linux (5.10.262-1+sx1) UNRELEASED; urgency=medium

  * Local amd64 backport of CVE-2026-98432.
    Stable commit b3b027ef0cd322bfa839b9aaf5b27551eea54cf6.
    Upstream commit e3f33b0a1d89d738e2b913dab519226eaf76e15b.
    ABI 5.10.0-46-sx1. Source revision 5.10.262-1+sx1.
    Not a Debian official kernel and not upstream 5.10.272.
    The image is unsigned for Secure Boot because the Debian signing key
    is not available. This package does not change machine Secure Boot policy.
    linux-image-amd64 is not built and must stay installed.

 -- StackX Kernel Build <stackx-kernel-build@localhost>  Fri, 30 Oct 2026 02:31:06 +0000

linux (5.10.262-1) bullseye-security; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.260
    - net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys
    - net/sched: transition act_pedit to rcu and percpu stats
    - net/sched: simplify tcf_pedit_act
    - net/sched: act_pedit: remove extra check for key type
    - net/sched: act_pedit: check static offsets a priori
    - net/sched: act_pedit: rate limit datapath messages
    - net/sched: act_pedit: Parse L3 Header for L4 offset
    - net/sched: fix pedit partial COW leading to page cache corruption
      (CVE-2026-46331)
    - net/sched: act_pedit: free pedit keys on bail from offset check
    - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)
    - [arm*] slimbus: qcom-ngd-ctrl: Register callbacks after creating the
      ngd
      (CVE-2026-53332)
    - drm/amd/display: Bound VBIOS record-chain walk loops (CVE-2026-53138)
    - net: add skb_header_pointer_careful() helper
    - net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve()
      (CVE-2026-53329)
    - net: 9p: fix refcount leak in p9_read_work() error handling
      (CVE-2022-50114)
    - netdevsim: Fix memory leak of nsim_dev->fa_cookie (CVE-2022-49803)
    - batman-adv: tt: reject oversized local TVLV buffers
    - batman-adv: tt: prevent TVLV entry number overflow
    - vfio/iommu_type1: replace kfree with kvfree
    - RDMA/bnxt_re: zero shared page before exposing to userspace
    - i2c: stub: Reject I2C block transfers with invalid length
    - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
    - [x86] agp/amd64: Fix broken error propagation in agp_amd64_probe()
      (CVE-2026-53325)
    - regulator: core: fix locking in regulator_resolve_supply() error path
      (CVE-2026-46252)
    - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent
      vcs_write
    - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    - [x86] crypto: qat - Replace kzalloc() + copy_from_user() with
      memdup_user()
    - [x86] crypto: qat - Return pointer directly in
      adf_ctl_alloc_resources
    - [x86] crypto: qat - remove unused character device and IOCTLs
    - net/sched: act_pedit: fix action bind logic
    - batman-adv: tp_meter: keep unacked list in ascending ordered
    - batman-adv: tp_meter: initialize dup_acks explicitly
    - batman-adv: tp_meter: initialize dec_cwnd explicitly
    - batman-adv: tp_meter: avoid window underflow
    - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
    - batman-adv: tp_meter: fix fast recovery precondition
    - batman-adv: tp_meter: handle seqno wrap-around for fast recovery
      detection
    - batman-adv: tp_meter: add only finished tp_vars to lists
    - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
    - batman-adv: prevent ELP transmission interval underflow
    - batman-adv: tp_meter: initialize last_recv_time during init
    - batman-adv: frag: ensure fragment is writable before modifying TTL
    - batman-adv: frag: avoid underflow of TTL
    - batman-adv: v: prevent OGM aggregation on disabled hardif
    - batman-adv: tp_meter: restrict number of unacked list entries
    - batman-adv: tp_meter: annotate last_recv_time access with
      READ/WRITE_ONCE
    - batman-adv: tp_meter: prevent parallel modifications of last_recv
    - batman-adv: tp_meter: handle overlapping packets
    - batman-adv: tt: don't merge change entries with different VIDs
    - batman-adv: tt: track roam count per VID
    - batman-adv: dat: prevent false sharing between VLANs
    - batman-adv: tvlv: enforce 2-byte alignment
    - batman-adv: tvlv: avoid race of cifsnotfound handler state
    - ring-buffer: Remove ring_buffer_read_prepare_sync()
    - ext4: add bounds check for inline data length in
      ext4_read_inline_page
      (CVE-2026-31451)
    - crypto: af_alg - Set merge to zero early in af_alg_sendmsg
      (CVE-2025-39931)
    - [armel,armhf] net: cpsw_new: Fix potential unregister of netdev that
      has
      not been registered yet (CVE-2026-43219)
    - mac802154: llsec: add skb_cow_data() before in-place crypto
    - KEYS: fix overflow in keyctl_pkey_params_get_2()
    - keys: Pin request_key_auth payload in instantiate paths
    - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
    - wifi: ath11k: fix warning when unbinding
    - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
    - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
    - bpf: use kvfree() for replaced sysctl write buffer
    - exfat: fix potential use-after-free in exfat_find_dir_entry()
    - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
    - pNFS: Fix use-after-free in pnfs_update_layout()
    - fpga: region: fix use-after-free in child_regions_with_firmware()
    - ocfs2: reject oversized group bitmap descriptors
    - [x86] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
    - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in
      fb_videomode_to_var
    - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
    - NFSD: Fix SECINFO_NO_NAME decode error cleanup
    - nfsd: fix posix_acl leak on SETACL decode failure
    - nfsd: check get_user() return when reading princhashlen
    - dlm: prevent NPD when writing a positive value to event_done
      (CVE-2025-23131)
    - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
      (CVE-2026-31755)
    - bnxt_en: Modify bnxt_disable_int_sync() to be called more than once.
    - bnxt_en: Fix NULL pointer dereference (CVE-2026-53177)
    - [x86] hv: utils: handle and propagate errors in kvp_register
    - mptcp: fix missing wakeups in edge scenarios
    - [arm*] misc: fastrpc: Add dma_mask to fastrpc_channel_ctx
    - [arm*] misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
      (CVE-2026-53158)
    - [x86] Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on
      Gen2
      VMs
    - phonet: Pass ifindex to fill_addr().
    - phonet: Pass net and ifindex to phonet_address_notify().
    - net: phonet: free phonet_device after RCU grace period
      (CVE-2026-53157)
    - [arm*] misc: fastrpc: fix DMA address corruption due to find_vma
      misuse
      (CVE-2026-53159)
    - virtiofs: fix UAF on submount umount
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.261
    - nvmet-tcp: fix race between ICReq handling and queue teardown
      (CVE-2026-46135)
    - nfsd: release layout stid on setlease failure (CVE-2026-53399)
    - nfsd: reset write verifier on deferred writeback errors
      (CVE-2026-53393)
    - userfaultfd: gate must_wait writability check on pte_present()
      (CVE-2026-64514)
    - clk: imx: Add check for kcalloc
    - nfsd: move name lookup out of nfsd4_list_rec_dir()
    - nfsd: change nfs4_client_to_reclaim() to allocate data
    - mmc: renesas_sdhi: Add quirk entry for RZ/G2H SoC
    - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with
      get_unaligned() (CVE-2026-63806)
    - bus: mhi: host: Add alignment check for event ring read pointer
      (CVE-2023-52494)
    - netfilter: nf_log: validate MAC header was set before dumping it
      (CVE-2026-52942)
    - skmsg: convert struct sk_msg_sg::copy to a bitmap
    - net: skmsg: preserve sg.copy across SG transforms (CVE-2026-63830)
    - apparmor: fix use-after-free in rawdata dedup loop (CVE-2026-63827)
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
      (CVE-2026-63829)
    - apparmor: mediate the implicit connect of TCP fast open sendmsg
      (CVE-2026-63828)
    - f2fs: adjust zone capacity when considering valid block count
    - f2fs: fix to round down start offset of fallocate for pin file
    - f2fs: validate orphan inode entry count (CVE-2026-63818)
    - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
      (CVE-2026-63815)
    - f2fs: fix potential deadlock in f2fs_balance_fs()
    - f2fs: fix listxattr handling of corrupted xattr entries
    - NFSv4/flexfiles: reject zero filehandle version count
      (CVE-2026-53392)
    - fbdev: fbcon: fix out-of-bounds read in err_out of
      fbcon_do_set_font() (CVE-2026-53402)
    - i2c: core: fix irq domain leak on adapter registration failure
    - i2c: core: fix hang on adapter registration failure
    - i2c: core: fix NULL-deref on adapter registration failure
    - i2c: core: fix adapter debugfs creation
    - i2c: core: fix adapter registration race (CVE-2026-53400)
    - hdlc_ppp: sync per-proto timers before freeing hdlc state
      (CVE-2026-63803)
    - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
      (CVE-2026-46116)
    - usb: gadget: function: rndis: add length check to response query
    - usb: gadget: function: rndis: add length check for header
      (CVE-2026-64505)
    - iio: accel: bmc150: clamp the device-reported FIFO frame count
      (CVE-2026-64504)
    - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
      (CVE-2026-64503)
    - iio: adc: lpc32xx: Initialize completion before requesting IRQ
      (CVE-2026-64500)
    - iio: adc: ti-ads124s08: Return reset GPIO lookup errors
    - iio: chemical: scd30: Cleanup initializations and fix sign-extension
      bug (CVE-2026-64497)
    - iio: event: Fix event FIFO reset race (CVE-2026-64496)
    - iio: gyro: bmg160: bail out when bandwidth/filter is not in table
      (CVE-2026-64495)
    - iio: gyro: bmg160: wait full startup time after mode change at probe
    - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
    - iio: imu: st_lsm6dsx: deselect shub page before reading whoami
    - iio: light: al3010: fix incorrect scale for the highest gain range
    - iio: light: gp2ap002: fix runtime PM leak on read error
      (CVE-2026-64494)
    - iio: light: opt3001: fix missing state reset on timeout
    - iio: light: veml6030: fix channel type when pushing events
    - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend()
      call
    - iio: temperature: ltc2983: Fix reinit_completion() called after
      conversion start
    - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input
      parser (CVE-2026-64487)
    - ALSA: es1938: check snd_ctl_new1() return value (CVE-2026-64484)
    - ALSA: firewire: isight: bound the sample count to the packet payload
      (CVE-2026-64483)
    - ALSA: usb-audio: avoid kobject path lookup in DualSense match
      (CVE-2026-64478)
    - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
    - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix
      EQ-switch put callbacks
    - ALSA: usb-audio: Roll back quirk control caches on write errors
    - ALSA: usb-audio: Update Babyface Pro control caches only after
      successful writes
    - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after
      successful writes
    - Bluetooth: btusb: fix use-after-free on registration failure
      (CVE-2026-64471)
    - binder: fix UAF in binder_thread_release() (CVE-2026-64469)
    - usb: xhci: Fix sleep in atomic context in xhci_free_streams()
      (CVE-2026-64465)
    - PCI: altera: Do not dispose parent IRQ mapping
    - PCI: host-common: Request bus reassignment when not probe-only
    - netfilter: ipset: fix race between dump and ip_set_list resize
      (CVE-2026-64189)
    - virtio-mmio: fix device release warning on module unload
    - hwrng: virtio: clamp device-reported used.len at copy_data()
      (CVE-2026-64456)
    - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
      (CVE-2026-64455)
    - 6lowpan: fix NHC entry use-after-free on error path (CVE-2026-64452)
    - tipc: fix out-of-bounds read in broadcast Gap ACK blocks
      (CVE-2026-64450)
    - media: staging: ipu3-imgu: Add range check for
      imgu_css_cfg_acc_stripe
    - crypto: amlogic - avoid double cleanup in meson_crypto_probe()
    - net: af_key: initialize alg_key_len for IPComp states
      (CVE-2026-64436)
    - audit: Fix data races of skb_queue_len() readers on audit_queue
      (CVE-2026-64435)
    - debugobjects: Plug race against a concurrent OOM disable
    - gpio: eic-sprd: use raw_spinlock_t in the irq startup path
      (CVE-2026-64429)
    - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
      (CVE-2026-64425)
    - ipv4: igmp: remove multicast group from hash table on device
      destruction (CVE-2026-64423)
    - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
      (CVE-2026-64422)
    - mfd: cros_ec: Delay dev_set_drvdata() until probe success
      (CVE-2026-64420)
    - netfilter: ebtables: module names must be null-terminated
      (CVE-2026-64412)
    - netfilter: ebtables: terminate table name before find_table_lock()
      (CVE-2026-64411)
    - Bluetooth: bnep: pin L2CAP connection during netdev registration
      (CVE-2026-64408)
    - Bluetooth: fix UAF in bt_accept_dequeue() (CVE-2026-64406)
    - Bluetooth: L2CAP: validate option length before reading conf opt
      value (CVE-2026-64403)
    - net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216)
    - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
      (CVE-2026-64374)
    - cpufreq: Fix hotplug-suspend race during reboot (CVE-2026-64373)
    - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
      (CVE-2026-64372)
    - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error
      path (CVE-2026-64370)
    - HID: wacom: stop hardware after post-start probe failures
    - HID: lg-g15: cancel pending work on remove to fix a use-after-free
      (CVE-2026-64362)
    - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for
      multi-byte reads
    - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
      (CVE-2026-64360)
    - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
      (CVE-2026-64359)
    - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
      (CVE-2026-64351)
    - usb: cdc_acm: Add quirk for Uniden BC125AT scanner
    - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
    - usb: gadget: composite: fix dead empty check in the USB_DT_OTG
      handler (CVE-2026-64347)
    - USB: idmouse: fix use-after-free on disconnect race (CVE-2026-64344)
    - USB: ldusb: fix use-after-free on disconnect race (CVE-2026-64343)
    - USB: iowarrior: fix use-after-free on disconnect (CVE-2026-64342)
    - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
    - USB: legousbtower: fix use-after-free on disconnect race
      (CVE-2026-64340)
    - usb: sl811-hcd: disable controller wakeup on remove
    - USB: storage: include US_FL_NO_SAME in quirks mask
    - USB: misc: uss720: unregister parport on probe failure
      (CVE-2026-64338)
    - usb: mtu3: unmap request DMA on queue failure (CVE-2026-64337)
    - USB: serial: option: add Telit Cinterion FE990D50 compositions
    - USB: serial: digi_acceleport: fix broken rx after throttle
      (CVE-2026-64335)
    - USB: serial: digi_acceleport: fix hard lockup on disconnect
      (CVE-2026-64334)
    - USB: ulpi: fix memory leak on registration failure (CVE-2026-64332)
    - USB: usb-storage: ene_ub6250: restore media-ready check
    - usbip: tools: support SuperSpeedPlus devices
    - usbip: vudc: fix NULL deref in vep_dequeue() (CVE-2026-64331)
    - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
      (CVE-2026-64330)
    - usb: typec: ucsi: Invert DisplayPort role assignment
    - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP
      alt mode
    - iio: adc: spear: Initialize completion before requesting IRQ
    - iio: temperature: ltc2983: Fix n_wires default bypassing rotation
      check
    - udf: validate free block extents against the partition length
      (CVE-2026-64324)
    - udf: validate VAT header length against the VAT inode size
      (CVE-2026-64323)
    - udf: validate sparing table length as an entry count, not a byte
      count (CVE-2026-64322)
    - dm-ioctl: report an error if a device has no table
    - partitions: aix: bound the pp_count scan to the ppe array
      (CVE-2026-64318)
    - isofs: bound Rock Ridge symlink components to the SL record
      (CVE-2026-64317)
    - crypto: caam - use print_hex_dump_devel to guard key hex dumps
      (CVE-2026-64316) (CVE-2026-64315)
    - crypto: caam - use print_hex_dump_devel to guard key hex dumps
      (CVE-2026-64316) (CVE-2026-64315) again
    - crypto: ecc - Fix carry overflow in vli multiplication
      (CVE-2026-64313)
    - crypto: pcrypt - restore callback for non-parallel fallback
      (CVE-2026-64312)
    - crypto: drbg - Fix returning success on failure in CTR_DRBG
      (CVE-2026-64306)
    - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
    - crypto: drbg - Fix the fips_enabled priority boost
    - crypto: talitos - use dma_sync_single_for_cpu() before reading
      descriptor header
    - spi: fsl-lpspi: replace dmaengine_terminate_all() with
      dmaengine_terminate_sync()
    - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
      (CVE-2026-64303)
    - tracing: Prevent out-of-bounds read in glob matching (CVE-2026-64299)
    - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
      (CVE-2026-64298)
    - exfat: bound uniname advance in exfat_find_dir_entry()
      (CVE-2026-64296)
    - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest
      mode
    - udmabuf: fix DMA direction mismatch in release_udmabuf()
    - i2c: stm32f7: truncate clock period instead of rounding it
    - Input: synaptics-rmi4 - unregister function handlers on physical
      driver registration failure
    - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
      (CVE-2026-64277)
    - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
      (CVE-2026-64276)
    - Input: elan_i2c - prevent division by zero and arithmetic underflow
      (CVE-2026-64275)
    - Input: goodix - clamp the device-reported contact count
      (CVE-2026-64274)
    - Input: iforce - bound the device-reported force-feedback effect index
      (CVE-2026-64273)
    - Input: touchwin - reset the packet index on every complete packet
      (CVE-2026-64271)
    - Input: maplemouse - fix NULL pointer dereference in open()
    - Input: mms114 - fix multi-touch slot corruption
    - Input: maple_keyb - set driver data before registering input device
    - Input: maplemouse - set driver data before registering input device
    - Input: maplecontrol - set driver data before registering input device
    - RDMA/siw: bound Read Response placement to the RREAD length
      (CVE-2026-64268)
    - fuse: fix device node leak in cuse_process_init_reply()
    - fuse: re-lock request before returning from fuse_ref_folio()
      (CVE-2026-64266)
    - sched/fair: Only update stats for allowed CPUs when looking for dst
      group
    - crypto: algif_skcipher - force synchronous processing on trees
      without ctx->state
    - tools/mm/slabinfo: fix total_objects attribute name
    - crypto: af_alg - Remove zero-copy support from skcipher and aead
    - media: uvcvideo: Avoid partial metadata buffers
    - media: uvcvideo: Fix buffer sequence in frame gaps
    - serial: msm: Disable DMA for kernel console UART
    - serial: 8250_omap: clear rx_running on zero-length DMA completes
    - afs: Fix netns teardown to cancel the preallocation charger
    - afs: fix NULL pointer dereference in afs_get_tree()
    - afs: Fix further netns teardown to cancel the preallocation charger
    - drm/tidss: Drop extra drm_mode_config_reset() call
    - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
    - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
    - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA
      buffer
    - kconfig: fix potential NULL pointer dereference in conf_askvalue
    - wifi: ath9k: fix OOB access from firmware tx status queue ID
    - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint
    - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register
      failure
    - media: cedrus: Fix failure to clean up hardware on probe failure
    - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path
    - crypto: atmel-sha204a - fix blocking and non-blocking rng logic
    - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
    - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
      (CVE-2026-64544)
    - iommu/amd: Fix a stale comment about which legacy mode is user
      visible
    - clk: scmi: Fix clock rate rounding
    - thermal: hwmon: Fix critical temperature attribute removal
    - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()
    - crypto: ccp - Treat zero-length cert chain as query for blob lengths
    - net/sched: sch_htb: annotate data-races (I)
    - ipv6: addrconf: bail out of dad_failure when state is no longer
      POSTDAD
    - RDMA/hns: Fix arithmetic overflow in calc_hem_config()
    - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
    - RDMA/srpt: fix integer overflow in immediate data length check
    - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
    - sysfs: clamp show() return value in sysfs_kf_read()
    - net/sched: sch_drr: annotate data-races around cl->deficit
    - media: rockchip: rga: fix too small buffer size
    - device property: fix fwnode reference leak in
      fwnode_graph_get_endpoint_by_id()
    - cpufreq: Documentation: fix sampling_down_factor range
    - cpufreq: conservative: Simplify frequency limit handling
    - pwm: imx27: Fix variable truncation in .apply()
    - bus: sunxi-rsb: Always check register address validity
    - IB/mlx4: Fix refcount leak in add_port() error path
    - RDMA/hns: Fix warning in poll cq direct mode
    - PM: sleep: Use complete() in device_pm_sleep_init()
    - mtd: spi-nor: Drop duplicate Kconfig dependency
    - nvme-multipath: fix flex array size in struct nvme_ns_head
    - workqueue: drop spurious '*' from print_worker_info() fn declaration
    - ipv6: guard against possible NULL deref in __in6_dev_stats_get()
    - net/sched: cls_bpf: prevent unbounded recursion in offload rollback
    - drm/tegra: dc: Fix device node reference leak in
      tegra_dc_has_output()
    - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
    - ocfs2: don't BUG_ON an invalid journal dinode
    - ocfs2: kill osb->system_file_mutex lock
    - drm/msm/dp: fix HPD state status bit shift value
    - drm/msm/dp: Fix the ISR_* enum values
    - media: qcom: venus: drop extra padding in NV12 raw size calculation
    - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data
      writeback
    - ARM: imx3: Fix CCM node reference leak
    - ARM: imx31: Fix IIM mapping leak in revision check
    - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and
      multi-channel scans"
    - scsi: pm8001: Fix error code in non_fatal_log_show()
    - mm/fake-numa: fix under-allocation detection in uniform split
    - lib/test_meminit: use && for bools
    - bpftool: Use libbpf error code for flow dissector query
    - ocfs2: rebase copied fsdlm LVB pointers in locking_state
    - ocfs2: fix buffer head management in ocfs2_read_blocks()
    - ocfs2: reject FITRIM ranges shorter than a cluster
    - ocfs2/dlm: require a ref for locking_state debugfs open
    - ocfs2: fix race between ocfs2_control_install_private() and
      ocfs2_control_release()
    - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
    - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
    - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master
      helper is pptp
    - bpf: Update transport_header when encapsulating UDP tunnel in lwt
    - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO
      indication
    - ACPI: IPMI: Fix message kref handling on dead device
    - cpufreq: Documentation: fix conservative governor freq_step
      description
    - spi: ep93xx: fix double-free of zeropage on DMA setup failure
    - firmware_loader: Fix recursive lock in device_cache_fw_images()
    - configfs: fix lockless traversals of ->s_children
    - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of
      pins 34-39
    - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of
      pins 34-39
    - hwspinlock: qcom: avoid uninitialized struct members
    - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
    - fbdev: sm501fb: Fix buffer errors in OF binding code
    - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not
      specified
    - vhost/vdpa: validate virtqueue index in mmap and fault paths
    - tools/virtio: check mmap return value in vringh_test
    - bonding: 3ad: fix mux port state on oper down
    - fs: efs: remove unneeded debug prints
    - RDMA/mlx5: Fix undefined shift of user RQ WQE size
    - ASoC: fsl: fsl_audmix: Validate written enum values
    - ASoC: tegra: tegra210_ahub: Validate written enum value
    - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
    - sctp: validate embedded address parameter length
    - net/sched: sch_hfsc: Don't make class passive twice
    - tipc: require net admin for TIPCv2 netlink mutators
    - tipc: prevent snt_unacked underflow on CONN_ACK
    - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
    - crypto: cavium/cpt - fix DMA cleanup using wrong loop index
    - crypto: rng - Free default RNG on module exit
    - spi: xilinx: use FIFO occupancy register to determine buffer size
    - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during
      peek before restoring qlen
    - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during
      peek before restoring qlen
    - kcm: use WRITE_ONCE() when changing lower socket callbacks
    - netfilter: nf_conncount: callers must hold rcu read lock
    - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
      (CVE-2026-64548)
    - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
    - MIPS: mm: Fix out-of-bounds write in maar_res_walk()
