under namespace semaphore
    - page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
    - dma-mapping: fix direction in dma_alloc direction traces
    - [amd64] KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
    - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
    - media: v4l2-subdev: Fix alloc failure check in
      v4l2_subdev_call_state_try()
    - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
    - perf disasm: Avoid undefined behavior in incrementing NULL
    - perf test trace_btf_enum: Skip if permissions are insufficient
    - perf evsel: Avoid container_of on a NULL leader
    - libperf event: Ensure tracing data is multiple of 8 sized
    - [arm64] clk: qcom: common: Fix NULL vs IS_ERR() check in
      qcom_cc_icc_register()
    - [arm64] clk: renesas: cpg-mssr: Fix memory leak in
      cpg_mssr_reserved_init()
    - perf util: Fix compression checks returning -1 as bool
    - perf arm_spe: Correct setting remote access
    - perf arm-spe: Rename the common data source encoding
    - perf arm_spe: Correct memory level for remote access
    - perf vendor events arm64 AmpereOneX: Fix typo - should be
      l1d_cache_access_prefetches
    - perf session: Fix handling when buffer exceeds 2 GiB
    - perf tools: Add fallback for exclude_guest
    - perf evsel: Ensure the fallback message is always written to
    - [arm64] clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
    - [arm64] clk: mediatek: clk-mux: Do not pass flags to
      clk_mux_determine_rate_flags()
    - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (CVE-2025-40001)
    - [amd64] ASoC: SOF: Intel: hda-pcm: Place the constraint on period time
      instead of buffer time
    - [amd64] ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
    - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
    - drm/xe/hw_engine_group: Fix double write lock release in error path
    - [s390x] cio: Update purge function to unregister the unused subchannels
    - drm/vmwgfx: Fix a null-ptr access in the cursor snooper
    - drm/vmwgfx: Fix Use-after-free in validation
    - drm/vmwgfx: Fix copy-paste typo in validation
    - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
    - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
    - [arm64] net: mscc: ocelot: Fix use-after-free caused by cyclic delayed
      work (CVE-2025-40003)
    - ice: ice_adapter: release xa entry on adapter allocation failure
    - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
    - [arm64] mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
      call
    - [arm64] mailbox: zynqmp-ipi: Remove dev.parent check in
      zynqmp_ipi_free_mboxes
    - [arm64] mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup
      loop
    - [arm64] mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
    - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
    - [arm64] mailbox: mtk-cmdq-mailbox: Switch to
      __pm_runtime_put_autosuspend()
    - [arm64] mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend()
    - [arm64] mailbox: mtk-cmdq: Remove pm_runtime APIs from
      cmdq_mbox_send_data()
    - drm/amdgpu: Add additional DCE6 SCL registers
    - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
    - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
    - drm/amd/display: Properly disable scaling on DCE6
    - netfilter: nft_objref: validate objref and objrefmap expressions
    - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
    - crypto: essiv - Check ssize for decryption and in-place encryption
    - cifs: Fix copy_to_iter return value check
    - smb: client: fix missing timestamp updates after utime(2)
    - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
    - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
    - [arm64] gpio: wcd934x: mark the GPIO controller as sleeping
    - bpf: Avoid RCU context warning when unpinning htab with internal structs
    - [s390x] vmlinux.lds.S: Reorder sections
    - [s390x] vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
    - ACPI: property: Fix buffer properties extraction for subnodes
    - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
    - ACPI: debug: fix signedness issues in read/write helpers
    - [arm64] dts: qcom: msm8916: Add missing MDSS reset
    - [arm64] dts: qcom: msm8939: Add missing MDSS reset
    - [arm64] dts: qcom: sdm845: Fix slimbam num-channels/ees
    - [arm64] dts: qcom: x1e80100-pmics: Disable pm8010 by default
    - [arm64] dts: ti: k3-am62a-main: Fix main padcfg length
    - [arm64] kprobes: call set_memory_rox() for kprobe page
    - [armhf] AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on
      reset)
    - [armhf] OMAP2+: pm33xx-core: ix device node reference leaks in
      amx3_idle_init
    - [arm64] perf/arm-cmn: Fix CMN S3 DTM offset
    - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
    - xen/events: Cleanup find_virq() return codes
    - xen/manage: Fix suspend error path
    - xen/events: Return -EEXIST for bound VIRQs
    - xen/events: Update virq_to_irq on migration
    - [arm64] firmware: meson_sm: fix device leak at probe
    - media: cx18: Add missing check after DMA map
    - media: mc: Fix MUST_CONNECT handling for pads with no links
    - media: pci: ivtv: Add missing check after DMA map
    - media: pci: mg4b: fix uninitialized iio scan data
    - [arm64] media: venus: firmware: Use correct reset sequence for IRIS2
    - media: vivid: fix disappearing <Vendor Command With ID> messages
    - media: lirc: Fix error handling in lirc_register()
    - [arm64] drm/panthor: Fix memory leak in panthor_ioctl_group_create()
    - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
    - drm/xe/uapi: loosen used tracking restriction
    - drm/amd/display: Enable Dynamic DTBCLK Switch
    - blk-crypto: fix missing blktrace bio split events
    - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
    - bus: mhi: ep: Fix chained transfer handling in read path
    - bus: mhi: host: Do not use uninitialized 'dev' pointer in
      mhi_init_irq_setup()
    - [arm64] clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP
      refclk
    - copy_sighand: Handle architectures where sizeof(unsigned long) <
      sizeof(u64)
    - [amd64] cpufreq: intel_pstate: Fix object lifecycle issue in
      update_qos_request()
    - [arm64,armhf] crypto: rockchip - Fix dma_unmap_sg() nents value
    - eventpoll: Replace rwlock with spinlock
    - fbdev: Fix logic error in "offb" name match
    - fs/ntfs3: Fix a resource leak bug in wnd_extend()
    - fs: quota: create dedicated workqueue for quota_release_work
    - fuse: fix possibly missing fuse_copy_finish() call in fuse_notify()
    - fuse: fix livelock in synchronous file put from fuseblk workers
    - iio: dac: ad5360: use int type to store negative error codes
    - iio: dac: ad5421: use int type to store negative error codes
    - iio: frequency: adf4350: Fix prescaler usage.
    - init: handle bootloader identifier in kernel parameters
    - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in
      resume
    - [amd64] iommu/vt-d: PRS isn't usable if PDS isn't supported
    - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in
      sys_prlimit64() paths
    - KEYS: trusted_tpm1: Compare HMAC values in constant time
    - lib/genalloc: fix device leak in of_gen_pool_get()
    - loop: fix backing file reference leak on validation error
    - openat2: don't trigger automounts with RESOLVE_NO_XDEV
    - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
    - [powerpc*] powernv/pci: Fix underflow and leak issue
    - [powerpc*] pseries/msi: Fix potential underflow and leak issue
    - Revert "ipmi: fix msg stack when IPMI is disconnected"
    - sched/deadline: Fix race in push_dl_task()
    - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
    - scsi: sd: Fix build warning in sd_revalidate_disk()
    - sctp: Fix MAC comparison to be constant-time
    - xsk: Harden userspace-supplied xdp_desc validation
    - mmc: core: SPI mode remove cmd7
    - mmc: mmc_spi: multiple block read remove read crc ack
    - [armhf] memory: samsung: exynos-srom: Fix of_iomap leak in
      exynos_srom_probe
    - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
    - rtc: interface: Fix long-standing race when setting alarm
    - [arm64] PCI: xilinx-nwl: Fix ECAM programming
    - [arm64,armhf] PCI: tegra: Convert struct tegra_msi mask_lock into raw
      spinlock
    - PCI/sysfs: Ensure devices are powered for config reads
    - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
    - PCI/ERR: Fix uevent on failure to recover
    - PCI/AER: Fix missing uevent on recovery when a reset is requested
    - PCI/AER: Support errors introduced by PCIe r6.0
    - [arm64] PCI: j721e: Fix programming sequence of "strap" settings
    - spi: cadence-quadspi: Flush posted register writes before INDAC access
    - spi: cadence-quadspi: Flush posted register writes before DAC access
    - spi: cadence-quadspi: Fix cqspi_setup_flash()
    - [x86] fred: Remove ENDBR64 from FRED entry points
    - [x86] umip: Check that the instruction opcode is at least two bytes
    - [x86] umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT
      aliases)
    - [s390x] dasd: enforce dma_alignment to ensure proper buffer validation
    - [s390x] dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request
    - [s390x] Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR
    - slab: prevent warnings when slab obj_exts vector allocation fails
    - slab: mark slab->obj_exts allocation failures unconditionally
    - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
    - wifi: mt76: mt7925u: Add VID/PID for Netgear A9000
    - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
    - mm/thp: fix MTE tag mismatch when replacing zero-filled subpages
    - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
    - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when
      max_huge_pages=0
    - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
    - mm/damon/lru_sort: use param_ctx for damon_attrs staging
    - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
    - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
    - ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches()
    - ext4: verify orphan file size is not too big
    - ext4: increase i_disksize to offset + len in
      ext4_update_disksize_before_punch()
    - ext4: correctly handle queries for metadata mappings
    - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
    - ext4: fix an off-by-one issue during moving extents
    - ext4: guard against EA inode refcount underflow in xattr update
    - ext4: validate ea_ino and size in check_xattrs
    - ACPICA: Allow to skip Global Lock initialization
    - ext4: free orphan info with kvfree
    - media: mc: Clear minor number before put device
    - Squashfs: add additional inode sanity checking
    - Squashfs: reject negative file sizes in squashfs_read_inode()
    - tracing: Fix race condition in kprobe initialization causing NULL pointer
      dereference
    - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
    - [amd64] ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams
    - [amd64] ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples
    - [amd64] mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config
      max_register value
    - [amd64] mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for
      cache_type
    - [amd64] mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config
      flag
    - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
    - cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency
    - [amd64] KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace
    - statmount: don't call path_put() under namespace semaphore
    - [arm64] mte: Do not flag the zero page as PG_mte_tagged
    - [x86] mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state()
    - [x86] kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP
    - nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT
    - NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock()
    - nfsd: refine and rename NFSD_MAY_LOCK
    - nfsd: don't use sv_nrthreads in connection limiting calculations.
    - nfsd: unregister with rpcbind when deleting a transport
    - ACPI: battery: allocate driver data through devm_ APIs
    - ACPI: battery: initialize mutexes through devm_ APIs
    - ACPI: battery: Check for error code from devm_mutex_init() call
    - ACPI: battery: Add synchronization between interface updates
    - ACPI: property: Disregard references in data-only subnode lists
    - ACPI: property: Add code comments explaining what is going on
    - ACPI: property: Do not pass NULL handles to acpi_attach_data()
    - mptcp: pm: in-kernel: usable client side with C-flag
    - ipmi: Rework user message limit handling
    - ipmi: Fix handling of messages with provided receive message pointer
    - mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled
      mTHP subpage to shared zeropage
    - [s390x] bpf: Centralize frame offset calculations
    - [s390x] bpf: Describe the frame using a struct instead of constants
    - [s390x] bpf: Write back tail call counter for BPF_PSEUDO_CALL
    - [s390x] bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
    - [riscv64] irqchip/sifive-plic: Make use of __assign_bit()
    - [riscv64] irqchip/sifive-plic: Avoid interrupt ID 0 handling during
      suspend/resume
    - copy_file_range: limit size if in compat mode
    - minixfs: Verify inode mode when loading from disk
    - pid: Add a judgment for ns null in pid_nr_ns
    - fs: Add 'initramfs_options' to set initramfs mount options
    - cramfs: Verify inode mode when loading from disk
    - writeback: Avoid softlockup when switching many inodes
    - writeback: Avoid excessively long inode switching times
    - sched/fair: Block delayed tasks on throttled hierarchy during dequeue
    - nfsd: fix __fh_verify for localio
    - nfsd: fix access checking for NLM under XPRTSEC policies
    - [amd64] ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA
    - mount: handle NULL values in mnt_ns_release()
    - nfsd: decouple the xprtsec policy check from check_nfsd_access()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.55
    - drm/xe/guc: Check GuC running state before deregistering exec queue
    - smb: client: Fix refcount leak for cifs_sb_tlink
    - slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL
    - r8152: add error handling in rtl8152_driver_init
    - f2fs: fix wrong block mapping for multi-devices
    - jbd2: ensure that all ongoing I/O complete before freeing blocks
    - ext4: wait for ongoing I/O to complete before freeing blocks
    - ext4: detect invalid INLINE_DATA + EXTENTS flag combination
    - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already
      running
    - btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl
    - btrfs: fix incorrect readahead expansion length
    - btrfs: fix memory leaks when rejecting a non SINGLE data profile without
      an RST
    - btrfs: do not assert we found block group item when creating free space
      tree
    - can: gs_usb: gs_make_candev(): populate net_device->dev_port
    - can: gs_usb: increase max interface to U8_MAX
    - cifs: parse_dfs_referrals: prevent oob on malformed input
    - drm/sched: Fix potential double free in
      drm_sched_job_add_resv_dependencies
    - drm/amdgpu: use atomic functions with memory barriers for vm fault info
    - drm/amdgpu: fix gfx12 mes packet status return check
    - perf/core: Fix address filter match with backing files
    - perf/core: Fix MMAP event path names with backing files
    - perf/core: Fix MMAP2 event device with backing files
    - drm/amd: Check whether secure display TA loaded successfully
    - irqdomain: cdx: Switch to of_fwnode_handle()
    - [arm64] drm/msm/a6xx: Fix PDC sleep sequence
    - usb: gadget: Store endpoint pointer in usb_request
    - usb: gadget: Introduce free_usb_request helper
    - usb: gadget: f_ncm: Refactor bind path to use __free()
    - usb: gadget: f_acm: Refactor bind path to use __free()
    - usb: gadget: f_ecm: Refactor bind path to use __free()
    - usb: gadget: f_rndis: Refactor bind path to use __free()
    - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
    - Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()"
      (Closes: #1116358)
    - HID: multitouch: fix sticky fingers
    - dax: skip read lock assertion for read-only filesystems
    - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
    - can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error
      Active
    - can: m_can: m_can_chip_config(): bring up interface in correct state
    - can: m_can: add deinit callback
    - can: m_can: call deinit/init callback when going into suspend/resume
    - can: m_can: fix CAN state in system PM
    - net: dlink: handle dma_map_single() failure properly
    - doc: fix seg6_flowlabel path
    - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
    - net/ip6_tunnel: Prevent perpetual tunnel growth
    - [amd64,arm64] amd-xgbe: Avoid spurious link down messages during interface
      toggle
    - tcp: fix tcp_tso_should_defer() vs large RTT
    - ksmbd: fix recursive locking in RPC handle list access
    - tg3: prevent use of uninitialized remote_adv and local_adv variables
    - tls: trim encrypted message to match the plaintext on short splice
    - tls: wait for async encrypt in case of error during latter iterations of
      sendmsg
    - tls: always set record_type in tls_process_cmsg
    - tls: wait for pending async decryptions if tls_strp_msg_hold fails
    - tls: don't rely on tx_work during send()
    - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
    - net: usb: lan78xx: fix use of improperly initialized dev->chipid in
      lan78xx_reset
    - [arm64] drm/panthor: Ensure MCU is disabled on suspend
    - nvme-multipath: Skip nr_active increments in RETRY disposition
    - [riscv64] kprobes: Fix probe address validation
    - [amd64] ASoC: nau8821: Cancel jdet_work before handling jack ejection
    - [amd64] ASoC: nau8821: Generalize helper to clear IRQ status
    - [amd64] ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
    - [amd64] drm/i915/guc: Skip communication warning on reset in progress
    - drm/amdgpu: add ip offset support for cyan skillfish
    - drm/amdgpu: add support for cyan skillfish without IP discovery
    - drm/amdgpu: fix handling of harvesting for ip_discovery firmware
    - drm/amd/powerplay: Fix CIK shutdown temperature
    - [arm64] drm/rockchip: vop2: use correct destination rectangle height check
    - sched/fair: Fix pelt lost idle time detection
    - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
    - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
    - HID: hid-input: only ignore 0 battery events for digitizers
    - HID: multitouch: fix name of Stylus input devices
    - nvme/tcp: handle tls partially sent records in write_space()
    - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
    - xfs: rename the old_crc variable in xlog_recover_process
    - xfs: fix log CRC mismatches between i386 and other architectures
    - PM: runtime: Add new devm functions
    - iio: imu: inv_icm42600: Simplify pm_runtime setup
    - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
    - nfsd: Use correct error code when decoding extents
    - nfsd: Drop dprintk in blocklayout xdr functions
    - NFSD: Rework encoding and decoding of nfsd4_deviceid
    - NFSD: Minor cleanup in layoutcommit processing
    - NFSD: Implement large extent array support in pNFS
    - NFSD: Fix last write offset handling in layoutcommit
    - wifi: rtw89: avoid possible TX wait initialization race
    - xfs: use deferred intent items for reaping crosslinked blocks
    - padata: Reset next CPU when reorder sequence wraps around
    - md/raid0: Handle bio_split() errors
    - md/raid1: Handle bio_split() errors
    - md/raid10: Handle bio_split() errors
    - md: fix mssing blktrace bio split events
    - [amd64] x86/resctrl: Refactor resctrl_arch_rmid_read()
    - [amd64] x86/resctrl: Fix miscount of bandwidth event when reactivating
      previously unavailable RMID
    - d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier
    - vfs: Don't leak disconnected dentries on umount
    - PCI: Add PCI_VDEVICE_SUB helper macro
    - ixgbevf: Add support for Intel(R) E610 device
    - ixgbevf: fix getting link speed data for E610 devices
    - ixgbevf: fix mailbox API compatibility by negotiating supported features
    - tcp: convert to dev_net_rcu()
    - tcp: cache RTAX_QUICKACK metric in a hot cache line
    - net: dst: add four helpers to annotate data-races around dst->dev
    - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
    - net: Add locking to protect skb->dev access in ip_output
    - mptcp: Call dst_release() in mptcp_active_enable().
    - mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
    - mptcp: reset blackhole on success with non-loopback ifaces
    - NFSD: Define a proc_layoutcommit for the FlexFiles layout type
    - [arm64] cputype: Add Neoverse-V3AE definitions
    - [arm64] errata: Apply workarounds for Neoverse-V3AE
    - [amd64] dmaengine: Add missing cleanup on module unload
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.56
    - exec: Fix incorrect type for ret
    - hfs: clear offset and space out of valid records in b-tree node
    - hfs: make proper initalization of struct hfs_find_data
    - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
    - hfs: validate record offset in hfsplus_bmap_alloc
    - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
    - dlm: check for defined force value in dlm_lockspace_release
    - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
    - hfsplus: return EIO when type of hidden directory mismatch in
      hfsplus_fill_super()
    - PCI: Test for bit underflow in pcie_set_readrq()
    - [arm64] sysreg: Correct sign definitions for EIESB and DoubleLock
    - drivers/perf: hisi: Relax the event ID check in the framework
    - [s390x] mm: Use __GFP_ACCOUNT for user page table allocations
    - smb: server: let smb_direct_flush_send_list() invalidate a remote key
      first
    - PM: EM: Drop unused parameter from em_adjust_new_capacity()
    - PM: EM: Slightly reduce em_check_capacity_update() overhead
    - PM: EM: Move CPU capacity check to em_adjust_new_capacity()
    - PM: EM: Fix late boot with holes in CPU topology
    - net/mlx5e: Return 1 instead of 0 in invalid case in
      mlx5e_mpwrq_umr_entry_size()
    - rtnetlink: Allow deleting FDB entries in user namespace
    - [arm64] net: enetc: fix the deadlock of enetc_mdio_lock
    - [arm64] net: enetc: correct the value of ENETC_RXB_TRUESIZE
    - [arm64] dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
    - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead
    - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ
    - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
    - net/smc: fix general protection fault in __smc_diag_dump
    - [arm64] net: ethernet: ti: am65-cpts: fix timestamp loss due to race
      conditions
    - [arm64] mm: avoid always making PTE dirty in pte_mkwrite()
    - ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
    - sctp: avoid NULL dereference when chunk data buffer is missing
    - net: phy: micrel: always set shared->phydev for LAN8814
    - net/mlx5: Fix IPsec cleanup over MPV device
    - fs/notify: call exportfs_encode_fid with s_umount
    - net: bonding: fix possible peer notify event loss or dup issue
    - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
    - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
    - btrfs: directly free partially initialized fs_info in
      btrfs_check_leaked_roots()
    - gpio: pci-idio-16: Define maximum valid register address offset
    - gpio: 104-idio-16: Define maximum valid register address offset
    - xfs: fix locking in xchk_nlinks_collect_dir
    - Revert "cpuidle: menu: Avoid discarding useful information"
    - slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts
    - slab: Fix obj_ext mistakenly considered NULL due to race condition
    - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
    - can: netlink: can_changelink(): allow disabling of automatic restart
    - cifs: Fix TCP_Server_Info::credits to be signed
    - ocfs2: clear extent cache after moving/defragmenting extents
    - vsock: fix lock inversion in vsock_assign_transport()
    - [arm64,armhf] net: stmmac: dwmac-rk: Fix disabling set_clock_selection
    - net: usb: rtl8150: Fix frame padding
    - mm: prevent poison consumption when splitting THP
    - drm/amd/display: increase max link count and fix link->enc NULL pointer
      access
    - [arm64] spi: spi-nxp-fspi: add extra delay after dll locked
    - [arm64] dts: broadcom: bcm2712: Add default GIC address cells
    - [arm64] dts: broadcom: bcm2712: Define VGIC interrupt
    - [arm64] firmware: arm_scmi: Account for failed debug initialization
    - [arm64] firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing
      in raw mode
    - [arm64] drm/panthor: Fix kernel panic on partial unmap of a GPU VA region
    - [riscv64] Define pgprot_dmacoherent() for non-coherent devices
    - [riscv64] Don't print details of CPUs disabled in DT
    - [riscv64] hwprobe: avoid uninitialized variable use in hwprobe_arch_id()
    - hwmon: (sht3x) Fix error handling
    - nbd: override creds to kernel when calling sock_{send,recv}msg()
    - drm/panic: Fix drawing the logo on a small narrow screen
    - drm/panic: Fix qr_code, ensure vmargin is positive
    - [amd64] gpio: ljca: Fix duplicated IRQ mapping
    - io_uring: correct __must_hold annotation in io_install_fixed_file
    - sched: Remove never used code in mm_cid_get()
    - io_uring/sqpoll: switch away from getrusage() for CPU accounting
    - io_uring/sqpoll: be smarter on when to update the stime usage
    - Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP
      (Closes: #1118660)
    - platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
      (CVE-2025-39678)
    - USB: serial: option: add UNISOC UIS7720
    - USB: serial: option: add Quectel RG255C
    - USB: serial: option: add Telit FN920C04 ECM compositions
    - usb/core/quirks: Add Huawei ME906S to wakeup quirk
    - usb: raw-gadget: do not limit transfer length
    - xhci: dbc: enable back DbC in resume if it was enabled before suspend
    - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall
      event
    - [amd64] x86/microcode: Fix Entrysign revision check for Zen1/Naples
    - [arm*] binder: remove "invalid inc weak" check
    - [amd64] comedi: fix divide-by-zero in comedi_buf_munge() (CVE-2025-40106)
    - [amd64] mei: me: add wildcat lake P DID
    - [arm64] misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
    - [amd64,arm64] tcpm: switch check for role_sw device with fw_node
    - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
    - serial: 8250_dw: handle reset control deassert error
    - serial: 8250_exar: add support for Advantech 2 port card with Device ID
      0x0018
    - [arm64] serial: 8250_mtk: Enable baud clock and manage in runtime PM
    - serial: sc16is7xx: remove useless enable of enhanced features
    - devcoredump: Fix circular locking dependency with devcd->mutex.
    - [arm64] mte: Do not warn if the page is already tagged in copy_highpage()
    - xfs: always warn about deprecated mount options
    - ksmbd: transport_ipc: validate payload size before reading handle
      (CVE-2025-40084)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.57
    - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083)
    - audit: record fanotify event regardless of presence of rules
    - [amd64] perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into
      INTEL_FIXED_BITS_MASK
    - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of
      current->mm == NULL
    - perf: Have get_perf_callchain() return NULL if crosstask and user are set
    - perf: Skip user unwind if the task is a kernel thread
    - seccomp: passthrough uprobe systemcall without filtering
    - [amd64] x86/bugs: Report correct retbleed mitigation status
    - [amd64] x86/bugs: Fix reporting of LFENCE retpoline
    - [amd64,arm64] EDAC/mc_sysfs: Increase legacy channel support to 16
    - cpuset: Use new excpus for nocpu error check when enabling root partition
    - btrfs: abort transaction on specific error places when walking log tree
    - btrfs: abort transaction in the process_one_buffer() log tree walk
      callback
    - btrfs: zoned: return error from btrfs_zone_finish_endio()
    - btrfs: zoned: refine extent allocator hint selection
    - btrfs: scrub: replace max_t()/min_t() with clamp() in
      scrub_throttle_dev_io()
    - btrfs: always drop log root tree reference in btrfs_replay_log()
    - btrfs: use level argument in log tree walk callback replay_one_buffer()
    - btrfs: abort transaction if we fail to update inode in log replay dir
      fixup
    - btrfs: tree-checker: add inode extref checks
    - btrfs: use smp_mb__after_atomic() when forcing COW in
      create_pending_snapshot()
    - sched_ext: Make qmap dump operation non-destructive
    - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
    - docs: kdoc: handle the obsolescensce of docutils.ErrorString()
    - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
    - f2fs: fix to avoid panic once fallocation fails for pinfile
      (CVE-2025-23130)
    - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
      (CVE-2025-38643)
    - bonding: return detailed error when loading native XDP fails
    - bonding: check xdp prog when set bond mode (CVE-2025-22105)
    - bits: add comments and newlines to #if, #else and #endif directives
    - bits: introduce fixed-type GENMASK_U*()
    - gpio: regmap: Allow to allocate regmap-irq device
    - gpio: regmap: add the .fixed_direction_output configuration parameter
    - gpio: idio-16: Define fixed direction of the GPIO lines
    - [amd64] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (CVE-2025-21833)
    - wifi: ath12k: fix read pointer after free in
      ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
    - [amd64,arm64] udmabuf: fix a buf size overflow issue during udmabuf
      creation (CVE-2025-37803)
    - sfc: fix NULL dereferences in ef100_process_design_param()
      (CVE-2025-37860)
    - btrfs: tree-checker: fix bounds check in check_inode_extref()

  [ Salvatore Bonaccorso ]
  * drivers/infiniband/hw/bnxt_re: Enable INFINIBAND_BNXT_RE as module
    (Closes: #1109977)

  [ Ben Hutchings ]
  * d/salsa-ci.yml: Adjust filenames to allow source package name suffix
  * tools/hv: Make the sample hv_get_dhcp_info script more useful
  * hyperv-daemons: Install the sample network info scripts (Closes: #919350)
  * d/salsa-ci.yml: Fix cache configuration for build job
  * d/salsa-ci.yml: Move orig tarball generation to a separate job again
  * d/salsa-ci.yml: Restore lintian checking of source package

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 05 Nov 2025 15:56:27 +0100

linux (6.12.48-1) trixie-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.44
    - serial: 8250: fix panic due to PSLVERR
    - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
    - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
    - PM: runtime: Take active children into account in
      pm_runtime_get_if_in_use()
    - dm: dm-crypt: Do not partially accept write BIOs with zoned targets
    - dm: Check for forbidden splitting of zone write operations
    - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
    - usb: gadget: udc: renesas_usb3: fix device leak at unbind
    - usb: musb: omap2430: fix device leak at unbind
    - [arm64,armhf] usb: dwc3: meson-g12a: fix device leaks at unbind
    - [arm64] usb: dwc3: imx8mp: fix device leak at unbind
    - bus: mhi: host: Fix endianness of BHI vector table
    - bus: mhi: host: Detect events pointing to unexpected TREs
    - vt: keyboard: Don't process Unicode characters in K_OFF mode
    - vt: defkeymap: Map keycodes above 127 to K_HOLE
    - [amd64] crypto: qat - lower priority for skcipher and aead algorithms
    - [arm64,armhf] crypto: caam - Prevent crash on suspend with iMX8QM /
      iMX8ULP
    - [amd64] crypto: qat - flush misc workqueue during device shutdown
    - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
    - ksmbd: fix refcount leak causing resource not released
    - ksmbd: extend the connection limiting mechanism to support IPv6
    - tracing: fprobe-event: Sanitize wildcard for fprobe event name
    - ext4: check fast symlink for ea_inode correctly
    - ext4: fix fsmap end of range reporting with bigalloc
    - ext4: fix reserved gdt blocks handling in fsmap
    - ext4: use kmalloc_array() for array space allocation
    - ext4: fix hole length calculation overflow in non-extent inodes
    - btrfs: zoned: fix write time activation failure for metadata block group
    - btrfs: fix incorrect log message for nobarrier mount option
    - btrfs: restore mount option info messages during mount
    - btrfs: fix printing of mount info messages for NODATACOW/NODATASUM
    - apparmor: Fix 8-byte alignment for initial dfa blob streams
    - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
    - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks
      constraints
    - scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host
    - [arm64] scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
    - scsi: mpi3mr: Fix race between config read submit and interrupt completion
    - ata: libata-scsi: Fix ata_to_sense_error() status handling
    - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host
      controllers
    - scsi: ufs: ufs-pci: Fix default runtime and system PM levels
    - ata: libata-scsi: Fix CDL control
    - [arm64] soc: qcom: mdt_loader: Ensure we don't read past the ELF header
    - iio: imu: bno055: fix OOB access of hw_xlate array
    - iio: adc: ad_sigma_delta: change to buffer predisable
    - wifi: brcmsmac: Remove const from tbl_ptr parameter in
      wlc_lcnphy_common_read_table()
    - wifi: ath12k: fix dest ring-buffer corruption
    - wifi: ath12k: fix source ring-buffer corruption
    - wifi: ath12k: fix dest ring-buffer corruption when ring is full
    - wifi: ath11k: fix dest ring-buffer corruption
    - wifi: ath11k: fix source ring-buffer corruption
    - wifi: ath11k: fix dest ring-buffer corruption when ring is full
    - [arm64] pwm: mediatek: Handle hardware enable and clock enable separately
    - [arm64] pwm: mediatek: Fix duty and period setting
    - mtd: spi-nor: Fix spi_nor_try_unlock_all()
    - [arm64] mtd: spinand: propagate spinand_wait() errors from
      spinand_write_page()
    - readahead: fix return value of page_cache_next_miss() when no hole is
      found
    - PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
    - PCI: endpoint: Fix configfs group list head handling
    - PCI: endpoint: Fix configfs group removal on driver teardown
    - [arm64,armhf] PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4
      in epc_features
    - [arm64,armhf] PCI: imx6: Remove apps_reset toggling from
      imx_pcie_{assert/deassert}_core_reset
    - [arm64,armhf] PCI: imx6: Delay link start until configfs 'start' written
    - vsock/virtio: Validate length in packet header before skb_put()
    - vhost/vsock: Avoid allocating arbitrarily-sized SKBs
    - amdgpu/amdgpu_discovery: increase timeout limit for IFWI init
    - [amd64] ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in
      resume context
    - f2fs: fix to avoid out-of-boundary access in dnode page (CVE-2025-38677)
    - jbd2: prevent softlockup in jbd2_log_do_checkpoint()
    - kbuild: userprogs: use correct linker when mixing clang and GNU ld
    - [arm64,armhf] soc/tegra: pmc: Ensure power-domains are in a known state
    - media: gspca: Add bounds checking to firmware parser
    - media: hi556: correct the test pattern configuration
    - [armhf] media: imx: fix a potential memory leak in
      imx_media_csc_scaler_device_init()
    - media: ipu6: isys: Use correct pads for xlate_streams()
    - media: vivid: fix wrong pixel_array control size
    - media: verisilicon: Fix AV1 decoder clock frequency
    - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
    - media: usbtv: Lock resolution while streaming
    - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
    - media: pisp_be: Fix pm_runtime underrun in probe
    - media: ov2659: Fix memory leaks in ov2659_probe()
    - media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
    - media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable()
      calls
    - [arm64] media: qcom: camss: cleanup media device allocated resource on
      error path
    - [arm64] media: venus: Add a check for packet size after reading from
      shared memory
    - [arm64] media: venus: Fix MSM8998 frequency table
    - [arm64] media: venus: hfi: explicitly release IRQ during teardown
    - [arm64] media: venus: protect against spurious interrupts during probe
    - [arm64] media: venus: vdec: Clamp param smaller than 1fps and bigger than
      240.
    - [arm64] media: venus: venc: Clamp param smaller than 1fps and bigger than
      240
    - drm/amdgpu/discovery: fix fw based ip discovery
    - drm/amd: Restore cached power limit during resume
    - drm/amdgpu: Avoid extra evict-restore process.
    - drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
    - drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram()
    - drm/amdgpu: Update external revid for GC v9.5.0
    - drm/amdgpu: update mmhub 3.0.1 client id mappings
    - drm/amdgpu: update mmhub 4.1.0 client id mappings
    - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
    - drm/amd/display: Add primary plane to commits for correct VRR handling
    - drm/amd/display: fix a Null pointer dereference vulnerability
    - drm/amd/display: Don't overwrite dce60_clk_mgr
    - net, hsr: reject HSR frame if skb can't hold tag
    - sched/ext: Fix invalid task state transitions on class switch
    - ipv6: sr: Fix MAC comparison to be constant-time
    - ACPI: pfr_update: Fix the driver update version check
    - mptcp: drop skb if MPTCP skb extension allocation fails
    - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
    - mm/damon/ops-common: ignore migration request to invalid nodes
    - [amd64] x86/sev: Ensure SVSM reserved fields in a page validation entry
      are initialized to zero
    - USB: typec: Use str_enable_disable-like helpers
    - usb: typec: fusb302: cache PD RX state
    - btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb()
    - btrfs: qgroup: fix race between quota disable and quota rescan ioctl
    - btrfs: move transaction aborts to the error site in
      add_block_group_free_space()
    - btrfs: always abort transaction on failure to add block group to free
      space tree
    - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
    - btrfs: explicitly ref count block_group on new_bgs list
    - btrfs: codify pattern for adding block_group to bg_list
    - btrfs: zoned: requeue to unused block group list if zone finish failed
    - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
    - btrfs: send: factor out common logic when sending xattrs
    - btrfs: send: only use boolean variables at process_recorded_refs()
    - btrfs: send: add and use helper to rename current inode when processing
      refs
    - btrfs: send: keep the current inode's path cached
    - btrfs: send: avoid path allocation for the current inode when issuing
      commands
    - btrfs: send: use fallocate for hole punching with send stream v2
    - btrfs: send: make fs_path_len() inline and constify its argument
    - netfs: Fix unbuffered write error handling
    - io_uring/net: commit partial buffers on retry
    - ata: libata-scsi: Return aborted command when missing sense and result TF
    - sched_ext: initialize built-in idle state before ops.init()
    - Revert "can: ti_hecc: fix -Woverflow compiler warning"
    - io_uring/futex: ensure io_futex_wait() cleans up properly on failure
    - iov_iter: iterate_folioq: fix handling of offset >= folio size
    - [arm64] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
    - mmc: sdhci-pci-gli: Add a new function to simplify the code
    - memstick: Fix deadlock by moving removing flag earlier
    - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
    - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
    - NFS: Fix a race when updating an existing write
    - squashfs: fix memory leak in squashfs_fill_super
    - mm/debug_vm_pgtable: clear page table entries at destroy_args()
    - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
    - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook
      830 G6
    - RDMA/rxe: Flush delayed SKBs while releasing RXE resources
    - [s390x] sclp: Fix SCCB present check
    - [amd64] platform/x86/intel-uncore-freq: Check write blocked for ELC
    - kvm: retry nx_huge_page_recovery_thread creation
    - [amd64] accel/habanalabs/gaudi2: Use kvfree() for memory allocated with
      kvcalloc()
    - drm/amdgpu/swm14: Update power limit logic
    - drm/amd/display: Avoid a NULL pointer dereference
    - drm/amd/display: Don't overclock DCE 6 by 15%
    - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
    - drm/amd/display: Fix Xorg desktop unresponsive on Replay panel
    - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
    - drm/amd/display: Find first CRTC and its line time in
      dce110_fill_display_configs
    - drm/amd/display: Fill display clock and vblank time in
      dce110_fill_display_configs
    - scsi: core: Fix command pass through retry regression
    - [arm64] soc: qcom: mdt_loader: Fix error return values in
      mdt_header_valid()
    - mptcp: remove duplicate sk_reset_timer call
    - mptcp: disable add_addr retransmission when timeout is 0
    - Mark xe driver as BROKEN if kernel page size is not 4kB
    - [arm64,armhf] PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support
    - [arm64,armhf] PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features
    - [arm64] PCI: rockchip: Use standard PCIe definitions
    - [arm64] PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
    - iio: adc: ad7173: fix setting ODR in probe
    - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
    - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
    - ext4: preserve SB_I_VERSION on remount
    - btrfs: subpage: keep TOWRITE tag until folio is cleaned
    - [arm64] dts: ti: k3-am6*: Add boot phase flag to support MMC boot
    - [arm64] dts: ti: k3-am62*: Add non-removable flag for eMMC
    - [arm64] dts: ti: k3-am6*: Remove disable-wp for eMMC
    - [arm64] dts: ti: k3-am62*: Move eMMC pinmux to top level board file
    - debugfs: fix mount options not being applied
    - smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
    - fs/buffer: fix use-after-free when call bh_read() helper
    - use uniform permission checks for all mount propagation changes
    - cpuidle: menu: Remove iowait influence
    - cpuidle: governors: menu: Avoid selecting states with too much latency
    - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
    - [arm64] mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1
    - ftrace: Also allocate and copy hash for reading of filter files
    - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
    - iio: proximity: isl29501: fix buffered read on big-endian systems
    - most: core: Drop device reference after usage in get_channel()
    - kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq()
    - cdx: Fix off-by-one error in cdx_rpmsg_probe()
    - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
    - [amd64] comedi: Make insn_rw_emulate_bits() do insn->n samples
    - [amd64] comedi: pcl726: Prevent invalid irq number
    - [amd64] comedi: Fix use of uninitialized memory in do_insn_ioctl() and
      do_insnlist_ioctl()
    - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE
      test
    - usb: renesas-xhci: Fix External ROM access timeouts
    - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
    - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
    - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
    - usb: typec: maxim_contaminant: disable low power mode when reading
      comparator values
    - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port
      is clean
    - usb: xhci: Fix slot_id resource race conflict
    - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
    - usb: dwc3: Remove WARN_ON for device endpoint command timeouts
    - usb: dwc3: pci: add support for the Intel Wildcat Lake
    - iio: light: Use aligned_s64 instead of open coding alignment.
    - iio: light: as73211: Ensure buffer holes are zeroed
    - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
    - tracing: Remove unneeded goto out logic
    - tracing: Limit access to parser->buffer when trace_get_user failed
    - [amd64] drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
    - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
    - [amd64] drm/i915/icl+/tc: Cache the max lane count value
    - ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()
    - tls: fix handling of zero-length records on the rx_list
    - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to
      aligned_s64
    - iio: imu: inv_icm42600: use = { } instead of memset()
    - iio: imu: inv_icm42600: Convert to uXX and sXX integer types
    - iio: imu: inv_icm42600: change invalid data error to -EBUSY
    - [amd64] x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
    - drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
    - cgroup/cpuset: Use static_branch_enable_cpuslocked() on
      cpusets_insane_config_key
    - cgroup/cpuset: Fix a partition error with CPU hotplug
    - drm/panic: Move drawing functions to drm_draw
    - drm/format-helper: Add conversion from XRGB8888 to BGR888
    - drm/format-helper: Move helpers for pixel conversion to header file
    - drm/format-helper: Add generic conversion to 32-bit formats
    - iosys-map: Fix undefined behavior in iosys_map_clear()
    - [arm64] RDMA/hns: Fix querying wrong SCC context for DIP algorithm
    - RDMA/bnxt_re: Fix to do SRQ armena by default
    - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
    - RDMA/bnxt_re: Fix a possible memory leak in the driver
    - RDMA/bnxt_re: Fix to initialize the PBL array
    - RDMA/hns: Fix dip entries leak on devices newer than hip09
    - net: bridge: fix soft lockup in br_multicast_query_expired()
    - scsi: qla4xxx: Prevent a potential error pointer dereference
    - [amd64] iommu/amd: Avoid stack buffer overflow from kernel cmdline
      (CVE-2025-38676)
    - Bluetooth: hci_sync: Fix scan state after PA Sync has been established
    - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
    - Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF
    - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
    - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
    - [arm64] drm/hisilicon/hibmc: refactored struct hibmc_drm_private
    - [arm64] drm/hisilicon/hibmc: fix the i2c device resource leak when vdac
      init failed
    - [arm64] drm/hisilicon/hibmc: fix the hibmc loaded failed bug
    - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
    - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
    - drm/amd/display: Don't print errors for nonexistent connectors
    - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
    - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
    - [arm64] net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
    - ppp: fix race conditions in ppp_fill_forward_path
    - net: ti: icssg-prueth: Fix HSR and switch offload Enablement during
      firwmare reload.
    - cifs: Fix oops due to uninitialised variable
    - phy: mscc: Fix timestamping for vsc8584
    - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
    - gve: prevent ethtool ops after shutdown
    - net/smc: fix UAF on smcsk after smc_listen_out()
    - [s390x] mm: Do not map lowcore with identity mapping
    - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
    - igc: fix disabling L1.2 PCI-E link substate on I226 on init
    - [armhf] net: dsa: microchip: Fix KSZ9477 HSR port setup issue
    - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
    - net/sched: Remove unnecessary WARNING condition for empty child qdisc in
      htb_activate
    - ALSA: timer: fix ida_free call while not allocated
    - bonding: update LACP activity flag after setting lacp_active
    - bonding: send LACPDUs periodically in passive mode after receiving
      partner's LACPDU
    - [arm64] Octeontx2-af: Skip overlap check for SPI field
    - net/mlx5: Base ECVF devlink port attrs from 0
    - net/mlx5: Relocate function declarations from port.h to mlx5_core.h
    - net/mlx5: Add IFC bits and enums for buf_ownership
    - net/mlx5e: Query FW for buffer ownership
    - net/mlx5e: Preserve shared buffer capacity during headroom updates
    - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
    - [s390x] hypfs: Avoid unnecessary ioctl registration in debugfs
    - [s390x] hypfs: Enable limited access during lockdown
    - netfilter: nf_reject: don't leak dst refcount for loopback packets
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.45
    - rtla: Check pkg-config install
    - trace/fgraph: Fix the warning caused by missing unregister notifier
    - of: dynamic: Fix memleak when of_pci_add_properties() failed
    - of: dynamic: Fix use after free in of_changeset_add_prop_helper()
    - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
    - perf symbol-minimal: Fix ehdr reading in filename__read_build_id
    - vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
    - scsi: core: sysfs: Correct sysfs attributes access rights
    - smb: client: fix race with concurrent opens in unlink(2)
    - smb: client: fix race with concurrent opens in rename(2)
    - [arm64] ASoC: codecs: tx-macro: correct tx_macro_component_drv name
    - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
    - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
    - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
    - [arm64] drm/msm: Defer fd_install in SUBMIT ioctl
    - of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
    - [arm64] drm/msm/kms: move snapshot init earlier in KMS init
    - [arm64] drm/msm: update the high bitfield of certain DSI registers
    - [arm64] drm/mediatek: Add error handling for old state CRTC in
      atomic_disable
    - [powerpc*] kvm: Fix ifdef to remove build warning
    - HID: input: rename hidinput_set_battery_charge_status()
    - HID: input: report battery status changes immediately
    - net: macb: fix unregister_netdev call order in macb_remove()
    - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
    - Bluetooth: hci_event: Mark connection as closed during suspend disconnect
    - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
    - Bluetooth: hci_sync: fix set_local_name race condition
    - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
    - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
    - drm/nouveau: remove unused memory target test
    - ice: don't leave device non-functional if Tx scheduler config fails
    - ice: use fixed adapter index for E825C embedded devices
    - ice: fix incorrect counter for buffer allocation failures
    - dt-bindings: display/msm: qcom,mdp5: drop lut clock
    - net: dlink: fix multicast stats being counted incorrectly
    - drm/xe/xe_sync: avoid race during ufence signaling
    - drm/xe: Don't trigger rebind on initial dma-buf validation
    - phy: mscc: Fix when PTP clock is register and unregister
    - bnxt_en: Fix memory corruption when FW resources change during ifdown
    - bnxt_en: Adjust TX rings if reservation is less than requested
    - bnxt_en: Fix stats context reservation logic
    - net/mlx5: Reload auxiliary drivers on fw_activate
    - net/mlx5: Fix lockdep assertion on sync reset unload event
    - net/mlx5: Nack sync reset when SFs are present
    - net/mlx5e: Update and set Xon/Xoff upon MTU set
    - net/mlx5e: Update and set Xon/Xoff upon port speed set
    - net/mlx5e: Set local Xoff after FW update
    - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
    - net: stmmac: xgmac: Correct supported speed modes
    - net: stmmac: Set CIC bit only for TX queues with COE
    - [amd64,arm64] hv_netvsc: Link queues to NAPIs
    - [amd64,arm64] net: hv_netvsc: fix loss of early receive events from host
      during channel open.
    - net: rose: split remove and free operations in rose_remove_neigh()
    - net: rose: convert 'use' field to refcount_t
    - net: rose: include node references in rose_neigh refcount
    - sctp: initialize more fields in sctp_v6_from_sk()
    - l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
    - fbnic: Move phylink resume out of service_task and into open/close
    - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
    - net: macb: Disable clocks once
    - [amd64] KVM: x86: use array_index_nospec with indices that come from guest
    - [riscv64] KVM: fix stack overrun when loading vlenb
    - [amd64] x86/microcode/AMD: Handle the case of no BIOS microcode
    - [amd64] x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on
      AMD/HYGON
    - HID: asus: fix UAF via HID_CLAIMED_INPUT validation
    - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
    - HID: quirks: add support for Legion Go dual dinput modes
    - HID: logitech: Add ids for G PRO 2 LIGHTSPEED
    - HID: wacom: Add a new Art Pen 2
    - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
    - Revert "drm/amdgpu: fix incorrect vm flags to map bo"
    - blk-zoned: Fix a lockdep complaint about recursive locking
    - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
    - fs/smb: Fix inconsistent refcnt update
    - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
    - smb3 client: fix return code mapping of remap_file_range
    - xfs: do not propagate ENODATA disk errors into xattr code
    - drm/xe/vm: Clear the scratch_pt pointer on error
    - drm/nouveau/disp: Always accept linear modifier
    - drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
    - drm/mediatek: Fix device/node reference count leaks in
      mtk_drm_get_all_drm_priv
    - drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
    - net: rose: fix a typo in rose_clear_routes()
    - PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS
    - PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up
    - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to
      LANE0_1_STATUS"
    - [arm64] thermal/drivers/mediatek/lvts_thermal: Change lvts commands array
      to static const
    - [arm64] thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their
      sizes to driver data
    - [arm64] thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.46
    - bpf: Add cookie object to bpf maps
    - bpf: Move bpf map owner out of common struct
    - bpf: Move cgroup iterator helpers to bpf.h
    - bpf: Fix oob access in cgroup local storage (CVE-2025-38502)
    - btrfs: fix race between logging inode and checking if it was logged before
    - btrfs: fix race between setting last_dir_index_offset and inode logging
    - btrfs: avoid load/store tearing races when checking if an inode was logged
    - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
    - drm/amd/display: Don't warn when missing DCE encoder caps
    - cpupower: Fix a bug where the -t option of the set subcommand was not
      working.
    - Bluetooth: hci_sync: Avoid adding default advertising on startup
    - btrfs: zoned: skip ZONE FINISH of conventional zones
    - fs: writeback: fix use-after-free in __mark_inode_dirty()
    - tee: fix NULL pointer dereference in tee_shm_put
    - tee: fix memory leak in tee_dyn_shm_alloc_helper
    - [arm64] dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
    - [arm64] tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
    - [arm64] dts: imx8mp-tqma8mpql: fix LDO5 power off
    - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics
      i.MX8M Plus DHCOM
    - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M
      Plus eDM SBC
    - HID: simplify snto32()
    - HID: stop exporting hid_snto32()
    - HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)
    - net: usb: qmi_wwan: fix Telit Cinterion FN990A name
    - net: usb: qmi_wwan: fix Telit Cinterion FE990A name
    - net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition
    - [arm64] mmc: sdhci-of-arasan: Support for emmc hardware reset
    - [arm64] mmc: sdhci-of-arasan: Ensure CD logic stabilization before
      power-up
    - wifi: cfg80211: fix use-after-free in cmp_bss()
    - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info
      work
    - wifi: mt76: mt7925: fix locking in mt7925_change_vif_links()
    - wifi: mt76: prevent non-offchannel mgmt tx during scan/roc
    - wifi: mt76: free pending offchannel tx frames on wcid cleanup
    - wifi: mt76: fix linked list corruption
    - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in()
      after confirm
    - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
    - wifi: iwlwifi: uefi: check DSM item validity
    - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
    - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
    - netfilter: nft_flowtable.sh: re-run with random mtu sizes
    - net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y
    - [amd64] xirc2ps_cs: fix register access when enabling FullDuplex
    - mISDN: Fix memory leak in dsp_hwec_enable()
    - bnxt_en: fix incorrect page count in RX aggr ring log
    - icmp: fix icmp_ndo_send address translation for reply direction
    - net: macb: Fix tx_ptr_lock locking
    - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
    - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
    - net: mctp: mctp_fraq_queue should take ownership of passed skb
    - ice: fix NULL access of tx->in_use in ice_ll_ts_intr
    - [amd64,arm64] idpf: set mac type when adding and removing MAC filters
    - i40e: remove read access to debugfs files
    - i40e: Fix potential invalid access when MAC list is empty
    - ixgbe: fix incorrect map used in eee linkmode
    - wifi: ath11k: fix group data packet drops during rekey
    - net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
    - [arm64] net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
    - net: skb: add pskb_network_may_pull_reason() helper
    - net: tunnel: add pskb_inet_may_pull_reason() helper
    - net: vxlan: add skb drop reasons to vxlan_rcv()
    - net: vxlan: make vxlan_snoop() return drop reasons
    - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
    - net: vxlan: make vxlan_set_mac() return drop reasons
    - net: vxlan: use kfree_skb_reason() in vxlan_xmit()
    - net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit()
    - net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE
    - vxlan: Refresh FDB 'updated' time upon 'NTF_USE'
    - vxlan: Avoid unnecessary updates to FDB 'used' time
    - vxlan: Add RCU read-side critical sections in the Tx path
    - vxlan: Rename FDB Tx lookup function
    - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
    - wifi: cw1200: cap SSID length in cw1200_do_join()
    - wifi: libertas: cap SSID len in lbs_associate()
    - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
    - [arm64] net: thunder_bgx: add a missing of_node_put
    - [arm64] net: thunder_bgx: decrement cleanup index before use
    - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
    - net/smc: Remove validation of reserved bits in CLC Decline message
    - mctp: return -ENOPROTOOPT for unknown getsockopt options
    - ax25: properly unshare skbs in ax25_kiss_rcv()
    - net: atm: fix memory leak in atm_register_sysfs when device_register fail
    - ppp: fix memory leak in pad_compress_skb
    - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
    - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
    - [amd64] accel/ivpu: Prevent recovery work from being queued during device
      removal
    - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
    - [arm64] ftrace: fix unreachable PLT for ftrace_caller in init_module with
      CONFIG_DYNAMIC_FTRACE
    - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
    - io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
      (CVE-2025-38453)
    - [amd64] x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and
      arch_sync_kernel_mappings()
    - mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
    - mm: move page table sync declarations to linux/pgtable.h
    - mm: fix possible deadlock in kmemleak
    - mm: slub: avoid wake up kswapd in set_track_prepare
    - sched: Fix sched_numa_find_nth_cpu() if mask offline
    - ocfs2: prevent release journal inode after journal shutdown
    - of_numa: fix uninitialized memory nodes causing kernel panic
    - [arm64] soc: qcom: mdt_loader: Deal with zero e_shentsize
    - wifi: mwifiex: Initialize the chan_stats array to zero
    - wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete
    - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
    - wifi: mt76: mt7925: fix the wrong bss cleanup for SAP
    - net: ethernet: oa_tc6: Handle failure of spi_setup
    - drm/amdgpu: drop hw access in non-DC audio fini
    - drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG
    - [amd64] platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042
      quirks list
    - scsi: lpfc: Fix buffer free/clear order in deferred receive path
    - batman-adv: fix OOB read/write in network-coding decode
    - cifs: prevent NULL pointer dereference in UTF16 conversion
    - e1000e: fix heap overflow in e1000_set_eeprom
    - net: pcs: rzn1-miic: Correct MODCTRL register offset
    - fs/fhandle.c: fix a race in call of has_locked_children() (CVE-2025-38306)
    - [arm64,armhf] net: dsa: add hook to determine whether EEE is supported
    - [arm64,armhf] net: dsa: provide implementation of .support_eee()
    - [armhf] net: dsa: b53/bcm_sf2: implement .support_eee() method
    - [armhf] net: dsa: b53: do not enable EEE on bcm63xx (CVE-2025-38272)
    - md/raid1,raid10: don't ignore IO flags (CVE-2025-22125)
    - md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT
    - md/raid1,raid10: strip REQ_NOWAIT from member bios
    - ext4: define ext4_journal_destroy wrapper
    - ext4: avoid journaling sb update on error if journal is destroying
      (CVE-2025-22113)
    - wifi: ath11k: update channel list in reg notifier instead reg worker
      (CVE-2025-23133)
    - wifi: ath11k: update channel list in worker when wait flag is set
    - net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103)
    - md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
      (CVE-2025-22124)
    - mm: slub: Print the broken data before restoring them
    - mm: slub: call WARN() when detecting a slab corruption
    - mm, slab: cleanup slab_bug() parameters
    - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
    - nouveau: fix disabling the nonstall irq due to storm code
    - mm: fix accounting of memmap pages
    - [arm64] thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum
      threshold
    - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
    - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
    - Revert "drm/amdgpu: Avoid extra evict-restore process."
    - pcmcia: omap: Add missing check for platform_get_resource
    - pcmcia: Add error handling for add_interval() in do_validate_mem()
    - [amd64] platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan
      quirk
    - [amd64] platform/x86/intel: power-domains: Use
      topology_logical_package_id() for package ID
    - block: add a queue_limits_commit_update_frozen helper
    - scsi: sr: Reinstate rotational media flag
    - drm/bridge: ti-sn65dsi86: fix REFCLK setting
    - perf bpf-event: Fix use-after-free in synthesis
    - perf bpf-utils: Constify bpil_array_desc
    - perf bpf-utils: Harden get_bpf_prog_info_linear
    - drm/amd/amdgpu: Fix missing error return on kzalloc failure
    - tools: gpio: remove the include directory on make clean
    - md: prevent incorrect update of resync/recovery offset
    - [riscv64] ACPI: RISC-V: Fix FFH_CPPC_CSR error handling
    - [riscv64] Only allow LTO with CMODEL_MEDANY
    - [riscv64] use lw when reading int cpu in new_vmalloc_check
    - [riscv64] use lw when reading int cpu in asm_per_cpu
    - [riscv64] bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG
    - [riscv64] bpf: use lw when reading int cpu in bpf_get_smp_processor_id
    - md/raid1: fix data lost for writemostly rdev
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.47
    - [amd64] Add mitigations for VMSCAPE (CVE-2025-40300):
      - Documentation/hw-vuln: Add VMSCAPE documentation
      - x86/vmscape: Enumerate VMSCAPE bug
      - x86/vmscape: Add conditional IBPB mitigation
      - x86/vmscape: Enable the mitigation
      - x86/bugs: Move cpu_bugs_smt_update() down
      - x86/vmscape: Warn when STIBP is disabled with SMT
      - x86/vmscape: Add old Intel CPUs to affected list
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.48
    - fhandle: use more consistent rules for decoding file handle from userns
    - dma-debug: store a phys_addr_t in struct dma_debug_entry
    - dma-mapping: trace dma_alloc/free direction
    - dma-mapping: use trace_dma_alloc for dma_alloc* instead of using
      trace_dma_map
    - dma-mapping: trace more error paths
    - dma-debug: don't enforce dma mapping check on noncoherent allocations
    - net/mlx5: HWS, change error flow on matcher disconnect
    - mm: introduce and use {pgd,p4d}_populate_kernel()
    - dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err
    - dma-debug: fix physical address calculation for struct dma_debug_entry
    - nvme-pci: skip nvme_write_sq_db on empty rqlist
    - Revert "udmabuf: fix vmap_udmabuf error page set"
    - ext4: introduce linear search for dentries
    - [amd64] drm/i915/pmu: Fix zero delta busyness issue
    - drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed
    - Revert "drm/amd/display: Optimize cursor position updates"
    - ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA
    - drm/amdgpu: Add back JPEG to video caps for carrizo and newer
    - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
    - SUNRPC: call xs_sock_process_cmsg for all cmsg
    - NFSv4: Don't clear capabilities that won't be reset (Closes: #1114898)
    - trace/fgraph: Fix error handling
    - tracing: Fix tracing_marker may trigger page fault during preempt_disable
    - nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter
    - nfs/localio: add direct IO enablement with sync and async IO support
    - nfs/localio: restore creds before releasing pageio data
    - ftrace/samples: Fix function size computation
    - fs/nfs/io: make nfs_start_io_*() killable
    - NFS: Serialise O_DIRECT i/o and truncate()
    - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
    - NFSv4.2: Serialise O_DIRECT i/o and clone range
    - NFSv4.2: Serialise O_DIRECT i/o and copy range
    - NFS: nfs_invalidate_folio() must observe the offset and size arguments
    - NFSv4/flexfiles: Fix layout merge mirror check.
    - tracing: Silence warning when chunk allocation fails in trace_pid_write
    - [s390x] pai: Deny all events not handled by this PMU
    - [s390x] cpum_cf: Deny all sampling events by counter PMU
    - bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt
    - bpf: Allow fall back to interpreter for programs with stack size <= 512
    - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
    - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate
      psock->cork.
    - proc: fix type confusion in pde_set_flags()
    - Revert "SUNRPC: Don't allow waiting for exiting tasks"
    - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
    - ocfs2: fix recursive semaphore deadlock in fiemap call
    - btrfs: fix squota compressed stats leak
    - btrfs: fix subvolume deletion lockup caused by inodes xarray race
    - [amd64] i2c: i801: Hide Intel Birch Stream SoC TCO WDT
    - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM
      wakeups
    - [armhf] mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
    - [armhf] mtd: rawnand: stm32_fmc2: fix ECC overwrite
    - fuse: do not allow mapping a non-regular backing file
    - fuse: check if copy_file_range() returns larger than requested size
    - fuse: prevent overflow in copy_file_range return value
    - mm/khugepaged: fix the address passed to notifier on testing young
    - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison
      memory
    - mm/memory-failure: fix redundant updates for already poisoned pages
    - mm/damon/core: set quota->charged_from to jiffies at first charge window
    - mm/damon/lru_sort: avoid divide-by-zero in
      damon_lru_sort_apply_parameters()
    - [arm64] drm/mediatek: fix potential OF node use-after-free
    - drm/xe: Attempt to bring bos back to VRAM after eviction
    - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
    - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
    - netlink: specs: mptcp: add missing 'server-side' attr
    - netlink: specs: mptcp: clearly mention attributes
    - netlink: specs: mptcp: replace underscores with dashes in names
    - netlink: specs: mptcp: fix if-idx attribute type
    - kernfs: Fix UAF in polling when open file is released
    - libceph: fix invalid accesses to ceph_connection_v1_info
    - ceph: fix race condition validating r_parent before applying state
    - ceph: fix race condition where r_parent becomes stale before sending
      message
    - mm/damon/sysfs: fix use-after-free in state_show()
    - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
    - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range()
    - [arm64] mtd: spinand: winbond: Fix oob_layout for W25N01JW
    - btrfs: use readahead_expand() on compressed extents
    - btrfs: fix corruption reading compressed range when block size is smaller
      than page size
    - hrtimers: Unconditionally update target CPU base after offline timer
      migration
    - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
    - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO
      runtime PM wakeups"
    - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
    - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
    - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
    - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
    - [arm64] drm/panthor: validate group queue count
    - [arm64,armhf] net: fec: Fix possible NPD in
      fec_enet_phy_reset_after_clk_enable()
    - genetlink: fix genl_bind() invoking bind() after -EPERM
    - net: bridge: Bounce invalid boolopts
    - tunnels: reset the GSO metadata before reusing the skb
    - docs: networking: can: change bcm_msg_head frames member to support
      flexible array
    - igb: fix link test skipping when interface is admin down
    - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
    - drm/amd/display: use udelay rather than fsleep
    - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when
      j1939_local_ecu_get() failed
    - can: j1939: j1939_local_ecu_get(): undo increment when
      j1939_local_ecu_get() fails
    - netfilter: nft_set_pipapo: remove unused arguments
    - netfilter: nft_set: remove one argument from lookup and update functions
    - netfilter: nft_set_pipapo: merge pipapo_get/lookup
    - netfilter: nft_set_pipapo: don't return bogus extension pointer
    - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups
    - netfilter: nft_set_rbtree: continue traversal if element is inactive
    - netfilter: nf_tables: Reintroduce shortened deletion notifications
    - netfilter: nf_tables: place base_seq in struct net
    - netfilter: nf_tables: make nft_set_do_lookup available unconditionally
    - netfilter: nf_tables: restart set lookup on base_seq change
    - net: hsr: Add VLAN CTAG filter support
    - hsr: use rtnl lock when iterating over ports
    - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
    - [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties
    - [amd64] dmaengine: idxd: Remove improper idxd_free
    - [amd64] dmaengine: idxd: Fix refcount underflow on module unload
    - [amd64] dmaengine: idxd: Fix double free in idxd_setup_wqs()
    - [amd64] dmaengine: ti: edma: Fix memory allocation size for
      queue_priority_map
    - xhci: fix memory leak regression when freeing xhci vdev devices depth
      first
    - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
    - [amd64,arm64] usb: typec: tcpm: properly deliver cable vdms to altmode
      drivers
    - [arm64] dmaengine: qcom: bam_dma: Fix DT error handling for
      num-channels/ees
    - [arm64] phy: tegra: xusb: fix device and OF node leak at probe
    - [armhf] phy: ti: omap-usb2: fix device leak at unbind
    - [armhf] phy: ti-pipe3: fix device leak at unbind
    - [amd64] x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon
    - net: mdiobus: release reset_gpio in mdiobus_unregister_device()
    - [amd64] drm/i915/power: fix size for for_each_set_bit() in abox iteration
    - drm/amdgpu: fix a memory leak in fence cleanup when unloading
    - netfilter: nft_set_pipapo: fix null deref for empty set

  [ Santiago Ruano Rincón ]
  * d/salsa-ci.yml: Merge the extract-source job into the build's job script
  * d/salsa-ci.yml: Suppress unreleased changes and mismatching distribution
    lintian tags.
  * d/salsa-ci.yml: Early move orig tarballs back where they can be cached

  [ Salvatore Bonaccorso ]
  * [rt] Add new signing key for Daniel Wagner
  * [rt] Update to 6.12.43-rt12
  * [amd64] x86/bugs: Add SRSO_USER_KERNEL_NO support
  * [amd64] x86/bugs: KVM: Add support for SRSO_MSR_FIX
  * [amd64] KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count
    transitions

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 20 Sep 2025 20:41:31 +0200

linux (6.12.43-1) trixie; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.42
    - [amd64] ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
    - ethernet: intel: fix building with large NR_CPUS
    - [amd64] ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
    - ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX
    - [amd64] ASoC: Intel: fix SND_SOC_SOF dependencies
    - [amd64] ASoC: amd: yc: add DMI quirk for ASUS M6501RM
    - audit,module: restore audit logging in load failure case
    - parse_longname(): strrchr() expects NUL-terminated string
    - fs_context: fix parameter name in infofc() macro
    - fs/ntfs3: cancle set bad inode after removing name fails
    - ublk: use vmalloc for ublk_device's __queues
    - hfsplus: make splice write available again
    - hfs: make splice write available again
    - hfsplus: remove mutex_lock check in hfsplus_free_extents
    - Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
    - gfs2: No more self recovery
    - io_uring: fix breakage in EXPERT menu
    - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
    - ASoC: ops: dynamically allocate struct snd_ctl_elem_value
    - ASoC: mediatek: use reserved memory or enable buffer pre-allocation
    - [arm64] dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV
    - [arm64] soc: qcom: QMI encoding/decoding for big endian
    - [arm64] dts: qcom: sdm845: Expand IMEM region
    - [arm64] dts: qcom: sc7180: Expand IMEM region
    - [arm64] dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes
    - [arm64] dts: qcom: sa8775p: Correct the interrupt for remoteproc
    - [arm64] dts: qcom: msm8976: Make blsp_dma controlled-remotely
    - usb: host: xhci-plat: fix incorrect type for of_match variable in
      xhci_plat_probe()
    - usb: misc: apple-mfi-fastcharge: Make power supply names unique
    - [arm64] dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports
    - [arm64] dts: ti: k3-am62p-j722s: fix pinctrl-single size
    - [arm64] firmware: arm_scmi: Fix up turbo frequencies selection
    - usb: typec: ucsi: yoga-c630: fix error and remove paths
    - mei: vsc: Destroy mutex after freeing the IRQ
    - mei: vsc: Event notifier fixes
    - mei: vsc: Unset the event callback on remove and probe errors
    - [armhf] spi: stm32: Check for cfg availability in stm32_spi_probe
    - vmci: Prevent the dispatching of uninitialized payloads
    - pps: fix poll support
    - Revert "vmci: Prevent the dispatching of uninitialized payloads"
    - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
    - usb: early: xhci-dbc: Fix early_ioremap leak
    - [armhf] dts: ti: omap: Fixup pinheader typo
    - [arm64] dts: st: fix timer used for ticks
    - [arm64] dts: imx8mm-beacon: Fix HS400 USDHC clock speed
    - [arm64] dts: imx8mn-beacon: Fix HS400 USDHC clock speed
    - PM / devfreq: Check governor before using governor->name
    - PM / devfreq: Fix a index typo in trans_stat
    - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
    - cpufreq: Initialize cpufreq-based frequency-invariance later
    - cpufreq: Init policy->rwsem before it may be possibly used
    - staging: greybus: gbphy: fix up const issue with the match callback
    - [arm64] soc: qcom: pmic_glink: fix OF node leak
    - [arm64] interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
    - [arm64] interconnect: qcom: sc8180x: specify num_nodes
    - bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640
    - [arm64,armhf] drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
    - [arm64,armhf] drm/panfrost: Fix panfrost device variable name in devfreq
    - drm/panthor: Add missing explicit padding in drm_panthor_gpu_info
    - bpf, sockmap: Fix psock incorrectly pointing to sk
    - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
    - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
    - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
    - drm/amdgpu: Remove nbiov7.9 replay count reporting
    - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
    - [powerpc*] pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add
    - wifi: rtw89: avoid NULL dereference when RX problematic packet on
      unsupported 6 GHz band
    - wifi: rtl818x: Kill URBs before clearing tx status queue
    - wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
    - iwlwifi: Add missing check for alloc_ordered_workqueue
    - wifi: ath11k: clear initialized flag for deinit-ed srng lists
    - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
    - net/mlx5: Check device memory pointer before usage
    - net: dst: annotate data-races around dst->input
    - net: dst: annotate data-races around dst->output
    - bpf: Ensure RCU lock is held around bpf_prog_ksym_find
    - [arm64] drm/msm/dpu: Fill in min_prefill_lines for SC8180X
    - refscale: Check that nreaders and loops multiplication doesn't overflow
    - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
    - sched/psi: Optimize psi_group_change() cpu_clock() usage
    - fbcon: Fix outdated registered_fb reference in comment
    - netfilter: nf_tables: Drop dead code from fill_*_info routines
    - netfilter: nf_tables: adjust lockdep assertions handling
    - [amd64] iommu/amd: Enable PASID and ATS capabilities in the correct order
    - net/sched: Restrict conditions for adding duplicating netems to qdisc tree
    - net_sched: act_ctinfo: use atomic64_t for three counters
    - RDMA/mlx5: Fix UMR modifying of mkey page size
    - xen: fix UAF in dmabuf_exp_from_pages()
    - xen/gntdev: remove struct gntdev_copy_batch from stack
    - tcp: call tcp_measure_rcv_mss() for ooo packets
    - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
    - wifi: rtw88: Fix macid assigned to TDLS station
    - mwl8k: Add missing check after DMA map
    - wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
    - drm/amdgpu/gfx9: fix kiq locking in KCQ reset
    - drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset
    - drm/amdgpu/gfx10: fix kiq locking in KCQ reset
    - [amd64] iommu/amd: Fix geometry.aperture_end for V2 tables
    - rcu: Fix delayed execution of hurry callbacks
    - wifi: mac80211: reject TDLS operations when station is not associated
    - wifi: plfxlc: Fix error handling in usb driver probe
    - wifi: mac80211: Do not schedule stopped TXQs
    - wifi: mac80211: Don't call fq_flow_idx() for management frames
    - wifi: mac80211: Check 802.11 encaps offloading in
      ieee80211_tx_h_select_key()
    - Reapply "wifi: mac80211: Update skb's control block key in
      ieee80211_tx_dequeue()"
    - wifi: ath12k: fix endianness handling while accessing wmi service bit
    - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P
      IE
    - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
    - wifi: nl80211: Set num_sub_specs before looping through sub_specs
    - ring-buffer: Remove ring_buffer_read_prepare_sync()
    - memcg_slabinfo: Fix use of PG_slab
    - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
    - Bluetooth: hci_event: Mask data status from LE ext adv reports
    - bpf: Disable migration in nf_hook_run_bpf().
    - can: peak_usb: fix USB FD devices potential malfunction
    - can: kvaser_pciefd: Store device channel index
    - can: kvaser_usb: Assign netdev.dev_port based on device channel index
    - netfilter: xt_nfacct: don't assume acct name is null-terminated
    - net/mlx5e: Clear Read-Only port buffer size in PBMC before update
    - net/mlx5e: Remove skb secpath if xfrm state is not found
    - stmmac: xsk: fix negative overflow of budget in zerocopy mode
    - vrf: Drop existing dst reference in vrf_ip6_input_dst
    - ipv6: prevent infinite loop in rt6_nlmsg_size()
    - ipv6: fix possible infinite loop in fib6_info_uses_dev()
    - ipv6: annotate data-races around rt->fib6_nsiblings
    - bpf/preload: Don't select USERMODE_DRIVER
    - [arm64] bpf, arm64: Fix fp initialization for exception boundary
    - fortify: Fix incorrect reporting of read buffer size
    - [arm64] PCI: rockchip-host: Fix "Unexpected Completion" log message
    - [arm64] clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv
      clocks
    - [arm64] crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
    - [amd64] crypto: qat - use unmanaged allocation for dc_data
    - [arm64,armhf] crypto: marvell/cesa - Fix engine load inaccuracy
    - [amd64] crypto: qat - allow enabling VFs in the absence of IOMMU
    - [amd64] crypto: qat - fix state restore for banks with exceptions
    - mtd: fix possible integer overflow in erase_xfer()
    - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
    - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
    - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
    - [armhf] crypto: arm/aes-neonbs - work around gcc-15 warning
    - pinctrl: sunxi: Fix memory leak on krealloc failure
    - dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning
    - [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers
    - fanotify: sanitize handle_type values when reporting fid
    - Fix dma_unmap_sg() nents value
    - perf tools: Fix use-after-free in help_unknown_cmd()
    - perf dso: Add missed dso__put to dso__load_kcore
    - mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER
    - perf sched: Make sure it frees the usage string
    - perf sched: Free thread->priv using priv_destructor
    - perf sched: Fix memory leaks in 'perf sched map'
    - perf sched: Fix memory leaks for evsel->priv in timehist
    - perf sched: Use RC_CHK_EQUAL() to compare pointers
    - perf sched: Fix memory leaks in 'perf sched latency'
    - [arm64] RDMA/hns: Fix double destruction of rsv_qp
    - [arm64] RDMA/hns: Fix HW configurations not cleared in error flow
    - [amd64] crypto: ccp - Fix locking on alloc failure handling
    - [arm64] crypto: inside-secure - Fix `dma_unmap_sg()` nents value
    - [amd64] crypto: ccp - Fix crash when rebind ccp device for ccp.ko
    - [arm64] RDMA/hns: Get message length of ack_req from FW
    - [arm64] RDMA/hns: Fix accessing uninitialized resources
    - [arm64] RDMA/hns: Drop GFP_NOWARN
    - [arm64] RDMA/hns: Fix -Wframe-larger-than issue
    - kernel: trace: preemptirq_delay_test: use offstack cpu mask
    - proc: use the same treatment to check proc_lseek as ones for
      proc_read_iter et.al
    - pinmux: fix race causing mux_owner NULL with active mux_usecount
    - perf tests bp_account: Fix leaked file descriptor
    - [riscv64] clk: thead: th1520-ap: Correctly refer the parent of osc_12m
    - [armhf] clk: sunxi-ng: v3s: Fix de clock definition
    - [ppc64el] scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
    - scsi: mvsas: Fix dma_unmap_sg() nents value
    - scsi: isci: Fix dma_unmap_sg() nents value
    - ext4: Make sure BH_New bit is cleared in ->write_end handler
    - [arm64] hwrng: mtk - handle devm_pm_runtime_enable errors
    - [amd64] crypto: qat - disable ZUC-256 capability for QAT GEN5
    - soundwire: stream: restore params when prepare ports fail
    - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
    - remoteproc: xlnx: Disable unsupported features
    - fs/orangefs: Allow 2 more characters in do_c_string()
    - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
    - dmaengine: nbpfaxi: Add missing check after DMA map
    - perf tools: Remove libtraceevent in .gitignore
    - [amd64] crypto: qat - fix DMA direction for compression on GEN2 devices
    - [amd64] crypto: qat - fix seq_file position update in adf_ring_next()
    - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
    - jfs: fix metapage reference count leak in dbAllocCtl
    - drm/xe/vf: Disable CSC support on VF
    - perf record: Cache build-ID of hit DSOs only
    - vdpa/mlx5: Fix needs_teardown flag calculation
    - vhost-scsi: Fix log flooding with target does not exist errors
    - vdpa/mlx5: Fix release of uninitialized resources on error path
    - vdpa: Fix IDR memory leak in VDUSE module exit
    - vhost: Reintroduce kthread API and add mode selection
    - bpf: Check flow_dissector ctx accesses are aligned
    - bpf: Check netfilter ctx accesses are aligned
    - apparmor: ensure WB_HISTORY_SIZE value is a power of 2
    - apparmor: fix loop detection used in conflicting attachment resolution
    - apparmor: Fix unaligned memory accesses in KUnit test
    - module: Restore the moduleparam prefix length check
    - ucount: fix atomic_long_inc_below() argument type
    - rtc: ds1307: fix incorrect maximum clock rate handling
    - rtc: hym8563: fix incorrect maximum clock rate handling
    - rtc: nct3018y: fix incorrect maximum clock rate handling
    - rtc: pcf85063: fix incorrect maximum clock rate handling
    - rtc: pcf8563: fix incorrect maximum clock rate handling
    - rtc: rv3028: fix incorrect maximum clock rate handling
    - f2fs: turn off one_time when forcibly set to foreground GC
    - f2fs: fix bio memleak when committing super block
    - f2fs: fix KMSAN uninit-value in extent_info usage
    - f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent
    - f2fs: fix to check upper boundary for gc_valid_thresh_ratio
    - f2fs: fix to check upper boundary for gc_no_zoned_gc_percent
    - f2fs: doc: fix wrong quota mount option description
    - f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
    - f2fs: fix to avoid panic in f2fs_evict_inode
    - f2fs: fix to avoid out-of-boundary access in devs.path
    - f2fs: vm_unmap_ram() may be called from an invalid context
    - f2fs: fix to update upper_p in __get_secs_required() correctly
    - f2fs: fix to calculate dirty data during has_not_enough_free_secs()
    - f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
    - exfat: fdatasync flag should be same like generic_write_sync()
    - i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe()
    - vfio: Fix unbalanced vfio_df_close call in no-iommu mode
    - vfio: Prevent open_count decrement to negative
    - vfio/pds: Fix missing detach_ioas op
    - vfio/pci: Separate SR-IOV VF dev_set
    - scsi: mpt3sas: Fix a fw_event memory leak
    - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
    - scsi: ufs: core: Use link recovery when h8 exit fails during runtime
      resume
    - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
    - kconfig: qconf: fix ConfigList::updateListAllforAll()
    - sched/psi: Fix psi_seq initialization
    - PCI: pnv_php: Clean up allocated IRQs on unplug
    - PCI: pnv_php: Work around switches with broken presence detection
    - [powerpc*] eeh: Export eeh_unfreeze_pe()
    - [powerpc*] eeh: Make EEH driver device hotplug safe
    - PCI: pnv_php: Fix surprise plug detection and recovery
    - pNFS/flexfiles: don't attempt pnfs on fatal DS errors
    - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
    - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
    - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
    - NFSv4.2: another fix for listxattr
    - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
    - md/md-cluster: handle REMOVE message earlier
    - netpoll: prevent hanging NAPI when netcons gets enabled
    - phy: mscc: Fix parsing of unicast frames
    - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
    - pptp: ensure minimal skb length in pptp_xmit()
    - nvmet: initialize discovery subsys after debugfs is initialized
    - [s390x] ap: Unmask SLCF bit in card and queue ap functions sysfs
    - netlink: specs: ethtool: fix module EEPROM input/output arguments
    - block: Fix default IO priority if there is no IO context
    - block: ensure discard_granularity is zero when discard is not supported
    - ASoC: tas2781: Fix the wrong step for TLV on tas2781
    - [amd64] spi: cs42l43: Property entry should be a null-terminated array
    - net/mlx5: Correctly set gso_segs when LRO is used
    - ipv6: reject malicious packets in ipv6_gso_segment()
    - net: mdio: mdio-bcm-unimac: Correct rate fallback logic
    - net: drop UFO packets in udp_rcv_segment()
    - net/sched: taprio: enforce minimum value for picos_per_byte
    - sunrpc: fix client side handling of tls alerts
    - [x86] irq: Plug vector setup race
    - benet: fix BUG when creating VFs
    - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
    - [s390x] mm: Allocate page table with PAGE_SIZE granularity
    - eth: fbnic: remove the debugging trick of super high page bias
    - irqchip: Build IMX_MU_MSI only on ARM
    - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
    - smb: server: remove separate empty_recvmsg_queue
    - smb: server: make sure we call ib_dma_unmap_single() only if we called
      ib_dma_map_single already
    - smb: server: let recv_done() consistently call
      put_recvmsg/smb_direct_disconnect_rdma_connection
    - smb: server: let recv_done() avoid touching data_transfer after
      cleanup/move
    - smb: client: remove separate empty_packet_queue
    - smb: client: make sure we call ib_dma_unmap_single() only if we called
      ib_dma_map_single already
    - smb: client: let recv_done() cleanup before notifying the callers.
    - smb: client: let recv_done() avoid touching data_transfer after
      cleanup/move
    - nvmet: exit debugfs after discovery subsystem exits
    - pptp: fix pptp_xmit() error path
    - smb: client: return an error if rdma_connect does not return within 5
      seconds
    - sunrpc: fix handling of server side tls alerts
    - perf/core: Don't leak AUX buffer refcount on allocation failure
    - perf/core: Exit early on perf_mmap() fail
    - perf/core: Prevent VMA split of buffer mappings
    - selftests/perf_events: Add a mmap() correctness test
    - net/packet: fix a race in packet_set_ring() and packet_notifier()
    - vsock: Do not allow binding to VMADDR_PORT_ANY
    - [amd64] accel/ivpu: Fix reset_engine debugfs file logic
    - Revert "bcache: remove heap-related macros and switch to generic min_heap"
    - ice/ptp: fix crosstimestamp reporting
    - [amd64] drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return
      type
    - [amd64] drm/i915/hdmi: propagate errors from intel_hdmi_init_connector()
    - [amd64] drm/i915/hdmi: add error handling in g4x_hdmi_init()
    - [amd64] drm/i915/ddi: gracefully handle errors from
      intel_ddi_init_hdmi_connector()
    - [amd64] drm/i915/display: add intel_encoder_is_hdmi()
    - [amd64] drm/i915/ddi: only call shutdown hooks for valid encoders
    - ksmbd: fix null pointer dereference error in generate_encryptionkey
    - ksmbd: fix Preauh_HashValue race condition
    - ksmbd: fix corrupted mtime and ctime in smb2_open
    - ksmbd: limit repeated connections from clients with the same IP
      (CVE-2025-38501)
    - smb: server: Fix extension string in ksmbd_extract_shortname()
    - USB: serial: option: add Foxconn T99W709
    - PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state()
    - PCI/ASPM: Fix L1SS saving
    - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
    - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
    - net: usbnet: Fix the wrong netif_carrier_on() call
    - [x86] sev: Evict cache lines during SNP memory validation (CVE-2024-36331)
    - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
    - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
    - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx
    - ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx
    - ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26)
    - [adm64] platform/x86/intel/pmt: fix a crashlog NULL pointer access
    - [x86] fpu: Delay instruction pointer fixup until after warning
    - [s390x] mm: Remove possible false-positive warning in pte_free_defer()
    - [mips*] mm: tlb-r4k: Uniquify TLB entries on init
    - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
    - mm: swap: correctly use maxpages in swapon syscall to avoid potential
      deadloop
    - mm: swap: fix potential buffer overflow in setup_clusters()
    - perf/arm-ni: Set initial IRQ affinity
    - media: ti: j721e-csi2rx: fix list_del corruption
    - HID: apple: validate feature-report field count to prevent NULL pointer
      dereference
    - USB: gadget: f_hid: Fix memory leak in hidg_bind error path
    - usb: gadget : fix use-after-free in composite_dev_cleanup()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.43
    - io_uring: don't use int for ABI
    - ALSA: usb-audio: Validate UAC3 power domain descriptors, too
    - ALSA: usb-audio: Validate UAC3 cluster segment descriptors
    - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
    - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
    - smb3: fix for slab out of bounds on mount to ksmbd
    - smb: client: remove redundant lstrp update in negotiate protocol
    - gpio: virtio: Fix config space reading.
    - gpio: mlxbf2: use platform_get_irq_optional()
    - Revert "gpio: mlxbf3: only get IRQ for device instance 0"
    - gpio: mlxbf3: use platform_get_irq_optional()
    - leds: flash: leds-qcom-flash: Fix registry access after re-bind
    - Revert "leds: trigger: netdev: Configure LED blink interval for HW
      offload"
    - netlink: avoid infinite retry looping in netlink_unicast()
      (Closes: #1111017)
    - net: phy: micrel: fix KSZ8081/KSZ8091 cable test
    - [armhf] net: ftgmac100: fix potential NULL pointer access in
      ftgmac100_phy_disconnect
    - [arm64] net: enetc: fix device and OF node leak at probe
    - [arm64] net: mtk_eth_soc: fix device leak at probe
    - [arm64] net: ti: icss-iep: fix device and OF node leaks at probe
    - net: usb: asix_devices: add phy_mask for ax88772 mdio bus
    - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
    - NFSD: detect mismatch of file handle and delegation stateid in OPEN op
    - NFS: Fix the setting of capabilities when automounting a new filesystem
    - PCI: Extend isolated function probing to LoongArch
    - [arm64] clk: samsung: exynos850: fix a comment
    - [arm64] clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD
    - [arm64] clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent
      clock
    - fscrypt: Don't use problematic non-inline crypto engines
    - fs: Prevent file descriptor table allocations exceeding INT_MAX
    - eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)
    - Documentation: ACPI: Fix parent device references
    - ACPI: processor: perflib: Fix initial _PPC limit application
    - ACPI: processor: perflib: Move problematic pr->performance check
    - block: Make REQ_OP_ZONE_FINISH a write operation
    - mm/memory-tier: fix abstract distance calculation overflow
    - smb: client: let send_done() cleanup before calling
      smbd_disconnect_rdma_connection()
    - smb: client: don't wait for info->send_pending == 0 on error
    - [amd64] KVM: x86: Convert vcpu_run()'s immediate exit param into a generic
      bitmap
    - [amd64] KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN
      flag
    - [amd64] KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is
      supported
    - [amd64] KVM: VMX: Extract checking of guest's DEBUGCTL into helper
    - [amd64] KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
    - [amd64] KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter
      APIs
    - [amd64] KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running
      the guest
    - [amd64] habanalabs: fix UAF in export_dmabuf()
    - mm/smaps: fix race between smaps_hugetlb_range and migration
    - udp: also consider secpath when evaluating ipsec use for checksumming
    - netfilter: ctnetlink: fix refcount leak on table dump
    - [arm64] net: ti: icssg-prueth: Fix emac link speed handling
    - [arm64] net: ti: icss-iep: Fix incorrect type for return value in
      extts_enable()
    - sctp: linearize cloned gso packets in sctp_rcv
    - [amd64] intel_idle: Allow loading ACPI tables for any family
    - cpuidle: governors: menu: Avoid using invalid recent intervals data
    - ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
    - tls: handle data disappearing from under the TLS ULP (CVE-2025-38616)
    - net: kcm: Fix race condition in kcm_unattach()
    - hfs: fix general protection fault in hfs_find_init()
    - hfs: fix slab-out-of-bounds in hfs_bnode_read()
    - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
    - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (CVE-2025-40082)
    - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
    - [arm64] Handle KCOV __init vs inline mismatches
    - smb/server: avoid deadlock when linking with ReplaceIfExists
    - nvme-pci: try function level reset on init failure
    - dm-stripe: limit chunk_sectors to the stripe size
    - md/raid10: set chunk_sectors limit
    - nvme-tcp: log TLS handshake failures at error level
    - gfs2: Validate i_depth for exhash directories
    - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
    - loop: Avoid updating block size under exclusive owner
    - udf: Verify partition map count
    - drbd: add missing kref_get in handle_write_conflicts
    - hfs: fix not erasing deleted b-tree node issue
    - better lockdep annotations for simple_recursive_removal()
    - ata: ahci: Disallow LPM policy control if not supported
    - ata: ahci: Disable DIPM if host lacks support
    - ata: libata-sata: Disallow changing LPM state if not supported
    - fs/ntfs3: Add sanity check for file name
    - fs/ntfs3: correctly create symlink for relative path
    - pidfs: raise SB_I_NODEV and SB_I_NOEXEC
    - fix locking in efi_secret_unlink()
    - securityfs: don't pin dentries twice, once is enough...
    - tracefs: Add d_delete to remove negative dentries
    - usb: xhci: print xhci->xhc_state when queue_command failed
    - [amd64] platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
    - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
    - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
    - usb: xhci: Avoid showing warnings for dying controller
    - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
    - usb: xhci: Avoid showing errors during surprise removal
    - [arm64] soc: qcom: rpmh-rsc: Add RSC version 4 support
    - ACPI: APEI: send SIGBUS to current task if synchronous memory error not
      recovered
    - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
    - usb: typec: tcpm/tcpci_maxim: fix irq wake usage
    - pmdomain: ti: Select PM_GENERIC_DOMAINS
    - [arm64] gpio: wcd934x: check the return value of regmap_update_bits()
    - cpufreq: Exit governor when failed to start old governor
    - cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
    - [armhf] rockchip: fix kernel hang during smp initialization
    - PM / devfreq: governor: Replace sscanf() with kstrtoul() in
      set_freq_store()
    - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was
      successed
    - [arm64] thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when
      required
    - iio: adc: ad_sigma_delta: don't overallocate scan buffer
    - [armhf] tegra: Use I/O memcpy to write to IRAM
    - ACPI: PRM: Reduce unnecessary printing to avoid user confusion
    - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
    - thermal: sysfs: Return ENODATA instead of EAGAIN for reads
    - PM: sleep: console: Fix the black screen issue
    - ACPI: processor: fix acpi_object initialization
    - [arm64] mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
    - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
    - pps: clients: gpio: fix interrupt handling order in remove path
    - reset: brcmstb: Enable reset drivers for ARCH_BCM2835
    - char: misc: Fix improper and inaccurate error code returned by misc_init()
    - [amd64] mei: bus: Check for still connected devices in
      mei_cl_bus_dev_release()
    - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
    - [amd64,arm64] platform/chrome: cros_ec_sensorhub: Retries when a sensor is
      not ready
    - ALSA: hda: Handle the jack polling always via a work
    - ALSA: hda: Disable jack polling at shutdown
    - [amd64] x86/bugs: Avoid warning when overriding return thunk
    - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
    - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
    - ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode
    - tty: serial: fix print format specifiers
    - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
    - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
    - usb: core: usb_submit_urb: downgrade type check
    - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
    - [arm64] imx8m-blk-ctrl: set ISI panic write hurry level
    - [arm64] soc: qcom: mdt_loader: Actually use the e_phoff
    - [amd64] platform/x86: thinkpad_acpi: Handle KCOV __init vs inline
      mismatches
    - [amd64,arm64] platform/chrome: cros_ec_typec: Defer probe on missing EC
      parent
    - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
    - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
    - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
    - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
    - ASoC: codecs: rt5640: Retry DEVICE_ID verification
    - [arm64] ASoC: qcom: use drvdata instead of component to keep id
    - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps
    - [powerpc*] thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
    - Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925
    - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
    - xen/netfront: Fix TX response spurious interrupts
    - wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn
    - net: usb: cdc-ncm: check for filtering capability
    - wifi: ath12k: Correct tid cleanup when tid setup fails
    - wifi: cfg80211: reject HTC bit for management frames
    - [s390x] time: Use monotonic clock in get_cycles()
    - be2net: Use correct byte order and format string for TCP seq and ack_seq
    - libbpf: Verify that arena map exists when adding arena relocations
    - idpf: preserve coalescing settings across resets
    - wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan
      mode
    - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
    - et131x: Add missing check after DMA map
    - net: ag71xx: Add missing check after DMA map
    - net/mlx5e: Properly access RCU protected qdisc_sleeping variable
    - net: pcs: xpcs: mask readl() return value to 16 bits
    - [arm64] Mark kernel as tainted on SAE and SError panic
    - drm/amd/pm: fix null pointer access
    - rcu: Protect ->defer_qs_iw_pending from data race
    - drm/amd/display: limit clear_update_flags to dcn32 and above
    - net: mctp: Prevent duplicate binds
    - wifi: cfg80211: Fix interface type validation
    - wifi: mac80211: don't unreserve never reserved chanctx
    - net: ipv4: fix incorrect MTU in broadcast routes
    - [arm64] net: thunderx: Fix format-truncation warning in
      bgx_acpi_match_id()
    - net: phy: micrel: Add ksz9131_resume()
    - sched/deadline: Fix accounting after global limits change
    - bpf: Forget ranges when refining tnum after JSET
    - wifi: iwlwifi: mvm: set gtk id also in older FWs
    - wifi: iwlwifi: mvm: fix scan request validation
    - [s390x] stp: Remove udelay from stp_sync_clock()
    - net: phy: bcm54811: PHY initialization
    - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
    - wifi: mac80211: don't complete management TX on SAE commit
    - wifi: mac80211: avoid weird state in error path
    - [s390x] early: Copy last breaking event address to pt_regs
    - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in
      __ipv6_dev_mc_inc().
    - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
    - wifi: mac80211: fix rx link assignment for non-MLO stations
    - [arm64] drm/msm: use trylock for debugfs
    - [arm64] drm/msm: Add error handling for krealloc in metadata setup
    - [arm64] perf/arm: Add missing .suppress_bind_attrs
    - wifi: rtw89: Fix rtw89_mac_power_switch() for USB
    - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
    - drm/xe/xe_query: Use separate iterator while filling GT list
    - [amd64] net: thunderbolt: Enable end-to-end flow control also in transmit
    - [amd64] net: thunderbolt: Fix the parameter passing of
      tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
    - xfrm: Duplicate SPI Handling
    - net: atlantic: add set_power to fw_ops for atl2 to fix wol
    - ACPI: Suppress misleading SPCR console message when SPCR table is absent
    - net: ieee8021q: fix insufficient table-size assertion
    - net: fec: allow disable coalescing
    - drm/amd/display: Separate set_gsl from set_gsl_source_select
    - wifi: ath10k: shutdown driver when hardware is unreliable
    - wifi: ath12k: Add memset and update default rate value in wmi tx
      completion
    - wifi: ath12k: Fix station association with MBSSID Non-TX BSS
    - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
    - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
    - drm/amd/display: Fix 'failed to blank crtc!'
    - drm/amd/display: Initialize mode_select to 0
    - wifi: mac80211: update radar_required in channel context after channel
      switch
    - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
    - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
    - wifi: ath12k: Decrement TID on RX peer frag setup error handling
    - [powerpc*] floppy: Add missing checks after DMA map
    - netmem: fix skb_frag_address_safe with unreadable skbs
    - [arm64] stacktrace: Check kretprobe_find_ret_addr() return value
    - wifi: iwlegacy: Check rate_idx range after addition
    - neighbour: add support for NUD_PERMANENT proxy entries
    - dpaa_eth: don't use fixed_phy_change_carrier
    - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to
      manual
    - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
    - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
    - gve: Return error for unknown admin queue command
    - [armhf] net: dsa: b53: ensure BCM5325 PHYs are enabled
    - [armhf] net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
    - [armhf] net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
    - [armhf] net: dsa: b53: prevent DIS_LEARNING access on BCM5325
    - [armhf] net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
    - bpftool: Fix JSON writer resource leak in version command
    - ptp: Use ratelimite for freerun error message
    - wifi: rtw89: scan abort when assign/unassign_vif
    - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
    - ionic: clean dbpage in de-init
    - drm/xe: Make dma-fences compliant with the safe access rules
    - [armhf] net: ncsi: Fix buffer overflow in fetching version id
    - drm/ttm: Should to return the evict error
    - uapi: in6: restore visibility of most IPv6 socket options
    - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
    - drm/amd/display: Update DMCUB loading sequence for DCN3.5
    - drm/amd/display: Avoid trying AUX transactions on disconnected ports
    - drm/ttm: Respect the shrinker core free target
    - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
    - [armhf] net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
    - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
    - vhost: fail early when __vhost_add_used() fails
    - drm/amd/display: Only finalize atomic_obj if it was initialized
    - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported
    - drm/amd/display: Disable dsc_power_gate for dcn314 by default
    - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race
      condition
    - cifs: Fix calling CIFSFindFirst() for root path without msearch
    - fbdev: fix potential buffer overflow in do_register_framebuffer()
    - crypto: hisilicon/hpre - fix dma unmap sequence
    - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
    - [arm64,armhf] clk: tegra: periph: Fix error handling and resolve unsigned
      compare warning
    - mfd: axp20x: Set explicit ID for AXP313 regulator
    - [arm64] phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
    - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
    - fs/orangefs: use snprintf() instead of sprintf()
    - watchdog: dw_wdt: Fix default timeout
    - hwmon: (emc2305) Set initial PWM minimum value during probe based on
      thermal state
    - [mips*] vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
    - watchdog: iTCO_wdt: Report error if timeout configuration fails
    - scsi: bfa: Double-free fix
    - jfs: truncate good inode pages when hard link is 0
    - jfs: Regular file corruption check
    - jfs: upper bound check of tree index in dbAllocAG
    - media: hi556: Fix reset GPIO timings
    - RDMA/bnxt_re: Fix size of uverbs_copy_to() in
      BNXT_RE_METHOD_GET_TOGGLE_MEM
    - crypto: jitter - fix intermediary handling
    - [mips*] Don't crash in stack_top() for tasks without ABI or vDSO
    - [riscv64] clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED
    - media: ipu-bridge: Add _HID for OV5670
    - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ
      control
    - leds: leds-lp50xx: Handle reg to get correct multi_index
    - [armhf] dmaengine: stm32-dma: configure next sg only if there are more
      than 2 sgs
    - [amd64] RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
    - RDMA/core: reduce stack using in nldev_stat_get_doit()
    - scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in
      dev_loss_tmo_callbk
    - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
    - power: supply: qcom_battmgr: Add lithium-polymer entry
    - scsi: mpt3sas: Correctly handle ATA device errors
    - scsi: mpi3mr: Correctly handle ATA device errors
    - [armhf] pinctrl: stm32: Manage irq affinity settings
    - media: usb: hdpvr: disable zero-length read messages
    - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
    - media: dvb-frontends: w7090p: fix null-ptr-deref in
      w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
    - media: uvcvideo: Add quirk for HP Webcam HD 2300
    - media: uvcvideo: Fix bandwidth issue for Alcor camera
    - [amd64] crypto: ccp - Add missing bootloader info reg for pspv6
    - [arm64] clk: renesas: rzg2l: Postpone updating priv->clks[]
    - soundwire: amd: serialize amd manager resume sequence during pm_prepare
    - soundwire: amd: cancel pending slave status handling workqueue during
      remove sequence
    - soundwire: Move handle_nested_irq outside of sdw_dev_lock
    - md: dm-zoned-target: Initialize return variable r to avoid uninitialized
      use
    - module: Prevent silent truncation of module name in delete_module(2)
    - i3c: add missing include to internal header
    - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
    - apparmor: shift ouid when mediating hard links in userns
    - i3c: don't fail if GETHDRCAP is unsupported
    - i3c: master: Initialize ret in i3c_i2c_notifier_call()
    - dm-mpath: don't print the "loaded" message if registering fails
    - dm-table: fix checking for rq stackable devices
    - apparmor: use the condition in AA_BUG_FMT even with debug disabled
    - apparmor: fix x_table_lookup when stacking is not the first entry
    - i2c: Force DLL0945 touchpad i2c freq to 100khz
    - exfat: add cluster chain loop check for dir
    - f2fs: check the generic conditions first
    - printk: nbcon: Allow reacquire during panic
    - vfio/type1: conditional rescheduling while pinning
    - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
    - scsi: target: core: Generate correct identifiers for PR OUT transport IDs
    - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
    - vfio/mlx5: fix possible overflow in tracking max message size
    - ipmi: Use dev_warn_ratelimited() for incorrect message warnings
    - ipmi: Fix strcpy source and destination the same
    - tools/power turbostat: Handle non-root legacy-uncore sysfs permissions
    - tools/power turbostat: Fix build with musl
    - tools/power turbostat: Handle cap_get_proc() ENOSYS
    - smb: client: don't call init_waitqueue_head(&info->conn_wait) twice in
      _smbd_get_connection
    - lib/sbitmap: convert shallow_depth from one word to the whole sbitmap
    - ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table
    - net: phy: smsc: add proper reset flags for LAN8710A
    - [amd64] ASoC: Intel: avs: Fix uninitialized pointer error in probe()
    - block: avoid possible overflow for chunk_sectors check in
      blk_stack_limits()
    - pNFS: Fix stripe mapping in block/scsi layout
    - pNFS: Fix disk addr range check in block/scsi layout
    - pNFS: Handle RPC size limit for layoutcommits
    - pNFS: Fix uninited ptr deref in block/scsi layout
    - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
    - scsi: lpfc: Remove redundant assignment to avoid memory leak
    - [amd64,armhf] ASoC: fsl_sai: replace regmap_write with regmap_update_bits
    - cifs: Fix collect_sample() to handle any iterator type
    - drm/amdgpu: fix vram reservation issue
    - drm/amdgpu: fix incorrect vm flags to map bo
    - mm/damon/core: commit damos->target_nid
    - block: Introduce bio_needs_zone_write_plugging()
    - dm: Always split write BIOs to zoned device limits
    - cifs: reset iface weights when we cannot find a candidate
    - [amd64] iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes
    - [arm64] iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
    - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range
    - iommufd: Prevent ALIGN() overflow
    - ext4: fix zombie groups in average fragment size lists
    - ext4: fix largest free orders lists corruption on mb_optimize_scan switch
    - ext4: initialize superblock fields in the kballoc-test.c kunit tests
    - usb: core: config: Prevent OOB read in SS endpoint companion parsing
    - misc: rtsx: usb: Ensure mmc child device is active when card is present
    - usb: typec: ucsi: Update power_supply on power role change
    - [amd64] comedi: fix race between polling and detaching
    - [amd64] thunderbolt: Fix copy+paste error in match_service_id()
    - cdc-acm: fix race between initial clearing halt and open
    - btrfs: zoned: use filesystem size not disk size for reclaim decision
    - btrfs: abort transaction during log replay if walk_log_tree() failed
    - btrfs: zoned: do not remove unwritten non-data block group
    - btrfs: qgroup: set quota enabled bit if quota disable fails flushing
      reservations
    - btrfs: don't ignore inode missing when replaying log tree
    - btrfs: fix ssd_spread overallocation
    - btrfs: populate otime when logging an inode item
    - btrfs: qgroup: fix qgroup create ioctl returning success after quotas
      disabled
    - btrfs: don't skip remaining extrefs if dir not found during log replay
    - btrfs: clear dirty status from extent buffer on error at insert_new_root()
    - btrfs: fix log tree replay failure due to file with 0 links and extents
    - btrfs: error on missing block group when unaccounting log tree extent
      buffers
    - btrfs: zoned: do not select metadata BG as finish target
    - btrfs: fix iteration bug in __qgroup_excl_accounting()
    - btrfs: do not allow relocation of partially dropped subvolumes
    - xfs: fix scrub trace with null pointer in quotacheck
    - userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry
    - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
    - net/sched: ets: use old 'nbands' while purging unused classes
    - [amd64,arm64] hv_netvsc: Fix panic during namespace deletion with VF
    - mm, slab: restore NUMA policy support for large kmalloc
    - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
    - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
    - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
    - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
    - media: venus: Fix OOB read due to missing payload bound check
    - media: uvcvideo: Do not mark valid metadata as invalid
    - media: v4l2: Add support for NV12M tiled variants to v4l2_format_info()
    - HID: magicmouse: avoid setting up battery timer when not needed
    - wifi: mac80211: check basic rates validity in sta_link_apply_parameters
    - HID: apple: avoid setting up battery timer for devices without battery
    - mfd: cros_ec: Separate charge-control probing from USB-PD
    - net: Add net_passive_inc() and net_passive_dec().
    - net: better track kernel sockets lifetime (CVE-2025-21884)
    - smb: client: fix netns refcount leak after net_passive changes
    - PCI: Store all PCIe Supported Link Speeds
    - PCI: Allow PCI bridges to go to D3Hot on all non-x86
    - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
    - [arm64] dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C
    - [arm64] dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C
    - ata: libata-sata: Add link_power_management_supported sysfs attribute
    - io_uring/rw: cast rw->flags assignment to rwf_t
    - drm/amd/display: Allow DCN301 to clear update flags
    - rcu: Fix racy re-initialization of irq_work causing hangs
    - dm: split write BIOs on zone boundaries when zone append is not emulated
    - PCI: Honor Max Link Speed when determining supported speeds
    - ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled

  [ Bastian Blank ]
  * [amd64, arm64] Enable MANA_INFINIBAND.

  [ Salvatore Bonaccorso ]
  * [amd64] udeb: kernel-image: Include SPI drivers
  * ext4: don't try to clear the orphan_present feature block device is r/o
    (Closes: #1108271)
  * alloc_fdtable(): change calling conventions.
  * net: ipv4: fix regression in local-broadcast route

  [ Ben Hutchings ]
  * proc: fix missing pde_set_flags() for net proc files

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 27 Aug 2025 10:10:25 +0200

linux (6.12.41-1) trixie-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.39
    - eventpoll: don't decrement ep refcount while still holding the ep mutex
      (CVE-2025-38349)
    - drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics
    - drm/amdgpu/ip_discovery: add missing ip_discovery fw
    - [s390x] crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2
    - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid
      Priority Inversion in SRIOV (CVE-2025-38104)
    - [amd64] ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select
      SND_SOC_ACPI_INTEL_MATCH
    - [amd64] ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address
      struct
    - [amd64] ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43
      laptops
    - [amd64] ASoC: soc-acpi: add get_function_tplg_files ops
    - [amd64] ASoC: Intel: add sof_sdw_get_tplg_files ops
    - [amd64] ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files
      ops
    - [amd64] ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches
    - perf/core: Fix the WARN_ON_ONCE is out of lock protected region
    - irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ
    - sched/core: Fix migrate_swap() vs. hotplug
    - perf: Revert to requiring CAP_SYS_ADMIN for uprobes
    - ASoC: cs35l56: probe() should fail if the device ID is not recognized
    - Bluetooth: hci_sync: Fix not disabling advertising instance
    - Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
    - pinctrl: amd: Clear GPIO debounce for suspend
    - fix proc_sys_compare() handling of in-lookup dentries
    - sched/deadline: Fix dl_server runtime calculation formula
    - bnxt_en: eliminate the compile warning in bnxt_request_irq due to
      CONFIG_RFS_ACCEL
    - [arm64] poe: Handle spurious Overlay faults
    - [arm64] net: phy: qcom: move the WoL function to shared library
    - [arm64] net: phy: qcom: qca808x: Fix WoL issue by utilizing
      at8031_set_wol()
    - netlink: Fix wraparounds of sk->sk_rmem_alloc.
    - vsock: fix `vsock_proto` declaration
    - tipc: Fix use-after-free in tipc_conn_close().
    - tcp: Correct signedness in skb remaining space calculation
    - vsock: Fix transport_{g2h,h2g} TOCTOU
    - vsock: Fix transport_* TOCTOU
    - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
    - net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
    - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
    - net: phy: smsc: Force predictable MDI-X state on LAN87xx
    - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
    - atm: clip: Fix potential null-ptr-deref in to_atmarpd().
    - atm: clip: Fix memory leak of struct clip_vcc.
    - atm: clip: Fix infinite recursive call of clip_push().
    - atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
    - [arm64] net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for
      skb_shared_info
    - net/sched: Abort __tc_modify_qdisc if parent class does not exist
    - rxrpc: Fix bug due to prealloc collision
    - rxrpc: Fix oops due to non-existence of prealloc backlog struct
    - ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
    - [amd64] x86/mce/amd: Add default names for MCA banks and blocks
    - [amd64] x86/mce/amd: Fix threshold limit reset
    - [amd64] x86/mce: Don't remove sysfs if thresholding sysfs init fails
    - [amd64] x86/mce: Ensure user polling settings are honored when restarting
      timer
    - [amd64] x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
    - [amd64] KVM: x86/xen: Allow 'out of range' event channel ports in IRQ
      routing table.
    - [amd64] KVM: SVM: Add missing member in SNP_LAUNCH_START command structure
    - [amd64] KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is
      in-flight
    - KVM: Allow CPU to reschedule while setting per-page memory attributes
    - ASoC: fsl_sai: Force a software reset when starting in consumer mode
    - gre: Fix IPv6 multicast route creation. (Closes: #1108430)
    - md/md-bitmap: fix GPF in bitmap_get_stats() (Closes: #1109734)
    - [arm64] pinctrl: qcom: msm: mark certain pins as invalid for interrupts
    - pwm: Fix invalid state detection
    - pwm: mediatek: Ensure to disable clocks in error path
    - wifi: prevent A-MSDU attacks in mesh networks (CVE-2025-27558)
    - wifi: mwifiex: discard erroneous disassoc frames on STA interface
    - wifi: mt76: mt7921: prevent decap offload config before STA initialization
    - wifi: mt76: mt7925: prevent NULL pointer dereference in
      mt7925_sta_set_decap_offload()
    - wifi: mt76: mt7925: fix the wrong config for tx interrupt
    - wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw
      scan
    - drm/imagination: Fix kernel crash when hard resetting the GPU
    - drm/amdkfd: Don't call mmput from MMU notifier callback
    - drm/gem: Acquire references on GEM handles for framebuffers
    - drm/sched: Increment job count before swapping tail spsc queue
    - drm/ttm: fix error handling in ttm_buffer_object_transfer
    - drm/gem: Fix race in drm_gem_handle_create_tail()
    - drm/xe/bmg: fix compressed VRAM handling
    - Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2"
    - usb: gadget: u_serial: Fix race condition in TTY wakeup
    - Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
    - drm/framebuffer: Acquire internal references on GEM handles
    - drm/xe: Allocate PF queue size on pow2 boundary
    - Revert "ACPI: battery: negate current when discharging" (Closes: #1109344)
    - Revert "PCI/ACPI: Fix allocated memory release on error in
      pci_acpi_scan_root()"
    - kallsyms: fix build without execinfo
    - maple_tree: fix mt_destroy_walk() on root leaf node
    - mm: fix the inaccurate memory statistics issue for users
    - mm/vmalloc: leave lazy MMU mode on PTE mapping error
    - lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users()
    - [amd64] x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
    - [amd64] x86/mm: Disable hugetlb page table sharing on 32-bit
    - [arm64] clk: scmi: Handle case where child clocks are initialized before
      their parents
    - smb: server: make use of rdma_destroy_qp()
    - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
    - erofs: fix to add missing tracepoint in erofs_read_folio()
    - erofs: address D-cache aliasing
    - [amd64] ASoC: Intel: sof-function-topology-lib: Print out the unsupported
      dmic count
    - netlink: Fix rmem check in netlink_broadcast_deliver().
    - netlink: make sure we allow at least one dump skb
    - netfs: Fix ref leak on inserted extra subreq in write retry
    - wifi: cfg80211: fix S1G beacon head validation in nl80211
    - wifi: zd1211rw: Fix potential NULL pointer dereference in
      zd_mac_tx_to_dev()
    - drm/tegra: nvdec: Fix dma_alloc_coherent error check
    - md/raid1: Fix stack memory use after return in raid1_reshape
    - raid10: cleanup memleak at raid10_make_request
    - wifi: mac80211: correctly identify S1G short beacon
    - wifi: mac80211: fix non-transmitted BSSID profile search
    - wifi: rt2x00: fix remove callback type mismatch
    - drm/nouveau/gsp: fix potential leak of memory used during acpi init
    - wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init()
    - nbd: fix uaf in nbd_genl_connect() error path
    - drm/xe/pf: Clear all LMTT pages on alloc
    - erofs: free pclusters if no cached folio is attached
    - erofs: get rid of `z_erofs_next_pcluster_t`
    - erofs: tidy up zdata.c
    - erofs: refine readahead tracepoint
    - erofs: fix to add missing tracepoint in erofs_readahead()
    - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
    - net: appletalk: Fix device refcount leak in atrtr_create()
    - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
    - net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits
    - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
    - drm/xe/pm: Correct comment of xe_pm_set_vram_threshold()
    - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to
      debug level
    - net/mlx5e: Fix race between DIM disable and net_dim()
    - net/mlx5e: Add new prio for promiscuous mode
    - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
    - bnxt_en: Fix DCB ETS validation
    - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
    - ublk: sanity check add_dev input for underflow
    - atm: idt77252: Add missing `dma_map_error()`
    - ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.
    - [amd64] ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606
    - io_uring: make fallocate be hashed work
    - [amd64] ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
    - ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
    - ALSA: hda/realtek: Add quirks for some Clevo laptops
    - net: usb: qmi_wwan: add SIMCom 8230C composition
    - driver: bluetooth: hci_qca:fix unable to load the BT driver
    - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
    - net: mana: Record doorbell physical address in PF mode
    - btrfs: fix assertion when building free space tree
    - vt: add missing notification when switching back to text mode
    - bpf: Adjust free target to avoid global starvation of LRU map
    - [riscv64] vdso: Exclude .rodata from the PT_DYNAMIC segment
    - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
    - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
    - HID: nintendo: avoid bluetooth suspend/resume stalls
    - erofs: fix rare pcluster memory leak after unmounting
    - net: wangxun: revert the adjustment of the IRQ vector sequence
    - kasan: remove kasan_find_vm_area() to prevent possible deadlock
    - ksmbd: fix potential use-after-free in oplock/lease break ack
    - [arm64] Filter out SME hwcaps when FEAT_SME isn't implemented
    - crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
      (CVE-2025-37984)
    - rseq: Fix segfault on registration when rseq_cs is non-zero
      (CVE-2025-38067)
    - [amd64] KVM: SVM: Set synthesized TSA CPUID flags
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.40
    - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
    - USB: serial: option: add Foxconn T99W640
    - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
    - usb: musb: fix gadget state on disconnect
    - [arm*] usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY
    - usb: gadget: configfs: Fix OOB read on empty string write
    - [armhf] i2c: stm32: fix the device used for the DMA map
    - [armhf] i2c: stm32f7: unmap DMA mapped buffer
    - [amd64] thunderbolt: Fix wake on connect at runtime
    - [amd64] thunderbolt: Fix bit masking in tb_dp_port_set_hops()
    - Revert "staging: vchiq_arm: Create keep-alive thread during probe"
    - nvmem: imx-ocotp: fix MAC address byte length
    - nvmem: layouts: u-boot-env: remove crc32 endianness conversion
    - Input: xpad - set correct controller type for Acer NGR200
    - pch_uart: Fix dma_sync_sg_for_device() nents value
    - spi: Add check for 8-bit transfer with 8 IO mode support
    - dm-bufio: fix sched in atomic context
    - HID: core: ensure the allocated report buffer can contain the reserved
      report ID
    - HID: core: ensure __hid_request reserves the report ID as the first byte
    - HID: core: do not bypass hid_hw_raw_request
    - tracing/probes: Avoid using params uninitialized in parse_btf_arg()
    - tracing: Add down_write(trace_event_sem) when adding trace event
    - tracing/osnoise: Fix crash in timerlat_dump_stack()
    - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
    - drm/amdgpu: Increase reset counter only on success
    - drm/amd/display: Disable CRTC degamma LUT for DCN401
    - drm/amd/display: Free memory allocation
    - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx
    - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
    - io_uring/poll: fix POLLERR handling
    - mptcp: make fallback action and fallback decision atomic
    - mptcp: plug races between subflow fail and subflow creation
    - mptcp: reset fallback status gracefully at disconnect() time
    - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in
      pep_sock_accept()
    - net/mlx5: Update the list of the PCI supported devices
    - [arm64] dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
    - [arm64] dts: add big-endian property back into watchdog node
    - [arm64] dts: freescale: imx8mm-verdin: Keep LDO5 always on
    - [arm64] dts: imx8mp-venice-gw71xx: fix TPM SPI frequency
    - [arm64] dts: imx8mp-venice-gw72xx: fix TPM SPI frequency
    - [arm64] dts: imx8mp-venice-gw73xx: fix TPM SPI frequency
    - [arm64] dts: rockchip: use cs-gpios for spi1 on ringneck
    - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
    - af_packet: fix soft lockup issue caused by tpacket_snd()
    - Bluetooth: btintel: Check if controller is ISO capable on
      btintel_classify_pkt_type
    - cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y
    - isofs: Verify inode mode when loading from disk
    - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
    - [arm*] mmc: bcm2835: Fix dma_unmap_sg() nents value
    - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based
      Positivo models
    - [arm64] mmc: sdhci_am654: Workaround for Errata i2312
    - [amd64] net: stmmac: intel: populate entire system_counterval_t in
      get_time_fn() callback
    - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
    - [s390x] bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
    - smb: client: fix use-after-free in crypt_message when using async crypto
    - [armhf] soc: aspeed: lpc-snoop: Cleanup resources in stack-order
    - [armhf] soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
    - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
    - iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps
    - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
    - iio: adc: max1363: Reorder mode_list[] entries
    - iio: adc: stm32-adc: Fix race in installing chained IRQ handler
    - iio: backend: fix out-of-bound write
    - iio: common: st_sensors: Fix use of uninitialize device structs
    - [arm64] dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5
    - [arm64] dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B
    - [arm64] dts: imx95: Correct the DMA interrupter number of pcie0_ep
    - bpf: Reject %p% format string in bprintf-like helpers
    - cachefiles: Fix the incorrect return value in __cachefiles_write()
    - block: fix kobject leak in blk_unregister_queue
    - net/sched: sch_qfq: Fix race condition on qfq_aggregate
    - rpl: Fix use-after-free in rpl_do_srh_inline().
    - smb: client: fix use-after-free in cifs_oplock_break
    - fix a leak in fcntl_dirnotify()
    - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
    - nvme: fix endianness of command word prints in nvme_log_err_passthru()
    - smc: Fix various oops due to inet_sock type confusion.
    - net: phy: Don't register LEDs for genphy
    - nvme: fix misaccounting of nvme-mpath inflight I/O
    - nvmet-tcp: fix callback lock for TLS handshake
    - wifi: cfg80211: remove scan request n_channels counted_by
    - [amd64] hwmon: (corsair-cpro) Validate the size of the received input
      buffer
    - ice: add NULL check in eswitch lag check
    - ice: check correct pointer in fwlog debugfs
    - usb: net: sierra: check for no status endpoint
    - loop: use kiocb helpers to fix lockdep warning
    - [riscv64] Enable interrupt during exception handling
    - [riscv64] traps_misaligned: properly sign extend value in misaligned load
      handler
    - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
    - Bluetooth: hci_sync: fix connectable extended advertising when using
      static random address
    - Bluetooth: SMP: If an unallowed command is received consider it a failure
    - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
    - Bluetooth: hci_core: add missing braces when using macro parameters
    - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant
      without board ID
    - net/mlx5: Correctly set gso_size when LRO is used
    - ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
    - net: fix segmentation after TCP/UDP fraglist GRO
    - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
    - drm/xe/pf: Sanitize VF scratch registers on FLR
    - drm/xe/pf: Move VFs reprovisioning to worker
    - drm/xe/pf: Prepare to stop SR-IOV support prior GT reset
    - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
    - [amd64,arm64] hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open
      to prevent IPv6 addrconf
    - virtio-net: fix recursived rtnl_lock() during probe()
    - tls: always refresh the queue when reading sock
    - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during
      runtime
    - net: bridge: Do not offload IGMP/MLD messages
    - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
    - rxrpc: Fix recv-recv race of completed call
    - rxrpc: Fix transmission of an abort in response to an abort
    - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
    - drm/mediatek: Add wait_event_timeout when disabling plane
    - drm/mediatek: only announce AFBC if really supported
    - libbpf: Fix handling of BPF arena relocations
    - efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths
    - sched: Change nr_uninterruptible type to unsigned long
    - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right
      userns
    - btrfs: fix block group refcount race in
      btrfs_create_pending_block_groups() (CVE-2025-22115)
    - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
    - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime
      pm
    - usb: hub: Fix flushing of delayed work used for post resume purposes
    - usb: hub: Don't try to recover devices lost during warm reset.
    - [arm64] usb: dwc3: qcom: Don't leave BCR asserted
    - [arm64,armhf] i2c: omap: Add support for setting mux
    - [arm64,armhf] i2c: omap: Fix an error handling path in omap_i2c_probe()
    - [arm64,armhf] i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
    - [arm64,armhf] i2c: omap: fix deprecated of_property_read_bool() use
    - sched,freezer: Remove unnecessary warning in __thaw_task
    - drm/xe/mocs: Initialize MOCS index early
    - drm/xe: Move page fault init after topology init
    - smb: client: let smbd_post_send_iter() respect the peers max_send_size and
      transmit all data
    - [amd64] iommu/vt-d: Fix misplaced domain_attached assignment
      (Closes: #1109676)
    - [amd64] KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll
      hypercalls
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.41
    - [amd64] x86/traps: Initialize DR7 by writing its architectural reset value
    - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
      (CVE-2025-38335)
    - virtio_net: Enforce minimum TX ring size for reliability
    - virtio_ring: Fix error reporting in virtqueue_resize
    - regulator: core: fix NULL dereference on unbind due to stale coupling data
    - [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo
      UX8406CA
    - RDMA/core: Rate limit GID cache warning messages
    - [arm64] interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1
      node
    - iio: adc: ad7949: use spi_is_bpw_supported()
    - regmap: fix potential memory leak of regmap_bus
    - [amd64] x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
    - [amd64] platform/x86: Fix initialization order for
      firmware_attributes_class
    - [arm*] staging: vchiq_arm: Make vchiq_shutdown never fail
    - xfrm: state: initialize state_ptrs earlier in xfrm_state_find
    - xfrm: state: use a consistent pcpu_id in xfrm_state_find
    - xfrm: Set transport header to fix UDP GRO handling
    - xfrm: interface: fix use-after-free after changing collect_md xfrm
      interface
    - [arm64] net: ti: icssg-prueth: Fix buffer allocation for ICSSG
    - net/mlx5: Fix memory leak in cmd_exec()
    - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
    - i40e: report VF tx_dropped with tx_errors instead of tx_discards
    - i40e: When removing VF MAC filters, only check PF-set MAC
    - net: appletalk: Fix use-after-free in AARP proxy probe
    - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in
      qfq_delete_class
    - can: netlink: can_changelink(): fix NULL pointer deref of struct
      can_priv::do_set_mode
    - [arm64] drm/bridge: ti-sn65dsi86: Remove extra semicolon in
      ti_sn_bridge_probe()
    - ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop
    - [s390x] ism: fix concurrency management in ism_cmd()
    - [arm64] net: hns3: fix concurrent setting vlan filter issue
    - [arm64] net: hns3: disable interrupt when ptp init failed
    - [arm64] net: hns3: fixed vf get max channels bug
    - [arm64] net: hns3: default enable tx bounce buffer when smmu enabled
    - [amd64] platform/x86: ideapad-laptop: Fix FnLock not remembered among
      boots
    - [amd64] platform/x86: ideapad-laptop: Fix kbd backlight not remembered
      among boots
    - drm/amdgpu: Reset the clear flag in buddy during resume
    - drm/sched: Remove optimization that causes hang when killing dependent
      jobs
    - mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show()
    - timekeeping: Zero initialize system_counterval when querying time from phc
      drivers
    - [arm64] i2c: qup: jump out of the loop in case of timeout
    - [arm64,armhf] i2c: tegra: Fix reset error handling with ACPI
    - i2c: virtio: Avoid hang by using interruptible completion wait
    - bus: fsl-mc: Fix potential double device reference in
      fsl_mc_get_endpoint()
    - sprintf.h requires stdarg.h
    - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
    - ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx
    - [arm64] entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
    - [arm64] dpaa2-eth: Fix device reference count leak in MAC endpoint
      handling
    - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
    - e1000e: ignore uninitialized checksum word on tgp
    - gve: Fix stuck TX queue for DQ queue format
    - ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
    - nilfs2: reject invalid file types when reading inodes
    - resource: fix false warning in __request_region()
    - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
    - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
    - [amd64,arm64] usb: typec: tcpm: allow to use sink in accessory mode
    - [amd64,arm64] usb: typec: tcpm: allow switching to mode accessory to mux
      properly
    - [amd64,arm64] usb: typec: tcpm: apply vbus before data bringup in
      tcpm_src_attach
    - spi: cadence-quadspi: fix cleanup of rx_chan on failure paths
    - [amd64] x86/bugs: Fix use of possibly uninit value in
      amd_check_tsa_microcode()
    - jfs: reject on-disk inodes of an unsupported type (CVE-2025-37925)
    - [amd64] comedi: comedi_test: Fix possible deletion of uninitialized timers
    - [arm64] dts: qcom: x1e78100-t14s: mark l12b and l15b always-on
    - erofs: simplify z_erofs_load_compact_lcluster()
    - erofs: refine z_erofs_get_extent_compressedlen()
    - erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches
    - erofs: simplify tail inline pcluster handling
    - erofs: clean up header parsing for ztailpacking and fragments
    - erofs: fix large fragment handling
    - ext4: don't explicit update times in ext4_fallocate()
    - ext4: refactor ext4_punch_hole()
    - ext4: refactor ext4_zero_range()
    - ext4: refactor ext4_collapse_range()
    - ext4: refactor ext4_insert_range()
    - ext4: factor out ext4_do_fallocate()
    - ext4: move out inode_lock into ext4_fallocate()
    - ext4: move out common parts into ext4_fallocate()
    - ext4: fix incorrect punch max_end
    - ext4: correct the error handle in ext4_fallocate()
    - ext4: fix out of bounds punch offset
    - [amd64] KVM: x86: drop x86.h include from cpuid.h
    - [amd64] KVM: x86: Route non-canonical checks in emulator through
      emulate_ops
    - [amd64] KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical
      checks
    - [amd64] KVM: x86: model canonical checks more precisely
    - [amd64] KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
      (CVE-2025-38351)
    - [amd64] x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap()
    - [arm64] dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage
    - Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO"
    - wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure
    - iio: hid-sensor-prox: Restore lost scale assignments
    - iio: hid-sensor-prox: Fix incorrect OFFSET calculation
    - [amd64,arm64] Drivers: hv: Make the sysfs node size for the ring buffer
      dynamic
    - ALSA: hda/tegra: Add Tegra264 support
    - ALSA: hda: Add missing NVIDIA HDA codec IDs
    - [amd64] drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
    - Revert "drm/xe/gt: Update handling of xe_force_wake_get return"
      (Closes: #1109799)
    - Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling"
    - Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return"
    - Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()"
    - [amd64] KVM: x86: Free vCPUs before freeing VM state
    - mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma

  [ Bastian Blank ]
  * Store build time signing key encrypted.
  * Enable CRYPTO_ECDSA.

  [ Aurelien Jarno ]
  * Fix installation of DTB files

  [ Tj ]
  * drivers/gpu/drm/nouveau: Enable DRM_NOUVEAU_GSP_DEFAULT (Closes: #1088522)

  [ Uwe Kleine-König ]
  * [armhf] Add phy-gmii-sel module to nic-shared-modules udeb for
    ti/omap/am335x based machines (e.g. BeagleBone black).

  [ Salvatore Bonaccorso ]
  * d/salsa-ci.yml: Update for trixie: Set RELEASE to trixie

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 12 Aug 2025 05:28:04 +0200

linux (6.12.38-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.38
    - [amd64] x86/CPU/AMD: Properly check the TSA microcode

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 16 Jul 2025 09:13:16 +0200

linux (6.12.37-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.36
    - cifs: Correctly set SMB1 SessionKey field in Session Setup Request
    - cifs: Fix cifs_query_path_info() for Windows NT servers
    - cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE
      mode
    - NFSv4: Always set NLINK even if the server doesn't support it
    - NFSv4.2: fix listxattr to return selinux security label
    - NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps
      are delegated
    - mailbox: Not protect module_put with spin_lock_irqsave
    - sunrpc: don't immediately retransmit on seqno miss
    - dm vdo indexer: don't read request structure after enqueuing
    - leds: multicolor: Fix intensity setting while SW blinking
    - fuse: fix race between concurrent setattrs from multiple nodes
    - cxl/region: Add a dev_err() on missing target list entries
    - NFSv4: xattr handlers should check for absent nfs filehandles
    - ksmbd: allow a filename to contain special characters on SMB3.1.1 posix
      extension
    - ksmbd: provide zero as a unique ID to the Mac client
    - [amd64] dmaengine: idxd: Check availability of workqueue allocated by idxd
      wq driver before using
    - PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH
      to one lane
    - [arm64,armhf] PCI: imx6: Add workaround for errata ERR051624
    - nvme-tcp: fix I/O stalls on congested sockets
    - nvme-tcp: sanitize request list handling
    - md/md-bitmap: fix dm-raid max_write_behind setting
    - amd/amdkfd: fix a kfd_process ref leak
    - bcache: fix NULL pointer in cache_set_flush()
    - drm/amdgpu: seq64 memory unmap uses uninterruptible lock
    - drm/scheduler: signal scheduled fence when kill job
    - iio: pressure: zpa2326: Use aligned_s64 for the timestamp
    - [arm64,armhf] coresight: Only check bottom two claim bits
    - [arm*] usb: dwc2: also exit clock_gating when stopping udc while suspended
    - iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos
    - usb: potential integer overflow in usbg_make_tpg()
    - usb: common: usb-conn-gpio: use a unique name for usb connector device
    - usb: Add checks for snprintf() calls in usb_alloc_dev()
    - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
    - usb: gadget: f_hid: wake up readers on disable/unbind
    - usb: typec: displayport: Receive DP Status Update NAK request exit dp
      altmode
    - usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set
    - [riscv64] add a data fence for CMODX in the kernel mode
    - ALSA: hda: Ignore unsol events for cards being shut down
    - ALSA: hda: Add new pci id for AMD GPU display HD audio controller
    - ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock
    - [amd64] ASoC: rt1320: fix speaker noise when volume bar is 100%
    - ceph: fix possible integer overflow in ceph_zero_objects()
    - scsi: ufs: core: Don't perform UFS clkscaling during host async scan
    - ovl: Check for NULL d_inode() in ovl_dentry_upper()
    - btrfs: handle csum tree error with rescue=ibadroots correctly
    - [amd64] drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
    - [amd64] Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts
      on DG1"
    - btrfs: factor out nocow ordered extent and extent map generation into a
      helper
    - btrfs: use unsigned types for constants defined as bit shifts
    - btrfs: fix qgroup reservation leak on failure to allocate ordered extent
    - fs/jfs: consolidate sanity checking in dbMount
    - jfs: validate AG parameters in dbMount() to prevent crashes
    - [arm64] ASoC: codec: wcd9335: Convert to GPIO descriptors
    - [arm64] ASoC: codecs: wcd9335: Fix missing free of regulator supplies
    - f2fs: don't over-report free space or inodes in statvfs
    - [amd64] accel/ivpu: Do not fail on cmdq if failed to allocate preemption
      buffers
    - [amd64] accel/ivpu: Remove copy engine support
    - [amd64] accel/ivpu: Make command queue ID allocated on XArray
    - [amd64] accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ
      allocation
    - [amd64] accel/ivpu: Add debugfs interface for setting HWS priority bands
    - [amd64] accel/ivpu: Trigger device recovery on engine reset/resume failure
    - af_unix: Don't leave consecutive consumed OOB skbs.
    - i2c: tiny-usb: disable zero-length read messages
    - i2c: robotfuzz-osif: disable zero-length read messages
    - ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk
    - smb: client: remove \t from TP_printk statements
    - mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on
      write
    - [amd64] ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
    - [s390x] pkey: Prevent overflow in size calculation for memdup_user()
    - fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio
    - lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
    - [riscv64] Revert "riscv: Define TASK_SIZE_MAX for __access_ok()"
    - [riscv64] Revert "riscv: misaligned: fix sleeping function called during
      misaligned access handling"
    - drm/xe/display: Add check for alloc_ordered_workqueue()
    - HID: wacom: fix crash in wacom_aes_battery_handler()
    - atm: clip: prevent NULL deref in clip_push()
    - Bluetooth: hci_core: Fix use-after-free in vhci_flush()
    - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
    - attach_recursive_mnt(): do not lock the covering tree when sliding
      something under it
    - libbpf: Fix null pointer dereference in btf_dump__free on allocation
      failure
    - ethernet: ionic: Fix DMA mapping tests
    - wifi: mac80211: fix beacon interval calculation overflow
    - af_unix: Don't set -ECONNRESET for consumed OOB skb.
    - wifi: mac80211: Add link iteration macro for link data
    - wifi: mac80211: Create separate links for VLAN interfaces
    - wifi: mac80211: finish link init before RCU publish
    - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
    - bnxt: properly flush XDP redirect lists
    - libbpf: Fix possible use-after-free for externs
    - netlink: specs: tc: replace underscores with dashes in names
    - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
    - net: selftests: fix TCP packet checksum
    - drm/amdgpu/discovery: optionally use fw based ip discovery
    - drm/amd: Adjust output for discovery error handling
    - [amd64] drm/i915: fix build error some more
    - [arm64] drm/bridge: ti-sn65dsi86: make use of debugfs_init callback
    - [arm64] drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
    - drm/xe: Process deferred GGTT node removals on device unwind
    - smb: client: fix potential deadlock when reconnecting channels
    - smb: smbdirect: add smbdirect_pdu.h with protocol definitions
    - smb: client: make use of common smbdirect_pdu.h
    - smb: smbdirect: add smbdirect.h with public structures
    - smb: smbdirect: add smbdirect_socket.h
    - smb: client: make use of common smbdirect_socket
    - smb: smbdirect: introduce smbdirect_socket_parameters
    - smb: client: make use of common smbdirect_socket_parameters
    - cifs: Fix the smbd_response slab to allow usercopy
    - cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code
    - [amd64] EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs
    - [amd64] x86/traps: Initialize DR6 by writing its architectural reset value
    - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
    - dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive
    - serial: core: restore of_node information in sysfs
    - serial: imx: Restore original RXTL for console to fix data loss
    - Bluetooth: L2CAP: Fix L2CAP MTU negotiation
    - dm-raid: fix variable in journal device check
    - btrfs: fix a race between renames and directory logging
    - btrfs: update superblock's device bytes_used when dropping chunk
    - spi: spi-cadence-quadspi: Fix pm runtime unbalance
    - net: libwx: fix the creation of page_pool
    - maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
    - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
    - f2fs: fix to zero post-eof page
    - HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
    - HID: wacom: fix memory leak on kobject creation failure
    - HID: wacom: fix memory leak on sysfs attribute creation failure
    - HID: wacom: fix kobject reference count leak
    - scsi: megaraid_sas: Fix invalid node index
    - scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
    - drm/ast: Fix comment on modeset lock
    - drm/cirrus-qemu: Fix pitch programming
    - [arm64,armhf] drm/etnaviv: Protect the scheduler's pending list with its
      lock
    - [arm64,armhf] drm/tegra: Assign plane type before registration
    - [arm64,armhf] drm/tegra: Fix a possible null pointer dereference
    - drm/udl: Unregister device before cleaning up on disconnect
    - [arm64] drm/msm/gpu: Fix crash when throttling GPU immediately during boot
    - drm/amdkfd: Fix race in GWS queue scheduling
    - drm/amd/display: Add null pointer check for get_first_active_display()
    - drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram
    - drm/amd/display: Correct non-OLED pre_T11_delay.
    - drm/xe/vm: move rebind_work init earlier
    - drm/xe/sched: stop re-submitting signalled jobs
    - drm/xe/guc_submit: add back fix
    - drm/amd/display: Fix RMCM programming seq errors
    - drm/amdgpu: Add kicker device detection
    - drm/amd/display: Check dce_hwseq before dereferencing it
    - drm/xe: Fix memset on iomem
    - drm/xe: Fix taking invalid lock on wedge
    - drm/xe: Fix early wedge on GuC load failure
    - drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL
    - drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences
    - drm/amdgpu: switch job hw_fence to amdgpu_fence
    - drm/amd/display: Fix mpv playback corruption on weston
    - media: uvcvideo: Rollback non processed entities on error
    - [amd64] x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE
    - [amd64] x86/pkeys: Simplify PKRU update in signal frame (Closes: #1103397)
    - net: libwx: fix Tx L4 checksum (CVE-2025-22101)
    - io_uring: fix potential page leak in io_sqe_buffer_register()
    - io_uring/rsrc: fix folio unpinning
    - io_uring/rsrc: don't rely on user vaddr alignment
    - io_uring/net: improve recv bundles
    - io_uring/net: only retry recv bundle for a full transfer
    - io_uring/net: only consider msg_inq if larger than 1
    - io_uring/net: always use current transfer count for buffer put
    - io_uring/net: mark iov as dynamically allocated even for single segments
    - io_uring/kbuf: flag partial buffer mappings
    - mm/vma: reset VMA iterator on commit_merge() OOM failure
    - r8169: add support for RTL8125D (Closes: #1107135)
    - net: phy: realtek: merge the drivers for internal NBase-T PHY's
    - net: phy: realtek: add RTL8125D-internal PHY
    - btrfs: do proper folio cleanup when cow_file_range() failed
    - drm/xe: Carve out wopcm portion from the stolen memory
    - usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters
      ERROR_RECOVERY
    - [arm64] drm/msm/dp: account for widebus and yuv420 during mode validation
    - drm/fbdev-dma: Add shadow buffering for deferred I/O (CVE-2024-58091)
    - btrfs: skip inodes without loaded extent maps when shrinking extent maps
    - btrfs: make the extent map shrinker run asynchronously as a work queue job
    - btrfs: do regular iput instead of delayed iput during extent map shrinking
    - [riscv64] atomic: Do proper sign extension also for unsigned in
      arch_cmpxchg
    - [arm64] dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi
    - ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA
    - drm/amdkfd: remove gfx 12 trap handler page size cap
    - drm/amdkfd: Fix instruction hazard in gfx12 trap handler
    - net: stmmac: Fix accessing freed irq affinity_hint (CVE-2025-23155)
    - spi: fsl-qspi: use devm function instead of driver remove (CVE-2025-37842)
    - btrfs: zoned: fix extent range end unlock in cow_file_range()
    - btrfs: fix use-after-free on inode when scanning root during em shrinking
    - spi: fsl-qspi: Fix double cleanup in probe error path
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.37
    - [arm64] rtc: pcf2127: add missing semicolon after statement
    - [arm64] rtc: pcf2127: fix SPI command byte for PCF2131
    - rtc: cmos: use spin_lock_irqsave in cmos_interrupt
    - virtio-net: xsk: rx: fix the frame's length check
    - virtio-net: ensure the received length does not exceed allocated size
    - [s390x] pci: Fix stale function handles in error handling
    - [s390x] pci: Do not try re-enabling load/store if device is disabled
    - vsock/vmci: Clear the vmci transport packet properly when initializing it
    - mmc: sdhci: Add a helper function for dump register in dynamic debug mode
    - mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
    - Bluetooth: HCI: Set extended advertising data synchronously
    - Bluetooth: hci_sync: revert some mesh modifications
    - Bluetooth: MGMT: set_mesh: update LE scan interval and window
    - Bluetooth: MGMT: mesh_send: check instances prior disabling advertising
    - [arm64,armhf] regulator: gpio: Fix the out-of-bounds access to
      drvdata::gpiods
    - usb: typec: altmodes/displayport: do not index invalid pin_assignments
    - [arm64] mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
    - [arm64] mtk-sd: Prevent memory corruption from DMA map failure
    - [arm64] mtk-sd: reset host->mrq on prepare_data() error
    - [arm64] drm/v3d: Disable interrupts before resetting the GPU
    - RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
    - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
    - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
    - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
    - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
    - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
    - scsi: sd: Fix VPD page 0xb7 length check
    - scsi: ufs: core: Fix spelling of a sysfs attribute name
    - RDMA/mlx5: Fix HW counters query for non-representor devices
    - RDMA/mlx5: Fix CC counters query for MPV
    - RDMA/mlx5: Fix vport loopback for MPV device
    - Bluetooth: Prevent unintended pause by checking if advertising is active
    - btrfs: fix missing error handling when searching for inode refs during log
      replay
    - btrfs: fix iteration of extrefs during log replay
    - btrfs: return a btrfs_inode from btrfs_iget_logging()
    - btrfs: return a btrfs_inode from read_one_inode()
    - btrfs: fix invalid inode pointer dereferences during log replay
    - btrfs: fix inode lookup error handling during log replay
    - btrfs: record new subvolume in parent dir earlier to avoid dir logging
      races
    - btrfs: propagate last_unlink_trans earlier when doing a rmdir
    - btrfs: use btrfs_record_snapshot_destroy() during rmdir
    - ethernet: atl1: Add missing DMA mapping error checks and count errors
    - [arm64] dpaa2-eth: fix xdp_rxq_info leak
    - [armhf] drm/exynos: fimd: Guard display clock control with runtime PM
      calls
    - [arm64] spi: spi-fsl-dspi: Clear completion counter before initiating
      transfer
    - nvme: Fix incorrect cdw15 value in passthru error logging
    - nvmet: fix memory leak of bio integrity
    - [x86] platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs
      callbacks
    - [x86] platform/x86: hp-bioscfg: Directly use firmware_attributes_class
    - [x86] platform/x86: hp-bioscfg: Fix class device unregistration
    - [x86] platform/x86: firmware_attributes_class: Move include
      linux/device/class.h
    - [x86] platform/x86: firmware_attributes_class: Simplify API
    - [x86] platform/x86: think-lmi: Directly use firmware_attributes_class
    - [x86] platform/x86: think-lmi: Fix class device unregistration
    - [x86] platform/x86: dell-sysman: Directly use firmware_attributes_class
    - [x86] platform/x86: dell-wmi-sysman: Fix class device unregistration
    - [arm64] drm/bridge: aux-hpd-bridge: fix assignment of the of_node
    - smb: client: fix warning when reconnecting channel
    - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
    - [amd64] drm/i915/gt: Fix timeline left held on VMA alloc error
    - [amd64] drm/i915/gsc: mei interrupt top half should be in irq disabled
      context
    - [amd64,arm64] idpf: return 0 size for RSS key if not supported
    - [amd64,arm64] idpf: convert control queue mutex to a spinlock
    - igc: disable L1.2 PCI-E link substate to avoid performance issue
    - smb: client: set missing retry flag in smb2_writev_callback()
    - smb: client: set missing retry flag in cifs_readv_callback()
    - smb: client: set missing retry flag in cifs_writev_callback()
    - netfs: Fix i_size updating
    - [amd64,arm64] amd-xgbe: align CL37 AN sequence as per databook
    - enic: fix incorrect MTU comparison in enic_change_mtu()
    - rose: fix dangling neighbour pointers in rose_rt_device_down()
    - nui: Fix dma_mapping_error() check
    - net/sched: Always pass notifications when child class becomes empty
    - [amd64,arm64] amd-xgbe: do not double read link status
    - smb: client: fix race condition in negotiate timeout by using more precise
      timing
    - [arm64] dts: rockchip: fix internal USB hub instability on RK3399 Puma
    - [amd64] crypto: iaa - Remove dst_null support
    - [amd64] crypto: iaa - Do not clobber req->base.data
    - spinlock: extend guard with spinlock_bh variants
    - gfs2: Initialize gl_no_formal_ino earlier
    - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE
    - gfs2: Rename dinode_demise to evict_behavior
    - gfs2: Prevent inode creation race
    - gfs2: Decode missing glock flags in tracepoints
    - gfs2: Add GLF_PENDING_REPLY flag
    - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE
    - gfs2: Move gfs2_dinode_dealloc
    - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc
    - gfs2: deallocate inodes in gfs2_create_inode
    - btrfs: prepare btrfs_page_mkwrite() for large folios
    - btrfs: fix wrong start offset for delalloc space release during mmap write
    - sched/fair: Rename h_nr_running into h_nr_queued
    - sched/fair: Add new cfs_rq.h_nr_runnable
    - sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE
    - gfs2: Move gfs2_trans_add_databufs
    - gfs2: Don't start unnecessary transactions during log flush
    - ACPI: thermal: Fix stale comment regarding trip points
    - ACPI: thermal: Execute _SCP before reading trip points
    - bonding: Mark active offloaded xfrm_states
    - wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path
    - wifi: ath12k: Handle error cases during extended skb allocation
    - wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers
    - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug
    - f2fs: decrease spare area for pinned files for zoned devices
    - f2fs: zone: introduce first_zoned_segno in f2fs_sb_info
    - f2fs: zone: fix to calculate first_zoned_segno correctly
    - scsi: lpfc: Remove NLP_RELEASE_RPI flag from nodelist structure
    - scsi: lpfc: Change lpfc_nodelist nlp_flag member into a bitmask
    - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk
      (CVE-2025-38289)
    - bpf: use common instruction history across all states
    - bpf: Do not include stack ptr register in precision backtracking
      bookkeeping (CVE-2025-38279)
    - [arm64] remoteproc: k3: Call of_node_put(rmem_np) only once in three
      functions
    - [arm64] remoteproc: k3-r5: Add devm action to release reserved memory
    - [arm64] remoteproc: k3-r5: Use devm_kcalloc() helper
    - [arm64] remoteproc: k3-r5: Use devm_ioremap_wc() helper
    - [arm64] remoteproc: k3-r5: Use devm_rproc_add() helper
    - [arm64] remoteproc: k3-r5: Refactor sequential core power up/down
      operations
    - netfs: Fix oops in write-retry from mis-resetting the subreq iterator
      (CVE-2025-38139)
    - mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe()
    - drm/xe: Fix DSB buffer coherency
    - drm/xe: Move DSB l2 flush to a more sensible place
    - drm/xe: add interface to request physical alignment for buffer objects
    - drm/xe: Allow bo mapping on multiple ggtts
    - drm/xe: move DPT l2 flush to a more sensible place
    - drm/xe: Replace double space with single space after comma
    - drm/xe/guc: Dead CT helper
    - drm/xe/guc: Explicitly exit CT safe mode on unwind
    - selinux: change security_compute_sid to return the ssid or tsid on match
    - drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause
    - [amd64] drm/i915/dp_mst: Work around Thunderbolt sink disconnect after
      SINK_COUNT_ESI read
    - drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13
    - drm/amd/display: Add more checks for DSC / HUBP ONO guarantees
    - [arm64] dts: qcom: x1e80100-crd: mark l12b and l15b always-on
    - drm/amdgpu/mes: add missing locking in helper functions
    - sched_ext: Make scx_group_set_weight() always update tg->scx.weight
    - scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp->nlp_flag
    - [arm64] drm/msm: Fix a fence leak in submit error path
    - [arm64] drm/msm: Fix another leak in the submit error path
    - ALSA: sb: Don't allow changing the DMA mode during operations
    - ALSA: sb: Force to disable DMAs once when DMA mode is changed
    - ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled
    - [amd64] ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
    - [amd64] platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042
      quirks list
    - genirq/irq_sim: Initialize work context pointers properly
    - [powerpc*] Fix struct termio related ioctl macros
    - [amd64] ASoC: amd: yc: update quirk data for HP Victus
    - [arm64,armhf] regulator: fan53555: add enable_time support and soft-start
      times
    - scsi: target: Fix NULL pointer dereference in
      core_scsi3_decode_spec_i_port()
    - aoe: defer rexmit timer downdev work to workqueue
    - wifi: mac80211: drop invalid source address OCB frames
    - wifi: ath6kl: remove WARN on bad firmware input
    - ACPICA: Refuse to evaluate a method if arguments are missing
    - [arm64] mtd: spinand: fix memory leak of ECC engine conf
    - rcu: Return early if callback is not specified
    - add a string-to-qstr constructor
    - module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper
    - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
    - RDMA/mlx5: Fix cache entry update on dereg error
    - IB/mlx5: Fix potential deadlock in MR deregistration
    - drm/xe/bmg: Update Wa_22019338487
    - drm/xe: Allow dropping kunit dependency as built-in
    - NFSv4/flexfiles: Fix handling of NFS level errors in I/O
    - usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed
    - Revert "usb: xhci: Implement xhci_handshake_check_state() helper"
    - usb: xhci: quirk for data loss in ISOC transfers
    - xhci: dbctty: disable ECHO flag by default
    - xhci: dbc: Flush queued requests before stopping dbc
    - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
    - Input: xpad - support Acer NGR 200 Controller
    - Input: iqs7222 - explicitly define number of external channels
    - [arm*] usb: dwc3: Abort suspend on soft disconnect failure
    - [arm64,armhf] usb: chipidea: udc: disconnect/reconnect from host when do
      suspend/resume
    - usb: acpi: fix device link removal
    - smb: client: fix readdir returning wrong type with POSIX extensions
    - cifs: all initializations for tcon should happen in tcon_info_alloc
    - dma-buf: fix timeout handling in dma_resv_wait_timeout v2
    - i2c/designware: Fix an initialization issue
    - Logitech C-270 even more broken
    - [arm64] optee: ffa: fix sleep in atomic context
    - [arm64,armhf] iommu/rockchip: prevent iommus dead loop when two masters
      share one IOMMU
    - [amd64] powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit
      cannot be changed
    - [riscv64] cpu_ops_sbi: Use static array for boot_data
    - [x86] platform/x86: think-lmi: Create ksets consecutively
    - [x86] platform/x86: think-lmi: Fix kobject cleanup
    - [x86] platform/x86: think-lmi: Fix sysfs group cleanup
    - usb: typec: displayport: Fix potential deadlock
    - [powerpc*] kernel: Fix ppc_save_regs inclusion in build
    - mm/vmalloc: fix data race in show_numa_info()
    - mm: userfaultfd: fix race of userfaultfd_move and swap cache
      (CVE-2025-38242)
    - [amd64] Mitigations Transitive Scheduler Attacks (TSA) (CVE-2024-36350,
      CVE-2024-36357)
      + x86/bugs: Rename MDS machinery to something more generic
      + x86/bugs: Add a Transient Scheduler Attacks mitigation
      + KVM: SVM: Advertise TSA CPUID bits to guests
      + x86/microcode/AMD: Add TSA microcode SHAs
      + x86/process: Move the buffer clearing before MONITOR

  [ Ben Hutchings ]
  * Revert "cgroup: Do not report unavailable v1 controllers in
    /proc/cgroups" (Closes: #1108294)
  * rtw89: Enable RTW89_8851BE, RTW89_8852BTE as modules (Closes: #1108965)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 11 Jul 2025 06:09:48 +0200

linux (6.12.35-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.34
    - [x86] idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in
      mwait_idle_with_hints() and prefer_mwait_c1_over_halt()
    - sched: Fix trace_sched_switch(.prev_state)
    - [x86] perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node'
      member
    - [x86] perf/x86/amd/uncore: Prevent UMC counters from saturating
    - gfs2: replace sd_aspace with sd_inode
    - gfs2: gfs2_create_inode error handling fix
    - perf/core: Fix broken throttling when max_samples_per_tick=1
    - [arm64] crypto: sun8i-ce-cipher - fix error handling in
      sun8i_ce_cipher_prepare()
    - [powerpc*] do not build ppc_save_regs.o always
    - [powerpc*] crash: Fix non-smp kexec preparation
    - sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed
      tasks
    - [x86] microcode/AMD: Do not return error when microcode update is not
      necessary
    - [arm64] crypto: sun8i-ce - undo runtime PM changes during driver removal
    - [x86] cpu: Sanitize CPUID(0x80000000) output
    - [x86] insn: Fix opcode map (!REX2) superscript tags
    - brd: fix aligned_sector from brd_do_discard()
    - brd: fix discard end sector
    - [arm64,armhf] crypto: marvell/cesa - Handle zero-length skcipher requests
    - [arm64,armhf] crypto: marvell/cesa - Avoid empty transfer descriptor
    - erofs: fix file handle encoding for 64-bit NIDs
    - erofs: avoid using multiple devices with different type
    - [powerpc*] pseries/iommu: Fix kmemleak in TCE table userspace view
    - btrfs: scrub: update device stats when an error is detected
    - btrfs: scrub: fix a wrong error type when metadata bytenr mismatches
    - btrfs: fix invalid data space release when truncating block in NOCOW mode
    - rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture
    - crypto: lrw - Only add ecb if it is not already there
    - crypto: xts - Only add ecb if it is not already there
    - crypto: api - Redo lookup on EEXIST
    - ACPICA: exserial: don't forget to handle FFixedHW opregions for reading
    - [arm64] ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY()
    - [amd64] EDAC/skx_common: Fix general protection fault
    - [amd64] EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo
      channel 0
    - power: reset: at91-reset: Optimize at91_reset()
    - PM: EM: Fix potential division-by-zero error in em_compute_costs()
    - [amd64] ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation
      type
    - ASoC: SOF: amd: add missing acp descriptor field
    - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
    - ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[]
    - [x86] mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
    - PM: sleep: Print PM debug messages during hibernation
    - thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure
    - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
    - spi: sh-msiof: Fix maximum DMA transfer size
    - ALSA: core: fix up bus match const issues.
    - drm/vmwgfx: Add seqno waiter for sync_files
    - drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource
    - drm/vmwgfx: Fix dumb buffer leak
    - drm/xe/d3cold: Set power state to D3Cold during s2idle/s3
    - drm/amd/pp: Fix potential NULL pointer dereference in
      atomctrl_initialize_mc_reg_table
    - media: rkvdec: Fix frame size enumeration
    - [arm64] fpsimd: Avoid RES0 bits in the SME trap handler
    - [arm64] fpsimd: Discard stale CPU state when handling SME traps
    - [arm64] fpsimd: Don't corrupt FPMR when streaming mode changes
    - [arm64] fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP
    - [arm64] fpsimd: Reset FPMR upon exec()
    - [arm64] fpsimd: Fix merging of FPSIMD state during signal return
    - [arm64] drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions
    - [arm64] drm/panthor: Update panthor_mmu::irq::mask when needed
    - [arm64] drm/bridge: lt9611uxc: Fix an error handling path in
      lt9611uxc_probe()
    - fs/ntfs3: handle hdr_first_de() return value
    - fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr
    - [arm64,armhf] firmware: psci: Fix refcount leak in psci_dt_init
    - [arm64] Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX
    - [arm64] fpsimd: Avoid warning when sve_to_fpsimd() is unused
    - [arm64,armhf] drm/tegra: rgb: Fix the unbound reference count
    - firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
    - [arm64] fpsimd: Do not discard modified SVE state
    - overflow: Fix direct struct member initialization in _DEFINE_FLEX()
    - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
    - [arm64] drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3
    - [arm64] drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device
      ptr
    - [arm64] drm/mediatek: Fix kobject put for component sub-drivers
    - [arm64] drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on
      err
    - [arm64,armhf] media: verisilicon: Free post processor buffers on error
    - svcrdma: Reduce the number of rdma_rw contexts per-QP
    - [x86] xen/x86: fix initial memory balloon target
    - wifi: ath11k: fix node corruption in ar->arvifs list
    - wifi: ath12k: Fix memory leak during vdev_id mismatch
    - wifi: ath12k: Fix invalid memory access while forming 802.11 header
    - IB/cm: use rwlock for MAD agent lock
    - bpf: Check link_create.flags parameter for multi_kprobe
    - bpf: fix ktls panic with sockmap
    - bpf, sockmap: fix duplicated data transmission
    - bpf, sockmap: Fix panic when calling skb_linearize
    - f2fs: zone: fix to avoid inconsistence in between SIT and SSA
    - wifi: ath12k: fix cleanup path after mhi init
    - wifi: ath12k: Fix WMI tag for EHT rate in peer assoc
    - wifi: ath12k: Fix buffer overflow in debugfs
    - f2fs: clean up unnecessary indentation
    - f2fs: prevent the current section from being selected as a victim during
      GC
    - f2fs: fix to do sanity check on sbi->total_valid_block_count
    - page_pool: Move pp_magic check into helper functions
    - page_pool: Track DMA-mapped pages and unmap them when destroying the pool
    - net: ncsi: Fix GCPS 64-bit member variables
    - libbpf: Fix buffer overflow in bpf_object__init_prog
    - net/mlx5: Avoid using xso.real_dev unnecessarily
    - xfrm: Use xdo.dev instead of xdo.real_dev
    - wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT
    - wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally
    - wifi: rtw88: do not ignore hardware read error during DPK
    - wifi: ath12k: fix invalid access to memory
    - wifi: ath12k: Add MSDU length validation for TKIP MIC error
    - wifi: ath12k: Fix the QoS control field offset to build QoS header
    - wifi: ath12k: fix node corruption in ar->arvifs list
    - [arm64] RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
    - scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk
    - libbpf: Fix event name too long error
    - libbpf: Remove sample_period init in perf_buffer
    - Use thread-safe function pointer in libbpf_print
    - iommu: Protect against overflow in iommu_pgsize()
    - bonding: assign random address if device address is same as bond
    - f2fs: clean up w/ fscrypt_is_bounce_page()
    - f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed()
    - scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels
    - libbpf: Use proper errno value in linker
    - bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps
    - netfilter: bridge: Move specific fragmented packet to slow_path instead of
      dropping it
    - netfilter: nft_quota: match correctly when the quota just depleted
    - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
    - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
    - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ
    - tracing: Move histogram trigger variables from stack to per CPU structure
    - bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels
    - [arm*] clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
    - wifi: iwlfiwi: mvm: Fix the rate reporting
    - efi/libstub: Describe missing 'out' parameter in efi_load_initrd
    - tracing: Rename event_trigger_alloc() to trigger_data_alloc()
    - tracing: Fix error handling in event_trigger_parse()
    - ktls, sockmap: Fix missing uncharge operation
    - libbpf: Use proper errno value in nlattr
    - bpf: Fix WARN() in get_bpf_raw_tp_regs
    - dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference
    - [s390x] bpf: Store backchain even for leaf progs
    - wifi: rtw89: pci: enlarge retry times of RX tag to 1000
    - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
    - wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips
    - iommu: remove duplicate selection of DMAR_TABLE
    - wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event
    - wifi: ath9k_htc: Abort software beacon handling if disabled
    - scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort()
    - kernfs: Relax constraint in draining guard
    - Bluetooth: ISO: Fix not using SID from adv report
    - wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init()
    - wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()
    - wifi: mt76: mt7925: prevent multiple scan commands
    - wifi: mt76: mt7925: refine the sniffer commnad
    - wifi: mt76: mt7925: ensure all MCU commands wait for response
    - wifi: mt76: mt7996: set EHT max ampdu length capability
    - wifi: mt76: mt7996: fix RX buffer size of MCU event
    - bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in
      multi-uprobe attach logic"
    - netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft
      only builds
    - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
    - vfio/type1: Fix error unwind in migration dirty bitmap allocation
    - Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach()
    - Bluetooth: btintel: Check dsbr size from EFI variable
    - bpf, sockmap: Avoid using sk_socket after free when sending
    - netfilter: nf_tables: nft_fib: consistent l3mdev handling
    - netfilter: nft_tunnel: fix geneve_opt dump
    - [riscv64] RISC-V: KVM: lock the correct mp_state during reset
    - net: usb: aqc111: fix error handling of usbnet read calls
    - vsock/virtio: fix `rx_bytes` accounting for stream sockets
    - RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
    - bpf: Avoid __bpf_prog_ret0_warn when jit fails
    - net: phy: clear phydev->devlink when the link is deleted
    - net: phy: fix up const issues in to_mdio_device() and to_phy_device()
    - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
    - net: lan743x: Fix PHY reset handling during initialization and WOL
    - net: phy: mscc: Fix memory leak when using one step timestamping
    - [arm64] octeontx2-pf: QOS: Perform cache sync on send queue teardown
    - [arm64] octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
    - calipso: Don't call calipso functions for AF_INET sk.
    - net: openvswitch: Fix the dead loop of MPLS parse
    - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames
    - f2fs: use d_inode(dentry) cleanup dentry->d_inode
    - f2fs: fix to correct check conditions in f2fs_cross_rename
    - [arm64] dts: qcom: x1e80100: Mark usb_2 as dma-coherent
    - [arm64] dts: qcom: sm8650: setup gpu thermal with higher temperatures
    - [arm64] dts: qcom: sm8650: add missing cpu-cfg interconnect path in the
      mdss node
    - [arm64] dts: qcom: x1e80100-romulus: Keep L12B and L15B always on
    - [arm64] dts: qcom: sdm845-starqltechn: remove wifi
    - [arm64] dts: qcom: sdm845-starqltechn: fix usb regulator mistake
    - [arm64] dts: qcom: sdm845-starqltechn: refactor node order
    - [arm64] dts: qcom: sdm845-starqltechn: remove excess reserved gpios
    - [arm64] dts: qcom: sm8350: Reenable crypto & cryptobam
    - [arm64] dts: qcom: sm8250: Fix CPU7 opp table
    - [arm64] dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies
    - [arm64] dts: qcom: ipq9574: Fix USB vdd info
    - [arm64] dts: rockchip: Move SHMEM memory to reserved memory on rk3588
    - [arm64] dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains
    - [arm64] dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO
    - [arm64] dts: mt8183: Add port node to mt8183.dtsi
    - [arm64] dts: imx8mm-beacon: Fix RTC capacitive load
    - [arm64] dts: imx8mn-beacon: Fix RTC capacitive load
    - [arm64] dts: imx8mp-beacon: Fix RTC capacitive load
    - [arm64] dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI
      audio
    - [arm64] dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI
      audio
    - [arm64] dts: mediatek: mt6357: Drop regulator-fixed compatibles
    - [arm64] dts: mt6359: Add missing 'compatible' property to regulators node
    - [arm64] dts: qcom: sdm660-lavender: Add missing USB phy supply
    - [arm64] dts: qcom: sda660-ifc6560: Fix dt-validate warning
    - [arm64] dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c
    - [arm64] dts: rockchip: Update eMMC for NanoPi R5 series
    - [arm64] tegra: Drop remaining serial clock-names and reset-names
    - [arm64] tegra: Add uartd serial alias for Jetson TX1 module
    - [arm64] dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E
    - [arm64] soc: qcom: smp2p: Fix fallback to qcom,ipc parse
    - Squashfs: check return result of sb_min_blocksize
    - ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery
    - nilfs2: add pointer check for nilfs_direct_propagate()
    - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
    - bus: fsl-mc: fix double-free on mc_dev
    - dt-bindings: vendor-prefixes: Add Liontron name
    - [arm64] dts: rockchip: disable unrouted USB controllers and PHY on RK3399
      Puma with Haikou
    - [arm64] dts: qcom: qcm2290: fix (some) of QUP interconnects
    - [arm64] dts: renesas: white-hawk-ard-audio: Fix TPU0 groups
    - [arm64] dts: mt6359: Rename RTC node to match binding expectations
    - [armhf] aspeed: Don't select SRAM
    - [armhf] soc: aspeed: lpc: Fix impossible judgment condition
    - [armhf] soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
    - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
    - randstruct: gcc-plugin: Remove bogus void member
    - randstruct: gcc-plugin: Fix attribute addition (Closes: #1104745)
    - perf build: Warn when libdebuginfod devel files are not available
    - perf ui browser hists: Set actions->thread before calling do_zoom_thread()
    - dm: don't change md if dm_table_set_restrictions() fails
    - dm: free table mempools if not used in __bind
    - backlight: pm8941: Add NULL check in wled_configure()
    - [x86] irq: Ensure initial PIR loads are performed exactly once
    - [amd64] hwmon: (asus-ec-sensors) check sensor index in read_string()
    - perf symbol-minimal: Fix double free in filename__read_build_id
    - dm: fix dm_blk_report_zones
    - dm-flakey: error all IOs when num_features is absent
    - dm-flakey: make corrupting read bios work
    - perf intel-pt: Fix PEBS-via-PT data_src
    - perf scripts python: exported-sql-viewer.py: Fix pattern matching with
      Python 3
    - remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe
    - remoteproc: k3-r5: Drop check performed in
      k3_r5_rproc_{mbox_callback/kick}
    - remoteproc: k3-dsp: Drop check performed in
      k3_dsp_rproc_{mbox_callback/kick}
    - [arm64] rpmsg: qcom_smd: Fix uninitialized return variable in
      __qcom_smd_send()
    - [arm64] mailbox: imx: Fix TXDB_V2 sending
    - [arm64] mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting
    - perf symbol: Fix use-after-free in filename__read_build_id
    - perf record: Fix incorrect --user-regs comments
    - perf trace: Always print return value for syscalls returning a pid
    - nfs: clear SB_RDONLY before getting superblock
    - nfs: ignore SB_RDONLY when remounting nfs
    - perf trace: Set errpid to false for rseq and set_robust_list
    - perf callchain: Always populate the addr_location map when adding IP
    - cifs: Fix validation of SMB1 query reparse point response
    - rtc: sh: assign correct interrupts with DT
    - [arm64] phy: rockchip: samsung-hdptx: Fix clock ratio setup
    - [arm64] phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy->rate in case
      of errors
    - PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus()
    - [arm64] PCI: cadence: Fix runtime atomic count underflow
    - [arm64] phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
    - [arm64] dmaengine: ti: Add NULL check in udma_probe()
    - PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()
    - PCI/DPC: Initialize aer_err_info before using it
    - PCI/DPC: Log Error Source ID only when valid
    - rtc: loongson: Add missing alarm notifications for ACPI RTC events
    - PCI: endpoint: Retain fixed-size BAR size as well as aligned size
    - serial: Fix potential null-ptr-deref in mlb_usio_probe()
    - [amd64] thunderbolt: Fix a logic error in wake on connect
    - iio: adc: ad7124: Fix 3dB filter frequency reading
    - usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()
    - [arm64,armhf] coresight: Fixes device's owner field for registered using
      coresight_init_driver()
    - [arm64,armhf] coresight: catu: Introduce refcount and spinlock for
      enabling/disabling
    - counter: interrupt-cnt: Protect enable/disable OPs with mutex
    - [arm64,armhf] coresight: prevent deactivate active config while enabling
      the config
    - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
    - mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array()
    - USB: gadget: udc: fix const issue in gadget_match_driver()
    - USB: typec: fix const issue in typec_match()
    - loop: add file_start_write() and file_end_write()
    - drm/xe: Make xe_gt_freq part of the Documentation
    - Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated
    - page_pool: Fix use-after-free in page_pool_recycle_in_ring
    - net: stmmac: platform: guarantee uniqueness of bus_id
    - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
    - net: tipc: fix refcount warning in tipc_aead_encrypt
    - driver: net: ethernet: mtk_star_emac: fix suspend/resume issue
    - net/mlx4_en: Prevent potential integer overflow calculating Hz
    - net: lan966x: Make sure to insert the vlan tags also in host mode
    - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
    - ice: fix Tx scheduler error handling in XDP callback
    - ice: create new Tx scheduler nodes for new queues only
    - ice: fix rebuilding the Tx scheduler tree for large queue counts
    - idpf: fix a race in txq wakeup
    - idpf: avoid mailbox timeout delays during reset
    - [armhf] net: dsa: tag_brcm: legacy: fix pskb_may_pull length
    - net: stmmac: make sure that ptp_rate is not 0 before configuring
      timestamping
    - net: stmmac: make sure that ptp_rate is not 0 before configuring EST
    - [amd64] drm/i915/guc: Check if expecting reply before decrementing
      outstanding_submission_g2h
    - [amd64] drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP
    - [amd64] drm/i915/guc: Handle race condition where wakeref count drops
      below 0
    - net: fix udp gso skb_segment after pull from frag_list
    - net: wwan: t7xx: Fix napi rx poll issue
    - vmxnet3: correctly report gso type for UDP tunnels
    - PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
    - nvme: fix command limits status code
    - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
    - [arm64,armhf] drm/panel-simple: fix the warnings for the Evervision
      VGG644804
    - netfilter: nf_set_pipapo_avx2: fix initial map fill
    - netfilter: nf_nat: also check reverse tuple to obtain clashing entry
    - [arm64] net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces.
    - [armhf] net: dsa: b53: do not enable RGMII delay on bcm63xx
    - [armhf] net: dsa: b53: allow RGMII for bcm63xx RGMII ports
    - [armhf] net: dsa: b53: do not touch DLL_IQQD on bcm53115
    - wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements
    - net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing
    - wireguard: device: enable threaded NAPI
    - seg6: Fix validation of nexthop addresses
    - [riscv64] misaligned: fix sleeping function called during misaligned
      access handling
    - scsi: ufs: qcom: Prevent calling phy_exit() before phy_init()
    - [amd64] ASoC: codecs: hda: Fix RPM usage count underflow
    - [amd64] ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX
    - [amd64] ASoC: Intel: avs: Verify content returned by parse_int_array()
    - iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec
    - path_overmount(): avoid false negatives
    - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2)
    - do_change_type(): refuse to operate on unmounted/not ours mounts
    - tools/power turbostat: Fix AMD package-energy reporting
    - ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315
    - ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247
    - ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA
    - ALSA: hda/realtek - Support mute led function for HP platform
    - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
    - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
    - Input: synaptics-rmi - fix crash with unsupported versions of F34
    - pmdomain: core: Introduce dev_pm_genpd_rpm_always_on()
    - mmc: sdhci-of-dwcmshc: add PD workaround on RK3576
    - [arm64,armhf] pinctrl: samsung: refactor drvdata suspend & resume
      callbacks
    - [arm64,armhf] pinctrl: samsung: add dedicated SoC eint suspend/resume
      callbacks
    - [arm64,armhf] pinctrl: samsung: add gs101 specific eint suspend/resume
      callbacks
    - dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3
    - dt-bindings: pwm: Correct indentation and style in DTS example
    - dt-bindings: pwm: adi,axi-pwmgen: Fix clocks
    - serial: sh-sci: Move runtime PM enable to sci_probe_single()
    - scsi: core: ufs: Fix a hang in the error handler
    - Bluetooth: hci_core: fix list_for_each_entry_rcu usage
    - Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers
    - Bluetooth: btintel_pcie: Increase the tx and rx descriptor count
    - Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race
      condition
    - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
    - Bluetooth: MGMT: Remove unused mgmt_pending_find_data
    - Bluetooth: MGMT: Protect mgmt_pending list with its own lock
    - [armhf] net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0
    - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
    - ath10k: snoc: fix unbalanced IRQ enable in crash recovery
    - wifi: ath11k: convert timeouts to secs_to_jiffies()
    - wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request()
    - wifi: ath11k: don't use static variables in
      ath11k_debugfs_fw_stats_process()
    - wifi: ath11k: don't wait when there is no vdev started
    - wifi: ath11k: move some firmware stats related functions outside of
      debugfs
    - wifi: ath11k: validate ath11k_crypto_mode on top of
      ath11k_core_qmi_firmware_ready
    - wifi: ath12k: refactor ath12k_hw_regs structure
    - wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850
    - regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt()
    - [arm64,armhf] spi: omap2-mcspi: Disable multi mode when CS should be kept
      asserted after message
    - [arm64,armhf] spi: omap2-mcspi: Disable multi-mode when the previous
      message kept CS asserted
    - [arm64] pinctrl: qcom: pinctrl-qcm2290: Add missing pins
    - scsi: iscsi: Fix incorrect error path labels for flashnode operations
    - net_sched: sch_sfq: fix a potential crash on gso_skb handling
    - [powerpc*] powernv/memtrace: Fix out of bounds issue in memtrace mmap
    - [powerpc*] vas: Return -EINVAL if the offset is non-zero in mmap()
    - [arm64] drm/meson: use unsigned long long / Hz for frequency types
    - [arm64] drm/meson: fix debug log statement when setting the HDMI clocks
    - [arm64] drm/meson: use vclk_freq instead of pixel_freq in debug print
    - [arm64] drm/meson: fix more rounding issues with 59.94Hz modes
    - i40e: return false from i40e_reset_vf if reset is in progress
    - i40e: retry VFLR handling if there is ongoing VF reset
    - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
    - net: Fix TOCTOU issue in sk_is_readable()
    - macsec: MACsec SCI assignment for ES = 0
    - net/mdiobus: Fix potential out-of-bounds read/write access
    - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
    - Bluetooth: Fix NULL pointer deference on eir_get_service_data
    - Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance
    - Bluetooth: eir: Fix possible crashes on eir_create_adv_data
    - Bluetooth: MGMT: Fix sparse errors
    - net/mlx5: Ensure fw pages are always allocated on same NUMA
    - net/mlx5: Fix ECVF vports unload on shutdown flow
    - net/mlx5: Fix return value when searching for existing flow group
    - net/mlx5: HWS, fix missing ip_version handling in definer
    - net/mlx5e: Fix leak of Geneve TLV option object
    - net_sched: prio: fix a race in prio_tune() (CVE-2025-38083)
    - net_sched: red: fix a race in __red_change()
    - net_sched: tbf: fix a race in tbf_change()
    - net_sched: ets: fix a race in ets_qdisc_change()
    - net: drv: netdevsim: don't napi_complete() from netpoll
    - btrfs: exit after state insertion failure at btrfs_convert_extent_bit()
    - fs/filesystems: Fix potential unsigned integer underflow in fs_name()
    - gfs2: pass through holder from the VFS for freeze/thaw
    - btrfs: exit after state split error at set_extent_bit()
    - nvmet-fcloop: access fcpreq only when holding reqlock
    - perf: Ensure bpf_perf_link path is properly serialized
    - block: use q->elevator with ->elevator_lock held in elv_iosched_show()
    - io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()
    - block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work
    - io_uring: consistently use rcu semantics with sqpoll thread
    - bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP
    - block: Fix bvec_set_folio() for very large folios
    - Revert "wifi: mwifiex: Fix HT40 bandwidth issue."
    - ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1
    - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
    - posix-cpu-timers: fix race between handle_posix_cpu_timers() and
      posix_cpu_timer_del()
    - nvmem: zynqmp_nvmem: unbreak driver after cleanup
    - usb: usbtmc: Fix read_stb function and get_stb ioctl
    - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
    - tty: serial: 8250_omap: fix TX with DMA for am33xx
    - usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence
    - usb: cdnsp: Fix issue with detecting command completion event
    - usb: cdnsp: Fix issue with detecting USB 3.2 speed
    - usb: Flush altsetting 0 endpoints before reinitializating them after
      reset.
    - usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx()
    - usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work
    - 9p: Add a migrate_folio method
    - ring-buffer: Do not trigger WARN_ON() due to a commit_overrun
    - ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()
    - ring-buffer: Move cpus_read_lock() outside of buffer->mutex
    - xfs: don't assume perags are initialised when trimming AGs
    - [arm64] xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
    - [x86] iopl: Cure TIF_IO_BITMAP inconsistencies
    - [x86] fred/signal: Prevent immediate repeat of single step trap on return
      from SIGTRAP handler
    - calipso: unlock rcu before returning -EAFNOSUPPORT
    - regulator: dt-bindings: mt6357: Drop fixed compatible requirement
    - usb: misc: onboard_usb_dev: fix build warning for
      CONFIG_USB_ONBOARD_DEV_USB5744=n
    - net: usb: aqc111: debug info before sanitation
    - overflow: Introduce __DEFINE_FLEX for having no initializer
    - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add
    - [arm64] drm/meson: Use 1000ULL when operating with mode->clock
    - thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.35
    - configfs: Do not override creating attribute file failure in
      populate_attrs()
    - [arm64,armhf] crypto: marvell/cesa - Do not chain submitted requests
    - gfs2: move msleep to sleepable context
    - [amd64] crypto: qat - add shutdown handler to qat_c3xxx
    - [amd64] crypto: qat - add shutdown handler to qat_420xx
    - [amd64] crypto: qat - add shutdown handler to qat_4xxx
    - [amd64] crypto: qat - add shutdown handler to qat_c62x
    - [amd64] crypto: qat - add shutdown handler to qat_dh895xcc
    - [arm64] ASoC: qcom: sdm845: Add error handling in
      sdm845_slim_snd_hw_params()
    - [arm64,armhf] ASoC: meson: meson-card-utils: use of_property_present() for
      DT parsing
    - io_uring: account drain memory to cgroup
    - io_uring/kbuf: account ring io_buffer_list memory
    - [powerpc*] pseries/msi: Avoid reading PCI device registers in reduced
      power states
    - [s390x] pci: Remove redundant bus removal and disable from
      zpci_release_device()
    - [s390x] pci: Prevent self deletion in disable_slot()
    - [s390x] pci: Allow re-add of a reserved but not yet removed device
    - [s390x] pci: Serialize device addition and removal
    - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
    - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
    - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
    - wifi: mt76: mt7925: fix host interrupt register initialization
    - wifi: ath11k: fix rx completion meta data corruption
    - wifi: rtw88: usb: Upload the firmware in bigger chunks
    - wifi: ath11k: fix ring-buffer corruption
    - NFSD: unregister filesystem in case genl_register_family() fails
    - NFSD: fix race between nfsd registration and exports_proc
    - NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
    - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
    - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
    - SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
    - NFSv4: Don't check for OPEN feature support in v4.1
    - fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
    - wifi: ath12k: fix ring-buffer corruption
    - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
    - svcrdma: Unregister the device if svc_rdma_accept() fails
    - wifi: rtw88: usb: Reduce control message timeout to 500 ms
    - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
    - [amd64] media: ov8856: suppress probe deferral errors
    - [arm64] media: ov5675: suppress probe deferral errors
    - media: cxusb: no longer judge rbuf when the write fails
    - media: gspca: Add error handling for stv06xx_read_sensor()
    - [amd64] media: intel/ipu6: Fix dma mask for non-secure mode
    - [amd64] media: ipu6: Remove workaround for Meteor Lake ES2
    - [arm64] media: mediatek: vcodec: Correct vsi_core framebuffer size
    - [armhf] media: omap3isp: use sgtable-based scatterlist wrappers
    - media: v4l2-dev: fix error handling in __video_register_device()
    - [arm64] media: venus: Fix probe error handling
    - media: videobuf2: use sgtable-based scatterlist wrappers
    - media: vivid: Change the siize of the composing
    - media: uvcvideo: Return the number of processed controls
    - media: uvcvideo: Send control events for partial succeeds
    - media: uvcvideo: Fix deferred probing error
    - [arm64] mm: Close theoretical race where stale TLB entry remains valid
    - [armel,armhf] 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
    - block: use plug request list tail for one-shot backmerge attempt
    - block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion
    - bus: mhi: ep: Update read pointer only after buffer is written
    - bus: mhi: host: Fix conflict between power_up and SYSERR
    - ceph: avoid kernel BUG for encrypted inode with unaligned file size
    - ceph: set superblock s_magic for IMA fsmagic matching
    - cgroup,freezer: fix incomplete freezing when attaching tasks
    - bus: firewall: Fix missing static inline annotations for stubs
    - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
    - ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard
    - ata: ahci: Disallow LPM for Asus B550-F motherboard
    - [arm64] bus: fsl-mc: do not add a device-link for the UAPI used DPMCP
      device
    - [arm64] bus: fsl-mc: fix GET/SET_TAILDROP command ids
    - ext4: inline: fix len overflow in ext4_prepare_inline_data
    - ext4: fix calculation of credits for extent tree modification
    - ext4: factor out ext4_get_maxbytes()
    - ext4: ensure i_size is smaller than maxbytes
    - ext4: only dirty folios when data journaling regular files
    - [arm*] Input: gpio-keys - fix possible concurrent access in
      gpio_keys_irq_timer()
    - f2fs: fix to do sanity check on ino and xnid
    - f2fs: prevent kernel warning due to negative i_nlink from corrupted image
    - f2fs: fix to do sanity check on sit_bitmap_size
    - hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
    - NFC: nci: uart: Set tty->disc_data only in success path
    - net/sched: fix use-after-free in taprio_dev_notifier
    - net: ftgmac100: select FIXED_PHY
    - [amd64] iommu/vt-d: Restore context entry setup order for aliased devices
    - fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in
      fb_videomode_to_var
    - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
    - vgacon: Add check for vc_origin address range in vgacon_scroll()
    - [arm64] clk: meson-g12a: add missing fclk_div2 to spicc
    - ipc: fix to protect IPCS lookups using RCU
    - watchdog: fix watchdog may detect false positive of softlockup
    - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
    - mm: fix ratelimit_pages update error in dirty_ratio_handler()
    - [arm64] soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
    - configfs-tsm-report: Fix NULL dereference of tsm_ops
    - [arm64] firmware: arm_scmi: Ensure that the message-id supports
      fastchannel
    - [armhf] mtd: rawnand: sunxi: Add randomizer configuration in
      sunxi_nfc_hw_ecc_write_chunk
    - [armhf] mtd: nand: sunxi: Add randomizer configuration before randomizer
      enable
    - [amd64] KVM: SVM: Clear current_vmcb during vCPU free for all *possible*
      CPUs
    - [amd64] KVM: VMX: Flush shadow VMCS on emergency reboot
    - dm-mirror: fix a tiny race condition
    - dm-verity: fix a memory leak if some arguments are specified multiple
      times
    - ftrace: Fix UAF when lookup kallsym after ftrace disabled
    - dm: lock limits when reading them
    - phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
    - net: ch9200: fix uninitialised access during mii_nway_restart
      (CVE-2025-38086)
    - [s390x] KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
    - sysfb: Fix screen_info type check for VGA
    - video: screen_info: Relocate framebuffers behind PCI bridges
    - pwm: axi-pwmgen: fix missing separate external clock
    - staging: iio: ad5933: Correct settling cycles encoding per datasheet
    - ovl: Fix nested backing file paths
    - regulator: max14577: Add error check for max14577_read_reg()
    - [arm64,armhf] remoteproc: core: Cleanup acquired resources when
      rproc_handle_resources() fails in rproc_attach()
    - [arm64,armhf] remoteproc: core: Release rproc->clean_table after
      rproc_attach() fails
    - cifs: reset connections for all channels when reconnect requested
    - cifs: update dstaddr whenever channel iface is updated
    - cifs: dns resolution is needed only for primary channel
    - smb: client: add NULL check in automount_fullpath
    - Drivers: hv: Allocate interrupt and monitor pages aligned to system page
      boundary
    - uio_hv_generic: Use correct size for interrupt and monitor pages
    - uio_hv_generic: Align ring size to system page
    - [arm64] PCI: cadence-ep: Correct PBA offset in .set_msix() callback
    - [arm64] PCI: dwc: ep: Correct PBA offset in .set_msix() callback
    - PCI: Add ACS quirk for Loongson PCIe
    - PCI: Fix lock symmetry in pci_slot_unlock()
    - [arm64] PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from
      rockchip_pcie_link_up()
    - [arm64] PCI: dw-rockchip: Fix PHY function call sequence in
      rockchip_pcie_phy_deinit()
    - iio: accel: fxls8962af: Fix temperature scan element sign
    - [amd64] accel/ivpu: Improve buffer object logging
    - [amd64] accel/ivpu: Use firmware names from upstream repo
    - [amd64] accel/ivpu: Use dma_resv_lock() instead of a custom mutex
    - [amd64] accel/ivpu: Fix warning in ivpu_gem_bo_free()
    - dummycon: Trigger redraw when switching consoles with deferred takeover
    - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
    - iio: imu: inv_icm42600: Fix temperature calculation
    - iio: adc: ad7944: mask high bits on direct read
    - iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build
    - iio: adc: ad7606_spi: fix reg write value mask
    - ACPICA: fix acpi operand cache leak in dswstate.c
    - [amd64] ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
    - clocksource: Fix the CPUs' choice in the watchdog per CPU verification
    - power: supply: collie: Fix wakeup source leaks on device unbind
    - mmc: Add quirk to disable DDR50 tuning
    - ACPICA: Avoid sequence overread in call to strncmp()
    - [amd64] ASoC: intel/sdw_utils: Assign initial value in
      asoc_sdw_rt_amp_spk_rtd_init()
    - ACPI: bus: Bail out if acpi_kobj registration fails
    - ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
    - ACPICA: fix acpi parse and parseext cache leaks
    - ACPICA: Apply pack(1) to union aml_resource
    - ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops
    - power: supply: bq27xxx: Retrieve again when busy
    - pmdomain: core: Reset genpd->states to avoid freeing invalid data
    - ACPICA: utilities: Fix overflow check in vsnprintf()
    - platform-msi: Add msi_remove_device_irq_domain() in
      platform_device_msi_free_irqs_all()
    - Make 'cc-option' work correctly for the -Wno-xyzzy pattern
    - gpiolib: of: Add polarity quirk for s5m8767
    - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
    - power: supply: max17040: adjust thermal channel scaling
    - ACPI: battery: negate current when discharging
    - net: macb: Check return value of dma_set_mask_and_coherent()
    - net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
    - tipc: use kfree_sensitive() for aead cleanup
    - f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
    - bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
    - Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
    - i2c: designware: Invoke runtime suspend on quick slave re-registration
    - wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
    - emulex/benet: correct command version selection in be_cmd_get_stats()
    - Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
    - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
    - wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
    - wifi: mt76: mt7925: introduce thermal protection
    - wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO
    - sctp: Do not wake readers in __sctp_write_space()
    - libbpf/btf: Fix string handling to support multi-split BTF
    - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
    - [arm64,armhf] i2c: tegra: check msg length in SMBUS block read
    - [arm64] clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
    - net: dlink: add synchronization for stats update
    - wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
    - wifi: ath12k: fix a possible dead lock caused by ab->base_lock
    - wifi: ath11k: Fix QMI memory reuse logic
    - [amd64] iommu/amd: Allow matching ACPI HID devices without matching UIDs
    - wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
    - tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
    - tcp: remove zero TCP TS samples for autotuning
    - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
    - tcp: add receive queue awareness in tcp_rcv_space_adjust()
    - [amd64] x86/sgx: Prevent attempts to reclaim poisoned pages
    - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
    - net: page_pool: Don't recycle into cache on PREEMPT_RT
    - xfrm: validate assignment of maximal possible SEQ number
    - net: atlantic: generate software timestamp just before the doorbell
    - [arm64] pinctrl: armada-37xx: propagate error from
      armada_37xx_pmx_set_by_name()
    - [arm64] pinctrl: armada-37xx: propagate error from
      armada_37xx_gpio_get_direction()
    - bpf: Pass the same orig_call value to trampoline functions
    - net: stmmac: generate software timestamp just before the doorbell
    - pinctrl: armada-37xx: propagate error from
      armada_37xx_pmx_gpio_set_direction()
    - libbpf: Check bpf_map_skeleton link for NULL
    - [arm64] pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
    - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
    - wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
    - wifi: mac80211: do not offer a mesh path if forwarding is disabled
    - [armhf] clk: rockchip: rk3036: mark ddrphy as critical
    - hid-asus: check ROG Ally MCU version and warn
    - wifi: iwlwifi: mvm: fix beacon CCK flag
    - f2fs: fix to bail out in get_new_segment()
    - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
    - libbpf: Add identical pointer detection to btf_dedup_is_equiv()
    - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
    - scsi: smartpqi: Add new PCI IDs
    - [amd64] iommu/amd: Ensure GA log notifier callbacks finish running before
      module unload
    - wifi: iwlwifi: pcie: make sure to lock rxq->read
    - wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
    - wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
    - net/mlx5: HWS, Fix IP version decision
    - bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
    - wifi: mac80211: VLAN traffic in multicast path
    - Revert "mac80211: Dynamically set CoDel parameters per station"
    - wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
    - net: bridge: mcast: update multicast contex when vlan state is changed
    - net: bridge: mcast: re-implement br_multicast_{enable, disable}_port
      functions
    - vxlan: Do not treat dst cache initialization errors as fatal
    - bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
    - wifi: ath12k: using msdu end descriptor to check for rx multicast packets
    - net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
    - software node: Correct a OOB check in software_node_get_reference_args()
    - isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
    - [armhf] pinctrl: mcp23s08: Reset all pins to input at probe
    - wifi: ath12k: fix failed to set mhi state error during reboot with
      hardware grouping
    - scsi: lpfc: Use memcpy() for BIOS version
    - sock: Correct error checking condition for (assign|release)_proto_idx()
    - i40e: fix MMIO write access to an invalid page in i40e_clear_hw
    - ixgbe: Fix unreachable retry logic in combined and byte I2C write
      functions
    - [arm64] RDMA/hns: initialize db in update_srq_db()
    - ice: fix check for existing switch rule
    - usbnet: asix AX88772: leave the carrier control to phylink
    - f2fs: fix to set atomic write status more clear
    - bpf, sockmap: Fix data lost during EAGAIN retries
    - net: ethernet: cortina: Use TOE/TSO on all TCP
    - [arm64] octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
    - wifi: ath11k: determine PM policy based on machine model
    - wifi: ath12k: fix link valid field initialization in the monitor Rx
    - wifi: ath12k: fix incorrect CE addresses
    - wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160
      MHz
    - net/mlx5: HWS, Harden IP version definer checks
    - fbcon: Make sure modelist not set on unregistered console
    - watchdog: da9052_wdt: respect TWDMIN
    - [arm64] bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
    - [armhf] OMAP2+: Fix l4ls clk domain handling in STANDBY
    - tee: Prevent size calculation wraparound on 32-bit kernels
    - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices
      first"
    - fs/xattr.c: fix simple_xattr_list()
    - [amd64] platform/x86/amd: pmc: Clear metrics table at start of cycle
    - [amd64] platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running
      twice
    - [amd64] platform/x86: dell_rbu: Fix list usage
    - [amd64] platform/x86: dell_rbu: Stop overwriting data buffer
    - [powerpc*] vdso: Fix build of VDSO32 with pcrel
    - [powerpc*] eeh: Fix missing PE bridge reconfiguration during VFIO EEH
      recovery
    - io_uring/kbuf: don't truncate end buffer for multiple buffer peeks
    - io_uring: fix task leak issue in io_wq_create()
    - drivers/rapidio/rio_cm.c: prevent possible heap overwrite
    - jffs2: check that raw node were preallocated before writing summary
    - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
    - cifs: deal with the channel loading lag while picking channels
    - cifs: serialize other channels when query server interfaces is pending
    - cifs: do not disable interface polling on failure
    - smb: improve directory cache reuse for readdir operations
    - scsi: storvsc: Increase the timeouts to storvsc_timeout
    - scsi: s390: zfcp: Ensure synchronous unit_add
    - nvme: always punt polled uring_cmd end_io work to task_work
    - net_sched: sch_sfq: reject invalid perturb period
    - net: clear the dst when changing skb protocol
    - mm: close theoretical race where stale TLB entries could linger
    - udmabuf: use sgtable-based scatterlist wrappers
    - [amd64] x86/virt/tdx: Avoid indirect calls to TDX assembly functions
    - ksmbd: fix null pointer dereference in destroy_previous_session
    - [amd64] platform/x86: ideapad-laptop: use usleep_range() for EC polling
    - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
    - [amd64] platform/x86/intel-uncore-freq: Fail module load when plat_info is
      NULL
    - sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from
      sched_create_group()
    - atm: Revert atm_account_tx() if copy_from_iter_full() fails.
    - wifi: rtw89: phy: add dummy C2H event handler for report of TAS power
    - cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update
      (CVE-2025-23137)
    - Input: sparcspkr - avoid unannotated fall-through
    - wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in
      error path
    - wifi: cfg80211: init wiphy_work before allocating rfkill fails
      (CVE-2025-22119)
    - [arm64] Restrict pagetable teardown to avoid false warning
    - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound
      card
    - ALSA: hda/intel: Add Thinkpad E15 to PM deny list
    - ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP
      Victus 15-fa1xxx
    - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
    - ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA
    - ALSA: hda/realtek: Add quirk for Asus GU605C
    - iio: accel: fxls8962af: Fix temperature calculation
    - mm/hugetlb: unshare page tables during VMA split, not before
      (CVE-2025-38084)
    - drm/amdgpu: read back register after written for VCN v4.0.5
    - kbuild: rust: add rustc-min-version support function
    - net: Fix checksum update for ILA adj-transport
    - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
    - erofs: remove unused trace event erofs_destroy_inode
    - nfsd: use threads array as-is in netlink interface
    - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
    - [arm64] drm/v3d: Avoid NULL pointer dereference in
      `v3d_job_update_stats()`
    - ipv6: remove leftover ip6 cookie initializer
    - ipv6: replace ipcm6_init calls with ipcm6_init_sk
    - smb: fix secondary channel creation issue with kerberos by populating
      hostname when adding channels
    - [arm64] drm/msm/disp: Correct porch timing for SDM845
    - [arm64] drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
    - [arm64] drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names
    - [arm64] drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE
    - ionic: Prevent driver/fw getting out of sync on devcmd(s)
    - drm/nouveau/bl: increase buffer size to avoid truncate warning
    - [amd64] drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
    - [armhf] hwmon: (occ) Rework attribute registration for stack usage
    - [armhf] hwmon: (occ) fix unaligned accesses
    - aoe: clean device rq_list in aoedev_downdev()
    - io_uring/sqpoll: don't put task_struct on tctx setup failure
    - net: ice: Perform accurate aRFS flow match
    - ice: fix eswitch code memory leak in reset scenario
    - e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13
    - workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
    - ksmbd: add free_transport ops in ksmbd connection
    - net: netmem: fix skb_ensure_writable with unreadable skbs
    - bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
    - eth: bnxt: fix out-of-range access of vnic_info array (CVE-2025-22112)
    - bnxt_en: Add a helper function to configure MRU and RSS
    - bnxt_en: Update MRU and RSS table of RSS contexts on queue reset
    - ptp: fix breakage after ptp_vclock_in_use() rework
    - ptp: allow reading of currently dialed frequency to succeed on
      free-running clocks
    - wifi: carl9170: do not ping device which has failed to load firmware
    - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
    - atm: atmtcp: Free invalid length skb in atmtcp_c_send().
    - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen()
      behavior
    - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
    - tcp: fix passive TFO socket having invalid NAPI ID
    - eth: fbnic: avoid double free when failing to DMA-map FW msg
    - net: lan743x: fix potential out-of-bounds write in
      lan743x_ptp_io_event_clock_get()
    - ublk: santizize the arguments from userspace when adding a device
    - drm/xe: Wire up device shutdown handler
    - drm/xe/gt: Update handling of xe_force_wake_get return
    - drm/xe/bmg: Update Wa_16023588340
    - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
    - mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
    - net: atm: add lec_mutex
    - net: atm: fix /proc/net/atm/lec handling
    - [amd64] EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
    - dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
    - smb: Log an error when close_all_cached_dirs fails
    - serial: sh-sci: Clean sci_ports[0] after at earlycon exit
    - serial: sh-sci: Increment the runtime usage counter for the earlycon
      device
    - smb: client: fix first command failure during re-negotiation
    - smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
    - [s390x] pci: Fix __pcilg_mio_inuser() inline assembly
    - perf: Fix sample vs do_exit()
    - perf: Fix cgroup state vs ERROR
    - perf/core: Fix WARN in perf_cgroup_switch()
    - [arm64] ptrace: Fix stack-out-of-bounds read in
      regs_get_kernel_stack_nth()
    - [riscv64] KVM: Fix the size parameter check in SBI SFENCE calls
    - [riscv64] KVM: Don't treat SBI HFENCE calls as NOPs
    - [arm64,armhf] gpio: pca953x: fix wrong error probe return value
    - cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr()
      function
    - bpftool: Fix cgroup command to only show cgroup bpf programs

  [ Uwe Kleine-König ]
  * Disable CONFIG_CDROM_PKTCDVD for all archs as this driver is
    orphaned, buggy and not needed. (Closes: #1107479)
  * [armhf] Enable various kernel modules for the machines defined in the
    device-trees st/stm32mp153c-lxa-tac-gen3,
    st/stm32mp153c-lxa-fairytux2-gen1 and st/stm32mp153c-lxa-fairytux2-gen2
    (Closes: #1105865)

  [ Macpaul Lin ]
  * [arm64] drivers/usb/typec/mux: Enable TYPEC_MUX_IT5205 as module
  * [arm64] sound/soc/mediatek: Enable sound for MediaTek MT8365 EVK
    - Enable SND_SOC_MT8365 as module
    - Enable SND_SOC_MT8365_MT6357 as module
  * [arm64] drivers/dma/mediatek: Enable DMA support for MediaTek peripherals
    - Enable MTK_HSDMA as module
    - Enable MTK_UART_APDMA as module
  * [arm64] drivers/net/ethernet/mediatek: Enable ethernet for MT8365
    - Enable NET_MEDIATEK_STAR_EMAC as module
  * drivers/bluetooth: set BT_HCIBTUSB_POLL_SYNC=y
  * All the above Closes: #1108597

  [ наб ]
  * Don't compress perf's tips.txt (Closes: #1088747)

  [ Aurelien Jarno ]
  * [riscv64] Enable BRCMFMAC_SDIO (Closes: #1108215)

  [ Salvatore Bonaccorso ]
  * ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
    (Closes: #1108069)
  * Revert "mmc: sdhci: Disable SD card clock before changing parameters"
    (Closes: #1108065)

  [ Bastian Blank ]
  * [cloud] Enable SATA_AHCI.

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 03 Jul 2025 21:01:19 +0200

linux (6.12.33-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.33
    - tracing: Fix compilation warning on arm32
    - f2fs: fix to avoid accessing uninitialized curseg (CVE-2025-22123)
    - [arm64] pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs >
      31
    - [arm64] pinctrl: armada-37xx: set GPIO output value before setting
      direction
    - acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio()
    - Documentation: ACPI: Use all-string data node references
    - rtc: Make rtc_time64_to_tm() support dates before 1970
    - rtc: Fix offset calculation for .start_secs < 0
    - [amd64] accel/ivpu: Add initial Panther Lake support
    - [amd64] accel/ivpu: Update power island delays
    - PCI/ASPM: Disable L1 before disabling L1 PM Substates
    - block: fix adding folio to bio (CVE-2025-22122)
    - Revert "cpufreq: tegra186: Share policy per cluster"
    - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
    - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
    - USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB
    - Bluetooth: hci_qca: move the SoC type check to the right place
    - serial: jsm: fix NPE during jsm_uart_port_init
    - usb: usbtmc: Fix timeout value in get_stb
    - [amd64] thunderbolt: Do not double dequeue a configuration request
    - dt-bindings: usb: cypress,hx3: Add support for all variants
    - dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt
      property

  [ Ben Hutchings ]
  * d/rules: Include target suite as an input to gencontrol.py
  * Move package revision and ABI name rules to configuration
  * Include target Debian release number in ABI name
  * Add suffix to ABI name to distinguish Debian versions with same upstream

  [ Uwe Kleine-König ]
  * [arm64] Enable Marvell OcteonTX2 NIC driver (Closes: #1098437)
  * [armhf] Enable M_CAN support, used e.g. on stm32mp153 and stm32mp157

  [ Macpaul Lin ]
  * [arm64] usb/typec: Enable TYPEC_RT1711H as module

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 19 Jun 2025 17:38:19 +0200

linux (6.12.32-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.31
    - drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401
    - drm/amd/display: Do not enable replay when vtotal update is pending.
    - drm/amd/display: Correct timing_adjust_pending flag setting.
    - drm/amd/display: Defer BW-optimization-blocked DRR adjustments
    - i2c: designware: Use temporary variable for struct device
    - i2c: designware: Fix an error handling path in i2c_dw_pci_probe()
    - [arm64] phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
    - [arm64] phy: renesas: rcar-gen3-usb2: Lock around hardware registers and
      driver data
    - [arm64] phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
    - cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist
    - [arm64] nvmem: rockchip-otp: Move read-offset into variant-data
    - [arm64] nvmem: rockchip-otp: add rk3576 variant data
    - nvmem: core: fix bit offsets of more than one byte
    - nvmem: core: verify cell's raw_len
    - nvmem: core: update raw_len if the bit reading is required
    - nvmem: qfprom: switch to 4-byte aligned reads
    - scsi: target: iscsi: Fix timeout on deleted connection
    - scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices
    - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
    - dma/mapping.c: dev_dbg support for dma_addressing_limited
    - [amd64] intel_th: avoid using deprecated page->mapping, index fields
    - [amd64] mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf
      type
    - dma-mapping: avoid potential unused data compilation warning
    - cgroup: Fix compilation issue due to cgroup_mutex not being exported
    - vhost_task: fix vhost_task_create() documentation
    - vhost-scsi: protect vq->log_used with vq->mutex
    - scsi: mpi3mr: Add level check to control event logging
    - net: enetc: refactor bulk flipping of RX buffers to separate function
    - dma-mapping: Fix warning reported for missing prototype
    - ima: process_measurement() needlessly takes inode_lock() on MAY_READ
    - fs/buffer: split locking for pagecache lookups
    - fs/buffer: introduce sleeping flavors for pagecache lookups
    - fs/buffer: use sleeping version of __find_get_block()
    - fs/ocfs2: use sleeping version of __find_get_block()
    - fs/jbd2: use sleeping version of __find_get_block()
    - fs/ext4: use sleeping version of sb_find_get_block()
    - drm/amd/display: Enable urgent latency adjustment on DCN35
    - drm/amdgpu: Allow P2P access through XGMI
    - block: fix race between set_blocksize and read paths
    - io_uring: don't duplicate flushing in io_req_post_cqe
    - bpf: fix possible endless loop in BPF map iteration
    - kconfig: merge_config: use an empty file as initfile
    - [x86] fred: Fix system hang during S4 resume with FRED enabled
    - [s390x] vfio-ap: Fix no AP queue sharing allowed message written to kernel
      log
    - cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES
    - cifs: Fix querying and creating MF symlinks over SMB1
    - cifs: Fix negotiate retry functionality
    - smb: client: Store original IO parameters and prevent zero IO sizes
    - fuse: Return EPERM rather than ENOSYS from link()
    - exfat: call bh_read in get_block only when necessary
    - io_uring/msg: initialise msg request opcode
    - NFSv4: Check for delegation validity in
      nfs_start_delegation_return_locked()
    - NFS: Don't allow waiting for exiting tasks
    - SUNRPC: Don't allow waiting for exiting tasks
    - [arm64] Add support for HIP09 Spectre-BHB mitigation
    - iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability
    - tracing: Mark binary printing functions with __printf() attribute
    - ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list
    - tpm: Convert warn to dbg in tpm2_start_auth_session()
    - [amd64,arm64] mailbox: pcc: Use acpi_os_ioremap() instead of ioremap()
    - mailbox: use error ret code of of_parse_phandle_with_args()
    - [riscv64] Allow NOMMU kernels to access all of RAM
    - fbdev: fsl-diu-fb: add missing device_remove_file()
    - fbcon: Use correct erase colour for clearing in fbcon
    - fbdev: core: tileblit: Implement missing margin clearing for tileblit
    - cifs: Set default Netbios RFC1001 server name to hostname in UNC
    - cifs: add validation check for the fields in smb_aces
    - cifs: Fix establishing NetBIOS session for SMB2+ connection
    - NFSv4: Treat ENETUNREACH errors as fatal for state recovery
    - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
    - SUNRPC: rpcbind should never reset the port to the value '0'
    - [arm64,armhf] spi-rockchip: Fix register out of bounds access
    - [arm64] ASoC: codecs: wsa883x: Correct VI sense channel mask
    - mctp: Fix incorrect tx flow invalidation condition in mctp-i2c
    - [arm64] thermal/drivers/mediatek/lvts: Start sensor interrupts disabled
    - [arm64] thermal/drivers/qoriq: Power down TMU on system suspend
    - Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler
      removal
    - Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken
    - dql: Fix dql->limit value when reset.
    - lockdep: Fix wait context check on softirq for PREEMPT_RT
    - objtool: Properly disable uaccess validation
    - [arm64] PCI: dwc: ep: Ensure proper iteration over outbound map windows
    - r8169: disable RTL8126 ZRX-DC timeout
    - tools/build: Don't pass test log files to linker
    - pNFS/flexfiles: Report ENETDOWN as a connection error
    - drm/amdgpu/discovery: check ip_discovery fw file available
    - drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12
    - PCI: vmd: Disable MSI remapping bypass under Xen
    - xen/pci: Do not register devices with segments >= 0x10000
    - ext4: on a remount, only log the ro or r/w state when it has changed
    - libnvdimm/labels: Fix divide error in nd_label_data_init()
    - pidfs: improve multi-threaded exec and premature thread-group leader exit
      polling
    - staging: vchiq_arm: Create keep-alive thread during probe
    - mmc: host: Wait for Vdd to settle on card power off
    - drm/amdgpu: Skip pcie_replay_count sysfs creation for VF
    - cgroup/rstat: avoid disabling irqs for O(num_cpu)
    - wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
    - wifi: mt76: mt7996: fix SER reset trigger on WED reset
    - wifi: mt76: mt7996: revise TXS size
    - wifi: mt76: mt7925: load the appropriate CLC data based on hardware type
    - wifi: mt76: mt7925: fix fails to enter low power mode in suspend state
    - [x86] headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers
    - [x86] stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP
    - [x86] smpboot: Fix INIT delay assignment for extended Intel Families
    - [x86] microcode: Update the Intel processor flag scan check
    - [x86] mm: Check return value from memblock_phys_alloc_range()
    - [arm64] i2c: qup: Vote for interconnect bandwidth to DRAM
    - [arm64,armhf] i2c: pxa: fix call balance of i2c->clk handling routines
    - btrfs: make btrfs_discard_workfn() block_group ref explicit
    - btrfs: avoid linker error in btrfs_find_create_tree_block()
    - btrfs: run btrfs_error_commit_super() early
    - btrfs: fix non-empty delayed iputs list on unmount due to async workers
    - btrfs: get zone unusable bytes while holding lock at
      btrfs_reclaim_bgs_work()
    - btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
    - blk-cgroup: improve policy registration error handling
    - drm/amdgpu: release xcp_mgr on exit
    - drm/amd/display: Guard against setting dispclk low for dcn31x
    - drm/amdgpu: adjust drm_firmware_drivers_only() handling
    - i3c: master: svc: Fix missing STOP for master request
    - [s390x] tlb: Use mm_has_pgste() instead of mm_alloc_pgste()
    - dlm: make tcp still work in multi-link env
    - wifi: mwifiex: Fix HT40 bandwidth issue.
    - bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set
    - [riscv64] Call secondary mmu notifier when flushing the tlb
    - ext4: reorder capability check last
    - hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure
    - scsi: st: Tighten the page format heuristics with MODE SELECT
    - scsi: st: ERASE does not change tape location
    - vfio/pci: Handle INTx IRQ_NOTCONNECTED
    - bpf: Return prog btf_id without capable check
    - [arm64,armhf] PCI: dwc: Use resource start as ioremap() input in
      dw_pcie_pme_turn_off()
    - jbd2: do not try to recover wiped journal
    - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
    - rtc: rv3032: fix EERD location
    - objtool: Fix error handling inconsistencies in check()
    - [amd64] thunderbolt: Do not add non-active NVM if NVM upgrade is disabled
      for retimer
    - erofs: initialize decompression early
    - spi: spi-mux: Fix coverity issue, unchecked return value
    - bpf: Allow pre-ordering for bpf cgroup progs
    - kbuild: fix argument parsing in scripts/config
    - kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf
    - dm: restrict dm device size to 2^63-512 bytes
    - net/smc: use the correct ndev to find pnetid by pnetid table
    - xen: Add support for XenServer 6.1 platform device
    - [arm64,armhf] pinctrl-tegra: Restore SFSEL bit when freeing pins
    - drm/amdgpu/gfx12: don't read registers in mqd init
    - drm/amdgpu/gfx11: don't read registers in mqd init
    - drm/amdgpu: Update SRIOV video codec caps
    - [armhf] ASoC: sun4i-codec: support hp-det-gpios property
    - [arm64] clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for
      QCM6490
    - ext4: reject the 'data_err=abort' option in nojournal mode
    - ext4: do not convert the unwritten extents if data writeback fails
    - RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
    - posix-timers: Add cond_resched() to posix_timer_add() search loop
    - posix-timers: Ensure that timer initialization is fully visible
    - [arm64,armhf] net: stmmac: dwmac-rk: Validate GRF and peripheral GRF
      during probe
    - net: hsr: Fix PRP duplicate detection
    - timer_list: Don't use %pK through printk()
    - wifi: rtw89: set force HE TB mode when connecting to 11ax AP
    - netfilter: conntrack: Bound nf_conntrack sysctl writes
    - PNP: Expand length of fixup id string
    - phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the
      corresponding set flags are set
    - [arm64] mm: Check pmd_table() in pmd_trans_huge()
    - [arm64] mm: Check PUD_TYPE_TABLE in pud_bad()
    - [armhf] mmc: dw_mmc: add exynos7870 DW MMC support
    - mmc: sdhci: Disable SD card clock before changing parameters
    - usb: xhci: Don't change the status of stalled TDs on failed Stop EP
    - wifi: iwlwifi: mvm: fix setting the TK when associated
    - [amd64] hwmon: (dell-smm) Increment the number of fans
    - iommu: Keep dev->iommu state consistent
    - printk: Check CON_SUSPEND when unblanking a console
    - wifi: iwlwifi: don't warn when if there is a FW error
    - wifi: iwlwifi: w/a FW SMPS mode selection
    - wifi: iwlwifi: fix debug actions order
    - wifi: iwlwifi: mark Br device not integrated
    - wifi: iwlwifi: fix the ECKV UEFI variable name
    - wifi: mac80211: fix warning on disconnect during failed ML reconf
    - wifi: mac80211_hwsim: Fix MLD address translation
    - wifi: cfg80211: allow IR in 20 MHz configurations
    - ipv6: save dontfrag in cork
    - drm/amd/display: remove minimum Dispclk and apply oem panel timing.
    - drm/amd/display: calculate the remain segments for all pipes
    - drm/amd/display: not abort link train when bw is low
    - drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch
    - gfs2: Check for empty queue in run_queue
    - auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct
      hd44780_common"
    - [arm64] ASoC: qcom: sm8250: explicitly set format in
      sm8250_be_hw_params_fixup()
    - badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable <
      0
    - [arm64,armhf] coresight-etb10: change etb_drvdata spinlock's type to
      raw_spinlock_t
    - [amd64] iommu/amd/pgtbl_v2: Improve error handling
    - watchdog: aspeed: Update bootstatus handling
    - PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
    - crypto: lzo - Fix compression buffer overrun
    - crypto: mxs-dcp - Only set OTP_KEY bit for OTP key
    - drm/amdkfd: Set per-process flags only once for gfx9/10/11/12
    - drm/amdkfd: Set per-process flags only once cik/vi
    - drm/amdgpu: Fix missing drain retry fault the last entry
    - [arm64] tegra: p2597: Fix gpio for vdd-1v8-dis regulator
    - [arm64] tegra: Resize aperture for the IGX PCIe C5 slot
    - [powerpc*] prom_init: Fixup missing #size-cells on PowerBook6,7
    - ALSA: seq: Improve data consistency at polling
    - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
    - rtc: ds1307: stop disabling alarms on probe
    - ieee802154: ca8210: Use proper setters and getters for bitwise types
    - drm/xe: Nuke VM's mapping upon close
    - drm/xe: Retry BO allocation
    - [arm64,armhf] soc: samsung: include linux/array_size.h where needed
    - media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
    - usb: xhci: set page size to the xHCI-supported size
    - dm cache: prevent BUG_ON by blocking retries on failed device resumes
    - [arm64] soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables
    - orangefs: Do not truncate file size
    - drm/gem: Test for imported GEM buffers with helper
    - net: phylink: use pl->link_interface in phylink_expects_phy()
    - blk-throttle: don't take carryover for prioritized processing of metadata
    - remoteproc: qcom_wcnss: Handle platforms with only single power domain
    - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
    - drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35
    - drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination
    - drm/amd/display: Fix DMUB reset sequence for DCN401
    - drm/amd/display: Fix p-state type when p-state is unsupported
    - drm/amd/display: Request HW cursor on DCN3.2 with SubVP
    - perf/core: Clean up perf_try_init_event()
    - media: cx231xx: set device_caps for 417
    - rcu: Fix get_state_synchronize_rcu_full() GP-start detection
    - [armhf] net: ethernet: ti: cpsw_new: populate netdev of_node
    - dpll: Add an assertion to check freq_supported_num
    - ublk: enforce ublks_max only for unprivileged devices
    - iommufd: Disallow allocating nested parent domain with fault ID
    - net: pktgen: fix mpls maximum labels list parsing
    - perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type
    - ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7
    - scsi: logging: Fix scsi_logging_level bounds
    - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
    - drm/rockchip: vop2: Add uv swap for cluster window
    - block: mark bounce buffering as incompatible with integrity
    - ublk: complete command synchronously on error
    - media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
    - media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value
    - [arm64] clk: imx8mp: inform CCF of maximum frequency of clocks
    - [x86] bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
    - hwmon: (gpio-fan) Add missing mutex locks
    - [arm64] drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
    - [arm64] perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling
      counters
    - wifi: ath12k: Report proper tx completion status to mac80211
    - PCI: brcmstb: Expand inbound window size up to 64GB
    - PCI: brcmstb: Add a softdep to MIP MSI-X driver
    - drm/xe/vf: Retry sending MMIO request to GUC on timeout error
    - drm/xe/pf: Create a link between PF and VF devices
    - net/mlx5: Avoid report two health errors on same syndrome
    - pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf
    - drm/amdkfd: KFD release_work possible circular locking
    - drm/xe: xe_gen_wa_oob: replace program_invocation_short_name
    - leds: pwm-multicolor: Add check for fwnode_property_read_u32
    - [arm64] net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q
      only
    - [arm64] net: xgene-v2: remove incorrect ACPI_PTR annotation
    - bonding: report duplicate MAC address in all situations
    - wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band
    - [arm64] soc: ti: k3-socinfo: Do not use syscon helper to build regmap
    - bpf: Search and add kfuncs in struct_ops prologue and epilogue
    - [x86] build: Fix broken copy command in genimage.sh when making isoimage
    - drm/amd/display: handle max_downscale_src_width fail check
    - drm/amd/display: fix dcn4x init failed
    - drm/amd/display: Fix mismatch type comparison
    - [arm64] ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile
    - [arm64] ASoC: mediatek: mt8188: Add reference for dmic clocks
    - [x86] nmi: Add an emergency handler in nmi_desc & use it in
      nmi_shootdown_cpus()
    - vhost-scsi: Return queue full for page alloc failures during copy
    - vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines
    - cpuidle: menu: Avoid discarding useful information
    - net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode
    - scsi: mpi3mr: Update timestamp only for supervisor IOCs
    - loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize
    - libbpf: Fix out-of-bound read
    - dm: fix unconditional IO throttle caused by REQ_PREFLUSH
    - scsi: scsi_debug: First fixes for tapes
    - net/mlx5: Change POOL_NEXT_SIZE define value and make it global
    - [x86] kaslr: Reduce KASLR entropy on most x86 systems
    - crypto: ahash - Set default reqsize from ahash_alg
    - crypto: skcipher - Zap type in crypto_alloc_sync_skcipher
    - net: ipv6: Init tunnel link-netns before registering dev
    - drm/xe/oa: Ensure that polled read returns latest data
    - [mips*] Use arch specific syscall name match function
    - drm/amdgpu: remove all KFD fences from the BO on release
    - [x86] locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op()
    - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of
      iommu_cookie
    - [mips*] pm-cps: Use per-CPU variables as per-CPU, not per-core
    - [mips*] clocksource: mips-gic-timer: Enable counter when CPUs start
    - scsi: mpt3sas: Send a diag reset if target reset fails
    - wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
    - wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
    - wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
    - wifi: rtw89: fw: propagate error code from rtw89_h2c_tx()
    - wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32()
    - wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware
    - wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU
    - net: pktgen: fix access outside of user given buffer in
      pktgen_thread_write()
    - power: supply: axp20x_battery: Update temp sensor for AXP717 from device
      tree
    - [amd64] EDAC/ie31200: work around false positive build warning
    - i3c: master: svc: Flush FIFO before sending Dynamic Address
      Assignment(DAA)
    - [arm*] mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs
    - eeprom: ee1004: Check chip before probing
    - [riscv64] irqchip/riscv-imsic: Separate next and previous pointers in
      IMSIC vector
    - drm/amd/pm: Fetch current power limit from PMFW
    - drm/amd/display: Add support for disconnected eDP streams
    - drm/amd/display: Guard against setting dispclk low when active
    - drm/amd/display: Fix BT2020 YCbCr limited/full range input
    - drm/amd/display: Read LTTPR ALPM caps during link cap retrieval
    - Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP"
    - drm/amd/display: Don't treat wb connector as physical in
      create_validate_stream_for_sink
    - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
    - RDMA/core: Fix best page size finding when it can cross SG entries
    - pmdomain: imx: gpcv2: use proper helper for property detection
    - can: c_can: Use of_property_present() to test existence of DT property
    - bpf: don't do clean_live_states when state->loop_entry->branches > 0
    - bpf: copy_verifier_state() should copy 'loop_entry' field
    - eth: mlx4: don't try to complete XDP frames in netpoll
    - PCI: Fix old_size lower bound in calculate_iosize() too
    - [amd64,arm64] ACPI: HED: Always initialize before evged
    - vxlan: Join / leave MC group after remote changes
    - hrtimers: Replace hrtimer_clock_to_base_table with switch-case
    - [riscv64] irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base
    - net/mlx5: Modify LSB bitmask in temperature event to include only the
      first bit
    - net/mlx5: Apply rate-limiting to high temperature warning
    - [arm64] firmware: xilinx: Dont send linux address to get fpga config get
      status
    - ASoC: ops: Enforce platform maximum on initial value
    - ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
    - pinctrl: devicetree: do not goto err when probing hogs in
      pinctrl_dt_to_map
    - media: v4l: Memset argument to 0 before calling get_mbus_config pad op
    - net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
    - drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init()
    - drm/xe: Fix xe_tile_init_noalloc() error propagation
    - [arm64] clk: qcom: clk-alpha-pll: Do not use random stack value for recalc
      rate
    - drm/xe/debugfs: fixed the return value of wedged_mode_set
    - drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set
    - [x86] ibt: Handle FineIBT in handle_cfi_failure()
    - [x86] traps: Cleanup and robustify decode_bug()
    - sched: Reduce the default slice to avoid tasks getting an extra tick
    - serial: sh-sci: Update the suspend/resume support
    - [arm64] pinctrl: renesas: rzg2l: Add suspend/resume support for pull
      up/down
    - [arm64] phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF
      and ROPLL_REF
    - phy: core: don't require set_mode() callback for phy_get_mode() to work
    - [arm64,armhf] phy: exynos5-usbdrd: fix EDS distribution tuning (gs101)
    - soundwire: amd: change the soundwire wake enable/disable sequence
    - soundwire: cadence_master: set frame shape and divider based on actual clk
      freq
    - drm/amdgpu/mes11: fix set_hw_resources_1 calculation
    - drm/amdkfd: fix missing L2 cache info in topology
    - drm/amdgpu: Set snoop bit for SDMA for MI series
    - drm/amd/display: pass calculated dram_speed_mts to dml2
    - drm/amd/display: Don't try AUX transactions on disconnected link
    - drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
    - drm/amd/pm: Skip P2S load for SMU v13.0.12
    - drm/amd/display: Support multiple options during psr entry.
    - Revert "drm/amd/display: Exit idle optimizations before attempt to access
      PHY"
    - drm/amd/display: Update CR AUX RD interval interpretation
    - drm/amd/display: Initial psr_version with correct setting
    - drm/amd/display: Increase block_sequence array size
    - drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It
    - drm/amd/display: Populate register address for dentist for dcn401
    - drm/amdgpu: Use active umc info from discovery
    - drm/amdgpu: enlarge the VBIOS binary size limit
    - drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer()
    - scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr()
    - net/mlx5: XDP, Enable TX side XDP multi-buffer support
    - net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
    - net/mlx5e: set the tx_queue_len for pfifo_fast
    - net/mlx5e: reduce rep rxq depth to 256 for ECPF
    - net/mlx5e: reduce the max log mpwrq sz for ECPF and reps
    - drm/v3d: Add clock handling
    - xfrm: prevent high SEQ input in non-ESN mode
    - wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV
    - mptcp: pm: userspace: flags: clearer msg if no remote addr
    - wifi: iwlwifi: use correct IMR dump variable
    - wifi: iwlwifi: don't warn during reprobe
    - wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
    - wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
    - wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx
    - net: fec: Refactor MAC reset to function
    - [powerpc*] pseries/iommu: memory notifier incorrectly adds TCEs for
      pmemory
    - [powerpc*] pseries/iommu: create DDW for devices with DMA mask less than
      64-bits
    - [powerpc*] arch/powerpc/perf: Check the instruction type before creating
      sample with perf_mem_data_src
    - ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
    - r8152: add vendor/device ID pair for Dell Alienware AW1022z
    - pstore: Change kmsg_bytes storage size to u32
    - leds: trigger: netdev: Configure LED blink interval for HW offload
    - ext4: don't write back data before punch hole in nojournal mode
    - ext4: remove writable userspace mappings before truncating page cache
    - wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
    - wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
    - wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang
    - wifi: rtw89: fw: validate multi-firmware header before getting its size
    - wifi: rtw89: fw: validate multi-firmware header before accessing
    - wifi: rtw89: call power_on ahead before selecting firmware
    - [arm64] clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
    - net: page_pool: avoid false positive warning if NAPI was never added
    - tools/power turbostat: Clustered Uncore MHz counters should honor
      show/hide options
    - [arm64] hwmon: (xgene-hwmon) use appropriate type for the latency value
    - f2fs: introduce f2fs_base_attr for global sysfs entries
    - [arm64] media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware
      is available
    - [arm64] media: qcom: camss: Add default case in vfe_src_pad_code
    - [arm64] drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0
    - eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when
      adding unicast addrs
    - tools: ynl-gen: don't output external constants
    - net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
    - cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost
    - vxlan: Annotate FDB data races
    - ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only
    - r8169: don't scan PHY addresses > 0
    - net: flush_backlog() small changes
    - bridge: mdb: Allow replace of a host-joined group
    - ice: init flow director before RDMA
    - ice: treat dyn_allowed only as suggestion
    - rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
    - rcu: handle unstable rdp in rcu_read_unlock_strict()
    - rcu: fix header guard for rcu_all_qs()
    - perf: Avoid the read if the count is already updated
    - ice: count combined queues using Rx/Tx count
    - drm/xe/relay: Don't use GFP_KERNEL for new transactions
    - net/mana: fix warning in the writer of client oob
    - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
    - scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk
    - scsi: lpfc: Free phba irq in lpfc_sli4_enable_msi() when pci_irq_vector()
      fails
    - scsi: st: Restore some drive settings after reset
    - wifi: ath12k: Avoid napi_sync() before napi_enable()
    - HID: usbkbd: Fix the bit shift number for LED_KANA
    - [arm64] zynqmp: add clock-output-names property in clock nodes
    - [amd64] ASoC: rt722-sdca: Add some missing readable registers
    - [riscv64] irqchip/riscv-aplic: Add support for hart indexes
    - dm vdo indexer: prevent unterminated string warning
    - dm vdo: use a short static string for thread name prefix
    - drm/ast: Find VBIOS mode from regular display size
    - bpf: Use kallsyms to find the function name of a struct_ops's stub
      function
    - bpftool: Fix readlink usage in get_fd_type
    - [arm64] firmware: arm_scmi: Relax duplicate name constraint across
      protocol ids
    - [amd64] perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
    - [amd64] perf/amd/ibs: Fix ->config to sample period calculation for OP PMU
    - [arm64] clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation
    - wifi: rtl8xxxu: retry firmware download on error
    - wifi: rtw88: Don't use static local variable in
      rtw8822b_set_tx_power_index_by_rate
    - wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet
    - regulator: ad5398: Add device tree support
    - wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override
    - accel/qaic: Mask out SR-IOV PCI resources
    - drm/xe/pf: Reset GuC VF config when unprovisioning critical resource
    - wifi: ath9k: return by of_get_mac_address
    - wifi: ath12k: Fetch regdb.bin file from board-2.bin
    - wifi: ath12k: Fix end offset bit definition in monitor ring descriptor
    - drm: bridge: adv7511: fill stream capabilities
    - drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE
    - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation
    - drm/xe: Move suballocator init to after display init
    - drm/xe: Do not attempt to bootstrap VF in execlists mode
    - wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event
    - drm/xe/sa: Always call drm_suballoc_manager_fini()
    - drm/xe: Reject BO eviction if BO is bound to current VM
    - drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
    - drm/buddy: fix issue that force_merge cannot free all roots
    - drm/panel-edp: Add Starry 116KHD024006
    - drm: Add valid clones check
    - [powerpc*] book3s64/radix: Fix compile errors when
      CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n
    - [arm64,armhf] pinctrl: meson: define the pull up/down resistor value as 60
      kOhm
    - smb: server: smb2pdu: check return value of xa_store()
    - [x86] platform/x86/intel: hid: Add Pantherlake support
    - [x86] platform/x86: asus-wmi: Disable OOBE state after resume from
      hibernation
    - [x86] platform/x86: ideapad-laptop: add support for some new buttons
    - [amd64] ASoC: cs42l43: Disable headphone clamps during type detection
    - [amd64] ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
    - ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
    - nvme-pci: add quirks for device 126f:1001
    - nvme-pci: add quirks for WDC Blue SN550 15b7:5009
    - ALSA: usb-audio: Fix duplicated name in MIDI substream names
    - nvmet-tcp: don't restore null sk_state_change
    - io_uring/fdinfo: annotate racy sq/cq head/tail reads
    - cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info()
    - cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info()
      function
    - [amd64] ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers
    - btrfs: compression: adjust cb->compressed_folios allocation type
    - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
    - btrfs: handle empty eb->folios in num_extent_folios()
    - btrfs: avoid NULL pointer dereference if no valid csum tree
    - tools: ynl-gen: validate 0 len strings from kernel
    - block: only update request sector if needed
    - wifi: iwlwifi: add support for Killer on MTL
    - xenbus: Allow PVH dom0 a non-local xenstore
    - drm/amd/display: Call FP Protect Before Mode Programming/Mode Support
    - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
    - soundwire: bus: Fix race on the creation of the IRQ domain
    - espintcp: fix skb leaks
    - espintcp: remove encap socket caching to avoid reference leak
    - xfrm: Fix UDP GRO handling for some corner cases
    - [amd64] dmaengine: idxd: Fix allowing write() from different address
      spaces
    - [x86] sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro
    - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
    - remoteproc: qcom_wcnss: Fix on platforms without fallback regulators
    - clk: sunxi-ng: d1: Add missing divider for MMC mod clocks
    - xfrm: Sanitize marks before insert
    - [amd64] dmaengine: idxd: Fix ->poll() return value
    - [arm64] dmaengine: fsl-edma: Fix return code for unhandled interrupts
    - driver core: Split devres APIs to device/devres.h
    - devres: Introduce devm_kmemdup_array()
    - [amd64] ASoC: SOF: Intel: hda: Fix UAF when reloading module
    - [riscv64] irqchip/riscv-imsic: Start local sync timer on correct CPU
    - [x86] perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq
    - Bluetooth: L2CAP: Fix not checking l2cap_chan security level
    - Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling
    - ptp: ocp: Limit signal/freq counts in summary output functions
    - bridge: netfilter: Fix forwarding of fragmented packets
    - ice: fix vf->num_mac count with port representors
    - ice: Fix LACP bonds without SRIOV environment
    - idpf: fix null-ptr-deref in idpf_features_check
    - [arm64] pinctrl: qcom: switch to devm_register_sys_off_handler()
    - [arm64,armhf] net: dwmac-sun8i: Use parsed internal PHY address instead of
      1
    - net: lan743x: Restore SGMII CTRL register on resume
    - io_uring: fix overflow resched cqe reordering
    - idpf: fix idpf_vport_splitq_napi_poll()
    - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
    - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
    - [armhf] clk: s2mps11: initialise clk_hw_onecell_data::num before accessing
      ::hws[] in probe()
    - crypto: algif_hash - fix double free in hash_accept
    - padata: do not leak refcount in reorder_work
    - can: slcan: allow reception of short error messages
    - can: bcm: add locking for bcm_op runtime updates
    - can: bcm: add missing rcu read protection for procfs content
    - [amd64] ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for
      bytes_ext
    - [amd64] ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms
    - [amd64] ASoc: SOF: topology: connect DAI to a single DAI link
    - [amd64] ASoC: SOF: ipc4-pcm: Delay reporting is only supported for
      playback direction
    - ALSA: pcm: Fix race of buffer access at PCM OSS layer
    - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
    - llc: fix data loss when reading from a socket in llc_ui_recvmsg()
    - can: kvaser_pciefd: Continue parsing DMA buf after dropped RX
    - can: kvaser_pciefd: Fix echo_skb race
    - net: dsa: microchip: linearize skb for tail-tagging switches
    - vmxnet3: update MTU after device quiesce
    - [arm64] pmdomain: renesas: rcar: Remove obsolete nullify checks
    - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
    - [x86] platform/x86: dell-wmi-sysman: Avoid buffer overflow in
      current_password_store()
    - [amd64] thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature
    - drm/edid: fixed the bug that hdr metadata was not reset
    - smb: client: Fix use-after-free in cifs_fill_dirent
    - [arm64] dts: marvell: uDPU: define pinctrl state for alarm LEDs
    - smb: client: Reset all search buffer pointers when releasing buffer
    - Revert "drm/amd: Keep display off while going into S4"
    - Input: xpad - add more controllers
    - highmem: add folio_test_partial_kmap()
    - memcg: always call cond_resched() after fn()
    - mm/page_alloc.c: avoid infinite retries caused by cpuset race
    - mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled
    - mm: vmalloc: actually use the in-place vrealloc region
    - mm: vmalloc: only zero-init on vrealloc shrink
    - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
    - Bluetooth: btmtksdio: Check function enabled before doing close
    - Bluetooth: btmtksdio: Do close if SDIO card removed without close
    - Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection"
    - ksmbd: fix stream write failure
    - [x86] platform/x86: think-lmi: Fix attribute name usage for non-compliant
      items
    - spi: use container_of_cont() for to_spi_device()
    - [arm64] spi: spi-fsl-dspi: restrict register range for regmap access
    - [arm64] spi: spi-fsl-dspi: Halt the module after a new message transfer
    - [arm64] spi: spi-fsl-dspi: Reset SR flags before sending a new message
    - err.h: move IOMEM_ERR_PTR() to err.h
    - gcc-15: make 'unterminated string initialization' just a warning
    - gcc-15: disable '-Wunterminated-string-initialization' entirely for now
    - Fix mis-uses of 'cc-option' for warning disablement
    - kbuild: Properly disable -Wunterminated-string-initialization for clang
    - drm/amd/display: Exit idle optimizations before accessing PHY
    - bpf: abort verification if env->cur_state->loop_entry != NULL
    - serial: sh-sci: Save and restore more registers
    - drm/amdkfd: Correct F8_MODE for gfx950
    - watchdog: aspeed: fix 64-bit division
    - [arm64,armhf] pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()
    - [x86] mm/init: Handle the special case of device private pages in
      add_pages(), to not increase max_pfn and trigger dma_addressing_limited()
      bounce buffers bounce buffers
    - drm/gem: Internally test import_attach for imported objects
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.32
    - [arm64] dts: qcom: ipq9574: Add missing properties for cryptobam
    - [arm64] dts: qcom: sa8775p: Remove extra entries from the iommus property
    - [arm64] dts: qcom: sa8775p: Remove cdsp compute-cb@10
    - [arm64] dts: qcom: sm8350: Fix typo in pil_camera_mem node
    - [arm64] dts: qcom: sm8450: Add missing properties for cryptobam
    - [arm64] dts: qcom: sm8550: Add missing properties for cryptobam
    - [arm64] dts: qcom: sm8650: Add missing properties for cryptobam
    - [arm64] dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage
    - [arm64] dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage
    - [arm64] dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage
    - [arm64] dts: qcom: x1e80100-qcp: mark l12b and l15b always-on
    - [arm64] dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on
    - [arm64] dts: qcom: x1e80100: Fix video thermal zone
    - [arm64] dts: ti: k3-am62-main: Set eMMC clock parent to default
    - [arm64] dts: ti: k3-am62a-main: Set eMMC clock parent to default
    - [arm64] dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to
      default
    - [arm64] dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay
    - [arm64] dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay
    - [arm64] dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay
    - [arm64] dts: ti: k3-am65-main: Add missing taps to sdhci0
    - [arm64] dts: ti: k3-am68-sk: Fix regulator hierarchy
    - [arm64] dts: ti: k3-j721e-sk: Add DT nodes for power regulators
    - [arm64] dts: ti: k3-j721e-sk: Remove clock-names property from IMX219
      overlay
    - [arm64] dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219
    - [arm64] dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1"
    - [arm64] dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1"
    - [arm64] dts: ti: k3-j784s4-j742s2-main-common: Fix length of
      serdes_ln_ctrl
    - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
    - [arm64] perf/arm-cmn: Fix REQ2/SNP2 mixup
    - [arm64] perf/arm-cmn: Initialise cmn->cpu earlier
    - [arm64] perf/arm-cmn: Add CMN S3 ACPI binding
    - coredump: fix error handling for replace_fd()
    - coredump: hand a pidfd to the usermode coredump helper
    - [amd64] dmaengine: idxd: cdev: Fix uninitialized use of sva in
      idxd_cdev_open
    - HID: quirks: Add ADATA XPG alpha wireless mouse support
    - nfs: don't share pNFS DS connections between net namespaces
    - [x86] platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
    - gpio: virtuser: fix potential out-of-bound write
    - drm/amd/display: fix link_set_dpms_off multi-display MST corner case
    - drm/amd/display: check stream id dml21 wrapper to get plane_id
    - [arm64] phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error
    - [armhf] spi: spi-sun4i: fix early activation
    - nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro
    - drm/xe/xe2hpg: Add Wa_22021007897
    - drm/xe: Save the gt pointer in lrc and drop the tile
    - char: tpm: tpm-buf: Add sanity check fallback in read helpers
    - NFS: Avoid flushing data while holding directory locks in nfs_rename()
    - [x86] platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
    - ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform
    - [x86] platform/x86: thinkpad_acpi: Ignore battery threshold change event
      notification
    - [arm64] net: ethernet: ti: am65-cpsw: Lower random mac address error print
      to info
    - ksmbd: use list_first_entry_or_null for opinfo_get_list()

  [ Salvatore Bonaccorso ]
  * [amd64] drivers/acpi: Make ACPI_HED built-in
  * [amd64] Add drivers/pinctrl/intel to kernel-image udeb (Closes: #1106658)
  * Revert "drm/amd/display: more liberal vmin/vmax update for freesync"
    (Closes: #1106743, #1106268)

  [ Ben Hutchings ]
  * linux-image, linux-headers: Use linux-run-hooks instead of run-parts
    (Closes: #1101733) 

  [ Max Staudt ]
  * drivers/net/can: Enable can327 as a module

  [ Uwe Kleine-König ]
  * drivers/gnss: Enable GNSS_MTK_SERIAL and GNSS_USB as modules
    (Closes: 1106744)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 07 Jun 2025 14:21:10 +0200

linux (6.12.30-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.30
    - [arm64] dts: rockchip: Assign RT5616 MCLK rate on
      rk3588-friendlyelec-cm3588
    - fs/xattr.c: fix simple_xattr_list to always include security.* xattrs
    - [amd64] drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart
      PC Policies
    - [amd64] drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies
    - [riscv64] dts: sophgo: fix DMA data-width configuration for CV18xx
    - binfmt_elf: Move brk for static PIE even if ASLR disabled
    - [amd64] platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO
      Wujie 14XA (GX4HRXL)
    - [amd64] platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
    - cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY
      tasks
    - tracing: probes: Fix a possible race in trace_probe_log APIs
    - tpm: tis: Double the timeout B to 4s
    - uio_hv_generic: Fix sysfs creation path for ring buffer
    - KVM: Add member to struct kvm_gfn_range to indicate private/shared
    - [amd64] KVM: x86/mmu: Prevent installing hugepages when mem attributes are
      changing
    - iio: adc: ad7266: Fix potential timestamp alignment issue.
    - drm/amd: Add Suspend/Hibernate notification callback support
    - Revert "drm/amd: Stop evicting resources on APUs in suspend"
    - xhci: dbc: Improve performance by removing delay in transfer event
      polling.
    - xhci: dbc: Avoid event polling busyloop if pending rx transfers are
      inactive.
    - iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
    - virtio_ring: add a func argument 'recycle_done' to virtqueue_reset()
    - virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx
    - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
    - HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
    - HID: uclogic: Add NULL check in uclogic_input_configured()
    - nfs: handle failure of nfs_get_lock_context in unlock path
    - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device"
      problem
    - Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags
    - net_sched: Flush gso_skb list too during ->change()
    - tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing
    - mctp: no longer rely on net->dev_index_head[]
    - net: mctp: Don't access ifa_index when missing
    - net: mctp: Ensure keys maintain only one ref to corresponding dev
    - ALSA: seq: Fix delivery of UMP events to group ports
    - ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info
    - [arm64] net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
    - nvme-pci: make nvme_pci_npages_prp() __always_inline
    - nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable
    - ALSA: sh: SND_AICA should depend on SH_DMA_API
    - [armhf] net: dsa: b53: prevent standalone from trying to forward to other
      ports
    - net/mlx5e: Disable MACsec offload for uplink representor profile
    - qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
    - regulator: max20086: fix invalid memory access
    - drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value
    - netlink: specs: tc: fix a couple of attribute names
    - netlink: specs: tc: all actions are indexed arrays
    - [arm64] net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW
      capability
    - wifi: mac80211: Set n_channels after allocating struct
      cfg80211_scan_request
    - mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
    - net/tls: fix kernel panic when alloc_page failed
    - tsnep: fix timestamping with a stacked DSA driver
    - NFSv4/pnfs: Reset the layout state after a layoutreturn
    - dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when
      interrupted"
    - sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
    - udf: Make sure i_lenExtents is uptodate on inode eviction
    - HID: bpf: abort dispatch if device destroyed
    - btrfs: fix discard worker infinite loop after disabling discard
    - btrfs: fix folio leak in submit_one_async_extent()
    - btrfs: add back warning for mount option commit values exceeding 300
    - Revert "drm/amd/display: Hardware cursor changes color when switched to
      software cursor"
    - drm/amdgpu: fix incorrect MALL size for GFX1151
    - drm/amdgpu: csa unmap use uninterruptible lock
    - drm/amd/display: Correct the reply value when AUX write incomplete
    - drm/amd/display: Avoid flooding unnecessary info messages
    - MAINTAINERS: Update Alexey Makhalov's email address
    - [arm64,armhf] gpio: pca953x: fix IRQ storm on system wake up
    - ACPI: PPTT: Fix processor subtable walk
    - ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
    - ALSA: usb-audio: Add sample rate quirk for Audioengine D1
    - ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera
    - dma-buf: insert memory barrier before updating num_fences
    - hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages
    - hv_netvsc: Preserve contiguous PFN grouping in the page buffer array
    - hv_netvsc: Remove rmsg_pgcnt
    - [arm64] dts: amlogic: dreambox: fix missing clkc_audio node
    - [arm64] dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi
    - Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges
    - Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()
    - ftrace: Fix preemption accounting for stacktrace trigger command
    - ftrace: Fix preemption accounting for stacktrace filter command
    - tracing: samples: Initialize trace_array_printk() with the correct
      function
    - [arm64,armhf] phy: Fix error handling in tegra_xusb_port_init
    - [arm64] phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
    - [arm64] phy: renesas: rcar-gen3-usb2: Set timing registers only once
    - scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer
    - smb: client: fix memory leak during error handling for POSIX mkdir
    - [arm64,armhf] spi: tegra114: Use value to check for invalid delays
    - tpm: Mask TPM RC in tpm2_start_auth_session()
    - wifi: mt76: disable napi on driver removal
    - ring-buffer: Fix persistent buffer when commit page is the reader page
    - net: qede: Initialize qede_ll_ops with designated initializer
    - mm: userfaultfd: correct dirty flags set for both present and swap pte
    - [arm64] dmaengine: ti: k3-udma: Add missing locking
    - [arm64] dmaengine: ti: k3-udma: Use cap_mask directly from dma_device
      structure instead of a local copy
    - [amd64] dmaengine: idxd: fix memory leak in error handling path of
      idxd_setup_wqs
    - [amd64] dmaengine: idxd: fix memory leak in error handling path of
      idxd_setup_engines
    - [amd64] dmaengine: idxd: fix memory leak in error handling path of
      idxd_setup_groups
    - [amd64] dmaengine: idxd: Add missing cleanup for early error out in
      idxd_setup_internals
    - [amd64] dmaengine: idxd: Add missing cleanups in cleanup internals
    - [amd64] dmaengine: idxd: Add missing idxd cleanup to fix memory leak in
      remove call
    - [amd64] dmaengine: idxd: fix memory leak in error handling path of
      idxd_alloc
    - [amd64] dmaengine: idxd: fix memory leak in error handling path of
      idxd_pci_probe
    - [amd64] dmaengine: idxd: Refactor remove call with idxd_cleanup() helper
    - CIFS: New mount option for cifs.upcall namespace resolution
    - drm/xe/gsc: do not flush the GSC worker from the reset path
    - mm/page_alloc: fix race condition in unaccepted memory handling
    - [amd64] accel/ivpu: Rename ivpu_log_level to fw_log_level
    - [amd64] accel/ivpu: Reset fw log on cold boot
    - [amd64] accel/ivpu: Refactor functions in ivpu_fw_log.c
    - [amd64] accel/ivpu: Fix fw log printing
    - iio: light: opt3001: fix deadlock due to concurrent flag access
      (CVE-2025-37968)
    - Bluetooth: btnxpuart: Fix kernel panic during FW release (CVE-2025-22102)
    - drm/fbdev-dma: Support struct drm_driver.fbdev_probe
    - drm/panel-mipi-dbi: Run DRM default client setup
    - drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc()
    - usb: typec: ucsi: displayport: Fix deadlock (CVE-2025-37967)
    - phy: tegra: xusb: remove a stray unlock
    - drm/amdgpu: fix pm notifier handling

  [ Salvatore Bonaccorso ]
  * loop: don't require ->write_iter for writable files in loop_configure
    (Closes: #1106070)

  [ Kevin P. Fleming ]
  * test-patches: Add defaults for DEBEMAIL and DEBFULLNAME

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 29 May 2025 00:38:54 +0200

linux (6.12.29-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.28
    - Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x
    - Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x
    - Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x
    - Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x
    - Bluetooth: btusb: Add new VID/PID for WCN785x
    - Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x
    - ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface()
    - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset
    - [arm*] binder: fix offset calculation in debug log
    - btrfs: adjust subpage bit start based on sectorsize
    - btrfs: fix COW handling in run_delalloc_nocow()
    - [amd64] cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
    - drm/fdinfo: Protect against driver unbind
    - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()
    - [arm64] i2c: imx-lpi2c: Fix clock count when probe defers
    - [arm64] errata: Add missing sentinels to Spectre-BHB MIDR arrays
    - [amd64] perf/x86/intel: Only check the group flag for X86 leader
    - [amd64] perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's
      value.
    - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum
      offload
    - [arm64] irqchip/qcom-mpm: Prevent crash when trying to handle non-wake
      GPIOs
    - mm/memblock: pass size instead of end to memblock_set_node()
    - mm/memblock: repeat setting reserved region nid if array is doubled
    - [arm64] mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe
    - [arm64,armhf] spi: tegra114: Don't fail set_cs_timing when delays are zero
    - tracing: Do not take trace_event_sem in print_event_fields()
    - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
    - [x86] boot/sev: Support memory acceptance in the EFI stub under SVSM
    - dm-bufio: don't schedule in atomic context
    - dm-integrity: fix a warning on invalid table line
    - dm: always update the array size in realloc_argv on success
    - drm/amdgpu: Fix offset for HDP remap in nbio v7.11
    - drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS
    - [amd64] iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
    - [arm64] iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated
      stream ids
    - [arm64] iommu/arm-smmu-v3: Fix pgsize_bit for sva domains
    - [amd64] iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57)
    - iommu: Fix two issues in iommu_copy_struct_from_user()
    - [amd64] platform/x86/amd: pmc: Require at least 2.5 seconds between HW
      sleep cycles
    - [amd64] platform/x86/intel-uncore-freq: Fix missing uncore sysfs during
      CPU hotplug
    - ksmbd: fix use-after-free in ksmbd_session_rpc_open
    - ksmbd: fix use-after-free in kerberos authentication
    - ksmbd: fix use-after-free in session logoff
    - smb: client: fix zero length for mkdir POSIX create context
    - cpufreq: Avoid using inconsistent policy->min and policy->max
    - cpufreq: Fix setting policy limits when frequency tables are used
    - tracing: Fix oob write in trace_seq_to_buffer()
    - drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF
    - ASoC: soc-core: Stop using of_property_read_bool() for non-boolean
      properties
    - ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence
    - [ppc64el] book3s64/radix : Align section vmemmap start address to
      PAGE_SIZE
    - [arm64,armhf] pinctrl: imx: Return NULL if no group is matched and found
    - [powerpc*] boot: Check for ld-option support
    - [amd64] ASoC: Intel: sof_sdw: Add NULL check in
      asoc_sdw_rt_dmic_rtd_init()
    - ALSA: hda/realtek - Enable speaker for HP platform
    - [amd64] drm/i915/pxp: fix undefined reference to
      `intel_pxp_gsccs_is_ready_for_sessions'
    - wifi: iwlwifi: don't warn if the NIC is gone in resume
    - wifi: iwlwifi: fix the check for the SCRATCH register upon resume
    - wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release
    - [powerpc*] boot: Fix dash warning
    - vxlan: vnifilter: Fix unlocked deletion of default FDB entry
    - xsk: Fix race condition in AF_XDP generic RX path
    - net/mlx5e: Use custom tunnel header for vxlan gbp
    - net/mlx5: E-Switch, Initialize MAC Address for Default GID
    - net/mlx5e: TC, Continue the attr process even if encap entry is invalid
    - net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover
    - net/mlx5: E-switch, Fix error handling for enabling roce
    - accel/ivpu: Correct DCT interrupt handling
    - ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot
    - Bluetooth: hci_conn: Remove alloc from critical section
    - Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver
    - Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync
    - Bluetooth: btintel_pcie: Avoid redundant buffer allocation
    - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()
    - Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths
    - Bluetooth: L2CAP: copy RX timestamp to new fragments
    - [arm64] net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID
    - bnxt_en: improve TX timestamping FIFO configuration
    - [arm64] net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array
    - net_sched: drr: Fix double list add in class with netem as child qdisc
    - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child
      qdisc
    - net_sched: ets: Fix double list add in class with netem as child qdisc
    - net_sched: qfq: Fix double list add in class with netem as child qdisc
    - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
    - idpf: fix offloads support for encapsulated packets
    - scsi: ufs: core: Remove redundant query_complete trace
    - ALSA: ump: Fix buffer overflow at UMP SysEx message conversion
    - nvme-pci: fix queue unquiesce check on slot_reset
    - [armhf] drm/mipi-dbi: Fix blanking for non-16 bit formats
    - net: dlink: Correct endianness handling of led_mode
    - [arm64,armhf] net: mdio: mux-meson-gxl: set reversed bit when using
      internal phy
    - idpf: fix potential memory leak on kcalloc() failure
    - idpf: protect shutdown from reset
    - igc: fix lock order in igc_ptp_reset
    - [arm64] net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM
    - [arm64] net: dsa: felix: fix broken taprio gate states after clock jump
    - net: ipv6: fix UDPv6 GSO segmentation with NAT
    - ALSA: hda/realtek: Fix built-mic regression on other ASUS models
    - bnxt_en: Fix error handling path in bnxt_init_chip()
    - bnxt_en: Fix ethtool selftest output in one of the failure cases
    - bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan()
    - bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings()
    - bnxt_en: Fix coredump logic to free allocated buffer
    - bnxt_en: Fix out-of-bound memcpy() during ethtool -w
    - bnxt_en: Fix ethtool -d byte order for 32-bit values
    - nvme-tcp: fix premature queue removal and I/O failover
    - nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS
    - nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS
    - ASoC: simple-card-utils: Fix pointer check in
      graph_util_parse_link_direction
    - bnxt_en: fix module unload sequence
    - net: use sock_gen_put() when sk_state is TCP_TIME_WAIT
    - ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations
    - net: lan743x: Fix memleak issue when GSO enabled
    - net: fec: ERR007885 Workaround for conventional TX
    - [arm64] net: hns3: store rx VLAN tag offload state for VF
    - [arm64] net: hns3: fix an interrupt residual problem
    - [arm64] net: hns3: fixed debugfs tm_qset size
    - [arm64] net: hns3: defer calling ptp_clock_register()
    - blk-mq: create correct map for fallback case (Closes: #1104669)
    - mm, slab: clean up slab->obj_exts always
    - bcachefs: Remove incorrect __counted_by annotation
    - net: Fix the devmem sock opts and msgs for parisc
    - [amd64] accel/ivpu: Make DB_ID and JOB_ID allocations incremental
    - [amd64] accel/ivpu: Use xa_alloc_cyclic() instead of custom function
    - [amd64] accel/ivpu: Fix a typo
    - [amd64] accel/ivpu: Update VPU FW API headers
    - [amd64] accel/ivpu: Abort all jobs after command queue unregister
    - [amd64] accel/ivpu: Fix locking order in ivpu_job_submit
    - [amd64] accel/ivpu: Add handling of
      VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW
    - sch_htb: make htb_qlen_notify() idempotent
    - sch_drr: make drr_qlen_notify() idempotent
    - sch_hfsc: make hfsc_qlen_notify() idempotent
    - sch_qfq: make qfq_qlen_notify() idempotent
    - sch_ets: make est_qlen_notify() idempotent
    - drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change
    - [arm64] firmware: arm_scmi: Balance device refcount when destroying
      devices
    - [arm64] dts: imx95: Correct the range of PCIe app-reg region
    - [arm64] dts: st: Adjust interrupt-controller for stm32mp25 SoCs
    - [arm64] dts: st: Use 128kB size for aliased GIC400 register access on
      stm32mp25 SoCs
    - Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates"
    - kernel: param: rename locate_module_kobject
    - kernel: globalize lookup_or_create_module_kobject()
    - drivers: base: handle module_kobject creation
    - drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp
    - drm/amd/display: Fix slab-use-after-free in hdcp
    - dm: fix copying after src array boundaries
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.29
    - dm: add missing unlock on in dm_keyslot_evict()
    - fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio()
    - Revert "btrfs: canonicalize the device path before adding it"
    - [arm64] firmware: arm_scmi: Fix timeout checks on polling path
    - [arm64] can: mcan: m_can_class_unregister(): fix order of unregistration
      calls
    - [s390] pci: Fix missing check for zpci_create_device() error return
    - wifi: cfg80211: fix out-of-bounds access during multi-link element
      defragmentation
    - vfio/pci: Align huge faults to order
    - [s390x] pci: Fix duplicate pci_dev_put() in disable_slot() when PF has
      child VFs
    - can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls
    - ksmbd: prevent rename with empty string
    - ksmbd: prevent out-of-bounds stream writes by validating *pos
    - ksmbd: Fix UAF in __close_file_table_ids
    - openvswitch: Fix unsafe attribute parsing in output_userspace()
    - ksmbd: fix memory leak in parse_lease_state()
    - [s390x] entry: Fix last breaking event handling in case of stack
      corruption
    - sch_htb: make htb_deactivate() idempotent
    - virtio_net: xsk: bind/unbind xsk for tx
    - virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable()
    - gre: Fix again IPv6 link-local address generation.
    - [arm64] net: ethernet: mtk_eth_soc: reset all TX queues on DMA free
    - [arm64] net: ethernet: mtk_eth_soc: do not reset PSE when setting FE
    - [arm64] can: m_can: m_can_class_allocate_dev(): initialize spin lock on
      device probe
    - can: gw: fix RCU/BH usage in cgw_create_job()
    - wifi: mac80211: fix the type of status_code for negotiated TID to Link
      Mapping
    - ice: Initial support for E825C hardware in ice_adapter
    - ice: use DSN instead of PCI BDF for ice_adapter index
    - erofs: ensure the extra temporary copy is valid for shortened bvecs
    - ipvs: fix uninit-value for saddr in do_output_route4
    - netfilter: ipset: fix region locking in hash types
    - bpf: Scrub packet on bpf_redirect_peer
    - [armhf] net: dsa: b53: allow leaky reserved multicast
    - [armhf] net: dsa: b53: keep CPU port always tagged again
    - [armhf] net: dsa: b53: fix clearing PVID of a port
    - [armhf] net: dsa: b53: fix flushing old pvid VLAN on pvid change
    - [armhf] net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave
    - [armhf] net: dsa: b53: always rejoin default untagged VLAN on bridge leave
    - [armhf] net: dsa: b53: do not allow to configure VLAN 0
    - [armhf] net: dsa: b53: do not program vlans when vlan filtering is off
    - [armhf] net: dsa: b53: fix toggling vlan_filtering
    - [armhf] net: dsa: b53: fix learning on VLAN unaware bridges
    - [armhf] net: dsa: b53: do not set learning and unicast/multicast on up
    - net: export a helper for adding up queue stats
    - virtio-net: fix total qstat values
    - Input: xpad - fix Share button on Xbox One controllers
    - Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller
    - Input: xpad - fix two controller table values
    - Input: synaptics - enable InterTouch on Dynabook Portege X30-D
    - Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
    - Input: synaptics - enable InterTouch on Dell Precision M3800
    - Input: synaptics - enable SMBus for HP Elitebook 850 G1
    - Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
    - [arm*] staging: bcm2835-camera: Initialise dev in v4l2_dev
    - [x86] mm: Eliminate window where TLB flushes may be inadvertently skipped
    - mm: fix folio_pte_batch() on XEN PV
    - mm: vmalloc: support more granular vrealloc() sizing
    - mm/huge_memory: fix dereferencing invalid pmd migration entry
    - mm/userfaultfd: fix uninitialized output field for -EAGAIN race
    - [amd64] KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
    - drm/amd/display: Shift DMUB AUX reply command if necessary
    - io_uring: ensure deferred completions are flushed for multishot
    - iio: adc: ad7606: fix serial register access
    - [arm64,armhf] iio: adc: rockchip: Fix clock initialization sequence
    - iio: adis16201: Correct inclinometer channel resolution
    - iio: imu: inv_mpu6050: align buffer for timestamp
    - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
    - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
    - [arm64] drm/v3d: Add job to pending list if the reset was skipped
    - drm/xe: Add page queue multiplier
    - drm/amdgpu/vcn: using separate VCN1_AON_SOC offset
    - drm/amd/display: Fix invalid context error in dml helper
    - drm/amd/display: more liberal vmin/vmax update for freesync
    - drm/amd/display: Fix the checking condition in dmub aux handling
    - drm/amd/display: Remove incorrect checking in dmub aux handler
    - drm/amd/display: Fix wrong handling for AUX_DEFER case
    - drm/amd/display: Copy AUX read reply data whenever length > 0
    - drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush
    - drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush
    - drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush
    - drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush
      (Closes: #1092624)
    - drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush
    - usb: uhci-platform: Make the clock really optional
    - smb: client: Avoid race in open_cached_dir with lease breaks
    - xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it
    - xenbus: Use kref to track req lifetime
    - [amd64] accel/ivpu: Increase state dump msg timeout
    - [arm64] cpufeature: Move arm64_use_ng_mappings to the .data section to
      prevent wrong idmap generation
    - clocksource/i8253: Use raw_spinlock_irqsave() in
      clockevent_i8253_disable()
    - memblock: Accept allocated memory before use in memblock_double_array()
    - module: ensure that kobject_put() is safe for module type kobjects
    - [x86] microcode: Consolidate the loader enablement checking
    - ocfs2: fix the issue with discontiguous allocation in the global_bitmap
    - ocfs2: switch osb->disable_recovery to enum
    - ocfs2: implement handshaking with ocfs2 recovery thread
    - ocfs2: stop quota recovery before disabling quotas
    - usb: dwc3: gadget: Make gadget_wakeup asynchronous
    - usb: gadget: f_ecm: Add get_status callback
    - usb: gadget: Use get_status callback to set remote wakeup capability
    - [arm64,armhf] usb: host: tegra: Prevent host controller crash when OTG
      port is used
    - usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs
    - [amd64,arm64] usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT
      transition
    - usb: typec: ucsi: displayport: Fix NULL pointer access
    - USB: usbtmc: use interruptible sleep in usbtmc_read
    - usb: usbtmc: Fix erroneous get_stb ioctl error returns
    - usb: usbtmc: Fix erroneous wait_srq ioctl return
    - usb: usbtmc: Fix erroneous generic_read ioctl return
    - iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.
    - types: Complement the aligned types with signed 64-bit one
    - [mips*] Fix MAX_REG_OFFSET
    - [riscv64] misaligned: Add handling for ZCB instructions
    - loop: Use bdev limit helpers for configuring discard
    - loop: Simplify discard granularity calc
    - loop: Fix ABBA locking race
    - loop: refactor queue limits updates
    - loop: factor out a loop_assign_backing_file helper
    - loop: Add sanity check for read/write_iter
    - drm/panel: simple: Update timings for AUO G101EVN010
    - nvme: unblock ctrl state transition for firmware update
    - [riscv64] misaligned: factorize trap handling
    - [riscv64] misaligned: enable IRQs while handling misaligned accesses
    - io_uring/sqpoll: Increase task_work submission batch size
    - do_umount(): add missing barrier before refcount checks in sync case
    - Revert "um: work around sched_yield not yielding in time-travel mode"
    - io_uring: always arm linked timeouts prior to issue
    - Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw
    - Bluetooth: btmtk: Remove the resetting step before downloading the fw
    - mm: page_alloc: don't steal single pages from biggest buddy
    - mm: page_alloc: speed up fallbacks in rmqueue_bulk()
    - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash
      (CVE-2025-37821)
    - [arm64] insn: Add support for encoding DSB
    - [arm64] proton-pack: Expose whether the platform is mitigated by firmware
    - [arm64] proton-pack: Expose whether the branchy loop k value
    - [arm64] bpf: Add BHB mitigation to the epilogue for cBPF programs
    - [arm64] bpf: Only mitigate cBPF programs loaded by unprivileged users
    - [arm64] proton-pack: Add new CPUs 'k' values for branch mitigation
    - [x86] bpf: Call branch history clearing sequence on exit
    - [x86] bpf: Add IBHF call at end of classic BPF
    - [x86] bhi: Do not set BHI_DIS_S in 32-bit mode
    - [x86] speculation: Simplify and make CALL_NOSPEC consistent
    - [x86] speculation: Add a conditional CS prefix to CALL_NOSPEC
    - [x86] speculation: Remove the extra #ifdef around CALL_NOSPEC
    - [amd64] Mitigations Indirect Target Selection (ITS) (CVE-2024-28956)
      + Documentation: x86/bugs/its: Add ITS documentation
      + x86/its: Enumerate Indirect Target Selection (ITS) bug
      + x86/its: Add support for ITS-safe indirect thunk
      + x86/its: Add support for ITS-safe return thunk
      + x86/its: Enable Indirect Target Selection mitigation
      + x86/its: Add "vmexit" option to skip mitigation on some CPUs
      + x86/its: Add support for RSB stuffing mitigation
      + x86/its: Align RETs in BHB clear sequence to avoid thunking
      + x86/ibt: Keep IBT disabled during alternative patching
      + x86/its: Use dynamic thunks for indirect branches
      + selftest/x86/bugs: Add selftests for ITS
      + x86/its: Fix build errors when CONFIG_MODULES=n
      + x86/its: FineIBT-paranoid vs ITS

  [ Ross Vandegrift ]
  * drivers/char: set VIRTIO_CONSOLE=y (Closes: #989153, #1041891)

  [ Aurelien Jarno ]
  * [riscv64] Enable BT_HCIUART (Closes: #1105002)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 18 May 2025 13:26:40 +0200

linux (6.12.27-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.26
    - module: sign with sha512 instead of sha1 by default
    - tracing: Add __print_dynamic_array() helper
    - tracing: Verify event formats that have "%*p.."
    - mm/vmscan: don't try to reclaim hwpoison folio
    - [arm64] soc: qcom: ice: introduce devm_of_qcom_ice_get
    - [arm64] mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get
    - PM: EM: use kfree_rcu() to simplify the code
    - PM: EM: Address RCU-related sparse warnings
    - [amd64] media: ov08x40: Move ov08x40_identify_module() function up
    - [amd64] media: ov08x40: Add missing ov08x40_identify_module() call on
      stream-start
    - block: remove the write_hint field from struct request
    - block: remove the ioprio field from struct request
    - block: make sure ->nr_integrity_segments is cloned in blk_rq_prep_clone
    - [arm64,armhf] net: dsa: mv88e6xxx: fix VTU methods for 6320 family
    - iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary
      return value check
    - iio: adc: ad7768-1: Fix conversion result sign
    - of: resolver: Simplify of_resolve_phandles() using __free()
    - of: resolver: Fix device node refcount leakage in of_resolve_phandles()
    - [arm64] scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get
    - PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag
    - PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends
    - PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads
    - [amd64] accel/ivpu: Add auto selection logic for job scheduler
    - [amd64] accel/ivpu: Fix the NPU's DPU frequency calculation
    - ksmbd: use __GFP_RETRY_MAYFAIL
    - ksmbd: add netdev-up/down event debug print
    - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL
    - ksmbd: fix use-after-free in __smb2_lease_break_noti() (CVE-2025-37777)
    - [arm64] scsi: ufs: exynos: Remove empty drv_init method
    - [arm64] scsi: ufs: exynos: Remove superfluous function parameter
    - [arm64] scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable
      WriteBooster
    - [arm64] scsi: ufs: exynos: Move UFS shareability value to drvdata
    - [arm64] scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set
    - net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads
    - drm/xe/bmg: Add one additional PCI ID
    - drm/amd/display: Fix unnecessary cast warnings from checkpatch
    - drm/amd/display/dml2: use vzalloc rather than kzalloc
    - ceph: Fix incorrect flush end position calculation
    - [arm64] cpufreq: sun50i: prevent out-of-bounds access
    - dma/contiguous: avoid warning about unused size_bytes
    - [arm64] cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
    - scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
    - cpufreq: cppc: Fix invalid return value in .get() callback
    - cpufreq: Do not enable by default during compile testing
    - cpufreq: fix compile-test defaults
    - btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range()
    - btrfs: zoned: return EIO on RAID1 block group write pointer mismatch
    - cgroup/cpuset-v1: Add missing support for cpuset_v2_mode
    - vhost-scsi: Add better resource allocation failure handling
    - vhost-scsi: Fix vhost_scsi_send_bad_target()
    - vhost-scsi: Fix vhost_scsi_send_status()
    - net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()
    - net/mlx5: Move ttc allocation after switch case to prevent leaks
    - scsi: core: Clear flags for scsi_cmnd that did not complete
    - scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()
    - net: lwtunnel: disable BHs when required
    - net: phy: leds: fix memory leak
    - tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
    - net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration
    - fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()
    - net_sched: hfsc: Fix a UAF vulnerability in class handling
      (CVE-2025-37797)
    - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
    - [arm64] net: dsa: mt7530: sync driver-specific behavior of MT7531 variants
    - pds_core: Prevent possible adminq overflow/stuck condition
    - pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result
    - pds_core: Remove unnecessary check in pds_client_adminq_cmd()
    - pds_core: make wait_context part of q_info
    - block: never reduce ra_pages in blk_apply_bdi_limits
    - [amd64] iommu/amd: Return an error if vCPU affinity is set for non-vCPU
      IRTE
    - [riscv64] Replace function-like macro by static inline function
    - [riscv64] uprobes: Add missing fence.i after building the XOL buffer
    - splice: remove duplicate noinline from pipe_clear_nowait
    - bpf: Add namespace to BPF internal symbols
    - [x86] perf/x86: Fix non-sampling (counting) events on certain x86
      platforms
    - [amd64] KVM: SVM: Disable AVIC on SNP-enabled system without
      HvInUseWrAllowed feature
    - netfilter: fib: avoid lookup if socket is available
    - virtio_console: fix missing byte order handling for cols and rows
    - xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
    - net: phy: microchip: force IRQ polling mode for lan88xx
    - scsi: mpi3mr: Fix pending I/O counter
    - drm/amd/display: Fix gpu reset in multidisplay config
    - drm/amd/display: Force full update in gpu reset
    - [x86] insn: Fix CTEST instruction decoding
    - [arm64,armhf] irqchip/gic-v2m: Prevent use after free of
      gicv2m_get_fwnode()
    - io_uring: fix 'sync' handling of io_fallback_tw()
    - [amd64] KVM: SVM: Allocate IR data using atomic allocation
    - cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports
    - ata: libata-scsi: Improve CDL control
    - ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type
    - ata: libata-scsi: Fix ata_msense_control_ata_feature()
    - USB: storage: quirk for ADATA Portable HDD CH94
    - scsi: Improve CDL control
    - mei: me: add panther lake H DID
    - mei: vsc: Fix fortify-panic caused by invalid counted_by() use
    - [amd64] KVM: x86: Explicitly treat routing entry type changes as changes
    - [amd64] KVM: x86: Reset IRTE to host control if *new* route isn't postable
    - [amd64] KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass
      producer
    - char: misc: register chrdev region with all possible minors
    - firmware: stratix10-svc: Add of_platform_default_populate()
    - tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT
    - [arm64] serial: msm: Configure correct working mode before starting
      earlycon
    - [riscv64] serial: sifive: lock port in startup()/shutdown() callbacks
    - USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
    - USB: serial: option: add Sierra Wireless EM9291
    - USB: serial: simple: add OWON HDS200 series oscilloscope support
    - xhci: Limit time spent with xHC interrupts disabled during bus resume
    - usb: xhci: Fix invalid pointer dereference in Etron workaround
    - usb: cdns3: Fix deadlock when using NCM gadget
    - usb: chipidea: ci_hdrc_imx: fix usbmisc handling
    - usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines
    - usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
    - USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
    - [arm64] usb: dwc3: gadget: check that event count does not exceed event
      buffer length
    - [arm64] usb: dwc3: xilinx: Prevent spike in reset signal
    - usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
    - usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
    - USB: VLI disk crashes if LPM is used
    - USB: wdm: handle IO errors in wdm_wwan_port_start
    - USB: wdm: close race between wdm_open and wdm_wwan_port_stop
    - USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context
    - USB: wdm: add annotation
    - [armhf] pinctrl: mcp23s08: Get rid of spurious level interrupts
    - [mips*] cm: Detect CM quirks from device tree
    - [amd64] crypto: ccp - Add support for PCI device 0x1134
    - crypto: null - Use spin lock instead of mutex
    - bpf: Fix kmemleak warning for percpu hashmap
    - bpf: Fix deadlock between rcu_tasks_trace and event_mutex.
    - clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
    - [s390x] sclp: Add check for get_zeroed_page()
    - [s390x] tty: Fix a potential memory leak bug
    - bpf: bpftool: Setting error code in do_loader()
    - bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it
      creates storage
    - bpf: Reject attaching fexit/fmod_ret to __noreturn functions
    - mailbox: pcc: Fix the possible race in updation of chan_in_use flag
    - mailbox: pcc: Always clear the platform ack interrupt first
    - usb: host: max3421-hcd: Add missing spi_device_id table
    - fs/ntfs3: Keep write operations atomic
    - fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size
    - [arm*] usb: dwc3: gadget: Refactor loop to avoid NULL endpoints
    - [arm*] usb: dwc3: gadget: Avoid using reserved endpoints on Intel
      Merrifield
    - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs
    - usb: xhci: Complete 'error mid TD' transfers when handling Missed Service
    - usb: xhci: Fix isochronous Ring Underrun/Overrun event handling
    - xhci: Handle spurious events on Etron host isoc enpoints
    - i3c: master: svc: Add support for Nuvoton npcm845 i3c
    - usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running
    - [arm64] phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init
    - [armhf] usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
    - usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func
    - [amd64] thunderbolt: Scan retimers after device router has been enumerated
    - objtool: Silence more KCOV warnings
    - objtool, panic: Disable SMAP in __stack_chk_fail()
    - objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in
      wcd934x_slim_irq_handler()
    - objtool, regulator: rk808: Remove potential undefined behavior in
      rk806_set_mode_dcdc()
    - objtool, lkdtm: Obfuscate the do_nothing() pointer
    - [amd64] qibfs: fix _another_ leak
    - 9p/net: fix improper handling of bogus negative read/write replies
    - 9p/trans_fd: mark concurrent read and writes to p9_conn->err
    - rtc: pcf85063: do a SW reset if POR failed
    - io_uring: always do atomic put from iowq
    - kbuild: add dependency from vmlinux to sorttable
    - sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
    - [s390x] KVM: s390: Don't use %pK through tracepoints
    - [s390x] KVM: s390: Don't use %pK through debug printing
    - cgroup/cpuset: Don't allow creation of local partition over a remote one
    - perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init
    - xen: Change xen-acpi-processor dom0 dependency
    - nvme: requeue namespace scan on missed AENs
    - ACPI: EC: Set ec_no_wakeup for Lenovo Go S
    - ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
    - drm/amdgpu: Increase KIQ invalidate_tlbs timeout
    - drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406
    - nvme: re-read ANA log page after ns scan completes
    - nvme: multipath: fix return value of nvme_available_path
    - objtool: Stop UNRET validation on UD2
    - gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment
    - [x86] xen: disable CPU idle and frequency drivers for PVH dom0
    - [x86] bugs: Use SBPB in write_ibpb() if applicable
    - [x86] bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
    - [x86] bugs: Don't fill RSB on context switch with eIBRS
    - nvmet-fc: take tgtport reference only once
    - nvmet-fc: put ref when assoc->del_work is already scheduled
    - cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE
      mode
    - timekeeping: Add a lockdep override in tick_freeze()
    - cifs: Fix querying of WSL CHR and BLK reparse points over SMB1
    - iommu: Clear iommu-dma ops on cleanup
    - ext4: make block validity check resistent to sb bh corruption
    - [arm64] scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes
    - [arm64] scsi: ufs: exynos: Ensure pre_link() executes before
      exynos_ufs_phy_init()
    - [arm64] scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO
    - [arm64] scsi: ufs: exynos: Move phy calls to .exit() callback
    - [arm64] scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend()
    - scsi: pm80xx: Set phy_attached to zero when device is gone
    - [x86] i8253: Call clockevent_i8253_disable() with interrupts disabled
    - netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS
    - iomap: skip unnecessary ifs_block_is_uptodate check
    - [riscv64] Provide all alternative macros all the time
    - ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"
    - [x86] cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove
      cores
    - md/raid1: Add check for missing source disk in process_checks()
    - drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4
    - drm/amdgpu: Use the right function for hdp flush
    - [arm64,armhf] spi: spi-imx: Add check for spi_imx_setupxfer()
    - Revert "drivers: core: synchronize really_probe() and dev_uevent()"
    - driver core: introduce device_set_driver() helper
    - driver core: fix potential NULL pointer dereference in dev_uevent()
    - xfs: do not check NEEDSREPAIR if ro,norecovery mount.
    - xfs: Do not allow norecovery mount with quotacheck
    - xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate
    - xfs: flush inodegc before swapon
    - usb: typec: class: Fix NULL pointer access
    - [amd64,arm64] vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp
    - [amd64] comedi: jr3_pci: Fix synchronous deletion of timer
    - ext4: goto right label 'out_mmap_sem' in ext4_setattr() (CVE-2025-22120)
    - usb: typec: class: Invalidate USB device pointers on partner
      unregistration
    - [arm64,armhf] Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320
      family"
    - [arm64,armhf] net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family
    - [arm64,armhf] net: dsa: mv88e6xxx: enable PVT for 6321 switch
    - [arm64,armhf] net: dsa: mv88e6xxx: enable .port_set_policy() for 6320
      family
    - [arm64,armhf] net: dsa: mv88e6xxx: enable STU methods for 6320 family
    - iommu: Handle race with default domain setup
    - crypto: lib/Kconfig - Hide arch options from user
    - media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl()
    - [mips*] cm: Fix warning if MIPS_CM is disabled
    - nvme: fixup scan failure for non-ANA multipath controllers
    - usb: xhci: Fix Short Packet handling rework ignoring errors
    - objtool: Ignore end-of-section jumps for KCOV/GCOV
    - objtool: Silence more KCOV warnings, part 2
    - usb: typec: class: Unlocked on error in typec_register_partner()
    - crypto: Kconfig - Select LIB generic option
    - mq-deadline: don't call req_get_ioprio from the I/O completion handler
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.27
    - bpf: Fix BPF_INTERNAL namespace import

  [ Salvatore Bonaccorso ]
  * drivers/net/wireless/realtek/rtw88: Enable RTW88_8723DS as module
    (Closes: #1104529)
  * Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Closes: #1104511)

  [ Ben Hutchings ]
  * lintian: Override some false positives:
    - linux-headers: Override another error and warning for vmlinux
    - [riscv64] linux-image-dbg: Override shared-library-lacks-stack-section
      for vdso.so
    - [arm64] linux-perf: Override statically-linked-binary for asm_pure_loop
  * [ppc64*] linux-image: Fix version in NEWS entry
  * linux-source: Suggest pkgconf, not the obsolete pkg-config
  * linux-image-dbg: lintian: Drop mismatched override for
    wrong-section-according-to-package-name
  * [amd64] linux-image-cloud-amd64-dbg: lintian: Drop overrides for vdsox32.so
  * d/copyright: Replace old FSF addresses with current GNU license URL
  * d/rules.real: Exclude vDSOs from processing by dh_makeshlibs
  * linux-doc: Use dh_sphinxdoc to replace embedded Javascript

  [ Alper Nebi Yasak ]
  * [arm64] udeb: Add mtk-cmdq-mailbox to kernel-image

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 06 May 2025 21:33:52 +0200

linux (6.12.25-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.23
    - watch_queue: fix pipe accounting mismatch
    - [x86] mm/pat: cpa-test: fix length for CPA_ARRAY test
    - cpufreq: scpi: compare kHz instead of Hz
    - sched: Cancel the slice protection of the idle entity
    - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks
    - cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
    - [amd64] EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald
      Rapids
    - [x86] fpu: Fix guest FPU state buffer allocation size
    - [x86] fpu: Avoid copying dynamic FP state from init_task in
      arch_dup_task_struct()
    - [x86] platform: Only allow CONFIG_EISA for 32-bit
    - [x86] sev: Add missing RIP_REL_REF() invocations during sme_enable()
    - lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
    - PM: sleep: Adjust check before setting power.must_resume
    - cpufreq: tegra194: Allow building for Tegra234
    - [riscv64] KVM: Disable the kernel perf counter during configure
    - watchdog/hardlockup/perf: Fix perf_event memory leak
    - selinux: Chain up tool resolving errors in install_policy.sh
    - [amd64] EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
    - [amd64] EDAC/ie31200: Fix the DIMM size mask for several SoCs
    - [amd64] EDAC/ie31200: Fix the error path order of ie31200_init()
    - [x86] resctrl: Fix allocation of cleanest CLOSID on platforms with no
      monitors
    - thermal: int340x: Add NULL check for adev
    - PM: sleep: Fix handling devices with direct_complete set on errors
    - lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
    - perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
    - [x86] traps: Make exc_double_fault() consistently noreturn
    - [x86] fpu/xstate: Fix inconsistencies in guest FPU xfeatures
    - [x86] entry: Add __init to ia32_emulation_override_cmdline()
    - [arm64] regulator: pca9450: Fix enable register for LDO5
    - [arm64,armhf] media: verisilicon: HEVC: Initialize start_bit field
    - [x86] platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol
      static
    - [x86] platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver
      static
    - [x86] platform/x86: dell-ddv: Fix temperature calculation
    - [amd64] ASoC: cs35l41: check the return value from spi_setup()
    - dt-bindings: vendor-prefixes: add GOcontroll
    - ALSA: hda/realtek: Always honor no_shutup_pins
    - ALSA: timer: Don't take register_mutex with copy_from/to_user()
    - [arm64] drm/bridge: ti-sn65dsi86: Fix multiple instances
    - drm/dp_mst: Fix drm RAD print
    - [arm64] drm/bridge: it6505: fix HDCP V match check is not performed
      correctly
    - [arm64] gpu: cdns-mhdp8546: fix call balance of mhdp->clk handling
      routines
    - drm/amdgpu: refine smu send msg debug log format
    - drm/amdgpu/umsch: fix ucode check
    - PCI: Use downstream bridges for distributing resources
    - PCI: Remove add_align overwrite unrelated to size0
    - [arm64] drm/mediatek: mtk_hdmi: Unregister audio platform device on
      failure
    - [arm64] drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
    - PCI/ASPM: Fix link state exit during switch upstream function removal
    - PCI/ACS: Fix 'pci=config_acs=' parameter
    - [arm64] drm/amd/display: fix an indent issue in DML21
    - [arm64] drm/msm/dpu: don't use active in atomic_check()
    - [arm64] drm/msm/dsi/phy: Program clock inverters in correct register
    - [arm64] drm/msm/dsi: Use existing per-interface slice count in DSC timing
    - [arm64] drm/msm/dsi: Set PHY usescase (and mode) before registering DSI
      host
    - [arm64] PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without
      data payload
    - [arm64] PCI: brcmstb: Set generation limit before PCIe link up
    - [arm64] PCI: brcmstb: Use internal register to change link capability
    - [arm64] PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
    - [arm64] PCI: brcmstb: Fix potential premature regulator disabling
    - PCI/portdrv: Only disable pciehp interrupts early when needed
    - PCI: Avoid reset when disabled via sysfs
    - drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
    - [arm64] drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump
    - [powerpc*] crypto: powerpc: Mark ghashp8-ppc.o as an
      OBJECT_FILES_NON_STANDARD
    - [powerpc*] kexec: fix physical address calculation in clear_utlb_entry()
    - PCI: Remove stray put_device() in pci_register_host_bridge()
    - [arm64] drm/mediatek: Fix config_updating flag never false when no mbox
      channel
    - [arm64] drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
    - [arm64] drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
    - drm/amd/display: avoid NPD when ASIC does not support DMUB
    - [arm64] PCI: dwc: ep: Return -ENOMEM for allocation failures
    - PCI: Fix BAR resizing when VF BARs are assigned
    - PCI: pciehp: Don't enable HPIE when resuming in poll mode
    - mdacon: rework dependency list
    - fbdev: sm501fb: Add some geometry checks.
    - [amd64] crypto: iaa - Test the correct request flag
    - [amd64] crypto: qat - set parity error mask for qat_420xx
    - crypto: bpf - Add MODULE_DESCRIPTION for skcipher
    - clk: amlogic: gxbb: drop incorrect flag on 32k clock
    - RDMA/mlx5: Fix page_size variable overflow
    - remoteproc: core: Clear table_sz when rproc_shutdown
    - of: property: Increase NR_FWNODE_REFERENCE_ARGS
    - pinctrl: renesas: rzg2l: Suppress binding attributes
    - remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
    - libbpf: Fix hypothetical STT_SECTION extern NULL deref case
    - [x86] mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
    - [arm64] clk: renesas: r8a08g045: Check the source of the CPU PLL settings
    - remoteproc: qcom: pas: add minidump_id to SC7280 WPSS
    - [arm64] clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
    - [s390x] Remove ioremap_wt() and pgprot_writethrough()
    - RDMA/mana_ib: Ensure variable err is initialized
    - remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226
    - [arm64] clk: qcom: gcc-x1e80100: Unregister
      GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK
    - bpf: Use preempt_count() directly in bpf_send_signal_common()
    - lib: 842: Improve error handling in sw842_compress()
    - RDMA/mlx5: Fix MR cache initialization error flow
    - [arm64] clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
    - RDMA/core: Don't expose hw_counters outside of init net namespace
    - RDMA/mlx5: Fix calculation of total invalidated pages
    - RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
    - remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
    - power: supply: bq27xxx_battery: do not update cached flags prematurely
    - crypto: api - Fix larval relookup type and mask
    - IB/mad: Check available slots before posting receive WRs
    - [arm64,armhf] pinctrl: tegra: Set SFIO mode to Mux Register
    - [arm64] clk: amlogic: g12b: fix cluster A parent data
    - [arm64] clk: amlogic: gxbb: drop non existing 32k clock parent
    - [amd64] crypto: qat - remove access to parity register for QAT GEN4
    - [arm64] clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents
    - [arm64] clk: amlogic: g12a: fix mmc A peripheral clock
    - [x86] entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
    - power: supply: max77693: Fix wrong conversion of charge input threshold
      value
    - crypto: nx - Fix uninitialised hv_nxc on error
    - bpf: Fix array bounds error with may_goto
    - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
    - [arm64] pinctrl: renesas: rzv2m: Fix missing of_node_put() call
    - [mips64el] mfd: sm501: Switch to BIT() to mitigate integer overflows
    - leds: Fix LED_OFF brightness race
    - [x86] dumpstack: Fix inaccurate unwinding from exception stacks due to
      misplaced assignment
    - RDMA/core: Fix use-after-free when rename device name
    - [amd64] pinctrl: intel: Fix wrong bypass assignment in
      intel_pinctrl_probe_pwm()
    - perf stat: Fix find_stat for mixed legacy/non-legacy events
    - perf: Always feature test reallocarray
    - w1: fix NULL pointer dereference in probe
    - fs/ntfs3: Update inode->i_mapping->a_ops on compression state
    - [arm64] phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine
      phy-id
    - isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
    - soundwire: slave: fix an OF node reference leak in soundwire slave device
    - perf report: Switch data file correctly in TUI
    - [arm64,armhf] coresight: catu: Fix number of pages while using 64k pages
    - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
    - [arm64,armhf] coresight-etm4x: add isb() before reading the TRCSTATR
    - perf pmu: Don't double count common sysfs and json events
    - [x86] tools/x86: Fix linux/unaligned.h include path in lib/insn.c
    - perf build: Fix in-tree build due to symbolic link
    - ucsi_ccg: Don't show failed to get FW build information error
    - iio: accel: mma8452: Ensure error return on failure to matching
      oversampling ratio
    - iio: accel: msa311: Fix failure to release runtime pm if direct mode claim
      fails.
    - iio: backend: make sure to NULL terminate stack buffer
    - perf bench: Fix perf bench syscall loop count
    - usb: xhci: correct debug message page size calculation
    - fs/ntfs3: Fix a couple integer overflows on 32bit systems
    - fs/ntfs3: Prevent integer overflow in hdr_first_de()
    - [arm64] dmaengine: fsl-edma: cleanup chan after
      dma_async_device_unregister
    - [arm64] dmaengine: fsl-edma: free irq correctly in remove path
    - iio: adc: ad4130: Fix comparison of channel setups
    - iio: adc: ad7124: Fix comparison of channel configs
    - iio: adc: ad7173: Fix comparison of channel configs
    - iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset
    - iio: light: Add check for array bounds in veml6075_read_int_time_ms
    - perf debug: Avoid stack overflow in recursive error message
    - perf evlist: Add success path to evlist__create_syswide_maps
    - perf units: Fix insufficient array space
    - kernel/events/uprobes: handle device-exclusive entries correctly in
      __replace_page()
    - kexec: initialize ELF lowest address to ULONG_MAX
    - ocfs2: validate l_tree_depth to avoid out-of-bounds access
    - NFSv4: Don't trigger uneccessary scans for return-on-close delegations
    - NFSv4: Avoid unnecessary scans of filesystems for returning delegations
    - NFSv4: Avoid unnecessary scans of filesystems for expired delegations
    - NFSv4: Avoid unnecessary scans of filesystems for delayed delegations
    - NFS: fix open_owner_id_maxsz and related fields.
    - fuse: fix dax truncate/punch_hole fault path
    - i3c: master: svc: Fix missing the IBI rules
    - perf python: Fixup description of sample.id event member
    - perf python: Decrement the refcount of just created event on failure
    - perf python: Don't keep a raw_data pointer to consumed ring buffer space
    - perf python: Check if there is space to copy all the event
    - perf dso: fix dso__is_kallsyms() check
    - perf: intel-tpebs: Fix incorrect usage of zfree()
    - [arm*]  staging: vchiq_arm: Register debugfs after cdev
    - [arm*] staging: vchiq_arm: Fix possible NPR of keep-alive thread
    - tty: n_tty: use uint for space returned by tty_write_room()
    - perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation
    - fs/procfs: fix the comment above proc_pid_wchan()
    - perf tools: annotate asm_pure_loop.S
    - perf bpf-filter: Fix a parsing error with comma
    - thermal: core: Remove duplicate struct declaration
    - objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show()
    - objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
    - NFS: Shut down the nfs_client only after all the superblocks
    - smb: client: Fix netns refcount imbalance causing leaks and use-after-free
    - exfat: fix the infinite loop in exfat_find_last_cluster()
    - exfat: fix missing shutdown check
    - rtnetlink: Allocate vfinfo size for VF GUIDs when supported
    - rndis_host: Flag RNDIS modems as WWAN devices
    - ksmbd: use aead_request_free to match aead_request_alloc
    - ksmbd: fix multichannel connection failure
    - ksmbd: fix r_count dec/increment mismatch
    - net/mlx5e: SHAMPO, Make reserved size independent of page size
    - ring-buffer: Fix bytes_dropped calculation issue
    - objtool: Fix segfault in ignore_unreachable_insn()
    - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are
      invalid
    - net: phy: broadcom: Correct BCM5221 PHY model detection
    - objtool: Fix verbose disassembly if CROSS_COMPILE isn't set
    - sched/smt: Always inline sched_smt_active()
    - context_tracking: Always inline ct_{nmi,irq}_{enter,exit}()
    - rcu-tasks: Always inline rcu_irq_work_resched()
    - nfs: Add missing release on error in nfs_lock_and_join_requests()
    - wifi: mac80211: Cleanup sta TXQs on flush
    - wifi: mac80211: remove debugfs dir for virtual monitor
    - wifi: iwlwifi: fw: allocate chained SG tables for dump
    - wifi: iwlwifi: mvm: use the right version of the rate API
    - nvme-tcp: fix possible UAF in nvme_tcp_poll
    - nvme-pci: clean up CMBMSC when registering CMB fails
    - nvme-pci: skip CMB blocks incompatible with PCI P2P DMA
    - wifi: brcmfmac: keep power during suspend if board requires it
    - affs: generate OFS sequence numbers starting at 1
    - affs: don't write overlarge OFS data block size fields
    - ALSA: hda/realtek: Fix Asus Z13 2025 audio
    - ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0
    - perf/core: Fix perf_pmu_register() vs. perf_init_event()
    - smb: common: change the data type of num_aces to le16
    - cifs: fix incorrect validation for num_aces field of smb_acl
    - [x86] platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go
      4 tablet
    - [x86] platform/x86/intel/vsec: Add Diamond Rapids support
    - HID: i2c-hid: improve i2c_hid_get_report error message
    - [amd64] platform/x86/amd/pmf: Propagate PMF-TA return codes
    - [amd64] platform/x86/amd/pmf: Update PMF Driver for Compatibility with new
      PMF-TA
    - exfat: add a check for invalid data size
    - ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using
      CS35L41 HDA
    - ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using
      CS35L41 HDA
    - ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using
      CS35L41 HDA
    - ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA
    - ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using
      CS35L41 HDA
    - ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using
      CS35L41 HDA
    - ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using
      CS35L41 HDA
    - sched/deadline: Use online cpus for validating runtime
    - [x86] hyperv/vtl: Stop kernel from probing VTL0 low memory
    - [amd64] ASoC: rt1320: set wake_capable = 0 explicitly
    - wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state
    - wifi: mac80211: fix SA Query processing in MLO
    - locking/semaphore: Use wake_q to wake up processes outside lock critical
      section
    - [x86] hyperv: Fix output argument to hypercall that changes page
      visibility
    - [x86] sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled
    - nvme-pci: fix stuck reset on concurrent DPC and HP
    - drm/amd: Keep display off while going into S4
    - net: devmem: do not WARN conditionally after netdev_rx_queue_restart()
    - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx
    - can: statistics: use atomic access in hot path
    - memory: omap-gpmc: drop no compatible check
    - hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}
    - netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int
    - spufs: fix a leak on spufs_new_file() failure
    - spufs: fix gang directory lifetimes
    - spufs: fix a leak in spufs_create_context()
    - fs/9p: fix NULL pointer dereference on mkdir
    - [riscv64] ftrace: Add parentheses in macro definitions of make_call_t0 and
      make_call_ra
    - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
    - ntb: intel: Fix using link status DB's
    - firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success
    - ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA
    - [riscv64] errata: Use medany for relocatable builds
    - [x86] uaccess: Improve performance by aligning writes to 8 bytes in
      copy_user_generic(), on non-FSRM/ERMS CPUs
    - ublk: make sure ubq->canceling is set when queue is frozen
    - [s390x] entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation
    - [riscv64]  Fix hugetlb retrieval of number of ptes in case of !present pte
    - [riscv64] kexec_file: Handle R_RISCV_64 in purgatory relocator
    - [riscv64] purgatory: 4B align purgatory_start
    - nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer
    - [arm*] spi: bcm2835: Do not call gpiod_put() on invalid descriptor
    - [arm*] spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is
      absent
    - e1000e: change k1 configuration on MTP and later platforms
    - idpf: fix adapter NULL pointer dereference on reboot
    - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets
      only
    - netfilter: nf_tables: don't unregister hook when table is dormant
    - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
    - net_sched: skbprio: Remove overly strict queue assertions
    - sctp: add mutual exclusion in proc_sctp_do_udp_port()
    - [arm64,armhf] net: mvpp2: Prevent parser TCAM memory corruption
    - udp: Fix multiple wraparounds of sk->sk_rmem_alloc.
    - udp: Fix memory accounting leak.
    - vsock: avoid timeout during connect() if the socket is closing
    - tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().
    - net: decrease cached dst counters in dst_release
    - netfilter: nft_tunnel: fix geneve_opt type confusion addition
    - ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
    - net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
    - net: fix geneve_opt length integer overflow
    - ipv6: Start path selection from the first nexthop
    - ipv6: Do not consider link down nexthops in path selection
    - [powerpc*] arcnet: Add NULL check in com20020pci_probe()
    - [powerpc*] net: ibmveth: make veth_pool_store stop hanging
    - kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally
    - drm/amdgpu/gfx11: fix num_mec
    - drm/amdgpu/gfx12: fix num_mec
    - perf/core: Fix child_total_time_enabled accounting bug at task exit
    - tracing: Switch trace_events_hist.c code over to use guard()
    - tracing/hist: Add poll(POLLIN) support on hist file
    - tracing/hist: Support POLLPRI event for poll on histogram
    - tracing: Correct the refcount if the hist/hist_debug file fails to open
    - cgroup/rstat: Tracking cgroup-level niced CPU time
    - cgroup/rstat: Fix forceidle time in cpu.stat
    - tty: serial: fsl_lpuart: Use u32 and u8 for register variables
    - tty: serial: fsl_lpuart: use port struct directly to simply code
    - tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning
    - tty: serial: lpuart: only disable CTS instead of overwriting the whole
      UARTMODIR register
    - wifi: mac80211: Fix sparse warning for monitor_sdata
    - usbnet:fix NPE during rx_complete
    - [x86] hyperv: Fix check of return value from snp_set_vmsa()
    - [x86] KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected
    - [x86] microcode/AMD: Fix __apply_microcode_amd()'s return value
    - [x86] mce: use is_copy_from_user() to determine copy-from-user context
    - [x86] tdx: Fix arch_safe_halt() execution for TDX VMs
    - [x86] ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO
      event-handlers
    - [x86] platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and
      E560
    - [x86] platform/x86: ISST: Correct command storage data length
    - ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
    - [x86] perf/x86/intel: Apply static call for drain_pebs
    - [x86] perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read
    - [x86] uprobes/x86: Harden uretprobe syscall trampoline check
    - idpf: Don't hard code napi_struct size
    - [x86] Kconfig: Add cmpxchg8b support back to Geode CPUs
    - [x86] tsc: Always save/restore TSC sched_clock() on suspend/resume
    - [x86] mm: Fix flush_tlb_range() when used for zapping normal PMDs
    - wifi: mt76: mt7925: remove unused acpi function for clc
    - acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
    - ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
    - [armel,armhf] 9444/1: add KEEP() keyword to ARM_VECTORS
    - media: omap3isp: Handle ARM dma_iommu_mapping
    - Remove unnecessary firmware version check for gc v9_4_2
    - mmc: omap: Fix memory leak in mmc_omap_new_slot
    - mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
    - mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD
    - [x86] KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT
      error
    - ksmbd: add bounds check for durable handle context
    - ksmbd: add bounds check for create lease context
    - ksmbd: fix use-after-free in ksmbd_sessions_deregister()
    - ksmbd: fix session use-after-free in multichannel connection
    - ksmbd: fix overflow in dacloffset bounds check
    - ksmbd: validate zero num_subauth before sub_auth is accessed
    - ksmbd: fix null pointer dereference in alloc_preauth_hash()
    - exfat: fix random stack corruption after get_block
    - exfat: fix potential wrong error return from get_block
    - tracing: Fix use-after-free in print_graph_function_flags during tracer
      switching
    - tracing: Ensure module defining synth event cannot be unloaded while
      tracing
    - tracing: Fix synth event printk format for str fields
    - tracing/osnoise: Fix possible recursive locking for cpus_read_lock()
    - mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs
    - [arm64] Don't call NULL in do_compat_alignment_fixup()
    - wifi: mt76: mt7921: fix kernel panic due to null pointer dereference
    - ext4: don't over-report free space or inodes in statvfs
    - ext4: fix OOB read when checking dotdot dir
    - jfs: fix slab-out-of-bounds read in ea_get()
    - jfs: add index corruption check to DT_GETPAGE()
    - mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead()
    - exec: fix the racy usage of fs_struct->in_exec
    - media: vimc: skip .s_stream() for stopped entities
    - media: streamzap: fix race between device disconnection and urb callback
    - nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()
    - nfsd: put dl_stid if fail to queue dl_recall
    - nfsd: fix management of listener transports
    - NFSD: nfsd_unlink() clobbers non-zero status returned from
      fh_fill_pre_attrs()
    - NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory
    - NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up
    - [armel,armhf] 9443/1: Require linker to support KEEP within OVERLAY for
      DCE
    - tracing: Do not use PERF enums when perf is not defined
    - [x86] platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.24
    - [amd64] ASoC: Intel: adl: add 2xrt1316 audio configuration
    - cgroup/cpuset: Fix incorrect isolated_cpus update in
      update_parent_effective_cpumask()
    - cgroup/cpuset: Fix error handling in remote_partition_disable()
    - cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in
      update_cpumasks_hier()"
    - cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per
      operation
    - cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set
    - cgroup/cpuset: Fix race between newly created partition and dying one
    - gpiolib: of: Fix the choice for Ingenic NAND quirk
    - ublk: refactor recovery configuration flag helpers
    - ublk: fix handling recovery & reissue in ublk_abort_queue()
    - [amd64] drm/i915: Disable RPG during live selftest
    - [x86] acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI
    - drm/xe/hw_engine: define sysfs_ops on all directories
    - ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()
    - objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret()
    - tipc: fix memory leak in tipc_link_xmit
    - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
    - net: tls: explicitly disallow disconnect
    - tc: Ensure we have enough buffer space when sending filter netlink
      notifications
    - net: ethtool: Don't call .cleanup_data when prepare_data fails
    - net: libwx: handle page_pool_dev_alloc_pages error
    - ata: sata_sx4: Add error handling in pdc20621_i2c_read()
    - drm/i915/huc: Fix fence not released on early probe errors
    - nvmet-fcloop: swap list_add_tail arguments
    - net_sched: sch_sfq: use a temporary work area for validating configuration
    - net_sched: sch_sfq: move the limit validation
    - smb: client: fix UAF in decryption with multichannel
    - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend()
    - net: phy: allow MDIO bus PM ops to start/stop state machine for
      phylink-controlled PHY
    - ipv6: Align behavior across nexthops during path selection
    - net: ppp: Add bound checking for skb data on ppp_sync_txmung
    - nft_set_pipapo: fix incorrect avx2 match of 5th field octet
    - [arm64] iommu/mediatek: Fix NULL pointer deference in
      mtk_iommu_device_group
    - perf/core: Add aux_pause, aux_resume, aux_start_paused
    - perf/core: Simplify the perf_event_alloc() error path
    - perf: Fix hang while freeing sigtrap event
    - fs: consistently deref the files table with rcu_dereference_raw()
    - umount: Allow superblock owners to force umount
    - pm: cpupower: bench: Prevent NULL dereference on malloc failure
    - [x86] mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW
    - [x86] percpu: Disable named address spaces for UBSAN_BOOL with KASAN for
      GCC < 14.2
    - [x86] ia32: Leave NULL selector values 0~3 unchanged
    - [x86] cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD
      when running in a virtual machine
    - [arm*] perf: arm_pmu: Don't disable counter in armpmu_add()
    - perf/dwc_pcie: fix some unreleased resources
    - PM: hibernate: Avoid deadlock in hibernate_compressor_param_set()
    - Flush console log from kernel_power_off()
    - [arm64] cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD
    - xen/mcelog: Add __nonstring annotations for unterminated strings
    - [amd64] platform/chrome: cros_ec_lpc: Match on Framework ACPI device
    - [amd64,arm64] ASoC: SOF: topology: Use krealloc_array() to replace
      krealloc()
    - HID: pidff: Convert infinite length from Linux API to PID standard
    - HID: pidff: Do not send effect envelope if it's empty
    - HID: pidff: Add MISSING_DELAY quirk and its detection
    - HID: pidff: Add MISSING_PBO quirk and its detection
    - HID: pidff: Add PERMISSIVE_CONTROL quirk
    - HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol
    - HID: pidff: Add FIX_WHEEL_DIRECTION quirk
    - HID: Add hid-universal-pidff driver and supported device ids
    - HID: pidff: Add PERIODIC_SINE_ONLY quirk
    - HID: pidff: Fix null pointer dereference in pidff_find_fields
    - [amd64] ASoC: amd: ps: use macro for ACP6.3 pci revision id
    - ALSA: hda: intel: Fix Optimus when GPU has no sound
    - ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist
    - [arm64] ASoC: fsl_audmix: register card device depends on 'dais' property
    - media: uvcvideo: Add quirk for Actions UVC05
    - mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves
    - ALSA: usb-audio: Fix CME quirk for UF series keyboards
    - [amd64] ASoC: amd: Add DMI quirk for ACP6X mic support
    - [amd64] ASoC: amd: yc: update quirk data for new Lenovo model
    - wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues
    - wifi: ath11k: fix memory leak in ath11k_xxx_remove()
    - wifi: ath12k: fix memory leak in ath12k_pci_remove()
    - wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
    - ata: libata-core: Add 'external' to the libata.force kernel parameter
    - scsi: mpi3mr: Avoid reply queue full condition
    - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
    - net: page_pool: don't cast mp param to devmem
    - f2fs: don't retry IO for corrupted data scenario
    - wifi: mac80211: add strict mode disabling workarounds
    - wifi: mac80211: ensure sdata->work is canceled before initialized.
    - scsi: target: spc: Fix RSOC parameter data header size
    - net: usb: asix_devices: add FiberGecko DeviceID
    - page_pool: avoid infinite loop to schedule delayed worker
    - [arm64,armhf] can: flexcan: Add quirk to handle separate interrupt lines
      for mailboxes
    - [arm64,armhf] can: flexcan: add NXP S32G2/S32G3 SoC support
    - jfs: Fix uninit-value access of imap allocated in the diMount() function
    - fs/jfs: cast inactags to s64 to prevent potential overflow
    - fs/jfs: Prevent integer overflow in AG size calculation
    - jfs: Prevent copying of nlink with value 0 from disk inode
    - jfs: add sanity check for agwidth in dbMount
    - ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
    - net: sfp: add quirk for 2.5G OEM BX SFP
    - wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi
    - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
    - net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module
    - ahci: add PCI ID for Marvell 88SE9215 SATA Controller
    - ext4: protect ext4_release_dquot against freezing
    - Revert "f2fs: rebuild nat_bits during umount"
    - ext4: ignore xattrs past end
    - cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk
    - scsi: st: Fix array overflow in st_setup()
    - ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI
    - btrfs: harden block_group::bg_list against list_del() races
    - wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
    - net: vlan: don't propagate flags on open
    - tracing: fix return value in __ftrace_event_enable_disable for
      TRACE_REG_UNREGISTER
    - Bluetooth: btintel_pcie: Add device id of Whale Peak
    - Bluetooth: hci_uart: fix race during initialization
    - Bluetooth: btusb: Add 2 HWIDs for MT7922
    - Bluetooth: hci_qca: use the power sequencer for wcn6750
    - Bluetooth: qca: simplify WCN399x NVM loading
    - Bluetooth: Add quirk for broken READ_VOICE_SETTING
    - Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE
    - drm: allow encoder mode_set even when connectors change for crtc
    - drm/xe/bmg: Add new PCI IDs
    - drm/xe/vf: Don't try to trigger a full GT reset if VF
    - drm/amd/display: Update Cursor request mode to the beginning prefetch
      always
    - drm/amdgpu: Unlocked unmap only clear page table leaves
    - drm: panel-orientation-quirks: Add support for AYANEO 2S
    - drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB
    - drm: panel-orientation-quirks: Add quirk for AYA NEO Slide
    - drm: panel-orientation-quirks: Add new quirk for GPD Win 2
    - drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel)
    - drm/debugfs: fix printk format for bridge index
    - drm/bridge: panel: forbid initializing a panel with unknown connector type
    - drm/amd/display: stop DML2 from removing pipes based on planes
    - drivers: base: devres: Allow to release group on device release
    - drm/amdkfd: clamp queue size to minimum
    - drm/amdkfd: Fix mode1 reset crash issue
    - drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
    - drm/amdkfd: debugfs hang_hws skip GPU with MES
    - drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds
    - [arm64] drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data
    - [arm64] drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
    - [arm64] PCI: Add Rockchip Vendor ID
    - drm/amdgpu: handle amdgpu_cgs_create_device() errors in
      amd_powerplay_create()
    - PCI: Enable Configuration RRS SV early
    - drm/amdgpu: Fix the race condition for draining retry fault
    - PCI: Check BAR index for validity
    - [amd64] PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type
    - drm/amdgpu: grab an additional reference on the gang fence v2
    - fbdev: omapfb: Add 'plane' value check
    - tracing: probe-events: Add comments about entry data storing code
    - tpm, tpm_tis: Workaround failed command reception on Infineon devices
    - tpm: End any active auth session before shutdown
    - [arm64] pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
    - erofs: set error to bio if file-backed IO fails
    - bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
    - ext4: don't treat fhandle lookup of ea_inode as FS corruption
    - [s390x] pci: Fix s390_mmio_read/write syscall page fault handling
    - HID: pidff: Clamp PERIODIC effect period to device's logical range
    - HID: pidff: Stop all effects before enabling actuators
    - HID: pidff: Completely rework and fix pidff_reset function
    - HID: pidff: Simplify pidff_upload_effect function
    - HID: pidff: Define values used in pidff_find_special_fields
    - HID: pidff: Rescale time values to match field units
    - HID: pidff: Factor out code for setting gain
    - HID: pidff: Move all hid-pidff definitions to a dedicated header
    - HID: pidff: Simplify pidff_rescale_signed
    - HID: pidff: Use macros instead of hardcoded min/max values for shorts
    - HID: pidff: Factor out pool report fetch and remove excess declaration
    - HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX
    - HID: hid-universal-pidff: Add Asetek wheelbases support
    - HID: pidff: Comment and code style update
    - HID: pidff: Support device error response from PID_BLOCK_LOAD
    - HID: pidff: Remove redundant call to pidff_find_special_keys
    - HID: pidff: Rename two functions to align them with naming convention
    - HID: pidff: Clamp effect playback LOOP_COUNT value
    - HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff
    - HID: pidff: Fix 90 degrees direction name North -> East
    - HID: pidff: Fix set_device_control()
    - dt-bindings: media: st,stmipid02: correct lane-polarities maxItems
    - [arm64] media: mediatek: vcodec: Fix a resource leak related to the scp
      device in FW initialization
    - [arm64] media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning
    - media: uapi: rkisp1-config: Fix typo in extensible params example
    - [amd64] media: intel/ipu6: set the dev_parent of video device to pdev
    - [arm64] media: venus: hfi: add a check to handle OOB in sfr region
    - [arm64] media: venus: hfi: add check to handle incorrect queue size
    - media: siano: Fix error handling in smsdvb_module_init()
    - [arm64,armhf] media: rockchip: rga: fix rga offset lookup
    - xenfs/xensyms: respect hypervisor's "next" indication
    - [arm64] cputype: Add MIDR_CORTEX_A76AE
    - [arm64] errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list
    - [arm64] errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB
    - [arm64] errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list
    - [arm64] KVM: arm64: Tear down vGIC on failed vCPU creation
    - spi: cadence-qspi: Fix probe on AM62A LP SK
    - tpm, tpm_tis: Fix timeout handling when waiting for TPM status
    - [amd64] accel/ivpu: Fix PM related deadlocks in MS IOCTLs
    - media: streamzap: prevent processing IR data on URB failure
    - [amd64] media: hi556: Fix memory leak (on error) in hi556_check_hwcfg()
    - media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
    - Revert "media: imx214: Fix the error handling in imx214_probe()"
    - [amd64] media: i2c: ov7251: Set enable GPIO low in probe
    - [amd64] media: i2c: ov7251: Introduce 1 ms delay between regulators and en
      GPIO
    - [arm64] media: venus: hfi_parser: add check to avoid out of bound access
    - [arm64] media: venus: hfi_parser: refactor hfi packet parsing logic
    - mptcp: sockopt: fix getting IPV6_V6ONLY
    - mptcp: sockopt: fix getting freebind & transparent
    - [arm64,armhf] net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum
      for 6320 family
    - [arm64,armhf] net: dsa: mv88e6xxx: fix internal PHYs for 6320 family
    - wifi: mt76: Add check for devm_kstrdup()
    - wifi: mac80211: fix integer overflow in hwmp_route_info_get()
    - wifi: mt76: mt7925: ensure wow pattern command align fw format
    - wifi: mt76: mt7925: fix country count limitation for CLC
    - wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present
    - wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO
    - io_uring/net: fix accept multishot handling
    - io_uring/net: fix io_req_post_cqe abuse by send bundle
    - io_uring/kbuf: reject zero sized provided buffers
    - [arm64] ASoC: q6apm: add q6apm_get_hw_pointer helper
    - [arm64] ASoC: q6apm-dai: schedule all available frames to avoid dsp
      under-runs
    - [arm64] ASoC: q6apm-dai: make use of q6apm_get_hw_pointer
    - [arm64] ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment.
    - [arm64] ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns.
    - [arm64] ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path
    - ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx
    - [amd64] accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal()
    - [amd64] accel/ivpu: Fix deadlock in ivpu_ms_cleanup()
    - bus: mhi: host: Fix race between unprepare and queue_buf
    - ext4: fix off-by-one error in do_split
    - f2fs: fix to avoid atomicity corruption of atomic file
    - vdpa/mlx5: Fix oversized null mkey longer than 32bit
    - udf: Fix inode_getblk() return value
    - tpm: do not start chip while suspended
    - svcrdma: do not unregister device for listeners
    - [amd64,armhf] soc: samsung: exynos-chipid: Add NULL pointer check in
      exynos_chipid_probe()
    - smb311 client: fix missing tcon check when mounting with linux/posix
      extensions
    - ima: limit the number of open-writers integrity violations
    - ima: limit the number of ToMToU integrity violations
    - i3c: master: svc: Use readsb helper for reading MDB
    - i3c: Add NULL pointer check in i3c_master_queue_ibi()
    - jbd2: remove wrong sb->s_sequence check
    - kbuild: exclude .rodata.(cst|str)* when building ranges
    - [arm64] leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs
    - [arm64] leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res
      PWMs
    - [armhf] mfd: ene-kb3930: Fix a potential NULL pointer dereference
    - locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
    - lib: scatterlist: fix sg_split_phys to preserve original scatterlist
      offsets
    - mptcp: fix NULL pointer in can_accept_new_subflow
    - mptcp: only inc MPJoinAckHMacFailure for HMAC failures
    - mtd: inftlcore: Add error check for inftl_read_oob()
    - mtd: rawnand: Add status chack in r852_ready()
    - [arm64] mops: Do not dereference src reg for a set operation
    - [arm64] tegra: Remove the Orin NX/Nano suspend key
    - [arm64] mm: Correct the update of max_pfn
    - [arm64] dts: mediatek: mt8173: Fix disp-pwm compatible string
    - [arm64] backlight: led_bl: Hold led_access lock when calling
      led_sysfs_disable()
    - btrfs: fix non-empty delayed iputs list on unmount due to compressed write
      workers
    - btrfs: tests: fix chunk map leak after failure to add it to the tree
    - btrfs: zoned: fix zone activation with missing devices
    - btrfs: zoned: fix zone finishing with missing devices
    - iommufd: Fix uninitialized rc in iommufd_access_rw()
    - [amd64] iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is
      disabled
    - [amd64] iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity
      changes
    - [amd64] iommu/vt-d: Fix possible circular locking dependency
    - [amd64] iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs
    - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
    - mm/damon/ops: have damon_get_folio return folio even for tail pages
    - mm/rmap: reject hugetlb folios in folio_make_device_exclusive()
    - mm: make page_mapped_in_vma() hugetlb walk aware
    - mm: fix lazy mmu docs and usage
    - mm/mremap: correctly handle partial mremap() of VMA starting at 0
    - mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
    - mm/userfaultfd: fix release hang over concurrent GUP
    - mm/hwpoison: do not send SIGBUS to processes with recovered clean pages
    - mm/hugetlb: move hugetlb_sysctl_init() to the __init section
    - mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper
    - sctp: detect and prevent references to a freed transport in sendmsg
    - [x86] xen: fix balloon target initialization for PVH dom0
    - tracing: fprobe events: Fix possible UAF on modules
    - tracing: Do not add length to print format in synthetic events
    - thermal/drivers/rockchip: Add missing rk3328 mapping entry
    - CIFS: Propagate min offload along with other parameters from primary to
      secondary channels.
    - cifs: avoid NULL pointer dereference in dbg call
    - cifs: fix integer overflow in match_server()
    - cifs: Ensure that all non-client-specific reparse points are processed by
      the server
    - [arm64] clk: renesas: r9a07g043: Fix HP clock source for RZ/Five
    - [arm64] clk: qcom: clk-branch: Fix invert halt status bit check for
      votable clocks
    - [arm64] clk: qcom: gdsc: Release pm subdomains in reverse add order
    - [arm64] clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code
    - [arm64] clk: qcom: gdsc: Set retain_ff before moving to HW CTRL
    - [amd64] crypto: ccp - Fix check for the primary ASP device
    - [amd64] crypto: ccp - Fix uAPI definitions of PSP errors
    - dlm: fix error if inactive rsb is not hashed
    - dlm: fix error if active rsb is not hashed
    - dm-integrity: set ti->error on memory allocation failure
    - dm-integrity: fix non-constant-time tag verification
    - dm-verity: fix prefetch-vs-suspend race
    - dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg'
    - dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg'
    - ftrace: Add cond_resched() to ftrace_graph_set_hash()
    - ftrace: Properly merge notrace hashes
    - [arm64] gpio: zynq: Fix wakeup source leaks on device unbind
    - gve: handle overflow when reporting TX consumed descriptors
    - KVM: Allow building irqbypass.ko as as module when kvm.ko is a module
    - [ppc64el] KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests
    - [x86] KVM: x86: Explicitly zero-initialize on-stack CPUID unions
    - [x86] KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory
      accesses
    - landlock: Move code to ease future backports
    - landlock: Add the errata interface
    - landlock: Add erratum for TCP fix
    - landlock: Always allow signals between threads of the same process
    - landlock: Prepare to add second errata
    - misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq'
      error
    - net: mana: Switch to page pool for jumbo frames
    - of/irq: Fix device node refcount leakage in API of_irq_parse_one()
    - of/irq: Fix device node refcount leakage in API of_irq_parse_raw()
    - of/irq: Fix device node refcount leakages in of_irq_count()
    - of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
    - of/irq: Fix device node refcount leakages in of_irq_init()
    - [arm64] PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe()
    - [arm64] PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4
    - PCI: pciehp: Avoid unnecessary device replacement check
    - PCI: Fix reference leak in pci_alloc_child_bus()
    - PCI: Fix reference leak in pci_register_host_bridge()
    - PCI: Fix wrong length of devres array
    - [arm64] phy: freescale: imx8m-pcie: assert phy reset and perst in power
      off
    - [arm64] pinctrl: qcom: Clear latched interrupt status when changing IRQ
      type
    - [arm64,armhf] pinctrl: samsung: add support for eint_fltcon_offset
    - ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio()
    - [s390x] pci: Fix zpci_bus_is_isolated_vf() for non-VFs
    - [s390x] virtio_ccw: Don't allocate/assign airqs for non-existing queues
    - [s390x] Fix linker error when -no-pie option is unavailable
    - [arm64] thermal/drivers/mediatek/lvts: Disable monitor mode during suspend
    - [arm64] thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold
    - [arm64] errata: Add newer ARM cores to the spectre_bhb_loop_affected()
      lists
    - iommufd: Make attach_handle generic than fault specific
    - iommufd: Fail replace if device has not been attached
    - [x86] paravirt: Move halt paravirt calls under CONFIG_PARAVIRT
    - [amd64] ACPI: platform-profile: Fix CFI violation when accessing sysfs
      files
    - NFSD: fix decoding in nfs4_xdr_dec_cb_getattr
    - NFSD: Fix CB_GETATTR status fix
    - nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026)
    - [x86] e820: Fix handling of subpage regions when calculating nosave ranges
      in e820__register_nosave_regions()
    - kbuild: Add '-fno-builtin-wcslen'
    - [arm64] media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef
      noinline
    - Bluetooth: hci_uart: Fix another race during initialization
    - [s390x] cpumf: Fix double free on error in cpumf_pmu_event_init()
    - [armhf] HSI: ssi_protocol: Fix use after free vulnerability in
      ssi_protocol Driver Due to Race Condition (CVE-2025-37838)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.25
    - [arm64] scsi: hisi_sas: Enable force phy when SATA disk directly connected
    - wifi: at76c50x: fix use after free access in at76_disconnect
    - wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
    - wifi: mac80211: Purge vif txq in ieee80211_do_stop()
    - wifi: wl1251: fix memory leak in wl1251_tx_work
    - scsi: iscsi: Fix missing scsi_host_put() in error path
    - driver core: bus: add irq_get_affinity callback to bus_type
    - blk-mq: introduce blk_mq_map_hw_queues
    - scsi: replace blk_mq_pci_map_queues with blk_mq_map_hw_queues
    - scsi: smartpqi: Use is_kdump_kernel() to check for kdump
    - md/raid10: fix missing discard IO accounting
    - md/md-bitmap: fix stats collection for external bitmaps
    - [amd64,riscv64] ASoC: dwc: always enable/disable i2s irqs
    - [amd64] ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()
    - ovl: remove unused forward declaration
    - [amd64] RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
    - [arm64] RDMA/hns: Fix wrong maximum DMA segment size
    - ALSA: hda/cirrus_scodec_test: Don't select dependencies
    - ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA
    - ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130
    - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue
    - [amd64] ASoC: cs42l43: Reset clamp override on jack removal
    - RDMA/core: Silence oversized kvmalloc() warning
    - Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
    - Bluetooth: btrtl: Prevent potential NULL dereference
    - Bluetooth: l2cap: Check encryption key size on incoming connection
    - ipv6: add exception routes to GC list in rt6_insert_exception
    - xen: fix multicall debug feature
    - Revert "wifi: mac80211: Update skb's control block key in
      ieee80211_tx_dequeue()"
    - igc: fix PTM cycle trigger logic
    - igc: increase wait time before retrying PTM
    - igc: move ktime snapshot into PTM retry loop
    - igc: handle the IGC_PTP_ENABLED flag correctly
    - igc: cleanup PTP module if probe fails
    - igc: add lock preventing multiple simultaneous PTM transactions
    - dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry
    - smc: Fix lockdep false-positive for IPPROTO_SMC.
    - pds_core: fix memory leak in pdsc_debugfs_add_qcq()
    - ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()
    - net: mctp: Set SOCK_RCU_FREE
    - block: fix resource leak in blk_register_queue() error path
    - netlink: specs: ovs_vport: align with C codegen capabilities
    - net: openvswitch: fix nested key length validation in the set() action
    - [arm64] net: ethernet: ti: am65-cpsw: fix port_np reference counting
    - eth: bnxt: fix missing ring index trim on error path
    - loop: aio inherit the ioprio of original request
    - loop: stop using vfs_iter_{read,write} for buffered I/O
    - ata: libata-sata: Save all fields from sense data descriptor
    - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
    - netlink: specs: rt-link: add an attr layer around alt-ifname
    - netlink: specs: rt-link: adjust mctp attribute naming
    - net: b53: enable BPDU reception for management port
    - net: bridge: switchdev: do not notify new brentries as changed
    - net: txgbe: fix memory leak in txgbe_probe() error path
    - [arm64,armhf] net: dsa: mv88e6xxx: avoid unregistering devlink regions
      which were never registered
    - [arm64,armhf] net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST
      is unsupported
    - [arm64,armhf] net: dsa: clean up FDB, MDB, VLAN entries on unbind
    - [arm64,armhf] net: dsa: free routing table on probe failure
    - [arm64,armhf] net: dsa: avoid refcount warnings when
      ds->ops->tag_8021q_vlan_del() fails
    - ptp: ocp: fix start time alignment in ptp_ocp_signal_set
    - [arm64] net: ti: icss-iep: Add pwidth configuration for perout signal
    - [arm64] net: ti: icss-iep: Add phase offset configuration for perout
      signal
    - [arm64] net: ti: icss-iep: Fix possible NULL pointer dereference for
      perout request
    - [arm64] net: ethernet: mtk_eth_soc: reapply mdc divider on reset
    - [arm64] net: ethernet: mtk_eth_soc: correct the max weight of the queue
      limit for 100Mbps
    - [arm64] net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings
    - [riscv64] Use kvmalloc_array on relocation_hashtable
    - [riscv64] Properly export reserved regions in /proc/iomem
    - [riscv64] module: Fix out-of-bounds relocation access
    - [riscv64] module: Allocate PLT entries for R_RISCV_PLT32
    - cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
    - writeback: fix false warning in inode_to_wb()
    - Revert "PCI: Avoid reset when disabled via sysfs"
    - [arm64] ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate
    - [arm64] ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels
    - [amd64] ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16
    - [arm64] ASoC: qcom: Fix sc7280 lpass potential buffer overflow
    - [amd64] asus-laptop: Fix an uninitialized variable
    - block: integrity: Do not call set_page_dirty_lock()
    - [arm64] drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and
      later
    - nfs: add missing selections of CONFIG_CRC32
    - nfsd: decrease sc_count directly if fail to queue dl_recall
    - i2c: atr: Fix wrong include
    - ftrace: fix incorrect hash size in register_ftrace_direct()
    - [arm64] drm/msm/a6xx+: Don't let IB_SIZE overflow
    - Bluetooth: l2cap: Process valid commands in too long frame
    - Bluetooth: vhci: Avoid needless snprintf() calls
    - btrfs: correctly escape subvol in btrfs_show_options()
    - cpufreq/sched: Explicitly synchronize limits_changed flag handling
    - hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
    - i2c: cros-ec-tunnel: defer probe if parent EC is not present
    - isofs: Prevent the use of too small fid
    - loop: properly send KOBJ_CHANGED uevent for disk device
    - loop: LOOP_SET_FD: send uevents for partitions
    - mm/compaction: fix bug in hugetlb handling pathway
    - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable()
    - mm: fix filemap_get_folios_contig returning batches of identical folios
    - mm: fix apply_to_existing_page_range()
    - ovl: don't allow datadir only
    - ksmbd: Fix dangling pointer in krb_authenticate
    - ksmbd: fix use-after-free in smb_break_all_levII_oplock()
    - ksmbd: Prevent integer overflow in calculation of deadtime
    - ksmbd: fix the warning from __kernel_write_iter
    - Revert "smb: client: Fix netns refcount imbalance causing leaks and
      use-after-free"
    - Revert "smb: client: fix TCP timers deadlock after rmmod" (CVE-2025-22077)
    - [riscv64] Avoid fortify warning in syscall_get_arguments()
    - slab: ensure slab->obj_exts is clear in a newly allocated slab page
    - smb3 client: fix open hardlink on deferred close file error
    - string: Add load_unaligned_zeropad() code path to sized_strscpy()
    - tracing: Fix filter string testing
    - virtiofs: add filesystem context source name check
    - [x86] microcode/AMD: Extend the SHA check to Zen5, block loading of any
      unreleased standalone Zen5 microcode patches
    - [x86] cpu/amd: Fix workaround for erratum 1054
    - [x86] boot/sev: Avoid shared GHCB page for early memory acceptance
    - scsi: megaraid_sas: Block zero-length ATA VPD inquiry
    - scsi: ufs: exynos: Ensure consistent phy reference counts
    - RDMA/cma: Fix workqueue crash in cma_netevent_work_handler
    - [amd64] RAS/AMD/ATL: Include row[13] bit in row retirement
    - [amd64] RAS/AMD/FMPM: Get masked address
    - [x86] platform/x86: amd: pmf: Fix STT limits
    - [x86] perf/x86/intel: Allow to update user space GPRs from PEBS records
    - [x86] perf/x86/intel/uncore: Fix the scale of IIO free running counters on
      SNR
    - [x86] perf/x86/intel/uncore: Fix the scale of IIO free running counters on
      ICX
    - [x86] perf/x86/intel/uncore: Fix the scale of IIO free running counters on
      SPR
    - drm/ast: Fix ast_dp connection status
    - [arm64] drm/msm/dsi: Add check for devm_kstrdup()
    - [arm64] drm/msm/a6xx: Fix stale rpmh votes from GPU
    - drm/amdgpu: Prefer shadow rom when available
    - drm/amd/display: prevent hang on link training fail
    - drm/amd: Handle being compiled without SI or CIK support better
    - drm/amd/display: Actually do immediate vblank disable
    - drm/amd/display: Increase vblank offdelay for PSR panels
    - drm/amd/pm: Prevent division by zero
    - drm/amd/pm/powerplay: Prevent division by zero
    - drm/amd/pm/smu11: Prevent division by zero
    - drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
    - drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
    - drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
    - drm/amdgpu/mes12: optimize MES pipe FW version fetching
    - [amd64] drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed
    - drm/xe: Use local fence in error path of xe_migrate_clear
    - drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1
    - drm/amd/display: Protect FPU in dml2_validate()/dml21_validate()
    - drm/amd/display: Protect FPU in dml21_copy()
    - drm/amdgpu/mes11: optimize MES pipe FW version fetching
    - drm/amdgpu/dma_buf: fix page_link check
    - drm/nouveau: prime: fix ttm_bo_delayed_delete oops
    - drm/xe: Fix an out-of-bounds shift when invalidating TLB
    - [amd64] drm/i915/gvt: fix unterminated-string-initialization warning
    - drm/amdgpu: immediately use GTT for new allocations
    - drm/amd/display: Do not enable Replay and PSR while VRR is on in
      amdgpu_dm_commit_planes()
    - drm/amd/display: Protect FPU in dml2_init()/dml21_init()
    - drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on
      DP1
    - drm/xe/dma_buf: stop relying on placement in unmap
    - drm/xe/userptr: fix notifier vs folio deadlock
    - drm/xe: Set LRC addresses before guc load
    - drm/amdgpu: fix warning of drm_mm_clean
    - [amd64] drm/mgag200: Fix value in <VBLKSTR> register
    - [arm64] sysreg: Update register fields for ID_AA64MMFR0_EL1
    - [arm64] sysreg: Add register fields for HDFGRTR2_EL2
    - [arm64] sysreg: Add register fields for HDFGWTR2_EL2
    - [arm64] sysreg: Add register fields for HFGITR2_EL2
    - [arm64] sysreg: Add register fields for HFGRTR2_EL2
    - [arm64] sysreg: Add register fields for HFGWTR2_EL2
    - [arm64] boot: Enable EL2 requirements for FEAT_PMUv3p9
    - cpufreq: Reference count policy in cpufreq_update_limits()
    - kbuild: Add '-fno-builtin-wcslen'
    - [x86] platform/x86: msi-wmi-platform: Rename "data" variable
    - [x86] platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug
    - drm/amd/display: Temporarily disable hostvm on DCN31
    - nvmet-fc: Remove unused functions
    - block: remove rq_list_move
    - block: add a rq_list type
    - block: don't reorder requests in blk_add_rq_to_plug
    - mm/vma: add give_up_on_oom option on modify/merge, use in uffd release
    - Revert "wifi: ath12k: Fix invalid entry fetch in
      ath12k_dp_mon_srng_process"
    - [mips*] ds1287: Match ds1287_set_base_clock() function types
    - wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
    - bpf: add find_containing_subprog() utility function
    - bpf: track changes_pkt_data property for global functions
    - bpf: check changes_pkt_data property for extension programs
    - bpf: fix null dereference when computing changes_pkt_data of prog w/o
      subprogs

  [ Emanuele Rocca ]
  * [arm64,powerpc,ppc64,ppc64el,riscv64,s390x] Enable KALLSYMS_ALL on
    all architectures where DEBUG_INFO_BTF is on (Closes: #1100634)

  [ Salvatore Bonaccorso ]
  * [amd64] drivers/hwmon/pmbus: Enable PMBUS and SENSORS_PMBUS as modules
    (Closes: #1103437)
 
  [ Uwe Kleine-König ]
  * Put all clock modules in the kernel image udeb
  * [arm64] Drop some clk modules from fb-modules that are also in the kernel
    udeb.

  [ Alper Nebi Yasak ]
  * [arm64] Enable BT_MTKSDIO as module
  * [arm64] Change REGULATOR_MT6358 and MFD_MT6397 to built-in
  * [arm64] Change COMMON_CLK_MT8173 and MTK_PMIC_WRAP to built-in
  * [arm64] Enable DRM_PANEL_HIMAX_HX83102, DRM_PANEL_ILITEK_ILI9882T as module
  * [arm64] Enable SND_SOC_MT8188, SND_SOC_MT8188_MT6359 as module
  * [arm64] Enable SND_SOC_MT8192, SND_SOC_MT8192_MT6359_RT1015_RT5682 as module
  * [arm64] udeb: Add modules for MediaTek devices
    - Add nvmem_mtk-efuse, phy-mtk-tphy, pwm-mediatek and i2c-mt65xx modules
      to kernel-image
    - Add mediatek-drm, mediatek-drm-hdmi, mediatek_dp, mtk_iommu, mtk-smi,
      phy-mtk-dp, phy-mtk-hdmi-drv, phy-mtk-mipi-dsi-drv, pwm-mtk-disp,
      anx7625, parade-ps8640 and ite-it6505 to fb-modules
    - Add panel-himax-hx83102 and panel-ilitek-ili9882t to fb-modules
    - Add elan_i2c to input-modules
    - Add mtu3 to usb-modules
  * udeb: Add onboard_usb_dev to usb-modules
  * [arm64] Enable modules for Qualcomm SC7180 Chromebooks
    - Enable SC_GPUCC_7180 and INTERCONNECT_QCOM_SC7180 as modules
    - Enable SC_DISPCC_7180, SC_VIDEOCC_7180 and SC_CAMCC_7180 as modules
    - Enable SC_LPASS_CORECC_7180, SND_SOC_ADAU7002, SND_SOC_SC7180 as modules
    - Enable IIO_CROS_EC_SENSORS_LID_ANGLE and CROS_EC_MKBP_PROXIMITY as modules
    - Enable EDAC_QCOM and SPI_QCOM_QSPI as modules
  * [arm64] udeb: Add modules fo Qualcomm SC7180 Chromebooks
    - Add gcc-sc7180 and qnoc-sc7180 to kernel-image
  * [arm64] Enable SC_LPASSCC_7280 as module
  * [arm64] Enable I2C_HID_OF_ELAN as module
  * udeb: Move i2c-hid-of-elan module to fb-modules

  [ Ben Hutchings ]
  * d/rules.real: Export CROSS_COMPILE_COMPAT, CROSS32_COMPILE variables.
    This re-enables the compat vDSO on arm64.
  * linux-kbuild: Fix cross-build regression:
    - libbpf: Use the standard fixdep build rule
    - d/rules.d/tools/bpf/resolve_btfids: Define REALHOST{CC,LD} for submake

  [ Bastian Blank ]
  * Include modprobe config in bug reports.

  [ Raphaël Hertzog ]
  * udeb: add dm-thin-pool md-modules (Closes: #956226)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 25 Apr 2025 17:07:45 +0200

linux (6.12.22-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.22
    - ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
    - HID: hid-plantronics: Add mic mute mapping and generalize quirks
    - atm: Fix NULL pointer dereference
    - drm/amd/display: Don't write DP_MSTM_CTRL after LT
    - netfilter: socket: Lookup orig tuple for IPv6 SNAT
    - ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx
    - tty: serial: 8250: Add some more device IDs
    - tty: serial: 8250: Add Brainboxes XC devices
    - tty: serial: fsl_lpuart: disable transmitter before changing RS485 related
      registers
    - net: usb: qmi_wwan: add Telit Cinterion FN990B composition
    - net: usb: qmi_wwan: add Telit Cinterion FE990B composition
    - net: usb: usbnet: restore usb%d name exception for local mac addresses
    - usb: xhci: Don't skip on Stopped - Length Invalid
    - usb: xhci: Apply the link chain quirk on NEC isoc endpoints
    - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
    - perf tools: Fix up some comments and code to properly use the event_source
      bus
    - [armhf] serial: stm32: do not deassert RS485 RTS GPIO prematurely
    - serial: 8250_dma: terminate correct DMA in tx_dma_flush()
    - bcachefs: bch2_ioctl_subvolume_destroy() fixes

  [ Salvatore Bonaccorso ]
  * ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model
    (Closes: #1100928)
  * md: fix mddev uaf while iterating all_mddevs list (Closes: #1086175)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 10 Apr 2025 15:32:40 +0200

linux (6.12.21-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.21
    - [arm64] firmware: qcom: scm: Fix error code in probe()
    - [arm64] dts: freescale: tqma8mpql: Fix vqmmc-supply
    - [arm64] dts: rockchip: remove supports-cqe from rk3588 jaguar
    - [arm64] dts: rockchip: remove supports-cqe from rk3588 tiger
    - xfrm: fix tunnel mode TX datapath in packet offload mode
    - xfrm_output: Force software GSO only in tunnel mode
    - [arm64] soc: imx8m: Remove global soc_uid
    - [arm64] soc: imx8m: Use devm_* to simplify probe failure handling
    - [arm64] soc: imx8m: Unregister cpufreq and soc dev in cleanup path
    - [arm64] dts: bcm2712: PL011 UARTs are actually r1p5
    - [arm64] dts: rockchip: Remove undocumented sdmmc property from lubancat-1
    - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex()
      tests
    - RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx
    - RDMA/mlx5: Handle errors returned from mlx5r_ib_rate()
    - dma-mapping: fix missing clear bdr in check_ram_in_range_map()
    - RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
    - [arm64] RDMA/hns: Fix soft lockup during bt pages loop
    - [arm64] RDMA/hns: Fix unmatched condition in error path of
      alloc_user_qp_db()
    - [arm64] RDMA/hns: Fix invalid sq params not being blocked
    - [arm64] RDMA/hns: Fix a missing rollback in error path of
      hns_roce_create_qp_common()
    - [arm64] RDMA/hns: Fix missing xa_destroy()
    - [arm64] RDMA/hns: Fix wrong value of max_sge_rd
    - Bluetooth: Fix error code in chan_alloc_skb_cb()
    - Bluetooth: hci_event: Fix connection regression between LE and non-LE
      adapters
    - tracing: tprobe-events: Fix to clean up tprobe correctly when module
      unload
    - [arm64] net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence
    - net: ipv6: fix TCP GSO segmentation with NAT
    - ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
    - ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
    - devlink: fix xa_alloc_cyclic() error handling
    - dpll: fix xa_alloc_cyclic() error handling
    - phy: fix xa_alloc_cyclic() error handling
    - [arm64,armhf] gpu: host1x: Do not assume that a NULL domain means no DMA
      IOMMU
    - net: atm: fix use after free in lec_send()
    - net: ti: icssg-prueth: Add lock to stats
    - net: lwtunnel: fix recursion loops
    - net: ipv6: ioam6: fix lwtunnel_output() loop
    - libfs: Fix duplicate directory entry in offset_dir_lookup
    - net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
    - Revert "gre: Fix IPv6 link-local address generation."
    - tracing: tprobe-events: Fix leakage of module refcount
    - i2c: omap: fix IRQ storms
    - net: mana: Support holes in device list reply msg
    - dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for
      R-Car V4M
    - can: ucan: fix out of bound read in strscpy() source
    - [arm64,armhf] can: flexcan: only change CAN state when link up in system
      PM
    - [arm64,armhf] can: flexcan: disable transceiver during system PM
    - drm/xe: Fix exporting xe buffers multiple times
    - [arm64] drm/v3d: Don't run jobs that have errors flagged in its fence
    - io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally
    - [riscv64] dts: starfive: Fix a typo in StarFive JH7110 pin function
      definitions
    - netfs: Call `invalidate_cache` only if implemented
    - regulator: dummy: force synchronous probing
    - regulator: check that dummy regulator has been probed before using it
    - [arm64] dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound
      card
    - [arm64] dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound
      card
    - [arm64] dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou
    - [arm64] dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou
    - mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT
    - mm/migrate: fix shmem xarray update during migration
    - mm/page_alloc: fix memory accept before watermarks gets initialized
    - proc: fix UAF in proc_get_inode()
    - memcg: drain obj stock on cpu hotplug teardown
    - [arm64] firmware: qcom: uefisecapp: fix efivars registration race
    - efi/libstub: Avoid physical address 0x0 when doing random allocation
    - keys: Fix UAF in key_put()
    - xsk: fix an integer overflow in xp_create_and_assign_umem()
    - batman-adv: Ignore own maximum aggregation size during RX
    - [arm64] soc: qcom: pdr: Fix the potential deadlock
    - pmdomain: amlogic: fix T7 ISP secpower
    - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
    - drm/sched: Fix fence reference count leak
    - drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini()
    - drm/amd/display: Fix message for support_edp0_on_dp1
    - drm/amd/display: Use HW lock mgr for PSR1 when only one eDP
    - drm/amd/pm: add unique_id for gfx12
    - drm/amdgpu: Restore uncached behaviour on GFX12
    - drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2
    - drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2
    - drm/amdgpu: Remove JPEG from vega and carrizo video caps
    - drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size
    - drm/amdgpu: Fix JPEG video caps max size for navi1x and raven
    - ksmbd: fix incorrect validation for num_aces field of smb_acl
    - io_uring/net: fix sendzc double notif flush
    - [arm64] KVM: arm64: Calculate cptr_el2 traps on activating traps
    - [arm64] KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state
    - [arm64] KVM: arm64: Remove host FPSIMD saving for non-protected KVM
    - [arm64] KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN
    - [arm64] KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN
    - [arm64] KVM: arm64: Refactor exit handlers
    - [arm64] KVM: arm64: Mark some header functions as inline
    - [arm64] KVM: arm64: Eagerly switch ZCR_EL{1,2}
    - Revert "sched/core: Reduce cost of sched_move_task when config autogroup"
    - libsubcmd: Silence compiler warning
    - [arm64] dts: rockchip: fix u2phy1_host status for NanoPi R4S
    - mm/huge_memory: drop beyond-EOF folios with the right number of refs
    - mptcp: Fix data stream corruption in the address announcement

  [ Ben Hutchings ]
  * lintian: Restore override for perf-read-vdso32 in linux-perf
  * linux-perf: Fix perf-check manual page built with asciidoctor
  * rtla: Add man page link for hwnoise(1)
  * intel-sdsi, rtla: Add "Depends: ${misc:Depends}"
  * d/copyright: Update filenames under arch/arm/boot/dts
  * d/copyright: Remove special case for drivers/crypto/vmx/*.pl
  * lintian: Override superfluous-file-pattern for d/copyright in
    linux-signed-*
  * d/salsa-ci.yml: Run lintian from the target release, not always unstable
  * [powerpc*] Revert "fbdev/offb: Update expected device name" (Closes:
    #1085949)
  * d/b/genpatch-rt: Fix subprocess cleanup with Python 3.13

  [ Salvatore Bonaccorso ]
  * sound/soc/amd/acp: Enable SND_AMD_ASOC_RENOIR as module (Closes: #1101155)
  * d/b/genpatch-rt: Drop now unused 'io' module.

  [ Vagrant Cascadian ]
  * drivers/net/wireless/realtek/rtw88: Enable RTW88_8723CS as a module

  [ Miguel Bernal Marin ]
  * [amd64,arm64/cloud] Enable virtualisation drivers on cloud flavours,
    (Closes: #1101378)
    - drivers/virt: Enable VIRT_DRIVERS
    - drivers/virt: Enable VMGENID
    - drivers/virt/nitro_enclaves: Enable NITRO_ENCLAVES as module
    - drivers/virt/coco/sev-guest: Enable SEV_GUEST as module
    - drivers/virt/coco/tdx-guest: Enable TDX_GUEST_DRIVER as module

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 30 Mar 2025 16:50:14 +0200

linux (6.12.20-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.20
    - mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq
    - mm: fix kernel BUG when userfaultfd_move encounters swapcache
    - userfaultfd: fix PTE unmapping stack-allocated PTE copies
    - fbdev: hyperv_fb: iounmap() the correct memory when removing a device
    - netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
    - ice: do not configure destination override for switchdev
    - ice: fix memory leak in aRFS after reset
    - ice: Fix switchdev slow-path in LAG
    - netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around
    - netfilter: nf_tables: make destruction work queue pernet
    - sched: address a potential NULL pointer dereference in the GRED scheduler.
    - wifi: iwlwifi: mvm: fix PNVM timeout for non-MSI-X platforms
    - wifi: mac80211: don't queue sdata::work for a non-running sdata
    - wifi: cfg80211: cancel wiphy_work before freeing wiphy
    - Bluetooth: hci_event: Fix enabling passive scanning
    - Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context"
    - net/mlx5: Fill out devlink dev info only for PFs
    - [arm64,armhf] net: dsa: mv88e6xxx: Verify after ATU Load ops
    - net: mctp i3c: Copy headers if cloned
    - net: mctp i2c: Copy headers if cloned
    - netpoll: hold rcu read lock in __netpoll_send_skb()
    - drm/hyperv: Fix address space leak when Hyper-V DRM device is removed
    - fbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs
    - fbdev: hyperv_fb: Simplify hvfb_putmem
    - fbdev: hyperv_fb: Allow graceful removal of framebuffer
    - Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
    - net/mlx5: handle errors in mlx5_chains_create_table()
    - eth: bnxt: fix truesize for mb-xdp-pass case
    - eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc()
    - eth: bnxt: do not use BNXT_VNIC_NTUPLE unconditionally in queue restart logic
    - eth: bnxt: do not update checksum in bnxt_xdp_build_skb()
    - eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx}
    - eth: bnxt: use page pool for head frags
    - bnxt_en: refactor tpa_info alloc/free into helpers
    - bnxt_en: handle tpa_info in queue API implementation
    - eth: bnxt: fix memory leak in queue reset
    - net: switchdev: Convert blocking notification chain to a raw one
    - net: mctp: unshare packets when reassembling
    - bonding: fix incorrect MAC address setting to receive NS messages
    - netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
    - ipvs: prevent integer overflow in do_ip_vs_get_ctl()
    - net_sched: Prevent creation of classes with TC_H_ROOT
    - netfilter: nft_exthdr: fix offset with ipv4_find_option()
    - gre: Fix IPv6 link-local address generation.
    - net: openvswitch: remove misbehaving actions length check
    - Revert "openvswitch: switch to per-action label counting in conntrack"
    - net/mlx5: HWS, Rightsize bwc matcher priority
    - net/mlx5: Fix incorrect IRQ pool usage when releasing IRQs
    - net/mlx5: Lag, Check shared fdb before creating MultiPort E-Switch
    - net/mlx5: Bridge, fix the crash caused by LAG state check
    - net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
    - nvme-fc: go straight to connecting state when initializing
    - nvme-fc: do not ignore connectivity loss during connecting
    - hrtimers: Mark is_migration_base() with __always_inline
    - powercap: call put_device() on an error path in powercap_register_control_type()
    - btrfs: avoid starting new transaction when cleaning qgroup during subvolume drop
    - futex: Pass in task to futex_queue()
    - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
    - [x86] platform/x86/intel: pmc: fix ltr decode in pmc_core_ltr_show()
    - drm/amd/display: Fix out-of-bound accesses
    - scsi: core: Use GFP_NOIO to avoid circular locking dependency
    - scsi: ufs: core: Fix error return with query response
    - scsi: qla1280: Fix kernel oops when debug level > 2
    - ACPI: resource: IRQ override for Eluktronics MECH-17
    - smb: client: fix noisy when tree connecting to DFS interlink targets
    - sched_ext: selftests/dsp_local_on: Fix sporadic failures
    - [amd64] HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
    - [amd64] HID: intel-ish-hid: Send clock sync message immediately after reset
    - HID: ignore non-functional sensor in HP 5MP Camera
    - HID: hid-steam: Fix issues with disabling both gamepad mode and lizard mode
    - usb: phy: generic: Use proper helper for property detection
    - [amd64] HID: intel-ish-hid: ipc: Add Panther Lake PCI device IDs
    - HID: topre: Fix n-key rollover on Realforce R3S TKL boards
    - HID: hid-apple: Apple Magic Keyboard a3203 USB-C support
    - HID: apple: fix up the F6 key on the Omoton KB066 keyboard
    - btrfs: fix two misuses of folio_shift()
    - objtool: Ignore dangling jump table entries
    - sched: Clarify wake_up_q()'s write to task->wake_q.next
    - [x86] platform/x86: thinkpad_acpi: Fix invalid fan speed on ThinkPad X120e
    - [x86] platform/x86: thinkpad_acpi: Support for V9 DYTC platform profiles
    - [x86] platform/x86: int3472: Use correct type for "polarity", call it gpio_flags
    - [x86] platform/x86: int3472: Call "reset" GPIO "enable" for INT347E
    - [s390x] cio: Fix CHPID "configure" attribute caching
    - thermal/cpufreq_cooling: Remove structure member documentation
    - [arm64] amu: Delay allocating cpumask for AMU FIE support
    - Xen/swiotlb: mark xen_swiotlb_fixup() __init
    - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
    - [amd64] ASoC: Intel: sof_sdw: Add lookup of quirk using PCI subsystem ID
    - [amd64] ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S14
    - [amd64] ASoC: Intel: soc-acpi-intel-mtl-match: declare adr as ull
    - ASoC: simple-card-utils.c: add missing dlc->of_node
    - ALSA: hda/realtek: Limit mic boost on Positivo ARN50
    - [amd64] ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
    - PCI: pci_ids: add INTEL_HDA_PTL_H
    - ALSA: hda: intel-dsp-config: Add PTL-H support
    - [amd64] ASoC: SOF: Intel: pci-ptl: Add support for PTL-H
    - ALSA: hda: hda-intel: add Panther Lake-H support
    - [amd64] ASoC: SOF: amd: Add post_fw_run_delay ACP quirk
    - [amd64] ASoC: SOF: amd: Handle IPC replies before FW_BOOT_COMPLETE
    - net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors
    - io-wq: backoff when retrying worker creation
    - nvme-pci: quirk Acer FA100 for non-uniqueue identifiers
    - nvmet-rdma: recheck queue state is LIVE in state lock in recv done
    - apple-nvme: Release power domains when probe fails
    - cifs: Treat unhandled directory name surrogate reparse points as mount directory nodes
    - sctp: Fix undefined behavior in left shift operation
    - nvme: only allow entering LIVE from CONNECTING state
    - phy: ti: gmii-sel: Do not use syscon helper to build regmap
    - fuse: don't truncate cached, mutated symlink
    - ASoC: dapm-graph: set fill colour of turned on nodes
    - [amd64] ASoC: SOF: Intel: don't check number of sdw links when set dmic_fixup
    - drm/vkms: Round fixp2int conversion in lerp_u16
    - [x86] perf/x86/intel: Use better start period for frequency mode
    - [x86] of: Don't use DTB for SMP setup if ACPI is enabled
    - [x86] irq: Define trace events conditionally
    - [x86] perf/x86/rapl: Add support for Intel Arrow Lake U
    - mptcp: safety check before fallback
    - drm/nouveau: Do not override forced connector status
    - net: Handle napi_schedule() calls from non-interrupt
    - block: fix 'kmem_cache of name 'bio-108' already exists'
    - vhost: return task creation error instead of NULL
    - cifs: Validate content of WSL reparse point buffers
    - cifs: Throw -EOPNOTSUPP error on unsupported reparse point type from parse_reparse_point()
    - Input: goodix-berlin - fix vddio regulator references
    - Input: ads7846 - fix gpiod allocation
    - Input: iqs7222 - preserve system status register
    - Input: xpad - add 8BitDo SN30 Pro, Hyperkin X91 and Gamesir G7 SE controllers
    - Input: xpad - add multiple supported devices
    - Input: xpad - add support for ZOTAC Gaming Zone
    - Input: xpad - add support for TECNO Pocket Go
    - Input: xpad - rename QH controller to Legion Go S
    - Input: i8042 - swap old quirk combination with new quirk for NHxxRZQ
    - Input: i8042 - add required quirks for missing old boardnames
    - Input: i8042 - swap old quirk combination with new quirk for several devices
    - Input: i8042 - swap old quirk combination with new quirk for more devices
    - USB: serial: ftdi_sio: add support for Altera USB Blaster 3
    - USB: serial: option: add Telit Cinterion FE990B compositions
    - USB: serial: option: fix Telit Cinterion FE990A name
    - USB: serial: option: match on interface class for Telit FN990B
    - [x86] microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
    - spi: microchip-core: prevent RX overflows when transmit size > FIFO size
    - [amd64] drm/i915/cdclk: Do cdclk post plane programming later
    - drm/panic: use `div_ceil` to clean Clippy warning
    - drm/panic: fix overindented list items in documentation
    - drm/atomic: Filter out redundant DPMS calls
    - drm/dp_mst: Fix locking when skipping CSN before topology probing
    - drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags
    - drm/amd/amdkfd: Evict all queues even HWS remove queue failed
    - drm/amdgpu/display: Allow DCC for video formats on GFX12
    - drm/amd/display: Disable unneeded hpd interrupts during dm_init
    - drm/amd/display: fix default brightness
    - drm/amd/display: fix missing .is_two_pixels_per_container
    - drm/amd/display: Restore correct backlight brightness after a GPU reset
    - drm/amd/display: Assign normalized_pix_clk when color depth = 14
    - drm/amd/display: Fix slab-use-after-free on hdcp_work
    - ksmbd: fix use-after-free in ksmbd_free_work_struct
    - ksmbd: prevent connection release during oplock break notification
    - clk: samsung: update PLL locktime for PLL142XX used on FSD platform
    - clk: samsung: gs101: fix synchronous external abort in samsung_clk_save()
    - [amd64] ASoC: Intel: sof_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
    - [amd64] ASoC: amd: yc: Support mic on another Lenovo ThinkPad E16 Gen 2 model
    - netmem: prevent TX of unreadable skbs
    - dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature
    - [arm64] mm: Populate vmemmap at the page level if not section aligned
    - Fix mmu notifiers for range-based invalidates
    - qlcnic: fix memory leak issues in qlcnic_sriov_common.c
    - smb: client: fix regression with guest option
    - net: phy: nxp-c45-tja11xx: add TJA112X PHY configuration errata
    - net: phy: nxp-c45-tja11xx: add TJA112XB SGMII PCS restart errata
    - sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()
    - ASoC: ops: Consistently treat platform_max as control value
    - drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
    - [amd64] ASoC: cs42l43: Fix maximum ADC Volume
    - [amd64] ASoC: rt722-sdca: add missing readable registers
    - drm/xe: cancel pending job timer before freeing scheduler
    - drm/xe: Release guc ids before cancelling work
    - drm/xe/userptr: Fix an incorrect assert
    - drm/xe/pm: Temporarily disable D3Cold on BMG
    - nvme: move error logging from nvme_end_req() to __nvme_end_req()
    - ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
    - [amd64] drm/i915: Increase I915_PARAM_MMAP_GTT_VERSION version to indicate support for partial mmaps
    - scripts: generate_rust_analyzer: add missing macros deps
    - scripts: generate_rust_analyzer: add missing include_dirs
    - scripts: generate_rust_analyzer: add uapi crate
    - block: change blk_mq_add_to_batch() third argument type to bool
    - cifs: Fix integer overflow while processing acregmax mount option
    - cifs: Fix integer overflow while processing acdirmax mount option
    - cifs: Fix integer overflow while processing actimeo mount option
    - cifs: Fix integer overflow while processing closetimeo mount option
    - [x86] vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors
    - i2c: ali1535: Fix an error handling path in ali1535_probe()
    - i2c: ali15x3: Fix an error handling path in ali15x3_probe()
    - i2c: sis630: Fix an error handling path in sis630_probe()
    - mm/hugetlb: wait for hugetlb folios to be freed
    - smb3: add support for IAKerb
    - smb: client: Fix match_session bug preventing session reuse
    - sched_ext: selftests/dsp_local_on: Fix selftest on UP systems
    - tools/sched_ext: Add helper to check task migration state
    - Bluetooth: L2CAP: Fix corrupted list in hci_chan_del
    - nvme-fc: rely on state transitions to handle connectivity loss
    - HID: apple: disable Fn key handling on the Omoton KB066

  [ Madhu Adav M J ]
  * drivers/nvme/target: Enable NVME_TARGET_PASSTHRU
  * drivers/nvme/target: Enable NVME_TARGET_LOOP and NVME_TARGET_FCLOOP
    as modules

  [ Salvatore Bonaccorso ]
  * net/sunrpc: Enable RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2 (Closes: #1100641)
  * [x86] drivers/pinctrl/intel: Enable PINCTRL_INTEL_PLATFORM as module
    (Closes: #1100694)
  * ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs
    (Closes: #1091696)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 23 Mar 2025 14:34:08 +0100

linux (6.12.19-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.18
    - RDMA/mlx5: Fix the recovery flow of the UMR QP
    - IB/mlx5: Set and get correct qp_num for a DCT QP
    - RDMA/mlx5: Fix a race for DMABUF MR which can lead to CQE with error
    - RDMA/mlx5: Fix a WARN during dereg_mr for DM type
    - RDMA/mana_ib: Allocate PAGE aligned doorbell index
    - RDMA/hns: Fix mbox timing out by adding retry mechanism
    - RDMA/bnxt_re: Fail probe early when not enough MSI-x vectors are reserved
    - RDMA/bnxt_re: Refactor NQ allocation
    - RDMA/bnxt_re: Cache MSIx info to a local structure
    - RDMA/bnxt_re: Add sanity checks on rdev validity
    - RDMA/bnxt_re: Allocate dev_attr information dynamically
    - RDMA/bnxt_re: Fix the statistics for Gen P7 VF
    - landlock: Fix non-TCP sockets restriction
    - scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and ufshcd_eh_timed_out()
    - ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
    - NFS: O_DIRECT writes must check and adjust the file length
    - NFS: Adjust delegated timestamps for O_DIRECT reads and writes
    - SUNRPC: Prevent looping due to rpc_signal_task() races
    - NFSv4: Fix a deadlock when recovering state on a sillyrenamed file
    - SUNRPC: Handle -ETIMEDOUT return from tlshd
    - RDMA/mlx5: Fix implicit ODP hang on parent deregistration
    - RDMA/mlx5: Fix AH static rate parsing
    - scsi: core: Clear driver private data when retrying request
    - scsi: ufs: core: Set default runtime/system PM levels before
      ufshcd_hba_init()
    - RDMA/mlx5: Fix bind QP error cleanup flow
    - RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers
    - sunrpc: suppress warnings for unused procfs functions
    - ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports
    - Bluetooth: L2CAP: Fix L2CAP_ECRED_CONN_RSP response
    - rxrpc: rxperf: Fix missing decoding of terminal magic cookie
    - afs: Fix the server_list to unuse a displaced server rather than putting
      it
    - afs: Give an afs_server object a ref on the afs_cell object it points to
    - net: loopback: Avoid sending IP packets without an Ethernet header
    - net: set the minimum for net_hotdata.netdev_budget_usecs
    - ipv4: Convert icmp_route_lookup() to dscp_t.
    - ipv4: Convert ip_route_input() to dscp_t.
    - ipvlan: Prepare ipvlan_process_v4_outbound() to future .flowi4_tos
      conversion.
    - ipvlan: ensure network headers are in skb linear part
    - net: cadence: macb: Synchronize stats calculations
    - net: dsa: rtl8366rb: Fix compilation problem
    - [armhf] ASoC: es8328: fix route from DAC to output
    - [arm64,armhf] ASoC: fsl: Rename stream name of SAI DAI driver
    - ipvs: Always clear ipvs_property flag in skb_scrub_packet()
    - drm/xe/oa: Signal output fences
    - drm/xe/oa: Move functions up so they can be reused for config ioctl
    - drm/xe/oa: Add syncs support to OA config ioctl
    - drm/xe/oa: Allow only certain property changes from config
    - drm/xe/oa: Allow oa_exponent value of 0
    - firmware: cs_dsp: Remove async regmap writes
    - [amd64] ASoC: cs35l56: Prevent races when soft-resetting using SPI control
    - ALSA: hda/realtek: Fix wrong mic setup for ASUS VivoBook 15
    - net: ethernet: ti: am65-cpsw: select PAGE_POOL
    - tcp: devmem: don't write truncated dmabuf CMSGs to userspace
    - ice: add E830 HW VF mailbox message limit support
    - ice: Fix deinitializing VF in error path
    - ice: Avoid setting default Rx VSI twice in switchdev setup
    - tcp: Defer ts_recent changes until req is owned
    - net: Clear old fragment checksum value in napi_reuse_skb
    - [arm64,armhf] net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow
      defination.
    - net/mlx5: IRQ, Fix null string in debug print
    - net: ipv6: fix dst ref loop on input in seg6 lwt
    - net: ipv6: fix dst ref loop on input in rpl lwt
    - idpf: fix checksums set in idpf_rx_rsc()
    - net: ti: icss-iep: Reject perout generation request
    - thermal: gov_power_allocator: Fix incorrect calculation in
      divvy_up_power()
    - perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list
    - uprobes: Reject the shared zeropage in uprobe_write_opcode()
    - thermal: of: Simplify thermal_of_should_bind with scoped for each OF child
    - thermal/of: Fix cdev lookup in thermal_of_should_bind()
    - thermal: core: Move lists of thermal instances to trip descriptors
    - thermal: gov_power_allocator: Update total_weight on bind and cdev updates
    - io_uring/net: save msg_control for compat
    - unreachable: Unify
    - objtool: Remove annotate_{,un}reachable()
    - objtool: Fix C jump table annotations for Clang
    - [x86] CPU: Fix warm boot hang regression on AMD SC1100 SoC systems
    - phy: rockchip: fix Kconfig dependency more
    - [riscv64] KVM: Fix hart suspend status check
    - [riscv64] KVM: Fix hart suspend_type use
    - [riscv64] KVM: Fix SBI IPI error generation
    - [riscv64] KVM: Fix SBI TIME error generation
    - tracing: Fix bad hist from corrupting named_triggers list
    - ftrace: Avoid potential division by zero in function_stat_show()
    - ALSA: usb-audio: Re-add sample rate quirk for Pioneer DJM-900NXS2
    - ALSA: hda/realtek: Fix microphone regression on ASUS N705UD
    - [arm64] KVM: arm64: Ensure a VMID is allocated before programming
      VTTBR_EL2
    - perf/core: Add RCU read lock protection to perf_iterate_ctx()
    - [x86] perf/x86: Fix low freqency setting issue
    - perf/core: Fix low freq setting via IOC_PERIOD
    - drm/xe/regs: remove a duplicate definition for RING_CTL_SIZE(size)
    - drm/xe/userptr: restore invalidation list on error
    - drm/xe/userptr: fix EFAULT handling
    - drm/amdkfd: Preserve cp_hqd_pq_control on update_mqd
    - drm/amdgpu: disable BAR resize on Dell G5 SE
    - drm/amdgpu: init return value in amdgpu_ttm_clear_buffer
    - drm/amd/display: Disable PSR-SU on eDP panels
    - drm/amd/display: add a quirk to enable eDP0 on DP1
    - drm/amd/display: Fix HPD after gpu reset
    - [arm64] mm: Fix Boot panic on Ampere Altra
    - block: Remove zone write plugs when handling native zone append writes
    - i2c: npcm: disable interrupt enable bit before devm_request_irq
    - i2c: ls2x: Fix frequency division register access
    - usbnet: gl620a: fix endpoint checking in genelink_bind()
    - net: phy: qcom: qca807x fix condition for DAC_DSP_BIAS_CURRENT
    - [arm64] net: enetc: fix the off-by-one issue in enetc_map_tx_buffs()
    - [arm64] net: enetc: keep track of correct Tx BD count in
      enetc_map_tx_tso_buffs()
    - [arm64] net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC
    - [arm64] net: enetc: update UDP checksum when updating originTimestamp
      field
    - [arm64] net: enetc: correct the xdp_tx statistics
    - [arm64] net: enetc: fix the off-by-one issue in enetc_map_tx_tso_buffs()
    - [arm64,armhf] phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL
      masks in refclk
    - [arm64,armhf] phy: exynos5-usbdrd: gs101: ensure power is gated to SS phy
      in phy_exit()
    - [amd64] iommu/vt-d: Remove device comparison in
      context_setup_pass_through_cb
    - [amd64] iommu/vt-d: Fix suspicious RCU usage
    - [amd64] intel_idle: Handle older CPUs, which stop the TSC in deeper C
      states, correctly (Closes: #1088682)
    - mptcp: always handle address removal under msk socket lock
    - mptcp: reset when MPTCP opts are dropped after join
    - vmlinux.lds: Ensure that const vars with relocations are mapped R/O
    - rcuref: Plug slowpath race in rcuref_put()
    - sched/core: Prevent rescheduling when interrupts are disabled
    - sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called
      without balance()
    - dm-integrity: Avoid divide by zero in table status in Inline mode
    - dm vdo: add missing spin_lock_init
    - ima: Reset IMA_NONACTION_RULE_FLAGS after post_setattr
    - scsi: ufs: core: bsg: Fix crash when arpmb command fails
    - [riscv64] futex: sign extend compare value in atomic cmpxchg
    - [riscv64] signal: fix signal frame size
    - [riscv64] cacheinfo: Use of_property_present() for non-boolean properties
    - [riscv64] signal: fix signal_minsigstksz
    - [riscv64] cpufeature: use bitmap_equal() instead of memcmp()
    - efi: Don't map the entire mokvar table to determine its size
    - amdgpu/pm/legacy: fix suspend/resume issues
    - [x86] microcode/AMD: Return bool from find_blobs_in_containers()
    - [x86] microcode/AMD: Have __apply_microcode_amd() return bool
    - [x86] microcode/AMD: Remove ugly linebreak in __verify_patch_section()
      signature
    - [x86] microcode/AMD: Remove unused save_microcode_in_initrd_amd()
      declarations
    - [x86] microcode/AMD: Merge early_apply_microcode() into its single
      callsite
    - [x86] microcode/AMD: Get rid of the _load_microcode_amd() forward
      declaration
    - [x86] microcode/AMD: Add get_patch_level()
    - [x86] microcode/AMD: Load only SHA256-checksummed patches
    - thermal: gov_power_allocator: Add missing NULL pointer check
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.19
    - [x86] amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()
    - [amd64] drm/i915/dsi: convert to struct intel_display
    - [amd64] drm/i915/dsi: Use TRANS_DDI_FUNC_CTL's own port width macro
    - [arm64,armhf] gpio: vf610: use generic device_get_match_data()
    - [arm64,armhf] gpio: vf610: add locking to gpio direction functions
    - cifs: Remove symlink member from cifs_open_info_data union
    - smb311: failure to open files of length 1040 when mounting with SMB3.1.1
      POSIX extensions
    - btrfs: fix data overwriting bug during buffered write when block size <
      page size
    - [x86] microcode/AMD: Add some forgotten models to the SHA check
    - Revert "of: reserved-memory: Fix using wrong number of cells to get
      property 'alignment'"
    - tracing: tprobe-events: Fix a memory leak when tprobe with $retval
    - tracing: tprobe-events: Reject invalid tracepoint name
    - [amd64] HID: appleir: Fix potential NULL dereference at raw event handle
    - ksmbd: fix type confusion via race condition when using
      ipc_msg_send_request
    - ksmbd: fix out-of-bounds in parse_sec_desc()
    - ksmbd: fix use-after-free in smb2_lock
    - ksmbd: fix bug on trap in smb2_lock
    - [arm64] gpio: rcar: Use raw_spinlock to protect register access
    - ALSA: seq: Avoid module auto-load handling at event delivery
    - ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
    - ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform
    - ALSA: hda/realtek: update ALC222 depop optimize
    - btrfs: fix a leaked chunk map issue in read_one_chunk()
    - hwmon: (peci/dimmtemp) Do not provide fake thresholds data
    - drm/amd/display: Fix null check for pipe_ctx->plane_state in
      resource_build_scaling_params
    - drm/amdkfd: Fix NULL Pointer Dereference in KFD queue
    - drm/amd/pm: always allow ih interrupt from fw
    - drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
    - Revert "mm/page_alloc.c: don't show protection in zone's
      ->lowmem_reserve[] for empty zone"
    - Revert "selftests/mm: remove local __NR_* definitions"
    - [x86] platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
    - [x86] boot: Sanitize boot params before parsing command line
    - [x86] cacheinfo: Validate CPUID leaf 0x2 EDX output
    - [x86] cpu: Validate CPUID leaf 0x2 EDX output
    - [x86] cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
    - drm/xe: Add staging tree for VM binds
    - drm/xe/hmm: Style- and include fixes
    - drm/xe/hmm: Don't dereference struct page pointers without notifier lock
    - drm/xe/vm: Fix a misplaced #endif
    - drm/xe/vm: Validate userptr during gpu vma prefetching
    - mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
    - drm/xe: Fix GT "for each engine" workarounds
    - drm/xe: Fix fault mode invalidation with unbind
    - drm/xe/userptr: properly setup pfn_flags_mask
    - drm/xe/userptr: Unmap userptrs in the mmu notifier
    - Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()
    - Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()
    - wifi: cfg80211: regulatory: improve invalid hints checking
    - wifi: nl80211: reject cooked mode if it is set along with other flags
    - rapidio: add check for rio_add_net() in rio_scan_alloc_net()
    - rapidio: fix an API misues when rio_add_net() fails
    - dma: kmsan: export kmsan_handle_dma() for modules
    - [s390x] traps: Fix test_monitor_call() inline assembly
    - NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback
    - userfaultfd: do not block on locking a large folio with raised refcount
    - block: fix conversion of GPT partition name to 7-bit
    - mm/page_alloc: fix uninitialized variable
    - mm: abort vma_modify() on merge out of memory failure
    - mm: memory-failure: update ttu flag inside unmap_poisoned_folio
    - mm: don't skip arch_sync_kernel_mappings() in error paths
    - mm: fix finish_fault() handling for large folios
    - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
    - mm: memory-hotplug: check folio ref count first in do_migrate_range
    - wifi: iwlwifi: mvm: clean up ROC on failure
    - wifi: iwlwifi: mvm: don't try to talk to a dead firmware
    - wifi: iwlwifi: limit printed string from FW file
    - wifi: iwlwifi: Free pages allocated when failing to build A-MSDU
    - wifi: iwlwifi: Fix A-MSDU TSO preparation
    - HID: google: fix unused variable warning under !CONFIG_ACPI
    - [amd64] HID: intel-ish-hid: Fix use-after-free issue in
      hid_ishtp_cl_remove()
    - [amd64] HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
    - coredump: Only sort VMAs when core_sort_vma sysctl is set
    - nvme-pci: add support for sgl metadata
    - nvme-pci: use sgls for all user requests if possible
    - nvme-ioctl: fix leaked requests on mapping error
    - wifi: mac80211: Support parsing EPCS ML element
    - wifi: mac80211: fix MLE non-inheritance parsing
    - wifi: mac80211: fix vendor-specific inheritance
    - drm/fbdev-helper: Move color-mode lookup into 4CC format helper
    - drm/fbdev: Add memory-agnostic fbdev client
    - drm: Add client-agnostic setup helper
    - drm/fbdev-ttm: Support struct drm_driver.fbdev_probe
    - drm/nouveau: Run DRM default client setup
    - drm/nouveau: select FW caching
    - bluetooth: btusb: Initialize .owner field of force_poll_sync_fops
    - nvme-tcp: add basic support for the C2HTermReq PDU
    - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
    - nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch
    - ALSA: hda/realtek: Remove (revert) duplicate Ally X config
    - net: gso: fix ownership in __udp_gso_segment
    - caif_virtio: fix wrong pointer check in cfv_probe()
    - perf/core: Fix pmus_lock vs. pmus_srcu ordering
    - hwmon: (pmbus) Initialise page count in pmbus_identify()
    - hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
    - hwmon: (ad7314) Validate leading zero bits and return error
    - tracing: probe-events: Remove unused MAX_ARG_BUF_LEN macro
    - drm/imagination: Fix timestamps in firmware traces
    - ALSA: usx2y: validate nrpacks module parameter on probe
    - llc: do not use skb_get() before dev_queue_xmit()
    - hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
    - drm/sched: Fix preprocessor guard
    - be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
    - [arm64] net: hns3: make sure ptp clock is unregister and freed if
      hclge_ptp_get_cycle returns an error
    - [amd64] drm/i915/color: Extract intel_color_modeset()
    - [amd64] drm/i915: Plumb 'dsb' all way to the plane hooks
    - drm/xe: Remove double pageflip
    - HID: hid-steam: Fix use-after-free when detaching device
    - [arm64] net: ipa: Fix v4.7 resource group names
    - [arm64] net: ipa: Fix QSB data for v4.7
    - [arm64] net: ipa: Enable checksum for IPA_ENDPOINT_AP_MODEM_{RX,TX} for
      v4.7
    - ppp: Fix KMSAN uninit-value warning with bpf
    - ethtool: linkstate: migrate linkstate functions to support multi-PHY
      setups
    - net: ethtool: plumb PHY stats to PHY drivers
    - net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device
    - vlan: enforce underlying device type
    - [x86] sgx: Fix size overflows in sgx_encl_create()
    - exfat: fix just enough dentries but allocate a new cluster to dir
    - exfat: fix soft lockup in exfat_clear_bitmap
    - exfat: short-circuit zero-byte writes in exfat_file_write_iter
    - net-timestamp: support TCP GSO case for a few missing flags
    - ublk: set_params: properly check if parameters can be applied
    - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
    - nvme-tcp: fix signedness bug in nvme_tcp_init_connection()
    - net: dsa: mt7530: Fix traffic flooding for MMIO devices
    - mctp i3c: handle NULL header address
    - net: ipv6: fix dst ref loop in ila lwtunnel
    - net: ipv6: fix missing dst ref drop in ila lwtunnel
    - [arm64] gpio: rcar: Fix missing of_node_put() call
    - Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
    - usb: renesas_usbhs: Call clk_put()
    - xhci: Restrict USB4 tunnel detection for USB3 devices to Intel hosts
    - usb: renesas_usbhs: Use devm_usb_get_phy()
    - usb: hub: lack of clearing xHC resources
    - usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card
      Reader
    - usb: typec: ucsi: Fix NULL pointer access
    - usb: renesas_usbhs: Flush the notify_hotplug_work
    - usb: gadget: u_ether: Set is_suspend flag if remote wakeup fails
    - usb: atm: cxacru: fix a flaw in existing endpoint checks
    - usb: dwc3: Set SUSPENDENABLE soon after phy init
    - usb: dwc3: gadget: Prevent irq storm when TH re-executes
    - usb: typec: ucsi: increase timeout for PPM reset operations
    - usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
    - usb: gadget: Set self-powered based on MaxPower and bmAttributes
    - usb: gadget: Fix setting self-powered state on suspend
    - usb: gadget: Check bmAttributes only if configuration is valid
    - acpi: typec: ucsi: Introduce a ->poll_cci method
    - xhci: pci: Fix indentation in the PCI device ID definitions
    - usb: xhci: Enable the TRB overfetch quirk on VIA VL805
    - [amd64] KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI
      shadow
    - [amd64] KVM: SVM: Save host DR masks on CPUs with DebugSwap
    - [amd64] KVM: SVM: Drop DEBUGCTL[5:2] from guest's effective value
    - [amd64] KVM: SVM: Suppress DEBUGCTL.BTF on AMD
    - [amd64] KVM: x86: Snapshot the host's DEBUGCTL in common x86
    - [amd64] KVM: SVM: Manually context switch DEBUGCTL if LBR virtualization
      is disabled
    - [amd64] KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs
    - [amd64] KVM: x86: Explicitly zero EAX and EBX when PERFMON_V2 isn't
      supported by KVM
    - cdx: Fix possible UAF error in driver_override_show()
    - mei: me: add panther lake P DID
    - mei: vsc: Use "wakeuphostint" when getting the host wakeup GPIO
    - [amd64] intel_th: pci: Add Arrow Lake support
    - [amd64] intel_th: pci: Add Panther Lake-H support
    - [amd64] intel_th: pci: Add Panther Lake-P/U support
    - char: misc: deallocate static minor in error path
    - drivers: core: fix device leak in __fw_devlink_relax_cycles()
    - slimbus: messaging: Free transaction ID in delayed interrupt scenario
    - bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid
      deadlock
    - eeprom: digsy_mtc: Make GPIO lookup table match the device
    - drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl
    - iio: filter: admv8818: Force initialization of SDO
    - iio: light: apds9306: fix max_scale_nano values
    - iio: dac: ad3552r: clear reset status flag
    - iio: adc: ad7192: fix channel select
    - iio: adc: at91-sama5d2_adc: fix sama7g5 realbits value
    - mm: hugetlb: Add huge page size param to huge_ptep_get_and_clear()
    - [arm64] hugetlb: Fix huge_ptep_get_and_clear() for non-present ptes
    - fs/netfs/read_pgpriv2: skip folio queues without `marks3`
      (Closes: #1098698, #1099591)
    - fs/netfs/read_collect: fix crash due to uninitialized `prev` variable
      (Closes: #1098698, #1099591)
    - ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage
    - nvme-tcp: Fix a C2HTermReq error message
    - Revert "KVM: e500: always restore irqs"
    - Revert "KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults"
    - Revert "KVM: PPC: e500: Mark "struct page" pfn accessed before dropping
      mmu_lock"
    - Revert "KVM: PPC: e500: Mark "struct page" dirty in
      kvmppc_e500_shadow_map()"
    - KVM: e500: always restore irqs
    - uprobes: Fix race in uprobe_free_utask
    - [x86] mm: Don't disable PCID when INVLPG has been fixed by microcode
    - wifi: iwlwifi: pcie: Fix TSO preparation

  [ Bastian Blank ]
  * Compress kernel with zstd where supported. (Closes: #1099722)

  [ Matt Mower ]
  * [amd64] sound/soc/amd/acp: Enable SND_AMD_ASOC_ACP70, SND_SOC_AMD_ACP_PCI
    and SND_SOC_AMD_LEGACY_MACH as modules (Closes: #1096006)

  [ Uwe Kleine-König ]
  * Enable IIO HRTIMER and SYSFS trigger. These are useful to do high-speed
    continuous and manual (or scripted) sensor reading respectively.