    - KEYS: Use acquire when reading state in keyring search
    - tipc: fix UAF in tipc_l2_send_msg()
    - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
    - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
    - net/9p: fix race condition on rdma->state in trans_rdma.c
    - staging: nvec: fix use-after-free in nvec_rx_completed()
    - coresight: cti: Fix DT filter signals silently ignored
    - x86/platform/olpc: xo15: Drop wakeup source on driver removal
    - platform/x86: xo15-ebook: Fix wakeup source and GPE handling
    - staging: most: video: avoid double free on video register failure
    - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
    - usb: host: max3421: Reject hub port requests for non-existent ports
    - char: tlclk: fix use-after-free in tlclk_cleanup()
    - iio: light: si1133: reset counter to prevent race condition
    - iio: light: si1133: prevent race condition on timeout
    - iio: magnetometer: ak8975: fix potential kernel stack memory leak
    - iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
    - HID: logitech-hidpp: remove excess kernel-doc member in
      hidpp_scroll_counter
    - dmaengine: Fix possible use after free
    - clk: qcom: a53: Corrected frequency multiplier for 1152MHz
    - pNFS/filelayout: fix cheking if a layout is striped
    - NFSv4/pnfs: defer return_range callbacks until after inode unlock
    - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect
      errors
    - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in
      pg_get_mirror_count_write
    - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
    - PCI: rcar-host: Remove unused LIST_HEAD(res)
    - tools lib api: Fix missing null termination in
      filename__read_int/ull()
    - tools lib api: Fix filename__write_int() writing uninitialized stack
      data
    - tools lib api: Fix mount_overload() snprintf truncation and toupper
      range
    - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
    - PCI: mediatek: Use actual physical address instead of virt_to_phys()
    - apparmor: check label build before no_new_privs test
    - apparmor: aa_label_alloc use aa_label_free on alloc failure
    - apparmor: grab ns lock and refresh when looking up changehat child
      profiles
    - apparmor: fix potential UAF in aa_replace_profiles
    - apparmor: aa_getprocattr free procattr leak on format failure
    - apparmor: put secmark label after secid lookup
    - i3c: master: Prevent reuse of dynamic address on device add failure
    - apparmor: fix label can not be immediately before a declaration
    - sparc: led: avoid trimming a newline from empty writes
    - xfrm: validate selector family and prefixlen during match
    - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
    - net: psample: fix info leak in PSAMPLE_ATTR_DATA (CVE-2026-64553)
    - sctp: hold socket lock when dumping endpoints in sctp_diag
    - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate
      BAS
    - thermal: intel: Fix dangling resources on thermal_throttle_online()
      failure
    - ACPI: resource: Amend kernel-doc style
    - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
    - ieee802154: fix kernel-infoleak in dgram_recvmsg()
    - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
    - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
    - irqchip/crossbar: Fix parent domain resource leak
    - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
    - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
    - bpf: Fix stack slot index in nospec checks
    - drm/edid: fix OOB read in drm_parse_tiled_block() (CVE-2026-64546)
    - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (CVE-2026-64538)
    - ipv4: fib: Don't ignore error route in local/main tables.
    - netfilter: nf_conncount: prevent connlimit drops for early confirmed
      ct
    - netfilter: nft_synproxy: stop bypassing the priv->info snapshot
    - alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
    - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
    - net: dsa: sja1105: round up PTP perout pin duration
    - ipv6: fix error handling in disable_ipv6 sysctl
    - ipv6: fix error handling in ignore_routes_with_linkdown sysctl
    - ipv6: fix error handling in forwarding sysctl
    - ipv6: fix error handling in disable_policy sysctl
    - smb/client: preserve errors from smb2_set_sparse()
    - rtc: ds1307: Fix off-by-one issue with wday for rx8130
    - rtc: cmos: unregister HPET IRQ handler on probe failure
    - net: mvneta: re-enable percpu interrupt on resume
    - net: sungem: fix probe error cleanup
    - tracing: probes: fix typo in a log message
    - spi: sh-msiof: abort transfers when reset times out
    - gpio: mvebu: fail probe if gpiochip registration fails
    - gpio: htc-egpio: use managed gpiochip registration
    - seg6: validate SRH length before reading fixed fields
    - hwmon: adm1275: Prevent reading uninitialized stack
    - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
      (CVE-2026-64540)
    - tracing/events: Fix to check the simple_tsk_fn creation
    - virtio_net: disable cb when NAPI is busy-polled
    - cxgb4: Fix decode strings dump for T6 adapters
    - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in
      probe
    - net/sched: hhf: clear heavy-hitter state on reset
    - afs: Fix error code in afs_extract_vl_addrs()
    - afs: Fix callback service message parsers to pass through -EAGAIN
    - afs: Fix vllist leak
    - afs: Fix unchecked-length string display in debug statement
    - ata: sata_gemini: unwind clocks on IDE pinctrl errors
    - HID: picolcd: prevent NULL pointer dereference in
      picolcd_send_and_wait()
    - HID: core: Fix OOB read in hid_get_report for numbered reports
    - net: usb: net1080: validate packet_len before pad-byte access in
      rx_fixup (CVE-2026-64547)
    - gue: validate REMCSUM private option length
    - netfilter: xt_u32: reject invalid shift counts
    - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
    - netfilter: ip6tables: mark malformed IPv6 extension headers for
      hotdrop
    - qede: fix off-by-one in BD ring consumption on build_skb failure
    - net: qualcomm: rmnet: simplify some byte order logic
    - net: qualcomm: rmnet: kill RMNET_MAP_GET_*() accessor macros
    - net: qualcomm: rmnet: use masks instead of C bit-fields
    - net: qualcomm: rmnet: don't use C bit-fields in rmnet checksum header
    - net: ethernet: rmnet: Support for ingress MAPv5 checksum offload
    - net: qualcomm: rmnet: add tx packets aggregation
    - net: qualcomm: rmnet: validate MAP frame length before ingress
      parsing (CVE-2026-64550)
    - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
      (CVE-2026-64541)
    - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
    - Bluetooth: bpa10x: avoid OOB read of revision string in
      bpa10x_setup() (CVE-2026-64549)
    - ring-buffer: Fix event length with forced 8-byte alignment
    - net: usb: lan78xx: disable VLAN filter in promiscuous mode
    - net/sched: cake: reject overhead values that underflow length
    - mld: convert from timer to delayed work
    - mld: get rid of inet6_dev->mc_lock
    - mld: convert ipv6_mc_socklist->sflist to RCU
    - mld: convert ip6_sf_list to RCU
    - mld: convert ifmcaddr6 to RCU
    - mld: add new workqueues for process mld events
    - mld: add mc_lock for protecting per-interface mld data
    - ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()
    - ipv6: mcast: Replace locking comments with lockdep annotations.
    - ipv6: mcast: Fix potential UAF in MLD delayed work
    - ipvs: pass parsed transport offset to state handlers
    - ipvs: use parsed transport offset in TCP state lookup
    - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
    - ipvs: ensure inner headers in ICMP errors are in headroom
    - dm era: fix NULL pointer dereference in metadata_open()
    - regulator: core: Make regulator_lock_two() logic easier to follow
    - regulator: core: regulator_lock_two() should test for EDEADLK not
      EDEADLOCK
    - net/mlx5: Fix L3 tunnel entropy refcount leak
    - smb: client: fix overflow in passthrough ioctl bounds check
    - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
    - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
    - net: atm: reject out-of-range traffic classes in QoS validation
    - net: ife: require ETH_HLEN to be pullable in ife_decode()
    - arm64: dts: qcom: sdm630: describe adsp_mem region properly
    - KVM: arm64: vgic: Check the interrupt is still ours before migrating
      it
    - fbdev: sm712: Fix operator precedence in big_swap macro
    - fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
    - fbdev: i740fb: fix potential memory leak in i740fb_probe()
    - fbdev: s3fb: fix potential memory leak in s3_pci_probe()
    - fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
    - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
    - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
    - fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
    - fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
    - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
    - netfilter: nfnl_cthelper: apply per-class values when updating
      policies
    - netfilter: xt_cluster: reject template conntracks in hash match
    - netfilter: nf_nat_sip: reload possible stale data pointer
    - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6
      defrag
    - netfilter: nf_conncount: fix zone comparison in tuple dedup
    - netfilter: xt_nat: reject unsupported target families
    - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
      (CVE-2026-64554)
    - gpu: host1x: Fix device reference leak in host1x_device_parse_dt()
      error path
    - soc: ti: k3-ringacc: Fix access mode for
      k3_ringacc_ring_pop_tail_io/proxy
    - soc: fsl: qe: panic on ioremap() failure in qe_reset()
    - leds: uleds: Fix potential buffer overread
    - mfd: sm501: Fix reference leak on failed device registration
    - x86/boot: Validate console=uart8250 baud rate to fix early boot hang
    - x86/boot: Reject too long acpi_rsdp= values
    - batman-adv: gw: acquire ethernet header only after skb realloc
    - batman-adv: access unicast_ttvn skb->data only after skb realloc
    - batman-adv: dat: acquire ARP hw source only after skb realloc
    - batman-adv: bla: reacquire gw address after skb realloc
    - batman-adv: dat: ensure accessible eth_hdr proto field
    - batman-adv: dat: fix tie-break for candidate selection
    - batman-adv: tt: avoid request storms during pending request
    - batman-adv: fix VLAN priority offset
    - batman-adv: frag: free unfragmentable packet
    - batman-adv: frag: fix primary_if leak on failed linearization
    - batman-adv: tt: prevent TVLV OOB check overflow
    - mfd: tps6586x: Fix OF node refcount
    - nvdimm/btt: Free arenas on btt_init() error paths
    - nvdimm/btt: Free arena sub-allocations on discover_arenas() error
      path
    - lockd: Plug nlm_file leak when nlm_do_fopen() fails
    - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
    - power: supply: charger-manager: fix refcount leak in
      is_full_charged()
    - proc: only bump parent nlink when registering directories
    - mtd: slram: remove failed entries from the device list
    - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
    - ocfs2: use kzalloc for quota recovery bitmap allocation
    - mtd: rawnand: fix condition in 'nand_select_target()'
    - ocfs2: avoid moving extents to occupied clusters
    - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
    - ocfs2: reject dinodes with non-canonical i_mode type
    - ocfs2: reject dinodes whose i_rdev disagrees with the file type
    - ocfs2: reject non-inline dinodes with i_size and zero i_clusters
    - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
    - irqchip/crossbar: Use correct index in crossbar_domain_free()
    - i2c: mediatek: fix WRRD for SoCs without auto_restart option
    - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
    - xen/gntdev: fix error handling in ioctl
    - xfrm: use compat translator only for u64 alignment mismatch
    - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for
      changelink
    - tpm: fix event_size output in tpm1_binary_bios_measurements_show
    - tpm: Make the TPM character devices non-seekable
    - time: Fix off-by-one in compat settimeofday() usec validation
    - spi: uniphier: Fix completion initialization order before
      devm_request_irq()
    - sctp: validate STALE_COOKIE cause length before reading staleness
      (CVE-2026-64551)
    - nvmet-rdma: handle inline data with a nonzero offset
    - can: isotp: use unconditional synchronize_rcu() in isotp_release()
    - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
    - can: bcm: add missing rcu list annotations and operations
    - dm thin metadata: fix superblock refcount leak on snapshot shadow
      failure
    - dm thin metadata: fix metadata snapshot consistency on commit failure
    - dm era: fix out-of-bounds memory access for non-zero start sector
    - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
    - dm-log: fix a bitset_size overflow on 32bit machines
    - dm-stats: fix dm_jiffies_to_msec64
    - dm-stats: fix merge accounting
    - dm_early_create: fix freeing used table on dm_resume failure
    - dm-verity: increase sprintf buffer size
    - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
    - scsi: sg: Report request-table problems when any status is set
    - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND
      MOVE
    - Input: ims-pcu - fix use-after-free and double-free in disconnect
    - Input: ims-pcu - release data interface on disconnect
    - Input: ims-pcu - validate control endpoint type
    - Input: ims-pcu - add response length checks
    - Input: ims-pcu - fix DMA mapping violation in line setup
    - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug
      logging
    - Input: ims-pcu - fix potential infinite loop in CDC union descriptor
      parsing
    - Input: ims-pcu - fix type confusion in CDC union descriptor parsing
    - cpu: hotplug: Preserve per instance callback errors
    - gpios: palmas: add .get_direction() op
    - net: sit: require CAP_NET_ADMIN in the device netns for changelink
    - net: ena: clean up XDP TX queues when regular TX setup fails
    - net: ip6_vti: require CAP_NET_ADMIN in the device netns for
      changelink
    - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
    - net: ip6_gre: require CAP_NET_ADMIN in the device netns for
      changelink
    - ieee802154: admin-gate legacy LLSEC dump operations
    - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
    - ieee802154: ca8210: fix cas_ctl leak on spi_async failure
    - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
    - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error
      path (CVE-2026-64534)
    - batman-adv: retrieve ethhdr after potential skb realloc on RX
    - batman-adv: ensure minimal ethernet header on TX
    - rtmutex: Use waiter::task instead of current in remove_waiter()
      (CVE-2026-43499)
    - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
    - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
    - hwmon: (w83627hf) remove VID sysfs files on error and remove
    - hwmon: (w83793) remove vrm sysfs file on probe failure
    - net: liquidio: fix BAR resource leak on PF number failure
    - fsl/fman: Free init resources on KeyGen failure in fman_init()
    - net/sched: sch_multiq: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked
    - tracing/probes: Fix double addition of offset for @+FOFFSET
    - orangefs: keep the readdir entry size 64-bit in fill_from_part()
    - ata: pata_pxa: Fix DMA channel leak on probe error
    - hwmon: (asus_atk0110) Check package count before accessing element
    - mac802154: remove interfaces with RCU list deletion
    - llc: fix SAP refcount leak in llc_ui_autobind()
    - ipvs: use parsed transport offset in SCTP state lookup
    - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
    - drbd: reject data replies with an out-of-range payload size
    - cgroup/cpuset: rebind mm mempolicy to effective_mems, not
      mems_allowed
    - wifi: rt2x00: avoid full teardown before work setup in probe
    - wifi: mac80211: fix memory leak in ieee80211_register_hw()
    - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
    - Bluetooth: btrtl: validate firmware patch bounds
    - llc: fix SAP refcount leak when creating incoming sockets
    - macsec: fix promiscuity refcount leak in macsec_dev_open()
    - memstick: ms_block: reject a card that reports too many blocks
    - ipvs: fix more places with wrong ipv6 transport offsets
    - reset: sunxi: fix memory region leak on ioremap failure
    - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
    - wifi: mac80211: free ack status frame on TX header build failure
    - wifi: mwifiex: fix permanently busy scans after multiple roam
      iterations
    - mtd: onenand: samsung: report DMA completion timeouts
    - mmc: vub300: defer reset until cmd_mutex is unlocked
    - mtd: rawnand: fsl_ifc: return errors for failed page reads
    - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
    - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
    - crypto: amcc - fix incorrect kernel-doc comment syntax in files
    - crypto: crypto4xx - Remove ahash-related code
    - crypto: crypto4xx - Remove insecure and unused rng_alg
    - batman-adv: clean untagged VLAN on netdev registration failure
    - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup (CVE-2026-64510)
    - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
    - iio: hid-sensor-rotation: Fix stale or zero output when reading raw
      values
    - iio: imu: inv_icm42600: make timestamp module chip independent
    - iio: move inv_icm42600 timestamp module in common
    - iio: make invensense timestamp module generic
    - iio: imu: inv_mpu6050: use the common inv_sensors timestamp module
    - iio: invensense: remove redundant initialization of variable period
    - iio: invensense: fix timestamp glitches when switching frequency
    - iio: imu: inv_icm42600: stabilized timestamp in interrupt
    - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
    - bitops: make BYTES_TO_BITS() treewide-available
    - iio: common: st_sensors: honour channel endianness in read_axis_data
    - ALSA: aoa: check snd_ctl_new1() return value (CVE-2026-64488)
    - Bluetooth: btintel: Fix offset calculation boot address parameter
    - Bluetooth: btintel: Check firmware version before download
    - Bluetooth: btusb: fix use-after-free on marvell probe failure
      (CVE-2026-64470)
    - Bluetooth: btusb: fix wakeup source leak on probe failure
    - vfio/pci: Release the VGA arbiter client on register_device() failure
      (CVE-2026-64475)
    - binder: fix UAF in binder_free_transaction() (CVE-2026-64468)
    - PCI: altera: Fix resource leaks on probe failure (CVE-2026-64462)
    - media: atomisp: replace boolean comparison of values with bool
      variables
    - media: staging: media: atomisp: Fix sh_css.c brace coding style
      issues
    - media: staging: media: atomisp: Fix the rest of sh_css.c brace issues
    - media: staging: media: atomisp: Replace if else clause with a ternary
    - media: staging: media: atomisp: Fix alignment and line length issues
    - staging: media: atomisp: reduce load_primary_binaries() stack usage
    - cifs: Create a new shared file holding smb2 pdu definitions
    - cifs: remove check of list iterator against head past the loop body
    - smb2: small refactor in smb2_check_message()
    - cifs: remove unused server parameter from calc_smb_size()
    - smb: client: restrict implied bcc[0] exemption to responses without
      data area (CVE-2026-64448)
    - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
    - staging: rtl8723bs: split too long line
    - staging: rtl8723bs: remove commented out RT_ASSERT occurrences
    - staging: rtl8723bs: remove all 5Ghz network types
    - staging: rtl8723bs: remove 5Ghz code related to channel plan
      definition
    - staging: rtl8723bs: remove 5Ghz code blocks
    - staging: rtl8723bs: remove commented out condition
    - staging: rtl8723bs: clean up comparsions to NULL
    - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
      (CVE-2026-64445)
    - staging: rtl8723bs: Fix space issues
    - staging: rtl8723bs: fix heap buffer overflow in
      rtw_cfg80211_set_wpa_ie() (CVE-2026-64446)
    - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and
      join_cmd_hdl() (CVE-2026-64442)
    - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
    - PCI: mediatek: Convert bool to single quirks entry and bitmap
    - PCI: mediatek: Fix IRQ domain leak when port fails to enable
      (CVE-2026-64461)
    - staging: rtl8723bs: remove DBG_871X log argument
    - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
      (CVE-2026-64438)
    - PCI: Prevent resource tree corruption when BAR resize fails
    - PCI: Free saved list without holding pci_bus_sem
    - PCI: Fix restoring BARs on BAR resize rollback path
    - PCI: Add kerneldoc for pci_resize_resource()
    - PCI: Move Resizable BAR code to rebar.c
    - PCI: Skip Resizable BAR restore on read error
    - coresight: etb10: restore atomic_t for shared reading state
    - netfilter: ebtables: Use vmalloc_array() to improve code
    - netfilter: ebtables: zero chainstack array (CVE-2026-64413)
    - Bluetooth: L2CAP: Fix not tracking outstanding TX ident
    - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
    - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
      (CVE-2026-64206)
    - smb: client: Fix next buffer leak in receive_encrypted_standard()
      (CVE-2026-64381)
    - smb: client: mask server-provided mode to 07777 in modefromsid
      (CVE-2026-64379)
    - smb: client: use unaligned reads in parse_posix_ctxt()
    - smb: client: harden POSIX SID length parsing (CVE-2026-64380)
    - writeback: fix race between cgroup_writeback_umount() and
      inode_switch_wbs() (CVE-2026-64378)
    - X.509: Fix validation of ASN.1 certificate header
    - proc: use generic setattr() for /proc/$PID/net
    - proc: rename proc_setattr to proc_nochmod_setattr
    - proc: protect ptrace_may_access() with exec_update_lock (FD links)
      (CVE-2026-64375)
    - HID: add haptics page defines
    - HID: multitouch: fix out-of-bounds bit access on mt_io_flags
      (CVE-2026-64364)
    - cpufreq: intel_pstate: Sync policy->cur during CPU offline
    - proc: protect ptrace_may_access() with exec_update_lock (part 1)
      (CVE-2026-64371)
    - HID: appleir: fix UAF on pending key_up_timer in remove()
      (CVE-2026-64363)
    - serial: 8250_mid: Remove 8250_pci usage
    - serial: 8250_mid: Disable DMA for selected platforms
    - xfs: reflect sb features in xfs_mount
    - xfs: fix unreachable BIGTIME check in dquot flush validation
    - xfs: use null daddr for unset first bad log block
    - hfs/hfsplus: prevent getting negative values of offset/length
    - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
      (CVE-2026-64361)
    - usb: gadget: function: Simplify diagnostic messaging in printer
    - usb: gadget: f_printer: take kref only for successful open
      (CVE-2026-64345)
    - usb: free iso schedules on failed submit (CVE-2026-64348)
    - usb: iowarrior: remove inherent race with minor number
    - USB: serial: digi_acceleport: fix write buffer corruption
      (CVE-2026-64333)
    - drm/i2c/sil164: Drop no-op remove function
    - leds: lm3697: Remove duplicated error reporting in .remove()
    - leds: lm3601x: Improve error reporting for problems during .remove()
    - gpio: pca953x: Make platform teardown callback return void
    - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
      (CVE-2026-64329)
    - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
    - usb: typec: tcpm: Fix VDM type for Enter Mode commands
    - usb: gadget: f_fs: initialize reset_work at allocation time
    - crypto: atmel-sha204a - Mark OF related data as maybe unused
    - crypto: atmel - Drop explicit initialization of struct
      i2c_device_id::driver_data to 0
    - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
    - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
    - btrfs: do not trim a device which is not writeable
    - crypto: qat - fix restarting state leak on allocation failure
    - crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)
    - audit: add audit_log_nf_skb helper function
    - audit: fix potential integer overflow in audit_log_n_hex()
    - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
    - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
    - Bluetooth: L2CAP: Fix regressions caused by reusing ident
    - iio: imu: inv_mpu6050: fix frequency setting when chip is off
    - iio: invensense: fix odr switching to same value
    - iio: imu: inv_icm42600: fix timestamp clock period by using lower
      value
    - mld: change lockdep annotation for ip6_sf_socklist and
      ipv6_mc_socklist
    - ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
    - net: ethernet: rmnet: Always subtract MAP header
    - ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
    - ipv6: fix lockdep splat in in6_dump_addrs()
    - net: mld: fix reference count leak in mld_{query | report}_work()
    - ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
    - ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
    - mld: fix suspicious RCU usage in __ipv6_dev_mc_dec()
    - perf/x86/amd/core: Always use the NMI latency mitigation
    - tools/resolve_btfids: Fix some error messages
    - tools/resolve_btfids: Emit warnings and patch zero id for missing
      symbols
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.262
    - posix-cpu-timers: Prevent UAF caused by non-leader exec() race
      (CVE-2026-64560)