  [ Dmytro Sinina ]
  * sound/pci/hda: Enable SND_HDA_SCODEC_CS35L56_I2C,
    SND_HDA_SCODEC_CS35L56_SPI, SND_SOC_CS35L56_I2C, SND_SOC_CS35L56_SPI,
    SND_SOC_CS35L56_SDW as modules

  [ Steev Klimaszewski ]
  * [arm64] Enable modules for Thinkpad X13s webcam (Closes: #1100036)

  [ Salvatore Bonaccorso ]
  * drm/amdkfd: Fix user queue validation on Gfx7/8 (Closes: #1093124)
  * fs/netfs/read_collect: add to next->prev_donated
    (Closes: #1098698, #1099591)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 16 Mar 2025 22:08:59 +0100

linux (6.12.17-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.17
    - [arm64] mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings
    - drm/xe/oa: Separate batch submission from waiting for completion
    - drm/xe/oa/uapi: Define and parse OA sync properties
    - drm/xe/oa: Add input fence dependencies
    - xe/oa: Fix query mode of operation for OAR/OAC
    - btrfs: do not assume the full page range is not dirty in
      extent_writepage_io()
    - btrfs: move the delalloc range bitmap search into extent_io.c
    - btrfs: mark all dirty sectors as locked inside writepage_delalloc()
    - btrfs: remove unused btrfs_folio_start_writer_lock()
    - btrfs: unify to use writer locks for subpage locking
    - btrfs: rename btrfs_folio_(set|start|end)_writer_lock()
    - btrfs: use btrfs_inode in extent_writepage()
    - btrfs: fix double accounting race when btrfs_run_delalloc_range() failed
    - btrfs: fix double accounting race when extent_writepage_io() failed
    - [amd64] KVM: x86: Get vcpu->arch.apic_base directly and drop
      kvm_get_apic_base()
    - [amd64] KVM: x86: Inline kvm_get_apic_mode() in lapic.h
    - [amd64] KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o
      VID
    - drm/amd/display: Refactoring if and endif statements to enable DC_LOGGER
    - drm/amd/display: update dcn351 used clock offset
    - drm/amd/display: Correct register address in dcn35
    - Bluetooth: qca: Update firmware-name to support board specific nvm
    - Bluetooth: qca: Fix poor RF performance for WCN6855
    - Input: serio - define serio_pause_rx guard to pause and resume serio ports
    - Input: synaptics - fix crash when enabling pass-through port
      (CVE-2025-21746)
    - PCI: Make pcim_request_all_regions() a public function
    - PCI: Export pci_intx_unmanaged() and pcim_intx()
    - PCI: Remove devres from pci_intx()
    - PCI: Restore original INTX_DISABLE bit by pcim_intx()
    - [arm64] dts: mediatek: mt8183-pumpkin: add HDMI support
    - [arm64] dts: mediatek: mt8183: Disable DSI display output by default
    - [amd64] accel/ivpu: Limit FW version string length
    - [amd64] accel/ivpu: Add coredump support
    - [amd64] accel/ivpu: Add FW state dump on TDR
    - [amd64] accel/ivpu: Fix error handling in recovery/reset
    - drm/amdkfd: Move gfx12 trap handler to separate file
    - drm/amdkfd: Ensure consistent barrier state saved in gfx12 trap handler
    - tracing: Switch trace.c code over to use guard()
    - tracing: Have the error of __tracing_resize_ring_buffer() passed to user
    - USB: gadget: f_midi: f_midi_complete to call queue_work
    - sched_ext: Factor out move_task_between_dsqs() from
      scx_dispatch_from_dsq()
    - sched_ext: Fix migration disabled handling in targeted dispatches
    - [arm64] ASoC: rockchip: i2s-tdm: fix shift config for
      SND_SOC_DAIFMT_DSP_[AB]
    - [amd64] ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
    - [powerpc*] code-patching: Disable KASAN report during patching via
      temporary mm
    - [powerpc*] 64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline
    - ALSA: hda/realtek: Fixup ALC225 depop procedure
    - [powerpc*] code-patching: Fix KASAN hit by not flagging text patching area
      as VM_ALLOC
    - [arm64] ASoC: imx-audmix: remove cpu_mclk which is from cpu dai device
    - vsock/virtio: fix variables initialization during resuming
    - geneve: Fix use-after-free in geneve_find_dev().
    - ALSA: hda/cirrus: Correct the full scale volume set logic
    - net/sched: cls_api: fix error handling causing NULL dereference
    - ALSA: seq: Drop UMP events when no UMP-conversion is set
    - [s390x] ism: add release function for struct device
    - ibmvnic: Add stat for tx direct vs tx batched
    - ibmvnic: Don't reference skb after sending to VIOS
    - sockmap, vsock: For connectible sockets allow only connected
    - vsock/bpf: Warn on socket without transport
    - tcp: adjust rcvq_space after updating scaling ratio
    - net: pse-pd: Avoid setting max_uA in regulator constraints
    - net: pse-pd: Use power limit at driver side instead of current limit
    - net: pse-pd: pd692x0: Fix power limit retrieval
    - gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
    - geneve: Suppress list corruption splat in geneve_destroy_tunnels().
    - flow_dissector: Fix handling of mixed port and port-range keys
    - flow_dissector: Fix port range key handling in BPF conversion
    - net: Add non-RCU dev_getbyhwaddr() helper
    - arp: switch to dev_getbyhwaddr() in arp_req_set_public()
    - net: axienet: Set mac_managed_pm
    - tcp: drop secpath at the same time as we currently drop dst
    - net: allow small head cache usage with large MAX_SKB_FRAGS values
    - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
    - bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic
    - bpf: avoid holding freeze_mutex during mmap operation
    - strparser: Add read_sock callback
    - bpf: Fix wrong copied_seq calculation
    - bpf: Disable non stream socket for strparser
    - bpf: Fix deadlock when freeing cgroup storage
    - [arm64] dts: rockchip: Fix lcdpwr_en pin for Cool Pi GenBook
    - power: supply: da9150-fg: fix potential overflow
    - power: supply: axp20x_battery: Fix fault handling for AXP717
    - net: Add rx_skb of kfree_skb to raw_tp_null_args[].
    - bpf: Fix softlockup in arena_map_free on 64k page kernel
    - [arm64] dts: rockchip: adjust SMMU interrupt type on rk3588
    - [arm64] firmware: arm_scmi: imx: Correct tx size of scmi_imx_misc_ctrl_set
    - md/raid*: Fix the set_queue_limits implementations
    - nouveau/svm: fix missing folio unlock + put after
      make_device_exclusive_range()
    - [arm64] drm/msm: Avoid rounding up to one jiffy
    - [arm64] drm/msm/dpu: skip watchdog timer programming through TOP on >=
      SM8450
    - [arm64] drm/msm/dpu: enable DPU_WB_INPUT_CTRL for DPU 5.x
    - [arm64] drm/msm/dpu: Don't leak bits_per_component into random DSC_ENC
      fields
    - [arm64] drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG0 updated from driver side
    - [arm64] drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG1 against clock driver
    - [arm64] drm/msm/dsi/phy: Do not overwite PHY_CMN_CLK_CFG1 when choosing
      bitclk source
    - nvme: tcp: Fix compilation warning with W=1
    - nvme-tcp: fix connect failure on receiving partial ICResp PDU
    - nvme/ioctl: add missing space in err message
    - bpf: skip non exist keys in generic_map_lookup_batch
    - drm/nouveau/pmu: Fix gp10b firmware guard
    - irqchip/jcore-aic, clocksource/drivers/jcore: Fix jcore-pit interrupt
      request
    - drm: panel: jd9365da-h3: fix reset signal polarity
    - [arm64] drm/msm/dpu: Disable dither in phys encoder cleanup
    - [amd64] drm/i915: Make sure all planes in use by the joiner have their
      crtc included
    - [amd64] drm/i915/dp: Fix error handling during 128b/132b link training
    - [amd64] drm/i915/ddi: Fix HDMI port width programming in DDI_BUF_CTL
    - [amd64] drm/i915/gt: Use spin_lock_irqsave() in interruptible context
    - io_uring/rw: forbid multishot async reads
    - io_uring: prevent opcode speculation
    - gpiolib: protect gpio_chip with SRCU in array_info paths in multi get/set
    - [arm64] tee: optee: Fix supplicant wait loop
    - drop_monitor: fix incorrect initialization order
    - mm/migrate_device: don't add folio to be freed to LRU in
      migrate_device_finalize()
    - [arm64] dts: rockchip: Fix broken tsadc pinctrl names for rk3588
    - [arm64] dts: rockchip: Move uart5 pin configuration to px30 ringneck SoM
    - [arm64] dts: rockchip: Disable DMA for uart5 on px30-ringneck
    - [s390x] boot: Fix ESSA detection
    - xfs: fix online repair probing when CONFIG_XFS_ONLINE_REPAIR=n
    - lib/iov_iter: fix import_iovec_ubuf iovec management
    - smb: client: fix chmod(2) regression with ATTR_READONLY
    - nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
    - gve: set xdp redirect target only when it is available
    - ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()
    - [arm64] ASoC: fsl_micfil: Enable default case in micfil_set_quality()
    - ALSA: hda: Add error check for snd_ctl_rename_id() in
      snd_hda_create_dig_out_ctls()
    - ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
    - ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close
    - acct: perform last write from workqueue
    - acct: block access to kernel internal filesystems
    - mm,madvise,hugetlb: check for 0-length range after end address adjustment
    - mtd: spi-nor: sst: Fix SST write failure
    - [x86] perf/x86/intel: Fix event constraints for LNC
    - irqchip/gic-v3: Fix rk3399 workaround when secure interrupts are enabled
    - smb: client: Add check for next_buffer in receive_encrypted_standard()
    - EDAC/qcom: Correct interrupt enable register configuration
    - ftrace: Correct preemption accounting for function tracing.
    - ftrace: Fix accounting of adding subops to a manager ops
    - ftrace: Do not add duplicate entries in subops manager ops
    - tracing: Fix using ret variable in tracing_set_tracer()
    - net: pse-pd: Fix deadlock in current limit functions
    - sched_ext: Fix incorrect assumption about migration disabled tasks in
      task_can_run_on_remote_rq()
    - [arm64] dts: rockchip: change eth phy mode to rgmii-id for orangepi r1
      plus lts
    - drm/amdgpu/gfx9: manually control gfxoff for CS on RV
    - drm/amdgpu: bump version for RV/PCO compute fix

  [ Salvatore Bonaccorso ]
  * kbuild: Add Depends on pahole (Closes: #1098706)
  * [arm64] phy: rockchip: naneng-combphy: compatible reset with old DT
    (Closes: #1095745, #1098250, #1098354)
  * [amd64,arm64] drivers/net/ethernet/intel/idpf: Enable IDPF as module
    (Closes: #1099143, #1099144, #1099145, #1099146)
  * [amd64,arm64] drivers/iommu: Enable VIRTIO_IOMMU as module
    (Closes: #1099158)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 01 Mar 2025 17:57:27 +0100

linux (6.12.16-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.16
    - nfsd: clear acl_access/acl_default after releasing them
    - NFSD: fix hang in nfsd4_shutdown_callback
    - [x86] cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
    - HID: multitouch: Add NULL check in mt_input_configured
    - pinctrl: pinconf-generic: Print unsigned value if a format is registered
    - HID: hid-thrustmaster: fix stack-out-of-bounds read in
      usb_check_int_endpoints()
    - HID: hid-steam: Don't use cancel_delayed_work_sync in IRQ context
    - net: fib_rules: annotate data-races around rule->[io]ifindex
    - Documentation/networking: fix basic node example document ISO 15765-2
    - ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
    - vrf: use RCU protection in l3mdev_l3_out()
    - idpf: fix handling rsc packet with a single segment
    - idpf: record rx queue in skb for RSC packets
    - idpf: call set_real_num_queues in idpf_open
    - igc: Fix HW RX timestamp when passed by ZC XDP
    - vxlan: check vxlan_vnigroup_init() return value
    - [arm64] net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases
    - [arm64] net: ethernet: ti: am65_cpsw: fix tx_cleanup for XDP case
    - Bluetooth: btintel_pcie: Fix a potential race condition
    - team: better TEAM_OPTION_TYPE_STRING validation
    - workqueue: Put the pwq after detaching the rescuer from the pool
    - sched_ext: Fix lock imbalance in dispatch_to_local_dsq()
    - [arm64] cacheinfo: Avoid out-of-bounds write to cacheinfo array
    - [arm64,armhf] gpu: host1x: Fix a use of uninitialized mutex
    - cgroup: Remove steal time from usage_usec
    - [x86] perf/x86/intel: Clean up PEBS-via-PT on hybrid
    - drm/xe/client: bo->client does not need bos_lock
    - [amd64] drm/i915/selftests: avoid using uninitialized context
    - io_uring/waitid: don't abuse io_tw_state
    - io_uring/uring_cmd: remove dead req_has_async_data() check
    - amdkfd: properly free gang_ctx_bo when failed to init user queue
    - drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()
    - drm: Fix DSC BPP increment decoding
    - block: cleanup and fix batch completion adding conditions
    - sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h.
    - sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx
    - gpiolib: Fix crash on error in gpiochip_get_ngpios()
    - [amd64] iommu/amd: Expicitly enable CNTRL.EPHEn bit in resume path
    - tools: fix annoying "mkdir -p ..." logs when building tools in parallel
    - [arm64] firmware: qcom: scm: smc: Handle missing SCM device
    - [arm64,armhf] soc/tegra: fuse: Update Tegra234 nvmem keepout list
    - media: cxd2841er: fix 64-bit division on gcc-9
    - media: i2c: ds90ub913: Add error handling to ub913_hw_init()
    - media: i2c: ds90ub953: Add error handling for i2c reads/writes
    - media: bcm2835-unicam: Disable trigger mode operation
    - media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
    - media: uvcvideo: Add new quirk definition for the Sonix Technology Co.
      292a camera
    - media: uvcvideo: Add Kurokesu C1 PRO camera
    - media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
    - PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P
    - PCI: switchtec: Add Microchip PCI100X device IDs
    - scsi: ufs: bsg: Set bsg_queue to NULL after removal
    - rtla/timerlat_hist: Abort event processing on second signal
    - rtla/timerlat_top: Abort event processing on second signal
    - serial: 8250_pci: Resolve WCH vendor ID ambiguity
    - serial: 8250_pci: Share WCH IDs with parport_serial driver
    - 8250: microchip: pci1xxxx: Add workaround for RTS bit toggle
    - kunit: platform: Resolve 'struct completion' warning
    - vfio/pci: Enable iowrite64 and ioread64 for vfio pci
    - NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
    - vfio/nvgrace-gpu: Read dvsec register to determine need for uncached
      resmem
    - vfio/nvgrace-gpu: Expose the blackwell device PF BAR1 to the VM
    - fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode()
    - Grab mm lock before grabbing pt lock
    - [x86] ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet
      5V
    - [x86] mm/tlb: Only trim the mm_cpumask once a second
    - orangefs: fix a oob in orangefs_debug_write
    - kbuild: suppress stdout from merge_config for silent builds
    - [amd64] ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10
      tablet 5V
    - kbuild: Use -fzero-init-padding-bits=all
    - batman-adv: fix panic during interface removal
    - batman-adv: Ignore neighbor throughput metrics in error case
    - batman-adv: Drop unmanaged ELP metric worker
    - drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
    - [x86] KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't
      in-kernel
    - [x86] KVM: x86: Load DR6 with guest value only before entering .vcpu_run()
      loop
    - [x86] KVM: nSVM: Enter guest mode before initializing nested NPT MMU
    - [x86] perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF
    - [x86] perf/x86/intel: Ensure LBRs are disabled when a CPU is starting
    - ring-buffer: Unlock resize on mmap error
    - tracing: Do not allow mmap() of persistent ring buffer
    - ring-buffer: Validate the persistent meta data subbuf array
    - ring-buffer: Update pages_touched to reflect persistent buffer content
    - usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI bind
      retries
    - usb: dwc3: Fix timeout issue during controller enter/exit from halt state
    - usb: roles: set switch registered flag early on
    - usb: gadget: udc: renesas_usb3: Fix compiler warning
    - usb: dwc2: gadget: remove of_node reference upon udc_stop
    - usb: xhci: Restore xhci_pci support for Renesas HCs
    - USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
    - usb: core: fix pipe creation for get_bMaxPacketSize0
    - USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
    - usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
    - USB: hub: Ignore non-compliant devices with too many configs or interfaces
    - USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
    - usb: cdc-acm: Check control transfer buffer size before access
    - usb: cdc-acm: Fix handling of oversized fragments
    - usb: gadget: core: flush gadget workqueue after device removal
    - USB: serial: option: add MeiG Smart SLM828
    - USB: serial: option: add Telit Cinterion FN990B compositions
    - USB: serial: option: fix Telit Cinterion FN990A name
    - USB: serial: option: drop MeiG Smart defines
    - can: ctucanfd: handle skb allocation failure
    - can: c_can: fix unbalanced runtime PM disable in error path
    - can: j1939: j1939_sk_send_loop(): fix unable to send messages with data
      length zero
    - can: etas_es58x: fix potential NULL pointer dereference on udev->serial
    - [alpha] make stack 16-byte aligned (most cases)
    - wifi: ath12k: fix handling of 6 GHz rules
    - PCI: Avoid FLR for Mediatek MT7922 WiFi
    - kbuild: userprogs: fix bitsize and target detection on clang
    - efi: Avoid cold plugged memory for placing the kernel
    - [arm64] rust: clean Rust 1.85.0 warning using softfloat target
    - cgroup: fix race between fork and cgroup.kill
    - serial: port: Assign ->iotype correctly when ->iobase is set
    - serial: port: Always update ->iotype in __uart_read_properties()
    - serial: 8250: Fix fifo underflow on flush
    - alpha: replace hardcoded stack offsets with autogenerated ones
    - alpha: align stack for page fault and user unaligned trap handlers
    - [s390x] pci: Pull search for parent PF out of zpci_iov_setup_virtfn()
    - [s390x] pci: Fix handling of isolated VFs
    - gpiolib: acpi: Add a quirk for Acer Nitro ANV14
    - gpio: stmpe: Check return value of stmpe_reg_read in
      stmpe_gpio_irq_sync_unlock
    - partitions: mac: fix handling of bogus partition table
    - sched_ext: Fix incorrect autogroup migration detection
    - regulator: qcom_smd: Add l2, l5 sub-node to mp5496 regulator
    - [amd64] iommu: Fix potential memory leak in iopf_queue_remove_device()
    - regmap-irq: Add missing kfree()
    - [arm64] Handle .ARM.attributes section in linker scripts
    - mmc: mtk-sd: Fix register settings for hs400(es) mode
    - igc: Set buffer type for empty frames in igc_init_empty_frame
    - cifs: pick channels for individual subrequests
    - btrfs: fix hole expansion when writing at an offset beyond EOF
    - include: net: add static inline dst_dev_overhead() to dst.h
    - net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue
    - net: ipv6: seg6_iptunnel: mitigate 2-realloc issue
    - net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
    - net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels
    - clocksource: Use pr_info() for "Checking clocksource synchronization"
      message
    - clocksource: Use migrate_disable() to avoid calling get_random_u32() in
      atomic context
    - scsi: ufs: core: Introduce ufshcd_has_pending_tasks()
    - scsi: ufs: core: Prepare to introduce a new clock_gating lock
    - scsi: ufs: core: Introduce a new clock_gating lock
    - scsi: ufs: Fix toggling of clk_gating.state when clock gating is not
      allowed
    - [amd64] cpufreq/amd-pstate: Call cppc_set_epp_perf in the reenable
      function
    - [amd64] cpufreq/amd-pstate: Align offline flow of shared memory and MSR
      based systems
    - [amd64] cpufreq/amd-pstate: Refactor amd_pstate_epp_reenable() and
      amd_pstate_epp_offline()
    - [amd64] cpufreq/amd-pstate: Remove the cppc_state check in offline/online
      functions
    - [amd64] cpufreq/amd-pstate: Merge amd_pstate_epp_cpu_offline() and
      amd_pstate_epp_offline()
    - [amd64] cpufreq/amd-pstate: convert mutex use to guard()
    - [amd64] cpufreq/amd-pstate: Fix cpufreq_policy ref counting
    - ipv4: add RCU protection to ip4_dst_hoplimit()
    - ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
    - net: add dev_net_rcu() helper
    - ipv4: use RCU protection in ipv4_default_advmss()
    - ipv4: use RCU protection in rt_is_expired()
    - ipv4: use RCU protection in inet_select_addr()
    - net: ipv4: Cache pmtu for all packet paths if multipath enabled
    - ipv4: use RCU protection in __ip_rt_update_pmtu()
    - ipv4: icmp: convert to dev_net_rcu()
    - flow_dissector: use RCU protection to fetch dev_net()
    - ipv6: use RCU protection in ip6_default_advmss()
    - ipv6: icmp: convert to dev_net_rcu()
    - HID: hid-steam: Make sure rumble work is canceled on removal
    - HID: hid-steam: Move hidraw input (un)registering to work
    - ndisc: use RCU protection in ndisc_alloc_skb()
    - neighbour: use RCU protection in __neigh_notify()
    - arp: use RCU protection in arp_xmit()
    - openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
    - ndisc: extend RCU protection in ndisc_send_skb()
    - ipv6: mcast: extend RCU protection in igmp6_send()
    - btrfs: rename __get_extent_map() and pass btrfs_inode
    - btrfs: fix stale page cache after race between readahead and direct IO
      write
    - ipv6: mcast: add RCU protection to mld_newpack()
    - [arm64] drm/tidss: Fix issue in irq handling causing irq-flood issue
    - [arm64] drm/tidss: Fix race condition while handling interrupt registers
    - [arm64] drm/tidss: Clear the interrupt status for interrupts being
      disabled
    - [arm64] drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()
    - [arm64] drm/msm/dpu: fix x1e80100 intf_6 underrun/vsync interrupt
    - [arm64] drm/msm/dpu1: don't choke on disabling the writeback connector
    - [arm64] drm/v3d: Stop active perfmon if it is being destroyed
    - drm/xe/tracing: Fix a potential TP_printk UAF
    - drm: renesas: rz-du: Increase supported resolutions
    - netdevsim: print human readable IP address
    - [x86] static-call: Remove early_boot_irqs_disabled check to fix Xen PVH
      dom0
    - bpf: handle implicit declaration of function gettid in bpf_iter.c
    - wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit
    - cpufreq/amd-pstate: Remove the goto label in amd_pstate_update_limits
    - net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels
    - scsi: ufs: core: Ensure clk_gating.lock is used only after initialization
    - io_uring/kbuf: reallocate buf lists on upgrade
    - vsock: Keep the binding until socket destruction
    - vsock: Orphan socket after transport release
    - Revert "vfio/platform: check the bounds of read/write syscalls"

  [ Marcin Juszkiewicz ]
  * [arm64] Enable SND_SOC_RT5616 for FriendlyElec NanoPC-T6.

  [ Bastian Blank ]
  * Support BTF id generation for external modules:
    - Install resolve_btfid tool. (closes: #1093655)
    - Copy base BTF ids into headers package.

  [ Salvatore Bonaccorso ]
  * sound/pci/hda: Set SND_HDA_POWER_SAVE_DEFAULT value to 10 (Closes: #1094755)
  * [x86] drivers/misc/mei: Enable INTEL_MEI_GSC_PROXY as module
    (Closes: #1096058)
  * drivers/usb/gadget/legacy: Enable USB_MASS_STORAGE as module
    (Closes: #962708)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 22 Feb 2025 08:49:24 +0100

linux (6.12.15-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.14
    - btrfs: fix assertion failure when splitting ordered extent after
      transaction abort
    - btrfs: do not output error message if a qgroup has been already cleaned up
    - btrfs: fix use-after-free when attempting to join an aborted transaction
    - [arm64] mm: Ensure adequate HUGE_MAX_HSTATE
    - exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case
    - [s390x] stackleak: Use exrl instead of ex in __stackleak_poison()
    - btrfs: fix data race when accessing the inode's disk_i_size at
      btrfs_drop_extents()
    - btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
    - sched: Don't try to catch up excess steal time.
    - [x86] Convert unreachable() to BUG()
    - locking/ww_mutex/test: Use swap() macro
    - lockdep: Fix upper limit for LOCKDEP_*_BITS configs
    - [x86] amd_nb: Restrict init function to AMD-based systems
    - drm/virtio: New fence for every plane update
    - drm: Add panel backlight quirks
    - drm: panel-backlight-quirks: Add Framework 13 matte panel
    - drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels
    - nvkm/gsp: correctly advance the read pointer of GSP message queue
    - nvkm: correctly calculate the available space of the GSP cmdq buffer
    - drm/amd/display: Populate chroma prefetch parameters, DET buffer fix
    - drm/amd/display: Overwriting dualDPP UBF values before usage
    - printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
    - drm/connector: add mutex to protect ELD from concurrent access
    - [arm64] drm/bridge: anx7625: use eld_mutex to protect access to
      connector->eld
    - drm/amd/display: use eld_mutex to protect access to connector->eld
    - [armhf] drm/exynos: hdmi: use eld_mutex to protect access to
      connector->eld
    - drm/radeon: use eld_mutex to protect access to connector->eld
    - [arm*] drm/vc4: hdmi: use eld_mutex to protect access to connector->eld
    - drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor
    - drm/amdgpu: Don't enable sdma 4.4.5 CTXEMPTY interrupt
    - drm/amdkfd: Queue interrupt work to different CPU
    - [arm64] drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT
    - [arm64] drm/bridge: it6505: fix HDCP Bstatus check
    - [arm64] drm/bridge: it6505: fix HDCP encryption when R0 ready
    - [arm64] drm/bridge: it6505: fix HDCP CTS compare V matching
    - [arm64] drm/bridge: it6505: fix HDCP CTS KSV list wait timer
    - safesetid: check size of policy writes
    - drm/amd/display: Increase sanitizer frame larger than limit when compile
      testing with clang
    - drm/amd/display: Limit Scaling Ratio on DCN3.01
    - ring-buffer: Make reading page consistent with the code logic
    - wifi: rtw89: add crystal_cap check to avoid setting as overflow value
    - tun: fix group permission check
    - mmc: core: Respect quirk_max_rate for non-UHS SDIO card
    - mmc: sdhci-esdhc-imx: enable 'SDHCI_QUIRK_NO_LED' quirk for S32G
    - wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
    - tomoyo: don't emit warning in tomoyo_write_control()
    - mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
    - wifi: rtw88: add __packed attribute to efuse layout struct
    - clk: qcom: Make GCC_8150 depend on QCOM_GDSC
    - HID: multitouch: Add quirk for Hantick 5288 touchpad
    - HID: Wacom: Add PCI Wacom device support
    - net/mlx5: use do_aux_work for PHC overflow checks
    - wifi: brcmfmac: Check the return value of of_property_read_string_index()
    - wifi: iwlwifi: pcie: Add support for new device ids
    - wifi: iwlwifi: avoid memory leak
    - i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
    - APEI: GHES: Have GHES honor the panic= setting
    - Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922
    - Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925
    - Bluetooth: MGMT: Fix slab-use-after-free Read in
      mgmt_remove_adv_monitor_sync
    - net: wwan: iosm: Fix hibernation by re-binding the driver around it
    - HID: hid-asus: Disable OOBE mode on the ProArt P16
    - mmc: sdhci-msm: Correctly set the load for the regulator
    - tipc: re-order conditions in tipc_crypto_key_rcv()
    - net: ethernet: ti: am65-cpsw: ensure proper channel cleanup in error path
    - [x86] ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
    - [x86] kexec: Allocate PGD for x86_64 transition page tables separately
    - [x86] ASoC: Intel: sof_sdw: Correct quirk for Lenovo Yoga Slim 7
    - [arm64] iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible
    - [arm64] iommu/arm-smmu-v3: Clean up more on probe failure
    - [x86] platform/x86: int3472: Check for adev == NULL
    - [x86] platform/x86: acer-wmi: Add support for Acer PH14-51
    - ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
    - [x86] platform/x86: acer-wmi: Add support for Acer Predator PH16-72
    - [amd64] ASoC: amd: Add ACPI dependency to fix build error
    - Input: allocate keycode for phone linking
    - [x86] platform/x86: acer-wmi: add support for Acer Nitro AN515-58
    - [x86] platform/x86: acer-wmi: Ignore AC events
    - [powerpc*] KVM: PPC: e500: Mark "struct page" dirty in
      kvmppc_e500_shadow_map()
    - [powerpc*] KVM: PPC: e500: Mark "struct page" pfn accessed before dropping
      mmu_lock
    - [powerpc*] KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults
    - [powerpc*] KVM: e500: always restore irqs
    - drm/amdgpu: Fix Circular Locking Dependency in AMDGPU GFX Isolation
    - xfs: report realtime block quota limits on realtime directories
    - xfs: don't over-report free space or inodes in statvfs
    - tty: xilinx_uartps: split sysrq handling
    - tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN
    - [x86] platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL
    - sched/fair: Fix inaccurate h_nr_runnable accounting with delayed dequeue
    - nvme: handle connectivity loss in nvme_set_queue_count
    - firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
    - gpu: drm_dp_cec: fix broken CEC adapter properties check
    - ice: put Rx buffers after being done with current frame
    - ice: gather page_count()'s of each frag right before XDP prog call
    - ice: stop storing XDP verdict within ice_rx_buf
    - nvme: make nvme_tls_attrs_group static
    - nvme-fc: use ctrl state getter
    - net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN
    - ice: Add check for devm_kzalloc()
    - vmxnet3: Fix tx queue race condition with XDP
    - tg3: Disable tg3 PCIe AER on system reboot
    - udp: gso: do not drop small packets when PMTU reduces
    - [amd64] drm/i915/dp: fix the Adaptive sync Operation mode for SDP
    - ethtool: rss: fix hiding unsupported fields in dumps
    - rxrpc: Fix the rxrpc_connection attend queue handling
    - gpio: pca953x: Improve interrupt support
    - net: atlantic: fix warning during hot unplug
    - net: rose: lock the socket in rose_bind()
    - gpio: sim: lock hog configfs items if present
    - [x86] xen: fix xen_hypercall_hvm() to not clobber %rbx (Closes: #1095435)
    - [x86] xen: add FRAME_END to xen_hypercall_hvm()
    - ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read()
    - pfifo_tail_enqueue: Drop new packet when sch->limit == 0
    - netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
    - tun: revert fix group permission check
    - net: sched: Fix truncation of offloaded action statistics
    - rxrpc: Fix call state set to not include the SERVER_SECURING state
    - cpufreq: fix using cpufreq-dt as module
    - cpufreq: s3c64xx: Fix compilation warning
    - leds: lp8860: Write full EEPROM, not only half of it
    - ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx
    - cifs: Remove intermediate object of failed create SFU call
    - drm/modeset: Handle tiled displays in pan_display_atomic.
    - drm/client: Handle tiled displays better
    - smb: client: fix order of arguments of tracepoints
    - smb: client: change lease epoch type from unsigned int to __u16
    - md: reintroduce md-linear
    - [s390x] futex: Fix FUTEX_OP_ANDN implementation
    - [arm64] Filter out SVE hwcaps when FEAT_SVE isn't implemented
    - fs/proc: do_task_stat: Fix ESP not readable during coredump
    - binfmt_flat: Fix integer overflow bug on 32 bit systems
    - accel/ivpu: Fix Qemu crash when running in passthrough
    - [arm64] kvm: Configure HYP TCR.PS/DS based on host stage1
    - [arm64] mm: Override PARange for !LPA2 and use it consistently
    - [arm64] sme: Move storage of reg_smidr to __cpuinfo_store_cpu()
    - [arm64] mm: Reduce PA space to 48 bits when LPA2 is not enabled
    - [arm64] KVM: arm64: timer: Always evaluate the need for a soft timer
    - [arm64] drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event()
    - [arm64] dts: rockchip: increase gmac rx_delay on rk3399-puma
    - remoteproc: omap: Handle ARM dma_iommu_mapping
    - KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
    - kvm: defer huge page recovery vhost task to later
    - [s390x] KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
    - ksmbd: fix integer overflows on 32 bit systems
    - drm/amd/display: Optimize cursor position updates
    - drm/amd/pm: Mark MM activity as unsupported
    - drm/amd/amdgpu: change the config of cgcg on gfx12
    - drm/amdkfd: only flush the validate MES contex
    - drm/amdkfd: Block per-queue reset when halt_if_hws_hang=1
    - Revert "drm/amd/display: Use HW lock mgr for PSR1"
    - [amd64] drm/i915/guc: Debug print LRC state entries only if the context is
      pinned
    - [amd64] drm/i915: Fix page cleanup on DMA remap failure
    - drm/xe/devcoredump: Move exec queue snapshot to Contexts section
    - [amd64] drm/i915/dp: Iterate DSC BPP from high to low on all platforms
    - [amd64] drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes
    - drm/amdgpu: add a BO metadata flag to disable write compression for Vulkan
    - drm/amd/display: Fix seamless boot sequence
    - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
    - Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection
    - KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y
    - [arm64] clk: sunxi-ng: a100: enable MMC clock reparenting
    - [armhf] clk: mmp2: call pm_genpd_init() only after genpd.name is set
    - media: i2c: ds90ub960: Fix UB9702 refclk register access
    - [arm64] clk: qcom: clk-alpha-pll: fix alpha mode configuration
    - [arm64] clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during
      gdsc_disable()
    - [arm64] clk: qcom: gcc-sm8650: Do not turn off PCIe GDSCs during
      gdsc_disable()
    - [arm64] clk: qcom: gcc-sm6350: Add missing parent_map for two clocks
    - [arm64] clk: qcom: dispcc-sm6350: Add missing parent_map for a clock
    - [arm64] clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg
    - [arm64] clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
    - seccomp: passthrough uretprobe systemcall without filtering
    - blk-cgroup: Fix class @block_class's subsystem refcount leakage
    - efi: libstub: Use '-std=gnu11' to fix build with GCC 15
    - perf bench: Fix undefined behavior in cmpworker()
    - scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions
    - of: Correct child specifier used as input of the 2nd nexus node
    - of: address: Fix empty resource handling in __of_address_resource_bounds()
    - of: Fix of_find_node_opts_by_path() handling of alias+path+options
    - of: reserved-memory: Fix using wrong number of cells to get property
      'alignment'
    - Input: bbnsm_pwrkey - add remove hook
    - HID: hid-sensor-hub: don't use stale platform-data on remove
    - ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg()
    - atomic64: Use arch_spin_locks instead of raw_spin_locks
    - wifi: rtlwifi: rtl8821ae: Fix media status report
    - wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
    - wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH
    - wifi: rtw88: sdio: Fix disconnection after beacon loss
    - wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916
    - wifi: rtw88: 8703b: Fix RX/TX issues
    - usb: gadget: f_tcm: Translate error to sense
    - usb: gadget: f_tcm: Decrement command ref count on cleanup
    - usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
    - usb: gadget: f_tcm: Don't prepare BOT write request twice
    - usbnet: ipheth: fix possible overflow in DPE length check
    - usbnet: ipheth: use static NDP16 location in URB
    - usbnet: ipheth: check that DPE points past NCM header
    - usbnet: ipheth: refactor NCM datagram loop
    - usbnet: ipheth: break up NCM header size computation
    - usbnet: ipheth: fix DPE OoB read
    - usbnet: ipheth: document scope of NCM implementation
    - [arm64] dts: qcom: x1e80100-asus-vivobook-s15: Fix USB QMP PHY supplies
    - [arm64] dts: qcom: x1e80100-qcp: Fix USB QMP PHY supplies
    - [arm64] dts: qcom: x1e78100-lenovo-thinkpad-t14s: Fix USB QMP PHY supplies
    - [arm64] dts: qcom: x1e80100-crd: Fix USB QMP PHY supplies
    - [arm64] dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix USB QMP PHY supplies
    - [arm64] dts: qcom: x1e80100-microsoft-romulus: Fix USB QMP PHY supplies
    - [arm64] dts: qcom: x1e80100: Fix usb_2 controller interrupts
    - ASoC: acp: Support microphone from Lenovo Go S
    - [arm64] soc: qcom: socinfo: Avoid out of bounds read of serial number
    - serial: sh-sci: Drop __initdata macro for port_cfg
    - serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is
      in use
    - [powerpc*] pseries/eeh: Fix get PE state translation
    - dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit()
    - dm-crypt: track tag_offset in convert_context
    - mips/math-emu: fix emulation of the prefx instruction (Closes: #1091858)
    - [mips*] pci-legacy: Override pci_address_to_pio
    - Revert "MIPS: csrc-r4k: Select HAVE_UNSTABLE_SCHED_CLOCK if SMP && 64BIT"
    - block: don't revert iter for -EIOCBQUEUED
    - Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
    - [arm64] firmware: qcom: scm: Fix missing read barrier in
      qcom_scm_is_available()
    - [arm64] firmware: qcom: scm: Fix missing read barrier in
      qcom_scm_get_tzmem_pool()
    - ALSA: hda/realtek: Enable headset mic on Positivo C6400
    - ALSA: hda/realtek: Fix quirk matching for Legion Pro 7
    - ALSA: hda: Fix headset detection failure due to unstable sort
    - [arm64] tegra: Fix Tegra234 PCIe interrupt-map
    - [s390x] pci: Fix SR-IOV for PFs initially in standby
    - PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
    - PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf()
    - PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()
    - PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
    - nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk
    - nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk
    - [x86] KVM: x86/mmu: Ensure NX huge page recovery thread is alive before
      waking
    - scsi: st: Don't set pos_unknown just after device recognition
    - scsi: qla2xxx: Move FCE Trace buffer allocation to user control
    - scsi: ufs: qcom: Fix crypto key eviction
    - scsi: ufs: core: Fix use-after free in init error and remove paths
    - scsi: storvsc: Set correct data length for sending SCSI command without
      payload
    - scsi: core: Do not retry I/Os during depopulation
    - kbuild: Move -Wenum-enum-conversion to W=2
    - [x86] acpi: Fix LAPIC/x2APIC parsing order
    - [x86] boot: Use '-std=gnu11' to fix build with GCC 15
    - ubi: Add a check for ubi_num
    - [arm64] dts: mediatek: mt8183: Disable DPI display output by default
    - [arm64] dts: qcom: sdx75: Fix MPSS memory length
    - [arm64] dts: qcom: x1e80100: Fix ADSP memory base and length
    - [arm64] dts: qcom: x1e80100: Fix CDSP memory length
    - [arm64] dts: qcom: sm6115: Fix MPSS memory length
    - [arm64] dts: qcom: sm6115: Fix CDSP memory length
    - [arm64] dts: qcom: sm6115: Fix ADSP memory base and length
    - [arm64] dts: qcom: sm6350: Fix ADSP memory length
    - [arm64] dts: qcom: sm6350: Fix MPSS memory length
    - [arm64] dts: qcom: sm6350: Fix uart1 interconnect path
    - [arm64] dts: qcom: sm6375: Fix ADSP memory length
    - [arm64] dts: qcom: sm6375: Fix CDSP memory base and length
    - [arm64] dts: qcom: sm6375: Fix MPSS memory base and length
    - [arm64] dts: qcom: sm8350: Fix ADSP memory base and length
    - [arm64] dts: qcom: sm8350: Fix CDSP memory base and length
    - [arm64] dts: qcom: sm8350: Fix MPSS memory length
    - [arm64] dts: qcom: sm8450: Fix ADSP memory base and length
    - [arm64] dts: qcom: sm8450: Fix CDSP memory length
    - [arm64] dts: qcom: sm8450: Fix MPSS memory length
    - [arm64] dts: qcom: sm8550: Fix ADSP memory base and length
    - [arm64] dts: qcom: sm8550: Fix CDSP memory length
    - [arm64] dts: qcom: sm8550: Fix MPSS memory length
    - [arm64] dts: qcom: sm8650: Fix ADSP memory base and length
    - [arm64] dts: qcom: sm8650: Fix CDSP memory length
    - [arm64] dts: qcom: sm8650: Fix MPSS memory length
    - [arm64] dts: qcom: sm8550: correct MDSS interconnects
    - [arm64] dts: qcom: sm8650: correct MDSS interconnects
    - crypto: qce - fix priority to be less than ARMv8 CE
    - [arm64] tegra: Fix typo in Tegra234 dce-fabric compatible
    - [arm64] tegra: Disable Tegra234 sce-fabric node
    - pwm: microchip-core: fix incorrect comparison with max period
    - xfs: don't call remap_verify_area with sb write protection held
    - xfs: Propagate errors from xfs_reflink_cancel_cow_range in
      xfs_dax_write_iomap_end
    - xfs: Add error handling for xfs_reflink_cancel_cow_range
    - accel/ivpu: Clear runtime_error after pm_runtime_resume_and_get() fails
    - ACPI: PRM: Remove unnecessary strict handler address checks
    - tpm: Change to kvalloc() in eventlog/acpi.c
    - rv: Reset per-task monitors also for idle tasks
    - hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
    - iommufd: Fix struct iommu_hwpt_pgfault init and padding
    - kfence: skip __GFP_THISNODE allocations on NUMA systems
    - media: ccs: Clean up parsed CCS static data on parse failure
    - mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
    - iio: light: as73211: fix channel handling in only-color triggered buffer
    - iommufd/fault: Destroy response and mutex in iommufd_fault_destroy()
    - iommufd/fault: Use a separate spinlock to protect fault->deliver list
    - [arm64,armhf] soc: samsung: exynos-pmu: Fix uninitialized ret in
      tensor_set_bits_atomic()
    - [arm64] soc: mediatek: mtk-devapc: Fix leaking IO map on error paths
    - [arm64] soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove
    - [arm64] soc: qcom: llcc: Enable LLCC_WRCACHE at boot on X1
    - [arm64] soc: qcom: smem_state: fix missing of_node_put in error path
    - media: mmp: Bring back registration of the device
    - media: mc: fix endpoint iteration
    - media: nuvoton: Fix an error check in npcm_video_ece_init()
    - media: imx296: Add standby delay during probe
    - media: intel/ipu6: remove cpu latency qos request on error
    - media: ov5640: fix get_light_freq on auto
    - media: stm32: dcmipp: correct dma_set_mask_and_coherent mask value
    - media: ccs: Fix CCS static data parsing for large block sizes
    - media: ccs: Fix cleanup order in ccs_probe()
    - media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
    - media: i2c: ds90ub960: Fix use of non-existing registers on UB9702
    - media: i2c: ds90ub960: Fix UB9702 VC map
    - media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702
    - media: uvcvideo: Fix crash during unbind if gpio unit is in use
    - media: uvcvideo: Fix event flags in uvc_ctrl_send_events
    - media: uvcvideo: Support partial control reads
    - media: uvcvideo: Only save async fh if success
    - media: uvcvideo: Remove redundant NULL assignment
    - media: uvcvideo: Remove dangling pointers
    - mm: kmemleak: fix upper boundary check for physical address objects
    - mm: gup: fix infinite loop within __get_longterm_locked
    - mm/vmscan: accumulate nr_demoted for accurate demotion statistics
    - mm/hugetlb: fix hugepage allocation for interleaved memory nodes
    - mm/compaction: fix UBSAN shift-out-of-bounds warning
    - ata: libata-sff: Ensure that we cannot write outside the allocated buffer
    - irqchip/irq-mvebu-icu: Fix access to msi_data from irq_domain::host_data
    - crypto: qce - fix goto jump in error path
    - crypto: qce - unregister previously registered algos in error path
    - ceph: fix memory leak in ceph_mds_auth_match()
    - nvmem: qcom-spmi-sdam: Set size in struct nvmem_config
    - nvmem: core: improve range check for nvmem_cell_write()
    - nvmem: imx-ocotp-ele: simplify read beyond device check
    - nvmem: imx-ocotp-ele: fix MAC address byte order
    - nvmem: imx-ocotp-ele: fix reading from non zero offset
    - nvmem: imx-ocotp-ele: set word length to 1
    - io_uring: fix multishots with selected buffers
    - io_uring/net: don't retry connect operation on EPOLLERR
    - vfio/platform: check the bounds of read/write syscalls
    - pnfs/flexfiles: retry getting layout segment for reads
    - ocfs2: fix incorrect CPU endianness conversion causing mount failure
    - ocfs2: handle a symlink read error correctly
    - nilfs2: fix possible int overflows in nilfs_fiemap()
    - nfs: Make NFS_FSCACHE select NETFS_SUPPORT instead of depending on it
    - NFSD: Encode COMPOUND operation status on page boundaries
    - NFC: nci: Add bounds checking in nci_hci_create_pipe()
    - fgraph: Fix set_graph_notrace with setting TRACE_GRAPH_NOTRACE_BIT
    - i3c: master: Fix missing 'ret' assignment in set_speed()
    - irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so
    - mtd: onenand: Fix uninitialized retlen in do_otp_read()
    - misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors
    - misc: fastrpc: Deregister device nodes properly in error scenarios
    - misc: fastrpc: Fix registered buffer page address
    - misc: fastrpc: Fix copy buffer page size
    - net/ncsi: wait for the last response to Deselect Package before
      configuring channel
    - net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset
    - maple_tree: simplify split calculation
    - scripts/gdb: fix aarch64 userspace detection in get_current_task
    - tracing/osnoise: Fix resetting of tracepoints
    - rtla/osnoise: Distinguish missing workload option
    - rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads
    - rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads
    - rtla: Add trace_instance_stop
    - rtla/timerlat_hist: Stop timerlat tracer on signal
    - rtla/timerlat_top: Stop timerlat tracer on signal
    - pinctrl: samsung: fix fwnode refcount cleanup if
      platform_get_irq_optional() fails
    - pinctrl: renesas: rzg2l: Fix PFC_MASK for RZ/V2H and RZ/G3E
    - ptp: Ensure info->enable callback is always set
    - RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
    - rtc: zynqmp: Fix optional clock name property
    - timers/migration: Fix off-by-one root mis-connection
    - [s390x] fpu: Add fpc exception handler / remove fixup section again
    - [mips*] ftrace: Declare ftrace_get_parent_ra_addr() as static
    - xfs: avoid nested calls to __xfs_trans_commit
    - xfs: don't lose solo superblock counter update transactions
    - xfs: separate dquot buffer reads from xfs_dqflush
    - xfs: clean up log item accesses in xfs_qm_dqflush{,_done}
    - xfs: attach dquot buffer to dquot log item buffer
    - xfs: convert quotacheck to attach dquot buffers
    - xfs: release the dquot buf outside of qli_lock
    - xfs: lock dquot buffer before detaching dquot from b_li_list
    - xfs: fix mount hang during primary superblock recovery failure
    - spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families
    - spi: atmel-qspi: Memory barriers after memory-mapped I/O
    - Revert "btrfs: avoid monopolizing a core when activating a swap file"
    - btrfs: avoid monopolizing a core when activating a swap file
    - mptcp: prevent excessive coalescing on receive
    - [x86] mm: Convert unreachable() to BUG()
    - md/md-linear: Fix a NULL vs IS_ERR() bug in linear_add()
    - md: Fix linear_set_limits()
    - Revert "drm/amd/display: Fix green screen issue after suspend"
    - drm/xe: Fix and re-enable xe_print_blob_ascii85()
    - fs: prepend statmount.mnt_opts string with security_sb_mnt_opts()
    - fs: fix adding security options to statmount.mnt_opt
    - statmount: let unset strings be empty
    - [arm64] dts: rockchip: add reset-names for combphy on rk3568
    - ocfs2: check dir i_size in ocfs2_find_entry
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.15
    - xfs: don't lose solo dquot update transactions

  [ Sebastian Siewior ]
  * Enable RCU_LAZY to not wake up the CPU for RCU callbacks

  [ Yoann Congal ]
  * [arm64/rt] Re-enable KVM

  [ Salvatore Bonaccorso ]
  * [mips*] Increase RELOCATION_TABLE_SIZE to 0x00280000 (fixes FTBFS)
  * nfsd: validate the nfsd_serv pointer before calling svc_wake_up
    (Closes: #1093734)
  * [x86] xen: allow larger contiguous memory regions in PV guests
    (Closes: #1093371, #1088159, #1087807)
  * xen/swiotlb: relax alignment requirements
    (Closes: #1093371, #1088159, #1087807)
  * USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
    (Closes: #1091517)

  [ Bastian Blank ]
  * [amd64, arm64] Enable NITRO_ENCLAVES, NSM. (closes: #1095647)
  * Support zstd for firmware loader, enable FW_LOADER_COMPRESS_ZSTD

  [ Luca Boccassi ]
  * linux-bpf-dev: mark as MA: same

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 18 Feb 2025 15:00:46 +0100

linux (6.12.13-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.13
    - coredump: Do not lock during 'comm' reporting
    - [powerpc*] book3s64/hugetlb: Fix disabling hugetlb when fadump is active
    - dlm: fix removal of rsb struct that is master and dir record
    - dlm: fix srcu_read_lock() return type to int
    - afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY
    - afs: Fix directory format encoding struct
    - afs: Fix cleanup of immediately failed async calls
    - fs: fix proc_handler for sysctl_nr_open
    - block: copy back bounce buffer to user-space correctly in case of split
    - block: retry call probe after request_module in blk_request_module
    - ps3disk: Do not use dev->bounce_size before it is set
    - nbd: don't allow reconnect after disconnect
    - pstore/blk: trivial typo fixes
    - block: check BLK_FEAT_POLL under q_usage_count
    - block: don't update BLK_FEAT_POLL in __blk_mq_update_nr_hw_queues
    - nvme-tcp: Fix I/O queue cpu spreading for multiple controllers
    - nvme: Add error check for xa_store in nvme_get_effects_log
    - [powerpc*] pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
    - nvme: Add error path for xa_store in nvme_init_effects
    - btrfs: improve the warning and error message for btrfs_remove_qgroup()
    - partitions: ldm: remove the initial kernel-doc notation
    - btrfs: subpage: fix the bitmap dump of the locked flags
    - select: Fix unbalanced user_access_end()
    - nvme: fix bogus kzalloc() return check in nvme_init_effects_log()
    - afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call
    - perf/core: Save raw sample data conditionally based on sample type
    - sched/fair: Untangle NEXT_BUDDY and pick_next_task()
    - sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat
    - sched: Fix race between yield_to() and try_to_wake_up()
    - [x86] cpu: Enable SD_ASYM_PACKING for PKG domain on AMD
    - [x86] topology: Use x86_sched_itmt_flags for PKG domain unconditionally
    - sched: Split out __schedule() deactivate task logic into a helper
    - sched: psi: pass enqueue/dequeue flags to psi callbacks directly
    - psi: Fix race when task wakes up before psi_sched_switch() adjusts flags
    - [arm64] drm/v3d: Fix performance counter source settings on V3D 7.x
    - [arm64] drm/rockchip: vop2: fix rk3588 dp+dsi maxclk verification
    - [arm64] drm/msm/dp: set safe_to_exit_level before printing it
    - [arm64] drm/msm/hdmi: simplify code in pll_get_integloop_gain
    - [arm64,armhf] drm/etnaviv: Fix page property being used for non
      writecombine buffers
    - HID: core: Fix assumption that Resolution Multipliers must be in Logical
      Collections
    - drm/amd/pm: Fix an error handling path in
      vega10_enable_se_edc_force_stall_config()
    - drm/amdgpu: Fix potential NULL pointer dereference in
      atomctrl_get_smc_sclk_range_table
    - [arm64] drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters
      offset
    - [arm64] drm/rockchip: vop2: Fix the mixer alpha setup for layer 0
    - [arm64] drm/panthor: Preserve the result returned by panthor_fw_resume()
    - [arm64] drm/rockchip: vop2: Fix the windows switch between different
      layers
    - printk: Defer legacy printing when holding printk_cpu_sync
    - drm/connector: Allow clearing HDMI infoframes
    - [arm64] drm/rockchip: vop2: Set AXI id for rk3588
    - [arm64] drm/rockchip: vop2: Setup delay cycle for Esmart2/3
    - [arm64] drm/rockchip: vop2: Check linear format for Cluster windows on
      rk3566/8
    - [arm64] drm/rockchip: vop2: Add check for 32 bpp format for rk3588
    - [arm64] drm/rockchip: vop2: include rockchip_drm_drv.h
    - drm/amdgpu/vcn: reset fw_shared under SRIOV
    - OPP: add index check to assert to avoid buffer overflow in _read_freq()
    - OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized
    - [arm64] drm/msm/dpu: provide DSPP and correct LM config for SDM670
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on SM8150
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on SM8250
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on SM8350
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on SM8550
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on SM8650
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on X1E80100
    - [arm64] drm/msm: Check return value of of_dma_configure()
    - [arm64] drm/msm: don't clean up priv->kms prematurely
    - [arm64] drm/msm/mdp4: correct LCDC regulator name
    - drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE
    - drm/amdgpu: tear down ttm range manager for doorbell in amdgpu_ttm_fini()
    - Revert "drm/amdgpu/gfx9: put queue resets behind a debug option"
    - drm/amdgpu: fix gpu recovery disable with per queue reset
    - genirq: Make handle_enforce_irqctx() unconditionally available
    - ipmi: ipmb: Add check devm_kasprintf() returned value
    - wifi: ath11k: Fix unexpected return buffer manager error for
      WCN6750/WCN6855
    - wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix infinite loop
    - wifi: rtlwifi: do not complete firmware loading needlessly
    - wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step
    - wifi: rtlwifi: wait for firmware loading before releasing memory
    - wifi: rtlwifi: fix init_sw_vars leak when probe fails
    - wifi: rtlwifi: usb: fix workqueue leak when probe fails
    - wifi: wcn36xx: fix channel survey memory allocation size
    - clk: renesas: cpg-mssr: Fix 'soc' node handling in
      cpg_mssr_reserved_init()
    - wifi: cfg80211: tests: Fix potential NULL dereference in
      test_cfg80211_parse_colocated_ap()
    - net_sched: sch_sfq: handle bigger packets
    - net_sched: sch_sfq: don't allow 1 packet limit
    - spi: zynq-qspi: Add check for clk_enable()
    - rxrpc: Fix handling of received connection abort
    - dt-bindings: mmc: controller: clarify the address-cells description
    - clk: fix an OF node reference leak in of_clk_get_parent_name()
    - dt-bindings: leds: class-multicolor: Fix path to color definitions
    - wifi: rtlwifi: remove unused check_buddy_priv
    - wifi: rtlwifi: destroy workqueue at rtl_deinit_core
    - wifi: rtlwifi: fix memory leaks and invalid access at probe error path
    - wifi: rtlwifi: pci: wait for firmware loading before releasing memory
    - HID: multitouch: fix support for Goodix PID 0x01e9
    - regulator: dt-bindings: mt6315: Drop regulator-compatible property
    - wifi: brcmfmac: add missing header include for brcmf_dbg
    - module: Convert default symbol namespace to string literal
    - hwmon: (nct6775): Actually make use of the HWMON_NCT6775 symbol namespace
    - ACPI: fan: cleanup resources in the error path of .probe()
    - cpupower: fix TSC MHz calculation
    - dt-bindings: mfd: bd71815: Fix rsense and typos
    - leds: netxbig: Fix an OF node reference leak in
      netxbig_leds_get_of_pdata()
    - inetpeer: remove create argument of inet_getpeer_v[46]()
    - inetpeer: remove create argument of inet_getpeer()
    - inetpeer: update inetpeer timestamp in inet_getpeer()
    - inetpeer: do not get a refcount in inet_getpeer()
    - pwm: stm32-lp: Add check for clk_enable()
    - cpufreq: schedutil: Fix superfluous updates caused by need_freq_update
    - ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
    - net: airoha: Fix error path in airoha_probe()
    - gpio: pca953x: log an error when failing to get the reset GPIO
    - [arm64] cpufreq: qcom: Fix qcom_cpufreq_hw_recalc_rate() to query LUT if
      LMh IRQ is not available
    - [arm64] cpufreq: qcom: Implement clk_ops::determine_rate() for
      qcom_cpufreq* clocks
    - udp: Deal with race between UDP socket address change and rehash
    - clk: imx8mp: Fix clkout1/2 support
    - dt-bindings: clock: imx93: Drop IMX93_CLK_END macro definition
    - dt-bindings: clock: Add i.MX91 clock support
    - dt-bindings: clock: imx93: Add SPDIF IPG clk
    - clk: imx93: Move IMX93_CLK_END macro to clk driver
    - clk: imx: add i.MX91 clk
    - clk: imx93: Add IMX93_CLK_SPDIF_IPG clock
    - [arm64] dts: imx93: Use IMX93_CLK_SPDIF_IPG as SPDIF IPG clock
    - clk: imx: Apply some clks only for i.MX93
    - [arm64] clk: qcom: camcc-x1e80100: Set titan_top_gdsc as the parent GDSC
      of subordinate GDSCs
    - team: prevent adding a device which is already a team device lower
    - dt-bindings: clock: sunxi: Export PLL_VIDEO_2X and PLL_MIPI
    - clk: sunxi-ng: a64: drop redundant CLK_PLL_VIDEO0_2X and CLK_PLL_MIPI
    - clk: sunxi-ng: a64: stop force-selecting PLL-MIPI as TCON0 parent
    - regulator: of: Implement the unwind path of of_regulator_match()
    - ax25: rcu protect dev->ax25_ptr
    - net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset
    - OPP: OF: Fix an OF node leak in _opp_add_static_v2()
    - ipmi: ssif_bmc: Fix new request loss when bmc ready for a response
    - wifi: ath12k: fix tx power, max reg power update to firmware
    - clk: qcom: gcc-sdm845: Do not use shared clk_ops for QUPs
    - HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding
      endpoint check
    - HID: fix generic desktop D-Pad controls
    - leds: cht-wcove: Use devm_led_classdev_register() to avoid memory leak
    - mfd: syscon: Fix race in device_node_get_regmap()
    - wifi: mt76: mt7996: fix invalid interface combinations
    - wifi: wlcore: fix unbalanced pm_runtime calls
    - wifi: rtw89: handle entity active flag per PHY
    - wifi: rtw89: chan: manage active interfaces
    - wifi: rtw89: tweak setting of channel and TX power for MLO
    - wifi: rtw89: fix proceeding MCC with wrong scanning state after sequence
      changes
    - wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles()
    - wifi: rtw89: avoid to init mgnt_entry list twice when WoWLAN failed
    - wifi: rtw89: mcc: consider time limits not divisible by 1024
    - wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion
    - hwmon: Fix help text for aspeed-g6-pwm-tach
    - wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
    - wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC
    - wifi: iwlwifi: fw: read STEP table from correct UEFI var
    - wifi: iwlwifi: mvm: avoid NULL pointer dereference
    - wifi: iwlwifi: mvm: don't count mgmt frames as MPDU
    - wifi: mac80211: prohibit deactivating all links
    - wifi: cfg80211: Move cfg80211_scan_req_add_chan() n_channels increment
      earlier
    - wifi: mac80211: fix tid removal during mesh forwarding
    - wifi: mac80211: Fix common size calculation for ML element
    - wifi: mac80211: don't flush non-uploaded STAs
    - clk: ralink: mtmips: remove duplicated 'xtal' clock for Ralink SoC RT3883
    - clk: thead: Fix clk gate registration to pass flags
    - clk: thead: Add CLK_IGNORE_UNUSED to fix TH1520 boot
    - clk: thead: Fix cpu2vp_clk for TH1520 AP_SUBSYS clocks
    - net/smc: fix data error when recvmsg with MSG_PEEK flag
    - landlock: Handle weird files
    - wifi: mt76: mt76u_vendor_request: Do not print error messages when -EPROTO
    - wifi: mt76: mt7921: fix using incorrect group cipher after disconnection.
    - wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface()
    - wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
    - wifi: mt76: mt7925: fix wrong band_idx setting when enable sniffer mode
    - wifi: mt76: mt7925: fix get wrong chip cap from incorrect pointer
    - wifi: mt76: mt7925: fix the invalid ip address for arp offload
    - wifi: mt76: mt7996: fix overflows seen when writing limit attributes
    - wifi: mt76: mt7915: fix overflows seen when writing limit attributes
    - wifi: mt76: connac: Extend mt76_connac_mcu_uni_add_dev for MLO
    - wifi: mt76: mt7925: Fix incorrect MLD address in bss_mld_tlv for MLO
      support
    - wifi: mt76: mt7925: Fix incorrect WCID assignment for MLO
    - wifi: mt76: mt7925: Fix incorrect WCID phy_idx assignment
    - wifi: mt76: mt7925: fix wrong parameter for related cmd of chan info
    - wifi: mt76: mt7925: Fix CNM Timeout with Single Active Link in MLO
    - wifi: mt76: mt7925: Enhance mt7925_mac_link_bss_add to support MLO
    - wifi: mt76: Enhance mt7925_mac_link_sta_add to support MLO
    - wifi: mt76: mt7925: Update mt7925_mcu_sta_update for BC in ASSOC state
    - wifi: mt76: mt7925: Update mt792x_rx_get_wcid for per-link STA
    - wifi: mt76: mt7925: Update mt7925_unassign_vif_chanctx for per-link BSS
    - wifi: mt76: mt7925: Update secondary link PS flow
    - wifi: mt76: mt7925: Init secondary link PM state
    - wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO
    - wifi: mt76: mt7925: Cleanup MLO settings post-disconnection
    - wifi: mt76: mt7925: Properly handle responses for commands with events
    - wifi: mt76: mt7996: fix rx filter setting for bfee functionality
    - wifi: mt76: only enable tx worker after setting the channel
    - wifi: mt76: mt7915: firmware restart on devices with a second pcie link
    - wifi: mt76: mt7915: fix omac index assignment after hardware reset
    - wifi: mt76: mt7915: fix register mapping
    - wifi: mt76: mt7996: fix register mapping
    - wifi: mt76: mt7996: add max mpdu len capability
    - wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU
    - wifi: mt76: mt7996: fix HE Phy capability
    - wifi: mt76: mt7996: fix incorrect indexing of MIB FW event
    - wifi: mt76: mt7996: fix definition of tx descriptor
    - wifi: mt76: mt7996: fix ldpc setting
    - i2c: designware: Actually make use of the I2C_DW_COMMON and I2C_DW symbol
      namespaces
    - cpufreq: ACPI: Fix max-frequency computation
    - wifi: cfg80211: adjust allocation of colocated AP data
    - Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
    - Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
    - inet: ipmr: fix data-races
    - clk: analogbits: Fix incorrect calculation of vco rate delta
    - dev: Acquire netdev_rename_lock before restoring dev->name in
      dev_change_name().
    - pwm: stm32: Add check for clk_enable()
    - net: let net.core.dev_weight always be non-zero
    - octeon_ep: remove firmware stats fetch in ndo_get_stats64
    - octeon_ep_vf: remove firmware stats fetch in ndo_get_stats64
    - net: avoid race between device unregistration and ethnl ops
    - net: sched: Disallow replacing of child qdisc from one parent to another
    - netfilter: nf_tables: fix set size with rbtree backend
    - netfilter: nft_flow_offload: update tcp state flags under lock
    - net: sched: refine software bypass handling in tc_run
    - net: ethernet: ti: am65-cpsw: fix freeing IRQ in
      am65_cpsw_nuss_remove_tx_chns()
    - tcp_cubic: fix incorrect HyStart round start detection
    - net/rose: prevent integer overflows in rose_setsockopt()
    - platform/mellanox: mlxbf-pmc: incorrect type in assignment
    - [x86] platform/x86: x86-android-tablets: make platform data be static
    - pinctrl: samsung: Fix irq handling if an error occurs in
      exynos_irq_demux_eint16_31()
    - libbpf: don't adjust USDT semaphore address if .stapsdt.base addr is
      missing
    - ASoC: cs40l50: Use *-y for Makefile
    - ASoC: mediatek: mt8365: Use *-y for Makefile
    - ASoC: wcd937x: Use *-y for Makefile
    - [x86] ASoC: Intel: sof_sdw: correct mach_params->dmic_num
    - ASoC: sun4i-spdif: Add clock multiplier settings
    - [arm64] iommu/arm-smmuv3: Update comments about ATS and bypass
    - crypto: tegra - do not transfer req when tegra init fails
    - crypto: api - Fix boot-up self-test race
    - crypto: caam - use JobR's space to access page 0 regs
    - perf header: Fix one memory leakage in process_bpf_btf()
    - perf header: Fix one memory leakage in process_bpf_prog_info()
    - perf bpf: Fix two memory leakages when calling
      perf_env__insert_bpf_prog_info()
    - ASoC: renesas: rz-ssi: Use only the proper amount of dividers
    - perf expr: Initialize is_test value in expr__ctx_new()
    - pinctrl: nomadik: Add check for clk_enable()
    - bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT
    - rhashtable: Fix potential deadlock by moving schedule_work outside lock
    - crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto()
    - crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to
      'async'
    - bpf: Use refcount_t instead of atomic_t for mmap_count
    - ALSA: seq: Make dependency on UMP clearer
    - bpf: Reject struct_ops registration that uses module ptr and the module
      btf_id is missing
    - padata: fix sysfs store callback check
    - perf top: Don't complain about lack of vmlinux when not resolving some
      kernel samples
    - perf maps: Fix display of kernel symbols
    - perf machine: Don't ignore _etext when not a text symbol
    - perf namespaces: Introduce nsinfo__set_in_pidns()
    - perf namespaces: Fixup the nsinfo__in_pidns() return type, its bool
    - [x86] ASoC: Intel: avs: Do not readq() u32 registers
    - [x86] ASoC: Intel: avs: Fix the minimum firmware version numbers
    - [x86] ASoC: Intel: avs: Fix theoretical infinite loop
    - [x86] ASoC: Intel: avs: Fix init-config parsing
    - perf MANIFEST: Add arch/*/include/uapi/asm/bpf_perf_event.h to the perf
      tarball
    - ALSA: hda: Fix compilation of snd_hdac_adsp_xxx() helpers
    - perf report: Fix misleading help message about --demangle
    - pinctrl: stm32: Add check for clk_enable()
    - pinctrl: amd: Take suspend type into consideration which pins are non-wake
    - perf inject: Fix use without initialization of local variables
    - [x86] ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83LC
    - [x86] ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83JX, 83MC and 83NM
    - bpf: Send signals asynchronously if !preemptible
    - libbpf: Fix return zero when elf_begin failed
    - libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED
    - bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write
    - [amd64] iommu/amd: Remove unused amd_iommu_domain_update()
    - ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire A115-31
      laptop
    - tools: Sync if_xdp.h uapi tooling header
    - perf lock: Fix parse_lock_type which only retrieve one lock flag
    - padata: fix UAF in padata_reorder
    - padata: add pd get/put refcnt helper
    - padata: avoid UAF for reorder_work
    - rhashtable: Fix rhashtable_try_insert test
    - smb: client: fix oops due to unset link speed
    - cifs: Use cifs_autodisable_serverino() for disabling
      CIFS_MOUNT_SERVER_INUM in readdir.c
    - bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT
    - soc: atmel: fix device_node release in atmel_soc_device_init()
    - [arm64] dts: mediatek: mt8186: Move wakeup to MTU3 to get working suspend
    - [arm64] dts: mt8183: set DMIC one-wire mode on Damu
    - [arm64] dts: mediatek: mt8516: fix GICv2 range
    - [arm64] dts: mediatek: mt8516: fix wdt irq type
    - [arm64] dts: mediatek: mt8516: add i2c clock-div property
    - [arm64] dts: mediatek: mt8516: reserve 192 KiB for TF-A
    - RDMA/mlx4: Avoid false error about access to uninitialized gids array
    - [arm64] dts: renesas: rzg3s-smarc: Fix the debug serial alias
    - rdma/cxgb4: Prevent potential integer overflow on 32bit
    - [arm64] dts: mediatek: mt8173-evb: Drop regulator-compatible property
    - [arm64] dts: mediatek: mt8173-elm: Drop regulator-compatible property
    - [arm64] dts: mediatek: mt8192-asurada: Drop regulator-compatible property
    - [arm64] dts: mediatek: mt8195-cherry: Drop regulator-compatible property
    - [arm64] dts: mediatek: mt8195-demo: Drop regulator-compatible property
    - [arm64] dts: medaitek: mt8395-nio-12l: Drop regulator-compatible property
    - [arm64] dts: mediatek: mt8395-genio-1200-evk: Drop regulator-compatible
      property
    - [arm64] dts: mediatek: mt8173-elm: Fix MT6397 PMIC sub-node names
    - [arm64] dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
    - [armhf] dts: aspeed: yosemite4: correct the compatible string of adm1272
    - [armhf] dts: aspeed: yosemite4: Add required properties for IOE on fan
      boards
    - [armhf] dts: aspeed: yosemite4: correct the compatible string for max31790
    - RDMA/rxe: Fix mismatched max_msg_sz
    - [arm64] dts: mediatek: mt8183: kenzo: Support second source touchscreen
    - [arm64] dts: mediatek: mt8183: willow: Support second source touchscreen
    - RDMA/srp: Fix error handling in srp_add_port
    - [arm64] dts: mediatek: mt8195: Remove suspend-breaking reset from pcie1
    - memory: tegra20-emc: fix an OF node reference bug in
      tegra_emc_find_node_by_ram_code()
    - [arm64] dts: mediatek: mt8183-kukui-jacuzzi: Drop pp3300_panel voltage
      settings
    - [arm64] dts: qcom: msm8996-xiaomi-gemini: Fix LP5562 LED1 reg property
    - [arm64] dts: qcom: sa8775p: Update sleep_clk frequency
    - [arm64] defconfig: remove obsolete CONFIG_SM_DISPCC_8650
    - [arm64] dts: qcom: msm8996: Fix up USB3 interrupts
    - [arm64] dts: qcom: msm8994: Describe USB interrupts
    - [arm64] dts: qcom: sm7225-fairphone-fp4: Drop extra qcom,msm-id value
    - [arm64] dts: qcom: msm8916: correct sleep clock frequency
    - [arm64] dts: qcom: msm8939: correct sleep clock frequency
    - [arm64] dts: qcom: msm8994: correct sleep clock frequency
    - [arm64] dts: qcom: qcs404: correct sleep clock frequency
    - [arm64] dts: qcom: q[dr]u1000: correct sleep clock frequency
    - [arm64] dts: qcom: qrb4210-rb2: correct sleep clock frequency
    - [arm64] dts: qcom: sc7280: correct sleep clock frequency
    - [arm64] dts: qcom: sdx75: correct sleep clock frequency
    - [arm64] dts: qcom: sm4450: correct sleep clock frequency
    - [arm64] dts: qcom: sm6125: correct sleep clock frequency
    - [arm64] dts: qcom: sm6375: correct sleep clock frequency
    - [arm64] dts: qcom: sm8250: correct sleep clock frequency
    - [arm64] dts: qcom: sm8350: correct sleep clock frequency
    - [arm64] dts: qcom: sm8450: correct sleep clock frequency
    - [arm64] dts: qcom: sm8550: correct sleep clock frequency
    - [arm64] dts: qcom: sm8650: correct sleep clock frequency
    - [arm64] dts: qcom: x1e80100: correct sleep clock frequency
    - [arm64] dts: qcom: sm8650: Fix CDSP context banks unit addresses
    - [arm64] dts: ti: k3-am62: Remove duplicate GICR reg
    - [arm64] dts: ti: k3-am62a: Remove duplicate GICR reg
    - [arm64] dts: rockchip: Fix sdmmc access on rk3308-rock-s0 v1.1 boards
    - [arm64] dts: allwinner: a64: explicitly assign clock parent for TCON0
    - RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error
    - RDMA/rtrs: Add missing deinit() call
    - [arm64] RDMA/hns: Clean up the legacy CONFIG_INFINIBAND_HNS
    - [arm64] dts: qcom: qcm6490-shift-otter: remove invalid orientation-switch
    - [arm64] dts: qcom: sdm845-db845c-navigation-mezzanine: Convert mezzanine
      riser to dtso
    - [arm64] dts: qcom: sdm845-db845c-navigation-mezzanine: remove disabled
      ov7251 camera
    - [arm64] dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply
    - [arm64] dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone
    - [arm64] dts: qcom: sc7180: change labels to lower-case
    - [arm64] dts: qcom: sc7180: fix psci power domain node names
    - [arm64] dts: qcom: sm8150-microsoft-surface-duo: fix typos in da7280
      properties
    - [arm64] dts: qcom: sc8280xp: Fix up remoteproc register space sizes
    - [arm64] firmware: qcom: scm: Cleanup global '__scm' on probe failures
    - [arm64] dts: mediatek: mt7988: Add missing clock-div property for i2c
    - [arm64] dts: arm64: mediatek: mt8195: Remove MT8183 compatible for OVL
    - [arm64] dts: mediatek: add per-SoC compatibles for keypad nodes
    - [arm64] dts: qcom: sc8280xp: Fix interrupt type of camss interrupts
    - [arm64] dts: qcom: sdm845: Fix interrupt types of camss interrupts
    - [arm64] dts: qcom: sm8250: Fix interrupt types of camss interrupts
    - [arm64] dts: marvell: cn9131-cf-solidwan: fix cp1 comphy links
    - [arm64] dts: rockchip: fix num-channels property of wolfvision pf5 mic
    - [arm64] dts: ti: k3-am642-hummingboard-t: Convert overlay to board dts
    - fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
    - [arm64] tegra: Fix DMA ID for SPI2
    - [arm64] dts: qcom: x1e80100-romulus: Update firmware nodes
    - i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition
    - RDMA/mlx5: Fix indirect mkey ODP page count
    - of: property: Avoiding using uninitialized variable @imaplen in
      parse_interrupt_map()
    - of: reserved-memory: Do not make kmemleak ignore freed address
    - efi: sysfb_efi: fix W=1 warnings when EFI is not set
    - RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event
    - RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"
    - [amd64] iommu: iommufd: fix WARNING in iommufd_device_unbind
    - [amd64] iommufd/iova_bitmap: Fix shift-out-of-bounds in
      iova_bitmap_offset_to_index()
    - spi: omap2-mcspi: Correctly handle devm_clk_get_optional() errors
    - of: reserved_mem: Restructure how the reserved memory regions are
      processed
    - of/fdt: Restore possibility to use both ACPI and FDT from bootloader
    - media: rc: iguanair: handle timeouts
    - media: lmedm04: Handle errors for lme2510_int_read
    - PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
    - remoteproc: mtk_scp: Only populate devices for SCP cores
    - media: marvell: Add check for clk_enable()
    - media: i2c: imx290: Register 0x3011 varies between imx327 and imx290
    - media: i2c: imx412: Add missing newline to prints
    - media: i2c: ov9282: Correct the exposure offset
    - media: mipi-csis: Add check for clk_enable()
    - media: camif-core: Add check for clk_enable()
    - media: uvcvideo: Propagate buf->error to userspace
    - mtd: rawnand: brcmnand: fix status read of brcmnand_waitfunc
    - mtd: hyperbus: hbmc-am654: fix an OF node reference leak
    - media: nxp: imx8-isi: fix v4l2-compliance test errors
    - watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe()
    - staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
    - media: dvb-usb-v2: af9035: fix ISO C90 compilation error on
      af9035_i2c_master_xfer
    - PCI: rcar-ep: Fix incorrect variable used when calling
      devm_request_mem_region()
    - PCI: imx6: Configure PHY based on Root Complex or Endpoint mode
    - PCI: imx6: Skip controller_id generation logic for i.MX7D
    - PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset()
    - PCI: imx6: Add missing reference clock disable logic
    - PCI: qcom: Update ICC and OPP values after Link Up event
    - PCI: dwc: Always stop link in the dw_pcie_suspend_noirq
    - PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error
    - PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test
    - PCI: microchip: Add support for using either Root Port 1 or 2
    - PCI: microchip: Set inbound address translation for coherent or
      non-coherent mode
    - scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
    - scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
    - scsi: mpi3mr: Fix possible crash when setting up bsg fails
    - firewire: test: Fix potential null dereference in firewire kunit test
    - erofs: get rid of erofs_{find,insert}_workgroup
    - erofs: move erofs_workgroup operations into zdata.c
    - erofs: sunset `struct erofs_workgroup`
    - erofs: fix potential return value overflow of z_erofs_shrink_scan()
    - ocfs2: mark dquot as inactive if failed to start trans while releasing
      dquot
    - nilfs2: do not force clear folio if buffer is referenced
    - nilfs2: protect access to buffers with no active references
    - nilfs2: handle errors that nilfs_prepare_chunk() may return
    - module: Extend the preempt disabled section in
      dereference_symbol_descriptor().
    - module: Don't fail module loading when setting ro_after_init section RO
      failed
    - driver core: class: Fix wild pointer dereferences in API
      class_dev_iter_next()
    - tty: mips_ejtag_fdc: fix one more u8 warning
    - serial: 8250: Adjust the timeout for FIFO mode
    - nfs: fix incorrect error handling in LOCALIO
    - NFSv4.2: fix COPY_NOTIFY xdr buf size calculation
    - NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE
    - xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO
    - xfrm: Add support for per cpu xfrm state handling.
    - xfrm: Cache used outbound xfrm states at the policy.
    - xfrm: Add an inbound percpu state cache.
    - xfrm: state: fix out-of-bounds read during lookup
    - dmaengine: ti: edma: fix OF node reference leaks in edma_driver
    - xfrm: delete intermediate secpath entry in packet offload mode
    - rtc: tps6594: Fix integer overflow on 32bit systems
    - rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
    - rtc: loongson: clear TOY_MATCH0_REG in loongson_rtc_isr()
    - ubifs: skip dumping tnc tree when zroot is null
    - regulator: core: Add missing newline character
    - net: airoha: Fix wrong GDM4 register definition
    - [arm64] net: hns3: fix oops when unload drivers paralleling
    - gpio: mxc: remove dead code after switch to DT-only
    - net: phy: marvell-88q2xxx: Fix temperature measurement with reset-gpios
    - net: fec: implement TSO descriptor cleanup
    - ipmr: do not call mr_mfc_uses_dev() for unres entries
    - PM: hibernate: Add error handling for syscore_suspend()
    - perf trace: Fix BPF loading failure (-E2BIG)
    - xfrm: Don't disable preemption while looking up cache state.
    - idpf: add read memory barrier when checking descriptor done bit
    - idpf: fix transaction timeouts on reset
    - idpf: Acquire the lock before accessing the xn->salt
    - idpf: convert workqueues to unbound
    - ice: fix ice_parser_rt::bst_key array size
    - ice: rework of dump serdes equalizer values feature
    - ice: extend dump serdes equalizer values feature
    - ice: remove invalid parameter of equalizer
    - iavf: allow changing VLAN state without calling PF
    - [s390x] mm: Allow large pages for KASAN shadow mapping
    - net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling
    - net: rose: fix timer races against user threads
    - net: netdevsim: try to close UDP port harness races
    - tools: ynl: c: correct reverse decode of empty attrs
    - rxrpc, afs: Fix peer hash locking vs RCU callback
    - vxlan: Fix uninit-value in vxlan_vnifilter_dump()
    - net: davicom: fix UAF in dm9000_drv_remove
    - ptp: Properly handle compat ioctls
    - net: ethtool: only allow set_rxnfc with rss + ring_cookie if driver opts
      in
    - ethtool: Fix set RXNFC command with symmetric RSS hash
    - net: stmmac: Limit the number of MTL queues to hardware capability
    - net: stmmac: Limit FIFO size by hardware capability
    - [s390x] sclp: Initialize sclp subsystem via arch_cpu_finalize_init()
    - perf trace: Fix runtime error of index out of bounds
    - perf test: Skip syscall enum test if no landlock syscall
    - Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()
    - Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming
    - vsock: Allow retrying on connect() failure
    - bgmac: reduce max frame size to support just MTU 1500
    - tcp: correct handling of extreme memory squeeze
    - net: xdp: Disallow attaching device-bound programs in generic mode
    - net: ravb: Fix missing rtnl lock in suspend/resume path
    - net: sh_eth: Fix missing rtnl lock in suspend/resume path
    - net: hsr: fix fill_frame_info() regression vs VLAN packets
    - genksyms: fix memory leak when the same symbol is added from source
    - genksyms: fix memory leak when the same symbol is read from *.symref file
    - hostfs: fix string handling in __dentry_name()
    - [riscv64] Mark riscv_v_init() as __init
    - ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback
    - io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock()
    - ASoC: amd: acp: Fix possible deadlock
    - tools/power turbostat: Fix forked child affinity regression
    - cifs: Validate EAs for WSL reparse points
    - cifs: Fix getting and setting SACLs over SMB1
    - kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST
    - kconfig: fix memory leak in sym_warn_unmet_dep()
    - f2fs: Introduce linear search for dentries
    - md/md-bitmap: factor behind write counters out from
      bitmap_{start/end}write()
    - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite()
    - md: add a new callback pers->bitmap_sector()
    - md/raid5: implement pers->bitmap_sector()
    - md/md-bitmap: move bitmap_{start, end}write to md upper layer
    - Revert "SUNRPC: Reduce thread wake-up rate when receiving large RPC
      messages"
    - netfilter: nf_tables: reject mismatching sum of field_len with set key
      length
    - drm/amd/display: Reduce accessing remote DPCD overhead
    - xfs: check for dead buffers in xfs_buf_find_insert
    - xfs: don't shut down the filesystem for media failures beyond end of log
    - ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro
    - net: usb: rtl8150: enable basic endpoint checking
    - usb: xhci: Fix NULL pointer dereference on certain command aborts
    - drivers/card_reader/rtsx_usb: Restore interrupt based detection
    - usb: gadget: f_tcm: Fix Get/SetInterface return value
    - usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk()
    - usb: dwc3: core: Defer the probe until USB power supply ready
    - usb: dwc3: Skip resume if pm_runtime_set_active() fails
    - usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to
      PD_T_SENDER_RESPONSE
    - usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR
      PPS
    - clk: qcom: gcc-x1e80100: Do not turn off usb_2 controller GDSC
    - mptcp: consolidate suboption status
    - mptcp: pm: only set fullmesh for subflow endp
    - mptcp: handle fastopen disconnect correctly
    - mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted
    - RDMA/mlx5: Fix implicit ODP use after free
    - remoteproc: core: Fix ida_free call while not allocated
    - media: uvcvideo: Fix double free in error path
    - pps: Fix a use-after-free
    - usb: gadget: f_tcm: Don't free command immediately
    - staging: media: max96712: fix kernel oops when removing module
    - media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
    - [powerpc*] pseries/iommu: Don't unset window if it was never set
    - md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
    - btrfs: output the reason for open_ctree() failure
    - of: reserved-memory: Warn for missing static reserved memory regions
    - dma-mapping: save base/size instead of pointer to shared DMA pool
    - xfrm: Add error handling when nla_put_u32() returns an error
    - xfrm: Fix acquire state insertion.
    - ethtool: Fix access to uninitialized fields in set RXNFC command
    - Revert "s390/mm: Allow large pages for KASAN shadow mapping"
    - ASoC: da7213: Initialize the mutex
    - [s390x] Add '-std=gnu11' to decompressor and purgatory CFLAGS
    - drm/amd/display: Add hubp cache reset when powergating
    - [x86] KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
    - memcg: fix soft lockup in the OOM process
    - btrfs: do proper folio cleanup when run_delalloc_nocow() failed
    - ethtool: ntuple: fix rss + ring_cookie check

  [ Emanuele Rocca ]
  * [amd64, arm64] Add pmem modules to amd64 and arm64 kernel-image udeb
    to support UEFI HTTP boot (or u-boot) in debian-installer

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 09 Feb 2025 10:19:08 +0100

linux (6.12.12-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.12
    - [amd64,arm64] ASoC: codecs: es8316: Fix HW rate calculation for 48Mhz MCLK
    - [amd64] ASoC: cs42l43: Add codec force suspend/resume ops
    - scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS
      request
    - drm/amd/display: Use HW lock mgr for PSR1
    - drm/amd/display: Initialize denominator defaults to 1
    - ALSA: hda/realtek: Fix volume adjustment issue on Lenovo ThinkBook 16P
      Gen5
    - drm/connector: hdmi: Validate supported_formats matches ycbcr_420_allowed
    - [arm64,armhf] irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
    - hwmon: (drivetemp) Set scsi command timeout to 10s
    - mm: zswap: properly synchronize freeing resources during CPU hotunplug
    - mm: zswap: move allocations during CPU init outside the lock
    - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
    - libfs: Return ENOSPC when the directory offset range is exhausted
    - Revert "libfs: Add simple_offset_empty()"
    - Revert "libfs: fix infinite directory reads for offset dir"
    - libfs: Replace simple_offset end-of-directory detection
    - libfs: Use d_children list to iterate simple_offset directories
    - smb: client: handle lack of EA support in smb2_query_path_info()
    - net: sched: fix ets qdisc OOB Indexing
    - Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
    - cachestat: fix page cache statistics permission checking
    - vfio/platform: check the bounds of read/write syscalls
    - scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
    - USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
    - Revert "usb: gadget: u_serial: Disable ep before setting port to null to
      fix the crash caused by port being null"
    - ALSA: usb-audio: Add delay quirk for USB Audio Device
    - wifi: rtl8xxxu: add more missing rtl8192cu USB IDs
    - HID: wacom: Initialize brightness of LED trigger
    - Input: xpad - add support for Nacon Pro Compact
    - Input: atkbd - map F23 key to support default copilot shortcut
    - Input: xpad - add unofficial Xbox 360 wireless receiver clone
    - Input: xpad - add QH Electronics VID/PID
    - Input: xpad - improve name of 8BitDo controller 2dc8:3106
    - Input: xpad - add support for Nacon Evol-X Xbox One Controller
    - Input: xpad - add support for wooting two he (arm)
    - io_uring/rsrc: require cloned buffers to share accounting contexts
    - [arm64] drm/v3d: Assign job pointer to NULL before signaling the fence

  [ Salvatore Bonaccorso ]
  * kbuild: switch from lz4c to lz4 for compression

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 02 Feb 2025 14:17:45 +0100

linux (6.12.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.11
    - efi/zboot: Limit compression options to GZIP and ZSTD
    - [arm64,armhf] net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
    - bpf: Fix bpf_sk_select_reuseport() memory leak
    - eth: bnxt: always recalculate features after XDP clearing, fix null-deref
    - net: ravb: Fix max TX frame size for RZ/V2M
    - openvswitch: fix lockup on tx to unregistering netdev with carrier
    - pktgen: Avoid out-of-bounds access in get_imix_entries
    - ice: Fix E825 initialization
    - ice: Fix quad registers read on E825
    - ice: Fix ETH56G FC-FEC Rx offset value
    - ice: Introduce ice_get_phy_model() wrapper
    - ice: Add ice_get_ctrl_ptp() wrapper to simplify the code
    - ice: Use ice_adapter for PTP shared data instead of auxdev
    - ice: Add correct PHY lane assignment
    - cpuidle: teo: Update documentation after previous changes
    - btrfs: add the missing error handling inside get_canonical_dev_path
    - gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
    - gtp: Destroy device along with udp socket's netns dismantle.
    - pfcp: Destroy device along with udp socket's netns dismantle.
    - cpufreq: Move endif to the end of Kconfig file
    - nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
    - [arm64,armhf] net: fec: handle page_pool_dev_alloc_pages error
    - net: make page_pool_ref_netmem work with net iovs
    - net/mlx5: Fix RDMA TX steering prio
    - net/mlx5: Fix a lockdep warning as part of the write combining test
    - net/mlx5: SF, Fix add port error handling
    - net/mlx5: Clear port select structure when fail to create
    - net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel
    - net/mlx5e: Rely on reqid in IPsec tunnel mode
    - net/mlx5e: Always start IPsec sequence number from 1
    - netdev: avoid CFI problems with sock priv helpers
    - [amd64,arm64] drm/vmwgfx: Unreserve BO on error
    - [amd64,arm64] drm/vmwgfx: Add new keep_resv BO param
    - [arm64] drm/v3d: Ensure job pointer is set to NULL after job completion
    - [arm64] reset: rzg2l-usbphy-ctrl: Assign proper of node to the allocated
      device
    - soc: ti: pruss: Fix pruss APIs
    - i2c: core: fix reference leak in i2c_register_adapter()
    - [x86] platform/x86: dell-uart-backlight: fix serdev race
    - [x86] platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race
    - hwmon: (tmp513) Fix division of negative numbers
    - Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
    - hwmon: (ltc2991) Fix mixed signed/unsigned in DIV_ROUND_CLOSEST
    - smb: client: fix double free of TCP_Server_Info::hostname
    - mac802154: check local interfaces before deleting sdata list
    - hfs: Sanity check the root record
    - fs: fix missing declaration of init_files
    - kheaders: Ignore silly-rename files
    - netfs: Fix non-contiguous donation between completed reads
    - cachefiles: Parse the "secctx" immediately
    - scsi: ufs: core: Honor runtime/system PM levels if set by host controller
      drivers
    - gpio: virtuser: lock up configfs that an instantiated device depends on
    - gpio: sim: lock up configfs that an instantiated device depends on
    - [x86] platform/x86/intel: power-domains: Add Clearwater Forest support
    - [x86] platform/x86: ISST: Add Clearwater Forest to support list
    - ACPI: resource: acpi_dev_irq_override(): Check DMI match last
    - sched_ext: keep running prev when prev->scx.slice != 0
    - iomap: avoid avoid truncating 64-bit offset to 32 bits
    - afs: Fix merge preference rule failure condition
    - poll_wait: add mb() to fix theoretical race between waitqueue_active() and
      .poll()
    - RDMA/bnxt_re: Fix to export port num to ib_query_qp
    - sched_ext: Fix dsq_local_on selftest
    - nvmet: propagate npwg topology
    - sched/fair: Fix update_cfs_group() vs DELAY_DEQUEUE
    - [x86] asm: Make serialize() always_inline
    - ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA
    - ALSA: hda/realtek: fixup ASUS GA605W
    - ALSA: hda/realtek: fixup ASUS H7606W
    - zram: fix potential UAF of zram table
    - i2c: atr: Fix client detach
    - mptcp: be sure to send ack when mptcp-level window re-opens
    - mptcp: fix spurious wake-up on under memory pressure
    - net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
    - vsock/bpf: return early if transport is not assigned
    - vsock/virtio: discard packets if the transport changes
    - vsock/virtio: cancel close work in the destructor
    - vsock: reset socket state when de-assigning the transport
    - vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
    - nouveau/fence: handle cross device fences properly
    - drm/nouveau/disp: Fix missing backlight control on Macbook 5,1
    - net/ncsi: fix locking in Get MAC Address handling
    - filemap: avoid truncating 64-bit offset to 32 bits
    - fs/proc: fix softlockup in __read_vmcore (part 2)
    - gpio: xilinx: Convert gpio_lock to raw spinlock
    - tools: fix atomic_set() definition to set the value correctly
    - pmdomain: imx8mp-blk-ctrl: add missing loop break condition
    - mm/kmemleak: fix percpu memory leak detection failure
    - drm/amd/display: Do not elevate mem_type change to full update
    - mm: clear uffd-wp PTE/PMD state on mremap()
    - mm: vmscan : pgdemote vmstat is not getting updated when MGLRU is enabled.
    - tracing: gfp: Fix the GFP enum values shown for user space tracing tools
    - irqchip: Plug a OF node reference leak in platform_irqchip_probe()
    - irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
    - irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
    - hrtimers: Handle CPU state correctly on hotplug
    - timers/migration: Fix another race between hotplug and idle entry/exit
    - timers/migration: Enforce group initialization visibility to tree walkers
    - [x86] fred: Fix the FRED RSP0 MSR out of sync with its per-CPU cache
    - [amd64] drm/i915/fb: Relax clear color alignment to 64 bytes
    - drm/xe: Mark ComputeCS read mode as UC on iGPU
    - drm/xe/oa: Add missing VISACTL mux registers
    - drm/amdgpu/smu13: update powersave optimizations
    - drm/amdgpu: fix fw attestation for MP0_14_0_{2/3}
    - drm/amdgpu: disable gfxoff with the compute workload on gfx12
    - drm/amdgpu: always sync the GFX pipe on ctx switch
    - drm/amd/display: Fix PSR-SU not support but still call the
      amdgpu_dm_psr_enable
    - drm/amd/display: Disable replay and psr while VRR is enabled
    - drm/amd/display: Do not wait for PSR disable on vbl enable
    - Revert "drm/amd/display: Enable urgent latency adjustments for DCN35"
    - drm/amd/display: Validate mdoe under MST LCT=1 case as well
    - apparmor: allocate xmatch for nullpdb inside aa_alloc_null

  [ наб ]
  * d/p/debian/cdc_ncm-cdc_mbim-use-ncm-by-default.patch: drop
    (Modern userland supports MBIM, disabling breaks connections by default,
     Ubuntu ships kernels without this patch and it's reliable there.)

  [ Diederik de Haas ]
  * [arm64] drivers/char/hw_random: Enable HW_RANDOM_ROCKCHIP as module
  * [arm64] drivers/pci/endpoint: Enable PCI_ENDPOINT

  [ Uwe Kleine-König ]
  * [arm64] Enable CONFIG_GPIO_THUNDERX=m which is a dependency for
    MMC_CAVIUM_THUNDERX that is already supposed to be enabled.

  [ Jochen Sprickerhof ]
  * [arm64] Enable modules for Google Pixel 6 (Exynos)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 25 Jan 2025 21:15:12 +0100

linux (6.12.10-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.10
    - jbd2: increase IO priority for writing revoke records
    - jbd2: flush filesystem device before updating tail sequence
    - fs/writeback: convert wbc_account_cgroup_owner to take a folio
    - iomap: pass byte granular end position to iomap_add_to_ioend
    - iomap: fix zero padding data issue in concurrent append writes
    - dm array: fix releasing a faulty array block twice in dm_array_cursor_end
    - dm array: fix unreleased btree blocks on closing a faulty array cursor
    - dm array: fix cursor index when skipping across block boundaries
    - netfs: Fix enomem handling in buffered reads
    - nfs: Fix oops in nfs_netfs_init_request() when copying to cache
    - netfs: Fix missing barriers by using clear_and_wake_up_bit()
    - netfs: Fix ceph copy to cache on write-begin
    - netfs: Fix the (non-)cancellation of copy when cache is temporarily
      disabled
    - netfs: Fix is-caching check in read-retry
    - exfat: fix the infinite loop in exfat_readdir()
    - exfat: fix the new buffer was not zeroed before writing
    - exfat: fix the infinite loop in __exfat_free_cluster()
    - fuse: respect FOPEN_KEEP_CACHE on opendir
    - ovl: pass realinode to ovl_encode_real_fh() instead of realdentry
    - ovl: support encoding fid from inode with no alias
    - [amd64] ASoC: rt722: add delay time to wait for the calibration procedure
    - [arm64] ASoC: mediatek: disable buffer pre-allocation
    - net: 802: LLC+SNAP OID:PID lookup on start of skb data
    - tcp/dccp: allow a connection when sk_max_ack_backlog is zero
    - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
    - net: libwx: fix firmware mailbox abnormal return
    - btrfs: avoid NULL pointer dereference if no valid extent tree
    - pds_core: limit loop over fw name list
    - bnxt_en: Fix possible memory leak when hwrm_req_replace fails
    - bnxt_en: Fix DIM shutdown
    - cxgb4: Avoid removal of uninserted tid
    - net: don't dump Tx and uninitialized NAPIs
    - ice: fix max values for dpll pin phase adjust
    - ice: fix incorrect PHY settings for 100 GB/s
    - igc: return early when failing to read EECD register
    - tls: Fix tls_sw_sendmsg error handling
    - ipvlan: Fix use-after-free in ipvlan_get_iflink().
    - [amd64,arm64] eth: gve: use appropriate helper to set xdp_features
    - Bluetooth: hci_sync: Fix not setting Random Address when required
    - Bluetooth: MGMT: Fix Add Device to responding before completing
    - Bluetooth: btnxpuart: Fix driver sending truncated data
    - Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices.
    - tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
    - [arm64] net: hns3: fixed reset failure issues caused by the incorrect
      reset type
    - [arm64] net: hns3: fix missing features due to dev->features configuration
      too early
    - [arm64] net: hns3: Resolved the issue that the debugfs query result is
      inconsistent.
    - [arm64] net: hns3: don't auto enable misc vector
    - [arm64] net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
    - [arm64] net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of
      bounds issue
    - [arm64] net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
    - mctp i3c: fix MCTP I3C driver multi-thread issue
    - netfilter: nf_tables: imbalance in flowtable binding
    - netfilter: conntrack: clamp maximum hashtable size to INT_MAX
    - sched: sch_cake: add bounds checks to host bulk flow fairness counts
    - net/mlx5: Fix variable not being completed when function returns
    - [arm64] drm/mediatek: Set private->all_drm_private[i]->drm to NULL if
      mtk_drm_bind returns err
    - [arm64] drm/mediatek: Move mtk_crtc_finish_page_flip() to ddp_cmdq_cb()
    - [arm64] drm/mediatek: Add support for 180-degree rotation in the display
      driver
    - [arm64] drm/mediatek: stop selecting foreign drivers
    - [arm64] drm/mediatek: Fix YCbCr422 color format issue for DP
    - [arm64] drm/mediatek: Fix mode valid issue for dp
    - [arm64] drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188
    - gpio: virtuser: fix missing lookup table cleanups
    - gpio: virtuser: fix handling of multiple conn_ids in lookup table
    - [arm64] drm/mediatek: Add return value check when reading DPCD
    - ksmbd: fix a missing return value check bug
    - afs: Fix the maximum cell name length
    - [amd64] platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042
      actually enabled it
    - [amd64] platform/x86: intel/pmc: Fix ioremap() of bad address
    - ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
    - [riscv64] module: remove relocation_head rel_entry member allocation
    - [riscv64] cpuidle: riscv-sbi: fix device node release in early exit of
      for_each_possible_cpu
    - [riscv64] mm: Fix the out of bound issue of vmemmap address
    - [riscv64] stacktrace: fix backtracing through exceptions
    - [riscv64] use local label names instead of global ones in assembly
    - drm/xe: Fix tlb invalidation when wedging
    - netfs: Fix kernel async DIO
    - netfs: Fix read-retry for fs with no ->prepare_read()
    - [riscv64] drivers/perf: riscv: Fix Platform firmware event data
    - [riscv64] drivers/perf: riscv: Return error for default case
    - dm thin: make get_first_thin use rcu-safe list first function
    - scsi: ufs: qcom: Power off the PHY if it was already powered on in
      ufs_qcom_power_up_sequence()
    - vfio/pci: Fallback huge faults for unaligned pfn
    - fs: relax assertions on failure to encode file handles
    - fs: fix is_mnt_ns_file()
    - dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
    - dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take
      2)
    - mptcp: sysctl: avail sched: remove write access
    - mptcp: sysctl: sched: avoid using current->nsproxy
    - mptcp: sysctl: blackhole timeout: avoid using current->nsproxy
    - sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
    - sctp: sysctl: rto_min/max: avoid using current->nsproxy
    - sctp: sysctl: auth_enable: avoid using current->nsproxy
    - sctp: sysctl: udp_port: avoid using current->nsproxy
    - sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
    - rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
    - ksmbd: Implement new SMB3 POSIX type
    - btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path
    - [arm64] Revert "drm/mediatek: dsi: Correct calculation formula of PHY
      Timing"
    - drm/amd/display: Remove unnecessary amdgpu_irq_get/put
    - drm/amd/display: Add check for granularity in dml ceil/floor helpers
    - cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains
    - thermal: of: fix OF node leak in of_thermal_zone_find()
    - sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()
    - sched_ext: switch class when preempted by higher priority scheduler
    - cgroup/cpuset: remove kernfs active break
    - sched_ext: idle: Refresh idle masks during idle-to-idle transitions
    - [arm64] dts: qcom: x1e80100: Fix up BAR space size for PCIe6a
    - [arm64] dts: qcom: sa8775p: Fix the size of 'addr_space' regions
    - smb: client: sync the root session and superblock context passwords before
      automounting
    - fs: kill MNT_ONRB
    - [riscv64] Fix sleeping in invalid context in die()
    - [riscv64] kprobes: Fix incorrect address calculation
    - gpio: loongson: Fix Loongson-2K2000 ACPI GPIO register offset
    - ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
    - ACPI: resource: Add Asus Vivobook X1504VAP to
      irq1_level_low_skip_override[]
    - drm/amdgpu: Add a lock when accessing the buddy trim function
    - drm/amd/pm: fix BUG: scheduling while atomic
    - drm/amd/display: fix divide error in DM plane scale calcs
    - drm/amd/display: fix page fault due to max surface definition mismatch
    - drm/amd/display: increase MAX_SURFACES to the value supported by hw
    - io_uring/timeout: fix multishot updates
    - io_uring/sqpoll: zero sqd->thread on tctx errors
    - USB: serial: option: add MeiG Smart SRM815
    - USB: serial: option: add Neoway N723-EA support
    - usb-storage: Add max sectors quirk for Nokia 208
    - USB: serial: cp210x: add Phoenix Contact UPS Device
    - usb: dwc3: gadget: fix writing NYET threshold
    - topology: Keep the cpumask unchanged when printing cpumap
    - tty: serial: 8250: Fix another runtime PM usage counter underflow
    - [armhf] serial: stm32: use port lock wrappers for break control
    - usb: gadget: u_serial: Disable ep before setting port to null to fix the
      crash caused by port being null
    - [x86] fpu: Ensure shadow stack is active before "getting" registers
    - usb: dwc3-am62: Disable autosuspend during remove
    - USB: usblp: return error when setting unsupported protocol
    - USB: core: Disable LPM only for non-suspended ports
    - usb: fix reference leak in usb_new_device()
    - usb: gadget: midi2: Reverse-select at the right place
    - usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and
      in the error path of .probe()
    - usb: typec: tcpci: fix NULL pointer issue on shared irq case
    - usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
    - usb: typec: tcpm/tcpci_maxim: fix error code in
      max_contaminant_read_resistance_kohm()
    - usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
    - usb: gadget: configfs: Ignore trailing LF for user strings to cdev
    - usb: host: xhci-plat: set skip_phy_initialization if software node has
      XHCI_SKIP_PHY_INIT property
    - usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control()
    - iio: pressure: zpa2326: fix information leak in triggered buffer
    - iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered
      buffer
    - iio: light: vcnl4035: fix information leak in triggered buffer
    - iio: light: bh1745: fix information leak in triggered buffer
    - iio: imu: kmx61: fix information leak in triggered buffer
    - [arm64,armhf] iio: adc: rockchip_saradc: fix information leak in triggered
      buffer
    - [arm64] iio: adc: ti-ads8688: fix information leak in triggered buffer
    - iio: gyro: fxas21002c: Fix missing data update in trigger handler
    - iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
    - iio: inkern: call iio_device_put() only on mapped devices
    - io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
    - hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors
      occur
    - block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
    - [arm64] dts: rockchip: add hevc power domain clock to rk3328
    - firewall: remove misplaced semicolon from stm32_firewall_get_firewall
    - [arm64] drm/mediatek: Only touch DISP_REG_OVL_PITCH_MSB if AFBC is
      supported
    - io_uring: don't touch sqd->thread off tw add
    - iio: imu: inv_icm42600: fix spi burst write not supported
    - netdev: prevent accessing NAPI instances from another namespace

  [ Salvatore Bonaccorso ]
  * [amd64/cloud] drivers/idle: Enable INTEL_IDLE (Closes: #1078005)
  * drivers/bluetooth: Enable BT_INTEL_PCIE as module (Closes: #1092465)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 18 Jan 2025 10:10:54 +0100

linux (6.12.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.9
    - [x86] platform/x86: mlx-platform: call pci_dev_put() to balance the
      refcount
    - drm/amdgpu: fix backport of commit 73dae652dcac (Closes: #1092187)
    - [x86] platform/x86: thinkpad-acpi: Add support for hotkey 0x1401
    - [x86] platform/x86: hp-wmi: mark 8A15 board for timed OMEN thermal profile
    - selinux: ignore unknown extended permissions
    - mmc: sdhci-msm: fix crypto key eviction
    - [arm64,armhf] pmdomain: imx: gpcv2: fix an OF node reference leak in
      imx_gpcv2_probe()
    - pmdomain: core: add dummy release function to genpd device
    - tracing: Have process_string() also allow arrays
    - block: lift bio_is_zone_append to bio.h
    - btrfs: use bio_is_zone_append() in the completion handler
    - RDMA/bnxt_re: Remove always true dattr validity check
    - sched_ext: fix application of sizeof to pointer
    - RDMA/mlx5: Enforce same type port association for multiport RoCE
    - RDMA/bnxt_re: Fix max SGEs for the Work Request
    - RDMA/bnxt_re: Avoid initializing the software queue for user queues
    - RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters
    - RDMA/core: Fix ENODEV error for iWARP test over vlan
    - nvme-pci: 512 byte aligned dma pool segment quirk
    - wifi: iwlwifi: fix CRF name for Bz
    - RDMA/bnxt_re: Fix the check for 9060 condition
    - RDMA/bnxt_re: Add check for path mtu in modify_qp
    - RDMA/bnxt_re: Fix reporting hw_ver in query_device
    - RDMA/nldev: Set error code in rdma_nl_notify_event
    - RDMA/siw: Remove direct link to net_device
    - RDMA/bnxt_re: Fix max_qp_wrs reported
    - RDMA/bnxt_re: Disable use of reserved wqes
    - RDMA/bnxt_re: Add send queue size check for variable wqe
    - RDMA/bnxt_re: Fix MSN table size for variable wqe mode
    - RDMA/bnxt_re: Fix the locking while accessing the QP table
    - net: phy: micrel: Dynamically control external clock of KSZ PHY
    - [arm64] drm/bridge: adv7511_audio: Update Audio InfoFrame properly
    - netdev-genl: avoid empty messages in napi get
    - [arm64] RDMA/hns: Fix mapping error of zero-hop WQE buffer
    - [arm64] RDMA/hns: Fix accessing invalid dip_ctx during destroying QP
    - [arm64] RDMA/hns: Fix warning storm caused by invalid input in IO path
    - [arm64] RDMA/hns: Fix missing flush CQE for DWQE
    - drm/xe: Revert some changes that break a mesa debug tool
    - drm/xe/pf: Use correct function to check LMEM provisioning
    - drm/xe: Fix fault on fd close after unbind
    - net: stmmac: restructure the error path of stmmac_probe_config_dt()
    - net: fix memory leak in tcp_conn_request()
    - net: Fix netns for ip_tunnel_init_flow()
    - netrom: check buffer length before accessing it
    - net: pse-pd: tps23881: Fix power on/off issue
    - net/mlx5: DR, select MSIX vector 0 for completion queue creation
    - net/mlx5e: macsec: Maintain TX SA from encoding_sa
    - net/mlx5e: Skip restore TC rules for vport rep without loaded flag
    - net/mlx5e: Keep netdev when leave switchdev for devlink set legacy only
    - RDMA/rxe: Remove the direct link to net_device
    - [amd64] drm/i915/cx0_phy: Fix C10 pll programming sequence
    - [amd64] drm/i915/dg1: Fix power gate sequence.
    - workqueue: add printf attribute to __alloc_workqueue()
    - netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
    - net: llc: reset skb->transport_header
    - nvmet: Don't overflow subsysnqn
    - ALSA: usb-audio: US16x08: Initialize array before use
    - eth: bcmsysport: fix call balance of priv->clk handling routines
    - net: mv643xx_eth: fix an OF node reference leak
    - net: wwan: t7xx: Fix FSM command timeout issue
    - RDMA/rtrs: Ensure 'ib_sge list' is accessible
    - RDMA/bnxt_re: Fix error recovery sequence
    - io_uring/net: always initialize kmsg->msg.msg_inq upfront
    - net: sfc: Correct key_len for efx_tc_ct_zone_ht_params
    - net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets
    - net: restrict SO_REUSEPORT to inet sockets
    - net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init()
    - af_packet: fix vlan_get_tci() vs MSG_PEEK
    - af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
    - ila: serialize calls to nf_register_net_hooks()
    - net: ti: icssg-prueth: Fix firmware load sequence.
    - net: ti: icssg-prueth: Fix clearing of IEP_CMP_CFG registers during
      iep_init
    - btrfs: allow swap activation to be interruptible
    - [x86] perf/x86/intel: Add Arrow Lake U support
    - wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
    - wifi: cfg80211: clear link ID from bitmap during link delete after clean
      up
    - wifi: mac80211: wake the queues in case of failure in resume
    - drm/amdgpu: use sjt mec fw on gfx943 for sriov
    - ALSA: hda: cs35l56: Remove calls to
      cs35l56_force_sync_asp1_registers_from_cache()
    - ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio
    - btrfs: handle bio_split() errors
    - btrfs: flush delalloc workers queue before stopping cleaner kthread during
      unmount
    - ALSA: hda/ca0132: Use standard HD-audio quirk matching helpers
    - ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model
    - sound: usb: enable DSD output for ddHiFi TC44C
    - sound: usb: format: don't warn that raw DSD is unsupported
    - spi: spi-cadence-qspi: Disable STIG mode for Altera SoCFPGA.
    - ASoC: audio-graph-card: Call of_node_put() on correct node
    - ARC: build: disallow invalid PAE40 + 4K page config
    - ARC: build: Use __force to suppress per-CPU cmpxchg warnings
    - ARC: bpf: Correct conditional check in 'check_jmp_32'
    - bpf: fix potential error return
    - ksmbd: retry iterate_dir in smb2_query_dir
    - ksmbd: set ATTR_CTIME flags when setting mtime
    - smb: client: destroy cfid_put_wq on module exit
    - net: usb: qmi_wwan: add Telit FE910C04 compositions
    - Bluetooth: hci_core: Fix sleeping function called from invalid context
    - irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base
    - bpf: refactor bpf_helper_changes_pkt_data to use helper number
    - bpf: consider that tail calls invalidate packet pointers
    - clk: thead: Fix TH1520 emmc and shdci clock rate
    - scripts/mksysmap: Fix escape chars '$'
    - modpost: fix the missed iteration for the max bit in do_input()
    - kbuild: pacman-pkg: provide versioned linux-api-headers package
    - Revert "ALSA: ump: Don't enumeration invalid groups for legacy rawmidi"
    - RDMA/mlx5: Enable multiplane mode only when it is supported
    - io_uring/kbuf: use pre-committed buffer address for non-pollable file
    - ALSA: seq: Check UMP support for midi_version change
    - ftrace: Fix function profiler's filtering functionality
    - drm/xe: Use non-interruptible wait when moving BO to system
    - drm/xe: Wait for migration job before unmapping pages
    - ALSA hda/realtek: Add quirk for Framework F111:000C
    - ALSA: seq: oss: Fix races at processing SysEx messages
    - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
    - kcov: mark in_softirq_really() as __always_inline
    - maple_tree: reload mas before the second call for mas_empty_area
    - clk: clk-imx8mp-audiomix: fix function signature
    - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and
      transitivity
    - sched_ext: Fix invalid irq restore in scx_ops_bypass()
    - RDMA/uverbs: Prevent integer overflow issue
    - pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
    - workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from
      !WQ_MEM_RECLAIM worker
    - sky2: Add device ID 11ab:4373 for Marvell 88E8075
    - sched_ext: initialize kit->cursor.flags
    - net/sctp: Prevent autoclose integer overflow in sctp_association_init()
    - io_uring/rw: fix downgraded mshot read
    - drm: adv7511: Drop dsi single lane support
    - dt-bindings: display: adi,adv7533: Drop single lane support
    - drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
    - wifi: iwlwifi: mvm: Fix __counted_by usage in cfg80211_wowlan_nd_*
    - fgraph: Add READ_ONCE() when accessing fgraph_array[]
    - net: ethernet: ti: am65-cpsw: default to round-robin for host port receive
    - mm/damon/core: fix ignored quota goals and filters of newly committed
      schemes
    - mm/damon/core: fix new damon_target objects leaks on
      damon_commit_targets()
    - mm: shmem: fix the update of 'shmem_falloc->nr_unswapped'
    - mm: shmem: fix incorrect index alignment for within_size policy
    - fs/proc/task_mmu: fix pagemap flags with PMD THP entries on 32bit
    - [amd64,arm64] gve: process XSK TX descriptors as part of RX NAPI
    - [amd64,arm64] gve: clean XDP queues in gve_tx_stop_ring_gqi
    - [amd64,arm64] gve: guard XSK operations on the existence of queues
    - [amd64,arm64] gve: fix XDP allocation path in edge cases
    - [amd64,arm64] gve: guard XDP xmit NDO on existence of xdp queues
    - [amd64,arm64] gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup
    - mm/readahead: fix large folio support in async readahead
    - mm/kmemleak: fix sleeping function called from invalid context at print
      message
    - mm: vmscan: account for free pages to prevent infinite Loop in
      throttle_direct_reclaim()
    - mm: reinstate ability to map write-sealed memfd mappings read-only
    - mm: hugetlb: independent PMD page table shared count
    - mptcp: fix TCP options overflow.
    - mptcp: fix recvbuffer adjust on sleeping rcvmsg
    - mptcp: don't always assume copied data in mptcp_cleanup_rbuf()

  [ Salvatore Bonaccorso ]
  * [mips*] Increase RELOCATION_TABLE_SIZE to 0x00201000 (fixes FTBFS)
  * [rt] Update to 6.12.8-rt8

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 10 Jan 2025 11:03:22 +0100

linux (6.12.8-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.7
    - net: sched: fix ordering of qlen adjustment (CVE-2024-53164)
    - net: stmmac: fix TSO DMA API usage causing oops (CVE-2024-56719)
    - firmware: arm_ffa: Fix the race around setting ffa_dev->properties
    - [riscv64] KVM: Fix csr_write -> csr_set for HVIEN PMU overflow bit
    - sched/fair: Fix NEXT_BUDDY
    - sched/fair: Fix sched_can_stop_tick() for fair tasks
    - sched/eevdf: More PELT vs DELAYED_DEQUEUE
    - [amd64] p2sb: Factor out p2sb_read_from_cache()
    - [amd64] p2sb: Introduce the global flag p2sb_hidden_by_bios
    - [amd64] p2sb: Move P2SB hide and unhide code to p2sb_scan_and_cache()
    - [amd64] p2sb: Do not scan and remove the P2SB device when it is unhidden
    - i2c: pnx: Fix timeout in wait functions
    - [s390x] ipl: Fix never less than zero warning
    - erofs: fix PSI memstall accounting
    - sched/dlserver: Fix dlserver double enqueue
    - sched/dlserver: Fix dlserver time accounting
    - [s390x] mm: Consider KMSAN modules metadata for paging levels
    - erofs: add erofs_sb_free() helper
    - erofs: use `struct erofs_device_info` for the primary device
    - erofs: reference `struct erofs_device_info` for erofs_map_dev
    - erofs: use buffered I/O for file-backed mounts by default
    - xfs: sb_spino_align is not verified
    - xfs: fix sparse inode limits on runt AG
    - xfs: fix off-by-one error in fsmap's end_daddr usage
    - xfs: fix sb_spino_align checks for large fsblock sizes
    - xfs: fix zero byte checking in the superblock scrubber
    - cxl/pci: Fix potential bogus return value upon successful probing
    - cxl/region: Fix region creation for greater than x2 switches
    - net/smc: protect link down work from execute after lgr freed
      (CVE-2024-56718)
    - net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
    - net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal
      msg
    - net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal
      msg
    - net/smc: check smcd_v2_ext_offset when receiving proposal msg
    - net/smc: check return value of sock_recvmsg when draining clc data
    - [arm64] net: mscc: ocelot: fix incorrect IFH SRC_PORT field in
      ocelot_ifh_set_basic()
    - ionic: Fix netdev notifier unregister on failure (CVE-2024-56715)
    - ionic: no double destroy workqueue (CVE-2024-56714)
    - ionic: use ee->offset when returning sprom data
    - ksmbd: count all requests in req_running counter
    - ksmbd: fix broken transfers when exceeding max simultaneous operations
    - netdev: fix repeated netlink messages in queue dump
    - netdev: fix repeated netlink messages in queue stats
    - team: Fix feature exposure when no ports are present
    - [amd64,arm64] net: hinic: Fix cleanup in create_rxqs/txqs()
    - net: ethernet: bgmac-platform: fix an OF node reference leak
    - can: m_can: set init flag earlier in probe
    - can: m_can: fix missed interrupts with m_can_pci
    - ipvs: Fix clamp() of ip_vs_conn_tab on small memory systems
    - netfilter: ipset: Fix for recursive locking warning
    - net: dsa: restore dsa_software_vlan_untag() ability to operate on
      VLAN-untagged traffic
    - netdev-genl: avoid empty messages in queue dump
    - psample: adjust size if rate_as_probability is set
    - net: mdiobus: fix an OF node reference leak
    - [arm64,armhf] mmc: sdhci-tegra: Remove
      SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk
    - [arm64] mmc: mtk-sd: disable wakeup in .remove() and in the error path of
      .probe()
    - irqchip/gic-v3: Work around insecure GIC integrations
    - [amd64] EDAC/amd64: Simplify ECC check on unified memory controllers
    - [arm64] KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be
      overridden
    - [amd64] KVM: x86: Cache CPUID.0xD XSTATE offsets+sizes during module init
    - net: tun: fix tun_napi_alloc_frags()
    - chelsio/chtls: prevent potential integer overflow on 32bit
    - net: mctp: handle skb cleanup on sock_queue failures
    - block: Revert "block: Fix potential deadlock while freezing queue and
      acquiring sysfs_lock"
    - i2c: riic: Always round-up when calculating bus period
    - efivarfs: Fix error on non-existent file
    - USB: serial: option: add TCL IK512 MBIM & ECM
    - USB: serial: option: add MeiG Smart SLM770A
    - USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
    - USB: serial: option: add MediaTek T7XX compositions
    - USB: serial: option: add Telit FE910C04 rmnet compositions
    - xhci: Turn NEC specific quirk for handling Stop Endpoint errors generic
    - [amd64] thunderbolt: Add support for Intel Panther Lake-M/P
    - [amd64] thunderbolt: Improve redrive mode handling
    - [amd64] thunderbolt: Don't display nvm_version unless upgrade supported
    - drm/display: use ERR_PTR on DP tunnel manager creation fail
    - drm/amd: Update strapping for NBIO 2.5.0
    - drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
    - drm/amdgpu: fix amdgpu_coredump
    - drm/amdgpu: Handle NULL bo->tbo.resource (again) in amdgpu_vm_bo_update
    - [amd64] udmabuf: udmabuf_create pin folio codestyle cleanup
    - [amd64] udmabuf: fix memory leak on last export_udmabuf() error path
    - dma-buf: Fix __dma_buf_debugfs_list_del argument for !CONFIG_DEBUG_FS
    - [amd64] i915/guc: Reset engine utilization buffer before registration
    - [amd64] i915/guc: Ensure busyness counter increases motonically
    - [amd64] i915/guc: Accumulate active runtime on gt reset
    - drm/amdgpu: don't access invalid sched
    - hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit
      Registers
    - hwmon: (tmp513) Fix Current Register value interpretation
    - hwmon: (tmp513) Fix interpretation of values of Temperature Result and
      Limit Registers
    - block: avoid to reuse `hctx` not removed from cpuhp callback list
    - trace/ring-buffer: Do not use TP_printk() formatting for boot mapped
      buffers
    - drm/amdgpu/nbio7.11: fix IP version check
    - drm/amdgpu/nbio7.7: fix IP version check
    - drm/amdgpu/smu14.0.2: fix IP version check
    - zram: refuse to use zero sized block device as backing device
    - zram: fix uninitialized ZRAM not releasing backing device
    - vmalloc: fix accounting with i915
    - mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in
      split_large_buddy()
    - ring-buffer: Fix overflow in __rb_map_vma
    - alloc_tag: fix set_codetag_empty() when !CONFIG_MEM_ALLOC_PROFILING_DEBUG
    - btrfs: split bios to the fs sector size boundary
    - btrfs: fix improper generation check in snapshot delete
    - btrfs: tree-checker: reject inline extent items with 0 ref count
    - [s390x] mm: Fix DirectMap accounting
    - drm/amdgpu/nbio7.0: fix IP version check
    - drm/amdgpu/gfx12: fix IP version check
    - drm/amdgpu/mmhub4.1: fix IP version check
    - fgraph: Still initialize idle shadow stacks when starting
    - Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
    - tools: hv: Fix a complier warning in the fcopy uio daemon
    - [x86] hyperv: Fix hv tsc page based sched_clock for hibernation
    - [x86] KVM: x86: Play nice with protected guests in
      complete_hypercall_exit()
    - smb: client: fix TCP timers deadlock after rmmod
    - accel/ivpu: Fix general protection fault in ivpu_bo_list()
    - accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()
    - tracing: Fix test_event_printk() to process entire print argument
    - tracing: Add missing helper functions in event pointer dereference check
    - tracing: Add "%s" check in test_event_printk()
    - tracing: Check "%s" dereference via the field and not the TP_printk format
    - io_uring: Fix registered ring file refcount leak
    - io_uring: check if iowq is killed before queuing (CVE-2024-56709)
    - NFS/pnfs: Fix a live lock between recalled layouts and layoutget
    - [x86] KVM: SVM: Allow guest writes to set MSR_AMD64_DE_CFG bits
    - of/irq: Fix interrupt-map cell length check in of_irq_parse_imap_parent()
    - of/irq: Fix using uninitialized variable @addr_len in API
      of_irq_parse_one()
    - ocfs2: fix the space leak in LA when releasing LA
    - nilfs2: fix buffer head leaks in calls to truncate_inode_pages()
    - nilfs2: prevent use of deleted inode
    - [amd64] udmabuf: fix racy memfd sealing check
    - [amd64] udmabuf: also check for F_SEAL_FUTURE_WRITE
    - of: property: fw_devlink: Do not use interrupt-parent directly
    - of: address: Preserve the flags portion on 1:1 dma-ranges mapping
    - of: Fix error path in of_parse_phandle_with_args_map()
    - of: Fix refcount leakage for OF node returned by __of_get_dma_parent()
    - ceph: give up on paths longer than PATH_MAX
    - ceph: validate snapdirname option length when mounting
    - ceph: improve error handling and short/overflow-read logic in
      __ceph_sync_read()
    - ceph: fix memory leaks in __ceph_sync_read()
    - ceph: fix memory leak in ceph_direct_read_write() (CVE-2024-56710)
    - mm: use aligned address in clear_gigantic_page()
    - mm: use aligned address in copy_user_gigantic_page()
    - mm: shmem: fix ShmemHugePages at swapout
    - mm: convert partially_mapped set/clear operations to be atomic
    - epoll: Add synchronous wakeup support for ep_poll_callback
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.8
    - media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
    - ceph: allocate sparse_ext map only for sparse reads
    - [arm64] dts: broadcom: Fix L2 linesize for Raspberry Pi 5
    - bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP
    - fork: avoid inappropriate uprobe access to invalid mm
    - mm/vmstat: fix a W=1 clang compiler warning
    - smb: client: Deduplicate "select NETFS_SUPPORT" in Kconfig
    - smb: fix bytes written value in /proc/fs/cifs/Stats
    - tcp_bpf: Charge receive socket buffer in bpf_tcp_ingress()
    - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection
    - bpf: Check negative offsets in __bpf_skb_min_len()
    - nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work"
    - nfsd: restore callback functionality for NFSv4.0
    - mtd: diskonchip: Cast an operand to prevent potential overflow
    - [arm64] phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP
    - phy: core: Fix an OF node refcount leakage in _of_phy_get()
    - phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup()
    - phy: core: Fix that API devm_phy_put() fails to release the phy
    - phy: core: Fix that API devm_of_phy_provider_unregister() fails to
      unregister the phy provider
    - phy: core: Fix that API devm_phy_destroy() fails to destroy the phy
    - phy: usb: Toggle the PHY power during init
    - [arm64] phy: rockchip: samsung-hdptx: Set drvdata before enabling runtime
      PM
    - [arm64] phy: rockchip: naneng-combphy: fix phy reset
    - ALSA: memalloc: prefer dma_mapping_error() over explicit address checking
    - [arm64,armhf] dmaengine: mv_xor: fix child node refcount handling in early
      exit
    - [amd64] dmaengine: dw: Select only supported masters for ACPI devices
    - dmaengine: amd: qdma: Remove using the private get and set dma_ops APIs
    - [arm64] dmaengine: fsl-edma: implement the cleanup path of
      fsl_edma3_attach_pd()
    - [amd64] ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP
    - [amd64] platform/chrome: cros_ec_lpc: fix product identity for early
      Framework Laptops
    - [amd64] ASoC: amd: ps: Fix for enabling DMIC on acp63 platform via _DSD
      entry
    - [amd64] ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 21QA and 21QB
    - ASoC: dt-bindings: realtek,rt5645: Fix CPVDD voltage comment
    - [amd64] ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 21Q6 and 21Q7
    - [powerpc*] pseries/vas: Add close() callback in vas_vm_ops struct
    - power: supply: bq24190: Fix BQ24296 Vbus regulator support
    - stddef: make __struct_group() UAPI C++-friendly
    - tracing/kprobe: Make trace_kprobe's module callback called after
      jump_label update
    - watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04
    - watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler
    - Revert "watchdog: s3c2410_wdt: use exynos_get_pmu_regmap_by_phandle() for
      PMU regs"
    - watchdog: mediatek: Add support for MT6735 TOPRGU/WDT
    - scsi: qla1280: Fix hw revision numbering for ISP1020/1040
    - scsi: megaraid_sas: Fix for a potential deadlock
    - udf: Skip parent dir link count update if corrupted
    - udf: Verify inode link counts before performing rename
    - ALSA: ump: Don't open legacy substream for an inactive group
    - ALSA: ump: Indicate the inactive group in legacy substream names
    - ALSA: ump: Update legacy substream names upon FB info update
    - ALSA: hda/conexant: fix Z60MR100 startup pop issue
    - ALSA: sh: Use standard helper for buffer accesses
    - smb: server: Fix building with GCC 15
    - regmap: Use correct format specifier for logging range errors
    - [x86] platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
    - bpf: Zero index arg error string for dynptr and iter
    - spi: intel: Add Panther Lake SPI controller support
    - scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver
      load time
    - scsi: mpi3mr: Synchronize access to ioctl data buffer
    - scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
    - scsi: mpi3mr: Start controller indexing from 0
    - scsi: mpi3mr: Handling of fault code for insufficient power
    - scsi: storvsc: Do not flag MAINTENANCE_IN return of
      SRB_STATUS_DATA_OVERRUN as an error
    - ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A
    - [arm64,armhf] spi: omap2-mcspi: Fix the IS_ERR() bug for
      devm_clk_get_optional_enabled()
    - drm/dp_mst: Ensure mst_primary pointer is valid in
      drm_dp_mst_handle_up_req()
    - virtio-blk: don't keep queue frozen during system suspend
    - blk-mq: register cpuhp callback after hctx is added to xarray table
    - wifi: iwlwifi: be less noisy if the NIC is dead in S3
    - ublk: detach gendisk from ublk device if add_disk() fails
    - drm/xe: Take PM ref in delayed snapshot capture worker
    - drm/xe: Move the coredump registration to the worker thread
    - objtool: Add bch2_trans_unlocked_error() to bcachefs noreturns
    - freezer, sched: Report frozen tasks as 'D' instead of 'R'
    - [x86] perf/x86/intel/uncore: Add Clearwater Forest support
    - tracing: Constify string literal data member in struct trace_event_call
    - tracing: Prevent bad count for tracing_cpumask_write
    - rtla/timerlat: Fix histogram ALL for zero samples
    - io_uring/sqpoll: fix sqpoll error handling races
    - i2c: microchip-core: actually use repeated sends
    - [x86] fred: Clear WFE in missing-ENDBRANCH #CPs
    - virt: tdx-guest: Just leak decrypted memory on unrecoverable errors
    - PCI/MSI: Handle lack of irqdomain gracefully
    - [x86] perf/x86/intel: Fix bitmask of OCR and FRONTEND events for LNC
    - i2c: imx: add imx7d compatible string for applying erratum ERR007805
    - i2c: microchip-core: fix "ghost" detections
    - [x86] perf/x86/intel/ds: Add PEBS format 6
    - power: supply: cros_charge-control: add mutex for driver data
    - power: supply: cros_charge-control: allow start_threshold == end_threshold
    - power: supply: cros_charge-control: hide start threshold on v2 cmd
    - power: supply: gpio-charger: Fix set charge current limits
    - btrfs: fix race with memory mapped writes when activating swap file
    - btrfs: avoid monopolizing a core when activating a swap file
    - btrfs: fix swap file activation failure due to extents that used to be
      shared
    - btrfs: fix transaction atomicity bug when enabling simple quotas
    - btrfs: sysfs: fix direct super block member reads
    - btrfs: fix use-after-free when COWing tree bock and tracing is enabled
    - btrfs: check folio mapping after unlock in put_file_data()
    - btrfs: check folio mapping after unlock in relocate_one_folio()
    - Bluetooth: btusb: mediatek: move Bluetooth power off command position
    - Bluetooth: btusb: mediatek: add callback function in btusb_disconnect
    - Bluetooth: btusb: mediatek: add intf release flow when usb disconnect
    - Bluetooth: btusb: mediatek: change the conditions for ISO interface
    - ALSA: ump: Shut up truncated string warning
    - ALSA: sh: Fix wrong argument order for copy_from_iter()

  [ Salvatore Bonaccorso ]
  * debian/salsa-ci.yml: Include run of .build-after-script from common
    pipeline.
  * nfsd: fix legacy client tracking initialization (Closes: #1087900)
  * drivers/nvme/host: Enable NVME_HOST_AUTH
  * drivers/nvme/target: Enable NVME_TARGET_AUTH
  * drivers/nvme/host: Enable NVME_TCP_TLS
  * drivers/nvme/target: Enable NVME_TARGET_TCP_TLS
  * debian/salsa-ci.yml: Reference .build-after-script from after_script
    section

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 02 Jan 2025 17:09:32 +0100

linux (6.12.6-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.6
    - [arm64] usb: misc: onboard_usb_dev: skip suspend/resume sequence for
      USB5744 SMBus support
    - serial: sh-sci: Check if TX data was written to device in .tx_empty()
    - bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
    - sched/deadline: Fix replenish_dl_new_period dl_server condition
    - [x86] perf/x86/intel/ds: Unconditionally drain PEBS DS when changing
      PEBS_DATA_CFG
    - ksmbd: fix racy issue from session lookup and expire
    - splice: do not checksum AF_UNIX sockets
    - tcp: check space before adding MPTCP SYN options
    - perf ftrace: Fix undefined behavior in cmp_profile_data()
    - virtio_net: correct netdev_tx_reset_queue() invocation point
    - virtio_ring: add a func argument 'recycle_done' to virtqueue_resize()
    - virtio_net: ensure netdev_tx_reset_queue is called on tx ring resize
    - [riscv64] mm: Do not call pmd dtor on vmemmap page table teardown
    - [riscv64] Fix wrong usage of __pa() on a fixmap address
    - blk-cgroup: Fix UAF in blkcg_unpin_online()
    - block: Switch to using refcount_t for zone write plugs
    - block: Use a zone write plug BIO work for REQ_NOWAIT BIOs
    - dm: Fix dm-zoned-reclaim zone write pointer alignment
    - block: Prevent potential deadlocks in zone write plug error recovery
    - gpio: graniterapids: Fix GPIO Ack functionality
    - memcg: slub: fix SUnreclaim for post charged objects
    - spi: rockchip: Fix PM runtime count on no-op cs
    - gpio: ljca: Initialize num before accessing item in ljca_gpio_config
    - ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5
    - ALSA: hda/realtek: Fix headset mic on Acer Nitro 5
    - [riscv64] Fix IPIs usage in kfence_protect_page()
    - drm/panic: remove spurious empty line to clean warning
    - usb: host: max3421-hcd: Correctly abort a USB request.
    - block: Ignore REQ_NOWAIT for zone reset and zone finish operations
    - gpio: graniterapids: Fix vGPIO driver crash
    - gpio: graniterapids: Fix incorrect BAR assignment
    - gpio: graniterapids: Fix invalid GPI_IS register offset
    - gpio: graniterapids: Fix invalid RXEVCFG register bitmask
    - gpio: graniterapids: Determine if GPIO pad can be used by driver
    - gpio: graniterapids: Check if GPIO line can be used for IRQs
    - usb: core: hcd: only check primary hcd skip_phy_initialization
    - bpf: Revert "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL"
    - ata: sata_highbank: fix OF node reference leak in
      highbank_initialize_phys()
    - usb: dwc2: Fix HCD resume
    - usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
    - usb: dwc2: Fix HCD port connection race
    - scsi: ufs: core: Update compl_time_stamp_local_clock after completing a
      cqe
    - usb: gadget: midi2: Fix interpretation of is_midi1 bits
    - usb: ehci-hcd: fix call balance of clocks handling routines
    - usb: typec: anx7411: fix fwnode_handle reference leak
    - usb: dwc3: imx8mp: fix software node kernel dump
    - usb: typec: anx7411: fix OF node reference leaks in
      anx7411_typec_switch_probe()
    - usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to
      accessing null pointer
    - usb: typec: ucsi: Fix completion notifications
    - usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode
    - [amd64] iommu/vt-d: Remove cache tags before disabling ATS
    - [amd64] iommu/vt-d: Fix qi_batch NULL pointer with nested parent domain
    - drm/xe: Call invalidation_fence_fini for PT inval fences in error state
    - [amd64] drm/i915: Fix memory leak by correcting cache object name in error
      handler
    - [amd64] drm/i915/color: Stop using non-posted DSB writes for legacy LUT
    - [amd64] drm/i915: Fix NULL pointer dereference in capture_engine
    - drm/amdgpu: fix UVD contiguous CS mapping problem
    - drm/amd/pm: Set SMU v13.0.7 default workload type
    - drm/amdgpu: fix when the cleaner shader is emitted
    - drm/amdkfd: Dereference null return value
    - drm/amdkfd: hard-code cacheline size for gfx11
    - drm/amdkfd: hard-code MALL cacheline size for gfx11, gfx12
    - xfs: set XFS_SICK_INO_SYMLINK_ZAPPED explicitly when zapping a symlink
    - xfs: update btree keys correctly when _insrec splits an inode root block
    - xfs: don't drop errno values when we fail to ficlone the entire range
    - xfs: return a 64-bit block count from xfs_btree_count_blocks
    - xfs: fix null bno_hint handling in xfs_rtallocate_rtg
    - xfs: return from xfs_symlink_verify early on V4 filesystems
    - xfs: fix scrub tracepoints when inode-rooted btrees are involved
    - xfs: only run precommits once per transaction object
    - xfs: unlock inodes when erroring out of xfs_trans_alloc_dir
    - bpf: Check size for BTF-based ctx access of pointer members
    - bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
    - bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
    - bpf, sockmap: Fix race between element replace and close()
    - bpf, sockmap: Fix update element with same
    - bpf: Augment raw_tp arguments with PTR_MAYBE_NULL
    - perf tools: Fix build-id event recording
    - wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
    - wifi: mac80211: init cnt before accessing elem in
      ieee80211_copy_mbssid_beacon
    - wifi: mac80211: fix a queue stall in certain cases of CSA
    - wifi: mac80211: fix station NSS capability initialization order
    - perf machine: Initialize machine->env to address a segfault
    - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
    - amdgpu/uvd: get ring reference from rq scheduler
    - batman-adv: Do not send uninitialized TT changes
    - batman-adv: Remove uninitialized data in full table TT response
    - batman-adv: Do not let TT changes list grows indefinitely
    - tipc: fix NULL deref in cleanup_bearer()
    - net/mlx5: DR, prevent potential error pointer dereference
    - wifi: cfg80211: sme: init n_channels before channels[] access
    - ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from
      kvm_arch_ptp_init()
    - bnxt_en: Fix GSO type for HW GRO packets on 5750X chips
    - net: lapb: increase LAPB_HEADER_LEN
    - net: defer final 'struct net' free in netns dismantle
    - [arm64] net: mscc: ocelot: fix memory leak on
      ocelot_port_add_txtstamp_skb()
    - [arm64] net: mscc: ocelot: improve handling of TX timestamp for unknown
      skb
    - [arm64] net: mscc: ocelot: ocelot->ts_id_lock and
      ocelot_port->tx_skbs.lock are IRQ-safe
    - [arm64] net: mscc: ocelot: be resilient to loss of PTP packets during
      transmission
    - [arm64] net: mscc: ocelot: perform error cleanup in ocelot_hwstamp_set()
    - regulator: axp20x: AXP717: set ramp_delay
    - spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user()
    - net: sparx5: fix FDMA performance issue
    - net: sparx5: fix the maximum frame length register
    - ACPI: resource: Fix memory resource type union access
    - cxgb4: use port number to set mac addr
    - qca_spi: Fix clock speed for multiple QCA7000
    - qca_spi: Make driver probing reliable
    - ALSA: control: Avoid WARN() for symlink errors
    - [amd64] ASoC: amd: yc: Fix the wrong return value
    - Documentation: PM: Clarify pm_runtime_resume_and_get() return value
    - block: get wp_offset by bdev_offset_from_zone_start
    - bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
    - Documentation: networking: Add a caveat to nexthop_compat_mode sysctl
    - cifs: Fix rmdir failure due to ongoing I/O on deleted file
    - ASoC: tas2781: Fix calibration issue in stress test
    - Bluetooth: Improve setsockopt() handling of malformed user input
    - libperf: evlist: Fix --cpu argument on hybrid platform
    - ASoC: fsl_xcvr: change IFACE_PCM to IFACE_MIXER
    - ASoC: fsl_spdif: change IFACE_PCM to IFACE_MIXER
    - netfilter: IDLETIMER: Fix for possible ABBA deadlock
    - netfilter: nf_tables: do not defer rule destruction via call_rcu
    - net: mana: Fix memory leak in mana_gd_setup_irqs
    - net: mana: Fix irq_contexts memory leak in mana_gd_setup_irqs
    - net: dsa: felix: fix stuck CPU-injected packets with short taprio windows
    - net/sched: netem: account for backlog updates from child qdisc
    - net, team, bonding: Add netdev_base_features helper
    - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features
    - bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
    - team: Fix initial vlan_feature set in __team_compute_features
    - team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
    - [x86] ASoC: Intel: sof_sdw: Add space for a terminator into DAIs array
    - ACPICA: events/evxfregn: don't release the ContextMutex that was never
      acquired
    - Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
    - Bluetooth: iso: Always release hdev at the end of iso_listen_bis
    - Bluetooth: iso: Fix recursive locking warning
    - Bluetooth: SCO: Add support for 16 bits transparent voice setting
    - Bluetooth: iso: Fix circular lock in iso_listen_bis
    - Bluetooth: iso: Fix circular lock in iso_conn_big_sync
    - Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
    - net: dsa: microchip: KSZ9896 register regmap alignment to 32 bit
      boundaries
    - net: dsa: tag_ocelot_8021q: fix broken reception
    - drm/xe: fix the ERR_PTR() returned on failure to allocate tiny pt
    - drm/xe/reg_sr: Remove register pool
    - blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
    - blk-mq: move cpuhp callback registering out of q->sysfs_lock
    - block: Fix potential deadlock while freezing queue and acquiring
      sysfs_lock
    - [arm64] KVM: arm64: Disable MPAM visibility by default and ignore VMM
      writes
    - xen/netfront: fix crash when removing device (CVE-2024-53240)
    - [x86] make get_cpu_vendor() accessible from Xen code (CVE-2024-53241)
    - [x86] objtool/x86: allow syscall instruction ((CVE-2024-53241)
    - [x86] static-call: provide a way to do very early static-call updates
      (CVE-2024-53241)
    - [x86] xen: don't do PV iret hypercall through hypercall page
      (CVE-2024-53241)
    - [x86] xen: add central hypercall functions (CVE-2024-53241)
    - [x86] xen: use new hypercall functions instead of hypercall page
      (CVE-2024-53241)
    - [x86] xen: remove hypercall page (CVE-2024-53241)
    - [x86] static-call: fix 32-bit build

  [ Uwe Kleine-König ]
  * [arm64] Enable rx8025 driver as module.

  [ Salvatore Bonaccorso ]
  * drivers/block/zram: Enable lz4, lz4hc and zstd compression support
    - Enable ZRAM_BACKEND_LZ4, ZRAM_BACKEND_LZ4HC and ZRAM_BACKEND_ZSTD
    (Closes: #1086172)
  * drivers/block/zram: Enable ZRAM_BACKEND_DEFLATE
  * drivers/hwmon: Enable SENSORS_SPD5118 as module (Closes: #1090071)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 21 Dec 2024 09:13:54 +0100

linux (6.12.5-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.4
    - xfs: remove unknown compat feature check in superblock write validation
    - quota: flush quota_release_work upon quota writeback
    - btrfs: drop unused parameter file_offset from
      btrfs_encoded_read_regular_fill_pages()
    - btrfs: change btrfs_encoded_read() so that reading of extent is done by
      caller
    - btrfs: move priv off stack in btrfs_encoded_read_regular_fill_pages()
    - btrfs: fix use-after-free in btrfs_encoded_read_endio()
    - btrfs: don't loop for nowait writes when checking for cross references
    - btrfs: add a sanity check for btrfs root in btrfs_search_slot()
    - btrfs: ref-verify: fix use-after-free after invalid ref action
    - netkit: Add option for scrubbing skb meta data
    - md/raid5: Wait sync io to finish before changing group cnt
    - md/md-bitmap: Add missing destroy_work_on_stack()
    - [arm64] dts: allwinner: pinephone: Add mount matrix to accelerometer
    - [arm64] dts: mediatek: mt8186-corsola: Fix GPU supply coupling max-spread
    - [arm64] dts: freescale: imx8mm-verdin: Fix SD regulator startup delay
    - [arm64] dts: ti: k3-am62-verdin: Fix SD regulator startup delay
    - [arm64] dts: mediatek: mt8186-corsola: Fix IT6505 reset line polarity
    - [arm64] dts: freescale: imx8mp-verdin: Fix SD regulator startup delay
    - media: platform: rga: fix 32-bit DMA limitation
    - [arm64,armhf] media: verisilicon: av1: Fix reference video buffer pointer
      assignment
    - media: ts2020: fix null-ptr-deref in ts2020_probe()
    - efi/libstub: Free correct pointer on failure
    - net: phy: dp83869: fix status reporting for 1000base-x autonegotiation
    - [arm64] media: venus: Fix pm_runtime_set_suspended() with runtime pm
      enabled
    - media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
    - [amd64] media: ov08x40: Fix burst write sequence
    - media: uvcvideo: Stop stream during unregister
    - media: uvcvideo: Require entities to have a non-zero unique ID
    - tracing: Fix function timing profiler to initialize hashtable
    - kunit: Fix potential null dereference in kunit_device_driver_test()
    - kunit: string-stream: Fix a UAF bug in kunit_init_suite()
    - ovl: Filter invalid inodes with missing lookup function
    - maple_tree: refine mas_store_root() on storing NULL
    - ftrace: Fix regression with module command in stack_trace_filter
    - vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
    - zram: clear IDLE flag after recompression
    - [arm64,armhf] iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated
      tables
    - [arm64] iommu/arm-smmu: Defer probe of clients after smmu device bound
    - mm/damon/vaddr: fix issue in damon_va_evenly_split_region()
    - [powerpc*] vdso: Drop -mstack-protector-guard flags in 32-bit files with
      clang
    - cpufreq: scmi: Fix cleanup path when boost enablement fails
    - clk: qcom: gcc-qcs404: fix initial rate of GPLL3
    - ad7780: fix division by zero in ad7780_write_raw()
    - nvmem: core: Check read_only flag for force_ro in bin_attr_nvmem_write()
    - driver core: fw_devlink: Stop trying to optimize cycle detection logic
    - spmi: pmic-arb: fix return path in for_each_available_child_of_node()
    - [armel,armhf] 9429/1: ioremap: Sync PGDs for VMALLOC shadow
    - [s390x] entry: Mark IRQ entries to fix stack depot warnings
    - [armel,armhf] 9430/1: entry: Do a dummy read from VMAP shadow
    - [armel,armhf] 9431/1: mm: Pair atomic_set_release() with _read_acquire()
    - net: stmmac: set initial EEE policy configuration
    - vfio/qat: fix overflow check in qat_vf_resume_write()
    - [arm64] PCI: qcom: Disable ASPM L0s for X1E80100
    - perf jevents: fix breakage when do perf stat on system metric
    - remoteproc: qcom_q6v5_pas: disable auto boot for wpss
    - [arm64,armhf] PCI: imx6: Fix suspend/resume support on i.MX6QDL
    - mm/slub: Avoid list corruption when removing a slab from the full list
    - f2fs: fix to drop all discards after creating snapshot on lvm device
    - ceph: extract entity name from device id
    - ceph: pass cred pointer to ceph_mds_auth_match()
    - ceph: fix cred leak in ceph_mds_check_access()
    - [arm64] mtd: spinand: winbond: Fix 512GW and 02JW OOB layout
    - [arm64] mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC
      information
    - util_macros.h: fix/rework find_closest() macros
    - [s390x] stacktrace: Use break instead of return statement
    - scsi: ufs: exynos: Add check inside exynos_ufs_config_smu()
    - scsi: ufs: exynos: Fix hibern8 notify callbacks
    - i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled
    - i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
    - i3c: master: svc: fix possible assignment of the same address to two
      devices
    - i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable
      counter
    - slab: Fix too strict alignment check in create_cache()
    - fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful
      iov_iter_zero
    - thermal: int3400: Fix reading of current_uuid for active policy
    - leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error
      paths
    - ovl: properly handle large files in ovl_security_fileattr
    - mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual
      address into one operation
    - dm: Fix typo in error message
    - dm thin: Add missing destroy_work_on_stack()
    - PCI: dwc: ep: Fix advertised resizable BAR size regression
    - PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI
      nodes
    - PCI: rockchip-ep: Fix address translation unit programming
    - nfsd: make sure exp active before svc_export_show
    - nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
    - iio: accel: kx022a: Fix raw read format
    - iio: invensense: fix multiple odr switch when FIFO is off
    - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name()
    - iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
    - iio: gts: fix infinite loop for gain_to_scaletables()
    - [powerpc*] Fix stack protector Kconfig test for clang
    - [powerpc*] Adjust adding stack protector flags to KBUILD_CLAGS for clang
    - [arm*] binder: fix node UAF in binder_add_freeze_work()
    - [arm*] binder: fix OOB in binder_add_freeze_work()
    - [arm*] binder: fix freeze UAF in binder_release_work()
    - [arm*] binder: fix BINDER_WORK_FROZEN_BINDER debug logs
    - [arm*] binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs
    - [arm*] binder: allow freeze notification for dead nodes
    - [arm*] binder: fix memleak of proc->delivered_freeze
    - [arm*] binder: add delivered_freeze to debugfs output
    - dt-bindings: net: fec: add pps channel property
    - [arm64,armhf] net: fec: refactor PPS channel configuration
    - [arm64,armhf] net: fec: make PPS channel configurable
    - drm/panic: Fix uninitialized spinlock acquisition with CONFIG_DRM_PANIC=n
    - drm/sti: avoid potential dereference of error pointers in
      sti_hqvdp_atomic_check
    - drm/sti: avoid potential dereference of error pointers in
      sti_gdp_atomic_check
    - drm: panel: jd9365da-h3: Remove unused num_init_cmds structure member
    - drm/sti: avoid potential dereference of error pointers
    - drm/fbdev-dma: Select FB_DEFERRED_IO
    - [arm64] drm/mediatek: Fix child node refcount handling in early exit
    - drm/bridge: it6505: Fix inverted reset polarity
    - [arm64,armhf] drm/etnaviv: flush shader L1 cache after user commandstream
    - drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs
    - drm/xe/migrate: fix pat index usage
    - Revert "drm/radeon: Delay Connector detecting when HPD singals is
      unstable"
    - drm/xe/migrate: use XE_BO_FLAG_PAGETABLE
    - drm/xe/guc_submit: fix race around suspend_pending
    - drm/amdgpu/pm: add gen5 display to the user on smu v14.0.2/3
    - drm/amd: Add some missing straps from NBIO 7.11.0
    - drm/amdgpu: fix usage slab after free
    - drm/amd/pm: skip setting the power source on smu v14.0.2/3
    - drm/amd: Fix initialization mistake for NBIO 7.11 devices
    - drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu
      v13.0.7
    - drm/amd/pm: disable pcie speed switching on Intel platform for smu
      v14.0.2/3
    - drm/amd/pm: Remove arcturus min power limit
    - drm/amd/display: Fix handling of plane refcount
    - drm/amd/display: update pipe selection policy to check head pipe
    - drm/amd/display: Remove PIPE_DTO_SRC_SEL programming from set_dtbclk_dto
    - posix-timers: Target group sigqueue to current task only if not exiting
    - Revert "drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.5
    - [amd64] iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
    - [arm64] watchdog: mediatek: Make sure system reset gets asserted in
      mtk_wdt_restart()
    - can: gs_usb: add usb endpoint address detection at driver probe step
    - can: c_can: c_can_handle_bus_err(): update statistics if skb allocation
      fails
    - can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is
      NULL
    - can: hi311x: hi3110_can_ist(): fix potential use-after-free
    - can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics
    - can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics
    - can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
    - can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
    - can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
    - can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
    - can: f81604: f81604_handle_can_bus_errors(): fix {rx,tx}_errors statistics
    - ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
    - netfilter: x_tables: fix LED ID check in led_tg_check()
    - netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
    - [arm64] net: enetc: Do not configure preemptible TCs if SIs do not support
    - ptp: Add error handling for adjfine callback in ptp_clock_adjtime
    - net/sched: tbf: correct backlog statistic for GSO packets
    - net: hsr: avoid potential out-of-bound access in fill_frame_info()
    - bnxt_en: ethtool: Supply ntuple rss context action
    - net: Fix icmp host relookup triggering ip_rt_bug
    - ipv6: avoid possible NULL deref in modify_prefix_route()
    - can: j1939: j1939_session_new(): fix skb reference counting
    - [x86] platform/x86: asus-wmi: Ignore return value when writing thermal
      policy
    - net: phy: microchip: Reset LAN88xx PHY to ensure clean link state on
      LAN7800/7850
    - net/ipv6: release expired exception dst cached in socket
    - dccp: Fix memory leak in dccp_feat_change_recv
    - tipc: Fix use-after-free of kernel socket in cleanup_bearer().
    - net/smc: initialize close_work early to avoid warning
    - net/smc: fix LGR and link use-after-free issue
    - net/qed: allow old cards not supporting "num_images" to work
    - net: hsr: must allocate more bytes for RedBox support
    - ice: fix PHY Clock Recovery availability check
    - ice: fix PHY timestamp extraction for ETH56G
    - ice: Fix VLAN pruning in switchdev mode
    - idpf: set completion tag for "empty" bufs associated with a packet
    - ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5
    - ixgbe: downgrade logging of unsupported VF API version to debug
    - ixgbe: Correct BASE-BX10 compliance code
    - igb: Fix potential invalid memory access in igb_init_module()
    - netfilter: nft_inner: incorrect percpu area handling under softirq
    - Revert "udp: avoid calling sock_def_readable() if possible"
    - net: sched: fix erspan_opt settings in cls_flower
    - netfilter: ipset: Hold module reference while requesting a module
    - netfilter: nft_set_hash: skip duplicated elements pending gc run
    - ethtool: Fix wrong mod state in case of verbose and no_mask bitset
    - geneve: do not assume mac header is set in geneve_xmit_skb()
    - net/mlx5: HWS: Fix memory leak in mlx5hws_definer_calc_layout
    - net/mlx5: HWS: Properly set bwc queue locks lock classes
    - net/mlx5e: SD, Use correct mdev to build channel param
    - net/mlx5e: Remove workaround to avoid syndrome for internal port
    - net: avoid potential UAF in default_operstate()
    - gpio: grgpio: use a helper variable to store the address of ofdev->dev
    - gpio: grgpio: Add NULL check in grgpio_probe
    - [arm64] mmc: mtk-sd: use devm_mmc_alloc_host
    - [arm64] mmc: mtk-sd: Fix error handle of probe function
    - [arm64] mmc: mtk-sd: fix devm_clk_get_optional usage
    - [arm64] mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting
    - mmc: sd: SDUC Support Recognition
    - mmc: core: Adjust ACMD22 to SDUC
    - mmc: core: Use GFP_NOIO in ACMD22
    - zram: do not mark idle slots that cannot be idle
    - zram: clear IDLE flag in mark_idle()
    - ntp: Remove invalid cast in time offset math
    - f2fs: clean up w/ F2FS_{BLK_TO_BYTES,BTYES_TO_BLK}
    - f2fs: fix to adjust appropriate length for fiemap
    - f2fs: fix to requery extent which cross boundary of inquiry
    - i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS
    - i3c: master: Extend address status bit to 4 and add
      I3C_ADDR_SLOT_EXT_DESIRED
    - i3c: master: Fix dynamic address leak when 'assigned-address' is present
    - drm/amd/display: calculate final viewport before TAP optimization
    - drm/amd/display: Ignore scalar validation failure if pipe is phantom
    - scsi: ufs: core: Always initialize the UIC done completion
    - scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG
    - bpf, vsock: Fix poll() missing a queue
    - bpf, vsock: Invoke proto::close on close()
    - xsk: always clear DMA mapping information when unmapping the pool
    - bpftool: fix potential NULL pointer dereferencing in prog_dump()
    - drm/sti: Add __iomem for mixer_dbg_mxn's parameter
    - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
    - ALSA: seq: ump: Fix seq port updates per FB info notify
    - ALSA: usb-audio: Notify xrun for low-latency mode
    - tools: Override makefile ARCH variable if defined, but empty
    - spi: mpc52xx: Add cancel_work_sync before module remove
    - [adm64,arm64] ASoC: SOF: ipc3-topology: Convert the topology pin index to
      ALH dai index
    - [amd64,arm64] ASoC: SOF: ipc3-topology: fix resource leaks in
      sof_ipc3_widget_setup_comp_dai()
    - pmdomain: core: Add missing put_device()
    - pmdomain: core: Fix error path in pm_genpd_init() when ida alloc fails
    - nvme: don't apply NVME_QUIRK_DEALLOCATE_ZEROES when DSM is not supported
    - [x86] pkeys: Change caller of update_pkru_in_sigframe()
    - [x86] pkeys: Ensure updated PKRU value is XRSTOR'd
    - bpf: Ensure reg is PTR_TO_STACK in process_iter_arg
    - irqchip/stm32mp-exti: CONFIG_STM32MP_EXTI should not default to y when
      compile-testing
    - drivers/virt: pkvm: Don't fail ioremap() call if MMIO_GUARD fails
    - bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc
    - bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
    - nvme-fabrics: handle zero MAXCMD without closing the connection
    - nvme-tcp: fix the memleak while create new ctrl failed
    - nvme-rdma: unquiesce admin_q before destroy it
    - scsi: sg: Fix slab-use-after-free read in sg_release()
    - scsi: scsi_debug: Fix hrtimer support for ndelay
    - [arm64] drm/v3d: Enable Performance Counters before clearing them
    - ocfs2: free inode when ocfs2_get_init_inode() fails
    - scatterlist: fix incorrect func name in kernel-doc
    - iio: magnetometer: yas530: use signed integer type for clamp limits
    - smb: client: fix potential race in cifs_put_tcon()
    - bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
    - bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem
    - bpf: Handle in-place update for full LPM trie correctly
    - bpf: Fix exact match conditions in trie_get_next_key()
    - [x86] CPU/AMD: WARN when setting EFER.AUTOIBRS if and only if the WRMSR
      fails
    - HID: i2c-hid: Revert to using power commands to wake on resume
    - HID: wacom: fix when get product name maybe null pointer
    - ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
    - ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
    - watchdog: rti: of: honor timeout-sec property
    - can: dev: can_set_termination(): allow sleeping GPIOs
    - can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum DS80000789E
      6.
    - tracing: Fix cmp_entries_dup() to respect sort() comparison rules
    - net :mana :Request a V2 response version for MANA_QUERY_GF_STAT
    - iommufd: Fix out_fput in iommufd_fault_alloc()
    - [arm64] mm: Fix zone_dma_limit calculation
    - [arm64] Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit
      ASIDs
    - [arm64] ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
    - [arm64] ptrace: fix partial SETREGSET for NT_ARM_FPMR
    - [arm64] ptrace: fix partial SETREGSET for NT_ARM_POE
    - ALSA: usb-audio: Fix a DMA to stack memory bug
    - ALSA: usb-audio: Add extra PID for RME Digiface USB
    - ALSA: hda/realtek: fix micmute LEDs don't work on HP Laptops
    - ALSA: usb-audio: add mixer mapping for Corsair HS80
    - ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8
    - ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG)
    - scsi: qla2xxx: Fix abort in bsg timeout
    - scsi: qla2xxx: Fix NVMe and NPIV connect issue
    - scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
    - scsi: qla2xxx: Fix use after free on unload
    - scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
    - scsi: ufs: core: sysfs: Prevent div by zero
    - scsi: ufs: core: Cancel RTC work during ufshcd_remove()
    - scsi: ufs: qcom: Only free platform MSIs when ESI is enabled
    - scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers
    - scsi: ufs: core: Add missing post notify for power mode change
    - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
    - fs/smb/client: avoid querying SMB2_OP_QUERY_WSL_EA for SMB3 POSIX
    - fs/smb/client: Implement new SMB3 POSIX type
    - fs/smb/client: cifs_prime_dcache() for SMB3 POSIX reparse points
    - smb3.1.1: fix posix mounts to older servers
    - io_uring: Change res2 parameter type in io_uring_cmd_done
    - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
    - Revert "readahead: properly shorten readahead when falling back to
      do_page_cache_ra()"
    - pmdomain: imx: gpcv2: Adjust delay after power up handshake
    - cacheinfo: Allocate memory during CPU hotplug if not done from the primary
      CPU
    - [x86] cacheinfo: Delete global num_cache_leaves
    - drm/dp_mst: Fix MST sideband message body length check
    - drm/amd/pm: fix and simplify workload handling
    - drm/dp_mst: Verify request type in the corresponding down message reply
    - drm/dp_mst: Fix resetting msg rx state after topology removal
    - drm/amd/display: Correct prefetch calculation
    - drm/amd/display: Limit VTotal range to max hw cap minus fp
    - drm/amd/display: Add a left edge pixel if in YCbCr422 or YCbCr420 and odm
    - drm/amdgpu/hdp6.0: do a posting read when flushing HDP
    - drm/amdgpu/hdp4.0: do a posting read when flushing HDP
    - drm/amdgpu/hdp5.0: do a posting read when flushing HDP
    - drm/amdgpu/hdp7.0: do a posting read when flushing HDP
    - drm/amdgpu/hdp5.2: do a posting read when flushing HDP
    - modpost: Add .irqentry.text to OTHER_SECTIONS
    - [x86] kexec: Restore GDT on return from ::preserve_context kexec
    - bpf: fix OOB devmap writes when deleting elements
    - dma-buf: fix dma_fence_array_signaled v4
    - dma-fence: Fix reference leak on fence merge failure path
    - dma-fence: Use kernel's sort for merging fences
    - xsk: fix OOB map writes when deleting elements
    - regmap: detach regmap from dev on regmap_exit
    - arch_numa: Restore nid checks before registering a memblock with a node
    - mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10
      tablet
    - mmc: core: Further prevent card detect during shutdown
    - [x86] cpu: Add Lunar Lake to list of CPUs with a broken MONITOR
      implementation
    - ocfs2: update seq_file index in ocfs2_dlm_seq_next
    - stackdepot: fix stack_depot_save_flags() in NMI context
    - lib: stackinit: hide never-taken branch from compiler
    - sched/numa: fix memory leak due to the overwritten vma->numab_state
    - kasan: make report_lock a raw spinlock
    - mm/gup: handle NULL pages in unpin_user_pages()
    - mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in
      a MM
    - [x86] cpu/topology: Remove limit of CPUs due to disabled IO/APIC
    - [x86] mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page
      tables
    - mm/damon: fix order of arguments in damos_before_apply tracepoint
    - mm: memcg: declare do_memsw_account inline
    - mm: open-code PageTail in folio_flags() and const_folio_flags()
    - mm: open-code page_folio() in dump_page()
    - mm: fix vrealloc()'s KASAN poisoning logic
    - mm: respect mmap hint address when aligning for THP
    - scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove()
    - memblock: allow zero threshold in validate_numa_converage()
    - [s390x] pci: Sort PCI functions prior to creating virtual busses
    - [s390x] pci: Use topology ID for multi-function devices
    - [s390x] pci: Ignore RID for isolated VFs
    - epoll: annotate racy check
    - [s390x] cpum_sf: Handle CPU hotplug remove during sampling
    - block: RCU protect disk->conv_zones_bitmap
    - btrfs: don't take dev_replace rwsem on task already holding it
    - btrfs: avoid unnecessary device path update for the same device
    - btrfs: canonicalize the device path before adding it
    - btrfs: do not clear read-only when adding sprout device
    - ext4: partial zero eof block on unaligned inode size extension
    - crypto: ecdsa - Avoid signed integer overflow on signature decoding
    - kcsan: Turn report_filterlist_lock into a raw_spinlock
    - hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list
    - [x86] ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID
    - [x86] ACPI: x86: Add adev NULL check to
      acpi_quirk_skip_serdev_enumeration()
    - ACPI: video: force native for Apple MacbookPro11,2 and Air7,2
    - [x86] perf/x86/amd: Warn only on new bits set
    - cleanup: Adjust scoped_guard() macros to avoid potential warning
    - iio: magnetometer: fix if () scoped_guard() formatting
    - timekeeping: Always check for negative motion
    - gpio: free irqs that are still requested when the chip is being removed
    - spi: spi-fsl-lpspi: Adjust type of scldiv
    - soc: qcom: llcc: Use designated initializers for LLC settings
    - HID: add per device quirk to force bind to hid-generic
    - [arm64] firmware: qcom: scm: Allow QSEECOM on Lenovo Yoga Slim 7x
    - [arm64] soc: qcom: pd-mapper: Add QCM6490 PD maps
    - media: uvcvideo: RealSense D421 Depth module metadata
    - media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
    - media: uvcvideo: Force UVC version to 1.0a for 0408:4033
    - media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
    - mmc: core: Add SD card quirk for broken poweroff notification
    - mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED
    - [arm64] firmware: qcom: scm: Allow QSEECOM on Dell XPS 13 9345
    - soc: imx8m: Probe the SoC driver as platform driver
    - regmap: maple: Provide lockdep (sub)class for maple tree's internal lock
    - sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl()
    - HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support
    - drm/xe/pciids: separate RPL-U and RPL-P PCI IDs
    - drm/xe/pciids: separate ARL and MTL PCI IDs
    - [arm*] drm/vc4: hdmi: Avoid log spam for audio start failure
    - [arm*] drm/vc4: hvs: Set AXI panic modes for the HVS
    - drm/xe/pciids: Add PVC's PCI device ID macros
    - wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
    - drm/xe/pciid: Add new PCI id for ARL
    - drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
    - drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition
    - drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK
    - drm/bridge: it6505: Enable module autoloading
    - drm/mcde: Enable module autoloading
    - wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
    - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
    - drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
    - [x86] ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for
      MTL.
    - dlm: fix possible lkb_resource null dereference
    - drm/amd/display: skip disable CRTC in seemless bootup case
    - drm/amd/display: Fix garbage or black screen when resetting otg
    - drm/amd/display: disable SG displays on cyan skillfish
    - drm/xe/ptl: L3bank mask is not available on the media GT
    - drm/xe/xe3: Add initial set of workarounds
    - drm/display: Fix building with GCC 15
    - ALSA: hda: Use own quirk lookup helper
    - ALSA: hda/conexant: Use the new codec SSID matching
    - ALSA: hda/realtek: Use codec SSID matching for Lenovo devices
    - r8169: don't apply UDP padding quirk on RTL8126A
    - wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask()
    - accel/qaic: Add AIC080 support
    - drm/amd/display: Full exit out of IPS2 when all allow signals have been
      cleared
    - net: fec_mpc52xx_phy: Use %pa to format resource_size_t
    - net: ethernet: fs_enet: Use %pa to format resource_size_t
    - net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
    - af_packet: avoid erroring out after sock_init_data() in packet_create()
    - Bluetooth: L2CAP: do not leave dangling sk pointer on error in
      l2cap_sock_create()
    - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in
      rfcomm_sock_alloc()
    - net: af_can: do not leave a dangling sk pointer in can_create()
    - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
    - net: inet: do not leave a dangling sk pointer in inet_create()
    - net: inet6: do not leave a dangling sk pointer in inet6_create()
    - wifi: ath10k: avoid NULL pointer error during sdio remove
    - wifi: ath5k: add PCI ID for SX76X
    - wifi: ath5k: add PCI ID for Arcadyan devices
    - fanotify: allow reporting errors on failure to open fd
    - bpf: Prevent tailcall infinite loop caused by freplace
    - ASoC: sdw_utils: Add support for exclusion DAI quirks
    - ASoC: sdw_utils: Add a quirk to allow the cs42l43 mic DAI to be ignored
    - [x86] ASoC: Intel: sof_sdw: Add quirk for cs42l43 system using host DMICs
    - [x86] ASoC: Intel: sof_sdw: Add quirks for some new Lenovo laptops
    - drm/xe/guc/ct: Flush g2h worker in case of g2h response timeout
    - drm/panel: simple: Add Microchip AC69T88A LVDS Display panel
    - net: sfp: change quirks for Alcatel Lucent G-010S-P
    - net: stmmac: Programming sequence for VLAN packets with split header
    - drm/sched: memset() 'job' in drm_sched_job_init()
    - drm/amd/display: Adding array index check to prevent memory corruption
    - drm/amdgpu/gfx9: Add cleaner shader for GFX9.4.2
    - drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih
    - drm/amdgpu: Dereference the ATCS ACPI buffer
    - netlink: specs: Add missing bitset attrs to ethtool spec
    - drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
    - ASoC: sdw_utils: Add quirk to exclude amplifier function
    - [x86] ASoC: Intel: soc-acpi-intel-arl-match: Add rt722 and rt1320 support
    - drm/amd/display: Fix underflow when playing 8K video in full screen mode
    - mptcp: annotate data-races around subflow->fully_established
    - dma-debug: fix a possible deadlock on radix_lock
    - jfs: array-index-out-of-bounds fix in dtReadFirst
    - jfs: fix shift-out-of-bounds in dbSplit
    - jfs: fix array-index-out-of-bounds in jfs_readdir
    - jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
    - fsl/fman: Validate cell-index value obtained from Device Tree
    - net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals
    - drm/panic: Add ABGR2101010 support
    - drm/amd/display: Remove hw w/a toggle if on DP2/HPO
    - drm/amd/display: parse umc_info or vram_info based on ASIC
    - drm/amd/display: Prune Invalid Modes For HDMI Output
    - drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
    - virtio-net: fix overflow inside virtnet_rq_alloc
    - ALSA: usb-audio: Make mic volume workarounds globally applicable
    - drm/amdgpu: set the right AMDGPU sg segment limitation
    - wifi: ipw2x00: libipw_rx_any(): fix bad alignment
    - wifi: brcmfmac: Fix oops due to NULL pointer dereference in
      brcmf_sdiod_sglist_rw()
    - bpf: Call free_htab_elem() after htab_unlock_bucket()
    - mptcp: fix possible integer overflow in mptcp_reset_tout_timer
    - dsa: qca8k: Use nested lock to avoid splat
    - i2c: i801: Add support for Intel Panther Lake
    - Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions
    - Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
    - Bluetooth: btusb: Add USB HW IDs for MT7920/MT7925
    - Bluetooth: hci_conn: Use disable_delayed_work_sync
    - Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
    - Bluetooth: Add new quirks for ATS2851
    - Bluetooth: Support new quirks for ATS2851
    - Bluetooth: Set quirks for ATS2851
    - Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925
    - Bluetooth: btusb: Add new VID/PID 0489/e124 for MT7925
    - Bluetooth: btusb: Add 3 HWIDs for MT7925
    - ASoC: hdmi-codec: reorder channel allocation list
    - rocker: fix link status detection in rocker_carrier_init()
    - net/neighbor: clear error in case strict check is not set
    - netpoll: Use rcu_access_pointer() in __netpoll_setup
    - pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU
    - rtla: Fix consistency in getopt_long for timerlat_hist
    - tracing/ftrace: disable preemption in syscall probe
    - tracing: Use atomic64_inc_return() in trace_clock_counter()
    - tools/rtla: fix collision with glibc sched_attr/sched_set_attr
    - rtla/timerlat: Make timerlat_top_cpu->*_count unsigned long long
    - rtla/timerlat: Make timerlat_hist_cpu->*_count unsigned long long
    - scsi: hisi_sas: Add cond_resched() for no forced preemption model
    - scsi: hisi_sas: Create all dump files during debugfs initialization
    - ring-buffer: Limit time with disabled interrupts in rb_check_pages()
    - pinmux: Use sequential access to access desc->pinmux data
    - scsi: ufs: core: Make DMA mask configuration more flexible
    - iommu/amd: Fix corruption when mapping large pages from 0
    - bpf: put bpf_link's program when link is safe to be deallocated
    - scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths
    - scsi: lpfc: Check SLI_ACTIVE flag in FDMI cmpl before submitting follow up
      FDMI
    - scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo
      callback
    - clk: qcom: rcg2: add clk_rcg2_shared_floor_ops
    - clk: qcom: rpmh: add support for SAR2130P
    - clk: qcom: tcsrcc-sm8550: add SAR2130P support
    - clk: qcom: dispcc-sm8550: enable support for SAR2130P
    - clk: qcom: clk-alpha-pll: Add NSS HUAYRA ALPHA PLL support for ipq9574
    - leds: class: Protect brightness_show() with led_cdev->led_access mutex
    - scsi: st: Don't modify unknown block number in MTIOCGET
    - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
    - pinctrl: qcom-pmic-gpio: add support for PM8937
    - pinctrl: qcom: spmi-mpp: Add PM8937 compatible
    - thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens
    - nvdimm: rectify the illogical code within nd_dax_probe()
    - smb: client: memcpy() with surrounding object base address
    - tracing: Fix function name for trampoline
    - tools/rtla: Enhance argument parsing in timerlat_load.py
    - verification/dot2: Improve dot parser robustness
    - mailbox: pcc: Check before sending MCTP PCC response ACK
    - f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
    - i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
    - PCI: qcom: Add support for IPQ9574
    - PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs
    - PCI: vmd: Set devices to D0 before enabling PM L1 Substates
    - PCI: Detect and trust built-in Thunderbolt chips
    - PCI: starfive: Enable controller runtime PM before probing host bridge
    - PCI: Add 'reset_subordinate' to reset hierarchy below bridge
    - PCI: Add ACS quirk for Wangxun FF5xxx NICs
    - remoteproc: qcom: pas: enable SAR2130P audio DSP support
    - i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to
      avoid deadlock
    - f2fs: print message if fscorrupted was found in f2fs_new_node_page()
    - f2fs: fix to shrink read extent node in batches
    - f2fs: add a sysfs node to limit max read extent count per-inode
    - ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840
    - ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[]
    - fs/ntfs3: Fix warning in ni_fiemap
    - fs/ntfs3: Fix case when unmarked clusters intersect with zone
    - regulator: qcom-rpmh: Update ranges for FTSMPS525
    - usb: chipidea: add CI_HDRC_HAS_SHORT_PKT_LIMIT flag
    - usb: chipidea: udc: limit usb request length to max 16KB
    - usb: chipidea: udc: create bounce buffer for problem sglist entries if
      possible
    - usb: chipidea: udc: handle USB Error Interrupt if IOC not set
    - usb: typec: ucsi: Do not call ACPI _DSM method for UCSI read operations
    - iio: adc: ad7192: properly check spi_get_device_match_data()
    - iio: light: ltr501: Add LTER0303 to the supported devices
    - usb: typec: ucsi: glink: be more precise on orientation-aware ports
    - [amd64] ASoC: amd: yc: fix internal mic on Redmi G 2022
    - drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3
    - [amd64] ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s
      Gen 6 21M1CTO1WW (Closes: #1087673)
    - [powerpc*] prom_init: Fixup missing powermac #size-cells
    - misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
    - rtc: cmos: avoid taking rtc_lock for extended period of time
    - serial: 8250_dw: Add Sophgo SG2044 quirk
    - Revert "nvme: make keep-alive synchronous operation"
    - irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
    - smb: client: don't try following DFS links in cifs_tree_connect()
    - setlocalversion: work around "git describe" performance
    - io_uring/tctx: work around xa_store() allocation error issue
    - scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()
    - drm/xe/devcoredump: Use drm_puts and already cached local variables
    - drm/xe/devcoredump: Improve section headings and add tile info
    - drm/xe/devcoredump: Add ASCII85 dump helper function
    - drm/xe/guc: Copy GuC log prior to dumping
    - drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()
    - drm/xe/devcoredump: Update handling of xe_force_wake_get return
    - drm/amd/display: Add option to retrieve detile buffer size
    - sched: fix warning in sched_setaffinity
    - sched/core: Remove the unnecessary need_resched() check in nohz_csd_func()
    - sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU
      turning busy
    - sched/core: Prevent wakeup of ksoftirqd during idle load balance
    - sched/deadline: Fix warning in migrate_enable for boosted tasks
    - btrfs: drop unused parameter options from open_ctree()
    - btrfs: drop unused parameter data from btrfs_fill_super()
    - btrfs: fix mount failure due to remount races
    - btrfs: fix missing snapshot drew unlock when root is dead during swap
      activation
    - clk: en7523: Initialize num before accessing hws in
      en7523_register_clocks()
    - tracing/eprobe: Fix to release eprobe when failed to add dyn_event
    - [x86] Fix build regression with CONFIG_KEXEC_JUMP enabled
    - Revert "unicode: Don't special case ignorable code points"
    - vfio/mlx5: Align the page tracking max message size with the device
      capability
    - [x86] KVM: x86/mmu: Ensure that kvm_release_pfn_clean() takes exact pfn
      from kvm_faultin_pfn()
    - jffs2: Prevent rtime decompress memory corruption
    - jffs2: Fix rtime decompressor
    - media: ipu6: use the IPU6 DMA mapping APIs to do mapping
    - ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2
      volume"
    - net/mlx5: unique names for per device caches
    - [x86] ASoC: Intel: avs: Fix return status of avs_pcm_hw_constraints_init()
    - drm/amdgpu: rework resume handling for display (v2)
    - ALSA: hda: Fix build error without CONFIG_SND_DEBUG
    - Revert "drm/amd/display: parse umc_info or vram_info based on ASIC"
    - [s390x] pci: Fix leak of struct zpci_dev when zpci_add_device() fails
    - ALSA: hda/realtek: Fix spelling mistake "Firelfy" -> "Firefly"
    - timekeeping: Remove CONFIG_DEBUG_TIMEKEEPING
    - clocksource: Make negative motion detection more robust
    - softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel

  [ Bastian Blank ]
  * Re-enable compressing all modules: (closes: #1089515)
    - Set MODULE_COMPRESS.

  [ Salvatore Bonaccorso ]
  * d/u/signing-key.asc: Merge keys into a single OpenPGP ASCII Armored block

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 15 Dec 2024 14:51:39 +0100

linux (6.12.3-1) unstable; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_6.12
    - tpm: Disable TPM on tpm2_create_primary() failure (Closes: #1087331)
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.1
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.2
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.3

  [ Aurelien Jarno ]
  * libbpf: Add missing per-arch include path (fixes FTBFS on riscv64).
  * [riscv64] Enable EFI_FB

  [ Ben Hutchings ]
  * d/b/gencontrol.py: Fix generation of debian/tests/control
  * linux-kbuild: Add scripts/module-common.c (Closes: #1087495)
  * objtool: Fix compiler flags leaking to fixdep in cross-build
  * linux-image: bug: Update list of related firmware packages

  [ Zhang Ning ]
  * [x86] add patches from maillist to fix intel_soc_pmic_bxtwc irq issues.
  * [x86] enable INTEL_BXTWC_PMIC_TMU, TYPEC_WCOVE as module.

  [ Miguel Bernal Marin ]
  * [amd64] Enable Compute Acceleration Framework and drivers
    (Closes: #1086054)
    - drivers/accel: Enable DRM_ACCEL
    - drivers/accel/habanalabs: Enable DRM_ACCEL_HABANALABS as module
    - drivers/accel/ivpu: Enable DRM_ACCEL_IVPU as module

  [ Matthias Geiger ]
  * [x86] Enable VIDEO_OV5670 as module

  [ Uwe Kleine-König ]
  * [arm64] Enable Texas Instruments ADS8688 driver (TI_ADS8688) as a module.
  * [amd64] Enable KVM support for XEN hypercalls

  [ Salvatore Bonaccorso ]
  * fs/ntfs3: Enable NTFS3_FS as module (Closes: #998627)
  * [arm64] drivers/clk/mediatek: Drop dead config options
    COMMON_CLK_MT8195_AUDSYS and COMMON_CLK_MT8195_MSDC

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 07 Dec 2024 08:24:54 +0100

linux (6.12~rc6-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Ben Hutchings ]
  * Update to 6.12-rc2:
    - Drop patches applied upstream:
      - "tools/rtla: Fix installation from out-of-tree build"
    - Refresh patches:
      - Update "Revert "tools build: Clean CFLAGS and LDFLAGS for fixdep"" and
        "fixdep: Allow overriding HOSTCC and HOSTLD" to use $(SILENT_MAKE)
      - Adjust context in "fanotify: Taint on use of
        FANOTIFY_ACCESS_PERMISSIONS"
      - Adjust context in "kbuild: Look for module.lds under arch directory
        too"
      - Adjust context in "Include package version along with kernel release in
        stack traces"
      - Adjust context in "arm64: add kernel config option to lock down when in
        Secure Boot mode"
      - Adjust context in "efi: Lock down the kernel if booted in secure boot
        mode"
      - Adjust context in "security,perf: Allow further restriction of
        perf_event_open"
      - Adjust context in "intel-iommu: Add option to exclude integrated GPU
        only"
  * [rt] Update to 6.12-rc1-rt2
  * d/rules.d/certs: Add newly required include directory to CPPFLAGS
  * libcpupower: Update symbols file for change in 6.12
  * d/config: Update with the help of kconfigeditor2:
    - i2c: Remove I2C_COMPAT
    - input/touchscreen: Remove TOUCHSCREEN_MCS5000
    - mm: Enable Z3FOLD_DEPRECATED instead of Z3FOLD
    - [amd64] sound/soc/intel: Enable AVS drivers to replace old Skylake SoC
      drivers:
      + Enable SND_SOC_INTEL_AVS_MACH_RT286 and
        SND_SOC_INTEL_AVS_MACH_RT5514
      + Leave SND_SOC_INTEL_AVS_MACH_MAX98357A disabled until we know it's safe
      + Remove SND_SOC_INTEL_SKYLAKE, SND_SOC_INTEL_CML_LP,
        SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC, SND_SOC_INTEL_SKL_*_MACH,
        SND_SOC_INTEL_KBL_*_MACH
  * drivers/usb/host: Enable XHCI_PCI_RENESAS on all architectures

  [ Han Gao ]
  * Enable DRM_XE for intel arc graphic card

  [ Salvatore Bonaccorso ]
  * mm: Do not enable Z3FOLD_DEPRECATED
  * debian/patches: Correct misspelled filename extension for patch.
    Thanks to Jing Luo (Closes: #1085600)
  * [rt] Update to 6.12-rc4-rt6

  [ Aurelien Jarno ]
  * [arm64,armhf,riscv64,x86] Enable I2C_DESIGNWARE_CORE, now gating the other
    I2C_DESIGNWARE options.
  * [riscv64] Enable GPIO_DWAPB, PINCTRL_SOPHGO_CV1800B,
    PINCTRL_SOPHGO_CV1812H, PINCTRL_SOPHGO_SG2000, PINCTRL_SOPHGO_SG2002,
    SENSORS_SG2042_MCU, SPI_DESIGNWARE, SPI_DW_MMIO.
  * [riscv64] Enable STAGING_MEDIA, VIDEO_CADENCE_CSI2RX, VIDEO_STARFIVE_CAMSS.

  [ Uwe Kleine-König ]
  * [arm64] Enable ARM64_VA_BITS_52

  [ Ricardo Salveti ]
  * [arm64] Enable Qualcomm CONFIG_SC_GCC and CONFIG_PINCTRL for 7280,
    7280, 8180X and 8280XP as builtin

  [ Sjoerd Simons ]
  * [x86] Enable Intel IPU supported camera sensors (Closes: #1082906)

  [ Matthias Geiger ]
  * [x86] Enable CIO2 and IPU3 as modules (Closes: #1086335)

  [ Luca Boccassi ]
  * Enable new IPE LSM. For more information on how to write policies see:
    https://docs.kernel.org/security/ipe.html

  [ Cyril Brulebois ]
  * [arm64] drivers/usb/host: Enable USB_XHCI_PCI_RENESAS as module
    (Closes: #1032671)

  [ Miguel Bernal Marin ]
  * [amd64] arch/x86: Enable X86_USER_SHADOW_STACK
    (X86 userspace shadow stack) (Closes: #1086695)

 -- Ben Hutchings <benh@debian.org>  Sun, 10 Nov 2024 01:12:45 +0100

linux (6.11.6-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.6
    - bpf: Use raw_spinlock_t in ringbuf
    - iio: accel: bma400: Fix uninitialized variable field_value in tap event
      handling.
    - [riscv64] reset: starfive: jh71x0: Fix accessing the empty member on
      JH7110 SoC
    - bpf: sync_linked_regs() must preserve subreg_def
    - bpf: Make sure internal and UAPI bpf_redirect flags don't overlap
    - [riscv64] irqchip/riscv-imsic: Fix output text of base address
    - bpf: devmap: provide rxq after redirect
    - [amd64] cpufreq/amd-pstate: Fix amd_pstate mode switch on shared memory
      systems
    - lib/Kconfig.debug: fix grammar in RUST_BUILD_ASSERT_ALLOW
    - bpf: Fix memory leak in bpf_core_apply
    - RDMA/bnxt_re: Fix a possible memory leak
    - RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
    - RDMA/bnxt_re: Add a check for memory allocation
    - RDMA/core: Fix ENODEV error for iWARP test over vlan
    - [x86] resctrl: Avoid overflow in MB settings in bw_validate()
    - [armel,armhf] dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
    - [arm64,armhf] clk: rockchip: fix finding of maximum clock ID
    - bpf: Check the remaining info_cnt before repeating btf fields
    - bpf: fix unpopulated name_len field in perf_event link info
    - [riscv64] bpf: Fix possible infinite tailcall when CONFIG_CFI_CLANG is
      enabled
    - [s390x] pci: Handle PCI error codes other than 0x3a
    - bpf: fix kfunc btf caching for modules
    - iio: frequency: {admv4420,adrf6780}: format Kconfig entries
    - iio: frequency: admv4420: fix missing select REMAP_SPI in Kconfig
    - drm/vmwgfx: Handle possible ENOMEM in vmw_stdu_connector_atomic_check
    - bpf: Fix unpopulated path_size when uprobe_multi fields unset
    - sched/core: Disable page allocation in task_tick_mm_cid()
    - ALSA: hda/cs8409: Fix possible NULL dereference
    - [arm64] firmware: arm_scmi: Fix the double free in
      scmi_debugfs_common_setup()
    - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
    - RDMA/irdma: Fix misspelling of "accept*"
    - RDMA/srpt: Make slab cache names unique
    - elevator: do not request_module if elevator exists
    - elevator: Remove argument from elevator_find_get
    - ipv4: give an IPv4 dev to blackhole_netdev
    - net: sparx5: fix source port register when mirroring
    - RDMA/bnxt_re: Fix the max CQ WQEs for older adapters
    - RDMA/bnxt_re: Fix out of bound check
    - RDMA/bnxt_re: Fix incorrect dereference of srq in async event
    - RDMA/bnxt_re: Return more meaningful error
    - RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop
    - RDMA/bnxt_re: Get the toggle bits from SRQ events
    - RDMA/bnxt_re: Change the sequence of updating the CQ toggle value
    - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
    - RDMA/bnxt_re: Fix the GID table length
    - accel/qaic: Fix the for loop used to walk SG table
    - [arm64] drm/msm/dpu: make sure phys resources are properly initialized
    - [arm64] drm/msm/dpu: move CRTC resource assignment to
      dpu_encoder_virt_atomic_check
    - [arm64] drm/msm/dpu: check for overflow in _dpu_crtc_setup_lm_bounds()
    - [arm64] drm/msm/dsi: improve/fix dsc pclk calculation
    - [arm64] drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate
      calculation
    - [arm64] drm/msm: Avoid NULL dereference in msm_disp_state_print_regs()
    - [arm64] drm/msm: Allocate memory for disp snapshot with kvzalloc()
    - firmware: arm_scmi: Queue in scmi layer for mailbox implementation
    - net/smc: Fix memory leak when using percpu refs
    - [PATCH} hwmon: (jc42) Properly detect TSE2004-compliant devices again
    - net: usb: usbnet: fix race in probe failure
    - net: stmmac: dwmac-tegra: Fix link bring-up sequence
    - ring-buffer: Fix reader locking when changing the sub buffer order
    - drm/amd/amdgpu: Fix double unlock in amdgpu_mes_add_ring
    - macsec: don't increment counters for an unrelated SA
    - net: ethernet: aeroflex: fix potential memory leak in
      greth_start_xmit_gbit()
    - net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid
    - net: ethernet: rtsn: fix potential memory leak in rtsn_start_xmit()
    - bpf: Fix truncation bug in coerce_reg_to_size_sx()
    - net: systemport: fix potential memory leak in bcm_sysport_xmit()
    - [arm64] irqchip/renesas-rzg2l: Fix missing put_device
    - [arm64] drm/msm/dpu: Don't always set merge_3d pending flush
    - [arm64] drm/msm/dpu: don't always program merge_3d block
    - net: bcmasp: fix potential memory leak in bcmasp_xmit()
    - [arm64] drm/msm/a6xx+: Insert a fence wait before SMMU table update
    - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
    - [arm64,armhf] net: dsa: mv88e6xxx: Fix the max_vid definition for the
      MV88E6361
    - genetlink: hold RCU in genlmsg_mcast()
    - ravb: Remove setting of RX software timestamp
    - net: ravb: Only advertise Rx/Tx timestamps if hardware supports it
    - scsi: target: core: Fix null-ptr-deref in target_alloc_device()
    - smb: client: fix possible double free in smb2_set_ea()
    - smb: client: fix OOBs when building SMB2_IOCTL request
    - usb: typec: altmode should keep reference to parent
    - [s390x] Initialize psw mask in perf_arch_fetch_caller_regs()
    - drm/xe: Use bookkeep slots for external BO's in exec IOCTL
    - bpf: Fix link info netfilter flags to populate defrag flag
    - Bluetooth: bnep: fix wild-memory-access in proto_unregister
    - [amd64,arm64] vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame
    - net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init
    - net/mlx5: Check for invalid vector index on EQ creation
    - net/mlx5: Fix command bitmask initialization
    - net/mlx5: Unregister notifier on eswitch init failure
    - net/mlx5e: Don't call cleanup on profile rollback failure
    - bpf, sockmap: SK_DROP on attempted redirects of unsupported af_vsock
    - vsock: Update rx_bytes on read_skb()
    - vsock: Update msg_count on read_skb()
    - bpf, vsock: Drop static vsock_bpf_prot initialization
    - [riscv64] bpf: Make BPF_CMPXCHG fully ordered
    - nvme-pci: fix race condition between reset and nvme_dev_disable()
    - bpf: Fix iter/task tid filtering
    - bpf: Fix incorrect delta propagation between linked registers
    - bpf: Fix print_reg_state's constant scalar dump
    - cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed()
    - fgraph: Allocate ret_stack_list with proper size
    - mm: shmem: rename shmem_is_huge() to shmem_huge_global_enabled()
    - mm: shmem: move shmem_huge_global_enabled() into
      shmem_allowable_huge_orders()
    - mm: huge_memory: add vma_thp_disabled() and thp_disabled_by_hw()
    - mm: don't install PMD mappings when THPs are disabled by the
      hw/process/vma
    - iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in
      Kconfig
    - uprobe: avoid out-of-bounds memory access of fetching args
      (CVE-2024-50067)
    - [amd64] drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape
      with real VLA
    - [amd64] ASoC: amd: yc: Add quirk for HP Dragonfly pro one
    - [arm64] ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2
      to default regs values
    - [arm64,armhf] ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit
    - [arm64] Force position-independent veneers
    - udf: refactor udf_current_aext() to handle error
    - udf: refactor udf_next_aext() to handle error
    - udf: refactor inode_bmap() to handle error
    - udf: fix uninit-value use in udf_get_fileshortad
    - [arm64] ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string
    - fsnotify: Avoid data race between fsnotify_recalc_mask() and
      fsnotify_object_watched()
    - cifs: Validate content of NFS reparse point buffer
    - [x86] platform/x86: dell-sysman: add support for alienware products
    - objpool: fix choosing allocation for percpu slots
    - jfs: Fix sanity check in dbMount
    - tracing/probes: Fix MAX_TRACE_ARGS limit handling
    - tracing: Consider the NULL character when validating the event length
    - xfrm: extract dst lookup parameters into a struct
    - xfrm: respect ip protocols rules criteria when performing dst lookups
    - xfrm: validate new SA's prefixlen using SA family when sel.family is unset
    - netfilter: bpf: must hold reference on net namespace
    - net: pse-pd: Fix out of bound for loop
    - net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
    - be2net: fix potential memory leak in be_xmit()
    - net: plip: fix break; causing plip to never transmit
    - bnxt_en: replace ptp_lock with irqsave variant
    - octeon_ep: Implement helper for iterating packets in Rx queue
    - octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()
    - net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x
    - [arm64] bpf, arm64: Fix address emission with tag-based KASAN enabled
    - fsl/fman: Save device references taken in mac_probe()
    - fsl/fman: Fix refcount handling of fman-related devices
    - net: wwan: fix global oob in wwan_rtnl_policy
    - net: fix races in netdev_tx_sent_queue()/dev_watchdog()
    - virtio_net: fix integer overflow in stats
    - net: usb: usbnet: fix name regression
    - bpf: Preserve param->string when parsing mount options
    - bpf: Add MEM_WRITE attribute
    - bpf: Fix overloading of MEM_UNINIT's meaning
    - bpf: Remove MEM_UNINIT from skb/xdp MTU helpers
    - net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions
      created by classifiers
    - net: sched: fix use-after-free in taprio_change()
    - net: sched: use RCU read-side critical section in taprio_dump()
    - r8169: avoid unsolicited interrupts
    - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
    - Bluetooth: hci_core: Disable works on hci_unregister_dev
    - Bluetooth: SCO: Fix UAF on sco_sock_timeout
    - Bluetooth: ISO: Fix UAF on iso_sock_timeout
    - bpf,perf: Fix perf_event_detach_bpf_prog error handling
    - bpf: fix do_misc_fixups() for bpf_get_branch_snapshot()
    - bpf: Add the missing BPF_LINK_TYPE invocation for sockmap
    - ASoC: dt-bindings: davinci-mcasp: Fix interrupts property
    - ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties
    - ASoC: topology: Bump minimal topology ABI version
    - [amd64] ASoC: max98388: Fix missing increment of variable slot_found
    - PCI: Hold rescan lock while adding devices during host probe
    - fs: pass offset and result to backing_file end_write() callback
    - fuse: update inode size after extending passthrough write
    - [arm64] ASoC: fsl_micfil: Add a flag to distinguish with different volume
      control types
    - ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
    - fbdev: wm8505fb: select CONFIG_FB_IOMEM_FOPS
    - powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request()
    - nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net
    - ALSA: hda/realtek: Update default depop procedure
    - smb: client: Handle kstrdup failures for passwords
    - cifs: fix warning when destroy 'cifs_io_request_pool'
    - PCI/pwrctl: Add WCN6855 support
    - PCI/pwrctl: Abandon QCom WCN probe on pre-pwrseq device-trees
    - cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception
    - btrfs: qgroup: set a more sane default value for subtree drop threshold
    - btrfs: clear force-compress on remount when compress mount option is given
    - btrfs: fix passing 0 to ERR_PTR in btrfs_search_dir_index_item()
    - [x86] amd_nb: Add new PCI IDs for AMD family 1Ah model 60h-70h
    - [x86] amd_nb: Add new PCI ID for AMD family 1Ah model 20h
    - [x86] perf/x86/rapl: Fix the energy-pkg event for AMD CPUs
    - btrfs: reject ro->rw reconfiguration if there are hard ro requirements
    - btrfs: zoned: fix zone unusable accounting for freed reserved extent
    - btrfs: fix read corruption due to race with extent map merging
    - drm/amd: Guard against bad data for ATIF ACPI method
    - ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
    - ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context
    - ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid
      detection issue
    - nilfs2: fix kernel bug due to missing clearing of buffer delay flag
    - fs: don't try and remove empty rbtree node
    - xfs: don't fail repairs on metadata files with no attr fork
    - openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)
    - [x86] KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
    - [arm64] KVM: arm64: Unregister redistributor for failed vCPU creation
    - [arm64] KVM: arm64: Fix shift-out-of-bounds bug
    - [arm64] KVM: arm64: Don't eagerly teardown the vgic on init error
    - firewire: core: fix invalid port index for parent device
    - [x86] lam: Disable ADDRESS_MASKING in most cases
    - [x86] sev: Ensure that RMP table fixups are reserved
    - ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
    - xfrm: fix one more kernel-infoleak in algo dumping
    - [amd64,arm64] hv_netvsc: Fix VF namespace also in synthetic NIC
      NETDEV_REGISTER event
    - md/raid10: fix null ptr dereference in raid10_size()
    - drm/bridge: Fix assignment of the of_node of the parent to aux bridge
    - drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too
    - [x86] platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for
      valid addresses
    - fgraph: Fix missing unlock in register_ftrace_graph()
    - fgraph: Change the name of cpuhp state to "fgraph:online"
    - net: phy: dp83822: Fix reset pin definitions
    - nfsd: fix race between laundromat and free_stateid
    - drm/amd/display: temp w/a for DP Link Layer compliance
    - ata: libata: Set DID_TIME_OUT for commands that actually timed out
    - [amd64] ASoC: SOF: Intel: hda-loader: do not wait for HDaudio IOC
    - [amd64] ASoC: SOF: Intel: hda: Handle prepare without close for non-HDA
      DAI's
    - [amd64] ASoC: SOF: Intel: hda: Always clean up link DMA during stop
    - [amd64] ASoC: SOF: ipc4-topology: Do not set ALH node_id for aggregated
      DAIs
    - ASoC: dapm: avoid container_of() to get component
    - [arm64] ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc
    - [arm64] ASoC: qcom: sdm845: add missing soundwire runtime stream alloc
    - [arm64] ASoC: qcom: Fix NULL Dereference in
      asoc_qcom_lpass_cpu_platform_probe()
    - Revert " fs/9p: mitigate inode collisions"
    - Revert "fs/9p: remove redundant pointer v9ses"
    - Revert "fs/9p: fix uaf in in v9fs_stat2inode_dotl"
    - Revert "fs/9p: simplify iget to remove unnecessary paths"
    - soundwire: intel_ace2x: Send PDI stream number during prepare
    - [x86] support user address masking instead of non-speculative conditional
    - [x86] fix whitespace in runtime-const assembler output
    - [x86] fix user address masking non-canonical speculation issue
    - [x86] platform/x86: dell-wmi: Ignore suspend notifications
    - ACPI: PRM: Clean up guid type in struct prm_handler_info
    - [arm64] ASoC: qcom: Select missing common Soundwire module code on SDM845

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 04 Nov 2024 22:57:57 +0100

linux (6.11.5-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.5
    - btrfs: fix uninitialized pointer free in add_inode_ref()
    - btrfs: fix uninitialized pointer free on read_alloc_one_name() error
    - ksmbd: fix user-after-free from session log off
    - ALSA: scarlett2: Add error check after retrieving PEQ filter values
    - ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2
    - mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow
    - net: enetc: remove xdp_drops statistic from enetc_xdp_drop()
    - net: enetc: block concurrent XDP transmissions during ring reconfiguration
    - net: enetc: disable Tx BD rings after they are empty
    - net: enetc: disable NAPI after all rings are disabled
    - net: enetc: add missing static descriptor and inline keyword
    - posix-clock: Fix missing timespec64 check in pc_clock_settime()
    - udp: Compute L4 checksum as usual when not segmenting the skb
    - [arm64] dts: marvell: cn9130-sr-som: fix cp0 mdio pin numbers
    - [arm64] probes: Remove broken LDR (literal) uprobe support
    - [arm64] probes: Fix simulate_ldr*_literal()
    - [arm64] probes: Fix uprobes for big-endian kernels
    - net: macb: Avoid 20s boot delay by skipping MDIO bus registration for
      fixed-link PHY
    - net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test()
    - maple_tree: correct tree corruption on spanning store
    - nilfs2: propagate directory read errors from nilfs_find_entry()
    - fat: fix uninitialized variable
    - mm/mremap: fix move_normal_pmd/retract_page_tables race (CVE-2024-50066)
    - mm: khugepaged: fix the arguments order in khugepaged_collapse_file trace
      point
    - mm/mglru: only clear kswapd_failures if reclaimable
    - mm/swapfile: skip HugeTLB pages for unuse_vma
    - mm/damon/tests/sysfs-kunit.h: fix memory leak in
      damon_sysfs_test_add_targets()
    - tcp: fix mptcp DSS corruption due to large pmtu xmit
    - net: fec: Move `fec_ptp_read()` to the top of the file
    - net: fec: Remove duplicated code
    - mptcp: prevent MPC handshake on port-based signal endpoints
    - [amd64] iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI
      devices
    - [s390x] sclp: Deactivate sclp after all its users
    - [s390x] sclp_vt220: Convert newlines to CRLF instead of LFCR
    - [s390x] KVM: s390: gaccess: Check if guest address is in memslot
    - [s390x] KVM: s390: Change virtual to physical address access in diag 0x258
      handler
    - [x86] cpufeatures: Define X86_FEATURE_AMD_IBPB_RET
    - [x86] cpufeatures: Add a IBPB_NO_RET BUG flag
    - [x86] entry: Have entry_ibpb() invalidate return predictions
    - [x86] bugs: Skip RSB fill at VMEXIT
    - [x86] bugs: Do not use UNTRAIN_RET with IBPB on entry
    - fgraph: Use CPU hotplug mechanism to initialize idle shadow stacks
    - Input: xpad - add support for 8BitDo Ultimate 2C Wireless Controller
    - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
    - io_uring/sqpoll: close race on waiting for sqring entries
    - blk-mq: setup queue ->tag_set before initializing hctx
    - ublk: don't allow user copy for unprivileged device
    - io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work
    - Input: xpad - add support for MSI Claw A1M
    - scsi: mpi3mr: Validate SAS port assignments
    - scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down
    - scsi: ufs: core: Fix the issue of ICU failure
    - scsi: ufs: core: Requeue aborted request
    - drm/radeon: Fix encoder->possible_clones
    - [x86] drm/i915/dp_mst: Handle error during DSC BW overhead/slice
      calculation
    - [x86] drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC
      compatible mode
    - drm/vmwgfx: Cleanup kms setup without 3d
    - drm/vmwgfx: Handle surface check failure correctly
    - drm/amdgpu/mes: fix issue of writing to the same log buffer from 2 MES
      pipes
    - drm/amdgpu/smu13: always apply the powersave optimization
    - drm/amdgpu/swsmu: Only force workload setup on init
    - drm/amdgpu: prevent BO_HANDLES error from being overwritten
    - iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig
    - iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig
    - iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig
    - iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
    - iio: hid-sensors: Fix an error handling path in
      _hid_sensor_set_report_latency()
    - iio: light: veml6030: fix ALS sensor resolution
    - iio: light: veml6030: fix IIO device retrieval from embedded device
    - iio: light: opt3001: add missing full-scale range value
    - iio: amplifiers: ada4250: add missing select REGMAP_SPI in Kconfig
    - iio: frequency: adf4377: add missing select REMAP_SPI in Kconfig
    - iio: chemical: ens160: add missing select IIO_(TRIGGERED_)BUFFER in
      Kconfig
    - iio: light: bu27008: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
    - iio: magnetometer: af8133j: add missing select IIO_(TRIGGERED_)BUFFER in
      Kconfig
    - iio: resolver: ad2s1210 add missing select REGMAP in Kconfig
    - iio: pressure: bm1390: add missing select IIO_(TRIGGERED_)BUFFER in
      Kconfig
    - iio: dac: ad5766: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
    - iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in
      Kconfig
    - iio: dac: ad3552r: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
    - iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in
      Kconfig
    - iio: adc: ti-lmp92064: add missing select REGMAP_SPI in Kconfig
    - iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in
      Kconfig
    - iio: resolver: ad2s1210: add missing select (TRIGGERED_)BUFFER in Kconfig
    - iio: adc: ad7944: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
    - iio: accel: kx022a: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
    - Bluetooth: Call iso_exit() on module unload
    - Bluetooth: Remove debugfs directory on module init failure
    - Bluetooth: ISO: Fix multiple init when debugfs is disabled
    - Bluetooth: btusb: Fix not being able to reconnect after suspend
    - Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001
    - vt: prevent kernel-infoleak in con_font_get()
    - xhci: tegra: fix checked USB2 port number
    - xhci: Fix incorrect stream context type macro
    - xhci: Mitigate failed set dequeue pointer commands
    - USB: serial: option: add support for Quectel EG916Q-GL
    - USB: serial: option: add Telit FN920C04 MBIM compositions
    - usb: typec: qcom-pmic-typec: fix sink status being overwritten with RP_DEF
    - USB: gadget: dummy-hcd: Fix "task hung" problem
    - usb: gadget: f_uac2: fix return value for UAC2_ATTRIBUTE_STRING store
    - usb: dwc3: Wait for EndXfer completion before restoring GUSB2PHYCFG
    - usb: dwc3: core: Fix system suspend on TI AM62 platforms
    - misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for EEPROM
      device
    - misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for OTP device
    - serial: imx: Update mctrl old_status on RTSD interrupt
    - parport: Proper fix for array out-of-bounds access
    - [x86] resctrl: Annotate get_mem_config() functions as __init
    - [x86] apic: Always explicitly disarm TSC-deadline timer
    - [x86] CPU/AMD: Only apply Zenbleed fix for Zen2 during late microcode load
    - [x86] entry_32: Do not clobber user EFLAGS.ZF
    - [x86] entry_32: Clear CPU buffers after register restore in NMI return
    - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
    - [x86] bugs: Use code segment selector for VERW operand
    - pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func()
    - pinctrl: intel: platform: fix error path in device_for_each_child_node()
    - pinctrl: ocelot: fix system hang on level based interrupts
    - pinctrl: stm32: check devm_kasprintf() returned value
    - pinctrl: apple: check devm_kasprintf() returned value
    - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE
    - irqchip/sifive-plic: Unmask interrupt in plic_irq_enable()
    - irqchip/sifive-plic: Return error code on failure
    - serial: qcom-geni: fix polled console initialisation
    - serial: qcom-geni: revert broken hibernation support
    - serial: qcom-geni: fix shutdown race
    - serial: qcom-geni: fix dma rx cancellation
    - serial: qcom-geni: fix receiver enable
    - mm: vmscan.c: fix OOM on swap stress test
    - ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne
      1000 G2

  [ Aurelien Jarno ]
  * Revert upstream commit causing data corrution (Closes: #1085425)
    - Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"

  [ Salvatore Bonaccorso ]
  * netfilter: xtables: fix typo causing some targets not to load on IPv6
    (Closes: #1085953)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 27 Oct 2024 07:25:33 +0100

linux (6.11.4-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.3
    - [amd64] static_call: Handle module init failure correctly in
      static_call_del_module()
    - [amd64] static_call: Replace pointless WARN_ON() in
      static_call_module_notify()
    - jump_label: Fix static_key_slow_dec() yet again
    - scsi: st: Fix input/output error on empty drive reset
    - scsi: pm8001: Do not overwrite PCI queue mapping
    - drm/i915/psr: Do not wait for PSR being idle on on Panel Replay
    - [x86] drm/i915/display: BMG supports UHBR13.5
    - [x86] drm/i915/dp: Fix AUX IO power enabling for eDP PSR
    - drm/amdgpu: Fix get each xcp macro
    - drm/amd/display: handle nulled pipe context in DCE110's set_drr()
    - ksmbd: fix warning: comparison of distinct pointer types lacks a cast
    - [arm64] mailbox: ARM_MHU_V3 should depend on ARM64
    - [arm64,armhf] mailbox: rockchip: fix a typo in module autoloading
    - [arm*] mailbox: bcm2835: Fix timeout during suspend mode
    - ceph: fix a memory leak on cap_auths in MDS client
    - ceph: remove the incorrect Fw reference check when dirtying pages
    - [x86] drm/i915/dp: Fix colorimetry detection
    - ieee802154: Fix build error
    - net: sparx5: Fix invalid timestamps
    - net/mlx5: Fix error path in multi-packet WQE transmit
    - net/mlx5: Added cond_resched() to crdump collection
    - net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
    - net/mlx5e: SHAMPO, Fix overflow of hd_per_wq
    - net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice
    - netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
    - net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
    - net: wwan: qcom_bam_dmux: Fix missing pm_runtime_disable()
    - netfilter: nf_tables: prevent nf_skb_duplicated corruption
    - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
    - Bluetooth: L2CAP: Fix uaf in l2cap_connect
    - Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
    - afs: Fix missing wire-up of afs_retry_request()
    - afs: Fix the setting of the server responding flag
    - net: dsa: improve shutdown sequence
    - net: Add netif_get_gro_max_size helper for GRO
    - net: Fix gso_features_check to check for both dev->gso_{ipv4_,}max_size
    - net: ethernet: lantiq_etop: fix memory disclosure
    - net: fec: Restart PPS after link state change
    - net: fec: Reload PTP registers after link-state change
    - net: avoid potential underflow in qdisc_pkt_len_init() with UFO
    - net: add more sanity checks to qdisc_pkt_len_init()
    - net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check
    - ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
    - netfs: Fix missing wakeup after issuing writes
    - net: test for not too small csum_start in virtio_net_hdr_to_skb()
    - ppp: do not assume bh is held in ppp_channel_bridge_input()
    - net: phy: realtek: Check the index value in led_hw_control_get
    - bridge: mcast: Fail MDB get request on empty entry
    - net/ncsi: Disable the ncsi work before freeing the associated structure
    - iomap: constrain the file range passed to iomap_file_unshare
    - dt-bindings: net: xlnx,axi-ethernet: Add missing reg minItems
    - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
    - ASoC: topology: Fix incorrect addressing assignments
    - drm/connector: hdmi: Fix writing Dynamic Range Mastering infoframes
    - io_uring: fix memory leak when cache init fail
    - ALSA: mixer_oss: Remove some incorrect kfree_const() usages
    - ALSA: hda/realtek: Fix the push button function for the ALC257
    - cifs: Remove intermediate object of failed create reparse call
    - [x86] ASoC: Intel: soc-acpi-intel-rpl-match: add missing empty item
    - ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
    - ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
    - cifs: Fix buffer overflow when parsing NFS reparse points
    - cifs: Do not convert delimiter when parsing NFS-style symlinks
    - gpiolib: Fix potential NULL pointer dereference in gpiod_get_label()
    - ALSA: gus: Fix some error handling paths related to get_bpos() usage
    - ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
    - drm/amd/display: Disable replay if VRR capability is false
    - drm/amd/display: Fix VRR cannot enable
    - drm/amd/display: Re-enable panel replay feature
    - e1000e: avoid failing the system during pm_suspend (Closes: #1082795)
    - l2tp: prevent possible tunnel refcount underflow
    - wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
    - wifi: rtw89: avoid to add interface to list twice when SER
    - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
    - [x86] intel_idle: Disable promotion to C1E on Jasper Lake and Elkhart Lake
    - [x86] crypto: x86/sha256 - Add parentheses around macros' single arguments
    - crypto: octeontx - Fix authenc setkey
    - crypto: octeontx2 - Fix authenc setkey
    - ice: Adjust over allocation of memory in ice_sched_add_root_node() and
      ice_sched_add_node()
    - wifi: iwlwifi: mvm: Fix a race in scan abort flow
    - wifi: iwlwifi: mvm: drop wrong STA selection in TX
    - wifi: cfg80211: Set correct chandef when starting CAC
    - net/xen-netback: prevent UAF in xenvif_flush_hash()
    - [arm64] net: hisilicon: hip04: fix OF node leak in probe()
    - [arm64] net: hisilicon: hns_dsaf_mac: fix OF node leak in
      hns_mac_get_info()
    - [arm64] net: hisilicon: hns_mdio: fix OF node leak in probe()
    - ACPI: PAD: fix crash in exit_round_robin()
    - ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
    - ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
    - exec: don't WARN for racy path_noexec check
    - fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
    - ACPI: resource: Skip IRQ override on Asus Vivobook Go E1404GAB
    - wifi: mt76: mt7915: disable tx worker during tx BA session enable/disable
    - net: sched: consistently use rcu_replace_pointer() in taprio_change()
    - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122
    - Bluetooth: btrtl: Set msft ext address filter quirk for RTL8852B
    - ACPI: video: Add force_vendor quirk for Panasonic Toughbook CF-18
    - ACPI: CPPC: Add support for setting EPP register in FFH
    - blk_iocost: fix more out of bound shifts
    - btrfs: don't readahead the relocation inode on RST
    - wifi: ath12k: fix array out-of-bound access in SoC stats
    - wifi: ath11k: fix array out-of-bound access in SoC stats
    - wifi: rtw88: select WANT_DEV_COREDUMP
    - l2tp: free sessions using rcu
    - l2tp: use rcu list add/del when updating lists
    - wifi: rtw89: 885xb: reset IDMEM mode to prevent download firmware failure
    - ACPI: EC: Do not release locks during operation region accesses
    - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in
      acpi_db_convert_to_package()
    - tipc: guard against string buffer overrun
    - net: skbuff: sprinkle more __GFP_NOWARN on ingress allocs
    - net: mvpp2: Increase size of queue_name buffer
    - bnxt_en: Extend maximum length of version string by 1 byte
    - ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
    - wifi: rtw89: correct base HT rate mask for firmware
    - netfilter: nf_tables: do not remove elements if set backend implements
      .abort
    - ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
    - nvme-keyring: restrict match length for version '1' identifiers
    - nvme-tcp: sanitize TLS key handling
    - nvme-tcp: check for invalidated or revoked key
    - net: atlantic: Avoid warning about potential string truncation
    - crypto: simd - Do not call crypto_alloc_tfm during registration
    - netpoll: Ensure clean state on setup failures
    - tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
    - wifi: iwlwifi: mvm: use correct key iteration
    - wifi: iwlwifi: allow only CN mcc from WRDD
    - wifi: iwlwifi: mvm: avoid NULL pointer dereference
    - virt: sev-guest: Ensure the SNP guest messages do not exceed a page
    - wifi: mac80211: fix RCU list iterations
    - ACPICA: iasl: handle empty connection_node
    - proc: add config & param to block forcing mem writes
    - vfs: use RCU in ilookup
    - drivers/perf: arm_spe: Use perf_allow_kernel() for permissions
    - nvme: fix metadata handling in nvme-passthrough
    - can: netlink: avoid call to do_set_data_bittiming callback with stale
      can_priv::ctrlmode
    - netdev-genl: Set extack and fix error on napi-get
    - wifi: wilc1000: Do not operate uninitialized hardware during
      suspend/resume
    - block: fix integer overflow in BLKSECDISCARD
    - [x86] cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
    - [arm64] trans_pgd: mark PTEs entries as valid to avoid dead kexec()
    - net: phy: Check for read errors in SIOCGMIIREG
    - wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
    - [x86] bugs: Add missing NO_SSB flag
    - [x86] bugs: Fix handling when SRSO mitigation is disabled
    - net: napi: Prevent overflow of napi_defer_hard_irqs
    - [arm64] crypto: hisilicon - fix missed error branch
    - wifi: mt76: mt7915: add dummy HW offload of IEEE 802.11 fragmentation
    - wifi: mt76: mt7915: hold dev->mt76.mutex while disabling tx worker
    - wifi: mwifiex: Fix memcpy() field-spanning write warning in
      mwifiex_cmd_802_11_scan_ext()
    - netfs: Cancel dirty folios that have no storage destination
    - nfp: Use IRQF_NO_AUTOEN flag in request_irq()
    - ALSA: usb-audio: Add input value sanity checks for standard types
    - [x86] ioapic: Handle allocation failures gracefully
    - [x86] apic: Remove logical destination mode for 64-bit
    - ALSA: usb-audio: Define macros for quirk table entries
    - ALSA: usb-audio: Replace complex quirk lines with macros
    - ALSA: usb-audio: Add quirk for RME Digiface USB
    - ALSA: usb-audio: Add mixer quirk for RME Digiface USB
    - ALSA: hda/realtek: Refactor and simplify Samsung Galaxy Book init
    - ALSA: usb-audio: Add logitech Audio profile quirk
    - ASoC: codecs: wsa883x: Handle reading version failure
    - ALSA: control: Take power_ref lock primarily
    - tools/x86/kcpuid: Protect against faulty "max subleaf" values
    - [x86] pkeys: Add PKRU as a parameter in signal handling functions
    - [x86] pkeys: Restore altstack access in sigreturn()
    - [x86] kexec: Add EFI config table identity mapping for kexec kernel
    - [x86] mm/ident_map: Use gbpages only where full GB page should be mapped.
    - ALSA: asihpi: Fix potential OOB array access
    - ALSA: hdsp: Break infinite MIDI input flush loop
    - tools/nolibc: powerpc: limit stack-protector workaround to GCC
    - [x86] syscall: Avoid memcpy() for ia32 syscall_get_arguments()
    - [x86] ASoC: Intel: boards: always check the result of
      acpi_dev_get_first_match_dev()
    - rcu-tasks: Fix access non-existent percpu rtpcp variable in
      rcu_tasks_need_gpcb()
    - hwmon: (nct6775) add G15CF to ASUS WMI monitoring list
    - fbdev: efifb: Register sysfs groups through driver core
    - fbdev: pxafb: Fix possible use after free in pxafb_task()
    - pmdomain: core: Don't hold the genpd-lock when calling dev_pm_domain_set()
    - pmdomain: core: Use dev_name() instead of kobject_get_path() in debugfs
    - rcuscale: Provide clear error when async specified without primitives
    - power: reset: brcmstb: Do not go into infinite loop if reset fails
    - [arm64] iommu/arm-smmu-v3: Match Stall behaviour for S2
    - [amd64] iommu/vt-d: Always reserve a domain ID for identity setup
    - [amd64] iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0
      count
    - [amd64] iommu/vt-d: Unconditionally flush device TLB for pasid table
      updates
    - [arm64] iommu/arm-smmu-v3: Do not use devm for the cd table allocations
    - drm/stm: Avoid use-after-free issues with crtc and plane
    - drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
    - drm/amd/display: Check null pointers before using them
    - drm/amd/display: Check null pointers before used
    - drm/amd/display: Check null pointers before multiple uses
    - drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit
    - drm/amd/display: Add null check for head_pipe in
      dcn201_acquire_free_pipe_for_layer
    - drm/amd/display: Add null check for head_pipe in
      dcn32_acquire_idle_pipe_for_head_pipe_in_layer
    - drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in
      dcn30_init_hw
    - drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in
      dcn401_init_hw
    - drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw
    - drm/amd/display: Add null check for pipe_ctx->plane_state in
      dcn20_program_pipe
    - drm/amd/display: Add null check for top_pipe_to_program in
      commit_planes_for_stream
    - drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces
    - ata: pata_serverworks: Do not use the term blacklist
    - ata: sata_sil: Rename sil_blacklist to sil_quirks
    - scsi: smartpqi: Add new controller PCI IDs
    - HID: Ignore battery for all ELAN I2C-HID devices
    - drm/amd/display: Underflow Seen on DCN401 eGPU
    - drm/amd/display: Handle null 'stream_status' in
      'planes_changed_for_existing_stream'
    - drm/amd/display: Add NULL check for function pointer in
      dcn20_set_output_transfer_func
    - drm/amd/display: Add NULL check for function pointer in
      dcn401_set_output_transfer_func
    - drm/amd/display: Add NULL check for function pointer in
      dcn32_set_output_transfer_func
    - drm/amd/display: fix a UBSAN warning in DML2.1
    - drm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2)
    - drm/amd/display: Check null pointers before using dc->clk_mgr
    - drm/amd/display: Check null pointer before try to access it
    - drm/amd/display: Add null check for 'afb' in
      amdgpu_dm_plane_handle_cursor_update (v2)
    - drm/amd/display: fix double free issue during amdgpu module unload
    - drm/amdgpu: add list empty check to avoid null pointer issue
    - jfs: UBSAN: shift-out-of-bounds in dbFindBits
    - jfs: Fix uaf in dbFreeBits
    - jfs: check if leafidx greater than num leaves per dmap tree
    - scsi: smartpqi: correct stream detection
    - scsi: smartpqi: add new controller PCI IDs
    - drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
    - jfs: Fix uninit-value access of new_ea in ea_buffer
    - drm/amdgpu: add raven1 gfxoff quirk
    - drm/amdgpu: enable gfxoff quirk on HP 705G4
    - HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio
    - [x86] platform/x86: touchscreen_dmi: add nanote-next quirk
    - [x86] platform/x86/amd: pmf: Add quirk for TUF Gaming A14
    - drm/stm: ltdc: reset plane transparency after plane disable
    - drm/amd/display: Initialize denominators' default to 1
    - drm/amd/display: Check null-initialized variables
    - drm/amd/display: Check phantom_stream before it is used
    - drm/amd/display: Check stream before comparing them
    - drm/amd/display: Deallocate DML memory if allocation fails
    - drm/amd/display: Increase array size of dummy_boolean
    - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format
      translation
    - drm/amd/display: Fix index out of bounds in degamma hardware format
      translation
    - drm/amd/display: Implement bounds check for stream encoder creation in
      DCN401
    - drm/amd/display: Fix index out of bounds in DCN30 color transformation
    - drm/amdgpu/gfx12: properly handle error ints on all pipes
    - drm/amdgpu/gfx9: properly handle error ints on all pipes
    - drm/amd/display: Fix possible overflow in integer multiplication
    - drm/amd/display: Check stream_status before it is used
    - drm/amd/display: Avoid overflow assignment in link_dp_cts
    - drm/amd/display: Initialize get_bytes_per_element's default to 1
    - drm/printer: Allow NULL data in devcoredump printer
    - [x86] perf,x86: avoid missing caller address in stack traces captured in
      uprobe
    - scsi: aacraid: Rearrange order of struct aac_srb_unit
    - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata
      paths
    - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached
      topology
    - scsi: lpfc: Update PRLO handling in direct attached topology
    - drm/amd/display: Force enable 3DLUT DMA check for dcn401 in DML
    - drm/amdgpu: fix unchecked return value warning for amdgpu_gfx
    - drm/amdgpu: fix unchecked return value warning for amdgpu_atombios
    - perf: Fix event_function_call() locking
    - scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers
    - drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
    - drm/amd/display: Unlock Pipes Based On DET Allocation
    - drm/amdgpu: fix ptr check warning in gfx9 ip_dump
    - drm/amdgpu: fix ptr check warning in gfx10 ip_dump
    - drm/amdgpu: fix ptr check warning in gfx11 ip_dump
    - drm/amdgpu: Block MMR_READ IOCTL in reset
    - drm/amdgpu/gfx9: use rlc safe mode for soft recovery
    - drm/amdgpu/gfx11: enter safe mode before touching CP_INT_CNTL
    - drm/amd/pm: ensure the fw_info is not null before using it
    - of/irq: Refer to actual buffer size in of_irq_parse_one()
    - drm/amd/display: guard write a 0 post_divider value to HW
    - [powerpc*] pseries: Use correct data types from pseries_hp_errorlog struct
    - ovl: fsync after metadata copy-up
    - drm/amdgpu/gfx12: use rlc safe mode for soft recovery
    - drm/amdgpu/gfx11: use rlc safe mode for soft recovery
    - drm/amdgpu/gfx10: use rlc safe mode for soft recovery
    - [x86] platform/x86: lenovo-ymc: Ignore the 0x0 state
    - tools/hv: Add memory allocation check in hv_fcopy_start
    - HID: i2c-hid: ensure various commands do not interfere with each other
    - ksmbd: add refcnt to ksmbd_conn struct
    - [x86] platform/x86: x86-android-tablets: Adjust Xiaomi Pad 2 bottom bezel
      touch buttons LED
    - ext4: filesystems without casefold feature cannot be mounted with siphash
    - bpf: Make the pointer returned by iter next method valid
    - ext4: ext4_search_dir should return a proper error
    - ext4: avoid use-after-free in ext4_ext_show_leaf()
    - ext4: fix i_data_sem unlock order in ext4_ind_migrate()
    - bpftool: Fix undefined behavior caused by shifting into the sign bit
    - iomap: handle a post-direct I/O invalidate race in
      iomap_write_delalloc_release
    - bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
    - bpf: Fix a sdiv overflow issue
    - EINJ, CXL: Fix CXL device SBDF calculation
    - spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
    - spi: spi-cadence: Fix pm_runtime_set_suspended() with runtime pm enabled
    - spi: spi-cadence: Fix missing spi_controller_is_target() check
    - spi: s3c64xx: fix timeout counters in flush_fifo
    - accel/ivpu: Add missing MODULE_FIRMWARE metadata
    - spi: rpc-if: Add missing MODULE_DEVICE_TABLE
    - ALSA: control: Fix power_ref lock order for compat code, too
    - perf callchain: Fix stitch LBR memory leaks
    - perf: Really fix event_function_call() locking
    - ext4: fix error message when rejecting the default hash
    - nvme-tcp: fix link failure for TCP auth
    - f2fs: add write priority option based on zone UFS
    - f2fs: fix to don't panic system for no free segment fault injection
    - [powerpc*] vdso: Fix VDSO data access when running in a non-root time
      namespace
    - f2fs: make BG GC more aggressive for zoned devices
    - f2fs: introduce migration_window_granularity
    - f2fs: increase BG GC migration window granularity when boosted for zoned
      devices
    - f2fs: do FG_GC when GC boosting is required for zoned devices
    - f2fs: forcibly migrate to secure space for zoned device file pinning
    - Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
      (Closes: #1081833)
    - [x86] platform/x86: x86-android-tablets: Fix use after free on
      platform_device_register() errors
    - [x86] platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
    - [arm64] KVM: arm64: Fix kvm_has_feat*() handling of negative features
    - i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
    - i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
    - i2c: xiic: Wait for TX empty to avoid missed TX NAKs
    - media: i2c: ar0521: Use cansleep version of gpiod_set_value()
    - i2c: core: Lock address during client device instantiation
    - i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
    - i2c: designware: fix controller is holding SCL low while ENABLE bit is
      disabled
    - i2c: synquacer: Deal with optional PCLK correctly
    - ovl: fail if trusted xattrs are needed but caller lacks permission
    - firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
    - memory: tegra186-emc: drop unused to_tegra186_emc()
    - dt-bindings: clock: exynos7885: Fix duplicated binding
    - spi: bcm63xx: Fix module autoloading
    - spi: bcm63xx: Fix missing pm_runtime_disable()
    - power: supply: hwmon: Fix missing temp1_max_alarm attribute
    - mm, slub: avoid zeroing kmalloc redzone
    - power: supply: Drop use_cnt check from
      power_supply_property_is_writeable()
    - perf/core: Fix small negative period being ignored
    - drm/v3d: Prevent out of bounds access in performance query extensions
    - drm/mediatek: ovl_adaptor: Add missing of_node_put()
    - drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
    - ALSA: hda/tas2781: Add new quirk for Lenovo Y990 Laptop
    - ALSA: core: add isascii() check to card ID generator
    - ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET
    - ALSA: usb-audio: Add native DSD support for Luxman D-08u
    - ALSA: line6: add hw monitor volume control to POD HD500X
    - ALSA: hda/realtek: fix mute/micmute LED for HP mt645 G8
    - ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
    - ALSA: hda/realtek: Add a quirk for HP Pavilion 15z-ec200
    - ext4: no need to continue when the number of entries is 1
    - ext4: correct encrypted dentry name hash when not casefolded
    - ext4: fix slab-use-after-free in ext4_split_extent_at()
    - ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
    - ext4: fix incorrect tid assumption in ext4_fc_mark_ineligible()
    - ext4: dax: fix overflowing extents beyond inode size when partially
      writing
    - ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
    - ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
    - ext4: aovid use-after-free in ext4_ext_insert_extent()
    - ext4: fix double brelse() the buffer of the extents path
    - ext4: fix timer use-after-free on failed mount
    - ext4: fix access to uninitialised lock in fc replay path
    - ext4: update orig_path in ext4_find_extent()
    - ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
    - ext4: fix incorrect tid assumption in
      jbd2_journal_shrink_checkpoint_list()
    - ext4: fix fast commit inode enqueueing during a full journal commit
    - ext4: use handle to mark fc as ineligible in __track_dentry_update()
    - ext4: mark fc as ineligible using an handle in ext4_xattr_set()
    - ext4: fix off by one issue in alloc_flex_gd()
    - drm/rockchip: vop: clear DMA stop bit on RK3066
    - of: address: Report error on resource bounds overflow
    - of/irq: Support #msi-cells=<0> in of_msi_get_domain
    - drm: omapdrm: Add missing check for alloc_ordered_workqueue
    - resource: fix region_intersects() vs add_memory_driver_managed()
    - lib/buildid: harden build ID parsing logic
    - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns
      error
    - jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit
    - mm: krealloc: consider spare memory for __GFP_ZERO
    - ocfs2: fix the la space leak when unmounting an ocfs2 volume
    - ocfs2: fix uninit-value in ocfs2_get_block()
    - ocfs2: reserve space for inline xattr before attaching reflink tree
    - ocfs2: cancel dqi_sync_work before freeing oinfo
    - ocfs2: remove unreasonable unlock in ocfs2_read_blocks
    - ocfs2: fix null-ptr-deref when journal load failed.
    - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
    - scripts/gdb: fix timerlist parsing issue
    - scripts/gdb: add iteration function for rbtree
    - scripts/gdb: fix lx-mounts command error
    - [arm64] fix selection of HAVE_DYNAMIC_FTRACE_WITH_ARGS
    - [arm64] Subscribe Microsoft Azure Cobalt 100 to erratum 3194386
    - sched/deadline: Comment sched_dl_entity::dl_server variable
    - sched/core: Add clearing of ->dl_server in put_prev_task_balance()
    - sched/core: Clear prev->dl_server in CFS pick fast path
    - sched: psi: fix bogus pressure spikes from aggregation race
    - [riscv64] define ILLEGAL_POINTER_VALUE for 64bit
    - exfat: fix memory leak in exfat_load_bitmap()
    - perf python: Disable -Wno-cast-function-type-mismatch if present on clang
    - perf hist: Update hist symbol when updating maps
    - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
    - nfsd: map the EBADMSG to nfserr_io to avoid warning
    - NFSD: Fix NFSv4's PUTPUBFH operation
    - i3c: master: svc: Fix use after free vulnerability in svc_i3c_master
      Driver Due to Race Condition
    - sysctl: avoid spurious permanent empty tables
    - RDMA/mana_ib: use the correct page table index based on hardware page size
    - RDMA/mana_ib: use the correct page size for mapping user-mode doorbell
      page
    - drivers/perf: riscv: Align errno for unsupported perf event
    - [riscv64] Fix kernel stack size when KASAN is enabled
    - aoe: fix the potential use-after-free problem in more places
    - media: imx335: Fix reset-gpio handling
    - media: ov5675: Fix power on/off delay timings
    - clk: rockchip: fix error for unknown clocks
    - leds: pca9532: Remove irrelevant blink configuration error message
    - remoteproc: k3-r5: Fix error handling when power-up failed
    - gfs2: fix double destroy_workqueue error
    - media: videobuf2: Drop minimum allocation requirement of 2 buffers
    - clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks
    - media: sun4i_csi: Implement link validate for sun4i_csi subdev
    - clk: qcom: gcc-sm8450: Do not turn off PCIe GDSCs during gdsc_disable()
    - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
    - dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x
    - clk: qcom: gcc-sc8180x: Register QUPv3 RCGs for DFS on sc8180x
    - clk: qcom: clk-rpmh: Fix overflow in BCM vote
    - clk: samsung: exynos7885: Update CLKS_NR_FSYS after bindings fix
    - clk: qcom: gcc-sm8150: De-register gcc_cpuss_ahb_clk_src
    - media: venus: fix use after free bug in venus_remove due to race condition
    - clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable()
    - media: qcom: camss: Remove use_count guard in stop_streaming
    - clk: qcom: gcc-sc8180x: Add GPLL9 support
    - media: qcom: camss: Fix ordering of pm_runtime_enable
    - clk: qcom: gcc-sc8180x: Fix the sdcc2 and sdcc4 clocks freq table
    - clk: qcom: clk-alpha-pll: Fix CAL_L_VAL override for LUCID EVO PLL
    - drm/amd/display: avoid set dispclk to 0
    - smb: client: use actual path when queryfs
    - smb3: fix incorrect mode displayed for read-only files
    - iio: magnetometer: ak8975: Fix reading for ak099xx sensors
    - iio: pressure: bmp280: Fix regmap for BMP280 device
    - iio: pressure: bmp280: Fix waiting time for BMP3xx configuration
    - vrf: revert "vrf: Remove unnecessary RCU-bh critical section"
    - net: gso: fix tcp fraglist segmentation after pull from frag_list
    - gso: fix udp gso fraglist segmentation after pull from frag_list
    - tomoyo: fallback to realpath if symlink's pathname does not exist
      (Closes: #1082001)
    - net: stmmac: Fix zero-division error when disabling tc cbs
    - rtc: at91sam9: fix OF node leak in probe() error path
    - mm/filemap: fix filemap_get_folios_contig THP panic
    - mm/hugetlb: fix memfd_pin_folios free_huge_pages leak
    - mm/hugetlb: fix memfd_pin_folios resv_huge_pages leak
    - mm/gup: fix memfd_pin_folios hugetlb page allocation
    - mm/gup: fix memfd_pin_folios alloc race panic
    - mm/hugetlb: simplify refs in memfd_alloc_folio
    - Input: adp5589-keys - fix NULL pointer dereference
    - Input: adp5589-keys - fix adp5589_gpio_get_value()
    - HID: bpf: fix cfi stubs for hid_bpf_ops
    - cachefiles: fix dentry leak in cachefiles_open_file()
    - pidfs: check for valid pid namespace
    - ACPI: video: Add backlight=native quirk for Dell OptiPlex 5480 AIO
    - ACPI: resource: Remove duplicate Asus E1504GAB IRQ override
    - ACPI: resource: Loosen the Asus E1404GAB DMI match to also cover the
      E1404GA
    - ACPI: resource: Add Asus Vivobook X1704VAP to
      irq1_level_low_skip_override[] (Closes: #1078696)
    - ACPI: resource: Add Asus ExpertBook B2502CVA to
      irq1_level_low_skip_override[]
    - btrfs: send: fix buffer overflow detection when copying path to cache
      entry
    - btrfs: fix a NULL pointer dereference when failed to start a new
      trasacntion
    - btrfs: drop the backref cache during relocation if we commit
    - btrfs: send: fix invalid clone operation for file that got its size
      decreased
    - btrfs: wait for fixup workers before stopping cleaner kthread during
      umount
    - cpufreq: Avoid a bad reference count on CPU node
    - cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock
      (Closes: #1076483)
    - gpio: davinci: fix lazy disable
    - net: pcs: xpcs: fix the wrong register that was written back
    - Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
      (CVE-2024-8805)
    - mac802154: Fix potential RCU dereference issue in mac802154_scan_worker
    - io_uring/net: harden multishot termination case for recv
    - ceph: fix cap ref leak via netfs init_request
    - tracing/hwlat: Fix a race during cpuhp processing
    - tracing/timerlat: Drop interface_lock in stop_kthread()
    - tracing/timerlat: Fix a race during cpuhp processing
    - tracing/timerlat: Fix duplicated kthread creation due to CPU
      online/offline
    - rtla: Fix the help text in osnoise and timerlat top tools
    - firmware/sysfb: Disable sysfb for firmware buffers with unknown parent
    - close_range(): fix the logics in descriptor table trimming
    - [x86] drm/i915/gem: fix bitwise and logical AND mixup
    - drm/sched: Fix dynamic job-flow control race
    - drm/sched: Add locking to drm_sched_entity_modify_sched
    - drm/sched: Always wake up correct scheduler in drm_sched_entity_push_job
    - drm/sched: Always increment correct scheduler score
    - drm/amd/display: Restore Optimized pbn Value if Failed to Disable DSC
    - drm/amd/display: Add HDR workaround for specific eDP
    - drm/amd/display: Enable idle workqueue for more IPS modes
    - drm/amd/display: update DML2 policy
      EnhancedPrefetchScheduleAccelerationFinal DCN35
    - drm/amd/display: Fix system hang while resume with TBT monitor
    - kconfig: fix infinite loop in sym_calc_choice()
    - kconfig: qconf: move conf_read() before drawing tree pain
    - kconfig: qconf: fix buffer overflow in debug links
    - [arm64] cputype: Add Neoverse-N3 definitions
    - [arm64] errata: Expand speculative SSBS workaround once more
    - uprobes: fix kernel info leak via "[uprobes]" vma
    - mm: z3fold: deprecate CONFIG_Z3FOLD
    - drm/amd/display: Allow backlight to go below
      `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT`
    - sunrpc: change sp_nrthreads from atomic_t to unsigned int.
    - NFSD: Async COPY result needs to return a write verifier
    - NFSD: Limit the number of concurrent async COPY operations
    - remoteproc: k3-r5: Acquire mailbox handle during probe routine
    - remoteproc: k3-r5: Delay notification of wakeup event
    - r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
    - r8169: add tally counter fields added with RTL8125
    - ACPI: battery: Simplify battery hook locking
    - ACPI: battery: Fix possible crash when unregistering a battery hook
    - drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066
    - Revert "drm/amd/display: Skip Recompute DSC Params if no Stream on Link"
    - drm/sched: revert "Always increment correct scheduler score"
    - rxrpc: Fix a race between socket set up and I/O thread creation
    - vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
    - ALSA: control: Fix leftover snd_power_unref()
    - crypto: octeontx* - Select CRYPTO_AUTHENC
    - drm/amd/display: Revert Avoid overflow assignment
    - perf report: Fix segfault when 'sym' sort key is not used
    - pmdomain: core: Reduce debug summary table width
    - perf python: Allow checking for the existence of warning options in clang
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.4
    - unicode: Don't special case ignorable code points
    - net: fec: don't save PTP state if PTP is unsupported
    - virtio_console: fix misc probe bugs
    - perf vdso: Missed put on 32-bit dsos
    - perf build: Fix static compilation error when libdw is not installed
    - perf build: Fix build feature-dwarf_getlocations fail for old libdw
    - zram: free secondary algorithms names
    - zram: don't free statically defined names
    - bpf: Call the missed btf_record_free() when map creation fails
    - bpf: Check percpu map value size first
    - [s390x] facility: Disable compile time optimization for decompressor code
    - [s390x] mm: Add cond_resched() to cmm_alloc/free_pages()
    - bpf, x64: Fix a jit convergence issue
    - ext4: don't set SB_RDONLY after filesystem errors
    - ext4: nested locking for xattr inode
    - [s390x] cpum_sf: Remove WARN_ON_ONCE statements
    - [s390x] traps: Handle early warnings gracefully
    - bpf: Prevent tail call between progs attached to different hooks
    - RDMA/mad: Improve handling of timed out WRs of mad agent
    - soundwire: intel_bus_common: enable interrupts before exiting reset
    - PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
    - RDMA/rtrs-srv: Avoid null pointer deref during path establishment
    - clk: bcm: bcm53573: fix OF node leak in init
    - PCI: Add ACS quirk for Qualcomm SA8775P
    - i2c: i801: Use a different adapter-name for IDF adapters
    - PCI: Mark Creative Labs EMU20k2 INTx masking as broken
    - i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master
      Driver Due to Race Condition
    - [riscv64] Don't have MAX_PHYSMEM_BITS exceed phys_addr_t
    - io_uring: check if we need to reschedule during overflow flush
    - mfd: intel_soc_pmic_chtwc: Make Lenovo Yoga Tab 3 X90F DMI match less
      strict
    - mfd: intel-lpss: Add Intel Arrow Lake-H LPSS PCI IDs
    - mfd: intel-lpss: Add Intel Panther Lake LPSS PCI IDs
    - [riscv64] avoid Imbalance in RAS
    - RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults
    - PCI: qcom: Disable mirroring of DBI and iATU register space in BAR region
    - PCI: endpoint: Assign PCI domain number for endpoint controllers
    - soundwire: cadence: re-check Peripheral status with delayed_work
    - [riscv64] kexec_file: Fix relocation type R_RISCV_ADD16 and R_RISCV_SUB16
      unknown
    - media: videobuf2-core: clear memory related fields in
      __vb2_plane_dmabuf_put()
    - remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table
    - clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
    - serial: protect uart_port_dtr_rts() in uart_shutdown() too
    - usb: typec: tipd: Free IRQ only if it was requested before
    - usb: chipidea: udc: enable suspend interrupt after usb reset
    - usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the
      Crashkernel Scenario
    - xhci: dbc: Fix STALL transfer event handling
    - usb: host: xhci-plat: Parse xhci-missing_cas_quirk and apply quirk
    - comedi: ni_routing: tools: Check when the file could not be opened
    - netfilter: nf_nat: don't try nat source port reallocation for reverse dir
      clash
    - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n
    - virtio_pmem: Check device status before requesting flush
    - tools/iio: Add memory allocation failure check for trigger_name
    - staging: vme_user: added bound check to geoid
    - usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c
    - dm vdo: don't refer to dedupe_context after releasing it
    - driver core: bus: Fix double free in driver API bus_register()
    - driver core: bus: Return -EIO instead of 0 when show/store invalid bus
      attribute
    - scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in
      lpfc_els_flush_cmd()
    - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV
      instance
    - scsi: lpfc: Revise TRACE_EVENT log flag severities from KERN_ERR to
      KERN_WARNING
    - drm/amd/display: Check null pointer before dereferencing se
    - fbcon: Fix a NULL pointer dereference issue in fbcon_putcs
    - smb: client: fix UAF in async decryption
    - fbdev: sisfb: Fix strbuf array overflow
    - NFSD: Mark filecache "down" if init fails
    - nfsd: nfsd_destroy_serv() must call svc_destroy() even if
      nfsd_startup_net() failed
    - ice: set correct dst VSI in only LAN filters
    - ice: clear port vlan config during reset
    - ice: fix memleak in ice_init_tx_topology()
    - ice: disallow DPLL_PIN_STATE_SELECTABLE for dpll output pins
    - ice: fix VLAN replay after reset
    - SUNRPC: Fix integer overflow in decode_rc_list()
    - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
    - net: phy: dp83869: fix memory corruption when enabling fiber
    - sfc: Don't invoke xdp_do_flush() from netpoll.
    - net: phy: aquantia: AQR115c fix up PMA capabilities
    - net: phy: aquantia: remove usage of phy_set_max_speed
    - tcp: fix to allow timestamp undo if no retransmits were sent
    - tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
    - tcp: fix TFO SYN_RECV to not zero retrans_stamp with retransmits out
    - rxrpc: Fix uninitialised variable in rxrpc_send_data()
    - net: dsa: sja1105: fix reception from VLAN-unaware bridges
    - netfilter: br_netfilter: fix panic with metadata_dst skb
    - net: pse-pd: Fix enabled status mismatch
    - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
    - Bluetooth: btusb: Don't fail external suspend requests
    - net: phy: bcm84881: Fix some error handling paths
    - nfsd: fix possible badness in FREE_STATEID
    - [amd64] thermal: intel: int340x: processor: Fix warning during module
      unload
    - Revert "net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled"
    - net: ethernet: adi: adin1110: Fix some error handling path in
      adin1110_read_fifo()
    - [armhf] net: dsa: b53: fix jumbo frame mtu check
    - [armhf] net: dsa: b53: fix max MTU for 1g switches
    - [armhf] net: dsa: b53: fix max MTU for BCM5325/BCM5365
    - [armhf] net: dsa: b53: allow lower MTUs on BCM5325/5365
    - [armhf] net: dsa: b53: fix jumbo frames on 10/100 ports
    - drm/nouveau: pass cli to nouveau_channel_new() instead of drm+device
    - nouveau/dmem: Fix privileged error in copy engine channel
    - gpio: aspeed: Add the flush write to ensure the write complete.
    - gpio: aspeed: Use devm_clk api to manage clock source
    - [x86] xen: mark boot CPU of PV guest in MSR_IA32_APICBASE
    - [amd64] powercap: intel_rapl_tpmi: Ignore minor version change
    - ice: Fix entering Safe Mode
    - ice: Fix netif_is_ice() in Safe Mode
    - ice: Flush FDB entries before reset
    - ice: Fix increasing MSI-X on VF
    - i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
    - igb: Do not bring the device up after non-fatal error
    - e1000e: change I219 (19) devices to ADP
    - net/sched: accept TCA_STAB only for root qdisc
    - net: ibm: emac: mal: fix wrong goto
    - net: ti: icssg-prueth: Fix race condition for VLAN table access
    - btrfs: zoned: fix missing RCU locking in error message when loading zone
      info
    - sctp: ensure sk_state is set to CLOSED if hashing fails in
      sctp_listen_start
    - netfilter: xtables: avoid NFPROTO_UNSPEC where needed
    - netfilter: fib: check correct rtable in vrf setups
    - net: ibm: emac: mal: add dcr_unmap to _remove
    - net: dsa: refuse cross-chip mirroring operations
    - net: netconsole: fix wrong warning
    - drm/fbdev-dma: Only cleanup deferred I/O if necessary
    - net: do not delay dst_entries_add() in dst_release()
    - rtnetlink: Add bulk registration helpers for rtnetlink message handlers.
    - vxlan: Handle error of rtnl_register_module().
    - bridge: Handle error of rtnl_register_module().
    - mctp: Handle error of rtnl_register_module().
    - mpls: Handle error of rtnl_register_module().
    - phonet: Handle error of rtnl_register_module().
    - ppp: fix ppp_async_encode() illegal access
    - net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC
    - slip: make slhc_remember() more robust against malicious packets
    - rcu/nocb: Fix rcuog wake-up from offline softirq
    - [x86] amd_nb: Add new PCI IDs for AMD family 1Ah model 60h
    - HID: multitouch: Add support for lenovo Y9000P Touchpad
    - hwmon: intel-m10-bmc-hwmon: relabel Columbiaville to CVL Die Temperature
    - hwmon: (tmp513) Add missing dependency on REGMAP_I2C
    - hwmon: (mc34vr500) Add missing dependency on REGMAP_I2C
    - hwmon: (adm9240) Add missing dependency on REGMAP_I2C
    - hwmon: (adt7470) Add missing dependency on REGMAP_I2C
    - hwmon: (ltc2991) Add missing dependency on REGMAP_I2C
    - [amd64] HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
    - HID: plantronics: Workaround for an unexcepted opposite volume key
    - HID: wacom: Hardcode (non-inverted) AES pens as BTN_TOOL_PEN
    - Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
    - usb: dwc3: core: Stop processing of pending events if controller is halted
    - usb: xhci: Fix problem with xhci resume from suspend
    - usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
    - usb: dwc3: re-enable runtime PM after failed resume
    - usb: gadget: core: force synchronous registration
    - hid: intel-ish-hid: Fix uninitialized variable 'rv' in
      ish_fw_xfer_direct_dma
    - ACPI: resource: Make Asus ExpertBook B2402 matches cover more models
    - ACPI: resource: Make Asus ExpertBook B2502 matches cover more models
    - drm/amdgpu: partially revert powerplay `__counted_by` changes
    - drm/amd/display: Clear update flags after update has been applied
    - drm/v3d: Stop the active perfmon before being destroyed
    - drm/vc4: Stop the active perfmon before being destroyed
    - drm/amd/display: fix hibernate entry for DCN35+
    - [x86] drm/i915/hdcp: fix connector refcounting
    - Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync
    - thermal: core: Reference count the zone in thermal_zone_get_by_id()
    - thermal: core: Free tzp copy along with the thermal zone
    - scsi: wd33c93: Don't use stale scsi_pointer value
    - scsi: fnic: Move flush_work initialization out of if block
    - scsi: ufs: Use pre-calculated offsets in ufshcd_init_lrb()
    - Revert "mmc: mvsdio: Use sg_miter for PIO"
    - mmc: sdhci-of-dwcmshc: Prevent stale command interrupt handling
    - mptcp: fallback when MPTCP opts are dropped after 1st data
    - ata: libata: avoid superfluous disk spin down + spin up during hibernation
    - OPP: fix error code in dev_pm_opp_set_config()
    - net: explicitly clear the sk pointer, when pf->create fails
    - net: Fix an unsafe loop on the list
    - net: dsa: lan9303: ensure chip reset and wait for READY status
    - net: phy: Remove LED entry from LEDs list on unregister
    - net: phy: realtek: Fix MMD access on RTL8126A-integrated PHY
    - mptcp: handle consistently DSS corruption
    - mptcp: pm: do not remove closing subflows
    - device-dax: correct pgoff align in dax_set_mapping()
    - ice: Fix improper handling of refcount in ice_dpll_init_rclk_pins()
    - ice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count()
    - nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
    - [amd64] powercap: intel_rapl_tpmi: Fix bogus register reading
    - btrfs: split remaining space to discard in chunks
    - btrfs: add cancellation points to trim loops
    - PM: domains: Fix alloc/free in dev_pm_domain_attach|detach_list()
    - idpf: use actual mbx receive payload length
    - kthread: unpark only parked kthread
    - fs/proc/kcore.c: allow translation of physical memory addresses
    - secretmem: disable memfd_secret() if arch cannot set direct map
    - PCI: Pass domain number to pci_bus_release_domain_nr() explicitly
    - io_uring/rw: fix cflags posting for single issue multishot read

  [ Salvatore Bonaccorso ]
  * d/config: Update with the help of kconfigeditor2
    - mm: Enable Z3FOLD_DEPRECATED instead of Z3FOLD

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 20 Oct 2024 20:51:13 +0200

linux (6.11.2-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.1
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.2

  [ Ben Hutchings ]
  * Revert "perf tools: Use $KBUILD_BUILD_TIMESTAMP as man page date" which is
    no longer useful
  * Fix some reproducibility issues (Closes: #1033663):
    - d/rules.real: Fix missing -ffile-prefix-map options for user-space
    - linux-perf: Remove remaining source filenames from executable
    - linux-perf: Work around gcc bug with -ffile-prefix-map and assembly
      sources
    - Documentation: Use relative source filenames in ABI documentation
    - kbuild, bpf: Fix BTF reproducibility
    - d/rules.real: Add -fdebug-prefix-map option for assembly sources in
      kernel
  * d/rules.real: Try harder to set the locale to C.UTF-8
  * udeb: Delete obsolete configuration for armel/marvell
  * udeb: Delete obsolete configuration for ide{-core,}-modules, ipv6-modules
  * udeb: Delete obsolete rtc-modules from kernel-image Provides
  * udeb: Fold i2c-modules into kernel-image (fixes FTBFS on alpha, sparc64)
  * udeb: Fold event-modules and mouse-modules into input-modules
  * udeb: Fold efi-modules into kernel-image
  * [arm64,armhf] udeb: Fold leds-modules into kernel-image
  * [amd64] udeb: Fold acpi-modules into kernel-image
  * [powerpc*] udeb: Fold fancontrol-modules into kernel-image
  * [alpha] udeb: Fold srm-modules into kernel-image
  * udeb: Fold crc-modules into kernel-image
  * [arm64,armhf] udeb: Add all watchdog drivers to kernel-image
    (Closes: #1081550)
  * Remove d/b/genorig.py in favour of uscan:
    - d/salsa-ci.yml: In extract-source, use origtagz instead of genorig.py
    - d/README.source: Document running uscan instead of genorig.py
    - d/rules: Expect orig tarballs to be in ../ and never in ../orig/

  [ Salvatore Bonaccorso ]
  * net/netfilter/ipvs: Enable IP_VS_TWOS as module (Closes: #1082903)
  * libcpupower: Update symbols file for changes in 6.11.2-1~exp1.

  [ Josua Mayer ]
  * [arm64] Enable drivers for AM64 SoC on HummingBoard-T (Closes: #1081837)
  * [arm64] udeb: Add kernel modules for I2C, USB and Ethernet on TI AM64
  * [arm64] udeb: Add kernel modules for RTC

  [ Jair Gonzalez ]
  * [amd64] arch/x86: Enable CONFIG_ADDRESS_MASKING
    (Linear Address Masking support) (Closes: #1082296)

  [ Uwe Kleine-König ]
  * [armhf] Enable support for GPIOs, i2c, spi and G-sensor for Terasic's
    DE10-nano board.

 -- Ben Hutchings <benh@debian.org>  Sun, 06 Oct 2024 01:00:02 +0200

linux (6.11-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_6.11

  [ Marcin Juszkiewicz ]
  * [arm64] udeb: Add kernel modules to get USB/SATA/PCIe working on Rockchip
    RK3588

  [ Alper Nebi Yasak ]
  * [arm64] Enable modules for MT8186 Chromebooks
    - Enable DRM_ITE_IT6505 and I2C_HID_OF_GOODIX as modules
    - Enable SND_SOC_MT8186_MT6366, SND_SOC_SOF_MT8186 and SND_SOC_MT8186 as
      modules
    - Enable SX9324 as a module
  * udeb: Move i2c-hid-of-goodix module to fb-modules

  [ Dylan Aïssi ]
  * [arm64] drivers/gpu/drm/panthor: Enable DRM_PANTHOR as module

  [ Dmitry Baryshkov ]
  * [arm64] Enable SC_CAMCC_8280XP as module, camera clock controller on
    Lenovo ThinkPad X13s laptop.
  * [arm64] Enable SC_GCC_8180X, SM_GPUCC_8150, INTERCONNECT_QCOM_SC8180X and
    PINCTRL_SC8180X as modules in order to support Lenovo Flex 5G laptops.
  * [arm64] Include modules for Lenovo Flex 5G (Snapdragon SC8180X)
  * [arm64] enable Qualcomm X Elite modules: CLK_X1E80100_GCC and
    INTERCONNECT_QCOM_X1E80100 as built-in and CLK_X1E80100_CAMCC,
    CLK_X1E80100_DISPCC, CLK_X1E80100_GPUCC, CLK_X1E80100_TCSRCC,
    DRM_PANEL_SAMSUNG_ATNA33XC20, PHY_QCOM_SNPS_EUSB2,
    PHY_QCOM_EUSB2_REPEATER, PINCTRL_X1E80100 and SND_SOC_X1E80100 as modules.
  * [arm64] Include modules for Qualcomm X Elite laptops

  [ Diederik de Haas ]
  * [arm64] Enable additional modules for rk356x devices:
    - [arm64] drivers/gpu/drm/panel: Enable DRM_PANEL_SITRONIX_ST7789V as
      module
    - [arm64] drivers/input/touchscreen: Enable TOUCHSCREEN_ST1232 as module
    - [arm64] drivers/pci/controller/dwc: Enable PCIE_ROCKCHIP_DW_EP
    - [arm64] drivers/regulator: Enable REGULATOR_TPS6286X as module
    - [arm64] drivers/rtc: Enable RTC_DRV_PCF85363 as module
    - [arm64] drivers/usb/typec: Enable TYPEC_WUSB3801 as module
    - [arm64] drivers/video/backlight: Enable BACKLIGHT_LM3630A as module
    - [arm64] sound/soc/codecs: Enable SND_SOC_DMIC and SND_SOC_TAS2562 as
      module
  * [arm64] Update rk3588 platform support:
    - [arm64] drivers/clocksource: Enable ROCKCHIP_TIMER
    - [arm64] drivers/iommu: Enable IOMMU_IO_PGTABLE_LPAE
    - [arm64] drivers/mmc/core: Enable PWRSEQ_EMMC
    - [arm64] drivers/phy/rockchip: Enable PHY_ROCKCHIP_SAMSUNG_HDPTX and
      PHY_ROCKCHIP_USBDP as module
  * [rt] Update to 6.11-rt7
  * d/config: Update with the help of kconfigeditor2

  [ Aurelien Jarno ]
  * [riscv64] Enable INPUT_MISC (Closes: #1079501).

  [ Bastian Blank ]
  * Revert "Make linux-libc-dev provide all cross packages".

  [ Helge Deller ]
  * [hppa] Fix kernel build with CONFIG_DRM=y on parisc64.

  [ Jair Gonzalez ]
  * [amd64] drivers/crypto/intel/iaa: Enable CRYPTO_DEV_IAA_CRYPTO
    (IAA Compression Accelerator Crypto Driver) (Closes: #1079272)

  [ Dave Vasilevsky ]
  * [powerpc] Explicitly disable CRASH_DUMP on 32-bit (Closes: #1079755)

  [ Ben Hutchings ]
  * [x86] ACPI: Enable ACPI_EC_DEBUGFS as module (Closes: #980555)
  * [i386] Stop building kernel packages
  * rtla: Switch to out-of-tree build:
    - Revert "tools/rtla: Restore option to set VERSION var to VERSION file's
      contents"
    - Fix installation from out-of-tree build
  * rtla: Enable verbose build
  * rtla: Build with dpkg's recommended compiler flags (regression in 6.9)
  * rtla: Fix missing debug symbols
  * rtla: Disable LTO
  * rtla: Set LD correctly for cross-build
  * objtool: Build with dpkg's recommended compiler flags (regression in
    6.5.1-1¬exp1):
    - Revert "tools build: Clean CFLAGS and LDFLAGS for fixdep"
    - Update "fixdep: Allow overriding HOSTCC and HOSTLD" to clear the
      buildflags when overriding
    - d/rules.d/t/objtool: Put buildflags in the correct variables when
      recursing
    - d/rules: Delete blhc ignore regexp for objtool

  [ Miao Wang ]
  * [loong64] Enable kernel support for LBT instructions.
  * [loong64] Enable KVM and para-virt support.
  * [loong64] Enable USB EHCI and OHCI host support.

  [ Yunseong Kim ]
  * mm/damon: Enable DAMON, DAMON_VADDR, DAMON_PADDR, DAMON_SYSFS,
    DAMON_RECLAIM, DAMON_LRU_SORT

  [ Miguel Bernal Marin ]
  * [x86] linux-cpupower: Add intel-speed-select command (Closes: #1036714)

  [ Vincent Blut ]
  * drivers/net/wireless: Support some Wi-Fi 7 devices: enable ATH12K,
    MT7925E, MT7925U, MT7996E and RTW89_8922AE as modules (Closes: #1081114)

  [ Emanuele Rocca ]
  * mm: set CONFIG_ZONE_DEVICE=y on arm64, loong64, ppc64, ppc64el, and
    riscv64, not only amd64. FS_DAX depends on it.

 -- Ben Hutchings <benh@debian.org>  Thu, 19 Sep 2024 18:42:39 +0200

linux (6.11~rc5-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Ben Hutchings ]
  * perf python: Fix the build on 32-bit arm by including missing
    "util/sample.h" (fixes FTBFS on many architectures)

  [ Aurelien Jarno ]
  * [riscv64] udeb: Add rtc-modules to Provides of kernel-image
  * [riscv64] udeb: Ship mtd in kernel-image, drop mtd-core-modules and
    add it to to Provides of kernel-image.

 -- Ben Hutchings <benh@debian.org>  Tue, 27 Aug 2024 12:59:49 +0200

linux (6.11~rc4-1~exp1) experimental; urgency=medium

  * New upstream release candidate
    - 9p: Fix DIO read through netfs (Closes: #1072004)

  [ Bastian Blank ]
  * Properly disable common headers packages

  [ Joel Stanley ]
  * [x86] Enable IPU6 MIPI drivers for Intel Alder Lake laptops
    (Closes: #994449, #1074441, #1060262, #1078170)

  [ Ben Hutchings ]
  * Drop "module: Avoid ABI changes when debug info is disabled" as we no
    longer try to maintain a module ABI
  * Update to 6.11:
    - Drop patches applied upstream:
      - "net: drop bad gso csum_start and offset in virtio_net_hdr"
    - Refresh patches:
      - Adjust context in "fs: Add MODULE_SOFTDEP declarations for hard-coded
        crypto drivers"
      - Adjust context in "arm64/acpi: Add fixup for HPE m400 quirks"
      - Adjust context in "add sysctl to disallow unprivileged CLONE_NEWUSER by
        default"
      - Update "Export symbols needed by Android drivers":
        - Update description to say this is only for binder and Waydroid
        - Add and remove exports to match what binder currently uses
      - Adjust context in "Tweak gitignore for Debian pkg-kernel using git"
      - Update "Use RELAXED ieee754 mode for Loongson-3 as 3A 4000 is 2008-
        only" for addition of EMULATED mode
      - Update "Include package version along with kernel release in stack
        traces" for addition of UID in dump_stack_print_info()
      - Adjust context in "security,perf: Allow further restriction of
        perf_event_open"
  * [rt] Update to 6.11-rc3-rt3
  * d/rules.real: Unset KBUILD_HOSTCFLAGS etc. instead of overriding to be
    empty
  * d/rules.d/Makefile.inc: Add scripts/include to header include path
  * d/config: Update with the help of kconfigeditor2:
    - hwmon: Enable SENSORS_LM90 (where not already enabled) instead of
      SENSORS_ADM1021 and SENSORS_MAX6642
    - [arm64] acpi/numa: Remove ACPI_NUMA which is now enabled automatically
    - debug: Remove TEST_USER_COPY
    - fs/netfs: Disable NETFS_DEBUG instead of FSCACHE_DEBUG
    - memstick: Remove MEMSTICK_REALTEK_PCI
    - [armhf] sound/soc/fsl: Remove SND_SOC_IMX_SPDIF which became redundant
      with SND_SOC_FSL_ASOC_CARD
    - staging/media/av7110: Remove DVB_BUDGET_PATCH
  * perf tools: Pass EXTRA_CFLAGS through to libbpf build again
  * d/config: Fix broken configs that were being resolved differently by
    kconfig:
    - [hppa/parisc64] Enable FLATMEM_MANUAL
    - [riscv64] Enable KERNEL_GZIP instead of KERNEL_XZ
    - [x86] Enable CPU_FREQ_DEFAULT_GOV_SCHEDUTIL instead of
      CPU_FREQ_DEFAULT_GOV_ONDEMAND or CPU_FREQ_DEFAULT_GOV_PERFORMANCE
  * d/control: Drop versions from Build-Depends that are satisfied since buster
  * d/control: Fix profiles for Build-Depends on bison, cpio, flex, xz-utils
  * d/control: Move bison, cpio, flex, xz-utils to Build-Depends-{Arch,Indep}

  [ Salvatore Bonaccorso ]
  * Compile with gcc-14 on all architectures

  [ Dmitry Baryshkov ]
  * [arm64] Include modules for Lenovo Yoga C630 and Lenovo Miix 630 into D-I
    packages.

  [ Jing Luo ]
  * [ia64] Purge ia64 from installer

  [ Aurelien Jarno ]
  * [riscv64] Enable STARFIVE_STARLINK_CACHE and PCIE_STARFIVE_HOST.
  * [riscv64] Enable PHY_STARFIVE_JH7110_DPHY_TX as a module.
  * [riscv64] Enable CLK_SOPHGO_SG2042_PLL, CLK_SOPHGO_SG2042_CLKGEN and
    CLK_SOPHGO_SG2042_RPGATE as modules.

  [ Jair Gonzalez ]
  * [amd64] tools/arch/x86/intel_sdsi: Add intel-sdsi package for Intel SDSi
    provisioning tool (Closes: #1059362)
  * [amd64] drivers/accel/habanalabs: Enable DRM_ACCEL_HABANALABS
    (Habana's AI Processors)
  * [amd64] drivers/accel/ivpu: Enable DRM_ACCEL_IVPU (Intel NPU, formerly
    called Intel VPU) (Closes: #1079170)

  [ Zhang Ning ]
  * [x86] Enable GPIO_WHISKEY_COVE, INTEL_BXT_PMIC_THERMAL as module.

 -- Ben Hutchings <benh@debian.org>  Wed, 21 Aug 2024 17:13:14 +0200

linux (6.10.12-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.12
    - [arm64] ASoC: SOF: mediatek: Add missing board compatible
    - [x86] ASoC: allow module autoloading for table board_ids
    - ALSA: hda/realtek - Fixed ALC256 headphone no sound
    - ALSA: hda/realtek - FIxed ALC285 headphone no sound
    - scsi: lpfc: Fix overflow build issue
    - [x86] hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
    - [x86] platform/x86: asus-wmi: Fix spurious rfkill on UX8406MA
    - [x86] platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F DMI
      match less strict
    - [armhf] net: ftgmac100: Ensure tx descriptor updates are visible
    - wifi: iwlwifi: lower message level for FW buffer destination
    - wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
    - wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
    - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
    - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
    - wifi: mac80211: free skb on error path in ieee80211_beacon_get_ap()
    - wifi: iwlwifi: clear trans->state earlier upon error
    - [arm64] can: m_can: Limit coalescing to peripheral instances
    - can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing configuration
    - [x86] ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI match
      less strict
    - [x86] ASoC: intel: fix module autoloading
    - spi: spidev: Add an entry for elgin,jg10309-01
    - [x86] ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
    - ALSA: hda: add HDMI codec ID for Intel PTL
    - smb: client: fix hang in wait_for_response() for negproto
    - [x86] platform/x86/amd: pmf: Make ASUS GA403 quirk generic
    - ice: check for XDP rings instead of bpf program when unconfiguring
    - [x86] hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides
      frequency
    - tools: hv: rm .*.cmd when make clean
    - spi: spidev: Add missing spi_device_id for jg10309-01
    - ocfs2: add bounds checking to ocfs2_xattr_find_entry()
    - ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
      (CVE-2024-41016)
    - drm: Use XArray instead of IDR for minors
    - accel: Use XArray instead of IDR for minors
    - drm: Expand max DRM device number to full MINORBITS
    - [x86] powercap/intel_rapl: Add support for AMD family 1Ah
    - [x86] powercap/intel_rapl: Fix the energy-pkg event for AMD CPUs
    - netfilter: nft_socket: make cgroupsv2 matching work with namespaces
    - netfilter: nft_socket: Fix a NULL vs IS_ERR() bug in
      nft_socket_cgroup_subtree_level()
    - Bluetooth: btintel_pcie: Allocate memory for driver private data
      (CVE-2024-46869)
    - nvme-pci: qdepth 1 quirk
    - can: mcp251xfd: properly indent labels
    - can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
      mcp251xfd_chip_start/stop()
    - USB: serial: pl2303: add device id for Macrosilicon MS3020
    - USB: usbtmc: prevent kernel-usb-infoleak
    - [x86] powercap: intel_rapl: Change an error pointer to NULL

  [ Helge Deller ]
  * [hppa] Fix kernel build with CONFIG_DRM=y on parisc64.

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 01 Oct 2024 19:08:55 +0200

linux (6.10.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.10
    - libfs: fix get_stashed_dentry()
    - sch/netem: fix use after free in netem_dequeue
    - xfs: xfs_finobt_count_blocks() walks the wrong btree
    - net: ethernet: ti: am65-cpsw: Fix NULL dereference on XDP_TX
    - net: microchip: vcap: Fix use-after-free error in kunit test
    - net: ethernet: ti: am65-cpsw: fix XDP_DROP, XDP_TX and XDP_REDIRECT
    - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
    - [x86] KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
    - [x86] KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and
      MSR_GS_BASE
    - [x86] KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is
      missing
    - ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius
      devices
    - ALSA: hda/realtek: add patch for internal mic in Lenovo V145
    - ALSA: hda/realtek: Enable Mute Led for HP Victus 15-fb1xxx
    - ALSA: hda/realtek - Fix inactive headset mic jack for ASUS Vivobook 15
      X1504VAP
    - ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
    - [powerpc*] qspinlock: Fix deadlock in MCS queue
    - smb: client: fix double put of @cfile in smb2_set_path_size()
    - ksmbd: unset the binding mark of a reused connection
    - ksmbd: Unlock on in ksmbd_tcp_set_interfaces()
    - ata: libata: Fix memory leak for error path in ata_host_alloc()
    - [x86] tdx: Fix data leak in mmio_read()
    - [x86] perf/x86/intel: Limit the period on Haswell
    - [arm64,armhf] irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
    - [riscv64] irqchip/sifive-plic: Probe plic driver early for Allwinner D1
      platform
    - [x86] kaslr: Expose and use the end of the physical memory address space
    - rtmutex: Drop rt_mutex::wait_lock before scheduling
    - irqchip/riscv-aplic: Fix an IS_ERR() vs NULL bug in probe()
    - nvme-pci: Add sleep quirk for Samsung 990 Evo
    - Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over
      BREDR/LE"
    - Bluetooth: MGMT: Ignore keys being loaded with invalid type
    - mmc: core: apply SD quirks earlier during probe
    - mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
    - mmc: sdhci-of-aspeed: fix module autoloading
    - mmc: cqhci: Fix checking of CQHCI_HALT state
    - fuse: update stats for pages in dropped aux writeback list
    - fuse: disable the combination of passthrough and writeback cache
    - fuse: check aborted connection before adding requests to pending list for
      resending
    - fuse: use unsigned type for getxattr/listxattr size truncation
    - fuse: fix memory leak in fuse_create_open
    - fuse: clear PG_uptodate when using a stolen page
    - [x86] ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder
    - [riscv64] misaligned: Restrict user access to kernel memory
    - [riscv64] clk: starfive: jh7110-sys: Add notifier for PLL0 clock
    - [arm64] clk: qcom: clk-alpha-pll: Fix the pll post div mask
    - [arm64] clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
    - [arm64] pinctrl: qcom: x1e80100: Bypass PDC wakeup parent for now
    - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
    - mm: vmalloc: optimize vmap_lazy_nr arithmetic when purging each vmap_area
    - alloc_tag: fix allocation tag reporting when CONFIG_MODULES=n
    - codetag: debug: mark codetags for poisoned page as empty
    - maple_tree: remove rcu_read_lock() from mt_validate()
    - kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y
    - mm: vmalloc: ensure vmap_block is initialised before adding to queue
    - mm/slub: add check for s->flags in the alloc_tagging_slab_free_hook
    - Revert "mm: skip CMA pages when they are not available"
    - spi: rockchip: Resolve unbalanced runtime PM / system PM handling
    - tracing/osnoise: Use a cpumask to know what threads are kthreads
    - tracing/timerlat: Only clear timer if a kthread exists
    - tracing: Avoid possible softlockup in tracing_iter_reset()
    - tracing/timerlat: Add interface_lock around clearing of kthread in
      stop_kthread()
    - userfaultfd: don't BUG_ON() if khugepaged yanks our page table
    - userfaultfd: fix checks for huge PMDs
    - fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF
    - eventfs: Use list_del_rcu() for SRCU protected list variable
    - net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup
    - net: mctp-serial: Fix missing escapes on transmit
    - [x86] fpu: Avoid writing LBR bit to IA32_XSS unless supported
    - [x86] apic: Make x2apic_disable() work correctly
    - Revert "drm/amdgpu: align pp_power_profile_mode with kernel docs"
    - Revert "wifi: ath11k: restore country code during resume"
    - Revert "wifi: ath11k: support hibernation"
    - tcp_bpf: fix return value of tcp_bpf_sendmsg()
    - ila: call nf_unregister_net_hooks() sooner
    - sched: sch_cake: fix bulk flow accounting logic for host fairness
    - nilfs2: fix missing cleanup on rollforward recovery error
    - nilfs2: protect references to superblock parameters exposed in sysfs
    - nilfs2: fix state management in error path of log writing function
    - btrfs: qgroup: don't use extent changeset when not needed
    - btrfs: zoned: handle broken write pointer on zones
    - drm/amdgpu: always allocate cleared VRAM for GEM allocations
    - [x86] drm/i915: Do not attempt to load the GSC multiple times
    - drm/amd/display: Lock DC and exit IPS when changing backlight
    - ALSA: hda/realtek: extend quirks for Clevo V5[46]0
    - ALSA: control: Apply sanity check of input values for user elements
    - ALSA: hda: Add input value sanity checks to HDMI channel map controls
    - wifi: ath12k: fix uninitialize symbol error on ath12k_peer_assoc_h_he()
    - wifi: ath12k: fix firmware crash due to invalid peer nss
    - smack: unix sockets: fix accept()ed socket label
    - drm/amd/display: Check UnboundedRequestEnabled's value
    - cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE until valid partition
    - virt: sev-guest: Mark driver struct with __refdata to prevent section
      mismatch
    - bpf, verifier: Correct tail_call_reachable for bpf prog
    - ELF: fix kernel.randomize_va_space double read
    - [arm64] irqchip/renesas-rzg2l: Reorder function calls in
      rzg2l_irqc_irq_disable()
    - [armhf] irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
    - media: b2c2: flexcop-usb: fix flexcop_usb_memory_req
    - af_unix: Remove put_pid()/put_cred() in copy_peercred().
    - [riscv64] iommu: sun50i: clear bypass register
    - netfilter: nf_conncount: fix wrong variable type
    - gve: Add adminq mutex lock
    - wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check
    - udf: Avoid excessive partition lengths
    - [riscv64] kprobes: Use patch_text_nosync() for insn slots
    - media: vivid: fix wrong sizeimage value for mplane
    - leds: spi-byte: Call of_node_put() on error path
    - wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
    - wifi: rtw89: wow: prevent to send unexpected H2C during download Firmware
    - usb: uas: set host status byte on data completion error
    - usb: gadget: aspeed_udc: validate endpoint index for ast udc
    - drm/amdgpu: Fix register access violation
    - drm/amd/display: Run DC_LOG_DC after checking link->link_enc
    - drm/amd/display: Check HDCP returned status
    - drm/amd/display: Validate function returns
    - drm/amdgpu: add missing error handling in function
      amdgpu_gmc_flush_gpu_tlb_pasid
    - drm/amdgpu: Fix smatch static checker warning
    - drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts
    - [x86] crypto: qat - initialize user_input.lock for rate_limiting
    - media: vivid: don't set HDMI TX controls if there are no HDMI outputs
    - vfio/spapr: Always clear TCEs before unsetting the window
    - fs: don't copy to userspace under namespace semaphore
    - fs: relax permissions for statmount()
    - [powerpc*] rtas: Prevent Spectre v1 gadget construction in sys_rtas()
    - seccomp: release task filters when the task exits
    - ice: Check all ice_vsi_rebuild() errors in function
    - PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
    - Input: ili210x - use kvmalloc() to allocate buffer for firmware update
    - media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
    - pcmcia: Use resource_size function on resource object
    - drm/amd/display: Check denominator pbn_div before used
    - drm/amd/display: Check denominator crb_pipes before used
    - drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6
    - drm/amdgpu: Correct register used to clear fault status
    - drm/amdgpu/display: handle gfx12 in amdgpu_dm_plane_format_mod_supported
    - can: bcm: Remove proc entry when dev is unregistered.
    - [arm64] can: m_can: Release irq on error in m_can_open
    - [arm64] can: m_can: Reset coalescing during suspend/resume
    - [arm64] can: m_can: Remove coalesing disable in isr during suspend
    - [arm64] can: m_can: Remove m_can_rx_peripheral indirection
    - [arm64] can: m_can: Do not cancel timer from within timer
    - [arm64] can: m_can: disable_all_interrupts, not clear active_interrupts
    - [arm64] can: m_can: Reset cached active_interrupts on start
    - can: mcp251xfd: fix ring configuration when switching from CAN-CC to
      CAN-FD mode
    - cifs: Fix lack of credit renegotiation on read retry
    - netfs, cifs: Fix handling of short DIO read
    - cifs: Fix copy offload to flush destination region
    - cifs: Fix FALLOC_FL_ZERO_RANGE to preflush buffered part of target region
    - igb: Fix not clearing TimeSync interrupts for 82580
    - ice: Add netif_device_attach/detach into PF reset flow
    - [x86] platform/x86: dell-smbios: Fix error path in dell_smbios_init()
    - spi: intel: Add check devm_kasprintf() returned value
    - regulator: core: Stub devm_regulator_bulk_get_const() if !CONFIG_REGULATOR
    - Bluetooth: qca: If memdump doesn't work, re-enable IBS
    - Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once
    - Bluetooth: MGMT: Fix not generating command complete for
      MGMT_OP_DISCONNECT
    - hwmon: ltc2991: fix register bits defines
    - scripts: fix gfp-translate after ___GFP_*_BITS conversion to an enum
    - igc: Unlock on error in igc_io_resume()
    - [x86] hwmon: (hp-wmi-sensors) Check if WMI event data exists
    - perf lock contention: Fix spinlock and rwlock accounting
    - net: ethernet: ti: am65-cpsw: Fix RX statistics for XDP_TX and
      XDP_REDIRECT
    - net: phy: Fix missing of_node_put() for leds
    - ptp: ocp: convert serial ports to array
    - ptp: ocp: adjust sysfs entries to expose tty information
    - ice: move netif_queue_set_napi to rtnl-protected sections
    - ice: protect XDP configuration with a mutex
    - ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset
    - ice: remove ICE_CFG_BUSY locking from AF_XDP code
    - ice: do not bring the VSI up, if it was down before the XDP setup
    - usbnet: modern method to get random MAC
    - net: dqs: Do not use extern for unused dql_group
    - bpf, net: Fix a potential race in do_sock_getsockopt()
    - bpf: add check for invalid name in btf_name_valid_section()
    - bareudp: Fix device stats updates.
    - fou: Fix null-ptr-deref in GRO.
    - r8152: fix the firmware doesn't work
    - net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
    - xen: privcmd: Fix possible access to a freed kirqfd instance
    - firmware: cs_dsp: Don't allow writes to read-only controls
    - [arm64] phy: zynqmp: Take the phy mutex in xlate
    - ASoC: topology: Properly initialize soc_enum values
    - dm init: Handle minors larger than 255
    - cxl/region: Fix a race condition in memory hotplug notifier
    - [amd64] iommu/vt-d: Handle volatile descriptor status read
    - [amd64] iommu/vt-d: Remove control over Execute-Requested requests
    - block: don't call bio_uninit from bio_endio
    - cgroup: Protect css->cgroup write under css_set_lock
    - devres: Initialize an uninitialized struct member
    - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
    - virtio_ring: fix KMSAN error for premapped mode
    - wifi: rtw88: usb: schedule rx work after everything is set up
    - scsi: ufs: core: Remove SCSI host only if added
    - scsi: pm80xx: Set phy->enable_completion only when we wait for it
    - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
    - [x86] crypto: qat - fix unintentional re-enabling of error interrupts
    - tracing/kprobes: Add symbol counting check when module loads
    - hwmon: (adc128d818) Fix underflows seen when writing limit attributes
    - hwmon: (lm95234) Fix underflows seen when writing limit attributes
    - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
    - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
    - ASoc: TAS2781: replace beXX_to_cpup with get_unaligned_beXX for
      potentially broken alignment
    - libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
    - drm/amdgpu: Set no_hw_access when VF request full GPU fails
    - ext4: fix possible tid_t sequence overflows
    - jbd2: avoid mount failed when commit block is partial submitted
    - dma-mapping: benchmark: Don't starve others when doing the test
    - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
    - [x86] perf/x86/intel: Hide Topdown metrics events if the feature is not
      enumerated
    - [arm64] PCI: qcom: Override NO_SNOOP attribute for SA8775P RC
    - staging: vchiq_core: Bubble up wait_event_interruptible() return value
    - iommufd: Require drivers to supply the cache_invalidate_user ops
    - bpf: Remove tst_run from lwt_seg6local_prog_ops.
    - watchdog: imx7ulp_wdt: keep already running watchdog enabled
    - drm/amdgpu: reject gang submit on reserved VMIDs
    - smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
    - btrfs: slightly loosen the requirement for qgroup removal
    - btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in
      walk_down_proc()
    - btrfs: replace BUG_ON with ASSERT in walk_down_proc()
    - btrfs: clean up our handling of refs == 0 in snapshot delete
    - btrfs: handle errors from btrfs_dec_ref() properly
    - btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
    - btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
    - ethtool: fail closed if we can't get max channel used in indirection
      tables
    - cxl/region: Verify target positions using the ordered target list
    - [riscv64] set trap vector earlier
    - PCI: Add missing bridge lock to pci_bus_lock()
    - tcp: Don't drop SYN+ACK for simultaneous connect().
    - Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush()
    - net: dpaa: avoid on-stack arrays of NR_CPUS elements
    - drm/amdgpu: add mutex to protect ras shared memory
    - regmap: maple: work around gcc-14.1 false-positive warning
    - [s390x] boot: Do not assume the decompressor range is reserved
    - cachefiles: Set the max subreq size for cache writes to MAX_RW_COUNT
    - vfs: Fix potential circular locking through setxattr() and removexattr()
    - i3c: master: svc: resend target address when get NACK
    - i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup
    - spi: hisi-kunpeng: Add verification for the max_frequency provided by the
      firmware
    - btrfs: initialize location to fix -Wmaybe-uninitialized in
      btrfs_lookup_dentry()
    - [s390x] vmlinux.lds.S: Move ro_after_init section behind rodata section
    - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
    - [amd64] HID: amd_sfh: free driver_data after destroying hid device
    - Input: uinput - reject requests with unreasonable number of slots
    - usbnet: ipheth: race between ipheth_close and error handling
    - Squashfs: sanity check symbolic link size
    - of/irq: Prevent device address out-of-bounds read in interrupt map walk
    - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
    - [arm64] net: hns3: void array out of bound when loop tnl_num
    - kunit/overflow: Fix UB in overflow_allocation_test
    - [mips64el] cevt-r4k: Don't call get_c0_compare_int if timer irq is
      installed
    - spi: spi-fsl-lpspi: limit PRESCALE bit in TCR register
    - ata: pata_macio: Use WARN instead of BUG
    - smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
    - NFSv4: Add missing rescheduling points in
      nfs_client_return_marked_delegations
    - drm/amdgpu: Fix two reset triggered in a row
    - drm/amdgpu: Add reset_context flag for host FLR
    - drm/amdgpu: Fix amdgpu_device_reset_sriov retry logic
    - fs: only copy to userspace on success in listmount()
    - tcp: process the 3rd ACK with sk_socket for TFO/MPTCP
    - usb: dwc3: core: update LC timer as per USB Spec V3.2
    - usb: cdns2: Fix controller reset issue
    - usb: dwc3: Avoid waking up gadget during startxfer
    - usb: typec: ucsi: Fix the partner PD revision
    - misc: fastrpc: Fix double free of 'buf' in error path
    - [arm*] binder: fix UAF caused by offsets overwrite
    - dt-bindings: nvmem: Use soc-nvmem node name instead of nvmem
    - nvmem: u-boot-env: error if NVMEM device is too small
    - nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
    - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
    - Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
    - VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
    - clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
    - clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
    - clocksource/drivers/timer-of: Remove percpu irq related code
    - uprobes: Use kzalloc to allocate xol area
    - perf/aux: Fix AUX buffer serialization
    - mm: zswap: rename is_zswap_enabled() to zswap_is_enabled()
    - mm/memcontrol: respect zswap.writeback setting from parent cg too
    - workqueue: wq_watchdog_touch is always called with valid CPU
    - workqueue: Improve scalability of workqueue watchdog touch
    - path: add cleanup helper
    - fs: simplify error handling
    - fs: relax permissions for listmount()
    - ACPI: processor: Return an error if acpi_processor_get_info() fails in
      processor_add()
    - ACPI: processor: Fix memory leaks in error paths of processor_add()
    - [arm64] acpi: Move get_cpu_for_acpi_id() to a header
    - [arm64] acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
    - can: mcp251xfd: mcp251xfd_handle_rxif_ring_uinc(): factor out in separate
      function
    - can: mcp251xfd: rx: prepare to workaround broken RX FIFO head index
      erratum
    - can: mcp251xfd: clarify the meaning of timestamp
    - can: mcp251xfd: rx: add workaround for erratum DS80000789E 6 of mcp2518fd
    - drm/amd: Add gfx12 swizzle mode defs
    - drm/amdgpu: handle gfx12 in amdgpu_display_verify_sizes
    - ata: libata-scsi: Remove redundant sense_buffer memsets
    - ata: libata-scsi: Check ATA_QCFLAG_RTF_FILLED before using result_tf
    - hid: bpf: add BPF_JIT dependency
    - net/mlx5e: SHAMPO, Use KSMs instead of KLMs
    - net/mlx5e: SHAMPO, Fix page leak
    - [arm64] clk: qcom: gcc-x1e80100: Fix USB 0 and 1 PHY GDSC pwrsts flags
    - [arm64] clk: qcom: ipq9574: Update the alpha PLL type for GPLLs
    - [powerpc*] 64e: remove unused IBM HTW code
    - [powerpc*] 64e: split out nohash Book3E 64-bit code
    - [powerpc*] 64e: Define mmu_pte_psize static
    - [powerpc*] vdso: Don't discard rela sections
    - nvmet-tcp: fix kernel crash if commands allocation fails
    - nvme-pci: allocate tagset on reset if necessary
    - [arm64] clk: qcom: gcc-x1e80100: Don't use parking clk_ops for QUPs
    - [x86,arm64] ASoc: SOF: topology: Clear SOF link platform name upon unload
    - [riscv64] mm: Do not restrict mmap address based on hint
    - [arm64,armhf] ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode
    - [arm64] clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs
    - [arm64] clk: qcom: gcc-sm8550: Don't park the USB RCG at registration time
    - nouveau: fix the fwsec sb verification register.
    - [x86] drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
    - [x86] drm/i915/fence: Mark debug_fence_free() with __maybe_unused
    - [arm64,armhf] gpio: rockchip: fix OF node leak in probe()
    - [arm64] gpio: modepin: Enable module autoloading
    - smb: client: fix double put of @cfile in smb2_rename_path()
    - [riscv64] Fix toolchain vector detection
    - [riscv64] Do not restrict memory size because of linear mapping on nommu
    - [riscv64] Add tracepoints for SBI calls and returns
    - [riscv64] Improve sbi_ecall() code generation by reordering arguments
    - [riscv64] Fix RISCV_ALTERNATIVE_EARLY
    - cifs: Fix zero_point init on inode initialisation
    - cifs: Fix SMB1 readv/writev callback in the same way as SMB2/3
    - nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err
    - nvme: fix status magic numbers
    - nvme: rename CDR/MORE/DNR to NVME_STATUS_*
    - nvmet: Identify-Active Namespace ID List command should reject invalid
      nsid
    - ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery()
    - [x86] mm: Fix PTI for i386 some more
    - [x86] drm/i915/display: Add mechanism to use sink model when applying
      quirk
    - [x86] drm/i915/display: Increase Fast Wake Sync length as a quirk
    - btrfs: fix race between direct IO write and fsync when using same fd
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.11
    - usb: typec: ucsi: Always set number of alternate modes
    - usb: typec: ucsi: Fix cable registration
    - drm/mediatek: Set sensible cursor width/height values to fix crash
    - ksmbd: override fsids for share path check
    - ksmbd: override fsids for smb2_query_info()
    - usbnet: ipheth: remove extraneous rx URB length check
    - usbnet: ipheth: drop RX URBs with no payload
    - usbnet: ipheth: do not stop RX on failing RX callback
    - usbnet: ipheth: fix carrier detection in modes 1 and 4
    - net: ethernet: use ip_hdrlen() instead of bit shift
    - drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero
    - drm: panel-orientation-quirks: Add quirk for Ayn Loki Max
    - net: phy: vitesse: repair vsc73xx autonegotiation
    - [powerpc*] mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL
    - wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
    - drm/amdgpu: Update kmd_fw_shared for VCN5
    - [arm64] net: hns3: use correct release function during uninitialization
    - btrfs: update target inode's ctime on unlink
    - Input: ads7846 - ratelimit the spi_sync error message
    - Input: synaptics - enable SMBus for HP Elitebook 840 G2
    - hid-asus: add ROG Ally X prod ID to quirk list
    - HID: multitouch: Add support for GT7868Q
    - Input: edt-ft5x06 - add support for FocalTech FT8201
    - cgroup/cpuset: Eliminate unncessary sched domains rebuilds in hotplug
    - scripts: kconfig: merge_config: config files: add a trailing newline
    - [x86] platform/x86: asus-wmi: Add quirk for ROG Ally X
    - [x86] platform/surface: aggregator_registry: Add Support for Surface Pro
      10
    - [x86] platform/surface: aggregator_registry: Add support for Surface
      Laptop Go 3
    - [x86] platform/surface: aggregator_registry: Add support for Surface
      Laptop Studio 2
    - [x86] platform/surface: aggregator_registry: Add fan and thermal sensor
      support for Surface Laptop 5
    - [x86] platform/surface: aggregator_registry: Add support for Surface
      Laptop 6
    - spi: zynqmp-gqspi: Scale timeout by data size
    - drm/msm/adreno: Fix error return if missing firmware-name
    - Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
    - [s390x] mm: Pin identity mapping base to zero
    - smb/server: fix return value of smb2_open()
    - NFSv4: Fix clearing of layout segments in layoutreturn
    - NFS: Avoid unnecessary rescanning of the per-server delegation list
    - [x86] platform/x86: panasonic-laptop: Fix SINF array out of bounds
      accesses
    - [x86] platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf
      array
    - mptcp: pm: Fix uaf in __timer_delete_sync
    - [arm64] dts: rockchip: fix eMMC/SPI corruption when audio has been used on
      RK3399 Puma
    - [arm64] dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399
      Puma
    - minmax: reduce min/max macro expansion in atomisp driver
    - net: tighten bad gso csum offset check in virtio_net_hdr
    - net: libwx: fix number of Rx and Tx descriptors
    - dm-integrity: fix a race condition when accessing recalc_sector
    - clocksource: hyper-v: Use lapic timer in a TDX VM without paravisor
    - [x86] hyperv: fix kexec crash due to VP assist page corruption
    - mm: avoid leaving partial pfn mappings around in error case
    - bcachefs: Fix bch2_extents_match() false positive
    - bcachefs: Revert lockless buffered IO path
    - bcachefs: Don't delete open files in online fsck
    - [arm64] dts: rockchip: fix PMIC interrupt pin in pinctrl for ROCK Pi E
    - [arm64] firmware: qcom: uefisecapp: Fix deadlock in qcuefi_acquire()
    - [riscv64] dts: starfive: jh7110-common: Fix lower rate of CPUfreq by
      setting PLL0 rate to 1.5GHz
    - drm/amd/display: Disable error correction if it's not supported
    - drm/amd/display: Fix FEC_READY write on DP LT
    - eeprom: digsy_mtc: Fix 93xx46 driver probe failure
    - clk/sophgo: Using BUG() instead of unreachable() in mmux_get_parent_id()
    - cxl/core: Fix incorrect vendor debug UUID define
    - cxl: Restore XOR'd position bits during address translation
    - net: hsr: Send supervisory frames to HSR network with ProxyNodeTable data
    - hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >=
      1.2
    - ice: Fix lldp packets dropping after changing the number of channels
    - ice: fix accounting for filters shared by multiple VSIs
    - ice: fix VSI lists confusion when adding VLANs
    - igb: Always call igb_xdp_ring_update_tail() under Tx lock
    - net/mlx5: Update the list of the PCI supported devices
    - net/mlx5e: Add missing link modes to ptys2ethtool_map
    - net/mlx5e: Add missing link mode to ptys2ext_ethtool_map
    - net/mlx5: Explicitly set scheduling element and TSAR type
    - net/mlx5: Add missing masks and QoS bit masks for scheduling elements
    - net/mlx5: Correct TASR typo into TSAR
    - net/mlx5: Verify support for scheduling element and TSAR type
    - net/mlx5: Fix bridge mode operations when there are no VFs
    - fou: fix initialization of grc
    - net: ftgmac100: Enable TX interrupt to avoid TX timeout
    - net: phy: dp83822: Fix NULL pointer dereference on DP83825 devices
    - drivers: perf: Fix smp_processor_id() use in preemptible code
    - [riscv64] Disable preemption while handling PR_RISCV_CTX_SW_FENCEI_OFF
    - netfilter: nft_socket: fix sk refcount leaks
    - net: hsr: prevent NULL pointer dereference in hsr_proxy_announce()
    - net: dsa: felix: ignore pending status of TAS module when it's disabled
    - net: dpaa: Pad packets to ETH_ZLEN
    - netlink: specs: mptcp: fix port endianness
    - tracing/osnoise: Fix build when timerlat is not enabled
    - spi: nxp-fspi: fix the KASAN report out-of-bounds bug
    - soundwire: stream: Revert "soundwire: stream: fix programming slave ports
      for non-continous port maps"
    - drm/syncobj: Fix syncobj leak in drm_syncobj_eventfd_ioctl
    - dma-buf: heaps: Fix off-by-one in CMA heap fault handler
    - drm/nouveau/fb: restore init() for ramgp102
    - drm/amdgpu/atomfirmware: Silence UBSAN warning
    - drm/amd/display: Avoid race between dcn10_set_drr() and
      dc_state_destruct()
    - drm/amd/display: Avoid race between dcn35_set_drr() and
      dc_state_destruct()
    - drm/amd/amdgpu: apply command submission parser for JPEG v1
    - drm/amd/amdgpu: apply command submission parser for JPEG v2+
    - tracing/kprobes: Fix build error when find_module() is not available
    - [x86] ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item
    - [x86] ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item
    - spi: geni-qcom: Undo runtime PM changes at driver exit time
    - spi: geni-qcom: Fix incorrect free_irq() sequence
    - [x86] drm/i915/guc: prevent a possible int overflow in wq offsets
    - ASoC: codecs: avoid possible garbage value in peb2466_reg_read()
    - cifs: Fix signature miscalculation
    - pinctrl: meteorlake: Add Arrow Lake-H/U ACPI ID
    - ASoC: meson: axg-card: fix 'use-after-free'
    - usb: typec: ucsi: Only set number of plug altmodes after registration

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 22 Sep 2024 16:24:33 +0200

linux (6.10.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.8
    - drm/amdgpu/mes: fix mes ring buffer overflow
    - erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially
      fails
    - ALSA: seq: Skip event type filtering for UMP events
    - ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop 14-ey0xxx
    - ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED
    - [ppc64el] tpm: ibmvtpm: Call tpm2_sessions_init() to initialize session
      support
    - btrfs: fix a use-after-free when hitting errors inside
      btrfs_submit_chunk()
    - btrfs: run delayed iputs when flushing delalloc
    - smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()
    - [arm64,armhf] pinctrl: rockchip: correct RK3328 iomux width flag for
      GPIO2-B pins
    - pinctrl: single: fix potential NULL dereference in pcs_get_function()
    - netfs, ceph: Partially revert "netfs: Replace PG_fscache by setting
      folio->private and marking dirty"
    - wifi: wfx: repair open network AP mode
    - wifi: mwifiex: duplicate static structs used in driver instances
    - [amd64,arm64] net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc
      response
    - mptcp: close subflow when receiving TCP+FIN
    - mptcp: sched: check both backup in retrans
    - mptcp: pr_debug: add missing \n at the end
    - mptcp: pm: reuse ID 0 after delete and re-add
    - mptcp: pm: skip connecting to already established sf
    - mptcp: pm: reset MPC endp ID when re-added
    - mptcp: pm: send ACK on an active subflow
    - mptcp: pm: fix RM_ADDR ID for the initial subflow
    - mptcp: pm: do not remove already closed subflows
    - mptcp: pm: fix ID 0 endp usage after multiple re-creations
    - mptcp: avoid duplicated SUB_CLOSED events
    - mptcp: pm: ADD_ADDR 0 is not a new address
    - binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined
    - [arm64] drm/v3d: Disable preemption while updating GPU stats
    - [x86] drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict
    - [x86] drm/i915/dp_mst: Fix MST state after a sink reset
    - drm/amdgpu: align pp_power_profile_mode with kernel docs
    - drm/amdgpu/swsmu: always force a state reprogram on init
    - drm/vmwgfx: Prevent unmapping active read buffers
    - drm/vmwgfx: Fix prime with external buffers
    - drm/vmwgfx: Disable coherent dumb buffers without 3d (Closes: #1079167)
    - video/aperture: optionally match the device in sysfb_disable()
    - drm/amdgpu: Do not wait for MP0_C2PMSG_33 IFWI init in SRIOV
    - drm/amdgpu: fix eGPU hotplug regression
    - pinctrl: qcom: x1e80100: Update PDC hwirq map
    - [x86] ASoC: SOF: amd: move iram-dram fence register programming sequence
    - [x86] ASoC: SOF: amd: Fix for incorrect acp error register offsets
    - [x86] ASoC: amd: acp: fix module autoloading
    - [x86] ASoC: SOF: amd: Fix for acp init sequence
    - ALSA: hda: cs35l56: Don't use the device index as a calibration index
    - ASoC: cs-amp-lib-test: Force test calibration blob entries to be valid
    - ASoC: cs-amp-lib: Ignore empty UEFI calibration entries
    - nfsd: ensure that nfsd4_fattr_args.context is zeroed out
    - backing-file: convert to using fops->splice_write
    - pinctrl: mediatek: common-v2: Fix broken bias-disable for
      PULL_PU_PD_RSEL_TYPE
    - pinctrl: qcom: x1e80100: Fix special pin offsets
    - pinctrl: starfive: jh7110: Correct the level trigger configuration of iev
      register
    - nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open
    - mm: Fix missing folio invalidation calls during truncation
    - afs: Fix post-setattr file edit to do truncation correctly
    - netfs: Fix netfs_release_folio() to say no if folio dirty
    - netfs: Fix trimming of streaming-write folios in netfs_inval_folio()
    - netfs: Fix missing iterator reset on retry of short read
    - netfs: Fix interaction of streaming writes with zero-point tracker
    - smb/client: remove unused rq_iter_size from struct smb_rqst
    - cifs: Fix FALLOC_FL_PUNCH_HOLE support
    - nfsd: hold reference to delegation when updating it for cb_getattr
    - nfsd: fix potential UAF in nfsd4_cb_getattr_release
    - fs/nfsd: fix update of inode attrs in CB_GETATTR
    - selinux,smack: don't bypass permissions check in inode_setsecctx hook
    - [x86] cpufreq/amd-pstate: Use topology_logical_package_id() instead of
      logical_die_id()
    - phy: fsl-imx8mq-usb: fix tuning parameter name
    - soundwire: stream: fix programming slave ports for non-continous port maps
    - [arm64] phy: qcom: qmp-pcie: Fix X1E80100 PCIe Gen4 PHY initialisation
    - [arm64] phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume
    - [x86] dmaengine: dw: Add peripheral bus width verification
    - [x86] dmaengine: dw: Add memory bus width verification
    - [armhf] dmaengine: ti: omap-dma: Initialize sglen after allocation
    - pktgen: use cpus_read_lock() in pg_net_init()
    - cpufreq/amd-pstate-ut: Don't check for highest perf matching on prefcore
    - Bluetooth: btnxpuart: Handle FW Download Abort scenario
    - Bluetooth: btnxpuart: Fix random crash seen while removing driver
    - Bluetooth: hci_core: Fix not handling hibernation actions
    - iommu: Do not return 0 from map_pages if it doesn't do anything
    - netfilter: nf_tables: restore IP sanity checks for netdev/egress
    - wifi: iwlwifi: mvm: take the mutex before running link selection
    - wifi: iwlwifi: fw: fix wgds rev 3 exact size
    - wifi: iwlwifi: mvm: allow 6 GHz channels in MLO scan
    - ethtool: check device is present when getting link settings
    - hwmon: (pt5161l) Fix invalid temperature reading
    - net_sched: sch_fq: fix incorrect behavior for small weights
    - netfilter: nf_tables_ipv6: consider network offset in netdev/egress
      validation
    - bonding: implement xdo_dev_state_free and call it after deletion
    - bonding: extract the use of real_device into local variable
    - bonding: change ipsec_lock from spin lock to mutex
    - gtp: fix a potential NULL pointer dereference
    - tcp: fix forever orphan socket caused by tcp_abort
    - sctp: fix association labeling in the duplicate COOKIE-ECHO case
    - drm/amd/display: avoid using null object of framebuffer
    - net: busy-poll: use ktime_get_ns() instead of local_clock()
    - nfc: pn533: Add poll mod list filling check
    - io_uring/kbuf: return correct iovec count from classic buffer peek
    - [arm64] soc: qcom: cmd-db: Map shared memory as WC, not WB
    - [arm64] soc: qcom: pmic_glink: Actually communicate when remote goes down
    - [arm64] soc: qcom: pmic_glink: Fix race during initialization
    - cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
    - usb: typec: fsa4480: Relax CHIP_ID check
    - [arm64] firmware: qcom: scm: Mark get_wq_ctx() as atomic call
    - scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress
    - dt-bindings: usb: microchip,usb2514: Fix reference USB device schema
    - USB: serial: option: add MeiG Smart SRM825L
    - usb: gadget: uvc: queue pump work in uvcg_video_enable()
    - [arm64] dts: qcom: x1e80100-crd: fix PCIe4 PHY supply
    - [arm64] dts: qcom: x1e80100-qcp: fix PCIe4 PHY supply
    - [arm64] dts: qcom: x1e80100: add missing PCIe minimum OPP
    - [arm64] dts: qcom: x1e80100: fix PCIe domain numbers
    - usb: dwc3: ep0: Don't reset resource alloc flag (including ep0)
    - [arm64] usb: dwc3: xilinx: add missing depopulate in probe error path
    - [armhf] usb: dwc3: omap: add missing depopulate in probe error path
    - usb: dwc3: core: Prevent USB core invalid event buffer address access
    - usb: dwc3: st: fix probed platform device ref count on probe error path
    - usb: dwc3: st: add missing depopulate in probe error path
    - usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
      remove_power_attributes()
    - usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
    - usb: cdnsp: fix for Link TRB with TC
    - usb: typec: ucsi: Move unregister out of atomic section
    - [arm64] dts: qcom: ipq5332: Fix interrupt trigger type for usb
    - [armhf] dts: omap3-n900: correct the accelerometer orientation
    - [arm64] dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962
    - [arm64] dts: imx93: update default value for snps,clk-csr
    - [arm64] dts: freescale: imx93-tqma9352: fix CMA alloc-ranges
    - [arm64] dts: freescale: imx93-tqma9352-mba93xxla: fix typo
    - firmware: microchip: fix incorrect error report of programming:timeout on
      success
    - scsi: aacraid: Fix double-free on probe failure
    - apparmor: fix policy_unpack_test on big endian systems
    - nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.9
    - drm/fb-helper: Don't schedule_work() to flush frame buffer during panic()
    - drm: panel-orientation-quirks: Add quirk for OrangePi Neo
    - scsi: ufs: core: Check LSDBS cap when !mcq
    - scsi: ufs: core: Bypass quick recovery if force reset is needed
    - btrfs: tree-checker: validate dref root and objectid
    - ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
    - ALSA: hda/conexant: Mute speakers at suspend / shutdown
    - [x86] CPU/AMD: Add models 0x60-0x6f to the Zen5 range
    - ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
    - ALSA: ump: Explicitly reset RPN with Null RPN
    - ALSA: seq: ump: Use the common RPN/bank conversion context
    - ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
    - ALSA: seq: ump: Explicitly reset RPN with Null RPN
    - net/mlx5: DR, Fix 'stack guard page was hit' error in dr_rule
    - smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp
    - [x86] ASoC: amd: yc: Support mic on HP 14-em0002la
    - spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
    - [x86] platform/x86/amd: pmf: Add quirk for ROG Ally X
    - [x86] platform/x86/amd/pmf: Add new ACPI ID AMDI0107
    - btrfs: factor out stripe length calculation into a helper
    - btrfs: scrub: update last_physical after scrubbing one stripe
    - btrfs: fix qgroup reserve leaks in cow_file_range
    - i2c: Fix conditional for substituting empty ACPI functions
    - virtio-net: check feature before configuring the vq coalescing command
    - dma-debug: avoid deadlock between dma debug vs printk and netconsole
    - net: usb: qmi_wwan: add MeiG Smart SRM825L
    - [x86] ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
    - ASoC: codecs: ES8326: button detect issue
    - [arm64] dts: qcom: x1e80100: Describe the PCIe 6a resources
    - [arm64] dts: qcom: x1e80100-crd: fix up PCIe6a pinctrl node
    - [arm64] dts: qcom: x1e80100-crd: fix missing PCIe4 gpios
    - [arm64] dts: qcom: x1e80100-qcp: fix up PCIe6a pinctrl node
    - [arm64] dts: qcom: x1e80100-qcp: fix missing PCIe4 gpios
    - drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
    - Revert "drm/amd/display: Fix incorrect pointer assignment"
    - drm/amd/display: Handle the case which quad_part is equal 0
    - drm/amd/display: Assign linear_pitch_alignment even for VM
    - drm/amdgpu: Handle sg size limit for contiguous allocation
    - drm/amdgpu: fix overflowed array index read warning
    - drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
    - drm/amd/pm: fix uninitialized variable warning
    - drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
    - drm/amd/pm: fix warning using uninitialized value of max_vid_step
    - drm/amd/pm: Fix negative array index read
    - drm/amd/pm: fix uninitialized variable warning for smu_v13
    - drm/amd/pm: fix the Out-of-bounds read warning
    - drm/amdgpu: fix uninitialized scalar variable warning
    - drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
    - drm/amdgpu: avoid reading vf2pf info size from FB
    - drm/amd/display: Ensure array index tg_inst won't be -1
    - drm/amd/display: Check gpio_id before used as array index
    - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
    - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than
      max_links
    - drm/amd/display: Fix incorrect size calculation for loop
    - drm/amd/display: Check index for aux_rd_interval before using
    - drm/amd/display: Add missing NULL pointer check within
      dpcd_extend_address_range
    - drm/amd/display: Add array index check for hdcp ddc access
    - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
    - drm/amd/display: Check msg_id before processing transcation
    - drm/amd/display: Release state memory if amdgpu_dm_create_color_properties
      fail
    - drm/amd/display: Check link_index before accessing dc->links[]
    - drm/amd/display: Add otg_master NULL check within
      resource_log_pipe_topology_update
    - drm/amd/display: Fix Coverity INTERGER_OVERFLOW within
      construct_integrated_info
    - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
      dal_gpio_service_create
    - drm/amd/display: Release clck_src memory if clk_src_construct fails
    - drm/amd/display: Spinlock before reading event
    - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
      decide_fallback_link_setting_max_bw_policy
    - drm/amd/display: Ensure index calculation will not overflow
    - drm/amd/display: Skip inactive planes within
      ModeSupportAndSystemConfiguration
    - drm/amd/display: Fix writeback job lock evasion within dm_crtc_high_irq
    - drm/amd/display: Fix index may exceed array range within
      fpu_update_bw_bounding_box
    - drm/amd/amdgpu: Check tbo resource pointer
    - drm/drm-bridge: Drop conditionals around of_node pointers
    - drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt
    - drm/amdgpu/pm: Fix uninitialized variable warning for smu10
    - drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
    - drm/amdgpu: Fix the uninitialized variable warning
    - drm/amdgpu: Fix out-of-bounds write warning
    - drm/amdgpu: fix uninitialized variable warning for amdgpu_xgmi
    - drm/amdgpu: fix uninitialized variable warning for jpeg_v4
    - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
    - drm/amdgpu: Fix uninitialized variable warning in amdgpu_info_ioctl
    - drm/amdgpu: fix ucode out-of-bounds read warning
    - drm/amdgpu: fix mc_data out-of-bounds read warning
    - drm/amdkfd: Reconcile the definition and use of oem_id in struct
      kfd_topology_device
    - apparmor: fix possible NULL pointer dereference
    - wifi: ath12k: initialize 'ret' in ath12k_qmi_load_file_target_mem()
    - wifi: ath11k: initialize 'ret' in ath11k_qmi_load_file_target_mem()
    - wifi: ath12k: initialize 'ret' in
      ath12k_dp_rxdma_ring_sel_config_wcn7850()
    - drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy
      SOCs
    - drm/amdgpu/pm: Check input value for power profile setting on smu11, smu13
      and smu14
    - drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend
    - drm/amdgpu: Fix the warning division or modulo by zero
    - drm/amdgpu: fix dereference after null check
    - drm/amdgpu: fix the waring dereferencing hive
    - drm/amd/pm: check specific index for aldebaran
    - drm/amd/pm: check specific index for smu13
    - drm/amdgpu: the warning dereferencing obj for nbio_v7_4
    - drm/amdgpu: fix the warning bad bit shift operation for aca_error_type
      type
    - drm/amd/pm: check negtive return for table entries
    - wifi: rtw89: ser: avoid multiple deinit on same CAM
    - drm/kfd: Correct pinned buffer handling at kfd restore and validate
      process
    - drm/amdgpu: fix compiler 'side-effect' check issue for RAS_EVENT_LOG()
    - drm/amd/display: Fix pipe addition logic in calc_blocks_to_ungate DCN35
    - drm/amdgpu: Queue KFD reset workitem in VF FED
    - drm/amdgpu: update type of buf size to u32 for eeprom functions
    - wifi: iwlwifi: remove fw_running op
    - wifi: cfg80211: restrict operation during radar detection
    - cpufreq: scmi: Avoid overflow of target_freq in fast switch
    - PCI: al: Check IORESOURCE_BUS existence during probe
    - remoteproc: mediatek: Zero out only remaining bytes of IPI buffer
    - wifi: iwlwifi: mvm: use only beacon BSS load for active links
    - wifi: mac80211: check ieee80211_bss_info_change_notify() against MLD
    - hwspinlock: Introduce hwspin_lock_bust()
    - [arm64] soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host()
    - remoteproc: qcom_q6v5_pas: Add hwspinlock bust on stop
    - RDMA/efa: Properly handle unexpected AQ completions
    - ionic: fix potential irq name truncation
    - pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode.
    - rcu/nocb: Remove buggy bypass lock contention mitigation
    - media: v4l2-cci: Always assign *val
    - usbip: Don't submit special requests twice
    - usb: typec: ucsi: Fix null pointer dereference in trace
    - fsnotify: clear PARENT_WATCHED flags lazily
    - net: remove NULL-pointer net parameter in ip_metrics_convert
    - tcp: annotate data-races around tw->tw_ts_recent and
      tw->tw_ts_recent_stamp
    - drm/amdgu: fix Unintentional integer overflow for mall size
    - regmap: spi: Fix potential off-by-one when calculating reserved size
    - smack: tcp: ipv4, fix incorrect labeling
    - [x86] platform/chrome: cros_ec_lpc: MEC access can use an AML mutex
    - net/mlx5e: SHAMPO, Fix incorrect page release
    - [arm64] drm/meson: plane: Add error handling
    - crypto: stm32/cryp - call finalize with bh disabled
    - gfs2: Revert "Add quota_change type"
    - RAS/AMD/ATL: Validate address map when information is gathered
    - net: tcp/dccp: prepare for tw_timer un-pinning
    - drm/bridge: tc358767: Check if fully initialized before signalling HPD
      event via IRQ
    - [arm64] pinctrl: renesas: rzg2l: Validate power registers for SD and ETH
    - thermal: trip: Use READ_ONCE() for lockless access to trip properties
    - [x86] hwmon: (k10temp) Check return value of amd_smn_read()
    - wifi: cfg80211: make hash table duplicates more survivable
    - f2fs: fix to do sanity check on blocks for inline_data inode
    - driver: iio: add missing checks on iio_info's callback access
    - block: remove the blk_flush_integrity call in blk_integrity_unregister
    - drm/amdgpu: add skip_hw_access checks for sriov
    - drm/amdgpu: add lock in amdgpu_gart_invalidate_tlb
    - drm/amdgpu: add lock in kfd_process_dequeue_from_device
    - drm/amdgpu: fix overflowed constant warning in mmhub_set_clockgating()
    - drm/amd/display: Don't use fsleep for PSR exit waits on dmub replay
    - drm/amd/display: added NULL check at start of dc_validate_stream
    - drm/amd/display: Correct the defined value for
      AMDGPU_DMUB_NOTIFICATION_MAX
    - drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection
    - drm/amd/display: use preferred link settings for dp signal only
    - drm/amd/display: Disable DMCUB timeout for DCN35
    - drm/amd/display: Avoid overflow from uint32_t to uint8_t
    - drm/amdgpu: set RAS fed status for more cases
    - drm/amd/display: Check BIOS images before it is used
    - drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
    - crypto: ecc - Fix off-by-one missing to clear most significant digit
    - media: uvcvideo: Enforce alignment of frame and interval
    - pinctrl: core: reset gpio_device in loop in pinctrl_pins_show()
    - mm: Fix filemap_invalidate_inode() to use invalidate_inode_pages2_range()
    - drm/amdgpu: remove redundant semicolons in RAS_EVENT_LOG
    - i2c: Use IS_REACHABLE() for substituting empty ACPI functions

  [ Aurelien Jarno ]
  * [riscv64] udeb: Ship mtd in kernel-image, drop mtd-core-modules and
    add it to to Provides of kernel-image.

  [ Marcin Juszkiewicz ]
  * [udeb] introduce drm-core-modules to handle 'kernel-image' modules which
    require 'drm' module
  * [arm64] udeb: ship mtd in kernel-image, drop mtd-core-modules and
    add it to to provides of kernel-image.
  * [arm64] udeb: ship typec in kernel-image

  [ Salvatore Bonaccorso ]
  * [hppa/parisc] Delay write-protection until mark_rodata_ro() call

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 08 Sep 2024 20:29:08 +0200

linux (6.10.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.7
    - tty: vt: conmakehash: remove non-portable code printing comment header
    - tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
    - tty: atmel_serial: use the correct RTS flag.
    - Revert "ACPI: EC: Evaluate orphan _REG under EC device"
    - Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD"
    - Revert "serial: 8250_omap: Set the console genpd always on if no console
      suspend"
    - Revert "usb: typec: tcpm: clear pd_event queue in PORT_RESET"
    - selinux: revert our use of vma_is_initial_heap()
    - netfs, ceph: Revert "netfs: Remove deprecated use of PG_private_2 as a
      second writeback flag"
    - fuse: Initialize beyond-EOF page contents before setting uptodate
    - ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
    - ALSA: usb-audio: Support Yamaha P-125 quirk entry
    - usb: misc: ljca: Add Lunar Lake ljca GPIO HID to ljca_gpio_hids[]
    - usb: xhci: Check for xhci->interrupters being allocated in
      xhci_mem_clearup()
    - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
    - [x86] thunderbolt: Mark XDomain as unplugged when router is removed
    - ALSA: hda/tas2781: fix wrong calibrated data order
    - ALSA: timer: Relax start tick time check for slave timer elements
    - [s390x] dasd: fix error recovery leading to data corruption on ESE devices
    - [s390x] KVM: s390: fix validity interception issue when gisa is switched
      off
    - thermal: gov_bang_bang: Call __thermal_cdev_update() directly
    - KEYS: trusted: fix DCP blob payload length assignment
    - KEYS: trusted: dcp: fix leak of blob encryption key
    - [riscv64] change XIP's kernel_map.size to be size of the entire kernel
    - [riscv64] entry: always initialize regs->a0 to -ENOSYS
    - smb3: fix lock breakage for cached writes
    - [arm64,armhf] i2c: tegra: Do not mark ACPI devices as irq safe
    - ACPICA: Add a depth argument to acpi_execute_reg_methods()
    - ACPI: EC: Evaluate _REG outside the EC scope more carefully
    - [arm64] ACPI: NUMA: initialize all values of acpi_early_node_map to
      NUMA_NO_NODE
    - dm resume: don't return EINVAL when signalled
    - dm persistent data: fix memory allocation failure
    - vfs: Don't evict inode under the inode lru traversing context
    - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
    - [arm64] i2c: qcom-geni: Add missing geni_icc_disable in
      geni_i2c_runtime_resume
    - tracing: Return from tracing_buffers_read() if the file has been closed
    - perf/bpf: Don't call bpf_overflow_handler() for tracing events
    - mseal: fix is_madv_discard()
    - rtla/osnoise: Prevent NULL dereference in error handling
    - mm: fix endless reclaim on machines with unaccepted memory
    - mm/hugetlb: fix hugetlb vs. core-mm PT locking
    - md/raid1: Fix data corruption for degraded array with slow disk
    - net: mana: Fix RX buf alloc_size alignment and atomic op panic
    - media: atomisp: Fix streaming no longer working on BYT / ISP2400 devices
    - net: mana: Fix doorbell out of order violation and avoid unnecessary
      doorbell rings
    - wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion
    - fs/netfs/fscache_cookie: add missing "n_accesses" check
    - selinux: fix potential counting error in avc_add_xperms_decision()
    - selinux: add the processing of the failure of avc_add_xperms_decision()
    - alloc_tag: mark pages reserved during CMA activation as not tagged
    - mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu
    - alloc_tag: introduce clear_page_tag_ref() helper function
    - mm/numa: no task_numa_fault() call if PMD is changed
    - mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order
      fallback to order 0
    - mm/numa: no task_numa_fault() call if PTE is changed
    - btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type
    - btrfs: send: allow cloning non-aligned extent if it ends at i_size
    - btrfs: check delayed refs when we're checking if a ref exists
    - btrfs: only run the extent map shrinker from kswapd tasks
    - btrfs: zoned: properly take lock to read/update block group's zoned
      variables
    - btrfs: tree-checker: add dev extent item checks
    - btrfs: only enable extent map shrinker for DEBUG builds
    - drm/amdgpu: Actually check flags for all context ops.
    - memcg_write_event_control(): fix a user-triggerable oops
    - drm/amd/display: Adjust cursor position
    - drm/amd/display: fix s2idle entry for DCN3.5+
    - drm/amd/display: Enable otg synchronization logic for DCN321
    - drm/amd/display: fix cursor offset on rotation 180
    - drm/amdgpu/jpeg2: properly set atomics vmid field
    - drm/amdgpu/jpeg4: properly set atomics vmid field
    - drm/amd/amdgpu: command submission parser for JPEG
    - pidfd: prevent creation of pidfds for kthreads
    - [s390x] uv: Panic for set and remove shared access UVC errors
    - netfs: Fault in smaller chunks for non-large folio mappings
    - filelock: fix name of file_lease slab cache
    - libfs: fix infinite directory reads for offset dir
    - bpf: Fix updating attached freplace prog in prog_array map
    - bpf: Fix a kernel verifier crash in stacksafe()
    - btrfs: fix invalid mapping of extent xarray state
    - igc: Fix packet still tx after gate close by reducing i226 MAC retry
      buffer
    - igc: Fix qbv_config_change_errors logics
    - igc: Fix reset adapter logics when tx mode change
    - igc: Fix qbv tx latency by setting gtxoffset
    - gtp: pull network headers in gtp_dev_xmit()
    - net/mlx5: SD, Do not query MPIR register if no sd_group
    - net/mlx5e: Take state lock during tx timeout reporter
    - net/mlx5e: Correctly report errors for ethtool rx flows
    - atm: idt77252: prevent use after free in dequeue_rx()
    - [arm64] net: ethernet: mtk_wed: fix use-after-free panic in
      mtk_wed_setup_tc_block_cb()
    - mlxbf_gige: disable RX filters until RX path initialized
    - mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
    - tcp: Update window clamping condition
    - netfilter: allow ipv6 fragments to arrive on different devices
    - netfilter: nfnetlink: Initialise extack before use in ACKs
      (CVE-2024-44945)
    - netfilter: flowtable: initialise extack before use
    - netfilter: nf_queue: drop packets with cloned unconfirmed conntracks
    - netfilter: nf_tables: Audit log dump reset after the fact
    - netfilter: nf_tables: Introduce nf_tables_getobj_single
    - netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests
    - vsock: fix recursive ->recvmsg calls
    - [arm64] net: hns3: fix wrong use of semaphore up
    - [arm64] net: hns3: use the user's cfg after reset
    - [arm64] net: hns3: fix a deadlock problem when config TC during resetting
    - kbuild: refactor variables in scripts/link-vmlinux.sh
    - kbuild: remove PROVIDE() for kallsyms symbols
    - kallsyms: get rid of code for absolute kallsyms
    - kallsyms: Do not cleanup .llvm.<hash> suffix before sorting symbols
    - kallsyms: Match symbols exactly with CONFIG_LTO_CLANG
    - [amd64] iommu: Restore lost return in iommu_report_device_fault()
    - gpio: mlxbf3: Support shutdown() function
    - ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
    - [arm64] drm/v3d: Fix out-of-bounds read in `v3d_csd_job_run()`
    - [s390x] dasd: Remove DMA alignment
    - io_uring/napi: Remove unnecessary s64 cast
    - io_uring/napi: use ktime in busy polling
    - io_uring/napi: check napi_enabled in io_napi_add() before proceeding
    - cpu/SMT: Enable SMT only if a core is online
    - [powerpc*] topology: Check if a core is online
    - printk/panic: Allow cpu backtraces to be written into ringbuffer during
      panic
    - [arm64] Fix KASAN random tag seed initialization
    - block: Fix lockdep warning in blk_mq_mark_tag_wait
    - drm/amd/display: Don't register panel_power_savings on OLED panels
    - thermal: gov_bang_bang: Drop unnecessary cooling device target state
      checks
    - thermal: gov_bang_bang: Split bang_bang_control()
    - thermal: gov_bang_bang: Add .manage() callback
    - thermal: gov_bang_bang: Use governor_data to reduce overhead
    - cifs: Add a tracepoint to track credits involved in R/W requests
    - smb/client: avoid possible NULL dereference in cifs_free_subrequest()
    - dm suspend: return -ERESTARTSYS instead of -EINTR
    - wifi: ath12k: use 128 bytes aligned iova in transmit path for WCN7850
    - [x86] platform/surface: aggregator: Fix warning when controller is
      destroyed in probe
    - ALSA: hda/tas2781: Use correct endian conversion
    - Makefile: add $(srctree) to dependency of compile_commands.json target
    - kbuild: merge temporary vmlinux for BTF and kallsyms
    - kbuild: avoid scripts/kallsyms parsing /dev/null
    - Bluetooth: HCI: Invert LE State quirk to be opt-out rather then opt-in
    - Bluetooth: hci_core: Fix LE quote calculation
    - Bluetooth: SMP: Fix assumption of Central always being Initiator
    - [arm64] net: mscc: ocelot: use ocelot_xmit_get_vlan_info() also for FDMA
      and register injection
    - [arm64] net: mscc: ocelot: fix QoS class for injected packets with
      "ocelot-8021q"
    - [arm64] net: mscc: ocelot: serialize access to the injection/extraction
      groups
    - net/mlx5e: XPS, Fix oversight of Multi-PF Netdev changes
    - net/mlx5: Fix IPsec RoCE MPV trace call
    - tc-testing: don't access non-existent variable on exception
    - tcp: prevent concurrent execution of tcp_sk_exit_batch
    - net: mctp: test: Use correct skb for route input check
    - kcm: Serialise kcm_sendmsg() for the same socket.
    - netfilter: nft_counter: Disable BH in nft_counter_offload_stats().
    - netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
    - ip6_tunnel: Fix broken GRO
    - bonding: fix bond_ipsec_offload_ok return type
    - bonding: fix null pointer deref in bond_ipsec_offload_ok
    - bonding: fix xfrm real_dev null pointer dereference
    - bonding: fix xfrm state handling when clearing active slave
    - ice: fix page reuse when PAGE_SIZE is over 8k
    - ice: fix ICE_LAST_OFFSET formula
    - ice: fix truesize operations for PAGE_SIZE >= 8192
    - ice: use internal pf id instead of function number
    - igb: cope with large MAX_SKB_FRAGS
    - [arm64,armhf] net: dsa: mv88e6xxx: Fix out-of-bound access
    - netem: fix return value if duplicate enqueue fails
    - udp: fix receiving fraglist GSO packets
    - ipv6: prevent UAF in ip6_send_skb()
    - ipv6: fix possible UAF in ip6_finish_output2()
    - ipv6: prevent possible UAF in ip6_xmit()
    - bnxt_en: Fix double DMA unmapping for XDP_REDIRECT
    - netfilter: flowtable: validate vlan header
    - octeontx2-af: Fix CPT AF register offset calculation
    - net: ovs: fix ovs_drop_reasons error
    - [s390x] iucv: Fix vargs handling in iucv_alloc_device()
    - [arm64] drm/msm/dpu: don't play tricks with debug macros
    - [arm64] drm/msm/dp: fix the max supported bpp logic
    - [arm64] drm/msm/dpu: move dpu_encoder's connector assignment to
      atomic_enable()
    - [arm64] drm/msm/dp: reset the link phy params before link training
    - [arm64] drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
    - [arm64] drm/msm/dpu: limit QCM2290 to RGB formats only
    - [arm64] drm/msm/dpu: relax YUV requirements
    - [arm64] drm/msm/dpu: take plane rotation into account for wide planes
    - workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask()
    - workqueue: Fix spruious data race in __flush_work()
    - [arm64] drm/msm: fix the highest_bank_bit for sc7180
    - spi: spi-cadence-quadspi: Fix OSPI NOR failures during system resume
    - [x86] drm/i915/hdcp: Use correct cp_irq_count
    - mmc: mmc_test: Fix NULL dereference on allocation failure
    - io_uring/kbuf: sanitize peek buffer setup
    - thermal/debugfs: Fix the NULL vs IS_ERR() confusion in
      debugfs_create_dir()
    - [s390x] boot: Avoid possible physmem_info segment corruption
    - [s390x] boot: Fix KASLR base offset off by __START_KERNEL bytes
    - smb: client: ignore unhandled reparse tags
    - nvme: move stopping keep-alive into nvme_uninit_ctrl()
    - Bluetooth: MGMT: Add error handling to pair_device() (CVE-2024-43884)
    - scsi: core: Fix the return value of scsi_logical_block_count()
    - ksmbd: the buffer of smb2 query dir response has at least 1 byte
    - drm/amdgpu: Validate TA binary size
    - drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1
    - ACPI: video: Add Dell UART backlight controller detection
    - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7760 AIO
    - [x86] platform/x86: dell-uart-backlight: Use
      acpi_video_get_backlight_type()
    - [x86] platform/x86: ISST: Fix return value on last invalid resource
    - [s390x] ap: Refine AP bus bindings complete processing
    - net: ngbe: Fix phy mode set to external phy
    - net: dsa: microchip: fix PTP config failure when using multiple ports
    - HID: wacom: Defer calculation of resolution until resolution_code is known
    - iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace()
    - Input: i8042 - add forcenorestore quirk to leave controller untouched even
      on s3
    - Input: i8042 - use new forcenorestore quirk to replace old buggy quirk
      combination
    - ata: pata_macio: Fix DMA table overflow
    - cxgb4: add forgotten u64 ivlan cast before shift
    - [arm64] KVM: arm64: vgic-debug: Don't put unmarked LPIs
    - [arm64] KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
    - cgroup/cpuset: fix panic caused by partcmd_update
    - cgroup/cpuset: Clear effective_xcpus on cpus_allowed clearing only if
      cpus.exclusive not set
    - mmc: mtk-sd: receive cmd8 data when hs400 tuning fail
    - mmc: dw_mmc: allow biu and ciu clocks to defer
    - smb3: fix broken cached reads when posix locks
    - pmdomain: imx: scu-pd: Remove duplicated clocks
    - pmdomain: imx: wait SSAR when i.MX93 power domain on
    - nouveau/firmware: use dma non-coherent allocator
    - thermal: of: Fix OF node leak in thermal_of_trips_init() error path
    - thermal: of: Fix OF node leak in thermal_of_zone_register()
    - thermal: of: Fix OF node leak in of_thermal_zone_find() error paths
    - mptcp: pm: re-using ID of unused removed ADD_ADDR
    - mptcp: pm: re-using ID of unused removed subflows
    - mptcp: pm: re-using ID of unused flushed subflows
    - mptcp: pm: remove mptcp_pm_remove_subflow()
    - mptcp: pm: only mark 'subflow' endp as available
    - mptcp: pm: only decrement add_addr_accepted for MPJ req
    - mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR
    - mptcp: pm: only in-kernel cannot have entries with ID 0
    - mptcp: pm: fullmesh: select the right ID later
    - mptcp: pm: avoid possible UaF when selecting endp
    - Revert "pidfd: prevent creation of pidfds for kthreads"
    - drm/amdgpu/vcn: identify unified queue in sw init
    - drm/amdgpu/vcn: not pause dpg for unified queue
    - ksmbd: fix race condition between destroy_previous_session() and smb2
      operations()
    - Input: MT - limit max slots

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "net/ipv4: Use nested-BH locking for ipv4_tcp_sk."

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 31 Aug 2024 12:14:41 +0200

linux (6.10.6-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.5
    - drm/amd/display: Refactor function dm_dp_mst_is_port_support_mode()
    - locking/pvqspinlock: Correct the type of "old" variable in pv_kick_node()
    - [x86] perf/x86/intel/cstate: Add Arrowlake support
    - [x86] perf/x86/intel/cstate: Add Lunarlake support
    - [x86] perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra
      Forest
    - [x86] platform/x86: intel-vbtn: Protect ACPI notify handler against
      recursion
    - irqchip/mbigen: Fix mbigen node address layout
    - [x86] platform/x86/intel/ifs: Initialize union ifs_status to zero
    - jump_label: Fix the fix, brown paper bags galore
    - [x86] perf/x86/amd: Use try_cmpxchg() in events/amd/{un,}core.c
    - [x86] perf/x86/intel: Support the PEBS event mask
    - [x86] perf/x86: Support counter mask
    - [x86] perf/x86: Fix smp_processor_id()-in-preemptible warnings
    - [x86] mm: Fix pti_clone_pgtable() alignment assumption
    - [x86] mm: Fix pti_clone_entry_text() for i386
    - smb: client: handle lack of FSCTL_GET_REPARSE_POINT support
    - power: supply: rt5033: Bring back i2c_set_clientdata
    - sctp: Fix null-ptr-deref in reuseport_add_sock().
    - gve: Fix use of netif_carrier_ok()
    - virtio-net: unbreak vq resizing when coalescing is not negotiated
    - net: usb: qmi_wwan: fix memory leak for not ip packets
    - net: bridge: mcast: wait for previous gc cycles when removing port
    - net: linkwatch: use system_unbound_wq
    - ice: Fix reset handler
    - Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
    - Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv
      monitor
    - net/smc: add the max value of fallback reason count
    - [armhf] net: dsa: bcm_sf2: Fix a possible memory leak in
      bcm_sf2_mdio_register()
    - bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()
    - idpf: fix memory leaks and crashes while performing a soft reset
    - idpf: fix UAFs when destroying the queues
    - l2tp: fix lockdep splat
    - net: bcmgenet: Properly overlay PHY and MAC Wake-on-LAN capabilities
    - net: fec: Stop PPS on driver remove
    - net: dsa: microchip: disable EEE for KSZ8567/KSZ9567/KSZ9896/KSZ9897.
    - regmap: kunit: Fix memory leaks in gen_regmap() and gen_raw_regmap()
    - gpio: prevent potential speculation leaks in gpio_device_get_desc()
    - [x86] hwmon: corsair-psu: add USB id of HX1200i Series 2023 psu
    - Revert "rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()"
    - platform/chrome: cros_ec_lpc: Add a new quirk for ACPI id
    - rcutorture: Fix rcu_torture_fwd_cb_cr() data race
    - md: do not delete safemode_timer in mddev_suspend
    - md: change the return value type of md_write_start to void
    - md/raid5: avoid BUG_ON() while continue reshape after reassembling
    - debugobjects: Annotate racy debug variables
    - nvme: apple: fix device reference counting
    - block: change rq_integrity_vec to respect the iterator
    - rcu: Fix rcu_barrier() VS post CPUHP_TEARDOWN_CPU invocation
    - clocksource/drivers/sh_cmt: Address race condition for clock events
    - ACPI: battery: create alarm sysfs attribute atomically
    - ACPI: SBS: manage alarm sysfs attribute through psy core
    - [x86] cpufreq: amd-pstate: Allow users to write 'default' EPP string
    - [x86] cpufreq: amd-pstate: auto-load pstate driver by default
    - [arm64] soc: qcom: icc-bwmon: Allow for interrupts to be shared across
      instances
    - xen: privcmd: Switch from mutex to spinlock for irqfds
    - ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MU
    - ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MJ
    - thermal: intel: hfi: Give HFI instances package scope
    - wifi: nl80211: disallow setting special AP channel widths
    - wifi: ath12k: fix race due to setting ATH12K_FLAG_EXT_IRQ_ENABLED too
      early
    - wifi: rtlwifi: handle return value of usb init TX/RX
    - wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup()
    - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink
    - wifi: rtw89: pci: fix RX tag race condition resulting in wrong RX length
    - af_unix: Don't retry after unix_state_lock_nested() in
      unix_stream_connect().
    - PCI: Add Edimax Vendor ID to pci_ids.h
    - wifi: mac80211: fix NULL dereference at band check in starting tx ba
      session
    - udf: prevent integer overflow in udf_bitmap_free_blocks()
    - bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory
      accesses
    - wifi: nl80211: don't give key data to userspace
    - can: mcp251xfd: tef: prepare to workaround broken TEF FIFO tail index
      erratum
    - can: mcp251xfd: tef: update workaround for erratum DS80000789E 6 of
      mcp2518fd
    - net: stmmac: qcom-ethqos: enable SGMII loopback during DMA reset on
      sa8775p-ride-r3
    - btrfs: do not clear page dirty inside extent_write_locked_range()
    - btrfs: do not BUG_ON() when freeing tree block after error
    - btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info()
    - btrfs: fix data race when accessing the last_trans field of a root
    - btrfs: fix bitmap leak when loading free space cache on duplicate entry
    - Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver
      unloading
    - drm/xe/preempt_fence: enlarge the fence critical section
    - drm/amd/display: Handle HPD_IRQ for internal link
    - drm/amd/display: Add delay to improve LTTPR UHBR interop
    - drm/amdgpu: fix potential resource leak warning
    - drm/amdgpu/pm: Fix the param type of set_power_profile_mode
    - drm/amd/amdkfd: Fix a resource leak in svm_range_validate_and_map()
    - drm/xe/xe_guc_submit: Fix exec queue stop race condition
    - drm/amdgpu/pm: Fix the null pointer dereference for smu7
    - drm/amdgpu: Fix the null pointer dereference to ras_manager
    - drm/amdgpu/pm: Fix the null pointer dereference in
      apply_state_adjust_rules
    - drm/admgpu: fix dereferencing null pointer context
    - drm/amdgpu: Add lock around VF RLCG interface
    - drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
    - drm/amd/display: Add null checks for 'stream' and 'plane' before
      dereferencing
    - media: amphion: Remove lock in s_ctrl callback
    - drm/amd/display: Add NULL check for 'afb' before dereferencing in
      amdgpu_dm_plane_handle_cursor_update
    - drm/amd/display: Wake DMCUB before sending a command for replay feature
    - drm/amd/display: reduce ODM slice count to initial new dc state only when
      needed
    - drm/amd/display: Don't refer to dc_sink in is_dsc_need_re_compute
    - drm/amd/display: remove dpp pipes on failure to update pipe params
    - drm/amd/display: Add null checker before passing variables
    - media: i2c: ov5647: replacing of_node_put with __free(device_node)
    - media: uvcvideo: Ignore empty TS packets
    - media: uvcvideo: Fix the bandwdith quirk on USB 3.x
    - drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401
    - media: xc2028: avoid use-after-free in load_firmware_cb()
    - ext4: fix uninitialized variable in ext4_inlinedir_to_tree
    - jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
    - drm/amd/display: Fix null pointer deref in dcn20_resource.c
    - [s390x] sclp: Prevent release of buffer in I/O
    - ext4: sanity check for NULL pointer after ext4_force_shutdown
    - SUNRPC: Fix a race to wake a sync task
    - mm, slub: do not call do_slab_free for kfence object
    - profiling: remove profile=sleep support
    - clocksource: Fix brown-bag boolean thinko in cs_watchdog_read()
    - scsi: Revert "scsi: sd: Do not repeat the starting disk message"
    - scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
    - media: ipu-bridge: fix ipu6 Kconfig dependencies
    - media: intel/ipu6: select AUXILIARY_BUS in Kconfig
    - irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to
      'raw_spinlock_t'
    - irqchip/loongarch-cpu: Fix return value of lpic_gsi_to_irq()
    - sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
    - [arm64] cputype: Add Cortex-X3 definitions
    - [arm64] cputype: Add Cortex-A720 definitions
    - [arm64] cputype: Add Cortex-X925 definitions
    - [arm64] errata: Unify speculative SSBS errata logic
    - [arm64] errata: Expand speculative SSBS workaround
    - [arm64] cputype: Add Cortex-X1C definitions
    - [arm64] cputype: Add Cortex-A725 definitions
    - [arm64] errata: Expand speculative SSBS workaround (again)
    - nfsd: don't set SVC_SOCK_ANONYMOUS when creating nfsd sockets
    - i2c: smbus: Improve handling of stuck alerts
    - [arm64] ASoC: SOF: Remove libraries from topology lookups
    - i2c: smbus: Send alert notifications to all devices if source not found
    - bpf: kprobe: remove unused declaring of bpf_kprobe_override
    - kprobes: Fix to check symbol prefixes correctly
    - ASoC: cs-amp-lib: Fix NULL pointer crash if efi.get_variable is NULL
    - i2c: qcom-geni: Add missing clk_disable_unprepare in
      geni_i2c_runtime_resume
    - [x86] ASoC: cs35l56: Revert support for dual-ownership of ASP registers
    - [x86] ASoC: cs35l56: Handle OTP read latency over SoundWire
    - drm/atomic: allow no-op FB_ID updates for async flips
    - i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume
    - [x86] drm/i915: Allow evicting to use the requested placement
    - [x86] drm/i915: Attempt to get pages without eviction first
    - drm/amd/display: Replace dm_execute_dmub_cmd with
      dc_wake_and_execute_dmub_cmd
    - spi: spi-fsl-lpspi: Fix scldiv calculation
    - ALSA: usb-audio: Re-add ScratchAmp quirk entries
    - drm/xe/rtp: Fix off-by-one when processing rules
    - drm/xe: Use dma_fence_chain_free in chain fence unused as a sync
    - drm/xe/hwmon: Fix PL1 disable flow in xe_hwmon_power_max_write
    - drm/xe: Minor cleanup in LRC handling
    - drm/xe: Take ref to VM in delayed snapshot
    - [arm64] ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT
    - cifs: cifs_inval_name_dfs_link_error: correct the check for fullpath
    - module: warn about excessively long module waits
    - module: make waiting for a concurrent module loader interruptible
    - [x86] drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
      (CVE-2024-42259)
    - drm/amd/display: Skip Recompute DSC Params if no Stream on Link
    - drm/amdgpu: Forward soft recovery errors to userspace
    - [x86] drm/i915/gem: Adjust vma offset for framebuffer mmap offset
    - drm/client: fix null pointer dereference in drm_client_modeset_probe
    - drm/i915/display: correct dual pps handling for MTL_PCH+
    - drm/test: fix the gem shmem test to map the sg table.
    - io_uring/net: ensure expanded bundle recv gets marked for cleanup
    - io_uring/net: ensure expanded bundle send gets marked for cleanup
    - io_uring/net: don't pick multiple buffers for non-bundle send
    - ALSA: line6: Fix racy access to midibuf
    - ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
    - ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks
    - ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
    - usb: vhci-hcd: Do not drop references before new references are gained
    - USB: serial: debug: do not echo input by default
    - usb: typec: fsa4480: Check if the chip is really there
    - usb: gadget: core: Check for unset descriptor
    - usb: gadget: midi2: Fix the response for FB info with block 0xff
    - usb: gadget: u_serial: Set start_delayed during suspend
    - usb: gadget: f_fs: restore ffs_func_disable() functionality
    - usb: gadget: u_audio: Check return codes from usb_ep_enable and
      config_ep_by_speed.
    - scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES
    - scsi: ufs: core: Fix deadlock during RTC update
    - scsi: ufs: core: Do not set link to OFF state while waking up from
      hibernation
    - scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
    - tick/broadcast: Move per CPU pointer access into the atomic section
    - media: v4l: Fix missing tabular column hint for Y14P format
    - vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler
    - spmi: pmic-arb: add missing newline in dev_err format strings
    - ntp: Clamp maxerror and esterror to operating range
    - driver core: Fix uevent_show() vs driver detach race
    - [arm64] dts: ti: k3-am62-verdin-dahlia: Keep CTRL_SLEEP_MOCI# regulator on
    - tracefs: Fix inode allocation
    - tracefs: Use generic inode RCU for synchronizing freeing
    - ntp: Safeguard against time_constant overflow
    - timekeeping: Fix bogus clock_was_set() invocation in do_adjtimex()
    - serial: core: check uartclk for zero to avoid divide by zero
    - serial: sc16is7xx: fix TX fifo corruption
    - serial: sc16is7xx: fix invalid FIFO access with special register set
    - tty: vt: conmakehash: cope with abs_srctree no longer in env
    - memcg: protect concurrent access to mem_cgroup_idr
    - [x86] ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx
    - spmi: pmic-arb: Pass the correct of_node to irq_domain_add_tree
    - kcov: properly check for softirq context
    - irqchip/xilinx: Fix shift out of bounds
    - irqchip/riscv-aplic: Retrigger MSI interrupt on source configuration
    - genirq/irqdesc: Honor caller provided affinity in alloc_desc()
    - power: supply: qcom_battmgr: return EAGAIN when firmware service is not up
    - power: supply: axp288_charger: Fix constant_charge_voltage writes
    - power: supply: axp288_charger: Round constant_charge_voltage writes down
    - tracing: Have format file honor EVENT_FILE_FL_FREED
    - tracing: Fix overflow in get_free_elt()
    - padata: Fix possible divide-by-0 panic in padata_mt_helper()
    - smb3: fix setting SecurityFlags when encryption is required
    - eventfs: Don't return NULL in eventfs_create_dir()
    - eventfs: Use SRCU for freeing eventfs_inodes
    - mm: list_lru: fix UAF for memory cgroup
    - net/tcp: Disable TCP-AO static key after RCU grace period
    - btrfs: avoid using fixed char array size for tree names
    - [x86] paravirt: Fix incorrect virt spinlock setting on bare metal
    - [x86] mtrr: Check if fixed MTRRs exist before saving them
    - sched/smt: Introduce sched_smt_present_inc/dec() helper
    - sched/smt: Fix unbalance sched_smt_present dec/inc
    - sched/core: Introduce sched_set_rq_on/offline() helper
    - sched/core: Fix unbalance set_rq_online/offline() in
      sched_cpu_deactivate()
    - drm/bridge: analogix_dp: properly handle zero sized AUX transactions
    - drm/dp_mst: Skip CSN if topology probing is not done yet
    - [arm64,armhf] drm/lima: Mark simple_ondemand governor as softdep
    - [x86] drm/mgag200: Set DDC timeout in milliseconds
    - [x86] drm/mgag200: Bind I2C lifetime to DRM device
    - drm/radeon: Remove __counted_by from StateArray.states[]
    - mptcp: fully established after ADD_ADDR echo on MPJ
    - mptcp: pm: deny endp with signal + subflow + port
    - block: use the right type for stub rq_integrity_vec()
    - Revert "drm/amd/display: Handle HPD_IRQ for internal link"
    - Revert "drm/amd/display: Add NULL check for 'afb' before dereferencing in
      amdgpu_dm_plane_handle_cursor_update"
    - btrfs: fix corruption after buffer fault in during direct IO append write
    - idpf: fix memleak in vport interrupt configuration
    - drm/amd/display: Add null check in resource_log_pipe_topology_update
    - drm/amd/display: Change ASSR disable sequence
    - mptcp: pm: reduce indentation blocks
    - mptcp: pm: don't try to create sf if alloc failed
    - mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set
    - btrfs: fix double inode unlock for direct IO sync writes
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.6
    - exec: Fix ToCToU between perm check and set-uid/gid usage
    - drm/amd/display: Defer handling mst up request in resume
    - drm/amd/display: Separate setting and programming of cursor
    - drm/amd/display: Prevent IPX From Link Detect and Set Mode
    - nvme/pci: Add APST quirk for Lenovo N60z laptop
    - [x86] ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value
    - bpf, net: Use DEV_STAT_INC()
    - f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
    - f2fs: fix to cover read extent cache access with lock
    - fou: remove warn in gue_gro_receive on unsupported protocol
    - jfs: fix null ptr deref in dtInsertEntry
    - jfs: Fix shift-out-of-bounds in dbDiscardAG
    - ALSA: usb: Fix UBSAN warning in parse_audio_unit()
    - [x86] platform/x86/amd/pmf: Fix to Update HPD Data When ALS is Disabled
    - [x86] platform/x86: ideapad-laptop: introduce a generic notification chain
    - [x86] platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc
    - [x86] platform/x86: ideapad-laptop: add a mutex to synchronize VPC
      commands
    - binfmt_flat: Fix corruption when not offsetting data start
    - drm/amd/display: Solve mst monitors blank out problem after resume
    - drm/amdgpu/display: Fix null pointer dereference in
      dc_stream_program_cursor_position
    - media: Revert "media: dvb-usb: Fix unexpected infinite loop in
      dvb_usb_read_remote_control()"
    - Revert "ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no
      error"
    - Revert "drm/amd/display: Refactor function
      dm_dp_mst_is_port_support_mode()"

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 19 Aug 2024 21:59:45 +0200

linux (6.10.4-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.4
    - mm/huge_memory: mark racy access onhuge_anon_orders_always
    - mm: fix khugepaged activation policy
    - mm/migrate: make migrate_misplaced_folio() return 0 on success
    - mm/migrate: move NUMA hinting fault folio isolation + checks under PTL
    - mm/migrate: putback split folios when numa hint migration fails
    - ext4: factor out a common helper to query extent map
    - ext4: check the extent status again before inserting delalloc block
    - f2fs: fix to avoid use SSR allocate when do defragment
    - f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid
    - perf: imx_perf: fix counter start and config sequence
    - [x86] perf/x86/intel: Switch to new Intel CPU model defines
    - [x86] perf/x86/intel: Add a distinct name for Granite Rapids
    - [armel,armhf] 9406/1: Fix callchain_trace() return value
    - [arm64] HID: amd_sfh: Move sensor discovery before HID device
      initialization
    - perf tool: fix dereferencing NULL al->maps
    - drm/gpuvm: fix missing dependency to DRM_EXEC
    - drm/nouveau: prime: fix refcount underflow
    - drm/vmwgfx: Make sure the screen surface is ref counted
    - drm/vmwgfx: Fix overlay when using Screen Targets
    - bnxt_en: Fix RSS logic in __bnxt_reserve_rings()
    - netlink: specs: correct the spec of ethtool
    - ethtool: rss: echo the context number back
    - drm/vmwgfx: Trigger a modeset when the screen moves
    - sched: act_ct: take care of padding in struct zones_ht_key
    - wifi: cfg80211: fix reporting failed MLO links status with
      cfg80211_connect_done
    - wifi: cfg80211: correct S1G beacon length calculation
    - net: phy: realtek: add support for RTL8366S Gigabit PHY
    - ALSA: hda: conexant: Fix headset auto detect fail in the polling mode
    - Bluetooth: btintel: Fail setup on error
    - Bluetooth: hci_sync: Fix suspending with wrong filter policy
    - drm/client: Fix error code in drm_client_buffer_vmap_local()
    - ethtool: fix setting key and resetting indir at once
    - tcp: Adjust clamping window for applications specifying SO_RCVBUF
    - net: axienet: start napi before enabling Rx/Tx
    - rtnetlink: Don't ignore IFLA_TARGET_NETNSID when ifname is specified in
      rtnl_dellink().
    - [x86] i915/perf: Remove code to update PWR_CLK_STATE for gen12
    - ice: respect netif readiness in AF_XDP ZC related ndo's
    - ice: don't busy wait for Rx queue disable in ice_qp_dis()
    - ice: replace synchronize_rcu with synchronize_net
    - ice: modify error handling when setting XSK pool in ndo_bpf
    - ice: toggle netif_carrier when setting up XSK pool
    - ice: improve updating ice_{t,r}x_ring::xsk_pool
    - ice: add missing WRITE_ONCE when clearing ice_rx_ring::xdp_prog
    - ice: xsk: fix txq interrupt mapping
    - net/iucv: fix use after free in iucv_sock_close()
    - [x86] drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro
    - net: mvpp2: Don't re-use loop iterator
    - net: phy: micrel: Fix the KSZ9131 MDI-X status issue
    - [s390x] mm/ptdump: Fix handling of identity mapping area
    - ALSA: hda: Conditionally use snooping for AMD HDMI
    - drm/atomic: Allow userspace to use explicit sync with atomic async flips
    - drm/atomic: Allow userspace to use damage clips with async flips
    - netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().
    - netfilter: iptables: Fix potential null-ptr-deref in
      ip6table_nat_table_init().
    - net/mlx5: Always drain health in shutdown callback
    - net/mlx5: Fix error handling in irq_pool_request_irq
    - net/mlx5: Lag, don't use the hardcoded value of the first port
    - net/mlx5: Fix missing lock on sync reset reload
    - net/mlx5e: Require mlx5 tc classifier action support for IPsec prio
      capability
    - net/mlx5e: Fix CT entry update leaks of modify header context
    - net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
    - igc: Fix double reset adapter triggered from a single taprio cmd
    - ipv6: fix ndisc_is_useropt() handling for PIO
    - [riscv64] purgatory: align riscv_kernel_entry
    - perf arch events: Fix duplicate RISC-V SBI firmware event name
    - [riscv64] perf: riscv: Fix selecting counters in legacy mode
    - [riscv64] mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
    - [riscv64] RISC-V: Enable the IPI before workqueue_online_cpu()
    - [riscv64] Fix linear mapping checks for non-contiguous memory regions
    - [arm64] jump_label: Ensure patched jump_labels are visible to all CPUs
    - ceph: force sending a cap update msg back to MDS for revoke op
    - [s390x] fpu: Re-add exception handling in load_fpu_state()
    - platform/chrome: cros_ec_proto: Lock device when updating MKBP version
    - HID: wacom: Modify pen IDs
    - btrfs: zoned: fix zone_unusable accounting on making block group
      read-write again
    - btrfs: do not subtract delalloc from avail bytes
    - btrfs: make cow_file_range_inline() honor locked_page on error
    - protect the fetch of ->fd[fd] in do_dup2() from mispredictions
    - mptcp: sched: check both directions for backup
    - ALSA: usb-audio: Correct surround channels in UAC1 channel map
    - ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G
    - ALSA: seq: ump: Optimize conversions from SysEx to UMP
    - Revert "ALSA: firewire-lib: obsolete workqueue for period update"
    - Revert "ALSA: firewire-lib: operate for period elapse event in process
      context"
    - PCI: pciehp: Retain Power Indicator bits for userspace indicators
    - drm/vmwgfx: Fix a deadlock in dma buf fence polling
    - drm/vmwgfx: Fix handling of dumb buffers
    - drm/ast: astdp: Wake up during connector status detection
    - drm/ast: Fix black screen after resume
    - drm/amdgpu: fix contiguous handling for IB parsing v2
    - drm/virtio: Fix type of dma-fence context variable
    - [x86] drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll()
    - [arm64] drm/v3d: Prevent out of bounds access in performance query
      extensions
    - [arm64] drm/v3d: Fix potential memory leak in the timestamp extension
    - [arm64] drm/v3d: Fix potential memory leak in the performance extension
    - [arm64] drm/v3d: Validate passed in drm syncobj handles in the timestamp
      extension
    - [arm64] drm/v3d: Validate passed in drm syncobj handles in the performance
      extension
    - Bluetooth: hci_event: Fix setting DISCOVERY_FINDING for passive scanning
    - nouveau: set placement to original placement on uvmm validate.
    - wifi: ath12k: fix soft lockup on suspend
    - wifi: mac80211: use monitor sdata with driver only if desired
    - io_uring: keep multishot request NAPI timeout current
    - net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
    - net: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutex
    - net: wan: fsl_qmc_hdlc: Discard received CRC
    - r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY
    - mptcp: fix user-space PM announced address accounting
    - mptcp: distinguish rcv vs sent backup flag in requests
    - mptcp: fix NL PM announced address accounting
    - mptcp: mib: count MPJ with backup flag
    - mptcp: fix bad RCVPRUNED mib accounting
    - mptcp: pm: fix backup support in signal endpoints
    - mptcp: pm: only set request_bkup flag when sending MP_PRIO
    - mptcp: fix duplicate data handling

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 12 Aug 2024 20:18:17 +0200

linux (6.10.3-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.2
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.3
    - ext4: don't track ranges in fast_commit if inode has inlined data
      (Closes: #1039883)

  [ Salvatore Bonaccorso ]
  * [rt] Update to 6.10.2-rt14
    - Refresh patches and drop patches applied upstream
  * [arm64] drivers/net/ethernet/microsoft: Enable MICROSOFT_MANA as module
  * drivers/net/ethernet/pensando: Enable IONIC as module (Closes: #1041893)

  [ Vincent Blut ]
  * [arm64] drivers/phy/marvell: Enable PHY_MVEBU_CP110_UTMI as module
    (Closes: #1076934)

  [ Ben Hutchings ]
  * net: drop bad gso csum_start and offset in virtio_net_hdr (regression in
    6.10.3)
  * spi: spidev: Add missing spi_device_id for bh2228fv (regression in 6.10.3)

 -- Ben Hutchings <benh@debian.org>  Sun, 04 Aug 2024 22:10:58 +0200

linux (6.10.1-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.1

  [ Diederik de Haas ]
  * [arm64] Add MediaTek MT7986a SoC support
    - [arm64] drivers/net/ethernet/mediatek: Enable NET_VENDOR_MEDIATEK
    - [arm64] drivers/net/ethernet/mediatek: Enable NET_MEDIATEK_SOC as module
    - [arm64] drivers/net/wireless/mediatek/mt76/mt7915: Enable MT798X_WMAC
    - [arm64] drivers/pwm: Enable PWM_MEDIATEK as module
    - [arm64] drivers/thermal/mediatek: Enable MTK_SOC_THERMAL as module
  * [arm64] Add Bananapi BPI-R3 support (Closes: #1072968)
    - [arm64] drivers/mtd/nand: Enable MTD_NAND_ECC_MEDIATEK as module
    - [arm64] drivers/mtd/nand/spi: Enable MTD_SPI_NAND as module
    - [arm64] drivers/net/dsa: Enable NET_DSA_MT7530, NET_DSA_MT7530_MDIO and
      NET_DSA_MT7530_MMIO as modules
    - [arm64] drivers/spi: Enable SPI_MTK_SNFI as module
  * [arm64] Enable support for Pine64's PineTab2:
    - drivers/iio/accel: Enable IIO_ST_ACCEL_I2C_3AXIS as module
    - [arm64] drivers/gpu/drm/panel: Enable DRM_PANEL_BOE_TH101MB31UIG002_28A
      as module
    - [arm64] drivers/media/i2c: Enable VIDEO_OV5648 and VIDEO_DW9714 as module
  * [arm64] drivers/gpu/drm/bridge/synopsys: Enable DRM_DW_HDMI_I2S_AUDIO as
    module
  * drivers/devfreq: Enable PM_DEVFREQ
  * [arm64,armhf] drivers/devfreq: Make DEVFREQ_GOV_SIMPLE_ONDEMAND builtin

  [ Emanuele Rocca ]
  * [arm64] Enable support for Renesas boards RZ/G3S (ARCH_R9A08G045) and
    RZ/V2H (ARCH_R9A09G057). (Closes: #1072574)
  * [arm64] Re-enable RELR, kernels built with binutils 2.42.90.20240720 boot
    fine. (Cf. #1074111).

  [ Bastian Blank ]
  * [ppc64*] Switch default kernel to 4k page size.  (closes: #1074217)
  * [ppc64*] Add additional kernel with 64k page size.
  * Remove unused check for image size.
  * [arm64] Add additional kernel with 16k page size.

  [ Ben Hutchings ]
  * d/b/test-patches: Handle kernel release strings without ABI number
  * d/b/test-patches: Stop looking for featuresets other than rt
  * d/b/test-patches: Update config overrides for the current format
  * d/b/buildcheck.py: Restore reading of config to pass to check classes
  * d/b/buildcheck.py, d/rules.real: Run buildcheck.py in setup as well
  * d/b/buildcheck.py: Restore config checks on kernels to be signed
  * [alpha] scsi: Disable SCSI_IMM (fixes FTBFS)

  [ Aurelien Jarno ]
  * [riscv64] Enable CONFIG_ARCH_CANAAN to support Canaan Kendryte SoCs.
  * [riscv64] Enable CONFIG_CLK_SOPHGO_CV1800 as a module.
  * [riscv64] Enable CONFIG_ACPI_CPPC_CPUFREQ as a module.

  [ Vincent Blut ]
  * [amd64/cloud] drivers/watchdog: Enable I6300ESB_WDT as module
    (Closes: #1067908)
  * [x86] drivers/platform/x86: Enable MSI_EC as module

  [ Salvatore Bonaccorso ]
  * drivers/md/dm-vdo: Enable DM_VDO as module (Closes: #1076457)
  * drivers/net: Enable NETKIT (BPF-programmable network device) (except for
    sh4/sh7785lcr) (Closes: #1076962)
  * fs/erofs: Enable more EROFS compression algorithms (Closes: #1076570)
    - Enable EROFS_FS_ZIP_LZMA
    - Enable EROFS_FS_ZIP_DEFLATE
    - Enable EROFS_FS_ZIP_ZSTD

  [ Richard Hansen ]
  * [x86] sound/soc/intel/avs/boards: Enable SND_SOC_INTEL_AVS_MACH_MAX98927 as
    a module (Closes: #1076062)

  [ YunQiang Su ]
  * [mips64el] Add mips64r6el flavor.
  * [mips*] Enable R2 to R6 emulator for all R6 flavors.

  [ Sergio Durigan Junior ]
  * Enable debuginfod support. (Closes: #1072311)
    libdebuginfod is dual-licensed LGPL-3+ and GPL-2+, which makes it
    possible for perf to link against the library.
    - d/rules.d/t/perf/Makefile: Remove NO_LIBDEBUGINFOD=1.
    - d/templates/tools-unversioned.control.in: B-D on libdebuginfod-dev.

  [ Dmitry Baryshkov ]
  * [arm64] Enable config options for Qualcomm boards:
    - Enable INTERCONNECT_QCOM_MSM8996, INTERCONNECT_QCOM_QCM2290,
      INTERCONNECT_QCOM_SC7280, INTERCONNECT_QCOM_SM6115, and
      INTERCONNECT_QCOM_SM8250 as built-in, this is required to get serial
      console early during bootup
    - Enable pincontrol PINCTRL_MSM8998, PINCTRL_QCM2290, PINCTRL_SC7280,
      PINCTRL_SC7280_LPASS_LPI, PINCTRL_SM6115, PINCTRL_SM6115_LPASS_LPI,
      PINCTRL_SM8250, PINCTRL_SM8250_LPASS_LPI as modules
    - Enable clock controllers MSM_GCC_8998, QCOM_CLK_APCC_MSM8996,
      QCOM_CLK_APCS_MSM8916, CLK_GFM_LPASS_SM8250, QCM_DISPCC_2290,
      QCM_GCC_2290, QCOM_A53PLL, SC_CAMCC_7280, SC_DISPCC_7280, SC_GPUCC_7280,
      SC_LPASS_CORECC_7280, SC_VIDEOCC_7280, SM_CAMCC_8250, SM_DISPCC_6115,
      SM_DISPCC_8250, SM_GCC_6115, SM_GPUCC_6115, SM_GPUCC_8250,
      SM_VIDEOCC_8250, SDM_LPASSCC_845 as modules
    - Enable Audio drivers MFD_WCD934X, SLIM_QCOM_CTRL, SLIM_QCOM_NGD_CTRL,
      SND_SOC_MSM8916_WCD_ANALOG, SND_SOC_MSM8916_WCD_DIGITAL,
      SND_SOC_MSM8996, SND_SOC_SC7280, SND_SOC_SDM845, SND_SOC_SM8250,
      SND_SOC_WCD9335, SND_SOC_WCD934X, SND_SOC_WSA881X as modules
    - Enable other Qualcomm-specific drivers ARM_QCOM_CPUFREQ_NVMEM,
      ATH10K_SNOC, CHARGER_QCOM_SMB2, I2C_QCOM_CCI, INTERCONNECT_QCOM_MSM8916,
      MSM_GPUCC_8998, MSM_MMCC_8998, GPIO_WCD934X, QCOM_IPA,
      PHY_QCOM_PCIE2, QCOM_GPI_DMA, QCOM_MPM, QCOM_RMTFS_MEM, QCOM_SOCINFO,
      QCOM_WCNSS_PIL, REGULATOR_QCOM_USB_VBUS, RESET_QCOM_PDC,
      TYPEC_QCOM_PMIC, UCSI_PMIC_GLINK as modules
    - Enable DRM_LONTIUM_LT9611, DRM_LONTIUM_LT9611UXC, TYPEC_MUX_NB7VPQ904M
      as moudles for devices present both on Qualcomm and non-Qualcomm
      platforms
  * [arm64] enable CONFIG_QCOM_LMH, another SDM845-related option

  [ Jochen Sprickerhof ]
  * Enable snd_soc_pcm5102a as a module on armhf/arm64

  [ Dylan Aïssi ]
  * debian/rules: sort control.md5sums to improve reproducibility

 -- Ben Hutchings <benh@debian.org>  Fri, 26 Jul 2024 17:53:15 +0200

linux (6.10-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_6.10

  [ Ben Hutchings ]
  * d/l/p/debian_linux/firmware.py: Handle RawFile fields
  * d/l/p/debian_linux/firmware.py: Correctly handle multiple licences per
    section
  * d/l/p/debian_linux/firmware.py: Handle quoted filenames
  * Update to 6.10:
    - Drop patches applied upstream:
      - "alpha: Fix missing symbol versions for str{,n}{cat,cpy}"
    - Refresh patches:
      - Adjust context in "Include package version along with kernel release
        in stack traces"
      - Adjust context in "Documentation: Drop sphinx version check"
      - Change "arm64/acpi: Add fixup for HPE m400 quirks" to not restructure
        acpi_boot_table_init()
      - Adjust context in "phy/marvell: disable 4-port phys"
  * [rt] Update to 6.10-rc6-rt11
  * d/config: Update with the help of kconfigeditor2:
    - Disable BASE_SMALL instead of enabling BASE_FULL
    - drm/display: Enable DRM_DISPLAY_DP_AUX_CHARDEV instead of
      DRM_DP_AUX_CHARDEV
    - [arm64] Enable USB_ONBOARD_DEV instead of USB_ONBOARD_HUB
    - [armel,armhf] Enable ARM_PAN instead of CPU_SW_DOMAIN_PAN
    - [riscv64] Enable ARCH_MICROCHIP, ARCH_SIFIVE, ARCH_VIRT instead of
      SOC_MICROCHIP_POLARFIRE, SOC_SIFIVE, SOC_VIRT
    - [x86] drm/display: Enable DRM_DISPLAY_DP_AUX_CEC instead of DRM_DP_CEC
    - [x86] staging/wlan-ng: Remove PRISM2_USB
  * hyperv-daemons: Update for upstream removal of hv_fcopy_daemon
  * [x86] linux-cpupower: Update turbostat Makefile to define BUILD_BUG_HEADER
  * linux-bpf-dev: Set O to absolute directory in bpftool build

  [ Bastian Blank ]
  * Use debhelper compatibility level 13.
  * Add linux-bpf-dev package for BPF header.
  * Replace dh-exec with static files everywhere.

  [ Punit Agrawal ]
  * drivers/vfio: Enable VFIO configuration for all supported architectures

 -- Ben Hutchings <benh@debian.org>  Thu, 18 Jul 2024 02:14:35 +0200

linux (6.9.12-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.12
    - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
    - [s390x] mm: Fix VM_FAULT_HWPOISON handling in do_exception()
    - ocfs2: add bounds checking to ocfs2_check_dir_entry()
    - jfs: don't walk off the end of ealist
    - usb: gadget: midi2: Fix incorrect default MIDI2 protocol setup
    - ALSA: hda/tas2781: Add new quirk for Lenovo Hera2 Laptop
    - ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
    - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360
    - [arm64] dts: qcom: sc7180: Disable SuperSpeed instances in park mode
    - [arm64] dts: qcom: sc7280: Disable SuperSpeed instances in park mode
    - [arm64] dts: qcom: x1e80100-qcp: Fix USB PHYs regulators
    - [arm64] dts: qcom: qrb2210-rb1: switch I2C2 to i2c-gpio
    - [arm64] dts: qcom: qrb4210-rb2: switch I2C2 to i2c-gpio
    - [arm64] dts: qcom: x1e80100-crd: Fix the PHY regulator for PCIe 6a
    - [arm64] dts: qcom: x1e80100-qcp: Fix the PHY regulator for PCIe 6a
    - [arm64] dts: qcom: x1e80100-crd: Fix USB PHYs regulators
    - [arm64] dts: qcom: msm8996: Disable SS instance in Parkmode for USB
    - [arm64] dts: qcom: sm6350: Disable SS instance in Parkmode for USB
    - [arm64] dts: qcom: msm8998: Disable SS instance in Parkmode for USB
    - [arm64] dts: qcom: ipq6018: Disable SS instance in Parkmode for USB
    - [arm64] dts: qcom: sdm630: Disable SS instance in Parkmode for USB
    - [arm64] dts: qcom: ipq8074: Disable SS instance in Parkmode for USB
    - [arm64] dts: qcom: sdm845: Disable SS instance in Parkmode for USB
    - [arm64] dts: qcom: sm6115: Disable SS instance in Parkmode for USB
    - ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is paused
    - ALSA: seq: ump: Skip useless ports for static blocks
    - filelock: Fix fcntl/close race recovery compat path
    - tun: add missing verification for short frame (CVE-2024-41091)
    - tap: add missing verification for short frame (CVE-2024-41090)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 27 Jul 2024 23:52:33 +0200

linux (6.9.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.11
    - cifs: fix noisy message on copy_file_range
    - scsi: core: alua: I/O errors for ALUA state transitions
    - scsi: sr: Fix unintentional arithmetic wraparound
    - scsi: qedf: Don't process stag work during unload and recovery
    - scsi: qedf: Wait for stag work during unload
    - scsi: qedf: Set qed_slowpath_params to zero before use
    - efi/libstub: zboot.lds: Discard .discard sections
    - ACPI: EC: Abort address space access upon error
    - ACPI: EC: Avoid returning AE_OK on errors in address space handler
    - btrfs: ensure fast fsync waits for ordered extents after a write failure
    - tools/power/cpupower: Fix Pstate frequency reporting on AMD Family 1Ah
      CPUs
    - PNP: Hide pnp_bus_type from the non-PNP code
    - ACPI: AC: Properly notify powermanagement core about changes
    - wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata
    - wifi: mac80211: apply mcast rate only if interface is up
    - wifi: mac80211: handle tasklet frames before stopping
    - wifi: cfg80211: fix 6 GHz scan request building
    - wifi: iwlwifi: mvm: d3: fix WoWLAN command version lookup
    - wifi: iwlwifi: mvm: remove stale STA link data during restart
    - wifi: iwlwifi: mvm: Handle BIGTK cipher in kek_kck cmd
    - wifi: iwlwifi: mvm: handle BA session teardown in RF-kill
    - wifi: iwlwifi: mvm: properly set 6 GHz channel direct probe option
    - wifi: iwlwifi: mvm: Fix scan abort handling with HW rfkill
    - wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
    - of/irq: Factor out parsing of interrupt-map parent phandle+args from
      of_irq_parse_raw()
    - nvme-fabrics: use reserved tag for reg read/write command
    - Input: silead - Always support 10 fingers
    - [x86] platform/x86/amd/hsmp: Check HSMP support on AMD family of
      processors
    - net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()
    - ila: block BH in ila_output()
    - io_uring: fix possible deadlock in io_register_iowq_max_workers()
    - [arm64] armv8_deprecated: Fix warning in isndep cpuhp starting process
    - drm/amdgpu/pptable: Fix UBSAN array-index-out-of-bounds
    - null_blk: fix validation of block size
    - kconfig: gconf: give a proper initial state to the Save button
    - kconfig: remove wrong expr_trans_bool()
    - input: Add event code for accessibility key
    - input: Add support for "Do Not Disturb"
    - HID: Ignore battery for ELAN touchscreens 2F2C and 4116
    - NFSv4: Fix memory leak in nfs4_set_security_label
    - nfs: propagate readlink errors in nfs_symlink_filler
    - nfs: Avoid flushing many pages with NFS_FILE_SYNC
    - nfs: don't invalidate dentries on transient errors
    - cachefiles: add consistency check for copen/cread
    - cachefiles: Set object to close if ondemand_id < 0 in copen
    - cachefiles: make on-demand read killable
    - fs/file: fix the check in find_next_fd()
    - vfio: Create vfio_fs_type with inode per device
    - vfio/pci: Use unmap_mapping_range()
    - mei: demote client disconnect warning on suspend to debug
    - parport: amiga: Mark driver struct with __refdata to prevent section
      mismatch
    - iomap: Fix iomap_adjust_read_range for plen calculation
    - [armhf] drm/exynos: dp: drop driver owner initialization
    - drm: panel-orientation-quirks: Add quirk for Aya Neo KUN
    - [arm64] drm/mediatek: Call drm_atomic_helper_shutdown() at shutdown time
    - nvme: avoid double free special payload
    - nvmet: always initialize cqe.result
    - vfio/pci: Insert full vma on mmap'd MMIO fault
    - loop: Disable fallocate() zero and discard if not supported
    - ALSA: hda: cs35l56: Fix lifecycle of codec pointer
    - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
    - ALSA: hda: cs35l41: Support Lenovo Thinkbook 16P Gen 5
    - ALSA: hda: cs35l41: Support Lenovo Thinkbook 13x Gen 4
    - ALSA: hda/realtek: Support Lenovo Thinkbook 16P Gen 5
    - ALSA: hda/realtek: Support Lenovo Thinkbook 13x Gen 4
    - wifi: mac80211: Avoid address calculations via out of bounds array
      indexing
    - [powerpc*] KVM: PPC: Book3S HV: Prevent UAF in
      kvm_spapr_tce_attach_iommu_group()
    - drm/vmwgfx: Fix missing HYPERVISOR_GUEST dependency
    - ALSA: hda/realtek: Add more codec ID to no shutup pins list
    - spi: Fix OCTAL mode support
    - cpumask: limit FORCE_NR_CPUS to just the UP case
    - drm/amdgpu: Indicate CU havest info to CP
    - drm/amd/display: Change dram_clock_latency to 34us for dcn351
    - drm/amd/display: change dram_clock_latency to 34us for dcn35
    - drm/amdgpu: init TA fw for psp v14
    - ALSA: hda: cs35l56: Select SERIAL_MULTI_INSTANTIATE
    - [mips*] fix compat_sys_lseek syscall
    - closures: Change BUG_ON() to WARN_ON()
    - workqueue: Refactor worker ID formatting and make wq_worker_comm() use
      full ID string
    - Input: elantech - fix touchpad state on resume for Lenovo N24
    - Input: i8042 - add Ayaneo Kun to i8042 quirk table
    - ASoC: rt722-sdca-sdw: add silence detection register as volatile
    - ASoC: codecs: ES8326: Solve headphone detection issue
    - Input: xpad - add support for ASUS ROG RAIKIRI PRO
    - ASoC: topology: Fix references to freed memory
    - [x86] ASoC: Intel: avs: Fix route override
    - ASoC: topology: Do not assign fields that are already set
    - bytcr_rt5640 : inverse jack detect for Archos 101 cesium
    - ALSA: dmaengine: Synchronize dma channel after drop()
    - ASoC: ti: davinci-mcasp: Set min period size using FIFO config
    - ASoC: ti: omap-hdmi: Fix too long driver name
    - ASoC: SOF: sof-audio: Skip unprepare for in-use widgets on error rollback
    - ASoC: rt722-sdca-sdw: add debounce time for type detection
    - ASoC: cs35l56: Disconnect ASP1 TX sources when ASP1 DAI is hooked up
    - nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA.
    - Input: ads7846 - use spi_device_id table
    - can: kvaser_usb: fix return value for hif_usb_send_regout
    - net: mvpp2: fill-in dev_port attribute
    - gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
    - [s390x] sclp: Fix sclp_init() cleanup on failure
    - [x86] platform/x86: wireless-hotkey: Add support for LG Airplane Button
    - [x86] platform/x86: lg-laptop: Remove LGEX0815 hotkey handling
    - [x86] platform/x86: lg-laptop: Change ACPI device id
    - [x86] platform/x86: lg-laptop: Use ACPI device handle when evaluating
      WMAB/WMBB
    - btrfs: scrub: handle RST lookup error correctly
    - btrfs: qgroup: fix quota root leak after quota disable failure
    - ibmvnic: Add tx check to prevent skb leak
    - ALSA: PCM: Allow resume only for suspended streams
    - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx
    - ALSA: dmaengine_pcm: terminate dmaengine before synchronize
    - drm/amd/swsmu: add MALL init support workaround for smu_v14_0_1
    - [x86] ASoC: amd: yc: Fix non-functional mic on ASUS M5602RA
    - net: usb: qmi_wwan: add Telit FN912 compositions
    - clk: qcom: apss-ipq-pll: remove 'config_ctl_hi_val' from Stromer pll
      configs
    - net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and
      DEV_STATS_ADD()
    - [powerpc*] pseries: Whitelist dtl slub object for copying to userspace
    - [powerpc*] eeh: avoid possible crash when edev->pdev changes
    - scsi: libsas: Fix exp-attached device scan after probe failure scanned in
      again after probe failed
    - [arm64] tee: optee: ffa: Fix missing-field-initializers warning
    - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
    - Bluetooth: btnxpuart: Enable Power Save feature on startup
    - bluetooth/l2cap: sync sock recv cb and release
    - erofs: ensure m_llen is reset to 0 if metadata is invalid
    - drm/amd/display: Add refresh rate range check
    - drm/amd/display: Account for cursor prefetch BW in DML1 mode support
    - drm/amd/display: Fix refresh rate range for some panel
    - drm/amd/display: Update efficiency bandwidth for dcn351
    - drm/amd/display: Fix array-index-out-of-bounds in dml2/FCLKChangeSupport
    - drm/radeon: check bo_va->bo is non-NULL before using it
    - btrfs: fix uninitialized return value in the ref-verify tool
    - fs: better handle deep ancestor chains in is_subdir()
    - wifi: iwlwifi: properly set WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK
    - drivers/perf: riscv: Reset the counter to hpmevent mapping while starting
      cpus
    - [riscv64] stacktrace: fix usage of ftrace_graph_ret_addr()
    - spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices
    - spi: davinci: Unset POWERDOWN bit when releasing resources
    - ksmbd: return FILE_DEVICE_DISK instead of super magic
    - [x86] ASoC: SOF: Intel: hda-pcm: Limit the maximum number of periods by
      MAX_BDL_ENTRIES
    - hfsplus: fix uninit-value in copy_name
    - spi: mux: set ctlr->bits_per_word_mask
    - ALSA: hda: Use imply for suggesting CONFIG_SERIAL_MULTI_INSTANTIATE
    - mm: page_ref: remove folio_try_get_rcu()
    - Bluetooth: L2CAP: Fix deadlock
    - ALSA: hda: cs35l41: Fix swapped l/r audio channels for Lenovo ThinBook 13x
      Gen4
    - of/irq: Disable "interrupt-map" parsing for PASEMI Nemo
    - wifi: cfg80211: wext: set ssids=NULL for passive scans
    - wifi: mac80211: disable softirqs for queued frame handling
    - wifi: iwlwifi: mvm: don't wake up rx_sync_waitq upon RFKILL
    - netfs, fscache: export fscache_put_volume() and add
      fscache_try_get_volume()
    - cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
    - cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 25 Jul 2024 22:57:48 +0200

linux (6.9.10-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.10
    - mm: prevent derefencing NULL ptr in pfn_section_valid()
    - scsi: ufs: core: Fix ufshcd_clear_cmd racing issue
    - scsi: ufs: core: Fix ufshcd_abort_one racing issue
    - vfio/pci: Init the count variable in collecting hot-reset devices
    - spi: axi-spi-engine: fix sleep calculation
    - cachefiles: propagate errors from vfs_getxattr() to avoid infinite loop
    - cachefiles: stop sending new request when dropping object
    - cachefiles: cancel all requests for the object that is being dropped
    - cachefiles: wait for ondemand_object_worker to finish when dropping object
    - cachefiles: cyclic allocation of msg_id to avoid reuse
    - cachefiles: add missing lock protection when polling
    - filelock: fix potential use-after-free in posix_lock_inode
    - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
    - vfs: don't mod negative dentry count when on shrinker list
    - net: bcmasp: Fix error code in probe()
    - tcp: fix incorrect undo caused by DSACK of TLP retransmit
    - bpf: Fix too early release of tcx_entry (CVE-2024-41010)
    - net: phy: microchip: lan87xx: reinit PHY after cable test
    - skmsg: Skip zero length skb in sk_msg_recvmsg
    - spi: don't unoptimize message in spi_async()
    - spi: add defer_optimize_message controller flag
    - net: fix rc7's __skb_datagram_iter()
    - i40e: Fix XDP program unloading while removing the driver
    - net: ethernet: lantiq_etop: fix double free in detach
    - minixfs: Fix minixfs_rename with HIGHMEM
    - bpf: fix order of args in call to bpf_map_kvcalloc
    - bpf: make timer data struct more generic
    - bpf: replace bpf_timer_init with a generic helper
    - bpf: Fail bpf_timer_cancel when callback is being cancelled
    - bpf: Defer work in bpf_timer_cancel_and_free
    - tcp: avoid too many retransmit packets (CVE-2024-41007)
    - net: ethernet: mtk-star-emac: set mac_managed_pm when probing
    - ppp: reject claimed-as-LCP but actually malformed packets
    - ethtool: netlink: do not return SQI value if link is down
    - netfilter: nfnetlink_queue: drop bogus WARN_ON
    - netfilter: nf_tables: prefer nft_chain_validate
    - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
    - net/sched: Fix UAF when resolving a clash
    - net, sunrpc: Remap EPERM in case of connection failure in
      xs_tcp_setup_socket
    - [arm64] dts: qcom: sc8180x: Fix LLCC reg property again
    - [arm64] dts: qcom: x1e80100-*: Allocate some CMA buffers
    - [arm64] dts: allwinner: Fix PMIC interrupt number
    - [arm64] dts: qcom: x1e80100: Fix PCIe 6a reg offsets and add MHI
    - [arm64] dts: qcom: sm6115: add iommu for sdhc_1
    - [arm64] dts: qcom: qdu1000: Fix LLCC reg property
    - firmware: cs_dsp: Fix overflow checking of wmfw header
    - firmware: cs_dsp: Return error if block header overflows file
    - firmware: cs_dsp: Validate payload length before processing block
    - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
    - [x86] ASoC: SOF: Intel: hda: fix null deref on system suspend entry
    - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
    - net: ethtool: Fix RSS setting
    - i40e: fix: remove needless retries of NVM update
    - cifs: fix setting SecurityFlags to true
    - Revert "sched/fair: Make sure to try to detach at least one movable task"
    - USB: serial: option: add Telit generic core-dump composition
    - USB: serial: option: add Telit FN912 rmnet compositions
    - USB: serial: option: add Fibocom FM350-GL
    - USB: serial: option: add support for Foxconn T99W651
    - USB: serial: option: add Netprisma LCUK54 series modules
    - USB: serial: option: add Rolling RW350-GL variants
    - USB: serial: mos7840: fix crash on resume
    - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
    - usb: dwc3: pci: add support for the Intel Panther Lake
    - usb: core: add missing of_node_put() in usb_of_has_devices_or_graph
    - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
    - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the
      descriptor
    - misc: microchip: pci1xxxx: Fix return value of nvmem callbacks
    - hpet: Support 32-bit userspace
    - xhci: always resume roothubs if xHC was reset during resume
    - [s390x] mm: Add NULL pointer check to crst_table_free() base_crst_free()
    - nilfs2: fix kernel bug on rename operation of broken directory
    - cachestat: do not flush stats in recency check
    - mm: vmalloc: check if a hash-index is in cpu_possible_mask
    - mm: fix crashes from deferred split racing folio migration
    - filemap: replace pte_offset_map() with pte_offset_map_nolock()
    - mm/filemap: skip to create PMD-sized page cache if needed
    - mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray
    - ksmbd: discard write access to the directory open
    - iio: trigger: Fix condition for own trigger
    - [arm64] dts: qcom: sa8775p: Correct IRQ number of EL2 non-secure physical
      timer
    - [arm64] dts: qcom: sc8280xp-x13s: fix touchscreen power on
    - [arm64] dts: qcom: x1e80100-crd: fix WCD audio codec TX port mapping
    - [arm64] dts: qcom: x1e80100-crd: fix DAI used for headset recording
    - nvmem: rmem: Fix return value of rmem_read()
    - nvmem: meson-efuse: Fix return value of nvmem callbacks
    - nvmem: core: only change name to fram for current attribute
    - nvmem: core: limit cell sysfs permissions to main attribute ones
    - [x86] platform/x86: toshiba_acpi: Fix array out-of-bounds access
    - tty: serial: ma35d1: Add a NULL check for of_node
    - serial: imx: ensure RTS signal is not left active after shutdown
    - ALSA: hda/realtek: add quirk for Clevo V5[46]0TU
    - ALSA: hda/realtek: Enable Mute LED on HP 250 G7
    - ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
    - mei: vsc: Enhance IVSC chipset stability during warm reboot
    - mei: vsc: Prevent timeout error with added delay post-firmware download
    - mei: vsc: Utilize the appropriate byte order swap function
    - Fix userfaultfd_api to return EINVAL as expected
    - mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE
    - mmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's
      length
    - pmdomain: qcom: rpmhpd: Skip retention level for Power Domains
    - libceph: fix race between delayed_work() and ceph_monc_stop()
    - ACPI: processor_idle: Fix invalid comparison with insertion sort for
      latency
    - cpufreq: ACPI: Mark boost policy as enabled when setting boost
    - cpufreq: Allow drivers to advertise boost enabled
    - wireguard: selftests: use acpi=off instead of -no-acpi for recent QEMU
    - wireguard: allowedips: avoid unaligned 64-bit memory accesses
    - wireguard: queueing: annotate intentional data race in cpu round robin
    - wireguard: send: annotate intentional data race in checking empty queue
    - [arm64] misc: fastrpc: Fix DSP capabilities request
    - [arm64] misc: fastrpc: Avoid updating PD type for capability request
    - [arm64] misc: fastrpc: Copy the complete capability structure to user
    - [arm64] misc: fastrpc: Fix memory leak in audio daemon attach operation
    - [arm64] misc: fastrpc: Fix ownership reassignment of remote heap
    - [arm64] misc: fastrpc: Restrict untrusted app to attach to privileged PD
    - mm/readahead: limit page cache size in page_cache_ra_order()
    - mm/shmem: disable PMD-sized page cache if needed
    - mm/damon/core: merge regions aggressively when max_nr_regions is unmet
    - Revert "dt-bindings: cache: qcom,llcc: correct QDU1000 reg entries"
    - ext4: avoid ptr null pointer dereference
    - i2c: mark HostNotify target address as used
    - i2c: testunit: avoid re-issued work after read message
    - sched/deadline: Fix task_struct reference leak
    - [x86] bhi: Avoid warning in #DB handler due to BHI mitigation
    - kbuild: Make ld-version.sh more robust against version string changes
    - kbuild: rpm-pkg: avoid the warnings with dtb's listed twice

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 19 Jul 2024 18:55:23 +0200

linux (6.9.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.9
    - locking/mutex: Introduce devm_mutex_init()
    - leds: mlxreg: Use devm_mutex_init() for mutex initialization
    - leds: an30259a: Use devm_mutex_init() for mutex initialization
    - crypto: hisilicon/debugfs - Fix debugfs uninit process issue
    - [arm64,armhf] drm/lima: fix shared irq handling on driver remove
    - [powerpc*] Avoid nmi_enter/nmi_exit in real mode interrupt.
    - media: dvb: as102-fe: Fix as10x_register_addr packing
    - media: dvb-usb: dib0700_devices: Add missing release_firmware()
    - net: dql: Avoid calling BUG() when WARN() is enough
    - wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if no 6 GHz sband
    - drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_buf
    - IB/core: Implement a limit on UMAD receive List
    - scsi: qedf: Make qedf_execute_tmf() non-preemptible
    - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable
    - bpf: check bpf_dummy_struct_ops program params for test runs
    - [riscv64] KVM: Fix the initial sample period value
    - crypto: aead,cipher - zeroize key buffer after use
    - media: mediatek: vcodec: Only free buffer VA that is not NULL
    - drm/amdgpu: Fix uninitialized variable warnings
    - drm/amdgpu: Using uninitialized value *size when calling
      amdgpu_vce_cs_reloc
    - drm/amdgpu: Initialize timestamp for some legacy SOCs
    - drm/amdgpu: fix double free err_addr pointer warnings
    - drm/amd/display: Add NULL pointer check for kzalloc
    - drm/amd/display: Check index msg_id before read or write
    - drm/amd/display: Check pipe offset before setting vblank
    - drm/amd/display: Skip finding free audio for unknown engine_id
    - drm/amd/display: Fix overlapping copy within dml_core_mode_programming
    - drm/amd/display: update pipe topology log to support subvp
    - drm/amd/display: Do not return negative stream id for array
    - drm/amd/display: ASSERT when failing to find index by plane/stream id
    - drm/amd/display: Fix uninitialized variables in DM
    - drm/amdgpu: fix uninitialized scalar variable warning
    - drm/amdgpu: fix the warning about the expression (int)size - len
    - media: dw2102: Don't translate i2c read into write
    - [riscv64] Apply SiFive CIP-1200 workaround to single-ASID sfence.vma
    - media: dw2102: fix a potential buffer overflow
    - sctp: prefer struct_size over open coded arithmetic
    - firmware: dmi: Stop decoding on broken entry
    - kunit/fortify: Do not spam logs with fortify WARNs
    - Input: ff-core - prefer struct_size over open coded arithmetic
    - usb: xhci: prevent potential failure in handle_tx_event() for Transfer
      events without TRB
    - wifi: mt76: replace skb_put with skb_put_zero
    - wifi: mt76: mt7996: add sanity checks for background radar trigger
    - thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data
    - [arm64,armhf] net: dsa: mv88e6xxx: Correct check for empty list
    - media: dvb-frontends: tda18271c2dd: Remove casting during div
    - media: s2255: Use refcount_t instead of atomic_t for num_channels
    - media: i2c: st-mipid02: Use the correct div function
    - media: tc358746: Use the correct div_ function
    - media: dvb-frontends: tda10048: Fix integer overflow
    - crypto: hisilicon/sec2 - fix for register offset
    - gve: Account for stopped queues when reading NIC stats
    - i2c: i801: Annotate apanel_addr as __ro_after_init
    - [powerpc*] 64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
    - orangefs: fix out-of-bounds fsid access
    - kunit: Fix timeout message
    - [powerpc*] xmon: Check cpu id in commands "c#", "dp#" and "dx#"
    - igc: fix a log entry using uninitialized netdev
    - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
    - f2fs: check validation of fault attrs in f2fs_build_fault_attr()
    - scsi: mpi3mr: Sanitise num_phys
    - serial: imx: Raise TX trigger level to 8
    - jffs2: Fix potential illegal address access in jffs2_free_inode
    - [s390x] Mark psw in __load_psw_mask() as __unitialized
    - [s390x] pkey: Use kfree_sensitive() to fix Coccinelle warnings
    - [s390x] pkey: Wipe sensitive data on failure
    - [s390x] pkey: Wipe copies of clear-key structures on failure
    - [s390x] pkey: Wipe copies of protected- and secure-keys
    - btrfs: scrub: initialize ret in scrub_simple_mirror() to fix compilation
      warning
    - cdrom: rearrange last_media_change check to avoid unintentional overflow
    - [x86] tools/power turbostat: Remember global max_die_id
    - [x86] tools/power turbostat: Avoid possible memory corruption due to
      sparse topology IDs
    - vhost: Use virtqueue mutex for swapping worker
    - vhost: Release worker mutex during flushes
    - vhost_task: Handle SIGKILL by flushing work and exiting
    - virtio-pci: Check if is_avq is NULL
    - mac802154: fix time calculation in ieee802154_configure_durations()
    - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
    - net: phy: phy_device: Fix PHY LED blinking code comment
    - wifi: mac80211: fix BSS_CHANGED_UNSOL_BCAST_PROBE_RESP
    - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
    - net/mlx5: E-switch, Create ingress ACL when needed
    - net/mlx5e: Add mqprio_rl cleanup and free in mlx5e_priv_cleanup()
    - net/mlx5e: Present succeeded IPsec SA bytes and packet
    - net/mlx5e: Approximate IPsec per-SA payload data bytes count
    - Bluetooth: hci_event: Fix setting of unicast qos interval
    - Bluetooth: Ignore too large handle values in BIG
    - Bluetooth: ISO: Check socket flag instead of hcon
    - bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
    - tcp_metrics: validate source addr length
    - [s390x] KVM: s390: fix LPSWEY handling
    - e1000e: Fix S0ix residency on corporate systems
    - gpiolib: of: fix lookup quirk for MIPS Lantiq
    - net: allow skb_datagram_iter to be called from any context
    - net: txgbe: initialize num_q_vectors for MSI/INTx interrupts
    - net: txgbe: remove separate irq request for MSI and INTx
    - net: txgbe: add extra handle for MSI/INTx into thread irq handle
    - net: txgbe: free isb resources at the right time
    - btrfs: always do the basic checks for btrfs_qgroup_inherit structure
    - net: phy: aquantia: add missing include guards
    - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from
      __netif_rx()
    - drm/fbdev-generic: Fix framebuffer on big endian devices
    - net: stmmac: enable HW-accelerated VLAN stripping for gmac4 only
    - [s390x] vfio_ccw: Fix target addresses of TIC CCWs
    - gpio: mmio: do not calculate bgpio_bits via "ngpios"
    - wifi: wilc1000: fix ies_len type in connect path
    - [riscv64] kexec: Avoid deadlock in kexec crash path
    - netfilter: nf_tables: unconditionally flush pending work before notifier
    - net: rswitch: Avoid use-after-free in rswitch_poll()
    - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
      (CVE-2024-39487)
    - ice: Fix improper extts handling
    - ice: Don't process extts if PTP is disabled
    - ice: Reject pin requests with unsupported flags
    - ice: use proper macro for testing bit
    - drm/xe/mcr: Avoid clobbering DSS steering
    - tcp: Don't flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO.
    - inet_diag: Initialize pad field in struct inet_diag_req_v2
    - bnxt_en: Fix the resource check condition for RSS contexts
    - gpiolib: of: add polarity quirk for TSC2005
    - [x86] platform/x86: toshiba_acpi: Fix quickstart quirk handling
    - Revert "igc: fix a log entry using uninitialized netdev"
    - nilfs2: fix inode number range checks
    - nilfs2: add missing check for inode numbers on directory entries
    - nilfs2: fix incorrect inode allocation from reserved inodes
    - mm: optimize the redundant loop of mm_update_owner_next()
    - mm: avoid overflows in dirty throttling logic
    - btrfs: zoned: fix calc_available_free_space() for zoned mode
    - btrfs: fix adding block group to a reclaim list and the unused list during
      reclaim
    - btrfs: fix folio refcount in __alloc_dummy_extent_buffer()
    - f2fs: Add inline to f2fs_build_fault_attr() stub
    - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add()
    - Bluetooth: hci_bcm4377: Fix msgid release
    - Bluetooth: Add quirk to ignore reserved PHY bits in LE Extended Adv Report
    - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
    - can: kvaser_usb: Explicitly initialize family in leafimx driver_info
      struct
    - fsnotify: Do not generate events for O_PATH file descriptors
    - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(),
      again"
    - drm/xe: fix error handling in xe_migrate_update_pgtables
    - drm/ttm: Always take the bo delayed cleanup path for imported bos
    - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
    - drm/amdgpu/atomfirmware: silence UBSAN warning
    - drm: panel-orientation-quirks: Add quirk for Valve Galileo
    - clk: qcom: gcc-ipq9574: Add BRANCH_HALT_VOTED flag
    - clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common
    - [powerpc*] pseries: Fix scv instruction crash with kexec
    - [powerpc*] 64s: Fix unnecessary copy to 0 when kernel is booted at address
      0
    - firmware: sysfb: Fix reference count of sysfb parent device
    - filelock: Remove locks reliably when fcntl/close race is detected
    - mtd: rawnand: Ensure ECC configuration is propagated to upper layers
    - mtd: rawnand: Fix the nand_read_data_op() early check
    - mtd: rawnand: Bypass a couple of sanity checks during NAND identification
    - mtd: rawnand: rockchip: ensure NVDDR timings are rejected
    - fs: don't misleadingly warn during thaw operations
    - net: stmmac: dwmac-qcom-ethqos: fix error array size
    - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
    - s390/dasd: Fix invalid dereferencing of indirect CCW data pointer
    - selftests/harness: Fix tests timeout and race condition
    - arm64: dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 Model
      B
    - clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents
    - clk: qcom: clk-alpha-pll: set ALPHA_EN bit for Stromer Plus PLLs
    - clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg
    - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
    - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
    - vhost-scsi: Handle vhost_vq_work_queue failures for events
    - nvme-multipath: find NUMA path only for online numa-node
    - dma-mapping: benchmark: avoid needless copy_to_user if benchmark fails
    - drm/amdgpu: correct hbm field in boot status
    - connector: Fix invalid conversion in cn_proc.h
    - swap: yield device immediately
    - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset
    - libbpf: detect broken PID filtering logic for multi-uprobe
    - regmap-i2c: Subtract reg size from max_write
    - [x86] platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW
      11.6" tablet
    - [x86] platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro
    - block: check for max_hw_sectors underflow
    - nvmet: fix a possible leak when destroy a ctrl during qp establishment
    - kbuild: fix short log for AS in link-vmlinux.sh
    - nfc/nci: Add the inconsistency check between the input data length and
      count
    - spi: cadence: Ensure data lines set to low during dummy-cycle period
    - ALSA: ump: Set default protocol when not given explicitly
    - drm/amdgpu: silence UBSAN warning
    - hwmon: (dell-smm) Add Dell G15 5511 to fan control whitelist
    - null_blk: Do not allow runt zone with zone capacity smaller then zone size
    - libbpf: don't close(-1) in multi-uprobe feature detector

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 13 Jul 2024 17:45:02 +0200

linux (6.9.8-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.8
    - usb: typec: ucsi: Never send a lone connector change ack
    - usb: typec: ucsi: Ack also failed Get Error commands
    - [arm64] pinctrl: renesas: rzg2l: Use spin_{lock,unlock}_irq{save,restore}
    - Input: ili210x - fix ili251x_read_touch_data() return value
    - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
    - [arm64,armhf] pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
    - [arm64,armhf] pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
    - [arm64,armhf] pinctrl: rockchip: use dedicated pinctrl type for RK3328
    - [arm64,armhf] pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
    - [mips*] pci: lantiq: restore reset gpio polarity
    - [x86] ASoC: cs42l43: Increase default type detect time and button delay
    - [arm64] ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on right
      mclk
    - [arm64] ASoC: mediatek: mt8183-da7219-max98357: Fix kcontrol name
      collision
    - workqueue: Increase worker desc's length to 32
    - [arm64] ASoC: q6apm-lpass-dai: close graph on prepare errors
    - bpf: Add missed var_off setting in set_sext32_default_val()
    - bpf: Add missed var_off setting in coerce_subreg_to_size_sx()
    - [s390x] pci: Add missing virt_to_phys() for directed DIBV
    - [s390x] virtio_ccw: Fix config change notifications
    - bpf: Fix remap of arena.
    - ASoC: amd: acp: add a null check for chip_pdev structure
    - ASoC: amd: acp: remove i2s configuration check in acp_i2s_probe()
    - ASoC: amd: acp: move chip->flag variable assignment
    - ASoC: fsl-asoc-card: set priv->pdev before using it
    - net: dsa: microchip: fix initial port flush problem
    - openvswitch: get related ct labels from its master if it is not confirmed
    - bonding: fix incorrect software timestamping report
    - ionic: fix kernel panic due to multi-buffer handling
    - mlxsw: pci: Fix driver initialization with Spectrum-4
    - mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems
    - bpf: Fix the corner case with may_goto and jump to the 1st insn.
    - bpf: Fix overrunning reservations in ringbuf
    - vxlan: Pull inner IP header in vxlan_xmit_one().
    - ibmvnic: Free any outstanding tx skbs during scrq reset
    - net: phy: micrel: add Microchip KSZ 9477 to the device table
    - net: dsa: microchip: use collision based back pressure mode
    - ice: Rebuild TC queues on VSI queue reconfiguration
    - bpf: Fix may_goto with negative offset.
    - xdp: Remove WARN() from __xdp_reg_mem_model()
    - btrfs: use NOFS context when getting inodes during logging and log replay
    - Fix race for duplicate reqsk on identical SYN
    - ALSA: seq: Fix missing channel at encoding RPN/NRPN MIDI2 messages
    - net: dsa: microchip: fix wrong register write when masking interrupt
    - [powerpc*] restore some missing spu syscalls
    - ionic: use dev_consume_skb_any outside of napi
    - tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO
    - ALSA: seq: Fix missing MSB in MIDI2 SPP conversion
    - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data
      registers
    - af_unix: Stop recv(MSG_PEEK) at consumed OOB skb.
    - af_unix: Don't stop recv(MSG_DONTWAIT) if consumed OOB skb is at the head.
    - af_unix: Don't stop recv() at consumed ex-OOB skb.
    - af_unix: Fix wrong ioctl(SIOCATMARK) when consumed OOB skb is at the head.
    - net: mana: Fix possible double free in error handling path
    - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
    - bpf: Take return from set_memory_rox() into account with
      bpf_jit_binary_lock_ro()
    - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
    - drm/xe: Fix potential integer overflow in page size calculation
    - vduse: validate block features only with block devices
    - vduse: Temporarily fail if control queue feature requested
    - [x86] fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup
    - drm/xe: Add a NULL check in xe_ttm_stolen_mgr_init
    - drm/amd/display: correct hostvm flag
    - mtd: partitions: redboot: Added conversion of operands to a larger type
    - wifi: ieee80211: check for NULL in ieee80211_mle_size_ok()
    - drm/amd/display: Skip pipe if the pipe idx not set properly
    - bpf: Add a check for struct bpf_fib_lookup size
    - bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
    - drm/xe/xe_devcoredump: Check NULL before assignments
    - RDMA/restrack: Fix potential invalid address access
    - net/iucv: Avoid explicit cpumask var allocation on stack
    - net/dpaa2: Avoid explicit cpumask var allocation on stack
    - wifi: rtw89: download firmware with five times retry
    - crypto: ecdh - explicitly zeroize private_key
    - ALSA: emux: improve patch ioctl data validation
    - media: dvbdev: Initialize sbuf
    - irqchip/loongson: Select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP for
      IRQ_LOONGARCH_CPU
    - iommu/arm-smmu-v3: Do not allow a SVA domain to be set on the wrong PASID
    - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
    - gfs2: Fix NULL pointer dereference in gfs2_log_flush
    - evm: Enforce signatures on unsupported filesystem for EVM_INIT_X509
    - drm/radeon/radeon_display: Decrease the size of allocated memory
    - drm/xe: Check pat.ops before dumping PAT settings
    - nvmet: do not return 'reserved' for empty TSAS values
    - nvme: fixup comment for nvme RDMA Provider Type
    - nvmet: make 'tsas' attribute idempotent for RDMA
    - drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
    - gpio: davinci: Validate the obtained number of IRQs
    - arm64: Clear the initial ID map correctly before remapping
    - nfsd: initialise nfsd_info.mutex early.
    - [riscv64] fix vector insn load/store width mask
    - drm/amdgpu: Fix pci state save during mode-1 reset
    - [riscv64] stacktrace: convert arch_stack_walk() to noinstr
    - [amd64] iommu/amd: Introduce per device DTE update function
    - [amd64] iommu/amd: Invalidate cache before removing device from domain
      list
    - [amd64] iommu/amd: Fix GT feature enablement again
    - gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
    - gpiolib: cdev: Ignore reconfiguration without direction
    - randomize_kstack: Remove non-functional per-arch entropy filtering
    - [x86] stop playing stack games in profile_pc()
    - Revert "MIPS: pci: lantiq: restore reset gpio polarity"
    - pinctrl: qcom: spmi-gpio: drop broken pm8008 support
    - ocfs2: fix DIO failure due to insufficient transaction credits
    - nfs: drop the incorrect assertion in nfs_swap_rw()
    - kasan: fix bad call to unpoison_slab_object
    - mm: fix incorrect vbq reference in purge_fragmented_block
    - mm/memory: don't require head page for do_set_pmd()
    - Revert "mmc: moxart-mmc: Use sg_miter for PIO"
    - mmc: sdhci-pci-o2micro: Convert PCIBIOS_* return codes to errnos
    - mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
    - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
    - mmc: sdhci: Do not invert write-protect twice
    - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
    - iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
    - SUNRPC: Fix backchannel reply, again
    - counter: ti-eqep: enable clock at probe
    - kbuild: doc: Update default INSTALL_MOD_DIR from extra to updates
    - kbuild: Fix build target deb-pkg: ln: failed to create hard link
    - kbuild: rpm-pkg: fix build error with CONFIG_MODULES=n
    - i2c: testunit: don't erase registers after STOP
    - i2c: testunit: discard write requests while old command is running
    - ata: libata-core: Fix null pointer dereference on error
    - ata,scsi: libata-core: Do not leak memory for ata_port struct members
    - iio: humidity: hdc3020: fix hysteresis representation
    - iio: adc: ad7266: Fix variable checking bug
    - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
    - net: usb: ax88179_178a: improve link status logs
    - usb: gadget: printer: SS+ support
    - usb: gadget: printer: fix races against disable
    - usb: musb: da8xx: fix a resource leak in probe()
    - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
    - usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to
      avoid deadlock
    - usb: gadget: aspeed_udc: fix device address configuration
    - usb: typec: ucsi: glink: fix child node release in probe function
    - Revert "usb: gadget: u_ether: Re-attach netif device to mirror detachment"
    - Revert "usb: gadget: u_ether: Replace netif_stop_queue with
      netif_device_detach"
    - usb: ucsi: stm32: fix command completion handling
    - usb: dwc3: core: Workaround for CSR read timeout
    - Revert "serial: core: only stop transmit when HW fifo is empty"
    - tty: serial: 8250: Fix port count mismatch with the device
    - serial: 8250_omap: Implementation of Errata i2310
    - serial: imx: set receiver level before starting uart
    - serial: core: introduce uart_port_tx_limited_flags()
    - serial: bcm63xx-uart: fix tx after conversion to uart_port_tx_limited()
    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook 645/665
      G11.
    - tty: mxser: Remove __counted_by from mxser_board.ports[]
    - tty: mcf: MCF54418 has 10 UARTS
    - net: can: j1939: Initialize unused data in j1939_send_one()
    - net: can: j1939: recover socket queue on CAN bus error during BAM
      transmission
    - net: can: j1939: enhanced error handling for tightly received RTS messages
      in xtp_rx_rts_session_new
    - PCI/MSI: Fix UAF in msi_capability_init
    - nvmet-fc: Remove __counted_by from nvmet_fc_tgt_queue.fod[]
    - cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing
    - irqchip/loongson-eiointc: Use early_cpu_to_node() instead of cpu_to_node()
    - cpu: Fix broken cmdline "nosmp" and "maxcpus=0"
    - cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked()
    - irqchip/loongson-liointc: Set different ISRs for different cores
    - kbuild: Install dtb files as 0644 in Makefile.dtbinst
    - btrfs: zoned: fix initial free space detection
    - csky, hexagon: fix broken sys_sync_file_range
    - drm/drm_file: Fix pid refcounting race (CVE-2024-39486)
    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
    - drm/fbdev-dma: Only set smem_start is enable per module option
    - drm/amdgpu: avoid using null object of framebuffer
    - [x86] drm/i915/gt: Fix potential UAF by revoke of fence registers
    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
    - drm/amd/display: Send DP_TOTAL_LTTPR_CNT during detection if LTTPR is
      present
    - drm/amdgpu/atomfirmware: fix parsing of vram_info
    - io_uring: signal SQPOLL task_work with TWA_SIGNAL_NO_IPI
    - batman-adv: Don't accept TT entries for out-of-spec VIDs
    - can: mcp251xfd: fix infinite loop when xmit fails
    - ata: ahci: Clean up sysfs file on error
    - ata: libata-core: Add ATA_HORKAGE_NOLPM for all Crucial BX SSD1 models
    - ata: libata-core: Fix double free on error
    - ftruncate: pass a signed offset
    - syscalls: fix compat_sys_io_pgetevents_time64 usage
    - syscalls: fix sys_fanotify_mark prototype
    - bcachefs: Fix sb_field_downgrade validation
    - bcachefs: Fix sb-downgrade validation
    - bcachefs: Fix bch2_sb_downgrade_update()
    - bcachefs: Fix setting of downgrade recovery passes/errors
    - bcachefs: btree_gc can now handle unknown btrees
    - Revert "net: sfp: enhance quirk for Fibrestore 2.5G copper SFP module"
    - mm/page_alloc: Separate THP PCP into movable and non-movable categories
    - [arm64] dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s
    - [arm64] dts: rockchip: Rename LED related pinctrl nodes on
      rk3308-rock-pi-s
    - [arm64] dts: rockchip: set correct pwm0 pinctrl on rk3588-tiger
    - [arm64] dts: rockchip: Fix the value of `dlg,jack-det-rate` mismatch on
      rk3399-gru
    - [arm64] Revert "arm64: dts: rockchip: remove redundant cd-gpios from
      rk3588 sdmmc nodes"
    - [arm64] dts: rockchip: make poweroff(8) work on Radxa ROCK 5A
    - cxl/region: Convert cxl_pmem_region_alloc to scope-based resource
      management
    - cxl/mem: Fix no cxl_nvd during pmem region auto-assembling
    - [arm64] dts: rockchip: fix PMIC interrupt pin on ROCK Pi E
    - reset: gpio: Fix missing gpiolib dependency for GPIO reset controller
    - [arm64] dts: rockchip: Fix the i2c address of es8316 on Cool Pi 4B
    - [arm64] dts: rockchip: Add sound-dai-cells for RK3368
    - cxl/region: Move cxl_dpa_to_region() work to the region driver
    - cxl/region: Avoid null pointer dereference in region lookup
    - cxl/region: check interleave capability
    - netfs: Fix netfs_page_mkwrite() to check folio->mapping is valid
    - netfs: Fix netfs_page_mkwrite() to flush conflicting data, not wait
    - serial: imx: only set receiver level if it is zero
    - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
    - tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()

  [ Salvatore Bonaccorso ]
  * [rt] Drop "pinctrl: renesas: rzg2l: Use
    spin_{lock,unlock}_irq{save,restore}" (applied upstream)
  * d/rules.real: Revert workaround to explicitly remove executable bits from
    dtb files (implemented upstream)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 07 Jul 2024 20:58:08 +0200

linux (6.9.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.3
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.4
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.5
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.6
    - [x86] cpu: Provide default cache line size if not enumerated
      (Closes: #1071378)
    - NFS: add barriers when testing for NFS_FSDATA_BLOCKED (Closes: #1071501)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.7

  [ Salvatore Bonaccorso ]
  * [x86] Refresh "intel-iommu: Add option to exclude integrated GPU only"
  * [x86] Refresh "intel-iommu: Add Kconfig option to exclude iGPU by default"
  * [rt] Drop "drm/i915/gt: Queue and wait for the irq_work item."
  * [arm64] Disable RELR.
    Temporarily disable RELR relocation packing to workaround failing boots
    on arm64 with recent binutils/2.42.50.20240618-1, cf. #1074111.
  * lib/python/debian_linux: Fix two E201/E202 whitespace errors
  * Drop "sched: Do not enable autogrouping by default" patch (Closes: #1070083)
  * [rt] init: Disable SCHED_AUTOGROUP on RT configurations

  [ Aurelien Jarno ]
  * [riscv64] crypto: enable CRYPTO_AES_RISCV64, CRYPTO_CHACHA_RISCV64,
    CRYPTO_GHASH_RISCV64, CRYPTO_SHA256_RISCV64, CRYPTO_SHA512_RISCV64 as
    modules.
  * [riscv64] Improve Microchip Polarfire support: enable
    POLARFIRE_SOC_AUTO_UPDATE and USB_MUSB_POLARFIRE_SOC as modules.
  * [riscv64] Improve T-Head TH1520 support: enable MMC_SDHCI_OF_DWCMSHC as
    module.
  * [riscv64] Improve VisionFive 2 support: enable SND_DESIGNWARE_I2S,
    SND_SIMPLE_CARD and SND_SOC_JH7110_PWMDAC as modules.
  * [riscv64] Improve JH7110 support: enable STARFIVE_STARLINK_PMU as module.

  [ Vincent Blut ]
  * [amd64] drivers/tee: Enable TEE as module (Closes: #1063161)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 27 Jun 2024 20:37:47 +0200

linux (6.9.2-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_6.9
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.1
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.2

  [ Johannes Schauer Marin Rodrigues ]
  * New target in debian/rules: "clean-generated" cleans up all auto-generated
    files inside the ./debian directory

  [ Diederik de Haas ]
  * [arm64,riscv64] drivers/leds/rgb: Enable LEDS_GROUP_MULTICOLOR as module
  * [arm64] drivers/leds/rgb: Enable LEDS_PWM_MULTICOLOR as module
  * [arm*,riscv64] drivers/pps/clients: Enable PPS_CLIENT_GPIO as module
  * Update to 6.9.2:
    - Drop patches:
      - "ntfs: mark it as broken"; ntfs driver removed upstream
    - Drop patches applied upstream:
      - "ARM64: Dynamically allocate cpumasks and increase supported CPUs to
        512"
      - "tipc: fix UAF in error path"
      - "tipc: fix a possible memleak in tipc_buf_append"
    - Refresh patches:
      - Adjust context in "video: Remove nvidiafb and rivafb"
      - Adjust context in "Export symbols needed by Android drivers"
      - Adjust context in "Documentation: Drop sphinx version check"
      - Adjust context in "firmware_class: Log every success and failure
        against given device"
      - Adjust context in "firmware: Remove redundant log messages from drivers"
      - Adjust context in "af_802154: Disable auto-loading as mitigation
        against local exploits"
      - Adjust context in "intel-iommu: Add Kconfig option to exclude iGPU by
        default"
      - Adjust context in "x86: Make x32 syscall support conditional on a
        kernel parameter"
      - Adjust context in "efi: Lock down the kernel if booted in secure boot
        mode"
      - Adjust context in "Revert 'perf build: Fix libunwind feature detection
        on 32-bit x86'"
  * tools/rtla: Restore option to set VERSION var to VERSION file's contents
  * d/rules.d: rtla: Update Makefile for upstream restructuring
  * d/config: Update with the help of kconfigeditor2:
    - [x86] arch/x86: Rename RETPOLINE to MITIGATION_RETPOLINE
    - [amd64] arch/x86: Rename SLS to MITIGATION_SLS
    - [x86] drivers/acpi: Remove ACPI_CUSTOM_METHOD
    - drivers/mtd/maps: Remove MTD_INTEL_VR_NOR
    - drivers/staging/board: Remove STAGING_BOARD
    - fs/ntfs: Remove NTFS_FS
    - lib/Kconfig.debug: Rename TEST_STRING_HELPERS to STRING_HELPERS_KUNIT_TEST
    - net/bluetooth: Remove BT_HS
    - net/ipv4/netfilter: Remove IP_NF_ARPTABLES
    - net/sched: Remove NET_ACT_IPT
  * [rt] Update to 6.9-rt5
  * [rt] pinctrl: renesas: rzg2l: use spin_{lock,unlock}_irq{save,restore}

  [ Ben Hutchings ]
  * d/signing_templates/rules.real: Consistently define REAL_VERSION variable
  * d/signing_templates: Define BUILD_DIR and STAMPS_DIR, and clean those dirs
  * d/signing_templates/rules.real: Use an intermediate install directory
  * Revert "Revert "Run dh_movetousr also in signed images."", as this now
    works
  * firmware_loader: Remove most Debian-specific logging changes
    (Closes: #1040738):
    - Revert "firmware_class: Refer to Debian wiki page when logging missing
      firmware"
    - Revert "firmware: Remove redundant log messages from drivers"
    - Revert "firmware_class: Log every success and failure against given
      device" (Closes: #857198, #966218)
    - firmware_loader: Log direct loading failures as info for d-i
  * d/rules.d/tools/tracing/rtla: Delete redundant sed command

  [ Macpaul Lin ]
  * [arm64] Enable support for various MediaTek SoCs:
    - Enable COMMON_CLK_MT8188 and related clocks, COMMON_CLK_MT8365 and
      related clocks, and COMMON_CLK_MT8195_IPESYS as modules
    - Enable pin controllers for MT2712, MT6765, MT6779, MT6795, MT6797,
      MT7622, MT7981, MT7986, MT8167, MT8186, MT8188, MT8192, MT8365,
      MT8516, MT6397
    - Enable REGULATOR_MT6357, REGULATOR_MT6360 as modules
    - Enable CHARGER_MT6360 and TYPEC_MT6360 as modules
    - Enable REALTEK_PHY, DWMAC_MEDIATEK as modules
    - Enable MTK_DEVAPC as a module

  [ Alper Nebi Yasak ]
  * [arm64] Merge and document MediaTek-related changes by Macpaul Lin:
    - Resolve conflicts with merge requests merged earlier
    - Clean up config with the help of kconfigeditor2
    - Change COMMON_CLK_MT8188, COMMON_CLK_MT8365 to be modules
  * [arm64] Enable more clock drivers for various MediaTek SoCs:
    - Enable COMMON_CLK_MT2712, COMMON_CLK_MT6779, COMMON_CLK_MT6795,
      COMMON_CLK_MT7622, COMMON_CLK_MT7986, COMMON_CLK_MT8167,
      COMMON_CLK_MT8186, COMMON_CLK_MT8192, COMMON_CLK_MT8516,
      and all their related clocks as modules
    - Enable COMMON_CLK_MT6765, COMMON_CLK_MT6797, COMMON_CLK_MT7981 as
      built-in (no module choice) and enable all their related clocks as
      modules

  [ Vincent Blut ]
  * [x86] drivers/pinctrl/intel: Enable PINCTRL_METEORLAKE and
    PINCTRL_METEORPOINT as modules (Closes: #1071551)

  [ Aurelien Jarno ]
  * [riscv64] Improve support for StarFive VisionFive 2:
    - Enable SIFIVE_CCACHE
    - Enable USB_CDNS_SUPPORT, USB_CDNS3, USB_CDNS3_STARFIVE as modules and
      enable CDNS3_GADGET and CDNS3_HOST options
    - Enable USB_GADGET as module

  [ Sebastian Andrzej Siewior ]
  * linux-image: postrm: Remove modules.weakdep on purge.

 -- Ben Hutchings <benh@debian.org>  Wed, 19 Jun 2024 15:34:34 +0200

linux (6.8.12-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.12
    - sunrpc: use the struct net as the svc proc private
    - [x86] tsc: Trust initial offset in architectural TSC-adjust MSRs
    - ftrace: Fix possible use-after-free issue in ftrace_location()
    - [arm64] Revert "arm64: fpsimd: Implement lazy restore for kernel mode
      FPSIMD"
    - [arm64] fpsimd: Avoid erroneous elide of user state reload
    - [arm64] Reapply "arm64: fpsimd: Implement lazy restore for kernel mode
      FPSIMD"
    - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016)
    - tty: n_gsm: fix missing receive state reset after mode switch
    - speakup: Fix sizeof() vs ARRAY_SIZE() bug
    - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
    - serial: 8250_bcm7271: use default_mux_rate if possible
    - serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup
    - Input: try trimming too long modalias strings
    - io_uring: fail NOP if non-zero op flags is passed in
    - Revert "r8169: don't try to disable interrupts if NAPI is, scheduled
      already"
    - r8169: Fix possible ring buffer corruption on fragmented Tx packets.
    - ring-buffer: Fix a race between readers and resize checks
    - net: mana: Fix the extra HZ in mana_hwc_send_request
    - tools/latency-collector: Fix -Wformat-security compile warns
    - tools/nolibc/stdlib: fix memory error in realloc()
    - net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe()
    - net: lan966x: remove debugfs directory in probe() error path
    - net: smc91x: Fix m68k kernel compilation for ColdFire CPU
    - nilfs2: fix use-after-free of timer for log writer thread
    - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
    - nilfs2: fix potential hang in nilfs_detach_log_writer()
    - ksmbd: avoid to send duplicate oplock break notifications
    - ksmbd: ignore trailing slashes in share paths
    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460
      G11.
    - ALSA: core: Fix NULL module pointer assignment at card init
    - ALSA: Fix deadlocks with kctl removals at disconnection
    - KEYS: asymmetric: Add missing dependency on CRYPTO_SIG
    - KEYS: asymmetric: Add missing dependencies of FIPS_SIGNATURE_SELFTEST
    - HID: nintendo: Fix N64 controller being identified as mouse
    - dmaengine: xilinx: xdma: Clarify kdoc in XDMA driver
    - wifi: mac80211: don't use rate mask for scanning
    - wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon
      timestamp field
    - wifi: cfg80211: fix the order of arguments for trace events of the
      tx_rx_evt class
    - dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node
    - HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is enabled
    - net: usb: qmi_wwan: add Telit FN920C04 compositions
    - drm/amd/display: Set color_mgmt_changed to true on unsuspend
    - drm/amdgpu: Update BO eviction priorities
    - drm/amd/pm: Restore config space after reset
    - drm/amdgpu: Fix the ring buffer size for queue VM flush
    - drm/amdgpu/mes: fix use-after-free issue
    - Revert "net: txgbe: fix i2c dev name cannot match clkdev"
    - Revert "net: txgbe: fix clk_name exceed MAX_DEV_ID limits"
    - cpu: Ignore "mitigations" kernel parameter if CPU_MITIGATIONS=n
    - [arm64,armhf] drm/etnaviv: fix tx clock gating on some GC7000 variants
    - [riscv64] thead: Rename T-Head PBMT to MAE
    - [riscv64] T-Head: Test availability bit before enabling MAE errata
    - sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU
    - [x86] ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM
      too
    - regulator: irq_helpers: duplicate IRQ name
    - ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot()
    - [x86] ASoC: SOF: ipc4-pcm: Use consistent name for snd_sof_pcm_stream
      pointer
    - [x86] ASoC: SOF: ipc4-pcm: Use consistent name for sof_ipc4_timestamp_info
      pointer
    - [x86] ASoC: SOF: ipc4-pcm: Introduce generic sof_ipc4_pcm_stream_priv
    - ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3
    - ASoC: acp: Support microphone from device Acer 315-24p
    - ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
    - ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
    - ASoC: rt722-sdca: modify channel number to support 4 channels
    - ASoC: rt722-sdca: add headset microphone vrefo setting
    - regulator: qcom-refgen: fix module autoloading
    - regulator: vqmmc-ipq4019: fix module autoloading
    - ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config
    - ASoC: rt715: add vendor clear control register
    - ASoC: rt715-sdca: volume step modification
    - Input: xpad - add support for ASUS ROG RAIKIRI
    - btrfs: take the cleaner_mutex earlier in qgroup disable
    - EDAC/versal: Do not register for NOC errors
    - fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card
    - bpf, x86: Fix PROBE_MEM runtime load check
    - ALSA: emu10k1: make E-MU FPGA writes potentially more reliable
    - softirq: Fix suspicious RCU usage in __do_softirq()
    - platform/x86: ISST: Add Grand Ridge to HPM CPU list
    - ASoC: da7219-aad: fix usage of device_get_named_child_node()
    - ASoC: cs35l56: fix usages of device_get_named_child_node()
    - ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection
    - Input: amimouse - mark driver struct with __refdata to prevent section
      mismatch
    - drm/amdgpu: Fix VRAM memory accounting
    - drm/amd/display: Ensure that dmcub support flag is set for DCN20
    - drm/amd/display: Add dtbclk access to dcn315
    - drm/amd/display: Allocate zero bw after bw alloc enable
    - drm/amd/display: Add VCO speed parameter for DCN31 FPU
    - drm/amd/display: Fix DC mode screen flickering on DCN321
    - drm/amd/display: Disable seamless boot on 128b/132b encoding
    - [x86] mm: Remove broken vsyscall emulation code from the page fault code
    - nvme: find numa distance only if controller has valid numa id
    - nvmet-auth: return the error code to the nvmet_auth_host_hash() callers
    - nvmet-auth: replace pr_debug() with pr_err() to report an error.
    - nvme: cancel pending I/O if nvme controller is in terminal state
    - nvmet-tcp: fix possible memory leak when tearing down a controller
    - nvmet: fix nvme status code when namespace is disabled
    - nvme-tcp: strict pdu pacing to avoid send stalls on TLS
    - epoll: be better about file lifetimes
    - nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
    - openpromfs: finish conversion to the new mount API
    - crypto: bcm - Fix pointer arithmetic
    - [arm64] firmware: qcom: qcm: fix unused qcom_scm_qseecom_allowlist
    - mm/slub, kunit: Use inverted data to corrupt kmem cache
    - [arm*] firmware: raspberrypi: Use correct device for DMA mappings
    - ecryptfs: Fix buffer size for tag 66 packet
    - nilfs2: fix out-of-range warning
    - crypto: ccp - drop platform ifdef checks
    - [x86] crypto: x86/nh-avx2 - add missing vzeroupper
    - [x86] crypto: x86/sha256-avx2 - add missing vzeroupper
    - [x86] crypto: x86/sha512-avx2 - add missing vzeroupper
    - [s390x] cio: fix tracepoint subchannel type field
    - io_uring: use the right type for work_llist empty check
    - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
    - rcu: Fix buffer overflow in print_cpu_stall_info()
    - jffs2: prevent xattr node from overflowing the eraseblock
    - libfs: Re-arrange locking in offset_iterate_dir()
    - libfs: Define a minimum directory offset
    - libfs: Add simple_offset_empty()
    - maple_tree: Add mtree_alloc_cyclic()
    - libfs: Convert simple directory offsets to use a Maple Tree
    - libfs: Fix simple_offset_rename_exchange()
    - libfs: Add simple_offset_rename() API
    - shmem: Fix shmem_rename2()
    - io-wq: write next_work before dropping acct_lock
    - mm/userfaultfd: Do not place zeropages when zeropages are disallowed
    - [s390x] mm: Re-enable the shared zeropage for !PV and !skeys KVM guests
    - [x86] crypto: qat - improve error message in adf_get_arbiter_mapping()
    - [x86] crypto: qat - improve error logging to be consistent across features
    - [arm64] soc: qcom: pmic_glink: don't traverse clients list without a lock
    - [arm64] soc: qcom: pmic_glink: notify clients about the current state
    - [arm64] firmware: qcom: scm: Fix __scm and waitq completion variable
      initialization
    - null_blk: Fix missing mutex_destroy() at module removal
    - crypto: qat - validate slices count returned by FW
    - [armhf] hwrng: stm32 - use logical OR in conditional
    - [armhf] hwrng: stm32 - put IP into RPM suspend on failure
    - [armhf] hwrng: stm32 - repair clock handling
    - io_uring/net: remove dependency on REQ_F_PARTIAL_IO for sr->done_io
    - io_uring/net: fix sendzc lazy wake polling
    - [arm64] soc: qcom: pmic_glink: Make client-lock non-sleeping
    - md: fix resync softlockup when bitmap size is less than array size
    - [x86] crypto: qat - specify firmware files for 402xx
    - block: refine the EOF check in blkdev_iomap_begin
    - block: fix and simplify blkdevparts= cmdline parsing
    - block: support to account io_ticks precisely
    - wifi: ath10k: poll service ready message before failing
    - wifi: brcmfmac: pcie: handle randbuf allocation failure
    - wifi: ath11k: don't force enable power save on non-running vdevs
    - bpftool: Fix missing pids during link show
    - libbpf: Prevent null-pointer dereference when prog to load has no BTF
    - wifi: ath12k: use correct flag field for 320 MHz channels
    - wifi: mt76: mt7915: workaround too long expansion sparse warnings
    - [x86] boot: Ignore relocations in .notes sections in walk_relocs() too
    - wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok()
    - wifi: iwlwifi: mvm: Do not warn on invalid link on scan complete
    - wifi: iwlwifi: mvm: allocate STA links only for active links
    - wifi: mac80211: don't select link ID if not provided in scan request
    - wifi: iwlwifi: implement can_activate_links callback
    - wifi: iwlwifi: mvm: fix active link counting during recovery
    - wifi: iwlwifi: mvm: select STA mask only for active links
    - wifi: iwlwifi: reconfigure TLC during HW restart
    - wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask
    - sched/fair: Add EAS checks before updating root_domain::overutilized
    - ACPI: bus: Indicate support for _TFP thru _OSC
    - ACPI: bus: Indicate support for more than 16 p-states thru _OSC
    - ACPI: bus: Indicate support for the Generic Event Device thru _OSC
    - ACPI: Fix Generic Initiator Affinity _OSC bit
    - ACPI: bus: Indicate support for IRQ ResourceSource thru _OSC
    - enetc: avoid truncating error message
    - qed: avoid truncating work queue length
    - mlx5: avoid truncating error message
    - mlx5: stop warning for 64KB pages
    - bitops: add missing prototype check
    - dlm: fix user space lock decision to copy lvb
    - wifi: carl9170: re-fix fortified-memset warning
    - bpftool: Mount bpffs on provided dir instead of parent dir
    - bpf: Pack struct bpf_fib_lookup
    - bpf: prevent r10 register from being marked as precise
    - [x86] microcode/AMD: Avoid -Wformat warning with clang-15
    - ACPI: LPSS: Advertise number of chip selects via property
    - EDAC/skx_common: Allow decoding of SGX addresses
    - [x86] locking/atomic/x86: Correct the definition of
      __arch_try_cmpxchg128()
    - irqchip/alpine-msi: Fix off-by-one in allocation error path
    - irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
    - ACPI: disable -Wstringop-truncation
    - gfs2: Don't forget to complete delayed withdraw
    - gfs2: Fix "ignore unlock failures after withdraw"
    - [arm64] Remove unnecessary irqflags alternative.h include
    - [x86] boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57
    - tcp: increase the default TCP scaling ratio
    - cpufreq: exit() callback is optional
    - [x86] pat: Introduce lookup_address_in_pgd_attr()
    - [x86] pat: Restructure _lookup_address_cpa()
    - [x86] pat: Fix W^X violation false-positives when running as Xen PV guest
    - udp: Avoid call to compute_score on multiple sites
    - cppc_cpufreq: Fix possible null pointer dereference
    - wifi: iwlwifi: mvm: init vif works only once
    - scsi: libsas: Fix the failure of adding phy with zero-address to port
    - scsi: hpsa: Fix allocation size for Scsi_Host private data
    - [x86] purgatory: Switch to the position-independent small code model
    - wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
    - thermal/drivers/tsens: Fix null pointer dereference
    - dt-bindings: thermal: loongson,ls2k-thermal: Add Loongson-2K0500
      compatible
    - dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible
      definition
    - wifi: ath10k: Fix an error code problem in
      ath10k_dbg_sta_write_peer_debug_trigger()
    - gfs2: Remove ill-placed consistency check
    - gfs2: Fix potential glock use-after-free on unmount
    - gfs2: finish_xmote cleanup
    - gfs2: do_xmote fixes
    - thermal/debugfs: Avoid excessive updates of trip point statistics
    - scsi: ufs: core: mcq: Fix ufshcd_mcq_sqe_search()
    - cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations
    - wifi: ath10k: populate board data for WCN3990
    - [arm64,armhf] net: dsa: mv88e6xxx: Add support for model-specific pre- and
      post-reset handlers
    - [arm64,armhf] net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on
      88E6250-family switches
    - tcp: avoid premature drops in tcp_add_backlog()
    - thermal/debugfs: Create records for cdev states as they get used
    - thermal/debugfs: Pass cooling device state to thermal_debug_cdev_add()
    - pwm: sti: Prepare removing pwm_chip from driver data
    - pwm: sti: Simplify probe function using devm functions
    - drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
    - drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
    - drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
    - net: give more chances to rcu in netdev_wait_allrefs_any()
    - macintosh/via-macii: Fix "BUG: sleeping function called from invalid
      context"
    - wifi: carl9170: add a proper sanity check for endpoints
    - bpf: Fix verifier assumptions about socket->sk
    - wifi: ar5523: enable proper endpoint verification
    - pwm: Drop useless member .of_pwm_n_cells of struct pwm_chip
    - pwm: Let the of_xlate callbacks accept references without period
    - pwm: Drop duplicate check against chip->npwm in of_pwm_xlate_with_flags()
    - pwm: Reorder symbols in core.c
    - pwm: Provide an inline function to get the parent device of a given chip
    - pwm: meson: Change prototype of a few helpers to prepare further changes
    - pwm: meson: Make use of pwmchip_parent() accessor
    - pwm: meson: Add check for error from clk_round_rate()
    - pwm: meson: Use mul_u64_u64_div_u64() for frequency calculating
    - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in
      BPF_LINK_CREATE
    - sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
    - Revert "sh: Handle calling csum_partial with misaligned data"
    - wifi: mt76: mt7603: fix tx queue of loopback packets
    - wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset
    - wifi: mt76: mt7996: fix size of txpower MCU command
    - wifi: mt76: mt7925: ensure 4-byte alignment for suspend & wow command
    - wifi: mt76: mt7996: fix uninitialized variable in mt7996_irq_tasklet()
    - wifi: mt76: mt7996: fix potential memory leakage when reading chip
      temperature
    - libbpf: Fix error message in attach_kprobe_multi
    - wifi: nl80211: Avoid address calculations via out of bounds array indexing
    - wifi: rtw89: wow: refine WoWLAN flows of HCI interrupts and low power mode
    - [x86] HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
    - scsi: bfa: Ensure the copied buf is NUL terminated
    - scsi: qedf: Ensure the copied buf is NUL terminated
    - scsi: qla2xxx: Fix debugfs output for fw_resource_count
    - gpio: nuvoton: Fix sgpio irq handle error
    - [x86] numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks()
    - wifi: mwl8k: initialize cmd->addr[] properly
    - HID: amd_sfh: Handle "no sensors" in PM operations
    - usb: aqc111: stop lying about skb->truesize
    - net: usb: sr9700: stop lying about skb->truesize
    - dm-delay: fix workqueue delay_timer race
    - dm-delay: fix hung task introduced by kthread mode
    - dm-delay: fix max_delay calculations
    - ptp: ocp: fix DPLL functions
    - net: ipv6: fix wrong start position when receive hop-by-hop fragment
    - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
    - net: ethernet: mediatek: split tx and rx fields in mtk_soc_data struct
    - net: ethernet: mediatek: use ADMAv1 instead of ADMAv2.0 on MT7981 and
      MT7986
    - ice: Fix package download algorithm
    - net: ethernet: cortina: Locking fixes
    - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
    - net: usb: smsc95xx: stop lying about skb->truesize
    - net: openvswitch: fix overwriting ct original tuple for ICMPv6
    - ipv6: sr: add missing seg6_local_exit
    - ipv6: sr: fix incorrect unregister order
    - ipv6: sr: fix invalid unregister error path
    - net/mlx5: Fix peer devlink set for SF representor devlink port
    - net/mlx5: Reload only IB representors upon lag disable/enable
    - net/mlx5: Add a timeout to acquire the command queue semaphore
    - net/mlx5: Discard command completions in internal error
    - [s390x] bpf: Emit a barrier for BPF_FETCH instructions
    - [riscv64] bpf: make some atomic operations fully ordered
    - ax25: Use kernel universal linked list to implement ax25_dev_list
    - ax25: Fix reference count leak issues of ax25_dev
    - ax25: Fix reference count leak issue of net_device
    - dpll: fix return value check for kmemdup
    - net: fec: remove .ndo_poll_controller to avoid deadlocks
    - mptcp: SO_KEEPALIVE: fix getsockopt support
    - mptcp: cleanup writer wake-up
    - mptcp: avoid some duplicate code in socket option handling
    - mptcp: implement TCP_NOTSENT_LOWAT support
    - mptcp: cleanup SOL_TCP handling
    - mptcp: fix full TCP keep-alive support
    - net: stmmac: Offload queueMaxSDU from tc-taprio
    - net: stmmac: est: Per Tx-queue error count for HLBF
    - net: stmmac: Report taprio offload status
    - net: stmmac: move the EST lock to struct stmmac_priv
    - net: micrel: Fix receiving the timestamp in the frame for lan8841
    - Bluetooth: compute LE flow credits based on recvbuf space
    - Bluetooth: qca: Fix error code in qca_read_fw_build_info()
    - Bluetooth: ISO: Add hcon for listening bis sk
    - Bluetooth: ISO: Clean up returns values in iso_connect_ind()
    - Bluetooth: ISO: Make iso_get_sock_listen generic
    - Bluetooth: Remove usage of the deprecated ida_simple_xx() API
    - Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS
    - Bluetooth: HCI: Remove HCI_AMP support
    - ice: make ice_vsi_cfg_rxq() static
    - ice: make ice_vsi_cfg_txq() static
    - overflow: Change DEFINE_FLEX to take __counted_by member
    - Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae
      warnings
    - Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1
    - drm/bridge: Fix improper bridge init order with pre_enable_prev_first
    - drm/ci: update device type for volteer devices
    - drm/nouveau/dp: Fix incorrect return code in r535_dp_aux_xfer()
    - drm/omapdrm: Fix console by implementing fb_dirty
    - drm/omapdrm: Fix console with deferred ops
    - printk: Let no_printk() use _printk()
    - dev_printk: Add and use dev_no_printk()
    - drm/lcdif: Do not disable clocks on already suspended hardware
    - drm/dp: Don't attempt AUX transfers when eDP panels are not powered
    - drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't
      assert
    - drm/amd/display: Fix potential index out of bounds in color transformation
      function
    - drm/amd/display: Remove redundant condition in dcn35_calc_blocks_to_gate()
    - [x86] ASoC: Intel: Disable route checks for Skylake boards
    - [x86] ASoC: Intel: avs: ssm4567: Do not ignore route checks
    - mtd: core: Report error if first mtd_otp_size() call fails in
      mtd_otp_nvmem_add()
    - mtd: rawnand: hynix: fixed typo
    - drm/imagination: avoid -Woverflow warning
    - drm/panel: ltk050h3146w: add MIPI_DSI_MODE_VIDEO to LTK050H3148W flags
    - drm/panel: ltk050h3146w: drop duplicate commands from LTK050H3148W init
    - fbdev: shmobile: fix snprintf truncation
    - ASoC: kirkwood: Fix potential NULL dereference
    - drm/meson: vclk: fix calculation of 59.94 fractional rates
    - drm/mediatek: Add 0 size check to mtk_drm_gem_obj
    - drm/mediatek: Init `ddp_comp` with devm_kcalloc()
    - [x86] ASoC: SOF: Intel: hda-dai: fix channel map configuration for
      aggregated dailink
    - [powerpc*] fsl-soc: hide unused const variable
    - [x86] ASoC: SOF: Intel: mtl: Correct rom_status_reg
    - [x86] ASoC: SOF: Intel: lnl: Correct rom_status_reg
    - [x86] ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed
    - [x86] ASoC: SOF: Intel: mtl: Implement firmware boot state check
    - fbdev: sisfb: hide unused variables
    - [x86] ASoC: Intel: avs: Restore stream decoupling on prepare
    - [x86] ASoC: Intel: avs: Fix ASRC module initialization
    - [x86] ASoC: Intel: avs: Fix potential integer overflow
    - [x86] ASoC: Intel: avs: Test result of avs_get_module_entry()
    - media: ngene: Add dvb_ca_en50221_init return value check
    - staging: media: starfive: Remove links when unregistering devices
    - media: rcar-vin: work around -Wenum-compare-conditional warning
    - media: radio-shark2: Avoid led_names truncations
    - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
    - platform/x86: xiaomi-wmi: Fix race condition when reporting key events
    - drm/msm/dp: allow voltage swing / pre emphasis of 3
    - drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected
    - media: ipu3-cio2: Request IRQ earlier
    - media: dt-bindings: ovti,ov2680: Fix the power supply names
    - media: i2c: et8ek8: Don't strip remove function when driver is builtin
    - media: v4l2-subdev: Fix stream handling for crop API
    - fbdev: sh7760fb: allow modular build
    - media: atomisp: ssh_css: Fix a null-pointer dereference in
      load_video_binaries
    - drm/arm/malidp: fix a possible null pointer dereference (CVE-2024-36014)
    - drm: vc4: Fix possible null pointer dereference
    - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
    - drm/bridge: anx7625: Don't log an error when DSI host can't be found
    - drm/bridge: icn6211: Don't log an error when DSI host can't be found
    - drm/bridge: lt8912b: Don't log an error when DSI host can't be found
    - drm/bridge: lt9611: Don't log an error when DSI host can't be found
    - drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found
    - drm/bridge: tc358775: Don't log an error when DSI host can't be found
    - drm/bridge: dpc3433: Don't log an error when DSI host can't be found
    - drm/panel: novatek-nt35950: Don't log an error when DSI host can't be
      found
    - drm/bridge: anx7625: Update audio status while detecting
    - drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
    - ALSA: hda: cs35l41: Remove Speaker ID for Lenovo Legion slim 7 16ARHA7
    - drm/mipi-dsi: use correct return type for the DSC functions
    - media: uvcvideo: Add quirk for Logitech Rally Bar
    - drm/rockchip: vop2: Do not divide height twice for YUV
    - drm/edid: Parse topology block for all DispID structure v1.x
    - media: cadence: csi2rx: configure DPHY before starting source stream
    - clk: samsung: exynosautov9: fix wrong pll clock id value
    - RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent
    - RDMA/mlx5: Change check for cacheable mkeys
    - RDMA/mlx5: Adding remote atomic access flag to updatable flags
    - clk: mediatek: pllfh: Don't log error for missing fhctl node
    - iommu: Undo pasid attachment only for the devices that have succeeded
    - [arm64] RDMA/hns: Fix return value in hns_roce_map_mr_sg
    - [arm64] RDMA/hns: Fix deadlock on SRQ async events.
    - [arm64] RDMA/hns: Fix UAF for cq async event
    - [arm64] RDMA/hns: Fix GMV table pagesize
    - [arm64] RDMA/hns: Use complete parentheses in macros
    - [arm64] RDMA/hns: Modify the print level of CQE error
    - clk: mediatek: mt8365-mm: fix DPI0 parent
    - clk: rs9: fix wrong default value for clock amplitude
    - clk: qcom: clk-alpha-pll: remove invalid Stromer register offset
    - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
    - RDMA/rxe: Allow good work requests to be executed
    - RDMA/rxe: Fix incorrect rxe_put in error path
    - IB/mlx5: Use __iowrite64_copy() for write combining stores
    - clk: renesas: r8a779a0: Fix CANFD parent clock
    - clk: renesas: r9a07g043: Add clock and reset entry for PLIC
    - lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
    - mm/ksm: fix ksm exec support for prctl
    - clk: qcom: dispcc-sm8450: fix DisplayPort clocks
    - clk: qcom: dispcc-sm6350: fix DisplayPort clocks
    - clk: qcom: dispcc-sm8550: fix DisplayPort clocks
    - clk: qcom: dispcc-sm8650: fix DisplayPort clocks
    - clk: qcom: mmcc-msm8998: fix venus clock issue
    - [x86] insn: Fix PUSH instruction in x86 instruction decoder opcode map
    - [x86] insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and
      VPDPWSSDS
    - ext4: avoid excessive credit estimate in ext4_tmpfile()
    - RDMA/mana_ib: Introduce helpers to create and destroy mana queues
    - RDMA/mana_ib: Use struct mana_ib_queue for CQs
    - RDMA/mana_ib: boundary check before installing cq callbacks
    - virt: acrn: stop using follow_pfn
    - drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
    - sunrpc: removed redundant procp check
    - nfsd: don't create nfsv4recoverydir in nfsdfs when not used.
    - ext4: fix potential unnitialized variable
    - ext4: remove the redundant folio_wait_stable()
    - clk: qcom: Fix SC_CAMCC_8280XP dependencies
    - clk: qcom: Fix SM_GPUCC_8650 dependencies
    - clk: qcom: apss-ipq-pll: fix PLL rate for IPQ5018
    - of: module: add buffer overflow check in of_modalias()
    - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
    - SUNRPC: Fix gss_free_in_token_pages()
    - RDMA/IPoIB: Fix format truncation compilation errors
    - RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use
      siw
    - tracing/user_events: Prepare find/delete for same name events
    - tracing/user_events: Fix non-spaced field matching
    - modules: Drop the .export_symbol section from the final modules
    - net: bridge: xmit: make sure we have at least eth header len bytes
    - net: bridge: mst: fix vlan use-after-free
    - net: qrtr: ns: Fix module refcnt
    - idpf: don't skip over ethtool tcp-data-split setting
    - netrom: fix possible dead-lock in nr_rt_ioctl()
    - af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
    - sched/fair: Allow disabling sched_balance_newidle with
      sched_relax_domain_level
    - sched/core: Fix incorrect initialization of the 'burst' parameter in
      cpu_max_write()
    - net: wangxun: fix to change Rx features
    - net: wangxun: match VLAN CTAG and STAG features
    - net: txgbe: move interrupt codes to a separate file
    - net: txgbe: use irq_domain for interrupt controller
    - net: txgbe: fix to control VLAN strip
    - l2tp: fix ICMP error handling for UDP-encap sockets
    - io_uring/net: ensure async prep handlers always initialize ->done_io
    - pwm: Fix setting period with #pwm-cells = <1> and of_pwm_single_xlate()
    - net: txgbe: fix to clear interrupt status after handling IRQ
    - net: txgbe: fix GPIO interrupt blocking

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 31 May 2024 20:24:01 +0200

linux (6.8.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.10
    - wifi: nl80211: don't free NULL coalescing rule
    - [armhf] pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of
      GPIOR-T
    - [arm64] pinctrl/meson: fix typo in PDM's pin name
    - pinctrl: core: delete incorrect free in pinctrl_enable()
    - [arm64] pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE
      readback
    - [arm64] pinctrl: mediatek: paris: Rework support for
      PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
    - sunrpc: add a struct rpc_stats arg to rpc_create_args
    - nfs: expose /proc/net/sunrpc/nfs in net namespaces
    - nfs: make the rpc_stat per net namespace
    - nfs: Handle error of rpc_proc_register() in nfs_net_init().
    - [x86] pinctrl: baytrail: Fix selecting gpio pinctrl state
    - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
    - nfsd: rename NFSD_NET_* to NFSD_STATS_*
    - nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
    - nfsd: make all of the nfsd stats per-network namespace
    - NFSD: add support for CB_GETATTR callback
    - NFSD: Fix nfsd4_encode_fattr4() crasher
    - regulator: change stubbed devm_regulator_get_enable to return Ok
    - regulator: change devm_regulator_get_enable_optional() stub to return Ok
    - bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
    - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
    - regmap: Add regmap_read_bypassed()
    - [x86] ASoC: SOF: Intel: add default firmware library path for LNL
    - nvme: fix warn output about shared namespaces without
      CONFIG_NVME_MULTIPATH
    - bpf: Fix a verifier verbose message
    - spi: axi-spi-engine: use common AXI macros
    - spi: axi-spi-engine: fix version format string
    - spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
    - bpf, arm64: Fix incorrect runtime stats
    - [riscv64] bpf: Fix incorrect runtime stats
    - [x86] ASoC: Intel: avs: Set name of control as in topology
    - [s390x] mm: Fix storage key clearing for guest huge pages
    - [s390x] mm: Fix clearing storage keys for huge pages
    - [armel,armhf] bpf: Reimplement sign-extension mov instruction
    - xdp: use flags field to disambiguate broadcast redirect
    - efi/unaccepted: touch soft lockup during memory accept
    - ice: ensure the copied buf is NUL terminated
    - bna: ensure the copied buf is NUL terminated
    - thermal/debugfs: Free all thermal zone debug memory on zone removal
    - thermal/debugfs: Fix two locking issues with thermal zone debug
    - nsh: Restore skb->{protocol,data,mac_header} for outer header in
      nsh_gso_segment().
    - net l2tp: drop flow hash on forward
    - thermal/debugfs: Prevent use-after-free from occurring after cdev removal
    - [s390x] vdso: Add CFI for RA register to asm macro vdso_func
    - Fix a potential infinite loop in extract_user_to_sg()
    - ALSA: emu10k1: fix E-MU card dock presence monitoring
    - ALSA: emu10k1: factor out snd_emu1010_load_dock_firmware()
    - ALSA: emu10k1: move the whole GPIO event handling to the workqueue
    - ALSA: emu10k1: fix E-MU dock initialization
    - net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
    - net: qede: use return from qede_parse_flow_attr() for flower
    - net: qede: use return from qede_parse_flow_attr() for flow_spec
    - net: qede: use return from qede_parse_actions()
    - vxlan: Fix racy device stats updates.
    - vxlan: Add missing VNI filter counter update in arp_reduce().
    - [arm64] ASoC: meson: axg-fifo: use FIELD helpers
    - [arm64] ASoC: meson: axg-fifo: use threaded irq to check periods
    - [arm64] ASoC: meson: axg-card: make links nonatomic
    - [arm64] ASoC: meson: axg-tdm-interface: manage formatters in trigger
    - [qrm64] ASoC: meson: cards: select SND_DYNAMIC_MINORS
    - ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
    - [s390x] cio: Ensure the copied buf is NUL terminated
    - cxgb4: Properly lock TX queue for the selftest.
    - net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
    - drm/amdgpu: fix doorbell regression
    - spi: fix null pointer dereference within spi_sync
    - net: bridge: fix multicast-to-unicast with fraglist GSO
    - net: core: reject skb_copy(_expand) for fraglist GSO skbs
    - rxrpc: Clients must accept conn from any address
    - vxlan: Pull inner IP header in vxlan_rcv().
    - [s390x] qeth: Fix kernel panic after setting hsuid
    - ipv4: Fix uninit-value access in __ip_make_skb()
    - net: gro: fix udp bad offset in socket lookup by adding
      {inner_}network_offset to napi_gro_cb
    - net: gro: add flush check in udp_gro_receive_segment
    - drm/xe/display: Fix ADL-N detection
    - [arm64] clk: qcom: smd-rpm: Restore msm8976 num_clk
    - [arm64] clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
    - [powerpc*] pseries: make max polling consistent for longer H_CALLs
    - [powerpc*] pseries/iommu: LPAR panics during boot up with a frozen PE
    - EDAC/versal: Do not log total error counts
    - swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
    - [arm64] KVM: arm64: vgic-v2: Check for non-NULL vCPU in
      vgic_v2_parse_attr()
    - exfat: fix timing of synchronizing bitmap and inode
    - firmware: microchip: don't unconditionally print validation success
    - scsi: ufs: core: Fix MCQ MAC configuration
    - scsi: lpfc: Move NPIV's transport unregistration to after resource clean
      up
    - scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling
    - scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
    - scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
    - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
    - scsi: lpfc: Use a dedicated lock for ras_fwlog state
    - gfs2: Fix invalid metadata access in punch_hole
    - fs/9p: fix uninitialized values during inode evict
    - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
    - wifi: cfg80211: fix rdev_dump_mpp() arguments order
    - wifi: mac80211: fix prep_connection error path
    - wifi: iwlwifi: read txq->read_ptr under lock
    - wifi: iwlwifi: mvm: guard against invalid STA ID on removal
    - net: mark racy access on sk->sk_rcvbuf
    - drm/xe: Fix END redefinition
    - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
    - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
    - btrfs: return accurate error code on open failure in open_fs_devices()
    - bpf: Check bloom filter map value size
    - kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
    - [x86] ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of
      S3 suspend
    - regulator: tps65132: Add of_match table
    - scsi: ufs: core: WLUN suspend dev/link state error recovery
    - scsi: libsas: Align SMP request allocation to ARCH_DMA_MINALIGN
    - scsi: ufs: core: Fix MCQ mode dev command timeout
    - ALSA: line6: Zero-initialize message buffers
    - block: fix overflow in blk_ioctl_discard()
    - [x86] ASoC: codecs: ES8326: Solve error interruption issue
    - [x86] ASoC: codecs: ES8326: modify clock table
    - net: bcmgenet: Reset RBUF on first open
    - [x86] vboxsf: explicitly deny setlease attempts
    - ata: sata_gemini: Check clk_enable() result
    - firewire: ohci: mask bus reset interrupts between ISR and bottom half
    - [x86] tools/power turbostat: Fix added raw MSR output
    - [x86] tools/power turbostat: Increase the limit for fd opened
    - [x86] tools/power turbostat: Fix Bzy_MHz documentation typo
    - [x86] tools/power turbostat: Do not print negative LPI residency
    - [x86] tools/power turbostat: Expand probe_intel_uncore_frequency()
    - [x86] tools/power turbostat: Print ucode revision only if valid
    - [x86] tools/power turbostat: Fix warning upon failed /dev/cpu_dma_latency
      read
    - btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
    - btrfs: always clear PERTRANS metadata during commit
    - memblock tests: fix undefined reference to `early_pfn_to_nid'
    - memblock tests: fix undefined reference to `panic'
    - memblock tests: fix undefined reference to `BIT'
    - nouveau/gsp: Avoid addressing beyond end of rpc->entries
    - scsi: target: Fix SELinux error when systemd-modules loads the target
      module
    - scsi: hisi_sas: Handle the NCQ error returned by D2H frame
    - blk-iocost: avoid out of bounds shift
    - [x86] platform/x86: acer-wmi: Add support for Acer PH18-71
    - [arm64,armhf] gpu: host1x: Do not setup DMA for virtual devices
    - [mips64el] scall: Save thread_info.syscall unconditionally on entry
      (Closes: #1068365)
    - [x86] tools/power/turbostat: Fix uncore frequency file string
    - net: add copy_safe_from_sockptr() helper
    - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
    - drm/amdgpu: Refine IB schedule error logging
    - drm/amd/display: add DCN 351 version for microcode load
    - drm/amdgpu: add smu 14.0.1 discovery support
    - drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2
    - drm/amd/display: Skip on writeback when it's not applicable
    - drm/amd/pm: fix the high voltage issue after unload
    - drm/amdgpu: Fix VCN allocation in CPX partition
    - Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
    - Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
    - hv_netvsc: Don't free decrypted memory
    - [x86] uio_hv_generic: Don't free decrypted memory
    - Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
    - drm/xe/xe_migrate: Cast to output precision before multiplying operands
    - drm/xe: Label RING_CONTEXT_CONTROL as masked
    - smb3: fix broken reconnect when password changing on the server by
      allowing password rotation
    - [arm64] iommu: mtk: fix module autoloading
    - fs/9p: only translate RWX permissions for plain 9P2000
    - fs/9p: translate O_TRUNC into OTRUNC
    - fs/9p: fix the cache always being enabled on files with qid flags
    - 9p: explicitly deny setlease attempts
    - [powerpc*] crypto/chacha-p10: Fix failure on non Power10
    - gpio: wcove: Use -ENOTSUPP consistently
    - gpio: crystalcove: Use -ENOTSUPP consistently
    - clk: Don't hold prepare_lock when calling kref_put()
    - fs/9p: remove erroneous nlink init from legacy stat2inode
    - fs/9p: drop inodes immediately on non-.L too
    - gpio: lpc32xx: fix module autoloading
    - drm/nouveau/dp: Don't probe eDP ports twice harder
    - [x86] platform/x86/amd: pmf: Decrease error message to debug
    - [x86] platform/x86: ISST: Add Granite Rapids-D to HPM CPU list
    - drm/radeon: silence UBSAN warning (v3)
    - net:usb:qmi_wwan: support Rolling modules
    - blk-iocost: do not WARN if iocg was already offlined
    - SUNRPC: add a missing rpc_stat for TCP TLS
    - qibfs: fix dentry leak
    - xfrm: Preserve vlan tags for transport mode software GRO
    - [armel,armhf] 9381/1: kasan: clear stale stack poison
    - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
    - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
    - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
      (CVE-2024-27398)
    - Bluetooth: msft: fix slab-use-after-free in msft_do_close()
    - [arm64] dts: mediatek: mt8183-pico6: Fix bluetooth node
    - Bluetooth: HCI: Fix potential null-ptr-deref
    - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
      (CVE-2024-27399)
    - net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
    - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
    - [x86] hwmon: (corsair-cpro) Use a separate buffer for sending commands
    - [x86] hwmon: (corsair-cpro) Use complete_all() instead of complete() in
      ccp_raw_event()
    - [x86] hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
    - phonet: fix rtm_phonet_notify() skb allocation
    - netlink: specs: Add missing bridge linkinfo attrs
    - nfc: nci: Fix kcov check in nci_rx_work()
    - net: bridge: fix corrupted ethernet header on multicast-to-unicast
    - ipv6: Fix potential uninit-value access in __ip6_make_skb()
    - rxrpc: Fix the names of the fields in the ACK trailer struct
    - rxrpc: Fix congestion control algorithm
    - rxrpc: Only transmit one ACK per jumbo packet received
    - dt-bindings: net: mediatek: remove wrongly added clocks and SerDes
    - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
    - net-sysfs: convert dev->operstate reads to lockless ones
    - hsr: Simplify code for announcing HSR nodes timer setup
    - ipv6: annotate data-races around cnf.disable_ipv6
    - ipv6: prevent NULL dereference in ip6_output()
    - net/smc: fix neighbour and rtable leak in smc_ib_find_route()
    - [arm64] net: hns3: using user configure after hardware reset
    - [arm64] net: hns3: direct return when receive a unknown mailbox message
    - [arm64] net: hns3: change type of numa_node_mask as nodemask_t
    - [arm64] net: hns3: release PTP resources if pf initialization failed
    - [arm64] net: hns3: use appropriate barrier function after setting a bit
      value
    - [arm64] net: hns3: fix port vlan filter not disabled issue
    - [arm64] net: hns3: fix kernel crash when devlink reload during
      initialization
    - [arm64,armhf] net: dsa: mv88e6xxx: add phylink_get_caps for the
      mv88e6320/21 family
    - [arm64] drm/meson: dw-hdmi: power up phy on device init
    - [arm64] drm/meson: dw-hdmi: add bandgap setting for g12
    - drm/connector: Add \n to message about demoting connector force-probes
    - dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11
      users
    - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
    - gpiolib: cdev: fix uninitialised kfifo
    - drm/amd/display: Atom Integrated System Info v2_2 for DCN35
    - drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible (Closes: #1071263)
    - drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
    - firewire: nosy: ensure user_length is taken into account when fetching
      packet contents (CVE-2024-27401)
    - Reapply "drm/qxl: simplify qxl_fence_wait"
    - usb: typec: ucsi: Check for notifications after init
    - usb: typec: ucsi: Fix connector check on init
    - usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed
      device
    - usb: ohci: Prevent missed ohci interrupts
    - USB: core: Fix access violation during port device removal
    - usb: gadget: composite: fix OS descriptors w_value logic
    - usb: gadget: uvc: use correct buffer size when parsing configfs lists
    - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
    - usb: gadget: f_fs: Fix a race condition when processing setup packets.
    - usb: xhci-plat: Don't include xhci.h
    - usb: dwc3: core: Prevent phy suspend during init
    - usb: typec: tcpm: clear pd_event queue in PORT_RESET
    - usb: typec: tcpm: unregister existing source caps before re-registration
    - usb: typec: tcpm: Check for port partner validity before consuming it
    - ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
    - ALSA: hda/realtek: Fix conflicting PCI SSID 17aa:386f for Lenovo Legion
      models
    - firewire: ohci: fulfill timestamp for some local asynchronous transaction
    - mm/slub: avoid zeroing outside-object freepointer for single free
    - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
    - btrfs: set correct ram_bytes when splitting ordered extent
    - btrfs: qgroup: do not check qgroup inherit if qgroup is disabled
    - btrfs: make sure that WRITTEN is set on all metadata blocks
      (CVE-2024-35949)
    - maple_tree: fix mas_empty_area_rev() null pointer dereference
    - mm/slab: make __free(kfree) accept error pointers
    - mptcp: ensure snd_nxt is properly initialized on connect
    - mptcp: only allow set existing scheduler for net.mptcp.scheduler
    - workqueue: Fix selection of wake_cpu in kick_pool()
    - dt-bindings: iio: health: maxim,max30102: fix compatible check
    - iio:imu: adis16475: Fix sync mode setting
    - iio: pressure: Fixes BME280 SPI driver data
    - iio: pressure: Fixes SPI support for BMP3xx devices
    - iio: accel: mxc4005: Interrupt handling fixes
    - iio: accel: mxc4005: Reset chip on probe() and resume()
    - e1000e: change usleep_range to udelay in PHY mdic access
    - net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
    - net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
    - net: bcmgenet: synchronize UMAC_CMD access
    - [armhf] ASoC: ti: davinci-mcasp: Fix race condition during probe
    - dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)
    - [armhf] clk: samsung: Revert "clk: Use device_get_match_data()"
    - clk: sunxi-ng: common: Support minimum and maximum rate
    - clk: sunxi-ng: a64: Set minimum and maximum rate for PLL-MIPI
    - mei: me: add lunar lake point M DID
    - drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()
    - Revert "drm/nouveau/firmware: Fix SG_DEBUG error with
      nvkm_firmware_ctor()"
    - drm/ttm: Print the memory decryption status just once
    - drm/vmwgfx: Fix Legacy Display Unit
    - drm/vmwgfx: Fix invalid reads in fence signaled events
    - drm/imagination: Ensure PVR_MIPS_PT_PAGE_COUNT is never zero
    - drm/amd/display: Fix idle optimization checks for multi-display and dual
      eDP
    - drm/nouveau/gsp: Use the sg allocator for level 2 of radix3
    - [x86] drm/i915/audio: Fix audio time stamp programming for DP
    - [x86] drm/i915/gt: Automate CCS Mode setting during engine resets
    - [x86] drm/i915/bios: Fix parsing backlight BDB data
    - drm/amd/display: Handle Y carry-over in VCP X.Y calculation
    - drm/amd/display: Fix incorrect DSC instance for MST
    - [arm64] dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration
    - [arm64] iommu/arm-smmu: Use the correct type in
      nvidia_smmu_context_fault()
    - net: fix out-of-bounds access in ops_init
    - hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
    - misc/pvpanic-pci: register attributes via pci_driver
    - [x86] apic: Don't access the APIC when disabling x2APIC
    - mm: use memalloc_nofs_save() in page_cache_ra_order()
    - mm/userfaultfd: reset ptes when close() for wr-protected ones
    - [amd64] iommu/amd: Enhance def_domain_type to handle untrusted device
    - fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan
    - fs/proc/task_mmu: fix uffd-wp confusion in pagemap_scan_pmd_entry()
    - nvme-pci: Add quirk for broken MSIs
    - regulator: core: fix debugfs creation regression
    - spi: microchip-core-qspi: fix setting spi bus clock rate
    - ksmbd: off ipv6only for both ipv4/ipv6 binding
    - ksmbd: avoid to send duplicate lease break notifications
    - ksmbd: do not grant v2 lease if parent lease key and epoch are not set
    - tracefs: Reset permissions on remount if permissions are options
    - tracefs: Still use mount point as default permissions for instances
    - eventfs: Do not treat events directory different than other directories
    - Bluetooth: qca: fix invalid device address check
    - Bluetooth: qca: fix wcn3991 device address check
    - Bluetooth: qca: add missing firmware sanity checks
    - Bluetooth: qca: fix NVM configuration parsing
    - Bluetooth: qca: generalise device address check
    - Bluetooth: qca: fix info leak when fetching board id
    - Bluetooth: qca: fix info leak when fetching fw build id
    - Bluetooth: qca: fix firmware check error path
    - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (CVE-2024-21823)
    - dmaengine: idxd: add a new security check to deal with a hardware erratum
      (CVE-2024-21823)
    - dmaengine: idxd: add a write() method for applications to submit work
      (CVE-2024-21823)
    - keys: Fix overwrite of key expiration on instantiation
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.11
    - drm/amd/display: Fix division by zero in setup_dsc_config
    - net: ks8851: Fix another TX stall caused by wrong ISR flag handling
    - ice: pass VSI pointer into ice_vc_isvalid_q_id
    - ice: remove unnecessary duplicate checks for VF VSI ID
    - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
      (CVE-2024-36013)
    - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
    - KEYS: trusted: Fix memory leak in tpm2_key_encode()
    - erofs: get rid of erofs_fs_context
    - erofs: reliably distinguish block based and fscache mode
    - [arm*] binder: fix max_thread type inconsistency
    - usb: dwc3: Wait unconditionally after issuing EndXfer command
    - net: usb: ax88179_178a: fix link status when link is set to down/up
    - usb: typec: ucsi: displayport: Fix potential deadlock
    - usb: typec: tipd: fix event checking for tps25750
    - usb: typec: tipd: fix event checking for tps6598x
    - serial: kgdboc: Fix NMI-safety problems from keyboard reset code
    - remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
    - KEYS: trusted: Do not use WARN when encode fails
    - admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET
    - docs: kernel_include.py: Cope with docutils 0.21
    - Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS filter
      matching sysfs file
    - block: add a disk_has_partscan helper
    - block: add a partscan sysfs attribute for disks

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 26 May 2024 07:52:48 +0200

linux (6.8.9-1) unstable; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_6.8
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.1
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.2
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.3
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.4
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.5
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.6
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.7
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.8
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.9

  [ Diederik de Haas ]
  * d/templates/main.control.in: Add python3-dacite as linux-support Depends
  * [armhf] Improve Tegra Chromebook support (Closes: #1061680)
    - [armhf] drivers/net/wireless/marvell/mwifiex: Enable MWIFIEX and
      MWIFIEX_SDIO as modules
    - [armhf] drivers/power/supply: Enable CHARGER_BQ24735 as module
    - [armhf] drivers/hwmon: Enable SENSORS_LM90 as module
    - [armhf] drivers/media/cec/platform: Enable CEC_TEGRA as module
  * drivers/thermal: Enable THERMAL_NETLINK
  * [amd64] drivers/tee/amdtee: Enable AMDTEE as module
  * [amd64] drivers/platform/x86/amd/pmf: Enable AMD_PMF as module
    (Closes: #1063161)
  * Update to 6.8.8:
    - Drop patches applied upstream:
      - "Partially revert 'MIPS: Add -Werror to arch/mips/Kbuild'"
      - "platform/x86: p2sb: On Goldmont only cache P2SB and SPI devfn BAR"
      - "driver core: Emit reason for pending deferred probe"
      - "x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set"
      - "Documentation/hw-vuln: Add documentation for RFDS"
      - "x86/rfds: Mitigate Register File Data Sampling (RFDS)"
      - "KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests"
    - Refresh patches:
      - Adjust context in "Tweak gitignore for Debian pkg-kernel using git"
      - Adjust context in "Documentation: Drop sphinx version check"
      - Adjust context in "firmware: Remove redundant log messages from drivers"
      - Adjust context in "yama: Disable by default"
      - Adjust context in "btrfs: warn about RAID5/6 being experimental at
        mount time"
      - Adjust context in "x86: Make x32 syscall support conditional on a
        kernel parameter"
      - Adjust context in "efi: Lock down the kernel if booted in secure boot
        mode"
      - Adjust context in "Export symbols needed by Android drivers"
  * d/copyright: Exclude 'action-ebpf' as that's a binary blob
  * d/installer/modules: Remove modules removed from upstream kernel
  * d/config: Update with the help of kconfigeditor2:
    - crypto: Remove CRYPTO_CFB and CRYPTO_OFB
    - drivers/gpu/drm: Remove DRM_LEGACY
    - drivers/md: Remove MD_FAULTY, MD_LINEAR and MD_MULTIPATH
    - [alpha,hppa,mips.malta,powerpc,x86] drivers/net/wireless/atmel:
      Remove ATMEL, PCI_ATMEL and PCMCIA_ATMEL
    - drivers/net/wireless/cisco: Remove WLAN_VENDOR_CISCO and AIRO
    - [alpha,hppa,powerpc,x86] drivers/net/wireless/cisco: Remove AIRO_CS
    - drivers/net/wireless/intersil/hostap: Remove HOSTAP, HOSTAP_FIRMWARE,
      HOSTAP_FIRMWARE_NVRAM, HOSTAP_PLX, HOSTAP_PCI and HOSTAP_CS
    - drivers/net/wireless/intersil/orinoco: Remove HERMES_PRISM,
      HERMES_CACHE_FW_ON_INIT, NORTEL_HERMES, PCMCIA_SPECTRUM and ORINOCO_USB
    - [alpha,hppa,mips.malta,powerpc,x86] drivers/net/wireless/intersil/orinoco:
      Remove HERMES, APPLE_AIRPORT, PLX_HERMES, TMD_HERMES, PCI_HERMES,
      PCMCIA_HERMES
    - drivers/net/wireless/legacy: Remove USB_NET_RNDIS_WLAN
    - [alpha,hppa,powerpc,x86] drivers/net/wireless/legacy:
      Remove PCMCIA_RAYCS and PCMCIA_WL3501
    - drivers/net/wireless/marvell/libertas: Remove LIBERTAS_CS
    - [alpha,hppa,mips.malta,powerpc,x86] drivers/net/wireless/zydas:
      Remove USB_ZD1201
    - drivers/video/fbdev: Remove FB_INTEL_DEBUG FB_INTEL_I2C
    - [armhf,arm64] drivers/video/fbdev: Remove FB_ARMCLCD
    - [cloud,x86] drivers/video/fbdev: Remove FB_CARILLO_RANCH and FB_LE80578
    - [x86] drivers/video/fbdev: Remove FB_INTEL
    - fs/fscache: Change FSCACHE to `y`
    - mm: Remove SLAB_DEPRECATED and SLUB
    - net/bpfilter: Remove BPFILTER
  * [rt] Update to 6.8.2-rt11
  * [rt] Drop patches applied in 6.8.6:
    - "printk: For @suppress_panic_printk check for other CPU in panic"
    - "panic: Flush kernel log buffer at the end"
    - "dump_stack: Do not get cpu_sync for panic CPU"
  * [arm64] net/rfkill: Enable RFKILL_GPIO as module
  * [arm64] Further improve support for SolidRun HoneyComb (Closes: #1065611):
    - [arm64] drivers/hwmon/pmbus: Enable PMBUS, SENSORS_PMBUS and
      SENSORS_LTC2978 as modules
    - [arm64] drivers/nvmem: Enable NVMEM_LAYERSCAPE_SFP as module
    - [arm64] drivers/rtc: Enable RTC_DRV_FSL_FTM_ALARM as module
    - [arm64] drivers/soc/fsl: Enable FSL_RCPM
  * d/templates: Change firmware-linux-free from Recommends to Suggests

  [ Vincent Blut ]
  * [arm64] Improve support for SolidRun Honeycomb Workstation:
    - drivers/pci/controller/mobiveil: Enable PCIE_LAYERSCAPE_GEN4
      (Closes: #1061116)
    - drivers/phy/freescale: Enable PHY_FSL_LYNX_28G as module
      (Closes: #1061117)
  * sound/virtio: Enable SND_VIRTIO as module (Closes: #1059089)

  [ Salvatore Bonaccorso ]
  * drivers/tty: Disable N_GSM
  * tipc: fix UAF in error path
  * tipc: fix a possible memleak in tipc_buf_append

  [ Ben Hutchings ]
  - d/salsa-ci.yml: Restore Python static checks on scripts
  * linux-doc: Add python3-yaml to Build-Depends, required from 6.8
  * udeb: Move crc8 to crc-modules to avoid duplication

  [ Stuart Hayhurst ]
  * sound: Enable TAS2781 Smart Amp modules

  [ Eric Mackay ]
  * [arm64] Dynamically allocate cpumasks and increase supported CPUs to 512

  [ Uwe Kleine-König ]
  * [arm64,armhf] Enable SND_SOC_WM8804_I2C for the hifiberry-digi raspberry
    hat.

 -- Ben Hutchings <benh@debian.org>  Thu, 16 May 2024 01:42:10 +0200

linux (6.7.12-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.10
    - [arm64] dmaengine: fsl-edma: utilize common dt-binding header file
    - [arm64] dmaengine: fsl-edma: correct max_segment_size setting
    - xfrm: Clear low order bits of ->flowi4_tos in decode_session4().
    - xfrm: Pass UDP encapsulation in TX packet offload
    - net: lan78xx: fix runtime PM count underflow on link stop
    - ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
    - i40e: disable NAPI right after disabling irqs when handling xsk_pool
    - ice: reorder disabling IRQ and NAPI in ice_qp_dis
    - ice: replace ice_vf_recreate_vsi() with ice_vf_reconfig_vsi()
    - ice: reconfig host after changing MSI-X on VF
    - Revert "net/mlx5: Block entering switchdev mode with ns inconsistency"
    - Revert "net/mlx5e: Check the number of elements before walk TC rhashtable"
    - net/mlx5: E-switch, Change flow rule destination checking
    - net/mlx5: Fix fw reporter diagnose output
    - net/mlx5: Check capability for fw_reset
    - net/mlx5e: Change the warning when ignore_flow_level is not supported
    - net/mlx5e: Fix MACsec state loss upon state update in offload path
    - net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking
      occurs after populating the metadata_map
    - net/mlx5e: Switch to using _bh variant of of spinlock API in port
      timestamping NAPI poll context
    - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string
    - geneve: make sure to pull inner header in geneve_rx()
    - idpf: disable local BH when scheduling napi for marker packets
    - ice: virtchnl: stop pretending to support RSS over AQ or registers
    - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
    - ice: fix uninitialized dplls mutex usage
    - igc: avoid returning frame twice in XDP_REDIRECT
    - net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
    - bpf: check bpf_func_state->callback_depth when pruning states
    - xdp, bonding: Fix feature flags when there are no slave devs anymore
    - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
    - net/rds: fix WARNING in rds_conn_connect_if_down
    - netfilter: nft_ct: fix l3num expectations with inet pseudo family
    - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
    - erofs: apply proper VMA alignment for memory mapped files on THP
    - netrom: Fix a data-race around sysctl_netrom_default_path_quality
    - netrom: Fix a data-race around
      sysctl_netrom_obsolescence_count_initialiser
    - netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
    - netrom: Fix a data-race around sysctl_netrom_transport_timeout
    - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
    - netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
    - netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
    - netrom: Fix a data-race around
      sysctl_netrom_transport_requested_window_size
    - netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
    - netrom: Fix a data-race around sysctl_netrom_routing_control
    - netrom: Fix a data-race around sysctl_netrom_link_fails_count
    - netrom: Fix data-races around sysctl_net_busy_read
    - net: pds_core: Fix possible double free in error handling path
    - readahead: avoid multiple marked readahead pages
    - [armel,armhf] 9328/1: mm: try VMA lock-based page fault handling first
    - [armel,armhf] arch/arm/mm: fix major fault accounting when retrying under
      per-VMA lock
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.11
    - io_uring/unix: drop usage of io_uring socket
    - io_uring: drop any code related to SCM_RIGHTS
    - [arm64] soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
    - media: rkisp1: Fix IRQ handling due to shared interrupts
    - HID: logitech-hidpp: Do not flood kernel log
    - [x86] ASoC: cs42l43: Handle error from devm_pm_runtime_enable
    - wifi: iwlwifi: mvm: use correct address 3 in A-MSDU
    - perf/arm-cmn: Workaround AmpereOneX errata AC04_MESH_1 (incorrect child
      count)
    - ASoC: rt5645: Make LattePanda board DMI match more precise
    - spi: intel-pci: Add support for Lunar Lake-M SPI serial flash
    - regmap: kunit: Ensure that changed bytes are actually different
    - [x86] ASoC: amd: yc: Fix non-functional mic on Lenovo 82UU
    - [x86] xen: Add some null pointer checking to smp.c
    - [mips*] Clear Cause.BD in instruction_pointer_set
    - ceph: always queue a writeback when revoking the Fb caps
    - ceph: add ceph_cap_unlink_work to fire check_caps() immediately
    - HID: multitouch: Add required quirk for Synaptics 0xcddc device
    - [x86] ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system
      suspend
    - ALSA: hda/realtek: cs35l41: Add internal speaker support for ASUS UM3402
      with missing DSD
    - gen_compile_commands: fix invalid escape sequence warning
    - [arm64] sve: Lower the maximum allocation for the SVE ptrace regset
    - soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt
    - arm64: dts: rockchip: mark system power controller on rk3588-evb1
    - RDMA/mlx5: Fix fortify source warning while accessing Eth segment
    - RDMA/mlx5: Relax DEVX access upon modify commands
    - [arm*] dts: rockchip: Drop interrupts property from pwm-rockchip nodes
    - bpf: Fix warning for bpf_cpumask in verifier
    - [riscv64] dts: sifive: add missing #interrupt-cells to pmic
    - [x86] mm: Move is_vsyscall_vaddr() into asm/vsyscall.h
    - [x86] mm: Disallow vsyscall page read for copy_from_kernel_nofault()
    - net/iucv: fix the allocation size of iucv_path_table array
    - block: sed-opal: handle empty atoms when parsing response
    - cxl/region: Handle endpoint decoders in cxl_region_find_decoder()
    - cxl/region: Allow out of order assembly of autodiscovered regions
    - perf: CXL: fix CPMU filter value mask length
    - [x86] platform/x86: x86-android-tablets: Fix acer_b1_750_goodix_gpios name
    - dm-verity, dm-crypt: align "struct bvec_iter" correctly
    - [arm*] dts: Fix dtc interrupt_provider warnings
    - [arm64] dts: Fix dtc interrupt_provider warnings
    - [arm*] dts: Fix dtc interrupt_map warnings
    - [arm64] dts: qcom: Fix interrupt-map cell sizes
    - [arm*] dts: renesas: rcar-gen2: Add missing #interrupt-cells to DA9063
      nodes
    - drm/amd/display: fix input states translation error for dcn35 & dcn351
    - regulator: max5970: Fix regulator child node name
    - wifi: iwlwifi: mvm: ensure offloading TID queue exists
    - wifi: iwlwifi: mvm: fix the TXF mapping for BZ devices
    - btrfs: zoned: don't skip block group profile checks on conventional zones
    - btrfs: fix data races when accessing the reserved amount of block reserves
    - btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
    - spi: cadence-qspi: put runtime in runtime PM hooks names
    - spi: cadence-qspi: add system-wide suspend and resume callbacks
    - net: smsc95xx: add support for SYS TEC USB-SPEmodule1
    - wifi: mac80211: only call drv_sta_rc_update for uploaded stations
    - drm/ttm/tests: depend on UML || COMPILE_TEST
    - [x86] ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table
    - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
    - ALSA: hda/realtek - ALC285 reduce pop noise from Headphone port
    - drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series
    - drm/buddy: check range allocation matches alignment
    - [x86] ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2
    - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
      (CVE-2024-22099)
    - Bluetooth: mgmt: Fix limited discoverable off timeout
    - firewire: core: use long bus reset on gap count error
    - [riscv64] perf: RISCV: Fix panic on pmu overflow handler
    - [arm64] tegra: Set the correct PHY mode for MGBE
    - [x86] ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8
      tablet
    - [x86] hyperv: Allow 15-bit APIC IDs for VTL platforms
    - ALSA: hda/realtek: Add quirks for Lenovo Thinkbook 16P laptops
    - ALSA: hda: cs35l41: Overwrite CS35L41 configuration for ASUS UM5302LA
    - [x86] ASoC: amd: yc: Add HP Pavilion Aero Laptop 13-be2xxx(8BD6) into DMI
      quirk table
    - xfrm: fix xfrm child route lookup for packet offload
    - xfrm: set skb control buffer based on packet offload as well
    - Input: gpio_keys_polled - suppress deferred probe error for gpio
    - ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
    - ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
    - ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
    - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
    - workqueue.c: Increase workqueue name length
    - workqueue: Move pwq->max_active to wq->max_active
    - workqueue: Factor out pwq_is_empty()
    - workqueue: Replace pwq_activate_inactive_work() with
      [__]pwq_activate_work()
    - workqueue: Move nr_active handling into helpers
    - workqueue: Make wq_adjust_max_active() round-robin pwqs while activating
    - workqueue: RCU protect wq->dfl_pwq and implement accessors for it
    - workqueue: Introduce struct wq_node_nr_active
    - workqueue: Implement system-wide nr_active enforcement for unbound
      workqueues
    - workqueue: Don't call cpumask_test_cpu() with -1 CPU in
      wq_update_node_max_active()
    - iomap: clear the per-folio dirty bits on all writeback failures
    - fs: Fix rw_hint validation
    - io_uring: remove looping around handling traditional task_work
    - io_uring: remove unconditional looping in local task_work handling
    - [s390x] dasd: Use dev_*() for device log messages
    - [s390x] dasd: fix double module refcount decrement
    - md: fix kmemleak of rdev->serial
    - rcu/exp: Fix RCU expedited parallel grace period kworker allocation
      failure recovery
    - rcu/exp: Handle RCU expedited grace period kworker allocation failure
    - nbd: null check for nla_nest_start
    - fs/select: rework stack allocation hack for clang
    - block: fix deadlock between bd_link_disk_holder and partition scan
    - md: Don't clear MD_CLOSING when the raid is about to stop
    - ovl: Always reject mounting over case-insensitive directories
    - kunit: test: Log the correct filter string in executor_test
    - lib/cmdline: Fix an invalid format specifier in an assertion msg
    - lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg
    - time: test: Fix incorrect format specifier
    - rtc: test: Fix invalid format specifier.
    - net: test: Fix printf format specifier in skb_segment kunit test
    - md: remove flag RemoveSynchronized
    - md/raid1: remove rcu protection to access rdev from conf
    - md/raid1: factor out helpers to add rdev to conf
    - md/raid1: record nonrot rdevs while adding/removing rdevs to conf
    - md/raid1: fix choose next idle in read_balance()
    - io_uring/net: unify how recvmsg and sendmsg copy in the msghdr
    - io_uring/net: move receive multishot out of the generic msghdr path
    - io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
    - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
    - [x86] mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type
    - [x86] resctrl: Remove hard-coded memory bandwidth limit
    - [x86] resctrl: Read supported bandwidth sources from CPUID
    - [x86] resctrl: Implement new mba_MBps throttling heuristic
    - [x86] sme: Fix memory encryption setting if enabled by default and not
      overridden
    - timekeeping: Fix cross-timestamp interpolation on counter wrap
    - timekeeping: Fix cross-timestamp interpolation corner case decision
    - timekeeping: Fix cross-timestamp interpolation for non-x86
    - sched/fair: Take the scheduling domain into account in select_idle_smt()
    - sched/fair: Take the scheduling domain into account in select_idle_core()
    - wifi: ath10k: fix NULL pointer dereference in
      ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (CVE-2023-7042)
    - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
    - wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
    - wifi: b43: Stop correct queue in DMA worker when QoS is disabled
    - wifi: b43: Disable QoS for bcm4331
    - wifi: wilc1000: fix declarations ordering
    - wifi: wilc1000: fix RCU usage in connect path
    - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
    - wifi: wilc1000: do not realloc workqueue everytime an interface is added
    - wifi: wilc1000: fix multi-vif management when deleting a vif
    - wifi: mwifiex: debugfs: Drop unnecessary error check for
      debugfs_create_dir()
    - [arm*] dts: renesas: r8a73a4: Fix external clocks and clock rate
    - [arm64] dts: qcom: sc8180x: Hook up VDD_CX as GCC parent domain
    - [arm64] dts: qcom: sc8180x: Fix up big CPU idle state entry latency
    - [arm64] dts: qcom: sc8180x: Add missing CPU off state
    - [arm64] dts: qcom: sc8180x: Fix eDP PHY power-domains
    - [arm64] dts: qcom: sc8180x: Don't hold MDP core clock at FMAX
    - [arm64] dts: qcom: sc8180x: Require LOW_SVS vote for MMCX if DISPCC is on
    - [arm64] dts: qcom: sc8180x: Shrink aoss_qmp register space size
    - cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
    - cpufreq: mediatek-hw: Wait for CPU supplies before probing
    - sock_diag: annotate data-races around sock_diag_handlers[family]
    - inet_diag: annotate data-races around inet_diag_table[]
    - bpftool: Silence build warning about calloc()
    - libbpf: Apply map_set_def_max_entries() for inner_maps on creation
    - wifi: ath12k: Fix issues in channel list update
    - wifi: mac80211: use deflink and fix typo in link ID check
    - wifi: iwlwifi: change link id in time event to s8
    - af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
    - [arm64] dts: qcom: sm8450: Add missing interconnects to serial
    - [arm64] soc: qcom: socinfo: rename PM2250 to PM4125
    - [arm64] dts: qcom: sdm845-oneplus-common: improve DAI node naming
    - cpufreq: mediatek-hw: Don't error out if supply is not found
    - libbpf: Fix faccessat() usage on Android
    - pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl
    - [arm64] dts: qcom: sa8540p: Drop gfx.lvl as power-domain for gpucc
    - [arm64] dts: renesas: r8a779g0: Restore sort order
    - [arm64] dts: renesas: r8a779g0: Add missing SCIF_CLK2
    - [arm64] dts: imx8mm-kontron: Disable pullups for I2C signals on OSM-S
      i.MX8MM
    - [arm64] dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL
      i.MX8MM
    - [arm64] dts: imx8mm-kontron: Disable pullups for onboard UART signals on
      BL OSM-S board
    - [arm64] dts: imx8mm-kontron: Disable pullups for onboard UART signals on
      BL board
    - [arm64] dts: imx8mm-kontron: Disable pull resistors for SD card signals on
      BL OSM-S board
    - [arm64] dts: imx8mm-kontron: Disable pull resistors for SD card signals on
      BL board
    - [arm64] dts: imx8mm-kontron: Fix interrupt for RTC on OSM-S i.MX8MM module
    - [arm64] dts: imx8qm: Align edma3 power-domains resources indentation
    - [arm64] dts: imx8qm: Correct edma3 power-domains and interrupt numbers
    - libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API
    - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
    - wifi: ath11k: change to move WMI_VDEV_PARAM_SET_HEMU_MODE before
      WMI_PEER_ASSOC_CMDID
    - wifi: ath12k: Update Qualcomm Innovation Center, Inc. copyrights
    - wifi: ath12k: fix fetching MCBC flag for QCN9274
    - wifi: iwlwifi: mvm: report beacon protection failures
    - wifi: iwlwifi: dbg-tlv: ensure NUL termination
    - wifi: iwlwifi: acpi: fix WPFC reading
    - wifi: iwlwifi: mvm: initialize rates in FW earlier
    - wifi: iwlwifi: fix EWRD table validity check
    - wifi: iwlwifi: mvm: d3: fix IPN byte order
    - wifi: iwlwifi: always have 'uats_enabled'
    - wifi: iwlwifi: mvm: fix the TLC command after ADD_STA
    - wifi: iwlwifi: read BIOS PNVM only for non-Intel SKU
    - gpio: vf610: allow disabling the vf610 driver
    - [arm64] dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
    - pwm: atmel-hlcdc: Fix clock imbalance related to suspend support
    - net: blackhole_dev: fix build warning for ethh set but not used
    - [arm64] dts: ti: k3-am62p5-sk: Enable CPSW MDIO node
    - [arm64] dts: ti: k3-j721s2: Fix power domain for VTM node
    - [arm64] dts: ti: k3-j784s4: Fix power domain for VTM node
    - wifi: ath11k: initialize rx_mcs_80 and rx_mcs_160 before use
    - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
    - [arm64] dts: ti: k3-am69-sk: remove assigned-clock-parents for unused VP
    - [arm64] dts: ti: k3-am62p-mcu/wakeup: Disable MCU and wakeup R5FSS nodes
    - libbpf: Use OPTS_SET() macro in bpf_xdp_query()
    - wifi: wfx: fix memory leak when starting AP
    - [arm64] dts: qcom: qcm2290: declare VLS CLAMP register for USB3 PHY
    - [arm64] dts: qcom: sm6115: declare VLS CLAMP register for USB3 PHY
    - wifi: ath12k: fix incorrect logic of calculating vdev_stats_id
    - printk: nbcon: Relocate 32bit seq macros
    - printk: ringbuffer: Do not skip non-finalized records with prb_next_seq()
    - printk: Wait for all reserved records with pr_flush()
    - printk: Add this_cpu_in_panic()
    - printk: ringbuffer: Cleanup reader terminology
    - printk: ringbuffer: Skip non-finalized records in panic
    - printk: Disable passing console lock owner completely during panic()
    - pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan
    - tools/resolve_btfids: Refactor set sorting with types from btf_ids.h
    - tools/resolve_btfids: Fix cross-compilation to non-host endianness
    - wifi: iwlwifi: support EHT for WH
    - wifi: iwlwifi: properly check if link is active
    - wifi: iwlwifi: mvm: fix erroneous queue index mask
    - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK
    - wifi: iwlwifi: mvm: don't set replay counters to 0xff
    - [s390x] pai: fix attr_event_free upper limit for pai device drivers
    - [s390x] vdso: drop '-fPIC' from LDFLAGS
    - ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
    - [arm64] dts: mt8183: Move CrosEC base detection node to kukui-based DTs
    - [arm64] dts: mediatek: mt7986: fix reference to PWM in fan node
    - [arm64] dts: mediatek: mt7986: drop crypto's unneeded/invalid clock name
    - [arm64] dts: mediatek: mt7986: fix SPI bus width properties
    - [arm64] dts: mediatek: mt7986: fix SPI nodename
    - [arm64] dts: mediatek: mt7986: drop "#clock-cells" from PWM
    - [arm64] dts: mediatek: mt7986: add "#reset-cells" to infracfg
    - [arm64] dts: mediatek: mt8192-asurada: Remove CrosEC base detection node
    - [arm64] dts: mediatek: mt8192: fix vencoder clock name
    - [arm64] dts: mediatek: mt8186: fix VENC power domain clocks
    - [arm64] dts: mediatek: mt7622: add missing "device_type" to memory nodes
    - can: m_can: Start/Cancel polling timer together with interrupts
    - wifi: iwlwifi: mvm: Fix the listener MAC filter flags
    - bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
    - [arm64] dts: qcom: sdm845: Use the Low Power Island CX/MX for SLPI
    - [arm64] soc: qcom: llcc: Check return value on Broadcast_OR reg read
    - [arm*] dts: qcom: msm8974: correct qfprom node size
    - [arm64] dts: mediatek: mt8186: Add missing clocks to ssusb power domains
    - [arm64] dts: mediatek: mt8186: Add missing xhci clock to usb controllers
    - [arm64] dts: ti: am65x: Fix dtbs_install for Rocktech OLDI overlay
    - cpufreq: qcom-hw: add CONFIG_COMMON_CLK dependency
    - wifi: wilc1000: prevent use-after-free on vif when cleaning up all
      interfaces
    - [arm64] dts: ti: k3-am62-main: disable usb lpm
    - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
    - bus: tegra-aconnect: Update dependency to ARCH_TEGRA
    - [amd64] iommu/amd: Mark interrupt as managed
    - wifi: brcmsmac: avoid function pointer casts
    - [arm64] dts: qcom: sdm845-db845c: correct PCIe wake-gpios
    - [arm64] dts: qcom: sm8150: use 'gpios' suffix for PCI GPIOs
    - [arm64] dts: qcom: sm8150: correct PCIe wake-gpios
    - powercap: dtpm_cpu: Fix error check against freq_qos_add_request()
    - net: ena: Remove ena_select_queue
    - [arm64] dts: ti: k3-j7200-common-proc-board: Modify Pinmux for wkup_uart0
      and mcu_uart0
    - [arm64] dts: ti: k3-j7200-common-proc-board: Remove clock-frequency from
      mcu_uart0
    - [arm64] dts: ti: k3-j721s2-common-proc-board: Remove Pinmux for CTS and
      RTS in wkup_uart0
    - [arm64] dts: ti: k3-j784s4-evm: Remove Pinmux for CTS and RTS in
      wkup_uart0
    - [arm64] dts: ti: k3-am64: Enable SDHCI nodes at the board level
    - [arm64] dts: ti: k3-am64-main: Fix ITAP/OTAP values for MMC
    - [arm64] dts: mt8195-cherry-tomato: change watchdog reset boot flow
    - [arm64] dts: ti: Add common1 register space for AM65x SoC
    - [arm64] dts: ti: Add common1 register space for AM62x SoC
    - [arm64] firmware: arm_scmi: Fix double free in SMC transport cleanup path
    - [arm64] dts: ti: k3-am62p: Fix memory ranges for DMSS
    - wifi: wilc1000: revert reset line logic flip
    - memory: tegra: Correct DLA client names
    - wifi: mt76: mt7925: fix connect to 80211b mode fail in 2Ghz band
    - wifi: mt76: mt7925: fix SAP no beacon issue in 5Ghz and 6Ghz band
    - wifi: mt76: mt7925: fix mcu query command fail
    - wifi: mt76: mt7925: fix wmm queue mapping
    - wifi: mt76: connac: add beacon protection support for mt7996
    - wifi: mt76: mt7925: fix WoW failed in encrypted mode
    - wifi: mt76: mt7925: fix the wrong header translation config
    - wifi: mt76: mt7925: add flow to avoid chip bt function fail
    - wifi: mt76: mt7925: add support to set ifs time by mcu command
    - wifi: mt76: mt7925: update PCIe DMA settings
    - wifi: mt76: mt7996: check txs format before getting skb by pid
    - wifi: mt76: mt7996: fix TWT issues
    - wifi: mt76: mt7996: fix incorrect interpretation of EHT MCS caps
    - wifi: mt76: mt7996: fix HE beamformer phy cap for station vif
    - wifi: mt76: mt7996: fix efuse reading issue
    - wifi: mt76: mt7996: fix HIF_TXD_V2_1 value
    - wifi: mt76: mt792x: fix ethtool warning
    - wifi: mt76: mt7921e: fix use-after-free in free_irq()
    - wifi: mt76: mt7925e: fix use-after-free in free_irq()
    - wifi: mt76: mt7921: fix incorrect type conversion for CLC command
    - wifi: mt76: mt792x: fix a potential loading failure of the 6Ghz channel
      config from ACPI
    - wifi: mt76: fix the issue of missing txpwr settings from ch153 to ch177
    - [arm64] dts: renesas: rzg2l: Add missing interrupts to IRQC nodes
    - [arm64] dts: renesas: r8a779a0: Correct avb[01] reg sizes
    - [arm64] dts: renesas: r8a779g0: Correct avb[01] reg sizes
    - net: mctp: copy skb ext data when fragmenting
    - pstore: inode: Convert mutex usage to guard(mutex)
    - pstore: inode: Only d_invalidate() is needed
    - [arm64] dts: allwinner: h6: Add RX DMA channel for SPDIF
    - [arm64] dts: imx8mp: Set SPI NOR to max 40 MHz on Data Modul i.MX8M Plus
      eDM SBC
    - [arm64] dts: imx8mp-evk: Fix hdmi@3d node
    - regulator: userspace-consumer: add module device table
    - gpiolib: Pass consumer device through to core in
      devm_fwnode_gpiod_get_index()
    - [arm64] dts: marvell: reorder crypto interrupts on Armada SoCs
    - ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override
    - ACPI: resource: Do IRQ override on Lunnen Ground laptops
    - ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override
    - ACPI: scan: Fix device check notification handling
    - [arm64] dts: rockchip: add missing interrupt-names for rk356x vdpu
    - [arm64] dts: rockchip: fix reset-names for rk356x i2s2 controller
    - [arm64] dts: rockchip: drop rockchip,trcm-sync-tx-only from rk3588 i2s
    - objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks
    - [x86] relocs: Ignore relocations in .notes section (CVE-2024-26816)
    - SUNRPC: fix a memleak in gss_import_v2_context
    - SUNRPC: fix some memleaks in gssx_dec_option_array
    - [arm64] dts: qcom: sm8550: Fix SPMI channels size
    - mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the
      .remove function
    - ACPI: CPPC: enable AMD CPPC V2 support for family 17h processors
    - wifi: rtw88: 8821cu: Fix firmware upload fail
    - wifi: rtw88: 8821c: Fix beacon loss and disconnect
    - wifi: rtw88: 8821c: Fix false alarm count
    - wifi: brcm80211: handle pmk_op allocation failure
    - PCI: Make pci_dev_is_disconnected() helper public for other drivers
    - [amd4] iommu/vt-d: Don't issue ATS Invalidation request when device is
      disconnected
    - igc: Fix missing time sync events
    - igb: Fix missing time sync events
    - ice: fix stats being updated by way too large values
    - Bluetooth: Remove HCI_POWER_OFF_TIMEOUT
    - Bluetooth: mgmt: Remove leftover queuing of power_off work
    - Bluetooth: Remove superfluous call to hci_conn_check_pending()
    - Bluetooth: Remove BT_HS
    - Bluetooth: hci_event: Fix not indicating new connection for BIG Sync
    - Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()
    - Bluetooth: hci_core: Cancel request on command timeout
    - Bluetooth: hci_sync: Fix overwriting request callback
    - Bluetooth: hci_h5: Add ability to allocate memory for private data
    - Bluetooth: btrtl: fix out of bounds memory access
    - Bluetooth: hci_core: Fix possible buffer overflow
    - Bluetooth: msft: Fix memory leak
    - Bluetooth: btusb: Fix memory leak
    - Bluetooth: af_bluetooth: Fix deadlock
    - Bluetooth: fix use-after-free in accessing skb after sending it
    - sr9800: Add check for usbnet_get_endpoints (CVE-2024-26651)
    - [s390x] cache: prevent rebuild of shared_cpu_list
    - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
    - bpf: Fix hashtab overflow check on 32-bit arches
    - bpf: Fix stackmap overflow check on 32-bit arches
    - net: dsa: microchip: make sure drive strength configuration is not lost by
      soft reset
    - dpll: spec: use proper enum for pin capabilities attribute
    - ipv6: fib6_rules: flush route cache when rule is changed
    - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
    - net: phy: fix phy_get_internal_delay accessing an empty array
    - dpll: fix dpll_xa_ref_*_del() for multiple registrations
    - [arm64] net: hns3: fix wrong judgment condition issue
    - [arm64] net: hns3: fix kernel crash when 1588 is received on HIP08 devices
    - [arm64] net: hns3: fix port duplex configure error in IMP reset
    - Bluetooth: Fix eir name length
    - net: phy: dp83822: Fix RGMII TX delay configuration
    - erofs: fix handling kern_mount() failure
    - erofs: fix lockdep false positives on initializing erofs_pseudo_mnt
    - OPP: debugfs: Fix warning around icc_get_name()
    - tcp: fix incorrect parameter validation in the do_tcp_getsockopt()
      function
    - ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt()
      function
    - l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt()
      function
    - udp: fix incorrect parameter validation in the udp_lib_getsockopt()
      function
    - net: kcm: fix incorrect parameter validation in the kcm_getsockopt)
      function
    - devlink: Fix length of eswitch inline-mode
    - nfp: flower: handle acti_netdevs allocation failure
    - bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes()
    - dm raid: fix false positive for requeue needed during reshape
    - dm: call the resume method on internal suspend
    - [arm64] drm/tegra: dsi: Add missing check for of_find_device_by_node
    - [arm64] drm/tegra: dpaux: Fix PM disable depth imbalance in
      tegra_dpaux_probe
    - [arm64] drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
    - [arm64] drm/tegra: dsi: Fix missing pm_runtime_disable() in the error
      handling path of tegra_dsi_probe()
    - [arm64] drm/tegra: hdmi: Fix some error handling paths in
      tegra_hdmi_probe()
    - [arm64] drm/tegra: rgb: Fix some error handling paths in
      tegra_dc_rgb_probe()
    - [arm64] drm/tegra: rgb: Fix missing clk_put() in the error handling paths
      of tegra_dc_rgb_probe()
    - [arm64] drm/tegra: output: Fix missing i2c_put_adapter() in the error
      handling paths of tegra_output_probe()
    - drm/rockchip: inno_hdmi: Fix video timing
    - drm: Don't treat 0 as -1 in drm_fixp2int_ceil
    - drm/vkms: Avoid reading beyond LUT array
    - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
    - drm/panel-edp: use put_sync in unprepare
    - drm/lima: fix a memleak in lima_heap_alloc
    - [x86] ASoC: amd: acp: Add missing error handling in sof-mach
    - [x86] ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe()
    - dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
    - media: tc358743: register v4l2 async device only after successful setup
    - media: cadence: csi2rx: use match fwnode for media link
    - PCI/DPC: Print all TLP Prefixes, not just the first
    - perf record: Fix possible incorrect free in record__switch_output()
    - perf top: Uniform the event name for the hybrid machine
    - perf record: Check conflict between '--timestamp-filename' option and pipe
      mode before recording
    - [x86] HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
    - drm/amd/display: Fix a potential buffer overflow in
      'dp_dsc_clock_en_read()'
    - perf pmu: Treat the msr pmu as software
    - ALSA: hda: cs35l41: Set Channel Index correctly when system is missing
      _DSD
    - drm/amd/display: Fix potential NULL pointer dereferences in
      'dcn10_set_output_transfer_func()'
    - drm/vmwgfx: Fix vmw_du_get_cursor_mob fencing of newly-created MOBs
    - pinctrl: renesas: r8a779g0: Add missing SCIF_CLK2 pin group/function
    - clk: samsung: exynos850: Propagate SPI IPCLK rate change
    - media: v4l2: cci: print leading 0 on error
    - perf evsel: Fix duplicate initialization of data->id in
      evsel__parse_sample()
    - perf bpf: Clean up the generated/copied vmlinux.h
    - clk: meson: Add missing clocks to axg_clk_regmaps
    - media: em28xx: annotate unchecked call to media_device_register()
    - media: v4l2-tpg: fix some memleaks in tpg_alloc
    - media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
    - mtd: spinand: esmt: Extend IDs to 5 bytes
    - media: edia: dvbdev: fix a use-after-free
    - pinctrl: mediatek: Drop bogus slew rate register range for MT8186
    - pinctrl: mediatek: Drop bogus slew rate register range for MT8192
    - drm/amdgpu: Fix potential out-of-bounds access in
      'amdgpu_discovery_reg_base_init()'
    - clk: qcom: reset: Commonize the de/assert functions
    - clk: qcom: reset: Ensure write completion on reset de/assertion
    - quota: Fix potential NULL pointer dereference
    - quota: Fix rcu annotations of inode dquot pointers
    - quota: Properly annotate i_dquot arrays with __rcu
    - PCI/P2PDMA: Fix a sleeping issue in a RCU read section
    - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
    - crypto: xilinx - call finalize with bh disabled
    - drivers/ps3: select VIDEO to provide cmdline functions
    - perf thread_map: Free strlist on normal path in
      thread_map__new_by_tid_str()
    - perf srcline: Add missed addr2line closes
    - dt-bindings: msm: qcom, mdss: Include ommited fam-b compatible
    - [arm64] drm/msm/dpu: fix the programming of INTF_CFG2_DATA_HCTL_EN
    - [arm64] drm/msm/dpu: Only enable DSC_MODE_MULTIPLEX if dsc_merge is
      enabled
    - drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
    - drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
    - clk: renesas: r8a779g0: Correct PFC/GPIO parent clocks
    - clk: renesas: r8a779f0: Correct PFC/GPIO parent clock
    - clk: renesas: r9a07g04[34]: Use SEL_SDHI1_STS status configuration for SD1
      mux
    - ALSA: seq: fix function cast warnings
    - perf expr: Fix "has_event" function for metric style events
    - perf stat: Avoid metric-only segv
    - perf metric: Don't remove scale from counts
    - [arm64] ASoC: meson: aiu: fix function pointer type mismatch
    - [arm64] ASoC: meson: t9015: fix function pointer type mismatch
    - [powerpc*] Force inlining of arch_vmap_p{u/m}d_supported()
    - [x86] ASoC: SOF: Add some bounds checking to firmware data
    - drm: ci: use clk_ignore_unused for apq8016
    - NTB: fix possible name leak in ntb_register_device()
    - media: cedrus: h265: Fix configuring bitstream size
    - media: sun8i-di: Fix coefficient writes
    - media: sun8i-di: Fix power on/off sequences
    - media: sun8i-di: Fix chroma difference threshold
    - media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
    - media: go7007: add check of return value of go7007_read_addr()
    - media: pvrusb2: remove redundant NULL check
    - media: pvrusb2: fix pvr2_stream_callback casts
    - clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
    - drm/amd/display: Add 'replay' NULL check in
      'edp_set_replay_allow_active()'
    - drm/panel: boe-tv101wum-nl6: make use of prepare_prev_first
    - [arm64] drm/msm/dpu: use devres-managed allocation for MDP TOP
    - [arm64] drm/msm/dpu: use devres-managed allocation for HW blocks
    - [arm64] drm/msm/dpu: finalise global state object
    - PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
    - drm/bridge: adv7511: fix crash on irq during probe
    - pinctrl: renesas: Allow the compiler to optimize away sh_pfc_pm
    - clk: hisilicon: hi3519: Release the correct number of gates in
      hi3519_clk_unregister()
    - clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
    - drm/tegra: put drm_gem_object ref on error in tegra_fb_create
    - media: ivsc: csi: Swap SINK and SOURCE pads
    - media: i2c: imx290: Fix IMX920 typo
    - mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
    - mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes
      a ref
    - perf print-events: make is_event_supported() more robust
    - [amd64] crypto: ccp - Avoid discarding errors in
      psp_send_platform_access_msg()
    - [x86] crypto: qat - remove unused macros in qat_comp_alg.c
    - [x86] crypto: qat - removed unused macro in adf_cnv_dbgfs.c
    - [x86] crypto: qat - avoid division by zero
    - [x86] crypto: qat - remove double initialization of value
    - [x86] crypto: qat - relocate and rename get_service_enabled()
    - [x86] crypto: qat - fix ring to service map for dcc in 4xxx
    - crypto: jitter - fix CRYPTO_JITTERENTROPY help text
    - drm/tidss: Fix initial plane zpos values
    - drm/tidss: Fix sync-lost issue with two displays
    - clk: imx: imx8mp: Fix SAI_MCLK_SEL definition
    - mtd: maps: physmap-core: fix flash size larger than 32-bit
    - mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
    - ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
    - ASoC: meson: axg-tdm-interface: add frame rate constraint
    - drm/msm/a7xx: Fix LLC typo
    - perf pmu: Fix a potential memory leak in perf_pmu__lookup()
    - HID: amd_sfh: Update HPD sensor structure elements
    - HID: amd_sfh: Avoid disabling the interrupt
    - drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
    - media: pvrusb2: fix uaf in pvr2_context_set_notify
    - media: dvb-frontends: avoid stack overflow warnings with clang
    - media: go7007: fix a memleak in go7007_load_encoder
    - media: ttpci: fix two memleaks in budget_av_attach
    - media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
    - arm64: ftrace: Don't forbid CALL_OPS+CC_OPTIMIZE_FOR_SIZE with Clang
    - drm/amd/pm: Fix esm reg mask use to get pcie speed
    - gpio: nomadik: fix offset bug in nmk_pmx_set()
    - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
    - mfd: cs42l43: Fix wrong register defaults
    - [powerpc*] 32: fix ADB_CUDA kconfig warning
    - [powerpc*] pseries: Fix potential memleak in papr_get_attr()
    - [powerpc*] hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value
      checks
    - clk: qcom: gcc-ipq5018: fix 'enable_reg' offset of 'gcc_gmac0_sys_clk'
    - clk: qcom: gcc-ipq5018: fix 'halt_reg' offset of 'gcc_pcie1_pipe_clk'
    - clk: qcom: gcc-ipq5018: fix register offset for GCC_UBI0_AXI_ARES reset
    - [arm64] drm/msm/dpu: add division of drm_display_mode's hskew parameter
    - modules: wait do_free_init correctly
    - mfd: cs42l43: Fix wrong GPIO_FN_SEL and SPI_CLK_CONFIG1 defaults
    - power: supply: mm8013: fix "not charging" detection
    - [powerpc*] embedded6xx: Fix no previous prototype for avr_uart_send() etc.
    - leds: aw2013: Unlock mutex before destroying it
    - leds: sgm3140: Add missing timer cleanup and flash gpio control
    - backlight: ktz8866: Correct the check for of_property_read_u32
    - backlight: lm3630a: Initialize backlight_properties on init
    - backlight: lm3630a: Don't set bl->props.brightness in get_brightness
    - backlight: da9052: Fully initialize backlight_properties during probe
    - backlight: lm3639: Fully initialize backlight_properties during probe
    - backlight: lp8788: Fully initialize backlight_properties during probe
    - clk: Fix clk_core_get NULL dereference
    - clk: zynq: Prevent null pointer dereference caused by kmalloc failure
    - PCI: brcmstb: Fix broken brcm_pcie_mdio_write() polling
    - smb: do not test the return value of folio_start_writeback()
    - cifs: Don't use certain unnecessary folio_*() functions
    - cifs: Fix writeback data corruption
    - ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
    - ALSA: hda/tas2781: use dev_dbg in system_resume
    - ALSA: hda/tas2781: add lock to system_suspend
    - ALSA: hda/tas2781: do not reset cur_* values in runtime_suspend
    - ALSA: hda/tas2781: add ptrs to calibration functions
    - ALSA: hda/tas2781: do not call pm_runtime_force_* in system_resume/suspend
    - ALSA: hda/tas2781: configure the amp after firmware load
    - ALSA: hda/tas2781: restore power state after system_resume
    - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
    - scsi: hisi_sas: Fix a deadlock issue related to automatic dump
    - RDMA/irdma: Remove duplicate assignment
    - RDMA/srpt: Do not register event handler until srpt device is fully setup
    - f2fs: compress: fix to guarantee persisting compressed blocks by CP
    - f2fs: compress: fix to cover normal cluster write with cp_rwsem
    - f2fs: compress: fix to check unreleased compressed cluster
    - f2fs: delete obsolete FI_FIRST_BLOCK_WRITTEN
    - f2fs: delete obsolete FI_DROP_CACHE
    - f2fs: introduce get_dnode_addr() to clean up codes
    - f2fs: update blkaddr in __set_data_blkaddr() for cleanup
    - f2fs: compress: fix to avoid inconsistence bewteen i_blocks and dnode
    - f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panic
    - f2fs: zone: fix to wait completion of last bio in zone correctly
    - f2fs: fix NULL pointer dereference in f2fs_submit_page_write()
    - f2fs: compress: fix to cover f2fs_disable_compressed_file() w/ i_sem
    - f2fs: fix to avoid potential panic during recovery
    - scsi: csiostor: Avoid function pointer casts
    - i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling
    - [arm64] RDMA/hns: Fix mis-modifying default congestion control algorithm
    - RDMA/device: Fix a race between mad_client and cm_client init
    - RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
    - scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
    - f2fs: fix to create selinux label during whiteout initialization
    - f2fs: compress: fix to check zstd compress level correctly in mount option
    - net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
    - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
    - NFSv4.2: fix listxattr maximum XDR buffer size
    - f2fs: compress: fix to check compress flag w/ .i_sem lock
    - f2fs: check number of blocks in a current section
    - watchdog: starfive: Check pm_runtime_enabled() before decrementing usage
      counter
    - watchdog: stm32_iwdg: initialize default timeout
    - f2fs: fix to use correct segment type in f2fs_allocate_data_block()
    - f2fs: ro: compress: fix to avoid caching unaligned extent
    - RDMA/mana_ib: Fix bug in creation of dma regions
    - Input: iqs7222 - add support for IQS7222D v1.1 and v1.2
    - NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt
    - NFS: Fix an off by one in root_nfs_cat()
    - NFSv4.1/pnfs: fix NFS with TLS in pnfs
    - f2fs: compress: relocate some judgments in f2fs_reserve_compress_blocks
    - f2fs: compress: fix reserve_cblocks counting error when out of space
    - f2fs: introduce f2fs_invalidate_internal_cache() for cleanup
    - f2fs: fix to truncate meta inode pages forcely
    - f2fs: zone: fix to remove pow2 check condition for zoned block device
    - [x86] perf/x86/amd/core: Avoid register reset when CPU is dead
    - afs: Revert "afs: Hide silly-rename files from userspace"
    - nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
    - io_uring/net: correct the type of variable
    - bcachefs: Fix build on parisc by avoiding __multi3()
    - bcachefs: install fd later to avoid race with close
    - bcachefs: check for failure to downgrade
    - bcachefs: fix simulateously upgrading & downgrading
    - bcachefs: Fix BTREE_ITER_FILTER_SNAPSHOTS on inodes btree
    - comedi: comedi_8255: Correct error in subdevice initialization
    - comedi: comedi_test: Prevent timers rescheduling during deletion
    - mei: gsc_proxy: match component when GSC is on different bus
    - remoteproc: stm32: Fix incorrect type in assignment for va
    - remoteproc: stm32: Fix incorrect type assignment returned by
      stm32_rproc_get_loaded_rsc_tablef
    - iio: pressure: mprls0025pa fix off-by-one enum
    - usb: phy: generic: Get the vbus supply
    - tty: vt: fix 20 vs 0x20 typo in EScsiignore
    - serial: max310x: fix syntax error in IRQ error message
    - tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
    - [arm64] dts: broadcom: bcmbca: bcm4908: drop invalid switch cells
    - coresight: Fix issue where a source device's helpers aren't disabled
    - coresight: etm4x: Set skip_power_up in etm4_init_arch_data function
    - kconfig: fix infinite loop when expanding a macro at the end of file
    - iio: gts-helper: Fix division loop
    - bus: mhi: ep: check the correct variable in mhi_ep_register_controller()
    - hwtracing: hisi_ptt: Move type check to the beginning of
      hisi_ptt_pmu_event_init()
    - rtc: mt6397: select IRQ_DOMAIN instead of depending on it
    - serial: 8250_exar: Don't remove GPIO device on suspend
    - staging: greybus: fix get_channel_from_mode() failure path
    - usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
    - char: xilinx_hwicap: Fix NULL vs IS_ERR() bug
    - [x86] hyperv: Use per cpu initial stack for vtl context
    - thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error
      handling path
    - thermal/drivers/qoriq: Fix getting tmu range
    - io_uring: don't save/restore iowait state
    - spi: lpspi: Avoid potential use-after-free in probe()
    - ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates
    - nouveau: reset the bo resource bus info after an eviction
    - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
    - rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
    - [s390x] vtime: fix average steal time calculation
    - net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check (CVE-2024-26815)
    - devlink: Move private netlink flags to C file
    - devlink: Acquire device lock during netns dismantle
    - devlink: Enable the use of private flags in post_doit operations
    - devlink: Allow taking device lock in pre_doit operations
    - devlink: Fix devlink parallel commands processing
    - [riscv64] Only check online cpus for emulated accesses
    - soc: fsl: dpio: fix kcalloc() argument order
    - cpufreq: Fix per-policy boost behavior on SoCs using
      cpufreq_boost_set_sw()
    - io_uring: Fix release of pinned pages when __io_uaddr_map fails
    - tcp: Fix refcnt handling in __inet_hash_connect().
    - vmxnet3: Fix missing reserved tailroom
    - hsr: Fix uninit-value access in hsr_get_node()
    - net: txgbe: fix clk_name exceed MAX_DEV_ID limits
    - nvme: fix reconnection fail due to reserved tag allocation
    - net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up
    - net: ethernet: mtk_eth_soc: fix PPE hanging issue
    - io_uring: fix poll_remove stalled req completion
    - xen/evtchn: avoid WARN() when unbinding an event channel
    - xen/events: increment refcnt only if event channel is refcounted
    - packet: annotate data-races around ignore_outgoing
    - xfrm: Allow UDP encapsulation only in offload modes
    - net: veth: do not manipulate GRO when using XDP
    - net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
    - spi: spi-imx: fix off-by-one in mx51 CPU mode burst length
    - drm: Fix drm_fixp2int_round() making it add 0.5
    - vdpa_sim: reset must not run
    - vdpa/mlx5: Allow CVQ size changes
    - virtio: packed: fix unmap leak for indirect desc table
    - wireguard: receive: annotate data-race around receiving_counter.counter
    - rds: introduce acquire/release ordering in acquire/release_in_xmit()
    - hsr: Handle failures in module init
    - ipv4: raw: Fix sending packets from raw sockets via IPsec tunnels
    - nouveau/gsp: don't check devinit disable on GSP.
    - ceph: stop copying to iter at EOF on sync reads
    - net: phy: fix phy_read_poll_timeout argument type in genphy_loopback
    - dm-integrity: fix a memory leak when rechecking the data
    - net/bnx2x: Prevent access to a freed page in page_pool
    - devlink: fix port new reply cmd type
    - drm/amdgpu: add MMHUB 3.3.1 support
    - drm/amdgpu: fix mmhub client id out-of-bounds access
    - drm/amdgpu: drop setting buffer funcs in sdma442
    - netfilter: nft_set_pipapo: release elements in clone only from destroy
      path
    - netfilter: nf_tables: do not compare internal table flags on updates
    - rcu: add a helper to report consolidated flavor QS
    - net: report RCU QS on threaded NAPI repolling
    - bpf: report RCU QS in cpumap kthread
    - net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports
    - net: dsa: mt7530: fix handling of all link-local frames
    - netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
    - spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
    - dm io: Support IO priority
    - dm-integrity: align the outgoing bio in integrity_recheck
    - [x86] efistub: Clear decompressor BSS in native EFI entrypoint
    - [x86] efistub: Don't clear BSS twice in mixed mode
    - printk: Adjust mapping for 32bit seq macros
    - printk: Use prb_first_seq() as base for 32bit seq macros
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.12
    - [x86] KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace
    - [x86] KVM: x86: Use a switch statement and macros in __feature_translate()
    - drm/vmwgfx: Unmap the surface before resetting it on a plane state
    - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
    - wifi: brcmfmac: avoid invalid list operation when vendor attach fails
    - media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
    - [arm64] dts: qcom: sc7280: Add additional MSI interrupts
    - [arm64] remoteproc: virtio: Fix wdg cannot recovery remote processor
    - [arm64] clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
    - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts
    - [arm64] dts: qcom: sm8450-hdk: correct AMIC4 and AMIC5 microphones
    - serial: max310x: fix NULL pointer dereference in I2C instantiation
    - drm/vmwgfx: Fix the lifetime of the bo cursor memory
    - pci_iounmap(): Fix MMIO mapping leak
    - media: xc4000: Fix atomicity violation in xc4000_get_frequency
    - media: mc: Add local pad to pipeline regardless of the link state
    - media: mc: Fix flags handling when creating pad links
    - media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before access
    - media: mc: Add num_links flag to media_pad
    - media: mc: Rename pad variable to clarify intent
    - media: mc: Expand MUST_CONNECT flag to always require an enabled link
    - media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT
    - md: use RCU lock to protect traversal in md_spares_need_change()
    - KVM: Always flush async #PF workqueue when vCPU is being destroyed
    - [arm64] dts: qcom: sm8550-qrd: correct WCD9385 TX port mapping
    - [arm64] dts: qcom: sm8550-mtp: correct WCD9385 TX port mapping
    - cpufreq: amd-pstate: Fix min_perf assignment in amd_pstate_adjust_perf()
    - [x86] thermal/intel: Fix intel_tcc_get_temp() to support negative CPU
      temperature
    - [x86] powercap: intel_rapl: Fix a NULL pointer dereference
    - [x86] powercap: intel_rapl: Fix locking in TPMI RAPL
    - [x86] powercap: intel_rapl_tpmi: Fix a register bug
    - [x86] powercap: intel_rapl_tpmi: Fix System Domain probing
    - [powerpc*] smp: Adjust nr_cpu_ids to cover all threads of a core
    - [powerpc*] smp: Increase nr_cpu_ids to include the boot CPU
    - [x86] crypto: qat - change SLAs cleanup flow at shutdown
    - [x86] crypto: qat - resolve race condition during AER recovery
    - ext4: correct best extent lstart adjustment logic
    - block: Clear zone limits for a non-zoned stacked queue
    - bounds: support non-power-of-two CONFIG_NR_CPUS
    - fat: fix uninitialized field in nostale filehandles
    - fuse: fix VM_MAYSHARE and direct_io_allow_mmap
    - mfd: twl: Select MFD_CORE
    - ubifs: Set page uptodate in the correct place
    - ubi: Check for too small LEB size in VTBL code
    - ubi: correct the calculation of fastmap size
    - mtd: rawnand: meson: fix scrambling mode value in command macro
    - md/md-bitmap: fix incorrect usage for sb_index
    - [x86] nmi: Fix the inverse "in NMI handler" check
    - md/raid5: fix atomicity violation in raid5_cache_count
    - iio: adc: rockchip_saradc: fix bitmask for channels on SARADCv2
    - iio: adc: rockchip_saradc: use mask for write_enable bitfield
    - docs: Restore "smart quotes" for quotes
    - cpufreq: Limit resolving a frequency to policy min/max
    - PM: suspend: Set mem_sleep_current during kernel command line setup
    - vfio/pds: Always clear the save/restore FDs on reset
    - clk: qcom: gcc-ipq5018: fix terminating of frequency table arrays
    - clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
    - clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
    - clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays
    - clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
    - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
    - usb: xhci: Add error handling in xhci_map_urb_for_dma
    - [powerpc*] fsl: Fix mfpmr build errors with newer binutils
    - USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
    - USB: serial: add device ID for VeriFone adapter
    - USB: serial: cp210x: add ID for MGP Instruments PDS100
    - wifi: mac80211: track capability/opmode NSS separately
    - USB: serial: option: add MeiG Smart SLM320 product
    - [x86] KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled
    - USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
    - PM: sleep: wakeirq: fix wake irq warning in system suspend
    - mmc: tmio: avoid concurrent runs of mmc_request_done()
    - fuse: replace remaining make_bad_inode() with fuse_make_bad()
    - fuse: fix root lookup with nonzero generation
    - fuse: don't unhash root
    - usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros
    - usb: dwc3-am62: fix module unload/reload behavior
    - usb: dwc3-am62: Disable wakeup at remove
    - serial: core: only stop transmit when HW fifo is empty
    - serial: Lock console when calling into driver before registration
    - btrfs: qgroup: always free reserved space for extent records
    - btrfs: fix off-by-one chunk length calculation at
      contains_pending_extent()
    - wifi: rtw88: Add missing VID/PIDs for 8811CU and 8821CU
    - PCI/PM: Drain runtime-idle callbacks before driver removal
    - PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports
    - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume
    - md: export helpers to stop sync_thread
    - md: export helper md_is_rdwr()
    - md: add a new helper reshape_interrupted()
    - dm-raid: really frozen sync_thread during suspend
    - md/dm-raid: don't call md_reap_sync_thread() directly
    - dm-raid: add a new helper prepare_suspend() in md_personality
    - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent
      with reshape
    - dm-raid: fix lockdep waring in "pers->hot_add_disk"
    - [powerpc*] xor_vmx: Add '-mhard-float' to CFLAGS
    - block: Fix page refcounts for unaligned buffers in __bio_release_pages()
    - mac802154: fix llsec key resources release in mac802154_llsec_key_del
    - mm: swap: fix race between free_swap_and_cache() and swapoff()
    - mmc: core: Fix switch on gp3 partition
    - Bluetooth: btnxpuart: Fix btnxpuart_close
    - leds: trigger: netdev: Fix kernel panic on interface rename trig notify
    - [arm64] drm/etnaviv: Restore some id values
    - landlock: Warn once if a Landlock action is requested while disabled
    - io_uring: fix mshot read defer taskrun cqe posting
    - hwmon: (amc6821) add of_match table
    - io_uring: fix io_queue_proc modifying req->flags
    - ext4: fix corruption during on-line resize
    - nvmem: meson-efuse: fix function pointer type mismatch
    - slimbus: core: Remove usage of the deprecated ida_simple_xx() API
    - phy: tegra: xusb: Add API to retrieve the port number of phy
    - usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic
    - speakup: Fix 8bit characters from direct synth
    - debugfs: fix wait/cancellation handling during remove
    - PCI/AER: Block runtime suspend when handling errors
    - io_uring/net: correctly handle multishot recvmsg retry setup
    - io_uring: fix mshot io-wq checks
    - PCI: qcom: Disable ASPM L0s for sc8280xp, sa8540p and sa8295p
    - nfs: fix UAF in direct writes
    - NFS: Read unlock folio on nfs_page_create_from_folio() error
    - kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
    - PCI: qcom: Enable BDF to SID translation properly
    - PCI: dwc: endpoint: Fix advertised resizable BAR size
    - PCI: hv: Fix ring buffer size calculation
    - smb: client: stop revalidating reparse points unnecessarily
    - cifs: prevent updating file size from server if we have a read/write lease
    - cifs: allow changing password during remount
    - thermal/drivers/mediatek: Fix control buffer enablement on MT7896
    - vfio/pci: Disable auto-enable of exclusive INTx IRQ (CVE-2024-27437)
    - vfio/pci: Lock external INTx masking ops (CVE-2024-26810)
    - vfio/platform: Disable virqfds on cleanup
    - [x86] i915: make inject_virtual_interrupt() void
    - eventfd: simplify eventfd_signal()
    - vfio/platform: Create persistent IRQ handlers (CVE-2024-26813)
    - vfio/fsl-mc: Block calling interrupt handler without trigger
      (CVE-2024-26814)
    - tpm,tpm_tis: Avoid warning splat at shutdown
    - ksmbd: replace generic_fillattr with vfs_getattr
    - ksmbd: retrieve number of blocks using vfs_getattr in
      set_file_allocation_info
    - [x86] platform/x86/intel/tpmi: Change vsec offset to u64
    - io_uring/rw: return IOU_ISSUE_SKIP_COMPLETE for multishot retry
    - io_uring: clean rings on NO_MMAP alloc fail
    - ring-buffer: Fix waking up ring buffer readers
    - ring-buffer: Do not set shortest_full when full target is hit
    - ring-buffer: Fix resetting of shortest_full
    - ring-buffer: Fix full_waiters_pending in poll
    - ring-buffer: Use wait_event_interruptible() in ring_buffer_wait()
    - dlm: fix user space lkb refcounting
    - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
    - soc: fsl: qbman: Use raw spinlock for cgr_lock
    - [s390x] zcrypt: fix reference counting on zcrypt card objects
    - drm/probe-helper: warn about negative .get_modes()
    - drm/panel: do not return negative error codes from drm_panel_get_modes()
    - drm/imx/ipuv3: do not return negative values from .get_modes()
    - [arm64] drm/vc4: hdmi: do not return negative values from .get_modes()
    - [riscv64] clocksource/drivers/timer-riscv: Clear timer interrupt on timer
      initialization
    - memtest: use {READ,WRITE}_ONCE in memory scanning
    - Revert "block/mq-deadline: use correct way to throttling write requests"
    - f2fs: mark inode dirty for FI_ATOMIC_COMMITTED flag
    - f2fs: truncate page cache before clearing flags when aborting atomic write
    - nilfs2: fix failure to detect DAT corruption in btree and direct mappings
    - nilfs2: prevent kernel bug at submit_bh_wbc()
    - cifs: make sure server interfaces are requested only for SMB3+
    - cifs: delete unnecessary NULL checks in cifs_chan_update_iface()
    - cifs: make cifs_chan_update_iface() a void function
    - cifs: reduce warning log level for server not advertising interfaces
    - cifs: open_cached_dir(): add FILE_READ_EA to desired access
    - mtd: rawnand: Fix and simplify again the continuous read derivations
    - mtd: rawnand: Add a helper for calculating a page index
    - mtd: rawnand: Ensure all continuous terms are always in sync
    - mtd: rawnand: Constrain even more when continuous reads are enabled
    - cpufreq: dt: always allocate zeroed cpumask
    - io_uring/futex: always remove futex entry for cancel all
    - io_uring/waitid: always remove waitid entry for cancel all
    - [amd64] x86/CPU/AMD: Update the Zenbleed microcode revisions
    - ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
    - net: esp: fix bad handling of pages from page_pool
    - NFSD: Fix nfsd_clid_class use of __string_len() macro
    - [x86] drm/i915: Add missing ; to __assign_str() macros in tracepoint code
    - [arm64] net: hns3: tracing: fix hclgevf trace event strings
    - cxl/trace: Properly initialize cxl_poison region name
    - ksmbd: fix potencial out-of-bounds when buffer offset is invalid
    - virtio: Define feature bit for administration virtqueue
    - virtio: reenable config if freezing device failed
    - wireguard: netlink: check for dangling peer via is_dead instead of empty
      list
    - wireguard: netlink: access device through ctx instead of peer
    - wireguard: selftests: set RISCV_ISA_FALLBACK on riscv{32,64}
    - ahci: asm1064: correct count of reported ports
    - ahci: asm1064: asm1166: don't limit reported ports
    - drm/amd/display: Change default size for dummy plane in DML2
    - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
    - drm/amdgpu/pm: Fix NULL pointer dereference when get power limit
    - drm/amdgpu/pm: Check the validity of overdiver power limit
    - drm/amd/display: Add ODM check during pipe split/merge validation
    - drm/amd/display: Override min required DCFCLK in dml1_validate
    - drm/amd/display: Allow dirty rects to be sent to dmub when abm is active
    - drm/amd/display: Add dml2 copy functions
    - drm/amd/display: Init DPPCLK from SMU on dcn32
    - drm/amd/display: Update odm when ODM combine is changed on an otg master
      pipe with no plane
    - drm/amd/display: Fix idle check for shared firmware state
    - drm/amd/display: Return the correct HDCP error code
    - drm/amd/display: Fix noise issue on HDMI AV mute
    - dm snapshot: fix lockup in dm_exception_table_exit
    - [x86] pm: Work around false positive kmemleak report in
      msr_build_context()
    - wifi: brcmfmac: add per-vendor feature detection callback
    - wifi: brcmfmac: cfg80211: Use WSEC to set SAE password
    - wifi: brcmfmac: Demote vendor-specific attach/detach messages to info
    - drm/ttm: Make sure the mapped tt pages are decrypted when needed
    - vfio: Introduce interface to flush virqfd inject workqueue
    - vfio/pci: Create persistent INTx handler (CVE-2024-26812)
    - drm/bridge: add ->edid_read hook and drm_bridge_edid_read()
    - drm/bridge: lt8912b: use drm_bridge_edid_read()
    - drm/bridge: lt8912b: clear the EDID property on failures
    - drm/bridge: lt8912b: do not return negative values from .get_modes()
    - workqueue: Shorten events_freezable_power_efficient name
    - drm/amd/display: Use freesync when `DRM_EDID_FEATURE_CONTINUOUS_FREQ`
      found
    - netfilter: nf_tables: mark set as dead when unbinding anonymous set with
      timeout (CVE-2024-26643)
    - netfilter: nf_tables: disallow anonymous set with timeout flag
      (CVE-2024-26642)
    - netfilter: nf_tables: reject constant set with timeout
    - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of
      memory
    - nouveau: lock the client object tree.
    - drm/nouveau: fix stale locked mutex in nouveau_gem_ioctl_pushbuf
    - crypto: rk3288 - Fix use after free in unprepare
    - crypto: sun8i-ce - Fix use after free in unprepare
    - Revert "crypto: pkcs7 - remove sha1 support"
    - xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
    - mm, mmap: fix vma_merge() case 7 with vma_ops->close
    - usb: typec: tpcm: Fix PORT_RESET behavior for self powered devices
    - thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()
    - cgroup/cpuset: Fix retval in update_cpumask()
    - cgroup/cpuset: Fix a memory leak in update_exclusive_cpumask()
    - Input: xpad - add additional HyperX Controller Identifiers
    - init/Kconfig: lower GCC version check for -Warray-bounds
    - firewire: ohci: prevent leak of left-over IRQ on unbind
    - [x86] KVM: x86: Mark target gfn of emulated atomic instruction as dirty
    - [x86] KVM: SVM: Flush pages under kvm->lock to fix UAF in
      svm_register_enc_region()
    - SEV: disable SEV-ES DebugSwap by default
    - tracing: Use .flush() call to wake up readers
    - drm/amdgpu/pm: Fix the error of pwm1_enable setting
    - tty: serial: imx: Fix broken RS485
    - [x86] drm/i915: Check before removing mm notifier
    - ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo
      ALC897 platform
    - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
    - usb: typec: altmodes/displayport: create sysfs nodes as driver's default
      device attribute group
    - usb: gadget: ncm: Fix handling of zero block length packets
    - usb: port: Don't try to peer unused USB ports based on location
    - xhci: Fix failure to detect ring expansion need.
    - tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
    - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on
      suspend/resume
    - misc: fastrpc: Pass proper arguments to scm call
    - serial: port: Don't suspend if the port is still busy
    - mei: me: add arrow lake point S DID
    - mei: me: add arrow lake point H DID
    - vt: fix unicode buffer corruption when deleting characters
    - Revert "tty: serial: simplify qcom_geni_serial_send_chunk_fifo()"
    - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
    - ALSA: hda/realtek - Add Headset Mic supported Acer NB platform
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook
    - tee: optee: Fix kernel panic caused by incorrect error handling
    - mm, vmscan: prevent infinite loop for costly GFP_NOIO |
      __GFP_RETRY_MAYFAIL allocations
    - [arm64] dts: qcom: sc8280xp-x13s: limit pcie4 link speed
    - iio: accel: adxl367: fix DEVID read after reset
    - iio: accel: adxl367: fix I2C FIFO data register
    - i2c: i801: Fix using mux_pdev before it's set
    - i2c: i801: Avoid potential double call to gpiod_remove_lookup_table
    - iio: imu: inv_mpu6050: fix frequency setting when chip is off
    - iio: imu: inv_mpu6050: fix FIFO parsing when empty
    - [x86] drm/i915: Don't explode when the dig port we don't have an AUX CH
    - drm/amd/display: handle range offsets in VRR ranges
    - drm/amd/swsmu: modify the gfx activity scaling
    - [x86] efistub: Call mixed mode boot services on the firmware's stack
    - [x86] ASoC: amd: yc: Revert "Fix non-functional mic on Lenovo 21J2"
    - Fix memory leak in posix_clock_open() (CVE-2024-26655)
    - wifi: rtw88: 8821cu: Fix connection failure
    - btrfs: fix deadlock with fiemap and extent locking
    - [x86] Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
    - [x86] sev: Fix position dependent variable references in startup code
    - clocksource/drivers/arm_global_timer: Fix maximum prescaler value
    - [arm*] 9352/1: iwmmxt: Remove support for PJ4/PJ4B cores
    - [arm*] 9359/1: flush: check if the folio is reserved for no-mapping
      addresses
    - entry: Respect changes to system call number by trace_sys_enter()
    - swiotlb: Fix double-allocation of slots due to broken alignment handling
    - swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc()
    - swiotlb: Fix alignment checks when both allocation and DMA masks are
      present
    - iommu/dma: Force swiotlb_max_mapping_size on an untrusted device
    - printk: Update @console_may_schedule in console_trylock_spinning()
    - irqchip/renesas-rzg2l: Implement restriction when writing ISCR register
    - irqchip/renesas-rzg2l: Flush posted write in irq_eoi()
    - irqchip/renesas-rzg2l: Add macro to retrieve TITSR register offset based
      on register's index
    - irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi()
    - irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi()
    - irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger
      type
    - [x86] kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe
      address
    - efi/libstub: fix efi_random_alloc() to allocate memory at alloc_min or
      higher address
    - [x86] mpparse: Register APIC address only once
    - [x86] fpu: Keep xfd_state in sync with MSR_IA32_XFD
    - efi: fix panic in kdump kernel
    - pwm: img: fix pwm clock lookup
    - btrfs: do not skip re-registration for the mounted device
    - mfd: intel-lpss: Switch to generalized quirk table
    - mfd: intel-lpss: Introduce QUIRK_CLOCK_DIVIDER_UNITY for XPS 9530
    - perf top: Use evsel's cpus to replace user_requested_cpus
    - [x86] drm/i915: Stop printing pipe name as hex
    - [x86] drm/i915: Use named initializers for DPLL info
    - [x86] drm/i915: Replace a memset() with zero initialization
    - [x86] drm/i915: Try to preserve the current shared_dpll for fastset on
      type-c ports
    - [x86] drm/i915: Include the PLL name in the debug messages
    - [x86] drm/i915: Suppress old PLL pipe_mask checks for MG/TC/TBT PLLs
    - drm/amd/display: Prevent crash when disable stream
    - ALSA: hda/tas2781: remove digital gain kcontrol
    - ALSA: hda/tas2781: add locks to kcontrols
    - init: open /initrd.image with O_LARGEFILE
    - [x86] efistub: Add missing boot_params for mixed mode compat entry
    - efi/libstub: Cast away type warning in use of max()
    - [x86] efistub: Reinstate soft limit for initrd loading
    - prctl: generalize PR_SET_MDWE support check to be per-arch
    - [arm*] prctl: reject PR_SET_MDWE on pre-ARMv6
    - tmpfs: fix race on handling dquot rbtree
    - btrfs: validate device maj:min during open
    - btrfs: fix race in read_extent_buffer_pages()
    - btrfs: zoned: don't skip block groups with 100% zone unusable
    - btrfs: zoned: use zone aware sb location for scrub
    - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
    - wifi: cfg80211: add a flag to disable wireless extensions
    - wifi: iwlwifi: mvm: disable MLO for the time being
    - wifi: iwlwifi: fw: don't always use FW dump trig
    - wifi: iwlwifi: mvm: handle debugfs names more carefully
    - Revert "drm/amd/display: Fix sending VSC (+ colorimetry) packets for
      DP/eDP displays without PSR"
    - exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
    - hexagon: vmlinux.lds.S: handle attributes section
    - mm: cachestat: fix two shmem bugs
    - mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc
      HS200 mode
    - mmc: core: Initialize mmc_blk_ioc_data
    - mmc: core: Avoid negative index with array access
    - sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove()
    - block: Do not force full zone append completion in req_bio_endio()
    - thermal: devfreq_cooling: Fix perf state when calculate dfc res_util
    - nouveau/dmem: handle kcalloc() allocation failure
    - net: ll_temac: platform_get_resource replaced by wrong function
    - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed
    - drm/amdkfd: fix TLB flush after unmap for GFX9.4.2
    - drm/amdgpu: fix deadlock while reading mqd from debugfs
    - drm/amd/display: Remove MPC rate control logic from DCN30 and above
    - drm/amd/display: Set DCN351 BB and IP the same as DCN35
    - [x86] drm/i915/hwmon: Fix locking inversion in sysfs getter
    - [x86] drm/i915/bios: Tolerate devdata==NULL in
      intel_bios_encoder_supports_dp_dual_mode()
    - [x86] drm/i915/vrr: Generate VRR "safe window" for DSB
    - [x86] drm/i915/dsi: Go back to the previous INIT_OTP/DISPLAY_ON order,
      mostly
    - [x86] drm/i915/dsb: Fix DSB vblank waits when using VRR
    - [x86] drm/i915: Do not match JSL in ehl_combo_pll_div_frac_wa_needed()
    - [x86] drm/i915/gt: Reset queue_priority_hint on parking
    - drm/amd/display: Fix bounds check for dcn35 DcfClocks
    - Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
    - mtd: spinand: Add support for 5-byte IDs
    - Revert "usb: phy: generic: Get the vbus supply"
    - usb: cdc-wdm: close race between read and workqueue
    - usb: misc: ljca: Fix double free in error handling path (CVE-2024-26653)
    - USB: UAS: return ENODEV when submit urbs fail with device not attached
    - drm/amd/display: set odm_combine_policy based on context in dcn32 resource
    - drm/amdgpu: make damage clips support configurable
    - drm/amdgpu/display: Address kdoc for 'is_psr_su' in 'fill_dc_dirty_rects'
    - vfio/pds: Make sure migration file isn't accessed after reset
    - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
      (CVE-2024-26654)
    - scsi: ufs: qcom: Provide default cycles_in_1us value
    - scsi: sd: Fix TCG OPAL unlock on system resume
    - scsi: core: Fix unremoved procfs host directory regression
    - staging: vc04_services: changen strncpy() to strscpy_pad()
    - staging: vc04_services: fix information leak in create_component()
    - usb: dwc3: Properly set system wakeup
    - USB: core: Fix deadlock in usb_deauthorize_interface()
    - USB: core: Add hub_get() and hub_put() routines
    - USB: core: Fix deadlock in port "disable" sysfs attribute
    - usb: dwc2: host: Fix remote wakeup from hibernation
    - usb: dwc2: host: Fix hibernation flow
    - usb: dwc2: host: Fix ISOC flow in DDMA mode
    - usb: dwc2: gadget: Fix exiting from clock gating
    - usb: dwc2: gadget: LPM flow fix
    - usb: udc: remove warning when queue disabled ep
    - usb: typec: ucsi: Fix race between typec_switch and role_switch
    - usb: typec: Return size of buffer if pd_set operation succeeds
    - usb: typec: ucsi: Clear EVENT_PENDING under PPM lock
    - usb: typec: ucsi: Ack unsupported commands
    - usb: typec: ucsi_acpi: Refactor and fix DELL quirk
    - usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset
    - scsi: qla2xxx: Prevent command send on chip reset
    - scsi: qla2xxx: Fix N2N stuck connection
    - scsi: qla2xxx: Split FCE|EFT trace control
    - scsi: qla2xxx: Update manufacturer detail
    - scsi: qla2xxx: NVME|FCP prefer flag not being honored
    - scsi: qla2xxx: Fix command flush on cable pull
    - scsi: qla2xxx: Fix double free of the ha->vp_map pointer
    - scsi: qla2xxx: Fix double free of fcport
    - scsi: qla2xxx: Change debug message during driver unload
    - scsi: qla2xxx: Delay I/O Abort on PCI error
    - [x86] bugs: Fix the SRSO mitigation on Zen3/4
    - crash: use macro to add crashk_res into iomem early for specific arch
    - [x86] bugs: Use fixed addressing for VERW operand
    - Revert "x86/bugs: Use fixed addressing for VERW operand"
    - usb: dwc3: pci: Drop duplicate ID
    - scsi: lpfc: Correct size for cmdwqe/rspwqe for memset()
    - scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
    - scsi: lpfc: Correct size for wqe for memset()
    - scsi: libsas: Fix disk not being scanned in after being removed
    - [x86] sev: Skip ROM range scans and validation for SEV-SNP guests
    - tools/resolve_btfids: fix build with musl libc
    - drm/amdgpu: fix use-after-free bug (CVE-2024-26656)
    - drm/sched: fix null-ptr-deref in init entity (CVE-2024-26657)

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "ARM: Allow to enable RT"
  * [rt] Drop "printk: nbcon: Relocate 32bit seq macros"
  * [rt] Drop "printk: Adjust mapping for 32bit seq macros"
  * [rt] Drop "printk: Use prb_first_seq() as base for 32bit seq macros"
  * [rt] Drop "printk: ringbuffer: Do not skip non-finalized records with
    prb_next_seq()"
  * [rt] Drop "printk: Add this_cpu_in_panic()"
  * [rt] "printk: ringbuffer: Cleanup reader terminology"
  * [rt] Drop "printk: Wait for all reserved records with pr_flush()"
  * [rt] Drop "printk: ringbuffer: Skip non-finalized records in panic"
  * [rt] Drop "printk: Disable passing console lock owner completely during
    panic()"
  * net/bluetooth: Remove BT_HS (Removed upstream)
  * Refresh "efi: Lock down the kernel if booted in secure boot mode"
  * Workaround FTBFS on dh_installdocs falls from different source package
    (Closes: #1068189)

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 24 Apr 2024 09:42:56 +0200

linux (6.7.9-2) unstable; urgency=high

  * [x86] Mitigate Register File Data Sampling (RFDS) vulnerability
    (CVE-2023-28746):
    - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set
    - Documentation/hw-vuln: Add documentation for RFDS
    - x86/rfds: Mitigate Register File Data Sampling (RFDS)
    - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 13 Mar 2024 12:13:41 +0100

linux (6.7.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.8
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.9
    - mtd: spinand: gigadevice: Fix the get ecc status issue
    - ice: fix connection state of DPLL and out pin
    - ice: fix dpll input pin phase_adjust value updates
    - ice: fix dpll and dpll_pin data access on PF reset
    - ice: fix dpll periodic work data updates on PF reset
    - ice: fix pin phase adjust updates on PF reset
    - spi: cadence-qspi: fix pointer reference in runtime PM hooks
    - spi: cadence-qspi: remove system-wide suspend helper calls from runtime PM
      hooks
    - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
    - netlink: add nla be16/32 types to minlen array
    - net: ip_tunnel: prevent perpetual headroom growth
    - net: mctp: take ownership of skb in mctp_local_output
    - tun: Fix xdp_rxq_info's queue_index when detaching
    - [x86] cpufreq: intel_pstate: fix pstate limits enforcement for adjust_perf
      call back
    - net: veth: clear GRO when clearing XDP even when down
    - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
    - lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is
      detected
    - veth: try harder when allocating queue memory
    - net: usb: dm9601: fix wrong return value in dm9601_mdio_read
    - net: lan78xx: fix "softirq work is pending" error
    - uapi: in6: replace temporary label with rfc9486
    - stmmac: Clear variable when destroying workqueue
    - Bluetooth: hci_sync: Check the correct flag before starting a scan
    - Bluetooth: Avoid potential use-after-free in hci_error_reset
    - Bluetooth: hci_sync: Fix accept_list when attempting to suspend
    - Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR
    - Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
    - Bluetooth: Enforce validation on max value of connection interval
    - Bluetooth: qca: Fix wrong event type for patch config command
    - Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT
    - Bluetooth: qca: Fix triggering coredump implementation
    - netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
    - netfilter: bridge: confirm multicast packets before passing them up the
      stack
    - rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
    - igb: extend PTP timestamp adjustments to i211
    - net: hsr: Use correct offset for HSR TLV values in supervisory HSR frames
    - tls: decrement decrypt_pending if no async completion will be called
    - tls: fix peeking with sync+async decryption
    - tls: separate no-async decryption request handling from async
    - tls: fix use-after-free on failed backlog decryption
    - [riscv64] tlb: fix __p*d_free_tlb()
    - efi/capsule-loader: fix incorrect allocation size
    - power: supply: bq27xxx-i2c: Do not free non existing IRQ
    - [x86] ASoC: cs35l56: Must clear HALO_STATE before issuing SYSTEM_RESET
    - [arm64,armhf] gpu: host1x: Skip reset assert on Tegra186
    - [riscv64] mm: fix NOCACHE_THEAD does not set bit[61] correctly
    - [riscv64] Fix build error if !CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION
    - [x86] ASoC: cs35l56: cs35l56_component_remove() must clear
      cs35l56->component
    - [x86] ASoC: cs35l56: cs35l56_component_remove() must clean up wm_adsp
    - [x86] ASoC: cs35l56: Don't add the same register patch multiple times
    - [x86] ASoC: cs35l56: Fix for initializing ASP1 mixer registers
    - [x86] ASoC: cs35l56: Fix misuse of wm_adsp 'part' string for silicon
      revision
    - [x86] ASoC: cs35l56: Fix deadlock in ASP1 mixer register initialization
    - ASoC: soc-card: Fix missing locking in snd_soc_card_get_kcontrol()
    - [riscv64] Ignore V from the riscv,isa DT property on older T-Head CPUs
    - [arm64,armhf] drm/tegra: Remove existing framebuffer only if we support
      display
    - fbcon: always restore the old font data in fbcon_do_set_font()
    - afs: Fix endless loop in directory parsing
    - drm/amd/display: Prevent potential buffer overflow in map_hw_resources
    - drivers: perf: added capabilities for legacy PMU
    - drivers: perf: ctr_get_width function for legacy is not defined
    - Revert "riscv: mm: support Svnapot in huge vmap"
    - [riscv64] Fix pte_leaf_size() for NAPOT
    - [riscv64] Sparse-Memory/vmemmap out-of-bounds fix
    - btrfs: fix race between ordered extent completion and fiemap
    - drm/nouveau: keep DMA buffers required for suspend/resume
    - tomoyo: fix UAF write bug in tomoyo_write_control() (CVE-2024-26622)
    - ALSA: firewire-lib: fix to check cycle continuity
    - ALSA: ump: Fix the discard error code from snd_ump_legacy_open()
    - ALSA: hda/realtek: Fix top speaker connection on Dell Inspiron 16 Plus
      7630
    - ALSA: hda/realtek: tas2781: enable subwoofer volume control
    - ALSA: hda/realtek: Enable Mute LED on HP 840 G8 (MB 8AB8)
    - ALSA: hda/realtek: fix mute/micmute LED For HP mt440
    - ALSA: hda/realtek: Add special fixup for Lenovo 14IRP8
    - Bluetooth: hci_bcm4377: do not mark valid bd_addr as invalid
    - landlock: Fix asymmetric private inodes referring
    - gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
    - mm: cachestat: fix folio read-after-free in cache walk
    - [armhf] mtd: rawnand: marvell: fix layouts
    - wifi: nl80211: reject iftype change with mesh ID change
    - btrfs: fix double free of anonymous device after snapshot creation failure
    - btrfs: dev-replace: properly validate device names
    - btrfs: send: don't issue unnecessary zero writes for trailing hole
    - Revert "drm/amd/pm: resolve reboot exception for si oland"
    - drm/buddy: fix range bias
    - drm/amdgpu/pm: Fix the power1_min_cap value
    - drm/amd/display: Add monitor patch for specific eDP
    - [arm64] soc: qcom: pmic_glink: Fix boot when QRTR=m
    - [arm64] dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
    - [arm64] crypto: arm64/neonbs - fix out-of-bounds access on short input
    - [arm64] dmaengine: fsl-edma: correct calculation of 'nbytes' in multi-fifo
      scenario
    - [arm64] dmaengine: fsl-qdma: init irq after reg initialization
    - [arm64,armhf] mmc: mmci: stm32: fix DMA API overlapping mappings warning
    - mmc: core: Fix eMMC initialization with 1-bit bus connection
    - [arm64] mmc: sdhci-xenon: add timeout for PHY init complete
    - [arm64] mmc: sdhci-xenon: fix PHY init clock stability
    - ceph: switch to corrected encoding of max_xattr_size in mdsmap
    - [riscv64] add CALLER_ADDRx support
    - [riscv64] Fix enabling cbo.zero when running in M-mode
    - power: supply: mm8013: select REGMAP_I2C
    - kbuild: Add -Wa,--fatal-warnings to as-instr invocation
    - efivarfs: Request at most 512 bytes for variable names
    - pmdomain: arm: Fix NULL dereference on scmi_perf_domain removal
    - pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation
    - fprobe: Fix to allocate entry_data_size buffer with rethook instances
    - mm/debug_vm_pgtable: fix BUG_ON with pud advanced test
    - mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index
    - [x86] e820: Don't reserve SETUP_RNG_SEED in e820
    - [x86] cpu: Allow reducing x86_phys_bits during early_identify_cpu()
    - [x86] cpu/intel: Detect TME keyid bits before setting MTRR mask registers
    - mptcp: map v4 address to v6 when destroying subflow
    - mptcp: avoid printing warning once on client side
    - mptcp: push at DSS boundaries
    - mptcp: fix snd_wnd initialization for passive socket
    - mptcp: fix potential wake-up event loss
    - mptcp: fix double-free on socket dismantle
    - mptcp: fix possible deadlock in subflow diag
    - mfd: twl6030-irq: Revert to use of_match_device()
    - NFS: Fix data corruption caused by congestion.
    - af_unix: Fix task hung while purging oob_skb in GC.
    - af_unix: Drop oob_skb ref before purging queue in GC.
    - [x86] ASoC: cs35l56: fix reversed if statement in
      cs35l56_dspwait_asp1tx_put()
    - [arm64] phy: freescale: phy-fsl-imx8-mipi-dphy: Fix alias name to use
      dashes
    - [arm64] phy: qcom-qmp-usb: fix v3 offsets data
    - [amd64] dmaengine: idxd: Remove shadow Event Log head stored in idxd
    - [amd64] dmaengine: idxd: Ensure safe user copy of completion record
    - [powerpc*] pseries/iommu: IOMMU table is not initialized for kdump over
      SR-IOV
    - [powerpc*] rtas: use correct function name for resetting TCE tables
    - gpio: 74x164: Enable output pins after registers are reset
    - gpiolib: Fix the error path order in gpiochip_add_data_with_key()
    - gpio: fix resource unwinding order in error path
    - block: define bvec_iter as __packed __aligned(4)
    - [x86] entry_64: Add VERW just before userspace transition
    - [x86] entry_32: Add VERW just before userspace transition
    - [x86] bugs: Use ALTERNATIVE() instead of mds_user_clear static key
    - [x86] KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH
    - [x86] KVM/VMX: Move VERW closer to VMentry for MDS mitigation
    - drm/nouveau: don't fini scheduler before entity flush

  [ Salvatore Bonaccorso ]
  * [x86] platform/x86: p2sb: On Goldmont only cache P2SB and SPI devfn BAR
    (Closes: #1065320)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 08 Mar 2024 21:55:53 +0100

linux (6.7.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.5
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.6
    - mmc: sdhci-pci-o2micro: Fix a warm reboot issue that disk can't be
      detected by BIOS (Closes: #1056056)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.7
    - drm/amd/display: Only allow dig mapping to pwrseq in new asic
      (Closes: #1061449)

  [ Weizhao Ouyang ]
  * Enable CONFIG_MFD_RK8XX_SPI for RK3588 SoC
    - MFD_RK8XX_SPI as built-in, same behavior as MFD_RK8XX_I2C

  [ Uwe Kleine-König ]
  * [armhf] Enable DRM_PANEL_MIPI_DBI as a module for
    stm32mp157c-lxa-tac-gen2.
  * Backport a patch from v6.8-rc1 to be more verbose about pending deferred
    probes helping debugging of failed boot attempts.
  * [arm64] Make PINCTRL_ROCKCHIP builtin.

  [ Vincent Blut ]
  * [x86] drivers/hwmon: Enable SENSORS_HP_WMI as module (Closes: #1064507)

  [ Weihao Li]
  * [loong64] Build kernel image and udebs for loong64 (Closes: #1053650)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 02 Mar 2024 08:22:54 +0100

linux (6.7.4-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.2
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.3
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.4

  [ Aurelien Jarno ]
  * [riscv64] Add clock, MFD, PCIe PHYs, regulator and RTC drivers to
    kernel-image udeb.
  * [riscv64] Disable CRYPTO_DEV_JH7110, it is broken.

  [ Bastian Blank ]
  * Make linux-libc-dev provide all cross packages.

  [ Salvatore Bonaccorso ]
  * Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
    (Closes: #1061521)

  [ Emanuele Rocca ]
  * [arm64] drivers/thermal/qcom: enable QCOM_SPMI_ADC_TM5 as module for
    thermal throttling on the Lenovo ThinkPad X13s.

  [ Vincent Blut ]
  * drivers/hwmon: Enable SENSORS_IIO_HWMON as module (Closes: #1057272)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 08 Feb 2024 16:01:07 +0100

linux (6.7.1-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.1

  [ Salvatore Bonaccorso ]
  * Enable bcachefs filesystem support
    - fs/bcachefs: Enable BCACHEFS_FS as module
    - fs/bcachefs: Enable BCACHEFS_QUOTA
    - fs/bcachefs: Enable BCACHEFS_POSIX_ACL
  * media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)

  [ Aurelien Jarno ]
  * [riscv64] Enable ARCH_SOPHGO and ARCH_THEAD.
  * [riscv64] Disable ARCH_R9A07G043 as it now depends on NONPORTABLE.
  * [riscv64] Enable PHY_STARFIVE_JH7110_DPHY_RX, PHY_STARFIVE_JH7110_PCIE and
    PHY_STARFIVE_JH7110_USB as modules.
  * [powerpc,ppc64,ppc64el] Drop ipddp from nic-modules.
  * [riscv64] Enable LEDS_PWM and LEDS_PWM_MULTICOLOR as modules.

  [ Vincent Blut ]
  * [arm64, armhf] drivers/net/phy: Enable ADIN_PHY as module
    (Closes: #1043354)

  [ Martin Kepplinger ]
  * [arm64] Enable CSI camera stack for i.MX8M SoCs (Closes: #1055442)

  [ Tim Pambor ]
  * Enable configs for MT8195 Chromebooks:
    - COMMON_CLK_MT8195 as built-in
    - COMMON_CLK_MT8195_APUSYS, COMMON_CLK_MT8195_AUDSYS,
      COMMON_CLK_MT8195_IMP_IIC_WRAP, COMMON_CLK_MT8195_MFGCFG,
      COMMON_CLK_MT8195_MSDC, COMMON_CLK_MT8195_SCP_ADSP,
      COMMON_CLK_MT8195_VDOSYS, COMMON_CLK_MT8195_VPPSYS,
      COMMON_CLK_MT8195_CAMSYS, COMMON_CLK_MT8195_IMGSYS,
      COMMON_CLK_MT8195_WPESYS, COMMON_CLK_MT8195_VDECSYS,
      COMMON_CLK_MT8195_VENCSYS as modules
    - MFD_MT6360, REGULATOR_MT6315, REGULATOR_MT6359,
      REGULATOR_CROS_EC, MTK_LVTS_THERMAL as modules
    - MTK_ADSP_MBOX, MTK_ADSP_IPC, SND_SOC_SOF_OF, SND_SOC_MT8195,
      SND_SOC_MT8195_MT6359, SND_SOC_SOF_MT8195 as modules
    - SND_SOC_SOF_TOPLEVEL, SND_SOC_SOF_MTK_TOPLEVEL as built-in
    - DRM_MEDIATEK_DP, PHY_MTK_DP, PHY_MTK_PCIE, PHY_MTK_UFS as modules
    - PINCTRL_MT8195, PCIE_MEDIATEK_GEN3, SPMI_MTK_PMIF as built-in

  [ Zhang Ning ]
  * [arm64] drivers/rtc: Enable RTC_DRV_RS5C372 as module

  [ Bastian Blank ]
  * Revert "Run dh_movetousr also in signed images."
  * Fix config specified CFLAGS on kernel builds.  Also drop old definitions
    that have not worked for a long time.
  * Disable ability to do binNMU.  The Debian infrastructure is not ready
    to binNMU signed packages.  But they instead just break the dependencies
    within this package.
  * Restructure and cleanup complete config:
    - Uses TOML instead of our home-grown INI based format.
    - Don't export a config dump anymore, it is not longer in use.
  * Generate and ship vmlinux.h in linux-headers package.

  [ Emanuele Rocca ]
  * [arm64] Set QCOM_QSEECOM and QCOM_QSEECOM_UEFISECAPP to 'y' in order to
    add support for EFI variables on the Lenovo X13s.

  [ Martyn Welch ]
  * [arm64] Support HDMI output on TI SK-AM62. Enable DRM_SII902X and
    DRM_TIDSS as modules.

 -- Bastian Blank <waldi@debian.org>  Mon, 22 Jan 2024 09:50:46 +0100

linux (6.7-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_6.7

  [ Harry 88 ]
  * [arm64] udeb: Include sun8i-drm-hdmi module in installer
    (Closes: #1050315)

  [ Diederik de Haas ]
  * Update to 6.7:
    - d/copyright: Remove drivers/net/appletalk/cops*; removed upstream
    - d/rules.d/scripts/mod: Add symsearch to Makefile.real
  * Drop patches applied upstream:
    - Drop "powerpc: Don't clobber f0/vs0 during fp|altivec register save"
  * Drop patches:
    - Drop "Add removal patches for: 3c359, smctr, keyspan, cops"; cops
      support removed upstream which was the last remaining part
    - Drop "Hardcode arch script output"; ia64 architecture removed upstream
  * Refresh patches:
    - Adjust context in "Tweak gitignore for Debian pkg-kernel using git"
    - Adjust context in "video: Remove nvidiafb and rivafb"
    - Adjust context in "Include package version along with kernel release in
      stack traces"
    - Adjust context in "kbuild: Look for module.lds under arch directory too"
    - Adjust context in "firmware: Remove redundant log messages from drivers"
    - Adjust context in "add sysctl to disallow unprivileged CLONE_NEWUSER by
      default"
    - Adjust context in "firmware: Remove redundant log messages from drivers"
    - Adjust context in "intel-iommu: Add option to exclude integrated GPU
      only"
    - Adjust context in "intel-iommu: Add Kconfig option to exclude iGPU by
      default"
    - Adjust context in "x86: Make x32 syscall support conditional on a kernel
      parameter"
  * [ia64] Drop all ia64 configs due to upstream dropping IA64 arch
  * d/config: Update with the help of kconfigeditor2:
    - Remove XZ_DEC_IA64
    - Remove DEV_APPLETALK, IPDDP and IPDDP_ENCAP
    - Remove RTL8192U
    - Remove MODULE_SIG_SHA1, MODULE_SIG_SHA224
    - Replace BCACHE_CLOSURES_DEBUG with DEBUG_CLOSURES
    - Remove BTRFS_FS_CHECK_INTEGRITY
    - Remove EEPROM_LEGACY
    - Remove MTD_AR7_PARTS
    - Remove QLGE
    - Replace SCSI_IZIP_EPP16 with SCSI_IMM
    - Remove AMD_IOMMU_V2
    - Replace SND_SOC_INTEL_SOF_DA7219_MAX98373_MACH with
      SND_SOC_INTEL_SOF_DA7219_MACH
  * [rt] Update to 6.7-rt6

  [ Bastian Blank ]
  * Generate separate package tests for every flavour.
  * Fix stripping of vmlinux binaries. (closes: #1059713)
  * Ignore vmlinux for shlibs. (closes: #1059676)
  * Drop not working selftests. (closes: #1059765)
  * Always build with CROSS_COMPILE set.
  * Run dh_movetousr also in signed images.
  * Fix some remaining cross build problems.

  [ Christian Göttsche ]
  * Enable MODULE_DECOMPRESS 

  [ Timothy Pearson ]
  * [ppc64] Build PowerNV PCIe hotplug driver as a module

  [ Aurelien Jarno ]
  * [riscv64] udeb: Add efi-modules and xfs-modules.

  [ Francesco Dolcini ]
  * [arm64] Add support for NXP i.MX8M PCIe
    - drivers/phy/freescale: Enable PHY_FSL_IMX8M_PCIE as module

 -- Bastian Blank <waldi@debian.org>  Mon, 08 Jan 2024 22:51:34 +0100

linux (6.6.15-2) unstable; urgency=medium

  * Revert upstream commit causing documentation build failure
    (Closes: #1063020)
    - Revert "docs: kernel_feat.py: fix potential command injection"

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 04 Feb 2024 21:28:21 +0100

linux (6.6.15-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.14
    - [x86] lib: Fix overflow when counting digits
    - [x86] mce/inject: Clear test status value
    - [arm64] EDAC/thunderx: Fix possible out-of-bounds string access
    - [powerpc*] add crtsavres.o to always-y instead of extra-y
    - [x86] Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram
    - [powerpc*] 44x: select I2C for CURRITUCK
    - [powerpc*] pseries/memhp: Fix access beyond end of drmem array
    - perf/arm-cmn: Fix HN-F class_occup_id events
    - drivers/perf: hisi: Fix some event id for HiSilicon UC pmu
    - [powerpc*] KVM: PPC: Book3S HV: Use accessors for VCPU registers
    - [powerpc*] KVM: PPC: Book3S HV: Introduce low level MSR accessor
    - [powerpc*] KVM: PPC: Book3S HV: Handle pending exceptions on guest entry
      with MSR_EE
    - [powerpc*] hv-gpci: Add return value check in
      affinity_domain_via_partition_show function
    - [powerpc*] rtas: Avoid warning on invalid token argument to sys_rtas()
    - [powerpc*] powernv: Add a null pointer check to scom_debug_init_one()
    - [powerpc*] powernv: Add a null pointer check in opal_event_init()
    - [powerpc*] powernv: Add a null pointer check in opal_powercap_init()
    - [powerpc*] imc-pmu: Add a null pointer check in update_events_in_group()
    - sched/fair: Update min_vruntime for reweight_entity() correctly
    - [x86] perf/x86/intel/uncore: Fix NULL pointer dereference issue in
      upi_fill_topology()
    - spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
    - ACPI: video: check for error while searching for backlight device parent
    - ACPI: LPIT: Avoid u32 multiplication overflow
    - KEYS: encrypted: Add check for strsep
    - spi: cadence-quadspi: add missing clk_disable_unprepare() in cqspi_probe()
    - [x86] platform/x86/intel/vsec: Fix xa_alloc memory leak
    - cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
    - calipso: fix memory leak in netlbl_calipso_add_pass()
    - efivarfs: force RO when remounting if SetVariable is not supported
    - efivarfs: Free s_fs_info on unmount
    - spi: sh-msiof: Enforce fixed DTDL for R-Car H3
    - ACPI: LPSS: Fix the fractional clock divider flags
    - ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the
      error
    - thermal: core: Fix NULL pointer dereference in zone registration error
      path
    - kunit: debugfs: Fix unchecked dereference in debugfs_print_results()
    - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
    - cpuidle: haltpoll: Do not enable interrupts when entering idle
    - drivers/thermal/loongson2_thermal: Fix incorrect PTR_ERR() judgment
    - selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
    - crypto: rsa - add a check for allocation failure
    - crypto: jh7110 - Correct deferred probe return
    - crypto: virtio - Handle dataq logic with tasklet
    - crypto: sa2ul - Return crypto_aead_setkey to transfer the error
    - [x86] crypto: ccp - fix memleak in ccp_init_dm_workarea
    - crypto: af_alg - Disallow multiple in-flight AIO requests
    - crypto: safexcel - Add error handling for dma_map_sg() calls
    - crypto: hisilicon/qm - save capability registers in qm init process
    - crypto: hisilicon/zip - add zip comp high perf mode configuration
    - crypto: hisilicon/qm - add a function to set qm algs
    - crypto: hisilicon/hpre - save capability registers in probe process
    - crypto: hisilicon/sec2 - save capability registers in probe process
    - crypto: hisilicon/zip - save capability registers in probe process
    - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
    - erofs: fix memory leak on short-lived bounced pages
    - fs: indicate request originates from old mount API
    - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
    - gfs2: fix kernel BUG in gfs2_quota_cleanup
    - dlm: fix format seq ops type 4
    - crypto: virtio - Wait for tasklet to complete on device remove
    - crypto: scomp - fix req->dst buffer overflow
    - csky: fix arch_jump_label_transform_static override
    - blocklayoutdriver: Fix reference leak of pnfs_device_node
    - NFS: Use parent's objective cred in nfs_access_login_time()
    - NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
    - SUNRPC: fix _xprt_switch_find_current_entry logic
    - pNFS: Fix the pnfs block driver's calculation of layoutget size
    - asm-generic: Fix 32 bit __generic_cmpxchg_local
    - [arm64] dts: qcom: qrb4210-rb2: don't force usb peripheral mode
    - [arm64] dts: qcom: sc8280xp-x13s: Use the correct DP PHY compatible
    - [arm64] dts: qcom: sc8280xp-x13s: add missing camera LED pin config
    - wifi: plfxlc: check for allocation failure in plfxlc_usb_wreq_async()
    - wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
    - bpf, lpm: Fix check prefixlen before walking trie
    - bpf: Add crosstask check to __bpf_get_stack
    - wifi: ath11k: Defer on rproc_get failure
    - wifi: libertas: stop selecting wext
    - net/ncsi: Fix netlink major/minor version numbers
    - [arm64] firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
    - scsi: bfa: Use the proper data type for BLIST flags
    - wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
    - [arm64] dts: ti: k3-am62a-main: Fix GPIO pin count in DT nodes
    - [arm64] dts: ti: k3-am65-main: Fix DSS irq trigger type
    - [arm64] dts: ti: iot2050: Re-add aliases
    - wifi: rtw88: sdio: Honor the host max_req_size in the RX path
    - md: synchronize flush io with array reconfiguration
    - bpf: enforce precision of R0 on callback return
    - dt-bindings: arm: qcom: Fix html link
    - [arm64] dts: qcom: sc8180x-primus: Fix HALL_INT polarity
    - [arm64] dts: qcom: sm8450: correct TX Soundwire clock
    - [arm64] dts: qcom: sm8550: correct TX Soundwire clock
    - [arm64] dts: qcom: sc7180: Make watchdog bark interrupt edge triggered
    - [arm64] dts: qcom: sc7280: Mark some nodes as 'reserved'
    - [arm64] dts: qcom: sc7280: Make watchdog bark interrupt edge triggered
    - [arm64] dts: qcom: sdm845: Make watchdog bark interrupt edge triggered
    - [arm64] dts: qcom: sm8150: Make watchdog bark interrupt edge triggered
    - [arm64] dts: qcom: sm8250: Make watchdog bark interrupt edge triggered
    - [arm64] dts: qcom: sa8775p: Make watchdog bark interrupt edge triggered
    - [arm64] dts: qcom: sc8280xp: Make watchdog bark interrupt edge triggered
    - [arm64] dts: qcom: sm6350: Make watchdog bark interrupt edge triggered
    - bpf: Add map and need_defer parameters to .map_fd_put_ptr()
    - bpf: Defer the free of inner map when necessary
    - bpf: fix check for attempt to corrupt spilled pointer
    - scsi: fnic: Return error if vmalloc() failed
    - [arm64] dts: qcom: qrb2210-rb1: Hook up USB3
    - [arm64] dts: qcom: qrb2210-rb1: use USB host mode
    - [arm64] dts: qcom: qrb5165-rb5: correct LED panic indicator
    - [arm64] dts: qcom: sdm845-db845c: correct LED panic indicator
    - [arm64] dts: qcom: sm6125: add interrupts to DWC3 USB controller
    - [arm64] dts: qcom: sm8350: Fix DMA0 address
    - [arm64] dts: qcom: sc7280: Fix up GPU SIDs
    - [arm64] dts: qcom: sc7280: Mark Adreno SMMU as DMA coherent
    - [arm64] dts: qcom: sa8775p: fix USB wakeup interrupt types
    - [arm64] dts: qcom: sc7280: fix usb_2 wakeup interrupt types
    - [arm64] dts: qcom: sm8550: fix USB wakeup interrupt types
    - wifi: mt76: fix typo in mt76_get_of_eeprom_from_nvmem function
    - wifi: mt76: mt7915: fallback to non-wed mode if platform_get_resource
      fails in mt7915_mmio_wed_init()
    - wifi: mt76: mt7996: fix the size of struct bss_rate_tlv
    - wifi: mt76: mt7996: fix rate usage of inband discovery frames
    - wifi: mt76: mt7915: fix EEPROM offset of TSSI flag on MT7981
    - wifi: mt76: mt7915: also MT7981 is 3T3R but nss2 on 5 GHz band
    - wifi: mt76: mt7921s: fix workqueue problem causes STA association fail
    - bpf: Fix verification of indirect var-off stack access
    - [arm64] dts: hisilicon: hikey970-pmic: fix regulator cells properties
    - bpf: Guard stack limits against 32bit overflow
    - bpf: Fix accesses to uninit stack slots
    - dt-bindings: media: mediatek: mdp3: correct RDMA and WROT node with
      generic names
    - wifi: mt76: mt7921: fix country count limitation for CLC
    - wifi: iwlwifi: don't support triggered EHT CQI feedback
    - block: Set memalloc_noio to false on device_add_disk() error path
    - [arm64] dts: xilinx: Apply overlays to base dtbs
    - [arm64] dts: renesas: white-hawk-cpu: Fix missing serial console pin
      control
    - [arm64] dts: imx8mm: Reduce GPU to nominal speed
    - scsi: ufs: qcom: Fix the return value of ufs_qcom_ice_program_key()
    - scsi: ufs: qcom: Fix the return value when platform_get_resource_byname()
      fails
    - [arm64] scsi: hisi_sas: Replace with standard error code return value
    - [arm64] scsi: hisi_sas: Check before using pointer variables
    - [arm64] scsi: hisi_sas: Rollback some operations if FLR failed
    - [arm64] scsi: hisi_sas: Correct the number of global debugfs registers
    - [armhf] dts: stm32: don't mix SCMI and non-SCMI board compatibles
    - bpf: Fix a race condition between btf_put() and map_free()
    - ipmr: support IP_PKTINFO on cache report IGMP msg
    - virtio/vsock: fix logic which reduces credit update messages
    - virtio/vsock: send credit update during setting SO_RCVLOWAT
    - dma-mapping: clear dev->dma_mem to NULL after freeing it
    - bpf: Limit the number of uprobes when attaching program to multiple
      uprobes
    - bpf: Limit the number of kprobes when attaching program to multiple
      kprobes
    - [arm64] dts: qcom: acer-aspire1: Correct audio codec definition
    - soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration
    - [arm64] dts: qcom: sm6375: fix USB wakeup interrupt types
    - [arm64] dts: qcom: sm6375: Hook up MPM
    - [arm64] dts: qcom: sm8150: make dispcc cast minimal vote on MMCX
    - [arm64] dts: qcom: sm8150-hdk: fix SS USB regulators
    - soc: qcom: llcc: Fix LLCC_TRP_ATTR2_CFGn offset
    - block: add check of 'minors' and 'first_minor' in device_add_disk()
    - [arm64] dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent
    - [arm64] dts: qcom: ipq6018: fix clock rates for GCC_USB0_MOCK_UTMI_CLK
    - [arm64] dts: qcom: sm8550: Separate out X3 idle state
    - [arm64] dts: qcom: sm8550: Update idle state time requirements
    - [arm64] dts: qcom: sc8180x: Mark PCIe hosts cache-coherent
    - [arm64] dts: qcom: sc8180x: switch PCIe QMP PHY to new style of bindings
    - [arm64] dts: qcom: sc8180x: Fix up PCIe nodes
    - bpf: Re-enable unit_size checking for global per-cpu allocator
    - bpf: Use pcpu_alloc_size() in bpf_mem_free{_rcu}()
    - bpf: Use c->unit_size to select target cache during free
    - wifi: rtlwifi: add calculate_bit_shift()
    - wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
    - wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request
    - wifi: iwlwifi: mvm: send TX path flush in rfkill
    - wifi: iwlwifi: fix out of bound copy_from_user
    - wifi: iwlwifi: assign phy_ctxt before eSR activation
    - netfilter: nf_tables: mark newset as dead on transaction abort
    - netfilter: nf_tables: validate chain type update if available
    - Bluetooth: Fix bogus check for re-auth no supported with non-ssp
    - Bluetooth: btnxpuart: fix recv_buf() return value
    - Bluetooth: btmtkuart: fix recv_buf() return value
    - null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS
    - [arm64] dts: rockchip: Fix led pinctrl of lubancat 1
    - wifi: cfg80211: correct comment about MLD ID
    - wifi: cfg80211: parse all ML elements in an ML probe response
    - bpf: sockmap, fix proto update hook to avoid dup calls
    - sctp: support MSG_ERRQUEUE flag in recvmsg()
    - sctp: fix busy polling
    - blk-cgroup: fix rcu lockdep warning in blkg_lookup()
    - net/sched: act_ct: fix skb leak and crash on ooo frags
    - mlxbf_gige: Fix intermittent no ip issue
    - mlxbf_gige: Enable the GigE port in mlxbf_gige_open
    - rxrpc: Fix skbuff cleanup of call's recvmsg_queue and rx_oos_queue
    - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
    - ARM: davinci: always select CONFIG_CPU_ARM926T
    - Revert "drm/tidss: Annotate dma-fence critical section in commit path"
    - Revert "drm/omapdrm: Annotate dma-fence critical section in commit path"
    - drm/dp_mst: Fix fractional DSC bpp handling
    - [arm64,armhf] drm/panfrost: Really power off GPU cores in
      panfrost_gpu_power_off()
    - RDMA/usnic: Silence uninitialized symbol smatch warnings
    - [arm64] RDMA/hns: Fix inappropriate err code for unsupported operations
    - drm/panel: nv3051d: Hold panel in reset for unprepare
    - drm/panel-elida-kd35t133: hold panel in reset for unprepare
    - drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer
    - drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
    - drm/tilcdc: Fix irq free on unload
    - media: pvrusb2: fix use after free on context disconnection
    - media: mtk-jpeg: Remove cancel worker in mtk_jpeg_remove to avoid the
      crash of multi-core JPEG devices
    - media: visl: Hook the (TRY_)DECODER_CMD stateless ioctls
    - media: verisilicon: Hook the (TRY_)DECODER_CMD stateless ioctls
    - media: rkvdec: Hook the (TRY_)DECODER_CMD stateless ioctls
    - media: amphion: Fix VPU core alias name
    - drm/bridge: Fix typo in post_disable() description
    - f2fs: fix to avoid dirent corruption
    - drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
    - drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
    - drm/radeon: check return value of radeon_ring_lock()
    - drm/tidss: Move reset to the end of dispc_init()
    - drm/tidss: Return error value from from softreset
    - drm/tidss: Check for K2G in in dispc_softreset()
    - drm/tidss: Fix dss reset
    - drm/imx/lcdc: Fix double-free of driver data
    - [arm64] drm/msm/mdp4: flush vblank event on disable
    - [arm64] drm/msm/dpu: Add missing safe_lut_tbl in sc8180x catalog
    - [arm64] drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
    - drm/drv: propagate errors from drm_modeset_register_all()
    - media: v4l: async: Fix duplicated list deletion
    - [x86] ASoC: Intel: glk_rt5682_max98357a: fix board id mismatch
    - [x86] ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev =
      NULL
    - [x86] ASoC: SOF: topology: Use partial match for disconnecting DAI link
      and DAI widget
    - [arm64,armhf] drm/panfrost: Ignore core_mask for poweroff and disable
      PWRTRANS irq
    - [arm64] drm/msm/dpu: correct clk bit for WB2 block
    - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
    - drm/radeon/dpm: fix a memleak in sumo_parse_power_table
    - drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
    - drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable
    - drm/bridge: tc358767: Fix return value on error case
    - media: cx231xx: fix a memleak in cx231xx_init_isoc
    - [arm64] RDMA/hns: Fix memory leak in free_mr_init()
    - clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config
    - media: bttv: start_streaming should return a proper error code
    - media: bttv: add back vbi hack
    - media: imx-mipi-csis: Fix clock handling in remove()
    - media: imx-mipi-csis: Drop extra clock enable at probe()
    - media: dt-bindings: media: rkisp1: Fix the port description for the
      parallel interface
    - media: rkisp1: Fix media device memory leak
    - [arm64] drm/msm/adreno: Fix A680 chip id
    - drm/panel: st7701: Fix AVCL calculation
    - f2fs: fix to wait on block writeback for post_read case
    - f2fs: fix to check compress file in f2fs_move_file_range()
    - f2fs: fix to update iostat correctly in f2fs_filemap_fault()
    - media: dvbdev: drop refcount on error path in dvb_device_open()
    - media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling
      path of m88ds3103_probe()
    - clk: renesas: rzg2l-cpg: Reuse code in rzg2l_cpg_reset()
    - clk: renesas: rzg2l: Check reset monitor registers
    - [arm64] drm/msm/dpu: Set input_sel bit for INTF
    - [arm64] drm/msm/dpu: Drop enable and frame_count parameters from
      dpu_hw_setup_misr()
    - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
    - drm/amd/pm: fix a double-free in si_dpm_init
    - drivers/amd/pm: fix a use-after-free in kv_parse_power_table
    - gpu/drm/radeon: fix two memleaks in radeon_vm_init
    - drm/amd/pm: fix a double-free in amdgpu_parse_extended_power_table
    - f2fs: fix to check return value of f2fs_recover_xattr_data
    - dt-bindings: clock: Update the videocc resets for sm8150
    - clk: qcom: videocc-sm8150: Update the videocc resets
    - clk: qcom: videocc-sm8150: Add missing PLL config property
    - clk: sp7021: fix return value check in sp7021_clk_probe()
    - drivers: clk: zynqmp: calculate closest mux rate
    - drivers: clk: zynqmp: update divider round rate logic
    - watchdog: set cdev owner before adding
    - watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
    - watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
    - watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused
    - clk: rs9: Fix DIF OEn bit placement on 9FGV0241
    - clk: si5341: fix an error code problem in si5341_output_clk_set_rate
    - ASoC: amd: vangogh: Drop conflicting ACPI-based probing
    - ASoC: tas2781: add support for FW version 0x0503
    - accel/habanalabs: fix information leak in sec_attest_info()
      (CVE-2023-50431)
    - clk: qcom: gcc-sm8550: Add the missing RETAIN_FF_ENABLE GDSC flag
    - clk: qcom: gcc-sm8550: Mark the PCIe GDSCs votable
    - clk: qcom: gcc-sm8550: use collapse-voting for PCIe GDSCs
    - clk: qcom: gcc-sm8550: Mark RCGs shared where applicable
    - clk: qcom: dispcc-sm8550: Update disp PLL settings
    - clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw
    - pwm: stm32: Use hweight32 in stm32_pwm_detect_channels
    - pwm: stm32: Fix enable count for clk in .probe()
    - ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[]
    - ALSA: scarlett2: Add missing error check to scarlett2_config_save()
    - ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config()
    - ALSA: scarlett2: Allow passing any output to line_out_remap()
    - ALSA: scarlett2: Add missing error checks to *_ctl_get()
    - ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
    - mmc: sdhci_am654: Fix TI SoC dependencies
    - mmc: sdhci_omap: Fix TI SoC dependencies
    - gpiolib: make gpio_device_get() and gpio_device_put() public
    - gpiolib: provide gpio_device_find()
    - gpio: sysfs: drop the mention of gpiochip_find() from sysfs code
    - IB/iser: Prevent invalidating wrong MR
    - drm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in
      kfd_topology.c
    - drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init
    - drm/amd/display: avoid stringop-overflow warnings for
      dp_decide_lane_settings()
    - ksmbd: validate the zero field of packet header
    - of: Fix double free in of_parse_phandle_with_args_map
    - fbdev: imxfb: fix left margin setting
    - class: fix use-after-free in class_register()
    - kernfs: convert kernfs_idr_lock to an irq safe raw spinlock
    - Revert "kernfs: convert kernfs_idr_lock to an irq safe raw spinlock"
    - keys, dns: Fix size check of V1 server-list header
    - [arm*] binder: fix async space check for 0-sized buffers
    - [arm*] binder: fix unused alloc->free_async_space
    - [mips*] smp: Call rcutree_report_cpu_starting() earlier
    - Input: atkbd - use ab83 as id when skipping the getid command
    - rust: Ignore preserve-most functions
    - xen-netback: don't produce zero-size SKB frags (CVE-2023-46838)
    - [arm*] binder: fix race between mmput() and do_exit()
    - clocksource/drivers/timer-ti-dm: Fix make W=n kerneldoc warnings
    - [powerpc*] 64s: Increase default stack size to 32KB
    - tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
    - Revert "usb: gadget: f_uvc: change endpoint allocation in
      uvc_function_bind()"
    - usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
    - usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
    - usb: dwc3: gadget: Handle EP0 request dequeuing properly
    - usb: dwc3: gadget: Queue PM runtime idle on disconnect event
    - Revert "usb: dwc3: Soft reset phy on probe for host"
    - Revert "usb: dwc3: don't reset device side if dwc3 was configured as
      host-only"
    - usb: chipidea: wait controller resume finished for wakeup irq
    - usb: cdns3: fix uvc failure work since sg support enabled
    - usb: cdns3: fix iso transfer error when mult is not zero
    - usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled
    - Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
    - usb: typec: class: fix typec_altmode_put_partner to put plugs
    - usb: mon: Fix atomicity violation in mon_bin_vma_fault
    - dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: fix path to header
    - serial: core: fix sanitizing check for RTS settings
    - serial: core: make sure RS485 cannot be enabled when it is not supported
    - serial: 8250_bcm2835aux: Restore clock error handling
    - serial: core, imx: do not set RS485 enabled if it is not supported
    - serial: imx: Ensure that imx_uart_rs485_config() is called with enabled
      clock
    - serial: 8250_exar: Set missing rs485_supported flag
    - serial: omap: do not override settings for RS485 support
    - ALSA: oxygen: Fix right channel of capture volume mixer
    - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx
    - ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on HP
      ZBook
    - ALSA: hda/realtek: Enable headset mic on Lenovo M70 Gen5
    - ksmbd: validate mech token in session setup
    - ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
    - ksmbd: only v2 leases handle the directory
    - ceph: select FS_ENCRYPTION_ALGS if FS_ENCRYPTION
    - io_uring: don't check iopoll if request completes
    - io_uring/rw: ensure io->bytes_done is always initialized
    - io_uring: ensure local task_work is run on wait timeout
    - fbdev/acornfb: Fix name of fb_ops initializer macro
    - fbdev: flush deferred work in fb_deferred_io_fsync()
    - fbdev: flush deferred IO before closing
    - scsi: ufs: core: Simplify power management during async scan
    - scsi: target: core: add missing file_{start,end}_write()
    - scsi: mpi3mr: Refresh sdev queue depth after controller reset
    - scsi: mpi3mr: Clean up block devices post controller reset
    - scsi: mpi3mr: Block PEL Enable Command on Controller Reset and
      Unrecoverable State
    - drm/amd: Enable PCIe PME from D3
    - block: add check that partition length needs to be aligned with block size
    - block: Remove special-casing of compound pages
    - block: Fix iterating over an empty bio with bio_for_each_folio_all
    - netfilter: nf_tables: check if catch-all set element is active in next
      generation (CVE-2024-1085)
    - pwm: jz4740: Don't use dev_err_probe() in .request()
    - pwm: Fix out-of-bounds access in of_pwm_single_xlate()
    - md/raid1: Use blk_opf_t for read and write operations
    - rootfs: Fix support for rootfstype= when root= is given
    - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
    - bpf: Fix re-attachment branch in bpf_tracing_prog_attach
    - [arm64] iommu/arm-smmu-qcom: Add missing GMU entry to match table
    - iommu/dma: Trace bounce buffer usage when mapping buffers
    - wifi: mt76: fix broken precal loading from MTD for mt7915
    - wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
    - wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
    - wifi: mwifiex: add extra delay for firmware ready
    - wifi: mwifiex: configure BSSID consistently when starting AP
    - wifi: mwifiex: fix uninitialized firmware_stat
    - net: stmmac: fix ethtool per-queue statistics
    - Revert "net: rtnetlink: Enslave device before bringing it up"
    - Revert "nSVM: Check for reserved encodings of TLB_CONTROL in nested VMCB"
    - cxl/port: Fix decoder initialization when nr_targets > interleave_ways
    - PCI/P2PDMA: Remove reference to pci_p2pdma_map_sg()
    - [x86] pci: Reserve ECAM if BIOS didn't include it in PNP0C02 _CRS
    - PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
    - PCI: mediatek: Clear interrupt status before dispatching handler
    - [x86] kvm: Do not try to disable kvmclock if it was not enabled
    - [arm64] KVM: arm64: vgic-v4: Restore pending state on host userspace write
    - [arm64] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
    - [x86] KVM: x86/pmu: Move PMU reset logic to common x86 code
    - [x86] KVM: x86/pmu: Reset the PMU, i.e. stop counters, before refreshing
    - iio: adc: ad7091r: Pass iio_dev to event handler
    - HID: sensor-hub: Enable hid core report processing for all devices
    - HID: wacom: Correct behavior when processing some confidence == false
      touches
    - serial: sc16is7xx: add check for unsupported SPI modes during probe
    - serial: sc16is7xx: set safe default SPI clock frequency
    - mfd: rk8xx: fixup devices registration with PLATFORM_DEVID_AUTO
    - mfd: cs42l43: Correct SoundWire port list
    - mfd: syscon: Fix null pointer dereference in of_syscon_register()
    - leds: aw2013: Select missing dependency REGMAP_I2C
    - leds: aw200xx: Fix write to DIM parameter
    - mfd: tps6594: Add null pointer check to tps6594_device_init()
    - mfd: intel-lpss: Fix the fractional clock divider flags
    - srcu: Use try-lock lockdep annotation for NMI-safe access.
    - [mips*] dmi: Fix early remap on MIPS32
    - [mips64el] Fix incorrect max_low_pfn adjustment
    - [riscv64] Check if the code to patch lies in the exit section
    - [riscv64] Fix module_alloc() that did not reset the linear mapping
      permissions
    - [riscv64] Fix set_memory_XX() and set_direct_map_XX() by splitting huge
      linear mappings
    - [riscv64] Fix set_direct_map_default_noflush() to reset _PAGE_EXEC
    - [riscv64] Fixed wrong register in XIP_FIXUP_FLASH_OFFSET macro
    - power: supply: cw2015: correct time_to_empty units in sysfs
    - power: supply: bq256xx: fix some problem in bq256xx_hw_init
    - PCI: Avoid potential out-of-bounds read in pci_dev_for_each_resource()
    - serial: 8250: omap: Don't skip resource freeing if
      pm_runtime_resume_and_get() failed
    - iommu: Map reserved memory as cacheable if device is coherent
    - perf test: Remove atomics from test_loop to avoid test failures
    - perf header: Fix segfault on build_mem_topology() error path
    - libapi: Add missing linux/types.h header to get the __u64 type on io.h
    - perf test record user-regs: Fix mask for vg register
    - vfio/pds: Fix calculations in pds_vfio_dirty_sync
    - perf vendor events arm64 AmpereOne: Rename BPU_FLUSH_MEM_FAULT to
      GPC_FLUSH_MEM_FAULT
    - perf mem: Fix error on hybrid related to availability of mem event in a
      PMU
    - perf stat: Exit perf stat if parse groups fails
    - base/node.c: initialize the accessor list before registering
    - acpi: property: Let args be NULL in __acpi_node_get_property_reference
    - software node: Let args be NULL in software_node_get_reference_args
    - serial: imx: fix tx statemachine deadlock
    - iio: adc: ad9467: fix reset gpio handling
    - iio: adc: ad9467: don't ignore error codes
    - iio: adc: ad9467: add mutex to struct ad9467_state
    - iio: adc: ad9467: fix scale setting
    - perf header: Fix one memory leakage in perf_event__fprintf_event_update()
    - perf hisi-ptt: Fix one memory leakage in hisi_ptt_process_auxtrace_event()
    - perf genelf: Set ELF program header addresses properly
    - perf unwind-libdw: Handle JIT-generated DSOs properly
    - perf unwind-libunwind: Fix base address for .eh_frame
    - bus: mhi: ep: Do not allocate event ring element on stack
    - bus: mhi: ep: Use slab allocator where applicable
    - bus: mhi: ep: Pass mhi_ep_buf_info struct to read/write APIs
    - PCI: epf-mhi: Fix the DMA data direction of dma_unmap_single()
    - tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK
    - tty: don't check for signal_pending() in send_break()
    - tty: use 'if' in send_break() instead of 'goto'
    - usb: cdc-acm: return correct error code on unsupported break
    - spmi: mtk-pmif: Serialize PMIF status check and command submission
    - usb: gadget: webcam: Make g_webcam loadable again
    - iommu: Don't reserve 0-length IOVA region
    - power: supply: Fix null pointer dereference in smb2_probe
    - vdpa: Fix an error handling path in eni_vdpa_probe()
    - apparmor: Fix ref count leak in task_kill
    - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
    - nvmet-tcp: fix a crash in nvmet_req_complete()
    - perf env: Avoid recursively taking env->bpf_progs.lock
    - perf stat: Fix hard coded LL miss units
    - cxl/region: fix x9 interleave typo
    - apparmor: fix possible memory leak in unpack_trans_table
    - apparmor: avoid crash when parsed profile name is empty
    - usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer
    - serial: imx: Correct clock error message in function probe()
    - serial: apbuart: fix console prompt on qemu
    - perf db-export: Fix missing reference count get in call_path_from_sample()
    - cxl/port: Fix missing target list lock
    - spi: coldfire-qspi: Remove an erroneous clk_disable_unprepare() from the
      remove function
    - hisi_acc_vfio_pci: Update migration data pointer correctly on
      saving/resume
    - nvmet: re-fix tracing strncpy() warning
    - nvme: trace: avoid memcpy overflow warning
    - nvmet-tcp: Fix the H2C expected PDU len calculation
    - PCI: keystone: Fix race condition when initializing PHYs
    - PCI: mediatek-gen3: Fix translation window size calculation
    - [s390x] pci: fix max size calculation in zpci_memcpy_toio()
    - net: qualcomm: rmnet: fix global oob in rmnet_policy
    - rxrpc: Fix use of Don't Fragment flag
    - net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames
    - amt: do not use overwrapped cb area
    - net: micrel: Fix PTP frame parsing for lan8841
    - net: phy: micrel: populate .soft_reset for KSZ9131
    - ALSA: hda: Properly setup HDMI stream
    - mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN
    - mptcp: strict validation before using mp_opt->hmac
    - mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
    - mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req()
    - mptcp: refine opt_mp_capable determination
    - block: ensure we hold a queue reference when using queue limits
    - net: stmmac: Fix ethool link settings ops for integrated PCS
    - udp: annotate data-races around up->pending
    - erofs: simplify compression configuration parser
    - erofs: fix inconsistent per-file compression format
    - net: add more sanity check in virtio_net_hdr_to_skb()
    - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition
    - bpf: iter_udp: Retry with a larger batch size without going back to the
      previous bucket
    - bpf: Avoid iter->offset making backward progress in bpf_iter_udp
    - net: tls, fix WARNIING in __sk_msg_free
    - net: ravb: Fix dma_addr_t truncation in error case
    - dt-bindings: gpio: xilinx: Fix node address in gpio
    - gpio: mlxbf3: add an error code check in mlxbf3_gpio_probe
    - [x86] ASoC: SOF: ipc4-loader: remove the CPC check warnings
    - drm/amdgpu: fall back to INPUT power for AVG power via INFO IOCTL
    - net: stmmac: ethtool: Fixed calltrace caused by unbalanced
      disable_irq_wake calls
    - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
    - net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
    - mptcp: relax check on MPC passive fallback
    - net: netdevsim: don't try to destroy PHC on VFs
    - netfilter: nf_tables: reject invalid set policy
    - netfilter: nft_limit: do not ignore unsupported flags
    - netfilter: nfnetlink_log: use proper helper for fetching physinif
    - netfilter: nf_queue: remove excess nf_bridge variable
    - netfilter: propagate net to nf_bridge_get_physindev
    - netfilter: bridge: replace physindev with physinif in nf_bridge_info
    - netfilter: nf_tables: do not allow mismatch field size and set key length
    - netfilter: nf_tables: skip dead set elements in netlink dump
    - netfilter: nf_tables: reject NFT_SET_CONCAT with not field length
      description
    - ipvs: avoid stat macros calls from preemptible context
    - io_uring: adjust defer tw counting
    - kdb: Fix a potential buffer overflow in kdb_local()
    - [arm64] ptrace: Don't flush ZA/ZT storage when writing ZA via ptrace
    - ethtool: netlink: Add missing ethnl_ops_begin/complete
    - loop: fix the the direct I/O support check when used on top of block
      devices
    - ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
    - i2c: s3c24xx: fix read transfers in polling mode
    - i2c: s3c24xx: fix transferring more than one message in polling mode
    - [riscv64] Fix wrong usage of lm_alias() when splitting a huge linear
      mapping
    - Revert "KEYS: encrypted: Add check for strsep"
    - [arm64] dts: armada-3720-turris-mox: set irq type for RTC
    - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.15
    - docs: sparse: move TW sparse.txt to TW dev-tools
    - docs: sparse: add sparse.rst to toctree
    - docs: kernel_feat.py: fix potential command injection
    - serial: core: Simplify uart_get_rs485_mode()
    - serial: core: set missing supported flag for RX during TX GPIO
    - soundwire: bus: introduce controller_id
    - soundwire: fix initializing sysfs for same devices on different buses
    - net: stmmac: Tx coe sw fallback
    - net: stmmac: Prevent DSA tags from breaking COE
    - iio: adc: ad7091r: Set alert bit in config register
    - iio: adc: ad7091r: Allow users to configure device events
    - iio: adc: ad7091r: Enable internal vref if external vref is not supplied
    - dmaengine: fsl-edma: fix eDMAv4 channel allocation issue
    - dmaengine: fix NULL pointer in channel unregistration function
    - dmaengine: idxd: Move dma_free_coherent() out of spinlocked context
    - scsi: ufs: core: Remove the ufshcd_hba_exit() call from
      ufshcd_async_scan()
    - [riscv64] Fix an off-by-one in get_early_cmdline()
    - scsi: core: Kick the requeue list after inserting when flushing
    - smb: client: fix parsing of SMB3.1.1 POSIX create context
    - cifs: handle cases where a channel is closed
    - cifs: reconnect work should have reference on server struct
    - cifs: handle when server starts supporting multichannel
    - cifs: handle when server stops supporting multichannel
    - Revert "cifs: reconnect work should have reference on server struct"
    - cifs: reconnect worker should take reference on server struct
      unconditionally
    - cifs: handle servers that still advertise multichannel after disabling
    - cifs: update iface_last_update on each query-and-update
    - ext4: allow for the last group to be marked as trimmed
    - async: Split async_schedule_node_domain()
    - async: Introduce async_schedule_dev_nocall()
    - PM: sleep: Fix possible deadlocks in core system-wide PM code
    - OPP: Pass rounded rate to _set_opp()
    - btrfs: sysfs: validate scrub_speed_max value
    - crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
    - erofs: fix lz4 inplace decompression
    - crypto: api - Disallow identical driver names
    - PM: hibernate: Enforce ordering during image compression/decompression
    - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
    - [s390x] crypto: s390/aes - Fix buffer overread in CTR mode
    - [s390x] vfio-ap: unpin pages on gisc registration failure
    - PM / devfreq: Fix buffer overflow in trans_stat_show
    - mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
    - mtd: rawnand: Prevent crossing LUN boundaries during sequential reads
    - mtd: rawnand: Fix core interference with sequential reads
    - mtd: rawnand: Prevent sequential reads with on-die ECC engines
    - mtd: rawnand: Clarify conditions to enable continuous reads
    - soc: qcom: pmic_glink_altmode: fix port sanity check
    - media: imx355: Enable runtime PM before registering async sub-device
    - media: ov9734: Enable runtime PM before registering async sub-device
    - media: ov13b10: Enable runtime PM before registering async sub-device
    - media: ov01a10: Enable runtime PM before registering async sub-device
    - soc: fsl: cpm1: tsa: Fix __iomem addresses declaration
    - soc: fsl: cpm1: qmc: Fix __iomem addresses declaration
    - soc: fsl: cpm1: qmc: Fix rx channel reset
    - [s390x] vfio-ap: always filter entire AP matrix
    - [s390x] vfio-ap: loop over the shadow APCB when filtering guest's AP
      configuration
    - [s390x] vfio-ap: let on_scan_complete() callback filter matrix and update
      guest's APCB
    - [s390x] vfio-ap: reset queues filtered from the guest's AP config
    - [s390x] vfio-ap: reset queues associated with adapter for queue unbound
      from driver
    - [s390x] vfio-ap: do not reset queue removed from host config
    - nbd: always initialize struct msghdr completely
    - [mips*] Fix max_mapnr being uninitialized on early stages
    - bus: mhi: host: Add alignment check for event ring read pointer
    - bus: mhi: host: Drop chan lock before queuing buffers
    - bus: mhi: host: Add spinlock to protect WP access when queueing TREs
    - [armhf] dts: imx6q-apalis: add can power-up delay on ixora board
    - [arm64] dts: qcom: sc8280xp-crd: fix eDP phy compatible
    - [armhf] dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
    - [arm64] dts: rockchip: configure eth pad driver strength for orangepi r1
      plus lts
    - [arm64] dts: rockchip: Fix rk3588 USB power-domain clocks
    - [arm64] dts: qcom: msm8916: Make blsp_dma controlled-remotely
    - [arm64] dts: qcom: msm8939: Make blsp_dma controlled-remotely
    - [arm64] dts: qcom: sc7180: fix USB wakeup interrupt types
    - [arm64] dts: qcom: sdm845: fix USB wakeup interrupt types
    - [arm64] dts: qcom: sdm670: fix USB wakeup interrupt types
    - [arm64] dts: qcom: sm8150: fix USB wakeup interrupt types
    - [arm64] dts: qcom: sc8180x: fix USB wakeup interrupt types
    - [arm64] dts: qcom: sc7280: fix usb_1 wakeup interrupt types
    - [arm64] dts: qcom: Add missing vio-supply for AW2013
    - [arm64] dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
    - [arm64] dts: qcom: sdm845: fix USB SS wakeup
    - [arm64] dts: qcom: sm8150: fix USB DP/DM HS PHY interrupts
    - [arm64] dts: qcom: sm8150: fix USB SS wakeup
    - [arm64] dts: qcom: sc8180x: fix USB DP/DM HS PHY interrupts
    - [arm64] dts: qcom: sc8180x: fix USB SS wakeup
    - [arm64] dts: qcom: sdm670: fix USB DP/DM HS PHY interrupts
    - [arm64] dts: qcom: sdm670: fix USB SS wakeup
    - lsm: new security_file_ioctl_compat() hook
    - dlm: use kernel_connect() and kernel_bind()
    - docs: kernel_abi.py: fix command injection
    - scripts/get_abi: fix source path leak
    - media: videobuf2-dma-sg: fix vmap callback
    - mmc: core: Use mrq.sbc in close-ended ffu
    - mmc: mmc_spi: remove custom DMA mapped buffers
    - media: i2c: st-mipid02: correct format propagation
    - media: mtk-jpeg: Fix timeout schedule error in mtk_jpegdec_worker.
    - media: mtk-jpeg: Fix use after free bug due to error path handling in
      mtk_jpeg_dec_device_run
    - [riscv64] mm: Fixup compat arch_get_mmap_end
    - [riscv64] mm: Fixup compat mode boot failure
    - [arm64] Rename ARM64_WORKAROUND_2966298
    - [arm64] errata: Add Cortex-A510 speculative unprivileged load workaround
    - [arm64] sme: Always exit sme_alloc() early with existing storage
    - [arm64] entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD
    - rtc: cmos: Use ACPI alarm for non-Intel x86 systems too
    - rtc: Adjust failure return code for cmos_set_alarm()
    - rtc: mc146818-lib: Adjust failure return code for mc146818_get_time()
    - rtc: Add support for configuring the UIP timeout for RTC reads
    - rtc: Extend timeout for waiting for UIP to clear to 1s
    - nouveau/vmm: don't set addr on the fail path to avoid warning
    - efi: disable mirror feature during crashkernel
    - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
    - selftests: mm: hugepage-vmemmap fails on 64K page size systems
    - mm/rmap: fix misplaced parenthesis of a likely()
    - mm/sparsemem: fix race in accessing memory_section->usage
    - rename(): fix the locking of subdirectories
    - serial: sc16is7xx: improve regmap debugfs by using one regmap per port
    - serial: sc16is7xx: remove wasteful static buffer in
      sc16is7xx_regmap_name()
    - serial: sc16is7xx: remove global regmap from struct sc16is7xx_port
    - serial: sc16is7xx: remove unused line structure member
    - serial: sc16is7xx: change EFR lock to operate on each channels
    - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
    - serial: sc16is7xx: fix invalid sc16is7xx_lines bitfield in case of probe
      error
    - serial: sc16is7xx: remove obsolete loop in sc16is7xx_port_irq()
    - serial: sc16is7xx: improve do/while loop in sc16is7xx_irq()
    - mm: page_alloc: unreserve highatomic page blocks before oom
    - serial: Do not hold the port lock when setting rx-during-tx GPIO
    - ksmbd: set v2 lease version on lease upgrade
    - ksmbd: fix potential circular locking issue in smb2_set_ea()
    - ksmbd: don't increment epoch if current state and request state are same
    - ksmbd: send lease break notification on FILE_RENAME_INFORMATION
    - ksmbd: Add missing set_freezable() for freezable kthread
    - dt-bindings: net: snps,dwmac: Tx coe unsupported
    - bpf: move explored_state() closer to the beginning of verifier.c
    - bpf: extract same_callsites() as utility function
    - bpf: exact states comparison for iterator convergence checks
    - bpf: correct loop detection for iterators convergence
    - bpf: print full verifier states on infinite loop detection
    - bpf: extract __check_reg_arg() utility function
    - bpf: extract setup_func_entry() utility function
    - bpf: verify callbacks as if they are called unknown number of times
    - bpf: widening for callback iterators
    - bpf: keep track of max number of bpf_loop callback iterations
    - Revert "drm/amd: Enable PCIe PME from D3"
    - cifs: fix lock ordering while disabling multichannel
    - cifs: fix a pending undercount of srv_count
    - cifs: after disabling multichannel, mark tcon for reconnect
    - SUNRPC: use request size to initialize bio_vec in svc_udp_sendto()
    - wifi: mac80211: fix potential sta-link leak
    - net/smc: fix illegal rmb_desc access in SMC-D connection dump
    - tcp: make sure init the accept_queue's spinlocks once
    - bnxt_en: Wait for FLR to complete during probe
    - bnxt_en: Prevent kernel warning when running offline self test
    - vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
    - llc: make llc_ui_sendmsg() more robust against bonding changes
    - llc: Drop support for ETH_P_TR_802_2.
    - udp: fix busy polling
    - net: fix removing a namespace with conflicting altnames
    - tun: fix missing dropped counter in tun_xdp_act
    - tun: add missing rx stats accounting in tun_xdp_act
    - net: micrel: Fix PTP frame parsing for lan8814
    - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
    - netfs, fscache: Prevent Oops in fscache_put_cache()
    - tracing: Ensure visibility when inserting an element into tracing_map
    - afs: Hide silly-rename files from userspace
    - tcp: Add memory barrier to tcp_push()
    - netlink: fix potential sleeping issue in mqueue_flush_file
    - ipv6: init the accept_queue's spinlocks in inet6_create
    - net/sched: flower: Fix chain template offload
    - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll
      context
    - net/mlx5e: Fix peer flow lists handling
    - net/mlx5: Fix a WARN upon a callback command failure
    - net/mlx5: Bridge, Enable mcast in smfs steering mode
    - net/mlx5: Bridge, fix multicast packets sent to uplink
    - net/mlx5: DR, Use the right GVMI number for drop action
    - net/mlx5: DR, Can't go to uplink vport on RX rule
    - net/mlx5: Use mlx5 device constant for selecting CQ period mode for ASO
    - net/mlx5e: Allow software parsing when IPsec crypto is enabled
    - net/mlx5e: Ignore IPsec replay window values on sender side
    - net/mlx5e: fix a double-free in arfs_create_groups
    - net/mlx5e: fix a potential double-free in fs_any_create_groups
    - rcu: Defer RCU kthreads wakeup when CPU is dying
    - netfilter: nft_limit: reject configurations that cause integer overflow
    - netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
    - netfilter: nf_tables: validate NFPROTO_* family
    - net: stmmac: Wait a bit for the reset to take effect
    - net: mvpp2: clear BM pool before initialization
    - xsk: recycle buffer in case Rx queue was full
    - xsk: make xsk_buff_pool responsible for clearing xdp_buff::flags
    - bpf: Propagate modified uaddrlen from cgroup sockaddr programs
    - bpf: Add bpf_sock_addr_set_sun_path() to allow writing unix sockaddr from
      bpf
    - xsk: fix usage of multi-buffer BPF helpers for ZC XDP
    - ice: work on pre-XDP prog frag count
    - i40e: handle multi-buffer packets that are shrunk by xdp prog
    - ice: remove redundant xdp_rxq_info registration
    - [x86] intel: xsk: initialize skb_frag_t::bv_offset in ZC drivers
    - ice: update xdp_rxq_info::frag_size for ZC enabled Rx queue
    - xdp: reflect tail increase for MEM_TYPE_XSK_BUFF_POOL
    - i40e: set xdp_rxq_info::frag_size
    - i40e: update xdp_rxq_info::frag_size for ZC enabled Rx queue
    - fjes: fix memleaks in fjes_hw_setup
    - net: fec: fix the unhandled context fault from smmu
    - tsnep: Remove FCS for XDP data path
    - tsnep: Fix XDP_RING_NEED_WAKEUP for empty fill ring
    - btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned
    - btrfs: zoned: fix lock ordering in btrfs_zone_activate()
    - btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume
      being deleted
    - btrfs: ref-verify: free ref cache before clearing mount opt
    - btrfs: tree-checker: fix inline ref size in error messages
    - btrfs: don't warn if discard range is not aligned to sector
    - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
    - btrfs: don't abort filesystem when attempting to snapshot deleted
      subvolume
    - rbd: don't move requests to the running list on errors
    - exec: Fix error handling in begin_new_exec()
    - wifi: iwlwifi: fix a memory corruption
    - nfsd: fix RELEASE_LOCKOWNER
    - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes
    - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress
      basechain
    - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-1086)
    - [x86] platform/x86: intel-uncore-freq: Fix types in sysfs callbacks
    - [x86] platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe
    - ksmbd: fix global oob in ksmbd_nl_policy
    - firmware: arm_scmi: Check mailbox/SMT channel for consistency
    - Revert "drivers/firmware: Move sysfb_init() from device_initcall to
      subsys_initcall_sync"
    - drm/amdgpu: Fix the null pointer when load rlc firmware
    - xfs: read only mounts with fsopen mount API are busted
    - gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
    - [x86] cpufreq: intel_pstate: Refine computation of P-state for given
      frequency
    - [x86] Revert "drm/i915/dsi: Do display on sequence later on icl+"
    - drm: Don't unref the same fb many times by mistake due to deadlock
      handling
    - drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
    - drm: Fix TODO list mentioning non-KMS drivers
    - drm/tidss: Fix atomic_flush check
    - drm: Disable the cursor plane on atomic contexts with virtualized drivers
    - drm/virtio: Disable damage clipping if FB changed since last page-flip
    - drm: Allow drivers to indicate the damage helpers to ignore damage clips
    - drm/amd/display: fix bandwidth validation failure on DCN 2.1
    - drm/amd/display: Disable PSR-SU on Parade 0803 TCON again
    - Revert "drm/amd/display: fix bandwidth validation failure on DCN 2.1"
    - drm/bridge: nxp-ptn3460: simplify some error checking
    - drm/amdgpu: correct the cu count for gfx v11
    - drm/amd/display: Fix variable deferencing before NULL check in
      edp_setup_replay()
    - drm/amd/display: Port DENTIST hang and TDR fixes to OTG disable W/A
    - drm/amd/display: Align the returned error code with legacy DP
    - drm/amd/display: Fix late derefrence 'dsc' check in
      'link_set_dsc_pps_packet()'
    - drm/amdgpu/pm: Fix the power source flag error
    - drm/amd/display: Fix uninitialized variable usage in core_link_
      'read_dpcd() & write_dpcd()' functions
    - net/bpf: Avoid unused "sin_addr_len" warning when CONFIG_CGROUP_BPF is not
      set
    - [x86] thermal: intel: hfi: Refactor enabling code into helper functions
    - [x86] thermal: intel: hfi: Disable an HFI instance when all its CPUs go
      offline
    - [x86] thermal: intel: hfi: Add syscore callbacks for system-wide PM
    - fs/pipe: move check to pipe_has_watch_queue()
    - pipe: wakeup wr_wait after setting max_usage
    - media: v4l: cci: Include linux/bits.h
    - media: v4l: cci: Add macros to obtain register width and address
    - media: v4l2-cci: Add support for little-endian encoded registers
    - media: i2c: imx290: Properly encode registers as little-endian
    - thermal: trip: Drop redundant trips check from for_each_thermal_trip()
    - thermal: core: Store trip pointer in struct thermal_instance
    - thermal: gov_power_allocator: avoid inability to reset a cdev
    - mm: migrate: record the mlocked page status to remove unnecessary lru
      drain
    - mm: migrate: fix getting incorrect page mapping during page migration
    - serial: core: Provide port lock wrappers
    - serial: sc16is7xx: Use port lock wrappers
    - serial: sc16is7xx: fix unconditional activation of THRI interrupt
    - btrfs: zoned: factor out prepare_allocation_zoned()
    - btrfs: zoned: optimize hint byte for zoned allocator
    - [x86] drm/i915/lnl: Remove watchdog timers for PSR
    - [x86] drm/i915/psr: Only allow PSR in LPSP mode on HSW non-ULT
    - drm/panel-edp: Add AUO B116XTN02, BOE NT116WHM-N21,836X2, NV116WHM-N49
      V8.0
    - drm/panel-edp: drm/panel-edp: Fix AUO B116XAK01 name and timing
    - drm/panel-edp: drm/panel-edp: Fix AUO B116XTN02 name
    - drm/amdgpu/gfx10: set UNORD_DISPATCH in compute MQDs
    - drm/amdgpu/gfx11: set UNORD_DISPATCH in compute MQDs
    - drm/bridge: parade-ps8640: Wait for HPD when doing an AUX transfer
    - drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
    - drm/panel: samsung-s6d7aa0: drop DRM_BUS_FLAG_DE_HIGH for lsl080al02
    - drm/bridge: sii902x: Fix probing race issue
    - drm/bridge: sii902x: Fix audio codec unregistration
    - drm/bridge: parade-ps8640: Ensure bridge is suspended in .post_disable()
    - drm/bridge: parade-ps8640: Make sure we drop the AUX mutex in the error
      case
    - memblock: fix crash when reserved memory is not added to memory
    - [arm64] firmware: arm_scmi: Use xa_insert() to store opps
    - [arm64] firmware: arm_scmi: Use xa_insert() when saving raw queues
    - gpio: eic-sprd: Clear interrupt after set the interrupt type
    - block: Move checking GENHD_FL_NO_PART to bdev_add_partition()
    - drm/bridge: anx7625: Ensure bridge is suspended in disable()
    - cpufreq/amd-pstate: Fix setting scaling max/min freq values
    - spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
    - spi: spi-cadence: Reverse the order of interleaved write and read
      operations
    - cifs: fix stray unlock in cifs_chan_skip_or_disable
    - spi: fix finalize message on error return
    - [mips*] lantiq: register smp_ops on non-smp platforms
    - drm: bridge: samsung-dsim: Don't use FORCE_STOP_STATE
    - cxl/region：Fix overflow issue in alloc_hpa()
    - [mips*] Call lose_fpu(0) before initializing fcr31 in
      mips_set_personality_nan
    - genirq: Initialize resend_node hlist for all interrupt descriptors
    - clocksource: Skip watchdog check for large watchdog intervals
    - tick/sched: Preserve number of idle sleeps across CPU hotplug events
    - [x86] entry/ia32: Ensure s32 is sign extended to s64
    - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
    - thermal: trip: Drop lockdep assertion from thermal_zone_trip_id()

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "serial: core: Use port lock wrappers"

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 03 Feb 2024 11:14:21 +0100

linux (6.6.13-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.12
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.13
    - f2fs: explicitly null-terminate the xattr list
    - ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
    - mptcp: fix uninit-value in mptcp_incoming_options
    - wifi: cfg80211: lock wiphy mutex for rfkill poll
    - wifi: avoid offset calculation on NULL pointer
    - wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap
    - debugfs: fix automount d_fsdata usage
    - ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format
    - nvme-core: fix a memory leak in nvme_ns_info_from_identify()
    - io_uring: use fget/fput consistently
    - block: warn once for each partition in bio_check_ro()
    - drm/amdgpu: Do not issue gpu reset from nbio v7_9 bif interrupt
    - drm/amd/display: update dcn315 lpddr pstate latency
    - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
    - drm/amdgpu: Use another offset for GC 9.4.3 remap
    - Revert "drm/prime: Unexport helpers for fd/handle conversion"
    - blk-mq: don't count completed flush data request as inflight in case of
      quiesce
    - nvme-core: check for too small lba shift
    - [x86] ASoC: amd: yc: Add HP 255 G10 into quirk table
    - [x86] ASoC: Intel: Skylake: Fix mem leak in few functions
    - [x86] ASoC: SOF: topology: Fix mem leak in sof_dai_load()
    - [x86] ASoC: Intel: Skylake: mem leak in skl register function
    - ASoC: rt5650: add mutex to avoid the jack detection failure
    - [x86] ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not
      available
    - [x86] ASoC: SOF: ipc4-topology: Add core_mask in struct snd_sof_pipeline
    - [x86] ASoC: SOF: sof-audio: Modify logic for enabling/disabling topology
      cores
    - nouveau/tu102: flush all pdbs on vmm flush
    - [x86] ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13
    - [x86] ASoC: hdac_hda: Conditionally register dais for HDMI and Analog
    - [x86] ASoC: SOF: ipc4-topology: Correct data structures for the SRC module
    - [x86] ASoC: SOF: ipc4-topology: Correct data structures for the GAIN
      module
    - net/tg3: fix race condition in tg3_reset_task()
    - ASoC: da7219: Support low DC impedance headset
    - nvme: introduce helper function to get ctrl state
    - nvme: ensure reset state check ordering
    - nvme-ioctl: move capable() admin check to the end
    - nvme: prevent potential spectre v1 gadget
    - nvme: fix deadlock between reset and scan
    - [arm64] dts: rockchip: Fix PCI node addresses on rk3399-gru
    - drm/amd/display: Add monitor patch for specific eDP
    - drm/amdgpu: Add NULL checks for function pointers
    - [armhf] drm/exynos: fix a potential error pointer dereference
    - [armhf] drm/exynos: fix a wrong error checking
    - ALSA: pcmtest: stop timer before buffer is released
    - [x86] hwmon: (corsair-psu) Fix probe when built-in
    - [arm64] clk: rockchip: rk3568: Add PLL rate for 292.5MHz
    - [arm64] clk: rockchip: rk3128: Fix HCLK_OTG gate register
    - soundwire: intel_ace2x: fix AC timing setting for ACE2.x
    - jbd2: correct the printing of write_flags in jbd2_write_superblock()
    - jbd2: increase the journal IO's priority
    - drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
    - neighbour: Don't let neigh_forced_gc() disable preemption for long
    - [x86] platform/x86: intel-vbtn: Fix missing tablet-mode-switch events
    - jbd2: fix soft lockup in journal_finish_inode_data_buffers()
    - tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
    - tracing: Add size check when printing trace_marker output
    - tracing: Fix uaf issue when open the hist or hist_debug file
    - ring-buffer: Do not record in NMI if the arch does not support cmpxchg in
      NMI
    - Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1
    - [arm64] reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
    - Input: atkbd - skip ATKBD_CMD_GETID in translated mode
    - Input: i8042 - add nomux quirk for Acer P459-G2-M
    - pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend
    - [s390x] scm: fix virtual vs physical address confusion
    - wifi: iwlwifi: pcie: avoid a NULL pointer dereference
    - Input: xpad - add Razer Wolverine V2 support
    - driver core: Add a guard() definition for the device_lock()
    - HID: nintendo: fix initializer element is not constant error
    - [x86] platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some
      ThinkPad systems
    - [amd64] platform/x86/amd/pmc: Move platform defines to header
    - [amd64] platform/x86/amd/pmc: Only run IRQ1 firmware version check on
      Cezanne
    - [amd64] platform/x86/amd/pmc: Move keyboard wakeup disablement detection
      to pmc-quirks
    - [amd64] platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346
    - [x86] ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk
    - ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models
    - dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM
    - HID: nintendo: Prevent divide-by-zero on code
    - smb: client: fix potential OOB in smb2_dump_detail() (CVE-2023-6610)
    - [arm64,armhf] i2c: rk3x: fix potential spinlock recursion on poll
    - drm/amd/display: Add case for dcn35 to support usb4 dmub hpd event
    - drm/amd/display: get dprefclk ss info from integration info table
    - posix-timers: Get rid of [COMPAT_]SYS_NI() uses
    - ida: Fix crash in ida_free when the bitmap is empty (CVE-2023-6915)
    - virtio_blk: fix snprintf truncation compiler warning
    - nfc: Do not send datagram if socket state isn't LLCP_BOUND
    - net: qrtr: ns: Return 0 if server port is not present
    - connector: Fix proc_event_num_listeners count not cleared
    - [armhf] sun9i: smp: fix return code check of of_property_match_string
    - [x86] csum: Remove unnecessary odd handling
    - [x86] csum: clean up `csum_partial' further
    - drm/crtc: fix uninitialized variable use
    - [x86] microcode: do not cache microcode if it will not be used
    - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 13-ay0xxx
    - ACPI: resource: Add another DMI match for the TongFang GMxXGxx
    - [arm64] bus: moxtet: Mark the irq as shared
    - [arm64] bus: moxtet: Add spi device table
    - [x86] ASoC: SOF: Intel: hda-codec: Delay the codec device registration
    - drm/amd/display: Pass pwrseq inst for backlight and ABM
    - ksmbd: don't allow O_TRUNC open on read-only share
    - ksmbd: free ppace array on error in parse_dacl
    - Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
    - [arm*] binder: use EPOLLERR from eventpoll.h
    - [arm*] binder: fix use-after-free in shinker's callback
    - [arm*] binder: fix trivial typo of binder_free_buf_locked()
    - [arm*] binder: fix comment on binder_alloc_new_buf() return value
    - uio: Fix use-after-free in uio_open
    - parport: parport_serial: Add Brainboxes BAR details
    - parport: parport_serial: Add Brainboxes device IDs and geometry
    - PCI: Add ACS quirk for more Zhaoxin Root Ports
    - scripts/decode_stacktrace.sh: optionally use LLVM utilities
    - mm/memory_hotplug: fix memmap_on_memory sysfs value retrieval

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 20 Jan 2024 20:37:22 +0100

linux (6.6.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.10
    - ksmbd: Remove unused field in ksmbd_user struct
    - ksmbd: reorganize ksmbd_iov_pin_rsp()
    - ksmbd: fix kernel-doc comment of ksmbd_vfs_setxattr()
    - ksmbd: fix missing RDMA-capable flag for IPoIB device in
      ksmbd_rdma_capable_netdev()
    - ksmbd: add support for surrogate pair conversion
    - ksmbd: no need to wait for binded connection termination at logoff
    - ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked()
    - ksmbd: prevent memory leak on error return
    - ksmbd: separately allocate ci per dentry
    - ksmbd: move oplock handling after unlock parent dir
    - ksmbd: release interim response after sending status pending response
    - ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId
    - ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error
    - ksmbd: set epoch in create context v2 lease
    - ksmbd: set v2 lease capability
    - ksmbd: downgrade RWH lease caching state to RH for directory
    - ksmbd: send v2 lease break notification for directory
    - ksmbd: lazy v2 lease break on smb2_write()
    - ksmbd: avoid duplicate opinfo_put() call on error of
      smb21_lease_break_ack()
    - fs: new accessor methods for atime and mtime
    - client: convert to new timestamp accessors
    - fs: cifs: Fix atime update check
    - virtio_ring: fix syncs DMA memory with different direction
    - kexec: fix KEXEC_FILE dependencies
    - kexec: select CRYPTO from KEXEC_FILE instead of depending on it
    - linux/export: Fix alignment for 64-bit ksymtab entries
    - linux/export: Ensure natural alignment of kcrctab array
    - mptcp: refactor sndbuf auto-tuning
    - mptcp: fix possible NULL pointer dereference on close
    - mptcp: fix inconsistent state on fastopen race
    - block: renumber QUEUE_FLAG_HW_WC
    - [x86] platform/x86/intel/pmc: Add suspend callback
    - [x86] platform/x86/intel/pmc: Allow reenabling LTRs
    - [x86] platform/x86/intel/pmc: Move GBE LTR ignore to suspend callback
    - ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
    - maple_tree: do not preallocate nodes for slot stores
    - mm/filemap: avoid buffered read/write race to read inconsistent data
    - mm: migrate high-order folios in swap cache correctly
    - mm/memory-failure: cast index to loff_t before shifting it
    - mm/memory-failure: check the mapcount of the precise page
    - Revert "nvme-fc: fix race between error recovery and creating association"
    - ring-buffer: Fix wake ups when buffer_percent is set to 100
    - ftrace: Fix modification of direct_function hash while in use
    - tracing: Fix blocked reader of snapshot buffer
    - wifi: cfg80211: fix CQM for non-range use
    - wifi: nl80211: fix deadlock in nl80211_set_cqm_rssi (6.6.x)
    - netfilter: nf_tables: skip set commit for deleted/destroyed sets
      (CVE-2024-0193)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.11
    - keys, dns: Fix missing size check of V1 server-list header
    - ALSA: hda/realtek: enable SND_PCI_QUIRK for hp pavilion 14-ec1xxx series
    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ZBook
    - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6
    - drm/amd/display: pbn_div need be updated for hotplug event
    - mptcp: prevent tcp diag from closing listener subflows
    - Revert "PCI/ASPM: Remove pcie_aspm_pm_state_change()"
    - [x86] drm/mgag200: Fix gamma lut not initialized for G200ER, G200EV,
      G200SE
    - cifs: cifs_chan_is_iface_active should be called with chan_lock held
    - cifs: do not depend on release_iface for maintaining iface_list
    - [x86] KVM: x86/pmu: fix masking logic for MSR_CORE_PERF_GLOBAL_CTRL
    - wifi: iwlwifi: pcie: don't synchronize IRQs from IRQ (Closes: #1058887)
    - [arm64] drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in
      AUX xfer
    - netfilter: nf_tables: set transport offset from mac header for
      netdev/egress
    - nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to
      llcp_local
    - [x86] drm/i915/dp: Fix passing the correct DPCD_REV for
      drm_dp_set_phy_test_pattern
    - [x86] drm/i915/perf: Update handling of MMIO triggered reports
    - ice: Fix link_down_on_close message
    - ice: Shut down VSI with "link-down-on-close" enabled
    - i40e: Fix filter input checks to prevent config with invalid values
    - igc: Report VLAN EtherType matching back to user
    - igc: Check VLAN TCI mask
    - igc: Check VLAN EtherType mask
    - net: sched: em_text: fix possible memory leak in em_text_destroy()
    - r8169: Fix PCI error on system resume
    - net: Implement missing getsockopt(SO_TIMESTAMPING_NEW)
    - [armhf] sun9i: smp: Fix array-index-out-of-bounds read in
      sunxi_mc_smp_init
    - sfc: fix a double-free bug in efx_probe_filters
    - [arm64] net: bcmgenet: Fix FCS generation for fragmented skbuffs
    - netfilter: nf_nat: fix action not being set for all ct states
    - netfilter: nft_immediate: drop chain reference counter on error
    - net: Save and restore msg_namelen in sock_sendmsg
    - i40e: fix use-after-free in i40e_aqc_add_filters()
    - [arm64] ASoC: meson: g12a-toacodec: Validate written enum values
    - [arm64] ASoC: meson: g12a-tohdmitx: Validate written enum values
    - [arm64] ASoC: meson: g12a-toacodec: Fix event generation
    - [arm64] ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux
    - i40e: Restore VF MSI-X state during PCI reset
    - igc: Fix hicredit calculation
    - apparmor: Fix move_mount mediation by detecting if source is detached
    - virtio_net: avoid data-races on dev->stats fields
    - virtio_net: fix missing dma unmap for resize
    - net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues
    - net/smc: fix invalid link access in dumping SMC-R connections
    - asix: Add check for usbnet_get_endpoints
    - bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters()
    - net: Implement missing SO_TIMESTAMPING_NEW cmsg support
    - mm: convert DAX lock/unlock page to lock/unlock folio
    - mm/memory-failure: pass the folio and the page to collect_procs()
    - xsk: add multi-buffer support for sockets sharing umem
    - tcp: derive delack_max from rto_min
    - bpftool: Fix -Wcast-qual warning
    - bpftool: Align output skeleton ELF code
    - crypto: xts - use 'spawn' for underlying single-block cipher
    - [x86] crypto: qat - fix double free during reset
    - crypto: hisilicon/qm - fix EQ/AEQ interrupt issue
    - RDMA/mlx5: Fix mkey cache WQ flush
    - ACPI: thermal: Fix acpi_thermal_unregister_thermal_zone() cleanup
    - rcu: Break rcu_node_0 --> &rq->__lock order
    - rcu: Introduce rcu_cpu_online()
    - rcu/tasks: Handle new PF_IDLE semantics
    - rcu/tasks-trace: Handle new PF_IDLE semantics
    - [riscv64] don't probe unaligned access speed if already done
    - [s390x] KVM: s390: vsie: fix wrong VIR 37 when MSO is used
    - [arm64,armhf] phy: ti: gmii-sel: Fix register offset when parent is not a
      syscon node
    - [arm64] dmaengine: ti: k3-psil-am62: Fix SPI PDMA data
    - [arm64] dmaengine: ti: k3-psil-am62a: Fix SPI PDMA data
    - iio: imu: adis16475: use bit numbers in assign_bit()
    - [amd64] iommu/vt-d: Support enforce_cache_coherency only for empty domains
    - [armhf] clk: rockchip: rk3128: Fix aclk_peri_src's parent
    - [armhf] clk: rockchip: rk3128: Fix SCLK_SDMMC's clock name
    - [x86] drm/i915: Call intel_pre_plane_updates() also for pipes getting
      enabled
    - drm/amd/display: Increase num voltage states to 40
    - cxl: Add cxl_decoders_committed() helper
    - cxl/core: Always hold region_rwsem while reading poison lists
    - kernel/resource: Increment by align value in get_free_mem_region()
    - drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml
    - [amd64] dmaengine: idxd: Protect int_handle field in hw descriptor
    - [riscv64] KVM: update external interrupt atomically for IMSIC swfile
    - [powerpc*] pseries/vas: Migration suspend waits for no in-progress open
      windows
    - net: prevent mss overflow in skb_segment()
    - cxl/pmu: Ensure put_device on pmu devices
    - net: constify sk_dst_get() and __sk_dst_get() argument
    - mm/mglru: skip special VMAs in lru_gen_look_around()
    - firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines
      and ASM108x/VT630x PCIe cards
    - [x86] kprobes: fix incorrect return address calculation in
      kprobe_emulate_call_indirect
    - i2c: core: Fix atomic xfer check for non-preempt config
    - mm: fix unmap_mapping_range high bits shift bug
    - drm/amdgpu: skip gpu_info fw loading on navi12
    - drm/amd/display: add nv12 bounding box
    - drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP
      displays without PSR
    - mmc: rpmb: fixes pause retune on all RPMB partitions.
    - mmc: core: Cancel delayed work before releasing host
    - cxl: Add cxl_num_decoders_committed() usage to cxl_test
    - cxl/hdm: Fix a benign lockdep splat
    - cxl/memdev: Hold region_rwsem during inject and clear poison ops

  [ Salvatore Bonaccorso ]
  * [rt] Disable "RISC-V: Probe misaligned access speed in parallel"
  * [x86] Enable DesignWare USB3 DRD Core Support (Closes: #1059607)
    - drivers/usb/dwc3: Enable USB_DWC3 as module
    - drivers/usb/dwc3: Enable USB_DWC3_ULPI
    - drivers/usb/dwc3: Enable USB_DWC3_DUAL_ROLE
  * nfsd: drop the nfsd_put helper

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 14 Jan 2024 09:01:06 +0100

linux (6.6.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.9
    - bpf: Fix prog_array_map_poke_run map poke update
    - btrfs: qgroup: iterate qgroups without memory allocation for
      qgroup_reserve()
    - btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta()
    - btrfs: free qgroup pertrans reserve on transaction abort
    - drm/amd/display: fix hw rotated modes when PSR-SU is enabled
    - [x86] drm/i915: Fix FEC state dump
    - [x86] drm/i915: Introduce crtc_state->enhanced_framing
    - [x86] drm/i915/edp: don't write to DP_LINK_BW_SET when using rate select
    - drm: Update file owner during use
    - drm: Fix FD ownership check in drm_master_check_perm()
    - [arm64,armhf] spi: spi-imx: correctly configure burst length when using
      dma
    - [arm64] dts: allwinner: h616: update emac for Orange Pi Zero 3
    - [armhf] OMAP2+: Fix null pointer dereference and memory leak in
      omap_soc_device_init
    - reset: Fix crash when freeing non-existent optional resets
    - [s390x] vx: fix save/restore of fpu kernel context
    - [x86] platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore()
    - SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806
    - wifi: ieee80211: don't require protected vendor action frames
    - wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock
    - wifi: mac80211: check if the existing link config remains unchanged
    - wifi: mac80211: don't re-add debugfs during reconfig
    - wifi: mac80211: check defragmentation succeeded
    - wifi: mac80211: mesh: check element parsing succeeded
    - wifi: mac80211: mesh_plink: fix matches_local logic
    - ice: fix theoretical out-of-bounds access in ethtool link modes
    - bpf: syzkaller found null ptr deref in unix_bpf proto add
    - Revert "net/mlx5e: fix double free of encap_header in update funcs"
    - Revert "net/mlx5e: fix double free of encap_header"
    - net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list()
    - net/mlx5e: Fix a race in command alloc flow
    - net/mlx5e: fix a potential double-free in fs_udp_create_groups
    - net/mlx5e: Fix overrun reported by coverity
    - net/mlx5e: Decrease num_block_tc when unblock tc offload
    - net/mlx5e: XDP, Drop fragmented packets larger than MTU size
    - net/mlx5: Fix fw tracer first block check
    - net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num
    - net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get()
    - net/mlx5e: Fix error codes in alloc_branch_attr()
    - net/mlx5e: Correct snprintf truncation handling for fw_version buffer
    - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used
      by representors
    - [arm64] net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and
      above
    - [arm64] net: mscc: ocelot: fix pMAC TX RMON stats for bucket 256-511 and
      above
    - net: Return error from sk_stream_wait_connect() if sk_wait_event() fails
    - net: sched: ife: fix potential use-after-free
    - ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
    - net/rose: fix races in rose_kill_by_device()
    - Bluetooth: Fix not notifying when connection encryption changes
    - Bluetooth: Fix deadlock in vhci_send_frame
    - Bluetooth: hci_event: shut up a false-positive warning
    - Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis
    - bnxt_en: do not map packet buffers twice
    - net: phy: skip LED triggers on PHYs on SFP modules
    - ice: stop trashing VF VSI aggregator node ID information
    - ice: alter feature support check for SRIOV and LAG
    - ice: Fix PF with enabled XDP going no-carrier after reset
    - net: mana: select PAGE_POOL
    - net: check vlan filter feature in vlan_vids_add_by_dev() and
      vlan_vids_del_by_dev()
    - afs: Fix the dynamic root's d_delete to always delete unused dentries
    - afs: Fix dynamic root lookup DNS check
    - net: ethernet: mtk_wed: fix possible NULL pointer dereference in
      mtk_wed_wo_queue_tx_clean()
    - net/ipv6: Revert remove expired routes with a separated list of routes
    - net: check dev->gso_max_size in gso_features_check()
    - keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
    - afs: Fix overwriting of result of DNS query
    - afs: Fix use-after-free due to get/remove race in volume tree
    - [x86] drm/i915/hwmon: Fix static analysis tool reported issues
    - [x86] drm/i915/mtl: Fix HDMI/DP PLL clock selection
    - [arm64,armhf] ASoC: hdmi-codec: fix missing report for jack initial status
    - [arm64] ASoC: fsl_sai: Fix channel swap issue on i.MX8MP
    - [arm64] i2c: qcom-geni: fix missing clk_disable_unprepare() and
      geni_se_resources_off()
    - drm/amdgpu: re-create idle bo's PTE during VM state machine reset
    - [armhf] i2c: aspeed: Handle the coalesced stop conditions with the start
      conditions.
    - gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl()
    - nvme-pci: fix sleeping function called from interrupt context
    - iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
    - [arm64,armhf] iio: adc: meson: add separate config for axg SoC family
    - scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
    - scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in
      ufs_qcom_clk_scale_notify()
    - scsi: ufs: core: Let the sq_lock protect sq_tail_slot access
    - iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time
      table
    - iio: imu: adis16475: add spi_device_id table
    - [armhf] iio: adc: ti_am335x_adc: Fix return value check of
      tiadc_request_dma()
    - iio: triggered-buffer: prevent possible freeing of wrong buffer
    - ALSA: usb-audio: Increase delay in MOTU M quirk
    - usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3
    - wifi: mt76: fix crash with WED rx support enabled
    - wifi: cfg80211: Add my certificate
    - wifi: cfg80211: fix certs build to not depend on file order
    - USB: serial: ftdi_sio: update Actisense PIDs constant names
    - USB: serial: option: add Quectel EG912Y module support
    - USB: serial: option: add Foxconn T99W265 with new baseline
    - USB: serial: option: add Quectel RM500Q R13 firmware support
    - ALSA: hda/tas2781: select program 0, conf 0 by default
    - ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA
    - ASoC: tas2781: check the validity of prm_no/cfg_no
    - Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
    - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
      (CVE-2023-51779)
    - Bluetooth: L2CAP: Send reject on command corrupted request
    - Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE
    - Bluetooth: Add more enc key size check
    - usb: typec: ucsi: fix gpio-based orientation detection
    - net: usb: ax88179_178a: avoid failed operations when device is
      disconnected
    - [x86] Input: soc_button_array - add mapping for airplane mode button
    - net: 9p: avoid freeing uninit memory in p9pdu_vreadf
    - net: rfkill: gpio: set GPIO direction
    - net: avoid build bug in skb extension length calculation
    - net: stmmac: fix incorrect flag check in timestamp interrupt
    - dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp
    - nfsd: call nfsd_last_thread() before final nfsd_put()
    - smb: client: fix OOB in cifsd when receiving compounded resps
    - smb: client: fix potential OOB in cifs_dump_detail()
    - smb: client: fix OOB in SMB2_query_info_init()
    - smb: client: fix OOB in smbCalcSize() (CVE-2023-6606)
    - [x86] drm/i915: Reject async flips with bigjoiner
    - [x86] drm/i915/dmc: Don't enable any pipe DMC events
    - 9p: prevent read overrun in protocol dump tracepoint
    - ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg()
    - ring-buffer: Remove useless update to write_stamp in rb_try_to_discard()
    - ring-buffer: Fix slowpath of interrupted event
    - nvmem: brcm_nvram: store a copy of NVRAM content
    - Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity"
      (Closes: #1059624)
    - scsi: core: Always send batch on reset or error handling command
    - tracing / synthetic: Disable events after testing in
      synth_event_gen_test_init()
    - dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
    - [riscv64] pinctrl: starfive: jh7110: ignore disabled device tree nodes
    - [risvv64] pinctrl: starfive: jh7100: ignore disabled device tree nodes
    - [armhf] bus: ti-sysc: Flush posted write only after srst_udelay
    - lib/vsprintf: Fix %pfwf when current node refcount == 0
    - [x86] thunderbolt: Fix memory leak in margining_port_remove()
    - [arm64] KVM: arm64: vgic: Simplify kvm_vgic_destroy()
    - [arm64] KVM: arm64: vgic: Add a non-locking primitive for
      kvm_vgic_vcpu_destroy()
    - [arm64] KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy
    - [x86] alternatives: Sync core before enabling interrupts
    - [x86] alternatives: Disable interrupts and sync when optimizing NOPs in
      place
    - [x86] smpboot/64: Handle X2APIC BIOS inconsistency gracefully

  [ Salvatore Bonaccorso ]
  * [arm64] drivers/vfio: Don't enable VFIO_NOIOMMU.
    This is a breach of the integrity lockdown requirement of secure boot
    and thus cannot be enabled.
    Thanks to Bastian Blank and Ben Hutchings
  * [rt] Update to 6.6.7-rt18

  [ Bastian Blank ]
  * [mips*] Increase RELOCATION_TABLE_SIZE to 0x200000. (closes: #1059431)

 -- Bastian Blank <waldi@debian.org>  Mon, 01 Jan 2024 18:22:27 +0100

linux (6.6.8-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.8
    - afs: Fix refcount underflow from error handling race (Closes: #1052304)
    - HID: lenovo: Restrict detection of patched firmware only to USB cptkbd
      (Closes: #1058758)
    - [mips*] PCI: loongson: Limit MRRS to 256 (Closes: #1035587)

 -- Bastian Blank <waldi@debian.org>  Fri, 22 Dec 2023 10:40:01 +0100

linux (6.6.7-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.5
    - r8169: fix deadlock on RTL8125 in jumbo mtu mode (Closes: #1057790)
    - io_uring: don't allow discontig pages for IORING_SETUP_NO_MMAP
      (CVE-2023-6560)
    - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
      (CVE-2023-6932)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.6
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.7
    - netfilter: nf_tables: bail out on mismatching dynset and set expressions
      (CVE-2023-6622)
    - perf: Fix perf_event_validate_size() (CVE-2023-6931)
    - [mips*] kernel: Clear FPU states when setting up kernel threads
      (Closes: #1055021)
    - netfilter: nft_set_pipapo: skip inactive elements during set walk
      (CVE-2023-6817)

  [ Anatoliy Gunya ]
  * [riscv64] improve Starfive Visionfive 2 support: enable DW_AXI_DMAC and
    MOTORCOMM_PHY as modules

  [ Bastian Blank ]
  * [i386] No longer sign kernels.
  * Properly merge Build-Depends, so that we don't carry hundred identical
    entries.
  * [udeb] Fix nic-shared-modules dependencies.
  * Add dependency on image to headers package.

  [ Salvatore Bonaccorso ]
  * Enable vDPA support (Closes: #1057619)
    - drivers/vdpa: Enable VDPA and VDPA_USER as module
    - drivers/virtio: Enable VIRTIO_VDPA as module
    - drivers/vhost: Enable VHOST_VDPA as module
  * [rt] Refresh "serial: amba-pl011: Use port lock wrappers" for context
    changes

  [ Miguel Bernal Marin ]
  * [amd64] Enable System Trace Modules and the Intel Trace Hub Software
    Trace Hub support (Closes: #1050353)
    - drivers/hwtracing/stm: Enable STM as module
    - drivers/hwtracing/stm: Enable STM_PROTO_BASIC as module
    - drivers/hwtracing/stm: Enable STM_PROTO_SYS_T as module
    - drivers/hwtracing/stm: Enable STM_DUMMY as module
    - drivers/hwtracing/stm: Enable STM_SOURCE_CONSOLE as module
    - drivers/hwtracing/stm: Enable STM_SOURCE_HEARTBEAT as module
    - drivers/hwtracing/stm: Enable STM_SOURCE_FTRACE as module
    - drivers/hwtracing/intel_th: Enable INTEL_TH_STH as module

  [ Jair Gonzalez ]
  * [amd64] drivers/platform/x86/intel: Enable INTEL_TPMI (Topology Aware
    Register and PM Capsule Interface).
  * [amd64] drivers/powercap/Kconfig: Enable INTEL_RAPL_TPMI (Running Average
    Power Limit Energy Reporting via the Topology Aware Register and PM
    Capsule Interface) (Closes: #1053187).

  [ Vincent Blut ]
  * [x86] sound/soc/amd: Enable SND_SOC_AMD_PS and SND_SOC_AMD_PS_MACH as
    modules (Closes: #1055649)
  * [x86] sound/soc/amd: Enable SND_SOC_AMD_RPL_ACP6x as module
    (Closes: #1058576)

  [ Luca Boccassi ]
  * Set CONFIG_VIRTIO_FS and its dependencies to builtin, to allow building
    images that boot directly to rootfs (skipping the initrd)

 -- Bastian Blank <waldi@debian.org>  Wed, 20 Dec 2023 12:06:39 +0100

linux (6.6.4-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.4
    - nvmet: nul-terminate the NQNs passed in the connect command
      (CVE-2023-6121)

  [ Bastian Blank ]
  * Fix build dependency on rsync.
  * Fix build dependency on kernel-wedge.
  * udeb: Make i2c-hid modules optional.

  [ Timothy Pearson ]
  * [powerpc] Don't clobber f0/vs0 during fp|altivec register save
    (Closes: #1032104)

  [ Johannes Schauer Marin Rodrigues ]
  * Fix FTCBFS: Pass _PYTHON_SYSCONFIGDATA_NAME to the perf build.
    (Closes: #1037938) Thanks to Helmut Grohne for the patch.

 -- Bastian Blank <waldi@debian.org>  Sun, 03 Dec 2023 20:57:56 +0100

linux (6.6.3-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_6.6
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.1
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.2
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.3

  [ Vincent Blut ]
  * [armhf] drivers/input/keyboard: Enable KEYBOARD_TCA8418 as module
    (Closes: #1050782)
  * drivers/net/wwan: Enable MTK_T7XX as module (Closes: #1055244)
  * drivers/video/fbdev: Disable FB_UDL on all architectures (Closes: #1011986)

  [ Bastian Blank ]
  * [powerpc,ppc64] Remove unused arch specific bootwrapper.
  * Generate installer packages according to own config.
  * Sign modules using an ephemeral key: (closes: #1040901)
    - Set MODULE_SIG_ALL to sign all modules.
    - Not longer request Secure Boot signing for modules.
    - Don't trust Secure Boot key any longer.
  * Sign modules and support lockdown always.
  * Compress all modules:
    - Set MODULE_COMPRESS_XZ.
  * Drop deprecated build profile stage1. (closes: #1051365)
  * Generate information for signed template package early.
  * Copy installer config into signed source.
  * Make it possible to run debian/rules.real without root.
  * Drop linux-compiler packages and use normal compiler packages again.
  * [hppa] Drop transitional meta packages after one stable release.
  * Use flake8 to check Python code.
  * Build linux-libc-dev as arch-all package.
  * [armel/marvell] Remove unusable kernel. (closes: #950324)
  * Remove architectures not existing in Debian:
    - arm64ilp32
    - mips64r6
    - mipsn32
    - mipsn32el
    - mipsn32r6
    - mipsn32r6el
    - mipsr6
    - mipsr6
    - mipsr6el
    - mipsr6el
    - s390
    - sh3
    - sparc

  [ Emanuele Rocca ]
  * [arm64] Enable support for Renesas RZ/G2UL (ARCH_R9A07G043), RZ/V2L
    (ARCH_R9A07G054), and RZ/V2M (ARCH_R9A09G011). (Closes: #1053503)
  * [arm64] Enable SND_SOC_SC8280XP, SC_LPASSCC_8280XP, and SND_SOC_WSA883X as
    modules, needed for audio support on the Lenovo X13s. (Closes: #1055069)

  [ Salvatore Bonaccorso ]
  * drivers/block: Enable BLK_DEV_UBLK as module (Closes: #1032604)

  [ Uwe Kleine-König ]
  * Enable support for TI DP83TD510 Ethernet 10Base-T1L PHY

  [ Diederik de Haas ]
  * Drop patches applied upstream:
    - Drop "cpupower: Bump soname version"
  * Refresh patches:
    - Adjust context in "Tweak gitignore for Debian pkg-kernel using git" and
      drop 'svn' from patch Subject
    - Adjust context in "linux-tools: Install perf-read-vdso{,x}32 in
      directory under /usr/lib"
    - Adjust context in "Documentation: Drop sphinx version check"
    - Adjust context in "firmware: Remove redundant log messages from drivers"
    - Adjust context in "radeon, amdgpu: Firmware is required for DRM and KMS
      on R600 onward"
    - Adjust context in "phy/marvell: disable 4-port phys"
    - Adjust context in "fs: Add MODULE_SOFTDEP declarations for hard-coded
      crypto drivers"
    - Adjust context in "efi: Add an EFI_SECURE_BOOT flag to indicate secure
      boot mode"
    - Adjust context in "trust machine keyring (MoK) by default"
    - Adjust context in "ntfs: mark it as broken"
  * d/config: Update with the help of kconfigeditor2:
    - [x86,amd64/cloud] arch/x86: Remove MICROCODE
    - init: Remove EMBEDDED
    - drivers/hwmon: Remove SENSORS_SMM665
    - [armhf] drivers/staging/media/imx: Merge VIDEO_IMX_CSI into
      VIDEO_IMX_MEDIA
  * libcpupower1: Add is_valid_path to symbols file
  * d/installer: Add crc-modules to nic-shared-modules Depends
  * [rt] Update to 6.6-rt15
  * d/patches: Remove amdgpu part in the "radeon, amdgpu: Firmware is required
    for DRM and KMS on R600 onward" and "firmware_class: Refer to Debian wiki
    page when logging missing firmware" patches (Closes: #1053764)
  * Improve support for rk3588 devices
    - [arm64] drivers/clk/rockchip: Enable CLK_RK3588
    - [arm64] drivers/nvmem: Enable NVMEM_ROCKCHIP_OTP as module
    - [arm64] drivers/perf: Enable ARM_PMUV3

  [ Alper Nebi Yasak ]
  * debian/templates: Keep cpio as build-depends for nodoc build profile
  * [x86] Enable modules for more ChromeOS hardware functionality:
    - Enable CROS_EC_SPI, CROS_EC_I2C, CROS_EC_LPC, CROS_EC_ISHTP as modules
    - Enable IIO_CROS_EC_SENSORS, IIO_CROS_EC_SENSORS_CORE, IIO_CROS_EC_BARO,
      IIO_CROS_EC_ACCEL_LEGACY, IIO_CROS_EC_SENSORS_LID_ANGLE,
      IIO_CROS_EC_LIGHT_PROX as modules
    - Enable KEYBOARD_CROS_EC, PWM_CROS_EC, RTC_DRV_CROS_EC, CEC_CROS_EC
      I2C_CROS_EC_TUNNEL, SND_SOC_CROS_EC_CODEC, CHARGER_CROS_USBPD,
      CROS_USBPD_LOGGER, EXTCON_USBC_CROS_EC as modules
    - Enable WILCO_EC, CHARGER_WILCO, RTC_DRV_WILCO_EC, WILCO_EC_DEBUGFS,
      WILCO_EC_EVENTS, WILCO_EC_TELEMETRY as modules
    - Enable CHROMEOS_PRIVACY_SCREEN, CHROMEOS_TBMC as modules
  * [x86] Enable more SoC audio modules for Intel and AMD systems:
    - Enable SND_SOC_AMD_ACP_COMMON, SND_SOC_AMD_RV_RT5682_MACH,
      SND_DESIGNWARE_I2S, SND_SOC_AMD_SOF_MACH, SND_SOC_SOF_AMD_TOPLEVEL,
      SND_SOC_SOF_AMD_REMBRANDT as modules
    - Enable SND_SOC_INTEL_AVS, SND_SOC_INTEL_AVS_MACH_DA7219,
      SND_SOC_INTEL_AVS_MACH_DMIC, SND_SOC_INTEL_AVS_MACH_HDAUDIO,
      SND_SOC_INTEL_AVS_MACH_MAX98373, SND_SOC_INTEL_AVS_MACH_NAU8825,
      SND_SOC_INTEL_AVS_MACH_SSM4567, SND_SOC_INTEL_AVS_MACH_RT5663 and
      SND_SOC_INTEL_CML_LP as modules
    - Enable SND_SOC_INTEL_KBL_DA7219_MAX98927_MACH,
      SND_SOC_INTEL_GLK_DA7219_MAX98357A_MACH, SND_SOC_INTEL_SOF_CS42L42_MACH,
      SND_SOC_INTEL_SOF_NAU8825_MACH, SND_SOC_INTEL_SOF_CML_RT1011_RT5682_MACH,
      SND_SOC_INTEL_SOF_DA7219_MAX98373_MACH, SND_SOC_INTEL_SOF_SSP_AMP_MACH,
      SND_SOC_INTEL_CML_LP_DA7219_MAX98357A_MACH, SND_SOC_CS35L41_I2C and
      SND_SOC_NAU8315 as modules
  * [x86] Enable TOUCHSCREEN_ELAN as module
  * [arm64] Enable configs common to MediaTek MT8173 and MT8183 platforms:
    - Enable ARCH_MEDIATEK, MTK_TIMER, MTK_CPUX_TIMER, MST_IRQ, MTK_SCPSYS,
      MTK_SCPSYS_PM_DOMAINS, MTK_INFRACFG, EINT_MTK, IOMMU_IO_PGTABLE_ARMV7S
    - Enable ARM_MEDIATEK_CPUFREQ, ARM_MEDIATEK_CPUFREQ_HW as built-in
    - Enable SERIAL_8250_MT6577 as built-in
    - Enable HW_RANDOM_MTK, MEDIATEK_WATCHDOG, ARM_MEDIATEK_CPUFREQ and
      ARM_MEDIATEK_CPUFREQ_HW as modules
    - Enable MTK_SMI, MTK_IOMMU, MTK_MMSYS, MTK_CMDQ, MTK_CMDQ_MBOX,
      PWM_MTK_DISP, DRM_MEDIATEK, DRM_MEDIATEK_HDMI, PHY_MTK_HDMI and
      PHY_MTK_MIPI_DSI as modules
    - Enable VIDEO_MEDIATEK_JPEG, VIDEO_MEDIATEK_VCODEC, VIDEO_MEDIATEK_VPU,
      MTK_SCP, RPMSG_MTK_SCP as modules
    - Enable MEDIATEK_MT6577_AUXADC and MTK_THERMAL as modules
    - Enable I2C_MT65XX, SPI_MT65XX, MFD_MT6397, RTC_DRV_MT6397, MTK_PMIC_WRAP
      and MTK_REGULATOR_COUPLER as modules
    - Enable MMC_MTK as module
    - Enable NVMEM_MTK_EFUSE, PHY_MTK_TPHY, USB_XHCI_MTK, USB_MTU3 as modules
    - Enable USB_MTU3_DUAL_ROLE, and enable USB_ROLE_SWITCH as built-in
    - Enable MT7622_WMAC
    - Keep SoC-specific clock and pin controller drivers disabled
  * [arm64] Enable configs for MT8183 Chromebooks:
    - Enable PINCTRL_MT8183
    - Enable COMMON_CLK_MT8183 and its AUDIOSYS, CAMSYS, IMGSYS, IPU_CORE0,
      IPU_CORE1, IPU_ADL, IPU_CONN, MFGCFG, MMSYS, VDECSYS, VENCSYS as modules
    - Enable DEVFREQ_GOV_PASSIVE, ARM_MEDIATEK_CCI_DEVFREQ, MTK_SVS as modules
    - Enable DRM_ANALOGIX_ANX7625, DRM_PANEL_BOE_TV101WUM_NL6 and
      REGULATOR_MT6358 as modules
    - Enable CROS_EC_RPMSG and VIDEO_MEDIATEK_MDP3 as modules
    - Enable MT7921S and ATH10K_SDIO as modules
    - Enable GENERIC_ADC_THERMAL and USB_ONBOARD_HUB as modules
    - Enable SND_SOC_BT_SCO, SND_SOC_CROS_EC_CODEC, SND_SOC_TS3A227E,
      SND_SOC_MT6358, SND_SOC_MT8183, SND_SOC_MT8183_DA7219_MAX98357A,
      and SND_SOC_MT8183_MT6358_TS3A227E_MAX98357A as modules
  * [arm64] Enable configs for MT8173 Chromebooks:
    - Enable PINCTRL_MT8173 and COMMON_CLK_MEDIATEK_FHCTL
    - Enable COMMON_CLK_MT8173 and its IMGSYS, MMSYS, VDECSYS, VENCSYS clocks
      as modules
    - Enable DRM_PARADE_PS8640, REGULATOR_DA9211, REGULATOR_MT6397,
      VIDEO_MEDIATEK_MDP and TOUCHSCREEN_MELFAS_MIP4 as modules
    - Enable SPI_MTK_NOR and ARM_SMC_WATCHDOG as modules
    - Enable SND_SOC_MT8173 and SND_SOC_MT8173_RT5650 as modules
  * [arm64] Enable more hardware for RK3399 ChromeOS tablets:
    - drivers/gpu/drm/panel/Kconfig: DRM_PANEL_INNOLUX_P079ZCA as module
    - drivers/gpu/drm/panel/Kconfig: DRM_PANEL_KINGDISPLAY_KD097D04 as module
    - drivers/media/i2c/Kconfig: Enable VIDEO_OV2685 as module
    - drivers/media/i2c/Kconfig: Enable VIDEO_OV5695 as module
    - drivers/net/wireless/ath/ath10k/Kconfig: Enable ATH10K_SDIO as module

  [ John Paul Adrian Glaubitz ]
  * [ia64] Compile with gcc-12 to work around ICE (PR target/111425)

  [ Francesco Dolcini ]
  * Improve support for NXP i.MX devices
    - [armhf] drivers/cpufreq/Kconfig.arm: Enable CONFIG_ARM_IMX_CPUFREQ_DT
    - [armhf] sound/soc/fsl/Kconfig: Enable CONFIG_SND_SOC_FSL_ASOC_CARD

  [ Ben Hutchings ]
  * d/rules.real: Reinstate installer test build with no build profiles
  * udeb: Move i2c-hid modules to fb-modules since they depend on drm
  * d/rules.real: Run dh_movetousr if available
  * d/rules.real: Change linux-libc-dev installation to:
    - Include all generic headers enabled on any supported architecture
    - Use the upstream headers_install target again

 -- Bastian Blank <waldi@debian.org>  Sat, 02 Dec 2023 20:03:34 +0100

linux (6.5.13-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.11
    - [x86] ASoC: Intel: sof_sdw: add support for SKU 0B14
    - [arm*] ASoC: simple-card: fixup asoc_simple_probe() error handling
    - [arm64,armhf] coresight: tmc-etr: Disable warnings for allocation failures
    - [arm64] ASoC: fsl-asoc-card: use integer type for fll_id and pll_id
    - ASoC: core: Do not call link_exit() on uninitialized rtd objects
    - net: sched: cls_u32: Fix allocation size in u32_init()
    - [arm64,armhf] can: flexcan: remove the auto stop mode for IMX93
    - [riscv64] irqchip/riscv-intc: Mark all INTC nodes as initialized
    - [armhf] irqchip/stm32-exti: add missing DT IRQ flag translation
    - ata: pata_parport: add custom version of wait_after_reset
    - ata: pata_parport: fit3: implement IDE command set registers
    - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
    - fbdev: atyfb: only use ioremap_uc() on i386 and ia64
    - ASoC: soc-dapm: Add helper for comparing widget name
    - netfilter: nfnetlink_log: silence bogus compiler warning
    - net/mlx5: Bridge, fix peer entry ageing in LAG mode
    - [x86] efistub: Don't try to print after ExitBootService()
    - efi: fix memory leak in krealloc failure handling
    - ASoC: rt5650: fix the wrong result of key button
    - drm/ttm: Reorder sys manager cleanup step
    - [x86] fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
    - scsi: mpt3sas: Fix in error path
    - ASoC: da7219: Correct the process of setting up Gnd switch in AAD
    - drm/amdgpu: Unset context priority is now invalid
    - gpu/drm: Eliminate DRM_SCHED_PRIORITY_UNSET
    - netfilter: nf_tables: audit log object reset once per table
    - drm/amdgpu: Reserve fences for VM update
    - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
    - r8152: Check for unplug in rtl_phy_patch_request()
    - r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en()
    - [powerpc*] mm: Fix boot crash with FLATMEM
    - io_uring: kiocb_done() should *not* trust ->ki_pos if
      ->{read,write}_iter() failed
    - ceph_wait_on_conflict_unlink(): grab reference before dropping ->d_lock
    - drm/amd/display: Don't use fsleep for PSR exit waits
    - power: supply: core: Use blocking_notifier_call_chain to avoid RCU
      complaint
    - perf evlist: Avoid frequency mode for the dummy event
    - mmap: fix vma_iterator in error path of vma_merge()
    - mmap: fix error paths with dup_anon_vma()
    - ALSA: usb-audio: add quirk flag to enable native DSD for McIntosh devices
    - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
    - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top"
      compatibility
    - usb: typec: tcpm: Add additional checks for contaminant
    - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
    - usb: raw-gadget: properly handle interrupted requests
    - Bluetooth: hci_bcm4377: Mark bcm4378/bcm4387 as BROKEN_LE_CODED
    - tty: n_gsm: fix race condition in status line change on dead connections
    - tty: 8250: Remove UC-257 and UC-431
    - tty: 8250: Add support for additional Brainboxes UC cards
    - tty: 8250: Add support for Brainboxes UP cards
    - tty: 8250: Add support for Intashield IS-100
    - tty: 8250: Fix port count of PX-257
    - tty: 8250: Fix up PX-803/PX-857
    - tty: 8250: Add support for additional Brainboxes PX cards
    - tty: 8250: Add support for Intashield IX cards
    - tty: 8250: Add Brainboxes Oxford Semiconductor-based quirks
    - dt-bindings: serial: rs485: Add rs485-rts-active-high
    - misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
    - serial: core: Fix runtime PM handling for pending tx
    - ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
    - [x86] ASoC: SOF: sof-pci-dev: Fix community key quirk detection
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.12
    - hwmon: (nct6775) Fix incorrect variable reuse in fan_div calculation
    - numa: Generalize numa_map_to_online_node()
    - sched/topology: Fix sched_numa_find_nth_cpu() in CPU-less case
    - sched/topology: Fix sched_numa_find_nth_cpu() in non-NUMA case
    - sched/fair: Fix cfs_rq_is_decayed() on !SMP
    - [x86] iov_iter, x86: Be consistent about the __user tag on
      copy_mc_to_user()
    - sched/uclamp: Set max_spare_cap_cpu even if max_spare_cap is 0
    - sched/uclamp: Ignore (util == 0) optimization in feec() when p_util_max =
      0
    - objtool: Propagate early errors
    - sched: Fix stop_one_cpu_nowait() vs hotplug
    - nfsd: Handle EOPENSTALE correctly in the filecache
    - vfs: fix readahead(2) on block devices
    - writeback, cgroup: switch inodes with dirty timestamps to release dying
      cgwbs
    - [x86] srso: Fix SBPB enablement for (possible) future fixed HW
    - [x86] srso: Print mitigation for retbleed IBPB case
    - [x86] srso: Fix vulnerability reporting for missing microcode
    - [x86] srso: Fix unret validation dependencies
    - futex: Don't include process MM in futex key on no-MMU
    - [x86] numa: Introduce numa_fill_memblks()
    - ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window
    - [x86] sev-es: Allow copy_from_kernel_nofault() in earlier boot
    - x86/boot: Fix incorrect startup_gdt_descr.size
    - cpu/hotplug: Remove dependancy against cpu_primary_thread_mask
    - cpu/SMT: Create topology_smt_thread_allowed()
    - cpu/SMT: Make SMT control more robust against enumeration failures
    - [x86] apic: Fake primary thread mask for XEN/PV
    - srcu: Fix callbacks acceleration mishandling
    - drivers/clocksource/timer-ti-dm: Don't call clk_get_rate() in stop
      function
    - [x86] nmi: Fix out-of-order NMI nesting checks & false positive warning
    - pstore/platform: Add check for kstrdup
    - perf: Optimize perf_cgroup_switch()
    - PCI/MSI: Provide stubs for IMS functions
    - string: Adjust strtomem() logic to allow for smaller sources
    - [x86] genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()
    - irqchip/sifive-plic: Fix syscore registration for multi-socket systems
    - wifi: ath12k: fix undefined behavior with __fls in dp
    - wifi: cfg80211: add flush functions for wiphy work
    - wifi: mac80211: move radar detect work to wiphy work
    - wifi: mac80211: move scan work to wiphy work
    - wifi: mac80211: move offchannel works to wiphy work
    - wifi: mac80211: move sched-scan stop work to wiphy work
    - wifi: mac80211: fix RCU usage warning in mesh fast-xmit
    - wifi: cfg80211: fix off-by-one in element defrag
    - wifi: mac80211: fix # of MSDU in A-MSDU calculation
    - wifi: iwlwifi: honor the enable_ini value
    - wifi: iwlwifi: don't use an uninitialized variable
    - i40e: fix potential memory leaks in i40e_remove()
    - iavf: Fix promiscuous mode configuration flow messages
    - [x86] bpf, x86: save/restore regs with BPF_DW size
    - [x86] bpf, x86: allow function arguments up to 12 for TRACING
    - [x86] bpf, x64: Fix tailcall infinite loop
    - wifi: cfg80211: fix kernel-doc for wiphy_delayed_work_flush()
    - udp: introduce udp->udp_flags
    - udp: move udp->no_check6_tx to udp->udp_flags
    - udp: move udp->no_check6_rx to udp->udp_flags
    - udp: move udp->gro_enabled to udp->udp_flags
    - udp: add missing WRITE_ONCE() around up->encap_rcv
    - udp: move udp->accept_udp_{l4|fraglist} to udp->udp_flags
    - udp: lockless UDP_ENCAP_L2TPINUDP / UDP_GRO
    - udp: annotate data-races around udp->encap_type
    - udplite: remove UDPLITE_BIT
    - udplite: fix various data-races
    - tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed
    - bpf: Fix kfunc callback register type handling
    - gve: Use size_add() in call to struct_size()
    - mlxsw: Use size_mul() in call to struct_size()
    - tls: Use size_add() in call to struct_size()
    - tipc: Use size_add() in calls to struct_size()
    - net: spider_net: Use size_add() in call to struct_size()
    - net: ethernet: mtk_wed: fix EXT_INT_STATUS_RX_FBUF definitions for MT7986
      SoC
    - wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
    - wifi: ath12k: fix DMA unmap warning on NULL DMA address
    - wifi: ath11k: fix boot failure with one MSI vector
    - wifi: mac80211: fix check for unusable RX result
    - PM: sleep: Fix symbol export for _SIMPLE_ variants of _PM_OPS()
    - wifi: ath: dfs_pattern_detector: Fix a memory initialization issue
    - tcp_metrics: add missing barriers on delete
    - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics()
    - tcp_metrics: do not create an entry from tcp_init_metrics()
    - wifi: rtlwifi: fix EDCA limit set by BT coexistence
    - ACPI: property: Allow _DSD buffer data only for byte accessors
    - ACPI: video: Add acpi_backlight=vendor quirk for Toshiba Portégé R100
    - wifi: ath11k: fix Tx power value during active CAC
    - can: dev: can_restart(): don't crash kernel if carrier is OK
    - can: dev: can_restart(): fix race condition between controller restart and
      netif_carrier_on()
    - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is
      accessed out of bounds
    - [arm64] PM / devfreq: rockchip-dfi: Make pmu regmap mandatory
    - wifi: wfx: fix case where rates are out of order
    - netfilter: nf_tables: Drop pointless memset when dumping rules
    - wifi: rtw88: Remove duplicate NULL check before calling
      usb_kill/free_urb()
    - thermal: core: prevent potential string overflow
    - r8169: fix rare issue with broken rx after link-down on RTL8125
    - bpf: Fix missed rcu read lock in bpf_task_under_cgroup()
    - net: skb_find_text: Ignore patterns extending past 'to'
    - thermal: core: Don't update trip points inside the hysteresis range
    - tcp: fix cookie_init_timestamp() overflows
    - wifi: iwlwifi: mvm: update station's MFP flag after association
    - wifi: iwlwifi: mvm: fix removing pasn station for responder
    - wifi: iwlwifi: mvm: use correct sta ID for IGTK/BIGTK
    - wifi: mac80211: don't recreate driver link debugfs in reconfig
    - wifi: mac80211: Fix setting vif links
    - wifi: iwlwifi: yoyo: swap cdb and jacket bits values
    - wifi: iwlwifi: mvm: Correctly set link configuration
    - wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface
    - wifi: iwlwifi: mvm: Don't always bind/link the P2P Device interface
    - wifi: iwlwifi: mvm: change iwl_mvm_flush_sta() API
    - wifi: iwlwifi: mvm: fix iwl_mvm_mac_flush_sta()
    - wifi: iwlwifi: mvm: remove TDLS stations from FW
    - wifi: iwlwifi: increase number of RX buffers for EHT devices
    - wifi: iwlwifi: mvm: fix netif csum flags
    - wifi: iwlwifi: pcie: synchronize IRQs before NAPI
    - wifi: iwlwifi: mvm: update IGTK in mvmvif upon D3 resume
    - wifi: iwlwifi: empty overflow queue during flush
    - Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync
    - Bluetooth: ISO: Pass BIG encryption info through QoS
    - Bluetooth: Make handle of hci_conn be unique
    - Bluetooth: hci_sync: Fix Opcode prints in bt_dev_dbg/err
    - bpf: Fix unnecessary -EBUSY from htab_lock_bucket
    - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias()
    - mptcp: properly account fastopen data
    - ipv6: avoid atomic fragment on GSO packets
    - virtio_net: use u64_stats_t infra to avoid data-races
    - net: add DEV_STATS_READ() helper
    - ipvlan: properly track tx_errors
    - regmap: debugfs: Fix a erroneous check after snprintf()
    - [arm64] spi: tegra: Fix missing IRQ check in tegra_slink_probe()
    - clk: qcom: ipq5332: Drop set rate parent from gpll0 dependent clocks
    - clk: qcom: gcc-msm8996: Remove RPM bus clocks
    - clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies
    - clk: qcom: mmcc-msm8998: Don't check halt bit on some branch clks
    - clk: qcom: mmcc-msm8998: Fix the SMMU GDSC
    - clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src
    - regulator: mt6358: Fail probe on unknown chip ID
    - clk: imx: Select MXC_CLK for CLK_IMX8QXP
    - clk: imx: imx8mq: correct error handling path
    - clk: imx: imx8qxp: Fix elcdif_pll clock
    - clk: renesas: rcar-gen3: Extend SDnH divider table
    - clk: renesas: rzg2l: Wait for status bit of SD mux before continuing
    - clk: renesas: rzg2l: Lock around writes to mux register
    - clk: renesas: rzg2l: Trust value returned by hardware
    - clk: renesas: rzg2l: Use FIELD_GET() for PLL register fields
    - clk: renesas: rzg2l: Fix computation formula
    - clk: linux/clk-provider.h: fix kernel-doc warnings and typos
    - [arm64] spi: nxp-fspi: use the correct ioremap function
    - clk: ralink: mtmips: quiet unused variable warning
    - clk: keystone: pll: fix a couple NULL vs IS_ERR() checks
    - clk: ti: fix double free in of_ti_divider_clk_setup()
    - clk: npcm7xx: Fix incorrect kfree
    - clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
    - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
    - clk: qcom: config IPQ_APSS_6018 should depend on QCOM_SMEM
    - clk: qcom: clk-alpha-pll: introduce stromer plus ops
    - clk: qcom: apss-ipq-pll: Use stromer plus ops for stromer plus pll
    - clk: qcom: apss-ipq-pll: Fix 'l' value for ipq5332_pll_config
    - clk: qcom: ipq9574: drop the CLK_SET_RATE_PARENT flag from GPLL clocks
    - clk: qcom: ipq5332: drop the CLK_SET_RATE_PARENT flag from GPLL clocks
    - clk: mediatek: fix double free in mtk_clk_register_pllfh()
    - [x86] platform/x86: wmi: Fix probe failure when failing to register WMI
      devices
    - [x86] platform/x86: wmi: Fix opening of char device
    - regulator: qcom-rpmh: Fix smps4 regulator for pm8550ve
    - hwmon: (axi-fan-control) Fix possible NULL pointer dereference
    - hwmon: (coretemp) Fix potentially truncated sysfs attribute name
    - Revert "hwmon: (sch56xx-common) Add DMI override table"
    - Revert "hwmon: (sch56xx-common) Add automatic module loading on supported
      devices"
    - hwmon: (sch5627) Use bit macros when accessing the control register
    - hwmon: (sch5627) Disallow write access if virtual registers are locked
    - hte: tegra: Fix missing error code in tegra_hte_test_probe()
    - platform/chrome: cros_ec_lpc: Separate host command and irq disable
    - spi: omap2-mcspi: remove redundant dev_err_probe()
    - spi: omap2-mcspi: switch to use modern name
    - spi: omap2-mcspi: Fix hardcoded reference clock
    - drm: bridge: samsung-dsim: Initialize ULPS EXIT for i.MX8M DSIM
    - drm: bridge: for GENERIC_PHY_MIPI_DPHY also select GENERIC_PHY
    - drm: bridge: samsung-dsim: Fix waiting for empty cmd transfer FIFO on
      older Exynos
    - drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs
    - drm/rockchip: vop: Fix call to crtc reset helper
    - drm/rockchip: vop2: Don't crash for invalid duplicate_state
    - drm/rockchip: vop2: Add missing call to crtc reset helper
    - drm/radeon: possible buffer overflow
    - drm: bridge: it66121: Fix invalid connector dereference
    - drm/bridge: lt8912b: Fix bridge_detach
    - drm/bridge: lt8912b: Fix crash on bridge detach
    - drm/bridge: lt8912b: Manually disable HPD only if it was enabled
    - drm/bridge: lt8912b: Add missing drm_bridge_attach call
    - drm/mediatek: Fix coverity issue with unintentional integer overflow
    - [x86] tdx: Zero out the missing RSI in TDX_HYPERCALL macro
    - drm/bridge: tc358768: Fix use of uninitialized variable
    - drm/bridge: tc358768: Fix bit updates
    - drm/bridge: tc358768: Use struct videomode
    - drm/bridge: tc358768: Print logical values, not raw register values
    - drm/bridge: tc358768: Use dev for dbg prints, not priv->dev
    - drm/bridge: tc358768: Rename dsibclk to hsbyteclk
    - drm/bridge: tc358768: Clean up clock period code
    - drm/bridge: tc358768: Fix tc358768_ns_to_cnt()
    - drm/aspeed: Convert to platform remove callback returning void
    - drm/stm: Convert to platform remove callback returning void
    - drm/tve200: Convert to platform remove callback returning void
    - drm: Call drm_atomic_helper_shutdown() at shutdown/remove time for misc
      drivers
    - drm/amdgpu: Increase IH soft ring size for GFX v9.4.3 dGPU
    - drm/amd/display: Fix null pointer dereference in error message
    - drm/amd/display: Check all enabled planes in dm_check_crtc_cursor
    - drm/amd/display: Refactor dm_get_plane_scale helper
    - drm/amd/display: Bail from dm_check_crtc_cursor if no relevant change
    - io_uring/kbuf: Fix check of BID wrapping in provided buffers
    - io_uring/kbuf: Allow the full buffer id space for provided buffers
    - accel/habanalabs/gaudi2: Fix incorrect string length computation in
      gaudi2_psoc_razwi_get_engines()
    - drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe()
    - [arm64,armhf] gpu: host1x: Correct allocated size for contexts
    - drm/bridge: lt9611uxc: fix the race in the error path
    - [arm*] xen: enlighten: Fix KPTI checks
    - drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map()
    - xenbus: fix error exit in xenbus_init()
    - xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled
    - [arm64] drm/msm/dsi: use msm_gem_kernel_put to free TX buffer
    - [arm64] drm/msm/dsi: free TX buffer in unbind
    - clocksource/drivers/arm_arch_timer: limit XGene-1 workaround
    - drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for
      hisi_hns3_pmu uninit process
    - drm/amd/pm: Fix a memory leak on an error path
    - perf/arm-cmn: Fix DTC domain detection
    - drivers/perf: hisi_pcie: Check the type first in pmu::event_init()
    - perf: hisi: Fix use-after-free when register pmu fails
    - [arm64] dts: qcom: sdm845: Fix PSCI power domain names
    - [arm64] dts: qcom: sdm845: cheza doesn't support LMh node
    - [arm64] dts: qcom: sc7280: link usb3_phy_wrapper_gcc_usb30_pipe_clk
    - [arm64] dts: qcom: msm8916: Fix iommu local address range
    - [arm64] dts: qcom: msm8992-libra: drop duplicated reserved memory
    - [arm64] dts: qcom: sm6125: Pad APPS IOMMU address to 8 characters
    - [arm64] dts: qcom: sc7280: Add missing LMH interrupts
    - [arm64] dts: qcom: qrb2210-rb1: Swap UART index
    - [arm64] dts: qcom: sc7280: drop incorrect EUD port on SoC side
    - [arm64] dts: qcom: sm8150: add ref clock to PCIe PHYs
    - [arm64] dts: qcom: sm8350: fix pinctrl for UART18
    - [arm64] dts: qcom: sdm845-mtp: fix WiFi configuration
    - [arm64] dts: marvell: cn9310: Use appropriate label for spi1 pins
    - [arm64] dts: qcom: msm8976: Fix ipc bit shifts
    - [arm64] dts: qcom: msm8939: Fix iommu local address range
    - [riscv64] dts: allwinner: remove address-cells from intc node
    - [arm64] dts: qcom: apq8016-sbc: Add missing ADV7533 regulators
    - [arm64] soc: qcom: llcc: Handle a second device without data corruption
    - firmware: ti_sci: Mark driver as non removable
    - [arm64] dts: ti: k3-am625-beagleplay: Fix typo in ramoops reg
    - [arm64] dts: ti: k3-am62a7-sk: Drop i2c-1 to 100Khz
    - firmware: arm_ffa: Assign the missing IDR allocation ID to the FFA device
    - firmware: arm_ffa: Allow the FF-A drivers to use 32bit mode of messaging
    - clk: scmi: Free scmi_clk allocated when the clocks with invalid info are
      skipped
    - [arm64] dts: imx8qm-ss-img: Fix jpegenc compatible entry
    - [arm64] dts: imx8mp-debix-model-a: Remove USB hub reset-gpios
    - [arm64] dts: imx8mm: Add sound-dai-cells to micfil node
    - [arm64] dts: imx8mn: Add sound-dai-cells to micfil node
    - [arm64] tegra: Fix P3767 card detect polarity
    - [arm64] tegra: Fix P3767 QSPI speed
    - firmware: tegra: Add suspend hook and reset BPMP IPC early on resume
    - memory: tegra: Set BPMP msg flags to reset IPC channels
    - [arm64] tegra: Use correct interrupts for Tegra234 TKE
    - [arm64] soc: qcom: pmic_glink: fix connector type to be DisplayPort
    - ASoC: cs35l41: Handle mdsync_down reg write errors
    - ASoC: cs35l41: Initialize completion object before requesting IRQ
    - ASoC: cs35l41: Verify PM runtime resume errors in IRQ handler
    - ASoC: cs35l41: Undo runtime PM changes at driver exit time
    - ALSA: hda: cs35l41: Fix unbalanced pm_runtime_get()
    - ALSA: hda: cs35l41: Undo runtime PM changes at driver exit time
    - KEYS: Include linux/errno.h in linux/verification.h
    - crypto: hisilicon/hpre - Fix a erroneous check after snprintf()
    - hwrng: bcm2835 - Fix hwrng throughput regression
    - [i386] hwrng: geode - fix accessing registers
    - RDMA/core: Use size_{add,sub,mul}() in calls to struct_size()
    - [x86] crypto: qat - fix state machines cleanup paths
    - [x86] crypto: qat - ignore subsequent state up commands
    - [x86] crypto: qat - fix unregistration of crypto algorithms
    - [x86] crypto: qat - fix unregistration of compression algorithms
    - scsi: ibmvfc: Fix erroneous use of rtas_busy_delay with hcall return code
    - ASoC: soc-pcm.c: Make sure DAI parameters cleared if the DAI becomes
      inactive
    - libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its
      return value
    - nd_btt: Make BTT lanes preemptible
    - crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure
    - crypto: caam/jr - fix Chacha20 + Poly1305 self test failure
    - [x86] crypto: qat - increase size of buffers
    - [x86] ASoC: SOF: ipc4-topology: Use size_add() in call to struct_size()
    - PCI: vmd: Correct PCI Header Type Register's multi-function check
    - hid: cp2112: Fix duplicate workqueue initialization
    - crypto: hisilicon/qm - fix PF queue parameter issue
    - [armel,armhf] 9321/1: memset: cast the constant byte to unsigned char
    - [armel,armhf] 9323/1: mm: Fix ARCH_LOW_ADDRESS_LIMIT when CONFIG_ZONE_DMA
    - ext4: move 'ix' sanity check to corrent position
    - ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not
      described
    - backlight: pwm_bl: Disable PWM on shutdown, suspend and remove
    - [x86] ASoC: Intel: sof_sdw_rt_sdca_jack_common: add rt713 support
    - ASoC: fsl-asoc-card: Add comment for mclk in the codec_priv
    - dlm: fix no ack after final message
    - IB/mlx5: Fix rdma counter binding for RAW QP
    - [x86] ASoC: SOF: core: Ensure sof_ops_free() is still called when probe
      never ran.
    - ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe
    - scsi: ufs: core: Leave space for '\0' in utf8 desc string
    - [amd64] RDMA/hfi1: Workaround truncation compilation error
    - HID: cp2112: Make irq_chip immutable
    - hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip
    - HID: uclogic: Fix user-memory-access bug in
      uclogic_params_ugee_v2_init_event_hooks()
    - HID: uclogic: Fix a work->entry not empty bug in __queue_work()
    - HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only
    - HID: logitech-hidpp: Revert "Don't restart communication if not necessary"
    - HID: logitech-hidpp: Move get_wireless_feature_index() check to
      hidpp_connect_event()
    - ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails
    - PCI: endpoint: Fix double free in __pci_epc_create()
    - padata: Fix refcnt handling in padata_free_shell()
    - certs: Break circular dependency when selftest is modular
    - crypto: qat - fix deadlock in backlog processing
    - ASoC: ams-delta.c: use component after check
    - erofs: fix erofs_insert_workgroup() lockref usage
    - IB/mlx5: Fix init stage error handling to avoid double free of same QP and
      UAF
    - mfd: core: Un-constify mfd_cell.of_reg
    - mfd: core: Ensure disabled devices are skipped without aborting
    - mfd: dln2: Fix double put in dln2_probe
    - dt-bindings: mfd: mt6397: Split out compatible for MediaTek MT6366 PMIC
    - mfd: arizona-spi: Set pdata.hpdet_channel for ACPI enumerated devs
    - leds: turris-omnia: Drop unnecessary mutex locking
    - leds: turris-omnia: Do not use SMBUS calls
    - leds: pwm: Don't disable the PWM when the LED should be off
    - leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu'
    - apparmor: fix invalid reference on profile->disconnected
    - perf stat: Fix aggr mode initialization
    - iio: frequency: adf4350: Use device managed functions and fix power down
      issue.
    - perf kwork: Fix incorrect and missing free atom in work_push_atom()
    - perf kwork: Add the supported subcommands to the document
    - perf kwork: Set ordered_events to true in 'struct perf_tool'
    - f2fs: compress: fix deadloop in f2fs_write_cache_pages()
    - f2fs: compress: fix to avoid use-after-free on dic
    - f2fs: compress: fix to avoid redundant compress extension
    - f2fs: fix to drop meta_inode's page cache in f2fs_put_super()
    - tty: tty_jobctrl: fix pid memleak in disassociate_ctty()
    - perf parse-events: Remove unused PE_PMU_EVENT_FAKE token
    - perf parse-events: Remove unused PE_KERNEL_PMU_EVENT token
    - perf parse-events: Remove ABORT_ON
    - perf tools: Revert enable indices setting syntax for BPF map
    - perf parse-events: Fix tracepoint name memory leak
    - pinctrl: renesas: rzg2l: Make reverse order of enable() for disable()
    - perf record: Fix BTF type checks in the off-cpu profiling
    - dmaengine: idxd: Register dsa_bus_type before registering idxd sub-drivers
    - usb: dwc2: fix possible NULL pointer dereference caused by driver
      concurrency
    - usb: chipidea: Fix DMA overwrite for Tegra
    - usb: chipidea: Simplify Tegra DMA alignment code
    - dmaengine: ti: edma: handle irq_of_parse_and_map() errors
    - tools/perf: Update call stack check in builtin-lock.c
    - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave()
    - tools: iio: iio_generic_buffer ensure alignment
    - USB: usbip: fix stub_dev hub disconnect
    - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc()
    - f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()
    - [powerpc*] Only define __parse_fpscr() when required
    - perf build: Add missing comment about NO_LIBTRACEEVENT=1
    - perf parse-events: Fix for term values that are raw events
    - perf pmu: Remove logic for PMU name being NULL
    - perf mem-events: Avoid uninitialized read
    - [s390x] ap: re-init AP queues on config on
    - modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host
    - modpost: fix ishtp MODULE_DEVICE_TABLE built on big-endian host
    - perf tools: Do not ignore the default vmlinux.h
    - [powerpc*] 40x: Remove stale PTE_ATOMIC_UPDATES macro
    - [powerpc*] xive: Fix endian conversion size
    - [powerpc*] Hide empty pt_regs at base of the stack
    - perf trace: Use the right bpf_probe_read(_str) variant for reading user
      data
    - [powerpc*] vas: Limit open window failure messages in log bufffer
    - [powerpc*] imc-pmu: Use the correct spinlock initializer.
    - [powerpc*] pseries: fix potential memory leak in init_cpu_associativity()
    - perf vendor events: Update PMC used in PM_RUN_INST_CMPL event for power10
      platform
    - xhci: Loosen RPM as default policy to cover for AMD xHC 1.1
    - usb: host: xhci-plat: fix possible kernel oops while resuming
    - perf machine: Avoid out of bounds LBR memory read
    - perf hist: Add missing puts to hist__account_cycles
    - perf vendor events intel: Fix broadwellde tma_info_system_dram_bw_use
      metric
    - perf vendor events intel: Add broadwellde two metrics
    - 9p/net: fix possible memory leak in p9_check_errors()
    - rtla: Fix uninitialized variable found
    - i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs
    - rtc: brcmstb-waketimer: support level alarm_irq
    - cxl/pci: Remove unnecessary device reference management in sanitize work
    - cxl/pci: Cleanup 'sanitize' to always poll
    - cxl/pci: Remove inconsistent usage of dev_err_probe()
    - cxl/pci: Clarify devm host for memdev relative setup
    - cxl/pci: Fix sanitize notifier setup
    - cxl/memdev: Fix sanitize vs decoder setup locking
    - cxl/mem: Fix shutdown order
    - virt: sevguest: Fix passing a stack buffer as a scatterlist target
    - rtc: pcf85363: Allow to wake up system without IRQ
    - rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call
    - cxl/region: Prepare the decoder match range helper for reuse
    - cxl/region: Calculate a target position in a region interleave
    - cxl/region: Use cxl_calc_interleave_pos() for auto-discovery
    - cxl/region: Fix cxl_region_rwsem lock held when returning to user space
    - cxl/core/regs: Rename @dev to @host in struct cxl_register_map
    - cxl/port: Fix @host confusion in cxl_dport_setup_regs()
    - cxl/hdm: Remove broken error path
    - pcmcia: cs: fix possible hung task and memory leak pccardd()
    - pcmcia: ds: fix refcount leak in pcmcia_device_add()
    - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()
    - media: imx-jpeg: initiate a drain of the capture queue in dynamic
      resolution change
    - media: hantro: Check whether reset op is defined before use
    - media: verisilicon: Do not enable G2 postproc downscale if source is
      narrower than destination
    - media: ov5640: fix vblank unchange issue when work at dvp mode
    - media: i2c: max9286: Fix some redundant of_node_put() calls
    - media: ov5640: Fix a memory leak when ov5640_probe fails
    - media: bttv: fix use after free error due to btv->timeout timer
    - media: amphion: handle firmware debug message
    - media: mtk-jpegenc: Fix bug in JPEG encode quality selection
    - media: s3c-camif: Avoid inappropriate kfree()
    - media: vidtv: psi: Add check for kstrdup
    - media: vidtv: mux: Add check and kfree for kstrdup
    - media: cedrus: Fix clock/reset sequence
    - media: cadence: csi2rx: Unregister v4l2 async notifier
    - media: dvb-usb-v2: af9035: fix missing unlock
    - media: verisilicon: Fixes clock list for rk3588 av1 decoder
    - media: imx-jpeg: notify source chagne event when the first picture parsed
    - media: platform: mtk-mdp3: fix uninitialized variable in mdp_path_config()
    - media: cec: meson: always include meson sub-directory in Makefile
    - cpupower: fix reference to nonexistent document
    - regmap: prevent noinc writes from clobbering cache
    - drm/amdgpu/gfx10,11: use memcpy_to/fromio for MQDs
    - drm/amdgpu: don't put MQDs in VRAM on ARM | ARM64
    - pwm: sti: Reduce number of allocations and drop usage of chip_data
    - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume
    - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
    - watchdog: ixp4xx: Make sure restart always works
    - llc: verify mac len before reading mac header
    - hsr: Prevent use after free in prp_create_tagged_frame()
    - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
    - rxrpc: Fix two connection reaping bugs
    - bpf: Check map->usercnt after timer->timer is assigned
    - inet: shrink struct flowi_common
    - net: page_pool: add missing free_percpu when page_pool_init fail
    - dccp: Call security_inet_conn_request() after setting IPv4 addresses.
    - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
    - net: r8169: Disable multicast filter for RTL8168H and RTL8107E
    - Fix termination state for idr_for_each_entry_ul()
    - net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs
    - net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT
    - net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc
    - net/smc: put sk reference if close work was canceled
    - nvme: fix error-handling for io_uring nvme-passthrough
    - tg3: power down device only on SYSTEM_POWER_OFF
    - nbd: fix uaf in nbd_open
    - blk-core: use pr_warn_ratelimited() in bio_check_ro()
    - vsock/virtio: remove socket from connected/bound list on shutdown
    - r8169: respect userspace disabling IFF_MULTICAST
    - net: enetc: shorten enetc_setup_xdp_prog() error message to fit
      NETLINK_MAX_FMTMSG_LEN
    - i2c: iproc: handle invalid slave state
    - netfilter: xt_recent: fix (increase) ipv6 literal buffer length
    - netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
    - net/sched: act_ct: Always fill offloading tuple iifidx
    - [riscv64] Don't fail in riscv_of_parent_hartid() for disabled HARTs
    - drm/vc4: tests: Fix UAF in the mock helpers
    - drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE
    - ASoC: hdmi-codec: register hpd callback on component probe
    - ASoC: dapm: fix clock get name
    - spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies
    - [arm*] arm_pmuv3: perf: Don't truncate 64-bit registers
    - fbdev: imsttfb: fix double free in probe()
    - fbdev: imsttfb: fix a resource leak in probe
    - ALSA: hda/realtek: Add support dual speaker for Dell
    - fbdev: fsl-diu-fb: mark wr_reg_wa() static
    - tracing/kprobes: Fix the order of argument descriptions
    - Revert "drm/ast: report connection status on Display Port."
    - io_uring/net: ensure socket is marked connected on connect retry
    - [x86] amd_nb: Use Family 19h Models 60h-7Fh Function 4 IDs
    - Revert "PCI/ASPM: Disable only ASPM_STATE_L1 when driver, disables L1"
    - Revert "mmc: core: Capture correct oemid-bits for eMMC cards"
    - btrfs: use u64 for buffer sizes in the tree search ioctls
    - [x86] bpf, x86: initialize the variable "first_off" in save_args()
    - perf parse-events: Fix driver config term
    - btrfs: make found_logical_ret parameter mandatory for function
      queue_scrub_stripe()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.13
    - btrfs: abort transaction on generation mismatch when marking eb as dirty
    - lib/generic-radix-tree.c: Don't overflow in peek()
    - [x86] retpoline: Make sure there are no unconverted return thunks due to
      KCSAN
    - perf/core: Bail out early if the request AUX area is out of bound
    - srcu: Fix srcu_struct node grpmask overflow on 64-bit systems
    - [armhf] clocksource/drivers/timer-imx-gpt: Fix potential memory leak
    - srcu: Only accelerate on enqueue time
    - smp,csd: Throw an error if a CSD lock is stuck for too long
    - cpu/hotplug: Don't offline the last non-isolated CPU
    - workqueue: Provide one lock class key per work_on_cpu() callsite
    - [x86] mm: Drop the 4 MB restriction on minimal NUMA node memory size
    - wifi: plfxlc: fix clang-specific fortify warning
    - wifi: ath12k: Ignore fragments from uninitialized peer in dp
    - wifi: mac80211_hwsim: fix clang-specific fortify warning
    - wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
    - atl1c: Work around the DMA RX overflow issue
    - bpf: Detect IP == ksym.end as part of BPF program
    - wifi: ath9k: fix clang-specific fortify warnings
    - wifi: ath12k: fix possible out-of-bound read in
      ath12k_htt_pull_ppdu_stats()
    - wifi: ath10k: fix clang-specific fortify warning
    - wifi: ath12k: fix possible out-of-bound write in
      ath12k_wmi_ext_hal_reg_caps()
    - ACPI: APEI: Fix AER info corruption when error status data has multiple
      sections
    - net: sfp: add quirk for Fiberstone GPON-ONU-34-20BI
    - wifi: mt76: mt7921e: Support MT7992 IP in Xiaomi Redmibook 15 Pro (2023)
    - net: annotate data-races around sk->sk_tx_queue_mapping
    - net: annotate data-races around sk->sk_dst_pending_confirm
    - wifi: ath12k: mhi: fix potential memory leak in ath12k_mhi_register()
    - wifi: ath10k: Don't touch the CE interrupt registers after power up
    - net: sfp: add quirk for FS's 2.5G copper SFP
    - vsock: read from socket's error queue
    - bpf: Ensure proper register state printing for cond jumps
    - wifi: iwlwifi: mvm: fix size check for fw_link_id
    - Bluetooth: btusb: Add date->evt_skb is NULL check
    - Bluetooth: Fix double free in hci_conn_cleanup
    - ACPI: EC: Add quirk for HP 250 G7 Notebook PC
    - tsnep: Fix tsnep_request_irq() format-overflow warning
    - gpiolib: acpi: Add a ignore interrupt quirk for Peaq C1010
    - platform/chrome: kunit: initialize lock for fake ec_dev
    - of: address: Fix address translation when address-size is greater than 2
    - [x86] platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
    - [x86] drm/gma500: Fix call trace when psb_gem_mm_init() fails
    - drm/amd/display: Blank phantom OTG before enabling
    - drm/amd/display: Don't lock phantom pipe on disabling
    - drm/amd/display: add seamless pipe topology transition check
    - drm/edid: Fixup h/vsync_end instead of h/vtotal
    - md: don't rely on 'mddev->pers' to be set in mddev_suspend()
    - drm/amdgpu: not to save bo in the case of RAS err_event_athub
    - drm/amd: Update `update_pcie_parameters` functions to use uint8_t
      arguments
    - drm/amd/display: use full update for clip size increase of large plane
      source
    - string.h: add array-wrappers for (v)memdup_user()
    - kernel: kexec: copy user-array safely
    - kernel: watch_queue: copy user-array safely
    - drm_lease.c: copy user-array safely
    - drm: vmwgfx_surface.c: copy user-array safely
    - [arm64] drm/msm/dp: skip validity check for DP CTS EDID checksum
    - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
    - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
    - drm/amdgpu: Fix potential null pointer derefernce
    - drm/panel: fix a possible null pointer dereference
    - drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
    - drm/radeon: fix a possible null pointer dereference
    - drm/amdgpu/vkms: fix a possible null pointer dereference
    - drm/panel: st7703: Pick different reset sequence
    - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
    - drm/amd: Disable PP_PCIE_DPM_MASK when dynamic speed switching not
      supported
    - drm/amd/display: fix num_ways overflow error
    - drm/amd: check num of link levels when update pcie param
    - [arm64] dts: ls208xa: use a pseudo-bus to constrain usb dma size
    - ASoC: soc-card: Add storage for PCI SSID
    - [x86] ASoC: SOF: Pass PCI SSID to machine driver
    - crypto: pcrypt - Fix hungtask for PADATA_RESET
    - [x86] ASoC: SOF: ipc4: handle EXCEPTION_CAUGHT notification from firmware
    - [amd64] RDMA/hfi1: Use FIELD_GET() to extract Link Width
    - [arm64] scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing
      debugfs
    - [powerpc*] scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool
    - fs/jfs: Add check for negative db_l2nbperpage
    - fs/jfs: Add validity check for db_maxag and db_agpref
    - jfs: fix array-index-out-of-bounds in dbFindLeaf
    - jfs: fix array-index-out-of-bounds in diAlloc
    - HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround
    - [armel,armhf] 9320/1: fix stack depot IRQ stack filter
    - ALSA: hda: Fix possible null-ptr-deref when assigning a stream
    - gpiolib: of: Add quirk for mt2701-cs42448 ASoC sound
    - [armel,armhf] PCI: mvebu: Use FIELD_PREP() with Link Width
    - atm: iphase: Do PCI error checks on own line
    - PCI: Do error check on own line to split long "if" conditions
    - scsi: libfc: Fix potential NULL pointer dereference in
      fc_lport_ptp_setup()
    - PCI: Use FIELD_GET() to extract Link Width
    - PCI: Extract ATS disabling to a helper function
    - PCI: Disable ATS for specific Intel IPU E2000 devices
    - PCI: dwc: Add dw_pcie_link_set_max_link_width()
    - PCI: dwc: Add missing PCI_EXP_LNKCAP_MLW handling
    - misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller
    - PCI: Use FIELD_GET() in Sapphire RX 5600 XT Pulse quirk
    - [x86] ASoC: Intel: soc-acpi-cht: Add Lenovo Yoga Tab 3 Pro YT3-X90 quirk
    - crypto: hisilicon/qm - prevent soft lockup in receive loop
    - HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
    - exfat: support handle zero-size directory
    - mfd: intel-lpss: Add Intel Lunar Lake-M PCI IDs
    - iio: adc: stm32-adc: harden against NULL pointer deref in
      stm32_adc_probe()
    - [x86] thunderbolt: Apply USB 3.x bandwidth quirk only in software
      connection manager
    - tty: vcc: Add check for kstrdup() in vcc_probe()
    - dt-bindings: phy: qcom,snps-eusb2-repeater: Add magic tuning overrides
    - phy: qualcomm: phy-qcom-eusb2-repeater: Use regmap_fields
    - phy: qualcomm: phy-qcom-eusb2-repeater: Zero out untouched tuning regs
    - usb: dwc3: core: configure TX/RX threshold for DWC3_IP
    - usb: ucsi: glink: use the connector orientation GPIO to provide switch
      events
    - soundwire: dmi-quirks: update HP Omen match
    - f2fs: fix error path of __f2fs_build_free_nids
    - f2fs: fix error handling of __get_node_page
    - usb: host: xhci: Avoid XHCI resume delay if SSUSB device is not present
    - usb: gadget: f_ncm: Always set current gadget in ncm_bind()
    - 9p/trans_fd: Annotate data-racy writes to file::f_flags
    - 9p: v9fs_listxattr: fix %s null argument warning
    - i2c: i801: Add support for Intel Birch Stream SoC
    - i2c: fix memleak in i2c_new_client_device()
    - i2c: sun6i-p2wi: Prevent potential division by zero
    - virtio-blk: fix implicit overflow on virtio_max_dma_size
    - media: gspca: cpia1: shift-out-of-bounds in set_flicker
    - media: vivid: avoid integer overflow
    - media: ipu-bridge: increase sensor_name size
    - gfs2: ignore negated quota changes
    - gfs2: fix an oops in gfs2_permission
    - media: cobalt: Use FIELD_GET() to extract Link Width
    - media: ccs: Fix driver quirk struct documentation
    - media: imon: fix access to invalid resource for the second interface
    - drm/amd/display: Avoid NULL dereference of timing generator
    - [riscv64] VMAP_STACK overflow detection thread-safe
    - i2c: dev: copy userspace array safely
    - [armhf] ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
    - drm/qxl: prevent memory leak
    - ALSA: hda/realtek: Add quirk for ASUS UX7602ZM
    - drm/amdgpu: fix software pci_unplug on some chips
    - pwm: Fix double shift bug
    - wifi: iwlwifi: Use FW rate for non-data frames
    - sched/core: Optimize in_task() and in_interrupt() a bit
    - dt-bindings: serial: fix regex pattern for matching serial node children
    - SUNRPC: ECONNRESET might require a rebind
    - [x86] drm/i915/mtl: avoid stringop-overflow warning
    - NFSv4.1: fix handling NFS4ERR_DELAY when testing for session trunking
    - SUNRPC: Add an IS_ERR() check back to where it was
    - NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
    - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
    - [riscv64] hwprobe: Fix vDSO SIGSEGV
    - [riscv64] provide riscv-specific is_trap_insn()
    - gfs2: Silence "suspicious RCU usage in gfs2_permission" warning
    - [x86] drm/i915/tc: Fix -Wformat-truncation in intel_tc_port_init
    - bpf: handle ldimm64 properly in check_cfg()
    - bpf: fix precision backtracking instruction iteration
    - net: set SOCK_RCU_FREE before inserting socket into hashtable
    - ipvlan: add ipvlan_route_v6_outbound() helper
    - tty: Fix uninit-value access in ppp_sync_receive()
    - xen/events: avoid using info_for_irq() in xen_send_IPI_one()
    - [arm64] net: hns3: fix add VLAN fail issue
    - [arm64] net: hns3: add barrier in vf mailbox reply process
    - [arm64] net: hns3: fix incorrect capability bit display for copper port
    - [arm64] net: hns3: fix out-of-bounds access may occur when coalesce info
      is read via debugfs
    - [arm64] net: hns3: fix variable may not initialized problem in
      hns3_init_mac_addr()
    - [arm64] net: hns3: fix VF reset fail issue
    - [arm64] net: hns3: fix VF wrong speed and duplex issue
    - tipc: Fix kernel-infoleak due to uninitialized TLV value
    - net: mvneta: fix calls to page_pool_get_stats
    - ppp: limit MRU to 64K
    - xen/events: fix delayed eoi list handling
    - blk-mq: make sure active queue usage is held for bio_integrity_prep()
    - ptp: annotate data-race around q->head and q->tail
    - bonding: stop the device in bond_setup_by_slave()
    - net: ethernet: cortina: Fix max RX frame define
    - net: ethernet: cortina: Handle large frames
    - net: ethernet: cortina: Fix MTU max setting
    - af_unix: fix use-after-free in unix_stream_read_actor()
    - netfilter: nf_conntrack_bridge: initialize err to 0
    - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
    - netfilter: nf_tables: bogus ENOENT when destroying element which does not
      exist
    - net: stmmac: fix rx budget limit check
    - net: stmmac: avoid rx queue overrun
    - pds_core: use correct index to mask irq
    - pds_core: fix up some format-truncation complaints
    - gve: Fixes for napi_poll when budget is 0
    - io_uring/fdinfo: remove need for sqpoll lock for thread/pid retrieval
    - net/mlx5: Decouple PHC .adjtime and .adjphase implementations
    - net/mlx5e: fix double free of encap_header
    - net/mlx5e: fix double free of encap_header in update funcs
    - net/mlx5e: Fix pedit endianness
    - net/mlx5: Consolidate devlink documentation in devlink/mlx5.rst
    - net/mlx5e: Make tx_port_ts logic resilient to out-of-order CQEs
    - net/mlx5e: Add recovery flow for tx devlink health reporter for unhealthy
      PTP SQ
    - net/mlx5e: Update doorbell for port timestamping CQ before the software
      counter
    - net/mlx5: Increase size of irq name buffer
    - net/mlx5e: Reduce the size of icosq_str
    - net/mlx5e: Check return value of snprintf writing to fw_version buffer
    - net/mlx5e: Check return value of snprintf writing to fw_version buffer for
      representors
    - net: sched: do not offload flows with a helper in act_ct
    - macvlan: Don't propagate promisc change to lower dev in passthru
    - scsi: ufs: core: Expand MCQ queue slot to DeviceQueueDepth + 1
    - cifs: spnego: add ';' in HOST_KEY_LEN
    - cifs: fix check of rc in function generate_smb3signingkey
    - perf/core: Fix cpuctx refcounting
    - [x86] i915/perf: Fix NULL deref bugs with drm_dbg() calls
    - perf: arm_cspmu: Reject events meant for other PMUs
    - drivers: perf: Check find_first_bit() return value
    - media: venus: hfi: add checks to perform sanity on queue pointers
    - [x86] perf intel-pt: Fix async branch flags
    - [powerpc*] perf: Fix disabling BHRB and instruction sampling
    - bpf: Fix check_stack_write_fixed_off() to correctly spill imm
    - bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
    - scsi: mpt3sas: Fix loop logic
    - scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for
      selected registers
    - scsi: ufs: qcom: Update PHY settings only when scaling to higher gears
    - scsi: qla2xxx: Fix system crash due to bad pointer access
    - scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
    - [x86] crypto: x86/sha - load modules based on CPU features
    - [x86] PCI: Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4
    - [x86] apic/msi: Fix misconfigured non-maskable MSI quirk
    - [x86] cpu/hygon: Fix the CPU topology evaluation for real
    - [x86] KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space
    - [x86] KVM: x86: Ignore MSR_AMD64_TW_CFG access
    - [x86] KVM: x86: Clear bit12 of ICR after APIC-write VM-exit
    - [x86] KVM: x86: Fix lapic timer interrupt lost after loading a snapshot.
    - mmc: sdhci-pci-gli: GL9755: Mask the replay timer timeout of AER
    - sched: psi: fix unprivileged polling against cgroups
    - audit: don't take task_lock() in audit_exe_compare() code path
    - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
    - proc: sysctl: prevent aliased sysctls from getting passed to init
    - tty/sysrq: replace smp_processor_id() with get_cpu()
    - tty: serial: meson: fix hard LOCKUP on crtscts mode
    - hvc/xen: fix console unplug
    - hvc/xen: fix error path in xen_hvc_init() to always register frontend
      driver
    - hvc/xen: fix event channel handling for secondary consoles
    - PCI/sysfs: Protect driver's D3cold preference from user space
    - watchdog: move softlockup_panic back to early_param
    - fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
    - dm crypt: account large pages in cc->n_allocated_pages
    - ACPI: resource: Do IRQ override on TongFang GMxXGxx
    - regmap: Ensure range selector registers are updated after cache sync
    - wifi: ath11k: fix temperature event locking
    - wifi: ath11k: fix dfs radar event locking
    - wifi: ath11k: fix htt pktlog locking
    - wifi: ath11k: fix gtk offload status event locking
    - wifi: ath12k: fix htt mlo-offset event locking
    - wifi: ath12k: fix dfs-radar and temperature event locking
    - mmc: meson-gx: Remove setting of CMD_CFG_ERROR
    - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
    - sched/core: Fix RQCF_ACT_SKIP leak
    - KEYS: trusted: tee: Refactor register SHM usage
    - KEYS: trusted: Rollback init_trusted() consistently
    - [arm64] Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
    - [arm64] module: Fix PLT counting when CONFIG_RANDOMIZE_BASE=n
    - cpufreq: stats: Fix buffer overflow detection in trans_stats()
    - [x86] powercap: intel_rapl: Downgrade BIOS locked limits pr_warn() to
      pr_debug()
    - ksmbd: fix recursive locking in vfs helpers
    - ksmbd: handle malformed smb1 message
    - ksmbd: fix slab out of bounds write in smb_inherit_dacl()
    - mmc: vub300: fix an error code
    - mmc: sdhci_am654: fix start loop index for TAP value parsing
    - mmc: Add quirk MMC_QUIRK_BROKEN_CACHE_FLUSH for Micron eMMC Q2J54A
    - PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common()
    - PCI: kirin: Don't discard .remove() callback
    - PCI: exynos: Don't discard .remove() callback
    - wifi: wilc1000: use vmm_table as array in wilc struct
    - svcrdma: Drop connection after an RDMA Read error
    - rcu/tree: Defer setting of jiffies during stall reset
    - [arm64] dts: qcom: ipq6018: Fix hwlock index for SMEM
    - dt-bindings: timer: renesas,rz-mtu3: Fix overflow/underflow interrupt
      names
    - PM: hibernate: Use __get_safe_page() rather than touching the list
    - PM: hibernate: Clean up sync_read handling in snapshot_write_next()
    - btrfs: don't arbitrarily slow down delalloc if we're committing
    - [x86] thermal: intel: powerclamp: fix mismatch in get function for
      max_idle
    - [arm64] dts: qcom: ipq5332: Fix hwlock index for SMEM
    - [arm64] dts: qcom: ipq8074: Fix hwlock index for SMEM
    - [arm64] firmware: qcom_scm: use 64-bit calling convention only when client
      is 64-bit
    - ACPI: FPDT: properly handle invalid FPDT subtables
    - [arm64] dts: qcom: ipq9574: Fix hwlock index for SMEM
    - [arm64] dts: qcom: ipq6018: Fix tcsr_mutex register size
    - leds: trigger: netdev: Move size check in set_device_name
    - [arm64] mfd: qcom-spmi-pmic: Fix reference leaks in revid helper
    - [arm64] mfd: qcom-spmi-pmic: Fix revid implementation
    - ima: annotate iint mutex to avoid lockdep false positive warnings
    - ima: detect changes to the backing overlay file
    - netfilter: nf_tables: remove catchall element in GC sync path
      (CVE-2023-6111)
    - netfilter: nf_tables: split async and sync catchall in two functions
    - ASoC: soc-dai: add flag to mute and unmute stream during trigger
    - hid: lenovo: Resend all settings on reset_resume for compact keyboards
    - [arm64] ASoC: codecs: wsa-macro: fix uninitialized stack variables with
      name prefix
    - jbd2: fix potential data lost in recovering journal raced with
      synchronizing fs bdev
    - quota: explicitly forbid quota files from being encrypted
    - kernel/reboot: emergency_restart: Set correct system_state
    - i2c: core: Run atomic i2c xfer when !preemptible
    - tracing: Have the user copy of synthetic event address use correct context
    - driver core: Release all resources during unbind before updating device
      links
    - mcb: fix error handling for different scenarios when parsing
    - [armhf] dmaengine: stm32-mdma: correct desc prep when channel running
    - [s390x] mm: add missing arch_set_page_dat() call to vmem_crst_alloc()
    - [s390x] cmma: fix detection of DAT pages
    - mm/cma: use nth_page() in place of direct struct page manipulation
    - mm/memory_hotplug: use pfn math in place of direct struct page
      manipulation
    - mm: make PR_MDWE_REFUSE_EXEC_GAIN an unsigned long
    - mtd: cfi_cmdset_0001: Byte swap OTP info
    - cxl/region: Do not try to cleanup after cxl_region_setup_targets() fails
    - cxl/region: Fix x1 root-decoder granularity calculations
    - cxl/port: Fix delete_endpoint() vs parent unregistration race
    - [arm64,armhf] pmdomain: bcm: bcm2835-power: check if the ASB register is
      equal to enable
    - [arm64,armhf] pmdomain: amlogic: Fix mask for the second NNA mem PD domain
    - [armhf] pmdomain: imx: Make imx pgc power domain also set the fwnode
    - PCI: Lengthen reset delay for VideoPropulsion Torrent QN16e card
    - mm/hugetlb: prepare hugetlb_follow_page_mask() for FOLL_PIN
    - mm/hugetlb: use nth_page() in place of direct struct page manipulation
    - xhci: Enable RPM on controllers that support low-power states
    - fs: add ctime accessors infrastructure
    - smb3: fix creating FIFOs when mounting with "sfu" mount option
    - smb3: fix touch -h of symlink
    - smb3: allow dumping session and tcon id to improve stats analysis and
      debugging
    - smb3: fix caching of ctime on setxattr
    - smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
    - smb: client: fix use-after-free in smb2_query_info_compound()
    - smb: client: fix potential deadlock when releasing mids
    - cifs: reconnect helper should set reconnect for the right channel
    - cifs: force interface update before a fresh session setup
    - cifs: do not reset chan_max if multichannel is not supported at mount
    - cifs: Fix encryption of cleared, but unset rq_iter data buffers
    - xfs: recovery should not clear di_flushiter unconditionally
    - btrfs: zoned: wait for data BG to be finished on direct IO allocation
    - ALSA: info: Fix potential deadlock at disconnection
    - ALSA: hda/realtek: Enable Mute LED on HP 255 G8
    - ALSA: hda/realtek - Add Dell ALC295 to pin fall back table
    - ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
    - ALSA: hda/realtek: Enable Mute LED on HP 255 G10
    - ALSA: hda/realtek: Add quirks for HP Laptops
    - Revert ncsi: Propagate carrier gain/loss events to the NCSI controller
    - Revert "i2c: pxa: move to generic GPIO recovery"
    - lsm: fix default return value for vm_enough_memory
    - lsm: fix default return value for inode_getsecctx
    - [arm64] sbsa_gwdt: Calculate timeout with 64-bit math
    - i2c: designware: Disable TX_EMPTY irq while waiting for block length byte
    - [s390x] ap: fix AP bus crash on early config change callback invocation
    - net: ethtool: Fix documentation of ethtool_sprintf()
    - net: dsa: lan9303: consequently nested-lock physical MDIO
    - net: phylink: initialize carrier state at creation
    - gfs2: don't withdraw if init_threads() got interrupted
    - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
    - f2fs: do not return EFSCORRUPTED, but try to run online repair
    - f2fs: set the default compress_level on ioctl
    - f2fs: avoid format-overflow warning
    - f2fs: split initial and dynamic conditions for extent_cache
    - media: lirc: drop trailing space from scancode transmit
    - media: sharp: fix sharp encoding
    - media: venus: hfi_parser: Add check to keep the number of codecs within
      range
    - media: venus: hfi: fix the check to handle session buffer requirement
    - media: venus: hfi: add checks to handle capabilities from firmware
    - media: ccs: Correctly initialise try compose rectangle
    - dm-bufio: fix no-sleep mode
    - dm-verity: don't use blocking calls from tasklets
    - nfsd: fix file memleak on client_opens_release
    - NFSD: Update nfsd_cache_append() to use xdr_stream
    - [riscv64] Using TOOLCHAIN_HAS_ZIHINTPAUSE marco replace zihintpause
    - [riscv64] put interrupt entries into .irqentry.text
    - [riscv64] mm: Update the comment of CONFIG_PAGE_OFFSET
    - [riscv64] correct pt_level name via pgtable_l5/4_enabled
    - [riscv64] kprobes: allow writing to x0
    - mmc: sdhci-pci-gli: A workaround to allow GL9750 to enter ASPM L1.2
    - mm: fix for negative counter: nr_file_hugepages
    - mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors
    - mptcp: deal with large GSO size
    - mptcp: add validity check for sending RM_ADDR
    - mptcp: fix setsockopt(IP_TOS) subflow locking
    - r8169: fix network lost after resume on DASH systems
    - r8169: add handling DASH when DASH is disabled
    - mmc: sdhci-pci-gli: GL9750: Mask the replay timer timeout of AER
    - Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
    - ext4: fix race between writepages and remount
    - ext4: make sure allocate pending entry not fail
    - ext4: apply umask if ACL support is disabled
    - ext4: correct offset of gdb backup in non meta_bg group to update_backups
    - ext4: mark buffer new if it is unwritten to avoid stale data exposure
    - ext4: correct return value of ext4_convert_meta_bg
    - ext4: correct the start block of counting reserved clusters
    - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
    - ext4: add missed brelse in update_backups
    - ext4: properly sync file size update after O_SYNC direct IO
    - ext4: fix racy may inline data check in dio write
    - drm/amd/pm: Handle non-terminated overdrive commands.
    - drm: bridge: it66121: ->get_edid callback must not return err pointers
    - [x86] drm/i915/mtl: Support HBR3 rate with C10 phy and eDP in MTL
    - [x86] drm/i915: Bump GLK CDCLK frequency when driving multiple pipes
    - [x86] drm/i915: Fix potential spectre vulnerability
    - [x86] drm/i915: Flush WC GGTT only on required platforms
    - drm/amd/pm: Fix error of MACO flag setting code
    - drm/amdgpu/smu13: drop compute workload workaround
    - drm/amdgpu: don't use pci_is_thunderbolt_attached()
    - drm/amdgpu: fix GRBM read timeout when do mes_self_test
    - drm/amdgpu: add a retry for IP discovery init
    - drm/amdgpu: don't use ATRM for external devices
    - drm/amdgpu: fix error handling in amdgpu_vm_init
    - drm/amdgpu: fix error handling in amdgpu_bo_list_get()
    - drm/amdgpu: lower CS errors to debug severity
    - drm/amdgpu: Fix possible null pointer dereference
    - drm/amd/display: Guard against invalid RPTR/WPTR being set
    - drm/amd/display: Fix DSC not Enabled on Direct MST Sink
    - drm/amd/display: fix a NULL pointer dereference in amdgpu_dm_i2c_xfer()
    - drm/amd/display: Enable fast plane updates on DCN3.2 and above
    - drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox
    - [powerpc*] powernv: Fix fortify source warnings in opal-prd.c
    - tracing: Have trace_event_file have ref counters
    - net/mlx5e: Avoid referencing skb after free-ing in drop path of
      mlx5e_sq_xmit_wqe
    - net/mlx5e: Track xmit submission to PTP WQ after populating metadata map

  [ Salvatore Bonaccorso ]
  * Bump ABI to 5

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 29 Nov 2023 08:45:07 +0100

linux (6.5.10-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.9
    - Bluetooth: hci_event: Ignore NULL link key
    - Bluetooth: Reject connection with the device which has same BD_ADDR
    - Bluetooth: Fix a refcnt underflow problem for hci_conn
    - Bluetooth: vhci: Fix race when opening vhci device
    - Bluetooth: hci_event: Fix coding style
    - Bluetooth: avoid memcmp() out of bounds warning
    - Bluetooth: hci_conn: Fix modifying handle while aborting
    - ice: fix over-shifted variable
    - ice: Fix safe mode when DDP is missing
    - ice: reset first in crash dump kernels
    - net/smc: return the right falback reason when prefix checks fail
    - btrfs: fix stripe length calculation for non-zoned data chunk allocation
    - regmap: fix NULL deref on lookup
    - [x86] KVM: x86: Mask LVTPC when handling a PMI
    - [x86] sev: Disable MMIO emulation from user mode (CVE-2023-46813)
    - [x86] sev: Check IOBM for IOIO exceptions from user-space (CVE-2023-46813)
    - [x86] sev: Check for user-space IOIO pointing to kernel space
      (CVE-2023-46813)
    - [x86] fpu: Allow caller to constrain xfeatures when copying to uabi buffer
    - [x86] KVM: x86/pmu: Truncate counter value to allowed width on write
    - [x86] KVM: x86: Constrain guest-supported xfeatures only at
      KVM_GET_XSAVE{2}
    - [x86] KVM: SVM: add support for Invalid IPI Vector interception
    - [x86] KVM: SVM: refresh AVIC inhibition in svm_leave_nested()
    - audit,io_uring: io_uring openat triggers audit reference count underflow
    - tcp: check mptcp-level constraints for backlog coalescing
    - mptcp: more conservative check for zero probes
    - mm: slab: Do not create kmalloc caches smaller than arch_slab_minalign()
    - Revert "net: wwan: iosm: enable runtime pm support for 7560"
    - netfilter: nft_payload: fix wrong mac header matching
    - io_uring: fix crash with IORING_SETUP_NO_MMAP and invalid SQ ring address
    - [x86] drm/i915: Retry gtt fault when out of fence registers
    - drm/nouveau/disp: fix DP capable DSM connectors
    - drm/edid: add 8 bpc quirk to the BenQ GW2765
    - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue
    - ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV
    - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx
    - [arm64] ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind
    - [arm64] ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe
      errors
    - [arm64] ASoC: codecs: wcd938x: drop bogus bind error handling
    - [arm64] ASoC: codecs: wcd938x: fix unbind tear down order
    - [arm64] ASoC: codecs: wcd938x: fix resource leaks on bind errors
    - [arm64] ASoC: codecs: wcd938x: fix regulator leaks on probe errors
    - [arm64] ASoC: codecs: wcd938x: fix runtime PM imbalance on remove
    - qed: fix LL2 RX buffer allocation
    - xfrm: fix a data-race in xfrm_lookup_with_ifid()
    - xfrm6: fix inet6_dev refcount underflow problem
    - xfrm: fix a data-race in xfrm_gen_index()
    - xfrm: interface: use DEV_STATS_INC()
    - net: xfrm: skip policies marked as dead while reinserting policies
    - fprobe: Fix to ensure the number of active retprobes is not zero
    - wifi: cfg80211: use system_unbound_wq for wiphy work
    - net: ipv4: fix return value check in esp_remove_trailer
    - net: ipv6: fix return value check in esp_remove_trailer
    - net: rfkill: gpio: prevent value glitch during probe
    - tcp: fix excessive TLP and RACK timeouts from HZ rounding
    - tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single
      skb
    - tcp: Fix listen() warning with v4-mapped-v6 address.
    - docs: fix info about representor identification
    - tun: prevent negative ifindex
    - gve: Do not fully free QPL pages on prefill errors
    - ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
    - net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
    - i40e: prevent crash on probe if hw registers have invalid values
    - net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register()
    - bonding: Return pointer to data after pull on skb
    - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
    - neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section
    - netfilter: nft_set_rbtree: .deactivate fails if element has expired
    - netlink: Correct offload_xstats size
    - netfilter: nf_tables: do not refresh timeout when resetting element
    - nf_tables: fix NULL pointer dereference in nft_expr_inner_parse()
    - nf_tables: fix NULL pointer dereference in nft_inner_init()
    - netfilter: nf_tables: do not remove elements if set backend implements
      .abort
    - netfilter: nf_tables: revert do not remove elements if set backend
      implements .abort
    - net: phy: bcm7xxx: Add missing 16nm EPHY statistics
    - net: pktgen: Fix interface flags printing
    - net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation
    - net: mdio-mux: fix C45 access returning -EIO after API change
    - net: avoid UAF on deleted altname
    - net: fix ifname in netlink ntf during netns move
    - net: check for altname conflicts when changing netdev's netns
    - iio: light: vcnl4000: Don't power on/off chip in config
    - fs-writeback: do not requeue a clean inode having skipped pages
    - btrfs: fix race when refilling delayed refs block reserve
    - btrfs: prevent transaction block reserve underflow when starting
      transaction
    - btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to
      1
    - btrfs: initialize start_slot in btrfs_log_prealloc_extents
    - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
    - overlayfs: set ctime when setting mtime and atime
    - gpio: timberdale: Fix potential deadlock on &tgpio->lock
    - ata: libata-core: Fix compilation warning in ata_dev_config_ncq()
    - ata: libata-eh: Fix compilation warning in ata_eh_link_report()
    - tracing: relax trace_event_eval_update() execution with cond_resched()
    - wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
    - wifi: cfg80211: validate AP phy operation before starting it
    - wifi: iwlwifi: Ensure ack flag is properly cleared.
    - rfkill: sync before userspace visibility/changes
    - HID: logitech-hidpp: Add Bluetooth ID for the Logitech M720 Triathlon
      mouse
    - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
    - Bluetooth: btusb: add shutdown function for QCA6174
    - Bluetooth: Avoid redundant authentication
    - Bluetooth: hci_core: Fix build warnings
    - wifi: cfg80211: Fix 6GHz scan configuration
    - wifi: mac80211: work around Cisco AP 9115 VHT MPDU length
    - wifi: mac80211: allow transmitting EAPOL frames with tainted key
    - wifi: cfg80211: avoid leaking stack data into trace
    - regulator/core: Revert "fix kobject release warning and memory leak in
      regulator_register()"
    - SUNRPC: Fail quickly when server does not recognize TLS
    - SUNRPC/TLS: Lock the lower_xprt during the tls handshake
    - nfs: decrement nrequests counter before releasing the req
    - sky2: Make sure there is at least one frag_addr available
    - ipv4/fib: send notify when delete source address routes
    - drm: panel-orientation-quirks: Add quirk for One Mix 2S
    - btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
    - btrfs: error out when COWing block using a stale transaction
    - btrfs: error when COWing block from a root that is being deleted
    - btrfs: error out when reallocating block for defrag using a stale
      transaction
    - [x86] platform/x86: touchscreen_dmi: Add info for the BUSH Bush Windows
      tablet
    - drm/amd/pm: add unique_id for gc 11.0.3
    - HID: multitouch: Add required quirk for Synaptics 0xcd7e device
    - HID: nintendo: reinitialize USB Pro Controller after resuming from suspend
    - HID: Add quirk to ignore the touchscreen battery on HP ENVY 15-eu0556ng
    - [x86] platform/x86: touchscreen_dmi: Add info for the Positivo C4128B
    - cpufreq: schedutil: Update next_freq when cpufreq_limits change
    - io-wq: fully initialize wqe before calling
      cpuhp_state_add_instance_nocalls()
    - Bluetooth: hci_sync: Fix not handling ISO_LINK in hci_abort_conn_sync
    - Bluetooth: hci_sync: Introduce PTR_UINT/UINT_PTR macros
    - Bluetooth: ISO: Fix invalid context error
    - Bluetooth: hci_sync: delete CIS in BT_OPEN/CONNECT/BOUND when aborting
    - Bluetooth: hci_sync: always check if connection is alive before deleting
    - net/mlx5: E-switch, register event handler before arming the event
    - net/mlx5: Handle fw tracer change ownership event based on MTRC
    - net/mlx5e: RX, Fix page_pool allocation failure recovery for striding rq
    - net/mlx5e: RX, Fix page_pool allocation failure recovery for legacy rq
    - net/mlx5e: XDP, Fix XDP_REDIRECT mpwqe page fragment leaks on shutdown
    - net/mlx5e: Take RTNL lock before triggering netdev notifiers
    - net/mlx5e: Don't offload internal port if filter device is out device
    - net/mlx5e: Fix VF representors reporting zero counters to "ip -s" command
    - net/tls: split tls_rx_reader_lock
    - tcp: allow again tcp_disconnect() when threads are waiting
    - Bluetooth: hci_event: Fix using memcmp when comparing keys
    - tcp_bpf: properly release resources on error paths
    - dt-bindings: mmc: sdhci-msm: correct minimum number of clocks
    - mmc: sdhci-pci-gli: fix LPM negotiation so x86/S0ix SoCs can suspend
    - mmc: core: Fix error propagation for some ioctl commands
    - mmc: core: sdio: hold retuning if sdio in 1-bit mode
    - mmc: core: Capture correct oemid-bits for eMMC cards
    - pinctrl: qcom: lpass-lpi: fix concurrent register updates
    - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
    - pNFS: Fix a hang in nfs4_evict_inode()
    - pNFS/flexfiles: Check the layout validity in
      ff_layout_mirror_prepare_stats
    - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server
    - ACPI: irq: Fix incorrect return value in acpi_register_gsi()
    - ACPI: bus: Move acpi_arm_init() to the place of after acpi_ghes_init()
    - perf dlfilter: Fix use of addr_location__exit() in dlfilter__object_code()
    - fanotify: limit reporting of event with non-decodeable file handles
    - NFS: Fix potential oops in nfs_inode_remove_request()
    - nfs42: client needs to strip file mode's suid/sgid bit after ALLOCATE op
    - nvme: sanitize metadata bounce buffer for reads
    - nvme-pci: add BOGUS_NID for Intel 0a54 device
    - nvme-auth: use chap->s2 to indicate bidirectional authentication
    - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
    - USB: serial: option: add entry for Sierra EM9191 with new firmware
    - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
    - [x86] thunderbolt: Call tb_switch_put() once DisplayPort bandwidth request
      is finished
    - perf: Disallow mis-matched inherited group reads (CVE-2023-5717)
    - [s390x] pci: fix iommu bitmap allocation
    - tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols
    - KEYS: asymmetric: Fix sign/verify on pkcs1pad without a hash
    - apple-gmux: Hard Code max brightness for MMIO gmux
    - [s390x] cio: fix a memleak in css_alloc_subchannel
    - [x86] platform/surface: platform_profile: Propagate error if profile
      registration fails
    - [x86] platform/x86: intel-uncore-freq: Conditionally create attribute for
      read frequency
    - [x86] platform/x86: msi-ec: Fix the 3rd config
    - [x86] platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to
      0x2e
    - [x86] platform/x86: asus-wmi: Only map brightness codes when using
      asus-wmi backlight control
    - [x86] platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events
    - gpiolib: acpi: Add missing memset(0) to acpi_get_gpiod_from_data()
    - gpio: vf610: set value before the direction to avoid a glitch
    - gpio: vf610: mask the gpio irq in system suspend and support wakeup
    - drm/bridge: ti-sn65dsi86: Associate DSI device lifetime with auxiliary
      device
    - [x86] drm/i915/cx0: Only clear/set the Pipe Reset bit of the PHY Lanes
      Owned
    - drm/amdgpu: Fix possible null pointer dereference
    - [powerpc*] mm: Allow ARCH_FORCE_MAX_ORDER up to 12
    - [powerpc*] qspinlock: Fix stale propagated yield_cpu
    - docs: Move rustdoc output, cross-reference it
    - [arm64] phy: qcom-qmp-usb: initialize PCS_USB registers
    - [arm64] phy: qcom-qmp-usb: split PCS_USB init table for sc8280xp and
      sa8775p
    - [arm64] phy: qcom-qmp-combo: Square out 8550 POWER_STATE_CONFIG1
    - [arm64] phy: qcom-qmp-combo: initialize PCS_USB registers
    - efi/unaccepted: Fix soft lockups caused by parallel memory acceptance
    - net: move altnames together with the netdevice
    - Bluetooth: hci_sock: fix slab oob read in create_monitor_event
    - net: rfkill: reduce data->mtx scope in rfkill_fop_open
    - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
    - mptcp: avoid sending RST when closing the initial subflow
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.10
    - smb3: allow controlling length of time directory entries are cached with
      dir leases
    - smb3: allow controlling maximum number of cached directories
    - smb3: do not start laundromat thread when dir leases disabled
    - smb: client: do not start laundromat thread on nohandlecache
    - smb: client: make laundromat a delayed worker
    - smb: client: prevent new fids from being removed by laundromat
    - [arm64] virtio_balloon: Fix endless deflation and inflation on arm64
    - virtio-mmio: fix memory leak of vm_dev
    - virtio-crypto: handle config changed by work queue
    - virtio_pci: fix the common cfg map size
    - vsock/virtio: initialize the_virtio_vsock before using VQs
    - vhost: Allow null msg.size on VHOST_IOTLB_INVALIDATE
    - [arm64] dts: qcom: apq8096-db820c: fix missing clock populate
    - [arm64] dts: qcom: msm8996-xiaomi: fix missing clock populate
    - [arm64] dts: rockchip: use codec as clock master on px30-ringneck-haikou
    - [arm64] dts: rockchip: set codec system-clock-fixed on
      px30-ringneck-haikou
    - [arm64] dts: qcom: sa8775p: correct PMIC GPIO label in gpio-ranges
    - [arm64] dts: rockchip: Add i2s0-2ch-bus-bclk-off pins to RK3399
    - [arm64] dts: rockchip: Fix i2s0 pin conflict on ROCK Pi 4 boards
    - i40e: sync next_to_clean and next_to_process for programming status desc
    - mm: fix vm_brk_flags() to not bail out while holding lock
    - hugetlbfs: clear resv_map pointer if mmap fails
    - mm/page_alloc: correct start page when guard page debug is enabled
    - mm/migrate: fix do_pages_move for compat pointers
    - mm/mempolicy: fix set_mempolicy_home_node() previous VMA pointer
    - hugetlbfs: extend hugetlb_vma_lock to private VMAs
    - maple_tree: add GFP_KERNEL to allocations in mas_expected_entries()
    - nfsd: lock_rename() needs both directories to live on the same fs
    - [x86] drm/i915/pmu: Check if pmu is closed before stopping event
    - drm/amd: Disable ASPM for VI w/ all Intel systems
    - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
    - btrfs: remove v0 extent handling
    - btrfs: fix unwritten extent buffer after snapshotting a new subvolume
    - [armhf] clk: ti: Fix missing omap4 mcbsp functional clock and aliases
    - [armhf] clk: ti: Fix missing omap5 mcbsp functional clock and aliases
    - r8169: fix the KCSAN reported data-race in rtl_tx() while reading
      tp->cur_tx
    - r8169: fix the KCSAN reported data-race in rtl_tx while reading
      TxDescArray[entry].opts1
    - r8169: fix the KCSAN reported data race in rtl_rx while reading
      desc->opts1
    - iavf: initialize waitqueues before starting watchdog_task
    - i40e: Fix I40E_FLAG_VF_VLAN_PRUNING value
    - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
    - net: do not leave an empty skb in write queue
    - neighbour: fix various data-races
    - igc: Fix ambiguity in the ethtool advertising
    - net: ethernet: adi: adin1110: Fix uninitialized variable
    - net: ieee802154: adf7242: Fix some potential buffer overflow in
      adf7242_stats_show()
    - net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
    - r8152: Increase USB control msg timeout to 5000ms as per spec
    - r8152: Run the unload routine if we have errors during probe
    - r8152: Cancel hw_phy_work if we have an error in probe
    - r8152: Release firmware if we have an error in probe
    - tcp: fix wrong RTO timeout when received SACK reneging
    - wifi: cfg80211: pass correct pointer to rdev_inform_bss()
    - wifi: cfg80211: fix assoc response warning on failed links
    - wifi: mac80211: don't drop all unprotected public action frames
    - net/handshake: fix file ref count in handshake_nl_accept_doit()
    - gtp: uapi: fix GTPA_MAX
    - gtp: fix fragmentation needed check with gso
    - [x86] drm/i915/perf: Determine context valid in OA reports
    - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
    - netfilter: flowtable: GC pushes back packets to classic path
    - net/sched: act_ct: additional checks for outdated flows
    - drm/i915/mcr: Hold GT forcewake during steering operations
    - iavf: in iavf_down, disable queues when removing the driver
    - scsi: sd: Introduce manage_shutdown device flag
    - blk-throttle: check for overflow in calculate_bytes_allowed
    - io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
      (CVE-2023-46862)
    - iio: afe: rescale: Accept only offset channels
    - iio: exynos-adc: request second interupt only when touchscreen mode is
      used
    - iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds
    - iio: adc: xilinx-xadc: Correct temperature offset/scale for UltraScale
    - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
    - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
    - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
    - i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
    - i2c: aspeed: Fix i2c bus hang in slave read
    - tracing/kprobes: Fix symbol counting logic by looking at modules as well
    - tracing/kprobes: Fix the description of variable length arguments
    - [arm64] misc: fastrpc: Reset metadata buffer to avoid incorrect free
    - [arm64] misc: fastrpc: Free DMA handles for RPC calls with no arguments
    - [arm64] misc: fastrpc: Clean buffers on remote invocation failures
    - [arm64] misc: fastrpc: Unmap only if buffer is unmapped from DSP
    - [arm64,armhf] nvmem: imx: correct nregs for i.MX6ULL
    - [arm64,armhf] nvmem: imx: correct nregs for i.MX6SLL
    - [arm64,armhf] nvmem: imx: correct nregs for i.MX6UL
    - [x86] tsc: Defer marking TSC unstable to a worker
    - [x86] i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
    - [x86] cpu: Add model number for Intel Arrow Lake mobile processor
    - perf/core: Fix potential NULL deref
    - clk: Sanitize possible_parent_show to Handle Return Value of
      of_clk_get_parent_name
    - [armhf] clk: socfpga: gate: Account for the divider in determine_rate
    - [armhf] clk: stm32: Fix a signedness issue in
      clk_stm32_composite_determine_rate()
    - [x86] platform/x86: Add s2idle quirk for more Lenovo laptops
    - mm/damon/sysfs: check DAMOS regions update progress from
      before_terminate()

  [ Emanuele Rocca ]
  * Disable DEBUG_PREEMPT as it introduces slowdowns up to 20% on certain
    workloads.

  [ Salvatore Bonaccorso ]
  * Bump ABI to 4
  * Do not explicitly unset DEBUG_PREEMPT (not enabled by default since 6.3-rc1)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 03 Nov 2023 05:15:32 +0100

linux (6.5.8-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.7
    - ASoC: soc-utils: Export snd_soc_dai_is_dummy() symbol
    - maple_tree: add mas_is_active() to detect in-tree walks
    - mptcp: Remove unnecessary test for __mptcp_init_sock()
    - mptcp: rename timer related helper to less confusing names
    - mptcp: fix dangling connection hang-up
    - scsi: core: Improve type safety of scsi_rescan_device()
    - scsi: Do not attempt to rescan suspended devices
    - ata: libata-scsi: Fix delayed scsi_rescan_device() execution
    - btrfs: remove btrfs_writepage_endio_finish_ordered
    - btrfs: remove end_extent_writepage
    - btrfs: don't clear uptodate on write errors
    - [arm64] add HWCAP for FEAT_HBC (hinted conditional branches)
    - [arm64] cpufeature: Fix CLRBHB and BC detection
    - net: add sysctl accept_ra_min_rtr_lft
    - net: change accept_ra_min_rtr_lft to affect all RA lifetimes
    - net: release reference to inet6_dev pointer
    - [arm64] iommu/arm-smmu-v3: Avoid constructing invalid range commands
    - maple_tree: reduce resets during store setup
    - maple_tree: add MAS_UNDERFLOW and MAS_OVERFLOW states
    - scsi: zfcp: Fix a double put in zfcp_port_enqueue()
    - [amd64] iommu/vt-d: Avoid memory allocation in iommu_suspend()
    - net: mana: Fix TX CQE error handling
    - mptcp: fix delegated action races
    - mptcp: userspace pm allow creating id 0 subflow
    - Bluetooth: hci_codec: Fix leaking content of local_codecs
    - wifi: brcmfmac: Replace 1-element arrays with flexible arrays
    - Bluetooth: hci_sync: Fix handling of HCI_QUIRK_STRICT_DUPLICATE_FILTER
    - wifi: rtw88: rtw8723d: Fix MAC address offset in EEPROM
    - wifi: mwifiex: Fix tlv_buf_left calculation
    - io_uring: don't allow IORING_SETUP_NO_MMAP rings on highmem pages
    - md/raid5: release batch_last before waiting for another stripe_head
    - PCI/PM: Mark devices disconnected if upstream PCIe link is down on resume
    - PCI: qcom: Fix IPQ8074 enumeration
    - [x86] platform/x86/intel/ifs: release cpus_read_lock()
    - net: replace calls to sock->ops->connect() with kernel_connect()
    - io_uring/kbuf: don't allow registered buffer rings on highmem pages
    - io_uring: ensure io_lockdep_assert_cq_locked() handles disabled rings
    - btrfs: always print transaction aborted messages with an error level
    - net: prevent rewrite of msg_name in sock_sendmsg()
    - [x86] drm/i915: Don't set PIPE_CONTROL_FLUSH_L3 for aux inval
    - drm/amd: Fix detection of _PR3 on the PCIe root port
    - drm/amd: Fix logic error in sienna_cichlid_update_pcie_parameters()
    - [arm64] Add Cortex-A520 CPU part definition
    - [arm64] errata: Add Cortex-A520 speculative unprivileged load workaround
    - HID: sony: Fix a potential memory leak in sony_probe()
    - wifi: mt76: fix lock dependency problem for wed_lock
    - ubi: Refuse attaching if mtd's erasesize is 0
    - erofs: fix memory leak of LZMA global compressed deduplication
    - wifi: cfg80211/mac80211: hold link BSSes when assoc fails for MLO
      connection
    - iwlwifi: mvm: handle PS changes in vif_cfg_changed
    - wifi: iwlwifi: dbg_ini: fix structure packing
    - wifi: iwlwifi: mvm: Fix a memory corruption issue
    - wifi: cfg80211: fix cqm_config access race
    - wifi: cfg80211: add missing kernel-doc for cqm_rssi_work
    - wifi: mac80211: fix mesh id corruption on 32 bit systems
    - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
    - HID: nvidia-shield: add LEDS_CLASS dependency
    - erofs: allow empty device tags in flatdev mode
    - [s390x] bpf: Let arch_prepare_bpf_trampoline return program size
    - leds: Drop BUG_ON check for LED_COLOR_ID_MULTI
    - bpf: Fix tr dereferencing
    - bpf: unconditionally reset backtrack_state masks on global func exit
    - regulator: mt6358: split ops for buck and linear range LDO regulators
    - Bluetooth: Delete unused hci_req_prepare_suspend() declaration
    - Bluetooth: Fix hci_link_tx_to RCU lock usage
    - Bluetooth: ISO: Fix handling of listen for unicast
    - drivers/net: process the result of hdlc_open() and add call of
      hdlc_close() in uhdlc_close()
    - wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling
    - [x86] perf/x86/amd/core: Fix overflow reset on hotplug
    - regmap: rbtree: Fix wrong register marked as in-cache when creating new
      node
    - wifi: mac80211: fix potential key use-after-free
    - [x86] perf/x86/amd: Do not WARN() on every IRQ
    - wifi: mac80211: Create resources for disabled links
    - regulator/core: regulator_register: set device->class earlier
    - wifi: iwlwifi: mvm: Fix incorrect usage of scan API
    - scsi: target: core: Fix deadlock due to recursive locking
    - NFSv4: Fix a nfs4_state_manager() race
    - ice: always add legacy 32byte RXDID in supported_rxdids
    - bpf: tcp_read_skb needs to pop skb regardless of seq
    - bpf, sockmap: Do not inc copied_seq when PEEK flag set
    - bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets
    - modpost: add missing else to the "of" check
    - net: stmmac: platform: fix the incorrect parameter
    - net: fix possible store tearing in neigh_periodic_work()
    - neighbour: fix data-races around n->output
    - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
    - ptp: ocp: Fix error handling in ptp_ocp_device_init
    - net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent
    - ovl: move freeing ovl_entry past rcu delay
    - ovl: fetch inode once in ovl_dentry_revalidate_common()
    - ipv6: tcp: add a missing nf_reset_ct() in 3WHS handling
    - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
    - ethtool: plca: fix plca enable data type while parsing the value
    - net: nfc: llcp: Add lock when modifying device list
    - [arm64] net: ethernet: ti: am65-cpsw: Fix error code in
      am65_cpsw_nuss_init_tx_chns()
    - ibmveth: Remove condition to recompute TCP header checksum.
    - netfilter: nft_payload: rebuild vlan header on h_proto access
    - netfilter: handle the connecting collision properly in
      nf_conntrack_proto_sctp
    - selftests: netfilter: Test nf_tables audit logging
    - selftests: netfilter: Extend nft_audit.sh
    - netfilter: nf_tables: Deduplicate nft_register_obj audit logs
    - netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure
    - ipv4: Set offload_failed flag in fibmatch results
    - net: stmmac: dwmac-stm32: fix resume on STM32 MCU
    - tipc: fix a potential deadlock on &tx->lock
    - tcp: fix quick-ack counting to count actual ACKs of new data
    - tcp: fix delayed ACKs for MSS boundary condition
    - sctp: update transport state when processing a dupcook packet
    - sctp: update hb timer immediately after users change hb_interval
    - netlink: annotate data-races around sk->sk_err
    - net: mana: Fix the tso_bytes calculation
    - net: mana: Fix oversized sge0 for GSO packets
    - HID: nvidia-shield: Fix a missing led_classdev_unregister() in the probe
      error handling path
    - HID: sony: remove duplicate NULL check before calling usb_free_urb()
    - HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit
    - net: lan743x: also select PHYLIB
    - smb: use kernel_connect() and kernel_bind()
    - dm zoned: free dmz->ddev array in dmz_put_zoned_devices
    - RDMA/core: Require admin capabilities to set system parameters
    - of: dynamic: Fix potential memory leak in of_changeset_action()
    - IB/mlx4: Fix the size of a buffer in add_port_entries()
    - gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config()
    - gpio: pxa: disable pinctrl calls for MMP_GPIO
    - RDMA/cma: Initialize ib_sa_multicast structure to 0 when join
    - RDMA/cma: Fix truncation compilation warning in make_cma_ports
    - RDMA/bnxt_re: Fix the handling of control path response data
    - RDMA/uverbs: Fix typo of sizeof argument
    - RDMA/srp: Do not call scsi_done() from srp_abort()
    - RDMA/siw: Fix connection failure handling
    - RDMA/mlx5: Fix mkey cache possible deadlock on cleanup
    - RDMA/mlx5: Fix assigning access flags to cache mkeys
    - RDMA/mlx5: Fix mutex unlocking on error flow for steering anchor creation
    - RDMA/mlx5: Fix NULL string error
    - [x86] sev: Change npages to unsigned long in snp_accept_memory()
    - [x86] sev: Use the GHCB protocol when available for SNP CPUID requests
    - ksmbd: fix race condition between session lookup and expire
    - ksmbd: fix uaf in smb20_oplock_break_ack
    - ksmbd: fix race condition from parallel smb2 lock requests
    - RDMA/mlx5: Remove not-used cache disable flag
    - xen/events: replace evtchn_rwlock with RCU (CVE-2023-34324)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.8
    - net: stmmac: remove unneeded stmmac_poll_controller
    - RDMA/cxgb4: Check skb value for failure to allocate
    - [arm64] perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7
    - [x86] platform/x86: think-lmi: Fix reference leak
    - [x86] drm/i915: Register engines early to avoid type confusion
    - cpuidle, ACPI: Evaluate LPI arch_flags for broadcast timer
    - drm/amdgpu: Fix a memory leak
    - [x86] platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent
      section mismatch warning
    - media: dt-bindings: imx7-csi: Make power-domains not required for imx8mq
    - drm/amd/display: implement pipe type definition and adding accessors
    - drm/amd/display: apply edge-case DISPCLK WDIVIDER changes to master OTG
      pipes only
    - scsi: Do not rescan devices with a suspended queue
    - ata: pata_parport: fix pata_parport_devchk
    - ata: pata_parport: implement set_devctl
    - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
    - quota: Fix slow quotaoff
    - dm crypt: Fix reqsize in crypt_iv_eboiv_gen
    - [x86] ASoC: amd: yc: Fix non-functional mic on Lenovo 82YM
    - [arm64,armhf] ASoC: hdmi-codec: Fix broken channel map reporting
    - ata: libata-scsi: Disable scsi device manage_system_start_stop
    - net: prevent address rewrite in kernel_bind()
    - [arm64] dts: qcom: sm8150: extend the size of the PDC resource
    - dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Update description
      for '#interrupt-cells' property
    - irqchip: renesas-rzg2l: Fix logic to clear TINT interrupt source
    - KEYS: trusted: Remove redundant static calls usage
    - ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset
    - ALSA: usb-audio: Fix microphone sound on Nexigo webcam.
    - ALSA: hda: cs35l41: Cleanup and fix double free in firmware request
    - ALSA: hda/realtek: Change model for Intel RVP board
    - ASoC: SOF: amd: fix for firmware reload failure after playback
    - [arm*] ASoC: simple-card-utils: fixup simple_util_startup() error handling
    - [x86] ASoC: Intel: soc-acpi: fix Dell SKU 0B34
    - [x86] ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support in MTL
      match table
    - [arm64] ASoC: fsl_sai: Don't disable bitclock for i.MX8MP
    - [x86] ASoC: Intel: sof_sdw: add support for SKU 0B14
    - [x86] ASoC: Intel: soc-acpi: Add entry for sof_es8336 in MTL match table.
    - ALSA: hda/realtek: Add quirk for HP Victus 16-d1xxx to enable mute LED
    - ALSA: hda/realtek: Add quirk for mute LEDs on HP ENVY x360 15-eu0xxx
    - ALSA: hda/realtek - ALC287 I2S speaker platform support
    - ALSA: hda/realtek - ALC287 merge RTK codec with CS CS35L41 AMP
    - [riscv64] pinctrl: starfive: jh7110: Fix failure to set irq after
      CONFIG_PM is enabled
    - [arm64] drm/msm/dp: do not reinitialize phy unless retry during link
      training
    - [arm64] drm/msm/dsi: skip the wait for video mode done if not applicable
    - [arm64] drm/msm/dsi: fix irq_of_parse_and_map() error checking
    - [arm64] drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid
      overflow
    - [arm64] drm/msm/dp: Add newlines to debug printks
    - [arm64] drm/msm/dpu: fail dpu_plane_atomic_check() based on mdp clk limits
    - can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior
    - [arm64] dts: mediatek: fix t-phy unit name
    - [arm64] dts: mediatek: mt8195: Set DSU PMU status to fail
    - devlink: Hold devlink lock on health reporter dump get
    - ieee802154: ca8210: Fix a potential UAF in ca8210_probe
    - xen-netback: use default TX queue size for vifs
    - [riscv64] bpf: Sign-extend return values
    - [riscv64] bpf: Track both a0 (RISC-V ABI) and a5 (BPF) return values
    - xdp: Fix zero-size allocation warning in xskq_create()
    - drm/vmwgfx: fix typo of sizeof argument
    - bpf: Fix verifier log for async callback return values
    - net: refine debug info in skb_checksum_help()
    - net: macsec: indicate next pn update when offloading
    - net: phy: mscc: macsec: reject PN update requests
    - net/mlx5e: macsec: use update_pn flag instead of PN comparation
    - ixgbe: fix crash with empty VF macvlan list
    - net/smc: Fix dependency of SMC on ISM
    - net/mlx5e: Again mutually exclude RX-FCS and RX-port-timestamp
    - [s390x] bpf: Fix clobbering the caller's backchain in the trampoline
    - [s390x] bpf: Fix unwinding past the trampoline
    - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
    - net/smc: Fix pos miscalculation in statistics
    - net: tcp: fix crashes trying to free half-baked MTU probes
    - pinctrl: renesas: rzn1: Enable missing PINMUX
    - af_packet: Fix fortified memcpy() without flex array.
    - nfc: nci: assert requested protocol is valid
    - octeontx2-pf: Fix page pool frag allocation warning
    - workqueue: Override implicit ordered attribute in
      workqueue_apply_unbound_cpumask()
    - [riscv64] signal: fix sigaltstack frame size checking
    - ovl: temporarily disable appending lowedirs
    - [armhf] dmaengine: stm32-mdma: abort resume if no ongoing transfer
    - [armhf] dmaengine: stm32-dma: fix stm32_dma_prep_slave_sg in case of MDMA
      chaining
    - [armhf] dmaengine: stm32-dma: fix residue in case of MDMA chaining
    - [armhf] dmaengine: stm32-mdma: use Link Address Register to compute
      residue
    - [armhf] dmaengine: stm32-mdma: set in_flight_bytes in case CRQA flag is
      set
    - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
    - xhci: track port suspend state correctly in unsuccessful resume cases
    - xhci: Clear EHB bit only at end of interrupt handler
    - xhci: Preserve RsvdP bits in ERSTBA register correctly
    - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
    - usb: dwc3: Soft reset phy on probe for host
    - usb: cdns3: Modify the return value of cdns_set_active () to void when
      CONFIG_PM_SLEEP is disabled
    - usb: hub: Guard against accesses to uninitialized BOS descriptors
    - usb: musb: Get the musb_qh poniter after musb_giveback
    - usb: musb: Modify the "HWVers" register address
    - iio: pressure: bmp280: Fix NULL pointer exception
    - iio: imu: bno055: Fix missing Kconfig dependencies
    - iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()
    - iio: adc: imx8qxp: Fix address for command buffer registers
    - iio: dac: ad3552r: Correct device IDs
    - iio: admv1013: add mixer_vgate corner cases
    - iio: pressure: dps310: Adjust Timeout Settings
    - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
    - iio: adc: ad7192: Correct reference voltage
    - iio: addac: Kconfig: update ad74413r selections
    - media: subdev: Don't report V4L2_SUBDEV_CAP_STREAMS when the streams API
      is disabled
    - [arm64] dts: mediatek: mt8195-demo: fix the memory size to 8GB
    - [arm64] dts: mediatek: mt8195-demo: update and reorder reserved memory
      regions
    - drm: Do not overrun array in drm_gem_get_pages()
    - drm/atomic-helper: relax unregistered connector check
    - drm/amdgpu: add missing NULL check
    - drm/amd/display: Don't set dpms_off for seamless boot
    - drm/vmwgfx: Keep a gem reference to user bos in surfaces
    - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
    - ACPI: resource: Add TongFang GM6BGEQ, GM6BG5Q and GM6BG0Q to
      irq1_edge_low_force_override[]
    - ACPI: EC: Add quirk for the HP Pavilion Gaming 15-dk1xxx
    - serial: Reduce spinlocked portion of uart_rs485_config()
    - serial: 8250_omap: Fix errors with no_console_suspend
    - serial: core: Fix checks for tx runtime PM state
    - [arm*] binder: fix memory leaks of spam and pending work
    - ksmbd: not allow to open file if delelete on close bit is set
    - [x86] perf/x86/lbr: Filter vsyscall addresses
    - [x86] cpu: Fix AMD erratum #1485 on Zen4-based CPUs
    - [x86] alternatives: Disable KASAN in apply_alternatives()
    - mcb: remove is_added flag from mcb_device struct
    - [x86] thunderbolt: Workaround an IOMMU fault on certain systems with Intel
      Maple Ridge
    - [x86] thunderbolt: Check that lane 1 is in CL0 before enabling lane
      bonding
    - [x86] thunderbolt: Correct TMU mode initialization from hardware
    - [x86] thunderbolt: Restart XDomain discovery handshake after failure
    - [powerpc*] pseries: Fix STK_PARAM access in the hcall tracing code
    - [powerpc*] 47x: Fix 47x syscall return crash
    - libceph: use kernel_connect()
    - ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
    - ceph: fix type promotion bug on 32bit systems
    - Input: powermate - fix use-after-free in powermate_config_complete
    - Input: psmouse - fix fast_reconnect function for PS/2 mode
    - Input: xpad - add PXN V900 support
    - Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
    - Input: xpad - add HyperX Clutch Gladiate Support
    - Input: goodix - ensure int GPIO is in input for gpio_count == 1 &&
      gpio_int_idx == 0 case
    - mctp: perform route lookups under a RCU read-side lock
    - block: Don't invalidate pagecache for invalid falloc modes
    - nfp: flower: avoid rmmod nfp crash issues
    - can: sja1000: Always restart the Tx queue after an overrun
    - power: supply: qcom_battmgr: fix battery_id type
    - power: supply: qcom_battmgr: fix enable request endianness
    - usb: typec: ucsi: Use GET_CAPABILITY attributes data to set power supply
      scope
    - cgroup: Remove duplicates in cgroup v1 tasks file
    - dma-buf: add dma_fence_timestamp helper
    - pinctrl: avoid unsafe code pattern in find_pinctrl()
    - scsi: ufs: core: Correct clear TM error log
    - [riscv64] Only consider swbp/ss handlers for correct privileged mode
    - counter: chrdev: fix getting array extensions
    - counter: microchip-tcb-capture: Fix the use of internal GCLK logic
    - coresight: Fix run time warnings while reusing ETR buffer
    - [riscv64] Remove duplicate objcopy flag
    - [riscv64]  Fix wrong use of CONFIG_HAVE_SOFTIRQ_ON_OWN_STACK
    - usb: typec: ucsi: Fix missing link removal
    - usb: typec: altmodes/displayport: Signal hpd low when exiting mode
    - usb: typec: ucsi: Clear EVENT_PENDING bit if ucsi_send_command fails
    - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
    - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
    - usb: cdnsp: Fixes issue with dequeuing not queued requests
    - usb: typec: qcom: Update the logic of regulator enable and disable
    - usb: misc: onboard_hub: add support for Microchip USB2412 USB 2.0 hub
    - [x86] Revert "x86/smp: Put CPUs into INIT on shutdown if possible"
    - [amd64] dmaengine: idxd: use spin_lock_irqsave before wait_event_lock_irq
    - [powerpc*] 8xx: Fix pte_access_permitted() for PAGE_NONE
    - [powerpc*] 64e: Fix wrong test in __ptep_test_and_clear_young()
    - fs: Fix kernel-doc warnings
    - fs: factor out vfs_parse_monolithic_sep() helper
    - ovl: fix regression in parsing of mount options with escaped comma
    - ovl: make use of ->layers safe in rcu pathwalk
    - ovl: fix regression in showing lowerdir mount option
    - ALSA: hda/realtek - Fixed two speaker platform

  [ Salvatore Bonaccorso ]
  * Bump ABI to 3
  * [x86] KVM: SVM: always update the x2avic msr interception (CVE-2023-5090)
  * nvmet-tcp: Fix a possible UAF in queue intialization setup (CVE-2023-5178)
  * Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
    (CVE-2023-31083)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 22 Oct 2023 21:28:21 +0200

linux (6.5.6-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.4
    - net/ipv6: SKB symmetric hash should incorporate transport ports
    - drm/virtio: Conditionally allocate virtio_gpu_fence
    - scsi: ufs: core: Add advanced RPMB support where UFSHCI 4.0 does not
      support EHS length in UTRD
    - scsi: qla2xxx: Adjust IOCB resource on qpair create
    - scsi: qla2xxx: Limit TMF to 8 per function
    - scsi: qla2xxx: Fix deletion race condition
    - scsi: qla2xxx: fix inconsistent TMF timeout
    - scsi: qla2xxx: Fix command flush during TMF
    - scsi: qla2xxx: Fix erroneous link up failure
    - scsi: qla2xxx: Turn off noisy message log
    - scsi: qla2xxx: Fix session hang in gnl
    - scsi: qla2xxx: Fix TMF leak through
    - scsi: qla2xxx: Remove unsupported ql2xenabledif option
    - scsi: qla2xxx: Flush mailbox commands on chip reset
    - scsi: qla2xxx: Fix smatch warn for qla_init_iocb_limit()
    - scsi: qla2xxx: Error code did not return to upper layer
    - scsi: qla2xxx: Fix firmware resource tracking
    - null_blk: fix poll request timeout handling
    - kernfs: fix missing kernfs_iattr_rwsem locking
    - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
    - clk: qcom: camcc-sc7180: fix async resume during probe
    - drm/ast: Fix DRAM init on AST2200
    - ASoC: tegra: Fix SFC conversion for few rates
    - [arm64] tegra: Update AHUB clock parent and rate on Tegra234
    - [arm64] tegra: Update AHUB clock parent and rate
    - clk: qcom: turingcc-qcs404: fix missing resume during probe
    - [arm64] dts: qcom: msm8953-vince: drop duplicated touschreen parent
      interrupt
    - [arm64] dts: renesas: rzg2l: Fix txdv-skew-psec typos
    - send channel sequence number in SMB3 requests after reconnects
    - memcg: drop kmem.limit_in_bytes
    - mm: hugetlb_vmemmap: fix a race between vmemmap pmd split
    - Multi-gen LRU: avoid race in inc_min_seq()
    - cifs: update desired access while requesting for directory lease
    - pinctrl: cherryview: fix address_space_handler() argument
    - dt-bindings: clock: xlnx,versal-clk: drop select:false
    - clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz
    - clk: imx: pll14xx: align pdiv with reference manual
    - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
    - soc: qcom: qmi_encdec: Restrict string length in decode
    - clk: qcom: dispcc-sm8450: fix runtime PM imbalance on probe errors
    - clk: qcom: dispcc-sm8550: fix runtime PM imbalance on probe errors
    - clk: qcom: lpasscc-sc7280: fix missing resume during probe
    - clk: qcom: q6sstop-qcs404: fix missing resume during probe
    - clk: qcom: mss-sc7180: fix missing resume during probe
    - NFS: Fix a potential data corruption
    - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
    - bus: mhi: host: Skip MHI reset if device is in RDDM
    - kbuild: rpm-pkg: define _arch conditionally
    - kbuild: do not run depmod for 'make modules_sign'
    - kbuild: dummy-tools: make MPROFILE_KERNEL checks work on BE
    - tpm_crb: Fix an error handling path in crb_acpi_add()
    - gfs2: Switch to wait_event in gfs2_logd
    - gfs2: low-memory forced flush fixes
    - tools/mm: fix undefined reference to pthread_once
    - perf trace: Really free the evsel->priv area
    - backlight: lp855x: Initialize PWM state on first brightness change
    - backlight: gpio_backlight: Drop output GPIO direction check for initial
      power state
    - perf parse-events: Separate YYABORT and YYNOMEM cases
    - perf parse-events: Move instances of YYABORT to YYNOMEM
    - perf parse-events: Separate ENOMEM memory handling
    - perf parse-events: Additional error reporting
    - [x86] KVM: SVM: Don't defer NMI unblocking until next exit for SEV-ES
      guests
    - Input: tca6416-keypad - always expect proper IRQ number in i2c client
    - Input: tca6416-keypad - fix interrupt enable disbalance
    - perf annotate bpf: Don't enclose non-debug code with an assert()
    - [x86] virt: Drop unnecessary check on extended CPUID level in
      cpu_has_svm()
    - perf script: Print "cgroup" field on the same line as "comm"
    - perf bpf-filter: Fix sample flag check with ||
    - perf dlfilter: Initialize addr_location before passing it to
      thread__find_symbol_fb()
    - perf dlfilter: Add al_cleanup()
    - perf vendor events: Update the JSON/events descriptions for power10
      platform
    - perf vendor events: Drop some of the JSON/events for power10 platform
    - perf vendor events: Drop STORES_PER_INST metric event for power10 platform
    - perf vendor events: Move JSON/events to appropriate files for power10
      platform
    - perf vendor events: Update metric event names for power10 platform
    - perf top: Don't pass an ERR_PTR() directly to perf_session__delete()
    - perf lock: Don't pass an ERR_PTR() directly to perf_session__delete()
    - [x86] watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
    - perf vendor events arm64: Remove L1D_CACHE_LMISS from AmpereOne list
    - pwm: lpc32xx: Remove handling of PWM channels
    - accel/ivpu: refactor deprecated strncpy
    - perf header: Fix missing PMU caps
    - i3c: master: svc: Describe member 'saved_regs'
    - regulator: tps6287x: Fix n_voltages
    - [x86] drm/i915: mark requests for GuC virtual engines to avoid
      use-after-free
    - blk-throttle: use calculate_io/bytes_allowed() for throtl_trim_slice()
    - blk-throttle: consider 'carryover_ios/bytes' in throtl_trim_slice()
    - netfilter: nf_tables: Audit log setelem reset
    - netfilter: nf_tables: Audit log rule reset
    - smb: propagate error code of extract_sharename()
    - net/sched: fq_pie: avoid stalls in fq_pie_timer()
    - sctp: annotate data-races around sk->sk_wmem_queued
    - ipv4: annotate data-races around fi->fib_dead
    - net: read sk->sk_family once in sk_mc_loop()
    - net: fib: avoid warn splat in flow dissector
    - xsk: Fix xsk_diag use-after-free error during socket cleanup
    - [x86] drm/i915/gvt: Verify pfn is "valid" before dereferencing "struct
      page"
    - [x86] drm/i915/gvt: Put the page reference obtained by KVM's gfn_to_pfn()
    - [x86] drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt()
    - drm/amd/display: fix mode scaling (RMX_.*)
    - net/handshake: fix null-ptr-deref in handshake_nl_done_doit()
    - net: use sk_forward_alloc_get() in sk_get_meminfo()
    - net: annotate data-races around sk->sk_forward_alloc
    - mptcp: annotate data-races around msk->rmem_fwd_alloc
    - net: annotate data-races around sk->sk_tsflags
    - net: annotate data-races around sk->sk_bind_phc
    - ipv4: ignore dst hint for multipath routes
    - ipv6: ignore dst hint for multipath routes
    - igb: disable virtualization features on 82580
    - gve: fix frag_list chaining
    - veth: Fixing transmit return status for dropped packets
    - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
    - net: phy: micrel: Correct bit assignments for phy_device flags
    - bpf, sockmap: Fix skb refcnt race after locking changes
    - af_unix: Fix msg_controllen test in scm_pidfd_recv() for MSG_CMSG_COMPAT.
    - af_unix: Fix data-races around user->unix_inflight.
    - af_unix: Fix data-race around unix_tot_inflight.
    - af_unix: Fix data-races around sk->sk_shutdown.
    - af_unix: Fix data race around sk->sk_err.
    - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (CVE-2023-4921)
    - kcm: Destroy mutex in kcm_exit_net()
    - igc: Change IGC_MIN to allow set rx/tx value between 64 and 80
    - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
    - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
    - [s390x] zcrypt: don't leak memory if dev_set_name() fails
    - regulator: tps6594-regulator: Fix random kernel crash
    - idr: fix param name in idr_alloc_cyclic() doc
    - ip_tunnels: use DEV_STATS_INC()
    - net/mlx5e: Clear mirred devices array if the rule is split
    - net/mlx5: Give esw_offloads_load/unload_rep() "mlx5_" prefix
    - net/mlx5: Rework devlink port alloc/free into init/cleanup
    - net/mlx5: Push devlink port PF/VF init/cleanup calls out of
      devlink_port_register/unregister()
    - mlx5/core: E-Switch, Create ACL FT for eswitch manager in switchdev mode
    - net: phylink: fix sphinx complaint about invalid literal
    - bpf: Invoke __bpf_prog_exit_sleepable_recur() on recursion in
      kern_sys_bpf().
    - bpf: Assign bpf_tramp_run_ctx::saved_run_ctx before recursion check.
    - [s390x] bpf: Pass through tail call counter in trampolines
    - bpf: bpf_sk_storage: Fix invalid wait context lockdep report
    - bpf: bpf_sk_storage: Fix the missing uncharge in sk_omem_alloc
    - netfilter: nftables: exthdr: fix 4-byte stack OOB write
    - netfilter: nfnetlink_osf: avoid OOB read
    - netfilter: nft_set_rbtree: skip sync GC for new elements in this
      transaction
    - netfilter: nf_tables: Unbreak audit log reset
    - net: phy: Provide Module 4 KSZ9477 errata (DS80000754C)
    - [arm64] net: hns3: fix tx timeout issue
    - [arm64] net: hns3: fix byte order conversion issue in
      hclge_dbg_fd_tcam_read()
    - [arm64] net: hns3: fix debugfs concurrency issue between kfree buffer and
      read
    - [arm64] net: hns3: fix invalid mutex between tc qdisc and dcb ets command
      issue
    - [arm64] net: hns3: fix the port information display when sfp is absent
    - [arm64] net: hns3: remove GSO partial feature bit
    - [arm64] net: enetc: distinguish error from valid pointers in
      enetc_fixup_clear_rss_rfs()
    - watchdog: advantech_ec_wdt: fix Kconfig dependencies
    - drm/amd/display: Temporary Disable MST DP Colorspace Property
    - clocksource/drivers/arm_arch_timer: Disable timer before programming CVAL
    - dmaengine: sh: rz-dmac: Fix destination and source data size setting
    - misc: fastrpc: Fix remote heap allocation request
    - misc: fastrpc: Fix incorrect DMA mapping unmap request
    - jbd2: fix checkpoint cleanup performance regression
    - jbd2: check 'jh->b_transaction' before removing it from checkpoint
    - jbd2: correct the end of the journal recovery scan range
    - ext4: fix slab-use-after-free in ext4_es_insert_extent()
    - ext4: add correct group descriptors and reserved GDT blocks to system zone
    - ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup}
    - ext4: drop dio overwrite only flag and associated warning
    - f2fs: get out of a repeat loop when getting a locked data page
    - f2fs: flush inode if atomic file is aborted
    - f2fs: avoid false alarm of circular locking
    - lib: test_scanf: Add explicit type cast to result initialization in
      test_number_prefix()
    - [arm64,armhf] hwspinlock: qcom: add missing regmap config for SFPB MMIO
      implementation
    - memcontrol: ensure memcg acquired by id is properly set up
    - ata: ahci: Add Elkhart Lake AHCI controller
    - ata: pata_falcon: fix IO base selection for Q40
    - ata: sata_gemini: Add missing MODULE_DESCRIPTION
    - ata: pata_ftide010: Add missing MODULE_DESCRIPTION
    - fuse: nlookup missing decrement in fuse_direntplus_link
    - btrfs: zoned: do not zone finish data relocation block group
    - btrfs: fix start transaction qgroup rsv double free
    - btrfs: free qgroup rsv on io failure
    - btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART
    - btrfs: set page extent mapped after read_folio in relocate_one_page
    - btrfs: zoned: re-enable metadata over-commit for zoned mode
    - btrfs: use the correct superblock to compare fsid in btrfs_validate_super
    - btrfs: scrub: avoid unnecessary extent tree search preparing stripes
    - btrfs: scrub: avoid unnecessary csum tree search preparing stripes
    - btrfs: scrub: fix grouping of read IO
    - drm/mxsfb: Disable overlay plane in mxsfb_plane_overlay_atomic_disable()
    - mtd: rawnand: brcmnand: Fix crash during the panic_write
    - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
    - mtd: spi-nor: Correct flags for Winbond w25q128
    - mtd: rawnand: brcmnand: Fix potential false time out warning
    - mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller
    - Revert "drm/amd/display: Remove v_startup workaround for dcn3+"
    - drm/amd/display: enable cursor degamma for DCN3+ DRM legacy gamma
    - drm/amd/display: limit the v_startup workaround to ASICs older than DCN3.1
    - drm/amd/display: prevent potential division by zero errors
    - [x86] KVM: VMX: Refresh available regs and IDT vectoring info before NMI
      handling
    - [x86] KVM: SVM: Take and hold ir_list_lock when updating vCPU's Physical
      ID entry
    - [x86] KVM: SVM: Don't inject #UD if KVM attempts to skip SEV guest insn
    - [x86] KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost
      migration
    - [x86] KVM: nSVM: Check instead of asserting on nested TSC scaling support
    - [x86] KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state
    - [x86] KVM: SVM: Set target pCPU during IRTE update if target vCPU is
      running
    - [x86] KVM: SVM: Skip VMSA init in sev_es_init_vmcb() if pointer is NULL
    - perf hists browser: Fix hierarchy mode header
    - perf build: Update build rule for generated files
    - perf test shell stat_bpf_counters: Fix test on Intel
    - perf tools: Handle old data in PERF_RECORD_ATTR
    - perf build: Include generated header files properly
    - perf hists browser: Fix the number of entries for 'e' key
    - drm/amd/display: always switch off ODM before committing more streams
    - drm/amd/display: Remove wait while locked
    - drm/amdgpu: register a dirty framebuffer callback for fbcon
      (Closes: #1037142)
    - bpf: fix bpf_probe_read_kernel prototype mismatch
    - net: ipv4: fix one memleak in __inet_del_ifa()
    - net: microchip: vcap api: Fix possible memory leak for vcap_dup_rule()
    - net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in
      smcr_port_add
    - net: stmmac: fix handling of zero coalescing tx-usecs
    - net: ethernet: mvpp2_main: fix possible OOB write in
      mvpp2_ethtool_get_rxnfc()
    - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in
      mtk_hwlro_get_fdir_all()
    - hsr: Fix uninit-value access in fill_frame_info()
    - net: ethernet: adi: adin1110: use eth_broadcast_addr() to assign broadcast
      address
    - net:ethernet:adi:adin1110: Fix forwarding offload
    - r8152: check budget for r8152_poll()
    - kcm: Fix memory leak in error path of kcm_sendmsg()
    - net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
    - net: macb: fix sleep inside spinlock
    - veth: Update XDP feature set when bringing up device
    - ipv6: fix ip6_sock_set_addr_preferences() typo
    - tcp: Factorise sk_family-independent comparison in
      inet_bind2_bucket_match(_addr_any).
    - tcp: Fix bind() regression for v4-mapped-v6 wildcard address.
    - tcp: Fix bind() regression for v4-mapped-v6 non-wildcard address.
    - ixgbe: fix timestamp configuration code
    - igb: clean up in all error paths when enabling SR-IOV
    - net: renesas: rswitch: Fix unmasking irq condition
    - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
    - vm: fix move_vma() memory accounting being off
    - drm/amd/display: Fix a bug when searching for insert_above_mpcc
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.5
    - iomap: Fix possible overflow condition in iomap_write_delalloc_scan
    - autofs: fix memory leak of waitqueues in autofs_catatonic_mode
    - btrfs: handle errors properly in update_inline_extent_backref()
    - btrfs: output extra debug info if we failed to find an inline backref
    - locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock
    - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
    - kernel/fork: beware of __put_task_struct() calling context
    - rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to
      _idle()
    - ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470
    - [x86] amd_nb: Add PCI IDs for AMD Family 1Ah-based models
    - [arm64] perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09
    - [s390x] boot: cleanup number of page table levels setup
    - [arm64] perf/imx_ddr: speed up overflow frequency of cycle
    - ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and
      iMac12,2
    - hw_breakpoint: fix single-stepping when using bpf_overflow_handler
    - [x86] ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects
    - [arm64] spi: sun6i: add quirk for dual and quad SPI modes support
    - devlink: remove reload failed checks in params get/set callbacks
    - crypto: lrw,xts - Replace strlcpy with strscpy
    - ice: Don't tx before switchdev is fully configured
    - wifi: ath9k: fix fortify warnings
    - wifi: ath9k: fix printk specifier
    - wifi: rtw88: delete timer and free skb queue when unloading
    - wifi: mwifiex: fix fortify warning
    - mt76: mt7921: don't assume adequate headroom for SDIO headers
    - wifi: wil6210: fix fortify warnings
    - net: Use sockaddr_storage for getsockopt(SO_PEERNAME).
    - wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan()
    - wifi: ath12k: avoid array overflow of hw mode for preferred_hw_mode
    - net/ipv4: return the real errno instead of -EINVAL
    - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
    - Bluetooth: btusb: Add device 0489:e0f5 as MT7922 device
    - Bluetooth: btusb: Add a new VID/PID 0489/e0f6 for MT7922
    - Bluetooth: btusb: Add new VID/PID 0489/e102 for MT7922
    - Bluetooth: btusb: Add new VID/PID 04ca/3804 for MT7922
    - Bluetooth: Fix hci_suspend_sync crash
    - Bluetooth: btusb: Add support for another MediaTek 7922 VID/PID
    - netlink: convert nlk->flags to atomic flags
    - tpm_tis: Resend command to recover from data transfer errors
    - [arm64] mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450
    - alx: fix OOB-read compiler warning
    - wifi: iwlwifi: pcie: avoid a warning in case prepare card failed
    - wifi: mac80211: check S1G action frame size
    - netfilter: ebtables: fix fortify warnings in size_entry_mwt()
    - wifi: cfg80211: reject auth/assoc to AP with our address
    - wifi: cfg80211: ocb: don't leave if not joined
    - wifi: mac80211: check for station first in client probe
    - wifi: mac80211_hwsim: drop short frames
    - Revert "wifi: mac80211_hwsim: check the return value of nla_put_u32"
    - wifi: ath12k: Fix memory leak in rx_desc and tx_desc
    - wifi: ath12k: add check max message length while scanning with extraie
    - Fix nomenclature for USB and PCI wireless devices
    - bpf: Consider non-owning refs trusted
    - bpf: Consider non-owning refs to refcounted nodes RCU protected
    - drm/edid: Add quirk for OSVR HDK 2.0
    - [arm64] dts: qcom: sm6125-pdx201: correct ramoops pmsg-size
    - [arm64] dts: qcom: sm6125-sprout: correct ramoops pmsg-size
    - [arm64] dts: qcom: sm6350: correct ramoops pmsg-size
    - [arm64] dts: qcom: sm8150-kumano: correct ramoops pmsg-size
    - [arm64] dts: qcom: sm8250-edo: correct ramoops pmsg-size
    - drm/amdgpu: Increase soft IH ring size
    - drm/amdgpu: Update ring scheduler info as needed
    - drm/amd/display: Fix underflow issue on 175hz timing
    - [x86] ASoC: SOF: topology: simplify code to prevent static analysis
      warnings
    - [x86] ASoC: Intel: sof_sdw: Update BT offload config for soundwire config
    - [x86] ALSA: hda: intel-dsp-cfg: add LunarLake support
    - drm/amd/display: Use DTBCLK as refclk instead of DPREFCLK
    - drm/amd/display: Blocking invalid 420 modes on HDMI TMDS for DCN31
    - drm/amd/display: Blocking invalid 420 modes on HDMI TMDS for DCN314
    - drm/amd/display: Use max memclk variable when setting max memclk
    - [arm64] drm/msm/adreno: Use quirk identify hw_apriv
    - [arm64] drm/msm/adreno: Use quirk to identify cached-coherent support
    - io_uring: annotate the struct io_kiocb slab for appropriate user copy
    - [arm64] dts: qcom: sc8280xp-x13s: Add camera activity LED
    - md: raid1: fix potential OOB in raid1_remove_disk()
    - blk-mq: fix tags leak when shrink nr_hw_queues
    - [x86] ASoC: SOF: amd: clear panic mask status when panic occurs
    - [x86] bring back rep movsq for user access on CPUs without ERMS
    - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
    - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
    - ext4: add two helper functions extent_logical_end() and pa_logical_end()
    - ext4: avoid overlapping preallocations due to overflow
    - [arm64] PCI: dwc: Provide deinit callback for i.MX
    - [armel] 9317/1: kexec: Make smp stop calls asynchronous
    - [powerpc*] pseries: fix possible memory leak in ibmebus_bus_init()
    - PCI: vmd: Disable bridge window for domain reset
    - PCI: fu740: Set the number of MSI vectors
    - media: mdp3: Fix resource leaks in of_find_device_by_node
    - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
    - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
    - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
    - media: anysee: fix null-ptr-deref in anysee_master_xfer
    - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
    - media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
    - scsi: lpfc: Abort outstanding ELS cmds when mailbox timeout error is
      detected
    - media: tuners: qt1010: replace BUG_ON with a regular error
    - media: pci: cx23885: replace BUG with error return
    - usb: cdns3: Put the cdns set active part outside the spin lock
    - usb: typec: intel_pmc_mux: Add new ACPI ID for Lunar Lake IOM device
    - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
    - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
    - serial: cpm_uart: Avoid suspicious locking
    - usb: dwc3: dwc3-octeon: Verify clock divider
    - usb: ehci: add workaround for chipidea PORTSC.PEC bug
    - usb: chipidea: add workaround for chipidea PEC bug
    - media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler
      warning
    - kobject: Add sanity check for kset->kobj.ktype in kset_register()
    - [arm64] interconnect: Fix locking for runpm vs reclaim
    - usb: typec: qcom-pmic-typec: register drm_bridge
    - printk: Reduce console_unblank() usage in unsafe scenarios
    - printk: Keep non-panic-CPUs out of console lock
    - printk: Do not take console lock for console_flush_on_panic()
    - printk: Consolidate console deferred printing
    - printk: Rename abandon_console_lock_in_panic() to other_cpu_in_panic()
    - ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
    - btrfs: introduce struct to consolidate extent buffer write context
    - btrfs: zoned: introduce block group context to btrfs_eb_write_context
    - btrfs: zoned: return int from btrfs_check_meta_write_pointer
    - btrfs: zoned: defer advancing meta write pointer
    - btrfs: zoned: activate metadata block group on write time
    - mtd: spi-nor: spansion: use CLPEF as an alternative to CLSR
    - mtd: spi-nor: spansion: preserve CFR2V[7] when writing MEMLAT
    - btrfs: add a helper to read the superblock metadata_uuid
    - btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super
    - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page()
    - drm: gm12u320: Fix the timeout usage for usb_bulk_msg()
    - scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir()
    - md: don't dereference mddev after export_rdev()
    - md: fix warning for holder mismatch from export_rdev()
    - efivarfs: fix statfs() on efivarfs
    - PM: hibernate: Fix the exclusive get block device in test_resume mode
    - [x86] ibt: Suppress spurious ENDBR
    - [x86] ibt: Avoid duplicate ENDBR in __put_user_nocheck*()
    - [riscv64] kexec: Align the kexeced kernel entry
    - [x86] sched: Restore the SD_ASYM_PACKING flag in the DIE domain
    - scsi: target: core: Fix target_cmd_counter leak
    - scsi: lpfc: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
    - panic: Reenable preemption in WARN slowpath
    - ata: libata-core: fetch sense data for successful commands iff CDL enabled
    - [x86] boot/compressed: Reserve more memory for page tables
    - [x86] purgatory: Remove LTO flags
    - blk-mq: prealloc tags when increase tagset nr_hw_queues
    - blk-mq: fix tags UAF when shrinking q->nr_hw_queues
    - md/raid1: fix error: ISO C90 forbids mixed declarations
    - Revert "SUNRPC: Fail faster on bad verifier"
    - attr: block mode changes of symlinks
    - ovl: fix failed copyup of fileattr on a symlink
    - ovl: fix incorrect fdput() on aio completion
    - io_uring/net: fix iter retargeting for selected buf
    - nvme: avoid bogus CRTO values
    - [x86] platform/uv: Use alternate source for socket to node data
    - Revert "firewire: core: obsolete usage of GFP_ATOMIC at building node
      tree"
    - md: Put the right device in md_seq_next
    - drm/amd: Make fence wait in suballocator uninterruptible
    - Revert "drm/amd: Disable S/G for APUs when 64GB or more host memory"
    - dm: don't attempt to queue IO under RCU protection
    - dm: fix a race condition in retrieve_deps
    - btrfs: fix lockdep splat and potential deadlock after failure running
      delayed items
    - btrfs: fix a compilation error if DEBUG is defined in btree_dirty_folio
    - btrfs: fix race between finishing block group creation and its item update
    - btrfs: release path before inode lookup during the ino lookup ioctl
    - btrfs: check for BTRFS_FS_ERROR in pending ordered assert
    - tracing/synthetic: Fix order of struct trace_dynamic_info
    - tracing: Have tracing_max_latency inc the trace array ref count
    - tracing: Have event inject files inc the trace array ref count
    - tracing/synthetic: Print out u64 values properly
    - tracing: Increase trace array ref count on enable and filter files
    - tracing: Have current_trace inc the trace array ref count
    - tracing: Have option files inc the trace array ref count
    - selinux: fix handling of empty opts in selinux_fs_context_submount()
      (Closes: #1052584)
    - nfsd: fix change_info in NFSv4 RENAME replies
    - tracefs: Add missing lockdown check to tracefs_create_dir()
    - i2c: aspeed: Reset the i2c controller when timeout occurs
    - ata: libata: disallow dev-initiated LPM transitions to unsupported states
    - ata: libahci: clear pending interrupt status
    - scsi: megaraid_sas: Fix deadlock on firmware crashdump
    - scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()
    - scsi: pm8001: Setup IRQs on resume
    - Revert "comedi: add HAS_IOPORT dependencies"
    - ext4: fix rec_len verify error
    - drm/radeon: make fence wait in suballocator uninterrruptable
    - [x86] drm/i915: Only check eDP HPD when AUX CH is shared
    - drm/amd/display: Adjust the MST resume flow
    - drm/amd/display: fix the white screen issue when >= 64GB DRAM
    - drm/amd/display: Add DPIA Link Encoder Assignment Fix
    - drm/amd/display: Fix 2nd DPIA encoder Assignment
    - Revert "memcg: drop kmem.limit_in_bytes"
    - drm/amdgpu: fix amdgpu_cs_p1_user_fence
    - [arm64] interconnect: Teach lockdep about icc_bw_lock order
    - [x86] alternatives: Remove faulty optimization
    - [x86] static_call: Fix static-call vs return-thunk
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.6
    - NFS: Fix error handling for O_DIRECT write scheduling
    - NFS: Fix O_DIRECT locking issues
    - NFS: More O_DIRECT accounting fixes for error paths
    - NFS: Use the correct commit info in nfs_join_page_group()
    - NFS: More fixes for nfs_direct_write_reschedule_io()
    - NFS/pNFS: Report EINVAL errors from connect() to the server
    - SUNRPC: Mark the cred for revalidation if the server rejects it
    - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server
    - NFSv4.1: fix pnfs MDS=DS session trunking
    - gfs2: Fix another freeze/thaw hang
    - netfs: Only call folio_start_fscache() one time for each folio
    - btrfs: improve error message after failure to add delayed dir index item
    - btrfs: remove BUG() after failure to insert delayed dir index item
    - ext4: replace the traditional ternary conditional operator with with
      max()/min()
    - ext4: move setting of trimmed bit into ext4_try_to_trim_range()
    - ext4: do not let fstrim block system suspend
    - netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
    - netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC
    - netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation
      fails
    - netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
    - netfilter: nf_tables: fix memleak when more than 255 elements expired
    - netfilter: nf_tables: disallow rule removal from chain binding
      (CVE-2023-5197)
    - [arm64] ASoC: meson: spdifin: start hw on dai probe
    - netfilter: nf_tables: disallow element removal on anonymous sets
    - bpf: Avoid deadlock when using queue and stack maps from NMI
    - bpf: Avoid dummy bpf_offload_netdev in __bpf_prog_dev_bound_init
    - ALSA: docs: Fix a typo of midi2_ump_probe option for snd-usb-audio
    - ALSA: seq: Avoid delivery of events for disabled UMP groups
    - ASoC: rt5640: Revert "Fix sleep in atomic context"
    - ASoC: rt5640: Fix sleep in atomic context
    - ASoC: rt5640: fix typos
    - ASoC: rt5640: Do not disable/enable IRQ twice on suspend/resume
    - ASoC: rt5640: Enable the IRQ on resume after configuring jack-detect
    - ASoC: rt5640: Fix IRQ not being free-ed for HDA jack detect mode
    - bpf: Fix a erroneous check after snprintf()
    - ALSA: hda/realtek: Splitting the UX3402 into two separate models
    - netfilter: conntrack: fix extension size table
    - netfilter: nf_tables: Fix entries val in rule reset audit log
    - uapi: stddef.h: Fix header guard location
    - uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
    - [x86] ASoC: SOF: ipc4-topology: fix wrong sizeof argument
    - net/core: Fix ETH_P_1588 flow dissector
    - ALSA: seq: ump: Fix -Wformat-truncation warning
    - ASoC: hdaudio.c: Add missing check for devm_kstrdup
    - [arm64] ASoC: imx-audmix: Fix return error with devm_clk_get()
    - iavf: do not process adminq tasks when __IAVF_IN_REMOVE_TASK is set
    - ASoC: SOF: core: Only call sof_ops_free() on remove if the probe was
      successful
    - iavf: add iavf_schedule_aq_request() helper
    - iavf: schedule a request immediately after add/delete vlan
    - i40e: Fix VF VLAN offloading when port VLAN is configured
    - netfilter, bpf: Adjust timeouts of non-confirmed CTs in
      bpf_ct_insert_entry()
    - ionic: fix 16bit math issue when PAGE_SIZE >= 64KB
    - igc: Fix infinite initialization loop with early XDP redirect
    - ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754)
    - scsi: iscsi_tcp: restrict to TCP sockets
    - [powerpc*] perf/hv-24x7: Update domain value check
    - [powerpc*] dexcr: Move HASHCHK trap handler
    - dccp: fix dccp_v4_err()/dccp_v6_err() again
    - [x86] mm, kexec, ima: Use memblock_free_late() from
      ima_free_kexec_buffer()
    - net: hsr: Properly parse HSRv1 supervisor frames.
    - [x86] platform/x86: intel_scu_ipc: Check status after timeout in
      busy_loop()
    - [x86] platform/x86: intel_scu_ipc: Check status upon timeout in
      ipc_wait_for_interrupt()
    - [x86] platform/x86: intel_scu_ipc: Don't override scu in
      intel_scu_ipc_dev_simple_command()
    - [x86] platform/x86: intel_scu_ipc: Fail IPC send if still busy
    - [x86] srso: Fix srso_show_state() side effect
    - [x86] srso: Set CPUID feature bits independently of bug or mitigation
      status
    - [x86] srso: Don't probe microcode in a guest
    - [x86] srso: Fix SBPB enablement for spec_rstack_overflow=off
    - [arm64] net: hns3: add cmdq check for vf periodic service task
    - [arm64] net: hns3: fix GRE checksum offload issue
    - [arm64] net: hns3: only enable unicast promisc when mac table full
    - [arm64] net: hns3: fix fail to delete tc flower rules during reset issue
    - [arm64] net: hns3: add 5ms delay before clear firmware reset irq source
    - net: bridge: use DEV_STATS_INC()
    - team: fix null-ptr-deref when team device type is changed
    - locking/atomic: scripts: fix fallback ifdeffery
    - net: rds: Fix possible NULL-pointer dereference
    - vxlan: Add missing entries to vxlan_get_size()
    - netfilter: nf_tables: disable toggling dormant table state more than once
    - netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
      (CVE-2023-42756)
    - net: hinic: Fix warning-hinic_set_vlan_fliter() warn: variable
      dereferenced before check 'hwdev'
    - net/handshake: Fix memory leak in __sock_create() and sock_alloc_file()
    - [x86] i915/pmu: Move execlist stats initialization to execlist specific
      setup
    - drm/virtio: clean out_fence on complete_submit
    - locking/seqlock: Do the lockdep annotation before locking in
      do_write_seqcount_begin_nested()
    - net: ena: Flush XDP packets on error.
    - bnxt_en: Flush XDP for bnxt_poll_nitroa0()'s NAPI
    - octeontx2-pf: Do xdp_do_flush() after redirects.
    - igc: Expose tx-usecs coalesce setting to user
    - cxl/region: Match auto-discovered region decoders by HPA range
    - proc: nommu: /proc/<pid>/maps: release mmap read lock
    - proc: nommu: fix empty /proc/<pid>/maps
    - cifs: Fix UAF in cifs_demultiplex_thread()
    - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
    - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
    - i2c: mux: gpio: Add missing fwnode_handle_put()
    - i2c: xiic: Correct return value check for xiic_reinit()
    - drm/amdgpu: set completion status as preempted for the resubmission
    - drm/amd/display: Update DPG test pattern programming
    - drm/amd/display: fix a regression in blank pixel data caused by coding
      mistake
    - [arm64] dts: qcom: sdm845-db845c: Mark cont splash memory region as
      reserved
    - direct_write_fallback(): on error revert the ->ki_pos update from buffered
      write
    - btrfs: reset destination buffer when read_extent_buffer() gets invalid
      range
    - vfio/mdev: Fix a null-ptr-deref bug for mdev_unregister_parent()
    - [armhf] bus: ti-sysc: Use fsleep() instead of usleep_range() in
      sysc_reset()
    - [armhf] bus: ti-sysc: Fix missing AM35xx SoC matching
    - [arm64] firmware: arm_scmi: Harden perf domain info access
    - [arm64]firmware: arm_scmi: Fixup perf power-cost/microwatt support
    - power: supply: mt6370: Fix missing error code in mt6370_chg_toggle_cfo()
    - clk: sprd: Fix thm_parents incorrect configuration
    - clk: si521xx: Use REGCACHE_FLAT instead of NONE
    - clk: si521xx: Fix regmap write accessor
    - clk: tegra: fix error return case for recalc_rate
    - [armhf] bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart
      wake-up
    - swiotlb: use the calculated number of areas
    - power: supply: ucs1002: fix error code in ucs1002_get_property()
    - power: supply: rt9467: Fix rt9467_run_aicl()
    - power: supply: core: fix use after free in uevent
    - power: supply: rk817: Fix node refcount leak
    - [powerpc*] stacktrace: Fix arch_stack_walk_reliable()
    - [arm64] dts: imx8mp: Fix SDMA2/3 clocks
    - [arm64] dts: imx8mp-beacon-kit: Fix audio_pll2 clock
    - [arm64] soc: imx8m: Enable OCOTP clock for imx8mm before reading registers
    - [arm64] dts: imx8mm-evk: Fix hdmi@3d node
    - [arm64] dts: imx: Add imx8mm-prt8mm.dtb to build
    - [x86] i915/guc: Get runtime pm in busyness worker only if already active
    - gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip
    - i2c: npcm7xx: Fix callback completion ordering
    - NFSD: Fix zero NFSv4 READ results when RQ_SPLICE_OK is not set
    - [x86] reboot: VMCLEAR active VMCSes before emergency reboot
    - ceph: drop messages from MDS when unmounting
    - dma-debug: don't call __dma_entry_alloc_check_leak() under
      free_entries_lock
    - bpf: Annotate bpf_long_memcpy with data_race
    - [x86] ASoC: amd: yc: Add DMI entries to support Victus by HP Gaming Laptop
      15-fb0xxx (8A3E)
    - spi: sun6i: reduce DMA RX transfer width to single byte
    - spi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain
    - nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()
    - scsi: qedf: Add synchronization between I/O completions and abort
    - scsi: ufs: core: Move __ufshcd_send_uic_cmd() outside host_lock
    - scsi: ufs: core: Poll HCS.UCRDY before issuing a UIC command
    - ring-buffer: Avoid softlockup in ring_buffer_resize()
    - btrfs: assert delayed node locked when removing delayed item
    - ring-buffer: Do not attempt to read past "commit"
    - ata: sata_mv: Fix incorrect string length computation in mv_dump_mem()
    - [x86] efi/x86: Ensure that EFI_RUNTIME_MAP is enabled for kexec
    - [x86] platform/x86: asus-wmi: Support 2023 ROG X16 tablet mode
    - thermal/of: add missing of_node_put()
    - drm/amdgpu: Store CU info from all XCCs for GFX v9.4.3
    - drm/amd/display: Don't check registers, if using AUX BL control
    - drm/amdgpu/soc21: don't remap HDP registers for SR-IOV
    - drm/amdgpu/nbio4.3: set proper rmmio_remap.reg_offset for SR-IOV
    - drm/amdgpu: fallback to old RAS error message for aqua_vanjaram
    - drm/amdgpu: Handle null atom context in VBIOS info ioctl
    - objtool: Fix _THIS_IP_ detection for cold functions
    - nvme-pci: do not set the NUMA node of device if it has none
    - [riscv64] errata: fix T-Head dcache.cva encoding
    - scsi: pm80xx: Use phy-specific SAS address when sending PHY_START command
    - scsi: pm80xx: Avoid leaking tags when processing
      OPC_INB_SET_CONTROLLER_CONFIG command
    - smb3: correct places where ENOTSUPP is used instead of preferred
      EOPNOTSUPP
    - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
    - ata: libata-eh: do not thaw the port twice in ata_eh_reset()
    - Add DMI ID for MSI Bravo 15 B7ED
    - spi: nxp-fspi: reset the FLSHxCR1 registers
    - [armhf] spi: stm32: add a delay before SPI disable
    - bpf: Clarify error expectations from bpf_clone_redirect
    - ASoC: rt5640: Only cancel jack-detect work on suspend if active
    - ALSA: hda: intel-sdw-acpi: Use u8 type for link index
    - [x86] ASoC: cs42l42: Ensure a reset pulse meets minimum pulse width.
    - [x86] ASoC: cs42l42: Don't rely on GPIOD_OUT_LOW to set RESET initially
      low
    - [x86] ASoC: cs42l42: Avoid stale SoundWire ATTACH after hard reset
    - firmware: cirrus: cs_dsp: Only log list of algorithms in debug build
    - ASoC: wm_adsp: Fix missing locking in wm_adsp_[read|write]_ctl()
    - ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link
    - [x86] ASoC: SOF: sof-audio: Fix DSP core put imbalance on widget setup
      failure
    - media: vb2: frame_vector.c: replace WARN_ONCE with a comment
    - NFSv4.1: fix zero value filehandle in post open getattr
    - [x86] ASoC: SOF: Intel: MTL: Reduce the DSP init timeout
    - [powerpc*] watchpoints: Disable preemption in thread_change_pc()
    - [powerpc*] watchpoint: Disable pagefaults when getting user instruction
    - [powerpc*] watchpoints: Annotate atomic context in more places
    - [armhf] ncsi: Propagate carrier gain/loss events to the NCSI controller
    - net: hsr: Add __packed to struct hsr_sup_tlv.
    - gfs2: fix glock shrinker ref issues
    - i2c: designware: fix __i2c_dw_disable() in case master is holding SCL low
    - perf build: Define YYNOMEM as YYNOABORT for bison < 3.81
    - iommu/arm-smmu-v3: Fix soft lockup triggered by
      arm_smmu_mm_invalidate_range
    - [x86] sgx: Resolves SECS reclaim vs. page fault for EAUG race
    - [x86] srso: Add SRSO mitigation for Hygon processors
    - [x86] KVM: SVM: INTERCEPT_RDTSCP is never intercepted anyway
    - [x86] KVM: SVM: Fix TSC_AUX virtualization setup
    - [x86] KVM: x86/mmu: Open code leaf invalidation from mmu_notifier
    - [x86] KVM: x86/mmu: Do not filter address spaces in
      for_each_tdp_mmu_root_yield_safe()
    - [x86] KVM: x86/mmu: Stop zapping invalidated TDP MMU roots asynchronously
    - mptcp: fix bogus receive window shrinkage with multiple subflows
    - mptcp: move __mptcp_error_report in protocol.c
    - mptcp: process pending subflow error on close
    - misc: rtsx: Fix some platforms can not boot and move the l1ss judgment to
      probe (Closes: #1052063)
    - Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
    - scsi: core: ata: Do no try to probe for CDL on old drives
    - serial: 8250_port: Check IRQ data before use
    - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
    - crypto: sm2 - Fix crash caused by uninitialized context
    - ALSA: rawmidi: Fix NULL dereference at proc read
    - ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre
      M70q
    - ata: libata-scsi: link ata port and scsi device
    - scsi: sd: Differentiate system and runtime start/stop management
    - scsi: sd: Do not issue commands to suspended disks on shutdown
    - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION
      CODES
    - io_uring/fs: remove sqe->rw_flags checking from LINKAT
    - i2c: i801: unregister tco_pdev in i801_probe() error path
    - [x86] ASoC: amd: yc: Fix non-functional mic on Lenovo 82QF and 82UG
    - kernel/sched: Modify initial boot task idle setup
    - sched/rt: Fix live lock between select_fallback_rq() and RT push
    - Revert "SUNRPC dont update timeout value on connection reset"
    - NFSv4: Fix a state manager thread deadlock regression
    - ACPI: NFIT: Fix incorrect calculation of idt size
    - timers: Tag (hr)timer softirq as hotplug safe
    - mm: mempolicy: keep VMA walk if both MPOL_MF_STRICT and MPOL_MF_MOVE are
      specified
    - mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()
    - mm: page_alloc: fix CMA and HIGHATOMIC landing on the wrong buddy list
    - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement
    - cxl/port: Fix cxl_test register enumeration regression
    - cxl/pci: Fix appropriate checking for _OSC while handling CXL RAS
      registers
    - ring-buffer: Fix bytes info in per_cpu buffer stats
    - ring-buffer: Update "shortest_full" in polling
    - btrfs: refresh dir last index during a rewinddir(3) call
    - btrfs: file_remove_privs needs an exclusive lock in direct io write
    - btrfs: set last dir index to the current last index when opening dir
    - btrfs: fix race between reading a directory and adding entries to it
    - btrfs: properly report 0 avail for very full file systems
    - media: uvcvideo: Fix OOB read
    - bpf: Add override check to kprobe multi link attach
    - bpf: Fix BTF_ID symbol generation collision
    - bpf: Fix BTF_ID symbol generation collision in tools/
    - net: thunderbolt: Fix TCPv6 GSO checksum calculation
    - thermal: sysfs: Fix trip_point_hyst_store()
    - fs/smb/client: Reset password pointer to NULL (CVE-2023-5345)
    - tracing/user_events: Align set_bit() address for all archs
    - ata: libata-core: Fix ata_port_request_pm() locking
    - ata: libata-core: Fix port and device removal
    - ata: libata-core: Do not register PM operations for SAS ports
    - ata: libata-sata: increase PMP SRST timeout to 10s
    - [x86] i915: Limit the length of an sg list to the requested length
    - [x86] drm/i915/gt: Fix reservation address in ggtt_reserve_guc_top
    - power: supply: rk817: Add missing module alias
    - power: supply: ab8500: Set typing and props
    - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC
    - drm/amd/display: fix the ability to use lower resolution modes on eDP
    - [arm64] drm/meson: fix memory leak on ->hpd_notify callback
    - rbd: move rbd_dev_refresh() definition
    - rbd: decouple header read-in from updating rbd_dev->header
    - rbd: decouple parent info read-in from updating rbd_dev
    - rbd: take header_rwsem in rbd_dev_refresh() only when updating
    - memcg: drop kmem.limit_in_bytes
    - mm, memcg: reconsider kmem.limit_in_bytes deprecation
    - [x86] ASoC: amd: yc: Fix a non-functional mic on Lenovo 82TL

  [ Salvatore Bonaccorso ]
  * Bump ABI to 2
  * [rt] Drop "kernel/fork: beware of __put_task_struct calling context"
    (applied upstream)
  * [rt] Disable RT featureset as not supported in 6.5.y series

  [ Yoann Congal ]
  * [x86] drivers/watchdog: Enable ADVANTECH_EC_WDT as module (Closes: #1051449)

  [ Vincent Blut ]
  * [x86] drivers/platform/x86: Enable SYSTEM76_ACPI as module
    (Closes: #1050996)

  [ Emanuele Rocca ]
  * [arm64] Add qrtr to kernel-image udeb, needed by Lenovo Thinkpad X13s.