  [ Emilio Pozuelo Monfort ]
  * [rt] Update to 5.10.261-rt157
  * [rt] Refresh:
    - Refresh "signals: Allow rt tasks to cache one sigqueue struct"

 -- Emilio Pozuelo Monfort <pochu@debian.org>  Fri, 31 Jul 2026 11:44:47 +0200

linux (5.10.259-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.258
    - [x86] ALSA: asihpi: avoid write overflow check warning
    - can: mcp251x: add error handling for power enable in open and resume
    - btrfs: tracepoints: get correct superblock from dentry in event
      btrfs_sync_file() (CVE-2026-43117)
    - [x86] ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
    - [x86] netfilter: nft_set_pipapo_avx2: don't return non-matching entry on
      expiry (CVE-2026-43114)
    - [arm*] wifi: wl1251: validate packet IDs before indexing tx_frames
      (CVE-2026-43113)
    - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
    - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
    - HID: roccat: fix use-after-free in roccat_report_event (CVE-2026-43111)
    - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
    - wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
    - [armhf] ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
    - [arm64] dts: imx8mq: Set the correct gpu_ahb clock frequency
    - [amd64] PCI: hv: Set default NUMA node to 0 for devices without affinity
      info
    - [arm*] drm/vc4: Fix memory leak of BO array in hang state
      (CVE-2026-43105)
    - [arm*] drm/vc4: Fix a memory leak in hang state error path
      (CVE-2026-43104)
    - [arm*] drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
    - net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
    - net: lapbether: Close the LAPB device before its underlying Ethernet
      device closes
    - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE (CVE-2026-43103)
    - tracing/probe: reject non-closed empty immediate strings
    - e1000: check return value of e1000_read_eeprom
    - xsk: tighten UMEM headroom validation to account for tailroom and min
      frame (CVE-2026-43093)
    - xfrm_user: fix info leak in build_mapping() (CVE-2026-43089)
    - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
      (CVE-2026-43085)
    - netfilter: xt_multiport: validate range encoding in checkentry
      (CVE-2026-31681)
    - netfilter: ip6t_eui64: reject invalid MAC header for all packets
      (CVE-2026-31685)
    - af_unix: read UNIX_DIAG_VFS data under unix_state_lock (CVE-2026-31673)
    - l2tp: Drop large packets with UDP encap (CVE-2026-43080)
    - netfilter: conntrack: add missing netlink policy validations
      (CVE-2026-31407)
    - [x86] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
      (CVE-2026-31656)
    - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR
    - batman-adv: hold claim backbone gateways by reference (CVE-2026-31657)
    - nfc: llcp: add missing return after LLCP_CLOSED checks (CVE-2026-31629)
    - can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
    - [armhf] i2c: s3c24xx: check the size of the SMBUS message before using it
      (CVE-2026-31627)
    - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
      (CVE-2026-31626)
    - HID: alps: fix NULL pointer dereference in alps_raw_event()
      (CVE-2026-31625)
    - HID: core: clamp report_size in s32ton() to avoid undefined shift
      (CVE-2026-31624)
    - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
      (CVE-2026-31623)
    - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
      (CVE-2026-31622)
    - ALSA: fireworks: bound device-supplied status before string array lookup
      (CVE-2026-31619)
    - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
      (CVE-2026-31618)
    - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
      (CVE-2026-31617)
    - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
      (CVE-2026-31616)
    - [arm*] usb: gadget: renesas_usb3: validate endpoint index in standard
      request handlers (CVE-2026-31615)
    - usbip: validate number_of_packets in usbip_pack_ret_submit()
      (CVE-2026-31607)
    - usb: storage: Expand range of matched versions for VL817 quirks entry
    - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
      (CVE-2026-31605)
    - staging: sm750fb: fix division by zero in ps_to_hz() (CVE-2026-31603)
    - USB: serial: option: add Telit Cinterion FN990A MBIM composition
    - ALSA: ctxfi: Limit PTP to a single page (CVE-2026-31602)
    - media: vidtv: fix NULL pointer dereference in
      vidtv_channel_pmt_match_sections (CVE-2026-31599)
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
      (CVE-2026-31597)
    - ocfs2: handle invalid dinode in ocfs2_group_extend (CVE-2026-31596)
    - [x86] KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
      (CVE-2026-31590)
    - rxrpc: Fix call removal to use RCU safe deletion (CVE-2026-31642)
    - rxrpc: proc: size address buffers for %pISpc output (CVE-2026-31630)
    - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave"
      (regression in 5.10.252)
    - media: uvcvideo: Allow extra entities
    - [x86] KVM: x86: Use scratch field in MMIO fragment to hold small write
      values (CVE-2026-31588)
    - mm/kasan: fix double free for kasan pXds (CVE-2026-31686)
    - media: vidtv: fix nfeeds state corruption on start_streaming failure
      (CVE-2026-31585)
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (CVE-2026-31583)
    - ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
    - bcache: fix cached_dev.sb_bio use-after-free and crash (CVE-2026-31580)
    - media: as102: fix to not free memory after the device is registered in
      as102_usb_probe() (CVE-2026-31578)
    - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
      (CVE-2026-31577)
    - media: vidtv: fix pass-by-value structs causing MSAN warnings
      (CVE-2026-43058)
    - media: hackrf: fix to not free memory after the device is registered in
      hackrf_probe() (CVE-2026-31576)
    - net: tap: NULL pointer derefence in dev_parse_header_protocol when
      skb->dev is null (CVE-2022-50073)
    - scsi: qla2xxx: Fix warning message due to adisc being flushed
      (CVE-2022-49158)
    - scsi: qla2xxx: Fix crash when I/O abort times out (CVE-2022-50493)
    - net/sched: act_ct: fix ref leak when switching zones (CVE-2022-49183)
    - bpf, sockmap: Fix an infinite loop error when len is 0 in
      tcp_bpf_recvmsg_parser() (CVE-2023-53133)
    - ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
    - drm/amd/display: Add null checker before passing variables
      (CVE-2024-43902)
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
      (CVE-2026-23444)
    - drm/amd/display: Fix memory leak (CVE-2022-49135)
    - [x86] thermal/int340x_thermal: handle data_vault when the value is
      ZERO_SIZE_PTR (CVE-2022-48703)
    - blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
      (CVE-2023-53421)
    - scsi: ufs: core: Improve SCSI abort handling (CVE-2021-47188)
    - IB/mad: Don't call to function that might sleep while in atomic context
      (CVE-2022-50472)
    - mailbox: Prevent out-of-bounds access in of_mbox_index_xlate()
      (CVE-2026-43281)
    - rxrpc: fix reference count leak in rxrpc_server_keyring()
      (CVE-2026-31634)
    - xfrm: clear trailing padding in build_polexpire() (CVE-2026-31664)
    - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
    - ocfs2: validate inline data i_size during inode read (CVE-2026-43076)
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (CVE-2026-43075)
    - rxrpc: reject undecryptable rxkad response tickets (CVE-2026-31637)
    - blk-mq: use quiesced elevator switch when reinitializing queues
      (CVE-2022-50552)
    - drivers: base: Free devm resources when unregistering a device
      (CVE-2023-53596)
    - [x86] uprobes: Fix XOL allocation failure for 32-bit tasks
    - fs/ocfs2: fix comments mentioning i_mutex
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write
      (CVE-2026-31598)
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
      (CVE-2026-31586)
    - [arm64] dts: imx8mq-librem5-r3: workaround i2c1 issue with 1GHz cpu
      voltage
    - [arm64] dts: imx8mq-librem5: Don't mark buck3 as always on
    - [arm64] dts: imx8mq-librem5: set regulators boot-on
    - [arm64] dts: imx8mq-librem5: Bump BUCK1 suspend voltage to 0.81V
    - [arm64] dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
    - gfs2: Validate i_depth for exhash directories (CVE-2025-38710)
    - i3c: fix uninitialized variable use in i2c setup
    - rxrpc: Fix recvmsg() unconditional requeue (CVE-2026-23066)
    - cifs: Fix connections leak when tlink setup failed (CVE-2022-49822)
    - rxrpc: only handle RESPONSE during service challenge (CVE-2026-31676)
    - rxrpc: Fix anonymous key handling
    - fuse: reject oversized dirents in page cache (CVE-2026-31694)
    - fuse: quiet down complaints in fuse_conn_limit_write
    - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
    - ALSA: caiaq: take a reference on the USB device in create_card()
      (CVE-2026-31701)
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
      (CVE-2026-31699)
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command
      failed (CVE-2026-31698)
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
      (CVE-2026-31697)
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
      (CVE-2026-31696)
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (CVE-2026-46018)
    - ALSA: usb-audio: Avoid false E-MU sample-rate notifications
    - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
    - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
    - [x86] misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
      (CVE-2026-46022)
    - [x86] ibmasm: fix OOB reads in command_file_write due to missing size
      checks (CVE-2026-45994)
    - [x86] ibmasm: fix heap over-read in ibmasm_send_i2o_message()
      (CVE-2026-46064)
    - ocfs2: split transactions in dio completion to avoid credit exhaustion
      (CVE-2026-46080)
    - padata: Fix pd UAF once and for all (CVE-2025-38584)
    - driver core: Don't let a device probe until it's ready
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
    - ALSA: control: Validate buf_len before strnlen() in
      snd_ctl_elem_init_enum_names() (CVE-2026-46088)
    - net: caif: clear client service pointer on teardown (CVE-2026-46098)
    - net: strparser: fix skb_head leak in strp_abort_strp() (CVE-2026-46102)
    - Revert "ALSA: usb: Increase volume range that triggers a warning"
      (regression in 5.10.249)
    - lib/ts_kmp: fix integer overflow in pattern length calculation
    - net: qrtr: ns: Fix use-after-free in driver remove() (CVE-2026-46047)
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
      (CVE-2026-46002)
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (CVE-2026-46049)
    - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
    - ALSA: caiaq: Fix control_put() result and cache rollback
    - ALSA: caiaq: Handle probe errors properly (CVE-2026-46004)
    - ALSA: 6fire: Fix input volume change detection
    - iio: adc: ad7768-1: fix one-shot mode data acquisition
    - net: rds: fix MR cleanup on copy error (CVE-2026-46053)
    - net/smc: avoid early lgr access in smc_clc_wait_msg (CVE-2026-46027)
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
      (CVE-2026-46043)
    - mmc: block: use single block write in retry
    - tpm: tpm_tis: add error logging for data transfer
    - userfaultfd: allow registration of ranges below mmap_min_addr
    - [x86] KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
      (CVE-2026-45987)
    - [x86] KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest
      mode
    - [x86] KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
    - io_uring/poll: fix EPOLL_URING_WAKE sometimes not being honored
    - io_uring/poll: fix backport of io_poll_add() changes
    - mtd: docg3: fix use-after-free in docg3_release() (CVE-2026-46285)
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
      (CVE-2026-46046)
    - md/raid5: fix soft lockup in retry_aligned_read() (CVE-2026-46051)
    - md/raid5: validate payload size before accessing journal metadata
      (CVE-2026-46070)
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
      (CVE-2026-46040)
    - taskstats: set version in TGID exit notifications
    - [armhf] crypto: atmel-aes - Fix 3-page memory leak in
      atmel_aes_buff_cleanup (CVE-2026-46019)
    - [armhf] crypto: atmel-ecc - Release client on allocation failure
    - [arm*] crypto: ccree - fix a memory leak in cc_mac_digest()
      (CVE-2026-45986)
    - [armhf] crypto: atmel-tdes - fix DMA sync direction (CVE-2026-46077)
    - dm mirror: fix integer overflow in create_dirty_log() (CVE-2026-46023)
    - IB/core: Fix zero dmac race in neighbor resolution
    - crypto: authencesn - reject short ahash digests during instance creation
      (CVE-2026-46033)
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
    - ALSA: caiaq: Don't abort when no input device is available
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
      (CVE-2026-43501)
    - drm/amdgpu: fix zero-size GDS range init on RDNA4 (CVE-2026-46276)
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure
    - netfilter: reject zero shift in nft_bitwise (CVE-2026-46101)
    - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
      (CVE-2026-46149)
    - ipmi: Add limits to event and receive message requests (CVE-2026-46177)
    - ipmi: Check event message buffer response for bad data (CVE-2026-46128)
    - ipmi:si: Return state to normal if message allocation fails
      (CVE-2026-46108)
    - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
      (CVE-2026-43497)
    - [x86] ACPI: video: force native backlight on HP OMEN 16 (8A44)
    - net/sched: sch_red: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked (CVE-2026-43496)
    - ipmi:ssif: Fix a shutdown race
    - ipmi:ssif: Clean up kthread on errors (CVE-2026-46044)
    - ipmi:ssif: Remove unnecessary indention
    - ipmi:ssif: NULL thread on error
    - wifi: b43legacy: enforce bounds check on firmware key index in RX path
      (CVE-2026-46163)
    - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
      (CVE-2026-46187)
    - wifi: ath5k: do not access array OOB (Closes: #1119093) (CVE-2026-46307)
    - wifi: b43: enforce bounds check on firmware key index in b43_rx()
      (CVE-2026-46122)
    - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
      (CVE-2026-46151)
    - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
      (CVE-2026-46167)
    - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
      (CVE-2026-46146)
    - ALSA: usb-audio: Fix UAC3 cluster descriptor size check
    - USB: serial: option: add Telit Cinterion LE910Cx compositions
    - usb: ulpi: fix memory leak on ulpi_register() error paths
      (CVE-2026-46109)
    - ALSA: firewire-tascam: Do not drop unread control events
    - xfrm: provide message size for XFRM_MSG_MAPPING
    - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (CVE-2026-46172)
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
      (CVE-2026-45835)
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
      (CVE-2026-45834)
    - fanotify: fix false positive on permission events (CVE-2026-46150)
    - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
      rtnl_fill_vfinfo (CVE-2026-46132)
    - sound: ua101: fix division by zero at probe (CVE-2026-46184)
    - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CVE-2026-46120)
    - net/rds: handle zerocopy send cleanup before the message is queued
      (CVE-2026-43502)
    - hv_sock: fix ARM64 support
    - udf: reject descriptors with oversized CRC length
    - [i386] spi: topcliff-pch: fix use-after-free on unbind (CVE-2026-46301)
    - dm: don't report warning when doing deferred remove
    - dm: fix a buffer overflow in ioctl processing (CVE-2026-46294)
    - dm-verity-fec: correctly reject too-small FEC devices
    - dm-verity-fec: correctly reject too-small hash devices
    - isofs: validate Rock Ridge CE continuation extent against volume size
      (CVE-2026-46303)
    - isofs: validate block number from NFS file handle in isofs_export_iget
      (CVE-2026-46124)
    - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
      (CVE-2026-46161)
    - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (CVE-2026-46304)
    - PCI/AER: Clear only error bits in PCIe Device Status
    - PCI/AER: Stop ruling out unbound devices as error source
    - [x86] power: supply: max17042: avoid overflow when determining health
    - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
      (CVE-2026-46178)
    - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
      (CVE-2026-46127)
    - RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
    - [x86] RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error
      path (CVE-2026-46189)
    - media: uvcvideo: Enable VB2_DMABUF for metadata stream
    - [x86] staging: media: atomisp: Disallow all private IOCTLs
      (CVE-2026-46205)
    - regulator: max77650: fix OF node reference imbalance
    - media: rc: xbox_remote: heed DMA restrictions (CVE-2026-46236)
    - media: rc: streamzap: Error handling in probe
    - regulator: act8945a: fix OF node reference imbalance
    - media: dib8000: avoid division by 0 in dib8000_set_dds()
    - [armhf] spi: imx: fix runtime pm leak on probe deferral
    - [armhf] spi: orion: fix clock imbalance on registration failure
    - drm/gem: Fix inconsistent plane dimension calculation in
      drm_gem_fb_init_with_funcs()
    - drm/radeon: add missing revision check for CI
    - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
    - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
      (CVE-2026-46220)
    - drm/amdgpu/pm: add missing revision check for CI
    - drm/amdgpu/pm: align Hawaii mclk workaround with radeon
    - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
      (CVE-2026-46227)
    - batman-adv: fix integer overflow on buff_pos (CVE-2026-46198)
    - batman-adv: reject new tp_meter sessions during teardown (CVE-2026-46206)
    - batman-adv: stop caching unowned originator pointers in BAT IV
      (CVE-2026-46238)
    - batman-adv: bla: prevent use-after-free when deleting claims
      (CVE-2026-46212)
    - batman-adv: bla: only purge non-released claims (CVE-2026-46233)
    - batman-adv: bla: put backbone reference on failed claim hash insert
      (CVE-2026-46231)
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
      (CVE-2026-45836)
    - vsock: fix buffer size clamping order (CVE-2026-46234)
    - vsock/virtio: fix accept queue count leak on transport mismatch
      (CVE-2026-46214)
    - bcache: fix uninitialized closure object
    - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
      (CVE-2026-53130)
    - drbd: Balance RCU calls in drbd_adm_dump_devices() (CVE-2026-53128)
    - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
      (CVE-2026-53320)
    - pstore/ram: fix resource leak when ioremap() fails
    - devres: fix missing node debug info in devm_krealloc()
    - firmware: dmi: Correct an indexing error in dmi.h
    - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
    - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished
      irq_prepare_bcn_tasklet (CVE-2026-53112)
    - bpf: fix end-of-list detection in cgroup_storage_get_next_key()
      (CVE-2026-45838)
    - brcmfmac: support chipsets with different core enumeration space
    - wifi: brcmfmac: Fix error pointer dereference (CVE-2026-53093)
    - [arm64] net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
      (CVE-2026-53088)
    - netfilter: nft_fwd_netdev: check ttl/hl before forwarding
    - 6pack: propagage new tty types
    - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
      (CVE-2026-53082)
    - net/sched: act_ct: Only release RCU read lock after ct_ft
      (CVE-2026-46319)
    - net/rds: Optimize rds_ib_laddr_check
    - net/rds: Restrict use of RDS/IB to the initial network namespace
      (CVE-2026-53077)
    - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
      (CVE-2026-53075)
    - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
      (CVE-2026-53074)
    - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU
    - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)
    - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
      (CVE-2026-53072)
    - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
      (CVE-2026-53071)
    - [arm*] drm/komeda: fix integer overflow in AFBC framebuffer size check
      (CVE-2026-53068)
    - [armhf] ASoC: sti: use managed regmap_field allocations (CVE-2026-53065)
    - dm cache: fix null-deref with concurrent writes in passthrough mode
      (CVE-2026-53064)
    - dm cache: fix write path cache coherency in passthrough mode
    - dm cache policy smq: fix missing locks in invalidating cache blocks
      (CVE-2026-53062)
    - dm cache: fix concurrent write failure in passthrough mode
    - dm cache: support shrinking the origin device
    - dm cache: fix dirty mapping checking in passthrough mode switching
      (CVE-2026-53061)
    - dm cache metadata: fix memory leak on metadata abort retry
      (CVE-2026-53060)
    - dm log: fix out-of-bounds write due to region_count overflow
      (CVE-2026-53059)
    - [arm*] drm/sun4i: Fix resource leaks
    - [arm*] drm/panel: simple: Correct G190EAN01 prepare timing
    - ALSA: compress: Drop unused functions
    - ALSA: core: Validate compress device numbers without dynamic minors
    - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
    - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
    - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
    - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
    - drm/amd/pm/ci: Fill DW8 fields from SMC
    - [arm64] drm/msm/a6xx: Fix HLSQ register dumping
    - [arm64] drm/msm/a6xx: Use barriers while updating HFI Q headers
    - [armhf] pmdomain: ti: omap_prm: Fix a reference leak on device node
    - PCI: Enable AtomicOps only if Root Port supports them
    - quota: Fix race of dquot_scan_active() with quota deactivation
      (CVE-2026-53050)
    - efi/capsule-loader: fix incorrect sizeof in phys array reallocation
      (CVE-2026-53047)
    - [armhf] dts: mediatek: mt7623: fix efuse fallback compatible
    - [armhf] memory: tegra124-emc: Fix dll_change check (CVE-2026-53045)
    - [arm64] dts: qcom: sdm845-xiaomi-beryllium: Add DSI and panel bits
    - [arm64] dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered
      during boot
    - ocfs2/dlm: validate qr_numregions in dlm_match_regions() (CVE-2026-53043)
    - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
      (CVE-2026-53309)
    - ocfs2: fix listxattr handling when the buffer is full (CVE-2026-53041)
    - ocfs2: validate bg_bits during freefrag scan (CVE-2026-53040)
    - ocfs2: validate group add input before caching (CVE-2026-53039)
    - [armhf] dmaengine: mxs-dma: Fix missing return value from
      of_dma_controller_register()
    - tracing: Rebuild full_name on each hist_field_name() call
    - ima: check return value of crypto_shash_final() in boot aggregate
    - HID: asus: do not abort probe when not necessary
    - [armhf] mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
    - HID: usbhid: fix deadlock in hid_post_reset() (CVE-2026-53037)
    - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
    - perf branch: Avoid incrementing NULL
    - perf expr: Return -EINVAL for syntax error in expr__find_ids()
    - driver core: Move dev_err_probe() to where it belogs
    - dev_printk: add new dev_err_probe() helpers
    - [x86] platform/surface: surfacepro3_button: Drop wakeup source on remove
    - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
    - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
    - [x86] platform/x86: dell_rbu: avoid uninit value usage in
      packet_size_write()
    - RDMA/core: Prefer NLA_NUL_STRING
    - scsi: sg: Resolve soft lockup issue when opening /dev/sgX
      (CVE-2026-53304)
    - scsi: target: core: Fix integer overflow in UNMAP bounds check
      (CVE-2026-53021)
    - [armhf] clk: imx: imx6q: Fix device node reference leak in
      pll6_bypassed()
    - [armhf] clk: imx: imx6q: Fix device node reference leak in
      of_assigned_ldb_sels()
    - [arm64] clk: imx8mq: Correct the CSI PHY sels
    - [arm64] clk: qoriq: avoid format string warning
    - [arm64] clk: xgene: Fix mapping leak in xgene_pllclk_init()
    - crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
    - [x86] PCMCIA: Fix garbled log messages for KERN_CONT
    - net/sched: sch_cake: fix NAT destination port not being updated in
      cake_update_flowkeys
    - nexthop: Emit a notification when a nexthop group is modified
    - nexthop: fix IPv6 route referencing IPv4 nexthop (CVE-2026-53012)
    - taprio: Handle short intervals and large packets
    - net: taprio offload: enforce qdisc to netdev queue mapping
    - net/sched: taprio: stop going through private ops for dequeue and peek
    - net/sched: taprio: replace safety precautions with comments
    - net/sched: taprio: continue with other TXQs if one dequeue() failed
    - net/sched: taprio: refactor one skb dequeue from TXQ to separate function
    - net/sched: taprio: rename close_time to end_time
    - net/sched: taprio: fix use-after-free in advance_sched() on schedule
      switch (CVE-2026-53011)
    - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
    - i40e: don't advertise IFF_SUPP_NOFCS
    - e1000e: Unroll PTP in probe error handling
    - ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)
    - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
      (CVE-2026-53004)
    - dissector: do not set invalid PPP protocol
    - flow_dissector: Add number of vlan tags dissector
    - flow_dissector: Add PPPoE dissectors
    - pppoe: drop PFC frames (CVE-2026-53003)
    - openvswitch: cap upcall PID array size and pre-size vport replies
      (CVE-2026-45840)
    - netfilter: nft_osf: restrict it to ipv4
    - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
      (CVE-2026-45841)
    - netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
    - netfilter: xtables: restrict several matches to inet family
      (CVE-2026-53001)
    - ipvs: fix MTU check for GSO packets in tunnel mode
    - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
      (CVE-2026-52999)
    - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
      (CVE-2026-52998)
    - slip: reject VJ receive packets on instances with no rstate array
      (CVE-2026-45842)
    - slip: bound decode() reads against the compressed packet length
      (CVE-2026-45843)
    - [arm64] dts: meson-gxl-p230: fix ethernet PHY interrupt number
    - net/rds: zero per-item info buffer before handing it to visitors
      (CVE-2026-52995)
    - net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
    - net/sched: sch_pie: annotate data-races in pie_dump_stats()
    - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
    - net: sched: gred/red: remove unused variables in struct red_stats
    - net/sched: sch_red: annotate data-races in red_dump_stats()
    - net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
    - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
    - tipc: fix double-free in tipc_buf_append() (CVE-2026-52993)
    - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
    - fs/adfs: validate nzones in adfs_validate_bblk() (CVE-2026-52992)
    - rtc: introduce features bitfield
    - fbdev: offb: fix PCI device reference leak on probe failure
    - mailbox: mailbox-test: free channels on probe error (CVE-2026-53296)
    - cgroup/rdma: fix integer overflow in rdmacg_try_charge()
    - mailbox: add sanity check for channel array (CVE-2026-53295)
    - mailbox: mailbox-test: don't free the reused channel (CVE-2026-53294)
    - mailbox: mailbox-test: initialize struct earlier
    - mailbox: mailbox-test: make data_ready a per-instance variable
    - btrfs: merge PAGE_CLEAR_DIRTY and PAGE_SET_WRITEBACK to
      PAGE_START_WRITEBACK
    - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
    - tracing: branch: Fix inverted check on stat tracer registration
    - netfilter: arp_tables: fix IEEE1394 ARP payload parsing (CVE-2026-45844)
    - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
    - netfilter: xt_policy: fix strict mode inbound policy matching
      (CVE-2026-52920)
    - netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)
    - scsi: sr: Add memory allocation failure handling for get_capabilities()
    - cdrom, scsi: sr: propagate read-only status to block layer via
      set_disk_ro()
    - netdevsim: zero initialize struct iphdr in dummy sk_buff (CVE-2026-52985)
    - net: sched: sch_netem: Refactor code in 4-state loss generator
    - net/sched: netem: fix probability gaps in 4-state loss model
    - net/sched: netem: fix queue limit check to include reordered packets
      (CVE-2026-52984)
    - net/sched: netem: validate slot configuration
    - net: sched: choke: remove unused variables in struct choke_sched_data
    - net/sched: sch_choke: annotate data-races in choke_dump_stats()
    - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
    - vrf: Fix a potential NPD when removing a port from a VRF (CVE-2026-52925)
    - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
      (CVE-2026-52982)
    - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
    - netfilter: skip recording stale or retransmitted INIT
    - sctp: discard stale INIT after handshake completion
    - ipv4: rename and move ip_route_output_tunnel()
    - ipv4: remove "proto" argument from udp_tunnel_dst_lookup()
    - ipv4: add new arguments to udp_tunnel_dst_lookup()
    - ipv6: rename and move ip6_dst_lookup_tunnel()
    - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
      (CVE-2026-45846)
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
    - drm/amd/display: Allow DCE link encoder without AUX registers
    - drm/amd/display: Read EDID from VBIOS embedded panel info
    - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
    - net/sched: taprio: Fix init procedure
    - flow_dissector: do not dissect PPPoE PFC frames
    - flow_dissector: Do not count vlan tags inside tunnel payload
    - net/sched: sch_pie: annotate more data-races in pie_dump_stats()
    - rtc: allow rtc_read_alarm without read_alarm callback
    - alarmtimer: Check RTC features instead of ops
    - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
    - audit: fix incorrect inheritable capability in CAPSET records
      (CVE-2026-53287)
    - netfilter: nft_ct: fix missing expect put in obj eval (CVE-2026-52970)
    - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
    - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
    - [x86] drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
    - ALSA: usb-audio: Bound MIDI endpoint descriptor scans (CVE-2026-52963
    - ceph: fix a buffer leak in __ceph_setxattr() (CVE-2026-52962)
    - libceph: Fix potential out-of-bounds access in osdmap_decode()
      (CVE-2026-52958)
    - libceph: Fix potential null-ptr-deref in decode_choose_args()
      (CVE-2026-52957)
    - libceph: Fix potential out-of-bounds access in crush_decode()
      (CVE-2026-52955)
    - libceph: handle rbtree insertion error in decode_choose_args()
      (CVE-2026-52954)
    - [x86] iommu/vt-d: Disable DMAR for Intel Q35 IGFX
    - [arm*] drm/panfrost: Fix wait_bo ioctl leaking positive return from
      dma_resv_wait_timeout()
    - [x86] drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
    - io-wq: check that the predecessor is hashed in io_wq_remove_pending()
    - net/rds: reset op_nents when zerocopy page pin fails (CVE-2026-43494)
    - [x86] Revert "x86/vdso: Fix output operand size of RDPID"
    - net: dsa: sja1105: fix kasan out-of-bounds warning in
      sja1105_table_delete_entry() (CVE-2025-22107)
    - sysfs: don't remove existing directory on update failure
    - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
    - ALSA: ua101: Reject too-short USB descriptors
    - ALSA: asihpi: Fix potential OOB array access at reading cache
    - Bluetooth: bnep: Fix UAF read of dev->name
    - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
      (CVE-2026-46275)
    - phonet/pep: disable BH around forwarded sk_receive_skb()
    - [arm64] net: bcmgenet: keep RBUF EEE/PM disabled
    - netfilter: ip6t_hbh: reject oversized option lists (CVE-2026-52915)
    - netfilter: ipset: stop hash:* range iteration at end (CVE-2026-52921)
    - ring-buffer: Fix reporting of missed events in iterator
    - [x86] vsock/vmci: fix UAF when peer resets connection during handshake
    - wifi: ath11k: clear shared SRNG pointer state on restart
    - ipv4: raw: reject IP_HDRINCL packets with ihl < 5
    - ixgbevf: fix use-after-free in VEPA multicast source pruning
    - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    - [x86] scsi: isci: Fix use-after-free in device removal path
    - [armhf] spi: ti-qspi: fix use-after-free after DMA setup failure
    - RDMA/siw: Reject MPA FPDU length underflow before signed receive math
    - drm/amd/display: Fix integer overflow in bios_get_image()
    - batman-adv: mcast: fix use-after-free in orig_node RCU release
    - batman-adv: clear current gateway during teardown (CVE-2026-52926)
    - batman-adv: dat: handle forward allocation error (CVE-2026-52922)
    - batman-adv: fix fragment reassembly length accounting (CVE-2026-52914)
    - batman-adv: fix tp_meter counter underflow during shutdown
      (CVE-2026-52919)
    - batman-adv: frag: disallow unicast fragment in fragment (CVE-2026-52916)
    - batman-adv: bla: fix report_work leak on backbone_gw purge
    - batman-adv: tp_meter: avoid use of uninit sender vars (CVE-2026-52931)
    - batman-adv: tt: fix negative last_changeset_len
    - batman-adv: tt: fix negative tt_buff_len
    - ice: fix locking in ice_dcb_rebuild()
    - [arm*] phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
      register access
    - net: ethernet: cortina: Make RX SKB per-port
    - net: ethernet: cortina: Drop half-assembled SKB
    - net: ethernet: cortina: Carry over frag counter
    - HID: quirks: really enable the intended work around for appledisplay
    - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
    - net: tls: prevent chain-after-chain in plain text SG
    - [x86] platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    - tracing: Avoid NULL return from hist_field_name() on truncation
    - string: add mem_is_zero() helper to check if memory area is all zeros
    - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)
    - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.259
    - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
    - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
      (CVE-2021-47211)
    - net/sched: cls_fw: fix NULL dereference of "old" filters before change()
      (CVE-2026-53080)
    - net/sched: sch_sfb: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked
    - nfc: llcp: protect nfc_llcp_sock_unlink() calls
    - nfc: llcp: Fix use-after-free in llcp_sock_release()
    - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    - xfrm: Check for underflow in xfrm_state_mtu
    - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    - netfilter: xt_cpu: prefer raw_smp_processor_id
    - netfilter: ebtables: fix OOB read in compat_mtw_from_user
      (CVE-2026-52927)
    - tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321)
    - net: netlink: fix sending unassigned nsid after assigned one
    - net: netlink: don't set nsid on local notifications
    - net/smc: Do not re-initialize smc hashtables
    - ipv4: free net->ipv4.sysctl_local_reserved_ports after
      unregister_net_sysctl_table()
    - [x86] ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    - tunnels: load network headers after skb_cow() in
      iptunnel_pmtud_build_icmp[v6]()
    - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
    - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
    - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
    - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    - sctp: fix race between sctp_wait_for_connect and peeloff
    - batman-adv: v: stop OGMv2 on disabled interface (CVE-2026-52913)
    - batman-adv: tvlv: abort OGM send on tvlv append failure
    - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
    - batman-adv: tvlv: reject oversized TVLV packets (CVE-2026-52934)
    - batman-adv: iv: recover OGM scheduling after forward packet error
    - batman-adv: tp_meter: fix race condition in send error reporting
    - batman-adv: tp_meter: avoid role confusion in tp_list