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 07 Oct 2023 11:36:46 +0200

linux (6.5.3-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.2
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.3

  [ Christian Göttsche ]
  * Enable KFENCE support (not enabled by default) (Closes: #1025845)

  [ Diederik de Haas ]
  * net/xdp: Enable XDP_SOCKETS_DIAG as module (Closes: #1051455)

  [ Ben Hutchings ]
  * udeb: Make MPT modules optional in scsi-modules (fixes FTBFS on s390x)
    (Closes: #1051249)

  [ Salvatore Bonaccorso ]
  * Refresh "radeon, amdgpu: Firmware is required for DRM and KMS on R600
    onward"
  * Set ABI to 1
  * [rt] Update to 6.5.2-rt8

  [ Emanuele Rocca ]
  * [arm64] Add reset-rzg2l-usbphy-ctrl to usb-modules udeb in order to enable
    USB support on Renesas RZ/G2L-SMARC boards.
  * [arm64,armhf] drivers/hwspinlock: Enable CONFIG_HWSPINLOCK
  * [arm64] Add support for Lenovo ThinkPad X13s: enable as modules
    SC_DISPCC_8280XP, SC_GCC_8280XP, SC_GPUCC_8280XP, QCOM_SPMI_ADC5,
    INTERCONNECT_QCOM_OSM_L3, INTERCONNECT_QCOM_SC8280XP, LEDS_QCOM_LPG,
    QCOM_IPCC, QCOM_FASTRPC, NVMEM_SPMI_SDAM, PHY_QCOM_EDP, PHY_QCOM_QMP_PCIE,
    PHY_QCOM_USB_SNPS_FEMTO_V2, PINCTRL_SC8280XP, PINCTRL_SC8280XP_LPASS_LPI,
    PINCTRL_LPASS_LPI, POWER_RESET_QCOM_PON, BATTERY_QCOM_BATTMGR,
    QCOM_Q6V5_ADSP, QCOM_Q6V5_PAS, QCOM_Q6V5_WCSS, QCOM_SYSMON, QCOM_LLCC,
    QCOM_OCMEM, QCOM_PMIC_GLINK, QCOM_STATS, QCOM_APR, QCOM_ICC_BWMON,
    SPI_QCOM_GENI, TYPEC_MUX_GPIO_SBU, QRTR_SMD, SND_SOC_WCD938X_SDW,
    SND_SOC_LPASS_WSA_MACRO, SND_SOC_LPASS_VA_MACRO, SND_SOC_LPASS_RX_MACRO,
    SND_SOC_LPASS_TX_MACRO, SND_SOC_QDSP6
    (Thanks Steve Capper!)
  * [arm64] Add Thinkpad X13s modules to udebs

  [ Vincent Blut ]
  * drivers/char/hw_random: Change HW_RANDOM from module to built-in
    (Closes: #1041007)
  * drivers/char/tpm: Do not explicitly set HW_RANDOM_TPM
  * [arm64, cloud, x86] drivers/char/tpm: Do not explicitly enable TCG_TPM
  * [arm*,ppc64*,sparc64,s390x] drivers/char/hw_random: Prevent some HW Random
    Number Generator drivers from being built-in

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 13 Sep 2023 22:20:48 +0200

linux (6.5.1-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_6.5
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.1

  [ Diederik de Haas ]
  * [rt] Update to 6.5-rc7-rt4
  * [rt] Update to 6.5-rt6

  [ Salvatore Bonaccorso ]
  * [rt] Update to 6.5-rt5

  [ Aurelien Jarno ]
  * [riscv64] enable cpufreq support for Starfive JH7110: enable CPUFREQ_DT,
    MFD_AXP20X_I2C and REGULATOR_AXP20X as modules, and CPUFREQ_DT_PLATDEV as
    built-in.
  * [armel/rpi,armhf,arm64] enable CPUFREQ_DT_PLATDEV as built-in, as it does
    not get autoloaded as a module (Closes: #1050587)

  [ Bastian Blank ]
  * Use pytest to test some of the code.
  * Re-add /usr/include/drm and /usr/include/scsi to linux-libc-dev; they
    don't longer conflict with other packages. (closes: #1050368)
  * Properly split host and build flags. (closes: #1050991)

  [ Miguel Bernal Marin ]
  * [x86] drivers/hwtracing/intel_th: Enable INTEL_TH_ACPI Intel Trace Hub
    ACPI controller as module (Closes: #1050342)
  * [amd64] arch/x86/ras: Enable RAS_CEC (Correctable Errors Collector)
    (Closes: #1050940)

  [ Antonio Terceiro ]
  * [arm64] sound/pci: Enable SND_CMIPCI as a module

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 03 Sep 2023 13:04:38 +0200

linux (6.5~rc7-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Salvatore Bonaccorso ]
  * linux-image: bug: Update taint list and use upstream descriptions
  * [rt] Refresh "serial: 8250: implement non-BKL console"

  [ Miguel Bernal Marin ]
  * [amd64] mm: Enable MEMORY_HOTPLUG_DEFAULT_ONLINE: Enable Online the newly
    added memory blocks by default (Closes: #1049901)

  [ Helge Deller ]
  * [hppa] Add build-dependency on binutils-dev to get bfd.h and thus allow
    disassembly of jitted programs in bpftool

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 21 Aug 2023 21:49:11 +0200

linux (6.5~rc6-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Aurelien Jarno ]
  * [riscv64] enable CONFIG_ACPI
  * [riscv64] improve Starfive JH7110 support: enable CRYPTO_DEV_JH7110,
    SND_SOC, SND_SOC_STARFIVE and SND_SOC_JH7110_TDM as modules

  [ Stuart Hayhurst ]
  * [x86] drivers/platform/x86/lenovo-ymc: Enable LENOVO_YMC as module

  [ Diederik de Haas ]
  * [rt] Update to 6.5-rc4-rt2

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 15 Aug 2023 13:01:14 +0200

linux (6.5~rc4-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Ben Hutchings ]
  * Drop patches applied upstream:
    - Drop "usbip: Use _FORTIFY_SOURCE=2 instead of (implicitly) =1"
    - Drop "arm: dts: Enable device-tree overlay support for RPi devices"
    - Drop "arm64: dts: broadcom: Enable device-tree overlay support for RPi
      devices"
    - Drop "m68k: Fix invalid .section syntax"
  * Refresh patches:
    - Adjust context in "firmware: Remove redundant log messages from drivers"
    - Adjust filename in "ARM: dts: kirkwood: Fix SATA pinmux-ing for TS419"
    - Adjust context in "Include package version along with kernel release in
      stack traces"
    - Adjust context in "efi: Lock down the kernel if booted in secure boot
      mode"
  * Set ABI to 0
  * d/config: Update with the help of kconfigeditor2:
    - [arm64,armhf] mfd: Enable MFD_RK8XX_I2C as built-in instead of MFD_RK808
    - media: Enable VIDEO_STK1160 as module instead of VIDEO_STK1160_COMMON
  * [rt] Update to 6.5-rc4-rt1

  [ Vincent Blut ]
  * [arm64] Improve support for Allwinner H6 and affiliated SoCs
    (Closes: #1038986)
    - drivers/cpufreq: Enable ARM_ALLWINNER_SUN50I_CPUFREQ_NVMEM as module
    - drivers/iommu: Enable SUN50I_IOMMU
    - drivers/media/rc: Enable IR_SUNXI as module
    - drivers/phy/allwinner: Enable PHY_SUN50I_USB3 as module
    - sound/soc/sunxi: Enable SND_SUN50I_DMIC as module

 -- Ben Hutchings <benh@debian.org>  Fri, 04 Aug 2023 03:45:57 +0200

linux (6.4.13-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.12
    - crypto, cifs: fix error handling in extract_iter_to_sg()
    - net: phy: at803x: Use devm_regulator_get_enable_optional()
    - net: phy: at803x: fix the wol setting functions
    - drm/amd/display: Update DTBCLK for DCN32
    - drm/scheduler: set entity to NULL in drm_sched_entity_pop_job()
    - drm/amdgpu: fix calltrace warning in amddrm_buddy_fini
    - drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
    - drm/amdgpu: fix memory leak in mes self test
    - Revert "drm/amd/display: disable SubVP + DRR to prevent underflow"
    - [x86] ASoC: Intel: sof_sdw: add quirk for MTL RVP
    - [x86] ASoC: Intel: sof_sdw: add quirk for LNL RVP
    - ASoC: SOF: amd: Add pci revision id check
    - drm/stm: ltdc: fix late dereference check
    - [arm64] dts: qcom: ipq5332: add QFPROM node
    - ASoC: amd: vangogh: Add check for acp config flags in vangogh platform
    - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing
    - ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
    - [x86] ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in
      _exit
    - [x86] ASoC: Intel: sof_sdw: add quick for Dell SKU 0BDA
    - [x86] ASoC: Intel: sof_sdw: Add support for Rex soundwire
    - iopoll: Call cpu_relax() in busy loops
    - ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion
    - dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
    - dt-bindings: input: goodix: Add "goodix,no-reset-during-suspend" property
    - HID: i2c-hid: goodix: Add support for "goodix,no-reset-during-suspend"
      property
    - HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL
      Keyboard
    - [amd64] iommu/amd: Introduce Disable IRTE Caching Support
    - drm/amdgpu: install stub fence into potential unused fence pointers
    - drm/amd/display: Remove v_startup workaround for dcn3+
    - drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz
    - drm/amdgpu: unmap and remove csa_va properly
    - RDMA/mlx5: Return the firmware result upon destroying QP/RQ
    - RDMA/bnxt_re: consider timeout of destroy ah as success.
    - drm/amd/display: Skip DPP DTO update if root clock is gated
    - drm/amd/display: Enable dcn314 DPP RCO
    - ASoC: SOF: core: Free the firmware trace before calling snd_sof_shutdown()
    - [x86] HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID
    - Revert "[PATCH] uml: export symbols added by GCC hardened"
    - smb: client: fix warning in cifs_smb3_do_mount()
    - cifs: fix session state check in reconnect to avoid use-after-free issue
    - led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node()
      loops
    - media: v4l2-mem2mem: add lock to protect parameter num_rdy
    - media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250
    - usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
    - usb: gadget: uvc: queue empty isoc requests if no video buffer is
      available
    - media: platform: mediatek: vpu: fix NULL ptr dereference
    - [x86] thunderbolt: Read retimer NVM authentication status prior
      tb_retimer_set_inbound_sbtx()
    - xhci: get rid of XHCI_PLAT quirk that used to prevent MSI setup
    - usb: chipidea: imx: don't request QoS for imx8ulp
    - usb: chipidea: imx: turn off vbus comparator when suspend
    - usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
    - gfs2: Fix possible data races in gfs2_show_options()
    - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
    - [x86] thunderbolt: Add Intel Barlow Ridge PCI ID
    - [x86] thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth
    - firewire: net: fix use after free in fwnet_finish_incoming_packet()
    - watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)
    - Bluetooth: L2CAP: Fix use-after-free
    - Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
    - ceph: try to dump the msgs when decoding fails
    - drm/amdgpu: Fix potential fence use-after-free v2
    - fs/ntfs3: Enhance sanity check while generating attr_list
    - fs/ntfs3: Return error for inconsistent extended attributes
    - fs: ntfs3: Fix possible null-pointer dereferences in mi_read()
    - fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted
    - fs/ntfs3: Alternative boot if primary boot is corrupted
    - ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
    - ALSA: hda: fix a possible null-pointer dereference due to data race in
      snd_hdac_regmap_sync()
    - ALSA: hda/realtek: Add quirk for ASUS ROG GX650P
    - ALSA: hda/realtek: Add quirk for ASUS ROG GA402X
    - ALSA: hda/realtek: Amend G634 quirk to enable rear speakers
    - ALSA: hda/realtek: Add quirk for ASUS ROG G614Jx
    - ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V
    - Bluetooth: MGMT: Use correct address for memcpy()
    - ring-buffer: Do not swap cpu_buffer during resize process
    - btrfs: move out now unused BG from the reclaim list
    - btrfs: fix use-after-free of new block group that became unused
    - regulator: qcom-rpmh: Fix LDO 12 regulator for PM8550
    - virtio-mmio: don't break lifecycle of vm_dev
    - cifs: fix potential oops in cifs_oplock_break
    - i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
    - i2c: hisi: Only handle the interrupt of the driver's transfer
    - i2c: tegra: Fix i2c-tegra DMA config option processing
    - blk-cgroup: hold queue_lock when removing blkg->q_node
    - fbdev: mmp: fix value check in mmphw_probe()
    - media: mtk-jpeg: Set platform driver data earlier
    - [powerpc*] rtas_flash: allow user copy to flash block cache objects
    - smb3: display network namespace in debug information
    - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
    - tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32
      platforms
    - btrfs: fix infinite directory reads
    - btrfs: fix incorrect splitting in btrfs_drop_extent_map_range
    - btrfs: fix BUG_ON condition in btrfs_cancel_balance
    - btrfs: fix replace/scrub failure with metadata_uuid
    - btrfs: only subtract from len_to_oe_boundary when it is tracking an extent
    - i2c: designware: Correct length byte validation logic
    - i2c: designware: Handle invalid SMBus block data response length value
    - [x86] cpu: Fix __x86_return_thunk symbol type
    - [x86] cpu: Fix up srso_safe_ret() and __x86_return_thunk()
    - [x86] objtool/x86: Fix SRSO mess
    - [x86] alternative: Make custom return thunk unconditional
    - [x86] cpu: Clean up SRSO return thunk mess
    - [x86] cpu: Rename original retbleed methods
    - [x86] cpu: Rename srso_(.*)_alias to srso_alias_\1
    - [x86] cpu: Cleanup the untrain mess
    - [x86] cpu/kvm: Provide UNTRAIN_RET_VM
    - [x86] srso: Explain the untraining sequences a bit more
    - [x86] objtool/x86: Fixup frame-pointer vs rethunk
    - [x86] static_call: Fix __static_call_fixup()
    - [x86] CPU/AMD: Fix the DIV(0) initial fix attempt (CVE-2023-20588)
    - [x86] srso: Disable the mitigation on unaffected configurations
    - [x86] retpoline,kprobes: Fix position of thunk sections with
      CONFIG_LTO_CLANG
    - [x86] retpoline,kprobes: Skip optprobe check for indirect jumps with
      retpolines and IBT
    - [x86] srso: Correct the mitigation status when SMT is disabled
    - net: xfrm: Fix xfrm_address_filter OOB read
    - net: af_key: fix sadb_x_filter validation
    - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
    - xfrm: Silence warnings triggerable by bad packets
    - xfrm: fix slab-use-after-free in decode_session6
    - ip6_vti: fix slab-use-after-free in decode_session6
    - ip_vti: fix potential slab-use-after-free in decode_session6
    - xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-3772)
    - xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH (CVE-2023-3773)
    - xfrm: delete offloaded policy
    - xfrm: don't skip free of empty state in acquire policy
    - virtio-net: set queues after driver_ok
    - net: pcs: Add missing put_device call in miic_create
    - net: phy: fix IRQ-based wake-on-lan over hibernate / power off
    - drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
    - [x86] drm/i915/guc/slpc: Restore efficient freq earlier
    - net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source
    - octeon_ep: fix timeout value for waiting on mbox response
    - octeon_ep: cancel tx_timeout_task later in remove sequence
    - octeon_ep: cancel ctrl_mbox_task after intr_poll_task
    - octeon_ep: cancel queued works in probe error path
    - net: veth: Page pool creation error handling for existing pools only
    - accel/qaic: Fix slicing memory leak
    - accel/qaic: Clean up integer overflow checking in map_user_pages()
    - netfilter: nf_tables: fix false-positive lockdep splat
    - netfilter: nf_tables: deactivate catchall elements in next generation
      (CVE-2023-4569)
    - netfilter: nf_tables: don't fail inserts if duplicate has expired
    - netfilter: set default timeout to 3 secs for sctp shutdown send and recv
      state
    - ipvs: fix racy memcpy in proc_do_sync_threshold
    - netfilter: nf_tables: fix GC transaction races with netns and netlink
      event exit path
    - netfilter: nf_tables: GC transaction race with netns dismantle
    - netfilter: nft_dynset: disallow object maps
    - net: phy: broadcom: stub c45 read/write for 54810
    - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
    - net: openvswitch: reject negative ifindex
    - iavf: fix FDIR rule fields masks validation
    - i40e: fix misleading debug logs
    - net/mlx5e: XDP, Fix fifo overrun on XDP_REDIRECT
    - drm/nouveau/disp: fix use-after-free in error handling of
      nouveau_connector_create
    - net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
    - sfc: add fallback action-set-lists for TC offload
    - sfc: don't unregister flow_indr if it was never registered
    - sfc: don't fail probe if MAE/TC setup fails
    - sock: Fix misuse of sk_under_memory_pressure()
    - net: do not allow gso_size to be set to GSO_BY_FRAGS
    - qede: fix firmware halt over suspend and resume
    - ice: Block switchdev mode when ADQ is active and vice versa
    - bus: ti-sysc: Flush posted write on enable before reset
    - [arm64] dts: qcom: qrb5165-rb5: fix thermal zone conflict
    - [arm64] dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
    - [arm64] dts: rockchip: Disable HS400 for eMMC on ROCK 4C+
    - ASoC: max98363: don't return on success reading revision ID
    - [arm64] dts: imx93: Fix anatop node size
    - ASoC: rt5665: add missed regulator_bulk_disable
    - ASoC: meson: axg-tdm-formatter: fix channel slot allocation
    - ALSA: hda/realtek: Add quirks for HP G11 Laptops
    - pinctrl: qcom: Add intr_target_width field to support increased number of
      interrupt targets
    - soc: aspeed: uart-routing: Use __sysfs_match_string
    - soc: aspeed: socinfo: Add kfree for kstrdup
    - ALSA: hda/realtek - Remodified 3k pull low procedure
    - [riscv64] entry: set a0 = -ENOSYS only when syscall != -1
    - [riscv64] correct riscv_insn_is_c_jr() and riscv_insn_is_c_jalr()
    - [riscv64] uaccess: Return the number of bytes effectively not copied
    - serial: 8250: Fix oops for port->pm on uart_change_pm()
    - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback
      interfaces.
    - cifs: Release folio lock on fscache read hit.
    - smb: client: fix null auth
    - regulator: da9063: better fix null deref with partial DT
    - virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case
    - [arm64] dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards
    - [arm64] ptrace: Ensure that SME is set up for target when writing SSVE
      state
    - [arm64] ptrace: Ensure that the task sees ZT writes on first use
    - blk-crypto: dynamically allocate fallback profile
    - media: uvcvideo: Fix menu count handling for userspace XU mappings
    - dt-bindings: pinctrl: qcom,sa8775p-tlmm: add gpio function constant
    - mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
    - mmc: wbsd: fix double mmc_free_host() in wbsd_init()
    - mmc: block: Fix in_flight[issue_type] value error
    - mmc: sunplus: fix return value check of mmc_add_host()
    - mmc: sunplus: Fix error handling in spmmc_drv_probe()
    - drm/qxl: fix UAF on handle creation
    - Revert "drm/edid: Fix csync detailed mode parsing"
    - Revert "Revert "drm/amdgpu/display: change pipe policy for DCN 2.0""
    - [x86] drm/i915/sdvo: fix panel_type initialization
    - drm/amd: flush any delayed gfxoff on suspend entry
    - drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix
    - drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7
    - drm/amd/display: disable RCO for DCN314
    - drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11
    - drm/amdgpu: keep irq count in amdgpu_irq_disable_all
    - Revert "perf report: Append inlines to non-DWARF callchains"
    - [x86] ASoC: SOF: intel: hda: Clean up link DMA for IPC3 during stop
      (Closes: #1042543)
    - af_unix: Fix null-ptr-deref in unix_stream_sendpage().
    - net: fix the RTO timer retransmitting skb every 1ms if linear option is
      enabled
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.13
    - NFSv4.2: fix error handling in nfs42_proc_getxattr
    - NFSv4: fix out path in __nfs4_get_acl_uncached
    - xprtrdma: Remap Receive buffers after a reconnect
    - PCI: acpiphp: Reassign resources on bridge if necessary
    - jbd2: remove t_checkpoint_io_list
    - jbd2: remove journal_clean_one_cp_list()
    - jbd2: fix a race when checking checkpoint buffer busy
    - can: raw: fix receiver memory leak
    - can: raw: fix lockdep issue in raw_release()
    - wifi: iwlwifi: mvm: add dependency for PTP clock
    - tracing: Fix cpu buffers unavailable due to 'record_disabled' missed
    - tracing/synthetic: Use union instead of casts
    - tracing/synthetic: Skip first entry for stack traces
    - tracing/synthetic: Allocate one additional element for size
    - tracing: Fix memleak due to race between current_tracer and trace
    - devlink: add missing unregister linecard notification
    - [arm64] net: dsa: felix: fix oversize frame dropping for always closed
      tc-taprio gates
    - sock: annotate data-races around prot->memory_pressure
    - dccp: annotate data-races in dccp_poll()
    - ipvlan: Fix a reference count leak warning in ipvlan_ns_exit()
    - mlxsw: pci: Set time stamp fields also when its type is MIRROR_UTC
    - mlxsw: reg: Fix SSPR register layout
    - mlxsw: Fix the size of 'VIRT_ROUTER_MSB'
    - [arm64] net: mdio: mdio-bitbang: Fix C45 read/write protocol
    - net: bgmac: Fix return value check for fixed_phy_register()
    - net: bcmgenet: Fix return value check for fixed_phy_register()
    - net: validate veth and vxcan peer ifindexes
    - ipv4: fix data-races around inet->inet_id
    - ice: fix receive buffer size miscalculation
    - Revert "ice: Fix ice VF reset during iavf initialization"
    - ice: Fix NULL pointer deref during VF reset
    - tg3: Use slab_build_skb() when needed
    - net: ethernet: mtk_eth_soc: fix NULL pointer on hw reset
    - can: isotp: fix support for transmission of SF without flow control
    - igb: Avoid starting unnecessary workqueues
    - igc: Fix the typo in the PTM Control macro
    - net/sched: fix a qdisc modification with ambiguous command request
    - i40e: fix potential NULL pointer dereferencing of pf->vf
      i40e_sync_vsi_filters()
    - netfilter: nf_tables: validate all pending tables
    - netfilter: nf_tables: flush pending destroy work before netlink notifier
    - netfilter: nf_tables: GC transaction race with abort path
    - netfilter: nf_tables: use correct lock to protect gc_list
    - netfilter: nf_tables: fix out of memory error handling
    - netfilter: nf_tables: defer gc run if previous batch is still pending
    - rtnetlink: Reject negative ifindexes in RTM_NEWLINK
    - bonding: fix macvlan over alb bond support
    - [x86] ASoC: amd: yc: Add VivoBook Pro 15 to quirks list for acp6x
    - [x86] ASoC: cs35l41: Correct amp_gain_tlv values
    - ibmveth: Use dcbf rather than dcbfl
    - wifi: mac80211: limit reorder_buf_filtered to avoid UBSAN warning
    - [x86] platform/x86: lenovo-ymc: Add Lenovo Yoga 7 14ACN6 to
      ec_trigger_quirk_dmi_table
    - [x86] platform/x86: ideapad-laptop: Add support for new hotkeys found on
      ThinkBook 14s Yoga ITL
    - NFSv4: Fix dropped lock for racing OPEN and delegation return
    - clk: Fix slab-out-of-bounds error in devm_clk_release()
    - mm,ima,kexec,of: use memblock_free_late from ima_free_kexec_buffer
    - shmem: fix smaps BUG sleeping while atomic
    - ALSA: ymfpci: Fix the missing snd_card_free() call at probe error
    - mm: enable page walking API to lock vmas during the walk
    - mm/gup: reintroduce FOLL_NUMA as FOLL_HONOR_NUMA_FAULT
    - mm/gup: handle cont-PTE hugetlb pages correctly in gup_must_unshare() via
      GUP-fast
    - drm/vmwgfx: Fix shader stage validation
    - drm/vmwgfx: Fix possible invalid drm gem put calls
    - drm: Add an HPD poll helper to reschedule the poll work
    - drm/panfrost: Skip speed binning on EOPNOTSUPP
    - [x86] drm/i915/dgfx: Enable d3cold at s2idle
    - drm/display/dp: Fix the DP DSC Receiver cap size
    - [x86] drm/i915: Fix HPD polling, reenabling the output poll work as needed
    - [x86] fpu: Invalidate FPU state correctly on exec()
    - [x86] fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4
      (Closes: #1050622)
    - [x86] drm/i915/display: Handle GMD_ID identification in display code
    - [x86] drm/i915: fix display probe for IVB Q and IVB D GT2 server
    - cgroup/cpuset: Rename functions dealing with DEADLINE accounting
    - sched/cpuset: Bring back cpuset_mutex
    - sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets
    - cgroup/cpuset: Iterate only if DEADLINE tasks are present
    - sched/deadline: Create DL BW alloc, free & check overflow interface
    - cgroup/cpuset: Free DL BW in case can_attach() fails
    - mm: add a call to flush_cache_vmap() in vmap_pfn()
    - mm: memory-failure: fix unexpected return value in soft_offline_page()
    - mm: multi-gen LRU: don't spin during memcg release
    - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
    - NFS: Fix a use after free in nfs_direct_join_group()
    - nfsd: Fix race to FREE_STATEID and cl_revoked
    - selinux: set next pointer before attaching to list
    - batman-adv: Trigger events for auto adjusted MTU
    - batman-adv: Don't increase MTU when set by user
    - batman-adv: Do not get eth header before batadv_check_management_packet
    - batman-adv: Fix TT global entry leak when client roamed back
    - batman-adv: Fix batadv_v_ogm_aggr_send memory leak
    - batman-adv: Hold rtnl lock during MTU update via netlink
    - ACPI: resource: Fix IRQ override quirk for PCSpecialist Elimina Pro 16 M
    - [riscv64] Handle zicsr/zifencei issue between gcc and binutils
    - [riscv64] Fix build errors using binutils2.37 toolchains
    - of: dynamic: Refactor action prints to not use "%pOF" inside devtree_lock
    - pinctrl: amd: Mask wake bits on probe again
    - media: vcodec: Fix potential array out-of-bounds in encoder queue_setup
    - PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for
      non-root bus
    - [x86] thunderbolt: Fix Thunderbolt 3 display flickering issue on 2nd hot
      plug onwards
    - can: raw: add missing refcount for memory leak fix
    - [x86] drm/i915: Fix error handling if driver creation fails during probe
    - madvise:madvise_cold_or_pageout_pte_range(): don't use mapcount() against
      large folio for sharing check
    - madvise:madvise_free_pte_range(): don't use mapcount() against large folio
      for sharing check
    - scsi: snic: Fix double free in snic_tgt_create()
    - scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5
    - scsi: core: raid_class: Remove raid_component_add()
    - clk: Fix undefined reference to `clk_rate_exclusive_{get,put}'
    - [x86] ASoC: SOF: ipc4-pcm: fix possible null pointer deference
    - dma-buf/sw_sync: Avoid recursive lock during fence signal
    - gpio: sim: dispose of irq mappings before destroying the irq_sim domain
    - gpio: sim: pass the GPIO device's software node to irq domain
    - [x86] ASoC: amd: yc: Fix a non-functional mic on Lenovo 82SJ
    - maple_tree: disable mas_wr_append() when other readers are possible
    - TIOCSTI: Document CAP_SYS_ADMIN behaviour in Kconfig
    - netfilter: nf_tables: fix kdoc warnings after gc rework

  [ Salvatore Bonaccorso ]
  * Bump ABI to 4

  [ Emanuele Rocca ]
  * [arm64] Enable support for Renesas RZ/G2L-SMARC. Set ARCH_R9A07G044 for SoC
    support and enable RESET_RZG2L_USBPHY_CTRL as module for USB2.
    (Closes: #1049346)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 31 Aug 2023 22:24:51 +0200

linux (6.4.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.5
    - security/integrity: fix pointer to ESL data and its size on pseries
    - HID: input: fix mapping for camera access keys
    - [amd64] HID: amd_sfh: Rename the float32 variable
    - [amd64] HID: amd_sfh: Fix for shift-out-of-bounds
    - net: lan743x: Don't sleep in atomic context
    - net: lan743x: select FIXED_PHY
    - ksmbd: add missing compound request handing in some commands
    - ksmbd: fix out of bounds read in smb2_sess_setup
    - drm/panel: simple: Add connector_type for innolux_at043tn24
    - drm: bridge: dw_hdmi: fix connector access for scdc
    - drm/bridge: ti-sn65dsi86: Fix auxiliary bus lifetime
    - swiotlb: always set the number of areas before allocating the pool
    - swiotlb: reduce the number of areas to match actual memory pool size
    - drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags
    - xen/virtio: Fix NULL deref when a bridge of PCI root bus has no parent
    - netfilter: nf_tables: report use refcount overflow
    - netfilter: conntrack: don't fold port numbers into addresses before
      hashing
    - ice: Fix max_rate check while configuring TX rate limits
    - ice: Fix tx queue rate limit when TCs are configured
    - igc: Add condition for qbv_config_change_errors counter
    - igc: Remove delay during TX ring configuration
    - igc: Add igc_xdp_buff wrapper for xdp_buff in driver
    - igc: Add XDP hints kfuncs for RX hash
    - igc: Fix TX Hang issue when QBV Gate is closed
    - net/mlx5e: fix double free in mlx5e_destroy_flow_table
    - net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create
    - net/mlx5e: fix memory leak in mlx5e_ptp_open
    - net/mlx5e: RX, Fix flush and close release flow of regular rq for legacy
      rq
    - net/mlx5: Register a unique thermal zone per device
    - net/mlx5e: Check for NOT_READY flag state after locking
    - net/mlx5e: TC, CT: Offload ct clear only once
    - net/mlx5: Query hca_cap_2 only when supported
    - net/mlx5e: RX, Fix page_pool page fragment tracking for XDP
    - igc: set TP bit in 'supported' and 'advertising' fields of
      ethtool_link_ksettings
    - igc: Include the length/type field and VLAN tag in queueMaxSDU
    - igc: Handle PPS start time programming for past time values
    - blk-crypto: use dynamic lock class for blk_crypto_profile::lock
    - scsi: qla2xxx: Fix error code in qla2x00_start_sp()
    - scsi: ufs: ufs-mediatek: Add dependency for RESET_CONTROLLER
    - bpf: Fix max stack depth check for async callbacks
    - net: mvneta: fix txq_map in case of txq_number==1
    - [arm64] net: dsa: felix: make vsc9959_tas_guard_bands_update() visible to
      ocelot->ops
    - [arm64] net: mscc: ocelot: fix oversize frame dropping for preemptible TCs
    - gve: Set default duplex configuration to full
    - drm/fbdev-dma: Fix documented default preferred_bpp value
    - octeontx2-af: Promisc enable/disable through mbox
    - octeontx2-af: Move validation of ptp pointer before its usage
    - ionic: remove WARN_ON to prevent panic_on_warn
    - udp6: add a missing call into udp_fail_queue_rcv_skb tracepoint
    - net: bgmac: postpone turning IRQs off to avoid SoC hangs
    - net: prevent skb corruption on frag list segmentation
    - [s390x] ism: Fix locking for forwarding of IRQs and events to clients
    - [s390x] ism: Fix and simplify add()/remove() callback handling
    - [s390x] ism: Do not unregister clients with registered DMBs
    - icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
    - udp6: fix udp6_ehashfn() typo
    - ntb: idt: Fix error handling in idt_pci_driver_init()
    - NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
    - ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
    - ipv6/addrconf: fix a potential refcount underflow for idev
    - HID: hyperv: avoid struct memcpy overrun warning
    - [x86] platform/x86: wmi: Break possible infinite loop when parsing GUID
    - net/sched: taprio: replace tc_taprio_qopt_offload :: enable with a "cmd"
      enum
    - igc: Rename qbv_enable to taprio_offload_enable
    - igc: Do not enable taprio offload for invalid arguments
    - igc: Handle already enabled taprio offload for basetime 0
    - kernel/trace: Fix cleanup logic of enable_trace_eprobe
    - fprobe: add unlock to match a succeeded ftrace_test_recursion_trylock
    - igc: No strict mode in pure launchtime/CBS offload
    - igc: Fix launchtime before start of cycle
    - igc: Fix inserting of empty frame for launchtime
    - nvme: fix the NVME_ID_NS_NVM_STS_MASK definition
    - [riscv64] bpf: Fix inconsistent JIT image generation
    - net: fec: remove useless fec_enet_reset_skb()
    - net: fec: remove last_bdp from fec_enet_txq_xmit_frame()
    - net: fec: recycle pages for transmitted XDP frames
    - net: fec: increase the size of tx ring and update tx_wake_threshold
    - [x86] drm/i915: Don't preserve dpll_hw_state for slave crtc in Bigjoiner
    - [x86] drm/i915: Fix one wrong caching mode enum usage
    - net: dsa: Removed unneeded of_node_put in felix_parse_ports_node
    - octeontx2-pf: Add additional check for MCAM rules
    - erofs: avoid useless loops in z_erofs_pcluster_readmore() when reading
      beyond EOF
    - erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond
      EOF
    - erofs: fix fsdax unavailability for chunk-based regular files
    - wifi: airo: avoid uninitialized warning in airo_get_rate()
    - bpf: cpumap: Fix memory leak in cpu_map_update_elem
    - xdp: use trusted arguments in XDP hints kfuncs
    - net/sched: flower: Ensure both minimum and maximum ports are specified
    - drm/nouveau/disp: fix HDMI on gt215+
    - drm/nouveau/disp/g94: enable HDMI
    - netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write()
    - drm/nouveau/acr: Abort loading ACR if no firmware was found
    - drm/nouveau: bring back blit subchannel for pre nv50 GPUs
    - net/sched: make psched_mtu() RTNL-less safe
    - net: txgbe: fix eeprom calculation error
    - wifi: rtw89: debug: fix error code in rtw89_debug_priv_send_h2c_set()
    - net/sched: sch_qfq: reintroduce lmax bound check for MTU
    - nvme-pci: fix DMA direction of unmapping integrity data
    - smb: client: improve DFS mount check
    - cifs: fix session state check in smb2_find_smb_ses
    - smb: client: fix parsing of source mount option
    - drm/client: Send hotplug event after registering a client
    - f2fs: don't reset unchangable mount option in f2fs_remount()
    - f2fs: fix deadlock in i_xattr_sem and inode page lock
    - kbuild: make modules_install copy modules.builtin(.modinfo)
    - pinctrl: amd: Detect internal GPIO0 debounce handling
    - pinctrl: amd: Fix mistake in handling clearing pins at startup
    - pinctrl: amd: Detect and mask spurious interrupts
    - pinctrl: amd: Revert "pinctrl: amd: disable and mask interrupts on probe"
    - pinctrl: amd: Only use special debounce behavior for GPIO 0
    - pinctrl: amd: Use amd_pinconf_set() for all config options
    - pinctrl: amd: Drop pull up select configuration
    - pinctrl: amd: Unify debounce handling into amd_pinconf_set()
    - tpm: Do not remap from ACPI resources again for Pluton TPM
    - tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
    - tpm: tpm_tis: Disable interrupts *only* for AEON UPX-i11
    - tpm: tis_i2c: Limit read bursts to I2C_SMBUS_BLOCK_MAX (32) bytes
    - tpm/tpm_tis: Disable interrupts for Framework Laptop Intel 12th gen
      (Closes: #1042540)
    - tpm: tis_i2c: Limit write bursts to I2C_SMBUS_BLOCK_MAX (32) bytes
    - tpm: return false from tpm_amd_is_rng_defective on non-x86 platforms
    - tpm/tpm_tis: Disable interrupts for Framework Laptop Intel 13th gen
      (Closes: #1042540)
    - tpm,tpm_tis: Disable interrupts after 1000 unhandled IRQs
    - tpm/tpm_tis: Disable interrupts for Lenovo L590 devices
    - net: bcmgenet: Ensure MDIO unregistration has clocks enabled
    - net: phy: dp83td510: fix kernel stall during netboot in DP83TD510E PHY
      driver
    - tracing/user_events: Fix incorrect return value for writing operation when
      events are disabled
    - misc: fastrpc: Create fastrpc scalar with correct buffer count
    - [powerpc*] security: Fix Speculation_Store_Bypass reporting on Power10
    - [powerpc*] 64s: Fix native_hpte_remove() to be irq-safe
    - drm/amd/display: perform a bounds check before filling dirty rectangles
    - [mips*] cpu-features: Use boot_cpu_type for CPU type based features
    - [mips*] Loongson: Fix cpu_probe_loongson() again
    - [mips*] Loongson: Fix build error when make modules_install
    - [mips*] KVM: Fix NULL pointer dereference
    - ext4: Fix reusing stale buffer heads from last failed mounting
    - ext4: fix wrong unit use in ext4_mb_clear_bb
    - ext4: get block from bh in ext4_free_blocks for fast commit replay
    - ext4: fix wrong unit use in ext4_mb_new_blocks
    - ext4: avoid updating the superblock on a r/o mount if not needed
    - ext4: fix to check return value of freeze_bdev() in ext4_shutdown()
    - ext4: turn quotas off if mount failed after enabling quotas
    - ext4: only update i_reserved_data_blocks on successful block allocation
    - fs: dlm: revert check required context while close
    - mm/mmap: Fix error return in do_vmi_align_munmap()
    - soc: qcom: mdt_loader: Fix unconditional call to scm_pas_mem_setup
    - jfs: jfs_dmap: Validate db_l2nbperpage while mounting
    - [arm64] dts: mt7986: use size of reserved partition for bl2
    - [arm64] dts: ti: k3-j721s2: Fix wkup pinmux range
    - hwrng: imx-rngc - fix the timeout for init and self check
    - dm integrity: reduce vmalloc space footprint on 32-bit architectures
    - scsi: mpi3mr: Propagate sense data for admin queue SCSI I/O
    - [s390x] zcrypt: do not retry administrative requests
    - PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold
    - PCI: Release resource invalidated by coalescing
    - PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
    - PCI: qcom: Disable write access to read only registers for IP v2.3.3
    - PCI: rockchip: Assert PCI Configuration Enable bit after probe
    - PCI: rockchip: Write PCI Device ID to correct register
    - PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked
    - PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core
    - PCI: rockchip: Use u32 variable to access 32-bit registers
    - PCI: rockchip: Set address alignment for endpoint mode
    - misc: pci_endpoint_test: Free IRQs before removing the device
    - misc: pci_endpoint_test: Re-init completion for every test
    - mfd: pm8008: Fix module autoloading
    - md/raid0: add discard support for the 'original' layout
    - fs: dlm: return positive pid value for F_GETLK
    - fs: dlm: fix cleanup pending ops when interrupted
    - fs: dlm: interrupt posix locks only when process is killed
    - fs: dlm: make F_SETLK use unkillable wait_event
    - fs: dlm: fix mismatch of plock results from userspace
    - fs: dlm: clear pending bit when queue was empty
    - fs: dlm: fix missing pending to false
    - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by
      lpfc_nlp_not_used()
    - drm/atomic: Allow vblank-enabled + self-refresh "disable"
    - drm/rockchip: vop: Leave vblank enabled in self-refresh
    - drm/dp_mst: Clear MSG_RDY flag before sending new message
    - drm/amd/display: Limit DCN32 8 channel or less parts to DPM1 for FPO
    - drm/amd/display: Fix in secure display context creation
    - drm/amd/display: fix seamless odm transitions
    - drm/amd/display: edp do not add non-edid timings
    - drm/amd/display: Remove Phantom Pipe Check When Calculating K1 and K2
    - drm/amd/display: disable seamless boot if force_odm_combine is enabled
    - drm/amdgpu: fix clearing mappings for BOs that are always valid in VM
    - drm/amd: Disable PSR-SU on Parade 0803 TCON
    - drm/amd/display: add a NULL pointer check
    - drm/amd/display: Fix 128b132b link loss handling
    - drm/amd/display: Correct `DMUB_FW_VERSION` macro
    - drm/amd/display: Add monitor specific edid quirk
    - drm/amdgpu: avoid restore process run into dead loop.
    - drm/amd/pm: fix smu i2c data read risk
    - drm/ttm: Don't leak a resource on eviction error
    - drm/ttm: Don't leak a resource on swapout move error
    - serial: atmel: don't enable IRQs prematurely
    - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in
      case of error
    - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk()
      when iterating clk
    - tty: serial: imx: fix rs485 rx after tx
    - tty: fix hang on tty device with no_room set
    - firmware: stratix10-svc: Fix a potential resource leak in
      svc_create_memory_pool()
    - libceph: harden msgr2.1 frame segment length checks
    - ceph: add a dedicated private data for netfs rreq
    - ceph: fix blindly expanding the readahead windows
    - ceph: don't let check_caps skip sending responses for revoke msgs
    - nfp: clean mc addresses in application firmware when closing port
    - [arm64] errata: Mitigate Ampere1 erratum AC03_CPU_38 at stage-2
    - xhci: Fix resume issue of some ZHAOXIN hosts
    - xhci: Fix TRB prefetch issue of ZHAOXIN hosts
    - xhci: Show ZHAOXIN xHCI root hub speed correctly
    - meson saradc: fix clock divider mask length
    - opp: Fix use-after-free in lazy_opp_tables after probe deferral
    - soundwire: qcom: fix storing port config out-of-bounds
    - media: uapi: Fix [GS]_ROUTING ACTIVE flag value
    - Revert "8250: add support for ASIX devices with a FIFO bug"
    - bus: ixp4xx: fix IXP4XX_EXP_T1_MASK
    - [s390x] decompressor: fix misaligned symbol build error
    - dm: verity-loadpin: Add NULL pointer check for 'bdev' parameter
    - tracing/histograms: Add histograms to hist_vars if they have referenced
      variables
    - tracing: Fix memory leak of iter->temp when reading trace_pipe
    - nvme: don't reject probe due to duplicate IDs for single-ported PCIe
      devices
    - [riscv64] perf: RISC-V: Remove PERF_HES_STOPPED flag checking in
      riscv_pmu_start()
    - regmap-irq: Fix out-of-bounds access when allocating config buffers
    - net: ena: fix shift-out-of-bounds in exponential backoff
    - ring-buffer: Fix deadloop issue on reading trace_pipe
    - ftrace: Fix possible warning on checking all pages used in
      ftrace_process_locs()
    - drm/amd/pm: share the code around SMU13 pcie parameters update
    - drm/amd/pm: conditionally disable pcie lane/speed switching for SMU13
    - cifs: if deferred close is disabled then close files immediately
    - [x86] perf/x86: Fix lockdep warning in for_each_sibling_event() on SPR
    - PM: QoS: Restore support for default value on frequency QoS
    - [arm64] pwm: meson: modify and simplify calculation in meson_pwm_get_state
    - [arm64] pwm: meson: fix handling of period/duty if greater than UINT_MAX
    - fprobe: Release rethook after the ftrace_ops is unregistered
    - fprobe: Ensure running fprobe_exit_handler() finished before calling
      rethook_free()
    - tracing: Fix null pointer dereference in tracing_err_log_open()
    - mptcp: do not rely on implicit state check in mptcp_listen()
    - mptcp: ensure subflow is unhashed before cleaning the backlog
    - smb: client: Fix -Wstringop-overflow issues
    - tracing/probes: Fix to avoid double count of the string length on the
      array
    - tracing/probes: Fix not to count error code to total length
    - tracing/probes: Fix to update dynamic data counter if fetcharg uses it
    - Revert "tracing: Add "(fault)" name injection to kernel probes"
    - tracing/probes: Fix to record 0-length data_loc in fetch_store_string*()
      if fails
    - tracing/user_events: Fix struct arg size match check
    - scsi: qla2xxx: Multi-que support for TMF
    - scsi: qla2xxx: Fix task management cmd failure
    - scsi: qla2xxx: Fix task management cmd fail due to unavailable resource
    - scsi: qla2xxx: Fix hang in task management
    - scsi: qla2xxx: Wait for io return on terminate rport
    - scsi: qla2xxx: Fix mem access after free
    - scsi: qla2xxx: Array index may go out of bound
    - scsi: qla2xxx: Avoid fcport pointer dereference
    - scsi: qla2xxx: Fix buffer overrun
    - scsi: qla2xxx: Fix potential NULL pointer dereference
    - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
    - scsi: qla2xxx: Correct the index of array
    - scsi: qla2xxx: Pointer may be dereferenced
    - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
    - scsi: qla2xxx: Fix end of loop test
    - net: dsa: ocelot: unlock on error in vsc9959_qos_port_tas_set()
    - [mips*] kvm: Fix build error with KVM_MIPS_DEBUG_COP0_COUNTERS enabled
    - Revert "drm/amd: Disable PSR-SU on Parade 0803 TCON"
    - drm/atomic: Fix potential use-after-free in nonblocking commits
    - net/ncsi: make one oem_gma function for all mfr id
    - net/ncsi: change from ndo_set_mac_address to dev_set_mac_address
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.6
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.7
    - io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
    - io_uring: Fix io_uring mmap() by using architecture-provided
      get_unmapped_area()
    - ALSA: hda/realtek - remove 3k pull low procedure
    - ALSA: hda/realtek: Add quirk for Clevo NS70AU
    - ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx
    - maple_tree: set the node limit when creating a new root node
    - mm/mlock: fix vma iterator conversion of apply_vma_lock_flags()
    - maple_tree: fix node allocation testing on 32 bit
    - keys: Fix linking a duplicate key to a keyring's assoc_array
    - prctl: move PR_GET_AUXV out of PR_MCE_KILL
    - perf probe: Add test for regression introduced by switch to
      die_get_decl_file()
    - perf probe: Read DWARF files from the correct CU
    - btrfs: fix iput() on error pointer after error during orphan cleanup
    - btrfs: fix warning when putting transaction with qgroups enabled after
      abort
    - fuse: revalidate: don't invalidate if interrupted
    - fuse: add feature flag for expire-only
    - fuse: Apply flags2 only when userspace set the FUSE_INIT_EXT
    - btrfs: raid56: always verify the P/Q contents for scrub
    - btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand
    - btrfs: fix double iput() on inode after an error during orphan cleanup
    - btrfs: zoned: fix memory leak after finding block group with super blocks
    - fuse: ioctl: translate ENOSYS in outarg
    - btrfs: fix race between balance and cancel/pause
    - regmap: Drop initial version of maximum transfer length fixes
    - [s390x] zcrypt: fix reply buffer calculations for CCA replies
    - of: Preserve "of-display" device name for compatibility
    - regmap: Account for register length in SMBus I/O limits
    - [ia64] mmap: Consider pgoff when searching for free mapping
    - [arm64] fpsimd: Ensure SME storage is allocated after SVE VL changes
    - can: mcp251xfd: __mcp251xfd_chip_set_mode(): increase poll timeout
    - can: bcm: Fix UAF in bcm_proc_show()
    - can: gs_usb: gs_can_open(): improve error handling
    - can: gs_usb: fix time stamp counter initialization
    - Revert "r8169: disable ASPM during NAPI poll"
    - dma-buf/dma-resv: Stop leaking on krealloc() failure
    - drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel
    - drm/amdgpu/pm: make gfxclock consistent for sienna cichlid
    - drm/amdgpu/pm: make mclk consistent for smu 13.0.7
    - drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts
    - drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP
    - drm/nouveau/i2c: fix number of aux event slots
    - drm/client: Fix memory leak in drm_client_target_cloned
    - drm/client: Fix memory leak in drm_client_modeset_probe
    - drm/amd/display: only accept async flips for fast updates
    - drm/amd/display: Disable MPC split by default on special asic
    - drm/amd/display: check TG is non-null before checking if enabled
    - drm/amd/display: Keep PHY active for DP displays on DCN31
    - [arm64] ASoC: fsl_sai: Disable bit clock with transmitter
    - [arm64] ASoC: fsl_sai: Revert "ASoC: fsl_sai: Enable MCTL_MCLK_EN bit for
      master mode"
    - ASoC: rt5640: Fix sleep in atomic context
    - ASoC: cs42l51: fix driver to properly autoload with automatic module
      loading
    - ASoC: codecs: wcd938x: fix missing clsh ctrl error handling
    - ASoC: cs35l45: Select REGMAP_IRQ
    - ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove
    - ASoC: qdsp6: audioreach: fix topology probe deferral
    - ASoC: tegra: Fix AMX byte map
    - ASoC: codecs: wcd938x: fix resource leaks on component remove
    - ASoC: codecs: wcd938x: fix missing mbhc init error handling
    - ASoC: codecs: wcd934x: fix resource leaks on component remove
    - ASoC: codecs: wcd938x: fix codec initialisation race
    - ASoC: codecs: wcd938x: fix soundwire initialisation race
    - [arm64] KVM: arm64: timers: Use CNTHCTL_EL2 when setting non-CNTKCTL_EL1
      bits
    - [arm64] KVM: arm64: Correctly handle page aging notifiers for unaligned
      memslot
    - [arm64] KVM: arm64: Disable preemption in kvm_arch_hardware_enable()
    - [arm64] KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t
      preemption
    - ext4: correct inline offset when handling xattrs in inode body
    - drm/radeon: Fix integer overflow in radeon_cs_parser_init
    - ALSA: emu10k1: roll up loops in DSP setup code for Audigy
    - quota: Properly disable quotas when add_dquot_ref() fails
    - quota: fix warning in dqgrab()
    - HID: add quirk for 03f0:464a HP Elite Presenter Mouse
    - ovl: check type and offset of struct vfsmount in ovl_entry
    - udf: Fix uninitialized array access for some pathnames
    - ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio
    - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
    - [mips*] dec: prom: Address -Warray-bounds warning
    - FS: JFS: Fix null-ptr-deref Read in txBegin
    - FS: JFS: Check for read-only mounted filesystem in txBegin
    - md: fix data corruption for raid456 when reshape restart while grow up
    - md/raid10: prevent soft lockup while flush writes
    - scsi: sg: fix blktrace debugfs entries leakage
    - blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none
    - posix-timers: Ensure timer ID search-loop limit is valid
    - btrfs: add xxhash to fast checksum implementations
    - btrfs: don't check PageError in __extent_writepage
    - btrfs: abort transaction at update_ref_for_cow() when ref count is zero
    - erofs: Fix detection of atomic context
    - [x86] ACPI: x86: Add skip i2c clients quirk for Nextbook Ares 8A
    - ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A
    - [x86] ACPI: x86: Add ACPI_QUIRK_UART1_SKIP for Lenovo Yoga Book yb1-x90f/l
    - ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3
    - ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e
      (3371 AMD version)
    - ACPI: resource: Remove "Zen" specific match and quirks
    - [arm64] set __exception_irq_entry with __irq_entry as a default
    - [arm64] mm: fix VA-range sanity check
    - ACPI: video: Add backlight=native DMI quirk for Dell Studio 1569
    - rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic()
    - rcu: Mark additional concurrent load from ->cpu_no_qs.b.exp
    - tools/nolibc: ensure stack protector guard is never zero
    - sched/fair: Don't balance task to its current running CPU
    - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel
      range
    - bpf: Print a warning only if writing to unprivileged_bpf_disabled.
    - bpf: Address KCSAN report on bpf_lru_list
    - spi: cadence-quadspi: Add compatible for AMD Pensando Elba SoC
    - bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
    - bpf: tcp: Avoid taking fast sock lock in iterator
    - wifi: rtw88: sdio: Check the HISR RX_REQUEST bit in rtw_sdio_rx_isr()
    - bpf: Silence a warning in btf_type_id_size()
    - devlink: make health report on unregistered instance warn just once
    - wifi: ath11k: add support default regdb while searching board-2.bin for
      WCN6855
    - wifi: mac80211_hwsim: Fix possible NULL dereference
    - spi: dw: Add compatible for Intel Mount Evans SoC
    - wifi: ath12k: Avoid NULL pointer access during management transmit cleanup
    - wifi: ath11k: fix memory leak in WMI firmware stats
    - wifi: iwlwifi: mvm: fix potential array out of bounds access
    - net: ethernet: litex: add support for 64 bit stats
    - devlink: report devlink_port_type_warn source device
    - wifi: iwlwifi: mvm: Add NULL check before dereferencing the pointer
    - wifi: wext-core: Fix -Wstringop-overflow warning in
      ioctl_standard_iw_point()
    - wifi: iwlwifi: Add support for new PCI Id
    - wifi: iwlwifi: mvm: avoid baid size integer overflow
    - wifi: iwlwifi: pcie: add device id 51F1 for killer 1675
    - igb: Fix igb_down hung on surprise removal
    - [arm64] net: hns3: fix strncpy() not using dest-buf length as length issue
    - ASoC: codecs: wcd938x: fix mbhc impedance loglevel
    - ASoC: codecs: wcd938x: fix dB range for HPHL and HPHR
    - ASoC: qcom: q6apm: do not close GPR port before closing graph
    - iov_iter: Mark copy_iovec_from_user() noclone
    - sched/fair: Use recent_used_cpu to test p->cpus_ptr
    - sched/psi: use kernfs polling functions for PSI trigger polling
    - spi: bcm63xx: fix max prepend length
    - fbdev: imxfb: warn about invalid left/right margin
    - fbdev: imxfb: Removed unneeded release_mem_region
    - perf build: Fix library not found error when using CSLIBS
    - btrfs: be a bit more careful when setting mirror_num_ret in
      btrfs_map_block
    - spi: s3c64xx: clear loopback bit after loopback test
    - kallsyms: strip LTO-only suffixes from promoted global functions
    - smb: client: fix missed ses refcounting
    - [arm64] Fix HFGxTR_EL2 field naming
    - [arm64] dsa: mv88e6xxx: Do a final check before timing out
    - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
    - bridge: Add extack warning when enabling STP in netns.
    - net: ethernet: mtk_eth_soc: handle probe deferral
    - gso: fix dodgy bit handling for GSO_UDP_L4
    - [amd64] iommu/sva: Fix signedness bug in iommu_sva_alloc_pasid()
    - cifs: fix mid leak during reconnection after timeout threshold
    - ice: Unregister netdev and devlink_port only once
    - ice: prevent NULL pointer deref during reload
    - ASoC: SOF: ipc3-dtrace: uninitialized data in
      dfsentry_trace_filter_write()
    - regulator: da9063: fix null pointer deref with partial DT config
    - net: sched: cls_matchall: Undo tcf_bind_filter in case of failure after
      mall_set_parms
    - net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
    - net: sched: cls_u32: Undo refcount decrement in case update failed
    - net: sched: cls_bpf: Undo tcf_bind_filter in case of an error
    - net: dsa: microchip: correct KSZ8795 static MAC table access
    - r8169: fix ASPM-related problem for chip version 42 and 43
    - [x86] drm/i915/perf: add sentinel to xehp_oa_b_counters
    - iavf: Fix use-after-free in free_netdev
    - iavf: Fix out-of-bounds when setting channels on remove
    - iavf: use internal state to free traffic IRQs
    - iavf: make functions static where possible
    - iavf: Wait for reset in callbacks which trigger it
    - iavf: fix a deadlock caused by rtnl and driver's lock circular
      dependencies
    - iavf: fix reset task race with iavf_remove()
    - security: keys: Modify mismatched function name
    - vrf: Fix lockdep splat in output path
    - octeontx2-pf: Dont allocate BPIDs for LBK interfaces
    - bpf: Fix subprog idx logic in check_max_stack_depth
    - bpf: Repeat check_max_stack_depth for async callbacks
    - bpf, arm64: Fix BTI type used for freplace attached functions
    - igc: Avoid transmit queue timeout for XDP
    - igc: Prevent garbled TX queue with XDP ZEROCOPY
    - net: ipv4: use consistent txhash in TIME_WAIT and SYN_RECV
    - tcp: annotate data-races around tcp_rsk(req)->txhash
    - tcp: annotate data-races around tcp_rsk(req)->ts_recent
    - net: ipv4: Use kfree_sensitive instead of kfree
    - net:ipv6: check return value of pskb_trim()
    - Revert "tcp: avoid the lookup process failing to get sk in ehash table"
    - net: ethernet: mtk_eth_soc: always mtk_get_ib1_pkt_type
    - fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
    - llc: Don't drop packet from non-root netns.
    - ALSA: hda/realtek: Fix generic fixup definition for cs35l41 amp
    - netfilter: nf_tables: fix spurious set element insertion failure
    - netfilter: nf_tables: can't schedule in nft_chain_validate
    - netfilter: nft_set_pipapo: fix improper element removal (CVE-2023-4004)
    - netfilter: nf_tables: skip bound chain in netns release path
    - netfilter: nf_tables: skip bound chain on rule flush
    - Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync
    - Bluetooth: hci_event: call disconnect callback before deleting conn
    - Bluetooth: ISO: fix iso_conn related locking and validity issues
    - Bluetooth: hci_sync: Avoid use-after-free in dbg for
      hci_remove_adv_monitor()
    - Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link
    - Bluetooth: SCO: fix sco_conn related locking and validity issues
    - Bluetooth: btusb: Fix bluetooth on Intel Macbook 2014
    - tcp: annotate data-races around tp->tcp_tx_delay
    - tcp: annotate data-races around tp->tsoffset
    - tcp: annotate data-races around tp->keepalive_time
    - tcp: annotate data-races around tp->keepalive_intvl
    - tcp: annotate data-races around tp->keepalive_probes
    - tcp: annotate data-races around icsk->icsk_syn_retries
    - tcp: annotate data-races around tp->linger2
    - tcp: annotate data-races around rskq_defer_accept
    - tcp: annotate data-races around tp->notsent_lowat
    - tcp: annotate data-races around icsk->icsk_user_timeout
    - tcp: annotate data-races around fastopenq.max_qlen
    - net: phy: prevent stale pointer dereference in phy_init()
    - jbd2: recheck chechpointing non-dirty buffer
    - tracing/histograms: Return an error if we fail to add histogram to
      hist_vars list
    - drm/ttm: fix bulk_move corruption when adding a entry
    - spi: dw: Remove misleading comment for Mount Evans SoC
    - scsi/sg: don't grab scsi host module reference
    - scsi: sg: Fix checking return value of blk_get_queue()
    - drm/amd/display: Clean up errors & warnings in amdgpu_dm.c
    - drm/amd/display: Add polling method to handle MST reply packet
    - Revert "drm/amd/display: edp do not add non-edid timings"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.8
    - [x86] platform/x86/amd/pmf: Notify OS power slider update
    - [x86] platform/x86/amd/pmf: reduce verbosity of apmf_get_system_params
    - drm/amd: Move helper for dynamic speed switch check out of smu13
    - drm/amd: Align SMU11 SMU_MSG_OverridePcieParameters implementation with
      SMU13
    - r8169: revert 2ab19de62d67 ("r8169: remove ASPM restrictions now that ASPM
      is disabled during NAPI poll")
    - jbd2: Fix wrongly judgement for buffer head removing while doing
      checkpoint
    - [arm64] KVM: arm64: Handle kvm_arm_init failure correctly in finalize_pkvm
    - blk-mq: Fix stall due to recursive flush plug
    - [powerpc*] pseries/vas: Hold mmap_mutex after mmap lock during window
      close
    - [s390x] KVM: s390: pv: simplify shutdown and fix race
    - [s390x] KVM: s390: pv: fix index value of replaced ASCE
    - [s390x] mm: fix per vma lock fault handling
    - io_uring: don't audit the capability check in io_uring_create()
    - gpio: tps68470: Make tps68470_gpio_output() always set the initial value
    - gpio: mvebu: Make use of devm_pwmchip_add
    - gpio: mvebu: fix irq domain leak
    - regmap: Disable locking for RBTREE and MAPLE unit tests
    - btrfs: factor out a btrfs_verify_page helper
    - btrfs: fix fsverify read error handling in end_page_read
    - btrfs: fix race between quota disable and relocation
    - i2c: Delete error messages for failed memory allocations
    - i2c: Improve size determinations
    - i2c: nomadik: Remove unnecessary goto label
    - i2c: nomadik: Use devm_clk_get_enabled()
    - i2c: nomadik: Remove a useless call in the remove function
    - PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
    - PCI/ASPM: Factor out pcie_wait_for_retrain()
    - PCI/ASPM: Avoid link retraining race
    - PCI: rockchip: Remove writes to unused registers
    - PCI: rockchip: Fix window mapping and address translation for endpoint
    - PCI: rockchip: Don't advertise MSI-X in PCIe capabilities
    - drm/amd/display: Convert Delaying Aux-I Disable To Monitor Patch
    - drm/amd/display: Keep disable aux-i delay as 0
    - drm/amd/display: add pixel rate based CRB allocation support
    - drm/amd/display: fix dcn315 single stream crb allocation
    - drm/amd/display: Update correct DCN314 register header
    - drm/amd/display: Set minimum requirement for using PSR-SU on Rembrandt
    - drm/amd/display: Set minimum requirement for using PSR-SU on Phoenix
    - drm/ttm: never consider pinned BOs for eviction&swap
    - maple_tree: add __init and __exit to test module
    - maple_tree: fix 32 bit mas_next testing
    - drm/amd/display: Add FAMS validation before trying to use it
    - drm/amd/display: update extended blank for dcn314 onwards
    - drm/amd/display: Fix possible underflow for displays with large vblank
    - drm/amd/display: Prevent vtotal from being set to 0
    - ext4: add EXT4_MB_HINT_GOAL_ONLY test in ext4_mb_use_preallocated
    - ext4: mballoc: Remove useless setting of ac_criteria
    - ext4: fix rbtree traversal bug in ext4_mb_use_preallocated
    - phy: phy-mtk-dp: Fix an error code in probe()
    - phy: mediatek: hdmi: mt8195: fix prediv bad upper limit test
    - phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend
    - phy: qcom-snps-femto-v2: properly enable ref clock
    - soundwire: qcom: update status correctly with mask
    - soundwire: amd: Fix a check for errors in probe()
    - media: tc358746: Address compiler warnings
    - media: staging: atomisp: select V4L2_FWNODE
    - media: amphion: Fix firmware path to match linux-firmware
    - media: mtk-jpeg: move data/code inside CONFIG_OF blocks
    - media: mtk_jpeg_core: avoid unused-variable warning
    - i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
    - iavf: fix potential deadlock on allocation failure
    - iavf: check for removal state before IAVF_FLAG_PF_COMMS_FAILED
    - net: phy: marvell10g: fix 88x3310 power up
    - [arm64] net: hns3: fix the imp capability bit cannot exceed 32 bits issue
    - [arm64] net: hns3: fix wrong tc bandwidth weight data issue
    - [arm64] net: hns3: fix wrong bw weight of disabled tc issue
    - vxlan: calculate correct header length for GPE
    - vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
    - vxlan: fix GRO with VXLAN-GPE
    - phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
    - atheros: fix return value check in atl1_tso()
    - ethernet: atheros: fix return value check in atl1e_tso_csum()
    - ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new
      temporary address
    - net: fec: avoid tx queue timeout when XDP is enabled
    - tcp: Reduce chance of collisions in inet6_hashfn(). (CVE-2023-1206)
    - ice: Fix memory management in ice_ethtool_fdir.c
    - bonding: reset bond's flags when down link is P2P device
    - team: reset team's flags when down link is P2P device
    - octeontx2-af: Fix hash extraction enable configuration
    - net: stmmac: Apply redundant write work around on 4.xx too
    - [x86] platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
    - [x86] traps: Fix load_unaligned_zeropad() handling for shared TDX memory
    - macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
    - igc: Fix Kernel Panic during ndo_tx_timeout callback
    - netfilter: nft_set_rbtree: fix overlap expiration walk
    - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
    - netfilter: nf_tables: disallow rule addition to bound chain via
      NFTA_RULE_CHAIN_ID (CVE-2023-4147)
    - mm: suppress mm fault logging if fatal signal already pending
    - tools: ynl-gen: fix enum index in _decode_enum(..)
    - net: fec: tx processing does not call XDP APIs if budget is 0
    - net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
    - benet: fix return value check in be_lancer_xmit_workarounds()
    - tipc: check return value of pskb_trim()
    - tipc: stop tipc crypto on failure in tipc_node_create
    - fs/9p: Fix a datatype used with V9FS_DIRECT_IO
    - RDMA/mlx4: Make check for invalid flags stricter
    - [arm64] drm/msm/mdss: correct UBWC programming for SM8550
    - [arm64] drm/msm/dpu: add missing flush and fetch bits for DMA4/DMA5 planes
    - [arm64] drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
    - [arm64] drm/msm/dsi: Drop unused regulators from QCM2290 14nm DSI PHY
      config
    - [arm64] drm/msm/adreno: Fix snapshot BINDLESS_DATA size
    - RDMA/irdma: Add missing read barriers
    - RDMA/irdma: Fix data race on CQP completion stats
    - RDMA/irdma: Fix data race on CQP request done
    - RDMA/core: Update CMA destination address on rdma_resolve_addr
    - RDMA/mthca: Fix crash when polling CQ for shared QPs
    - RDMA/bnxt_re: Prevent handling any completions after qp destroy
    - RDMA/bnxt_re: Enhance the existing functions that wait for FW responses
    - RDMA/bnxt_re: Avoid the command wait if firmware is inactive
    - RDMA/bnxt_re: use shadow qd while posting non blocking rcfw command
    - RDMA/bnxt_re: Simplify the function that sends the FW commands
    - RDMA/bnxt_re: add helper function __poll_for_resp
    - RDMA/bnxt_re: Fix hang during driver unload
    - [arm64] drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
    - [arm64] drm/msm: Fix hw_fence error path cleanup
    - cxl/acpi: Fix a use-after-free in cxl_parse_cfmws()
    - cxl/acpi: Return 'rc' instead of '0' in cxl_parse_cfmws()
    - [arm64] ASoC: fsl_spdif: Silence output on stop
    - block: Fix a source code comment in include/uapi/linux/blkzoned.h
    - smb3: do not set NTLMSSP_VERSION flag for negotiate not auth request
    - [x86] drm/i915: Fix an error handling path in igt_write_huge()
    - xenbus: check xen_domain in xenbus_probe_initcall
    - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
    - dm raid: clean up four equivalent goto tags in raid_ctr()
    - dm raid: protect md_stop() with 'reconfig_mutex'
    - drm/amd: Fix an error handling mistake in psp_sw_init()
    - drm/amd/display: Unlock on error path in
      dm_handle_mst_sideband_msg_ready_event()
    - RDMA/irdma: Fix op_type reporting in CQEs
    - RDMA/irdma: Report correct WC error
    - [arm64] drm/msm: Disallow submit with fence id 0
    - ublk: fail to start device if queue setup is interrupted
    - ublk: fail to recover device if queue setup is interrupted
    - ublk: return -EINTR if breaking from waiting for existed users in DEL_DEV
    - iommufd: IOMMUFD_DESTROY should not increase the refcount
    - tmpfs: fix Documentation of noswap and huge mount options
    - ata: pata_ns87415: mark ns87560_tf_read static
    - ring-buffer: Fix wrong stat of cpu_buffer->read
    - tracing: Fix warning in trace_buffered_event_disable()
    - Revert "usb: gadget: tegra-xudc: Fix error check in
      tegra_xudc_powerdomain_init()"
    - usb: gadget: call usb_gadget_check_config() to verify UDC capability
    - USB: gadget: Fix the memory leak in raw_gadget driver
    - usb: gadget: core: remove unbalanced mutex_unlock in usb_gadget_activate
    - KVM: Grab a reference to KVM for VM and vCPU stats file descriptors
    - [x86] KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest
    - [x86] KVM: x86: Disallow KVM_SET_SREGS{2} if incoming CR0 is invalid
    - serial: qcom-geni: drop bogus runtime pm state update
    - tty: serial: sh-sci: Fix sleeping in atomic context
    - serial: 8250_dw: Preserve original value of DLF register
    - USB: serial: option: support Quectel EM060K_128
    - USB: serial: option: add Quectel EC200A module support
    - USB: serial: simple: add Kaufmann RKS+CAN VCP
    - USB: serial: simple: sort driver entries
    - can: gs_usb: gs_can_close(): add missing set of CAN state to
      CAN_STATE_STOPPED
    - TIOCSTI: always enable for CAP_SYS_ADMIN (Closes: #1039092)
    - usb: typec: Set port->pd before adding device for typec_port
    - usb: typec: Iterate pds array when showing the pd list
    - usb: typec: Use sysfs_emit_at when concatenating the string
    - Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
    - usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
    - usb: dwc3: don't reset device side if dwc3 was configured as host-only
    - usb: misc: ehset: fix wrong if condition
    - usb: ohci-at91: Fix the unhandle interrupt when resume
    - USB: quirks: add quirk for Focusrite Scarlett
    - usb: cdns3: fix incorrect calculation of ep_buf_size when more than one
      config
    - usb: xhci-mtk: set the dma max_seg_size
    - Revert "usb: xhci: tegra: Fix error check"
    - Documentation: security-bugs.rst: update preferences when dealing with the
      linux-distros group
    - Documentation: security-bugs.rst: clarify CVE handling
    - staging: r8712: Fix memory leak in _r8712_init_xmit_priv()
    - staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
    - tty: n_gsm: fix UAF in gsm_cleanup_mux
    - Revert "xhci: add quirk for host controllers that don't update endpoint
      DCS"
    - ALSA: hda/realtek: Support ASUS G713PV laptop
    - ALSA: hda/relatek: Enable Mute LED on HP 250 G8
    - hwmon: (k10temp) Enable AMD3255 Proc to show negative temperature
    - hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
    - hwmon: (aquacomputer_d5next) Fix incorrect PWM value readout
    - hwmon: (pmbus_core) Fix pmbus_is_enabled()
    - hwmon: (pmbus_core) Fix NULL pointer dereference
    - hwmon: (pmbus_core) Fix Deadlock in pmbus_regulator_get_status
    - btrfs: zoned: do not enable async discard
    - btrfs: account block group tree when calculating global reserve size
    - btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
    - btrfs: check for commit error at btrfs_attach_transaction_barrier()
    - [x86] MCE/AMD: Decrement threshold_bank refcount when removing threshold
      blocks
    - [x86] cpu: Enable STIBP on AMD if Automatic IBRS is enabled
    - file: always lock position for FMODE_ATOMIC_POS
    - nfsd: Remove incorrect check in nfsd4_validate_stateid
    - ksmbd: check if a mount point is crossed during path lookup
    - ACPI/IORT: Remove erroneous id_count check in iort_node_get_rmr_info()
    - tpm_tis: Explicitly check for error code
    - irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
    - irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation
    - locking/rtmutex: Fix task->pi_waiters integrity
    - proc/vmcore: fix signedness bug in read_from_oldmem()
    - xen: speed up grant-table reclaim
    - virtio-net: fix race between set queues and probe
    - net: ipa: only reset hashed tables when supported
    - net: dsa: qca8k: enable use_single_write for qca8xxx
    - net: dsa: qca8k: fix search_and_insert wrong handling of new rule
    - net: dsa: qca8k: fix broken search_and_del
    - net: dsa: qca8k: fix mdb add/del case with 0 VID
    - iommufd: Set end correctly when doing batch carry
    - soundwire: fix enumeration completion
    - Revert "um: Use swap() to make code cleaner"
    - 9p: fix ignored return value in v9fs_dir_release
    - fs/9p: remove unnecessary and overrestrictive check
    - fs/9p: fix typo in comparison logic for cache mode
    - fs/9p: fix type mismatch in file cache mode helper
    - fs/9p: remove unnecessary invalidate_inode_pages2
    - [s390x] dasd: fix hanging device after quiesce/resume
    - [s390x] dasd: print copy pair message only for the correct error
    - mptcp: more accurate NL event generation
    - ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
    - [arm64] sme: Set new vector length before reallocating
    - PM: sleep: wakeirq: fix wake irq arming
    - thermal: of: fix double-free on unregistration
    - ceph: never send metrics if disable_send_metrics is set
    - [x86] drm/i915/dpt: Use shmem for dpt objects
    - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
    - rbd: make get_lock_owner_info() return a single locker or NULL
    - rbd: harden get_lock_owner_info() a bit
    - rbd: retrieve and check lock owner twice before blocklisting
    - mm: lock VMA in dup_anon_vma() before setting ->anon_vma
    - mm: fix memory ordering for mm_lock_seq and vm_lock_seq
    - mm/memory-failure: fix hardware poison check in unpoison_memory()
    - mm/mempolicy: Take VMA lock before replacing policy
    - dma-buf: keep the signaling time of merged fences v3
    - dma-buf: fix an error pointer vs NULL bug
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.9
    - xen/netback: Fix buffer overrun triggered by unusual packet
      (CVE-2023-34319)
    - [x86] fix backwards merge of GDS/SRSO bit
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.10
    - mm: lock_vma_under_rcu() must check vma->anon_vma under vma lock
    - [arm64] iommu/arm-smmu-v3: Work around MMU-600 erratum 1076982
    - [arm64] iommu/arm-smmu-v3: Document MMU-700 erratum 2812531
    - [arm64] iommu/arm-smmu-v3: Add explicit feature for nesting
    - [arm64] iommu/arm-smmu-v3: Document nesting-related errata
    - [arm64] dts: imx8mm-venice-gw7903: disable disp_blk_ctrl
    - [arm64] dts: imx8mm-venice-gw7904: disable disp_blk_ctrl
    - [arm64] dts: phycore-imx8mm: Label typo-fix of VPU
    - [arm64] dts: phycore-imx8mm: Correction in gpio-line-names
    - [arm64] dts: imx8mn-var-som: add missing pull-up for onboard PHY reset
      pinmux
    - [arm64] dts: freescale: Fix VPU G2 clock
    - [arm64] firmware: smccc: Fix use of uninitialised results structure
    - lib/bitmap: workaround const_eval test build failure
    - [arm64] soc: imx: imx8mp-blk-ctrl: register HSIO PLL clock as
      bus_power_dev child
    - [arm64] firmware: arm_scmi: Fix chan_free cleanup on SMC
    - word-at-a-time: use the same return type for has_zero regardless of
      endianness
    - [s390x] vmem: split pages when debug pagealloc is enabled
    - [s390x] KVM: s390: fix sthyi error handling
    - erofs: fix wrong primary bvec selection on deduplicated extents
    - [arm64] perf pmu arm64: Fix reading the PMU cpu slots in sysfs
    - wifi: cfg80211: Fix return value in scan logic
    - net/mlx5e: fix double free in macsec_fs_tx_create_crypto_table_groups
    - net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
    - net/mlx5: fix potential memory leak in mlx5e_init_rep_rx
    - net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
    - net/mlx5: Honor user input for migratable port fn attr
    - net/mlx5e: Don't hold encap tbl lock if there is no encap action
    - net/mlx5e: Fix crash moving to switchdev mode when ntuple offload is set
    - net/mlx5e: Move representor neigh cleanup to profile cleanup_tx
    - net/mlx5e: xsk: Fix invalid buffer access for legacy rq
    - net/mlx5e: xsk: Fix crash on regular rq reactivation
    - net/mlx5e: kTLS, Fix protection domain in use syndrome when devlink reload
    - net/mlx5: fs_chains: Fix ft prio if ignore_flow_level is not supported
    - net/mlx5: Unregister devlink params in case interface is down
    - bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing
    - rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length
    - net: sched: cls_u32: Fix match key mis-addressing
    - mISDN: hfcpci: Fix potential deadlock on &hc->lock
    - net: stmmac: tegra: Properly allocate clock bulk data
    - qed: Fix scheduling in a tasklet while getting stats
    - net: move gso declarations and functions to their own files
    - net: gro: fix misuse of CB in udp socket lookup
    - net: annotate data-races around sk->sk_reserved_mem
    - net: annotate data-race around sk->sk_txrehash
    - net: annotate data-races around sk->sk_max_pacing_rate
    - net: add missing READ_ONCE(sk->sk_rcvlowat) annotation
    - net: add missing READ_ONCE(sk->sk_sndbuf) annotation
    - net: add missing READ_ONCE(sk->sk_rcvbuf) annotation
    - net: annotate data-races around sk->sk_mark
    - net: add missing data-race annotations around sk->sk_peek_off
    - net: add missing data-race annotation for sk_ll_usec
    - net: annotate data-races around sk->sk_priority
    - net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX.
    - net: usb: lan78xx: reorder cleanup operations to avoid UAF bugs
    - ice: Fix RDMA VSI removal during queue rebuild
    - bnxt: don't handle XDP in netpoll
    - octeon_ep: initialize mbox mutexes
    - bpf: Move unprivileged checks into map_create() and bpf_prog_load()
    - bpf: Inline map creation logic in map_create() function
    - bpf: Centralize permissions checks for all BPF map types
    - bpf, cpumap: Make sure kthread is running before map update returns
    - bpf, cpumap: Handle skb as well when clean up ptr_ring
    - net/sched: cls_u32: No longer copy tcf_result on update to avoid
      use-after-free (CVE-2023-4128)
    - net/sched: cls_fw: No longer copy tcf_result on update to avoid
      use-after-free (CVE-2023-4128)
    - net/sched: cls_route: No longer copy tcf_result on update to avoid
      use-after-free (CVE-2023-4128)
    - bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire
    - net: ll_temac: fix error checking of irq_of_parse_and_map()
    - net: korina: handle clk prepare error in korina_probe()
    - net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode
    - bnxt_en: Fix page pool logic for page size >= 64K
    - bnxt_en: Fix max_mtu setting for multi-buf XDP
    - net: dcb: choose correct policy to parse DCB_ATTR_BCN
    - [s390x] qeth: Don't call dev_close/dev_open (DOWN/UP)
    - ip6mr: Fix skb_under_panic in ip6mr_cache_report()
    - vxlan: Fix nexthop hash size
    - net/mlx5: fs_core: Make find_closest_ft more generic
    - net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio
    - net/mlx5e: Set proper IPsec source port in L4 selector
    - prestera: fix fallback to previous version on same major version
    - tcp_metrics: fix addr_same() helper
    - tcp_metrics: annotate data-races around tm->tcpm_stamp
    - tcp_metrics: annotate data-races around tm->tcpm_lock
    - tcp_metrics: annotate data-races around tm->tcpm_vals[]
    - tcp_metrics: annotate data-races around tm->tcpm_net
    - tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
    - scsi: zfcp: Defer fc_rport blocking until after ADISC response
    - scsi: storvsc: Limit max_sectors for virtual Fibre Channel devices
    - Documentation: kdump: Add va_kernel_pa_offset for RISCV64
    - libceph: fix potential hang in ceph_osdc_notify()
    - USB: zaurus: Add ID for A-300/B-500/C-700
    - ceph: defer stopping mdsc delayed_work
    - [arm64] firmware: arm_scmi: Drop OF node reference in the transport
      channel setup
    - exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree
    - exfat: check if filename entries exceeds max filename length
      (CVE-2023-4273)
    - exfat: release s_lock before calling dir_emit()
    - mtd: spinand: toshiba: Fix ecc_get_status
    - mtd: spinand: winbond: Fix ecc_get_status
    - mtd: rawnand: meson: fix OOB available bytes for ECC
    - bpf: Disable preemption in bpf_perf_event_output
    - [arm64] dts: stratix10: fix incorrect I2C property for SCL signal
    - net: tun_chr_open(): set sk_uid from current_fsuid() (CVE-2023-4194)
    - net: tap_open(): set sk_uid from current_fsuid() (CVE-2023-4194)
    - wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC)
    - [x86] hyperv: Disable IBT when hypercall page lacks ENDBR instruction
    - rbd: prevent busy loop when requesting exclusive lock
    - bpf: Disable preemption in bpf_event_output
    - smb: client: fix dfs link mount against w2k8
    - [powerpc*] ftrace: Create a dummy stackframe to fix stack unwind
    - [arm64] fpsimd: Sync and zero pad FPSIMD state for streaming SVE
    - [arm64] fpsimd: Clear SME state in the target task when setting the VL
    - [arm64] fpsimd: Sync FPSIMD state with SVE for SME only systems
    - [arm64] ptrace: Flush FP state when setting ZT0
    - [arm64] ptrace: Don't enable SVE when setting streaming SVE
    - open: make RESOLVE_CACHED correctly test for O_TMPFILE
    - drm/ttm: check null pointer before accessing when swapping
    - [x86] drm/i915: Fix premature release of request's reusable memory
    - [x86] drm/i915/gt: Cleanup aux invalidation registers
    - Revert "page cache: fix page_cache_next/prev_miss off by one"
    - sunvnet: fix sparc64 build error after gso code split
    - clk: imx93: Propagate correct error in imx93_clocks_probe()
    - file: reinstate f_pos locking optimization for regular files
    - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()
    - fs/sysv: Null check to prevent null-ptr-deref bug
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
      (CVE-2023-40283)
    - debugobjects: Recheck debug_objects_enabled before reporting
    - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
    - fs: Protect reconfiguration of sb read-write from racing writes
    - mm/gup: do not return 0 from pin_user_pages_fast() for bad args
    - btrfs: remove BUG_ON()'s in add_new_free_space()
    - f2fs: fix to do sanity check on direct node in truncate_dnode()
    - io_uring: annotate offset timeout races
    - mtd: rawnand: omap_elm: Fix incorrect type in assignment
    - mtd: rawnand: rockchip: fix oobfree offset and description
    - mtd: rawnand: rockchip: Align hwecc vs. raw page helper layouts
    - clk: mediatek: mt8183: Add back SSPM related clocks
    - mtd: spi-nor: avoid holes in struct spi_mem_op
    - mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op()
    - [powerpc*] mm/altmap: Fix altmap boundary check
    - drm/imx/ipuv3: Fix front porch adjustment upon hactive aligning
    - drm/amdgpu: Use apt name for FW reserved region
    - [x86] drm/i915: Add the gen12_needs_ccs_aux_inv helper
    - [x86] drm/i915/gt: Ensure memory quiesced before invalidation
    - [x86] drm/i915/gt: Add workaround 14016712196
    - [x86] drm/i915/gt: Rename flags with bit_group_X according to the
      datasheet
    - [x86] drm/i915/gt: Poll aux invalidation register bit on invalidation
    - [x86] drm/i915/gt: Support aux invalidation on all engines
    - [x86] drm/i915/gt: Enable the CCS_FLUSH bit in the pipe control and in the
      CS
    - [x86] CPU/AMD: Do not leak quotient data after a division by 0
      (CVE-2023-20588)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.11
    - tpm/tpm_tis: Disable interrupts for TUXEDO InfinityBook S 15/17 Gen7
    - tpm: Disable RNG for all AMD fTPMs
    - tpm/tpm_tis: Disable interrupts for Lenovo P620 devices
    - tpm: Add a helper for checking hwrng enabled
    - ksmbd: validate command request size
    - ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
    - [x86] KVM: SEV: snapshot the GHCB before accessing it
    - [x86] KVM: SEV: only access GHCB fields once (CVE-2023-4155)
    - wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()
    - wifi: rtw89: fix 8852AE disconnection caused by RX full flags
    - wireguard: allowedips: expand maximum node depth
    - mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
    - ipv6: adjust ndisc_is_useropt() to also return true for PIO
    - mptcp: avoid bogus reset on fallback close
    - mptcp: fix disconnect vs accept race
    - dmaengine: pl330: Return DMA_PAUSED when transaction is paused
    - dmaengine: xilinx: xdma: Fix interrupt vector setting
    - net: mana: Fix MANA VF unload when hardware is unresponsive
    - ACPI: resource: revert "Remove "Zen" specific match and quirks"
    - ACPI: resource: Always use MADT override IRQ settings for all legacy non
      i8042 IRQs
    - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen
    - ACPI: resource: Add IRQ override quirk for PCSpecialist Elimina Pro 16 M
    - zram: take device and not only bvec offset into account
    - [riscv64] Start of DRAM should at least be aligned on PMD size for the
      direct mapping
    - [riscv64] kexec: load initrd high in available memory
    - [riscv64] mmio: Fix readX()-to-delay() ordering
    - [riscv64] kexec: handle R_RISCV_CALL_PLT relocation type
    - riscv: mm: fix 2 instances of -Wmissing-variable-declarations
    - nvme: fix possible hang when removing a controller during error recovery
    - nvme-tcp: fix potential unbalanced freeze & unfreeze
    - nvme-rdma: fix potential unbalanced freeze & unfreeze
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for Samsung PM9B1 256G and 512G
    - drm/nouveau/gr: enable memory loads on helper invocation on all channels
    - drm/nouveau/nvkm/dp: Add workaround to fix DP 1.3+ DPCD issues
    - drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
    - drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()
    - drm/amd/pm: correct the pcie width for smu 13.0.0
    - drm/amd/display: Fix a regression on Polaris cards
    - drm/amd/display: check attr flag before set cursor degamma on DCN3+
    - drm/amd: Disable S/G for APUs when 64GB or more host memory
    - tpm: tpm_tis: Fix UPX-i11 DMI_MATCH condition
    - tpm_tis: Opt-in interrupts
    - cpuidle: dt_idle_genpd: Add helper function to remove genpd topology
    - cpuidle: psci: Move enabling OSI mode after power domains creation
    - io_uring: correct check for O_TMPFILE
    - zsmalloc: fix races between modifications of fullness and isolated
    - hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100
    - cpufreq: amd-pstate: fix global sysfs attribute type
    - fs/proc/kcore: reinstate bounce buffer for KCORE_TEXT regions
    - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
    - accel/ivpu: Add set_pages_array_wc/uc for internal buffers
    - hugetlb: do not clear hugetlb dtor until allocating vmemmap
    - mm: memory-failure: fix potential unexpected return value from
      unpoison_memory()
    - mm: memory-failure: avoid false hwpoison page mapped error info
    - drm/amd/pm: expose swctf threshold setting for legacy powerplay
    - drm/amd/pm: avoid unintentional shutdown due to temperature momentary
      fluctuation
    - iio: cros_ec: Fix the allocation size for cros_ec_command
    - iio: frequency: admv1013: propagate errors from regulator_get_voltage()
    - iio: adc: ad7192: Fix ac excitation feature
    - iio: adc: meson: fix core clock enable/disable moment
    - iio: adc: ina2xx: avoid NULL pointer dereference on OF device match
    - [arm*] binder: fix memory leak in binder_init()
    - misc: rtsx: judge ASPM Mode to set PETXCFG Reg
    - [x86] thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request()
    - usb-storage: alauda: Fix uninit-value in alauda_check_media()
    - usb: dwc3: Properly handle processing of pending events
    - USB: Gadget: core: Help prevent panic during UVC unconfigure
    - usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
    - usb: typec: tcpm: Fix response to vsafe0V event
    - usb: typec: altmodes/displayport: Signal hpd when configuring pin
      assignment
    - [x86] srso: Fix build breakage with the LLVM linker
    - [x86] vdso: Choose the right GDT_ENTRY_CPUNODE for 32-bit getcpu() on
      64-bit kernel
    - [x86] cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
    - [x86] mm: Fix VDSO and VVAR placement on 5-level paging machines
    - [x86] sev: Do not try to parse for the CC blob on non-AMD hardware
    - [x86] linkage: Fix typo of BUILD_VDSO in asm/linkage.h
    - [x86] speculation: Add cpu_show_gds() prototype
    - [x86] Move gds_ucode_mitigated() declaration to header
    - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
    - netfilter: nf_tables: don't skip expired elements during walk
    - netfilter: nf_tables: GC transaction API to avoid race with control plane
    - netfilter: nf_tables: adapt set backend to use GC transaction API
    - netfilter: nft_set_hash: mark set element as dead when deleting from
      packet path
    - iio: imu: lsm6dsx: Fix mount matrix retrieval
    - iio: core: Prevent invalid memory access when there is no parent
    - iio: light: bu27034: Fix scale format
    - interconnect: qcom: Add support for mask-based BCMs
    - interconnect: qcom: sa8775p: add enable_mask for bcm nodes
    - interconnect: qcom: sm8450: add enable_mask for bcm nodes
    - interconnect: qcom: sm8550: add enable_mask for bcm nodes
    - [arm64] KVM: arm64: Fix hardware enable/disable flows for pKVM
    - net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail()
    - bpf, sockmap: Fix map type error in sock_map_del_link
    - bpf, sockmap: Fix bug that strp_done cannot be called
    - hwmon: (aquacomputer_d5next) Add selective 200ms delay after sending ctrl
      report
    - mISDN: Update parameter type of dsp_cmx_send()
    - macsec: use DEV_STATS_INC()
    - mptcp: fix the incorrect judgment for msk->cb_flags
    - igc: Add lock to safeguard global Qbv variables
    - ionic: Add missing err handling for queue reconfig
    - net/packet: annotate data-races around tp->status
    - net/smc: Fix setsockopt and sysctl to specify same buffer size again
    - net/smc: Use correct buffer sizes when switching between TCP and SMC
    - PCI: move OF status = "disabled" detection to dev->match_driver
    - tcp: add missing family to tcp_set_ca_state() tracepoint
    - tunnels: fix kasan splat when generating ipv4 pmtu error
    - xsk: fix refcount underflow in error path
    - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
    - dccp: fix data-race around dp->dccps_mss_cache
    - drivers: net: prevent tun_build_skb() to exceed the packet size limit
    - drivers: vxlan: vnifilter: free percpu vni stats on error path
    - iavf: fix potential races for FDIR filters
    - [amd64] IB/hfi1: Fix possible panic during hotplug remove
    - drm/amd/display: Don't show stack trace for missing eDP
    - drm/bridge: it6505: Check power state with it6505->powered in IRQ handler
    - drm/nouveau: remove unused tu102_gr_load() function
    - drm/rockchip: Don't spam logs in atomic check
    - wifi: brcm80211: handle params_v1 allocation failure
    - wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
    - RDMA/umem: Set iova in ODP flow
    - RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF
    - RDMA/bnxt_re: Fix error handling in probe failure path
    - net: tls: avoid discarding data on record close
    - net: marvell: prestera: fix handling IPv4 routes with nhid
    - net: phy: at803x: remove set/get wol callbacks for AR8032
    - net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on
      driver remove
    - [arm64] net: hns3: refactor hclge_mac_link_status_wait for interface reuse
    - [arm64] net: hns3: add wait until mac link down
    - [arm64] net: hns3: fix deadlock issue when externel_lb and reset are
      executed together
    - net: enetc: reimplement RFS/RSS memory clearing as PCI quirk
    - nexthop: Fix infinite nexthop dump when using maximum nexthop ID
    - nexthop: Make nexthop bucket dump more efficient
    - nexthop: Fix infinite nexthop bucket dump when using maximum nexthop ID
    - [arm64] net: hns3: fix strscpy causing content truncation issue
    - dmaengine: mcf-edma: Fix a potential un-allocated memory access
    - dmaengine: idxd: Clear PRS disable flag when disabling IDXD device
    - dmaengine: owl-dma: Modify mismatched function name
    - net/mlx5e: Take RTNL lock when needed before calling xdp_set_features()
    - net/mlx5e: TC, Fix internal port memory leak
    - net/mlx5: DR, Fix wrong allocation of modify hdr pattern
    - net/mlx5: Allow 0 for total host VFs
    - net/mlx5e: Unoffload post act rule when handling FIB events
    - net/mlx5: LAG, Check correct bucket when modifying LAG
    - net/mlx5: Skip clock update work when device is in error state
    - net/mlx5: Reload auxiliary devices in pci error handlers
    - ibmvnic: Enforce stronger sanity checks on login response
    - ibmvnic: Unmap DMA login rsp buffer on send login fail
    - ibmvnic: Handle DMA unmapping of login buffs in release functions
    - ibmvnic: Do partial reset on login failure
    - ibmvnic: Ensure login failure recovery is safe from other resets
    - gpio: ws16c48: Fix off-by-one error in WS16C48 resource region extent
    - gpio: sim: mark the GPIO chip as a one that can sleep
    - btrfs: wait for actual caching progress during allocation
    - btrfs: don't stop integrity writeback too early
    - btrfs: don't wait for writeback on clean pages in extent_write_cache_pages
    - btrfs: properly clear end of the unreserved range in cow_file_range
    - btrfs: exit gracefully if reloc roots don't match
    - btrfs: reject invalid reloc tree root keys with stack dump
    - btrfs: set cache_block_group_error if we find an error
    - scsi: core: Fix legacy /proc parsing buffer overflow
    - [x86] scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
    - scsi: ufs: renesas: Fix private allocation
    - scsi: 53c700: Check that command slot is not NULL
    - scsi: snic: Fix possible memory leak if device_add() fails
    - scsi: core: Fix possible memory leak if device_add() fails
    - scsi: fnic: Replace return codes in fnic_clean_pending_aborts()
    - scsi: qedi: Fix firmware halt over suspend and resume
    - scsi: qedf: Fix firmware halt over suspend and resume
    - [x86] platform/x86: lenovo-ymc: Only bind on machines with a convertible
      DMI chassis-type
    - platform: mellanox: Change register offset addresses
    - platform: mellanox: mlx-platform: Fix signals polarity and latch mask
    - platform: mellanox: mlx-platform: Modify graceful shutdown callback and
      power down mask
    - platform: mellanox: Fix order in exit flow
    - [x86] platform/x86: serial-multi-instantiate: Auto detect IRQ resource for
      CSC3551
    - ACPI: scan: Create platform device for CS35L56
    - [alpha] remove __init annotation from exported page_is_ram()

  [ Vincent Blut ]
  * [x86] drivers/platform/x86/intel/int3472: Enable INTEL_SKL_INT3472 as
    module (Closes: #1038385)

  [ Salvatore Bonaccorso ]
  * Bump ABI to 3
  * [rt] Drop "posix-timers: Ensure timer ID search-loop limit is valid"
    (applied upstream)
  * [rt] Update to 6.4.6-rt8
  * [rt] Drop "locking/rtmutex: Fix task->pi_waiters integrity" (applied
    upstream)
  * [x86] retpoline: Don't clobber RFLAGS during srso_safe_ret()
    (Closes: #1043585)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 17 Aug 2023 21:46:04 +0200

linux (6.4.4-3) unstable; urgency=high

  * io_uring: gate iowait schedule on having pending requests (Closes: #1041855)
  * [x86] Add mitigations for Gather Data Sampling (GDS) (CVE-2022-40982)
    - init: Provide arch_cpu_finalize_init()
    - x86/cpu: Switch to arch_cpu_finalize_init()
    - ARM: cpu: Switch to arch_cpu_finalize_init()
    - ia64/cpu: Switch to arch_cpu_finalize_init()
    - loongarch/cpu: Switch to arch_cpu_finalize_init()
    - m68k/cpu: Switch to arch_cpu_finalize_init()
    - mips/cpu: Switch to arch_cpu_finalize_init()
    - sh/cpu: Switch to arch_cpu_finalize_init()
    - sparc/cpu: Switch to arch_cpu_finalize_init()
    - um/cpu: Switch to arch_cpu_finalize_init()
    - init: Remove check_bugs() leftovers
    - init: Invoke arch_cpu_finalize_init() earlier
    - init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init()
    - x86/init: Initialize signal frame size late
    - x86/fpu: Remove cpuinfo argument from init functions
    - x86/fpu: Mark init functions __init
    - x86/fpu: Move FPU initialization into arch_cpu_finalize_init()
    - x86/speculation: Add Gather Data Sampling mitigation
    - x86/speculation: Add force option to GDS mitigation
    - x86/speculation: Add Kconfig option for GDS
    - KVM: Add GDS_NO support to KVM
    - x86/mem_encrypt: Unbreak the AMD_MEM_ENCRYPT=n build
    - x86/xen: Fix secondary processors' FPU initialization
    - Documentation/x86: Fix backwards on/off logic about YMM support
  * [x86] Add a Speculative RAS Overflow (SRSO) mitigation (CVE-2023-20569)
    - x86/bugs: Increase the x86 bugs vector size to two u32s
    - x86/srso: Add a Speculative RAS Overflow mitigation
    - x86/srso: Add IBPB_BRTYPE support
    - x86/srso: Add SRSO_NO support
    - x86/srso: Add IBPB
    - x86/srso: Add IBPB on VMEXIT
    - x86/srso: Fix return thunks in generated code
    - x86/srso: Add a forgotten NOENDBR annotation
    - x86/srso: Tie SBPB bit setting to microcode patch detection
  * Bump ABI to 2

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 08 Aug 2023 19:08:55 +0200

linux (6.4.4-2) unstable; urgency=high

  [ John Paul Adrian Glaubitz ]
  * [sh4] Add i2c-modules udeb for sh7785lcr flavor

  [ Salvatore Bonaccorso ]
  * [x86] cpu/amd: Move the errata checking functionality up
  * [x86] cpu/amd: Add a Zenbleed fix (CVE-2023-20593)
  * net/sched: cls_fw: Fix improper refcount update leads to use-after-free
    (CVE-2023-3776)
  * net/sched: sch_qfq: account for stab overhead in qfq_enqueue (CVE-2023-3611)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 30 Jul 2023 06:50:27 +0200

linux (6.4.4-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.2
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.3
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.4
    - Revert "drm/amd/display: edp do not add non-edid timings"
      (Closes: #1040346)
    - netfilter: nf_tables: do not ignore genmask when looking up chain by id
      (CVE-2023-31248)
    - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
      (CVE-2023-35001)

  [ Vincent Pelletier ]
  * [riscv64] enable CONFIG_SND_HDA_INTEL as module

  [ Salvatore Bonaccorso ]
  * Compile with gcc-13 on all architectures
  * [rt] Refresh "serial: 8250: implement non-BKL console"
  * Set ABI to 1

  [ Benjamin Poirier ]
  * kernel/trace: Enable FPROBE

  [ Ben Hutchings ]
  * d/rules.real: Fix CROSS_COMPILE definition for hppa native build
    (regression in 6.4~rc7-1~exp1)

  [ Bastian Blank ]
  * Include kbuild package into ABI. (closes: #1040178)
  * [powerpc,riscv64,s390x] Enable DEBUG_INFO_BTF.

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 23 Jul 2023 08:53:20 +0200

linux (6.4.1-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_6.4
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.1

  [ Aurelien Jarno ]
  * [riscv64] Enable devices added in 6.4 for StarFive JH7110 RISC-V SoC:
    SENSORS_SFCTEMP, MMC_DW, MMC_DW_STARFIVE and STARFIVE_WATCHDOG.

  [ Helge Deller ]
  * [hppa] Allow up to 16 CPUs with 32-bit kernel
  * [hppa] Build some more fbdev graphic card drivers as modules

  [ Uwe Kleine-König ]
  * Enable all RTW88 variants (USB + SDIO). (Closes: #1038409)

  [ Ben Hutchings ]
  * [rt] Update to 6.4-rt5

  [ Salvatore Bonaccorso ]
  * [rt] Update to 6.4-rt6
  * [x86] drivers/platform/x86/hp: Enable X86_PLATFORM_DRIVERS_HP
    (Closes: #1038799)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 01 Jul 2023 20:41:23 +0200

linux (6.4~rc7-1~exp1) experimental; urgency=medium

  * New upstream release candidate:
    - [hppa] Delete redundant register definitions in <asm/assembly.h> (fixes
      FTBFS)

  [ Salvatore Bonaccorso ]
  * mm: Enable Multi-Gen LRU implementation (by default) (Closes: #1030617)

  [ Ben Hutchings ]
  * linux-perf: Add libtraceevent-dev to Build-Depends (fixes FTBFS on several
    architectures)
  * linux-image: Define CROSS_COMPILE and CROSS_COMPILE_COMPAT more consistently
  * [hppa] linux-headers: Fix toolchain dependencies
  * [hppa] Make cross-builds work
  * [m68k] Fix invalid .section syntax (fixes FTBFS)

  [ Diederik de Haas ]
  * d/rules.real: Also remove executable bit from dtbo files

  [ Jiaxun Yang ]
  * [mips*]: Enable more drivers for boston
  * [mips*]: Install dtbs for mipsel and mips64el

 -- Ben Hutchings <benh@debian.org>  Mon, 19 Jun 2023 17:30:46 +0200

linux (6.4~rc6-1~exp1) experimental; urgency=medium

  * New upstream release candidate.

  [ Diederik de Haas ]
  * Update for 6.4:
    - d/copyright: Remove vs6624.c; removed upstream
  * [rt] Update to 6.4-rc5-rt4

  [ Ben Hutchings ]
  * linux-perf: Update build rules and dependencies for change to
    demangling
  * linux-perf: Build C++ code with Debian standard compiler flags

 -- Ben Hutchings <benh@debian.org>  Mon, 12 Jun 2023 13:35:43 +0200

linux (6.3.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.8
    - [x86] platform/surface: aggregator: Allow completion work-items to be
      executed in parallel
    - [x86] platform/surface: aggregator_tabletsw: Add support for book mode in
      KIP subsystem
    - [arm64] spi: qup: Request DMA before enabling clocks
    - afs: Fix setting of mtime when creating a file/dir/symlink
    - wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll
    - bpf, sockmap: Avoid potential NULL dereference in
      sk_psock_verdict_data_ready()
    - neighbour: fix unaligned access to pneigh_entry
    - net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294
    - bpf: Fix UAF in task local storage
    - bpf: Fix elem_size not being set for inner maps
    - net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down
    - net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT
    - [arm64] net: enetc: correct the statistics of rx bytes
    - [arm64] net: enetc: correct rx_bytes statistics of XDP
    - net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values
    - [x86] drm/i915: Explain the magic numbers for AUX SYNC/precharge length
    - [x86] drm/i915: Use 18 fast wake AUX sync len
    - Bluetooth: Split bt_iso_qos into dedicated structures
    - Bluetooth: ISO: consider right CIS when removing CIG at cleanup
    - Bluetooth: ISO: Fix CIG auto-allocation to select configurable CIG
    - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER
    - Bluetooth: Fix l2cap_disconnect_req deadlock
    - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left
    - Bluetooth: hci_conn: Add support for linking multiple hcon
    - Bluetooth: hci_conn: Fix not matching by CIS ID
    - Bluetooth: ISO: use correct CIS order in Set CIG Parameters event
    - Bluetooth: L2CAP: Add missing checks for invalid DCID
    - wifi: mac80211: use correct iftype HE cap
    - wifi: cfg80211: reject bad AP MLD address
    - wifi: mac80211: mlme: fix non-inheritence element
    - wifi: mac80211: don't translate beacon/presp addrs
    - qed/qede: Fix scheduling while atomic
    - wifi: cfg80211: fix locking in sched scan stop work
    - netfilter: nf_tables: Add null check for nla_nest_start_noflag() in
      nft_dump_basechain_hook()
    - netfilter: nft_bitwise: fix register tracking
    - netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper
    - netfilter: ipset: Add schedule point in call_ad().
    - netfilter: nf_tables: out-of-bound check in chain blob
    - [arm64,armhf] drm/lima: fix sched context destroy
    - ipv6: rpl: Fix Route of Death. (CVE-2023-2156)
    - tcp: gso: really support BIG TCP
    - rfs: annotate lockless accesses to sk->sk_rxhash
    - rfs: annotate lockless accesses to RFS sock flow table
    - net: sched: add rcu annotations around qdisc->qdisc_sleeping
    - ice: make writes to /dev/gnssX synchronous
    - net: sched: move rtm_tca_policy declaration to include file
    - net: openvswitch: fix upcall counter access before allocation
    - net: sched: act_police: fix sparse errors in tcf_police_dump()
    - net: sched: fix possible refcount leak in tc_chain_tmplt_add()
    - bpf: Add extra path pointer check to d_path helper
    - drm/amdgpu: fix Null pointer dereference error in
      amdgpu_device_recover_vram
    - lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
    - [arm64] net: bcmgenet: Fix EEE implementation
    - bnxt_en: Fix bnxt_hwrm_update_rss_hash_cfg()
    - bnxt_en: Don't issue AP reset during ethtool's reset operation
    - bnxt_en: Query default VLAN before VNIC setup on a VF
    - bnxt_en: Skip firmware fatal error recovery if chip is not accessible
    - bnxt_en: Prevent kernel panic when receiving unexpected PHC_UPDATE event
    - bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
    - [arm64] drm/msm/a6xx: initialize GMU mutex earlier
    - batman-adv: Broken sync while rescheduling delayed work
    - Input: xpad - delete a Razer DeathAdder mouse VID/PID entry
    - Input: psmouse - fix OOB access in Elantech protocol
    - Input: fix open count when closing inhibited device
    - ALSA: hda: Fix kctl->id initialization
    - ALSA: ymfpci: Fix kctl->id initialization
    - [i386] ALSA: gus: Fix kctl->id initialization
    - ALSA: cmipci: Fix kctl->id initialization
    - ALSA: hda/realtek: Add quirk for Clevo NS50AU
    - ALSA: ice1712,ice1724: fix the kcontrol->id initialization
    - ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01
    - ALSA: hda/realtek: Add Lenovo P3 Tower platform
    - ALSA: hda/realtek: Add quirks for Asus ROG 2024 laptops using CS35L41
    - [x86] drm/i915/gt: Use the correct error value when kernel_context() fails
    - drm/amd/pm: conditionally disable pcie lane switching for some
      sienna_cichlid SKUs
    - drm/amdgpu: fix xclk freq on CHIP_STONEY
    - drm/amdgpu: change reserved vram info print
    - drm/amd: Disallow s0ix without BIOS support again
    - drm/amd/pm: Fix power context allocation in SMU13
    - drm/amd/display: Reduce sdp bw after urgent to 90%
    - drm/amd/display: add ODM case when looking for first split pipe
    - wifi: iwlwifi: mvm: Fix -Warray-bounds bug in iwl_mvm_wait_d3_notif()
    - can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in
      J1939 Socket
    - can: j1939: change j1939_netdev_lock type to mutex
    - can: j1939: avoid possible use-after-free when j1939_can_rx_register fails
    - mptcp: only send RM_ADDR in nl_cmd_remove
    - mptcp: add address into userspace pm list
    - mptcp: update userspace pm infos
    - ceph: fix use-after-free bug for inodes when flushing capsnaps
    - [s390x] dasd: Use correct lock while counting channel queue length
    - Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk
    - Bluetooth: fix debugfs registration
    - Bluetooth: hci_qca: fix debugfs registration
    - rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting
    - rbd: get snapshot context after exclusive lock is ensured to be held
    - virtio_net: use control_buf for coalesce params
    - [arm64] pinctrl: meson-axg: add missing GPIOA_18 gpio group
    - usb: usbfs: Enforce page requirements for mmap
    - usb: usbfs: Use consistent mmap functions
    - [arm64] soc: qcom: rpmh-rsc: drop redundant unsigned >=0 comparision
    - [arm64] dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals
    - [arm*] ASoC: simple-card-utils: fix PCM constraint error check
    - blk-mq: fix blk_mq_hw_ctx active request accounting
    - [arm*] i2c: mv64xxx: Fix reading invalid status value in atomic mode
    - soundwire: stream: Add missing clear of alloc_slave_rt
    - vhost: support PACKED when setting-getting vring_base
    - ksmbd: fix out-of-bound read in deassemble_neg_contexts()
    - ksmbd: fix out-of-bound read in parse_lease_state()
    - ksmbd: fix posix_acls and acls dereferencing possible ERR_PTR()
    - ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop
    - Bluetooth: Fix potential double free caused by hci_conn_unlink
    - Bluetooth: Refcnt drop must be placed last in hci_conn_unlink
    - Bluetooth: Fix UAF in hci_conn_hash_flush again
    - Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is
      re-enabled"
    - ext4: only check dquot_initialize_needed() when debugging
    - wifi: rtw89: correct PS calculation for SUPPORTS_DYNAMIC_PS
    - wifi: rtw88: correct PS calculation for SUPPORTS_DYNAMIC_PS
    - Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.9
    - [x86] head/64: Switch to KERNEL_CS as soon as new GDT is installed
    - cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers
    - cgroup: always put cset in cgroup_css_set_put_fork
    - cgroup: fix missing cpus_read_{lock,unlock}() in cgroup_transfer_tasks()
    - ksmbd: validate smb request protocol id
    - of: overlay: Fix missing of_node_put() in error case of
      init_overlay_changeset()
    - power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() +
      schedule()
    - [armhf] dts: vexpress: add missing cache properties
    - [arm64] dts: arm: add missing cache properties
    - power: supply: Ratelimit no data debug output
    - PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports
    - [x86] platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0
    - regulator: Fix error checking for debugfs_create_dir
    - [arm64,armhf] irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/
      firmware issues
    - [arm64,armhf] irqchip/meson-gpio: Mark OF related data as maybe unused
    - power: supply: Fix logic checking if system is running from battery
    - drm: panel-orientation-quirks: Change Air's quirk to support Air Plus
    - btrfs: scrub: try harder to mark RAID56 block groups read-only
    - btrfs: handle memory allocation failure in btrfs_csum_one_bio
    - ASoC: soc-pcm: test if a BE can be prepared
    - sfc: fix devlink info error handling
    - erofs: use HIPRI by default if per-cpu kthreads are enabled
    - [mips*] unhide PATA_PLATFORM
    - [mips*] Restore Au1300 support
    - [mips*] Move initrd_start check after initrd address sanitisation.
    - ASoC: cs35l41: Fix default regmap values for some registers
    - xen/blkfront: Only check REQ_FUA for writes
    - drm:amd:amdgpu: Fix missing buffer object unlock in failure path
    - io_uring: unlock sqd->lock before sq thread release CPU
    - NVMe: Add MAXIO 1602 to bogus nid list.
    - [arm64,armhf] irqchip/gic: Correctly validate OF quirk descriptors
    - wifi: cfg80211: fix locking in regulatory disconnect
    - wifi: cfg80211: fix double lock bug in reg_wdev_chan_valid()
    - epoll: ep_autoremove_wake_function should use list_del_init_careful
    - ocfs2: fix use-after-free when unmounting read-only filesystem
    - ocfs2: check new file size on fallocate call
    - zswap: do not shrink if cgroup may not zswap
    - mm/uffd: fix vma operation where start addr cuts part of vma
    - nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key()
    - nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
    - nilfs2: reject devices with insufficient block count
    - io_uring/net: save msghdr->msg_control for retries
    - Revert "drm/amdgpu: remove TOPDOWN flags when allocating VRAM in large bar
      system"
    - kexec: support purgatories with .text.hot sections
    - [x86] purgatory: remove PGO flags
    - [riscv64] purgatory: remove PGO flags
    - [powerpc*] purgatory: remove PGO flags
    - btrfs: subpage: fix a crash in metadata repair path
    - btrfs: properly enable async discard when switching from RO->RW
    - btrfs: do not ASSERT() on duplicated global roots
    - btrfs: fix iomap_begin length for nocow writes
    - btrfs: can_nocow_file_extent should pass down args->strict from callers
    - ALSA: usb-audio: Fix broken resume due to UAC3 power state
    - ALSA: usb-audio: Add quirk flag for HEM devices to enable native DSD
      playback
    - dm thin metadata: check fail_io before using data_sm
    - dm thin: fix issue_discard to pass GFP_NOIO to __blkdev_issue_discard
    - net: ethernet: stmicro: stmmac: fix possible memory leak in __stmmac_open
    - nouveau: fix client work fence deletion race
    - RDMA/uverbs: Restrict usage of privileged QKEYs
    - drm/amdgpu: vcn_4_0 set instance 0 init sched score to 1
    - net: usb: qmi_wwan: add support for Compal RXM-G1
    - drm/amd/display: limit DPIA link rate to HBR3
    - drm/amd/display: edp do not add non-edid timings
    - drm/amd: Make sure image is written to trigger VBIOS image update flow
    - drm/amd: Tighten permissions on VBIOS flashing attributes
    - drm/amd/pm: workaround for compute workload type on some skus
    - drm/amdgpu: add missing radeon secondary PCI ID
    - drm/amdgpu: Reset CP_VMID_PREEMPT after trailing fence signaled
    - drm/amdgpu: Program gds backup address as zero if no gds allocated
    - drm/amdgpu: Implement gfx9 patch functions for resubmission
    - drm/amdgpu: Modify indirect buffer packages for resubmission
    - ALSA: hda/realtek: Add a quirk for Compaq N14JP6
    - [x86] thunderbolt: Increase DisplayPort Connection Manager handshake
      timeout
    - [x86] thunderbolt: Do not touch CL state configuration during discovery
    - [x86] thunderbolt: dma_test: Use correct value for absent rings when
      creating paths
    - [x86] thunderbolt: Mask ring interrupt on Intel hardware as well
    - USB: serial: option: add Quectel EM061KGL series
    - serial: lantiq: add missing interrupt ack
    - tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A
    - usb: typec: ucsi: Fix command cancellation
    - usb: typec: Fix fast_role_swap_current show function
    - usb: gadget: udc: core: Offload usb_udc_vbus_handler processing
    - usb: gadget: udc: core: Prevent soft_connect_store() race
    - usb: gadget: udc: renesas_usb3: Fix RZ/V2M {modprobe,bind} error
    - [arm64] USB: dwc3: qcom: fix NULL-deref on suspend
    - [arm64,armhf] USB: dwc3: fix use-after-free on core driver unbind
    - [arm64,armhf] usb: dwc3: gadget: Reset num TRBs before giving back the
      request
    - RDMA/rtrs: Fix the last iu->buf leak in err path
    - RDMA/rtrs: Fix rxe_dealloc_pd warning
    - RDMA/rxe: Fix packet length checks
    - RDMA/rxe: Fix ref count error in check_rkey()
    - RDMA/bnxt_re: Fix reporting active_{speed,width} attributes
    - spi: cadence-quadspi: Add missing check for dma_set_mask
    - [arm64] spi: fsl-dspi: avoid SCK glitches with continuous transfers
    - [arm64] regulator: qcom-rpmh: add support for pmm8654au regulators
    - [arm64] regulator: qcom-rpmh: Fix regulators for PM8550
    - netfilter: nf_tables: integrate pipapo into commit protocol
    - netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
    - ice: do not busy-wait to read GNSS data
    - ice: Don't dereference NULL in ice_gnss_read error path
    - ice: Fix XDP memory leak when NIC is brought up and down
    - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
      (CVE-2023-3390)
    - [arm64] net: enetc: correct the indexes of highest and 2nd highest TCs
    - ping6: Fix send to link-local addresses with VRF.
    - igb: Fix extts capture value format for 82580/i354/i350
    - net/sched: act_pedit: remove extra check for key type
    - net/sched: act_pedit: Parse L3 Header for L4 offset
    - net/sched: taprio: fix slab-out-of-bounds Read in taprio_dequeue_from_txq
    - net/sched: cls_u32: Fix reference counter leak leading to overflow
    - wifi: mac80211: fix link activation settings order
    - wifi: cfg80211: fix link del callback to call correct handler
    - wifi: mac80211: take lock before setting vif links
    - RDMA/rxe: Fix the use-before-initialization error of resp_pkts
    - iavf: remove mask from iavf_irq_enable_queues()
    - RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions
    - RDMA/mlx5: Create an indirect flow table for steering anchor
    - RDMA/cma: Always set static rate to 0 for RoCE
    - IB/uverbs: Fix to consider event queue closing also upon non-blocking mode
    - RDMA/mlx5: Fix affinity assignment
    - IB/isert: Fix dead lock in ib_isert
    - IB/isert: Fix possible list corruption in CMA handler
    - IB/isert: Fix incorrect release of isert connection
    - net: ethtool: correct MAX attribute value for stats
    - wifi: mac80211: fragment per STA profile correctly
    - ipvlan: fix bound dev checking for IPv6 l3s mode
    - sctp: fix an error code in sctp_sf_eat_auth()
    - igc: Clean the TX buffer and TX descriptor ring
    - igc: Fix possible system crash when loading module
    - igb: fix nvm.ops.read() error handling
    - net: phylink: report correct max speed for QUSGMII
    - net: phylink: use a dedicated helper to parse usgmii control word
    - drm/nouveau: don't detect DSM for non-NVIDIA device
    - [arm64] drm/bridge: ti-sn65dsi86: Avoid possible buffer overflow
    - drm/nouveau/dp: check for NULL nv_connector->native_mode
    - drm/nouveau: add nv_encoder pointer check for NULL
    - [arm64] net: ethernet: ti: am65-cpsw: Call of_node_put() on error path
    - net/sched: act_ct: Fix promotion of offloaded unreplied tuple
    - net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs
    - net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting
    - cifs: fix lease break oops in xfstest generic/098
    - RDMA/rxe: Fix rxe_cq_post
    - Revert "media: dvb-core: Fix use-after-free on race condition at
      dvb_frontend" (Closes: #1038068)
    - ext4: drop the call to ext4_error() from ext4_get_group_info()
    - ice: Fix ice module unload
    - net/sched: cls_api: Fix lockup on flushing explicitly created chain
    - [arm64] net: dsa: felix: fix taprio guard band overflow at 10Mbps with
      jumbo frames
    - net: macsec: fix double free of percpu stats
    - sfc: fix XDP queues mode with legacy IRQ
    - dm: don't lock fs when the map is NULL during suspend or resume
    - net: tipc: resize nlattr array to correct size
    - afs: Fix vlserver probe RTT handling
    - [hppa/parisc] Delete redundant register definitions in <asm/assembly.h>
    - neighbour: delete neigh_lookup_nodev as not used
    - scsi: target: core: Fix error path in target_setup_session()
    - blk-cgroup: Flush stats before releasing blkcg_gq
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.10
    - cifs: fix status checks in cifs_tree_connect
    - drm/amd/display: Use dc_update_planes_and_stream
    - drm/amd/display: Add wrapper to call planes and stream update
    - drm/amd/display: fix the system hang while disable PSR
    - ata: libata-scsi: Avoid deadlock on rescan after device resume
    - mm: Fix copy_from_user_nofault(). (Closes: #1033398)
    - tpm, tpm_tis: Claim locality in interrupt handler
    - ksmbd: validate command payload size
    - ksmbd: fix out-of-bound read in smb2_write
    - ksmbd: validate session id and tree id in the compound request
    - Revert "efi: random: refresh non-volatile random seed when RNG is
      initialized"
    - afs: Fix dangling folio ref counts in writeback
    - afs: Fix waiting for writeback then skipping folio
    - tick/common: Align tick period during sched_timer setup (Closes: #1038754)
    - Revert "virtio-blk: support completion batching for the IRQ path"
    - memfd: check for non-NULL file_seals in memfd_create() syscall
    - writeback: fix dereferencing NULL mapping->host on writeback_page_template
    - nilfs2: fix buffer corruption due to concurrent device reads
    - nilfs2: prevent general protection fault in nilfs_clear_dirty_page()
    - ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep()
    - [x86] thermal/intel/intel_soc_dts_iosf: Fix reporting wrong temperatures
    - KVM: Avoid illegal stage2 mapping on invalid memory slot
    - mm/vmalloc: do not output a spurious warning when huge vmalloc() fails
    - mm/mprotect: fix do_mprotect_pkey() limit check
    - Drivers: hv: vmbus: Call hv_synic_free() if hv_synic_alloc() fails
    - Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs
    - PCI: hv: Fix a race condition bug in hv_pci_query_relations()
    - Revert "PCI: hv: Fix a timing issue which causes kdump to fail
      occasionally"
    - PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev
    - PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic
    - PCI: hv: Add a per-bus mutex state_lock
    - io_uring/net: clear msg_controllen on partial sendmsg retry
    - io_uring/net: disable partial retries for recvmsg with cmsg
    - mptcp: handle correctly disconnect() failures
    - mptcp: fix possible divide by zero in recvmsg()
    - mptcp: fix possible list corruption on passive MPJ
    - mptcp: consolidate fallback and non fallback state machine
    - mptcp: ensure listener is unhashed before updating the sk status
    - cgroup: Do not corrupt task iteration when rebinding subsystem
    - cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex in
      freezer_css_{online,offline}()
    - net: mdio: fix the wrong parameters
    - [arm64] mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916
    - [arm64] mmc: meson-gx: remove redundant mmc_request_done() call from irq
      context
    - [arm64,armhf] mmc: mmci: stm32: fix max busy timeout calculation
    - [arm64,armhf] mmc: bcm2835: fix deferred probing
    - mmc: sunxi: fix deferred probing
    - [arm64] mmc: meson-gx: fix deferred probing
    - bpf: ensure main program has an extable
    - wifi: iwlwifi: pcie: Handle SO-F device for PCI id 0x7AF0
    - ksmbd: remove internal.h include
    - fs: introduce lock_rename_child() helper
    - ksmbd: fix racy issue from using ->d_parent and ->d_name
    - ksmbd: add mnt_want_write to ksmbd vfs functions
    - block: make sure local irq is disabled when calling __blkcg_rstat_flush
    - io_uring/poll: serialize poll linked timer start with poll removal
    - [x86] mm: Avoid using set_pgd() outside of real PGD pages
    - ieee802154: hwsim: Fix possible memory leaks
    - xfrm: Treat already-verified secpath entries as optional
    - xfrm: Ensure policies always checked on XFRM-I input path
    - [arm64] KVM: arm64: PMU: Restore the host's PMUSERENR_EL0
    - xfrm: add missed call to delete offloaded policies
    - bpf: Fix verifier id tracking of scalars on spill
    - xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets
    - bpf: Fix a bpf_jit_dump issue for x86_64 with sysctl bpf_jit_enable.
    - xfrm: Linearize the skb after offloading if needed.
    - net/mlx5: DR, Fix wrong action data allocation in decap action
    - sfc: use budget for TX completions
    - [armel,armhf] mmc: mvsdio: fix deferred probing
    - [armhf] mmc: omap: fix deferred probing
    - [armhf] mmc: omap_hsmmc: fix deferred probing
    - mmc: sdhci-acpi: fix deferred probing
    - ipvs: align inner_mac_header for encapsulation
    - be2net: Extend xmit workaround to BE3 chip
    - netfilter: nf_tables: fix chain binding transaction logic
    - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound
      set/chain
    - netfilter: nf_tables: drop map element references from preparation phase
    - netfilter: nft_set_pipapo: .walk does not deal with generations
    - netfilter: nf_tables: disallow element updates of bound anonymous sets
    - netfilter: nf_tables: reject unbound anonymous set before commit phase
    - netfilter: nf_tables: reject unbound chain set before commit phase
    - netfilter: nf_tables: disallow updates of anonymous sets
    - netfilter: nfnetlink_osf: fix module autoload
    - Revert "net: phy: dp83867: perform soft reset and retain established link"
    - bpf/btf: Accept function names that contain dots
    - bpf: Force kprobe multi expected_attach_type for kprobe_multi link
    - io_uring/net: use the correct msghdr union member in io_sendmsg_copy_hdr
    - sch_netem: acquire qdisc lock in netem_change()
    - revert "net: align SO_RCVMARK required privileges with SO_MARK"
    - [arm64] dts: rockchip: fix nEXTRST on SOQuartz
    - gpiolib: Fix GPIO chip IRQ initialization restriction
    - [amd64] iommu/amd: Fix possible memory leak of 'domain'
    - gpiolib: Fix irq_domain resource tracking for
      gpiochip_irqchip_add_domain()
    - scsi: target: iscsi: Fix hang in the iSCSI login code
    - scsi: target: iscsi: Remove unused transport_timer
    - scsi: target: iscsi: Prevent login threads from racing between each other
    - HID: wacom: Add error check to wacom_parse_and_register()
    - [arm64] Add missing Set/Way CMO encodings
    - smb3: missing null check in SMB2_change_notify
    - media: cec: core: disable adapter in cec_devnode_unregister
    - media: cec: core: don't set last_initiator if tx in progress
    - nfcsim.c: Fix error checking for debugfs_create_dir
    - btrfs: fix an uninitialized variable warning in btrfs_log_inode
    - [i386] usb: gadget: udc: fix NULL dereference in remove()
    - nvme: fix miss command type check
    - nvme: double KA polling frequency to avoid KATO with TBKAS on
    - nvme: check IO start time when deciding to defer KA
    - nvme: improve handling of long keep alives
    - [x86] Input: soc_button_array - add invalid acpi_index DMI quirk handling
    - [s390x] cio: unregister device when the only path is gone
    - [arm*] ASoC: simple-card: Add missing of_node_put() in case of error
    - soundwire: dmi-quirks: add new mapping for HP Spectre x360
    - soundwire: qcom: add proper error paths in qcom_swrm_startup()
    - [x86] ASoC: nau8824: Add quirk to active-high jack-detect
    - [x86] ASoC: amd: yc: Add Thinkpad Neo14 to quirks list for acp6x
    - gfs2: Don't get stuck writing page onto itself under direct I/O
    - [arm64] ASoC: fsl_sai: Enable BCI bit if SAI works on synchronous mode
      with BYP asserted
    - net: sched: wrap tc_skip_wrapper with CONFIG_RETPOLINE
    - ALSA: hda/realtek: Add "Intel Reference board" and "NUC 13" SSID in the
      ALC256
    - [armhf] dts: Fix erroneous ADS touchscreen polarities
    - null_blk: Fix: memory release when memory_backed=1
    - drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl
    - vhost_net: revert upend_idx only on retriable error
    - [x86] unwind/orc: Add ELF section with ORC version identifier
    - [x86] apic: Fix kernel panic when booting with intremap=off and
      x2apic_phys
    - [arm64] i2c: imx-lpi2c: fix type char overflow issue when calculating the
      clock cycle
    - netfilter: nf_tables: drop module reference after updating chain
    - [arm64] KVM: arm64: Restore GICv2-on-GICv3 functionality
    - ksmbd: fix uninitialized pointer read in ksmbd_vfs_rename()
    - ksmbd: fix uninitialized pointer read in smb2_create_link()
    - ksmbd: call putname after using the last component
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.11
    - mm/mmap: Fix error path in do_vmi_align_munmap()
    - mm/mmap: Fix error return in do_vmi_align_munmap()
    - [x86] microcode/AMD: Load late on both threads too
    - [x86] smp: Make stop_other_cpus() more robust
    - [x86] smp: Dont access non-existing CPUID leaf
    - [x86] smp: Remove pointless wmb()s from native_stop_other_cpus()
    - [x86] smp: Use dedicated cache-line for mwait_play_dead()
    - [x86] smp: Cure kexec() vs. mwait_play_dead() breakage
    - [x86] cpufreq: amd-pstate: Make amd-pstate EPP driver name hyphenated
    - can: isotp: isotp_sendmsg(): fix return error fix on TX path
    - maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()
    - mm: introduce new 'lock_mm_and_find_vma()' page fault helper
    - mm: make the page fault mmap locking killable
    - [arm64] mm: Convert to using lock_mm_and_find_vma()
    - [powerpc*] mm: Convert to using lock_mm_and_find_vma()
    - [mips*] mm: Convert to using lock_mm_and_find_vma()
    - [riscv64] mm: Convert to using lock_mm_and_find_vma()
    - [armel,armhf] mm: Convert to using lock_mm_and_find_vma()
    - mm/fault: convert remaining simple cases to lock_mm_and_find_vma()
    - [powerpc*] mm: convert coprocessor fault to lock_mm_and_find_vma()
    - mm: make find_extend_vma() fail if write lock not held
    - execve: expand new process stack manually ahead of time
    - mm: always expand the stack with the mmap write lock held
    - gup: add warning if some caller would seem to want stack expansion
    - fbdev: fix potential OOB read in fast_imageblit()
    - HID: hidraw: fix data race on device refcount
    - HID: wacom: Use ktime_t rather than int when dealing with timestamps
    - HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651.
      (Closes: #1038271)

  [ Salvatore Bonaccorso ]
  * Ignore ABI changes for xfrm_bpf_md_dst (only for use in xfrm subsystem)
  * [amd64,arm64] drivers/virtio: Enable VIRTIO_MEM as module (Closes: #1038665)
  * Bump ABI to 2

  [ Ben Hutchings ]
  * Add pkg.linux.mintools profile for building minimal userland tools
  * d/b/test-patches: Build linux-{kbuild,bootwrapper} packages
    (Closes: #871216, #1035359)

  [ Helge Deller ]
  * [hppa] Allow up to 16 CPUs with 32-bit kernel

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 01 Jul 2023 20:23:53 +0200

linux (6.3.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.6
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.7

  [ Uwe Kleine-König ]
  * [arm*] Add symbol information to raspberry pi device trees. This is useful
    when device tree overlays are used.

  [ Zhang Ning ]
  * [armhf] drivers/staging/media/rkvdec: enable rkvdec as module

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 12 Jun 2023 08:25:26 +0200

linux (6.3.5-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.5

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 31 May 2023 22:32:55 +0200

linux (6.3.4-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.3
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4
    - maple_tree: make maple state reusable after mas_empty_area()
      (Closes: #1036755)

  [ Salvatore Bonaccorso ]
  * [rt] Update to 6.3.3-rt15
  * drivers/ptp: Make PTP_1588_CLOCK builtin (except armel/marvell)
    (Closes: #1036744)

  [ Aurelien Jarno ]
  * [riscv64] rtc: Enable RTC_DRV_DS1307, RTC_DRV_PCF85063 and RTC_DRV_PCF8563
    as modules.

  [ Diederik de Haas ]
  * [arm64,armhf] drivers/mailbox: Enable ROCKCHIP_MBOX
  * [armhf] drivers/mailbox: Drop OMAP_MBOX_KFIFO_SIZE setting

  [ Johannes Schauer Marin Rodrigues ]
  * drivers/input/joystick: Enable INPUT_JOYSTICK by default (except for s390x
    and cloud configuration) (Closes: #1035063)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 25 May 2023 23:32:33 +0200

linux (6.3.2-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.2

  [ Diederik de Haas ]
  * [arm64] Improve support for rk3328 devices
    - drivers/clk: Enable COMMON_CLK
    - drivers/clk/rockchip: Enable CLK_RK3328
    - drivers/cpuidle[arm]: Enable ARM_PSCI_CPUIDLE_DOMAIN
    - drivers/gpio: Enable GPIO_ROCKCHIP as module
    - drivers/gpio: Enable GPIO_SYSCON as module
    - drivers/pinctrl: Enable PINCTRL_ROCKCHIP as module
    - drivers/power/reset: Enable SYSCON_REBOOT_MODE as module
    - drivers/soc/rockchip: Enable ROCKCHIP_GRF
  * [arm64] Improve support for rk3399 devices
    - drivers/clk/rockchip: Enable CLK_RK3399
    - drivers/mmc/core: Enable PWRSEQ_SIMPLE
    - drivers/soc/rockchip: Enable ROCKCHIP_DTPM as module
    - drivers/usb/dwc3: Enable USB_DWC3_OF_SIMPLE as module
  * [arm64] Improve support for rk356x devices
    - drivers/clk/rockchip: Enable CLK_RK3568
    - drivers/firmware/arm_scmi: Enable ARM_SCMI_TRANSPORT_SMC
    - drivers/gpu/drm/bridge: Enable DRM_DISPLAY_CONNECTOR as module
    - drivers/misc: Enable SRAM
  * [rt] Update to 6.3.1-rt13

  [ Yoann Congal ]
  * net/hsr: Enable PRP/HSR protocols as module (Closes: #1034506)

  [ Vincent Blut ]
  * drivers/net/wireless/realtek/rtw89: Enable RTW89_8852BE and RTW89_8852CE
    as modules (Closes: #1035569)

  [ Salvatore Bonaccorso ]
  * drivers/tty: Unset LEGACY_TIOCSTI (Closes: #1033095)
  * d/rules.real: Fix typo in setup_image target.

  [ Aurelien Jarno ]
  * [riscv64] Enable support for hardware added in Linux 6.2 and 6.3 based on
    the upstream defconfig update: ARCH_R9A07G043, ARCH_RENESAS, ARCH_SUNXI,
    DMADEVICES, DMA_SUN6I, DRM_SUN4I, HW_RANDOM_JH7110, I2C_MV64XXX,
    MMC_SUNXI, NOP_USB_XCEIV, NVMEM_SUNXI_SID, PHY_SUN4I_USB, REGULATOR,
    REGULATOR_FIXED_VOLTAGE, RTC_DRV_SUN6I, SERIAL_SH_SCI, SPI_SUN6I,
    STMMAC_ETH, SUN50I_IOMMU, SUNXI_WATCHDOG, USB_MUSB_HDRC, USB_MUSB_SUNXI.

  [ Ben Hutchings ]
  * [mips*] Increase RELOCATION_TABLE_SIZE to 0x1d0000 (fixes FTBFS)
  * [sh4/sh7785lcr] Modularise drivers to shrink kernel image (fixes FTBFS):
    - ata: Change ATA, SATA_SIL from built-in to modular
    - SCSI: Change SCSI, BLK_DEV_SD from built-in to modular
    - USB: Change USB, USB_EHCI_HCD, USB_R8A66597_HCD,_USB_STORAGE from
      built-in to modular
    - udeb: Add ata-modules, scsi-core-modules, usb-modules packages
  * [armel/marvell]: Disable features to shrink kernel image (fixes FTBFS):
    - security: Disable SECURITY_APPARMOR_EXPORT_BINARY
    - tcp: Disable MPTCP
    - tracing: Disable FUNCTION_TRACER
  * linux-kbuild: Fix cross-build regression in objtool in 6.3
  * linux-kbuild: Add support for objtool powerpc target

  [ Andreas Hübner ]
  * d/templates: Improve package description for "header" packages

  [ Martyn Welch ]
  * d/rules.real: Enable limiting of compression threading

  [ Punit Agrawal ]
  * [arm64,armhf] drivers/hwtracing/coresight: Enable components

  [ Miguel Bernal Marin ]
  * Enable MEI options for Intel ARC GPUs as modules (Closes: #1028463)
    - [amd64] drivers/gpu/drm/i915: Enable DRM_I915_PXP
    - [x86] drivers/misc/mei: Enable INTEL_MEI_GSC as module
    - [x86] drivers/misc/mei/pxp: Enable INTEL_MEI_PXP as module
  * Enable Intel Trust Domain Extensions - Guest Support (Closes: #1032437)
    - [amd64] arch/x86: Enable INTEL_TDX_GUEST
    - [amd64] drivers/virt/coco/tdx-guest: Enable TDX_GUEST_DRIVER as module
  * [amd64] drivers/platform/x86/intel/ifs: Enable Intel In-Field Scan (IFS)
    INTEL_IFS as module (Closes: #1033061)

 -- Ben Hutchings <benh@debian.org>  Mon, 15 May 2023 02:12:25 +0200

linux (6.3.1-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_6.2
  * New upstream release: https://kernelnewbies.org/Linux_6.3
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.1

  [ Diederik de Haas ]
  * Update for 6.2:
    - libcpupower1: Update symbols file
    - d/patches: Forward and add patches to fix hardening issues
    - d/rules: Let blhc ignore perf tests binaries that are compiled without
      fortification (by Uwe Kleine-König)
    - [rt] Update to 6.2-rt3
  * Update for 6.3:
    - linux-kbuild: Stop building bin2c
    - [rt] Update to 6.3-rt11

  [ Uwe Kleine-König ]
  * iwlwifi: Enable device tracing
  * [arm*] Enable NVMEM_RMEM which is useful (at least) on raspberry pi

 -- Ben Hutchings <benh@debian.org>  Mon, 08 May 2023 01:01:58 +0200

linux (6.1.27-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.26
    - [arm64] dts: qcom: ipq8074-hk01: enable QMP device, not the PHY node
    - netfilter: br_netfilter: fix recent physdev match breakage
    - netfilter: nf_tables: Modify nla_memdup's flag to GFP_KERNEL_ACCOUNT
    - [arm64,armhf] regulator: fan53555: Explicitly include bits header
    - [arm64,armhf] regulator: fan53555: Fix wrong TCS_SLEW_MASK
    - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
      (CVE-2023-31436)
    - virtio_net: bugfix overflow inside xdp_linearize_page()
    - sfc: Fix use-after-free due to selftest_work
    - netfilter: nf_tables: fix ifdef to also consider nf_tables=m
    - i40e: fix accessing vsi->active_filters without holding lock
    - i40e: fix i40e_setup_misc_vector() error handling
    - netfilter: nf_tables: validate catch-all set elements
    - netfilter: nf_tables: tighten netlink attribute requirements for catch-all
      elements
    - bnxt_en: Do not initialize PTP on older P3/P4 chips
    - mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
    - bonding: Fix memory leak when changing bond type to Ethernet
    - net: rpl: fix rpl header size calculation
    - [arm64] spi: spi-rockchip: Fix missing unwind goto in rockchip_sfc_probe()
    - bpf: Fix incorrect verifier pruning due to missing register precision
      taints
    - e1000e: Disable TSO on i219-LM card to increase speed
    - net: bridge: switchdev: don't notify FDB entries with "master dynamic"
    - f2fs: Fix f2fs_truncate_partial_nodes ftrace event
    - [x86] platform/x86/intel: vsec: Fix a memory leak in intel_vsec_add_aux
    - [x86] platform/x86 (gigabyte-wmi): Add support for A320M-S2H V2
    - scsi: megaraid_sas: Fix fw_crash_buffer_show()
    - scsi: core: Improve scsi_vpd_inquiry() checks
    - [x86] platform/x86: gigabyte-wmi: add support for B650 AORUS ELITE AX
    - [s390x] ptrace: fix PTRACE_GET_LAST_BREAK error handling
    - drm: buddy_allocator: Fix buddy allocator init on 32-bit systems
    - nvme-tcp: fix a possible UAF when failing to allocate an io queue
    - xen/netback: use same error messages for same errors
    - [x86] platform/x86: gigabyte-wmi: add support for X570S AORUS ELITE
    - [x86] platform/x86: asus-nb-wmi: Add quirk_asus_tablet_mode to other ROG
      Flow X13 models
    - mtd: spi-nor: fix memory leak when using debugfs_lookup()
    - Revert "userfaultfd: don't fail on unrecognized features"
    - drm/amdgpu/vcn: Disable indirect SRAM on Vangogh broken BIOSes
    - iio: dac: ad5755: Add missing fwnode_handle_put()
    - iio: light: tsl2772: fix reading proximity-diodes from device tree
    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
    - btrfs: get the next extent map during fiemap/lseek more efficiently
    - maple_tree: make maple state reusable after mas_empty_area_rev()
    - maple_tree: fix mas_empty_area() search
    - maple_tree: fix a potential memory leak, OOB access, or other
      unpredictable bug
    - nilfs2: initialize unused bytes in segment summary blocks
    - memstick: fix memory leak if card device is never registered
    - kernel/sys.c: fix and improve control flow in __sys_setres[ug]id()
    - writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs
    - [arm64] mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25
    - [x86] drm/i915: Fix fast wake AUX sync len
    - drm/amdgpu: Fix desktop freezed after gpu-reset
    - drm/amd/display: set dcn315 lb bpp to 48
    - [arm64] drm/rockchip: vop2: fix suspend/resume
    - [arm64] drm/rockchip: vop2: Use regcache_sync() to fix suspend/resume
    - mm/userfaultfd: fix uffd-wp handling for THP migration entries
    - mm/khugepaged: check again on anon uffd-wp during isolation
    - mm/huge_memory.c: warn with pr_warn_ratelimited instead of
      VM_WARN_ON_ONCE_FOLIO
    - mm: kmsan: handle alloc failures in kmsan_ioremap_page_range()
    - mm: kmsan: handle alloc failures in kmsan_vmap_pages_range_noflush()
    - mm: page_alloc: skip regions with hugetlbfs pages when allocating 1G pages
    - mm/mmap: regression fix for unmapped_area{_topdown}
    - sched/fair: Detect capacity inversion
    - sched/fair: Consider capacity inversion in util_fits_cpu()
    - sched/fair: Fixes for capacity inversion detection
    - [arm64] KVM: arm64: Make vcpu flag updates non-preemptible
    - [arm64] KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg()
    - [mips*] Define RUNTIME_DISCARD_EXIT in LD script
    - fuse: always revalidate rename target dentry
    - inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
    - dccp: Call inet6_destroy_sock() via sk->sk_destruct().
    - sctp: Call inet6_destroy_sock() via sk->sk_destruct().
    - Input: pegasus-notetaker - check pipe type when probing
    - mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock
    - [x86] ASoC: SOF: pm: Tear down pipelines only if DSP was active
    - ASN.1: Fix check for strdup() success
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.27
    - [arm64] KVM: arm64: Retry fault if vma_lookup() results become invalid
    - mm/mempolicy: fix use-after-free of VMA iterator
    - mptcp: stops worker on unaccepted sockets at listener close
    - mptcp: fix accept vs worker race
    - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
      (CVE-2023-1380)
    - drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var
    - gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xNU
    - bluetooth: Perform careful capability checks in hci_sock_ioctl()
      (CVE-2023-2002)
    - btrfs: fix uninitialized variable warnings
    - USB: serial: option: add UNISOC vendor and TOZED LT70C product
    - driver core: Don't require dynamic_debug for initcall_debug probe timing
    - [riscv64] Move early dtb mapping into the fixmap region
    - [riscv64] Do not set initial_boot_params to the linear address of the dtb
    - [riscv64] No need to relocate the dtb as it lies in the fixmap region

  [ Aurelien Jarno ]
  * [armhf] Asymmetric Multi Processing on STM32MP1: Enable STM32_IPCC,
    RPMSG_CHAR, RPMSG_CTRL, RPMSG_VIRTIO, CONFIG_RPMSG_TTY as module.
  * [armhf] Enable CEC_STM32 as module.

  [ Emanuele Rocca ]
  * [arm64] Enable support for RZ/G2M-HiHope. Set ARCH_RENESAS, ARCH_R8A774A1,
    and SERIAL_SH_SCI. Enable GPIO_RCAR, MMC_SDHI, PHY_RCAR_GEN3_USB2 as
    modules. (Closes: #1033232)

  [ Ben Hutchings ]
  * d/b/gencontrol.py: Add optional extra config dir debian/config.local
  * d/b/gencontrol.py: Add support for noudeb build profile
  * d/b/test-patches: Change ABI name to make packages co-installable
  * d/b/test-patches: Make debug info optional and disabled by default
  * d/b/test-patches: Build a linux-headers-common package as well
    (Closes: #871216)
  * d/b/test-patches: Tolerate missing d/control, d/rules.gen, or d/p/test
  * d/b/test-patches: Detect flavour correctly when running backported kernel

  [ Salvatore Bonaccorso ]
  * netfilter: nf_tables: deactivate anonymous set from preparation phase
    (CVE-2023-32233)
  * Bump ABI to 9
  * [rt] Update to 6.1.26-rt8

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 08 May 2023 22:16:50 +0200

linux (6.1.25-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.21
    - xfrm: Allow transport-mode states with AF_UNSPEC selector
    - drm/virtio: Pass correct device to dma_sync_sgtable_for_device()
    - drm/msm/gem: Prevent blocking within shrinker loop
    - [arm64,armhf] drm/panfrost: Don't sync rpm suspension after mmu flushing
    - cifs: Move the in_send statistic to __smb_send_rqst()
    - [arm64] drm/meson: fix 1px pink line on GXM when scaling video overlay
    - [x86] ASoC: SOF: Intel: MTL: Fix the device description
    - [x86] ASoC: SOF: Intel: HDA: Fix device description
    - [x86] ASoC: SOF: Intel: SKL: Fix device description
    - [x86] ASOC: SOF: Intel: pci-tgl: Fix device description
    - docs: Correct missing "d_" prefix for dentry_operations member
      d_weak_revalidate
    - scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
    - ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
    - netfilter: nft_nat: correct length for loading protocol registers
    - netfilter: nft_masq: correct length for loading protocol registers
    - netfilter: nft_redir: correct length for loading protocol registers
    - netfilter: nft_redir: correct value of inet type `.maxattrs`
    - scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD
    - scsi: core: Fix a procfs host directory removal regression
    - ftrace,kcfi: Define ftrace_stub_graph conditionally
    - tcp: tcp_make_synack() can be called from process context
    - wifi: nl80211: fix NULL-ptr deref in offchan check
    - wifi: cfg80211: fix MLO connection ownership
    - nfc: pn533: initialize struct pn533_out_arg properly
    - ipvlan: Make skb->skb_iif track skb->dev for l3s mode
    - i40e: Fix kernel crash during reboot when adapter is in recovery mode
    - [s390x] PCI: s390: Fix use-after-free of PCI resources with per-function
      hotplug
    - [x86] drm/i915/psr: Use calculated io and fast wake lines
    - [x86] drm/i915/sseu: fix max_subslices array-index-out-of-bounds access
    - net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
    - qed/qed_dev: guard against a possible division by zero
    - block: do not reverse request order when flushing plug list
    - loop: Fix use-after-free issues
    - net: tunnels: annotate lockless accesses to dev->needed_headroom
    - net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status
      fails
    - tcp: Fix bind() conflict check for dual-stack wildcard address.
    - net/smc: fix deadlock triggered by cancel_delayed_work_syn()
    - net: usb: smsc75xx: Limit packet length to skb->len
    - drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts
      kdoc
    - [powerpc*] mm: Fix false detection of read faults
    - nvme: fix handling single range discard request
    - nvmet: avoid potential UAF in nvmet_req_complete()
    - block: sunvdc: add check for mdesc_grab() returning NULL
    - net/mlx5e: Fix macsec ASO context alignment
    - net/mlx5e: Don't cache tunnel offloads capability
    - net/mlx5: Fix setting ec_function bit in MANAGE_PAGES
    - net/mlx5: Disable eswitch before waiting for VF pages
    - net/mlx5e: Support Geneve and GRE with VF tunnel offload
    - net/mlx5: E-switch, Fix wrong usage of source port rewrite in split rules
    - net/mlx5: E-switch, Fix missing set of split_count when forward to ovs
      internal port
    - net/mlx5e: Fix cleanup null-ptr deref on encap lock
    - net/mlx5: Set BREAK_FW_WAIT flag first when removing driver
    - veth: Fix use after free in XDP_REDIRECT
    - ice: xsk: disable txq irq before flushing hw
    - [arm64,armhf] net: dsa: don't error out when drivers return ETH_DATA_LEN
      in .port_max_mtu()
    - [arm64,armhf] net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191,
      6220, 6250, 6290
    - sh_eth: avoid PHY being resumed when interface is not up
    - ipv4: Fix incorrect table ID in IOCTL path
    - net: usb: smsc75xx: Move packet length check to prevent kernel panic in
      skb_pull
    - net: atlantic: Fix crash when XDP is enabled but no program is loaded
    - [s390x] net/iucv: Fix size of interrupt data
    - qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
    - bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
    - bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
    - hwmon: (adt7475) Display smoothing attributes in correct order
    - hwmon: (adt7475) Fix masking of hysteresis registers
    - jffs2: correct logic when creating a hole in jffs2_write_begin
    - ext4: fail ext4_iget if special inode unallocated
    - ext4: update s_journal_inum if it changes after journal replay
    - ext4: fix task hung in ext4_xattr_delete_inode
    - net/9p: fix bug in client create for .L
    - drm/amdgpu: fix ttm_bo calltrace warning in psp_hw_fini
    - drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
    - ext4: fix possible double unlock when moving a directory
    - [arm64] tty: serial: fsl_lpuart: skip waiting for transmission complete
      when UARTCTRL_SBK is asserted
    - serial: 8250_fsl: fix handle_irq locking
    - [arm64] firmware: xilinx: don't make a sleepable memory allocation from an
      atomic context
    - [arm64,armhf] memory: tegra: fix interconnect registration race
    - [armhf] memory: tegra124-emc: fix interconnect registration race
    - drm/ttm: Fix a NULL pointer dereference
    - [arm64,armhf] interconnect: fix icc_provider_del() error handling
    - [arm64,armhf] interconnect: fix provider registration API
    - [arm64] interconnect: imx: fix registration race
    - [arm64,armhf] interconnect: fix mem leak when freeing nodes
    - md: select BLOCK_LEGACY_AUTOLOAD
    - cifs: generate signkey for the channel that's reconnecting
    - tracing: Make splice_read available again
    - tracing: Check field value in hist_field_name()
    - tracing: Make tracepoint lockdep check actually test something
    - cifs: Fix smb2_set_path_size()
    - [x86] KVM: SVM: Fix a benign off-by-one bug in AVIC physical table mask
    - [x86] KVM: SVM: Modify AVIC GATag to support max number of 512 vCPUs
    - [x86] KVM: nVMX: add missing consistency checks for CR0 and CR4
    - ALSA: hda: intel-dsp-config: add MTL PCI id
    - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
    - ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP
      platform
    - drm/shmem-helper: Remove another errant put in error path
    - [arm64,armhf] drm/sun4i: fix missing component unbind on bind errors
    - [x86] drm/i915/active: Fix misuse of non-idle barriers as fence trackers
    - [x86] drm/i915/dg2: Add HDMI pixel clock frequencies 267.30 and 319.89 MHz
    - drm/amdgpu: Don't resume IOMMU after incomplete init
    - drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume
    - drm/amd/pm: bump SMU 13.0.4 driver_if header version
    - drm/amd/display: Do not set DRR on pipe Commit
    - drm/amd/display: disconnect MPCC only on OTG change
    - mptcp: fix possible deadlock in subflow_error_report
    - mptcp: add ro_after_init for tcp{,v6}_prot_override
    - mptcp: avoid setting TCP_CLOSE state twice
    - mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket()
    - ftrace: Fix invalid address access in lookup_rec() when index is 0
    - ocfs2: fix data corruption after failed write
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000
    - ice: avoid bonding causing auxiliary plug/unplug under RTNL lock
    - mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
    - mm: teach mincore_hugetlb about pte markers
    - trace/hwlat: Do not wipe the contents of per-cpu thread data
    - trace/hwlat: Do not start per-cpu thread if it is already running
    - [arm64] ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is
      absent
    - fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release()
    - [arm64] cpuidle: psci: Iterate backwards over list in psci_pd_remove()
    - [x86] ASoC: Intel: soc-acpi: fix copy-paste issue in topology names
    - [x86] mce: Make sure logged MCEs are processed after sysfs update
    - [x86] mm: Fix use of uninitialized buffer in sme_enable()
    - [x86] resctrl: Clear staged_config[] before and after it is used
    - powerpc: Pass correct CPU reference to assembler
    - [amd64] virt/coco/sev-guest: Check SEV_SNP attribute at probe time
    - [amd64] virt/coco/sev-guest: Simplify extended guest request handling
    - [amd64] virt/coco/sev-guest: Remove the disable_vmpck label in
      handle_guest_request()
    - [amd64] virt/coco/sev-guest: Carve out the request issuing logic into a
      helper
    - [amd64] virt/coco/sev-guest: Do some code style cleanups
    - [amd64] virt/coco/sev-guest: Convert the sw_exit_info_2 checking to a
      switch-case
    - [amd64] virt/coco/sev-guest: Add throttling awareness
    - io_uring/msg_ring: let target know allocated index
    - perf: Fix check before add_event_to_groups() in perf_group_detach()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.22
    - perf/core: Fix perf_output_begin parameter is incorrectly invoked in
      perf_event_bpf_output
    - perf: fix perf_event_context->time
    - drm/amd/display: Include virtual signal to set k1 and k2 values
    - drm/amd/display: fix k1 k2 divider programming for phantom streams
    - drm/amd/display: Remove OTG DIV register write for Virtual signals.
    - mptcp: refactor passive socket initialization
    - mptcp: use the workqueue to destroy unaccepted sockets
    - mptcp: fix UaF in listener shutdown
    - drm/amd/display: Fix DP MST sinks removal issue
    - [x86] power: supply: bq24190: Fix use after free bug in bq24190_remove due
      to race condition
    - [arm64] dts: imx8dxl-evk: Disable hibernation mode of AR8031 for EQOS
    - [arm64] dts: imx8dxl-evk: Fix eqos phy reset gpio
    - NFS: Fix /proc/PID/io read_bytes for buffered reads
    - xsk: Add missing overflow check in xdp_umem_reg
    - iavf: fix inverted Rx hash condition leading to disabled hash
    - iavf: fix non-tunneled IPv6 UDP packet type and hashing
    - iavf: do not track VLAN 0 filters
    - intel/igbvf: free irq on the error path in igbvf_request_msix()
    - igbvf: Regard vf reset nack as success
    - igc: fix the validation logic for taprio's gate list
    - [arm64] i2c: imx-lpi2c: check only for enabled interrupt flags
    - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
    - nfsd: don't replace page in rq_pages if it's a continuation of last page
    - net: usb: smsc95xx: Limit packet length to skb->len
    - efi/libstub: smbios: Use length member instead of record struct size
    - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
    - net: phy: Ensure state transitions are processed from phy_stop()
    - net: mdio: fix owner field for mdio buses registered using device-tree
    - net: mdio: fix owner field for mdio buses registered using ACPI
    - net: stmmac: Fix for mismatched host/device DMA address width
    - [x86] drm/i915: Print return value on error
    - [x86] drm/i915/fbdev: lock the fbdev obj before vma pin
    - [x86] drm/i915/guc: Rename GuC register state capture node to be more
      obvious
    - [x86] drm/i915/guc: Fix missing ecodes
    - [x86] drm/i915/gt: perform uc late init after probe error injection
    - [arm64] net: qcom/emac: Fix use after free bug in emac_remove due to race
      condition
    - net: usb: lan78xx: Limit packet length to skb->len
    - keys: Do not cache key in task struct if key is requested from kernel
      thread
    - ice: check if VF exists before mode check
    - iavf: fix hang on reboot with ice
    - i40e: fix flow director packet filter programming
    - bpf: Adjust insufficient default bpf_jit_limit
    - net/mlx5e: Set uplink rep as NETNS_LOCAL
    - net/mlx5e: Block entering switchdev mode with ns inconsistency
    - net/mlx5: Fix steering rules cleanup
    - net/mlx5e: Overcome slow response for first macsec ASO WQE
    - net/mlx5: Read the TC mapping of all priorities on ETS query
    - net/mlx5: E-Switch, Fix an Oops in error handling code
    - [armhf] net: dsa: tag_brcm: legacy: fix daisy-chained switches
    - atm: idt77252: fix kmemleak when rmmod idt77252
    - erspan: do not use skb_mac_header() in ndo_start_xmit()
    - nvme-tcp: fix nvme_tcp_term_pdu to match spec
    - hvc/xen: prevent concurrent accesses to the shared ring
    - ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA
    - ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES
    - ksmbd: fix possible refcount leak in smb2_open()
    - Bluetooth: hci_sync: Resume adv with no RPA when active scan
    - Bluetooth: hci_core: Detect if an ACL packet is in fact an ISO packet
    - Bluetooth: btusb: Remove detection of ISO packets over bulk
    - Bluetooth: ISO: fix timestamped HCI ISO data packet parsing
    - Bluetooth: Remove "Power-on" check from Mesh feature
    - [amd64,arm64] gve: Cache link_speed value from device
    - net: asix: fix modprobe "sysfs: cannot create duplicate filename"
    - [arm64] net: mdio: thunder: Add missing fwnode_handle_put()
    - drm/amd/display: Set dcn32 caps.seamless_odm
    - Bluetooth: btqcomsmd: Fix command timeout after setting BD address
    - Bluetooth: L2CAP: Fix responding with wrong PDU type
    - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to
      unfinished work (CVE-2023-1989)
    - Bluetooth: mgmt: Fix MGMT add advmon with RSSI command
    - platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl
    - entry: Fix noinstr warning in __enter_from_user_mode()
    - [x86] perf/x86/amd/core: Always clear status for idx
    - entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up
    - hwmon: fix potential sensor registration fail if of_node is missing
    - [x86] hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
    - scsi: qla2xxx: Synchronize the IOCB count to be in order
    - scsi: qla2xxx: Perform lockless command completion in abort path
    - smb3: lower default deferred close timeout to address perf regression
    - smb3: fix unusable share after force unmount failure
    - [x86] thunderbolt: Use scale field when allocating USB3 bandwidth
    - [x86] thunderbolt: Call tb_check_quirks() after initializing adapters
    - [x86] thunderbolt: Add quirk to disable CLx
    - [x86] thunderbolt: Fix memory leak in margining
    - [x86] thunderbolt: Disable interrupt auto clear for rings
    - [x86] thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer access
    - [x86] thunderbolt: Use const qualifier for `ring_interrupt_index`
    - [x86] thunderbolt: Rename shadowed variables bit to interrupt_bit and
      auto_clear_bit
    - [x86] ASoC: amd: yp: Add OMEN by HP Gaming Laptop 16z-n000 to quirks
    - [x86] ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A43)
    - [x86] ACPI: x86: Drop quirk for HP Elitebook
    - [x86] ACPI: x86: utils: Add Cezanne to the list for forcing
      StorageD3Enable
    - drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update()
    - HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded
    - HID: logitech-hidpp: Add support for Logitech MX Master 3S mouse
    - [amd64] HID: intel-ish-hid: ipc: Fix potential use-after-free in work
      function
    - scsi: target: iscsi: Fix an error message in iscsi_check_key()
    - scsi: qla2xxx: Add option to disable FC2 Target support
    - [arm64] scsi: hisi_sas: Check devm_add_action() return value
    - scsi: ufs: core: Add soft dependency on governor_simpleondemand
    - scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read()
    - scsi: lpfc: Avoid usage of list iterator variable after loop
    - scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
    - scsi: mpi3mr: Wait for diagnostic save during controller init
    - scsi: mpi3mr: NVMe command size greater than 8K fails
    - scsi: mpi3mr: Bad drive in topology results kernel crash
    - scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file
    - net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
    - net: usb: qmi_wwan: add Telit 0x1080 composition
    - drm/amd/display: Update clock table to include highest clock setting
    - drm/amdgpu: Fix call trace warning and hang when removing amdgpu device
    - drm/amd: Fix initialization mistake for NBIO 7.3.0
    - cifs: lock chan_lock outside match_session
    - cifs: append path to open_enter trace event
    - cifs: do not poll server interfaces too regularly
    - cifs: empty interface list when server doesn't support query interfaces
    - cifs: dump pending mids for all channels in DebugData
    - cifs: print session id while listing open files
    - cifs: fix dentry lookups in directory handle cache
    - [x86] fpu/xstate: Prevent false-positive warning in
      __copy_xstate_uabi_buf()
    - scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
    - [arm64] usb: dwc2: drd: fix inconsistent mode if
      role-switch-default-mode="host"
    - [arm64,armhf] usb: dwc2: fix a devres leak in hw_enable upon suspend
      resume
    - usb: gadget: u_audio: don't let userspace block driver unbind
    - btrfs: zoned: fix btrfs_can_activate_zone() to support DUP profile
    - Bluetooth: Fix race condition in hci_cmd_sync_clear
    - efi: sysfb_efi: Fix DMI quirks not working for simpledrm
    - mm/slab: Fix undefined init_cache_node_node() for NUMA and !SMP
    - fscrypt: destroy keyring after security_sb_delete()
    - fsverity: Remove WQ_UNBOUND from fsverity read workqueue
    - lockd: set file_lock start and end when decoding nlm4 testargs
    - [arm64] dts: imx8mm-nitrogen-r2: fix WM8960 clock name
    - igb: revert rtnl_lock() that causes deadlock
    - dm thin: fix deadlock when swapping to thin device
    - usb: typec: tcpm: fix create duplicate source-capabilities file
    - usb: typec: tcpm: fix warning when handle discover_identity message
    - [arm64,armhf] usb: chipdea: core: fix return -EINVAL if request role is
      the same with current role
    - [arm64,armhf] usb: chipidea: core: fix possible concurrent when switch
      role
    - [arm64,armhf] usb: dwc3: gadget: Add 1ms delay after end transfer command
      without IOC
    - io_uring/net: avoid sending -ECONNABORTED on repeated connection requests
    - io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() (CVE-2023-1583)
    - maple_tree: fix mas_skip_node() end slot detection
    - ksmbd: fix wrong signingkey creation when encryption is AES256
    - ksmbd: set FILE_NAMED_STREAMS attribute in FS_ATTRIBUTE_INFORMATION
    - ksmbd: don't terminate inactive sessions after a few seconds
    - ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect
    - ksmbd: return unsupported error on smb1 mount
    - wifi: mac80211: fix qos on mesh interfaces
    - nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
    - drm/amd/display: fix wrong index used in dccg32_set_dpstreamclk
    - [arm64] drm/meson: fix missing component unbind on bind errors
    - drm/amdgpu/nv: Apply ASPM quirk on Intel ADL + AMD Navi
    - [x86] drm/i915/active: Fix missing debug object activation
    - [x86] drm/i915: Preserve crtc_state->inherited during state clearing
    - drm/amdgpu: skip ASIC reset for APUs when go to S4
    - drm/amdgpu: reposition the gpu reset checking for reuse
    - [arm64] firmware: arm_scmi: Fix device node validation for mailbox
      transport
    - mm/ksm: fix race with VMA iteration and mm_struct teardown
    - [arm64] i2c: xgene-slimpro: Fix out-of-bounds bug in
      xgene_slimpro_i2c_xfer() (CVE-2023-2194)
    - dm stats: check for and propagate alloc_percpu failure
    - dm crypt: add cond_resched() to dmcrypt_write()
    - dm crypt: avoid accessing uninitialized tasklet
    - sched/fair: sanitize vruntime of entity being placed
    - sched/fair: Sanitize vruntime of entity being migrated
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.23
    - [x86] thunderbolt: Limit USB3 bandwidth of certain Intel USB4 host routers
    - cifs: update ip_addr for ses only for primary chan setup
    - cifs: prevent data race in cifs_reconnect_tcon()
    - cifs: avoid race conditions with parallel reconnects
    - zonefs: Reorganize code
    - zonefs: Simplify IO error handling
    - zonefs: Reduce struct zonefs_inode_info size
    - zonefs: Separate zone information from inode information
    - zonefs: Fix error message in zonefs_file_dio_append()
    - fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY
    - btrfs: rename BTRFS_FS_NO_OVERCOMMIT to BTRFS_FS_ACTIVE_ZONE_TRACKING
    - btrfs: zoned: count fresh BG region as zone unusable
    - [armhf] dts: aspeed: p10bmc: Update battery node name
    - [arm64] drm/msm/dpu: Refactor sc7280_pp location
    - [arm64] drm/msm/dpu: correct sm8250 and sm8350 scaler
    - [arm64] drm/msm/disp/dpu: fix sc7280_pp base offset
    - [arm64] tty: serial: fsl_lpuart: switch to new dmaengine_terminate_* API
    - [arm64] tty: serial: fsl_lpuart: fix race on RX DMA shutdown
    - tracing: Add .percent suffix option to histogram values
    - tracing: Add .graph suffix option to histogram value
    - tracing: Do not let histogram values have some modifiers
    - [arm64] net: mscc: ocelot: fix stats region batching
    - [arm64] efi: Set NX compat flag in PE/COFF header
    - cifs: fix missing unload_nls() in smb2_reconnect()
    - xfrm: Zero padding when dumping algos and encap
    - zstd: Fix definition of assert()
    - ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535
    - [x86] ASoC: SOF: ipc3: Check for upper size limit for the received message
    - [x86] ASoC: SOF: ipc4-topology: Fix incorrect sample rate print unit
    - [x86] ASoC: SOF: Intel: pci-tng: revert invalid bar size setting
    - [x86] ASoC: SOF: IPC4: update gain ipc msg definition to align with fw
    - md: avoid signed overflow in slot_store()
    - [amd64] x86/PVH: obtain VGA console info in Dom0
    - ALSA: asihpi: check pao in control_message()
    - ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
    - sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620
    - net/mlx5e: Lower maximum allowed MTU in XSK to match XDP prerequisites
    - tracing: Fix wrong return in kprobe_event_gen_test.c
    - btrfs: fix uninitialized variable warning in btrfs_update_block_group
    - btrfs: use temporary variable for space_info in btrfs_update_block_group
    - ALSA: usb-audio: Fix recursive locking at XRUN during syncing
    - [arm64,armhf] PCI: dwc: Fix PORT_LINK_CONTROL update when CDM check
      enabled
    - [x86] platform/x86: think-lmi: add missing type attribute
    - [x86] platform/x86: think-lmi: use correct possible_values delimiters
    - [x86] platform/x86: think-lmi: only display possible_values if available
    - [x86] platform/x86: think-lmi: Add possible_values for ThinkStation
    - [x86] platform/surface: aggregator: Add missing fwnode_handle_put()
    - SUNRPC: fix shutdown of NFS TCP client socket
    - sfc: ef10: don't overwrite offload features at NIC reset
    - scsi: megaraid_sas: Fix crash after a double completion
    - scsi: mpt3sas: Don't print sense pool info twice
    - [arm64] ptp_qoriq: fix memory leak in probe()
    - r8169: fix RTL8168H and RTL8107E rx crc error
    - [arm*] regulator: Handle deferred clk
    - net/net_failover: fix txq exceeding warning
    - net: stmmac: don't reject VLANs when IFF_PROMISC is set
    - [x86] drm/i915/tc: Fix the ICL PHY ownership check in TC-cold state
    - [x86] platform/x86/intel/pmc: Alder Lake PCH slp_s0_residency fix
    - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
    - ACPI: bus: Rework system-level device notification handling
    - loop: LOOP_CONFIGURE: send uevents for partitions
    - [arm64,armhf] net: mvpp2: classifier flow fix fragmentation flags
    - [arm64,armhf] net: mvpp2: parser fix QinQ
    - [arm64,armhf] net: mvpp2: parser fix PPPoE
    - [arm64,armhf] smsc911x: avoid PHY being resumed when interface is not up
    - ice: Fix ice_cfg_rdma_fltr() to only update relevant fields
    - ice: add profile conflict check for AVF FDIR
    - ice: fix invalid check for empty list in ice_sched_assoc_vsi_to_agg()
    - ALSA: ymfpci: Create card with device-managed snd_devm_card_new()
    - ALSA: ymfpci: Fix BUG_ON in probe function
    - i40e: fix registers dump after run ethtool adapter self test
    - bnxt_en: Fix reporting of test result in ethtool selftest
    - bnxt_en: Fix typo in PCI id to device description string mapping
    - bnxt_en: Add missing 200G link speed reporting
    - [arm64,armhf] net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
    - Input: xpad - fix incorrectly applied patch for MAP_PROFILE_BUTTON
    - [amd64] iommu/vt-d: Allow zero SAGAW if second-stage not supported
    - Input: alps - fix compatibility with -funsigned-char
    - Input: focaltech - use explicitly signed char type
    - cifs: prevent infinite recursion in CIFSGetDFSRefer()
    - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
    - Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table
    - btrfs: fix deadlock when aborting transaction during relocation with scrub
    - btrfs: fix race between quota disable and quota assign ioctls
      (CVE-2023-1611)
    - btrfs: scan device in non-exclusive mode
    - zonefs: Do not propagate iomap_dio_rw() ENOTBLK error to user space
    - block/io_uring: pass in issue_flags for uring_cmd task_work handling
    - io_uring/poll: clear single/double poll flags on poll arming
    - io_uring/rsrc: fix rogue rsrc node grabbing
    - io_uring: fix poll/netmsg alloc caches
    - vmxnet3: use gro callback when UPT is enabled
    - zonefs: Always invalidate last cached page on append write
    - dm: fix __send_duplicate_bios() to always allow for splitting IO
    - can: j1939: prevent deadlock by moving j1939_sk_errqueue()
    - xen/netback: don't do grant copy across page boundary
    - modpost: Fix processing of CRCs on 32-bit build machines
      (Closes: #1033329)
    - pinctrl: amd: Disable and mask interrupts on resume
    - [x86] platform/x86: ideapad-laptop: Stop sending KEY_TOUCHPAD_TOGGLE
    - [powerpc*] Don't try to copy PPR for task with NULL pt_regs
    - [powerpc*] pseries/vas: Ignore VAS update for DLPAR if copy/paste is not
      enabled
    - NFSv4: Fix hangs when recovering open state after a server reboot
    - ALSA: hda/conexant: Partial revert of a quirk for Lenovo
    - ALSA: usb-audio: Fix regression on detection of Roland VS-100
    - ALSA: hda/realtek: Add quirks for some Clevo laptops
    - ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z
    - rcu: Fix rcu_torture_read ftrace event
    - [s390x] uaccess: add missing earlyclobber annotations to __clear_user()
    - [arm64,armhf] drm/etnaviv: fix reference leak when mmaping imported buffer
    - drm/amdgpu: allow more APUs to do mode2 reset when go to S4
    - drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub
    - drm/amd/display: Take FEC Overhead into Timeslot Calculation
    - [x86] drm/i915/gem: Flush lmem contents after construction
    - [x86] drm/i915/dpt: Treat the DPT BO as a framebuffer
    - [x86] drm/i915: Disable DC states for all commits
    - [x86] drm/i915: Move CSC load back into .color_commit_arm() when PSR is
      enabled on skl/glk
    - [arm64] KVM: arm64: PMU: Fix GET_ONE_REG for vPMC regs to return the
      current value
    - [arm64] KVM: arm64: Disable interrupts while walking userspace PTs
    - [arm64,armhf] net: dsa: mv88e6xxx: read FID when handling ATU violations
    - [arm64,armhf] net: dsa: mv88e6xxx: replace ATU violation prints with trace
      points
    - [arm64,armhf] net: dsa: mv88e6xxx: replace VTU violation prints with trace
      points
    - usb: ucsi: Fix ucsi->connector race
    - [amd64] x86/PVH: avoid 32-bit build warning when obtaining VGA console
      info
    - Revert "cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.24
    - dm cache: Add some documentation to dm-cache-background-tracker.h
    - dm integrity: Remove bi_sector that's only used by commented debug code
    - dm: change "unsigned" to "unsigned int"
    - dm: fix improper splitting for abnormal bios
    - [arm64] KVM: arm64: PMU: Align chained counter implementation with
      architecture pseudocode
    - [arm64] KVM: arm64: PMU: Distinguish between 64bit counter and 64bit
      overflow
    - [arm64] KVM: arm64: PMU: Sanitise PMCR_EL0.LP on first vcpu run
    - [arm64] KVM: arm64: PMU: Don't save PMCR_EL0.{C,P} for the vCPU
    - Drivers: vmbus: Check for channel allocation before looking up relids
    - [x86] ASoC: SOF: ipc4: Ensure DSP is in D0I0 during
      sof_ipc4_set_get_data()
    - pwm: Make .get_state() callback return an error code
    - [arm64] pwm: cros-ec: Explicitly set .polarity in .get_state()
    - [arm64,armhf] pwm: meson: Explicitly set .polarity in .get_state()
    - [s390x] KVM: s390: pv: fix external interruption loop not always detected
    - wifi: mac80211: fix the size calculation of ieee80211_ie_len_eht_cap()
    - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded
      sta
    - net: qrtr: Fix a refcount bug in qrtr_recvmsg()
    - net: phylink: add phylink_expects_phy() method
    - net: stmmac: check if MAC needs to attach to a PHY
    - net: stmmac: remove redundant fixup to support fixed-link mode
    - l2tp: generate correct module alias strings
    - wifi: brcmfmac: Fix SDIO suspend/resume regression
    - NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL
    - nfsd: call op_release, even when op_func returns an error
    - icmp: guard against too small mtu
    - ALSA: hda/hdmi: Preserve the previous PCM device upon re-enablement
    - net: don't let netpoll invoke NAPI if in xmit context
    - [arm64,armhf] net: dsa: mv88e6xxx: Reset mv88e6393x force WD event bit
    - sctp: check send stream number after wait_for_sndbuf
    - net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT
    - ipv6: Fix an uninit variable access bug in __ip6_make_skb()
    - [x86] platform/x86: think-lmi: Fix memory leak when showing current
      settings
    - [x86] platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation
      WMI strings
    - [x86] platform/x86: think-lmi: Clean up display of current_value on
      Thinkstation
    - net: stmmac: fix up RX flow hash indirection table when setting channels
    - sunrpc: only free unix grouplist after RCU settles
    - NFSD: callback request does not use correct credential for AUTH_SYS
    - ice: fix wrong fallback logic for FDIR
    - ice: Reset FDIR counter in FDIR init stage
    - raw: use net_hash_mix() in hash function
    - raw: Fix NULL deref in raw_get_next().
    - ping: Fix potentail NULL deref for /proc/net/icmp.
    - ethtool: reset #lanes when lanes is omitted
    - netlink: annotate lockless accesses to nlk->max_recvmsg_len
    - [amd64,arm64] gve: Secure enough bytes in the first TX desc for all TCP
      pkts
    - [arm64] compat: Work around uninitialized variable warning
    - net: stmmac: check fwnode for phy device before scanning for phy
    - cxl/pci: Fix CDAT retrieval on big endian
    - cxl/pci: Handle truncated CDAT header
    - cxl/pci: Handle truncated CDAT entries
    - cxl/pci: Handle excessive CDAT length
    - [arm64,armhf] usb: xhci: tegra: fix sleep in atomic call
    - xhci: Free the command allocated for setting LPM if we return early
    - xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu
    - USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs
    - usb: typec: altmodes/displayport: Fix configure initial pin assignment
    - USB: serial: option: add Telit FE990 compositions
    - USB: serial: option: add Quectel RM500U-CN modem
    - drivers: iio: adc: ltc2497: fix LSB shift
    - iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip
    - iio: buffer: correctly return bytes written in output buffers
    - iio: buffer: make sure O_NONBLOCK is respected
    - iio: light: cm32181: Unregister second I2C client if present
    - [arm64] tty: serial: fsl_lpuart: avoid checking for transfer complete when
      UARTCTRL_SBK is asserted in lpuart32_tx_empty
    - nilfs2: fix potential UAF of struct nilfs_sc_info in
      nilfs_segctor_thread()
    - nilfs2: fix sysfs interface lifetime
    - serial: 8250: Prevent starting up DMA Rx on THRI interrupt
    - ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN
    - ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
    - ALSA: hda/realtek: Add quirk for Clevo X370SNW
    - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
    - x86/ACPI/boot: Use FADT version to check support for online capable
    - [x86] KVM: x86: Clear "has_error_code", not "error_code", for RM exception
      injection
    - [x86] KVM: nVMX: Do not report error code when synthesizing VM-Exit from
      Real Mode
    - [arm64] coresight: etm4x: Do not access TRCIDR1 for identification
    - [arm64] coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug
    - blk-mq: directly poll requests
    - iio: adc: ad7791: fix IRQ flags
    - io_uring: fix return value when removing provided buffers
    - io_uring: fix memory leak when removing provided buffers
    - scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()
    - scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
    - nvme: fix discard support without oncs
    - cifs: sanitize paths in cifs_update_super_prepath.
    - block: don't set GD_NEED_PART_SCAN if scan partition failed
    - perf/core: Fix the same task check in perf_event_set_output
    - ftrace: Mark get_lock_parent_ip() __always_inline
    - ftrace: Fix issue that 'direct->addr' not restored in
      modify_ftrace_direct()
    - fs: drop peer group ids under namespace lock
    - can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access
    - can: isotp: fix race between isotp_sendsmg() and isotp_release()
    - can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events
    - can: isotp: isotp_recvmsg(): use sock_recv_cmsgs() to get SOCK_RXQ_OVFL
      infos
    - ACPI: video: Add auto_detect arg to __acpi_video_get_backlight_type()
    - ACPI: video: Make acpi_backlight=video work independent from GPU driver
    - ACPI: video: Add acpi_backlight=video quirk for Apple iMac14,1 and
      iMac14,2
    - ACPI: video: Add acpi_backlight=video quirk for Lenovo ThinkPad W530
    - net: stmmac: Add queue reset into stmmac_xdp_open() function
    - tracing/synthetic: Fix races on freeing last_cmd
    - tracing/timerlat: Notify new max thread latency
    - tracing: Free error logs of tracing instances
    - [x86] ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots()
    - tracing/synthetic: Make lastcmd_mutex static
    - mm: vmalloc: avoid warn_alloc noise caused by fatal signal
    - wifi: mt76: ignore key disable commands
    - [arm64,armhf] drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error
      path
    - drm/nouveau/disp: Support more modes by checking with lower bpc
    - [x86] drm/i915: Fix context runtime accounting
    - [x86] drm/i915: fix race condition UAF in i915_perf_add_config_ioctl
    - ring-buffer: Fix race while reader and writer are on the same page
    - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
    - mm/hugetlb: fix uffd wr-protection for CoW optimization path
    - maple_tree: fix get wrong data_end in mtree_lookup_walk()
    - maple_tree: fix a potential concurrency bug in RCU mode
    - blk-throttle: Fix that bps of child could exceed bps limited in parent
    - drm/amd/display: Clear MST topology if it fails to resume
    - drm/amdgpu: for S0ix, skip SDMA 5.x+ suspend/resume
    - drm/amdgpu: skip psp suspend for IMU enabled ASICs mode2 reset
    - [x86] drm/display/dp_mst: Handle old/new payload states in
      drm_dp_remove_payload()
    - [x86] drm/i915/dp_mst: Fix payload removal during output disabling
    - [x86] drm/i915: Use _MMIO_PIPE() for SKL_BOTTOM_COLOR
    - [x86] drm/i915: Split icl_color_commit_noarm() from
      skl_color_commit_noarm()
    - mm: take a page reference when removing device exclusive entries
    - maple_tree: remove GFP_ZERO from kmem_cache_alloc() and
      kmem_cache_alloc_bulk()
    - maple_tree: fix potential rcu issue
    - maple_tree: reduce user error potential
    - maple_tree: fix handle of invalidated state in mas_wr_store_setup()
    - maple_tree: fix mas_prev() and mas_find() state handling
    - maple_tree: be more cautious about dead nodes
    - maple_tree: refine ma_state init from mas_start()
    - maple_tree: detect dead nodes in mas_start()
    - maple_tree: fix freeing of nodes in rcu mode
    - maple_tree: remove extra smp_wmb() from mas_dead_leaves()
    - maple_tree: add smp_rmb() to dead node detection
    - maple_tree: add RCU lock checking to rcu callback functions
    - mm: enable maple tree RCU mode by default.
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.25
    - Revert "pinctrl: amd: Disable and mask interrupts on resume"
    - drm/amd/display: Pass the right info to drm_dp_remove_payload
    - ALSA: emu10k1: fix capture interrupt handler unlinking
    - ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard
    - ALSA: i2c/cs8427: fix iec958 mixer control deactivation
    - ALSA: hda: patch_realtek: add quirk for Asus N7601ZM
    - ALSA: hda/realtek: Add quirks for Lenovo Z13/Z16 Gen2
    - ALSA: firewire-tascam: add missing unwind goto in
      snd_tscm_stream_start_duplex()
    - ALSA: emu10k1: don't create old pass-through playback device on Audigy
    - ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards
    - ALSA: hda/hdmi: disable KAE for Intel DG2
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
    - Bluetooth: Fix race condition in hidp_session_thread
    - bluetooth: btbcm: Fix logic error in forming the board name.
    - Bluetooth: Free potentially unfreed SCO connection
    - Bluetooth: hci_conn: Fix possible UAF
    - btrfs: restore the thread_pool= behavior in remount for the end I/O
      workqueues
    - btrfs: fix fast csum implementation detection
    - fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace
    - mtdblock: tolerate corrected bit-flips
    - [armhf] mtd: rawnand: stm32_fmc2: remove unsupported EDO mode
    - [armhf] mtd: rawnand: stm32_fmc2: use timings.mode instead of checking
      tRC_min
    - [arm64] KVM: arm64: PMU: Restore the guest's EL0 event counting after
      migration
    - fbcon: Fix error paths in set_con2fb_map
    - fbcon: set_con2fb_map needs to set con2fb_map!
    - [x86] drm/i915/dsi: fix DSS CTL register offsets for TGL+
    - RDMA/irdma: Do not generate SW completions for NOPs
    - RDMA/irdma: Fix memory leak of PBLE objects
    - RDMA/irdma: Increase iWARP CM default rexmit count
    - RDMA/irdma: Add ipv4 check to irdma_find_listener()
    - IB/mlx5: Add support for 400G_8X lane speed
    - RDMA/cma: Allow UD qp_type to join multicast only
    - bpf: tcp: Use sock_gen_put instead of sock_put in bpf_iter_tcp
    - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race
      condition (CVE-2023-1859)
    - [arm64] bpf, arm64: Fixed a BTI error on returning to patched function
    - [arm64] KVM: arm64: Initialise hypervisor copies of host symbols
      unconditionally
    - [arm64] KVM: arm64: Advertise ID_AA64PFR0_EL1.CSV2/3 to protected VMs
    - niu: Fix missing unwind goto in niu_alloc_channels()
    - tcp: restrict net.ipv4.tcp_app_win
    - bonding: fix ns validation on backup slaves
    - iavf: refactor VLAN filter states
    - iavf: remove active_cvlans and active_svlans bitmaps
    - net: openvswitch: fix race on port output
    - Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure
    - Bluetooth: Fix printing errors if LE Connection times out
    - Bluetooth: SCO: Fix possible circular locking dependency
      sco_sock_getsockopt
    - Bluetooth: Set ISO Data Path on broadcast sink
    - [armhf] drm/armada: Fix a potential double free in an error handling path
    - qlcnic: check pci_reset_function result
    - net: wwan: iosm: Fix error handling path in ipc_pcie_probe()
    - cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex
    - net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()
    - sctp: fix a potential overflow in sctp_ifwdtsn_skip
    - RDMA/core: Fix GID entry ref leak when create_ah fails
    - udp6: fix potential access to stale information
    - [arm64] net: macb: fix a memory corruption in extended buffer descriptor
      mode
    - skbuff: Fix a race between coalescing and releasing SKBs
    - [arm64] power: supply: rk817: Fix unsigned comparison with less than zero
    - [arm64] power: supply: cros_usbpd: reclassify "default case!" as debug
    - [x86] power: supply: axp288_fuel_gauge: Added check for negative values
    - wifi: mwifiex: mark OF related data as maybe unused
    - [arm64] i2c: imx-lpi2c: clean rx/tx buffers upon new message
    - efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L
    - [x86] ACPI: video: Add backlight=native DMI quirk for Acer Aspire 3830TG
    - drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F
    - [arm64] hwmon: (xgene) Fix ioremap and memremap leak
    - [amd64] verify_pefile: relax wrapper length check
    - asymmetric_keys: log on fatal failures in PE/pkcs7
    - nvme: send Identify with CNS 06h only to I/O controllers
    - wifi: iwlwifi: mvm: fix mvmtxq->stopped handling
    - wifi: iwlwifi: mvm: protect TXQ list manipulation
    - drm/amdgpu: add mes resume when do gfx post soft reset
    - drm/amdgpu: Force signal hw_fences that are embedded in non-sched jobs
    - drm/amdgpu/gfx: set cg flags to enter/exit safe mode
    - ACPI: resource: Add Medion S17413 to IRQ override quirk
    - [x86] hyperv: Move VMCB enlightenment definitions to hyperv-tlfs.h
    - [x86] KVM: SVM: Add a proper field for Hyper-V VMCB enlightenments
    - [x86] hyperv: KVM: Rename "hv_enlightenments" to "hv_vmcb_enlightenments"
    - [x86] KVM: SVM: Flush Hyper-V TLB when required
    - tracing: Add trace_array_puts() to write into instance
    - tracing: Have tracing_snapshot_instance_cond() write errors to the
      appropriate instance
    - maple_tree: fix write memory barrier of nodes once dead for RCU mode
    - ksmbd: avoid out of bounds access in decode_preauth_ctxt()
    - [riscv64] add icache flush for nommu sigreturn trampoline
    - [amd64] HID: intel-ish-hid: Fix kernel panic during warm reset
    - net: sfp: initialize sfp->i2c_block_size at sfp allocation
    - scsi: ses: Handle enclosure with just a primary component gracefully
    - [x86] PCI: Add quirk for AMD XHCI controller that loses MSI-X state in
      D3hot
    - cgroup: fix display of forceidle time at root
    - cgroup/cpuset: Fix partition root's cpuset.cpus update bug
    - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()
    - mptcp: use mptcp_schedule_work instead of open-coding it
    - mptcp: stricter state check in mptcp_worker
    - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
    - ubi: Fix deadlock caused by recursively holding work_sem
    - [powerpc*] papr_scm: Update the NUMA distance table for the target node
    - sched/fair: Fix imbalance overflow
    - [x86] rtc: Remove __init for runtime functions
    - i2c: ocores: generate stop condition after timeout in polling mode
    - cifs: fix negotiate context parsing
    - nvme-pci: mark Lexar NM760 as IGNORE_DEV_SUBNQN
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for T-FORCE Z330 SSD
    - cgroup/cpuset: Skip spread flags update on v2
    - cgroup/cpuset: Make cpuset_fork() handle CLONE_INTO_CGROUP properly
    - cgroup/cpuset: Add cpuset_can_fork() and cpuset_cancel_fork() methods

  [ Salvatore Bonaccorso ]
  * Bump ABI to 8
  * [arm64] drivers/net/can: Enable CAN_C_CAN, CAN_C_CAN_PLATFORM, CAN_M_CAN and
    CAN_M_CAN_PLATFORM as module.
    Move configuration enablement to arm64 specific configuration.

  [ Cyril Brulebois ]
  * fbdev/offb: Update expected device name (Closes: #1033058)
    This fixes the hang/black screen in Debian Installer on ppc64el, with
    thanks to Frédéric Bonnard for the detailed bug report.

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 22 Apr 2023 20:48:02 +0200

linux (6.1.20-2) unstable; urgency=medium

  [ Hans van Kranenburg ]
  * d/t/control.tools-unversioned.in: version rtla build deps

  [ Helmut Grohne ]
  * Fix FTCBFS: Supply the host pkg-config to the rtla build. (Closes: #1019118)

  [ Francesco Dolcini ]
  * [armhf] Add support for NXP i.MX7 SOC (Closes: #1031180)

  [ Martyn Welch ]
  * [arm64] ti: am62x: Enable support for am625-sk eval board
  * d/salsa-ci.yml: Increase timeout of CI build stage to 3 hours

  [ наб ]
  * Re-instate "KEYS: Make use of platform keyring for module signature verify"
    (Closes: #1030200)

  [ Vincent Blut ]
  * drivers/input/touchscreen: Enable TOUCHSCREEN_SILEAD as module
    (Closes: #925424)
  * [x86] drivers/platform/x86: Enable TOUCHSCREEN_DMI
  * drivers/scsi/mpi3mr: Enable SCSI_MPI3MR as module (Closes: #1033566)

  [ Diederik de Haas ]
  * [arm64,armhf] Enable DRM_PANEL_FEIYANG_FY07024DI26A30D as module

  [ Cyril Brulebois ]
  * udeb: add intel_lpss* (optional) to kernel-image (Closes: #1032136)
    Many laptops have their touchpad accessible over I2C, only visible
    if LPSS is available in the installer.

  [ Salvatore Bonaccorso ]
  * [x86] acpi/boot: Correct acpi_is_processor_usable() check (Closes: #1033732)
  * usb: ucsi: Fix NULL pointer deref in ucsi_connector_change()
    (Closes: #1032948)
  * usb: ucsi_acpi: Increase the command completion timeout (Closes: #1032948)
  * [arm64] hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to
    race condition (CVE-2023-1855)
  * net/sched: act_mirred: better wording on protection against excessive stack
    growth
  * act_mirred: use the backlog for nested calls to mirred ingress
    (CVE-2022-4269)
  * [x86] xirc2ps_cs: Fix use after free bug in xirc2ps_detach (CVE-2023-1670)
  * Bluetooth: HCI: Fix global-out-of-bounds (CVE-2023-28866)

  [ Henning Schild ]
  * [x86] drivers/gpio: Enable GPIO_F7188X as module

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 08 Apr 2023 17:36:24 +0200

linux (6.1.20-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.16
    - HID: asus: use spinlock to protect concurrent accesses
    - HID: asus: use spinlock to safely schedule workers (CVE-2023-1079)
    - [powerpc*] mm: Rearrange if-else block to avoid clang warning
    - ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI controller"
    - [armhf] OMAP2+: Fix memory leak in realtime_counter_init()
    - [arm64] dts: qcom: sm6125-seine: Clean up gpio-keys (volume down)
    - [arm64] dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
    - [x86] acpi/boot: Do not register processors that cannot be onlined for
      x2APIC
    - [arm64] dts: meson-gxl: jethub-j80: Fix WiFi MAC address node
    - [arm64] dts: meson-gxl: jethub-j80: Fix Bluetooth MAC node name
    - cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*
    - [armhf] imx: Call ida_simple_remove() for ida_simple_get
    - locking/rwsem: Disable preemption in all down_read*() and up_read() code
      paths
    - [arm64] dts: meson: radxa-zero: allow usb otg mode
    - [arm64] dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
    - [armhf] dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
    - sbitmap: remove redundant check in __sbitmap_queue_get_batch
    - sbitmap: Use single per-bitmap counting to wake up queued tags
    - sbitmap: correct wake_batch recalculation to avoid potential IO hung
    - blk-mq: avoid sleep in blk_mq_alloc_request_hctx
    - blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
    - blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
    - blk-mq: Fix potential io hung for shared sbitmap per tagset
    - blk-mq: correct stale comment of .get_budget
    - [s390x] dasd: Fix potential memleak in dasd_eckd_init()
    - sched/rt: pick_next_rt_entity(): check list_entry (CVE-2023-1077)
    - [x86] perf/x86/intel/ds: Fix the conversion from TSC to perf time
    - [x86] perf/zhaoxin: Add stepping check for ZXC
    - KEYS: asymmetric: Fix ECDSA use via keyctl uapi
    - erofs: relinquish volume with mutex held
    - block: sync mixed merged request's failfast with 1st bio's
    - block: Fix io statistics for cgroup in throttle path
    - block: bio-integrity: Copy flags when bio_integrity_payload is cloned
    - block: use proper return value from bio_failfast()
    - wifi: mt76: mt7915: check return value before accessing free_block_num
    - wifi: mt76: mt7915: drop always true condition of __mt7915_reg_addr()
    - wifi: mt76: mt7915: fix unintended sign extension of
      mt7915_hw_queue_read()
    - wifi: mt76: fix coverity uninit_use_in_call in
      mt76_connac2_reverse_frag0_hdr_trans()
    - wifi: rsi: Fix memory leak in rsi_coex_attach()
    - wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: iwlegacy: common: don't call dev_kfree_skb() under
      spin_lock_irqsave()
    - wifi: libertas: fix memory leak in lbs_init_adapter()
    - wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
    - wifi: rtw89: 8852c: rfk: correct DACK setting
    - wifi: rtw89: 8852c: rfk: correct DPK settings
    - wifi: rtlwifi: Fix global-out-of-bounds bug in
      _rtl8812ae_phy_set_txpower_limit()
    - wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
    - wifi: ipw2200: fix memory leak in ipw_wdev_init()
    - wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
    - wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init()
    - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
    - wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
    - wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
    - [x86] wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
    - [amd64] crypto: x86/ghash - fix unaligned access in ghash_setkey()
    - ACPICA: Drop port I/O validation for some regions
    - genirq: Fix the return type of kstat_cpu_irqs_sum()
    - rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
    - rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
    - rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
    - lib/mpi: Fix buffer overrun when SG is too long
    - [amd64] crypto: ccp - Avoid page allocation failure warning for
      SEV_GET_ID2
    - platform/chrome: cros_ec_typec: Update port DP VDO
    - ACPICA: nsrepair: handle cases without a return value correctly
    - [arm64] cpufeature: Fix field sign for DIT hwcap detection
    - workqueue: Protects wq_unbound_cpumask with wq_pool_attach_mutex
    - [s390x] early: fix sclp_early_sccb variable lifetime
    - [s390x] vfio-ap: fix an error handling path in vfio_ap_mdev_probe_queue()
    - [x86] signal: Fix the value returned by strict_sas_size()
    - [arm64] thermal/drivers/tsens: Drop msm8976-specific defines
    - [arm64] thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
    - [arm64] thermal/drivers/tsens: fix slope values for msm8939
    - [arm64] thermal/drivers/tsens: limit num_sensors to 9 for msm8939
    - wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie()
    - wifi: rtw89: Add missing check for alloc_workqueue
    - wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
    - wifi: orinoco: check return value of hermes_write_wordrec()
    - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no
      callback function
    - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
    - wifi: ath9k: Fix potential stack-out-of-bounds write in
      ath9k_wmi_rsp_callback()
    - wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
    - wifi: cfg80211: Fix extended KCK key length check in
      nl80211_set_rekey_data()
    - ACPI: battery: Fix missing NUL-termination with large strings
    - [x86] crypto: ccp - Failure on re-initialization due to duplicate sysfs
      filename
    - crypto: essiv - Handle EBUSY correctly
    - crypto: seqiv - Handle EBUSY correctly
    - [x86] powercap: fix possible name leak in powercap_register_zone()
    - [x86] microcode: Add a parameter to microcode_check() to store CPU
      capabilities
    - [x86] microcode: Check CPU capabilities after late microcode update
      correctly
    - [x86] microcode: Adjust late loading result reporting message
    - crypto: xts - Handle EBUSY correctly
    - leds: led-class: Add missing put_device() to led_put()
    - wifi: iwlwifi: mei: fix compilation errors in rfkill()
    - [amd64]  crypto: ccp - Flush the SEV-ES TMR memory before giving it to
      firmware
    - wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only after
      init_work
    - wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit
    - wifi: mt76: mt7915: fix WED TxS reporting
    - wifi: mt76: add memory barrier to SDIO queue kick
    - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read
    - net/mlx5: Enhance debug print in page allocation failure
    - irqchip: Fix refcount leak in platform_irqchip_probe
    - [arm64] irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
    - [s390x] mem_detect: fix detect_memory() error handling
    - [s390x] vmem: fix empty page tables cleanup under KASAN
    - [s390x] boot: cleanup decompressor header files
    - [s390x] mem_detect: rely on diag260() if sclp_early_get_memsize() fails
    - [s390x] boot: fix mem_detect extended area allocation
    - net: add sock_init_data_uid()
    - tun: tun_chr_open(): correctly initialize socket uid (CVE-2023-1076)
    - tap: tap_open(): correctly initialize socket uid (CVE-2023-1076)
    - OPP: fix error checking in opp_migrate_dentry()
    - Bluetooth: hci_conn: Refactor hci_bind_bis() since it always succeeds
    - Bluetooth: L2CAP: Fix potential user-after-free
    - Bluetooth: hci_qca: get wakeup status from serdev device handle
    - [s390x] vfio-ap: tighten the NIB validity check
    - [s390x] ap: fix status returned by ap_aqic()
    - [s390x] ap: fix status returned by ap_qact()
    - xen/grant-dma-iommu: Implement a dummy probe_device() callback
    - rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
    - crypto: rsa-pkcs1pad - Use akcipher_request_complete
    - wifi: iwl3945: Add missing check for create_singlethread_workqueue
    - wifi: iwl4965: Add missing check for create_singlethread_workqueue()
    - wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
    - ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models
    - ACPI: resource: Do IRQ override on all TongFang GMxRGxx
    - wifi: mac80211: move color collision detection report in a delayed work
    - wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
    - wifi: mac80211: fix non-MLO station association
    - wifi: mac80211: Don't translate MLD addresses for multicast
    - wifi: mac80211: avoid u32_encode_bits() warning
    - wifi: mac80211: fix off-by-one link setting
    - [arm64] thermal/drivers/hisi: Drop second sensor hi3660
    - wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta()
    - bpf: Zeroing allocated object from slab in bpf memory allocator
    - can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a
      bus error
    - can: esd_usb: Make use of can_change_state() and relocate checking skb for
      NULL
    - xsk: check IFF_UP earlier in Tx path
    - bpf: Fix global subprog context argument resolution logic
    - [arm64,armhf] irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered
      interrupts
    - net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()
    - net/smc: fix application data exception
    - l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
    - net: bcmgenet: fix MoCA LED control
    - net/mlx4_en: Introduce flexible array to silence overflow warning
    - drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
    - drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
    - [arm64,armhf] drm/vc4: dpi: Fix format mapping for RGB565
    - [armhf] gpu: ipu-v3: common: Add of_node_put() for reference returned by
      of_graph_get_port_by_id()
    - [arm64,armhf] drm/vc4: drop all currently held locks if deadlock happens
    - hwmon: (ftsteutates) Fix scaling of measurements
    - [arm64] drm/msm/dpu: check for null return of devm_kzalloc() in
      dpu_writeback_init()
    - [arm64] drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
    - [armhf] pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
    - [arm64,armhf] pinctrl: rockchip: Fix refcount leak in
      rockchip_pinctrl_parse_groups
    - [arm64,armhf] drm/vc4: hvs: Set AXI panic modes
    - [arm64,armhf] drm/vc4: hvs: SCALER_DISPBKGND_AUTOHS is only valid on HVS4
    - [arm64,armhf] drm/vc4: hvs: Correct interrupt masking bit assignment for
      HVS5
    - [arm64,armhf] drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
    - [arm64,armhf] drm/vc4: hdmi: Correct interlaced timings again
    - [arm64] drm/msm: clean event_thread->worker in case of an error
    - [arm64,armhf] drm/panel-edp: fix name for IVO product id 854b
    - scsi: qla2xxx: Fix exchange oversubscription
    - scsi: qla2xxx: Fix exchange oversubscription for management commands
    - scsi: qla2xxx: edif: Fix clang warning
    - [arm64] ASoC: fsl_sai: initialize is_dsp_mode flag
    - [arm64] drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
    - ALSA: hda/ca0132: minor fix for allocation size
    - drm/amdgpu: Use the sched from entity for amdgpu_cs trace
    - [arm64] drm/msm/gem: Add check for kmalloc
    - [arm64] drm/msm/dpu: Disallow unallocated resources to be returned
    - drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
    - [armhf] drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags
    - [arm64] drm/msm/dsi: Allow 2 CTRLs on v2.5.0
    - scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096
    - [arm64] drm/msm/dpu: sc7180: add missing WB2 clock control
    - [arm64] drm/msm: use strscpy instead of strncpy
    - [arm64] drm/msm/dpu: Add check for cstate
    - [arm64] drm/msm/dpu: Add check for pstates
    - [arm64] drm/msm/mdp5: Add check for kzalloc
    - [arm64,armhf] pinctrl: bcm2835: Remove of_node_put() in
      bcm2835_of_gpio_ranges_fallback()
    - [arm64,armhf] drm/tegra: firewall: Check for is_addr_reg existence in IMM
      check
    - [arm64] drm/msm/dpu: set pdpu->is_rt_pipe early in
      dpu_plane_sspp_atomic_update()
    - [x86] ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
    - [arm64,armhf] gpio: vf610: connect GPIO label to dev name
    - [x86] ASoC: topology: Properly access value coming from topology file
    - dm: improve shrinker debug names
    - regmap: apply reg_base and reg_downshift for single register ops
    - [x86] hwmon: (asus-ec-sensors) add missing mutex path
    - ALSA: hda: Fix the control element identification for multiple codecs
    - drm/amdgpu: fix enum odm_combine_mode mismatch
    - scsi: mpt3sas: Fix a memory leak
    - scsi: aic94xx: Add missing check for dma_map_single()
    - HID: multitouch: Add quirks for flipped axes
    - HID: retain initial quirks set up when creating HID devices
    - drm/amd/display: don't call dc_interrupt_set() for disabled crtcs
    - HID: logitech-hidpp: Hard-code HID++ 1.0 fast scroll support
    - dm: remove flush_scheduled_work() during local_exit()
    - nfs4trace: fix state manager flag printing
    - NFS: fix disabling of swap
    - HID: bigben: use spinlock to protect concurrent accesses
    - HID: bigben_worker() remove unneeded check on report_field
    - HID: bigben: use spinlock to safely schedule workers (CVE-2023-25012)
    - hid: bigben_probe(): validate report count
    - ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU Macbooks
    - drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()
    - NFSD: enhance inter-server copy cleanup
    - NFSD: fix leaked reference count of nfsd4_ssc_umount_item
    - nfsd: fix race to check ls_layouts
    - nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
    - NFSD: fix problems with cleanup on errors in nfsd4_copy
    - nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open
    - nfsd: don't fsync nfsd_files on last close
    - NFSD: copy the whole verifier in nfsd_copy_write_verifier
    - cifs: Fix lost destroy smbd connection when MR allocate failed
    - cifs: Fix warning and UAF when destroy the MR list
    - cifs: use tcon allocation functions even for dummy tcon
    - gfs2: jdata writepage fix
    - leds: led-core: Fix refcount leak in of_led_get()
    - [x86] leds: simatic-ipc-leds-gpio: Make sure we have the GPIO providing
      driver
    - [amd64] dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
    - [arm64] RDMA/hns: Fix refcount leak in hns_roce_mmap
    - iio: light: tsl2563: Do not hardcode interrupt trigger type
    - i2c: designware: fix i2c_dw_clk_rate() return size to be u32
    - soundwire: cadence: Don't overflow the command FIFOs
    - driver core: fix potential null-ptr-deref in device_add()
    - kobject: modify kobject_get_path() to take a const *
    - kobject: Fix slab-out-of-bounds in fill_kobj_path()
    - media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()
    - media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU
    - media: uvcvideo: Refactor uvc_ctrl_mappings_uvcXX
    - media: uvcvideo: Refactor power_line_frequency_controls_limited
    - [arm64] coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR
    - PCI/IOV: Enlarge virtfn sysfs name buffer
    - [arm64] tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown()
    - [arm64] tty: serial: fsl_lpuart: clear LPUART Status Register in
      lpuart32_shutdown()
    - [arm64,armhf] serial: tegra: Add missing clk_disable_unprepare() in
      tegra_uart_hw_init()
    - [x86] Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in
      set_protocol"
    - applicom: Fix PCI device refcount leak in applicom_init()
    - [x86] VMCI: check context->notify_page after call to get_user_pages_fast()
      to avoid GPF
    - [x86] misc/mei/hdcp: Use correct macros to initialize uuid_le
    - driver core: fix resource leak in device_add()
    - driver core: location: Free struct acpi_pld_info *pld before return false
    - drivers: base: transport_class: fix possible memory leak
    - drivers: base: transport_class: fix resource leak when
      transport_add_device() fails
    - firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
    - [arm64] tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma
      case
    - RDMA/cxgb4: add null-ptr-check after ip_dev_find()
    - usb: gadget: configfs: Restrict symlink creation is UDC already binded
    - PCI: mt7621: Delay phy ports initialization
    - [amd64] iommu/vt-d: Set No Execute Enable bit in PASID table entry
    - power: supply: remove faulty cooling logic
    - RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()
    - RDMA/irdma: Cap MSIX used to online CPUs + 1
    - [arm64] serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
    - [arm64,armhf] tty: serial: imx: Handle RS485 DE signal active high
    - [arm64,armhf] tty: serial: imx: disable Ageing Timer interrupt request irq
    - driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links
    - driver core: fw_devlink: Don't purge child fwnode's consumer links
    - driver core: fw_devlink: Allow marking a fwnode link as being part of a
      cycle
    - driver core: fw_devlink: Consolidate device link flag computation
    - driver core: fw_devlink: Improve check for fwnode with no device/driver
    - driver core: fw_devlink: Make cycle detection more robust
    - mtd: mtdpart: Don't create platform device that'll never probe
    - [arm64] usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev
    - PCI: Fix dropping valid root bus resources with .end = zero
    - [arm64] phy: rockchip-typec: fix tcphy_get_mode error case
    - [arm64] PCI: qcom: Fix host-init error handling
    - iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()
    - iommu: Fix error unwind in iommu_group_alloc()
    - [amd64] iommu/amd: Do not identity map v2 capable device when snp is
      enabled
    - [amd64] iommu/vt-d: Fix error handling in sva enable/disable paths
    - [amd64] iommu/vt-d: Allow to use flush-queue when first level is default
    - RDMA/rxe: cleanup some error handling in rxe_verbs.c
    - RDMA/rxe: Fix missing memory barriers in rxe_queue.h
    - [amd64] IB/hfi1: Fix math bugs in hfi1_can_pin_pages()
    - [amd64] IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
    - [armhf] media: platform: ti: Add missing check for devm_regulator_get
    - [armhf] media: imx: imx7-media-csi: fix missing clk_disable_unprepare() in
      imx7_csi_init()
    - media: mc: Get media_device directly from pad
    - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
      (CVE-2023-1118)
    - media: usb: siano: Fix use after free bugs caused by do_submit_urb
    - media: saa7134: Use video_unregister_device for radio_dev
    - [arm64] rpmsg: glink: Avoid infinite loop on intent for missing channel
    - [arm64] rpmsg: glink: Release driver_override
    - [armhf] OMAP2+: omap4-common: Fix refcount leak bug
    - udf: Define EFSCORRUPTED error code
    - exit: Detect and fix irq disabled state in oops
    - fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
    - blk-iocost: fix divide by 0 error in calc_lcoefs()
    - blk-cgroup: dropping parent refcount after pd_free_fn() is done
    - blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and
      blkcg_deactivate_policy()
    - trace/blktrace: fix memory leak with using debugfs_lookup()
    - btrfs: scrub: improve tree block error reporting
    - cpuidle, intel_idle: Fix CPUIDLE_FLAG_INIT_XSTATE
    - [x86] fpu: Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads
    - cpuidle: drivers: firmware: psci: Dont instrument suspend code
    - cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG
    - [x86] perf/x86/intel/uncore: Add Meteor Lake support
    - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
    - wifi: ath11k: fix monitor mode bringup crash
    - wifi: brcmfmac: Fix potential stack-out-of-bounds in
      brcmf_c_preinit_dcmds()
    - rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
    - rcu: Suppress smp_processor_id() complaint in
      synchronize_rcu_expedited_wait()
    - srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL
    - rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
    - rcu-tasks: Handle queue-shrink/callback-enqueue race condition
    - wifi: ath11k: debugfs: fix to work with multiple PCI devices
    - [x86] thermal: intel: Fix unsigned comparison with less than zero
    - timers: Prevent union confusion from unexpected restart_syscall()
    - [x86] bugs: Reset speculation control settings on init
    - wifi: brcmfmac: ensure CLM version is null-terminated to prevent
      stack-out-of-bounds
    - wifi: mt7601u: fix an integer underflow
    - inet: fix fast path in __inet_hash_connect()
    - ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB
    - ice: add missing checks for PF vsi type
    - ACPI: Don't build ACPICA with '-Os'
    - bpf, docs: Fix modulo zero, division by zero, overflow, and underflow
    - [x86] thermal: intel: intel_pch: Add support for Wellsburg PCH
    - clocksource: Suspend the watchdog temporarily when high read latency
      detected
    - net: bcmgenet: Add a check for oversized packets
    - [s390x] mm,ptdump: avoid Kasan vs Memcpy Real markers swapping
    - netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj()
    - can: isotp: check CAN address family in isotp_bind()
    - wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
    - ACPI: video: Fix Lenovo Ideapad Z570 DMI match
    - net/mlx5: fw_tracer: Fix debug print
    - coda: Avoid partial allocation of sig_inputArgs
    - uaccess: Add minimum bounds check on kernel buffer size
    - [s390x] idle: mark arch_cpu_idle() noinstr
    - time/debug: Fix memory leak with using debugfs_lookup()
    - PM: domains: fix memory leak with using debugfs_lookup()
    - PM: EM: fix memory leak with using debugfs_lookup()
    - Bluetooth: Fix issue with Actions Semi ATS2851 based devices
    - Bluetooth: btusb: Add new PID/VID 0489:e0f2 for MT7921
    - Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
    - wifi: rtw89: debug: avoid invalid access on RTW89_DBG_SEL_MAC_30
    - hv_netvsc: Check status in SEND_RNDIS_PKT completion message
    - [s390x] kfence: fix page fault reporting
    - devlink: Fix TP_STRUCT_entry in trace of devlink health report
    - scm: add user copy checks to put_cmsg()
    - drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab 3 X90F
    - drm: panel-orientation-quirks: Add quirk for DynaBook K50
    - drm/amd/display: Reduce expected sdp bandwidth for dcn321
    - drm/amd/display: Revert Reduce delay when sink device not able to ACK
      00340h write
    - drm/amd/display: Fix potential null-deref in dm_resume
    - [armhf] drm/omap: dsi: Fix excessive stack usage
    - HID: Add Mapping for System Microphone Mute
    - drm/amd/display: Defer DIG FIFO disable after VID stream enable
    - drm/radeon: free iio for atombios when driver shutdown
    - drm/amd: Avoid BUG() for case of SRIOV missing IP version
    - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware
      write
    - Revert "fbcon: don't lose the console font across generic->chip driver
      switch"
    - drm/amd: Avoid ASSERT for some message failures
    - drm: amd: display: Fix memory leakage
    - drm/amd/display: fix mapping to non-allocated address
    - HID: uclogic: Add frame type quirk
    - HID: uclogic: Add battery quirk
    - HID: uclogic: Add support for XP-PEN Deco Pro SW
    - HID: uclogic: Add support for XP-PEN Deco Pro MW
    - [arm64] drm/msm/dsi: Add missing check for alloc_ordered_workqueue
    - drm/amd/display: Set hvm_enabled flag for S/G mode
    - [arm64] drm/msm/dpu: Add DSC hardware blocks to register snapshot
    - [x86] ASoC: soc-compress: Reposition and add pcm_mutex
    - [armel,armhf] ASoC: kirkwood: Iterate over array indexes instead of using
      pointer math
    - [armhf] regulator: s5m8767: Bounds check id indexing into arrays
    - Revert "drm/amdgpu: TA unload messages are not actually sent to psp when
      amdgpu is uninstalled"
    - drm/amd/display: fix FCLK pstate change underflow
    - gfs2: Improve gfs2_make_fs_rw error handling
    - [x86] hwmon: (coretemp) Simplify platform device handling
    - hwmon: (nct6775) Directly call ASUS ACPI WMI method
    - hwmon: (nct6775) B650/B660/X670 ASUS boards support
    - drm/amd/display: Do not commit pipe when updating DRR
    - scsi: ufs: core: Fix device management cmd timeout flow
    - HID: logitech-hidpp: Don't restart communication if not necessary
    - drm/amd/display: Enable P-state validation checks for DCN314
    - drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
    - drm/amd/display: Disable HUBP/DPP PG on DCN314 for now
    - dm thin: add cond_resched() to various workqueue loops
    - dm cache: add cond_resched() to various workqueue loops
    - nfsd: zero out pointers after putting nfsd_files on COPY setup error
    - nfsd: don't hand out delegation on setuid files being opened for write
    - cifs: prevent data race in smb2_reconnect()
    - drm/shmem-helper: Revert accidental non-GPL export
    - driver core: fw_devlink: Avoid spurious error message
    - wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
    - scsi: mpt3sas: Remove usage of dma_get_required_mask() API
      (Closes: #1022126)
    - firmware: coreboot: framebuffer: Ignore reserved pixel color bits
    - block: don't allow multiple bios for IOCB_NOWAIT issue
    - block: clear bio->bi_bdev when putting a bio back in the cache
    - block: be a bit more careful in checking for NULL bdev while polling
    - [arm64] rtc: pm8xxx: fix set-alarm race
    - ipmi:ssif: resend_msg() cannot fail
    - ipmi_ssif: Rename idle state and check
    - io_uring: Replace 0-length array with flexible array
    - io_uring: use user visible tail in io_uring_poll()
    - io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
    - io_uring: add a conditional reschedule to the IOPOLL cancelation loop
    - io_uring: add reschedule point to handle_tw_list()
    - io_uring/rsrc: disallow multi-source reg buffers
    - io_uring: remove MSG_NOSIGNAL from recvmsg
    - io_uring: fix fget leak when fs don't support nowait buffered read
    - [s390x] extmem: return correct segment type in __segment_load()
    - [s390x] discard .interp section
    - [s390x] kprobes: fix irq mask clobbering on kprobe reenter from
      post_handler
    - [s390x] kprobes: fix current_kprobe never cleared after kprobes reenter
    - [s390x] KVM: s390: disable migration mode when dirty tracking is disabled
    - cifs: Fix uninitialized memory read in smb3_qfs_tcon()
    - cifs: Fix uninitialized memory reads for oparms.mode
    - cifs: fix mount on old smb servers
    - cifs: introduce cifs_io_parms in smb2_async_writev()
    - cifs: split out smb3_use_rdma_offload() helper
    - cifs: don't try to use rdma offload on encrypted connections
    - cifs: Check the lease context if we actually got a lease
    - cifs: return a single-use cfid if we did not get a lease
    - scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi
    - btrfs: hold block group refcount during async discard
    - locking/rwsem: Prevent non-first waiter from spinning in down_write()
      slowpath
    - ksmbd: fix wrong data area length for smb2 lock request
    - ksmbd: do not allow the actual frame length to be smaller than the rfc1002
      length
    - ksmbd: fix possible memory leak in smb2_lock()
    - io_uring: mark task TASK_RUNNING before handling resume/task work
    - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
    - fs: hfsplus: fix UAF issue in hfsplus_put_super
    - exfat: fix reporting fs error when reading dir beyond EOF
    - exfat: fix unexpected EOF while reading dir
    - exfat: redefine DIR_DELETED as the bad cluster number
    - exfat: fix inode->i_blocks for non-512 byte sector size device
    - fs: dlm: don't set stop rx flag after node reset
    - fs: dlm: move sending fin message into state change handling
    - fs: dlm: send FIN ack back in right cases
    - f2fs: fix information leak in f2fs_move_inline_dirents()
    - f2fs: retry to update the inode page given data corruption
    - f2fs: fix cgroup writeback accounting with fs-layer encryption
    - f2fs: fix kernel crash due to null io->bio
    - ocfs2: fix defrag path triggering jbd2 ASSERT
    - ocfs2: fix non-auto defrag path not working issue
    - udf: Truncate added extents on failed expansion
    - udf: Do not bother merging very long extents
    - udf: Do not update file length for failed writes to inline files
    - udf: Preserve link count of system files
    - udf: Detect system inodes linked into directory hierarchy
    - udf: Fix file corruption when appending just after end of preallocated
      extent
    - md: don't update recovery_cp when curr_resync is ACTIVE
    - KVM: Destroy target device if coalesced MMIO unregistration fails
    - [x86] KVM: VMX: Fix crash due to uninitialized current_vmcs
    - KVM: Register /dev/kvm as the _very_ last thing during initialization
    - [x86] KVM: x86: Purge "highest ISR" cache when updating APICv state
    - [x86] KVM: x86: Blindly get current x2APIC reg value on "nodecode write"
      traps
    - [x86] KVM: x86: Don't inhibit APICv/AVIC on xAPIC ID "change" if APIC is
      disabled
    - [x86] KVM: x86: Don't inhibit APICv/AVIC if xAPIC ID mismatch is due to
      32-bit ID
    - [x86] KVM: SVM: Flush the "current" TLB when activating AVIC
    - [x86] KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid
      target
    - [x86] KVM: SVM: Don't put/load AVIC when setting virtual APIC mode
    - [x86] KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
    - [x86] KVM: x86: Inject #GP on x2APIC WRMSR that sets reserved bits 63:32
    - [x86] KVM: SVM: Fix potential overflow in SEV's send|receive_update_data()
    - [x86] KVM: SVM: hyper-v: placate modpost section mismatch error
    - [x86] virt: Force GIF=1 prior to disabling SVM (for reboot flows)
    - [x86] crash: Disable virt in core NMI crash handler to avoid double
      shootdown
    - [x86] reboot: Disable virtualization in an emergency if SVM is supported
    - [x86] reboot: Disable SVM, not just VMX, when stopping CPUs
    - [x86] kprobes: Fix __recover_optprobed_insn check optimizing logic
    - [x86] kprobes: Fix arch_check_optimized_kprobe check within
      optimized_kprobe range
    - [x86] microcode/amd: Remove load_microcode_amd()'s bsp parameter
    - [x86] microcode/AMD: Add a @cpu parameter to the reloading functions
    - [x86] microcode/AMD: Fix mixed steppings support
    - [x86] speculation: Allow enabling STIBP with legacy IBRS
    - Documentation/hw-vuln: Document the interaction between IBRS and STIBP
    - [amd64] virt/sev-guest: Return -EIO if certificate buffer is not large
      enough
    - brd: mark as nowait compatible
    - brd: return 0/-error from brd_insert_page()
    - brd: check for REQ_NOWAIT and set correct page allocation mask
    - ima: fix error handling logic when file measurement failed
    - ima: Align ima_file_mmap() parameters with mmap_file LSM hook
    - irqdomain: Fix association race
    - irqdomain: Fix disassociation race
    - irqdomain: Look for existing mapping only once
    - irqdomain: Drop bogus fwspec-mapping error handling
    - irqdomain: Refactor __irq_domain_alloc_irqs()
    - irqdomain: Fix mapping-creation race
    - irqdomain: Fix domain registration race
    - [x86] crypto: qat - fix out-of-bounds read
    - ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
    - ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
    - jbd2: fix data missing when reusing bh which is ready to be checkpointed
    - ext4: optimize ea_inode block expansion
    - ext4: refuse to create ea block when umounted
    - [amd64,arm64] cxl/pmem: Fix nvdimm registration races
    - mtd: spi-nor: sfdp: Fix index value for SCCR dwords
    - mtd: spi-nor: spansion: Consider reserved bits in CFR5 register
    - mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
    - dm: send just one event on resize, not two
    - dm: add cond_resched() to dm_wq_work()
    - dm: add cond_resched() to dm_wq_requeue_work()
    - wifi: rtw88: use RTW_FLAG_POWERON flag to prevent to power on/off twice
    - wifi: rtl8xxxu: Use a longer retry limit of 48
    - wifi: ath11k: allow system suspend to survive ath11k
    - wifi: cfg80211: Fix use after free for wext
    - wifi: cfg80211: Set SSID if it is not already set
    - cpuidle: add ARCH_SUSPEND_POSSIBLE dependencies
    - qede: fix interrupt coalescing configuration
    - [x86] thermal: intel: powerclamp: Fix cur_state for multi package system
    - dm flakey: fix logic when corrupting a bio
    - dm cache: free background tracker's queued work in btracker_destroy
    - dm flakey: don't corrupt the zero page
    - dm flakey: fix a bug with 32-bit highmem systems
    - hwmon: (nct6775) Fix incorrect parenthesization in nct6775_write_fan_div()
    - [arm64] mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP
    - fuse: add inode/permission checks to fileattr_get/fileattr_set
    - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
    - ceph: update the time stamps and try to drop the suid/sgid
    - regulator: core: Use ktime_get_boottime() to determine how long a
      regulator was off
    - panic: fix the panic_print NMI backtrace setting
    - mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON
    - dax/kmem: Fix leak of memory-hotplug resources
    - mm: memcontrol: deprecate charge moving
    - mm/thp: check and bail out if page in deferred queue already
    - kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
    - memory tier: release the new_memtier in find_create_memory_tier()
    - ring-buffer: Handle race between rb_move_tail and rb_check_pages
    - tracing/eprobe: Fix to add filter on eprobe description in README file
    - [amd64] iommu/amd: Add a length limitation for the ivrs_acpihid
      command-line parameter
    - [amd64] iommu/amd: Improve page fault error reporting
    - scsi: aacraid: Allocate cmd_priv with scsicmd
    - scsi: qla2xxx: Fix link failure in NPIV environment
    - scsi: qla2xxx: Check if port is online before sending ELS
    - scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
    - scsi: qla2xxx: Remove unintended flag clearing
    - scsi: qla2xxx: Fix erroneous link down
    - scsi: qla2xxx: Remove increment of interface err cnt
    - scsi: ses: Don't attach if enclosure has no components
    - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
    - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
    - scsi: ses: Fix possible desc_ptr out-of-bounds accesses
    - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
    - [riscv64] RISC-V: add a spin_shadow_stack declaration
    - [riscv64] Avoid enabling interrupts in die()
    - [riscv64] mm: fix regression due to update_mmu_cache change
    - [riscv64] jump_label: Fixup unaligned arch_static_branch function
    - [riscv64] mm: Perform BPF exhandler fixup on page fault
    - [riscv64] ftrace: Remove wasted nops for !RISCV_ISA_C
    - [riscv64] ftrace: Reduce the detour code size to half
    - PCI/PM: Observe reset delay irrespective of bridge_d3
    - PCI: Unify delay handling for reset and resume
    - PCI: hotplug: Allow marking devices as disconnected during bind/unbind
    - PCI: Avoid FLR for AMD FCH AHCI adapters
    - PCI/DPC: Await readiness of secondary bus after reset
    - [amd64] iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode
    - [amd64] iommu/vt-d: Fix PASID directory pointer coherency
    - vfio/type1: exclude mdevs from VFIO_UPDATE_VADDR
    - vfio/type1: prevent underflow of locked_vm via exec()
    - vfio/type1: track locked_vm per dma
    - vfio/type1: restore locked_vm
    - drm/amd: Fix initialization for nbio 7.5.1
    - [x86] drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
    - drm/radeon: Fix eDP for single-display iMac11,2
    - [x86] drm/i915: Don't use stolen memory for ring buffers with LLC
    - [x86] drm/i915: Don't use BAR mappings for ring buffers with LLC
    - drm/edid: fix AVI infoframe aspect ratio handling
    - drm/edid: fix parsing of 3D modes from HDMI VSDB
    - qede: avoid uninitialized entries in coal_entry array
    - brd: use radix_tree_maybe_preload instead of radix_tree_preload
    - sbitmap: Advance the queue index before waking up a queue
    - wait: Return number of exclusive waiters awaken
    - sbitmap: Try each queue to wake up at least one waiter
    - net: avoid double iput when sock_alloc_file fails (CVE-2023-1032)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.17
    - Revert "blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and
      blkcg_deactivate_policy()"
    - Revert "blk-cgroup: dropping parent refcount after pd_free_fn() is done"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.18
    - net/sched: Retire tcindex classifier
    - fs/jfs: fix shift exponent db_agl2size negative
    - [arm64] driver: soc: xilinx: fix memory leak in
      xlnx_add_cb_for_notify_event()
    - f2fs: don't rely on F2FS_MAP_* in f2fs_iomap_begin
    - f2fs: fix to avoid potential deadlock
    - objtool: Fix memory leak in create_static_call_sections()
    - [armhf] pwm: stm32-lp: fix the check on arr and cmp registers update
    - f2fs: introduce trace_f2fs_replace_atomic_write_block
    - f2fs: correct i_size change for atomic writes
    - f2fs: clear atomic_write_task in f2fs_abort_atomic_write()
    - fs: f2fs: initialize fsdata in pagecache_write()
    - f2fs: allow set compression option of files without blocks
    - f2fs: fix to abort atomic write only during do_exist()
    - ubi: ensure that VID header offset + VID header size <= alloc, size
    - ubifs: Fix memory leak in ubifs_sysfs_init()
    - ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
    - ubifs: Rectify space budget for ubifs_xrename()
    - ubifs: Fix wrong dirty space budget for dirty inode
    - ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
    - ubifs: Reserve one leb for each journal head while doing budget
    - ubi: Fix use-after-free when volume resizing failed
    - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
    - ubifs: Fix memory leak in alloc_wbufs()
    - ubi: Fix possible null-ptr-deref in ubi_free_volume()
    - ubifs: Re-statistic cleaned znode count if commit failed
    - ubifs: dirty_cow_znode: Fix memleak in error handling path
    - ubifs: ubifs_writepage: Mark page dirty after writing inode failed
    - ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process
    - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
    - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
    - f2fs: fix to avoid potential memory corruption in
      __update_iostat_latency()
    - ext4: use ext4_fc_tl_mem in fast-commit replay path
    - ext4: don't show commit interval if it is zero
    - netfilter: nf_tables: allow to fetch set elements when table has an owner
    - [x86] um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
    - f2fs: synchronize atomic write aborts
    - watchdog: Fix kmemleak in watchdog_cdev_register
    - watchdog: pcwd_usb: Fix attempting to access uninitialized memory
    - [arm64] watchdog: sbsa_wdog: Make sure the timeout programming is within
      the limits
    - netfilter: ctnetlink: fix possible refcount leak in
      ctnetlink_create_conntrack()
    - netfilter: conntrack: fix rmmod double-free race
    - netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
    - netfilter: ebtables: fix table blob use-after-free
    - netfilter: xt_length: use skb len to match in length_mt6
    - netfilter: ctnetlink: make event listener tracking global
    - netfilter: x_tables: fix percpu counter block leak on error path when
      creating new netns
    - ptp: vclock: use mutex to fix "sleep on atomic" bug
    - ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
    - net: sunhme: Fix region request
    - sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
    - net: fix __dev_kfree_skb_any() vs drop monitor
    - 9p/xen: fix version parsing
    - 9p/xen: fix connection sequence
    - 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
    - mlx5: fix skb leak while fifo resync and push
    - mlx5: fix possible ptp queue fifo use-after-free
    - net/mlx5: ECPF, wait for VF pages only after disabling host PFs
    - net/mlx5e: Verify flow_source cap before using it
    - net/mlx5: Geneve, Fix handling of Geneve object id as error code
    - ext4: fix incorrect options show of original mount_opt and extend
      mount_opt2
    - nfc: fix memory leak of se_io context in nfc_genl_se_io
    - net/sched: transition act_pedit to rcu and percpu stats
    - net/sched: act_pedit: fix action bind logic
    - net/sched: act_mpls: fix action bind logic
    - net/sched: act_sample: fix action bind logic
    - [arm64] net: dsa: felix: fix internal MDIO controller resource length
    - tcp: tcp_check_req() can be called from process context
    - vc_screen: modify vcs_size() handling in vcs_read()
    - [arm64,armhf] rtc: sun6i: Always export the internal oscillator
    - genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
    - scsi: ipr: Work around fortify-string warning
    - rtc: allow rtc_read_alarm without read_alarm callback
    - io_uring: fix size calculation when registering buf ring
    - loop: loop_set_status_from_info() check before assignment
    - nvme: bring back auto-removal of deleted namespaces during sequential scan
    - nvme-tcp: don't access released socket during error recovery
    - tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
    - kernel/printk/index.c: fix memory leak with using debugfs_lookup()
    - [x86] firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
    - bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC
      support
    - [amd64] IB/hfi1: Update RMT size calculation
    - [amd64] iommu/amd: Fix error handling for pdev_pri_ats_enable()
    - PCI/ACPI: Account for _S0W of the target bridge in acpi_pci_bridge_d3()
    - media: uvcvideo: Remove format descriptions
    - media: uvcvideo: Handle cameras with invalid descriptors
    - media: uvcvideo: Handle errors from calls to usb_string
    - media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
    - media: uvcvideo: Silence memcpy() run-time false positive warnings
    - USB: fix memory leak with using debugfs_lookup()
    - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
    - tty: fix out-of-bounds access in tty_driver_lookup_tty()
    - [arm64] tty: serial: fsl_lpuart: disable the CTS when send break signal
    - [x86] mei: bus-fixup:upon error print return values of send and receive
    - iio: accel: mma9551_core: Prevent uninitialized variable in
      mma9551_read_status_word()
    - iio: accel: mma9551_core: Prevent uninitialized variable in
      mma9551_read_config_word()
    - media: uvcvideo: Add GUID for BGRA/X 8:8:8:8
    - soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe()
    - [arm64,armhf] USB: dwc3: fix memory leak with using debugfs_lookup()
    - [arm64,armhf] USB: chipidea: fix memory leak with using debugfs_lookup()
    - [arm64,armhf] USB: ULPI: fix memory leak with using debugfs_lookup()
    - USB: uhci: fix memory leak with using debugfs_lookup()
    - USB: sl811: fix memory leak with using debugfs_lookup()
    - [mips64el,mipsel] USB: isp116x: fix memory leak with using
      debugfs_lookup()
    - [arm64,armhf] usb: host: xhci: mvebu: Iterate over array indexes instead
      of using pointer math
    - USB: ene_usb6250: Allocate enough memory for full object
    - usb: uvc: Enumerate valid values for color matching
    - usb: gadget: uvc: Make bSourceID read/write
    - PCI: Align extra resources for hotplug bridges properly
    - PCI: Take other bus devices into account when distributing resources
    - PCI: Distribute available resources for root buses, too
    - [i386] tty: pcn_uart: fix memory leak with using debugfs_lookup()
    - [x86] misc: vmw_balloon: fix memory leak with using debugfs_lookup()
    - drivers: base: component: fix memory leak with using debugfs_lookup()
    - drivers: base: dd: fix memory leak with using debugfs_lookup()
    - PCI: Add ACS quirk for Wangxun NICs
    - PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
    - [arm64] phy: rockchip-typec: Fix unsigned comparison with less than zero
    - RDMA/cma: Distinguish between sockaddr_in and sockaddr_in6 by size
    - iommu: Attach device group to old domain in error path
    - soundwire: cadence: Remove wasted space in response_buf
    - soundwire: cadence: Drain the RX FIFO after an IO timeout
    - net: tls: avoid hanging tasks on the tx_lock
    - [x86] resctl: fix scheduler confusion with 'current'
    - drm/display/dp_mst: Add drm_atomic_get_old_mst_topology_state()
    - drm/display/dp_mst: Fix down/up message handling after sink disconnect
    - drm/display/dp_mst: Fix down message handling after a packet reception
      error
    - drm/display/dp_mst: Fix payload addition on a disconnected sink
    - [x86] drm/i915/dp_mst: Add the MST topology state for modesetted CRTCs
    - [x86] drm/i915: Fix system suspend without fbdev being initialized
    - media: uvcvideo: Fix race condition with usb_kill_urb
    - io_uring: fix two assignments in if conditions
    - io_uring/poll: allow some retries for poll triggering spuriously
    - [arm64] efi: Make efi_rt_lock a raw_spinlock
    - [arm64] mte: Fix/clarify the PG_mte_tagged semantics
    - usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.19
    - tpm: disable hwrng for fTPM on some AMD designs
    - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for
      wext"
    - [x86] staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a
      script
    - [x86] staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.20
    - fs: prevent out-of-bounds array speculation when closing a file descriptor
    - btrfs: fix unnecessary increment of read error stat on write error
    - btrfs: fix percent calculation for bg reclaim message
    - io_uring/uring_cmd: ensure that device supports IOPOLL
    - erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms
    - fork: allow CLONE_NEWTIME in clone3 flags
    - [x86] CPU/AMD: Disable XSAVES on AMD family 0x17
    - drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15
    - drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc21
    - drm/amdgpu: fix error checking in amdgpu_read_mm_registers for nv
    - drm/display: Don't block HDR_OUTPUT_METADATA on unknown EOTF
    - drm/connector: print max_requested_bpc in state debugfs
    - staging: rtl8723bs: Fix key-store index handling
    - staging: rtl8723bs: Pass correct parameters to cfg80211_get_bss()
    - ext4: fix cgroup writeback accounting with fs-layer encryption
    - ext4: fix RENAME_WHITEOUT handling for inline directories
    - ext4: fix another off-by-one fsmap error on 1k block filesystems
    - ext4: move where set the MAY_INLINE_DATA flag is set
    - ext4: fix WARNING in ext4_update_inline_data
    - ext4: zero i_disksize when initializing the bootloader inode
    - HID: core: Provide new max_buffer_size attribute to over-ride the default
    - HID: uhid: Over-ride the default maximum data buffer value with our own
    - nfc: change order inside nfc_se_io error path
    - [x86] KVM: VMX: Reset eVMCS controls in VP assist page during hardware
      disabling
    - [x86] KVM: VMX: Don't bother disabling eVMCS static key on module exit
    - [x86] KVM: x86: Move guts of kvm_arch_init() to standalone helper
    - [x86] KVM: VMX: Do _all_ initialization before exposing /dev/kvm to
      userspace
    - fs: dlm: fix log of lowcomms vs midcomms
    - fs: dlm: add midcomms init/start functions
    - fs: dlm: start midcomms before scand
    - fs: dlm: remove send repeat remove handling
    - fs: dlm: use packet in dlm_mhandle
    - fd: dlm: trace send/recv of dlm message and rcom
    - fs: dlm: fix use after free in midcomms commit
    - fs: dlm: use WARN_ON_ONCE() instead of WARN_ON()
    - fs: dlm: be sure to call dlm_send_queue_flush()
    - fs: dlm: fix race setting stop tx flag
    - udf: Fix off-by-one error when discarding preallocation
    - bus: mhi: ep: Change state_lock to mutex
    - ipmi:ssif: Remove rtc_us_timer
    - ipmi:ssif: Increase the message retry time
    - ipmi:ssif: Add a timer between request retries
    - [x86] drm/i915: Introduce intel_panel_init_alloc()
    - [x86] drm/i915: Do panel VBT init early if the VBT declares an explicit
      panel type
    - [x86] drm/i915: Populate encoder->devdata for DSI on icl+
    - block: Revert "block: Do not reread partition table on exclusively open
      device"
    - block: fix scan partition for exclusively open device again
    - scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
    - ext4: Fix possible corruption when moving a directory
    - cifs: improve checking of DFS links over STATUS_OBJECT_NAME_INVALID
    - drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype
    - [arm64] drm/msm: Fix potential invalid ptr free
    - [arm64] drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register
    - [arm64] drm/msm/a5xx: fix highest bank bit for a530
    - [arm64] drm/msm/a5xx: fix the emptyness check in the preempt code
    - [arm64] drm/msm/a5xx: fix context faults during ring switch
    - tls: rx: fix return value for async crypto
    - [arm64] drm/msm/dpu: disable features unsupported by QCM2290
    - ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
    - netfilter: nft_last: copy content when cloning expression
    - netfilter: nft_quota: copy content when cloning expression
    - net: tls: fix possible race condition between do_tls_getsockopt_conf() and
      do_tls_setsockopt_conf() (CVE-2023-28466)
    - net: use indirect calls helpers for sk_exit_memory_pressure()
    - net: lan78xx: fix accessing the LAN7800's internal phy specific registers
      from the MAC driver
    - ice: copy last block omitted in ice_get_module_eeprom()
    - bpf, sockmap: Fix an infinite loop error when len is 0 in
      tcp_bpf_recvmsg_parser()
    - [arm64] drm/msm/dpu: fix len of sc7180 ctl blocks
    - [arm64] drm/msm/dpu: drop DPU_DIM_LAYER from MIXER_MSM8998_MASK
    - [arm64] drm/msm/dpu: fix clocks settings for msm8998 SSPP blocks
    - [arm64] drm/msm/dpu: clear DSPP reservations in rm release
    - net: stmmac: add to set device wake up flag when stmmac init phy
    - net: phylib: get rid of unnecessary locking
    - bnxt_en: Avoid order-5 memory allocation for TPA data
    - netfilter: ctnetlink: revert to dumping mark regardless of event type
    - netfilter: tproxy: fix deadlock due to missing BH disable
    - btrfs: fix extent map logging bit not cleared for split maps after
      dropping range
    - btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR
    - net: phy: smsc: fix link up detection in forced irq mode
    - net: tls: fix device-offloaded sendpage straddling records
    - scsi: megaraid_sas: Update max supported LD IDs to 240
    - scsi: sd: Fix wrong zone_write_granularity value during revalidate
    - netfilter: conntrack: adopt safer max chain length
    - block: fix wrong mode for blkdev_put() from disk_scan_partitions()
    - NFSD: Protect against filesystem freezing
    - ice: Fix DSCP PFC TLV creation
    - net/smc: fix fallback failed while sendmsg with fastopen
    - SUNRPC: Fix a server shutdown leak
    - af_unix: fix struct pid leaks in OOB support
    - erofs: Revert "erofs: fix kvcalloc() misuse with __GFP_NOFAIL"
    - [riscv64] Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
    - [riscv64] Don't check text_mutex during stop_machine
    - drm/amdgpu: fix return value check in kfd
    - ext4: Fix deadlock during directory rename
    - drm/amdgpu/soc21: don't expose AV1 if VCN0 is harvested
    - drm/amdgpu/soc21: Add video cap query support for VCN_4_0_4
    - [arm64] adreno: Shutdown the GPU properly
    - [arm64] drm/msm/adreno: fix runtime PM imbalance at unbind
    - watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths
    - tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address
    - [powerpc*] 64: Don't recurse irq replay
    - [powerpc*] iommu: fix memory leak with using debugfs_lookup()
    - [powerpc*] 64: Fix task_cpu in early boot when booting non-zero cpuid
    - [powerpc*] 64: Move paca allocation to early_setup()
    - PCI: Add SolidRun vendor ID
    - [arm64,armhf] media: rc: gpio-ir-recv: add remove function
    - drm/amd/display: Allow subvp on vactive pipes that are 2560x1440@60
    - drm/amd/display: adjust MALL size available for DCN32 and DCN321
    - filelocks: use mount idmapping for setlease permission check
    - Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES"

  [ Diederik de Haas ]
  * [arm64,armhf,riscv64] drivers/ata: Enable AHCI_DWC as module
    (Closes: #1032362)
  * drivers/net/can/spi/mcp251xfd: Enable CAN_MCP251XFD as module
    (Closes: #1032582)

  [ Salvatore Bonaccorso ]
  * [x86] drivers/platform/x86: Enable THINKPAD_LMI as module (Closes: #1032399)
  * [rt] Refresh "printk: Bring back the RT bits." for context changes in 6.1.16
  * Bump ABI to 7
  * net/sched: Drop setting of NET_CLS_TCINDEX (retired upstream)
  * net/kcm: Enable AF_KCM as module (Closes: #1023958)
  * [rt] Update to 6.1.19-rt8

  [ Cyril Brulebois ]
  * wifi: mt76: do not run mt76_unregister_device() on unregistered hw
    This prevents a kernel panic when unloading the module, which happens
    within the installer after firmware files have been deployed, at least
    with mt7921e (Closes: #1029116). Thanks to Helmut Grohne for the
    initial patch, which led upstream to propose this patch.
  * udeb: Add michael_mic to crypto-modules, for ath11k and others.
    Thanks to Nicolas Dandrimont for reporting and Benoît Chauvet for
    testing (See: #1032140).

  [ Héctor Orón Martínez ]
  * [powerpc/powerpc64,ppc64el] udeb: add DRM ast driver to fb-modules
    (Closes: #990016)

  [ Miguel Bernal Marin ]
  * Enable modules to be used by rasdaemon tool on Intel platforms
    (Closes: #1032467)
    - [amd64] drivers/edac: Enable EDAC_IGEN6 as module
    - [x86] drivers/acpi/apei: Enable ACPI_APEI_EINJ as module

  [ Alper Nebi Yasak ]
  * Enable important configs for ChromeOS boards:
    - Enable GOOGLE_VPD, GOOGLE_SMI, GOOGLE_FRAMEBUFFER_COREBOOT as modules
    - [x86] Enable FB_SIMPLE as built-in
    - [x86,armhf,arm64] Change GOOGLE_FRAMEBUFFER_COREBOOT and
      GOOGLE_COREBOOT_TABLE to built-in (except cloud-*)
    - [x86,arm64] Enable CHROMEOS_ACPI as module
    - [x86,arm64] Enable TCG_TIS_SPI_CR50 as built-in
    - [x86,arm64] Enable TCG_TIS_I2C_CR50 as module

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 19 Mar 2023 15:46:34 +0100

linux (6.1.15-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.13
    - mptcp: sockopt: make 'tcp_fastopen_connect' generic
    - mptcp: fix locking for setsockopt corner-case
    - mptcp: deduplicate error paths on endpoint creation
    - mptcp: fix locking for in-kernel listener creation
    - btrfs: move the auto defrag code to defrag.c
    - btrfs: lock the inode in shared mode before starting fiemap
    - [x86] ASoC: amd: yc: Add DMI support for new acer/emdoor platforms
    - [x86] ASoC: SOF: sof-audio: start with the right widget type
    - ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum610 Wireless
    - [x86] ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers
    - ALSA: hda: Do not unset preset when cleaning up codec
    - [x86] ASoC: amd: yc: Add Xiaomi Redmi Book Pro 15 2022 into DMI table
    - bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself
    - net/rose: Fix to not accept on connected socket
    - net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC
    - [powerpc*] 64: Fix perf profiling asynchronous interrupt handlers
    - fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work()
    - drm/nouveau/devinit/tu102-: wait for GFW_BOOT_PROGRESS == COMPLETED
    - net: sched: sch: Bounds check priority
    - nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
    - nvme: clear the request_queue pointers on failure in
      nvme_alloc_admin_tag_set
    - nvme: clear the request_queue pointers on failure in nvme_alloc_io_tag_set
    - drm/amd/display: Add missing brackets in calculation
    - drm/amd/display: Adjust downscaling limits for dcn314
    - drm/amd/display: Unassign does_plane_fit_in_mall function from dcn3.2
    - drm/amd/display: Reset DMUB mailbox SW state after HW reset
    - drm/amdgpu: enable HDP SD for gfx 11.0.3
    - drm/amdgpu: Enable vclk dclk node for gc11.0.3
    - drm/amd/display: Properly handle additional cases where DCN is not
      supported
    - ceph: move mount state enum to super.h
    - ceph: blocklist the kclient when receiving corrupted snap trace
    - of: reserved_mem: Have kmemleak ignore dynamically allocated reserved mem
    - mm: shrinkers: fix deadlock in shrinker debugfs
    - aio: fix mremap after fork null-deref
    - vmxnet3: move rss code block under eop descriptor
    - fbdev: Fix invalid page access after closing deferred I/O devices
    - drm/amd/amdgpu: fix warning during suspend
    - drm/amd/display: Fail atomic_check early on normalize_zpos error
    - drm/vmwgfx: Stop accessing buffer objects which failed init
    - drm/vmwgfx: Do not drop the reference to the handle too soon
    - [arm64] mmc: meson-gx: fix SDIO mode if cap_sdio_irq isn't set
    - mmc: sdio: fix possible resource leaks in some error paths
    - mmc: mmc_spi: fix error handling in mmc_spi_probe()
    - ALSA: hda: Fix codec device field initializan
    - ALSA: hda/conexant: add a new hda codec SN6180
    - ALSA: hda/realtek - fixed wrong gpio assigned
    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for a HP platform.
    - ALSA: hda/realtek: Enable mute/micmute LEDs and speaker support for HP
      Laptops
    - ata: ahci: Add Tiger Lake UP{3,4} AHCI controller
    - ata: libata-core: Disable READ LOG DMA EXT for Samsung MZ7LH
    - hugetlb: check for undefined shift on 32 bit architectures
    - nilfs2: fix underflow in second superblock position calculations
    - mm/MADV_COLLAPSE: set EAGAIN on unexpected page refcount
    - mm/filemap: fix page end in filemap_get_read_batch
    - mm/migrate: fix wrongly apply write bit after mkdirty on sparc64
    - freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL
    - Revert "mm: Always release pages to the buddy allocator in
      memblock_free_late()."
    - net: Fix unwanted sign extension in netdev_stats_to_stats64()
    - revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
    - [arm64,armhf] drm/vc4: crtc: Increase setup cost in core clock calculation
      to handle extreme reduced blanking
    - [arm64,armhf] drm/vc4: Fix YUV plane handling when planes are in different
      buffers
    - [x86] drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list
    - ice: fix lost multicast packets in promisc mode
    - ixgbe: allow to increase MTU to 3K with XDP enabled
    - i40e: add double of VLAN header when computing the max MTU
    - net: bgmac: fix BCM5358 support by setting correct flags
    - sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list
    - net/sched: tcindex: update imperfect hash filters respecting rcu
    - ice: xsk: Fix cleaning of XDP_TX frames
    - dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
    - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
    - net/sched: act_ctinfo: use percpu stats
    - net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
    - net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence
    - bnxt_en: Fix mqprio and XDP ring checking logic
    - tracing: Make trace_define_field_ext() static
    - net: stmmac: Restrict warning on disabling DMA store and fwd mode
    - net: use a bounce buffer for copying skb->mark
    - tipc: fix kernel warning when sending SYN message
    - net: mpls: fix stale pointer if allocation fails during device rename
      (CVE-2023-26545)
    - igb: conditionalize I2C bit banging on external thermal sensor support
    - igb: Fix PPS input and output using 3rd and 4th SDP
    - ixgbe: add double of VLAN header when computing the max MTU
    - ipv6: Fix datagram socket connection with DSCP.
    - ipv6: Fix tcp socket connection with DSCP.
    - mm/gup: add folio to list when folio_isolate_lru() succeed
    - mm: extend max struct page size for kmsan
    - i40e: Add checking for null for nlmsg_find_attr()
    - net/sched: tcindex: search key must be 16 bits
    - nvme-tcp: stop auth work after tearing down queues in error recovery
    - nvme-rdma: stop auth work after tearing down queues in error recovery
    - [x86] KVM: x86/pmu: Disable vPMU support on hybrid CPUs (host PMUs)
    - [x86] kvm: initialize all of the kvm_debugregs structure before sending it
      to userspace
    - [x86] perf/x86: Refuse to export capabilities for hybrid PMUs
    - alarmtimer: Prevent starvation by small intervals and SIG_IGN
    - nvme-pci: refresh visible attrs for cmb attributes
    - [x86] ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak
    - net: sched: sch: Fix off by one in htb_activate_prios()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.14
    - [arm64,armhf] drm/etnaviv: don't truncate physical page address
    - wifi: ath11k: fix warning in dma_free_coherent() of memory chunks while
      recovery
    - wifi: rtl8xxxu: gen2: Turn on the rate control
    - drm/edid: Fix minimum bpc supported with DSC1.2 for HDMI sink
    - sched/psi: Stop relying on timer_pending() for poll_work rescheduling
    - random: always mix cycle counter in add_latent_entropy()
    - scsi: libsas: Add smp_ata_check_ready_type()
    - [arm64] scsi: hisi_sas: Fix SATA devices missing issue during I_T nexus
      reset
    - docs: perf: Fix PMU instance name of hisi-pcie-pmu
    - [x86] KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception
    - [x86] KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid
    - [x86] KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
      (CVE-2022-2196)
    - [x86] drm/i915: Remove __maybe_unused from mtl_info
    - [x86] KVM: x86: fix deadlock for KVM_XEN_EVTCHN_RESET
    - [powerpc*] 64s/radix: Fix RWX mapping with relocated kernel
    - nfp: ethtool: support reporting link modes
    - nfp: ethtool: fix the bug of setting unsupported port speed
    - uaccess: Add speculation barrier to copy_from_user()
    - [x86] alternatives: Introduce int3_emulate_jcc()
    - [x86] alternatives: Teach text_poke_bp() to patch Jcc.d32 instructions
    - [x86] static_call: Add support for Jcc tail-calls
    - Bluetooth: btusb: Add more device IDs for WCN6855
    - [powerpc*] vmlinux.lds: Define RUNTIME_DISCARD_EXIT
    - [powerpc*] vmlinux.lds: Don't discard .rela* for relocatable builds
    - wifi: mwifiex: Add missing compatible string for SD8787
    - audit: update the mailing list in MAINTAINERS
    - [x86] platform/x86: nvidia-wmi-ec-backlight: Add force module parameter
    - ext4: Fix function prototype mismatch for ext4_feat_ktype
    - bpf: add missing header file include
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.15
    - Fix XFRM-I support for nested ESP tunnels
    - [arm64] dts: rockchip: reduce thermal limits on rk3399-pinephone-pro
    - [arm64] dts: rockchip: drop unused LED mode property from rk3328-roc-cc
    - [arm64] dts: rockchip: fix probe of analog sound card on rock-3a
    - HID: elecom: add support for TrackBall 056E:011C
    - HID: Ignore battery for Elan touchscreen on Asus TP420IA
    - [amd64,arm64] ACPI: NFIT: fix a potential deadlock during NFIT teardown
    - pinctrl: amd: Fix debug output for debounce time
    - btrfs: send: limit number of clones and allocated memory size
    - [x86] ASoC: rt715-sdca: fix clock stop prepare timeout issue
    - [amd64] IB/hfi1: Assign npages earlier
    - neigh: make sure used and confirmed times are valid
    - HID: core: Fix deadloop in hid_apply_multiplier.
    - [x86] ASoC: codecs: es8326: Fix DTS properties reading
    - [x86] HID: Ignore battery for ELAN touchscreen 29DF on HP
    - [x86] cpu: Add Lunar Lake M
    - PM: sleep: Avoid using pr_cont() in the tasks freezing code
    - bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
    - net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from
      sk_stream_kill_queues().
    - vc_screen: don't clobber return value in vcs_read
    - drm/amd/display: Move DCN314 DOMAIN power control to DMCUB
    - drm/amd/display: Fix race condition in DPIA AUX transfer
    - USB: serial: option: add support for VW/Skoda "Carstick LTE"
    - usb: gadget: u_serial: Add null pointer check in gserial_resume
    - usb: typec: pd: Remove usb_suspend_supported sysfs from sink PDO
    - drm/amd/display: Properly reuse completion structure
    - attr: add in_group_or_capable()
    - fs: move should_remove_suid()
    - attr: add setattr_should_drop_sgid()
    - attr: use consistent sgid stripping checks
    - fs: use consistent setgid checks in is_sxid()
    - USB: core: Don't hold device lock while reading the "descriptors" sysfs
      file

  [ Salvatore Bonaccorso ]
  * [rt] Update to 6.1.12-rt7
  * Bump ABI to 6

  [ Diederik de Haas ]
  * [arm64,armhf] udeb: Add sound and speakup packages (Closes: #1031289)

  [ Cyril Brulebois ]
  * udeb: Add qrtr_mhi to nic-wireless, for ath11k (Closes: #1032140)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 05 Mar 2023 16:33:00 +0100

linux (6.1.12-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.12
    - hv_netvsc: Allocate memory in netvsc_dma_map() with GFP_ATOMIC
    - btrfs: limit device extents to the device size
    - btrfs: zlib: zero-initialize zlib workspace
    - ALSA: hda/realtek: Add Positivo N14KP6-TG
    - ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
    - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360
    - ALSA: hda/realtek: Enable mute/micmute LEDs on HP Elitebook, 645 G9
    - ALSA: hda/realtek: Add quirk for ASUS UM3402 using CS35L41
    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for a HP platform.
    - Revert "PCI/ASPM: Save L1 PM Substates Capability for suspend/resume"
    - Revert "PCI/ASPM: Refactor L1 PM Substates Control Register programming"
    - tracing: Fix poll() and select() do not work on per_cpu trace_pipe and
      trace_pipe_raw
    - of/address: Return an error when no valid dma-ranges are found
      (Closes: #993612)
    - can: j1939: do not wait 250 ms if the same addr was already claimed
    - HID: logitech: Disable hi-res scrolling on USB (Closes: #1029584)
    - [amd64] IB/hfi1: Restore allocated resources on failed copyout
    - IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
    - xfrm: annotate data-race around use_time
    - RDMA/irdma: Fix potential NULL-ptr-dereference
    - [amd64] RDMA/usnic: use iommu_map_atomic() under spin_lock()
    - xfrm: fix bug with DSCP copy to v6 from v4 tunnel
    - of: Make OF framebuffer device names unique
    - net: phylink: move phy_device_free() to correctly release phy device
    - bonding: fix error checking in bond_debug_reregister()
    - [arm64,riscv64] net: macb: Perform zynqmp dynamic configuration only for
      SGMII interface
    - [arm64] net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal
      PHY
    - [arm64] cpufreq: qcom-hw: Fix cpufreq_driver->get() for non-LMH systems
    - uapi: add missing ip/ipv6 header dependencies for linux/stddef.h
    - [amd64] HID: amd_sfh: if no sensors are enabled, clean up
    - [x86] drm/i915: Don't do the WM0->WM1 copy w/a if WM1 is already enabled
    - drm/virtio: exbuf->fence_fd unmodified on interrupted wait
    - cpuset: Call set_cpus_allowed_ptr() with appropriate mask for task
    - ice: Do not use WQ_MEM_RECLAIM flag for workqueue
    - ice: Fix disabling Rx VLAN filtering with port VLAN enabled
    - ice: switch: fix potential memleak in ice_add_adv_recipe()
    - [arm64] net: mscc: ocelot: fix VCAP filters not matching on MAC with
      "protocol 802.1Q"
    - net/mlx5e: Update rx ring hw mtu upon each rx-fcs flag change
    - net/mlx5: Bridge, fix ageing of peer FDB entries
    - net/mlx5e: Fix crash unsetting rx-vlan-filter in switchdev mode
    - net/mlx5e: IPoIB, Show unknown speed instead of error
    - net/mlx5: Store page counters in a single array
    - net/mlx5: Expose SF firmware pages counter
    - net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers
    - net/mlx5: fw_tracer, Zero consumer index when reloading the tracer
    - net/mlx5: Serialize module cleanup with reload and remove
    - igc: Add ndo_tx_timeout support
    - txhash: fix sk->sk_txrehash default
    - rds: rds_rm_zerocopy_callback() use list_first_entry()
    - [arm64] net: mscc: ocelot: fix all IPv6 getting trapped to CPU when PTP
      timestamping is used
    - [arm64] dts: rockchip: set sdmmc0 speed to sd-uhs-sdr50 on rock-3a
    - ALSA: pci: lx6464es: fix a debug loop
    - [riscv64] stacktrace: Fix missing the first frame
    - [arm64] ASoC: fsl_sai: fix getting version from VERID
    - [x86] ASoC: topology: Return -ENOMEM on memory allocation failure
    - [riscv64] clk: microchip: mpfs-ccc: Use devm_kasprintf() for allocating
      formatted strings
    - [armhf] pinctrl: aspeed: Fix confusing types in return value
    - [arm64,armhf] pinctrl: single: fix potential NULL dereference
    - [armhf] pinctrl: aspeed: Revert "Force to disable the function's signal"
    - [x86] pinctrl: intel: Restore the pins that used to be in Direct IRQ mode
    - cifs: Fix use-after-free in rdata->read_into_pages()
    - net: USB: Fix wrong-direction WARNING in plusb.c
    - mptcp: do not wait for bare sockets' timeout
    - mptcp: be careful on subflow status propagation on errors
    - btrfs: simplify update of last_dir_index_offset when logging a directory
    - btrfs: free device in btrfs_close_devices for a single device filesystem
    - usb: core: add quirk for Alcor Link AK9563 smartcard reader
    - usb: typec: altmodes/displayport: Fix probe pin assign check
    - cxl/region: Fix null pointer dereference for resetting decoder
    - cxl/region: Fix passthrough-decoder detection
    - drm/amd/pm: add SMU 13.0.7 missing GetPptLimit message mapping
    - ceph: flush cap releases when the session is flushed
    - [amd64] nvdimm: Support sizeof(struct page) > MAX_STRUCT_PAGE_SIZE
    - [riscv64] Fixup race condition on PG_dcache_clean in flush_icache_pte
    - [riscv64] kprobe: Fixup misaligned load text
    - [powerpc*] 64s/interrupt: Fix interrupt exit race with security mitigation
      switch
    - drm/amdgpu: Use the TGID for trace_amdgpu_vm_update_ptes
    - tracing: Fix TASK_COMM_LEN in trace event format file
    - rtmutex: Ensure that the top waiter is always woken up
    - Fix page corruption caused by racy check in __free_pages
    - [arm64] efi: Force the use of SetVirtualAddressMap() on eMAG and Altra Max
      machines
    - drm/amd/pm: bump SMU 13.0.0 driver_if header version
    - drm/amdgpu: Add unique_id support for GC 11.0.1/2
    - drm/amd/pm: bump SMU 13.0.7 driver_if header version
    - drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini
    - drm/amdgpu/smu: skip pptable init under sriov
    - drm/amd/display: properly handling AGP aperture in vm setup
    - drm/amd/display: fix cursor offset on rotation 180
    - [x86] drm/i915: Move fd_install after last use of fence
    - [x86] drm/i915: Initialize the obj flags for shmem objects
    - [x86] drm/i915: Fix VBT DSI DVO port handling
    - [x86] speculation: Identify processors vulnerable to SMT RSB predictions
      (CVE-2022-27672)
    - [x86] KVM: x86: Mitigate the cross-thread return address predictions bug
      (CVE-2022-27672)
    - Documentation/hw-vuln: Add documentation for Cross-Thread Return
      Predictions (CVE-2022-27672)

  [ Helge Deller ]
  * [hppa] Fix i2c-modules udeb for parisc64

  [ John Paul Adrian Glaubitz ]
  * [alpha] Add i2c-modules to Depends for nic-shared-modules udeb
  * [powerpc,ppc64] Set DESTDIR= when installing bootwrapper (fixes FTBFS)

  [ Salvatore Bonaccorso ]
  * Bump ABI to 5

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 15 Feb 2023 06:56:21 +0100

linux (6.1.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.9
    - [armel,armhf] memory: mvebu-devbus: Fix missing clk_disable_unprepare in
      mvebu_devbus_probe()
    - [arm64] soc: imx: imx8mp-blk-ctrl: enable global pixclk with HDMI_TX_PHY
      PD
    - [armhf] dts: imx6ul-pico-dwarf: Use 'clock-frequency'
    - [armhf] imx: add missing of_node_put()
    - [arm64] soc: imx: imx8mp-blk-ctrl: don't set power device name
    - [amd64] HID: intel_ish-hid: Add check for ishtp_dma_tx_map
    - [arm64] soc: imx8m: Fix incorrect check for of_clk_get_by_name()
    - [arm64] firmware: arm_scmi: Harden shared memory access in fetch_response
    - [arm64] firmware: arm_scmi: Harden shared memory access in
      fetch_notification
    - [arm64] firmware: arm_scmi: Fix virtio channels cleanup on shutdown
    - [amd64] HID: amd_sfh: Fix warning unwind goto
    - tomoyo: fix broken dependency on *.conf.default
    - RDMA/rxe: Fix inaccurate constants in rxe_type_info
    - RDMA/rxe: Prevent faulty rkey generation
    - erofs: fix kvcalloc() misuse with __GFP_NOFAIL
    - RDMA/core: Fix ib block iterator counter overflow
    - [amd64] IB/hfi1: Reject a zero-length user expected buffer
    - [amd64] IB/hfi1: Reserve user expected TIDs
    - [amd64] IB/hfi1: Fix expected receive setup error exit issues
    - [amd64] IB/hfi1: Immediately remove invalid memory from hardware
    - [amd64] IB/hfi1: Remove user expected buffer invalidate race
    - affs: initialize fsdata in affs_truncate()
    - kbuild: export top-level LDFLAGS_vmlinux only to scripts/Makefile.vmlinux
    - kbuild: fix 'make modules' error when CONFIG_DEBUG_INFO_BTF_MODULES=y
    - [arm64] drm/msm/gpu: Fix potential double-free
    - NFSD: fix use-after-free in nfsd4_ssc_setup_dul()
    - [arm64,armhf] drm/vc4: bo: Fix drmm_mutex_init memory hog
    - bpf: hash map, avoid deadlock with suitable hash mask
    - [amd64,arm64] amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
    - [amd64,arm64] amd-xgbe: Delay AN timeout during KR training
    - bpf: Fix pointer-leak due to insufficient speculative store bypass
      mitigation
    - [amd64,arm64] drm/vc4: bo: Fix unused variable warning
    - [arm64] phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in
      rockchip_usb2phy_power_on()
    - net: nfc: Fix use-after-free in local_cleanup()
    - [arm64] net: enetc: avoid deadlock in enetc_tx_onestep_tstamp()
    - sch_htb: Avoid grafting on htb_destroy_class_offload when destroying htb
    - [arm64,armhf] gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock
    - [arm64,armhf] gpio: mxc: Always set GPIOs used as interrupt source to
      INPUT mode
    - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid
      (CVE-2023-23559)
    - [arm64,armhf] pinctrl: rockchip: fix reading pull type on rk3568
    - net: stmmac: Fix queue statistics reading
    - net/sched: sch_taprio: fix possible use-after-free
    - l2tp: convert l2tp_tunnel_list to idr
    - l2tp: close all race conditions in l2tp_tunnel_register()
    - net: usb: sr9700: Handle negative len
    - net: mdio: validate parameter addr in mdiobus_get_phy()
    - HID: check empty report_list in hid_validate_values()
    - HID: check empty report_list in bigben_probe()
    - net: stmmac: fix invalid call to mdiobus_get_phy()
    - [arm64,armhf] pinctrl: rockchip: fix mux route data for rk3568
    - HID: revert CHERRY_MOUSE_000C quirk
    - usb: ucsi: Ensure connector delayed work items are flushed
    - usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
    - usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
    - netfilter: conntrack: handle tcp challenge acks during connection reuse
    - Bluetooth: Fix a buffer overflow in mgmt_mesh_add()
    - Bluetooth: hci_conn: Fix memory leaks
    - Bluetooth: hci_sync: fix memory leak in hci_update_adv_data()
    - Bluetooth: ISO: Avoid circular locking dependency
    - Bluetooth: ISO: Fix possible circular locking dependency
    - Bluetooth: hci_event: Fix Invalid wait context
    - Bluetooth: Fix possible deadlock in rfcomm_sk_state_change
    - net/mlx5e: Avoid false lock dependency warning on tc_ht even more
    - net/mlx5: E-switch, Fix setting of reserved fields on
      MODIFY_SCHEDULING_ELEMENT
    - net/mlx5e: QoS, Fix wrongfully setting parent_element_id on
      MODIFY_SCHEDULING_ELEMENT
    - net/mlx5e: Set decap action based on attr for sample
    - net/mlx5: E-switch, Fix switchdev mode after devlink reload
    - net: mlx5: eliminate anonymous module_init & module_exit
    - dmaengine: Fix double increment of client_count in dma_chan_get()
    - net: macb: fix PTP TX timestamp failure due to packet padding
    - virtio-net: correctly enable callback during start_xmit
    - l2tp: prevent lockdep issue in l2tp_tunnel_register()
    - HID: betop: check shape of output reports
    - cifs: fix potential deadlock in cache_refresh_path()
    - drm/amd/display: fix issues with driver unload
    - net: sched: gred: prevent races when adding offloads to stats
    - nvme-pci: fix timeout request state check
    - tcp: avoid the lookup process failing to get sk in ehash table
    - device property: fix of node refcount leak in
      fwnode_graph_get_next_endpoint()
    - w1: fix deadloop in __w1_remove_master_device()
    - w1: fix WARNING after calling w1_process()
    - driver core: Fix test_async_probe_init saves device in wrong array
    - thermal: Validate new state in cur_state_store()
    - thermal/core: fix error code in __thermal_cooling_device_register()
    - thermal: core: call put_device() only after device_register() fails
    - net: stmmac: enable all safety features by default
    - bnxt: Do not read past the end of test names
    - tcp: fix rate_app_limited to default to 1
    - scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace
    - [x86] ASoC: SOF: pm: Set target state earlier
    - [x86] ASoC: SOF: pm: Always tear down pipelines before DSP suspend
    - [x86] ASoC: SOF: Add FW state to debugfs
    - [x86] ASoC: amd: yc: Add Razer Blade 14 2022 into DMI table
    - [arm64] cpufreq: CPPC: Add u64 casts to avoid overflowing
    - [arm64,armhf] cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist
    - [x86] ASoC: amd: yc: Add ASUS M5402RA into DMI table
    - [arm64,armhf] cpufreq: Add SM6375 to cpufreq-dt-platdev blocklist
    - [arm64] ASoC: fsl_micfil: Correct the number of steps on SX controls
    - [arm64] drm/msm/a6xx: Avoid gx gbit halt during rpm suspend
    - net: usb: cdc_ether: add support for Thales Cinterion PLS62-W modem
    - drm: Add orientation quirk for Lenovo ideapad D330-10IGL
    - [s390x] debug: add _ASM_S390_ prefix to header guard
    - [s390x] expicitly align _edata and _end symbols on page boundary
    - xen/pvcalls: free active map buffer on pvcalls_front_free_map
    - [x86] perf/x86/cstate: Add Meteor Lake support
    - [x86] perf/x86/msr: Add Meteor Lake support
    - [x86] perf/x86/msr: Add Emerald Rapids
    - [x86] perf/x86/intel/uncore: Add Emerald Rapids
    - [arm64] cpufreq: armada-37xx: stop using 0 as NULL pointer
    - [arm64,armhf] ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with
      AC'97 CODEC
    - [arm64] ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets
    - ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
    - cifs: fix potential memory leaks in session setup
    - spi: spidev: remove debug messages that access spidev->spi without locking
    - [s390x] KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
    - [arm64] scsi: hisi_sas: Use abort task set to reset SAS disks when
      discovered
    - [arm64] scsi: hisi_sas: Set a port invalid only if there are no devices
      attached when refreshing port id
    - r8152: add vendor/device ID pair for Microsoft Devkit
    - [x86] platform/x86: asus-nb-wmi: Add alternate mapping for KEY_CAMERA
    - [x86] platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK
    - [x86] platform/x86: asus-wmi: Add quirk wmi_ignore_fan
    - [x86] platform/x86: asus-wmi: Ignore fan on E410MA
    - [x86] platform/x86: simatic-ipc: correct name of a model
    - [x86] platform/x86: simatic-ipc: add another model
    - lockref: stop doing cpu_relax in the cmpxchg loop
    - firmware: coreboot: Check size of table entry and use flex-array
    - btrfs: zoned: enable metadata over-commit for non-ZNS setup
    - [arm64] efi: Recover from synchronous exceptions occurring in firmware
    - [arm64] efi: Avoid workqueue to check whether EFI runtime is live
    - [arm64] efi: Account for the EFI runtime stack in stack unwinder
    - Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
    - [x86] drm/i915: Allow panel fixed modes to have differing sync polarities
    - [x86] drm/i915: Allow alternate fixed modes always for eDP
    - drm/amdgpu: complete gfxoff allow signal during suspend without delay
    - io_uring/msg_ring: fix remote queue to disabled ring
    - wifi: mac80211: Proper mark iTXQs for resumption
    - wifi: mac80211: Fix iTXQ AMPDU fragmentation handling
    - sched/fair: Check if prev_cpu has highest spare cap in feec()
    - sched/uclamp: Fix a uninitialized variable warnings
    - vfio/type1: Respect IOMMU reserved regions in vfio_test_domain_fgsp()
    - scsi: hpsa: Fix allocation size for scsi_host_alloc()
    - kvm/vfio: Fix potential deadlock on vfio group_lock
    - nfsd: don't free files unconditionally in __nfsd_file_cache_purge
    - module: Don't wait for GOING modules
    - ftrace: Export ftrace_free_filter() to modules
    - tracing: Make sure trace_printk() can output as soon as it can be used
    - trace_events_hist: add check for return value of 'create_hist_field'
    - ftrace/scripts: Update the instructions for ftrace-bisect.sh
    - cifs: Fix oops due to uncleared server->smbd_conn in reconnect
    - ksmbd: add max connections parameter
    - ksmbd: do not sign response to session request for guest login
    - ksmbd: downgrade ndr version error message to debug
    - ksmbd: limit pdu length size according to connection status
    - ovl: fix tmpfile leak
    - ovl: fail on invalid uid/gid mapping at copy up
    - io_uring/net: cache provided buffer group value for multishot receives
    - [x86] KVM: x86/vmx: Do not skip segment attributes if unusable bit is set
    - [arm64] KVM: arm64: GICv4.1: Fix race with doorbell on VPE
      activation/deactivation
    - scsi: ufs: core: Fix devfreq deadlocks
    - [x86] thermal: intel: int340x: Protect trip temperature from concurrent
      updates
    - regulator: dt-bindings: samsung,s2mps14: add lost
      samsung,ext-control-gpios
    - ipv6: fix reachability confirmation with proxy_ndp
    - EDAC/device: Respect any driver-supplied workqueue polling value
    - [x86] platform/x86: thinkpad_acpi: Fix profile modes on Intel platforms
    - drm/amd/pm: add missing AllowIHInterrupt message mapping for SMU13.0.0
    - drm/amdgpu: remove unconditional trap enable on add gfx11 queues
    - io_uring: inline io_req_task_work_add()
    - io_uring: inline __io_req_complete_post()
    - io_uring: hold locks for io_req_complete_failed
    - io_uring: use io_req_task_complete() in timeout
    - io_uring: remove io_req_tw_post_queue
    - io_uring: inline __io_req_complete_put()
    - [amd64] net: mana: Fix IRQ name - add PCI and queue number
    - io_uring: always prep_async for drain requests
    - i2c: designware: use casting of u64 in clock multiplication to avoid
      overflow
    - i2c: designware: Fix unbalanced suspended flag
    - drm/drm_vma_manager: Add drm_vma_node_allow_once()
    - [x86] drm/i915: Fix a memory leak with reused mmap_offset
    - iavf: fix temporary deadlock and failure to set MAC address
    - iavf: schedule watchdog immediately when changing primary MAC
    - netlink: prevent potential spectre v1 gadgets
    - net: fix UaF in netns ops registration error path
    - net: fec: Use page_pool_put_full_page when freeing rx buffers
    - nvme: simplify transport specific device attribute handling
    - nvme: consolidate setting the tagset flags
    - nvme-fc: fix initialization order
    - ACPI: video: Add backlight=native DMI quirk for HP Pavilion g6-1d80nr
    - ACPI: video: Add backlight=native DMI quirk for HP EliteBook 8460p
    - ACPI: video: Add backlight=native DMI quirk for Asus U46E
    - netfilter: nft_set_rbtree: Switch to node list walk for overlap detection
    - netfilter: nft_set_rbtree: skip elements in transaction from garbage
      collection
    - netlink: annotate data races around nlk->portid
    - netlink: annotate data races around dst_portid and dst_group
    - netlink: annotate data races around sk_state
    - ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
    - ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
    - netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
    - netrom: Fix use-after-free of a listening socket.
    - [x86] platform/x86: asus-wmi: Fix kbd_dock_devid tablet-switch reporting
    - [x86] platform/x86: apple-gmux: Move port defines to apple-gmux.h
    - [x86] platform/x86: apple-gmux: Add apple_gmux_detect() helper
    - ACPI: video: Fix apple gmux detection
    - net/sched: sch_taprio: do not schedule in taprio_reset()
    - sctp: fail if no bound addresses can be used for a given scope
    - [riscv64] kprobe: Fix instruction simulation of JALR
    - nvme: fix passthrough csi check
    - [arm64,armhf] gpio: mxc: Unlock on error path in mxc_flip_edge()
    - net: mctp: add an explicit reference from a mctp_sk_key to sock
    - net: mctp: move expiry timer delete to unhash
    - net: mctp: hold key reference when looking up a general key
    - net: mctp: mark socks as dead on unhash, prevent re-add
    - [x86] thermal: intel: int340x: Add locking to
      int340x_thermal_get_trip_type()
    - [riscv64] Move call to init_cpu_topology() to later initialization stage
    - net/tg3: resolve deadlock in tg3_reset_task() during EEH
    - [arm64,armhf] net: mdio-mux-meson-g12a: force internal PHY off on mux
      switch
    - [arm64] Partially revert "perf/arm-cmn: Optimise DTC counter accesses"
    - block: ublk: move ublk_chr_class destroying after devices are removed
    - treewide: fix up files incorrectly marked executable
    - Fix up more non-executable files marked executable
    - Revert "mm/compaction: fix set skip in fast_find_migrateblock"
    - Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI
      mode"
    - Input: i8042 - add Clevo PCX0DX to i8042 quirk table
    - [x86] sev: Add SEV-SNP guest feature negotiation support
    - acpi: Fix suspend with Xen PV
    - [x86] i8259: Mark legacy PIC interrupts with IRQ_LEVEL
    - netfilter: conntrack: unify established states for SCTP paths
    - [x86] perf/x86/amd: fix potential integer overflow on shift of a int
    - amdgpu: fix build on non-DCN platforms.
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.10
    - [armhf] dts: imx: Fix pca9547 i2c-mux node name
    - [arm64] dts: freescale: Fix pca954x i2c-mux node names
    - [arm64] dts: imx8mq-thor96: fix no-mmc property for SDHCI
    - [arm64] firmware: arm_scmi: Clear stale xfer->hdr.status
    - bpf: Skip task with pid=1 in send_signal_common()
    - erofs/zmap.c: Fix incorrect offset calculation
    - mac80211: Fix MLO address translation for multiple bss case
    - [arm64] dts: msm8994-angler: fix the memory map
    - erofs: clean up parsing of fscache related options
    - blk-cgroup: fix missing pd_online_fn() while activating policy
    - ACPI: video: Add backlight=native DMI quirk for Acer Aspire 4810T
    - block: fix hctx checks for batch allocation
    - [s390x] workaround invalid gcc-11 out of bounds read warning
    - HID: uclogic: Add support for XP-PEN Deco 01 V2
    - HID: playstation: sanity check DualSense calibration data.
    - [arm64,armhf] dmaengine: imx-sdma: Fix a possible memory leak in
      sdma_transfer_init
    - gpiolib: acpi: Allow ignoring wake capability on pins that aren't in _AEI
    - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint()
    - gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xRU
    - net: fix NULL pointer in skb_segment_list
    - net: mctp: purge receive queues on sk destruction
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.11
    - firewire: fix memory leak for payload of request subaction to IEC 61883-1
      FCP region
    - [arm64,armhf] bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
    - [arm64] dts: imx8m-venice: Remove incorrect 'uart-has-rtscts'
    - [x86] ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device
      after use
    - [x86] ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after
      use
    - [x86] ASoC: Intel: bytcr_rt5640: Drop reference count of ACPI device after
      use
    - [x86] ASoC: Intel: sof_es8336: Drop reference count of ACPI device after
      use
    - bpf: Fix off-by-one error in bpf_mem_cache_idx()
    - bpf: Fix a possible task gone issue with bpf_send_signal[_thread]()
      helpers
    - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
    - bpf: Fix to preserve reg parent/live fields when copying range info
    - [x86] ASoC: SOF: ipc4-mtrace: prevent underflow in
      sof_ipc4_priority_mask_dfs_write()
    - bpf: Add missing btf_put to register_btf_id_dtor_kfuncs
    - media: v4l2-ctrls-api.c: move ctrl->is_new = 1 to the correct line
    - bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
    - [arm64,armhf] drm/vc4: hdmi: make CEC adapter name unique
    - scsi: Revert "scsi: core: map PQ=1, PDT=other values to
      SCSI_SCAN_TARGET_PRESENT"
    - bpf: Fix the kernel crash caused by bpf_setsockopt().
    - ALSA: memalloc: Workaround for Xen PV
    - vhost/net: Clear the pending messages when the backend is removed
    - [armhf] WRITE is "data source", not destination...
    - [s390x] memcpy_real(): WRITE is "data source", not destination...
    - fix iov_iter_bvec() "direction" argument
    - fix 'direction' argument of iov_iter_{init,bvec}()
    - fix "direction" argument of iov_iter_kvec()
    - use less confusing names for iov_iter direction initializers
    - vhost-scsi: unbreak any layout for response
    - ice: Prevent set_channel from changing queues while RDMA active
    - qede: execute xdp_do_flush() before napi_complete_done()
    - virtio-net: execute xdp_do_flush() before napi_complete_done()
    - [arm64] dpaa2-eth: execute xdp_do_flush() before napi_complete_done()
    - skb: Do mix page pool and page referenced frags in GRO
    - sfc: correctly advertise tunneled IPv6 segmentation
    - net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices
    - block, bfq: replace 0/1 with false/true in bic apis
    - block, bfq: fix uaf for bfqq in bic_set_bfqq()
    - netrom: Fix use-after-free caused by accept on already connected socket
    - fscache: Use wait_on_bit() to wait for the freeing of relinquished volume
    - [x86] platform/x86: thinkpad_acpi: Fix thinklight LED brightness returning
      255
    - [x86] drm/i915/guc: Fix locking when searching for a hung request
    - [x86] drm/i915: Fix request ref counting during error capture & debugfs
      dump
    - [x86] drm/i915: Fix up locking around dumping requests lists
    - [x86] drm/i915/adlp: Fix typo for reference clock
    - net/tls: tls_is_tx_ready() checked list_entry
    - ALSA: firewire-motu: fix unreleased lock warning in hwdep device
    - netfilter: br_netfilter: disable sabotage_in hook after first suppression
    - block: ublk: extending queue_size to fix overflow
    - squashfs: harden sanity check in squashfs_read_xattr_id_table
    - maple_tree: should get pivots boundary by type
    - sctp: do not check hb_timer.expires when resetting hb_timer
    - [arm64] net: phy: meson-gxl: Add generic dummy stubs for MMD register
      access
    - ip/ip6_gre: Fix changing addr gen mode not generating IPv6 link local
      address
    - ip/ip6_gre: Fix non-point-to-point tunnel not generating IPv6 link local
      address
    - [riscv64] kprobe: Fixup kernel panic when probing an illegal position
    - igc: return an error if the mac type is unknown in
      igc_ptp_systim_to_hwtstamp()
    - can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
    - can: raw: fix CAN FD frame transmissions over CAN XL devices
    - ata: libata: Fix sata_down_spd_limit() when no link speed is reported
    - virtio-net: Keep stop() to follow mirror sequence of open()
    - net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
    - efi: fix potential NULL deref in efi_mem_reserve_persistent
    - [x86] i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU
    - scsi: target: core: Fix warning on RT kernels
    - [x86] aperfmperf: Erase stale arch_freq_scale values when disabling
      frequency invariance readings
    - [x86] perf/x86/intel: Add Emerald Rapids
    - [x86] perf/x86/intel/cstate: Add Emerald Rapids
    - scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
    - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
    - [arm64,armhf] i2c: rk3x: fix a bunch of kernel-doc warnings
    - Revert "gfs2: stop using generic_writepages in gfs2_ail1_start_one"
    - [x86] build: Move '-mindirect-branch-cs-prefix' out of GCC-only block
    - [x86] platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010
      table
    - [x86] platform/x86: hp-wmi: Handle Omen Key event
    - [x86] platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF
    - [amd64] platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN
    - drm/amd/display: Fix timing not changning when freesync video is enabled
    - bcache: Silence memcpy() run-time false positive warnings
    - [arm64] usb: dwc3: qcom: enable vbus override when in OTG dr-mode
    - usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
    - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
    - fbcon: Check font dimension limits
    - cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()
    - hv_netvsc: Fix missed pagebuf entries in netvsc_dma_map/unmap()
    - net: qrtr: free memory on error path in radix_tree_insert()
    - can: isotp: split tx timer into transmission and timeout
    - can: isotp: handle wait_event_interruptible() return values
    - [s390x] watchdog: diag288_wdt: do not use stack buffers for hardware data
    - [s390x] watchdog: diag288_wdt: fix __diag288() inline assembly
    - ALSA: hda/realtek: Add Acer Predator PH315-54
    - ALSA: hda/realtek: fix mute/micmute LEDs, speaker don't work for a HP
      platform
    - [x86] ASoC: SOF: sof-audio: unprepare when swidget->use_count > 0
    - [x86] ASoC: SOF: sof-audio: skip prepare/unprepare if swidget is NULL
    - [x86] ASoC: SOF: keep prepare/unprepare widgets in sink path
    - efi: Accept version 2 of memory attributes table
    - rtc: efi: Enable SET/GET WAKEUP services as optional
    - iio: hid: fix the retval in accel_3d_capture_sample
    - iio: hid: fix the retval in gyro_3d_capture_sample
    - iio: imu: fxos8700: fix ACCEL measurement range selection
    - iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback
    - iio: imu: fxos8700: fix IMU data bits returned to user space
    - iio: imu: fxos8700: fix map label of channel type to MAGN sensor
    - iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback
    - iio: imu: fxos8700: fix incorrect ODR mode readback
    - iio: imu: fxos8700: fix failed initialization ODR mode assignment
    - iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN
    - iio: imu: fxos8700: fix MAGN sensor scale and unit
    - [arm64,armhf] nvmem: sunxi_sid: Always use 32-bit MMIO reads
    - [riscv64] disable generation of unwind tables
    - Revert "mm: kmemleak: alloc gray object for reserved region with direct
      map"
    - mm: multi-gen LRU: fix crash during cgroup migration
    - mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
    - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()
    - usb: gadget: f_uac2: Fix incorrect increment of bNumEndpoints
    - usb: typec: ucsi: Don't attempt to resume the ports before they exist
    - usb: gadget: udc: do not clear gadget driver.bus
    - kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup()
    - HV: hv_balloon: fix memory leak with using debugfs_lookup()
    - [x86] debug: Fix stack recursion caused by wrongly ordered DR7 accesses
    - mm/uffd: fix pte marker when fork() without fork event
    - mm/swapfile: add cond_resched() in get_swap_pages()
    - mm/khugepaged: fix ->anon_vma race
    - mm, mremap: fix mremap() expanding for vma's with vm_ops->close()
    - mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups
    - highmem: round down the address passed to kunmap_flush_on_unmap()
    - Squashfs: fix handling and sanity checking of xattr_ids count
    - maple_tree: fix mas_empty_area_rev() lower bound validation
    - migrate: hugetlb: check for hugetlb shared PMD in node migration
    - dma-buf: actually set signaling bit for private stub fences
    - [armhf] serial: stm32: Merge hard IRQ and threaded IRQ handling into
      single IRQ handler
    - [x86] drm/i915: Avoid potential vm use-after-free
    - [x86] drm/i915: Fix potential bit_17 double-free
    - drm/amd: Fix initialization for nbio 4.3.0
    - drm/amd/pm: drop unneeded dpm features disablement for SMU 13.0.4/11
    - drm/amdgpu: update wave data type to 3 for gfx11
    - nvmem: core: initialise nvmem->id early
    - nvmem: core: remove nvmem_config wp_gpio
    - nvmem: core: fix cleanup after dev_set_name()
    - nvmem: core: fix registration vs use race
    - nvmem: core: fix device node refcounting
    - nvmem: core: fix cell removal on error
    - nvmem: core: fix return value
    - [arm64] phy: qcom-qmp-combo: fix runtime suspend
    - serial: 8250_dma: Fix DMA Rx completion race
    - serial: 8250_dma: Fix DMA Rx rearm race
    - [x86] ASoC: SOF: sof-audio: prepare_widgets: Check swidget for NULL on
      sink failure
    - [powerpc*] 64s/radix: Fix crash with unaligned relocated kernel
    - [powerpc*] 64s: Fix local irq disable when PMIs are disabled
    - [powerpc*] imc-pmu: Revert nest_init_lock to being a mutex
    - ovl: Use "buf" flexible array for memcpy() destination
    - f2fs: initialize locks earlier in f2fs_fill_super()
    - fbdev: smscufx: fix error handling code in ufx_usb_probe
    - f2fs: fix to do sanity check on i_extra_isize in is_alive()
    - wifi: brcmfmac: Check the count value of channel spec to prevent
      out-of-bounds reads
    - gfs2: Cosmetic gfs2_dinode_{in,out} cleanup
    - gfs2: Always check inode size of inline inodes
    - bpf: Skip invalid kfunc call in backtrack_insn

  [ Diederik de Haas ]
  * [amd64,arm64,armel,i386] Remove unnecessary constraints since stretch
    (old-old-stable)

  [ Salvatore Bonaccorso ]
  * Refresh "kbuild: Make the toolchain variables easily overwritable"
  * Bump ABI to 4

  [ John Paul Adrian Glaubitz ]
  * [hppa,ia64,sh4,sparc64] Add i2c-modules to Depends for nic-shared-modules
    udeb

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 09 Feb 2023 22:48:50 +0100

linux (6.1.8-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.8
    - dma-buf: fix dma_buf_export init order v2
    - btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
    - wifi: iwlwifi: fw: skip PPAG for JF
    - pNFS/filelayout: Fix coalescing test for single DS
    - virtio_pci: modify ENOENT to EINVAL
    - net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
    - r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down()
    - r8169: fix dmar pte write access is not set error
    - bpf: keep a reference to the mm, in case the task is dead.
    - btrfs: always report error in run_one_delayed_ref()
    - [x86] asm: Fix an assembler warning with current binutils
    - f2fs: let's avoid panic if extent_tree is not created
    - [x86] perf/x86/rapl: Treat Tigerlake like Icelake
    - cifs: fix race in assemble_neg_contexts()
    - [x86] perf/x86/rapl: Add support for Intel Meteor Lake
    - [x86] perf/x86/rapl: Add support for Intel Emerald Rapids
    - of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2
    - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2
    - Bluetooth: hci_qca: Fix driver shutdown on closed serdev
    - wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
    - wifi: mac80211: fix MLO + AP_VLAN check
    - wifi: mac80211: reset multiple BSSID options in stop_ap()
    - wifi: mac80211: sdata can be NULL during AMPDU start
    - wifi: mac80211: fix initialization of rx->link and rx->link_sta
      (Closes: #1029816)
    - proc: fix PIE proc-empty-vm, proc-pid-vm tests
    - zonefs: Detect append writes at invalid locations
    - nilfs2: fix general protection fault in nilfs_btree_insert()
    - mm/shmem: restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE
    - hugetlb: unshare some PMDs when splitting VMAs
    - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
    - xhci-pci: set the dma max_seg_size
    - usb: xhci: Check endpoint is valid before dereferencing it
    - xhci: Fix null pointer dereference when host dies
    - xhci: Add update_hub_device override for PCI xHCI hosts
    - xhci: Add a flag to disable USB3 lpm on a xhci root port level.
    - usb: acpi: add helper to check port lpm capability using acpi _DSM
    - xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
    - prlimit: do_prlimit needs to have a speculation check
    - USB: serial: option: add Quectel EM05-G (GR) modem
    - USB: serial: option: add Quectel EM05-G (CS) modem
    - USB: serial: option: add Quectel EM05-G (RS) modem
    - USB: serial: option: add Quectel EC200U modem
    - USB: serial: option: add Quectel EM05CN (SG) modem
    - USB: serial: option: add Quectel EM05CN modem
    - USB: misc: iowarrior: fix up header size for
      USB_DEVICE_ID_CODEMERCS_IOW100
    - usb: core: hub: disable autosuspend for TI TUSB8041
    - [x86] comedi: adv_pci1760: Fix PWM instruction handling
    - [amd64,arm64] ACPI: PRM: Check whether EFI runtime is available
    - [arm64,armhf] mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
    - [arm64,armhf] mmc: sdhci-esdhc-imx: correct the tuning start tap and step
      setting
    - mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()
    - mm/hugetlb: fix uffd-wp handling for migration entries in
      hugetlb_change_protection()
    - mm/hugetlb: pre-allocate pgtable pages for uffd wr-protects
    - mm/userfaultfd: enable writenotify while userfaultfd-wp is enabled for a
      VMA
    - mm/MADV_COLLAPSE: don't expand collapse when vm_end is past requested end
    - btrfs: add extra error messages to cover non-ENOMEM errors from
      device_add_list()
    - btrfs: fix missing error handling when logging directory items
    - btrfs: fix directory logging due to race with concurrent index key
      deletion
    - btrfs: add missing setup of log for full commit at add_conflicting_inode()
    - btrfs: do not abort transaction on failure to write log tree when syncing
      log
    - btrfs: do not abort transaction on failure to update log root
    - btrfs: qgroup: do not warn on record without old_roots populated
    - btrfs: fix invalid leaf access due to inline extent during lseek
    - btrfs: fix race between quota rescan and disable leading to NULL pointer
      deref
    - cifs: do not include page data when checking signature
    - [x86] thunderbolt: Disable XDomain lane 1 only in software connection
      manager
    - [x86] thunderbolt: Use correct function to calculate maximum USB3 link
      rate
    - [x86] thunderbolt: Do not report errors if on-board retimers are found
    - [x86] thunderbolt: Do not call PM runtime functions in tb_retimer_scan()
    - bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and
      PERF_BPF_EVENT_PROG_UNLOAD
    - [arm64] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO
      buffer
    - tty: fix possible null-ptr-defer in spk_ttyio_release
    - pktcdvd: check for NULL returna fter calling bio_split_to_limits()
    - io_uring/poll: don't reissue in case of poll race on multishot request
    - mptcp: explicitly specify sock family at subflow creation time
    - mptcp: netlink: respect v4/v6-only sockets
    - USB: gadgetfs: Fix race between mounting and unmounting
    - USB: serial: cp210x: add SCALANCE LPE-9000 device id
    - [arm64] usb: host: ehci-fsl: Fix module alias
    - [armhf] usb: musb: fix error return code in omap2430_probe()
    - usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail
    - usb: typec: altmodes/displayport: Add pin assignment helper
    - usb: typec: altmodes/displayport: Fix pin assignment calculation
    - USB: gadget: Add ID numbers to configfs-gadget driver names
    - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
    - [i386] serial: pch_uart: Pass correct sg to dma_unmap_sg()
    - [arm64] dmaengine: tegra210-adma: fix global intr clear
    - [amd64] dmaengine: idxd: Let probe fail when workqueue cannot be enabled
    - [amd64] dmaengine: idxd: Prevent use after free on completion memory
    - [amd64] dmaengine: idxd: Do not call DMX TX callbacks during workqueue
      disable
    - [arm*] serial: amba-pl011: fix high priority character transmission in
      rs486 mode
    - serial: exar: Add support for Sealevel 7xxxC serial cards
    - mei: bus: fix unlink on bus in error path
    - mei: me: add meteor lake point M DID
    - [x86] VMCI: Use threaded irqs instead of tasklets
    - drm/amdgpu: fix amdgpu_job_free_resources v2
    - drm/amdgpu: allow multipipe policy on ASICs with one MEC
    - drm/amdgpu: Correct the power calcultion for Renior/Cezanne.
    - [x86] drm/i915: re-disable RC6p on Sandy Bridge
    - [x86] drm/i915/display: Check source height is > 0
    - [x86] drm/i915: Allow switching away via vga-switcheroo if uninitialized
    - [x86] drm/i915: Remove unused variable
    - drm/amd/display: Fix set scaling doesn's work
    - drm/amd/display: Calculate output_color_space after pixel encoding
      adjustment
    - drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
    - drm/amd/display: disable S/G display on DCN 3.1.5
    - drm/amd/display: disable S/G display on DCN 3.1.4
    - cifs: reduce roundtrips on create/qinfo requests
    - fs/ntfs3: Fix attr_punch_hole() null pointer derenference (CVE-2022-4842)
    - [arm64] efi: Execute runtime services from a dedicated stack
    - [arm64] efi: rt-wrapper: Add missing include
    - panic: Separate sysctl logic from CONFIG_SMP
    - exit: Put an upper limit on how often we can oops
    - exit: Expose "oops_count" to sysfs
    - exit: Allow oops_limit to be disabled
    - panic: Consolidate open-coded panic_on_warn checks
    - panic: Introduce warn_limit
    - panic: Expose "warn_count" to sysfs
    - docs: Fix path paste-o for /sys/kernel/warn_count
    - exit: Use READ_ONCE() for all oops/warn limit reads
    - [x86] fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN
    - drm/amdgpu/discovery: enable soc21 common for GC 11.0.4
    - drm/amdgpu/discovery: enable gmc v11 for GC 11.0.4
    - drm/amdgpu/discovery: enable gfx v11 for GC 11.0.4
    - drm/amdgpu/discovery: enable mes support for GC v11.0.4
    - drm/amdgpu: set GC 11.0.4 family
    - drm/amdgpu/discovery: set the APU flag for GC 11.0.4
    - drm/amdgpu: add gfx support for GC 11.0.4
    - drm/amdgpu: add gmc v11 support for GC 11.0.4
    - drm/amdgpu/discovery: add PSP IP v13.0.11 support
    - drm/amdgpu/pm: enable swsmu for SMU IP v13.0.11
    - drm/amdgpu: add smu 13 support for smu 13.0.11
    - drm/amdgpu/pm: add GFXOFF control IP version check for SMU IP v13.0.11
    - drm/amdgpu/soc21: add mode2 asic reset for SMU IP v13.0.11
    - drm/amdgpu/pm: use the specific mailbox registers only for SMU IP v13.0.4
    - drm/amdgpu/discovery: enable nbio support for NBIO v7.7.1
    - drm/amdgpu: enable PSP IP v13.0.11 support
    - drm/amdgpu: enable GFX IP v11.0.4 CG support
    - drm/amdgpu: enable GFX Power Gating for GC IP v11.0.4
    - drm/amdgpu: enable GFX Clock Gating control for GC IP v11.0.4
    - drm/amdgpu: add tmz support for GC 11.0.1
    - drm/amdgpu: add tmz support for GC IP v11.0.4
    - drm/amdgpu: correct MEC number for gfx11 APUs
    - net/ulp: use consistent error code when blocking ULP
    - net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work()
    - block: mq-deadline: Rename deadline_is_seq_writes()
    - Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"

  [ Salvatore Bonaccorso ]
  * d/t/main.control.in: Add Depends on python3-jinja2 for linux-support
    packages
  * gpiolib-acpi: Don't set GPIOs for wakeup in S3 mode (Closes: #1029046)
  * drm/amdgpu/display/mst: Fix mst_state->pbn_div and slot count assignments
    (Closes: #1028451)
  * drm/amdgpu/display/mst: limit payload to be updated one by one
    (Closes: #1028451)
  * drm/amdgpu/display/mst: update mst_mgr relevant variable when long HPD
    (Closes: #1028451)
  * drm/display/dp_mst: Correct the kref of port. (Closes: #1028451)
  * Bump ABI to 3
  * [amd64,arm64] Enable MODULE_ALLOW_BTF_MISMATCH (Closes: #1003210, #1022202)

  [ Diederik de Haas ]
  * d/rules.real: Remove executable bit from dtb files (Closes: #1028601)

  [ John Paul Adrian Glaubitz ]
  * Add patch to fix missing symbol versions for str{,n}{cat,cpy}
    on alpha. Fixes FTBFS. (Closes: #1027974)

  [ Miguel Bernal Marin ]
  * [amd64] drivers/platform/x86/intel/uncore-frequency: Enable
    INTEL_UNCORE_FREQ_CONTROL as module (Intel Uncore frequency control)
    (Closes: #1029484)
  * [amd64] arch/x86: Enable 5-level page tables support (X86_5LEVEL)
    (Closes: #1029674)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 29 Jan 2023 13:33:36 +0100

linux (6.1.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.5
    - btrfs: replace strncpy() with strscpy()
    - cifs: fix interface count calculation during refresh
    - cifs: refcount only the selected iface during interface update
    - [arm64,armhf] usb: dwc3: gadget: Ignore End Transfer delay on teardown
    - btrfs: fix off-by-one in delalloc search during lseek
    - btrfs: fix compat_ro checks against remount
    - [arm64] phy: qcom-qmp-combo: fix broken power on
    - btrfs: fix an error handling path in btrfs_defrag_leaves()
    - SUNRPC: ensure the matching upcall is in-flight upon downcall
    - wifi: ath9k: use proper statements in conditionals
    - bpf: pull before calling skb_postpull_rcsum()
    - [arm64,armhf] drm/panfrost: Fix GEM handle creation ref-counting
    - netfilter: nf_tables: consolidate set description
    - netfilter: nf_tables: add function to create set stateful expressions
    - netfilter: nf_tables: perform type checking for existing sets
    - ice: xsk: do not use xdp_return_frame() on tx_buf->raw_buf
    - net: vrf: determine the dst using the original ifindex for multicast
    - vmxnet3: correctly report csum_level for encapsulated packet
    - mptcp: fix deadlock in fastopen error path
    - mptcp: fix lockdep false positive
    - netfilter: nf_tables: honor set timeout and garbage collection updates
    - bonding: fix lockdep splat in bond_miimon_commit()
    - veth: Fix race with AF_XDP exposing old or uninitialized descriptors
    - nfsd: shut down the NFSv4 state objects before the filecache
    - [arm64] net: hns3: add interrupts re-initialization while doing VF FLR
    - [arm64] net: hns3: fix miss L3E checking for rx packet
    - [arm64] net: hns3: fix VF promisc mode not update when mac table full
    - net: sched: fix memory leak in tcindex_set_parms
    - qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure
    - nfc: Fix potential resource leaks
    - bnxt_en: Simplify bnxt_xdp_buff_init()
    - bnxt_en: Fix XDP RX path
    - bnxt_en: Fix first buffer size calculations for XDP multi-buffer
    - bnxt_en: Fix HDS and jumbo thresholds for RX packets
    - vhost/vsock: Fix error handling in vhost_vsock_init()
    - vhost: fix range used in translate_desc()
    - virtio-crypto: fix memory leak in
      virtio_crypto_alg_skcipher_close_session()
    - net/mlx5: E-Switch, properly handle ingress tagged packets on VST
    - net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path
    - net/mlx5: Fix io_eq_size and event_eq_size params validation
    - net/mlx5: Avoid recovery in probe flows
    - net/mlx5: Fix RoCE setting at HCA level
    - net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default
    - net/mlx5e: Fix RX reporter for XSK RQs
    - net/mlx5e: CT: Fix ct debugfs folder name
    - net/mlx5e: Always clear dest encap in neigh-update-del
    - net/mlx5e: Fix hw mtu initializing at XDP SQ allocation
    - net/mlx5e: Set geneve_tlv_option_0_exist when matching on geneve option
    - net/mlx5: Lag, fix failure to cancel delayed bond work
    - bpf: Always use maximal size for copy_array()
    - tcp: Add TIME_WAIT sockets in bhash2.
    - [arm64] net: hns3: refine the handling for VF heartbeat
    - [amd64,arm64] net: amd-xgbe: add missed tasklet_kill
    - net: ena: Fix toeplitz initial hash value
    - net: ena: Don't register memory info on XDP exchange
    - net: ena: Account for the number of processed bytes in XDP
    - net: ena: Use bitmask to indicate packet redirection
    - net: ena: Fix rx_copybreak value update
    - net: ena: Set default value for RX interrupt moderation
    - net: ena: Update NUMA TPH hint register upon NUMA node update
    - [arm64,armhf] gpio: pca953x: avoid to use uninitialized value pinctrl
    - RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device
    - RDMA/mlx5: Fix validation of max_rd_atomic caps for DC
    - [arm64] drm/meson: Reduce the FIFO lines held when AFBC is not used
    - filelock: new helper: vfs_inode_has_locks
    - ceph: switch to vfs_inode_has_locks() to fix file lock bug
    - net: sched: atm: dont intepret cls results when asked to drop
      (CVE-2023-23455)
    - net: sched: cbq: dont intepret cls results when asked to drop
      (CVE-2023-23454)
    - vxlan: Fix memory leaks in error path
    - netfilter: ipset: fix hash:net,port,net hang with /0 subnet
    - netfilter: ipset: Rework long task execution when adding/deleting entries
    - drm/virtio: Fix memory leak in virtio_gpu_object_create()
    - perf tools: Fix resources leak in perf_data__open_dir()
    - [armhf] drm/imx: ipuv3-plane: Fix overlay plane width
    - drivers/net/bonding/bond_3ad: return when there's no aggregator
    - usb: rndis_host: Secure rndis_query check against int overflow
    - [x86] drm/i915: unpin on error in intel_vgpu_shadow_mm_pin()
    - [x86] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
      (CVE-2022-3707)
    - qed: allow sleep in qed_mcp_trace_dump()
    - net/ulp: prevent ULP without clone op from entering the LISTEN status
    - udf: Fix extension of the last extent in the file
    - [arm64] usb: dwc3: xilinx: include linux/gpio/consumer.h
    - hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling
    - [x86] ASoC: SOF: Revert: "core: unregister clients and machine drivers in
      .shutdown"
    - 9p/client: fix data race on req->status
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071
      tablet
    - drm/amdgpu: Fix size validation for non-exclusive domains (v4)
    - io_uring/cancel: re-grab ctx mutex after finishing wait
    - ACPI: video: Allow GPU drivers to report no panels
    - drm/amd/display: Report to ACPI video if no panels were found
    - ACPI: video: Don't enable fallback path for creating ACPI backlight by
      default
    - io_uring: check for valid register opcode earlier
    - nvmet: use NVME_CMD_EFFECTS_CSUPP instead of open coding it
    - nvme: also return I/O command effects from nvme_command_effects
    - [x86] ASoC: SOF: Intel: pci-tgl: unblock S5 entry if DMA stop has failed"
    - [x86] kexec: Fix double-free of elf header buffer
    - [x86] bugs: Flush IBP in ib_prctl_set()
    - nfsd: fix handling of readdir in v4root vs. mount upcall timeout
    - fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB
    - bpf: Fix panic due to wrong pageattr of im->image
    - Revert "drm/amd/display: Enable Freesync Video Mode by default"
    - net: dsa: tag_qca: fix wrong MGMT_DATA2 size
    - block: don't allow splitting of a REQ_NOWAIT bio
    - io_uring: pin context while queueing deferred tw
    - io_uring: fix CQ waiting timeout handling
    - tpm: Allow system suspend to continue when TPM suspend fails
    - [amd64] thermal: int340x: Add missing attribute for data rate base
    - of/fdt: run soc memory setup when early_init_dt_scan_memory fails
    - drm/plane-helper: Add the missing declaration of drm_atomic_state
    - [x86] drm/i915/gvt: fix gvt debugfs destroy
    - [x86] drm/i915/gvt: fix vgpu debugfs clean in remove
    - virtio-blk: use a helper to handle request queuing errors
    - virtio_blk: Fix signedness bug in virtblk_prep_rq()
    - drm/amd/display: Add check for DET fetch latency hiding for dcn32
    - drm/amd/display: Uninitialized variables causing 4k60 UCLK to stay at DPM1
      and not DPM0
    - btrfs: handle case when repair happens with dev-replace
    - ksmbd: fix infinite loop in ksmbd_conn_handler_loop()
    - ksmbd: send proper error response in smb2_tree_connect()
    - ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in
      ksmbd_decode_ntlmssp_auth_blob (CVE-2023-0210)
    - [x86] drm/i915/dsi: add support for ICL+ native MIPI GPIO sequence
    - [x86] drm/i915/dsi: fix MIPI_BKLT_EN_1 native GPIO index
    - efi: random: combine bootloader provided RNG seed with RNG protocol output
    - wifi: ath11k: Send PME message during wakeup from D3cold
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.6
    - [x86] fpu: Take task_struct* in copy_sigframe_from_user_to_xstate()
    - [x86] fpu: Add a pkru argument to copy_uabi_from_kernel_to_xstate().
    - [x86] fpu: Add a pkru argument to copy_uabi_to_xstate()
    - [x86] fpu: Allow PKRU to be (once again) written by ptrace.
    - [x86] fpu: Emulate XRSTOR's behavior if the xfeatures PKRU bit is not set
    - Revert "SUNRPC: Use RMW bitops in single-threaded hot paths"
    - gcc: disable -Warray-bounds for gcc-11 too
    - net: sched: disallow noqueue for qdisc classes
    - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
      (CVE-2023-0266)
    - ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list
    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for a HP platform
    - ALSA: hda: cs35l41: Don't return -EINVAL from system suspend/resume
    - ALSA: hda - Enable headset mic on another Dell laptop with ALC3254
    - ALSA: hda: cs35l41: Check runtime suspend capability at runtime_idle
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.7
    - netfilter: nft_payload: incorrect arithmetics when fetching VLAN header
      bits (CVE-2023-0179)
    - Revert "ALSA: usb-audio: Drop superfluous interface setup at parsing"
    - ALSA: control-led: use strscpy in set_led_id()
    - ALSA: usb-audio: Always initialize fixed_rate in
      snd_usb_find_implicit_fb_sync_format()
    - ALSA: hda/realtek - Turn on power early
    - ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx
    - [x86] KVM: x86: Do not return host topology information from
      KVM_GET_SUPPORTED_CPUID
    - [arm64] KVM: arm64: Fix S1PTW handling on RO memslots
    - efi: fix userspace infinite retry read efivars after EFI runtime services
      page fault
    - efi: tpm: Avoid READ_ONCE() for accessing the event log
    - docs: Fix the docs build with Sphinx 6.0
    - io_uring/poll: add hash if ready poll request can't complete inline
    - [arm64] mte: Fix double-freeing of the temporary tag storage during
      coredump
    - [arm64] mte: Avoid the racy walk of the vma list during core dump
    - ACPI: Fix selecting wrong ACPI fwnode for the iGPU on some Dell laptops
    - net: stmmac: add aux timestamps fifo clearance wait
    - [s390x] kexec: fix ipl report address for kdump
    - brcmfmac: Prefer DT board type over DMI board type
    - [arm64] ASoC: qcom: lpass-cpu: Fix fallback SD line index handling
    - elfcore: Add a cprm parameter to elf_core_extra_{phdrs,data_size}
    - [x86] cpufreq: amd-pstate: fix kernel hang issue while amd-pstate
      unregistering
    - [s390x] cpum_sf: add READ_ONCE() semantics to compare and swap loops
    - [s390x] percpu: add READ_ONCE() to arch_this_cpu_to_op_simple()
    - drm/virtio: Fix GEM handle creation UAF
    - drm/amd/pm/smu13: BACO is supported when it's in BACO state
    - drm: Optimize drm buddy top-down allocation method
    - [x86] drm/i915/gt: Reset twice
    - [x86] drm/i915: Reserve enough fence slot for i915_vma_unbind_async
    - [x86] drm/i915: Fix potential context UAFs
    - drm/amd: Delay removal of the firmware framebuffer
    - drm/amdgpu: Fixed bug on error when unloading amdgpu
    - drm/amd/pm: correct the reference clock for fan speed(rpm) calculation
    - drm/amd/pm: add the missing mapping for PPT feature on SMU13.0.0 and
      13.0.7
    - drm/amd/display: move remaining FPU code to dml folder
    - Revert "drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10
      properly""
    - cifs: Fix uninitialized memory read for smb311 posix symlink create
    - cifs: fix file info setting in cifs_query_path_info() (Closes: #1029130)
    - cifs: fix file info setting in cifs_open_file()
    - cifs: do not query ifaces on smb1 mounts
    - cifs: fix double free on failed kerberos auth
    - io_uring/fdinfo: include locked hash table in fdinfo output
    - ACPI: video: Allow selecting NVidia-WMI-EC or Apple GMUX backlight from
      the cmdline
    - [x86] platform/surface: aggregator: Ignore command messages not intended
      for us
    - [x86] platform/x86: thinkpad_acpi: Fix profile mode display in AMT mode
    - [x86] platform/x86: asus-wmi: Don't load fan curves without fan
    - [arm64] drm/msm: another fix for the headless Adreno GPU
    - firmware/psci: Fix MEM_PROTECT_RANGE function numbers
    - firmware/psci: Don't register with debugfs if PSCI isn't available
    - [arm64] signal: Always allocate SVE signal frames on SME only systems
    - [arm64] signal: Always accept SVE signal frames on SME only systems
    - [arm64] mm: add pud_user_exec() check in pud_user_accessible_page()
    - [arm64] ptrace: Use ARM64_SME to guard the SME register enumerations
    - [arm64] mm: fix incorrect file_map_count for invalid pmd
    - [x86] platform/x86: ideapad-laptop: Add Legion 5 15ARH05 DMI id to
      set_fn_lock_led_list[]
    - [arm64] drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for
      aux transfer
    - [x86] platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight
      during probe
    - ixgbe: fix pci device refcount leak
    - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
    - iavf/iavf_main: actually log ->src mask when talking about it
    - [x86] drm/i915/gt: Cleanup partial engine discovery failures
    - [arm64,armhf] usb: ulpi: defer ulpi_register on ulpi_read_id timeout
    - drm/amd/pm: enable mode1 reset on smu_v13_0_10
    - drm/amd/pm: Enable bad memory page/channel recording support for smu
      v13_0_0
    - drm/amd/pm: enable GPO dynamic control support for SMU13.0.0
    - drm/amd/pm: enable GPO dynamic control support for SMU13.0.7
    - drm/amdgpu: add soc21 common ip block support for GC 11.0.4
    - drm/amdgpu: Enable pg/cg flags on GC11_0_4 for VCN
    - drm/amdgpu: enable VCN DPG for GC IP v11.0.4
    - mm: Always release pages to the buddy allocator in memblock_free_late().
    - iommu/iova: Fix alloc iova overflows issue
    - [arm64] iommu/arm-smmu-v3: Don't unregister on shutdown
    - [arm64,armhf] iommu/arm-smmu: Don't unregister on shutdown
    - [arm64,armhf] iommu/arm-smmu: Report IOMMU_CAP_CACHE_COHERENCY even
      betterer
    - sched/core: Fix use-after-free bug in dup_user_cpus_ptr()
    - netfilter: ipset: Fix overflow before widen in the bitmap_ip_create()
      function.
    - [powerpc*] imc-pmu: Fix use of mutex in IRQs disabled section
    - [x86] boot: Avoid using Intel mnemonics in AT&T syntax asm
    - EDAC/device: Fix period calculation in edac_device_reset_delay_period()
    - [x86] pat: Fix pat_x_mtrr_type() for MTRR disabled case
    - [x86] resctrl: Fix task CLOSID/RMID update race
    - [x86] resctrl: Fix event counts regression in reused RMIDs
    - scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM
    - scsi: ufs: core: WLUN suspend SSU/enter hibern8 fail recovery
    - [x86] ASoC: Intel: sof_nau8825: support rt1015p speaker amplifier
    - [x86] ASoC: Intel: sof-nau8825: fix module alias overflow
    - [arm64] drm/msm/dpu: Fix memory leak in msm_mdss_parse_data_bus_icc_path
    - [arm64] ASoC: wm8904: fix wrong outputs volume after power reactivation
    - mtd: cfi: allow building spi-intel standalone
    - ALSA: usb-audio: Make sure to stop endpoints before closing EPs
    - ALSA: usb-audio: Relax hw constraints for implicit fb sync
    - tipc: fix unexpected link reset due to discovery messages
    - NFSD: Pass the target nfsd_file to nfsd_commit()
    - NFSD: Revert "NFSD: NFSv4 CLOSE should release an nfsd_file immediately"
    - NFSD: Add an NFSD_FILE_GC flag to enable nfsd_file garbage collection
    - nfsd: remove the pages_flushed statistic from filecache
    - nfsd: reorganize filecache.c
    - NFSD: Add an nfsd_file_fsync tracepoint
    - nfsd: rework refcounting in filecache
    - nfsd: fix handling of cached open files in nfsd4_open codepath
    - sched/core: Fix arch_scale_freq_tick() on tickless systems
    - hvc/xen: lock console list traversal
    - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
    - gro: avoid checking for a failed search
    - gro: take care of DODGY packets
    - [arm64] ASoC: qcom: Fix building APQ8016 machine driver without SOUNDWIRE
    - drm/amdgpu: Fix potential NULL dereference
    - ice: Fix potential memory leak in ice_gnss_tty_write()
    - ice: Add check for kzalloc
    - drm/vmwgfx: Write the driver id registers
    - drm/vmwgfx: Refactor resource manager's hashtable to use linux/hashtable
      implementation.
    - drm/vmwgfx: Remove ttm object hashtable
    - drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable
      implementation.
    - drm/vmwgfx: Refactor ttm reference object hashtable to use
      linux/hashtable.
    - drm/vmwgfx: Remove vmwgfx_hashtab
    - drm/vmwgfx: Remove rcu locks from user resources
    - net/sched: act_mpls: Fix warning during failed attribute validation
    - Revert "r8169: disable detection of chip version 36"
    - net/mlx5: check attr pointer validity before dereferencing it
    - net/mlx5e: TC, Keep mod hdr actions after mod hdr alloc
    - net/mlx5: Fix command stats access after free
    - net/mlx5e: Verify dev is present for fix features ndo
    - net/mlx5e: IPoIB, Block queue count configuration when sub interfaces are
      present
    - net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent
    - net/mlx5e: IPoIB, Fix child PKEY interface stats on rx path
    - net/mlx5: Fix ptp max frequency adjustment range
    - net/mlx5e: Don't support encap rules with gbp option
    - net/mlx5e: Fix macsec ssci attribute handling in offload path
    - net/mlx5e: Fix macsec possible null dereference when updating MAC security
      entity (SecY)
    - igc: Fix PPS delta between two synchronized end-points
    - [arm64] net: hns3: fix wrong use of rss size during VF rss config
    - bnxt: make sure we return pages to the pool
    - [x86] platform/surface: aggregator: Add missing call to
      ssam_request_sync_free()
    - [x86] platform/x86/amd: Fix refcount leak in amd_pmc_probe
    - ALSA: usb-audio: Fix possible NULL pointer dereference in
      snd_usb_pcm_has_fixed_rate()
    - efi: fix NULL-deref in init error path
    - io_uring: lock overflowing for IOPOLL
    - io_uring/poll: attempt request issue after racy poll wakeup
    - [x86] drm/i915: Fix CFI violations in gt_sysfs
    - io_uring/io-wq: free worker if task_work creation is canceled
    - io_uring/io-wq: only free worker if it was allocated for creation
    - block: handle bio_split_to_limits() NULL return
    - [arm64,armhf] Revert "usb: ulpi: defer ulpi_register on ulpi_read_id
      timeout"
    - pinctrl: amd: Add dynamic debugging for active GPIOs

  [ Helmut Grohne ]
  * Fix cross Build-Depends: Annotate python3 and python3-jinja2
    dependencies :native. (Closes: #1028184)

  [ Helge Deller ]
  * [hppa] Add i2c-modules udeb

  [ Miguel Bernal Marin ]
  * [x86] Enable Intel Speed Select Technology as module (Closes: #1028344)
    - Enable INTEL_SPEED_SELECT_INTERFACE.
  * [amd64] Enable the Intel Data Accelerators performance monitor
    (Closes: #1028509)
    - Enable INTEL_IDXD_PERFMON.

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "arm: Add support for lazy preemption"
  * Bump ABI to 2
  * d/t/tools-unversioned: hyperv-daemons Drop Depends on lsb-base
  * Refresh "radeon, amdgpu: Firmware is required for DRM and KMS on R600
    onward"

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 18 Jan 2023 20:56:44 +0100

linux (6.1.4-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.3
    - eventpoll: add EPOLL_URING_WAKE poll wakeup flag
    - eventfd: provide a eventfd_signal_mask() helper
    - io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups
    - nvme-pci: fix doorbell buffer value endianness
    - nvme-pci: fix mempool alloc size
    - nvme-pci: fix page size checks
    - ACPI: resource: do IRQ override on XMG Core 15
    - ACPI: resource: do IRQ override on Lenovo 14ALC7
    - ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
    - [x86] ACPI: video: Fix Apple GMUX backlight detection
    - block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq
    - ata: ahci: Fix PCS quirk application for suspend
    - nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition
    - soundwire: dmi-quirks: add quirk variant for LAPBC710 NUC15
    - [arm64,armhf] phy: sun4i-usb: Introduce port2 SIDDQ quirk
    - [arm64,armhf] phy: sun4i-usb: Add support for the H616 USB PHY
    - [powerpc*] rtas: avoid device tree lookups in rtas_os_term()
    - [powerpc*] rtas: avoid scheduling in rtas_os_term()
    - NFSD: fix use-after-free in __nfs42_ssc_open() (CVE-2022-4379)
    - kprobes: kretprobe events missing on 2-core KVM guest
    - HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
    - HID: plantronics: Additional PIDs for double volume key presses quirk
    - futex: Fix futex_waitv() hrtimer debug object leak on kcalloc error
    - rtmutex: Add acquire semantics for rtmutex lock acquisition slow path
    - mm, mremap: fix mremap() expanding vma with addr inside vma
    - mm/mempolicy: fix memory leak in set_mempolicy_home_node system call
    - pstore: Properly assign mem_type property
    - pstore/zone: Use GFP_ATOMIC to allocate zone buffer
    - hfsplus: fix bug causing custom uid and gid being unable to be assigned
      with mount
    - [x86] ACPI: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865
    - [x86] ACPI: x86: s2idle: Stop using AMD specific codepath for Rembrandt+
    - ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
    - ovl: update ->f_iocb_flags when ovl_change_flags() modifies ->f_flags
    - ALSA: line6: correct midi status byte when receiving data from podxt
    - ALSA: line6: fix stack overflow in line6_midi_transmit
    - ALSA: hda/hdmi: Static PCM mapping again with AMD HDMI codecs
    - pnode: terminate at peers of source
    - md: fix a crash in mempool_free
    - mm, compaction: fix fast_isolate_around() to stay within boundaries
    - f2fs: should put a page when checking the summary info
    - f2fs: allow to read node block after shutdown
    - block: Do not reread partition table on exclusively open device
    - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
    - tpm: acpi: Call acpi_put_table() to fix memory leak
    - tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
    - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
    - SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.4
    - drm/amdgpu: skip MES for S0ix as well since it's part of GFX
    - drm/amdgpu: skip mes self test after s0i3 resume for MES IP v11.0
    - media: stv0288: use explicitly signed char
    - cxl/region: Fix memdev reuse check
    - [arm64] Prohibit instrumentation on arch_stack_walk()
    - jbd2: use the correct print format
    - [x86] perf/x86/intel/uncore: Disable I/O stacks to PMU mapping on ICX-D
    - [x86] perf/x86/intel/uncore: Clear attr_update properly
    - [arm64] dts: qcom: sdm845-db845c: correct SPI2 pins drive strength
    - [arm64] phy: qcom-qmp-combo: fix out-of-bounds clock access
    - drm/amd/pm: update SMU13.0.0 reported maximum shader clock
    - drm/amd/pm: correct SMU13.0.0 pstate profiling clock settings
    - btrfs: fix uninitialized parent in insert_state
    - btrfs: fix extent map use-after-free when handling missing device in
      read_one_chunk
    - btrfs: fix resolving backrefs for inline extent followed by prealloc
    - [arm64] dts: qcom: sdm850-samsung-w737: correct I2C12 pins drive strength
    - random: use rejection sampling for uniform bounded random integers
    - [x86] fpu/xstate: Fix XSTATE_WARN_ON() to emit relevant diagnostics
    - [arm64] dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive
      strength
    - cxl/region: Fix missing probe failure
    - EDAC/mc_sysfs: Increase legacy channel support to 12
    - [x86] MCE/AMD: Clear DFR errors found in THR handler
    - random: add helpers for random numbers with given floor or range
    - PM/devfreq: governor: Add a private governor_data for governor
    - cpufreq: Init completion before kobject_init_and_add()
    - ext2: unbugger ext2_empty_dir()
    - bpf: Resolve fext program type when checking map compatibility
    - ALSA: patch_realtek: Fix Dell Inspiron Plus 16
    - ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops
    - [x86] platform/x86: thinkpad_acpi: Fix max_brightness of thinklight
    - [x86] platform/x86: ideapad-laptop: Revert "check for touchpad support in
      _CFG"
    - [x86] platform/x86: ideapad-laptop: Add new _CFG bit numbers for future
      use
    - [x86] platform/x86: ideapad-laptop: support for more special keys in WMI
    - ACPI: video: Simplify __acpi_video_get_backlight_type()
    - ACPI: video: Prefer native over vendor
    - [x86] platform/x86: ideapad-laptop: Refactor ideapad_sync_touchpad_state()
    - [x86] platform/x86: ideapad-laptop: Do not send KEY_TOUCHPAD* events on
      probe / resume
    - [x86] platform/x86: ideapad-laptop: Only toggle ps2 aux port on/off on
      select models
    - [x86] platform/x86: ideapad-laptop: Send KEY_TOUCHPAD_TOGGLE on some
      models
    - [x86] platform/x86: ideapad-laptop: Stop writing VPCCMD_W_TOUCHPAD at
      probe time
    - [x86] platform/x86: intel-uncore-freq: add Emerald Rapids support
    - ALSA: hda/cirrus: Add extra 10 ms delay to allow PLL settle and lock.
    - [x86] platform/x86: x86-android-tablets: Add Medion Lifetab S10346 data
    - [x86] platform/x86: x86-android-tablets: Add Lenovo Yoga Tab 3 (YT3-X90F)
      charger + fuel-gauge data
    - [x86] platform/x86: x86-android-tablets: Add Advantech MICA-071 extra
      button
    - HID: Ignore HP Envy x360 eu0009nv stylus battery
    - ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless
    - fs: dlm: fix sock release if listen fails
    - fs: dlm: retry accept() until -EAGAIN or error returns
    - mptcp: netlink: fix some error return code
    - mptcp: remove MPTCP 'ifdef' in TCP SYN cookies
    - mptcp: dedicated request sock for subflow in v6
    - mptcp: use proper req destructor for IPv6
    - dm cache: Fix ABBA deadlock between shrink_slab and
      dm_cache_metadata_abort
    - dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
    - dm thin: Use last transaction's pmd->root when commit failed
    - dm thin: resume even if in FAIL mode
    - dm thin: Fix UAF in run_timer_softirq()
    - dm integrity: Fix UAF in dm_integrity_dtr()
    - dm cache: Fix UAF in destroy()
    - dm cache: set needs_check flag after aborting metadata
    - PCI/DOE: Fix maximum data object length miscalculation
    - tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'
    - perf/core: Call LSM hook after copying perf_event_attr
    - [x86] KVM: VMX: Resume guest immediately when injecting #GP on ECREATE
    - [x86] KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check
      fails
    - [x86] KVM: x86: fix APICv/x2AVIC disabled when vm reboot by itself
    - [x86] KVM: nVMX: Properly expose ENABLE_USR_WAIT_PAUSE control to L1
    - [x86] microcode/intel: Do not retry microcode reloading on the APs
    - [x86] ftrace/x86: Add back ftrace_expected for ftrace bug reports
    - [x86] kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK
    - [x86] kprobes: Fix optprobe optimization check with CONFIG_RETHUNK
    - tracing: Fix race where eprobes can be called before the event
    - [powerpc*] ftrace: fix syscall tracing on PPC64_ELF_ABI_V1
    - tracing: Fix complicated dependency of CONFIG_TRACER_MAX_TRACE
    - tracing/hist: Fix wrong return value in parse_action_params()
    - tracing/probes: Handle system names with hyphens
    - tracing: Fix issue of missing one synthetic field
    - tracing: Fix infinite loop in tracing_read_pipe on overflowed
      print_trace_line
    - media: dvb-core: Fix double free in dvb_register_device()
    - media: dvb-core: Fix UAF due to refcount races at releasing
      (CVE-2022-41218)
    - cifs: fix confusing debug message
    - cifs: fix missing display of three mount options
    - cifs: set correct tcon status after initial tree connect
    - cifs: set correct ipc status after initial tree connect
    - cifs: set correct status of tcon ipc when reconnecting
    - drm/amdgpu: fix mmhub register base coding error
    - block: mq-deadline: Fix dd_finish_request() for zoned devices
    - block: mq-deadline: Do not break sequential write streams to zoned HDDs
    - md/bitmap: Fix bitmap chunk size overflow issues
    - efi: Add iMac Pro 2017 to uefi skip cert quirk
    - ipmi: fix long wait in unload when IPMI disconnect
    - mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type()
    - ima: Fix a potential NULL pointer access in ima_restore_measurement_list
    - ipmi: fix use after free in _ipmi_destroy_user()
    - mtd: spi-nor: gigadevice: gd25q256: replace gd25q256_default_init with
      gd25q256_post_bfpt
    - ima: Fix memory leak in __ima_inode_hash()
    - PCI: Fix pci_device_is_present() for VFs by checking PF
    - PCI/sysfs: Fix double free in error path
    - [riscv64] kexec: Fix memory leak of fdt buffer
    - [riscv64] kexec: Fix memory leak of elf header buffer
    - [riscv64] stacktrace: Fixup ftrace_graph_ret_addr retp argument
    - [riscv64] mm: notify remote harts about mmu cache updates
    - [x86] crypto: ccp - Add support for TEE for PCI ID 0x14CA
    - driver core: Fix bus_type.match() error handling in __driver_attach()
    - bus: mhi: host: Fix race between channel preparation and M0 event
    - [arm64] phy: qcom-qmp-combo: fix sdm845 reset
    - [arm64] phy: qcom-qmp-combo: fix sc8180x reset
    - [amd64] iommu/amd: Fix ivrs_acpihid cmdline parsing code
    - [amd64] iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid
      options
    - hugetlb: really allocate vma lock for all sharable vmas
    - [armhf] remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
    - device_cgroup: Roll back to original exceptions after copy failure
    - drm/connector: send hotplug uevent on connector cleanup
    - drm/vmwgfx: Validate the box size for the snooped cursor (CVE-2022-36280)
    - [x86] drm/mgag200: Fix PLL setup for G200_SE_A rev >=4
    - [arm64,armhf] drm/etnaviv: move idle mapping reaping into separate
      function
    - [x86] drm/i915/dsi: fix VBT send packet port selection for dual link DSI
    - [arm64,armhf] drm/etnaviv: reap idle mapping if it doesn't match the
      softpin address
    - ext4: silence the warning when evicting inode with dioread_nolock
    - ext4: add inode table check in __ext4_get_inode_loc to aovid possible
      infinite loop
    - ext4: remove trailing newline from ext4_msg() message
    - ext4: correct inconsistent error msg in nojournal mode
    - fs: ext4: initialize fsdata in pagecache_write()
    - ext4: fix use-after-free in ext4_orphan_cleanup
    - ext4: fix undefined behavior in bit shift for ext4_check_flag_values
    - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
    - ext4: add helper to check quota inums
    - ext4: fix bug_on in __es_tree_search caused by bad quota inode
    - ext4: fix reserved cluster accounting in __es_remove_extent()
    - ext4: journal_path mount options should follow links
    - ext4: check and assert if marking an no_delete evicting inode dirty
    - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
    - ext4: don't allow journal inode to have encrypt flag
    - ext4: disable fast-commit of encrypted dir operations
    - ext4: fix leaking uninitialized memory in fast-commit journal
    - ext4: don't set up encryption key during jbd2 transaction
    - ext4: add missing validation of fast-commit record lengths
    - ext4: fix unaligned memory access in ext4_fc_reserve_space()
    - ext4: fix off-by-one errors in fast-commit block filling
    - ext4: fix uninititialized value in 'ext4_evict_inode'
    - ext4: init quota for 'old.inode' in 'ext4_rename'
    - ext4: don't fail GETFSUUID when the caller provides a long buffer
    - ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline
    - ext4: fix corruption when online resizing a 1K bigalloc fs
    - ext4: fix error code return to user-space in ext4_get_branch()
    - ext4: fix bad checksum after online resize
    - ext4: dont return EINVAL from GETFSUUID when reporting UUID length
    - ext4: fix corrupt backup group descriptors after online resize
    - ext4: avoid BUG_ON when creating xattrs
    - ext4: fix deadlock due to mbcache entry corruption
    - ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
    - ext4: fix inode leak in ext4_xattr_inode_create() on an error path
    - ext4: initialize quota before expanding inode in setproject ioctl
    - ext4: avoid unaccounted block allocation when expanding inode
    - ext4: allocate extended attribute value in vmalloc area
    - [x86] drm/i915/ttm: consider CCS for backup objects
    - drm/amd/display: Add DCN314 display SG Support
    - drm/amdgpu: handle polaris10/11 overlap asics (v2)
    - drm/amdgpu: make display pinning more flexible (v2)
    - [x86] drm/i915: improve the catch-all evict to handle lock contention
    - [x86] drm/i915/migrate: Account for the reserved_space
    - drm/amd/pm: add missing SMU13.0.0 mm_dpm feature mapping
    - drm/amd/pm: add missing SMU13.0.7 mm_dpm feature mapping
    - drm/amd/pm: bump SMU13.0.0 driver_if header to version 0x34
    - drm/amd/pm: correct the fan speed retrieving in PWM for some SMU13 asics

  [ Salvatore Bonaccorso ]
  * Set ABI to 1
  * Refresh "security,perf: Allow further restriction of perf_event_open"

  [ Diederik de Haas ]
  * [arm64] Enable CRYPTO_POLYVAL_ARM64_CE as module

  [ Emanuele Rocca ]
  * [arm64] drivers/hwtracing/coresight: Enable CORESIGHT,
    CORESIGHT_SOURCE_ETM4X and CORESIGHT_TRBE as modules (Closes: #1014743)

  [ Miguel Bernal Marin ]
  * [x86] Enable Intel Vendor Specific Extended Capabilities Driver,
    with Intel Platform Monitoring Technology and Intel Software Defined
    Silicon Driver as modules (Closes: #1027953)
    - Enable CONFIG_INTEL_VSEC.
    - Enable CONFIG_INTEL_SDSI.
    - Enable CONFIG_INTEL_PMT_TELEMETRY.
    - Enable CONFIG_INTEL_PMT_CRASHLOG.

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 07 Jan 2023 14:53:00 +0100

linux (6.1.2-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.2
    - misc: sgi-gru: fix use-after-free error in gru_set_context_option,
      gru_fault and gru_handle_user_call_os (CVE-2022-3424)
    - i2c: ismt: Fix an out-of-bounds bug in ismt_access() (CVE-2022-2873)

  [ Ben Hutchings ]
  * Fix build regression in stage1 and pkg.linux.nokernel profiles
  * linux-perf: Simplify build-dependency on libbabeltrace-dev
  * linux-perf: Build with libzstd
  * linux-perf: Disable building with libdebuginfod
  * linux-perf: Update variable definitions to disable building with libbfd

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "net: Remove the obsolte u64_stats_fetch_*_irq() users (net)."

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 01 Jan 2023 10:57:02 +0100

linux (6.1.1-1~exp2) experimental; urgency=medium

  [ Diederik de Haas ]
  * [arm64] Fix/enable audio on rk356x devices
  * [arm64] Enable various Pine64's SOQuartz features
  * [arm64] Enable several Pine64's SOQuartz baseboards

  [ Salvatore Bonaccorso ]
  * debian/bin/gencontrol_signed.py: Adjust arguments for
    _ControlFileDict.setdefault() calls

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 24 Dec 2022 08:04:23 +0100

linux (6.1.1-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_6.1
    - xen/netback: fix build warning (Closes: #1026035)
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.1

  [ Bastian Blank ]
  * Support Jinja2 templates.
  * Convert some templates to Jinja2.
  * Restore lost special relations for images.

  [ Aurelien Jarno ]
  * [arm64] Backport rk3568-odroid-m1.dts file from upstream.

  [ Diederik de Haas ]
  * [x86] Enable X86_SGX_KVM (Closes: #1026174)
  * [arm64,powerpc*,s390x,x86] arch: Enable RANDOMIZE_KSTACK_OFFSET_DEFAULT
    (Closes: #1016056)

  [ Ben Hutchings ]
  * d/salsa-ci.yml: Run extract-source job in target release, not unstable

  [ Salvatore Bonaccorso ]
  * [x86] drivers/thermal/intel: Enable INTEL_HFI_THERMAL (Closes: #1026336)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 22 Dec 2022 21:58:26 +0100

linux (6.1~rc8-1~exp1) experimental; urgency=medium

  * New upstream release candidate.

  [ Bastian Blank ]
  * Generate calls into rules.real for setup targets.
  * Simplify source rules generation.
  * Generate calls into rules.real for extra.
  * Remove remaining old targets in rules.real.

  [ Salvatore Bonaccorso ]
  * lockdown: Correct mentioning of mode when LOCK_DOWN_IN_EFI_SECURE_BOOT is
    enabled (Closes: #1025417)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 09 Dec 2022 08:20:09 +0100

linux (6.1~rc7-1~exp1) experimental; urgency=medium

  * New upstream release candidate.

  [ Bastian Blank ]
  * Rename templates to debhelper schema.
  * Support extra debhelper template for every package.

  [ Salvatore Bonaccorso ]
  * [x86] drivers/cpufreq: Change X86_AMD_PSTATE from module to built-in
  * [rt] Update to 6.1-rc7-rt5

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 01 Dec 2022 14:53:19 +0100

linux (6.1~rc6-1~exp1) experimental; urgency=medium

  * New upstream release candidate.

  [ Salvatore Bonaccorso ]
  * [rt] Update to 6.1-rc6-rt4
  * net: wwan: iosm: fix dma_alloc_coherent incompatible pointer type (Fixes
    FTBFS on armhf)

  [ Punit Agrawal ]
  * [arm64] drivers/perf: Enable ARM_SPE_PMU as a module
  * [arm64] drivers/perf: Enable ARM_DSU_PMU as a module
  * [arm64] drivers/perf: Convert CCN_PMU from builtin to a module

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 26 Nov 2022 19:05:45 +0100

linux (6.1~rc5-1~exp1) experimental; urgency=medium

  * New upstream release candidate.

  [ Punit Agrawal ]
  * trace: Enable HIST_TRIGGERS for all kernels

  [ Patrick Clara ]
  * [x86] drivers/hwmon: Enable SENSORS_AQUACOMPUTER_D5NEXT as module
    (Closes: #1019496)

  [ Diederik de Haas ]
  * [arm64] Drop "arm64: dts: rockchip: correct voltage selector on
    Firefly-RK3399" (never applied upstream)
  * [x86] drivers/hwmon: Enable SENSORS_CORSAIR_CPRO as module
    (Closes: #1023992)

  [ Salvatore Bonaccorso ]
  * [x86] sound/soc/intel/boards: Enable SND_SOC_INTEL_SOF_ES8336_MACH as module
    (Closes: #1014595)
  * [s390x] debian/config: Drop explicit enable of RELOCATABLE.
  * mm: Enable Multi-Gen LRU implementation (not enabled by default)
  * [rt] Update to 6.1-rc5-rt3

  [ Adam Borowski ]
  * Enable CXL_BUS for amd64 arm64 ppc64el riscv64 (Closes: #1021998)

  [ Bastian Blank ]
  * Install some leftovers into the right location. (closes: #1023720)

  [ Aurelien Jarno ]
  * [riscv64] Set CONFIG_I2C=y to match most other architectures and fix an
    FTBFS due to modules ending-up in more than one package.
  * [riscv64] Improve Microchip Polarfire support:
    - Enable HW_RANDOM_POLARFIRE_SOC.
    - Enable MAILBOX and POLARFIRE_SOC_MAILBOX.
    - Enable POLARFIRE_SOC_SYS_CTRL.
    - Enable RTC_DRV_POLARFIRE_SOC.

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 16 Nov 2022 23:29:47 +0100

linux (6.1~rc3-1~exp1) experimental; urgency=medium

  * New upstream release candidate.

  [ Bastian Blank ]
  * [arm64] Enable ARCH_NXP.
  * Generate the lists of packages to build.
  * Use abi name 0 for everything before unstable.

  [ Luca Boccassi ]
  * verity: enable DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
  * ima: enable ARCH_POLICY to let IMA check the status of SecureBoot
  * Enable CONFIG_INTEGRITY_MACHINE_KEYRING to load keys from MoK into
    the new machine keyring, trust by default and link into trusted and
    secondary keyrings. Refresh/drop obsolete out-of-tree patches.

  [ Diederik de Haas ]
  * [arm64] Enable ARCH_BCM to re-enable various RPi options

  [ Aurelien Jarno ]
  * [arm64] Enable support for Rockchip rk356x devices (Rock 3A, Quartz64,
    Odroid M1, etc.):
    - Enable ARM_SCMI_PROTOCOL, COMMON_CLK_SCMI, RESET_SCMI.
    - Enable CHARGER_RK817.
    - Enable MMC_SDHCI_OF_DWCMSHC.
    - Enable MOTORCOMM_PHY.
    - Enable PCIE_ROCKCHIP_DW_HOST, PHY_ROCKCHIP_SNPS_PCIE3.
    - Enable PHY_ROCKCHIP_INNO_CSIDPHY, PHY_ROCKCHIP_INNO_DSIDPHY,
      PHY_ROCKCHIP_NANENG_COMBO_PHY.
    - Enable ROCKCHIP_VOP2.
    - Enable SND_SOC_RK817, SND_SOC_ROCKCHIP_I2S_TDM.
    - Enable SPI_ROCKCHIP_SFC.