    - batman-adv: tt: fix TOCTOU race for reported vlans
    - batman-adv: tt: avoid empty VLAN responses
    - batman-adv: bla: avoid double decrement of bla.num_requests
    - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
      (CVE-2025-39929)
    - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    - usb: typec: ucsi: ccg: reject firmware images without a ':' record header
    - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
    - usb: typec: altmodes/displayport: validate count before reading Status
      Update VDO
    - [x86] usb: typec: wcove: don't write past struct pd_message in
      wcove_read_rx_buffer()
    - USB: serial: safe_serial: fix memory corruption with small endpoint
    - Bluetooth: btusb: Allow firmware re-download when version matches
    - hpfs: fix a crash if hpfs_map_dnode_bitmap fails
    - ipc: limit next_id allocation to the valid ID range (CVE-2026-52923)
    - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
    - parport: Fix race between port and client registration (Closes: #1130365)
    - iio: dac: ad5686: fix input raw value check
    - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    - iio: gyro: itg3200: fix i2c read into the wrong stack location
    - iio: ssp_sensors: cancel delayed work_refresh on remove
    - iio: temperature: tsys01: fix broken PROM checksum validation
    - iio: light: cm3323: fix reg_conf not being initialized correctly
    - iio: buffer: hw-consumer: fix use-after-free in error path
    - USB: serial: omninet: fix memory corruption with small endpoint
    - usb: dwc2: Fix use after free in debug code
    - Input: elan_i2c - validate firmware size before use
    - wireguard: send: append trailer after expanding head
    - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    - macsec: fix replay protection at XPN lower-PN wrap
    - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    - [arm64] ASoC: qcom: q6asm-dai: fix error handling in prepare and
      set_params
    - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
    - ipv6: validate extension header length before copying to cmsg
    - ip6: vti: Use ip6_tnl.net in vti6_changelink().
    - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    - nfc: hci: fix out-of-bounds read in HCP header parsing
    - xfrm: route MIGRATE notifications to caller's netns
    - xfrm: ah: use skb_to_full_sk in async output callbacks
    - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without
      direction check
    - [arm64] ASoC: qcom: q6asm-dai: close stream only when running
    - [arm64] ASoC: qcom: q6asm-dai: do not set stream state in event and
      trigger callbacks
    - xfrm: esp: restore combined single-frag length gate
    - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    - [x86] Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
    - [x86] comedi: comedi_test: fix check for valid scan_begin_src in
      waveform_ai_cmdtest()
    - [x86] comedi: comedi_test: Fix limiting of convert_arg in
      waveform_ai_cmdtest()
    - [i386] tty: serial: pch_uart: add check for dma_alloc_coherent()
    - [arm*] usb: chipidea: core: convert ci_role_switch to local variable
    - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
    - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub
      controllers
    - usb: storage: Add quirks for PNY Elite Portable SSD
    - usbip: vudc: Fix use after free bug in vudc_remove due to race condition
    - usb: usbtmc: check URB actual_length for interrupt-IN notifications
    - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
    - USB: serial: option: add MeiG SRM813Q
    - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
    - USB: serial: belkin_sa: validate interrupt status length
    - USB: serial: cypress_m8: validate interrupt packet headers
    - USB: serial: keyspan: fix missing indat transfer sanity check
    - USB: serial: mxuport: fix memory corruption with small endpoint
    - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
    - usb: gadget: net2280: Fix double free in probe error path
    - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
    - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
    - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
    - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
    - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
    - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250)
    - USB: serial: cypress_m8: fix memory corruption with small endpoint
    - USB: serial: digi_acceleport: fix memory corruption with small endpoints
    - [arm*] xhci: tegra: Fix ghost USB device on dual-role port unplug
    - page_pool: Fix use-after-free in page_pool_recycle_in_ring
      (CVE-2025-38129)
    - team: Move team device type change at the end of team_port_add
      (CVE-2025-68340)
    - usb: core: Fix SuperSpeed root hub wMaxPacketSize
    - bpf: Free reuseport cBPF prog after RCU grace period. (CVE-2026-52910)
    - HID: core: Add printk_ratelimited variants to hid_warn() etc
    - HID: pass the buffer size to hid_report_raw_event
    - HID: core: Fix size_t specifier in hid_report_raw_event()
    - USB: serial: mct_u232: fix memory corruption with small endpoint
    - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (CVE-2026-52948)
    - tee: optee: prevent use-after-free when the client exits before the
      supplicant (CVE-2026-53273)
    - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
    - ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
    - netfilter: synproxy: add mutex to guard hook reference counting
      (CVE-2026-53269)
    - netfilter: conntrack_irc: fix possible out-of-bounds read
      (CVE-2026-53268)
    - netfilter: bridge: make ebt_snat ARP rewrite writable (CVE-2026-53266)
    - dm cache policy smq: check allocation under invalidate lock
      (CVE-2026-53265)
    - net/sched: act_api: use RCU with deferred freeing for action lifecycle
      (CVE-2026-53264)
    - 6lowpan: fix off-by-one in multicast context address compression
      (CVE-2026-53263)
    - pcnet32: stop holding device spin lock during napi_complete_done
    - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
    - net: lan743x: permit VLAN-tagged packets up to configured MTU
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
      (CVE-2026-53256)
    - Bluetooth: MGMT: validate advertising TLV before type checks
      (CVE-2026-53255)
    - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (CVE-2026-53249)
    - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
    - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
      (CVE-2026-53245)
    - sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
    - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
    - time: Fix off-by-one in settimeofday() usec validation
    - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked
      streams (CVE-2026-53242)
    - ext4: validate p_idx bounds in ext4_ext_correct_indexes (CVE-2026-31449)
    - bonding: limit BOND_MODE_8023AD to Ethernet devices (CVE-2026-23099)
    - usbnet: Fix using smp_processor_id() in preemptible code warnings
      (CVE-2025-40164)
    - nfsd: don't ignore the return code of svc_proc_register()
      (CVE-2025-22026)
    - wifi: mac80211: check tdls flag in ieee80211_tdls_oper (CVE-2026-43052)
    - [arm*] spi: meson-spicc: Fix double-put in remove path (CVE-2026-31489)
    - io_uring: prevent opcode speculation (CVE-2025-21863)
    - tap: free page on error paths in tap_get_user_xdp() (CVE-2026-46320)
    - tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322)
    - [arm64] KVM: arm64: Remove VPIPT I-cache handling
    - [arm64] tlb: Allow XZR argument to TLBI ops
    - [arm64] tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
    - xfrm: policy: fix use-after-free on inexact bin in
      xfrm_policy_bysel_ctx() (CVE-2026-53239)
    - netlabel: validate unlabeled address and mask attribute lengths
      (CVE-2026-53238)
    - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
      (CVE-2026-52947)
    - ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
    - net: openvswitch: fix possible kfree_skb of ERR_PTR (CVE-2026-53227)
    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (CVE-2026-53225)
    - net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
    - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic
      completion (CVE-2026-52939)
    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
      (CVE-2026-53221)
    - rds: mark snapshot pages dirty in rds_info_getsockopt()
    - netfilter: x_tables: avoid leaking percpu counter pointers
      (CVE-2026-53219)
    - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
      (CVE-2026-53218)
    - [arm*] net: mvpp2: sync RX data at the hardware packet offset
      (CVE-2026-53217)
    - netfilter: nft_tunnel: fix use-after-free on object destroy
      (CVE-2026-53212)
    - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
      (CVE-2026-53208)
    - [x86] drm/i915/gem: Fix phys BO pread/pwrite with offset
    - xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)
    - USB: serial: io_ti: fix heap overflow in get_manuf_info()
      (CVE-2026-53196)
    - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
      (CVE-2026-53195)
    - USB: serial: option: add usb-id for Dell Wireless DW5826e-m
    - USB: serial: kl5kusb105: fix bulk-out buffer overflow (CVE-2026-53194)
    - ALSA: timer: Fix UAF at snd_timer_user_params()
    - drm/amd/display: Reject gpio_bitshift >= 32 in
      bios_parser_get_gpio_pin_info()
    - RDMA/srp: bound SRP_RSP sense copy by the received length
      (CVE-2026-53186)
    - [armhf] socfpga: Fix OF node refcount leak in SMP setup
    - vsock/vmci: fix sk_ack_backlog leak on failed handshake (CVE-2026-53181)
    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
      (CVE-2026-53176)
    - pidfd: refuse access to tasks that have started exiting harder
    - fuse: reject fuse_notify() pagecache ops on directories (CVE-2026-53168)
    - [arm*] i2c: tegra: Fix NOIRQ suspend/resume
    - [x86] Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
    - [x86] Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
    - ipc/shm: serialize orphan cleanup with shm_nattch updates
      (CVE-2026-52930)
    - [arm*] misc: fastrpc: fix use-after-free of fastrpc_user in workqueue
      context (CVE-2026-53161)
    - net: bonding: fix NULL pointer dereference in bond_do_ioctl()
    - [armhf] net: mv643xx: fix OF node refcount
    - net: rds: clear i_sends on setup unwind
    - mmc: core: Fix host controller programming for fixed driver type
    - mmc: sdhci: add signal voltage switch in sdhci_resume_host
    - sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)
    - sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)
    - thunderbolt: Reject zero-length property entries in validator
      (CVE-2026-53150)
    - thunderbolt: Bound root directory content to block size
      (CVE-2026-53149)
    - thunderbolt: Clamp XDomain response data copy to allocation size
      (CVE-2026-53148)
    - thunderbolt: Limit XDomain response copy to actual frame size
      (CVE-2026-53146)
    - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
      (CVE-2026-53137)
    - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
      (CVE-2026-53135)
    - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
      (CVE-2026-52946)
    - io_uring/poll: fix signed comparison in io_poll_get_ownership()
    - ipvs: skip ipv6 extension headers for csum checks (CVE-2026-45850)
    - batman-adv: stop tp_meter sessions during mesh teardown (CVE-2026-46208)
    - batman-adv: tp_meter: fix tp_num leak on kmalloc failure
    - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in
      f2fs_write_end_io() (CVE-2026-31715)
    - smb: client: require a full NFS mode SID before reading mode bits
      (CVE-2026-43350)
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
      (CVE-2026-31708)
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
      (CVE-2026-31700)
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
      (CVE-2026-46006)
    - [arm64] mm: Enable batched TLB flush in unmap_hotplug_range()
    - thermal: core: Fix thermal zone governor cleanup issues (CVE-2026-46021)
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
      (CVE-2026-46069)
    - media: rc: ttusbir: respect DMA coherency rules
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents
      (CVE-2026-46078)
    - media: rc: igorplugusb: heed coherency rules
    - sched: Use u64 for bandwidth ratio calculations
    - ALSA: core: Fix potential data race at fasync handling
    - net: qrtr: ns: Limit the maximum number of lookups (CVE-2026-46026)
    - net: qrtr: ns: Change servers radix tree to xarray
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (CVE-2026-46038)
    - net: qrtr: ns: Limit the total number of nodes (CVE-2026-46003)
    - net: bridge: use a stable FDB dst snapshot in RCU readers
      (CVE-2026-46086)
    - mtd: spi-nor: sst: Fix write enable before AAI sequence
    - udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
    - hfsplus: fix uninit-value by validating catalog record size
      (CVE-2026-46169)
    - hfsplus: fix held lock freed on hfsplus_fill_super() (CVE-2026-46299)
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
      (CVE-2026-46056)
    - can: ucan: fix devres lifetime (CVE-2026-46103)
    - ceph: only d_add() negative dentries when they are unhashed
      (CVE-2026-46052)
    - ALSA: aloop: Fix peer runtime UAF during format-change stop
      (CVE-2026-46090)
    - printk: add print_hex_dump_devel()
    - [arm*] crypto: caam - guard HMAC key hex dumps in hash_digest_key
      (CVE-2026-46291)
    - ACPI: scan: Use acpi_dev_put() in object add error paths
    - tracepoint: balance regfunc() on func_add() failure in
      tracepoint_add_func() (CVE-2026-46196)
    - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog
      task (CVE-2026-46180)
    - [arm*] usb: dwc3: Move GUID programming after PHY initialization
    - [armhf] spi: sun4i: fix controller deregistration
    - [armhf] spi: ti-qspi: fix controller deregistration
    - [armhf] spi: sun6i: fix controller deregistration
    - [arm*] spi: tegra20-sflash: fix controller deregistration
    - [arm*] spi: tegra114: fix controller deregistration
    - mm/hugetlb_cma: round up per_node before logging it
    - fbcon: Avoid OOB font access if console rotation fails (CVE-2026-46191)
    - [i386] spi: topcliff-pch: fix controller deregistration
    - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
      info-leak (CVE-2026-46159)
    - tracing/probes: Limit size of event probe to 3K
    - pmdomain: core: Fix detach procedure for virtual devices in genpd
      (CVE-2026-46292)
    - dm btree: improve btree residency
    - dm-thin: fix metadata refcount underflow (CVE-2026-46107)
    - btrfs: fix missing last_unlink_trans update when removing a directory
      (CVE-2026-46160)
    - smb: client: Use FullSessionKey for AES-256 encryption key derivation
    - mptcp: pm: ADD_ADDR rtx: fix potential data-race (CVE-2026-46137)
    - f2fs: fix incorrect file address mapping when inline inode is unwritten
    - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
    - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    - qed: Use the bitmap API to simplify some functions
    - qed: fix double free in qed_cxt_tables_alloc()
    - net: Remove redundant if statements
    - netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)
    - Bluetooth: Consolidate code around sk_alloc into a helper function
    - Bluetooth: Init sk_peer_* on bt_sock_alloc
    - Bluetooth: serialize accept_q access (CVE-2026-52918)
    - net: hsr: defer node table free until after RCU readers
    - ice: fix VF queue configuration with low MTU values
    - use less confusing names for iov_iter direction initializers
    - [arm64] octeontx2-af: Add validation for lmac type (CVE-2023-54129)
    - [arm64] spi: qup: switch to use modern name
    - [arm64] spi: qup: fix error pointer deref after DMA setup failure
    - [arm64] tlb: Flush walk cache when unsharing PMD tables
    - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
    - usb: typec: ucsi: Check if power role change actually happened before
      handling
    - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
    - scsi: target: iscsi: Fix CRC overread and double-free in
      iscsit_handle_text_cmd()
    - usb: typec: ucsi: Don't update power_supply on power role change if not
      connected
    - netfilter: nft_fib: fix stale stack leak via the OIFNAME register
      (CVE-2026-53134)
    - [x86] hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
      (CVE-2026-53199)
    - mm/huge_memory: update file PMD counter before folio_put()
      (CVE-2026-53189)
    - RDMA/umem: fix kernel-doc warnings
    - RDMA: Move DMA block iterator logic into dedicated files
    - RDMA/umem: Fix truncation for block sizes >= 4G (CVE-2026-53133)
    - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
    - [x86] ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
    - iio: chemical: scd30: fix division by zero in write_raw
    - iio: gyro: adis16260: fix division by zero in write_raw
    - iio: dac: ad5686: fix ref bit initialization for single-channel parts
    - xfrm: input: hold netns during deferred transport reinjection
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers
      (CVE-2026-52943)
    - [armhf] serial: samsung_tty: Use port lock wrappers
    - [armhf] tty: serial: samsung: use u32 for register interactions
    - [armhf] tty: serial: samsung: Remove redundant port lock acquisition in
      rx helpers
    - usb: gadget: f_hid: tidy error handling in hidg_alloc
    - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
      (CVE-2026-43492)
    - [arm64] Mitigate TLBI errata on various CPU cores (CVE-2025-10263):
      + Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata
      + cputype: Add NVIDIA Olympus definitions
      + cputype: Add C1-Ultra definitions
      + cputype: Add C1-Premium definitions
      + errata: Mitigate TLBI errata on various Arm CPUs
      + errata: Mitigate TLBI errata on NVIDIA Olympus CPU
      + errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
    - media: rc: ttusbir: fix inverted error logic
    - media: rc: igorplugusb: fix control request setup packet (CVE-2026-46091)