  [ Salvatore Bonaccorso ]
  * drivers/net/ethernet/sfc: Re-enable support for Solarflare SFC9000
    (Closes: #1022276)
    - Enable SFC_SIENA as module
    - Enable SFC_SIENA_MTD, SFC_SIENA_MCDI_MON, SFC_SIENA_SRIOV and
      SFC_SIENA_MCDI_LOGGING
  * [rt] Update to 6.1-rc2-rt1
  * [rt] Drop "mm: multi-gen LRU: Move lru_gen_add_mm() out of IRQ-off" (applied
    upstream)

 -- Bastian Blank <waldi@debian.org>  Wed, 02 Nov 2022 22:24:00 +0100

linux (6.0.12-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.11
    - [arm*] binder: validate alloc->mm in ->mmap() handler
    - ceph: Use kcalloc for allocating multiple elements
    - ceph: fix NULL pointer dereference for req->r_session
    - wifi: mac80211: fix memory free error when registering wiphy fail
    - wifi: cfg80211: Fix bitrates overflow issue
    - wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
    - [riscv64] dts: sifive unleashed: Add PWM controlled LEDs
    - audit: fix undefined behavior in bit shift for AUDIT_BIT
    - wifi: airo: do not assign -1 to unsigned char
    - wifi: mac80211: Fix ack frame idr leak when mesh has no route
    - wifi: ath11k: Fix QCN9074 firmware boot on x86
    - [s390x] zcrypt: fix warning about field-spanning write
    - [armhf] spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for
      every run
    - Revert "net: macsec: report real_dev features when HW offloading is
      enabled"
    - [x86] ACPI: video: Add backlight=native DMI quirk for Dell G15 5515
    - [x86] platform/x86: ideapad-laptop: Disable touchpad_switch
    - [x86] platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2
      2-in-1
    - [x86] platform/x86/intel/pmt: Sapphire Rapids PMT errata fix
    - [x86] platform/x86/intel/hid: Add some ACPI device IDs
    - [powerpc*] scsi: ibmvfc: Avoid path failures during live migration
    - scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC
    - drm: panel-orientation-quirks: Add quirk for Nanote UMPC-01
    - drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017)
    - block, bfq: fix null pointer dereference in bfq_bio_bfqg()
    - [s390x] always build relocatable kernel
    - [arm64] syscall: Include asm/ptrace.h in syscall_wrapper header.
    - nvme: quiet user passthrough command errors
    - nvmet: fix memory leak in nvmet_subsys_attr_model_store_locked
    - net: wwan: iosm: fix kernel test robot reported errors
    - drm/amd/display: Zeromem mypipe heap struct before using it
    - drm/amd/display: Fix FCLK deviation and tool compile issues
    - drm/amd/display: Fix gpio port mapping issue
    - Revert "drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10
      properly""
    - drm/amdgpu: Drop eviction lock when allocating PT BO
    - drm/amd/display: only fill dirty rectangles when PSR is enabled
    - ALSA: usb-audio: add quirk to fix Hamedal C20 disconnect issue
    - [riscv64] vdso: Do not add missing symbols to version section in linker
      script
    - [mips*] pic32: treat port as signed integer
    - io_uring/poll: lockdep annote io_poll_req_insert_locked
    - xfrm: fix "disable_policy" on ipv4 early demux
    - [arm64] dts: rockchip: fix quartz64-a bluetooth configuration
    - xfrm: replay: Fix ESN wrap around for GSO
    - af_key: Fix send_acquire race with pfkey_register
    - [arm64,armhf] ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove
    - ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open()
    - [x86] hyperv: Restore VP assist page after cpu offlining/onlining
    - scsi: storvsc: Fix handling of srb_status and capacity change events
    - [amd64,arm64] PCI: hv: Only reuse existing IRTE allocation for Multi-MSI
    - [arm64] dts: rockchip: Fix Pine64 Quartz4-B PMIC interrupt
    - [x86] ASoC: max98373: Add checks for devm_kcalloc
    - regulator: core: fix kobject release warning and memory leak in
      regulator_register()
    - regulator: core: fix UAF in destroy_regulator()
    - [arm64,armhf] bus: sunxi-rsb: Remove the shutdown callback
    - [arm64,armhf] bus: sunxi-rsb: Support atomic transfers
    - [arm64] tee: optee: fix possible memory leak in optee_register_device()
    - net: liquidio: simplify if expression
    - ipvlan: hold lower dev to avoid possible use-after-free
    - rxrpc: Fix race between conn bundle lookup and bundle removal
      [ZDI-CAN-15975]
    - nfc/nci: fix race with opening and closing
    - [i386] net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
    - 9p/fd: fix issue of list_del corruption in p9_fd_cancel()
    - netfilter: conntrack: Fix data-races around ct mark
    - netfilter: nf_tables: do not set up extensions for end interval
    - iavf: Fix a crash during reset task
    - iavf: Do not restart Tx queues after reset task failure
    - iavf: remove INITIAL_MAC_SET to allow gARP to work properly
    - iavf: Fix race condition between iavf_shutdown and iavf_remove
    - [armhf] dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties
    - net/mlx4: Check retval of mlx4_bitmap_init
    - [arm64,armhf] net: mvpp2: fix possible invalid pointer dereference
    - net/qla3xxx: fix potential memleak in ql3xxx_send()
    - [i386] net: pch_gbe: fix pci device refcount leak while module exiting
    - nfp: fill splittable of devlink_port_attrs correctly
    - nfp: add port from netdev validation for EEPROM access
    - bonding: fix ICMPv6 header handling when receiving IPv6 messages
    - macsec: Fix invalid error code set
    - [x86] drm/i915: Fix warn in intel_display_power_*_domain() functions
    - Drivers: hv: vmbus: fix double free in the error path of
      vmbus_add_channel_work()
    - Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
    - netfilter: ipset: regression in ip_set_hash_ip.c
    - net/mlx5: Do not query pci info while pci disabled
    - net/mlx5: Fix FW tracer timestamp calculation
    - net/mlx5: SF: Fix probing active SFs during driver probe phase
    - net/mlx5: cmdif, Print info on any firmware cmd failure to tracepoint
    - net/mlx5: Fix handling of entry refcount when command is not issued to FW
    - net/mlx5: E-Switch, Set correctly vport destination
    - net/mlx5: Fix sync reset event handler error flow
    - net/mlx5e: Offload rule only when all encaps are valid
    - net: phy: at803x: fix error return code in at803x_probe()
    - tipc: set con sock in tipc_conn_alloc
    - tipc: add an extra conn_get in tipc_conn_alloc
    - tipc: check skb_linearize() return value in tipc_disc_rcv()
    - zonefs: Fix race between modprobe and mount
    - xfrm: Fix oops in __xfrm_state_delete()
    - xfrm: Fix ignored return value in xfrm6_init()
    - net: wwan: iosm: use ACPI_FREE() but not kfree() in
      ipc_pcie_read_bios_cfg()
    - sfc: fix potential memleak in __ef100_hard_start_xmit()
    - net: sched: allow act_ct to be built without NF_NAT
    - NFC: nci: fix memory leak in nci_rx_data_packet()
    - [armhf] regulator: twl6030: re-add TWL6032_SUBCLASS
    - bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending()
    - [x86] cpufreq: amd-pstate: change amd-pstate driver to be built-in type
    - netfilter: ipset: restore allowing 64 clashing elements in hash:net,iface
    - netfilter: flowtable_offload: add missing locking
    - fs: do not update freeing inode i_io_list
    - blk-mq: fix queue reference leak on blk_mq_alloc_disk_for_queue failure
    - dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
    - ipv4: Fix error return code in fib_table_insert()
    - [x86] arcnet: fix potential memory leak in com20020_probe()
    - [s390x] ap: fix memory leak in ap_init_qci_info()
    - [s390x] dasd: fix no record found for raw_track_access
    - fscache: fix OOB Read in __fscache_acquire_volume
    - [arm64] net: enetc: cache accesses to &priv->si->hw
    - [arm64] net: enetc: preserve TX ring priority across reconfiguration
    - virtio_net: Fix probe failed when modprobe virtio_net
    - [arm64] net: thunderx: Fix the ACPI memory leak
    - io_uring/filetable: fix file reference underflow
    - io_uring/poll: fix poll_refs race with cancelation
    - lib/vdso: use "grep -E" instead of "egrep"
    - can: gs_usb: remove dma allocations
    - [armhf] usb: dwc3: exynos: Fix remove() function
    - cifs: fix missing unlock in cifs_file_copychunk_range()
    - cifs: Use after free in debug code
    - ext4: fix use-after-free in ext4_ext_shift_extents
    - [arm64] dts: rockchip: lower rk3399-puma-haikou SD controller clock
      frequency
    - [armhf] iio: adc: aspeed: Remove the trim valid dts property.
    - iio: light: apds9960: fix wrong register for gesture gain
    - iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
    - iio: accel: bma400: Fix memory leak in bma400_get_steps_reg()
    - [amd64] virt/sev-guest: Prevent IV reuse in the SNP guest driver
    - [x86] cpufreq: amd-pstate: cpufreq: amd-pstate: reset MSR_AMD_PERF_CTL
      register at init
    - zonefs: Fix active zone accounting
    - [arm64,armhf] spi: spi-imx: Fix spi_bus_clk if requested clock is higher
      than input clock
    - [arm64,armhf] spi: spi-imx: spi_imx_transfer_one(): check for DMA transfer
      first
    - NFSD: Fix reads with a non-zero offset that don't end on a page boundary
    - drm/amdgpu: Enable SA software trap.
    - drm/amd/display: Added debug option for forcing subvp num ways
    - drm/amd/display: Add debug option for allocating extra way for cursor
    - drm/amd/display: Update MALL SS NumWays calculation
    - drm/amd/display: Fix calculation for cursor CAB allocation
    - [arm64,armhf] usb: dwc3: gadget: conditionally remove requests
    - [arm64,armhf] usb: dwc3: gadget: Return -ESHUTDOWN on ep disable
    - [arm64,armhf] usb: dwc3: gadget: Clear ep descriptor last
    - io_uring: cmpxchg for poll arm refs release
    - io_uring: make poll refs more robust
    - io_uring: clear TIF_NOTIFY_SIGNAL if set and task_work not available
    - nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
    - mm/cgroup/reclaim: fix dirty pages throttling on cgroup v1
    - mm: vmscan: fix extreme overreclaim and swap floods
    - [x86] KVM: x86/mmu: Fix race condition in direct_page_fault
      (CVE-2022-45869)
    - [x86] KVM: x86/xen: Only do in-kernel acceleration of hypercalls for guest
      CPL0
    - [x86] KVM: x86/xen: Validate port number in SCHEDOP_poll
    - [x86] drm/i915/gvt: Get reference to KVM iff attachment to VM is
      successful
    - [x86] KVM: x86: nSVM: leave nested mode on vCPU free
    - [x86] KVM: x86: forcibly leave nested mode on vCPU reset (CVE-2022-3344)
    - [x86] KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while
      still in use (CVE-2022-3344)
    - [x86] KVM: x86: add kvm_leave_nested
    - [x86] KVM: x86: remove exit_int_info warning in svm_handle_exit
    - [x86] KVM: Update gfn_to_pfn_cache khva when it moves within the same page
    - [x86] tsx: Add a feature bit for TSX control MSR support
    - [x86] pm: Add enumeration check before spec MSRs save/restore setup
    - [x86] ioremap: Fix page aligned size calculation in __ioremap_caller()
    - mm: fix unexpected changes to {failslab|fail_page_alloc}.attr
    - mm: correctly charge compressed memory to its memcg
    - Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode
    - [x86] ASoC: amd: yc: Add Alienware m17 R5 AMD into DMI table
    - [x86] ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01
    - [x86] ASoC: Intel: soc-acpi: add ES83x6 support to IceLake
    - ASoC: hda: intel-dsp-config: add ES83x6 quirk for IceLake
    - [x86] ASoC: SOF: ipc3-topology: use old pipeline teardown flow with SOF2.1
      and older
    - Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
    - Revert "tty: n_gsm: replace kicktimer with delayed_work"
    - Input: goodix - try resetting the controller when no config is set
    - bpf: Convert BPF_DISPATCHER to use static_call() (not ftrace)
    - [x86] Input: soc_button_array - add use_low_level_irq module parameter
    - [x86] Input: soc_button_array - add Acer Switch V 10 to
      dmi_use_low_level_irq[]
    - Input: i8042 - apply probe defer to more ASUS ZenBook models
    - xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too
    - [x86] xen/platform-pci: add missing free_irq() in error path
    - [x86] platform/x86: thinkpad_acpi: Enable s2idle quirk for 21A1 machine
      type
    - [x86] platform/x86: asus-wmi: add missing pci_dev_put() in
      asus_wmi_set_xusb2pr()
    - [x86] platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10
      (SW5-017)
    - [x86] platform/surface: aggregator_registry: Add support for Surface Pro 9
    - drm/amd/display: use uclk pstate latency for fw assisted mclk validation
      dcn32
    - drm/amdgpu: disable BACO support on more cards
    - zonefs: fix zone report size in __zonefs_io_error()
    - [x86] platform/surface: aggregator_registry: Add support for Surface
      Laptop 5
    - [x86] platform/x86: hp-wmi: Ignore Smart Experience App event
    - [x86] platform/x86: ideapad-laptop: Fix interrupt storm on fn-lock toggle
      on some Yoga laptops
    - [x86] platform/x86: ideapad-laptop: Add module parameters to match DMI
      quirk tables
    - tcp: configurable source port perturb table size
    - block: make blk_set_default_limits() private
    - dm-integrity: set dma_alignment limit in io_hints
    - dm-log-writes: set dma_alignment limit in io_hints
    - net: usb: qmi_wwan: add Telit 0x103a composition
    - scsi: iscsi: Fix possible memory leak when device_register() failed
    - [arm64,armhf] gpu: host1x: Avoid trying to use GART on Tegra20
    - dm integrity: flush the journal on suspend
    - dm integrity: clear the journal on suspend
    - fuse: lock inode unconditionally in fuse_fallocate()
    - btrfs: free btrfs_path before copying root refs to userspace
    - btrfs: free btrfs_path before copying inodes to userspace
    - btrfs: free btrfs_path before copying fspath to userspace
    - btrfs: free btrfs_path before copying subvol info to userspace
    - btrfs: zoned: fix missing endianness conversion in sb_write_pointer
    - btrfs: use kvcalloc in btrfs_get_dev_zone_info
    - btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()
    - btrfs: do not modify log tree while holding a leaf from fs tree locked
    - [x86] drm/i915/ttm: never purge busy objects
    - drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code
    - drm/amd/display: No display after resume from WB/CB
    - drm/amdgpu/psp: don't free PSP buffers on suspend
    - drm/amdgpu: Enable Aldebaran devices to report CU Occupancy
    - drm/amd/amdgpu: reserve vm invalidation engine for firmware
    - drm/amd/display: Update soc bounding box for dcn32/dcn321
    - drm/amdgpu: always register an MMU notifier for userptr
    - drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info
      correctly when the edid is read"
    - bpf: Add explicit cast to 'void *' for __BPF_DISPATCHER_UPDATE()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.12
    - btrfs: qgroup: fix sleep from invalid context bug in
      btrfs_qgroup_inherit()
    - drm/amdgpu: move setting the job resources
    - drm/amdgpu: cleanup error handling in amdgpu_cs_parser_bos
    - drm/amdgpu: fix userptr HMM range handling v2
    - drm/amd/pm: add smu_v13_0_10 driver if version
    - drm/amd/pm: update driver-if header for smu_v13_0_10
    - drm/amd/pm: update driver if header for smu_13_0_7
    - [arm64] clk: qcom: gdsc: add missing error handling
    - [arm64] clk: qcom: gdsc: Remove direct runtime PM calls
    - bpf, perf: Use subprog name when reporting subprog ksymbol
    - scripts/faddr2line: Fix regression in name resolution on ppc64le
    - [x86] hwmon: (i5500_temp) fix missing pci_disable_device()
    - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
    - [arm64,armhf] clocksource/drivers/arm_arch_timer: Fix XGene-1 TVAL
      register math error
    - bpf: Do not copy spin lock field from user in bpf_selem_alloc
    - of: property: decrement node refcount in of_fwnode_get_reference_args()
    - ixgbevf: Fix resource leak in ixgbevf_init_module()
    - i40e: Fix error handling in i40e_init_module()
    - iavf: Fix error handling in iavf_init_module()
    - e100: Fix possible use after free in e100_xmit_prepare
    - net/mlx5: DR, Fix uninitialized var warning
    - net/mlx5: E-switch, Destroy legacy fdb table when needed
    - net/mlx5: E-switch, Fix duplicate lag creation
    - net/mlx5: Fix uninitialized variable bug in outlen_write()
    - net/mlx5e: Fix use-after-free when reverting termination table
    - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
    - [i386] can: cc770: cc770_isa_probe(): add missing free_cc770dev()
    - vfs: fix copy_file_range() averts filesystem freeze protection
    - qlcnic: fix sleep-in-atomic-context bugs caused by msleep
    - aquantia: Do not purge addresses when setting the number of rings
    - wifi: cfg80211: fix buffer overflow in elem comparison
    - wifi: cfg80211: don't allow multi-BSSID in S1G
    - wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
    - net: phy: fix null-ptr-deref while probe() failed
    - net: net_netdev: Fix error handling in ntb_netdev_init_module()
    - net/9p: Fix a potential socket leak in p9_socket_open
    - net: wwan: iosm: fix kernel test robot reported error
    - net: wwan: iosm: fix dma_alloc_coherent incompatible pointer type
    - net: wwan: iosm: fix crash in peek throughput test
    - net: wwan: iosm: fix incorrect skb length
    - mptcp: don't orphan ssk in mptcp_close()
    - mptcp: fix sleep in atomic at close time
    - tipc: re-fetch skb cb after tipc_msg_validate
    - net: mdiobus: fix unbalanced node reference count
    - afs: Fix fileserver probe RTT handling
    - net: tun: Fix use-after-free in tun_detach()
    - net/mlx5: Lag, Fix for loop when checking lag
    - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
    - sctp: fix memory leak in sctp_stream_outq_migrate()
    - afs: Fix server->active leak in afs_put_server
    - [x86] hwmon: (coretemp) Check for null before removing sysfs attrs
    - [x86] hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
    - [x86] hwmon: (asus-ec-sensors) Add checks for devm_kcalloc
    - [riscv64] vdso: fix section overlapping under some conditions
    - [riscv64] mm: Proper page permissions after initmem free
    - ALSA: dice: fix regression for Lexicon I-ONIX FW810S
    - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
    - [x86] bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from
      S3
    - [x86] pinctrl: intel: Save and restore pins in "direct IRQ" mode
    - v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
    - mm: migrate: fix THP's mapcount on isolation
    - net: stmmac: Set MAC's flow control register to reflect current settings
    - mmc: core: Fix ambiguous TRIM and DISCARD arg
    - [amd64,armhf] mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check
    - mmc: sdhci: Fix voltage switch delay
    - drm/amdgpu: temporarily disable broken Clang builds due to blown
      stack-frame
    - drm/amdgpu: enable Vangogh VCN indirect sram mode
    - [x86] drm/i915: Fix negative value passed as remaining time
    - [x86] drm/i915: Never return 0 if not all requests retired
    - tracing/osnoise: Fix duration type
    - tracing: Fix race where histograms can be called before the event
    - tracing: Free buffers when a used dynamic event is removed
    - ASoC: ops: Fix bounds check for _sx controls
    - [arm64,armhf] pinctrl: single: Fix potential division by zero
    - [riscv64] Sync efi page table's kernel mappings before switching
    - [riscv64] fix race when vmap stack overflow
    - [riscv64] kexec: Fixup irq controller broken in kexec crash path
    - nvme: fix SRCU protection of nvme_ns_head list
    - [amd64] iommu/vt-d: Fix PCI device refcount leak in has_external_pci()
    - [amd64] iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
    - ipv4: Handle attempt to delete multipath route when fib_info contains an
      nh reference (CVE-2022-3435)
    - ipv4: Fix route deletion when nexthop info is not specified
    - i2c: Restore initial power state if probe fails
    - [arm64] i2c: qcom-geni: fix error return code in geni_i2c_gpi_xfer
    - [arm64,armhf] i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set
    - [amd64,arm64] ACPI: HMAT: remove unnecessary variable initialization
    - [amd64,arm64] ACPI: HMAT: Fix initiator registration for single-initiator
      systems
    - char: tpm: Protect tpm_pm_suspend with locks
    - ipc/sem: Fix dangling sem_array access in semtimedop race
    - proc: avoid integer type confusion in get_proc_long
    - proc: proc_skip_spaces() shouldn't think it is working on C strings

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "serial: 8250: implement write_atomic"
  * Bump ABI to 6
  * [s390x] debian/config: Drop explicit enable of RELOCATABLE.
  * [x86] drivers/cpufreq: Change X86_AMD_PSTATE from module to built-in
  * xen/netback: Ensure protocol headers don't fall in the non-linear area
    (XSA-423, CVE-2022-3643)
  * xen/netback: don't call kfree_skb() with interrupts disabled (XSA-424,
    CVE-2022-42328, CVE-2022-42329)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 09 Dec 2022 06:54:57 +0100

linux (6.0.10-2) unstable; urgency=medium

  * [x86] drm/i915: fix TLB invalidation for Gen12 video and compute engines
    (CVE-2022-4139)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 01 Dec 2022 07:42:33 +0100

linux (6.0.10-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.9
    - [x86] thunderbolt: Add DP OUT resource when DP tunnel is discovered
    - [x86] drm/i915/gvt: Add missing vfio_unregister_group_dev() call
    - KVM: debugfs: Return retval of simple_attr_open() if it fails
    - [x86] drm/i915: Allow more varied alternate fixed modes for panels
    - [x86] drm/i915: Simplify intel_panel_add_edid_alt_fixed_modes()
    - [x86] drm/i915/sdvo: Grab mode_config.mutex during LVDS init to avoid
      WARNs
    - drm/amd/display: Acquire FCLK DPM levels on DCN32
    - drm/amd/display: Limit dcn32 to 1950Mhz display clock
    - drm/amd/display: Set memclk levels to be at least 1 for dcn32
    - HID: wacom: Fix logic used for 3rd barrel switch emulation
    - [armhf] phy: stm32: fix an error code in probe
    - wifi: cfg80211: silence a sparse RCU warning
    - wifi: cfg80211: fix memory leak in query_regdb_file()
    - soundwire: qcom: reinit broadcast completion
    - soundwire: qcom: check for outanding writes before doing a read
    - bpf, verifier: Fix memory leak in array reallocation for stack state
    - bpf, sockmap: Fix the sk->sk_forward_alloc warning of
      sk_stream_kill_queues
    - wifi: mac80211: fix general-protection-fault in
      ieee80211_subif_start_xmit()
    - wifi: mac80211: Set TWT Information Frame Disabled bit as 1
    - bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without
      FILE
    - [x86,arm64] HID: hyperv: fix possible memory leak in mousevsc_probe()
    - [arm*] drm/vc4: hdmi: Fix HSM clock too low on Pi4
    - bpf, sock_map: Move cancel_work_sync() out of sock lock
    - [amd64,arm64] PCI: hv: Fix the definition of vector in
      hv_compose_msi_msg()
    - bpf: Add helper macro bpf_for_each_reg_in_vstate
    - bpf: Fix wrong reg type conversion in release_reference()
    - net: gso: fix panic on frag_list with mixed head alloc types
    - macsec: delete new rxsc when offload fails
    - macsec: fix secy->n_rx_sc accounting
    - macsec: fix detection of RXSCs when toggling offloading
    - macsec: clear encryption keys from the stack after setting up offload
    - net: tun: Fix memory leaks of napi_get_frags
    - bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()
    - bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer
    - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
    - [s390x] KVM: s390: pv: don't allow userspace to set the clock under PV
    - [s390x] KVM: s390: pci: Fix allocation size of aift kzdev elements
    - hamradio: fix issue of dev reference count leakage in bpq_device_event()
    - [amd64] net: wwan: iosm: fix memory leak in ipc_wwan_dellink
    - net: wwan: mhi: fix memory leak in mhi_mbim_dellink
    - [arm*] drm/vc4: Fix missing platform_unregister_drivers() call in
      vc4_drm_register()
    - tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
    - [x86] platform/x86: p2sb: Don't fail if unknown CPU is found
    - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
    - can: af_can: fix NULL pointer dereference in can_rx_register()
    - [x86] drm/i915/psr: Send update also on invalidate
    - [x86] drm/i915: Do not set cache_dirty for DGFX
    - [arm64,armhf] net: stmmac: dwmac-meson8b: fix
      meson8b_devm_clk_prepare_enable()
    - tipc: fix the msg->req tlv len check in
      tipc_nl_compat_name_table_dump_header
    - [amd64] dmanegine: idxd: reformat opcap output to match bitmap_parse()
      input
    - [amd64] dmaengine: idxd: Fix max batch size for Intel IAA
    - [amd64] dmaengine: idxd: fix RO device state error after been
      disabled/reset
    - [arm64] dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()
    - [armhf] dmaengine: stm32-dma: fix potential race between pause and resume
    - [arm64] drivers: net: xgene: disable napi when register irq failed in
      xgene_enet_open()
    - netfilter: nfnetlink: fix potential dead lock in nfnetlink_rcv_msg()
    - netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()
    - net: tun: call napi_schedule_prep() to ensure we own a napi
    - [amd64] net: wwan: iosm: fix memory leak in ipc_pcie_read_bios_cfg
    - [amd64] net: wwan: iosm: fix invalid mux header type
    - net/mlx5: Bridge, verify LAG state when adding bond to bridge
    - net/mlx5: Allow async trigger completion execution on single CPU systems
    - net/mlx5: E-switch, Set to legacy mode if failed to change switchdev mode
    - net/mlx5: fw_reset: Don't try to load device in case PCI isn't working
    - net/mlx5e: Add missing sanity checks for max TX WQE size
    - net/mlx5e: Fix tc acts array not to be dependent on enum order
    - net/mlx5e: TC, Fix wrong rejection of packet-per-second policing
    - net/mlx5e: E-Switch, Fix comparing termination table instance
    - ice: Fix spurious interrupt during removal of trusted VF
    - iavf: Fix VF driver counting VLAN 0 filters
    - [armhf] net: cpsw: disable napi in cpsw_ndo_open()
    - net: cxgb3_main: disable napi when bind qsets failed in cxgb_up()
    - [x86] stmmac: intel: Update PCH PTP clock rate from 200MHz to 204.8MHz
    - mctp: Fix an error handling path in mctp_init()
    - cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in
      cxgb4vf_open()
    - net: phy: mscc: macsec: clear encryption keys when freeing a flow
    - net: atlantic: macsec: clear encryption keys from the stack
    - ethernet: s2io: disable napi when start nic failed in s2io_card_up()
    - [armel,armhf] net: mv643xx_eth: disable napi when init rxq or txq failed
      in mv643xx_eth_open()
    - ALSA: memalloc: Don't fall back for SG-buffer with IOMMU
    - net: macvlan: fix memory leaks of macvlan_common_newlink
    - [riscv64] process: fix kernel info leakage
    - [riscv64] vdso: fix build with llvm
    - [riscv64] fix reserved memory setup
    - [arm64] efi: Fix handling of misaligned runtime regions and drop warning
    - [mips*] jump_label: Fix compat branch range check
    - drm/amdgpu: Fix the lpfn checking condition in drm buddy
    - [arm64] mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI
    - [arm64,armhf] mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI
    - [arm64,armhf] mmc: sdhci-esdhc-imx: use the correct host caps for
      MMC_CAP_8_BIT_DATA
    - ALSA: hda/hdmi - enable runtime pm for more AMD display audio
    - ALSA: hda/ca0132: add quirk for EVGA Z390 DARK
    - ALSA: hda: fix potential memleak in 'add_widget_node'
    - ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41
    - ALSA: hda/realtek: Add Positivo C6300 model quirk
    - ALSA: usb-audio: Yet more regression for for the delayed card registration
    - ALSA: usb-audio: Add quirk entry for M-Audio Micro
    - ALSA: usb-audio: Add DSD support for Accuphase DAC-60
    - vmlinux.lds.h: Fix placement of '.data..decrypted' section
    - ata: libata-scsi: fix SYNCHRONIZE CACHE (16) command failure
    - nilfs2: fix deadlock in nilfs_count_free_blocks()
    - nilfs2: fix use-after-free bug of ns_writer on remount
    - [x86] drm/i915/dmabuf: fix sg_table handling in map_dma_buf
    - drm/amd/display: Fix reg timeout in enc314_enable_fifo
    - drm/amd/pm: update SMU IP v13.0.4 msg interface header
    - drm/amd/display: Update SR watermarks for DCN314
    - drm/amdgpu: workaround for TLB seq race
    - drm/amdgpu: disable BACO on special BEIGE_GOBY card
    - [x86] platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi
    - btrfs: fix match incorrectly in dev_args_match_device
    - btrfs: zoned: clone zoned device info when cloning a device
    - btrfs: zoned: initialize device's zone info for seeding
    - io_uring: check for rollover of buffer ID when providing buffers
    - [arm64] phy: qcom-qmp-combo: fix NULL-deref on runtime resume
    - [arm64,armhf] mms: sdhci-esdhc-imx: Fix SDHCI_RESET_ALL for CQHCI
    - udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
    - [x86] arch/x86/mm/hugetlbpage.c: pud_huge() returns 0 when using 2-level
      paging (Closes: #1023025)
    - [amd64,arm64] mm: hugetlb_vmemmap: include missing linux/moduleparam.h
    - dmaengine: idxd: Do not enable user type Work Queue without Shared Virtual
      Addressing
    - [amd64] mm/memremap.c: map FS_DAX device memory as decrypted
    - mm/shmem: use page_mapping() to detect page cache for uffd continue
    - can: j1939: j1939_send_one(): fix missing CAN header initialization
    - can: isotp: fix tx state handling for echo tx processing
    - [x86] KVM: x86/mmu: Block all page faults during kvm_zap_gfn_range()
    - [x86] KVM: x86/pmu: Do not speculatively query Intel GP PMCs that don't
      exist yet
    - [x86] KVM: x86: use a separate asm-offsets.c file
    - [x86] KVM: SVM: replace regs argument of __svm_vcpu_run() with vcpu_svm
    - [x86] KVM: SVM: adjust register allocation for __svm_vcpu_run()
    - [x86] KVM: SVM: Only dump VMSA to klog at KERN_DEBUG level
    - [x86] KVM: SVM: retrieve VMCB from assembly
    - [x86] KVM: SVM: move guest vmsave/vmload back to assembly
    - can: dev: fix skb drop check
    - ALSA: memalloc: Try dma_alloc_noncontiguous() at first
    - [x86] cpu: Restore AMD's DE_CFG MSR after resume
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.10
    - [arm64] drm/msm/gpu: Fix crash during system suspend after unbind
    - [x86] ASoC: rt5682s: Fix the TDM Tx settings
    - [x86] ASoC: Intel: sof_sdw: add quirk variant for LAPBC710 NUC15
    - [x86] ASoC: Intel: sof_rt5682: Add quirk for Rex board
    - [x86] ASoC: amd: yc: Adding Lenovo ThinkBook 14 Gen 4+ ARA and Lenovo
      ThinkBook 16 Gen 4+ ARA to the Quirks List
    - [x86] ASoC: amd: yc: Add Lenovo Thinkbook 14+ 2022 21D0 to quirks table
    - drm/amdgpu: Adjust MES polling timeout for sriov
    - [x86] platform/x86: thinkpad_acpi: Fix reporting a non present second fan
      on some models
    - [x86] platform/x86/intel: pmc/core: Add Raptor Lake support to pmc core
      driver
    - drm/amd/display: Remove wrong pipe control lock
    - drm/amd/display: Don't return false if no stream
    - drm/scheduler: fix fence ref counting
    - ACPI: scan: Add LATT2021 to acpi_ignore_dep_ids[]
    - btrfs: raid56: properly handle the error when unable to find the missing
      stripe
    - NFSv4: Retry LOCK on OLD_STATEID during delegation return
    - SUNRPC: Fix crasher in gss_unwrap_resp_integ()
    - [x86] ACPI: x86: Add another system to quirk list for forcing
      StorageD3Enable
    - block: blk_add_rq_to_plug(): clear stale 'last' after flush
    - [arm64,armhf] i2c: tegra: Allocate DMA memory for DMA engine
    - [x86] i2c: i801: add lis3lv02d's I2C address for Vostro 5568
    - btrfs: remove pointless and double ulist frees in error paths of qgroup
      tests
    - drm/amd/display: Ignore Cable ID Feature
    - drm/amd/display: Enable timing sync on DCN32
    - drm/amdgpu: set fb_modifiers_not_supported in vkms
    - drm/amd: Fail the suspend if resources can't be evicted
    - drm/amd/display: Fix DCN32 DSC delay calculation
    - drm/amd/display: Use forced DSC bpp in DML
    - drm/amd/display: Round up DST_after_scaler to nearest int
    - drm/amd/display: Investigate tool reported FCLK P-state deviations
    - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
    - [x86] cpu: Add several Intel server CPU model numbers
    - cifs: always iterate smb sessions using primary channel
    - [arm64] mm: fold check for KFENCE into can_set_direct_map()
    - [arm64] fix rodata=full again
    - hugetlb: rename remove_huge_page to hugetlb_delete_from_page_cache
    - hugetlbfs: don't delete error page from pagecache
    - [x86] KVM: SVM: remove dead field from struct svm_cpu_data
    - [x86] KVM: SVM: do not allocate struct svm_cpu_data dynamically
    - [x86] KVM: SVM: restore host save area from assembly
    - [x86] KVM: SVM: move MSR_IA32_SPEC_CTRL save/restore to assembly
    - [arm64] dts: qcom: sa8155p-adp: Specify which LDO modes are allowed
    - [arm64] dts: qcom: sa8295p-adp: Specify which LDO modes are allowed
    - [arm64] dts: qcom: sc8280xp-crd: Specify which LDO modes are allowed
    - [arm64] dts: qcom: sm8350-hdk: Specify which LDO modes are allowed
    - [armhf] spi: stm32: Print summary 'callbacks suppressed' message
    - ASoC: core: Fix use-after-free in snd_soc_exit()
    - [arm64] ASoC: fsl_asrc fsl_esai fsl_sai: allow CONFIG_PM=N
    - [arm64] tty: serial: fsl_lpuart: don't break the on-going transfer when
      global reset
    - [arm64,armhf] serial: imx: Add missing .thaw_noirq hook
    - tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send
    - ASoC: rt5514: fix legacy dai naming
    - ASoC: rt5677: fix legacy dai naming
    - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
    - bnxt_en: refactor bnxt_cancel_reservations()
    - bnxt_en: fix the handling of PCIE-AER
    - ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
    - [arm64,armhf] pinctrl: rockchip: list all pins in a possible mux route for
      PX30
    - scsi: scsi_transport_sas: Fix error handling in sas_phy_add()
    - sctp: remove the unnecessary sinfo_stream check in
      sctp_prsctp_prune_unsent
    - sctp: clear out_curr if all frag chunks of current msg are pruned
    - erofs: clean up .read_folio() and .readahead() in fscache mode
    - erofs: get correct count for unmapped range in fscache mode
    - block: sed-opal: kmalloc the cmd/resp buffers
    - nfsd: put the export reference in nfsd4_verify_deleg_dentry
    - bpf: Fix memory leaks in __check_func_call
    - io_uring: calculate CQEs from the user visible value
    - nvmet: fix a memory leak
    - parport_pc: Avoid FIFO port location truncation
    - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
    - [arm*] drm/vc4: kms: Fix IS_ERR() vs NULL check for vc4_kms
    - [arm64,armhf] drm/panel: simple: set bpc field for logic technologies
      displays
    - drm/drv: Fix potential memory leak in drm_dev_init()
    - [arm64] dts: imx8mm-tqma8mqml-mba8mx: Fix USB DR
    - erofs: put metabuf in error path in fscache mode
    - ata: libata-transport: fix double ata_host_put() in ata_tport_add()
    - ata: libata-transport: fix error handling in ata_tport_add()
    - ata: libata-transport: fix error handling in ata_tlink_add()
    - ata: libata-transport: fix error handling in ata_tdev_add()
    - nfp: change eeprom length to max length enumerators
    - [mips*] fix duplicate definitions for exported symbols
    - io_uring/poll: fix double poll req->flags races
    - cifs: Fix connections leak when tlink setup failed
    - bpf: Initialize same number of free nodes for each pcpu_freelist
    - ata: libata-core: do not issue non-internal commands once EH is pending
    - mISDN: fix possible memory leak in mISDN_dsp_element_register()
    - net: hinic: Fix error handling in hinic_module_init()
    - net: phy: dp83867: Fix SGMII FIFO depth for non OF devices
    - net: stmmac: ensure tx function is not running in stmmac_xdp_release()
    - [arm64] soc: imx8m: Enable OCOTP clock before reading the register
    - net: liquidio: release resources when liquidio driver open failed
    - mISDN: fix misuse of put_device() in mISDN_register_device()
    - net: macvlan: Use built-in RCU list checking
    - bnxt_en: Remove debugfs when pci_register_driver failed
    - [arm64,armhf] drm/lima: Fix opp clkname setting in case of missing
      regulator
    - net: mhi: Fix memory leak in mhi_net_dellink()
    - [arm64,armhf] net: dsa: make dsa_master_ioctl() see through
      port_hwtstamp_get() shims
    - xen/pcpu: fix possible memory leak in register_pcpu()
    - erofs: fix missing xas_retry() in fscache mode
    - mlxsw: Avoid warnings when not offloaded FDB entry with IPv6 is removed
    - net: ena: Fix error handling in ena_init()
    - [arm64] net: hns3: fix incorrect hw rss hash type of rx packet
    - [arm64] net: hns3: fix return value check bug of rx copybreak
    - [arm64] net: hns3: fix setting incorrect phy link ksettings for firmware
      in resetting process
    - bridge: switchdev: Fix memory leaks when changing VLAN protocol
    - drbd: use after free in drbd_create_device()
    - [x86] platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when
      virtualized
    - [x86] platform/surface: aggregator: Do not check for repeated unsequenced
      packets
    - netfs: Fix missing xas_retry() calls in xarray iteration
    - netfs: Fix dodgy maths
    - cifs: add check for returning value of SMB2_close_init
    - [arm64,armhf] net: dsa: don't leak tagger-owned storage on switch driver
      unbind
    - cifs: Fix wrong return value checking when GETFLAGS
    - [x86] net: thunderbolt: Fix error handling in tbnet_init()
    - cifs: add check for returning value of SMB2_set_info_init
    - block: make dma_alignment a stacking queue_limit
    - dm-crypt: provide dma_alignment limit in io_hints
    - ftrace: Fix the possible incorrect kernel message
    - ftrace: Optimize the allocation for mcount entries
    - ftrace: Fix null pointer dereference in ftrace_add_mod()
    - ring_buffer: Do not deactivate non-existant pages
    - tracing: Fix memory leak in tracing_read_pipe()
    - tracing/ring-buffer: Have polling block on watermark
    - tracing: Fix memory leak in test_gen_synth_cmd() and
      test_empty_synth_event()
    - tracing: Fix wild-memory-access in register_synth_event()
    - tracing: Fix race where eprobes can be called before the event
    - tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in
      kprobe_event_gen_test_exit()
    - tracing: kprobe: Fix potential null-ptr-deref on trace_array in
      kprobe_event_gen_test_exit()
    - [x86] rethook: fix a potential memleak in rethook_alloc()
    - [amd64] platform/x86/amd: pmc: Remove more CONFIG_DEBUG_FS checks
    - [amd64] platform/x86/amd: pmc: Add new ACPI ID AMDI0009
    - drm/amd/pm: enable runpm support over BACO for SMU13.0.7
    - drm/amd/pm: enable runpm support over BACO for SMU13.0.0
    - drm/amd/pm: fix SMU13 runpm hang due to unintentional workaround
    - drm/display: Don't assume dual mode adaptors support i2c sub-addressing
    - drm/amd/display: Fix invalid DPIA AUX reply causing system hang
    - drm/amd/display: Add HUBP surface flip interrupt handler
    - drm/amd/display: Fix access timeout to DPIA AUX at boot time
    - drm/amd/display: Support parsing VRAM info v3.0 from VBIOS
    - drm/amd/display: Fix optc2_configure warning on dcn314
    - drm/amd/display: don't enable DRM CRTC degamma property for DCE
    - drm/amd/display: Fix prefetch calculations for dcn32
    - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()
    - ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro
    - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360
    - [arm64,armhf] Revert "usb: dwc3: disable USB core PHY management"
    - [arm64,armhf] usb: dwc3: Do not get extcon device when usb-role-switch is
      used
    - io_uring: update res mask in io_poll_check_events
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV7000
    - slimbus: stream: correct presence rate frequencies
    - speakup: fix a segfault caused by switching consoles
    - USB: serial: option: add Sierra Wireless EM9191
    - USB: serial: option: remove old LARA-R6 PID
    - USB: serial: option: add u-blox LARA-R6 00B modem
    - USB: serial: option: add u-blox LARA-L6 modem
    - USB: serial: option: add Fibocom FM160 0x0111 composition
    - usb: add NO_LPM quirk for Realforce 87U Keyboard
    - [x86] usb: typec: tipd: Prevent uninitialized event{1,2} in IRQ handler
    - iio: accel: bma400: Ensure VDDIO is enable defore reading the chip ID.
    - iio: pressure: ms5611: fixed value compensation bug
    - iio: pressure: ms5611: changed hardcoded SPI speed to value limited
    - dm bufio: Fix missing decrement of no_sleep_enabled if
      dm_bufio_client_create failed
    - dm ioctl: fix misbehavior if list_versions races with module loading
    - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs
    - serial: 8250: Flush DMA Rx on RLSI
    - [x86] serial: 8250_lpss: Configure DMA also w/o DMA filter
    - [x86] serial: 8250_lpss: Use 16B DMA burst with Elkhart Lake
    - io_uring: fix tw losing poll events
    - io_uring: fix multishot accept request leaks
    - io_uring: fix multishot recv request leaks
    - io_uring: disallow self-propelled ring polling
    - ceph: avoid putting the realm twice when decoding snaps fails
    - Input: iforce - invert valid length check when fetching device IDs
    - maccess: Fix writing offset in case of fault in
      strncpy_from_kernel_nofault()
    - net: phy: marvell: add sleep time after enabling the loopback bit
    - [s390x] scsi: zfcp: Fix double free of FSF request when qdio send fails
    - [amd64] iommu/vt-d: Preset Access bit for IOVA in FL non-leaf paging
      entries
    - [amd64] iommu/vt-d: Set SRE bit only when hardware has SRS cap
    - firmware: coreboot: Register bus in module init
    - mmc: core: properly select voltage range without power cycle
    - mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce
      timeout
    - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
    - docs: update mediator contact information in CoC doc
    - [s390x] dcssblk: fix deadlock when adding a DCSS
    - [x86] misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
    - blk-cgroup: properly pin the parent in blkcg_css_online
    - [amd64] x86/sgx: Add overflow check in sgx_validate_offset_length()
    - [x86] fpu: Drop fpregs lock before inheriting FPU permissions
    - [x86] perf/x86/amd/uncore: Fix memory leak for events array
    - [x86] perf/x86/intel/pt: Fix sampling using single range output
    - nvme: restrict management ioctls to admin
    - nvme: ensure subsystem reset is single threaded (CVE-2022-3169)
    - [x86] ASoC: SOF: topology: No need to assign core ID if token parsing
      failed
    - perf: Improve missing SIGTRAP checking
    - vfio: Rename vfio_ioctl_check_extension()
    - vfio: Split the register_device ops call into functions
    - [x86] perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf
      NMI and throttling
    - ring-buffer: Include dropped pages in counting dirty patches
    - tracing: Fix warning on variable 'struct trace_array'
    - net: usb: smsc95xx: fix external PHY reset
    - net: use struct_group to copy ip/ipv6 header addresses
    - scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()
    - scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper()
    - kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case
    - tracing: Fix potential null-pointer-access of entry in list 'tr->err_log'
    - [arm64] mm: fix incorrect file_map_count for non-leaf pmd/pud
    - Input: i8042 - fix leaking of platform device on module removal
    - macvlan: enforce a consistent minimal mtu
    - tcp: cdg: allow tcp_cdg_release() to be called multiple times
    - kcm: avoid potential race in kcm_tx_work (CVE-2022-3521)
    - [x86] KVM: x86/xen: Fix eventfd error handling in kvm_xen_eventfd_assign()
    - 9p: trans_fd/p9_conn_cancel: drop client lock earlier
    - gfs2: Check sb_bsize_shift after reading superblock
    - gfs2: Switch from strlcpy to strscpy
    - 9p/trans_fd: always use O_NONBLOCK read/write
    - netlink: Bounds-check struct nlmsgerr creation
    - wifi: wext: use flex array destination for memcpy()
    - rseq: Use pr_warn_once() when deprecated/unknown ABI flags are encountered
    - mm: fs: initialize fsdata passed to write_begin/write_end interface
    - net/9p: use a dedicated spinlock for trans_fd
    - bpf: Prevent bpf program recursion for raw tracepoint probes
    - ntfs: fix use-after-free in ntfs_attr_find()
    - ntfs: fix out-of-bounds read in ntfs_attr_find()
    - ntfs: check overflow when iterating ATTR_RECORDs

  [ Santiago Ruano Rincón ]
  * net/cdc_ncm: Fix multicast RX support for CDC NCM devices with ZLP
    (Closes: #1024328)

  [ Salvatore Bonaccorso ]
  * Bump ABI to 5
  * net: neigh: decrement the family specific qlen (Closes: #1024070)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 26 Nov 2022 16:06:48 +0100

linux (6.0.8-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.8
    - [arm64,armhf] usb: dwc3: gadget: Force sending delayed status during soft
      disconnect
    - [arm64,armhf] usb: dwc3: gadget: Don't delay End Transfer on
      delayed_status
    - RDMA/cma: Use output interface for net_dev check
    - [amd64] IB/hfi1: Correctly move list in sc_disable()
    - [arm64] RDMA/hns: Disable local invalidate operation
    - [arm64] RDMA/hns: Fix NULL pointer problem in free_mr_init()
    - RDMA/rxe: Fix mr leak in RESPST_ERR_RNR
    - NFSv4: Fix a potential state reclaim deadlock
    - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
    - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
    - SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed
    - NFSv4.2: Fixup CLONE dest file size for zero-length count
    - nfs4: Fix kmemleak when allocate slot failed
    - RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
    - RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
    - [arm64,armhf] net: dsa: fall back to default tagger if we can't load the
      one from DT
    - nfc: nxp-nci: Fix potential memory leak in nxp_nci_send()
    - [arm64,armhf] net: fec: fix improper use of NETDEV_TX_BUSY
    - [amd64,i386] ata: pata_legacy: fix pdc20230_set_piomode()
    - net: sched: Fix use after free in red_enqueue()
    - net: tun: fix bugs for oversize packet when napi frags enabled
    - netfilter: nf_tables: netlink notifier might race to release objects
    - netfilter: nf_tables: release flow rule object from commit path
    - sfc: Fix an error handling path in efx_pci_probe()
    - nfsd: fix nfsd_file_unhash_and_dispose
    - nfsd: fix net-namespace logic in __nfsd_file_cache_purge
    - ipvs: use explicitly signed chars
    - ipvs: fix WARNING in __ip_vs_cleanup_batch()
    - ipvs: fix WARNING in ip_vs_app_net_cleanup()
    - rose: Fix NULL pointer dereference in rose_send_frame()
    - mISDN: fix possible memory leak in mISDN_register_device()
    - btrfs: fix inode list leak during backref walking at
      resolve_indirect_refs()
    - btrfs: fix inode list leak during backref walking at find_parent_nodes()
    - btrfs: fix ulist leaks in error paths of qgroup self tests
    - netfilter: ipset: enforce documented limit to prevent allocating huge
      memory
    - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
    - Bluetooth: hci_conn: Fix CIS connection dst_type handling
    - Bluetooth: virtio_bt: Use skb_put to set length
    - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
    - Bluetooth: L2CAP: Fix memory leak in vhci_write
    - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect
    - net: mdio: fix undefined behavior in bit shift for __mdiobus_register
    - net/smc: Fix possible leaked pernet namespace in smc_init()
    - net, neigh: Fix null-ptr-deref in neigh_table_clear()
    - bridge: Fix flushing of dynamic FDB entries
    - ipv6: fix WARNING in ip6_route_net_exit_late()
    - vsock: fix possible infinite sleep in vsock_connectible_wait_data()
    - [arm64] media: rkisp1: Fix source pad format configuration
    - [arm64] media: rkisp1: Don't pass the quantization to rkisp1_csm_config()
    - [arm64] media: rkisp1: Initialize color space on resizer sink and source
      pads
    - [arm64] media: rkisp1: Use correct macro for gradient registers
    - [arm64] media: rkisp1: Zero v4l2_subdev_format fields in when validating
      links
    - media: dvb-frontends/drxk: initialize err to 0
    - [arm64] media: meson: vdec: fix possible refcount leak in vdec_probe()
    - [arm64,armhf] media: hantro: Store HEVC bit depth in context
    - [arm64,armhf] media: hantro: HEVC: Fix auxilary buffer size calculation
    - [arm64,armhf] media: hantro: HEVC: Fix chroma offset computation
    - [arm*] drm/vc4: hdmi: Check the HSM rate at runtime_resume
    - ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()
    - [arm*] hwrng: bcm2835 - use hwrng_msleep() instead of cpu_relax()
    - io_uring: don't iopoll from io_ring_ctx_wait_and_kill()
    - scsi: core: Restrict legal sdev_state transitions via sysfs
    - HID: saitek: add madcatz variant of MMO7 mouse device ID
    - drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in SRIOV
      case
    - drm/amd/pm: skip loading pptable from driver on secure board for
      smu_v13_0_10
    - drm/amdgpu: Program GC registers through RLCG interface in gfx_v11/gmc_v11
    - drm/amdgpu: dequeue mes scheduler during fini
    - nvme-pci: disable write zeroes on various Kingston SSD
    - bio: safeguard REQ_ALLOC_CACHE bio put
    - [arm64] dts: imx8mm: Enable CPLD_Dn pull down resistor on MX8Menlo
    - efi/tpm: Pass correct address to memblock_reserve
    - [arm64,armhf] drm/rockchip: dw_hdmi: filter regulator -EPROBE_DEFER error
      messages
    - [arm64,armhf] drm/rockchip: fix fbdev on non-IOMMU devices
    - [x86] drm/i915: stop abusing swiotlb_max_segment
    - block: Fix possible memory leak for rq_wb on add_disk failure
    - blk-mq: Fix kmemleak in blk_mq_init_allocated_queue
    - i2c: piix4: Fix adapter not be removed in piix4_remove()
    - fscrypt: stop using keyrings subsystem for fscrypt_master_key
    - fscrypt: fix keyring memory leak on mount failure
    - btrfs: fix lost file sync on direct IO write with nowait and dsync iocb
    - btrfs: fix tree mod log mishandling of reallocated nodes
    - btrfs: fix type of parameter generation in btrfs_get_dentry
    - btrfs: don't use btrfs_chunk::sub_stripes from disk
    - btrfs: fix a memory allocation failure test in btrfs_submit_direct
    - [amd64,arm64] ACPI: NUMA: Add CXL CFMWS 'nodes' to the possible nodes set
    - ftrace: Fix use-after-free for dynamic ftrace_ops
    - tracing/fprobe: Fix to check whether fprobe is registered correctly
    - fprobe: Check rethook_alloc() return in rethook initialization
    - tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd()
    - kprobe: reverse kp->flags when arm_kprobe failed
    - ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()
      (Closes: #1023726)
    - tracing/histogram: Update document for KEYS_MAX size
    - capabilities: fix potential memleak on error path from
      vfs_getxattr_alloc()
    - fuse: add file_modified() to fallocate
    - fuse: fix readdir cache race
    - efi: random: reduce seed size to 32 bytes
    - efi: random: Use 'ACPI reclaim' memory for random seed
    - efi: efivars: Fix variable writes with unsupported query_variable_store()
      (Closes: #1022900)
    - net/ulp: remove SOCK_SUPPORT_ZC from tls sockets
    - [arm64] entry: avoid kprobe recursion
    - [armhf] dts: imx6dl-yapp4: Do not allow PM to switch PU regulator off on
      Q/QP
    - [x86] perf/x86/intel: Fix pebs event constraints for ICL
    - [x86] perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[]
    - [x86] perf/x86/intel: Fix pebs event constraints for SPR
    - net: remove SOCK_SUPPORT_ZC from sockmap
    - net: also flag accepted sockets supporting msghdr originated zerocopy
    - ext4: fix warning in 'ext4_da_release_space'
    - ext4: fix BUG_ON() when directory entry has invalid rec_len
    - ext4: update the backup superblock's at the end of the online resize
      (Closes: #1023450)
    - [x86] syscall: Include asm/ptrace.h in syscall_wrapper header
    - [x86] KVM: x86: Mask off reserved bits in CPUID.80000006H
    - [x86] KVM: x86: Mask off reserved bits in CPUID.8000001AH
    - [x86] KVM: x86: Mask off reserved bits in CPUID.80000008H
    - [x86] KVM: x86: Mask off reserved bits in CPUID.80000001H
    - [x86] KVM: x86: Mask off reserved bits in CPUID.8000001FH
    - [x86] KVM: VMX: Advertise PMU LBRs if and only if perf supports LBRs
    - [x86] KVM: VMX: Fold vmx_supported_debugctl() into
      vcpu_supported_debugctl()
    - [x86] KVM: VMX: Ignore guest CPUID for host userspace writes to DEBUGCTL
    - [x86] KVM: VMX: fully disable SGX if SECONDARY_EXEC_ENCLS_EXITING
      unavailable
    - [x86] KVM: Initialize gfn_to_pfn_cache locks in dedicated helper
    - [x86] KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache
    - [arm64] KVM: arm64: Fix SMPRI_EL1/TPIDR2_EL0 trapping on VHE
    - [x86] KVM: x86: smm: number of GPRs in the SMRAM image depends on the
      image format
    - [x86] KVM: x86: emulator: em_sysexit should update ctxt->mode
    - [x86] KVM: x86: emulator: introduce emulator_recalc_and_set_mode
    - [x86] KVM: x86: emulator: update the emulation mode after rsm
    - [x86] KVM: x86: emulator: update the emulation mode after CR0 write
    - ext4,f2fs: fix readahead of verity data
    - cifs: fix regression in very old smb1 mounts
    - [arm64,armhf] drm/rockchip: dsi: Clean up 'usage_mode' when failing to
      attach
    - [arm64,armhf] drm/rockchip: dsi: Force synchronous probe
    - drm/amdgpu: disable GFXOFF during compute for GFX11
    - drm/amd/display: Update latencies on DCN321
    - drm/amd/display: Update DSC capabilitie for DCN314
    - [x86] drm/i915/sdvo: Filter out invalid outputs more sensibly
    - [x86] drm/i915/sdvo: Setup DDC fully before output init
    - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
      (CVE-2022-3628)

  [ Vincent Blut ]
  * [x86] drivers/platform/x86: Enable GIGABYTE_WMI as module
    (Closes: #1023613)

  [ Salvatore Bonaccorso ]
  * Bump ABI to 4

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 11 Nov 2022 09:36:29 +0100

linux (6.0.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.7
    - can: j1939: transport: j1939_session_skb_drop_old():
      spin_unlock_irqrestore() before kfree_skb()
    - can: kvaser_usb: Fix possible completions during init_completion
    - ALSA: Use del_timer_sync() before freeing timer
    - ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41
    - ALSA: usb-audio: Add quirks for M-Audio Fast Track C400/600
    - ALSA: hda/realtek: Add another HP ZBook G9 model quirks
    - ALSA: control: add snd_ctl_rename()
    - ALSA: hda/realtek: Use snd_ctl_rename() to rename a control
    - ALSA: emu10k1: Use snd_ctl_rename() to rename a control
    - ALSA: ac97: Use snd_ctl_rename() to rename a control
    - ALSA: usb-audio: Use snd_ctl_rename() to rename a control
    - ALSA: ca0106: Use snd_ctl_rename() to rename a control
    - ALSA: au88x0: use explicitly signed char
    - ALSA: rme9652: use explicitly signed char
    - USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
    - usb: gadget: uvc: limit isoc_sg to super speed gadgets
    - Revert "usb: gadget: uvc: limit isoc_sg to super speed gadgets"
    - usb: gadget: uvc: fix dropped frame after missed isoc
    - usb: gadget: uvc: fix sg handling in error case
    - usb: gadget: uvc: fix sg handling during video encode
    - [armhf] usb: gadget: aspeed: Fix probe regression
    - [arm64,armhf] usb: dwc3: gadget: Stop processing more requests on IMI
    - [arm64,armhf] usb: dwc3: gadget: Don't set IMI for no_interrupt
    - [arm64,armhf] usb: dwc3: gadget: Force sending delayed status during soft
      disconnect
    - [arm64,armhf] usb: dwc3: gadget: Don't delay End Transfer on
      delayed_status
    - usb: typec: ucsi: Check the connection on resume
    - usb: typec: ucsi: acpi: Implement resume callback
    - [arm64,armhf] usb: dwc3: st: Rely on child's compatible instead of name
    - [arm64,armhf] usb: dwc3: Don't switch OTG -> peripheral if extcon is
      present
    - usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96
      controller
    - squashfs: fix read regression introduced in readahead code
      (Closes: #1023167)
    - squashfs: fix extending readahead beyond end of file
    - squashfs: fix buffer release race condition in readahead code
    - xhci: Add quirk to reset host back to default state at shutdown
    - xhci-pci: Set runtime PM as default policy on all xHC 1.2 or later devices
    - xhci: Remove device endpoints from bandwidth list when freeing the device
    - iio: light: tsl2583: Fix module unloading
    - iio: temperature: ltc2983: allocate iio channels once
    - iio: adxl372: Fix unsafe buffer attributes
    - fbdev: smscufx: Fix several use-after-free bugs
    - [x86] cpufreq: intel_pstate: Read all MSRs on the target CPU
    - [x86] cpufreq: intel_pstate: hybrid: Use known scaling factor for P-cores
    - fs/binfmt_elf: Fix memory leak in load_elf_binary()
    - exec: Copy oldsighand->action under spin-lock
    - mac802154: Fix LQI recording
    - scsi: qla2xxx: Use transport-defined speed mask for supported_speeds
    - drm/amdgpu: Fix VRAM BO swap issue
    - drm/amdgpu: Fix for BO move issue
    - [x86] drm/i915: Extend Wa_1607297627 to Alderlake-P
    - drm/amdgpu: Remove ATC L2 access for MMHUB 2.1.x
    - drm/amdgpu: disallow gfxoff until GC IP blocks complete s2idle resume
    - drm/amdgpu: fix pstate setting issue
    - drm/amd/display: Revert logic for plane modifiers
    - [arm64] drm/msm: fix use-after-free on probe deferral
    - [arm64] drm/msm/dsi: fix memory corruption with too many bridges
    - [arm64] drm/msm/hdmi: fix memory corruption with too many bridges
    - [arm64] drm/msm/hdmi: fix IRQ lifetime
    - [arm64] drm/msm/dp: fix memory corruption with too many bridges
    - [arm64] drm/msm/dp: fix aux-bus EP lifetime
    - [arm64] drm/msm/dp: fix IRQ lifetime
    - [arm64] drm/msm/dp: fix bridge lifetime
    - random: use arch_get_random*_early() in random_init()
    - mmc: block: Remove error check of hw_reset on reset
    - mmc: queue: Cancel recovery work on cleanup
    - mmc: core: Fix kernel panic when remove non-standard SDIO card
    - mmc: core: Fix WRITE_ZEROES CQE handling
    - mmc: sdhci-pci-core: Disable ES for ASUS BIOS on Jasper Lake
    - [arm64,armhf] mmc: sdhci-esdhc-imx: Propagate ESDHC_FLAG_HS400* only on
      8bit bus
    - mm: migrate: fix return value if all subpages of THPs are migrated
      successfully
    - mm,madvise,hugetlb: fix unexpected data loss with MADV_DONTNEED on
      hugetlbfs
    - mm/huge_memory: do not clobber swp_entry_t during THP split
    - mm: prep_compound_tail() clear page->private
    - kernfs: fix use-after-free in __kernfs_remove
    - Revert "dt-bindings: pinctrl-zynqmp: Add output-enable configuration"
    - pinctrl: Ingenic: JZ4755 bug fixes
    - [s390x] boot: add secure boot trailer
    - [s390x] cio: fix out-of-bounds access on cio_ignore free
    - [s390x] uaccess: add missing EX_TABLE entries to __clear_user()
    - [s390x] futex: add missing EX_TABLE entry to __futex_atomic_op()
    - [s390x] pci: add missing EX_TABLE entries to
      __pcistg_mio_inuser()/__pcilg_mio_inuser()
    - ethtool: eeprom: fix null-deref on genl_info in dump
    - fbdev/core: Avoid uninitialized read in
      aperture_remove_conflicting_pci_device()
    - [amd64,arm64] ACPI: PCC: Fix unintentional integer overflow
    - net: ieee802154: fix error return code in dgram_bind()
    - media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation
    - [arm64] drm/msm/a6xx: Replace kcalloc() with kvzalloc()
    - [arm64] drm/msm/dp: add atomic_check to bridge ops
    - [arm64] drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
    - [arm64] drm/msm/dp: cleared DP_DOWNSPREAD_CTRL register before start link
      training
    - [arm64] ASoC: qcom: lpass-cpu: mark HDMI TX registers as volatile
    - [arm64] drm/msm/a6xx: Fix kvzalloc vs state_kcalloc usage
    - erofs: fix illegal unmapped accesses in z_erofs_fill_inode_lazy()
    - erofs: fix up inplace decompression success rate
    - [arm64] pinctrl: qcom: Avoid glitching lines when we first mux to output
    - [arm64] spi: qup: support using GPIO as chip select line
    - [x86] fpu: Configure init_fpstate attributes orderly
    - [x86] fpu: Fix the init_fpstate size check with the actual size
    - [x86] fpu: Exclude dynamic states from init_fpstate
    - sched/core: Fix comparison in sched_group_cookie_match()
    - bpf: prevent decl_tag from being referenced in func_proto
    - mtd: core: add missing of_node_get() in dynamic partitions code
    - [x86] ASoC: SOF: Intel: pci-mtl: fix firmware name
    - [armhf] spi: aspeed: Fix window offset of CE1
    - [arm64] ASoC: qcom: lpass-cpu: Mark HDMI TX parity register as volatile
    - [x86] ASoC: Intel: common: add ACPI matching tables for Raptor Lake
    - [x86] ASoC: SOF: Intel: pci-tgl: use RPL specific firmware definitions
    - [x86] ASoC: SOF: Intel: pci-tgl: fix ADL-N descriptor
    - ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
    - [x86] perf/x86/intel/lbr: Use setup_clear_cpu_cap() instead of
      clear_cpu_cap()
    - rcu: Keep synchronize_rcu() from enabling irqs in early boot
    - tipc: fix a null-ptr-deref in tipc_topsrv_accept
    - [arm64] net: netsec: fix error handling in netsec_register_mdio()
    - net: hinic: fix incorrect assignment issue in hinic_set_interrupt_cfg()
    - net: hinic: fix memory leak when reading function table
    - net: hinic: fix the issue of CMDQ memory leaks
    - net: hinic: fix the issue of double release MBOX callback of VF
    - [arm64] net: macb: Specify PHY PM management done by MAC
    - [x86] unwind/orc: Fix unreliable stack dump with gcov
    - [x86] fpu: Fix copy_xstate_to_uabi() to copy init states correctly
    - [amd64,arm64] amd-xgbe: Yellow carp devices do not need rrc
    - [amd64,arm64] amd-xgbe: fix the SFP compliance codes check for DAC cables
    - [amd64,arm64] amd-xgbe: add the bit rate quirk for Molex cables
    - [x86] drm/i915/dgfx: Keep PCI autosuspend control 'on' by default on all
      dGPU
    - [x86] drm/i915/dp: Reset frl trained flag before restarting FRL training
    - atlantic: fix deadlock at aq_nic_stop
    - net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
    - tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
    - tcp: fix indefinite deferral of RTO with SACK reneging
    - mptcp: set msk local address earlier
    - can: mcp251x: mcp251x_can_probe(): add missing unregister_candev() in
      error path
    - PM: hibernate: Allow hybrid sleep to work with s2idle
    - media: vivid: s_fbuf: add more sanity checks
    - media: vivid: dev->bitmap_cap wasn't freed in all cases
    - media: v4l2-dv-timings: add sanity checks for blanking values
    - media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced'
    - media: vivid: set num_in/outputs to 0 if not supported
    - ipv6: ensure sane device mtu in tunnels
    - i40e: Fix ethtool rx-flow-hash setting for X722
    - i40e: Fix VF hang when reset is triggered on another VF
    - i40e: Fix flow-type by setting GL_HASH_INSET registers
    - net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
    - PM: domains: Fix handling of unavailable/disabled idle states
    - [arm64,armhf] net: fec: limit register access on i.MX6UL
    - openvswitch: switch from WARN to pr_warn
    - nh: fix scope used to find saddr when adding non gw nh
    - net/mlx5e: Do not increment ESN when updating IPsec ESN state
    - net/mlx5: Wait for firmware to enable CRS before pci_restore_state
    - net/mlx5: DR, Fix matcher disconnect error flow
    - net/mlx5e: Extend SKB room check to include PTP-SQ
    - net/mlx5e: Update restore chain id for slow path packets
    - net/mlx5: ASO, Create the ASO SQ with the correct timestamp format
    - net/mlx5: Fix possible use-after-free in async command interface
    - net/mlx5e: TC, Reject forwarding from internal port to internal port
    - net/mlx5: Update fw fatal reporter state on PCI handlers successful
      recover
    - net/mlx5: Fix crash during sync firmware reset
    - net: do not sense pfmemalloc status in skb_append_pagefrags()
    - [arm64] net: enetc: survive memory pressure without crashing
    - [arm64] Add AMPERE1 to the Spectre-BHB affected list
    - tcp/udp: Fix memory leak in ipv6_renew_options(). (CVE-2022-3524)

  [ Salvatore Bonaccorso ]
  * wifi: ath11k: avoid deadlock during regulatory update in
    ath11k_regd_update() (Closes: #1023329)
  * Bump ABI to 3 (Fixes FTBFS on arm64 and armhf) (Closes: #1023298)
  * Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
    (CVE-2022-42896)
  * Bluetooth: L2CAP: Fix attempting to access uninitialized memory
    (CVE-2022-42895)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 05 Nov 2022 14:41:22 +0100

linux (6.0.6-2) unstable; urgency=medium

  * Ignore ABI changes for ahci_fill_cmd_slot, phylink_create and
    phylink_generic_validate

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 01 Nov 2022 13:55:44 +0100

linux (6.0.6-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.6
    - video/aperture: Call sysfb_disable() before removing PCI devices
    - ocfs2: clear dinode links count in case of error
    - ocfs2: fix BUG when iput after ocfs2_mknod fails
    - smb3: interface count displayed incorrectly
    - selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()
    - [x86] microcode/AMD: Apply the patch early on every logical thread
    - [x86] hwmon/coretemp: Handle large core ID value
    - [armhf] ata: ahci-imx: Fix MODULE_ALIAS
    - [x86] resctrl: Fix min_cbm_bits for AMD
    - drm/amdgpu: fix sdma doorbell init ordering on APUs
    - mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
    - kvm: Add support for arch compat vm ioctls
    - [x86] KVM: x86: Copy filter arg outside kvm_vm_ioctl_set_msr_filter()
    - x[86] KVM: x86: Add compat handler for KVM_X86_SET_MSR_FILTER
    - [arm64] KVM: arm64: vgic: Fix exit condition in scan_its_table()
    - media: mceusb: set timeout to at least timeout provided
    - [x86] topology: Fix multiple packages shown on a single-package system
    - [x86] topology: Fix duplicated core ID within a package
    - [amd64] platform/x86/amd: pmc: Read SMU version during suspend on Cezanne
      systems
    - dm bufio: use the acquire memory barrier when testing for B_READING
    - btrfs: fix processing of delayed data refs during backref walking
    - btrfs: fix processing of delayed tree block refs during backref walking
    - [arm*] drm/vc4: Add module dependency on hdmi-codec
    - [arm*] drm/vc4: hdmi: Enforce the minimum rate at runtime_resume
    - ACPI: extlog: Handle multiple records
    - tipc: Fix recognition of trial period
    - tipc: fix an information leak in tipc_topsrv_kern_subscr
    - i40e: Fix DMA mappings leak
    - tls: strp: make sure the TCP skbs do not have overlapping data
    - HID: magicmouse: Do not set BTN_MOUSE on double report
    - sfc: Change VF mac via PF as first preference if available.
    - net/atm: fix proc_mpc_write incorrect return value
    - net: phy: dp83867: Extend RX strap quirk for SGMII mode
    - net/smc: Fix an error code in smc_lgr_create()
    - net: phylink: add mac_managed_pm in phylink_config structure
    - net: stmmac: Enable mac_managed_pm phylink config
    - skmsg: pass gfp argument to alloc_sk_msg()
    - erofs: shouldn't churn the mapping page for duplicated copies
    - blk-mq: fix null pointer dereference in blk_mq_clear_rq_mapping()
    - io_uring/rw: remove leftover debug statement
    - scsi: lpfc: Fix memory leak in lpfc_create_port()
    - udp: Update reuse->has_conns under reuseport_lock.
    - ip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() failed
    - cifs: Fix xid leak in cifs_create()
    - cifs: Fix xid leak in cifs_copy_file_range()
    - cifs: Fix xid leak in cifs_flock()
    - cifs: Fix xid leak in cifs_ses_add_channel()
    - cifs: Fix memory leak when build ntlmssp negotiate blob failed
    - dm: remove unnecessary assignment statement in alloc_dev()
    - drm/amd/display: Increase frame size limit for display_mode_vba_util_32.o
    - bnxt_en: fix memory leak in bnxt_nvm_test()
    - netfilter: rpfilter/fib: Populate flowic_l3mdev field
    - netfilter: rpfilter/fib: Set ->flowic_uid correctly for user namespaces.
    - netfilter: nf_tables: relax NFTA_SET_ELEM_KEY_END set flags requirements
    - nvme-hwmon: consistently ignore errors from nvme_hwmon_init
    - nvme-hwmon: kmalloc the NVME SMART log buffer
    - nvmet: fix workqueue MEM_RECLAIM flushing dependency
    - net: sched: cake: fix null pointer access issue when cake_init() fails
    - net: sched: delete duplicate cleanup of backlog and qlen
    - net: sched: sfb: fix null pointer access issue when sfb_init() fails
    - net: Fix return value of qdisc ingress handling on success
    - io_uring/msg_ring: Fix NULL pointer dereference in io_msg_send_fd()
    - sfc: include vport_id in filter spec hash and equal()
    - [arm64] net: hns: fix possible memory leak in hnae_ae_register()
    - net: sched: fix race condition in qdisc_graft()
    - net: phy: dp83822: disable MDI crossover status change interrupt
    - drbd: only clone bio if we have a backing device
    - [amd64] iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check()
    - [amd64] iommu/vt-d: Clean up si_domain in the init_dmars() error path
    - wifi: mt76: mt7921e: fix random fw download fail
    - io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL
    - ext4: introduce EXT4_FC_TAG_BASE_LEN helper
    - ext4: factor out ext4_fc_get_tl()
    - ext4: fix potential out of bound read in ext4_fc_replay_scan()
    - ACPI: video: Force backlight native for more TongFang devices
    - mm: /proc/pid/smaps_rollup: fix no vma's null-deref

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 01 Nov 2022 06:28:12 +0100

linux (6.0.5-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.4
    - [x86] drm/i915/bios: Validate fp_timing terminator presence
    - [x86] drm/i915/bios: Use hardcoded fp_timing size for generating LFP data
      pointers
    - pinctrl: amd: change dev_warn to dev_dbg for additional feature support
    - [x86] thermal: intel_powerclamp: Use first online CPU as control_cpu
    - io_uring/net: fail zc send when unsupported by socket
    - HID: playstation: stop DualSense output work on remove.
    - HID: playstation: add initial DualSense Edge controller support
    - net: flag sockets supporting msghdr originated zerocopy
    - drm/amd/pm: fulfill SMU13.0.7 cstate control interface
    - drm/amd/pm: add SMU IP v13.0.4 IF version define to V7
    - drm/amd/pm: disable cstate feature for gpu reset scenario
    - drm/amd/pm: fulfill SMU13.0.0 cstate control interface
    - drm/amd/pm: update SMU IP v13.0.4 driver interface version
    - dm clone: Fix typo in block_device format specifier
    - efi: efivars: Fix variable writes without query_variable_store()
    - efi: ssdt: Don't free memory if ACPI table was loaded successfully
    - gcov: support GCC 12.1 and newer compilers
    - io-wq: Fix memory leak in worker creation
    - fbdev/core: Remove remove_conflicting_pci_framebuffers()
    - Revert "ALSA: hda: Fix page fault in snd_hda_codec_shutdown()"
      (Closes: #1022544)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.5
    - [arm64,armhf] clk: tegra: Fix Tegra PWM parent clock
    - Revert "btrfs: call __btrfs_remove_free_space_cache_locked on cache load
      failure" (Closes: #1022848)

  [ Salvatore Bonaccorso ]
  * [rt] Update to 6.0.5-rt14
  * Ignore ABI changes doe to removed check_var_size, check_var_size_nonblocking
    and remove_conflicting_pci_framebuffers

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 28 Oct 2022 08:53:43 +0200

linux (6.0.3-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.3
    - ALSA: oss: Fix potential deadlock at unregistration
    - ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
    - ALSA: usb-audio: Fix potential memory leaks
    - ALSA: usb-audio: Fix NULL dererence at error path
    - ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
    - ALSA: hda/realtek: Correct pin configs for ASUS G533Z
    - ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
    - ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
    - io_uring: add custom opcode hooks on fail
    - io_uring/rw: don't lose partial IO result on fail
    - io_uring/net: don't lose partial send/recv on fail
    - io_uring/rw: fix unexpected link breakage
    - io_uring/rw: don't lose short results on io_setup_async_rw()
    - io_uring/net: fix fast_iov assignment in io_setup_async_msg()
    - io_uring/net: don't update msg_name if not provided
    - io_uring: limit registration w/ SINGLE_ISSUER
    - io_uring/net: handle -EINPROGRESS correct for IORING_OP_CONNECT
    - io_uring/af_unix: defer registered files gc to io_uring release
      (CVE-2022-2602)
    - io_uring: correct pinned_vm accounting
    - [x86] hv_netvsc: Fix race between VF offering and VF association message
      from host
    - cifs: destage dirty pages before re-reading them for cache=none
    - cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
    - iio: dac: ad5593r: Fix i2c read protocol requirements
    - iio: ltc2497: Fix reading conversion results
    - iio: adc: ad7923: fix channel readings for some variants
    - iio: pressure: dps310: Refactor startup procedure
    - iio: pressure: dps310: Reset chip after timeout
    - xhci: dbc: Fix memory leak in xhci_alloc_dbc()
    - usb: gadget: uvc: Fix argument to sizeof() in uvc_register_video()
    - usb: add quirks for Lenovo OneLink+ Dock
    - mmc: core: Add SD card quirk for broken discard
    - can: kvaser_usb: Fix use of uninitialized completion
    - can: kvaser_usb_leaf: Fix overread with an invalid command
    - can: kvaser_usb_leaf: Fix TX queue out of sync after restart
    - can: kvaser_usb_leaf: Fix CAN state after restart
    - mmc: renesas_sdhi: Fix rounding errors
    - mmc: sdhci-tegra: Use actual clock rate for SW tuning correction
    - mmc: sdhci-sprd: Fix minimum clock limit
    - i2c: designware: Fix handling of real but unexpected device interrupts
    - fs: dlm: fix race between test_bit() and queue_work()
    - fs: dlm: handle -EBUSY first in lock arg validation
    - fs: dlm: fix invalid derefence of sb_lvbptr
    - btf: Export bpf_dynptr definition
    - mbcache: Avoid nesting of cache->c_list_lock under bit locks
    - HID: multitouch: Add memory barriers
    - quota: Check next/prev free block number after reading from quota file
    - platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
    - [arm64] dts: qcom: sdm845-mtp: correct ADC settle time
    - ASoC: wcd9335: fix order of Slimbus unprepare/disable
    - ASoC: wcd934x: fix order of Slimbus unprepare/disable
    - hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
    - net: thunderbolt: Enable DMA paths only after rings are enabled
    - regulator: qcom_rpm: Fix circular deferral regression
    - [arm64] topology: move store_cpu_topology() to shared code
    - [riscv64] topology: fix default topology reporting
    - [riscv64] Re-enable counter access from userspace
    - [riscv64] Make port I/O string accessors actually work
    - [riscv64] vdso: fix NULL deference in vdso_join_timens() when vfork
    - [riscv64] Allow PROT_WRITE-only mmap()
    - [riscv64] Make VM_WRITE imply VM_READ
    - [riscv64] always honor the CONFIG_CMDLINE_FORCE when parsing dtb
    - [riscv64] Pass -mno-relax only on lld < 15.0.0
    - nvmem: core: Fix memleak in nvmem_register()
    - nvme-multipath: fix possible hang in live ns resize with ANA access
    - Revert "drm/amdgpu: use dirty framebuffer helper"
    - dm: verity-loadpin: Only trust verity targets with enforcement
    - dmaengine: mxs: use platform_driver_register
    - dmaengine: qcom-adm: fix wrong sizeof config in slave_config
    - dmaengine: qcom-adm: fix wrong calling convention for prep_slave_sg
    - drm/virtio: Check whether transferred 2D BO is shmem
    - drm/virtio: Unlock reservations on virtio_gpu_object_shmem_init() error
    - drm/virtio: Unlock reservations on dma_resv_reserve_fences() error
    - drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb()
    - drm/udl: Restore display mode on resume
    - [arm64] mte: move register initialization to C
    - [arm64] mte: Avoid setting PG_mte_tagged if no tags cleared or restored
    - [arm64] errata: Add Cortex-A55 to the repeat tlbi list
    - clocksource/drivers/arm_arch_timer: Fix CNTPCT_LO and CNTVCT_LO value
    - mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page
    - mm/damon: validate if the pmd entry is present before accessing
    - mm/uffd: fix warning without PTE_MARKER_UFFD_WP compiled in
    - mm/mmap: undo ->mmap() when arch_validate_flags() fails
    - xen/gntdev: Prevent leaking grants
    - xen/gntdev: Accommodate VMA splitting
    - PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
    - serial: cpm_uart: Don't request IRQ too early for console port
    - serial: stm32: Deassert Transmit Enable on ->rs485_config()
    - serial: Deassert Transmit Enable on probe in driver-specific way
    - serial: ar933x: Deassert Transmit Enable on ->rs485_config()
    - serial: 8250: Let drivers request full 16550A feature probing
    - serial: 8250: Request full 16550A feature probing for OxSemi PCIe devices
    - NFSD: Protect against send buffer overflow in NFSv3 READDIR
    - NFSD: Protect against send buffer overflow in NFSv2 READ
    - NFSD: Protect against send buffer overflow in NFSv3 READ
    - cpufreq: qcom-cpufreq-hw: Fix uninitialized throttled_freq warning
    - LoadPin: Fix Kconfig doc about format of file with verity digests
    - powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain
    - slimbus: qcom-ngd: use correct error in message of pdr_add_lookup()
      failure
    - slimbus: qcom-ngd: cleanup in probe error path
    - scsi: lpfc: Rework MIB Rx Monitor debug info logic
    - scsi: qedf: Populate sysfs attributes for vport
    - gpio: rockchip: request GPIO mux to pinctrl when setting direction
    - pinctrl: rockchip: add pinmux_ops.gpio_set_direction callback
    - fbdev: smscufx: Fix use-after-free in ufx_ops_open()
    - hwrng: core - let sleep be interrupted when unregistering hwrng
    - smb3: do not log confusing message when server returns no network
      interfaces
    - ksmbd: fix incorrect handling of iterate_dir
    - ksmbd: fix endless loop when encryption for response fails
    - ksmbd: Fix wrong return value and message length check in smb2_ioctl()
    - ksmbd: Fix user namespace mapping
    - fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE
    - btrfs: fix alignment of VMA for memory mapped files on THP
    - btrfs: enhance unsupported compat RO flags handling
    - btrfs: fix race between quota enable and quota rescan ioctl
    - btrfs: fix missed extent on fsync after dropping extent maps
    - btrfs: set generation before calling btrfs_clean_tree_block in
      btrfs_init_new_buffer
    - f2fs: fix wrong continue condition in GC
    - f2fs: complete checkpoints during remount
    - f2fs: flush pending checkpoints when freezing super
    - f2fs: increase the limit for reserve_root
    - f2fs: fix to do sanity check on destination blkaddr during recovery
    - f2fs: fix to do sanity check on summary info
    - f2fs: allow direct read for zoned device
    - jbd2: wake up journal waiters in FIFO order, not LIFO
    - jbd2: fix potential buffer head reference count leak
    - jbd2: fix potential use-after-free in jbd2_fc_wait_bufs
    - jbd2: add miss release buffer head in fc_do_one_pass()
    - ext2: Add sanity checks for group and filesystem size
    - ext4: avoid crash when inline data creation follows DIO write
    - ext4: fix null-ptr-deref in ext4_write_info
    - ext4: make ext4_lazyinit_thread freezable
    - ext4: fix check for block being out of directory size (CVE-2022-1184)
    - ext4: don't increase iversion counter for ea_inodes
    - ext4: unconditionally enable the i_version counter
    - ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
    - ext4: place buffer head allocation before handle start
    - ext4: fix i_version handling in ext4
    - ext4: fix dir corruption when ext4_dx_add_entry() fails
    - ext4: fix miss release buffer head in ext4_fc_write_inode
    - ext4: fix potential memory leak in ext4_fc_record_modified_inode()
    - ext4: fix potential memory leak in ext4_fc_record_regions()
    - ext4: update 'state->fc_regions_size' after successful memory allocation
    - ftrace: Properly unset FTRACE_HASH_FL_MOD
    - ftrace: Still disable enabled records marked as disabled
    - ring-buffer: Allow splice to read previous partially read pages
    - ring-buffer: Have the shortest_full queue be the shortest not longest
    - ring-buffer: Check pending waiters when doing wake ups as well
    - ring-buffer: Add ring_buffer_wake_waiters()
    - ring-buffer: Fix race between reset page and reading page
    - tracing/eprobe: Fix alloc event dir failed when event name no set
    - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
    - tracing: Wake up ring buffer waiters on closing of the file
    - tracing: Wake up waiters when tracing is disabled
    - tracing: Add ioctl() to force ring buffer waiters to wake up
    - tracing: Do not free snapshot if tracer is on cmdline
    - tracing: Move duplicate code of trace_kprobe/eprobe.c into header
    - tracing: Add "(fault)" name injection to kernel probes
    - tracing: Fix reading strings from synthetic events
    - rpmsg: char: Avoid double destroy of default endpoint
    - thunderbolt: Explicitly enable lane adapter hotplug events at startup
    - efi: libstub: drop pointless get_memory_map() call
    - media: cedrus: Fix watchdog race condition
    - media: cedrus: Set the platform driver data earlier
    - media: cedrus: Fix endless loop in cedrus_h265_skip_bits()
    - blk-throttle: fix that io throttle can only work for single bio
    - blk-wbt: call rq_qos_add() after wb_normal is initialized
    - [x86] KVM: x86/emulator: Fix handing of POP SS to correctly set
      interruptibility
    - [x86] KVM: nVMX: Unconditionally purge queued/injected events on nested
      "exit"
    - [x86] KVM: nVMX: Don't propagate vmcs12's PERF_GLOBAL_CTRL settings to
      vmcs02
    - [x86] KVM: x86: Treat #DBs from the emulator as fault-like (code and
      DR7.GD=1)
    - [x86] KVM: VMX: Drop bits 31:16 when shoving exception error code into
      VMCS
    - staging: greybus: audio_helper: remove unused and wrong debugfs usage
    - drm/nouveau/kms/nv140-: Disable interlacing
    - drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
    - [x86] drm/i915/gt: Use i915_vm_put on ppgtt_create error paths
    - [x86] drm/i915/guc: Fix revocation of non-persistent contexts
    - [x86] drm/i915: Fix watermark calculations for gen12+ RC CCS modifier
    - [x86] drm/i915: Fix watermark calculations for gen12+ MC CCS modifier
    - [x86] drm/i915: Fix watermark calculations for gen12+ CCS+CC modifier
    - [x86] drm/i915: Fix watermark calculations for DG2 CCS modifiers
    - [x86] drm/i915: Fix watermark calculations for DG2 CCS+CC modifier
    - [x86] drm/i915: Fix display problems after resume
    - drm/amd/display: Fix watermark calculation
    - drm/amd/display: Update PMFW z-state interface for DCN314
    - drm/amd/display: zeromem mypipe heap struct before using it
    - drm/amd/display: Validate DSC After Enable All New CRTCs
    - drm/amd/display: Enable dpia support for dcn314
    - drm/amd/display: Enable 2 to 1 ODM policy if supported
    - drm/amd/display: Fix vblank refcount in vrr transition
    - drm/amd/display: Add HUBP surface flip interrupt handler
    - drm/amd/display: explicitly disable psr_feature_enable appropriately
    - drm/amdgpu: Enable VCN PG on GC11_0_1
    - drm/amdgpu: Enable F32_WPTR_POLL_ENABLE in mqd
    - smb3: must initialize two ACL struct fields to zero
    - selinux: use "grep -E" instead of "egrep"
    - ima: fix blocking of security.ima xattrs of unsupported algorithms
    - userfaultfd: open userfaultfds with O_RDONLY
    - acl: return EOPNOTSUPP in posix_acl_fix_xattr_common()
    - thermal: cpufreq_cooling: Check the policy first in
      cpufreq_cooling_register()
    - cpufreq: amd-pstate: Fix initial highest_perf value
    - erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
    - erofs: use kill_anon_super() to kill super in fscache mode
    - ACPI: PCC: Release resources on address space setup failure path
    - ACPI: PCC: replace wait_for_completion()
    - ACPI: PCC: Fix Tx acknowledge in the PCC address space handler
    - objtool: Preserve special st_shndx indexes in elf_update_symbol
    - nfsd: Fix a memory leak in an error handling path
    - SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation
    - SUNRPC: Fix svcxdr_init_encode's buflen calculation
    - NFSD: Protect against send buffer overflow in NFSv2 READDIR
    - NFSD: Fix handling of oversized NFSv4 COMPOUND requests
    - [x86] paravirt: add extra clobbers with ZERO_CALL_USED_REGS enabled
    - wifi: rtlwifi: 8192de: correct checking of IQK reload
    - wifi: ath10k: Set tx credit to one for WCN3990 snoc based devices
    - wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
    - bpf: Cleanup check_refcount_ok
    - bpf: Fix ref_obj_id for dynptr data slices in verifier
    - leds: lm3601x: Don't use mutex after it was destroyed
    - tsnep: Fix TSNEP_INFO_TX_TIME register define
    - net: prestera: cache port state for non-phylink ports too
    - bpf: Fix reference state management for synchronous callbacks
    - wifi: mac80211: properly set old_links when removing a link
    - wifi: cfg80211: get correct AP link chandef
    - wifi: mac80211: fix use-after-free
    - wifi: mac80211: mlme: don't add empty EML capabilities
    - wifi: mac80211_hwsim: fix link change handling
    - wifi: mac80211: allow bw change during channel switch in mesh
    - bpftool: Fix a wrong type cast in btf_dumper_int
    - ice: set tx_tstamps when creating new Tx rings via ethtool
    - audit: explicitly check audit_context->context enum value
    - audit: free audit_proctitle only on task exit
    - esp: choose the correct inner protocol for GSO on inter address family
      tunnels
    - spi: mt7621: Fix an error message in mt7621_spi_probe()
    - [x86] resctrl: Fix to restore to original value when re-enabling hardware
      prefetch register
    - xsk: Fix backpressure mechanism on Tx
    - bpf: Disable preemption when increasing per-cpu map_locked
    - bpf: Propagate error from htab_lock_bucket() to userspace
    - wifi: ath11k: Fix incorrect QMI message ID mappings
    - bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy
    - bpf: Use this_cpu_{inc_return|dec} for prog->active
    - Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend
    - bpf: Only add BTF IDs for socket security hooks when
      CONFIG_SECURITY_NETWORK is on
    - wifi: rtw89: pci: fix interrupt stuck after leaving low power mode
    - wifi: rtw89: pci: correct TX resource checking in low power mode
    - wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
    - wifi: wfx: prevent underflow in wfx_send_pds()
    - wifi: rtw88: add missing destroy_workqueue() on error path in
      rtw_core_init()
    - wifi: mac80211: mlme: assign link address correctly
    - spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
    - spi: qup: add missing clk_disable_unprepare on error in
      spi_qup_pm_resume_runtime()
    - wifi: rtl8xxxu: Fix skb misuse in TX queue selection
    - spi: meson-spicc: do not rely on busy flag in pow2 clk ops
    - bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
    - wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
    - wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask
    - Bluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev()
    - wifi: mt76: mt7921e: fix race issue between reset and suspend/resume
    - wifi: mt76: mt7921s: fix race issue between reset and suspend/resume
    - wifi: mt76: mt7921u: fix race issue between reset and suspend/resume
    - wifi: mt76: sdio: fix the deadlock caused by sdio->stat_work
    - wifi: mt76: sdio: poll sta stat when device transmits data
    - wifi: mt76: mt7915: fix an uninitialized variable bug
    - wifi: mt76: mt7921: fix use after free in mt7921_acpi_read()
    - wifi: mt76: sdio: fix transmitting packet hangs
    - wifi: mt76: mt7615: add mt7615_mutex_acquire/release in
      mt7615_sta_set_decap_offload
    - wifi: mt76: mt7915: fix possible unaligned access in
      mt7915_mac_add_twt_setup
    - wifi: mt76: connac: fix possible unaligned access in
      mt76_connac_mcu_add_nested_tlv
    - wifi: mt76: mt7921: add mt7921_mutex_acquire at mt7921_[start, stop]_ap
    - wifi: mt76: mt7921: add mt7921_mutex_acquire at
      mt7921_sta_set_decap_offload
    - wifi: mt76: mt7921: fix the firmware version report
    - wifi: mt76: mt7915: fix mcs value in ht mode
    - wifi: mt76: fix uninitialized pointer in mt7921_mac_fill_rx
    - wifi: mt76: mt7915: do not check state before configuring implicit
      beamform
    - wifi: mt76: mt7921e: fix rmmod crash in driver reload test
    - Bluetooth: RFCOMM: Fix possible deadlock on socket shutdown/release
    - net: fs_enet: Fix wrong check in do_pd_setup
    - bpf: Ensure correct locking around vulnerable function find_vpid()
    - libbpf: Fix crash if SEC("freplace") programs don't have attach_prog_fd
      set
    - wifi: ath11k: Include STA_KEEPALIVE_ARP_RESPONSE TLV header by default
    - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
    - netfilter: conntrack: fix the gc rescheduling delay
    - netfilter: conntrack: revisit the gc initial rescheduling bias
    - bpf, cgroup: Reject prog_attach_flags array when effective query
    - bpftool: Fix wrong cgroup attach flags being assigned to effective progs
    - flow_dissector: Do not count vlan tags inside tunnel payload
    - mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv
    - wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected
    - wifi: ath11k: fix number of VHT beamformee spatial streams
    - mips: dts: ralink: mt7621: fix external phy on GB-PC2
    - [x86] microcode/AMD: Track patch allocation size explicitly
    - wifi: ath11k: fix peer addition/deletion error on sta band migration
    - [x86] cpu: Include the header of init_ia32_feat_ctl()'s prototype
    - spi: cadence-quadspi: Fix PM disable depth imbalance in cqspi_probe
    - spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe
    - spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
    - skmsg: Schedule psock work if the cached skb exists on the psock
    - cw1200: fix incorrect check to determine if no element is found in list
    - i2c: mlxbf: support lock mechanism
    - Bluetooth: hci_core: Fix not handling link timeouts propertly
    - xfrm: Reinject transport-mode packets through workqueue
    - netfilter: nft_fib: Fix for rpath check with VRF devices
    - spi: s3c64xx: Fix large transfers with DMA
    - Bluetooth: Prevent double register of suspend
    - wifi: rtl8xxxu: gen2: Enable 40 MHz channel width
    - wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM
    - vhost/vsock: Use kvmalloc/kvfree for larger packets.
    - eth: alx: take rtnl_lock on resume
    - mISDN: fix use-after-free bugs in l1oip timer handlers (CVE-2022-3565)
    - sctp: handle the error returned from sctp_auth_asoc_init_active_key
    - tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
    - spi: Ensure that sg_table won't be used after being freed
    - Bluetooth: hci_sync: Fix not indicating power state
    - hwmon: (pmbus/mp2888) Fix sensors readouts for MPS Multi-phase mp2888
      controller
    - net: rds: don't hold sock lock when cancelling work from
      rds_tcp_reset_callbacks()
    - af_unix: Fix memory leaks of the whole sk due to OOB skb. (CVE-2022-3543)
    - net: prestera: acl: Add check for kmemdup
    - eth: lan743x: reject extts for non-pci11x1x devices
    - bnx2x: fix potential memory leak in bnx2x_tpa_stop() (CVE-2022-3542)
    - eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address
      (CVE-2022-3541)
    - net: wwan: iosm: Call mutex_init before locking it
    - net/ieee802154: reject zero-sized raw_sendmsg()
    - once: add DO_ONCE_SLOW() for sleepable contexts
    - net: mvpp2: fix mvpp2 debugfs leak (CVE-2022-3535)
    - drm: bridge: adv7511: fix CEC power down control register offset
    - drm: bridge: adv7511: unregister cec i2c device after cec adapter
    - drm/bridge: Avoid uninitialized variable warning
    - drm/mipi-dsi: Detach devices when removing the host
    - drm/vc4: drv: Call component_unbind_all()
    - drm/bridge: it6505: Power on downstream device in .atomic_enable
    - video/aperture: Disable and unregister sysfb devices via aperture helpers
    - drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling
    - drm/bridge: anx7625: Fix refcount bug in anx7625_parse_dt()
    - drm/bridge: tc358767: Add of_node_put() when breaking out of loop
    - drm/bridge: parade-ps8640: Fix regulator supply order
    - drm/format-helper: Fix test on big endian architectures
    - drm/dp_mst: fix drm_dp_dpcd_read return value checks
    - drm:pl111: Add of_node_put() when breaking out of
      for_each_available_child_of_node()
    - ASoC: mt6359: fix tests for platform_get_irq() failure
    - ASoC: amd: acp: add missing platform_device_unregister() in
      acp_pci_probe()
    - drm/msm: Make .remove and .shutdown HW shutdown consistent
    - platform/chrome: fix double-free in chromeos_laptop_prepare()
    - platform/chrome: fix memory corruption in ioctl
    - [x86] drm/i915/dg2: Bump up CDCLK for DG2
    - drm/virtio: Fix same-context optimization
    - ASoC: soc-pcm.c: call __soc_pcm_close() in soc_pcm_close()
    - ASoC: tas2764: Allow mono streams
    - ASoC: tas2764: Drop conflicting set_bias_level power setting
    - ASoC: tas2764: Fix mute/unmute
    - platform/x86: msi-laptop: Fix old-ec check for backlight registering
    - platform/x86: msi-laptop: Fix resource cleanup
    - drm/panel: use 'select' for Ili9341 panel driver helpers
    - drm: fix drm_mipi_dbi build errors
    - platform/chrome: cros_ec_typec: Add bit offset for DP VDO
    - platform/chrome: cros_ec_typec: Correct alt mode index
    - drm/amdgpu: add missing pci_disable_device() in
      amdgpu_pmops_runtime_resume()
    - drm/bridge: megachips: Fix a null pointer dereference bug
    - drm/bridge: it6505: Fix the order of DP_SET_POWER commands
    - ASoC: rsnd: Add check for rsnd_mod_power_on
    - ASoC: wm_adsp: Handle optional legacy support
    - ALSA: hda: beep: Simplify keep-power-at-enable behavior
    - drm/virtio: set fb_modifiers_not_supported
    - drm/bochs: fix blanking
    - ASoC: mediatek: mt8195-mt6359: Properly register sound card for SOF
    - ASoC: SOF: mediatek: mt8195: Import namespace SND_SOC_SOF_MTK_COMMON
    - drm/omap: dss: Fix refcount leak bugs
    - drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue()
    - ASoC: rockchip: i2s: use regmap_read_poll_timeout to poll I2S_CLR
    - mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
    - ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
    - drm/msm: lookup the ICC paths in both mdp5/dpu and mdss devices
    - drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
    - drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa()
    - ALSA: hda/hdmi: change type for the 'assigned' variable
    - ALSA: hda/hdmi: Fix the converter allocation for the silent stream
    - ALSA: usb-audio: Properly refcounting clock rate
    - ASoC: SOF: ipc4-topology: Free the ida when IPC fails in
      sof_ipc4_widget_setup()
    - drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()
    - virtio-gpu: fix shift wrapping bug in virtio_gpu_fence_event_create()
    - ASoC: codecs: tx-macro: fix kcontrol put
    - ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
    - ALSA: dmaengine: increment buffer pointer atomically
    - mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
    - ASoC: stm32: dfsdm: Fix PM disable depth imbalance in stm32_adfsdm_probe
    - ASoC: stm32: spdifrx: Fix PM disable depth imbalance in
      stm32_spdifrx_probe
    - ASoC: stm: Fix PM disable depth imbalance in stm32_i2s_probe
    - ASoC: wcd-mbhc-v2: Revert "ASoC: wcd-mbhc-v2: use
      pm_runtime_resume_and_get()"
    - ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
    - ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
    - ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
    - ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe
    - ASoC: rockchip: i2s: use regmap_read_poll_timeout_atomic to poll I2S_CLR
    - ALSA: hda/hdmi: Don't skip notification handling during PM operation
    - memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
    - memory: of: Fix refcount leak bug in of_get_ddr_timings()
    - memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
    - locks: fix TOCTOU race when granting write lease
    - soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
    - soc: qcom: smem_state: Add refcounting for the 'state->of_node'
    - ARM: dts: imx6qdl-kontron-samx6i: hook up DDC i2c bus
    - [arm64] dts: renesas: r9a07g044: Fix SCI{Rx,Tx} interrupt types
    - [arm64] dts: renesas: r9a07g054: Fix SCI{Rx,Tx} interrupt types
    - [arm64] dts: renesas: r9a07g043: Fix SCI{Rx,Tx} interrupt types
    - dt-bindings: clock: exynosautov9: correct clock numbering of peric0/c1
    - [arm64] dts: qcom: sdm845-xiaomi-polaris: Fix sde_dsi_active pinctrl
    - [arm64] dts: qcom: sc7280: Cleanup the lpasscc node
    - [arm64] dts: qcom: sc7280: Update lpasscore node
    - [arm64] dts: qcom: sc8280xp-crd: disallow regulator mode switches
    - [arm64] dts: qcom: sc8280xp-lenovo-thinkpad-x13s: disallow regulator mode
      switches
    - [arm64] dts: qcom: sa8295p-adp: disallow regulator mode switches
    - [arm64] dts: qcom: pm8350c: Drop PWM reg declaration
    - [arm64] dts: qcom: sc7180-trogdor: Keep pm6150_adc enabled for TZ
    - [arm64] dts: marvell: 98dx25xx: use correct property for i2c gpios
    - [arm64] dts: qcom: sm8350-sagami: correct TS pin property
    - soc/tegra: fuse: Add missing of_node_put() in tegra_init_fuse()
    - soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
    - [arm64] dts: qcom: ipq8074: fix PCIe PHY serdes size
    - [arm64] dts: qcom: sm8450: fix UFS PHY serdes size
    - [arm64] dts: ti: k3-j7200: fix main pinmux range
    - ext4: continue to expand file system when the target size doesn't reach
    - ext4: don't run ext4lazyinit for read-only filesystems
    - [arm64] ftrace: fix module PLTs with mcount
    - [arm64] dts: exynos: fix polarity of "enable" line of NFC chip in TM2
    - ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
    - iomap: iomap: fix memory corruption when recording errors during writeback
    - iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
    - iio: adc: at91-sama5d2_adc: check return status for pressure and touch
    - iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
    - iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume
    - iio: inkern: only release the device node when done with it
    - iio: inkern: fix return value in devm_of_iio_channel_get_by_name()
    - iio: ABI: Fix wrong format of differential capacitance channel ABI.
    - iio: magnetometer: yas530: Change data type of hard_offsets to signed
    - RDMA/mlx5: Don't compare mkey tags in DEVX indirect mkey
    - usb: common: usb-conn-gpio: Simplify some error message
    - usb: common: debug: Check non-standard control requests
    - clk: meson: Hold reference returned by of_get_parent()
    - clk: st: Hold reference returned by of_get_parent()
    - clk: oxnas: Hold reference returned by of_get_parent()
    - clk: qoriq: Hold reference returned by of_get_parent()
    - clk: berlin: Add of_node_put() for of_get_parent()
    - clk: sprd: Hold reference returned by of_get_parent()
    - coresight: docs: Fix a broken reference
    - clk: tegra: Fix refcount leak in tegra210_clock_init
    - clk: tegra: Fix refcount leak in tegra114_clock_init
    - clk: tegra20: Fix refcount leak in tegra20_clock_init
    - clk: samsung: exynosautov9: correct register offsets of peric0/c1
    - HID: uclogic: Add missing suffix for digitalizers
    - HID: uclogic: Fix warning in uclogic_rdesc_template_apply
    - HSI: omap_ssi: Fix refcount leak in ssi_probe
    - HSI: omap_ssi_port: Fix dma_map_sg error check
    - clk: qcom: gcc-sdm660: Use floor ops for SDCC1 clock
    - media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
    - media: airspy: fix memory leak in airspy probe
    - tty: xilinx_uartps: Check clk_enable return value
    - tty: xilinx_uartps: Fix the ignore_status
    - media: mediatek: vcodec: Skip non CBR bitrate mode
    - media: amphion: insert picture startcode after seek for vc1g format
    - media: amphion: adjust the encoder's value range of gop size
    - media: amphion: don't change the colorspace reported by decoder.
    - media: amphion: fix a bug that vpu core may not resume after suspend
    - media: meson: vdec: add missing clk_disable_unprepare on error in
      vdec_hevc_start()
    - media: uvcvideo: Fix memory leak in uvc_gpio_parse
    - media: uvcvideo: Use entity get_cur in uvc_ctrl_set
    - media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
    - RDMA/rxe: Fix "kernel NULL pointer dereference" error
    - RDMA/rxe: Fix the error caused by qp->sk
    - clk: mediatek: clk-mt8195-vdo0: Set rate on vdo0_dp_intf0_dp_intf's parent
    - clk: mediatek: clk-mt8195-vdo1: Reparent and set rate on vdo1_dpintf's
      parent
    - clk: mediatek: mt8195-infra_ao: Set pwrmcu clocks as critical
    - misc: ocxl: fix possible refcount leak in afu_ioctl()
    - fpga: dfl-pci: Add IDs for Intel N6000, N6001 and C6100 cards
    - fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
    - phy: rockchip-inno-usb2: Return zero after otg sync
    - dmaengine: idxd: avoid deadlock in process_misc_interrupts()
    - dmaengine: hisilicon: Disable channels when unregister hisi_dma
    - dmaengine: hisilicon: Fix CQ head update
    - dmaengine: hisilicon: Add multi-thread support for a DMA channel
    - iio: Use per-device lockdep class for mlock
    - usb: gadget: f_fs: stricter integer overflow checks
    - dyndbg: fix static_branch manipulation
    - dyndbg: fix module.dyndbg handling
    - dyndbg: let query-modname override actual module name
    - dyndbg: drop EXPORTed dynamic_debug_exec_queries
    - clk: qcom: sm6115: Select QCOM_GDSC
    - scsi: lpfc: Fix various issues reported by tools
    - mtd: devices: docg3: check the return value of devm_ioremap() in the probe
    - remoteproc: Harden rproc_handle_vdev() against integer overflow
    - phy: qcom-qmp-usb: disable runtime PM on unbind
    - phy: amlogic: phy-meson-axg-mipi-pcie-analog: Hold reference returned by
      of_get_parent()
    - phy: phy-mtk-tphy: fix the phy type setting issue
    - mtd: rawnand: intel: Read the chip-select line from the correct OF node
    - mtd: rawnand: intel: Remove undocumented compatible string
    - mtd: rawnand: fsl_elbc: Fix none ECC mode
    - RDMA/irdma: Align AE id codes to correct flush code and event
    - RDMA/irdma: Validate udata inlen and outlen
    - RDMA/srp: Fix srp_abort()
    - RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
    - RDMA/siw: Fix QP destroy to wait for all references dropped.
    - ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
    - ata: fix ata_id_has_devslp()
    - ata: fix ata_id_has_ncq_autosense()
    - ata: fix ata_id_has_dipm()
    - mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
    - block: Fix the enum blk_eh_timer_return documentation
    - eventfd: guard wake_up in eventfd fs calls as well
    - io_uring/fdinfo: fix sqe dumping for IORING_SETUP_SQE128
    - md: Replace snprintf with scnprintf
    - md/raid5: Ensure stripe_fill happens on non-read IO with journal
    - md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()
    - md: Remove extra mddev_get() in md_seq_start()
    - RDMA/cm: Use SLID in the work completion as the DLID in responder side
    - IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
    - xhci: Don't show warning for reinit on known broken suspend
    - usb: gadget: function: fix dangling pnp_string in f_printer.c
    - usb: typec: anx7411: Use of_get_child_by_name() instead of
      of_find_node_by_name()
    - usb: dwc3: core: fix some leaks in probe
    - drivers: serial: jsm: fix some leaks in probe
    - serial: 8250: Toggle IER bits on only after irq has been set up
    - tty: serial: fsl_lpuart: disable dma rx/tx use flags in
      lpuart_dma_shutdown
    - phy: qualcomm: call clk_disable_unprepare in the error handling
    - staging: vt6655: fix some erroneous memory clean-up loops
    - slimbus: qcom-ngd: Add error handling in of_qcom_slim_ngd_register
    - firmware: google: Test spinlock on panic path to avoid lockups
    - serial: 8250: Fix restoring termios speed after suspend
    - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
    - scsi: pm8001: Fix running_req for internal abort commands
    - scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
    - clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical
    - clk: qcom: gcc-sm6115: Override default Alpha PLL regs
    - nvmet-auth: don't try to cancel a non-initialized work_struct
    - RDMA/rxe: Set pd early in mr alloc routines
    - RDMA/rxe: Fix resize_finish() in rxe_queue.c
    - fsi: core: Check error number after calling ida_simple_get
    - mfd: intel_soc_pmic: Fix an error handling path in
      intel_soc_pmic_i2c_probe()
    - mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
    - mfd: lp8788: Fix an error handling path in lp8788_probe()
    - mfd: lp8788: Fix an error handling path in lp8788_irq_init() and
      lp8788_irq_init()
    - mfd: fsl-imx25: Fix check for platform_get_irq() errors
    - mfd: sm501: Add check for platform_driver_register()
    - mfd: da9061: Fix Failed to set Two-Wire Bus Mode.
    - clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
    - clk: mediatek: clk-mt8195-mfg: Reparent mfg_bg3d and propagate rate
      changes
    - clk: mediatek: fix unregister function in mtk_clk_register_dividers
      cleanup
    - clk: mediatek: Migrate remaining clk_unregister_*() to
      clk_hw_unregister_*()
    - io_uring/rw: defer fsnotify calls to task context
    - dmaengine: ioat: stop mod_timer from resurrecting deleted timer in
      __cleanup()
    - HID: amd_sfh: Handle condition of "no sensors" for SFH1.1
    - usb: mtu3: fix failed runtime suspend in host only mode
    - spmi: pmic-arb: correct duplicate APID to PPID mapping logic
    - clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD
    - clk: baikal-t1: Fix invalid xGMAC PTP clock divider
    - clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent
    - clk: baikal-t1: Add SATA internal ref clock buffer
    - clk: bcm2835: Make peripheral PLLC critical
    - clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
    - clk: imx8mp: tune the order of enet_qos_root_clk
    - clk: imx: scu: fix memleak on platform_device_add() fails
    - clk: ti: Balance of_node_get() calls for of_find_node_by_name()
    - clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
    - clk: ast2600: BCLK comes from EPLL
    - ipc: mqueue: fix possible memory leak in init_mqueue_fs()
    - powerpc/configs: Properly enable PAPR_SCM in pseries_defconfig
    - powerpc/math_emu/efp: Include module.h
    - powerpc/sysdev/fsl_msi: Add missing of_node_put()
    - powerpc/pci_dn: Add missing of_node_put()
    - powerpc/powernv: add missing of_node_put() in opal_export_attrs()
    - cpuidle: riscv-sbi: Fix CPU_PM_CPU_IDLE_ENTER_xyz() macro usage
    - powerpc: dts: turris1x.dts: Fix NOR partitions labels
    - powerpc: dts: turris1x.dts: Fix labels in DSA cpu port nodes
    - powerpc: Fix fallocate and fadvise64_64 compat parameter combination
    - x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
    - powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
    - powerpc/64/interrupt: Fix false warning in context tracking due to idle
      state
    - powerpc/64: mark irqs hard disabled in boot paca
    - powerpc/64/interrupt: Fix return to masked context after hard-mask irq
      becomes pending
    - powerpc: Fix SPE Power ISA properties for e500v1 platforms
    - powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()
    - powerpc/pseries/vas: Pass hw_cpu_id to node associativity HCALL
    - crypto: sahara - don't sleep when in softirq
    - crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr
    - hwrng: arm-smccc-trng - fix NO_ENTROPY handling
    - crypto: ccp - Fail the PSP initialization when writing psp data file
      failed
    - cgroup: Honor caller's cgroup NS when resolving path
    - hwrng: imx-rngc - use devm_clk_get_enabled
    - hwrng: imx-rngc - Moving IRQ handler registering after
      imx_rngc_irq_mask_clear()
    - crypto: qat - fix default value of WDT timer
    - crypto: hisilicon/qm - fix missing put dfx access
    - cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
    - iommu/omap: Fix buffer overflow in debugfs
    - crypto: akcipher - default implementation for setting a private key
    - crypto: ccp - Release dma channels before dmaengine unrgister
    - crypto: inside-secure - Change swab to swab32
    - crypto: qat - fix DMA transfer direction
    - clocksource/drivers/arm_arch_timer: Fix handling of ARM erratum 858921
    - clocksource/drivers/timer-gxp: Add missing error handling in
      gxp_timer_probe
    - cifs: return correct error in ->calc_signature()
    - iommu/iova: Fix module config properly
    - tracing: kprobe: Fix kprobe event gen test module on exit
    - tracing: kprobe: Make gen test module work in arm and riscv
    - tracing/osnoise: Fix possible recursive locking in stop_per_cpu_kthreads
    - ftrace: Fix recursive locking direct_mutex in ftrace_modify_direct_caller
    - kbuild: remove the target in signal traps when interrupted
    - linux/export: use inline assembler to populate symbol CRCs
    - kbuild: rpm-pkg: fix breakage when V=1 is used
    - crypto: marvell/octeontx - prevent integer overflows
    - crypto: cavium - prevent integer overflow loading firmware
    - random: schedule jitter credit for next jiffy, not in two jiffies
    - thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id
    - ACPI: APEI: do not add task_work to kernel thread to avoid memory leak
    - f2fs: fix race condition on setting FI_NO_EXTENT flag
    - f2fs: fix to account FS_CP_DATA_IO correctly
    - tools/power turbostat: Use standard Energy Unit for SPR Dram RAPL domain
    - selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle
    - ARM/dma-mapping: don't override ->dma_coherent when set from a bus
      notifier
    - module: tracking: Keep a record of tainted unloaded modules only
    - fs: dlm: fix race in lowcomms
    - rcu: Avoid triggering strict-GP irq-work when RCU is idle
    - rcu: Back off upon fill_page_cache_func() allocation failure
    - rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE()
    - rcu-tasks: Ensure RCU Tasks Trace loops have quiescent states
    - cpufreq: amd_pstate: fix wrong lowest perf fetch
    - ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
    - fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL
    - ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys
      address
    - cpufreq: intel_pstate: Add Tigerlake support in no-HWP mode
    - MIPS: BCM47XX: Cast memcmp() of function to (void *)
    - powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
    - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to
      avoid crash
    - ARM: decompressor: Include .data.rel.ro.local
    - ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable
    - NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
    - NFSD: fix use-after-free on source server when doing inter-server copy
    - wifi: brcmfmac: fix invalid address access when enabling SCAN log level
    - bpftool: Clear errno after libcap's checks
    - net: ethernet: ti: davinci_mdio: Add workaround for errata i2329
    - openvswitch: Fix double reporting of drops in dropwatch
    - openvswitch: Fix overreporting of drops in dropwatch
    - tcp: annotate data-race around tcp_md5sig_pool_populated
    - micrel: ksz8851: fixes struct pointer issue
    - wifi: mac80211: accept STA changes without link changes
    - [x86] mce: Retrieve poison range from hardware
    - wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
    - thunderbolt: Add back Intel Falcon Ridge end-to-end flow control
      workaround
    - [x86] apic: Don't disable x2APIC if locked
    - net: axienet: Switch to 64-bit RX/TX statistics
    - net-next: Fix IP_UNICAST_IF option behavior for connected sockets
    - xfrm: Update ipcomp_scratches with NULL when freed
    - wifi: ath11k: Register shutdown handler for WCN6750
    - rtw89: ser: leave lps with mutex
    - net: ftmac100: fix endianness-related issues from 'sparse'
    - iavf: Fix race between iavf_close and iavf_reset_task
    - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
    - Bluetooth: btintel: Mark Intel controller to support LE_STATES quirk
    - regulator: core: Prevent integer underflow
    - wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register()
    - wifi: mt76: mt7921: reset msta->airtime_ac while clearing up hw value
    - wifi: rtw89: free unused skb to prevent memory leak
    - wifi: rtw89: fix rx filter after scan
    - Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
    - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
    - Bluetooth: hci_event: Make sure ISO events don't affect non-ISO
      connections
    - bnxt_en: replace reset with config timestamps
    - selftests/bpf: Free the allocated resources after test case succeeds
    - can: bcm: check the result of can_send() in bcm_can_tx()
    - wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
    - wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
    - wifi: rt2x00: set VGC gain for both chains of MT7620
    - wifi: rt2x00: set SoC wmac clock register
    - wifi: rt2x00: correctly set BBP register 86 for MT7620
    - hwmon: (sht4x) do not overflow clamping operation on 32-bit platforms
    - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
    - bpf: Adjust kprobe_multi entry_ip for CONFIG_X86_KERNEL_IBT
    - bpf: use bpf_prog_pack for bpf_dispatcher
    - Bluetooth: L2CAP: Fix user-after-free
    - net: sched: cls_u32: Avoid memcpy() false-positive warning
    - libbpf: Fix overrun in netlink attribute iteration
    - i2c: designware-pci: Group AMD NAVI quirk parts together
    - r8152: Rate limit overflow messages (CVE-2022-3594)
    - drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
    - drm: Use size_t type for len variable in drm_copy_field()
    - drm: Prevent drm_copy_field() to attempt copying a NULL pointer
    - drm/komeda: Fix handling of atomic commits in the atomic_commit_tail hook
    - gpu: lontium-lt9611: Fix NULL pointer dereference in
      lt9611_connector_init()
    - drm/amd/display: fix overflow on MIN_I64 definition
    - ALSA: hda: Fix page fault in snd_hda_codec_shutdown()
    - ALSA: usb-audio: Add quirk to enable Avid Mbox 3 support
    - udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
    - platform/x86: pmc_atom: Improve quirk message to be less cryptic
    - drm/amd: fix potential memory leak
    - drm: bridge: dw_hdmi: only trigger hotplug event on link change
    - drm/amd/display: Fix variable dereferenced before check
    - drm/amdgpu: Skip the program of MMMC_VM_AGP_* in SRIOV on MMHUB v3_0_0
    - drm/admgpu: Skip CG/PG on SOC21 under SRIOV VF
    - ALSA: usb-audio: Register card at the last interface
    - drm/vc4: vec: Fix timings for VEC modes
    - drm: panel-orientation-quirks: Add quirk for Anbernic Win600
    - drm: panel-orientation-quirks: Add quirk for Aya Neo Air
    - platform/chrome: cros_ec: Notify the PM of wake events during resume
    - platform/x86: hp-wmi: Setting thermal profile fails with 0x06
    - platform/x86: msi-laptop: Change DMI match / alias strings to fix module
      autoloading
    - ALSA: intel-dspconfig: add ES8336 support for AlderLake-PS
    - ASoC: SOF: pci: Change DMI match info to support all Chrome platforms
    - ASoC: sunxi: sun4i-codec: set debugfs_prefix for CPU DAI component
    - ASoC: SOF: add quirk to override topology mclk_id
    - drm/amdgpu: SDMA update use unlocked iterator
    - drm/amd/display: Fix urgent latency override for DCN32/DCN321
    - drm/amd/display: correct hostvm flag
    - drm/amdgpu: fix initial connector audio value
    - ASoC: amd: yc: Add ASUS UM5302TA into DMI table
    - ASoC: amd: yc: Add Lenovo Yoga Slim 7 Pro X to quirks table
    - drm/meson: reorder driver deinit sequence to fix use-after-free bug
    - drm/meson: explicitly remove aggregate driver at module unload time
    - drm/meson: remove drm bridges at aggregate driver unbind time
    - mmc: sdhci-msm: add compatible string check for sdm670
    - drm/dp: Don't rewrite link config when setting phy test pattern
    - drm/amd/display: Remove interface for periodic interrupt 1
    - drm/amd/display: polling vid stream status in hpo dp blank
    - drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
    - ARM: dts: imx6: delete interrupts property if interrupts-extended is set
    - ARM: dts: imx7d-sdb: config the max pressure for tsc2046
    - [arm64] dts: qcom: sc7280-idp: correct ADC channel node name and unit
      address
    - ARM: dts: imx6q: add missing properties for sram
    - ARM: dts: imx6dl: add missing properties for sram
    - ARM: dts: imx6qp: add missing properties for sram
    - ARM: dts: imx6sl: add missing properties for sram
    - ARM: dts: imx6sll: add missing properties for sram
    - ARM: dts: imx6sx: add missing properties for sram
    - ARM: dts: imx6sl: use tabs for code indent
    - ARM: dts: imx6sx-udoo-neo: don't use multiple blank lines
    - [arm64] dts: imx8mm-kontron: Use the VSELECT signal to switch SD card IO
      voltage
    - [arm64] dts: imx8mq-librem5: Add bq25895 as max17055's power supply
    - ARM: orion: fix include path
    - btrfs: dump extra info if one free space cache has more bitmaps than it
      should
    - btrfs: scrub: properly report super block errors in system log
    - btrfs: scrub: try to fix super block errors
    - btrfs: don't print information about space cache or tree every remount
    - btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure
    - ARM: 9233/1: stacktrace: Skip frame pointer boundary check for
      call_with_stack()
    - ARM: 9234/1: stacktrace: Avoid duplicate saving of exception PC value
    - ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n
    - clk: zynqmp: Fix stack-out-of-bounds in strncpy`
    - media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
    - media: platform: fix some double free in meson-ge2d and mtk-jpeg and
      s5p-mfc
    - clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
    - RDMA/rxe: Delete error messages triggered by incoming Read requests
    - usb: host: xhci-plat: suspend and resume clocks
    - usb: host: xhci-plat: suspend/resume clks for brcm
    - scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID
    - dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent
      overflow
    - scsi: 3w-9xxx: Avoid disabling device if failing to enable it
    - nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
    - iommu/arm-smmu-v3: Make default domain type of HiSilicon PTT device to
      identity
    - usb: gadget: uvc: increase worker prio to WQ_HIGHPRI
    - power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
    - staging: vt6655: fix potential memory leak
    - blk-throttle: prevent overflow while calculating wait time
    - ata: libahci_platform: Sanity check the DT child nodes number
    - bcache: fix set_at_max_writeback_rate() for multiple attached devices
    - soundwire: cadence: Don't overwrite msg->buf during write commands
    - soundwire: intel: fix error handling on dai registration issues
    - hid: topre: Add driver fixing report descriptor
    - HID: roccat: Fix use-after-free in roccat_read()
    - HSI: ssi_protocol: fix potential resource leak in ssip_pn_open()
    - HID: nintendo: check analog user calibration for plausibility
    - md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
    - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
    - usb: musb: Fix musb_gadget.c rxstate overflow bug
    - usb: dwc3: core: add gfladj_refclk_lpm_sel quirk
    - [arm64] dts: imx8mp: Add snps,gfladj-refclk-lpm-sel quirk to USB nodes
    - usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after
      resume bug
    - Revert "usb: storage: Add quirk for Samsung Fit flash"
    - io_uring: fix CQE reordering
    - staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw()
    - staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
    - scsi: tracing: Fix compile error in trace_array calls when TRACING is
      disabled
    - ext2: Use kvmalloc() for group descriptor array
    - nvme: handle effects after freeing the request
    - nvme: copy firmware_rev on each init
    - nvmet-tcp: add bounds check on Transfer Tag
    - usb: idmouse: fix an uninit-value in idmouse_open
    - blk-mq: use quiesced elevator switch when reinitializing queues
    - hwmon (occ): Retry for checksum failure
    - fsi: occ: Prevent use after free
    - fsi: master-ast-cf: Fix missing of_node_put in fsi_master_acf_probe
    - dmaengine: dw-edma: Remove runtime PM support
    - usb: typec: ucsi: Don't warn on probe deferral
    - clk: bcm2835: Round UART input clock up
    - perf: Skip and warn on unknown format 'configN' attrs
    - perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
    - perf intel-pt: Fix system_wide dummy event for hybrid
    - io_uring/net: refactor io_sr_msg types
    - io_uring/net: use io_sr_msg for sendzc
    - io_uring/net: don't lose partial send_zc on fail
    - io_uring/net: rename io_sendzc()
    - io_uring/net: don't skip notifs for failed requests
    - io_uring/net: fix notif cqe reordering
    - mm: hugetlb: fix UAF in hugetlb_handle_userfault
    - net: ieee802154: return -EINVAL for unknown addr type
    - ALSA: usb-audio: Fix last interface check for registration
    - blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()
    - net: ethernet: ti: davinci_mdio: fix build for mdio bitbang uses
    - Revert "drm/amd/display: correct hostvm flag"
    - Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
    - net/ieee802154: don't warn zero-sized raw_sendmsg()
    - powerpc/64s/interrupt: Fix lost interrupts when returning to soft-masked
      context
    - drm/amd/display: Fix build breakage with CONFIG_DEBUG_FS=n
    - io_uring: fix fdinfo sqe offsets calculation
    - io_uring/rw: ensure kiocb_end_write() is always called
    - [arm64] dts: qcom: sc8280xp-pmics: Remove reg entry & use correct node
      name for pmc8280c_lpg node

  [ Zhang Ning ]
  * [arm64] disable CONFIG_ARM_CPUIDLE, it's arm only

  [ Salvatore Bonaccorso ]
  * Bump ABI to 2
  * [rt] Refresh "serial: 8250: implement write_atomic"

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 21 Oct 2022 21:05:40 +0200

linux (6.0.2-1) unstable; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.1
    - xsk: Inherit need_wakeup flag for shared sockets
    - fs: fix UAF/GPF bug in nilfs_mdt_destroy
    - fix coredump breakage
    - sparc: Unbreak the build
    - Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
    - hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
    - docs: update mediator information in CoC docs
    - hwmon: (aquacomputer_d5next) Fix Quadro fan speed offsets
    - usb: mon: make mmapped memory read only
    - USB: serial: ftdi_sio: fix 300 bps rate for SIO
    - gpiolib: acpi: Add support to ignore programming an interrupt
    - gpiolib: acpi: Add a quirk for Asus UM325UAZ
    - RISC-V: Print SSTC in canonical order
    - bpf: Gate dynptr API behind CAP_BPF
    - net: ethernet: mtk_eth_soc: fix state in __mtk_foe_entry_clear
    - bpf: Fix resetting logic for unreferenced kptrs
    - Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.2
    - nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
    - nilfs2: fix use-after-free bug of struct nilfs_root
    - nilfs2: fix leak of nilfs_root in case of writer thread creation failure
    - nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
    - nvme-pci: set min_align_mask before calculating max_hw_sectors
    - random: restore O_NONBLOCK support
    - random: clamp credited irq bits to maximum mixed
    - ALSA: hda: Fix position reporting on Poulsbo
    - ALSA: hda/realtek: Add quirk for HP Zbook Firefly 14 G9 model
    - efi: Correct Macmini DMI match in uefi cert quirk
    - scsi: qla2xxx: Revert "scsi: qla2xxx: Fix response queue handler reading stale packets"
    - scsi: qla2xxx: Fix response queue handler reading stale packets
    - scsi: stex: Properly zero out the passthrough command structure
    - USB: serial: qcserial: add new usb-id for Dell branded EM7455
    - Revert "USB: fixup for merge issue with "usb: dwc3: Don't switch OTG -> peripheral if extcon is present""
    - Revert "usb: dwc3: Don't switch OTG -> peripheral if extcon is present"
    - Revert "powerpc/rtas: Implement reentrant rtas call"
    - Revert "crypto: qat - reduce size of mapped region"
    - random: avoid reading two cache lines on irq randomness
    - random: use expired timer rather than wq for mixing fast pool
    - wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans()
      CVE-2022-41674
    - wifi: cfg80211/mac80211: reject bad MBSSID elements
    - wifi: mac80211: fix MBSSID parsing use-after-free
      CVE-2022-42719
    - wifi: cfg80211: ensure length byte is present before access
    - wifi: cfg80211: fix BSS refcounting bugs
      CVE-2022-42720
    - wifi: cfg80211: avoid nontransmitted BSS list corruption
      CVE-2022-42721
    - wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
    - wifi: mac80211: fix crash in beacon protection for P2P-device
      CVE-2022-42722
    - wifi: cfg80211: update hidden BSSes to avoid WARN_ON
    - mctp: prevent double key removal and unref
    - Input: xpad - add supported devices as contributed on github
    - Input: xpad - fix wireless 360 controller breaking after suspend
    - misc: pci_endpoint_test: Aggregate params checking for xfer
    - misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic

  [ Bastian Blank]
  * [cloud] Enable INTEGRITY.

 -- Bastian Blank <waldi@debian.org>  Sun, 16 Oct 2022 18:25:05 +0200

linux (6.0-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_6.0

  [ Salvatore Bonaccorso ]
  * drivers/hwmon: Enable SENSORS_SHT3x and SENSORS_SHT4x as module
    (Closes: #1016092)
  * [rt] Update to 6.0-rt11

  [ Diederik de Haas ]
  * [amd64] drivers/dma: Enable INTEL_IDXD as module and INTEL_IDXD_SVM as
    builtin (Closes: #1021337)

  [ Ben Hutchings ]
  * d/salsa-ci.yml: Use !reference to include scripts from common pipeline
  * d/salsa-ci.yml: Remove obsolete lintian error suppressions

  [ Christopher Obbard ]
  * [arm64] drivers/regulator: Enable MP8859 as module

  [ Mateusz Łukasik ]
  * Compile with gcc-12 on all architectures
  * d/salsa-ci.yml: Add linux-compiler-* packages to build-signed job artifacts

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 09 Oct 2022 17:11:55 +0200

linux (6.0~rc7-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Ben Hutchings ]
  * Rewrite "tools/perf: pmu-events: Fix reproducibility" for new Python
    generator
  * Build-depend on python3-setuptools for linux-perf
  * udeb: Move ledtrig-audio from sound-modules to kernel-image
  * d/bin/gencontrol_signed.py: Fix source package name in Built-Using field
  * [rt] Update to 6.0-rc5-rt7

  [ Didier Raboud ]
  * d/lib/python/debian_linux: Add two more known fields to
    {Source,Binary}Package

  [ Diederik de Haas ]
  * [arm64] drivers/gpu/drm/v3d: Enable DRM_V3D as module (Closes: #977441)
  * drivers/nfc/nxp-nci: Enable NFC_NXP_NCI and NFC_NXP_NCI_I2C and reenable
    NFC_NCI as module (Closes: #1020276)

  [ Frieder Schrempf ]
  * [arm64] Add nvmem-imx-ocotp driver to kernel-image udeb
  * [arm64] Add imx2_wdt driver to kernel-image udeb
  * udeb: Also add drivers in subdirectories of drivers/net/phy
  * [arm64] Add i2c-imx to i2c-modules udeb

  [ Bastian Blank ]
  * Make cross build of signed packages self contained.

  [ Zhang Ning ]
  * [armhf] enable multiple configs for rk3288
  * [config] enable CONFIG_RTL8723BS for all arch

  [ Zhang Boyang ]
  * [riscv64] Enable AMDGPU

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 27 Sep 2022 17:39:09 +0200

linux (5.19.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.7
    - [arm*] drm/vc4: hdmi: Rework power up
    - [arm*] drm/vc4: hdmi: Depends on CONFIG_PM
    - crypto: lib - remove unneeded selection of XOR_BLOCKS
    - docs: kerneldoc-preamble: Test xeCJK.sty before loading
    - [arm64] errata: Add Cortex-A510 to the repeat tlbi list
    - Bluetooth: L2CAP: Fix build errors in some archs
    - Revert "PCI/portdrv: Don't disable AER reporting in
      get_port_device_capability()"
    - HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
    - media: pvrusb2: fix memory leak in pvr_probe
    - USB: gadget: Fix use-after-free Read in usb_udc_uevent()
    - HID: hidraw: fix memory leak in hidraw_release()
    - net: fix refcount bug in sk_psock_get (2)
    - fbdev: fb_pm2fb: Avoid potential divide by zero error
    - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace
      is dead
    - bpf: Don't redirect packets with invalid pkt_len
    - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
    - ALSA: usb-audio: Add quirk for LH Labs Geek Out HD Audio 1V5
    - HID: input: fix uclogic tablets
    - HID: add Lenovo Yoga C630 battery quirk
    - [amd64] HID: AMD_SFH: Add a DMI quirk entry for Chromebooks
    - HID: Add Apple Touchbar on T2 Macs in hid_have_special_driver list
    - HID: asus: ROG NKey: Ignore portion of 0x5a report
    - HID: nintendo: fix rumble worker null pointer deref
    - HID: thrustmaster: Add sparco wheel and fix array length
    - [amd64] HID: intel-ish-hid: ipc: Add Meteor Lake PCI device ID
    - ASoC: rt5640: Fix the JD voltage dropping issue
    - rtla: Fix tracer name
    - drm/amd/display: Add a missing register field for HPO DP stream encoder
    - drm/amd/display: Device flash garbage before get in OS
    - drm/amd/display: Avoid MPC infinite loop
    - drm/amd/display: Fix HDMI VSIF V3 incorrect issue
    - drm/amd/display: For stereo keep "FLIP_ANY_FRAME"
    - drm/amd/display: clear optc underflow before turn off odm clock
    - drm/amd/display: Fix TDR eDP and USB4 display light up issue
    - drm/amd/pm: skip pptable override for smu_v13_0_7
    - drm/amd/pm: Fix a potential gpu_metrics_table memory leak
    - ksmbd: return STATUS_BAD_NETWORK_NAME error status if share is not
      configured
    - neigh: fix possible DoS due to net iface start/stop loop
    - ALSA: hda/realtek: Add quirks for ASUS Zenbooks using CS35L41
    - [s390x] hypfs: avoid error message under KVM
    - ksmbd: don't remove dos attribute xattr on O_TRUNC open
    - drm/amdgpu: disable 3DCGCG/CGLS temporarily due to stability issue
    - drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid
    - drm/amd/pm: add missing ->fini_xxxx interfaces for some SMU13 asics
    - drm/amd/display: Fix pixel clock programming
    - drm/amdgpu: Increase tlb flush timeout for sriov
    - drm/amd/display: Fix plug/unplug external monitor will hang while playback
      MPO video
    - drm/amd/display: avoid doing vm_init multiple time
    - drm/amdgpu: Add decode_iv_ts helper for ih_v6 block
    - drm/amdgpu: Add secure display TA load for Renoir
    - drm/amdgpu: Fix interrupt handling on ih_soft ring
    - netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
    - [x86] platform/x86: serial-multi-instantiate: Add CLSA0101 Laptop
    - ALSA: hda/cs8409: Support new Dolphin Variants
    - btrfs: move lockdep class helpers to locking.c
    - btrfs: fix lockdep splat with reloc root extent buffers
    - btrfs: tree-checker: check for overlapping extent items
    - [arm*] android: binder: fix lockdep check on clearing vma
    - net/af_packet: check len when min_header_len equals to 0
    - net: neigh: don't call kfree_skb() under spin_lock_irqsave()
    - [arm64] cacheinfo: Fix incorrect assignment of signed error value to
      unsigned fw_level
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.8
    - [arm64] drm/msm/dp: make eDP panel as the first connected connector
    - [arm64] drm/msm/dsi: fix the inconsistent indenting
    - [arm64] drm/msm/dpu: populate wb or intf before reset_intf_cfg
    - [arm64] drm/msm/dp: delete DP_RECOVERED_CLOCK_OUT_EN to fix tps4
    - [arm64] drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg
    - [arm64] drm/msm/dsi: Fix number of regulators for SDM660
    - [x86] platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask
    - [x86] platform/x86: x86-android-tablets: Fix broken touchscreen on Chuwi
      Hi8 with Windows BIOS
    - xsk: Fix corrupted packets for XDP_SHARED_UMEM
    - [arm64] drm/msm/gpu: Drop qos request if devm_devfreq_add_device() fails
    - iio: adc: mcp3911: make use of the sign bit
    - skmsg: Fix wrong last sg check in sk_msg_recvmsg()
    - bpf: Restrict bpf_sys_bpf to CAP_PERFMON
    - ip_tunnel: Respect tunnel key's "flow_flags" in IP tunnels
    - bpf, cgroup: Fix kernel BUG in purge_effective_progs
    - [x86] drm/i915/gvt: Fix Comet Lake
    - ieee802154/adf7242: defer destroy_workqueue call
    - bpf: Fix a data-race around bpf_jit_limit.
    - [x86] drm/i915/ttm: fix CCS handling
    - [x86] drm/i915/display: avoid warnings when registering dual panel
      backlight
    - ALSA: hda: intel-nhlt: Correct the handling of fmt_config flexible array
    - wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
    - xhci: Fix null pointer dereference in remove if xHC has only one roothub
    - Revert "xhci: turn off port power in shutdown"
    - bpf: Allow helpers to accept pointers with a fixed size
    - bpf: Tidy up verifier check_func_arg()
    - bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO
    - Bluetooth: hci_event: Fix vendor (unknown) opcode status handling
    - Bluetooth: hci_sync: Fix suspend performance regression
    - Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt
    - Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn
    - [arm64,armhf] net: smsc911x: Stop and start PHY during suspend and resume
    - openvswitch: fix memory leak at failed datapath creation
    - nfp: flower: fix ingress police using matchall filter
    - [x86] drm/i915: fix null pointer dereference
    - net: sched: tbf: don't call qdisc_put() while holding tree lock
    - net/sched: fix netdevice reference leaks in attach_default_qdiscs()
    - net: phy: micrel: Make the GPIO to be non-exclusive
    - sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb
    - tcp: annotate data-race around challenge_timestamp
    - Revert "sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb"
    - net/smc: Remove redundant refcount increase
    - soundwire: qcom: fix device status array range
    - mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding
      slab_mutex/cpu_hotplug_lock
    - [arm64] serial: fsl_lpuart: RS485 RTS polariy is inverse
    - staging: rtl8712: fix use after free bugs
    - staging: r8188eu: Add Rosewill USB-N150 Nano to device tables
    - staging: r8188eu: add firmware dependency
    - [powerpc*] rtas: Fix RTAS MSR[HV] handling for Cell
    - vt: Clear selection before changing the font
    - [arm64] tty: serial: lpuart: disable flow control while waiting for the
      transmit engine to complete
    - Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag
    - iio: ad7292: Prevent regulator double disable
    - iio: adc: mcp3911: correct "microchip,device-addr" property
    - iio: adc: mcp3911: use correct formula for AD conversion
    - firmware_loader: Fix use-after-free during unregister
    - firmware_loader: Fix memory leak in firmware upload
    - USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id
    - landlock: Fix file reparenting without explicit LANDLOCK_ACCESS_FS_REFER
    - mmc: core: Fix UHS-I SD 1.8V workaround branch
    - mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch
      failure
    - [arm*] binder: fix UAF of ref->proc caused by race condition
    - [arm*] binder: fix alloc->vma_vm_mm null-ptr dereference
    - cifs: fix small mempool leak in SMB2_negotiate()
    - [x86] KVM: VMX: Heed the 'msr' argument in msr_write_intercepted()
    - [armhf] clk: ti: Fix missing of_node_get() ti_find_clock_provider()
    - [x86] drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported"
    - clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops
    - Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops"
    - clk: core: Fix runtime PM sequence in clk_core_unprepare()
    - [arm64,armhf] Input: rk805-pwrkey - fix module autoloading
    - [arm*] clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate
    - [arm*] clk: bcm: rpi: Prevent out-of-bounds access
    - [arm*] clk: bcm: rpi: Add missing newline
    - [arm*] hwmon: (gpio-fan) Fix array out of bounds access
    - [arm64,armhf] gpio: pca953x: Add mutex_lock for regcache sync in PM
    - [x86] KVM: x86: Mask off unsupported and unknown bits of
      IA32_ARCH_CAPABILITIES
    - xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()
    - mm: pagewalk: Fix race between unmap and page walker
    - xen-blkback: Advertise feature-persistent as user requested
    - xen-blkfront: Advertise feature-persistent as user requested
    - xen-blkfront: Cache feature_persistent value before advertisement
    - [x86] thunderbolt: Use the actual buffer in tb_async_error()
    - [x86] thunderbolt: Check router generation before connecting xHCI
    - [arm64] usb: dwc3: pci: Add support for Intel Raptor Lake
    - media: mceusb: Use new usb_control_msg_*() routines
    - xhci: Add grace period after xHC start to prevent premature runtime
      suspend.
    - [arm64,armhf] usb: dwc3: disable USB core PHY management
    - [arm64,armhf] usb: dwc3: gadget: Avoid duplicate requests to enable
      Run/Stop
    - [arm64,armhf] usb: dwc3: fix PHY disable sequence
    - USB: serial: ch341: fix lost character on LCR updates
    - USB: serial: ch341: fix disabled rx timer on older devices
    - USB: serial: cp210x: add Decagon UCA device id
    - USB: serial: option: add support for OPPO R11 diag port
    - USB: serial: option: add Quectel EM060K modem
    - USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode
    - Revert "usb: typec: ucsi: add a common function
      ucsi_unregister_connectors()"
    - usb: typec: altmodes/displayport: correct pin assignment for UFP
      receptacles
    - usb: typec: tcpm: Return ENOTSUPP for power supply prop writes
    - [arm*] usb: dwc2: fix wrong order of phy_power_on and phy_init
    - USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020)
    - usb-storage: Add ignore-residue quirk for NXP PN7462AU
    - [s390x] hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages
    - [s390x] fix nospec table alignments
    - USB: core: Prevent nested device-reset calls
    - usb: gadget: f_uac2: fix superspeed transfer
    - usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
    - USB: gadget: Fix obscure lockdep violation for udc_mutex
    - dma-buf/dma-resv: check if the new fence is really later
    - driver core: Don't probe devices after bus_type.match() probe deferral
    - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
    - wifi: mac80211: Fix UAF in ieee80211_scan_rx()
    - ip: fix triggering of 'icmp redirect'
    - net: Use u64_stats_fetch_begin_irq() for stats fetch.
    - net: mac802154: Fix a condition in the receive path
    - ALSA: memalloc: Revive x86-specific WC page allocations again
    - ALSA: hda/realtek: Add speaker AMP init for Samsung laptops with ALC298
    - ALSA: seq: oss: Fix data-race for max_midi_devs access
    - ALSA: seq: Fix data-race at module auto-loading
    - [x86] drm/i915/backlight: Disable pps power hook for aux based backlight
    - [x86] drm/i915/guc: clear stalled request after a reset
    - [x86] drm/i915/glk: ECS Liva Q2 needs GLK HDMI port timing quirk
    - [x86] drm/i915: Skip wm/ddb readout for disabled pipes
    - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()
    - tty: n_gsm: initialize more members at gsm_alloc_mux()
    - tty: n_gsm: replace kicktimer with delayed_work
    - tty: n_gsm: avoid call of sleeping functions from atomic context
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.9
    - efi: libstub: Disable struct randomization
    - efi: capsule-loader: Fix use-after-free in efi_capsule_write
      (CVE-2022-40307)
    - wifi: mt76: mt7921e: fix crash in chip reset fail
    - wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in
      il4965_rs_fill_link_cmd()
    - fs: only do a memory barrier for the first set_buffer_uptodate()
    - scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX
    - scsi: core: Allow the ALUA transitioning state enough time
    - scsi: megaraid_sas: Fix double kfree()
    - drm/gem: Fix GEM handle release errors
    - drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to
      psp_hw_fini
    - drm/amdgpu: fix hive reference leak when adding xgmi device
    - drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup.
    - drm/amdgpu: Remove the additional kfd pre reset call for sriov
    - drm/radeon: add a force flush to delay work when radeon
    - scsi: ufs: core: Reduce the power mode change timeout
    - [hppa/parisc64] Revert "parisc: Show error if wrong 32/64-bit compiler is
      being used"
    - [hppa/parisc64] parisc: ccio-dma: Handle kmalloc failure in
      ccio_init_resources()
    - [hppa/parisc64] parisc: Add runtime check to prevent PA2.0 kernels on
      PA1.x machines
    - [arm64] errata: add detection for AMEVCNTR01 incrementing incorrectly
    - netfilter: conntrack: work around exceeded receive window
    - [amd64] thermal/int340x_thermal: handle data_vault when the value is
      ZERO_SIZE_PTR
    - cpufreq: check only freq_table in __resolve_freq()
    - net/core/skbuff: Check the return value of skb_copy_bits()
    - md: Flush workqueue md_rdev_misc_wq in md_alloc()
    - fbdev: fbcon: Destroy mutex on freeing struct fb_info
    - drm/amdgpu: add sdma instance check for gfx11 CGCG
    - drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly
    - ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
    - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
    - ALSA: hda: Once again fix regression of page allocations with IOMMU
    - ALSA: aloop: Fix random zeros in capture data when using jiffies timer
    - ALSA: usb-audio: Split endpoint setups for hw_params and prepare
    - ALSA: usb-audio: Clear fixed clock rate at closing EP
    - ALSA: usb-audio: Fix an out-of-bounds bug in
      __snd_usb_parse_audio_interface()
    - tracefs: Only clobber mode/uid/gid on remount if asked
    - tracing: hold caller_addr to hardirq_{enable,disable}_ip
    - tracing: Fix to check event_mutex is held while accessing trigger list
    - btrfs: zoned: set pseudo max append zone limit in zone emulation mode
    - btrfs: zoned: fix API misuse of zone finish waiting
    - vfio/type1: Unpin zero pages
    - kprobes: Prohibit probes in gate area
    - debugfs: add debugfs_lookup_and_remove()
    - drm/amd/display: fix memory leak when using debugfs_lookup()
    - driver core: fix driver_set_override() issue with empty strings
    - nvmet: fix a use-after-free
    - [x86] drm/i915/bios: Copy the whole MIPI sequence block
    - [x86] drm/i915/slpc: Let's fix the PCODE min freq table setup for SLPC
    - [x86] drm/i915: Implement WaEdpLinkRateDataReload
    - scsi: mpt3sas: Fix use-after-free warning
    - scsi: lpfc: Add missing destroy_workqueue() in error path
    - cgroup: Elide write-locking threadgroup_rwsem when updating csses on an
      empty subtree
    - cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
    - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl()
    - smb3: missing inode locks in zero range
    - [arm64] Revert "soc: imx: imx8m-blk-ctrl: set power device name"
    - regmap: spi: Reserve space for register address/padding
    - [arm64] dts: imx8mp-venice-gw74xx: fix sai2 pin settings
    - [arm64] dts: ls1028a-qds-65bb: don't use in-band autoneg for 2500base-x
    - [arm64] soc: imx: gpcv2: Assert reset before ungating clock
    - [arm64] dts: imx8mm-venice-gw7901: fix port/phy validation
    - regulator: core: Clean up on enable failure
    - [arm64] tee: fix compiler warning in tee_shm_register()
    - RDMA/irdma: Fix drain SQ hang with no completion
    - RDMA/cma: Fix arguments order in net device validation
    - [arm64] RDMA/hns: Fix supported page size
    - [arm64] RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift
    - [arm64] RDMA/hns: Remove the num_qpc_timer variable
    - netfilter: br_netfilter: Drop dst references before setting.
    - netfilter: nf_tables: clean up hook list when offload flags check fails
    - netfilter: nf_conntrack_irc: Fix forged IP logic (CVE-2022-2663)
    - RDMA/srp: Set scmnd->result only when scmnd is not NULL
    - ALSA: usb-audio: Inform the delayed registration more properly
    - ALSA: usb-audio: Register card again for iface over delayed_register
      option
    - rxrpc: Fix ICMP/ICMP6 error handling
    - rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2()
    - afs: Use the operation issue time instead of the reply time for callbacks
    - [arm64] Revert "net: phy: meson-gxl: improve link-up behavior"
    - sch_sfb: Don't assume the skb is still around after enqueueing to child
    - tipc: fix shift wrapping bug in map_get()
    - net: introduce __skb_fill_page_desc_noacc
    - tcp: TX zerocopy should not sense pfmemalloc status
    - ice: Fix DMA mappings leak
    - ice: use bitmap_free instead of devm_kfree
    - i40e: Fix kernel crash during module removal
    - iavf: Detach device during reset task
    - xen-netback: only remove 'hotplug-status' when the vif is actually
      destroyed
    - block: don't add partitions if GD_SUPPRESS_PART_SCAN is set
    - bonding: use unspecified address if no available link local address
    - bonding: add all node mcast address when slave up
    - ipv6: sr: fix out-of-bounds read when setting HMAC data.
    - IB/core: Fix a nested dead lock as part of ODP flow
    - RDMA/mlx5: Set local port to one when accessing counters
    - btrfs: zoned: fix mounting with conventional zones
    - erofs: fix error return code in erofs_fscache_{meta_,}read_folio
    - erofs: fix pcluster use-after-free on UP platforms
    - nvme-tcp: fix UAF when detecting digest errors
    - nvme-tcp: fix regression that causes sporadic requests to time out
    - tcp: fix early ETIMEDOUT after spurious non-SACK RTO
    - btrfs: fix the max chunk size and stripe length calculation
    - nvmet: fix mar and mor off-by-one errors
    - RDMA/irdma: Report the correct max cqes from query device
    - RDMA/irdma: Return error on MR deregister CQP failure
    - RDMA/irdma: Return correct WC error for bind operation failure
    - RDMA/irdma: Report RNR NAK generation in device caps
    - [arm64] net: dsa: felix: disable cut-through forwarding for frames
      oversized for tc-taprio
    - [arm64] net: dsa: felix: access QSYS_TAG_CONFIG under tas_lock in
      vsc9959_sched_speed_set
    - net/smc: Fix possible access to freed memory in link clear
    - io_uring: recycle kbuf recycle on tw requeue
    - net: phy: lan87xx: change interrupt src of link_up to comm_ready
    - sch_sfb: Also store skb len before calling child enqueue
    - lsm,io_uring: add LSM hooks for the new uring_cmd file op
    - selinux: implement the security_uring_cmd() LSM hook
    - i40e: Refactor tc mqprio checks
    - i40e: Fix ADQ rate limiting for PF
    - net: bonding: replace dev_trans_start() with the jiffies of the last
      ARP/NS
    - bonding: accept unsolicited NA message
    - swiotlb: avoid potential left shift overflow
    - [amd64] iommu/amd: use full 64-bit value in build_completion_wait()
    - [s390x] boot: fix absolute zero lowcore corruption on boot
    - time64.h: consolidate uses of PSEC_PER_NSEC
    - [arm64] net: dsa: felix: tc-taprio intervals smaller than MTU should send
      at least one packet
    - [amd64] iommu/vt-d: Fix possible recursive locking in intel_iommu_init()
    - [arm64] Revert "arm64: kasan: Revert "arm64: mte: reset the page tag in
      page->flags""
    - [x86] hwmon: (asus-ec-sensors) add support for Strix Z690-a D4
    - [x86] hwmon: (asus-ec-sensors) add support for Maximus XI Hero
    - [x86] hwmon: (asus-ec-sensors) add missing sensors for X570-I GAMING
    - [x86] hwmon: (asus-ec-sensors) add definitions for ROG ZENITH II EXTREME
    - [x86] hwmon: (asus-ec-sensors) autoload module via DMI data
    - [arm64] bti: Disable in kernel BTI when cross section thunks are broken
    - [amd64] iommu/vt-d: Correctly calculate sagaw value of IOMMU
    - iommu: Fix false ownership failure on AMD systems with PASID activated
    - drm/amd/display: Add SMU logging code
    - drm/amd/display: Removing assert statements for Linux
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.10
    - [amd64] iommu/vt-d: Fix kdump kernels boot failure with scalable mode
    - net/mlx5: Introduce ifc bits for using software vhca id
    - net/mlx5: Use software VHCA id when it's supported
    - RDMA/mlx5: Rely on RoCE fw cap instead of devlink when setting profile
    - RDMA/mlx5: Add a umr recovery flow
    - RDMA/mlx5: Fix UMR cleanup on error flow of driver init
    - [amd64] ACPI: resource: skip IRQ override on AMD Zen platforms
    - Input: goodix - add support for GT1158
    - [x86] platform/surface: aggregator_registry: Add support for Surface
      Laptop Go 2
    - [arm64] drm/msm/rd: Fix FIFO-full deadlock
    - peci: cpu: Fix use-after-free in adev_release()
    - [x86] kvm: x86: mmu: Always flush TLBs when enabling dirty logging
    - [amd64] hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered
      message
    - Bluetooth: MGMT: Fix Get Device Flags
    - tg3: Disable tg3 device on system reboot to avoid triggering AER
    - r8152: add PID for the Lenovo OneLink+ Dock
    - ieee802154: cc2520: add rc code in cc2520_tx()
    - Input: iforce - add support for Boeder Force Feedback Wheel
    - drm/amdgpu: disable FRU access on special SIENNA CICHLID card
    - drm/amd/pm: use vbios carried pptable for all SMU13.0.7 SKUs
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM610
    - nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change()
    - drm/amd/amdgpu: skip ucode loading if ucode_size == 0
    - [x86] platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot
      keymap fixes
    - [x86] platform/x86: asus-wmi: Increase FAN_CURVE_BUF_LEN to 32
    - RDMA/irdma: Use s/g array in post send only when its valid
    - Input: goodix - add compatible string for GT1158
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.11
    - of: fdt: fix off-by-one error in unflatten_dt_nodes()
    - [arm64,armhf] pinctrl: rockchip: Enhance support for IRQ_TYPE_EDGE_BOTH
    - [arm64] pinctrl: sunxi: Fix name for A100 R_PIO
    - SUNRPC: Fix call completion races with call_decode()
    - NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0
    - [arm64] gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in
      mpc85xx
    - NFSv4.2: Update mode bits after ALLOCATE and DEALLOCATE
    - Revert "SUNRPC: Remove unreachable error condition"
    - [arm64,armhf] drm/panel-edp: Fix delays for Innolux N116BCA-EA1
    - [arm64] drm/meson: Correct OSD1 global alpha value
    - [arm64] drm/meson: Fix OSD1 RGB to YCbCr coefficient
    - [x86] drm/i915/vdsc: Set VDSC PIC_HEIGHT before using for DP DSC
    - [x86] drm/i915/guc: Don't update engine busyness stats too frequently
    - [x86] drm/i915/guc: Cancel GuC engine busyness worker synchronously
    - block: blk_queue_enter() / __bio_queue_enter() must return -EAGAIN for
      nowait
    - [hppa/parisc] ccio-dma: Add missing iounmap in error path in ccio_probe()
    - of/device: Fix up of_dma_configure_id() stub
    - io_uring/msg_ring: check file type before putting
    - cifs: revalidate mapping when doing direct writes
    - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM
    - cifs: always initialize struct msghdr smb_msg completely
    - blk-lib: fix blkdev_issue_secure_erase
    - [hppa] parisc: Allow CONFIG_64BIT with ARCH=parisc
    - tools/include/uapi: Fix <asm/errno.h> for parisc and xtensa
    - [x86] drm/i915/gt: Fix perf limit reasons bit positions
    - [x86] drm/i915: Set correct domains values at _i915_vma_move_to_active
    - drm/amdgpu: make sure to init common IP before gmc
    - drm/amdgpu: Don't enable LTR if not supported
    - drm/amdgpu: move nbio ih_doorbell_range() into ih code for vega
    - drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega
    - net: Find dst with sk's xfrm policy not ctl_sk
    - dt-bindings: apple,aic: Fix required item "apple,fiq-index" in affinity
      description
    - cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
    - ALSA: hda/sigmatel: Keep power up while beep is enabled
    - ALSA: hda/sigmatel: Fix unused variable warning for beep power change
    - [amd64] Revert "iommu/vt-d: Fix possible recursive locking in
      intel_iommu_init()"

  [ Vincent Blut ]
  * [armhf] sound/soc/rockchip: Enable SND_SOC_RK3288_HDMI_ANALOG as module
    (Closes: #1019143)

  [ Salvatore Bonaccorso ]
  * [x86] drivers/edac: Enable EDAC_I10NM as module (Closes: #1019248)
  * d/b/check-patches.sh: Use grep -(E|F) instead of deprecated (e|f)grep
  * d/templates/image.bug/include-model: Use grep -E instead of deprecated egrep
  * Bump ABI to 2
  * Refresh "Export symbols needed by Android drivers"
  * Revert "[hppa/parisc64] Drop explicit setting of 64BIT"

  [ Ben Hutchings ]
  * debian/bin/genpatch-rt: Change argument parsing to use argparse
  * debian/bin/genpatch-rt: Add option to disable signature verification
  * linux-headers: Skip exact compiler version comparison (Closes: #1019749)

  [ Aurelien Jarno ]
  * [arm64] Add support for misalignment fixups for multiword loads from next
    branch. Enable COMPAT_ALIGNMENT_FIXUPS.

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 24 Sep 2022 13:05:59 +0200

linux (5.19.6-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.2
    - Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" (Closes: #1017894)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.3
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.4
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.5
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.6
    - mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
      (CVE-2022-2590)
    - af_key: Do not call xfrm_probe_algs in parallel (CVE-2022-3028)
    - [x86] nospec: Unwreck the RSB stuffing
    - [x86] nospec: Fix i386 RSB stuffing (Closes: #1017425)
    - bpf: Don't use tnum_range on array range checking for poke descriptors
      (CVE-2022-2905)

  [ Ben Hutchings ]
  * d/tests/kbuild: Fix default-flavour lookup for arches with no featuresets
  * d/tests/kbuild: Make flavour lookup verbose
  * d/lib/python/debian_linux, d/templates: Use variable for binary package
    name
  * lintian: Update overrides in linux-image-*-dbg for lintian 2.115
  * d/{signing_templates/,}rules.real: Run dh_lintian for all packages
  * [hppa,mips,mipsel,powerpc] lintian: Override error for 64-bit kernels
  * [mips64el,mipsel,ppc64el] lintian: Override error for unstripped vmlinux
  * [arm64] lintian: Override errors for vdso32.so in linux-image-*-dbg
  * android: Remove CONFIG_ANDROID:
    - Drop "wireguard: Clear keys after suspend despite CONFIG_ANDROID=y"
    - pm/sleep: Add PM_USERSPACE_AUTOSLEEP Kconfig
    - remove CONFIG_ANDROID
    - Enable/disable ANDROID_BINDER_IPC to match previous configuration

  [ Vincent Blut ]
  * [x86] drivers/hwmon: Enable SENSORS_ASUS_WMI and SENSORS_ASUS_EC as
    modules
  * [x86] drivers/platform/x86: Enable NVIDIA_WMI_EC_BACKLIGHT as module
    (Closes: #1017972)
  * [arm64] drivers/spi: Enable SPI_GPIO and SPI_SUN6I as modules
    (Closes: #1016807)

  [ Diederik de Haas ]
  * [arm64] drivers/gpu/drm/rockchip: Explicitly enable ROCKCHIP_VOP

  [ Helge Deller ]
  * [hppa] Drop CONFIG_PATA_LEGACY for hppa architecture

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "rcutorture: Also force sched priority to timersd on boosting
    test."
  * Drop setting of CRYPTO_BLAKE2S
    crypto: blake2s shash module was removed upstream.
  * [arm] arch/arm/crypto: Enable CRYPTO_BLAKE2S_ARM
  * certs: Rotate to use the "Debian Secure Boot Signer 2022 - linux"
    certificate (Closes: #1018752)
  * Set ABI to 1
  * [hppa/parisc64] Drop explicit setting of 64BIT

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 01 Sep 2022 09:04:35 +0200

linux (5.19-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.19
    - [i386] x86/asm/32: Fix ANNOTATE_UNRET_SAFE use on 32-bit (fixes FTBFS)

  [ Ben Hutchings ]
  * [riscv64] Disable COMPAT (fixes FTBFS)
  * linux-kbuild: Add check-local-export script (Closes: #1014633)
  * [x86,arm64,armhf] Add rtla package for Real-Time Linux Analysis tools

  [ Uwe Kleine-König ]
  * Enable IOSM modem driver as a module.

  [ Diederik de Haas ]
  * [arm64] drivers/crypto: Enable CRYPTO_DEV_ROCKCHIP as module

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.19-rc8-rt9

  [ Vincent Blut ]
  * [amd64] crypto: Enable CRYPTO_NHPOLY1305_SSE2 and CRYPTO_NHPOLY1305_AVX2
    as modules (Closes: #1013870)

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 02 Aug 2022 16:04:51 +0200

linux (5.19~rc6-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Ben Hutchings ]
  * [mips64el/mips64r2el] Fix package description
  * [x86] Add mitigations for RETbleed on AMD/Hygon (CVE-2022-29900) and
    Intel (CVE-2022-29901) processors:
    - x86/kvm/vmx: Make noinstr clean
    - x86/cpufeatures: Move RETPOLINE flags to word 11
    - x86/retpoline: Cleanup some #ifdefery
    - x86/retpoline: Swizzle retpoline thunk
    - x86/retpoline: Use -mfunction-return
    - x86: Undo return-thunk damage
    - x86,objtool: Create .return_sites
    - x86,static_call: Use alternative RET encoding
    - x86/ftrace: Use alternative RET encoding
    - x86/bpf: Use alternative RET encoding
    - x86/kvm: Fix SETcc emulation for return thunks
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation
    - x86/sev: Avoid using __x86_return_thunk
    - x86: Use return-thunk in asm code
    - x86/entry: Avoid very early RET
    - objtool: Treat .text.__x86.* as noinstr
    - x86: Add magic AMD return-thunk
    - x86/bugs: Report AMD retbleed vulnerability
    - x86/bugs: Add AMD retbleed= boot parameter
    - x86/bugs: Enable STIBP for JMP2RET
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value
    - x86/entry: Add kernel IBRS implementation
    - x86/bugs: Optimize SPEC_CTRL MSR writes
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS
    - x86/bugs: Split spectre_v2_select_mitigation() and
      spectre_v2_user_select_mitigation()
    - x86/bugs: Report Intel retbleed vulnerability
    - intel_idle: Disable IBRS during long idle
    - objtool: Update Retpoline validation
    - x86/xen: Rename SYS* entry points
    - x86/xen: Add UNTRAIN_RET
    - x86/bugs: Add retbleed=ibpb
    - x86/bugs: Do IBPB fallback check only once
    - objtool: Add entry UNRET validation
    - x86/cpu/amd: Add Spectral Chicken
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n
    - x86/speculation: Fix firmware entry SPEC_CTRL handling
    - x86/speculation: Fix SPEC_CTRL write on SMT state change
    - x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit
    - x86/speculation: Remove x86_spec_ctrl_mask
    - objtool: Re-add UNWIND_HINT_{SAVE_RESTORE}
    - KVM: VMX: Flatten __vmx_vcpu_run()
    - KVM: VMX: Convert launched argument to flags
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
    - KVM: VMX: Fix IBRS handling after vmexit
    - x86/speculation: Fill RSB on vmexit for IBRS
    - KVM: VMX: Prevent RSB underflow before vmenter
    - x86/common: Stamp out the stepping madness
    - x86/cpu/amd: Enumerate BTC_NO
    - x86/retbleed: Add fine grained Kconfig knobs
    - x86/bugs: Add Cannon lake to RETBleed affected CPU list
    - x86/entry: Move PUSH_AND_CLEAR_REGS() back into error_entry
    - x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
    - x86/kexec: Disable RET on kexec
    - x86/speculation: Disable RRSBA behavior
    - x86/static_call: Serialize __static_call_fixup() properly
  * [amd64] Enable SLS mitigation

 -- Ben Hutchings <benh@debian.org>  Wed, 13 Jul 2022 01:20:17 +0200

linux (5.19~rc4-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Johannes Schauer Marin Rodrigues ]
  * [arm64] Add pwm-imx27, nwl-dsi, ti-sn65dsi86, imx-dcss, mxsfb, mux-mmio
    and imx8mq-interconnect to fb-modules udeb for the MNT Reform 2.

  [ Julien Massot ]
  * [arm64] Enable Qualcomm SDA845 SoC:
    - Enable QCOM_CLK_RPMH, SDM_GCC_845, QCOM_HFPLL, INTERCONNECT_QCOM,
      INTERCONNECT_QCOM_SDM845, QCOM_PDC, PINCTRL_MSM, PINCTRL_SDM845,
      RESET_QCOM_AOSS, QCOM_AOSS_QMP, QCOM_COMMAND_DB, QCOM_GENI_SE,
      QCOM_RPMH, QCOM_RPMHPD, QCOM_RPMPD, SERIAL_QCOM_GENI,
      SERIAL_QCOM_GENI_CONSOLE as built-in
    - Enable SDM_CAMCC_845, SDM_GPUCC_845, SDM_VIDEOCC_845, SDM_DISPCC_845,
      ARM_QCOM_CPUFREQ_HW, REGULATOR_QCOM_RPMH, SCSI_UFSHCD_PLATFORM,
      SCSI_UFS_QCOM as modules

  [ Diederik de Haas ]
  * [armel/rpi] drivers/char/hw_random: Enable HW_RANDOM_BCM2835 as module
  * [armel/rpi] drivers/rtc: Enable RTC_DRV_DS1307 as module (Closes: #958904)

  [ Zhang Ning ]
  * [arm64] enable gpio polled keyboard which is needed for Khadas SBCs
  * [arm64] media: enable Amlogic CEC, GE2D, vdec, and Rockchip RGA, ISP1
  * [arm64] phy: enable Rk3399 Mipi phy which is needed by RK3399 ISP1
  * [arm64] enable GPIO ir receirer which is needed by Khadas edge SBC
  * [arm64] enable HYM8563 RTC driver which is needed by Khadas SBCs

  [ Ben Hutchings ]
  * Refresh our patches for 5.19
  * [rt] Update to 5.19-rc3-rt5
  * Update config for 5.19
  * virtio: disable notification hardening by default (regression in 5.19-rc1)
  * [rt] printk: Reinstate deferred printing with kthreads
  * d/bin: Use subprocess text mode support instead of decoding separately
  * d/bin, d/lib/python: Use open() with encoding instead of codecs.open()
  * d/lib/python/debian_linux: Introduce {Source,Binary}Package classes
  * d/lib/python/debian_linux: Add all used fields to {Source,Binary}Package
  * d/lib/python/debian_linux: Warn about unknown fields in control files
  * firmware_loader: Enable FW_LOADER_COMPRESS, FW_LOADER_COMPRESS_XZ

 -- Ben Hutchings <benh@debian.org>  Fri, 01 Jul 2022 18:01:46 +0200

linux (5.18.16-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.15
    - [arm64] pinctrl: armada-37xx: use raw spinlocks for regmap to avoid
      invalid wait context
    - [armhf] pinctrl: stm32: fix optional IRQ support to gpios
    - [riscv64] add as-options for modules with assembly compontents
    - lockdown: Fix kexec lockdown bypass with ima policy (CVE-2022-21505)
    - [armhf] mmc: sdhci-omap: Fix a lockdep warning for PM runtime init
    - [armhf] mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on
      program/erase times
    - drm/ttm: fix locking in vmap/vunmap TTM GEM helpers
    - drm/amd/display: Fix new dmub notification enabling in DM
    - drm/scheduler: Don't kill jobs in interrupt context
    - net: usb: ax88179_178a needs FLAG_SEND_ZLP
    - PCI: hv: Fix multi-MSI to allow more than one MSI vector
    - PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI
    - PCI: hv: Reuse existing IRTE allocation in compose_msi_msg()
    - PCI: hv: Fix interrupt mapping for multi-MSI
    - r8152: fix a WOL issue
    - ip: Fix data-races around sysctl_ip_default_ttl.
    - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in
      xfrm_bundle_lookup() (CVE-2022-36879)
    - RDMA/irdma: Do not advertise 1GB page size for x722
    - RDMA/irdma: Fix sleep from invalid context BUG
    - perf/core: Fix data race between perf_event_set_output() and
      perf_mmap_close()
    - e1000e: Enable GPT clock before sending message to CSME
    - Revert "e1000e: Fix possible HW unit hang after an s0ix exit"
    - igc: Reinstate IGC_REMOVED logic and implement it properly
    - ip: Fix data-races around sysctl_ip_no_pmtu_disc.
    - ip: Fix data-races around sysctl_ip_fwd_use_pmtu.
    - ip: Fix data-races around sysctl_ip_fwd_update_priority.
    - ip: Fix data-races around sysctl_ip_nonlocal_bind.
    - ip: Fix a data-race around sysctl_ip_autobind_reuse.
    - ip: Fix a data-race around sysctl_fwmark_reflect.
    - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
    - tcp: sk->sk_bound_dev_if once in inet_request_bound_dev_if()
    - tcp: Fix data-races around sysctl_tcp_l3mdev_accept.
    - tcp: Fix data-races around sysctl_tcp_mtu_probing.
    - tcp: Fix data-races around sysctl_tcp_base_mss.
    - tcp: Fix data-races around sysctl_tcp_min_snd_mss.
    - tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor.
    - tcp: Fix a data-race around sysctl_tcp_probe_threshold.
    - tcp: Fix a data-race around sysctl_tcp_probe_interval.
    - net: stmmac: fix pm runtime issue in stmmac_dvr_remove()
    - net: stmmac: fix unbalanced ptp clock issue in suspend/resume flow
    - tcp/udp: Make early_demux back namespacified.
    - net: stmmac: fix dma queue left shift overflow issue
    - net/tls: Fix race in TLS device down flow
    - igmp: Fix data-races around sysctl_igmp_llm_reports.
    - igmp: Fix a data-race around sysctl_igmp_max_memberships.
    - igmp: Fix data-races around sysctl_igmp_max_msf.
    - igmp: Fix data-races around sysctl_igmp_qrv.
    - tcp: Fix data-races around keepalive sysctl knobs.
    - tcp: Fix data-races around sysctl_tcp_syn(ack)?_retries.
    - tcp: Fix data-races around sysctl_tcp_syncookies.
    - tcp: Fix data-races around sysctl_tcp_migrate_req.
    - tcp: Fix data-races around sysctl_tcp_reordering.
    - tcp: Fix data-races around some timeout sysctl knobs.
    - tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
    - tcp: Fix a data-race around sysctl_tcp_tw_reuse.
    - tcp: Fix data-races around sysctl_max_syn_backlog.
    - tcp: Fix data-races around sysctl_tcp_fastopen.
    - tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout.
    - iavf: Fix VLAN_V2 addition/rejection
    - iavf: Disallow changing rx/tx-frames and rx/tx-frames-irq
    - iavf: Fix handling of dummy receive descriptors
    - iavf: Fix missing state logs
    - ACPI: CPPC: Don't require flexible address space if X86_FEATURE_CPPC is
      supported
    - [arm64] pinctrl: armada-37xx: Reuse GPIO fwnode in
      armada_37xx_irqchip_register()
    - [arm64] pinctrl: armada-37xx: make irq_lock a raw spinlock to avoid
      invalid wait context
    - i40e: Fix erroneous adapter reinitialization during recovery process
    - ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero
    - [arm64,armhf] net: dsa: fix dsa_port_vlan_filtering when global
    - [arm64,armhf] net: dsa: move reset of VLAN filtering to
      dsa_port_switchdev_unsync_attrs
    - [arm64,armhf] net: dsa: fix NULL pointer dereference in
      dsa_port_reset_vlan_filtering
    - net: stmmac: remove redunctant disable xPCS EEE call
    - [arm64,armhf] gpio: pca953x: only use single read/write for No AI mode
    - [arm64,armhf] gpio: pca953x: use the correct range when do regmap sync
    - [arm64,armhf] gpio: pca953x: use the correct register address when
      regcache sync during init
    - be2net: Fix buffer overflow in be_get_module_eeprom
    - [arm64,armhf] drm/panel-edp: Fix variable typo when saving hpd absent
      delay from DT
    - [arm64] drm/imx/dcss: Add missing of_node_put() in fail path
    - ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.
    - ipv4: Fix data-races around sysctl_fib_multipath_hash_policy.
    - ipv4: Fix data-races around sysctl_fib_multipath_hash_fields.
    - ip: Fix data-races around sysctl_ip_prot_sock.
    - udp: Fix a data-race around sysctl_udp_l3mdev_accept.
    - tcp: Fix data-races around sysctl knobs related to SYN option.
    - tcp: Fix a data-race around sysctl_tcp_early_retrans.
    - tcp: Fix data-races around sysctl_tcp_recovery.
    - tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.
    - tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.
    - tcp: Fix a data-race around sysctl_tcp_retrans_collapse.
    - tcp: Fix a data-race around sysctl_tcp_stdurg.
    - tcp: Fix a data-race around sysctl_tcp_rfc1337.
    - tcp: Fix a data-race around sysctl_tcp_abort_on_overflow.
    - tcp: Fix data-races around sysctl_tcp_max_reordering.
    - net/sched: cls_api: Fix flow action initialization
    - [arm*] spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for
      non DMA transfers
    - KVM: Don't null dereference ops->destroy
    - mm/mempolicy: fix uninit-value in mpol_rebind_policy()
    - bpf: Make sure mac_header was set before using it
    - sched/deadline: Fix BUG_ON condition for deboosted tasks
    - [x86] perf/x86/intel/lbr: Fix unchecked MSR access error on HSW
    - [x86] x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS
      parts
    - dlm: fix pending remove if msg allocation fails
    - [x86] crypto: qat - set to zero DH parameters before free
    - [x86] crypto: qat - use pre-allocated buffers in datapath
    - [x86] crypto: qat - refactor submission logic
    - [x86] crypto: qat - add backlog mechanism
    - [x86] crypto: qat - fix memory leak in RSA
    - [x86] crypto: qat - remove dma_free_coherent() for RSA
    - [x86] crypto: qat - remove dma_free_coherent() for DH
    - [x86] crypto: qat - add param check for RSA
    - [x86] crypto: qat - add param check for DH
    - [x86] crypto: qat - re-enable registration of algorithms
    - exfat: fix referencing wrong parent directory information after renaming
    - exfat: use updated exfat_chain directly during renaming
    - [x86] amd: Use IBPB for firmware calls
    - [x86] alternative: Report missing return thunk details
    - watchqueue: make sure to serialize 'wqueue->defunct' properly
    - [x86] ASoC: SOF: pm: add explicit behavior for ACPI S1 and S2
    - [x86] ASoC: SOF: pm: add definitions for S4 and S5 states
    - [x86] ASoC: SOF: Intel: disable IMR boot when resuming from ACPI S4 and S5
      states
    - watch-queue: remove spurious double semicolon
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.16
    - Bluetooth: Always set event mask on suspend
    - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
    - Revert "ocfs2: mount shared volume without ha stack"
    - userfaultfd: provide properly masked address for huge-pages
    - fs: sendfile handles O_NONBLOCK of out_fd
    - secretmem: fix unhandled fault in truncate
    - mm: fix page leak with multiple threads mapping the same page
    - mm: fix missing wake-up event for FSDAX pages
    - hugetlb: fix memoryleak in hugetlb_mcopy_atomic_pte
    - [s390x] archrandom: prevent CPACF trng invocations in interrupt context
    - [x86] intel_idle: Fix false positive RCU splats due to incorrect hardirqs
      state
    - watch_queue: Fix missing rcu annotation
    - watch_queue: Fix missing locking in add_watch_to_object()
    - tcp: Fix data-races around sysctl_tcp_dsack.
    - tcp: Fix a data-race around sysctl_tcp_app_win.
    - tcp: Fix a data-race around sysctl_tcp_adv_win_scale.
    - tcp: Fix a data-race around sysctl_tcp_frto.
    - tcp: Fix a data-race around sysctl_tcp_nometrics_save.
    - tcp: Fix data-races around sysctl_tcp_no_ssthresh_metrics_save.
    - bridge: Do not send empty IFLA_AF_SPEC attribute
    - ice: Fix max VLANs available for VF
    - ice: check (DD | EOF) bits on Rx descriptor rather than (EOP | RS)
    - ice: do not setup vlan for loopback VSI
    - ice: Fix VSIs unable to share unicast MAC
    - Revert "tcp: change pingpong threshold to 3"
    - tcp: md5: fix IPv4-mapped support
    - tcp: Fix data-races around sysctl_tcp_moderate_rcvbuf.
    - tcp: Fix a data-race around sysctl_tcp_limit_output_bytes.
    - tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit.
    - scsi: core: Fix warning in scsi_alloc_sgtables()
    - scsi: mpt3sas: Stop fw fault watchdog work item during system shutdown
    - net: ping6: Fix memleak in ipv6_renew_options().
    - ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
    - net/tls: Remove the context from the list in tls_device_down
    - net: pcs: xpcs: propagate xpcs_read error to xpcs_get_state_c37_sgmii
    - net: sungem_phy: Add of_node_put() for reference returned by
      of_get_parent()
    - tcp: Fix a data-race around sysctl_tcp_min_tso_segs.
    - tcp: Fix a data-race around sysctl_tcp_tso_rtt_log.
    - tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen.
    - tcp: Fix a data-race around sysctl_tcp_autocorking.
    - tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit.
    - Documentation: fix sctp_wmem in ip-sysctl.rst
    - macsec: fix NULL deref in macsec_add_rxsa
    - macsec: fix error message in macsec_add_rxsa and _txsa
    - macsec: limit replay window size with XPN
    - macsec: always read MACSEC_SA_ATTR_PN as a u64
    - net: macsec: fix potential resource leak in macsec_add_rxsa() and
      macsec_add_txsa()
    - net: mld: fix reference count leak in mld_{query | report}_work()
    - tcp: Fix data-races around sk_pacing_rate.
    - net: Fix data-races around sysctl_[rw]mem(_offset)?.
    - tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns.
    - tcp: Fix a data-race around sysctl_tcp_comp_sack_slack_ns.
    - tcp: Fix a data-race around sysctl_tcp_comp_sack_nr.
    - tcp: Fix data-races around sysctl_tcp_reflect_tos.
    - ipv4: Fix data-races around sysctl_fib_notify_on_flag_change.
    - i40e: Fix interface init with MSI interrupts (no MSI-X)
    - [arm64,armhf] net: dsa: fix reference counting for LAG FDBs
    - sctp: fix sleep in atomic context bug in timer handlers
    - netfilter: nf_queue: do not allow packet truncation below transport header
      offset (CVE-2022-36946)
    - scsi: ufs: Support clearing multiple commands at once
    - scsi: ufs: core: Fix a race condition related to device management
    - virtio-net: fix the race between refill work and close
    - perf symbol: Correct address for bss symbols
    - sfc: disable softirqs for ptp TX
    - sctp: leave the err path free in sctp_stream_init to sctp_stream_free
    - mm/hmm: fault non-owner device private entries
    - page_alloc: fix invalid watermark check on a negative value
    - tcp: Fix data-races around sysctl_tcp_workaround_signed_windows.
    - [armel,armhf] 9216/1: Fix MAX_DMA_ADDRESS overflow
    - docs/kernel-parameters: Update descriptions for "mitigations=" param with
      retbleed
    - locking/rwsem: Allow slowpath writer to ignore handoff bit if not set by
      first waiter
    - [x86] bugs: Do not enable IBPB at firmware entry when IBPB is not
      available

  [ Ben Hutchings ]
  * d/tests: kbuild test case depends on python3
  * d/tests: Run kbuild test with default flavour if quick flavour not defined
  * d/lib/python/debian_linux/debian.py: Add Architecture field to TestsControl
  * d/tests: Restrict kbuild tests to architectures with default or quick
    flavour
  * security: Add landlock and bpf to enabled LSM list (Closes: #999551)

  [ Salvatore Bonaccorso ]
  * Bump ABI to 4
  * Add mitigations for Post-Barrier Return Stack Buffer Predictions (PBRSB)
    issue (CVE-2022-26373):
    - x86/speculation: Add RSB VM Exit protections
    - x86/speculation: Add LFENCE to RSB fill sequence
  * posix-cpu-timers: Cleanup CPU timers before freeing them during exec
    (CVE-2022-2585)
  * netfilter: nf_tables: do not allow SET_ID to refer to another table
    (CVE-2022-2586)
  * netfilter: nf_tables: do not allow CHAIN_ID to refer to another table
  * netfilter: nf_tables: do not allow RULE_ID to refer to another chain
  * net_sched: cls_route: remove from list when handle is 0 (CVE-2022-2588)
  * Revert "mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte"
    (CVE-2022-2590)

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 10 Aug 2022 20:11:48 +0200

linux (5.18.14-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.6
    - Revert "drm/amd/display: Fix DCN3 B0 DP Alt Mapping" (regression in 5.16)
    - [arm64] dts: imx8mm-beacon: Enable RTS-CTS on UART3
    - [arm64] dts: imx8mn-beacon: Enable RTS-CTS on UART3
    - io_uring: reinstate the inflight tracking (CVE-2022-1976)
    - [arm64] ASoC: qcom: lpass-platform: Update VMA access permissions in mmap
      callback
    - drm/amd/display: Read Golden Settings Table from VBIOS
    - drm/amdgpu: Resolve RAS GFX error count issue after cold boot on Arcturus
    - [amd64] drm/amdkfd: Use mmget_not_zero in MMU notifier
    - [x86] ASoC: Intel: cirrus-common: fix incorrect channel mapping
    - [armel,armhf] ASoC: cs42l51: Correct minimum value for SX volume control
    - [amd64] drm/amdkfd: add pinned BOs to kfd_bo_list
    - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
    - quota: Prevent memory allocation recursion while holding dq_lock
    - [armhf] ASoC: es8328: Fix event generation for deemphasis control
    - [x86] ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put()
    - [x86] ALSA: hda: MTL: add HD Audio PCI ID and HDMI codec vendor ID
    - [x86] Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to
      dmi_use_low_level_irq
    - [x86] scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
    - scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted
    - scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology
    - scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd
      completion
    - scsi: mpt3sas: Fix out-of-bounds compiler warning
    - scsi: ipr: Fix missing/incorrect resource cleanup in error case
    - scsi: pmcraid: Fix missing resource cleanup in error case
    - ALSA: hda/realtek - Add HW8326 support
    - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration
      failed
    - ipv6: Fix signed integer overflow in __ip6_append_data
    - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
    - random: credit cpu and bootloader seeds by default
    - [x86] platform/x86/intel: pmc: Support Intel Raptorlake P
    - [x86] platform/x86/intel: hid: Add Surface Go to VGBS allow list
    - staging: r8188eu: fix rtw_alloc_hwxmits error detection for now
      (regression in 5.18.4) (Closes: #1013895)
    - staging: r8188eu: Fix warning of array overflow in ioctl_linux.c
      (regression in 5.15)
    - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE
    - pNFS: Avoid a live lock condition in pnfs_update_layout() (regression in
      5.14)
    - sunrpc: set cl_max_connect when cloning an rpc_clnt (regression in 5.15)
    - i40e: Fix adding ADQ filter to TC0
    - i40e: Fix calculating the number of queue pairs
    - i40e: Fix call trace in setup_tx_descriptors
    - iavf: Fix issue with MAC address of VF shown as zero (regression in 5.18)
    - [x86,arm64] Drivers: hv: vmbus: Release cpu lock in error case
    - [riscv64] dts: microchip: re-add pdma to mpfs device tree (regression in
      5.18)
    - io_uring: fix races with file table unregister
    - io_uring: fix races with buffer table unregister
    - [x86] drm/i915/reset: Fix error_state_read ptr + offset use
    - [arm64] net: hns3: set port base vlan tbl_sta to false before removing
      old vlan (regression in 5.18)
    - [arm64] net: hns3: don't push link state to VF if unalive
    - [arm64] net: hns3: restore tm priority/qset to default settings when tc
      disabled
    - [arm64] net: hns3: fix PF rss size initialization bug (regression in
      5.17)
    - [arm64] net: hns3: fix tm port shapping of fibre port is incorrect after
      driver initialization
    - ice: Fix PTP TX timestamp offset calculation
    - ice: Sync VLAN filtering features for DVM
    - ice: Fix queue config fail handling
    - ice: Fix memory corruption in VF driver
    - net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg
    - [arm64] ftrace: fix branch range checks
    - [arm64] ftrace: consistently handle PLTs.
    - init: Initialize noop_backing_dev_info early (regression in 5.18.4)
    - block: Fix handling of offline queues in blk_mq_alloc_request_hctx()
    - [x86] ftrace: Remove OBJECT_FILES_NON_STANDARD usage
    - [arm64,armhf] irqchip/gic-v3: Fix error handling in
      gic_populate_ppi_partitions
    - sched: Fix balance_push() vs __sched_setscheduler()
    - i2c: designware: Use standard optional ref clock implementation
    - [x86] mei: hbm: drop capability response on early shutdown
    - [x86] mei: me: add raptor lake point S DID
    - [x86] comedi: vmk80xx: fix expression for tx buffer size
    - USB: serial: option: add support for Cinterion MV31 with new baseline
    - USB: serial: io_ti: add Agilent E5805A support
    - [arm64] mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
    - [arm64,armhf] usb: dwc2: Fix memory leak in dwc2_hcd_init
    - [arm64,armhf] usb: dwc3: gadget: Fix IN endpoint max packet size
      allocation
    - [arm64,armhf] usb: dwc3: pci: Restore line lost in merge conflict
      resolution (regression in 5.18)
    - usb: gadget: u_ether: fix regression in setting fixed MAC address
      (regression in 5.16)
    - usb: gadget: f_fs: change ep->status safe in ffs_epfile_io()
    - usb: gadget: f_fs: change ep->ep safe in ffs_epfile_io()
    - tty: n_gsm: Debug output allocation must use GFP_ATOMIC (regression in
      5.18.3)
    - serial: 8250: Store to lsr_save_flags after lsr read
    - [arm64] bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
    - md/raid5-ppl: Fix argument order in bio_alloc_bioset() (regression in
      5.18)
    - dm: fix race in dm_start_io_acct (regression in 5.18)
    - dm mirror log: round up region bitmap size to BITS_PER_LONG
    - drm/amdgpu: Fix GTT size reporting in amdgpu_ioctl (regression in 5.18)
    - drm/amd/display: Cap OLED brightness per max frame-average luminance
    - audit: free module name (regression in 5.16)
    - fs: account for group membership
    - selinux: free contexts previously transferred in selinux_add_opt()
      (regression in 5.18)
    - ext4: fix super block checksum incorrect after mount
    - ext4: fix bug_on ext4_mb_use_inode_pa
    - ext4: make variable "count" signed
    - ext4: add reserved GDT blocks check
    - [arm64] KVM: arm64: Always start with clearing SVE flag on load
      (regression in 5.17)
    - [arm64] KVM: arm64: Don't read a HW interrupt pending state in user
      context (regression in 5.17)
    - netfs: Fix gcc-12 warning by embedding vfs inode in netfs_i_context
    - [x86] drm/i915/uc: remove accidental static from a local variable
      (regression in 5.17)
    - bpf: Use safer kvmalloc_array() where possible
    - dm: fix bio_set allocation
    - [arm64] clk: imx8mp: fix usb_root_clk parent
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.7
    - [s390x] mm: use non-quiescing sske for KVM switch to keyed guest
    - zonefs: fix zonefs_iomap_begin() for reads
    - [x86] boot: Wrap literal addresses in absolute_pointer()
    - fsnotify: consistent behavior for parent not watching children
    - bpf: Fix calling global functions from BPF_PROG_TYPE_EXT programs
      (regression in 5.17)
    - io_uring: use original request task for inflight tracking
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.8
    - random: schedule mix_interrupt_randomness() less often
    - random: quiet urandom warning ratelimit suppression message
    - [x86] ALSA: memalloc: Drop x86-specific hack for WC allocations
    - ALSA: hda/via: Fix missing beep setup
    - [x86] ALSA: hda: Fix discovery of i915 graphics PCI device (regression in
      5.18)
    - ALSA: hda/conexant: Fix missing beep setup
    - [x86] ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop
    - ALSA: hda/realtek - ALC897 headset MIC no sound
    - [x86] ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly
    - [x86] ALSA: hda/realtek: Add quirk for Clevo PD70PNT
    - [x86] ALSA: hda/realtek: Add quirk for Clevo NS50PU
    - net: openvswitch: fix parsing of nw_proto for IPv6 fragments
    - ipv4: ping: fix bind address validity check (regression in 5.17)
    - 9p: Fix refcounting during full path walks for fid lookups
    - 9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl
    - 9p: fix fid refcount leak in v9fs_vfs_get_link
    - 9p: fix EBADF errors in cached mode (regression in 5.16)
    - btrfs: fix hang during unmount when block group reclaim task is running
      (regression in 5.13)
    - btrfs: prevent remounting to v1 space cache for subpage mount
    - btrfs: add error messages to all unrecognized mount options
    - [powerpc*] scsi: ibmvfc: Store vhost pointer during subcrq allocation
    - [powerpc*] scsi: ibmvfc: Allocate/free queue resource only during probe/
      remove
    - mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing
    - xen/gntdev: Avoid blocking in unmap_grant_pages()
    - dm era: commit metadata in postsuspend after worker stops
    - dm: do not return early from dm_io_complete if BLK_STS_AGAIN without
      polling (regression in 5.18)
    - dm mirror log: clear log bits up to BITS_PER_LONG boundary
    - tracing/kprobes: Check whether get_kretprobe() returns NULL in
      kretprobe_dispatcher()
    - filemap: Handle sibling entries in filemap_get_read_batch()
    - mm/slub: add missing TID updates on slab deactivation
    - [x86] drm/i915: Implement w/a 22010492432 for adl-s
    - amd/display/dc: Fix COLOR_ENCODING and COLOR_RANGE doing nothing for
      DCN20+
    - drm/amd/display: Fix typo in override_lane_settings
    - USB: serial: pl2303: add support for more HXN (G) types
    - USB: serial: option: add Telit LE910Cx 0x1250 composition
    - USB: serial: option: add Quectel EM05-G modem
    - USB: serial: option: add Quectel RM500K module support
    - [arm64] drm/msm: Ensure mmap offset is initialized
    - [arm64] drm/msm: Fix double pm_runtime_disable() call
    - netfilter: use get_random_u32 instead of prandom
    - scsi: scsi_debug: Fix zone transition to full condition
    - [arm64] drm/msm: Switch ordering of runpm put vs devfreq_idle (regression
      in 5.15)
    - scsi: iscsi: Exclude zero from the endpoint ID range (regression in 5.18)
    - xsk: Fix generic transmit when completion queue reservation fails
    - [arm64] drm/msm: use for_each_sgtable_sg to iterate over scatterlist
    - bpf: Fix request_sock leak in sk lookup helpers
    - [arm64,armhf] drm/sun4i: Fix crash during suspend after component bind
      failure
    - [amd64] bpf, x86: Fix tail call count offset calculation on bpf2bpf call
    - [x86,arm64] scsi: storvsc: Correct reporting of Hyper-V I/O size limits
    - phy: aquantia: Fix AN when higher speeds than 1G are not advertised
    - net: fix data-race in dev_isalive()
    - veth: Add updating of trans_start
    - tipc: fix use-after-free Read in tipc_named_reinit
    - block: disable the elevator int del_gendisk
    - rethook: Reject getting a rethook if RCU is not watching
    - igb: fix a use-after-free issue in igb_clean_tx_ring
    - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
    - ethtool: Fix get module eeprom fallback
    - net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
    - [arm64] drm/msm/dp: check core_initialized before disable interrupts at
      dp_display_unbind() (regression in 5.18.3)
    - [arm64] drm/msm/dp: force link training for display resolution change
    - net: phy: at803x: fix NULL pointer dereference on AR9331 PHY (regression
      in 5.18)
    - perf arm-spe: Don't set data source if it's not a memory operation
    - erspan: do not assume transport header is always set
    - net/tls: fix tls_sk_proto_close executed repeatedly
    - netfilter: nf_dup_netdev: do not push mac header a second time
    - netfilter: nf_dup_netdev: add and use recursion counter
    - xen-blkfront: Handle NULL gendisk (regression in 5.14)
    - afs: Fix dynamic root getattr (regression in 5.18)
    - block: pop cached rq before potentially blocking rq_qos_throttle()
      (regression in 5.17)
    - ice: ignore protocol field in GTP offload
    - ice: Fix switchdev rules book keeping
    - ice: ethtool: advertise 1000M speeds properly
    - ice: ethtool: Prohibit improper channel config for DCB
    - io_uring: fail links when poll fails (regression in 5.17)
    - regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips
    - regmap-irq: Fix offset/index mismatch in read_sub_irq_data()
    - drm/amd: Revert "drm/amd/display: keep eDP Vdd on when eDP stream is
      already enabled" (regression in 5.18)
    - igb: Make DMA faster when CPU is active on the PCIe link
    - virtio_net: fix xdp_rxq_info bug after suspend/resume
    - Revert "net/tls: fix tls_sk_proto_close executed repeatedly"
    - sock: redo the psock vs ULP protection check
    - nvme: move the Samsung X5 quirk entry to the core quirks
    - gpio: winbond: Fix error code in winbond_gpio_get()
    - [s390x] cpumf: Handle events cycles and instructions identical
    - filemap: Fix serialization adding transparent huge pages to page cache
      (regression in 5.18)
    - [x86] KVM: SEV: Init target VMCBs in sev_migrate_from
    - iio: mma8452: fix probe fail when device tree compatible is used.
    - io_uring: fix req->apoll_events (regression in 5.18)
    - io_uring: fix wrong arm_poll error handling (regression in 5.17)
    - vmcore: convert copy_oldmem_page() to take an iov_iter
    - [s390x] crash: add missing iterator advance in copy_oldmem_page()
    - [s390x] crash: make copy_oldmem_page() return number of bytes copied
    - xhci: turn off port power in shutdown
    - xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI
    - xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI
    - usb: gadget: uvc: fix list double add in uvcg_video_pump (regression in
      5.16)
    - usb: gadget: Fix non-unique driver names in raw-gadget driver
    - USB: gadget: Fix double-free bug in raw_gadget driver
    - [arm64,armhf] usb: chipidea: udc: check request status before setting
      device address
    - btrfs: fix race between reflinking and ordered extent completion
    - btrfs: fix deadlock with fsync+fiemap+transaction commit
    - f2fs: attach inline_data after setting compression (regression in 5.18.3)
    - f2fs: fix iostat related lock protection (regression in 5.17)
    - f2fs: do not count ENOENT for error case (regression in 5.18.4)
    - iio:accel:kxcjk-1013: rearrange iio trigger get and register
    - iio:accel:bma180: rearrange iio trigger get and register
    - iio:accel:mxc4005: rearrange iio trigger get and register
    - iio: accel: mma8452: ignore the return value of reset operation
    - iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up()
    - iio: trigger: sysfs: fix use-after-free on remove
    - iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value)
    - iio: adc: axp288: Override TS pin bias current for some models
    - [hppa] Fix flush_anon_page on PA8800/PA8900 (regression in 5.18)
    - [hppa] Enable ARCH_HAS_STRICT_MODULE_RWX
    - [powerpc*] Enable execve syscall exit tracepoint
    - [powerpc*] rtas: Allow ibm,platform-dump RTAS call with null buffer
      address
    - [powerpc*] powernv: wire up rng during setup_arch
    - mm/memory-failure: disable unpoison once hw error happens
    - mm: lru_cache_disable: use synchronize_rcu_expedited (regression in 5.18)
    - [armhf] dts: imx6qdl: correct PU regulator ramp delay
    - modpost: fix section mismatch check for exported init/exit sections
    - [arm64] dts: bcm2711-rpi-400: Fix GPIO line names
    - smb3: fix empty netname context on secondary channels (regression in
      5.18.4)
    - perf build-id: Fix caching files with a wrong build ID
    - smb3: use netname when available on secondary channels
    - dma-direct: use the correct size for dma_set_encrypted() (regression in
      5.17)
    - [powerpc*] pseries: wire up rng during setup_arch()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.9
    - bcache: memset on stack variables in bch_btree_check() and
      bch_sectors_dirty_init()
    - hinic: Replace memcpy() with direct assignment
    - [powerpc*] ftrace: Remove ftrace init tramp once kernel init is complete
    - io_uring: fix not locked access to fixed buf table
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.10
    - drm/amdgpu: fix adev variable used in amdgpu_device_gpu_recover()
      (regression in 5.17)
    - Revert "drm/amdgpu/display: set vblank_disable_immediate for DC"
      (regression in 5.17)
    - drm/amdgpu: To flush tlb for MMHUB of RAVEN series
    - ksmbd: set the range of bytes to zero without extending file size in
      FSCTL_ZERO_DATA
    - ksmbd: check invalid FileOffset and BeyondFinalZero in FSCTL_ZERO_DATA
    - ksmbd: use vfs_llseek instead of dereferencing NULL
    - ipv6: take care of disable_policy when restoring routes
    - net: phy: Don't trigger state machine while in suspend
    - [s390x] archrandom: simplify back to earlier design and initialize
      earlier
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG SX6000LNP (AKA SPECTRIX
      S40G)
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA IM2P33F8ABR1
    - nvdimm: Fix badblocks clear off-by-one error
    - ceph: wait on async create before checking caps for syncfs
      (regression in 5.18)
    - [hppa] Fix vDSO signal breakage on 32-bit kernel (regression in 5.18)
    - [hppa] unaligned: Fix emulate_ldw() breakage (regression in 5.18)
    - [powerpc*] prom_init: Fix kernel config grep
    - [powerpc*] bpf: Fix use of user_pt_regs in uapi
    - [x86] cpufreq: amd-pstate: Add resume and suspend callbacks
    - dm raid: fix accesses beyond end of raid member array
    - dm raid: fix KASAN warning in raid5_add_disks
    - SUNRPC: Fix READ_PLUS crasher
    - net: rose: fix UAF bugs caused by timer handler (CVE-2022-2318)
    - net: usb: ax88179_178a: Fix packet receiving (regression in 5.17)
    - virtio-net: fix race between ndo_open() and virtio_device_ready()
    - [armhf] net: dsa: bcm_sf2: force pause link settings
    - net: tun: unlink NAPI from device on destruction
    - net: tun: stop NAPI when detaching queues
    - net: fix IFF_TX_SKB_NO_LINEAR definition
    - net: dp83822: disable false carrier interrupt
    - net: dp83822: disable rx error interrupt
    - RDMA/qedr: Fix reporting QP timeout attribute
    - RDMA/cm: Fix memory leak in ib_cm_insert_listen
    - linux/dim: Fix divide by 0 in RDMA DIM
    - net: usb: asix: do not force pause frames support
    - usbnet: fix memory allocation in helpers
    - mptcp: fix race on unaccepted mptcp sockets (regression in 5.17)
    - mptcp: fix conflict with <netinet/in.h> (regression in 5.16)
    - [armhf] hwmon: (occ) Prevent power cap command overwriting poll response
    - NFS: restore module put when manager exits. (regression in 5.18)
    - NFSD: restore EINVAL error translation in nfsd_commit() (regression in
      5.17)
    - NFSv4: Add an fattr allocation to _nfs4_discover_trunking()
      (regression in 5.18.3)
    - vfs: fix copy_file_range() regression in cross-fs copies
    - caif_virtio: fix race between virtio_device_ready() and ndo_open()
    - io_uring: ensure that send/sendmsg and recv/recvmsg check sqe->ioprio
    - PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events
    - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()
    - vdpa/mlx5: Update Control VQ callback information
    - netfilter: nft_dynset: restore set element counter when failing to update
    - net/sched: act_api: Notify user space if any actions were flushed before
      error
    - net: asix: fix "can't send until first packet is send" issue
    - net: bonding: fix possible NULL deref in rlb code
    - net: phy: ax88772a: fix lost pause advertisement configuration
    - net: bonding: fix use-after-free after 802.3ad slave unbind
    - [arm64] net: dsa: felix: fix race between reading PSFP stats and port
      stats
    - [powerpc] memhotplug: Add add_pages override for PPC (regression in 5.18)
    - [x86] platform/x86: thinkpad_acpi: Fix a memory leak of EFCH MMIO
      resource (regression in 5.18)
    - [x86] platform/x86: ideapad-laptop: Add Ideapad 5 15ITL05 to
      ideapad_dytc_v4_allow_table[]
    - tipc: move bc link creation back to tipc_node_create
    - epic100: fix use after free on rmmod
    - tcp: add a missing nf_reset_ct() in 3WHS handling
    - nvmet-tcp: fix regression in data_digest calculation (regression in 5.12)
    - ACPI: video: Change how we determine if brightness key-presses are handled
    - tunnels: do not assume mac header is set in skb_tunnel_check_pmtu()
    - fanotify: refine the validation checks on non-dir inode mask (regression
      in 5.18)
    - nvmet: add a clear_ids attribute for passthru targets
    - ipv6/sit: fix ipip6_tunnel_get_prl return value
    - ipv6: fix lockdep splat in in6_dump_addrs() (regression in 5.13)
    - net: tun: avoid disabling NAPI twice
    - [arm64] drm/msm/dpu: Increment vsync_cnt before waking up userspace
      (regression in 5.16)
    - [x86] platform/x86: ideapad-laptop: Add allow_v4_dytc module parameter
    - [x86] drm/i915/gem: add missing else
    - [x86] drm/i915/dgfx: Disable d3cold at gfx root port
    - [arm64] drm/msm/gem: Fix error return on fence id alloc fail (regression
      in 5.15)
    - [x86] platform/x86: panasonic-laptop: revert "Resolve hotkey double
      trigger bug"
    - [x86] platform/x86: panasonic-laptop: don't report duplicate brightness
      key-presses
    - [x86] platform/x86: panasonic-laptop: filter out duplicate volume up/down
      /mute keypresses
    - drm/fourcc: fix integer type usage in uapi header
    - hwmon: (ibmaem) don't call platform_device_del() if platform_device_add()
      fails
    - xen/blkfront: fix leaking data in shared pages (CVE-2022-26365)
    - xen/netfront: fix leaking data in shared pages (CVE-2022-33740)
    - xen/netfront: force data bouncing when backend is untrusted
      (CVE-2022-33741)
    - xen/blkfront: force data bouncing when backend is untrusted
      (CVE-2022-33742)
    - xen-netfront: restore __skb_queue_tail() positioning in
      xennet_get_responses() (CVE-2022-33743)
    - [arm64,armhf] xen/arm: Fix race in RB-tree based P2M accounting
      (CVE-2022-33744)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.11
    - io_uring: fix provided buffer import (regression in 5.18)
    - ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD
    - [x86] ALSA: hda/realtek: Add quirk for Clevo L140PU
    - can: bcm: use call_rcu() instead of costly synchronize_rcu()
    - can: gs_usb: gs_usb_open/close(): fix memory leak
    - can: kvaser_usb: replace run-time checks with struct
      kvaser_usb_driver_info
    - can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression
      (regression in 5.16)
    - can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits
    - bpf: Fix incorrect verifier simulation around jmp32's jeq/jne
    - bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals
    - usbnet: fix memory leak in error case
    - net: rose: fix UAF bug caused by rose_t0timer_expiry
    - netfilter: nft_set_pipapo: release elements in clone from abort path
    - netfilter: nf_tables: stricter validation of element data
      (CVE-2022-34918)
    - [x86] iommu/vt-d: Fix PCI bus rescan device hot add
    - [x86] iommu/vt-d: Fix RID2PASID setup/teardown failure
    - fbdev: Fix potential buffer overflow with silly screen sizes
      (CVE-2021-33655):
      + fbmem: Check virtual screen sizes in fb_set_var()
      + fbcon: Disallow setting font bigger than screen size
      + fbcon: Prevent that screen size is smaller than font size
    - PM: runtime: Redefine pm_runtime_release_supplier()
    - PM: runtime: Fix supplier device management during consumer probe
    - memregion: Fix memregion_free() fallback definition
    - fscache: Fix invalidation/lookup race (regression in 5.17)
    - fscache: Fix if condition in fscache_wait_on_volume_collision()
    - [powerpc*] powernv: delay rng platform device creation until later in
      boot
    - [armhf] pinctrl: sunxi: a83t: Fix NAND function name for some pins
    - srcu: Tighten cleanup_srcu_struct() GP checks
    - ASoC: rt711: Add endianness flag in snd_soc_component_driver
    - ASoC: rt711-sdca: Add endianness flag in snd_soc_component_driver
    - ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect
    - ASoC: SOF: ipc3-topology: Move and correct size checks in
      sof_ipc3_control_load_bytes()
    - [x86] ASoC: SOF: Intel: hda: Fix compressed stream position tracking
    - [arm64] dts: qcom: sm8450: fix interconnects property of UFS node
    - [arm64] dts: qcom: msm8994: Fix CPU6/7 reg values
    - [arm64] dts: qcom: sdm845: use dispcc AHB clock for mdss node
    - [arm64] dts: imx8mp-evk: correct mmc pad settings
    - [arm64] dts: imx8mp-evk: correct the uart2 pinctl value
    - [arm64] dts: imx8mp-evk: correct gpio-led pad settings
    - [arm64] dts: imx8mp-evk: correct vbus pad settings
    - [arm64] dts: imx8mp-evk: correct eqos pad settings
    - [arm64] dts: imx8mp-evk: correct I2C5 pad settings
    - [arm64] dts: imx8mp-evk: correct I2C1 pad settings
    - [arm64] dts: imx8mp-evk: correct I2C3 pad settings
    - [arm64] dts: imx8mp-phyboard-pollux-rdk: correct uart pad settings
    - [arm64] dts: imx8mp-phyboard-pollux-rdk: correct eqos pad settings
    - [arm64] dts: imx8mp-phyboard-pollux-rdk: correct i2c2 & mmc settings
    - [arm64,armhf] pinctrl: sunxi: sunxi_pconf_set: use correct offset
    - [arm64] dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo
    - xsk: Clear page contiguity bit when unmapping pool
    - i2c: piix4: Fix a memory leak in the EFCH MMIO support
    - i40e: Fix dropped jumbo frames statistics
    - i40e: Fix VF's MAC Address change on VM
    - [armhf] dts: stm32: add missing usbh clock and fix clk order on stm32mp15
    - ACPI: CPPC: Check _OSC for flexible address space
    - ACPI: bus: Set CPPC _OSC bits for all and when CPPC_LIB is supported
    - ACPI: CPPC: Only probe for _CPC if CPPC v2 is acked (regressions in
      5.13, 5.18)
    - [x86] ACPI: CPPC: Don't require _OSC if X86_FEATURE_CPPC is supported
    - net/mlx5e: Fix matchall police parameters validation
    - mptcp: Avoid acquiring PM lock for subflow priority changes
    - mptcp: Acquire the subflow socket lock before modifying MP_PRIO flags
    - mptcp: fix local endpoint accounting
    - r8169: fix accessing unset transport header
    - net/sched: act_api: Add extack to offload_act_setup() callback
    - net/sched: act_police: Add extack messages for offload failure
    - net/sched: act_police: allow 'continue' action offload
    - [arm64] dmaengine: imx-sdma: Allow imx8m for imx7 FW revs
    - [arm64,armhf] dmaengine: imx-sdma: only restart cyclic channel when
      enabled (regression in 5.18)
    - misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer
      (Closes: #1015240, regression in 5.18)
    - misc: rtsx_usb: use separate command and response buffers
    - misc: rtsx_usb: set return value in rsp_buf alloc err path
    - ida: don't use BUG_ON() for debugging
    - [arm64,armhf] dmaengine: pl330: Fix lockdep warning about non-static key
    - [armhf] dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
    - [arm64] dmaengine: qcom: bam_dma: fix runtime PM underflow
    - [armhf] dmaengine: ti: Add missing put_device in
      ti_dra7_xbar_route_allocate
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.12
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.13
    - USB: serial: ftdi_sio: add Belimo device ids
    - usb: typec: add missing uevent when partner support PD
    - [arm64,armhf] usb: dwc3: gadget: Fix event pending check
    - gpio: sim: fix the chip_name configfs item
    - [armhf] tty: serial: samsung_tty: set dma burst_size to 1
    - [x86] xen: Use clear_bss() for Xen PV guests
    - [x86] ALSA: hda - Add fixup for Dell Latitidue E5430
    - [x86] ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model
    - [x86] ALSA: hda/realtek: Fix headset mic for Acer SF313-51
    - [x86] ALSA: hda/realtek - Fix headset mic problem for a HP machine with
      alc671
    - [x86] ALSA: hda/realtek: fix mute/micmute LEDs for HP machines
    - [x86] ALSA: hda/realtek - Fix headset mic problem for a HP machine with
      alc221
    - [x86] ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop
    - xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue
    - fix race between exit_itimers() and /proc/pid/timers
    - mm: userfaultfd: fix UFFDIO_CONTINUE on fallocated shmem pages
    - mm: sparsemem: fix missing higher order allocation splitting (regression
      in 5.18)
    - mm: split huge PUD on wp_huge_pud fallback
    - tracing/histograms: Fix memory leak problem
    - net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale
      pointer
    - ip: fix dflt addr selection for connected nexthop
    - [armhf] 9213/1: Print message about disabled Spectre workarounds only
      once
    - [armel,armhf] 9214/1: alignment: advance IT state after emulating Thumb
      instruction
    - wifi: mac80211: fix queue selection for mesh/OCB interfaces
    - cgroup: Use separate src/dst nodes when preloading css_sets for migration
    - btrfs: return -EAGAIN for NOWAIT dio reads/writes on compressed and
      inline extents
    - btrfs: zoned: fix a leaked bioc in read_zone_info
    - [arm64,armhf] drm/panfrost: Put mapping instead of shmem obj on
      panfrost_mmu_map_fault_addr() error
    - [arm64,armhf] drm/panfrost: Fix shrinker list corruption by madvise IOCTL
    - fs/remap: constrain dedupe of EOF blocks
    - nilfs2: fix incorrect masking of permission flags for symlinks
    - Revert "evm: Fix memleak in init_desc"
    - reset: Fix devm bulk optional exclusive control getter
    - [arm64] dts: ls1028a: Update SFP node to include clock
    - [armhf] dts: imx6qdl-ts7970: Fix ngpio typo and count
    - [riscv64] dts: microchip: hook up the mpfs' l2cache
    - [armhf] 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out
      of idle
    - [armel,armhf] 9210/1: Mark the FDT_FIXED sections as shareable
    - net/mlx5e: Fix enabling sriov while tc nic rules are offloaded
      (regression in 5.14)
    - net/mlx5e: CT: Use own workqueue instead of mlx5e priv (regression in
      5.18)
    - net/mlx5e: Fix capability check for updating vnic env counters
    - net/mlx5e: Ring the TX doorbell on DMA errors
    - drm/amdgpu: keep fbdev buffers pinned during suspend (regression in 5.17)
    - drm/amdgpu/display: disable prefer_shadow for generic fb helpers
      (regression in 5.17)
    - [x86] drm/i915: fix a possible refcount leak in
      intel_dp_add_mst_connector()
    - [x86] drm/i915/guc: ADL-N should use the same GuC FW as ADL-S
    - ima: Fix a potential integer overflow in ima_appraise_measurement
    - [arm64,armhf] ASoC: sgtl5000: Fix noise on shutdown/remove
    - [x86] ASoC: Intel: Skylake: Correct the ssp rate discovery in
      skl_get_ssp_clks()
    - [x86] ASoC: Intel: Skylake: Correct the handling of fmt_config flexible
      array
    - netfilter: ecache: move to separate structure
    - netfilter: conntrack: split inner loop of list dumping to own function
    - netfilter: ecache: use dedicated list for event redelivery
    - netfilter: conntrack: include ecache dying list in dumps
    - netfilter: conntrack: remove the percpu dying list
    - netfilter: conntrack: fix crash due to confirmed bit load reordering
      (regression in 5.17)
    - sysctl: Fix data races in proc_dointvec().
    - sysctl: Fix data races in proc_douintvec().
    - sysctl: Fix data races in proc_dointvec_minmax().
    - sysctl: Fix data races in proc_douintvec_minmax().
    - sysctl: Fix data races in proc_doulongvec_minmax().
    - sysctl: Fix data races in proc_dointvec_jiffies().
    - tcp: Fix a data-race around sysctl_tcp_max_orphans.
    - inetpeer: Fix data-races around sysctl.
    - net: Fix data-races around sysctl_mem.
    - cipso: Fix data-races around sysctl.
    - icmp: Fix data-races around sysctl.
    - ipv4: Fix a data-race around sysctl_fib_sync_mem.
    - [armhf] dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero
    - netfilter: nf_log: incorrect offset to network header
    - nfp: fix issue of skb segments exceeds descriptor limitation
    - vlan: fix memory leak in vlan_newlink() (regression in 5.17)
    - netfilter: nf_tables: replace BUG_ON by element length check
    - [riscv64] KVM: Fix SRCU deadlock caused by
      kvm_riscv_check_vcpu_requests()
    - [x86] drm/i915/gvt: IS_ERR() vs NULL bug in
      intel_gvt_update_reg_whitelist()
    - xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE
    - mptcp: fix subflow traversal at disconnect time (regression in 5.17)
    - NFSD: Decode NFSv4 birth time attribute (regression in 5.18)
    - lockd: set fl_owner when unlocking files
    - lockd: fix nlm_close_files (regression in 5.15)
    - ice: handle E822 generic device ID in PLDM header
    - ice: change devlink code to read NVM in blocks
    - [x86] drm/i915/ttm: fix sg_table construction (regression in 5.15)
    - [x86] drm/i915/gt: Serialize GRDOM access between multiple engine resets
    - [x86] drm/i915/gt: Serialize TLB invalidates with GT resets
    - bnxt_en: reclaim max resources if sriov enable fails
    - bnxt_en: Fix bnxt_reinit_after_abort() code path
    - bnxt_en: fix livepatch query
    - bnxt_en: Fix bnxt_refclk_read()
    - sysctl: Fix data-races in proc_dou8vec_minmax().
    - sysctl: Fix data-races in proc_dointvec_ms_jiffies().
    - tcp: Fix a data-race around sysctl_max_tw_buckets.
    - icmp: Fix a data-race around sysctl_icmp_echo_ignore_all.
    - icmp: Fix data-races around sysctl_icmp_echo_enable_probe.
    - icmp: Fix a data-race around sysctl_icmp_echo_ignore_broadcasts.
    - icmp: Fix a data-race around sysctl_icmp_ignore_bogus_error_responses.
    - icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.
    - icmp: Fix a data-race around sysctl_icmp_ratelimit.
    - icmp: Fix a data-race around sysctl_icmp_ratemask.
    - raw: Fix a data-race around sysctl_raw_l3mdev_accept.
    - tcp: Fix data-races around sysctl_tcp_ecn.
    - tcp: Fix a data-race around sysctl_tcp_ecn_fallback.
    - ipv4: Fix data-races around sysctl_ip_dynaddr.
    - nexthop: Fix data-races around nexthop_compat_mode.
    - [amd64] ima: force signature verification when CONFIG_KEXEC_SIG is
      configured
    - drm/amd/display: Ignore First MST Sideband Message Return Error
    - [amd64] drm/amdkfd: correct the MEC atomic support firmware checking for
      GC 10.3.7
    - drm/amd/display: Only use depth 36 bpp linebuffers on DCN display
      engines. (regression in 5.14)
    - drm/amd/pm: Prevent divide by zero
    - drm/amd/display: Ensure valid event timestamp for cursor-only commits
    - smb3: workaround negprot bug in some Samba servers
    - sfc: fix use after free when disabling sriov
    - netfs: do not unlock and put the folio twice
    - seg6: fix skb checksum evaluation in SRH encapsulation/insertion
    - seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors
    - seg6: bpf: fix skb checksum in bpf_push_seg6_encap()
    - sfc: fix kernel panic when creating VF
    - net: atlantic: remove deep parameter on suspend/resume functions
    - net: atlantic: remove aq_nic_deinit() when resume (regression in 5.18)
    - [x86] KVM: x86: Fully initialize 'struct kvm_lapic_irq' in
      kvm_pv_kick_cpu_op()
    - net/tls: Check for errors in tls_device_init
    - mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE
    - [arm64] tee: tee_get_drvdata(): fix description of return value
    - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
    - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
    - scsi: megaraid: Clear READ queue map's nr_queues (regression in 5.13)
    - scsi: ufs: core: Drop loglevel of WriteBoost message (regression in 5.13)
    - nvme: fix block device naming collision (regression in 5.18)
    - ksmbd: use SOCK_NONBLOCK type for kernel_accept()
    - [x86] platform/x86: intel/pmc: Add Alder Lake N support to PMC core
      driver
    - virtio_mmio: Add missing PM calls to freeze/restore
    - virtio_mmio: Restore guest page size on resume
    - netfilter: nf_tables: avoid skb access on nf_stolen
    - netfilter: br_netfilter: do not skip all hooks with 0 priority
    - [arm64] scsi: hisi_sas: Limit max hw sectors for v3 HW
    - [powerpc*] cpufreq: pmac32-cpufreq: Fix refcount leak bug
    - [x86] platform/x86: thinkpad-acpi: profile capabilities as integer
    - [x86] platform/x86: thinkpad_acpi: do not use PSC mode on Intel platforms
    - [x86] platform/x86: hp-wmi: Ignore Sanitization Mode event
    - firmware: sysfb: Make sysfb_create_simplefb() return a pdev pointer
    - firmware: sysfb: Add sysfb_disable() helper function
    - fbdev: Disable sysfb device registration when removing conflicting FBs
    - net: tipc: fix possible refcount leak in tipc_sk_create()
    - nvme-tcp: always fail a request when sending it failed
    - nvme: fix regression when disconnect a recovering ctrl
    - net: sfp: fix memory leak in sfp_probe()
    - ASoC: ops: Fix off by one in range control validation
    - [armhf] pinctrl: aspeed: Fix potential NULL dereference in
      aspeed_pinmux_set_mux()
    - ASoC: Realtek/Maxim SoundWire codecs: disable pm_runtime on remove
    - ASoC: rt711-sdca-sdw: fix calibrate mutex initialization
    - [x86] ASoC: Intel: sof_sdw: handle errors on card registration
    - ASoC: rt711: fix calibrate mutex initialization
    - ASoC: rt7*-sdw: harden jack_detect_handler
    - ASoC: codecs: rt700/rt711/rt711-sdca: initialize workqueues in probe
    - [x86] ASoC: SOF: Intel: hda-dsp: Expose hda_dsp_core_power_up()
    - [x86] ASoC: SOF: Intel: hda-loader: Make sure that the fw load sequence
      is followed
    - [x86] ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow
    - [x86] ASoC: Intel: bytcr_wm5102: Fix GPIO related probe-ordering problem
    - ASoC: wm_adsp: Fix event for preloader
    - ASoC: cs35l41: Correct some control names
    - ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error
    - ASoC: dapm: Initialise kcontrol data for mux/demux controls
    - ASoC: cs35l41: Add ASP TX3/4 source to register patch
    - [amd64] Clear .brk area at early boot
    - [armhf] dts: stm32: use the correct clock source for CEC on stm32mp151
    - Revert "can: xilinx_can: Limit CANFD brp to 2"
    - ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices
    - ALSA: usb-audio: Add quirk for Fiero SC-01
    - ALSA: usb-audio: Add quirk for Fiero SC-01 (fw v1.0.0)
    - nvme-pci: phison e16 has bogus namespace ids
    - nvme: use struct group for generic command dwords
    - signal handling: don't use BUG_ON() for debugging
    - ACPI: video: Fix acpi_video_handles_brightness_key_presses()
    - vt: fix memory overlapping when deleting chars in the buffer
    - [s390x] ap: fix error handling in __verify_queue_reservations()
    - [x86] ACPI: CPPC: Fix enabling CPPC on AMD systems with shared memory
    - serial: 8250: fix return error code in serial8250_request_std_resource()
    - power: supply: core: Fix boundary conditions in interpolation
      (regression in 5.17)
    - [armhf] serial: stm32: Clear prev values before setting RTS delays
    - [arm*] serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle
    - serial: 8250: Fix PM usage_count for console handover
    - [arm64] serial: mvebu-uart: correctly report configured baudrate value
    - [x86] pat: Fix x86_has_pat_wp()
    - [i386] drm/i915/ttm: fix 32b build
    - drm/aperture: Run fbdev removal before internal helpers
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.14
    - [amd64] Preparation for mitigating RETbleed:
      + x86/traps: Use pt_regs directly in fixup_bad_iret()
      + x86/entry: Switch the stack after error_entry() returns
      + x86/entry: Move PUSH_AND_CLEAR_REGS out of error_entry()
      + x86/entry: Don't call error_entry() for XENPV
      + x86/entry: Remove skip_r11rcx
    - [amd64] Add mitigations for RETbleed on AMD/Hygon (CVE-2022-29900) and
      Intel (CVE-2022-29901) processors:
      + x86/kvm/vmx: Make noinstr clean
      + x86/cpufeatures: Move RETPOLINE flags to word 11
      + x86/retpoline: Cleanup some #ifdefery
      + x86/retpoline: Swizzle retpoline thunk
      + x86/retpoline: Use -mfunction-return
      + x86: Undo return-thunk damage
      + x86,objtool: Create .return_sites
      + objtool: skip non-text sections when adding return-thunk sites
      + x86,static_call: Use alternative RET encoding
      + x86/ftrace: Use alternative RET encoding
      + x86/bpf: Use alternative RET encoding
      + x86/kvm: Fix SETcc emulation for return thunks
      + x86/vsyscall_emu/64: Don't use RET in vsyscall emulation
      + x86/sev: Avoid using __x86_return_thunk
      + x86: Use return-thunk in asm code
      + x86/entry: Avoid very early RET
      + objtool: Treat .text.__x86.* as noinstr
      + x86: Add magic AMD return-thunk
      + x86/bugs: Report AMD retbleed vulnerability
      + x86/bugs: Add AMD retbleed= boot parameter
      + x86/bugs: Enable STIBP for JMP2RET
      + x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value
      + x86/entry: Add kernel IBRS implementation
      + x86/bugs: Optimize SPEC_CTRL MSR writes
      + x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS
      + x86/bugs: Split spectre_v2_select_mitigation() and
        spectre_v2_user_select_mitigation()
      + x86/bugs: Report Intel retbleed vulnerability
      + intel_idle: Disable IBRS during long idle
      + objtool: Update Retpoline validation
      + x86/xen: Rename SYS* entry points
      + x86/xen: Add UNTRAIN_RET
      + x86/bugs: Add retbleed=ibpb
      + x86/bugs: Do IBPB fallback check only once
      + objtool: Add entry UNRET validation
      + x86/cpu/amd: Add Spectral Chicken
      + x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n
      + x86/speculation: Fix firmware entry SPEC_CTRL handling
      + x86/speculation: Fix SPEC_CTRL write on SMT state change
      + x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit
      + x86/speculation: Remove x86_spec_ctrl_mask
      + objtool: Re-add UNWIND_HINT_{SAVE_RESTORE}
      + KVM: VMX: Flatten __vmx_vcpu_run()
      + KVM: VMX: Convert launched argument to flags
      + KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
      + KVM: VMX: Fix IBRS handling after vmexit
      + x86/speculation: Fill RSB on vmexit for IBRS
      + KVM: VMX: Prevent RSB underflow before vmenter
      + x86/common: Stamp out the stepping madness
      + x86/cpu/amd: Enumerate BTC_NO
      + x86/retbleed: Add fine grained Kconfig knobs
      + x86/bugs: Add Cannon lake to RETBleed affected CPU list
      + x86/entry: Move PUSH_AND_CLEAR_REGS() back into error_entry
      + x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
      + x86/kexec: Disable RET on kexec
      + x86/speculation: Disable RRSBA behavior
      + x86/static_call: Serialize __static_call_fixup() properly
      + x86/asm/32: Fix ANNOTATE_UNRET_SAFE use on 32-bit
      + x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current
      + efi/x86: use naked RET on mixed mode call wrapper
      + x86/kvm: fix FASTOP_SIZE when return thunks are enabled
      + KVM: emulate: do not adjust size of fastop and setcc subroutines
      + tools arch x86: Sync the msr-index.h copy with the kernel sources
      + tools headers cpufeatures: Sync with the kernel sources
      + x86/bugs: Remove apostrophe typo
      + um: Add missing apply_returns()

  [ John Paul Adrian Glaubitz ]
  * [ia64] Disable CONFIG_HARDENED_USERCOPY which is currently broken

  [ Ben Hutchings ]
  * [arm64] pinctrl: Re-enable PINCTRL_MSM (regression in 5.14)
  * lintian: Update overrides for lintian 2.115
  * [rt] Update to 5.18-rt11:
    - Revert "softirq: Check preemption after reenabling interrupts"
  * Bump ABI to 3
  * Disable SECURITY_LOCKDOWN_LSM and MODULE_SIG where we don't sign code
    (Closes: #825141)
  * tools/bpf, tools/perf: Update for init_disassemble_info() API change in
    binutils 2.38.50
  * tools/perf: Fix "unused parameter" warning introduced by "tools/perf:
    pmu-events: Fix reproducibility"
  * [amd64,arm64,armhf] wireguard: Clear keys after suspend despite
    CONFIG_ANDROID=y
  * d/salsa-ci.yml: Sync build-script with upstream
  * d/salsa-ci.yml: Handle APT sources in debian.sources as well as
    sources.list
  * d/tests: Remove obsolete dependencies of python test
  * d/tests: Add kbuild test that builds a trivial OOT module
  * linux-kbuild: Add missing pahole-version.sh script
  * [amd64] ata: Enable PATA_LEGACY (Closes: #910010)
  * udeb: Add essiv to crypto-modules (Closes: #973378)
  * udeb: Add SCSI device handlers to multipath-modules (Closes: #989079)
  * linux-source: Update Recommends to include all dependencies for deb-pkg
    target
  * [x86] speculation: Make all RETbleed mitigations depend on X86_64

  [ Vincent Blut ]
  * [armhf] drivers/crypto/caam: Enable CRYPTO_DEV_FSL_CAAM as module
    (Closes: #1013255)
  * drivers/net/wireless/mediatek/mt76/mt7921: Enable MT7921U as module
    (Closes: #1015808)

 -- Ben Hutchings <benh@debian.org>  Sat, 23 Jul 2022 18:29:57 +0200

linux (5.18.5-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.3
    - binfmt_flat: do not stop relocating GOT entries prematurely on riscv
    - parisc: fix a crash with multicore scheduler
    - parisc/stifb: Implement fb_is_primary_device()
    - parisc/stifb: Keep track of hardware path of graphics card
    - RISC-V: Mark IORESOURCE_EXCLUSIVE for reserved mem instead of
      IORESOURCE_BUSY
    - riscv: Initialize thread pointer before calling C functions
    - riscv: Fix irq_work when SMP is disabled
    - riscv: Wire up memfd_secret in UAPI header
    - riscv: Move alternative length validation into subsection
    - ALSA: hda/realtek - Add new type for ALC245
    - ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop
    - ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS
    - ALSA: usb-audio: Cancel pending work at closing a MIDI substream
    - USB: serial: pl2303: fix type detection for odd device
    - USB: serial: option: add Quectel BG95 modem
    - USB: new quirk for Dell Gen 2 devices
    - usb: isp1760: Fix out-of-bounds array access
    - usb: dwc3: gadget: Move null pinter check to proper place
    - usb: core: hcd: Add support for deferring roothub registration
    - fs/ntfs3: provide block_invalidate_folio to fix memory leak
    - fs/ntfs3: Update valid size if -EIOCBQUEUED
    - fs/ntfs3: Fix fiemap + fix shrink file size (to remove preallocated space)
    - fs/ntfs3: Keep preallocated only if option prealloc enabled
    - fs/ntfs3: Check new size for limits
    - fs/ntfs3: In function ntfs_set_acl_ex do not change inode->i_mode if
      called from function ntfs_init_acl
    - fs/ntfs3: Fix some memory leaks in an error handling path of
      'log_replay()'
    - fs/ntfs3: Update i_ctime when xattr is added
    - fs/ntfs3: Restore ntfs_xattr_get_acl and ntfs_xattr_set_acl functions
    - cifs: don't call cifs_dfs_query_info_nonascii_quirk() if nodfs was set
    - cifs: fix ntlmssp on old servers
    - cifs: fix potential double free during failed mount
    - cifs: when extending a file with falloc we should make files not-sparse
    - xhci: Set HCD flag to defer primary roothub registration
    - xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI
    - platform/x86: intel-hid: fix _DSM function index handling
    - x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails
    - perf/x86/intel: Fix event constraints for ICL
    - x86/kexec: fix memory leak of elf header buffer
    - x86/sgx: Set active memcg prior to shmem allocation
    - kthread: Don't allocate kthread_struct for init and umh
    - ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP
    - ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
    - ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
    - btrfs: add "0x" prefix for unsupported optional features
    - btrfs: return correct error number for __extent_writepage_io()
    - btrfs: repair super block num_devices automatically
    - btrfs: fix the error handling for submit_extent_page() for
      btrfs_do_readpage()
    - btrfs: fix deadlock between concurrent dio writes when low on free data
      space
    - btrfs: zoned: properly finish block group on metadata write
    - btrfs: zoned: zone finish unused block group
    - btrfs: zoned: finish block group when there are no more allocatable bytes
      left
    - btrfs: zoned: fix comparison of alloc_offset vs meta_write_pointer
    - iommu/vt-d: Add RPLS to quirk list to skip TE disabling
    - drm/selftests: fix a shift-out-of-bounds bug
    - drm/vmwgfx: validate the screen formats
    - ath11k: fix the warning of dev_wake in mhi_pm_disable_transition()
    - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
    - selftests/bpf: Fix vfs_link kprobe definition
    - selftests/bpf: Fix parsing of prog types in UAPI hdr for bpftool sync
    - ath11k: Change max no of active probe SSID and BSSID to fw capability
    - selftests/bpf: Fix file descriptor leak in load_kallsyms()
    - rtw89: ser: fix CAM leaks occurring in L2 reset
    - rtw89: fix misconfiguration on hw_scan channel time
    - mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue
    - b43legacy: Fix assigning negative value to unsigned variable
    - b43: Fix assigning negative value to unsigned variable
    - ipw2x00: Fix potential NULL dereference in libipw_xmit()
    - ipv6: fix locking issues with loops over idev->addr_list
    - fbcon: Consistently protect deferred_takeover with console_lock()
    - x86/platform/uv: Update TSC sync state for UV5
    - ACPICA: Avoid cache flush inside virtual machines
    - libbpf: Fix a bug with checking bpf_probe_read_kernel() support in old
      kernels
    - mac80211: minstrel_ht: fix where rate stats are stored (fixes debugfs
      output)
    - drm/komeda: return early if drm_universal_plane_init() fails.
    - drm/amd/display: Disabling Z10 on DCN31
    - rcu-tasks: Fix race in schedule and flush work
    - rcu-tasks: Handle sparse cpu_possible_mask in rcu_tasks_invoke_cbs()
    - rcu: Make TASKS_RUDE_RCU select IRQ_WORK
    - sfc: ef10: Fix assigning negative value to unsigned variable
    - ALSA: jack: Access input_dev under mutex
    - rtw88: fix incorrect frequency reported
    - rtw88: 8821c: fix debugfs rssi value
    - spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA
      direction
    - tools/power turbostat: fix ICX DRAM power numbers
    - tcp: consume incoming skb leading to a reset
    - loop: implement ->free_disk
    - scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg()
    - scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock
    - scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and
      PLOGI
    - scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT
    - scsi: lpfc: Fix call trace observed during I/O with CMF enabled
    - cpuidle: PSCI: Improve support for suspend-to-RAM for PSCI OSI mode
    - drm/amdgpu/pm: fix the null pointer while the smu is disabled
    - drm/amd/pm: fix double free in si_parse_power_table()
    - ASoC: rsnd: care default case on rsnd_ssiu_busif_err_status_clear()
    - ASoC: rsnd: care return value from rsnd_node_fixed_index()
    - net: macb: In ZynqMP initialization make SGMII phy configuration optional
    - ath9k: fix QCA9561 PA bias level
    - media: Revert "media: dw9768: activate runtime PM and turn off device"
    - media: i2c: dw9714: Disable the regulator when the driver fails to probe
    - media: venus: hfi: avoid null dereference in deinit
    - media: venus: do not queue internal buffers from previous sequence
    - media: pci: cx23885: Fix the error handling in cx23885_initdev()
    - media: cx25821: Fix the warning when removing the module
    - md/bitmap: don't set sb values if can't pass sanity check
    - mmc: jz4740: Apply DMA engine limits to maximum segment size
    - drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit
    - scsi: megaraid: Fix error check return value of register_chrdev()
    - drm/amdgpu/sdma: Fix incorrect calculations of the wptr of the doorbells
    - scsi: ufs: Use pm_runtime_resume_and_get() instead of
      pm_runtime_get_sync()
    - scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()
    - ath11k: disable spectral scan during spectral deinit
    - ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408
    - drm/plane: Move range check for format_count earlier
    - drm/amdkfd: Fix circular lock dependency warning
    - drm/amd/pm: fix the compile warning
    - ath10k: skip ath10k_halt during suspend for driver state RESTARTING
    - arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall
    - drm: msm: fix error check return value of irq_of_parse_and_map()
    - drm/msm/dpu: Clean up CRC debug logs
    - xtensa: move trace_hardirqs_off call back to entry.S
    - ath11k: fix warning of not found station for bssid in message
    - scsi: target: tcmu: Fix possible data corruption
    - ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL
    - net/mlx5: use kvfree() for kvzalloc() in mlx5_ct_fs_smfs_matcher_create
    - net/mlx5: fs, delete the FTE when there are no rules attached to it
    - ASoC: dapm: Don't fold register value changes into notifications
    - ASoC: SOF: ipc3-topology: Correct get_control_data for non bytes payload
    - mlxsw: spectrum_dcb: Do not warn about priority changes
    - mlxsw: Treat LLDP packets as control
    - drm/amdgpu/psp: move PSP memory alloc from hw_init to sw_init
    - drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo
    - regulator: mt6315: Enforce regulator-compatible, not name
    - ice: always check VF VSI pointer values
    - HID: bigben: fix slab-out-of-bounds Write in bigben_probe
    - drm/tegra: gem: Do not try to dereference ERR_PTR()
    - of: Support more than one crash kernel regions for kexec -s
    - ASoC: tscs454: Add endianness flag in snd_soc_component_driver
    - net/mlx5: Increase FW pre-init timeout for health recovery
    - ASoC: Intel: sof_ssp_amp: fix no DMIC BE Link on Chromebooks
    - scsi: hisi_sas: Undo RPM resume for failed notify phy event for v3 HW
    - scsi: lpfc: Inhibit aborts if external loopback plug is inserted
    - scsi: lpfc: Alter FPIN stat accounting logic
    - net: remove two BUG() from skb_checksum_help()
    - s390/preempt: disable __preempt_count_add() optimization for
      PROFILE_ALL_BRANCHES
    - perf/amd/ibs: Cascade pmu init functions' return value
    - sched/core: Avoid obvious double update_rq_clock warning
    - spi: stm32-qspi: Fix wait_cmd timeout in APM mode
    - dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC
    - fs: hold writers when changing mount's idmapping
    - ASoC: SOF: amd: add missing platform_device_unregister in acp_pci_rn_probe
    - ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
    - ipmi:ssif: Check for NULL msg when handling events and messages
    - ipmi: Add an intializer for ipmi_smi_msg struct
    - ipmi: Fix pr_fmt to avoid compilation issues
    - kunit: bail out of test filtering logic quicker if OOM
    - rtlwifi: Use pr_warn instead of WARN_ONCE
    - mt76: mt7915: accept rx frames with non-standard VHT MCS10-11
    - mt76: mt7921: accept rx frames with non-standard VHT MCS10-11
    - mt76: fix encap offload ethernet type check
    - media: rga: fix possible memory leak in rga_probe
    - media: coda: limit frame interval enumeration to supported encoder frame
      sizes
    - media: hantro: HEVC: unconditionnaly set pps_{cb/cr}_qp_offset values
    - media: ccs-core.c: fix failure to call clk_disable_unprepare
    - media: imon: reorganize serialization
    - media: cec-adap.c: fix is_configuring state
    - usbnet: Run unregister_netdev() before unbind() again
    - Bluetooth: HCI: Add HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk
    - Bluetooth: btusb: Set HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN for QCA
    - Bluetooth: btusb: Set HCI_QUIRK_BROKEN_ERR_DATA_REPORTING for QCA
    - bnxt_en: Configure ptp filters during bnxt open
    - media: mediatek: vcodec: prevent kernel crash when rmmod mtk-vcodec-dec.ko
    - openrisc: start CPU timer early in boot
    - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
    - ASoC: rt5645: Fix errorenous cleanup order
    - nbd: Fix hung on disconnect request if socket is closed before
    - drm/amd/pm: update smartshift powerboost calc for smu12
    - drm/amd/pm: update smartshift powerboost calc for smu13
    - drm/amdgpu: Move mutex_init(&smu->message_lock) to smu_early_init()
    - btrfs: fix anon_dev leak in create_subvol()
    - kunit: tool: make parser stop overwriting status of suites w/ no_tests
    - net: phy: micrel: Allow probing without .driver_data
    - media: exynos4-is: Fix compile warning
    - media: hantro: Stop using H.264 parameter pic_num
    - rtw89: cfo: check mac_id to avoid out-of-bounds
    - of/fdt: Ignore disabled memory nodes
    - blk-throttle: Set BIO_THROTTLED when bio has been throttled
    - ASoC: max98357a: remove dependency on GPIOLIB
    - ASoC: rt1015p: remove dependency on GPIOLIB
    - ACPI: CPPC: Assume no transition latency if no PCCT
    - nvme: set non-mdts limits in nvme_scan_work
    - can: mcp251xfd: silence clang's -Wunaligned-access warning
    - x86/microcode: Add explicit CPU vendor dependency
    - net: ipa: ignore endianness if there is no header
    - selftests/bpf: Add missing trampoline program type to trampoline_count
      test
    - m68k: atari: Make Atari ROM port I/O write macros return void
    - hwmon: (pmbus) Add get_voltage/set_voltage ops
    - rxrpc: Return an error to sendmsg if call failed
    - rxrpc, afs: Fix selection of abort codes
    - afs: Adjust ACK interpretation to try and cope with NAT
    - eth: tg3: silence the GCC 12 array-bounds warning
    - char: tpm: cr50_i2c: Suppress duplicated error message in .remove()
    - selftests/bpf: fix btf_dump/btf_dump due to recent clang change
    - gfs2: use i_lock spin_lock for inode qadata
    - linux/types.h: reinstate "__bitwise__" macro for user space use
    - scsi: target: tcmu: Avoid holding XArray lock when calling lock_page
    - kunit: fix executor OOM error handling logic on non-UML
    - IB/rdmavt: add missing locks in rvt_ruc_loopback
    - PCI/ASPM: Make Intel DG2 L1 acceptable latency unlimited
    - ARM: dts: ox820: align interrupt controller node name with dtschema
    - ARM: dts: socfpga: align interrupt controller node name with dtschema
    - ARM: dts: s5pv210: align DMA channels with dtschema
    - ASoC: amd: Add driver data to acp6x machine driver
    - arm64: dts: qcom: msm8994: Fix the cont_splash_mem address
    - arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count
    - PM / devfreq: rk3399_dmc: Disable edev on remove()
    - crypto: ccree - use fine grained DMA mapping dir
    - crypto: qat - fix off-by-one error in PFVF debug print
    - soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc
    - fs: jfs: fix possible NULL pointer dereference in dbFree()
    - arm64: dts: qcom: sdm845-xiaomi-beryllium: fix typo in panel's
      vddio-supply property
    - ALSA: usb-audio: Add quirk bits for enabling/disabling generic implicit fb
    - ALSA: usb-audio: Move generic implicit fb quirk entries into quirks.c
    - ARM: OMAP1: clock: Fix UART rate reporting algorithm
    - powerpc/fadump: Fix fadump to work with a different endian capture kernel
    - fat: add ratelimit to fat*_ent_bread()
    - pinctrl: renesas: rzn1: Fix possible null-ptr-deref in
      sh_pfc_map_resources()
    - ARM: versatile: Add missing of_node_put in dcscb_init
    - ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM
    - arm64: dts: qcom: sc7280-idp: Configure CTS pin to bias-bus-hold for
      bluetooth
    - arm64: dts: qcom: sc7280-qcard: Configure CTS pin to bias-bus-hold for
      bluetooth
    - ARM: hisi: Add missing of_node_put after of_find_compatible_node
    - cpufreq: Avoid unnecessary frequency updates due to mismatch
    - PCI: microchip: Add missing chained_irq_enter()/exit() calls
    - powerpc/rtas: Keep MSR[RI] set when calling RTAS
    - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
    - PCI: cadence: Clear FLR in device capabilities register
    - KVM: PPC: Book3S HV Nested: L2 LPCR should inherit L1 LPES setting
    - alpha: fix alloc_zeroed_user_highpage_movable()
    - tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate
    - cifs: return ENOENT for DFS lookup_cache_entry()
    - powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr
    - powerpc/xics: fix refcount leak in icp_opal_init()
    - powerpc/powernv: fix missing of_node_put in uv_init()
    - macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled
    - powerpc/iommu: Add missing of_node_put in iommu_init_early_dart
    - fanotify: fix incorrect fmode_t casts
    - smb3: check for null tcon
    - RDMA/hfi1: Prevent panic when SDMA is disabled
    - cifs: do not use tcpStatus after negotiate completes
    - Input: gpio-keys - cancel delayed work only in case of GPIO
    - drm: fix EDID struct for old ARM OABI format
    - drm/bridge_connector: enable HPD by default if supported
    - drm/selftests: missing error code in igt_buddy_alloc_smoke()
    - drm/omap: fix NULL but dereferenced coccicheck error
    - dt-bindings: display: sitronix, st7735r: Fix backlight in example
    - drm/bridge: anx7625: check the return on anx7625_aux_trans
    - drm: ssd130x: Fix COM scan direction register mask
    - drm: ssd130x: Always apply segment remap setting
    - drm/solomon: Make DRM_SSD130X depends on MMU
    - drm/format-helper: Rename drm_fb_xrgb8888_to_mono_reversed()
    - drm/format-helper: Fix XRGB888 to monochrome conversion
    - drm/ssd130x: Fix rectangle updates
    - drm/ssd130x: Reduce temporary buffer sizes
    - fbdev: defio: fix the pagelist corruption
    - drm/vmwgfx: Fix an invalid read
    - ath11k: acquire ab->base_lock in unassign when finding the peer by addr
    - drm: bridge: it66121: Fix the register page length
    - drm/bridge: it6505: Fix build error
    - ath9k: fix ar9003_get_eepmisc
    - drm/edid: fix invalid EDID extension block filtering
    - drm/bridge: anx7625: add missing destroy_workqueue() in
      anx7625_i2c_probe()
    - drm/bridge: adv7511: clean up CEC adapter when probe fails
    - drm: bridge: icn6211: Fix register layout
    - drm: bridge: icn6211: Fix HFP_HSW_HBP_HI and HFP_MIN handling
    - mtd: spinand: gigadevice: fix Quad IO for GD5F1GQ5UExxG
    - spi: qcom-qspi: Add minItems to interconnect-names
    - ASoC: codecs: Fix error handling in power domain init and exit handlers
    - ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t
    - ASoC: SOF: ipc3-topology: Set scontrol->priv to NULL after freeing it
    - ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
    - ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
    - docs: driver-api/thermal/intel_dptf: Use copyright symbol
    - x86/delay: Fix the wrong asm constraint in delay_loop()
    - drm/mediatek: Add vblank register/unregister callback functions
    - drm/mediatek: Fix DPI component detection for MT8192
    - drm/vc4: kms: Take old state core clock rate into account
    - drm/vc4: hvs: Fix frame count register readout
    - drm/mediatek: Fix mtk_cec_mask()
    - drm/amd/amdgpu: Only reserve vram for firmware with vega9 MS_HYPERV host.
    - drm/vc4: hvs: Reset muxes at probe time
    - drm/vc4: txp: Don't set TXP_VSTART_AT_EOF
    - drm/vc4: txp: Force alpha to be 0xff if it's disabled
    - libbpf: Don't error out on CO-RE relos for overriden weak subprogs
    - x86/PCI: Fix ALi M1487 (IBC) PIRQ router link value interpretation
    - mptcp: optimize release_cb for the common case
    - mptcp: reset the packet scheduler on incoming MP_PRIO
    - mptcp: reset the packet scheduler on PRIO change
    - nl80211: show SSID for P2P_GO interfaces
    - drm/komeda: Fix an undefined behavior bug in komeda_plane_add()
    - drm: mali-dp: potential dereference of null pointer
    - drm/amd/amdgpu: Fix asm/hypervisor.h build error.
    - spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout
    - scftorture: Fix distribution of short handler delays
    - net: ethernet: ti: am65-cpsw: Fix build error without PHYLINK
    - net: dsa: mt7530: 1G can also support 1000BASE-X link mode
    - ixp4xx_eth: fix error check return value of platform_get_irq()
    - NFC: NULL out the dev->rfkill to prevent UAF
    - cpufreq: governor: Use kobject release() method to free dbs_data
    - efi: Allow to enable EFI runtime services by default on RT
    - efi: Add missing prototype for efi_capsule_setup_info
    - device property: Allow error pointer to be passed to fwnode APIs
    - drm/amd/amdgpu: Remove static from variable in RLCG Reg RW
    - net: dsa: qca8k: correctly handle mdio read error
    - target: remove an incorrect unmap zeroes data deduction
    - drbd: remove assign_p_sizes_qlim
    - drbd: use bdev based limit helpers in drbd_send_sizes
    - drbd: use bdev_alignment_offset instead of queue_alignment_offset
    - drbd: fix duplicate array initializer
    - EDAC/dmc520: Don't print an error for each unconfigured interrupt line
    - bpf: Move rcu lock management out of BPF_PROG_RUN routines
    - drm/bridge: anx7625: Use uint8 for lane-swing arrays
    - mtd: rawnand: denali: Use managed device resources
    - HID: hid-led: fix maximum brightness for Dream Cheeky
    - HID: elan: Fix potential double free in elan_input_configured
    - drm/bridge: Fix error handling in analogix_dp_probe
    - regulator: da9121: Fix uninit-value in da9121_assign_chip_model()
    - drm/mediatek: dpi: Use mt8183 output formats for mt8192
    - signal: Deliver SIGTRAP on perf event asynchronously if blocked
    - sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq
    - sched/psi: report zeroes for CPU full at the system level
    - spi: img-spfi: Fix pm_runtime_get_sync() error checking
    - drm/bridge: Fix it6505 Kconfig DRM_DP_AUX_BUS dependency
    - cpufreq: Fix possible race in cpufreq online error path
    - printk: add missing memory barrier to wake_up_klogd()
    - printk: wake waiters for safe and NMI contexts
    - ath9k_htc: fix potential out of bounds access with invalid
      rxstatus->rs_keyix
    - media: i2c: max9286: fix kernel oops when removing module
    - media: amphion: fix decoder's interlaced field
    - media: hantro: Implement support for encoder commands
    - media: hantro: Empty encoder capture buffers by default
    - media: imx: imx-mipi-csis: Rename csi_state to mipi_csis_device
    - media: imx: imx-mipi-csis: Fix active format initialization on source pad
    - drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01
    - ALSA: pcm: Check for null pointer of pointer substream before
      dereferencing it
    - mtdblock: warn if opened on NAND
    - inotify: show inotify mask flags in proc fdinfo
    - fsnotify: fix wrong lockdep annotations
    - spi: rockchip: fix missing error on unsupported SPI_CS_HIGH
    - of: overlay: do not break notify on NOTIFY_{OK|STOP}
    - selftests/damon: add damon to selftests root Makefile
    - drm/msm: properly add and remove internal bridges
    - drm/msm/dpu: adjust display_v_end for eDP and DP
    - scsi: iscsi: Fix harmless double shift bug
    - scsi: ufs: qcom: Fix ufs_qcom_resume()
    - scsi: ufs: core: Exclude UECxx from SFR dump list
    - drm/v3d: Fix null pointer dereference of pointer perfmon
    - selftests/resctrl: Fix null pointer dereference on open failed
    - libbpf: Fix logic for finding matching program for CO-RE relocation
    - mtd: spi-nor: core: Check written SR value in
      spi_nor_write_16bit_sr_and_check()
    - x86/pm: Fix false positive kmemleak report in msr_build_context()
    - mtd: rawnand: cadence: fix possible null-ptr-deref in
      cadence_nand_dt_probe()
    - mtd: rawnand: intel: fix possible null-ptr-deref in ebu_nand_probe()
    - x86/speculation: Add missing prototype for unpriv_ebpf_notify()
    - ASoC: rk3328: fix disabling mclk on pclk probe failure
    - perf tools: Add missing headers needed by util/data.h
    - drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory
      free during pm runtime resume
    - drm/msm/dp: stop event kernel thread when DP unbind
    - drm/msm/dp: fix error check return value of irq_of_parse_and_map()
    - drm/msm/dp: reset DP controller before transmit phy test pattern
    - drm/msm/dp: do not stop transmitting phy test pattern during DP phy
      compliance test
    - drm/msm/dsi: fix error checks and return values for DSI xmit functions
    - drm/msm/hdmi: check return value after calling
      platform_get_resource_byname()
    - drm/msm/hdmi: fix error check return value of irq_of_parse_and_map()
    - drm/msm: add missing include to msm_drv.c
    - drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H
    - drm/bridge: it6505: Send DPCD SET_POWER to downstream
    - drm/msm: Fix null pointer dereferences without iommu
    - kunit: fix debugfs code to use enum kunit_status, not bool
    - drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
    - spi: cadence-quadspi: fix Direct Access Mode disable for SoCFPGA
    - perf tools: Use Python devtools for version autodetection rather than
      runtime
    - virtio_blk: fix the discard_granularity and discard_alignment queue limits
    - nl80211: don't hold RTNL in color change request
    - x86: Fix return value of __setup handlers
    - irqchip/exiu: Fix acknowledgment of edge triggered interrupts
    - irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
    - irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value
    - x86/mm: Cleanup the control_va_addr_alignment() __setup handler
    - arm64: fix types in copy_highpage()
    - regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET
    - wl1251: dynamically allocate memory used for DMA
    - linkage: Fix issue with missing symbol size
    - ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init()
    - drm/msm/disp/dpu1: avoid clearing hw interrupts if hw_intr is null during
      drm uninit
    - drm/msm/dsi: fix address for second DSI PHY on SDM660
    - drm/msm/dp: fix event thread stuck in wait_event after kthread_stop()
    - drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is
      detected
    - drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is
      detected
    - drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
    - media: uvcvideo: Fix missing check to determine if element is found in
      list
    - arm64: stackleak: fix current_top_of_stack()
    - iomap: iomap_write_failed fix
    - spi: spi-fsl-qspi: check return value after calling
      platform_get_resource_byname()
    - selftests/bpf: Prevent skeleton generation race
    - Revert "cpufreq: Fix possible race in cpufreq online error path"
    - regulator: qcom_smd: Fix up PM8950 regulator configuration
    - samples: bpf: Don't fail for a missing VMLINUX_BTF when VMLINUX_H is
      provided
    - perf/amd/ibs: Use interrupt regs ip for stack unwinding
    - ath11k: Don't check arvif->is_started before sending management frames
    - scsi: lpfc: Fix element offset in __lpfc_sli_release_iocbq_s4()
    - scsi: lpfc: Fix dmabuf ptr assignment in lpfc_ct_reject_event()
    - wilc1000: fix crash observed in AP mode with cfg80211_register_netdevice()
    - HID: amd_sfh: Modify the bus name
    - HID: amd_sfh: Modify the hid name
    - ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe
    - ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe
    - ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
    - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
    - PM: EM: Decrement policy counter
    - dma-direct: don't fail on highmem CMA pages in dma_direct_alloc_pages
    - ASoC: samsung: Fix refcount leak in aries_audio_probe
    - block: Fix the bio.bi_opf comment
    - kselftest/cgroup: fix test_stress.sh to use OUTPUT dir
    - scripts/faddr2line: Fix overlapping text section failures
    - media: aspeed: Fix an error handling path in aspeed_video_probe()
    - media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe
    - mt76: mt7915: fix DBDC default band selection on MT7915D
    - mt76: mt7921: honor pm user configuration in mt7921_sniffer_interface_iter
    - mt76: mt7915: fix unbounded shift in mt7915_mcu_beacon_mbss
    - mt76: mt7921: Fix the error handling path of mt7921_pci_probe()
    - mt76: mt7915: fix possible uninitialized pointer dereference in
      mt7986_wmac_gpio_setup
    - mt76: mt7915: fix possible NULL pointer dereference in
      mt7915_mac_fill_rx_vector
    - mt76: mt7915: do not pass data pointer to mt7915_mcu_muru_debug_set
    - mt76: mt7915: report rx mode value in mt7915_mac_fill_rx_rate
    - mt76: fix antenna config missing in 6G cap
    - mt76: mt7921: fix kernel crash at mt7921_pci_remove
    - mt76: do not attempt to reorder received 802.3 packets without agg session
    - mt76: fix tx status related use-after-free race on station removal
    - mt76: mt7915: fix twt table_mask to u16 in mt7915_dev
    - media: st-delta: Fix PM disable depth imbalance in delta_probe
    - media: atmel: atmel-isc: Fix PM disable depth imbalance in atmel_isc_probe
    - media: i2c: rdacm2x: properly set subdev entity function
    - media: exynos4-is: Change clk_disable to clk_disable_unprepare
    - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
    - media: make RADIO_ADAPTERS tristate
    - media: vsp1: Fix offset calculation for plane cropping
    - media: atmel: atmel-sama5d2-isc: fix wrong mask in YUYV format check
    - media: hantro: HEVC: Fix tile info buffer value computation
    - Bluetooth: mt7921s: Fix the incorrect pointer check
    - Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
    - Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring
    - Bluetooth: use hdev lock for accept_list and reject_list in conn req
    - Bluetooth: protect le accept and resolv lists with hdev->lock
    - Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event
    - Bluetooth: btmtksdio: fix possible FW initialization failure
    - Bluetooth: btmtksdio: fix the reset takes too long
    - media: mediatek: vcodec: Fix v4l2 compliance decoder cmd test fail
    - io_uring: avoid io-wq -EAGAIN looping for !IOPOLL
    - io_uring: only wake when the correct events are set
    - irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling
    - irqchip/gic-v3: Refactor ISB + EOIR at ack time
    - irqchip/gic-v3: Fix priority mask handling
    - nvme: set dma alignment to dword
    - m68k: math-emu: Fix dependencies of math emulation support
    - net: annotate races around sk->sk_bound_dev_if
    - sctp: read sk->sk_bound_dev_if once in sctp_rcv()
    - net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init
    - ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_*
    - kselftest/arm64: bti: force static linking
    - media: ov7670: remove ov7670_power_off from ov7670_remove
    - media: i2c: ov2640: Depend on V4L2_ASYNC
    - media: i2c: ov5648: fix wrong pointer passed to IS_ERR() and PTR_ERR()
    - media: rkvdec: h264: Fix dpb_valid implementation
    - media: rkvdec: h264: Fix bit depth wrap in pps packet
    - regulator: scmi: Fix refcount leak in scmi_regulator_probe
    - blk-cgroup: always terminate io.stat lines
    - erofs: fix buffer copy overflow of ztailpacking feature
    - net/mlx5e: Correct the calculation of max channels for rep
    - ext4: reject the 'commit' option on ext2 filesystems
    - drm/msm/dsi: don't powerup at modeset time for parade-ps8640
    - drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init
    - drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
    - x86/sev: Annotate stack change in the #VC handler
    - drm/msm: don't free the IRQ if it was not requested
    - selftests/bpf: Add missed ima_setup.sh in Makefile
    - drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path
    - drm/i915: Fix CFI violation with show_dynamic_id()
    - thermal/drivers/bcm2711: Don't clamp temperature at zero
    - thermal/drivers/broadcom: Fix potential NULL dereference in
      sr_thermal_probe
    - thermal/core: Fix memory leak in __thermal_cooling_device_register()
    - thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe
    - bfq: Relax waker detection for shared queues
    - bfq: Allow current waker to defend against a tentative one
    - ASoC: codecs: lpass: Fix passing zero to 'PTR_ERR'
    - ASoC: wm2000: fix missing clk_disable_unprepare() on error in
      wm2000_anc_transition()
    - cpuidle: psci: Fix regression leading to no genpd governor
    - cpuidle: riscv-sbi: Fix code to allow a genpd governor to be used
    - platform/x86: intel_cht_int33fe: Set driver data
    - PM: domains: Fix initialization of genpd's next_wakeup
    - net: macb: Fix PTP one step sync support
    - scsi: hisi_sas: Fix rescan after deleting a disk
    - scsi: hisi_sas: Fix memory ordering in hisi_sas_task_deliver()
    - NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx
    - bonding: fix missed rcu protection
    - ASoC: max98090: Move check for invalid values before casting in
      max98090_put_enab_tlv()
    - perf parse-events: Support different format of the topdown event name
    - net: stmmac: fix out-of-bounds access in a selftest
    - amt: fix gateway mode stuck
    - amt: fix memory leak for advertisement message
    - hv_netvsc: Fix potential dereference of NULL pointer
    - hwmon: (dimmtemp) Fix bitmap handling
    - hwmon: (pmbus) Check PEC support before reading other registers
    - rxrpc: Fix locking issue
    - rxrpc: Fix listen() setting the bar too high for the prealloc rings
    - rxrpc: Don't try to resend the request if we're receiving the reply
    - rxrpc: Fix overlapping ACK accounting
    - rxrpc: Don't let ack.previousPacket regress
    - rxrpc: Fix decision on when to generate an IDLE ACK
    - hinic: Avoid some over memory allocation
    - dpaa2-eth: retrieve the virtual address before dma_unmap
    - dpaa2-eth: use the correct software annotation field
    - dpaa2-eth: unmap the SGT buffer before accessing its contents
    - net: dsa: restrict SMSC_LAN9303_I2C kconfig
    - net/smc: postpone sk_refcnt increment in connect()
    - net/smc: fix listen processing for SMC-Rv2
    - dma-direct: don't over-decrypt memory
    - Bluetooth: hci_conn: Fix hci_connect_le_sync
    - Revert "net/smc: fix listen processing for SMC-Rv2"
    - media: lirc: revert removal of unused feature flags
    - arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399
    - arm64: dts: mt8192: Fix nor_flash status disable typo
    - PCI/ACPI: Allow D3 only if Root Port can signal and wake from D3
    - memory: samsung: exynos5422-dmc: Avoid some over memory allocation
    - ARM: dts: BCM5301X: Update pin controller node name
    - ARM: dts: suniv: F1C100: fix watchdog compatible
    - soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc
    - soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
    - arm64: defconfig: reenable SM_DISPCC_8250
    - PCI: cadence: Fix find_first_zero_bit() limit
    - PCI: rockchip: Fix find_first_zero_bit() limit
    - PCI: mediatek: Fix refcount leak in mtk_pcie_subsys_powerup()
    - PCI: dwc: Fix setting error return on MSI DMA mapping failure
    - ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks
    - arm64: dts: qcom: sc7280: Fix sar1_irq_odl node name
    - arm64: dts: qcom: sc7280-herobrine: Drop outputs on fpmcu pins
    - soc: qcom: llcc: Add MODULE_DEVICE_TABLE()
    - cxl/pci: Add debug for DVSEC range init failures
    - cxl/pci: Make cxl_dvsec_ranges() failure not fatal to cxl_pci
    - KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry
    - KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault
    - arm64: dts: juno: Fix SCMI power domain IDs for ETF and CS funnel
    - crypto: qat - set CIPHER capability for DH895XCC
    - crypto: qat - set COMPRESSION capability for DH895XCC
    - platform/chrome: cros_ec: fix error handling in cros_ec_register()
    - ARM: dts: imx6dl-colibri: Fix I2C pinmuxing
    - platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls
    - can: xilinx_can: mark bit timing constants as const
    - ARM: dts: stm32: Fix PHY post-reset delay on Avenger96
    - dt-bindings: soc: qcom: smd-rpm: Fix missing MSM8936 compatible
    - ARM: dts: qcom: sdx55: remove wrong unit address from RPMH RSC clocks
    - arm64: dts: qcom: sm8450: Fix missing iommus for qup
    - arm64: dts: qcom: sm8450: Fix missing iommus for qup1
    - ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT
    - ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C
    - ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED
    - ARM: dts: bcm2835-rpi-b: Fix GPIO line names
    - misc: ocxl: fix possible double free in ocxl_file_register_afu
    - hwrng: cn10k - Optimize cn10k_rng_read()
    - hwrng: cn10k - Make check_rng_health() return an error code
    - crypto: marvell/cesa - ECB does not IV
    - gpiolib: of: Introduce hook for missing gpio-ranges
    - pinctrl: bcm2835: implement hook for missing gpio-ranges
    - drm/msm: simplify gpu_busy callback
    - drm/msm: return the average load over the polling period
    - arm: mediatek: select arch timer for mt7629
    - pinctrl/rockchip: support deferring other gpio params
    - pinctrl: mediatek: mt8195: enable driver on mtk platforms
    - arm64: dts: qcom: qrb5165-rb5: Fix can-clock node name
    - Drivers: hv: vmbus: Fix handling of messages with transaction ID of zero
    - powerpc/fadump: fix PT_LOAD segment for boot memory area
    - mfd: ipaq-micro: Fix error check return value of platform_get_irq()
    - scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()
    - soc: bcm: Check for NULL return of devm_kzalloc()
    - arm64: dts: ti: k3-am64-mcu: remove incorrect UART base clock rates
    - ASoC: sh: rz-ssi: Propagate error codes returned from
      platform_get_irq_byname()
    - ASoC: sh: rz-ssi: Release the DMA channels in rz_ssi_probe() error path
    - firmware: arm_scmi: Fix list protocols enumeration in the base protocol
    - nvdimm: Fix firmware activation deadlock scenarios
    - nvdimm: Allow overwrite in the presence of disabled dimms
    - pinctrl: mvebu: Fix irq_of_parse_and_map() return value
    - crypto: ccp - Fix the INIT_EX data file open failure
    - drivers/base/node.c: fix compaction sysfs file leak
    - dax: fix cache flush on PMD-mapped pages
    - drivers/base/memory: fix an unlikely reference counting issue in
      __add_memory_block()
    - firmware: arm_ffa: Fix uuid parameter to ffa_partition_probe
    - firmware: arm_ffa: Remove incorrect assignment of driver_data
    - ocfs2: fix mounting crash if journal is not alloced
    - list: fix a data-race around ep->rdllist
    - drm/msm/dpu: fix error check return value of irq_of_parse_and_map()
    - powerpc/8xx: export 'cpm_setbrg' for modules
    - pinctrl: renesas: r8a779a0: Fix GPIO function on I2C-capable pins
    - pinctrl: renesas: r8a779f0: Fix GPIO function on I2C-capable pins
    - pinctrl: renesas: core: Fix possible null-ptr-deref in
      sh_pfc_map_resources()
    - powerpc/idle: Fix return value of __setup() handler
    - powerpc/4xx/cpm: Fix return value of __setup() handler
    - RDMA/hns: Add the detection for CMDQ status in the device initialization
      process
    - arm64: dts: marvell: espressobin-ultra: fix SPI-NOR config
    - arm64: dts: marvell: espressobin-ultra: enable front USB3 port
    - ASoC: atmel-pdmic: Remove endianness flag on pdmic component
    - ASoC: atmel-classd: Remove endianness flag on class d component
    - proc: fix dentry/inode overinstantiating under /proc/${pid}/net
    - ipc/mqueue: use get_tree_nodev() in mqueue_get_tree()
    - PCI: imx6: Fix PERST# start-up sequence
    - PCI: mediatek-gen3: Assert resets to ensure expected init state
    - module.h: simplify MODULE_IMPORT_NS
    - module: fix [e_shstrndx].sh_size=0 OOB access
    - tty: fix deadlock caused by calling printk() under tty_port->lock
    - crypto: sun8i-ss - rework handling of IV
    - crypto: sun8i-ss - handle zero sized sg
    - crypto: cryptd - Protect per-CPU resource by disabling BH.
    - ARM: dts: at91: sama7g5: remove interrupt-parent from gic node
    - ARM: dts: lan966x: swap dma channels for crypto node
    - hugetlbfs: fix hugetlbfs_statfs() locking
    - x86/mce: relocate set{clear}_mce_nospec() functions
    - mce: fix set_mce_nospec to always unmap the whole page
    - Input: sparcspkr - fix refcount leak in bbc_beep_probe
    - PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits
    - KVM: PPC: Book3S HV: Fix vcore_blocked tracepoint
    - PCI: microchip: Fix potential race in interrupt handling
    - cxl/mem: Drop mem_enabled check from wait_for_media()
    - hwrng: omap3-rom - fix using wrong clk_disable() in
      omap_rom_rng_runtime_resume()
    - perf evlist: Keep topdown counters in weak group
    - perf stat: Always keep perf metrics topdown events in a group
    - mailbox: pcc: Fix an invalid-load caught by the address sanitizer
    - powerpc/64: Only WARN if __pa()/__va() called with bad addresses
    - powerpc/powernv: Get L1D flush requirements from device-tree
    - powerpc/powernv: Get STF barrier requirements from device-tree
    - powerpc/perf: Fix the threshold compare group constraint for power10
    - powerpc/perf: Fix the threshold compare group constraint for power9
    - macintosh: via-pmu and via-cuda need RTC_LIB
    - powerpc/xive: Fix refcount leak in xive_spapr_init
    - powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
    - powerpc/papr_scm: Fix leaking nvdimm_events_map elements
    - powerpc/fsl_book3e: Don't set rodata RO too early
    - gpio: sim: Use correct order for the parameters of devm_kcalloc()
    - mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe()
    - nfsd: destroy percpu stats counters after reply cache shutdown
    - mailbox: forward the hrtimer if not queued and under a lock
    - RDMA/rxe: Fix an error handling path in rxe_get_mcg()
    - RDMA/hfi1: Prevent use of lock before it is initialized
    - pinctrl: apple: Use a raw spinlock for the regmap
    - KVM: LAPIC: Drop pending LAPIC timer injection when canceling the timer
    - Input: stmfts - do not leave device disabled in stmfts_input_open
    - OPP: call of_node_put() on error path in _bandwidth_supported()
    - dmaengine: ti: k3-psil-am62: Update PSIL thread for saul.
    - f2fs: fix to do sanity check on inline_dots inode
    - f2fs: fix dereference of stale list iterator after loop body
    - riscv: Fixup difference with defconfig
    - iommu/amd: Enable swiotlb in all cases
    - iommu/amd: Do not call sleep while holding spinlock
    - iommu/mediatek: Fix 2 HW sharing pgtable issue
    - iommu/mediatek: Add list_del in mtk_iommu_remove
    - iommu/mediatek: Remove clk_disable in mtk_iommu_remove
    - iommu/mediatek: Add mutex for m4u_group and m4u_dom in data
    - i2c: at91: use dma safe buffers
    - cpufreq: mediatek: Use module_init and add module_exit
    - cpufreq: mediatek: Unregister platform device on exit
    - iommu/arm-smmu-v3-sva: Fix mm use-after-free
    - MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon
    - iommu/mediatek: Fix NULL pointer dereference when printing dev_name
    - i2c: at91: Initialize dma_buf in at91_twi_xfer()
    - dmaengine: idxd: Fix the error handling path in idxd_cdev_register()
    - NFS: Do not report EINTR/ERESTARTSYS as mapping errors
    - NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS
    - NFS: Don't report ENOSPC write errors twice
    - NFS: Do not report flush errors in nfs_write_end()
    - NFS: Don't report errors from nfs_pageio_complete() more than once
    - NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout
    - NFS: Further fixes to the writeback error handling
    - NFS: Pass i_size to fscache_unuse_cookie() when a file is released
    - video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
    - dmaengine: stm32-mdma: remove GISR1 register
    - dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler()
    - iommu/amd: Increase timeout waiting for GA log enablement
    - i2c: npcm: Fix timeout calculation
    - i2c: npcm: Correct register access width
    - i2c: npcm: Handle spurious interrupts
    - i2c: rcar: fix PM ref counts in probe error paths
    - tracing: Reset the function filter after completing trampoline/graph
      selftest
    - RISC-V: Split out the XIP fixups into their own file
    - RISC-V: Fix the XIP build
    - MIPS: RALINK: Define pci_remap_iospace under CONFIG_PCI_DRIVERS_GENERIC
    - perf build: Fix btf__load_from_kernel_by_id() feature check
    - perf c2c: Use stdio interface if slang is not supported
    - rtla: Avoid record NULL pointer dereference
    - rtla: Don't overwrite existing directory mode
    - rtla: Minor grammar fix for rtla README
    - rtla: Fix __set_sched_attr error message
    - rtla: Remove procps-ng dependency
    - tracing/timerlat: Notify IRQ new max latency only if stop tracing is set
    - perf jevents: Fix event syntax error caused by ExtSel
    - video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup
    - NFSv4: Fix free of uninitialized nfs4_label on referral lookup.
    - NFSv4.1 mark qualified async operations as MOVEABLE tasks
    - f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()
    - f2fs: fix to do sanity check on block address in f2fs_do_zero_range()
    - f2fs: fix to clear dirty inode in f2fs_evict_inode()
    - f2fs: fix deadloop in foreground GC
    - f2fs: don't need inode lock for system hidden quota
    - f2fs: fix to do sanity check on total_data_blocks
    - f2fs: don't use casefolded comparison for "." and ".."
    - f2fs: fix fallocate to use file_modified to update permissions
      consistently
    - f2fs: fix to do sanity check for inline inode
    - objtool: Fix objtool regression on x32 systems
    - objtool: Fix symbol creation
    - wifi: mac80211: fix use-after-free in chanctx code
    - iwlwifi: fw: init SAR GEO table only if data is present
    - iwlwifi: mvm: fix assert 1F04 upon reconfig
    - iwlwifi: mei: clear the sap data header before sending
    - iwlwifi: mei: fix potential NULL-ptr deref
    - ipmi:ipmb: Fix refcount leak in ipmi_ipmb_probe
    - fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped
      pages
    - efi: Do not import certificates from UEFI Secure Boot for T2 Macs
    - bfq: Avoid false marking of bic as stably merged
    - bfq: Avoid merging queues with different parents
    - bfq: Split shared queues on move between cgroups
    - bfq: Update cgroup information before merging bio
    - bfq: Drop pointless unlock-lock pair
    - bfq: Remove pointless bfq_init_rq() calls
    - bfq: Track whether bfq_group is still online
    - bfq: Get rid of __bio_blkcg() usage
    - bfq: Make sure bfqg for which we are queueing requests is online
    - ext4: mark group as trimmed only if it was fully scanned
    - ext4: fix use-after-free in ext4_rename_dir_prepare
    - ext4: fix journal_ioprio mount option handling
    - ext4: fix race condition between ext4_write and ext4_convert_inline_data
    - ext4: fix warning in ext4_handle_inode_extension
    - ext4: fix memory leak in parse_apply_sb_mount_options()
    - ext4: fix bug_on in ext4_writepages
    - ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state
    - ext4: fix bug_on in __es_tree_search
    - ext4: verify dir block before splitting it
    - ext4: avoid cycles in directory h-tree
    - ACPI: property: Release subnode properties with data nodes
    - tty: goldfish: Introduce gf_ioread32()/gf_iowrite32()
    - tracing: Have event format check not flag %p* on __get_dynamic_array()
    - tracing: Fix potential double free in create_var_ref()
    - tracing: Fix return value of trace_pid_write()
    - tracing: Initialize integer variable to prevent garbage return value
    - drm/amdgpu: add beige goby PCI ID
    - PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299
    - PCI: qcom: Fix pipe clock imbalance
    - PCI: qcom: Fix runtime PM imbalance on probe errors
    - PCI: qcom: Fix unbalanced PHY init on probe errors
    - staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()
    - block: Fix potential deadlock in blk_ia_range_sysfs_show()
    - mm, compaction: fast_find_migrateblock() should return pfn in the target
      zone
    - s390/perf: obtain sie_block from the right address
    - s390/stp: clock_delta should be signed
    - dlm: fix plock invalid read
    - dlm: uninitialized variable on error in dlm_listen_for_all()
    - dlm: fix wake_up() calls for pending remove
    - dlm: fix missing lkb refcount handling
    - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
    - scsi: dc395x: Fix a missing check on list iterator
    - scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled
    - landlock: Add clang-format exceptions
    - landlock: Format with clang-format
    - selftests/landlock: Add clang-format exceptions
    - selftests/landlock: Normalize array assignment
    - selftests/landlock: Format with clang-format
    - samples/landlock: Add clang-format exceptions
    - samples/landlock: Format with clang-format
    - landlock: Fix landlock_add_rule(2) documentation
    - selftests/landlock: Make tests build with old libc
    - selftests/landlock: Extend tests for minimal valid attribute size
    - selftests/landlock: Add tests for unknown access rights
    - selftests/landlock: Extend access right tests to directories
    - selftests/landlock: Fully test file rename with "remove" access
    - selftests/landlock: Add tests for O_PATH
    - landlock: Change landlock_add_rule(2) argument check ordering
    - landlock: Change landlock_restrict_self(2) check ordering
    - selftests/landlock: Test landlock_create_ruleset(2) argument check
      ordering
    - landlock: Define access_mask_t to enforce a consistent access mask size
    - landlock: Reduce the maximum number of layers to 16
    - landlock: Create find_rule() from unmask_layers()
    - landlock: Fix same-layer rule unions
    - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
    - drm/nouveau/subdev/bus: Ratelimit logging for fault errors
    - drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem
    - drm/nouveau/clk: Fix an incorrect NULL check on list iterator
    - drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator
    - drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX
    - drm/i915/dsi: fix VBT send packet port selection for ICL+
    - md: fix an incorrect NULL check in does_sb_need_changing
    - md: fix an incorrect NULL check in md_reload_sb
    - mtd: cfi_cmdset_0002: Move and rename
      chip_check/chip_ready/chip_good_for_write
    - mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
    - media: coda: Fix reported H264 profile
    - media: coda: Add more H264 levels for CODA960
    - ima: remove the IMA_TEMPLATE Kconfig option
    - Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13
      bug
    - lib/string_helpers: fix not adding strarray to device's resource list
    - RDMA/hfi1: Fix potential integer multiplication overflow errors
    - mmc: core: Allows to override the timeout value for ioctl() path
    - csky: patch_text: Fixup last cpu should be master
    - irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375,
      A38x, A39x
    - irqchip: irq-xtensa-mx: fix initial IRQ affinity
    - thermal: devfreq_cooling: use local ops instead of global ops
    - mt76: fix use-after-free by removing a non-RCU wcid pointer
    - cfg80211: declare MODULE_FIRMWARE for regulatory.db
    - mac80211: upgrade passive scan to active scan on DFS channels after beacon
      rx
    - um: virtio_uml: Fix broken device handling in time-travel
    - um: Use asm-generic/dma-mapping.h
    - um: chan_user: Fix winch_tramp() return value
    - um: Fix out-of-bounds read in LDT setup
    - MIPS: IP27: Remove incorrect `cpu_has_fpu' override
    - MIPS: IP30: Remove incorrect `cpu_has_fpu' override
    - kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
    - ftrace: Clean up hash direct_functions on register failures
    - ksmbd: fix outstanding credits related bugs
    - iommu/msm: Fix an incorrect NULL check on list iterator
    - iommu/dma: Fix iova map result check bug
    - kprobes: Fix build errors with CONFIG_KRETPROBES=n
    - Revert "mm/cma.c: remove redundant cma_mutex lock"
    - mm/page_owner: use strscpy() instead of strlcpy()
    - mm/page_alloc: always attempt to allocate at least one page during bulk
      allocation
    - nodemask.h: fix compilation error with GCC12
    - hugetlb: fix huge_pmd_unshare address update
    - mm/memremap: fix missing call to untrack_pfn() in pagemap_range()
    - xtensa/simdisk: fix proc_read_simdisk()
    - rtl818x: Prevent using not initialized queues
    - ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control
    - carl9170: tx: fix an incorrect use of list iterator
    - stm: ltdc: fix two incorrect NULL checks on list iterator
    - bcache: improve multithreaded bch_btree_check()
    - bcache: improve multithreaded bch_sectors_dirty_init()
    - bcache: remove incremental dirty sector counting for
      bch_sectors_dirty_init()
    - bcache: avoid journal no-space deadlock by reserving 1 journal bucket
    - serial: pch: don't overwrite xmit->buf[0] by x_char
    - tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
    - gma500: fix an incorrect NULL check on list iterator
    - arm64: dts: qcom: ipq8074: fix the sleep clock frequency
    - arm64: tegra: Add missing DFLL reset on Tegra210
    - clk: tegra: Add missing reset deassertion
    - phy: qcom-qmp: fix struct clk leak on probe errors
    - ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries
    - ARM: pxa: maybe fix gpio lookup tables
    - ceph: fix decoding of client session messages flags
    - misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl
    - SMB3: EBADF/EIO errors in rename/open caused by race condition in
      smb2_compound_op
    - docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0
    - dt-bindings: gpio: altera: correct interrupt-cells
    - vdpasim: allow to enable a vq repeatedly
    - blk-iolatency: Fix inflight count imbalances and IO hangs on offline
    - coresight: core: Fix coresight device probe failure issue
    - phy: qcom-qmp: fix reset-controller leak on probe errors
    - net: ipa: fix page free in ipa_endpoint_trans_release()
    - net: ipa: fix page free in ipa_endpoint_replenish_one()
    - media: lirc: add missing exceptions for lirc uapi header file
    - kseltest/cgroup: Make test_stress.sh work if run interactively
    - perf evlist: Extend arch_evsel__must_be_in_group to support hybrid systems
    - Revert "random: use static branch for crng_ready()"
    - staging: r8188eu: delete rtw_wx_read/write32()
    - binder: fix sender_euid type in uapi header
    - RDMA/hns: Remove the num_cqc_timer variable
    - RDMA/rxe: Generate a completion for unsupported/invalid opcode
    - ext4: only allow test_dummy_encryption when supported
    - fs: add two trivial lookup helpers
    - exportfs: support idmapped mounts
    - fs/ntfs3: Fix invalid free in log_replay (CVE-2022-1973)
    - md: Don't set mddev private to NULL in raid0 pers->free
    - md: fix double free of io_acct_set bioset
    - md: bcache: check the return value of kzalloc() in
      detached_dev_do_request()
    - macsec: fix UAF bug for real_dev
    - tty: n_gsm: Fix packet data hex dump output
    - pinctrl/rockchip: support setting input-enable param
    - block: fix bio_clone_blkg_association() to associate with proper blkcg_gq
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.4
    - pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
    - staging: greybus: codecs: fix type confusion of list iterator variable
    - iio: adc: ad7124: Remove shift from scan_type
    - soundwire: qcom: fix an error message in swrm_wait_for_frame_gen_enabled()
    - remoteproc: mediatek: Fix side effect of mt8195 sram power on
    - remoteproc: mtk_scp: Fix a potential double free
    - lkdtm/bugs: Check for the NULL pointer after calling kmalloc
    - lkdtm/bugs: Don't expect thread termination without CONFIG_UBSAN_TRAP
    - tty: goldfish: Use tty_port_destroy() to destroy port
    - tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe
    - tty: n_tty: Restore EOF push handling behavior
    - serial: 8250_aspeed_vuart: Fix potential NULL dereference in
      aspeed_vuart_probe
    - tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id
      and ida_simple_get
    - remoteproc: imx_rproc: Ignore create mem entry for resource table
    - phy: rockchip-inno-usb2: Fix muxed interrupt support
    - staging: r8188eu: fix struct rt_firmware_hdr
    - usb: usbip: fix a refcount leak in stub_probe()
    - usb: usbip: add missing device lock on tweak configuration cmd
    - USB: storage: karma: fix rio_karma_init return
    - usb: musb: Fix missing of_node_put() in omap2430_probe
    - staging: fieldbus: Fix the error handling path in
      anybuss_host_common_probe()
    - pwm: lp3943: Fix duty calculation in case period was clamped
    - pwm: raspberrypi-poe: Fix endianness in firmware struct
    - rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
    - usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback
    - usb: dwc3: pci: Fix pm_runtime_get_sync() error checking
    - scripts/get_abi: Fix wrong script file name in the help message
    - misc: fastrpc: fix an incorrect NULL check on list iterator
    - firmware: stratix10-svc: fix a missing check on list iterator
    - usb: typec: mux: Check dev_set_name() return value
    - rpmsg: virtio: Fix possible double free in rpmsg_probe()
    - rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev()
    - rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl
    - iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check
    - iio: proximity: vl53l0x: Fix return value check of
      wait_for_completion_timeout
    - iio: adc: sc27xx: fix read big scale voltage not right
    - iio: adc: sc27xx: Fine tune the scale calibration values
    - rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails
    - misc/pvpanic: Convert regular spinlock into trylock on panic path
    - phy: qcom-qmp: fix pipe-clock imbalance on power-on failure
    - power: supply: core: Initialize struct to zero
    - power: supply: axp288_fuel_gauge: Fix battery reporting on the One Mix 1
    - power: supply: axp288_fuel_gauge: Drop BIOS version check from "T3 MRD"
      DMI quirk
    - power: supply: ab8500_fg: Allocate wq in probe
    - serial: sifive: Report actual baud base rather than fixed 115200
    - export: fix string handling of namespace in EXPORT_SYMBOL_NS
    - watchdog: rzg2l_wdt: Fix 32bit overflow issue
    - watchdog: rzg2l_wdt: Fix Runtime PM usage
    - watchdog: rzg2l_wdt: Fix 'BUG: Invalid wait context'
    - watchdog: rzg2l_wdt: Fix reset control imbalance
    - soundwire: intel: prevent pm_runtime resume prior to system suspend
    - soundwire: qcom: return error when pm_runtime_get_sync fails
    - coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
    - ksmbd: fix reference count leak in smb_check_perm_dacl()
    - extcon: ptn5150: Add queue work sync before driver release
    - dt-bindings: remoteproc: mediatek: Make l1tcm reg exclusive to mt819x
    - soc: rockchip: Fix refcount leak in rockchip_grf_init
    - clocksource/drivers/riscv: Events are stopped during CPU suspend
    - ARM: dts: aspeed: ast2600-evb: Enable RX delay for MAC0/MAC1
    - rtc: mt6397: check return value after calling platform_get_resource()
    - rtc: ftrtc010: Fix error handling in ftrtc010_rtc_probe
    - staging: r8188eu: add check for kzalloc
    - serial: meson: acquire port->lock in startup()
    - Revert "serial: 8250_mtk: Make sure to select the right FEATURE_SEL"
    - serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485
    - serial: cpm_uart: Fix build error without CONFIG_SERIAL_CPM_CONSOLE
    - serial: uartlite: Fix BRKINT clearing
    - serial: digicolor-usart: Don't allow CS5-6
    - serial: rda-uart: Don't allow CS5-6
    - serial: txx9: Don't allow CS5-6
    - serial: sh-sci: Don't allow CS5-6
    - serial: sifive: Sanitize CSIZE and c_iflag
    - serial: st-asc: Sanitize CSIZE and correct PARENB for CS7
    - serial: stm32-usart: Correct CSIZE, bits, and parity
    - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
    - bus: ti-sysc: Fix warnings for unbind for serial
    - driver: base: fix UAF when driver_attach failed
    - driver core: fix deadlock in __device_attach
    - watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking
    - watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe
    - blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx
    - ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition
    - scsi: sd: Don't call blk_cleanup_disk() in sd_probe()
    - clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value
    - s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
    - amt: fix return value of amt_update_handler()
    - amt: fix possible memory leak in amt_rcv()
    - net: ethernet: ti: am65-cpsw: Fix fwnode passed to phylink_create()
    - net/smc: set ini->smcrv2.ib_dev_v2 to NULL if SMC-Rv2 is unavailable
    - spi: fsi: Fix spurious timeout
    - drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq()
    - net: lan966x: check devm_of_phy_get() for -EDEFER_PROBE
    - net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog
    - net: ethernet: mtk_eth_soc: out of bounds read in
      mtk_hwlro_get_fdir_entry()
    - net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks
    - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
    - modpost: fix removing numeric suffixes
    - ep93xx: clock: Do not return the address of the freed memory
    - jffs2: fix memory leak in jffs2_do_fill_super
    - ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not
      empty
    - ubi: ubi_create_volume: Fix use-after-free when volume creation failed
    - selftests/bpf: fix stacktrace_build_id with missing kprobe/urandom_read
    - bpf: Fix probe read error in ___bpf_prog_run()
    - block: take destination bvec offsets into account in bio_copy_data_iter
    - nbd: don't clear 'NBD_CMD_INFLIGHT' flag if request is not completed
    - nbd: fix possible overflow on 'first_minor' in nbd_dev_add()
    - riscv: read-only pages should not be writable
    - net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct
      smc_wr_tx_pend_priv *"
    - tcp: add accessors to read/set tp->snd_cwnd
    - nfp: only report pause frame configuration for physical device
    - block: use bio_queue_enter instead of blk_queue_enter in bio_poll
    - bonding: NS target should accept link local address
    - sfc: fix considering that all channels have TX queues
    - sfc: fix wrong tx channel offset with efx_separate_tx_channels
    - block: make bioset_exit() fully resilient against being called twice
    - sched/autogroup: Fix sysctl move
    - blk-mq: do not update io_ticks with passthrough requests
    - net: phy: at803x: disable WOL at probe
    - bonding: show NS IPv6 targets in proc master info
    - erofs: fix 'backmost' member of z_erofs_decompress_frontend
    - vdpa: Fix error logic in vdpa_nl_cmd_dev_get_doit
    - virtio: pci: Fix an error handling path in vp_modern_probe()
    - net/mlx5: Don't use already freed action pointer
    - net/mlx5e: TC NIC mode, fix tc chains miss table
    - net/mlx5: CT: Fix header-rewrite re-use for tupels
    - net/mlx5e: Disable softirq in mlx5e_activate_rq to avoid race condition
    - net/mlx5: correct ECE offset in query qp output
    - net/mlx5e: Update netdev features after changing XDP state
    - net: sched: add barrier to fix packet stuck problem for lockless qdisc
    - tcp: tcp_rtx_synack() can be called from process context
    - vdpa: ifcvf: set pci driver data in probe
    - bonding: guard ns_targets by CONFIG_IPV6
    - octeontx2-af: fix error code in is_valid_offset()
    - s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST flag
    - regulator: mt6315-regulator: fix invalid allowed mode
    - net: ping6: Fix ping -6 with interface name
    - net/sched: act_api: fix error code in tcf_ct_flow_table_fill_tuple_ipv6()
    - gpio: pca953x: use the correct register address to do regcache sync
    - afs: Fix infinite loop found by xfstest generic/676
    - drm/msm/dp: Always clear mask bits to disable interrupts at
      dp_ctrl_reset_irq_ctrl()
    - scsi: sd: Fix potential NULL pointer dereference
    - ax25: Fix ax25 session cleanup problems
    - nfp: remove padding in nfp_nfdk_tx_desc
    - tipc: check attribute length for bearer name
    - driver core: Fix wait_for_device_probe() & deferred_probe_timeout
      interaction
    - perf evsel: Fixes topdown events in a weak group for the hybrid platform
    - perf parse-events: Move slots event for the hybrid platform too
    - perf record: Support sample-read topdown metric group for hybrid platforms
    - perf c2c: Fix sorting in percent_rmt_hitm_cmp()
    - Bluetooth: MGMT: Add conditions for setting HCI_CONN_FLAG_REMOTE_WAKEUP
      (Closes: #1012054)
    - Bluetooth: hci_sync: Fix attempting to suspend with unfiltered passive
      scan (Closes: #1012054)
    - bluetooth: don't use bitmaps for random flag accesses
    - dmaengine: idxd: set DMA_INTERRUPT cap bit
    - mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
    - bootconfig: Make the bootconfig.o as a normal object file
    - tracing: Make tp_printk work on syscall tracepoints
    - tracing: Fix sleeping function called from invalid context on RT kernel
    - tracing: Avoid adding tracer option before update_tracer_options
    - i2c: mediatek: Optimize master_xfer() and avoid circular locking
    - iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe()
    - iommu/arm-smmu-v3: check return value after calling
      platform_get_resource()
    - f2fs: remove WARN_ON in f2fs_is_valid_blkaddr
    - f2fs: avoid infinite loop to flush node pages
    - i2c: cadence: Increase timeout per message if necessary
    - m68knommu: set ZERO_PAGE() to the allocated zeroed page
    - m68knommu: fix undefined reference to `_init_sp'
    - dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type
    - NFSv4: Don't hold the layoutget locks across multiple RPC calls
    - video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1
    - video: fbdev: pxa3xx-gcu: release the resources correctly in
      pxa3xx_gcu_probe/remove()
    - RISC-V: use memcpy for kexec_file mode
    - m68knommu: fix undefined reference to `mach_get_rtc_pll'
    - rtla/Makefile: Properly handle dependencies
    - f2fs: fix to tag gcing flag on page during file defragment
    - xprtrdma: treat all calls not a bcall when bc_serv is NULL
    - drm/bridge: ti-sn65dsi83: Handle dsi_lanes == 0 as invalid
    - drm/panfrost: Job should reference MMU not file_priv
    - powerpc/papr_scm: don't requests stats with '0' sized stats buffer
    - netfilter: nat: really support inet nat without l3 address
    - netfilter: nf_tables: use kfree_rcu(ptr, rcu) to release hooks in
      clean_net path
    - netfilter: nf_tables: delete flowtable hooks via transaction list
    - powerpc/kasan: Force thread size increase with KASAN
    - NFSD: Fix potential use-after-free in nfsd_file_put()
    - SUNRPC: Trap RDMA segment overflows
    - netfilter: nf_tables: always initialize flowtable hook list in transaction
    - ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
    - netfilter: nf_tables: release new hooks on unsupported flowtable flags
    - netfilter: nf_tables: memleak flow rule from commit path
    - netfilter: nf_tables: bail out early if hardware offload is not supported
    - amt: fix wrong usage of pskb_may_pull()
    - amt: fix possible null-ptr-deref in amt_rcv()
    - amt: fix wrong type string definition
    - net: ethernet: bgmac: Fix refcount leak in bcma_mdio_mii_register
    - xen: unexport __init-annotated xen_xlate_map_ballooned_pages()
    - stmmac: intel: Fix an error handling path in intel_eth_pci_probe()
    - af_unix: Fix a data-race in unix_dgram_peer_wake_me().
    - selftests net: fix bpf build error
    - x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm()
    - bpf, arm64: Clear prog->jited_len along prog->jited
    - net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list
    - net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure
    - xsk: Fix handling of invalid descriptors in XSK TX batching API
    - drm/amdgpu: fix limiting AV1 to the first instance on VCN3
    - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()
    - net: mdio: unexport __init-annotated mdio_bus_init()
    - net: xfrm: unexport __init-annotated xfrm4_protocol_init()
    - net: ipv6: unexport __init-annotated seg6_hmac_init()
    - net/mlx5e: CT: Fix cleanup of CT before cleanup of TC ct rules
    - net/mlx5: Lag, filter non compatible devices
    - net/mlx5: Fix mlx5_get_next_dev() peer device matching
    - net/mlx5: Rearm the FW tracer after each tracer event
    - net/mlx5: fs, fail conflicting actions
    - ip_gre: test csum_start instead of transport header
    - net: altera: Fix refcount leak in altera_tse_mdio_create
    - net: dsa: mv88e6xxx: use BMSR_ANEGCOMPLETE bit for filling an_complete
    - net: dsa: realtek: rtl8365mb: fix GMII caps for ports with internal PHY
    - tcp: use alloc_large_system_hash() to allocate table_perturb
    - drm: imx: fix compiler warning with gcc-12
    - nfp: flower: restructure flow-key for gre+vlan combination
    - net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev
    - iov_iter: Fix iter_xarray_get_pages{,_alloc}()
    - iio: dummy: iio_simple_dummy: check the return value of kstrdup()
    - staging: rtl8712: fix a potential memory leak in r871xu_drv_init()
    - iio: st_sensors: Add a local lock for protecting odr
    - lkdtm/usercopy: Expand size of "out of frame" object
    - drivers: staging: rtl8723bs: Fix deadlock in
      rtw_surveydone_event_callback()
    - drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()
    - drivers: staging: rtl8192eu: Fix deadlock in rtw_joinbss_event_prehandle
    - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
    - tty: Fix a possible resource leak in icom_probe
    - thunderbolt: Use different lane for second DisplayPort tunnel
    - drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
    - drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
    - USB: host: isp116x: check return value after calling
      platform_get_resource()
    - drivers: tty: serial: Fix deadlock in sa1100_set_termios()
    - drivers: usb: host: Fix deadlock in oxu_bus_suspend()
    - USB: hcd-pci: Fully suspend across freeze/thaw cycle
    - char: xillybus: fix a refcount leak in cleanup_dev()
    - sysrq: do not omit current cpu when showing backtrace of all active CPUs
    - usb: dwc2: gadget: don't reset gadget's driver->bus
    - usb: dwc3: host: Stop setting the ACPI companion
    - usb: dwc3: gadget: Only End Transfer for ep0 data phase
    - soundwire: qcom: adjust autoenumeration timeout
    - misc: rtsx: set NULL intfdata when probe fails
    - extcon: Fix extcon_get_extcon_dev() error handling
    - extcon: Modify extcon device to be created after driver data is set
    - clocksource/drivers/sp804: Avoid error on multiple instances
    - staging: rtl8712: fix uninit-value in usb_read8() and friends
    - staging: rtl8712: fix uninit-value in r871xu_drv_init()
    - serial: msm_serial: disable interrupts in __msm_console_write()
    - kernfs: Separate kernfs_pr_cont_buf and rename_lock.
    - watchdog: wdat_wdt: Stop watchdog when rebooting the system
    - ksmbd: smbd: fix connection dropped issue
    - md: protect md_unregister_thread from reentrancy
    - ASoC: SOF: amd: Fixed Build error
    - scsi: myrb: Fix up null pointer access on myrb_cleanup()
    - ASoC: rt5640: Do not manipulate pin "Platform Clock" if the "Platform
      Clock" is not in the DAPM
    - Revert "net: af_key: add check for pfkey_broadcast in function
      pfkey_process"
    - ceph: allow ceph.dir.rctime xattr to be updatable
    - ceph: flush the mdlog for filesystem sync
    - ceph: fix possible deadlock when holding Fwb to get inline_data
    - net, neigh: Set lower cap for neigh_managed_work rearming
    - drm/amd/display: Check if modulo is 0 before dividing.
    - drm/amd/display: Check zero planes for OTG disable W/A on clock change
    - drm/radeon: fix a possible null pointer dereference
    - drm/amd/pm: fix a potential gpu_metrics_table memory leak
    - drm/amd/pm: Fix missing thermal throttler status
    - drm/amd/pm: correct the metrics version for SMU 11.0.11/12/13
    - um: line: Use separate IRQs per line
    - modpost: fix undefined behavior of is_arm_mapping_symbol()
    - objtool: Mark __ubsan_handle_builtin_unreachable() as noreturn
    - x86/cpu: Elide KCSAN for cpu_has() and friends
    - jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds
    - nbd: call genl_unregister_family() first in nbd_cleanup()
    - nbd: fix race between nbd_alloc_config() and module removal
    - nbd: fix io hung while disconnecting device
    - Revert "PCI: brcmstb: Do not turn off WOL regulators on suspend"
    - Revert "PCI: brcmstb: Add control of subdevice voltage regulators"
    - Revert "PCI: brcmstb: Add mechanism to turn on subdev regulators"
    - Revert "PCI: brcmstb: Split brcm_pcie_setup() into two funcs"
    - cifs: fix potential deadlock in direct reclaim
    - s390/gmap: voluntarily schedule during key setting
    - cifs: version operations for smb20 unneeded when legacy support disabled
    - drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate
    - nodemask: Fix return values to be unsigned
    - scsi: lpfc: Correct BDE type for XMIT_SEQ64_WQE in lpfc_ct_reject_event()
    - vringh: Fix loop descriptors check in the indirect cases
    - platform/x86: barco-p50-gpio: Add check for platform_driver_register
    - scripts/gdb: change kernel config dumping method
    - platform/x86: hp-wmi: Resolve WMI query failures on some devices
    - platform/x86: hp-wmi: Use zero insize parameter only when supported
    - ALSA: usb-audio: Skip generic sync EP parse for secondary EP
    - ALSA: usb-audio: Set up (implicit) sync for Saffire 6
    - ALSA: hda/conexant - Fix loopback issue with CX20632
    - ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo
      Yoga DuetITL 2021
    - ALSA: hda/realtek: Add quirk for HP Dev One
    - cifs: return errors during session setup during reconnects
    - cifs: fix reconnect on smb3 mount types
    - cifs: populate empty hostnames for extra channels
    - scsi: sd: Fix interpretation of VPD B9h length
    - scsi: lpfc: Resolve some cleanup issues following abort path refactoring
    - scsi: lpfc: Resolve some cleanup issues following SLI path refactoring
    - scsi: lpfc: Address NULL pointer dereference after starget_to_rport()
    - KVM: x86/mmu: Check every prev_roots in __kvm_mmu_free_obsolete_roots()
    - KVM: SVM: fix tsc scaling cache logic
    - filemap: Cache the value of vm_flags
    - KEYS: trusted: tpm2: Fix migratable logic
    - libata: fix reading concurrent positioning ranges log
    - libata: fix translation of concurrent positioning ranges
    - ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
    - mmc: sdhci-pci-gli: Fix GL9763E runtime PM when the system resumes from
      suspend
    - mmc: block: Fix CQE recovery reset success
    - net: phy: dp83867: retrigger SGMII AN when link change
    - net: openvswitch: fix misuse of the cached connection on tuple changes
    - writeback: Fix inode->i_io_list not be protected by inode->i_lock error
    - nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION
    - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
    - nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION
    - ixgbe: fix bcast packets Rx on VF after promisc removal
    - ixgbe: fix unexpected VLAN Rx in promisc mode on VF
    - Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
      (Closes: #1012655)
    - vduse: Fix NULL pointer dereference on sysfs access
    - cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE
    - mm/huge_memory: Fix xarray node memory leak
    - powerpc: Don't select HAVE_IRQ_EXIT_ON_IRQ_STACK
    - drm/amdkfd:Fix fw version for 10.3.6
    - drm/bridge: analogix_dp: Support PSR-exit to disable transition
    - drm/atomic: Force bridge self-refresh-exit on CRTC switch
    - drm/amdgpu/jpeg2: Add jpeg vmid update under IB submit
    - drm/amd/display: remove stale config guards
    - drm/amdgpu: update VCN codec support for Yellow Carp
    - virtio-rng: make device ready before making request
    - powerpc/32: Fix overread/overwrite of thread_struct via ptrace
      (CVE-2022-32981)
    - random: avoid checking crng_ready() twice in random_init()
    - random: mark bootloader randomness code as __init
    - random: account for arch randomness in bits
    - md/raid0: Ignore RAID0 layout if the second zone has only one device
    - zonefs: fix handling of explicit_open option on mount
    - iov_iter: fix build issue due to possible type mis-match
    - dmaengine: idxd: add missing callback function to support DMA_INTERRUPT
    - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
    - net/mlx5: E-Switch, pair only capable devices
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.5
    - Documentation: Add documentation for Processor MMIO Stale Data
    - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug
    - x86/speculation: Add a common function for MD_CLEAR mitigation update
    - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data
    - x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations
    - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle
    - x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data
    - x86/speculation/srbds: Update SRBDS mitigation selection
    - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS
    - KVM: x86/speculation: Disable Fill buffer clear within guests
    - x86/speculation/mmio: Print SMT warning

  [ Ben Hutchings ]
  * d/rules: Fix maintainerclean rule to not remove linux-perf files
  * d/watch: Fix typo in gitmode option

  [ Vincent Blut ]
  * [arm64] drivers/gpu/drm/sun4i: Enable DRM_SUN6I_DSI as module
    (Closes: #1012288)
  * sound/pci/hda: Enable SND_HDA_SCODEC_CS35L41_I2C and
    SND_HDA_SCODEC_CS35L41_SPI as modules (Closes: #1012794)
  * [armhf] drivers/crypto: Enable CRYPTO_DEV_OMAP as module (Closes: #1012880)

  [ Salvatore Bonaccorso ]
  * Bump ABI to 2
  * Drop "sign-file: Convert API usage to support OpenSSL v3"
  * io_uring: reinstate the inflight tracking (CVE-2022-1976)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 16 Jun 2022 23:40:32 +0200

linux (5.18.2-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.2
    - netfilter: nf_tables: disallow non-stateful expression in sets earlier
      (CVE-2022-1966)
    - pipe: Fix missing lock in pipe_resize_ring() (ZDI-CAN-17291)
    - netfilter: nf_tables: sanitize nft_set_desc_concat_parse() (CVE-2022-1972)
    - [x86] fpu: KVM: Set the base guest FPU uABI size to sizeof(struct
      kvm_xsave) (Closes: #1011168)
    - KVM: x86: avoid calling x86 emulator without a decoded instruction
      (CVE-2022-1852)

  [ Diederik de Haas ]
  * [arm64,armel.marvell] Remove duplicate MTD_SPI_NOR config option
  * [arm64] Remove duplicate CAN_MCP251X config option
  * drivers/net/can/spi: Enable CAN_HI311X as module (Closes: #927252)

  [ Henning Schild ]
  * [x86] drivers/platform/x86: Enable SIEMENS_SIMATIC_IPC as module
  * [x86] drivers/leds: Enable LEDS_SIEMENS_SIMATIC_IPC as module
  * [x86] drivers/wdt: Enable SIEMENS_SIMATIC_IPC_WDT as module

  [ Lubomir Rintel ]
  * [x86] Enable X86_ANDROID_TABLETS as a module

  [ Michal Simek ]
  * [arm64] Enable Xilinx PHY driver and SI5341 clock driver

  [ Zhang Ning ]
  * [arm64] Enable COMMON_CLK_PWM which is needed for some Amlogic SBCs
  * [arm64] Enable Khadas MCU and fan
  * [arm64] cpufreq: Enable SCPI cpufreq driver
  * [arm64] cpuidle: Enable CONFIG_ARM_PSCI_CPUIDLE

  [ Ben Hutchings ]
  * drivers/firmware: Build ISCSI_IBFT as module on all architectures with
    ACPI. Thanks to Eric Mackay. (Closes: #1008933).
  * intel-iommu: Correct matching of the "intgpu_off" option value.
    Thanks to Markus Kolb.
  * random: Enable RANDOM_TRUST_BOOTLOADER. This can be reverted using the
    kernel parameter: random.trust_bootloader=off

  [ Bastian Blank ]
  * [amd64] Enable X86_SGX.

  [ Salvatore Bonaccorso ]
  * block, loop: support partitions without scanning (Closes: #1012298)
  * Set ABI to 1

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 06 Jun 2022 20:45:23 +0200

linux (5.18-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.18

  [ Diederik de Haas ]
  * Rebase patches:
    - Update patches
      - debian/dfsg/vs6624-disable.patch (9958d30f38)
      - debian/version.patch (b8321ed4a4, 03248addad)
  * Change patches:
    - debian/android-enable-building-ashmem-and-binder-as-modules.patch
      Upstream removed ashmem support in 721412ed3d saying
      "The mainline replacement for ashmem is memfd, so remove the legacy code
      from drivers/staging/"
      This seems to partially revert #901492, but there is no anbox-modules in
      the archive, even though the ITP bug was closed.

  [ Ben Hutchings ]
  * Rewrite "module: Avoid ABI changes when debug info is disabled" for 5.18
  * In "firmware: Remove redundant log messages from drivers", adjust some
    filenames
  * In "x86: Make x32 syscall support conditional on a kernel parameter",
    update dependency from X86_X32 to X86_X32_ABI
  * Drop "bpftool: Fix version string in recursive builds" as redundant
  * bpftool: Prepend program version to the package version
  * [s390x] Enable MARCH_Z10 instead of MARCH_Z900, since support for z9 has
    been removed upstream
  * d/config: Update with the help of kconfigeditor2
  * udeb: Move crc64 to crc-modules and make scsi-core-modules depend on that
  * libcpupower1: Update symbols file for 5.18
  * d/copyright: Update filename of extract-cert.c
  * lintian: Add lintian-override to linux-perf for non-issue
  * d/bin/gencontrol.py, d/templates: Stop using templates for linux-perf
  * [rt] Update to 5.18-rt10

 -- Ben Hutchings <benh@debian.org>  Mon, 23 May 2022 12:21:44 +0200

linux (5.17.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.7
    - [arm64] pci_irq_vector() can't be used in atomic context any longer. This
      conflicts with the usage of this function in nic_mbx_intr_handler(). age
      of this function in nic_mbx_intr_handler().
    - ipmi: When handling send message responses, don't process the message
    - ipmi:ipmi_ipmb: Fix null-ptr-deref in ipmi_unregister_smi()
    - [mips*] Fix CP0 counter erratum detection for R4k CPUs
    - ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers
    - ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
    - [arm64] mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC
    - [arm64,armhf] mmc: sunxi-mmc: Fix DMA descriptors allocated above 32 bits
    - mmc: core: Set HS clock speed before sending HS CMD13
    - gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
    - [x86] fpu: Prevent FPU state corruption
    - [x86] KVM: x86/svm: Account for family 17h event renumberings in
      amd_pmc_perf_hw_id
    - [amd64] iommu/vt-d: Calculate mask for non-aligned flushes
    - drm/amdgpu: do not use passthrough mode in Xen dom0
    - Revert "SUNRPC: attempt AF_LOCAL connect on setup"
    - timekeeping: Mark NMI safe time accessors as notrace
    - firewire: fix potential uaf in outbound_phy_packet_callback()
    - firewire: remove check of list iterator against head past the loop body
    - firewire: core: extend card->lock in fw_core_handle_bus_reset
    - net: stmmac: disable Split Header (SPH) for Intel platforms
    - btrfs: sysfs: export the balance paused state of exclusive operation
    - btrfs: force v2 space cache usage for subpage mount
    - btrfs: do not BUG_ON() on failure to update inode when setting xattr
    - btrfs: export a helper for compression hard check
    - btrfs: do not allow compression on nodatacow files
    - btrfs: skip compression property for anything other than files and dirs
    - genirq: Synchronize interrupt thread startup
    - ASoC: da7219: Fix change notifications for tone generator frequency
    - [arm64] ASoC: wm8958: Fix change notifications for DSP controls
    - [arm64,armhf] ASoC: meson: Fix event generation for AUI ACODEC mux
    - [arm64,armhf] ASoC: meson: Fix event generation for G12A tohdmi mux
    - [arm64,armhf] ASoC: meson: Fix event generation for AUI CODEC mux
    - [s390x] dasd: fix data corruption for ESE devices
    - [s390x] dasd: prevent double format of tracks for ESE devices
    - [s390x] dasd: Fix read for ESE with blksize < 4k
    - [s390x] dasd: Fix read inconsistency for ESE DASD devices
    - can: isotp: remove re-binding of bound socket
    - nfc: replace improper check device_is_registered() in netlink related
      functions
    - NFC: netlink: fix sleep in atomic bug when firmware download timeout
    - [arm64,armhf] gpio: pca953x: fix irq_stat not updated when irq is disabled
      (irq_mask not set)
    - hwmon: (adt7470) Fix warning on module removal
    - [armhf] hwmon: (pmbus) disable PEC if not enabled
    - [arm*] ASoC: dmaengine: Restore NULL prepare_slave_config() callback
    - [arm64] ASoC: meson: axg-tdm-interface: Fix formatters in trigger"
    - [arm64] ASoC: meson: axg-card: Fix nonatomic links
    - ASoC: soc-ops: fix error handling
    - [amd64] iommu/vt-d: Drop stop marker messages
    - net/mlx5e: Fix trust state reset in reload
    - net/mlx5: Fix slab-out-of-bounds while reading resource dump menu
    - net/mlx5e: Fix wrong source vport matching on tunnel rule
    - net/mlx5e: Don't match double-vlan packets if cvlan is not set
    - net/mlx5e: CT: Fix queued up restore put() executing after relevant ft
      release
    - net/mlx5e: Fix the calling of update_buffer_lossy() API
    - net/mlx5: Fix matching on inner TTC
    - net/mlx5: Avoid double clear or set of sync reset requested
    - net/mlx5: Fix deadlock in sync reset flow
    - net/mlx5e: Lag, Fix use-after-free in fib event handler
    - net/mlx5e: Lag, Fix fib_info pointer assignment
    - net/mlx5e: Lag, Don't skip fib events on current dst
    - net/mlx5e: TC, fix decap fallback to uplink when int port not supported
    - ALSA: hda/realtek: Fix mute led issue on thinkpad with cs35l41 s-codec
    - SUNRPC release the transport of a relocated task with an assigned
      transport
    - RDMA/irdma: Flush iWARP QP if modified to ERR from RTR state
    - RDMA/irdma: Reduce iWARP QP destroy time
    - RDMA/irdma: Fix possible crash due to NULL netdev in notifier
    - NFSv4: Don't invalidate inode attributes on delegation return
    - [arm64,armhf] net: stmmac: dwmac-sun8i: add missing of_node_put() in
      sun8i_dwmac_register_mdio_mux()
    - [armhf] net: cpsw: add missing of_node_put() in cpsw_probe_dt()
    - net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
    - [arm64] drm/msm/dp: remove fail safe mode related code
    - hinic: fix bug of wq out of bound access
    - SUNRPC: Don't leak sockets in xs_local_connect()
    - mld: respect RCU rules in ip6_mc_source() and ip6_mc_msfilter()
    - rxrpc: Enable IPv6 checksums on transport socket
    - dt-bindings: pci: apple,pcie: Drop max-link-speed from example
    - bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag
    - bnxt_en: Fix unnecessary dropping of RX packets
    - [arm64,armhf] smsc911x: allow using IRQ0
    - btrfs: always log symlinks in full mode
    - [arm*] gpio: mvebu: drop pwm base assignment
    - net: rds: acquire refcount on TCP sockets
    - [x86] kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
      architectural PMU
    - fbdev: Make fb_release() return -ENODEV if fbdev was unregistered
    - [x86] KVM: SEV: Mark nested locking of vcpu->lock
    - [x86] KVM: VMX: Exit to userspace if vCPU has injected exception and
      invalid state
    - [x86] kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume
    - [x86] KVM: x86: Do not change ICR on write to APIC_SELF_IPI
    - [x86] KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs
    - [x86] KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is
      advertised
    - mmc: rtsx: add 74 Clocks in power on flow
    - [arm64] PCI: aardvark: Replace custom PCIE_CORE_INT_* macros with
      PCI_INTERRUPT_*
    - [arm64] PCI: aardvark: Rewrite IRQ code to chained IRQ handler
    - [arm64] PCI: aardvark: Check return value of generic_handle_domain_irq()
      when processing INTx IRQ
    - [arm64] PCI: aardvark: Make MSI irq_chip structures static driver
      structures
    - [arm64] PCI: aardvark: Make msi_domain_info structure a static driver
      structure
    - [arm64] PCI: aardvark: Use dev_fwnode() instead of
      of_node_to_fwnode(dev->of_node)
    - [arm64] PCI: aardvark: Refactor unmasking summary MSI interrupt
    - [arm64] PCI: aardvark: Add support for masking MSI interrupts
    - [arm64] PCI: aardvark: Fix setting MSI address
    - [arm64] PCI: aardvark: Enable MSI-X support
    - [arm64] PCI: aardvark: Add support for ERR interrupt on emulated bridge
    - [arm64] PCI: aardvark: Optimize writing PCI_EXP_RTCTL_PMEIE and
      PCI_EXP_RTSTA_PME on emulated bridge
    - [arm64] PCI: aardvark: Add support for PME interrupts
    - [arm64] PCI: aardvark: Fix support for PME requester on emulated bridge
    - [arm64] PCI: aardvark: Use separate INTA interrupt for emulated root
      bridge
    - [arm64] PCI: aardvark: Remove irq_mask_ack() callback for INTx interrupts
    - [arm64] PCI: aardvark: Don't mask irq when mapping
    - [arm64] PCI: aardvark: Drop __maybe_unused from advk_pcie_disable_phy()
    - [arm64] PCI: aardvark: Update comment about link going down after link-up
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.8
    - Bluetooth: Fix the creation of hdev->name
    - rfkill: uapi: fix RFKILL_IOCTL_MAX_SIZE ioctl request definition
    - udf: Avoid using stale lengthOfImpUse
    - mm: fix missing cache flush for all tail pages of compound page
    - mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
    - mm: hugetlb: fix missing cache flush in hugetlb_mcopy_atomic_pte()
    - mm: shmem: fix missing cache flush in shmem_mfill_atomic_pte()
    - mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and
      __mcopy_atomic()
    - mm/hwpoison: fix error page recovered but reported "not recovered"
    - mm/mlock: fix potential imbalanced rlimit ucounts adjustment
    - mm,migrate: fix establishing demotion target
    - mm: fix invalid page pointer returned with FOLL_PIN gups
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.9
    - batman-adv: Don't skb_split skbuffs with frag_list
    - iwlwifi: iwl-dbg: Use del_timer_sync() before freeing
    - hwmon: (tmp401) Add OF device ID table
    - mac80211: Reset MBSSID parameters upon connection
    - net: rds: use maybe_get_net() when acquiring refcount on TCP sockets
    - net: Fix features skip in for_each_netdev_feature()
    - [arm64] net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in
      hardware when deleted
    - [arm64] net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups
    - [arm64] net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0
    - [arm64] net: mscc: ocelot: avoid corrupting hardware counters when moving
      VCAP filters
    - [arm*] fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove
    - fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove
    - [x86] fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove
    - [x86] platform/surface: aggregator: Fix initialization order when
      compiling as builtin module
    - ice: Fix race during aux device (un)plugging
    - ice: clear stale Tx queue settings before configuring
    - ice: fix PTP stale Tx timestamps cleanup
    - ipv4: drop dst in multicast routing path
    - drm/nouveau: Fix a potential theorical leak in
      nouveau_get_backlight_name()
    - netlink: do not reset transport header in netlink_recvmsg()
    - net: chelsio: cxgb4: Avoid potential negative array offset
    - fbdev: efifb: Fix a use-after-free due early fb_info cleanup
    - net: sfc: fix memory leak due to ptp channel
    - fanotify: do not allow setting dirent events in mask of non-dir
    - mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
    - nfs: fix broken handling of the softreval mount option
    - dim: initialize all struct fields
    - procfs: prevent unprivileged processes accessing fdinfo dir
    - [arm64,armhf] net: dsa: flush switchdev workqueue on bridge join error
      path
    - [arm64] vdso: fix makefile dependency on vdso.so
    - virtio: fix virtio transitional ids
    - [s390x] ctcm: fix variable dereferenced before check
    - [s390x] ctcm: fix potential memory leak
    - [s390x] lcs: fix variable dereferenced before check
    - net/sched: act_pedit: really ensure the skb is writable
    - [arm64] net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral
    - [arm*] drm/vc4: hdmi: Fix build error for implicit function declaration
    - [armhf] net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down()
    - net/smc: non blocking recvmsg() return -EAGAIN when no data and
      signal_pending
    - net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
    - tls: Fix context leak on tls_device_down
    - drm/vmwgfx: Fix fencing on SVGAv3
    - gfs2: Fix filesystem block deallocation for short writes
    - hwmon: (f71882fg) Fix negative temperature
    - RDMA/irdma: Fix deadlock in irdma_cleanup_cm_core()
    - [arm64,armhf] iommu: arm-smmu: disable large page mappings for Nvidia
      arm-smmu
    - ASoC: max98090: Reject invalid values in custom control put()
    - ASoC: max98090: Generate notifications on changes for custom control
    - ASoC: ops: Validate input values in snd_soc_put_volsw_range()
    - [s390x] disable -Warray-bounds
    - [x86] ASoC: SOF: Fix NULL pointer exception in sof_pci_probe callback
    - io_uring: assign non-fixed early for async work
    - net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT
    - secure_seq: use the 64 bits of the siphash for port offset calculation
      (CVE-2022-1012)
    - tcp: use different parts of the port_offset for index and offset
      (CVE-2022-1012)
    - tcp: resalt the secret every 10 seconds (CVE-2022-1012)
    - tcp: add small random increments to the source port (CVE-2022-1012)
    - tcp: dynamically allocate the perturb table used by source ports
      (CVE-2022-1012)
    - tcp: increase source port perturb table to 2^16 (CVE-2022-1012)
    - tcp: drop the hash_32() part from the index calculation (CVE-2022-1012)
    - block: Do not call folio_next() on an unreferenced folio
    - [arm64,armhf] interconnect: Restore sync state by ignoring ipa-virt in
      provider count
    - firmware_loader: use kernel credentials when reading firmware
    - [x86] mm: Fix marking of unused sub-pmd ranges
    - tty: n_gsm: fix buffer over-read in gsm_dlci_data()
    - tty: n_gsm: fix mux activation issues in gsm_config()
    - tty: n_gsm: fix invalid gsmtty_write_room() result
    - usb: gadget: uvc: allow for application to cleanly shutdown
    - usb: cdc-wdm: fix reading stuck on device close
    - [arm64] usb: typec: tcpci: Don't skip cleanup in .remove() on error
    - USB: serial: pl2303: add device id for HP LM930 Display
    - USB: serial: qcserial: add support for Sierra Wireless EM7590
    - USB: serial: option: add Fibocom L610 modem
    - USB: serial: option: add Fibocom MA510 modem
    - [arm64] fsl_lpuart: Don't enable interrupts too early
    - genirq: Remove WARN_ON_ONCE() in generic_handle_domain_irq()
    - ceph: fix setting of xattrs on async created inodes
    - Revert "mm/memory-failure.c: skip huge_zero_page in memory_failure()"
    - mm/huge_memory: do not overkill when splitting huge_zero_page
    - mm: mremap: fix sign for EFAULT error return value
    - drm/vmwgfx: Disable command buffers on svga3 without gbobjects
    - drm/nouveau/tegra: Stop using iommu_present()
    - i40e: i40e_main: fix a missing check on list iterator
    - net: atlantic: always deep reset on pm op, fixing up my null deref
      regression
    - net: phy: Fix race condition on link status change
    - writeback: Avoid skipping inode writeback
    - cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
    - ping: fix address binding wrt vrf
    - ath11k: reduce the wait time of 11d scan and hw scan while add interface
    - [arm*] arm[64]/memremap: don't abuse pfn_valid() to ensure presence of
      linear map
    - net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061
    - net: phy: micrel: Pass .probe for KS8737
    - SUNRPC: Ensure that the gssproxy client can start in a connected state
    - drm/vmwgfx: Initialize drm_mode_fb_cmd2
    - Revert "drm/amd/pm: keep the BACO feature enabled for suspend"
    - dma-buf: call dma_buf_stats_setup after dmabuf is in valid list
    - mm/hwpoison: use pr_err() instead of dump_page() in get_any_page()
    - net: phy: micrel: Fix incorrect variable type in micrel
    - mm/kfence: reset PG_slab and memcg_data before freeing __kfence_pool
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.10
    - floppy: use a statically allocated error counter
    - kernel/resource: Introduce request_mem_region_muxed()
    - i2c: piix4: Replace hardcoded memory map size with a #define
    - i2c: piix4: Move port I/O region request/release code into functions
    - i2c: piix4: Move SMBus controller base address detect into function
    - i2c: piix4: Move SMBus port selection into function
    - i2c: piix4: Add EFCH MMIO support to region request and release
    - i2c: piix4: Add EFCH MMIO support to SMBus base address detect
    - i2c: piix4: Add EFCH MMIO support for SMBus port select
    - i2c: piix4: Enable EFCH MMIO for Family 17h+
    - [x86] Watchdog: sp5100_tco: Move timer initialization into function
    - [x86] Watchdog: sp5100_tco: Refactor MMIO base address initialization
    - [x86] Watchdog: sp5100_tco: Add initialization using EFCH MMIO
    - [x86] Watchdog: sp5100_tco: Enable Family 17h+ CPUs
    - [x86] Revert "drm/i915/opregion: check port number bounds for SWSCI
      display power state"
    - gfs2: cancel timed-out glock requests
    - gfs2: Switch lock order of inode and iopen glock
    - rtc: fix use-after-free on device removal
    - [arm64] rtc: pcf2127: fix bug when reading alarm registers
    - Input: add bounds checking to input_set_capability()
    - nvme-pci: add quirks for Samsung X5 SSDs
    - gfs2: Disable page faults during lockless buffered reads
    - [arm64,armhf] rtc: sun6i: Fix time overflow handling
    - [armhf] crypto: stm32 - fix reference leak in stm32_crc_remove
    - [amd64] crypto: x86/chacha20 - Avoid spurious jumps to other functions
    - ALSA: hda/realtek: Enable headset mic on Lenovo P360
    - [s390x] traps: improve panic message for translation-specification
      exception
    - [s390x] pci: improve zpci_dev reference counting
    - smb3: cleanup and clarify status of tree connections
    - nvmet: use a private workqueue instead of the system workqueue
    - nvme-multipath: fix hang when disk goes live over reconnect
    - rtc: mc146818-lib: Fix the AltCentury for AMD platforms
    - fs: fix an infinite loop in iomap_fiemap
    - drbd: remove usage of list iterator variable after loop
    - platform/chrome: cros_ec_debugfs: detach log reader wq from devm
    - [armel,armhf] arm/stacktrace, kasan: Silence KASAN warnings in
      unwind_frame()
    - nilfs2: fix lockdep warnings in page operations for btree nodes
    - nilfs2: fix lockdep warnings during disk space reclamation
    - ALSA: usb-audio: Restore Rane SL-1 quirk
    - [i386] ALSA: wavefront: Proper check of get_user() error
    - ALSA: hda/realtek: Add quirk for TongFang devices with pop noise
    - perf: Fix sys_perf_event_open() race against self (CVE-2022-1729)
    - selinux: fix bad cleanup on error in hashtab_duplicate()
    - audit,io_uring,io-wq: call __audit_uring_exit for dummy contexts
    - Fix double fget() in vhost_net_set_backend()
    - PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold
    - [arm64] KVM: arm64: vgic-v3: Consistently populate ID_AA64PFR0_EL1.GIC
    - [x86] KVM: x86/mmu: Update number of zapped pages even if page list is
      stable
    - KVM: Free new dirty bitmap if creating a new memslot fails
    - [arm64] paravirt: Use RCU read locks to guard stolen_time
    - [arm64] mte: Ensure the cleared tags are visible before setting the PTE
    - [arm64] crypto: qcom-rng - fix infinite loop on requests not multiple of
      WORD_SZ
    - mmc: core: Fix busy polling for MMC_SEND_OP_COND again
    - libceph: fix potential use-after-free on linger ping and resends
    - drm/amd: Don't reset dGPUs if the system is going to s2idle
    - [x86] drm/i915/dmc: Add MMIO range restrictions
    - drm/dp/mst: fix a possible memory leak in fetch_monitor_name()
    - dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace
    - dma-buf: ensure unique directory name for dmabuf stats
    - [arm64] dts: qcom: sm8250: don't enable rx/tx macro by default
    - [armhf] pinctrl: pinctrl-aspeed-g6: remove FWQSPID group in pinctrl
    - ALSA: hda - fix unused Realtek function when PM is not enabled
    - block/mq-deadline: Set the fifo_time member also if inserting at head
    - mptcp: fix subflow accounting on close
    - [arm64] net: macb: Increment rx bd head after allocating skb and buffer
    - [x86] i915/guc/reset: Make __guc_reset_context aware of guilty engines
    - xfrm: rework default policy structure
    - xfrm: fix "disable_policy" flag use when arriving from different devices
    - net/sched: act_pedit: sanitize shift argument before usage
    - netfilter: flowtable: fix excessive hw offload attempts after failure
    - netfilter: nft_flow_offload: skip dst neigh lookup for ppp devices
    - net: fix dev_fill_forward_path with pppoe + bridge
    - netfilter: nft_flow_offload: fix offload with pppoe + vlan
    - ptp: ocp: have adjtime handle negative delta_ns correctly
    - [arm64] Revert "PCI: aardvark: Rewrite IRQ code to chained IRQ handler"
    - net: vmxnet3: fix possible use-after-free bugs in
      vmxnet3_rq_alloc_rx_buf()
    - net: vmxnet3: fix possible NULL pointer dereference in
      vmxnet3_rq_cleanup()
    - [arm64] kexec: load from kimage prior to clobbering
    - ice: fix crash when writing timestamp on RX rings
    - ice: fix possible under reporting of ethtool Tx and Rx statistics
    - ice: Fix interrupt moderation settings getting cleared
    - net/qla3xxx: Fix a test in ql_reset_work()
    - net/mlx5: DR, Fix missing flow_source when creating multi-destination FW
      table
    - net/mlx5: Initialize flow steering during driver probe
    - net/mlx5: DR, Ignore modify TTL on RX if device doesn't support it
    - net/mlx5e: Block rx-gro-hw feature in switchdev mode
    - net/mlx5e: Properly block LRO when XDP is enabled
    - net/mlx5e: Properly block HW GRO when XDP is enabled
    - net/mlx5e: Remove HW-GRO from reported features
    - net/mlx5: Drain fw_reset when removing device
    - net: af_key: add check for pfkey_broadcast in function pfkey_process
    - [armhf] 9196/1: spectre-bhb: enable for Cortex-A15
    - [armel,armhf] 9197/1: spectre-bhb: fix loop8 sequence for Thumb2
    - lockdown: also lock down previous kgdb use (CVE-2022-21499)
    - mptcp: fix checksum byte order
    - igb: skip phy status check where unavailable
    - netfilter: flowtable: fix TCP flow teardown
    - netfilter: flowtable: pass flowtable to nf_flow_table_iterate()
    - netfilter: flowtable: move dst_check to packet path
    - net: bridge: Clear offload_fwd_mark when passing frame up bridge
      interface.
    - [x86] kvm: x86/pmu: Fix the compare function used by the pmu event filter
    - [arm*] gpio: mvebu/pwm: Refuse requests with inverted polarity
    - scsi: scsi_dh_alua: Properly handle the ALUA transitioning state
    - scsi: qla2xxx: Fix missed DMA unmap for aborted commands
    - mac80211: fix rx reordering with non explicit / psmp ack policy
    - nl80211: validate S1G channel width
    - cfg80211: retrieve S1G operating channel number
    - Revert "fbdev: Make fb_release() return -ENODEV if fbdev was unregistered"
    - fbdev: Prevent possible use-after-free in fb_release()
    - [x86] platform/x86: thinkpad_acpi: Convert btusb DMI list to quirks
    - [x86] platform/x86: thinkpad_acpi: Correct dual fan probe
    - [x86] platform/surface: gpe: Add support for Surface Pro 8
    - net: fix wrong network header length
    - nl80211: fix locking in nl80211_set_tx_bitrate_mask()
    - ethernet: tulip: fix missing pci_disable_device() on error in
      tulip_init_one()
    - net: atlantic: fix "frag[0] not initialized"
    - net: atlantic: reduce scope of is_rsc_complete
    - net: atlantic: add check for MAX_SKB_FRAGS
    - net: atlantic: verify hw_head_ lies within TX buffer ring
    - [arm64] Enable repeat tlbi workaround on KRYO4XX gold CPUs
    - dt-bindings: pinctrl: aspeed-g6: remove FWQSPID group
    - afs: Fix afs_getattr() to refetch file status if callback break occurred
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.11
    - mptcp: Do TCP fallback on early DSS checksum failure

  [ Vincent Blut ]
  * [x86] sound/soc/amd: Enable SND_SOC_AMD_ACP5x, SND_SOC_AMD_VANGOGH_MACH,
    SND_SOC_AMD_ACP6x and SND_SOC_AMD_YC_MACH as modules (Closes: #1010580)
  * [ppc64*] crypto: Enable CRYPTO_CRC32C_VPMSUM as module (Closes: #1010293)

  [ Alejandro R. Sedeño ]
  * drivers/net/wwan: Enable MHI_WWAN_MBIM as module (Closes: #1011395)

  [ Salvatore Bonaccorso ]
  * Bump ABI to 3
  * sign-file: Convert API usage to support OpenSSL v3
  * [x86] KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID
    (CVE-2022-1789)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 26 May 2022 21:42:32 +0200

linux (5.17.6-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.4
    - [arm64] cpuidle: PSCI: Move the `has_lpi` check to the beginning of the
      function
    - ACPI: processor idle: Check for architectural support for LPI
    - btrfs: remove no longer used counter when reading data page
    - btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups()
    - media: si2157: unknown chip version Si2147-A30 ROM 0x50
    - drm/amdgpu: Ensure HDA function is suspended before ASIC reset
    - btrfs: release correct delalloc amount in direct IO write path
    - btrfs: fix btrfs_submit_compressed_write cgroup attribution
    - btrfs: return allocated block group from do_chunk_alloc()
    - ALSA: core: Add snd_card_free_on_error() helper
    - [i386] ALSA: sis7019: Fix the missing error handling
    - ALSA: ali5451: Fix the missing snd_card_free() call at probe error
    - ALSA: als300: Fix the missing snd_card_free() call at probe error
    - ALSA: als4000: Fix the missing snd_card_free() call at probe error
    - ALSA: atiixp: Fix the missing snd_card_free() call at probe error
    - ALSA: azt3328: Fix the missing snd_card_free() call at probe error
    - ALSA: bt87x: Fix the missing snd_card_free() call at probe error
    - ALSA: ca0106: Fix the missing snd_card_free() call at probe error
    - ALSA: cmipci: Fix the missing snd_card_free() call at probe error
    - ALSA: cs4281: Fix the missing snd_card_free() call at probe error
    - [i386] ALSA: cs5535audio: Fix the missing snd_card_free() call at probe
      error
    - ALSA: emu10k1x: Fix the missing snd_card_free() call at probe error
    - ALSA: ens137x: Fix the missing snd_card_free() call at probe error
    - ALSA: es1938: Fix the missing snd_card_free() call at probe error
    - ALSA: es1968: Fix the missing snd_card_free() call at probe error
    - ALSA: fm801: Fix the missing snd_card_free() call at probe error
    - ALSA: hdsp: Fix the missing snd_card_free() call at probe error
    - ALSA: hdspm: Fix the missing snd_card_free() call at probe error
    - ALSA: ice1724: Fix the missing snd_card_free() call at probe error
    - ALSA: intel8x0: Fix the missing snd_card_free() call at probe error
    - [x86] ALSA: intel_hdmi: Fix the missing snd_card_free() call at probe
      error
    - ALSA: korg1212: Fix the missing snd_card_free() call at probe error
    - ALSA: lola: Fix the missing snd_card_free() call at probe error
    - ALSA: lx6464es: Fix the missing snd_card_free() call at probe error
    - ALSA: maestro3: Fix the missing snd_card_free() call at probe error
    - ALSA: oxygen: Fix the missing snd_card_free() call at probe error
    - ALSA: riptide: Fix the missing snd_card_free() call at probe error
    - ALSA: rme32: Fix the missing snd_card_free() call at probe error
    - ALSA: rme9652: Fix the missing snd_card_free() call at probe error
    - ALSA: rme96: Fix the missing snd_card_free() call at probe error
    - [i386] ALSA: sc6000: Fix the missing snd_card_free() call at probe error
    - ALSA: sonicvibes: Fix the missing snd_card_free() call at probe error
    - ALSA: via82xx: Fix the missing snd_card_free() call at probe error
    - ALSA: usb-audio: Cap upper limits of buffer/period bytes for implicit fb
    - [x86] ALSA: memalloc: Add fallback SG-buffer allocations for x86
    - ALSA: nm256: Don't call card private_free at probe error path
    - [arm64] drm/msm: Add missing put_task_struct() in debugfs path
    - nfsd: Fix a write performance regression
    - Revert "ath11k: mesh: add support for 256 bitmap in blockack frames in
      11ax"
    - [arm64] KVM: arm64: Generalise VM features into a set of flags
    - [arm64] KVM: arm64: mixed-width check should be skipped for uninitialized
      vCPUs
    - SUNRPC: Fix the svc_deferred_event trace class
    - net/sched: flower: fix parsing of ethertype following VLAN header
    - veth: Ensure eth header is in skb's linear part
    - gpiolib: acpi: use correct format characters
    - cifs: release cached dentries only if mount is complete
    - ice: arfs: fix use-after-free when freeing @rx_cpu_rmap
    - Revert "iavf: Fix deadlock occurrence during resetting VF interface"
    - net: mdio: don't defer probe forever if PHY IRQ provider is missing
    - sctp: use the correct skb for security_sctp_assoc_request
    - net/sched: fix initialization order when updating chain 0 head
    - cachefiles: unmark inode in use in error path
    - cachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr
    - [arm64] net: dsa: felix: suppress -EPROBE_DEFER errors
    - io_uring: flag the fact that linked file assignment is sane
    - [armhf] net: ethernet: stmmac: fix altr_tse_pcs function when using a
      fixed-link
    - net/sched: taprio: Check if socket flags are valid
    - cfg80211: hold bss_lock while updating nontrans_list
    - netfilter: nft_socket: make cgroup match work in input too
    - [arm64] drm/msm: Fix range size vs end confusion
    - [arm64] drm/msm/dsi: Use connector directly in
      msm_dsi_manager_connector_init()
    - [arm64] drm/msm/dp: add fail safe mode outside of event_mutex context
    - io_uring: stop using io_wq_work as an fd placeholder
    - net/smc: use memcpy instead of snprintf to avoid out of bounds read
    - net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()
    - scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63
    - scsi: pm80xx: Enable upper inbound, outbound queues
    - scsi: iscsi: Move iscsi_ep_disconnect()
    - scsi: iscsi: Fix offload conn cleanup when iscsid restarts
    - scsi: iscsi: Fix endpoint reuse regression
    - scsi: iscsi: Fix conn cleanup and stop race during iscsid restart
    - scsi: iscsi: Fix unbound endpoint error handling
    - sctp: Initialize daddr on peeled off socket
    - netfilter: nf_tables: nft_parse_register can return a negative value
    - io_uring: fix assign file locking issue
    - ALSA: ad1889: Fix the missing snd_card_free() call at probe error
    - ALSA: mtpav: Don't call card private_free at probe error path
    - io_uring: move io_uring_rsrc_update2 validation
    - io_uring: verify that resv2 is 0 in io_uring_rsrc_update2
    - io_uring: verify pad field is 0 in io_get_ext_arg
    - ALSA: usb-audio: Increase max buffer size
    - ALSA: usb-audio: Limit max buffer and period sizes per time
    - macvlan: Fix leaking skb in source mode with nodst option
    - [armhf] net: ftgmac100: access hardware register after clock ready
    - cifs: potential buffer overflow in handling symlinks
    - vfio/pci: Fix vf_token mechanism when device-specific VF drivers are used
    - tun: annotate access to queue->trans_start
    - [arm64] net: dsa: felix: fix tagging protocol changes with multiple CPU
      ports
    - [arm64] net: bcmgenet: Revert "Use stronger register read/writes to assure
      ordering"
    - block: fix offset/size check in bio_trim()
    - block: null_blk: end timed out poll request
    - io_uring: abort file assignment prior to assigning creds
    - [powerpc*] KVM: PPC: Book3S HV P9: Fix "lost kick" race
    - drm/amd: Add USBC connector ID
    - btrfs: fix fallocate to use file_modified to update permissions
      consistently
    - btrfs: do not warn for free space inode in cow_file_range
    - drm/amdgpu: conduct a proper cleanup of PDB bo
    - drm/amdgpu/gmc: use PCI BARs for APUs in passthrough
    - drm/amd/display: FEC check in timing validation
    - drm/amdkfd: Fix Incorrect VMIDs passed to HWS
    - drm/amdgpu/vcn: improve vcn dpg stop procedure
    - [arm64,x86] Drivers: hv: vmbus: Deactivate sysctl_record_panic_msg by
      default in isolated guests
    - [arm64,x86] Drivers: hv: vmbus: Propagate VMbus coherence to each VMbus
      device
    - [amd64,arm64] PCI: hv: Propagate coherence from VMbus device to PCI device
    - [arm64,x86] Drivers: hv: vmbus: Prevent load re-ordering when reading ring
      buffer
    - scsi: target: tcmu: Fix possible page UAF
    - scsi: lpfc: Improve PCI EEH Error and Recovery Handling
    - scsi: lpfc: Fix unload hang after back to back PCI EEH faults
    - scsi: lpfc: Fix queue failures when recovering from PCI parity error
    - [powerpc*] scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
    - ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs
    - [armhf] gpu: ipu-v3: Fix dev_dbg frequency output
    - [powerpc*] static_call: Properly initialise DEFINE_STATIC_CALL_RET0()
    - [arm64] alternatives: mark patch_alternative() as `noinstr`
    - tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry
    - [arm64,x86] Drivers: hv: balloon: Disable balloon and hot-add accordingly
    - net: usb: aqc111: Fix out-of-bounds accesses in RX fixup
    - myri10ge: fix an incorrect free for skb in myri10ge_sw_tso
    - drm/amd/display: Fix allocate_mst_payload assert on resume
    - drbd: set QUEUE_FLAG_STABLE_WRITES
    - scsi: mpt3sas: Fail reset operation if config request timed out
    - scsi: mvsas: Add PCI ID of RocketRaid 2640
    - scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan
    - drivers: net: slip: fix NPD bug in sl_tx_timeout()
    - io_uring: zero tag on rsrc removal
    - io_uring: use nospec annotation for more indexes
    - [arm64] perf/imx_ddr: Fix undefined behavior due to shift overflowing the
      constant
    - mm/secretmem: fix panic when growing a memfd_secret
    - mm, page_alloc: fix build_zonerefs_node()
    - mm: fix unexpected zeroed page mapping with zram swap
    - hugetlb: do not demote poisoned hugetlb pages
    - revert "fs/binfmt_elf: fix PT_LOAD p_align values for loaders"
    - revert "fs/binfmt_elf: use PT_LOAD p_align values for static PIE"
    - [x86] KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded
    - SUNRPC: Fix NFSD's request deferral on RDMA transports
    - cifs: verify that tcon is valid before dereference in cifs_kill_sb
    - ath9k: Properly clear TX status area before reporting to mac80211
    - ath9k: Fix usage of driver-private space in tx_info
    - btrfs: zoned: activate block group only for extent allocation
    - btrfs: fix root ref counts in error handling in btrfs_get_root_ref
    - btrfs: mark resumed async balance as writing
    - ALSA: hda/realtek: Add quirk for Clevo PD50PNT
    - ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers
    - ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
    - nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size
    - ipv6: fix panic when forwarding a pkt with no in6 dev
    - drm/amdgpu: Enable gfxoff quirk on MacBook Pro
    - [x86] tsx: Use MSR_TSX_CTRL to clear CPUID bits
    - [x86] tsx: Disable TSX development mode at boot
    - genirq/affinity: Consider that CPUs on nodes can be unbalanced
    - tick/nohz: Use WARN_ON_ONCE() to prevent console saturation
    - dm integrity: fix memory corruption when tag_size is less than digest size
    - i2c: dev: check return value when calling dev_set_name()
    - [arm64,armhf] Revert "net: dsa: setup master before ports"
    - smp: Fix offline cpu check in flush_smp_call_function_queue()
    - dt-bindings: memory: snps,ddrc-3.80a compatible also need interrupts
    - timers: Fix warning condition in __run_timers()
    - mm, kfence: support kmem_dump_obj() for KFENCE objects
    - [x86] drm/i915: Sunset igpu legacy mmap support based on GRAPHICS_VER_FULL
    - cpu/hotplug: Remove the 'cpu' member of cpuhp_cpu_state
    - ax25: Fix UAF bugs in ax25 timers (CVE-2022-1205)
    - io_uring: use right issue_flags for splice/tee
    - io_uring: fix poll file assign deadlock
    - io_uring: fix poll error reporting
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.5
    - etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
    - perf tools: Fix segfault accessing sample_id xyarray
    - drm/amd/display: Only set PSR version when valid
    - block/compat_ioctl: fix range check in BLKGETSIZE
    - gfs2: assign rgrp glock before compute_bitstructs
    - scsi: ufs: core: scsi_get_lba() error fix
    - net/sched: cls_u32: fix netns refcount changes in u32_change()
    - ALSA: usb-audio: Clear MIDI port active flag after draining
    - ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX.
    - ALSA: hda/realtek: Add quirk for Clevo NP70PNP
    - ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek
    - ASoC: topology: Correct error handling in soc_tplg_dapm_widget_create()
    - ASoC: rk817: Use devm_clk_get() in rk817_platform_probe
    - ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component
    - ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use
    - dmaengine: idxd: fix device cleanup on disable
    - dmaengine: imx-sdma: Fix error checking in sdma_event_remap
    - dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resources
    - dmaengine: dw-edma: Fix unaligned 64bit access
    - spi: spi-mtk-nor: initialize spi controller after resume
    - firmware: cs_dsp: Fix overrun of unterminated control name string
    - esp: limit skb_page_frag_refill use to a single page
    - spi: cadence-quadspi: fix incorrect supports_op() return value
    - igc: Fix infinite loop in release_swfw_sync
    - igc: Fix BUG: scheduling while atomic
    - igc: Fix suspending when PTM is active
    - ice: allow creating VFs for !CONFIG_NET_SWITCHDEV
    - ice: fix crash in switchdev mode
    - ice: Fix memory leak in ice_get_orom_civd_data()
    - ALSA: hda/hdmi: fix warning about PCM count when used with SOF
    - rxrpc: Restore removed timer deletion
    - net/smc: Fix sock leak when release after smc_shutdown()
    - net/packet: fix packet_sock xmit return value checking
    - ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit()
    - ip6_gre: Fix skb_under_panic in __gre6_xmit()
    - net: restore alpha order to Ethernet devices in config
    - net/sched: cls_u32: fix possible leak in u32_init_knode()
    - l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu
    - ipv6: make ip6_rt_gc_expire an atomic_t
    - can: isotp: stop timeout monitoring when no first frame was sent
    - net: dsa: hellcreek: Calculate checksums in tagger
    - net: mscc: ocelot: fix broken IP multicast flooding
    - netlink: reset network and mac headers in netlink_dump()
    - drm/i915/display/psr: Unset enable_psr2_sel_fetch if other checks in intel_psr2_config_valid() fails
    - RISC-V: KVM: Remove 's' & 'u' as valid ISA extension
    - RISC-V: KVM: Restrict the extensions that can be disabled
    - net: stmmac: Use readl_poll_timeout_atomic() in atomic state
    - dmaengine: idxd: match type for retries var in idxd_enqcmds()
    - dmaengine: idxd: fix retry value to be constant for duration of function call
    - dmaengine: idxd: add RO check for wq max_batch_size write
    - dmaengine: idxd: add RO check for wq max_transfer_size write
    - dmaengine: idxd: skip clearing device context when device is read-only
    - selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets
    - selftests: mlxsw: vxlan_flooding_ipv6: Prevent flooding of unwanted packets
    - userfaultfd: mark uffd_wp regardless of VM_WRITE flag
    - arm64: mm: fix p?d_leaf()
    - XArray: Disallow sibling entries of nodes
    - drm/msm/gpu: Rename runtime suspend/resume functions
    - drm/msm/gpu: Remove mutex from wait_event condition
    - ARM: vexpress/spc: Avoid negative array index when !SMP
    - reset: renesas: Check return value of reset_control_deassert()
    - reset: tegra-bpmp: Restore Handle errors in BPMP response
    - platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative
    - ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant
    - drm/msm/disp: check the return value of kzalloc()
    - selftests: KVM: Free the GIC FD when cleaning up in arch_timer
    - ALSA: hda: intel-dsp-config: update AlderLake PCI IDs
    - arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes
    - vxlan: fix error return code in vxlan_fdb_append
    - cifs: Check the IOCB_DIRECT flag, not O_DIRECT
    - net: atlantic: Avoid out-of-bounds indexing
    - mt76: Fix undefined behavior due to shift overflowing the constant
    - brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant
    - dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info()
    - drm/msm/mdp5: check the return of kzalloc()
    - KVM: x86: hyper-v: Avoid writing to TSC page without an active vCPU
    - net: macb: Restart tx only if queue pointer is lagging
    - scsi: iscsi: Release endpoint ID when its freed
    - scsi: iscsi: Merge suspend fields
    - scsi: iscsi: Fix NOP handling during conn recovery
    - scsi: qedi: Fix failed disconnect handling
    - stat: fix inconsistency between struct stat and struct compat_stat
    - VFS: filename_create(): fix incorrect intent.
    - nvme: add a quirk to disable namespace identifiers
    - nvme-pci: disable namespace identifiers for the MAXIO MAP1002/1202
    - nvme-pci: disable namespace identifiers for Qemu controllers
    - irq_work: use kasan_record_aux_stack_noalloc() record callstack
    - EDAC/synopsys: Read the error count from the correct register
    - mm/memory-failure.c: skip huge_zero_page in memory_failure()
    - memcg: sync flush only if periodic flush is delayed
    - mm, hugetlb: allow for "high" userspace addresses
    - oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup
    - mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove()
    - ata: pata_marvell: Check the 'bmdma_addr' beforing reading
    - dma: at_xdmac: fix a missing check on list iterator
    - dmaengine: imx-sdma: fix init of uart scripts
    - net: atlantic: invert deep par in pm functions, preventing null derefs
    - drm/radeon: fix logic inversion in radeon_sync_resv
    - io_uring: free iovec if file assignment fails
    - Input: omap4-keypad - fix pm_runtime_get_sync() error checking
    - scsi: sr: Do not leak information in ioctl
    - sched/pelt: Fix attach_entity_load_avg() corner case
    - perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled
    - drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised
    - drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare
    - powerpc/time: Always set decrementer in timer_interrupt()
    - KVM: PPC: Fix TCE handling for VFIO
    - drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage
    - powerpc/perf: Fix power9 event alternatives
    - powerpc/perf: Fix power10 event alternatives
    - arm/xen: Fix some refcount leaks
    - perf script: Always allow field 'data_src' for auxtrace
    - perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event
    - fs: fix acl translation
    - cifs: fix NULL ptr dereference in refresh_mounts()
    - cifs: use correct lock type in cifs_reconnect()
    - xtensa: patch_text: Fixup last cpu should be master
    - xtensa: fix a7 clobbering in coprocessor context load/store
    - openvswitch: fix OOB access in reserve_sfa_size()
    - gpio: Request interrupts after IRQ is initialized
    - ASoC: rt5682: fix an incorrect NULL check on list iterator
    - ASoC: soc-dapm: fix two incorrect uses of list iterator
    - e1000e: Fix possible overflow in LTR decoding
    - codecs: rt5682s: fix an incorrect NULL check on list iterator
    - ARC: entry: fix syscall_trace_exit argument
    - drm/vmwgfx: Fix gem refcounting and memory evictions
    - arm_pmu: Validate single/group leader events
    - KVM: x86/pmu: Update AMD PMC sample period to fix guest NMI-watchdog
    - KVM: x86: Don't re-acquire SRCU lock in complete_emulated_io()
    - KVM: x86: Pend KVM_REQ_APICV_UPDATE during vCPU creation to fix a race
    - KVM: nVMX: Defer APICv updates while L2 is active until L1 is active
    - KVM: SVM: Simplify and harden helper to flush SEV guest page(s)
    - KVM: SVM: Flush when freeing encrypted pages even on SME_COHERENT CPUs
    - ext4: fix fallocate to use file_modified to update permissions consistently
    - ext4: fix symlink file size not match to file content
    - ext4: fix use-after-free in ext4_search_dir
    - ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
    - ext4, doc: fix incorrect h_reserved size
    - ext4: fix overhead calculation to account for the reserved gdt blocks
    - ext4: force overhead calculation if the s_overhead_cluster makes no sense
    - ext4: update the cached overhead value in the superblock
    - jbd2: fix a potential race while discarding reserved buffers after an abort
    - spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller
    - ASoC: SOF: topology: cleanup dailinks on widget unload
    - io_uring: fix leaks on IOPOLL and CQE_SKIP
    - arm64: dts: qcom: add IPA qcom,qmp property
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.6
    - usb: mtu3: fix USB 3.0 dual-role-switch from device to host
    - floppy: disable FDRAWCMD by default
    - USB: quirks: add a Realtek card reader
    - USB: quirks: add STRING quirk for VCOM device
    - USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
    - USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader
    - USB: serial: option: add support for Cinterion MV32-WA/MV32-WB
    - USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions
    - usb: xhci: tegra:Fix PM usage reference leak of tegra_xusb_unpowergate_partitions
    - xhci: Enable runtime PM on second Alderlake controller
    - xhci: stop polling roothubs after shutdown
    - xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms
    - iio: dac: ad5592r: Fix the missing return value.
    - iio: scd4x: check return of scd4x_write_and_fetch
    - iio: dac: ad5446: Fix read_raw not returning set value
    - iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on()
    - iio: imu: inv_icm42600: Fix I2C init possible nack
    - usb: misc: fix improper handling of refcount in uss720_probe()
    - usb: core: Don't hold the device lock while sleeping in do_proc_control()
    - usb: typec: ucsi: Fix reuse of completion structure
    - usb: typec: ucsi: Fix role swapping
    - usb: gadget: uvc: Fix crash when encoding data for usb request
    - usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind()
    - usb: dwc3: Try usb-role-switch first in dwc3_drd_init
    - usb: dwc3: core: Fix tx/rx threshold settings
    - usb: dwc3: core: Only handle soft-reset in DCTL
    - usb: dwc3: gadget: Return proper request status
    - usb: dwc3: pci: add support for the Intel Meteor Lake-P
    - usb: cdns3: Fix issue for clear halt endpoint
    - usb: phy: generic: Get the vbus supply
    - kernfs: fix NULL dereferencing in kernfs_remove
    - binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
    - binder: Address corner cases in deferred copy and fixup
    - serial: imx: fix overrun interrupts in DMA mode
    - serial: amba-pl011: do not time out prematurely when draining tx fifo
    - serial: 8250: Also set sticky MCR bits in console restoration
    - serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
    - eeprom: at25: Use DMA safe buffers
    - arch_topology: Do not set llc_sibling if llc_id is invalid
    - topology: make core_mask include at least cluster_siblings
    - ceph: fix possible NULL pointer dereference for req->r_session
    - bus: mhi: host: pci_generic: Add missing poweroff() PM callback
    - bus: mhi: host: pci_generic: Flush recovery worker during freeze
    - arm64: dts: imx8mm-venice: fix spi2 pin configuration
    - pinctrl: samsung: fix missing GPIOLIB on ARM64 Exynos config
    - f2fs: should not truncate blocks during roll-forward recovery
    - hex2bin: make the function hex_to_bin constant-time
    - hex2bin: fix access beyond string end
    - bus: fsl-mc-msi: Fix MSI descriptor mutex lock for msi_first_desc()
    - riscv: patch_text: Fixup last cpu should be master
    - x86/cpu: Load microcode during restore_processor_state()
    - x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests
    - iocost: don't reset the inuse weight of under-weighted debtors
    - virtio_net: fix wrong buf address calculation when using xdp
    - cpufreq: qcom-hw: drop affinity hint before freeing the IRQ
    - cpufreq: qcom-hw: fix the race between LMH worker and cpuhp
    - cpufreq: qcom-hw: fix the opp entries refcounting
    - cpufreq: qcom-cpufreq-hw: Fix throttle frequency value on EPSS platforms
    - video: fbdev: udlfb: properly check endpoint type
    - arm64: dts: meson: remove CPU opps below 1GHz for G12B boards
    - arm64: dts: meson: remove CPU opps below 1GHz for SM1 boards
    - iio: dac: ad3552r: fix signedness bug in ad3552r_reset()
    - iio:imu:bmi160: disable regulator in error path
    - iio:filter:admv8818: select REGMAP_SPI for ADMV8818
    - mtd: rawnand: fix ecc parameters for mt7622
    - tee: optee: add missing mutext_destroy in optee_ffa_probe
    - xsk: Fix l2fwd for copy mode + busy poll combo
    - arm64: dts: imx8qm: Correct SCU clock controller's compatible property
    - USB: Fix xhci event ring dequeue pointer ERDP update issue
    - soc: imx: imx8m-blk-ctrl: Fix IMX8MN_DISPBLK_PD_ISI hang
    - ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue
    - iio:dac:ad3552r: Fix an IS_ERR() vs NULL check
    - arm64: dts: imx8mq-tqma8mq: change the spi-nor tx
    - arm64: dts: imx8mn: Fix SAI nodes
    - arm64: dts: meson-sm1-bananapi-m5: fix wrong GPIO pin labeling for CON1
    - phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe
    - phy: samsung: exynos5250-sata: fix missing device put in probe error paths
    - ARM: OMAP2+: Fix refcount leak in omap_gic_of_init
    - bus: ti-sysc: Make omap3 gpt12 quirk handling SoC specific
    - ARM: dts: dra7: Fix suspend warning for vpe powerdomain
    - phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks
    - ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek
    - ARM: dts: at91: sama5d4_xplained: fix pinctrl phandle name
    - ARM: dts: at91: fix pinctrl phandles
    - phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe
    - phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe
    - interconnect: qcom: sc7180: Drop IP0 interconnects
    - interconnect: qcom: sdx55: Drop IP0 interconnects
    - ARM: dts: Fix mmc order for omap3-gta04
    - ARM: dts: am33xx-l4: Add missing touchscreen clock properties
    - ARM: dts: am3517-evm: Fix misc pinmuxing
    - ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35
    - pinctrl: qcom: sm6350: fix order of UFS & SDC pins
    - ipvs: correctly print the memory size of ip_vs_conn_tab
    - phy: amlogic: fix error path in phy_g12a_usb3_pcie_probe()
    - pinctrl: mediatek: moore: Fix build error
    - mtd: rawnand: Fix return value check of wait_for_completion_timeout
    - mtd: fix 'part' field data corruption in mtd_info
    - pinctrl: stm32: Do not call stm32_gpio_get() for edge triggered IRQs in EOI
    - memory: renesas-rpc-if: Fix HF/OSPI data transfer in Manual Mode
    - net: dsa: Add missing of_node_put() in dsa_port_link_register_of
    - netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion
    - bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook
    - pinctrl: rockchip: fix RK3308 pinmux bits
    - tcp: md5: incorrect tcp_header_len for incoming connections
    - pinctrl: stm32: Keep pinctrl block clock enabled when LEVEL IRQ requested
    - tcp: ensure to use the most recently sent skb when filling the rate sample
    - wireguard: device: check for metadata_dst with skb_valid_dst()
    - sctp: check asoc strreset_chunk in sctp_generate_reconf_event
    - ARM: dts: imx6ull-colibri: fix vqmmc regulator
    - arm64: dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock
    - pinctrl: pistachio: fix use of irq_of_parse_and_map()
    - cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe
    - net: hns3: clear inited state and stop client after failed to register netdev
    - net: hns3: fix error log of tx/rx tqps stats
    - net: hns3: modify the return code of hclge_get_ring_chain_from_mbx
    - net: hns3: add validity check for message data length
    - net: hns3: add return value for mailbox handling in PF
    - net/smc: sync err code when tcp connection was refused
    - net: lan966x: fix a couple off by one bugs
    - ip_gre: Make o_seqno start from 0 in native mode
    - ip6_gre: Make o_seqno start from 0 in native mode
    - ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode
    - tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
    - tcp: make sure treq->af_specific is initialized
    - bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
    - clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource()
    - cpufreq: qcom-cpufreq-hw: Clear dcvs interrupts
    - mctp: defer the kfree of object mdev->addrs
    - net: bcmgenet: hide status block before TX timestamping
    - net: phy: marvell10g: fix return value on error
    - net: dsa: mv88e6xxx: Fix port_hidden_wait to account for port_base_addr
    - drm/sun4i: Remove obsolete references to PHYS_OFFSET
    - ice: wait 5 s for EMP reset after firmware flash
    - Bluetooth: hci_event: Fix checking for invalid handle on error status
    - net: dsa: lantiq_gswip: Don't set GSWIP_MII_CFG_RMII_CLK
    - io_uring: check reserved fields for send/sendmsg
    - io_uring: check reserved fields for recv/recvmsg
    - netfilter: nf_conntrack_tcp: re-init for syn packets only
    - netfilter: conntrack: fix udp offload timeout sysctl
    - platform/x86: asus-wmi: Potential buffer overflow in asus_wmi_evaluate_method_buf()
    - platform/x86: asus-wmi: Fix driver not binding when fan curve control probe fails
    - drm/amdkfd: Fix GWS queue count
    - drm/amd/display: Fix memory leak in dcn21_clock_source_create
    - tls: Skip tls_append_frag on zero copy size
    - bnx2x: fix napi API usage sequence
    - net: fec: add missing of_node_put() in fec_enet_init_stop_mode()
    - gfs2: Minor retry logic cleanup
    - gfs2: Make sure not to return short direct writes
    - gfs2: No short reads or writes upon glock contention
    - perf arm-spe: Fix addresses of synthesized SPE events
    - ixgbe: ensure IPsec VF<->PF compatibility
    - net: enetc: allow tc-etf offload even with NETIF_F_CSUM_MASK
    - Revert "ibmvnic: Add ethtool private flag for driver-defined queue limits"
    - tcp: fix F-RTO may not work correctly when receiving DSACK
    - io_uring: fix uninitialized field in rw io_kiocb
    - ASoC: soc-pcm: use GFP_KERNEL when the code is sleepable
    - ASoC: cs35l41: Fix a shift-out-of-bounds warning found by UBSAN
    - ASoC: rt711/5682: check if bus is active before deferred jack detection
    - ASoC: Intel: soc-acpi: correct device endpoints for max98373
    - ASoC: wm8731: Disable the regulator when probing fails
    - Input: cypress-sf - register a callback to disable the regulators
    - ext4: fix bug_on in start_this_handle during umount filesystem
    - arch: xtensa: platforms: Fix deadlock in rs_close()
    - ksmbd: increment reference count of parent fp
    - ksmbd: set fixed sector size to FS_SECTOR_SIZE_INFORMATION
    - erofs: fix use-after-free of on-stack io[]
    - bonding: do not discard lowest hash bit for non layer3+4 hashing
    - x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
    - cifs: destage any unwritten data to the server before calling copychunk_write
    - drivers: net: hippi: Fix deadlock in rr_close()
    - powerpc/perf: Fix 32bit compile
    - ALSA: hda: intel-dsp-config: Add RaptorLake PCI IDs
    - selftest/vm: verify mmap addr in mremap_test
    - selftest/vm: verify remap destination address in mremap_test
    - bfq: Fix warning in bfqq_request_over_limit()
    - Revert "ACPI: processor: idle: fix lockup regression on 32-bit ThinkPad T40"
    - Revert "block: inherit request start time from bio for BLK_CGROUP"
    - zonefs: Fix management of open zones
    - zonefs: Clear inode information flags on inode creation
    - kasan: prevent cpu_quarantine corruption when CPU offline and cache shrink occur at same time
    - mtd: rawnand: qcom: fix memory corruption that causes panic
    - netfilter: Update ip6_route_me_harder to consider L3 domain
    - drm/amdgpu: don't runtime suspend if there are displays attached (v3)
    - drm/i915: Check EDID for HDR static metadata when choosing blc
    - drm/i915: Fix SEL_FETCH_PLANE_*(PIPE_B+) register addresses
    - net: ethernet: stmmac: fix write to sgmii_adapter_base
    - ACPI: processor: idle: Avoid falling back to C3 type C-states
    - thermal: int340x: Fix attr.show callback prototype
    - btrfs: fix direct I/O read repair for split bios
    - btrfs: fix direct I/O writes for split bios on zoned devices
    - btrfs: fix leaked plug after failure syncing log on zoned filesystems
    - btrfs: zoned: use dedicated lock for data relocation
    - btrfs: fix assertion failure during scrub due to block group reallocation
    - ARM: dts: at91: sama7g5ek: enable pull-up on flexcom3 console lines
    - ARM: dts: imx8mm-venice-gw{71xx,72xx,73xx}: fix OTG controller OC mode
    - perf symbol: Pass is_kallsyms to symbols__fixup_end()
    - perf symbol: Update symbols__fixup_end()
    - perf symbol: Remove arch__symbols__fixup_end()
    - tty: n_gsm: fix missing mux reset on config change at responder
    - tty: n_gsm: fix restart handling via CLD command
    - tty: n_gsm: fix decoupled mux resource
    - tty: n_gsm: fix mux cleanup after unregister tty device
    - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
    - tty: n_gsm: fix frame reception handling
    - tty: n_gsm: fix malformed counter for out of frame data
    - netfilter: nft_socket: only do sk lookups when indev is available
    - tty: n_gsm: fix insufficient txframe size
    - tty: n_gsm: fix wrong DLCI release order
    - tty: n_gsm: fix missing explicit ldisc flush
    - tty: n_gsm: fix wrong command retry handling
    - tty: n_gsm: fix wrong command frame length field encoding
    - tty: n_gsm: fix wrong signal octets encoding in MSC
    - tty: n_gsm: fix missing tty wakeup in convergence layer type 2
    - tty: n_gsm: fix reset fifo race condition
    - tty: n_gsm: fix incorrect UA handling
    - tty: n_gsm: fix missing update of modem controls after DLCI open
    - tty: n_gsm: fix broken virtual tty handling
    - tty: n_gsm: fix invalid use of MSC in advanced option
    - tty: n_gsm: fix software flow control handling
    - tty: n_gsm: fix sometimes uninitialized warning in gsm_dlci_modem_output()
    - objtool: Fix code relocs vs weak symbols
    - objtool: Fix type of reloc::addend
    - powerpc/64: Add UADDR64 relocation support

  [ Diederik de Haas ]
  * [armhf] drivers/net/ethernet/freescale: Enable FEC as module
    (Closes: #991461)
  * [x86] drivers/extcon: Enable EXTCON_AXP288 as module
  * [x86] drivers/power/supply: Enable AXP288_CHARGER as module
    (Closes: #940672)

  [ Vagrant Cascadian ]
  * [arm64] Enable modules for MNT Reform: DRM_LVDS_CODEC,
    DRM_SIMPLE_BRIDGE, DRM_TI_SN65DSI86, DRM_CDNS_MHDP8546, DRM_IMX_DCSS,
    DRM_PANEL_LVDS, I2C_IMX_LPI2C, I2C_MUX_REG, INTERCONNECT_IMX,
    INTERCONNECT_IMX8MQ, MFD_WM8994, MUX_GPIO, MUX_MMIO, RTC_DRV_PCF8523,
    USB_EHCI_FSL, BACKLIGHT_GPIO, BACKLIGHT_LED, SND_SOC_WM8960,
    SND_SOC_FSL_MICFIL, SND_IMX_SOC, SND_SOC_FSL_ASOC_CARD,
    SND_SOC_IMX_AUDMIX and SND_SOC_IMX_HDMI. Thanks to Johannes Schauer
    Marin Rodrigues. (Closes: #1009858)

  [ Salvatore Bonaccorso ]
  * Bump ABI to 2

 -- Bastian Blank <waldi@debian.org>  Wed, 11 May 2022 18:50:31 +0200

linux (5.17.3-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.2
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.3

  [ Salvatore Bonaccorso ]
  * linux-kbuild: Include scripts/pahole-flags.sh (Closes: #1008501)
  * [x86] drivers/cpufreq: Enable X86_AMD_PSTATE as module (Closes: #1009302)
  * [rt] Update to 5.17.1-rt17
  * Set ABI to 1

  [ Adriaan Schmidt ]
  * tools: install perf python bindings (Closes: #860957)

  [ Ben Hutchings ]
  * d/bin/gencontrol_signed.py: Add support for pkg.linux.quick profile
  * lintian: Add lintian-overrides to linux-signed-* for non-issues
  * d/salsa-ci.yml: Don't disable signed code
  * d/certs: Add certificate and key to enable test signing in CI
  * d/salsa-ci.yml: Add jobs to build and test the signed packages

  [ Vagrant Cascadian ]
  * [arm64] Add nvmem-rockchip-efuse and phy-rockchip-inno-hdmi to fb-modules
    udeb.

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 18 Apr 2022 14:36:36 +0200

linux (5.17.1-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.17
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.1

  [ Bastian Blank ]
  * [arm64] Enable HyperV support.  (closes: #1007023)
  * Replace FB_HYPERV with DRM_HYPERV.
  * Allow disabling debug info by build profile.
  * [arm64] Make sure hyperv-daemons are actually build.

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.17-rt15

  [ Diederik de Haas ]
  * [armhf] Enable SUN8I_THERMAL as module (Closes: #1007799)

 -- Bastian Blank <waldi@debian.org>  Tue, 29 Mar 2022 09:16:17 +0200

linux (5.17~rc8-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.17-rc7-rt13

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 14 Mar 2022 07:04:37 +0100

linux (5.17~rc7-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.17-rc7-rt12

 -- Ben Hutchings <benh@debian.org>  Wed, 09 Mar 2022 22:49:07 +0100

linux (5.17~rc6-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.17-rc6-rt10

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 03 Mar 2022 06:30:16 +0100

linux (5.17~rc5-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.17-rc5-rt8

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 26 Feb 2022 14:11:52 +0100

linux (5.17~rc4-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Bastian Blank ]
  * Add pkg.linux.nokerneldbg build profile that excludes kernel debug
    packages.

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.17-rc4-rt7

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 18 Feb 2022 13:01:10 +0100

linux (5.17~rc3-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Ben Hutchings ]
  * Rebase patches:
    - Drop "x86-32: Disable 3D-Now in generic config"
    - Drop "RISC-V: Use SBI SRST extension when available"
    - Drop "objtool: check: give big enough buffer for pv_ops"
    - Drop part of "sh: Do not use hyphen in exported variable names"
    - Update "add sysctl to disallow unprivileged CLONE_NEWUSER by default"
    - Update "Disable uImage generation for mips generic"
    - Update "MODSIGN: do not load mok when secure boot disabled"
  * [rt] Update to 5.17-rc2-rt4
  * linux-kbuild: Build extract-cert in certs/ instead of scripts/
  * d/rules.real: Pass C compiler options to user-space build in HOSTCFLAGS too

  [ Aurelien Jarno ]
  * [riscv64] Add basic support for StarFive JH7100 RISC-V SoC: enable
    I2C_DESIGNWARE_PLATFORM, MFD_TPS65086, REGULATOR_TPS65086, SERIAL_8250_DW,
    SOC_STARFIVE

 -- Ben Hutchings <benh@debian.org>  Fri, 11 Feb 2022 02:28:15 +0100

linux (5.16.18-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.15
    - HID: elo: Revert USB reference counting
    - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts
    - [arm64] clk: qcom: gdsc: Add support to update GDSC transition delay
    - HID: vivaldi: fix sysfs attributes leak
    - HID: nintendo: check the return value of alloc_workqueue()
    - [arm64] dts: armada-3720-turris-mox: Add missing ethernet0 alias
    - tipc: fix kernel panic when enabling bearer
    - [arm64] net: phy: meson-gxl: fix interrupt handling in forced mode
    - mISDN: Fix memory leak in dsp_pipeline_build()
    - vhost: fix hung thread due to erroneous iotlb entries
    - virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero
    - virtio-blk: Remove BUG_ON() in virtio_queue_rq()
    - isdn: hfcpci: check the return value of dma_set_mask() in setup_hw()
    - net: qlogic: check the return value of dma_alloc_coherent() in
      qed_vf_hw_prepare()
    - esp: Fix possible buffer overflow in ESP transformation (CVE-2022-27666)
    - esp: Fix BEET mode inter address family tunneling on GSO
    - net: gro: move skb_gro_receive_list to udp_offload.c
    - qed: return status of qed_iov_get_link
    - smsc95xx: Ignore -ENODEV errors when device is unplugged
    - gpiolib: acpi: Convert ACPI value of debounce to microseconds
    - [x86] drm/i915/psr: Set "SF Partial Frame Enable" also on full update
    - drm/sun4i: mixer: Fix P010 and P210 format numbers
    - iavf: Fix handling of vlan strip virtual channel messages
    - i40e: stop disabling VFs due to PF error responses
    - ice: stop disabling VFs due to PF error responses
    - ice: Fix error with handling of bonding MTU
    - ice: Don't use GFP_KERNEL in atomic context
    - ice: Fix curr_link_speed advertised speed
    - ethernet: Fix error handling in xemaclite_of_probe
    - tipc: fix incorrect order of state message data sanity check
    - [armhf] net: ethernet: ti: cpts: Handle error for clk_enable
    - ax25: Fix NULL pointer dereference in ax25_kill_by_device
    - net/mlx5: Fix size field in bufferx_reg struct
    - net/mlx5: Fix a race on command flush flow
    - net/mlx5e: Lag, Only handle events from highest priority multipath entry
    - net/mlx5e: SHAMPO, reduce TIR indication
    - NFC: port100: fix use-after-free in port100_send_complete
    - mm: gup: make fault_in_safe_writeable() use fixup_user_fault()
    - net: phy: DP83822: clear MISR2 register to disable interrupts
    - sctp: fix kernel-infoleak for SCTP sockets
    - [arm64] net: bcmgenet: Don't claim WOL when its not available
    - [arm64] net: phy: meson-gxl: improve link-up behavior
    - swiotlb: fix info leak with DMA_FROM_DEVICE (CVE-2022-0854)
    - [arm64] usb: dwc3: pci: add support for the Intel Raptor Lake-S
    - [x86] pinctrl: tigerlake: Revert "Add Alder Lake-M ACPI ID"
    - KVM: Fix lockdep false negative during host resume
    - [x86] kvm: x86: Disable KVM_HC_CLOCK_PAIRING if tsc is in always catchup
      mode
    - [arm64,armhf] spi: rockchip: Fix error in getting num-cs property
    - [arm64,armhf] spi: rockchip: terminate dma transmission when slave abort
    - [arm*] drm/vc4: hdmi: Unregister codec device on unbind
    - of/fdt: move elfcorehdr reservation early for crash dump kernel
    - [x86] kvm: Don't use pv tlb/ipi/sched_yield if on 1 vCPU
    - drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
    - net-sysfs: add check for netdevice being present to speed_show
    - [armhf] hwmon: (pmbus) Clear pmbus fault/warning bits after read
    - nvme-tcp: send H2CData PDUs based on MAXH2CDATA
    - PCI: Mark all AMD Navi10 and Navi14 GPU ATS as broken
    - gpio: Return EPROBE_DEFER if gc->to_irq is NULL
    - drm/amdgpu: bypass tiling flag check in virtual display case (v2)
    - Revert "xen-netback: remove 'hotplug-status' once it has served its
      purpose"
    - Revert "xen-netback: Check for hotplug-status existence before watching"
    - ipv6: prevent a possible race condition with lifetimes
    - tracing: Ensure trace buffer is at least 4096 bytes large
    - tracing/osnoise: Make osnoise_main to sleep for microseconds
    - [armel,armhf] Spectre-BHB: provide empty stub for non-config
    - fuse: fix fileattr op failure
    - fuse: fix pipe buffer lifetime for direct_io (CVE-2022-1011)
    - [arm64,x86] staging: rtl8723bs: Fix access-point mode deadlock
    - [arm64] net: macb: Fix lost RX packet wakeup race in NAPI receive
    - [arm64] mmc: meson: Fix usage of meson_mmc_post_req()
    - tracing/osnoise: Force quiescent states while tracing
    - tracing/osnoise: Do not unregister events twice
    - [arm64] dts: marvell: armada-37xx: Remap IO space to bus address 0x0
    - [arm64] Ensure execute-only permissions are not allowed without EPAN
    - swiotlb: rework "fix info leak with DMA_FROM_DEVICE" (CVE-2022-0854)
    - virtio: unexport virtio_finalize_features
    - virtio: acknowledge all features before access
    - net/mlx5: Fix offloading with ESWITCH_IPV4_TTL_MODIFY_ENABLE
    - [armel,armhf] fix Thumb2 regression with Spectre BHB
    - watch_queue: Fix filter limit check (CVE-2022-0995)
    - watch_queue, pipe: Free watchqueue state after clearing pipe ring
      (CVE-2022-0995)
    - watch_queue: Fix to release page in ->release() (CVE-2022-0995)
    - watch_queue: Fix to always request a pow-of-2 pipe ring size
      (CVE-2022-0995)
    - watch_queue: Fix the alloc bitmap size to reflect notes allocated
      (CVE-2022-0995)
    - watch_queue: Free the alloc bitmap when the watch_queue is torn down
      (CVE-2022-0995)
    - watch_queue: Fix lack of barrier/sync/lock between post and read
      (CVE-2022-0995)
    - watch_queue: Make comment about setting ->defunct more accurate
      (CVE-2022-0995)
    - [x86] boot: Fix memremap of setup_indirect structures
    - [x86] boot: Add setup_indirect support in early_memremap_is_setup_data()
    - [x86] module: Fix the paravirt vs alternative order
    - [x86] traps: Mark do_int3() NOKPROBE_SYMBOL
    - perf parse: Fix event parser error for hybrid systems
    - btrfs: make send work with concurrent block group relocation
    - vhost: allow batching hint without size
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.16
    - Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0"
    - [arm64] dts: rockchip: fix rk3399-puma-haikou USB OTG mode
    - xfrm: Check if_id in xfrm_migrate
    - xfrm: Fix xfrm migrate issues when address family changes
    - mac80211: refuse aggregations sessions before authorized
    - [mips64el,mipsel] smp: fill in sibling and core maps earlier
    - Bluetooth: hci_core: Fix leaking sent_cmd skb
    - [x86] atm: firestream: check the return value of ioremap() in fs_init()
    - netfilter: egress: silence egress hook lockdep splats
    - Input: goodix - use the new soc_intel_is_byt() helper
    - Input: goodix - workaround Cherry Trail devices with a bogus ACPI
      Interrupt() resource
    - iwlwifi: don't advertise TWT support
    - drm/vrr: Set VRR capable prop only if it is attached to connector
    - nl80211: Update bss channel on channel switch for P2P_CLIENT
    - tcp: make tcp_read_sock() more robust
    - sfc: extend the locking on mcdi->seqno
    - bnx2: Fix an error message
    - ice: Fix race condition during interface enslave
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.17
    - crypto: qcom-rng - ensure buffer for generate is completely filled
    - ocfs2: fix crash when initialize filecheck kobj fails
    - mm: swap: get rid of livelock in swapin readahead
    - block: release rq qos structures for queue without disk
    - [x86] drm/mgag200: Fix PLL setup for g200wb and g200ew
    - efi: fix return value of __setup handlers
    - alx: acquire mutex for alx_reinit in alx_change_mtu
    - vsock: each transport cycles only on its own sockets
    - esp6: fix check on ipv6_skip_exthdr's return value
    - net: phy: marvell: Fix invalid comparison in the resume and suspend
      functions
    - net/packet: fix slab-out-of-bounds access in packet_recvmsg()
    - nvmet: revert "nvmet: make discovery NQN configurable"
    - atm: eni: Add check for dma_map_single
    - ice: fix NULL pointer dereference in ice_update_vsi_tx_ring_stats()
    - iavf: Fix double free in iavf_reset_task
    - hv_netvsc: Add check for kvmalloc_array
    - [armhf] drm/imx: parallel-display: Remove bus flags check in
      imx_pd_bridge_atomic_check()
    - [arm64,armhf] drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings
    - net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
    - [arm64,armhf] net: dsa: Add missing of_node_put() in dsa_port_parse_of
    - net: phy: mscc: Add MODULE_FIRMWARE macros
    - bnx2x: fix built-in kernel driver load failure
    - [arm64] net: bcmgenet: skip invalid partial checksums
    - [arm64] net: mscc: ocelot: fix backwards compatibility with single-chain
      tc-flower offload
    - iavf: Fix hang during reboot/shutdown
    - usb: gadget: rndis: prevent integer overflow in rndis_set_response()
    - usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
    - usb: usbtmc: Fix bug in pipe direction for control transfers
    - scsi: mpt3sas: Page fault in reply q processing
    - Input: aiptek - properly check endpoint type
    - [arm64] errata: avoid duplicate field initializer
    - perf symbols: Fix symbol size calculation condition
    - Revert "ath10k: drop beacon and probe response which leak from other
      channel"
    - btrfs: skip reserved bytes warning on unmount after log cleanup failure
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.18
    - Bluetooth: btusb: Add another Realtek 8761BU
    - llc: fix netdevice reference leaks in llc_ui_bind()
    - ALSA: oss: Fix PCM OSS buffer allocation overflow
    - ALSA: hda/realtek: Add quirk for Clevo NP70PNJ
    - ALSA: hda/realtek: Add quirk for Clevo NP50PNJ
    - ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671
    - ALSA: hda/realtek: Add quirk for ASUS GA402
    - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
      (CVE-2022-1048)
    - ALSA: pcm: Fix races among concurrent read/write and buffer changes
      (CVE-2022-1048)
    - nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
      (CVE-2022-26490)
    - net: ipv6: fix skb_over_panic in __ip6_append_data
    - tpm: Fix error handling in async work
    - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
      (CVE-2022-1048)
    - ALSA: pcm: Fix races among concurrent prealloc proc writes (CVE-2022-1048)
    - ALSA: pcm: Add stream lock during PCM reset ioctl operations
    - ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB
    - ALSA: cmipci: Restore aux vol on suspend/resume
    - ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
    - [arm64] drivers: net: xgene: Fix regression in CRC stripping
    - netfilter: nf_tables: initialize registers in nft_do_chain()
      (CVE-2022-1016)
    - netfilter: nf_tables: validate registers coming from userspace.
      (CVE-2022-1015)
    - [x86] ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board
    - ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3
    - [x86] ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU
    - [x86] crypto: qat - disable registration of algorithms
    - Bluetooth: btusb: Add one more Bluetooth part for the Realtek RTL8852AE
    - Revert "ath: add support for special 0x0 regulatory domain"
    - drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()
    - rcu: Don't deboost before reporting expedited quiescent state
    - uaccess: fix integer overflow on access_ok()
    - mac80211: fix potential double free on mesh join
    - tpm: use try_get_ops() in tpm-space.c
    - [arm64] wcn36xx: Differentiate wcn3660 from wcn3620
    - llc: only change llc->dev when bind() succeeds

  [ Salvatore Bonaccorso ]
  * Bump ABI to 6

  [ Vincent Blut ]
  * sound/pci/hda: Enable SND_HDA_CODEC_CS8409 as module (Closes: #1008122)

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 29 Mar 2022 22:46:53 +0200

linux (5.16.14-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.13
    - mac80211_hwsim: report NOACK frames in tx_status
    - mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work
    - [arm*] i2c: bcm2835: Avoid clock stretching timeouts
    - [x86] ASoC: rt5682s: do not block workqueue if card is unbound
    - ASoC: rt5682: do not block workqueue if card is unbound
    - regulator: core: fix false positive in regulator_late_cleanup()
    - Input: clear BTN_RIGHT/MIDDLE on buttonpads
    - btrfs: get rid of warning on transaction commit when using flushoncommit
    - [arm64] KVM: arm64: vgic: Read HW interrupt pending state from the HW
    - block: loop:use kstatfs.f_bsize of backing file to set discard granularity
    - tipc: fix a bit overflow in tipc_crypto_key_rcv()
    - cifs: do not use uninitialized data in the owner/group sid
    - cifs: fix double free race when mount fails in cifs_get_root()
    - [amd64] HID: amd_sfh: Handle amd_sfh work buffer in PM ops
    - [amd64] HID: amd_sfh: Add functionality to clear interrupts
    - [amd64] HID: amd_sfh: Add interrupt handler to process interrupts
    - cifs: modefromsids must add an ACE for authenticated users
    - drm/amd/pm: correct UMD pstate clocks for Dimgrey Cavefish and Beige Goby
    - net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990
    - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
    - usb: gadget: don't release an existing dev->buf (CVE-2022-24958)
    - usb: gadget: clear related members when goto fail (CVE-2022-24958)
    - exfat: reuse exfat_inode_info variable instead of calling EXFAT_I()
    - exfat: fix i_blocks for files truncated over 4 GiB
    - tracing: Add test for user space strings when filtering on string pointers
    - [arm64] Mark start_backtrace() notrace and NOKPROBE_SYMBOL
    - [armhf] serial: stm32: prevent TDR register overwrite when sending x_char
    - [arm64] KVM: arm64: Workaround Cortex-A510's single-step and PAC trap
      errata
    - ext4: drop ineligible txn start stop APIs
    - ext4: simplify updating of fast commit stats
    - ext4: fast commit may not fallback for ineligible commit
    - ext4: fast commit may miss file actions
    - sched/fair: Fix fault in reweight_entity
    - [x86] KVM: x86: Add KVM_CAP_ENABLE_CAP to x86
    - ata: pata_hpt37x: fix PCI clock detection
    - drm/amdgpu: check vm ready by amdgpu_vm->evicting flag
    - tracing: Add ustring operation to filtering string pointers
    - ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()
      (CVE-2022-0742)
    - btrfs: defrag: bring back the old file extent search behavior
    - btrfs: defrag: don't use merged extent map for their generation check
    - [x86] ALSA: intel_hdmi: Fix reference to PCM buffer address
    - ucounts: Fix systemd LimitNPROC with private users regression
    - binfmt_elf: Avoid total_mapping_size for ET_EXEC
    - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min
    - [amd64] iommu/vt-d: Fix double list_add when enabling VMD in scalable mode
    - [amd64] iommu/amd: Recover from event log overflow
    - [x86] drm/i915: s/JSP2/ICP2/ PCH
    - drm/amd/display: Reduce dmesg error to a debug print
    - xen/netfront: destroy queues before real_num_tx_queues is zeroed
    - mac80211: fix EAPoL rekey fail in 802.3 rx path
    - blktrace: fix use after free for struct blk_trace
    - mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls
    - xfrm: fix MTU regression
    - netfilter: fix use-after-free in __nf_register_net_hook()
    - bpf, sockmap: Do not ignore orig_len parameter
    - xfrm: fix the if_id check in changelink
    - xfrm: enforce validity of offload input flags
    - e1000e: Correct NVM checksum verification flow
    - net: fix up skbs delta_truesize in UDP GRO frag_list
    - netfilter: nf_queue: don't assume sk is full socket
    - netfilter: nf_queue: fix possible use-after-free
    - netfilter: nf_queue: handle socket prefetch
    - batman-adv: Request iflink once in batadv-on-batadv check
    - batman-adv: Request iflink once in batadv_get_real_netdevice
    - batman-adv: Don't expect inter-netns unique iflink indices
    - net: ipv6: ensure we call ipv6_mc_down() at most once
    - net: dcb: flush lingering app table entries for unregistered devices
    - net/smc: fix connection leak
    - net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error generated by client
    - net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server
    - btrfs: fix ENOSPC failure when attempting direct IO write into NOCOW range
    - [amd64] platform/x86: amd-pmc: Set QOS during suspend on CZN w/ timer
      wakeup
    - mac80211: fix forwarded mesh frames AC & queue selection
    - net: stmmac: fix return value of __setup handler
    - mac80211: treat some SAE auth steps as final
    - iavf: Fix missing check for running netdev
    - net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
    - ixgbe: xsk: change !netif_carrier_ok() handling in ixgbe_xmit_zc()
    - iavf: Fix deadlock in iavf_reset_task
    - efivars: Respect "block" flag in efivar_entry_set_safe()
    - [armhf] firmware: arm_scmi: Remove space in MODULE_ALIAS name
    - can: gs_usb: change active_channels's type from atomic_t to u8
    - [arm64,armhf] iommu/tegra-smmu: Fix missing put_device() call in
      tegra_smmu_find
    - igc: igc_read_phy_reg_gpy: drop premature return
    - [mips*] setup: fix setnocoherentio() boolean setting
    - [armel,armhf] 9182/1: mmu: fix returns from early_param() and __setup()
      functions
    - mptcp: Correctly set DATA_FIN timeout when number of retransmits is large
    - [arm64,armhf] pinctrl: sunxi: Use unique lockdep classes for IRQs
    - igc: igc_write_phy_reg_gpy: drop premature return
    - memfd: fix F_SEAL_WRITE after shmem huge page allocated
    - [s390x] setup: preserve memory at OLDMEM_BASE and OLDMEM_SIZE
    - [s390x] extable: fix exception table sorting
    - sched: Fix yet more sched_fork() races
    - [arm64] dts: rockchip: fix Quartz64-A ddr regulator voltage
    - [amd64] iommu/amd: Fix I/O page table memory leak
    - [armhf] dts: switch timer config to common devkit8000 devicetree
    - [armhf] dts: Use 32KiHz oscillator on devkit8000
    - [arm64] soc: fsl: guts: Revert commit 3c0d64e867ed
    - [arm64] soc: fsl: guts: Add a missing memory allocation failure check
    - [arm64] soc: imx: gpcv2: Fix clock disabling imbalance in error path
    - netfilter: nf_tables: prefer kfree_rcu(ptr, rcu) variant
    - [armhf] tegra: Move panels to AUX bus
    - Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks
    - net: stmmac: enhance XDP ZC driver level switching performance
    - net: stmmac: only enable DMA interrupts when ready
    - net: chelsio: cxgb3: check the return value of pci_find_capability()
    - iavf: Add trace while removing device
    - iavf: Rework mutexes for better synchronisation
    - iavf: Add waiting so the port is initialized in remove
    - iavf: Fix init state closure on remove
    - iavf: Fix locking for VIRTCHNL_OP_GET_OFFLOAD_VLAN_V2_CAPS
    - iavf: Fix race in init state
    - iavf: Fix __IAVF_RESETTING state usage
    - [x86] drm/i915/guc/slpc: Correct the param count for unset param
    - e1000e: Fix possible HW unit hang after an s0ix exit
    - nl80211: Handle nla_memdup failures in handle_nan_filter
    - ptp: ocp: Add ptp_ocp_adjtime_coarse for large adjustments
    - drm/amdgpu: fix suspend/resume hang regression
    - net: dcb: disable softirqs in dcbnl_flush_dev()
    - net: stmmac: perserve TX and RX coalesce value during XDP setup
    - Input: elan_i2c - move regulator_[en|dis]able() out of
      elan_[en|dis]able_power()
    - Input: elan_i2c - fix regulator enable count imbalance after
      suspend/resume
    - HID: add mapping for KEY_DICTATE
    - HID: add mapping for KEY_ALL_APPLICATIONS
    - tracing/histogram: Fix sorting on old "cpu" value
    - tracing: Fix return value of __setup handlers
    - btrfs: fix lost prealloc extents beyond eof after full fsync
    - btrfs: fix relocation crash due to premature return from
      btrfs_commit_transaction()
    - btrfs: subpage: fix a wrong check on subpage->writers
    - btrfs: do not WARN_ON() if we have PageError set
    - btrfs: qgroup: fix deadlock between rescan worker and remove qgroup
    - btrfs: add missing run of delayed items after unlink during log replay
    - btrfs: fallback to blocking mode when doing async dio over multiple
      extents
    - btrfs: do not start relocation until in progress drops are done
    - Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6"
    - proc: fix documentation and description of pagemap
    - [x86] kvmclock: Fix Hyper-V Isolated VM's boot issue when vCPUs > 64
    - [s390x] ftrace: fix arch_ftrace_get_regs implementation
    - [s390x] ftrace: fix ftrace_caller/ftrace_regs_caller generation
    - [x86] KVM: x86/mmu: Passing up the error state of mmu_alloc_shadow_roots()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.14
    - [armhf] report Spectre v2 status through sysfs
    - [armel,armhf] early traps initialisation
    - [armel,armhf] use LOADADDR() to get load address of sections
    - [armel,armhf] Spectre-BHB workaround
    - [armhf] include unprivileged BPF status in Spectre V2 reporting
    - [arm64] add ID_AA64ISAR2_EL1 sys register
    - [arm64] cpufeature: add HWCAP for FEAT_AFP
    - [arm64] cpufeature: add HWCAP for FEAT_RPRES
    - [arm64] entry.S: Add ventry overflow sanity checks
    - [arm64] spectre: Rename spectre_v4_patch_fw_mitigation_conduit
    - [arm64] KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A
    - [arm64] entry: Make the trampoline cleanup optional
    - [arm64] entry: Free up another register on kpti's tramp_exit path
    - [arm64] entry: Move the trampoline data page before the text page
    - [arm64] entry: Allow tramp_alias to access symbols after the 4K boundary
    - [arm64] entry: Don't assume tramp_vectors is the start of the vectors
    - [arm64] entry: Move trampoline macros out of ifdef'd section
    - [arm64] entry: Make the kpti trampoline's kpti sequence optional
    - [arm64] entry: Allow the trampoline text to occupy multiple pages
    - [arm64] entry: Add non-kpti __bp_harden_el1_vectors for mitigations
    - [arm64] entry: Add vectors that have the bhb mitigation sequences
    - [arm64] entry: Add macro for reading symbol addresses from the trampoline
    - [arm64] Add percpu vectors for EL1
    - [arm64] proton-pack: Report Spectre-BHB vulnerabilities as part of
      Spectre-v2
    - [arm64] Mitigate spectre style branch history side channels
    - [arm64] KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and
      migrated
    - [arm64] Use the clearbhb instruction in mitigations
    - [arm64] proton-pack: Include unprivileged eBPF status in Spectre v2
      mitigation reporting
    - [armel,armhf] fix co-processor register typo
    - [armel,armhf] Do not use NOCROSSREFS directive with ld.lld
    - [arm64] Do not include __READ_ONCE() block in assembly files
    - [armhf] fix build warning in proc-v7-bugs.c
    - xen/xenbus: don't let xenbus_grant_ring() remove grants in error case
      (CVE-2022-23040, XSA-396)
    - xen/grant-table: add gnttab_try_end_foreign_access() (CVE-2022-23036,
      CVE-2022-23038, XSA-396)
    - xen/blkfront: don't use gnttab_query_foreign_access() for mapped status
      (CVE-2022-23036, XSA-396)
    - xen/netfront: don't use gnttab_query_foreign_access() for mapped status
      (CVE-2022-23037, XSA-396)
    - xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
      (CVE-2022-23038, XSA-396)
    - xen/gntalloc: don't use gnttab_query_foreign_access() (CVE-2022-23039,
      XSA-396)
    - xen: remove gnttab_query_foreign_access()
    - xen/9p: use alloc/free_pages_exact() (CVE-2022-23041, XSA-396)
    - xen/pvcalls: use alloc/free_pages_exact() (CVE-2022-23041, XSA-396)
    - xen/gnttab: fix gnttab_end_foreign_access() without page specified
      (CVE-2022-23041, XSA-396)
    - xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
      (CVE-2022-23042, XSA-396)
    - Revert "ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE"

  [ Bastian Blank ]
  * [arm64] Enable hyperv-daemons package.

  [ Salvatore Bonaccorso ]
  * Bump ABI to 5

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 15 Mar 2022 07:54:31 +0100

linux (5.16.12-1) unstable; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.12
    - mm/filemap: Fix handling of THPs in generic_file_buffered_read()
    - cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug
    - btrfs: tree-checker: check item_size for inode_item
    - btrfs: tree-checker: check item_size for dev_item
    - slab: remove __alloc_size attribute from __kmalloc_track_caller
    - io_uring: don't convert to jiffies for waiting on timeouts
    - io_uring: disallow modification of rsrc_data during quiesce
    - selinux: fix misuse of mutex_is_locked()
    - vhost/vsock: don't check owner in vhost_vsock_stop() while releasing
    - [x86] KVM: x86/mmu: make apf token non-zero to fix bug
    - [x86] KVM: x86: nSVM: disallow userspace setting of MSR_AMD64_TSC_RATIO to
      non default value when tsc scaling disabled
    - drm/amd: Check if ASPM is enabled from PCIe subsystem
    - drm/amdgpu: disable MMHUB PG for Picasso
    - drm/amdgpu: do not enable asic reset for raven2
    - [x86] drm/i915: Widen the QGV point mask
    - [x86] drm/i915: Disconnect PHYs left connected by BIOS on disabled ports
    - [x86] drm/i915: Correctly populate use_sagv_wm for all pipes
    - [x86] drm/i915: Fix bw atomic check when switching between SAGV vs. no
      SAGV
    - sr9700: sanity check for packet length
    - USB: zaurus: support another broken Zaurus
    - CDC-NCM: avoid overflow in sanity checking
    - ping: remove pr_err from ping_lookup
    - Revert "i40e: Fix reset bw limit when DCB enabled with 1 TC"
    - [arm64,armhf] gpu: host1x: Always return syncpoint value when waiting
    - perf data: Fix double free in perf_session__delete()
    - mptcp: fix race in incoming ADD_ADDR option processing
    - mptcp: add mibs counter for ignored incoming options
    - bnx2x: fix driver load from initrd
    - bnxt_en: Fix devlink fw_activate
    - bnxt_en: Fix active FEC reporting to ethtool
    - bnxt_en: Fix offline ethtool selftest with RDMA enabled
    - bnxt_en: Fix occasional ethtool -t loopback test failures
    - bnxt_en: Fix incorrect multicast rx mask setting when not requested
    - bnxt_en: Restore the resets_reliable flag in bnxt_open()
    - hwmon: Handle failure to register sensor with thermal zone correctly
    - net/mlx5: Fix tc max supported prio for nic mode
    - ice: fix setting l4 port flag when adding filter
    - ice: fix concurrent reset and removal of VFs
    - ice: check the return of ice_ptp_gettimex64
    - ice: initialize local variable 'tlv'
    - net/mlx5: Update the list of the PCI supported devices
    - bpf: Fix crash due to incorrect copy_map_value
    - bpf: Do not try bpf_msg_push_data with len 0
    - bpf: Fix a bpf_timer initialization issue
    - bpf: Add schedule points in batch ops
    - io_uring: add a schedule point in io_add_buffers()
    - net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends
    - nvme: also mark passthrough-only namespaces ready in nvme_update_ns_info
    - tipc: Fix end of loop tests for list_for_each_entry()
    - gso: do not skip outer ip header in case of ipip and net_failover
    - [armel,armhf] net: mv643xx_eth: process retval from of_get_mac_address
    - openvswitch: Fix setting ipv6 fields causing hw csum failure
    - drm/edid: Always set RGB444
    - net/mlx5e: Fix wrong return value on ioctl EEPROM query failure
    - net/mlx5e: TC, Reject rules with forward and drop actions
    - net/mlx5e: TC, Reject rules with drop and modify hdr action
    - block: clear iocb->private in blkdev_bio_end_io_async()
    - [arm*] drm/vc4: crtc: Fix runtime_pm reference counting
    - [x86] drm/i915/dg2: Print PHY name properly on calibration error
    - drm/amd/display: For vblank_disable_immediate, check PSR is really used
    - net/sched: act_ct: Fix flow table lookup after ct clear or switching zones
    - net: Force inlining of checksum functions in net/checksum.h
    - netfilter: nf_tables: unregister flowtable hooks on netns exit
    - [arm64,armhf] net: dsa: avoid call to __dev_set_promiscuity() while
      rtnl_mutex isn't held
    - nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()
    - netfilter: nf_tables: fix memory leak during stateful obj update
    - net/smc: Use a mutex for locking "struct smc_pnettable"
    - [x86] surface: surface3_power: Fix battery readings on batteries without a
      serial number
    - udp_tunnel: Fix end of loop test in udp_tunnel_nic_unregister()
    - net/mlx5: DR, Cache STE shadow memory
    - net/mlx5: DR, Don't allow match on IP w/o matching on full
      ethertype/ip_version
    - net/mlx5: Fix possible deadlock on rule deletion
    - net/mlx5: Fix wrong limitation of metadata match on ecpf
    - net/mlx5: DR, Fix the threshold that defines when pool sync is initiated
    - net/mlx5e: MPLSoUDP decap, fix check for unsupported matches
    - net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets
    - net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte
    - net/mlx5: Update log_max_qp value to be 17 at most
    - net/mlx5e: Add missing increment of count
    - [armel,armhf] PCI: mvebu: Fix device enumeration regression
    - [arm64,armhf] gpio: rockchip: Reset int_bothedge when changing trigger
    - regmap-irq: Update interrupt clear register for proper reset
    - net: use sk_is_tcp() in more places
    - net-timestamp: convert sk->sk_tskey to atomic_t
    - bnxt_en: Increase firmware message response DMA wait time
    - configfs: fix a race in configfs_{,un}register_subsystem()
    - RDMA/ib_srp: Fix a deadlock
    - bpf: Extend kfunc with PTR_TO_CTX, PTR_TO_MEM argument support
    - bpf: Fix crash due to out of bounds access into reg2btf_ids.
    - tracing: Dump stacktrace trigger to the corresponding instance
    - tracing: Have traceon and traceoff trigger honor the instance
    - iio:imu:adis16480: fix buffering for devices with no burst mode
    - iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits
    - iio: imu: st_lsm6dsx: wait for settling time in st_lsm6dsx_read_oneshot
    - iio: Fix error handling for PM
    - ata: pata_hpt37x: disable primary channel on HPT371
    - Revert "USB: serial: ch341: add new Product ID for CH341A"
    - usb: gadget: rndis: add spinlock for rndis response list
    - tracefs: Set the group ownership in apply_options() not parse_options()
    - USB: serial: option: add support for DW5829e
    - USB: serial: option: add Telit LE910R1 compositions
    - [arm*] usb: dwc2: drd: fix soft connect when gadget is unconfigured
    - [arm64] usb: dwc3: pci: Add "snps,dis_u2_susphy_quirk" for Intel Bay Trail
    - [arm64] usb: dwc3: pci: Fix Bay Trail phy GPIO mappings
    - [arm64,armhf] usb: dwc3: gadget: Let the interrupt handler disable bottom
      halves.
    - xhci: re-initialize the HC during resume if HCE was set
    - xhci: Prevent futile URB re-submissions due to incorrect return value.
    - nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property
    - mtd: core: Fix a conflict between MTD and NVMEM on wp-gpios property
    - driver core: Free DMA range map when device is released
    - btrfs: defrag: don't try to merge regular extents with preallocated
      extents
    - btrfs: defrag: don't defrag extents which are already at max capacity
    - btrfs: defrag: remove an ambiguous condition for rejection
    - btrfs: prevent copying too big compressed lzo segment
    - btrfs: defrag: allow defrag_one_cluster() to skip large extent which is
      not a target
    - btrfs: autodefrag: only scan one inode once
    - btrfs: reduce extent threshold for autodefrag
    - RDMA/cma: Do not change route.addr.src_addr outside state checks
    - [amd64] thermal: int340x: fix memory leak in int3400_notify()
    - [x86] tps6598x: clear int mask on probe failure
    - [amd64] IB/qib: Fix duplicate sysfs directory name
    - mm/hugetlb: fix kernel crash with hugetlb mremap
    - hugetlbfs: fix a truncation issue in hugepages parameter
    - tty: n_gsm: fix encoding of control signal octet bit DV
    - tty: n_gsm: fix encoding of command/response bit
    - tty: n_gsm: fix proper link termination after failed open
    - tty: n_gsm: fix NULL pointer access due to DLCI release
    - tty: n_gsm: fix wrong tty control line for flow control
    - tty: n_gsm: fix wrong modem processing in convergence layer type 2
    - tty: n_gsm: fix deadlock in gsmtty_open()
    - memblock: use kfree() to release kmalloced memblock regions

  [ Vincent Blut ]
  * drivers/leds: Enable LEDS_CLASS_MULTICOLOR as module (Closes: #1006490)

  [ Salvatore Bonaccorso ]
  * Bump ABI to 4
  * Mitigate Spectre v2-type Branch History Buffer attacks (CVE-2022-0001,
    CVE-2022-0002)
    - [x86] speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
    - [x86] speculation: Add eIBRS + Retpoline options
    - Documentation/hw-vuln: Update spectre doc
    - [x86] speculation: Include unprivileged eBPF status in Spectre v2
      mitigation reporting
    - [x86] speculation: Use generic retpoline by default on AMD
    - [x86] speculation: Update link to AMD speculation whitepaper
    - [x86] speculation: Warn about Spectre v2 LFENCE mitigation
    - [x86] speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT

  [ Ben Hutchings [
  * module: Avoid ABI changes when debug info is disabled

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 08 Mar 2022 18:47:04 +0100

linux (5.16.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.11
    - drm/nouveau/pmu/gm200-: use alternate falcon reset sequence
    - HID:Add support for UGTABLET WP5540
    - [x86] Revert "svm: Add warning message for AVIC IPI invalid target"
    - mmc: block: fix read single on recovery logic
    - mm: don't try to NUMA-migrate COW pages that have other uses
    - [amd64] HID: amd_sfh: Add illuminance mask to limit ALS max value
    - [amd64] HID: amd_sfh: Increase sensor command timeout
    - [amd64] HID: amd_sfh: Correct the structure field name
    - [amd64] PCI: hv: Fix NUMA node assignment when kernel boots with custom
      NUMA topology
    - HID: apple: Set the tilde quirk flag on the Wellspring 5 and later
    - btrfs: don't hold CPU for too long when defragging a file
    - btrfs: send: in case of IO error log it
    - btrfs: defrag: don't try to defrag extents which are under writeback
    - [amd64] platform/x86: amd-pmc: Correct usage of SMU version
    - net: ieee802154: at86rf230: Stop leaking skb's
    - ax25: improve the incomplete fix to avoid UAF and NPD bugs
    - cifs: unlock chan_lock before calling cifs_put_tcp_session
    - vfs: make freeze_super abort when sync_filesystem returns error
    - vfs: make sync_filesystem return errors from ->sync_fs
    - quota: make dquot_quota_sync return errors from ->sync_fs
    - scsi: pm80xx: Fix double completion for SATA devices
    - scsi: core: Reallocate device's budget map on queue depth change
    - scsi: pm8001: Fix use-after-free for aborted TMF sas_task
    - scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
    - drm/amd: Warn users about potential s0ix problems
    - nvme: fix a possible use-after-free in controller reset during load
    - nvme-tcp: fix possible use-after-free in transport error_recovery work
    - nvme-rdma: fix possible use-after-free in transport error_recovery work
    - drm/amd: add support to check whether the system is set to s3
    - drm/amd: Only run s3 or s0ix if system is configured properly
    - drm/amdgpu: fix logic inversion in check
    - [amd64] x86/Xen: streamline (and fix) PV CPU enumeration
    - Revert "module, async: async_synchronize_full() on module init iff async
      is used"
    - random: wake up /dev/random writers after zap
    - [x86] KVM: x86/xen: Fix runstate updates to be atomic when preempting vCPU
    - [x86] KVM: x86: nSVM/nVMX: set nested_run_pending on VM entry which is a
      result of RSM
    - [x86] KVM: x86: SVM: don't passthrough SMAP/SMEP/PKE bits in !NPT &&
      !gCR0.PG case
    - [x86] KVM: x86: nSVM: fix potential NULL derefernce on nested migration
    - [x86] KVM: x86: nSVM: mark vmcb01 as dirty when restoring SMM saved state
    - iwlwifi: remove deprecated broadcast filtering feature
    - iwlwifi: fix use-after-free (Closes: #1005884)
    - drm/radeon: Fix backlight control on iMac 12,1
    - drm/atomic: Don't pollute crtc_state->mode_blob with error pointers
    - drm/amdgpu: skipping SDMA hw_init and hw_fini for S0ix.
    - [x86] drm/i915/opregion: check port number bounds for SWSCI display power
      state
    - [x86] drm/i915: Fix dbuf slice config lookup
    - [x86] drm/i915: Fix mbus join config lookup
    - vsock: remove vsock from connected table when connect is interrupted by a
      signal
    - [arm64] tee: export teedev_open() and teedev_close_context()
    - [arm64] optee: use driver internal tee_context for some rpc
    - [arm*] drm/cma-helper: Set VM_DONTEXPAND for mmap
    - [x86] drm/i915/gvt: Make DRM_I915_GVT depend on X86
    - [x86] drm/i915/ttm: tweak priority hint selection
    - iwlwifi: pcie: fix locking when "HW not ready"
    - iwlwifi: pcie: gen2: fix locking when "HW not ready"
    - iwlwifi: mvm: fix condition which checks the version of rate_n_flags
    - iwlwifi: fix iwl_legacy_rate_to_fw_idx
    - iwlwifi: mvm: don't send SAR GEO command for 3160 devices
    - netfilter: nft_synproxy: unregister hooks on init error path
    - ipv4: fix data races in fib_alias_hw_flags_set
    - ipv6: fix data-race in fib6_info_hw_flags_set / fib6_purge_rt
    - ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
    - ipv6: per-netns exclusive flowlabel checks
    - Revert "net: ethernet: bgmac: Use devm_platform_ioremap_resource_byname"
    - mac80211: mlme: check for null after calling kmemdup
    - brcmfmac: firmware: Fix crash in brcm_alt_fw_path
    - cfg80211: fix race in netlink owner interface destruction
    - [arm64,armhf] net: dsa: mv88e6xxx: flush switchdev FDB workqueue before
      removing VLAN
    - ping: fix the dif and sdif check in ping_lookup
    - bonding: force carrier update when releasing slave
    - mctp: fix use after free
    - drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
    - net_sched: add __rcu annotation to netdev->qdisc
    - crypto: af_alg - get rid of alg_memory_allocated
    - bonding: fix data-races around agg_select_timer
    - net/smc: Avoid overwriting the copies of clcsock callback functions
    - atl1c: fix tx timeout after link flap on Mikrotik 10/25G NIC
    - tipc: fix wrong publisher node address in link publications
    - [arm64] dpaa2-eth: Initialize mutex used in one step timestamping path
    - [arm64] net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()
    - net: bridge: multicast: notify switchdev driver whenever MC processing
      gets disabled
    - [arm64] Correct wrong label in macro __init_el2_gicv3
    - ALSA: usb-audio: Don't abort resume upon errors
    - ALSA: usb-audio: revert to IMPLICIT_FB_FIXED_DEV for M-Audio FastTrack
      Ultra
    - ALSA: memalloc: Fix dma_need_sync() checks
    - ALSA: memalloc: invalidate SG pages before sync
    - ALSA: hda/realtek: Add quirk for Legion Y9000X 2019
    - ALSA: hda/realtek: Fix deadlock by COEF mutex
    - ALSA: hda: Fix regression on forced probe mask option
    - ALSA: hda: Fix missing codec probe on Shenker Dock 15
    - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw()
    - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range()
    - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_sx()
    - ASoC: ops: Fix stereo change notifications in snd_soc_put_xr_sx()
    - cifs: fix set of group SID via NTSD xattrs
    - cifs: fix confusing unneeded warning message on smb2.1 and earlier
    - ACPI: processor: idle: fix lockup regression on 32-bit ThinkPad T40
    - [armhf] mtd: rawnand: gpmi: don't leak PM reference in error path
    - smb3: fix snapshot mount option
    - tipc: fix wrong notification node addresses
    - scsi: ufs: Remove dead code
    - scsi: ufs: Fix a deadlock in the error handler
    - [arm64] ASoC: qcom: Actually clear DMA interrupt register for HDMI
    - block/wbt: fix negative inflight counter when remove scsi device
    - NFS: Remove an incorrect revalidation in nfs4_update_changeattr_locked()
    - NFS: LOOKUP_DIRECTORY is also ok with symlinks
    - NFS: Do not report writeback errors in nfs_getattr()
    - tty: n_tty: do not look ahead for EOL character past the end of the buffer
    - block: fix surprise removal for drivers calling blk_set_queue_dying
    - mtd: phram: Prevent divide by zero bug in phram_setup()
    - scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop
    - EDAC: Fix calculation of returned address and next offset in
      edac_align_ptr()
    - [x86] ptrace: Fix xfpregs_set()'s incorrect xmm clearing
    - ucounts: Base set_cred_ucounts changes on the real user
    - ucounts: Handle wrapping in is_ucounts_overlimit
    - ucounts: Enforce RLIMIT_NPROC not RLIMIT_NPROC+1
    - rlimit: Fix RLIMIT_NPROC enforcement failure caused by capability calls in
      set_user
    - ucounts: Move RLIMIT_NPROC handling after set_user
    - net: sched: limit TC_ACT_REPEAT loops
    - [armhf] dmaengine: stm32-dmamux: Fix PM disable depth imbalance in
      stm32_dmamux_probe
    - copy_process(): Move fd_install() out of sighand->siglock critical section
    - scsi: qedi: Fix ABBA deadlock in qedi_process_tmf_resp() and
      qedi_process_cmd_cleanup_resp()
    - ice: enable parsing IPSEC SPI headers for RSS
    - [arm*] i2c: brcmstb: fix support for DSL and CM variants
    - HID: elo: fix memory leak in elo_probe
    - [x86,arm64] Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
    - [x86] KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id()
    - [x86] KVM: x86/pmu: Don't truncate the PerfEvtSeln MSR when creating a
      perf event
    - [x86] KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
    - [armhf] OMAP2+: hwmod: Add of_node_put() before break
    - [armhf] OMAP2+: adjust the location of put_device() call in
      omapdss_init_of
    - [arm*] staging: vc04_services: Fix RCU dereference check
    - [riscv64] irqchip/sifive-plic: Add missing thead,c900-plic match string
    - [x86] bug: Merge annotate_reachable() into _BUG_FLAGS() asm
    - netfilter: conntrack: don't refresh sctp entries in closed state
    - ksmbd: fix same UniqueId for dot and dotdot entries
    - ksmbd: don't align last entry offset in smb2 query directory
    - lib/iov_iter: initialize "flags" in new pipe_buffer
    - mm: io_uring: allow oom-killer from io_uring_setup
    - [x86] ACPI: PM: Revert "Only mark EC GPE for wakeup on Intel systems"
    - kconfig: let 'shell' return enough output for deep path names
    - ata: libata-core: Disable TRIM on M88V29
    - [armhf] soc: aspeed: lpc-ctrl: Block error printing on probe defer cases
    - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
    - [arm64,armhf] drm/rockchip: dw_hdmi: Do not leave clock enabled in error
      case
    - tracing: Fix tp_printk option related with tp_printk_stop_on_boot
    - drm/amdgpu: add utcl2_harvest to gc 10.3.1
    - net: usb: qmi_wwan: Add support for Dell DW5829e
    - [arm64,riscv64] net: macb: Align the dma and coherent dma masks
    - kconfig: fix failing to generate auto.conf

  [ Salvatore Bonaccorso ]
  * Bump ABI to 3
  * cgroup-v1: Correct privileges check in release_agent writes
  * netfilter: xt_socket: fix a typo in socket_mt_destroy()
  * netfilter: xt_socket: missing ifdef CONFIG_IP6_NF_IPTABLES dependency
  * netfilter: nf_tables_offload: incorrect flow offload action array size
    (CVE-2022-25636)

  [ Vincent Blut ]
  * drivers/hid: Enable HID_NINTENDO as module and NINTENDO_FF as built-in
    (Closes: #1006275)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 25 Feb 2022 18:15:16 +0100

linux (5.16.10-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.8
    - [x86] drm/i915: Disable DSB usage for now
    - selinux: fix double free of cond_list on error paths
    - audit: improve audit queue handling when "audit=1" on cmdline
    - ipc/sem: do not sleep with a spin lock held
    - [armhf] spi: stm32-qspi: Update spi registering
    - ASoC: hdmi-codec: Fix OOB memory accesses
    - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
    - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()
    - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx()
    - ALSA: usb-audio: Correct quirk for VF0770
    - ALSA: hda: Fix UAF of leds class devs at unbinding
    - ALSA: hda: realtek: Fix race at concurrent COEF updates
    - ALSA: hda/realtek: Add quirk for ASUS GU603
    - ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220
      quirks
    - ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer
      chipset)
    - ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after
      reboot from Windows
    - ata: libata-core: Introduce ATA_HORKAGE_NO_LOG_DIR horkage
    - btrfs: don't start transaction for scrub if the fs is mounted read-only
    - btrfs: fix deadlock between quota disable and qgroup rescan worker
    - btrfs: fix use-after-free after failure to create a snapshot
    - Revert "fs/9p: search open fids first"
    - drm/nouveau: fix off by one in BIOS boundary checking
    - [x86] drm/i915/adlp: Fix TypeC PHY-ready status readout
    - drm/amdgpu: fix a potential GPU hang on cyan skillfish
    - drm/amd/display: Update watermark values for DCN301
    - drm/amd/display: watermark latencies is not enough on DCN31
    - drm/amd/display: Force link_rate as LINK_RATE_RBR2 for 2018 15" Apple
      Retina panels
    - mm/pgtable: define pte_index so that preprocessor could recognize it
    - mm/kmemleak: avoid scanning potential huge holes
    - block: bio-integrity: Advance seed correctly for larger interval sizes
    - cifs: fix workstation_name for multiuser mounts
    - dma-buf: heaps: Fix potential spectre v1 gadget
    - [amd64] IB/hfi1: Fix panic with larger ipoib send_queue_size
    - [amd64] IB/hfi1: Fix alloc failure with larger txqueuelen
    - [amd64] IB/hfi1: Fix AIP early init panic
    - Revert "fbdev: Garbage collect fbdev scrolling acceleration, part 1 (from
      TODO list)"
    - Revert "fbcon: Disable accelerated scrolling"
    - fbcon: Add option to enable legacy hardware acceleration
    - mptcp: fix msk traversal in mptcp_nl_cmd_set_flags()
    - [riscv64] KVM: make CY, TM, and IR counters accessible in VU mode
    - [arm64] KVM: arm64: Avoid consuming a stale esr value when SError occur
    - [arm64] KVM: arm64: Stop handle_exit() from handling HVC twice when an
      SError occurs
    - [arm64] Add Cortex-A510 CPU part definition
    - RDMA/cma: Use correct address when leaving multicast group
    - RDMA/ucma: Protect mc during concurrent multicast leaves
    - [amd64] IB/rdmavt: Validate remote_addr during loopback atomic tests
    - RDMA/mlx4: Don't continue event handler after memory allocation failure
    - ALSA: usb-audio: initialize variables that could ignore errors
    - ALSA: hda: Fix signedness of sscanf() arguments
    - ALSA: hda: Skip codec shutdown in case the codec is not registered
    - [amd64] iommu/vt-d: Fix potential memory leak in
      intel_setup_irq_remapping()
    - [amd64] iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
    - [arm64,armhf] spi: meson-spicc: add IRQ check in meson_spicc_probe
    - [amd64] IB/hfi1: Fix tstats alloc and dealloc
    - IB/cm: Release previously acquired reference counter in the cm_id_priv
    - net: ieee802154: hwsim: Ensure proper channel selection at probe time
    - netfilter: nft_reject_bridge: Fix for missing reply from prerouting
    - net: ieee802154: Return meaningful error codes from the netlink helpers
    - net/smc: Forward wakeup to smc socket waitqueue after fallback
    - net: stmmac: properly handle with runtime pm in stmmac_dvr_remove()
    - net: macsec: Fix offload support for NETDEV_UNREGISTER event
    - net: macsec: Verify that send_sci is on when setting Tx sci explicitly
    - net: stmmac: dump gmac4 DMA registers correctly
    - net, neigh: Do not trigger immediate probes on NUD_FAILED from
      neigh_managed_work
    - net: stmmac: ensure PTP time register reads are consistent
    - [arm64] drm: mxsfb: Fix NULL pointer dereference
    - [x86] drm/i915/overlay: Prevent divide by zero bugs in scaling
    - [x86] drm/i915: Lock timeline mutex directly in error path of
      eb_pin_timeline
    - drm/amd: avoid suspend on dGPUs w/ s2idle support when runtime PM enabled
    - ASoC: rt5682: Fix deadlock on resume
    - [arm*] ASoC: simple-card: fix probe failure on platform component
    - [arm64] pinctrl: sunxi: Fix H616 I2S3 pin data
    - [x86] pinctrl: intel: Fix a glitch when updating IRQ flags on a
      preconfigured line
    - [x86] pinctrl: intel: fix unexpected interrupt
    - [arm*] pinctrl: bcm2835: Fix a few error paths
    - btrfs: fix use of uninitialized variable at rm device ioctl
    - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
    - nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client.
    - [amd64,arm64] gve: fix the wrong AdminQ buffer queue index check
    - bpf: Use VM_MAP instead of VM_ALLOC for ringbuf
    - tools/resolve_btfids: Do not print any commands when building silently
    - e1000e: Separate ADP board type from TGP
    - rtc: cmos: Evaluate century appropriate
    - kvm: add guest_state_{enter,exit}_irqoff()
    - [arm64] kvm/arm64: rework guest entry logic
    - perf: Copy perf_event_attr::sig_data on modification
    - [x86] perf/x86/intel/pt: Fix crash with stop filters in single-range mode
    - [x86] perf: Default set FREEZE_ON_SMI for all
    - [arm64] EDAC/xgene: Fix deferred probing
    - ext4: prevent used blocks from being allocated during fast commit replay
    - ext4: modify the logic of ext4_mb_new_blocks_simple
    - ext4: fix error handling in ext4_restore_inline_data()
    - ext4: fix error handling in ext4_fc_record_modified_inode()
    - ext4: fix incorrect type issue during replay_del_range
    - cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning
    - [arm64] gpio: mpc8xxx: Fix an ignored error return from platform_get_irq()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.9
    - ata: libata-core: Fix ata_dev_config_cpr()
    - moxart: fix potential use-after-free on remove path (CVE-2022-0487)
    - [s390x] KVM: s390: Return error on SIDA memop on normal guest
      (CVE-2022-0516)
    - ksmbd: fix SMB 3.11 posix extension mount failure
    - crypto: api - Move cryptomgr soft dependency into algapi
    - tipc: improve size validations for received domain records CVE-2022-0435)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10
    - integrity: check the return value of audit_log_start()
    - audit: don't deref the syscall args when checking the openat2
      open_how::flags
    - ima: fix reference leak in asymmetric_verify()
    - ima: Remove ima_policy file before directory
    - ima: Allow template selection with ima_template[_fmt]= after ima_hash=
    - ima: Do not print policy rule with inactive LSM labels
    - [arm64] mmc: sdhci-of-esdhc: Check for error num after setting mask
    - mmc: core: Wait for command setting 'Power Off Notification' bit to
      complete
    - can: isotp: fix potential CAN frame reception race in isotp_rcv()
    - can: isotp: fix error path in isotp_sendmsg() to unlock wait queue
    - net: phy: marvell: Fix RGMII Tx/Rx delays setting in 88e1121-compatible
      PHYs
    - net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs
    - NFS: Fix initialisation of nfs_client cl_flags field
    - NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
    - NFSD: Fix ia_size underflow
    - NFSD: Clamp WRITE offsets
    - NFSD: Fix offset type in I/O trace points
    - NFSD: Fix the behavior of READ near OFFSET_MAX
    - NFS: change nfs_access_get_cached to only report the mask
    - NFSv4 only print the label when its queried
    - nfs: nfs4clinet: check the return value of kstrdup()
    - NFSv4.1: Fix uninitialised variable in devicenotify
    - NFSv4 remove zero number of fs_locations entries error check
    - NFSv4 store server support for fs_location attribute
    - NFSv4.1 query for fs_location attr on a new file system
    - NFSv4 expose nfs_parse_server_name function
    - NFSv4 handle port presence in fs_location server string
    - SUNRPC allow for unspecified transport time in rpc_clnt_add_xprt
    - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change
    - sunrpc: Fix potential race conditions in rpc_sysfs_xprt_state_change()
    - [amd64] perf/x86/rapl: fix AMD event handling
    - [x86] perf: Avoid warning for Arch LBR without XSAVE
    - sched: Avoid double preemption in __cond_resched_*lock*()
    - [arm*] drm/vc4: Fix deadlock on DSI device attach error
    - drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer
    - net: sched: Clarify error message when qdisc kind is unknown
    - [powerpc*] fixmap: Fix VM debug warning on unmap
    - [arm64] Add Cortex-X2 CPU part definition
    - [arm64] errata: Update ARM64_ERRATUM_[2119858|2224489] with Cortex-X2
      ranges
    - scsi: target: iscsi: Make sure the np under each tpg is unique
    - scsi: qedf: Add stag_work to all the vports
    - scsi: qedf: Fix refcount issue when LOGO is received during TMF
    - scsi: qedf: Change context reset messages to ratelimited
    - scsi: pm8001: Fix bogus FW crash for maxcpus=1
    - scsi: ufs: Use generic error code in ufshcd_set_dev_pwr_mode()
    - scsi: ufs: Treat link loss as fatal error
    - scsi: myrs: Fix crash in error case
    - net: stmmac: reduce unnecessary wakeups from eee sw timer
    - PM: hibernate: Remove register_nosave_region_late()
    - [arm*] usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend
    - perf: Always wake the parent event
    - nvme-pci: add the IGNORE_DEV_SUBNQN quirk for Intel P4500/P4600 SSDs
    - [mips*] Fix build error due to PTR used in more places
    - [arm64,armhf] net: stmmac: dwmac-sun8i: use return val of
      readl_poll_timeout()
    - [arm64] errata: Add detection for TRBE ignored system register writes
    - [arm64] errata: Add detection for TRBE invalid prohibited states
    - [arm64] errata: Add detection for TRBE trace data corruption
    - [arm64] cpufeature: List early Cortex-A510 parts as having broken dbm
    - KVM: eventfd: Fix false positive RCU usage warning
    - [x86] KVM: nVMX: eVMCS: Filter out VM_EXIT_SAVE_VMX_PREEMPTION_TIMER
    - [x86] KVM: nVMX: Also filter MSR_IA32_VMX_TRUE_PINBASED_CTLS when eVMCS
    - [x86] KVM: SVM: Don't kill SEV guest if SMAP erratum triggers in usermode
    - [x86] KVM: VMX: Set vmcs.PENDING_DBG.BS on #DB in STI/MOVSS blocking
      shadow
    - [x86] KVM: x86: Report deprecated x87 features in supported CPUID
    - [riscv64] Fix XIP_FIXUP_FLASH_OFFSET
    - [riscv64] cpu-hotplug: clear cpu from numa map when teardown
    - [riscv64] mm: Add XIP_FIXUP for phys_ram_base
    - [riscv64] eliminate unreliable __builtin_frame_address(1)
    - gfs2: Fix gfs2_release for non-writers regression
    - Revert "gfs2: check context in gfs2_glock_put"
    - Revert "PCI/portdrv: Do not setup up IRQs if there are no users"
    - nvme-tcp: fix bogus request completion when failing to send AER
    - [arm64] ACPI/IORT: Check node revision for PMCG resources
    - PM: s2idle: ACPI: Fix wakeup interrupts handling
    - [arm64,armhf] drm/rockchip: vop: Correct RK3399 VOP register fields
    - [x86] drm/i915: Disable DRRS on IVB/HSW port != A
    - [x86] drm/i915: Allow !join_mbus cases for adlp+ dbuf configuration
    - [x86] drm/i915: Populate pipe dbuf slices more accurately during readout
    - [x86] drm/i915: Workaround broken BIOS DBUF configuration on TGL/RKL
    - [armhf] dts: Fix timer regression for beagleboard revision c
    - [arm64] tee: optee: do not check memref size on return from Secure World
    - [arm64] optee: add error checks in optee_ffa_do_call_with_arg()
    - [armhf] phy: stm32: fix a refcount leak in stm32_usbphyc_pll_enable()
    - usb: f_fs: Fix use-after-free for epfile
    - [arm64] Enable Cortex-A510 erratum 2051678 by default
    - [arm64,armhf] phy: dphy: Correct clk_pre parameter
    - NFS: Don't overfill uncached readdir pages
    - NFS: Don't skip directory entries when doing uncached readdir
    - NFS: Avoid duplicate uncached readdir calls on eof
    - [arm*] drm/vc4: hdmi: Allow DBLCLK modes even if horz timing is odd.
    - netfilter: nft_payload: don't allow th access for fragments
    - netfilter: ctnetlink: disable helper autoassign
    - [arm64] dts: meson-sm1-bananapi-m5: fix wrong GPIO domain for GPIOE_2
    - ixgbevf: Require large buffers for build_skb on 82599VF
    - tcp: take care of mixed splice()/sendmsg(MSG_ZEROCOPY) case
    - [arm64] net: mscc: ocelot: fix all IP traffic getting trapped to CPU with
      PTP over IP
    - [arm64,armhf] drm/panel: simple: Assign data from panel_dpi_probe()
      correctly
    - ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE
    - gpiolib: Never return internal error codes to user space
    - [riscv64] gpio: sifive: use the correct register to read output values
    - fbcon: Avoid 'cap' set but not used warning
    - SUNRPC: lock against ->sock changing during sysfs read
    - [arm64,arm64] gve: Recording rx queue before sending to napi
    - bonding: pair enable_port with slave_arr_updates
    - [arm64,armhf] net: dsa: mv88e6xxx: don't use devres for mdiobus
    - [armhf] net: dsa: bcm_sf2: don't use devres for mdiobus
    - [arm64] net: dsa: felix: don't use devres for mdiobus
    - ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure
      path
    - nfp: flower: fix ida_idx not being released
    - net: do not keep the dst cache when uncloning an skb dst and its metadata
    - net: fix a memleak when uncloning an skb dst and its metadata
    - veth: fix races around rq->rx_notify_masked
    - [armhf] net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE
    - tipc: rate limit warning for received illegal binding update
    - [amd64,armhf] net: amd-xgbe: disable interrupts during pci removal
    - [amd64,armhf] net: dsa: fix panic when DSA master device unbinds on
      shutdown
    - mptcp: netlink: process IPv6 addrs in creating listening sockets
    - [arm64] dpaa2-eth: unregister the netdev before disconnecting from the PHY
    - ice: fix an error code in ice_cfg_phy_fec()
    - ice: fix IPIP and SIT TSO offload
    - ice: Avoid RTNL lock when re-creating auxiliary device
    - [arm64] net: mscc: ocelot: fix mutex lock error during ethtool stats read
    - [arm64,armhf] net: dsa: mv88e6xxx: fix use-after-free in
      mv88e6xxx_mdios_unregister
    - vt_ioctl: fix array_index_nospec in vt_setactivate
    - vt_ioctl: add array_index_nospec to VT_ACTIVATE
    - n_tty: wake up poll(POLLRDNORM) on receiving data
    - eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
    - [arm*] usb: dwc2: drd: fix soft connect when gadget is unconfigured
    - [arm*] Revert "usb: dwc2: drd: fix soft connect when gadget is
      unconfigured"
    - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
    - [arm64,armhf] usb: ulpi: Move of_node_put to ulpi_dev_release
    - [arm64,armhf] usb: ulpi: Call of_node_put correctly
    - [arm64,armhf] usb: dwc3: gadget: Prevent core from processing stale TRBs
    - USB: gadget: validate interface OS descriptor requests (CVE-2022-25258)
    - usb: gadget: rndis: check size of RNDIS_MSG_SET command
    - usb: gadget: f_uac2: Define specific wTerminalType
    - USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320
    - USB: serial: option: add ZTE MF286D modem
    - USB: serial: ch341: add support for GW Instek USB2.0-Serial devices
    - USB: serial: cp210x: add NCR Retail IO box id
    - USB: serial: cp210x: add CPI Bulk Coin Recycler id
    - speakup-dectlk: Restore pitch setting
    - iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL
    - fs/proc: task_mmu.c: don't read mapcount for migration entry
    - mm: vmscan: remove deadlock due to throttling failing to make progress
    - mm: memcg: synchronize objcg lists with a dedicated spinlock
    - seccomp: Invalidate seccomp mode to catch death failures
    - signal: HANDLER_EXIT should clear SIGNAL_UNKILLABLE
    - [s390x] cio: verify the driver availability for path_event call
    - bus: mhi: pci_generic: Add mru_default for Foxconn SDX55
    - bus: mhi: pci_generic: Add mru_default for Cinterion MV31-W
    - scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled
    - scsi: lpfc: Reduce log messages seen after firmware download
    - [mips64el,mipsel] octeon: Fix missed PTR->PTR_WD conversion
    - perf: Fix list corruption in perf_cgroup_switch()
    - iommu: Fix potential use-after-free during probe

  [ Salvatore Bonaccorso ]
  * Bump ABI to 2
  * [rt] Refresh "mm/memcg: Add a local_lock_t for IRQ and TASK object."
  * bpf: Introduce composable reg, ret and arg types.
  * bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL
  * bpf: Replace RET_XXX_OR_NULL with RET_XXX | PTR_MAYBE_NULL
  * bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL
  * bpf: Introduce MEM_RDONLY flag
  * bpf: Convert PTR_TO_MEM_OR_NULL to composable types.
  * bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM.
  * bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem.
  * bpf/selftests: Test PTR_TO_RDONLY_MEM

  [ Luca Boccassi ]
  * drivers/watchdog: enable CONFIG_WATCHDOG_HRTIMER_PRETIMEOUT

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 18 Feb 2022 06:42:33 +0100

linux (5.16.7-2) unstable; urgency=medium

  * linux-perf: Protect invocation of dpkg-divert to run only on relevant
    actions in maintscripts. Thanks to Guillem Jover (Closes: #1005141)

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 09 Feb 2022 09:35:55 +0100

linux (5.16.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5
    - Bluetooth: refactor malicious adv data check
    - btrfs: fix too long loop when defragging a 1 byte file
    - btrfs: allow defrag to be interruptible
    - btrfs: defrag: fix wrong number of defragged sectors
    - btrfs: defrag: properly update range->start for autodefrag
    - btrfs: fix deadlock when reserving space during defrag
    - btrfs: add back missing dirty page rate limiting to defrag
    - btrfs: update writeback index when starting defrag
    - net: sfp: ignore disabled SFP node
    - net: stmmac: configure PTP clock source prior to PTP initialization
    - net: stmmac: skip only stmmac_ptp_register when resume from suspend
    - [armel,armhf] 9179/1: uaccess: avoid alignment faults in
      copy_[from|to]_kernel_nofault
    - [armel,armhf] 9180/1: Thumb2: align ALT_UP() sections in modules
      sufficiently
    - [arm64] KVM: arm64: vgic-v3: Restrict SEIS workaround to known broken
      systems
    - [s390x] module: fix loading modules with a lot of relocations
    - [s390x] hypfs: include z/VM guests with access control group set
    - [s390x] nmi: handle guarded storage validity failures for KVM guests
    - [s390x] nmi: handle vector validity failures for KVM guests
    - bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()
    - [s390x] scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV
      FCP devices
    - udf: Restore i_lenAlloc when inode expansion fails
    - udf: Fix NULL ptr deref when converting from inline format
    - [x86] efi: runtime: avoid EFIv2 runtime services on Apple x86 machines
    - tracing: Don't inc err_log entry count if entry allocation fails
    - ceph: properly put ceph_string reference after async create attempt
    - ceph: set pool_ns in new inode layout for async creates
    - fsnotify: invalidate dcache before IN_DELETE event
    - fsnotify: fix fsnotify hooks in pseudo filesystems
    - Revert "KVM: SVM: avoid infinite loop on NPF from bad address"
    - psi: Fix uaf issue when psi trigger is destroyed while being polled
    - [x86] perf/x86/intel/uncore: Fix CAS_COUNT_WRITE issue for ICX
    - [x86] perf/x86/intel: Add a quirk for the calculation of the number of
      counters on Alder Lake
    - [arm64,armhf] drm/etnaviv: relax submit size limits
    - drm/atomic: Add the crtc to affected crtc only if uapi.enable = true
    - drm/amdgpu: filter out radeon secondary ids as well
    - [x86] KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
    - [x86] KVM: SVM: Never reject emulation due to SMAP errata for !SEV guests
    - [x86] KVM: SVM: Don't intercept #GP for SEV guests
    - [x86] KVM: x86: nSVM: skip eax alignment check for non-SVM instructions
    - [x86] KVM: x86: Move CPUID.(EAX=0x12,ECX=1) mangling to
      __kvm_update_cpuid_runtime()
    - [x86] KVM: x86: Free kvm_cpuid_entry2 array on post-KVM_RUN
      KVM_SET_CPUID{,2}
    - [x86] KVM: x86: Forcibly leave nested virt when SMM state is toggled
    - [x86] KVM: x86: Check .flags in kvm_cpuid_check_equal() too
    - [x86] KVM: x86: Keep MSR_IA32_XSS unchanged for INIT
    - [x86] KVM: x86: Update vCPU's runtime CPUID on write to MSR_IA32_XSS
    - [x86] KVM: x86: Sync the states size with the XCR0/IA32_XSS at, any time
    - [powerpc*] KVM: PPC: Book3S HV Nested: Fix nested HFSCR being clobbered
      with multiple vCPUs
    - security, lsm: dentry_init_security() Handle multi LSM registration
    - [arm64] extable: fix load_unaligned_zeropad() reg indices
    - dm: revert partial fix for redundant bio-based IO accounting
    - block: add bio_start_io_acct_time() to control start_time
    - dm: properly fix redundant bio-based IO accounting
    - [arm*] serial: pl011: Fix incorrect rs485 RTS polarity on set_mctrl
    - serial: 8250: of: Fix mapped region size when using reg-offset property
    - [armhf] serial: stm32: fix software flow control transfer
    - tty: n_gsm: fix SW flow control encoding/handling
    - tty: Add support for Brainboxes UC cards.
    - usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge
    - usb: xhci-plat: fix crash when suspend if remote wake enable
    - [arm64,armhf] usb: common: ulpi: Fix crash in ulpi_match()
    - usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS
    - [arm64] usb: dwc3: xilinx: Skip resets and USB3 register settings for
      USB2.0 mode
    - [arm64] usb: dwc3: xilinx: Fix error handling when getting USB3 PHY
    - USB: core: Fix hang in usb_kill_urb by adding memory barriers
    - [arm64] usb: typec: tcpci: don't touch CC line if it's Vconn source
    - usb: typec: tcpm: Do not disconnect while receiving VBUS off
    - usb: typec: tcpm: Do not disconnect when receiving VSAFE0V
    - mt76: connac: introduce MCU_CE_CMD macro
    - jbd2: export jbd2_journal_[grab|put]_journal_head
    - ocfs2: fix a deadlock when commit trans
    - sched/membarrier: Fix membarrier-rseq fence command missing from query
      bitmask
    - PCI/sysfs: Find shadow ROM before static attribute initialization
    - [x86] MCE/AMD: Allow thresholding interface updates after init
    - [x86] cpu: Add Xeon Icelake-D to list of CPUs that support PPIN
    - i40e: Increase delay to 1 s after global EMP reset
    - i40e: Fix issue when maximum queues is exceeded
    - i40e: Fix queues reservation for XDP
    - i40e: Fix for failed to init adminq while VF reset
    - i40e: fix unsigned stat widths
    - scsi: bnx2fc: Flush destroy_work queue before calling
      bnx2fc_interface_put()
    - ipv6_tunnel: Rate limit warning messages
    - [armel,armhf] 9170/1: fix panic when kasan and kprobe are enabled
    - net: fix information leakage in /proc/net/ptype
    - hwmon: (lm90) Mark alert as broken for MAX6646/6647/6649
    - hwmon: (lm90) Mark alert as broken for MAX6680
    - ping: fix the sk_bound_dev_if match in ping_lookup
    - ipv4: avoid using shared IP generator for connected sockets
    - hwmon: (lm90) Reduce maximum conversion rate for G781
    - NFSv4: Handle case where the lookup of a directory fails
    - NFSv4: nfs_atomic_open() can race when looking up a non-regular file
    - net-procfs: show net devices bound packet types
    - [arm64] drm/msm: Fix wrong size calculation
    - [arm64] drm/msm/dsi: Fix missing put_device() call in dsi_get_phy
    - [arm64] drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable
    - ipv6: annotate accesses to fn->fn_sernum
    - NFS: Ensure the server has an up to date ctime before hardlinking
    - NFS: Ensure the server has an up to date ctime before renaming
    - [arm64] KVM: arm64: pkvm: Use the mm_ops indirection for cache maintenance
    - SUNRPC: Don't dereference xprt->snd_task if it's a cookie
    - netfilter: conntrack: don't increment invalid counter on NF_REPEAT
    - [powerpc*] 64s: Mask SRR0 before checking against the masked NIP
    - perf: Fix perf_event_read_local() time
    - sched/pelt: Relax the sync of util_sum with util_avg
    - net: phy: broadcom: hook up soft_reset for BCM54616S
    - ethtool: Fix link extended state for big endian
    - phylib: fix potential use-after-free
    - rxrpc: Adjust retransmission backoff
    - [arm64] efi/libstub: arm64: Fix image check alignment at entry
    - io_uring: fix bug in slow unregistering of nodes
    - block: fix memory leak in disk_register_independent_access_ranges
    - [x86] Drivers: hv: balloon: account for vmbus packet header in
      max_pkt_size
    - hwmon: (lm90) Re-enable interrupts after alert clears
    - hwmon: (lm90) Mark alert as broken for MAX6654
    - hwmon: (lm90) Fix sysfs and udev notifications
    - hwmon: (adt7470) Prevent divide by zero in adt7470_fan_write()
    - ipv4: fix ip option filtering for locally generated fragments
    - net/smc: Transitional solution for clcsock race issue
    - video: hyperv_fb: Fix validation of screen resolution
    - hwmon: (nct6775) Fix crash in clear_caseopen
    - [arm64] drm/msm/hdmi: Fix missing put_device() call in msm_hdmi_get_phy
    - [arm64] drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc
    - [arm64] drm/msm/a6xx: Add missing suspend_count increment
    - yam: fix a memory leak in yam_siocdevprivate()
    - [armhf] net: cpsw: Properly initialise struct page_pool_params
    - [arm64] net: hns3: handle empty unknown interrupt for VF
    - sch_htb: Fail on unsupported parameters when offload is requested
    - ceph: put the requests/sessions when it fails to alloc memory
    - gve: Fix GFP flags when allocing pages
    - Revert "ipv6: Honor all IPv6 PIO Valid Lifetime values"
    - net: bridge: vlan: fix single net device option dumping
    - ipv4: raw: lock the socket in raw_bind()
    - ipv4: tcp: send zero IPID in SYNACK messages
    - ipv4: remove sparse error in ip_neigh_gw4()
    - net: bridge: vlan: fix memory leak in __allowed_ingress
    - dt-bindings: can: tcan4x5x: fix mram-cfg RX FIFO config
    - perf/core: Fix cgroup event list management
    - [arm64] usb: dwc3: xilinx: fix uninitialized return value
    - [x86] KVM: nVMX: Rename vmcs_to_field_offset{,_table}
    - [x86] KVM: nVMX: Implement evmcs_field_offset() suitable for
      handle_vmread()
    - [x86] KVM: nVMX: Allow VMREAD when Enlightened VMCS is in use
    - block: Fix wrong offset in bio_truncate()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.6
    - PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
    - [arm*] drm/vc4: hdmi: Make sure the device is powered with CEC
    - cgroup-v1: Require capabilities to set release_agent (CVE-2022-0492)
    - Revert "mm/gup: small refactoring: simplify try_grab_page()"
    - net: phy: Fix qca8081 with speeds lower than 2.5Gb/s
    - ovl: don't fail copy up if no fileattr support on upper
    - lockd: fix server crash on reboot of client holding lock
    - lockd: fix failure to cleanup client locks
    - net/mlx5e: TC, Reject rules with drop and modify hdr action
    - net/mlx5: Bridge, take rtnl lock in init error handler
    - net/mlx5e: Fix handling of wrong devices during bond netevent
    - net/mlx5: Use del_timer_sync in fw reset flow of halting poll
    - net/mlx5e: Fix module EEPROM query
    - net/mlx5e: TC, Reject rules with forward and drop actions
    - net/mlx5: Fix offloading with ESWITCH_IPV4_TTL_MODIFY_ENABLE
    - net/mlx5e: Don't treat small ceil values as unlimited in HTB offload
    - net/mlx5: Bridge, Fix devlink deadlock on net namespace deletion
    - net/mlx5e: Avoid field-overflowing memcpy()
    - net/mlx5e: Fix wrong calculation of header index in HW_GRO
    - net/mlx5e: Fix broken SKB allocation in HW-GRO
    - net/mlx5: E-Switch, Fix uninitialized variable modact
    - net/mlx5e: Avoid implicit modify hdr for decap drop rule
    - ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback
    - i40e: Fix reset bw limit when DCB enabled with 1 TC
    - i40e: Fix reset path while removing the driver
    - [amd64,arm64] net: amd-xgbe: ensure to reset the tx_timer_active flag
    - [amd64,arm64] net: amd-xgbe: Fix skb data length underflow
    - fanotify: Fix stale file descriptor in copy_event_to_user()
    - net: sched: fix use-after-free in tc_new_tfilter()
    - rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
    - bpf: Fix possible race in inc_misses_counter
    - cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask()
    - e1000e: Handshake with CSME starts from ADL platforms
    - af_packet: fix data-race in packet_setsockopt / packet_setsockopt
    - tcp: fix mem under-charging with zerocopy sendmsg()
    - tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data()
    - ovl: fix NULL pointer dereference in copy up warning
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.7
    - [arm*] Revert "drm/vc4: hdmi: Make sure the device is powered with CEC"
    - [arm*] Revert "drm/vc4: hdmi: Make sure the device is powered with CEC"
      again

  [ Salvatore Bonaccorso ]
  * Set ABI to 1

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 06 Feb 2022 09:13:18 +0100

linux (5.16.4-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.4
    - io_uring: fix not released cached task refs
    - bnx2x: Utilize firmware 7.13.21.0
    - bnx2x: Invalidate fastpath HSI version for VFs
    - memcg: better bounds on the memcg stats updates
    - rcu: Tighten rcu_advance_cbs_nowake() checks
    - select: Fix indefinitely sleeping task in poll_schedule_timeout()
    - [arm64] bpf: Remove 128MB limit for BPF JIT programs

  * objtool: check: give big enough buffer for pv_ops (Closes: #1004495)
  * Refresh "firmware: Remove redundant log messages from drivers"
  * [rt] Refresh "mm/memcg: Protect per-CPU counter by disabling preemption on
    PREEMPT_RT where needed."

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 30 Jan 2022 19:00:56 +0100

linux (5.16.3-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.16
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.1
    - bpf: Fix out of bounds access from invalid *_or_null type verification
      (CVE-2022-23222)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.2
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3
    - netfilter: nft_payload: do not update layer 4 checksum when mangling
      fragments (Closes: #1002706)

  [ Helmut Grohne ]
  * Multiarchify python build-depends. (Closes: #983757)

  [ Ben Hutchings ]
  * linux-perf: Fix detection of libperl and libpython in cross-build
  * debian/README.source: Tag signatures are automatically verified
  * [rt] trace: Enable OSNOISE_TRACER, TIMERLAT_TRACER, HIST_TRIGGERS
  * d/bin/git-tag-gpg-wrapper, debian/upstream: Use ASCII-armored keyring
  * d/watch: Rewrite to find all upstream versions through Git
  * d/bin/genorig.py, d/README.source: Only support Git as upstream
  * d/bin/genorig.py, d/README.source: Add support for remote upstream repos
  * lintian: Refresh lintian-overrides
  * d/copyright: Fix license name with spaces in it
  * d/copyright: Update for removed and renamed source files
  * d/tests/selftests: Use $AUTOPKGTEST_TMP instead of $ADTTMP
  * Fix missing user-space hardening:
    - d/rules.real: Define KBUILD_HOST{C,LD}FLAGS for sub-make
    - linux-kbuild: Build modpost with standard CPPFLAGS
    - cpupower: Build with standard CPPFLAGS
    - usbip: Build with standard CPPFLAGS
    - objtool: Build with standard CFLAGS and CPPFLAGS
    - tools/perf: Define DEBUG=0 for sub-make so libapi doesn't use wrong flags
    - libapi: Define _FORTIFY_SOURCE as 2, not empty
    - tools/perf: Fix missing LDFLAGS for some programs
  * d/rules: Tell blhc to ignore missing flags for perf-read-vdso* helpers
  * d/rules: Tell blhc to ignore kernel compilation
  * d/rules: Filter out -s option so that Kbuild is not silent
  * d/bin/gencontrol.py, d/lib/python: Use classes for build restriction
    formulae
  * d/bin/gencontrol.py, d/rules.real: Replace DEBUG variable with if_package
  * Introduce pkg.linux.quick build profile for quicker CI builds
  * d/salsa-ci.yml: Add CI config using some of the common pipeline
  * d/salsa-ci.yml, d/tests/python: Only run static checks in CI
  * d/salsa-ci.yml: Run kconfigeditor2 as kconfig static check
  * d/rules, d/salsa-ci.yml: Enable blhc, ignoring terse output
  * bpftool, objtool, usbip: Always build with V=1 so blhc can check them
  * d/salsa-ci.yml: Use per-release cache of orig tarballs
  * linux-perf: Build a single unversioned package of perf, as it is no
    longer necessary to match the kernel version

  [ Vincent Blut ]
  * drivers/net/wireless/realtek/rtw89: Enable RTW89 and RTW89_8852AE as
    modules (Closes: #1004095)

  [ Aurelien Jarno ]
  * [riscv64] Add support for SBI SRST extension

  [ YunQiang Su ]
  * [mips*/generic] Change zload address for QEMU compatibility.

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.16.2-rt18
  * [rt] Update to 5.16.2-rt19
  * [x86] drm/i915: Flush TLBs before releasing backing store (CVE-2022-0330)
  * drm/vmwgfx: Fix stale file descriptors on failed usercopy (CVE-2022-22942)

  [ Bastian Blank ]
  * Build-depend on pahole after rename from dwarves.
  * Remove remaining aufs patches for good.

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 27 Jan 2022 23:12:52 +0100

linux (5.16~rc8-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ YunQiang Su ]
  * [mips*] unify installer flavors
  * [mips*] add generic platform and remove 5kc-malta from 32bit ports

  [ Alper Nebi Yasak ]
  * [armhf,arm64] drivers/gpu/drm/panel: Enable DRM_PANEL_EDP as module
  * [arm64] Include panel-edp in fb-modules udeb

  [ Noah Meyerhans ]
  * net: Use fq_codel as the default network qdisc (Closes: #890343)

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.16-rc8-rt13

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 03 Jan 2022 17:47:35 +0100

linux (5.16~rc7-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Uwe Kleine-König ]
  * [arm64] enable DRM_VMWGFX_FBCON to get a tty to login in the absence of a
    graphical login manager.

  [ Vincent Blut ]
  * [x86] drivers/platform/surface/aggregator: Enable SURFACE_AGGREGATOR as
    module (Closes: #1002460)
  * [x86] drivers/platform/surface: Enable SURFACE_3_POWER_OPREGION,
    SURFACE_ACPI_NOTIFY, SURFACE_AGGREGATOR_REGISTRY, SURFACE_DTX,
    SURFACE_GPE, SURFACE_HOTPLUG and SURFACE_PLATFORM_PROFILE as modules
  * [x86] drivers/hid/surface-hid: Enable SURFACE_HID and SURFACE_KBD as
    modules
  * [x86] drivers/power/supply: Enable BATTERY_SURFACE and CHARGER_SURFACE as
    modules

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.16-rc6-rt12
  * [x86] drivers/firmware/google: Re-enable GOOGLE_FIRMWARE (Closes: #947179)

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 27 Dec 2021 00:18:19 +0100

linux (5.16~rc6-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Aurelien Jarno ]
  * [riscv64] Improve HiFive Unmatched support: enable INPUT_DA9063_ONKEY,
    MFD_DA9063, REGULATOR_DA9063, RTC_DRV_DA9063, DA9063_WATCHDOG.

  [ Salvatore Bonaccorso ]
  * xen/blkfront: harden blkfront against event channel storms (CVE-2021-28711)
  * xen/netfront: harden netfront against event channel storms (CVE-2021-28712)
  * xen/console: harden hvc_xen against event channel storms (CVE-2021-28713)
  * xen/netback: fix rx queue stall detection (CVE-2021-28714)
  * xen/netback: don't queue unlimited number of packages (CVE-2021-28715)

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 20 Dec 2021 22:47:25 +0100

linux (5.16~rc5-1~exp1) experimental; urgency=medium

  * New upstream release candidate
    - nfsd: fix use-after-free due to delegation race (Closes: #988044)

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.16-rc5-rt10
  * Refresh "Export symbols needed by Android drivers"
  * net/tls: Enable TLS_DEVICE (Closes: #1001731)

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 15 Dec 2021 09:31:18 +0100

linux (5.16~rc4-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.16-rc4-rt8
  * Makefile: Do not quote value for CONFIG_CC_IMPLICIT_FALLTHROUGH
    (Closes: #1001083)
  * [arm64] drivers/iio/adc: Enable QCOM_SPMI_IADC, QCOM_SPMI_VADC and
    ROCKCHIP_SARADC as modules (Closes: #1001080)
  * [armhf] drivers/iio/adc: Enable ASPEED_ADC, EXYNOS_ADC, ROCKCHIP_SARADC,
    TI_AM335X_ADC and TWL4030_MADC as modules (Closes: #1001080)

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 07 Dec 2021 22:52:32 +0100

linux (5.16~rc3-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.16-rc2-rt4
  * [arm64] drivers/firmware/efi: Enable
    EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER (Closes: #997907)
  * liblockdep: Remove code to build liblockdep packages
  * [rt] Update to 5.16-rc3-rt5

  [ Uwe Kleine-König ]
  * [arm*] Enable support for Raspberry Pi POE hat (PWM_RASPBERRYPI_POE)
  * [arm*] Enable suport for pinctrl-based I2C multiplexer (I2C_MUX_PINCTRL).
    These are used (among others) on the Raspberry Pi CM4 IO Board.

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 29 Nov 2021 17:22:55 +0100

linux (5.16~rc1-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.16-rc1-rt2
  * fs/ksmbd: Enable SMB_SERVER as module (Closes: #998835)

  [ Aurelien Jarno ]
  * [riscv64] Enable VIRTUALIZATION and KVM.

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 19 Nov 2021 22:45:28 +0100

linux (5.15.15-2) unstable; urgency=high

  [ Bastian Blank ]
  * Build-depend on pahole after rename from dwarves.

  [ Salvatore Bonaccorso ]
  * [x86] mwifiex: Fix skb_over_panic in mwifiex_usb_recv() (CVE-2021-43976)
  * [x86] drm/i915: Flush TLBs before releasing backing store (CVE-2022-0330)
  * drm/vmwgfx: Fix stale file descriptors on failed usercopy (CVE-2022-22942)
  * ucount:  Make get_ucount a safe get_user replacement (CVE-2022-24122)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 30 Jan 2022 11:14:49 +0100

linux (5.15.15-1) unstable; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.6
    - scsi: sd: Fix sd_do_mode_sense() buffer length handling
      (Closes: #1001559)
    - ACPI: Get acpi_device's parent from the parent field
    - ACPI: CPPC: Add NULL pointer check to cppc_get_perf()
    - USB: serial: pl2303: fix GC type detection
    - USB: serial: option: add Telit LE910S1 0x9200 composition
    - USB: serial: option: add Fibocom FM101-GL variants
    - [arm*] usb: dwc2: gadget: Fix ISOC flow for elapsed frames
    - [arm*] usb: dwc2: hcd_queue: Fix use of floating point literal
    - [arm64,armhf] usb: dwc3: leave default DMA for PCI devices
    - [arm64,armhf] usb: dwc3: core: Revise GHWPARAMS9 offset
    - [arm64,armhf] usb: dwc3: gadget: Ignore NoStream after End Transfer
    - [arm64,armhf] usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer
    - [arm64,armhf] usb: dwc3: gadget: Fix null pointer exception
    - net: usb: Correct PHY handling of smsc95xx
    - net: nexthop: fix null pointer dereference when IPv6 is not enabled
    - [arm64,armhf] usb: chipidea: ci_hdrc_imx: fix potential error pointer
      dereference in probe
    - [x86,arm64] usb: typec: fusb302: Fix masking of comparator and bc_lvl
      interrupts
    - [arm64,armhf] usb: xhci: tegra: Check padctrl interrupt presence in
      device tree
    - usb: hub: Fix usb enumeration issue due to address0 race
    - usb: hub: Fix locking issues with address0_mutex
    - binder: fix test regression due to sender_euid change
    - ALSA: ctxfi: Fix out-of-range access
    - [x86] ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100
    - [x86] ALSA: hda/realtek: Fix LED on HP ProBook 435 G7
    - media: cec: copy sequence field for the reply
    - [hppa] Revert "parisc: Fix backtrace to always include init funtion
      names" (regression in 5.15.3)
    - HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts
    - staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
    - staging: r8188eu: Use kzalloc() with GFP_ATOMIC in atomic context
    - staging: r8188eu: Fix breakage introduced when 5G code was removed
    - staging: r8188eu: use GFP_ATOMIC under spinlock
    - staging: r8188eu: fix a memory leak in rtw_wx_read32()
    - xen: don't continue xenstore initialization in case of errors
    - xen: detect uninitialized xenbus in xenbus_init
    - io_uring: correct link-list traversal locking
    - io_uring: fail cancellation for EXITING tasks
    - io_uring: fix link traversal locking
    - drm/amdgpu: IH process reset count when restart
    - drm/amdgpu/pm: fix powerplay OD interface (regression in 5.15)
    - drm/nouveau: recognise GA106
    - [powerpc*] KVM: PPC: Book3S HV: Prevent POWER7/8 TLB flush flushing SLB
    - tracing/uprobe: Fix uprobe_perf_open probes iteration
    - tracing: Fix pid filtering when triggers are attached
    - [arm64,armhf] mmc: sdhci-esdhc-imx: disable CMDQ support
    - mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB
    - [armhf] mdio: aspeed: Fix "Link is Down" issue
    - [arm64] mm: Fix VM_BUG_ON(mm != &init_mm) for trans_pgd
    - [x86] cpufreq: intel_pstate: Fix active mode offline/online EPP handling
    - [powerpc] Fix hardlockup on vmap stack overflow
    - iomap: Fix inline extent handling in iomap_readpage
    - NFSv42: Fix pagecache invalidation after COPY/CLONE
    - [arm64] PCI: aardvark: Deduplicate code in advk_pcie_rd_conf()
    - [arm64] PCI: aardvark: Implement re-issuing config requests on CRS
      response
    - [arm64] PCI: aardvark: Simplify initialization of rootcap on virtual
      bridge
    - [arm64] PCI: aardvark: Fix link training
    - drm/amd/display: Fix OLED brightness control on eDP
    - proc/vmcore: fix clearing user buffer by properly using clear_user()
    - [x86] ASoC: SOF: Intel: hda: fix hotplug when only codec is suspended
    - netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY
    - netfilter: ctnetlink: do not erase error code with EINVAL
    - netfilter: ipvs: Fix reuse connection if RS weight is 0
    - netfilter: flowtable: fix IPv6 tunnel addr match
    - media: v4l2-core: fix VIDIOC_DQEVENT handling on non-x86
    - [armhf] firmware: arm_scmi: Fix null de-reference on error path
    - ASoC: topology: Add missing rwsem around snd_ctl_remove() calls
    - net: ieee802154: handle iftypes as u32
    - [armhf] firmware: arm_scmi: Fix base agent discover response
    - [armhf] firmware: arm_scmi: pm: Propagate return value to caller
    - [armhf] ASoC: stm32: i2s: fix 32 bits channel length without mclk
    - NFSv42: Don't fail clone() unless the OP_CLONE operation failed
    - [armhf] socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
    - drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks
    - scsi: qla2xxx: edif: Fix off by one bug in qla_edif_app_getfcinfo()
    - scsi: mpt3sas: Fix kernel panic during drive powercycle test
    - scsi: mpt3sas: Fix system going into read-only mode
    - scsi: mpt3sas: Fix incorrect system timestamp
    - [arm*] drm/vc4: fix error code in vc4_create_object()
    - [armhf] drm/aspeed: Fix vga_pw sysfs output
    - HID: input: Fix parsing of HID_CP_CONSUMER_CONTROL fields
    - HID: input: set usage type to key on keycode remap
    - HID: magicmouse: prevent division by 0 on scroll
    - iavf: Prevent changing static ITR values if adaptive moderation is on
    - iavf: Fix refreshing iavf adapter stats on ethtool request
    - iavf: Fix VLAN feature flags after VFR
    - [x86] ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336
      codec
    - mptcp: fix delack timer
    - mptcp: use delegate action to schedule 3rd ack retrans
    - af_unix: fix regression in read after shutdown
    - [arm64,armhf] firmware: smccc: Fix check for ARCH_SOC_ID not implemented
    - ipv6: fix typos in __ip6_finish_output()
    - nfp: checking parameter process for rx-usecs/tx-usecs is invalid
    - net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls
    - net: ipv6: add fib6_nh_release_dsts stub
    - net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group
    - ice: fix vsi->txq_map sizing
    - ice: avoid bpf_prog refcount underflow
    - scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
    - scsi: scsi_debug: Zero clear zones at reset write pointer
    - erofs: fix deadlock when shrink erofs slab
    - i2c: virtio: disable timeout handling
    - net/smc: Ensure the active closing peer first closes clcsock
    - [arm64,armhf] net: marvell: mvpp2: increase MTU limit when XDP enabled
    - [x86] cpufreq: intel_pstate: Add Ice Lake server to out-of-band IDs
    - nvmet-tcp: fix incomplete data digest send
    - [x86] drm/hyperv: Fix device removal on Gen1 VMs
    - [arm64] uaccess: avoid blocking within critical sections
    - [armhf] net/ncsi : Add payload to be 32-bit aligned to fix dropped
      packets
    - PM: hibernate: use correct mode for swsusp_close()
    - drm/amd/display: Fix DPIA outbox timeout after GPU reset
    - drm/amd/display: Set plane update flags for all planes in reset
    - tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited
      flows
    - lan743x: fix deadlock in lan743x_phy_link_status_change()
    - net: phylink: Force link down and retrigger resolve on interface change
    - net: phylink: Force retrigger in case of latched link-fail indicator
    - net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
    - net/smc: Fix loop in smc_listen
    - nvmet: use IOCB_NOWAIT only if the filesystem supports it
    - igb: fix netpoll exit with traffic
    - [mips*el/loongson-3] fix FTLB configuration
    - tls: splice_read: fix record type check
    - tls: splice_read: fix accessing pre-processed records
    - tls: fix replacing proto_ops
    - net: stmmac: Disable Tx queues when reconfiguring the interface
    - net/sched: sch_ets: don't peek at classes beyond 'nbands'
    - ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
    - net: vlan: fix underflow for the real_dev refcnt
    - net/smc: Don't call clcsock shutdown twice when smc shutdown
    - [arm64] net: hns3: fix VF RSS failed problem after PF enable multi-TCs
    - [arm64] net: hns3: fix incorrect components info of ethtool --reset
      command
    - locking/rwsem: Make handoff bit handling more consistent
    - perf: Ignore sigtrap for tracepoints destined for other tasks
    - sched/scs: Reset task stack state in bringup_cpu()
    - [arm64] iommu/rockchip: Fix PAGE_DESC_HI_MASKs for RK3568
    - [x86] iommu/vt-d: Fix unmap_pages support
    - f2fs: quota: fix potential deadlock
    - f2fs: set SBI_NEED_FSCK flag when inconsistent node block found
    - [riscv64] dts: microchip: fix board compatible
    - [riscv64] dts: microchip: drop duplicated MMC/SDHC node
    - cifs: nosharesock should not share socket with future sessions
    - ceph: properly handle statfs on multifs setups
    - [amd64] iommu/amd: Clarify AMD IOMMUv2 initialization messages
    - vhost/vsock: fix incorrect used length reported to the guest
    - tracing: Check pid filtering when creating events
    - cifs: nosharesock should be set on new server
    - io_uring: fix soft lockup when call __io_remove_buffers
    - [armhf] firmware: arm_scmi: Fix type error assignment in voltage protocol
    - [armhf] firmware: arm_scmi: Fix type error in sensor protocol
    - blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and
      disk_release()
    - block: avoid to quiesce queue in elevator_init_mq
    - drm/amdgpu/gfx10: add wraparound gpu counter check for APUs as well
    - drm/amdgpu/gfx9: switch to golden tsc registers for renoir+
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.7
    - ALSA: usb-audio: Restrict rates for the shared clocks
    - ALSA: usb-audio: Rename early_playback_start flag with lowlatency_playback
    - ALSA: usb-audio: Disable low-latency playback for free-wheel mode
    - ALSA: usb-audio: Disable low-latency mode for implicit feedback sync
    - ALSA: usb-audio: Check available frames for the next packet size
    - ALSA: usb-audio: Add spinlock to stop_urbs()
    - ALSA: usb-audio: Improved lowlatency playback support
    - ALSA: usb-audio: Avoid killing in-flight URBs during draining
    - ALSA: usb-audio: Fix packet size calculation regression
    - ALSA: usb-audio: Less restriction for low-latency playback mode
    - ALSA: usb-audio: Switch back to non-latency mode at a later point
    - ALSA: usb-audio: Don't start stream for capture at prepare
    - gfs2: release iopen glock early in evict
    - gfs2: Fix length of holes reported at end-of-file
    - [powerpc*] pseries/ddw: Revert "Extend upper limit for huge DMA window
      for persistent memory"
    - [powerpc*] pseries/ddw: Do not try direct mapping with persistent memory
      and one window
    - mac80211: do not access the IV when it was stripped
    - mac80211: fix throughput LED trigger
    - [x86] hyperv: Move required MSRs check to initial platform probing
    - net/smc: Transfer remaining wait queue entries during fallback
    - net: return correct error code
    - [x86] platform/x86: dell-wmi-descriptor: disable by default
    - [x86] platform/x86: thinkpad_acpi: Add support for dual fan control
    - [x86] platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after
      S3 deep
    - btrfs: silence lockdep when reading chunk tree during mount
    - btrfs: check-integrity: fix a warning on write caching disabled disk
    - thermal: core: Reset previous low and high trip during thermal zone init
    - scsi: iscsi: Unblock session then wake up error handler
    - net: usb: r8152: Add MAC passthrough support for more Lenovo Docks
    - drm/amd/pm: Remove artificial freq level on Navi1x
    - drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered
      again
    - drm/amd/amdgpu: fix potential memleak
    - [x86] ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile
    - ata: libahci: Adjust behavior when StorageD3Enable _DSD is set
    - [arm64] ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array
      overflow in hns_dsaf_ge_srst_by_port()
    - ipv6: check return value of ipv6_skip_exthdr
    - [alpha] net: tulip: de4x5: fix the problem that the array 'lp->phy[8]'
      may be out of bound
    - [alpha] net: ethernet: dec: tulip: de4x5: fix possible array overflows in
      type3_infoblock()
    - perf sort: Fix the 'weight' sort key behavior
    - perf sort: Fix the 'ins_lat' sort key behavior
    - perf sort: Fix the 'p_stage_cyc' sort key behavior
    - [arm*] perf inject: Fix ARM SPE handling
    - perf hist: Fix memory leak of a perf_hpp_fmt
    - perf report: Fix memory leaks around perf_tip()
    - tracing: Don't use out-of-sync va_list in event printing
    - net/smc: Avoid warning of possible recursive locking
    - ACPI: Add stubs for wakeup handler functions
    - net/tls: Fix authentication failure in CCM mode
    - vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
    - kprobes: Limit max data_size of the kretprobe instances
    - rt2x00: do not mark device gone on EPROTO errors during start
    - ipmi: Move remove_work to dedicated workqueue
    - cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink()
    - iwlwifi: mvm: retry init flow if failed
    - [s390x] pci: move pseudo-MMIO to prevent MIO overlap
    - scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO
    - scsi: ufs: ufs-pci: Add support for Intel ADL
    - ipv6: fix memory leak in fib6_rule_suppress
    - drm/amd/display: Allow DSC on supported MST branch devices
    - [x86] drm/i915/dp: Perform 30ms delay after source OUI write
    - [x86] KVM: fix avic_set_running for preemptable kernels
    - KVM: Disallow user memslot with size that exceeds "unsigned long"
    - [x86] KVM: x86/mmu: Fix TLB flush range when handling disconnected pt
    - KVM: Ensure local memslot copies operate on up-to-date arch-specific data
    - [x86] KVM: x86: ignore APICv if LAPIC is not enabled
    - [x86] KVM: nVMX: Emulate guest TLB flush on nested VM-Enter with new
      vpid12
    - [x86] KVM: nVMX: Flush current VPID (L1 vs. L2) for
      KVM_REQ_TLB_FLUSH_GUEST
    - [x86] KVM: nVMX: Abide to KVM_REQ_TLB_FLUSH_GUEST request on nested
      vmentry/vmexit
    - [x86] KVM: VMX: prepare sync_pir_to_irr for running with APICv disabled
    - [x86] KVM: x86: Use a stable condition around all VT-d PI paths
    - [x86] KVM: MMU: shadow nested paging does not have PKU
    - [arm64] KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and
      CPTR_EL2 to 1
    - [x86] KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg()
    - [x86] KVM: x86: check PIR even for vCPUs with disabled APICv
    - tracing/histograms: String compares should not care about signed values
    - [arm64,armhf] net: dsa: mv88e6xxx: Fix application of erratum 4.8 for
      88E6393X
    - [arm64,armhf] net: dsa: mv88e6xxx: Drop unnecessary check in
      mv88e6393x_serdes_erratum_4_6()
    - [arm64,armhf] net: dsa: mv88e6xxx: Save power by disabling SerDes
      trasmitter and receiver
    - [arm64,armhf] net: dsa: mv88e6xxx: Add fix for erratum 5.2 of 88E6393X
      family
    - [arm64,armhf] net: dsa: mv88e6xxx: Fix inband AN for 2500base-x on
      88E6393X family
    - [arm64,armhf] net: dsa: mv88e6xxx: Link in pcs_get_state() if AN is
      bypassed
    - wireguard: allowedips: add missing __rcu annotation to satisfy sparse
    - wireguard: device: reset peer src endpoint when netns exits
    - wireguard: receive: use ring buffer for incoming handshakes
    - wireguard: receive: drop handshakes if queue lock is contended
    - wireguard: ratelimiter: use kvcalloc() instead of kvzalloc()
    - [armhf] i2c: stm32f7: flush TX FIFO upon transfer errors
    - [armhf] i2c: stm32f7: recover the bus on access timeout
    - [armhf] i2c: stm32f7: stop dma transfer in case of NACK
    - tcp: fix page frag corruption on page fault
    - net: qlogic: qlcnic: Fix a NULL pointer dereference in
      qlcnic_83xx_add_rings()
    - net: mpls: Fix notifications when deleting a device
    - siphash: use _unaligned version by default
    - [arm64] ftrace: add missing BTIs
    - iwlwifi: fix warnings produced by kernel debug options
    - net/mlx5e: IPsec: Fix Software parser inner l3 type setting in case of
      encapsulation
    - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
    - [armhf] net: dsa: b53: Add SPI ID table (regression in 5.15)
    - mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode
    - [arm64,armhf] ASoC: tegra: Fix wrong value type in ADMAIF
    - [arm64,armhf] ASoC: tegra: Fix wrong value type in I2S
    - [arm64,armhf] ASoC: tegra: Fix wrong value type in DMIC
    - [arm64,armhf] ASoC: tegra: Fix wrong value type in DSPK
    - [arm64,armhf] ASoC: tegra: Fix kcontrol put callback in ADMAIF
    - [arm64,armhf] ASoC: tegra: Fix kcontrol put callback in I2S
    - [arm64,armhf] ASoC: tegra: Fix kcontrol put callback in DMIC
    - [arm64,armhf] ASoC: tegra: Fix kcontrol put callback in DSPK
    - [arm64,armhf] ASoC: tegra: Fix kcontrol put callback in AHUB
    - rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
    - rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
    - [x86] ALSA: intel-dsp-config: add quirk for CML devices based on ES8336
      codec
    - net: stmmac: Avoid DMA_CHAN_CONTROL write if no Split Header support
    - net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no
      IRQ is available
    - [arm64,armhf] net: marvell: mvpp2: Fix the computation of shared CPUs
    - [arm64] dpaa2-eth: destroy workqueue at the end of remove function
    - net: annotate data-races on txq->xmit_lock_owner
    - ipv4: convert fib_num_tclassid_users to atomic_t
    - net/smc: fix wrong list_del in smc_lgr_cleanup_early
    - net/rds: correct socket tunable error in rds_tcp_tune()
    - net/smc: Keep smc_close_final rc during active close
    - [arm64] drm/msm/a6xx: Allocate enough space for GMU registers
    - [arm64] drm/msm: Do hw_init() before capturing GPU state
    - [arm*] drm/vc4: kms: Wait for the commit before increasing our clock rate
    - [arm*] drm/vc4: kms: Fix return code check
    - [arm*] drm/vc4: kms: Add missing drm_crtc_commit_put
    - [arm*] drm/vc4: kms: Clear the HVS FIFO commit pointer once done
    - [arm*] drm/vc4: kms: Don't duplicate pending commit
    - [arm*] drm/vc4: kms: Fix previous HVS commit wait
    - atlantic: Increase delay for fw transactions
    - atlatnic: enable Nbase-t speeds with base-t
    - atlantic: Fix to display FW bundle version instead of FW mac version.
    - atlantic: Add missing DIDs and fix 115c.
    - atlantic: Remove Half duplex mode speed capabilities.
    - atlantic: Fix statistics logic for production hardware
    - atlantic: Remove warn trace message.
    - [x86] KVM: x86/mmu: Skip tlb flush if it has been done in zap_gfn_range()
    - [x86] KVM: x86/mmu: Pass parameter flush as false in
      kvm_tdp_mmu_zap_collapsible_sptes()
    - [arm64] drm/msm/devfreq: Fix OPP refcnt leak
    - [arm64] drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP
    - [arm64] drm/msm: Fix wait_fence submitqueue leak
    - [arm64] drm/msm: Restore error return on invalid fence
    - iwlwifi: Fix memory leaks in error handling path
    - [x86] KVM: X86: Fix when shadow_root_level=5 && guest root_level<4
    - [x86] KVM: SEV: initialize regions_list of a mirror VM
    - net/mlx5e: Fix missing IPsec statistics on uplink representor
    - net/mlx5: Move MODIFY_RQT command to ignore list in internal error state
    - net/mlx5: E-switch, Respect BW share of the new group
    - net/mlx5: E-Switch, fix single FDB creation on BlueField
    - net/mlx5: E-Switch, Check group pointer before reading bw_share value
    - [x86] KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register
    - [x86] KVM: VMX: Set failure code in prepare_vmcs02()
    - io-wq: don't retry task_work creation failure on fatal conditions
    - [x86] sev: Fix SEV-ES INS/OUTS instructions for word, dword, and qword
    - [x86] entry: Add a fence for kernel entry SWAPGS in paranoid_entry()
    - [x86] entry: Use the correct fence macro after swapgs in kernel CR3
    - [x86] xen: Add xenpv_restore_regs_and_return_to_usermode()
    - preempt/dynamic: Fix setup_preempt_mode() return value
    - sched/uclamp: Fix rq->uclamp_max not set on first enqueue
    - [x86] KVM: SEV: Return appropriate error codes if SEV-ES scratch setup
      fails
    - [x86] KVM: x86/mmu: Rename slot_handle_leaf to slot_handle_level_4k
    - [x86] KVM: x86/mmu: Remove spurious TLB flushes in TDP MMU zap
      collapsible path
    - net/mlx5e: Rename lro_timeout to packet_merge_timeout
    - net/mlx5e: Rename TIR lro functions to TIR packet merge functions
    - net/mlx5e: Sync TIR params updates against concurrent create/modify
    - [hppa] Fix KBUILD_IMAGE for self-extracting kernel
    - [hppa] Fix "make install" on newer debian releases
    - [hppa] Mark cr16 CPU clocksource unstable on all SMP machines
    - vgacon: Propagate console boot parameters before calling `vc_resize'
    - xhci: Fix commad ring abort, write all 64 bits to CRCR register.
    - USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub
    - [x86,arm64] usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
    - [x86] tsc: Add a timer to make sure TSC_adjust is always checked
    - [x86] tsc: Disable clocksource watchdog for TSC on qualified platorms
    - [amd64] mm: Map all kernel memory into trampoline_pgd
    - [arm64] tty: serial: msm_serial: Deactivate RX DMA for polling support
    - [arm*] serial: pl011: Add ACPI SBSA UART match id
    - [arm64,armhf] serial: tegra: Change lower tolerance baud rate limit for
      tegra20 and tegra30
    - serial: core: fix transmit-buffer reset and memleak
    - serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array
    - serial: 8250_pci: rewrite pericom_do_set_divisor()
    - serial: 8250: Fix RTS modem control while in rs485 mode
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.8
    - usb: gadget: uvc: fix multiple opens
    - [x86] HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
    - HID: google: add eel USB id
    - [x86] HID: intel-ish-hid: ipc: only enable IRQ wakeup when requested
    - HID: bigbenff: prevent null pointer dereference
    - HID: wacom: fix problems when device is not a valid USB device
    - HID: check for valid USB device for many HID drivers
    - mtd: dataflash: Add device-tree SPI IDs (regression in 5.15)
    - mmc: spi: Add device-tree SPI IDs
    - HID: sony: fix error path in probe
    - [x86] HID: Ignore battery for Elan touchscreen on Asus UX550VE
    - [x86] platform/x86/intel: hid: add quirk to support Surface Go 3
    - [x86] nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six
      8-bit groups
    - IB/hfi1: Insure use of smp_processor_id() is preempt disabled
    - IB/hfi1: Fix early init panic
    - IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr
    - can: kvaser_usb: get CAN clock frequency from device
    - can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct
      stats->{rx,tx}_errors counter
    - can: sja1000: fix use after free in ems_pcmcia_add_card()
    - [i386] can: pch_can: pch_can_rx_normal: fix use after free
    - [arm64,armhf] net: dsa: mv88e6xxx: fix "don't use PHY_DETECT on internal
      PHY's"
    - [arm64,armhf] net: dsa: mv88e6xxx: allow use of PHYs on CPU and DSA ports
    - [x86] sme: Explicitly map new EFI memmap table as encrypted
    - [x86] platform/x86: amd-pmc: Fix s2idle failures on certain AMD laptops
    - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
    - vrf: don't run conntrack on vrf with !dflt qdisc
    - bpf, sockmap: Attach map progs to psock early for feature probes
    - bpf: Make sure bpf_disable_instrumentation() is safe vs preemption.
    - bpf: Fix the off-by-two error in range markings
    - ice: ignore dropped packets during init
    - ethtool: do not perform operations on net devices being unregistered
    - bonding: make tx_rebalance_counter an atomic
    - nfp: Fix memory leak in nfp_cpp_area_cache_add()
    - seg6: fix the iif in the IPv6 socket control block
    - udp: using datalen to cap max gso segments
    - netfilter: nft_exthdr: break evaluation if setting TCP option fails
    - netfilter: conntrack: annotate data-races around ct->timeout
    - iavf: restore MSI state on reset
    - iavf: Fix reporting when setting descriptor count
    - IB/hfi1: Correct guard on eager buffer deallocation
    - devlink: fix netns refcount leak in devlink_nl_cmd_reload()
    - [arm64,armhf] net: dsa: mv88e6xxx: error handling for serdes_power
      functions
    - [arm64] net: dsa: felix: Fix memory leak in felix_setup_mmio_filtering
    - net/sched: fq_pie: prevent dismantle issue
    - [arm64,armhf] net: mvpp2: fix XDP rx queues registering
    - [x86] KVM: x86: Don't WARN if userspace mucks with RCX during string I/O
      exit
    - [x86] KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse
      IPI req
    - [x86] KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB
      flush hypercall
    - timers: implement usleep_idle_range()
    - mm/slub: fix endianness bug for alloc/free_traces attributes
    - mm: bdi: initialize bdi_min_ratio when bdi is unregistered
    - ALSA: ctl: Fix copy of updated id with element read/write
    - [x86] ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897
      platform
    - [x86] ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1
    - ALSA: pcm: oss: Fix negative period/buffer sizes
    - ALSA: pcm: oss: Limit the period size to 16MB
    - ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
    - cifs: Fix crash on unload of cifs_arc4.ko
    - scsi: qla2xxx: Format log strings only if needed
    - btrfs: clear extent buffer uptodate when we fail to write it
    - btrfs: fix re-dirty process of tree-log nodes
    - btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error
      handling
    - btrfs: free exchange changeset on failures
    - [x86] perf intel-pt: Fix some PGE (packet generation enable/control flow
      packets) usage
    - [x86] perf intel-pt: Fix sync state when a PSB (synchronization) packet
      is found
    - [x86] perf intel-pt: Fix intel_pt_fup_event() assumptions about setting
      state type
    - [x86] perf intel-pt: Fix state setting when receiving overflow (OVF)
      packet
    - [x86] perf intel-pt: Fix next 'err' value, walking trace
    - [x86] perf intel-pt: Fix missing 'instruction' events with 'q' option
    - [x86] perf intel-pt: Fix error timestamp setting on the decoder error
      path
    - md: fix update super 1.0 on rdev size change
    - nfsd: Fix nsfd startup race (again)
    - tracefs: Have new files inherit the ownership of their parent
    - hwmon: (pwm-fan) Ensure the fan going on in .probe()
    - [arm64] clk: qcom: regmap-mux: fix parent clock lookup
    - [x86] thermal: int340x: Fix VCoRefLow MMIO bit offset for TGL
    - drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence.
    - libata: add horkage for ASMedia 1092
    - io_uring: ensure task_work gets run as part of cancelations
    - wait: add wake_up_pollfree()
    - binder: use wake_up_pollfree()
    - signalfd: use wake_up_pollfree()
    - aio: keep poll requests on waitqueue until completed
    - aio: fix use-after-free due to missing POLLFREE handling
    - tracefs: Set all files to the same group ownership as the mount option
    - [powerpc*] i2c: mpc: Use atomic read and fix break condition
    - block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
    - scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()
    - scsi: scsi_debug: Fix buffer size of REPORT ZONES command
    - ALSA: usb-audio: Reorder snd_djm_devices[] entries
    - qede: validate non LSO skb length
    - PM: runtime: Fix pm_runtime_active() kerneldoc comment
    - ASoC: rt5682: Fix crash due to out of scope stack vars
    - [arm64] RDMA/hns: Do not halt commands during reset until later
    - [arm64] RDMA/hns: Do not destroy QP resources in the hw resetting phase
    - [x86] hwmon: (dell-smm) Fix warning on /proc/i8k creation error
    - [arm64] clk: qcom: clk-alpha-pll: Don't reconfigure running Trion
    - i40e: Fix failed opcode appearing if handling messages from VF
    - i40e: Fix pre-set max number of queues for VF
    - bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap
    - i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
    - [arm64] Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on
      emulated bridge" (regression in 5.15.3)
    - drm/amd/display: Fix DPIA outbox timeout after S3/S4/reset
    - perf tools: Fix SMT detection fast read path
    - net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
    - [arm64] net: fec: only clear interrupt of handling queue in
      fec_enet_rx_queue()
    - net, neigh: clear whole pneigh_entry at alloc time
    - net/qla3xxx: fix an error code in ql_adapter_up()
    - [arm64] Revert "usb: dwc3: dwc3-qcom: Enable tx-fifo-resize property by
      default" (regression in 5.15)
    - usb: core: config: fix validation of wMaxPacketValue entries
    - xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime
      suspending
    - xhci: avoid race between disable slot command and host runtime suspend
    - iio: gyro: adxrs290: fix data signedness
    - iio: trigger: Fix reference counting
    - iio: stk3310: Don't return error code in interrupt handler
    - iio: mma8452: Fix trigger reference couting
    - iio: ltr501: Don't return error code in trigger handler
    - iio: kxsd9: Don't return error code in trigger handler
    - iio: itg3200: Call iio_trigger_notify_done() on error
    - iio: adc: axp20x_adc: fix charging current reporting on AXP22x
    - iio: ad7768-1: Call iio_trigger_notify_done() on error
    - iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
    - misc: rtsx: Avoid mangling IRQ during runtime PM
    - nvmem: eeprom: at25: fix FRAM byte_len
    - bus: mhi: pci_generic: Fix device recovery failed issue
    - bus: mhi: core: Add support for forced PM resume
    - [armhf] irqchip/aspeed-scu: Replace update_bits with write_bits.
    - [armhf] irqchip/armada-370-xp: Fix return value of
      armada_370_xp_msi_alloc()
    - [armhf] irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
    - aio: Fix incorrect usage of eventfd_signal_allowed()
    - [arm64,armhf] irqchip/irq-gic-v3-its.c: Force synchronisation when
      issuing INVALL
    - [armhf] clocksource/drivers/dw_apb_timer_of: Fix probe failure
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.9
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.10
    - nfc: fix segfault in nfc_genl_dump_devices_done
    - [x86] hwmon: (corsair-psu) fix plain integer used as NULL pointer
    - RDMA: Fix use-after-free in rxe_queue_cleanup
    - RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow
    - mtd: rawnand: Fix nand_erase_op delay
    - mtd: rawnand: Fix nand_choose_best_timings() on unsupported interface
    - netfs: Fix lockdep warning from taking sb_writers whilst holding
      mmap_lock
    - ice: fix FDIR init missing when reset VF
    - [x86] vmxnet3: fix minimum vectors alloc issue
    - [arm64] drm/msm: Fix null ptr access msm_ioctl_gem_submit()
    - [arm64] drm/msm/a6xx: Fix uinitialized use of gpu_scid
    - [arm64] drm/msm/dsi: set default num_data_lanes
    - [arm64] drm/msm/dp: Avoid unpowered AUX xfers that caused crashes
    - [arm64] KVM: arm64: Save PSTATE early on exit
    - [arm64] Revert "tty: serial: fsl_lpuart: drop earlycon entry for
      i.MX8QXP"
    - net/mlx4_en: Update reported link modes for 1/10G
    - loop: Use pr_warn_once() for loop_control_remove() warning
    - ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
    - [x86] ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P
    - [arm64,armhf] i2c: rk3x: Handle a spurious start completion interrupt
      flag
    - net: netlink: af_netlink: Prevent empty skb by adding a check on len.
    - drm/amdgpu: cancel the correct hrtimer on exit
    - drm/amdgpu: check atomic flag to differeniate with legacy path
    - drm/amd/display: Fix for the no Audio bug with Tiled Displays
    - drm/amdkfd: fix double free mem structure
    - drm/amd/display: add connector type check for CRC source set
    - drm/amdkfd: process_info lock not needed for svm
    - tracing: Fix a kmemleak false positive in tracing_map
    - fuse: make sure reclaim doesn't write the inode
    - perf inject: Fix itrace space allowed for new attributes
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.11
    - [x86] KVM: VMX: clear vmx_x86_ops.sync_pir_to_irr if APICv is disabled
    - KVM: downgrade two BUG_ONs to WARN_ON_ONCE
    - [x86] kvm: remove unused ack_notifier callbacks
    - [x86] KVM: X86: Fix tlb flush for tdp in kvm_invalidate_pcid()
    - mac80211: fix rate control for retransmitted frames
    - mac80211: fix regression in SSN handling of addba tx
    - mac80211: mark TX-during-stop for TX in in_reconfig
    - mac80211: send ADDBA requests using the tid/queue of the aggregation
      session
    - mac80211: validate extended element ID is present
    - [arm64] firmware: arm_scpi: Fix string overflow in SCPI genpd driver
    - virtio_ring: Fix querying of maximum DMA mapping size for virtio device
    - [s390x] entry: fix duplicate tracking of irq nesting level
    - [s390x] recordmcount.pl: look for jgnop instruction as well as bcrl on
      s390
    - [arm64] dts: ten64: remove redundant interrupt declaration for gpio-keys
    - ceph: fix up non-directory creation in SGID directories
    - dm btree remove: fix use after free in rebalance_children()
    - audit: improve robustness of the audit queue handling
    - btrfs: convert latest_bdev type to btrfs_device and rename
    - btrfs: use latest_dev in btrfs_show_devname
    - btrfs: update latest_dev when we create a sprout device
    - btrfs: remove stale comment about the btrfs_show_devname
    - scsi: ufs: core: Retry START_STOP on UNIT_ATTENTION
    - [x86] drm/i915/hdmi: convert intel_hdmi_to_dev to intel_hdmi_to_i915
    - [x86] drm/i915/hdmi: Turn DP++ TMDS output buffers back on in encoder->
      shutdown()
    - [x86] pinctrl: amd: Fix wakeups when IRQ is shared with SCI
    - [arm64] dts: rockchip: remove mmc-hs400-enhanced-strobe from
      rk3399-khadas-edge
    - [arm64] dts: rockchip: fix rk3308-roc-cc vcc-sd supply
    - [arm64] dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
    - [arm64] dts: rockchip: fix audio-supply for Rock Pi 4
    - [arm64] dts: rockchip: fix poweroff on helios64
    - mac80211: track only QoS data frames for admission control
    - ceph: fix duplicate increment of opened_inodes metric
    - ceph: initialize pathlen variable in reconnect_caps_cb
    - [armhf] socfpga: dts: fix qspi node compatible
    - [arm64] dts: imx8mq: remove interconnect property from lcdif
    - clk: Don't parent clks until the parent is fully registered
    - [armhf] soc: imx: Register SoC device only on i.MX boards
    - iwlwifi: mvm: don't crash on invalid rate w/o STA
    - virtio/vsock: fix the transport to work with VMADDR_CID_ANY
    - Revert "drm/fb-helper: improve DRM fbdev emulation device names"
    - sch_cake: do not call cake_destroy() from cake_init()
    - inet_diag: fix kernel-infoleak for UDP sockets
    - netdevsim: don't overwrite read only ethtool parms
    - [arm64] net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
    - [arm64] net: hns3: fix race condition in debugfs
    - net/sched: sch_ets: don't remove idle classes from the round-robin list
    - [arm64,armhf] net: dsa: mv88e6xxx: Unforce speed & duplex in
      mac_link_down()
    - mptcp: never allow the PM to close a listener subflow
    - drm/ast: potential dereference of null pointer
    - [x86] drm/i915/display: Fix an unsigned subtraction which can never be
      negative.
    - mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock
    - cfg80211: Acquire wiphy mutex on regulatory work
    - mac80211: fix lookup when adding AddBA extension element
    - net: stmmac: fix tc flower deletion for VLAN priority Rx steering
    - flow_offload: return EOPNOTSUPP for the unsupported mpls action type
    - rds: memory leak in __rds_conn_create() (CVE-2021-45480)
    - ice: Use div64_u64 instead of div_u64 in adjfine
    - ice: Don't put stale timestamps in the skb
    - drm/amd/display: Set exit_optimized_pwr_state for DCN31
    - drm/amd/pm: fix a potential gpu_metrics_table memory leak
    - mptcp: remove tcp ulp setsockopt support
    - mptcp: clear 'kern' flag from fallback sockets
    - mptcp: fix deadlock in __mptcp_push_pending()
    - [arm64,armhf] soc/tegra: fuse: Fix bitwise vs. logical OR warning
    - igb: Fix removal of unicast MAC filters of VFs
    - igbvf: fix double free in `igbvf_probe`
    - igc: Fix typo in i225 LTR functions
    - ixgbe: Document how to enable NBASE-T support
    - ixgbe: set X550 MDIO speed before talking to PHY
    - netdevsim: Zero-initialize memory for new map's value in function
      nsim_bpf_map_alloc (CVE-2021-4135)
    - net/packet: rx_owner_map depends on pg_vec
    - [arm64,armhf] net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup
    - sfc_ef100: potential dereference of null pointer
    - [arm64,armhf] dsa: mv88e6xxx: fix debug print for SPEED_UNFORCED
    - net: Fix double 0x prefix print in SKB dump
    - net/smc: Prevent smc_release() from long blocking
    - sit: do not call ipip6_dev_free() from sit_init_net()
    - afs: Fix mmap
    - [arm64] kexec: Fix missing error code 'ret' warning in
      load_other_segments()
    - bpf: Fix extable fixup offset.
    - USB: gadget: bRequestType is a bitfield, not a enum
    - Revert "usb: early: convert to readl_poll_timeout_atomic()"
    - [x86] KVM: x86: Drop guest CPUID check for host initiated writes to
      MSR_IA32_PERF_CAPABILITIES
    - tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous
    - USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04)
    - [arm*] usb: dwc2: fix STM ID/VBUS detection startup delay in
      dwc2_driver_probe
    - PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
    - PCI/MSI: Mask MSI-X vectors only on success
    - [x86] usb: xhci: Extend support for runtime power management for AMD's
      Yellow carp.
    - [x86,arm64] usb: typec: tcpm: fix tcpm unregister port but leave a
      pending timer
    - usb: gadget: u_ether: fix race in setting MAC address in setup phase
    - USB: serial: cp210x: fix CP2105 GPIO registration
    - USB: serial: option: add Telit FN990 compositions
    - selinux: fix sleeping function called from invalid context
    - btrfs: fix memory leak in __add_inode_ref()
    - btrfs: fix double free of anon_dev after failure to create subvolume
    - btrfs: check WRITE_ERR when trying to read an extent buffer
    - btrfs: fix missing blkdev_put() call in btrfs_scan_one_device()
    - zonefs: add MODULE_ALIAS_FS
    - iocost: Fix divide-by-zero on donation from low hweight cgroup
    - [x86] serial: 8250_fintek: Fix garbled text for console
    - timekeeping: Really make sure wall_to_monotonic isn't positive
    - cifs: sanitize multiple delimiters in prepath
    - locking/rtmutex: Fix incorrect condition in rtmutex_spin_on_owner()
    - [riscv64] dts: unleashed: Add gpio card detect to mmc-spi-slot
    - [riscv64] dts: unmatched: Add gpio card detect to mmc-spi-slot
    - perf inject: Fix segfault due to close without open
    - perf inject: Fix segfault due to perf_data__fd() without open
    - libata: if T_LENGTH is zero, dma direction should be DMA_NONE
    - [powerpc*] powerpc/module_64: Fix livepatching for RO modules
    - drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE
    - drm/amdgpu: don't override default ECO_BITs setting
    - drm/amd/pm: fix reading SMU FW version from amdgpu_firmware_info on YC
    - [armhf] dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
    - mptcp: add missing documented NL params
    - [amd64] bpf, x64: Factor out emission of REX byte in more cases
    - bpf: Fix extable address check.
    - USB: core: Make do_proc_control() and do_proc_bulk() killable
    - media: mxl111sf: change mutex_init() location
    - ovl: fix warning in ovl_create_real()
    - scsi: scsi_debug: Don't call kcalloc() if size arg is zero
    - scsi: scsi_debug: Fix type in min_t to avoid stack OOB
    - scsi: scsi_debug: Sanity check block descriptor length in
      resp_mode_select()
    - io-wq: remove spurious bit clear on task_work addition
    - io-wq: check for wq exit after adding new worker task_work
    - rcu: Mark accesses to rcu_state.n_force_qs
    - io-wq: drop wqe lock before creating new worker
    - [armhf] bus: ti-sysc: Fix variable set but not used warning for
      reinit_modules
    - xen/blkfront: harden blkfront against event channel storms
      (CVE-2021-28711)
    - xen/netfront: harden netfront against event channel storms
      (CVE-2021-28712)
    - xen/console: harden hvc_xen against event channel storms
      (CVE-2021-28713)
    - xen/netback: fix rx queue stall detection (CVE-2021-28714)
    - xen/netback: don't queue unlimited number of packages (CVE-2021-28715)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.12
    - net: usb: lan78xx: add Allied Telesis AT29M2-AF
    - ext4: prevent partial update of the extent blocks
    - ext4: check for out-of-order index extents in ext4_valid_extent_entries()
    - ext4: check for inconsistent extents between index and leaf block
    - HID: holtek: fix mouse probing
    - HID: potential dereference of null pointer
    - NFSD: Fix READDIR buffer overflow
    - PM: sleep: Fix error handling in dpm_prepare()
    - [arm64] dts: allwinner: orangepi-zero-plus: fix PHY mode
    - [arm64,armhf] bus: sunxi-rsb: Fix shutdown
    - spi: change clk_disable_unprepare to clk_unprepare
    - ucounts: Fix rlimit max values check
    - [arm64,armhf] ASoC: meson: aiu: fifo: Add missing
      dma_coerce_mask_and_coherent()
    - [arm64] RDMA/hns: Fix RNR retransmission issue for HIP08
    - IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
    - [arm64] RDMA/hns: Replace kfree() with kvfree()
    - netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
    - netfilter: fix regression in looped (broad|multi)cast's MAC handling
    - [armhf] dts: imx6qdl-wandboard: Fix Ethernet support
    - ice: Use xdp_buf instead of rx_buf for xsk zero-copy
    - ice: xsk: return xsk buffers back to pool when cleaning the ring
    - qlcnic: potential dereference null pointer of rx_queue->page_ring
    - tcp: move inet->rx_dst_ifindex to sk->sk_rx_dst_ifindex
    - ipv6: move inet6_sk(sk)->rx_dst_cookie to sk->sk_rx_dst_cookie
    - inet: fully convert sk->sk_rx_dst to RCU rules
    - net: accept UFOv6 packages in virtio_net_hdr_to_skb
    - net: skip virtio_net_hdr_set_proto if protocol already set
    - igb: fix deadlock caused by taking RTNL in RPM resume path
    - ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
    - bonding: fix ad_actor_system option setting to default
    - [amd64] fjes: Check for error irq
    - [armhf] drivers: net: smc911x: Check for error irq
    - asix: fix uninit-value in asix_mdio_read()
    - asix: fix wrong return value in asix_check_host_enable()
    - io_uring: zero iocb->ki_pos for stream file types
    - veth: ensure skb entering GRO are not cloned.
    - net: stmmac: ptp: fix potentially overflowing expression
    - net: bridge: Use array_size() helper in copy_to_user()
    - net: bridge: fix ioctl old_deviceless bridge argument
    - r8152: fix the force speed doesn't work for RTL8156
    - Input: elantech - fix stack out of bound access in
      elantech_change_report_id()
    - [arm*] pinctrl: bcm2835: Change init order for gpio hogs
    - hwmon: (lm90) Fix usage of CONFIG2 register in detect function
    - hwmon: (lm90) Prevent integer overflow/underflow in hysteresis
      calculations
    - hwmon: (lm90) Introduce flag indicating extended temperature support
    - hwmon: (lm90) Add basic support for TI TMP461
    - hwmon: (lm90) Drop critical attribute support for MAX6654
    - kernel/crash_core: suppress unknown crashkernel parameter warning
    - [x86] Revert "x86/boot: Pull up cmdline preparation and early param
      parsing"
    - [x86] boot: Move EFI range reservation after cmdline parsing
    - ALSA: jack: Check the return value of kstrdup()
    - ALSA: drivers: opl3: Fix incorrect use of vp->state
    - ALSA: rawmidi - fix the uninitalized user_pversion
    - [x86] ALSA: hda/hdmi: Disable silent stream on GLK
    - [x86] ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6
    - [x86] ALSA: hda/realtek: Add new alc285-hp-amp-init model
    - [x86] ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
    - [x86] ALSA: hda/realtek: Fix quirk for Clevo NJ51CU
    - [arm64,armhf] ASoC: meson: aiu: Move AIU_I2S_MISC hold setting to
      aiu-fifo-i2s
    - [arm64,armhf] ASoC: tegra: Add DAPM switches for headphones and mic jack
    - [armhf] ASoC: tegra: Restore headphones jack name on Nyan Big
    - Input: atmel_mxt_ts - fix double free in mxt_read_info_block
    - ipmi: bail out if init_srcu_struct fails
    - ipmi: ssif: initialize ssif_info->client early
    - ipmi: fix initialization when workqueue allocation fails
    - [hppa] Correct completer in lws start
    - [hppa] Fix mask used to select futex spinlock
    - tee: handle lookup of shm with reference count 0
    - [x86] pkey: Fix undefined behaviour with PKRU_WD_BIT
    - [amd64] platform/x86: amd-pmc: only use callbacks for suspend
    - [x86] platform/x86: intel_pmc_core: fix memleak on registration failure
    - [x86] KVM: x86: Always set kvm_run->if_flag
    - [x86] KVM: x86/mmu: Don't advance iterator after restart due to yielding
    - [x86] KVM: nVMX: Synthesize TRIPLE_FAULT for L2 if emulation is required
    - [x86] KVM: VMX: Always clear vmx->fail on emulation_required
    - [x86] KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this
      vCPU
    - [armhf] pinctrl: stm32: consider the GPIO offset to expose all the GPIO
      lines
    - [arm64,armhf] mmc: sdhci-tegra: Fix switch to HS400ES mode
    - [armhf] mmc: meson-mx-sdhc: Set MANUAL_STOP for multi-block SDIO commands
    - mmc: core: Disable card detect during shutdown
    - [armhf] mmc: mmci: stm32: clear DLYB_CR after sending tuning command
    - mac80211: fix locking in ieee80211_start_ap error path
    - mm: mempolicy: fix THP allocations escaping mempolicy restrictions
    - mm, hwpoison: fix condition in free hugetlb page path
    - mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
    - [arm64] tee: optee: Fix incorrect page free bug
    - f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
      (CVE-2021-45469)
    - netfs: fix parameter of cleanup()
    - [x86] KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state
    - [arm64] dts: lx2160a: fix scl-gpios property name
    - [arm64] Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312
    - Input: goodix - add id->model mapping for the "9111" model
    - [x86] ASoC: SOF: Intel: pci-tgl: add new ADL-P variant
    - [x86] ASoC: SOF: Intel: pci-tgl: add ADL-N support
    - ASoC: rt5682: fix the wrong jack type detected
    - hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681
    - hwmon: (lm90) Do not report 'busy' status bit as alarm
    - r8152: sync ocp base
    - ax25: NPD bug when detaching AX25 device
    - hamradio: defer ax25 kfree after unregister_netdev
    - hamradio: improve the incomplete fix to avoid NPD
    - tun: avoid double free in tun_free_netdev
    - phonet/pep: refuse to enable an unbound pipe
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.13
    - Input: i8042 - add deferred probe support
    - Input: i8042 - enable deferred probe quirk for ASUS UM325UA
    - tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok().
    - tomoyo: use hwight16() in tomoyo_domain_quota_is_ok()
    - net/sched: Extend qdisc control block with tc control block
    - [x86] platform/x86: apple-gmux: use resource_size() with res
    - memblock: fix memblock_phys_alloc() section mismatch error
    - ALSA: hda: intel-sdw-acpi: harden detection of controller
    - ALSA: hda: intel-sdw-acpi: go through HDAS ACPI at max depth of 2
    - efi: Move efifb_setup_from_dmi() prototype from arch headers
    - selinux: initialize proto variable in selinux_ip_postroute_compat()
    - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
    - net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources
    - net/mlx5: Fix error print in case of IRQ request failed
    - net/mlx5: Fix SF health recovery flow
    - net/mlx5: Fix tc max supported prio for nic mode
    - net/mlx5e: Wrap the tx reporter dump callback to extract the sq
    - net/mlx5e: Fix interoperability between XSK and ICOSQ recovery flow
    - net/mlx5e: Fix ICOSQ recovery flow for XSK
    - net/mlx5e: Use tc sample stubs instead of ifdefs in source file
    - net/mlx5e: Delete forward rule for ct or sample action
    - udp: using datalen to cap ipv6 udp max gso segments
    - sctp: use call_rcu to free endpoint
    - net/smc: fix using of uninitialized completions
    - net: usb: pegasus: Do not drop long Ethernet frames
    - net/smc: don't send CDC/LLC message if link not ready
    - net/smc: fix kernel panic caused by race of smc_sock
    - igc: Do not enable crosstimestamping for i225-V models
    - igc: Fix TX timestamp support for non-MSI-X platforms
    - drm/amd/display: Send s0i2_rdy in stream_count == 0 optimization
    - drm/amd/display: Set optimize_pwr_state for DCN31
    - net/mlx5e: Fix wrong features assignment in case of error
    - net: bridge: mcast: add and enforce query interval minimum
    - net: bridge: mcast: add and enforce startup query interval minimum
    - net: bridge: mcast: fix br_multicast_ctx_vlan_global_disabled helper
    - [armhf] net/ncsi: check for error return from call to nla_put_u32
    - i2c: validate user data in compat ioctl
    - nfc: uapi: use kernel size_t to fix user-space builds
    - uapi: fix linux/nfc.h userspace compilation errors
    - drm/nouveau: wait for the exclusive fence after the shared ones v2
      (Closes: #1000681)
    - drm/amdgpu: When the VCN(1.0) block is suspended, powergating is
      explicitly enabled
    - drm/amdgpu: add support for IP discovery gc_info table v2
    - drm/amd/display: Changed pipe split policy to allow for multi-display pipe
      split
    - xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set.
    - usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
    - [arm*] binder: fix async_free_space accounting for empty parcels
    - [x86] scsi: vmw_pvscsi: Set residual data length conditionally
    - Input: appletouch - initialize work before device registration
    - Input: spaceball - fix parsing of movement data packets
    - net: fix use-after-free in tw_timer_handler
    - fs/mount_setattr: always cleanup mount_kattr
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.14
    - fscache_cookie_enabled: check cookie is valid before accessing it
    - tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
    - tracing: Tag trace_percpu_buffer as a percpu pointer
    - Revert "RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow"
    - ieee802154: atusb: fix uninit value in atusb_set_extended_addr
    - i40e: Fix to not show opcode msg on unsuccessful VF MAC change
    - iavf: Fix limit of total number of queues to active queues of VF
    - RDMA/core: Don't infoleak GRH fields
    - Revert "net: usb: r8152: Add MAC passthrough support for more Lenovo
      Docks"
    - netrom: fix copying in user data in nr_setsockopt
    - RDMA/uverbs: Check for null return of kmalloc_array
    - mac80211: initialize variable have_higher_than_11mbit
    - mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
    - sfc: The RX page_ring is optional
    - i40e: fix use-after-free in i40e_sync_filters_subtask()
    - i40e: Fix for displaying message regarding NVM version
    - i40e: Fix incorrect netdev's real number of RX/TX queues
    - ipv4: Check attribute length for RTA_GATEWAY in multipath route
    - ipv4: Check attribute length for RTA_FLOW in multipath route
    - ipv6: Check attribute length for RTA_GATEWAY in multipath route
    - ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
    - lwtunnel: Validate RTA_ENCAP_TYPE attribute length
    - sctp: hold endpoint before calling cb in sctp_transport_lookup_process
    - batman-adv: mcast: don't send link-local multicast to mcast routers
    - sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
    - net: ena: Fix undefined state when tx request id is out of bounds
    - net: ena: Fix wrong rx request id by resetting device
    - net: ena: Fix error handling when calculating max IO queues number
    - md/raid1: fix missing bitmap update w/o WriteMostly devices
    - [x86] KVM: x86: Check for rmaps allocation
    - cgroup: Use open-time credentials for process migraton perm checks
      (CVE-2021-4197)
    - cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
      (CVE-2021-4197)
    - cgroup: Use open-time cgroup namespace for process migration perm checks
      (CVE-2021-4197)
    - Revert "i2c: core: support bus regulator controlling in adapter"
    - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
      (CVE-2021-4155)
    - power: supply: core: Break capacity loop
    - rndis_host: support Hytera digital radios
    - net ticp:fix a kernel-infoleak in __tipc_sendmsg()
    - phonet: refcount leak in pep_sock_accep (CVE-2021-45095)
    - fbdev: fbmem: add a helper to determine if an aperture is used by a fw fb
    - drm/amdgpu: disable runpm if we are the primary adapter
    - [arm64] power: bq25890: Enable continuous conversion for ADC at charging
    - ipv6: Continue processing multipath route even if gateway attribute is
      invalid
    - ipv6: Do cleanup if attribute validation fails in multipath route
    - drm/amdgpu: fix dropped backing store handling in
      amdgpu_dma_buf_move_notify
    - scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
    - ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
    - net: udp: fix alignment problem in udp4_seq_show()
    - atlantic: Fix buff_ring OOB in aq_ring_rx_clean
    - drm/amd/pm: skip setting gfx cgpg in the s0ix suspend-resume
    - drm/amdgpu: always reset the asic in suspend (v2)
    - drm/amdgpu: put SMU into proper state on runpm suspending for BOCO capable
      platform
    - mISDN: change function names to avoid conflicts
    - drm/amd/display: fix B0 TMDS deepcolor no dislay issue
    - drm/amd/display: Added power down for DCN10
    - ipv6: raw: check passed optlen before reading
    - Revert "drm/amdgpu: stop scheduler when calling hw_fini (v2)"
    - drm/amd/pm: keep the BACO feature enabled for suspend
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.15
    - workqueue: Fix unbind_workers() VS wq_worker_running() race
    - staging: r8188eu: switch the led off during deinit
    - bpf: Fix out of bounds access from invalid *_or_null type verification
      (CVE-2022-23222)
    - Bluetooth: btusb: Add protocol for MediaTek bluetooth devices(MT7922)
    - Bluetooth: btusb: Add the new support ID for Realtek RTL8852A
    - Bluetooth: btusb: Add support for IMC Networks Mediatek Chip(MT7921)
    - Bbluetooth: btusb: Add another Bluetooth part for Realtek 8852AE
    - Bluetooth: btusb: fix memory leak in btusb_mtk_submit_wmt_recv_urb()
    - Bluetooth: btusb: enable Mediatek to support AOSP extension
    - Bluetooth: btusb: Add one more Bluetooth part for the Realtek RTL8852AE
    - Bluetooth: btusb: Add the new support IDs for WCN6855
    - fget: clarify and improve __fget_files() implementation
    - Bluetooth: btusb: Add one more Bluetooth part for WCN6855
    - Bluetooth: btusb: Add two more Bluetooth parts for WCN6855
    - Bluetooth: btusb: Add support for Foxconn MT7922A
    - Bluetooth: btintel: Fix broken LED quirk for legacy ROM devices
    - Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0
    - Bluetooth: bfusb: fix division by zero in send path
    - [armhf] dts: exynos: Fix BCM4330 Bluetooth reset polarity in I9100
    - USB: core: Fix bug in resuming hub's handling of wakeup requests
    - USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
    - ath11k: Fix buffer overflow when scanning with extraie
    - mmc: sdhci-pci: Add PCI ID for Intel ADL
    - Bluetooth: add quirk disabling LE Read Transmit Power
    - Bluetooth: btbcm: disable read tx power for some Macs with the T2 Security
      chip
    - Bluetooth: btbcm: disable read tx power for MacBook Air 8,1 and 8,2
    - veth: Do not record rx queue hint in veth_xmit
    - [x86] mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
    - can: gs_usb: fix use of uninitialized variable, detach device on reception
      of invalid USB data
    - can: isotp: convert struct tpcon::{idx,len} to unsigned int
    - can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved}
    - random: fix data race on crng_node_pool
    - random: fix data race on crng init time
    - random: fix crash on multiple early calls to add_bootloader_randomness()
    - [x86] platform/x86/intel: hid: add quirk to support Surface Go 3
    - media: Revert "media: uvcvideo: Set unique vdev name based in type"
    - [x86] drm/i915: Avoid bitwise vs logical OR warning in
      snb_wm_latency_quirk()

  [ Ben Hutchings ]
  * Bump ABI to 3
  * wait: Export new function __wake_up_pollfree() needed by binder
  * [rt] Add new signing key for Clark Williams
  * [rt] Update to 5.15.10-rt24
  * debian/control: Add version to libopencsd-dev build-dependency
  * [armhf] media: Set MEDIA_SUPPORT=m so drivers are no longer built-in

  [ Andrew Balmos ]
  * net/can: Enable CONFIG_CAN_MCP251X as module

  [ Salvatore Bonaccorso ]
  * drivers/infiniband/hw/irdma: Enable INFINIBAND_IRDMA as module
    (Closes: #1003082)
  * vfs: fs_context: fix up param length parsing in legacy_parse_param
    (CVE-2022-0185)

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 18 Jan 2022 22:31:03 +0100

linux (5.15.5-2) unstable; urgency=medium

  * atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait
    (CVE-2021-43975)
  * fget: check that the fd still exists after getting a ref to it
    (CVE-2021-4083)
  * USB: gadget: detect too-big endpoint 0 requests (CVE-2021-39685)
  * USB: gadget: zero allocate endpoint 0 buffers (CVE-2021-39685)
  * [x86] Revert "drm/i915: Implement Wa_1508744258" (Closes: #1001128)
  * nfsd: fix use-after-free due to delegation race (Closes: #988044)
  * bpf: Fix kernel address leakage in atomic fetch
  * bpf: Fix signed bounds propagation after mov32
  * bpf: Make 32->64 bounds propagation slightly more robust
  * bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 19 Dec 2021 00:20:10 +0100

linux (5.15.5-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.4
    - string: uninline memcpy_and_pad
    - [x86] KVM: Fix steal time asm constraints
    - btrfs: introduce btrfs_is_data_reloc_root
    - btrfs: zoned: add a dedicated data relocation block group
    - btrfs: zoned: only allow one process to add pages to a relocation inode
    - btrfs: zoned: use regular writes for relocation
    - btrfs: check for relocation inodes on zoned btrfs in should_nocow
    - btrfs: zoned: allow preallocation for relocation inodes
    - block: Add a helper to validate the block size
    - loop: Use blk_validate_block_size() to validate block size
    - Bluetooth: btusb: Add support for TP-Link UB500 Adapter
    - PCI/MSI: Deal with devices lying about their MSI mask capability
    - PCI: Add MSI masking quirk for Nvidia ION AHCI
    - perf/core: Avoid put_page() when GUP fails
    - thermal: Fix NULL pointer dereferences in of_thermal_ functions
    - Revert "ACPI: scan: Release PM resources blocked by unused objects"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.5
    - [arm64] zynqmp: Do not duplicate flash partition label property
    - [arm64] zynqmp: Fix serial compatible string
    - [arm64,armhf] clk: sunxi-ng: Unregister clocks/resets when unbinding
    - scsi: pm80xx: Fix memory leak during rmmod
    - scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
    - [armhf] bus: ti-sysc: Add quirk handling for reinit on context lost
    - [armhf] bus: ti-sysc: Use context lost quirk for otg
    - [armhf] usb: musb: tusb6010: check return value after calling
      platform_get_resource()
    - [x86] usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
    - staging: rtl8723bs: remove possible deadlock when disconnect (v2)
    - staging: rtl8723bs: remove a second possible deadlock
    - staging: rtl8723bs: remove a third possible deadlock
    - [arm64] dts: ls1012a: Add serial alias for ls1012a-rdb
    - RDMA/rxe: Separate HW and SW l/rkeys
    - [x86] ASoC: SOF: Intel: hda-dai: fix potential locking issue
    - scsi: core: Fix scsi_mode_sense() buffer length handling
    - ALSA: usb-audio: disable implicit feedback sync for Behringer UFX1204 and
      UFX1604
    - [armhf] clk: imx: imx6ul: Move csi_sel mux to correct base register
    - ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ
    - [x86] ASoC: rt5651: Use IRQF_NO_AUTOEN when requesting the IRQ
    - [x86] ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect
    - scsi: advansys: Fix kernel pointer leak
    - scsi: smartpqi: Add controller handshake during kdump
    - [arm64] dts: imx8mm-kontron: Fix reset delays for ethernet PHY
    - ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336
      codec
    - [x86] ASoC: Intel: soc-acpi: add missing quirk for TGL SDCA single amp
    - [x86] ASoC: Intel: sof_sdw: add missing quirk for Dell SKU 0A45
    - firmware_loader: fix pre-allocated buf built-in firmware use
    - HID: multitouch: disable sticky fingers for UPERFECT Y
    - ALSA: usb-audio: Add support for the Pioneer DJM 750MK2 Mixer/Soundcard
    - ASoC: rt5682: fix a little pop while playback
    - [amd64] iommu/vt-d: Do not falsely log intel_iommu is unsupported kernel
      option
    - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
    - scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
    - scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
    - scsi: target: Fix ordered tag handling
    - scsi: target: Fix alua_tg_pt_gps_count tracking
    - iio: imu: st_lsm6dsx: Avoid potential array overflow in
      st_lsm6dsx_set_odr()
    - RDMA/core: Use kvzalloc when allocating the struct ib_port
    - scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
    - scsi: lpfc: Fix link down processing to address NULL pointer dereference
    - scsi: lpfc: Allow fabric node recovery if recovery is in progress before
      devloss
    - [i386] ALSA: gus: fix null pointer dereference on pointer block
    - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
    - f2fs: fix up f2fs_lookup tracepoints
    - f2fs: fix to use WHINT_MODE
    - f2fs: fix wrong condition to trigger background checkpoint correctly
    - f2fs: compress: disallow disabling compress on non-empty compressed file
    - f2fs: fix incorrect return value in f2fs_sanity_check_ckpt()
    - [armhf] clk/ast2600: Fix soc revision for AHB
    - [arm64] clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk
    - [arm64] KVM: arm64: Fix host stage-2 finalization
    - sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
    - sched/fair: Prevent dead task groups from regaining cfs_rq's
    - [x86] perf/x86/vlbr: Add c->flags to vlbr event constraints
    - blkcg: Remove extra blkcg_bio_issue_init
    - drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame
    - bpf: Fix inner map state pruning regression.
    - tcp: Fix uninitialized access in skb frags array for Rx 0cp.
    - tracing: Add length protection to histogram string copies
    - nl80211: fix radio statistics in survey dump
    - mac80211: fix monitor_sdata RCU/locking assertions
    - net: bnx2x: fix variable dereferenced before check
    - bnxt_en: reject indirect blk offload when hw-tc-offload is off
    - tipc: only accept encrypted MSG_CRYPTO msgs
    - sock: fix /proc/net/sockstat underflow in sk_clone_lock()
    - net/smc: Make sure the link_id is unique
    - NFSD: Fix exposure in nfsd4_decode_bitmap()
    - iavf: Fix return of set the new channel count
    - iavf: check for null in iavf_fix_features
    - iavf: free q_vectors before queues in iavf_disable_vf
    - iavf: don't clear a lock we don't hold
    - iavf: Fix failure to exit out from last all-multicast mode
    - iavf: prevent accidental free of filter structure
    - iavf: validate pointers
    - iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
    - iavf: Fix for setting queues to 0
    - iavf: Restore VLAN filters after link down
    - bpf: Fix toctou on read-only map's constant scalar tracking
      (CVE-2021-4001)
    - [x86] platform/x86: hp_accel: Fix an error handling path in
      'lis3lv02d_probe()'
    - udp: Validate checksum in udp_read_sock()
    - btrfs: make 1-bit bit-fields of scrub_page unsigned int
    - RDMA/core: Set send and receive CQ before forwarding to the driver
    - net/mlx5e: Wait for concurrent flow deletion during neigh/fib events
    - net/mlx5: E-Switch, Fix resetting of encap mode when entering switchdev
    - net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()
    - net/mlx5: Update error handler for UCTX and UMEM
    - net/mlx5: E-Switch, rebuild lag only when needed
    - net/mlx5e: CT, Fix multiple allocations and memleak of mod acts
    - net/mlx5: Lag, update tracker when state change event received
    - net/mlx5: E-Switch, return error if encap isn't supported
    - scsi: ufs: core: Improve SCSI abort handling
    - scsi: core: sysfs: Fix hang when device state is set via sysfs
    - scsi: ufs: core: Fix task management completion timeout race
    - scsi: ufs: core: Fix another task management completion race
    - [arm*] net: mvmdio: fix compilation warning
    - net: sched: act_mirred: drop dst for the direction from egress to ingress
    - [arm64] net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
    - net: virtio_net_hdr_to_skb: count transport header in UFO
    - i40e: Fix correct max_pkt_size on VF RX queue
    - i40e: Fix NULL ptr dereference on VSI filter sync
    - i40e: Fix changing previously set num_queue_pairs for PFs
    - i40e: Fix ping is lost after configuring ADq on VF
    - RDMA/mlx4: Do not fail the registration on port stats
    - i40e: Fix warning message and call stack during rmmod i40e driver
    - i40e: Fix creation of first queue by omitting it if is not power of two
    - i40e: Fix display error code in dmesg
    - e100: fix device suspend/resume (Closes: #995927)
    - [powerpc*] KVM: PPC: Book3S HV: Use GLOBAL_TOC for
      kvmppc_h_set_dabr/xdabr()
    - [powerpc*] pseries: rename numa_dist_table to form2_distances
    - [powerpc*] pseries: Fix numa FORM2 parsing fallback code
    - [x86] perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake
      Server
    - [x86] perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
    - [x86] perf/x86/intel/uncore: Fix IIO event constraints for Snowridge
    - [s390x] kexec: fix return code handling
    - blk-cgroup: fix missing put device in error path from blkg_conf_pref()
    - tun: fix bonding active backup with arp monitoring
    - tipc: check for null after calling kmemdup
    - ipc: WARN if trying to remove ipc object which is absent
    - shm: extend forced shm destroy to support objects from several IPC nses
    - hugetlb, userfaultfd: fix reservation restore on userfaultfd error
    - [x86] boot: Pull up cmdline preparation and early param parsing
    - [x86] hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup
      fails
    - [x86] KVM: x86: Assume a 64-bit hypercall for guests with protected state
    - [x86] KVM: x86: Fix uninitialized eoi_exit_bitmap usage in
      vcpu_load_eoi_exitmap()
    - [x86] KVM: x86/mmu: include EFER.LMA in extended mmu role
    - [x86] KVM: x86/xen: Fix get_attr of KVM_XEN_ATTR_TYPE_SHARED_INFO
    - [powerpc*] xive: Change IRQ domain to a tree domain
    - [x86] Revert "drm/i915/tgl/dsi: Gate the ddi clocks after pll mapping"
    - ata: libata: improve ata_read_log_page() error message
    - ata: libata: add missing ata_identify_page_supported() calls
    - scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id()
    - [s390x] setup: avoid reserving memory above identity mapping
    - [s390x] boot: simplify and fix kernel memory layout setup
    - [s390x] vdso: filter out -mstack-guard and -mstack-size
    - [s390x] dump: fix copying to user-space of swapped kdump oldmem
    - block: Check ADMIN before NICE for IOPRIO_CLASS_RT
    - fbdev: Prevent probing generic drivers if a FB is already registered
    - [x86] KVM: SEV: Disallow COPY_ENC_CONTEXT_FROM if target has created vCPUs
    - [x86] KVM: nVMX: don't use vcpu->arch.efer when checking host state on
      nested state load
    - drm/cma-helper: Release non-coherent memory with dma_free_noncoherent()
    - printk: restore flushing of NMI buffers on remote CPUs after NMI
      backtraces
    - udf: Fix crash after seekdir
    - spi: fix use-after-free of the add_lock mutex
    - [armhf] net: stmmac: socfpga: add runtime suspend/resume callback for
      stratix10 platform
    - [x86] Drivers: hv: balloon: Use VMBUS_RING_SIZE() wrapper for dm_ring_size
    - btrfs: fix memory ordering between normal and ordered work functions
    - fs: handle circular mappings correctly
    - net: stmmac: Fix signed/unsigned wreckage
    - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
    - mac80211: drop check for DONT_REORDER in __ieee80211_select_queue
    - drm/amd/display: Update swizzle mode enums
    - drm/amd/display: Limit max DSC target bpp for specific monitors
    - [x86] drm/i915/guc: Fix outstanding G2H accounting
    - [x86] drm/i915/guc: Don't enable scheduling on a banned context, guc_id
      invalid, not registered
    - [x86] drm/i915/guc: Workaround reset G2H is received after schedule done
      G2H
    - [x86] drm/i915/guc: Don't drop ce->guc_active.lock when unwinding context
    - [x86] drm/i915/guc: Unwind context requests in reverse order
    - drm/udl: fix control-message timeout
    - drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
    - drm/nouveau: Add a dedicated mutex for the clients list (CVE-2020-27820)
    - drm/nouveau: use drm_dev_unplug() during device removal (CVE-2020-27820)
    - drm/nouveau: clean up all clients on device removal (CVE-2020-27820)
    - [x86] drm/i915/dp: Ensure sink rate values are always valid
    - [x86] drm/i915/dp: Ensure max link params are always valid
    - [x86] drm/i915: Fix type1 DVI DP dual mode adapter heuristic for modern
      platforms
    - drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga
      and dvi connectors
    - drm/amd/pm: avoid duplicate powergate/ungate setting
    - signal: Implement force_fatal_sig
    - exit/syscall_user_dispatch: Send ordinary signals on failure
    - [powerpc*] signal/powerpc: On swapcontext failure force SIGSEGV
    - [s390x] signal/s390: Use force_sigsegv in default_trap_handler
    - [x86] signal/x86: In emulate_vsyscall force a signal instead of calling
      do_exit
    - signal: Replace force_sigsegv(SIGSEGV) with force_fatal_sig(SIGSEGV)
    - signal: Don't always set SA_IMMUTABLE for forced signals
    - signal: Replace force_fatal_sig with force_exit_sig when in doubt
    - hugetlbfs: flush TLBs correctly after huge_pmd_unshare (CVE-2021-4002)
    - RDMA/netlink: Add __maybe_unused to static inline in C file
    - bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs
    - selinux: fix NULL-pointer dereference when hashtab allocation fails
    - ASoC: DAPM: Cover regression by kctl change notification fix
    - ice: Fix VF true promiscuous mode
    - ice: Delete always true check of PF pointer
    - fs: export an inode_update_time helper
    - btrfs: update device path inode time instead of bd_inode
    - net: add and use skb_unclone_keeptruesize() helper
    - [x86] ALSA: hda: hdac_ext_stream: fix potential locking issues
    - ALSA: hda: hdac_stream: fix potential locking issue in
      snd_hdac_stream_assign()

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.15.3-rt21
  * Drop "arm64: dts: rockchip: disable USB type-c DisplayPort"
  * [rt] Refresh "printk: move console printing to kthreads"
  * [rt] Refresh "printk: remove deferred printing"
  * Bump ABI to 2
  * fuse: release pipe buf after last use (Closes: #1000504)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 26 Nov 2021 06:33:39 +0100

linux (5.15.3-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.3
    - Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
      (CVE-2021-3640)

  [ Vincent Blut ]
  * [arm64] sound/soc/meson: Enable SND_MESON_AXG_SOUND_CARD as module
    (Closes: #999638)
  * [arm64,armhf] sound/soc/meson: Enable SND_MESON_GX_SOUND_CARD as module
  * drivers/bluetooth: Enable BT_HCIBTUSB_MTK (Closes: #999748)

  [ Salvatore Bonaccorso ]
  * mac80211: fix radiotap header generation
  * [rt] Update to 5.15.2-rt20
  * [rt] Refresh "printk: introduce kernel sync mode"
  * [rt] Refresh "printk: move console printing to kthreads"
  * [rt] Drop "rcutorture: Avoid problematic critical section nesting on
    PREEMPT_RT"
  * [rt] Drop "lockdep: Let lock_is_held_type() detect recursive read as read"
  * [rt] Refresh "x86/softirq: Disable softirq stacks on PREEMPT_RT"
  * [rt] Refresh "POWERPC: Allow to enable RT"
  * Set ABI to 1

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 18 Nov 2021 22:32:07 +0100

linux (5.15.2-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.2

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.15-rt17 and reenable (Closes: #995466)
  * perf srcline: Use long-running addr2line per DSO (Closes: #911815)
  * Refresh "Export symbols needed by Android drivers"
  * [rt] Update to 5.15.2-rt19
  * Input: elantench - fix misreporting trackpoint coordinates (Closes: #989285)
  * kernel/time: Enable NO_HZ_FULL (Closes: #804857)
  * io-wq: serialize hash clear with wakeup (Closes: #996951)

  [ Vincent Blut ]
  * [x86] drivers/ptp: Enable PTP_1588_CLOCK_VMW as module
  * drivers/ptp: Enable PTP_1588_CLOCK_DTE, PTP_1588_CLOCK_IDT82P33,
    PTP_1588_CLOCK_IDTCM, PTP_1588_CLOCK_OCP as modules
  * drivers/ptp, net: Enable DP83640_PHY, PTP_1588_CLOCK_INES,
    NET_PTP_CLASSIFY, NETWORK_PHY_TIMESTAMPING

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 14 Nov 2021 14:27:40 +0100

linux (5.15.1-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.1

  [ Salvatore Bonaccorso ]
  * [arm*] drop cc-option fallbacks for architecture selection
  * net/tls: Enable TLS as module (Closes: #919807)

  [ Diederik de Haas ]
  * [x86] drivers/hwmon: Enable SENSORS_CORSAIR_PSU as module
  * [arm64] drivers/hwmon: Enable SENSORS_GPIO_FAN as module

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 07 Nov 2021 11:22:47 +0100

linux (5.15-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Diederik de Haas ]
  * [arm*] drivers/led/trigger: Make LEDS_TRIGGER_HEARTBEAT builtin
    (Closes: #992184)
  * [arm64] sound/soc/codecs: Enable SND_SOC_SPDIF as module
  * [armel/rpi] Enable RPi's clock framework and CPU Freq scaling
  * [armel/rpi] Change default governor to 'ondemand' for RPi 0/0w/1
    (Closes: #991921)
  * [arm64] sound/soc/rockchip: Enable SND_SOC_ROCKCHIP_PDM as module
  * [armel] Make explicit that -rpi kernel variant is for RPi 0/0w/1, not the
    others

  [ Nathan Schulte ]
  * [arm64] drivers/staging/media/hantro: Enable VIDEO_HANTRO as module
  * [arm64] drivers/staging/media/rkvdec: Enable VIDEO_ROCKCHIP_VDEC as module
    (Closes: #993902)

  [ Vincent Blut ]
  * [arm] arch/arm/crypto: Enable CRYPTO_BLAKE2S_ARM, CRYPTO_SHA256_ARM and
    CRYPTO_SHA512_ARM as modules
  * [armhf] arch/arm/crypto: Enable most NEON based implementation of
    cryptographic algorithms as modules
  * [arm] Move CRYPTO_NHPOLY1305_NEON in armhf config file
  * [arm64] drivers/gpu/drm/vmwgfx: Enable DRM_VMWGFX as module
    (Closes: #995276)
  * [armhf] sound/soc/sunxi: Enable SND_SUN4I_I2S as module (Closes: #971892)
  * [armhf] drivers/gpu/drm/bridge/synopsys: Enable DRM_DW_HDMI_I2S_AUDIO as
    module
  * drivers/usb/serial: Enable USB_SERIAL_XR as module (Closes: #996962)
  * drivers/bus/mhi: Enable MHI_BUS, MHI_BUS_PCI_GENERIC as modules
    (Closes: #995407)
  * drivers/net: Enable MHI_NET as module
  * drivers/net/wwan: Enable WWAN, MHI_WWAN_CTRL as modules

  [ YunQiang Su ]
  * [mipsel,mips64el/loongson-3] linux-image: Recommend pmon-update

  [ Salvatore Bonaccorso ]
  * Compile with gcc-11 on all architectures
  * [arm64] drivers/net: Enable VMXNET3 as module

  [ Uwe Kleine-König ]
  * [arm64] Enable various symbols for the librem5 devkit and iMX8MN Variscite
    Symphony (Patches by Guido Günther and Ariel D'Alessandro)
  * [armhf,arm64] Cherrypick fix for snvs_pwrkey to prevent a machine hang.

  [ Heiko Thiery ]
  * [arm64] drivers/mtd/spi-nor: enable MTD_SPI_NOR as module
  * [arm64] drivers/net/can/spi: enable CAN_MCP251X as module
  * [arm64] drivers/net/phy: enable MICROSEMI_PHY as module
  * [arm64] drivers/net/usb: enable USB_NET_SMSC95XX as module

  [ Ryutaroh Matsumoto ]
  * [arm64] Enable TOUCHSCREEN_RASPBERRYPI_FW and
    REGULATOR_RASPBERRYPI_TOUCHSCREEN_ATTINY (Closes: #977575)

  [ Ariel D'Alessandro ]
  * [arm64] drivers/regulator: Enable REGULATOR_BD718XX as module

  [ Lubomir Rintel ]
  * [armhf] Add support for Marvell MMP3
  * [armhf] Enable SND_MMP_SOC_SSPA, COMMON_CLK_MMP2_AUDIO, PHY_MMP3_USB,
    MFD_ENE_KB3930 and LEDS_ARIEL as modules.

  [ Sean McAvoy ]
  * [armel] marvell: Enable CONFIG_SENSORS_LM63 as a module.

  [ Dan Stefura ]
  * [arm64] enable i6300esb watchdog kernel module

  [ Thore Sommer ]
  * drivers/md: Enable DM_VERITY_FEC

  [ Aurelien Jarno ]
  * [riscv64] Enable NUMA (Closes: #993453)

 -- Bastian Blank <bastian.blank@credativ.de>  Thu, 04 Nov 2021 09:01:01 +0100

linux (5.14.16-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.13
    - ext4: check and update i_disksize properly
    - ext4: correct the error path of ext4_write_inline_data_end()
    - [x86] ASoC: Intel: sof_sdw: tag SoundWire BEs as non-atomic
    - ALSA: oxfw: fix transmission method for Loud models based on OXFW971
    - ALSA: usb-audio: Unify mixer resume and reset_resume procedure
    - HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS
    - netfilter: ip6_tables: zero-initialize fragment offset
    - HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs
    - [x86] ASoC: SOF: loader: release_firmware() on load failure to avoid
      batching
    - netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic
    - netfilter: nf_nat_masquerade: defer conntrack walk to work queue
    - mac80211: Drop frames from invalid MAC address in ad-hoc mode
    - [m68k] Handle arrivals of multiple signals correctly
    - net: prevent user from passing illegal stab size
    - mac80211: check return value of rhashtable_init
    - [x86] vboxfs: fix broken legacy mount signature checking
    - drm/amdgpu: fix gart.bo pin_count leak
    - scsi: ses: Fix unsigned comparison with less than zero
    - scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
    - scsi: qla2xxx: Fix excessive messages during device logout
    - perf/core: fix userpage->time_enabled of inactive events
    - sched: Always inline is_percpu_thread()
    - io_uring: kill fasync
    - [armhf] hwmon: (pmbus/ibm-cffps) max_power_out swap changes
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.14
    - ALSA: usb-audio: Add quirk for VF0770
    - ALSA: pcm: Workaround for a wrong offset in SYNC_PTR compat ioctl
    - ALSA: usb-audio: Fix a missing error check in scarlett gen2 mixer
    - ALSA: seq: Fix a potential UAF by wrong private_free call order
    - ALSA: hda/realtek: Enable 4-speaker output for Dell Precision 5560 laptop
    - ALSA: hda - Enable headphone mic on Dell Latitude laptops with ALC3254
    - ALSA: hda/realtek: Complete partial device name to avoid ambiguity
    - ALSA: hda/realtek: Add quirk for Clevo X170KM-G
    - ALSA: hda/realtek - ALC236 headset MIC recording issue
    - ALSA: hda/realtek: Add quirk for TongFang PHxTxX1
    - ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo
      13s Gen2
    - ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW
    - [amd64] platform/x86: amd-pmc: Add alternative acpi id for PMC controller
    - dm: fix mempool NULL pointer race when completing IO
    - [x86] ACPI: PM: Include alternate AMDI0005 id in special behaviour
    - dm rq: don't queue request to blk-mq during DM suspend
    - [s390x] fix strrchr() implementation
    - drm/fbdev: Clamp fbdev surface size if too large
    - [arm64] hugetlb: fix CMA gigantic page order for non-4K PAGE_SIZE
    - drm/nouveau/fifo: Reinstate the correct engine bit programming
    - [arm64] drm/msm: Do not run snapshot on non-DPU devices
    - [arm64] drm/msm: Avoid potential overflow in timeout_to_jiffies()
    - btrfs: unlock newly allocated extent buffer after error
    - btrfs: deal with errors when replaying dir entry during log replay
    - btrfs: deal with errors when adding inode reference during log replay
    - btrfs: check for error when looking up inode during dir entry replay
    - btrfs: update refs for any root except tree log roots
    - btrfs: fix abort logic in btrfs_replace_file_extents
    - [x86] resctrl: Free the ctrlval arrays when domain_setup_mon_state() fails
    - [x86] mei: me: add Ice Lake-N device id.
    - [x86] mei: hbm: drop hbm responses on early shutdown
    - xhci: guard accesses to ep_state in xhci_endpoint_reset()
    - xhci: add quirk for host controllers that don't update endpoint DCS
    - xhci: Fix command ring pointer corruption while aborting a command
    - xhci: Enable trust tx length quirk for Fresco FL11 USB controller
    - cb710: avoid NULL pointer subtraction
    - [arm64,x86] efi/cper: use stack buffer for error record decoding
    - efi: Change down_interruptible() in virt_efi_reset_system() to
      down_trylock()
    - [armhf] usb: musb: dsps: Fix the probe error path
    - Input: xpad - add support for another USB ID of Nacon GC-100
    - USB: serial: qcserial: add EM9191 QDL support
    - USB: serial: option: add Quectel EC200S-CN module support
    - USB: serial: option: add Telit LE910Cx composition 0x1204
    - USB: serial: option: add prod. id for Quectel EG91
    - virtio: write back F_VERSION_1 before validate
    - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
    - virtio-blk: remove unneeded "likely" statements
    - Revert "virtio-blk: Add validation for block size in config space"
    - [x86] fpu: Mask out the invalid MXCSR bits properly
    - [x86] Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
      automatically
    - [powerpc*] xive: Discard disabled interrupts in get_irqchip_state()
    - [armhf] drivers: bus: simple-pm-bus: Add support for probing simple bus
      only devices
    - driver core: Reject pointless SYNC_STATE_ONLY device links
    - iio: adc: ad7192: Add IRQ flag
    - iio: adc: ad7780: Fix IRQ flag
    - iio: adc: ad7793: Fix IRQ flag
    - iio: adis16480: fix devices that do not support sleep mode
    - iio: adc128s052: Fix the error handling path of 'adc128_probe()'
    - iio: adc: max1027: Fix wrong shift with 12-bit devices
    - iio: adis16475: fix deadlock on frequency set
    - iio: light: opt3001: Fixed timeout error when 0 lux
    - iio: adc: max1027: Fix the number of max1X31 channels
    - eeprom: at25: Add SPI ID table
    - iio: dac: ti-dac5571: fix an error code in probe()
    - [arm64] tee: optee: Fix missing devices unregister during optee_remove
    - [armel,armhf] dts: bcm2711-rpi-4-b: Fix usb's unit address
    - [armel,armhf] dts: bcm2711-rpi-4-b: fix sd_io_1v8_reg regulator states
    - [armel,armhf] dts: bcm2711-rpi-4-b: Fix pcie0's unit address formatting
    - nvme-pci: Fix abort command id
    - sctp: account stream padding length for reconf chunk
    - [arm64,armhf] gpio: pca953x: Improve bias setting
    - net/smc: improved fix wait on already cleared link
    - net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path
    - net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp
    - net/mlx5e: Switchdev representors are not vlan challenged
    - net: stmmac: fix get_hw_feature() on old hardware
    - net: phy: Do not shutdown PHYs in READY state
    - [arm64,armhf] net: dsa: mv88e6xxx: don't use PHY_DETECT on internal PHY's
    - [arm64,armhf] net: dsa: fix spurious error message when unoffloaded port
      leaves bridge
    - ethernet: s2io: fix setting mac address during resume
    - nfc: fix error handling of nfc_proto_register()
    - NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
    - NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
    - pata_legacy: fix a couple uninitialized variable bugs
    - ata: ahci_platform: fix null-ptr-deref in
      ahci_platform_enable_regulators()
    - spi: spidev: Add SPI ID table
    - drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read
    - [arm64] drm/msm: Fix null pointer dereference on pointer edp
    - [arm64] drm/msm/mdp5: fix cursor-related warnings
    - [arm64] drm/msm/submit: fix overflow check on 64-bit architectures
    - [arm64] drm/msm/a6xx: Track current ctx by seqno
    - [arm64] drm/msm/a4xx: fix error handling in a4xx_gpu_init()
    - [arm64] drm/msm/a3xx: fix error handling in a3xx_gpu_init()
    - [arm64] drm/msm/dsi: dsi_phy_14nm: Take ready-bit into account in
      poll_for_ready
    - [arm64] drm/msm/dsi: Fix an error code in msm_dsi_modeset_init()
    - [arm64] drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
    - [arm64] acpi/arm64: fix next_platform_timer() section mismatch error
    - [x86] platform/x86: intel_scu_ipc: Fix busy loop expiry time
    - mqprio: Correct stats in mqprio_dump_class_stats().
    - mptcp: fix possible stall on recvmsg()
    - qed: Fix missing error code in qed_slowpath_start()
    - ice: fix locking for Tx timestamp tracking flush
    - nfp: flow_offload: move flow_indr_dev_register from app init to app start
    - [arm64] net: mscc: ocelot: make use of all 63 PTP timestamp identifiers
    - [arm64] net: mscc: ocelot: avoid overflowing the PTP timestamp FIFO
    - [arm64] net: mscc: ocelot: warn when a PTP IRQ is raised for an unknown
      skb
    - [arm64] net: mscc: ocelot: deny TX timestamping of non-PTP packets
    - [arm64] net: mscc: ocelot: cross-check the sequence id from the timestamp
      FIFO with the skb PTP header
    - [arm64] net: dsa: felix: break at first CPU port during init and teardown
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
    - [armhf] dts: vexpress-v2p-ca9: Fix the SMB unit-address
    - block: decode QUEUE_FLAG_HCTX_ACTIVE in debugfs output
    - [x86] xen/x86: prevent PVH type from getting clobbered
    - r8152: avoid to resubmit rx immediately
    - drm/amdgpu: init iommu after amdkfd device init
    - NFSD: Keep existing listeners on portlist error
    - [powerpc*] powerpc/lib: Add helper to check if offset is within
      conditional branch range
    - [powerpc*] powerpc/bpf: Validate branch ranges
    - [powerpc*] powerpc/security: Add a helper to query stf_barrier type
    - [powerpc*] powerpc/bpf: Emit stf barrier instruction sequences for
      BPF_NOSPEC
    - [arm64] KVM: arm64: Fix host stage-2 PGD refcount
    - [arm64] KVM: arm64: Release mmap_lock when using VM_SHARED with MTE
    - netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage
      value
    - netfilter: nf_tables: skip netdev events generated on netns removal
    - ice: Fix failure to re-add LAN/RDMA Tx queues
    - ice: Avoid crash from unnecessary IDA free
    - ice: fix getting UDP tunnel entry
    - ice: Print the api_patch as part of the fw.mgmt.api
    - netfilter: ip6t_rt: fix rt0_hdr parsing in rt_mt6
    - netfilter: ipvs: make global sysctl readonly in non-init netns
    - sctp: fix transport encap_port update in sctp_vtag_verify
    - tcp: md5: Fix overlap between vrf and non-vrf keys
    - ipv6: When forwarding count rx stats on the orig netdev
    - hamradio: baycom_epp: fix build for UML
    - net/sched: act_ct: Fix byte count on fragmented packets
    - [arm64,armhf] net: dsa: Fix an error handling path in
      'dsa_switch_parse_ports_of()'
    - [powerpc*] smp: do not decrement idle task preempt count in CPU offline
    - [arm64] net: hns3: Add configuration of TM QCN error event
    - [arm64] net: hns3: reset DWRR of unused tc to zero
    - [arm64] net: hns3: add limit ets dwrr bandwidth cannot be 0
    - [arm64] net: hns3: schedule the polling again when allocation fails
    - [arm64] net: hns3: fix vf reset workqueue cannot exit
    - [arm64] net: hns3: disable sriov before unload hclge layer
    - net: stmmac: Fix E2E delay mechanism
    - ptp: Fix possible memory leak in ptp_clock_register()
    - e1000e: Fix packet loss on Tiger Lake and later
    - igc: Update I226_K device ID
    - ice: Add missing E810 device ids
    - net/mlx5e: IPsec: Fix a misuse of the software parser's fields
    - net/mlx5e: IPsec: Fix work queue entry ethernet segment checksum flags
    - [arm64] net: enetc: fix ethtool counter name for PM0_TERR
    - [arm64] net: enetc: make sure all traffic classes can send large frames
    - can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state
      notification
    - can: peak_pci: peak_pci_remove(): fix UAF
    - can: isotp: isotp_sendmsg(): fix return error on FC timeout on TX path
    - can: isotp: isotp_sendmsg(): add result check for
      wait_event_interruptible()
    - can: isotp: isotp_sendmsg(): fix TX buffer concurrent access in
      isotp_sendmsg()
    - can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer
    - can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
    - can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with
      error length
    - can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes
    - ceph: skip existing superblocks that are blocklisted or shut down when
      mounting
    - ceph: fix handling of "meta" errors
    - tracing: Have all levels of checks prevent recursion
    - ocfs2: fix data corruption after conversion from inline format
    - ocfs2: mount fails with buffer overflow in strlen
    - userfaultfd: fix a race between writeprotect and exit_mmap()
    - mm/mempolicy: do not allow illegal MPOL_F_NUMA_BALANCING | MPOL_LOCAL in
      mbind()
    - vfs: check fd has read access in kernel_read_file_from_fd()
    - ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
    - ALSA: hda/realtek: Add quirk for Clevo PC50HS
    - ASoC: DAPM: Fix missing kctl change notifications
    - [x86] ASoC: nau8824: Fix headphone vs headset, button-press detection no
      longer working
    - blk-cgroup: blk_cgroup_bio_start() should use irq-safe operations on
      blkg->iostat_cpu
    - audit: fix possible null-pointer dereference in audit_filter_rules
    - ucounts: Move get_ucounts from cred_alloc_blank to
      key_change_session_keyring
    - ucounts: Pair inc_rlimit_ucounts with dec_rlimit_ucoutns in commit_creds
    - ucounts: Proper error handling in set_cred_ucounts
    - ucounts: Fix signal ucount refcounting
    - [powerpc*] KVM: PPC: Book3S HV: Fix stack handling in
      idle_kvm_start_guest()
    - [powerpc*] KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it
      went to guest (CVE-2021-43056)
    - [powerpc*] idle: Don't corrupt back chain when going idle
    - mm, slub: fix mismatch between reconstructed freelist depth and cnt
    - mm, slub: fix potential memoryleak in kmem_cache_open()
    - mm, slub: fix potential use-after-free in slab_debugfs_fops
    - mm, slub: fix incorrect memcg slab count for bulk free
    - [x86] KVM: nVMX: promptly process interrupts delivered while in guest mode
    - [x86] KVM: SEV: Flush cache on non-coherent systems before
      RECEIVE_UPDATE_DATA
    - [x86] KVM: SEV-ES: rename guest_ins_data to sev_pio_data
    - [x86] KVM: SEV-ES: clean up kvm_sev_es_ins/outs
    - [x86] KVM: SEV-ES: keep INS functions together
    - [x86] KVM: SEV-ES: fix length of string I/O
    - [x86] KVM: SEV-ES: go over the sev_pio_data buffer in multiple passes if
      needed
    - [x86] KVM: SEV-ES: reduce ghcb_sa_len to 32 bits
    - [x86] KVM: x86: leave vcpu->arch.pio.count alone in emulator_pio_in_out
    - [x86] KVM: x86: check for interrupts before deciding whether to exit the
      fast path
    - [x86] KVM: x86: split the two parts of emulator_pio_in
    - [x86] KVM: x86: remove unnecessary arguments from complete_emulator_pio_in
    - nfc: nci: fix the UAF of rf_conn_info object (CVE-2021-3760)
    - isdn: cpai: check ctr->cnr to avoid array index out of bound
      (CVE-2021-3896)
    - [sh4] net: bridge: mcast: use multicast_membership_interval for IGMPv3
    - [x86] KVM: SEV-ES: Set guest_state_protected after VMSA update
    - [arm64] net: hns3: fix the max tx size according to user manual
    - [x86] KVM: MMU: Reset mmu->pkru_mask to avoid stale data
    - [arm64] drm/msm/a6xx: Serialize GMU communication
    - ALSA: hda: intel: Allow repeatedly probing on codec configuration errors
    - btrfs: deal with errors when checking if a dir entry exists during log
      replay
    - net: stmmac: add support for dwmac 3.40a
    - [x86] platform/x86: intel_scu_ipc: Increase virtual timeout to 10s
    - [x86] platform/x86: intel_scu_ipc: Update timeout value in comment
    - ALSA: hda: avoid write to STATESTS if controller is in reset
    - spi: Fix deadlock when adding SPI controllers on SPI buses
    - spi-mux: Fix false-positive lockdep splats
    - [x86] perf/x86/msr: Add Sapphire Rapids CPU support
    - scsi: iscsi: Fix set_param() handling
    - [x86] scsi: storvsc: Fix validation for unsolicited incoming packets
    - scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()
    - mm/thp: decrease nr_thps in file's mapping on THP split
    - sched/scs: Reset the shadow stack when idle_task_exit
    - [arm64] net: hns3: fix for miscalculation of rx unused desc
    - net/mlx5: Lag, move lag destruction to a workqueue
    - net/mlx5: Lag, change multipath and bonding to be mutually exclusive
    - autofs: fix wait name hash calculation in autofs_wait()
    - scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
    - [s390x] pci: cleanup resources only if necessary
    - [s390x] pci: fix zpci_zdev_put() on reserve
    - net: mdiobus: Fix memory leak in __mdiobus_register
    - e1000e: Separate TGP board type from SPT
    - [armhf] pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.16
    - [armel,armhf] 9134/1: remove duplicate memcpy() definition
    - [armel,armhf] 9139/1: kprobes: fix arch_init_kprobes() prototype
    - [armel,armhf] 9148/1: handle CONFIG_CPU_ENDIAN_BE32 in
      arch/arm/kernel/head.S
    - usbnet: sanity check for maxpacket
    - usbnet: fix error return code in usbnet_probe()
    - pinctrl: amd: disable and mask interrupts on probe
    - ata: sata_mv: Fix the error handling of mv_chip_id()
    - tipc: fix size validations for the MSG_CRYPTO type (CVE-2021-43267)
    - nfc: port100: fix using -ERRNO as command type mask
    - Revert "net: mdiobus: Fix memory leak in __mdiobus_register"
    - mmc: vub300: fix control-message timeouts
    - mmc: cqhci: clear HALT state after CQE enable
    - [armhf] mmc: dw_mmc: exynos: fix the finding clock sample value
    - mmc: sdhci: Map more voltage level to SDHCI_POWER_330
    - mmc: sdhci-pci: Read card detect from ACPI for Intel Merrifield
    - [arm64,armhf] mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset
      standard tuning circuit
    - block: Fix partition check for host-aware zoned block devices
    - ocfs2: fix race between searching chunks and release journal_head from
      buffer_head
    - nvme-tcp: fix H2CData PDU send accounting (again)
    - cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
    - cfg80211: fix management registrations locking
    - net: lan78xx: fix division by zero in send path
    - mm: hwpoison: remove the unnecessary THP check
    - mm: filemap: check if THP has hwpoisoned subpage for PMD page fault
    - mm, thp: bail out early in collapse_file for writeback page
    - mm: khugepaged: skip huge page collapse for special files
    - [arm64] dts: imx8mm-kontron: Fix polarity of reg_rst_eth2
    - [arm64] dts: imx8mm-kontron: Fix CAN SPI clock frequency
    - [arm64] dts: imx8mm-kontron: Fix connection type for VSC8531 RGMII PHY
    - [arm64] dts: imx8mm-kontron: Set lower limit of VDD_SNVS to 800 mV
    - [arm64] dts: imx8mm-kontron: Make sure SOC and DRAM supply voltages are
      correct
    - mac80211: mesh: fix HE operation element length check
    - drm/ttm: fix memleak in ttm_transfered_destroy
    - [x86] drm/i915: Convert unconditional clflush to drm_clflush_virt_range()
    - [x86] drm/i915: Catch yet another unconditioal clflush
    - [x86] drm/i915/dp: Skip the HW readout of DPCD on disabled encoders
    - drm/amdgpu: Fix even more out of bound writes from debugfs
    - drm/amdgpu: fix out of bounds write (CVE-2021-42327)
    - drm/amdgpu: support B0&B1 external revision id for yellow carp
    - drm/amd/display: Limit display scaling to up to true 4k for DCN 3.1
    - drm/amd/display: Fix prefetch bandwidth calculation for DCN3.1
    - drm/amd/display: increase Z9 latency to workaround underflow in Z9
    - drm/amd/display: Increase watermark latencies for DCN3.1
    - drm/amd/display: Moved dccg init to after bios golden init
    - drm/amd/display: Fallback to clocks which meet requested voltage on DCN31
    - drm/amd/display: Fix deadlock when falling back to v2 from v3
    - Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout"
    - cgroup: Fix memory leak caused by missing cgroup_bpf_offline
    - [riscv64] riscv, bpf: Fix potential NULL dereference
    - tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function
    - bpf: Fix potential race in tail call compatibility check
    - bpf: Fix error usage of map_fd and fdget() in generic_map_update_batch()
    - [amd64] IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt
      fields
    - [amd64] IB/hfi1: Fix abba locking issue with sc_disable()
    - nvmet-tcp: fix data digest pointer calculation
    - nvme-tcp: fix data digest pointer calculation
    - nvme-tcp: fix possible req->offset corruption
    - ice: Respond to a NETDEV_UNREGISTER event for LAG
    - RDMA/mlx5: Set user priority for DCT
    - ice: check whether PTP is initialized in ice_ptp_release()
    - [arm64] dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node
    - regmap: Fix possible double-free in regcache_rbtree_exit()
    - net: batman-adv: fix error handling
    - net-sysfs: initialize uid and gid before calling net_ns_get_ownership
    - cfg80211: correct bridge/4addr mode check
    - net: Prevent infinite while loop in skb_tx_hash()
    - RDMA/mlx5: Initialize the ODP xarray when creating an ODP MR
    - RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string
    - net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume
      fails
    - net: ethernet: microchip: lan743x: Fix dma allocation failure by using
      dma_set_mask_and_coherent
    - [arm64] net: hns3: fix pause config problem after autoneg disabled
    - [arm64] net: hns3: fix data endian problem of some functions of debugfs
    - net: ethernet: microchip: lan743x: Fix skb allocation failure
    - phy: phy_ethtool_ksettings_get: Lock the phy for consistency
    - phy: phy_ethtool_ksettings_set: Move after phy_start_aneg
    - phy: phy_start_aneg: Add an unlocked version
    - phy: phy_ethtool_ksettings_set: Lock the PHY while changing settings
    - sctp: use init_tag from inithdr for ABORT chunk (CVE-2021-3772)
    - sctp: fix the processing for INIT chunk (CVE-2021-3772)
    - sctp: fix the processing for INIT_ACK chunk (CVE-2021-3772)
    - sctp: fix the processing for COOKIE_ECHO chunk (CVE-2021-3772)
    - sctp: add vtag check in sctp_sf_violation (CVE-2021-3772)
    - sctp: add vtag check in sctp_sf_do_8_5_1_E_sa (CVE-2021-3772)
    - sctp: add vtag check in sctp_sf_ootb (CVE-2021-3772)
    - bpf: Use kvmalloc for map values in syscall
    - [arm64] watchdog: sbsa: only use 32-bit accessors
    - bpf: Move BPF_MAP_TYPE for INODE_STORAGE and TASK_STORAGE outside of
      CONFIG_NET
    - [arm64] net: hns3: add more string spaces for dumping packets number of
      queue info in debugfs
    - [arm64] net: hns3: expand buffer len for some debugfs command
    - virtio-ring: fix DMA metadata flags
    - [s390x] KVM: s390: clear kicked_mask before sleeping again
    - [s390x] KVM: s390: preserve deliverable_mask in __airqs_kick_single_vcpu
    - [powerpc*] scsi: ibmvfc: Fix up duplicate response detection
    - [riscv64] fix misalgned trap vector base address
    - [x86] KVM: switch pvclock_gtod_sync_lock to a raw spinlock
    - [x86] KVM: SEV-ES: fix another issue with string I/O VMGEXITs
    - [x86] KVM: Take srcu lock in post_kvm_run_save()

  [ Salvatore Bonaccorso ]
  * Revert "[amd64] Unset AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT"
  * Bump ABI to 4
  * media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers
    (Closes: #994050)
  * [x86] media: ite-cir: IR receiver stop working after receive overflow
    (Closes: #996672)
  * scsi: core: Put LLD module refcnt after SCSI device is released
  * sfc: Fix reading non-legacy supported link modes
  * vrf: Revert "Reset skb conntrack connection..."
  * media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
    (CVE-2021-42739)

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 03 Nov 2021 15:35:31 +0100

linux (5.14.12-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
    - [arm64,armhf] media: cedrus: Fix SUNXI tile size calculation
    - [arm64] ASoC: fsl_sai: register platform component before registering cpu
      dai
    - [armhf] ASoC: fsl_spdif: register platform component before registering
      cpu dai
    - [x86] ASoC: SOF: Fix DSP oops stack dump output contents
    - [arm64] pinctrl: qcom: spmi-gpio: correct parent irqspec translation
    - net/mlx4_en: Resolve bad operstate value
    - [s390x] qeth: Fix deadlock in remove_discipline
    - [s390x] qeth: fix deadlock during failing recovery
    - [x86] crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
      (CVE-2021-3744, CVE-2021-3764)
    - [m68k] Update ->thread.esp0 before calling syscall_trace() in
      ret_from_signal
    - [amd64] HID: amd_sfh: Fix potential NULL pointer dereference
    - tty: Fix out-of-bound vmalloc access in imageblit
    - cpufreq: schedutil: Use kobject release() method to free sugov_tunables
    - scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS
    - drm/amdgpu: adjust fence driver enable sequence
    - drm/amdgpu: avoid over-handle of fence driver fini in s3 test (v2)
    - drm/amdgpu: stop scheduler when calling hw_fini (v2)
    - cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
    - scsi: ufs: ufs-pci: Fix Intel LKF link stability
    - ALSA: rawmidi: introduce SNDRV_RAWMIDI_IOCTL_USER_PVERSION
    - ALSA: firewire-motu: fix truncated bytes in message tracepoints
    - ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i
      15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.
    - [amd64,arm64] ACPI: NFIT: Use fallback node id when numa info in NFIT
      table is incorrect
    - fs-verity: fix signed integer overflow with i_size near S64_MAX
    - hwmon: (tmp421) handle I2C errors
    - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary
      structure field
    - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary
      structure field
    - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary
      structure field
    - [arm64,armhf] gpio: pca953x: do not ignore i2c errors
    - scsi: ufs: Fix illegal offset in UPIU event trace
    - mac80211: fix use-after-free in CCMP/GCMP RX
    - [x86] platform/x86/intel: hid: Add DMI switches allow list
    - [x86] kvmclock: Move this_cpu_pvti into kvmclock.h
    - [x86] ptp: Fix ptp_kvm_getcrosststamp issue for x86 ptp_kvm
    - [x86] KVM: x86: Fix stack-out-of-bounds memory access from
      ioapic_write_indirect()
    - [x86] KVM: x86: nSVM: don't copy virt_ext from vmcb12
    - [x86] KVM: x86: Clear KVM's cached guest CR3 at RESET/INIT
    - [x86] KVM: x86: Swap order of CPUID entry "index" vs. "significant flag"
      checks
    - [x86] KVM: nVMX: Filter out all unsupported controls when eVMCS was
      activated
    - [x86] KVM: SEV: Update svm_vm_copy_asid_from for SEV-ES
    - [x86] KVM: SEV: Pin guest memory for write for RECEIVE_UPDATE_DATA
    - [x86] KVM: SEV: Acquire vcpu mutex when updating VMSA
    - [x86] KVM: SEV: Allow some commands for mirror VM
    - [x86] KVM: SVM: fix missing sev_decommission in sev_receive_start
    - [x86] KVM: nVMX: Fix nested bus lock VM exit
    - [x86] KVM: VMX: Fix a TSX_CTRL_CPUID_CLEAR field mask issue
    - RDMA/cma: Do not change route.addr.src_addr.ss_family
    - RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
    - nbd: use shifts rather than multiplies
    - drm/amd/display: initialize backlight_ramping_override to false
    - drm/amd/display: Pass PCI deviceid into DC
    - drm/amd/display: Fix Display Flicker on embedded panels
    - drm/amdgpu: force exit gfxoff on sdma resume for rmb s0ix
    - drm/amdgpu: check tiling flags when creating FB on GFX8-
    - drm/amdgpu: correct initial cp_hqd_quantum for gfx9
    - [amd64] drm/i915/gvt: fix the usage of ww lock in gvt scheduler.
    - ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
    - bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog
    - IB/cma: Do not send IGMP leaves for sendonly Multicast groups
    - RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure
    - netfilter: nf_tables: unlink table before deleting it
    - netfilter: log: work around missing softdep backend module
    - Revert "mac80211: do not use low data rates for data frames with no ack
      flag"
    - mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
    - mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
    - mac80211: mesh: fix potentially unaligned access
    - mac80211-hwsim: fix late beacon hrtimer handling
    - driver core: fw_devlink: Add support for
      FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD
    - net: mdiobus: Set FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD for mdiobus parents
    - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
    - mptcp: don't return sockets in foreign netns
    - mptcp: allow changing the 'backup' bit when no sockets are open
    - [arm64] RDMA/hns: Work around broken constant propagation in gcc 8
    - hwmon: (tmp421) report /PVLD condition as fault
    - hwmon: (tmp421) fix rounding for negative values
    - [arm64] net: enetc: fix the incorrect clearing of IF_MODE bits
    - net: ipv4: Fix rtnexthop len when RTA_FLOW is present
    - smsc95xx: fix stalled rx after link change
    - [x86] drm/i915/request: fix early tracepoints
    - [x86] drm/i915: Remove warning from the rps worker
    - [arm64,armhf] dsa: mv88e6xxx: 6161: Use chip wide MAX MTU
    - [arm64,armhf] dsa: mv88e6xxx: Fix MTU definition
    - [arm64,armhf] dsa: mv88e6xxx: Include tagger overhead when setting MTU for
      DSA and CPU ports
    - e100: fix length calculation in e100_get_regs_len
    - e100: fix buffer overrun in e100_get_regs
    - [amd64] RDMA/hfi1: Fix kernel pointer leak
    - [arm64] RDMA/hns: Fix the size setting error when copying CQE in
      clean_cq()
    - [arm64] RDMA/hns: Add the check of the CQE size of the user space
    - bpf: Exempt CAP_BPF from checks against bpf_jit_limit
    - [amd64] bpf, x86: Fix bpf mapping of atomic fetch implementation
    - Revert "block, bfq: honor already-setup queue merges"
    - scsi: csiostor: Add module softdep on cxgb4
    - ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
    - [arm64] net: hns3: do not allow call hns3_nic_net_open repeatedly
    - [arm64] net: hns3: remove tc enable checking
    - [arm64] net: hns3: don't rollback when destroy mqprio fail
    - [arm64] net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and
      HCLGE_FLAG_DCB_ENABLE
    - [arm64] net: hns3: fix show wrong state when add existing uc mac address
    - [arm64] net: hns3: reconstruct function hns3_self_test
    - [arm64] net: hns3: fix always enable rx vlan filter problem after selftest
    - [arm64] net: hns3: disable firmware compatible features when uninstall PF
    - [arm64,armhf] net: phy: bcm7xxx: Fixed indirect MMD operations
    - net: sched: flower: protect fl_walk() with rcu
    - net: stmmac: fix EEE init issue when paired with EEE capable PHYs
    - af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
    - [x86] perf/x86/intel: Update event constraints for ICX
    - sched/fair: Add ancestors of unthrottled undecayed cfs_rq
    - sched/fair: Null terminate buffer when updating tunable_scaling
    - [armhf] hwmon: (occ) Fix P10 VRM temp sensors
    - [x86] kvm: fix objtool relocation warning
    - nvme: add command id quirk for apple controllers
    - elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings
    - driver core: fw_devlink: Improve handling of cyclic dependencies
    - debugfs: debugfs_create_file_size(): use IS_ERR to check for error
    - ext4: fix loff_t overflow in ext4_max_bitmap_size()
    - ext4: fix reserved space counter leakage
    - ext4: add error checking to ext4_ext_replay_set_iblocks()
    - ext4: fix potential infinite loop in ext4_dx_readdir()
    - ext4: flush s_error_work before journal destroy in ext4_fill_super
    - HID: u2fzero: ignore incomplete packets without data (Closes: #994535)
    - net: udp: annotate data race around udp_sk(sk)->corkflag
    - usb: hso: remove the bailout parameter
    - HID: betop: fix slab-out-of-bounds Write in betop_probe
    - netfilter: ipset: Fix oversized kvmalloc() calls
    - mm: don't allow oversized kvmalloc() calls
    - HID: usbhid: free raw_report buffers in usbhid_stop
    - [x86] crypto: aesni - xts_crypt() return if walk.nbytes is 0
    - [x86] KVM: x86: Handle SRCU initialization failure during page track init
    - netfilter: conntrack: serialize hash resizes and cleanups
    - netfilter: nf_tables: Fix oversized kvmalloc() calls
    - [amd64] HID: amd_sfh: Fix potential NULL pointer dereference - take 2
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.11
    - [arm64,armhf] spi: rockchip: handle zero length transfers without timing
      out
    - afs: Add missing vnode validation checks
    - nfsd: back channel stuck in SEQ4_STATUS_CB_PATH_DOWN
    - btrfs: replace BUG_ON() in btrfs_csum_one_bio() with proper error handling
    - btrfs: fix mount failure due to past and transient device flush error
    - net: mdio: introduce a shutdown method to mdio device drivers
    - xen-netback: correct success/error reporting for the SKB-with-fraglist
      case
    - [sparc64] fix pci_iounmap() when CONFIG_PCI is not set
    - scsi: sd: Free scsi_disk device via put_device()
    - [arm*] usb: dwc2: check return value after calling platform_get_resource()
    - Xen/gntdev: don't ignore kernel unmapping error
    - swiotlb-xen: ensure to issue well-formed XENMEM_exchange requests
    - nvme-fc: update hardware queues before using them
    - nvme-fc: avoid race between time out and tear down
    - [arm64] thermal/drivers/tsens: Fix wrong check for tzd in irq handlers
    - scsi: ses: Retry failed Send/Receive Diagnostic commands
    - [arm64,armhf] irqchip/gic: Work around broken Renesas integration
    - smb3: correct smb3 ACL security descriptor
    - [x86] insn, tools/x86: Fix undefined behavior due to potential unaligned
      accesses
    - io_uring: allow conditional reschedule for intensive iterators
    - block: don't call rq_qos_ops->done_bio if the bio isn't tracked
    - KVM: do not shrink halt_poll_ns below grow_start
    - [x86] KVM: x86: reset pdptrs_from_userspace when exiting smm
    - [x86] kvm: x86: Add AMD PMU MSRs to msrs_to_save_all[]
    - [x86] KVM: x86: nSVM: restore int_vector in svm_clear_vintr
    - [x86] perf/x86: Reset destroy callback on event init failure
    - libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD.
    - Revert "brcmfmac: use ISO3166 country code and 0 rev as fallback"
    - [armhf] Revert "ARM: imx6q: drop of_platform_default_populate() from
      init_machine"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.12
    - usb: cdc-wdm: Fix check for WWAN
    - [arm64,armhf] usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle
    - usb: gadget: f_uac2: fixed EP-IN wMaxPacketSize
    - USB: cdc-acm: fix racy tty buffer accesses
    - USB: cdc-acm: fix break reporting
    - usb: typec: tcpm: handle SRC_STARTUP state if cc changes
    - [x86] usb: typec: tipd: Remove dependency on "connector" child fwnode
    - drm/amdgpu: During s0ix don't wait to signal GFXOFF
    - drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows
    - drm/nouveau/ga102-: support ttm buffer moves via copy engine
    - [x86] drm/i915: Fix runtime pm handling in i915_gem_shrink
    - [x86] drm/i915: Extend the async flip VT-d w/a to skl/bxt
    - xen/privcmd: fix error handling in mmap-resource processing
    - [arm64] mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk
    - ovl: fix missing negative dentry check in ovl_rename()
    - ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO
    - nfsd: fix error handling of register_pernet_subsys() in init_nfsd()
    - nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero
    - SUNRPC: fix sign error causing rpcsec_gss drops
    - xen/balloon: fix cancelled balloon action
    - [armhf] dts: omap3430-sdp: Fix NAND device node
    - scsi: ufs: core: Fix task management completion
    - [riscv64] Flush current cpu icache before other cpus
    - [armhf] bus: ti-sysc: Add break in switch statement in sysc_init_soc()
    - iwlwifi: mvm: Fix possible NULL dereference
    - [arm64] soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment
    - [armhf] dts: imx: Add missing pinctrl-names for panel on M53Menlo
    - [armhf] dts: imx: Fix USB host power regulator polarity on M53Menlo
    - [amd64] PCI: hv: Fix sleep while in non-sleep context when removing child
      devices from the bus
    - iwlwifi: pcie: add configuration of a Wi-Fi adapter on Dell XPS 15
    - netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1
    - netfilter: nf_tables: add position handle in event notification
    - netfilter: nf_tables: reverse order in rule replacement expansion
    - [armel,armhf] bpf, arm: Fix register clobbering in div/mod implementation
    - [armhf] soc: ti: omap-prm: Fix external abort for am335x pruss
    - bpf: Fix integer overflow in prealloc_elems_and_freelist()
      (CVE-2021-41864)
    - net/mlx5e: IPSEC RX, enable checksum complete
    - net/mlx5e: Keep the value for maximum number of channels in-sync
    - net/mlx5: E-Switch, Fix double allocation of acl flow counter
    - net/mlx5: Force round second at 1PPS out start time
    - net/mlx5: Avoid generating event after PPS out in Real time mode
    - net/mlx5: Fix length of irq_index in chars
    - net/mlx5: Fix setting number of EQs of SFs
    - net/mlx5e: Fix the presented RQ index in PTP stats
    - phy: mdio: fix memory leak
    - net_sched: fix NULL deref in fifo_set_limit()
    - [arm64] net: mscc: ocelot: fix VCAP filters remaining active after being
      deleted
    - [arm64,armhf] net: stmmac: dwmac-rk: Fix ethernet on rk3399 based devices
    - [mips*] Revert "add support for buggy MT7621S core detection"
    - netfilter: nf_tables: honor NLM_F_CREATE and NLM_F_EXCL in event
      notification
    - [i386] ptp_pch: Load module automatically if ID matches
    - [armhf] dts: imx: change the spi-nor tx
    - [arm64] dts: imx8: change the spi-nor tx
    - [armhf] imx6: disable the GIC CPU interface before calling stby-poweroff
      sequence
    - [x86] drm/i915/audio: Use BIOS provided value for RKL HDA link
    - [x86] drm/i915/jsl: Add W/A 1409054076 for JSL
    - [x86] drm/i915/tc: Fix TypeC port init/resume time sanitization
    - [x86] drm/i915/bdb: Fix version check
    - netfs: Fix READ/WRITE confusion when calling iov_iter_xarray()
    - afs: Fix afs_launder_page() to set correct start file position
    - net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size()
    - net: bridge: fix under estimation in br_get_linkxstats_size()
    - net/sched: sch_taprio: properly cancel timer from taprio_destroy()
    - net: sfp: Fix typo in state machine debug string
    - net: pcs: xpcs: fix incorrect CL37 AN sequence
    - netlink: annotate data races around nlk->bound
    - drm/amdgpu: handle the case of pci_channel_io_frozen only in
      amdgpu_pci_resume
    - [armhf] bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
    - [arm64,armhf] drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup
    - drm/nouveau: avoid a use-after-free when BO init fails
    - drm/nouveau/kms/nv50-: fix file release memory leak
    - drm/nouveau/debugfs: fix file release memory leak
    - net: pcs: xpcs: fix incorrect steps on disable EEE
    - net: stmmac: trigger PCS EEE to turn off on link down
    - [amd64,arm64] gve: Correct available tx qpl check
    - [amd64,arm64] gve: Avoid freeing NULL pointer
    - [amd64,arm64] gve: Properly handle errors in gve_assign_qpl
    - rtnetlink: fix if_nlmsg_stats_size() under estimation
    - [amd64,arm64] gve: fix gve_get_stats()
    - [amd64,arm64] gve: report 64bit tx_bytes counter from
      gve_handle_report_stats()
    - i40e: fix endless loop under rtnl
    - i40e: Fix freeing of uninitialized misc IRQ vector
    - iavf: fix double unlock of crit_lock
    - net: prefer socket bound to interface when not in VRF
    - [powerpc*] iommu: Report the correct most efficient DMA mask for PCI
      devices
    - i2c: acpi: fix resource leak in reconfiguration device addition
    - [riscv64] explicitly use symbol offsets for VDSO
    - [riscv64] vdso: Refactor asm/vdso.h
    - [riscv64] vdso: Move vdso data page up front
    - [riscv64] vdso: make arch_setup_additional_pages wait for mmap_sem for
      write killable
    - [s390x] bpf, s390: Fix potential memory leak about jit_data
    - [riscv64] Include clone3() on rv32
    - scsi: iscsi: Fix iscsi_task use after free
    - [powerpc*] bpf: Fix BPF_MOD when imm == 1
    - [powerpc*] bpf: Fix BPF_SUB when imm == 0x80000000
    - [powerpc*] 64s: fix program check interrupt emergency stack path
    - [powerpc*] traps: do not enable irqs in _exception
    - [powerpc*] 64s: Fix unrecoverable MCE calling async handler from NMI
    - [powerpc*] pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init
    - [i386] x86/platform/olpc: Correct ifdef symbol to intended
      CONFIG_OLPC_XO15_SCI
    - [x86] fpu: Restore the masking out of reserved MXCSR bits
    - [x86] entry: Correct reference to intended CONFIG_64_BIT
    - [x86] hpet: Use another crystalball to evaluate HPET usability
    - [arm64,armhf] dsa: tag_dsa: Fix mask for trunked packets

  [ Ben Hutchings ]
  * debian/.gitignore: Ignore debian/tests/control again
  * integrity: Drop "MODSIGN: load blacklist from MOKx" as redundant after 5.13
  * tools/perf: Fix warning introduced by "tools/perf: pmu-events: Fix
    reproducibility"
  * debian/rules.real: Stop invoking obsolete headers_check target
  * libcpupower: Update symbols file for changes in 5.13.9-1~exp1

  [ John Paul Adrian Glaubitz ]
  * [alpha] Re-enable CONFIG_EISA which was disabled upstream by accident

  [ Salvatore Bonaccorso ]
  * Bump ABI to 3
  * mm/secretmem: Fix NULL page->mapping dereference in page_is_secretmem()
    (Closes: #996175)

  [ Aurelien Jarno ]
  * [riscv64] Improve HiFive Unmatched support: enable SENSORS_LM90.

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 14 Oct 2021 08:39:01 +0200

linux (5.14.9-2) unstable; urgency=medium

  * [amd64] Unset AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT.
    Do not activate AMD Secure Memory Encryption (SME) by default, until
    AMDGPU related incompatibilities are fixed. (Closes: #994453)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 03 Oct 2021 22:14:52 +0200

linux (5.14.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.7
    - [amd64] net: stmmac: fix MAC not working when system resume back with WoL
      active
    - [amd64,arm64] swiotlb-xen: avoid double free
    - swiotlb-xen: fix late init retry
    - [amd64] xen: reset legacy rtc flag for PV domU
    - [amd64] xen: fix usage of pmd_populate in mremap for pv guests
    - [arm64] sve: Use correct size when reinitialising SVE state
    - PCI: Add AMD GPU multi-function power dependencies
    - drm/amd/display: dsc mst 2 4K displays go dark with 2 lane HBR3
    - drm/amd/display: Fix white screen page fault for gpuvm
    - drm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10
    - drm/amdgpu: use IS_ERR for debugfs APIs
    - drm/amdgpu: fix use after free during BO move
    - drm/amdgpu: add amdgpu_amdkfd_resume_iommu
    - drm/amdgpu: move iommu_resume before ip init/resume
    - drm/radeon: pass drm dev radeon_agp_head_init directly
    - io_uring: allow retry for O_NONBLOCK if async is supported
    - [x86] drm/i915/dp: Use max params for panels < eDP 1.4
    - [armhf] drm/etnaviv: return context from etnaviv_iommu_context_get
    - [armhf] drm/etnaviv: put submit prev MMU context when it exists
    - [armhf] drm/etnaviv: stop abusing mmu_context as FE running marker
    - [armhf] drm/etnaviv: keep MMU context across runtime suspend/resume
    - [armhf] drm/etnaviv: exec and MMU state is lost when resetting the GPU
    - [armhf] drm/etnaviv: fix MMU context leak on GPU reset
    - [armhf] drm/etnaviv: reference MMU context when setting up hardware state
    - [armhf] drm/etnaviv: add missing MMU context put when reaping MMU mapping
    - [s390x] sclp: fix Secure-IPL facility detection
    - net: qrtr: revert check in qrtr_endpoint_post() (Closes: #995491)
    - [x86] pat: Pass valid address to sanitize_phys()
    - [x86] mm: Fix kern_addr_valid() to cope with existing but not present
      entries
    - x86/mce: Avoid infinite loop for copy from user recovery
    - tipc: fix an use-after-free issue in tipc_recvmsg
    - net: remove the unnecessary check in cipso_v4_doi_free
    - net/{mlx5|nfp|bnxt}: Remove unnecessary RTNL lock assert
    - net/l2tp: Fix reference count leak in l2tp_udp_recv_core
    - r6040: Restore MDIO clock frequency after MAC reset
    - tipc: increase timeout in tipc_sk_enqueue()
    - [arm64] drm/rockchip: cdn-dp-core: Make cdn_dp_core_resume __maybe_unused
    - rtc: cmos: Disable irq around direct invocation of cmos_interrupt()
    - [x86] drm/i915/dp: return proper DPRX link training result
    - net/mlx5: FWTrace, cancel work on alloc pd error flow
    - net/mlx5: Fix potential sleeping in atomic context
    - net: stmmac: fix system hang caused by eee_ctrl_timer during
      suspend/resume
    - igc: fix tunnel offloading
    - nvme-tcp: fix io_work priority inversion
    - [powerpc*] 64s: system call scv tabort fix for corrupt irq soft-mask state
    - events: Reuse value read using READ_ONCE instead of re-reading it
    - vhost_net: fix OoB on sendmsg() failure.
    - net/af_unix: fix a data-race in unix_dgram_poll
    - [arm64,armhf] net: dsa: destroy the phylink instance on any error in
      dsa_slave_phy_setup
    - tcp: fix tp->undo_retrans accounting in tcp_sacktag_one()
    - qed: Handle management FW error
    - udp_tunnel: Fix udp_tunnel_nic work-queue type
    - dt-bindings: arm: Fix Toradex compatible typo
    - [powerpc*] KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode
      changing registers
    - [powerpc*] 64s: system call rfscv workaround for TM bugs
    - [powerpc*] mce: Fix access error in mce handler
    - [s390x] pci_mmio: fully validate the VMA before calling follow_pte()
    - bnxt_en: make bnxt_free_skbs() safe to call after bnxt_free_mem()
    - [arm64] net: hns3: pad the short tunnel frame before sending to hardware
    - [arm64] net: hns3: change affinity_mask to numa node range
    - [arm64] net: hns3: disable mac in flr process
    - [arm64] net: hns3: fix the timing issue of VF clearing interrupt sources
    - net: stmmac: platform: fix build warning when with !CONFIG_PM_SLEEP
    - [x86] Drivers: hv: vmbus: Fix kernel crash upon unbinding a device from
      uio_hv_generic driver
    - net/mlx5e: Fix mutual exclusion between CQE compression and HW TS
    - ice: Correctly deal with PFs that do not support RDMA
    - [arm64] net: hns3: fix the exception when query imp info
    - nvme: avoid race in shutdown namespace removal
    - blkcg: fix memory leak in blk_iolatency_init
    - [arm64,armhf] net: dsa: flush switchdev workqueue before tearing down
      CPU/DSA ports
    - dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation
    - PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms
    - fuse: fix use after free in fuse_read_interrupt()
    - [arm64,armhf] PCI: tegra: Fix OF node reference leak
    - [armhf] mfd: Don't use irq_create_mapping() to resolve a mapping
    - [riscv64] fix the global name pfn_base confliction error
    - [arm64] KVM: Make hyp_panic() more robust when protected mode is enabled
    - tracing/probes: Reject events which have the same name of existing one
    - PCI: Add ACS quirks for Cavium multi-function devices
    - watchdog: Start watchdog in watchdog_set_last_hw_keepalive only if
      appropriate
    - Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6
    - flow: fix object-size-mismatch warning in flowi{4,6}_to_flowi_common()
    - net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920
    - block, bfq: honor already-setup queue merges
    - [i386] PCI: ibmphp: Fix double unmap of io_mem
    - loop: reduce the loop_ctl_mutex scope
    - ethtool: Fix an error code in cxgb2.c
    - net: phylink: add suspend/resume support
    - mfd: axp20x: Update AXP288 volatile ranges
    - PCI: of: Don't fail devm_pci_alloc_host_bridge() on missing 'ranges'
    - netfilter: nft_ct: protect nft_ct_pcpu_template_refcnt with mutex
    - [arm64] KVM: Restrict IPA size to maximum 48 bits on 4K and 16K page size
    - PCI: Fix pci_dev_str_match_path() alloc while atomic bug
    - mtd: mtdconcat: Judge callback existence based on the master
    - mtd: mtdconcat: Check _read, _write callbacks existence before assignment
    - [arm64] KVM: Fix read-side race on updates to vcpu reset state
    - [arm64] KVM: Handle PSCI resets before userspace touches vCPU state
    - PCI/PTM: Remove error message at boot
    - watchdog: Fix NULL pointer dereference when releasing cdev
    - mtd: rawnand: cafe: Fix a resource leak in the error handling path of
      'cafe_nand_probe()'
    - [arm64] gpio: mpc8xxx: Fix a resources leak in the error handling path of
      'mpc8xxx_probe()'
    - [arm64] gpio: mpc8xxx: Fix a potential double iounmap call in
      'mpc8xxx_probe()'
    - [arm64] gpio: mpc8xxx: Use 'devm_gpiochip_add_data()' to simplify the code
      and avoid a leak
    - io_uring: retry in case of short read on block device
    - mptcp: fix possible divide by zero
    - net: hso: add failure handler for add_net_device
    - [armhf] net: dsa: b53: Fix calculating number of switch ports
    - [armhf] net: dsa: b53: Set correct number of ports in the DSA struct
    - mptcp: Only send extra TCP acks in eligible socket states
    - netfilter: socket: icmp6: fix use-after-scope
    - fq_codel: reject silly quantum parameters
    - qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom
    - iwlwifi: move get pnvm file name to a separate function
    - iwlwifi: pnvm: Fix a memory leak in 'iwl_pnvm_get_from_fs()'
    - ip_gre: validate csum_start only on pull
    - [armhf] net: dsa: b53: Fix IMP port setup on BCM5301x
    - bnxt_en: fix stored FW_PSID version masks
    - bnxt_en: Fix asic.rev in devlink dev info command
    - bnxt_en: Fix possible unintended driver initiated error recovery
    - ip6_gre: Revert "ip6_gre: add validation for csum_start"
    - mfd: lpc_sch: Rename GPIOBASE to prevent build error
    - cxgb3: fix oops on module removal
    - bnxt_en: Fix error recovery regression
    - [armhf] net: dsa: bcm_sf2: Fix array overrun in bcm_sf2_num_active_ports()
    - [s390x] bpf: Fix optimizing out zero-extensions
    - [s390x] bpf: Fix 64-bit subtraction of the -0x80000000 constant
    - [s390x] bpf: Fix branch shortening during codegen pass
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.8
    - PCI: pci-bridge-emul: Add PCIe Root Capabilities Register
    - [arm64] PCI: aardvark: Fix reporting CRS value
    - console: consume APC, DM, DCS
    - [x86] staging: rtl8192u: Fix bitwise vs logical operator in
      TranslateRxSignalStuff819xUsb()
    - coredump: fix memleak in dump_vma_snapshot()
    - [arm64] RDMA/hns: Enable stash feature of HIP09
    - RDMA/mlx5: Fix xlt_chunk_align calculation
    - dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
    - staging: rtl8723bs: fix wpa_set_auth_algs() function
    - [armhf] thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
    - 9p/trans_virtio: Remove sysfs file on probe failure
    - prctl: allow to setup brk for et_dyn executables
    - nilfs2: use refcount_dec_and_lock() to fix potential UAF
    - profiling: fix shift-out-of-bounds bugs
    - PM: sleep: core: Avoid setting power.must_resume to false
    - ceph: cancel delayed work instead of flushing on mdsc teardown
    - platform/chrome: sensorhub: Add trace events for sample
    - platform/chrome: cros_ec_trace: Fix format warnings
    - [s390x] entry: make oklabel within CHKSTG macro local
    - SUNRPC: don't pause on incomplete allocation
    - init: move usermodehelper_enable() to populate_rootfs()
    - thermal/core: Fix thermal_cooling_device_register() prototype
    - drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION()
    - [amd64] iommu/amd: Relocate GAMSup check to early_enable_iommus
    - [amd64] iommu/vt-d: Fix PASID leak in intel_svm_unbind_mm()
    - [amd64] iommu/vt-d: Fix a deadlock in intel_svm_drain_prq()
    - [arm64] mm: limit linear region to 51 bits for KVM in nVHE mode
    - drm/ttm: Fix a deadlock if the target BO is not idle during swap
    - of: property: Disable fw_devlink DT support for X86
    - [riscv64] dts: microchip: mpfs-icicle: Fix serial console
    - [arm64,armhf] ASoC: audio-graph: respawn Platform Support
    - [x86] ACPI: PM: s2idle: Run both AMD and Microsoft methods if both are
      supported
    - ceph: fix memory leak on decode error in ceph_handle_caps
    - ceph: request Fw caps before updating the mtime in ceph_write_iter
    - ceph: remove the capsnaps when removing caps
    - ceph: lockdep annotations for try_nonblocking_invalidate
    - [s390x] unwind: use current_frame_address() to unwind current task
    - btrfs: update the bdev time directly when closing
    - btrfs: delay blkdev_put until after the device remove
    - btrfs: fix lockdep warning while mounting sprout fs
    - nilfs2: fix memory leak in nilfs_sysfs_create_device_group
    - nilfs2: fix NULL pointer in nilfs_##name##_attr_release
    - nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group
    - nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group
    - nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group
    - nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
    - drm/amdgpu: Fixes to returning VBIOS RAS EEPROM address
    - drm/amdgpu: fix fdinfo race with process exit
    - [arm64,armhf] pwm: rockchip: Don't modify HW state in .remove() callback
    - [armhf] pwm: stm32-lp: Don't modify HW state in .remove() callback
    - nvmet: fixup buffer overrun in nvmet_subsys_attr_serial()
    - block: genhd: don't call blkdev_show() with major_names_lock held
    - blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
    - blk-mq: allow 4x BLK_MAX_REQUEST_COUNT at blk_plug for multiple_queues
    - sched/idle: Make the idle timer expire in hard interrupt context
    - cifs: properly invalidate cached root handle when closing it
    - io_uring: fix off-by-one in BUILD_BUG_ON check of __REQ_F_LAST_BIT
    - selinux,smack: fix subjective/objective credential use mixups
    - drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.9
    - mm, hwpoison: add is_free_buddy_page() in HWPoisonHandlable()
    - ocfs2: drop acl cache for directories too
    - mm/debug: sync up MR_CONTIG_RANGE and MR_LONGTERM_PIN
    - mm: fix uninitialized use in overcommit_policy_handler
    - usb: gadget: u_audio: EP-OUT bInterval in fback frequency
    - [arm*] usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave
    - [arm*] usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA
    - [armhf] usb: musb: tusb6010: uninitialized data in
      tusb_fifo_write_unaligned()
    - cifs: Not to defer close on file when lock is set
    - cifs: Fix soft lockup during fsstress
    - cifs: fix incorrect check for null pointer in header_assemble
    - [xen] x86: fix PV trap handling on secondary processors
    - usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
    - USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter
    - USB: cdc-acm: fix minor-number release
    - [arm*] binder: make sure fd closes complete
    - [arm*] binder: fix freeze race
    - [arm64] usb: isp1760: do not sleep in field register poll
    - Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
    - [arm64,armhf] usb: dwc3: core: balance phy init and exit
    - usb: core: hcd: Add support for deferring roothub registration
    - USB: serial: mos7840: remove duplicated 0xac24 device ID
    - USB: serial: option: add Telit LN920 compositions
    - USB: serial: option: remove duplicate USB device ID
    - USB: serial: option: add device id for Foxconn T99W265
    - [powerpc*] misc: genwqe: Fixes DMA mask setting
    - KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest
    - erofs: fix up erofs_lookup tracepoint
    - nexthop: Fix division by zero while replacing a resilient group
    - btrfs: prevent __btrfs_dump_space_info() to underflow its free space
    - xhci: Set HCD flag to defer primary roothub registration
    - [arm64] serial: mvebu-uart: fix driver's tx_empty callback
    - scsi: sd_zbc: Ensure buffer size is aligned to SECTOR_SIZE
    - net: hso: fix muxed tty registration
    - [amd64] platform/x86: amd-pmc: Increase the response register timeout
    - [arm64] Restore forced disabling of KPTI on ThunderX
    - [arm64] Mitigate MTE issues with str{n}cmp()
    - [x86] comedi: Fix memory leak in compat_insnlist()
    - afs: Fix page leak
    - afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation
    - afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
    - afs: Fix updating of i_blocks on file/dir extension
    - virtio-net: fix pages leaking when building skb in big mode
    - [arm64] enetc: Fix illegal access when reading affinity_hint
    - [arm64] enetc: Fix uninitialized struct dim_sample field usage
    - [arm64,armhf] net: dsa: tear down devlink port regions when tearing down
      the devlink port on error
    - napi: fix race inside napi_enable
    - bnxt_en: Fix TX timeout when TX ring size is set to the smallest
    - [arm64] net: hns3: fix change RSS 'hfunc' ineffective issue
    - [arm64] net: hns3: fix inconsistent vf id print
    - [arm64] net: hns3: fix misuse vf id and vport id in some logs
    - [arm64] net: hns3: check queue id range before using
    - [arm64] net: hns3: check vlan id before using it
    - [arm64] net: hns3: fix a return value error in hclge_get_reset_status()
    - net/smc: add missing error check in smc_clc_prfx_set()
    - net/smc: fix 'workqueue leaked lock' in smc_conn_abort_work
    - [arm64,armhf] net: dsa: fix dsa_tree_setup error path
    - [arm64,armhf] net: dsa: don't allocate the slave_mii_bus using devres
    - spi: Revert modalias changes
    - [s390x] qeth: fix NULL deref in qeth_clear_working_pool_list()
    - gpiolib: acpi: Make set-debounce-timeout failures non fatal
    - qed: rdma - don't wait for resources under hw error recovery flow
    - mptcp: ensure tx skbs always have the MPTCP ext
    - nexthop: Fix memory leaks in nexthop notification chain listeners
    - [arm64] net: mscc: ocelot: fix forwarding from BLOCKING ports remaining
      enabled
    - net/mlx4_en: Don't allow aRFS for encapsulated packets
    - atlantic: Fix issue in the pm resume flow.
    - scsi: iscsi: Adjust iface sysfs attr detection
    - scsi: target: Fix the pgr/alua_support_store functions
    - [x86] tty: synclink_gt: rename a conflicting function name
    - [x86] fault: Fix wrong signal when vsyscall fails with pkey
    - nvme-tcp: fix incorrect h2cdata pdu offset accounting
    - nvme: keep ctrl->namespaces ordered
    - thermal/core: Potential buffer overflow in
      thermal_build_list_of_policies()
    - cifs: fix a sign extension bug
    - scsi: sd_zbc: Support disks with more than 2**32 logical blocks
    - scsi: ufs: Revert "Utilize Transfer Request List Completion Notification
      Register"
    - scsi: ufs: Retry aborted SCSI commands instead of completing these
      successfully
    - scsi: ufs: core: Unbreak the reset handler
    - scsi: qla2xxx: Restore initiator in dual mode
    - scsi: lpfc: Use correct scnprintf() limit
    - [arm64,armhf] irqchip/gic-v3-its: Fix potential VPE leak on error
    - md: fix a lock order reversal in md_alloc
    - [x86] asm: Fix SETZ size enqcmds() build failure
    - io_uring: fix race between poll completion and cancel_hash insertion
    - io_uring: fix missing set of EPOLLONESHOT for CQ ring overflow
    - io_uring: put provided buffer meta data under memcg accounting
    - io_uring: don't punt files update to io-wq unconditionally
    - blktrace: Fix uaf in blk_trace access after removing by sysfs
    - net: phylink: Update SFP selected interface on advertising changes
    - net: stmmac: allow CSR clock of 300MHz
    - blk-mq: avoid to iterate over stale request
    - ipv6: delay fib6_sernum increase in fib6_add
    - [x86] cpufreq: intel_pstate: Override parameters if HWP forced by BIOS
    - bpf: Add oversize check before call kvcalloc()
    - xen/balloon: use a kernel thread instead a workqueue
    - nvme-multipath: fix ANA state updates when a namespace is not present
    - nvme-rdma: destroy cm id before destroy qp to avoid use after free
    - amd/display: downgrade validation failure log level
    - drm/ttm: fix type mismatch error on sparc64
    - block: check if a profile is actually registered in
      blk_integrity_unregister
    - block: flush the integrity workqueue in blk_integrity_unregister
    - blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd
    - compiler.h: Introduce absolute_pointer macro
    - qnx4: avoid stringop-overread errors
    - drm/amd/display: Fix unstable HPCP compliance on Chrome Barcelo
    - drm/amd/display: Link training retry fix for abort case
    - amd/display: enable panel orientation quirks
    - [arm64] Mark __stack_chk_guard as __ro_after_init
    - net: 6pack: Fix tx timeout and slot time
    - [arm64] spi: Fix tegra20 build with CONFIG_PM=n
    - [arm*] Revert drm/vc4 hdmi runtime PM changes
    - [x86] setup: Call early_reserve_memory() earlier
    - [x86] thermal/drivers/int340x: Do not set a wrong tcc offset on resume
    - [armhf] irqchip/armada-370-xp: Fix ack/eoi breakage
    - [arm64] add MTE supported check to thread switching and syscall entry/exit
    - USB: serial: cp210x: fix dropped characters with CP2102
    - software node: balance refcount for managed software nodes
    - xen/balloon: fix balloon kthread freezing
    - qnx4: work around gcc false positive warning bug
    - nvmet: fix a width vs precision bug in nvmet_subsys_attr_serial_show()
    - usb: gadget: f_uac2: Add missing companion descriptor for feedback EP
    - usb: gadget: f_uac2: Populate SS descriptors' wBytesPerInterval

  [ Salvatore Bonaccorso ]
  * Bump ABI to 2
  * ext4: limit the number of blocks in one ADD_RANGE TLV (Closes: #995425)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 03 Oct 2021 14:09:38 +0200

linux (5.14.6-3) unstable; urgency=medium

  [ Salvatore Bonaccorso ]
  * ethtool: Fix rxnfc copy to user buffer overflow (Closes: #995109)
  * debian/bin/gencontrol.py: Fix under-indented line triggering pycodestyle
    problem.
  * [armhf] dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode

  [ John Paul Adrian Glaubitz ]
  * [ia64] Set CONFIG_CRYPTO_ZSTD=y to force CONFIG_ZSTD_COMPRESS=y
  * [ia64] Drop udebs for legacy IDE support, removed upstream
  * [m68k] Drop udebs for legacy IDE support, removed upstream
  * [sh4] Set CONFIG_CC_OPTIMIZE_FOR_SIZE=y to reduce image size

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 28 Sep 2021 06:29:40 +0200

linux (5.14.6-2) unstable; urgency=medium

  * io_uring: ensure symmetry in handling iter types in loop_rw_iter()
    (CVE-2021-41073)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 19 Sep 2021 10:49:04 +0200

linux (5.14.6-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.4
    - locking/mutex: Fix HANDOFF condition
    - regmap: fix the offset of register error log
    - sched/deadline: Fix reset_on_fork reporting of DL tasks
    - power: supply: axp288_fuel_gauge: Report register-address on readb /
      writeb errors
    - sched/deadline: Fix missing clock update in migrate_task_rq_dl()
    - rcu/tree: Handle VM stoppage in stall detection
    - [x86] EDAC/mce_amd: Do not load edac_mce_amd module on guests
    - posix-cpu-timers: Force next expiration recalc after itimer reset
    - hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
    - hrtimer: Ensure timerfd notification for HIGHRES=n
    - udf: Check LVID earlier
    - udf: Fix iocharset=utf8 mount option
    - isofs: joliet: Fix iocharset=utf8 mount option
    - bcache: add proper error unwinding in bcache_device_init
    - nbd: add the check to prevent overflow in __nbd_ioctl()
    - blk-throtl: optimize IOPS throttle for large IO scenarios
    - nvme-tcp: don't update queue count when failing to set io queues
    - nvme-rdma: don't update queue count when failing to set io queues
    - nvmet: pass back cntlid on successful completion
    - [s390x] cio: add dev_busid sysfs entry for each subchannel
    - [s390x] zcrypt: fix wrong offset index for APKA master key valid state
    - libata: fix ata_host_start()
    - sched/topology: Skip updating masks for non-online nodes
    - [x86] crypto: qat - do not ignore errors from enable_vf2pf_comms()
    - [x86] crypto: qat - handle both source of interrupt in VF ISR
    - [x86] crypto: qat - fix reuse of completion variable
    - [x86] crypto: qat - fix naming for init/shutdown VF to PF notifications
    - [x86] crypto: qat - do not export adf_iov_putmsg()
    - crypto: tcrypt - Fix missing return value check
    - fcntl: fix potential deadlocks for &fown_struct.lock
    - fcntl: fix potential deadlock for &fasync_struct.fa_lock
    - udf_get_extendedattr() had no boundary checks.
    - io-wq: remove GFP_ATOMIC allocation off schedule out path
    - [s390x] pci: fix misleading rc in clp_set_pci_fn()
    - [s390x] debug: keep debug data on resize
    - [s390x] debug: fix debug area life cycle
    - [s390x] ap: fix state machine hang after failure to enable irq
    - [s390x] smp: enable DAT before CPU restart callback is called
    - sched/debug: Don't update sched_domain debug directories before
      sched_debug_init()
    - [arm64] power: supply: cw2015: use dev_err_probe to allow deferred probe
    - [x86] crypto: x86/aes-ni - add missing error checks in XTS code
    - sched/numa: Fix is_core_idle()
    - sched: Fix UCLAMP_FLAG_IDLE setting
    - rcu: Fix to include first blocked task in stall warning
    - rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock
    - block: return ELEVATOR_DISCARD_MERGE if possible
    - [arm64] spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
    - [mips64el,mipsel] irqchip/loongson-pch-pic: Improve edge triggered
      interrupt support
    - lib/mpi: use kcalloc in mpi_resize
    - nbd: do del_gendisk() asynchronously for NBD_DESTROY_ON_DISCONNECT
    - block: nbd: add sanity check for first_minor
    - [arm64,armhf] irqchip/gic-v3: Fix priority comparison when non-secure
      priorities are used
    - [x86] crypto: qat - use proper type for vf_mask
    - [powerpc*] tpm: ibmvtpm: Avoid error message when process gets signal
      while waiting
    - [x86] mce: Defer processing of early errors
    - blk-crypto: fix check for too-large dun_bytes
    - [arm64] regulator: vctrl: Use locked regulator_get_voltage in probe path
    - [arm64] regulator: vctrl: Avoid lockdep warning in enable/disable ops
    - [arm64,armhf] drm/panfrost: Fix missing clk_disable_unprepare() on error
      in panfrost_clk_init()
    - [x86] drm/gma500: Fix end of loop tests for list_for_each_entry
    - drm/of: free the right object
    - bpf: Fix a typo of reuseport map in bpf.h.
    - bpf: Fix potential memleak and UAF in the verifier.
    - drm/of: free the iterator object on failure
    - [amd64,arm64] gve: fix the wrong AdminQ buffer overflow check
    - [armhf] dts: everest: Add phase corrections for eMMC
    - i40e: improve locking of mac_filter_hash
    - gfs2: Fix memory leak of object lsi on error return path
    - firmware: fix theoretical UAF race with firmware cache and resume
    - driver core: Fix error return code in really_probe()
    - media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
    - media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
    - media: dvb-usb: Fix error handling in dvb_usb_i2c_init
    - net: usb: asix: ax88772: add missing stop
    - media: go7007: fix memory leak in go7007_usb_probe
    - media: go7007: remove redundant initialization
    - [armhf] media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
    - Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
    - Bluetooth: btusb: Fix a unspported condition to set available debug
      features
    - [x86] drm/amdgpu/acp: Make PM domain really work
    - tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
    - [armhf] dts: meson8b: odroidc1: Fix the pwm regulator supply properties
    - [armhf] dts: meson8b: mxq: Fix the pwm regulator supply properties
    - [armhf] dts: meson8b: ec100: Fix the pwm regulator supply properties
    - net/mlx5e: Prohibit inner indir TIRs in IPoIB
    - net/mlx5e: Block LRO if firmware asks for tunneled LRO
    - cgroup/cpuset: Fix a partition bug with hotplug
    - net: cipso: fix warnings in netlbl_cipsov4_add_std
    - Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd
    - drm/amd/pm: Fix a bug in semaphore double-lock
    - net/mlx5: Fix missing return value in
      mlx5_devlink_eswitch_inline_mode_set()
    - leds: lt3593: Put fwnode in any case during ->probe()
    - leds: trigger: audio: Add an activate callback to ensure the initial
      brightness is set
    - media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
    - [armhf] media: omap3isp: Fix missing unlock in
      isp_subdev_notifier_complete()
    - PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
    - PCI: PM: Enable PME if it can be signaled from D3cold
    - [arm64] net: dsa: build tag_8021q.c as part of DSA core
    - debugfs: Return error during {full/open}_proxy_open() on rmmod
    - Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
    - [arm64,armhf] net: dsa: stop syncing the bridge mcast_router attribute at
      join time
    - [arm64,armhf] net: dsa: don't disable multicast flooding to the CPU even
      without an IGMP querier
    - PM: EM: Increase energy calculation precision
    - [arm64] drm/msm: Fix error return code in msm_drm_init()
    - [arm64] drm/msm/mdp4: refactor HW revision detection into
      read_mdp_hw_revision
    - [arm64] drm/msm/mdp4: move HW revision detection to earlier phase
    - [arm64] drm/msm/dp: update is_connected status base on sink count at
      dp_pm_resume()
    - [arm64] drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary
      LMs
    - cgroup/cpuset: Miscellaneous code cleanup
    - cgroup/cpuset: Fix violation of cpuset locking rule
    - [x86] ASoC: Intel: Fix platform ID matching
    - Bluetooth: fix repeated calls to sco_sock_kill
    - [arm64] drm/msm/dsi: Fix some reference counted resource leaks
    - [arm64] drm/msm/dp: replug event is converted into an unplug followed by
      an plug events
    - net/mlx5: Fix unpublish devlink parameters
    - [x86] ASoC: rt5682: Properly turn off regulators if wrong device ID
    - [arm64,armhf] usb: dwc3: meson-g12a: add IRQ check
    - [arm64,armhf] usb: dwc3: qcom: add IRQ check
    - mac80211: remove unnecessary NULL check in ieee80211_register_hw()
    - [armhf] usb: phy: twl6030: add IRQ checks
    - devlink: Clear whole devlink_flash_notify struct
    - net: stmmac: fix INTR TBU status affecting irq count statistic
    - Bluetooth: Move shutdown callback before flushing tx and rx queue
    - PM: cpu: Make notifier chain use a raw_spinlock_t
    - mac80211: Fix insufficient headroom issue for AMSDU
    - locking/local_lock: Add missing owner initialization
    - lockd: Fix invalid lockowner cast after vfs_test_lock
    - SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency()
    - nfsd4: Fix forced-expiry locking
    - [arm64] dts: marvell: armada-37xx: Extend PCIe MEM space
    - [arm*] firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()'
    - mm/swap: consider max pages in iomap_swapfile_add_extent
    - Bluetooth: add timeout sanity check to hci_inquiry
    - [armhf] i2c: s3c2410: fix IRQ check
    - gfs2: init system threads before freeze lock
    - rsi: fix error code in rsi_load_9116_firmware()
    - rsi: fix an error code in rsi_probe()
    - [x86] ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
    - [x86] ASoC: Intel: Skylake: Fix module resource and format selection
    - mmc: sdhci: Fix issue with uninitialized dma_slave_config
    - [arm64,armhf] mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
    - bpf: Fix possible out of bound write in narrow load handling
    - [x86] hv_utils: Set the maximum packet size for VSS driver to the length
      of the receive buffer
    - CIFS: Fix a potencially linear read overflow
    - [arm64] i2c: xlp9xx: fix main IRQ check
    - [arm*] usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
    - [arm64] tty: serial: fsl_lpuart: fix the wrong mapbase value
    - iwlwifi: skip first element in the WTAS ACPI table
    - net/mlx5: Lag, fix multipath lag activation
    - net/mlx5: Remove all auxiliary devices at the unregister event
    - net/mlx5e: Fix possible use-after-free deleting fdb rule
    - net/mlx5: E-Switch, Set vhca id valid flag when creating indir fwd group
    - net/mlx5e: Use correct eswitch for stack devices with lag
    - [x86] misc/pvpanic: fix set driver data
    - ice: fix Tx queue iteration for Tx timestamp enablement
    - ice: add lock around Tx timestamp tracker flush
    - ice: restart periodic outputs around time changes
    - ice: Only lock to update netdev dev_addr
    - net: phy: marvell10g: fix broken PHY interrupts for anyone after us in the
      driver probe list
    - ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
    - ALSA: usb-audio: Add lowlatency module option
    - atlantic: Fix driver resume flow.
    - bcma: Fix memory leak for internally-handled cores
    - brcmfmac: pcie: fix oops on failure to resume and reprobe
    - ipv6: make exception cache less predictible
    - ipv4: make exception cache less predictible
    - net: qrtr: make checks in qrtr_endpoint_post() stricter
    - sch_htb: Fix inconsistency when leaf qdisc creation fails
    - net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
    - ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
    - [x86] ASoC: rt5682: Remove unused variable in rt5682_i2c_remove()
    - iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha
    - f2fs: guarantee to write dirty data when enabling checkpoint back
    - time: Handle negative seconds correctly in timespec64_to_ns()
    - io_uring: limit fixed table size by RLIMIT_NOFILE
    - io_uring: IORING_OP_WRITE needs hash_reg_file set
    - io_uring: io_uring_complete() trace should take an integer
    - io_uring: fail links of cancelled timeouts
    - bio: fix page leak bio_add_hw_page failure
    - raid1: ensure write behind bio has less than BIO_MAX_VECS sectors
    - cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED
    - smb3: fix posix extensions mount option
    - tty: Fix data race between tiocsti() and flush_to_ldisc()
    - [x86] perf/x86/intel/uncore: Fix IIO cleanup mapping procedure for SNR/ICX
    - [x86] Revert "KVM: x86: mmu: Add guest physical address check in
      translate_gpa()"
    - [s390x] KVM: index kvm->arch.idle_mask by vcpu_idx
    - [x86] KVM: x86: Update vCPU's hv_clock before back to guest when
      tsc_offset is adjusted
    - [x86] KVM: x86: clamp host mapping level to max_level in
      kvm_mmu_max_mapping_level
    - [x86] KVM: x86/mmu: Avoid collision with !PRESENT SPTEs in TDP MMU lpage
      stats
    - [x86] KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation
    - [x86] KVM: nVMX: Unconditionally clear nested.pi_pending on nested
      VM-Enter
    - [arm64] KVM: arm64: Unregister HYP sections from kmemleak in protected
      mode
    - [arm64] KVM: arm64: vgic: Resample HW pending state on deactivation
    - io-wq: check max_worker limits if a worker transitions bound state
    - md/raid10: Remove unnecessary rcu_dereference in raid10_handle_discard
    - fuse: truncate pagecache on atomic_o_trunc
    - fuse: flush extending writes
    - fuse: wait for writepages in syncfs
    - fbmem: don't allow too huge resolutions
    - [amd64] ACPI: PRM: Find PRMT table before parsing it
    - RDMA/mlx5: Fix number of allocated XLT entries
    - backlight: pwm_bl: Improve bootloader/kernel device handover
    - [armel] clk: kirkwood: Fix a clocking boot regression
    - devlink: Break parameter notification sequence to be before/after
      unload/load driver
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.5
    - Revert "posix-cpu-timers: Force next expiration recalc after itimer reset"
    - Revert "time: Handle negative seconds correctly in timespec64_to_ns()"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
    - io_uring: place fixed tables under memcg limits
    - io_uring: add ->splice_fd_in checks
    - io_uring: fix io_try_cancel_userdata race for iowq
    - io-wq: fix wakeup race when adding new work
    - io-wq: fix race between adding work and activating a free worker
    - btrfs: use delalloc_bytes to determine flush amount for shrink_delalloc
    - btrfs: wake up async_delalloc_pages waiters after submit
    - btrfs: wait on async extents when flushing delalloc
    - btrfs: reduce the preemptive flushing threshold to 90%
    - btrfs: do not do preemptive flushing if the majority is global rsv
    - btrfs: zoned: fix block group alloc_offset calculation
    - btrfs: zoned: suppress reclaim error message on EAGAIN
    - btrfs: fix upper limit for max_inline for page size 64K
    - btrfs: reset replace target device to allocation state on close
    - btrfs: zoned: fix double counting of split ordered extent
    - blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
    - blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
    - [powerpc*] perf/hv-gpci: Fix counter value parsing
    - xen: fix setting of max_pfn in shared_info
    - 9p/xen: Fix end of loop tests for list_for_each_entry
    - ceph: fix dereference of null pointer cf
    - Input: elan_i2c - reduce the resume time for controller in Whitebox
    - [armhf] soc: aspeed: lpc-ctrl: Fix boundary check for mmap
    - [armhf] soc: aspeed: p2a-ctrl: Fix boundary check for mmap
    - [arm64] Move .hyp.rodata outside of the _sdata.._edata range
    - [arm64] mm: Fix TLBI vs ASID rollover
    - [arm64] head: avoid over-mapping in map_memory
    - [arm64] Do not trap PMSNEVFR_EL1
    - iio: ltc2983: fix device probe
    - [arm64] wcn36xx: Ensure finish scan is not requested before start scan
    - block: bfq: fix bfq_set_next_ioprio_data()
    - [x86] power: supply: max17042: handle fails of reading status register
    - dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()
    - [x86] crypto: ccp - shutdown SEV firmware on kexec
    - [x86] VMCI: fix NULL pointer dereference when unmapping queue pair
    - media: uvc: don't do DMA on stack
    - media: rc-loopback: return number of emitters rather than error
    - nvmem: core: fix error handling while validating keepout regions
    - [s390x] qdio: fix roll-back after timeout on ESTABLISH ccw
    - [s390x] qdio: cancel the ESTABLISH ccw after timeout
    - [armhf] Revert "dmaengine: imx-sdma: refine to load context only once"
    - [armhf] dmaengine: imx-sdma: remove duplicated sdma_load_context
    - [x86] watchdog: iTCO_wdt: Fix detection of SMI-off case
    - libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
    - sched: Prevent balance_push() on remote runqueues
    - f2fs: let's keep writing IOs on SBI_NEED_FSCK
    - f2fs: fix to do sanity check for sb/cp fields correctly
    - PCI/portdrv: Enable Bandwidth Notification only if port supports it
    - PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
    - PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
    - [arm64] PCI: xilinx-nwl: Enable the clock through CCF
    - [arm64] PCI: aardvark: Configure PCIe resources from 'ranges' DT property
    - [arm64] PCI: aardvark: Fix checking for PIO status
    - [arm64] PCI: aardvark: Increase polling delay to 1.5s while waiting for
      PIO response
    - [arm64] PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
    - HID: input: do not report stylus battery state as "full"
    - f2fs: quota: fix potential deadlock
    - [arm64] pinctrl: armada-37xx: Correct PWM pins definitions
    - scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND
    - [arm64,armhf] clk: rockchip: drop GRF dependency for rk3328/rk3036 pll
      types
    - [amd64] IB/hfi1: Adjust pkey entry in index 0
    - RDMA/iwcm: Release resources if iw_cm module initialization fails
    - docs: Fix infiniband uverbs minor number
    - scsi: BusLogic: Use %X for u32 sized integer rather than %lX
    - [armhf] pinctrl: samsung: Fix pinctrl bank pin count
    - f2fs: do not submit NEW_ADDR to read node block
    - f2fs: turn back remapped address in compressed page endio
    - f2fs: fix wrong checkpoint_changed value in f2fs_remount()
    - scsi: ufs: Fix memory corruption by ufshcd_read_desc_param()
    - scsi: ufs: Use DECLARE_COMPLETION_ONSTACK() where appropriate
    - scsi: ufs: Fix the SCSI abort handler
    - [powerpc*] cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards
    - [powerpc*] stacktrace: Include linux/delay.h
    - [arm64] RDMA/hns: Don't overwrite supplied QP attributes
    - RDMA/mlx5: Delete not-available udata check
    - [powerpc*] cpuidle: pseries: Mark pseries_idle_proble() as __init
    - f2fs: reduce the scope of setting fsck tag when de->name_len is zero
    - xprtrdma: Put rpcrdma_reps before waking the tear-down completion
    - NFSv4/pNFS: Fix a layoutget livelock loop
    - NFSv4/pNFS: Always allow update of a zero valued layout barrier
    - NFSv4/pnfs: The layout barrier indicate a minimal value for the seqid
    - SUNRPC: Fix potential memory corruption
    - SUNRPC/xprtrdma: Fix reconnection locking
    - sunrpc: Fix return value of get_srcport()
    - scsi: ufs: Fix unsigned int compared with less than zero
    - scsi: ufshcd: Fix device links when BOOT WLUN fails to probe
    - [arm64,armhf] pinctrl: single: Fix error return code in
      pcs_parse_bits_in_pinctrl_entry()
    - [powerpc*] numa: Consider the max NUMA node for migratable LPAR
    - scsi: smartpqi: Fix an error code in pqi_get_raid_map()
    - scsi: qedi: Fix error codes in qedi_alloc_global_queues()
    - scsi: qedf: Fix error codes in qedf_alloc_global_queues()
    - f2fs: fix to keep compatibility of fault injection interface
    - iommu/vt-d: Update the virtual command related registers
    - [arm64] RDMA/hns: Fix return in hns_roce_rereg_user_mr()
    - [amd64] HID: amd_sfh: Fix period data field to enable sensor
    - HID: i2c-hid: Fix Elan touchpad regression
    - HID: thrustmaster: clean up Makefile and adapt quirks
    - [arm64] RDMA/hns: Ownerbit mode add control field
    - [arm64] clk: imx8mm: use correct mux type for clkout path
    - [arm64,armhf] clk: imx8m: fix clock tree update of TF-A managed clocks
    - [powerpc*] KVM: PPC: Book3S HV: Fix copy_tofrom_guest routines
    - [powerpc*] KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when
      guest SPRs are live
    - [powerpc*] powerpc/perf: Fix the check for SIAR value
    - [arm64] RDMA/hns: Fix incorrect lsn field
    - [arm64] RDMA/hns: Bugfix for data type of dip_idx
    - [arm64] RDMA/hns: Bugfix for the missing assignment for dip_idx
    - [arm64] RDMA/hns: Bugfix for incorrect association between dip_idx and
      dgid
    - [x86] platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from
      run_smbios_call
    - [powerpc*] smp: Fix a crash while booting kvm guest with nr_cpus=2
    - [powerpc*] smp: Update cpu_core_map on all PowerPc systems
    - [arm64] RDMA/hns: Fix query destination qpn
    - [arm64] RDMA/hns: Fix QP's resp incomplete assignment
    - fscache: Fix cookie key hashing
    - [powerpc*] KVM: PPC: Fix clearing never mapped TCEs in realmode
    - f2fs: fix to account missing .skipped_gc_rwsem
    - f2fs: fix unexpected ENOENT comes from f2fs_map_blocks()
    - f2fs: fix to unmap pages from userspace process in punch_hole()
    - f2fs: deallocate compressed pages when error happens
    - f2fs: should put a page beyond EOF when preparing a write
    - [mips64el,mipsel] Malta: fix alignment of the devicetree buffer
    - userfaultfd: prevent concurrent API initialization
    - [x86] drm/vmwgfx: Fix subresource updates with new contexts
    - [x86] drm/vmwgfx: Fix some static checker warnings
    - [arm*] drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET
    - drm/ttm: Fix multihop assert on eviction.
    - [armhf] drm/omap: Follow implicit fencing in prepare_fb
    - drm/amdgpu: Fix amdgpu_ras_eeprom_init()
    - drm/amdgpu: Fix koops when accessing RAS EEPROM
    - [arm*] drm: vc4: Fix pixel-wrap issue with DVP teardown
    - dma-buf: fix dma_resv_test_signaled test_all handling v2
    - drm/panel: Fix up DT bindings for Samsung lms397kf04
    - [armhf] ASoC: ti: davinci-mcasp: Fix DIT mode support
    - media: dib8000: rewrite the init prbs logic
    - [x86] hyperv: fix for unwanted manipulation of sched_clock when TSC marked
      unstable
    - PCI: Use pci_update_current_state() in pci_enable_device_flags()
    - tipc: keep the skb in rcv queue until the whole data is read
    - net: phy: Fix data type in DP83822 dp8382x_disable_wol()
    - iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
    - iavf: do not override the adapter state in the watchdog task
    - iavf: fix locking of critical sections
    - video: fbdev: kyro: fix a DoS bug by restricting user input
    - drm/ast: Disable fast reset after DRAM initial
    - netlink: Deal with ESRCH error in nlmsg_notify()
    - [arm64] dts: qcom: Fix usb entries for SA8155p adp board
    - drm: avoid blocking in drm_clients_info's rcu section
    - drm: serialize drm_file.master with a new spinlock
    - drm: protect drm_master pointers in drm_lease.c
    - rcu: Fix macro name CONFIG_TASKS_RCU_TRACE
    - igc: Check if num of q_vectors is smaller than max before array access
    - usb: gadget: u_ether: fix a potential null pointer dereference
    - [armhf] USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable()
    - usb: gadget: composite: Allow bMaxPower=0 if self-powered
    - tty: serial: jsm: hold port lock when reporting modem line changes
    - [arm64] bus: fsl-mc: fix arg in call to dprc_scan_objects()
    - [arm64] bus: fsl-mc: fix mmio base address for child DPRCs
    - [x86] misc/pvpanic-pci: Allow automatic loading
    - nfp: fix return statement in nfp_net_parse_meta()
    - ethtool: improve compat ioctl handling
    - drm/amdgpu: Fix a printing message
    - [arm64] dts: allwinner: h6: tanix-tx6: Fix regulator node names
    - video: fbdev: kyro: Error out if 'pixclock' equals zero
    - ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
    - flow_dissector: Fix out-of-bounds warnings
    - [s390x] jump_label: print real address in a case of a jump label bug
    - [s390x] make PCI mio support a machine flag
    - serial: 8250: Define RX trigger levels for OxSemi 950 devices
    - serial: 8250_pci: make setup_port() parameters explicitly unsigned
    - vt: keyboard.c: make console an unsigned int
    - Bluetooth: skip invalid hci_sync_conn_complete_evt
    - workqueue: Fix possible memory leaks in wq_numa_init()
    - [arm64] drm/msm/a6xx: Fix llcc configuration for a660 gpu
    - netfilter: nft_compat: use nfnetlink_unicast()
    - bonding: 3ad: fix the concurrency between __bond_release_one() and
      bond_3ad_state_machine_handler()
    - [x86] ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps
      for the matching in-/output
    - Bluetooth: Fix not generating RPA when required
    - [armhf] media: imx: imx7-media-csi: Fix buffer return upon stream start
      failure
    - media: v4l2-dv-timings.c: fix wrong condition in two for-loops
    - gfs2: Fix glock recursion in freeze_go_xmote_bh
    - [arm*] misc: sram: Only map reserved areas in Tegra SYSRAM
    - [armhf] dts: imx53-ppd: Fix ACHC entry
    - [arm64] dts: qcom: sdm660: use reg value for memory node
    - [arm64] nvmem: qfprom: Fix up qfprom_disable_fuse_blowing() ordering
    - [arm64] net: ethernet: stmmac: Do not use unreachable() in
      ipq806x_gmac_probe()
    - [arm64] drm/msm: mdp4: drop vblank get/put from prepare/complete_commit
    - [arm64] drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660
    - [x86] thunderbolt: Fix port linking by checking all adapters
    - [x86] drm/vmwgfx: fix potential UAF in vmwgfx_surface.c
    - staging: rtl8723bs: fix right side of condition
    - Bluetooth: schedule SCO timeouts with delayed_work
    - Bluetooth: avoid circular locks in sco_sock_connect
    - [arm64] drm/msm/dp: reduce link rate if failed at link training 1
    - [arm64] drm/msm/dp: reset aux controller after dp_aux_cmd_fifo_tx()
      failed.
    - [arm64] drm/msm/dp: return correct edid checksum after corrupted edid
      checksum read
    - [arm64] drm/msm/dp: do not end dp link training until video is ready
    - net/mlx5: Fix variable type to match 64bit
    - gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable
      access in amdgpu_i2c_router_select_ddc_port()
    - mac80211: Fix monitor MTU limit so that A-MSDUs get through
    - nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data
    - nvme: code command_id with a genctr for use-after-free validation
    - Bluetooth: Fix handling of LE Enhanced Connection Complete
    - Bluetooth: Fix race condition in handling NOP command
    - opp: Don't print an error if required-opps is missing
    - [sh4] serial: sh-sci: fix break handling for sysrq
    - iomap: pass writeback errors to the mapping
    - tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD
    - locking/rtmutex: Set proper wait context for lockdep
    - rpc: fix gss_svc_init cleanup on failure
    - iavf: use mutexes for locking of critical sections
    - [armhf] hwmon: (pmbus/ibm-cffps) Fix write bits for LED control
    - [x86] staging: rts5208: Fix get_ms_information() heap buffer size
    - net: Fix offloading indirect devices dependency on qdisc order creation
    - gfs2: Don't call dlm after protocol is unmounted
    - [arm64,armhf] usb: chipidea: host: fix port index underflow and UBSAN
      complains
    - lockd: lockd server-side shouldn't set fl_ops
    - [armhf] drm/exynos: Always initialize mapping in exynos_drm_register_dma()
    - rtl8xxxu: Fix the handling of TX A-MPDU aggregation
    - rtw88: use read_poll_timeout instead of fixed sleep
    - rtw88: wow: build wow function only if CONFIG_PM is on
    - rtw88: wow: fix size access error of probe request
    - btrfs: remove racy and unnecessary inode transaction update when using
      no-holes
    - btrfs: tree-log: check btrfs_lookup_data_extent return value
    - soundwire: intel: fix potential race condition during power down
    - [x86] ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER
    - [x86] ASoC: Intel: Skylake: Fix passing loadable flag for module
    - of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS
    - [arm64] mmc: sdhci-of-arasan: Modified SD default speed to 19MHz for
      ZynqMP
    - [arm64] mmc: sdhci-of-arasan: Check return value of non-void funtions
    - mmc: core: Avoid hogging the CPU while polling for busy in the I/O err
      path
    - mmc: core: Avoid hogging the CPU while polling for busy for mmc ioctls
    - mmc: core: Avoid hogging the CPU while polling for busy after I/O writes
    - mmc: rtsx_pci: Fix long reads when clock is prescaled
    - mmc: core: Return correct emmc response in case of ioctl error
    - cifs: fix wrong release in sess_alloc_buffer() failed path
    - Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST
      quirk set"
    - [arm64] usb: dwc3: imx8mp: request irq after initializing dwc3
    - [armhf] usb: musb: musb_dsps: request_irq() after initializing musb
    - usbip: give back URBs for unsent unlink requests during cleanup
    - usbip:vhci_hcd USB port can get stuck in the disabled state
    - [arm64,armhf] ASoC: rockchip: i2s: Fix regmap_ops hang
    - [arm64,armhf] ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B
    - ASoC: soc-pcm: protect BE dailink state changes in trigger
    - nfs: don't atempt blocking locks on nfs reexports
    - nfsd: fix crash on LOCKT on reexported NFSv3
    - iwlwifi: pcie: free RBs during configure
    - iwlwifi: mvm: Do not use full SSIDs in 6GHz scan
    - iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed
    - iwlwifi: mvm: avoid static queue number aliasing
    - iwlwifi: mvm: Fix umac scan request probe parameters
    - iwlwifi: mvm: fix access to BSS elements
    - iwlwifi: fw: correctly limit to monitor dump
    - iwlwifi: mvm: don't schedule the roc_done_wk if it is already running
    - iwlwifi: mvm: Fix scan channel flags settings
    - net/mlx5: DR, fix a potential use-after-free bug
    - net/mlx5: DR, Enable QP retransmission
    - [arm64] usb: isp1760: fix memory pool initialization
    - [arm64] usb: isp1760: fix qtd fill length
    - [arm64] usb: isp1760: write to status and address register
    - [arm64] usb: isp1760: use the right irq status bit
    - [arm64] usb: isp1760: otg control register access
    - parport: remove non-zero check on count
    - [arm64] wcn36xx: Fix missing frame timestamp for beacon/probe-resp
    - ath9k: fix OOB read ar9300_eeprom_restore_internal
    - ath9k: fix sleeping in atomic context
    - net: fix NULL pointer reference in cipso_v4_doi_free
    - fix array-index-out-of-bounds in taprio_change
    - [arm64] net: hns3: clean up a type mismatch warning
    - printk/console: Check consistent sequence number when handling race in
      console_unlock()
    - ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup()
    - scsi: BusLogic: Fix missing pr_cont() use
    - scsi: qla2xxx: Changes to support kdump kernel
    - scsi: qla2xxx: Sync queue idx with queue_pair_map idx
    - [powerpc*] cpufreq: powernv: Fix init_chip_info initialization in numa=off
    - [s390x] pv: fix the forcing of the swiotlb
    - [s390x] topology: fix topology information when calling cpu hotplug
      notifiers
    - mm: fix panic caused by __page_handle_poison()
    - hugetlb: fix hugetlb cgroup refcounting during vma split
    - mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range()
    - mm/hmm: bypass devmap pte when all pfn requested flags are fulfilled
    - mm/hugetlb: initialize hugetlb_usage in mm_init
    - mm,vmscan: fix divide by zero in get_scan_count
    - mm/page_alloc.c: avoid accessing uninitialized pcp page migratetype
    - mm/mempolicy: fix a race between offset_il_node and mpol_rebind_task
    - memcg: enable accounting for pids in nested pid namespaces
    - libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind
    - platform/chrome: cros_ec_proto: Send command again when timeout occurs
    - net: stmmac: Fix overall budget calculation for rxtx_napi
    - [x86] drm/mgag200: Select clock in PLL update functions
    - [arm64] drm/msi/mdp4: populate priv->kms in mdp4_kms_init
    - drm/dp_mst: Fix return code on sideband message failure
    - [arm64,armhf] drm/panfrost: Make sure MMU context lifetime is not bound to
      panfrost_priv
    - drm/amdgpu: Fix BUG_ON assert
    - drm/amdgpu: Enable S/G for Yellow Carp
    - drm/amdgpu: Fix a deadlock if previous GEM object allocation fails
    - [arm64] drm/msm/disp/dpu1: add safe lut config in dpu driver
    - drm/ttm: Fix ttm_bo_move_memcpy() for subclassed struct ttm_resource
    - [arm64,armhf] drm/panfrost: Simplify lock_region calculation
    - [arm64,armhf] drm/panfrost: Use u64 for size in lock_region
    - [arm64,armhf] drm/panfrost: Clamp lock region to Bifrost minimum

  [ Vincent Blut ]
  * [arm64] drivers/bus/fsl-mc: Enable FSL_MC_UAPI_SUPPORT (Closes: #992988)
  * [arm64] drivers/vfio/fsl-mc: Enable VFIO_FSL_MC as module (Closes: #993000)
  * [arm64] drivers/firmware: Enable ARM_SCPI_PROTOCOL as module
    (Closes: #929528)
  * [arm64] drivers/hwmon: Enable SENSORS_ARM_SCPI as module
  * [arm64] drivers/mailbox: Enable ARM_MHU, PLATFORM_MHU as modules
  * [armhf] drivers/input/misc: Enable INPUT_TPS65218_PWRBUTTON as module
    (Closes: #944518)

  [ Heiko Thiery ]
  * [arm64] drivers/regulator: Enable REGULATOR_PCA9450 as module
  * [arm64] drivers/regulator: Enable REGULATOR_PFUZE100 as module
  * [arm64] drivers/pci/controller: Enable PCI_IMX6

  [ Salvatore Bonaccorso ]
  * dccp: don't duplicate ccid when cloning dccp sock (CVE-2020-16119)
  * bnx2x: Fix enabling network interfaces without VFs (Closes: #993948)
  * Refresh "kbuild: Make the toolchain variables easily overwritable"
  * Drop "Partially revert "net: socket: implement 64-bit timestamps""
  * Set ABI to 1
  * [mipsel] bpf, mips: Validate conditional branch offsets (CVE-2021-38300)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 18 Sep 2021 20:58:49 +0200

linux (5.14.3-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.3
    - firmware: dmi: Move product_sku info to the end of the modalias
    - igmp: Add ip_mc_list lock in ip_check_mc_rcu
    - Revert "r8169: avoid link-up interrupt issue on RTL8106e if user enables
      ASPM"
    - ALSA: usb-audio: Add registration quirk for JBL Quantum 800
    - Bluetooth: Add additional Bluetooth part for Realtek 8852AE
    - Bluetooth: btusb: Make the CSR clone chip force-suspend workaround more
      generic
    - xhci: fix even more unsafe memory usage in xhci tracing
    - xhci: fix unsafe memory usage in xhci tracing
    - xhci: Fix failure to give back some cached cancelled URBs.
    - [x86] reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
    - PCI: Call Max Payload Size-related fixup quirks early

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 12 Sep 2021 19:17:38 +0200

linux (5.14.2-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.2
    - ext4: fix race writing to an inline_data file while its xattrs are
      changing
    - ext4: fix e2fsprogs checksum failure for mounted filesystem
    - USB: serial: pl2303: fix GL type detection
    - USB: serial: cp210x: fix control-characters error handling
    - USB: serial: cp210x: fix flow-control error handling
    - HID: usbhid: Fix flood of "control queue full" messages
    - HID: usbhid: Fix warning caused by 0-length input reports
    - ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup
    - ALSA: usb-audio: Fix regression on Sony WALKMAN NW-A45 DAC
    - ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17
    - ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
    - ALSA: usb-audio: Work around for XRUN with low latency playback
    - media: stkwebcam: fix memory leak in stk_camera_probe

  [ Vincent Blut ]
  * drivers/media/cec: Enable MEDIA_CEC_RC (Closes: #872650)
  * drivers/hid: Enable various HID drivers as modules (Closes: #988277)
  * [x86] drivers/platform/chrome: Enable CROS_EC as module and set
    CROS_EC_PROTO explicitly
  * [arm64] sound/soc/generic: Enable SND_AUDIO_GRAPH_CARD as module
    (Closes: #987576)
  * drivers/net/wireless/mediatek/mt76/mt7915: Enable MT7915E as module
    (Closes: #993865)
  * drivers/net/wireless/mediatek/mt76/mt7921: Enable MT7921E as module
  * drivers/net/wireless/mediatek/mt76/mt7615: Enable MT7615E, MT7663U as
    modules

  [ Salvatore Bonaccorso ]
  * HID: apple: Add missing scan code event for keys handled by hid-apple
    (Closes: #757356)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 10 Sep 2021 00:20:28 +0200

linux (5.14.1-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.1
    - vt_kdsetmode: extend console locking (CVE-2021-3753)
    - Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
    - btrfs: fix NULL pointer dereference when deleting device by invalid id
      (CVE-2021-3739)
    - Revert "floppy: reintroduce O_NDELAY fix"
    - fscrypt: add fscrypt_symlink_getattr() for computing st_size
    - ext4: report correct st_size for encrypted symlinks
    - f2fs: report correct st_size for encrypted symlinks
    - ubifs: report correct st_size for encrypted symlinks
    - net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
    - audit: move put_tree() to avoid trim_trees refcount underflow and UAF

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 07 Sep 2021 08:40:13 +0200

linux (5.14-1~exp2) experimental; urgency=medium

  [ Bastian Blank ]
  * Fix perf build.
  * Enable EVM, ENCRYPTED_KEYS. (closes: #993535)
  * Enable IMA_SIG_TEMPLATE.
  * Enable AMD_SFH_HID, AMD_PMC. (closes: #992832)
  * Enable TMPFS_INODE64. (closes: #993641)
  * Move more into nic-shared-modules.

  [ Diederik de Haas ]
  * [arm64] sound/soc/codecs: Enable SND_SOC_RK3328 as module
  * [arm64,armhf] drivers/input/misc: Enable INPUT_RK805_PWRKEY as module
  * [arm64,armhf] drivers/pinctrl: Enable PINCTRL_RK805 (Closes: #990536)
  * [arm64] drivers/mfd: Make MFD_RK808 builtin

 -- Bastian Blank <waldi@debian.org>  Sun, 05 Sep 2021 20:51:25 +0200

linux (5.14-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.14

  [ Aurelien Jarno ]
  * [riscv64] Enable KEXEC.
  * [riscv64] Add initial Microchip Polarfire support: enable
    SOC_MICROCHIP_POLARFIRE, MMC_SDHCI_PLTFM, MMC_SDHCI_CADENCE and
    PCIE_MICROCHIP_HOST.
  * [riscv64] Improve HiFive Unmatched support: enable PCIE_DW_PLAT_HOST and
    PCIE_FU740.

  [ Vincent Blut ]
  * [armhf] drivers/leds: Enable LEDS_PCA963X as module (Closes: #908196)

  [ Salvatore Bonaccorso ]
  * net/batman-adv: Enable BATMAN_ADV_BATMAN_V

  [ Bastian Blank ]
  * [powerpc*] Disable support for debugging VDSO.

 -- Bastian Blank <waldi@debian.org>  Wed, 01 Sep 2021 21:49:53 +0200

linux (5.13.12-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.10
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.11
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.12

  [ Salvatore Bonaccorso ]
  * net: Enable MPTCP (Closes: #987815)

  [ Bastian Blank ]
  * [mips*] Increase RELOCATION_TABLE_SIZE to 0x1c0000.
  * Enable SECURITY_LANDLOCK, SECURITY_PATH.
  * Fix external modules build. (closes: #992219)
  * Force more compressions modules into main installer package.
    (closes: #992221)
  * Drop redundant patch for overlay in user namespace.

  [ Uwe Kleine-König ]
  * [x86] Enable X86_PLATFORM_DRIVERS_DELL which is needed to keep some Dell
    specific drivers. (Closes: #992251)

 -- Bastian Blank <waldi@debian.org>  Fri, 20 Aug 2021 22:39:29 +0200

linux (5.13.9-1~exp2) experimental; urgency=medium

  * Fix linux-cpupower installation.

 -- Bastian Blank <waldi@debian.org>  Tue, 10 Aug 2021 21:12:41 +0200

linux (5.13.9-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.11
  * New upstream release: https://kernelnewbies.org/Linux_5.12
  * New upstream release: https://kernelnewbies.org/Linux_5.13

  [ Bastian Blank ]
  * Always build-depend on native libelf-dev.
  * Specify trusted certs file in package config.
  * Enable PROC_VMCORE.
  * Enable SECURITYFS.
  * Re-enable IMA. (closes: #972459)
  * [x86] Enable AMD_MEM_ENCRYPT. (closes: #983586, #989040)
  * Enable UNICODE. (closes: #985689)
  * Enable CGROUP_MISC.
  * [x86] Enable PINCTRL_ALDERLAKE, PINCTRL_ELKHARTLAKE, PINCTRL_EMMITSBURG,
    PINCTRL_JASPERLAKE, PINCTRL_LAKEFIELD.
  * [amd64] Enable MICROSOFT_MANA.
  * [arm64] Enable GVE. (closes: #991835)

 -- Bastian Blank <waldi@debian.org>  Mon, 09 Aug 2021 18:35:43 +0200

linux (5.10.46-4) unstable; urgency=medium

  * bpf: Introduce BPF nospec instruction for mitigating Spectre v4
    (CVE-2021-34556, CVE-2021-35477)
  * bpf: Fix leakage due to insufficient speculative store bypass mitigation
    (CVE-2021-34556, CVE-2021-35477)
  * bpf: Remove superfluous aux sanitation on subprog rejection
  * Ignore ABI changes for bpf_offload_dev_create and bpf_verifier_log_write
  * bpf: Add kconfig knob for disabling unpriv bpf by default
  * init: Enable BPF_UNPRIV_DEFAULT_OFF (Closes: #990411)
  * linux-image: Add NEWS entry documenting that unprivileged calls to bpf() are
    disabled by default in Debian.
  * bpf: verifier: Allocate idmap scratch in verifier env
  * bpf: Fix pointer arithmetic mask tightening under state pruning

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 03 Aug 2021 07:50:50 +0200

linux (5.10.46-3) unstable; urgency=medium

  * [armhf] Add mdio-aspeed to nic-modules.
    Thanks to Joel Stanley <joel@jms.id.au> (Closes: #991262)
  * Revert "drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue."
    (Closes: #990312)
  * Revert "drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full
    doorbell." (Closes: #990312)
  * Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl
    (CVE-2021-3612)
  * sctp: validate from_addr_param return (CVE-2021-3655)
  * sctp: add size validation when walking chunks (CVE-2021-3655)
  * [s390x] sclp_vt220: fix console name to match device (Closes: #961056)
  * block: return the correct bvec when checking for gaps
  * sctp: fix return value check in __sctp_rcv_asconf_lookup

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 28 Jul 2021 07:55:40 +0200

linux (5.10.46-2) unstable; urgency=medium

  * swiotlb: manipulate orig_addr when tlb_addr has offset (Closes: #989778)
  * KVM: do not allow mapping valid but non-reference-counted pages
    (CVE-2021-22543)
  * [x86] platform/x86: toshiba_haps: Fix missing newline in pr_debug call in
    toshiba_haps_notify (Closes: #799193)
  * seq_file: Disallow extremely large seq buffer allocations (CVE-2021-33909)

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 20 Jul 2021 14:06:36 +0200

linux (5.10.46-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.41
    - context_tracking: Move guest exit context tracking to separate helpers
    - context_tracking: Move guest exit vtime accounting to separate helpers
    - [x86] KVM: Defer vtime accounting 'til after IRQ handling
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.42
    - ALSA: hda/realtek: the bass speaker can't output sound on Yoga 9i
    - ALSA: hda/realtek: Headphone volume is controlled by Front mixer
    - ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation P340
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
    - ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook G8
    - ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 15
      G8
    - ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 17
      G8
    - ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
    - ALSA: usb-audio: scarlett2: Improve driver startup messages
    - cifs: set server->cipher_type to AES-128-CCM for SMB3.0
    - NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()
    - iommu/vt-d: Fix sysfs leak in alloc_iommu()
    - proc: Check /proc/$pid/attr/ writes against file opener
    - net: hso: fix control-request directions
    - net/sched: fq_pie: re-factor fix for fq_pie endless loop
    - net/sched: fq_pie: fix OOB access in the traffic path
    - netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to
      non-AVX2 version
    - mac80211: assure all fragments are encrypted (CVE-2020-26147)
    - mac80211: prevent mixed key and fragment cache attacks (CVE-2020-24586,
      CVE-2020-24587)
    - mac80211: properly handle A-MSDUs that start with an RFC 1042 header
    - cfg80211: mitigate A-MSDU aggregation attacks (CVE-2020-24588)
    - mac80211: drop A-MSDUs on old ciphers (CVE-2020-24588)
    - mac80211: add fragment cache to sta_info
    - mac80211: check defrag PN against current frame
    - mac80211: prevent attacks on TKIP/WEP as well
    - mac80211: do not accept/forward invalid EAPOL frames (CVE-2020-26139)
    - mac80211: extend protection against mixed key and fragment cache attacks
      (CVE-2020-24586, CVE-2020-24587)
    - ath10k: add CCMP PN replay protection for fragmented frames for PCIe
    - ath10k: drop fragments with multicast DA for PCIe (CVE-2020-26145)
    - ath10k: drop fragments with multicast DA for SDIO (CVE-2020-26145)
    - ath10k: drop MPDU which has discard flag set by firmware for SDIO
      (CVE-2020-24588)
    - ath10k: Fix TKIP Michael MIC verification for PCIe (CVE-2020-26141)
    - ath10k: Validate first subframe of A-MSDU before processing the list
    - ath11k: Clear the fragment cache during key install (CVE-2020-24587)
    - dm snapshot: properly fix a crash when an origin has no snapshots
    - drm/amdgpu/vcn1: add cancel_delayed_work_sync before power gate
    - [amd64] drm/amdkfd: correct sienna_cichlid SDMA RLC register offset error
    - drm/amdgpu/vcn2.0: add cancel_delayed_work_sync before power gate
    - drm/amdgpu/vcn2.5: add cancel_delayed_work_sync before power gate
    - drm/amdgpu/jpeg2.0: add cancel_delayed_work_sync before power gate
    - Documentation: seccomp: Fix user notification documentation
    - seccomp: Refactor notification handler to prepare for new semantics
    - serial: core: fix suspicious security_locked_down() call
    - misc/uss720: fix memory leak in uss720_probe
    - [x86] thunderbolt: usb4: Fix NVM read buffer bounds and offset issue
    - [x86] thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
    - [x86] KVM: Fix vCPU preempted state from guest's point of view
    - [arm64] KVM: Prevent mixed-width VM creation
    - [x86] mei: request autosuspend after sending rx flow control
    - iio: gyro: fxas21002c: balance runtime power in error path
    - iio: dac: ad5770r: Put fwnode in error case during ->probe()
    - iio: adc: ad7768-1: Fix too small buffer passed to
      iio_push_to_buffers_with_timestamp()
    - iio: adc: ad7124: Fix missbalanced regulator enable / disable on error.
    - iio: adc: ad7124: Fix potential overflow due to non sequential channel
      numbers
    - iio: adc: ad7923: Fix undersized rx buffer.
    - iio: adc: ad7793: Add missing error code in ad7793_setup()
    - iio: adc: ad7192: Avoid disabling a clock that was never enabled.
    - iio: adc: ad7192: handle regulator voltage error first
    - serial: 8250: Add UART_BUG_TXRACE workaround for Aspeed VUART
    - serial: 8250_dw: Add device HID for new AMD UART controller
    - serial: 8250_pci: Add support for new HPE serial device
    - serial: 8250_pci: handle FL_NOIRQ board flag
    - USB: trancevibrator: fix control-request direction
    - Revert "irqbypass: do not start cons/prod when failed connect"
    - USB: usbfs: Don't WARN about excessively large memory allocations
    - drivers: base: Fix device link removal
    - [arm64,armhf] serial: tegra: Fix a mask operation that is always true
    - serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
    - USB: serial: ti_usb_3410_5052: add startech.com device id
    - USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011
    - USB: serial: ftdi_sio: add IDs for IDS GmbH Products
    - USB: serial: pl2303: add device id for ADLINK ND-6530 GC
    - [x86] thermal/drivers/intel: Initialize RW trip to THERMAL_TEMP_INVALID
    - [arm64,armhf] usb: dwc3: gadget: Properly track pending and queued SG
    - [arm64,x86] usb: typec: mux: Fix matching with typec_altmode_desc
    - net: usb: fix memory leak in smsc75xx_bind
    - Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
    - fs/nfs: Use fatal_signal_pending instead of signal_pending
    - NFS: fix an incorrect limit in filelayout_decode_layout()
    - NFS: Fix an Oopsable condition in __nfs_pageio_add_request()
    - NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()
    - NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config
    - [arm64] drm/meson: fix shutdown crash when component not probed
    - net/mlx5e: reset XPS on error flow if netdev isn't registered yet
    - net/mlx5e: Fix multipath lag activation
    - net/mlx5e: Fix error path of updating netdev queues
    - {net,vdpa}/mlx5: Configure interface MAC into mpfs L2 table
    - net/mlx5e: Fix nullptr in add_vlan_push_action()
    - net/mlx5: Set reformat action when needed for termination rules
    - net/mlx5e: Fix null deref accessing lag dev
    - net/mlx4: Fix EEPROM dump support
    - net/mlx5: Set term table as an unmanaged flow table
    - SUNRPC in case of backlog, hand free slots directly to waiting task
    - Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv"
    - tipc: wait and exit until all work queues are done
    - tipc: skb_linearize the head skb when reassembling msgs
    - [arm64] spi: spi-fsl-dspi: Fix a resource leak in an error handling path
    - netfilter: flowtable: Remove redundant hw refresh bit
    - [arm64,armhf] net: dsa: fix a crash if ->get_sset_count() fails
    - [armhf] i2c: s3c2410: fix possible NULL pointer deref on read message
      after write
    - [x86] i2c: i801: Don't generate an interrupt on bus reset
    - afs: Fix the nlink handling of dir-over-dir rename
    - nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response
    - [x86] platform/x86: hp_accel: Avoid invoking _INI to speed up resume
    - [arm64] Revert "crypto: cavium/nitrox - add an error message to explain
      the failure of pci_request_mem_regions"
    - Revert "media: usb: gspca: add a missed check for goto_low_power"
    - [i386] Revert "ALSA: sb: fix a missing check of snd_ctl_add"
    - Revert "net: fujitsu: fix a potential NULL pointer dereference"
    - net: fujitsu: fix potential null-ptr-deref
    - Revert "net/smc: fix a NULL pointer dereference"
    - net/smc: properly handle workqueue allocation failure
    - [x86] Revert "char: hpet: fix a missing check of ioremap"
    - [x86] char: hpet: add checks after calling ioremap
    - [i386] Revert "ALSA: gus: add a check of the status of snd_ctl_add"
    - Revert "isdn: mISDNinfineon: fix potential NULL pointer dereference"
    - isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io
    - Revert "ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd()"
    - ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd()
    - Revert "isdn: mISDN: Fix potential NULL pointer dereference of kzalloc"
    - isdn: mISDN: correctly handle ph_info allocation failure in
      hfcsusb_ph_info
    - [arm64] Revert "dmaengine: qcom_hidma: Check for driver register failure"
    - [arm64] dmaengine: qcom_hidma: comment platform_driver_register call
    - Revert "libertas: add checks for the return value of sysfs_create_group"
    - libertas: register sysfs groups properly
    - Revert "media: dvb: Add check on sp8870_readreg"
    - media: dvb: Add check on sp8870_readreg return
    - Revert "media: gspca: mt9m111: Check write_bridge for timeout"
    - media: gspca: mt9m111: Check write_bridge for timeout
    - Revert "media: gspca: Check the return value of write_bridge for timeout"
    - media: gspca: properly check for errors in po1030_probe()
    - Revert "net: liquidio: fix a NULL pointer dereference"
    - net: liquidio: Add missing null pointer checks
    - Revert "brcmfmac: add a check for the status of usb_register"
    - brcmfmac: properly check for bus register errors
    - btrfs: return whole extents in fiemap
    - [powerpc,x86] scsi: BusLogic: Fix 64-bit system enumeration error for
      Buslogic
    - scsi: pm80xx: Fix drives missing during rmmod/insmod loop
    - btrfs: release path before starting transaction when cloning inline extent
    - btrfs: do not BUG_ON in link_to_fixup_dir
    - [x86] platform/x86: hp-wireless: add AMD's hardware id to the supported
      list
    - SMB3: incorrect file id in requests compounded with open
    - drm/amd/amdgpu: fix refcount leak
    - drm/amdgpu: Fix a use-after-free
    - drm/amd/amdgpu: fix a potential deadlock in gpu reset
    - drm/amdgpu: stop touching sched.ready in the backend
    - block: fix a race between del_gendisk and BLKRRPART
    - linux/bits.h: fix compilation error with GENMASK
    - [arm64,armhf] net: dsa: fix error code getting shifted with 4 in
      dsa_slave_get_sset_count
    - net: stmmac: Fix MAC WoL not working if PHY does not support WoL
    - spi: Assume GPIO CS active high in ACPI case
    - net: really orphan skbs tied to closing sk
    - net: packetmmap: fix only tx timestamp on request
    - [arm64,armhf] net: fec: fix the potential memory leak in fec_enet_init()
    - [arm64] net: mdio: thunder: Fix a double free issue in the .remove
      function
    - [mips64el,mipsel] net: mdio: octeon: Fix some double free issues
    - cxgb4/ch_ktls: Clear resources when pf4 device is removed
    - openvswitch: meter: fix race when getting now_ms.
    - net: sched: fix packet stuck problem for lockless qdisc
    - net: sched: fix tx action rescheduling issue during deactivation
    - net: sched: fix tx action reschedule issue with stopped queue
    - net: hso: check for allocation failure in hso_create_bulk_serial_device()
    - net: bnx2: Fix error return code in bnx2_init_board()
    - bnxt_en: Include new P5 HV definition in VF check.
    - bnxt_en: Fix context memory setup for 64K page size.
    - mld: fix panic in mld_newpack()
    - net/smc: remove device from smcd_dev_list after failed device_add()
    - [amd64] gve: Check TX QPL was actually assigned
    - [amd64] gve: Update mgmt_msix_idx if num_ntfy changes
    - [amd64] gve: Add NULL pointer checks when freeing irqs.
    - [amd64] gve: Upgrade memory barrier in poll routine
    - [amd64] gve: Correct SKB queue index validation.
    - [arm64] net: hns3: fix incorrect resp_msg issue
    - [arm64] net: hns3: put off calling register_netdev() until client
      initialize complete
    - [amd64] iommu/vt-d: Use user privilege for RID2PASID translation
    - cxgb4: avoid accessing registers when clearing filters
    - bpf, offload: Reorder offload callback 'prepare' in verifier
    - bpf: Set mac_len in bpf_skb_change_head
    - ixgbe: fix large MTU request from VF
    - [arm64] ASoC: qcom: lpass-cpu: Use optional clk APIs
    - scsi: libsas: Use _safe() loop in sas_resume_port()
    - ipv6: record frag_max_size in atomic fragments in input path
    - ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create() can be
      static
    - sch_dsmark: fix a NULL deref in qdisc_reset()
    - net: zero-initialize tc skb extension on allocation
    - [arm64,armhf] net: mvpp2: add buffer header handling in RX
    - [x86] i915: fix build warning in intel_dp_get_link_status()
    - [arm64] net: hns3: check the return of skb_checksum_help()
    - bpftool: Add sock_release help info for cgroup attach/prog load command
    - SUNRPC: More fixes for backlog congestion
    - net: hso: bail out on interrupt URB allocation failure
    - neighbour: Prevent Race condition in neighbour subsytem
    - usb: core: reduce power-on-good delay time of root hub
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.43
    - btrfs: tree-checker: do not error out if extent ref hash doesn't match
    - net: usb: cdc_ncm: don't spew notifications (Closes: #989451)
    - [x86] hwmon: (dell-smm-hwmon) Fix index values
    - netfilter: conntrack: unregister ipv4 sockopts on error unwind
    - efi/fdt: fix panic when no valid fdt found
    - efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared
    - efi/libstub: prevent read overflow in find_file_option()
    - [arm64,x86] efi: cper: fix snprintf() use in cper_dimm_err_location()
    - vfio/pci: Fix error return code in vfio_ecap_init()
    - ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service
    - HID: logitech-hidpp: initialize level variable
    - HID: pidff: fix error return code in hid_pidff_init()
    - [arm64,x86] HID: i2c-hid: fix format string mismatch
    - devlink: Correct VIRTUAL port to not have phys_port attributes
    - net/sched: act_ct: Offload connections with commit action
    - net/sched: act_ct: Fix ct template allocation for zone 0
    - nvme-rdma: fix in-casule data send for chained sgls
    - ACPICA: Clean up context mutex during object deletion
    - perf probe: Fix NULL pointer dereference in convert_variable_location()
    - net: sock: fix in-kernel mark setting
    - net/mlx5e: Fix incompatible casting
    - net/mlx5: Check firmware sync reset requested is set before trying to
      abort it
    - net/mlx5e: Check for needed capability for cvlan matching
    - net/mlx5: DR, Create multi-destination flow table with level less than 64
    - nvmet: fix freeing unallocated p2pmem
    - netfilter: nft_ct: skip expectations for confirmed conntrack
    - netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches
    - bpf: Simplify cases in bpf_base_func_proto
    - bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks
    - ieee802154: fix error return code in ieee802154_add_iface()
    - ieee802154: fix error return code in ieee802154_llsec_getparams()
    - igb: add correct exception tracing for XDP
    - ixgbevf: add correct exception tracing for XDP
    - cxgb4: fix regression with HASH tc prio value update
    - ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions
    - ice: Fix allowing VF to request more/less queues via virtchnl
    - ice: Fix VFR issues for AVF drivers that expect ATQLEN cleared
    - ice: handle the VF VSI rebuild failure
    - ice: report supported and advertised autoneg using PHY capabilities
    - ice: Allow all LLDP packets from PF to Tx
    - cxgb4: avoid link re-train during TC-MQPRIO configuration
    - i40e: optimize for XDP_REDIRECT in xsk path
    - i40e: add correct exception tracing for XDP
    - ice: simplify ice_run_xdp
    - ice: optimize for XDP_REDIRECT in xsk path
    - ice: add correct exception tracing for XDP
    - ixgbe: optimize for XDP_REDIRECT in xsk path
    - ixgbe: add correct exception tracing for XDP
    - [arm64] optee: use export_uuid() to copy client UUID
    - [armhf] bus: ti-sysc: Fix am335x resume hang for usb otg module
    - [arm64] dts: freescale: sl28: var4: fix RGMII clock and voltage
    - [armhf] bus: ti-sysc: Fix flakey idling of uarts and stop using
      swsup_sidle_act
    - tipc: add extack messages for bearer/media failure
    - tipc: fix unique bearer names sanity check
    - [armhf] serial: stm32: fix threaded interrupt handling
    - io_uring: fix link timeout refs
    - io_uring: use better types for cflags
    - drm/amdgpu/vcn3: add cancel_delayed_work_sync before power gate
    - drm/amdgpu/jpeg2.5: add cancel_delayed_work_sync before power gate
    - drm/amdgpu/jpeg3: add cancel_delayed_work_sync before power gate
    - Bluetooth: fix the erroneous flush_work() order (CVE-2021-3564)
    - Bluetooth: use correct lock to prevent UAF of hdev object (CVE-2021-3573)
    - wireguard: do not use -O3
    - wireguard: peer: allocate in kmem_cache
    - wireguard: use synchronize_net rather than synchronize_rcu
    - wireguard: allowedips: initialize list head in selftest
    - wireguard: allowedips: remove nodes in O(1)
    - wireguard: allowedips: allocate nodes in kmem_cache
    - wireguard: allowedips: free empty intermediate nodes when removing single
      node
    - [arm64,x86] HID: i2c-hid: Skip ELAN power-on command after reset
    - HID: magicmouse: fix NULL-deref on disconnect
    - HID: multitouch: require Finger field to mark Win8 reports as MT
    - gfs2: fix scheduling while atomic bug in glocks
    - ALSA: timer: Fix master timer notification
    - ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx
    - ALSA: hda: update the power_state during the direct-complete
    - ext4: fix memory leak in ext4_fill_super
    - ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed
    - ext4: fix fast commit alignment issues
    - ext4: fix memory leak in ext4_mb_init_backend on error path.
    - ext4: fix accessing uninit percpu counter variable with fast_commit
    - [arm*] usb: dwc2: Fix build in periphal-only mode
    - pid: take a reference when initializing `cad_pid`
    - ocfs2: fix data corruption by fallocate
    - mm/page_alloc: fix counting of free pages after take off from buddy
    - [x86] cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
      update_pasid()
    - nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect
      (CVE-2021-3587)
    - drm/amdgpu: Don't query CE and UE errors
    - drm/amdgpu: make sure we unpin the UVD BO
    - [x86] apic: Mark _all_ legacy interrupts when IO/APIC is missing
    - [powerpc] kprobes: Fix validation of prefixed instructions across page
      boundary
    - btrfs: mark ordered extent and inode with error if we fail to finish
    - btrfs: fix error handling in btrfs_del_csums
    - btrfs: return errors from btrfs_del_csums in cleanup_ref_head
    - btrfs: fixup error handling in fixup_inode_link_counts
    - btrfs: abort in rename_exchange if we fail to insert the second ref
    - btrfs: fix deadlock when cloning inline extents and low on available space
    - mm, hugetlb: fix simple resv_huge_pages underflow on UFFDIO_COPY
    - [arm64] drm/msm/dpu: always use mdp device to scale bandwidth
    - btrfs: fix unmountable seed device after fstrim
    - [x86] KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode
    - [arm64] KVM: Fix debug register indexing
    - [x86] kvm: Teardown PV features on boot CPU as well
    - [x86] kvm: Disable kvmclock on all CPUs on shutdown
    - [x86] kvm: Disable all PV features on crash
    - lib/lz4: explicitly support in-place decompression
    - netfilter: nf_tables: missing error reporting for not selected expressions
    - xen-netback: take a reference to the RX task thread (CVE-2021-28691)
    - neighbour: allow NUD_NOARP entries to be forced GCed
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.44
    - proc: Track /proc/$pid/attr/ opener mm_struct
    - [amd64] ASoC: amd: fix for pcm_read() error
    - spi: Fix spi device unregister flow
    - bpf: Forbid trampoline attach for functions with variable arguments
    - net/nfc/rawsock.c: fix a permission check bug
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L
      tablet
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830
      tablet
    - [arm64,armhf] usb: chipidea: udc: assign interrupt number to USB gadget
      structure
    - bonding: init notify_work earlier to avoid uninitialized use
    - netlink: disable IRQs for netlink_lock_table()
    - net: mdiobus: get rid of a BUG_ON()
    - cgroup: disable controllers at parse time
    - wq: handle VM suspension in stall detection
    - net/qla3xxx: fix schedule while atomic in ql_sem_spinlock
    - RDS tcp loopback connection can hang
    - net:sfc: fix non-freed irq in legacy irq mode
    - scsi: bnx2fc: Return failure if io_req is already in ABTS processing
    - [x86] scsi: vmw_pvscsi: Set correct residual data length
    - [arm64] scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated
      irq
    - scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal
    - net: macb: ensure the device is available before accessing GEMGXL control
      registers
    - nvme-fabrics: decode host pathing error for connect
    - dm verity: fix require_signatures module_param permissions
    - bnx2x: Fix missing error code in bnx2x_iov_init_one()
    - nvmet: fix false keep-alive timeout when a controller is torn down
    - spi: Don't have controller clean up spi device before driver unbind
    - spi: Cleanup on failure of initial setup
    - [powerpc] i2c: mpc: Make use of i2c_recover_bus()
    - [powerpc] i2c: mpc: implement erratum A-004447 workaround
    - ALSA: seq: Fix race of snd_seq_timer_open()
    - ALSA: firewire-lib: fix the context to call snd_pcm_stop_xrun()
    - ALSA: hda/realtek: headphone and mic don't work on an Acer laptop
    - ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite
      Dragonfly G2
    - ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360
      1040 G8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
    - [arm*] spi: bcm2835: Fix out-of-bounds access with more than 4 slaves
    - Revert "ACPI: sleep: Put the FACS table after using it"
    - drm: Fix use-after-free read in drm_getunique()
    - drm: Lock pointer access in drm_master_release()
    - [x86] perf/x86/intel/uncore: Fix M2M event umask for Ice Lake server
    - [x86] KVM: X86: MMU: Use the correct inherited permissions to get shadow
      page
    - kvm: avoid speculation-based attacks from out-of-range memslot accesses
    - [arm64,x86] staging: rtl8723bs: Fix uninitialized variables
    - async_xor: check src_offs is not NULL before updating it
    - btrfs: return value from btrfs_mark_extent_written() in case of error
    - btrfs: promote debugging asserts to full-fledged checks in validate_super
    - cgroup1: don't allow '\n' in renaming
    - ftrace: Do not blindly read the ip address in ftrace_bug()
    - USB: f_ncm: ncm_bitrate (speed) is unsigned
    - usb: f_ncm: only first packet of aggregate needs to start timer
    - usb: pd: Set PD_T_SINK_WAIT_CAP to 310ms
    - [arm64,armhf] usb: dwc3-meson-g12a: fix usb2 PHY glue init when phy0 is
      disabled
    - [arm64,armhf] usb: dwc3: meson-g12a: Disable the regulator in the error
      handling path of the probe
    - [arm64,armhf] usb: dwc3: gadget: Bail from dwc3_gadget_exit() if
      dwc->gadget is NULL
    - [arm64,armhf] usb: dwc3: ep0: fix NULL pointer exception
    - [arm64,armhf] usb: musb: fix MUSB_QUIRK_B_DISCONNECT_99 handling
    - usb: typec: ucsi: Clear PPM capability data in ucsi_init() error path
    - usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind
    - USB: serial: ftdi_sio: add NovaTech OrionMX product ID
    - USB: serial: omninet: add device id for Zyxel Omni 56K Plus
    - USB: serial: quatech2: fix control-request directions
    - USB: serial: cp210x: fix alternate function for CP2102N QFN20
    - usb: gadget: eem: fix wrong eem header operation
    - usb: fix various gadgets null ptr deref on 10gbps cabling.
    - usb: fix various gadget panics on 10gbps cabling
    - usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister
      tcpm port
    - usb: typec: tcpm: cancel frs hrtimer when unregister tcpm port
    - regulator: core: resolve supply for boot-on/always-on regulators
    - [arm64] regulator: max77620: Use device_set_of_node_from_dev()
    - regulator: bd71828: Fix .n_voltages settings
    - [arm64,armhf] usb: dwc3: gadget: Disable gadget IRQ during pullup disable
    - usb: typec: mux: Fix copy-paste mistake in typec_mux_match
    - [arm64] drm/msm/a6xx: fix incorrectly set uavflagprd_inv field for A650
    - [arm64] drm/msm/a6xx: update/fix CP_PROTECT initialization
    - [arm64] drm/msm/a6xx: avoid shadow NULL reference in failure path
    - RDMA/ipoib: Fix warning caused by destroying non-initial netns
    - RDMA/mlx4: Do not map the core_clock page to user space unless enabled
    - ASoC: core: Fix Null-point-dereference in fmt_single_name()
    - perf: Fix data race between pin_count increment/decrement
    - sched/fair: Keep load_avg and load_sum synced
    - sched/fair: Make sure to update tg contrib for blocked load
    - sched/fair: Fix util_est UTIL_AVG_UNCHANGED handling
    - [x86] nmi_watchdog: Fix old-style NMI watchdog regression on old Intel
      CPUs
    - [x86] KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint
      message
    - IB/mlx5: Fix initializing CQ fragments buffer
    - NFS: Fix a potential NULL dereference in nfs_get_client()
    - NFSv4: Fix deadlock between nfs4_evict_inode() and
      nfs4_opendata_get_inode()
    - kvm: fix previous commit for 32-bit builds
    - NFS: Fix use-after-free in nfs4_init_client()
    - NFSv4: Fix second deadlock in nfs4_evict_inode()
    - NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error.
    - scsi: core: Fix error handling of scsi_host_alloc()
    - scsi: core: Fix failure handling of scsi_add_host_with_dma()
    - scsi: core: Put .shost_dev in failure path if host state changes to
      RUNNING
    - scsi: core: Only put parent device if host state differs from
      SHOST_CREATED
    - tracing: Correct the length check which causes memory corruption
    - proc: only require mm_struct for writing
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.45
    - net: ieee802154: fix null deref in parse dev addr
    - HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for Saitek X65
    - HID: a4tech: use A4_2WHEEL_MOUSE_HACK_B8 for A4TECH NB-95
    - HID: hid-input: add mapping for emoji picker key
    - HID: hid-sensor-hub: Return error for hid_set_field() failure
    - HID: quirks: Add quirk for Lenovo optical mouse
    - HID: multitouch: set Stylus suffix for Stylus-application devices, too
    - HID: Add BUS_VIRTUAL to hid_connect logging
    - HID: usbhid: fix info leak in hid_submit_ctrl
    - [arm64,armhf] drm/tegra: sor: Do not leak runtime PM reference
    - [arm64,armhf] gpu: host1x: Split up client initalization and registration
    - [arm64,armhf] drm/tegra: sor: Fully initialize SOR before registration
    - gfs2: Prevent direct-I/O write fallback errors from getting lost
    - gfs2: fix a deadlock on withdraw-during-mount
    - HID: gt683r: add missing MODULE_DEVICE_TABLE
    - gfs2: Fix use-after-free in gfs2_glock_shrink_scan
    - scsi: target: core: Fix warning on realtime kernels
    - ethernet: myri10ge: Fix missing error code in myri10ge_probe()
    - scsi: qedf: Do not put host in qedf_vport_create() unconditionally
    - Bluetooth: Add a new USB ID for RTL8822CE
    - scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V
    - net: ipconfig: Don't override command-line hostnames or domains
    - drm/amd/display: Allow bandwidth validation for 0 streams.
    - drm/amdgpu: refine amdgpu_fru_get_product_info
    - drm/amd/display: Fix potential memory leak in DMUB hw_init
    - drm/amd/amdgpu:save psp ring wptr to avoid attack
    - rtnetlink: Fix missing error code in rtnl_bridge_notify()
    - net: Return the correct errno code
    - fib: Return the correct errno code
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.46
    - afs: Fix an IS_ERR() vs NULL check
    - mm/memory-failure: make sure wait for page writeback in memory_failure
    - [x86] kvm: LAPIC: Restore guard to prevent illegal APIC register access
    - fanotify: fix copy_event_to_user() fid error clean up
    - batman-adv: Avoid WARN_ON timing related checks
    - mac80211: fix skb length check in ieee80211_scan_rx()
    - net: ipv4: fix memory leak in netlbl_cipsov4_add_std
    - vrf: fix maximum MTU
    - net: rds: fix memory leak in rds_recvmsg
    - [arm64] net: dsa: felix: re-enable TX flow control in ocelot_port_flush()
    - netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local
    - ice: add ndo_bpf callback for safe mode netdev ops
    - ice: parameterize functions responsible for Tx ring management
    - udp: fix race between close() and udp_abort()
    - rtnetlink: Fix regression in bridge VLAN configuration
    - net/sched: act_ct: handle DNAT tuple collision
    - net/mlx5e: Fix page reclaim for dead peer hairpin
    - net/mlx5: Consider RoCE cap before init RDMA resources
    - net/mlx5: DR, Allow SW steering for sw_owner_v2 devices
    - net/mlx5: DR, Don't use SW steering when RoCE is not supported
    - net/mlx5e: Block offload of outer header csum for UDP tunnels
    - netfilter: synproxy: Fix out of bounds when parsing TCP options
    - sch_cake: Fix out of bounds when parsing TCP options and header
    - alx: Fix an error handling path in 'alx_probe()'
    - cxgb4: fix endianness when flashing boot image
    - cxgb4: fix sleep in atomic when flashing PHY firmware
    - cxgb4: halt chip before flashing PHY firmware image
    - net: make get_net_ns return error if NET_NS is disabled
    - ethtool: strset: fix message length calculation
    - qlcnic: Fix an error handling path in 'qlcnic_probe()'
    - netxen_nic: Fix an error handling path in 'netxen_nic_probe()'
    - cxgb4: fix wrong ethtool n-tuple rule lookup
    - ipv4: Fix device used for dst_alloc with local routes
    - net: qrtr: fix OOB Read in qrtr_endpoint_post
    - bpf: Fix leakage under speculation on mispredicted branches
      (CVE-2021-33624)
    - ptp: improve max_adj check against unreasonable values
    - net: cdc_ncm: switch to eth%d interface naming
    - net: usb: fix possible use-after-free in smsc75xx_bind
    - [arm64,armhf] net: fec_ptp: fix issue caused by refactor the fec_devtype
    - net: ipv4: fix memory leak in ip_mc_add1_src
    - net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
    - net/mlx5: E-Switch, Read PF mac address
    - net/mlx5: E-Switch, Allow setting GUID for host PF vport
    - net/mlx5: Reset mkey index on creation
    - be2net: Fix an error handling path in 'be_probe()'
    - net: hamradio: fix memory leak in mkiss_close
    - net: cdc_eem: fix tx fixup skb leak
    - cxgb4: fix wrong shift.
    - bnxt_en: Rediscover PHY capabilities after firmware reset
    - bnxt_en: Fix TQM fastpath ring backing store computation
    - bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path
    - icmp: don't send out ICMP messages with a source address of 0.0.0.0
    - [x86] platform/x86: thinkpad_acpi: Add X1 Carbon Gen 9 second fan support
    - sched/pelt: Ensure that *_sum is always synced with *_avg
    - [armhf] spi: stm32-qspi: Always wait BUSY bit to be cleared in
      stm32_qspi_wait_cmd()
    - ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire
      mode
    - [arm64,armhf] drm/sun4i: dw-hdmi: Make HDMI PHY into a platform device
    - [arm64] ASoC: qcom: lpass-cpu: Fix pop noise during audio capture begin
    - radeon: use memcpy_to/fromio for UVD fw upload
    - mm: relocate 'write_protect_seq' in struct mm_struct
    - [arm64,armhf] irqchip/gic-v3: Workaround inconsistent PMR setting on NMI
      entry
    - bpf: Inherit expanded/patched seen count from old aux data
      (CVE-2021-33624)
    - bpf: Do not mark insn as seen under speculative path verification
      (CVE-2021-33624)
    - can: bcm: fix infoleak in struct bcm_msg_head (CVE-2021-34693)
    - can: bcm/raw/isotp: use per module netdevice notifier
    - can: j1939: fix Use-after-Free, hold skb ref while in use
    - can: mcba_usb: fix memory leak in mcba_usb
    - usb: core: hub: Disable autosuspend for Cypress CY7C65632
    - [arm64,armhf] usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
    - tracing: Do not stop recording cmdlines when tracing is off
    - tracing: Do not stop recording comms if the trace file is being read
    - tracing: Do no increment trace_clock_global() by one
    - PCI: Mark TI C667X to avoid bus reset
    - PCI: Mark some NVIDIA GPUs to avoid bus reset
    - [arm64] PCI: aardvark: Fix kernel panic during PIO transfer
    - PCI: Add ACS quirk for Broadcom BCM57414 NIC
    - PCI: Work around Huawei Intelligent NIC VF FLR erratum
    - [x86] KVM: x86: Immediately reset the MMU context when the SMM flag is
      cleared
    - [x86] KVM: x86/mmu: Calculate and check "full" mmu_role for nested MMU
    - [x86] KVM: X86: Fix x86_emulator slab cache leak
    - [s390x] mcck: fix calculation of SIE critical section size
    - [s390x] ap: Fix hanging ioctl caused by wrong msg counter
    - [amd64] x86/mm: Avoid truncating memblocks for SGX memory
    - [x86] process: Check PF_KTHREAD and not current->mm for kernel threads
    - [x86] ioremap: Map EFI-reserved memory as encrypted for SEV
    - [x86] pkru: Write hardware init value to PKRU when xstate is init
    - [x86] fpu: Prevent state corruption in __fpu__restore_sig()
    - [x86] fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
    - [x86] fpu: Reset state for all signal restore failures
    - crash_core, vmcoreinfo: append 'SECTION_SIZE_BITS' to vmcoreinfo
    - [arm64,armhf] dmaengine: pl330: fix wrong usage of spinlock flags in
      dma_cyclc
    - mac80211: Fix NULL ptr deref for injected rate info
    - cfg80211: avoid double free of PMSR request
    - drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full
      doorbell.
    - drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue.
    - net: ll_temac: Fix TX BD buffer overwrite
    - net: bridge: fix vlan tunnel dst null pointer dereference
    - net: bridge: fix vlan tunnel dst refcnt when egressing
    - mm/swap: fix pte_same_as_swp() not removing uffd-wp bit when compare
    - mm/slub: clarify verification reporting
    - mm/slub: fix redzoning for small allocations
    - mm/slub: actually fix freelist pointer vs redzoning
    - mm/slub.c: include swab.h
    - net: stmmac: disable clocks in stmmac_remove_config_dt()
    - [arm64,armhf] net: fec_ptp: add clock rate zero check
    - [arm64,armhf] usb: dwc3: debugfs: Add and remove endpoint dirs dynamically
    - [arm64,armhf] usb: dwc3: core: fix kernel panic when do reboot

  [ Josua Mayer ]
  * [armhf] drivers/bluetooth: Enable BT_HCIUART as a module, with support
    for all features already enabled in the generic config. (Closes: #987361)
  * [armhf] enable i.MX6 MIPI-CSI video capture device. (Closes: #987365)
    - drivers/mux: Enable MUX_MMIO as a module.
    - drivers/media/platform: Enable VIDEO_MUX as a module.
    - drivers/staging/media/imx: Enable VIDEO_IMX_MEDIA and VIDEO_IMX_CSI as
      modules.

  [ Uwe Kleine-König ]
  * [arm64] Update device tree for Kobol's helios64 from next

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "net/Qdisc: use a seqlock instead seqcount"
  * Ignore some ABI changes that should not affect OOT modules
  * Bump ABI to 8
  * [rt] Refresh "tracing: Merge irqflags + preempt counter"
  * can: bcm: delay release of struct bcm_op after synchronize_rcu()
    (CVE-2021-3609)
  * Revert "PCI: PM: Do not read power state in pci_enable_device_flags()"
    (Closes: #990008)

  [ Vagrant Cascadian ]
  * [arm64] Add pwm-rockchip to fb-modules udeb.
  * [arm64] Add fusb302, tcpm and typec to usb-modules udeb.
  * [armhf] Add gpio-mxc to kernel-image udeb. Thanks to Rick Thomas.
    (Closes: #982270)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 24 Jun 2021 14:11:37 +0200

linux (5.10.40-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.39
    - [x86] msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes
    - [x86] drm/i915/display: fix compiler warning about array overrun
    - airo: work around stack usage warning
    - usb: sl811-hcd: improve misleading indentation
    - cxgb4: Fix the -Wmisleading-indentation warning
    - isdn: capi: fix mismatched prototypes
    - virtio_net: Do not pull payload in skb->head
    - [armel,armhf] 9066/1: ftrace: pause/unpause function graph tracer in
      cpu_suspend()
    - [arm64,x86] ACPI / hotplug / PCI: Fix reference count leak in
      enable_slot()
    - [arm64] Input: elants_i2c - do not bind to i2c-hid compatible ACPI
      instantiated devices
    - NFS: NFS_INO_REVAL_PAGECACHE should mark the change attribute invalid
    - [armel,armhf] 9075/1: kernel: Fix interrupted SMC calls
    - [arm64] platform/chrome: cros_ec_typec: Add DP mode check
    - scsi: lpfc: Fix illegal memory access on Abort IOCBs
    - ceph: fix fscache invalidation
    - ceph: don't clobber i_snap_caps on non-I_NEW inode
    - ceph: don't allow access to MDS-private inodes
    - scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not
      found
    - bridge: Fix possible races between assigning rx_handler_data and setting
      IFF_BRIDGE_PORT bit
    - nvmet: remove unsupported command noise
    - drm/amd/display: Fix two cursor duplication when using overlay
    - [arm64,x86] gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10
      Pro 5055
    - net:CXGB4: fix leak if sk_buff is not used
    - ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP
    - block: reexpand iov_iter after read/write
    - net: stmmac: Do not enable RX FIFO overflow interrupts
    - ip6_gre: proper dev_{hold|put} in ndo_[un]init methods
    - sit: proper dev_{hold|put} in ndo_[un]init methods
    - ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods
    - ipv6: remove extra dev_hold() for fallback tunnels
    - tweewide: Fix most Shebang lines
    - scripts: switch explicitly to Python 3
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.40
    - RDMA/core: Prevent divide-by-zero error triggered by the user
    - RDMA/rxe: Clear all QP fields if creation failed
    - scsi: ufs: core: Increase the usable queue depth
    - scsi: qedf: Add pointer checks in qedf_update_link_speed()
    - scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword()
    - RDMA/mlx5: Recover from fatal event in dual port mode
    - RDMA/core: Don't access cm_id after its destruction
    - nvmet: remove unused ctrl->cqs
    - nvmet: fix memory leak in nvmet_alloc_ctrl()
    - nvme-tcp: rerun io_work if req_list is not empty
    - nvme-fc: clear q_live at beginning of association teardown
    - [x86] platform/x86: intel_int0002_vgpio: Only call enable_irq_wake() when
      using s2idle
    - [x86] platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios
    - RDMA/mlx5: Fix query DCT via DEVX
    - RDMA/uverbs: Fix a NULL vs IS_ERR() bug
    - [powerpc*] pseries: Fix hcall tracing recursion in pv queued spinlocks
    - ptrace: make ptrace() fail if the tracee changed its pid unexpectedly
    - nvmet: seset ns->file when open fails
    - [x86] perf/x86: Avoid touching LBR_TOS MSR for Arch LBR
    - locking/lockdep: Correct calling tracepoints
    - locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to signal
    - [powerpc*] Fix early setup to make early_ioremap() work
    - btrfs: avoid RCU stalls while running delayed iputs
    - cifs: fix memory leak in smb2_copychunk_range
    - misc: eeprom: at24: check suspend status before disable regulator
    - ALSA: dice: fix stream format for TC Electronic Konnekt Live at high
      sampling transfer frequency
    - ALSA: intel8x0: Don't update period unless prepared
    - ALSA: firewire-lib: fix amdtp_packet tracepoints event for packet_index
      field
    - ALSA: line6: Fix racy initialization of LINE6 MIDI
    - ALSA: dice: fix stream format at middle sampling rate for Alesis iO 26
    - ALSA: firewire-lib: fix calculation for size of IR context payload
    - ALSA: usb-audio: Validate MS endpoint descriptors
    - ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro
    - ALSA: hda: fixup headset for ASUS GU502 laptop
    - Revert "ALSA: sb8: add a check for request_region"
    - ALSA: firewire-lib: fix check for the size of isochronous packet payload
    - ALSA: hda/realtek: reset eapd coeff to default value for alc287
    - ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293
    - ALSA: hda/realtek: Fix silent headphone output on ASUS UX430UA
    - ALSA: hda/realtek: Add fixup for HP OMEN laptop
    - ALSA: hda/realtek: Add fixup for HP Spectre x360 15-df0xxx
    - [x86] uio_hv_generic: Fix a memory leak in error handling paths
    - [arm64] Revert "serial: mvebu-uart: Fix to avoid a potential NULL pointer
      dereference"
    - nvme-tcp: fix possible use-after-completion
    - drm/amdgpu: Fix GPU TLB update error when PAGE_SIZE > AMDGPU_PAGE_SIZE
    - drm/amdgpu: disable 3DCGCG on picasso/raven1 to avoid compute hang
    - drm/amdgpu: update gc golden setting for Navi12
    - drm/amdgpu: update sdma golden setting for Navi12
    - [powerpc*] 64s/syscall: Use pt_regs.trap to distinguish syscall ABI
      difference between sc and scv syscalls
    - [powerpc*] 64s/syscall: Fix ptrace syscall info with scv syscalls
    - mmc: sdhci-pci-gli: increase 1.8V regulator wait
    - [x86] xen-pciback: redo VF placement in the virtual topology
    - [x86] xen-pciback: reconfigure also from backend watch handler
    - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry
    - dm snapshot: fix crash with transient storage and zero chunk size
    - Revert "video: hgafb: fix potential NULL pointer dereference"
    - [arm64,armhf] Revert "net: stmicro: fix a missing check of clk_prepare"
    - Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe"
    - Revert "ecryptfs: replace BUG_ON with error handling code"
    - Revert "rtlwifi: fix a potential NULL pointer dereference"
    - Revert "qlcnic: Avoid potential NULL pointer dereference"
    - Revert "niu: fix missing checks of niu_pci_eeprom_read"
    - ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read()
    - [arm64,armhf] net: stmicro: handle clk_prepare() failure during init
    - net: rtlwifi: properly check for alloc_workqueue() failure
    - ics932s401: fix broken handling of errors when word reading fails
    - qlcnic: Add null check after calling netdev_alloc_skb
    - [x86] video: hgafb: fix potential NULL pointer dereference
    - vgacon: Record video mode changes with VT_RESIZEX
    - vt_ioctl: Revert VT_RESIZEX parameter handling removal
    - vt: Fix character height handling with VT_RESIZEX
    - tty: vt: always invoke vc->vc_sw->con_resize callback
    - [x86] drm/i915/gt: Disable HiZ Raw Stall Optimization on broken gen7
    - [amd64] x86/Xen: swap NX determination and GDT setup on BSP
    - nvme-multipath: fix double initialization of ANA state
    - [arm64] rtc: pcf85063: fallback to parent of_node
    - nvmet: use new ana_log_size instead the old one
    - [x86] video: hgafb: correctly handle card detect failure during probe
    - Bluetooth: SMP: Fail if remote and local public keys are identical

  [ Salvatore Bonaccorso ]
  * bpf: Wrap aux data inside bpf_sanitize_info container (CVE-2021-33200)
  * bpf: Fix mask direction swap upon off reg sign change (CVE-2021-33200)
  * bpf: No need to simulate speculative domain for immediates (CVE-2021-33200)
  * [armhf] dts: sun8i: h3: orangepi-plus: Fix ethernet phy-mode
    (Closes: #988574)
  * [rt] Refresh "ptrace: fix ptrace vs tasklist_lock race"
  * Deal with vc_data ABI changes in 5.10.40

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 28 May 2021 10:31:38 +0200

linux (5.10.38-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.29
    - [armhf] bus: ti-sysc: Fix warning on unbind if reset is not deasserted
    - [x86] platform/x86: intel-hid: Support Lenovo ThinkPad X1 Tablet Gen 2
    - [amd64] bpf, x86: Use kvmalloc_array instead kmalloc_array in bpf_jit_comp
    - net/mlx5e: Enforce minimum value check for ICOSQ size
    - mISDN: fix crash in fritzpci
    - mac80211: Check crypto_aead_encrypt for errors
    - mac80211: choose first enabled channel for monitor
    - [arm64] drm/msm/dsi_pll_7nm: Fix variable usage for pll_lockdet_rate
    - [arm64] drm/msm/adreno: a5xx_power: Don't apply A540 lm_setup to other
      GPUs
    - [arm64] drm/msm: Ratelimit invalid-fence message
    - netfilter: conntrack: Fix gre tunneling over ipv6
    - netfilter: nftables: skip hook overlap logic if flowtable is stale
    - [x86] platform/x86: thinkpad_acpi: Allow the FnLock LED to change state
    - [arm64] drm/msm/disp/dpu1: icc path needs to be set before dpu runtime
      resume
    - block: clear GD_NEED_PART_SCAN later in bdev_disk_changed
    - [x86] platform/x86: intel_pmc_core: Ignore GBE LTR on Tiger Lake platforms
    - [arm64] ptp_qoriq: fix overflow in ptp_qoriq_adjfine() u64 calcalation
    - scsi: target: pscsi: Clean up after failure in pscsi_map_sg()
    - [ia64] mca: allocate early mca with GFP_ATOMIC
    - [ia64] fix format strings for err_inject
    - cifs: revalidate mapping when we open files for SMB1 POSIX
    - cifs: Silently ignore unknown oplock break handle
    - io_uring: fix timeout cancel return code
    - math: Export mul_u64_u64_div_u64
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.30
    - ALSA: aloop: Fix initialization of controls
    - ALSA: hda/realtek: Fix speaker amp setup on Acer Aspire E1
    - ALSA: hda/conexant: Apply quirk for another HP ZBook G5 model
    - [x86] ASoC: intel: atom: Stop advertising non working S24LE support
    - nfc: fix refcount leak in llcp_sock_bind() (CVE-2020-25670)
    - nfc: fix refcount leak in llcp_sock_connect() (CVE-2020-25671)
    - nfc: fix memory leak in llcp_sock_connect() (CVE-2020-25672)
    - nfc: Avoid endless loops caused by repeated llcp_sock_connect()
    - selinux: make nslot handling in avtab more robust
    - selinux: fix cond_list corruption when changing booleans
    - selinux: fix race between old and new sidtab
    - xen/evtchn: Change irq_info lock to raw_spinlock_t
    - net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh
    - [x86] drm/i915: Fix invalid access to ACPI _DSM objects
    - [amd64] IB/hfi1: Fix probe time panic when AIP is enabled with a buggy
      BIOS
    - LOOKUP_MOUNTPOINT: we are cleaning "jumped" flag too late
    - [ia64] fix user_stack_pointer() for ptrace()
    - ocfs2: fix deadlock between setattr and dio_end_io_write
    - fs: direct-io: fix missing sdio->boundary
    - ethtool: fix incorrect datatype in set_eee ops
    - of: property: fw_devlink: do not link ".*,nr-gpios"
    - [armhf] dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin
    - batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field
    - ice: Continue probe on link/PHY errors
    - ice: Increase control queue timeout
    - ice: prevent ice_open and ice_stop during reset
    - ice: fix memory allocation call
    - ice: remove DCBNL_DEVRESET bit from PF state
    - ice: Fix for dereference of NULL pointer
    - ice: Use port number instead of PF ID for WoL
    - ice: Cleanup fltr list in case of allocation issues
    - iwlwifi: pcie: properly set LTR workarounds on 22000 devices
    - ice: fix memory leak of aRFS after resuming from suspend
    - net: hso: fix null-ptr-deref during tty device unregistration
    - bpf: Enforce that struct_ops programs be GPL-only
    - bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET
    - ethernet/netronome/nfp: Fix a use after free in nfp_bpf_ctrl_msg_rx
    - bpf: Refcount task stack in bpf_get_task_stack
    - bpf, sockmap: Fix sk->prot unhash op reset
    - bpf, sockmap: Fix incorrect fwd_alloc accounting
    - net: ensure mac header is set in virtio_net_hdr_to_skb()
    - i40e: Fix sparse warning: missing error code 'err'
    - i40e: Fix sparse error: 'vsi->netdev' could be null
    - i40e: Fix sparse error: uninitialized symbol 'ring'
    - i40e: Fix sparse errors in i40e_txrx.c
    - net: sched: sch_teql: fix null-pointer dereference
    - net: sched: fix action overwrite reference counting
    - nl80211: fix beacon head validation
    - nl80211: fix potential leak of ACL params
    - cfg80211: check S1G beacon compat element length
    - mac80211: fix time-is-after bug in mlme
    - mac80211: fix TXQ AC confusion
    - net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind()
    - net: let skb_orphan_partial wake-up waiters.
    - [x86] thunderbolt: Fix a leak in tb_retimer_add()
    - [x86] thunderbolt: Fix off by one in tb_port_find_retimer()
    - usbip: add sysfs_lock to synchronize sysfs code paths
    - usbip: stub-dev synchronize sysfs code paths
    - usbip: vudc synchronize sysfs code paths
    - usbip: synchronize event handler with sysfs code paths
    - driver core: Fix locking bug in deferred_probe_timeout_work_func()
    - scsi: pm80xx: Fix chip initialization failure
    - scsi: target: iscsi: Fix zero tag inside a trace event
    - percpu: make pcpu_nr_empty_pop_pages per chunk type
    - i2c: turn recovery error on init to debug
    - [x86] KVM: x86/mmu: change TDP MMU yield function returns to match
      cond_resched
    - [x86] KVM: x86/mmu: Merge flush and non-flush tdp_mmu_iter_cond_resched
    - [x86] KVM: x86/mmu: Rename goal_gfn to next_last_level_gfn
    - [x86] KVM: x86/mmu: Ensure forward progress when yielding in TDP MMU iter
    - [x86] KVM: x86/mmu: Yield in TDU MMU iter even if no SPTES changed
    - [x86] KVM: x86/mmu: Ensure TLBs are flushed when yielding during GFN range
      zap
    - [x86] KVM: x86/mmu: Ensure TLBs are flushed for TDP MMU during NX zapping
    - [x86] KVM: x86/mmu: Don't allow TDP MMU to yield when recovering NX pages
    - [x86] KVM: x86/mmu: preserve pending TLB flush across calls to
      kvm_tdp_mmu_zap_sp
    - net: sched: fix err handler in tcf_action_init()
    - ice: Refactor DCB related variables out of the ice_port_info struct
    - ice: Recognize 860 as iSCSI port in CEE mode
    - xfrm: interface: fix ipv4 pmtu check to honor ip header df
    - xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume
    - [armhf] OMAP4: PM: update ROM return address for OSWR and OFF
    - net: xfrm: Localize sequence counter per network namespace
    - esp: delete NETIF_F_SCTP_CRC bit from features for esp offload
    - [x86] ASoC: SOF: Intel: HDA: fix core status verification
    - xfrm: Fix NULL pointer dereference on policy lookup
    - virtchnl: Fix layout of RSS structures
    - i40e: Added Asym_Pause to supported link modes
    - i40e: Fix kernel oops when i40e driver removes VF's
    - vxlan: do not modify the shared tunnel info when PMTU triggers an ICMP
      reply
    - geneve: do not modify the shared tunnel info when PMTU triggers an ICMP
      reply
    - sch_red: fix off-by-one checks in red_check_params()
    - drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit
    - xfrm: Provide private skb extensions for segmented and hw offloaded ESP
      packets
    - can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE
    - can: isotp: fix msg_namelen values depending on CAN_REQUIRED_SIZE
    - ethernet: myri10ge: Fix a use after free in myri10ge_sw_tso
    - gianfar: Handle error code at MAC address change
    - [arm64,armhf] net: dsa: Fix type was not set for devlink port
    - cxgb4: avoid collecting SGE_QBASE regs during traffic
    - net:tipc: Fix a double free in tipc_sk_mcast_rcv
    - [armhf] net/ncsi: Avoid channel_monitor hrtimer deadlock
    - net: qrtr: Fix memory leak on qrtr_tx_wait failure
    - nfp: flower: ignore duplicate merge hints from FW
    - net: phy: broadcom: Only advertise EEE for supported modes
    - [armhf] ASoC: sunxi: sun4i-codec: fill ASoC card owner (Closes: #980539)
    - net/mlx5e: Fix mapping of ct_label zero
    - net/mlx5e: Fix ethtool indication of connector type
    - net/mlx5: Don't request more than supported EQs
    - net/rds: Fix a use after free in rds_message_map_pages
    - xdp: fix xdp_return_frame() kernel BUG throw for page_pool memory model
    - i40e: Fix display statistics for veb_tc
    - [arm64] drm/msm: Set drvdata to NULL when msm_drm_init() fails
    - net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...);
    - scsi: ufs: core: Fix task management request completion timeout
    - scsi: ufs: core: Fix wrong Task Tag used in task management request UPIUs
    - net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb
    - [arm64,riscv64] net: macb: restore cmp registers on resume path
    - clk: fix invalid usage of list cursor in register
    - clk: fix invalid usage of list cursor in unregister
    - workqueue: Move the position of debug_work_activate() in __queue_work()
    - [s390x] cpcmd: fix inline assembly register clobbering
    - net: openvswitch: conntrack: simplify the return expression of
      ovs_ct_limit_get_default_limit()
    - openvswitch: fix send of uninitialized stack memory in ct limit reply
    - i2c: designware: Adjust bus_freq_hz when refuse high speed mode set
    - iwlwifi: fix 11ax disabled bit in the regulatory capability flags
    - tipc: increment the tmp aead refcnt before attaching it
    - [arm64] net: hns3: clear VF down state bit before request link status
    - net/mlx5: Fix placement of log_max_flow_counter
    - net/mlx5: Fix PPLM register mapping
    - net/mlx5: Fix PBMC register mapping
    - RDMA/cxgb4: check for ipv6 address properly while destroying listener
    - RDMA/qedr: Fix kernel panic when trying to access recv_cq
    - [arm*] drm/vc4: crtc: Reduce PV fifo threshold on hvs4
    - i40e: Fix parameters in aq_get_phy_register()
    - RDMA/addr: Be strict with gid size
    - [armhf] clk: socfpga: fix iomem pointer cast on 64-bit
    - dt-bindings: net: ethernet-controller: fix typo in NVMEM
    - net: sched: bump refcount for new action in ACT replace mode
    - gpiolib: Read "gpio-line-names" from a firmware node
    - cfg80211: remove WARN_ON() in cfg80211_sme_connect
    - net: tun: set tun->dev->addr_len during TUNSETLINK processing
    - drivers: net: fix memory leak in atusb_probe
    - drivers: net: fix memory leak in peak_usb_create_dev
    - net: mac802154: Fix general protection fault (CVE-2021-33033)
    - net: ieee802154: nl-mac: fix check on panid
    - net: ieee802154: fix nl802154 del llsec key
    - net: ieee802154: fix nl802154 del llsec dev
    - net: ieee802154: fix nl802154 add llsec key
    - net: ieee802154: fix nl802154 del llsec devkey
    - net: ieee802154: forbid monitor for set llsec params
    - net: ieee802154: forbid monitor for del llsec seclevel
    - net: ieee802154: stop dump llsec params for monitors
    - Revert "net: sched: bump refcount for new action in ACT replace mode"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.31
    - gfs2: Flag a withdraw if init_threads() fails
    - [arm64] KVM: Hide system instruction access to Trace registers
    - [arm64] KVM: Disable guest access to trace filter controls
    - [armhf] drm/imx: imx-ldb: fix out of bounds array access warning
    - gfs2: report "already frozen/thawed" errors
    - ftrace: Check if pages were allocated before calling free_pages()
    - [arm64,armhf] drm/tegra: dc: Don't set PLL clock to 0Hz
    - [arm64,armhf] gpu: host1x: Use different lock classes for each client
    - XArray: Fix splitting to non-zero orders
    - block: only update parent bi_status when bio fail
    - null_blk: fix command timeout completion handling
    - io_uring: don't mark S_ISBLK async work as unbounded
    - [riscv64] entry: fix misaligned base for excp_vect_table
    - block: don't ignore REQ_NOWAIT for direct IO
    - netfilter: x_tables: fix compat match/target pad out-of-bound write
    - net: sfp: relax bitrate-derived mode check
    - net: sfp: cope with SFPs that set both LOS normal and LOS inverted
    - xen/events: fix setting irq affinity
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.32
    - net/sctp: fix race condition in sctp_destroy_sock
    - gpio: sysfs: Obey valid_mask
    - dmaengine: Fix a double free in dma_async_device_register
    - [x86] ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade()
    - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd()
    - xfrm: BEET mode doesn't support fragments for inner packets
    - ASoC: max98373: Changed amp shutdown register as volatile
    - ASoC: max98373: Added 30ms turn on/off time delay
    - [x86] gpu/xen: Fix a use after free in xen_drm_drv_init
    - neighbour: Disregard DEAD dst in neigh_update
    - [arm64] drm/msm: Fix a5xx/a6xx timestamps
    - scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state
    - iwlwifi: add support for Qu with AX201 device
    - net: ieee802154: stop dump llsec keys for monitors
    - net: ieee802154: forbid monitor for add llsec key
    - net: ieee802154: forbid monitor for del llsec key
    - net: ieee802154: stop dump llsec devs for monitors
    - net: ieee802154: forbid monitor for add llsec dev
    - net: ieee802154: forbid monitor for del llsec dev
    - net: ieee802154: stop dump llsec devkeys for monitors
    - net: ieee802154: forbid monitor for add llsec devkey
    - net: ieee802154: forbid monitor for del llsec devkey
    - net: ieee802154: stop dump llsec seclevels for monitors
    - net: ieee802154: forbid monitor for add llsec seclevel
    - pcnet32: Use pci_resource_len to validate PCI resource
    - mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN
    - Input: i8042 - fix Pegatron C15B ID entry
    - HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices
    - readdir: make sure to verify directory entry for legacy interfaces too
    - [arm64] fix inline asm in load_unaligned_zeropad()
    - [arm64] alternatives: Move length validation in alternative_{insn, endif}
    - vfio/pci: Add missing range check in vfio_pci_mmap
    - scsi: libsas: Reset num_scatter if libata marks qc as NODATA
    - ixgbe: fix unbalanced device enable/disable in suspend/resume
    - netfilter: flowtable: fix NAT IPv6 offload mangling
    - netfilter: conntrack: do not print icmpv6 as unknown via /proc
    - ice: Fix potential infinite loop when using u8 loop counter
    - libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC
    - netfilter: bridge: add pre_exit hooks for ebtable unregistration
    - netfilter: arp_tables: add pre_exit hook for table unregister
    - [arm64,riscv64] net: macb: fix the restore of cmp registers
    - net/mlx5e: fix ingress_ifindex check in mlx5e_flower_parse_meta
    - netfilter: nft_limit: avoid possible divide error in nft_limit_init
    - net/mlx5e: Fix setting of RS FEC mode
    - net: sit: Unregister catch-all devices
    - net: ip6_tunnel: Unregister catch-all devices
    - mm: ptdump: fix build failure
    - net: Make tcp_allowed_congestion_control readonly in non-init netns
    - i40e: fix the panic when running bpf in xdpdrv mode
    - ethtool: pause: make sure we init driver stats
    - [ia64] tools: remove inclusion of ia64-specific version of errno.h header
    - gro: ensure frag0 meets IP header alignment
    - [armhf] OMAP2+: Fix warning for omap_init_time_of()
    - [armhf] OMAP2+: Fix uninitialized sr_inst
    - [arm64] dts: allwinner: Fix SD card CD GPIO for SOPine systems
    - [arm64] dts: allwinner: h6: beelink-gs1: Remove ext. 32 kHz osc reference
    - bpf: Use correct permission flag for mixed signed bounds arithmetic
      (CVE-2021-29155)
    - [x86] KVM: VMX: Convert vcpu_vmx.exit_reason to a union
    - [x86] KVM: VMX: Don't use vcpu->run->internal.ndata as an array index
      (CVE-2021-3501)
    - r8169: tweak max read request size for newer chips also in jumbo mtu mode
    - r8169: don't advertise pause in jumbo mode
    - bpf: Ensure off_reg has no mixed signed bounds for all types
      (CVE-2021-29155)
    - bpf: Move off_reg into sanitize_ptr_alu (CVE-2021-29155)
    - [armel,armhf] 9071/1: uprobes: Don't hook on thumb instructions
    - [arm64] mte: Ensure TIF_MTE_ASYNC_FAULT is set atomically
    - bpf: Rework ptr_limit into alu_limit and add common error path
      (CVE-2021-29155)
    - bpf: Improve verifier error messages for users (CVE-2021-29155)
    - bpf: Move sanitize_val_alu out of op switch
    - net: phy: marvell: fix detection of PHY on Topaz switches
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.33
    - [armhf] gpio: omap: Save and restore sysconfig
    - [x86] pinctrl: lewisburg: Update number of pins in community
    - block: return -EBUSY when there are open partitions in blkdev_reread_part
    - pinctrl: core: Show pin numbers for the controllers with base = 0
    - [arm64] dts: allwinner: Revert SD card CD GPIO for Pine64-LTS
    - bpf: Permits pointers on stack for helper calls
    - bpf: Allow variable-offset stack access
    - bpf: Refactor and streamline bounds check into helper (CVE-2021-29155)
    - bpf: Tighten speculative pointer arithmetic mask
    - locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
    - [x86] perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3
    - [x86] perf/x86/kvm: Fix Broadwell Xeon stepping in isolation_ucodes[]
    - HID: alps: fix error return code in alps_input_configured()
    - HID cp2112: fix support for multiple gpiochips
    - HID: wacom: Assign boolean values to a bool variable
    - net: geneve: check skb is large enough for IPv4/IPv6 header
    - [arm64,armhf] dmaengine: tegra20: Fix runtime PM imbalance on error
    - [s390x] entry: save the caller of psw_idle
    - [arm64] kprobes: Restore local irqflag if kprobes is cancelled
    - xen-netback: Check for hotplug-status existence before watching
    - [x86] crash: Fix crash_setup_memmap_entries() out-of-bounds access
    - net: hso: fix NULL-deref on disconnect regression
    - USB: CDC-ACM: fix poison/unpoison imbalance (Closes: #986995)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.34
    - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()
    - [x86] mei: me: add Alder Lake P device id.
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.35
    - [mips*] Do not include hi and lo in clobber list for R6
    - netfilter: conntrack: Make global sysctls readonly in non-init netns
    - net: usb: ax88179_178a: initialize local variables before use
    - igb: Enable RSS for Intel I211 Ethernet Controller
    - bpf: Fix masking negation logic upon negative dst register
      (CVE-2021-31829)
    - bpf: Fix leakage of uninitialized bpf stack under speculation
      (CVE-2021-31829)
    - net: qrtr: Avoid potential use after free in MHI send
    - perf data: Fix error return code in perf_data__create_dir()
    - capabilities: require CAP_SETFCAP to map uid 0
    - perf ftrace: Fix access to pid in array when setting a pid filter
    - driver core: add a min_align_mask field to struct device_dma_parameters
    - swiotlb: add a IO_TLB_SIZE define
    - swiotlb: factor out an io_tlb_offset helper
    - swiotlb: factor out a nr_slots helper
    - swiotlb: clean up swiotlb_tbl_unmap_single
    - swiotlb: refactor swiotlb_tbl_map_single
    - swiotlb: don't modify orig_addr in swiotlb_tbl_sync_single
    - swiotlb: respect min_align_mask
    - nvme-pci: set min_align_mask
    - ovl: fix leaked dentry
    - ovl: allow upperdir inside lowerdir
    - ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX
    - USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet
    - USB: Add reset-resume quirk for WD19's Realtek Hub
    - [x86] platform/x86: thinkpad_acpi: Correct thermal sensor allocation
    - perf/core: Fix unconditional security_locked_down() call
    - vfio: Depend on MMU
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.36
    - bus: mhi: core: Fix check for syserr at power_up
    - bus: mhi: core: Clear configuration from channel context during reset
    - bus: mhi: core: Sanity check values from remote device before use
    - dyndbg: fix parsing file query without a line-range suffix
    - [s390x] disassembler: increase ebpf disasm buffer size
    - [s390x] zcrypt: fix zcard and zqueue hot-unplug memleak
    - [arm64,x86] tpm: acpi: Check eventlog signature before using it
    - ftrace: Handle commands when closing set_ftrace_filter file
    - ecryptfs: fix kernel panic with null dev_name
    - fs/epoll: restore waking from ep_done_scan()
    - mtd: spi-nor: core: Fix an issue of releasing resources during read/write
    - Revert "mtd: spi-nor: macronix: Add support for mx25l51245g"
    - erofs: add unsupported inode i_format check
    - [armhf] spi: stm32-qspi: fix pm_runtime usage_count counter
    - [armhf] spi: spi-ti-qspi: Free DMA resources
    - scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()
    - scsi: mpt3sas: Block PCI config access from userspace during reset
    - mmc: sdhci: Check for reset prior to DMA address unmap
    - mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based
      controllers
    - [arm64,armhf] mmc: sdhci-tegra: Add required callbacks to set/clear CQE_EN
      bit
    - mmc: block: Update ext_csd.cache_ctrl if it was written
    - mmc: block: Issue a cache flush only when it's enabled
    - mmc: core: Do a power cycle when the CMD11 fails
    - mmc: core: Set read only for SD cards with permanent write protect bit
    - mmc: core: Fix hanging on I/O during system suspend for removable cards
    - [arm64,armhf] irqchip/gic-v3: Do not enable irqs when handling spurious
      interrups
    - cifs: Return correct error code from smb2_get_enc_key
    - cifs: fix out-of-bound memory access when calling smb3_notify() at mount
      point
    - cifs: detect dead connections only when echoes are enabled.
    - smb2: fix use-after-free in smb2_ioctl_query_info()
    - btrfs: handle remount to no compress during compression
    - btrfs: fix metadata extent leak after failure to create subvolume
    - [x86] intel_th: pci: Add Rocket Lake CPU support
    - btrfs: fix race between transaction aborts and fsyncs leading to
      use-after-free
    - posix-timers: Preserve return value in clock_adjtime32()
    - fbdev: zero-fill colormap in fbcmap.c
    - [armhf] bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices
      first
    - staging: wimax/i2400m: fix byte-order issue
    - bus: mhi: core: Destroy SBL devices when moving to mission mode
    - crypto: api - check for ERR pointers in crypto_destroy_tfm()
    - [x86] crypto: qat - fix unmap invalid dma address
    - usb: gadget: uvc: add bInterval checking for HS mode
    - usb: webcam: Invalid size of Processing Unit Descriptor
    - [x86] genirq/matrix: Prevent allocation counter corruption
    - usb: gadget: f_uac2: validate input parameters
    - usb: gadget: f_uac1: validate input parameters
    - [arm64,armhf] usb: dwc3: gadget: Ignore EP queue requests during bus reset
    - usb: xhci: Fix port minor revision
    - PCI: PM: Do not read power state in pci_enable_device_flags()
    - [arm64,armhf] soc/tegra: pmc: Fix completion of power-gate toggling
    - [arm64] dts: imx8mq-librem5-r3: Mark buck3 as always on
    - [arm64] tee: optee: do not check memref size on return from Secure World
    - [arm64,x86] soundwire: cadence: only prepare attached devices on clock
      stop
    - [arm*] perf/arm_pmu_platform: Use dev_err_probe() for IRQ errors
    - [arm*] perf/arm_pmu_platform: Fix error handling
    - random: initialize ChaCha20 constants with correct endianness
    - xhci: check port array allocation was successful before dereferencing it
    - xhci: check control context is valid before dereferencing it.
    - xhci: fix potential array out of bounds with several interrupters
    - bus: mhi: core: Clear context for stopped channels from remove()
    - [arm64] spi: qup: fix PM reference leak in spi_qup_remove()
    - [arm64,armhf] usb: musb: fix PM reference leak in musb_irq_work()
    - usb: core: hub: Fix PM reference leak in usb_port_resume()
    - [arm64,armhf] usb: dwc3: gadget: Check for disabled LPM quirk
    - tty: n_gsm: check error while registering tty devices
    - [x86] intel_th: Consistency and off-by-one fix
    - [armhf] phy: phy-twl4030-usb: Fix possible use-after-free in
      twl4030_usb_remove()
    - [arm64] crypto: sun8i-ce - Fix PM reference leak in sun8i_ce_probe()
    - [armhf] crypto: stm32/hash - Fix PM reference leak on stm32-hash.c
    - [armhf] crypto: stm32/cryp - Fix PM reference leak on stm32-cryp.c
    - [x86] platform/x86: intel_pmc_core: Don't use global pmcdev in quirks
    - spi: sync up initial chipselect state
    - btrfs: do proper error handling in create_reloc_root
    - btrfs: do proper error handling in btrfs_update_reloc_root
    - btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s
    - drm: Added orientation quirk for OneGX1 Pro
    - drm/qxl: do not run release if qxl failed to init
    - drm/qxl: release shadow on shutdown
    - drm/ast: Fix invalid usage of AST_MAX_HWC_WIDTH in cursor atomic_check
    - drm/ast: fix memory leak when unload the driver
    - drm/amd/display: Check for DSC support instead of ASIC revision
    - drm/amdgpu/display: buffer INTERRUPT_LOW_IRQ_CONTEXT interrupt work
    - scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe
    - scsi: lpfc: Fix pt2pt connection does not recover after LOGO
    - drm/amdgpu: Fix some unload driver issues
    - sched/pelt: Fix task util_est update filtering
    - kvfree_rcu: Use same set of GFP flags as does single-argument
    - scsi: target: pscsi: Fix warning in pscsi_complete_cmd()
    - [x86] media: ite-cir: check for receive overflow
    - power: supply: bq27xxx: fix power_avg for newer ICs
    - media: media/saa7164: fix saa7164_encoder_register() memory leak bugs
    - media: gspca/sq905.c: fix uninitialized variable
    - drm/amdgpu: mask the xgmi number of hops reported from psp to kfd
    - drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f
    - drm/amd/display: Fix UBSAN warning for not a valid value for type '_Bool'
    - scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats()
    - scsi: qla2xxx: Fix use after free in bsg
    - [arm64,armhf] mmc: sdhci-esdhc-imx: validate pinctrl before use it
    - mmc: sdhci-pci: Add PCI IDs for Intel LKF
    - ata: ahci: Disable SXS for Hisilicon Kunpeng920
    - nvmet: return proper error code from discovery ctrl
    - scsi: smartpqi: Use host-wide tag space
    - scsi: smartpqi: Correct request leakage during reset operations
    - scsi: smartpqi: Add new PCI IDs
    - scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg()
    - media: em28xx: fix memory leak
    - media: vivid: update EDID
    - [arm64] drm/msm/dp: Fix incorrect NULL check kbot warnings in DP driver
    - [armhf] clk: socfpga: arria10: Fix memory leak of socfpga_clk on error
      return
    - media: dvb-usb: fix memory leak in dvb_usb_adapter_init
    - media: gscpa/stv06xx: fix memory leak
    - sched/fair: Ignore percpu threads for imbalance pulls
    - [arm64] drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal
    - [arm64] drm/msm/mdp5: Do not multiply vclk line count by 100
    - drm/amdgpu/ttm: Fix memory leak userptr pages
    - drm/radeon/ttm: Fix memory leak userptr pages
    - drm/amd/display: Try YCbCr420 color when YCbCr444 fails
    - drm/amdgpu: fix NULL pointer dereference
    - scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO
      response
    - scsi: lpfc: Fix error handling for mailboxes completed in MBX_POLL mode
    - scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic
    - mfd: intel-m10-bmc: Fix the register access range
    - mfd: da9063: Support SMBus and I2C mode
    - scsi: libfc: Fix a format specifier
    - perf: Rework perf_event_exit_event()
    - sched,fair: Alternative sched_slice()
    - [s390x] archrandom: add parameter check for s390_arch_random_generate
    - sched,psi: Handle potential task count underflow bugs more gracefully
    - [i386] ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer
    - ALSA: hda/conexant: Re-order CX5066 quirk table entries
    - [i386] ALSA: sb: Fix two use after free in snd_sb_qsound_build
    - ALSA: usb-audio: Explicitly set up the clock selector
    - ALSA: usb-audio: Add dB range mapping for Sennheiser Communications
      Headset PC 8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G7
    - ALSA: hda/realtek: GA503 use same quirks as GA401
    - ALSA: hda/realtek: fix mic boost on Intel NUC 8
    - ALSA: hda/realtek - Headset Mic issue on HP platform
    - ALSA: hda/realtek: fix static noise on ALC285 Lenovo laptops
    - ALSA: hda/realtek: Add quirk for Intel Clevo PCx0Dx
    - [x86] tools/power/turbostat: Fix turbostat for AMD Zen CPUs
      (Closes: #985681)
    - btrfs: fix race when picking most recent mod log operation for an old root
    - [arm64] vdso: Discard .note.gnu.property sections in vDSO
    - Makefile: Move -Wno-unused-but-set-variable out of GCC only block
    - fs: fix reporting supported extra file attributes for statx()
    - virtiofs: fix memory leak in virtio_fs_probe()
    - ubifs: Only check replay with inode type to judge if inode linked
    - f2fs: fix error handling in f2fs_end_enable_verity()
    - f2fs: fix to avoid out-of-bounds memory access (CVE-2021-3506)
    - openvswitch: fix stack OOB read while fragmenting IPv4 packets
    - [arm64] ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe
      failure
    - NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
    - NFS: Don't discard pNFS layout segments that are marked for return
    - NFSv4: Don't discard segments marked for return in _pnfs_return_layout()
    - jffs2: Fix kasan slab-out-of-bounds problem
    - jffs2: Hook up splice_write callback
    - [powerpc*] powernv: Enable HAIL (HV AIL) for ISA v3.1 processors
    - [powerpc*] eeh: Fix EEH handling for hugepages in ioremap space.
    - [x86] intel_th: pci: Add Alder Lake-M support
    - [arm64,x86] tpm: efi: Use local variable for calculating final log size
    - [arm64,x86] tpm: vtpm_proxy: Avoid reading host log when using a virtual
      device
    - [armhf] crypto: arm/curve25519 - Move '.fpu' after '.arch'
    - md/raid1: properly indicate failure when ending a failed write request
    - dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload
      sequences
    - fuse: fix write deadlock
    - exfat: fix erroneous discard when clear cluster bit
    - sfc: farch: fix TX queue lookup in TX flush done handling
    - sfc: farch: fix TX queue lookup in TX event handling
    - security: commoncap: fix -Wstringop-overread warning
    - Fix misc new gcc warnings
    - jffs2: check the validity of dstlen in jffs2_zlib_compress()
    - smb3: when mounting with multichannel include it in requested capabilities
    - smb3: do not attempt multichannel to server which does not support it
    - Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT
      op")
    - futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
    - [x86] cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported
    - ext4: annotate data race in start_this_handle()
    - ext4: annotate data race in jbd2_journal_dirty_metadata()
    - ext4: fix check to prevent false positive report of incorrect used inodes
    - ext4: do not set SB_ACTIVE in ext4_orphan_cleanup()
    - ext4: fix error code in ext4_commit_super
    - ext4: fix ext4_error_err save negative errno into superblock
    - ext4: fix error return code in ext4_fc_perform_commit()
    - ext4: allow the dax flag to be set and cleared on inline directories
    - ext4: Fix occasional generic/418 failure
    - media: dvbdev: Fix memory leak in dvb_media_device_free()
    - media: dvb-usb: Fix use-after-free access
    - media: dvb-usb: Fix memory leak at error in dvb_usb_device_init()
    - media: v4l2-ctrls: fix reference to freed memory
    - [arm64] media: venus: hfi_parser: Don't initialize parser on v1
    - usb: gadget: dummy_hcd: fix gpf in gadget_setup
    - usb: gadget: Fix double free of device descriptor pointers
    - usb: gadget/function/f_fs string table fix for multiple languages
    - [arm64,armhf] usb: dwc3: gadget: Remove FS bInterval_m1 limitation
    - [arm64,armhf] usb: dwc3: gadget: Fix START_TRANSFER link state check
    - [arm64,armhf] usb: dwc3: core: Do core softreset when switch mode
    - [arm*] usb: dwc2: Fix session request interrupt handler
    - tty: fix memory leak in vc_deallocate
    - [x86] tools/power turbostat: Fix offset overflow issue in index converting
    - tracing: Map all PIDs to command lines
    - tracing: Restructure trace_clock_global() to never block
    - dm space map common: fix division bug in sm_ll_find_free_block()
    - dm integrity: fix missing goto in bitmap_flush_interval error handling
    - dm rq: fix double free of blk_mq_tag_set in dev remove after table load
      fails
    - lib/vsprintf.c: remove leftover 'f' and 'F' cases from bstr_printf()
    - [arm*] thermal/drivers/cpufreq_cooling: Fix slab OOB issue
    - thermal/core/fair share: Lock the thermal zone while looping over
      instances
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.37
    - Bluetooth: verify AMP hci_chan before amp_destroy (CVE-2021-33034)
    - bluetooth: eliminate the potential race condition when removing the HCI
      controller (CVE-2021-32399)
    - net/nfc: fix use-after-free llcp_sock_bind/connect (CVE-2021-23134)
    - io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers
      (CVE-2021-3491)
    - Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL"
    - usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode()
    - [amd64] tty: moxa: fix TIOCSSERIAL jiffies conversions
    - USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions
    - USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check
    - [amd64] tty: moxa: fix TIOCSSERIAL permission check
    - [x86] usb: typec: tcpm: Address incorrect values of tcpm psy for fixed
      supply
    - [x86] usb: typec: tcpm: Address incorrect values of tcpm psy for pps
      supply
    - [x86] usb: typec: tcpm: update power supply once partner accepts
    - FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR
    - PCI: Allow VPD access for QLogic ISP2722
    - [x86] KVM: Defer the MMU unload to the normal path on an global INVPCID
    - [arm64] PCI: xgene: Fix cfg resource mapping
    - PM / devfreq: Unlock mutex and free devfreq struct in error path
    - iio: inv_mpu6050: Fully validate gyro and accel scale writes
    - iio:accel:adis16201: Fix wrong axis assignment that prevents loading
    - iio:adc:ad7476: Fix remove handling
    - misc: lis3lv02d: Fix false-positive WARN on various HP models
    - [x86] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct
    - [x86] misc: vmw_vmci: explicitly initialize vmci_datagram payload
    - selinux: add proper NULL termination to the secclass_map permissions
    - [x86] sched: Treat Intel SNC topology as default, COD as exception
    - async_xor: increase src_offs when dropping destination page
    - md/bitmap: wait for external bitmap writes to complete during tear down
    - md-cluster: fix use-after-free issue when removing rdev
    - md: split mddev_find
    - md: factor out a mddev_find_locked helper from mddev_find
    - md: md_open returns -EBUSY when entering racing area
    - md: Fix missing unused status line of /proc/mdstat
    - ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()
    - cfg80211: scan: drop entry from hidden_list on overflow
    - rtw88: Fix array overrun in rtw_get_tx_power_params()
    - mt76: fix potential DMA mapping leak
    - [amd64] drm/i915/gvt: Fix virtual display setup for BXT/APL
    - [amd64] drm/i915/gvt: Fix vfio_edid issue for BXT/APL
    - drm/qxl: use ttm bo priorities
    - [arm64,armhf] drm/panfrost: Clear MMU irqs before handling the fault
    - [arm64,armhf] drm/panfrost: Don't try to map pages that are already mapped
    - drm/radeon: fix copy of uninitialized variable back to userspace
    - drm/dp_mst: Revise broadcast msg lct & lcr
    - drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast
    - drm: bridge/panel: Cleanup connector on bridge detach
    - drm/amd/display: Reject non-zero src_y and src_x for video planes
    - drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2
    - ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries
    - ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries
    - ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 HP quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries
    - ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries
    - ALSA: hda/realtek: Re-order ALC662 quirk table entries
    - ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices
    - ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable
    - ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32
    - [s390x] KVM: VSIE: correctly handle MVPG when in VSIE
    - [s390x] KVM: split kvm_s390_logical_to_effective
    - [s390x] KVM: fix guarded storage control register handling
    - [s390x] fix detection of vector enhancements facility 1 vs. vector packed
      decimal facility
    - [s390x] KVM: VSIE: fix MVPG handling for prefixing and MSO
    - [s390x] KVM: split kvm_s390_real_to_abs
    - [s390x] KVM: extend kvm_s390_shadow_fault to return entry pointer
    - [x86] KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with
      64-bit
    - [x86] KVM: x86: Remove emulator's broken checks on CR0/CR3/CR4 loads
    - [x86] KVM: nSVM: Set the shadow root level to the TDP level for nested NPT
    - [x86] KVM: SVM: Don't strip the C-bit from CR2 on #PF interception
    - [x86] KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are
      created
    - [x86] KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP
      unsupported
    - [x86] KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch
    - [x86] KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in
      !64-bit
    - [x86] KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit
    - [arm64] KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read
    - KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
    - KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
    - [arm64] KVM: Fully zero the vcpu state on reset
    - [arm64] KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read
    - Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit"
    - Revert "i3c master: fix missing destroy_workqueue() on error in
      i3c_master_register"
    - ovl: fix missing revert_creds() on error path
    - Revert "drm/qxl: do not run release if qxl failed to init"
    - [x86] usb: gadget: pch_udc: Revert d3cb25a12138 completely
    - Revert "tools/power turbostat: adjust for temperature offset"
    - [arm64] firmware: xilinx: Fix dereferencing freed memory
    - [armhf] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
    - [armhf] ARM: dts: exynos: correct fuel gauge interrupt trigger level on
      GT-I9100
    - [armhf] ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250
    - [armhf] serial: stm32: fix code cleaning warnings and checks
    - [armhf] serial: stm32: add "_usart" prefix in functions name
    - [armhf] serial: stm32: fix probe and remove order for dma
    - [armhf] serial: stm32: Use of_device_get_match_data()
    - [armhf] serial: stm32: fix startup by enabling usart for reception
    - [armhf] serial: stm32: fix incorrect characters on console
    - [armhf] serial: stm32: fix TX and RX FIFO thresholds
    - [armhf] serial: stm32: fix a deadlock condition with wakeup event
    - [armhf] serial: stm32: fix wake-up flag handling
    - [armhf] serial: stm32: fix a deadlock in set_termios
    - [armhf] serial: stm32: fix tx dma completion, release channel
    - [armhf] serial: stm32: call stm32_transmit_chars locked
    - [armhf] serial: stm32: fix FIFO flush in startup and set_termios
    - [armhf] serial: stm32: add FIFO flush when port is closed
    - [armhf] serial: stm32: fix tx_empty condition
    - [x86] usb: typec: tps6598x: Fix return value check in tps6598x_probe()
    - regmap: set debugfs_name to NULL after it is freed
    - [arm64,armhf] spi: rockchip: avoid objtool warning
    - mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions()
    - mtd: don't lock when recursively deleting partitions
    - mtd: maps: fix error return code of physmap_flash_remove()
    - [arm64] dts: qcom: db845c: fix correct powerdown pin for WSA881x
    - [armhf] spi: stm32: drop devres version of spi_register_master
    - [armhf] spi: stm32: Fix use-after-free on unbind
    - [x86] microcode: Check for offline CPUs before requesting new microcode
    - devtmpfs: fix placement of complete() call
    - [x86] usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits()
    - [x86] usb: gadget: pch_udc: Check if driver is present before calling
      ->setup()
    - [x86] usb: gadget: pch_udc: Check for DMA mapping error
    - [x86] usb: gadget: pch_udc: Initialize device pointer before use
    - [x86] usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard
      (v1)
    - [amd64] crypto: ccp - fix command queuing to TEE ring buffer
    - [x86] crypto: qat - don't release uninitialized resources
    - [x86] crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
    - dt-bindings: serial: stm32: Use 'type: object' instead of false for
      'additionalProperties'
    - mtd: require write permissions for locking and badblock ioctls
    - [arm64] bus: qcom: Put child node before return
    - soundwire: bus: Fix device found flag correctly
    - NFSD: Fix sparse warning in nfs4proc.c
    - NFSv4.2: fix copy stateid copying for the async copy
    - crypto: poly1305 - fix poly1305_core_setkey() declaration
    - [x86] crypto: qat - fix error path in adf_isr_resource_alloc()
    - [armhf] usb: gadget: aspeed: fix dma map failure
    - [arm64] drivers: nvmem: Fix voltage settings for QTI qfprom-efuse
    - driver core: platform: Declare early_platform_cleanup() prototype
    - [armel,armhf] memory: pl353: fix mask of ECC page_size config register
    - soundwire: stream: fix memory leak in stream config error path
    - [arm64] firmware: qcom_scm: Make __qcom_scm_is_call_available() return
      bool
    - [arm64] firmware: qcom_scm: Reduce locking section for __get_convention()
    - [arm64] firmware: qcom_scm: Workaround lack of "is available" call on
      SC7180
    - [arm64,armhf] irqchip/gic-v3: Fix OF_BAD_ADDR error handling
    - [x86] staging: rtl8192u: Fix potential infinite loop
    - PM / devfreq: Use more accurate returned new_freq as resume_freq
    - [armhf] clocksource/drivers/timer-ti-dm: Fix posted mode status check
      order
    - [armhf] clocksource/drivers/timer-ti-dm: Add missing
      set_state_oneshot_stopped
    - spi: Fix use-after-free with devm_spi_alloc_*
    - [arm64] soc: qcom: mdt_loader: Validate that p_filesz < p_memsz
    - [arm64] soc: qcom: mdt_loader: Detect truncated read of segments
    - PM: runtime: Replace inline function pm_runtime_callbacks_present()
    - [amd64,arm64] ACPI: CPPC: Replace cppc_attr with kobj_attribute
    - [x86] crypto: qat - Fix a double free in adf_create_ring
    - [arm64] cpufreq: armada-37xx: Fix setting TBG parent for load levels
    - [arm64] clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU
      PM clock
    - [arm64] cpufreq: armada-37xx: Fix the AVS value for load L1
    - [arm64] clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250
      Mhz to 1 GHz
    - [arm64] clk: mvebu: armada-37xx-periph: Fix workaround for switching from
      L1 to L0
    - [arm64] cpufreq: armada-37xx: Fix driver cleanup when registration failed
    - [arm64] cpufreq: armada-37xx: Fix determining base CPU frequency
    - USB: cdc-acm: fix unprivileged TIOCCSERIAL
    - USB: cdc-acm: fix TIOCGSERIAL implementation
    - tty: actually undefine superseded ASYNC flags
    - tty: fix return value for unsupported ioctls
    - tty: fix return value for unsupported termiox ioctls
    - serial: core: return early on unsupported ioctls
    - node: fix device cleanups in error handling code
    - crypto: chelsio - Read rxchannel-id from firmware
    - usbip: vudc: fix missing unlock on error in usbip_sockfd_store()
    - security: keys: trusted: fix TPM2 authorizations
    - [x86] platform/x86: pmc_atom: Match all Beckhoff Automation baytrail
      boards with critclk_systems DMI table
    - [armhf] dts: aspeed: Rainier: Fix humidity sensor bus address
    - [x86] Drivers: hv: vmbus: Use after free in __vmbus_open()
    - [x86] Drivers: hv: vmbus: Increase wait time for VMbus unload
    - [x86] PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820
      integrity check
    - [arm*] usb: dwc2: Fix host mode hibernation exit with remote wakeup flow.
    - [arm*] usb: dwc2: Fix hibernation between host and device modes.
    - ttyprintk: Add TTY hangup callback.
    - [armhf] serial: omap: don't disable rs485 if rts gpio is missing
    - [armhf] serial: omap: fix rs485 half-duplex filtering
    - xen-blkback: fix compatibility bug with single page rings
    - [armhf] soc: aspeed: fix a ternary sign expansion bug
    - [armhf] drm/tilcdc: send vblank event when disabling crtc
    - [armhf] drm/stm: Fix bus_flags handling
    - drm/amd/display: Fix off by one in hdmi_14_process_transaction()
    - sched/fair: Fix shift-out-of-bounds in load_balance()
    - afs: Fix updating of i_mode due to 3rd party change
    - rcu: Remove spurious instrumentation_end() in rcu_nmi_enter()
    - media: vivid: fix assignment of dev->fbuf_out_flags
    - media: saa7134: use sg_dma_len when building pgtable
    - media: saa7146: use sg_dma_len when building pgtable
    - [armhf] media: aspeed: fix clock handling logic
    - drm/probe-helper: Check epoch counter in output_poll_execute()
    - [arm64] media: venus: core: Fix some resource leaks in the error path of
      'venus_probe()'
    - media: m88ds3103: fix return value check in m88ds3103_probe()
    - media: m88rs6000t: avoid potential out-of-bounds reads on arrays
    - [x86] kprobes: Fix to check non boostable prefixes correctly
    - sata_mv: add IRQ checks
    - ata: libahci_platform: fix IRQ check
    - seccomp: Fix CONFIG tests for Seccomp_filters
    - nvme-tcp: block BH in sk state_change sk callback
    - nvmet-tcp: fix incorrect locking in state_change sk callback
    - [armhf] clk: imx: Fix reparenting of UARTs not associated with stdout
    - nvme: retrigger ANA log update if group descriptor isn't found
    - media: v4l2-ctrls.c: fix race condition in hdl->requests list
    - vfio/pci: Move VGA and VF initialization to functions
    - vfio/pci: Re-order vfio_pci_probe()
    - [amd64] vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer
    - drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct
    - drm/radeon: Fix a missing check bug in radeon_dp_mst_detect()
    - scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check()
    - scsi: pm80xx: Fix potential infinite loop
    - scsi: ufs: ufshcd-pltfrm: Fix deferred probing
    - [amd64] scsi: hisi_sas: Fix IRQ checks
    - [powerpc*] scsi: ibmvfc: Fix invalid state machine BUG_ON()
    - nvmet-tcp: fix a segmentation fault during io parsing error
    - nvme-pci: don't simple map sgl when sgls are disabled
    - [armhf] HSI: core: fix resource leaks in hsi_add_client_from_dt()
    - [amd64] x86/events/amd/iommu: Fix sysfs type mismatch
    - [x86] perf/amd/uncore: Fix sysfs type mismatch
    - io_uring: fix overflows checks in provide buffers
    - sched/debug: Fix cgroup_path[] serialization
    - drivers/block/null_blk/main: Fix a double free in null_init.
    - xsk: Respect device's headroom and tailroom on generic xmit path
    - HID: plantronics: Workaround for double volume key presses
    - RDMA/mlx5: Fix mlx5 rates to IB rates map
    - [x86] KVM: x86/mmu: Retry page faults that hit an invalid memslot
    - Bluetooth: avoid deadlock between hci_dev->lock and socket lock
    - bpftool: Fix maybe-uninitialized warnings
    - iommu: Check dev->iommu in iommu_dev_xxx functions
    - [amd64] iommu/vt-d: Reject unsupported page request modes
    - [powerpc*] prom: Mark identical_pvr_fixup as __init
    - inet: use bigger hash table for IP ID generation
    - [arm64,armhf] pinctrl: pinctrl-single: remove unused parameter
    - [arm64,armhf] pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when
      bits_per_mux is not zero
    - [mips64el,mipsel] loongson64: fix bug when PAGE_SIZE > 16KB
    - RDMA/mlx5: Fix drop packet rule in egress table
    - IB/isert: Fix a use after free in isert_connect_request
    - gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP
    - ALSA: core: remove redundant spin_lock pair in snd_card_disconnect
    - net: phy: lan87xx: fix access to wrong register of LAN87xx
    - udp: never accept GSO_FRAGLIST packets
    - [powerpc*] pseries: Only register vio drivers if vio bus exists
    - net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start()
    - bug: Remove redundant condition check in report_bug
    - RDMA/core: Fix corrupted SL on passive side
    - nfc: pn533: prevent potential memory corruption
    - [arm64] net: hns3: Limiting the scope of vector_ring_chain variable
    - [amd64] iommu/vt-d: Don't set then clear private data in
      prq_event_thread()
    - iommu: Fix a boundary issue to avoid performance drop
    - [amd64] iommu/vt-d: Report right snoop capability when using FL for IOVA
    - [amd64] iommu/vt-d: Report the right page fault address
    - [amd64] iommu/vt-d: Preset Access/Dirty bits for IOVA over FL
    - [amd64] iommu/vt-d: Remove WO permissions on second-level paging entries
    - [amd64] iommu/vt-d: Invalidate PASID cache when root/context entry changed
    - ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls
    - HID: lenovo: Use brightness_set_blocking callback for setting LEDs
      brightness
    - HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling
    - HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event()
    - HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE
    - [arm64] KVM: Initialize VCPU mdcr_el2 before loading it
    - [arm*] ASoC: simple-card: fix possible uninitialized single_cpu local
      variable
    - [amd64] IB/hfi1: Use kzalloc() for mmu_rb_handler allocation
    - [powerpc*] 64s: Fix pte update for kernel memory on radix
    - [powerpc*] perf: Fix PMU constraint check for EBB events
    - mac80211: bail out if cipher schemes are invalid
    - perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric
    - xfs: fix return of uninitialized value in variable error
    - rtw88: Fix an error code in rtw_debugfs_set_rsvd_page()
    - mt7601u: fix always true expression
    - [powerpc*] KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit
    - ovl: invalidate readdir cache on changes to dir with origin
    - RDMA/qedr: Fix error return code in qedr_iw_connect()
    - [amd64] IB/hfi1: Fix error return code in parse_platform_config()
    - cxgb4: Fix unintentional sign extension issues
    - [arm64] net: thunderx: Fix unintentional sign extension issue
    - RDMA/srpt: Fix error return code in srpt_cm_req_recv()
    - [arm64,armhf] i2c: imx: fix reference leak when pm_runtime_get_sync fails
    - [armhf] i2c: omap: fix reference leak when pm_runtime_get_sync fails
    - [armhf] i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails
    - [powerpc*] xive: Drop check on irq_data in xive_core_debug_show()
    - [powerpc*] xive: Fix xmon command "dxi"
    - net/packet: make packet_fanout.arr size configurable up to 64K
    - net/packet: remove data races in fanout operations
    - [amd64] drm/i915/gvt: Fix error code in intel_gvt_init_device()
    - [amd64] iommu/amd: Put newline after closing bracket in warning
    - [mips64el,mipsel] pci-legacy: stop using of_pci_range_to_resource
    - [powerpc*] pseries: extract host bridge from pci_bus prior to bus removal
    - [powerpc*] smp: Reintroduce cpu_core_mask
    - [x86] KVM: dump_vmcs should not assume GUEST_IA32_EFER is valid
    - rtlwifi: 8821ae: upgrade PHY and RF parameters
    - [arm64,armhf] wlcore: fix overlapping snprintf arguments in debugfs
    - mwl8k: Fix a double Free in mwl8k_probe_hw
    - netfilter: nft_payload: fix C-VLAN offload support
    - netfilter: nftables_offload: VLAN id needs host byteorder in flow
      dissector
    - netfilter: nftables_offload: special ethertype handling for VLAN
    - [x86] vsock/vmci: log once the failed queue pair allocation
    - gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check
    - RDMA/cxgb4: add missing qpid increment
    - RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
    - ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails
    - sfc: ef10: fix TX queue lookup in TX event handling
    - vsock/virtio: free queued packets when closing socket
    - [armhf] net: davinci_emac: Fix incorrect masking of tx and rx error
      channel
    - [amd64] crypto: ccp: Detect and reject "invalid" addresses destined for
      PSP
    - nfp: devlink: initialize the devlink port attribute "lanes"
    - net: stmmac: fix TSO and TBS feature enabling during driver open
    - RDMA/rxe: Fix a bug in rxe_fill_ip_info()
    - RDMA/core: Add CM to restrack after successful attachment to a device
    - [powerpc*] 64: Fix the definition of the fixmap area
    - ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
    - ath10k: Fix a use after free in ath10k_htc_send_bundle
    - ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock
    - wlcore: Fix buffer overrun by snprintf due to incorrect buffer size
    - [powerpc*] perf: Fix the threshold event selection for memory events in
      power10
    - net: phy: marvell: fix m88e1011_set_downshift
    - net: phy: marvell: fix m88e1111_set_downshift
    - bnxt_en: fix ternary sign extension bug in bnxt_show_temp()
    - net: geneve: modify IP header check in geneve6_xmit_skb and
      geneve_xmit_skb
    - bnxt_en: Fix RX consumer index logic in the error path.
    - [x86] KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM
    - [arm64] net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
    - bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds
    - net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
    - net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
    - perf tools: Change fields type in perf_record_time_conv
    - perf jit: Let convert_timestamp() to be backwards-compatible
    - perf session: Add swap operation for event TIME_CONV
    - mm/sl?b.c: remove ctor argument from kmem_cache_flags
    - mm: memcontrol: slab: fix obtain a reference to a freeing memcg
    - mm/sparse: add the missing sparse_buffer_fini() in error branch
    - mm/memory-failure: unnecessary amount of unmapping
    - afs: Fix speculative status fetches
    - bpf: Fix alu32 const subreg bound tracking on bitwise operations
      (CVE-2021-3490)
    - bpf, ringbuf: Deny reserve of buffers larger than ringbuf (CVE-2021-3489)
    - bpf: Prevent writable memory-mapping of read-only ringbuf pages
    - [arm64] Remove arm64_dma32_phys_limit and its uses
    - net: Only allow init netns to set default tcp cong to a restricted algo
    - smp: Fix smp_call_function_single_async prototype
    - Revert "net/sctp: fix race condition in sctp_destroy_sock"
    - sctp: delay auto_asconf init until binding the first addr (CVE-2021-23133)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.38
    - [arm64,x86] tpm: fix error return code in tpm2_get_cc_attrs_tbl()
    - [arm64,x86] tpm, tpm_tis: Extend locality handling to TPM2 in
      tpm_tis_gen_interrupt()
    - [arm64,x86] tpm, tpm_tis: Reserve locality in tpm_tis_resume()
    - [x86] KVM: x86/mmu: Remove the defunct update_pte() paging hook
    - [x86] KVM/VMX: Invoke NMI non-IST entry instead of IST entry
    - ACPI: PM: Add ACPI ID of Alder Lake Fan
    - PM: runtime: Fix unpaired parent child_count for force_resume
    - [x86] cpufreq: intel_pstate: Use HWP if enabled by platform firmware
    - kvm: Cap halt polling at kvm->max_halt_poll_ns
    - ath11k: fix thermal temperature read
    - fs: dlm: fix debugfs dump
    - fs: dlm: add errno handling to check callback
    - fs: dlm: check on minimum msglen size
    - fs: dlm: flush swork on shutdown
    - tipc: convert dest node's address to network order
    - [x86] ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus
      T100TAF
    - net/mlx5e: Use net_prefetchw instead of prefetchw in MPWQE TX datapath
    - [arm64] net: stmmac: Set FIFO sizes for ipq806x
    - Bluetooth: Fix incorrect status handling in LE PHY UPDATE event
    - i2c: bail out early when RDWR parameters are wrong
    - ALSA: hdsp: don't disable if not enabled
    - ALSA: hdspm: don't disable if not enabled
    - ALSA: rme9652: don't disable if not enabled
    - ALSA: bebob: enable to deliver MIDI messages for multiple ports
    - Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default
    - Bluetooth: initialize skb_queue_head at l2cap_chan_create()
    - net/sched: cls_flower: use ntohs for struct flow_dissector_key_ports
    - net: bridge: when suppression is enabled exclude RARP packets
    - Bluetooth: check for zapped sk before connecting
    - [powerpc] 32: Statically initialise first emergency context
    - [arm64] net: hns3: remediate a potential overflow risk of bd_num_list
    - [arm64] net: hns3: add handling for xmit skb with recursive fraglist
    - ip6_vti: proper dev_{hold|put} in ndo_[un]init methods
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet
    - ice: handle increasing Tx or Rx ring sizes
    - Bluetooth: btusb: Enable quirk boolean flag for Mediatek Chip.
    - [x86] ASoC: rt5670: Add a quirk for the Dell Venue 10 Pro 5055
    - i2c: Add I2C_AQ_NO_REP_START adapter quirk
    - [mips64el,mipsel] MIPS: Loongson64: Use _CACHE_UNCACHED instead of
      _CACHE_UNCACHED_ACCELERATED
    - [amd64] IB/hfi1: Correct oversized ring allocation
    - mac80211: clear the beacon's CRC after channel switch
    - [armhf] pinctrl: samsung: use 'int' for register masks in Exynos
    - rtw88: 8822c: add LC calibration for RTL8822C
    - mt76: mt76x0: disable GTK offloading
    - fuse: invalidate attrs when page writeback completes
    - virtiofs: fix userns
    - cuse: prevent clone
    - iwlwifi: pcie: make cfg vs. trans_cfg more robust
    - [powerpc*] mm: Add cond_resched() while removing hpte mappings
    - Revert "iommu/amd: Fix performance counter initialization"
    - [amd64] iommu/amd: Remove performance counter pre-initialization test
    - ALSA: hda/realtek: Add quirk for Lenovo Ideapad S740
    - [x86] ASoC: Intel: sof_sdw: add quirk for new ADL-P Rvp
    - ALSA: hda/hdmi: fix race in handling acomp ELD notification at resume
    - sctp: Fix out-of-bounds warning in sctp_process_asconf_param()
    - flow_dissector: Fix out-of-bounds warning in __skb_flow_bpf_to_target()
    - [powerpc*] smp: Set numa node before updating mask
    - [x86] ASoC: rt286: Generalize support for ALC3263 codec
    - ethtool: ioctl: Fix out-of-bounds warning in
      store_link_ksettings_for_user()
    - net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule
    - [powerpc*] pseries: Stop calling printk in rtas_stop_self()
    - wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt
    - wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join
    - [powerpc*] iommu: Annotate nested lock for lockdep
    - iavf: remove duplicate free resources calls
    - kbuild: generate Module.symvers only when vmlinux exists
    - bnxt_en: Add PCI IDs for Hyper-V VF devices.
    - [ia64] module: fix symbolizer crash on fdescr
    - watchdog: rename __touch_watchdog() to a better descriptive name
    - watchdog: explicitly update timestamp when reporting softlockup
    - watchdog/softlockup: remove logic that tried to prevent repeated reports
    - watchdog: fix barriers when printing backtraces from all CPUs
    - [x86] ASoC: rt286: Make RT286_SET_GPIO_* readable and writable
    - thermal: thermal_of: Fix error return code of
      thermal_of_populate_bind_params()
    - f2fs: move ioctl interface definitions to separated file
    - f2fs: fix compat F2FS_IOC_{MOVE,GARBAGE_COLLECT}_RANGE
    - f2fs: fix to allow migrating fully valid segment
    - f2fs: fix panic during f2fs_resize_fs()
    - f2fs: fix a redundant call to f2fs_balance_fs if an error occurs
    - PCI: Release OF node in pci_scan_device()'s error path
    - [armel,armhf] 9064/1: hw_breakpoint: Do not directly check the event's
      overflow_handler hook
    - f2fs: fix to align to section for fallocate() on pinned file
    - f2fs: fix to update last i_size if fallocate partially succeeds
    - f2fs: fix to avoid touching checkpointed data in get_victim()
    - f2fs: fix to cover __allocate_new_section() with curseg_lock
    - f2fs: Fix a hungtask problem in atomic write
    - f2fs: fix to avoid accessing invalid fio in f2fs_allocate_data_block()
    - [arm64] rpmsg: qcom_glink_native: fix error return code of
      qcom_glink_rx_data()
    - NFS: nfs4_bitmask_adjust() must not change the server global bitmasks
    - NFS: Fix attribute bitmask in _nfs42_proc_fallocate()
    - NFSv4.2: Always flush out writes in nfs42_proc_fallocate()
    - NFS: Deal correctly with attribute generation counter overflow
    - pNFS/flexfiles: fix incorrect size check in decode_nfs_fh()
    - NFSv4.2 fix handling of sr_eof in SEEK's reply
    - SUNRPC: Move fault injection call sites
    - SUNRPC: Remove trace_xprt_transmit_queued
    - SUNRPC: Handle major timeout in xprt_adjust_timeout()
    - [arm64] thermal/drivers/tsens: Fix missing put_device error
    - NFSv4.x: Don't return NFS4ERR_NOMATCHING_LAYOUT if we're unmounting
    - nfsd: ensure new clients break delegations
    - SUNRPC: fix ternary sign expansion bug in tracing
    - xprtrdma: Avoid Receive Queue wrapping
    - xprtrdma: Fix cwnd update ordering
    - xprtrdma: rpcrdma_mr_pop() already does list_del_init()
    - swiotlb: Fix the type of index
    - ceph: fix inode leak on getattr error in __fh_to_dentry
    - scsi: qla2xxx: Prevent PRLI in target mode
    - scsi: ufs: core: Do not put UFS power into LPM if link is broken
    - scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend
    - scsi: ufs: core: Narrow down fast path in system suspend path
    - rtc: ds1307: Fix wday settings for rx8130
    - [arm64] net: hns3: fix incorrect configuration for igu_egu_hw_err
    - [arm64] net: hns3: initialize the message content in hclge_get_link_mode()
    - [arm64] net: hns3: add check for HNS3_NIC_STATE_INITED in
      hns3_reset_notify_up_enet()
    - [arm64] net: hns3: fix for vxlan gpe tx checksum bug
    - [arm64] net: hns3: use netif_tx_disable to stop the transmit queue
    - [arm64] net: hns3: disable phy loopback setting in hclge_mac_start_phy
    - sctp: do asoc update earlier in sctp_sf_do_dupcook_a
    - [riscv64] Fix error code returned by riscv_hartid_to_cpuid()
    - sunrpc: Fix misplaced barrier in call_decode
    - ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
    - sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b
    - netfilter: xt_SECMARK: add new revision to fix structure layout
    - net: stmmac: Clear receive all(RA) bit when promiscuous mode is off
    - drm/radeon: Fix off-by-one power_state index heap overwrite
    - drm/radeon: Avoid power table parsing memory leaks
    - [arm64] entry: factor irq triage logic into macros
    - [arm64] entry: always set GIC_PRIO_PSR_I_SET during entry
    - khugepaged: fix wrong result value for
      trace_mm_collapse_huge_page_isolate()
    - mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts()
    - mm/migrate.c: fix potential indeterminate pte entry in
      migrate_vma_insert_page()
    - ksm: fix potential missing rmap_item for stable_node
    - mm/gup: check every subpage of a compound page during isolation
    - mm/gup: return an error on migration failure
    - mm/gup: check for isolation errors
    - ethtool: fix missing NLM_F_MULTI flag when dumping
    - net: fix nla_strcmp to handle more then one trailing null character
    - smc: disallow TCP_ULP in smc_setsockopt()
    - netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check
    - netfilter: nftables: Fix a memleak from userdata error path in new objects
    - sched: Fix out-of-bound access in uclamp
    - sched/fair: Fix unfairness caused by missing load decay
    - fs/proc/generic.c: fix incorrect pde_is_permanent check
    - kernel: kexec_file: fix error return code of
      kexec_calculate_store_digests()
    - kernel/resource: make walk_system_ram_res() find all busy
      IORESOURCE_SYSTEM_RAM resources
    - kernel/resource: make walk_mem_res() find all busy IORESOURCE_MEM
      resources
    - netfilter: nftables: avoid overflows in nft_hash_buckets()
    - i40e: fix broken XDP support
    - i40e: Fix use-after-free in i40e_client_subtask()
    - i40e: fix the restart auto-negotiation after FEC modified
    - i40e: Fix PHY type identifiers for 2.5G and 5G adapters
    - f2fs: avoid unneeded data copy in f2fs_ioc_move_range()
    - [powerpc*] 64s: Fix crashes when toggling stf barrier
    - [powerpc*] 64s: Fix crashes when toggling entry flush barrier
    - hfsplus: prevent corruption in shrinking truncate
    - squashfs: fix divide error in calculate_skip()
    - userfaultfd: release page in error path to avoid BUG_ON
    - mm/hugetlb: fix F_SEAL_FUTURE_WRITE
    - blk-iocost: fix weight updates of inner active iocgs
    - [arm64] mte: initialize RGSR_EL1.SEED in __cpu_setup
    - [arm64] Fix race condition on PG_dcache_clean in __sync_icache_dcache()
    - btrfs: fix race leading to unpersisted data and metadata on fsync
    - drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors
      are connected
    - [x86] drm/i915: Avoid div-by-zero on gen2
    - kvm: exit halt polling on need_resched() as well
    - [x86] KVM: LAPIC: Accurately guarantee busy wait for timer to expire when
      using hv_timer
    - [arm64] drm/msm/dp: initialize audio_comp when audio starts
    - [x86] KVM: x86: Cancel pvclock_gtod_work on module removal
    - [x86] KVM: x86: Prevent deadlock against tk_core.seq
    - dax: Add an enum for specifying dax wakup mode
    - dax: Add a wakeup mode parameter to put_unlocked_entry()
    - dax: Wake up all waiters after invalidating dax entry
    - [amd64] xen/unpopulated-alloc: consolidate pgmap manipulation
    - [amd64] xen/unpopulated-alloc: fix error return code in fill_list()
    - [arm64,armhf] usb: dwc3: gadget: Free gadget structure only after freeing
      endpoints
    - iio: light: gp2ap002: Fix rumtime PM imbalance on error
    - iio: proximity: pulsedlight: Fix rumtime PM imbalance on error
    - [armhf] hwmon: (occ) Fix poll rate limiting
    - ACPI: scan: Fix a memory leak in an error handling path
    - kyber: fix out of bounds access when preempted
    - nvmet: add lba to sect conversion helpers
    - nvmet: fix inline bio check for bdev-ns
    - nvmet-rdma: Fix NULL deref when SEND is completed with error
    - f2fs: compress: fix to free compress page correctly
    - f2fs: compress: fix race condition of overwrite vs truncate
    - f2fs: compress: fix to assign cc.cluster_idx correctly
    - nbd: Fix NULL pointer in flush_workqueue
    - blk-mq: plug request for shared sbitmap
    - blk-mq: Swap two calls in blk_mq_exit_queue()
    - [armhf] usb: dwc3: omap: improve extcon initialization
    - [arm64] usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel
      Merrifield
    - usb: xhci: Increase timeout for HC halt
    - [arm*] usb: dwc2: Fix gadget DMA unmap direction
    - usb: core: hub: fix race condition about TRSMRCY of resume
    - [arm64,armhf] usb: dwc3: gadget: Enable suspend events
    - [arm64,armhf] usb: dwc3: gadget: Return success always for kick transfer
      in ep queue
    - [x86] usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4
    - [x86] usb: typec: ucsi: Put fwnode in any case during ->probe()
    - xhci-pci: Allow host runtime PM as default for Intel Alder Lake xHCI
    - xhci: Do not use GFP_KERNEL in (potentially) atomic context
    - xhci: Add reset resume quirk for AMD xhci controller.
    - iio: gyro: mpu3050: Fix reported temperature value
    - iio: tsl2583: Fix division by a zero lux_val
    - cdc-wdm: untangle a circular dependency between callback and softint
    - xen/gntdev: fix gntdev_mmap() error exit path
    - [x86] KVM: Emulate RDPID only if RDTSCP is supported
    - [x86] KVM: Move RDPID emulation intercept to its own enum
    - [x86] KVM: nVMX: Always make an attempt to map eVMCS after migration
    - [x86] KVM: VMX: Do not advertise RDPID if ENABLE_RDTSCP control is
      unsupported
    - [x86] KVM: VMX: Disable preemption when probing user return MSRs
    - Revert "iommu/vt-d: Remove WO permissions on second-level paging entries"
    - Revert "iommu/vt-d: Preset Access/Dirty bits for IOVA over FL"
    - iommu/vt-d: Preset Access/Dirty bits for IOVA over FL
    - iommu/vt-d: Remove WO permissions on second-level paging entries
    - mm: fix struct page layout on 32-bit systems
    - [mips*] Reinstate platform `__div64_32' handler
    - [mips*] Avoid DIVU in `__div64_32' is result would be zero
    - [mips*] Avoid handcoded DIVU in `__div64_32' altogether
    - [armhf] clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap
      issue
    - [armhf] clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata
      i940
    - [armel,armhf] 9011/1: centralize phys-to-virt conversion of DT/ATAGS
      address
    - [armel,armhf] 9012/1: move device tree mapping out of linear region
    - [armel,armhf] 9020/1: mm: use correct section size macro to describe the
      FDT virtual address
    - [armel,armhf] 9027/1: head.S: explicitly map DT even if it lives in the
      first physical section
    - [x86] usb: typec: tcpm: Fix error while calculating PPS out values
    - kobject_uevent: remove warning in init_uevent_argv()
    - [x86] drm/i915/gt: Fix a double free in gen8_preallocate_top_level_pdp
    - [x86] drm/i915: Read C0DRB3/C1DRB3 as 16 bits again
    - [x86] drm/i915/overlay: Fix active retire callback alignment
    - [x86] drm/i915: Fix crash in auto_retire
    - debugfs: Make debugfs_allow RO after init
    - ext4: fix debug format string warning
    - nvme: do not try to reconfigure APST when the controller is not live

  [ Vincent Blut ]
  * [x86] sound/soc/intel: Enable SND_SOC_INTEL_CATPT as module
    (Closes: #986822)
  * [x86] sound/soc/intel/boards: Enable SND_SOC_INTEL_BDW_RT5650_MACH as
    module
  * drivers/input/rmi4: Enable RMI4_F3A (Closes: #986848)
  * [armhf] drivers/gpio: Enable GPIO_MXC as module (Closes: #987019)
  * [x86] drivers/misc/mei: Enable INTEL_MEI_TXE, INTEL_MEI_HDCP as modules
    (Closes: #987281)

  [ Uwe Kleine-König ]
  * [arm64] Enable more options for NXP's i.MX8 (Closes: #985862)

  [ Salvatore Bonaccorso ]
  * vfs: move cap_convert_nscap() call into vfs_setxattr() (CVE-2021-3493)
  * Refresh "Makefile: Do not check for libelf when building OOT module"
  * Bump ABI to 7
  * Refresh "tools/include/uapi: Fix <asm/errno.h>"
  * [rt] Update to 5.10.35-rt39
  * [rt] Refresh "powerpc/mm/highmem: Switch to generic kmap atomic"
  * [arm64] udeb: Include mdio module for RPi4 ethernet in installer
    (Closes: #985956)

  [ Vagrant Cascadian ]
  * [arm64] Disable USB type-C DisplayPort in pinebook pro device-tree.
  * [arm64] Enable TYPEC_FUSB302, SND_SOC_ES8316, TYPEC and TYPEC_TCPM as
    modules. (Closes: #987638)

  [ Michal Simek ]
  * [arm64] Enable clock driver for Xilinx ZynqMP SoC

  [ Valentin Vidic ]
  * [s390x] udeb: Include standard scsi-modules containing the virtio_blk
    module (Closes: #988005)

  [ Ben Hutchings ]
  * kbuild: Abort build if SUBDIRS used (Closes: #987575)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 20 May 2021 07:47:35 +0200

linux (5.10.28-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.27
    - mm/memcg: rename mem_cgroup_split_huge_fixup to split_page_memcg and add
      nr_pages argument
    - mm/memcg: set memcg when splitting page
    - mt76: fix tx skb error handling in mt76_dma_tx_queue_skb
    - net: stmmac: fix dma physical address of descriptor when display ring
    - [arm64,armhf] net: fec: ptp: avoid register access when ipg clock is
      disabled
    - [powerpc*] 4xx: Fix build errors from mfdcr()
    - atm: eni: dont release is never initialized
    - atm: lanai: dont run lanai_dev_close if not open
    - Revert "r8152: adjust the settings about MAC clock speed down for RTL8153"
    - [x86] ALSA: hda: ignore invalid NHLT table
    - ixgbe: Fix memleak in ixgbe_configure_clsu32
    - blk-cgroup: Fix the recursive blkg rwstat
    - net: tehuti: fix error return code in bdx_probe()
    - net: intel: iavf: fix error return code of iavf_init_get_resources()
    - sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
    - gianfar: fix jumbo packets+napi+rx overrun crash (CVE-2021-29264)
    - cifs: ask for more credit on async read/write code paths
    - gfs2: fix use-after-free in trans_drain
    - [arm64,armhf] cpufreq: blacklist Arm Vexpress platforms in
      cpufreq-dt-platdev
    - gpiolib: acpi: Add missing IRQF_ONESHOT
    - nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
    - NFS: Correct size calculation for create reply length
    - [arm64] net: hisilicon: hns: fix error return code of
      hns_nic_clear_all_rx_fetch()
    - [arm64] net: enetc: set MAC RX FIFO to recommended value
    - atm: uPD98402: fix incorrect allocation
    - atm: idt77252: fix null-ptr-dereference
    - cifs: change noisy error message to FYI
    - kbuild: add image_name to no-sync-config-targets
    - umem: fix error return code in mm_pci_probe()
    - [sparc64] Fix opcode filtering in handling of no fault loads
    - u64_stats,lockdep: Fix u64_stats_init() vs lockdep
    - block: Fix REQ_OP_ZONE_RESET_ALL handling
    - drm/amdgpu: fb BO should be ttm_bo_type_device
    - drm/radeon: fix AGP dependency
    - nvme: simplify error logic in nvme_validate_ns()
    - nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request()
    - nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange()
    - nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted
    - nvme-core: check ctrl css before setting up zns
    - nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
    - nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a
    - nfs: we don't support removing system.nfs4_acl
    - block: Suppress uevent for hidden device when removed
    - mm/fork: clear PASID for new mm
    - [ia64] fix ia64_syscall_get_set_arguments() for break-based syscalls
    - [ia64] fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
    - static_call: Pull some static_call declarations to the type headers
    - [x86] static_call: Allow module use without exposing static_call_key
    - [x86] static_call: Fix the module key fixup
    - [x86] static_call: Fix static_call_set_init()
    - [x86] KVM: Protect userspace MSR filter with SRCU, and set atomically-ish
    - btrfs: fix sleep while in non-sleep context during qgroup removal
    - selinux: don't log MAC_POLICY_LOAD record on failed policy load
    - selinux: fix variable scope issue in live sidtab conversion
    - [arm64] netsec: restore phy power state after controller reset
    - [x86] platform/x86: intel-vbtn: Stop reporting SW_DOCK events
    - psample: Fix user API breakage
    - z3fold: prevent reclaim/free race for headless pages
    - squashfs: fix inode lookup sanity checks
    - squashfs: fix xattr id and id lookup sanity checks
    - hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared
      mappings
    - [x86] ACPI: video: Add missing callback back for Sony VPCEH3U1E
    - ACPICA: Always create namespace nodes using acpi_ns_create_node()
    - [arm64] stacktrace: don't trace arch_stack_walk()
    - integrity: double check iint_cache was initialized
    - [armhf] drm/etnaviv: Use FOLL_FORCE for userptr
    - drm/amdgpu: Add additional Sienna Cichlid PCI ID
    - [x86] drm/i915: Fix the GT fence revocation runtime PM logic
    - dm verity: fix DM_VERITY_OPTS_MAX value
    - dm ioctl: fix out of bounds array access when no devices
    - [armhf] bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
    - [armhf] OMAP2+: Fix smartreflex init regression after dropping legacy data
    - [armhf] soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7
      iva
    - veth: Store queue_mapping independently of XDP prog presence
    - bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF
    - net/mlx5e: RX, Mind the MPWQE gaps when calculating offsets
    - net/mlx5e: When changing XDP program without reset, take refs for XSK RQs
    - net/mlx5e: Don't match on Geneve options in case option masks are all zero
    - ipv6: fix suspecious RCU usage warning
    - drop_monitor: Perform cleanup upon probe registration failure
    - macvlan: macvlan_count_rx() needs to be aware of preemption
    - net: sched: validate stab values
    - [armhf] net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port
    - igc: reinit_locked() should be called with rtnl_lock
    - igc: Fix Pause Frame Advertising
    - igc: Fix Supported Pause Frame Link Setting
    - igc: Fix igc_ptp_rx_pktstamp()
    - e1000e: add rtnl_lock() to e1000_reset_task
    - e1000e: Fix error handling in e1000_set_d0_lplu_state_82571
    - net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
    - net: phy: broadcom: Add power down exit reset state delay
    - [armhf] ftgmac100: Restart MAC HW once
    - net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() (CVE-2021-29647)
    - flow_dissector: fix byteorder of dissected ICMP ID
    - netfilter: ctnetlink: fix dump of the expect mask attribute
    - net: phylink: Fix phylink_err() function name error in
      phylink_major_config
    - tipc: better validate user input in tipc_nl_retrieve_key()
      (CVE-2021-29646)
    - tcp: relookup sock for RST+ACK packets handled by obsolete req sock
    - can: isotp: isotp_setsockopt(): only allow to set low level TX flags for
      CAN-FD
    - can: isotp: TX-path: ensure that CAN frame flags are initialized
    - can: peak_usb: add forgotten supported devices
    - [arm64,armhf] can: flexcan: flexcan_chip_freeze(): fix chip freeze for
      missing bitrate
    - can: c_can_pci: c_can_pci_remove(): fix use-after-free
    - [armhf] can: c_can: move runtime PM enable/disable to c_can_platform
    - mac80211: fix rate mask reset
    - mac80211: Allow HE operation to be longer than expected.
    - nfp: flower: fix unsupported pre_tunnel flows
    - nfp: flower: add ipv6 bit to pre_tunnel control message
    - nfp: flower: fix pre_tun mask id allocation
    - ftrace: Fix modify_ftrace_direct.
    - [arm64] drm/msm/dsi: fix check-before-set in the 7nm dsi_pll code
    - net/sched: cls_flower: fix only mask bit check in the validate_ct_state
    - netfilter: nftables: report EOPNOTSUPP on unsupported flowtable flags
    - netfilter: nftables: allow to update flowtable flags
    - netfilter: flowtable: Make sure GC works periodically in idle system
    - [armhf] dts: imx6ull: fix ubi filesystem mount failed
    - ipv6: weaken the v4mapped source check
    - net: check all name nodes in __dev_alloc_name
    - net: cdc-phonet: fix data-interface release on probe failure
    - igb: check timestamp validity
    - r8152: limit the RX buffer size of RTL8153A for USB 2.0
    - [arm64,armhf] net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes
    - selinux: vsock: Set SID for socket returned by accept()
    - bpf: Fix umd memory leak in copy_process() (CVE-2021-29649)
    - can: isotp: tx-path: zero initialize outgoing CAN frames
    - [arm64] drm/msm: fix shutdown hook in case GPU components failed to bind
    - [arm64] drm/msm: Fix suspend/resume on i.MX5
    - [arm64] kdump: update ppos when reading elfcorehdr
    - PM: runtime: Defer suspending suppliers
    - net/mlx5: Add back multicast stats for uplink representor
    - net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP
    - net/mlx5e: Offload tuple rewrite for non-CT flows
    - net/mlx5e: Fix error path for ethtool set-priv-flag
    - PM: EM: postpone creating the debugfs dir till fs_initcall
    - net: bridge: don't notify switchdev for local FDB addresses
    - [amd64] xen/x86: make XEN_BALLOON_MEMORY_HOTPLUG_LIMIT depend on
      MEMORY_HOTPLUG
    - RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening
      server
    - bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs
    - net: Consolidate common blackhole dst ops
    - net, bpf: Fix ip6ip6 crash with collect_md populated skbs
    - igb: avoid premature Rx buffer reuse
    - net: phy: introduce phydev->port
    - net: phy: broadcom: Avoid forward for bcm54xx_config_clock_delay()
    - net: phy: broadcom: Set proper 1000BaseX/SGMII interface mode for
      BCM54616S
    - net: phy: broadcom: Fix RGMII delays for BCM50160 and BCM50610M
    - Revert "netfilter: x_tables: Switch synchronization to RCU"
    - netfilter: x_tables: Use correct memory barriers. (CVE-2021-29650)
    - dm table: Fix zoned model check and zone sectors check
    - mm/mmu_notifiers: ensure range_end() is paired with range_start()
    - Revert "netfilter: x_tables: Update remaining dereference to RCU"
    - ACPI: scan: Rearrange memory allocation in acpi_device_add()
    - ACPI: scan: Use unique number for instance_no
    - io_uring: fix provide_buffers sign extension
    - block: recalculate segment count for multi-segment discards correctly
    - scsi: Revert "qla2xxx: Make sure that aborted commands are freed"
    - scsi: qedi: Fix error return code of qedi_alloc_global_queues()
    - scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
    - smb3: fix cached file size problems in duplicate extents (reflink)
    - cifs: Adjust key sizes and key generation routines for AES256 encryption
    - locking/mutex: Fix non debug version of mutex_lock_io_nested()
    - mm/memcg: fix 5.10 backport of splitting page memcg
    - fs/cachefiles: Remove wait_bit_key layout dependency
    - can: dev: Move device back to init netns on owning netns delete
    - r8169: fix DMA being used after buffer free if WoL is enabled
    - [armhf] net: dsa: b53: VLAN filtering is global to all users
    - mac80211: fix double free in ibss_leave
    - ext4: add reclaim checks to xattr code
    - fs/ext4: fix integer overflow in s_log_groups_per_flex
    - [amd64] Revert "xen: fix p2m size in dom0 for disabled memory hotplug
      case"
    - Revert "net: bonding: fix error return code of bond_neigh_init()"
    - nvme: fix the nsid value to print in nvme_validate_or_alloc_ns
    - can: peak_usb: Revert "can: peak_usb: add forgotten supported devices"
    - xen-blkback: don't leak persistent grants from xen_blkbk_map()
      (CVE-2021-28688)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.28
    - [arm64] mm: correct the inside linear map range during hotplug check
    - bpf: Fix fexit trampoline.
    - virtiofs: Fail dax mount if device does not support it
    - ext4: shrink race window in ext4_should_retry_alloc()
    - ext4: fix bh ref count on error paths
    - rpc: fix NULL dereference on kmalloc failure
    - iomap: Fix negative assignment to unsigned sis->pages in
      iomap_swapfile_activate
    - [x86] ASoC: rt1015: fix i2c communication error
    - ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10
    - [x86] ASoC: rt5651: Fix dac- and adc- vol-tlv values being off by a factor
      of 10
    - [armhf] ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value
      on probe
    - [x86] ASoC: es8316: Simplify adc_pga_gain_tlv table
    - ASoC: soc-core: Prevent warning if no DMI table is present
    - NFSD: fix error handling in NFSv4.0 callbacks
    - kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for freezing
    - vhost: Fix vhost_vq_reset()
    - io_uring: fix ->flags races by linked timeouts
    - scsi: st: Fix a use after free in st_open()
    - scsi: qla2xxx: Fix broken #endif placement
    - [x86] staging: comedi: cb_pcidas: fix request_irq() warn
    - [x86] staging: comedi: cb_pcidas64: fix request_irq() warn
    - ASoC: rt711: add snd_soc_component remove callback
    - thermal/core: Add NULL pointer check before using cooling device stats
    - locking/ww_mutex: Simplify use_ww_ctx & ww_ctx handling
    - locking/ww_mutex: Fix acquire/release imbalance in
      ww_acquire_init()/ww_acquire_fini()
    - nvmet-tcp: fix kmap leak when data digest in use
    - io_uring: imply MSG_NOSIGNAL for send[msg]()/recv[msg]() calls
    - [x86] static_call: Align static_call_is_init() patching condition
    - ext4: do not iput inode under running transaction in ext4_rename()
    - io_uring: call req_set_fail_links() on short send[msg]()/recv[msg]() with
      MSG_WAITALL
    - [arm64,armhf] net: mvpp2: fix interrupt mask/unmask skip condition
    - flow_dissector: fix TTL and TOS dissection on IPv4 fragments
    - net: introduce CAN specific pointer in the struct net_device
    - brcmfmac: clear EAP/association status bits on linkdown events
    - ath11k: add ieee80211_unregister_hw to avoid kernel crash caused by NULL
      pointer
    - rtw88: coex: 8821c: correct antenna switch function
    - iwlwifi: pcie: don't disable interrupts for reg_lock
    - ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr()
    - [amd64,arm64] net: ethernet: aquantia: Handle error cleanup of start on
      open
    - appletalk: Fix skb allocation size in loopback case
    - net: wan/lmc: unregister device when no matching device is found
    - net: 9p: advance iov on empty read
    - bpf: Remove MTU check in __bpf_skb_max_len
    - ACPI: tables: x86: Reserve memory occupied by ACPI tables
    - ACPI: processor: Fix CPU0 wakeup in acpi_idle_play_dead()
    - ALSA: usb-audio: Apply sample rate quirk to Logitech Connect
    - ALSA: hda: Re-add dropped snd_poewr_change_state() calls
    - ALSA: hda: Add missing sanity checks in PM prepare/complete callbacks
    - ALSA: hda/realtek: fix a determine_headset_type issue for a Dell AIO
    - ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 640 G8
    - [x86] KVM: SVM: load control fields from VMCB12 before checking them
      (CVE-2021-29657)
    - [x86] KVM: SVM: ensure that EFER.SVME is set when running nested guest or
      on nested vmexit
    - PM: runtime: Fix race getting/putting suppliers at probe
    - PM: runtime: Fix ordering in pm_runtime_get_suppliers()
    - tracing: Fix stack trace event size
    - [s390x] vdso: copy tod_steering_delta value to vdso_data page
    - [s390x] vdso: fix tod_steering_delta type
    - mm: fix race by making init_zero_pfn() early_initcall
    - drm/amdgpu: fix offset calculation in amdgpu_vm_bo_clear_mappings()
    - drm/amdgpu: check alignment on CPU page for bo map
    - reiserfs: update reiserfs_xattrs_initialized() condition
    - [armhf] drm/imx: fix memory leak when fails to init
    - [arm64,armhf] drm/tegra: dc: Restore coupling of display controllers
    - [arm64,armhf] drm/tegra: sor: Grab runtime PM reference across reset
    - [arm64,armhf] pinctrl: rockchip: fix restore error in resume
    - extcon: Add stubs for extcon_register_notifier_all() functions
    - extcon: Fix error handling in extcon_dev_register
    - firmware: stratix10-svc: reset COMMAND_RECONFIG_FLAG_PARTIAL to 0
    - [arm64] usb: dwc3: pci: Enable dis_uX_susphy_quirk for Intel Merrifield
    - [x86] video: hyperv_fb: Fix a double free in hvfb_probe
    - firewire: nosy: Fix a use-after-free bug in nosy_ioctl() (CVE-2021-3483)
    - usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control()
    - USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem
    - [arm64,armhf] usb: musb: Fix suspend with devices connected for a64
    - cdc-acm: fix BREAK rx code path adding necessary calls
    - USB: cdc-acm: untangle a circular dependency between callback and softint
    - USB: cdc-acm: downgrade message to debug
    - USB: cdc-acm: fix double free on probe failure
    - USB: cdc-acm: fix use-after-free after probe failure
    - [i386] usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference
    - [arm*] usb: dwc2: Fix HPRT0.PrtSusp bit setting for HiKey 960 board.
    - [arm*] usb: dwc2: Prevent core suspend when port connection flag is 0
    - [arm64] usb: dwc3: qcom: skip interconnect init for ACPI probe
    - [arm64,armhf] usb: dwc3: gadget: Clear DEP flags after stop transfers in
      ep disable
    - soc: qcom-geni-se: Cleanup the code to remove proxy votes
    - [x86] staging: rtl8192e: Fix incorrect source in memcpy()
    - [x86] staging: rtl8192e: Change state information from u16 to u8
    - driver core: clear deferred probe reason on probe retry
    - drivers: video: fbcon: fix NULL dereference in fbcon_cursor()
    - [riscv64] evaluate put_user() arg before enabling user access
    - Revert "kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for
      freezing"
    - [amd64] bpf: Use NOP_ATOMIC5 instead of emit_nops(&prog, 5) for
      BPF_TRAMP_F_CALL_ORIG

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "u64_stats: Disable preemption on 32bit-UP/SMP with RT
    during updates"
  * Bump ABI to 6
  * [rt] Refresh "tracing: Merge irqflags + preempt counter."
  * bpf, x86: Validate computation of branch displacements for x86-64
    (CVE-2021-29154)
  * bpf, x86: Validate computation of branch displacements for x86-32
    (CVE-2021-29154)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 09 Apr 2021 20:17:58 +0200

linux (5.10.26-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.25
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.26
    - ALSA: dice: fix null pointer dereference when node is disconnected
    - ALSA: hda/realtek: apply pin quirk for XiaomiNotebook Pro
    - ALSA: hda: generic: Fix the micmute led init state
    - ALSA: hda/realtek: Apply headset-mic quirks for Xiaomi Redmibook Air
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 840 G8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 440 G8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 850 G8
    - Revert "PM: runtime: Update device status before letting suppliers
      suspend"
    - [s390x] vtime: fix increased steal time accounting
    - [s390x] pci: refactor zpci_create_device()
    - [s390x] pci: remove superfluous zdev->zbus check
    - [s390x] pci: fix leak of PCI device structure
    - zonefs: Fix O_APPEND async write handling
    - zonefs: prevent use of seq files as swap file
    - zonefs: fix to update .i_wr_refcnt correctly in zonefs_open_zone()
    - btrfs: fix race when cloning extent buffer during rewind of an old root
      (CVE-2021-28964)
    - btrfs: fix slab cache flags for free space tree bitmap
    - vhost-vdpa: fix use-after-free of v->config_ctx (CVE-2021-29266)
    - [armhf] ASoC: fsl_ssi: Fix TDM slot setup for I2S mode
    - [x86] ASoC: Intel: bytcr_rt5640: Fix HP Pavilion x2 10-p0XX OVCD current
      threshold
    - [x86] ASoC: SOF: Intel: unregister DMIC device on probe error
    - [x86] ASoC: SOF: intel: fix wrong poll bits in dsp power down
    - ASoC: qcom: sdm845: Fix array out of bounds access (CVE-2021-28952)
    - ASoC: qcom: sdm845: Fix array out of range on rx slim channels
    - [arm64] ASoC: qcom: lpass-cpu: Fix lpass dai ids parse
    - [arm*] ASoC: simple-card-utils: Do not handle device clock
    - afs: Fix accessing YFS xattrs on a non-YFS server
    - afs: Stop listxattr() from listing "afs.*" attributes
    - ALSA: usb-audio: Fix unintentional sign extension issue
    - nvme: fix Write Zeroes limitations
    - nvme-tcp: fix misuse of __smp_processor_id with preemption enabled
    - nvme-tcp: fix possible hang when failing to set io queues
    - nvme-tcp: fix a NULL deref when receiving a 0-length r2t PDU
    - nvmet: don't check iosqes,iocqes for discovery controllers
    - nfsd: Don't keep looking up unhashed files in the nfsd file cache
    - nfsd: don't abort copies early
    - NFSD: Repair misuse of sv_lock in 5.10.16-rt30.
    - NFSD: fix dest to src mount in inter-server COPY
    - svcrdma: disable timeouts on rdma backchannel
    - sunrpc: fix refcount leak for rpc auth modules
    - [x86] i915/perf: Start hrtimer only if sampling the OA buffer
    - pstore: Fix warning in pstore_kill_sb()
    - io_uring: ensure that SQPOLL thread is started for exit (CVE-2021-28951)
    - net/qrtr: fix __netdev_alloc_skb call
    - cifs: fix allocation size on newly created files
    - scsi: lpfc: Fix some error codes in debugfs
    - scsi: myrs: Fix a double free in myrs_cleanup()
    - [riscv64] correct enum sbi_ext_rfence_fid
    - gpiolib: Assign fwnode to parent's if no primary one provided
    - nvme-rdma: fix possible hang when failing to set io queues
    - [armhf] tty: serial: stm32-usart: Remove set but unused 'cookie' variables
    - [armhf] serial: stm32: fix DMA initialization error handling
    - bpf: Declare __bpf_free_used_maps() unconditionally
    - module: merge repetitive strings in module_sig_check()
    - module: avoid *goto*s in module_sig_check()
    - module: harden ELF info handling
    - scsi: pm80xx: Make mpi_build_cmd locking consistent
    - scsi: pm80xx: Make running_req atomic
    - scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition
    - scsi: pm8001: Neaten debug logging macros and uses
    - scsi: libsas: Remove notifier indirection
    - scsi: libsas: Introduce a _gfp() variant of event notifiers
    - scsi: mvsas: Pass gfp_t flags to libsas event notifiers
    - [x86] scsi: isci: Pass gfp_t flags in isci_port_link_down()
    - [x86] scsi: isci: Pass gfp_t flags in isci_port_link_up()
    - [x86] scsi: isci: Pass gfp_t flags in isci_port_bc_change_received()
    - RDMA/mlx5: Allow creating all QPs even when non RDMA profile is used
    - [powerpc*] sstep: Fix load-store and update emulation
    - [powerpc*] sstep: Fix darn emulation
    - i40e: Fix endianness conversions
    - net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8081
    - drm/amd/display: turn DPMS off on connector unplug
    - iwlwifi: Add a new card for MA family
    - io_uring: fix inconsistent lock state
    - [arm64,armhf] media: cedrus: h264: Support profile controls
    - [s390x] qeth: schedule TX NAPI on QAOB completion
    - io_uring: don't attempt IO reissue from the ring exit path
    - io_uring: clear IOCB_WAITQ for non -EIOCBQUEUED return
    - net: bonding: fix error return code of bond_neigh_init()
    - gfs2: Add common helper for holding and releasing the freeze glock
    - gfs2: move freeze glock outside the make_fs_rw and _ro functions
    - gfs2: bypass signal_our_withdraw if no journal
    - [powerpc*] Force inlining of cpu_has_feature() to avoid build failure
    - usb-storage: Add quirk to defeat Kindle's automatic unload
    - usbip: Fix incorrect double assignment to udc->ud.tcp_rx
    - usb: gadget: configfs: Fix KASAN use-after-free
    - [x86] usb: typec: Remove vdo[3] part of tps6598x_rx_identity_reg struct
    - [x86] usb: typec: tcpm: Invoke power_supply_changed for tcpm-source-psy-
    - [arm64,armhf] usb: dwc3: gadget: Allow runtime suspend if UDC unbinded
    - [arm64,armhf] usb: dwc3: gadget: Prevent EP queuing while stopping
      transfers
    - [x86] thunderbolt: Initialize HopID IDAs in tb_switch_alloc()
    - [x86] thunderbolt: Increase runtime PM reference count on DP tunnel
      discovery
    - iio: gyro: mpu3050: Fix error handling in mpu3050_trigger_handler
    - iio: adc: ad7949: fix wrong ADC result due to incorrect bit mask
    - iio: hid-sensor-prox: Fix scale not correct issue
    - iio: hid-sensor-temperature: Fix issues of timestamp channel
    - [powerpc*] PCI: rpadlpar: Fix potential drc_name corruption in store
      functions (CVE-2021-28972)
    - [x86] perf/x86/intel: Fix a crash caused by zero PEBS status
      (CVE-2021-28971)
    - [x86] perf/x86/intel: Fix unchecked MSR access error caused by VLBR_EVENT
    - [x86] ioapic: Ignore IRQ2 again
    - kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()
    - [x86] Move TS_COMPAT back to asm/thread_info.h
    - [x86] Introduce TS_COMPAT_RESTART to fix get_nr_restart_syscall()
    - efivars: respect EFI_UNSUPPORTED return from firmware
    - ext4: fix error handling in ext4_end_enable_verity()
    - ext4: find old entry again if failed to rename whiteout
    - ext4: stop inode update before return
    - ext4: do not try to set xattr into ea_inode if value is empty
    - ext4: fix potential error in ext4_do_update_inode
    - ext4: fix rename whiteout with fast commit
    - static_call: Fix static_call_update() sanity check
    - efi: use 32-bit alignment for efi_guid_t literals
    - firmware/efi: Fix a use after bug in efi_mem_reserve_persistent
    - genirq: Disable interrupts for force threaded handlers
    - [x86] apic/of: Fix CPU devicetree-node lookups
    - cifs: Fix preauth hash corruption

  [ Salvatore Bonaccorso ]
  * linux-image: Add Breaks: relation with old fwupdate versions
    (Closes: #985801)
  * [rt] Update to 5.10.25-rt35
  * Refresh "Include package version along with kernel release in stack
    traces"
  * Refresh "firmware: Remove redundant log messages from drivers"
  * Refresh "MODSIGN: checking the blacklisted hash before loading a kernel
    module"
  * libsas: Avoid ABI change for removal of notifier indirection