  [ Ben Hutchings ]
  * [rt] Update to 5.10.259-rt155
  * Drop "Revert "io_uring/poll: correctly handle io_poll_add() return value
    on update""
  * Revert "Bluetooth: L2CAP: use chan timer to close channels in
    cleanup_listen()"
  * Revert "media: rc: streamzap: Error handling in probe"
  * usb: type: ucsi: Fix misplaced call to ucsi_port_psy_changed() (regression
    in 5.10.241)

  [ Salvatore Bonaccorso ]
  * ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)

 -- Ben Hutchings <benh@debian.org>  Thu, 02 Jul 2026 16:19:48 +0200

linux (5.10.257-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.252
    - RDMA/siw: Fix potential NULL pointer dereference in header processing
      (CVE-2026-23242)
    - RDMA/umad: Reject negative data_len in ib_umad_write (CVE-2026-23243)
    - hfsplus: return error when node already exists in hfs_bnode_create
    - gfs2: Add new gfs2_iomap_get helper
    - gfs2: Turn gfs2_extent_map into gfs2_{get,alloc}_extent
    - gfs2: Replace gfs2_lblk_to_dblk with gfs2_get_extent
    - gfs2: Add wrapper for iomap_file_buffered_write
    - gfs2: Move the inode glock locking to gfs2_file_buffered_write
    - gfs2: Add metapath_dibh helper
    - gfs2: Fix use-after-free in iomap inline data write path
    - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
    - [x86] tpm: st33zp24: Fix missing cleanup on get_burstcount() error
    - btrfs: qgroup: return correct error when deleting qgroup relation item
    - md/raid10: fix any_working flag handling in raid10_sync_request
    - iomap: fix submission side handling of completion side errors
    - PM: wakeup: Handle empty list in wakeup_sources_walk_start()
    - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
    - [armhf] VDSO: Patch out __vdso_clock_getres() if unavailable
    - [arm64] crypto: cavium - fix dma_free_coherent() size
    - hrtimer: Fix trace oddity
    - sched/rt: Skip currently executing CPU in rto_next_cpu()
    - pstore/ram: fix buffer overflow in persistent_ram_save_old()
    - [x86] EDAC/i5000: Fix snprintf() size calculation in
      calculate_dimm_size()
    - [x86] EDAC/i5400: Fix snprintf() limit calculation in
      calculate_dimm_size()
    - [arm64] clk: qcom: Return correct error code in qcom_cc_probe_by_index()
    - [arm64] dts: qcom: sdm630: Add qfprom subnodes
    - [arm64] dts: qcom: sdm630: correct QFPROM byte offsets
    - [arm64] dts: qcom: sdm630: fix gpu_speed_bin size
    - [armhf] dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
    - [arm64] soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in
      cmd_db_dev_probe
    - [arm64] dts: amlogic: axg: assign the MMC signal clocks
    - [arm64] dts: amlogic: gx: assign the MMC signal clocks
    - [arm64] dts: amlogic: g12: assign the MMC B and C signal clocks
    - [arm64] dts: amlogic: g12: assign the MMC A signal clock
    - [arm64] dts: qcom: sdm845-db845c: specify power for WiFi CH1
    - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
    - regulator: core: Respect off_on_delay at startup
    - regulator: core: Fix off_on_delay handling
    - regulator: Flag uncontrollable regulators as always_on
    - regulator: core: Fix off-on-delay-us for always-on/boot-on regulators
    - regulator: core: Use ktime_get_boottime() to determine how long a
      regulator was off
    - regulator: core: Shorten off-on-delay-us for always-on/boot-on by time
      since booted
    - regulator: core: move supply check earlier in set_machine_constraints()
    - [arm64] platform/chrome: cros_ec_lightbar: Fix response size
      initialization
    - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (regression
      in 5.10.248)
    - PCI: Do not attempt to set ExtTag for VFs
    - PCI/portdrv: Fix potential resource leak
    - wifi: cfg80211: stop NAN and P2P in cfg80211_leave
    - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
    - netfilter: nf_conncount: increase the connection clean up limit to 64
    - netfilter: nf_conncount: fix tracking of connections from localhost
    - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
    - [x86] iommu/vt-d: Flush cache for PASID table before using it
    - nfsd: never defer requests during idmap lookup
    - fat: avoid parent link count underflow in rmdir
    - tcp: tcp_tx_timestamp() must look at the rtx queue
    - PCI: Initialize RCB from pci_configure_device()
    - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
    - bonding: only set speed/duplex to unknown, if getting speed failed
    - netfilter: nft_set_hash: fix get operation on big endian
    - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
    - procfs: fix missing RCU protection when reading real_parent in
      do_task_stat()
    - net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
      (CVE-2026-31411)
    - serial: caif: fix use-after-free in caif_serial ldisc_close()
    - power: supply: {act8945a,bq25980,cpcap-battery,goldfish,rt9455,
      sbs-battery}: Fix use-after-free in power_supply_changed()
    - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
    - RDMA/rxe: Fix double free in rxe_srq_from_init
    - PM: core: Redefine pm_ptr() macro
    - PM: core: Add new *_PM_OPS macros, deprecate old ones
    - [x86] crypto: ccp - Add an S4 restore flow
    - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
    - svcrdma: Add a batch Receive posting mechanism
    - svcrdma: Use svc_rdma_refresh_recvs() in wc_receive
    - svcrdma: Maintain a Receive water mark
    - RDMA/core: Fix a couple of obvious typos in comments
    - svcrdma: Remove queue-shortening warnings
    - svcrdma: Clean up comment in svc_rdma_accept()
    - svcrdma: Increase the per-transport rw_ctx count
    - svcrdma: Reduce the number of rdma_rw contexts per-QP
    - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
    - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
    - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
    - scsi: csiostor: Fix dereference of null pointer rn
    - nvdimm: virtio_pmem: serialize flush requests
    - [arm64] clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
    - mmc: core: Initial support for SD express card/host
    - misc: rtsx: Add SD Express mode support for RTS5261
    - drivers: iio: mpu3050: use dev_err_probe for regulator request
    - ovl: Fix uninit-value in ovl_fill_real
    - iio: sca3000: Fix a resource leak in sca3000_probe()
    - pinctrl: single: fix refcount leak in pcs_add_gpio_func()
    - cpuidle: Skip governor when only one idle state is available
    - usbb: catc: use correct API for MAC addresses
    - net: usb: catc: enable basic endpoint checking
    - xen-netback: reject zero-queue configuration from guest
    - net/rds: rds_sendmsg should not discard payload_len
    - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
    - ipv6: fix a race in ip6_sock_set_v6only()
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error
      path (CVE-2026-23273)
    - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
    - apparmor: fix NULL sock in aa_sock_file_perm
    - apparmor: fix rlimit for posix cpu timers
    - apparmor: fix invalid deref of rawdata when export_binary is unset
    - [x86] drm/i915/acpi: free _DSM package when no connectors
    - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not
      found
    - ext4: don't cache extent during splitting extent
    - ext4: fix memory leak in ext4_ext_shift_extents()
    - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
    - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
    - perf callchain: Fix srcline printing with inlines
    - rtc: interface: Alarm race handling should not discard preceding error
      (regression in 5.10.246)
    - hfsplus: fix volume corruption issue for generic/498
    - hfsplus: pretend special inodes as regular files
    - minix: Add required sanity checking to minix_check_superblock()
    - tools/power cpupower: Reset errno before strtoull()
    - [arm64] Add support for TSV110 Spectre-BHB mitigation
    - rnbd-srv: Zero the rsp buffer before using it
    - [i386] xen/pvh: Enable PAE mode for 32-bit guest only when
      CONFIG_X86_PAE is set
    - EFI/CPER: don't dump the entire memory region
    - APEI/GHES: ensure that won't go past CPER allocated record
    - [arm64] EFI/CPER: don't go past the ARM processor CPER record buffer
    - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
    - xenbus: Use .freeze/.thaw to handle xenbus devices
    - blk-mq-debugfs: add missing debugfs_mutex in
      blk_mq_debugfs_register_hctxs()
    - bpf: verifier improvement in 32bit shift sign extension pattern
    - pstore: ram_core: fix incorrect success return when vmap() fails
    - [arm64] tegra: smaug: Add usb-role-switch support
    - media: dvb-core: dmxdevfilter must always flush bufs
    - [armhf] media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
    - [armhf] media: omap3isp: isppreview: always clamp in preview_try_format()
    - [armhf] media: omap3isp: set initial format
    - media: pvrusb2: fix URB leak in pvr2_send_request_ex
    - media: solo6x10: Check for out of bounds chip_id
    - media: cx25821: Fix a resource leak in cx25821_dev_setup()
    - drm: Account property blob allocations to memcg
    - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
    - virt: vbox: uapi: Mark inner unions in packed structs as packed
    - HID: multitouch: add eGalaxTouch EXC3188 support
    - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
    - [armhf] ASoC: es8328: Add error unwind in resume
    - jfs: Add missing set_freezable() for freezable kthread
    - jfs: nlink overflow in jfs_rename
    - dm: remove fake timeout to avoid leak request
    - [arm64] iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
    - wifi: libertas: fix WARNING in usb_tx_block
    - netfilter: nf_conntrack: Add allow_clash to generic protocol handler
    - netfilter: xt_tcpmss: check remaining length before reading optlen
    - net: usb: r8152: fix transmit queue timeout
    - net/rds: No shortcut out of RDS_CONN_ERROR
    - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
    - wifi: iwlegacy: add missing mutex protection in
      il3945_store_measurement()
    - ipv4: fib: Annotate access to struct fib_alias.fa_state.
    - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
    - Bluetooth: btusb: Add device ID for Realtek RTL8761BU
    - wifi: ath10k: fix lock protection in
      ath10k_wmi_event_peer_sta_ps_state_chg()
    - net: usb: sr9700: remove code to drive nonexistent multicast filter
    - [x86] vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
    - net/rds: Clear reconnect pending bit
    - PCI: Mark ASM1164 SATA controller to avoid bus reset
    - PCI: Fix pci_slot_lock () device locking
    - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
    - PCI: Mark Nvidia GB10 to avoid bus reset
    - myri10ge: avoid uninitialized variable use
    - serial: 8250_dw: handle clock enable errors in runtime_resume
    - [x86] fix it87_wdt early reboot by reporting running timer
    - binder: don't use %pK through printk
    - [arm64] phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
    - [armhf] Revert "mfd: da9052-spi: Change read-mask to write-mask"
      (regression in 5.10.231)
    - iio: magnetometer: Remove IRQF_ONESHOT
    - include: uapi: netfilter_bridge.h: Cover for musl libc
    - [armhf] 9467/1: mm: Don't use %pK through printk
    - drm/amd/display: Avoid updating surface with the same surface under MPO
    - drm/amdgpu: Add HAINAN clock adjustment
    - drm/radeon: Add HAINAN clock adjustment
    - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
    - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
    - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
    - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
    - lan78xx: Remove unused pause frame queue
    - lan78xx: Fix race condition in disconnect handling
    - lan78xx: Fix memory allocation bug
    - net: usb: lan78xx: scan all MDIO addresses on LAN7801
    - wifi: cfg80211: wext: fix IGTK key ID off-by-one
    - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
    - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
    - Bluetooth: Enforce key size of 16 bytes on FIPS level
    - Bluetooth: l2cap: Check encryption key size on incoming connection
    - Bluetooth: L2CAP: Fix not checking l2cap_chan security level
    - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
    - RDMA/core: Fix stale RoCE GIDs during netdev events at registration
    - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
    - RDMA/efa: Fix typo in efa_alloc_mr()
    - net: usb: pegasus: enable basic endpoint checking
    - net: consume xmit errors of GSO frames
    - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
    - rpmsg: core: fix race in driver_override_show() and use core helper
    - dm-verity: correctly handle dm_bufio_client_create() failure
    - [arm*] media: mtk-mdp: Fix error handling in probe function
    - [arm*] media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
    - HID: hid-pl: handle probe errors
    - HID: magicmouse: Do not crash on missing msc->input
    - HID: prodikeys: Check presence of pm->input_ep82
    - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
    - media: radio-keene: fix memory leak in error path
    - media: cx88: Add missing unmap in snd_cx88_hw_params()
    - media: cx23885: Add missing unmap in snd_cx23885_hw_params()
    - media: cx25821: Add missing unmap in snd_cx25821_hw_params()
    - [arm*] media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
    - [arm*] media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
    - dm-integrity: fix a typo in the code for write/discard race
    - dm: clear cloned request bio pointer when last clone bio completes
    - [arm*] soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
    - [armhf] clk: tegra: tegra124-emc: Fix potential memory leak in
      tegra124_clk_register_emc()
    - dm-unstripe: fix mapping bug when there are multiple targets in a table
    - [arm64] dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
    - [arm64] media: venus: vdec: fix error state assignment for zero bytesused
    - drm: of: drm_of_panel_bridge_remove(): fix device_node leak
    - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
    - xfs: mark data structures corrupt on EIO and ENODATA
    - [x86] iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in
      scalable mode
    - xfs: delete attr leaf freemap entries when empty
    - xfs: fix freemap adjustments when adding xattrs to leaf blocks
    - xfs: fix remote xattr valuelblk check
    - md/bitmap: fix GPF in write_page caused by resize race
    - nfsd: fix return error code for nfsd_map_name_to_[ug]id
    - [arm64] bus: fsl-mc: fix an error handling in fsl_mc_device_add()
    - dm mpath: make pg_init_delay_msecs settable
    - iio: gyro: itg3200: Fix unchecked return value in read_raw
    - ocfs2: fix reflink preserve cleanup issue
    - kexec: derive purgatory entry from symbol
    - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling
      SR-IOV" (regression in 5.10.246)
    - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
      (CVE-2025-40219)
    - btrfs: continue trimming remaining devices on failure
    - [arm*] usb: dwc2: fix resume failure if dr_mode is host
    - tipc: fix RCU dereference race in tipc_aead_users_dec()
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
    - [armhf] net: cpsw_new: Fix unnecessary netdev unregistration in
      cpsw_probe() error path
    - PCI: Fix pci_slot_trylock() error handling
    - ceph: supply snapshot context in ceph_zero_partial_object()
    - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
    - net: intel: fix PCI device ID conflict between i40e and ipw2200
    - atm: fore200e: fix use-after-free in tasklets during device removal
    - [armhf] fbdev: vt8500lcdfb: fix missing dma_free_coherent()
    - fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
    - drm/amdgpu: keep vga memory on MacBooks with switchable graphics
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.253
    - [armhf] clean up the memset64() C wrapper
    - scsi: lpfc: Properly set WC for DPP mapping
    - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
      (regression in 5.10.241)
    - ALSA: usb-audio: Cap the packet size pre-calculations
    - btrfs: fix incorrect key offset in error message in
      check_dev_extent_item()
    - [armhf] OMAP2+: add missing of_node_put before break and return
    - [armhf] omap2: Fix reference count leaks in omap_control_init()
    - [arm*] drm/tegra: dsi: fix device leak on probe
    - [armhf] clk: tegra: tegra124-emc: fix device leak on set_rate()
    - [x86] ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
    - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization
      induced race
    - [x86] ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
    - [x86] net: arcnet: com20020-pci: fix support for 2.5Mbit cards
    - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
      (CVE-2026-23253)
    - nfc: pn533: properly drop the usb interface reference on disconnect
      (CVE-2026-23291)
    - net: usb: kaweth: validate USB endpoints (CVE-2026-23312)
    - net: usb: kalmia: validate USB endpoints (CVE-2026-23365)
    - net: usb: pegasus: validate USB endpoints (CVE-2026-23290)
    - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a
      message (CVE-2026-23307)
    - can: ucan: Fix infinite loop from zero-length messages (CVE-2026-23298)
    - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
      (CVE-2026-23382)
    - [x86] efi: defer freeing of boot services memory (CVE-2026-23352)
    - ALSA: usb-audio: Use correct version for UAC3 header validation
      (CVE-2026-23318)
    - wifi: radiotap: reject radiotap with unknown bits (CVE-2026-23367)
    - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
      (CVE-2026-23289)
    - net/sched: ets: fix divide by zero in the offload path (CVE-2026-23379)
    - Squashfs: check metadata block offset is within range (CVE-2026-23388)
    - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() (CVE-2026-23356)
    - [x86] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
    - [armhf] net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry
      handling in ALE table
    - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs (CVE-2026-23286)
    - can: bcm: fix locking for bcm_op runtime updates (CVE-2026-23362)
    - can: mcp251x: fix deadlock in error path of mcp251x_open (CVE-2026-23357)
    - wifi: wlcore: Fix a locking bug (CVE-2026-23420)
    - indirect_call_wrapper: do not reevaluate function pointer
    - [amd64] xen/acpi-processor: fix _CST detection using undersized
      evaluation buffer
    - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (CVE-2026-23304)
    - amd-xgbe: fix sleep while atomic on suspend/resume
    - net: nfc: nci: Fix zero-length proprietary notifications (regression in
      5.10.215)
    - nfc: nci: free skb on nci_transceive early error paths (CVE-2026-23339)
    - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
    - nfc: rawsock: cancel tx_work before socket teardown (CVE-2026-23372)
    - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
      (CVE-2026-23381)
    - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
      (CVE-2026-23293)
    - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
      (CVE-2026-23300)
    - [rt][x86] scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
    - [x86] ACPI: PM: Save NVS memory on Lenovo G70-35
    - unshare: fix unshare_fs() handling
    - [x86] ACPI: OSI: Add DMI quirk for Acer Aspire One D255
    - scsi: ses: Fix devices attaching to different hosts
    - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
    - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
    - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL
      slave xmit (CVE-2026-23277)
    - ASoC: soc-core: drop delayed_work_pending() check before flush
    - ASoC: topology: use inclusive language for bclk and fsync
    - ASoC: don't indicate error message for snd_soc_[pcm_]dai_xxx()
    - ASoC: soc-core: move snd_soc_runtime_set_dai_fmt() to upside
    - ASoC: soc-core: add snd_soc_runtime_get_dai_fmt()
    - ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt()
    - ASoC: core: Exit all links before removing their components
    - ASoC: core: Do not call link_exit() on uninitialized rtd objects
    - ASoC: soc-core: flush delayed work before removing DAIs and widgets
    - serial: caif: hold tty->link reference in ldisc_open and ser_release
    - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
    - netfilter: x_tables: guard option walkers against 1-byte tail reads
    - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
    - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
    - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
      (CVE-2026-23274)
    - sched: idle: Make skipping governor callbacks more consistent
    - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
    - i40e: fix src IP mask checks and memcpy argument names in cloud filter
    - e1000/e1000e: Fix leak in DMA error cleanup
    - [x86] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock
      acquisition
    - ASoC: detect empty DMI strings
    - cgroup: fix race between task migration and iteration
    - net: usb: lan78xx: fix silent drop of packets with checksum errors
    - net: usb: lan78xx: skip LTM configuration for LAN7850
    - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
    - usb: xhci: Fix memory leak in xhci_disable_slot() (regression in 5.10.85)
    - usb: yurex: fix race in probe
    - usb: misc: uss720: properly clean up reference in uss720_probe()
    - usb: core: don't power off roothub PHYs if phy_set_mode() fails
    - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 (regression in
      5.10.209)
    - USB: usbcore: Introduce usb_bulk_msg_killable()
    - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
    - USB: core: Limit the length of unkillable synchronous timeouts
    - usb: class: cdc-wdm: fix reordering issue in read code path
    - [arm*] usb: renesas_usbhs: fix use-after-free in ISR during device
      removal
    - usb: mdc800: handle signal and read racing
    - usb: image: mdc800: kill download URB on timeout
    - mm/tracing: rss_stat: ensure curr is false from kthread context
    - [arm*] mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
    - tipc: fix divide-by-zero in tipc_sk_filter_connect()
    - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
    - ceph: fix i_nlink underrun during async unlink