  [ Uwe Kleine-König ]
  * [arm64] Enable various configurations for i.MX8 (Closes: #985862)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 27 Mar 2021 15:14:11 +0100

linux (5.10.24-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.20
    - vmlinux.lds.h: add DWARF v5 sections
    - debugfs: be more robust at handling improper input in debugfs_lookup()
    - debugfs: do not attempt to create a new file before the filesystem is
      initalized
    - scsi: libsas: docs: Remove notify_ha_event()
    - scsi: qla2xxx: Fix mailbox Ch erroneous error
    - kdb: Make memory allocations more robust
    - w1: w1_therm: Fix conversion result for negative temperatures
    - [arm64] PCI: qcom: Use PHY_REFCLK_USE_PAD only for ipq8064
    - PCI: Decline to resize resources if boot config must be preserved
    - [x86] virt: vbox: Do not use wait_event_interruptible when called from
      kernel context
    - bfq: Avoid false bfq queue merging
    - ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode
    - [mips*] vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section
    - random: fix the RNDRESEEDCRNG ioctl
    - ALSA: pcm: Call sync_stop at disconnection
    - ALSA: pcm: Assure sync with the pending stop operation at suspend
    - ALSA: pcm: Don't call sync_stop if it hasn't been stopped
    - [arm64] Bluetooth: btqcomsmd: Fix a resource leak in error handling
      paths in the probe function
    - Bluetooth: hci_uart: Fix a race for write_work scheduling
    - Bluetooth: Fix initializing response id after clearing struct
    - [armhf] dts: exynos: correct PMIC interrupt trigger level on Spring
    - [armhf] dts: exynos: correct PMIC interrupt trigger level on Arndale
      Octa
    - Bluetooth: hci_qca: Fix memleak in qca_controller_memdump
    - [arm*] staging: vchiq: Fix bulk userdata handling
    - [arm*] staging: vchiq: Fix bulk transfers on 64-bit builds
    - [arm64,armhf] net: stmmac: dwmac-meson8b: fix enabling the
      timing-adjustment clock
    - bpf: Add bpf_patch_call_args prototype to include/linux/bpf.h
    - bpf: Avoid warning when re-casting __bpf_call_base into
      __bpf_call_base_args
    - [arm64] dts: allwinner: A64: properly connect USB PHY to port 0
    - [arm64] dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz
    - ACPICA: Fix exception code class checks
    - usb: gadget: u_audio: Free requests only after callback
    - Bluetooth: drop HCI device reference before return
    - Bluetooth: Put HCI device if inquiry procedure interrupts
    - [arm*] usb: dwc2: Do not update data length if it is 0 on inbound
      transfers
    - [arm*] usb: dwc2: Abort transaction after errors with unknown reason
    - [arm*] usb: dwc2: Make "trimming xfer length" a debug message
    - staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory
      rules
    - [x86] MSR: Filter MSR writes through X86_IOC_WRMSR_REGS ioctl too
    - [armhf] dts: armada388-helios4: assign pinctrl to LEDs
    - [armhf] dts: armada388-helios4: assign pinctrl to each fan
    - opp: Correct debug message in _opp_add_static_v2()
    - Bluetooth: btusb: Fix memory leak in btusb_mtk_wmt_recv
    - iwlwifi: mvm: set enabled in the PPAG command properly
    - [arm64] optee: simplify i2c access
    - ath10k: Fix suspicious RCU usage warning in
      ath10k_wmi_tlv_parse_peer_stats_info()
    - ath10k: Fix lockdep assertion warning in ath10k_sta_statistics
    - iwlwifi: mvm: fix the type we use in the PPAG table validity checks
    - iwlwifi: mvm: store PPAG enabled/disabled flag properly
    - iwlwifi: mvm: send stored PPAG command instead of local
    - iwlwifi: mvm: assign SAR table revision to the command later
    - iwlwifi: mvm: don't check if CSA event is running before removing
    - bpf_lru_list: Read double-checked variable once without lock
    - iwlwifi: pnvm: set the PNVM again if it was already loaded
    - iwlwifi: pnvm: increment the pointer before checking the TLV
    - bnxt_en: reverse order of TX disable and carrier off
    - bnxt_en: Fix devlink info's stored fw.psid version format.
    - xen/netback: fix spurious event detection for common event case
    - net: phy: consider that suspend2ram may cut off PHY power
    - net/mlx5e: Don't change interrupt moderation params when DIM is enabled
    - net/mlx5e: Change interrupt moderation channel params also when channels
      are closed
    - net/mlx5: Fix health error state handling
    - net/mlx5e: Replace synchronize_rcu with synchronize_net
    - net/mlx5e: kTLS, Use refcounts to free kTLS RX priv context
    - net/mlx5: Disable devlink reload for multi port slave device
    - net/mlx5: Disallow RoCE on multi port slave device
    - net/mlx5: Disallow RoCE on lag device
    - net/mlx5: Disable devlink reload for lag devices
    - net/mlx5e: CT: manage the lifetime of the ct entry object
    - net/mlx5e: Check tunnel offload is required before setting SWP
    - mac80211: fix potential overflow when multiplying to u32 integers
    - libbpf: Ignore non function pointer member in struct_ops
    - bpf: Fix an unitialized value in bpf_iter
    - bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation
    - bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx
    - tcp: fix SO_RCVLOWAT related hangs under mem pressure
    - cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in
      cxgb4 and ulds
    - b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
    - bpf: Clear subreg_def for global function return values
    - [amd64,arm64] net: amd-xgbe: Reset the PHY rx data path when mailbox
      command timeout
    - [amd64,arm64] net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout
      warning
    - [amd64,arm64] net: amd-xgbe: Reset link when the link never comes back
    - [amd64,arm64] net: amd-xgbe: Fix network fluctuations when using 1G
      BELFUSE SFP
    - [arm64,armhf] net: mvneta: Remove per-cpu queue mapping for Armada 3700
    - tty: convert tty_ldisc_ops 'read()' function to take a kernel pointer
    - tty: implement read_iter
    - [x86] drm/gma500: Fix error return code in psb_driver_load()
    - [x86] gma500: clean up error handling in init
    - drm/fb-helper: Add missed unlocks in setcmap_legacy()
    - [arm*] drm/vc4: hdmi: Take into account the clock doubling flag in
      atomic_check
    - [arm64] crypto: arm64/aes-ce - really hide slower algos when faster ones
      are enabled
    - [mips*] c-r4k: Fix section mismatch for loongson2_sc_init
    - drm/virtio: make sure context is created in gem open
    - media: em28xx: Fix use-after-free in em28xx_alloc_urbs
    - media: media/pci: Fix memleak in empress_init
    - [x86] media: tm6000: Fix memleak in tm6000_start_stream
    - sched/fair: Avoid stale CPU util_est value for schedutil in task dequeue
    - [arm64,armhf] drm/sun4i: tcon: fix inverted DCLK polarity
    - [mips*] properly stop .eh_frame generation
    - [arm64,armhf] drm/tegra: Fix reference leak when pm_runtime_get_sync()
      fails
    - bsg: free the request before return error code
    - media: lmedm04: Fix misuse of comma
    - media: qm1d1c0042: fix error return code in qm1d1c0042_init()
    - media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values
    - sched/eas: Don't update misfit status if the task is pinned
    - f2fs: compress: fix potential deadlock
    - [arm64] ASoC: qcom: lpass-cpu: Remove bit clock state check
    - perf/arm-cmn: Fix PMU instance naming
    - perf/arm-cmn: Move IRQs when migrating context
    - mm: proc: Invalidate TLB after clearing soft-dirty page state
    - f2fs: fix to avoid inconsistent quota data
    - f2fs: fix a wrong condition in __submit_bio
    - [arm64] ASoC: qcom: Fix typo error in HDMI regmap config callbacks
    - [x86] KVM: nSVM: Don't strip host's C-bit from guest's CR3 when reading
      PDPTRs
    - [x86] Drivers: hv: vmbus: Avoid use-after-free in
      vmbus_onoffer_rescind()
    - [x86] ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A5E
    - [x86] ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A3E
    - locking/lockdep: Avoid unmatched unlock
    - [arm64] ASoC: qcom: lpass: Fix i2s ctl register bit map
    - btrfs: clarify error returns values in __load_free_space_cache
    - btrfs: fix double accounting of ordered extent for subpage case in
      btrfs_invalidapge
    - [x86] KVM: Restore all 64 bits of DR6 and DR7 during RSM on x86-64
    - [s390x] zcrypt: return EIO when msg retry limit reached
    - [arm*] drm/vc4: hdmi: Move hdmi reset to bind
    - [arm*] drm/vc4: hdmi: Fix register offset with longer CEC messages
    - [arm*] drm/vc4: hdmi: Fix up CEC registers
    - [arm*] drm/vc4: hdmi: Restore cec physical address on reconnect
    - [arm*] drm/vc4: hdmi: Compute the CEC clock divider from the clock rate
    - [arm*] drm/vc4: hdmi: Update the CEC clock divider on HSM rate change
    - drm/dp_mst: Don't cache EDIDs for physical ports
    - crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key()
    - io_uring: fix possible deadlock in io_uring_poll
    - nvme-multipath: set nr_zones for zoned namespaces
    - nvmet: remove extra variable in identify ns
    - nvmet: set status to 0 in case for invalid nsid
    - [armel,armhf] ASoC: simple-card-utils: Fix device module clock
    - fs/jfs: fix potential integer overflow on shift of a int
    - jffs2: fix use after free in jffs2_sum_write_data()
    - smp: Process pending softirqs in flush_smp_call_function_from_idle()
    - capabilities: Don't allow writing ambiguous v3 file capabilities
    - [armhf] HSI: Fix PM usage counter unbalance in ssi_hw_init
    - [arm64,armhf] clk: meson: clk-pll: fix initializing the old rate
      (fallback) for a PLL
    - [arm64,armhf] clk: meson: clk-pll: make "ret" a signed integer
    - [arm64,armhf] clk: meson: clk-pll: propagate the error from
      meson_clk_pll_set_rate()
    - quota: Fix memory leak when handling corrupted quota file
    - [arm64] clk: sunxi-ng: h6: Fix CEC clock
    - HID: core: detect and skip invalid inputs to snto32()
    - fdt: Properly handle "no-map" field in the memory region
    - of/fdt: Make sure no-map does not remove already reserved regions
    - [armhf] spi: imx: Don't print error on -EPROBEDEFER
    - RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation
    - IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex
    - [arm64] clk: sunxi-ng: h6: Fix clock divider range on some clocks
    - [arm64,armhf] platform/chrome: cros_ec_proto: Use EC_HOST_EVENT_MASK not
      BIT
    - [arm64,armhf] platform/chrome: cros_ec_proto: Add LID and BATTERY to
      default mask
    - [arm64,armhf] regulator: axp20x: Fix reference cout leak
    - watch_queue: Drop references to /dev/watch_queue
    - certs: Fix blacklist flag type confusion
    - [armhf] regulator: s5m8767: Fix reference count leak
    - [armhf] regulator: s5m8767: Drop regulators OF node reference
    - [arm64,armhf] power: supply: axp20x_usb_power: Init work before enabling
      IRQs
    - regulator: core: Avoid debugfs: Directory ... already present! error
    - isofs: release buffer head before return
    - objtool: Fix error handling for STD/CLD warnings
    - objtool: Fix retpoline detection in asm code
    - objtool: Fix ".cold" section suffix check for newer versions of GCC
    - scsi: lpfc: Fix ancient double free
    - iommu: Switch gather->end to the inclusive end
    - IB/umad: Return EIO in case of when device disassociated
    - IB/umad: Return EPOLLERR in case of when device disassociated
    - [ppc64el] KVM: Make the VMX instruction emulation routines static
    - [powerpc*] time: Enable sched clock for irqtime
    - [armel,armhf] 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+
      cores
    - [arm*] amba: Fix resource leak for drivers without .remove
    - iommu: Move iotlb_sync_map out from __iommu_map
    - iommu: Properly pass gfp_t in _iommu_map() to avoid atomic sleeping
    - IB/mlx5: Return appropriate error code instead of ENOMEM
    - IB/cm: Avoid a loop when device has 255 ports
    - tracepoint: Do not fail unregistering a probe due to memory failure
    - perf tools: Fix DSO filtering when not finding a map for a sampled
      address
    - perf vendor events arm64: Fix Ampere eMag event typo
    - RDMA/rxe: Fix coding error in rxe_recv.c
    - RDMA/rxe: Fix coding error in rxe_rcv_mcast_pkt
    - RDMA/rxe: Correct skb on loopback path
    - [powerpc*] pseries/dlpar: handle ibm, configure-connector delay status
    - [arm64] RDMA/hns: Fixed wrong judgments in the goto branch
    - [arm64] RDMA/hns: Fix type of sq_signal_bits
    - [arm64] RDMA/hns: Disable RQ inline by default
    - clk: divider: fix initialization with parent_hw
    - [amd64] spi: pxa2xx: Fix the controller numbering for Wildcat Point
    - [powerpc*] uaccess: Avoid might_fault() when user access is enabled
    - [powerpc*] kuap: Restore AMR after replaying soft interrupts
    - perf symbols: Use (long) for iterator for bfd symbols
    - spi: Skip zero-length transfers in spi_transfer_one_message()
    - printk: avoid prb_first_valid_seq() where possible
    - perf symbols: Fix return value when loading PE DSO
    - nfsd: register pernet ops last, unregister first
    - svcrdma: Hold private mutex while invoking rdma_accept()
    - ceph: fix flush_snap logic after putting caps
    - [arm64] RDMA/hns: Fixes missing error code of CMDQ
    - RDMA/ucma: Fix use-after-free bug in ucma_create_uevent
    - Input: sur40 - fix an error code in sur40_probe()
    - perf record: Fix continue profiling after draining the buffer
    - perf intel-pt: Fix missing CYC processing in PSB
    - perf intel-pt: Fix premature IPC
    - perf intel-pt: Fix IPC with CYC threshold
    - perf test: Fix unaligned access in sample parsing test
    - Input: elo - fix an error code in elo_connect()
    - [arm64,armhf] phy: rockchip-emmc: emmc_phy_init() always return 0
    - [arm64,armhf] pwm: rockchip: Enable APB clock during register access
      while probing
    - [arm64,armhf] pwm: rockchip: rockchip_pwm_probe(): Remove superfluous
      clk_unprepare()
    - [arm64,armhf] pwm: rockchip: Eliminate potential race condition when
      probing
    - [x86] VMCI: Use set_page_dirty_lock() when unregistering guest memory
    - PCI: Align checking of syscall user config accessors
    - [x86] mei: hbm: call mei_set_devstate() on hbm stop response
    - [arm64] drm/msm: Fix MSM_INFO_GET_IOVA with carveout
    - [arm64] drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY)
    - [arm64] drm/msm/mdp5: Fix wait-for-commit for cmd panels
    - [arm64] drm/msm: Fix race of GPU init vs timestamp power management.
    - [arm64] drm/msm: Fix races managing the OOB state for timestamp vs
      timestamps.
    - [arm64] drm/msm/dp: trigger unplug event in msm_dp_display_disable
    - [amd64,arm64] vfio/iommu_type1: Populate full dirty when detach
      non-pinned group
    - [amd64,arm64] vfio/iommu_type1: Fix some sanity checks in detach group
    - ext4: fix potential htree index checksum corruption
    - nvmem: core: Fix a resource leak on error in nvmem_add_cells_from_of()
    - nvmem: core: skip child nodes not matching binding
    - soundwire: bus: use sdw_update_no_pm when initializing a device
    - soundwire: bus: use sdw_write_no_pm when setting the bus scale registers
    - soundwire: export sdw_write/read_no_pm functions
    - soundwire: bus: fix confusion on device used by pm_runtime
    - ext: EXT4_KUNIT_TESTS should depend on EXT4_FS instead of selecting it
    - PCI: pci-bridge-emul: Fix array overruns, improve safety
    - i40e: Fix flow for IPv6 next header (extension header)
    - i40e: Add zero-initialization of AQ command structures
    - i40e: Fix overwriting flow control settings during driver loading
    - i40e: Fix addition of RX filters after enabling FW LLDP agent
    - i40e: Fix VFs not created
    - Take mmap lock in cacheflush syscall
    - i40e: Fix add TC filter for IPv6
    - [amd64,arm64] vfio/type1: Use follow_pte()
    - ice: report correct max number of TCs
    - ice: Account for port VLAN in VF max packet size calculation
    - ice: Fix state bits on LLDP mode switch
    - ice: update the number of available RSS queues
    - [arm64,armhf] net: stmmac: fix CBS idleslope and sendslope calculation
    - net/mlx4_core: Add missed mlx4_free_cmd_mailbox()
    - [arm64] PCI: rockchip: Make 'ep-gpios' DT property optional
    - vxlan: move debug check after netdev unregister
    - wireguard: device: do not generate ICMP for non-IP packets
    - wireguard: kconfig: use arm chacha even with no neon
    - ocfs2: fix a use after free on error
    - mm: memcontrol: fix NR_ANON_THPS accounting in charge moving
    - mm: memcontrol: fix slub memory accounting
    - mm/memory.c: fix potential pte_unmap_unlock pte error
    - mm/hugetlb: fix potential double free in hugetlb_register_node() error
      path
    - mm/hugetlb: suppress wrong warning info when alloc gigantic page
    - mm/compaction: fix misbehaviors of fast_find_migrateblock()
    - NFSv4: Fixes for nfs4_bitmask_adjust()
    - [x86] KVM: SVM: Intercept INVPCID when it's disabled to inject #UD
    - [x86] KVM: x86/mmu: Expand collapsible SPTE zap for TDP MMU to
      ZONE_DEVICE and HugeTLB pages
    - [arm64] Add missing ISB after invalidating TLB in __primary_switch
    - [armhf] i2c: exynos5: Preserve high speed master code
    - mm,thp,shmem: make khugepaged obey tmpfs mount flags
    - mm: fix memory_failure() handling of dax-namespace metadata
    - mm/rmap: fix potential pte_unmap on an not mapped pte
    - proc: use kvzalloc for our kernel buffer
    - scsi: sd: sd_zbc: Don't pass GFP_NOIO to kvcalloc
    - block: reopen the device in blkdev_reread_part
    - scsi: sd: Fix Opal support
    - blk-settings: align max_sectors on "logical_block_size" boundary
    - ACPI: property: Fix fwnode string properties matching
    - ACPI: configfs: add missing check after
      configfs_register_default_group()
    - cpufreq: ACPI: Set cpuinfo.max_freq directly if max boost is known
    - HID: logitech-dj: add support for keyboard events in eQUAD step 4 Gaming
    - HID: wacom: Ignore attempts to overwrite the touch_max value from HID
    - Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox
      Series X|S
    - Input: joydev - prevent potential read overflow in ioctl
    - Input: i8042 - add ASUS Zenbook Flip to noselftest list
    - media: mceusb: Fix potential out-of-bounds shift
    - USB: serial: option: update interface mapping for ZTE P685M
    - [arm64,armhf] usb: musb: Fix runtime PM race in musb_queue_resume_work
    - [arm64,armhf] usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1
    - [arm64,armhf] usb: dwc3: gadget: Fix dep->interval for fullspeed
      interrupt
    - USB: serial: ftdi_sio: fix FTX sub-integer prescaler
    - USB: serial: pl2303: fix line-speed handling on newer chips
    - USB: serial: mos7840: fix error code in mos7840_write()
    - USB: serial: mos7720: fix error code in mos7720_write()
    - ALSA: hda: Add another CometLake-H PCI ID
    - ALSA: hda/hdmi: Drop bogus check at closing a stream
    - ALSA: hda/realtek: modify EAPD in the ALC886
    - ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup
    - [mips*] Ingenic: Disable HPTLB for D0 XBurst CPUs too
    - [mips*] Revert "MIPS: Octeon: Remove special handling of
      CONFIG_MIPS_ELF_APPENDED_DTB=y"
    - Revert "bcache: Kill btree_io_wq"
    - bcache: Give btree_io_wq correct semantics again
    - bcache: Move journal work to new flush wq
    - drm/amdgpu: Set reference clock to 100Mhz on Renoir (v2)
    - drm/nouveau/kms: handle mDP connectors
    - drm/modes: Switch to 64bit maths to avoid integer overflow
    - drm/sched: Cancel and flush all outstanding jobs before finish.
    - selinux: fix inconsistency between inode_getxattr and inode_listsecurity
    - tpm_tis: Fix check_locality for correct locality acquisition
    - tpm_tis: Clean up locality release
    - KEYS: trusted: Fix incorrect handling of tpm_get_random()
    - KEYS: trusted: Fix migratable=1 failing
    - KEYS: trusted: Reserve TPM for seal and unseal operations
    - btrfs: do not cleanup upper nodes in btrfs_backref_cleanup_node
    - btrfs: do not warn if we can't find the reloc root when looking up
      backref
    - btrfs: add asserts for deleting backref cache nodes
    - btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root
    - btrfs: fix reloc root leak with 0 ref reloc roots on recovery
    - btrfs: splice remaining dirty_bg's onto the transaction dirty bg list
    - btrfs: handle space_info::total_bytes_pinned inside the delayed ref
      itself
    - btrfs: account for new extents being deleted in total_bytes_pinned
    - btrfs: fix extent buffer leak on failure to copy root
    - [arm64] crypto: arm64/sha - add missing module aliases
    - [x86] crypto: aesni - prevent misaligned buffers on the stack
    - crypto: michael_mic - fix broken misalignment handling
    - seccomp: Add missing return in non-void function
    - [arm64] ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)
    - misc: rtsx: init of rts522a add OCP power off when no card is present
    - [x86] drivers/misc/vmw_vmci: restrict too big queue size in
      qp_host_alloc_queue
    - pstore: Fix typo in compression option name
    - staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table
    - floppy: reintroduce O_NDELAY fix
    - media: marvell-ccic: power up the device on mclk enable
    - media: smipcie: fix interrupt handling and IR timeout
    - [x86] virt: Eat faults on VMXOFF in reboot flows
    - [x86] reboot: Force all cpus to exit VMX root if VMX is supported
    - [x86] fault: Fix AMD erratum #91 errata fixup for user code
    - [x86] entry: Fix instrumentation annotation
    - [powerpc*] prom: Fix "ibm,arch-vec-5-platform-support" scan
    - rcu: Pull deferred rcuog wake up to rcu_eqs_enter() callers
    - rcu/nocb: Perform deferred wake up before last idle's need_resched()
      check
    - kprobes: Fix to delay the kprobes jump optimization
    - [arm64] Extend workaround for erratum 1024718 to all versions of
      Cortex-A55
    - [arm64] uprobe: Return EOPNOTSUPP for AARCH32 instruction probing
    - [arm64] module: set plt* section addresses to 0x0
    - [arm64] spectre: Prevent lockdep splat on v4 mitigation enable path
    - [arm64] watchdog: qcom: Remove incorrect usage of QCOM_WDT_ENABLE_IRQ
    - [x86] watchdog: mei_wdt: request stop on unregister
    - fs/affs: release old buffer head on error path
    - seq_file: document how per-entry resources are managed.
    - [x86] fix seq_file iteration for pat/memtype.c
    - mm: memcontrol: fix swap undercounting in cgroup2
    - mm: memcontrol: fix get_active_memcg return value
    - hugetlb: fix update_and_free_page contig page struct assumption
    - hugetlb: fix copy_huge_page_from_user contig page struct assumption
    - mm/vmscan: restore zone_reclaim_mode ABI
    - mm, compaction: make fast_isolate_freepages() stay within zone
    - [x86] KVM: nSVM: fix running nested guests when npt=0
    - nvmem: qcom-spmi-sdam: Fix uninitialized pdev pointer
    - module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols
    - [armhf] mmc: sdhci-esdhc-imx: fix kernel panic when remove module
    - mmc: sdhci-pci-o2micro: Bug fix for SDR104 HW tuning failure
    - [arm64] spmi: spmi-pmic-arb: Fix hw_irq overflow
    - [x86] mei: fix transfer over dma with extended header
    - [x86] mei: me: emmitsburg workstation DID
    - [x86] mei: me: add adler lake point S DID
    - [x86] mei: me: add adler lake point LP DID
    - [armhf] gpio: pcf857x: Fix missing first interrupt
    - printk: fix deadlock when kernel panic
    - exfat: fix shift-out-of-bounds in exfat_fill_super()
    - zonefs: Fix file size of zones in full condition
    - [x86] cpufreq: intel_pstate: Change intel_pstate_get_hwp_max() argument
    - [x86] cpufreq: intel_pstate: Get per-CPU max freq via
      MSR_HWP_CAPABILITIES if available
    - proc: don't allow async path resolution of /proc/thread-self components
    - [s390x] vtime: fix inline assembly clobber list
    - [s390x] virtio/s390: implement virtio-ccw revision 2 correctly
    - f2fs: fix out-of-repair __setattr_copy()
    - f2fs: enforce the immutable flag on open files
    - f2fs: flush data when enabling checkpoint back
    - gfs2: fix glock confusion in function signal_our_withdraw
    - gfs2: Don't skip dlm unlock if glock has an lvb
    - gfs2: Lock imbalance on error path in gfs2_recover_one
    - gfs2: Recursive gfs2_quota_hold in gfs2_iomap_end
    - dm: fix deadlock when swapping to encrypted device
    - dm table: fix iterate_devices based device capability checks
    - dm table: fix DAX iterate_devices based device capability checks
    - dm table: fix zoned iterate_devices based device capability checks
    - dm writecache: fix performance degradation in ssd mode
    - dm writecache: return the exact table values that were set
    - dm writecache: fix writing beyond end of underlying device when
      shrinking
    - dm era: Recover committed writeset after crash
    - dm era: Update in-core bitset after committing the metadata
    - dm era: Verify the data block size hasn't changed
    - dm era: Fix bitset memory leaks
    - dm era: Use correct value size in equality function of writeset tree
    - dm era: Reinitialize bitset cache before digesting a new writeset
    - dm era: only resize metadata in preresume
    - kgdb: fix to kill breakpoints on initmem after boot
    - ipv6: silence compilation warning for non-IPV6 builds
    - net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
    - wireguard: queueing: get rid of per-peer ring buffers
    - net: sched: fix police ext initialization
    - net_sched: fix RTNL deadlock again caused by request_module()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.21
    - net: usb: qmi_wwan: support ZTE P685M modem
    - Input: elantech - fix protocol errors for some trackpoints in SMBus mode
    - Input: elan_i2c - add new trackpoint report type 0x5F
    - drm/virtio: use kvmalloc for large allocations
    - [x86] build: Treat R_386_PLT32 relocation as R_386_PC32
    - JFS: more checks for invalid superblock
    - sched/core: Allow try_invoke_on_locked_down_task() with irqs disabled
    - udlfb: Fix memory leak in dlfb_usb_probe
    - media: mceusb: sanity check for prescaler value
    - erofs: fix shift-out-of-bounds of blkszbits
    - media: v4l2-ctrls.c: fix shift-out-of-bounds in std_validate
    - xfs: Fix assert failure in xfs_setattr_size()
    - [s390x] net/af_iucv: remove WARN_ONCE on malformed RX packets
    - tomoyo: ignore data race while checking quota
    - net: fix up truesize of cloned skb in skb_prepare_for_shift()
    - [riscv64] Get rid of MAX_EARLY_MAPPING_SIZE
    - nbd: handle device refs for DESTROY_ON_DISCONNECT properly
    - mm/hugetlb.c: fix unnecessary address expansion of pmd sharing
    - tcp: fix tcp_rmem documentation
    - net: bridge: use switchdev for port flags set through sysfs too
    - net/sched: cls_flower: Reject invalid ct_state flags rules
    - net: psample: Fix netlink skb length with tunnel info
    - net: fix dev_ifsioc_locked() race condition
    - dt-bindings: ethernet-controller: fix fixed-link specification
    - dt-bindings: net: btusb: DT fix s/interrupt-name/interrupt-names/
    - [arm64] ASoC: qcom: Remove useless debug print
    - rsi: Fix TX EAPOL packet handling against iwlwifi AP
    - rsi: Move card interrupt handling to RX thread
    - [x86] EDAC/amd64: Do not load on family 0x15, model 0x13
    - [x86] reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk
    - vt/consolemap: do font sum unsigned
    - [arm64,armhf] wlcore: Fix command execute failure 19 for wl12xx
    - Bluetooth: hci_h5: Set HCI_QUIRK_SIMULTANEOUS_DISCOVERY for btrtl
    - Bluetooth: btusb: fix memory leak on suspend and resume
    - pktgen: fix misuse of BUG_ON() in pktgen_thread_worker()
    - ath10k: fix wmi mgmt tx queue full due to race condition
    - net: sfp: add mode quirk for GPON module Ubiquiti U-Fiber Instant
    - Bluetooth: Add new HCI_QUIRK_NO_SUSPEND_NOTIFIER quirk
    - Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data
    - [arm*] staging: bcm2835-audio: Replace unsafe strcpy() with strscpy()
    - brcmfmac: Add DMI nvram filename quirk for Predia Basic tablet
    - brcmfmac: Add DMI nvram filename quirk for Voyo winpad A15 tablet
    - [arm64] drm/hisilicon: Fix use-after-free
    - crypto: tcrypt - avoid signed overflow in byte count
    - fs: make unlazy_walk() error handling consistent
    - drm/amdgpu: Add check to prevent IH overflow
    - PCI: Add a REBAR size quirk for Sapphire RX 5600 XT Pulse
    - [x86] ASoC: Intel: bytcr_rt5640: Add new BYT_RT5640_NO_SPEAKERS
      quirk-flag
    - media: uvcvideo: Allow entities with no pads
    - f2fs: handle unallocated section and zone on pinned/atgc
    - f2fs: fix to set/clear I_LINKABLE under i_lock
    - nvme-core: add cancel tagset helpers
    - nvme-rdma: add clean action for failed reconnection
    - nvme-tcp: add clean action for failed reconnection
    - ASoC: Intel: Add DMI quirk table to soc_intel_is_byt_cr()
    - btrfs: fix error handling in commit_fs_roots
    - [x86] perf/x86/kvm: Add Cascade Lake Xeon steppings to
      isolation_ucodes[]
    - [x86] ASoC: Intel: sof-sdw: indent and add quirks consistently
    - [x86] ASoC: Intel: sof_sdw: detect DMIC number based on mach params
    - sched/features: Fix hrtick reprogramming
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Estar Beauty HD MID
      7316R tablet
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Voyo Winpad A15
      tablet
    - [x86] ASoC: Intel: bytcr_rt5651: Add quirk for the Jumper EZpad 7 tablet
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Acer One S1002 tablet
    - scsi: iscsi: Restrict sessions and handles to admin capabilities
      (CVE-2021-27363, CVE-2021-27364)
    - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE
      (CVE-2021-27365)
    - scsi: iscsi: Verify lengths on passthrough PDUs (CVE-2021-27365)
    - Xen/gnttab: handle p2m update errors on a per-slot basis
      (CVE-2021-28038)
    - xen-netback: respect gnttab_map_refs()'s return value (CVE-2021-28038)
    - xen: fix p2m size in dom0 for disabled memory hotplug case
      (CVE-2021-28039)
    - zsmalloc: account the number of compacted pages correctly
    - swap: fix swapfile read/write offset
    - [powerpc*] sstep: Check instruction validity against ISA version before
      emulation
    - [powerpc*] sstep: Fix incorrect return from analyze_instr()
    - tty: fix up iterate_tty_read() EOVERFLOW handling
    - tty: fix up hung_up_tty_read() conversion
    - tty: clean up legacy leftovers from n_tty line discipline
    - tty: teach n_tty line discipline about the new "cookie continuations"
    - tty: teach the n_tty ICANON case about the new "cookie continuations"
      too
    - media: v4l: ioctl: Fix memory leak in video_usercopy
    - ALSA: hda/realtek: Add quirk for Clevo NH55RZQ
    - ALSA: hda/realtek: Add quirk for Intel NUC 10
    - ALSA: hda/realtek: Apply dual codec quirks for MSI Godlike X570 board
    - net: sfp: VSOL V2801F / CarlitoxxPro CPGOS03-0490 v2.0 workaround
    - net: sfp: add workaround for Realtek RTL8672 and RTL9601C chips
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.22
    - ALSA: hda/realtek: Enable headset mic of Acer SWIFT with ALC256
    - ALSA: usb-audio: Drop bogus dB range in too low level
    - tpm, tpm_tis: Decorate tpm_tis_gen_interrupt() with request_locality()
    - tpm, tpm_tis: Decorate tpm_get_timeouts() with request_locality()
    - btrfs: avoid double put of block group when emptying cluster
    - btrfs: fix raid6 qstripe kmap
    - btrfs: fix race between writes to swap files and scrub
    - btrfs: fix race between swap file activation and snapshot creation
    - btrfs: fix stale data exposure after cloning a hole with NO_HOLES
      enabled
    - btrfs: fix race between extent freeing/allocation when using bitmaps
    - btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl
    - btrfs: free correct amount of space in
      btrfs_delayed_inode_reserve_metadata
    - btrfs: unlock extents in btrfs_zero_range in case of quota reservation
      errors
    - btrfs: fix warning when creating a directory with smack enabled
    - PM: runtime: Update device status before letting suppliers suspend
    - ring-buffer: Force before_stamp and write_stamp to be different on
      discard
    - io_uring: ignore double poll add on the same waitqueue head
    - dm bufio: subtract the number of initial sectors in
      dm_bufio_get_device_size
    - drm/amdgpu:disable VCN for Navi12 SKU
    - drm/amdgpu: fix parameter error of RREG32_PCIE() in amdgpu_regs_pcie
    - [arm64] mm: Move reserve_crashkernel() into mem_init()
    - [arm64] mm: Move zone_dma_bits initialization into zone_sizes_init()
    - of/address: Introduce of_dma_get_max_cpu_address()
    - [arm64] mm: Set ZONE_DMA size based on devicetree's dma-ranges
    - [arm64] mm: Set ZONE_DMA size based on early IORT scan
    - ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits
    - RDMA/cm: Fix IRQ restore in ib_send_cm_sidr_rep
    - IB/mlx5: Add missing error code
    - ALSA: hda: intel-nhlt: verify config type
    - ftrace: Have recordmcount use w8 to read relp->r_info in
      arm64_is_fake_mcount
    - rsxx: Return -EFAULT if copy_to_user() fails
    - [amd64] iommu/vt-d: Fix status code for Allocate/Free PASID command
    - tomoyo: recognize kernel threads correctly
    - r8169: fix resuming from suspend on RTL8105e if machine runs on battery
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.23
    - ACPICA: Fix race in generic_serial_bus (I2C) and GPIO op_region
      parameter handling
    - nvme-pci: mark Kingston SKC2000 as not supporting the deepest power
      state
    - btrfs: export and rename qgroup_reserve_meta
    - btrfs: don't flush from btrfs_delayed_inode_reserve_metadata
    - [amd64] iommu/amd: Fix sleeping in atomic in increase_address_space()
    - Bluetooth: btqca: Add valid le states quirk
    - mwifiex: pcie: skip cancel_work_sync() on reset failure path
    - [x86] ASoC: Intel: sof_sdw: add quirk for new TigerLake-SDCA device
    - [armhf] bus: ti-sysc: Implement GPMC debug quirk to drop platform data
    - [x86] platform/x86: acer-wmi: Cleanup ACER_CAP_FOO defines
    - [x86] platform/x86: acer-wmi: Cleanup accelerometer device handling
    - [x86] platform/x86: acer-wmi: Add new force_caps module parameter
    - [x86] platform/x86: acer-wmi: Add ACER_CAP_SET_FUNCTION_MODE capability
      flag
    - [x86] platform/x86: acer-wmi: Add support for SW_TABLET_MODE on Switch
      devices
    - [x86] platform/x86: acer-wmi: Add ACER_CAP_KBD_DOCK quirk for the Aspire
      Switch 10E SW3-016
    - HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube
      Adapter
    - media: cx23885: add more quirks for reset DMA on some AMD IOMMU
    - [x86] ACPI: video: Add DMI quirk for GIGABYTE GB-BXBT-2807
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for ARCHOS Cesium 140
    - PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller
    - [x86] KVM: x86: Supplement __cr4_reserved_bits() with X86_FEATURE_PCID
      check
    - [x86] ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A32
    - scsi: ufs: Add a quirk to permit overriding UniPro defaults
    - misc: eeprom_93xx46: Add quirk to support Microchip 93LC46B eeprom
    - scsi: ufs: Introduce a quirk to allow only page-aligned sg entries
    - [arm64] drm/msm/a5xx: Remove overwriting A5XX_PC_DBG_ECO_CNTL register
    - HID: i2c-hid: Add I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for ITE8568 EC on
      Voyo Winpad A15
    - ALSA: usb-audio: Add DJM750 to Pioneer mixer quirk
    - ALSA: usb-audio: add mixer quirks for Pioneer DJM-900NXS2
    - [x86] ASoC: Intel: sof_sdw: reorganize quirks by generation
    - [x86] ASoC: Intel: sof_sdw: add quirk for HP Spectre x360 convertible
    - [x86] KVM: SVM: Clear the CR4 register on reset
    - nvme-pci: mark Seagate Nytro XM1440 as QUIRK_NO_NS_DESC_LIST.
    - nvme-pci: add quirks for Lexar 256GB SSD
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.24
    - uapi: nfnetlink_cthelper.h: fix userspace compilation error
    - [powerpc*] perf: Fix handling of privilege level checks in perf interrupt
      context
    - [powerpc*] pseries: Don't enforce MSI affinity with kdump
    - ethernet: alx: fix order of calls on resume (Closes: #983595)
    - [mips*] crypto: mips/poly1305 - enable for all MIPS processors
    - ath9k: fix transmitting to stations in dynamic SMPS mode
    - net: Fix gro aggregation for udp encaps with zero csum
    - net: check if protocol extracted by virtio_net_hdr_set_proto is correct
    - net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0
    - net: l2tp: reduce log level of messages in receive path, add counter
      instead
    - can: skb: can_skb_set_owner(): fix ref counting if socket was closed
      before setting skb ownership
    - [armhf] can: flexcan: assert FRZ bit in flexcan_chip_freeze()
    - [armhf] can: flexcan: enable RX FIFO after FRZ/HALT valid
    - [armhf] can: flexcan: invoke flexcan_chip_freeze() to enter freeze mode
    - tcp: Fix sign comparison bug in getsockopt(TCP_ZEROCOPY_RECEIVE)
    - tcp: add sanity tests to TCP_QUEUE_SEQ
    - netfilter: nf_nat: undo erroneous tcp edemux lookup
    - netfilter: x_tables: gpf inside xt_find_revision()
    - net: always use icmp{,v6}_ndo_send from ndo_start_xmit
    - net: phy: fix save wrong speed and duplex problem if autoneg is on
    - mt76: dma: do not report truncated frames to mac80211
    - [powerpc*] 603: Fix protection of user pages mapped with PROT_NONE
    - mount: fix mounting of detached mounts onto targets that reside on shared
      mounts
    - cifs: return proper error code in statfs(2)
    - Revert "mm, slub: consider rest of partial list if acquire_slab() fails"
    - docs: networking: drop special stable handling
    - [arm64] net: enetc: don't overwrite the RSS indirection table when
      initializing
    - [arm64] net: enetc: take the MDIO lock only once per NAPI poll cycle
    - [arm64] net: enetc: fix incorrect TPID when receiving 802.1ad tagged
      packets
    - [arm64] net: enetc: don't disable VLAN filtering in IFF_PROMISC mode
    - [arm64] net: enetc: force the RGMII speed and duplex instead of operating
      in inband mode
    - [arm64] net: enetc: remove bogus write to SIRXIDR from enetc_setup_rxbdr
    - [arm64] net: enetc: keep RX ring consumer index in sync with hardware
    - net/mlx4_en: update moderation when config reset
    - net: stmmac: fix incorrect DMA channel intr enable setting of EQoS v4.10
    - nexthop: Do not flush blackhole nexthops when loopback goes down
    - net: sched: avoid duplicates in classes dump
    - [arm64] net: mscc: ocelot: properly reject destination IP keys in VCAP IS1
    - net: usb: qmi_wwan: allow qmimux add/del with master up
    - cipso,calipso: resolve a number of problems with the DOI refcounts
    - net: stmmac: Fix VLAN filter delete timeout issue in Intel mGBE SGMII
    - [x86] stmmac: intel: Fixes clock registration error seen for multiple
      interfaces
    - [arm64] net: enetc: allow hardware timestamping on TX queues with tc-etf
      enabled
    - net: qrtr: fix error return code of qrtr_sendmsg()
    - [s390x] qeth: fix memory leak after failed TX Buffer allocation
    - r8169: fix r8168fp_adjust_ocp_cmd function
    - ixgbe: fail to create xfrm offload of IPsec tunnel mode SA
    - net: stmmac: stop each tx channel independently
    - net: stmmac: fix watchdog timeout during suspend/resume stress test
    - net: stmmac: fix wrongly set buffer2 valid when sph unsupport
    - ethtool: fix the check logic of at least one channel for RX/TX
    - net: phy: make mdio_bus_phy_suspend/resume as __maybe_unused
    - perf traceevent: Ensure read cmdlines are null terminated.
    - perf report: Fix -F for branch & mem modes
    - [arm64] net: hns3: fix query vlan mask value error for flow director
    - [arm64] net: hns3: fix bug when calculating the TCAM table info
    - bnxt_en: reliably allocate IRQ table on reset to avoid crash
    - gpiolib: acpi: Add ACPI_GPIO_QUIRK_ABSOLUTE_NUMBER quirk
    - gpiolib: acpi: Allow to find GpioInt() resource by name and index
    - [arm64,armhf] gpio: pca953x: Set IRQ type when handle Intel Galileo Gen 2
    - gpio: fix gpio-device list corruption
    - drm/compat: Clear bounce structures
    - drm/amd/display: Add a backlight module option
    - drm/amd/display: Fix nested FPU context in dcn21_validate_bandwidth()
    - drm/shmem-helper: Check for purged buffers in fault handler
    - drm/shmem-helper: Don't remove the offset in vm_area_struct pgoff
    - drm: Use USB controller's DMA mask when importing dmabufs
    - [arm64] drm: meson_drv add shutdown function
    - drm/shmem-helpers: vunmap: Don't put pages for dma-buf
    - [x86] drm/i915: Wedge the GPU if command parser setup fails
    - qxl: Fix uninitialised struct field head.surface_id
    - media: usbtv: Fix deadlock on suspend
    - media: rc: compile rc-cec.c into rc-core
    - cifs: fix credit accounting for extra channel
    - [arm64] net: hns3: fix error mask definition of flow director
    - [s390x] qeth: don't replace a fully completed async TX buffer
    - [s390x] qeth: remove QETH_QDIO_BUF_HANDLED_DELAYED state
    - [s390x] qeth: improve completion of pending TX buffers
    - [s390x] qeth: fix notification for pending buffers during teardown
    - [arm64,armhf] net: dsa: implement a central TX reallocation procedure
    - [arm64,armhf] net: dsa: trailer: don't allocate additional memory for
      padding/tagging
    - [arm64] net: dsa: tag_ocelot: let DSA core deal with TX reallocation
    - [arm64,armhf] net: dsa: tag_edsa: let DSA core deal with TX reallocation
    - [armhf] net: dsa: tag_brcm: let DSA core deal with TX reallocation
    - [arm64,armhf] net: dsa: tag_dsa: let DSA core deal with TX reallocation
    - [arm64] enetc: Fix unused var build warning for CONFIG_OF
    - [arm64] net: enetc: initialize RFS/RSS memories for unused ports too
    - ath11k: peer delete synchronization with firmware
    - ath11k: start vdev if a bss peer is already created
    - ath11k: fix AP mode for QCA6390
    - scsi: ufs: WB is only available on LUN #0 to #7
    - udf: fix silent AED tagLocation corruption
    - [amd64] iommu/vt-d: Clear PRQ overflow only when PRQ is empty
    - [arm*] mmc: sdhci-iproc: Add ACPI bindings for the RPi
    - Platform: OLPC: Fix probe error handling
    - [powerpc*] pci: Add ppc_md.discover_phbs()
    - [armhf] spi: stm32: make spurious and overrun interrupts visible
    - [powerpc] improve handling of unrecoverable system reset
    - [powerpc] perf: Record counter overflow always if SAMPLE_IP is unset
    - HID: logitech-dj: add support for the new lightspeed connection iteration
    - [powerpc*] 64: Fix stack trace not displaying final frame
    - [amd64] iommu/amd: Fix performance counter initialization
    - [arm64] clk: qcom: gdsc: Implement NO_RET_PERIPH flag
    - [x86] Input: applespi - don't wait for responses to commands indefinitely.
    - [arm64] PCI: xgene-msi: Fix race in installing chained irq handler
    - ext4: don't try to processed freed blocks until mballoc is initialized
    - kbuild: clamp SUBLEVEL to 255
    - PCI: Fix pci_register_io_range() memory leak
    - i40e: Fix memory leak in i40e_probe
    - [s390x] smp: __smp_rescan_cpus() - move cpumask away from stack
    - drivers/base/memory: don't store phys_device in memory blocks
    - sysctl.c: fix underflow value setting risk in vm_table
    - scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling
    - scsi: target: core: Add cmd length set before cmd complete
    - scsi: target: core: Prevent underflow for service actions
    - mmc: sdhci: Update firmware interface API
    - [arm*] assembler: introduce adr_l, ldr_l and str_l macros
    - [arm*] efistub: replace adrl pseudo-op with adr_l macro invocation
    - ALSA: usb: Add Plantronics C320-M USB ctrl msg delay quirk
    - ALSA: hda/hdmi: Cancel pending works before suspend
    - ALSA: hda/conexant: Add quirk for mute LED control on HP ZBook G5
    - ALSA: hda/ca0132: Add Sound BlasterX AE-5 Plus support
    - ALSA: hda: Drop the BATCH workaround for AMD controllers
    - ALSA: hda: Flush pending unsolicited events before suspend
    - ALSA: hda: Avoid spurious unsol event handling during S3/S4
    - ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar
    - ALSA: usb-audio: Apply the control quirk to Plantronics headsets
    - ALSA: usb-audio: Disable USB autosuspend properly in
      setup_disable_autosuspend()
    - ALSA: usb-audio: fix NULL ptr dereference in usb_audio_probe
    - ALSA: usb-audio: fix use after free in usb_audio_disconnect
    - Revert 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file
      capabilities")
    - block: Discard page cache of zone reset target range
    - block: Try to handle busy underlying device on discard
    - [arm64] mte: Map hotplugged memory as Normal Tagged
    - [arm64] perf: Fix 64-bit event counter read truncation
    - [s390x] dasd: fix hanging DASD driver unbind
    - [s390]x dasd: fix hanging IO request during DASD driver unbind
    - software node: Fix node registration
    - xen/events: reset affinity of 2-level event when tearing it down
    - [arm64,armhf] mmc: mmci: Add MMC_CAP_NEED_RSP_BUSY for the stm32 variants
    - mmc: core: Fix partition switch time for eMMC
    - mmc: cqhci: Fix random crash when remove mmc module/card
    - cifs: do not send close in compound create+close requests
    - Goodix Fingerprint device is not a modem
    - usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio
      slot
    - usb: gadget: f_uac1: stop playback on function disable
    - [arm64] usb: dwc3: qcom: Add missing DWC3 OF node refcount decrement
    - [arm64] usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot
    - [arm64] usb: dwc3: qcom: add ACPI device id for sc8180x
    - [arm64] usb: dwc3: qcom: Honor wakeup enabled/disabled state
    - USB: usblp: fix a hang in poll() if disconnected
    - usb: xhci: do not perform Soft Retry for some xHCI hosts
    - xhci: Improve detection of device initiated wake signal.
    - usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing
    - xhci: Fix repeated xhci wake after suspend due to uncleared internal wake
      state
    - USB: serial: io_edgeport: fix memory leak in edge_startup
    - USB: serial: ch341: add new Product ID
    - USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter
    - USB: serial: cp210x: add some more GE USB IDs
    - usbip: fix stub_dev to check for stream socket
    - usbip: fix vhci_hcd to check for stream socket
    - usbip: fix vudc to check for stream socket
    - usbip: fix stub_dev usbip_sockfd_store() races leading to gpf
    - usbip: fix vhci_hcd attach_store() races leading to gpf
    - usbip: fix vudc usbip_sockfd_store races leading to gpf
    - [x86] misc/pvpanic: Export module FDT device table
    - misc: fastrpc: restrict user apps from sending kernel RPC messages
      (CVE-2021-28375)
    - [x86] staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan()
    - staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan()
      (CVE-2021-28660)
    - staging: rtl8712: unterminated string leads to read overflow
    - staging: rtl8188eu: fix potential memory corruption in
      rtw_check_beacon_data()
    - staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd
    - [x86] staging: rtl8192e: Fix possible buffer overflow in
      _rtl92e_wx_set_scan
    - [x86] staging: comedi: addi_apci_1032: Fix endian problem for COS sample
    - [x86] staging: comedi: addi_apci_1500: Fix endian problem for command
      sample
    - [x86] staging: comedi: adv_pci1710: Fix endian problem for AI command data
    - [i386] staging: comedi: das6402: Fix endian problem for AI command data
    - [i386] staging: comedi: das800: Fix endian problem for AI command data
    - [i386] staging: comedi: dmm32at: Fix endian problem for AI command data
    - [x86] staging: comedi: me4000: Fix endian problem for AI command data
    - [i386] staging: comedi: pcl711: Fix endian problem for AI command data
    - [i386] staging: comedi: pcl818: Fix endian problem for AI command data
    - [arm64] mm: Fix pfn_valid() for ZONE_DEVICE based memory
    - SUNRPC: Set memalloc_nofs_save() for sync tasks
    - NFS: Don't revalidate the directory permissions on a lookup failure
    - NFS: Don't gratuitously clear the inode cache when lookup failed
    - NFSv4.2: fix return value of _nfs4_get_security_label()
    - block: rsxx: fix error return code of rsxx_pci_probe()
    - nvme-fc: fix racing controller reset and create association
    - configfs: fix a use-after-free in __configfs_open_file
    - [arm64] mm: use a 48-bit ID map when possible on 52-bit VA builds
    - perf/core: Flush PMU internal buffers for per-CPU events
    - [x86] perf/x86/intel: Set PERF_ATTACH_SCHED_CB for large PEBS and LBR
    - hrtimer: Update softirq_expires_next correctly after
      __hrtimer_get_next_event()
    - seqlock,lockdep: Fix seqcount_latch_init()
    - stop_machine: mark helpers __always_inline
    - include/linux/sched/mm.h: use rcu_dereference in in_vfork()
    - zram: fix return value on writeback_store
    - sched/membarrier: fix missing local execution of ipi_sync_rq_state()
    - efi: stub: omit SetVirtualAddressMap() if marked unsupported in RT_PROP
      table
    - [powerpc*] 64s: Fix instruction encoding for lis in ppc_function_entry()
    - [powerpc*] Fix inverted SET_FULL_REGS bitop
    - [powerpc*] Fix missing declaration of [en/dis]able_kernel_vsx()
    - binfmt_misc: fix possible deadlock in bm_register_write
    - [amd64] x86/unwind/orc: Disable KASAN checking in the ORC unwinder, part 2
    - [x86] entry: Move nmi entry/exit into common code
    - [x86] entry: Fix entry/exit mismatch on failed fast 32-bit syscalls
    - [x86] KVM: Ensure deadline timer has truly expired before posting its IRQ
    - [x86] KVM: kvmclock: Fix vCPUs > 64 can't be online/hotpluged
    - [arm64] KVM: Fix range alignment when walking page tables
    - [arm64] KVM: Avoid corrupting vCPU context register in guest exit
    - [arm64] KVM: nvhe: Save the SPE context early
    - [arm64] KVM: Reject VM creation when the default IPA size is unsupported
    - [arm64] KVM: Fix exclusive limit for IPA size
    - mm/userfaultfd: fix memory corruption due to writeprotect
    - mm/madvise: replace ptrace attach requirement for process_madvise
    - [arm64] KVM: Ensure I-cache isolation between vcpus of a same VM
    - mm/page_alloc.c: refactor initialization of struct page for holes in
      memory layout
    - xen/events: don't unmask an event channel when an eoi is pending
    - xen/events: avoid handling the same event on two cpus at the same time
    - [arm64] KVM: Fix nVHE hyp panic host context restore
    - RDMA/umem: Use ib_dma_max_seg_size instead of dma_get_max_seg_size

  [ Salvatore Bonaccorso ]
  * Bump ABI to 5
  * [rt] Refresh "printk: remove logbuf_lock"
  * [rt] Refresh "printk: remove safe buffers"
  * [rt] Refresh "printk: remove deferred printing"
  * [rt] Refresh "mm/memcontrol: Replace local_irq_disable with local locks"
  * [rt] Update to 5.10.21-rt34
  * Refresh "Include package version along with kernel release in stack
    traces"
  * bpf: Prohibit alu ops for pointer types not defining ptr_limit
    (CVE-2020-27170)
  * bpf: Fix off-by-one for area size in creating mask to left
    (CVE-2020-27171)
  * bpf: Simplify alu_limit masking for pointer arithmetic
  * bpf: Add sanity check for upper ptr_limit
  * bpf, selftests: Fix up some test_verifier cases for unprivileged
  * [x86] crypto: aesni - Use TEST %reg,%reg instead of CMP $0,%reg
  * [x86] crypto: x86/aes-ni-xts - use direct calls to and 4-way stride
  * RDMA/srp: Fix support for unpopulated and unbalanced NUMA nodes
  * fuse: fix live lock in fuse_iget()
  * Revert "nfsd4: remove check_conflicting_opens warning"
  * Revert "nfsd4: a client's own opens needn't prevent delegations"
  * ALSA: usb-audio: Don't avoid stopping the stream at disconnection
  * [armhf] net: dsa: b53: Support setting learning on port

  [ Wookey ]
  * [arm64] drivers/perf: Enable ARM_CMN as module (Closes: #981186)

  [ Vincent Blut ]
  * [arm64] drivers/perf: Enable ARM_SMMU_V3_PMU as module

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 19 Mar 2021 19:20:52 +0100

linux (5.10.19-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.14
    - [armhf] net: fec: put child node on error path
    - [x86] stmmac: intel: Configure EHL PSE0 GbE and PSE1 GbE to 32 bits DMA
      addressing
    - [armhf] net: dsa: bcm_sf2: put device node before return
    - net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP
    - [arm64,armhf] iommu/io-pgtable-arm: Support coherency for Mali LPAE
    - [arm64,armhf] drm/panfrost: Support cache-coherent integrations
    - [arm64] Fix kernel address detection of __is_lm_address()
    - [arm64] Do not pass tagged addresses to __is_lm_address()
    - Revert "x86/setup: don't remove E820_TYPE_RAM for pfn 0"
    - [amd64] iommu/vt-d: Do not use flush-queue when caching-mode is on
    - [x86] platform/x86: touchscreen_dmi: Add swap-x-y quirk for Goodix
      touchscreen on Estar Beauty HD tablet
    - [x86] platform/x86: intel-vbtn: Support for tablet mode on Dell Inspiron
      7352
    - [x86] __always_inline __{rd,wr}msr()
    - scsi: scsi_transport_srp: Don't block target in failfast state
    - scsi: libfc: Avoid invoking response handler twice if ep is already
      completed
    - [x86] scsi: fnic: Fix memleak in vnic_dev_init_devcmd2
    - [x86] ASoC: SOF: Intel: hda: Resume codec to do jack detection
    - ALSA: hda: Add AlderLake-P PCI ID and HDMI codec vid
    - mac80211: fix fast-rx encryption check
    - mac80211: fix encryption key selection for 802.3 xmit
    - [powerpc*] scsi: ibmvfc: Set default timeout to avoid crash during
      migration
    - ALSA: hda: Add Cometlake-R PCI ID
    - [arm64,armhf] i2c: tegra: Create i2c_writesl_vi() to use with VI I2C for
      filling TX FIFO
    - udf: fix the problem that the disc content is not displayed
    - nvme: check the PRINFO bit before deciding the host buffer length
    - nvme-rdma: avoid request double completion for concurrent
      nvme_rdma_timeout
    - nvme-tcp: avoid request double completion for concurrent
      nvme_tcp_timeout
    - nvme-pci: allow use of cmb on v1.4 controllers
    - nvmet: set right status on error in id-ns handler
    - [x86] platform/x86: thinkpad_acpi: Add P53/73 firmware to
      fan_quirk_table for dual fan control
    - objtool: Don't fail the kernel build on fatal errors
    - [x86] cpu: Add another Alder Lake CPU to the Intel family
    - kthread: Extract KTHREAD_IS_PER_CPU
    - workqueue: Restrict affinity change to rescuer
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.15
    - USB: serial: cp210x: add pid/vid for WSDA-200-USB
    - USB: serial: cp210x: add new VID/PID for supporting Teraoka AD2000
    - USB: serial: option: Adding support for Cinterion MV31
    - [arm64,armhf] usb: host: xhci: mvebu: make USB 3.0 PHY optional for
      Armada 3720
    - USB: gadget: legacy: fix an error code in eth_bind()
    - [armhf] usb: gadget: aspeed: add missing of_node_put
    - USB: usblp: don't call usb_set_interface if there's a single alt
    - [arm*] usb: dwc2: Fix endpoint direction check in ep_from_windex
    - [arm64,armhf] usb: dwc3: fix clock issue during resume in OTG mode
    - [arm64] dts: qcom: c630: keep both touchpad devices enabled
    - Input: i8042 - unbreak Pegatron C15B
    - [arm64] dts: rockchip: Use only supported PCIe link speed on Pinebook
      Pro
    - bpf, cgroup: Fix optlen WARN_ON_ONCE toctou (CVE-2021-20194)
    - bpf, cgroup: Fix problematic bounds check (CVE-2021-20194)
    - bpf, inode_storage: Put file handler if no storage was found
    - bpf, preload: Fix build when $(O) points to a relative path
    - [arm64] dts: meson: switch TFLASH_VDD_EN pin to open drain on Odroid-C4
    - r8169: work around RTL8125 UDP hw bug
    - rxrpc: Fix deadlock around release of dst cached on udp tunnel
    - SUNRPC: Fix NFS READs that start at non-page-aligned offsets
    - igc: set the default return value to -IGC_ERR_NVM in igc_write_nvm_srwr
    - igc: check return value of ret_val in igc_config_fc_after_link_up
    - i40e: Revert "i40e: don't report link up for a VF who hasn't enabled
      queues"
    - net/mlx5: Fix function calculation for page trees
    - net/mlx5: Fix leak upon failure of rule creation
    - net/mlx5e: Update max_opened_tc also when channels are closed
    - net/mlx5e: Release skb in case of failure in tc update skb
    - net: lapb: Copy the skb before sending a packet
    - [arm64,armhf] net: mvpp2: TCAM entry enable should be written after SRAM
      data
    - [armhf] dts: sun7i: a20: bananapro: Fix ethernet phy-mode
    - nvmet-tcp: fix out-of-bounds access when receiving multiple h2cdata PDUs
    - memblock: do not start bottom-up allocations with kernel_end
    - [x86] thunderbolt: Fix possible NULL pointer dereference in
      tb_acpi_add_link()
    - ovl: fix dentry leak in ovl_get_redirect
    - ovl: avoid deadlock on directory ioctl
    - ovl: implement volatile-specific fsync error behaviour
    - mac80211: fix station rate table updates on assoc
    - gpiolib: free device name on error path to fix kmemleak
    - fgraph: Initialize tracing_graph_pause at task creation
    - tracing/kprobe: Fix to support kretprobe events on unloaded modules
    - kretprobe: Avoid re-registration of the same kretprobe earlier
    - tracing: Use pause-on-trace with the latency tracers
    - tracepoint: Fix race between tracing and removing tracepoint
    - [arm64,x86] libnvdimm/namespace: Fix visibility of namespace resource
      attribute
    - [arm64,x86] libnvdimm/dimm: Avoid race between probe and
      available_slots_show()
    - genirq: Prevent [devm_]irq_alloc_desc from returning irq 0
    - genirq/msi: Activate Multi-MSI early when MSI_FLAG_ACTIVATE_EARLY is set
    - scripts: use pkg-config to locate libcrypto
    - xhci: fix bounce buffer usage for non-sg list case
    - cifs: report error instead of invalid when revalidating a dentry fails
    - iommu: Check dev->iommu in dev_iommu_priv_get() before dereferencing it
    - smb3: Fix out-of-bounds bug in SMB2_negotiate()
    - smb3: fix crediting for compounding when only one request in flight
    - mmc: core: Limit retries when analyse of SDIO tuples fails
    - [x86] Fix unsynchronized access to sev members through
      svm_register_enc_region
    - drm/dp/mst: Export drm_dp_get_vc_payload_bw()
    - [x86] drm/i915: Fix the MST PBN divider calculation
    - [x86] drm/i915/gem: Drop lru bumping on display unpinning
    - [x86] drm/i915/gt: Close race between enable_breadcrumbs and
      cancel_breadcrumbs
    - [x86] drm/i915/display: Prevent double YUV range correction on HDR
      planes
    - [x86] drm/i915: Extract intel_ddi_power_up_lanes()
    - [x86] drm/i915: Power up combo PHY lanes for for HDMI as well
    - drm/amd/display: Revert "Fix EDID parsing after resume from suspend"
    - io_uring: don't modify identity's files uncess identity is cowed
    - nvme-pci: avoid the deepest sleep state on Kingston A2000 SSDs
    - [x86] KVM: SVM: Treat SVM as unsupported when running as an SEV guest
    - [x86] KVM: x86/mmu: Fix TDP MMU zap collapsible SPTEs
    - [x86] KVM: x86: Allow guests to see MSR_IA32_TSX_CTRL even if tsx=off
    - [x86] KVM: x86: fix CPUID entries returned by KVM_GET_CPUID2 ioctl
    - [x86] KVM: x86: Update emulator context mode if SYSENTER xfers to 64-bit
      mode
    - [x86] KVM: x86: Set so called 'reserved CR3 bits in LM mask' at vCPU
      reset
    - mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page
    - mm: hugetlb: fix a race between freeing and dissolving the page
    - mm: hugetlb: fix a race between isolating and freeing page
    - mm: hugetlb: remove VM_BUG_ON_PAGE from page_huge_active
    - mm, compaction: move high_pfn to the for loop scope
    - mm/vmalloc: separate put pages and flush VM flags
    - mm: thp: fix MADV_REMOVE deadlock on shmem THP
    - mm/filemap: add missing mem_cgroup_uncharge() to
      __add_to_page_cache_locked()
    - [x86] build: Disable CET instrumentation in the kernel
    - [x86] debug: Fix DR6 handling
    - [x86] debug: Prevent data breakpoints on __per_cpu_offset
    - [x86] debug: Prevent data breakpoints on cpu_dr7
    - [x86] apic: Add extra serialization for non-serializing MSRs
    - Input: goodix - add support for Goodix GT9286 chip
    - Input: xpad - sync supported devices with fork on GitHub
    - md: Set prev_flush_start and flush_bio in an atomic way
    - igc: Report speed and duplex as unknown when device is runtime suspended
    - neighbour: Prevent a dead entry from updating gc_list
    - net: ip_tunnel: fix mtu calculation
    - udp: ipv4: manipulate network header of NATed UDP GRO fraglist
    - [arm64,armhf] net: dsa: mv88e6xxx: override existent unicast portvec in
      port_fdb_add
    - net: sched: replaced invalid qdisc tree flush helper in qdisc_replace
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.16
    - io_uring: simplify io_task_match()
    - io_uring: add a {task,files} pair matching helper
    - io_uring: don't iterate io_uring_cancel_files()
    - io_uring: pass files into kill timeouts/poll
    - io_uring: always batch cancel in *cancel_files()
    - io_uring: fix files cancellation
    - io_uring: account io_uring internal files as REQ_F_INFLIGHT
    - io_uring: if we see flush on exit, cancel related tasks
    - io_uring: fix __io_uring_files_cancel() with TASK_UNINTERRUPTIBLE
    - io_uring: replace inflight_wait with tctx->wait
    - io_uring: fix cancellation taking mutex while TASK_UNINTERRUPTIBLE
    - io_uring: fix flush cqring overflow list while TASK_INTERRUPTIBLE
    - io_uring: fix list corruption for splice file_get
    - io_uring: fix sqo ownership false positive warning
    - io_uring: reinforce cancel on flush during exit
    - io_uring: drop mm/files between task_work_submit
    - gpiolib: cdev: clear debounce period if line set to output
    - [powerpc*] 64/signal: Fix regression in __kernel_sigtramp_rt64()
      semantics
    - af_key: relax availability checks for skb size calculation
    - regulator: core: avoid regulator_resolve_supply() race condition
    - drm/nouveau/nvif: fix method count when pushing an array
    - mac80211: 160MHz with extended NSS BW in CSA
    - [x86] ASoC: Intel: Skylake: Zero snd_ctl_elem_value
    - pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()
    - pNFS/NFSv4: Improve rejection of out-of-order layouts
    - ALSA: hda: intel-dsp-config: add PCI id for TGL-H
    - [x86] ASoC: Intel: sof_sdw: set proper flags for Dell TGL-H SKU 0A5E
    - iwlwifi: mvm: skip power command when unbinding vif during CSA
    - iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap
    - iwlwifi: pcie: fix context info memory leak
    - iwlwifi: mvm: invalidate IDs of internal stations at mvm start
    - iwlwifi: pcie: add rules to match Qu with Hr2
    - iwlwifi: mvm: guard against device removal in reprobe
    - iwlwifi: queue: bail out on invalid freeing
    - SUNRPC: Move simple_get_bytes and simple_get_netobj into private header
    - SUNRPC: Handle 0 length opaque XDR object data properly
    - blk-cgroup: Use cond_resched() when destroy blkgs
    - regulator: Fix lockdep warning resolving supplies
    - bpf: Fix verifier jmp32 pruning decision logic
    - bpf: Fix 32 bit src register truncation on div/mod
    - bpf: Fix verifier jsgt branch analysis on max bound
    - [x86] drm/i915: Fix ICL MG PHY vswing handling
    - [x86] drm/i915: Skip vswing programming for TBT
    - nilfs2: make splice write available again
    - Revert "mm: memcontrol: avoid workload stalls when lowering memory.high"
    - squashfs: avoid out of bounds writes in decompressors
    - squashfs: add more sanity checks in id lookup
    - squashfs: add more sanity checks in inode lookup
    - squashfs: add more sanity checks in xattr id lookup
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.17
    - objtool: Fix seg fault with Clang non-section symbols
    - Revert "dts: phy: add GPIO number and active state used for phy reset"
    - tracing: Do not count ftrace events in top level enable output
    - tracing: Check length before giving out the filter buffer
    - [x86] drm/i915: Fix overlay frontbuffer tracking
    - arm/xen: Don't probe xenbus as part of an early initcall
    - cgroup: fix psi monitor for root cgroup
    - [x86] drm/i915/tgl+: Make sure TypeC FIA is powered up when initializing
      it
    - drm/dp_mst: Don't report ports connected if nothing is attached to them
    - dmaengine: move channel device_node deletion to driver
    - [armhf] soc: ti: omap-prm: Fix boot time errors for rst_map_012 bits 0
      and 1
    - [arm64] dts: qcom: sdm845: Reserve LPASS clocks in gcc
    - [x86] platform/x86: hp-wmi: Disable tablet-mode reporting by default
    - [arm64] dts: rockchip: Disable display for NanoPi R2S
    - ovl: perform vfs_getxattr() with mounter creds
    - cap: fix conversions on getxattr
    - ovl: skip getxattr of security labels
    - scsi: lpfc: Fix EEH encountering oops with NVMe traffic
    - [x86] split_lock: Enable the split lock feature on another Alder Lake
      CPU
    - nvme-pci: ignore the subsysem NQN on Phison E16
    - [riscv64] virt_addr_valid must check the address belongs to linear
      mapping
    - bfq-iosched: Revert "bfq: Fix computation of shallow depth"
    - kallsyms: fix nonconverging kallsyms table with lld
    - [armel,armhf] ensure the signal page contains defined contents
    - [armel,armhf] kexec: fix oops after TLB are invalidated
    - Revert "lib: Restrict cpumask_local_spread to houskeeping CPUs"
    - [amd64] x86/efi: Remove EFI PGD build time checks
    - [x86] KVM: x86: cleanup CR3 reserved bits checks
    - cgroup-v1: add disabled controller check in cgroup1_parse_param()
    - mt76: dma: fix a possible memory leak in mt76_add_fragment()
    - [arm*] drm/vc4: hvs: Fix buffer overflow with the dlist handling
    - bpf: Unbreak BPF_PROG_TYPE_KPROBE when kprobe is called via do_int3
    - bpf: Check for integer overflow when using roundup_pow_of_two()
    - netfilter: xt_recent: Fix attempt to update deleted entry
    - netfilter: nftables: fix possible UAF over chains from packet path in
      netns
    - netfilter: flowtable: fix tcp and udp header checksum update
    - xen/netback: avoid race in xenvif_rx_ring_slots_available()
    - [x86] hv_netvsc: Reset the RSC count if NVSP_STAT_FAIL in
      netvsc_receive()
    - [arm64] net: enetc: initialize the RFS and RSS memories
    - net: stmmac: set TxQ mode back to DCB after disabling CBS
    - netfilter: conntrack: skip identical origin tuple in same zone only
    - scsi: scsi_debug: Fix a memory leak
    - [x86] build: Disable CET instrumentation in the kernel for 32-bit too
    - [arm64] net: dsa: felix: implement port flushing on
      .phylink_mac_link_down
    - [arm64] net: hns3: add a check for queue_id in hclge_reset_vf_queue()
    - [arm64] net: hns3: add a check for tqp_index in
      hclge_get_ring_chain_from_mbx()
    - [arm64] net: hns3: add a check for index in hclge_get_rss_key()
    - firmware_loader: align .builtin_fw to 8
    - [arm64,armhf] drm/sun4i: tcon: set sync polarity for tcon1 channel
    - [arm64,armhf] drm/sun4i: dw-hdmi: always set clock rate
    - [arm64,armhf] drm/sun4i: Fix H6 HDMI PHY configuration
    - [arm64,armhf] drm/sun4i: dw-hdmi: Fix max. frequency for H6
    - [arm64,armhf] clk: sunxi-ng: mp: fix parent rate change flag check
    - [armhf] i2c: stm32f7: fix configuration of the digital filter
    - scripts: set proper OpenSSL include dir also for sign-file
    - [x86] pci: Create PCI/MSI irqdomain after x86_init.pci.arch_init()
    - arm64: mte: Allow PTRACE_PEEKMTETAGS access to the zero page
    - rxrpc: Fix clearance of Tx/Rx ring when releasing a call
    - udp: fix skb_copy_and_csum_datagram with odd segment sizes
    - [arm64,armhf] net: dsa: call teardown method on probe failure
    - [x86] cpufreq: ACPI: Extend frequency tables to cover boost frequencies
    - [x86] cpufreq: ACPI: Update arch scale-invariance max perf ratio if CPPC
      is not there
    - net: gro: do not keep too many GRO packets in napi->rx_list
    - net: fix iteration for sctp transport seq_files
    - net/vmw_vsock: fix NULL pointer dereference
    - net/vmw_vsock: improve locking in vsock_connect_timeout()
    - net: watchdog: hold device global xmit lock during tx disable
    - switchdev: mrp: Remove SWITCHDEV_ATTR_ID_MRP_PORT_STAT
    - vsock/virtio: update credit only if socket is not closed
    - vsock: fix locking in vsock_shutdown()
    - net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS
    - ovl: expand warning in ovl_d_real()
    - kcov, usb: only collect coverage from __usb_hcd_giveback_urb in softirq
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.18
    - IB/isert: add module param to set sg_tablesize for IO cmd
    - net: qrtr: Fix port ID for control messages
    - net/sched: fix miss init the mru in qdisc_skb_cb
    - net: openvswitch: fix TTL decrement exception action execution
    - net: bridge: Fix a warning when del bridge sysfs
    - net: fix proc_fs init handling in af_packet and tls
    - [amd64] Xen/x86: don't bail early from clear_foreign_p2m_mapping()
      (CVE-2021-26932)
    - [amd64] Xen/x86: also check kernel mapping in set_foreign_p2m_mapping()
      (CVE-2021-26932)
    - Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages()
      (CVE-2021-26932)
    - Xen/gntdev: correct error checking in gntdev_map_grant_pages()
      (CVE-2021-26932)
    - [armhf] xen/arm: don't ignore return errors from set_phys_to_machine
      (CVE-2021-26932)
    - xen-blkback: don't "handle" error by BUG() (CVE-2021-26931)
    - xen-netback: don't "handle" error by BUG() (CVE-2021-26931)
    - xen-scsiback: don't "handle" error by BUG() (CVE-2021-26931)
    - xen-blkback: fix error handling in xen_blkbk_map() (CVE-2021-26930)
    - tty: protect tty_write from odd low-level tty disciplines
    - Bluetooth: btusb: Always fallback to alt 1 for WBS
    - btrfs: fix crash after non-aligned direct IO write with O_DSYNC
    - media: pwc: Use correct device for DMA
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.19
    - bpf: Fix truncation handling for mod32 dst reg wrt zero
    - HID: make arrays usage and value to be the same
    - RDMA: Lift ibdev_to_node from rds to common code
    - nvme-rdma: Use ibdev_to_node instead of dereferencing ->dma_device
    - USB: quirks: sort quirk entries
    - usb: quirks: add quirk to start video capture on ELMO L-12F document
      camera reliable
    - ceph: downgrade warning from mdsmap decode to debug
    - Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working
      (Closes: #981005)
    - [x86] hwmon: (dell-smm) Add XPS 15 L502X to fan control blacklist
    - [x86] KVM: Zap the oldest MMU pages, not the newest
    - mm: unexport follow_pte_pmd
    - mm: simplify follow_pte{,pmd}
    - KVM: do not assume PTE is writable after follow_pfn
    - mm: provide a saner PTE walking API for modules
    - KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped()
    - NET: usb: qmi_wwan: Adding support for Cinterion MV31
    - cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath.

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.10.14-rt28
  * Ignore __udp_gso_segment to avoid ABI changes
  * Ignore xhci_init_driver to avoid ABI changes
  * [rt] Update to 5.10.16-rt30
  * [rt] Refresh "tracing: Merge irqflags + preempt counter." for context
    changes
  * [rt] Update to 5.10.17-rt32
  * [rt] Refresh "um: synchronize kmsg_dumper" for context changes
  * [rt] Refresh "printk: move console printing to kthreads" for context
    changes
  * Bump ABI to 4
  * soundwire: intel: fix possible crash when no device is detected
    (Closes: #981003)
  * drm/nouveau: bail out of nouveau_channel_new if channel init fails
    (CVE-2020-25639)
  * [x86] drm/i915/gt: One more flush for Baytrail clear residuals
  * [x86] drm/i915/gt: Flush before changing register state
  * [x86] drm/i915/gt: Correct surface base address for renderclear
  * certs: Rotate to use the "Debian Secure Boot Signer 2021 - linux"
    certificate

  [ Vincent Blut ]
  * [x86] Enable PWM_CRC (Closes: #982808)
  * net/can: Enable CAN_J1939 as module
  * misc/eeprom: Enable EEPROM_EE1004 as module (Closes: #983495)
  * [arm64] Enable DRM_DW_HDMI_CEC as module (Closes: #983759)

  [ Luca Boccassi ]
  * bpf: enable CONFIG_BPF_LSM on all architectures. Not active by default,
    by explicitly setting CONFIG_LSM to include all other LSMs but not bpf.

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 02 Mar 2021 17:49:25 +0100

linux (5.10.13-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.13
    - iwlwifi: provide gso_type to GSO packets
    - nbd: freeze the queue while we're adding connections (CVE-2021-3348)
    - tty: avoid using vfs_iocb_iter_write() for redirected console writes
    - ACPI: sysfs: Prefer "compatible" modalias
    - ACPI: thermal: Do not call acpi_thermal_check() directly
    - kernel: kexec: remove the lock operation of system_transition_mutex
    - ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256
    - ALSA: hda/via: Apply the workaround generically for Clevo machines
    - [arm64,armhf] media: cedrus: Fix H264 decoding
    - media: rc: fix timeout handling after switch to microsecond durations
    - [x86] media: rc: ite-cir: fix min_timeout calculation
    - media: rc: ensure that uevent can be read directly after rc device
      register
    - [armhf] dts: tbs2910: rename MMC node aliases
    - wext: fix NULL-ptr-dereference with cfg80211's lack of commit()
    - [amd64] ASoC: AMD Renoir - refine DMI entries for some Lenovo products
    - drm/nouveau/kms/gk104-gp1xx: Fix > 64x64 cursors
    - [x86] drm/i915: Always flush the active worker before returning from the
      wait
    - [x86] drm/i915/gt: Always try to reserve GGTT address 0x0
    - drivers/nouveau/kms/nv50-: Reject format modifiers for cursor planes
    - bcache: only check feature sets when sb->version >=
      BCACHE_SB_VERSION_CDEV_WITH_FEATURES
    - net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem
      family
    - [s390x] uv: Fix sysfs max number of VCPUs reporting
    - PM: hibernate: flush swap writer after marking
    - [x86] efi/apple-properties: Reinstate support for boolean properties
    - btrfs: fix lockdep warning due to seqcount_mutex on 32bit arch
    - btrfs: fix possible free space tree corruption with online conversion
    - [x86] KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in
      intel_arch_events[]
    - [x86] KVM: x86/pmu: Fix UBSAN shift-out-of-bounds warning in
      intel_pmu_refresh()
    - [arm64] KVM: Filter out v8.1+ events on v8.0 HW
    - [x86] KVM: nSVM: cancel KVM_REQ_GET_NESTED_STATE_PAGES on nested vmexit
    - [x86] KVM: x86: allow KVM_REQ_GET_NESTED_STATE_PAGES outside guest mode
      for VMX
    - [x86] KVM: nVMX: Sync unsync'd vmcs02 state to vmcs12 on migration
    - [x86] KVM: get smi pending status correctly
    - KVM: Forbid the use of tagged userspace addresses for memslots
    - io_uring: fix wqe->lock/completion_lock deadlock
    - leds: trigger: fix potential deadlock with libata
    - mt7601u: fix kernel crash unplugging the device
    - mt7601u: fix rx buffer refcounting
    - iwlwifi: Fix IWL_SUBDEVICE_NO_160 macro to use the correct bit.
    - [x86] drm/i915/gt: Clear CACHE_MODE prior to clearing residuals
    - [x86] drm/i915/pmu: Don't grab wakeref when enabling events
    - [arm*] drm/vc4: Correct lbm size and calculation
    - [arm*] drm/vc4: Correct POS1_SCL for hvs5
    - drm/nouveau/dispnv50: Restore pushing of all data.
    - [x86] drm/i915: Check for all subplatform bits
    - uapi: fix big endian definition of ipv6_rpl_sr_hdr
    - KVM: Documentation: Fix spec for KVM_CAP_ENABLE_CAP_VM
    - [arm64] tee: optee: replace might_sleep with cond_resched
    - xen-blkfront: allow discard-* nodes to be optional
    - blk-mq: test QUEUE_FLAG_HCTX_ACTIVE for sbitmap_shared in hctx_may_queue
    - [armhf] imx: build suspend-imx6.S with arm instruction set
    - netfilter: nft_dynset: add timeout extension to template
    - Revert "RDMA/mlx5: Fix devlink deadlock on net namespace deletion"
    - Revert "block: simplify set_init_blocksize" to regain lost performance
    - xfrm: Fix oops in xfrm_replay_advance_bmp
    - xfrm: fix disable_xfrm sysctl when used on xfrm interfaces
    - xfrm: Fix wraparound in xfrm_policy_addr_delta()
    - RDMA/cxgb4: Fix the reported max_recv_sge value
    - [arm64] ASoC: qcom: Fix incorrect volatile registers
    - [arm64] ASoC: qcom: Fix broken support to MI2S TERTIARY and QUATERNARY
    - [x86] ASoC: Intel: Skylake: skl-topology: Fix OOPs ib skl_tplg_complete
    - [powerpc*] 64s: prevent recursive replay_soft_interrupts causing
      superfluous interrupt
    - pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process()
    - pNFS/NFSv4: Update the layout barrier when we schedule a layoutreturn
    - ASoC: SOF: Intel: soundwire: fix select/depend unmet dependencies
    - ASoC: qcom: lpass: Fix out-of-bounds DAI ID lookup
    - iwlwifi: pcie: avoid potential PNVM leaks
    - iwlwifi: pnvm: don't skip everything when not reloading
    - iwlwifi: pnvm: don't try to load after failures
    - iwlwifi: pcie: set LTR on more devices
    - iwlwifi: pcie: use jiffies for memory read spin time limit
    - iwlwifi: pcie: reschedule in long-running memory reads
    - mac80211: pause TX while changing interface type
    - ice: fix FDir IPv6 flexbyte
    - ice: Implement flow for IPv6 next header (extension header)
    - ice: update dev_addr in ice_set_mac_address even if HW filter exists
    - ice: Don't allow more channels than LAN MSI-X available
    - ice: Fix MSI-X vector fallback logic
    - i40e: acquire VSI pointer only after VF is initialized
    - igc: fix link speed advertising
    - net/mlx5: Fix memory leak on flow table creation error flow
    - net/mlx5e: E-switch, Fix rate calculation for overflow
    - net/mlx5e: free page before return
    - net/mlx5e: Reduce tc unsupported key print level
    - net/mlx5: Maintain separate page trees for ECPF and PF functions
    - net/mlx5e: Disable hw-tc-offload when MLX5_CLS_ACT config is disabled
    - net/mlx5e: Fix CT rule + encap slow path offload and deletion
    - net/mlx5e: Correctly handle changing the number of queues when the
      interface is down
    - net/mlx5e: Revert parameters on errors when changing trust state without
      reset
    - net/mlx5e: Revert parameters on errors when changing MTU and LRO state
      without reset
    - can: dev: prevent potential information leak in can_fill_info()
    - [arm64] ACPI/IORT: Do not blindly trust DMA masks from firmware
    - of/device: Update dma_range_map only when dev has valid dma-ranges
    - [amd64] iommu/amd: Use IVHD EFR for early initialization of IOMMU
      features
    - [amd64] iommu/vt-d: Correctly check addr alignment in
      qi_flush_dev_iotlb_pasid()
    - nvme-multipath: Early exit if no path is available
    - rxrpc: Fix memory leak in rxrpc_lookup_local
    - NFC: fix resource leak when target index is invalid
    - NFC: fix possible resource leak
    - [x86] ASoC: topology: Properly unregister DAI on removal
    - [x86] ASoC: topology: Fix memory corruption in
      soc_tplg_denum_create_values()
    - scsi: qla2xxx: Fix description for parameter ql2xenforce_iocb_limit
    - team: protect features update by RCU to avoid deadlock
    - tcp: make TCP_USER_TIMEOUT accurate for zero window probes
    - tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN
    - vsock: fix the race conditions in multi-transport support
      (CVE-2021-26708)

  [ Salvatore Bonaccorso ]
  * arch/s390: uv_info: Ignore ABI changes

  [ Vincent Blut ]
  * [arm64] Enable CRYPTO_NHPOLY1305_NEON. (closes: #980214)
  * [armhf] Enable KERNEL_MODE_NEON.

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 06 Feb 2021 09:23:52 +0100

linux (5.10.12-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.10
    - [x86] hyperv: Initialize clockevents after LAPIC is initialized
    - bpf: Fix signed_{sub,add32}_overflows type handling
    - nfsd4: readdirplus shouldn't return parent of export (CVE-2021-3178)
    - bpf: Don't leak memory in bpf getsockopt when optlen == 0
    - bpf: Support PTR_TO_MEM{,_OR_NULL} register spilling
    - bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback
    - net: fix use-after-free when UDP GRO with shared fraglist
    - udp: Prevent reuseport_select_sock from reading uninitialized socks
    - netxen_nic: fix MSI/MSI-x interrupts
    - net: ipv6: Validate GSO SKB before finish IPv6 processing
    - tipc: fix NULL deref in tipc_link_xmit()
    - [arm64,armhf] net: mvpp2: Remove Pause and Asym_Pause support
    - rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
    - esp: avoid unneeded kmap_atomic call
    - net: dcb: Validate netlink message in DCB handler
    - net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
    - rxrpc: Call state should be read with READ_ONCE() under some
      circumstances
    - i40e: fix potential NULL pointer dereferencing
    - [arm64,armhf] net: stmmac: Fixed mtu channged by cache aligned
    - net: sit: unregister_netdevice on newlink's error path
    - [arm64,armhf] net: stmmac: fix taprio schedule configuration
    - [arm64,armhf] net: stmmac: fix taprio configuration when base_time is in
      the past
    - net: avoid 32 x truesize under-estimation for tiny skbs
    - net: phy: smsc: fix clk error handling
    - [arm64,armhf] net: dsa: clear devlink port type before unregistering
      slave netdevs
    - rxrpc: Fix handling of an unsupported token type in rxrpc_read()
    - [arm64,armhf] net: stmmac: use __napi_schedule() for PREEMPT_RT
    - [armhf] drm/panel: otm8009a: allow using non-continuous dsi clock
    - mac80211: do not drop tx nulldata packets on encrypted links
    - mac80211: check if atf has been disabled in __ieee80211_schedule_txq
    - [arm64,armhf] net: dsa: unbind all switches from tree when DSA master
      unbinds
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.11
    - scsi: target: tcmu: Fix use-after-free of se_cmd->priv
    - [armhf] mtd: rawnand: gpmi: fix dst bit offset when extracting raw
      payload
    - mtd: rawnand: nandsim: Fix the logic when selecting Hamming soft ECC
      engine
    - [arm64,armhf] i2c: tegra: Wait for config load atomically while in ISR
    - [x86] platform/x86: i2c-multi-instantiate: Don't create platform device
      for INT3515 ACPI nodes
    - [x86] platform/x86: ideapad-laptop: Disable touchpad_switch for ELAN0634
    - ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T
    - ALSA: hda/via: Add minimum mute flag
    - crypto: xor - Fix divide error in do_xor_speed()
    - dm crypt: fix copy and paste bug in crypt_alloc_req_aead
    - ACPI: scan: Make acpi_bus_get_device() clear return pointer on error
    - btrfs: don't get an EINTR during drop_snapshot for reloc
    - btrfs: do not double free backref nodes on error
    - btrfs: fix lockdep splat in btrfs_recover_relocation
    - btrfs: don't clear ret in btrfs_start_dirty_block_groups
    - btrfs: send: fix invalid clone operations when cloning from the same
      file and root
    - fs: fix lazytime expiration handling in __writeback_single_inode()
    - mmc: core: don't initialize block size from ext_csd if not present
    - [arm64] mmc: sdhci-xenon: fix 1.8v regulator stabilization
    - dm: avoid filesystem lookup in dm_get_dev_t()
    - dm integrity: fix a crash if "recalculate" used without "internal_hash"
    - dm integrity: conditionally disable "recalculate" feature
    - drm/atomic: put state on error path
    - drm/syncobj: Fix use-after-free
    - drm/amdgpu: remove gpu info firmware of green sardine
    - [x86] drm/i915/gt: Prevent use of engine->wa_ctx after error
    - [x86] drm/i915: Check for rq->hwsp validity after acquiring RCU lock
    - ASoC: rt711: mutex between calibration and power state changes
    - SUNRPC: Handle TCP socket sends with kernel_sendpage() again
    - HID: multitouch: Enable multi-input for Synaptics pointstick/touchpad
      device
    - dm integrity: select CRYPTO_SKCIPHER
    - [x86] hyperv: Fix kexec panic/hang issues
    - scsi: ufs: Relax the condition of UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL
    - scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback
    - scsi: qedi: Correct max length of CHAP secret
    - scsi: scsi_debug: Fix memleak in scsi_debug_init()
    - scsi: sd: Suppress spurious errors when WRITE SAME is being disabled
    - [riscv64] Fix kernel time_init()
    - [riscv64] Fix sifive serial driver
    - [riscv64] Enable interrupts during syscalls with M-Mode
    - HID: logitech-dj: add the G602 receiver
    - HID: Ignore battery for Elan touchscreen on ASUS UX550
    - [arm64,armhf] ALSA: hda/tegra: fix tegra-hda on tegra30 soc
    - [riscv64] cacheinfo: Fix using smp_processor_id() in preemptible
    - [arm64] make atomic helpers __always_inline
    - xen: Fix event channel callback via INTX/GSI
    - [x86] xen: Add xen_no_vector_callback option to test PCI INTX delivery
    - [x86] xen: Fix xen_hvm_smp_init() when vector callback not available
    - [riscv64] dts: phy: fix missing mdio device and probe failure of
      vsc8541-01 device
    - [riscv64] dts: phy: add GPIO number and active state used for phy reset
    - drm/amdgpu/psp: fix psp gfx ctrl cmds
    - HID: logitech-hidpp: Add product ID for MX Ergo in Bluetooth mode
    - drm/nouveau/bios: fix issue shadowing expansion ROMs
    - drm/nouveau/privring: ack interrupts the same way as RM
    - drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields
    - drm/nouveau/mmu: fix vram heap sizing
    - drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0
    - io_uring: flush timeouts that should already have expired
    - [riscv64] Set current memblock limit
    - [riscv64] Fix maximum allowed phsyical memory for RV32
    - nfsd: Fixes for nfsd4_encode_read_plus_data()
    - nfsd: Don't set eof on a truncated READ_PLUS
    - gpiolib: cdev: fix frame size warning in gpio_ioctl()
    - [armhf] pinctrl: aspeed: g6: Fix PWMG0 pinctrl setting
    - RDMA/ucma: Do not miss ctx destruction steps in some cases
    - btrfs: print the actual offset in btrfs_root_name
    - scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression
    - scsi: ufs: Fix tm request when non-fatal error happens
    - bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach
    - [powerpc*] Use the common INIT_DATA_SECTION macro in vmlinux.lds.S
    - [powerpc*] Fix alignment bug within the init sections
    - [arm64] entry: remove redundant IRQ flag tracing
    - bpf: Reject too big ctx_size_in for raw_tp test run
    - RDMA/umem: Avoid undefined behavior of rounddown_pow_of_two()
    - RDMA/cma: Fix error flow in default_roce_mode_store
    - printk: ringbuffer: fix line counting
    - printk: fix kmsg_dump_get_buffer length calulations
    - iov_iter: fix the uaccess area in copy_compat_iovec_from_user
    - [mips*] i2c: octeon: check correct size of maximum RECV_LEN packet
    - [armel,armhf] drm/vc4: Unify PCM card's driver_name
    - [x86] platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11
      from allow-list
    - [x86] platform/x86: hp-wmi: Don't log a warning on
      HPWMI_RET_UNKNOWN_COMMAND errors
    - ALSA: hda: Balance runtime/system PM if direct-complete is disabled
    - xsk: Clear pool even for inactive queues
    - can: dev: can_restart: fix use after free bug
    - can: vxcan: vxcan_xmit: fix use after free bug
    - can: peak_usb: fix use after free bugs
    - iio: common: st_sensors: fix possible infinite loop in
      st_sensors_irq_thread
    - iio: ad5504: Fix setting power-down state
    - drivers: iio: temperature: Add delay after the addressed reset command
      in mlx90632.c
    - [powerpc*] 64s: fix scv entry fallback flush vs interrupt
    - cifs: do not fail __smb_send_rqst if non-fatal signals are pending
    - [mips*] irqchip/mips-cpu: Set IPI domain parent chip
    - [x86] fpu: Add kernel_fpu_begin_mask() to selectively initialize state
    - [x86] topology: Make __max_die_per_package available unconditionally
    - [x86] mmx: Use KFPU_387 for MMX string operations
    - [x86] setup: don't remove E820_TYPE_RAM for pfn 0
    - proc_sysctl: fix oops caused by incorrect command parameters
    - mm: memcg/slab: optimize objcg stock draining
    - mm: memcg: fix memcg file_dirty numa stat
    - mm: fix numa stats for thp migration
    - io_uring: iopoll requests should also wake task ->in_idle state
    - io_uring: fix SQPOLL IORING_OP_CLOSE cancelation state
    - io_uring: fix short read retries for non-reg files
    - [x86] intel_th: pci: Add Alder Lake-P support
    - [arm64] serial: mvebu-uart: fix tx lost characters at power off
    - ehci: fix EHCI host controller initialization sequence
    - [armhf] usb: gadget: aspeed: fix stop dma register setting.
    - USB: gadget: dummy-hcd: Fix errors in port-reset handling
    - usb: udc: core: Use lock when write to soft_connect
    - xhci: make sure TRB is fully written before giving it to the controller
    - [arm64,armhf] xhci: tegra: Delay for disabling LFPS detector
    - drivers core: Free dma_range_map when driver probe failed
    - driver core: Fix device link device name collision
    - driver core: Extend device_is_dependent()
    - [x86] drm/i915: s/intel_dp_sink_dpms/intel_dp_set_power/
    - [x86] drm/i915: Only enable DFP 4:4:4->4:2:0 conversion when outputting
      YCbCr 4:4:4
    - [x86] entry: Fix noinstr fail
    - [x86] cpu/amd: Set __max_die_per_package on AMD
    - cls_flower: call nla_ok() before nla_next()
    - netfilter: rpfilter: mask ecn bits before fib lookup
    - [x86] drm/i915/hdcp: Update CP property in update_pipe
    - locking/lockdep: Cure noinstr fail
    - [x86] ASoC: SOF: Intel: fix page fault at probe if i915 init fails
    - [arm64,armhf] net: dsa: mv88e6xxx: also read STU state in
      mv88e6250_g1_vtu_getnext
    - nvme-pci: refactor nvme_unmap_data
    - nvme-pci: fix error unwind in nvme_map_data
    - cachefiles: Drop superfluous readpages aops NULL check
    - skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too
    - tcp: fix TCP socket rehash stats mis-accounting
    - net_sched: gen_estimator: support large ewma log
    - udp: mask TOS bits in udp_v4_early_demux()
    - ipv6: create multicast route with RTPROT_KERNEL
    - net_sched: avoid shift-out-of-bounds in tcindex_set_parms()
    - net_sched: reject silly cell_log in qdisc_get_rtab()
    - ipv6: set multicast flag on the multicast route
    - net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled
    - [armhf] net: dsa: b53: fix an off by one in checking "vlan->vid"
    - tcp: do not mess with cloned skbs in tcp_add_backlog()
    - tcp: fix TCP_USER_TIMEOUT with zero window
    - net: core: devlink: use right genl user_ptr when handling port param
      get/set
    - [arm64] pinctrl: qcom: Allow SoCs to specify a GPIO function that's not
      0
    - [arm64] pinctrl: qcom: No need to read-modify-write the interrupt status
    - [arm64] pinctrl: qcom: Properly clear "intr_ack_high" interrupts when
      unmasking
    - [arm64] pinctrl: qcom: Don't clear pending interrupts when enabling
    - tty: implement write_iter
    - tty: fix up hung_up_tty_write() conversion
    - tcp: Fix potential use-after-free due to double kfree()
    - [x86] ASoC: SOF: Intel: hda: Avoid checking jack on system suspend
    - [x86] drm/i915/hdcp: Get conn while content_type changed
    - bpf: Local storage helpers should check nullness of owner ptr passed
    - kernfs: implement ->read_iter
    - kernfs: implement ->write_iter
    - kernfs: wire up ->splice_read and ->splice_write
    - fs/pipe: allow sendfile() to pipe again
    - mm: fix initialization of struct page for holes in memory layout
    - Revert "mm: fix initialization of struct page for holes in memory
      layout"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.12
    - [arm*] gpio: mvebu: fix pwm .get_state period calculation
    - Revert "mm/slub: fix a memory leak in sysfs_slab_add()"
    - HID: wacom: Correct NULL dereference on AES pen proximity
    - HID: multitouch: Apply MT_QUIRK_CONFIDENCE quirk for multi-input devices
    - media: Revert "media: videobuf2: Fix length check for single plane
      dmabuf queueing"
    - media: v4l2-subdev.h: BIT() is not available in userspace
    - RDMA/vmw_pvrdma: Fix network_hdr_type reported in WC
    - iwlwifi: dbg: Don't touch the tlv data
    - kernel/io_uring: cancel io_uring before task works
    - io_uring: inline io_uring_attempt_task_drop()
    - io_uring: add warn_once for io_uring_flush()
    - io_uring: stop SQPOLL submit on creator's death
    - io_uring: fix null-deref in io_disable_sqo_submit
    - io_uring: do sqo disable on install_fd error
    - io_uring: fix false positive sqo warning on flush
    - io_uring: fix uring_flush in exit_files() warning
    - io_uring: fix skipping disabling sqo on exec
    - io_uring: dont kill fasync under completion_lock
    - io_uring: fix sleeping under spin in __io_clean_op
    - objtool: Don't fail on missing symbol table
    - mm/page_alloc: add a missing mm_page_alloc_zone_locked() tracepoint
    - mm: fix a race on nr_swap_pages
    - tools: Factor HOSTCC, HOSTLD, HOSTAR definitions
    - printk: fix buffer overflow potential for print_text()
    - printk: fix string termination for record_print_text()

  [ Salvatore Bonaccorso ]
  * Add set of PI futex fixes (CVE-2021-3347)
    - futex: Ensure the correct return value from futex_lock_pi()
    - futex: Replace pointless printk in fixup_owner()
    - futex: Provide and use pi_state_update_owner()
    - rtmutex: Remove unused argument from rt_mutex_proxy_unlock()
    - futex: Use pi_state_update_owner() in put_pi_state()
    - futex: Simplify fixup_pi_state_owner()
    - futex: Handle faults correctly for PI futexes
  * Bump ABI to 3
  * xen: Fix XenStore initialisation for XS_LOCAL
  * [rt] Refresh "printk: refactor kmsg_dump_get_buffer()"
  * [rt] Refresh "locking/rtmutex: Handle the various new futex race
    conditions"
  * [rt] Refresh "locking/rtmutex: add sleeping lock implementation"
  * [rt] Refresh "crypto: limit more FPU-enabled sections"
  * Unset CRYPTO_USER_API_ENABLE_OBSOLETE

  [ Ricardo Ribalda ]
  * Enable USB_NET_AQC111 as module (Closes: #968760)

  [ Vincent Blut ]
  * [arm64] Enable DRM_VC4 again. (Closes: #968181, #968188)
  * [arm64] Enable DRM_VC4_HDMI_CEC. (Closes: #977438)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 30 Jan 2021 21:38:57 +0100

linux (5.10.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
    - [arm64] rtc: pcf2127: move watchdog initialisation to a separate
      function
    - [arm64] rtc: pcf2127: only use watchdog when explicitly available
    - dt-bindings: rtc: add reset-source property
    - kdev_t: always inline major/minor helper functions
    - ALSA: hda/realtek - Modify Dell platform name
    - ALSA: hda/hdmi: Fix incorrect mutex unlock in silent_stream_disable()
    - [x86] drm/i915/tgl: Fix Combo PHY DPLL fractional divider for 38.4MHz
      ref clock
    - RDMA/core: remove use of dma_virt_ops
    - RDMA/siw,rxe: Make emulated devices virtual in the device tree
    - fuse: fix bad inode
    - perf: Break deadlock involving exec_update_mutex
    - rwsem: Implement down_read_killable_nested
    - rwsem: Implement down_read_interruptible
    - exec: Transform exec_update_mutex into a rw_semaphore
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.7
    - i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs
    - iavf: fix double-release of rtnl_lock
    - net/sched: sch_taprio: ensure to reset/destroy all child qdiscs
    - [arm64,armhf] net: mvpp2: Add TCAM entry to drop flow control pause
      frames
    - [arm64,armhf] net: mvpp2: prs: fix PPPoE with ipv6 packet parse
    - atm: idt77252: call pci_disable_device() on error path
    - [arm64,armhf] net: mvpp2: Fix GoP port 3 Networking Complex Control
      configurations
    - [arm64,armhf] net: stmmac: dwmac-meson8b: ignore the second clock input
    - [arm64,armhf] net: ethernet: mvneta: Fix error handling in mvneta_probe
    - qede: fix offload for IPIP tunnel packets
    - virtio_net: Fix recursive call to cpus_read_lock()
    - [armhf] net/ncsi: Use real net-device for response handler
    - net-sysfs: take the rtnl lock when storing xps_cpus
    - net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc
    - net-sysfs: take the rtnl lock when storing xps_rxqs
    - net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc
    - [armhf] net: ethernet: ti: cpts: fix ethtool output when no ptp_clock
      registered
    - tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS
    - e1000e: Only run S0ix flows if shutdown succeeded
    - e1000e: bump up timeout to wait when ME un-configures ULP mode
    - Revert "e1000e: disable s0ix entry and exit flows for ME systems"
    - e1000e: Export S0ix flags to ethtool
    - bnxt_en: Check TQM rings for maximum supported value.
    - [arm64,armhf] net: mvpp2: fix pkt coalescing int-threshold configuration
    - bnxt_en: Fix AER recovery.
    - ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst()
    - net: sched: prevent invalid Scell_log shift count
    - [arm64] net: hns: fix return value check in __lb_other_process()
    - erspan: fix version 1 check in gre_parse_header()
    - net: hdlc_ppp: Fix issues when mod_timer is called while timer is
      running
    - vhost_net: fix ubuf refcount incorrectly when sendmsg fails
    - r8169: work around power-saving bug on some chip versions
    - CDC-NCM: remove "connected" log message
    - net: usb: qmi_wwan: add Quectel EM160R-GL
    - block: add debugfs stanza for QUEUE_FLAG_NOWAIT
    - workqueue: Kick a worker based on the actual activation of delayed works
    - scsi: ufs: Fix wrong print message in dev_err()
    - scsi: ufs-pci: Fix restore from S4 for Intel controllers
    - scsi: ufs-pci: Ensure UFS device is in PowerDown mode for
      suspend-to-disk ->poweroff()
    - scsi: ufs-pci: Fix recovery from hibernate exit errors for Intel
      controllers
    - scsi: ufs-pci: Enable UFSHCD_CAP_RPM_AUTOSUSPEND for Intel controllers
    - scsi: block: Introduce BLK_MQ_REQ_PM
    - scsi: ide: Do not set the RQF_PREEMPT flag for sense requests
    - scsi: scsi_transport_spi: Set RQF_PM for domain validation commands
    - scsi: core: Only process PM requests if rpm_status != RPM_ACTIVE
    - lib/genalloc: fix the overflow when size is too big
    - scsi: ufs: Clear UAC for FFU and RPMB LUNs
    - Bluetooth: revert: hci_h5: close serdev device and free hu in h5_close
    - scsi: block: Remove RQF_PREEMPT and BLK_MQ_REQ_PREEMPT
    - scsi: block: Do not accept any requests while suspended
    - crypto: ecdh - avoid buffer overflow in ecdh_set_secret()
    - [powerpc*] Handle .text.{hot,unlikely}.* in linker script
    - [x86] Staging: comedi: Return -EFAULT if copy_to_user() fails
    - usb: gadget: enable super speed plus
    - USB: cdc-acm: blacklist another IR Droid device
    - USB: cdc-wdm: Fix use after free in service_outstanding_interrupt().
    - [arm64,armhf] usb: dwc3: meson-g12a: disable clk on error handling path
      in probe
    - [arm64,armhf] usb: dwc3: gadget: Restart DWC3 gadget when enabling
      pullup
    - [arm64,armhf] usb: dwc3: gadget: Clear wait flag on dequeue
    - [arm64] usb: dwc3: ulpi: Use VStsDone to detect PHY regs access
      completion
    - [arm64] usb: dwc3: ulpi: Replace CPU-based busyloop with Protocol-based
      one
    - [arm64] usb: dwc3: ulpi: Fix USB2.0 HS/FS/LS PHY suspend regression
    - [arm64,armhf] usb: chipidea: ci_hdrc_imx: add missing put_device() call
      in usbmisc_get_init_data()
    - USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk
      set
    - usb: usbip: vhci_hcd: protect shift size
    - usb: uas: Add PNY USB Portable SSD to unusual_uas
    - USB: serial: iuu_phoenix: fix DMA from stack
    - USB: serial: option: add LongSung M5710 module support
    - USB: serial: option: add Quectel EM160R-GL
    - USB: yurex: fix control-URB timeout handling
    - USB: usblp: fix DMA to stack
    - ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks
    - USB: Gadget: dummy-hcd: Fix shift-out-of-bounds bug
    - usb: gadget: f_uac2: reset wMaxPacketSize
    - usb: gadget: function: printer: Fix a memory leak for interface
      descriptor
    - usb: gadget: u_ether: Fix MTU size mismatch with RX packet size
    - usb: gadget: Fix spinlock lockup on usb_function_deactivate
    - usb: gadget: configfs: Preserve function ordering after bind failure
    - usb: gadget: configfs: Fix use-after-free issue with udc_name
    - USB: serial: keyspan_pda: remove unused variable
    - mm: make wait_on_page_writeback() wait for multiple pending writebacks
    - [x86] mm: Fix leak of pmd ptlock
    - [x86] KVM: mmu: Use -1 to flag an undefined spte in get_mmio_spte()
    - [x86] KVM: mmu: Get root level from walkers when retrieving MMIO SPTE
    - kvm: check tlbs_dirty directly
    - [x86] KVM: mmu: Ensure TDP MMU roots are freed after yield
    - [x86] resctrl: Use an IPI instead of task_work_add() to update PQR_ASSOC
      MSR
    - [x86] resctrl: Don't move a task to the same resource group
    - blk-iocost: fix NULL iocg deref from racing against initialization
    - ALSA: hda/via: Fix runtime PM for Clevo W35xSS
    - ALSA: hda/conexant: add a new hda codec CX11970
    - ALSA: hda/realtek - Fix speaker volume control on Lenovo C940
    - ALSA: hda/realtek: Add mute LED quirk for more HP laptops
    - ALSA: hda/realtek: Enable mute and micmute LED on HP EliteBook 850 G7
    - ALSA: hda/realtek: Add two "Intel Reference board" SSID in the ALC256.
    - [amd64] iommu/vt-d: Move intel_iommu info from struct intel_svm to
      struct intel_svm_dev
    - btrfs: qgroup: don't try to wait flushing if we're already holding a
      transaction
    - btrfs: send: fix wrong file path when there is an inode with a pending
      rmdir
    - Revert "device property: Keep secondary firmware node secondary by type"
    - dmabuf: fix use-after-free of dmabuf's file->f_inode
    - [x86] drm/i915: clear the shadow batch
    - [x86] drm/i915: clear the gpu reloc batch
    - bcache: check unsupported feature sets for bcache register
    - bcache: introduce BCH_FEATURE_INCOMPAT_LOG_LARGE_BUCKET_SIZE for large
      bucket
    - net/mlx5e: Fix SWP offsets when vlan inserted by driver
    - netfilter: x_tables: Update remaining dereference to RCU
    - netfilter: ipset: fix shift-out-of-bounds in htable_bits()
    - netfilter: xt_RATEEST: reject non-null terminated string from userspace
    - netfilter: nft_dynset: report EOPNOTSUPP on missing set feature
    - [x86] mtrr: Correct the range check before performing MTRR type lookups
    - xsk: Fix memory leak for failed bind
    - rtlwifi: rise completion at the last step of firmware callback
    - scsi: target: Fix XCOPY NAA identifier lookup (CVE-2020-28374)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.8
    - [powerpc] 32s: Fix RTAS machine check with VMAP stack
    - io_uring: synchronise IOPOLL on task_submit fail
    - io_uring: limit {io|sq}poll submit locking scope
    - io_uring: patch up IOPOLL overflow_flush sync
    - [arm64] RDMA/hns: Avoid filling sl in high 3 bits of vlan_id
    - [arm64,armhf] iommu/arm-smmu-qcom: Initialize SCTLR of the bypass
      context
    - [arm64,armhf] drm/panfrost: Don't corrupt the queue mutex on open/close
    - io_uring: Fix return value from alloc_fixed_file_ref_node
    - scsi: ufs: Fix -Wsometimes-uninitialized warning
    - btrfs: skip unnecessary searches for xattrs when logging an inode
    - btrfs: fix deadlock when cloning inline extent and low on free metadata
      space
    - btrfs: shrink delalloc pages instead of full inodes
    - [arm64] net: hns3: fix incorrect handling of sctp6 rss tuple
    - [arm64] net: hns3: fix the number of queues actually used by ARQ
    - [arm64] net: hns3: fix a phy loopback fail issue
    - [arm64,armhf] net: stmmac: dwmac-sun8i: Fix probe error handling
    - [arm64,armhf] net: stmmac: dwmac-sun8i: Balance internal PHY resource
      references
    - [arm64,armhf] net: stmmac: dwmac-sun8i: Balance internal PHY power
    - [arm64,armhf] net: stmmac: dwmac-sun8i: Balance syscon
      (de)initialization
    - net: vlan: avoid leaks on register_vlan_dev() failures
    - net: ipv6: fib: flush exceptions when purging route
    - net: fix pmtu check in nopmtudisc mode
    - net: ip: always refragment ip defragmented packets
    - nexthop: Fix off-by-one error in error path
    - nexthop: Unlink nexthop group entry in error path
    - nexthop: Bounce NHA_GATEWAY in FDB nexthop groups
    - [s390x] qeth: fix deadlock during recovery
    - [s390x] qeth: fix locking for discipline setup / removal
    - [s390x] qeth: fix L2 header access in qeth_l3_osa_features_check()
    - net/mlx5: Use port_num 1 instead of 0 when delete a RoCE address
    - net/mlx5e: ethtool, Fix restriction of autoneg with 56G
    - net/mlx5e: In skb build skip setting mark in switchdev mode
    - net/mlx5: Check if lag is supported before creating one
    - scsi: lpfc: Fix variable 'vport' set but not used in
      lpfc_sli4_abts_err_handler()
    - HID: wacom: Fix memory leakage caused by kfifo_alloc
    - fanotify: Fix sys_fanotify_mark() on native x86-32
    - [armhf] OMAP2+: omap_device: fix idling of devices during probe
    - [x86] cpufreq: powernow-k8: pass policy rather than use
      cpufreq_cpu_get()
    - [armhf] spi: stm32: FIFO threshold level - fix align packet size
    - i2c: i801: Fix the i2c-mux gpiod_lookup_table not being properly
      terminated
    - bcache: set bcache device into read-only mode for
      BCH_FEATURE_INCOMPAT_OBSO_LARGE_BUCKET
    - [amd64] iommu/vt-d: Fix misuse of ALIGN in qi_flush_piotlb()
    - [amd64] iommu/intel: Fix memleak in intel_irq_remapping_alloc
    - nvme-tcp: Fix possible race of io_work and direct send
    - net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups
    - net/mlx5e: Fix two double free cases
    - regmap: debugfs: Fix a memory leak when calling regmap_attach_dev
    - [arm64,armhf] net: mvpp2: disable force link UP during port init
      procedure
    - [x86] drm/i915/dp: Track pm_qos per connector
    - [arm64,armhf] net: mvneta: fix error message when MTU too large for XDP
    - [arm64] KVM: Don't access PMCR_EL0 when no PMU is available
    - xsk: Fix race in SKB mode transmit with shared cq
    - xsk: Rollback reservation at NETDEV_TX_BUSY
    - can: isotp: isotp_getname(): fix kernel information leak
    - block: fix use-after-free in disk_part_iter_next
    - net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of
      trimmed packet
    - regmap: debugfs: Fix a reversed if statement in regmap_debugfs_init()
    - [arm64,armhf] drm/panfrost: Remove unused variables in
      panfrost_job_close()
    - tools headers UAPI: Sync linux/fscrypt.h with the kernel sources
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.9
    - btrfs: reloc: fix wrong file extent type check to avoid false ENOENT
    - btrfs: prevent NULL pointer dereference in extent_io_tree_panic
    - ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP
      machines
    - ALSA: doc: Fix reference to mixart.rst
    - [amd64] ASoC: AMD Renoir - add DMI entry for Lenovo ThinkPad X395
    - ASoC: dapm: remove widget from dirty list on free
    - [x86] hyperv: check cpu mask after interrupt has been disabled
    - drm/amdgpu: add green_sardine device id (v2)
    - drm/amdgpu: fix DRM_INFO flood if display core is not supported (bug
      210921)
    - drm/amdgpu: add new device id for Renior
    - [x86] drm/i915: Allow the sysadmin to override security mitigations
    - [x86] drm/i915/gt: Limit VFE threads based on GT
    - [x86] drm/i915/backlight: fix CPU mode backlight takeover on LPT
    - [armhf] drm/bridge: sii902x: Refactor init code into separate function
    - dt-bindings: display: sii902x: Add supply bindings
    - [armhf] drm/bridge: sii902x: Enable I/O and core VCC supplies if present
    - tracing/kprobes: Do the notrace functions check without kprobes on
      ftrace
    - tools/bootconfig: Add tracing_on support to helper scripts
    - ext4: use IS_ERR instead of IS_ERR_OR_NULL and set inode null when
      IS_ERR
    - ext4: fix wrong list_splice in ext4_fc_cleanup
    - ext4: fix bug for rename with RENAME_WHITEOUT
    - cifs: check pointer before freeing
    - cifs: fix interrupted close commands
    - [riscv64] Drop a duplicated PAGE_KERNEL_EXEC
    - [riscv64] return -ENOSYS for syscall -1
    - [riscv64] Fixup CONFIG_GENERIC_TIME_VSYSCALL
    - [mips*] fix Section mismatch in reference
    - [mips*] lib: uncached: fix non-standard usage of variable 'sp'
    - [mips*] boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB
    - [mips*] Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps
    - [mips*] relocatable: fix possible boot hangup with KASLR enabled
    - RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd()
    - ACPI: scan: Harden acpi_device_add() against device ID overflows
    - xen/privcmd: allow fetching resource sizes
    - mm/vmalloc.c: fix potential memory leak
    - mm/hugetlb: fix potential missing huge page size info
    - mm/process_vm_access.c: include compat.h
    - dm raid: fix discard limits for raid1
    - dm snapshot: flush merged data before committing metadata
    - dm integrity: fix flush with external metadata device
    - dm integrity: fix the maximum number of arguments
    - dm crypt: use GFP_ATOMIC when allocating crypto requests from softirq
    - dm crypt: do not wait for backlogged crypto request completion in
      softirq
    - dm crypt: do not call bio_endio() from the dm-crypt tasklet
    - dm crypt: defer decryption to a tasklet if interrupts disabled
    - r8152: Add Lenovo Powered USB-C Travel Hub
    - btrfs: tree-checker: check if chunk item end overflows
    - ext4: don't leak old mountpoint samples
    - io_uring: don't take files/mm for a dead task
    - io_uring: drop mm and files after task_work_run
    - ath11k: fix crash caused by NULL rx_channel
    - netfilter: ipset: fixes possible oops in mtype_resize
    - ath11k: qmi: try to allocate a big block of DMA memory first
    - btrfs: fix async discard stall
    - btrfs: merge critical sections of discard lock in workfn
    - btrfs: fix transaction leak and crash after RO remount caused by qgroup
      rescan
    - ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram
    - [arm64,armhf] hwmon: (pwm-fan) Ensure that calculation doesn't discard
      big period values
    - spi: fix the divide by 0 error when calculating xfer waiting time
    - io_uring: drop file refs after task cancel
    - bfq: Fix computation of shallow depth
    - misdn: dsp: select CONFIG_BITREVERSE
    - net: ethernet: fs_enet: Add missing MODULE_LICENSE
    - nvme-pci: mark Samsung PM1725a as IGNORE_DEV_SUBNQN
    - nvme: avoid possible double fetch in handling CQE
    - nvmet-rdma: Fix list_del corruption on queue establishment failure
    - drm/amdgpu: fix a GPU hang issue when remove device
    - drm/amdgpu: fix potential memory leak during navi12 deinitialization
    - [amd64] iommu/vt-d: Fix lockdep splat in sva bind()/unbind()
    - ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI
    - [arm64] drm/msm: Call msm_init_vram before binding the gpu
    - poll: fix performance regression due to out-of-line __put_user()
    - rcu-tasks: Move RCU-tasks initialization to before early_initcall()
    - bpf: Simplify task_file_seq_get_next()
    - bpf: Save correct stopping point in file seq iteration
    - nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt
      context
    - [amd64] iommu/vt-d: Update domain geometry in iommu_ops.at(de)tach_dev
    - net/mlx5: Fix passing zero to 'PTR_ERR'
    - net/mlx5: E-Switch, fix changing vf VLANID
    - blk-mq-debugfs: Add decode for BLK_MQ_F_TAG_HCTX_SHARED
    - mm: fix clear_refs_write locking
    - mm: don't play games with pinned pages in clear_page_refs
    - mm: don't put pinned pages into the swap cache
    - perf intel-pt: Fix 'CPU too large' error
    - dump_common_audit_data(): fix racy accesses to ->d_name
    - [x86] ASoC: Intel: fix error code cnl_set_dsp_D0()
    - nvmet-rdma: Fix NULL deref when setting pi_enable and traddr INADDR_ANY
    - nvme: don't intialize hwmon for discovery controllers
    - nvme-tcp: fix possible data corruption with bio merges
    - nvme-tcp: Fix warning with CONFIG_DEBUG_PREEMPT
    - NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock
    - pNFS: We want return-on-close to complete when evicting the inode
    - pNFS: Mark layout for return if return-on-close was not sent
    - pNFS: Stricter ordering of layoutget and layoutreturn
    - NFS: Adjust fs_context error logging
    - NFS/pNFS: Don't call pnfs_free_bucket_lseg() before removing the request
    - NFS/pNFS: Don't leak DS commits in pnfs_generic_retry_commit()
    - NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter
    - NFS: nfs_delegation_find_inode_server must first reference the
      superblock
    - NFS: nfs_igrab_and_active must first reference the superblock
    - scsi: ufs: Fix possible power drain during system suspend
    - ext4: fix superblock checksum failure when setting password salt
    - RDMA/restrack: Don't treat as an error allocation ID wrapping
    - [amd64] RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp
    - bnxt_en: Improve stats context resource accounting with RDMA driver
      loaded.
    - RDMA/mlx5: Fix wrong free of blue flame register on error
    - IB/mlx5: Fix error unwinding when set_has_smi_cap fails
    - umount(2): move the flag validity checks first
    - [x86] drm/i915/dsi: Use unconditional msleep for the panel_on_delay when
      there is no reset-deassert MIPI-sequence
    - [x86] drm/i915/icl: Fix initing the DSI DSC power refcount during HW
      readout
    - [x86] drm/i915/gt: Restore clear-residual mitigations for Ivybridge,
      Baytrail
    - mm, slub: consider rest of partial list if acquire_slab() fails
    - [riscv64] Trace irq on only interrupt is enabled
    - [amd64] iommu/vt-d: Fix unaligned addresses for
      intel_flush_svm_range_dev()
    - net: sunrpc: interpret the return value of kstrtou32 correctly
    - dm: eliminate potential source of excessive kernel log noise
    - ALSA: fireface: Fix integer overflow in transmit_midi_msg()
    - ALSA: firewire-tascam: Fix integer overflow in midi_port_work()
    - netfilter: conntrack: fix reading nf_conntrack_buckets
    - netfilter: nf_nat: Fix memleak in nf_nat_init

  [ Aurelien Jarno ]
  * Ignore ABI change for dfltcc_* symbols.
  * [riscv64] PCI: Enable PCI_HOST_GENERIC.

  [ Salvatore Bonaccorso ]
  * Bump ABI to 2
  * [rt] Update to 5.10.8-rt24

  [ Bastian Blank ]
  * [arm64] Enable support for Marvell EBU SoC.
  * Enable remaining NET_ACT_*.
  * Enable ACPI_HMAT, EFI_SOFT_RESERVE.
  * Enable remaining THERMAL_GOV_*, ENERGY_MODEL.
  * Set SCTP_DEFAULT_COOKIE_HMAC_SHA1.
  * [x86] Enable SERIAL_8250_LPSS. (closes: #973985)
  * Enable CRYPTO_DEV_VIRTIO.
  * Enable DRM_AMD_DC_*.
  * [arm] Enable CRYPTO_NHPOLY1305_NEON. (closes: #980214)
  * [arm64] Enable MFD_AXP20X_I2C. (closes: #980114)
  * [amd64] Enable SENSORS_AMD_ENERGY. (closes: #970699)
  * [cloud] Enable SUSPEND. (closes: #964845)
  * [armhf] Enable GPIO_PCA953X_IRQ. (closes: #972221)
  * [arm] Enable DRM_VC4, DRM_VC4_HDMI_CEC. (closes: #956951)
  * [x86] Enable STMMAC_ETH, DWMAC_INTEL. (closes: #980180)

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 20 Jan 2021 17:40:43 +0100

linux (5.10.5-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.5
    - net/sched: sch_taprio: reset child qdiscs before freeing them
    - ethtool: fix error paths in ethnl_set_channels()
    - ethtool: fix string set id check
    - md/raid10: initialize r10_bio->read_slot before use.
    - io_uring: close a small race gap for files cancel
    - jffs2: Allow setting rp_size to zero during remounting
    - jffs2: Fix NULL pointer dereference in rp_size fs option parsing
    - opp: fix memory leak in _allocate_opp_table
    - opp: Call the missing clk_put() on error
    - scsi: block: Fix a race in the runtime power management code
    - mm/hugetlb: fix deadlock in hugetlb_cow error path
    - mm: memmap defer init doesn't work as expected
    - [s390x] lib/zlib: fix inflating zlib streams on s390
    - io_uring: don't assume mm is constant across submits
    - io_uring: use bottom half safe lock for fixed file data
    - io_uring: add a helper for setting a ref node
    - io_uring: fix io_sqe_files_unregister() hangs
    - uapi: move constants from <linux/kernel.h> to <linux/const.h>
    - tools headers UAPI: Sync linux/const.h with the kernel headers
    - cgroup: Fix memory leak when parsing multiple source parameters
    - [s390x] zlib: move EXPORT_SYMBOL() and MODULE_LICENSE() out of
      dfltcc_syms.c
    - Bluetooth: hci_h5: close serdev device and free hu in h5_close
    - fbcon: Disable accelerated scrolling
    - reiserfs: add check for an invalid ih_entry_count
    - [x86] misc: vmw_vmci: fix kernel info-leak by initializing dbells in
      vmci_ctx_get_chkpt_doorbells()
    - media: gp8psk: initialize stats at power control logic
    - f2fs: fix shift-out-of-bounds in sanity_check_raw_super()
    - ALSA: seq: Use bool for snd_seq_queue internal flags
    - ALSA: rawmidi: Access runtime->avail always in spinlock
    - bfs: don't use WARNING: string when it's just info.
    - ext4: check for invalid block size early when mounting a file system
    - fcntl: Fix potential deadlock in send_sig{io, urg}()
    - io_uring: check kthread stopped flag when sq thread is unparked
    - [arm64,armhf] rtc: sun6i: Fix memleak in sun6i_rtc_clk_init
    - module: set MODULE_STATE_GOING state when a module fails to load
    - quota: Don't overflow quota file offsets
    - [arm64,armhf] rtc: pl031: fix resource leak in pl031_probe
    - i3c master: fix missing destroy_workqueue() on error in
      i3c_master_register
    - NFSv4: Fix a pNFS layout related use-after-free race when freeing the
      inode
    - f2fs: avoid race condition for shrinker count
    - f2fs: fix race of pending_pages in decompression
    - module: delay kobject uevent until after module init call
    - [powerpc*] 64: irq replay remove decrementer overflow check
    - fs/namespace.c: WARN if mnt_count has become negative
    - ceph: fix inode refcount leak when ceph_fill_inode on non-I_NEW inode
      fails
    - tick/sched: Remove bogus boot "safety" check
    - [s390x] always clear kernel stack backchain before calling functions
    - io_uring: remove racy overflow list fast checks
    - ALSA: pcm: Clear the full allocated memory at hw_params
    - dm verity: skip verity work if I/O error when system is shutting down
    - ext4: avoid s_mb_prefetch to be zero in individual scenarios
    - device-dax: Fix range release

  [ Luca Boccassi ]
  * [amd64,arm64] Generate BTF debug info: (partially closes: #973870)
    - Enable DEBUG_INFO_BTF.
    - Build-Depend on dwarves >= 1.16~.

  [ Aurelien Jarno ]
  * usbip: depend on usb.ids instead of usbutils.
  * [mips*] Fix build with binutils configured with
    --enable-mips-fix-loongson3-llsc=yes.

  [ Salvatore Bonaccorso ]
  * Bluetooth: Fix attempting to set RPA timeout when unsupported
    (Closes: #972968)
  * net: cdc_ncm: correct overhead in delayed_ndp_size (Closes: #970736)
  * mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start
    (CVE-2020-36158)
  * [rt] Update to 5.10.4-rt22
  * X.509: Fix crash caused by NULL pointer (Closes: #979496)
  * Revert "drm/amd/display: Fix memory leaks in S3 resume"

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 09 Jan 2021 21:25:11 +0100

linux (5.10.4-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.3
    - net: ipconfig: Avoid spurious blank lines in boot log
    - [x86] split-lock: Avoid returning with interrupts enabled
    - exfat: Avoid allocating upcase table using kcalloc()
    - [arm64] soc/tegra: fuse: Fix index bug in get_process_id
    - USB: serial: option: add interface-number sanity check to flag handling
    - USB: gadget: f_acm: add support for SuperSpeed Plus
    - USB: gadget: f_midi: setup SuperSpeed Plus descriptors
    - usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
    - USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
    - [arm64,armhf] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING
      flag to imx6ul
    - [armhf] dts: exynos: fix roles of USB 3.0 ports on Odroid XU
    - [armhf] dts: exynos: fix USB 3.0 pins supply being turned off on Odroid
      XU
    - f2fs: fix to seek incorrect data offset in inline data file
    - f2fs: init dirty_secmap incorrectly
    - scsi: megaraid_sas: Check user-provided offsets
    - [arm64,x86] HID: i2c-hid: add Vero K147 to descriptor override
    - serial_core: Check for port state when tty is in error state
    - fscrypt: remove kernel-internal constants from UAPI header
    - fscrypt: add fscrypt_is_nokey_name()
    - ubifs: prevent creating duplicate encrypted filenames
    - ext4: prevent creating duplicate encrypted filenames
    - f2fs: prevent creating duplicate encrypted filenames
    - Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
    - quota: Sanity-check quota file headers on load
    - fs: quota: fix array-index-out-of-bounds bug by passing correct argument
      to vfs_cleanup_quota_inode()
    - media: msi2500: assign SPI bus number dynamically
    - crypto: af_alg - avoid undefined behavior accessing salg_name
    - nl80211: validate key indexes for cfg80211_registered_device
    - md: fix a warning caused by a race between concurrent md_ioctl()s
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.4
    - [x86] hwmon: (k10temp) Remove support for displaying voltage and current
      on Zen CPUs
    - [x86] drm/gma500: fix double free of gma_connector
    - [arm64] rtc: pcf2127: fix pcf2127_nvmem_read/write() returns
    - selinux: fix error initialization in inode_doinit_with_dentry()
    - [armhf] dts: aspeed: s2600wf: Fix VGA memory region location
    - RDMA/core: Fix error return in _ib_modify_qp()
    - RDMA/rxe: Compute PSN windows correctly
    - [x86] /mm/ident_map: Check for errors from ident_pud_init()
    - [armel,armhf] p2v: fix handling of LPAE translation in BE mode
    - [x86] apic: Fix x2apic enablement without interrupt remapping
    - sched/deadline: Fix sched_dl_global_validate()
    - sched: Reenable interrupts in do_sched_yield()
    - [arm64] crypto: inside-secure - Fix sizeof() mismatch
    - [arm64] ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified
      mode
    - drm/msm: Add missing stub definition
    - [armhf] dts: aspeed: tiogapass: Remove vuart
    - [powerpc*] 64: Set up a kernel stack for secondaries before
      cpu_restore()
    - f2fs: call f2fs_get_meta_page_retry for nat page
    - RDMA/mlx5: Fix corruption of reg_pages in mlx5_ib_rereg_user_mr()
    - [arm64] drm/msm/dp: DisplayPort PHY compliance tests fixup
    - [arm64] drm/msm/dsi_pll_7nm: restore VCO rate during restore_state
    - [arm64] drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
    - [arm64] drm/msm/dpu: fix clock scaling on non-sc7180 board
    - spi: spi-mem: fix reference leak in spi_mem_access_start
    - scsi: aacraid: Improve compat_ioctl handlers
    - ASoC: pcm: DRAIN support reactivation
    - [armhf] drm/bridge: tpd12s015: Fix irq registering in tpd12s015_probe
    - [arm64] crypto: arm64/poly1305-neon - reorder PAC authentication with SP
      update
    - [arm64] crypto: caam - fix printing on xts fallback allocation error
      path
    - selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
    - nl80211/cfg80211: fix potential infinite loop
    - [armhf] spi: stm32: fix reference leak in stm32_spi_resume
    - [x86] mce: Correct the detection of invalid notifier priorities
    - drm/edid: Fix uninitialized variable in drm_cvt_modes()
    - ath11k: Initialize complete alpha2 for regulatory change
    - ath11k: Fix number of rules in filtered ETSI regdomain
    - ath11k: fix wmi init configuration
    - brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free}
    - [arm64,armhf] drm/panel: simple: Add flags to boe_nv133fhm_n61
    - Bluetooth: Fix null pointer dereference in hci_event_packet()
    - Bluetooth: Fix: LL PRivacy BLE device fails to connect
    - Bluetooth: hci_h5: fix memory leak in h5_close
    - [armhf] spi: stm32-qspi: fix reference leak in stm32 qspi operations
    - [armhf] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
    - [arm64] spi: tegra20-slink: fix reference leak in slink ops of tegra20
    - [arm64,armhf] spi: tegra20-sflash: fix reference leak in
      tegra_sflash_resume
    - [arm64,armhf] spi: tegra114: fix reference leak in tegra spi ops
    - [armhf] spi: imx: fix reference leak in two imx operations
    - [arm64] ASoC: qcom: common: Fix refcounting in qcom_snd_parse_of()
    - ath11k: Handle errors if peer creation fails
    - mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
    - [arm64] drm/msm/a6xx: Clear shadow on suspend
    - [arm64] drm/msm/a5xx: Clear shadow on suspend
    - [arm64] drm/msm/dp: return correct connection status after suspend
    - [arm64] drm/msm/dp: skip checking LINK_STATUS_UPDATED bit
    - [arm64] drm/msm/dp: do not notify audio subsystem if sink doesn't
      support audio
    - virtiofs fix leak in setup
    - RDMa/mthca: Work around -Wenum-conversion warning
    - [armhf] soc: ti: omap-prm: Do not check rstst bit on deassert if already
      deasserted
    - [x86] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
    - drm/udl: Fix missing error code in udl_handle_damage()
    - [x86] media: tm6000: Fix sizeof() mismatches
    - media: v4l2-fwnode: Return -EINVAL for invalid bus-type
    - media: v4l2-fwnode: v4l2_fwnode_endpoint_parse caller must init vep
      argument
    - [arm64,armhf] media: cedrus: fix reference leak in
      cedrus_start_streaming
    - [arm64] media: venus: core: change clk enable and disable order in
      resume and suspend
    - [arm64] media: venus: core: vote for video-mem path
    - [arm64] media: venus: core: vote with average bandwidth and peak
      bandwidth as zero
    - RDMA/cma: Add missing error handling of listen_id
    - scsi: core: Fix VPD LUN ID designator priorities
    - [arm64] media: venus: put dummy vote on video-mem path after last
      session release
    - media: solo6x10: fix missing snd_card_free in error handling case
    - [arm64,armhf] mmc: sdhci: tegra: fix wrong unit with busy_timeout
    - [armhf] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
    - [arm64] drm/meson: Free RDMA resources after tearing down DRM
    - [arm64] drm/meson: Unbind all connectors on module removal
    - [arm64] drm/meson: dw-hdmi: Register a callback to disable the regulator
    - [arm64] drm/meson: dw-hdmi: Ensure that clocks are enabled before
      touching the TOP registers
    - [amd64] iommu/vt-d: include conditionally on CONFIG_INTEL_IOMMU_SVM
    - Input: ads7846 - fix race that causes missing releases
    - Input: ads7846 - fix integer overflow on Rt calculation
    - Input: ads7846 - fix unaligned access on 7845
    - bus: mhi: core: Remove double locking from mhi_driver_remove()
    - bus: mhi: core: Fix null pointer access when parsing MHI configuration
    - [powerpc*] Avoid broken GCC __attribute__((optimize))
    - [powerpc*] feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
    - [armhf] dts: tacoma: Fix node vs reg mismatch for flash memory
    - Revert "powerpc/pseries/hotplug-cpu: Remove double free in error path"
    - [powerpc*] powernv/sriov: fix unsigned int win compared to less than
      zero
    - [x86] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId
    - scsi: ufs: Avoid to call REQ_CLKS_OFF to CLKS_OFF
    - scsi: ufs: Fix clkgating on/off
    - rcu: Allow rcu_irq_enter_check_tick() from NMI
    - rcu,ftrace: Fix ftrace recursion
    - rcu/tree: Defer kvfree_rcu() allocation to a clean context
    - spi: fix resource leak for drivers without .remove callback
    - [arm64] drm/meson: dw-hdmi: Disable clocks on driver teardown
    - [arm64] drm/meson: dw-hdmi: Enable the iahb clock early enough
    - PCI: Disable MSI for Pericom PCIe-USB adapter
    - [arm64] PCI: brcmstb: Initialize "tmp" before use
    - [arm64] dts: qcom: sm8250: correct compatible for sm8250-mtp
    - [armhf] Input: omap4-keypad - fix runtime PM error handling
    - ath11k: Fix the rx_filter flag setting for peer rssi stats
    - RDMA/cxgb4: Validate the number of CQEs
    - [arm64] pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin
      controller
    - memstick: fix a double-free bug in memstick_check
    - brcmfmac: fix error return code in brcmf_cfg80211_connect()
    - orinoco: Move context allocation after processing the skb
    - rsi: fix error return code in rsi_reset_card()
    - [arm64] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
    - [armel] leds: netxbig: add missing put_device() call in
      netxbig_leds_get_of_pdata()
    - RDMA/cma: Fix deadlock on &lock in rdma_cma_listen_on_all() error unwind
    - media: siano: fix memory leak of debugfs members in smsdvb_hotplug
    - [x86] platform/x86: mlx-platform: Remove PSU EEPROM from default
      platform configuration
    - [x86] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x
      platform configuration
    - [arm64] RDMA/hns: Only record vlan info for HIP08
    - [arm64] RDMA/hns: Fix missing fields in address vector
    - [arm64] RDMA/hns: Avoid setting loopback indicator when smac is same as
      dmac
    - RDMA/core: Track device memory MRs
    - [armhf] HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
    - [arm64] dts: armada-3720-turris-mox: update ethernet-phy handle name
    - [arm64] dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
    - [x86] power: supply: max17042_battery: Fix current_{avg,now} hiding with
      no current sense
    - [x86] power: supply: bq24190_charger: fix reference leak
    - genirq/irqdomain: Don't try to free an interrupt that has no mapping
    - [arm64] dts: freescale: sl28: combine SPI MTD partitions
    - [arm64,armhf] phy: tegra: xusb: Fix usb_phy device driver field
    - [arm64] dts: qcom: c630: Polish i2c-hid devices
    - [arm64] dts: qcom: c630: Fix pinctrl pins properties
    - PCI: Bounds-check command-line resource alignment requests
    - PCI: Fix overflow in command-line resource alignment requests
    - [arm64] dts: meson: fix spi-max-frequency on Khadas VIM2
    - [arm64] soc: amlogic: canvas: add missing put_device() call in
      meson_canvas_get()
    - [arm64] scsi: hisi_sas: Fix up probe error handling for v3 hw
    - scsi: pm80xx: Do not sleep in atomic context
    - [arm64] spi: spi-fsl-dspi: Use max_native_cs instead of num_chipselect
      to set SPI_MCR
    - [arm64] RDMA/hns: Fix 0-length sge calculation error
    - [arm64] RDMA/hns: Bugfix for calculation of extended sge
    - soundwire: master: use pm_runtime_set_active() on add
    - [x86] platform/x86: dell-smbios-base: Fix error return code in
      dell_smbios_init
    - [x86] ASoC: Intel: Boards: tgl_max98373: update TDM slot_width
    - ath11k: Don't cast ath11k_skb_cb to ieee80211_tx_info.control
    - ath11k: Reset ath11k_skb_cb before setting new flags
    - ath11k: Fix an error handling path
    - ath10k: Fix the parsing error in service available event
    - ath10k: Fix an error handling path
    - ath10k: Release some resources in an error handling path
    - SUNRPC: rpc_wake_up() should wake up tasks in the correct order
    - NFSv4.2: condition READDIR's mask for security label based on LSM state
    - SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
    - NFSv4: Fix the alignment of page data in the getdeviceinfo reply
    - net: sunrpc: Fix 'snprintf' return value check in 'do_xprt_debugfs'
    - lockd: don't use interval-based rebinding over TCP
    - NFS: switch nfsiod to be an UNBOUND workqueue.
    - vfio-pci: Use io_remap_pfn_range() for PCI IO memory
    - f2fs: fix double free of unicode map
    - media: tvp5150: Fix wrong return value of tvp5150_parse_dt()
    - media: saa7146: fix array overflow in vidioc_s_audio()
    - [powerpc*] perf: Fix crash with is_sier_available when pmu is not set
    - [powerpc*] 64: Fix an EMIT_BUG_ENTRY in head_64.S
    - [powerpc*] xmon: Fix build failure for 8xx
    - [powerpc*] perf: Fix to update radix_scope_qual in power10
    - [powerpc*] perf: Update the PMU group constraints for l2l3 events in
      power10
    - [powerpc*] perf: Fix the PMU group constraints for threshold events in
      power10
    - [armel,armhf] clocksource/drivers/orion: Add missing
      clk_disable_unprepare() on error path
    - [arm64] mte: fix prctl(PR_GET_TAGGED_ADDR_CTRL) if TCF0=NONE
    - bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address()
    - [arm64,armhf] soc: rockchip: io-domain: Fix error return code in
      rockchip_iodomain_probe()
    - memstick: r592: Fix error return in r592_probe()
    - [mips64el] Don't round up kernel sections size for memblock_add()
    - mt76: dma: fix possible deadlock running mt76_dma_cleanup
    - net/mlx5: Properly convey driver version to firmware
    - mt76: fix memory leak if device probing fails
    - dm ioctl: fix error return code in target_message
    - [arm64] drm/msm: a5xx: Make preemption reset case reentrant
    - [arm64,armhf] clocksource/drivers/arm_arch_timer: Use stable count
      reader in erratum sne
    - [arm64,armhf] clocksource/drivers/arm_arch_timer: Correct fault
      programming of CNTKCTL_EL1.EVNTI
    - [m68k] macintosh/adb-iop: Always wait for reply message from IOP
    - [m68k] macintosh/adb-iop: Send correct poll command
    - Bluetooth: btusb: Add the missed release_firmware() in
      btusb_mtk_setup_firmware()
    - Bluetooth: btmtksdio: Add the missed release_firmware() in
      mtk_setup_firmware()
    - Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option
    - Bluetooth: btusb: Fix detection of some fake CSR controllers with a
      bcdDevice val of 0x0134
    - [x86] platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on
      some HP x360 models
    - adm8211: fix error return code in adm8211_probe()
    - mtd: spi-nor: sst: fix BPn bits for the SST25VF064C
    - mtd: spi-nor: ignore errors in spi_nor_unlock_all()
    - mtd: spi-nor: atmel: remove global protection flag
    - mtd: spi-nor: atmel: fix unlock_all() for AT25FS010/040
    - [arm64] dts: meson: fix PHY deassert timing requirements
    - [armhf] dts: meson: fix PHY deassert timing requirements
    - [arm64] dts: meson: g12a: x96-max: fix PHY deassert timing requirements
    - [arm64] clk: fsl-sai: fix memory leak
    - scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
    - scsi: pm80xx: Fix error return in pm8001_pci_probe()
    - scsi: iscsi: Fix inappropriate use of put_device()
    - seq_buf: Avoid type mismatch for seq_buf_init
    - [x86] scsi: fnic: Fix error return code in fnic_probe()
    - [x86] platform/x86: mlx-platform: Fix item counter assignment for
      MSN2700, MSN24xx systems
    - [x86] platform/x86: mlx-platform: Fix item counter assignment for
      MSN2700/ComEx system
    - [armel,armhf] 9030/1: entry: omit FP emulation for UND exceptions taken
      in kernel mode
    - [powerpc*] pseries/hibernation: drop pseries_suspend_begin() from
      suspend ops
    - [powerpc*] pseries/hibernation: remove redundant cacheinfo update
    - [powerpc*] powermac: Fix low_sleep_handler with CONFIG_VMAP_STACK
    - [x86] ASoC: amd: change clk_get() to devm_clk_get() and add missed
      checks
    - [x86] ASoC: max98390: Fix error codes in max98390_dsm_init()
    - [powerpc*] mm: sanity_check_fault() should work for all, not only BOOK3S
    - [armhf] usb: ehci-omap: Fix PM disable depth umbalance in
      ehci_hcd_omap_probe
    - speakup: fix uninitialized flush_lock
    - nfsd: Fix message level for normal termination
    - NFSD: Fix 5 seconds delay when doing inter server copy
    - nfs_common: need lock during iterate through the list
    - [x86] kprobes: Restore BTF if the single-stepping is cancelled
    - scsi: qla2xxx: Fix FW initialization error on big endian machines
    - scsi: qla2xxx: Fix N2N and NVMe connect retry failure
    - [arm64,armhf] platform/chrome: cros_ec_spi: Don't overwrite spi::mode
    - [arm64] bus: fsl-mc: add back accidentally dropped error check
    - [arm64] bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
    - [armhf] fsi: Aspeed: Add mutex to protect HW access
    - [s390x] cio: fix use-after-free in ccw_device_destroy_console
    - iwlwifi: dbg-tlv: fix old length in is_trig_data_contained()
    - iwlwifi: mvm: hook up missing RX handlers
    - erofs: avoid using generic_block_bmap
    - [powerpc*] sstep: Emulate prefixed instructions only when
      CPU_FTR_ARCH_31 is set
    - [powerpc*] sstep: Cover new VSX instructions under CONFIG_VSX
    - ALSA: hda/hdmi: fix silent stream for first playback to DP
    - RDMA/core: Do not indicate device ready when device enablement fails
    - RDMA/uverbs: Fix incorrect variable type
    - [arm64,armhf] clk: tegra: Fix duplicated SE clock entry
    - [armhf] mtd: rawnand: gpmi: fix reference count leak in gpmi ops
    - [armhf] mtd: rawnand: gpmi: Fix the random DMA timeout issue
    - samples/bpf: Fix possible hang in xdpsock with multiple threads
    - fs: Handle I_DONTCACHE in iput_final() instead of generic_drop_inode()
    - mac80211: don't set set TDLS STA bandwidth wider than possible
    - mac80211: fix a mistake check for rx_stats update
    - [arm64] irqchip/alpine-msi: Fix freeing of interrupts on allocation
      error path
    - [arm64] RDMA/hns: Limit the length of data copied between kernel and
      userspace
    - [arm64] RDMA/hns: Normalization the judgment of some features
    - [arm64] RDMA/hns: Do shift on traffic class when using RoCEv2
    - gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask
    - ath11k: Fix incorrect tlvs in scan start command
    - watchdog: Fix potential dereferencing of null pointer
    - sunrpc: fix xs_read_xdr_buf for partial pages receive
    - RDMA/mlx5: Fix MR cache memory leak
    - RDMA/cma: Don't overwrite sgid_attr after device is released
    - [powerpc*] perf: Fix Threshold Event Counter Multiplier width for P10
    - [powerpc*] ps3: use dma_mapping_error()
    - mm/gup: reorganize internal_get_user_pages_fast()
    - mm/gup: prevent gup_fast from racing with COW during fork
    - mm/gup: combine put_compound_head() and unpin_user_page()
    - mm: memcg/slab: fix return of child memcg objcg for root memcg
    - mm: memcg/slab: fix use after free in obj_cgroup_charge
    - mm/rmap: always do TTU_IGNORE_ACCESS
    - [sparc64] fix handling of page table constructor failure
    - mm/vmalloc: Fix unlock order in s_stop()
    - mm/vmalloc.c: fix kasan shadow poisoning size
    - mm,memory_failure: always pin the page in madvise_inject_error
    - hugetlb: fix an error code in hugetlb_reserve_pages()
    - mm: don't wake kswapd prematurely when watermark boosting is disabled
    - proc: fix lookup in /proc/net subdirectories after setns(2)
    - lan743x: fix rx_napi_poll/interrupt ping-pong
    - ice, xsk: clear the status bits for the next_to_use descriptor
    - i40e, xsk: clear the status bits for the next_to_use descriptor
    - [arm64] dpaa2-eth: fix the size of the mapped SGT buffer
    - [arm64] net: bcmgenet: Fix a resource leak in an error handling path in
      the probe functin
    - [armhf] net: allwinner: Fix some resources leak in the error handling
      path of the probe and in the remove function
    - NFS/pNFS: Fix a typo in ff_layout_resend_pnfs_read()
    - devlink: use _BITUL() macro instead of BIT() in the UAPI header
    - libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
    - [powerpc*] 32s: Fix cleanup_cpu_mmu_context() compile bug
    - [arm64] watchdog: qcom: Avoid context switch in restart handler
    - [armhf] clk: ti: Fix memleak in ti_fapll_synth_setup
    - [armhf] pwm: imx27: Fix overflow for bigger periods
    - [arm64,armhf] pwm: sun4i: Remove erroneous else branch
    - io_uring: cancel only requests of current task
    - perf record: Fix memory leak when using '--user-regs=?' to list
      registers
    - qlcnic: Fix error code in probe
    - nfp: move indirect block cleanup to flower app stop callback
    - virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed()
    - virtio_net: Fix error code in probe()
    - virtio_ring: Fix two use after free bugs
    - vhost scsi: fix error return code in vhost_scsi_set_endpoint()
    - epoll: check for events when removing a timed out thread from the wait
      queue
    - [arm*] clk: bcm: dvp: Add MODULE_DEVICE_TABLE()
    - [armhf] clk: s2mps11: Fix a resource leak in error handling paths in the
      probe function
    - [arm64,armhf] clk: sunxi-ng: Make sure divider tables have sentinel
    - [powerpc*] smp: Add __init to init_big_cores()
    - [armel,armhf] 9044/1: vfp: use undef hook for VFP support detection
    - [armel,armhf] 9036/1: uncompress: Fix dbgadtb size parameter name
    - perf probe: Fix memory leak when synthesizing SDT probes
    - io_uring: fix racy IOPOLL flush overflow
    - io_uring: cancel reqs shouldn't kill overflow list
    - proc mountinfo: make splice available again
    - io_uring: fix io_cqring_events()'s noflush
    - io_uring: fix racy IOPOLL completions
    - io_uring: always let io_iopoll_complete() complete polled io
    - vfio/pci: Move dummy_resources_list init in vfio_pci_probe()
    - media: gspca: Fix memory leak in probe
    - io_uring: fix io_wqe->work_list corruption
    - io_uring: fix 0-iov read buffer select
    - io_uring: hold uring_lock while completing failed polled io in
      io_wq_submit_work()
    - io_uring: fix ignoring xa_store errors
    - io_uring: fix double io_uring free
    - io_uring: make ctx cancel on exit targeted to actual ctx
    - [armhf] media: sunxi-cir: ensure IR is handled when it is continuous
    - media: netup_unidvb: Don't leak SPI master in probe error path
    - [x86] Input: cyapa_gen6 - fix out-of-bounds stack access
    - ALSA: hda/ca0132 - Change Input Source enum strings.
    - [amd64,arm64] ACPI: NFIT: Fix input validation of bus-family
    - PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
    - Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources
      walks"
    - ACPI: PNP: compare the string length in the matching_id()
    - ALSA: hda: Fix regressions on clear and reconfig sysfs
    - ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg.
    - ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop
    - ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
    - ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
    - ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button
    - ALSA: pcm: oss: Fix a few more UBSAN fixes
    - ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G
    - ALSA: hda/realtek: Add quirk for MSI-GP73
    - ALSA: hda/realtek: Apply jack fixup for Quanta NL3
    - ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658
    - ALSA: hda/realtek - Supported Dell fixed type headset
    - ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO
      devices
    - ALSA: usb-audio: Disable sample read check if firmware doesn't give back
    - ALSA: usb-audio: Add alias entry for ASUS PRIME TRX40 PRO-S
    - ALSA: core: memalloc: add page alignment for iram
    - [s390x] smp: perform initial CPU reset also for SMT siblings
    - [s390x] idle: add missing mt_cycles calculation
    - [s390x] idle: fix accounting with machine checks
    - [s390x] dasd: fix hanging device offline processing
    - [s390x] dasd: prevent inconsistent LCU device data
    - [s390x] dasd: fix list corruption of pavgroup group list
    - [s390x] dasd: fix list corruption of lcu list
    - binder: add flag to clear buffer on txn complete
    - [x86] ASoC: cx2072x: Fix doubly definitions of Playback and Capture
      streams
    - [amd64] ASoC: AMD Renoir - add DMI table to avoid the ACP mic probe
      (broken BIOS)
    - [amd64] ASoC: AMD Raven/Renoir - fix the PCI probe (PCI revision)
    - [x86] staging: comedi: mf6x4: Fix AI end-of-conversion detection
    - z3fold: simplify freeing slots
    - z3fold: stricter locking and more careful reclaim
    - [x86] perf/x86/intel: Add event constraint for
      CYCLE_ACTIVITY.STALLS_MEM_ANY
    - [x86] perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake
    - [x86] perf/x86/intel/lbr: Fix the return type of get_lbr_cycles()
    - [powerpc*] perf: Exclude kernel samples while counting events in user
      space.
    - [x86] cpufreq: intel_pstate: Use most recent guaranteed performance
      values
    - crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
    - [x86] EDAC/amd64: Fix PCI component registration
    - cpuset: fix race between hotplug work and later CPU offline
    - dyndbg: fix use before null check
    - USB: serial: mos7720: fix parallel-port state restore
    - USB: serial: digi_acceleport: fix write-wakeup deadlocks
    - USB: serial: keyspan_pda: fix dropped unthrottle interrupts
    - USB: serial: keyspan_pda: fix write deadlock
    - USB: serial: keyspan_pda: fix stalled writes
    - USB: serial: keyspan_pda: fix write-wakeup use-after-free
    - USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
    - USB: serial: keyspan_pda: fix write unthrottling
    - btrfs: do not shorten unpin len for caching block groups
    - btrfs: update last_byte_to_unpin in switch_commit_roots
    - btrfs: fix race when defragmenting leads to unnecessary IO
    - ext4: fix an IS_ERR() vs NULL check
    - ext4: fix a memory leak of ext4_free_data
    - ext4: fix deadlock with fs freezing and EA inodes
    - ext4: don't remount read-only with errors=continue on reboot
    - [riscv64] Fix usage of memblock_enforce_memory_limit
    - [arm64] KVM: Introduce handling of AArch32 TTBCR2 traps
    - [x86] KVM: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits
    - [x86] KVM: SVM: Remove the call to sev_platform_status() during setup
    - [arm64,armhf] iommu/arm-smmu: Allow implementation specific write_s2cr
    - [arm64,armhf] iommu/arm-smmu-qcom: Read back stream mappings
    - [arm64,armhf] iommu/arm-smmu-qcom: Implement S2CR quirk
    - [armhf] dts: pandaboard: fix pinmux for gpio user button of Pandaboard
      ES
    - xprtrdma: Fix XDRBUF_SPARSE_PAGES support
    - [powerpc*] 32: Fix vmap stack - Properly set r1 before activating MMU on
      syscall too
    - [powerpc*] Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
    - [powerpc*] rtas: Fix typo of ibm,open-errinjct in RTAS filter
    - [powerpc*] bitops: Fix possible undefined behaviour with fls() and
      fls64()
    - [powerpc*] feature: Add CPU_FTR_NOEXECUTE to G2_LE
    - [powerpc*] xmon: Change printk() to pr_cont()
    - [powerpc*] 8xx: Fix early debug when SMC1 is relocated
    - [powerpc*] mm: Fix verification of MMU_FTR_TYPE_44x
    - [powerpc*] powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU
    - [powerpc*] powernv/memtrace: Don't leak kernel memory to user space
    - [powerpc*] powernv/memtrace: Fix crashing the kernel when enabling
      concurrently
    - ovl: make ioctl() safe
    - ceph: fix race in concurrent __ceph_remove_cap invocations
    - SMB3: avoid confusing warning message on mount to Azure
    - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot
      rsp
    - SMB3.1.1: do not log warning message if server doesn't populate salt
    - ubifs: wbuf: Don't leak kernel memory to flash
    - jffs2: Fix GC exit abnormally
    - jffs2: Fix ignoring mounting options problem during remounting
    - fsnotify: generalize handle_inode_event()
    - inotify: convert to handle_inode_event() interface
    - fsnotify: fix events reported to watching parent and child
    - jfs: Fix array index bounds check in dbAdjTree (CVE-2020-27815)
    - [arm64,armhf] drm/panfrost: Fix job timeout handling
    - [arm64,armhf] drm/panfrost: Move the GPU reset bits outside the timeout
      handler
    - [x86] platform/x86: mlx-platform: remove an unused variable
    - drm/dp_aux_dev: check aux_dev before use in
      drm_dp_aux_dev_get_by_minor()
    - [x86] drm/i915: Fix mismatch between misplaced vma check and vma insert
    - iio: ad_sigma_delta: Don't put SPI transfer buffer on the stack
    - [arm64,armhf] spi: pxa2xx: Fix use-after-free on unbind
    - [armhf] spi: gpio: Don't leak SPI master in probe error path
    - [armel] mtd: parser: cmdline: Fix parsing of part-names with colons
    - mtd: core: Fix refcounting for unpartitioned MTDs
    - scsi: qla2xxx: Fix crash during driver load on big endian machines
    - scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
    - scsi: lpfc: Fix scheduling call while in softirq context in
      lpfc_unreg_rpi
    - scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
    - openat2: reject RESOLVE_BENEATH|RESOLVE_IN_ROOT
    - iio: buffer: Fix demux update
    - iio: imu: st_lsm6dsx: fix edge-trigger interrupts
    - iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
    - iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
    - iio:magnetometer:mag3110: Fix alignment and data leak issues.
    - iio:pressure:mpl3115: Force alignment of buffer
    - iio:imu:bmi160: Fix too large a buffer.
    - iio:imu:bmi160: Fix alignment and data leak issues
    - md/cluster: block reshape with remote resync job
    - md/cluster: fix deadlock when node is doing resync job
    - [arm64,armhf] pinctrl: sunxi: Always call chained_irq_{enter, exit} in
      sunxi_pinctrl_irq_handler
    - [arm64] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
    - [arm64,armhf] clk: tegra: Do not return 0 on failure
    - device-dax/core: Fix memory leak when rmmod dax.ko
    - dma-buf/dma-resv: Respect num_fences when initializing the shared fence
      list.
    - driver: core: Fix list corruption after device_del()
    - libnvdimm/namespace: Fix reaping of invalidated block-window-namespace
      labels
    - [x86] platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha
      12
    - tracing: Disable ftrace selftests when any tracer is running
    - mt76: add back the SUPPORTS_REORDERING_BUFFER flag
    - PCI: Fix pci_slot_release() NULL pointer dereference
    - [arm64,armhf] regulator: axp20x: Fix DLDO2 voltage control register mask
      for AXP22x
    - [arm*] thermal/drivers/cpufreq_cooling: Update cpufreq_state only if
      state has changed
    - null_blk: Fix zone size initialization
    - null_blk: Fail zone append to conventional zones
    - drm/edid: fix objtool warning in drm_cvt_modes()
    - [x86] CPU/AMD: Save AMD NodeId as cpu_die_id

  [ Uwe Kleine-König ]
  * [armhf] Enable VIDEO_CODA and VIDEO_IMX_PXP for i.MX6 platforms

  [ Vincent Blut ]
  * [x86] Enable SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES. (Closes: #976791)

  [ Salvatore Bonaccorso ]
  * [rt] Drop "z3fold: simplify freeing slots"
  * [rt] Drop "z3fold: stricter locking and more careful reclaim"
  * [rt] Refresh "sched: Move mmdrop to RCU on RT"
  * Set ABI to 1

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 31 Dec 2020 07:26:43 +0100

linux (5.10.2-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.2
    - ptrace: Prevent kernel-infoleak in ptrace_get_syscall_info()
    - USB: legotower: fix logical error in recent commit
    - USB: add RESET_RESUME quirk for Snapscan 1212
    - ALSA: usb-audio: Fix potential out-of-bounds shift
    - ALSA: usb-audio: Fix control 'access overflow' errors from chmap
    - xhci: Give USB2 ports time to enter U3 in bus suspend
    - usb: xhci: Set quirk for XHCI_SG_TRB_CACHE_SIZE_QUIRK
    - xhci-pci: Allow host runtime PM as default for Intel Alpine Ridge LP
    - xhci-pci: Allow host runtime PM as default for Intel Maple Ridge xHCI
    - USB: UAS: introduce a quirk to set no_write_same
    - ALSA: pcm: oss: Fix potential out-of-bounds shift

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.10.1-rt20
  * Revert "Generate BTF debug info" (fixes FTBFS on 32bit architectures)
    (Reopen: #973870) (Cf. #977715)
  * Enable USB_DUMMY_HCD as module (Closes: #868771)

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 22 Dec 2020 22:22:59 +0100

linux (5.10.1-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.10
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.1

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.10-rt17

  [ Ben Hutchings ]
  * userns: Enable unprivileged user namespaces by default (Closes: #898446)
    (sysctl: kernel.unprivileged_userns_clone)

  [ Bastian Blank ]
  * Enable all Industrial I/O accelerometers. (closes: #975572)
  * Enable all Industrial I/O ADC.
  * Enable all Industrial I/O DAC.
  * Enable all Industrial I/O digital gyroscopes.
  * Enable all Industrial I/O IMU.
  * Enable all Industrial I/O light sensors.
  * Enable all Industrial I/O magnetometers.
  * Enable all Industrial I/O pressure sensors.
  * Enable all Industrial I/O proximity sensors.
  * Enable all Industrial I/O temperatur sensors.
  * Enable BT_LEDS.
  * Enable remaining LEDS_TRIGGER_*.
  * Enable ZONEFS_FS.
  * Gemerate BTF debug info: (closes: #973870)
    - Enable DEBUG_INFO_BTF.
    - Build-depend on dwarves.
  * [amd64] Support high CPU counts:
    - Set MAXSMP.
    - Remove not longer modifiable NR_CPUS.
  * [armel/marvell] Disable uncompressed size check.
  * [x86] Enable INTEL_TXT. (closes: #960195)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 17 Dec 2020 10:06:31 +0100

linux (5.10~rc7-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Vincent Blut ]
  * net/sched: Enable NET_SCH_ETS and NET_SCH_FQ_PIE as modules.

  [ Bastian Blank ]
  * Enable SOUNDWIRE, SOUNDWIRE_INTEL, SOUNDWIRE_QCOM.
  * Enable SND_SOC_RT700_SDW, SND_SOC_RT711_SDW, SND_SOC_RT715_SDW.
    (closes: #976791)
  * [x86] Enable SND_SOC_SOF_INTEL_SOUNDWIRE_LINK.
  * [x86] Enable SND_SOC_SOF_COMETLAKE_LP_SUPPORT,
    SND_SOC_SOF_ELKHARTLAKE_SUPPORT, SND_SOC_SOF_JASPERLAKE_SUPPORT.
  * [cloud] Disable some further filesystems. (closes: #977005)
  * [cloud] Disable NET_VENDOR_MICROCHIP.
  * [cloud] Disable ICE, IGC.
  * [amd64] Make GVE module.
  * [x86] Enable X86_CPU_RESCTRL.
  * [amd64/cloud] Disable INFINIBAND_USNIC.
  * Enable PSTORE_BLK.
  * Set SQUASHFS_FILE_DIRECT, SQUASHFS_DECOMP_MULTI_PERCPU.
  * Disable EFI_VARS.
  * [x86] Enable APPLE_PROPERTIES.
  * Enable CRYPTO_ECRDSA, CRYPTO_CURVE25519, disable CRYPTO_SM2.
  * Enable CRYPTO_CFB, CRYPTO_OFB, CRYPTO_KEYWRAP, CRYPTO_ADIANTUM.
  * Enable CRYPTO_BLAKE2S, disable CRYPTO_SM3.
  * Enable CRYPTO_AES_TI, disable CRYPTO_SM4.
  * Enable CRYPTO_DRBG_HASH, CRYPTO_DRBG_CTR.
  * Enable SND_SOC_MAX98373_SDW, SND_SOC_RT1308_SDW, SND_SOC_RT5682_SDW.
  * Enable SND_SOC_INTEL_SOUNDWIRE_SOF_MACH.
  * Enable ATH11K. (closes: #977004)
  * [arm64] Enable most accelerated crypto modules. (closes: #976635)
  * [s390x] Disable IIO.
  * Enable BLK_CGROUP_IOCOST.
  * Enable CGROUP_HUGETLB.

  [ Ben Hutchings ]
  * Fix missing module.lds for building out-of-tree modules (Closes: #975571)
    - debian/rules.real: Install module.lds under arch directory
    - kbuild: Look for module.lds under arch directory too

 -- Bastian Blank <waldi@debian.org>  Fri, 11 Dec 2020 11:16:29 +0100

linux (5.10~rc6-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Romain Perier ]
  * Enable F2FS compression support (Closes: #969139)

  [ Uwe Kleine-König ]
  * [arm64] Enable support for Kontron's sl28cpld Board Management Controller
  * [arm64] Enable support for NXP's PCF85063 RTC (Closes: #972345)

  [ Salvatore Bonaccorso ]
  * udeb: Remove efivars from efi-modules.
  * [rt] Update to 5.10-rc6-rt13

  [ Aurelien Jarno ]
  * [mips*] Increase RELOCATION_TABLE_SIZE to 0x180000.

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 03 Dec 2020 15:42:50 +0100

linux (5.10~rc4-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Uwe Kleine-König ]
  * enable support for ISO 15765-2:2016 CAN (CAN_ISOTP)

  [ YunQiang Su ]
  * [mips/loongson-3]: enable some new features for 3A 4000
    - VIRTUALIZATION/KVM
    - HOTPLUG_PCI
    - RTC based on GOLDFISH
    - ieee754 to relaxed mode

  [ Madhu Adav M J ]
  * nvme: Enable NVME_TCP and NVME_TARGET_TCP as modules (Closes: #961573)

  [ Ben Hutchings ]
  * Rewrite "MODSIGN: load blacklist from MOKx" for 5.10
  * Revert "lockdown: Refer to Debian wiki until manual page exists";
    the page was added in man-pages 5.09

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.10-rc4-rt8
  * linux-cpupower: Add librt to turbostat linker flags

  [ Nicolas Dandrimont ]
  * udeb: add bonding driver to nic-modules

 -- Ben Hutchings <benh@debian.org>  Thu, 19 Nov 2020 12:58:26 +0000

linux (5.9.15-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.12
    - io_uring: get an active ref_node from files_data
    - io_uring: order refnode recycling
    - [arm*] spi: bcm2835: Fix use-after-free on unbind
    - ipv4: use IS_ENABLED instead of ifdef
    - [amd64] IB/hfi1: Ensure correct mm is used at all times (CVE-2020-27835)
    - RDMA/i40iw: Address an mmap handler exploit in i40iw
    - btrfs: fix missing delalloc new bit for new delalloc ranges
    - btrfs: tree-checker: add missing return after error in root_item
    - btrfs: tree-checker: add missing returns after data_ref alignment checks
    - btrfs: don't access possibly stale fs_info data for printing duplicate
      device
    - btrfs: fix lockdep splat when reading qgroup config on mount
    - [arm64] rtc: pcf2127: fix a bug when not specify interrupts property
    - [s390x] fix fpu restore in entry.S
    - mm: fix VM_BUG_ON(PageTail) and BUG_ON(PageWriteback)
    - smb3: Call cifs reconnect from demultiplex thread
    - smb3: Avoid Mid pending list corruption
    - smb3: Handle error case during offload read path
    - cifs: fix a memleak with modefromsid
    - [powerpc*] KVM: PPC: Book3S HV: XIVE: Fix possible oops when accessing
      ESB page
    - [arm64] KVM: vgic-v3: Drop the reporting of GICR_TYPER.Last for
      userspace
    - [x86] KVM: x86: handle !lapic_in_kernel case in kvm_cpu_*_extint
    - [x86] KVM: x86: Fix split-irqchip vs interrupt injection window request
    - [amd64] iommu/vt-d: Don't read VCCAP register unless it exists
    - [arm64] firmware: xilinx: Use hash-table for api feature check
    - drm/amdgpu: fix SI UVD firmware validate resume fail
    - io_uring: fix ITER_BVEC check
    - trace: fix potenial dangerous pointer
    - [arm64] pgtable: Fix pte_accessible()
    - [arm64] pgtable: Ensure dirty bit is preserved across pte_wrprotect()
    - drm/amdgpu: fix a page fault
    - drm/amdgpu: update golden setting for sienna_cichlid
    - drm/amd/amdgpu: fix null pointer in runtime pm
    - HID: uclogic: Add ID for Trust Flex Design Tablet
    - HID: ite: Replace ABS_MISC 120/121 events with touchpad on/off
      keypresses
    - HID: cypress: Support Varmilo Keyboards' media hotkeys
    - HID: add support for Sega Saturn
    - Input: i8042 - allow insmod to succeed on devices without an i8042
      controller
    - HID: hid-sensor-hub: Fix issue with devices with no report ID
    - HID: add HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE for Gamevice devices
    - [x86] xen: don't unbind uninitialized lock_kicker_irq
    - HID: logitech-hidpp: Add HIDPP_CONSUMER_VENDOR_KEYS quirk for the Dinovo
      Edge
    - HID: Add Logitech Dinovo Edge battery quirk
    - proc: don't allow async path resolution of /proc/self components
    - nvme: free sq/cq dbbuf pointers when dbbuf set fails
    - io_uring: handle -EOPNOTSUPP on path resolution
    - [arm64,armhf] net: stmmac: dwmac_lib: enlarge dma reset timeout
    - vhost: add helper to check if a vq has been setup
    - vhost scsi: alloc cmds per vq instead of session
    - vhost scsi: fix cmd completion race
    - [arm64,armhf] dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size
    - scsi: libiscsi: Fix NOP race condition
    - scsi: target: iscsi: Fix cmd abort fabric stop race
    - lockdep: Put graph lock/unlock under lock_recursion protection
    - [x86] perf/x86: fix sysfs type mismatches
    - [x86] dumpstack: Do not try to access user space code of other tasks
    - [arm64,armhf] net: dsa: mv88e6xxx: Wait for EEPROM done after HW reset
    - [armhf] bus: ti-sysc: Fix reset status check for modules with quirks
    - [armhf] bus: ti-sysc: Fix bogus resetdone warning on enable for cpsw
    - [arm64,armhf] phy: tegra: xusb: Fix dangling pointer on probe failure
    - iwlwifi: mvm: use the HOT_SPOT_CMD to cancel an AUX ROC
    - iwlwifi: mvm: properly cancel a session protection for P2P
    - iwlwifi: mvm: write queue_sync_state only for sync
    - [s390x] KVM: pv: Mark mm as protected after the set secure parameters
      and improve cleanup
    - [s390x] KVM: remove diag318 reset code
    - btrfs: qgroup: don't commit transaction when we already hold the handle
    - arch: pgtable: define MAX_POSSIBLE_PHYSMEM_BITS where needed
    - [armhf] bus: ti-sysc: suppress err msg for timers used as
      clockevent/source
    - scsi: ufs: Fix race between shutdown and runtime resume flow
    - bnxt_en: fix error return code in bnxt_init_one()
    - bnxt_en: fix error return code in bnxt_init_board()
    - [x86] video: hyperv_fb: Fix the cache type when mapping the VRAM
    - bnxt_en: Release PCI regions when DMA mask setup fails during probe.
    - cxgb4: fix the panic caused by non smac rewrite
    - [s390x] qeth: make af_iucv TX notification call more robust
    - [s390x] qeth: fix af_iucv notification race
    - [s390x] qeth: fix tear down of async TX buffers
    - bonding: wait for sysfs kobject destruction before freeing struct slave
    - [powerpc*] 64s: Fix allnoconfig build since uaccess flush
    - iommu: Check return of __iommu_attach_device()
    - IB/mthca: fix return value of error branch in mthca_init_cq()
    - i40e: Fix removing driver while bare-metal VFs pass traffic
    - [arm64] firmware: xilinx: Fix SD DLL node reset issue
    - [armhf] spi: imx: fix the unbalanced spi runtime pm management
    - io_uring: fix shift-out-of-bounds when round up cq size
    - [amd64,arm64] aquantia: Remove the build_skb path
    - net: ena: handle bad request id in ena_netdev
    - net: ena: set initial DMA width to avoid intel iommu issue
    - net: ena: fix packet's addresses for rx_offset feature
    - [arm64] optee: add writeback to valid memory type
    - efi/efivars: Set generic ops before loading SSDT
    - efivarfs: revert "fix memory leak in efivarfs_create()"
      (Closes:  #977048)
    - efi: EFI_EARLYCON should depend on EFI
    - [riscv64] Add missing jump label initialization
    - [riscv64] fix barrier() use in <vdso/processor.h>
    - [arm64,armhf] net: stmmac: fix incorrect merge of patch upstream
    - [arm64] enetc: Let the hardware auto-advance the taprio base-time of 0
    - drm/nouveau: fix relocations applying logic and a double-free
    - can: gs_usb: fix endianess problem with candleLight firmware
    - [x86] platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup
      time
    - [x86] platform/x86: toshiba_acpi: Fix the wrong variable assignment
    - [arm64] RDMA/hns: Fix retry_cnt and rnr_cnt when querying QP
    - [arm64] RDMA/hns: Bugfix for memory window mtpt configuration
    - perf record: Synthesize cgroup events only if needed
    - perf stat: Use proper cpu for shadow stats
    - perf probe: Fix to die_entrypc() returns error correctly
    - [arm*] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe
    - USB: core: Change %pK for __user pointers to %px
    - usb: gadget: f_midi: Fix memleak in f_midi_alloc
    - USB: core: Fix regression in Hercules audio card
    - USB: quirks: Add USB_QUIRK_DISCONNECT_SUSPEND quirk for Lenovo A630Z TIO
      built-in usb-audio card
    - usb: gadget: Fix memleak in gadgetfs_fill_super
    - [arm64] irqchip/exiu: Fix the index of fwspec for IRQ type
    - [x86] mce: Do not overwrite no_way_out if mce_end() fails
    - [x86] speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb
    - drm/amdgpu: add rlc iram and dram firmware support
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.13
    - devlink: Hold rtnl lock while reading netdev attributes
    - devlink: Make sure devlink instance and port are in same net namespace
    - ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init
    - [s390x] net/af_iucv: set correct sk_protocol for child sockets
    - net: openvswitch: fix TTL decrement action netlink message format
    - rose: Fix Null pointer dereference in rose_send_frame()
    - sock: set sk_err to ee_errno on dequeue from errq
    - tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control
    - tun: honor IOCB_NOWAIT flag
    - vsock/virtio: discard packets only when socket is really closed
    - net/packet: fix packet receive on L3 devices without visible hard header
    - netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING
      traversal
    - ipv4: Fix tos mask in inet_rtm_getroute()
    - dt-bindings: net: correct interrupt flags in examples
    - tipc: fix incompatible mtu of transmission
    - inet_ecn: Fix endianness of checksum update when setting ECT(1)
    - geneve: pull IP header before ECN decapsulation
    - net: ip6_gre: set dev->hard_header_len when using header_ops
    - cxgb3: fix error return code in t3_sge_alloc_qset()
    - [powerpc*] net: pasemi: fix error return code in pasemi_mac_open()
    - vxlan: fix error return code in __vxlan_dev_create()
    - [arm64,armhf] net: mvpp2: Fix error return code in mvpp2_open()
    - net: skbuff: ensure LSE is pullable before decrementing the MPLS ttl
    - net: openvswitch: ensure LSE is pullable before reading it
    - net/mlx5: DR, Proper handling of unsupported Connect-X6DX SW steering
    - net/mlx5: Fix wrong address reclaim when command interface is down
    - net: mlx5e: fix fs_tcp.c build when IPV6 is not enabled
    - ALSA: usb-audio: US16x08: fix value count for level meters
    - Input: xpad - support Ardwiino Controllers
    - Input: i8042 - add ByteSpeed touchpad to noloop table
    - Input: atmel_mxt_ts - fix lost interrupts
    - tracing: Fix alignment of static buffer
    - tracing: Remove WARN_ON in start_thread()
    - uapi: fix statx attribute value overlap for DAX & MOUNT_ROOT
    - [x86] drm/i915/gt: Fixup tgl mocs for PTE tracking
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.14
    - usb: gadget: f_fs: Use local copy of descriptors for userspace copy
    - USB: serial: kl5kusb105: fix memleak on open
    - USB: serial: ch341: add new Product ID for CH341A
    - USB: serial: ch341: sort device-id entries
    - USB: serial: option: add Fibocom NL668 variants
    - USB: serial: option: add support for Thales Cinterion EXS82
    - USB: serial: option: fix Quectel BG96 matching
    - tty: Fix ->pgrp locking in tiocspgrp() (CVE-2020-29661)
    - tty: Fix ->session locking (CVE-2020-29660)
    - speakup: Reject setting the speakup line discipline outside of speakup
      (CVE-2020-27830)
    - ALSA: hda/realtek: Fix bass speaker DAC assignment on Asus Zephyrus G14
    - ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model
    - ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294
    - ALSA: hda/realtek - Add new codec supported for ALC897
    - ALSA: hda/realtek - Fixed Dell AIO wrong sound tone
    - ALSA: hda/generic: Add option to enforce preferred_dacs pairs
    - ring-buffer: Update write stamp with the correct ts
    - ring-buffer: Set the right timestamp in the slow path of
      __rb_reserve_next()
    - ring-buffer: Always check to put back before stamp when crossing pages
    - ftrace: Fix updating FTRACE_FL_TRAMP
    - ftrace: Fix DYNAMIC_FTRACE_WITH_DIRECT_CALLS dependency
    - cifs: allow syscalls to be restarted in __smb_send_rqst()
    - cifs: fix potential use-after-free in cifs_echo_request()
    - cifs: refactor create_sd_buf() and and avoid corrupting the buffer
    - cifs: add NULL check for ses->tcon_ipc
    - gfs2: Upgrade shared glocks for atime updates
    - gfs2: Fix deadlock between gfs2_{create_inode,inode_lookup} and
      delete_work_func
    - [s390x] pci: fix CPU address in MSI for directed IRQ
    - [arm64,armhf] i2c: imx: Fix reset of I2SR_IAL flag
    - [arm64,armhf] i2c: imx: Check for I2SR_IAL after every byte
    - [arm64,armhf] i2c: imx: Don't generate STOP condition if arbitration has
      been lost
    - tracing: Fix userstacktrace option for instances
    - [x86] thunderbolt: Fix use-after-free in remove_unplugged_switch()
    - [armhf] drm/omap: sdi: fix bridge enable/disable
    - drm/amdgpu/vcn3.0: stall DPG when WPTR/RPTR reset
    - drm/amdgpu/vcn3.0: remove old DPG workaround
    - [x86] drm/i915/gt: Retain default context state across shrinking
    - [x86] drm/i915/gt: Limit frequency drop to RPe on parking
    - [x86] drm/i915/gt: Program mocs:63 for cache eviction on gen9
    - [powerpc*] KVM: PPC: Book3S HV: XIVE: Fix vCPU id sanity check
    - scsi: mpt3sas: Fix ioctl timeout
    - io_uring: fix recvmsg setup with compat buf-select
    - dm writecache: advance the number of arguments when reporting max_age
    - dm writecache: fix the maximum number of arguments
    - [powerpc*] 64s/powernv: Fix memory corruption when saving SLB entries on
      MCE
    - genirq/irqdomain: Add an irq_create_mapping_affinity() function
    - [powerpc*] pseries: Pass MSI affinity to irq_create_mapping()
    - dm: fix bug with RCU locking in dm_blk_report_zones
    - dm: fix double RCU unlock in dm_dax_zero_page_range() error path
    - dm: remove invalid sparse __acquires and __releases annotations
    - [x86] uprobes: Do not use prefixes.nbytes when looping over
      prefixes.bytes
    - coredump: fix core_pattern parse error
    - mm: list_lru: set shrinker map bit when child nr_items is not zero
    - mm/swapfile: do not sleep with a spin lock held
    - hugetlb_cgroup: fix offline of hugetlb cgroup with reservations
    - Revert "amd/amdgpu: Disable VCN DPG mode for Picasso"
    - iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
    - mm: memcg/slab: fix obj_cgroup_charge() return value handling
    - lib/syscall: fix syscall registers retrieval on 32-bit platforms
      (CVE-2020-28588)
    - can: af_can: can_rx_unregister(): remove WARN() statement from list
      operation sanity check
    - gfs2: check for empty rgrp tree in gfs2_ri_update
    - netfilter: ipset: prevent uninit-value in hash_ip6_add
    - tipc: fix a deadlock when flushing scheduled work
    - gfs2: Fix deadlock dumping resource group glocks
    - gfs2: Don't freeze the file system during unmount
    - rtw88: debug: Fix uninitialized memory in debugfs code
    - [arm64] i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc()
    - dm writecache: remove BUG() and fail gracefully instead
    - Input: i8042 - fix error return code in i8042_setup_aux()
    - netfilter: nf_tables: avoid false-postive lockdep splat
    - netfilter: nftables_offload: set address type in control dissector
    - netfilter: nftables_offload: build mask based from the matching bytes
    - [x86] insn-eval: Use new for_each_insn_prefix() macro to loop over
      prefixes bytes
    - Revert "geneve: pull IP header before ECN decapsulation"
    - bpf: Fix propagation of 32-bit signed bounds from 64-bit bounds.
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.15
    - mm/zsmalloc.c: drop ZSMALLOC_PGTABLE_MAPPING
    - kprobes: Remove NMI context check
    - kprobes: Tell lockdep about kprobe nesting
    - [x86] ASoC: Intel: bytcr_rt5640: Fix HP Pavilion x2 Detachable quirks
    - net, xsk: Avoid taking multiple skbuff references
    - bpftool: Fix error return value in build_btf_type_table
    - [powerpc*] 64s: Fix hash ISA v3.0 TLBIEL instruction generation
    - batman-adv: Consider fragmentation for needed_headroom
    - batman-adv: Reserve needed_*room for fragments
    - batman-adv: Don't always reallocate the fragmentation skb head
    - ipvs: fix possible memory leak in ip_vs_control_net_init
    - [armhf] drm/panel: sony-acx565akm: Fix race condition in probe
    - can: sja1000: sja1000_err(): don't count arbitration lose as an error
    - [armhf] can: sun4i_can: sun4i_can_err(): don't count arbitration lose as
      an error
    - [armhf] can: c_can: c_can_power_up(): fix error handling
    - [x86] scsi: storvsc: Fix error return in storvsc_probe()
    - iwlwifi: pcie: invert values of NO_160 device config entries
    - [x86] perf/x86/intel: Fix a warning on x86_pmu_stop() with large PEBS
    - [x390x] zlib: export S390 symbols for zlib modules
    - mm/mmap.c: fix mmap return value when vma is merged after call_mmap()
    - [arm64] dts: rockchip: Remove system-power-controller from pmic on
      Odroid Go Advance
    - iwlwifi: pcie: limit memory read spin time
    - iwlwifi: sta: set max HE max A-MPDU according to HE capa
    - iwlwifi: pcie: set LTR to avoid completion timeout
    - iwlwifi: mvm: fix kernel panic in case of assert during CSA
    - [powerpc*] Drop -me200 addition to build flags
    - scsi: ufs: Fix unexpected values from ufshcd_read_desc_param()
    - scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE
    - [arm64,armhf] irqchip/gic-v3-its: Unconditionally save/restore the ITS
      state on suspend
    - [arm64] spi: spi-nxp-fspi: fix fspi panic by unexpected interrupts
    - [arm64,armhf] arm-smmu-qcom: Ensure the qcom_scm driver has finished
      probing
    - btrfs: do nofs allocations when adding and removing qgroup relations
    - btrfs: fix lockdep splat when enabling and disabling qgroups
    - [arm64] soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)
    - sched/idle: Fix arch_cpu_idle() vs tracing
    - [x86] intel_idle: Fix intel_idle() vs tracing
    - [x86] platform/x86: thinkpad_acpi: add P1 gen3 second fan support
    - [x86] platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga
      11e
    - [x86] platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for
      Thinkpad Yoga 11e 4th gen
    - [x86] platform/x86: thinkpad_acpi: Whitelist P15 firmware for dual fan
      control
    - [x86] platform/x86: acer-wmi: add automatic keyboard background light
      toggle key as KEY_LIGHTS_TOGGLE
    - [x86] platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion
      13 x360 PC
    - [s390x] fix irq state tracing
    - [x86] intel_idle: Build fix
    - media: pulse8-cec: fix duplicate free at disconnect or probe error
    - media: pulse8-cec: add support for FW v10 and up
    - xen: add helpers for caching grant mapping pages
    - xen: don't use page->lru for ZONE_DEVICE memory
    - Input: cm109 - do not stomp on control URB
    - Input: i8042 - add Acer laptops to the i8042 reset list
    - pinctrl: amd: remove debounce filter setting in IRQ type setting
    - [arm64] mmc: sdhci-of-arasan: Fix clock registration error for Keem Bay
      SOC
    - mmc: block: Fixup condition for CMD13 polling for RPMB requests
    - [x86] drm/i915/gem: Propagate error from cancelled submit due to context
      closure
    - [x86] drm/i915/display/dp: Compute the correct slice count for VDSC on
      DP
    - [x86] drm/i915/gt: Declare gen9 has 64 mocs entries!
    - [x86] drm/i915/gt: Ignore repeated attempts to suspend request flow
      across reset
    - [x86] drm/i915/gt: Cancel the preemption timeout on responding to it
    - drm/amdgpu: fix sdma instance fw version and feature version init
    - kbuild: avoid static_assert for genksyms
    - proc: use untagged_addr() for pagemap_read addresses
    - mm/hugetlb: clear compound_nr before freeing gigantic pages
    - scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"
    - [x86] membarrier: Get rid of a dubious optimization
    - [x86] apic/vector: Fix ordering in vector assignment
    - [x86] kprobes: Fix optprobe to detect INT3 padding correctly

  [ Salvatore Bonaccorso ]
  * [x86] drm/i915: Update TGL and RKL DMC firmware versions (Closes: #974646)
  * [rt] Refresh "mm/zsmalloc: copy with get_cpu_var() and locking"
  * xen/xenbus: Allow watches discard events before queueing (CVE-2020-29568,
    XSA-349)
  * xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
    (CVE-2020-29568, XSA-349)
  * xen/xenbus/xen_bus_type: Support will_handle watch callback
    (CVE-2020-29568, XSA-349)
  * xen/xenbus: Count pending messages for each watch (CVE-2020-29568,
    XSA-349)
  * xenbus/xenbus_backend: Disallow pending watch messages (CVE-2020-29568,
    XSA-349)
  * xen-blkback: set ring->xenblkd to NULL after kthread_stop()
    (CVE-2020-29569, XSA-350)
  * Bump ABI to 5

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 17 Dec 2020 06:31:52 +0100

linux (5.9.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.10
    - [powerpc*] 64s: flush L1D on kernel entry (CVE-2020-4788)
    - [powerpc*] 64s: flush L1D after user accesses (CVE-2020-4788)
    - [powerpc*] Only include kup-radix.h for 64-bit Book3S
    - Input: sunkbd - avoid use-after-free in teardown paths (CVE-2020-25669)
    - mac80211: always wind down STA state
    - can: proc: can_remove_proc(): silence remove_proc_entry warning
    - [powerpc*] smp: Call rcu_cpu_starting() earlier
    - [x86] perf/x86/intel/uncore: Fix Add BW copypasta
    - [x86] KVM: clflushopt should be treated as a no-op by emulation
    - [arm64,x86] ACPI: GED: fix -Wformat
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.11
    - ah6: fix error return code in ah6_input()
    - atm: nicstar: Unmap DMA on send error
    - bnxt_en: read EEPROM A2h address using page 0
    - devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()
    - [arm64] enetc: Workaround for MDIO register access issue
    - Exempt multicast addresses from five-second neighbor lifetime
    - inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
    - ipv6: Fix error path to cancel the meseage
    - lan743x: fix issue causing intermittent kernel log warnings
    - lan743x: prevent entire kernel HANG on open, for some platforms
    - net: b44: fix error return code in b44_init_one()
    - net: bridge: add missing counters to ndo_get_stats64 callback
    - [arm64,armhf] net: dsa: mv88e6xxx: Avoid VTU corruption on 6097
    - [armhf] net: ethernet: ti: cpsw: fix cpts irq after suspend
    - [armhf] net: ethernet: ti: cpsw: fix error return code in cpsw_probe()
    - [armhf] net: ftgmac100: Fix crash when removing driver
    - net: Have netpoll bring-up DSA management interface
    - netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
    - netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
    - net/mlx4_core: Fix init_hca fields offset
    - [armhf] net/ncsi: Fix netlink registration
    - net: phy: mscc: remove non-MACSec compatible phy
    - net/smc: fix direct access to ib_gid_addr->ndev in
      smc_ib_determine_gid()
    - [arm64,armhf] net: stmmac: Use rtnl_lock/unlock on
      netif_set_real_num_rx_queues() call
    - page_frag: Recover from memory pressure
    - qed: fix error return code in qed_iwarp_ll2_start()
    - qed: fix ILT configuration of SRC block
    - qlcnic: fix error return code in qlcnic_83xx_restart_hw()
    - sctp: change to hold/put transport for proto_unreach_timer
    - tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
    - vsock: forward all packets to the host when no H2G is registered
    - net/mlx5e: Fix check if netdev is bond slave
    - net/mlx5: Add handling of port type in rule deletion
    - net/mlx5: Clear bw_share upon VF disable
    - net/mlx5: Disable QoS when min_rates on all VFs are zero
    - PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter
    - [armhf] net: fec: Fix reference count leak in fec series ops
    - bnxt_en: Fix counter overflow logic.
    - bnxt_en: Free port stats during firmware reset.
    - [arm64,armhf] net: mvneta: fix possible memory leak in
      mvneta_swbm_add_rx_fragment
    - net: usb: qmi_wwan: Set DTR quirk for MR400
    - [armhf] Revert "Revert "gpio: omap: Fix lost edge wake-up interrupts""
    - tools, bpftool: Avoid array index warnings.
    - [arm64,armhf] pinctrl: rockchip: enable gpio pclk for
      rockchip_gpio_to_irq
    - scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold()
    - scsi: ufs: Try to save power mode change and UIC cmd completion timeout
    - [armhf] pinctrl: mcp23s08: Print error message when regmap init fails
    - [x86] ACPI: button: Add DMI quirk for Medion Akoya E2228T
    - [arm64] errata: Fix handling of 1418040 with late CPU onlining
    - [arm64] psci: Avoid printing in cpu_psci_cpu_die()
    - [arm64] smp: Tell RCU about CPUs that fail to come online
    - vfs: remove lockdep bogosity in __sb_start_write
    - gfs2: fix possible reference leak in gfs2_check_blk_type
    - [arm64,armhf] hwmon: (pwm-fan) Fix RPM calculation
    - gfs2: Fix case in which ail writes are done to jdata holes
    - [arm64] Add MIDR value for KRYO2XX gold/silver CPU cores
    - [arm64] kpti: Add KRYO2XX gold/silver CPU cores to kpti safelist
    - [arm64] cpu_errata: Apply Erratum 845719 to KRYO2XX Silver
    - [arm64,armhf] usb: dwc2: Avoid leaving the error_debugfs label unused
    - [arm64] dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay
    - [arm64] dts: allwinner: Pine H64: Enable both RGMII RX/TX delay
    - [arm64] dts: allwinner: a64: OrangePi Win: Fix ethernet node
    - [arm64] dts: allwinner: a64: Pine64 Plus: Fix ethernet node
    - [arm64] dts: allwinner: h5: OrangePi PC2: Fix ethernet node
    - [armhf] dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node
    - [armhf] Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to
      active high"
    - [armhf] dts: sun6i: a31-hummingbird: Enable RGMII RX/TX delay on
      Ethernet PHY
    - [armhf] dts: sun7i: cubietruck: Enable RGMII RX/TX delay on Ethernet PHY
    - [armhf] dts: sun7i: bananapi-m1-plus: Enable RGMII RX/TX delay on
      Ethernet PHY
    - [armhf] dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on
      Ethernet PHY
    - [armhf] dts: sun9i: Enable both RGMII RX/TX delay on Ethernet PHY
    - [arm64] dts: allwinner: h5: libretech-all-h5-cc: Enable RGMII RX/TX
      delay on PHY
    - [arm64] dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on
      PHY
    - [mips64el,mipsel] export has_transparent_hugepage() for modules
    - [arm64] dts: allwinner: h5: OrangePi Prime: Fix ethernet node
    - [armhf] dts: imx6q-prti6q: fix PHY address
    - swiotlb: using SIZE_MAX needs limits.h included
    - [armhf] dmaengine: ti: omap-dma: Block PM if SDMA is busy to fix audio
    - rcu: Don't invoke try_invoke_on_locked_down_task() with irqs disabled
    - spi: fix client driver breakages when using GPIO descriptors
    - Input: elan_i2c - fix firmware update on newer ICs
    - rfkill: Fix use-after-free in rfkill_resume()
    - perf lock: Correct field name "flags"
    - perf lock: Don't free "lock_seq_stat" if read_count isn't zero
    - SUNRPC: Fix oops in the rpc_xdr_buf event class
    - [arm64,armhf] drm: bridge: dw-hdmi: Avoid resetting force in the detect
      function
    - tools, bpftool: Add missing close before bpftool net attach exit
    - [amd64] IB/hfi1: Fix error return code in hfi1_init_dd()
    - ip_tunnels: Set tunnel option flag when tunnel metadata is present
    - can: af_can: prevent potential access of uninitialized member in
      can_rcv()
    - can: af_can: prevent potential access of uninitialized member in
      canfd_rcv()
    - can: dev: can_restart(): post buffer from the right context
    - can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to
      can_put_echo_skb()
    - can: peak_usb: fix potential integer overflow on shift of a int
    - [armhf] can: flexcan: fix failure handling of pm_runtime_get_sync()
    - [arm64] ASoC: qcom: lpass-platform: Fix memory leak
    - [arm64,armhf] drm/sun4i: dw-hdmi: fix error return code in
      sun8i_dw_hdmi_bind()
    - net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled
    - bpf, sockmap: Fix partial copy_page_to_iter so progress can still be
      made
    - bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect
    - can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits
    - dmaengine: fix error codes in channel_register()
    - [amd64] iommu/vt-d: Move intel_iommu_gfx_mapped to Intel IOMMU header
    - [amd64] iommu/vt-d: Avoid panic if iommu init fails in tboot system
    - [armhf] can: flexcan: flexcan_chip_start(): fix erroneous
      flexcan_transceiver_enable() during bus-off recovery
    - xfs: ensure inobt record walks always make forward progress
    - xfs: return corresponding errcode if xfs_initialize_perag() fail
    - [x86] ASOC: Intel: kbl_rt5663_rt5514_max98927: Do not try to disable
      disabled clock
    - [armhf] regulator: ti-abb: Fix array out of bound read access on the
      first transition
    - lib/strncpy_from_user.c: Mask out bytes after NUL terminator.
    - xfs: revert "xfs: fix rmap key and record comparison functions"
    - bpf, sockmap: Skb verdict SK_PASS to self already checked rmem limits
    - bpf, sockmap: On receive programs try to fast track SK_PASS ingress
    - bpf, sockmap: Use truesize with sk_rmem_schedule()
    - bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to self
    - [armhf] efi/arm: set HSCTLR Thumb2 bit correctly for HVC calls from HYP
    - [amd64] efi/x86: Free efi_pgd with free_pages()
    - sched/fair: Fix overutilized update in enqueue_task_fair()
    - sched: Fix data-race in wakeup
    - sched: Fix rq->nr_iowait ordering
    - libfs: fix error cast of negative value in simple_attr_write()
    - afs: Fix speculative status fetch going out of order wrt to
      modifications
    - HID: logitech-hidpp: Add PID for MX Anywhere 2
    - HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin
      trackpad
    - HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver
    - speakup: Do not let the line discipline be used several times
      (CVE-2020-28941)
    - ALSA: firewire: Clean up a locking issue in copy_resp_to_buf()
    - ALSA: usb-audio: Add delay quirk for all Logitech USB devices
    - ALSA: ctl: fix error path at adding user-defined element set
    - ALSA: mixart: Fix mutex deadlock
    - ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button
    - ALSA: hda/realtek - Add supported mute Led for HP
    - ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220)
    - ALSA: hda/realtek - HP Headset Mic can't detect after boot
    - [armhf] tty: serial: imx: fix potential deadlock
    - [armhf] tty: serial: imx: keep console clocks always on
    - HID: logitech-dj: Fix an error in mse_bluetooth_descriptor
    - [arm64,armhf,x86] efivarfs: fix memory leak in efivarfs_create()
    - [arm64,x86] staging: rtl8723bs: Add 024c:0627 to the list of SDIO
      device-ids
    - xfs: fix forkoff miscalculation related to XFS_LITINO(mp)
    - [arm64,x86] ACPI: fan: Initialize performance state sysfs attribute
    - [x86] iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type
      enum
    - [x86] iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for
      setting tablet-mode
    - [arm64] iio: cros_ec: Use default frequencies when EC returns invalid
      information
    - spi: Introduce device-managed SPI controller allocation
    - [arm64,armhf] spi: bcm2835aux: Fix use-after-free on unbind
    - [armhf] regulator: pfuze100: limit pfuze-support-disable-sw to
      pfuze{100,200}
    - regulator: fix memory leak with repeated set_machine_constraints()
    - regulator: avoid resolve_supply() infinite recursion
    - regulator: workaround self-referent regulators
    - gfs2: Fix regression in freeze_go_sync
    - mac80211: minstrel: remove deferred sampling code
    - mac80211: minstrel: fix tx status processing corner case
    - mac80211: free sta in sta_info_insert_finish() on errors
    - [s390x] fix system call exit path
    - [s390x] cpum_sf.c: fix file permission for cpum_sfb_size
    - [s390x] dasd: fix null pointer dereference for ERP requests
    - [x86] Drivers: hv: vmbus: Allow cleanup of VMBUS_CONNECT_CPU if
      disconnected
    - [x86] drm/i915: Handle max_bpc==16
    - [x86] drm/i915/tgl: Fix Media power gate sequence.
    - io_uring: don't double complete failed reissue request
    - mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based
      Intel controllers
    - [arm64] mmc: sdhci-of-arasan: Allow configuring zero tap values
    - [arm64] mmc: sdhci-of-arasan: Use Mask writes for Tap delays
    - [arm64] mmc: sdhci-of-arasan: Issue DLL reset explicitly
    - blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats
    - ptrace: Set PF_SUPERPRIV when checking capability
    - seccomp: Set PF_SUPERPRIV when checking capability
    - fanotify: fix logic of reporting name info with watched parent
    - [x86] microcode/intel: Check patch signature before saving microcode for
      early loading
    - mm: never attempt async page lock if we've transferred data already
    - mm: fix readahead_page_batch for retry entries
    - mm: memcg/slab: fix root memcg vmstats
    - mm/userfaultfd: do not access vma->vm_mm after calling
      handle_userfault()

  [ Ben Hutchings ]
  * [arm64][rt] Disable KVM, which currently conflicts with PREEMPT_RT

  [ Yves-Alexis Perez ]
  * usbnet: ipheth: fix connectivity with iOS 14

  [ Salvatore Bonaccorso ]
  * Bump ABI to 4

  [ Julien Cristau ]
  * Disable NOUVEAU_LEGACY_CTX_SUPPORT, which was keeping DRM_LEGACY enabled
    for no good reason (closes: #975038)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 27 Nov 2020 22:02:14 +0100

linux (5.9.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.7
    - net: core: use list_del_init() instead of list_del() in
      netdev_run_todo()
    - tipc: fix use-after-free in tipc_bcast_get_mode
    - [x86] drm/i915/gem: Avoid implicit vmap for highmem on x86-32
    - [x86] drm/i915/gem: Prevent using pgprot_writecombine() if PAT is not
      supported
    - [x86] drm/i915/gem: Always test execution status on closing the context
    - [x86] drm/i915/gt: Always send a pulse down the engine after disabling
      heartbeat
    - [x86] drm/i915: Break up error capture compression loops with
      cond_resched()
    - [x86] drm/i915: Cancel outstanding work after disabling heartbeats on an
      engine
    - [x86] drm/i915: Avoid mixing integer types during batch copies
    - [x86] drm/i915: Fix TGL DKL PHY DP vswing handling
    - [x86] drm/i915/gt: Initialize reserved and unspecified MOCS indices
    - [x86] drm/i915/gt: Undo forced context restores after trivial
      preemptions
    - [x86] drm/i915/gt: Delay execlist processing for tgl
    - [x86] drm/i915: Drop runtime-pm assert from vgpu io accessors
    - [x86] drm/i915: Exclude low pages (128KiB) of stolen from use
    - [x86] drm/i915: Mark ininitial fb obj as WT on eLLC machines to avoid
      rcu lockup during fbdev init
    - [x86] drm/i915: Use the active reference on the vma while capturing
    - [x86] drm/i915: Reject 90/270 degree rotated initial fbs
    - [x86] drm/i915: Restore ILK-M RPS support
    - drm/nouveau/kms/nv50-: Program notifier offset before requesting disp
      caps
    - drm/nouveau/device: fix changing endianess code to work on older GPUs
    - ptrace: fix task_join_group_stop() for the case when current is traced
    - [arm64,riscv64] cadence: force nonlinear buffers to be cloned
    - ip_tunnel: fix over-mtu packet send fail without TUNNEL_DONT_FRAGMENT
      flags
    - [armhf] net: ethernet: ti: cpsw: disable PTPv1 hw timestamping
      advertisement
    - net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition
    - sctp: Fix COMM_LOST/CANT_STR_ASSOC err reporting on big-endian platforms
    - [arm64,armhf,riscv64] sfp: Fix error handing in sfp_probe()
    - ip6_tunnel: set inner ipproto before ip6_tnl_encap
    - [armhf] net: fec: fix MDIO probing for some FEC hardware blocks
    - net: openvswitch: silence suspicious RCU usage warning
    - r8169: work around short packet hw bug on RTL8125
    - drm/nouveau/kms/nv50-: Get rid of bogus nouveau_conn_mode_valid()
    - drm/nouveau/kms/nv50-: Fix clock checking algorithm in
      nv50_dp_mode_valid()
    - Fonts: Replace discarded const qualifier
    - ALSA: hda/realtek - Fixed HP headset Mic can't be detected
    - ALSA: hda/realtek - Enable headphone for ASUS TM420
    - ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2
    - ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices
    - ALSA: usb-audio: Add implicit feedback quirk for Qu-16
    - ALSA: usb-audio: Add implicit feedback quirk for MODX
    - hugetlb_cgroup: fix reservation accounting
    - mm: mempolicy: fix potential pte_unmap_unlock pte error
    - kthread_worker: prevent queuing delayed work from timer_fn when it is
      being canceled
    - mm: always have io_remap_pfn_range() set pgprot_decrypted()
    - gfs2: Wake up when sd_glock_disposal becomes zero
    - gfs2: Don't call cancel_delayed_work_sync from within delete work
      function
    - ring-buffer: Fix recursion protection transitions between interrupt
      context
    - drm/amdgpu: update golden setting for sienna_cichlid
    - drm/amdgpu: resolved ASD loading issue on sienna
    - [amd64] iommu/vt-d: Fix kernel NULL pointer dereference in find_domain()
    - mtd: spi-nor: Don't copy self-pointing struct around
    - ftrace: Fix recursion check for NMI test
    - ftrace: Handle tracing when switching between context
    - regulator: defer probe when trying to get voltage from unresolved supply
    - [arm*] spi: bcm2835: fix gpio cs level inversion
    - tracing: Fix out of bounds write in get_trace_buf
    - futex: Handle transient "ownerless" rtmutex state correctly
    - [amd64] x86/lib: Change .weak to SYM_FUNC_START_WEAK for
      arch/x86/lib/mem*_64.S
    - [x86] kexec: Use up-to-dated screen_info copy to fill boot params
    - [x86] hyperv_fb: Update screen_info after removing old framebuffer
    - io_uring: don't miss setting IO_WQ_WORK_CONCURRENT
    - of: Fix reserved-memory overlap detection
    - [arm64,armhf] drm/sun4i: frontend: Rework a bit the phase data
    - [arm64,armhf] drm/sun4i: frontend: Reuse the ch0 phase for RGB formats
    - [arm64,armhf] drm/sun4i: frontend: Fix the scaler phase on A33
    - blk-cgroup: Fix memleak on error path
    - blk-cgroup: Pre-allocate tree node on blkg_conf_prep
    - btrfs: drop the path before adding qgroup items when enabling qgroups
    - btrfs: add a helper to read the tree_root commit root for backref lookup
    - scsi: core: Don't start concurrent async scan on same host
    - drm/amdgpu: disable DCN and VCN for navi10 blockchain SKU(v3)
    - drm/amdgpu: add DID for navi10 blockchain SKU
    - [powerpc*] scsi: ibmvscsi: Fix potential race after loss of transport
    - vsock: use ns_capable_noaudit() on socket create
    - nvme-rdma: handle unexpected nvme completion data length
    - nvmet: fix a NULL pointer dereference when tracing the flush command
    - [arm*] staging: mmal-vchiq: Fix memory leak for vchiq_instance
    - [arm*] drm/vc4: drv: Add error handding for bind
    - [amd64,arm64] ACPI: NFIT: Fix comparison to '-ENXIO'
    - drm/nouveau/gem: fix "refcount_t: underflow; use-after-free"
    - [arm64] smp: Move rcu_cpu_starting() earlier
    - vt: Disable KD_FONT_OP_COPY
    - tty: fix crash in release_tty if tty->port is not set
    - fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
    - entry: Fix the incorrect ordering of lockdep and RCU check
    - [s390x] pci: fix hot-plug of PCI function missing bus
    - [s390x] mm: make pmd/pud_deref() large page aware
    - [s390x] pkey: fix paes selftest failure with paes and pkey static build
    - USB: serial: cyberjack: fix write-URB completion race
    - USB: serial: option: add Quectel EC200T module support
    - USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231
    - USB: serial: option: add Telit FN980 composition 0x1055
    - [arm64,armhf] usb: dwc3: ep0: Fix delay status handling
    - USB: Add NO_LPM quirk for Kingston flash drive
    - io_uring: fix link lookup racing with link timeout
    - mac80211: fix regression where EAPOL frames were sent in plaintext
    - [arm64,armhf] drm/panfrost: Fix a deadlock between the shrinker and
      madvise path
    - PM: runtime: Drop runtime PM references to supplier on link removal
    - PM: runtime: Drop pm_runtime_clean_up_links()
    - PM: runtime: Resume the device earlier in __device_release_driver()
    - [x86] drm/i915: Fix encoder lookup during PSR atomic check
    - [x86] drm/i915/gt: Use the local HWSP offset during submission
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.8
    - [x86] powercap: restrict energy meter to root access (CVE-2020-8694)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.9
    - [x86] drm/i915: Hold onto an explicit ref to i915_vma_work.pinned
    - [x86] drm/i915/gem: Flush coherency domains on first set-domain-ioctl
    - mm: memcg: link page counters to root if use_hierarchy is false
    - nbd: don't update block size after device is started
    - [arm64] KVM: Force PTE mapping on fault resulting in a device mapping
    - xfrm: interface: fix the priorities for ipip and ipv6 tunnels
    - [x86] ASoC: Intel: kbl_rt5663_max98927: Fix kabylake_ssp_fixup function
    - [x86] hv_balloon: disable warning when floor reached
    - net: xfrm: fix a race condition during allocing spi
    - [riscv64] irqchip/sifive-plic: Fix broken irq_set_affinity() callback
    - mtd: spi-nor: Fix address width on flash chips > 16MB
    - xfs: set xefi_discard when creating a deferred agfl free log intent item
    - mac80211: don't require VHT elements for HE on 2.4 GHz
    - netfilter: nftables: fix netlink report logic in flowtable and genid
    - netfilter: use actual socket sk rather than skb sk when routing harder
    - netfilter: nf_tables: missing validation from the abort path
    - PCI: Always enable ACS even if no ACS Capability
    - netfilter: ipset: Update byte and packet counters regardless of whether
      they match
    - [riscv64] irqchip/sifive-plic: Fix chip_data access within a hierarchy
    - [powerpc*] eeh_cache: Fix a possible debugfs deadlock
    - [arm*] drm/vc4: bo: Add a managed action to cleanup the cache
    - IB/srpt: Fix memory leak in srpt_add_one
    - mm: memcontrol: correct the NR_ANON_THPS counter of hierarchical memcg
    - [arm64,armhf] drm/panfrost: rename error labels in device_init
    - [arm64,armhf] drm/panfrost: move devfreq_init()/fini() in device
    - [arm64,armhf] drm/panfrost: Fix module unload
    - perf trace: Fix segfault when trying to trace events by cgroup
    - perf tools: Add missing swap for ino_generation
    - perf tools: Add missing swap for cgroup events
    - [x86] ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
    - [amd64] iommu/vt-d: Fix sid not set issue in intel_svm_bind_gpasid()
    - [amd64] iommu/vt-d: Fix a bug for PDP check in prq_event_thread
    - afs: Fix warning due to unadvanced marshalling pointer
    - afs: Fix incorrect freeing of the ACL passed to the YFS ACL store op
    - vfio/pci: Implement ioeventfd thread handler for contended memory lock
    - can: rx-offload: don't call kfree_skb() from IRQ context
    - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ
      context
    - can: dev: __can_get_echo_skb(): fix real payload length return value for
      RTR frames
    - can: can_create_echo_skb(): fix echo skb generation: always use
      skb_clone()
    - can: j1939: swap addr and pgn in the send example
    - can: j1939: j1939_sk_bind(): return failure if netdev is down
    - can: peak_usb: add range checking in decode operations
    - can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
    - can: peak_canfd: pucan_handle_can_rx(): fix echo management when
      loopback is on
    - [armhf] can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for
      LS1021A
    - [armhf] can: flexcan: flexcan_remove(): disable wakeup completely
    - xfs: flush new eof page on truncate to avoid post-eof corruption
    - xfs: fix missing CoW blocks writeback conversion retry
    - xfs: fix scrub flagging rtinherit even if there is no rt device
    - io_uring: ensure consistent view of original task ->mm from SQPOLL
    - [arm64] spi: fsl-dspi: fix wrong pointer in suspend/resume
    - [armel,armhf] PCI: mvebu: Fix duplicate resource requests
    - ceph: check session state after bumping session->s_seq
    - [x86] speculation: Allow IBPB to be conditionally enabled on CPUs with
      always-on STIBP
    - USB: apple-mfi-fastcharge: fix reference leak in
      apple_mfi_fc_set_property
    - [arm64,x86] tpm: efi: Don't create binary_bios_measurements file for an
      empty log
    - [arm64] KVM: ARM_SMCCC_ARCH_WORKAROUND_1 doesn't return
      SMCCC_RET_NOT_REQUIRED
    - ath9k_htc: Use appropriate rs_datalen type
    - scsi: ufs: Fix missing brace warning for old compilers
    - [arm64] usb: dwc3: pci: add support for the Intel Alder Lake-S
    - opp: Reduce the size of critical section in _opp_table_kref_release()
    - usb: raw-gadget: fix memory leak in gadget_setup
    - ALSA: hda: Separate runtime and system suspend
    - ALSA: hda: Reinstate runtime_allow() for all hda controllers
    - [amd64] x86/boot/compressed/64: Introduce sev_status
    - gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
    - gfs2: Add missing truncate_inode_pages_final for sd_aspace
    - gfs2: check for live vs. read-only file system in gfs2_fitrim
    - scsi: hpsa: Fix memory leak in hpsa_init_one()
    - drm/amdgpu: perform srbm soft reset always on SDMA resume
    - mac80211: fix use of skb payload instead of header
    - cfg80211: initialize wdev data earlier
    - cfg80211: regulatory: Fix inconsistent format argument
    - tracing: Fix the checking of stackidx in __ftrace_trace_stack
    - Revert "nvme-pci: remove last_sq_tail"
    - scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
    - scsi: mpt3sas: Fix timeouts observed while reenabling IRQ
    - nvme: introduce nvme_sync_io_queues
    - nvme-rdma: avoid race between time out and tear down
    - nvme-rdma: avoid repeated request completion
    - [amd64] iommu/amd: Increase interrupt remapping table limit to 512
      entries
    - [s390x] smp: move rcu_cpu_starting() earlier
    - vfio/pci: Bypass IGD init in case of -ENODEV
    - amd/amdgpu: Disable VCN DPG mode for Picasso
    - iomap: clean up writeback state logic on writepage error
    - [riscv64] Set text_offset correctly for M-Mode
    - tpm_tis: Disable interrupts on ThinkPad T490s
    - [arm*] spi: bcm2835: remove use of uninitialized gpio flags variable
    - [x86] pinctrl: intel: Fix 2 kOhm bias which is 833 Ohm
    - [x86] pinctrl: intel: Set default bias in case no particular value given
    - [armhf] gpio: aspeed: fix ast2600 bank properties
    - [armel,armhf] 9019/1: kprobes: Avoid fortify_panic() when copying
      optprobe template
    - bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE
    - libbpf, hashmap: Fix undefined behavior in hash_bits
    - [armhf] pinctrl: mcp23s08: Use full chunk of memory for regmap
      configuration
    - [armhf] pinctrl: aspeed: Fix GPI only function problem.
    - net/mlx5e: Fix modify header actions memory leak
    - net/mlx5e: Protect encap route dev from concurrent release
    - net/mlx5e: Use spin_lock_bh for async_icosq_lock
    - net/mlx5: Fix deletion of duplicate rules
    - net/mlx5: E-switch, Avoid extack error log for disabled vport
    - net/mlx5e: Fix VXLAN synchronization after function reload
    - net/mlx5e: Fix incorrect access of RCU-protected xdp_prog
    - SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow()
    - NFSD: Fix use-after-free warning when doing inter-server copy
    - NFSD: fix missing refcount in nfsd4_copy by nfsd4_do_async_copy
    - tools/bpftool: Fix attaching flow dissector
    - bpf: Zero-fill re-used per-cpu map element
    - r8169: fix potential skb double free in an error path
    - r8169: disable hw csum for short packets on all chip versions
    - [arm64] pinctrl: qcom: Move clearing pending IRQ to
      .irq_request_resources callback
    - nbd: fix a block_device refcount leak in nbd_release
    - i40e: Fix MAC address setting for a VF via Host/VM
    - igc: Fix returning wrong statistics (Closes: #970722)
    - lan743x: correctly handle chips with internal PHY
    - net: phy: realtek: support paged operations on RTL8201CP
    - xfs: fix flags argument to rmap lookup when converting shared file rmaps
    - xfs: set the unwritten bit in rmap lookup flags in
      xchk_bmap_get_rmapextents
    - xfs: fix rmap key and record comparison functions
    - xfs: fix brainos in the refcount scrubber's rmap fragment processor
    - lan743x: fix "BUG: invalid wait context" when setting rx mode
    - xfs: fix a missing unlock on error in xfs_fs_map_blocks
    - of/address: Fix of_node memory leak in of_dma_is_coherent
    - ch_ktls: Update cheksum information
    - ch_ktls: tcb update fails sometimes
    - [i386] cosa: Add missing kfree in error path of cosa_write
    - hwmon: (applesmc) Re-work SMC comms
    - NFS: Fix listxattr receive buffer size
    - vrf: Fix fast path output packet handling with async Netfilter rules
    - lan743x: fix use of uninitialized variable
    - [arm64] mm: Validate hotplug range before creating linear mapping
    - kernel/watchdog: fix watchdog_allowed_mask not used warning
    - mm: memcontrol: fix missing wakeup polling thread
    - afs: Fix afs_write_end() when called with copied == 0 [ver #3]
    - perf: Fix get_recursion_context()
    - nvme: factor out a nvme_configure_metadata helper
    - nvme: freeze the queue over ->lba_shift updates
    - nvme: fix incorrect behavior when BLKROSET is called by the user
    - perf: Simplify group_sched_in()
    - perf: Fix event multiplexing for exclusive groups
    - [arm64] firmware: xilinx: fix out-of-bounds access
    - erofs: fix setting up pcluster for temporary pages
    - erofs: derive atime instead of leaving it empty
    - ext4: correctly report "not supported" for {usr,grp}jquota when
      !CONFIG_QUOTA
    - ext4: unlock xattr_sem properly in ext4_inline_data_truncate()
    - btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch
    - btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod
    - btrfs: fix min reserved size calculation in merge_reloc_root
    - btrfs: dev-replace: fail mount if we don't have replace item with target
      device
    - [arm64] KVM: Don't hide ID registers from userspace
    - [x86] thunderbolt: Fix memory leak if ida_simple_get() fails in
      enumerate_services()
    - [x86] thunderbolt: Add the missed ida_simple_remove() in
      ring_request_msix()
    - block: add a return value to set_capacity_revalidate_and_notify
    - loop: Fix occasional uevent drop
    - uio: Fix use-after-free in uio_unregister_device()
    - Revert "usb: musb: convert to devm_platform_ioremap_resource_byname"
    - usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode
    - [x86] usb: typec: ucsi: Report power supply changes
    - virtio: virtio_console: fix DMA memory allocation for rproc serial
    - futex: Don't enable IRQs unconditionally in put_pi_state()
    - jbd2: fix up sparse warnings in checkpoint code
    - bootconfig: Extend the magic check range to the preceding 3 bytes
    - mm/compaction: count pages and stop correctly during page isolation
    - mm/compaction: stop isolation if too many pages are isolated and we have
      pages to migrate
    - mm/slub: fix panic in slab_alloc_node()
    - mm/vmscan: fix NR_ISOLATED_FILE corruption on 64-bit
    - mm/gup: use unpin_user_pages() in __gup_longterm_locked()
    - Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint"
    - reboot: fix overflow parsing reboot cpu number
    - hugetlbfs: fix anon huge page migration race
    - ocfs2: initialize ip_next_orphan
    - hwmon: (amd_energy) modify the visibility of the counters
      (CVE-2020-12912)
    - selinux: Fix error return code in sel_ib_pkey_sid_slow()
    - io_uring: round-up cq size before comparing with rounded sq size
    - [riscv64] gpio: sifive: Fix SiFive gpio probe
    - gpio: pcie-idio-24: Fix irq mask when masking
    - gpio: pcie-idio-24: Fix IRQ Enable Register value
    - gpio: pcie-idio-24: Enable PEX8311 interrupts
    - [arm64] mmc: sdhci-of-esdhc: Handle pulse width detection erratum for
      more SoCs
    - don't dump the threads that had been already exiting when zapped.
    - [x86] drm/i915: Correctly set SFC capability for video engines
    - [x86] drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]
    - NFSv4.2: fix failure to unregister shrinker
    - pinctrl: amd: use higher precision for 512 RtcClk
    - pinctrl: amd: fix incorrect way to disable debounce filter
    - swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"
    - cpufreq: Introduce governor flags
    - cpufreq: Introduce CPUFREQ_GOV_STRICT_TARGET
    - cpufreq: Add strict_target to struct cpufreq_policy
    - cpufreq: intel_pstate: Take CPUFREQ_GOV_STRICT_TARGET into account
    - ethtool: netlink: add missing netdev_features_change() call
    - IPv6: Set SIT tunnel hard_header_len to zero
    - [s390x] net/af_iucv: fix null pointer dereference on shutdown
    - net: udp: fix IP header access and skb lookup on Fast/frag0 UDP GRO
    - net: udp: fix UDP header access on Fast/frag0 UDP GRO
    - net: Update window_clamp if SOCK_RCVBUF is set
    - tipc: fix memory leak in tipc_topsrv_start()
    - devlink: Avoid overwriting port attributes of registered port
    - tunnels: Fix off-by-one in lower MTU bounds for ICMP/ICMPv6 replies
    - [powerpc*] 603: Always fault when _PAGE_ACCESSED is not set
    - null_blk: Fix scheduling in atomic with zoned mode
    - Convert trailing spaces and periods in path components

  [ Uwe Kleine-König ]
  * [amd64] Enable SND_SOC_AMD_ACP3x, SND_SOC_AMD_RENOIR and
    SND_SOC_AMD_RENOIR_MACH (Closes: #973252)
  * [arm64] Add device tree for Kobol helios64 from rockchip next branch.

  [ John L. Villalovos ]
  * [arm64] NUMA: Kconfig: Increase NODES_SHIFT to 4

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "signals: Allow rt tasks to cache one sigqueue struct"
  * [armhf] dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY
    (Closes: #973369)
  * Bump ABI to 3

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 19 Nov 2020 08:19:18 +0100

linux (5.9.6-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.2
    - [powerpc*] ibmveth: Switch order of ibmveth_helper calls.
    - [powerpc*] ibmveth: Identify ingress large send packets.
    - cxgb4: handle 4-tuple PEDIT to NAT mode translation
    - ipv4: Restore flowi4_oif update before call to xfrm_lookup_route
    - mlx4: handle non-napi callers to napi_poll
    - net: dsa: microchip: fix race condition
    - net: fec: Fix phy_device lookup for phy_reset_after_clk_enable()
    - net: fec: Fix PHY init after phy_reset_after_clk_enable()
    - net: fix pos incrementment in ipv6_route_seq_next
    - net: ipa: skip suspend/resume activities if not set up
    - net: sched: Fix suspicious RCU usage while accessing tcf_tunnel_info
    - net/smc: fix use-after-free of delayed events
    - net/smc: fix valid DMBE buffer sizes
    - tipc: fix NULL pointer dereference in tipc_named_rcv
    - tipc: fix the skb_unshare() in tipc_buf_append()
    - socket: fix option SO_TIMESTAMPING_NEW
    - socket: don't clear SOCK_TSTAMP_NEW when SO_TIMESTAMPNS is disabled
    - can: m_can_platform: don't call m_can_class_suspend in runtime suspend
    - can: j1935: j1939_tp_tx_dat_new(): fix missing initialization of skbcnt
    - net: j1939: j1939_session_fresh_new(): fix missing initialization of
      skbcnt
    - binder: fix UAF when releasing todo list (CVE-2020-0423)
    - ALSA: bebob: potential info leak in hwdep_read()
    - ALSA: hda: fix jack detection with Realtek codecs when in D3
    - ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close
    - tipc: re-configure queue limit for broadcast link
    - tipc: fix incorrect setting window for bcast link
    - ibmvnic: save changed mac address to adapter->mac_addr
    - icmp: randomize the global rate limiter
    - net: ftgmac100: Fix Aspeed ast2600 TX hang issue
    - net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device
    - net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling
      ether_setup
    - net: Properly typecast int values to set sk_max_pacing_rate
    - net/sched: act_ct: Fix adding udp port mangle operation
    - net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels
    - netsec: ignore 'phy-mode' device property on ACPI systems
    - nexthop: Fix performance regression in nexthop deletion
    - nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in
      nfc_genl_fw_download()
    - r8169: fix operation under forced interrupt threading
    - tcp: fix to update snd_wl1 in bulk receiver fast path
    - net: ethernet: mtk-star-emac: select REGMAP_MMIO
    - net/sched: act_gate: Unlock ->tcfa_lock in tc_setup_flow_action()
    - ixgbe: fix probing of multi-port devices with one MDIO
    - net: openvswitch: fix to make sure flow_lookup() is not preempted
    - sfc: move initialisation of efx->filter_sem to efx_init_struct()
    - ALSA: hda - Don't register a cb func if it is registered already
    - ALSA: hda - Fix the return value if cb func is already registered
    - ALSA: usb-audio: Line6 Pod Go interface requires static clock rate quirk
    - ALSA: hda/realtek - The front Mic on a HP machine doesn't work
    - ALSA: hda/realtek - set mic to auto detect on a HP AIO machine
    - ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7
    - ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887
    - cifs: remove bogus debug code
    - cifs: Return the error from crypt_message when enc/dec key not found.
    - SMB3: Resolve data corruption of TCP server info fields
    - SMB3.1.1: Fix ids returned in POSIX query dir
    - smb3: do not try to cache root directory if dir leases not supported
    - smb3: fix stat when special device file and mounted with modefromsid
    - [arm64] Make use of ARCH_WORKAROUND_1 even when KVM is not enabled
    - [x86] KVM: nVMX: Morph notification vector IRQ on nested VM-Enter to
      pending PI
    - [x86] KVM: nVMX: Reset the segment cache when stuffing guest segs
    - [x86] KVM: nVMX: Reload vmcs01 if getting vmcs12's pages fails
    - [x86] KVM: x86/mmu: Commit zap of remaining invalid pages when
      recovering lpages
    - [x86] KVM: x86: Intercept LA57 to inject #GP fault when it's reserved
    - [x86] KVM: SVM: Initialize prev_ga_tag before use
    - crypto: caam - add xts check for block length equal to zero
    - crypto: algif_aead - Do not set MAY_BACKLOG on the async path
    - crypto: caam/qi - add fallback for XTS with more than 8B IV
    - crypto: caam/qi - add support for more XTS key lengths
    - crypto: caam/jr - add fallback for XTS with more than 8B IV
    - crypto: caam/jr - add support for more XTS key lengths
    - crypto: caam/qi2 - add fallback for XTS with more than 8B IV
    - crypto: caam/qi2 - add support for more XTS key lengths
    - RAS/CEC: Fix cec_init() prototype
    - sched/fair: Fix wrong negative conversion in find_energy_efficient_cpu()
    - microblaze: fix kbuild redundant file warning
    - [x86] EDAC/i5100: Fix error handling order in i5100_init_one()
    - [x86] perf/x86/intel/ds: Fix x86_pmu_stop warning for large PEBS
    - [x86] x86/fpu: Allow multiple bits in clearcpuid= parameter
    - irqchip/ti-sci-inta: Fix unsigned comparison to zero
    - irqchip/ti-sci-intr: Fix unsigned comparison to zero
    - [arm64] kprobe: add checks for ARMv8.3-PAuth combined instructions
    - seqlock: Unbreak lockdep
    - drivers/perf: xgene_pmu: Fix uninitialized resource struct
    - drivers/perf: thunderx2_pmu: Fix memory resource error handling
    - sched/fair: Fix wrong cpu selecting from isolated domain
    - sched/fair: Use dst group while checking imbalance for NUMA balancer
    - [arm64] perf: Add missing ISB in armv8pmu_enable_counter()
    - [x86] perf/x86/intel/uncore: Update Ice Lake uncore units
    - [x86] perf/x86/intel/uncore: Reduce the number of CBOX counters
    - [x86] perf/x86/intel/uncore: Fix for iio mapping on Skylake Server
    - [x86] perf/x86/intel/uncore: Fix the scale of the IMC free-running
      events
    - [x86] x86/nmi: Fix nmi_handle() duration miscalculation
    - [amd64] x86/events/amd/iommu: Fix sizeof mismatch
    - [arm64] pinctrl: qcom: Set IRQCHIP_SET_TYPE_MASKED and
      IRQCHIP_MASK_ON_SUSPEND flags
    - [arm64] pinctrl: qcom: Use return value from irq_set_wake() call
    - [x86] perf/x86: Fix n_pair for cancelled txn
    - lockdep: Fix usage_traceoverflow
    - lockdep: Fix lockdep recursion
    - lockdep: Revert "lockdep: Use raw_cpu_*() for per-cpu variables"
    - perf/core: Fix race in the perf_mmap_close() function (CVE-2020-14351)
    - crypto: algif_skcipher - EBUSY on aio should be an error
    - crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call
    - crypto: picoxcell - Fix potential race condition bug
    - media: vivid: Fix global-out-of-bounds read in precalculate_color()
    - crypto: ccree - fix runtime PM imbalance on error
    - media: hantro: h264: Get the correct fallback reference buffer
    - media: hantro: postproc: Fix motion vector space allocation
    - media: ov5640: Correct Bit Div register in clock tree diagram
    - media: i2c: fix error check on max9286_read call
    - media: m5mols: Check function pointer in m5mols_sensor_power
    - fscrypt: restrict IV_INO_LBLK_32 to ino_bits <= 32
    - media: uvcvideo: Set media controller entity functions
    - media: uvcvideo: Silence shift-out-of-bounds warning
    - media: staging/intel-ipu3: css: Correctly reset some memory
    - media: omap3isp: Fix memleak in isp_probe
    - media: i2c: ov5640: Remain in power down for DVP mode unless streaming
    - media: i2c: ov5640: Separate out mipi configuration from s_power
    - media: i2c: ov5640: Enable data pins on poweron for DVP mode
    - media: i2c: max9286: Allocate v4l2_async_subdev dynamically
    - crypto: sa2ul - fix compiler warning produced by clang
    - spi: fsi: Handle 9 to 15 byte transfers lengths
    - spi: fsi: Fix use of the bneq+ sequencer instruction
    - spi: fsi: Implement restricted size for certain controllers
    - spi: dw-pci: free previously allocated IRQs if desc->setup() fails
    - crypto: sa2ul - Select CRYPTO_AUTHENC
    - crypto: omap-sham - fix digcnt register handling with export/import
    - crypto: sa2ul - Fix pm_runtime_get_sync() error checking
    - regmap: debugfs: Fix more error path regressions
    - hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61}
    - hwmon: (w83627ehf) Fix a resource leak in probe
    - crypto: stm32/crc32 - Avoid lock if hardware is already used
    - crypto: sun8i-ce - handle endianness of t_common_ctl
    - media: mx2_emmaprp: Fix memleak in emmaprp_probe
    - media: mtk-mdp: Fix Null pointer dereference when calling list_add
    - media: tc358743: initialize variable
    - media: tc358743: cleanup tc358743_cec_isr
    - nvme: fix error handling in nvme_ns_report_zones
    - media: rcar-vin: Fix a reference count leak.
    - media: rockchip/rga: Fix a reference count leak.
    - media: platform: fcp: Fix a reference count leak.
    - media: camss: Fix a reference count leak.
    - media: s5p-mfc: Fix a reference count leak
    - media: stm32-dcmi: Fix a reference count leak
    - media: ti-vpe: Fix a missing check and reference count leak
    - regulator: resolve supply after creating regulator
    - hwmon: (bt1-pvt) Test sensor power supply on probe
    - hwmon: (bt1-pvt) Cache current update timeout
    - hwmon: (bt1-pvt) Wait for the completion with timeout
    - spi: imx: Fix freeing of DMA channels if spi_bitbang_start() fails
    - btrfs: add owner and fs_info to alloc_state io_tree
    - blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue
    - ath10k: provide survey info as accumulated data
    - Bluetooth: hci_uart: Cancel init work before unregistering
    - [arm64,armhf] drm: panel: Fix bus format for OrtusTech COM43H4M85ULC
      panel
    - ath6kl: prevent potential array overflow in ath6kl_add_new_sta()
    - ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb()
    - ath10k: Fix the size used in a 'dma_free_coherent()' call in an error
      handling path
    - wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680
    - [arm64] ASoC: qcom: lpass-platform: fix memory leak
    - [arm64] ASoC: qcom: lpass-cpu: fix concurrency issue
    - ath11k: Fix possible memleak in ath11k_qmi_init_service
    - brcmfmac: check ndev pointer
    - mwifiex: Do not use GFP_KERNEL in atomic context
    - [arm64] drm/malidp: Use struct drm_gem_object_funcs.get_sg_table
      internally
    - staging: rtl8192u: Do not use GFP_KERNEL in atomic context
    - drm/gma500: fix error check
    - scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()'
    - scsi: qla2xxx: Fix the size used in a 'dma_free_coherent()' call
    - scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg()
    - scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba()
    - scsi: csiostor: Fix wrong return value in csio_hw_prep_fw()
    - libbpf: Fix unintentional success return code in bpf_object__load
    - wilc1000: Fix memleak in wilc_sdio_probe
    - wilc1000: Fix memleak in wilc_bus_probe
    - rtw88: don't treat NULL pointer as an array
    - backlight: sky81452-backlight: Fix refcount imbalance on error
    - staging: wfx: fix frame reordering
    - staging: emxx_udc: Fix passing of NULL to dma_alloc_coherent()
    - [x86] VMCI: check return value of get_user_pages_fast() for errors
    - mm/error_inject: Fix allow_error_inject function signatures.
    - drm: panel: Fix bpc for OrtusTech COM43H4M85ULC panel
    - Bluetooth: Clear suspend tasks on unregister
    - scsi: ufs: Make ufshcd_print_trs() consider UFSHCD_QUIRK_PRDT_BYTE_GRAN
    - binder: Remove bogus warning on failed same-process transaction
    - drm/amdgpu: fix max_entries calculation v4
    - soundwire: stream: fix NULL/IS_ERR confusion
    - soundwire: intel: fix NULL/ERR_PTR confusion
    - tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup()
    - pty: do tty_flip_buffer_push without port->lock in pty_write
    - [x86] pwm: lpss: Fix off by one error in base_unit math in
      pwm_lpss_prepare()
    - [x86] pwm: lpss: Add range limit check for the base_unit register value
    - sfc: don't double-down() filters in ef100_reset()
    - ath11k: fix a double free and a memory leak
    - video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value
      error
    - video: fbdev: sis: fix null ptr dereference
    - video: fbdev: radeon: Fix memleak in radeonfb_pci_register
    - HID: roccat: add bounds checking in kone_sysfs_write_settings()
    - ath11k: fix uninitialized return in ath11k_spectral_process_data()
    - drm/msm: Avoid div-by-zero in dpu_crtc_atomic_check()
    - [arm64,armhf] drm/panfrost: Ensure GPU quirks are always initialised
    - iomap: Clear page error before beginning a write
    - iomap: Mark read blocks uptodate in write_begin
    - Bluetooth: Fix memory leak in read_adv_mon_features()
    - Bluetooth: Re-order clearing suspend tasks
    - [armhf] pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser
    - [armhf] pinctrl: mcp23s08: Fix mcp23x17 precious range
    - pinctrl: devicetree: Keep deferring even on timeout
    - [s390x] bpf: Fix multiple tail calls
    - net/mlx5: Fix uninitialized variable warning
    - net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow
    - scsi: mpt3sas: Fix sync irqs
    - [arm64,armhf] net: stmmac: Fix incorrect location to set
      real_num_rx|tx_queues
    - [arm64,armhf] net: stmmac: use netif_tx_start|stop_all_queues() function
    - xfs: force the log after remapping a synchronous-writes file
    - [arm64] cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE
    - ASoC: topology: disable size checks for bytes_ext controls if needed
    - ASoC: tlv320adcx140: Fix digital gain range
    - nvmem: core: fix missing of_node_put() in of_nvmem_device_get()
    - dmaengine: ti: k3-udma-glue: fix channel enable functions
    - Bluetooth: Fix auto-creation of hci_conn at Conn Complete event
    - xhci: don't create endpoint debugfs entry before ring buffer is set.
    - [arm64] drm/msm: Fix the a650 hw_apriv check
    - net: dsa: rtl8366: Check validity of passed VLANs
    - net: dsa: rtl8366: Refactor VLAN/PVID init
    - net: dsa: rtl8366: Skip PVID setting if not requested
    - net: wilc1000: clean up resource in error path of init mon interface
    - ASoC: tlv320aic32x4: Fix bdiv clock rate derivation
    - net: dsa: rtl8366rb: Support all 4096 VLANs
    - ASoC: SOF: control: add size checks for ext_bytes control .put()
    - ASoC: tas2770: Fix unbalanced calls to pm_runtime
    - [armhf] spi: omap2-mcspi: Improve performance waiting for CHSTAT
    - ath11k: Add checked value for ath11k_ahb_remove
    - ath6kl: wmi: prevent a shift wrapping bug in
      ath6kl_wmi_delete_pstream_cmd()
    - drm: rcar-du: Put reference to VSP device
    - phy: rockchip-dphy-rx0: Include linux/delay.h
    - dmaengine: dmatest: Check list for emptiness before access its last
      entry
    - ASoC: cros_ec_codec: fix kconfig dependency warning for
      SND_SOC_CROS_EC_CODEC
    - misc: mic: scif: Fix error handling path
    - ALSA: seq: oss: Avoid mutex lock for a long-time ioctl
    - net/mlx5e: IPsec: Use kvfree() for memory allocated with kvzalloc()
    - [arm*] usb: dwc2: Fix parameter type in function pointer prototype
    - [arm64,armhf] usb: dwc3: core: Properly default unspecified speed
    - [arm*] usb: dwc2: Add missing cleanups when usb_add_gadget_udc() fails
    - rtw88: Fix probe error handling race with firmware loading
    - rtw88: Fix potential probe error handling race with wow firmware loading
    - quota: clear padding in v2r1_mem2diskdqb()
    - [arm*] drm/vc4: crtc: Rework a bit the CRTC state code
    - ASoC: fsl_sai: Instantiate snd_soc_dai_driver
    - HID: hid-input: fix stylus battery reporting
    - tty: hvc: fix link error with CONFIG_SERIAL_CORE_CONSOLE=n
    - tty: serial: imx: fix link error with CONFIG_SERIAL_CORE_CONSOLE=n
    - nvmem: core: fix possibly memleak when use
      nvmem_cell_info_to_nvmem_cell()
    - [x86] hv: clocksource: Add notrace attribute to read_hv_sched_clock_*()
      functions
    - nl80211: fix OBSS PD min and max offset validation
    - iomap: Use kzalloc to allocate iomap_page
    - ibmvnic: set up 200GBPS speed
    - bpf: disallow attaching modify_return tracing functions to other BPF
      programs
    - qtnfmac: fix resource leaks on unsupported iftype error return path
    - pinctrl: aspeed: Use the right pinconf mask
    - [arm64] iommu/qcom: add missing put_device() call in
      qcom_iommu_of_xlate()
    - iio: adc: stm32-adc: fix runtime autosuspend delay when slow polling
    - net: enic: Cure the enic api locking trainwreck
    - pinctrl: tigerlake: Fix register offsets for TGL-H variant
    - serial: 8250: Discard RTS/DTS setting from clock update method
    - serial: 8250: Skip uninitialized TTY port baud rate update
    - serial: 8250_dw: Fix clk-notifier/port suspend deadlock
    - mfd: syscon: Don't free allocated name for regmap_config
    - mfd: sm501: Fix leaks in probe()
    - dm: fix missing imposition of queue_limits from dm_wq_work() thread
    - pinctrl: single: fix pinctrl_spec.args_count bounds check
    - pinctrl: single: fix debug output when #pinctrl-cells = 2
    - staging: rtl8712: Fix enqueue_reorder_recvframe()
    - ASoC: wm_adsp: Pass full name to snd_ctl_notify
    - iwlwifi: mvm: split a print to avoid a WARNING in ROC
    - iwlwifi: dbg: remove no filter condition
    - iwlwifi: dbg: run init_cfg function once per driver load
    - usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above.
    - usb: gadget: u_serial: clear suspended flag when disconnecting
    - usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well
    - bus: mhi: core: Fix the building of MHI module
    - ocxl: fix kconfig dependency warning for OCXL
    - nl80211: fix non-split wiphy information
    - [arm*] usb: dwc2: Fix INTR OUT transfers in DDMA mode.
    - scsi: target: tcmu: Fix warning: 'page' may be used uninitialized
    - scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs()
    - dmaengine: ioat: Allocate correct size for descriptor chunk
    - staging: qlge: fix build breakage with dumping enabled
    - ipmi_si: Fix wrong return value in try_smi_init()
    - tracing: Fix parse_synth_field() error handling
    - staging: wfx: fix BA sessions for older firmwares
    - [x86] platform/x86: mlx-platform: Remove PSU EEPROM configuration
    - dm: fix request-based DM to not bounce through indirect dm_submit_bio
    - mwifiex: fix double free
    - [arm64,armhf] drm/panfrost: increase readl_relaxed_poll_timeout values
    - drm/amdgpu: Fix invalid number of character '{' in amdgpu_acpi_init
    - ipvs: clear skb->tstamp in forwarding path
    - bpf, sockmap: Remove skb_orphan and let normal skb_kfree do cleanup
    - netfilter: nf_log: missing vlan offload tag and proto
    - mm/swapfile.c: fix potential memory leak in sys_swapon
    - mm: memcg/slab: fix racy access to page->mem_cgroup in
      mem_cgroup_from_obj()
    - mm/memcg: fix device private memcg accounting
    - mm/mmap.c: replace do_brk with do_brk_flags in comment of
      insert_vm_struct()
    - mm/page_alloc.c: fix freeing non-compound pages
    - mm, oom_adj: don't loop through tasks in __set_oom_adj when not
      necessary
    - fs: fix NULL dereference due to data race in prepend_path()
    - tracing: Handle synthetic event array field type checking correctly
    - i3c: master add i3c_master_attach_boardinfo to preserve boardinfo
    - IB/mlx4: Fix starvation in paravirt mux/demux
    - IB/mlx4: Adjust delayed work when a dup is observed
    - [powerpc*] pseries: Fix missing of_node_put() in rng_init()
    - [powerpc*] icp-hv: Fix missing of_node_put() in success path
    - rcu/tree: Force quiescent state on callback overload
    - rcutorture: Properly set rcu_fwds for OOM handling
    - refperf: Avoid null pointer dereference when buf fails to allocate
    - RDMA/ucma: Fix locking for ctx->events_reported
    - RDMA/ucma: Add missing locking around rdma_leave_multicast()
    - mtd: lpddr: fix excessive stack usage with clang
    - RDMA/hns: Add a check for current state before modifying QP
    - RDMA/umem: Fix signature of stub ib_umem_find_best_pgsz()
    - [powerpc*] pseries: explicitly reschedule during drmem_lmb list
      traversal
    - [powerpc*] pseries/drmem: don't cache node id in drmem_lmb struct
    - RDMA/mlx5: Fix potential race between destroy and CQE poll
    - mtd: mtdoops: Don't write panic data twice
    - perf tools: Make GTK2 support opt-in
    - [armel,armhf] 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using
      DT values
    - xfs: fix finobt btree block recovery ordering
    - m68knommu: include SDHC support only when hardware has it
    - xfs: limit entries returned when counting fsmap records
    - xfs: fix deadlock and streamline xfs_getfsmap performance
    - nfs: add missing "posix" local_lock constant table definition
    - xfs: fix high key handling in the rt allocator's query_range function
    - RDMA/rtrs-srv: Incorporate ib_register_client into rtrs server init
    - RDMA/core: Delete function indirection for alloc/free kernel CQ
    - RDMA: Allow fail of destroy CQ
    - RDMA: Change XRCD destroy return value
    - RDMA: Restore ability to return error for destroy WQ
    - RDMA/umem: Fix ib_umem_find_best_pgsz() for mappings that cross a page
      boundary
    - RDMA/umem: Prevent small pages from being returned by
      ib_umem_find_best_pgsz()
    - RDMA/qedr: Fix qp structure memory leak
    - RDMA/qedr: Fix doorbell setting
    - RDMA/qedr: Fix use of uninitialized field
    - RDMA/qedr: Fix return code if accept is called on a destroyed qp
    - RDMA/qedr: Fix inline size returned for iWARP
    - [powerpc*] pseries/svm: Allocate SWIOTLB buffer anywhere in memory
    - [powerpc*] watchpoint: Fix quadword instruction handling on p10
      predecessors
    - [powerpc*] watchpoint: Fix handling of vector instructions
    - [powerpc*] watchpoint: Add hw_len wherever missing
    - [powerpc*] book3s64/hash/4k: Support large linear mapping range with 4K
    - [powerpc*] 64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm
    - [powerpc*] papr_scm: Fix warning triggered by perf_stats_show()
    - RDMA/cma: Combine cma_ndev_work with cma_work
    - RDMA/cma: Remove dead code for kernel rdmacm multicast
    - RDMA/cma: Consolidate the destruction of a cma_multicast in one place
    - RDMA/cma: Fix use after free race in roce multicast join
    - perf intel-pt: Fix "context_switch event has no tid" error
    - perf metricgroup: Fix uncore metric expressions
    - RDMA/qedr: Fix resource leak in qedr_create_qp
    - RDMA/hns: Set the unsupported wr opcode
    - RDMA/mlx5: Use set_mkc_access_pd_addr_fields() in reg_create()
    - RDMA/mlx5: Make mkeys always owned by the kernel's PD when not enabled
    - RDMA/mlx5: Disable IB_DEVICE_MEM_MGT_EXTENSIONS if IB_WR_REG_MR can't
      work
    - i40iw: Add support to make destroy QP synchronous
    - perf stat: Skip duration_time in setup_system_wide
    - RDMA/hns: Add check for the validity of sl configuration
    - RDMA/hns: Solve the overflow of the calc_pg_sz()
    - RDMA/hns: Fix the wrong value of rnr_retry when querying qp
    - RDMA/hns: Fix configuration of ack_req_freq in QPC
    - RDMA/hns: Fix missing sq_sig_type when querying QP
    - RDMA/mlx5: Fix type warning of sizeof in __mlx5_ib_alloc_counters()
    - mtd: hyperbus: hbmc-am654: Fix direct mapping setup flash access
    - overflow: Include header file with SIZE_MAX declaration
    - mtd: parsers: bcm63xx: Do not make it modular
    - RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces
    - [powerpc*] 64: fix irq replay missing preempt
    - [powerpc*] 64: fix irq replay pt_regs->softe value
    - [powerpc*] perf: Exclude pmc5/6 from the irrelevant PMU group
      constraints
    - [powerpc*] perf/hv-gpci: Fix starting index value
    - perf stat: Fix out of bounds CPU map access when handling armv8_pmu
      events
    - i3c: master: Fix error return in cdns_i3c_master_probe()
    - [powerpc*] security: Fix link stack flush instruction
    - [powerpc*] book3s64/radix: Make radix_mem_block_size 64bit
    - [powerpc*] papr_scm: Add PAPR command family to pass-through command-set
    - [powerpc*] cpufreq: powernv: Fix frame-size-overflow in
      powernv_cpufreq_reboot_notifier
    - IB/rdmavt: Fix sizeof mismatch
    - RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast_pkt()
    - f2fs: reject CASEFOLD inode flag without casefold feature
    - um: vector: Use GFP_ATOMIC under spin lock
    - um: time-travel: Fix IRQ handling in time_travel_handle_message()
    - thermal: core: Adding missing nlmsg_free() in
      thermal_genl_sampling_temp()
    - perf trace: Fix off by ones in memset() after realloc() in arches using
      libaudit
    - f2fs: wait for sysfs kobject removal before freeing f2fs_sb_info
    - afs: Fix rapid cell addition/removal by not using RCU on cells tree
    - afs: Fix cell refcounting by splitting the usage counter
    - afs: Fix cell purging with aliases
    - afs: Fix cell removal
    - RDMA/rxe: Handle skb_clone() failure in rxe_recv.c
    - mm/page_owner: change split_page_owner to take a count
    - mm/huge_memory: fix split assumption of page size
    - mm: fix a race during THP splitting
    - lib/crc32.c: fix trivial typo in preprocessor condition
    - ramfs: fix nommu mmap with gaps in the page cache
    - rapidio: fix error handling path
    - rapidio: fix the missed put_device() for rio_mport_add_riodev
    - clk: meson: axg-audio: separate axg and g12a regmap tables
    - rtc: ds1307: Clear OSF flag on DS1388 when setting time
    - clk: meson: g12a: mark fclk_div2 as critical
    - PCI: designware-ep: Fix the Header Type check
    - PCI: aardvark: Fix compilation on s390
    - PCI: aardvark: Check for errors from pci_bridge_emul_init() call
    - PCI: iproc: Set affinity mask on MSI interrupts
    - PCI/IOV: Mark VFs as not implementing PCI_COMMAND_MEMORY
    - vfio: add a singleton check for vfio_group_pin_pages
    - [s390x] pci: Mark all VFs as not implementing PCI_COMMAND_MEMORY
    - vfio/pci: Decouple PCI_COMMAND_MEMORY bit checks from is_virtfn
    - vfio: fix a missed vfio group put in vfio_pin_pages
    - [x86,arm64] vfio/type1: fix dirty bitmap calculation in vfio_dma_rw
    - nfsd: Cache R, RW, and W opens separately
    - [x86] PCI: hv: Fix hibernation in case interrupts are not re-created
    - module: statically initialize init section freeing data
    - clk: at91: clk-main: update key before writing AT91_CKGR_MOR
    - clk: bcm2835: add missing release if devm_clk_hw_register fails
    - kbuild: deb-pkg: do not build linux-headers package if CONFIG_MODULES=n
    - watchdog: Fix memleak in watchdog_cdev_register
    - watchdog: Use put_device on error
    - watchdog: sp5100: Fix definition of EFCH_PM_DECODEEN3
    - clk: at91: sam9x60: support only two programmable clocks
    - svcrdma: fix bounce buffers for unaligned offsets and multiple pages
    - ext4: fix dead loop in ext4_mb_new_blocks
    - ext4: discard preallocations before releasing group lock
    - ext4: disallow modifying DAX inode flag if inline_data has been set
    - ext4: limit entries returned when counting fsmap records
    - vfio/pci: Clear token on bypass registration failure
    - [x86,arm64] vfio iommu type1: Fix memory leak in
      vfio_iommu_type1_pin_pages
    - clk: qcom: gdsc: Keep RETAIN_FF bit set if gdsc is already on
    - clk: imx8mq: Fix usdhc parents order
    - SUNRPC: fix copying of multiple pages in gss_read_proxy_verf()
    - NFSv4.2: Fix NFS4ERR_STALE error when doing inter server copy
    - platform/chrome: cros_ec_typec: Send enum values to
      usb_role_switch_set_role()
    - platform/chrome: cros_ec_lightbar: Reduce ligthbar get version command
    - Input: elants_i2c - fix typo for an attribute to show calibration count
    - Input: imx6ul_tsc - clean up some errors in imx6ul_tsc_resume()
    - Input: stmfts - fix a & vs && typo
    - Input: ep93xx_keypad - fix handling of platform_get_irq() error
    - Input: omap4-keypad - fix handling of platform_get_irq() error
    - Input: twl4030_keypad - fix handling of platform_get_irq() error
    - Input: sun4i-ps2 - fix handling of platform_get_irq() error
    - [x86] KVM: x86: emulating RDPID failure shall return #UD rather than #GP
    - [x86] KVM: nSVM: CR3 MBZ bits are only 63:52
    - scsi: bfa: Fix error return in bfad_pci_init()
    - [arm64] mm: use single quantity to represent the PA to VA translation
    - bpf: Enforce id generation for all may-be-null register type
    - net: dsa: seville: the packet buffer is 2 megabits, not megabytes
    - netfilter: conntrack: connection timeout after re-register
    - netfilter: ebtables: Fixes dropping of small packets in bridge nat
    - vdpa/mlx5: Make use of a specific 16 bit endianness API
    - vdpa/mlx5: Fix failure to bring link up
    - vdpa/mlx5: Setup driver only if VIRTIO_CONFIG_S_DRIVER_OK
    - netfilter: nf_fwd_netdev: clear timestamp in forwarding path
    - [arm64] soc: xilinx: Fix error code in zynqmp_pm_probe()
    - [arm64] arm64: dts: meson: vim3: correct led polarity
    - [armhf] dts: sun8i: r40: bananapi-m2-ultra: Fix dcdc1 regulator
    - [arm64] dts: allwinner: h5: remove Mali GPU PMU module
    - [armhf] memory: omap-gpmc: Fix a couple off by ones
    - [armhf] memory: omap-gpmc: Fix build error without CONFIG_OF
    - [arm64] dts: qcom: msm8992: Fix UART interrupt property
    - [arm64] dts: qcom: sdm845-db845c: Fix hdmi nodes
    - [arm64] dts: qcom: sm8150: fix up primary USB nodes
    - [arm64] dts: qcom: sc7180: Fix the LLCC base register size
    - memory: fsl-corenet-cf: Fix handling of platform_get_irq() error
    - firmware: arm_scmi: Fix NULL pointer dereference in mailbox_chan_free
    - [arm64] dts: mt8173-elm: fix supported values for
      regulator-allowed-modes of da9211
    - [arm64] dts: qcom: sm8250: Rename UART2 node to UART12
    - dmaengine: ti: k3-udma-glue: Fix parameters for rx ring pair request
    - [arm64] dts: imx8mq: Add missing interrupts to GPC
    - [arm64] dts: qcom: sc7180: Drop flags on mdss irqs
    - [arm64] dts: sdm845: Fixup OPP table for all qup devices
    - [arm64] dts: qcom: msm8916: Remove one more thermal trip point unit name
    - [arm64] dts: qcom: pm8916: Remove invalid reg size from wcd_codec
    - [arm64] dts: qcom: msm8916: Fix MDP/DSI interrupts
    - [arm64] dts: mt8173: elm: Fix nor_flash node property
    - [arm64] dts: ti: k3-j721e: Rename mux header and update macro names
    - [arm64] dts: actions: limit address range for pinctrl node
    - lightnvm: fix out-of-bounds write to array devices->info[]
    - [powerpc*] powernv/dump: Fix race while processing OPAL dump
    - [powerpc*] 64s: Remove TM from Power10 features
    - [powerpc*] pseries: Avoid using addr_to_pfn in real mode
    - nvmet: fix uninitialized work for zero kato
    - nvmet: limit passthru MTDS by BIO_MAX_PAGES
    - [x86] KVM: ioapic: break infinite recursion on lazy EOI (CVE-2020-27152)
    - NTB: hw: amd: fix an issue about leak system resources
    - sched/features: Fix !CONFIG_JUMP_LABEL case
    - perf: correct SNOOPX field offset
    - random32: make prandom_u32() output unpredictable
    - i2c: core: Restore acpi_walk_dep_device_list() getting called after
      registering the ACPI i2c devs
    - md/bitmap: fix memory leak of temporary bitmap
    - block: ratelimit handle_bad_sector() message
    - [x86] dumpstack: Fix misleading instruction pointer error message
    - crypto: ccp - fix error handling
    - [x86] asm: Replace __force_order with a memory clobber
    - [x86] mce: Add Skylake quirk for patrol scrub reported errors
    - media: firewire: fix memory leak
    - media: ati_remote: sanity check for both endpoints
    - media: st-delta: Fix reference count leak in delta_run_work
    - media: sti: Fix reference count leaks
    - media: exynos4-is: Fix several reference count leaks due to
      pm_runtime_get_sync
    - media: exynos4-is: Fix a reference count leak due to pm_runtime_get_sync
    - media: exynos4-is: Fix a reference count leak
    - media: vsp1: Fix runtime PM imbalance on error
    - media: platform: s3c-camif: Fix runtime PM imbalance on error
    - media: platform: sti: hva: Fix runtime PM imbalance on error
    - media: bdisp: Fix runtime PM imbalance on error
    - media: media/pci: prevent memory leak in bttv_probe
    - [x86] mce: Annotate mce_rd/wrmsrl() with noinstr
    - crypto: hisilicon - fixed memory allocation error
    - spi: fsi: Fix clock running too fast
    - blk-mq: always allow reserved allocation in hctx_may_queue
    - [x86] mce: Make mce_rdmsrl() panic on an inaccessible MSR
    - media: uvcvideo: Ensure all probed info is returned to v4l2
    - mmc: sdio: Check for CISTPL_VERS_1 buffer size
    - media: saa7134: avoid a shift overflow
    - media: atomisp: fix memleak in ia_css_stream_create
    - media: venus: fixes for list corruption
    - notifier: Fix broken error handling pattern
    - fs: dlm: fix configfs memory leak
    - media: venus: core: Fix error handling in probe
    - media: venus: core: Fix runtime PM imbalance in venus_probe
    - ntfs: add check for mft record size in superblock
    - ip_gre: set dev->hard_header_len and dev->needed_headroom properly
    - mac80211: handle lack of sband->bitrates in rates
    - staging: wfx: fix handling of MMIC error
    - libbpf: Close map fd if init map slots failed
    - bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI
    - PM: hibernate: remove the bogus call to get_gendisk() in
      software_resume()
    - scsi: mvumi: Fix error return in mvumi_io_attach()
    - scsi: target: core: Add CONTROL field for trace events
    - [amd64] mic: vop: copy data to kernel space then write to io memory
    - [amd64] misc: vop: add round_up(x,4) for vring_size to avoid kernel
      panic
    - [arm64,armhf] usb: dwc3: Add splitdisable quirk for Hisilicon Kirin Soc
    - usb: gadget: function: printer: fix use-after-free in __lock_acquire
    - rtw88: pci: Power cycle device during shutdown
    - udf: Limit sparing table size
    - udf: Avoid accessing uninitialized data on failed inode read
    - rtw88: increse the size of rx buffer size
    - USB: cdc-acm: handle broken union descriptors
    - [arm64,armhf] usb: dwc3: simple: add support for Hikey 970
    - can: flexcan: flexcan_chip_stop(): add error handling and propagate
      error value
    - HID: multitouch: Lenovo X1 Tablet Gen3 trackpoint and buttons
    - ath9k: hif_usb: fix race condition between usb_get_urb() and
      usb_kill_anchored_urbs()
    - [arm64,armhf] drm/panfrost: add Amlogic GPU integration quirks
    - [arm64,armhf] drm/panfrost: add amlogic reset quirk callback
    - [arm64,armhf] drm/panfrost: add support for vendor quirk
    - bpf: Limit caller's stack depth 256 for subprogs with tailcalls
    - dma-direct: Fix potential NULL pointer dereference
    - misc: rtsx: Fix memory leak in rtsx_pci_probe
    - reiserfs: only call unlock_new_inode() if I_NEW
    - opp: Prevent memory leak in dev_pm_opp_attach_genpd()
    - xfs: make sure the rt allocator doesn't run off the end
    - usb: ohci: Default to per-port over-current protection
    - drm: fix double free for gbo in drm_gem_vram_init and
      drm_gem_vram_create
    - Bluetooth: Only mark socket zapped after unlocking
    - drm/msm/a6xx: fix a potential overflow issue
    - drm/xlnx: Use devm_drm_dev_alloc
    - iomap: fix WARN_ON_ONCE() from unprivileged users
    - scsi: ibmvfc: Fix error return in ibmvfc_probe()
    - scsi: qla2xxx: Warn if done() or free() are called on an already freed
      srb
    - soundwire: cadence: fix race condition between suspend and Slave device
      alerts
    - brcmsmac: fix memory leak in wlc_phy_attach_lcnphy
    - rtl8xxxu: prevent potential memory leak
    - Fix use after free in get_capset_info callback.
    - HID: ite: Add USB id match for Acer One S1003 keyboard dock
    - scsi: qedf: Return SUCCESS if stale rport is encountered
    - scsi: qedi: Mark all connections for recovery on link down event
    - scsi: qedi: Protect active command list to avoid list corruption
    - scsi: qedi: Fix list_del corruption while removing active I/O
    - fbmem: add margin check to fb_check_caps()
    - tty: ipwireless: fix error handling
    - Bluetooth: btusb: Fix memleak in btusb_mtk_submit_wmt_recv_urb
    - ipvs: Fix uninit-value in do_ip_vs_set_ctl()
    - reiserfs: Fix memory leak in reiserfs_parse_options()
    - [s390x] qeth: strictly order bridge address events
    - mwifiex: don't call del_timer_sync() on uninitialized timer
    - ALSA: hda/ca0132 - Add AE-7 microphone selection commands.
    - ALSA: hda/ca0132 - Add new quirk ID for SoundBlaster AE-7.
    - [x86] ASoC: SOF: Add topology filename override based on dmi data match
    - [x86] ASoC: Intel: sof_rt5682: override quirk data for
      tgl_max98373_rt5682
    - scsi: smartpqi: Avoid crashing kernel for controller issues
    - brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach
    - usb: core: Solve race condition in anchor cleanup functions
    - soundwire: intel: reinitialize IP+DSP in .prepare(), but only when
      resuming
    - scsi: ufs: ufs-qcom: Fix race conditions caused by
      ufs_qcom_testbus_config()
    - dmaengine: dw: Add DMA-channels mask cell support
    - dmaengine: dw: Activate FIFO-mode for memory peripherals only
    - drm/hisilicon: Code refactoring for hibmc_drv_de
    - [arm64,armhf] drm/panfrost: perfcnt: fix ref count leak in
      panfrost_perfcnt_enable_locked
    - ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n()
    - [s390x] qeth: don't let HW override the configured port role
    - tty: serial: lpuart: fix lpuart32_write usage
    - tty: serial: fsl_lpuart: fix lpuart32_poll_get_char
    - usb: gadget: bcm63xx_udc: fix up the error of undeclared usb_debug_root
    - usb: cdc-acm: add quirk to blacklist ETAS ES58X devices
    - USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync().
    - usb: cdns3: gadget: free interrupt after gadget has deleted
    - eeprom: at25: set minimum read/write access stride to 1
    - usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.3
    - cpufreq: Improve code around unlisted freq check
    - netfilter: nftables_offload: KASAN slab-out-of-bounds Read in
      nft_flow_rule_create
    - io_uring: allow timeout/poll/files killing to take task into account
    - io_uring: move dropping of files into separate helper
    - io_uring: stash ctx task reference for SQPOLL
    - io_uring: unconditionally grab req->task
    - io_uring: return cancelation status from poll/timeout/files handlers
    - io_uring: enable task/files specific overflow flushing
    - io_uring: don't rely on weak ->files references
    - io_uring: reference ->nsproxy for file table commands
    - io_wq: Make io_wqe::lock a raw_spinlock_t
    - io-wq: fix use-after-free in io_wq_worker_running
    - io_uring: no need to call xa_destroy() on empty xarray
    - io_uring: Fix use of XArray in __io_uring_files_cancel
    - io_uring: Fix XArray usage in io_uring_add_task_file
    - io_uring: Convert advanced XArray uses to the normal API
    - scripts/setlocalversion: make git describe output more reliable
    - [arm64] efi/arm64: libstub: Deal gracefully with EFI_RNG_PROTOCOL
      failure
    - fs/kernel_read_file: Remove FIRMWARE_EFI_EMBEDDED enum
    - [arm64] Run ARCH_WORKAROUND_1 enabling code on all CPUs
    - [arm64] Run ARCH_WORKAROUND_2 enabling code on all CPUs
    - [arm64] link with -z norelro regardless of CONFIG_RELOCATABLE
    - [x86] PCI: Fix intel_mid_pci.c build error when ACPI is not enabled
    - efivarfs: Replace invalid slashes with exclamation marks in dentries.
    - bnxt_en: Check abort error state in bnxt_open_nic().
    - bnxt_en: Fix regression in workqueue cleanup logic in bnxt_remove_one().
    - bnxt_en: Invoke cancel_delayed_work_sync() for PFs also.
    - bnxt_en: Re-write PCI BARs after PCI fatal error.
    - bnxt_en: Send HWRM_FUNC_RESET fw command unconditionally.
    - cxgb4: set up filter action after rewrites
    - gtp: fix an use-before-init in gtp_newlink()
    - ibmveth: Fix use of ibmveth in a bridge.
    - ibmvnic: fix ibmvnic_set_mac
    - mlxsw: core: Fix memory leak on module removal
    - mlxsw: Only advertise link modes supported by both driver and device
    - netem: fix zero division in tabledist
    - net: hns3: Clear the CMDQ registers before unmapping BAR region
    - net: ipa: command payloads already mapped
    - net/sched: act_mpls: Add softdep on mpls_gso.ko
    - r8169: fix issue with forced threading in combination with shared
      interrupts
    - ravb: Fix bit fields checking in ravb_hwtstamp_get()
    - tcp: Prevent low rmem stalls with SO_RCVLOWAT.
    - tipc: fix memory leak caused by tipc_buf_append()
    - net/smc: fix invalid return code in smcd_new_buf_create()
    - net/smc: fix suppressed return code
    - net: protect tcf_block_unbind with block lock
    - erofs: avoid duplicated permission check for "trusted." xattrs
    - [x86] arch/x86/amd/ibs: Fix re-arming IBS Fetch
    - [x86] traps: Fix #DE Oops message regression
    - [x86] xen: disable Firmware First mode for correctable memory errors
    - PCI: aardvark: Fix initialization with old Marvell's Arm Trusted
      Firmware
    - ata: ahci: mvebu: Make SATA PHY optional for Armada 3720
    - fuse: fix page dereference after free
    - bpf: Fix comment for helper bpf_current_task_under_cgroup()
    - evm: Check size of security.evm before using it
    - p54: avoid accessing the data mapped to streaming DMA
    - cxl: Rework error message for incompatible slots
    - RDMA/addr: Fix race with netevent_callback()/rdma_addr_cancel()
    - mtd: lpddr: Fix bad logic in print_drs_error
    - [x86] drm/i915/gem: Serialise debugfs i915_gem_objects with ctx->mutex
    - serial: qcom_geni_serial: To correct QUP Version detection logic
    - serial: pl011: Fix lockdep splat when handling magic-sysrq interrupt
    - PM: runtime: Fix timer_expires data type on 32-bit arches
    - ata: sata_rcar: Fix DMA boundary mask
    - mm: mark async iocb read as NOWAIT once some data has been copied
    - xen/gntdev.c: Mark pages as dirty
    - io_uring: don't reuse linked_timeout
    - misc: rtsx: do not setting OC_POWER_DOWN reg in rtsx_pci_init_ocp()
    - phy: marvell: comphy: Convert internal SMCC firmware return codes to
      errno
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.4
    - [x86,powerpc] Rename memcpy_mcsafe() to copy_mc_to_{user, kernel}()
    - [x86] copy_mc: Introduce copy_mc_enhanced_fast_string()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.5
    - xen/events: avoid removing an event channel while handling it
      (CVE-2020-27675)
    - xen/events: add a proper barrier to 2-level uevent unmasking
      (CVE-2020-27673)
    - xen/events: fix race in evtchn_fifo_unmask() (CVE-2020-27673)
    - xen/events: add a new "late EOI" evtchn framework (CVE-2020-27673)
    - xen/blkback: use lateeoi irq binding (CVE-2020-27673)
    - xen/netback: use lateeoi irq binding (CVE-2020-27673)
    - xen/scsiback: use lateeoi irq binding (CVE-2020-27673)
    - xen/pvcallsback: use lateeoi irq binding (CVE-2020-27673)
    - xen/pciback: use lateeoi irq binding (CVE-2020-27673)
    - xen/events: switch user event channels to lateeoi model (CVE-2020-27673)
    - xen/events: use a common cpu hotplug hook for event channels
      (CVE-2020-27673)
    - xen/events: defer eoi in case of excessive number of events
      (CVE-2020-27673)
    - xen/events: block rogue events for some time (CVE-2020-27673)
    - [arm64] tee: client UUID: Skip REE kernel login method as well
    - [x86] unwind/orc: Fix inactive tasks with stack pointer in %sp on GCC 10
      compiled kernels
    - [x86] alternative: Don't call text_poke() in lazy TLB mode
    - RDMA/mlx5: Fix devlink deadlock on net namespace deletion
    - afs: Fix a use after free in afs_xattr_get_acl()
    - afs: Fix afs_launder_page to not clear PG_writeback
    - RDMA/qedr: Fix memory leak in iWARP CM
    - ata: sata_nv: Fix retrieving of active qcs
    - [arm64] efi: increase EFI PE/COFF header padding to 64 KB
    - afs: Fix to take ref on page when PG_private is set
    - afs: Fix page leak on afs_write_begin() failure
    - afs: Fix where page->private is set during write
    - afs: Wrap page->private manipulations in inline functions
    - afs: Alter dirty range encoding in page->private
    - afs: Fix afs_invalidatepage to adjust the dirty region
    - afs: Fix dirty-region encoding on ppc32 with 64K pages
    - lockdep: Fix preemption WARN for spurious IRQ-enable
    - [arm64,armhf] usb: host: ehci-tegra: Fix error handling in
      tegra_ehci_probe()
    - futex: Fix incorrect should_fail_futex() handling
    - [powerpc*] vmemmap: Fix memory leak with vmemmap list allocation
      failures.
    - [powerpc*] powernv/smp: Fix spurious DBG() warning
    - RDMA/core: Change how failing destroy is handled during uobj abort
    - f2fs: allocate proper size memory for zstd decompress
    - mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race
    - [powerpc*] select ARCH_WANT_IRQS_OFF_ACTIVATE_MM
    - [sparc64] remove mm_cpumask clearing to fix kthread_use_mm race
    - f2fs: add trace exit in exception path
    - f2fs: do sanity check on zoned block device path
    - f2fs: fix uninit-value in f2fs_lookup
    - f2fs: fix to check segment boundary during SIT page readahead
    - [s390x] startup: avoid save_area_sync overflow
    - f2fs: compress: fix to disallow enabling compress on non-empty file
    - [s390x] ap/zcrypt: revisit ap and zcrypt error handling
    - f2fs: handle errors of f2fs_get_meta_page_nofail
    - afs: Don't assert on unpurgeable server records
    - [powerpc*] 64s: handle ISA v3.1 local copy-paste context switches
    - [armel,armhf] 8997/2: hw_breakpoint: Handle inexact watchpoint addresses
    - NFS4: Fix oops when copy_file_range is attempted with NFS4.0 source
    - xfs: Set xfs_buf type flag when growing summary/bitmap files
    - xfs: Set xfs_buf's b_ops member when zeroing bitmap/summary files
    - xfs: log new intent items created as part of finishing recovered intent
      items
    - power: supply: bq27xxx: report "not charging" on all types
    - xfs: change the order in which child and parent defer ops are finished
    - xfs: fix realtime bitmap/summary file truncation when growing rt volume
    - io_uring: don't set COMP_LOCKED if won't put
    - ath10k: fix retry packets update in station dump
    - [x86] kaslr: Initialize mem_limit to the real maximum address
    - drm/ast: Separate DRM driver from PCI code
    - drm/amdgpu: restore ras flags when user resets eeprom(v2)
    - ath10k: start recovery process when payload length exceeds max htc
      length for sdio
    - ath10k: fix VHT NSS calculation when STBC is enabled
    - drm/scheduler: Scheduler priority fixes (v2)
    - [x86] ASoC: SOF: fix a runtime pm issue in SOF when HDMI codec doesn't
      work
    - drm/bridge_connector: Set default status connected for eDP connectors
    - media: videodev2.h: RGB BT2020 and HSV are always full range
    - [x86] usb: typec: tcpm: During PR_SWAP, source caps should be sent only
      after tSwapSourceStart
    - mmc: via-sdmmc: Fix data race bug
    - brcmfmac: increase F2 watermark for BCM4329
    - [arm64] topology: Stop using MPIDR for topology information
    - printk: reduce LOG_BUF_SHIFT range for H8300
    - [ia64] kprobes: Use generic kretprobe trampoline handler
    - bpf: Permit map_ptr arithmetic with opcode add and offset 0
    - [arm64,armhf] drm: lima: fix common struct sg_table related issues
    - [arm64,armhf] drm: panfrost: fix common struct sg_table related issues
    - media: uvcvideo: Fix dereference of out-of-bound list iterator
    - selinux: access policycaps with READ_ONCE/WRITE_ONCE
    - samples/bpf: Fix possible deadlock in xdpsock
    - [riscv64] Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
    - cpufreq: sti-cpufreq: add stih418 support
    - USB: adutux: fix debugging
    - mac80211: add missing queue/hash initialization to 802.3 xmit
    - usb: xhci: omit duplicate actions when suspending a runtime suspended
      host.
    - SUNRPC: Mitigate cond_resched() in xprt_transmit()
    - [arm64] mm: return cpu_all_mask when node is NUMA_NO_NODE
    - [armhf] can: flexcan: disable clocks during stop mode
    - xfs: don't free rt blocks when we're doing a REMAP bunmapi call
    - xfs: avoid LR buffer overrun due to crafted h_len
    - ACPI: Add out of bounds and numa_off protections to pxm_to_node()
    - brcmfmac: Fix warning message after dongle setup failed
    - ath11k: Use GFP_ATOMIC instead of GFP_KERNEL in
      ath11k_dp_htt_get_ppdu_desc
    - ath11k: fix warning caused by lockdep_assert_held
    - ath11k: change to disable softirqs for ath11k_regd_update to solve
      deadlock
    - drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values
    - [arm64,armhf] usb: dwc3: core: do not queue work if dr_mode is not
      USB_DR_MODE_OTG
    - [arm64] bus/fsl_mc: Do not rely on caller to provide non NULL mc_io
    - ACPI: HMAT: Fix handling of changes from ACPI 6.2 to ACPI 6.3
    - block: Consider only dispatched requests for inflight statistic
    - btrfs: fix replace of seed device
    - md/bitmap: md_bitmap_get_counter returns wrong blocks
    - f2fs: fix to set SBI_NEED_FSCK flag for inconsistent inode
    - bnxt_en: Log unknown link speed appropriately.
    - [arm64] rpmsg: glink: Use complete_all for open states
    - PCI/ACPI: Add Ampere Altra SOC MCFG quirk
    - [armhf] clk: ti: clockdomain: fix static checker warning
    - nfsd: rename delegation related tracepoints to make them less confusing
    - nfsd4: remove check_conflicting_opens warning
    - net: 9p: initialize sun_server.sun_path to have addr's value only when
      addr is valid
    - ceph: encode inodes' parent/d_name in cap reconnect message
    - jbd2: avoid transaction reuse after reformatting
    - ext4: Detect already used quota file early
    - [ppc64el] KVM: PPC: Book3S HV: Do not allocate HPT for a nested guest
    - scsi: core: Clean up allocation and freeing of sgtables
    - gfs2: call truncate_inode_pages_final for address space glocks
    - gfs2: Fix NULL pointer dereference in gfs2_rgrp_dump
    - gfs2: use-after-free in sysfs deregistration
    - gfs2: add validation checks for size of superblock
    - Handle STATUS_IO_TIMEOUT gracefully
    - cifs: handle -EINTR in cifs_setattr
    - [armhf] memory: emif: Remove bogus debugfs error handling
    - nbd: make the config put is called before the notifying the waiter
    - sgl_alloc_order: fix memory leak
    - nvme-rdma: fix crash when connect rejected
    - vmlinux.lds.h: Add PGO and AutoFDO input sections
    - [mips64el,mipsel] irqchip/loongson-htvec: Fix initial interrupt clearing
    - md: fix the checking of wrong work queue
    - md/raid5: fix oops during stripe resizing
    - mmc: sdhci: Add LTR support for some Intel BYT based controllers
    - mmc: sdhci-acpi: AMDI0040: Set SDHCI_QUIRK2_PRESET_VALUE_BROKEN
    - mm: memcg/slab: uncharge during kmem_cache_free_bulk()
    - seccomp: Make duplicate listener detection non-racy
    - [x86] perf/x86/intel: Fix Ice Lake event constraint table
    - [x86] perf/x86/amd: Fix sampling Large Increment per Cycle events
    - [x86] perf/amd/uncore: Set all slices and threads to restore perf stat
      -a behaviour
    - [x86] perf/x86/amd/ibs: Don't include randomized bits in
      get_ibs_op_count()
    - [x86] perf/x86/amd/ibs: Fix raw sample data accumulation
    - media: uvcvideo: Fix uvc_ctrl_fixup_xu_info() not having any effect
    - fs: Don't invalidate page buffers in block_write_full_page()
    - ACPI: configfs: Add missing config_item_put() to fix refcount leak
    - NFS: fix nfs_path in case of a rename retry
    - ACPI: button: fix handling lid state changes when input device closed
    - ACPI: video: use ACPI backlight for HP 635 Notebook
    - ACPI: debug: don't allow debugging when ACPI is disabled
    - PCI/ACPI: Whitelist hotplug ports for D3 if power managed by ACPI
    - ACPI: EC: PM: Flush EC work unconditionally after wakeup
    - ACPI: EC: PM: Drop ec_no_wakeup check from acpi_ec_dispatch_gpe()
    - acpi-cpufreq: Honor _PSD table setting on new AMD CPUs
    - io-wq: assign NUMA node locality if appropriate
    - w1: mxc_w1: Fix timeout resolution problem leading to bus error
    - fs/kernel_read_file: Remove FIRMWARE_PREALLOC_BUFFER enum
    - scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
    - scsi: qla2xxx: Fix MPI reset needed message
    - scsi: qla2xxx: Fix reset of MPI firmware
    - scsi: qla2xxx: Fix crash on session cleanup with unload
    - PM: runtime: Remove link state checks in rpm_get/put_supplier()
    - btrfs: qgroup: fix wrong qgroup metadata reserve for delayed inode
    - btrfs: improve device scanning messages
    - btrfs: qgroup: fix qgroup meta rsv leak for subvolume operations
    - btrfs: sysfs: init devices outside of the chunk_mutex
    - btrfs: tracepoints: output proper root owner for
      trace_find_free_extent()
    - btrfs: reschedule if necessary when logging directory items
    - btrfs: send, orphanize first all conflicting inodes when processing
      references
    - btrfs: send, recompute reference path after orphanization of a directory
    - btrfs: use kvzalloc() to allocate clone_roots in btrfs_ioctl_send()
    - btrfs: tree-checker: fix false alert caused by legacy btrfs root item
    - btrfs: reschedule when cloning lots of extents
    - btrfs: cleanup cow block on error
    - btrfs: skip devices without magic signature when mounting
    - btrfs: tree-checker: validate number of chunk stripes and parity
    - btrfs: fix use-after-free on readahead extent after failure to create it
    - btrfs: fix readahead hang and use-after-free after removing a device
    - btrfs: drop the path before adding block group sysfs files
    - usb: xhci: Workaround for S3 issue on AMD SNPS 3.0 xHC
    - [arm64] usb: dwc3: pci: Allow Elkhart Lake to utilize DSM method for PM
      functionality
    - [arm64,armhf] usb: dwc3: ep0: Fix ZLP for OUT ep0 requests
    - [arm64,armhf] usb: dwc3: gadget: Check MPS of the request length
    - [arm64,armhf] usb: dwc3: gadget: Reclaim extra TRBs after request
      completion
    - [arm64,armhf] usb: dwc3: core: add phy cleanup for probe error handling
    - [arm64,armhf] usb: dwc3: core: don't trigger runtime pm when remove
      driver
    - [arm64,armhf] usb: dwc3: gadget: Resume pending requests after
      CLEAR_STALL
    - [arm64,armhf] usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command
    - usb: cdc-acm: fix cooldown mechanism
    - [x86] usb: typec: tcpm: reset hard_reset_count for any disconnect
    - usbcore: Check both id_table and match() when both available
    - USB: apple-mfi-fastcharge: don't probe unhandled devices
    - [x86] drm/i915: Force VT'd workarounds when running as a guest OS
    - vt: keyboard, simplify vt_kdgkbsent
    - vt: keyboard, extend func_buf_lock to readers (CVE-2020-25656)
    - vt_ioctl: fix GIO_UNIMAP regression
    - HID: wacom: Avoid entering wacom_wac_pen_report for pad / battery
    - [x86] mce: Allow for copy_mc_fragile symbol checksum to be generated
    - [arm64] tty: serial: fsl_lpuart: LS1021A has a FIFO size of 16 words,
      like LS1028A
    - tracing: Fix race in trace_open and buffer resize call
    - [powerpc*] Fix random segfault when freeing hugetlb range
    - udf: Fix memory leak when mounting
    - rcu-tasks: Fix grace-period/unlock race in RCU Tasks Trace
    - rcu-tasks: Fix low-probability task_struct leak
    - rcu-tasks: Enclose task-list scan in rcu_read_lock()
    - [s390x] stp: add locking to sysfs functions
    - [powerpc*] rtas: Restrict RTAS requests from userspace
    - [powerpc*] Warn about use of smt_snooze_delay
    - [powerpc*] memhotplug: Make lmb size 64bit
    - [powerpc*] powernv/elog: Fix race while processing OPAL error log event.
    - [powerpc*] powermac: Fix low_sleep_handler with KUAP and KUEP
    - [powerpc*] mce: Avoid nmi_enter/exit in real mode on pseries hash
    - [powerpc*] Fix undetected data corruption with P9N DD2.1 VSX CI load
      emulation
    - [powerpc*] 32: Fix vmap stack - Do not activate MMU before reading task
      struct
    - [powerpc*] 32: Fix vmap stack - Properly set r1 before activating MMU
    - block: advance iov_iter on bio_add_hw_page failure
    - io_uring: use type appropriate io_kiocb handler for double poll
    - [armhf] remoteproc: Fixup coredump debugfs disable request
    - gfs2: Make sure we don't miss any delayed withdraws
    - gfs2: Only access gl_delete for iopen glocks
    - NFSv4: Wait for stateid updates after CLOSE/OPEN_DOWNGRADE
    - NFSv4.2: support EXCHGID4_FLAG_SUPP_FENCE_OPS 4.2 EXCHANGE_ID flag
    - NFSD: Add missing NFSv2 .pc_func methods
    - ubifs: dent: Fix some potential memory leaks while iterating entries
    - ubifs: xattr: Fix some potential memory leaks while iterating entries
    - ubifs: journal: Make sure to not dirty twice for auth nodes
    - ubifs: Fix a memleak after dumping authentication mount options
    - ubifs: Don't parse authentication mount options in remount process
    - ubifs: mount_ubifs: Release authentication resource in error handling
      path
    - perf vendor events amd: Add L2 Prefetch events for zen1
    - perf python scripting: Fix printable strings in python3 scripts
    - ubi: check kthread_should_stop() after the setting of task state
    - [arm64,armhf] i2c: imx: Fix external abort on interrupt in exit paths
    - drm/amdgpu: don't map BO in reserved region
    - drm/amdgpu: vcn and jpeg ring synchronization
    - drm/amdgpu: update golden setting for sienna_cichlid
    - drm/amdgpu: correct the gpu reset handling for job != NULL case
    - drm/amdgpu: add function to program pbb mode for sienna cichlid
    - drm/amdgpu: increase the reserved VM size to 2MB
    - ceph: promote to unsigned long long before shifting
    - libceph: clear con->out_msg on Policy::stateful_server faults
    - 9P: Cast to loff_t before multiplying
    - net/sunrpc: Fix return value for sysctl sunrpc.transports
    - [arm64] PCI: qcom: Make sure PCIe is reset before init for rev 2.1.0
    - ring-buffer: Return 0 on success from ring_buffer_resize()
    - [x86] intel_idle: Ignore _CST if control cannot be taken from the
      platform
    - [x86] intel_idle: Fix max_cstate for processor models without C-state
      tables
    - cpufreq: Avoid configuring old governors as default with intel_pstate
    - cpufreq: Introduce CPUFREQ_NEED_UPDATE_LIMITS driver flag
    - cpufreq: intel_pstate: Avoid missing HWP max updates in passive mode
    - [amd64] vringh: fix __vringh_iov() when riov and wiov are different
    - ext4: fix leaking sysfs kobject after failed mount
    - ext4: fix error handling code in add_new_gdb
    - ext4: implement swap_activate aops using iomap
    - ext4: fix invalid inode checksum
    - ext4: clear buffer verified flag if read meta block from disk
    - ext4: fix bdev write error check failed when mount fs with ro
    - ext4: fix bs < ps issue reported with dioread_nolock mount opt
    - ext4: do not use extent after put_bh
    - drm/ttm: fix eviction valuable range check.
    - [arm64] mmc: sdhci-of-esdhc: make sure delay chain locked for HS400
    - [arm64] mmc: sdhci-of-esdhc: set timeout to max before tuning
    - mmc: sdhci: Use Auto CMD Auto Select only when v4_mode is true
    - [arm64,armhf] memory: tegra: Remove GPU from DRM IOMMU group
    - futex: Adjust absolute futex timeouts with per time namespace offset
    - drm/amd/psp: Fix sysfs: cannot create duplicate filename
    - drm/amdgpu: correct the cu and rb info for sienna cichlid
    - tty: make FONTX ioctl use the tty pointer they were actually passed
      (CVE-2020-25668)
    - cachefiles: Handle readpage error correctly
    - [hppa] hil/parisc: Disable HIL driver when it gets stuck
    - [arm64] Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S
    - [arm64] dts: marvell: espressobin: Add ethernet switch aliases
    - null_blk: synchronization fix for zoned device
    - device property: Keep secondary firmware node secondary by type
    - device property: Don't clear secondary pointer for shared primary
      firmware node
    - [x86] KVM: Fix NULL dereference at kvm_msr_ignored_check()
    - [arm64] KVM: Fix AArch32 handling of DBGD{CCINT,SCRext} and DBGVCR
    - stop_machine, rcu: Mark functions as notrace
    - [x86] staging: comedi: cb_pcidas: Allow 2-channel commands for AO
      subdevice
    - [mips64el,mipsel] staging: octeon: repair "fixed-link" support
    - [mips64el,mipsel] staging: octeon: Drop on uncorrectable alignment or
      FCS error
    - cpufreq: Introduce cpufreq_driver_test_flags()
    - cpufreq: schedutil: Always call driver if CPUFREQ_NEED_UPDATE_LIMITS is
      set
    - time: Prevent undefined behaviour in timespec64_to_ns()
    - time/sched_clock: Mark sched_clock_read_begin/retry() as notrace
    - null_blk: Fix zone reset all tracing
    - null_blk: Fix locking in zoned mode
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.6
    - [x86] ASOC: SOF: Intel: hda-codec: move unused label to correct position

  [ Sudip Mukherjee ]
  * Remove libtraceevent. (See: #971976)

  [ Vagrant Cascadian ]
  * [arm64] Add i2c_mv64xxx i2c-modules udeb.
  * [arm64] Add drivers/pinctrl to kernel-image udeb.

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.9.1-rt20
  * [rt] Drop "io_wq: Make io_wqe::lock a raw_spinlock_t"
  * [rt] Refresh "kernel/sched: move stack + kprobe clean up to
    __put_task_struct()" for context changes in 5.9.3
  * Bump ABI to 2
  * [x86] media/cec: Enable MEDIA_CEC_SUPPORT; Enable CEC_SECO as module
    (Closes: #972973)
  * [rt] Drop "printk: reduce LOG_BUF_SHIFT range for H8300"
  * [rt] Drop "mm: fix exec activate_mm vs TLB shootdown and lazy tlb
    switching race"
  * [x86] pinctrl: Enable PINCTRL_TIGERLAKE (Closes: #973372)
  * [x86] sound/soc: Enable SND_SOC_SOF_TIGERLAKE_SUPPORT (Closes: #973879)
  * perf/core: Fix a memory leak in perf_event_parse_addr_filter()

  [ Ben Hutchings ]
  * [rt] Rebase seqlock patches on top of 5.9.6

  [ John Paul Adrian Glaubitz ]
  * [sh4] Update kernel configuration for sh7785lcr flavor
    - Compile CONFIG_HID, CONFIG_USB_HID, CONFIG_INPUT_EVDEV and
      CONFIG_R8169 as modules to reduce kernel image size
    - Disable CONFIG_KEYBOARD_ATKBD, CONFIG_MOUSE_PS2*, CONFIG_SERIO*
      and CONFIG_PARPORT_1284 as the SH-7785LCR board does not support
      PC-style keyboards, serial and parallel ports and mice

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 08 Nov 2020 13:40:04 +0100

linux (5.9.1-1) unstable; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.9
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.1
    - Bluetooth: A2MP: Fix not initializing all members (CVE-2020-12352)
    - Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel
      (CVE-2020-12351)
    - Bluetooth: MGMT: Fix not checking if BT_HS is enabled
    - media: usbtv: Fix refcounting mixup
    - USB: serial: option: add Cellient MPL200 card
    - USB: serial: option: Add Telit FT980-KS composition
    - [x86] staging: comedi: check validity of wMaxPacketSize of usb endpoints
      found
    - USB: serial: pl2303: add device-id for HP GC device
    - USB: serial: ftdi_sio: add support for FreeCalypso JTAG+UART adapters
    - vt_ioctl: make VT_RESIZEX behave like VT_RESIZE
    - reiserfs: Initialize inode keys properly
    - reiserfs: Fix oops during mount
    - Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers"
    - [x86] crypto: qat - check cipher length for aead AES-CBC-HMAC-SHA

  [ Romain Perier ]
  * [rt] Update to 5.9-rc8-rt12

  [ Uwe Kleine-König ]
  * [armhf,arm64] Enable CONFIG_VIDEO_SUNXI_CEDRUS (Closes: #972123)

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.9-rt16
  * [x86]  ACPI / extlog: Check for RDMSR failure (Closes: #971058)
  * Set ABI to 1

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 17 Oct 2020 15:14:43 +0200

linux (5.9~rc8-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Ben Hutchings ]
  * linux-doc: Correct index filename in package description
  * [amd64/cloud-amd64] Generalise the description of supported platforms

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.9-rc8-rt11

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 05 Oct 2020 23:17:12 +0200

linux (5.9~rc6-1~exp1) experimental; urgency=medium

  * New upstream release candidate:

  [ Ben Hutchings ]
  * linux-signed-*: Set Uploaders and Standards-Version to match linux
  * [rt] Update to 5.9-rc5-rt7 and re-enable

  [ Uwe Kleine-König ]
  * [arm64,generic] Enable configs used on SMARC-sAL28 board and its carriers.
    Patch by Michael Walle.

  [ Gianfranco Costamagna ]
  * Provide virtualbox-guest-modules now that the module is inside the kernel
    itself.

  [ Salvatore Bonaccorso ]
  * Set ABI to trunk
  * drivers/net/wireless: Enable RTW88_8821CE (Closes: #917941)

 -- Ben Hutchings <benh@debian.org>  Mon, 21 Sep 2020 03:23:41 +0100

linux (5.9~rc4-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Ben Hutchings ]
  * Un-export symbols no longer needed by the Android ashmem and binder drivers
  * aufs: Disable support patchset until it is updated for Linux 5.9
  * Makefile: Do not check for libelf when building OOT module
  * udeb: Move any compression modules to kernel-image; drop compress-modules
  * libtraceevent1: Update symbols list for functions added in 5.9
  * drm/virtio: Revert "drm/virtio: Call the right shmem helpers"

 -- Ben Hutchings <benh@debian.org>  Fri, 11 Sep 2020 04:20:59 +0100

linux (5.8.14-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.11
    - dt-bindings: spi: Fix spi-bcm-qspi compatible ordering
    - net: handle the return value of pskb_carve_frag_list() correctly
    - dt-bindings: PCI: intel,lgm-pcie: Fix matching on all snps,dw-pcie
      instances
    - [x86] hv_netvsc: Remove "unlikely" from netvsc_select_queue
    - loop: Set correct device size when using LOOP_CONFIGURE
    - firmware_loader: fix memory leak for paged buffer
    - xprtrdma: Release in-flight MRs on disconnect
    - NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation
      recall
    - [armhf] phy: omap-usb2-phy: disable PHY charger detect
    - scsi: pm8001: Fix memleak in pm8001_exec_internal_task_abort
    - scsi: libfc: Fix for double free()
    - scsi: lpfc: Fix FLOGI/PLOGI receive race condition in pt2pt discovery
    - scsi: lpfc: Extend the RDF FPIN Registration descriptor for additional
      events
    - [arm64] regulator: pwm: Fix machine constraints application
    - NFS: Zero-stateid SETATTR should first return delegation
    - SUNRPC: stop printk reading past end of string
    - cifs: fix DFS mount with cifsacl/modefromsid
    - nvme-fc: cancel async events before freeing event struct
    - nvme-rdma: cancel async events before freeing event struct
    - block: only call sched requeue_request() for scheduled requests
    - f2fs: fix indefinite loop scanning for free nid
    - f2fs: Return EOF on unaligned end of file DIO read
    - i2c: algo: pca: Reapply i2c bus settings after reset
    - spi: Fix memory leak on splited transfers
    - [mips*] KVM: Change the definition of kvm type
    - [arm64,armhf] clk: rockchip: Fix initialization of mux_pll_src_4plls_p
    - [x86] ASoC: Intel: skl_hda_dsp_generic: Fix NULLptr dereference in
      autosuspend delay
    - [arm64] ASoC: qcom: Set card->owner to avoid warnings
    - ASoC: qcom: common: Fix refcount imbalance on error
    - [powerpc*] book3s64/radix: Fix boot failure with large amount of guest
      memory
    - ASoC: soc-core: add snd_soc_find_dai_with_mutex()
    - [x86] ASoC: Intel: haswell: Fix power transition refactor
    - ASoC: core: Do not cleanup uninitialized dais on soc_pcm_open failure
    - [x86] Drivers: hv: vmbus: hibernation: do not hang forever in
      vmbus_bus_resume()
    - scsi: libsas: Fix error path in sas_notify_lldd_dev_found()
    - [arm64] Allow CPUs unffected by ARM erratum 1418040 to come in late
    - [x86] Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload
    - [x86] drm/i915/gem: Reduce context termination list iteration guard to
      RCU
    - fbcon: Fix user font detection test at fbcon_resize().
    - [arm64] bpf: Fix branch offset in JIT
    - [amd64] iommu/amd: Fix potential @entry null deref
    - [amd64] iommu/amd: Restore IRTE.RemapEn bit for
      amd_iommu_activate_guest_mode
    - [riscv64] Add sfence.vma after early page table changes
    - locking/lockdep: Fix "USED" <- "IN-NMI" inversions
    - efi: efibc: check for efivars write capability
    - locking/percpu-rwsem: Use this_cpu_{inc,dec}() for read_count
    - [x86] unwind/fp: Fix FP unwinding in ret_from_fork
    - [x86] drm/i915/gem: Delay tracking the GEM context until it is
      registered
    - [x86] drm/i915: Filter wake_flags passed to default_wake_function
    - USB: quirks: Add USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for BYD zhaoxin
      notebook
    - USB: UAS: fix disconnect by unplugging a hub
    - usblp: fix race between disconnect() and read()
    - [x86] usb: typec: ucsi: acpi: Increase command completion timeout value
    - [x86] usb: typec: ucsi: Prevent mode overrun
    - [x86] i2c: i801: Fix resume bug
    - Revert "ALSA: hda - Fix silent audio output and corrupted input on MSI
      X570-A PRO"
    - ALSA: hda: fixup headset for ASUS GX502 laptop
    - ALSA: hda/realtek - The Mic on a RedmiBook doesn't work
    - percpu: fix first chunk size calculation for populated bitmap
    - Input: trackpoint - add new trackpoint variant IDs
    - Input: i8042 - add Entroware Proteus EL07R4 to nomux and reset lists
    - [x86] thunderbolt: Retry DROM read once if parsing fails
    - serial: 8250_pci: Add Realtek 816a and 816b
    - serial: core: fix port-lock initialisation
    - serial: core: fix console port-lock regression
    - ksm: reinstate memcg charge on copied pages
    - kprobes: fix kill kprobe which has been marked as gone
    - mm/thp: fix __split_huge_pmd_locked() for migration PMD
    - [s390x] add 3f program exception handler
    - [s390x] pci: fix leak of DMA tables on hard unplug
    - [s390x] zcrypt: fix kmalloc 256k failure
    - ehci-hcd: Move include to keep CRC stable
    - [arm64] paravirt: Initialize steal time when cpu is online
    - [powerpc*] dma: Fix dma_map_ops::get_required_mask
    - dm/dax: Fix table reference counts
    - mm/memory_hotplug: drain per-cpu pages again during memory offline
    - dm: Call proper helper to determine dax support
    - dax: Fix compilation for CONFIG_DAX && !CONFIG_FS_DAX
    - mm: memcg: fix memcg reclaim soft lockup
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.12
    - act_ife: load meta modules before tcf_idr_check_alloc()
    - bnxt_en: Avoid sending firmware messages when AER error is detected.
    - bnxt_en: Fix NULL ptr dereference crash in bnxt_fw_reset_task()
    - cxgb4: fix memory leak during module unload
    - cxgb4: Fix offset when clearing filter byte counters
    - geneve: add transport ports in route lookup for geneve (CVE-2020-25645)
    - hdlc_ppp: add range checks in ppp_cp_parse_cr() (CVE-2020-25643)
    - [arm64,x86] hinic: bump up the timeout of SET_FUNC_STATE cmd
    - ip: fix tos reflection in ack and reset packets
    - ipv4: Initialize flowi4_multipath_hash in data path
    - ipv4: Update exception handling for multipath routes via same device
    - ipv6: avoid lockdep issue in fib6_del()
    - net: bridge: br_vlan_get_pvid_rcu() should dereference the VLAN group
      under RCU
    - net: DCB: Validate DCB_ATTR_DCB_BUFFER argument
    - net: Fix bridge enslavement failure
    - net: ipv6: fix kconfig dependency warning for IPV6_SEG6_HMAC
    - net/mlx5: Fix FTE cleanup
    - net: phy: call phy_disable_interrupts() in phy_attach_direct() instead
    - net: sched: initialize with 0 before setting erspan md->u
    - net: sch_generic: aviod concurrent reset and enqueue op for lockless
      qdisc
    - net: sctp: Fix IPv6 ancestor_size calc in sctp_copy_descendant
    - nfp: use correct define to return NONE fec
    - tipc: Fix memory leak in tipc_group_create_member()
    - tipc: fix shutdown() of connection oriented socket
    - tipc: use skb_unshare() instead in tipc_buf_append()
    - net/mlx5e: Enable adding peer miss rules only if merged eswitch is
      supported
    - bnxt_en: Use memcpy to copy VPD field info.
    - bnxt_en: return proper error codes in bnxt_show_temp
    - bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex.
    - net: phy: Avoid NPD upon phy_detach() when driver is unbound
    - net: phy: Do not warn in phy_stop() on PHY_DOWN
    - net: add __must_check to skb_put_padto()
    - [armhf] net: ethernet: ti: cpsw_new: fix suspend/resume
    - wireguard: noise: take lock when removing handshake entry from table
    - wireguard: peerlookup: take lock before checking hash in replace
      operation
    - net/mlx5e: Fix memory leak of tunnel info when rule under multipath not
      ready
    - [arm64,x86] hinic: fix rewaking txq after netif_tx_disable
    - [x86] hv_netvsc: Fix hibernation for mlx5 VF driver
    - [arm64,armhf] net: dsa: link interfaces with the DSA master to get rid
      of lockdep warnings
    - net: macb: fix for pause frame receive enable bit
    - Revert "netns: don't disable BHs when locking "nsid_lock""
    - net/mlx5e: Use RCU to protect rq->xdp_prog
    - net/mlx5e: Use synchronize_rcu to sync with NAPI
    - net/mlx5e: Fix endianness when calculating pedit mask first bit
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.13
    - device_cgroup: Fix RCU list debugging warning
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1
    - [riscv64] Take text_mutex in ftrace_init_nop()
    - [armhf] i2c: aspeed: Mask IRQ status to relevant bits
    - [s390x] init: add missing __init annotations
    - lockdep: fix order in trace_hardirqs_off_caller()
    - i2c: core: Call i2c_acpi_install_space_handler() before
      i2c_acpi_register_devices()
    - objtool: Fix noreturn detection for ignored functions
    - mwifiex: Increase AES key storage size to 256 bits
    - batman-adv: bla: fix type misuse for backbone_gw hash indexing
    - libbpf: Fix build failure from uninitialized variable warning
    - atm: eni: fix the missed pci_disable_device() for eni_init_one()
    - batman-adv: mcast/TT: fix wrongly dropped or rerouted packets
    - netfilter: ctnetlink: add a range check for l3/l4 protonum
      (CVE-2020-25211)
    - netfilter: ctnetlink: fix mark based dump filtering regression
    - netfilter: conntrack: nf_conncount_init is failing with IPv6 disabled
    - netfilter: nft_meta: use socket user_ns to retrieve skuid and skgid
    - mac802154: tx: fix use-after-free
    - bpf: Fix clobbering of r2 in bpf_gen_ld_abs
    - tools/libbpf: Avoid counting local symbols in ABI check
    - [arm*] drm/vc4/vc4_hdmi: fill ASoC card owner
    - net: qed: Disable aRFS for NPAR and 100G
    - net: qede: Disable aRFS for NPAR and 100G
    - net: qed: RDMA personality shouldn't fail VF load
    - igc: Fix wrong timestamp latency numbers
    - igc: Fix not considering the TX delay for timestamps
    - [x86] hv_netvsc: Switch the data path at the right time during
      hibernation
    - RDMA/core: Fix ordering of CQ pool destruction
    - batman-adv: Add missing include for in_interrupt()
    - xsk: Fix number of pinned pages/umem size discrepancy
    - batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN
    - batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh
    - batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
    - bpf: Fix a rcu warning for bpffs map pretty-print
    - mac80211: do not disable HE if HT is missing on 2.4 GHz
    - cfg80211: fix 6 GHz channel conversion
    - mac80211: fix 80 MHz association to 160/80+80 AP on 6 GHz
    - [x86] ALSA: asihpi: fix iounmap in error handler
    - io_uring: fix openat/openat2 unified prep handling
    - SUNRPC: Fix svc_flush_dcache()
    - regmap: fix page selection for noinc reads
    - regmap: fix page selection for noinc writes
    - net/mlx5e: mlx5e_fec_in_caps() returns a boolean
    - [mips64el,mipsel] Loongson-3: Fix fp register access if MSA enabled
    - [armhf] PM / devfreq: tegra30: Disable clock on error in probe
    - [arm64,armhf] regulator: axp20x: fix LDO2/4 description
    - [x86] KVM: Reset MMU context if guest toggles CR4.SMAP or CR4.PKE
    - [x86] KVM: SVM: Add a dedicated INVD intercept routine
    - mm: validate pmd after splitting
    - [x86] arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache
      writeback
    - [x86] irq: Make run_on_irqstack_cond() typesafe
    - [x86] ioapic: Unbreak check_timer()
    - scsi: lpfc: Fix initial FLOGI failure due to BBSCN not supported
    - ALSA: usb-audio: Add delay quirk for H570e USB headsets
    - ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged
    - ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation
      P520
    - lib/string.c: implement stpcpy
    - tracing: fix double free
    - [s390x] dasd: Fix zero write for FBA devices
    - kprobes: Fix to check probe enabled before disarm_kprobe_ftrace()
    - kprobes: tracing/kprobes: Fix to kill kprobes on initmem after boot
    - btrfs: fix put of uninitialized kobject after seed device delete
    - btrfs: fix overflow when copying corrupt csums for a message
    - media: cec-adap.c: don't use flush_scheduled_work()
    - dmabuf: fix NULL pointer dereference in dma_buf_release()
    - mm, THP, swap: fix allocating cluster for swapfile by mistake
    - mm/gup: fix gup_fast with dynamic page table folding
    - mm: replace memmap_context by meminit_context
    - mm: don't rely on system state to detect hot-plug operations
    - [s390x] zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl
    - io_uring: ensure open/openat2 name is cleaned on cancelation
    - [arm64] KVM: Assume write fault on S1PTW permission fault on instruction
      fetch
    - dm: fix bio splitting and its bio completion order for regular IO
    - [armhf] clocksource/drivers/timer-ti-dm: Do reset before enable
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.14
    - io_uring: always delete double poll wait entry on match
    - btrfs: fix filesystem corruption after a device replace
    - mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS
      models
    - USB: gadget: f_ncm: Fix NDP16 datagram validation
    - Revert "usbip: Implement a match function to fix usbip"
    - usbcore/driver: Fix specific driver selection
    - usbcore/driver: Fix incorrect downcast
    - usbcore/driver: Accommodate usbip
    - [x86] gpio: amd-fch: correct logic of GPIO_LINE_DIRECTION
    - [armhf] clk: samsung: Keep top BPLL mux on Exynos542x enabled
    - scsi: iscsi: iscsi_tcp: Avoid holding spinlock while calling
      getpeername()
    - [arm64,x86] i2c: i801: Exclude device from suspend direct complete
      optimization
    - Input: i8042 - add nopnp quirk for Acer Aspire 5 A515
    - ftrace: Move RCU is watching check after recursion check
    - tracing: Fix trace_find_next_entry() accounting of temp buffer size
    - memstick: Skip allocating card when removing host
    - drm/amdgpu: restore proper ref count in amdgpu_display_crtc_set_config
    - xen/events: don't use chip_data for legacy IRQs
    - [x86] vboxsf: Fix the check for the old binary mount-arguments struct
    - drivers/net/wan/hdlc_fr: Add needed_headroom for PVC devices
    - Revert "wlcore: Adding suppoprt for IGTK key in wlcore driver"
    - [arm64,armhf] drm/sun4i: mixer: Extend regmap max_register
    - [x86] hv_netvsc: Cache the current data path to avoid duplicate call and
      message
    - net: dec: de2104x: Increase receive ring size for Tulip
    - rndis_host: increase sleep time in the query-response loop
    - nvme-pci: disable the write zeros command for Intel 600P/P3100
    - nvme-core: get/put ctrl and transport module in nvme_dev_open/release()
    - fuse: fix the ->direct_IO() treatment of iov_iter
    - drivers/net/wan/hdlc: Set skb->protocol before transmitting
    - mac80211: Fix radiotap header channel flag for 6GHz band
    - mac80211: do not allow bigger VHT MPDUs than the hardware supports
    - tracing: Make the space reserved for the pid wider
    - tools/io_uring: fix compile breakage
    - io_uring: mark statx/files_update/epoll_ctl as non-SQPOLL
    - cpuidle: psci: Fix suspicious RCU usage
    - nvme-pci: fix NULL req in completion handler
    - nvme-fc: fail new connections to a deleted host or remote port
    - scripts/kallsyms: skip ppc compiler stub *.long_branch.* /
      *.plt_branch.*
    - [armhf] pinctrl: mvebu: Fix i2c sda definition for 98DX3236
    - nfs: Fix security label length not being reset
    - NFSv4.2: fix client's attribute cache management for copy_file_range
    - pNFS/flexfiles: Ensure we initialise the mirror bsizes correctly on read
    - [arm64,armhf] clk: tegra: Always program PLL_E when enabled
    - [arm64,armhf] clk: tegra: Fix missing prototype for
      tegra210_clk_register_emc()
    - [armhf] clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED
    - scsi: target: Fix lun lookup for TARGET_SCF_LOOKUP_LUN_FROM_TAG case
    - [arm64,armhf] gpio: pca953x: Fix uninitialized pending variable
    - Input: trackpoint - enable Synaptics trackpoints
    - blk-mq: call commit_rqs while list empty but error happen
    - scripts/dtc: only append to HOST_EXTRACFLAGS instead of overwriting
    - autofs: use __kernel_write() for the autofs pipe writing
    - [arm64,armhf] gpio: pca953x: Correctly initialize registers 6 and 7 for
      PCA957x
    - [amd64] iommu/amd: Fix the overwritten field in IVMD header
    - pipe: remove pipe_wait() and fix wakeup race with splice
    - random32: Restore __latent_entropy attribute on net_rand_state
    - gpiolib: Fix line event handling in syscall compatible mode
    - [x86] drm/i915/gvt: Fix port number for BDW on EDID region setup
    - scsi: sd: sd_zbc: Fix handling of host-aware ZBC disks
    - scsi: sd: sd_zbc: Fix ZBC disk initialization
    - epoll: do not insert into poll queues until all sanity checks are done
    - epoll: replace ->visited/visited_list with generation count
    - epoll: EPOLL_CTL_ADD: close the race in decision to take fast path
    - ep_create_wakeup_source(): dentry name can change under you...

  [ Vagrant Cascadian ]
  * [armhf] Enable MFD_AXP20X_RSB as a built-in (Closes: #914813). Thanks
    to Bernhard.

  [ Salvatore Bonaccorso ]
  * [x86] Enable INTEL_PMC_CORE as module (Closes: #971017)
  * Bump ABI to 3

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 10 Oct 2020 21:40:31 +0200

linux (5.8.10-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.8
    - HID: quirks: Always poll three more Lenovo PixArt mice
    - [arm64] drm/msm/dpu: Fix reservation failures in modeset
    - [arm64] drm/msm/dpu: Fix scale params in plane validation
    - [arm64] drm/msm/dpu: fix unitialized variable error
    - [arm64] drm/msm: add shutdown support for display platform_driver
    - [x86] hwmon: (applesmc) check status earlier.
    - nvmet: Disable keep-alive timer when kato is cleared to 0h
    - [arm64] drm/msm: enable vblank during atomic commits
    - [arm64] drm/msm/a6xx: fix gmu start on newer firmware
    - gfs2: add some much needed cleanup for log flushes that fail
    - [x86] hv_utils: return error if host timesysnc update is stale
    - [x86] hv_utils: drain the timesync packets on onchannelcallback
    - ceph: don't allow setlease on cephfs
    - [armhf] drm/omap: fix incorrect lock state
    - cpuidle: Fixup IRQ state
    - nbd: restore default timeout when setting it to zero
    - [s390x] don't trace preemption in percpu macros
    - xen/xenbus: Fix granting of vmalloc'd memory
    - dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling
    - batman-adv: Avoid uninitialized chaddr when handling DHCP
    - batman-adv: Fix own OGM check in aggregated OGMs
    - batman-adv: bla: use netif_rx_ni when not in interrupt context
    - rxrpc: Keep the ACK serial in a var in rxrpc_input_ack()
    - rxrpc: Fix loss of RTT samples due to interposed ACK
    - rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
    - [mips*] mm: BMIPS5000 has inclusive physical caches
    - [arm64,x86] mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040
    - perf sched timehist: Fix use of CPU list with summary option
    - perf top: Skip side-band event setup if HAVE_LIBBPF_SUPPORT is not set
    - netfilter: nf_tables: add NFTA_SET_USERDATA if not null
    - netfilter: nf_tables: incorrect enum nft_list_attributes definition
    - netfilter: nf_tables: fix destination register zeroing
    - [arm64] net: hns: Fix memleak in hns_nic_dev_probe
    - bpf: Fix a buffer out-of-bound access when filling raw_tp link_info
    - [arm64,armhf] dmaengine: pl330: Fix burst length if burst size is
      smaller than bus width
    - gtp: add GTPA_LINK info to msg sent to userspace
    - [armhf] net: ethernet: ti: cpsw: fix clean up of vlan mc entries for
      host port
    - [armhf] net: ethernet: ti: cpsw_new: fix clean up of vlan mc entries for
      host port
    - bnxt_en: Don't query FW when netif_running() is false.
    - bnxt_en: Check for zero dir entries in NVRAM.
    - bnxt_en: Fix ethtool -S statitics with XDP or TCs enabled.
    - bnxt_en: Fix PCI AER error recovery flow
    - bnxt_en: Fix possible crash in bnxt_fw_reset_task().
    - bnxt_en: fix HWRM error when querying VF temperature
    - xfs: finish dfops on every insert range shift iteration
    - xfs: fix boundary test in xfs_attr_shortform_verify
    - bnxt: don't enable NAPI until rings are ready
    - [armhf] net: ethernet: ti: cpsw_new: fix error handling in
      cpsw_ndo_vlan_rx_kill_vid()
    - netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of
      ENOBUFS
    - nvmet-fc: Fix a missed _irqsave version of spin_lock in
      'nvmet_fc_fod_op_done()'
    - nvme: fix controller instance leak
    - netfilter: conntrack: do not auto-delete clash entries on reply
    - opp: Don't drop reference for an OPP table that was never parsed
    - cxgb4: fix thermal zone device registration
    - [mips*] perf: Fix wrong check condition of Loongson event IDs
    - block: fix locking in bdev_del_partition
    - perf top/report: Fix infinite loop in the TUI for grouped events
    - perf cs-etm: Fix corrupt data after perf inject from
    - perf intel-pt: Fix corrupt data after perf inject from
    - perf tools: Correct SNOOPX field offset
    - net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init()
    - fix regression in "epoll: Keep a reference on files added to the check
      list"
    - [arm64] net: bcmgenet: fix mask check in bcmgenet_validate_flow()
    - nfp: flower: fix ABI mismatch between driver and firmware
    - net: dp83867: Fix WoL SecureOn password
    - [mips*] add missing MSACSR and upper MSA initialization
    - xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt
      files
    - perf jevents: Fix suspicious code in fixregex()
    - perf stat: Turn off summary for interval mode by default
    - perf bench: The do_run_multi_threaded() function must use
      IS_ERR(perf_session__new())
    - tg3: Fix soft lockup when tg3_reset_task() fails.
    - [amd64] x86, fakenuma: Fix invalid starting node ID
    - [amd64] iommu/vt-d: Serialize IOMMU GCMD register modifications
    - [armhf] thermal: ti-soc-thermal: Fix bogus thermal shutdowns for
      omap4430
    - [arm64] thermal: qcom-spmi-temp-alarm: Don't suppress negative temp
    - [amd64] iommu/amd: Restore IRTE.RemapEn bit after programming IRTE
    - [amd64] iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE
    - [amd64] iommu/vt-d: Handle 36bit addressing for x86-32
    - [x86] tracing/kprobes, x86/ptrace: Fix regs argument order for i386
    - [x86] entry: Fix AC assertion
    - [x86] debug: Allow a single level of #DB recursion
    - ext2: don't update mtime on COW faults
    - xfs: don't update mtime on COW faults
    - btrfs: drop path before adding new uuid tree entry
    - btrfs: fix potential deadlock in the search ioctl
    - btrfs: allocate scrub workqueues outside of locks
    - btrfs: set the correct lockdep class for new nodes
    - btrfs: set the lockdep class for log tree extent buffers
    - btrfs: block-group: fix free-space bitmap threshold
    - btrfs: tree-checker: fix the error message for transid error
    - Bluetooth: Return NOTIFY_DONE for hci_suspend_notifier (Closes: #964839)
    - [x86] mm/32: Bring back vmalloc faulting on x86_32
    - Revert "ALSA: hda: Add support for Loongson 7A1000 controller"
    - ALSA: ca0106: fix error code handling
    - ALSA: usb-audio: Add basic capture support for Pioneer DJ DJM-250MK2
    - ALSA: usb-audio: Add implicit feedback quirk for UR22C
    - ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check
    - ALSA: hda/hdmi: always check pin power status in i915 pin fixup
    - ALSA: firewire-digi00x: exclude Avid Adrenaline from detection
    - ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A
      PRO
    - ALSA; firewire-tascam: exclude Tascam FE-8 from detection
    - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A
    - ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen
    - mmc: sdhci-pci: Fix SDHCI_RESET_ALL for CQHCI for Intel GLK-based
      controllers
    - media: rc: do not access device via sysfs after rc_unregister_device()
    - media: rc: uevent sysfs file races with rc_unregister_device()
    - affs: fix basic permission bits to actually work
    - block: allow for_each_bvec to support zero len bvec
    - block: ensure bdi->io_pages is always initialized
    - io_uring: set table->files[i] to NULL when io_sqe_file_register failed
    - io_uring: fix removing the wrong file in __io_sqe_files_update()
    - libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks
    - [mips*] oprofile: Fix fallthrough placement
    - blk-stat: make q->stats->lock irqsafe
    - [x86] drm/i915: Fix sha_text population code
    - dm writecache: handle DAX to partitions on persistent memory correctly
    - dm mpath: fix racey management of PG initialization
    - dm integrity: fix error reporting in bitmap mode after creation
    - dm crypt: Initialize crypto wait structures
    - dm cache metadata: Avoid returning cmd->bm wild pointer on error
    - dm thin metadata: Avoid returning cmd->bm wild pointer on error
    - dm thin metadata: Fix use-after-free in dm_bm_set_read_only
    - mm: slub: fix conversion of freelist_corrupted()
    - mm: track page table modifications in __apply_to_page_range()
    - mm: madvise: fix vma user-after-free
    - mm/rmap: fixup copying of soft dirty and uffd ptes
    - io_uring: no read/write-retry on -EAGAIN error and O_NONBLOCK marked
      file
    - perf record: Correct the help info of option "--no-bpf-event"
    - [arm64,armhf] sdhci: tegra: Add missing TMCLK for data timeout
    - mm/migrate: fixup setting UFFD_WP flag
    - mm/hugetlb: try preferred node first when alloc gigantic page from cma
    - mm/hugetlb: fix a race between hugetlb sysctl handlers (CVE-2020-25285)
    - mm/khugepaged.c: fix khugepaged's request size in collapse_file
    - cfg80211: regulatory: reject invalid hints
    - net: usb: Fix uninit-was-stored issue in asix_read_phy_addr()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.9
    - io_uring: fix cancel of deferred reqs with ->files
    - io_uring: fix linked deferred ->files cancellation
    - RDMA/cma: Simplify DEVICE_REMOVAL for internal_id
    - RDMA/cma: Using the standard locking pattern when delivering the removal
      event
    - RDMA/cma: Remove unneeded locking for req paths
    - RDMA/cma: Execute rdma_cm destruction from a handler properly
    - ipv4: Silence suspicious RCU usage warning
    - ipv6: Fix sysctl max for fib_multipath_hash_policy
    - netlabel: fix problems with mapping removal
    - net: usb: dm9601: Add USB ID of Keenetic Plus DSL
    - sctp: not disable bh in the whole sctp_get_port_local()
    - tipc: fix shutdown() of connectionless socket
    - tipc: fix using smp_processor_id() in preemptible
    - net: disable netpoll on fresh napis
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.10
    - [armhf] OMAP2+: Fix an IS_ERR() vs NULL check in _get_pwrdm()
    - regulator: push allocation in regulator_ena_gpio_request() out of lock
    - regulator: remove superfluous lock in regulator_resolve_coupling()
    - RDMA/rxe: Fix memleak in rxe_mem_init_user
    - RDMA/rxe: Drop pointless checks in rxe_init_ports
    - RDMA/rxe: Fix panic when calling kmem_cache_create()
    - [arm64,armhf] drm/sun4i: add missing put_device() call in
      sun8i_r40_tcon_tv_set_mux()
    - [armhf] drm/sun4i: Fix dsi dcs long write function
    - scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA
    - drm/virtio: fix unblank
    - RDMA/core: Fix unsafe linked list traversal after failing to allocate CQ
    - RDMA/core: Fix reported speed and width
    - scsi: megaraid_sas: Don't call disable_irq from process IRQ poll
    - scsi: mpt3sas: Don't call disable_irq from IRQ poll handler
    - padata: fix possible padata_works_lock deadlock
    - [arm64,armhf] drm/sun4i: Fix DE2 YVU handling
    - [arm64,armhf] drm/sun4i: backend: Support alpha property on lowest plane
    - [arm64,armhf] drm/sun4i: backend: Disable alpha on the lowest plane on
      the A20
    - [arm64] KVM: Update page shift if stage 2 block mapping not supported
    - [arm64,x86] mmc: sdhci-acpi: Clear amd_sdhci_host on reset
    - [arm64] mmc: sdhci-msm: Add retries when all tuning phases are found
      valid
    - [armhf] spi: stm32: Rate-limit the 'Communication suspended' message
    - btrfs: fix NULL pointer dereference after failure to create snapshot
    - block: restore a specific error code in bdev_del_partition
    - seccomp: don't leak memory when filter install races
    - nvme-fabrics: allow to queue requests for live queues
    - [armhf] spi: stm32: fix pm_runtime_get_sync() error checking
    - block: Set same_page to false in __bio_try_merge_page if ret is false
    - IB/isert: Fix unaligned immediate-data handling
    - [x86] KVM: nVMX: Fix the update value of nested load
      IA32_PERF_GLOBAL_CTRL control
    - [x86] KVM: always allow writing '0' to MSR_KVM_ASYNC_PF_EN
    - [arm64,x86] dmaengine: acpi: Put the CSRT table after using it
    - netfilter: conntrack: allow sctp hearbeat after connection re-use
    - netfilter: nft_set_rbtree: Detect partial overlap with start endpoint
      match
    - [x86] firestream: Fix memleak in fs_open
    - scsi: qedf: Fix null ptr reference in qedf_stag_change_work
    - [arm64,armhf] ALSA: hda: Fix 2 channel swapping for Tegra
    - [arm64,armhf] ALSA: hda/tegra: Program WAKEEN register for Tegra
    - [arm64] net: hns3: Fix for geneve tx checksum bug
    - xfs: fix off-by-one in inode alloc block reservation calculation
    - wireless: fix wrong 160/80+80 MHz setting
    - mac80211: reduce packet loss event false positives
    - cfg80211: Adjust 6 GHz frequency to channel conversion
    - xfs: initialize the shortform attr header padding entry
    - nvme-fabrics: don't check state NVME_CTRL_NEW for request acceptance
    - nvme: have nvme_wait_freeze_timeout return if it timed out
    - nvme-rdma: serialize controller teardown sequences
    - nvme-rdma: fix timeout handler
    - nvme-rdma: fix reset hang if controller died in the middle of a reset
    - nvme-pci: cancel nvme device request before disabling
    - HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for all Saitek X52 devices
    - HID: microsoft: Add rumble support for the 8bitdo SN30 Pro+ controller
    - drivers/net/wan/hdlc_cisco: Add hard_header_len
    - HID: elan: Fix memleak in elan_input_configured
    - [x86] cpufreq: intel_pstate: Refuse to turn off with HWP enabled
    - [x86] cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo
      disabled
    - [arm64] module: set trampoline section flags regardless of
      CONFIG_DYNAMIC_FTRACE
    - ALSA: hda: hdmi - add Rocketlake support
    - ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled
    - ALSA: hda: use consistent HDAudio spelling in comments/docs
    - drivers/net/wan/hdlc: Change the default of hard_header_len to 0
    - [amd64] iommu/amd: Do not force direct mapping when SME is active
    - [amd64] iommu/amd: Do not use IOMMUv2 functionality when SME is active
    - gcov: Disable gcov build with GCC 10
    - iio: adc: ti-ads1015: fix conversion when CONFIG_PM is not set
    - [arm64] iio: cros_ec: Set Gyroscope default frequency to 25Hz
    - [x86] iio:accel:bmc150-accel: Fix timestamp alignment and prevent data
      leak.
    - [x86] iio:magnetometer:ak8975 Fix alignment and data leak issues.
    - [armhf] iio:accel:mma8452: Fix timestamp alignment and prevent data
      leak.
    - [x86] staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb()
    - btrfs: require only sector size alignment for parent eb bytenr
    - btrfs: fix lockdep splat in add_missing_dev
    - btrfs: free data reloc tree on failed mount
    - btrfs: fix wrong address when faulting in pages in the search ioctl
    - [x86] thunderbolt: Disable ports that are not implemented
    - kobject: Restore old behaviour of kobject_del(NULL)
    - regulator: push allocation in regulator_init_coupling() outside of lock
    - regulator: push allocations in create_regulator() outside of lock
    - regulator: push allocation in set_consumer_device_supply() out of lock
    - regulator: plug of_node leak in regulator_register()'s error path
    - regulator: core: Fix slab-out-of-bounds in regulator_unlock_recursive()
    - misc: eeprom: at24: register nvmem only after eeprom is ready to use
    - scsi: target: iscsi: Fix data digest calculation
    - scsi: lpfc: Fix setting IRQ affinity with an empty CPU mask
    - scsi: target: iscsi: Fix hang in iscsit_access_np() when getting
      tpg->np_login_sem
    - [arm64] drm/msm: Split the a5xx preemption record
    - [arm64] drm/msm: Disable preemption on all 5xx targets
    - [arm64] drm/msm: Disable the RPTR shadow
    - mmc: sdio: Use mmc_pre_req() / mmc_post_req()
    - [arm64] mmc: sdhci-of-esdhc: Don't walk device-tree on every interrupt
    - nvme: Revert: Fix controller creation races with teardown flow
    - rbd: require global CAP_SYS_ADMIN for mapping and unmapping
      (CVE-2020-25284)
    - RDMA/rxe: Fix the parent sysfs read when the interface has 15 chars
    - RDMA/mlx4: Read pkey table length instead of hardcoded value
    - fbcon: remove soft scrollback code (CVE-2020-14390)
    - fbcon: remove now unusued 'softback_lines' cursor() argument
    - vgacon: remove software scrollback support
    - [x86] KVM: VMX: Don't freeze guest when event delivery causes an
      APIC-access exit
    - [arm64] KVM: Do not try to map PUDs when they are folded into PMD
    - [x86] kvm x86/mmu: use KVM_REQ_MMU_SYNC to sync when needed
    - KVM: fix memory leak in kvm_io_bus_unregister_dev()
    - [arm64,armhf] Revert "usb: dwc3: meson-g12a: fix shared reset control
      use"
    - debugfs: Fix module state check condition
    - test_firmware: Test platform fw loading on non-EFI systems
    - [x86] video: fbdev: fix OOB read in vga_8planes_imageblit()
    - [arm64] phy: qcom-qmp: Use correct values for ipq8074 PCIe Gen2 PHY init
    - usb: core: fix slab-out-of-bounds Read in read_descriptors
    - USB: serial: ftdi_sio: add IDs for Xsens Mti USB converter
    - USB: serial: option: support dynamic Quectel USB compositions
    - USB: serial: option: add support for SIM7070/SIM7080/SIM7090 modules
    - usb: Fix out of sync data toggle if a configured device is reconfigured
    - [x86] usb: typec: ucsi: acpi: Check the _DEP dependencies
    - [arm64] drm/msm/gpu: make ringbuffer readonly
    - gcov: add support for GCC 10.1

  [ Salvatore Bonaccorso ]
  * [x86] drivers/input/keyboard: Enable KEYBOARD_APPLESPI as module
    (Closes: #943337)
  * drivers/net/wireless: Enable RTW88_8723DE
  * Bump ABI to 2
  * udeb: Make input-modules depend on crc-modules.

  [ Vagrant Cascadian ]
  * [arm64] Enable BATTERY_CW2015 as a module.
  * [arm64] Apply patch from upstream to support battery status on
    Pinebook Pro.

  [ Ben Hutchings ]
  * [hppa] Set Build-Profiles for linux-image-parisc{,64}-smp (Closes: #970011)
  * Provide linux-{image,headers}-generic virtual packages on most
    architectures (Closes: #960209)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 19 Sep 2020 14:17:19 +0200

linux (5.8.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.4
    - ext4: fix potential negative array index in do_split() (CVE-2020-14314)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.5
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.6
    - nfsd: fix oops on mixed NFSv4/NFSv3 client access
    - [powerpc] 32s: Disable VMAP stack which CONFIG_ADB_PMU (Closes: #963689)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.7

  [ Ben Hutchings ]
  * [mips*] udeb: Drop hfs-modules (fixes FTBFS)
  * [m68k,powerpc,ppc64] udeb: Make hfs-modules depend on cdrom-core-modules
    (fixes FTBFS)
  * tools/include/uapi: Fix <asm/errno.h> (probably fixes FTBFS on ia64)
  * bpftool: Build with Debian recommended compiler options

  [ Salvatore Bonaccorso ]
  * iwlwifi: yoyo: don't print failure if debug firmware is missing
    (Closes: #966218)
  * debian/tests/python: pycodestyle: Increase max-line-length to 100.
  * net/packet: fix overflow in tpacket_rcv (CVE-2020-14386)
  * Set ABI to 1

  [ Uwe Kleine-König ]
  * [arm64] Enable a few options for Kobol's helios64

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 05 Sep 2020 16:52:44 +0200

linux (5.8.3-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.8
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.2
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.3

  [ Jeremy Stanley ]
  * [x86] PMIC operation region support (Closes: #925965)
    - Enable CONFIG_PMIC_OPREGION for general ACPI support of operation
      regions with Power Management Integrated Circuits. Turn on specific
      opregion support for:
      + CONFIG_BYTCRC_PMIC_OPREGION (Bay Trail Crystal Cove PMIC)
      + CONFIG_CHTCRC_PMIC_OPREGION (Cherry Trail Crystal Cove PMIC)
      + CONFIG_XPOWER_PMIC_OPREGION (XPower AXP288 PMIC)
      + CONFIG_BXT_WC_PMIC_OPREGION (BXT WhiskeyCove PMIC)
      + CONFIG_CHT_WC_PMIC_OPREGION (CHT Whiskey Cove PMIC)
      + CONFIG_CHT_DC_TI_PMIC_OPREGION (Dollar Cove TI PMIC)
      Additionally enable CONFIG_MFD_INTEL_PMC_BXT as a module (multi-function
      device driver for Intel Broxton Whiskey Cove PMIC), along with
      CONFIG_INTEL_SOC_PMIC (Crystal Cove PMIC) as a dependency for it.
  * [x86] Fix Cherry Trail power management regression (Closes: #949886)
    - Switch CONFIG_I2C_DESIGNWARE_PLATFORM from being compiled as a module to
      compiled into the kernel directly, since as of kernel version 5.1 this
      state became a dependency for CONFIG_INTEL_SOC_PMIC_CHTWC which is
      already enabled.
    - Enable CONFIG_USB_ROLES_INTEL_XHCI and CONFIG_TYPEC_MUX_PI3USB30532 as
      modules, which became dependencies for the already enabled
      CONFIG_INTEL_CHT_INT33FE as of kernel version 4.17.

  [ Romain Perier ]
  * Rebased patches onto 5.8.

  [ Uwe Kleine-König ]
  * [armhf] Enable BCM2835 auxiliar mini UART support found on Raspberry Pi
    (all models); patch by Marc Kleine-Budde. (Closes: #963619)
  * [arm64] Enable IR_MESON and SPI_MESON_SPICC.

  [ Helge Deller ]
  * [hppa] Build linux-image-parisc-smp and linux-image-parisc64-smp
    transition packages

  [ Yves-Alexis Perez ]
  * usb: Enable APPLE_MFI_FASTCHARGE as a module

  [ Salvatore Bonaccorso ]
  * Set ABI to trunk

  [ Bastian Blank ]
  * [x86] hyperv-daemons:
    - Rename services to remove "hyperv-daemons." prefix
    - Use debhelper for services.
    - Make systemd service bind to device.
    - Start kvp daemon way earlier in boot.
    - Specify some service restrictions.
  * udeb: Reverse order of cdrom-core and isofs/udf.
  * Fix build of documentation.
  * [amd64] Enable GVE. (closes: #964812)
  * Compile with gcc-10 on all architectures.
  * [cloud] Enable TARGET_CORE. (closes: #952108)
  * [cloud] Disable DLM, GFS2_FS, OCFS2_FS.
  * Move System.map into debug package and replace with pointer.

  [ Ben Hutchings ]
  * [x86] hyperv-daemons: Complete renaming of init scripts
  * [x86] hyperv-daemons: Correct old names in Conflicts field of unit files
  * [hppa] Use standard metadata for transitional packages
  * bpftool: Fix version string in recursive builds
  * Revert "linux-libc-dev: Re-add "Provides: linux-kernel-headers""
    (Closes: #959462)
  * mm: Enable INIT_ON_ALLOC_DEFAULT_ON. This can be reverted using the
    kernel parameter: init_on_alloc=0
  * libtraceevent1: Add new APIs to symbols file

  [ Christian Barcenas ]
  * bpftool: add packaging for tools/bpf/bpftool (Closes: #896165)
    - Thank you to Noah Meyerhans for the first iteration of packaging.

  [ Thomas W ]
  * [x86] Enable CONFIG_XIAOMI_WMI

  [ Matthew Gabeler-Lee ]
  * [x86] Re-enable APU2 LED control (Closes: 949448)

  [ Joel Stanley ]
  * [armhf] Enable NET_NCSI

  [ Walter Lozano ]
  * [armhf] Enable NVMEM_IMX_OCOTP (Closes: #968253)

  [ Philipp Kern ]
  * [s390x] Add virtio_net to nic-modules.

 -- Ben Hutchings <benh@debian.org>  Mon, 24 Aug 2020 01:23:22 +0100

linux (5.7.17-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.11
    - bpf: Set the number of exception entries properly for subprograms
    - mac80211: allow rx of mesh eapol frames with default rx key
    - scsi: scsi_transport_spi: Fix function pointer check
    - scsi: mpt3sas: Fix unlock imbalance
    - ALSA: hda/hdmi: fix failures at PCM open on Intel ICL and later
    - net: sky2: initialize return of gm_phy_read
    - drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout
    - scsi: mpt3sas: Fix error returns in BRM_status_show
    - scsi: dh: Add Fujitsu device to devinfo and dh lists
    - dm: use bio_uninit instead of bio_disassociate_blkg
    - fuse: fix weird page warning
    - [x86] irqdomain/treewide: Keep firmware node unconditionally allocated
    - SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct
      IO compeletion")
    - exfat: fix overflow issue in exfat_cluster_to_sector()
    - exfat: fix wrong hint_stat initialization in exfat_find_dir_entry()
    - exfat: fix wrong size update of stream entry by typo
    - exfat: fix name_hash computation on big endian systems
    - btrfs: reloc: clear DEAD_RELOC_TREE bit for orphan roots to prevent
      runaway balance
    - uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to
      fix GDB regression
    - ALSA: hda/realtek: Fixed ALC298 sound bug by adding quirk for Samsung
      Notebook Pen S
    - ALSA: info: Drop WARN_ON() from buffer NULL sanity check
    - [x86] ASoC: rt5670: Correct RT5670_LDO_SEL_MASK
    - [x86] ASoC: Intel: cht_bsw_rt5672: Change bus format to I2S 2 channel
    - [s390x] cpum_cf,perf: change DFLT_CCERROR counter name
    - btrfs: fix double free on ulist after backref resolution failure
    - btrfs: fix mount failure caused by race with umount
    - btrfs: fix page leaks after failure to lock page for delalloc
    - mt76: mt76x02: fix handling MCU timeouts during hw restart
    - efi/efivars: Expose RT service availability via efivars abstraction
    - bnxt_en: Fix race when modifying pause settings.
    - bnxt_en: Init ethtool link settings after reading updated PHY
      configuration.
    - bnxt_en: Fix completion ring sizing with TPA enabled.
    - [x86] hippi: Fix a size used in a 'pci_free_consistent()' in an error
      handling path
    - netfilter: nf_tables: fix nat hook table deletion
    - [arm64] dpaa2-eth: check fsl_mc_get_endpoint for IS_ERR_OR_NULL()
    - vsock/virtio: annotate 'the_virtio_vsock' RCU pointer
    - ax88172a: fix ax88172a_unbind() failures
    - RDMA/mlx5: Use xa_lock_irq when access to SRQ table
    - RDMA/core: Fix race in rdma_alloc_commit_uobject()
    - RDMA/cm: Protect access to remote_sidr_table
    - [armhf] net: fec: fix hardware time stamping by external devices
    - [x86] ASoC: Intel: bytcht_es8316: Add missed put_device()
    - ieee802154: fix one possible memleak in adf7242_probe
    - [arm64,armhf] drm: sun4i: hdmi: Fix inverted HPD result
    - [arm64,armhf] net: smc91x: Fix possible memory leak in smc_drv_probe()
    - [arm64,armhf] net: dsa: mv88e6xxx: fix in-band AN link establishment
    - [arm64] dts: clearfog-gt-8k: fix switch link configuration
    - bonding: check error value of register_netdevice() immediately
    - iwlwifi: Make some Killer Wireless-AC 1550 cards work again
    - [arm64] net: bcmgenet: fix error returns in bcmgenet_probe()
    - RDMA/mlx5: Prevent prefetch from racing with implicit destruction
    - [arm64] net: hns3: fix for not calculating TX BD send size correctly
    - [arm64] net: hns3: fix error handling for desc filling
    - [arm64] net: hns3: fix return value error when query MAC link status
      fail
    - qed: suppress "don't support RoCE & iWARP" flooding on HW init
    - qed: suppress false-positives interrupt error messages on HW init
    - ipvs: fix the connection sync failed in some cases
    - [arm64] iommu/qcom: Use domain rather than dev as tlb cookie
    - Revert "PCI/PM: Assume ports without DLL Link Active train links in 100
      ms"
    - nfsd4: fix NULL dereference in nfsd/clients display code
    - bonding: check return value of register_netdevice() in bond_newlink()
    - geneve: fix an uninitialized value in geneve_changelink()
    - serial: exar: Fix GPIO configuration for Sealevel cards based on
      XR17V35X
    - scripts/decode_stacktrace: strip basepath from all paths
    - scripts/gdb: fix lx-symbols 'gdb.error' while loading modules
    - [riscv64] Do not rely on initrd_start/end computed during early dt
      parsing
    - kbuild: fix single target builds for external modules
    - [arm64,x86] HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor
      override
    - HID: alps: support devices with report id 2
    - HID: steam: fixes race in handling device list.
    - dmaengine: idxd: fix hw descriptor fields for delta record
    - HID: apple: Disable Fn-key key-re-mapping on clone keyboards
    - [arm64] dmaengine: tegra210-adma: Fix runtime PM imbalance on error
    - [arm64,armhf] soc: amlogic: meson-gx-socinfo: Fix S905X3 and S905D3 ID's
    - Input: add `SW_MACHINE_COVER`
    - [armhf] dts: n900: remove mmc1 card detect gpio
    - regmap: dev_get_regmap_match(): fix string comparison
    - hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow
    - [amd64] dmaengine: ioat setting ioat timeout as module parameter
    - Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen
    - Input: elan_i2c - only increment wakeup count on touch
    - [arm64] usb: dwc3: pci: add support for the Intel Tiger Lake PCH -H
      variant
    - [arm64] usb: dwc3: pci: add support for the Intel Jasper Lake
    - drm/amdgpu/gfx10: fix race condition for kiq
    - drm/amdgpu: fix preemption unit test
    - hwmon: (nct6775) Accept PECI Calibration as temperature source for
      NCT6798D
    - [x86] platform: asus-wmi: allow BAT1 battery name
    - ALSA: hda/realtek - fixup for yet another Intel reference board
    - drivers/perf: Fix kernel panic when rmmod PMU modules during perf
      sampling
    - [arm64] Use test_tsk_thread_flag() for checking TIF_SINGLESTEP
    - asm-generic/mmiowb: Allow mmiowb_set_pending() when preemptible()
    - drivers/perf: Prevent forced unbinding of PMU drivers
    - [riscv64] Upgrade smp_mb__after_spinlock() to iorw,iorw
    - [x86] boot: Don't add the EFI stub to targets
    - [arm*] binder: Don't use mmput() from shrinker function.
    - [arm64,armhf] usb: tegra: Fix allocation for the FPCI context
    - usb: xhci: Fix ASM2142/ASM3142 DMA addressing
    - Revert "cifs: Fix the target file was deleted when rename failed."
      (Closes: #966917)
    - iwlwifi: mvm: don't call iwl_mvm_free_inactive_queue() under RCU
    - [arm64] tty: xilinx_uartps: Really fix id assignment
    - [x86] staging: wlan-ng: properly check endpoint types
    - [x86] staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG
      shift
    - [x86] staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support
    - [x86] staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG
      shift
    - [x86] staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG
      shift
    - [arm64,armhf] serial: tegra: fix CREAD handling for PIO
    - serial: 8250: fix null-ptr-deref in serial8250_start_tx()
    - /dev/mem: Add missing memory barriers for devmem_inode
    - fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
    - vt: Reject zero-sized screen buffer size.
    - mm/mmap.c: close race between munmap() and expand_upwards()/downwards()
    - vfs/xattr: mm/shmem: kernfs: release simple xattr entry in a right way
    - mm/memcg: fix refcount error while moving and swapping
    - mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
    - mm/hugetlb: avoid hardcoding while checking if cma is enabled
    - khugepaged: fix null-pointer dereference due to race
    - io-mapping: indicate mapping failure
    - [armhf] mmc: sdhci-of-aspeed: Fix clock divider calculation
    - drm/amdgpu: Fix NULL dereference in dpm sysfs handlers
    - [x86] vmlinux.lds: Page-align end of ..page_aligned sections
    - [x86] ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on
      the Lenovo Miix 2 10
    - [x86] ASoC: topology: fix kernel oops on route addition error
    - [x86] ASoC: topology: fix tlvs in error handling for widget_dmixer
    - [x86] ASoC: Intel: bdw-rt5677: fix non BE conversion
    - dm integrity: fix integrity recalculation that is improperly skipped
    - ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
    - ath9k: Fix regression with Atheros 9271
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.12
    - AX.25: Fix out-of-bounds read in ax25_connect()
    - AX.25: Prevent out-of-bounds read in ax25_sendmsg()
    - dev: Defer free of skbs in flush_backlog
    - ip6_gre: fix null-ptr-deref in ip6gre_init_net()
    - net-sysfs: add a newline when printing 'tx_timeout' by sysfs
    - net: udp: Fix wrong clean up for IS_UDPLITE macro
    - rtnetlink: Fix memory(net_device) leak when ->newlink fails
    - rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA
    - tcp: allow at most one TLP probe per flight
    - AX.25: Prevent integer overflows in connect and sendmsg
    - sctp: shrink stream outq only when new outcnt < old outcnt
    - sctp: shrink stream outq when fails to do addstream reconf
    - udp: Copy has_conns in reuseport_grow().
    - udp: Improve load balancing for SO_REUSEPORT.
    - tipc: allow to build NACK message in link timeout function
    - io_uring: ensure double poll additions work with both request types
    - regmap: debugfs: check count when read regmap file
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.13
    - sunrpc: check that domain table is empty at module unload.
    - PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge
    - ALSA: usb-audio: Add implicit feedback quirk for SSL2
    - ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502)
      series with ALC289
    - ALSA: hda/realtek: typo_fix: enable headset mic of ASUS ROG Zephyrus
      G14(GA401) series with ALC289
    - ALSA: hda/realtek: Fix add a "ultra_low_power" function for intel
      reference board (alc256)
    - ALSA: hda/realtek - Fixed HP right speaker no sound
    - ALSA: hda: Workaround for spurious wakeups on some Intel platforms
    - ALSA: hda/hdmi: Fix keep_power assignment for non-component devices
    - RDMA/mlx5: Fix prefetch memory leak if get_prefetchable_mr fails
    - [amd64] IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE
    - vhost/scsi: fix up req type endian-ness
    - 9p/trans_fd: Fix concurrency del of req_list in
      p9_fd_cancelled/p9_read_work
    - revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules
      present") (Closes: #966822)
    - [armel,armhf] 8986/1: hw_breakpoint: Don't invoke overflow handler on
      uaccess watchpoints
    - [armhf] 8987/1: VDSO: Fix incorrect clock_gettime64
    - [armhf] dts: imx6sx-sabreauto: Fix the phy-mode on fec2
    - virtio_balloon: fix up endian-ness for free cmd id
    - Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers"
    - drm/amd/display: Clear dm_state for fast updates (Closes: #963868)
    - drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
    - drm/dbi: Fix SPI Type 1 (9-bit) transfer
    - drm: hold gem reference until object is no longer accessed
    - drm: of: Fix double-free bug
    - rds: Prevent kernel-infoleak in rds_notify_queue_get()
    - xfrm: policy: match with both mark and mask on user interfaces
    - [arm64] pinctrl: qcom: Handle broken/missing PDC dual edge IRQs on
      sc7180
    - espintcp: recv() should return 0 when the peer socket is closed
    - xfrm: Fix crash when the hold queue is used.
    - [arm64] net: hns3: fix desc filling bug when skb is expanded or lineared
    - [arm64] net: hns3: fix a TX timeout issue
    - [arm64] net: hns3: add reset check for VF updating port based VLAN
    - [arm64] net: hns3: fix aRFS FD rules leftover after add a user FD rule
    - [arm64] net: hns3: fix for VLAN config when reset failed
    - net/mlx5: E-switch, Destroy TSAR when fail to enable the mode
    - net/mlx5: E-switch, Destroy TSAR after reload interface
    - net/mlx5e: Fix error path of device attach
    - net/mlx5: Fix a bug of using ptp channel index as pin index
    - net/mlx5: Verify Hardware supports requested ptp function on a given pin
    - net/mlx5: Query PPS pin operational status before registering it
    - net/mlx5e: Modify uplink state on interface up/down
    - net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev
    - net: lan78xx: add missing endpoint sanity check
    - net: lan78xx: fix transfer-buffer memory leak
    - rhashtable: Fix unprotected RCU dereference in __rht_ptr
    - mlx4: disable device on shutdown
    - nvme: add a Identify Namespace Identification Descriptor list quirk
    - bpf: Fix map leak in HASH_OF_MAPS map
    - espintcp: handle short messages instead of breaking the encap socket
    - mac80211: mesh: Free ie data when leaving mesh
    - mac80211: mesh: Free pending skb when destroying a mpath
    - RDMA/core: Stop DIM before destroying CQ
    - RDMA/core: Free DIM memory in error unwind
    - [arm64] alternatives: move length validation inside the subsection
    - [arm64] csum: Fix handling of bad packets
    - Bluetooth: fix kernel oops in store_pending_adv_report
    - net/mlx5e: E-Switch, Add misc bit when misc fields changed for mirroring
    - net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq
    - vxlan: fix memleak of fdb
    - iwlwifi: fix crash in iwl_dbg_tlv_alloc_trigger
    - qed: Disable "MFW indication via attention" SPAM every 5 minutes
    - io_uring: always allow drain/link/hardlink/async sqe flags
    - scsi: core: Run queue in case of I/O resource contention failure
    - [amd64] x86/unwind/orc: Fix ORC for newly forked tasks
    - [x86] stacktrace: Fix reliable check for empty user task stacks
    - cxgb4: add missing release on skb in uld_send()
    - xen-netfront: fix potential deadlock in xennet_remove()
    - [riscv64] Set maximum number of mapped pages correctly
    - [riscv64] Parse all memory blocks to remove unusable memory
    - [arm64] KVM: Don't inherit exec permission across page-table levels
    - [x86] KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is
      hw disabled
    - [x86] KVM: SVM: Fix disable pause loop exit/pause filtering capability
      on SVM
    - [x86] i8259: Use printk_deferred() to prevent deadlock
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.14
    - random32: update the net random state on interrupt and activity
      (CVE-2020-16166)
    - [armel] percpu.h: fix build error
    - [arm64] random: fix circular include dependency on arm64 after addition
      of percpu.h
    - random32: remove net_rand_state from the latent entropy gcc plugin
    - random32: move the pseudo-random 32-bit definitions to prandom.h
    - [arm64] Workaround circular dependency in pointer_auth.h
    - random: random.h should include archrandom.h, not the other way around
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.15
    - scsi: ufs: Fix and simplify setup_xfer_req variant operation
    - USB: serial: qcserial: add EM7305 QDL product ID
    - USB: iowarrior: fix up report size handling for some devices
    - usb: xhci: define IDs for various ASMedia host controllers
    - usb: xhci: Fix ASMedia ASM1142 DMA addressing
    - Revert "ALSA: hda: call runtime_allow() for all hda controllers"
    - ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops
    - ALSA: hda/ca0132 - Add new quirk ID for Recon3D.
    - ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value.
    - ALSA: hda/ca0132 - Fix AE-5 microphone selection commands.
    - ALSA: seq: oss: Serialize ioctls
    - [arm*] staging: android: ashmem: Fix lockdep warning for write operation
    - staging: rtl8712: handle firmware load failure
    - Staging: rtl8188eu: rtw_mlme: Fix uninitialized variable authmode
    - Bluetooth: Fix slab-out-of-bounds read in
      hci_extended_inquiry_result_evt()
    - Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt()
    - Bluetooth: Prevent out-of-bounds read in
      hci_inquiry_result_with_rssi_evt()
    - [arm*] binder: Prevent context manager from incrementing ref 0
    - Smack: fix use-after-free in smk_write_relabel_self()
    - vgacon: Fix for missing check in scrollback handling (CVE-2020-14331)
    - mtd: properly check all write ioctls for permissions
    - [arm64] gpio: max77620: Fix missing release of interrupt
    - bpf: Fix NULL pointer dereference in __btf_resolve_helper_id()
    - net/9p: validate fds in p9_fd_open
    - drm/nouveau/kms/tu102: wait for core update to complete when assigning
      windows
    - drm/nouveau/fbcon: fix module unload when fbcon init has failed for some
      reason
    - drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure
    - io_uring: fix lockup in io_fail_links()
    - nvme-pci: prevent SK hynix PC400 from using Write Zeroes command
    - [arm64] drm/bridge/adv7511: set the bridge type properly
    - [armhf] i2c: slave: improve sanity check when registering
    - [armhf] i2c: slave: add sanity check when unregistering
    - usb: hso: check for return value in hso_serial_common_create()
    - ALSA: hda: fix NULL pointer dereference during suspend
    - firmware: Fix a reference count leak.
    - cfg80211: check vendor command doit pointer before use
    - igb: reinit_locked() should be called with rtnl_lock
    - atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
    - tools lib traceevent: Fix memory leak in process_dynamic_array_len
    - xattr: break delegations in {set,remove}xattr
    - [arm64,armhf] PCI: tegra: Revert tegra124 raw_violation_fixup
    - ipv4: Silence suspicious RCU usage warning
    - ipv6: fix memory leaks on IPV6_ADDRFORM path
    - ipv6: Fix nexthop refcnt leak when creating ipv6 route info
    - rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
    - vxlan: Ensure FDB dump is performed under RCU
    - net: lan78xx: replace bogus endpoint lookup
    - rhashtable: Restore RCU marking on rhash_lock_head
    - devlink: ignore -EOPNOTSUPP errors on dumpit
    - appletalk: Fix atalk_proc_init() return path
    - [arm64] dpaa2-eth: Fix passing zero to 'PTR_ERR' warning
    - [x86] hv_netvsc: do not use VF device if link is down
    - net: bridge: clear bridge's private skb space on xmit
    - net: gre: recompute gre csum for sctp over gre tunnels
    - net: macb: Properly handle phylink on at91sam9x
    - [arm64,armhf] net: mvpp2: fix memory leak in mvpp2_rx
    - net/sched: act_ct: fix miss set mru for ovs after defrag in act_ct
    - [arm64] net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task()
    - openvswitch: Prevent kernel-infoleak in ovs_ct_put_key()
    - Revert "vxlan: fix tos value before xmit"
    - tcp: apply a floor of 1 for RTT samples from TCP timestamps
    - [arm64] kaslr: Use standard early random function
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.16
    - tracepoint: Mark __tracepoint_string's __used
    - io_uring: abstract out task work running
    - HID: input: Fix devices that return multiple bytes in battery report
    - [x86] mce/inject: Fix a wrong assignment of i_mce.status
    - [x86] perf/x86/intel/uncore: Fix oops when counting IMC uncore events on
      some TGL
    - [x86] sched: Bail out of frequency invariance if turbo frequency is
      unknown
    - [x86] sched: Bail out of frequency invariance if turbo_freq/base_freq
      gives 0
    - sched/fair: Fix NOHZ next idle balance
    - sched: correct SD_flags returned by tl->sd_flags()
    - EDAC: Fix reference count leaks
    - crc-t10dif: Fix potential crypto notify dead-lock
    - blktrace: fix debugfs use after free (CVE-2019-19770)
    - [armhf] exynos: MCPM: Restore big.LITTLE cpuidle support
    - rcu/tree: Repeat the monitor if any free channel is busy
    - sched/uclamp: Fix initialization of struct uclamp_rq
    - [x86] crypto: qat - allow xts requests not multiple of block
    - [x86] platform/x86: intel-hid: Fix return value check in
      check_acpi_dev()
    - [x86] platform/x86: intel-vbtn: Fix return value check in
      check_acpi_dev()
    - tpm: Require that all digests are present in TCG_PCR_EVENT2 structures
    - recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64.
    - regulator: fix memory leak on error path of regulator_register()
    - io_uring: fix sq array offset calculation
    - [arm64] dts: meson: fix mmc0 tuning error on Khadas VIM3
    - [arm64,armhf] spi: rockchip: Fix error in SPI slave pio read
    - seccomp: Fix ioctl number for SECCOMP_IOCTL_NOTIF_ID_VALID
    - md: raid0/linear: fix dereference before null check on pointer mddev
    - [mips64el,mipsel] irqchip/loongson-liointc: Fix potential dead lock
    - [arm64,armhf] irqchip/gic-v4.1: Use GFP_ATOMIC flag in
      allocate_vpe_l1_table()
    - nvme-tcp: fix controller reset hang during traffic
    - nvme-rdma: fix controller reset hang during traffic
    - nvme-multipath: fix logic for non-optimized paths
    - nvme-multipath: do not fall back to __nvme_find_path() for non-optimized
      paths
    - block: don't do revalidate zones on invalid devices
    - [armhf] drm/tilcdc: fix leak & null ref in panel_connector_get_modes
    - [armhf] exynos: clear L310_AUX_CTRL_FULL_LINE_ZERO in default
      l2c_aux_val
    - Bluetooth: add a mutex lock to avoid UAF in do_enale_set
    - loop: be paranoid on exit and prevent new additions / removals
    - io_uring: fix req->work corruption
    - fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls
    - drm/amdgpu: avoid dereferencing a NULL pointer
    - drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync
    - video: fbdev: savage: fix memory leak on error handling path in probe
    - video: fbdev: neofb: fix memory leak in neo_scan_monitor()
    - [armhf] bus: ti-sysc: Add missing quirk flags for usb_host_hs
    - md-cluster: fix wild pointer of unlock_all_bitmaps()
    - drm/nouveau/kms/nv50-: Fix disabling dithering
    - [arm64] dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT
      binding
    - [armhf] drm/etnaviv: fix ref count leak via pm_runtime_get_sync
    - drm/nouveau: fix reference count leak in nouveau_debugfs_strap_peek
    - drm/nouveau: fix multiple instances of reference count leaks
    - btrfs: fix lockdep splat from btrfs_dump_space_info
    - [arm64] drm: msm: a6xx: fix gpu failure after system resume
    - [arm64] drm/msm: Fix a null pointer access in msm_gem_shrinker_count()
    - drm/debugfs: fix plain echo to connector "force" attribute
    - drm/radeon: disable AGP by default
    - net: phy: mscc: restore the base page in vsc8514/8584_config_init
    - mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls
    - bpf: Fix fds_example SIGSEGV error
    - Bluetooth: hci_qca: Bug fixes for SSR
    - brcmfmac: keep SDIO watchdog running when console_interval is non-zero
    - brcmfmac: To fix Bss Info flag definition Bug
    - brcmfmac: set state of hanger slot to FREE when flushing PSQ
    - [x86] platform/x86: asus-nb-wmi: add support for ASUS ROG Zephyrus G14
      and G15
    - iwlegacy: Check the return value of pcie_capability_read_*()
    - [arm64,armhf] gpu: host1x: debug: Fix multiple channels emitting
      messages simultaneously
    - [x86] uaccess: Make __get_user_size() Clang compliant on 32-bit
    - mmc: sdhci-pci-o2micro: Bug fix for O2 host controller Seabird1
    - usb: gadget: net2280: fix memory leak on probe error handling paths
    - dyndbg: fix a BUG_ON in ddebug_describe_flags
    - bcache: fix super block seq numbers comparision in register_cache_set()
    - btrfs: allow btrfs_truncate_block() to fallback to nocow for data space
      reservation
    - btrfs: qgroup: free per-trans reserved space when a subvolume gets
      dropped
    - [arm64,x86] ACPICA: Do not increment operation_region reference counts
      for field units
    - io_uring: fix racy overflow count reporting
    - io_uring: fix stalled deferred requests
    - [arm64] crypto: caam - silence .setkey in case of bad key length
    - [arm64] drm/msm: ratelimit crtc event overflow error
    - drm/gem: Fix a leak in drm_gem_objects_lookup()
    - drm/amdgpu: use the unlocked drm_gem_object_put
    - [x86] agp/intel: Fix a memory leak on module initialisation failure
    - btmrvl: Fix firmware filename for sd8977 chipset
    - btmrvl: Fix firmware filename for sd8997 chipset
    - Bluetooth: hci_qca: Fix an error pointer dereference
    - Bluetooth: hci_qca: Only remove TX clock vote after TX is completed
    - Bluetooth: Allow suspend even when preparation has failed
    - ath10k: Acquire tx_lock in tx error paths
    - Bluetooth: hci_qca: Bug fix during SSR timeout
    - Bluetooth: hci_qca: Increase SoC idle timeout to 200ms
    - iio: improve IIO_CONCENTRATION channel type description
    - scsi: ufs: Fix imprecise load calculation in devfreq window
    - [armhf] drm/etnaviv: Fix error path on failure to enable bus clk
    - [arm64,armhf] drm/panfrost: Fix inbalance of devfreq record_busy/idle()
    - [arm64] drm/arm: fix unintentional integer overflow on left shift
    - Bluetooth: btusb: fix up firmware download sequence
    - Bluetooth: btmtksdio: fix up firmware download sequence
    - media: marvell-ccic: Add missed v4l2_async_notifier_cleanup()
    - [armhf] media: omap3isp: Add missed v4l2_ctrl_handler_free() for
      preview_init_entities()
    - [arm64] dpaa2-eth: fix condition for number of buffer acquire retries
    - drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline
    - [powerpc*] cxl: Fix kobject memleak
    - tracing: Move pipe reference to trace array instead of current_tracer
    - drm/amdgpu: ensure 0 is returned for success in jpeg_v2_5_wait_for_idle
    - drm/radeon: fix array out-of-bounds read and write issues
    - [arm*] staging: vchiq_arm: Add a matching unregister call
    - iavf: fix error return code in iavf_init_get_resources()
    - iavf: Fix updating statistics
    - RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued()
    - ipvs: allow connection reuse for unconfirmed conntrack
    - media: firewire: Using uninitialized values in node_probe()
    - media: tvp5150: Add missed media_entity_cleanup()
    - xfs: don't eat an EIO/ENOSPC writeback error when scrubbing data fork
    - xfs: fix reflink quota reservation accounting error
    - RDMA/rxe: Skip dgid check in loopback mode
    - PCI: Fix pci_cfg_wait queue locking problem
    - samples: bpf: Fix bpf programs with kprobe/sys_connect event
    - [armhf] drm/stm: repair runtime power management
    - kobject: Avoid premature parent object freeing in kobject_cleanup()
    - leds: core: Flush scheduled work for system suspend
    - [arm64,armhf] drm: panel: simple: Fix bpc for LG LB070WV8 panel
    - [armhf] phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY
    - [arm64] mmc: sdhci-of-arasan: Add missed checks for devm_clk_register()
    - scsi: scsi_debug: Add check for sdebug_max_queue during module init
    - mwifiex: Prevent memory corruption handling keys
    - kernfs: do not call fsnotify() with name without a parent
    - [powerpc*] pseries: remove cede offline state for CPUs
    - [powerpc*] rtas: don't online CPUs for partition suspend
    - [powerpc*] vdso: Fix vdso cpu truncation
    - RDMA/qedr: SRQ's bug fixes
    - RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send
      queue
    - [x86] staging: rtl8192u: fix a dubious looking mask before a shift
    - PCI/ASPM: Add missing newline in sysfs 'policy'
    - go7007: add sanity checking for endpoints
    - [powerpc*] book3s64/pkeys: Use PVR check instead of cpu feature
    - [armhf] drm/imx: fix use after free
    - [armhf] gpu: ipu-v3: Restore RGB32, BGR32
    - USB: serial: iuu_phoenix: fix led-activity helpers
    - usb: core: fix quirks_param_set() writing to a const pointer
    - [armhf] thermal: ti-soc-thermal: Fix reversed condition in
      ti_thermal_expose_sensor()
    - [powerpc*] perf: Fix missing is_sier_aviable() during build
    - [armhf] phy: armada-38x: fix NETA lockup when repeatedly switching
      speeds
    - [x86] ASoC: hdac_hda: fix deadlock after PCM open error
    - [mips64el,mipsel] OCTEON: add missing put_device() call in
      dwc3_octeon_device_init()
    - [x86] thermal: int340x: processor_thermal: fix: update Jasper Lake PCI
      id
    - [arm*] usb: dwc2: Fix error path in gadget registration
    - usb: gadget: f_uac2: fix AC Interface Header Descriptor wTotalLength
    - scsi: megaraid_sas: Clear affinity hint
    - [powerpc] scsi: mesh: Fix panic after host or bus reset
    - [arm64,armhf] net: dsa: mv88e6xxx: MV88E6097 does not support jumbo
      configuration
    - RDMA/core: Fix return error value in _ib_modify_qp() to negative
    - Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth
      controllers
    - Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags
    - Bluetooth: hci_serdev: Only unregister device if it was registered
    - Bluetooth: Fix suspend notifier race
    - Bluetooth: hci_qca: Stop collecting memdump again for command timeout
      during SSR
    - xfs: fix inode allocation block res calculation precedence
    - xfs: clear XFS_DQ_FREEING if we can't lock the dquot buffer to flush
    - RDMA/netlink: Remove CAP_NET_RAW check when dump a raw QP
    - PCI: Release IVRS table in AMD ACS quirk
    - [powerpc*] pseries/hotplug-cpu: Remove double free in error path
    - ASoC: soc-core: Fix regression causing sysfs entries to disappear
    - [s390x] qeth: tolerate pre-filled RX buffer
    - [s390x] qeth: don't process empty bridge port events
    - ice: Clear and free XLT entries on reset
    - ice: Graceful error handling in HW table calloc failure
    - netfilter: nft_meta: fix iifgroup matching
    - rtw88: fix LDPC field for RA info
    - rtw88: fix short GI capability based on current bandwidth
    - rtw88: coex: only skip coex triggered by BT info
    - [arm64,armhf] wl1251: fix always return 0 error
    - net/mlx5: DR, Change push vlan action sequence
    - net/mlx5: Delete extra dump stack that gives nothing
    - ftrace: Fix ftrace_trace_task return value
    - [amd64,arm64] net: ethernet: aquantia: Fix wrong return value
    - liquidio: Fix wrong return value in cn23xx_get_pf_num()
    - [powerpc] net: spider_net: Fix the size used in a 'dma_free_coherent()'
      call
    - gpio: don't use same lockdep class for all devm_gpiochip_add_data users
    - [arm64] net: thunderx: initialize VF's mailbox mutex before first usage
    - dlm: Fix kobject memleak
    - ocfs2: fix unbalanced locking
    - [arm64,armhf] pinctrl-single: fix pcs_parse_pinconf() return value
    - svcrdma: Fix page leak in svc_rdma_recv_read_chunk()
    - nfsd: avoid a NULL dereference in __cld_pipe_upcall()
    - SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()")
    - [amd64] x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task
    - [amd64] crypto: aesni - add compatibility with IAS
    - af_packet: TPACKET_V3: fix fill status rwlock imbalance
    - net: Fix potential memory leak in proto_register()
    - net/nfc/rawsock.c: add CAP_NET_RAW check.
    - net: phy: fix memory leak in device-create error path
    - net: Set fput_needed iff FDPUT_FPUT is set
    - tcp: correct read of TFO keys on big endian systems
    - [x86] vmxnet3: use correct tcp hdr length when packet is encapsulated
    - net: refactor bind_bucket fastreuse into helper
    - net: initialize fastreuse on inet_inherit_port
    - vsock: fix potential null pointer dereference in vsock_poll()
    - net: phy: marvell10g: fix null pointer dereference
    - USB: serial: cp210x: re-enable auto-RTS on open
    - USB: serial: cp210x: enable usb generic throttle/unthrottle
    - ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO
    - ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support
    - ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109
    - ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109
    - ALSA: usb-audio: add quirk for Pioneer DDJ-RB
    - [arm64,x86] tpm: Unify the mismatching TPM space buffer sizes
    - [x86] crypto: qat - fix double free in qat_uclo_create_batch_init_list
    - [x86] crypto: ccp - Fix use of merged scatterlists
    - [arm64] crypto: cpt - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not
      specified
    - tick/nohz: Narrow down noise while setting current task's tick
      dependency
    - bitfield.h: don't compile-time validate _val in FIELD_FIT
    - fs/minix: check return value of sb_getblk()
    - fs/minix: don't allow getting deleted inodes
    - fs/minix: reject too-large maximum file size
    - [x86] kvm: x86: replace kvm_spec_ctrl_test_value with runtime test on
      the host
    - 9p: Fix memory leak in v9fs_mount
    - driver core: Fix probe_count imbalance in really_probe()
    - media: media-request: Fix crash if memory allocation fails
    - drm/ttm/nouveau: don't call tt destroy callback on alloc failure.
    - io_uring: set ctx sq/cq entry count earlier
    - io_uring: use TWA_SIGNAL for task_work uncondtionally
    - io_uring: fail poll arm on queue proc failure
    - NFS: Don't move layouts to plh_return_segs list while in use
    - NFS: Don't return layout segments that are in use
    - cpufreq: Fix locking issues with governors
    - [arm64] cpufreq: dt: fix oops on armada37xx
    - include/asm-generic/vmlinux.lds.h: align ro_after_init
    - [arm64] PM / devfreq: rk3399_dmc: Fix kernel oops when rockchip,pmu is
      absent
    - PM / devfreq: Fix indentaion of devfreq_summary debugfs node
    - spi: spidev: Align buffers for DMA
    - erofs: fix extended inode could cross boundary
    - [arm64] firmware: qcom_scm: Fix legacy convention SCM accessors
    - [x86] irqdomain/treewide: Free firmware node after domain removal
    - xen/balloon: fix accounting in alloc_xenballooned_pages error path
    - xen/balloon: make the balloon wait interruptible
    - [x86] drm/xen-front: Fix misused IS_ERR_OR_NULL checks
    - [s390x] dasd: fix inability to use DASD with DIAG driver
    - [s390x] numa: set node distance to LOCAL_DISTANCE
    - [s390x] gmap: improve THP splitting
    - io_uring: sanitize double poll handling
    - io_uring: Fix NULL pointer dereference in loop_rw_iter()
    - task_work: only grab task signal lock when needed
    - io_uring: add missing REQ_F_COMP_LOCKED for nested requests
    - io_uring: enable lookup of links holding inflight files
    - io_uring: hold 'ctx' reference around task_work queue + execute
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.17
    - smb3: warn on confusing error scenario with sec=krb5
    - genirq/affinity: Make affinity setting if activated opt-in
    - genirq/PM: Always unlock IRQ descriptor in rearm_wake_irq()
    - [arm64,x86] PCI: hotplug: ACPI: Fix context refcounting in
      acpiphp_grab_context()
    - PCI/ATS: Add pci_pri_supported() to check device or associated PF
    - PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken
    - PCI: Add device even if driver attach failed
    - [arm64] PCI: qcom: Define some PARF params needed for ipq8064 SoC
    - [arm64] PCI: qcom: Add support for tx term offset for rev 2.1.0
    - btrfs: allow use of global block reserve for balance item deletion
    - btrfs: free anon block device right after subvolume deletion
    - btrfs: don't allocate anonymous block device for user invisible roots
    - btrfs: ref-verify: fix memory leak in add_block_entry
    - btrfs: only commit the delayed inode when doing a full fsync
    - btrfs: stop incremening log_batch for the log root tree when syncing log
    - btrfs: only commit delayed items at fsync if we are logging a directory
    - btrfs: remove no longer needed use of log_writers for the log root tree
    - btrfs: don't traverse into the seed devices in show_devname
    - btrfs: pass checksum type via BTRFS_IOC_FS_INFO ioctl
    - btrfs: open device without device_list_mutex
    - btrfs: move the chunk_mutex in btrfs_read_chunk_tree
    - btrfs: relocation: review the call sites which can be interrupted by
      signal
    - btrfs: add missing check for nocow and compression inode flags
    - btrfs: avoid possible signal interruption of btrfs_drop_snapshot() on
      relocation tree
    - btrfs: return EROFS for BTRFS_FS_STATE_ERROR cases
    - btrfs: sysfs: use NOFS for device creation
    - btrfs: don't WARN if we abort a transaction with EROFS
    - btrfs: fix race between page release and a fast fsync
    - btrfs: don't show full path of bind mounts in subvol=
    - btrfs: fix messages after changing compression level by remount
    - btrfs: only search for left_info if there is no right_info in
      try_merge_free_space
    - btrfs: inode: fix NULL pointer dereference if inode doesn't need
      compression
    - btrfs: fix memory leaks after failure to lookup checksums during inode
      logging
    - btrfs: trim: fix underflow in trim length to prevent access beyond
      device boundary
    - btrfs: make sure SB_I_VERSION doesn't get unset by remount
    - btrfs: fix return value mixup in btrfs_get_extent
    - [arm64] perf: Correct the event index in sysfs
    - cifs: Fix leak when handling lease break for cached root fid
    - [powerpc*] Allow 4224 bytes of stack expansion for the signal frame
    - [powerpc*] Fix circular dependency between percpu.h and mmu.h
    - [arm64] media: venus: fix multiple encoder crash
    - [arm64] net: ethernet: stmmac: Disable hardware multicast filter
    - [arm64,armhf] net: stmmac: dwmac1000: provide multicast filter fallback
    - [mips64el,mipsel] irqchip/loongson-liointc: Fix misuse of gc->mask_cache
    - [arm64,armhf] irqchip/gic-v4.1: Ensure accessing the correct RD when
      writing INVALLR
    - pidfd: Add missing sock updates for pidfd_getfd()
    - net/compat: Add missing sock updates for SCM_RIGHTS
    - md/raid5: Fix Force reconstruct-write io stuck in degraded raid5
    - bcache: allocate meta data pages as compound pages
    - bcache: fix overflow in offset_to_stripe()
    - mac80211: fix misplaced while instead of if
    - driver core: Avoid binding drivers to dead devices
    - [mips*] CPU#0 is not hotpluggable
    - ext2: fix missing percpu_counter_inc
    - khugepaged: collapse_pte_mapped_thp() flush the right range
    - mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
    - khugepaged: collapse_pte_mapped_thp() protect the pmd lock
    - hugetlbfs: remove call to huge_pte_alloc without i_mmap_rwsem
    - [amd64,arm64] mm/shuffle: don't move pages between zones and don't read
      garbage memmaps
    - ocfs2: change slot number type s16 to u16
    - mm/page_counter.c: fix protection usage propagation
    - cma: don't quit at first error when activating reserved areas
    - mm/memory_hotplug: fix unpaired mem_hotplug_begin/done
    - ftrace: Setup correct FTRACE_FL_REGS flags for module
    - kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler
    - tracing: Use trace_sched_process_free() instead of exit() for pid
      tracing
    - [x86] watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in
      watchdog_info.options
    - [x86] watchdog: f71808e_wdt: remove use of wrong watchdog_info option
    - [x86] watchdog: f71808e_wdt: clear watchdog timeout occurred flag
    - ceph: set sec_context xattr on symlink creation
    - ceph: handle zero-length feature mask in session messages
    - [powerpc*] pseries: Fix 64 bit logical memory block panic
    - dm: don't call report zones for more than the user requested
    - module: Correctly truncate sysfs sections output
    - bootconfig: Fix to find the initargs correctly
    - perf probe: Fix wrong variable warning when the probe point is not found
    - perf probe: Fix memory leakage when the probe point is not found
    - perf intel-pt: Fix FUP packet state
    - perf intel-pt: Fix duplicate branch after CBR
    - gfs2: Never call gfs2_block_zero_range with an open transaction
    - [armhf] drm/imx: imx-ldb: Disable both channels for split mode in
      enc->disable()
    - crypto: algif_aead - Only wake up when ctx->more is zero
    - RDMA/ipoib: Return void from ipoib_ib_dev_stop()
    - RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah()
    - rtc: cpcap: fix range
    - IB/uverbs: Set IOVA on IB MR in uverbs layer
    - sched/uclamp: Protect uclamp fast path code with static key
    - USB: serial: ftdi_sio: make process-packet buffer unsigned
    - USB: serial: ftdi_sio: clean up receive processing
    - crypto: af_alg - Fix regression on empty requests
    - devres: keep both device name and resource name in pretty name
    - RDMA/counter: Only bind user QPs in auto mode
    - RDMA/counter: Allow manually bind QPs with different pids to same
      counter
    - rtw88: pci: disable aspm for platform inter-op with module parameter
    - [arm64,armhf] rtc: pl031: fix set_alarm by adding back call to
      alarm_irq_enable
    - [armhf] gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq
      handlers
    - [armhf] gpu: ipu-v3: image-convert: Wait for all EOFs before completing
      a tile
    - dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue()
    - f2fs: compress: fix to avoid memory leak on cc->cpages
    - [arm64] clk: qcom: clk-alpha-pll: remove unused/incorrect PLL_CAL_VAL
    - iommu/vt-d: Enforce PASID devTLB field mask
    - f2fs: compress: fix to update isize when overwriting compressed file
    - nvme: fix deadlock in disconnect during scan_work and/or ana_work
    - sched/uclamp: Fix a deadlock when enabling uclamp static key
    - nfs: ensure correct writeback errors are returned on close()
    - ubifs: Fix wrong orphan node deletion in ubifs_jnl_update|rename
    - [arm*] clk: bcm2835: Do not use prediv with bcm2711's PLLs
    - scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying
      targetport
    - nfs: nfs_file_write() should check for writeback errors
    - watchdog: initialize device before misc_register
    - md-cluster: Fix potential error pointer dereference in resize_bitmaps()
    - [x86] tsr: Fix tsc frequency enumeration bug on Lightning Mountain SoC
    - [x86] bugs/multihit: Fix mitigation reporting when VMX is not in use
    - Input: sentelic - fix error return when fsp_reg_write fails
    - [x86] drm/vmwgfx: Use correct vmw_legacy_display_unit pointer
    - [x86] drm/vmwgfx: Fix two list_for_each loop exit tests
    - [arm64] net: qcom/emac: add missed clk_disable_unprepare in error path
      of emac_clks_phase1_init
    - nfs: Fix getxattr kernel panic and memory overflow
    - NFS: Fix flexfiles read failover
    - fs/minix: set s_maxbytes correctly
    - fs/minix: fix block limit check for V1 filesystems
    - fs/minix: remove expected error message in block_to_path()
    - fs/ufs: avoid potential u32 multiplication overflow
    - crypto: algif_aead - fix uninitialized ctx->init
    - perf bench mem: Always memset source before memcpy
    - [x86] perf/x86/rapl: Fix missing psys sysfs attributes
    - khugepaged: retract_page_tables() remember to test exit
    - [arm64,armhf] ASoC: tegra: Use device managed resource APIs to get the
      clock
    - [arm64,armhf] ASoC: tegra: Add audio mclk parent configuration
    - [arm64,armhf] ASoC: tegra: Enable audio mclk during
      tegra_asoc_utils_init()
    - [x86] drm/i915/gt: Force the GT reset on shutdown
    - [arm64,armhf] drm/panfrost: Use kvfree() to free bo->sgts
    - drm/dp_mst: Fix the DDC I2C device registration of an MST port
    - drm/amdgpu: fix ordering of psp suspend
    - [armhf] drm/omap: force runtime PM suspend on system suspend
    - drm: Added orientation quirk for ASUS tablet model T103HAF
    - drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
    - drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume

  [ Salvatore Bonaccorso ]
  * Bump ABI to 3

  [ Ben Hutchings ]
  * doc: Disable extension incompatible with Sphinx 3 (fixes FTBFS)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 23 Aug 2020 15:44:14 +0200

linux (5.7.10-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.7
    - block/bio-integrity: don't free 'buf' if bio_integrity_add_page() failed
    - ethtool: Fix check in ethtool_rx_flow_rule_create
    - geneve: allow changing DF behavior after creation
    - [powerpc*] ibmveth: Fix max MTU limit
    - mld: fix memory leak in ipv6_mc_destroy_dev()
    - [arm64,armhf] mvpp2: ethtool rxtx stats fix
    - net: bridge: enfore alignment for ethernet address
    - net: core: reduce recursion limit value
    - net: Do not clear the sock TX queue in sk_set_socket()
    - net: ethtool: add missing string for NETIF_F_GSO_TUNNEL_REMCSUM
    - net: fix memleak in register_netdevice()
    - net: Fix the arp error in some cases
    - net: increment xmit_recursion level in dev_direct_xmit()
    - net: usb: ax88179_178a: fix packet alignment padding
    - openvswitch: take into account de-fragmentation/gso_size in
      execute_check_pkt_len
    - rxrpc: Fix notification call on completion of discarded calls
    - sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket
    - tcp: don't ignore ECN CWR on pure ACK
    - tcp: grow window for OOO packets only for SACK flows
    - tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes
    - ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()
    - net: phy: Check harder for errors in get_phy_id()
    - ip_tunnel: fix use-after-free in ip_tunnel_lookup()
    - bnxt_en: Store the running firmware version code.
    - bnxt_en: Do not enable legacy TX push on older firmware.
    - bnxt_en: Fix statistics counters issue during ifdown with older firmware.
    - bnxt_en: Read VPD info only for PFs
    - net: phylink: fix ethtool -A with attached PHYs
    - net: phylink: ensure manual pause mode configuration takes effect
    - sch_cake: don't try to reallocate or unshare skb unconditionally
    - sch_cake: don't call diffserv parsing code when it is not needed
    - sch_cake: fix a few style nits
    - tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT
    - bpf: tcp: bpf_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT
    - [arm64,riscv64] net: macb: undo operations in case of failure
    - r8169: fix firmware not resetting tp->ocp_base
    - net: ethtool: add missing NETIF_F_GSO_FRAGLIST feature string
    - [arm64,riscv64] net: macb: call pm_runtime_put_sync on failure path
    - net: phy: mscc: avoid skcipher API for single block AES encryption
    - of: of_mdio: Correct loop scanning logic
    - wireguard: device: avoid circular netns references
    - bareudp: Fixed multiproto mode configuration
    - [armhf] net: dsa: bcm_sf2: Fix node reference count
    - net: phy: smsc: fix printing too many logs
    - genetlink: clean up family attributes allocations
    - nvmet: cleanups the loop in nvmet_async_events_process
    - nvmet: fail outstanding host posted AEN req
    - ALSA: usb-audio: Fix potential use-after-free of streams
    - [arm64,armhf] Revert "i2c: tegra: Fix suspending in active runtime PM
      state"
    - btrfs: fix a block group ref counter leak after failure to remove block
      group
    - binder: fix null deref of proc->context
    - [x86] mei: me: disable mei interface on Mehlow server platforms
    - [x86] mei: me: add tiger lake point device ids for H platforms.
    - [armhf] Revert "usb: dwc3: exynos: Add support for Exynos5422 suspend
      clk"
    - [mips*/*-malta,sh4] USB: ohci-sm501: Add missed iounmap() in remove
    - [arm64,armhf] usb: dwc2: Postponed gadget registration to the udc class
      driver
    - usb: add USB_QUIRK_DELAY_INIT for Logitech C922
    - USB: ehci: reopen solution for Synopsys HC bug
    - xhci: Poll for U0 after disabling USB2 LPM
    - [armhf] usb: host: ehci-exynos: Fix error check in exynos_ehci_probe()
    - ALSA: usb-audio: Add implicit feedback quirk for SSL2+.
    - ALSA: usb-audio: add quirk for Denon DCD-1500RE
    - ALSA: usb-audio: Set 48 kHz rate for Rodecaster
    - ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Flight S
    - ALSA: usb-audio: add quirk for Samsung USBC Headset (AKG)
    - ALSA: usb-audio: Fix OOB access of mixer element list
    - scsi: qla2xxx: Keep initiator ports after RSCN
    - [s390x] scsi: zfcp: Fix panic on ERP timeout for previously dismissed ERP
      action
    - cifs: Fix cached_fid refcnt leak in open_shroot
    - cifs/smb3: Fix data inconsistent when punch hole
    - cifs/smb3: Fix data inconsistent when zero file range
    - xhci: Fix incorrect EP_STATE_MASK
    - xhci: Fix enumeration issue when setting max packet size for FS devices.
    - xhci: Return if xHCI doesn't support LPM
    - cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip
    - loop: replace kill_bdev with invalidate_bdev
    - IB/mad: Fix use after free when destroying MAD agent
    - IB/hfi1: Fix module use count flaw due to leftover module put calls
    - [armhf] bus: ti-sysc: Flush posted write on enable and disable
    - [armhf] bus: ti-sysc: Use optional clocks on for enable and wait for
      softreset bit
    - [armhf] bus: ti-sysc: Ignore clockactivity unless specified as a quirk
    - [armhf] bus: ti-sysc: Fix uninitialized framedonetv_irq
    - [armhf] OMAP2+: Fix legacy mode dss_reset
    - xfrm: Fix double ESP trailer insertion in IPsec crypto offload.
    - [armhf] dts: Fix am33xx.dtsi USB ranges length
    - [armhf] dts: Fix am33xx.dtsi ti,sysc-mask wrong softreset flag
    - [x86] resctrl: Support CPUID enumeration of MBM counter width
    - [x86] resctrl: Fix memory bandwidth counter width for AMD
    - efi/tpm: Verify event log header before parsing
    - ASoC: soc-pcm: fix checks for multi-cpu FE dailinks
    - [arm64] ASoC: qcom: common: set correct directions for dailinks
    - [armhf] regualtor: pfuze100: correct sw1a/sw2 on pfuze3000
    - efi/libstub: Fix path separator regression
    - RDMA/siw: Fix pointer-to-int-cast warning in siw_rx_pbl()
    - [armhf] dts: am335x-pocketbeagle: Fix mmc0 Write Protect
    - [armhf] dts: Fix duovero smsc interrupt for suspend
    - dma-direct: re-encrypt memory if dma_direct_alloc_pages() fails
    - dma-direct: check return value when encrypting or decrypting memory
    - [x86] resctrl: Fix a NULL vs IS_ERR() static checker warning in
      rdt_cdp_peer_get()
    - [x86] efi/x86: Setup stack correctly for efi_pe_entry
    - regmap: Fix memory leak from regmap_register_patch
    - devmap: Use bpf_map_area_alloc() for allocating hash buckets
    - bpf: Don't return EINVAL from {get,set}sockopt when optlen > PAGE_SIZE
    - rxrpc: Fix handling of rwind from an ACK packet
    - RDMA/rvt: Fix potential memory leak caused by rvt_alloc_rq
    - RDMA/efa: Set maximum pkeys device attribute
    - RDMA/qedr: Fix KASAN: use-after-free in ucma_event_handler+0x532
    - RDMA/cma: Protect bind_list and listen_list while finding matching cm id
    - RDMA/core: Check that type_attrs is not NULL prior access
    - [arm64,armhf] ASoC: rockchip: Fix a reference count leak.
    - [s390x] qeth: fix error handling for isolation mode cmds
    - RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads()
    - [x86] Revert "KVM: VMX: Micro-optimize vmexit time when not exposing PMU"
    - [x86] iommu/vt-d: Set U/S bit in first level page table by default
    - [x86] iommu/vt-d: Enable PCI ACS for platform opt in hint
    - [x86] iommu/vt-d: Update scalable mode paging structure coherency
    - dma-direct: add missing set_memory_decrypted() for coherent mapping
    - net: qed: fix left elements count calculation
    - net: qed: fix async event callbacks unregistering
    - net: qede: stop adding events on an already destroyed workqueue
    - net: qed: fix NVMe login fails over VFs
    - net: qed: fix excessive QM ILT lines consumption
    - net: qede: fix PTP initialization on recovery
    - net: qede: fix use-after-free on recovery and AER handling
    - net: qed: reset ILT block sizes before recomputing to fix crashes
    - cxgb4: move handling L2T ARP failures to caller
    - cxgb4: move PTP lock and unlock to caller in Tx path
    - [armhf] imx5: add missing put_device() call in imx_suspend_alloc_ocram()
    - scsi: lpfc: Avoid another null dereference in lpfc_sli4_hba_unset()
    - usb: gadget: udc: Potential Oops in error handling code
    - nvme: don't protect ns mutation with ns->head->lock
    - qed: add missing error test for DBG_STATUS_NO_MATCHING_FRAMING_MODE
    - netfilter: ipset: fix unaligned atomic access
    - [arm64] net: bcmgenet: use hardware padding of runt frames
    - io_uring: fix hanging iopoll in case of -EAGAIN
    - [riscv64] clk: sifive: allocate sufficient memory for struct __prci_data
    - [armhf] i2c: fsi: Fix the port number field in status register
    - wireguard: receive: account for napi_gro_receive never returning GRO_DROP
    - [arm64] socionext: account for napi_gro_receive never returning GRO_DROP
    - wil6210: account for napi_gro_receive never returning GRO_DROP
    - i2c: core: check returned size of emulated smbus block read
    - afs: Fix storage of cell names
    - sched/deadline: Initialize ->dl_boosted
    - sched/core: Fix PI boosting between RT and DEADLINE tasks
    - sched/cfs: change initial value of runnable_avg
    - ata/libata: Fix usage of page address by page_address in
      ata_scsi_mode_select_xlat function
    - drm/amd/display: Use kfree() to free rgb_user in
      calculate_user_regamma_ramp()
    - [riscv64] atomic: Fix sign extension for RV64I
    - bcache: check and adjust logical block size for backing devices
    - net: alx: fix race condition in alx_remove
    - [arm64] pinctrl: qcom: spmi-gpio: fix warning about irq chip reusage
    - [arm64,armhf] pinctrl: tegra: Use noirq suspend/resume callbacks
    - [s390x] seccomp: pass syscall arguments via seccomp_data
    - [s390x] ptrace: return -ENOSYS when invalid syscall is supplied
    - [s390x] ptrace: pass invalid syscall numbers to tracing
    - [s390x] ptrace: fix setting syscall number
    - [s390x] vdso: Use $(LD) instead of $(CC) to link vDSO
    - [s390x] vdso: fix vDSO clock_getres()
    - [arm64] sve: Fix build failure when ARM64_SVE=y and SYSCTL=n
    - kbuild: improve cc-option to clean up all temporary files
    - recordmcount: support >64k sections
    - kprobes: Suppress the suspicious RCU warning on kprobes
    - blktrace: break out of blktrace setup on concurrent calls
    - nvdimm/region: always show the 'align' attribute
    - block: update hctx map when use multiple maps
    - [riscv64] Don't allow write+exec only page mapping request in mmap
    - syscalls: Fix offset type of ksys_ftruncate()
    - ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table
    - [x86] ALSA: hda/realtek - Add quirk for MSI GE63 laptop
    - [x86] ALSA: hda/realtek: Add mute LED and micmute LED support for HP
      systems
    - ACPI: sysfs: Fix pm_profile_attr type
    - ACPI: configfs: Disallow loading ACPI tables when locked down
      (CVE-2020-15780)
    - erofs: fix partially uninitialized misuse in z_erofs_onlinepage_fixup
    - [x86] KVM: X86: Fix MSR range of APIC registers in X2APIC mode
    - [x86] kvm: lapic: fix broken vcpu hotplug
    - [x86] KVM: nVMX: Plumb L2 GPA through to PML emulation
    - [x86] KVM: VMX: Stop context switching MSR_IA32_UMWAIT_CONTROL
    - [x86] cpu: Use pinning mask for CR4 bits needing to be 0
    - [x86] cpu: Reinitialize IA32_FEAT_CTL MSR on BSP during wakeup
    - [amd64] asm/64: Align start of __clear_user() loop to 16-bytes
    - btrfs: fix bytes_may_use underflow when running balance and scrub in
      parallel
    - btrfs: fix data block group relocation failure due to concurrent scrub
    - btrfs: check if a log root exists before locking the log_mutex on unlink
    - btrfs: fix hang on snapshot creation after RWF_NOWAIT write
    - btrfs: fix failure of RWF_NOWAIT write into prealloc extent beyond eof
    - btrfs: fix RWF_NOWAIT write not failling when we need to cow
    - mm, compaction: make capture control handling safe wrt interrupts
    - mm, slab: fix sign conversion problem in memcg_uncharge_slab()
    - mm/slab: use memzero_explicit() in kzfree()
    - ocfs2: avoid inode removal while nfsd is accessing it
    - ocfs2: load global_inode_alloc
    - ocfs2: fix value of OCFS2_INVALID_SLOT
    - ocfs2: fix panic on nfs server over ocfs2
    - mm: memcontrol: handle div0 crash race condition in memory.low
    - mm/memcontrol.c: add missed css_put()
    - mm/memory_hotplug.c: fix false softlockup during pfn range removal
    - [arm64] perf: Report the PC value in REGS_ABI_32 mode
    - tracing/boottime: Fix kprobe multiple events
    - tracing: Fix event trigger to accept redundant spaces
    - ring-buffer: Zero out time extend if it is nested and not absolute
    - drm/amd/display: Enable output_bpc property on all outputs
    - drm/amd: fix potential memleak in err branch
    - drm/radeon: fix fb_div check in ni_init_smc_spll_table()
    - drm/fb-helper: Fix vt restore
    - drm/amdgpu: add fw release for sdma v5_0
    - drm/amdgpu/display: Unlock mutex on error
    - drm/panel-simple: fix connector type for newhaven_nhd_43_480272ef_atxl
    - drm/panel-simple: fix connector type for LogicPD Type28 Display
    - [armhf] dts: imx6ul-kontron: Move watchdog from Kontron i.MX6UL/ULL board
      to SoM
    - [armhf] dts: imx6ul-kontron: Change WDOG_ANY signal from push-pull to
      open-drain
    - [x86,arm64] Staging: rtl8723bs: prevent buffer overflow in
      update_sta_support_rate()
    - sunrpc: fixed rollback in rpc_gssd_dummy_populate()
    - SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
    - pNFS/flexfiles: Fix list corruption if the mirror count changes
    - NFSv4 fix CLOSE not waiting for direct IO compeletion
    - [x86] EDAC/amd64: Read back the scrub rate PCI register on F15h
    - xprtrdma: Fix handling of RDMA_ERROR replies
    - dm writecache: correct uncommitted_block when discarding uncommitted entry
    - dm writecache: add cond_resched to loop in persistent_memory_claim()
    - Revert "tty: hvc: Fix data abort due to race in hvc_open"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.8
    - exfat: Set the unused characters of FileName field to the value 0000h
    - exfat: add missing brelse() calls on error paths
    - exfat: call sync_filesystem for read-only remount
    - exfat: move setting VOL_DIRTY over exfat_remove_entries()
    - exfat: flush dirty metadata in fsync
    - btrfs: block-group: refactor how we delete one block group item
    - btrfs: fix race between block group removal and block group creation
    - mm: fix swap cache node allocation mask
    - drm/amd/display: Fix incorrectly pruned modes with deep color
    - drm/amd/display: Fix ineffective setting of max bpc property
    - seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds
    - tipc: add test for Nagle algorithm effectiveness
    - tipc: fix kernel WARNING in tipc_msg_append()
    - usbnet: smsc95xx: Fix use-after-free after removal
    - tipc: Fix NULL pointer dereference in __tipc_sendstream()
    - [x86] drm/i915/gt: Mark timeline->cacheline as destroyed after rcu grace
      period
    - drm/amdgpu: disable ras query and iject during gpu reset
    - drm/amdgpu: fix non-pointer dereference for non-RAS supported
    - drm/amdgpu: fix kernel page fault issue by ras recovery on sGPU
    - sched/debug: Make sd->flags sysctl read-only
    - soc: ti: omap-prm: use atomic iopoll instead of sleeping one
    - [powerpc*] kvm/book3s: Add helper to walk partition scoped linux page
      table.
    - [powerpc*] book3s64/kvm: Fix secondary page table walk warning during
      migration
    - mm/slub.c: fix corrupted freechain in deactivate_slab()
    - mm/slub: fix stack overruns with SLUB_STATS
    - mm, dump_page(): do not crash with invalid mapping pointer
    - io_uring: fix {SQ,IO}POLL with unsupported opcodes
    - rxrpc: Fix race between incoming ACK parser and retransmitter
    - usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect
      (CVE-2020-15393)
    - tools lib traceevent: Add append() function helper for appending strings
    - tools lib traceevent: Handle __attribute__((user)) in field names
    - [s390x] debug: avoid kernel warning on too large number of pages
    - io_uring: fix io_sq_thread no schedule when busy
    - nvme-multipath: set bdi capabilities once
    - nvme: fix possible deadlock when I/O is blocked
    - nvme-multipath: fix deadlock between ana_work and scan_work
    - nvme-multipath: fix deadlock due to head->lock
    - nvme-multipath: fix bogus request queue reference put
    - io_uring: fix current->mm NULL dereference on exit
    - tpm: Fix TIS locality timeout problems
    - crypto: af_alg - fix use-after-free in af_alg_accept() due to
      bh_lock_sock()
    - task_work: teach task_work_add() to do signal_wake_up()
    - io_uring: use signal based task_work running
    - [arm64] drm/msm/dpu: fix error return code in dpu_encoder_init
    - btrfs: fix RWF_NOWAIT writes blocking on extent locks and waiting for IO
    - rxrpc: Fix afs large storage transmission performance drop
    - RDMA/counter: Query a counter before release
    - xfs: fix use-after-free on CIL context on shutdown
    - hsr: remove hsr interface if all slaves are removed
    - hsr: avoid to create proc file after unregister
    - cxgb4: use unaligned conversion for fetching timestamp
    - cxgb4: parse TC-U32 key values and masks natively
    - cxgb4: fix endian conversions for L4 ports in filters
    - cxgb4: use correct type for all-mask IP address comparison
    - cxgb4: fix SGE queue dump destination buffer context
    - security: Fix hook iteration and default value for inode_copy_up_xattr
    - [x86] hwmon: (acpi_power_meter) Fix potential memory leak in
      acpi_power_meter_add()
    - scsi: qla2xxx: Fix a condition in qla2x00_find_all_fabric_devs()
    - nfsd4: fix nfsdfs reference count loop
    - nfsd: fix nfsdfs inode reference count leak
    - [arm64,armhf] drm: sun4i: hdmi: Remove extra HPD polling
    - virtio-blk: free vblk-vqs in error path of virtblk_probe()
    - SMB3: Honor 'posix' flag for multiuser mounts
    - nvme: fix identify error status silent ignore
    - nvme: fix a crash in nvme_mpath_add_disk
    - [sh4] i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665
    - [x86,arm64] i2c: designware: platdrv: Set class based on DMI
    - io_uring: fix regression with always ignoring signals in io_cqring_wait()
    - Revert "ALSA: usb-audio: Improve frames size computation"
    - padata: upgrade smp_mb__after_atomic to smp_mb in padata_do_serial
    - SMB3: Honor 'seal' flag for multiuser mounts
    - SMB3: Honor persistent/resilient handle flags for multiuser mounts
    - SMB3: Honor lease disabling for multiuser mounts
    - SMB3: Honor 'handletimeout' flag for multiuser mounts
    - cifs: Fix the target file was deleted when rename failed.
    - [x86] Drivers: hv: Change flag to write log level in panic msg to false
    - hwmon: (pmbus) Fix page vs. register when accessing fans
    - [x86] ACPI: fan: Fix Tiger Lake ACPI device ID
    - gfs2: fix trans slab error when withdraw occurs inside log_flush
    - [x86] split_lock: Don't write MSR_TEST_CTRL on CPUs that aren't
      whitelisted
    - [mips*] Add missing EHB in mtc0 -> mfc0 sequence for DSPen
    - [x86] drm/i915: Include asm sources for {ivb, hsw}_clear_kernel.c
    - drm/amd/powerplay: Fix NULL dereference in lock_bus() on Vega20 w/o RAS
    - drm/amd/display: Only revalidate bandwidth on medium and fast updates
    - drm/amdgpu: use %u rather than %d for sclk/mclk
    - drm/amdgpu/atomfirmware: fix vram_info fetching for renoir
    - dma-buf: Move dma_buf_release() from fops to dentry_ops
    - [arm64,armhf] irqchip/gic: Atomically update affinity
    - mm/hugetlb.c: fix pages per hugetlb calculation
    - [arm*] mm/cma.c: use exact_nid true to fix possible per-numa cma leak
    - dm zoned: assign max_io_len correctly
    - efi: Make it possible to disable efivar_ssdt entirely
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.9
    - [s389x] KVM: s390: reduce number of IO pins to 1
    - regmap: fix alignment issue
    - [x86] perf/x86/rapl: Move RAPL support to common x86 code
    - [x86] perf/x86/rapl: Fix RAPL config variable bug
    - [armhf] dts: omap4-droid4: Fix spi configuration and increase rate
    - drm/ttm: Fix dma_fence refcnt leak in ttm_bo_vm_fault_reserved
    - drm/ttm: Fix dma_fence refcnt leak when adding move fence
    - [arm64,armhf] gpu: host1x: Clean up debugfs in error handling path
    - [arm64,armhf] drm/tegra: hub: Do not enable orphaned window group
    - [arm64,armhf] gpu: host1x: Detach driver on unregister
    - [x86] ASoC: SOF: Intel: add PCI ID for CometLake-S
    - ASoC: hdac_hda: fix memleak with regmap not freed on remove
    - [x86] ALSA: hda: Intel: add missing PCI IDs for ICL-H, TGL-H and EKL
    - spi: spidev: fix a race between spidev_release and spidev_remove
    - spi: spidev: fix a potential use-after-free in spidev_release()
    - [arm64,armhf] net: ethernet: mvneta: Fix Serdes configuration for SoCs
      without comphy
    - [arm64,armhf] net: ethernet: mvneta: Add 2500BaseX support for SoCs
      without comphy
    - ixgbe: protect ring accesses with READ- and WRITE_ONCE
    - i40e: protect ring accesses with READ- and WRITE_ONCE
    - ice: protect ring accesses with WRITE_ONCE
    - [powerpc*] kvm/book3s64: Fix kernel crash with nested kvm & DEBUG_VIRTUAL
    - xprtrdma: Prevent dereferencing r_xprt->rx_ep after it is freed
    - [x86] iommu/vt-d: Don't apply gfx quirks to untrusted devices
    - [x86] drm: panel-orientation-quirks: Add quirk for Asus T101HA panel
    - [x86] drm: panel-orientation-quirks: Use generic orientation-data for
      Acer S1003
    - [s390x] kasan: fix early pgm check handler execution
    - cifs: update ctime and mtime during truncate
    - [armhf] imx6: add missing put_device() call in imx6q_suspend_init()
    - scsi: qla2xxx: Fix MPI failure AEN (8200) handling
    - scsi: mptscsih: Fix read sense data size
    - [arm64,armhf] usb: dwc3: pci: Fix reference count leak in
      dwc3_pci_resume_work
    - [arm64] kpti: Add KRYO{3, 4}XX silver CPU cores to kpti safelist
    - block: release bip in a right way in error path
    - nvme-rdma: assign completion vector correctly
    - [x86] entry: Increase entry_stack size to a full page
    - [arm64] Add KRYO{3,4}XX silver CPU cores to SSB safelist
    - nfs: Fix memory leak of export_path
    - sched/core: Check cpus_mask, not cpus_ptr in __set_cpus_allowed_ptr(), to
      fix mask corruption
    - mtd: set master partition panic write flag
    - [arm64,armhf] gpio: pca953x: Synchronize interrupt handler properly
    - [arm64,armhf] gpio: pca953x: Fix direction setting when configure an IRQ
    - [arm64] KVM: arm64: vgic-v4: Plug race between non-residency and v4.1
      doorbell
    - mac80211: Fix dropping broadcast packets in 802.11 encap
    - bpf: Do not allow btf_ctx_access with __int128 types
    - nl80211: don't return err unconditionally in nl80211_start_ap()
    - nl80211: fix memory leak when parsing NL80211_ATTR_HE_BSS_COLOR
    - bpf, sockmap: RCU splat with redirect and strparser error or TLS
    - bpf, sockmap: RCU dereferenced psock may be used outside RCU block
    - netfilter: ipset: call ip_set_free() instead of kfree()
    - [arm64,armhf] net: mvneta: fix use of state->speed
    - net: cxgb4: fix return error value in t4_prep_fw
    - btrfs: fix reclaim_size counter leak after stealing from global reserve
    - [arm64] drm/meson: viu: fix setting the OSD burst length in
      VIU_OSD1_FIFO_CTRL_STAT
    - IB/sa: Resolv use-after-free in ib_nl_make_request()
    - netfilter: conntrack: refetch conntrack after nf_conntrack_update()
    - perf report TUI: Fix segmentation fault in perf_evsel__hists_browse()
    - [x86] perf intel-pt: Fix recording PEBS-via-PT with registers
    - [x86] perf intel-pt: Fix PEBS sample for XMM registers
    - smsc95xx: check return value of smsc95xx_reset
    - smsc95xx: avoid memory leak in smsc95xx_bind
    - [arm64] net: hns3: check reset pending after FLR prepare
    - [arm64] net: hns3: fix for mishandle of asserting VF reset fail
    - [arm64] net: hns3: add a missing uninit debugfs when unload driver
    - [arm64] net: hns3: fix use-after-free when doing self test
    - ALSA: compress: fix partial_drain completion state
    - net: qed: fix buffer overflow on ethtool -d
    - [powerpc*] 64s/exception: Fix 0x1500 interrupt handler crash
    - RDMA/siw: Fix reporting vendor_part_id
    - net: atlantic: fix ip dst and ipv6 address filters
    - nbd: Fix memory leak in nbd_add_socket
    - cxgb4: fix all-mask IP address comparison
    - IB/mlx5: Fix 50G per lane indication
    - qed: Populate nvm-file attributes while reading nvm config partition.
    - net/mlx5: Fix eeprom support for SFP module
    - net/mlx5e: Fix VXLAN configuration restore after function reload
    - net/mlx5e: Fix CPU mapping after function reload to avoid aRFS RX crash
    - net/mlx5e: Fix 50G per lane indication
    - net/mlx5e: CT: Fix memory leak in cleanup
    - bnxt_en: fix NULL dereference in case SR-IOV configuration fails
    - [arm64,riscv64] net: macb: fix wakeup test in runtime suspend/resume
      routines
    - [arm64,riscv64] net: macb: mark device wake capable when "magic-packet"
      property present
    - [arm64,riscv64] net: macb: fix macb_get/set_wol() when moving to phylink
    - [arm64,riscv64] net: macb: fix macb_suspend() by removing call to
      netif_carrier_off()
    - [arm64,riscv64] net: macb: fix call to pm_runtime in the suspend/resume
      functions
    - IB/hfi1: Do not destroy hfi1_wq when the device is shut down
    - IB/hfi1: Do not destroy link_wq when the device is shut down
    - [i386,alpha,hppa] ALSA: opl3: fix infoleak in opl3
    - ALSA: hda - let hs_mic be picked ahead of hp_mic
    - ALSA: usb-audio: add quirk for MacroSilicon MS2109
    - ALSA: usb-audio: Add implicit feedback quirk for RTX6001
    - [x86] ALSA: hda/realtek - Fix Lenovo Thinkpad X1 Carbon 7th quirk
      subdevice id
    - ALSA: hda/realtek - Enable audio jacks of Acer vCopperbox with ALC269VC
    - [x86] ALSA: hda/realtek: Enable headset mic of Acer C20-820 with ALC269VC
    - [x86] ALSA: hda/realtek: Enable headset mic of Acer Veriton N4660G with
      ALC269VC
    - [arm64] KVM: arm64: Fix definition of PAGE_HYP_DEVICE
    - [arm64] KVM: arm64: Stop clobbering x0 for HVC_SOFT_RESTART
    - [arm64] KVM: arm64: Annotate hyp NMI-related functions as __always_inline
    - [x86] KVM: x86: bit 8 of non-leaf PDPEs is not reserved
    - [x86] KVM: x86: Inject #GP if guest attempts to toggle CR4.LA57 in 64-bit
      mode
    - [x86] KVM: x86: Mark CR4.TSD as being possibly owned by the guest
    - [arm64] KVM: arm64: Fix kvm_reset_vcpu() return code being incorrect with
      SVE
    - io_uring: fix memleak in __io_sqe_files_update()
    - io_uring: account user memory freed when exit has been queued
    - io_uring: fix memleak in io_sqe_files_register()
    - io_uring: fix missing msg_name assignment
    - kallsyms: Refactor kallsyms_show_value() to take cred
    - module: Refactor section attr into bin attribute
    - module: Do not expose section addresses to non-CAP_SYSLOG
    - kprobes: Do not expose probe addresses to non-CAP_SYSLOG
    - bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok()
    - Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb"
      (Closes: #964153, #964480)
    - btrfs: fix fatal extent_buffer readahead vs releasepage race
    - btrfs: reset tree root pointer after error in init_tree_roots
    - btrfs: discard: add missing put when grabbing block group from unused list
    - btrfs: fix double put of block group with nocow
    - drm/radeon: fix double free
    - [x86] drm/i915/gt: Pin the rings before marking active
    - [x86] drm/i915: Skip stale object handle for debugfs per-file-stats
    - drm/amdgpu: don't do soft recovery if gpu_recovery=0
    - drm/amdgpu: add TMR destory function for psp
    - drm/amdgpu: asd function needs to be unloaded in suspend phase
    - [x86] drm/i915: Drop vm.ref for duplicate vma on construction
    - [x86] drm/i915: Also drop vm.ref along error paths for vma construction
    - cifs: fix reference leak for tlink
    - smb3: fix access denied on change notify request to some servers
    - smb3: fix unneeded error message on change notify
    - dm: use noio when sending kobject event
    - [arm64] mmc: meson-gx: limit segments to 1 when dram-access-quirk is
      needed
    - [x86] pinctrl: baytrail: Fix pin being driven low for a while on
      gpiod_get(..., GPIOD_OUT_HIGH)
    - [s390x] setup: init jump labels before command line parsing
    - [s390x] mm: fix huge pte soft dirty copying
    - [arm64] Introduce a way to disable the 32bit vdso
    - [arm64] arch_timer: Allow an workaround descriptor to disable compat vdso
    - [arm64] arch_timer: Disable the compat vdso for cores affected by
      ARM64_WORKAROUND_1418040
    - blk-mq: consider non-idle request as "inflight" in blk_mq_rq_inflight()
    - dm writecache: reject asynchronous pmem devices
    - perf scripts python: export-to-postgresql.py: Fix struct.pack() int
      argument
    - perf scripts python: exported-sql-viewer.py: Fix zero id in call graph
      'Find' result
    - perf scripts python: exported-sql-viewer.py: Fix zero id in call tree
      'Find' result
    - perf scripts python: exported-sql-viewer.py: Fix unexpanded 'Find' result
    - perf scripts python: exported-sql-viewer.py: Fix time chart call tree
    - [s390x] Change s390_kernel_write() return type to match memcpy()
    - [s390x] maccess: add no DAT mode to kernel_write
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.10
    - bridge: mcast: Fix MLD2 Report IPv6 payload length check
    - genetlink: remove genl_bind
    - ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
    - ipv6: fib6_select_path can not use out path for nexthop objects
    - ipv6: Fix use of anycast address with loopback
    - l2tp: remove skb_dst_set() from l2tp_xmit_skb()
    - llc: make sure applications use ARPHRD_ETHER
    - net: Added pointer check for dst->ops->neigh_lookup in
      dst_neigh_lookup_skb
    - net_sched: fix a memory leak in atm_tc_init()
    - net: usb: qmi_wwan: add support for Quectel EG95 LTE modem
    - sched: consistently handle layer3 header accesses in the presence of
      VLANs
    - tcp: fix SO_RCVLOWAT possible hangs under high mem pressure
    - tcp: make sure listeners don't initialize congestion-control state
    - tcp: md5: add missing memory barriers in tcp_md5_do_add()/
      tcp_md5_hash_key()
    - tcp: md5: do not send silly options in SYNCOOKIES
    - vlan: consolidate VLAN parsing code and limit max parsing depth
    - tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers
    - tcp: md5: allow changing MD5 keys in all socket states
    - cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
    - cgroup: Fix sock_cgroup_data on big-endian.
    - ip: Fix SO_MARK in RST, ACK and ICMP packets
    - genetlink: get rid of family->attrbuf
    - net: ipv4: Fix wrong type conversion from hint to rt in
      ip_route_use_hint()
    - ethtool: fix genlmsg_put() failure handling in ethnl_default_dumpit()
    - [arm64] drm/msm: fix potential memleak in error branch
    - [arm64] drm/msm/dpu: allow initialization of encoder locks during encoder
      init
    - [armhf] drm/exynos: Properly propagate return value in
      drm_iommu_attach_device()
    - [armhf] drm/exynos: fix ref count leak in mic_pre_enable
    - [x86] fpu: Reset MXCSR to default in kernel_fpu_begin()
    - [armhf] thermal/drivers: imx: Fix missing of_node_put() at probe time
    - [x86] ACPI: DPTF: Add battery participant for TigerLake
    - blk-mq-debugfs: update blk_queue_flag_name[] accordingly for new flags
    - [m68k] mm: fix node memblock init
    - cifs: prevent truncation from long to int in wait_for_free_credits
    - [arm64] alternatives: use subsections for replacement sequences
    - tpm_tis: extra chip->ops check on error path in tpm_tis_core_init
    - xen/xenbus: avoid large structs and arrays on the stack
    - xen/xenbus: let xenbus_map_ring_valloc() return errno values only
    - gfs2: eliminate GIF_ORDERED in favor of list_empty
    - gfs2: freeze should work on read-only mounts
    - gfs2: read-only mounts should grab the sd_freeze_gl glock
    - gfs2: When freezing gfs2, use GL_EXACT and not GL_NOCACHE
    - gfs2: The freeze glock should never be frozen
    - [arm64] Add MIDR value for KRYO4XX gold CPU cores
    - [arm64] Add KRYO4XX gold CPU cores to erratum list 1463225 and 1418040
    - [arm64] Add KRYO4XX silver CPU cores to erratum list 1530923 and 1024718
    - [i386,mips*/boston] i2c: eg20t: Load module automatically if ID matches
    - [arm64] alternatives: don't patch up internal branches
    - iio: core: add missing IIO_MOD_H2/ETHANOL string identifiers
    - [armhf] iio: mma8452: Add missed iio_device_unregister() call in
      mma8452_probe()
    - [arm64] Add missing sentinel to erratum_1463225
    - xen/xenbus: Fix a double free in xenbus_map_ring_pv()
    - [arm64,armhf] net: ethernet: mvneta: Do not error out in non serdes modes
    - [arm64,armhf] net: ethernet: mvneta: Add back interface mode validation
    - scsi: qla2xxx: make 1-bit bit-fields unsigned int
    - io_uring: fix recvmsg memory leak with buffer selection
    - [arm64,armhf] phy: rockchip: Fix return value of inno_dsidphy_probe()
    - [arm64,armhf] phy: sun4i-usb: fix dereference of pointer phy0 before it
      is null checked
    - [arm64] dts: meson: add missing gxl rng clock
    - [arm64] dts: meson-gxl-s805x: reduce initial Mali450 core frequency
    - [armhf] bus: ti-sysc: Fix wakeirq sleeping function called from invalid
      context
    - [armhf] bus: ti-sysc: Fix sleeping function called from invalid context
      for RTC quirk
    - [armhf] bus: ti-sysc: Do not disable on suspend for no-idle
    - [x86] dmaengine: dw: Initialize channel before each transfer
    - [armhf] spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock
      rate
    - [x86] staging: comedi: verify array index is correct before using it
    - serial: core: Initialise spin lock before use in uart_configure_port()
    - [arm64,armhf] clk: mvebu: ARMADA_AP_CPU_CLK needs to select
      ARMADA_AP_CP_HELPER
    - [armhf] clk: AST2600: Add mux for EMMC clock
    - xprtrdma: Fix double-free in rpcrdma_ep_create()
    - xprtrdma: Fix recursion into rpcrdma_xprt_disconnect()
    - xprtrdma: Fix return code from rpcrdma_xprt_connect()
    - xprtrdma: Fix handling of connect errors
    - NFS: Fix interrupted slots by sending a solo SEQUENCE operation
    - fuse: don't ignore errors from fuse_writepages_fill()
    - xprtrdma: fix incorrect header size calculations
    - [armhf] dts: socfpga: Align L2 cache-controller nodename with dtschema
    - keys: asymmetric: fix error return code in software_key_query()
    - nvme: explicitly update mpath disk capacity on revalidation
    - regmap: debugfs: Don't sleep while atomic for fast_io regmaps
    - copy_xstate_to_kernel: Fix typo which caused GDB regression
    - apparmor: ensure that dfa state tables have entries
    - RDMA/rxe: Set default vendor ID
    - PCI/PM: Call .bridge_d3() hook only if non-NULL
    - perf stat: Zero all the 'ena' and 'run' array slot stats for interval
      mode
    - RDMA/mlx5: Verify that QP is created with RQ or SQ
    - [arm64] clk: qcom: Add missing msm8998 ufs_unipro_core_clk_src
    - mtd: spi-nor: winbond: Fix 4-byte opcode support for w25q256
    - mtd: spi-nor: spansion: fix writes on S25FS512S
    - [armhf] mtd: rawnand: marvell: Fix the condition on a return code
    - [armhf] mtd: rawnand: marvell: Use nand_cleanup() when the device is not
      yet registered
    - [armhf] mtd: rawnand: marvell: Fix probe error path
    - mtd: rawnand: timings: Fix default tR_max and tCCS_min timings
    - [arm64] clk: qcom: gcc: Add GPU and NPU clocks for SM8150
    - [arm64] clk: qcom: gcc: Add missing UFS clocks for SM8150
    - [arm64] clk: qcom: gcc: Add support for a new frequency for SC7180
    - HID: logitech-hidpp: avoid repeated "multiplier = " log messages
    - HID: magicmouse: do not set up autorepeat
    - HID: quirks: Always poll Obins Anne Pro 2 keyboard
    - HID: quirks: Ignore Simply Automated UPB PIM
    - ALSA: line6: Perform sanity check for each URB creation
    - ALSA: line6: Sync the pending work cancel at disconnection
    - ALSA: usb-audio: Fix race against the error recovery URB submission
    - [x86] ALSA: hda/realtek - change to suitable link model for ASUS platform
    - [x86] ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus
      G14(G401) series with ALC289
    - [x86] ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31
      with ALC256
    - [x86] ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534
    - [x86] ALSA: hda/realtek - Enable Speaker for ASUS UX563
    - [x86] thunderbolt: Fix path indices used in USB3 tunnel discovery
    - [arm64,armhf] usb: dwc2: Fix shutdown callback in platform
    - [arm64,armh] usb: chipidea: core: add wakeup support for extcon
    - usb: gadget: function: fix missing spinlock in f_uac1_legacy
    - USB: serial: iuu_phoenix: fix memory corruption
    - USB: serial: cypress_m8: enable Simply Automated UPB PIM
    - USB: serial: ch341: add new Product ID for CH340
    - USB: serial: option: add GosunCn GM500 series
    - USB: serial: option: add Quectel EG95 LTE modem
    - [x86] virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers
      to match upstream
    - [x86] virt: vbox: Fix guest capabilities mask check
    - [arm64] Revert "tty: xilinx_uartps: Fix missing id assignment to the
      console"
    - virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc
      serial
    - [sh4] serial: sh-sci: Initialize spinlock for uart console
    - Revert "serial: core: Refactor uart_unlock_and_check_sysrq()"
    - serial: core: fix sysrq overhead regression
    - ovl: fix regression with re-formatted lower squashfs
    - ovl: inode reference leak in ovl_is_inuse true case.
    - ovl: relax WARN_ON() when decoding lower directory file handle
    - ovl: fix unneeded call to ovl_change_flags()
    - fuse: ignore 'data' argument of mount(..., MS_REMOUNT)
    - fuse: use ->reconfigure() instead of ->remount_fs()
    - fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS
    - Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()"
      (CVE-2020-10781)
    - [x86] mei: bus: don't clean driver pointer
    - [arm64] Revert "Input: elants_i2c - report resolution information for
      touch major"
    - [x86] Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list
    - [x86] Input: elan_i2c - add more hardware ID for Lenovo laptops
    - scsi: megaraid_sas: Remove undefined ENABLE_IRQ_POLL macro
    - timer: Prevent base->clk from moving backward
    - timer: Fix wheel index calculation on last level
    - [riscv64] use 16KB kernel stack on 64-bit
    - hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
    - hwmon: (drivetemp) Avoid SCT usage on Toshiba DT01ACA family drives
    - [powerpc*] book3s64/pkeys: Fix pkey_access_permitted() for execute
      disable pkey
    - [powerpc*] pseries/svm: Fix incorrect check for shared_lppaca_size
    - [x86] intel_th: pci: Add Jasper Lake CPU support
    - [x86] intel_th: pci: Add Tiger Lake PCH-H support
    - [x86] intel_th: pci: Add Emmitsburg PCH support
    - [x86] intel_th: Fix a NULL dereference when hub driver is not loaded
    - opp: Increase parsed_static_opps in _of_add_opp_table_v1()
    - dmabuf: use spinlock to access dmabuf->name
    - [x86] thermal: int3403_thermal: Downgrade error message
    - [armhf] dts: imx6qdl-gw551x: fix audio SSI
    - [arm64] ptrace: Override SPSR.SS when single-stepping is enabled
    - [arm64] ptrace: Consistently use pseudo-singlestep exceptions
    - [arm64] compat: Ensure upper 32 bits of x0 are zero on syscall return
    - sched: Fix unreliable rseq cpu_id for new tasks
    - sched/fair: handle case of task_h_load() returning 0
    - [x86] ioperm: Fix io bitmap invalidation on Xen PV
    - genirq/affinity: Handle affinity setting on inactive interrupts correctly
    - [x86] drm/vmwgfx: fix update of display surface when resolution changes
    - drm/amdgpu/powerplay: Modify SMC message name for setting power profile
      mode
    - drm/amdgpu/sdma5: fix wptr overwritten in ->get_wptr()
    - drm/amd/display: handle failed allocation during stream construction
    - drm/amd/display: OLED panel backlight adjust not work with external
      display connected
    - drm/amdgpu/display: create fake mst encoders ahead of time (v4)
    - [x86] drm/i915: Move cec_notifier to intel_hdmi_connector_unregister, v2.
    - [x86] drm/i915/gt: Ignore irq enabling on the virtual engines
    - [x86] drm/i915/gt: Only swap to a random sibling once upon creation
    - libceph: don't omit recovery_deletes in target_copy()
    - rxrpc: Fix trace string
    - [x86] iommu/vt-d: Make Intel SVM code 64-bit only
    - mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages()
    - [x86] drm/i915/gvt: Fix two CFL MMIO handling caused by regression.
    - [arm64,armhf] gpio: pca953x: disable regmap locking for automatic address
      incrementing
    - bpf: sockmap: Check value of unused args to BPF_PROG_ATTACH
    - bpf: sockmap: Require attach_bpf_fd when detaching a program
    - [x86] drm/i915/perf: Use GTT when saving/restoring engine GPR

  [ Aurelien Jarno ]
  * Enable perf on riscv64.

  [ Salvatore Bonaccorso ]
  * drivers/net/ethernet/intel: Enable IGC as module (Closes: #965931)
  * [x86] ioperm: Fix io bitmap invalidation on Xen PV (CVE-2020-15852,
    XSA-329)
  * certs: Rotate to use the Debian Secure Boot Signer 2020 certificate
  * perf cs-etm: Move definition of 'traceid_list' global variable from header
    file (Closes: #957491)
  * usbip: tools: fix build error for multiple definition

  [ Ben Hutchings ]
  * libtraceevent: Fix build with binutils 2.35
  * Bump ABI to 2

  [ John Paul Adrian Glaubitz ]
  * [sh4] Add patch to implement __get_user_u64()

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 26 Jul 2020 08:40:40 +0200

linux (5.7.6-1) unstable; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.7
    - [x86] syscalls: Revert "x86/syscalls: Make __X32_SYSCALL_BIT be unsigned
      long" (Closes: #954294)
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.2
    - vt: keyboard: avoid signed integer overflow in k_ascii (CVE-2020-13974)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.3
    - [x86] speculation: Prevent rogue cross-process SSBD shutdown
      (CVE-2020-10766)
    - [x86] speculation: Avoid force-disabling IBPB based on STIBP and
      enhanced IBRS. (CVE-2020-10767)
    - [x86] speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect
      branches. (CVE-2020-10768)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.4
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.5
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.6

  [ Ben Hutchings ]
  * fs: Enable EXFAT_FS as module (Closes: #959781)
  * Fix conversion of meta-package doc directories to symlinks
    (Closes: #942861)

  [ Vagrant Cascadian ]
  * [arm64] Enable DRM_ANALOGIX_ANX6345 as a module.
  * [arm64] Add analogix-anx6345, pwm-sun4i, sun4i-drm and sun8i-mixer to
    fb-modules udeb.

  [ Helge Deller ]
  * [hppa] Don't run dh_strip on vmlinuz (Closes: #961299)

  [ YunQiang Su ]
  * [mips/loongson-3] Enable SERIAL_OF_PLATFORM and OF (Closes: 961328)

  [ Aurelien Jarno ]
  * Enable CONFIG_NVME_HWMON (Closes: #961823)

  [ Romain Perier ]
  * [arm64] Enable PCIE_BRCMSTB
  * [arm64] Enable BCM2711_THERMAL

  [ Salvatore Bonaccorso ]
  * nfsd: apply umask on fs without ACL support (Closes: #962254)
  * [rt] Add new signing key for Tom Zanussi
  * Set ABI to 1
  * [arm64] Remove explicit setting of CONFIG_HNS
  * debian/config: Clean up with the help of kconfigeditor2

  [ Gianfranco Costamagna ]
  * [x86] Enable VBOXSF_FS as a module (Closes: #961516)

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 24 Jun 2020 20:56:57 +0200

linux (5.7~rc5-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Romain Perier ]
  * Enable support for fsverity

  [ Ben Hutchings ]
  * [rt] Disable until it is updated for 5.5 or later
  * lockdown: Update Secure Boot support patches for 5.7
  * [amd64] Update "x86: Make x32 syscall support conditional ..." for 5.7
  * Update "tools/perf: pmu-events: Fix reproducibility" for 5.7

 -- Ben Hutchings <benh@debian.org>  Sun, 10 May 2020 23:42:53 +0100

linux (5.6.14-2) unstable; urgency=medium

  [ Vagrant Cascadian ]
  * [arm64] Add pwm-sun4i to fb-modules udeb.

  [ Salvatore Bonaccorso ]
  * kernel/relay.c: handle alloc_percpu returning NULL in relay_open
    (CVE-2019-19462)
  * fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
    (CVE-2020-10732)
  * mm: Fix mremap not considering huge pmd devmap (CVE-2020-10757)

  [ Ben Hutchings ]
  * [x86] Add support for mitigation of Special Register Buffer Data Sampling
    (SRBDS) (CVE-2020-0543):
    - x86/cpu: Add 'table' argument to cpu_matches()
    - x86/speculation: Add Special Register Buffer Data Sampling (SRBDS)
      mitigation
    - x86/speculation: Add SRBDS vulnerability and mitigation documentation
    - x86/speculation: Add Ivy Bridge to affected list
  * [x86] speculation: Do not match steppings, to avoid an ABI change

 -- Ben Hutchings <benh@debian.org>  Tue, 09 Jun 2020 18:50:00 +0100

linux (5.6.14-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.8
    - mm: check that mm is still valid in madvise()
    - watchdog: reset last_hw_keepalive time at start
    - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
    - xfs: correctly acount for reclaimable slabs
    - scsi: lpfc: Fix crash after handling a pci error
    - scsi: lpfc: Fix crash in target side cable pulls hitting WAIT_FOR_UNREG
    - scsi: libfc: If PRLI rejected, move rport to PLOGI state
    - ceph: return ceph_mdsc_do_request() errors from __get_parent()
    - ceph: don't skip updating wanted caps when cap is stale
    - [armhf] pwm: imx27: Fix clock handling in pwm_imx27_apply()
    - nvme-tcp: fix possible crash in write_zeroes processing
    - scsi: iscsi: Report unbind session event when the target has been
      removed
    - [x86] ASoC: Intel: atom: Take the drv->lock mutex before calling
      sst_send_slot_map()
    - nvme: fix deadlock caused by ANA update wrong locking
    - drm/amd/display: Update stream adjust in dc_stream_adjust_vmin_vmax
    - dma-direct: fix data truncation in dma_direct_get_required_mask()
    - kernel/gcov/fs.c: gcov_seq_next() should increase position index
    - ipc/util.c: sysvipc_find_ipc() should increase position index
    - block: fix busy device checking in blk_drop_partitions
    - [s390x] cio: generate delayed uevent for vfio-ccw subchannels
    - [s390x] cio: avoid duplicated 'ADD' uevents
    - loop: Better discard support for block devices
    - [powerpc*] Revert "powerpc/64: irq_work avoid interrupt when called with
      hardware irqs enabled"
    - [powerpc*] pseries: Fix MCE handling on pseries
    - nvme: fix compat address handling in several ioctls
    - pwm: renesas-tpu: Fix late Runtime PM enablement
    - [armel, armhf, arm64] pwm: bcm2835: Dynamically allocate base
    - scsi: lpfc: Fix erroneous cpu limit of 128 on I/O statistics
    - scsi: lpfc: Fix lockdep error - register non-static key
    - perf/core: Disable page faults when getting phys address
    - drm/amd/display: Calculate scaling ratios on every medium/full update
    - ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN MPWIN895CL tablet
    - ALSA: usb-audio: Add Pioneer DJ DJM-250MK2 quirk
    - xhci: Ensure link state is U3 after setting USB_SS_PORT_LS_U3
    - xhci: Wait until link state trainsits to U0 after setting
      USB_SS_PORT_LS_U0
    - xhci: Finetune host initiated USB3 rootport link suspend and resume
    - block: fix busy device checking in blk_drop_partitions again
    - cxgb4: fix adapter crash due to wrong MC size
    - cxgb4: fix large delays in PTP synchronization
    - ipv4: Update fib_select_default to handle nexthop objects
    - ipv6: fix restrict IPV6_ADDRFORM operation
    - macsec: avoid to set wrong mtu
    - macvlan: fix null dereference in macvlan_device_event()
    - mlxsw: Fix some IS_ERR() vs NULL bugs
    - [arm64] net: bcmgenet: correct per TX/RX ring statistics
    - net/mlx4_en: avoid indirect call in TX completion
    - net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
    - net: openvswitch: ovs_ct_exit to be done under ovs_lock
    - [armhf, arm64] net: stmmac: dwmac-meson8b: Add missing boundary to RGMII
      TX clock array
    - net/x25: Fix x25_neigh refcnt leak when receiving frame
    - sched: etf: do not assume all sockets are full blown
    - tcp: cache line align MAX_TCP_HEADER
    - team: fix hang in team_mode_get()
    - tipc: Fix potential tipc_aead refcnt leak in tipc_crypto_rcv
    - tipc: Fix potential tipc_node refcnt leak in tipc_rcv
    - vrf: Fix IPv6 with qdisc and xfrm
    - net: dsa: b53: Lookup VID in ARL searches when VLAN is enabled
    - net: dsa: b53: Fix valid setting for MDB entries
    - net: dsa: b53: Fix ARL register definitions
    - net: dsa: b53: Rework ARL bin logic
    - net: dsa: b53: b53_arl_rw_op() needs to select IVL or SVL
    - vxlan: use the correct nlattr array in NL_SET_ERR_MSG_ATTR
    - geneve: use the correct nlattr array in NL_SET_ERR_MSG_ATTR
    - xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
    - vrf: Check skb for XFRM_TRANSFORMED flag
    - net: ethernet: ixp4xx: Add error handling in ixp4xx_eth_probe()
    - KEYS: Avoid false positive ENOMEM error on key read
    - ALSA: hda: Remove ASUS ROG Zenith from the blacklist
    - ALSA: usb-audio: Add static mapping table for ALC1220-VB-based mobos
    - ALSA: usb-audio: Add connector notifier delegation
    - mac80211: populate debugfs only after cfg80211 init
    - libbpf: Only check mode flags in get_xdp_id
    - iio: core: remove extra semi-colon from devm_iio_device_register() macro
    - iio: imu: st_lsm6dsx: flush hw FIFO before resetting the device
    - iio: st_sensors: rely on odr mask to know if odr can be set
    - iio: adc: stm32-adc: fix sleep in atomic context
    - iio: adc: ti-ads8344: properly byte swap value
    - USB: sisusbvga: Change port variable from signed to unsigned
    - USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair
      K70 RGB RAPIDFIRE
    - USB: early: Handle AMD's spec-compliant identifiers, too
    - USB: core: Fix free-while-in-use bug in the USB S-Glibrary
      (CVE-2020-12464)
    - USB: hub: Fix handling of connect changes during sleep
    - USB: hub: Revert commit bd0e6c9614b9 ("usb: hub: try old enumeration
      scheme first for high speed devices")
    - tty: serial: owl: add "much needed" clk_prepare_enable()
    - vmalloc: fix remap_vmalloc_range() bounds checks
    - staging: gasket: Fix incongruency in handling of sysfs entries creation
    - coredump: fix null pointer dereference on coredump
    - mm/hugetlb: fix a addressing exception caused by huge_pte_offset
    - mm/ksm: fix NULL pointer dereference when KSM zero page is enabled
    - ALSA: usx2y: Fix potential NULL dereference
    - ALSA: hda/realtek - Fix unexpected init_amp override
    - ALSA: hda/realtek - Add new codec supported for ALC245
    - ALSA: hda/hdmi: Add module option to disable audio component binding
    - ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif
    - ALSA: usb-audio: Filter out unsupported sample rates on Focusrite
      devices
    - tpm/tpm_tis: Free IRQ if probing fails
    - tpm: fix wrong return value in tpm_pcr_extend
    - tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send()
    - [s390x] KVM: Return last valid slot if approx index is out-of-bounds
    - KVM: Check validity of resolved slot when searching memslots
    - [x86] KVM: VMX: Enable machine check support for 32bit targets
    - tty: hvc: fix buffer overflow during hvc_alloc().
    - tty: rocket, avoid OOB access
    - usb-storage: Add unusual_devs entry for JMicron JMS566
    - signal: Avoid corrupting si_pid and si_uid in do_notify_parent
    - drm/dp_mst: Zero assigned PBN when releasing VCPI slots
    - audit: check the length of userspace generated audit records
    - ASoC: dapm: fixup dapm kcontrol widget
    - SUNRPC: Fix backchannel RPC soft lockups
    - iwlwifi: pcie: actually release queue memory in TVQM
    - iwlwifi: mvm: beacon statistics shouldn't go backwards
    - iwlwifi: pcie: indicate correct RB size to device
    - iwlwifi: mvm: limit maximum queue appropriately
    - iwlwifi: mvm: Do not declare support for ACK Enabled Aggregation
    - iwlwifi: mvm: fix inactive TID removal return value usage
    - iwlwifi: fix WGDS check when WRDS is disabled
    - cifs: fix uninitialised lease_key in open_shroot()
    - [armhf] imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y
    - [powerpc*] 8xx: Fix STRICT_KERNEL_RWX startup test failure
    - [powerpc*] setup_64: Set cache-line-size based on cache-block-size
    - [x86] staging: comedi: dt2815: fix writing hi byte of analog output
    - [x86] staging: comedi: Fix comedi_device refcnt leak in comedi_open
    - vt: don't hardcode the mem allocation upper bound
    - vt: don't use kmalloc() for the unicode screen buffer
    - [x86] staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by
      default.
    - [x86] staging: vt6656: Fix calling conditions of vnt_set_bss_mode
    - [x86] staging: vt6656: Fix drivers TBTT timing counter.
    - [x86] staging: vt6656: Fix pairwise key entry save.
    - [x86] staging: vt6656: Power save stop wake_up_count wrap around.
    - [x86] mei: me: fix irq number stored in hw struct
    - cdc-acm: close race betrween suspend() and acm_softint
    - cdc-acm: introduce a cool down
    - UAS: no use logging any details in case of ENODEV
    - UAS: fix deadlock in error handling and PM flushing work
    - fpga: dfl: pci: fix return value of cci_pci_sriov_configure
    - [armhf, arm64] usb: dwc3: gadget: Fix request completion check
    - usb: f_fs: Clear OS Extended descriptor counts to zero in
      ffs_data_reset()
    - [x86] usb: typec: tcpm: Ignore CC and vbus changes in PORT_RESET change
    - [x86] usb: typec: altmode: Fix typec_altmode_get_partner sometimes
      returning an invalid pointer
    - xhci: Fix handling halted endpoint even if endpoint ring appears empty
    - xhci: prevent bus suspend if a roothub port detected a over-current
      condition
    - xhci: Don't clear hub TT buffer on ep0 protocol stall
    - serial: sh-sci: Make sure status register SCxSR is read in correct
      sequence
    - Revert "serial: uartps: Fix uartps_major handling"
    - Revert "serial: uartps: Use the same dynamic major number for all ports"
    - Revert "serial: uartps: Fix error path when alloc failed"
    - Revert "serial: uartps: Do not allow use aliases >= MAX_UART_INSTANCES"
    - Revert "serial: uartps: Change uart ID port allocation"
    - Revert "serial: uartps: Move Port ID to device data structure"
    - Revert "serial: uartps: Register own uart console and driver structures"
    - [x86] drm/i915/gt: Update PMINTRMSK holding fw
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.9
    - ubifs: Fix ubifs_tnc_lookup() usage in do_kill_orphans()
    - printk: queue wake_up_klogd irq_work only if per-CPU areas are ready
    - [armhf] ASoC: stm32: sai: fix sai probe
    - [armhf, arm64] usb: dwc3: gadget: Do link recovery for SS and SSP
    - [armel, armhf] ARM: dts: bcm283x: Add cells encoding format to firmware
      bus
    - usb: gadget: udc: bdc: Remove unnecessary NULL checks in
      bdc_req_complete
    - usb: gadget: udc: atmel: Fix vbus disconnect handling
    - afs: Make record checking use TASK_UNINTERRUPTIBLE when appropriate
    - afs: Fix to actually set AFS_SERVER_FL_HAVE_EPOCH
    - iio:ad7797: Use correct attribute_group
    - iio: imu: st_lsm6dsx: fix read misalignment on untagged FIFO
    - iio: imu: st_lsm6dsx: specify slave odr in slv_odr
    - propagate_one(): mnt_set_mountpoint() needs mount_lock
    - counter: 104-quad-8: Add lock guards - generic interface
    - [s390x] ftrace: fix potential crashes when switching tracers
    - ASoC: q6dsp6: q6afe-dai: add missing channels to MI2S DAIs
    - iwlwifi: actually check allocated conf_tlv pointer
    - ASoC: tas571x: disable regulators on failed probe
    - [armhf, arm64] ASoC: meson: axg-card: fix codec-to-codec link setup
    - ASoC: wm8960: Fix wrong clock after suspend & resume
    - nfsd: memory corruption in nfsd4_lock()
    - [armhf] dts: OMAP3: disable RNG on N950/N9
    - bpf: Forbid XADD on spilled pointers for unprivileged users
    - brcmfmac: add stub for monitor interface xmit
    - i2c: altera: use proper variable to hold errno
    - clk: asm9260: fix __clk_hw_register_fixed_rate_with_accuracy typo
    - rtw88: avoid unused function warnings
    - hwmon: (drivetemp) Return -ENODATA for invalid temperatures
    - rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket
    - netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag
    - [x86] efi: Don't remap text<->rodata gap read-only for mixed mode
    - net/cxgb4: Check the return from t4_query_params properly
    - tipc: fix incorrect increasing of link window
    - xfs: acquire superblock freeze protection on eofblocks scans
    - svcrdma: Fix trace point use-after-free race
    - svcrdma: Fix leak of svc_rdma_recv_ctxt objects
    - [armhf, arm64] net/mlx5e: Don't trigger IRQ multiple times on XSK wakeup
      to avoid WQ overruns
    - [armhf, arm64] net/mlx5e: Get the latest values from counters in
      switchdev mode
    - PCI: Avoid ASMedia XHCI USB PME# from D0 defect
    - PCI: Add Zhaoxin Vendor ID
    - PCI: Add ACS quirk for Zhaoxin multi-function devices
    - PCI: Add ACS quirk for Zhaoxin Root/Downstream Ports
    - PCI: Move Apex Edge TPU class quirk to fix BAR assignment
    - ARM: dts: bcm283x: Disable dsi0 node
    - cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled
    - [s390x] pci: do not set affinity for floating irqs
    - remoteproc: mtk_scp: use dma_addr_t for DMA API
    - net/mlx5: Fix failing fw tracer allocation on s390
    - sched/core: Fix reset-on-fork from RT with uclamp
    - perf/core: fix parent pid/tid in task exit events
    - netfilter: nat: fix error handling upon registering inet hook
    - PM: sleep: core: Switch back to async_schedule_dev()
    - blk-iocost: Fix error on iocost_ioc_vrate_adj
    - bpf: Fix handling of XADD on BTF memory
    - [x86] bpf: Fix encoding for lower 8-bit registers in BPF_STX BPF_B
    - [x86] bpf: x32: Fix incorrect encoding in BPF_LDX zero-extension
    - [x86] bpf: x32: Fix clobbering of dst for BPF_JSET
    - [x86] bpf, x32: Fix logic error in BPF_LDX zero-extension
    - bpf: Propagate expected_attach_type when verifying freplace programs
    - mm: shmem: disable interrupt when acquiring info->lock in
      userfaultfd_copy path
    - xfs: clear PF_MEMALLOC before exiting xfsaild thread
    - libbpf: Initialize *nl_pid so gcc 10 is happy
    - [armhf] net: fec: set GPR bit on suspend by DT configuration.
    - [x86] hyperv: report value of misc_features
    - signal: check sig before setting info in kill_pid_usb_asyncio
    - afs: Fix length of dump of bad YFSFetchStatus record
    - xfs: fix partially uninitialized structure in xfs_reflink_remap_extent
    - ALSA: hda: Release resources at error in delayed probe
    - ALSA: hda: Keep the controller initialization even if no codecs found
    - ALSA: hda: Explicitly permit using autosuspend if runtime PM is
      supported
    - drm/amdgpu: fix wrong vram lost counter increment V2
    - scsi: target: fix PR IN / READ FULL STATUS for FC
    - scsi: target: tcmu: reset_ring should reset TCMU_DEV_BIT_BROKEN
    - objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings
    - objtool: Support Clang non-section symbols in ORC dump
    - xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
    - ALSA: hda: call runtime_allow() for all hda controllers
    - net: stmmac: socfpga: Allow all RGMII modes
    - mac80211: fix channel switch trigger from unknown mesh peer
    - sched/isolation: Allow "isolcpus=" to skip unknown sub-parameters
    - sched/vtime: Work around an unitialized variable warning
    - [arm64] Delete the space separator in __emit_inst
    - ext4: use matching invalidatepage in ext4_writepage
    - ext4: increase wait time needed before reuse of deleted inode numbers
    - ext4: convert BUG_ON's to WARN_ON's in mballoc.c
    - irqchip/gic-v4.1: Add support for VPENDBASER's Dirty+Valid signaling
    - blk-mq: Put driver tag in blk_mq_dispatch_rq_list() when no budget
    - irqchip/meson-gpio: Fix HARDIRQ-safe -> HARDIRQ-unsafe lock order
    - hwmon: (jc42) Fix name to have no illegal characters
    - sfc: fix XDP-redirect in this driver
    - taprio: do not use BIT() in TCA_TAPRIO_ATTR_FLAG_* definitions
    - tipc: Add a missing case of TIPC_DIRECT_MSG type
    - qed: Fix race condition between scheduling and destroying the slowpath
      workqueue
    - Crypto: chelsio - Fixes a hang issue during driver registration
    - net: use indirect call wrappers for skb_copy_datagram_iter()
    - qed: Fix use after free in qed_chain_free
    - ext4: check for non-zero journal inum in ext4_calculate_overhead
    - ASoC: soc-pcm: fix regression in soc_new_pcm()
    - ASoC: soc-core: disable route checks for legacy devices
    - [armhf] ASoC: stm32: spdifrx: fix regmap status check
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.10
    - Revert "ASoC: meson: axg-card: fix codec-to-codec link setup"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.11
    - drm/scheduler: fix drm_sched_get_cleanup_job
    - dma-buf: Fix SET_NAME ioctl uapi
    - drm/amdgpu: invalidate L2 before SDMA IBs (v2)
    - drm/edid: Fix off-by-one in DispID DTD pixel clock
    - drm/amd/display: Fix green screen issue after suspend
    - [x86] drm/i915/gem: Hold obj->vma.lock over for_each_ggtt_vma()
    - [x86] drm/i915/gt: Check cacheline is valid before acquiring
    - drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
    - drm/qxl: qxl_release leak in qxl_hw_surface_alloc()
    - drm/qxl: qxl_release use after free
    - NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION
    - btrfs: fix transaction leak in btrfs_recover_relocation
    - btrfs: fix block group leak when removing fails
    - btrfs: fix partial loss of prealloc extent past i_size after fsync
    - btrfs: transaction: Avoid deadlock due to bad initialization timing of
      fs_info::journal_info
    - mmc: cqhci: Avoid false "cqhci: CQE stuck on" by not open-coding timeout
      loop
    - [arm64] mmc: sdhci-xenon: fix annoying 1.8V regulator warning
    - mmc: sdhci-pci: Fix eMMC driver strength for BYT-based controllers
    - [arm64] mmc: sdhci-msm: Enable host capabilities pertains to R1b
      response
    - [armhf] mmc: meson-mx-sdio: Set MMC_CAP_WAIT_WHILE_BUSY
    - [armhf] mmc: meson-mx-sdio: remove the broken ->card_busy() op
    - ALSA: hda/realtek - Two front mics on a Lenovo ThinkCenter
    - ALSA: usb-audio: Correct a typo of NuPrime DAC-10 USB ID
    - ALSA: hda/hdmi: fix without unlocked before return
    - ALSA: line6: Fix POD HD500 audio playback
    - ALSA: pcm: oss: Place the plugin buffer overflow checks correctly
    - [x86] i2c: amd-mp2-pci: Fix Oops in amd_mp2_pci_init() error handling
    - [x86] hyperv: Suspend/resume the VP assist page for hibernation
    - [x86] Drivers: hv: vmbus: Fix Suspend-to-Idle for Generation-2 VM
    - dlmfs_file_write(): fix the bogosity in handling non-zero *ppos
    - selinux: properly handle multiple messages in selinux_netlink_send()
    - [amd64] IB/rdmavt: Always return ERR_PTR from rvt_create_mmap_info()
    - PM: ACPI: Output correct message on target power state
    - PM: hibernate: Freeze kernel threads in software_resume()
    - dm writecache: fix data corruption when reloading the target
    - dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath
    - block: remove the bd_openers checks in blk_drop_partitions
    - scsi: qla2xxx: set UNLOADING before waiting for session deletion
    - scsi: qla2xxx: check UNLOADING before posting async work
    - RDMA/mlx5: Set GRH fields in query QP on RoCE
    - RDMA/uverbs: Fix a race with disassociate and exit_mmap()
    - RDMA/mlx4: Initialize ib_spec on the stack
    - RDMA/core: Prevent mixed use of FDs between shared ufiles
    - RDMA/core: Fix overwriting of uobj in case of error
    - RDMA/core: Fix race between destroy and release FD object
    - RDMA/cm: Fix ordering of xa_alloc_cyclic() in ib_create_cm_id()
    - RDMA/cm: Fix an error check in cm_alloc_id_priv()
    - [arm64] dmaengine: hisilicon: Fix build error without PCI_MSI
    - [x86,arm64] vfio: avoid possible overflow in vfio_iommu_type1_pin_pages
    - [x86,arm64] vfio/type1: Fix VA->PA translation for PFNMAP VMAs in
      vaddr_get_pfn()
    - [arm64] iommu/qcom: Fix local_base status check
    - dmaengine: fix channel index enumeration
    - scsi: target/iblock: fix WRITE SAME zeroing
    - iommu: Properly export iommu_group_get_for_dev()
    - [amd64] iommu/vt-d: Use right Kconfig option name
    - [amd64] iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled
      system
    - [armhf] i2c: aspeed: Avoid i2c interrupt status clear race condition.
    - [i386] ALSA: opti9xx: shut up gcc-10 range warning
    - Fix use after free in get_tree_bdev()
    - nvme: prevent double free in nvme_alloc_ns() error handling
    - nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl
    - [x86] drm/i915: Use proper fault mask in interrupt postinstall too
    - [arm64] vdso: Add -fasynchronous-unwind-tables to cflags
    - io_uring: statx must grab the file table for valid fd
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.12
    - vhost: vsock: kick send_pkt worker once device is started
    - [arm64,armhf] drm/bridge: analogix_dp: Split bind() into probe() and
      real bind()
    - [x86] ASoC: topology: Add missing memory checks
    - [x86] ASoC: topology: Check return value of soc_tplg_create_tlv
    - [x86] ASoC: topology: Check return value of soc_tplg_*_create
    - [x86] ASoC: topology: Check soc_tplg_add_route return value
    - [x86] ASoC: topology: Check return value of pcm_new_ver
    - [x86] ASoC: topology: Check return value of soc_tplg_dai_config
    - SUNRPC/cache: Fix unsafe traverse caused double-free in cache_purge
    - scsi: sg: add sg_remove_request in sg_write (CVE-2020-12770)
    - [armhf] ASoC: sgtl5000: Fix VAG power-on handling
    - [x86] ASoC: topology: Fix endianness issue
    - [arm64,armhf] usb: dwc3: gadget: Properly set maxpacket limit
    - [x86] ASoC: codecs: hdac_hdmi: Fix incorrect use of list_for_each_entry
    - wimax/i2400m: Fix potential urb refcnt leak
    - [armhf] net: stmmac: fix enabling socfpga's ptp_ref_clock
    - [arm64,armhf] net: stmmac: Fix sub-second increment
    - cifs: protect updating server->dstaddr with a spinlock
    - cifs: do not share tcons with DFS
    - tracing: Fix memory leaks in trace_events_hist.c
    - ftrace: Fix memory leak caused by not freeing entry in
      unregister_ftrace_direct()
    - mac80211: sta_info: Add lockdep condition for RCU list usage
    - [arm64] net: bcmgenet: suppress warnings on failed Rx SKB allocations
    - sctp: Fix SHUTDOWN CTSN Ack in the peer restart case
    - drm/amdgpu: Fix oops when pp_funcs is unset in ACPI event
    - ALSA: hda: Match both PCI ID and SSID for driver blacklist
    - [x86] kvm: fix a missing-prototypes "vmread_error"
    - [x86] platform: GPD pocket fan: Fix error message when temp-limits are
      out of range
    - ACPI: PM: s2idle: Fix comment in acpi_s2idle_prepare_late()
    - mac80211: add ieee80211_is_any_nullfunc()
    - cgroup, netclassid: remove double cond_resched
    - mm/mremap: Add comment explaining the untagging behaviour of mremap()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.13
    - [x86] thunderbolt: Check return value of tb_sw_read() in
      usb4_switch_op()
    - USB: serial: qcserial: Add DW5816e support
    - drm/amdgpu: move kfd suspend after ip_suspend_phase1
    - drm/amdgpu: drop redundant cg/pg ungate on runpm enter
    - vt: fix unicode console freeing with a common interface
    - [arm64] tty: xilinx_uartps: Fix missing id assignment to the console
    - ext4: don't set dioread_nolock by default for blocksize < pagesize
    - ext4: disable dioread_nolock whenever delayed allocation is disabled
    - nvme: refactor nvme_identify_ns_descs error handling
    - nvme: fix possible hang when ns scanning fails during error recovery
    - tracing/kprobes: Fix a double initialization typo
    - [arm64,riscv64] net: macb: Fix runtime PM refcounting
    - cxgb4: fix EOTID leak when disabling TC-MQPRIO offload
    - devlink: Fix reporter's recovery condition
    - devlink: fix return value after hitting end in region read
    - fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks
    - ipv6: Use global sernum for dst validation with nexthop objects
    - neigh: send protocol value in neighbor create notification
    - net: bridge: vlan: Add a schedule point during VLAN processing
    - [arm64,armhf] net: dsa: Do not leave DSA master with NULL netdev_ops
    - [arm64,armhf] net: dsa: Do not make user port errors fatal
    - [arm64,riscv64] net: macb: fix an issue about leak related system
      resources
    - net: macsec: preserve ingress frame ordering
    - net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc()
    - net: phy: marvell10g: fix temperature sensor on 2110
    - net_sched: sch_skbprio: add message validation to skbprio_change()
    - net: stricter validation of untrusted gso packets
    - net: usb: qmi_wwan: add support for DW5816e
    - nfp: abm: fix a memory leak bug
    - sch_choke: avoid potential panic in choke_reset()
    - sch_sfq: validate silly quantum values
    - tipc: fix partial topology connection closure
    - tunnel: Propagate ECT(1) when decapsulating as recommended by RFC6040
    - bnxt_en: Fix VF anti-spoof filter setup.
    - bnxt_en: Reduce BNXT_MSIX_VEC_MAX value to supported CQs per PF.
    - bnxt_en: Improve AER slot reset.
    - bnxt_en: Return error when allocating zero size context memory.
    - bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features().
    - net/mlx5: DR, On creation set CQ's arm_db member to right value
    - net/mlx5: Fix forced completion access non initialized command entry
    - net/mlx5: Fix command entry leak in Internal Error State
    - net/mlx5e: Fix q counters on uplink representors
    - [arm64,armhf] net: mvpp2: prevent buffer overflow in mvpp22_rss_ctx()
    - [arm64,armhf] net: mvpp2: cls: Prevent buffer overflow in
      mvpp2_ethtool_cls_rule_del()
    - wireguard: queueing: cleanup ptr_ring in error path of packet_queue_init
    - wireguard: receive: use tunnel helpers for decapsulating ECN markings
    - wireguard: socket: remove errant restriction on looping to self
    - wireguard: send/receive: cond_resched() when processing worker
      ringbuffers
    - HID: wacom: Read HID_DG_CONTACTMAX directly for non-generic devices
    - sctp: Fix bundling of SHUTDOWN with COOKIE-ACK
    - Revert "HID: wacom: generic: read the number of expected touches on a
      per collection basis"
    - HID: usbhid: Fix race between usbhid_close() and usbhid_stop()
    - HID: wacom: Report 2nd-gen Intuos Pro S center button status over BT
    - USB: uas: add quirk for LaCie 2Big Quadra
    - [arm64,armhf] usb: chipidea: msm: Ensure proper controller reset using
      role switch API
    - USB: serial: garmin_gps: add sanity checking for data length
    - tracing/boottime: Fix kprobe event API usage
    - tracing/kprobes: Reject new event if loc is NULL
    - tracing: Wait for preempt irq delay thread to finish
    - tracing: Add a vmalloc_sync_mappings() for safe measure
    - crypto: arch/lib - limit simd usage to 4k chunks
    - [s390x] KVM: Remove false WARN_ON_ONCE for the PQAP instruction
    - [x86] KVM: VMX: Explicitly clear RFLAGS.CF and RFLAGS.ZF in VM-Exit RSB
      path
    - [arm64,armhf] KVM: vgic: Fix limit condition when writing to
      GICD_I[CS]ACTIVER
    - [arm64] KVM: Fix 32bit PC wrap-around
    - [arm64] hugetlb: avoid potential NULL dereference
    - driver core: platform: Initialize dma_parms for platform devices
    - [arm*] amba: Initialize dma_parms for amba devices
    - [x86] mei: me: disable mei interface on LBG servers.
    - ipc/mqueue.c: change __do_notify() to bypass check_kill_permission()
    - epoll: atomically remove wait entry on wake up
    - eventpoll: fix missing wakeup for ovflist in ep_poll_callback
    - mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous()
    - mm: limit boost_watermark on small zones
    - ceph: fix endianness bug when handling MDS session feature bits
    - ceph: demote quotarealm lookup warning to a debug message
    - coredump: fix crash when umh is disabled
    - [riscv64] set max_pfn to the PFN of the last page
    - batman-adv: fix batadv_nc_random_weight_tq
    - batman-adv: Fix refcnt leak in batadv_show_throughput_override
    - batman-adv: Fix refcnt leak in batadv_store_throughput_override
    - batman-adv: Fix refcnt leak in batadv_v_ogm_process
    - [x86] mm/cpa: Flush direct map alias during cpa
    - [x86] entry/64: Fix unwind hints in register clearing code
    - [x86] entry/64: Fix unwind hints in kernel exit path
    - [x86] entry/64: Fix unwind hints in __switch_to_asm()
    - [x86] entry/64: Fix unwind hints in rewind_stack_do_exit()
    - [amd64] x86/unwind/orc: Don't skip the first frame for inactive tasks
    - [amd64] x86/unwind/orc: Prevent unwinding before ORC initialization
    - [amd64] x86/unwind/orc: Fix error path for bad ORC entry type
    - [amd64] x86/unwind/orc: Fix premature unwind stoppage due to IRET frames
    - [x86] KVM: Fixes posted interrupt check for IRQs delivery modes
    - [x86] arch/x86/kvm/svm/sev.c: change flag passed to GUP fast in
      sev_pin_memory()
    - netfilter: nat: never update the UDP checksum when it's 0
    - netfilter: nf_osf: avoid passing pointer to local var
    - [x86] kvm: ioapic: Restrict lazy EOI update to edge-triggered interrupts
    - scripts/decodecode: fix trapping instruction formatting
    - mm, memcg: fix error return value of mem_cgroup_css_alloc()
    - bdi: move bdi_dev_name out of line
    - bdi: add a ->dev_name field to struct backing_dev_info
    - io_uring: don't use 'fd' for openat/openat2/statx
    - fsnotify: replace inode pointer with an object id
    - fanotify: merge duplicate events on parent and child
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.14
    - [x86] KVM: nVMX: Consolidate nested MTF checks to helper function
    - [x86] kvm: nVMX: reflect MTF VM-exits if injected by L1
    - xprtrdma: Clean up the post_send path
    - xprtrdma: Fix trace point use-after-free race
    - [x86] drm/i915/tgl: Add Wa_14010477008:tgl
    - [x86] drm/i915/tgl: TBT AUX should use TC power well ops
    - [x86] drm/i915/display: Load DP_TP_CTL/STATUS offset before use it
    - shmem: fix possible deadlocks on shmlock_user_lock
    - net: phy: microchip_t1: add lan87xx_phy_init to initialize the lan87xx
      phy.
    - [arm64,armhf] KVM: vgic: Synchronize the whole guest on
      GIC{D,R}_I{S,C}ACTIVER read
    - [arm64,armhf] KVM: vgic-v2: Only use the virtual state when userspace
      accesses pending bits
    - gpio: pca953x: Fix pca953x_gpio_set_config
    - SUNRPC: Add "@len" parameter to gss_unwrap()
    - SUNRPC: Fix GSS privacy computation of auth->au_ralign
    - [x86] hv_netvsc: Fix netvsc_start_xmit's return type
    - drop_monitor: work around gcc-10 stringop-overflow warning
    - virtio-blk: handle block_device_operations callbacks after hot unplug
    - net_sched: fix tcm_parent in tc filter dump
    - [arm64,armhf] net: stmmac: gmac5+: fix potential integer overflow on 32
      bit multiply
    - [amd64] iommu/amd: Fix race in increase_address_space()/fetch_pte()
    - [amd64] iommu/amd: Update Device Table in increase_address_space()
    - mmc: sdhci-acpi: Add SDHCI_QUIRK2_BROKEN_64_BIT_DMA for AMDI0040
    - [arm64] dpaa2-eth: properly handle buffer size restrictions
    - mptcp: set correct vfs info for subflows
    - net: fix a potential recursive NETDEV_FEAT_CHANGE
    - netlabel: cope with NULL catmap (CVE-2020-10711)
    - net: phy: fix aneg restart in phy_ethtool_set_eee
    - [arm64] net: stmmac: fix num_por initialization
    - pppoe: only process PADT targeted at local interfaces
    - Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu"
    - tcp: fix error recovery in tcp_zerocopy_receive()
    - tcp: fix SO_RCVLOWAT hangs with fat skbs
    - virtio_net: fix lockdep warning on 32 bit
    - [arm64] dpaa2-eth: prevent array underflow in update_cls_rule()
    - hinic: fix a bug of ndo_stop
    - net: ipv4: really enforce backoff for redirects
    - netprio_cgroup: Fix unlimited memory leak of v2 cgroups
    - net: tcp: fix rx timestamp behavior for tcp_recvmsg
    - nfp: abm: fix error return code in nfp_abm_vnic_alloc()
    - r8169: re-establish support for RTL8401 chip version
    - umh: fix memory leak on execve failure
    - [arm64] net: broadcom: Select BROADCOM_PHY for BCMGENET
    - [i386] dmaengine: pch_dma.c: Avoid data race between probe and irq
      handler
    - [x86] cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode
      once
    - ALSA: hda/hdmi: fix race in monitor detection during probe
    - drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()
    - fibmap: Warn and return an error in case of block > INT_MAX
    - io_uring: use cond_resched() in io_ring_ctx_wait_and_kill()
    - io_uring: check non-sync defer_list carefully
    - ipc/util.c: sysvipc_find_ipc() incorrectly updates position index
    - ALSA: hda/realtek - Fix S3 pop noise on Dell Wyse
    - gfs2: Another gfs2_walk_metadata fix
    - mmc: sdhci-pci-gli: Fix no irq handler from suspend
    - [amd64] IB/hfi1: Fix another case where pq is left on waitlist
    - ACPI: EC: PM: Avoid premature returns from acpi_s2idle_wake()
    - [x86] pinctrl: sunrisepoint: Fix PAD lock register offset for SPT-H
    - [x86] pinctrl: baytrail: Enable pin configuration setting for GPIO chip
    - [arm64] pinctrl: qcom: fix wrong write in update_dual_edge
    - [x86] pinctrl: cherryview: Add missing spinlock usage in
      chv_gpio_irq_handler
    - [arm64,armhf] drm/tegra: Fix SMMU support on Tegra124 and Tegra210
    - bpf: Fix error return code in map_lookup_and_delete_elem()
    - ALSA: firewire-lib: fix 'function sizeof not defined' error of
      tracepoints format
    - cachefiles: Fix corruption of the return value in
      cachefiles_read_or_alloc_pages()
    - i40iw: Fix error handling in i40iw_manage_arp_cache()
    - [x86] drm/i915/gt: Make timeslicing an explicit engine property
    - [x86] drm/i915: Don't enable WaIncreaseLatencyIPCEnabled when IPC is
      disabled
    - bpf, sockmap: msg_pop_data can incorrecty set an sge length
    - bpf, sockmap: bpf_tcp_ingress needs to subtract bytes from sg.size
    - [x86] drm/i915/gem: Remove object_is_locked assertion from
      unpin_from_display_plane
    - mmc: sdhci-pci-gli: Fix can not access GL9750 after reboot from Windows
      10
    - mmc: core: Check request type before completing the request
    - mmc: core: Fix recursive locking issue in CQE recovery path
    - mmc: block: Fix request completion in the CQE timeout path
    - gfs2: More gfs2_find_jhead fixes
    - fork: prevent accidental access to clone3 features
    - drm/amdgpu: force fbdev into vram
    - NFS: Fix fscache super_cookie index_key from changing after umount
    - NFS: Fix fscache super_cookie allocation
    - NFSv4: Fix fscache cookie aux_data to ensure change_attr is included
    - hwmon: (drivetemp) Fix SCT support if SCT data tables are not supported
    - netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
    - [x86] drm/i915/gvt: Fix kernel oops for 3-level ppgtt guest
    - [arm64] fix the flush_icache_range arguments in machine_kexec
    - netfilter: conntrack: fix infinite loop on rmmod
    - [x86] drm/i915: Mark concurrent submissions with a weak-dependency
    - nfs: fix NULL deference in nfs4_get_valid_delegation
    - SUNRPC: Signalled ASYNC tasks need to exit
    - tracing: Wait for preempt irq delay thread to execute
    - netfilter: flowtable: set NF_FLOW_TEARDOWN flag on entry expiration
    - netfilter: nft_set_rbtree: Add missing expired checks
    - RDMA/rxe: Always return ERR_PTR from rxe_create_mmap_info()
    - IB/mlx4: Test return value of calls to ib_get_cached_pkey
    - IB/core: Fix potential NULL pointer dereference in pkey cache
    - RDMA/core: Fix double put of resource
    - RDMA/iw_cxgb4: Fix incorrect function parameters
    - [x86] ftrace: Have ftrace trampolines turn read-only at the end of
      system boot up
    - [x86] drm/i915: Handle idling during i915_gem_evict_something busy loops
    - mm, memcg: fix inconsistent oom event behavior
    - epoll: call final ep_events_available() check under the lock
    - bpf: Fix bug in mmap() implementation for BPF array map
    - NFSv3: fix rpc receive buffer size for MOUNT call
    - pnp: Use list_for_each_entry() instead of open coding
    - net/rds: Use ERR_PTR for rds_message_alloc_sgs()
    - Stop the ad-hoc games with -Wno-maybe-initialized
    - gcc-10: disable 'zero-length-bounds' warning for now
    - gcc-10: disable 'array-bounds' warning for now
    - gcc-10: disable 'stringop-overflow' warning for now
    - gcc-10: disable 'restrict' warning for now
    - gcc-10 warnings: fix low-hanging fruit
    - gcc-10: mark more functions __init to avoid section mismatch warnings
    - gcc-10: avoid shadowing standard library 'free()' in crypto
    - bootconfig: Fix to remove bootconfig data from initrd while boot
    - bootconfig: Fix to prevent warning message if no bootconfig option
    - usb: usbfs: correct kernel->user page attribute mismatch
    - USB: usbfs: fix mmap dma mismatch
    - ALSA: hda/realtek - Limit int mic boost for Thinkpad T530
    - ALSA: hda/realtek - Add COEF workaround for ASUS ZenBook UX431DA
    - ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
    - ALSA: usb-audio: Add control message quirk delay for Kingston HyperX
      headset
    - usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B
    - [arm64,armhf,riscv64] usb: host: xhci-plat: keep runtime active when
      removing host
    - USB: gadget: fix illegal array access in binding with UDC
      (CVE-2020-13143)
    - usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg
      list
    - [x86] Make the "Reducing compressed framebufer size" message be
      DRM_INFO_ONCE()
    - [armhf] dts: imx6dl-yapp4: Fix Ursa board Ethernet connection
    - drm/amd/amdgpu: add raven1 part to the gfxoff quirk list
    - [x86] drm/i915/tgl+: Fix interrupt handling for DP AUX transactions
    - [powerpc*] vdso32: Fallback on getres syscall when clock is unknown
    - cifs: fix leaked reference on requeued write
    - [x86] KVM: Fix pkru save/restore when guest CR4.PKE=0, move it to x86.c
    - [x86] Fix early boot crash on gcc-10, third try
    - [amd64] x86/unwind/orc: Fix error handling in __unwind_start()
    - exec: Move would_dump into flush_old_exec
    - [arm64,armhf] clk: rockchip: fix incorrect configuration of rk3228
      aclk_gpu* clocks
    - [arm64,armhf] dwc3: Remove check for HWO flag in
      dwc3_gadget_ep_reclaim_trb_sg()
    - fanotify: fix merging marks masks with FAN_ONDIR
    - [arm64] dts: meson-g12b-ugoos-am6: fix usb vbus-supply
    - Revert "ALSA: hda/realtek: Fix pop noise on ALC225"
    - [armhf] clk: ti: clkctrl: Fix Bad of_node_put within clkctrl_get_name
    - clk: Unlink clock if failed to prepare or enable
    - [arm64] dts: rockchip: Replace RK805 PMIC node name with "pmic" on
      rk3328 boards
    - dt-bindings: dma: fsl-edma: fix ls1028a-edma compatible
    - SUNRPC: Revert 241b1f419f0e ("SUNRPC: Remove xdr_buf_trim()")
    - bpf: Fix sk_psock refcnt leak when receiving message
    - RDMA/uverbs: Do not discard the IB_EVENT_DEVICE_FATAL event
    - RDMA/uverbs: Move IB_EVENT_DEVICE_FATAL to destroy_uobj
    - [x86] KVM: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce
    - bpf: Enforce returning 0 for fentry/fexit progs
    - bpf: Restrict bpf_trace_printk()'s %s usage and add %pks, %pus specifier
    - Makefile: disallow data races on gcc-10 as well

  [ Ben Hutchings ]
  * linux-libc-dev: Re-add "Provides: linux-kernel-headers" as several
    source packages still have this in Build-Depends

  [ Luca Boccassi ]
  * [cloud] Enable INFINIBAND configs for HyperV/Azure (Closes: #958300)

  [ Bastian Blank ]
  * [cloud] Re-enable some FB drivers.

  [ Romain Perier ]
  * Enable support for fsverity

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.6.10-rt5 and re-enable
  * Bump ABI to 2.
  * xfs: add agf freeblocks verify in xfs_agf_verify (CVE-2020-12655)

  [ Domenico Andreoli ]
  * [arm64] udeb: Add armada_37xx_wdt to kernel-image (Closes: #961086)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 23 May 2020 16:29:21 +0200

linux (5.6.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.5
    - perf tools: Support Python 3.8+ in Makefile (Closes: #958165)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.6
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.7

  [ Ben Hutchings ]
  * [armhf,arm64] lockdown: Update arm Secure Boot patch for 5.6
    (fixes FTBFS)
  * Use debhelper compatibility level 12:
    - Build-Depend on debhelper-compat and remove debian/compat
    - hyperv-daemons: Use dh_installsystemd instead of
      dh_systemd_{enable,start}
    - hyperv-daemons: Add "Pre-Depends: ${misc:Pre-Depends}"
  * debian/README.source: Refer to upload checklist in kernel-team.git
  * [armel] Disable NETLABEL, since SECURITY_SELINUX is also disabled
  * Drop linux-headers-<ver>-all and linux-headers-<ver>-all-<arch> packages,
    which are no longer needed
  * linux-libc-dev: Drop "Provides: linux-kernel-headers" which is no longer
    needed
  * [s390x] mm: fix page table upgrade vs 2ndary address mode accesses
    (CVE-2020-11884)
  * Set ABI to 1

  [ Romain Perier ]
  *  Rebased patch firmware-remove-redundant-log-messages-from-drivers.patch
     onto 5.6.7.

  [ Philip Rinn ]
  * [arm64] Enable CRYPTO_DEV_SUN8I_CE (closes: #958037)
  * [arm64] Enable SUN8I_THERMAL

  [ Roberto Bampi ]
  * [arm64] Enable ARMADA_37XX_WATCHDOG as module

  [ Vagrant Cascadian ]
  * [arm64] Enable SENSORS_PWM_FAN as a module.

  [ Paul Tagliamonte ]
  * Enable CONFIG_NETLABEL (Closes: #958804)

 -- Ben Hutchings <benh@debian.org>  Wed, 29 Apr 2020 04:46:47 +0100

linux (5.6.4-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.6
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.2
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.3
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.4

  [ Ben Hutchings ]
  * Set ABI to trunk
  * [mips*] Revert "staging: octeon-usb: delete the octeon usb host controller
    driver"
  * [mips*] Revert "staging: octeon: delete driver"
  * [powerpc*] i2c: Enable I2C_PARPORT instead of I2C_PARPORT_LIGHT
  * aufs: Update support patchset to aufs5.x-rcN 20200302; no functional
    change
  * linux-signed-*: Build-Depend on kernel-wedge 2.102 for consistency
  * aufs: Update support patchset to aufs5.6 20200413; no functional change
  * [rt] Update to 5.6.4-rt3 and re-enable

  [ Aurelien Jarno ]
  * Enable SENSORS_DRIVETEMP
  * [riscv64] Enable SOC_VIRT
  * [riscv64] Enable GPIOLIB, GPIO_SIFIVE, POWER_RESET, POWER_RESET_GPIO,
    POWER_RESET_GPIO_RESTART, POWER_RESET_RESTART, CONFIG_PWM,
    CONFIG_PWM_SIFIVE, CONFIG_SIFIVE_L2

  [ Christian Barcenas ]
  * linux-kbuild: Stop building conmakehash
  * linux-cpupower: Add libcap to Build-Depends and turbostat linker flags
  * [x86] Drop EFI cold boot mitigation patch in favor of upstream
  * [amd64] Update "x86: Make x32 syscall support conditional ..." for 5.6

  [ Romain Perier ]
  * [x86] udeb: Add crc32_pclmul to crc-modules
  * udeb: Add crc32_generic to crc-modules

  [ Luca Boccassi ]
  * lockdown: set default (with Secure Boot) to LOCKDOWN_INTEGRITY_MAX
    (Closes: #956197)

 -- Ben Hutchings <benh@debian.org>  Fri, 17 Apr 2020 01:26:42 +0100

linux (5.5.17-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.14
    - mmc: core: Allow host controllers to require R1B for CMD6
    - mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard
    - mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command
    - [armhf] mmc: sdhci-omap: Fix busy detection by enabling
      MMC_CAP_NEED_RSP_BUSY
    - [armhf,arm64] mmc: sdhci-tegra: Fix busy detection by enabling
      MMC_CAP_NEED_RSP_BUSY
    - cxgb4: fix throughput drop during Tx backpressure
    - cxgb4: fix Txq restart check during backpressure
    - geneve: move debug check after netdev unregister
    - hsr: fix general protection fault in hsr_addr_is_self()
    - ipv4: fix a RCU-list lock in inet_dump_fib()
    - macsec: restrict to ethernet devices
    - net/bpfilter: fix dprintf usage for /dev/kmsg
    - net: cbs: Fix software cbs to consider packet sending time
    - [armhf,arm64] net: dsa: Fix duplicate frames flooded by learning
    - net: ena: Add PCI shutdown handler to allow safe kexec
    - [armhf] net: mvneta: Fix the case where the last poll did not process all
      rx
    - net/packet: tpacket_rcv: avoid a producer race condition
    - net: phy: dp83867: w/a for fld detect threshold bootstrapping issue
    - [armhf,arm64] net: phy: mdio-bcm-unimac: Fix clock handling
    - net: qmi_wwan: add support for ASKEY WWHC050
    - net/sched: act_ct: Fix leak of ct zone template on replace
    - net_sched: cls_route: remove the right filter from hashtable
    - net_sched: hold rtnl lock in tcindex_partial_destroy_work()
    - net_sched: keep alloc_hash updated after hash allocation
    - [armhf,arm64] net: stmmac: dwmac-rk: fix error path in rk_gmac_probe
    - r8169: re-enable MSI on RTL8168c
    - slcan: not call free_netdev before rtnl_unlock in slcan_open
    - tcp: also NULL skb->dev when copy was needed
    - tcp: ensure skb->dev is NULL before leaving TCP stack
    - tcp: repair: fix TCP_QUEUE_SEQ implementation
    - vxlan: check return value of gro_cells_init()
    - [arm64] Revert "net: bcmgenet: use RGMII loopback for MAC reset"
    - [arm64] net: bcmgenet: keep MAC in reset until PHY is up
    - bnxt_en: Fix Priority Bytes and Packets counters in ethtool -S.
    - bnxt_en: fix memory leaks in bnxt_dcbnl_ieee_getets()
    - bnxt_en: Return error if bnxt_alloc_ctx_mem() fails.
    - bnxt_en: Free context memory after disabling PCI in probe error path.
    - bnxt_en: Reset rings if ring reservation fails during open()
    - net: ena: fix incorrect setting of the number of msix vectors
    - net: ena: fix request of incorrect number of IRQ vectors
    - net: ena: avoid memory access violation by validating req_id properly
    - net: ena: fix continuous keep-alive resets
    - net: ip_gre: Separate ERSPAN newlink / changelink callbacks
    - net: ip_gre: Accept IFLA_INFO_DATA-less configuration
    - hsr: use rcu_read_lock() in hsr_get_node_{list/status}()
    - hsr: add restart routine into hsr_get_node_list()
    - hsr: set .netnsok flag
    - net/mlx5: DR, Fix postsend actions write length
    - net/mlx5e: Enhance ICOSQ WQE info fields
    - net/mlx5e: Fix missing reset of SW metadata in Striding RQ reset
    - net/mlx5e: Fix ICOSQ recovery flow with Striding RQ
    - net/mlx5e: Do not recover from a non-fatal syndrome
    - net/mlx5_core: Set IB capability mask1 to fix ib_srpt connection failure
    - net/mlx5e: kTLS, Fix TCP seq off-by-1 issue in TX resync flow
    - net/mlx5e: Fix endianness handling in pedit mask
    - cgroup-v1: cgroup_pidlist_next should update position index
    - nfs: add minor version to nfs_server_key for fscache
    - drivers/of/of_mdio.c:fix of_mdiobus_register()
    - cgroup1: don't call release_agent when it is ""
    - veth: ignore peer tx_dropped when counting local rx_dropped
    - drm/amd/display: update soc bb for nv14
    - drm/amdgpu: correct ROM_INDEX/DATA offset for VEGA20
    - [armhf] drm/exynos: Fix cleanup of IOMMU related objects
    - [x86] iommu/vt-d: Silence RCU-list debugging warnings
    - scsi: ipr: Fix softlockup when rescanning devices in petitboot
    - mac80211: Do not send mesh HWMP PREQ if HWMP is disabled
    - [x86] iommu/vt-d: Fix debugfs register reads
    - [x86] iommu/vt-d: Populate debugfs if IOMMUs are detected
    - Input: fix stale timestamp on key autorepeat events
    - [x86] Input: synaptics - enable RMI on HP Envy 13-ad105ng
    - Input: avoid BIT() macro usage in the serio.h UAPI header
    - IB/rdmavt: Free kernel completion queue when done
    - RDMA/core: Fix missing error check on dev_set_name()
    - RDMA/odp: Fix leaking the tgid for implicit ODP
    - gpiolib: Fix irq_disable() semantics
    - RDMA/nl: Do not permit empty devices names during
      RDMA_NLDEV_CMD_NEWLINK/SET
    - RDMA/mad: Do not crash if the rdma device does not have a umad interface
    - ceph: check POOL_FLAG_FULL/NEARFULL in addition to OSDMAP_FULL/NEARFULL
    - ceph: fix memory leak in ceph_cleanup_snapid_map()
    - [x86] KVM: SVM: Issue WBINVD after deactivating an SEV guest
    - [armhf] dts: dra7: Add bus_dma_limit for L3 bus
    - [armhf] dts: omap5: Add bus_dma_limit for L3 bus
    - perf probe: Fix to delete multiple probe event
    - perf probe: Do not depend on dwfl_module_addrsym()
    - rtlwifi: rtl8188ee: Fix regression due to commit d1d1a96bdb44
    - drm/prime: use dma length macro when mapping sg
    - drm/amdgpu: fix scatter-gather mapping with user pages
    - drm/radeon: fix scatter-gather mapping with user pages
    - [armhf] soc: samsung: chipid: Fix return value on non-Exynos platforms
    - scsi: sd: Fix optimal I/O size for devices that change reported values
    - nl80211: fix NL80211_ATTR_CHANNEL_WIDTH attribute type
    - mac80211: drop data frames without key on encrypted links
    - mac80211: mark station unauthorized before key removal
    - mm/swapfile.c: move inode_lock out of claim_swapfile
    - drivers/base/memory.c: indicate all memory blocks as removable
    - mm/sparse: fix kernel crash with pfn_section_valid check
    - mm: fork: fix kernel_stack memcg stats for various stack implementations
    - [x86] gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk
    - gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option
    - [x86] gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT +
      AXP288 model
    - bpf: Fix cgroup ref leak in cgroup_bpf_inherit on out-of-memory
    - RDMA/core: Ensure security pkey modify is not lost
    - afs: Fix handling of an abort from a service handler
    - genirq: Fix reference leaks on irq affinity notifiers
    - xfrm: handle NETDEV_UNREGISTER for xfrm device
    - vti[6]: fix packet tx through bpf_redirect() in XinY cases
    - RDMA/mlx5: Fix the number of hwcounters of a dynamic counter
    - RDMA/mlx5: Fix access to wrong pointer while performing flush due to
      error
    - RDMA/mlx5: Block delay drop to unprivileged users
    - xfrm: fix uctx len check in verify_sec_ctx_len
    - xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire
    - xfrm: policy: Fix doulbe free in xfrm_policy_timer
    - afs: Fix client call Rx-phase signal handling
    - afs: Fix some tracing details
    - afs: Fix unpinned address list during probing
    - ieee80211: fix HE SPR size calculation
    - mac80211: set IEEE80211_TX_CTRL_PORT_CTRL_PROTO for nl80211 TX
    - netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6}
    - netfilter: flowtable: populate addr_type mask
    - netfilter: nft_fwd_netdev: validate family and chain type
    - netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress
    - [i386] bpf, x32: Fix bug with JMP32 JSET BPF_X checking upper bits
    - bpf: Initialize storage pointers to NULL to prevent freeing garbage
      pointer
    - bpf/btf: Fix BTF verification of enum members in struct/union
    - bpf, sockmap: Remove bucket->lock from sock_{hash|map}_free
    - [armhf] dts: sun8i-a83t-tbs-a711: Fix USB OTG mode detection
    - vti6: Fix memory leak of skb if input policy check fails
    - r8169: fix PHY driver check on platforms w/o module softdeps
    - [x86] clocksource/drivers/hyper-v: Untangle stimers and timesync from
      clocksources
    - bpf: Undo incorrect __reg_bound_offset32 handling
    - USB: serial: option: add support for ASKEY WWHC050
    - USB: serial: option: add BroadMobi BM806U
    - USB: serial: option: add Wistron Neweb D19Q1
    - USB: cdc-acm: restore capability check order
    - USB: serial: io_edgeport: fix slab-out-of-bounds read in
      edge_interrupt_callback
    - [armhf,arm64] usb: musb: fix crash with highmen PIO and usbmon
    - media: flexcop-usb: fix endpoint sanity check
    - media: usbtv: fix control-message timeouts
    - staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
    - [x86] staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
    - [x86] staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
    - [x86] ahci: Add Intel Comet Lake H RAID PCI ID
    - libfs: fix infoleak in simple_attr_read()
    - media: ov519: add missing endpoint sanity checks (CVE-2020-11608)
    - media: dib0700: fix rc endpoint lookup
    - media: stv06xx: add missing descriptor sanity checks (CVE-2020-11609)
    - media: xirlink_cit: add missing descriptor sanity checks
      (CVE-2020-11668)
    - media: v4l2-core: fix a use-after-free bug of sd->devnode
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.15
    - bpf: update jmp32 test cases to fix range bound deduction
    - mac80211: Check port authorization in the ieee80211_tx_dequeue() case
    - mac80211: fix authentication with iwlwifi/mvm
    - vt: selection, introduce vc_is_sel
    - vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines
    - vt: switch vt_dont_switch to bool
    - vt: vt_ioctl: remove unnecessary console allocation checks
    - vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console
    - vt: vt_ioctl: fix use-after-free in vt_in_use()
    - [x86] platform: pmc_atom: Add Lex 2I385SW to critclk_systems DMI table
    - bpf: Explicitly memset the bpf_attr structure
    - bpf: Explicitly memset some bpf info structures declared on the stack
    - iwlwifi: don't send GEO_TX_POWER_LIMIT if no wgds table
    - [x86] gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT +
      AXP288 model
    - [armhf] clk: imx: Align imx sc clock msg structs to 4
    - [armhf] clk: imx: Align imx sc clock parent msg structs to 4
    - libceph: fix alloc_msg_with_page_vector() memory leaks
    - perf map: Fix off by one in strncpy() size argument
    - [armel,armhf] dts: bcm283x: Fix vc4's firmware bus DMA limitations
    - [armel] bcm2835-rpi-zero-w: Add missing pinctrl name
    - [armhf] dts: imx6: phycore-som: fix arm and soc minimum voltage
    - [armhf] dts: N900: fix onenand timings
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.16
    - ipv4: fix a RCU-list lock in fib_triestat_seq_show
    - net, ip_tunnel: fix interface lookup with no key
    - sctp: fix possibly using a bad saddr with a given dst
    - sctp: fix refcount bug in sctp_wfree
    - [arm64,riscv64] net: macb: Fix handling of fixed-link node
    - nvme-rdma: Avoid double freeing of async event data
    - drm/amdgpu: add fbdev suspend/resume on gpu reset
    - [x86] drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017
    - drm/bochs: downgrade pci_request_region failure from error to warning
    - initramfs: restore default compression behavior
    - drm/amdgpu: fix typo for vcn1 idle check
    - tools/power turbostat: Fix gcc build warnings
    - tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks
    - tools/power turbostat: Fix 32-bit capabilities warning
    - padata: fix uninitialized return value in padata_replace()
    - brcmfmac: abort and release host after error
    - XArray: Fix xa_find_next for large multi-index entries
    - misc: rtsx: set correct pcr_ops for rts522A
    - PCI: sysfs: Revert "rescan" file renames
    - [x86] mei: me: add cedar fork device ids
    - nvmem: check for NULL reg_read and reg_write before dereferencing
    - [armhf] extcon: axp288: Add wakeup support
    - Revert "dm: always call blk_queue_split() in dm_process_bio()"
    - [x86] ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on
      EVGA X99 Classified motherboard
    - iwlwifi: consider HE capability when setting LDPC
    - iwlwifi: yoyo: don't add TLV offset when reading FIFOs
    - iwlwifi: dbg: don't abort if sending DBGC_SUSPEND_RESUME fails
    - rxrpc: Fix sendmsg(MSG_WAITALL) handling
    - IB/hfi1: Ensure pq is not left on waitlist
    - sched: act: count in the size of action flags bitfield
    - tcp: fix TFO SYNACK undo to avoid double-timestamp-undo
    - [x86,ia64] watchdog: iTCO_wdt: Export vendorsupport
    - [x86,ia64] watchdog: iTCO_wdt: Make ICH_RES_IO_SMI optional
    - i2c: i801: Do not add ICH_RES_IO_SMI for the iTCO_wdt device
    - net: genetlink: return the error code when attribute parsing fails.
    - net: Fix Tx hash bound checking
    - net/smc: fix cleanup for linkgroup setup failures
    - padata: always acquire cpu_hotplug_lock before pinst->lock
    - mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
      (CVE-2020-11565)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.17
    - cxgb4: fix MPS index overwrite when setting MAC address
    - ipv6: don't auto-add link-local address to lag ports
    - [armhf] net: dsa: bcm_sf2: Do not register slave MDIO bus with OF
    - [armhf] net: dsa: bcm_sf2: Ensure correct sub-node is parsed
    - net: phy: micrel: kszphy_resume(): add delay after genphy_resume() before
      accessing PHY registers
    - net_sched: add a temporary refcnt for struct tcindex_data
    - net_sched: fix a missing refcnt in tcindex_init()
    - [armhf,arm64] net: stmmac: dwmac1000: fix out-of-bounds mac address reg
      setting
    - slcan: Don't transmit uninitialized stack data in padding
    - tun: Don't put_page() for all negative return values from XDP program
    - r8169: change back SG and TSO to be disabled by default
    - cxgb4: free MQPRIO resources in shutdown path
    - [s390x] prevent leaking kernel address in BEAR
    - random: always use batched entropy for get_random_u{32,64}
    - [armhf,arm64] usb: dwc3: gadget: Wrap around when skip TRBs
    - slub: improve bit diffusion for freelist ptr obfuscation
    - ubi: fastmap: Free unused fastmap anchor peb during detach
    - RDMA/ucma: Put a lock around every call to the rdma_cm layer
    - RDMA/cma: Teach lockdep about the order of rtnl and lock
    - RDMA/siw: Fix passive connection establishment
    - Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl
    - RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow
    - blk-mq: Keep set->nr_hw_queues and set->map[].nr_queues in sync
    - fbcon: fix null-ptr-deref in fbcon_switch
    - driver core: Reevaluate dev->links.need_for_probe as suppliers are added
    - [x86] iommu/vt-d: Allow devices with RMRRs to use identity domain
    - ACPI: PM: Add acpi_[un]register_wakeup_handler()
    - [x86] platform: intel_int0002_vgpio: Use acpi_register_wakeup_handler()
    - IB/hfi1: Call kobject_put() when kobject_init_and_add() fails
    - IB/hfi1: Fix memory leaks in sysfs registration and unregistration
    - IB/mlx5: Replace tunnel mpls capability bits for tunnel_offloads
    - [armhf] imx: Enable ARM_ERRATA_814220 for i.MX6UL and i.MX7D
    - [armhf] imx: only select ARM_ERRATA_814220 for ARMv7-A
    - ceph: remove the extra slashes in the server path
    - ceph: canonicalize server path in place

  [ Noah Meyerhans ]
  * Fix autopkgtest failure due to pycodestyle violation
  * [cloud] Re-enable kernel page merge functionality (Closes: #955366)
  * [cloud] Apply a number of additional optimizations (Closes: #947759)
    - Statically link nvme and ext4 drivers with the kernel
    - [amd64] Re-enable SCHED_MC_PRIO
    - Switch to LZ4 for compression
    - Disable a number of additional drivers unlikely to be found in
      cloud environments

  [ Ben Hutchings ]
  * drm: Disable DRM_LEGACY (DRI1)
  * Bump ABI to 2
  * WireGuard: Update for renaming of skb_reset_tc() to skb_reset_redirect()
  * lib/fonts: Enable FONTS, FONT_8x8, FONT_8x16, FONT_TER16x32 for most
    flavours (Closes: #956173)
  * keys: Enable PERSISTENT_KEYRINGS
  * mm: Enable DEFERRED_STRUCT_PAGE_INIT (Closes: #954025)
  * [armel/marvell] mm: Enable COMPACTION (Closes: #949171)
  * [x86} media/cec: Enable CEC_PLATFORM_DRIVERS; enable VIDEO_SECO_CEC as a
    module (Closes: #951543)
  * [x86] sound/soc/intel: Enable SND_SOC_INTEL_BYT_CHT_CX2072X_MACH as module
    (Closes: #951482)

  [ Sudip Mukherjee ]
  * Remove libbpf. (See: #948041)

  [ Jason A. Donenfeld ]
  * Provide wireguard-modules as stop-gap for packages.

  [ Christian Barcenas ]
  * linux-cpupower: Add libcap to Build-Depends and turbostat linker flags

  [ Joel Johnson ]
  * [armhf] Build PHY_MVEBU_A38X_COMPHY module (Closes: #951409)

  [ Josua Mayer ]
  * [arm64] enable support for the Honeycomb arm64 workstation
    (Closes: #948576)

 -- Ben Hutchings <benh@debian.org>  Wed, 15 Apr 2020 03:37:48 +0100

linux (5.5.13-2) unstable; urgency=medium

  * bpf: Undo incorrect __reg_bound_offset32 handling (CVE-2020-8835)

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 30 Mar 2020 23:06:57 +0200

linux (5.5.13-1) unstable; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.5
    (Closes: #953680)
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.2
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.3
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.4
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.5
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.6
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.7
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.8
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.9
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.10
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.11
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.12
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.13

  [ Ben Hutchings ]
  * aufs: Update support patchset to aufs5.x-rcN 20200120; no functional
    change
  * net: Enable NET_SWITCHDEV; disable on armel/marvell (Closes: #949863)
  * [armhf] net/ethernet/ti: Enable TI_CPSW_SWITCHDEV as module; enable TI_CPTS
  * wireless: Enable regulatory.db direct loading:
    - Drop "wireless: Disable regulatory.db direct loading"
    - linux-image: Add Breaks: relation with old wireless-regdb versions
    - Regenerate my wireless-regdb certificate with expected attributes
  * [x86] Drop "Add a SysRq option to lift kernel lockdown" (Closes: #947021)
    - This patch allowed remotely disabling lockdown using usbip
    - Lockdown can be disabled by running "mokutil --disable-validation",
      rebooting, and confirming the change when prompted
  * Set PYTHON=python3 for document build (fixes FTBFS)
  * [x86,arm64] Move linux-headers metapackages to src:linux-signed-*.
    This should ensure that src:linux and src:linux-signed-* transition to
    testing together.
  * debian/bin/gencontrol_signed.py: Generate valid versions in a linux binNMU
  * udeb: Drop zlib-modules packages, as zlib_deflate is now always built-in
    (fixes FTBFS on several architectures)
  * [mips*/octeon] Fix and re-enable the Octeon Ethernet driver
  * [mips*] Fix FTBFS:
    - Increase RELOCATION_TABLE_SIZE to 0x160000
    - Fix exception handler memcpy()
  * debian/config: Delete redundant arch/flavour-specific "debug-info: true"
  * linux-source: Suggest qtbase5-dev instead of the removed libqt4-dev
    (Closes: #953386)
  * Add WireGuard driver and required crypto changes from 5.6-rc7 and
    cryptodev-2.6, thanks to Jason A. Donenfeld (Closes: #953569)
  * drivers/net: Enable WIREGUARD as module
  * debian/control: Use my debian.org email in Uploaders field
  * debian/certs: Rename Romain Perier's certificate to match email address
  * security/integrity/platform_certs: Rebase db-mok-keyring patch set for
    5.5.9
  * [x86] Enable X86_UMIP (previously configured as X86_INTEL_UMIP)
  * Set ABI to 1
  * [amd64] Enable Intel GVT-g (except cloud-amd64) (Closes: #954088):
    - vfio: Enable VFIO_MDEV, VFIO_MDEV_DEVICE as modules
    - i915: Enable DRM_I915_GVT; enable DRM_I915_GVT_KVMGT as module
  * drivers/net/wireless: Enable MT76x0E as module (Closes: #953683)
  * bcmgenet: Backport ACPI support, supporting Raspberry Pi 4
    (Closes: #950578)

  [ Aurelien Jarno ]
  * [riscv64] Enable SECCOMP.

  [ Romain Perier ]
  * [arm64] Enable BCMGENET
  * [arm64] Fix CONFIG_INFINIBAND_HNS_HIP06 and CONFIG_INFINIBAND_HNS_HIP08
    from tristate to boolean
  * debian/certs: Add my own certificate for wireless-regdb
  * debian/patches/debian/wireless-add-debian-wireless-regdb-certificates.patch:
    Add the hexdump of my certificate to this patch, so the kernel can
    directly load the regulatory db and trust it if have I signed it.

  [ Noah Meyerhans ]
  * [arm64] Enable KVM_ARM_HOST and KVM_ARM_PMU
  * [arm64] Enable CONFIG_ARM64_ERRATUM_1418040
  * [arm64/cloud-arm64] Introduce cloud build flavour
  * [cloud] random: Enable RANDOM_TRUST_BOOTLOADER

  [ Mark Pearson ]
  * [amd64] ASoC: Enable SND_SOC_SOF_COMETLAKE_LP_SUPPORT,
    SND_SOC_SOF_COMETLAKE_H_SUPPORT

  [ Christian Barcenas ]
  * lockdown: honor LOCK_DOWN_IN_EFI_SECURE_BOOT=n (Closes: #945604)

  [ Salvatore Bonaccorso ]
  * libcpupower: Lower back soname version to 1 and add new
    cpufreq_{get,put}_boost_frequencies methods

  [ Joel Stanley ]
  * [armhf] Enable ASPEED AST2600 SoC family. This includes all ASPEED symbols
    for the AST2600 and FTGMAC100, the network device used by this SoC. The
    SoC has 5 UARTs so CONFIG_SERIAL_8250_NR_UARTS is bumped to 5 from 4
    in order to correctly register UART5, the boot console.

  [ Petr Stastny ]
  * [x86] i2c: Enable I2C_AMD_MP2 as module (Closes: #955004)

  [ Vagrant Cascadian ]
  * [arm64] Add patch from next-20200325 to enable device-tree for
    Pinebook Pro.

 -- Ben Hutchings <benh@debian.org>  Mon, 30 Mar 2020 03:03:47 +0100

linux (5.5~rc5-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Romain Perier ]
  * [rt] Disable until it is updated for 5.5 or later
  * [mips*] Remove obsolete patch
    MIPS-Loongson-3-Add-Loongson-LS3A-RS780E-1-way-machi.patch
  * Retrieve the new aufs5 patches from the upstream tree, with an update in
    aufs5-standalone.patch (see its header).
  * Refreshed patches:
    - debian/dfsg/vs6624-disable.patch
    - bugfix/all/firmware_class-log-every-success-and-failure.patch
    - bugfix/all/
      radeon-amdgpu-firmware-is-required-for-drm-and-kms-on-r600-onward.patch
    - bugfix/all/disable-some-marvell-phys.patch
    - features/all/
      security-perf-allow-further-restriction-of-perf_event_open.patch
    - features/x86/x86-make-x32-syscall-support-conditional.patch
    - bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch
    - features/all/lockdown/
      efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch

  [ Ben Hutchings ]
  * udeb: Add f2fs-modules package
  * linux-kbuild: Stop building pnmtologo
  * linux-kbuild: Add new file to Makefile for kconfig

 -- Ben Hutchings <ben@decadent.org.uk>  Mon, 06 Jan 2020 04:26:45 +0000

linux (5.4.19-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.14
    - [arm64,armhf] soc: amlogic: meson-ee-pwrc: propagate PD provider
      registration errors
    - [arm64,armhf] soc: amlogic: meson-ee-pwrc: propagate errors from
      pm_genpd_init()
    - [armhf] bus: ti-sysc: Fix iterating over clocks
    - clk: Don't try to enable critical clocks if prepare failed
    - [armhf] ASoC: stm32: sai: fix possible circular locking
    - [armhf] ASoC: stm32: dfsdm: fix 16 bits record
    - [armhf] OMAP2+: Fix ti_sysc_find_one_clockdomain to check for
      to_clk_hw_omap
    - [armhf] dts: imx6q-dhcom: Fix SGTL5000 VDDIO regulator connection
    - [x86] ASoC: Intel: bytcht_es8316: Fix Irbis NB41 netbook quirk
    - ALSA: dice: fix fallback from protocol extension into limited
      functionality
    - ALSA: seq: Fix racy access for queue timer in proc read
    - ALSA: firewire-tascam: fix corruption due to spin lock without
      restoration in SoftIRQ context
    - ALSA: usb-audio: fix sync-ep altsetting sanity check
    - [arm64] dts: allwinner: a64: olinuxino: Fix SDIO supply regulator
    - [arm64] dts: allwinner: a64: olinuxino: Fix eMMC supply regulator
    - [armhf] clk: sunxi-ng: r40: Allow setting parent rate for external clock
      outputs
    - block: fix an integer overflow in logical block size
    - fuse: fix fuse_send_readpages() in the syncronous read case
    - io_uring: only allow submit from owning task
    - [armhf] dts: am571x-idk: Fix gpios property to have the correct gpio
      number
    - [armel] davinci: select CONFIG_RESET_CONTROLLER
    - perf: Correctly handle failed perf_get_aux_event()
    - iio: buffer: align the size of scan bytes to size of the largest element
    - USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx
    - USB: serial: option: Add support for Quectel RM500Q
    - USB: serial: opticon: fix control-message timeouts
    - USB: serial: option: add support for Quectel RM500Q in QDL mode
    - USB: serial: suppress driver bind attributes
    - USB: serial: ch341: handle unbound port at reset_resume
    - USB: serial: io_edgeport: handle unbound ports on URB completion
    - USB: serial: io_edgeport: add missing active-port sanity check
    - USB: serial: keyspan: handle unbound ports
    - USB: serial: quatech2: handle unbound ports
    - [x86] staging: comedi: ni_routes: fix null dereference in
      ni_find_route_source()
    - [x86] staging: comedi: ni_routes: allow partial routing information
    - [x86] scsi: fnic: fix invalid stack access
    - scsi: mptfusion: Fix double fetch bug in ioctl
    - ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()
    - [armhf] mtd: rawnand: gpmi: Fix suspend/resume problem
    - [armhf] mtd: rawnand: gpmi: Restore nfc timing setup after
      suspend/resume
    - usb: core: hub: Improved device recognition on remote wakeup
    - cpu/SMT: Fix x86 link error without CONFIG_SYSFS
    - [x86] CPU/AMD: Ensure clearing of SME/SEV features is maintained
    - locking/rwsem: Fix kernel crash when spinning on RWSEM_OWNER_UNKNOWN
    - [x86] perf/x86/intel/uncore: Fix missing marker for
      snr_uncore_imc_freerunning_events
    - [amd64] x86/efistub: Disable paging at mixed mode entry
    - [s390x] zcrypt: Fix CCA cipher key gen with clear key value function
    - [x86] scsi: storvsc: Correctly set number of hardware queues for IDE
      disk
    - mtd: spi-nor: Fix selection of 4-byte addressing opcodes on Spansion
    - [x86] efi/earlycon: Fix write-combine mapping on x86
    - [s390x] setup: Fix secure ipl message
    - [armhf] clk: samsung: exynos5420: Keep top G3D clocks enabled
    - perf hists: Fix variable name's inconsistency in hists__for_each() macro
    - locking/lockdep: Fix buffer overrun problem in stack_trace[]
    - perf report: Fix incorrectly added dimensions as switch perf data file
    - mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD
      alignment
    - mm/huge_memory.c: thp: fix conflict of above-47bit hint address and PMD
      alignment
    - mm: memcg/slab: fix percpu slab vmstats flushing
    - mm: memcg/slab: call flush_memcg_workqueue() only if memcg workqueue is
      valid
    - mm, debug_pagealloc: don't rely on static keys too early
    - btrfs: rework arguments of btrfs_unlink_subvol
    - btrfs: fix invalid removal of root ref
    - btrfs: do not delete mismatched root refs
    - btrfs: relocation: fix reloc_root lifespan and access
    - btrfs: fix memory leak in qgroup accounting
    - btrfs: check rw_devices, not num_devices for balance
    - Btrfs: always copy scrub arguments back to user space
    - mm/memory_hotplug: don't free usage map when removing a re-added early
      section
    - mm/page-writeback.c: avoid potential division by zero in
      wb_min_max_ratio()
    - mm: khugepaged: add trace status description for SCAN_PAGE_HAS_PRIVATE
    - [armhf] dts: imx6sx-sdb: Remove incorrect power supply assignment
    - [armhf] dts: imx6sl-evk: Remove incorrect power supply assignment
    - [armhf] dts: imx6sll-evk: Remove incorrect power supply assignment
    - [armhf] dts: imx6q-icore-mipi: Use 1.5 version of i.Core MX6DL
    - [arm64,armhf] net: stmmac: 16KB buffer must be 16 byte aligned
    - [arm64,armhf] net: stmmac: Enable 16KB buffer size
    - [arm*] reset: Fix {of,devm}_reset_control_array_get kerneldoc return
      types
    - tipc: fix potential hanging after b/rcast changing
    - tipc: fix retrans failure due to wrong destination
    - block: Fix the type of 'sts' in bsg_queue_rq()
    - bpf: Fix incorrect verifier simulation of ARSH under ALU32
    - bpf: Sockmap/tls, during free we may call tcp_bpf_unhash() in loop
    - bpf: Sockmap, ensure sock lock held during tear down
    - bpf: Sockmap/tls, push write_space updates through ulp updates
    - bpf: Sockmap, skmsg helper overestimates push, pull, and pop bounds
    - bpf: Sockmap/tls, msg_push_data may leave end mark in place
    - bpf: Sockmap/tls, tls_sw can create a plaintext buf > encrypt buf
    - bpf: Sockmap/tls, skmsg can have wrapped skmsg that needs extra chaining
    - bpf: Sockmap/tls, fix pop data with SK_DROP return code
    - [arm64,armhf] i2c: tegra: Fix suspending in active runtime PM state
    - [arm64,armhf] i2c: tegra: Properly disable runtime PM on driver's probe
      error
    - cfg80211: fix deadlocks in autodisconnect work
    - cfg80211: fix memory leak in nl80211_probe_mesh_link
    - cfg80211: fix memory leak in cfg80211_cqm_rssi_update
    - cfg80211: fix page refcount issue in A-MSDU decap
    - bpf/sockmap: Read psock ingress_msg before sk_receive_queue
    - netfilter: fix a use-after-free in mtype_destroy()
    - netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct
    - netfilter: nat: fix ICMP header corruption on ICMP errors
    - netfilter: nft_tunnel: fix null-attribute check
    - netfilter: nft_tunnel: ERSPAN_VERSION must not be null
    - netfilter: nf_tables: remove WARN and add NLA_STRING upper limits
    - netfilter: nf_tables: store transaction list locally while requesting
      module
    - netfilter: nf_tables: fix flowtable list del corruption
    - NFC: pn533: fix bulk-message timeout
    - net: bpf: Don't leak time wait and request sockets
    - bpftool: Fix printing incorrect pointer in btf_dump_ptr
    - batman-adv: Fix DAT candidate selection on little endian systems
    - macvlan: use skb_reset_mac_header() in macvlan_queue_xmit()
    - [x86] hv_netvsc: Fix memory leak when removing rndis device
    - net: avoid updating qdisc_xmit_lock_key in netdev_update_lockdep_key()
    - [arm64] net: hns3: pad the short frame before sending to the hardware
    - [arm64] net: hns: fix soft lockup when there is not enough memory
    - net: phy: dp83867: Set FORCE_LINK_GOOD to default after reset
    - net/sched: act_ife: initalize ife->metalist earlier
    - net: usb: lan78xx: limit size of local TSO packets
    - ptp: free ptp device pin descriptors properly
    - r8152: add missing endpoint sanity check
    - tcp: fix marked lost packets not being retransmitted
    - bnxt_en: Fix NTUPLE firmware command failures.
    - bnxt_en: Fix ipv6 RFS filter matching logic.
    - bnxt_en: Do not treat DSN (Digital Serial Number) read failure as fatal.
    - net: sched: act_ctinfo: fix memory leak
    - [armhf] net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec
    - i40e: prevent memory leak in i40e_setup_macvlans (CVE-2019-19043)
    - drm/amdgpu: allow direct upload save restore list for raven2
    - [arm64,armhf] net: stmmac: tc: Do not setup flower filtering if RSS is
      enabled
    - devlink: Wait longer before warning about unset port type
    - xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk
    - tcp: refine rule to allow EPOLLOUT generation under mem pressure
    - [arm64] dts: meson-gxl-s905x-khadas-vim: fix gpio-keys-polled node
    - cfg80211: check for set_wiphy_params
    - tick/sched: Annotate lockless access to last_jiffies_update
    - [armhf] dts: imx6ul-kontron-n6310-s: Disable the snvs-poweroff driver
    - mtd: cfi_cmdset_0002: only check errors when ready in
      cfi_check_err_status()
    - mtd: cfi_cmdset_0002: fix delayed error detection on HyperFlash
    - reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr
    - scsi: esas2r: unlock on error in esas2r_nvram_read_direct()
    - [arm64] scsi: hisi_sas: Don't create debugfs dump folder twice
    - [arm64] scsi: hisi_sas: Set the BIST init value before enabling BIST
    - scsi: qla4xxx: fix double free bug
    - scsi: bnx2i: fix potential use after free
    - scsi: target: core: Fix a pr_debug() argument
    - scsi: lpfc: fix: Coverity: lpfc_get_scsi_buf_s3(): Null pointer
      dereferences
    - [arm64] scsi: hisi_sas: Return directly if init hardware failed
    - scsi: scsi_transport_sas: Fix memory leak when removing devices
    - scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI
    - scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan
    - scsi: core: scsi_trace: Use get_unaligned_be*()
    - scsi: lpfc: Fix list corruption detected in lpfc_put_sgl_per_hdwq
    - scsi: lpfc: Fix hdwq sgl locks and irq handling
    - scsi: lpfc: Fix a kernel warning triggered by lpfc_get_sgl_per_hdwq()
    - rtw88: fix potential read outside array boundary
    - perf probe: Fix wrong address verification
    - perf script: Allow --time with --reltime
    - perf script: Fix --reltime with --time
    - scsi: lpfc: use hdwq assigned cpu for allocation
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.15
    - [x86] drm/i915: Fix pid leak with banned clients
    - libbpf: Fix compatibility for kernels without need_wakeup
    - libbpf: Fix memory leak/double free issue
    - libbpf: Fix potential overflow issue
    - libbpf: Fix another potential overflow issue in bpf_prog_linfo
    - libbpf: Make btf__resolve_size logic always check size error condition
    - bpf: Force .BTF section start to zero when dumping from vmlinux
    - [armhf] OMAP2+: Add missing put_device() call in omapdss_init_of()
    - xfs: Sanity check flags of Q_XQUOTARM call
    - [armhf] i2c: stm32f7: rework slave_id allocation
    - [armhf] i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop
    - [x86] mfd: intel-lpss: Add default I2C device properties for Gemini Lake
    - SUNRPC: Fix svcauth_gss_proxy_init()
    - SUNRPC: Fix backchannel latency metrics
    - [powerpc*] security: Fix debugfs data leak on 32-bit
    - [powerpc*] pseries: Enable support for ibm,drc-info property
    - tipc: reduce sensitive to retransmit failures
    - tipc: update mon's self addr when node addr generated
    - tipc: fix potential memory leak in __tipc_sendmsg()
    - tipc: fix wrong socket reference counter after tipc_sk_timeout() returns
    - tipc: fix wrong timeout input for tipc_wait_for_cond()
    - [arm64,armhf] net/mlx5e: Fix free peer_flow when refcount is 0
    - net: phy: broadcom: Fix RGMII delays configuration for BCM54210E
    - [armhf] phy: ti: gmii-sel: fix mac tx internal delay for rgmii-rxid
    - mt7601u: fix bbp version check in mt7601u_wait_bbp_ready
    - ice: fix stack leakage
    - [s390x] pkey: fix memory leak within _copy_apqns_from_user()
    - nfsd: depend on CRYPTO_MD5 for legacy client tracking
    - [armhf] crypto: sun4i-ss - fix big endian issues
    - perf map: No need to adjust the long name of modules
    - [arm64,armhf] soc/tegra: pmc: Fix crashes for hierarchical interrupts
    - watchdog: sprd: Fix the incorrect pointer getting from driver data
    - ipmi: Fix memory leak in __ipmi_bmc_register (CVE-2019-19046)
    - sched/core: Further clarify sched_class::set_next_task()
    - gpiolib: No need to call gpiochip_remove_pin_ranges() twice
    - rtw88: fix beaconing mode rsvd_page memory violation issue
    - rtw88: fix error handling when setup efuse info
    - [arm64,armhf] drm/panfrost: Add missing check for pfdev->regulator
    - drm/amdgpu: remove excess function parameter description
    - [armhf] hwrng: omap3-rom - Fix missing clock by probing with device tree
    - [arm64,armhf] drm/rockchip: Round up _before_ giving to the clock
      framework
    - software node: Get reference to parent swnode in get_parent op
    - [arm64] net: netsec: Correct dma sync for XDP_TX frames
    - ACPI: platform: Unregister stale platform devices
    - [arm64,armhf] pwm: sun4i: Fix incorrect calculation of duty_cycle/period
    - libbpf: Don't use kernel-side u32 type in xsk.c
    - scsi: ufs: delete redundant function ufshcd_def_desc_sizes()
    - net: openvswitch: don't unlock mutex when changing the user_features
      fails
    - [x86] hv_netvsc: flag software created hash value
    - rt2800: remove errornous duplicate condition
    - net: neigh: use long type to store jiffies delta
    - packet: fix data-race in fanout_flow_is_huge()
    - [armhf] i2c: stm32f7: report dma error during probe
    - [arm64] tee: optee: Fix dynamic shm pool allocations
    - [arm64] tee: optee: fix device enumeration error handling
    - workqueue: Add RCU annotation for pwq list walk
    - SUNRPC: Fix another issue with MIC buffer space
    - sched/cpufreq: Move the cfs_rq_util_change() call to
      cpufreq_update_util()
    - mt76: mt76u: rely on usb_interface instead of usb_dev
    - dma-direct: don't check swiotlb=force in dma_direct_map_resource
    - afs: Remove set but not used variables 'before', 'after'
    - [armhf] dmaengine: ti: edma: fix missed failure handling
    - drm/radeon: fix bad DMA from INTERRUPT_CNTL2
    - xdp: Fix cleanup on map free for devmap_hash map type
    - block: fix memleak of bio integrity data
    - [s390x] qeth: fix dangling IO buffers after halt/clear
    - net-sysfs: Call dev_hold always in netdev_queue_add_kobject
    - [arm64,armhf] phy/rockchip: inno-hdmi: round clock rate down to closest
      1000 Hz
    - [arm64] optee: Fix multi page dynamic shm pool alloc
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.16
    - can, slip: Protect tty->disc_data in write_wakeup and close with RCU
    - firestream: fix memory leaks
    - gtp: make sure only SOCK_DGRAM UDP sockets are accepted
    - ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions
    - net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM
    - net: ip6_gre: fix moving ip6gre between namespaces
    - net, ip6_tunnel: fix namespaces move
    - net, ip_tunnel: fix namespaces move
    - net: rtnetlink: validate IFLA_MTU attribute in rtnl_create_link()
    - net_sched: fix datalen for ematch
    - net_sched: use validated TCA_KIND attribute in tc_new_tfilter()
    - net-sysfs: Fix reference count leak
    - net: usb: lan78xx: Add .ndo_features_check
    - Revert "udp: do rmem bulk free even if the rx sk queue is empty"
    - tcp_bbr: improve arithmetic division in bbr_update_bw()
    - tcp: do not leave dangling pointers in tp->highest_sack
    - tun: add mutex_unlock() call and napi.skb clearing in tun_get_user()
    - airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
    - airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE
    - fou: Fix IPv6 netlink policy
    - net: Fix packet reordering caused by GRO and listified RX cooperation
    - [arm64,armhf] net/mlx5: Fix lowest FDB pool size
    - [arm64,armhf] net/mlx5: Update the list of the PCI supported devices
    - [arm64,armhf] net/mlx5: DR, Enable counter on non-fwd-dest objects
    - [arm64,armhf] net/mlx5: E-Switch, Prevent ingress rate configuration of
      uplink rep
    - [arm64,armhf] net/mlx5: DR, use non preemptible call to get the current
      cpu number
    - ipv4: Detect rollover in specific fib table dump
    - Revert "io_uring: only allow submit from owning task"
    - afs: Fix characters allowed into cell names
    - hwmon: (adt7475) Make volt2reg return same reg as reg2volt input
    - hwmon: (core) Do not use device managed functions for memory allocations
    - ceph: hold extra reference to r_parent over life of request
    - PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken
    - [arm64,armhf] drm/panfrost: Add the panfrost_gem_mapping concept
    - [x86] drm/i915: Align engine->uabi_class/instance with i915_drm.h
    - PM: hibernate: fix crashes with init_on_free=1
    - tracing: trigger: Replace unneeded RCU-list traversals
    - tracing/uprobe: Fix double perf_event linking on multiprobe uprobe
    - tracing: Do not set trace clock if tracefs lockdown is in effect
    - tracing: Fix histogram code when expression has same var as value
    - [powerpc*] xive: Discard ESB load value when interrupt is invalid
    - Revert "iwlwifi: mvm: fix scan config command size"
    - iwlwifi: mvm: don't send the IWL_MVM_RXQ_NSSN_SYNC notif to Rx queues
    - XArray: Fix infinite loop with entry at ULONG_MAX
    - XArray: Fix xa_find_after with multi-index entries
    - XArray: Fix xas_find returning too many entries
    - [x86] pinctrl: sunrisepoint: Add missing Interrupt Status register
      offset
    - [amd64] iommu/vt-d: Call __dmar_remove_one_dev_info with valid pointer
    - Input: keyspan-remote - fix control-message timeouts
    - [x86] Revert "Input: synaptics-rmi4 - don't increment rmiaddr for SMBus
      transfers"
    - [arm64,armhf] mmc: tegra: fix SDR50 tuning override
    - mmc: sdhci: fix minimum clock rate for v3 controller
    - Input: sur40 - fix interface sanity checks
    - Input: gtco - fix endpoint sanity check
    - Input: aiptek - fix endpoint sanity check
    - Input: pegasus_notetaker - fix endpoint sanity check
    - Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register
    - netfilter: nft_osf: add missing check for DREG attribute
    - [amd64] iommu/amd: Fix IOMMU perf counter clobbering during init
    - readdir: make user_access_begin() use the real access range
    - leds: gpio: Fix uninitialized gpio label for fwnode based probe
    - hwmon: (nct7802) Fix voltage limits to wrong registers
    - hwmon: (nct7802) Fix non-working alarm on voltages
    - scsi: RDMA/isert: Fix a recently introduced regression related to logout
    - tracing: xen: Ordered comparison of function pointers
    - iwlwifi: mvm: fix SKB leak on invalid queue
    - iwlwifi: mvm: fix potential SKB leak on TXQ TX
    - [x86] drm/i915/userptr: fix size calculation
    - xfrm: support output_mark for offload ESP packets
    - net, sk_msg: Don't check if sock is locked when tearing down psock
    - do_last(): fetch directory ->i_mode and ->i_uid before it's too late
      (CVE-2020-8428)
    - readdir: be more conservative with directory entry names
    - libertas: Fix two buffer overflows at parsing bss descriptor
      (CVE-2019-14896 CVE-2019-14897)
    - media: v4l2-ioctl.c: zero reserved fields for S/TRY_FMT
    - netfilter: ipset: use bitmap infrastructure completely
    - netfilter: nf_tables: add __nft_chain_type_get()
    - netfilter: nf_tables: autoload modules from the abort path
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.17
    - Bluetooth: btusb: fix non-atomic allocation in completion handler
    - orinoco_usb: fix interface sanity check
    - rsi_91x_usb: fix interface sanity check
    - usb: dwc3: pci: add ID for the Intel Comet Lake -V variant
    - [arm64,armhf] usb: host: xhci-tegra: set MODULE_FIRMWARE for tegra186
    - USB: serial: ir-usb: add missing endpoint sanity check
    - USB: serial: ir-usb: fix link-speed handling
    - USB: serial: ir-usb: fix IrLAP framing
    - [arm64,armhf] usb: dwc3: turn off VBUS when leaving host mode
    - [x86] usb: typec: fusb302: fix "op-sink-microwatt" default that was in
      mW
    - [x86] staging: vt6656: correct packet types for CTS protect, mode.
    - [x86] staging: vt6656: use NULLFUCTION stack on mac80211
    - [x86] staging: vt6656: Fix false Tx excessive retries reporting.
    - [arm64,armel] serial: 8250_bcm2835aux: Fix line mismatch on driver
      unbind
    - [armhf] serial: imx: fix a race condition in receive path
    - debugfs: Return -EPERM when locked down
    - component: do not dereference opaque pointer in debugfs
    - [arm*] binder: fix log spam for existing debugfs file creation.
    - [x86] mei: me: add comet point (lake) H device ids
    - crypto: chelsio - fix writing tfm flags to wrong place
    - CIFS: Fix task struct use-after-free on reconnect
    - cifs: set correct max-buffer-size for smb2_ioctl_init()
    - cifs: Fix memory allocation in __smb2_handle_cancelled_cmd()
    - ath9k: fix storage endpoint lookup
    - brcmfmac: fix interface sanity check
    - rtl8xxxu: fix interface sanity check
    - zd1211rw: fix storage endpoint lookup
    - net_sched: ematch: reject invalid TCF_EM_SIMPLE
    - net_sched: fix ops->bind_class() implementations
    - net_sched: walk through all child classes in tc_bind_tclass()
    - [arm64] net: socionext: fix possible user-after-free in
      netsec_process_rx
    - [arm64] net: socionext: fix xdp_result initialization in
      netsec_process_rx
    - udp: segment looped gso packets correctly
    - net: include struct nhmsg size in nh nlmsg size
    - rxrpc: Fix use-after-free in rxrpc_receive_data()
    - HID: multitouch: Add LG MELF0410 I2C touchscreen support
    - HID: Add quirk for Xin-Mo Dual Controller
    - HID: ite: Add USB id match for Acer SW5-012 keyboard dock
    - HID: asus: Ignore Asus vendor-page usage-code 0xff events
    - HID: Add quirk for incorrect input length on Lenovo Y720
    - HID: intel-ish-hid: ipc: add CMP device id
    - HID: wacom: Recognize new MobileStudio Pro PID
    - [x86] ASoC: SOF: fix fault at driver unload after failed probe
    - [x86] ASoC: SOF: Intel: hda: hda-dai: fix oops on hda_link .hw_free
    - drivers/hid/hid-multitouch.c: fix a possible null pointer access.
    - phy: qcom-qmp: Increase PHY ready timeout
    - [x86] ASoC: topology: Prevent use-after-free in
      snd_soc_get_pcm_runtime()
    - HID: intel-ish-hid: ipc: Add Tiger Lake PCI device ID
    - [arm64] watchdog: max77620_wdt: fix potential build errors
    - [armel,armhf] watchdog: orion: fix platform_get_irq() complaints
    - drivers/net/b44: Change to non-atomic bit operations on pwol_mask
    - [i386] net: wan: sdla: Fix cast from pointer to integer of different
      size
    - [arm64] gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP
    - [arm64] iommu/dma: fix variable 'cookie' set but not used
    - [arm64,armhf] stmmac: debugfs entry name is not be changed when udev
      rename device name.
    - atm: eni: fix uninitialized variable warning
    - HID: steam: Fix input device disappearing
    - [x86] ASoC: Intel: cht_bsw_rt5645: Add quirk for boards using
      pmc_plt_clk_0
    - drm/amdgpu/SRIOV: add navi12 pci id for SRIOV (v2)
    - libbpf: Fix BTF-defined map's __type macro handling of arrays
    - [x86] platform/x86: dell-laptop: disable kbd backlight on Inspiron 10xx
    - PCI: Add DMA alias quirk for Intel VCA NTB
    - media: dvbsky: add support for eyeTV Geniatech T2 lite
    - [armhf] bus: ti-sysc: Handle mstandby quirk and use it for musb
    - [armhf] bus: ti-sysc: Use swsup quirks also for am335x musb
    - [amd64,armhf] spi: pxa2xx: Add support for Intel Comet Lake-H
    - [amd64] iommu/amd: Support multiple PCI DMA aliases in device table
    - [amd64] iommu/amd: Support multiple PCI DMA aliases in IRQ Remapping
    - perf/imx_ddr: Add enhanced AXI ID filter support
    - [x86] mfd: intel-lpss: Add Intel Comet Lake PCH-H PCI IDs
    - mmc: sdhci-pci: Quirk for AMD SDHC Device 0x7906
    - mmc: sdhci-pci: Add support for Intel JSL
    - [armhf] bus: ti-sysc: Add module enable quirk for audio AESS
    - usb-storage: Disable UAS on JMicron SATA enclosure
    - ALSA: hda/realtek - Move some alc236 pintbls to fallback table
    - Bluetooth: Allow combination of BDADDR_PROPERTY and INVALID_BDADDR
      quirks
    - Bluetooth: btbcm: Use the BDADDR_PROPERTY quirk
    - [armhf] bus: ti-sysc: Fix missing force mstandby quirk handling
    - rsi: fix use-after-free on failed probe and unbind
    - rsi: fix use-after-free on probe errors
    - rsi: fix memory leak on failed URB submission
    - rsi: fix non-atomic allocation in completion handler
    - crypto: af_alg - Use bh_lock_sock in sk_destruct
    - [powerpc*] crypto: vmx - reject xts inputs that are too short
    - crypto: pcrypt - Fix user-after-free on module unload
    - [arm64] KVM: Write arch.mdcr_el2 changes since last vcpu_load on VHE
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.18
    - vfs: fix do_last() regression
    - cifs: fix soft mounts hanging in the reconnect code
    - e1000e: Drop unnecessary __E1000_DOWN bit twiddling
    - e1000e: Revert "e1000e: Make watchdog use delayed work"
    - gfs2: Another gfs2_find_jhead fix
    - perf c2c: Fix return type for histogram sorting comparision functions
    - PM / devfreq: Add new name attribute for sysfs
    - mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
    - reiserfs: Fix memory leak of journal device string
    - media: digitv: don't continue if remote control state can't be read
    - media: af9005: uninitialized variable printked
    - media: vp7045: do not read uninitialized values if usb transfer fails
    - media: gspca: zero usb_buf
    - media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0
    - tomoyo: Use atomic_t for statistics counter
    - ttyprintk: fix a potential deadlock in interrupt context issue
    - Bluetooth: Fix race condition in hci_release_sock()
    - cgroup: Prevent double killing of css when enabling threaded cgroup
    - [armhf] clk: sunxi-ng: v3s: Fix incorrect number of hw_clks.
    - [arm64] dts: meson-sm1-sei610: add gpio bluetooth interrupt
    - [armhf] dts: sun8i: a83t: Correct USB3503 GPIOs polarity
    - [armhf] dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint
      dt nodes
    - rseq: Unregister rseq for clone CLONE_VM
    - [arm64,armhf] clk: sunxi-ng: sun8i-r: Fix divider on APB0 clock
    - [arm64] clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order
    - mac80211: mesh: restrict airtime metric to peered established plinks
    - [armhf] clk: mmp2: Fix the order of timer mux parents
    - ASoC: rt5640: Fix NULL dereference on module unload
    - [s390x] zcrypt: move ap device reset from bus to driver code
    - i40e: Fix virtchnl_queue_select bitmap validation
    - ixgbevf: Remove limit of 10 entries for unicast filter list
    - ixgbe: Fix calculation of queue with VFs and flow director on interface
      flap
    - igb: Fix SGMII SFP module discovery for 100FX/LX.
    - iavf: remove current MAC address filter on VF reset
    - [x86] platform/x86: GPD pocket fan: Allow somewhat lower/higher
      temperature limits
    - [x86] platform/x86: intel_pmc_core: update Comet Lake platform driver
    - [x86] ASoC: SOF: Intel: fix HDA codec driver probe with multiple
      controllers
    - [x86] ASoC: hdac_hda: Fix error in driver removal after failed probe
    - qmi_wwan: Add support for Quectel RM500Q
    - [hppa/parisc] Use proper printk format for resource_size_t
    - wireless: fix enabling channel 12 for custom regulatory domain
    - cfg80211: Fix radar event during another phy CAC
    - mac80211: Fix TKIP replay protection immediately after key setup
    - [x86] perf/x86/intel/uncore: Add PCI ID of IMC for Xeon E3 V5 Family
    - [x86] perf/x86/intel/uncore: Remove PCIe3 unit for SNR
    - XArray: Fix xas_pause at ULONG_MAX
    - iwlwifi: pcie: allocate smaller dev_cmd for TX headers
    - iwlwifi: Don't ignore the cap field upon mcc update
    - iwlwifi: dbg: force stop the debug monitor HW
    - Input: evdev - convert kzalloc()/vzalloc() to kvzalloc()
    - vti[6]: fix packet tx through bpf_redirect()
    - xfrm interface: fix packet tx through bpf_redirect()
    - xfrm: interface: do not confirm neighbor when do pmtu update
    - [x86] scsi: fnic: do not queue commands during fwreset
    - [armhf] 8955/1: virt: Relax arch timer version check during early boot
    - r8152: get default setting of WOL before initializing
    - r8152: disable U2P3 for RTL8153B
    - r8152: Disable PLA MCU clock speed down
    - r8152: disable test IO for RTL8153B
    - r8152: avoid the MCU to clear the lanwake
    - r8152: disable DelayPhyPwrChg
    - qlcnic: Fix CPU soft lockup while collecting firmware dump
    - seq_tab_next() should increase position index
    - l2t_seq_next should increase position index
    - netfilter: conntrack: sctp: use distinct states for new SCTP connections
    - netfilter: nf_tables_offload: fix check the chain offload flag
    - net: Fix skb->csum update in inet_proto_csum_replace16().
    - btrfs: do not zero f_bavail if we have available space
    - flow_dissector: Fix to use new variables for port ranges in bpf hook
    - dm thin: fix use-after-free in metadata_pre_commit_callback
    - perf report: Fix no libunwind compiled warning break s390 issue
    - mm/migrate.c: also overwrite error when it is bigger than zero
    - [x86] ASoC: topology: fix soc_tplg_fe_link_create() - link->dobj
      initialization order
    - Revert "rsi: fix potential null dereference in rsi_probe()"
    - tracing/uprobe: Fix to make trace_uprobe_filter alignment safe
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.19
    - bnxt_en: Move devlink_register before registering netdev
    - gtp: use __GFP_NOWARN to avoid memalloc warning
    - l2tp: Allow duplicate session creation with UDP
    - net_sched: fix an OOB access in cls_tcindex
    - [arm64,armhf] net: stmmac: Delete txtimer in suspend()
    - bnxt_en: Fix TC queue mapping.
    - rxrpc: Fix use-after-free in rxrpc_put_local()
    - rxrpc: Fix insufficient receive notification generation
    - rxrpc: Fix missing active use pinning of rxrpc_local object
    - rxrpc: Fix NULL pointer deref due to call->conn being cleared on
      disconnect
    - tcp: clear tp->total_retrans in tcp_disconnect()
    - tcp: clear tp->delivered in tcp_disconnect()
    - tcp: clear tp->data_segs{in|out} in tcp_disconnect()
    - tcp: clear tp->segs_{in|out} in tcp_disconnect()
    - bnxt_en: Fix logic that disables Bus Master during firmware reset.
    - media: uvcvideo: Avoid cyclic entity chains due to malformed USB
      descriptors
    - netfilter: ipset: fix suspicious RCU usage in find_set_and_id
    - ipc/msg.c: consolidate all xxxctl_down() functions
    - tracing/kprobes: Have uname use __get_str() in print_fmt
    - tracing: Fix sched switch start/stop refcount racy updates
    - rcu: Use *_ONCE() to protect lockless ->expmask accesses
    - rcu: Avoid data-race in rcu_gp_fqs_check_wake()
    - srcu: Apply *_ONCE() to ->srcu_last_gp_end
    - rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special()
    - nvmet: Fix error print message at nvmet_install_queue function
    - nvmet: Fix controller use after free
    - Bluetooth: btusb: fix memory leak on fw
    - Bluetooth: btusb: Disable runtime suspend on Realtek devices
    - brcmfmac: Fix memory leak in brcmf_usbdev_qinit
    - [arm64,armhf] usb: dwc3: gadget: Check END_TRANSFER completion
    - [arm64,armhf] usb: dwc3: gadget: Delay starting transfer
    - usb: gadget: f_fs: set req->num_sgs as 0 for non-sg transfer
    - usb: gadget: legacy: set max_speed to super-speed
    - usb: gadget: f_ncm: Use atomic_t to track in-flight request
    - usb: gadget: f_ecm: Use atomic_t to track in-flight request
    - ALSA: usb-audio: Fix endianess in descriptor validation
    - ALSA: usb-audio: Annotate endianess in Scarlett gen2 quirk
    - ALSA: dummy: Fix PCM format loop in proc output
    - memcg: fix a crash in wb_workfn when a device disappears
    - mm/sparse.c: reset section's mem_map when fully deactivated
    - mmc: sdhci-pci: Make function amd_sdhci_reset static
    - utimes: Clamp the timestamps in notify_change()
    - mm/memory_hotplug: fix remove_memory() lockdep splat
    - mm: thp: don't need care deferred split queue in memcg charge move path
    - mm: move_pages: report the number of non-attempted pages
    - media/v4l2-core: set pages dirty upon releasing DMA buffers
    - media: v4l2-core: compat: ignore native command codes
    - media: v4l2-rect.h: fix v4l2_rect_map_inside() top/left adjustments
    - irqdomain: Fix a memory leak in irq_domain_push_irq()
    - [x86] cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
    - ALSA: hda: Apply aligned MMIO access only conditionally
    - ALSA: hda: Add Clevo W65_67SB the power_save blacklist
    - ALSA: hda: Add JasperLake PCI ID and codec vid
    - [arm64] acpi: fix DAIF manipulation with pNMI
    - [arm64] KVM: Correct PSTATE on exception entry
    - [arm64,armhf] KVM: Correct CPSR on exception entry
    - [arm64,armhf] KVM: Correct AArch32 SPSR on exception entry
    - [arm64] KVM: Only sign-extend MMIO up to register width
    - [s390x] mm: fix dynamic pagetable upgrade for hugetlbfs
    - [powerpc*] xmon: don't access ASDR in VMs
    - [powerpc*] pseries: Advance pfn if section is not present in
      lmb_is_removable()
    - tracing: Fix now invalid var_ref_vals assumption in trace action
    - [arm64,armhf] PCI: tegra: Fix return value check of
      pm_runtime_get_sync()
    - mmc: spi: Toggle SPI polarity, do not hardcode it
    - [x86] ACPI: video: Do not export a non working backlight interface on
      MSI MS-7721 boards
    - ACPI / battery: Deal with design or full capacity being reported as -1
    - ACPI / battery: Use design-cap for capacity calculations if full-cap is
      not available
    - ACPI / battery: Deal better with neither design nor full capacity not
      being reported
    - alarmtimer: Unregister wakeup source when module get fails
    - fscrypt: don't print name of busy file when removing key
    - ubifs: don't trigger assertion on invalid no-key filename
    - ubifs: Fix wrong memory allocation
    - ubifs: Fix FS_IOC_SETFLAGS unexpectedly clearing encrypt flag
    - ubifs: Fix deadlock in concurrent bulk-read and writepage
    - [x86] ASoC: SOF: core: free trace on errors
    - [x86] hv_balloon: Balloon up according to request page number
    - mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile
    - nvmem: core: fix memory abort in cleanup path
    - crypto: api - Check spawn->alg under lock in crypto_drop_spawn
    - padata: Remove broken queue flushing
    - fs: allow deduplication of eof block into the end of the destination
      file
    - erofs: fix out-of-bound read for shifted uncompressed block
    - scsi: megaraid_sas: Do not initiate OCR if controller is not in ready
      state
    - scsi: qla2xxx: Fix mtcp dump collection failure
    - cpupower: Revert library ABI changes from commit ae2917093fb60bdc1ed3e
    - [arm64,armhf] power: supply: axp20x_ac_power: Fix reporting online
      status
    - ovl: fix wrong WARN_ON() in ovl_cache_update_ino()
    - ovl: fix lseek overflow on 32bit
    - f2fs: choose hardlimit when softlimit is larger than hardlimit in
      f2fs_statfs_project()
    - f2fs: fix miscounted block limit in f2fs_statfs_project()
    - f2fs: code cleanup for f2fs_statfs_project()
    - f2fs: fix dcache lookup of !casefolded directories
    - f2fs: fix race conditions in ->d_compare() and ->d_hash()
    - PM: core: Fix handling of devices deleted during system-wide resume
    - cpufreq: Avoid creating excessively large stack frames
    - [armel,armhf] dma-api: fix max_pfn off-by-one error in __dma_supported()
    - dm zoned: support zone sizes smaller than 128MiB
    - dm space map common: fix to ensure new block isn't already in use
    - dm writecache: fix incorrect flush sequence when doing SSD mode commit
    - dm crypt: fix GFP flags passed to skcipher_request_alloc()
    - dm crypt: fix benbi IV constructor crash if used in authenticated mode
    - dm thin metadata: use pool locking at end of dm_pool_metadata_close
    - dm: fix potential for q->make_request_fn NULL pointer
    - scsi: qla2xxx: Fix stuck login session using prli_pend_timer
    - [x86] ASoC: SOF: Introduce state machine for FW boot
    - [x86] ASoC: SOF: core: release resources on errors in probe_continue
    - tracing: Annotate ftrace_graph_hash pointer with __rcu
    - tracing: Annotate ftrace_graph_notrace_hash pointer with __rcu
    - ftrace: Add comment to why rcu_dereference_sched() is open coded
    - ftrace: Protect ftrace_graph_hash with ftrace_sync
    - crypto: pcrypt - Avoid deadlock by using per-instance padata queues
    - btrfs: fix improper setting of scanned for range cyclic write cache
      pages
    - btrfs: Handle another split brain scenario with metadata uuid feature
    - [riscv64] bpf: Fix broken BPF tail calls
    - bpf, devmap: Pass lockdep expression to RCU lists
    - libbpf: Fix realloc usage in bpf_core_find_cands
    - crypto: api - fix unexpectedly getting generic implementation
    - [arm64] crypto: hisilicon - Use the offset fields in sqe to avoid need
      to split scatterlists
    - [x86] crypto: ccp - set max RSA modulus size for v3 platform devices as
      well
    - [arm64] crypto: arm64/ghash-neon - bump priority to 150
    - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request
    - crypto: api - Fix race condition in crypto_spawn_alg
    - [powerpc*] futex: Fix incorrect user access blocking
    - scsi: qla2xxx: Fix unbound NVME response length
    - NFS: Fix memory leaks and corruption in readdir
    - NFS: Directory page cache pages need to be locked when read
    - nfsd: fix filecache lookup
    - jbd2_seq_info_next should increase position index
    - ext4: fix deadlock allocating crypto bounce page from mempool
    - ext4: fix race conditions in ->d_compare() and ->d_hash()
    - Btrfs: fix missing hole after hole punching and fsync when using
      NO_HOLES
    - Btrfs: make deduplication with range including the last block work
    - Btrfs: fix infinite loop during fsync after rename operations
    - btrfs: set trans->drity in btrfs_commit_transaction
    - btrfs: drop log root for dropped roots
    - Btrfs: fix race between adding and putting tree mod seq elements and
      nodes
    - btrfs: flush write bio if we loop in extent_write_cache_pages
    - btrfs: Correctly handle empty trees in find_first_clear_extent_bit
    - [armhf] tegra: Enable PLLP bypass during Tegra124 LP1
    - iwlwifi: don't throw error when trying to remove IGTK
    - mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
    - sunrpc: expiry_time should be seconds not timeval
    - gfs2: fix gfs2_find_jhead that returns uninitialized jhead with seq 0
    - gfs2: move setting current->backing_dev_info
    - gfs2: fix O_SYNC write handling
    - drm/rect: Avoid division by zero
    - media: iguanair: fix endpoint sanity check
    - media: rc: ensure lirc is initialized before registering input device
    - xen/balloon: Support xend-based toolstack take two
    - watchdog: fix UAF in reboot notifier handling in watchdog core code
    - bcache: add readahead cache policy options via sysfs interface
    - eventfd: track eventfd_signal() recursion depth
    - aio: prevent potential eventfd recursion on poll
    - [x86] KVM: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
    - [x86] KVM: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
    - [x86] KVM: Protect pmu_intel.c from Spectre-v1/L1TF attacks
    - [x86] KVM: Protect DR-based index computations from Spectre-v1/L1TF
      attacks
    - [x86] KVM: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
    - [x86] KVM: Protect kvm_hv_msr_[get|set]_crash_data() from
      Spectre-v1/L1TF attacks
    - [x86] KVM: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
    - [x86] KVM: Protect MSR-based index computations in pmu.h from
      Spectre-v1/L1TF attacks
    - [x86] KVM: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
    - [x86] KVM: Protect MSR-based index computations from Spectre-v1/L1TF
      attacks in x86.c
    - [x86] KVM: Protect x86_decode_insn from Spectre-v1/L1TF attacks
    - [x86] KVM: Protect MSR-based index computations in
      fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks
    - [x86] KVM: Fix potential put_fpu() w/o load_fpu() on MPX platform
    - [powerpc*] KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails
    - [powerpc*] KVM: PPC: Book3S PR: Free shared page if mmu initialization
      fails
    - [x86] kvm/svm: PKU not currently supported
    - [x86] kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit
      (CVE-2019-3016)
    - [x86] kvm: Introduce kvm_(un)map_gfn() (CVE-2019-3016)
    - [x86] KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
      (CVE-2019-3016)
    - [x86] kvm: Cache gfn to pfn translation (CVE-2019-3016)
    - [x86] KVM: Clean up host's steal time structure (CVE-2019-3016)
    - [x86] KVM: VMX: Add non-canonical check on writes to RTIT address MSRs
    - [x86] KVM: Don't let userspace set host-reserved cr4 bits
    - [x86] KVM: Free wbinvd_dirty_mask if vCPU creation fails
    - [x86] KVM: Handle TIF_NEED_FPU_LOAD in kvm_{load,put}_guest_fpu()
    - [x86] KVM: Ensure guest's FPU state is loaded when accessing for
      emulation
    - [x86] KVM: Revert "KVM: X86: Fix fpu state crash in kvm guest"
    - [s390x] KVM: do not clobber registers during guest reset/store status
    - ocfs2: fix oops when writing cloned file
    - mm/page_alloc.c: fix uninitialized memmaps on a partially populated last
      section
    - mm/mmu_gather: invalidate TLB correctly on batch allocation failure and
      flush
    - [arm64,armhf] clk: tegra: Mark fuse clock as critical
    - virtio-balloon: initialize all vq callbacks
    - virtio-pci: check name when counting MSI-X vectors
    - fix up iter on short count in fuse_direct_io()
    - broken ping to ipv6 linklocal addresses on debian buster
    - percpu: Separate decrypted varaibles anytime encryption can be enabled
    - scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return
      type
    - scsi: csiostor: Adjust indentation in csio_device_reset
    - scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
    - scsi: ufs: Recheck bkops level if bkops is disabled
    - mtd: spi-nor: Split mt25qu512a (n25q512a) entry into two
    - [arm64] phy: qualcomm: Adjust indentation in read_poll_timeout
    - ext2: Adjust indentation in ext2_fill_super
    - [arm64] drm: msm: mdp4: Adjust indentation in mdp4_dsi_encoder_enable
    - [x86] NFC: pn544: Adjust indentation in pn544_hci_check_presence
    - ppp: Adjust indentation into ppp_async_input
    - [armhf] net: smc911x: Adjust indentation in smc911x_phy_configure
    - net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
    - IB/mlx5: Fix outstanding_pi index for GSI qps
    - IB/core: Fix ODP get user pages flow
    - nfsd: fix delay timer on 32-bit architectures
    - nfsd: fix jiffies/time_t mixup in LRU list
    - nfsd: Return the correct number of bytes written to the file
    - virtio-balloon: Fix memory leak when unloading while hinting is in
      progress
    - virtio_balloon: Fix memory leaks on errors in virtballoon_probe()
    - ubifs: Fix memory leak from c->sup_node
    - regulator: core: Add regulator_is_equal() helper
    - [armhf] ASoC: sgtl5000: Fix VDDA and VDDIO comparison
    - bonding/alb: properly access headers in bond_alb_xmit()
    - devlink: report 0 after hitting end in region read
    - [armhf] net: dsa: b53: Always use dev->vlan_enabled in
      b53_configure_vlan()
    - [armhf] net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port
    - [arm64,armhf] net: mvneta: move rx_dropped and rx_errors in per-cpu
      stats
    - net_sched: fix a resource leak in tcindex_set_parms()
    - [arm64] net: stmmac: fix a possible endless loop
    - [arm64,riscv64] net: macb: Remove unnecessary alignment check for TSO
    - [arm64,riscv64] net: macb: Limit maximum GEM TX length in TSO
    - ipv6/addrconf: fix potential NULL deref in inet6_set_link_af()
    - qed: Fix timestamping issue for L2 unicast ptp packets.
    - drop_monitor: Do not cancel uninitialized work item
    - net/mlx5: Fix deadlock in fs_core
    - net/mlx5: Deprecate usage of generic TLS HW capability bit
    - [x86] ASoC: Intel: skl_hda_dsp_common: Fix global-out-of-bounds bug
    - [x86] timer: Don't skip PIT setup when APIC is disabled or in legacy
      mode
    - btrfs: use bool argument in free_root_pointers()
    - btrfs: free block groups after free'ing fs trees
    - drm/dp_mst: Remove VCPI while disabling topology mgr
    - [x86] KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM
    - [x86] KVM: x86: use CPUID to locate host page table reserved bits
    - [x86] KVM: x86: Use gpa_t for cr2/gpa to fix TDP support on 32-bit KVM
    - [x86] KVM: x86: fix overlap between SPTE_MMIO_MASK and generation
    - [x86] KVM: nVMX: vmread should not set rflags to specify success in case
      of #PF
    - KVM: Use vcpu-specific gva->hva translation when querying host page size
    - KVM: Play nice with read-only memslots when querying host page size
    - cifs: fail i/o on soft mounts if sessionsetup errors out
    - [x86] apic/msi: Plug non-maskable MSI affinity race
    - clocksource: Prevent double add_timer_on() for watchdog_timer
    - perf/core: Fix mlock accounting in perf_mmap()
    - rxrpc: Fix service call disconnection

  [ Aurelien Jarno ]
  * [mips*/malta] Enable POWER_RESET_PIIX4_POWEROFF.

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.4.13-rt6
  * [rt] Update to 5.4.13-rt7
  * [rt] Update to 5.4.17-rt8
  * [rt] Update to 5.4.17-rt9
  * Bump ABI to 4.
  * Revert "cpupower: Revert library ABI changes from commit
    ae2917093fb60bdc1ed3e"

  [ Ben Hutchings ]
  * linux-perf: Build with CORESIGHT=1 (thanks to Wookey) (Closes: #924673)

  [ Steve McIntyre ]
  * [arm64] Include the Hisilicon Hibmc drm driver in fb-modules
    Closes: #944546)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 13 Feb 2020 06:14:49 +0100

linux (5.4.13-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.9
    - nvme_fc: add module to ops template to allow module references
    - nvme-fc: fix double-free scenarios on hw queues
    - drm/amdgpu: add check before enabling/disabling broadcast mode
    - drm/amdgpu: add header line for power profile on Arcturus
    - drm/amdgpu: add cache flush workaround to gfx8 emit_fence
    - nvme/pci: Fix write and poll queue types
    - nvme/pci: Fix read queue count
    - [armhf] iio: st_accel: Fix unused variable warning
    - PM / devfreq: Fix devfreq_notifier_call returning errno
    - PM / devfreq: Set scaling_max_freq to max on OPP notifier error
    - PM / devfreq: Don't fail devfreq_dev_release if not in list
    - afs: Fix afs_find_server lookups for ipv4 peers
    - afs: Fix SELinux setting security label on /afs
    - RDMA/cma: add missed unregister_pernet_subsys in init failure
    - rxe: correctly calculate iCRC for unaligned payloads
    - scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func
    - scsi: qla2xxx: Use explicit LOGO in target mode
    - scsi: qla2xxx: Drop superfluous INIT_WORK of del_work
    - scsi: qla2xxx: Don't call qlt_async_event twice
    - scsi: qla2xxx: Fix PLOGI payload and ELS IOCB dump length
    - scsi: qla2xxx: Configure local loop for N2N target
    - scsi: qla2xxx: Send Notify ACK after N2N PLOGI
    - scsi: qla2xxx: Don't defer relogin unconditonally
    - scsi: qla2xxx: Ignore PORT UPDATE after N2N PLOGI
    - scsi: iscsi: qla4xxx: fix double free in probe
    - scsi: libsas: stop discovering if oob mode is disconnected
      (CVE-2019-19965)
    - scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func
    - [x86] staging/wlan-ng: add CRC32 dependency in Kconfig
    - drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit
    - drm/nouveau: Fix drm-core using atomic code-paths on pre-nv50 hardware
    - drm/nouveau/kms/nv50-: fix panel scaling
    - usb: gadget: fix wrong endpoint desc
    - net: make socket read/write_iter() honor IOCB_NOWAIT
    - afs: Fix mountpoint parsing
    - afs: Fix creation calls in the dynamic root to fail with EOPNOTSUPP
    - raid5: need to set STRIPE_HANDLE for batch head
    - md: raid1: check rdev before reference in raid1_sync_request func
    - [s390x] cpum_sf: Adjust sampling interval to avoid hitting sample limits
    - [s390x] cpum_sf: Avoid SBD overflow condition in irq handler
    - RDMA/counter: Prevent auto-binding a QP which are not tracked with res
    - IB/mlx4: Follow mirror sequence of device add during device removal
    - IB/mlx5: Fix steering rule of drop and count
    - xen-blkback: prevent premature module unload
    - xen/balloon: fix ballooned page accounting without hotplug enabled
    - PM / hibernate: memory_bm_find_bit(): Tighten node optimisation
    - ALSA: hda/realtek - Add Bass Speaker and fixed dac for bass speaker
    - ALSA: hda/realtek - Enable the bass speaker of ASUS UX431FLC
    - PCI: Add a helper to check Power Resource Requirements _PR3 existence
    - ALSA: hda: Allow HDA to be runtime suspended when dGPU is not bound to a
      driver
    - PCI: Fix missing inline for pci_pr3_present()
    - ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen
    - tcp: fix data-race in tcp_recvmsg()
    - shmem: pin the file in shmem_fault() if mmap_sem is dropped
    - taskstats: fix data-race
    - ALSA: hda - Downgrade error message for single-cmd fallback
    - netfilter: nft_tproxy: Fix port selector on Big Endian
    - block: add bio_truncate to fix guard_bio_eod
    - mm: drop mmap_sem before calling balance_dirty_pages() in write fault
    - ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code
    - ALSA: usb-audio: fix set_format altsetting sanity check
    - ALSA: usb-audio: set the interface format after resume on Dell WD19
    - ALSA: hda - Apply sync-write workaround to old Intel platforms, too
    - ALSA: hda/realtek - Add headset Mic no shutup for ALC283
    - [arm64,armhf] drm/sun4i: hdmi: Remove duplicate cleanup calls
    - [mips*] BPF: Disable MIPS32 eBPF JIT
    - [mips*] BPF: eBPF JIT: check for MIPS ISA compliance in Kconfig
    - [mips*] Avoid VDSO ABI breakage due to global register variable
    - media: pulse8-cec: fix lost cec_transmit_attempt_done() call
    - media: cec: CEC 2.0-only bcast messages were ignored
    - media: cec: avoid decrementing transmit_queue_sz if it is 0
    - media: cec: check 'transmit_in_progress', not 'transmitting'
    - mm/memory_hotplug: shrink zones when offlining memory
    - mm/zsmalloc.c: fix the migrated zspage statistics.
    - memcg: account security cred as well to kmemcg
    - mm: move_pages: return valid node id in status if the page is already on
      the target node
    - mm/oom: fix pgtables units mismatch in Killed process message
    - ocfs2: fix the crash due to call ocfs2_get_dlm_debug once less
    - [x86,arm64] pstore/ram: Write new dumps to start of recycled zones
    - [x86,arm64] pstore/ram: Fix error-path memory leak in
      persistent_ram_new() callers
    - locks: print unsigned ino in /proc/locks
    - seccomp: Check that seccomp_notif is zeroed out by the user
    - Btrfs: fix infinite loop during nocow writeback due to race
    - compat_ioctl: block: handle Persistent Reservations
    - compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE
    - compat_ioctl: block: handle BLKGETZONESZ/BLKGETNRZONES
    - bpf: Fix precision tracking for unbounded scalars
    - ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys()
    - libata: Fix retrieving of active qcs
    - gpiolib: fix up emulated open drain outputs
    - [riscv64] clocksource: riscv: add notrace to riscv_sched_clock
    - [riscv64] ftrace: correct the condition logic in function graph tracer
    - tracing: Fix lock inversion in trace_event_enable_tgid_record()
    - tracing: Avoid memory leak in process_system_preds()
    - tracing: Have the histogram compare functions convert to u64 first
    - tracing: Fix endianness bug in histogram trigger
    - io_uring: use current task creds instead of allocating a new one
    - mm/gup: fix memory leak in __gup_benchmark_ioctl
    - apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock
    - dmaengine: virt-dma: Fix access after free in vchan_complete()
    - [i386] ALSA: cs4236: fix error return comparison of an unsigned integer
    - ALSA: pcm: Yet another missing check of non-cached buffer type
    - ALSA: firewire-motu: Correct a typo in the clock proc string
    - scsi: lpfc: Fix rpi release when deleting vport
    - exit: panic before exit_mm() on global init exit
    - [arm64] Revert support for execute-only user mappings
    - ftrace: Avoid potential division by zero in function profiler
    - [arm64] drm/msm: include linux/sched/task.h
    - PM / devfreq: Check NULL governor in available_governors_show
    - sunrpc: fix crash when cache_head become valid before update
    - nfsd4: fix up replay_matches_cache()
    - [powerpc*] Chunk calls to flush_dcache_range in arch_*_memory
    - [x86,arm64] HID: i2c-hid: Reset ALPS touchpads on resume
    - net/sched: annotate lockless accesses to qdisc->empty
    - kernel/module.c: wakeup processes in module_wq on module unload
    - ACPI: sysfs: Change ACPI_MASKABLE_GPE_MAX to 0x100
    - perf callchain: Fix segfault in thread__resolve_callchain_sample()
    - [amd64] iommu/vt-d: Remove incorrect PSI capability check
    - cifs: Fix potential softlockups while refreshing DFS cache
    - xfs: don't check for AG deadlock for realtime files in bunmapi
    - [x86] platform/x86: pmc_atom: Add Siemens CONNECT X300 to
      critclk_systems DMI table
    - netfilter: nf_queue: enqueue skbs with NULL dst
    - [arm64,armhf] regulator: axp20x: Fix axp20x_set_ramp_delay
    - [arm64,armhf] regulator: axp20x: Fix AXP22x ELDO2 regulator enable
      bitmask
    - [powerpc*] mm: Mark get_slice_psize() & slice_addr_is_low() as notrace
    - Bluetooth: btusb: fix PM leak in error case of setup
    - Bluetooth: delete a stray unlock
    - Bluetooth: Fix memory leak in hci_connect_le_scan
    - [arm64] dts: meson-gxl-s905x-khadas-vim: fix uart_A bluetooth node
    - [arm64] dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node
    - media: flexcop-usb: ensure -EIO is returned on error condition
    - media: usb: fix memory leak in af9005_identify_state (CVE-2019-18809)
    - [arm64] dts: meson: odroid-c2: Disable usb_otg bus to avoid power failed
      warning
    - [arm64] tty: serial: msm_serial: Fix lockup for sysrq and oops
    - cifs: Fix lookup of root ses in DFS referral cache
    - fs: cifs: Fix atime update check vs mtime
    - fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP
    - ath9k_htc: Modify byte order for an error message
    - ath9k_htc: Discard undersized packets
    - [x86] drm/i915/execlists: Fix annotation for decoupling virtual request
    - xfs: periodically yield scrub threads to the scheduler
    - net: add annotations on hh->hh_len lockless accesses
    - ubifs: ubifs_tnc_start_commit: Fix OOB in layout_in_gaps
    - btrfs: get rid of unique workqueue helper functions
    - Btrfs: only associate the locked page with one async_chunk struct
    - [s390x] smp: fix physical to logical CPU map for SMT
    - mm/sparse.c: mark populate_section_memmap as __meminit
    - xen/blkback: Avoid unmapping unmapped grant pages
    - lib/ubsan: don't serialize UBSAN report
    - [x86] perf/x86/intel/bts: Fix the use of page_private()
    - net: annotate lockless accesses to sk->sk_pacing_shift
    - mm/hugetlb: defer freeing of huge pages if in non-task context
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.10
    - [powerpc*] pmem: Fix kernel crash due to wrong range value usage in
      flush_dcache_range
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.11
    - bpf: Fix passing modified ctx to ld/abs/ind instruction
    - [x86] ASoC: rt5682: fix i2c arbitration lost issue
    - spi: pxa2xx: Add support for Intel Jasper Lake
    - regulator: fix use after free issue
    - ASoC: max98090: fix possible race conditions
    - gpio: Handle counting of Freescale chipselects
    - netfilter: ctnetlink: netns exit must wait for callbacks
    - [x86] intel: Disable HPET on Intel Ice Lake platforms
    - netfilter: nf_tables_offload: Check for the NETDEV_UNREGISTER event
    - mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
      (CVE-2019-14901)
    - regulator: core: fix regulator_register() error paths to properly
      release rdev
    - [x86] efi: Update e820 with reserved EFI boot services data to fix kexec
      breakage
    - [x86] ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89
    - efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs
    - efi/gop: Return EFI_SUCCESS if a usable GOP was found
    - efi/gop: Fix memory leak in __gop_query32/64()
    - [x86,arm64] efi/earlycon: Remap entire framebuffer after page
      initialization
    - netfilter: uapi: Avoid undefined left-shift in xt_sctp.h
    - netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in
      named sets
    - netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END
    - netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()
    - netfilter: nf_tables: skip module reference count bump on object updates
    - netfilter: nf_tables_offload: return EOPNOTSUPP if rule specifies no
      actions
    - [arm64] spi: spi-cavium-thunderx: Add missing pci_release_regions()
    - [arm*] reset: Do not register resource data for missing resets
    - [x86] ASoC: topology: Check return value for snd_soc_add_dai_link()
    - [x86] ASoC: topology: Check return value for soc_tplg_pcm_create()
    - [x86] ASoC: SOF: loader: snd_sof_fw_parse_ext_data log warning on
      unknown header
    - [x86] ASoC: SOF: Intel: split cht and byt debug window sizes
    - [armhf] dts: am335x-sancloud-bbe: fix phy mode
    - [riscv64] bpf, riscv: Limit to 33 tail calls
    - [mips64el,mipsel] bpf, mips: Limit to 33 tail calls
    - perf header: Fix false warning when there are no duplicate cache entries
    - [armhf] spi: spi-ti-qspi: Fix a bug when accessing non default CS
    - [armhf] bus: ti-sysc: Fix missing reset delay handling
    - clk: walk orphan list on clock provider registration
    - mac80211: fix TID field in monitor mode transmit
    - cfg80211: fix double-free after changing network namespace
    - pinctrl: pinmux: fix a possible null pointer in
      pinmux_can_be_used_for_gpio
    - [powerpc*] Ensure that swiotlb buffer is allocated from low memory
    - btrfs: Fix error messages in qgroup_rescan_init
    - Btrfs: fix cloning range with a hole when using the NO_HOLES feature
    - [powerpc*] vcpu: Assume dedicated processors as non-preempt
    - [powerpc*] spinlocks: Include correct header for static key
    - btrfs: handle error in btrfs_cache_block_group
    - Btrfs: fix hole extent items with a zero size after range cloning
    - [powerpc*] ocxl: Fix potential memory leak on context creation
    - bpf: Clear skb->tstamp in bpf_redirect when necessary
    - bnx2x: Do not handle requests from VFs after parity
    - bnx2x: Fix logic to get total no. of PFs per engine
    - cxgb4: Fix kernel panic while accessing sge_info
    - net: usb: lan78xx: Fix error message format specifier
    - [hppa/parisc] add missing __init annotation
    - rfkill: Fix incorrect check to avoid NULL pointer dereference
    - staging: axis-fifo: add unspecified HAS_IOMEM dependency
    - [arm*] iommu/iova: Init the struct iova to fix the possible memleak
    - [x86] perf/x86: Fix potential out-of-bounds access
    - [x86] perf/x86/intel: Fix PT PMI handling
    - sched/psi: Fix sampling error and rare div0 crashes with cgroups and
      high uptime
    - psi: Fix a division error in psi poll()
    - [x86] usb: typec: fusb302: Fix an undefined reference to
      'extcon_get_state'
    - block: end bio with BLK_STS_AGAIN in case of non-mq devs and REQ_NOWAIT
    - fs: avoid softlockups in s_inodes iterators
    - fs: call fsnotify_sb_delete after evict_inodes
    - [arm64] iommu/dma: Relax locking in iommu_dma_prepare_msi()
    - io_uring: don't wait when under-submitting
    - clk: Move clk_core_reparent_orphans() under CONFIG_OF
    - [arm64,armhf] net: stmmac: Determine earlier the size of RX buffer
    - [arm64,armhf] net: stmmac: Do not accept invalid MTU values
    - [arm64,armhf] net: stmmac: xgmac: Clear previous RX buffer size
    - [arm64,armhf] net: stmmac: RX buffer size must be 16 byte aligned
    - [arm64,armhf] net: stmmac: Always arm TX Timer at end of transmission
      start
    - xsk: Add rcu_read_lock around the XSK wakeup
    - net/mlx5e: Fix concurrency issues between config flow and XSK
    - net/i40e: Fix concurrency issues between config flow and XSK
    - net/ixgbe: Fix concurrency issues between config flow and XSK
    - [arm64] cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list
    - block: Fix a lockdep complaint triggered by request queue flushing
    - [s390x] dasd/cio: Interpret ccw_device_get_mdc return value correctly
    - [s390x] dasd: fix memleak in path handling error case
    - block: fix memleak when __blk_rq_map_user_iov() is failed
    - sbitmap: only queue kyber's wait callback if not already active
    - [s390x] qeth: handle error due to unsupported transport mode
    - [s390x] qeth: fix promiscuous mode after reset
    - [s390x] qeth: don't return -ENOTSUPP to userspace
    - llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and
      _test_c)
    - [x86] hv_netvsc: Fix unwanted rx_table reset
    - gtp: fix bad unlock balance in gtp_encap_enable_socket
    - macvlan: do not assume mac_header is set in macvlan_broadcast()
    - [arm64,armhf] net: dsa: mv88e6xxx: Preserve priority when setting CPU
      port.
    - [armhf] net: freescale: fec: Fix ethtool -d runtime PM
    - [arm64,armhf] net: stmmac: dwmac-sun8i: Allow all RGMII modes
    - [arm64,armhf] net: stmmac: dwmac-sunxi: Allow all RGMII modes
    - [arm64,armhf] net: stmmac: Fixed link does not need MDIO Bus
    - net: usb: lan78xx: fix possible skb leak
    - pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
    - sch_cake: avoid possible divide by zero in cake_enqueue()
    - sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY
    - tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK
    - vxlan: fix tos value before xmit
    - net: sch_prio: When ungrafting, replace with FIFO
    - vlan: fix memory leak in vlan_dev_set_egress_priority
    - vlan: vlan_changelink() should propagate errors
    - [arm64,riscv64] macb: Don't unregister clks unconditionally
    - net/mlx5: Move devlink registration before interfaces load
    - [arm64,armhf] net: dsa: mv88e6xxx: force cmode write on 6141/6341
    - net/mlx5e: Always print health reporter message to dmesg
    - net/mlx5: DR, No need for atomic refcount for internal SW steering
      resources
    - net/mlx5e: Fix hairpin RSS table size
    - net/mlx5: DR, Init lists that are used in rule's member
    - [arm64,armhf] usb: dwc3: gadget: Fix request complete check
    - USB: core: fix check for duplicate endpoints
    - USB: serial: option: add Telit ME910G1 0x110a composition
    - usb: missing parentheses in USE_NEW_SCHEME
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.12
    - chardev: Avoid potential use-after-free in 'chrdev_open()'
    - i2c: fix bus recovery stop mode timing
    - [x86] powercap: intel_rapl: add NULL pointer check to
      rapl_mmio_cpu_online()
    - [arm64,armhf] usb: chipidea: host: Disable port power only if previously
      enabled
    - ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5
    - ALSA: hda/realtek - Add new codec supported for ALCS1200A
    - ALSA: hda/realtek - Set EAPD control to default for ALC222
    - ALSA: hda/realtek - Add quirk for the bass speaker on Lenovo Yoga X1 7th
      gen
    - tpm: Revert "tpm_tis: reserve chip for duration of tpm_tis_core_init"
    - tpm: Revert "tpm_tis_core: Set TPM_CHIP_FLAG_IRQ before probing for
      interrupts"
    - tpm: Revert "tpm_tis_core: Turn on the TPM before probing IRQ's"
    - tpm: Handle negative priv->response_len in tpm_common_read()
    - [arm64,armhf] rtc: sun6i: Add support for RTC clocks on R40
    - kernel/trace: Fix do not unregister tracepoints when register
      sched_migrate_task fail
    - tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined
    - tracing: Change offset type to s32 in preempt/irq tracepoints
    - HID: Fix slab-out-of-bounds read in hid_field_extract
    - HID: uhid: Fix returning EPOLLOUT from uhid_char_poll
    - HID: hidraw: Fix returning EPOLLOUT from hidraw_poll
    - HID: hid-input: clear unmapped usages
    - Input: add safety guards to input_set_keycode()
    - [x86] drm/i915: Add Wa_1408615072 and Wa_1407596294 to icl,ehl
    - [arm64,armhf] drm/sun4i: tcon: Set RGB DCLK min. divider based on
      hardware model
    - drm/fb-helper: Round up bits_per_pixel if possible
    - drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ
    - [x86] drm/i915: Add Wa_1407352427:icl,ehl
    - [x86] drm/i915/gt: Mark up virtual engine uabi_instance
    - [amd64] IB/hfi1: Adjust flow PSN with the correct resync_psn
    - can: kvaser_usb: fix interface sanity check
    - can: gs_usb: gs_usb_probe(): use descriptors of current altsetting
    - gpiolib: acpi: Turn dmi_system_id table into a generic quirk table
    - gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism
    - pstore/ram: Regularize prz label allocation lifetime
    - [x86] staging: vt6656: set usb_set_intfdata on driver fail.
    - [x86] staging: vt6656: Fix non zero logical return of, usb_control_msg
    - USB: serial: option: add ZLP support for 0x1bc7/0x9010
    - [arm64,armhf] usb: musb: fix idling for suspend after disconnect
      interrupt
    - [arm64,armhf] usb: musb: Disable pullup at init
    - [arm64,armhf] usb: musb: dma: Correct parameter passed to IRQ handler
    - [x86] staging: comedi: adv_pci1710: fix AI channels 16-31 for PCI-1713
    - [x86] staging: vt6656: correct return of vnt_init_registers.
    - [x86] staging: vt6656: limit reg output to block size
    - staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21
    - serdev: Don't claim unsupported ACPI serial devices
    - [amd64] iommu/vt-d: Fix adding non-PCI devices to Intel IOMMU
    - tty: link tty and port before configuring it as console
    - tty: always relink the port
    - [arm64] Move __ARCH_WANT_SYS_CLONE3 definition to uapi headers
    - [arm64] Implement copy_thread_tls
    - [arm*] Implement copy_thread_tls
    - [hppa/parisc] Implement copy_thread_tls
    - [riscv64] Implement copy_thread_tls
    - clone3: ensure copy_thread_tls is implemented
    - um: Implement copy_thread_tls
    - [x86] staging: vt6656: remove bool from vnt_radio_power_on ret
    - mwifiex: fix possible heap overflow in mwifiex_process_country_ie()
      (CVE-2019-14895)
    - mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf
      (CVE-2019-19056)
    - rpmsg: char: release allocated memory (CVE-2019-19053)
    - scsi: bfa: release allocated memory in case of error (CVE-2019-19066)
    - rtl8xxxu: prevent leaking urb (CVE-2019-19068)
    - ath10k: fix memory leak (CVE-2019-19078)
    - HID: hiddev: fix mess in hiddev_open()
    - USB: Fix: Don't skip endpoint descriptors with maxpacket=0
    - netfilter: arp_tables: init netns pointer in xt_tgchk_param struct
    - netfilter: conntrack: dccp, sctp: handle null timeout argument
    - netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
    - [x86] drm/i915/gen9: Clear residual context state on context switch
      (CVE-2019-14615)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.13
    - HID: hidraw, uhid: Always report EPOLLOUT
    - [amd64] IB/hfi1: Don't cancel unused work item
    - [armhf] mtd: rawnand: stm32_fmc2: avoid to lock the CPU bus
    - [arm*] 2c: bcm2835: Store pointer to bus clock
    - ASoC: soc-core: Set dpcm_playback / dpcm_capture
    - [armhf] ASoC: stm32: spdifrx: fix inconsistent lock state
    - [armhf] ASoC: stm32: spdifrx: fix race condition in irq handler
    - [armhf] ASoC: stm32: spdifrx: fix input pin state management
    - netfilter: nft_flow_offload: fix underflow in flowtable reference
      counter
    - [armhf] mtd: onenand: omap2: Pass correct flags for prep_dma_memcpy
    - [arm64] gpio: zynq: Fix for bug in zynq_gpio_restore_context API
    - [arm64,armhf] pinctrl: meson: Fix wrong shift value when get
      drive-strength
    - [amd64] iommu/vt-d: Unlink device if failed to add to group
    - iommu: Remove device link to group on failure
    - bpf: cgroup: prevent out-of-order release of cgroup bpf
    - fs: move guard_bio_eod() after bio_set_op_attrs
    - scsi: mpt3sas: Fix double free in attach error handling
    - gpio: Fix error message on out-of-range GPIO in lookup table
    - [arm64,armhf] PM / devfreq: tegra: Add COMMON_CLK dependency
    - [arm64,armhf] drm/tegra: Fix ordering of cleanup code
    - [s390x] qeth: fix qdio teardown after early init error
    - [s390x] qeth: fix false reporting of VNIC CHAR config failure
    - [s390x] qeth: Fix vnicc_is_in_use if rx_bcast not set
    - [s390x] qeth: vnicc Fix init to default
    - [s390x] qeth: fix initialization on old HW
    - scsi: smartpqi: Update attribute name to `driver_version`
    - afs: Fix missing cell comparison in afs_test_super()
    - [x86] syscalls/x86: Wire up COMPAT_SYSCALL_DEFINE0
    - [x86] syscalls/x86: Use COMPAT_SYSCALL_DEFINE0 for IA32 (rt_)sigreturn
    - [x86] syscalls/x86: Use the correct function type for sys_ni_syscall
    - [x86] syscalls/x86: Fix function types in COND_SYSCALL
    - btrfs: simplify inode locking for RWF_NOWAIT
    - netfilter: nf_tables_offload: release flow_rule on error from commit
      path
    - netfilter: nft_meta: use 64-bit time arithmetic
    - [arm64] RDMA/hns: Prevent undefined behavior in
      hns_roce_set_user_sq_size()
    - [arm64] RDMA/hns: remove a redundant le16_to_cpu
    - [arm64] RDMA/hns: Modify return value of restrack functions
    - RDMA/counter: Prevent QP counter manual binding in auto mode
    - [arm64] RDMA/hns: Release qp resources when failed to destroy qp
    - xprtrdma: Add unique trace points for posting Local Invalidate WRs
    - xprtrdma: Connection becomes unstable after a reconnect
    - xprtrdma: Fix MR list handling
    - xprtrdma: Close window between waking RPC senders and posting Receives
    - [arm64] RDMA/hns: Fix to support 64K page for srq
    - [arm64] RDMA/hns: Bugfix for qpc/cqc timer configuration
    - RDMA/mlx5: Return proper error value
    - RDMA/srpt: Report the SCSI residual to the initiator
    - uaccess: Add non-pagefault user-space write function
    - bpf: Make use of probe_user_write in probe write helper
    - bpf: skmsg, fix potential psock NULL pointer dereference
    - libbpf: Fix Makefile' libbpf symbol mismatch diagnostic
    - afs: Fix use-after-loss-of-ref
    - afs: Fix afs_lookup() to not clobber the version on a new dentry
    - keys: Fix request_key() cache
    - scsi: enclosure: Fix stale device oops with hot replug
    - scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI
    - [x86] platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0
    - [x86] platform/x86: GPD pocket fan: Use default values when wrong
      modparams are given
    - Documentation/ABI: Fix documentation inconsistency for mlxreg-io sysfs
      interfaces
    - Documentation/ABI: Add missed attribute for mlxreg-io sysfs interfaces
    - xprtrdma: Fix create_qp crash on device unload
    - xprtrdma: Fix completion wait during device removal
    - xprtrdma: Fix oops in Receive handler after device removal
    - dm: add dm-clone to the documentation index
    - scsi: ufs: Give an unique ID to each ufs-bsg
    - [arm64] crypto: cavium/nitrox - fix firmware assignment to AE cores
    - crypto: virtio - implement missing support for output IVs
    - crypto: algif_skcipher - Use chunksize instead of blocksize
    - [i386] crypto: geode-aes - convert to skcipher API and make thread-safe
    - NFSv2: Fix a typo in encode_sattr()
    - nfsd: Fix cld_net->cn_tfm initialization
    - nfsd: v4 support requires CRYPTO_SHA256
    - NFSv4.x: Handle bad/dead sessions correctly in nfs41_sequence_process()
    - NFSv4.x: Drop the slot if nfs4_delegreturn_prepare waits for
      layoutreturn
    - mei: fix modalias documentation
    - [armhf] clk: samsung: exynos5420: Preserve CPU clocks configuration
      during suspend/resume
    - clk: Fix memory leak in clk_unregister()
    - [arm64,armhf] dmaengine: dw: platform: Mark 'hclk' clock optional
    - [armhf] clk: imx: pll14xx: Fix quick switch of S/K parameter
    - rsi: fix potential null dereference in rsi_probe()
    - affs: fix a memory leak in affs_remount
    - [armhf] pinctl: ti: iodelay: fix error checking on
      pinctrl_count_index_with_args call
    - [x86] pinctrl: lewisburg: Update pin list according to v1.1v6
    - PCI: pciehp: Do not disable interrupt twice on suspend
    - Revert "drm/virtio: switch virtio_gpu_wait_ioctl() to gem helper."
    - drm/amdgpu: cleanup creating BOs at fixed location
    - drm/amdgpu/discovery: reserve discovery data at the top of VRAM
    - scsi: sd: enable compat ioctls for sed-opal
    - gfs2: add compat_ioctl support
    - af_unix: add compat_ioctl support
    - compat_ioctl: handle SIOCOUTQNSD
    - [arm64] PCI: aardvark: Use LTSSM state to build link training flag
    - [arm64] PCI: aardvark: Fix PCI_EXP_RTCTL register configuration
    - [arm64,armhf] PCI: dwc: Fix find_next_bit() usage
    - PCI: Fix missing bridge dma_ranges resource list cleanup
    - PCI/PM: Clear PCIe PME Status even for legacy power management
    - PCI/PTM: Remove spurious "d" from granularity message
    - [powerpc*] powernv: Disable native PCIe port management
    - [mips64el,mipsel] Loongson: Fix return value of loongson_hwmon_init
    - [armhf] tty: serial: imx: use the sg count from dma_map_sg
    - [i386] tty: serial: pch_uart: correct usage of dma_unmap_sg
    - ARM: 8943/1: Fix topology setup in case of CPU hotplug for
      CONFIG_SCHED_MC
    - Revert "ubifs: Fix memory leak bug in alloc_ubifs_info() error path"
    - ubifs: Fixed missed le64_to_cpu() in journal
    - ubifs: do_kill_orphans: Fix a memory leak bug
    - mtd: spi-nor: fix silent truncation in spi_nor_read()
    - mtd: spi-nor: fix silent truncation in spi_nor_read_raw()
    - [arm64,armhf] spi: pxa2xx: Set controller->max_transfer_size in dma mode
    - iwlwifi: mvm: consider ieee80211 station max amsdu value
    - rtlwifi: Remove unnecessary NULL check in rtl_regd_init
    - iwlwifi: mvm: fix support for single antenna diversity
    - sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO
    - f2fs: fix potential overflow
    - NFSD fixing possible null pointer derefering in copy offload
    - scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy()
    - scsi: target/iblock: Fix protection error with blocks greater than 512B
    - [riscv64] export flush_icache_all to modules
    - [mips64el,mipsel] cacheinfo: report shared CPU map
    - [mips64el,mipsel] Fix gettimeofday() in the vdso library
    - tomoyo: Suppress RCU warning at list_for_each_entry_rcu().
    - [arm64] drm/arm/mali: make malidp_mw_connector_helper_funcs static
    - rxrpc: Unlock new call in rxrpc_new_incoming_call() rather than the
      caller
    - rxrpc: Don't take call->user_mutex in rxrpc_new_incoming_call()
    - rxrpc: Fix missing security check on incoming calls
    - [arm64] dmaengine: k3dma: Avoid null pointer traversal
    - [s390x] qeth: lock the card while changing its hsuid
    - [amd64] ioat: ioat_alloc_ring() failure handling.
    - drm/amdgpu: enable gfxoff for raven1 refresh
    - ocfs2: call journal flush to mark journal as empty after journal
      recovery when mount

  [ Salvatore Bonaccorso ]
  * signing_templates/rules.real: Include modules.builtin.modinfo file in
    image (Closes: #948427)
  * [rt] Drop "lib/ubsan: Don't seralize UBSAN report"
  * nvme: Ignore ABI changes
  * Drop "ARM: dts: bcm283x: Fix critical trip point"
  * Drop "tracing: Do not create directories if lockdown is in affect"
  * Drop "libtraceevent: Fix lib installation with O="
  * Drop "libtraceevent: Copy pkg-config file to output folder when using O="
  * Refresh "libbpf: fix readelf output parsing on powerpc with recent
    binutils"
  * Refresh "x86: Make x32 syscall support conditional on a kernel parameter"
  * Bump ABI to 3.

  [ Ben Hutchings ]
  * f2fs: Fix crypto softdep: it uses crc32, not crc32c

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 19 Jan 2020 10:22:58 +0100

linux (5.4.8-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.7
    - af_packet: set defaule value for tmo
    - [amd64] fjes: fix missed check in fjes_acpi_add
    - mod_devicetable: fix PHY module format
    - net: dst: Force 4-byte alignment of dst_metrics
    - [arm64] net: hisilicon: Fix a BUG trigered by wrong bytes_compl
    - net: phy: ensure that phy IDs are correctly typed
    - net: qlogic: Fix error paths in ql_alloc_large_buffers()
    - net-sysfs: Call dev_hold always in rx_queue_add_kobject
    - net: usb: lan78xx: Fix suspend/resume PHY register access error
    - [arm64,armhf] nfp: flower: fix stats id allocation
    - qede: Disable hardware gro when xdp prog is installed
    - qede: Fix multicast mac configuration
    - sctp: fix memleak on err handling of stream initialization
    - sctp: fully initialize v4 addr in some functions
    - neighbour: remove neigh_cleanup() method
    - bonding: fix bond_neigh_init()
    - net: ena: fix default tx interrupt moderation interval
    - net: ena: fix issues in setting interrupt moderation params in ethtool
    - [armhf] net: ethernet: ti: davinci_cpdma: fix warning "device driver
      frees DMA memory with different size"
    - [arm64,armhf] net: stmmac: platform: Fix MDIO init for platforms without
      PHY
    - [armhf] net: dsa: b53: Fix egress flooding settings
    - btrfs: don't double lock the subvol_sem for rename exchange
    - btrfs: do not call synchronize_srcu() in inode_tree_del
    - Btrfs: make tree checker detect checksum items with overlapping ranges
    - btrfs: return error pointer from alloc_test_extent_buffer
    - Btrfs: fix missing data checksums after replaying a log tree
    - btrfs: send: remove WARN_ON for readonly mount
    - btrfs: abort transaction after failed inode updates in create_subvol
    - btrfs: skip log replay on orphaned roots
    - btrfs: do not leak reloc root if we fail to read the fs root
    - btrfs: handle ENOENT in btrfs_uuid_tree_iterate
    - Btrfs: fix removal logic of the tree mod log that leads to
      use-after-free issues
    - ALSA: pcm: Avoid possible info leaks from PCM stream buffers
    - ALSA: hda/ca0132 - Keep power on during processing DSP response
    - ALSA: hda/ca0132 - Avoid endless loop
    - ALSA: hda/ca0132 - Fix work handling in delayed HP detection
    - [arm*] drm/vc4/vc4_hdmi: fill in connector info
    - drm/virtio: switch virtio_gpu_wait_ioctl() to gem helper.
    - drm: mst: Fix query_payload ack reply struct
    - [arm64,armhf] drm/panel: Add missing drm_panel_init() in panel drivers
    - [armhf] drm: exynos: exynos_hdmi: use cec_notifier_conn_(un)register
    - drm: Use EOPNOTSUPP, not ENOTSUPP
    - drm/amdgpu/sriov: add ring_stop before ring_create in psp v11 code
    - drm/amdgpu: grab the id mgr lock while accessing passid_mapping
    - drm/ttm: return -EBUSY on pipelining with no_gpu_wait (v2)
    - ath10k: add cleanup in ath10k_sta_state()
    - ath10k: Check if station exists before forwarding tx airtime report
    - spi: Add call to spi_slave_abort() function when spidev driver is
      released
    - [arm64] drm/meson: vclk: use the correct G12A frac max value
    - [x86] staging: rtl8192u: fix multiple memory leaks on error path
    - staging: rtl8188eu: fix possible null dereference
    - rtlwifi: prevent memory leak in rtl_usb_probe (CVE-2019-19063)
    - libertas: fix a potential NULL pointer dereference
    - ath10k: fix backtrace on coredump
    - IB/iser: bound protection_sg size by data_sg size
    - [armhf] spi: gpio: prevent memory leak in spi_gpio_probe
    - media: max2175: Fix build error without CONFIG_REGMAP_I2C
    - [arm64] media: venus: core: Fix msm8996 frequency table
    - ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq
    - pinctrl: devicetree: Avoid taking direct reference to device name string
    - [armhf] drm/sun4i: dsi: Fix TCON DRQ set bits
    - [arm64] media: venus: Fix occasionally failures to suspend
    - rtw88: fix NSS of hw_cap
    - [armhf] hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if
      not idled
    - media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
    - [arm64,armhf] drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the
      internal I2C controller
    - mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
      (CVE-2019-19057)
    - drm/drm_vblank: Change EINVAL by the correct errno
    - libbpf: Fix struct end padding in btf_dump
    - libbpf: Fix passing uninitialized bytes to setsockopt
    - net/smc: increase device refcount for added link group
    - team: call RCU read lock when walking the port_list
    - media: cx88: Fix some error handling path in 'cx8800_initdev()'
    - [arm64] crypto: inside-secure - Fix a maybe-uninitialized warning
    - [arm64] crypto: aegis128/simd - build 32-bit ARM for v8 architecture
      explicitly
    - [x86] ASoC: SOF: enable sync_write in hdac_bus
    - [armhf] media: ti-vpe: vpe: Fix Motion Vector vpdma stride
    - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid
      pixel format
    - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance failure about frame
      sequence number
    - [armhf] media: ti-vpe: vpe: Make sure YUYV is set as default format
    - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance failure causing a
      kernel panic
    - [armhf] media: ti-vpe: vpe: ensure buffers are cleaned up properly in
      abort cases
    - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid
      sizeimage
    - [x86] syscalls/x86: Use the correct function type in SYSCALL_DEFINE0
    - [x86] mm: Use the correct function type for native_set_fixmap()
    - ath10k: Correct error handling of dma_map_single()
    - rtw88: coex: Set 4 slot mode for A2DP
    - [arm64,armhf] drm/bridge: dw-hdmi: Restore audio when setting a mode
    - perf vendor events arm64: Fix Hisi hip08 DDRC PMU eventname
    - usb: usbfs: Suppress problematic bind and unbind uevents.
    - Bluetooth: btusb: avoid unused function warning
    - Bluetooth: missed cpu_to_le16 conversion in hci_init4_req
    - Bluetooth: Workaround directed advertising bug in Broadcom controllers
    - Bluetooth: hci_core: fix init for HCI_USER_CHANNEL
    - bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack()
    - [x86] mce: Lower throttling MCE messages' priority to warning
    - [arm64] net: hns3: log and clear hardware error after reset complete
    - [arm64] RDMA/hns: Fix wrong parameters when initial mtt of srq->idx_que
    - [x86] drm/gma500: fix memory disclosures due to uninitialized bytes
    - ASoC: soc-pcm: fixup dpcm_prune_paths() loop continue
    - rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot
    - ipmi: Don't allow device module unload when in use
    - [x86] ioapic: Prevent inconsistent state when moving an interrupt
    - media: cedrus: Fix undefined shift with a SHIFT_AND_MASK_BITS macro
    - drm/nouveau: Don't grab runtime PM refs for HPD IRQs
    - md: no longer compare spare disk superblock events in super_load
    - md/bitmap: avoid race window between md_bitmap_resize and
      bitmap_file_clear_bit
    - drm: Don't free jobs in wait_event_interruptible()
    - EDAC/amd64: Set grain per DIMM
    - [arm64] psci: Reduce the waiting time for cpu_psci_cpu_kill()
    - i40e: initialize ITRN registers with correct values
    - i40e: Wrong 'Advertised FEC modes' after set FEC to AUTO
    - net: phy: dp83867: enable robust auto-mdix
    - [arm64,armhf] drm/tegra: sor: Use correct SOR index on Tegra210
    - regulator: core: Release coupled_rdevs on regulator_init_coupling()
      error
    - ubsan, x86: Annotate and allow __ubsan_handle_shift_out_of_bounds() in
      uaccess regions
    - ACPI: button: Add DMI quirk for Medion Akoya E2215T
    - RDMA/qedr: Fix memory leak in user qp and mr
    - [arm64] RDMA/hns: Fix memory leak on 'context' on error return path
    - RDMA/qedr: Fix srqs xarray initialization
    - RDMA/core: Set DMA parameters correctly
    - [arm64,armhf] gpu: host1x: Allocate gather copy for host1x
    - [arm64,armhf] net: dsa: LAN9303: select REGMAP when LAN9303 enable
    - [arm64] phy: qcom-usb-hs: Fix extcon double register after power cycle
    - [s390x] time: ensure get_clock_monotonic() returns monotonic values
    - [s390x] add error handling to perf_callchain_kernel
    - [s390x] mm: add mm_pxd_folded() checks to pxd_free()
    - [arm64] net: hns3: add struct netdev_queue debug info for TX timeout
    - libata: Ensure ata_port probe has completed before detach
    - loop: fix no-unmap write-zeroes request behavior
    - [arm64,armhf] net/mlx5e: Verify that rule has at least one fwd/drop
      action
    - ALSA: bebob: expand sleep just after breaking connections for protocol
      version 1
    - libbpf: Fix error handling in bpf_map__reuse_fd()
    - Bluetooth: Fix advertising duplicated flags
    - ALSA: pcm: Fix missing check of the new non-cached buffer type
    - [riscv64] spi: sifive: disable clk when probe fails and remove
    - pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler()
    - ixgbe: protect TX timestamping from API misuse
    - media: rcar_drif: fix a memory disclosure (CVE-2019-18786)
    - media: v4l2-core: fix touch support in v4l_g_fmt
    - nvme: introduce "Command Aborted By host" status code
    - nvmem: core: fix nvmem_cell_write inline function
    - ASoC: SOF: topology: set trigger order for FE DAI link
    - media: vivid: media_device_cleanup was called too early
    - bnx2x: Fix PF-VF communication over multi-cos queues.
    - ALSA: timer: Limit max amount of slave instances
    - RDMA/core: Fix return code when modify_port isn't supported
    - [arm64] drm: msm: a6xx: fix debug bus register configuration
    - rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
    - perf probe: Fix to find range-only function instance
    - perf cs-etm: Fix definition of macro TO_CS_QUEUE_NR
    - perf probe: Fix to list probe event with correct line number
    - perf jevents: Fix resource leak in process_mapfile() and main()
    - perf probe: Walk function lines in lexical blocks
    - perf probe: Fix to probe an inline function which has no entry pc
    - perf probe: Fix to show ranges of variables in functions without
      entry_pc
    - perf probe: Fix to show inlined function callsite without entry_pc
    - perf probe: Fix to probe a function which has no entry pc
    - perf tools: Fix cross compile for ARM64
    - perf tools: Splice events onto evlist even on error
    - ice: Check for null pointer dereference when setting rings
    - perf parse: If pmu configuration fails free terms
    - perf probe: Skip overlapped location on searching variables
    - net: avoid potential false sharing in neighbor related code
    - perf probe: Return a better scope DIE if there is no best scope
    - perf probe: Fix to show calling lines of inlined functions
    - perf probe: Skip end-of-sequence and non statement lines
    - perf probe: Filter out instances except for inlined subroutine and
      subprogram
    - libbpf: Fix negative FD close() in xsk_setup_xdp_prog()
    - [s390x] bpf: Use kvcalloc for addrs array
    - cgroup: freezer: don't change task and cgroups status unnecessarily
    - ath10k: fix get invalid tx rate for Mesh metric
    - media: pvrusb2: Fix oops on tear-down when radio support is not present
    - ice: delay less
    - media: cedrus: Use helpers to access capture queue
    - [arm64,armhf] spi: pxa2xx: Add missed security checks
    - ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile
    - iio: dac: ad5446: Add support for new AD5600 DAC
    - [x86] ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format
      constraint
    - r8169: respect EEE user setting when restarting network
    - [s390x] disassembler: don't hide instruction addresses
    - [armhf] net: ethernet: ti: Add dependency for TI_DAVINCI_EMAC
    - nvme: Discard workaround for non-conformant devices
    - parport: load lowlevel driver if ports not found
    - bcache: fix static checker warning in bcache_device_free()
    - cpufreq: Register drivers only after CPU devices have been registered
    - [x86] crash: Add a forward declaration of struct kimage
    - tracing: use kvcalloc for tgid_map array allocation
    - tracing/kprobe: Check whether the non-suffixed symbol is notrace
    - bcache: fix deadlock in bcache_allocator
    - iwlwifi: mvm: fix unaligned read of rx_pkt_status
    - regulator: core: Let boot-on regulators be powered off
    - [arm64] spi: tegra20-slink: add missed clk_unprepare
    - tun: fix data-race in gro_normal_list()
    - xhci-pci: Allow host runtime PM as default also for Intel Ice Lake xHCI
    - crypto: virtio - deal with unsupported input sizes
    - btrfs: don't prematurely free work in end_workqueue_fn()
    - btrfs: don't prematurely free work in run_ordered_work()
    - sched/uclamp: Fix overzealous type replacement
    - perf/core: Fix the mlock accounting, again
    - bnxt_en: Return proper error code for non-existent NVM variable
    - net: phy: avoid matching all-ones clause 45 PHY IDs
    - [x86] ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012
      2-in-1
    - [x86] insn: Add some Intel instructions to the opcode map
    - brcmfmac: remove monitor interface when detaching
    - perf session: Fix decompression of PERF_RECORD_COMPRESSED records
    - perf probe: Fix to show function entry line as probe-able
    - [s390x] crypto: Fix unsigned variable compared with zero
    - [s390x] kasan: support memcpy_real with TRACE_IRQFLAGS
    - bnxt_en: Improve RX buffer error handling.
    - iwlwifi: check kasprintf() return value
    - ASoC: soc-pcm: check symmetry before hw_params
    - [armhf] net: ethernet: ti: ale: clean ale tbl on init and intf restart
    - [s390x] cpumf: Adjust registration of s390 PMU device drivers
    - [armhf] crypto: sun4i-ss - Fix 64-bit size_t warnings
    - [armhf] crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c
    - mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED
    - libtraceevent: Fix memory leakage in copy_filter_type
    - ice: Only disable VF state when freeing each VF resources
    - ice: Fix setting coalesce to handle DCB configuration
    - net: phy: initialise phydev speed and duplex sanely
    - tools, bpf: Fix build for 'make -s tools/bpf O=<dir>'
    - bpf: Provide better register bounds after jmp32 instructions
    - net: wireless: intel: iwlwifi: fix GRO_NORMAL packet stalling
    - btrfs: don't prematurely free work in reada_start_machine_worker()
    - btrfs: don't prematurely free work in scrub_missing_raid56_worker()
    - Revert "mmc: sdhci: Fix incorrect switch to HS mode"
    - tpm_tis: reserve chip for duration of tpm_tis_core_init
    - tpm: fix invalid locking in NONBLOCKING mode
    - iommu: fix KASAN use-after-free in iommu_insert_resv_region
    - iommu: set group default domain before creating direct mappings
    - iommu/vt-d: Fix dmar pte read access not set error
    - iommu/vt-d: Set ISA bridge reserved region as relaxable
    - iommu/vt-d: Allocate reserved region for ISA with correct permission
    - [armhf] can: flexcan: fix possible deadlock and out-of-order reception
      after wakeup
    - [armhf] can: flexcan: poll MCR_LPM_ACK instead of GPR ACK for stop mode
      acknowledgment
    - can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices
      (CVE-2019-19947)
    - usb: xhci: Fix build warning seen with CONFIG_PM=n
    - ath10k: Revert "ath10k: add cleanup in ath10k_sta_state()"
    - md: avoid invalid memory access for array sb->dev_roles
    - [s390x] ftrace: fix endless recursion in function_graph tracer
    - [armhf] can: flexcan: add low power enter/exit acknowledgment helper
    - usbip: Fix receive error in vhci-hcd when using scatter-gather
    - usbip: Fix error path of vhci_recv_ret_submit()
    - cpufreq: Avoid leaving stale IRQ work items during CPU offline
    - mm: vmscan: protect shrinker idr replace with CONFIG_MEMCG
    - [x86] intel_th: pci: Add Comet Lake PCH-V support
    - [x86] intel_th: pci: Add Elkhart Lake SOC support
    - [x86] intel_th: Fix freeing IRQs
    - [x86] intel_th: msu: Fix window switching without windows
    - [x86] platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128
      bytes
    - [x86] staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value
    - [x86] pinctrl: baytrail: Really serialize all register accesses
    - ext4: fix ext4_empty_dir() for directories with holes (CVE-2019-19037)
    - ext4: check for directory entries too close to block end
    - ext4: unlock on error in ext4_expand_extra_isize()
    - ext4: validate the debug_want_extra_isize mount option at parse time
    - [powerpc*] KVM: PPC: Book3S HV: Fix regression on big endian hosts
    - [x86] kvm: x86: Host feature SSBD doesn't imply guest feature
      SPEC_CTRL_SSBD
    - [x86] kvm: x86: Host feature SSBD doesn't imply guest feature AMD_SSBD
    - [arm64,armhf] KVM: arm/arm64: Properly handle faulting of device
      mappings
    - [arm64] KVM: arm64: Ensure 'params' is initialised when looking up sys
      register
    - [x86] intel: Disable HPET on Intel Coffee Lake H platforms
    - [x86] MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure()
    - [x86] MCE/AMD: Allow Reserved types to be overwritten in smca_banks[]
    - [x86] mce: Fix possibly incorrect severity calculation on AMD
    - [powerpc*] irq: fix stack overflow verification
    - [powerpc*] ocxl: Fix concurrent AFU open and device removal
    - [arm64] mmc: sdhci-msm: Correct the offset and value for DDR_CONFIG
      register
    - mmc: sdhci: Update the tuning failed messages to pr_debug level
    - mmc: sdhci: Workaround broken command queuing on Intel GLK
    - mmc: sdhci: Add a quirk for broken command queuing
    - nbd: fix shutdown and recv work deadlock v2
    - iwlwifi: pcie: move power gating workaround earlier in the flow
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.8
    - Revert "MIPS: futex: Restore \n after sync instructions"
    - Revert "MIPS: futex: Emit Loongson3 sync workarounds within asm"
    - scsi: lpfc: Fix spinlock_irq issues in lpfc_els_flush_cmd()
    - scsi: lpfc: Fix discovery failures when target device connectivity
      bounces
    - scsi: mpt3sas: Fix clear pending bit in ioctl status
    - scsi: lpfc: Fix locking on mailbox command completion
    - scsi: mpt3sas: Reject NVMe Encap cmnds to unsupported HBA
    - [armhf] gpio: mxc: Only get the second IRQ when there is more than one
      IRQ
    - scsi: lpfc: Fix list corruption in lpfc_sli_get_iocbq
    - Input: atmel_mxt_ts - disable IRQ across suspend
    - f2fs: fix to update time in lazytime mode
    - [x86] platform/x86: peaq-wmi: switch to using polled mode of input
      devices
    - [arm64,armhf] iommu: rockchip: Free domain on .domain_free
    - [arm64,armhf] iommu/tegra-smmu: Fix page tables in > 4 GiB memory
    - scsi: target: compare full CHAP_A Algorithm strings
    - scsi: lpfc: Fix hardlockup in lpfc_abort_handler
    - scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
    - scsi: csiostor: Don't enable IRQs too early
    - [arm64] scsi: hisi_sas: Replace in_softirq() check in
      hisi_sas_task_exec()
    - [arm64] scsi: hisi_sas: Delete the debugfs folder of hisi_sas when the
      probe fails
    - [powerpc*] pseries: Mark accumulate_stolen_time() as notrace
    - [powerpc*] pseries: Don't fail hash page table insert for bolted mapping
    - dma-mapping: Add vmap checks to dma_map_single()
    - dma-mapping: fix handling of dma-ranges for reserved memory (again)
    - clocksource/drivers/timer-of: Use unique device name instead of timer
    - [powerpc*] security/book3s64: Report L1TF status in sysfs
    - [powerpc*] book3s64/hash: Add cond_resched to avoid soft lockup warning
    - ext4: update direct I/O read lock pattern for IOCB_NOWAIT
    - ext4: iomap that extends beyond EOF should be marked dirty
    - jbd2: Fix statistics for the number of logged blocks
    - scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and
      WRITE(6)
    - scsi: lpfc: Fix unexpected error messages during RSCN handling
    - scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
    - f2fs: fix to update dir's i_pino during cross_rename
    - [arm64] clk: qcom: smd: Add missing pnoc clock
    - [arm64] clk: qcom: Allow constant ratio freq tables for rcg
    - clk: clk-gpio: propagate rate change to parent
    - dma-direct: check for overflows on 32 bit DMA addresses
    - fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned
      long
    - [arm64] iommu/arm-smmu-v3: Don't display an error when IRQ lines are
      missing
    - [armhf] i2c: stm32f7: fix & reorder remove & probe error handling
    - iomap: fix return value of iomap_dio_bio_actor on 32bit systems
    - scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer
      dereferences
    - [m68k] scsi: zorro_esp: Limit DMA transfers to 65536 bytes (except on
      Fastlane)
    - [powerpc*] PCI: rpaphp: Fix up pointer to first drc-info entry
    - scsi: ufs: fix potential bug which ends in system hang
    - [powerpc*] PCI: rpaphp: Don't rely on firmware feature to imply drc-info
      support
    - [powerpc*] PCI: rpaphp: Annotate and correctly byte swap DRC properties
    - [powerpc*] PCI: rpaphp: Correctly match ibm, my-drc-index to drc-name
      when using drc-info
    - [powerpc*] security: Fix wrong message when RFI Flush is disable
    - [powerpc*] eeh: differentiate duplicate detection message
    - [powerpc*] book3s/mm: Update Oops message to print the correct
      translation in use
    - bcache: at least try to shrink 1 node in bch_mca_scan()
    - HID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse
    - HID: logitech-hidpp: Silence intermittent get_battery_capacity errors
    - HID: i2c-hid: fix no irq after reset on raydium 3118
    - [armhf] 8937/1: spectre-v2: remove Brahma-B53 from hardening
    - libnvdimm/btt: fix variable 'rc' set but not used
    - HID: Improve Windows Precision Touchpad detection.
    - HID: rmi: Check that the RMI_STARTED bit is set before unregistering the
      RMI transport device
    - watchdog: prevent deferral of watchdogd wakeup on RT
    - watchdog: Fix the race between the release of watchdog_core_data and
      cdev
    - scsi: pm80xx: Fix for SATA device discovery
    - scsi: ufs: Fix error handing during hibern8 enter
    - scsi: scsi_debug: num_tgts must be >= 0
    - scsi: target: core: Release SPC-2 reservations when closing a session
    - scsi: ufs: Fix up auto hibern8 enablement
    - scsi: iscsi: Don't send data to unbound connection
    - scsi: target: iscsi: Wait for all commands to finish before freeing a
      session
    - f2fs: Fix deadlock in f2fs_gc() context during atomic files handling
    - [x86] Drivers: hv: vmbus: Fix crash handler reset of Hyper-V synic
    - apparmor: fix unsigned len comparison with less than zero
    - drm/amdgpu: Call find_vma under mmap_sem
    - cifs: Fix use-after-free bug in cifs_reconnect()
    - io_uring: io_allocate_scq_urings() should return a sane state
    - cdrom: respect device capabilities during opening action
    - cifs: move cifsFileInfo_put logic into a work-queue
    - perf diff: Use llabs() with 64-bit values
    - perf script: Fix brstackinsn for AUXTRACE
    - perf regs: Make perf_reg_name() return "unknown" instead of NULL
    - [s390x] zcrypt: handle new reply code FILTERED_BY_HYPERVISOR
    - [s390x] unwind: filter out unreliable bogus %r14
    - [s390x] cpum_sf: Check for SDBT and SDB consistency
    - ocfs2: fix passing zero to 'PTR_ERR' warning
    - [s390x] disable preemption when switching to nodat stack with
      CALL_ON_STACK
    - mm/hugetlbfs: fix error handling when setting up mounts
    - kernel: sysctl: make drop_caches write-only
    - userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
    - sctp: fix err handling of stream initialization
    - md: make sure desc_nr less than MD_SB_DISKS
    - Revert "iwlwifi: assign directly to iwl_trans->cfg in QuZ detection"
    - netfilter: ebtables: compat: reject all padding in matches/watchers
    - 6pack,mkiss: fix possible deadlock
    - [powerpc*] Fix __clear_user() with KUAP enabled
    - net/smc: add fallback check to connect()
    - netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
    - inetpeer: fix data-race in inet_putpeer / inet_putpeer
    - net: add a READ_ONCE() in skb_peek_tail()
    - net: icmp: fix data-race in cmp_global_allow()
    - hrtimer: Annotate lockless access to timer->state
    - tomoyo: Don't use nifty names on sockets.
    - uaccess: disallow > INT_MAX copy sizes
    - drm: limit to INT_MAX in create_blob ioctl
    - xfs: fix mount failure crash on invalid iclog memory access
    - cxgb4/cxgb4vf: fix flow control display for auto negotiation
    - [armhf] net: dsa: bcm_sf2: Fix IP fragment location and behavior
    - net/mlxfw: Fix out-of-memory error in mfa2 flash burning
    - net: phy: aquantia: add suspend / resume ops for AQR105
    - net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit
      device
    - net/sched: add delete_empty() to filters and use it in cls_flower
    - net_sched: sch_fq: properly set sk->sk_pacing_status
    - [arm64,armhf] net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on
      Meson8b/8m2 SoCs
    - ptp: fix the race between the release of ptp_clock and cdev
    - tcp: Fix highest_sack and highest_sack_seq
    - udp: fix integer overflow while computing available space in sk_rcvbuf
    - bnxt_en: Fix MSIX request logic for RDMA driver.
    - bnxt_en: Free context memory in the open path if firmware has been
      reset.
    - bnxt_en: Return error if FW returns more data than dump length
    - bnxt_en: Fix bp->fw_health allocation and free logic.
    - bnxt_en: Remove unnecessary NULL checks for fw_health
    - bnxt_en: Fix the logic that creates the health reporters.
    - bnxt_en: Add missing devlink health reporters for VFs.
    - net: add bool confirm_neigh parameter for dst_ops.update_pmtu
    - ip6_gre: do not confirm neighbor when do pmtu update
    - gtp: do not confirm neighbor when do pmtu update
    - net/dst: add new function skb_dst_update_pmtu_no_confirm
    - tunnel: do not confirm neighbor when do pmtu update
    - vti: do not confirm neighbor when do pmtu update
    - sit: do not confirm neighbor when do pmtu update
    - net/dst: do not confirm neighbor for vxlan and geneve pmtu update
    - [arm64,armhf] net: marvell: mvpp2: phylink requires the link interrupt
    - gtp: fix wrong condition in gtp_genl_dump_pdp()
    - gtp: avoid zero size hashtable
    - bonding: fix active-backup transition after link failure
    - tcp: do not send empty skb from tcp_write_xmit()
    - tcp/dccp: fix possible race __inet_lookup_established()
    - [x86] hv_netvsc: Fix tx_table init in rndis_set_subchannel()
    - gtp: fix an use-after-free in ipv4_pdp_find()
    - gtp: do not allow adding duplicate tid and ms_addr pdp context
    - bnxt: apply computed clamp value for coalece parameter
    - ipv6/addrconf: only check invalid header values when
      NETLINK_F_STRICT_CHK is set
    - [arm64,armhf] net: phylink: fix interface passed to mac_link_up
    - net: ena: fix napi handler misbehavior when the napi budget is zero
    - vhost/vsock: accept only packets with the right dst_cid
    - mm/hugetlbfs: fix for_each_hstate() loop in init_hugetlbfs_fs()

  [ Salvatore Bonaccorso ]
  * debian/lib/python/debian_linux/abi.py: Add one missing string replacement.
  * debian/lib/python/debian_linux/abi.py: strip whitespace characters in
    line.
  * [rt] Refresh lib-ubsan-Don-t-seralize-UBSAN-report.patch for context
    changes in 5.4.7
  * [rt] Drop x86-ioapic-Prevent-inconsistent-state-when-moving-an.patch
  * Enable EROFS filesystem support as module.
    Enable EROFS_FS as module, enable EROFS_FS_XATTR, EROFS_FS_POSIX_ACL,
    EROFS_FS_SECURITY, EROFS_FS_ZIP and EROFS_FS_CLUSTER_PAGE_LIMIT.
    Thanks to Gao Xiang <gaoxiang25@huawei.com> (Closes: #946569)
  * Enable additional netfilter modules.
    Enable NFT_BRIDGE_META, NF_CONNTRACK_BRIDGE, IP6_NF_MATCH_SRH, NFT_XFRM
    and NFT_SYNPROXY as modules.
    Thanks to Arturo Borrero Gonzalez (Closes: #948031)
  * [rt] Drop watchdog-prevent-deferral-of-watchdogd-wakeup-on-RT.patch
  * [rt] Refresh Use-CONFIG_PREEMPTION.patch (Context changes in 5.4.8)
  * Bump ABI to 2

  [ YunQiang Su ]
  * [mips*/octeon] Fix ftbfs on mips* due to octeon image-file:
        move "image-file: linux" to octeon_build from octeon_image.

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 05 Jan 2020 15:40:37 +0100

linux (5.4.6-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.3
    - rsi: release skb if rsi_prepare_beacon fails (CVE-2019-19071)
    - lp: fix sparc64 LPSETTIMEOUT ioctl
    - time: Zero the upper 32-bits in __kernel_timespec on 32-bit
    - usb: gadget: u_serial: add missing port entry locking
    - [arm64] tty: serial: msm_serial: Fix flow control
    - [arm64,armel,armhf] serial: pl011: Fix DMA ->flush_buffer()
    - serial: serial_core: Perform NULL checks for break_ctl ops
    - [armhf] serial: stm32: fix clearing interrupt error flags
    - serial: 8250_dw: Avoid double error messaging when IRQ absent
    - mwifiex: Re-work support for SDIO HW reset
    - io_uring: fix dead-hung for non-iter fixed rw
    - io_uring: transform send/recvmsg() -ERESTARTSYS to -EINTR
    - fuse: fix leak of fuse_io_priv
    - fuse: verify nlink
    - fuse: verify write return
    - fuse: verify attributes
    - io_uring: fix missing kmap() declaration on powerpc
    - io_uring: ensure req->submit is copied when req is deferred
    - SUNRPC: Avoid RPC delays when exiting suspend
    - ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC
    - ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop
    - ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236
    - ALSA: hda/realtek - Fix inverted bass GPIO pin on Acer 8951G
    - ALSA: pcm: oss: Avoid potential buffer overflows
    - ALSA: hda - Add mute led support for HP ProBook 645 G4
    - ALSA: hda: Modify stream stripe mask only when needed
    - Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus
    - Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash
    - [x86] Input: synaptics-rmi4 - don't increment rmiaddr for SMBus
      transfers
    - Input: goodix - add upside-down quirk for Teclast X89 tablet
    - media: rc: mark input device as pointing stick
    - [i386] x86/mm/32: Sync only to VMALLOC_END in vmalloc_sync_all()
    - [x86] PCI: Avoid AMD FCH XHCI USB PME# from D0 defect
    - CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks
    - CIFS: Fix SMB2 oplock break processing
    - tty: vt: keyboard: reject invalid keycodes
    - can: slcan: Fix use-after-free Read in slcan_open
    - nfsd: Ensure CLONE persists data and metadata changes to the target file
    - nfsd: restore NFSv3 ACL support
    - kernfs: fix ino wrap-around detection
    - jbd2: Fix possible overflow in jbd2_log_space_left()
    - [arm64] drm/msm: fix memleak on release
    - drm: damage_helper: Fix race checking plane->state->fb
    - [i386] drm/i810: Prevent underflow in ioctl
    - [arm64] Validate tagged addresses in access_ok() called from kernel
      threads
    - [powerpc*] KVM: PPC: Book3S HV: XIVE: Free previous EQ page when setting
      up a new one
    - [powerpc*] KVM: PPC: Book3S HV: XIVE: Fix potential page leak on error
      path
    - [powerpc*] KVM: PPC: Book3S HV: XIVE: Set kvm->arch.xive when VPs are
      allocated
    - [x86] KVM: nVMX: Always write vmcs02.GUEST_CR3 during nested VM-Enter
    - [arm64,armhf] KVM: vgic: Don't rely on the wrong pending table
    - [x86] KVM: do not modify masked bits of shared MSRs
    - [x86] KVM: fix presentation of TSX feature in ARCH_CAPABILITIES
    - [x86] KVM: Remove a spurious export of a static function
    - [x86] KVM: Grab KVM's srcu lock when setting nested state
    - crypto: af_alg - cast ki_complete ternary op to int
    - [i386] crypto: geode-aes - switch to skcipher for cbc(aes) fallback
    - [x86] crypto: ccp - fix uninitialized list head
    - crypto: ecdh - fix big endian bug in ECC library
    - crypto: user - fix memory leak in crypto_report (CVE-2019-19062)
    - [armhf] spi: stm32-qspi: Fix kernel oops when unbinding driver
    - spi: Fix SPI_CS_HIGH setting when using native and GPIO CS
    - spi: Fix NULL pointer when setting SPI_CS_HIGH for GPIO CS
    - can: ucan: fix non-atomic allocation in completion handler
    - [amd64] RDMA/qib: Validate ->show()/store() callbacks before calling
      them
    - rfkill: allocate static minor
    - bdev: Factor out bdev revalidation into a common helper
    - bdev: Refresh bdev size for disks without partitioning
    - iomap: Fix pipe page leakage during splicing
    - thermal: Fix deadlock in thermal thermal_zone_device_check
    - vcs: prevent write access to vcsu devices
    - Revert "serial/8250: Add support for NI-Serial PXI/PXIe+485 devices"
    - binder: Fix race between mmap() and binder_alloc_print_pages()
    - binder: Prevent repeated use of ->mmap() via NULL mapping
    - binder: Handle start==NULL in binder_update_page_range()
    - [x86] KVM: fix out-of-bounds write in KVM_GET_EMULATED_CPUID
      (CVE-2019-19332)
    - ALSA: hda - Fix pending unsol events at shutdown
    - md/raid0: Fix an error message in raid0_make_request()
    - drm/mcde: Fix an error handling path in 'mcde_probe()'
    - perf script: Fix invalid LBR/binary mismatch error
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.4
    - usb: gadget: configfs: Fix missing spin_lock_init()
    - [x86] usb: gadget: pch_udc: fix use after free
    - nvme: Namepace identification descriptor list is optional
    - Revert "nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T"
    - scsi: lpfc: Fix bad ndlp ptr in xri aborted handling
    - [s390x] scsi: zfcp: trace channel log even for FCP command responses
    - scsi: qla2xxx: Do command completion on abort timeout
    - scsi: qla2xxx: Fix driver unload hang
    - scsi: qla2xxx: Fix double scsi_done for abort path
    - scsi: qla2xxx: Fix memory leak when sending I/O fails
    - compat_ioctl: add compat_ptr_ioctl()
    - ceph: fix compat_ioctl for ceph_dir_operations
    - [arm64] media: venus: remove invalid compat_ioctl32 handler
    - USB: uas: honor flag to avoid CAPACITY16
    - USB: uas: heed CAPACITY_HEURISTICS
    - USB: documentation: flags on usb-storage versus UAS
    - usb: Allow USB device to be warm reset in suspended state
    - [arm64,armhf] usb: host: xhci-tegra: Correct phy enable sequence
    - binder: fix incorrect calculation for num_valid
    - staging: rtl8188eu: fix interface sanity check
    - staging: rtl8712: fix interface sanity check
    - [arm*] staging: vchiq: call unregister_chrdev_region() when driver
      registration fails
    - staging: gigaset: fix general protection fault on probe
    - staging: gigaset: fix illegal free on probe errors
    - staging: gigaset: add endpoint-type sanity check
    - usb: xhci: only set D3hot for pci device
    - xhci: Fix memory leak in xhci_add_in_port()
    - xhci: fix USB3 device initiated resume race with roothub autosuspend
    - xhci: Increase STS_HALT timeout in xhci_suspend()
    - xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default
      behaviour.
    - xhci: make sure interrupts are restored to correct state
    - [x86] iio: imu: inv_mpu6050: fix temperature reporting using bad unit
    - USB: atm: ueagle-atm: add missing endpoint check
    - USB: idmouse: fix interface sanity checks
    - USB: serial: io_edgeport: fix epic endpoint lookup
    - usb: roles: fix a potential use after free
    - USB: adutux: fix interface sanity check
    - usb: core: urb: fix URB structure initialization function
    - usb: mon: Fix a deadlock in usbmon between mmap and read
    - [arm64,amd64,i386] tpm: add check after commands attribs tab allocation
    - [arm64,amd64,i386] tpm: Switch to platform_get_irq_optional()
    - brcmfmac: disable PCIe interrupts before bus reset
    - mtd: rawnand: Change calculating of position page containing BBM
    - virtio-balloon: fix managed page counts when migrating pages between
      zones
    - usb: dwc3: pci: add ID for the Intel Comet Lake -H variant
    - [arm64,armhf] usb: dwc3: gadget: Fix logical condition
    - [arm64,armhf] usb: dwc3: gadget: Clear started flag for non-IOC
    - [arm64,armhf] usb: dwc3: ep0: Clear started flag on completion
    - [x86] usb: typec: fix use after free in typec_register_port()
    - iwlwifi: pcie: fix support for transmitting SKBs with fraglist
    - btrfs: check page->mapping when loading free space cache
    - btrfs: use btrfs_block_group_cache_done in update_block_group
    - btrfs: use refcount_inc_not_zero in kill_all_nodes
    - Btrfs: fix metadata space leak on fixup worker failure to set range as
      delalloc
    - Btrfs: fix negative subv_writers counter and data space leak after
      buffered write
    - btrfs: Avoid getting stuck during cyclic writebacks
    - btrfs: Remove btrfs_bio::flags member
    - Btrfs: send, skip backreference walking for extents with many references
    - btrfs: record all roots for rename exchange on a subvol
    - rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address
    - rtlwifi: rtl8192de: Fix missing callback that tests for hw release of
      buffer
    - rtlwifi: rtl8192de: Fix missing enable interrupt flag
    - ovl: fix lookup failure on multi lower squashfs
    - ovl: fix corner case of non-unique st_dev;st_ino
    - ovl: relax WARN_ON() on rename to self
    - [arm*] hwrng: omap - Fix RNG wait loop timeout
    - dm writecache: handle REQ_FUA
    - dm zoned: reduce overhead of backing device checks
    - workqueue: Fix spurious sanity check failures in destroy_workqueue()
    - workqueue: Fix pwq ref leak in rescuer_thread()
    - ASoC: rt5645: Fixed buddy jack support.
    - ASoC: rt5645: Fixed typo for buddy jack support.
    - ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report
    - md: improve handling of bio with REQ_PREFLUSH in md_flush_request()
    - blk-mq: avoid sysfs buffer overflow with too many CPU cores
    - cgroup: pids: use atomic64_t for pids->limit
    - wil6210: check len before memcpy() calls
    - ar5523: check NULL before memcpy() in ar5523_cmd()
    - [s390x] mm: properly clear _PAGE_NOEXEC bit when it is not supported
    - cpuidle: Do not unset the driver if it is there already
    - cpuidle: use first valid target residency as poll time
    - [arm64,armhf] drm/panfrost: Open/close the perfcnt BO
    - [powerpc*] perf: Disable trace_imc pmu
    - [x86] intel_th: Fix a double put_device() in error path
    - [x86] intel_th: pci: Add Ice Lake CPU support
    - [x86] intel_th: pci: Add Tiger Lake CPU support
    - PM / devfreq: Lock devfreq in trans_stat_show
    - [powerpc*] cpufreq: powernv: fix stack bloat and hard limit on number of
      CPUs
    - ALSA: fireface: fix return value in error path of isochronous resources
      reservation
    - ALSA: oxfw: fix return value in error path of isochronous resources
      reservation
    - ALSA: hda/realtek - Line-out jack doesn't work on a Dell AIO
    - ACPI / utils: Move acpi_dev_get_first_match_dev() under CONFIG_ACPI
    - ACPI: LPSS: Add LNXVIDEO -> BYT I2C7 to lpss_device_links
    - ACPI: LPSS: Add LNXVIDEO -> BYT I2C1 to lpss_device_links
    - ACPI: LPSS: Add dmi quirk for skipping _DEP check for some device-links
    - ACPI / hotplug / PCI: Allocate resources directly under the non-hotplug
      bridge
    - ACPI: OSL: only free map once in osl.c
    - ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data()
    - ACPI: EC: Rework flushing of pending work
    - ACPI: PM: Avoid attaching ACPI PM domain to certain devices
    - [arm64] pinctrl: armada-37xx: Fix irq mask access in
      armada_37xx_irq_set_type()
    - [armhf] pinctrl: samsung: Add of_node_put() before return in error path
    - [armhf] pinctrl: samsung: Fix device node refcount leaks in Exynos
      wakeup controller init
    - [armhf] pinctrl: samsung: Fix device node refcount leaks in init code
    - [armhf] mmc: host: omap_hsmmc: add code for special init of wl1251 to
      get rid of pandora_wl1251_init_card
    - RDMA/core: Fix ib_dma_max_seg_size()
    - ppdev: fix PPGETTIME/PPSETTIME ioctls
    - [powerpc*] Allow 64bit VDSO __kernel_sync_dicache to work across ranges
      >4GB
    - [powerpc*] xive: Prevent page fault issues in the machine crash handler
    - [powerpc*] Allow flush_icache_range to work across ranges >4GB
    - [powerpc*] xive: Skip ioremap() of ESB pages for LSI interrupts
    - video/hdmi: Fix AVI bar unpack
    - quota: Check that quota is not dirty before release
    - ext2: check err when partial != NULL
    - seccomp: avoid overflow in implicit constant conversion
    - quota: fix livelock in dquot_writeback_dquots
    - ext4: Fix credit estimate for final inode freeing
    - reiserfs: fix extended attributes on the root directory
    - scsi: qla2xxx: Fix SRB leak on switch command timeout
    - scsi: qla2xxx: Fix a dma_pool_free() call
    - Revert "scsi: qla2xxx: Fix memory leak when sending I/O fails"
    - [armhf] omap: pdata-quirks: revert pandora specific gpiod additions
    - [armhf] omap: pdata-quirks: remove openpandora quirks for mmc3 and
      wl1251
    - [powerpc*] Avoid clang warnings around setjmp and longjmp
    - [powerpc*] Fix vDSO clock_getres()
    - mm, memfd: fix COW issue on MAP_PRIVATE and F_SEAL_FUTURE_WRITE mappings
    - mm: memcg/slab: wait for !root kmem_cache refcnt killing on root
      kmem_cache destruction
    - ext4: work around deleting a file with i_nlink == 0 safely
    - [arm64] firmware: qcom: scm: Ensure 'a0' status code is treated as
      signed
    - [s390x] smp,vdso: fix ASCE handling
    - [s390x] kaslr: store KASLR offset for early dumps
    - mm/shmem.c: cast the type of unmap_start to u64
    - [powerpc*] Define arch_is_kernel_initmem_freed() for lockdep
    - rtc: disable uie before setting time and enable after
    - splice: only read in as much information as there is pipe buffer space
    - ext4: fix a bug in ext4_wait_for_tail_page_commit
    - ext4: fix leak of quota reservations
    - blk-mq: make sure that line break can be printed
    - workqueue: Fix missing kfree(rescuer) in destroy_workqueue()
    - r8169: fix rtl_hw_jumbo_disable for RTL8168evl
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.5
    - inet: protect against too small mtu values.
    - mqprio: Fix out-of-bounds access in mqprio_dump
    - net: bridge: deny dev_set_mac_address() when unregistering
    - net: dsa: fix flow dissection on Tx path
    - [armhf] net: ethernet: ti: cpsw: fix extra rx interrupt
    - net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues
    - net_sched: validate TCA_KIND attribute in tc_chain_tmplt_add()
    - [arm64] net: thunderx: start phy before starting autonegotiation
    - openvswitch: support asymmetric conntrack
    - tcp: md5: fix potential overestimation of TCP option space
    - tipc: fix ordering of tipc module init and exit routine
    - net/mlx5e: Query global pause state before setting prio2buffer
    - net: ipv6: add net argument to ip6_dst_lookup_flow
    - net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
    - tcp: fix rejected syncookies due to stale timestamps
    - tcp: tighten acceptance of ACKs not matching a child socket
    - tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE()
    - net: core: rename indirect block ingress cb function
    - net: sched: allow indirect blocks to bind to clsact in TC
    - cls_flower: Fix the behavior using port ranges with hw-offload
    - gre: refetch erspan header from skb->data after pskb_may_pull()
    - Fixed updating of ethertype in function skb_mpls_pop
    - net: Fixed updating of ethertype in skb_mpls_push()
    - net/mlx5e: Fix TXQ indices to be sequential
    - net/mlx5e: Fix SFF 8472 eeprom length
    - net/mlx5e: Fix freeing flow with kfree() and not kvfree()
    - net/mlx5e: Fix translation of link mode into speed
    - net/mlx5e: ethtool, Fix analysis of speed setting
    - page_pool: do not release pool until inflight == 0.
    - xdp: obtain the mem_id mutex before trying to remove an entry.
    - r8169: add missing RX enabling for WoL on RTL8125
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.6
    - USB: Fix incorrect DMA allocations for local memory pool drivers
    - mmc: block: Make card_busy_detect() a bit more generic
    - mmc: block: Add CMD13 polling for MMC IOCTLS with R1B response
    - mmc: core: Drop check for mmc_card_is_removable() in mmc_rescan()
    - mmc: core: Re-work HW reset for SDIO cards
    - PCI/PM: Always return devices to D0 when thawing
    - PCI: pciehp: Avoid returning prematurely from sysfs requests
    - PCI: Fix Intel ACS quirk UPDCR register address
    - PCI/MSI: Fix incorrect MSI-X masking on resume
    - PCI: Do not use bus number zero from EA capability
    - PCI: Apply Cavium ACS quirk to ThunderX2 and ThunderX3
    - PM / QoS: Redefine FREQ_QOS_MAX_DEFAULT_VALUE to S32_MAX
    - block: fix "check bi_size overflow before merge"
    - gfs2: Multi-block allocations in gfs2_page_mkwrite
    - gfs2: fix glock reference problem in gfs2_trans_remove_revoke
    - [arm64] rpmsg: glink: Fix reuse intents memory leak issue
    - [arm64] rpmsg: glink: Fix use after free in open_ack TIMEOUT case
    - [arm64] rpmsg: glink: Put an extra reference during cleanup
    - [arm64] rpmsg: glink: Fix rpmsg_register_device err handling
    - [arm64] rpmsg: glink: Don't send pending rx_done during remove
    - [arm64] rpmsg: glink: Free pending deferred work on remove
    - cifs: smbd: Return -EAGAIN when transport is reconnecting
    - cifs: smbd: Only queue work for error recovery on memory registration
    - cifs: smbd: Add messages on RDMA session destroy and reconnection
    - cifs: smbd: Return -EINVAL when the number of iovs exceeds
      SMBDIRECT_MAX_SGE
    - cifs: smbd: Return -ECONNABORTED when trasnport is not in connected
      state
    - cifs: Don't display RDMA transport on reconnect
    - CIFS: Respect O_SYNC and O_DIRECT flags during reconnect
    - CIFS: Close open handle after interrupted close
    - CIFS: Do not miss cancelled OPEN responses
    - CIFS: Fix NULL pointer dereference in mid callback
    - cifs: Fix retrieval of DFS referrals in cifs_mount()
    - [armhf] ARM: tegra: Fix FLOW_CTLR_HALT register clobbering by
      tegra_resume()
    - vfio/pci: call irq_bypass_unregister_producer() before freeing irq
    - dma-buf: Fix memory leak in sync_file_merge()
    - [arm64,armhf] drm/panfrost: Fix a race in panfrost_ioctl_madvise()
    - [arm64,armhf] drm/panfrost: Fix a BO leak in panfrost_ioctl_mmap_bo()
    - [arm64,armhf] drm/panfrost: Fix a race in panfrost_gem_free_object()
    - [x86] drm/mgag200: Extract device type from flags
    - [x86] drm/mgag200: Store flags from PCI driver data in device structure
    - [x86] drm/mgag200: Add workaround for HW that does not support
      'startadd'
    - [x86] drm/mgag200: Flag all G200 SE A machines as broken wrt <startadd>
    - [arm64] drm: meson: venc: cvbs: fix CVBS mode matching
    - dm mpath: remove harmful bio-based optimization
    - dm btree: increase rebalance threshold in __rebalance2()
    - dm clone metadata: Track exact changes per transaction
    - dm clone metadata: Use a two phase commit
    - dm clone: Flush destination device before committing metadata
    - dm thin metadata: Add support for a pre-commit callback
    - dm thin: Flush data device before committing metadata
    - scsi: ufs: Disable autohibern8 feature in Cadence UFS
    - scsi: iscsi: Fix a potential deadlock in the timeout handler
    - scsi: qla2xxx: Ignore NULL pointer in tcm_qla2xxx_free_mcmd
    - scsi: qla2xxx: Initialize free_work before flushing it
    - scsi: qla2xxx: Added support for MPI and PEP regions for ISP28XX
    - scsi: qla2xxx: Change discovery state before PLOGI
    - scsi: qla2xxx: Correctly retrieve and interpret active flash region
    - scsi: qla2xxx: Fix incorrect SFUB length used for Secure Flash Update MB
      Cmd
    - drm/nouveau/kms/nv50-: Call outp_atomic_check_view() before handling PBN
    - drm/nouveau/kms/nv50-: Store the bpc we're using in nv50_head_atom
    - drm/nouveau/kms/nv50-: Limit MST BPC to 8
    - [x86] drm/i915/fbc: Disable fbc by default on all glk+
    - drm/radeon: fix r1xx/r2xx register checker for POT textures
    - drm/dp_mst: Correct the bug in drm_dp_update_payload_part1()
    - drm/amdgpu: initialize vm_inv_eng0_sem for gfxhub and mmhub
    - drm/amdgpu: invalidate mmhub semaphore workaround in gmc9/gmc10
    - drm/amdgpu/gfx10: explicitly wait for cp idle after halt/unhalt
    - drm/amdgpu/gfx10: re-init clear state buffer after gpu reset
    - drm/amdgpu: avoid using invalidate semaphore for picasso
    - drm/amdgpu: add invalidate semaphore limit for SRIOV and picasso in gmc9
    - ALSA: hda: Fix regression by strip mask fix

  [ Joe Richey ]
  * [amd64/cloud-amd64] tpm: Enable TPM drivers for Cloud (Closes: #946237)

  [ Ben Hutchings ]
  * [armel/rpi,armhf,arm64] Enable DEBUG_WX
  * linux-cpupower: Fix grammar error in package description
  * debian/control: Make library package descriptions more consistent
  * Set ABI to 1
  * tracing: Do not create directories if lockdown is in affect

  [ Aurelien Jarno ]
  * [armhf,arm64] Fix critical trip point on RPI 3.

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.4.3-rt1 and re-enable
  * [rt] Enable PREEMPT_RT (instead of PREEMPT_RT_FULL) which is part of 5.4
  * [rt] Update to 5.4.5-rt3

  [ YunQiang Su ]
  * [mipsel,mips64el/loongson-3] Enable AMDGPU.
  * [mips*] switch to vmlinuz from vmlinux except octeon.
  * [mips*] enable CONFIG_MIPS_O32_FP64_SUPPORT.
  * [mips*] enable CONFIG_CPU_HAS_MSA except octeon.

  [ Vagrant Cascadian ]
  * [arm64] drivers/gpu/drm/sun4i: Enable DRM_SUN8I_MIXER as a module.
    (Closes: #946510). Thanks to Andrei POPESCU.

  [ Sudip Mukherjee ]
  * Add libtraceevent packages (Closes: #944138)

 -- Ben Hutchings <ben@decadent.org.uk>  Fri, 27 Dec 2019 22:17:44 +0000

linux (5.4.2-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.1
    - Bluetooth: Fix invalid-free in bcsp_close()
    - ath9k_hw: fix uninitialized variable data
    - ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe
      (CVE-2019-15099)
    - ath10k: Fix HOST capability QMI incompatibility
    - ath10k: restore QCA9880-AR1A (v1) detection
    - Revert "Bluetooth: hci_ll: set operational frequency earlier"
    - Revert "dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues"
    - md/raid10: prevent access of uninitialized resync_pages offset
    - [x86] insn: Fix awk regexp warnings
    - [x86] speculation: Fix incorrect MDS/TAA mitigation status
    - [x86] speculation: Fix redundant MDS mitigation message
    - nbd: prevent memory leak
    - [i386] x86/stackframe/32: Repair 32-bit Xen PV
    - [i386] x86/xen/32: Make xen_iret_crit_fixup() independent of frame
      layout
    - [i386] x86/xen/32: Simplify ring check in xen_iret_crit_fixup()
    - [i386] x86/doublefault/32: Fix stack canaries in the double fault
      handler
    - [i386] x86/pti/32: Size initial_page_table correctly
    - [i386] x86/cpu_entry_area: Add guard page for entry stack on 32bit
    - [i386] x86/entry/32: Fix IRET exception
    - [i386] x86/entry/32: Use %ss segment where required
    - [i386] x86/entry/32: Move FIXUP_FRAME after pushing %fs in SAVE_ALL
    - [i386] x86/entry/32: Unwind the ESPFIX stack earlier on exception entry
    - [i386] x86/entry/32: Fix NMI vs ESPFIX
    - [i386] x86/pti/32: Calculate the various PTI cpu_entry_area sizes
      correctly, make the CPU_ENTRY_AREA_PAGES assert precise
    - [i386] x86/entry/32: Fix FIXUP_ESPFIX_STACK with user CR3
    - futex: Prevent robust futex exit race
    - ALSA: usb-audio: Fix NULL dereference at parsing BADD
    - ALSA: usb-audio: Fix Scarlett 6i6 Gen 2 port data
    - media: vivid: Set vid_cap_streaming and vid_out_streaming to true
    - media: vivid: Fix wrong locking that causes race conditions on streaming
      stop (CVE-2019-18683)
    - media: usbvision: Fix invalid accesses after device disconnect
    - media: usbvision: Fix races among open, close, and disconnect
    - cpufreq: Add NULL checks to show() and store() methods of cpufreq
    - futex: Move futex exit handling into futex code
    - futex: Replace PF_EXITPIDONE with a state
    - exit/exec: Seperate mm_release()
    - futex: Split futex_mm_release() for exit/exec
    - futex: Set task::futex_state to DEAD right after handling futex exit
    - futex: Mark the begin of futex exit explicitly
    - futex: Sanitize exit state handling
    - futex: Provide state handling for exec() as well
    - futex: Add mutex around futex exit
    - futex: Provide distinct return value when owner is exiting
    - futex: Prevent exit livelock
    - media: uvcvideo: Fix error path in control parsing failure
    - media: b2c2-flexcop-usb: add sanity checking (CVE-2019-15291)
    - media: cxusb: detect cxusb_ctrl_msg error in query
    - media: imon: invalid dereference in imon_touch_event
    - media: mceusb: fix out of bounds read in MCE receiver buffer
    - ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs
    - usbip: tools: fix fd leakage in the function of read_attr_usbip_status
    - usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit()
    - usb-serial: cp201x: support Mark-10 digital force gauge
    - USB: chaoskey: fix error case of a timeout
    - appledisplay: fix error handling in the scheduled work
    - USB: serial: mos7840: add USB ID to support Moxa UPort 2210
    - USB: serial: mos7720: fix remote wakeup
    - USB: serial: mos7840: fix remote wakeup
    - USB: serial: option: add support for DW5821e with eSIM support
    - USB: serial: option: add support for Foxconn T77W968 LTE modules
    - [x86] staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
    - [powerpc*] powerpc/book3s64: Fix link stack flush on context switch
      (CVE-2019-18660)
    - [powerpc*] KVM: PPC: Book3S HV: Flush link stack on guest exit to host
      kernel
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2
    - io_uring: async workers should inherit the user creds
    - net: separate out the msghdr copy from ___sys_{send,recv}msg()
    - net: disallow ancillary data for __sys_{send,recv}msg_file()
    - [arm64] crypto: inside-secure - Fix stability issue with Macchiatobin
    - driver core: platform: use the correct callback type for bus_find_device
    - [arm64,armel,armhf] usb: dwc2: use a longer core rest timeout in
      dwc2_core_reset()
    - [x86] staging: rtl8192e: fix potential use after free
    - staging: rtl8723bs: Drop ACPI device ids
    - staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids
    - USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
    - [x86] mei: bus: prefix device names on bus with the bus name
    - [x86] mei: me: add comet point V device id
    - [x86] thunderbolt: Power cycle the router if NVM authentication fails
    - [x86] fpu: Don't cache access to fpu_fpregs_owner_ctx
    - macvlan: schedule bc_work even if error
    - mdio_bus: don't use managed reset-controller
    - net: macb: add missed tasklet_kill
    - net: psample: fix skb_over_panic
    - net: sched: fix `tc -s class show` no bstats on class with nolock
      subqueues
    - openvswitch: fix flow command message size
    - sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook
    - slip: Fix use-after-free Read in slip_open
    - sctp: cache netns in sctp_ep_common
    - openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
    - openvswitch: remove another BUG_ON()
    - net: skmsg: fix TLS 1.3 crash with full sk_msg
    - tipc: fix link name length check
    - r8169: fix jumbo configuration for RTL8168evl
    - r8169: fix resume on cable plug-in
    - ext4: add more paranoia checking in ext4_expand_extra_isize handling
    - Revert "jffs2: Fix possible null-pointer dereferences in
      jffs2_add_frag_to_fragtree()"
    - HID: core: check whether Usage Page item is after Usage ID items
    - [x86] platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
    - [x86] platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input
      size

  [ Ben Hutchings ]
  * [armel] udeb: Replace m25p80 with spi-nor in mtd-modules (fixes FTBFS)
  * [ia64] udeb: Remove SGI SN2 modules (fixes FTBFS)
  * iio: Enable TI_ADS1015 as module, replacing SENSORS_ADS1015
  * [armhf] regulator: Really enable REGULATOR_STM32_PWR
  * [armhf] drm/panel: Enable DRM_PANEL_{SONY_ACX565AKM,TPO_TD028TTEC1,
    TPO_TD043MTEA1} as modules, replacing the corresponding omapdrm options
  * [armhf,arm64] platform/chrome: Change chromeos drivers back to modules
  * Build-Depend on kernel-wedge 2.102; remove workaround in debian/rules.real
  * debian/bin: Add script to update taint list for bug reporting script
  * linux-image: bug: Update taint list and use upstream descriptions
  * btrfs,fanotify: Use TAINT_AUX instead of TAINT_USER for unsupported
    features

  [ Romain Perier ]
  * Enable VIRTIO_FS and VIRTIO_PMEM (Closes: #945853)

  [ Aurelien Jarno]
  * [ppc64el] Fix building libbpf with recent binutils versions (fixes FTBFS).

  [ Luca Boccassi ]
  * verity: enable DM_VERITY_VERIFY_ROOTHASH_SIG

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 05 Dec 2019 08:37:56 +0100

linux (5.4-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.4

  [ Ben Hutchings ]
  * lockdown: Rebase on upstream Lockdown LSM:
    - Refresh "efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode"
    - Update "efi: Lock down the kernel if booted in secure boot mode"
    - Update "Add a SysRq option to lift kernel lockdown"
    - Update "mtd: Disable slram and phram when locked down"
    - Update "arm64: add kernel config option to lock down when in Secure Boot
      mode"
    - Refresh "lockdown: Refer to Debian wiki until manual page exists"
    - Drop all other lockdown patches
    - Enable SECURITY_LOCKDOWN_LSM, LOCK_DOWN_KERNEL_FORCE_NONE,
      LOCK_DOWN_IN_EFI_SECURE_BOOT
  * [armel/marvell] lockdown: Disable Lockdown as it now selects MODULE_SIG
  * [amd64] Update "x86: Make x32 syscall support conditional …" for 5.4
  * debian/lib/python/debian_linux/abi.py: Add support for symbol namespaces
  * debian/bin/genpatch-rt: Fix series generation from git

  [ Romain Perier ]
  * Rebased the following patches onto 5.4.x:
    - debian/version.patch
    - debian/ia64-hardcode-arch-script-output.patch
    - bugfix/all/
      radeon-amdgpu-firmware-is-required-for-drm-and-kms-on-r600-onward.patch
    - features/all/aufs5/aufs5-mmap.patch
    - features/all/aufs5/aufs5-standalone.patch
    - features/x86/
      intel-iommu-add-kconfig-option-to-exclude-igpu-by-default.patch
    - bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch
    - debian/revert-objtool-fix-config_stack_validation-y-warning.patch
    - features/all/db-mok-keyring/
      0003-MODSIGN-checking-the-blacklisted-hash-before-loading-a-kernel-module
      .patch
    - bugfix/all/tools-perf-man-date.patch
    - bugfix/all/usbip-fix-misuse-of-strncpy.patch
    - bugfix/all/partially-revert-usb-kconfig-using-select-for-usb_co.patch

  [ John Paul Adrian Glaubitz ]
  * [m68k] Enable CONFIG_PATA_BUDDHA as module

  [ Aurelien Jarno ]
  * [armhf] Add support for STM32MP1 SoC: enable ARCH_STM32,
    CRYPTO_DEV_STM32_CRC, CRYPTO_DEV_STM32_CRYP, CRYPTO_DEV_STM32_HASH,
    DRM_PANEL_ORISETECH_OTM8009A, DRM_SII902X, DRM_STM, DRM_STM_DSI,
    HW_RANDOM_STM32, I2C_STM32F7, INPUT_STPMIC1_ONKEY, MFD_STM32_LPTIMER,
    MFD_STPMIC1, MTD_NAND_STM32_FMC2, PHY_STM32_USBPHYC, PWM_STM32_LP,
    REGULATOR_STM32_BOOSTER, REGULATOR_STM32_PWR, REGULATOR_STM32_VREFBUF,
    REGULATOR_STPMIC1, REMOTEPROC, RTC_DRV_STM32, SERIAL_STM32,
    SERIAL_STM32_CONSOLE, SND_AUDIO_GRAPH_CARD, SND_SOC_CS42L51_I2C,
    SND_SOC_STM32_DFSDM, SND_SOC_STM32_I2S, SND_SOC_STM32_SAI,
    SND_SOC_STM32_SPDIFRX, SPI_STM32, SPI_STM32_QSPI, STM32_DMA,
    STM32_DMAMUX, STM32_MDMA, STM32_RPROC, STPMIC1_WATCHDOG,
    TOUCHSCREEN_EDT_FT5X06.
  * [arm64] Re-enable BT_HCIUART_{BCM,LL} (arm64 version of #906048).
  * [arm64,armhf] Enable CLK_RASPBERRYPI and RASPBERRYPI_CPUFREQ.

  [ Salvatore Bonaccorso ]
  * md: Enable MD_CLUSTER as module (Closes: #927026)

 -- Ben Hutchings <ben@decadent.org.uk>  Tue, 26 Nov 2019 01:33:11 +0000

linux (5.3.15-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.10
    - regulator: of: fix suspend-min/max-voltage parsing
    - ASoC: topology: Fix a signedness bug in soc_tplg_dapm_widget_create()
    - [arm64] dts: allwinner: a64: pine64-plus: Add PHY regulator delay
    - [arm64] dts: allwinner: a64: Drop PMU node
    - [arm64] dts: allwinner: a64: sopine-baseboard: Add PHY regulator delay
    - [arm64] dts: Fix gpio to pinmux mapping
    - [x86] pinctrl: intel: Allocate IRQ chip dynamic
    - [amd64] ASoC: SOF: loader: fix kernel oops on firmware boot failure
    - [amd64] ASoC: SOF: topology: fix parse fail issue for byte/bool tuple
      types
    - [amd64] ASoC: SOF: Intel: hda: fix warnings during FW load
    - [amd64] ASoC: SOF: Intel: initialise and verify FW crash dump data.
    - [amd64] ASoC: SOF: Intel: hda: Disable DMI L1 entry during capture
    - [amd64] ASoC: rt5682: add NULL handler to set_jack function
    - [amd64] ASoC: intel: sof_rt5682: add remove function to disable jack
    - [x86] ASoC: intel: bytcr_rt5651: add null check to support_button_press
    - [armhf] regulator: pfuze100-regulator: Variable "val" in
      pfuze100_regulator_probe() could be uninitialized
    - [armhf,arm64] ASoc: rockchip: i2s: Fix RPM imbalance
    - [arm64] dts: rockchip: fix Rockpro64 RK808 interrupt line
    - [armhf] dts: logicpd-torpedo-som: Remove twl_keypad
    - [arm64] dts: rockchip: fix RockPro64 vdd-log regulator settings
    - [arm64] dts: rockchip: fix RockPro64 sdhci settings
    - [arm64] dts: zii-ultra: fix ARM regulator states
    - [armhf] dts: am3874-iceboard: Fix 'i2c-mux-idle-disconnect' usage
    - [armhf] dts: Use level interrupt for omap4 & 5 wlcore
    - [armel,armhf] mm: fix alignment handler faults under memory pressure
    - scsi: qla2xxx: fix a potential NULL pointer dereference
    - scsi: scsi_dh_alua: handle RTPG sense code correctly during state
      transitions
    - [armel,armhf] 8908/1: add __always_inline to functions called from
      __get_user_check()
    - [arm64] dts: rockchip: fix RockPro64 sdmmc settings
    - [arm64] dts: rockchip: Fix usb-c on Hugsun X99 TV Box
    - [armhf] dts: imx6q-logicpd: Re-Enable SNVS power key
    - perf tools: Fix resource leak of closedir() on the error paths
    - perf c2c: Fix memory leak in build_cl_output()
    - perf kmem: Fix memory leak in compact_gfp_flags()
    - drm/amdgpu: fix potential VM faults
    - drm/amdgpu: fix error handling in amdgpu_bo_list_create
    - scsi: target: core: Do not overwrite CDB byte 1
    - scsi: hpsa: add missing hunks in reset-patch
    - [x86] ASoC: Intel: sof-rt5682: add a check for devm_clk_get
    - [x86] ASoC: SOF: control: return true when kcontrol values change
    - tracing: Fix "gfp_t" format for synthetic events
    - [arm64] dts: bcm2837-rpi-cm3: Avoid leds-gpio probing issue
    - [x86] ALSA: hda: Add Tigerlake/Jasperlake PCI ID
    - [armhf,arm64] irqchip/gic-v3-its: Use the exact ITSList for VMOVP
    - cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs
    - [riscv64] irqchip/sifive-plic: Skip contexts except supervisor in
      plic_init()
    - nbd: protect cmd->status with cmd->lock
    - nbd: handle racing with error'ed out commands
    - cxgb4: fix panic when attaching to ULD fail
    - cxgb4: request the TX CIDX updates to status page
    - dccp: do not leak jiffies on the wire
    - erspan: fix the tun_info options_len check for erspan
    - inet: stop leaking jiffies on the wire
    - net: annotate accesses to sk->sk_incoming_cpu
    - net: annotate lockless accesses to sk->sk_napi_id
    - [armhf] net: dsa: bcm_sf2: Fix IMP setup for port different than 8
    - net: fix sk_page_frag() recursion from memory reclaim
    - [arm64] net: hisilicon: Fix ping latency when deal with high throughput
    - net/mlx4_core: Dynamically set guaranteed amount of counters per VF
    - netns: fix GFP flags in rtnl_net_notifyid()
    - net: rtnetlink: fix a typo fbd -> fdb
    - net: usb: lan78xx: Disable interrupts before calling generic_handle_irq()
    - net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()
    - udp: fix data-race in udp_set_dev_scratch()
    - vxlan: check tun_info options_len properly
    - net: add skb_queue_empty_lockless()
    - udp: use skb_queue_empty_lockless()
    - net: use skb_queue_empty_lockless() in poll() handlers
    - net: use skb_queue_empty_lockless() in busy poll contexts
    - net: add READ_ONCE() annotation in __skb_wait_for_more_packets()
    - ipv4: fix route update on metric change.
    - net/smc: fix closing of fallback SMC sockets
    - net/smc: keep vlan_id for SMC-R in smc_listen_work()
    - keys: Fix memory leak in copy_net_ns
    - net: phylink: Fix phylink_dbg() macro
    - rxrpc: Fix handling of last subpacket of jumbo packet
    - net/mlx5e: Determine source port properly for vlan push action
    - net/mlx5e: Remove incorrect match criteria assignment line
    - net/mlx5e: Initialize on stack link modes bitmap
    - net/mlx5: Fix flow counter list auto bits struct
    - net/smc: fix refcounting for non-blocking connect()
    - net/mlx5: Fix rtable reference leak
    - r8169: fix wrong PHY ID issue with RTL8168dp
    - net/mlx5e: Fix ethtool self test: link speed
    - net/mlx5e: Fix handling of compressed CQEs in case of low NAPI budget
    - ipv4: fix IPSKB_FRAG_PMTU handling with fragmentation
    - [armhf] net: dsa: b53: Do not clear existing mirrored port mask
    - net: dsa: fix switch tree list
    - net: ensure correct skb->tstamp in various fragmenters
    - [arm64] net: hns3: fix mis-counting IRQ vector numbers issue
    - net: netem: fix error path for corrupted GSO frames
    - net: reorder 'struct net' fields to avoid false sharing
    - net: usb: lan78xx: Connect PHY before registering MAC
    - [x86] r8152: add device id for Lenovo ThinkPad USB-C Dock Gen 2
    - net: netem: correct the parent's backlog when corrupted packet was
      dropped
    - net/flow_dissector: switch to siphash
    - CIFS: Fix retry mid list corruption on reconnects
    - usb: gadget: udc: core: Fix segfault if udc_bind_to_driver() for pending
      driver fails
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11
    - bonding: fix state transition issue in link monitoring
    - CDC-NCM: handle incomplete transfer of MTU
    - ipv4: Fix table id reference in fib_sync_down_addr
    - [mips*/octeon] net: ethernet: octeon_mgmt: Account for second possible
      VLAN header
    - net: fix data-race in neigh_event_send()
    - net: usb: qmi_wwan: add support for DW5821e with eSIM support
    - nfc: netlink: fix double device reference drop
    - qede: fix NULL pointer deref in __qede_remove()
    - ipv6: fixes rt6_probe() and fib6_nh->last_probe init
    - [arm64] net: hns: Fix the stray netpoll locks causing deadlock in NAPI
      path
    - net: prevent load/store tearing on sk->sk_stamp
    - net: sched: prevent duplicate flower rules from tcf_proto destroy race
    - net/smc: fix ethernet interface refcounting
    - vsock/virtio: fix sock refcnt holding during the shutdown
    - r8169: fix page read in r8168g_mdio_read
    - ALSA: timer: Fix incorrectly assigned timer instance
    - ALSA: bebob: fix to detect configured source of sampling clock for
      Focusrite Saffire Pro i/o series
    - ALSA: hda/ca0132 - Fix possible workqueue stall
    - mm: memcontrol: fix NULL-ptr deref in percpu stats flush
    - mm: memcontrol: fix network errors from failing __GFP_ATOMIC charges
    - mm, meminit: recalculate pcpu batch and high limits after init completes
    - mm: thp: handle page cache THP correctly in PageTransCompoundMap
    - mm, vmstat: hide /proc/pagetypeinfo from normal users
    - dump_stack: avoid the livelock of the dump_lock
    - mm: slab: make page_cgroup_ino() to recognize non-compound slab pages
      properly
    - btrfs: Consider system chunk array size for new SYSTEM chunks
    - btrfs: tree-checker: Fix wrong check on max devid
    - btrfs: save i_size to avoid double evaluation of i_size_read in
      compress_file_range
    - [x86] pinctrl: intel: Avoid potential glitches if pin is in GPIO mode
    - perf tools: Fix time sorting
    - perf map: Use zalloc for map_groups
    - drm/radeon: fix si_enable_smc_cac() failed issue
    - HID: wacom: generic: Treat serial number and related fields as unsigned
    - mm/khugepaged: fix might_sleep() warn with CONFIG_HIGHPTE=y
    - blkcg: make blkcg_print_stat() print stats only for online blkgs
    - [arm64] Do not mask out PTE_RDONLY in pte_same()
    - ceph: fix use-after-free in __ceph_remove_cap()
    - ceph: fix RCU case handling in ceph_d_revalidate()
    - ceph: add missing check in d_revalidate snapdir handling
    - ceph: don't try to handle hashed dentries in non-O_CREAT atomic_open
    - ceph: don't allow copy_file_range when stripe_count != 1
    - [x86] iio: imu: inv_mpu6050: fix no data on MPU6050
    - [armhf] sunxi: Fix CPU powerdown on A83T
    - [armhf] dts: imx6-logicpd: Re-enable SNVS power key
    - cpufreq: intel_pstate: Fix invalid EPB setting
    - clone3: validate stack arguments
    - netfilter: nf_tables: Align nft_expr private data to 64-bit
    - netfilter: ipset: Fix an error code in ip_set_sockfn_get()
    - [x86] intel_th: gth: Fix the window switching sequence
    - [x86] intel_th: pci: Add Comet Lake PCH support
    - [x86] intel_th: pci: Add Jasper Lake PCH support
    - [amd64] dumpstack: Don't evaluate exception stacks before setup
    - [i386] apic: Avoid bogus LDR warnings
    - SMB3: Fix persistent handles reconnect
    - can: usb_8dev: fix use-after-free on disconnect
    - [armhf] can: flexcan: disable completely the ECC mechanism
    - [armhf] can: c_can: c_can_poll(): only read status register after status
      IRQ
    - can: peak_usb: fix a potential out-of-sync while decoding packets
    - can: rx-offload: can_rx_offload_queue_sorted(): fix error handling, avoid
      skb mem leak
    - can: gs_usb: gs_can_open(): prevent memory leak (CVE-2019-19052)
    - can: dev: add missing of_node_put() after calling of_get_child_by_name()
    - can: mcba_usb: fix use-after-free on disconnect (CVE-2019-19529)
    - can: peak_usb: fix slab info leak (CVE-2019-19534)
    - configfs: fix a deadlock in configfs_symlink()
    - ALSA: usb-audio: More validations of descriptor units
    - ALSA: usb-audio: Simplify parse_audio_unit()
    - ALSA: usb-audio: Unify the release of usb_mixer_elem_info objects
    - ALSA: usb-audio: Remove superfluous bLength checks
    - ALSA: usb-audio: Clean up check_input_term()
    - ALSA: usb-audio: Fix possible NULL dereference at
      create_yamaha_midi_quirk()
    - ALSA: usb-audio: remove some dead code
    - ALSA: usb-audio: Fix copy&paste error in the validator
    - usbip: Implement SG support to vhci-hcd and stub driver
    - HID: google: add magnemite/masterball USB ids
    - bpf: lwtunnel: Fix reroute supplying invalid dst
    - [x86] HID: intel-ish-hid: fix wrong error handling in
      ishtp_cl_alloc_tx_ring()
    - [powerpc] fix allow/prevent_user_access() when crossing segment
      boundaries.
    - RDMA/mlx5: Clear old rate limit when closing QP
    - iw_cxgb4: fix ECN check on the passive accept
    - RDMA/siw: free siw_base_qp in kref release routine
    - RDMA/qedr: Fix reported firmware version
    - IB/core: Use rdma_read_gid_l2_fields to compare GID L2 fields
    - net/mlx5e: Tx, Fix assumption of single WQEBB of NOP in cleanup flow
    - net/mlx5e: TX, Fix consumer index of error cqe dump
    - net/mlx5: prevent memory leak in mlx5_fpga_conn_create_cq
      (CVE-2019-19045)
    - net/mlx5: fix memory leak in mlx5_fw_fatal_reporter_dump (CVE-2019-19047)
    - scsi: qla2xxx: fixup incorrect usage of host_byte
    - scsi: lpfc: Check queue pointer before use
    - scsi: ufs-bsg: Wake the device before sending raw upiu commands
    - RDMA/uverbs: Prevent potential underflow
    - bpf: Fix use after free in subprog's jited symbol removal
    - [armhf,arm64] net: stmmac: Fix the problem of tso_xmit
    - net: openvswitch: free vport unless register_netdevice() succeeds
    - scsi: lpfc: Honor module parameter lpfc_use_adisc
    - scsi: qla2xxx: Initialized mailbox to prevent driver load failure
    - bpf: Fix use after free in bpf_get_prog_name
    - iwlwifi: pcie: fix PCI ID 0x2720 configs that should be soc
    - iwlwifi: pcie: fix all 9460 entries for qnj
    - iwlwifi: pcie: 0x2720 is qu and 0x30DC is not
    - netfilter: nf_flow_table: set timeout before insertion into hashes
    - xsk: Fix registration of Rx-only sockets
    - net: phy: smsc: LAN8740: add PHY_RST_AFTER_CLK_EN flag
    - ipvs: don't ignore errors in case refcounting ip_vs module fails
    - ipvs: move old_secure_tcp into struct netns_ipvs
    - netfilter: nft_payload: fix missing check for matching length in offloads
    - RDMA/nldev: Skip counter if port doesn't match
    - bonding: fix unexpected IFF_BONDING bit unset
    - bonding: use dynamic lockdep key instead of subclass
    - macsec: fix refcnt leak in module exit routine
    - virt_wifi: fix refcnt leak in module exit routine
    - scsi: sd: define variable dif as unsigned int instead of bool
    - usb: gadget: composite: Fix possible double free memory bug
    - usb: gadget: configfs: fix concurrent issue between composite APIs
    - [armhf,arm64] usb: dwc3: remove the call trace of USBx_GFLADJ
    - [x86] perf/amd/ibs: Fix reading of the IBS OpData register and thus
      precise RIP validity
    - [x86] perf/amd/ibs: Handle erratum #420 only on the affected CPU family
      (10h)
    - [x86] perf/uncore: Fix event group support
    - USB: Skip endpoints with 0 maxpacket length
    - USB: ldusb: use unsigned size format specifiers
    - usbip: tools: Fix read_usb_vudc_device() error path handling
    - RDMA/iw_cxgb4: Avoid freeing skb twice in arp failure case
    - [arm64] RDMA/hns: Prevent memory leaks of eq->buf_list
    - scsi: qla2xxx: stop timer in shutdown path
    - sched/topology: Don't try to build empty sched domains
    - sched/topology: Allow sched_asym_cpucapacity to be disabled
    - nvme-multipath: fix possible io hang after ctrl reconnect
    - [amd64] fjes: Handle workqueue allocation failure
    - [arm64] net: hisilicon: Fix "Trying to free already-free IRQ"
    - wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle
      (CVE-2019-19051)
    - [x86] iommu/amd: Apply the same IVRS IOAPIC workaround to Acer Aspire
      A315-41
    - mt76: dma: fix buffer unmap with non-linear skbs
    - drm/amdgpu/sdma5: do not execute 0-sized IBs (v2)
    - drm/sched: Set error to s_fence if HW job submission failed.
    - drm/amdgpu: If amdgpu_ib_schedule fails return back the error.
    - drm/amd/display: do not synchronize "drr" displays
    - drm/amd/display: add 50us buffer as WA for pstate switch in active
    - drm/amd/display: Passive DP->HDMI dongle detection fix
    - drm/amd/display: dc.c:use kzalloc without test
    - SUNRPC: The TCP back channel mustn't disappear while requests are
      outstanding
    - SUNRPC: The RDMA back channel mustn't disappear while requests are
      outstanding
    - SUNRPC: Destroy the back channel when we destroy the host transport
    - [x86] hv_netvsc: Fix error handling in netvsc_attach()
    - efi/tpm: Return -EINVAL when determining tpm final events log size fails
    - efi: libstub/arm: Account for firmware reserved memory at the base of RAM
    - [x86] efi: Never relocate kernel below lowest acceptable address
    - [arm64] cpufeature: Enable Qualcomm Falkor errata 1009 for Kryo
    - usb: dwc3: gadget: fix race when disabling ep with cancelled xfers
    - [arm64] apply ARM64_ERRATUM_845719 workaround for Brahma-B53 core
    - [arm64] Brahma-B53 is SSB and spectre v2 safe
    - [arm64] apply ARM64_ERRATUM_843419 workaround for Brahma-B53 core
    - NFSv4: Don't allow a cached open with a revoked delegation
    - igb: Fix constant media auto sense switching when no cable is connected
    - e1000: fix memory leaks
    - ocfs2: protect extent tree in ocfs2_prepare_inode_for_write()
    - [x86] pinctrl: cherryview: Fix irq_valid_mask calculation
    - timekeeping/vsyscall: Update VDSO data unconditionally
    - mm/filemap.c: don't initiate writeback if mapping has no dirty pages
    - cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg
      is dead
    - [x86] ASoC: SOF: Intel: hda-stream: fix the CONFIG_ prefix missing
    - usbip: Fix free of unallocated memory in vhci tx
    - bonding: fix using uninitialized mode_lock
    - netfilter: ipset: Copy the right MAC address in hash:ip,mac IPv6 sets
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.12
    - scsi: core: Handle drivers which set sg_tablesize to zero
    - ax88172a: fix information leak on short answers
    - devlink: disallow reload operation during device cleanup
    - ipmr: Fix skb headroom in ipmr_get_route().
    - net/smc: fix fastopen for non-blocking connect()
    - net: usb: qmi_wwan: add support for Foxconn T77W968 LTE modules
    - slip: Fix memory leak in slip_open error path
    - tcp: remove redundant new line from tcp_event_sk_skb
    - devlink: Add method for time-stamp on reporter's dump
    - net/smc: fix refcount non-blocking connect() -part 2
    - ALSA: usb-audio: Fix missing error check at mixer resolution test
    - ALSA: usb-audio: not submit urb for stopped endpoint
    - ALSA: usb-audio: Fix incorrect NULL check in create_yamaha_midi_quirk()
    - ALSA: usb-audio: Fix incorrect size check for processing/extension units
    - Btrfs: fix log context list corruption after rename exchange operation
    - cgroup: freezer: call cgroup_enter_frozen() with preemption disabled in
      ptrace_stop()
    - Input: ff-memless - kill timer in destroy() (CVE-2019-19524)
    - Input: synaptics-rmi4 - fix video buffer size
    - Input: synaptics-rmi4 - disable the relative position IRQ in the F12
      driver
    - Input: synaptics-rmi4 - do not consume more data than we have (F11, F12)
    - Input: synaptics-rmi4 - clear IRQ enables for F54
    - Input: synaptics-rmi4 - destroy F54 poller workqueue when removing
    - KVM: MMU: Do not treat ZONE_DEVICE pages as being reserved
    - IB/hfi1: Ensure r_tid_ack is valid before building TID RDMA ACK packet
    - IB/hfi1: Calculate flow weight based on QP MTU for TID RDMA
    - IB/hfi1: TID RDMA WRITE should not return IB_WC_RNR_RETRY_EXC_ERR
    - IB/hfi1: Ensure full Gen3 speed in a Gen4 system
    - IB/hfi1: Use a common pad buffer for 9B and 16B packets
    - i2c: acpi: Force bus speed to 400KHz if a Silead touchscreen is present
    - [x86] quirks: Disable HPET on Intel Coffe Lake platforms
    - ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable
    - ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either
    - io_uring: ensure registered buffer import returns the IO length
    - [x86] drm/i915: update rawclk also on resume
    - [x86] Revert "drm/i915/ehl: Update MOCS table for EHL"
    - ntp/y2038: Remove incorrect time_t truncation
    - [x86] iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros
    - mm: mempolicy: fix the wrong return value and potential pages leak of
      mbind
    - mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm()
    - mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup()
    - mm: slub: really fix slab walking for init_on_free
    - mm/memory_hotplug: fix try_offline_node()
    - mm/page_io.c: do not free shared swap slots
    - mmc: sdhci-of-at91: fix quirk2 overwrite
    - slcan: Fix memory leak in error path
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.13
    - net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size()
    - block, bfq: deschedule empty bfq_queues not referred by any process
    - mm/memory_hotplug: don't access uninitialized memmaps in
      shrink_pgdat_span()
    - mm/memory_hotplug: fix updating the node span
    - [arm64] uaccess: Ensure PAN is re-enabled after unhandled uaccess fault
    - fbdev: Ditch fb_edid_add_monspecs
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.14
    - net/mlx4_en: fix mlx4 ethtool -N insertion
    - net/mlx4_en: Fix wrong limitation for number of TX rings
    - net: rtnetlink: prevent underflows in do_setvfinfo()
    - net/sched: act_pedit: fix WARN() in the traffic path
    - net: sched: ensure opts_len <= IP_TUNNEL_OPTS_MAX in act_tunnel_key
    - sfc: Only cancel the PPS workqueue if it exists
    - net/mlxfw: Verify FSM error code translation doesn't exceed array size
    - net/mlx5e: Fix set vf link state error flow
    - net/mlx5: Fix auto group size calculation
    - ipv6/route: return if there is no fib_nh_gw_family
    - taprio: don't reject same mqprio settings
    - net/ipv4: fix sysctl max for fib_multipath_hash_policy
    - net/mlx5e: Fix error flow cleanup in mlx5e_tc_tun_create_header_ipv4/6
    - net/mlx5e: Do not use non-EXT link modes in EXT mode
    - net/mlx5: Update the list of the PCI supported devices
    - vhost/vsock: split packets to send using multiple buffers
    - [arm64] gpio: max77620: Fixup debounce delays
    - fork: fix pidfd_poll()'s return type
    - nbd:fix memory leak in nbd_get_socket()
    - virtio_console: allocate inbufs in add_port() only if it is needed
    - virtio_ring: fix return code on DMA mapping fails
    - virtio_balloon: fix shrinker count
    - Revert "fs: ocfs2: fix possible null-pointer dereferences in
      ocfs2_xa_prepare_entry()"
    - mm/memory_hotplug: don't access uninitialized memmaps in
      shrink_zone_span()
    - mm/ksm.c: don't WARN if page is still mapped in remove_stable_node()
    - drm/amdgpu: disable gfxoff when using register read interface
    - drm/amdgpu: disable gfxoff on original raven
    - drm/amd/powerplay: issue no PPSMC_MSG_GetCurrPkgPwr on unsupported ASICs
    - [x86] drm/i915: Don't oops in dumb_create ioctl if we have no crtcs
    - [x86] drm/i915/pmu: "Frequency" is reported as accumulated cycles
    - [x86] drm/i915/userptr: Try to acquire the page lock around
      set_page_dirty()
    - Bluetooth: Fix invalid-free in bcsp_close()
    - ath10k: restore QCA9880-AR1A (v1) detection
    - ath10k: Fix HOST capability QMI incompatibility
    - ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe
      (CVE-2019-15099)
    - ath9k_hw: fix uninitialized variable data
    - Revert "Bluetooth: hci_ll: set operational frequency earlier"
    - Revert "dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues"
    - md/raid10: prevent access of uninitialized resync_pages offset
    - mdio_bus: Fix init if CONFIG_RESET_CONTROLLER=n
    - [armel,armhf] 8904/1: skip nomap memblocks while finding the lowmem/
      highmem boundary
    - [x86] insn: Fix awk regexp warnings
    - [x86] speculation: Fix incorrect MDS/TAA mitigation status
    - [x86] speculation: Fix redundant MDS mitigation message
    - nbd: prevent memory leak
    - [i386] stackframe: Repair 32-bit Xen PV
    - [i386] xen: Make xen_iret_crit_fixup() independent of frame layout
    - [i386] xen: Simplify ring check in xen_iret_crit_fixup()
    - [i386] doublefault: Fix stack canaries in the double fault handler
    - [i386] pti: Size initial_page_table correctly
    - [i386] cpu_entry_area: Add guard page for entry stack on 32bit
    - [i386] entry: Fix IRET exception
    - [i386] entry: Use %ss segment where required
    - [i386] entry: Move FIXUP_FRAME after pushing %fs in SAVE_ALL
    - [i386] entry: Unwind the ESPFIX stack earlier on exception entry
    - [i386] entry: Fix NMI vs ESPFIX
    - [i386] pti: Calculate the various PTI cpu_entry_area sizes correctly,
      make the CPU_ENTRY_AREA_PAGES assert precise
    - [i386] entry: Fix FIXUP_ESPFIX_STACK with user CR3
    - futex: Prevent robust futex exit race
    - ALSA: usb-audio: Fix NULL dereference at parsing BADD
    - nfc: port100: handle command failure cleanly
    - media: vivid: Set vid_cap_streaming and vid_out_streaming to true
    - media: vivid: Fix wrong locking that causes race conditions on streaming
      stop (CVE-2019-18683)
    - media: usbvision: Fix invalid accesses after device disconnect
    - media: usbvision: Fix races among open, close, and disconnect
    - cpufreq: Add NULL checks to show() and store() methods of cpufreq
    - media: uvcvideo: Fix error path in control parsing failure
    - media: b2c2-flexcop-usb: add sanity checking (CVE-2019-15291)
    - media: cxusb: detect cxusb_ctrl_msg error in query
    - media: imon: invalid dereference in imon_touch_event
    - media: mceusb: fix out of bounds read in MCE receiver buffer
    - mm/slub.c: init_on_free=1 should wipe freelist ptr for bulk allocations
    - usbip: tools: fix fd leakage in the function of read_attr_usbip_status
    - usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit()
    - usb-serial: cp201x: support Mark-10 digital force gauge
    - USB: chaoskey: fix error case of a timeout
    - appledisplay: fix error handling in the scheduled work
    - USB: serial: mos7840: add USB ID to support Moxa UPort 2210
    - USB: serial: mos7720: fix remote wakeup
    - USB: serial: mos7840: fix remote wakeup
    - USB: serial: option: add support for DW5821e with eSIM support
    - USB: serial: option: add support for Foxconn T77W968 LTE modules
    - [x86] staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
    - [powerpc*] 64s: support nospectre_v2 cmdline option
    - [powerpc*] book3s64: Fix link stack flush on context switch
      (CVE-2019-18660)
    - [powerpc*] KVM: Book3S HV: Flush link stack on guest exit to host kernel
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.15
    - io_uring: async workers should inherit the user creds
    - net: separate out the msghdr copy from ___sys_{send,recv}msg()
    - net: disallow ancillary data for __sys_{send,recv}msg_file()
    - XArray: Fix xas_next() with a single entry at 0
    - [arm64] clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate
    - [x86] thunderbolt: Read DP IN adapter first two dwords in one go
    - [x86] thunderbolt: Fix lockdep circular locking depedency warning
    - [x86] ASoC: compress: fix unsigned integer overflow check
    - [arm64,armel,armhf] reset: Fix memory leak in reset_control_array_put()
    - [armhf] clk: samsung: exynos542x: Move G3D subsystem clocks to its
      sub-CMU
    - [armel,armhf] ASoC: kirkwood: fix external clock probe defer
    - [armel,armhf] ASoC: kirkwood: fix device remove ordering
    - [armhf] clk: samsung: exynos5420: Preserve PLL configuration during
      suspend/resume
    - [x86] pinctrl: cherryview: Allocate IRQ chip dynamic
    - [armhf] soc: imx: gpc: fix initialiser format
    - ASoC: SOF: ipc: Fix memory leak in sof_set_get_large_ctrl_data
      (CVE-2019-18811)
    - [armhf] ASoC: ti: sdma-pcm: Add back the flags parameter for non
      standard dma names
    - [armhf] ASoC: rockchip: rockchip_max98090: Enable SHDN to fix headset
      detection
    - [arm64,armhf] clk: sunxi: Fix operator precedence in
      sunxi_divs_clk_setup
    - [armhf] clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18
    - [armhf] dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend
    - bpf: Allow narrow loads of bpf_sysctl fields with offset > 0
    - bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}()
    - [powerpc*] bpf: Fix tail call implementation
    - idr: Fix idr_get_next_ul race with idr_remove
    - idr: Fix integer overflow in idr_for_each_entry
    - idr: Fix idr_alloc_u32 on 32-bit systems
    - [amd64] ASoC: hdac_hda: fix race in device removal
    - [armhf] clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call
    - [armhf] clk: ti: clkctrl: Fix failed to enable error with double udelay
      timeout
    - [armhf] net: fec: add missed clk_disable_unprepare in remove
    - netfilter: ipset: Fix nla_policies to fully support NL_VALIDATE_STRICT
    - bridge: ebtables: don't crash when using dnat target in output chains
    - netfilter: nf_tables: bogus EOPNOTSUPP on basechain update
    - netfilter: nf_tables_offload: skip EBUSY on chain update
    - stacktrace: Don't skip first entry on noncurrent tasks
    - can: peak_usb: report bus recovery as well
    - [armhf] can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset
      on open
    - can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid
      skb mem leak
    - can: rx-offload: can_rx_offload_offload_one(): do not increase the
      skb_queue beyond skb_queue_len_max
    - can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors
      on queue overflow or OOM
    - can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to
      propagate error value in case of errors
    - can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on
      error
    - can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error
    - [armhf] can: flexcan: increase error counters if skb enqueueing via
      can_rx_offload_queue_sorted() fails
    - [x86] tsc: Respect tsc command line paraemeter for clocksource_tsc_early
    - nvme-rdma: fix a segmentation fault during module unload
    - nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths
    - [arm64] watchdog: meson: Fix the wrong value of left time
    - ALSA: hda: hdmi - add Tigerlake support
    - [amd64] ASoC: SOF: topology: Fix bytes control size checks
    - drm/amdgpu: dont schedule jobs while in reset
    - [arm64,armhf] net/mlx5e: Fix eswitch debug print of max fdb flow
    - net/mlx5e: Use correct enum to determine uplink port
    - drm/amdgpu: register gpu instance before fan boost feature enablment
    - drm/amdgpu: add warning for GRBM 1-cycle delay issue in gfx9
    - [arm64,armhf] net: stmmac: gmac4: bitrev32 returns u32
    - [arm64,armhf] net: stmmac: xgmac: bitrev32 returns u32
    - [arm64,armhf] net: stmmac: xgmac: Fix TSA selection
    - [arm64,armhf] net: stmmac: xgmac: Disable Flow Control when 1 or more
      queues are in AV
    - ceph: return -EINVAL if given fsc mount option on kernel w/o support
    - mac80211: fix ieee80211_txq_setup_flows() failure path
    - mac80211: fix station inactive_time shortly after boot
    - block: drbd: remove a stray unlock in __drbd_send_protocol()
    - ice: fix potential infinite loop because loop counter being too small
    - iavf: initialize ITRN registers with correct values
    - [arm64,armel,armhf] usb: dwc2: use a longer core rest timeout in
      dwc2_core_reset()
    - [x86] staging: rtl8192e: fix potential use after free
    - staging: rtl8723bs: Drop ACPI device ids
    - staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids
    - USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
    - [x86] mei: bus: prefix device names on bus with the bus name
    - [x86] mei: me: add comet point V device id
    - [x86] thunderbolt: Power cycle the router if NVM authentication fails
    - xfrm: Fix memleak on xfrm state destroy
    - [x86] fpu: Don't cache access to fpu_fpregs_owner_ctx (CVE-2019-19602)
    - macvlan: schedule bc_work even if error
    - mdio_bus: don't use managed reset-controller
    - net: macb: add missed tasklet_kill
    - net: psample: fix skb_over_panic
    - net: sched: fix `tc -s class show` no bstats on class with nolock
      subqueues
    - openvswitch: fix flow command message size
    - sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook
    - slip: Fix use-after-free Read in slip_open
    - sctp: cache netns in sctp_ep_common
    - openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
    - openvswitch: remove another BUG_ON()
    - net/tls: take into account that bpf_exec_tx_verdict() may free the
      record
    - net: skmsg: fix TLS 1.3 crash with full sk_msg
    - tipc: fix link name length check
    - ext4: add more paranoia checking in ext4_expand_extra_isize handling
    - HID: core: check whether Usage Page item is after Usage ID items
    - [x86] platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
    - [x86] platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input
      size
    - [armhf] net: fec: fix clock count mis-match

  [ Ben Hutchings ]
  * [amd64] sound/soc/sof: Disable SND_SOC_SOF_ACPI,
    SND_SOC_SOF_{BAYTRAIL,BROADWELL}_SUPPORT (Closes: #945914)
  * [amd64] sound/soc/intel/boarss: Disable Broxton drivers again
  * [i386] sound/soc: Enable same SOF drivers as on amd64
  * Bump ABI to 3

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 07 Dec 2019 13:24:06 +0100

linux (5.3.9-3) unstable; urgency=medium

  * [arm64,armhf,powerpc*,s390x] KVM: Add more exports to ABI ignore list
    (fixes FTBFS)

 -- Ben Hutchings <ben@decadent.org.uk>  Tue, 19 Nov 2019 01:43:33 +0000

linux (5.3.9-2) unstable; urgency=medium

  * [x86] Add mitigation for TSX Asynchronous Abort (CVE-2019-11135):
    - x86/msr: Add the IA32_TSX_CTRL MSR
    - x86/cpu: Add a helper function x86_read_arch_cap_msr()
    - x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default
    - x86/speculation/taa: Add mitigation for TSX Async Abort
    - x86/speculation/taa: Add sysfs reporting for TSX Async Abort
    - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled
    - x86/tsx: Add "auto" option to the tsx= cmdline parameter
    - x86/speculation/taa: Add documentation for TSX Async Abort
    - x86/tsx: Add config options to set tsx=on|off|auto
    - x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs
    TSX is now disabled by default; see
    Documentation/admin-guide/hw-vuln/tsx_async_abort.rst
  * [x86] KVM: Add mitigation for Machine Check Error on Page Size Change
    (aka iTLB multi-hit, CVE-2018-12207):
    - kvm: x86, powerpc: do not allow clearing largepages debugfs entry
    - x86/bugs: Add ITLB_MULTIHIT bug infrastructure
    - x86/cpu: Add Tremont to the cpu vulnerability whitelist
    - cpu/speculation: Uninline and export CPU mitigations helpers
    - kvm: mmu: ITLB_MULTIHIT mitigation
    - kvm: Add helper function for creating VM worker threads
    - kvm: x86: mmu: Recovery of shattered NX large pages
    - Documentation: Add ITLB_MULTIHIT documentation
  * [x86] i915: Mitigate local privilege escalation on gen9 (CVE-2019-0155):
    - drm/i915: Rename gen7 cmdparser tables
    - drm/i915: Disable Secure Batches for gen6+
    - drm/i915: Remove Master tables from cmdparser
    - drm/i915: Add support for mandatory cmdparsing
    - drm/i915: Support ro ppgtt mapped cmdparser shadow buffers
    - drm/i915: Allow parsing of unsized batches
    - drm/i915: Add gen9 BCS cmdparsing
    - drm/i915/cmdparser: Use explicit goto for error paths
    - drm/i915/cmdparser: Add support for backward jumps
    - drm/i915/cmdparser: Ignore Length operands during command matching
    - drm/i915/cmdparser: Fix jump whitelist clearing
  * [x86] i915: Mitigate local denial-of-service on gen8/gen9 (CVE-2019-0154):
    - drm/i915: Lower RM timeout to avoid DSI hard hangs
    - drm/i915/gen8+: Add RC6 CTX corruption WA

 -- Ben Hutchings <ben@decadent.org.uk>  Tue, 12 Nov 2019 15:44:08 +0000

linux (5.3.9-1) unstable; urgency=medium

  * New version hopefully closes: #942881
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.8
    - drm: Free the writeback_job when it with an empty fb
    - drm: Clear the fence pointer when writeback job signaled
    - [armhf] clk: ti: dra7: Fix mcasp8 clock bits
    - [armhf] dts: Fix wrong clocks for dra7 mcasp
    - nvme-pci: Fix a race in controller removal
    - scsi: ufs: skip shutdown if hba is not powered
    - scsi: megaraid: disable device when probe failed after enabled device
    - scsi: qla2xxx: Silence fwdump template message
    - scsi: qla2xxx: Fix unbound sleep in fcport delete path.
    - scsi: qla2xxx: Fix stale mem access on driver unload
    - scsi: qla2xxx: Fix N2N link reset
    - scsi: qla2xxx: Fix N2N link up fail
    - [armhf] dts: Fix gpio0 flags for am335x-icev2
    - [armhf] OMAP2+: Fix missing reset done flag for am3 and am43
    - [armhf] OMAP2+: Add missing LCDC midlemode for am335x
    - [armhf] OMAP2+: Fix warnings with broken omap2_set_init_voltage()
    - nvme-tcp: fix wrong stop condition in io_work
    - nvme-pci: Save PCI state before putting drive into deepest state
    - nvme: fix an error code in nvme_init_subsystem()
    - nvme-rdma: Fix max_hw_sectors calculation
    - nvme: Added QUIRKs for ADATA XPG SX8200 Pro 512GB
    - nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T
    - nvme-rdma: fix possible use-after-free in connect timeout
    - blk-mq: honor IO scheduler for multiqueue devices
    - xen/efi: Set nonblocking callbacks
    - loop: change queue block size to match when using DIO
    - nl80211: fix null pointer dereference
    - mac80211: fix txq null pointer dereference
    - netfilter: nft_connlimit: disable bh on garbage collection
    - [armhf,arm64] net: stmmac: xgmac: Not all Unicast addresses may be
      available
    - [armhf,arm64] net: stmmac: dwmac4: Always update the MAC Hash Filter
    - [armhf,arm64] net: stmmac: Correctly take timestamp for PTPv2
    - [armhf,arm64] net: stmmac: Do not stop PHY if WoL is enabled
    - drm/amdgpu: fix multiple memory leaks in acp_hw_init
    - drm/amd/display: memory leak
    - [mips*el/loongson-*] Fix the link time qualifier of 'serial_exit()'
    - [arm64] net: hisilicon: Fix usage of uninitialized variable in function
      mdio_sc_cfg_reg_write()
    - [armhf,arm64] net: stmmac: Avoid deadlock on suspend/resume
    - [s390x] mm: fix -Wunused-but-set-variable warnings
    - r8152: Set macpassthru in reset_resume callback
    - net: phy: allow for reset line to be tied to a sleepy GPIO controller
    - net: phy: fix write to mii-ctrl1000 register
    - vfs: Convert filldir[64]() from __put_user() to unsafe_put_user()
    - elf: don't use MAP_FIXED_NOREPLACE for elf executable mappings
      (regression in 4.17)
    - vfs: Make filldir[64]() verify the directory entry filename is valid
    - uaccess: implement a proper unsafe_copy_to_user() and switch filldir over
      to it
    - vfs: filldir[64]: remove WARN_ON_ONCE() for bad directory entries
    - net_sched: fix backward compatibility for TCA_KIND (regression in 5.3.4)
    - net_sched: fix backward compatibility for TCA_ACT_KIND (regression in
      5.3.4)
    - libata/ahci: Fix PCS quirk application (regression in 5.3.4)
    - md/raid0: fix warning message for parameter default_layout
    - Revert "drm/radeon: Fix EEH during kexec" (regression in 5.3.5)
    - ocfs2: fix panic due to ocfs2_wq is null
    - nvme-pci: Set the prp2 correctly when using more than 4k page
    - ipv4: fix race condition between route lookup and invalidation
    - ipv4: Return -ENETUNREACH if we can't create route but saddr is valid
    - net: avoid potential infinite loop in tc_ctl_action()
    - [hppa,m68k] net: i82596: fix dma_alloc_attr for sni_82596
    - net: ipv6: fix listify ip6_rcv_finish in case of forwarding
    - [armhf,arm64] net: stmmac: disable/enable ptp_ref_clk in suspend/resume
      flow
    - rxrpc: Fix possible NULL pointer access in ICMP handling
    - sched: etf: Fix ordering of packets with same txtime
    - sctp: change sctp_prot .no_autobind with true
    - net: aquantia: temperature retrieval fix
    - net: aquantia: when cleaning hw cache it should be toggled
    - net: aquantia: do not pass lro session with invalid tcp checksum
    - net: aquantia: correctly handle macvlan and multicast coexistence
    - net: phy: micrel: Discern KSZ8051 and KSZ8795 PHYs
    - net: phy: micrel: Update KSZ87xx PHY name
    - net: avoid errors when trying to pop MLPS header on non-MPLS packets
    - net/sched: fix corrupted L2 header with MPLS 'push' and 'pop' actions
    - netdevsim: Fix error handling in nsim_fib_init and nsim_fib_exit
    - net: ethernet: broadcom: have drivers select DIMLIB as needed
    - net: phy: Fix "link partner" information disappear issue
    - rxrpc: use rcu protection while reading sk->sk_user_data
    - io_uring: fix bad inflight accounting for SETUP_IOPOLL|SETUP_SQTHREAD
    - io_uring: Fix corrupted user_data
    - USB: legousbtower: fix memleak on disconnect
    - ALSA: hda/realtek - Add support for ALC711
    - [x86] ALSA: hda/realtek - Enable headset mic on Asus MJ401TA
    - ALSA: usb-audio: Disable quirks for BOSS Katana amplifiers
    - ALSA: hda - Force runtime PM on Nvidia HDMI codecs
    - USB: serial: ti_usb_3410_5052: fix port-close races
    - USB: ldusb: fix memleak on disconnect
    - USB: usblp: fix use-after-free on disconnect
    - USB: ldusb: fix read info leaks
    - binder: Don't modify VMA bounds in ->mmap handler
    - [mips*] tlbex: Fix build_restore_pagemask KScratch restore
    - staging: wlan-ng: fix exit return when sme->key_idx >= NUM_WEPKEYS
    - [s390x] scsi: zfcp: fix reaction on bit error threshold notification
    - scsi: sd: Ignore a failure to sync cache due to lack of authorization
    - scsi: core: save/restore command resid for error handling
    - scsi: core: try to get module before removing device
    - scsi: ch: Make it possible to open a ch device multiple times again
    - Revert "Input: elantech - enable SMBus on new (2018+) systems"
      (regression in 5.3)
    - Input: synaptics-rmi4 - avoid processing unknown IRQs
    - ACPI: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit()
    - ACPI: NFIT: Fix unlock on error in scrub_show()
    - iwlwifi: pcie: change qu with jf devices to use qu configuration
    - cfg80211: wext: avoid copying malformed SSIDs (CVE-2019-17133)
    - mac80211: Reject malformed SSID elements
    - drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50
    - drm/ttm: Restore ttm prefaulting
    - [armhf,arm64] drm/panfrost: Handle resetting on timeout better
    - drm/amdgpu: Bail earlier when amdgpu.cik_/si_support is not set to 1
    - drm/amdgpu/sdma5: fix mask value of POLL_REGMEM packet for pipe sync
    - [x86] drm/i915/userptr: Never allow userptr into the mappable GGTT
    - [x86] drm/i915: Favor last VBT child device with conflicting AUX ch/DDC
      pin
    - drm/amdgpu/vce: fix allocation size in enc ring test
    - drm/amdgpu/vcn: fix allocation size in enc ring test
    - drm/amdgpu/uvd6: fix allocation size in enc ring test (v2)
    - drm/amdgpu/uvd7: fix allocation size in enc ring test (v2)
    - drm/amdgpu: user pages array memory leak fix
    - drivers/base/memory.c: don't access uninitialized memmaps in
      soft_offline_page_store()
    - fs/proc/page.c: don't access uninitialized memmaps in fs/proc/page.c
    - io_uring: Fix broken links with offloading
    - io_uring: Fix race for sqes with userspace
    - io_uring: used cached copies of sq->dropped and cq->overflow
    - [armhf] mmc: sdhci-omap: Fix Tuning procedure for temperatures < -20C
    - mm/memory-failure.c: don't access uninitialized memmaps in
      memory_failure()
    - mm/slub: fix a deadlock in show_slab_objects()
    - mm/page_owner: don't access uninitialized memmaps when reading
      /proc/pagetypeinfo
    - mm/memunmap: don't access uninitialized memmap in memunmap_pages()
    - mm: memcg/slab: fix panic in __free_slab() caused by premature memcg
      pointer release
    - mm, compaction: fix wrong pfn handling in __reset_isolation_pfn()
    - mm: memcg: get number of pages on the LRU list in memcgroup base on
      lru_zone_size
    - mm: memblock: do not enforce current limit for memblock_phys* family
    - hugetlbfs: don't access uninitialized memmaps in
      pfn_range_valid_gigantic()
    - mm/memory-failure: poison read receives SIGKILL instead of SIGBUS if
      mmaped more than once
    - zram: fix race between backing_dev_show and backing_dev_store
    - [s390x] zcrypt: fix memleak at release
    - [s390x] kaslr: add support for R_390_GLOB_DAT relocation type
    - lib/vdso: Make clock_getres() POSIX compliant again
    - [hppa] Fix vmap memory leak in ioremap()/iounmap()
    - [arm64] KVM: Trap VM ops when ARM64_WORKAROUND_CAVIUM_TX2_219_TVM is set
    - [arm64] Avoid Cavium TX2 erratum 219 when switching TTBR
    - [arm64] Enable workaround for Cavium TX2 erratum 219 when running SMT
    - [arm64] Allow CAVIUM_TX2_ERRATUM_219 to be selected
    - CIFS: avoid using MID 0xFFFF
    - cifs: Fix missed free operations
    - CIFS: Fix use after free of file info structures
    - perf/aux: Fix AUX output stopping
    - tracing: Fix race in perf_trace_buf initialization
    - fs/dax: Fix pmd vs pte conflict detection
    - dm cache: fix bugs when a GFP_NOWAIT allocation fails
    - [riscv64] irqchip/sifive-plic: Switch to fasteoi flow
    - [amd64] boot: Make level2_kernel_pgt pages invalid outside kernel area
    - [x86] apic/x2apic: Fix a NULL pointer deref when handling a dying cpu
    - [x86] hyperv: Make vapic support x2apic mode
    - [x86] pinctrl: cherryview: restore Strago DMI workaround for all versions
    - [arm64] pinctrl: armada-37xx: fix control of pins 32 and up
    - [arm64] pinctrl: armada-37xx: swap polarity on LED group
    - btrfs: block-group: Fix a memory leak due to missing
      btrfs_put_block_group()
    - Btrfs: add missing extents release on file extent cluster relocation
      error
    - btrfs: don't needlessly create extent-refs kernel thread
    - Btrfs: fix qgroup double free after failure to reserve metadata for
      delalloc
    - Btrfs: check for the full sync flag while holding the inode lock during
      fsync
    - btrfs: tracepoints: Fix wrong parameter order for qgroup events
    - btrfs: tracepoints: Fix bad entry members of qgroup events
    - [ppc64*] KVM: Book3S HV: XIVE: Ensure VP isn't already in use
    - memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
    - cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown
    - ceph: just skip unrecognized info in ceph_reply_info_extra
    - xen/netback: fix error path of xenvif_connect_data()
    - PCI: PM: Fix pci_power_up()
    - opp: of: drop incorrect lockdep_assert_held()
    - of: reserved_mem: add missing of_node_put() for proper ref-counting
    - blk-rq-qos: fix first node deletion of rq_qos_del()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9
    - io_uring: fix up O_NONBLOCK handling for sockets
    - dm snapshot: introduce account_start_copy() and account_end_copy()
    - dm snapshot: rework COW throttling to fix deadlock
    - Btrfs: fix inode cache block reserve leak on failure to allocate data
      space
    - btrfs: qgroup: Always free PREALLOC META reserve in
      btrfs_delalloc_release_extents()
    - iio: fix center temperature of bmc150-accel-core
    - libsubcmd: Make _FORTIFY_SOURCE defines dependent on the feature
    - perf tests: Avoid raising SEGV using an obvious NULL dereference
    - perf map: Fix overlapped map handling
    - perf script brstackinsn: Fix recovery from LBR/binary mismatch
    - perf jevents: Fix period for Intel fixed counters
    - perf tools: Propagate get_cpuid() error
    - perf annotate: Propagate perf_env__arch() error
    - perf annotate: Fix the signedness of failure returns
    - perf annotate: Propagate the symbol__annotate() error return
    - perf annotate: Fix arch specific ->init() failure errors
    - perf annotate: Return appropriate error code for allocation failures
    - perf annotate: Don't return -1 for error when doing BPF disassembly
    - staging: rtl8188eu: fix null dereference when kzalloc fails
    - RDMA/hfi1: Prevent memory leak in sdma_init
    - RDMA/iw_cxgb4: fix SRQ access from dump_qp()
    - RDMA/iwcm: Fix a lock inversion issue
    - [x86] HID: hyperv: Use in-place iterator API in the channel callback
    - nfs: Fix nfsi->nrequests count error on nfs_inode_remove_request
    - [arm64] cpufeature: Effectively expose FRINT capability to userspace
    - [arm64] Fix incorrect irqflag restore for priority masking for compat
    - [arm64] ftrace: Ensure synchronisation in PLT setup for Neoverse-N1
      #1542419
    - [riscv64] serial/sifive: select SERIAL_EARLYCON
    - RDMA/core: Fix an error handling path in 'res_get_common_doit()'
    - RDMA/cm: Fix memory leak in cm_add/remove_one
    - RDMA/nldev: Reshuffle the code to avoid need to rebind QP in error path
    - RDMA/mlx5: Do not allow rereg of a ODP MR
    - RDMA/mlx5: Order num_pending_prefetch properly with synchronize_srcu
    - RDMA/mlx5: Add missing synchronize_srcu() for MW cases
    - [arm64] gpio: max77620: Use correct unit for debounce times
    - fs: cifs: mute -Wunused-const-variable message
    - [arm64] vdso32: Fix broken compat vDSO build warnings
    - [arm64] vdso32: Detect binutils support for dmb ishld
    - serial: mctrl_gpio: Check for NULL pointer
    - [armhf] serial: 8250_omap: Fix gpio check for auto RTS/CTS
    - [arm64] vdso32: Don't use KBUILD_CPPFLAGS unconditionally
    - efi/cper: Fix endianness of PCIe class code
    - [x86] efi: Do not clean dummy variable in kexec path
    - [mips*] include: Mark __cmpxchg as __always_inline
    - [riscv64] avoid kernel hangs when trapped in BUG()
    - [riscv64] avoid sending a SIGTRAP to a user thread trapped in WARN()
    - [riscv64] Correct the handling of unexpected ebreak in do_trap_break()
    - [x86] xen: Return from panic notifier
    - ocfs2: clear zero in unaligned direct IO
    - fs: ocfs2: fix possible null-pointer dereferences in
      ocfs2_xa_prepare_entry()
    - fs: ocfs2: fix a possible null-pointer dereference in
      ocfs2_write_end_nolock()
    - fs: ocfs2: fix a possible null-pointer dereference in
      ocfs2_info_scan_inode_alloc()
    - btrfs: silence maybe-uninitialized warning in clone_range
    - [arm64] armv8_deprecated: Checking return value for memory allocation
    - [x86] cpu: Add Comet Lake to the Intel CPU models header
    - sched/fair: Scale bandwidth quota and period without losing quota/period
      ratio precision
    - sched/vtime: Fix guest/system mis-accounting on task switch
    - perf/core: Rework memory accounting in perf_mmap()
    - perf/core: Fix corner case in perf_rotate_context()
    - [x86] perf/amd: Change/fix NMI latency mitigation to use a timestamp
    - drm/amdgpu: fix memory leak
    - [mips*] include: Mark __xchg as __always_inline
    - [mips*] fw: sni: Fix out of bounds init of o32 stack
    - [s390x] cio: fix virtio-ccw DMA without PV
    - [x86] virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr
    - nbd: fix possible sysfs duplicate warning
    - NFSv4: Fix leak of clp->cl_acceptor string
    - SUNRPC: fix race to sk_err after xs_error_report
    - [s390x] uaccess: avoid (false positive) compiler warnings
    - tracing: Initialize iter->seq after zeroing in tracing_read_pipe()
    - perf annotate: Fix multiple memory and file descriptor leaks
    - perf/aux: Fix tracking of auxiliary trace buffer allocation
    - USB: legousbtower: fix a signedness bug in tower_probe()
    - nbd: verify socket is supported during setup
    - [arm64] dts: qcom: Add Lenovo Miix 630
    - [arm64] dts: qcom: Add HP Envy x2
    - [arm64] dts: qcom: Add Asus NovaGo TP370QL
    - rtw88: Fix misuse of GENMASK macro
    - [s390x] pci: fix MSI message data
    - thunderbolt: Correct path indices for PCIe tunnel
    - thunderbolt: Use 32-bit writes when writing ring producer/consumer
    - fuse: flush dirty data/metadata before non-truncate setattr
    - fuse: truncate pending writes on O_TRUNC
    - ALSA: bebob: Fix prototype of helper function to return negative value
    - ALSA: timer: Fix mutex deadlock at releasing card
    - ALSA: hda/realtek - Fix 2 front mics of codec 0x623
    - ALSA: hda/realtek - Add support for ALC623
    - ath10k: fix latency issue for QCA988x
    - UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather
      segments") (regression in 5.2)
    - nl80211: fix validation of mesh path nexthop
    - USB: gadget: Reject endpoints with 0 maxpacket value
    - usb-storage: Revert commit 747668dbc061 ("usb-storage: Set
      virt_boundary_mask to avoid SG overflows") (regression in 5.2)
    - USB: ldusb: fix ring-buffer locking
    - USB: ldusb: fix control-message timeout
    - usb: xhci: fix Immediate Data Transfer endianness
    - USB: serial: whiteheat: fix potential slab corruption
    - USB: serial: whiteheat: fix line-speed endianness
    - xhci: Fix use-after-free regression in xhci clear hub TT implementation
    - scsi: qla2xxx: Fix partial flash write of MBI
    - scsi: target: cxgbit: Fix cxgbit_fw4_ack()
    - [x86] HID: i2c-hid: add Trekstor Primebook C11B to descriptor override
    - HID: Fix assumption that devices have inputs
    - HID: fix error message in hid_open_report()
    - HID: logitech-hidpp: split g920_get_config()
    - HID: logitech-hidpp: rework device validation
    - HID: logitech-hidpp: do all FF cleanup in hidpp_ff_destroy()
    - [s390x] unwind: fix mixing regs and sp
    - [s390x] cmm: fix information leak in cmm_timeout_handler()
    - [s390x] idle: fix cpu idle time calculation
    - IB/hfi1: Avoid excessive retry for TID RDMA READ request
    - [arm64] Ensure VM_WRITE|VM_SHARED ptes are clean by default
    - [arm64] cpufeature: Enable Qualcomm Falkor/Kryo errata 1003
    - virtio_ring: fix stalls for packed rings
    - rtlwifi: rtl_pci: Fix problem of too small skb->len
    - rtlwifi: Fix potential overflow on P2P code
    - [x86] KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is
      active
    - [arm64] dmaengine: qcom: bam_dma: Fix resource leak
    - [arm64] dmaengine: tegra210-adma: fix transfer failure
    - [armhf] dmaengine: imx-sdma: fix size check for sdma script_number
    - [armhf] dmaengine: cppi41: Fix cppi41_dma_prep_slave_sg() when idle
    - drm/amdgpu/gmc10: properly set BANK_SELECT and FRAGMENT_SIZE
    - [x86] drm/i915: Fix PCH reference clock for FDI on HSW/BDW
    - drm/amdgpu/gfx10: update gfx golden settings
    - drm/amdgpu/powerplay/vega10: allow undervolting in p7
    - drm/amdgpu: Fix SDMA hang when performing VKexample test
    - NFS: Fix an RCU lock leak in nfs4_refresh_delegation_stateid()
    - io_uring: ensure we clear io_kiocb->result before each issue
    - [x86] iommu/vt-d: Fix panic after kexec -p for kdump
    - batman-adv: Avoid free/alloc race when handling OGM buffer
    - llc: fix sk_buff leak in llc_sap_state_process()
    - llc: fix sk_buff leak in llc_conn_service()
    - rxrpc: Fix call ref leak
    - rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record
    - rxrpc: Fix trace-after-put looking at the put peer record
    - NFC: pn533: fix use-after-free and memleaks
    - bonding: fix potential NULL deref in bond_update_slave_arr
    - netfilter: conntrack: avoid possible false sharing
    - net: usb: sr9800: fix uninitialized local variable
    - sch_netem: fix rcu splat in netem_enqueue()
    - net: sched: sch_sfb: don't call qdisc_put() while holding tree lock
    - iwlwifi: exclude GEO SAR support for 3168
    - sched/fair: Fix low cpu usage with high throttling by removing expiration
      of cpu-local slices
    - ALSA: usb-audio: DSD auto-detection for Playback Designs
    - ALSA: usb-audio: Update DSD support quirks for Oppo and Rotel
    - ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB Interface
    - RDMA/mlx5: Use irq xarray locking for mkey_table
    - sched/fair: Fix -Wunused-but-set-variable warnings
    - [powerpc*] powernv: Fix CPU idle to be called with IRQs disabled
    - Revert "ALSA: hda: Flush interrupts on disabling" (regression in 5.3.4)

  [ Ben Hutchings ]
  * debian/bin/gencontrol_signed.py: Fix code style error
  * debian/bin/gencontrol.py: Skip linux-perf lintian-overrides if we won't
    build it
  * debian/bin/gencontrol{,_signed}.py: Use vars parameter instead of self.vars
  * debian/bin/gencontrol{,_signed}.py: Use %(name)s to format template vars
  * debian/.gitignore, debian/rules: Generalise patterns for generated files
  * gencontrol: Generalise substitution of debhelper config template
  * Add maint scripts to meta-packages to convert doc directories to symlinks
    (Closes: #942861)
  * debian/lib/python/debian_linux/utils.py: Use 'with' to manage file handles
  * debian/lib/python/debian_linux/utils.py: Store file mode for templates
  * Copy template file permissions to output files
  * debian/templates/headers.postinst.in: Set executable for consistency
  * debian/README.source: Document code signing and how to test it
  * debian/tests/control: Mark python test as superficial
  * [arm64] linux-headers: Disable check for a 32-bit compiler
    (Closes: #943953):
    - arm64: Kconfig: Make CONFIG_COMPAT_VDSO a proper Kconfig option
    - debian/bin/gencontrol.py: Optionally define $(CROSS_COMPILE_COMPAT) make
      variable
    - Enable COMPAT_VDSO and set $(CROSS_COMPILE_COMPAT) instead of setting
      CROSS_COMPILE_COMPAT_VDSO
  * crypto: Enable PKCS8_PRIVATE_KEY_PARSER as module (Closes: #924705)
  * Bump ABI to 2
  * [arm64] atmel_mxt_ts: Disable TOUCHSCREEN_ATMEL_MXT_T37 to avoid V4L
    dependency
  * random: try to actively add entropy rather than passively wait for it

  [ Bastian Blank ]
  * [amd64/cloud-amd64] Re-enable RTC drivers. (closes: #931341)

  [ Thomas W ]
  * [x86] Enable missing modules and setting:
    CONFIG_HUAWEI_WMI
    CONFIG_I2C_MULTI_INSTANTIATE
    CONFIG_INTEL_TURBO_MAX_3

  [ Alper Nebi Yasak ]
  * [arm64] udeb: Add i2c-rk3x to i2c-modules
  * [arm64,armhf] udeb: Add rockchip-io-domain to kernel-image
  * udeb: Add atmel_mxt_ts to input-modules

  [ Noah Meyerhans ]
  * drivers/net/ethernet/amazon: Backport driver fixes from v5.4-rc5

  [ Niv Sardi ]
  * KEYS: Make use of platform keyring for module signature verify
    (closes: #935945)

 -- Ben Hutchings <ben@decadent.org.uk>  Sat, 09 Nov 2019 15:42:49 +0000

linux (5.3.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.3
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4
    - mISDN: enforce CAP_NET_RAW for raw sockets (CVE-2019-17055)
    - appletalk: enforce CAP_NET_RAW for raw sockets (CVE-2019-17054)
    - ax25: enforce CAP_NET_RAW for raw sockets (CVE-2019-17052)
    - ieee802154: enforce CAP_NET_RAW for raw sockets (CVE-2019-17053)
    - nfc: enforce CAP_NET_RAW for raw sockets (CVE-2019-17056)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.5
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.6
    - nl80211: validate beacon head (CVE-2019-16746)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.7

  [ Aurelien Jarno ]
  * [riscv64] Enable SOC_SIFIVE. Do not select CLK_SIFIVE,
    CLK_SIFIVE_FU540_PRCI, SIFIVE_PLIC, SERIAL_SIFIVE and
    SERIAL_SIFIVE_CONSOLE as they are selected by SOC_SIFIVE.
  * [riscv64] Install DTBS using dtbs_install target.
  * [riscv64] Enable SPI_SIFIVE.
  * [riscv64] Enable SERIAL_EARLYCON_RISCV_SBI.
  * [riscv64] Enable MMC, MMC_SPI.
  * [riscv64] udeb: Add mmc-core-modules and mmc-modules.
  * [riscv64] Fix memblock reservation for device tree blob.
  * [riscv64] Clear load reservations while restoring hart contexts.

  [ Ben Hutchings ]
  * [mips*] Revert "Only define MAX_PHYSMEM_BITS on Loongson-3"
  * KEYS: Re-enable SECONDARY_TRUSTED_KEYRING, dropped in 5.2.6-1 by
    mis-merge (Closes: #935945)

  [ John Paul Adrian Glaubitz ]
  * [m68k] Enable CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
  * [hppa] Enable CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
  * [sh4] Enable CONFIG_CRYPTO_MANAGER_DISABLE_TESTS

  [ Salvatore Bonaccorso ]
  * RDMA/cxgb4: Do not dma memory off of the stack (CVE-2019-17075)
  * ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()
    (CVE-2019-15098)

  [ Romain Perier ]
  * [armel/rpi] Enable CONFIG_BRCMFMAC_SDIO (Closes: #940530)

  [ Héctor Orón Martínez ]
  * [x86] Enable ASoC: SOF sound driver (Closes: #940726)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 20 Oct 2019 00:56:32 +0200

linux (5.3.2-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.3
    - [armhf] select the dma-noncoherent symbols for all swiotlb builds
      (fixes FTBFS)
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.2

  [ Ben Hutchings ]
  * [hppa,sparc64] udeb: Delete osst from scsi-modules (fixes FTBFS)
  * Compile with gcc-9 on all architectures
  * Set KCFLAGS make variable instead of CFLAGS_{KERNEL,MODULE}
  * linux-image-dbg: Delete ./ from source file names in debug info
  * debian/rules: Make maintainerclean delete (almost) everything clean does
  * debian/rules: Make maintainerclean delete everything gencontrol.py creates
  * debian/.gitignore: Synchronise some patterns with clean target
  * Add the metapackages previously built by src:linux-latest:
    - Add template and NEWS files from linux-latest
    - Rename added templates to be consistent with existing templates
    - Fix some inconsistencies in metapackage templates
    - Define pkg.linux.nometa build profile to exclude the metapackages
    - Build the metapackages by default (Closes: #583849, #941042)
    - Make linux-perf an arch-dependent package
    - Require metapackage dependencies to be the same version, and link doc
      dirs

  [ Uwe Kleine-König ]
  * [arm64] enable I2C_QCOM_GENI for Lenovo C630

 -- Ben Hutchings <ben@decadent.org.uk>  Wed, 02 Oct 2019 05:31:27 +0100

linux (5.3~rc5-1~exp2) experimental; urgency=medium

  * tools/perf: pmu-events: Fix reproducibility
  * Fix FTBFS:
    - Update "kbuild: Make the toolchain variables easily overwritable" for 5.3
    - udeb: Make nic-wireless-modules depend on crypto-modules
  * debian/control: Remove build profile qual for rsync, needed for
    headers_install
  * debian/changelog: Move older entries to changelog.old

 -- Ben Hutchings <ben@decadent.org.uk>  Sun, 25 Aug 2019 16:28:41 +0100

linux (5.3~rc5-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Ben Hutchings ]
  * aufs: Update support patchset to aufs5.x-rcN 20190805
  * [rt] Disable until it is updated for 5.3 or later
  * [powerpcspe] Remove all support for powerpcspe, which is dead upstream
  * linux-headers: Change per-flavour Makefile to match upstream out-of-tree
    builds
  * debian/bin/genorig.py: Import debian.deb822 instead of deprecated deb822
  * [arm64] Use armhf cross-compiler for building compat vDSO
  * Documentation: Fix broken link to CIPSO draft

  [ Lubomir Rintel ]
  * udeb: input-modules: Add OLPC AP-SP keyboard
  * [armhf] Add camera, EC and battery drivers for OLPC XO-1.75 laptop.

 -- Ben Hutchings <ben@decadent.org.uk>  Sat, 24 Aug 2019 19:07:56 +0100

linux (5.2.17-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.10
    - KEYS: trusted: allow module init if TPM is inactive or deactivated
    - seq_file: fix problem when seeking mid-record
    - mm/hmm: fix bad subpage pointer in try_to_unmap_one
    - mm: mempolicy: make the behavior consistent when MPOL_MF_MOVE* and
      MPOL_MF_STRICT were specified
    - mm: mempolicy: handle vma with unmovable pages mapped correctly in mbind
    - mm/z3fold.c: fix z3fold_destroy_pool() ordering
    - mm/z3fold.c: fix z3fold_destroy_pool() race condition
    - mm/memcontrol.c: fix use after free in mem_cgroup_iter()
    - mm/usercopy: use memory range to be accessed for wraparound check
    - mm, vmscan: do not special-case slab reclaim when watermarks are boosted
    - [armhf,arm64] cpufreq: schedutil: Don't skip freq update when limits
      change
    - drm/amdgpu: fix gfx9 soft recovery
    - drm/nouveau: Only recalculate PBN/VCPI on mode/connector changes
    - [arm64] ftrace: Ensure module ftrace trampoline is coherent with I-side
    - [x86] ALSA: hda/realtek - Add quirk for HP Envy x360
    - ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
      (CVE-2019-15118)
    - ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
      (CVE-2019-15117)
    - [x86] ALSA: hda - Apply workaround for another AMD chip 1022:1487
    - ALSA: hda - Fix a memory leak bug
    - ALSA: hda - Add a generic reboot_notify
    - ALSA: hda - Let all conexant codec enter D3 when rebooting
    - HID: holtek: test for sanity of intfdata
    - HID: hiddev: avoid opening a disconnected device
    - HID: hiddev: do cleanup in failure of opening a device
    - Input: kbtab - sanity check for endpoint type
    - Input: iforce - add sanity checks
    - net: usb: pegasus: fix improper read if get_registers() fail
    - bpf: fix access to skb_shared_info->gso_segs
    - netfilter: ebtables: also count base chain policies
    - [riscv64] Correct the initialized flow of FP register
    - [riscv64] Make __fstate_clean() work correctly.
    - [armhf] Revert "i2c: imx: improve the error handling in
      i2c_imx_dma_request()"
    - blk-mq: move cancel of requeue_work to the front of blk_exit_queue
    - io_uring: fix manual setup of iov_iter for fixed buffers
    - [arm64] RDMA/hns: Fix sg offset non-zero issue
    - IB/mlx5: Replace kfree with kvfree
    - dma-mapping: check pfn validity in dma_common_{mmap,get_sgtable}
    - [x87] platform: intel_pmc_core: Add ICL-NNPI support to PMC Core
    - mm/hmm: always return EBUSY for invalid ranges in
      hmm_range_{fault,snapshot}
    - [armhf,arm64] irqchip/gic-v3-its: Free unused vpt_page when alloc vpe
      table fail
    - [armhf] irqchip/irq-imx-gpcv2: Forward irq type to parent
    - f2fs: fix to read source block before invalidating it
    - tools perf beauty: Fix usbdevfs_ioctl table generator to handle _IOC()
    - perf header: Fix divide by zero error if f_header.attr_size==0
    - perf header: Fix use of unitialized value warning
    - RDMA/qedr: Fix the hca_type and hca_rev returned in device attributes
    - ALSA: pcm: fix lost wakeup event scenarios in snd_pcm_drain
    - libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
    - Btrfs: fix deadlock between fiemap and transaction commits
    - scsi: hpsa: correct scsi command status issue after reset
    - scsi: qla2xxx: Fix possible fcport null-pointer dereferences
    - drm/amdkfd: Fix byte align on VegaM
    - drm/amd/powerplay: fix null pointer dereference around dpm state relates
    - drm/amdgpu: fix error handling in amdgpu_cs_process_fence_dep
    - drm/amdgpu: fix a potential information leaking bug
    - ata: libahci: do not complain in case of deferred probe
    - [riscv64] Fix perf record without libelf support
    - [arm64] Lower priority mask for GIC_PRIO_IRQON
    - [arm64] unwind: Prohibit probing on return_address()
    - IB/core: Add mitigation for Spectre V1 (CVE-2017-5753)
    - IB/mlx5: Fix MR registration flow to use UMR properly
    - RDMA/restrack: Track driver QP types in resource tracker
    - IB/mad: Fix use-after-free in ib mad completion handling
    - RDMA/mlx5: Release locks during notifier unregister
    - [arm64] drm: msm: Fix add_gpu_components
    - [arm64] RDMA/hns: Fix error return code in hns_roce_v1_rsv_lp_qp()
    - [armhf] drm/exynos: fix missing decrement of retry counter
    - [arm64] kprobes: Recover pstate.D in single-step exception handler
    - [arm64] Make debug exception handlers visible from RCU
    - Revert "kmemleak: allow to coexist with fault injection"
    - ocfs2: remove set but not used variable 'last_hash'
    - page flags: prioritize kasan bits over last-cpuid
    - asm-generic: fix -Wtype-limits compiler warnings
    - tpm: tpm_ibm_vtpm: Fix unallocated banks
    - [arm64] KVM: regmap: Fix unexpected switch fall-through
    - [x86] staging: comedi: dt3000: Fix signed integer overflow 'divider *
      base'
    - [x86] staging: comedi: dt3000: Fix rounding up of timer divisor
    - USB: core: Fix races in character device registration and deregistraion
    - usb: cdc-acm: make sure a refcount is taken early enough
    - USB: CDC: fix sanity checks in CDC union parser
    - USB: serial: option: add D-Link DWM-222 device ID
    - USB: serial: option: Add support for ZTE MF871A
    - USB: serial: option: add the BroadMobi BM818 card
    - USB: serial: option: Add Motorola modem UARTs
    - usb: setup authorized_default attributes using usb_bus_notify
    - netfilter: conntrack: Use consistent ct id hash calculation
    - iwlwifi: Add support for SAR South Korea limitation
    - Input: psmouse - fix build error of multiple definition
    - bnx2x: Fix VF's VLAN reconfiguration in reload.
    - bonding: Add vlan tx offload to hw_enc_features
    - [armhf,arm64] net: dsa: Check existence of .port_mdb_add callback before
      calling it
    - net/mlx4_en: fix a memory leak bug
    - net/packet: fix race in tpacket_snd()
    - net: sched: sch_taprio: fix memleak in error path for sched list parse
    - sctp: fix memleak in sctp_send_reset_streams
    - sctp: fix the transport error_count check
    - team: Add vlan tx offload to hw_enc_features
    - tipc: initialise addr_trail_end when setting node addresses
    - xen/netback: Reset nr_frags before freeing skb
    - net/mlx5e: Only support tx/rx pause setting for port owner
    - bnxt_en: Fix VNIC clearing logic for 57500 chips.
    - bnxt_en: Improve RX doorbell sequence.
    - bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails
    - bnxt_en: Suppress HWRM errors for HWRM_NVM_GET_VARIABLE command
    - bnxt_en: Use correct src_fid to determine direction of the flow
    - bnxt_en: Fix to include flow direction in L2 key
    - net sched: update skbedit action for batched events operations
    - netdevsim: Restore per-network namespace accounting for fib entries
    - net/mlx5e: ethtool, Avoid setting speed to 56GBASE when autoneg off
    - net/mlx5e: Fix false negative indication on tx reporter CQE recovery
    - net/mlx5e: Remove redundant check in CQE recovery flow of tx reporter
    - net/mlx5e: Use flow keys dissector to parse packets for ARFS
    - net/tls: prevent skb_orphan() from leaking TLS plain text with offload
    - net: phy: consider AN_RESTART status when reading link status
    - netlink: Fix nlmsg_parse as a wrapper for strict message parsing
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.11
    - ASoC: simple_card_utils.h: care NULL dai at asoc_simple_debug_dai()
    - ASoC: simple-card: fix an use-after-free in simple_dai_link_of_dpcm()
    - ASoC: simple-card: fix an use-after-free in simple_for_each_link()
    - ASoC: audio-graph-card: fix use-after-free in graph_dai_link_of_dpcm()
    - ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id()
    - ASoC: audio-graph-card: add missing const at graph_get_dai_id()
    - regulator: axp20x: fix DCDCA and DCDCD for AXP806
    - regulator: axp20x: fix DCDC5 and DCDC6 for AXP803
    - [armhf] ASoC: samsung: odroid: fix an use-after-free issue for codec
    - [armhf] ASoC: samsung: odroid: fix a double-free issue for cpu_dai
    - [x86] ASoC: Intel: bytcht_es8316: Add quirk for Irbis NB41 netbook
    - HID: logitech-hidpp: add USB PID for a few more supported mice
    - HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
    - [mips*] kernel: only use i8253 clocksource with periodic clockevent
    - [mips*] fix cacheinfo
    - libbpf: sanitize VAR to conservative 1-byte INT
    - netfilter: ebtables: fix a memory leak bug in compat
    - ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks
    - [amd64] spi: pxa2xx: Balance runtime PM enable/disable on error
    - bpf: sockmap, sock_map_delete needs to use xchg
    - bpf: sockmap, synchronize_rcu before free'ing map
    - bpf: sockmap, only create entry if ulp is not already enabled
    - ASoC: dapm: fix a memory leak bug
    - bonding: Force slave speed check after link state recovery for 802.3ad
    - [armhf,arm64] net: mvpp2: Don't check for 3 consecutive Idle frames for
      10G links
    - libbpf: fix using uninitialized ioctl results
    - can: dev: call netif_carrier_off() in register_candev()
    - can: gw: Fix error path of cgw_module_init
    - libbpf: silence GCC8 warning about string truncation
    - {nl,mac}80211: fix interface combinations on crypto controlled devices
    - [armhf] ASoC: ti: davinci-mcasp: Fix clk PDIR handling for i2s master
      mode
    - [armhf,arm64] ASoC: rockchip: Fix mono capture
    - [armhf] ASoC: ti: davinci-mcasp: Correct slot_width posed constraint
    - net: usb: qmi_wwan: Add the BroadMobi BM818 card
    - qed: RDMA - Fix the hw_ver returned in device attributes
    - isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in
      start_isoc_chain()
    - mac80211_hwsim: Fix possible null-pointer dereferences in
      hwsim_dump_radio_nl()
    - [armhf,arm64] net: stmmac: manage errors returned by of_get_mac_address()
    - netfilter: ipset: Actually allow destination MAC address for hash:ip,mac
      sets too
    - netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and
      hash:ip,mac sets
    - netfilter: ipset: Fix rename concurrency with listing
    - rxrpc: Fix potential deadlock
    - rxrpc: Fix the lack of notification when sendmsg() fails on a DATA packet
    - nvmem: Use the same permissions for eeprom as for nvmem
    - iwlwifi: mvm: avoid races in rate init and rate perform
    - iwlwifi: dbg_ini: move iwl_dbg_tlv_load_bin out of debug override ifdef
    - iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
    - iwlwifi: fix locking in delayed GTK setting
    - iwlwifi: mvm: send LQ command always ASYNC
    - isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the
      stack
    - net: phy: phy_led_triggers: Fix a possible null-pointer dereference in
      phy_led_trigger_change_speed()
    - perf bench numa: Fix cpu0 binding
    - [arm64] spi: pxa2xx: Add support for Intel Tiger Lake
    - can: sja1000: force the string buffer NULL-terminated
    - can: peak_usb: force the string buffer NULL-terminated
    - [x86] ASoC: amd: acp3x: use dma_ops of parent device for acp3x dma driver
    - net/ethernet/qlogic/qed: force the string buffer NULL-terminated
    - NFSv4: Fix a credential refcount leak in nfs41_check_delegation_stateid
    - NFSv4: When recovering state fails with EAGAIN, retry the same recovery
    - NFSv4.1: Fix open stateid recovery
    - NFSv4.1: Only reap expired delegations
    - NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()
    - NFS: Fix regression whereby fscache errors are appearing on 'nofsc'
      mounts
    - HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE quirk on Saitek X52
    - HID: input: fix a4tech horizontal wheel custom usage
    - [armhf,arm64] drm/rockchip: Suspend DP late
    - SMB3: Fix potential memory leak when processing compound chain
    - SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL
    - sched/deadline: Fix double accounting of rq/running bw in push & pull
    - sched/psi: Reduce psimon FIFO priority
    - sched/psi: Do not require setsched permission from the trigger creator
    - [s390x] protvirt: avoid memory sharing for diag 308 set/store
    - [s390x] mm: fix dump_pagetables top level page table walking
    - [s390x] put _stext and _etext into .text section
    - net: cxgb3_main: Fix a resource leak in a error path in 'init_one()'
    - [armhf,arm64] net: stmmac: Fix issues when number of Queues >= 4
    - [armhf,arm64] net: stmmac: tc: Do not return a fragment entry
    - drm/amdgpu: pin the csb buffer on hw init for gfx v8
    - [arm64] net: hisilicon: make hip04_tx_reclaim non-reentrant
    - [arm64] net: hisilicon: fix hip04-xmit never return TX_BUSY
    - [arm64] net: hisilicon: Fix dma_map_single failed on arm64
    - NFSv4: Ensure state recovery handles ETIMEDOUT correctly
    - libata: have ata_scsi_rw_xlat() fail invalid passthrough requests
    - libata: add SG safety checks in SFF pio transfers
    - [x86] lib/cpu: Address missing prototypes warning
    - [x86] drm/vmwgfx: fix memory leak when too many retries have occurred
    - block: aoe: Fix kernel crash due to atomic sleep when exiting
    - block, bfq: handle NULL return value by bfq_init_rq()
    - perf ftrace: Fix failure to set cpumask when only one cpu is present
    - perf cpumap: Fix writing to illegal memory in handling cpumap mask
    - perf pmu-events: Fix missing "cpu_clk_unhalted.core" event
    - [riscv64] dt-bindings: fix the schema compatible string for the HiFive
      Unleashed board
    - [arm64] KVM: Don't write junk to sysregs on reset
    - [armhf] KVM: Don't write junk to CP15 registers on reset
    - iwlwifi: mvm: disable TX-AMSDU on older NICs (Closes: #939853)
    - HID: wacom: correct misreported EKR ring values
    - HID: wacom: Correct distance scale for 2nd-gen Intuos devices
    - [x86] Revert "KVM: x86/mmu: Zap only the relevant pages when removing a
      memslot" (regression in 5.1)
    - Revert "dm bufio: fix deadlock with loop device" (regression in 5.2.3)
    - [armhf] clk: socfpga: stratix10: fix rate caclulationg for cnt_clks
    - ceph: clear page dirty before invalidate page
    - ceph: don't try fill file_lock on unsuccessful GETFILELOCK reply
    - libceph: fix PG split vs OSD (re)connect race
    - drm/amdgpu/gfx9: update pg_flags after determining if gfx off is possible
    - drm/nouveau: Don't retry infinitely when receiving no data on i2c over
      AUX
    - scsi: ufs: Fix NULL pointer dereference in ufshcd_config_vreg_hpm()
    - gpiolib: never report open-drain/source lines as 'input' to user-space
    - [x86] Drivers: hv: vmbus: Fix virt_to_hvpfn() for X86_PAE
    - userfaultfd_release: always remove uffd flags and clear
      vm_userfaultfd_ctx
    - [i386] retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386
    - [x86] apic: Handle missing global clockevent gracefully
    - [x86] CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h
    - [x86] boot: Save fields explicitly, zero out everything else
    - [x86] boot: Fix boot regression caused by bootparam sanitizing
    - IB/hfi1: Unsafe PSN checking for TID RDMA READ Resp packet
    - IB/hfi1: Add additional checks when handling TID RDMA READ RESP packet
    - IB/hfi1: Add additional checks when handling TID RDMA WRITE DATA packet
    - IB/hfi1: Drop stale TID RDMA packets that cause TIDErr
    - psi: get poll_work to run when calling poll syscall next time
    - dm kcopyd: always complete failed jobs
    - dm btree: fix order of block initialization in btree_split_beneath
    - dm integrity: fix a crash due to BUG_ON in __journal_read_write()
    - dm raid: add missing cleanup in raid_ctr()
    - dm space map metadata: fix missing store of apply_bops() return value
    - dm table: fix invalid memory accesses with too high sector number
    - dm zoned: improve error handling in reclaim
    - dm zoned: improve error handling in i/o map code
    - dm zoned: properly handle backing device failure
    - genirq: Properly pair kobject_del() with kobject_add()
    - mm/z3fold.c: fix race between migration and destruction
    - mm, page_alloc: move_freepages should not examine struct page of reserved
      memory
    - mm: memcontrol: flush percpu vmstats before releasing memcg
    - mm: memcontrol: flush percpu vmevents before releasing memcg
    - mm, page_owner: handle THP splits correctly
    - mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely
    - mm/zsmalloc.c: fix race condition in zs_destroy_pool
    - IB/hfi1: Drop stale TID RDMA packets
    - dm zoned: fix potential NULL dereference in dmz_do_reclaim()
    - io_uring: fix potential hang with polled IO
    - io_uring: don't enter poll loop if we have CQEs pending
    - io_uring: add need_resched() check in inner poll loop
    - [powerpc*] Allow flush_(inval_)dcache_range to work across ranges >4GB
    - rxrpc: Fix local endpoint refcounting
    - rxrpc: Fix read-after-free in rxrpc_queue_local()
    - rxrpc: Fix local endpoint replacement
    - rxrpc: Fix local refcounting
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.12
    - nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns
    - afs: Fix the CB.ProbeUuid service handler to reply correctly
    - afs: Fix loop index mixup in afs_deliver_vl_get_entry_by_name_u()
    - fs: afs: Fix a possible null-pointer dereference in afs_put_read()
    - afs: Fix off-by-one in afs_rename() expected data version calculation
    - afs: Only update d_fsdata if different in afs_d_revalidate()
    - afs: Fix missing dentry data version updating
    - nvmet: Fix use-after-free bug when a port is removed
    - nvmet-loop: Flush nvme_delete_wq when removing the port
    - nvmet-file: fix nvmet_file_flush() always returning an error
    - nvme-core: Fix extra device_put() call on error path
    - nvme: fix a possible deadlock when passthru commands sent to a multipath
      device
    - nvme-rdma: fix possible use-after-free in connect error flow
    - nvme: fix controller removal race with scan work
    - nvme-pci: Fix async probe remove race
    - btrfs: trim: Check the range passed into to prevent overflow
    - IB/mlx5: Fix implicit MR release flow
    - [armhf] omap-dma/omap_vout_vrfb: fix off-by-one fi value
    - iommu/dma: Handle SG length overflow better
    - dma-direct: don't truncate dma_required_mask to bus addressing
      capabilities
    - usb: gadget: composite: Clear "suspended" on reset/disconnect
    - usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt
    - xen/blkback: fix memory leaks
    - [arm64] cpufeature: Don't treat granule sizes as strict
    - [riscv64] fix flush_tlb_range() end address for flush_tlb_page()
    - drm/scheduler: use job count instead of peek
    - drm/ast: Fixed reboot test may cause system hanged
    - [x86] tools: hv: fix KVP and VSS daemons exit code
    - locking/rwsem: Add missing ACQUIRE to read_slowpath exit when queue is
      empty
    - lcoking/rwsem: Add missing ACQUIRE to read_slowpath sleep loop
    - [arm*] watchdog: bcm2835_wdt: Fix module autoload
    - mt76: usb: fix rx A-MSDU support
    - ipv6/addrconf: allow adding multicast addr if IFA_F_MCAUTOJOIN is set
    - ipv6: Fix return value of ipv6_mc_may_pull() for malformed packets
      (regression in 5.1)
    - [armhf] net: cpsw: fix NULL pointer exception in the probe error path
    - net: fix __ip_mc_inc_group usage
    - net/smc: make sure EPOLLOUT is raised
    - tcp: make sure EPOLLOUT wont be missed
    - ipv4: mpls: fix mpls_xmit for iptunnel
    - openvswitch: Fix conntrack cache with timeout
    - ipv4/icmp: fix rt dst dev null pointer dereference
    - xfrm/xfrm_policy: fix dst dev null pointer dereference in collect_md mode
    - mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
    - ALSA: usb-audio: Check mixer unit bitmap yet more strictly
    - ALSA: hda/ca0132 - Add new SBZ quirk
    - ALSA: line6: Fix memory leak at line6_init_pcm() error path
    - ALSA: hda - Fixes inverted Conexant GPIO mic mute led
    - ALSA: seq: Fix potential concurrent access to the deleted pool
    - ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate()
    - ALSA: usb-audio: Add implicit fb quirk for Behringer UFX1604
    - [x86] kvm: skip populating logical dest map if apic is not sw enabled
    - [x86] KVM: hyper-v: don't crash on KVM_GET_SUPPORTED_HV_CPUID when
      kvm_intel.nested is disabled
    - [x86] KVM: Don't update RIP or do single-step on faulting emulation
    - [x86] uprobes: Fix detection of 32-bit user mode
    - [x86] mm/cpa: Prevent large page split when ftrace flips RW on kernel text
    - [x86] apic: Do not initialize LDR and DFR for bigsmp
    - [x86] apic: Include the LDR when clearing out APIC registers
    - HID: logitech-hidpp: remove support for the G700 over USB
    - ftrace: Fix NULL pointer dereference in t_probe_next()
    - ftrace: Check for successful allocation of hash
    - ftrace: Check for empty hash and comment the race with registering probes
    - usbtmc: more sanity checking for packet size
    - usb-storage: Add new JMS567 revision to unusual_devs
    - USB: cdc-wdm: fix race between write and disconnect due to flag abuse
    - usb: hcd: use managed device resources
    - [armhf,arm64] usb: chipidea: udc: don't do hardware access if gadget has
      stopped
    - usb: host: ohci: fix a race condition between shutdown and irq
    - USB: storage: ums-realtek: Whitelist auto-delink support
    - [x86] tools/power turbostat: Fix caller parameter of get_tdp_amd()
    - [powerpc*] KVM: Book3S: Fix incorrect guest-to-user-translation error
      handling
    - [armhf,arm64] KVM: vgic: Fix potential deadlock when ap_list is long
    - [armhf,arm64] KVM: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
    - [x86] mei: me: add Tiger Lake point LP device ID
    - [armhf,arm64] Revert "mmc: sdhci-tegra: drop ->get_ro() implementation"
      (regression in 5.1)
    - mmc: core: Fix init of SD cards reporting an invalid VDD range
    - [x86] intel_th: pci: Add support for another Lewisburg PCH
    - [x86] intel_th: pci: Add Tiger Lake support
    - [x86] typec: tcpm: fix a typo in the comparison of pdo_max_voltage
    - NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
    - NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0
    - Revert "NFSv4/flexfiles: Abort I/O early if the layout segment was
      invalidated" (regression in 5.1)
    - lib: logic_pio: Fix RCU usage
    - lib: logic_pio: Avoid possible overlap for unregistering regions
    - lib: logic_pio: Add logic_pio_unregister_range()
    - drm/amdgpu: Add APTX quirk for Dell Latitude 5495
    - drm/amdgpu: fix GFXOFF on Picasso and Raven2
    - [x86] drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest
    - [x86] drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe()
    - i2c: piix4: Fix port selection for AMD Family 16h Model 30h
    - [arm64] bus: hisi_lpc: Unregister logical PIO range to avoid potential
      use-after-free
    - [arm64] bus: hisi_lpc: Add .remove method to avoid driver unbind crash
    - [x86] VMCI: Release resource if the work is already queued
    - [x86] crypto: ccp - Ignore unconfigured CCP device on suspend/resume
    - SUNRPC: Don't handle errors if the bind/connect succeeded
    - mt76: mt76x0u: do not reset radio on resume
    - mm, memcg: partially revert "mm/memcontrol.c: keep local VM counters in
      sync with the hierarchical ones" (regression in 5.2.7)
    - mm: memcontrol: fix percpu vmstats and vmevents flush
    - mac80211: fix possible sta leak
    - cfg80211: Fix Extended Key ID key install checks
    - mac80211: Don't memset RXCB prior to PAE intercept
    - mac80211: Correctly set noencrypt for PAE frames
    - iwlwifi: add new cards for 22000 and fix struct name
    - iwlwifi: add new cards for 22000 and change wrong structs
    - iwlwifi: add new cards for 9000 and 20000 series
    - iwlwifi: change 0x02F0 fw from qu to quz
    - iwlwifi: pcie: add support for qu c-step devices
    - iwlwifi: pcie: don't switch FW to qnj when ax201 is detected
    - iwlwifi: pcie: handle switching killer Qu B0 NICs to C0
    - [x86] drm/i915: Do not create a new max_bpc prop for MST connectors
    - [x86] drm/i915/dp: Fix DSC enable code to use cpu_transcoder instead of
      encoder->type
    - [x86] ptrace: fix up botched merge of spectrev1 fix
    - bpf: fix use after free in prog symbol exposure
    - hsr: implement dellink to clean up resources
    - hsr: fix a NULL pointer deref in hsr_dev_xmit()
    - hsr: switch ->dellink() to ->ndo_uninit()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.13
    - Revert "Input: elantech - enable SMBus on new (2018+) systems"
      (regression in 5.2.9)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.14
    - mld: fix memory leak in mld_del_delrec()
    - net: fix skb use after free in netpoll
    - net: sched: act_sample: fix psample group handling on overwrite
    - net_sched: fix a NULL pointer deref in ipt action
    - [arm64, armhf] net: stmmac: dwmac-rk: Don't fail if phy regulator is
      absent
    - tcp: inherit timestamp on mtu probe
    - tcp: remove empty skb from write queue in error cases
    - Revert "r8152: napi hangup fix after disconnect"
    - r8152: remove calling netif_napi_del
    - net/sched: cbs: Set default link speed to 10 Mbps in cbs_set_port_rate
    - Add genphy_c45_config_aneg() function to phy-c45.c
    - net/sched: pfifo_fast: fix wrong dereference in pfifo_fast_enqueue
    - net/sched: pfifo_fast: fix wrong dereference when qdisc is reset
    - net/rds: Fix info leak in rds6_inc_info_copy() (CVE-2019-16714)
    - batman-adv: Fix netlink dumping of all mcast_flags buckets
    - libbpf: fix erroneous multi-closing of BTF FD
    - libbpf: set BTF FD for prog only when there is supported .BTF.ext data
    - netfilter: nf_flow_table: fix offload for flows that are subject to xfrm
    - net/mlx5e: Fix error flow of CQE recovery on tx reporter
    - [armhf] clk: samsung: Change signature of exynos5_subcmus_init() function
    - [armhf] clk: samsung: exynos5800: Move MAU subsystem clocks to MAU sub-CMU
    - [armhf] clk: samsung: exynos542x: Move MSCL subsystem clocks to its
      sub-CMU
    - netfilter: nf_tables: use-after-free in failing rule with bound set
    - netfilter: nf_flow_table: conntrack picks up expired flows
    - netfilter: nf_flow_table: teardown flow timeout race
    - tools: bpftool: fix error message (prog -> object)
    - ixgbe: fix possible deadlock in ixgbe_service_task()
    - [x86] hv_netvsc: Fix a warning of suspicious RCU usage
    - net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
    - Bluetooth: btqca: Add a short delay before downloading the NVM
    - Bluetooth: hci_qca: Send VS pre shutdown command.
    - [s390x] qeth: serialize cmd reply with concurrent timeout
    - ibmveth: Convert multicast list size for little-endian system
    - gpio: Fix build error of function redefinition
    - netfilter: nft_flow_offload: skip tcp rst and fin packets
    - scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure
    - scsi: target: tcmu: avoid use-after-free after command timeout
    - cxgb4: fix a memory leak bug
    - liquidio: add cleanup in octeon_setup_iq()
    - net: myri10ge: fix memory leaks
    - clk: Fix falling back to legacy parent string matching
    - clk: Fix potential NULL dereference in clk_fetch_parent_index()
    - lan78xx: Fix memory leaks
    - vfs: fix page locking deadlocks when deduping files
    - cx82310_eth: fix a memory leak bug
    - net: kalmia: fix memory leaks
    - net: cavium: fix driver name
    - wimax/i2400m: fix a memory leak bug
    - sched/core: Schedule new worker even if PI-blocked
    - kprobes: Fix potential deadlock in kprobe_optimizer()
    - [x86] HID: intel-ish-hid: ipc: add EHL device id
    - HID: cp2112: prevent sleeping function called from invalid context
    - [x86] boot/compressed/64: Fix boot on machines with broken E820 table
    - scsi: lpfc: Mitigate high memory pre-allocation by SCSI-MQ
    - [x86] Input: hyperv-keyboard: Use in-place iterator API in the channel
      callback
    - Tools: hv: kvp: eliminate 'may be used uninitialized' warning
    - nvme-multipath: fix possible I/O hang when paths are updated
    - nvme: Fix cntlid validation when not using NVMEoF
    - RDMA/cma: fix null-ptr-deref Read in cma_cleanup
    - IB/mlx4: Fix memory leaks
    - [x86] infiniband: hfi1: fix a memory leak bug
    - [x86] infiniband: hfi1: fix memory leaks
    - drm/amdgpu: prevent memory leaks in AMDGPU_CS ioctl
    - ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
    - ceph: fix buffer free while holding i_ceph_lock in
      __ceph_build_xattrs_blob()
    - ceph: fix buffer free while holding i_ceph_lock in fill_inode()
    - [arm64, armhf] KVM: Only skip MMIO insn once
    - afs: Fix leak in afs_lookup_cell_rcu()
    - afs: Fix possible oops in afs_lookup trace event
    - afs: use correct afs_call_type in yfs_fs_store_opaque_acl2
    - RDMA/bnxt_re: Fix stack-out-of-bounds in bnxt_qplib_rcfw_send_message
    - gpio: Fix irqchip initialization order
    - [arm64, armhf] KVM: VGIC: Properly initialise private IRQ affinity
    - [x86] boot/compressed/64: Fix missing initialization in
      find_trampoline_placement()
    - libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
    - [x86] Revert "x86/apic: Include the LDR when clearing out APIC registers"
    - [x86] boot: Preserve boot_params.secure_boot from sanitizing
    - Revert "mmc: core: do not retry CMD6 in __mmc_switch()"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.15
    - gpio: pca953x: correct type of reg_direction
    - gpio: pca953x: use pca953x_read_regs instead of regmap_bulk_read
    - ALSA: hda - Fix potential endless loop at applying quirks
    - ALSA: hda/realtek - Fix overridden device-specific initialization
    - ALSA: hda/realtek - Add quirk for HP Pavilion 15
    - ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS UX431FL
    - ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre
    - sched/fair: Don't assign runtime for throttled cfs_rq
    - [x86] drm/vmwgfx: Fix double free in vmw_recv_msg()
    - drm/nouveau/sec2/gp102: add missing MODULE_FIRMWAREs
    - [powerpc*] 64e: Drop stale call to smp_processor_id() which hangs SMP
      startup
    - [powerpc*] tm: Fix restoring FP/VMX facility incorrectly on interrupts
      (CVE-2019-15031)
    - batman-adv: fix uninit-value in batadv_netlink_get_ifindex()
    - batman-adv: Only read OGM tvlv_len after buffer len check
    - bcache: only clear BTREE_NODE_dirty bit when it is set
    - bcache: add comments for mutex_lock(&b->write_lock)
    - bcache: fix race in btree_flush_write()
    - IB/rdmavt: Add new completion inline
    - IB/{rdmavt, qib, hfi1}: Convert to new completion API
    - IB/hfi1: Unreserve a flushed OPFN request
    - [x86] drm/i915: Disable SAMPLER_STATE prefetching on all Gen11 steppings.
    - [x86] drm/i915: Make sure cdclk is high enough for DP audio on VLV/CHV
    - mmc: sdhci-sprd: Fix the incorrect soft reset operation when runtime
      resuming
    - usb: chipidea: imx: add imx7ulp support
    - usb: chipidea: imx: fix EPROBE_DEFER support during driver probe
    - [s390x] virtio: fix race on airq_areas[]
    - [x86] drm/i915: Support flags in whitlist WAs
    - [x86] drm/i915: Support whitelist workarounds on all engines
    - [x86] drm/i915: whitelist PS_(DEPTH|INVOCATION)_COUNT
    - [x86] drm/i915: Add whitelist workarounds for ICL
    - [x86] drm/i915/icl: whitelist PS_(DEPTH|INVOCATION)_COUNT
    - Btrfs: fix unwritten extent buffers and hangs on future writeback
      attempts (Closes: #940105)
    - vhost: make sure log_num < in_num (CVE-2019-14835)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.16
    - bridge/mdb: remove wrong use of NLM_F_MULTI
    - cdc_ether: fix rndis support for Mediatek based smartphones
    - ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
    - isdn/capi: check message length in capi_write()
    - ixgbe: Fix secpath usage for IPsec TX offload.
    - ixgbevf: Fix secpath usage for IPsec Tx offload
    - net: Fix null de-reference of device refcount
    - net: gso: Fix skb_segment splat when splitting gso_size mangled skb
      having linear-headed frag_list
    - net: phylink: Fix flow control resolution
    - net: sched: fix reordering issues
    - sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
    - sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()'
    - sctp: use transport pf_retrans in sctp_do_8_2_transport_strike
    - tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
    - tipc: add NULL pointer check before calling kfree_rcu
    - tun: fix use-after-free when register netdev failed
    - net-ipv6: fix excessive RTF_ADDRCONF flag on ::1/128 local route (and
      others)
    - ipv6: addrconf_f6i_alloc - fix non-null pointer check to !IS_ERR()
    - net: fixed_phy: Add forward declaration for struct gpio_desc;
    - sctp: fix the missing put_user when dumping transport thresholds
    - net: sock_map, fix missing ulp check in sock hash case
    - gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and
      blacklist
    - gpio: mockup: add missing single_release()
    - gpio: fix line flag validation in linehandle_create
    - gpio: fix line flag validation in lineevent_create
    - Btrfs: fix assertion failure during fsync and use of stale transaction
    - cgroup: freezer: fix frozen state inheritance
    - Revert "mmc: bcm2835: Terminate timeout work synchronously"
    - Revert "mmc: sdhci: Remove unneeded quirk2 flag of O2 SD host controller"
    - mmc: tmio: Fixup runtime PM management during probe
    - mmc: tmio: Fixup runtime PM management during remove
    - drm/lima: fix lima_gem_wait() return value
    - [x86] drm/i915: Limit MST to <= 8bpc once again
    - [x86] drm/i915: Restore relaxed padding (OCL_OOB_SUPPRES_ENABLE) for skl+
    - ipc: fix semtimedop for generic 32-bit architectures
    - ipc: fix sparc64 ipc() wrapper
    - ixgbe: fix double clean of Tx descriptors with xdp
    - ixgbe: Prevent u8 wrapping of ITR value to something less than 10us
    - Revert "rt2800: enable TX_PIN_CFG_LNA_PE_ bits per band"
    - mt76: mt76x0e: disable 5GHz band for MT7630E
    - genirq: Prevent NULL pointer dereference in resend_irqs()
    - regulator: twl: voltage lists for vdd1/2 on twl4030
    - [s390x] KVM: kvm_s390_vm_start_migration: check dirty_bitmap before using
      it as target for memset()
    - [s390x] KVM: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl
    - [x86] KVM: work around leak of uninitialized stack contents
    - [x86] KVM: mmu: Reintroduce fast invalidate/zap for flushing memslot
    - [x86] KVM: nVMX: handle page fault in vmread
    - [x86] purgatory: Change compiler flags from -mcmodel=kernel to
      -mcmodel=large to fix kexec relocation errors
    - powerpc: Add barrier_nospec to raw_copy_in_user()
    - kernel/module: Fix mem leak in module_add_modinfo_attrs
    - x86/boot: Use efi_setup_data for searching RSDP on kexec-ed kernels
    - x86/ima: check EFI SetupMode too
    - drm/meson: Add support for XBGR8888 & ABGR8888 formats
    - clk: Fix debugfs clk_possible_parents for clks without parent string names
    - clk: Simplify debugfs printing and add a newline
    - mt76: Fix a signedness bug in mt7615_add_interface()
    - mt76: mt7615: Use after free in mt7615_mcu_set_bcn()
    - clk: rockchip: Don't yell about bad mmc phases when getting
    - mtd: rawnand: mtk: Fix wrongly assigned OOB buffer pointer issue
    - PCI: Always allow probing with driver_override
    - ubifs: Correctly use tnc_next() in search_dh_cookie()
    - driver core: Fix use-after-free and double free on glue directory
    - crypto: talitos - check AES key size
    - crypto: talitos - fix CTR alg blocksize
    - crypto: talitos - check data blocksize in ablkcipher.
    - crypto: talitos - fix ECB algs ivsize
    - crypto: talitos - Do not modify req->cryptlen on decryption.
    - crypto: talitos - HMAC SNOOP NO AFEU mode requires SW icv checking.
    - firmware: ti_sci: Always request response from firmware
    - drm: panel-orientation-quirks: Add extra quirk table entry for GPD MicroPC
    - drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
    - mm/z3fold.c: remove z3fold_migration trylock
    - mm/z3fold.c: fix lock/unlock imbalance in z3fold_page_isolate
    - Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
    - modules: fix BUG when load module with rodata=n
    - modules: fix compile error if don't have strict module rwx
    - modules: always page-align module section allocations
    - [x86] kvm: nVMX: Remove unnecessary sync_roots from handle_invept
    - [x86] KVM: SVM: Fix detection of AMD Errata 1096
    - [x86] platform: pmc_atom: Add CB4063 Beckhoff Automation board to
      critclk_systems DMI table
    - [x86] platform: pcengines-apuv2: use KEY_RESTART for front button
    - rsi: fix a double free bug in rsi_91x_deinit() (CVE-2019-15504)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.17
    - USB: usbcore: Fix slab-out-of-bounds bug during device reset
    - media: tm6000: double free if usb disconnect while streaming
    - phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
    - net: hns3: adjust hns3_uninit_phy()'s location in the hns3_client_uninit()
    - netfilter: nf_flow_table: set default timeout after successful insertion
    - HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report
    - Input: elan_i2c - remove Lenovo Legion Y7000 PnpID
    - SUNRPC: Handle connection breakages correctly in call_status()
    - nfs: disable client side deduplication
    - [powerpc*] mm/radix: Use the right page size for vmemmap mapping
    - net: hns: fix LED configuration for marvell phy
    - net: aquantia: fix limit of vlan filters
    - ip6_gre: fix a dst leak in ip6erspan_tunnel_xmit
    - net/sched: fix race between deactivation and dequeue for NOLOCK qdisc
    - net_sched: let qdisc_put() accept NULL pointer
    - udp: correct reuseport selection with connected sockets
    - xen-netfront: do not assume sk_buff_head list is empty in error handling
    - net: dsa: Fix load order between DSA drivers and taggers
    - KVM: coalesced_mmio: add bounds checking (CVE-2019-14821)
    - firmware: google: check if size is valid when decoding VPD data
    - serial: sprd: correct the wrong sequence of arguments
    - tty/serial: atmel: reschedule TX after RX was started
    - mwifiex: Fix three heap overflow at parsing element in
      cfg80211_ap_settings (CVE-2019-14814, CVE-2019-14815, CVE-2019-14816)
    - nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
    - ieee802154: hwsim: Fix error handle path in hwsim_init_module
    - ieee802154: hwsim: unregister hw while hwsim_subscribe_all_others fails
    - [armhf] dts: am57xx: Disable voltage switching for SD card
    - [armhf] OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss
    - bus: ti-sysc: Fix handling of forced idle
    - bus: ti-sysc: Fix using configured sysc mask value
    - [armhf] dts: Fix flags for gpio7
    - [armhf] dts: Fix incorrect dcan register mapping for am3, am4 and dra7
    - [arm64] dts: meson-g12a: add missing dwc2 phy-names
    - [s390x] bpf: fix lcgr instruction encoding
    - [armhf] OMAP2+: Fix omap4 errata warning on other SoCs
    - [armhf] dts: am335x: Fix UARTs length
    - [armhf] dts: dra74x: Fix iodelay configuration for mmc3
    - bus: ti-sysc: Simplify cleanup upon failures in sysc_probe()
    - [armhf] dts: Fix incomplete dts data for am3 and am4 mmc
    - [s390x] bpf: use 32-bit index for tail calls
    - fpga: altera-ps-spi: Fix getting of optional confd gpio
    - netfilter: ebtables: Fix argument order to ADD_COUNTER
    - netfilter: nft_flow_offload: missing netlink attribute policy
    - netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info
    - NFSv4: Fix return values for nfs4_file_open()
    - NFSv4: Fix return value in nfs_finish_open()
    - NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup
    - NFS: On fatal writeback errors, we need to call
      nfs_inode_remove_request()
    - xdp: unpin xdp umem pages in error path
    - selftests/bpf: fix test_cgroup_storage on s390
    - selftests/bpf: add config fragment BPF_JIT
    - qed: Add cleanup in qed_slowpath_start()
    - drm/omap: Fix port lookup for SDI output
    - drm/virtio: use virtio_max_dma_size
    - [armel,armhf] 8874/1: mm: only adjust sections of valid mm structures
    - batman-adv: Only read OGM2 tvlv_len after buffer len check
    - flow_dissector: Fix potential use-after-free on BPF_PROG_DETACH
    - bpf: allow narrow loads of some sk_reuseport_md fields with offset > 0
    - r8152: Set memory to all 0xFFs on failed reg reads
    - x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines
    - pNFS/flexfiles: Don't time out requests on hard mounts
    - NFS: Fix spurious EIO read errors
    - NFS: Fix writepage(s) error handling to not report errors twice
    - drm/amdgpu: fix dma_fence_wait without reference
    - netfilter: xt_physdev: Fix spurious error message in physdev_mt_check
    - netfilter: nf_conntrack_ftp: Fix debug output
    - NFSv2: Fix eof handling
    - NFSv2: Fix write regression
    - NFS: remove set but not used variable 'mapping'
    - kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the
      first symbol
    - netfilter: conntrack: make sysctls per-namespace again
    - drm/amd/powerplay: correct Vega20 dpm level related settings
    - cifs: set domainName when a domain-key is used in multiuser
    - cifs: Use kzfree() to zero out the password
    - libceph: don't call crypto_free_sync_skcipher() on a NULL tfm
    - usb: host: xhci-tegra: Set DMA mask correctly
    - RISC-V: Fix FIXMAP area corruption on RV32 systems
    - [armel,armhf] 8901/1: add a criteria for pfn_valid of arm
    - ibmvnic: Do not process reset during or after device removal
    - sky2: Disable MSI on yet another ASUS boards (P6Xxxx)
    - i2c: designware: Synchronize IRQs when unregistering slave client
    - perf/x86/intel: Restrict period on Nehalem
    - perf/x86/amd/ibs: Fix sample bias for dispatched micro-ops
    - i2c: iproc: Stop advertising support of SMBUS quick cmd
    - i2c: mediatek: disable zero-length transfers for mt8183
    - amd-xgbe: Fix error path in xgbe_mod_init()
    - netfilter: nf_flow_table: clear skb tstamp before xmit
    - [x86] tools/power x86_energy_perf_policy: Fix argument parsing
    - [x86] tools/power turbostat: fix leak of file descriptor on error return
      path
    - [x86] tools/power turbostat: fix file descriptor leaks
    - [x86] tools/power turbostat: fix buffer overrun
    - [x86] tools/power turbostat: Fix Haswell Core systems
    - [x86] tools/power turbostat: Add Ice Lake NNPI support
    - [x86] tools/power turbostat: Fix CPU%C1 display value
    - net: aquantia: fix removal of vlan 0
    - net: aquantia: reapply vlan filters on up
    - net: aquantia: linkstate irq should be oneshot
    - net: aquantia: fix out of memory condition on rx side
    - net: dsa: microchip: add KSZ8563 compatibility string
    - enetc: Add missing call to 'pci_free_irq_vectors()' in probe and remove
      functions
    - net: seeq: Fix the function used to release some memory in an error
      handling path
    - dmaengine: ti: dma-crossbar: Fix a memory leak bug
    - dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe()
    - [x86] uaccess: Don't leak the AC flags into __get_user() argument
      evaluation
    - [x86] hyper-v: Fix overflow bug in fill_gva_list()
    - [x86] iommu/vt-d: Remove global page flush support
    - dmaengine: sprd: Fix the DMA link-list configuration
    - dmaengine: rcar-dmac: Fix DMACHCLR handling if iommu is mapped
    - keys: Fix missing null pointer check in request_key_auth_describe()
    - [x86] iommu/amd: Flush old domains in kdump kernel
    - [x86] iommu/amd: Fix race in increase_address_space()
    - [arm64] Revert "arm64: Remove unnecessary ISBs from set_{pte,pmd,pud}"
    - ovl: fix regression caused by overlapping layers detection
    - floppy: fix usercopy direction
    - media: technisat-usb2: break out of loop at end of buffer
      (CVE-2019-15505)
    - vfs: Fix refcounting of filenames in fs_parser

  [ Salvatore Bonaccorso ]
  * xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT
    (CVE-2019-15538)

  [ Romain Perier ]
  * [rt] Update to 5.2.14-rt7

  [ Ben Hutchings ]
  * Bump ABI to 3

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 26 Sep 2019 14:19:06 +0200

linux (5.2.9-2) unstable; urgency=medium

  [ Ben Hutchings ]
  * Partially revert "net: socket: implement 64-bit timestamps"
    (fixes build/test regressions for glibc, qemu, suricata)
  * [x86] intel-iommu: Exclude integrated GPUs by default (Closes: #935270):
    - intel-iommu: Add option to exclude integrated GPU only
    - intel-iommu: Add Kconfig option to exclude iGPU by default
    - Enable INTEL_IOMMU_DEFAULT_ON_INTGPU_OFF instead of
      INTEL_IOMMU_DEFAULT_ON

  [ Thomas W ]
  * [x86] Add various laptop modules. (Closes: #932086)
    CONFIG_ACER_WIRELESS
    CONFIG_LG_LAPTOP
    CONFIG_SURFACE3_WMI
    CONFIG_INTEL_WMI_THUNDERBOLT
    CONFIG_PEAQ_WMI
    CONFIG_TOSHIBA_WMI
    CONFIG_SURFACE_3_BUTTON

 -- Ben Hutchings <ben@decadent.org.uk>  Wed, 21 Aug 2019 13:48:11 +0100

linux (5.2.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.8
    - scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure
    - libnvdimm/bus: Prepare the nd_ioctl() path to be re-entrant
    - libnvdimm/bus: Fix wait_nvdimm_bus_probe_idle() ABBA deadlock
    - ALSA: usb-audio: Sanity checks for each pipe and EP types
    - ALSA: usb-audio: Fix gpf in snd_usb_pipe_sanity_check
    - HID: wacom: fix bit shift for Cintiq Companion 2
    - HID: Add quirk for HP X1200 PIXART OEM mouse
    - atm: iphase: Fix Spectre v1 vulnerability (CVE-2017-5753)
    - bnx2x: Disable multi-cos feature.
    - drivers/net/ethernet/marvell/mvmdio.c: Fix non OF case (Closes: #908712)
    - ife: error out when nla attributes are empty
    - ip6_gre: reload ipv6h in prepare_ip6gre_xmit_ipv6
    - ip6_tunnel: fix possible use-after-free on xmit
    - ipip: validate header length in ipip_tunnel_xmit
    - [armhf,arm64] mvpp2: fix panic on module removal
    - [armhf,arm64] mvpp2: refactor MTU change code
    - net: bridge: delete local fdb on device init failure
    - net: bridge: mcast: don't delete permanent entries when fast leave is
      enabled
    - net: bridge: move default pvid init/deinit to NETDEV_REGISTER/UNREGISTER
    - net: fix ifindex collision during namespace removal
    - net/mlx5e: always initialize frag->last_in_page
    - net/mlx5: Use reversed order when unregister devices
    - net: phy: fixed_phy: print gpio error only if gpio node is present
    - net: phy: mscc: initialize stats array
    - net: sched: Fix a possible null-pointer dereference in dequeue_func()
    - net sched: update vlan action for batched events operations
    - net: sched: use temporary variable for actions indexes
    - net/smc: do not schedule tx_work in SMC_CLOSED state
    - [armhf,arm64] net: stmmac: Use netif_tx_napi_add() for TX polling
      function
    - tipc: compat: allow tipc commands without arguments
    - tipc: fix unitilized skb list crash
    - tun: mark small packets as owned by the tap sock
    - net/mlx5: Fix modify_cq_in alignment
    - net/mlx5e: Prevent encap flow counter update async to user query
    - r8169: don't use MSI before RTL8168d
    - net: fix bpf_xdp_adjust_head regression for generic-XDP
    - [x86] hv_sock: Fix hang when a connection is closed
    - net: phy: fix race in genphy_update_link
    - net/smc: avoid fallback in case of non-blocking connect
    - rocker: fix memory leaks of fib_work on two error return paths
    - net/mlx5: Add missing RDMA_RX capabilities
    - net/mlx5e: Fix matching of speed to PRM link modes
    - compat_ioctl: pppoe: fix PPPOEIOCSFWD handling
    - [x86] drm/i915/vbt: Fix VBT parsing for the PSR section
    - Revert "mac80211: set NETIF_F_LLTX when using intermediate tx queues"
    - [armhf,arm64] spi: bcm2835: Fix 3-wire mode if DMA is enabled
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.9
    - Revert "PCI: Add missing link delays required by the PCIe spec"
    - [arm64] iio: cros_ec_accel_legacy: Fix incorrect channel setting
    - [x86] iio: imu: mpu6050: add missing available scan masks
    - [x86] crypto: ccp - Fix oops by properly managing allocated structures
    - [x86] crypto: ccp - Add support for valid authsize values less than 16
    - [x86] crypto: ccp - Ignore tag length when decrypting GCM ciphertext
    - driver core: platform: return -ENXIO for missing GpioInt
    - usb: usbfs: fix double-free of usb memory upon submiturb error
    - Revert "USB: rio500: simplify locking"
    - usb: iowarrior: fix deadlock on disconnect
    - sound: fix a memory leak bug
    - [arm64,mips/octeon] mmc: cavium: Set the correct dma max segment size for
      mmc_host
    - [arm64,mips/octeon] mmc: cavium: Add the missing dma unmap when the dma
      has finished.
    - loop: set PF_MEMALLOC_NOIO for the worker thread
    - bdev: Fixup error handling in blkdev_get() (Closes: #934378)
    - Input: usbtouchscreen - initialize PM mutex before using it
    - Input: elantech - enable SMBus on new (2018+) systems
    - [x86] Input: synaptics - enable RMI mode for HP Spectre X360
    - [x86] mm: Check for pfn instead of page in vmalloc_sync_one()
    - [x86] mm: Sync also unmappings in vmalloc_sync_all()
    - mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
    - [s390x] perf annotate: Fix s390 gap between kernel end and module start
    - perf db-export: Fix thread__exec_comm()
    - [s390x] perf record: Fix module size on s390
    - [x86] purgatory: Do not use __builtin_memcpy and __builtin_memset
    - [x86] purgatory: Use CFLAGS_REMOVE rather than reset KBUILD_CFLAGS
    - genirq/affinity: Create affinity mask for single vector
    - gfs2: gfs2_walk_metadata fix
    - usb: yurex: Fix use-after-free in yurex_delete
    - usb: typec: ucsi: ccg: Fix uninitilized symbol error
    - usb: typec: tcpm: free log buf memory when remove debug file
    - usb: typec: tcpm: remove tcpm dir if no children
    - usb: typec: tcpm: Add NULL check before dereferencing config
    - usb: typec: tcpm: Ignore unsupported/unknown alternate mode requests
    - [armhf] can: flexcan: fix stop mode acknowledgment
    - [armhf] can: flexcan: fix an use-after-free in flexcan_setup_stop_mode()
    - can: peak_usb: fix potential double kfree_skb()
    - [powerpc*] fix off by one in max_zone_pfn initialization for ZONE_DMA
    - netfilter: nfnetlink: avoid deadlock due to synchronous request_module
    - netfilter: Fix rpfilter dropping vrf packets by mistake
    - netfilter: nf_tables: fix module autoload for redir
    - netfilter: conntrack: always store window size un-scaled
    - netfilter: nft_hash: fix symhash with modulus one
    - rq-qos: don't reset has_sleepers on spurious wakeups
    - rq-qos: set ourself TASK_UNINTERRUPTIBLE after we schedule
    - rq-qos: use a mb for got_token
    - netfilter: nf_tables: Support auto-loading for inet nat
    - drm/amd/display: No audio endpoint for Dell MST display
    - drm/amd/display: Clock does not lower in Updateplanes
    - drm/amd/display: Wait for backlight programming completion in set
      backlight level
    - drm/amd/display: fix DMCU hang when going into Modern Standby
    - drm/amd/display: use encoder's engine id to find matched free audio
      device
    - drm/amd/display: put back front end initialization sequence
    - drm/amd/display: allocate 4 ddc engines for RV2
    - drm/amd/display: Fix dc_create failure handling and 666 color depths
    - drm/amd/display: Only enable audio if speaker allocation exists
    - drm/amd/display: Increase size of audios array
    - nl80211: fix NL80211_HE_MAX_CAPABILITY_LEN
    - mac80211: fix possible memory leak in ieee80211_assign_beacon
    - mac80211: don't warn about CW params when not using them
    - allocate_flower_entry: should check for null deref
    - hwmon: (nct6775) Fix register address and added missed tolerance for
      nct6106
    - [armhf] dts: imx6ul: fix clock frequency property name of I2C buses
    - [powerpc*] papr_scm: Force a scm-unbind if initial scm-bind fails
    - [arm64] Force SSBS on context switch
    - [arm64] entry: SP Alignment Fault doesn't write to FAR_EL1
    - [x86] iommu/vt-d: Check if domain->pgd was allocated
    - [arm64] drm/msm/dpu: Correct dpu encoder spinlock initialization
    - [ppc64] cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init()
    - [s390x] qdio: add sanity checks to the fast-requeue path
    - ALSA: compress: Fix regression on compressed capture streams
    - ALSA: compress: Prevent bypasses of set_params
    - ALSA: compress: Don't allow paritial drain operations on capture streams
    - ALSA: compress: Be more restrictive about when a drain is allowed
    - perf script: Fix off by one in brstackinsn IPC computation
    - perf tools: Fix proper buffer size for feature processing
    - perf stat: Fix segfault for event group in repeat mode
    - perf session: Fix loading of compressed data split across adjacent
      records
    - perf probe: Avoid calling freeing routine multiple times for same pointer
    - drbd: dynamically allocate shash descriptor
    - ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id()
    - nvme: ignore subnqn for ADATA SX6000LNP
    - nvme: fix memory leak caused by incorrect subsystem free
    - scsi: megaraid_sas: fix panic on loading firmware crashdump
    - scsi: ibmvfc: fix WARN_ON during event pool release
    - scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG
    - test_firmware: fix a memory leak bug
    - tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop
    - [x86] perf/intel: Fix SLOTS PEBS event constraint
    - [x86] perf/intel: Fix invalid Bit 13 for Icelake MSR_OFFCORE_RSP_x
      register
    - [x86] perf: Apply more accurate check on hypervisor platform
    - perf/core: Fix creating kernel counters for PMUs that override event->cpu
    - [s390x] dma: provide proper ARCH_ZONE_DMA_BITS value
    - HID: sony: Fix race condition between rumble and device remove.
    - ALSA: usb-audio: fix a memory leak bug
    - [x86] KVM/nSVM: properly map nested VMCB
    - can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices
    - can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices
    - hwmon: (nct7802) Fix wrong detection of in4 presence
    - hwmon: (lm75) Fixup tmp75b clr_mask
    - [x86] drm/i915: Fix wrong escape clock divisor init for GLK
    - ALSA: firewire: fix a memory leak bug
    - ALSA: hiface: fix multiple memory leak bugs
    - ALSA: hda - Don't override global PCM hw info flag
    - [x86] ALSA: hda - Workaround for crackled sound on AMD controller
      (1022:1457)
    - mac80211: don't WARN on short WMM parameters from AP
    - dax: dax_layout_busy_page() should not unmap cow pages
    - SMB3: Fix deadlock in validate negotiate hits reconnect
    - smb3: send CAP_DFS capability during session setup
    - NFSv4: Fix delegation state recovery
    - NFSv4: Check the return value of update_open_stateid()
    - NFSv4: Fix an Oops in nfs4_do_setattr
    - [x86] KVM: Fix leak vCPU's VMCS value into other pCPU
    - [armhf,arm64] KVM: Sync ICH_VMCR_EL2 back when about to block
    - mwifiex: fix 802.11n/WPA detection
    - iwlwifi: don't unmap as page memory that was mapped as single
    - iwlwifi: mvm: fix an out-of-bound access
    - iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment
    - iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT on version < 41
    - iwlwifi: mvm: fix version check for GEO_TX_POWER_LIMIT support

  [ Salvatore Bonaccorso ]
  * Enable Realtek 802.11ac wireless chips support (Closes: #933963)

  [ Ben Hutchings ]
  * [armel] fb-modules: Remove xgifb, which was removed upstream (fixes FTBFS)
  * tracefs: Fix potential null dereference in default_file_open()
    (Closes: #934304)
  * [arm64] hwrandom: Re-enable HW_RANDOM_OMAP as module (Closes: #931707)
  * ptp: Change CAVIUM_PTP from built-in to modular (Closes: #934848)
  * bug script: Check whether /e/n/interfaces exists (Closes: #934824)
  * bug script: Include network configuration from /e/n/interfaces.d
  * bug script: Check for unreadable /e/n/interfaces files
  * [x86] iommu: Enable INTEL_IOMMU_DEFAULT_ON (Closes: #934309)
  * HID: Enable HID_BIGBEN_FF, HID_MACALLY, HID_GFRM, HID_GT683R,
    HID_VIEWSONIC, HID_MALTRON, HID_U2FZERO as modules (Closes: #934091)
  * usbip: network: Fix unaligned member access (Closes: #925766)
  * libbpf: Fix cross-build
  * [rt] Update to 5.2.9-rt3:
    - i2c: exynos5: Remove IRQF_ONESHOT
    - i2c: hix5hd2: Remove IRQF_ONESHOT
    - sched/deadline: Ensure inactive_timer runs in hardirq context
    - thermal/x86_pkg_temp: make pkg_temp_lock a raw spinlock
    - dma-buf: Use seqlock_t instread disabling preemption
    - KVM: arm/arm64: Let the timer expire in hardirq context on RT
    - x86: preempt: Check preemption level before looking at lazy-preempt
    - arm64: preempt: Fixup lazy preempt
    - arm64: preempt: Check preemption level before looking at lazy-preempt

  [ Alper Nebi Yasak ]
  * [arm64] udeb: Add pl330 to kernel-image

 -- Ben Hutchings <ben@decadent.org.uk>  Sun, 18 Aug 2019 22:54:21 +0100

linux (5.2.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.7
    - [armhf] dts: rockchip: Make rk3288-veyron-minnie run at hs200
    - [armhf] dts: rockchip: Make rk3288-veyron-mickey's emmc work again
    - [arm64] clk: meson: mpll: properly handle spread spectrum
    - [armhf] dts: rockchip: Mark that the rk3288 timer might stop in suspend
    - ftrace: Enable trampoline when rec count returns back to one
    - [arm64] dts: qcom: qcs404-evb: fix l3 min voltage
    - [arm64] dts: marvell: mcbin: enlarge PCI memory window
    - [armhf,arm64] dmaengine: tegra-apb: Error out if DMA_PREP_INTERRUPT flag
      is unset
    - [arm64] dts: rockchip: fix isp iommu clocks and power domain
    - kernel/module.c: Only return -EEXIST for modules that have finished
      loading
    - PCI: OF: Initialize dev->fwnode appropriately
    - [armhf,arm64] firmware/psci: psci_checker: Park kthreads before stopping
      them
    - [arm64] qcom: qcs404: Add reset-cells to GCC node
    - swiotlb: fix phys_addr_t overflow warning
    - [arm64] clk: tegra210: fix PLLU and PLLU_OUT1
    - fs/adfs: super: fix use-after-free bug
    - [arm64] dts: rockchip: Fix USB3 Type-C on rk3399-sapphire
    - btrfs: tree-checker: Check if the file extent end overflows
    - btrfs: fix minimum number of chunk errors for DUP
    - btrfs: Flush before reflinking any extent to prevent NOCOW write falling
      back to COW without data reservation
    - [arm64] remoteproc: copy parent dma_pfn_offset for vdev
    - btrfs: qgroup: Don't hold qgroup_ioctl_lock in btrfs_qgroup_inherit()
    - cifs: Fix a race condition with cifs_echo_request
    - ceph: fix improper use of smp_mb__before_atomic()
    - ceph: fix dir_lease_is_valid()
    - ceph: return -ERANGE if virtual xattr value didn't fit in buffer
    - virtio-mmio: add error check for platform_get_irq
    - drm/amd/display: Expose audio inst from DC to DM
    - cifs: fix crash in cifs_dfs_do_automount
    - perf version: Fix segfault due to missing OPT_END()
    - [x86] kvm: avoid constant-conversion warning
    - ACPI: fix false-positive -Wuninitialized warning
    - [x86] KVM: nVMX: Ignore segment base for VMX memory operand when segment
      not FS or GS
    - bpf: fix BTF verifier size resolution logic
    - be2net: Signal that the device cannot transmit during reconfiguration
    - mm/z3fold: don't try to use buddy slots after free
    - mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones
    - mm/z3fold.c: reinitialize zhdr structs after migration
    - [x86] apic: Silence -Wtype-limits compiler warnings
    - [arm*] mm/cma.c: fail if fixed declaration can't be honored
    - mm/ioremap: check virtual address alignment while creating huge mappings
    - coda: add error handling for fget
    - uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side
      headers
    - ipc/mqueue.c: only perform resource calculation if user valid
    - device-dax: fix memory and resource leak if hotplug fails
    - mm/hotplug: make remove_memory() interface usable
    - stacktrace: Force USER_DS for stack_trace_save_user()
    - [x86] crypto: ccp - Fix SEV_VERSION_GREATER_OR_EQUAL
    - xen/pv: Fix a boot up hang revealed by int3 self test
    - [x86] kvm: Don't call kvm_spurious_fault() from .fixup
    - [x86] paravirt: Fix callee-saved function ELF sizes
    - [x86] boot: Remove multiple copy of static function sanitize_boot_params()
    - bpf: Disable GCC -fgcse optimization for ___bpf_prog_run()
    - drm/nouveau: fix memory leak in nouveau_conn_reset()
    - drm/nouveau/dmem: missing mutex_lock in error path
    - kconfig: Clear "written" flag to avoid data loss
    - tpm: Fix null pointer dereference on chip register error path
    - Btrfs: fix incremental send failure after deduplication
    - Btrfs: fix race leading to fs corruption after transaction abort
    - dax: Fix missed wakeup in put_unlocked_entry()
    - fgraph: Remove redundant ftrace_graph_notrace_addr() test
    - [armhf,arm64] mmc: dw_mmc: Fix occasional hang after tuning on eMMC
    - [armhf] mmc: meson-mx-sdio: Fix misuse of GENMASK macro
    - mmc: mmc_spi: Enable stable writes
    - gpiolib: Preserve desc->flags when setting state
    - gpio: don't WARN() on NULL descs if gpiolib is disabled
    - gpiolib: fix incorrect IRQ requesting of an active-low lineevent
    - IB/hfi1: Fix Spectre v1 vulnerability
    - drm/nouveau: Only release VCPI slots on mode changes
    - mtd: rawnand: micron: handle on-die "ECC-off" devices correctly
    - eeprom: at24: make spd world-readable again
    - [arm*] i2c: iproc: Fix i2c master read more than 63 bytes
    - selinux: fix memory leak in policydb_init()
    - [x86] ALSA: hda: Fix 1-minute detection delay when i915 module is not
      available (see #931507)
    - mm: vmscan: check if mem cgroup is disabled or not before calling memcg
      slab shrinker
    - mm: migrate: fix reference check race between __find_get_block() and
      migration
    - mm: compaction: avoid 100% CPU usage during compaction when a task is
      killed
    - mm/migrate.c: initialize pud_entry in migrate_vma()
    - loop: Fix mount(2) failure due to race with LOOP_SET_FD
    - [s390x] dasd: fix endless loop after read unit address configuration
    - cgroup: kselftest: relax fs_spec checks
    - [hppa] Add archclean Makefile target
    - [hppa] Strip debug info from kernel before creating compressed vmlinuz
    - [hppa] Fix build of compressed kernel even with debug enabled
    - drivers/perf: arm_pmu: Fix failure path in PM notifier
    - [arm64] compat: Allow single-byte watchpoints on all addresses
    - [arm64] cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG}
    - io_uring: fix KASAN use after free in io_sq_wq_submit_work
    - scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA
    - nbd: replace kill_bdev() with __invalidate_device() again
    - xen/swiotlb: fix condition for calling xen_destroy_contiguous_region()
    - xen/gntdev.c: Replace vm_map_pages() with vm_map_pages_zero()
    - RDMA/devices: Do not deadlock during client removal
    - IB/mlx5: Fix unreg_umr to ignore the mkey state
    - IB/mlx5: Use direct mkey destroy command upon UMR unreg failure
    - IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache
    - IB/mlx5: Fix clean_mr() to work in the expected order
    - IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification
    - IB/hfi1: Check for error on call to alloc_rsm_map_table
    - IB/hfi1: Drop all TID RDMA READ RESP packets after r_next_psn
    - IB/hfi1: Field not zero-ed when allocating TID flow memory
    - [x86] drm/i915/perf: fix ICL perf register offsets
    - [x86] drm/i915/gvt: fix incorrect cache entry for guest page mapping
    - [x86] cpufeatures: Carve out CQM features retrieval
    - [x86] cpufeatures: Combine word 11 and 12 into a new scattered features
      word
    - [x86] speculation: Prepare entry code for Spectre v1 swapgs mitigations
    - [x86] speculation: Enable Spectre v1 swapgs mitigations (CVE-2019-1125)
    - [amd64] entry: Use JMP instead of JMPQ
    - [x86] speculation/swapgs: Exclude ATOMs from speculation through SWAPGS
    - Documentation: Add swapgs description to the Spectre v1 documentation

  [ Ben Hutchings ]
  * [armhf] udeb: Remove davinci_cpdma from nic-modules (fixes FTBFS)
  * Bump ABI to 2
  * [armel/marvell] Increase maximum image size (fixes FTBFS):
    - This removes support for QNAP TS-109, TS-119, TS-209, TS-219, TS-409,
      and HP Media Vault mv2120
    - This may be reverted if we can disable or modularise some features

  [ Julien Cristau ]
  * Fix libcpupower-dev's Depends field to account for SONAME bump.

 -- Ben Hutchings <ben@decadent.org.uk>  Wed, 07 Aug 2019 14:50:10 +0100

linux (5.2.6-1) unstable; urgency=medium

  * New upstream release:
    https://kernelnewbies.org/Linux_5.1
    https://kernelnewbies.org/Linux_5.2

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.2
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.4
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.5
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.6

  [ Bastian Germann ]
  * [armhf] Enable C_CAN as a module. (Closes: #929968)

  [ Ben Hutchings ]
  * Drop "x86/boot: Add ACPI RSDP address to setup_header", which should
    not have been applied to 4.20 or later
  * Drop redundant part of "Install perf scripts non-executable"
  * Drop "kbuild: Use -nostdinc in compile tests", which is no longer needed
  * debian/rules.d/scripts/kconfig: Update for upstream file renaming
  * debian/rules.d/scripts/mod: Add uuid_t and UUID_STRING_LEN definitions
  * liblockdep: Disable until it can be built again
  * libcpupower: Bump soversion since 2 exported functions have been removed
  * libbpf: Stop overriding upstream soname; rename shlib package to libbpf0
  * vfs: Enable FS_ENCRYPTION as built-in; disable on armel/marvell
  * net: Enable NET_DEVLINK as built-in; disable on armel/marvell
  * aufs: Update support patchset to aufs5.2 20190805
  * lockdown: Update for 5.2:
    - Update "acpi: Ignore acpi_rsdp kernel param when the kernel ..."
    - Add "tracefs: Restrict tracefs when the kernel is locked down"
    - Add "efi: Restrict efivar_ssdt_load when the kernel is locked down"
    - Drop "MODSIGN: Import certificates from UEFI Secure Boot"
  * [rt] Rebase onto 5.2.6, and re-enable
  * [armhf,arm64] gpu: Enable DRM_LIMA, DRM_PANFROST as modules
  * sched: Enable PSI (Closes: #931247)
  * [armhf,arm64] power: Enable ENERGY_MODEL
  * [armhf,arm64] cpufreq: Enable CPU_FREQ_DEFAULT_GOV_SCHEDUTIL (instead of
    CPU_FREQ_DEFAULT_GOV_PERFORMANCE)
  * hamradio: Disable auto-loading as mitigation against local exploits
  * hamradio: Enable most options in top-level config:
    - [arm64,ia64,mips*,riscv64,s390x,sh4,sparc64] Enable AX25, NETROM, ROSE,
      and all possible drivers (Closes: #920651)
    - [alpha,amd64,armel] ax25: Enable AX25_DAMA_SLAVE
    - [armhf] Enable BPQETHER, BAYCOM_SER_FDX, BAYCOM_SER_HDX, BAYCOM_PAR,
      BAYCOM_EPP, YAM as modules
  * [armel/rpi,armhf] media: Enable VIDEO_BCM2835 as module
  * usb/typec: Enable TYPEC_DP_ALTMODE, TYPEC_NVIDIA_ALTMODE as modules
    (Closes: #931752)
  * [amd64/cloud-amd64] hwrandom: Enable HW_RANDOM_VIRTIO (Closes: #914511)
  * [ppc64*] crypto: Enable CRYPTO_DEV_NX, and CRYPTO_DEV_NX_ENCRYPT,
    CRYPTO_DEV_NX_COMPRESS, CRYPTO_DEV_NX_COMPRESS_PSERIES,
    CRYPTO_DEV_NX_COMPRESS_POWERNV as modules (Closes: #931374)
  * [ppc64*] Disable PPC_TRANSACTIONAL_MEM (Closes: #866122)

  [ Vagrant Cascadian ]
  * [arm64] Enable modules to support audio on pinebook: SND_SUN4I_I2S,
    SND_SUN8I_CODEC, SND_SUN50I_CODEC_ANALOG, SND_SIMPLE_CARD,
    SND_SOC_SIMPLE_AMPLIFIER. (Closes: #921019)

  [ Romain Perier ]
  * Refreshed patches:
    - debian/revert-objtool-fix-config_stack_validation-y-warning.patch
    - debian/dfsg/video-remove-nvidiafb-and-rivafb.patch
    - debian/gitignore.patch
    - debian/mips-disable-werror.patch
    - bugfix/all/firmware-remove-redundant-log-messages-from-drivers.patch
    - bugfix/arm/arm-mm-export-__sync_icache_dcache-for-xen-privcmd.patch
    - bugfix/powerpc/powerpc-lib-makefile-don-t-pull-in-quad.o-for-32-bit.patch
    - bugfix/all/
      radeon-amdgpu-firmware-is-required-for-drm-and-kms-on-r600-onward.patch
    - bugfix/all/disable-some-marvell-phys.patch
    - debian/overlayfs-permit-mounts-in-userns.patch
    - bugfix/all/tools-perf-remove-shebangs.patch
    - debian/ntfs-mark-it-as-broken.patch
    - features/all/db-mok-keyring/
      0003-MODSIGN-checking-the-blacklisted-hash-before-loading-a-kernel-module.patch
    - features/all/db-mok-keyring/
      0004-MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch
    - debian/android-enable-building-ashmem-and-binder-as-modules.patch
    - features/all/aufs5/aufs5-mmap.patch
    - features/all/aufs5/aufs5-standalone.patch
    - features/all/lockdown/
      0029-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch
  * Enable coreboot memconsole (Closes: #872069)
  * [rt] Update to 5.2-rt1

  [ Karsten Merker ]
  * [riscv64] Change the kernel image format from ELF to flat Image.
    (Closes: #928451)
  * [riscv64] Update config and image format (Closes: #933603):
    - Enable SiFive UART and UART console support
    - Enable clock drivers for the SiFive FU540
    - Backport kernel image header support from kernel 5.3

  [ Uwe Kleine-König ]
  * [armhf] Add support for all i.MX6 variants.
  * enable XFRM_STATISTICS (Closes: #929938)
  * [arm64] Add support for Raspberry Pi 3 camera host interface (Closes:
    #933228)
  * Enable CRYPTO_ZSTD for ZRAM with ZSTD compression (Closes: #932722)

  [ Lubomir Rintel ]
  * [armhf] Enable config items for OLPC XO-1.75 (Closes: #927791)

 -- Ben Hutchings <ben@decadent.org.uk>  Mon, 05 Aug 2019 02:27:14 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog linux-image-6.12.90+deb13.1-amd64`.