    - time/jiffies: Mark jiffies_64_to_clock_t() notrace
    - [arm*] irqchip/gic-v3-its: Limit number of per-device MSIs to the range
      the ITS supports
    - staging: rtl8723bs: fix potential out-of-bounds read in
      rtw_restruct_wmm_ie
    - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
    - media: dvb-net: fix OOB access in ULE extension header tables
      (CVE-2026-31405)
    - batman-adv: Avoid double-rtnl_lock ELP metric worker (regression in
      5.10.235)
    - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
    - net: ncsi: fix skb leak in error paths
    - drm/amdgpu: Fix use-after-free race in VM acquire
    - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
    - [x86] apic: Disable x2apic on resume if the kernel expects so
    - btrfs: abort transaction on failure to update root in the received subvol
      ioctl
    - iio: dac: ds4424: reject -128 RAW value
    - iio: chemical: bme680: Fix measurement wait duration calculation
    - iio: imu: inv_icm42600: fix odr switch to the same value
    - bpf: Forget ranges when refining tnum after JSET (CVE-2025-39748)
    - l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
    - sunrpc: fix cache_request leak in cache_release (CVE-2026-31400)
    - nvdimm/bus: Fix potential use after free in asynchronous initialization
      (CVE-2026-31399)
    - NFC: nxp-nci: allow GPIOs to sleep (CVE-2026-31545)
    - net: macb: fix use-after-free access to PTP clock (CVE-2026-31396)
    - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
    - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
      (CVE-2026-31393)
    - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
    - mmc: sdhci: fix timing selection for 1-bit bus width
    - [x86] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
    - serial: 8250_pci: add support for the AX99100
    - serial: 8250: Fix TX deadlock when using DMA (regression in 5.10.235)
    - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART
      BUSY
    - drm/radeon: apply state adjust rules to some additional HAINAN vairants
    - net: Handle napi_schedule() calls from non-interrupt
    - [armhf] drm/exynos: vidi: use priv->vidi_dev for ctx lookup in
      vidi_connection_ioctl()
    - [armhf] drm/exynos: vidi: fix to avoid directly dereferencing user
      pointer
    - [armhf] drm/exynos: vidi: use ctx->lock to protect struct vidi_context
      member variables related to memory alloc/free (CVE-2026-23227)
    - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting
      I/O
    - ext4: drop extent cache when splitting extent fails
    - ext4: fix dirtyclusters double decrement on fs shutdown
    - ata: libata: remove pointless VPRINTK() calls
    - ata: libata-scsi: refactor ata_scsi_translate()
    - wifi: libertas: fix use-after-free in lbs_free_adapter() (CVE-2026-23281)
    - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
      (CVE-2026-23279)
    - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
      (CVE-2026-23336)
    - smb: client: Don't log plaintext credentials in cifs_set_cifscreds
      (CVE-2026-23303)
    - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
      (CVE-2026-23368)
    - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
    - net/sched: act_gate: snapshot parameters with RCU on replace
      (CVE-2026-23245)
    - iomap: reject delalloc mappings during writeback
    - tracing: Fix syscall events activation by ensuring refcount hits zero
    - [arm*] pmdomain: bcm: bcm2835-power: Fix broken reset status read
    - iio: light: bh1780: fix PM runtime leak on error path
    - smb: client: fix atomic open with O_DIRECT & O_SYNC
    - smb: client: fix iface port assignment in parse_server_interfaces
    - xfs: ensure dquot item is deleted from AIL only after log shutdown
    - xfs: fix integer overflow in bmap intent sort comparator
    - crypto: atmel-sha204a - Fix OOM ->tfm_count leak (CVE-2026-31391)
    - [arm64] drm/msm: Fix dma_free_attrs() buffer size
    - [arm64] mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
      (regression in 5.10.246)
    - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
      (CVE-2026-31403)
    - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)
    - mtd: Avoid boot crash in RedBoot partition table parser (CVE-2026-23474)
    - [arm*] pmdomain: bcm: bcm2835-power: Increase ASB control timeout
      (CVE-2026-31550)
    - iio: imu: inv_icm42600: fix odr switch when turning buffer off
    - usb: roles: get usb role switch from parent only for usb-b-connector
    - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
    - can: gs_usb: gs_can_open(): always configure bitrates before starting
      device
    - [x86] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-
      kernel APIC
    - ALSA: pcm: fix wait_time calculations
    - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
    - smb: client: Compare MACs in constant time
    - net/tcp-md5: Fix MAC comparison to be constant-time
    - staging: rtl8723bs: fix null dereference in find_network
    - [arm64] soc: fsl: qbman: fix race condition in qman_destroy_fq
      (CVE-2026-23463)
    - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
    - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
    - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
    - Bluetooth: HIDP: Fix possible UAF (CVE-2026-23462)
    - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
      (CVE-2026-23460)
    - netfilter: ctnetlink: remove refcounting in expectation dumpers
      (CVE-2025-39764)
    - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
      (CVE-2026-23458)
    - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in
      sip_help_tcp() (CVE-2026-23457)
    - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
      (CVE-2026-23456)
    - netfilter: nft_ct: add seqadj extension for natted connections
      (CVE-2025-68206)
    - netfilter: nft_ct: drop pending enqueued packets on removal
    - netfilter: xt_CT: drop pending enqueued packets on template removal
      (CVE-2026-23391)
    - netfilter: xt_time: use unsigned int for monthday bit shift
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
      (CVE-2026-23455)
    - [arm64] net: bcmgenet: increase WoL poll timeout
    - sched: idle: Consolidate the handling of two special cases
    - PM: runtime: Fix a race condition related to device removal
      (CVE-2026-23452)
    - net: usb: aqc111: Do not perform PM inside suspend callback
      (CVE-2026-23446)
    - igc: fix missing update of skb->tail in igc_xmit_frame()
    - wifi: mac80211: fix NULL deref in mesh_matches_local() (CVE-2026-23396)
    - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough
      headroom (CVE-2026-31552)
    - [arm64] net: macb: fix uninitialized rx_fs_lock
    - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
      (CVE-2026-23439)
    - net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546)
    - nfnetlink_osf: validate individual option lengths in fingerprints
      (CVE-2026-23397)
    - [armhf] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error
      paths
    - icmp: fix NULL pointer dereference in icmp_tag_validation()
      (CVE-2026-23398)
    - [armhf] i2c: fsi: Fix a potential leak in fsi_i2c_probe()
    - mtd: rawnand: serialize lock/unlock against other NAND operations
      (CVE-2026-23434)
    - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
      (CVE-2026-23351)
    - xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)
    - xen/privcmd: add boot control for restricted usage in domU
    - HID: asus: avoid memory leak in asus_report_fixup() (CVE-2026-31524)
    - [x86] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold
      16 Gen 1
    - [x86] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix
      touchscreen on SUPI S10
    - nvme-pci: ensure we're polling a polled queue (CVE-2026-31523)
    - dma-buf: Include ioctl.h in UAPI header
    - [x86] ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
    - xfrm: call xdo_dev_state_delete during state update
    - xfrm: Fix the usage of skb->sk
    - esp: fix skb leak with espintcp and async crypto (CVE-2026-31518)
    - af_key: validate families in pfkey_send_migrate() (CVE-2026-31515)
    - can: statistics: add missing atomic access in hot path
    - Bluetooth: L2CAP: Validate PDU length before reading SDU length in
      l2cap_ecred_data_rcv() (CVE-2026-31512)
    - Bluetooth: hci_ll: Fix firmware leak on error path
    - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
      (CVE-2026-31510)
    - nfc: nci: fix circular locking dependency in nci_close_device
      (CVE-2026-31509)
    - net: openvswitch: Avoid releasing netdev before teardown completes
      (regression in 5.10.248) (CVE-2026-31508)
    - openvswitch: validate MPLS set/set_masked payload length (CVE-2026-31679)
    - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice
      pipe buffer (CVE-2026-31507)
    - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
    - [armhf] platform/olpc: olpc-xo175-ec: Fix overflow error message to print
      inlen
    - net: fix fanout UAF in packet_release() via NETDEV_UP race
      (CVE-2026-31504)
    - [arm64] net: enetc: fix the output issue of 'ethtool --show-ring'
    - dma-mapping: add missing `inline` for `dma_free_attrs`
    - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
      (CVE-2026-31498)
    - Bluetooth: btusb: clamp SCO altsetting table indices (CVE-2026-31497)
    - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
      (CVE-2026-31428)
    - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
      (CVE-2026-31674)
    - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in
      process_sdp (CVE-2026-31427)
    - netlink: introduce NLA_POLICY_MAX_BE
    - netfilter: nft_payload: reject out-of-range attributes via policy
    - netlink: hide validation union fields from kdoc
    - netlink: introduce bigendian integer types
    - netlink: allow be16 and be32 types in all uint policy checks
    - netfilter: ctnetlink: use netlink policy range checks (CVE-2026-31495)
    - [arm64] net: macb: use the current queue number for stats
      (CVE-2026-31494)
    - regmap: Synchronize cache for the page selector
    - RDMA/rw: Fall back to direct SGE on MR pool exhaustion
    - scsi: scsi_transport_sas: Fix the maximum channel scanning issue
      (regression in 5.10.241)
    - [x86] fault: Fold mm_fault_error() into do_user_addr_fault()
    - [x86] fault: Improve kernel-executing-user-memory handling
    - [x86] efi: efi_unmap_boot_services: fix calculation of ranges_to_free
      size
    - [x86] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
    - [x86] ASoC: Intel: catpt: Fix the device initialization
    - ACPICA: include/acpi/acpixf.h: Fix indentation
    - ACPICA: Allow address_space_handler Install and _REG execution as 2
      separate steps
    - ACPI: EC: Fix EC address space handler unregistration
    - ACPI: EC: Fix ECDT probe ordering issues
    - sysctl: fix uninitialized variable in proc_do_large_bitmap
    - [arm*] spi: spi-fsl-lpspi: fix teardown order issue (UAF)
      (CVE-2026-31485)
    - can: gw: fix OOB heap access in cgw_csum_crc8_rel() (CVE-2026-31570)
    - cpufreq: conservative: Reset requested_freq on limits change
    - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
      (CVE-2026-31473)
    - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and
      napi_tx is false (CVE-2026-31469)
    - alarmtimer: Fix argument order in alarm_timer_forward()
    - scsi: ses: Handle positive SCSI error from ses_recv_diag()
    - jbd2: gracefully abort on checkpointing state corruptions
    - ext4: convert inline data to extents when truncate exceeds inline size
      (CVE-2026-31452)
    - ext4: make recently_deleted() properly work with lazy itable
      initialization
    - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
    - ext4: reject mount if bigalloc with s_first_data_block != 0
      (CVE-2026-31447)
    - btrfs: fix super block offset in error message in btrfs_validate_super()
    - btrfs: fix lost error when running device stats on multiple devices fs
    - futex: Clear stale exiting pointer in futex_lock_pi() retry path
      (CVE-2026-31555)
    - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
    - atm: lec: fix use-after-free in sock_def_readable()
    - objtool: Fix Clang jump table detection
    - HID: multitouch: Check to ensure report responses match the request
    - crypto: af-alg - fix NULL pointer dereference in scatterwalk
    - net: qrtr: Add GFP flags parameter to qrtr_alloc_ctrl_packet
    - net: qrtr: Release distant nodes along the bridge node
    - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
    - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX
      fields to zero to prevent an info-leak
    - tg3: Fix race for querying speed/duplex
    - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
    - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
    - bridge: br_nd_send: linearize skb before parsing ND options
      (CVE-2026-31682)
    - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (CVE-2026-31423)
    - ipv6: prevent possible UaF in addrconf_permanent_addr()
    - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to
      zero to prevent an info-leak
    - NFC: pn533: bound the UART receive buffer
    - bpf: Fix regsafe() for pointers to packet (regresion in 5.10.155)
    - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
      (CVE-2026-31680)
    - netfilter: nfnetlink_log: account for netlink header size
      (CVE-2026-31416)
    - netfilter: x_tables: ensure names are nul-terminated
    - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
    - netfilter: nf_conntrack_helper: pass helper to expect cleanup
    - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
    - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions
      for NFPROTO_ARP (CVE-2026-31424)
    - netfilter: nf_tables: reject immediate NF_QUEUE verdict
    - Bluetooth: MGMT: validate LTK enc_size on load
    - rds: ib: reject FRMR registration before IB connection is established
      (CVE-2026-31425)
    - [arm64] net: macb: fix clk handling on PCI glue driver removal
      (regression in 5.10.70)
    - [arm64] net: macb: properly unregister fixed rate clocks
    - net/mlx5: Avoid "No data available" when FW version queries fail
    - net/x25: Fix potential double free of skb
    - net/x25: Fix overflow when accumulating packets (CVE-2026-31417)
    - net/sched: cls_fw: fix NULL pointer dereference on shared blocks
      (CVE-2026-31421)
    - net/sched: cls_flow: fix NULL pointer dereference on shared blocks
      (CVE-2026-31422)
    - ipv6: avoid overflows in ip6_datagram_send_ctl() (CVE-2026-31415)
    - efi/mokvar-table: Avoid repeated map/unmap of the same page
    - [armhf] hwmon: (occ) Fix missing newline in occ_show_extended()
    - drm/ioc32: stop speculation on the drm_compat_ioctl path
    - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
    - USB: serial: option: add MeiG Smart SRM825WN
    - ALSA: caiaq: fix stack out-of-bounds read in init_card
    - ALSA: ctxfi: Fix missing SPDIFI1 index handling
    - Bluetooth: SMP: derive legacy responder STK authentication from MITM
      state
    - Bluetooth: SMP: force responder MITM requirements before building the
      pairing response
    - [armhf] hwmon: (occ) Fix division by zero in occ_show_power_1()
    - drm/ast: dp501: Fix initialization of SCU2C
    - USB: serial: io_edgeport: add support for Blackbox IC135A
    - USB: serial: option: add support for Rolling Wireless RW135R-GL
    - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
    - Input: synaptics-rmi4 - fix a locking bug in an error path
    - [x86] Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042
      quirk table
    - [x86] Input: xpad - add support for Razer Wolverine V3 Pro
    - iio: dac: ad5770r: fix error return in ad5770r_read_raw()
    - iio: light: vcnl4035: fix scan buffer on big-endian
    - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
    - iio: gyro: mpu3050: Fix incorrect free_irq() variable
    - iio: gyro: mpu3050: Fix irq resource leak
    - iio: gyro: mpu3050: Move iio_device_register() to correct location
    - iio: gyro: mpu3050: Fix out-of-sequence free_irq()
    - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
    - usb: ulpi: fix double free in ulpi_register_interface() error path
    - usb: usbtmc: Flush anchored URBs in usbtmc_release
    - bridge: br_nd_send: validate ND option lengths
    - cdc-acm: new quirk for EPSON HMD
    - comedi: dt2815: add hardware detection to prevent crash
    - comedi: Reinit dev->spinlock between attachments to low-level drivers
    - comedi: ni_atmio16d: Fix invalid clean-up after failed attach
    - comedi: me_daq: Fix potential overrun of firmware buffer
    - comedi: me4000: Fix potential overrun of firmware buffer
    - netfilter: ipset: drop logically empty buckets in mtype_del
      (CVE-2026-31418)
    - vxlan: validate ND option lengths in vxlan_na_create
    - [armhf] net: ftgmac100: fix ring allocation unwind on open failure
    - thunderbolt: Fix property read in nhi_wake_supported()
    - USB: dummy-hcd: Fix locking/synchronization error
    - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows
      partial transfer
    - nvmet-tcp: fix use-before-check of sg in bounds validation
      (CVE-2026-23112)
    - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
    - usb: gadget: f_rndis: Protect RNDIS options with mutex
    - usb: gadget: f_uac1_legacy: validate control request size
    - io_uring/tctx: work around xa_store() allocation error issue
      (CVE-2024-56584)
    - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
    - wifi: rt2x00usb: fix devres lifetime (CVE-2026-31672)
    - xfrm_user: fix info leak in build_report() (CVE-2026-31671)
    - Input: uinput - fix circular locking dependency with ff-core
      (CVE-2026-31667)
    - Input: uinput - take event lock when submitting FF request "event"
    - mm/hugetlb: fix skipping of unsharing of pmd page tables (regression in
      5.10.239)
    - mm/hugetlb: make detecting shared pte more reliable
    - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
      (regression in 5.10.239)
    - mm/hugetlb: fix hugetlb_pmd_shared() (CVE-2026-23100) (regression in
      5.10.239)
    - mm/hugetlb: fix two comments related to huge_pmd_unshare()
    - mm/rmap: fix two comments related to huge_pmd_unshare()
    - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using
      mmu_gather (regression in 5.10.239)
    - netfilter: nft_ct: fix use-after-free in timeout object destroy
      (CVE-2026-31665)
    - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (CVE-2026-31662)
    - wifi: brcmsmac: Fix dma_free_coherent() size (CVE-2026-31661)
    - [arm64] dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
    - [arm64] dts: hisilicon: hi3798cv200: Add missing dma-ranges
    - nfc: pn533: allocate rx skb before consuming bytes (CVE-2026-31660)
    - batman-adv: reject oversized global TT response buffers (CVE-2026-31659)
    - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
      (CVE-2026-31658)
    - mmc: vub300: fix NULL-deref on disconnect (CVE-2026-31651)
    - net: stmmac: fix integer underflow in chain mode (CVE-2026-31649)
    - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
    - xen/privcmd: unregister xenstore notifier on module exit
    - ASoC: soc-core: don't use discriminatory terms on
      snd_soc_runtime_get_dai_fmt()
    - [arm*] ASoC: tegra: Fix Master Volume Control
    - netlink: add nla be16/32 types to minlen array
    - cpufreq: governor: Free dbs_data directly when gov->init() fails
    - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error
      path
    - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
      (CVE-2026-31668)
    - net: rfkill: prevent unlimited numbers of rfkill events from being
      created (CVE-2026-31670)
    - usb: gadget: f_hid: move list and spinlock inits from bind to alloc
    - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
    - usb: gadget: uvc: fix NULL pointer dereference during unbind race
    - [arm64] net: macb: Move devm_{free,request}_irq() out of spin lock area
    - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
      (CVE-2026-31466)
    - ext4: fix the might_sleep() warnings in kvfree()
    - xfs: save ailp before dropping the AIL lock in push callbacks
      (CVE-2026-31454)
    - xfs: stop reclaim before pushing AIL during unmount (CVE-2026-31455)
    - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
    - ext4: publish jinode after initialization (CVE-2026-31450)
    - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
      (CVE-2026-23395)
    - Revert "nvme: nvme-fc: Ensure ->ioerr_work is cancelled in
      nvme_fc_delete_ctrl()"
    - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
      (CVE-2025-40261)
    - device property: Add fwnode_is_ancestor_of() and
      fwnode_get_next_parent_dev()
    - media: device property: Return true in fwnode_device_is_available for
      NULL ops
    - device property: Retrieve fwnode from of_node via accessor
    - device property: Unify access to of_node
    - device property: Check fwnode->secondary in
      fwnode_graph_get_next_endpoint()
    - device property: Check fwnode->secondary when finding properties
    - device property: Allow error pointer to be passed to fwnode APIs
    - device property: Allow secondary lookup in
      fwnode_get_next_child_node()
    - batman-adv: avoid OGM aggregation when skb tailroom is insufficient
      (CVE-2026-31683)
    - device property: fix of node refcount leak in
      fwnode_graph_get_next_endpoint()
    - io_uring/poll: correctly handle io_poll_add() return value on update
    - [x86] CPU: Fix FPDSS on Zen1 (CVE-2025-54505, CVE-2026-31628)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.254
    - xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
    - Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.255
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.256
    - [x86] CPU/AMD: Add ZenX generations flags
    - [x86] CPU/AMD: Call the spectral chicken in the Zen2 init function
    - [x86] CPU/AMD: Rename init_amd_zn() to init_amd_zen_common()
    - [x86] CPU/AMD: Add X86_FEATURE_ZEN1
    - [x86] CPU/AMD: Prevent improper isolation of shared resources in Zen2's
      op cache
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.257
    - net: skbuff: preserve shared-frag marker during coalescing
      (CVE-2026-46300)
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers
      (CVE-2026-43503)

  [ Ben Hutchings ]
  * [rt] Update to 5.10.255-rt151:
    - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
  * Redo backport of "RDMA/rxe: Fix double free in rxe_srq_from_init"
  * [armhf] fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter
  * [x86] CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function
  * Revert "io_uring/poll: correctly handle io_poll_add() return value on
    update"
  * net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
    (CVE-2024-53213)

  [ Salvatore Bonaccorso ]
  * smb: client: reject userspace cifs.spnego descriptions

 -- Ben Hutchings <benh@debian.org>  Wed, 27 May 2026 18:38:00 +0200

linux (5.10.251-5) bullseye-security; urgency=medium

  * ptrace: slightly saner 'get_dumpable()' logic

 -- Ben Hutchings <benh@debian.org>  Fri, 15 May 2026 12:09:08 +0200

linux (5.10.251-4) bullseye-security; urgency=high

  * rxrpc: input: Open-code skb_unshare()
  * rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
  * rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  * xfrm: esp: avoid in-place decrypt on shared skb frags

 -- Ben Hutchings <benh@debian.org>  Fri, 08 May 2026 11:43:47 +0200

linux (5.10.251-3) bullseye-security; urgency=high

  [ Bastian Blank ]
  * Remove architectures not existing in Debian

 -- Ben Hutchings <benh@debian.org>  Thu, 30 Apr 2026 21:59:04 +0200

linux (5.10.251-2) bullseye-security; urgency=high

  * crypto: af-alg - fix NULL pointer dereference in scatterwalk
  * crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
  * crypto: scatterwalk - Backport memcpy_sglist()
  * crypto: algif_aead - use memcpy_sglist() instead of null skcipher
  * crypto: algif_aead - Revert to operating out-of-place
    (CVE-2026-31431)
  * crypto: algif_aead - snapshot IV for async AEAD requests
  * crypto: authenc - use memcpy_sglist() instead of null skcipher
  * crypto: authencesn - Do not place hiseq at end of dst for out-of-place
    decryption
  * crypto: authencesn - Fix src offset when decrypting in-place
  * crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
  * crypto: algif_aead - Fix minimum RX size check for decryption

 -- Ben Hutchings <benh@debian.org>  Thu, 30 Apr 2026 18:04:21 +0200

linux (5.10.251-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.250
    - rbd: check for EOD after exclusive lock is ensured to be held
    - KVM: Don't clobber irqfd routing type when deassigning irqfd
      (CVE-2026-23198)
    - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
      (CVE-2025-38201)
    - binderfs: fix ida_alloc_max() upper bound
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
      (CVE-2025-71224)
    - wifi: wlcore: ensure skb headroom before skb_push (CVE-2025-71222)
    - net: usb: sr9700: support devices with virtual driver CD
    - block,bfq: fix aux stat accumulation destination
    - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
    - [amd64] HID: intel-ish-hid: Reset enum_devices_done before enumeration
    - [x86] ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
    - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
    - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
    - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
    - wifi: mac80211: collect station statistics earlier when disconnect
    - wifi: cfg80211: Fix bitrate calculation overflow for HE rates
    - scsi: target: iscsi: Fix use-after-free in
      iscsit_dec_session_usage_count() (CVE-2026-23193)
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
      (CVE-2026-23216)
    - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
    - [x86] platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
      (CVE-2026-23176)
    - [x86] platform/x86: intel_telemetry: Fix PSS event register mask
    - net: liquidio: Initialize netdev pointer before queue setup
    - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
    - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
    - macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)
    - tipc: use kfree_sensitive() for session key material
    - [armhf] hwmon: (occ) Mark occ_init_attribute() as __printf
    - nvmet-tcp: add an helper to free the cmd buffers
    - nvmet-tcp: fix memory leak when performing a controller reset
    - nvmet-tcp: fix regression in data_digest calculation
    - nvmet-tcp: don't map pages which can't come from HIGHMEM
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
      (CVE-2026-23112)
    - [amd64] ASoC: amd: fix memory leak in acp3x pdm dma ops (CVE-2026-23190)
    - [x86] platform/x86: intel_telemetry: Fix swapped arrays in PSS output
    - gve: Fix stats report corruption on queue count change
    - tracing: Fix ftrace event field alignments
    - gve: Correct ethtool rx_dropped calculation
    - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.251
    - [armhf] crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists
      correctly (CVE-2026-23222)
    - crypto: virtio - Add spinlock protection with virtqueue notification
      (CVE-2026-23229)
    - nilfs2: Fix potential block overflow that cause system hang
      (CVE-2025-71237)
    - scsi: qla2xxx: Delay module unload while fabric scan in progress
      (CVE-2025-71235)
    - scsi: qla2xxx: Query FW again before proceeding with login
    - [armhf] gpio: omap: do not register driver in probe()
    - [x86] ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
    - romfs: check sb_set_blocksize() return value (CVE-2026-23238)
    - [x86] platform/x86: classmate-laptop: Add missing NULL pointer checks
      (CVE-2026-23237)
    - gpiolib: acpi: Fix gpio count with string references
    - fs: dlm: fix invalid derefence of sb_lvbptr (CVE-2022-50516)
    - crypto: virtio - Remove duplicated virtqueue_kick in
      virtio_crypto_skcipher_crypt_req
    - scsi: qla2xxx: Validate sp before freeing associated memory
      (CVE-2025-71236)
    - scsi: qla2xxx: Free sp in error path to fix system crash (CVE-2025-71232)
    - scsi: qla2xxx: Fix bsg_done() causing double free (CVE-2025-71238)
    - fbdev: smscufx: properly copy ioctl memory to kernelspace
      (CVE-2026-23236)
    - f2fs: fix out-of-bounds access in sysfs attribute read/write
      (CVE-2026-23235)
    - f2fs: fix to avoid UAF in f2fs_write_end_io() (CVE-2026-23234)
    - USB: serial: option: add Telit FN920C04 RNDIS compositions

  [ Ben Hutchings ]
  * [armhf] Revert "ARM: 9468/1: fix memset64() on big-endian"
  * ip6_tunnel: Fix usage of skb_vlan_inet_prepare() (Closes: #1127597)
  * CI: Delete support for ccache, which was removed from common pipeline
  * CI: Update build job to work after another common pipeline change
  * [rt] Update to 5.10.251-rt146

  [ Salvatore Bonaccorso ]
  * apparmor: fix kernel-doc complaints
  * apparmor: Fix kernel-doc warnings in apparmor/policy.c
  * apparmor: validate DFA start states are in bounds in unpack_pdb
  * apparmor: fix memory leak in verify_header
  * apparmor: replace recursive profile removal with iterative approach
  * apparmor: fix: limit the number of levels of policy namespaces
  * apparmor: fix side-effect bug in match_char() macro usage
  * apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
  * apparmor: Fix double free of ns_name in aa_replace_profiles()
  * apparmor: fix unprivileged local user can do privileged policy management
  * apparmor: fix differential encoding verification
  * apparmor: fix race on rawdata dereference
  * apparmor: fix race between freeing data and fs accessing it

 -- Ben Hutchings <benh@debian.org>  Mon, 09 Mar 2026 12:26:03 +0100

linux (5.10.249-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.248
    - xfrm: delete x->tunnel as we delete x (CVE-2025-40215)
    - Revert "xfrm: destroy xfrm_state synchronously on net exit path"
    - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that
      were never added
    - xfrm: flush all states in xfrm_state_fini
    - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system
      corrupted (CVE-2025-68337)
    - ext4: refresh inline data size before write operations (CVE-2025-68264)
    - locking/spinlock/debug: Fix data-race in do_raw_write_lock
      (CVE-2025-68336)
    - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
      (CVE-2025-68261)
    - USB: serial: option: add Foxconn T99W760
    - USB: serial: option: add Telit Cinterion FE910C04 new compositions
    - USB: serial: option: move Telit 0x10c7 composition in the right place
    - USB: serial: ftdi_sio: match on interface number for jtag
    - serial: add support of CPCI cards
    - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
    - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
    - [armhf] spi: imx: keep dma request disabled before dma transfer setup
    - bfs: Reconstruct file type when loading from disk (CVE-2025-68266)
    - [arm64] pinctrl: qcom: msm: Fix deadlock in pinmux configuration
    - [x86] platform/x86: acer-wmi: Ignore backlight event
    - [x86] platform/x86: huawei-wmi: add keys for HONOR models
    - comedi: c6xdigio: Fix invalid PNP driver unregistration (CVE-2025-68332)
    - comedi: multiq3: sanitize config options in multiq3_attach()
      (CVE-2025-68258)
    - comedi: check device's attached status in compat ioctls (CVE-2025-68257)
    - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
      (CVE-2025-68255)
    - smack: fix bug: unprivileged task can create labels (CVE-2025-68733)
    - drm/vgem-fence: Fix potential deadlock on release (CVE-2025-68757)
    - USB: Fix descriptor count when handling invalid MBIM extended descriptor
    - [arm64] irqchip/qcom-irq-combiner: Fix section mismatch
    - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
    - inet: Avoid ehash lookup race in inet_ehash_insert()
    - iio: imu: st_lsm6dsx: introduce st_lsm6dsx_device_set_enable routine
    - iio: imu: st_lsm6dsx: discard samples during filters settling time
    - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
    - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
      (CVE-2025-68724)
    - [x86] dumpstack: Make show_trace_log_lvl() static
    - kmsan: introduce __no_sanitize_memory and __no_kmsan_checks
    - [x86] kmsan: don't instrument stack walking functions
    - [x86] dumpstack: Prevent KASAN false positive warnings in __show_regs()
    - [armhf] pinctrl: stm32: fix hwspinlock resource leak in probe function
    - scsi: target: Do not write NUL characters into ASCII configfs output
    - ext4: minor defrag code improvements
    - ext4: correct the checking of quota files before moving extents
    - [x86] perf/x86/intel: Correct large PEBS flag check
    - regulator: core: disable supply if enabling main regulator fails
    - nbd: clean up return value checking of sock_xmit()
    - nbd: partition nbd_read_stat() into nbd_read_reply() and
      nbd_handle_reply()
    - nbd: defer config put in recv_work (CVE-2025-68372)
    - scsi: stex: Fix reboot_notifier leak in probe error path
    - [amd64] macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
      (CVE-2025-68367)
    - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
    - nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
    - [arm*] clk: renesas: r9a06g032: Fix memory leak in error path
    - lib/vsprintf: Check pointer before dereferencing in time_and_date()
    - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
      (CVE-2025-68364)
    - ACPI: property: Fix fwnode refcount leak in
      acpi_fwnode_graph_parse_endpoint()
    - watchdog: wdat_wdt: Stop watchdog when uninstalling module
    - watchdog: wdat_wdt: Fix ACPI table leak in probe function
    - NFSD/blocklayout: Fix minlength check in proc_layoutget
    - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
      (CVE-2025-68759)
    - [arm*] pwm: bcm2835: Support apply function for atomic configuration
    - [arm*] pwm: bcm2835: Make sure the channel is enabled after pwm_request()
    - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
    - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
    - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
      (CVE-2025-68362)
    - ima: Handle error code returned by ima_filter_rule_match()
      (CVE-2025-68740)
    - usb: chaoskey: fix locking for O_NONBLOCK
    - [arm*] usb: dwc2: disable platform lowlevel hw resources during shutdown
    - [arm*] usb: dwc2: fix hang during shutdown if set as peripheral
    - [arm*] usb: dwc2: fix hang during suspend if set as peripheral
    - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
    - [arm*] crypto: ccree - Correctly handle return of sg_nents_for_len
    - staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
    - [arm*] PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
    - wifi: ieee80211: correct FILS status codes
    - backlight: led-bl: Add devlink to supplier LEDs (CVE-2025-68758)
    - [arm*] iommu/arm-smmu-qcom: Enable use of all SMR groups when running
      bare-metal
    - drm/amd/display: Fix logical vs bitwise bug in
      get_embedded_panel_info_v2_1()
    - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
    - ext4: remove unused return value of __mb_check_buddy
    - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0
      validation
    - regulator: core: Protect regulator_supply_alias_list with
      regulator_list_mutex (CVE-2025-68354)
    - netfilter: nft_connlimit: move stateful fields out of expression data
    - netfilter: nf_conncount: reduce unnecessary GC
    - netfilter: nf_conncount: rework API to use sk_buff directly
    - netfilter: nft_connlimit: update the count if add was skipped
    - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
    - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
      (CVE-2025-68325)
    - perf tools: Fix split kallsyms DSO counting
    - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling
    - pinctrl: single: Fix incorrect type for error return variable
    - NFS: Clean up function nfs_mark_dir_for_revalidate()
    - NFS: Fix open coded versions of nfs_set_cache_invalid()
    - NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink()
    - NFS: don't unhash dentry during unlink/rename
    - NFS: Avoid changing nlink when file removes and attribute updates race
    - fs/nls: Fix utf16 to utf8 conversion
    - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in
      pnfs_mark_layout_stateid_invalid (CVE-2025-68349)
    - Revert "nfs: ignore SB_RDONLY when remounting nfs" (regression in
      5.10.239)
    - Revert "nfs: clear SB_RDONLY before getting superblock"
    - Revert "nfs: ignore SB_RDONLY when mounting nfs" (regression in 5.10.231)
    - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
      (CVE-2025-68764)
    - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
    - [x86] platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
    - blk-mq: Abort suspend when wakeup events are pending
    - dma/pool: eliminate alloc_pages warning in atomic_pool_expand
    - [armhf] 9464/1: fix input-only operand modification in
      load_unaligned_zeropad()
    - dm-raid: fix possible NULL dereference with undefined raid type
    - dm log-writes: Add missing set_freezable() for freezable kthread
    - efi/cper: Add a new helper function to print bitmasks
    - [arm64] efi/cper: Adjust infopfx size to accept an extra space
    - [arm64] efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
    - ocfs2: fix memory leak in ocfs2_merge_rec_left()
    - usb: phy: Initialize struct usb_phy list_head
    - ALSA: dice: fix buffer overflow in detect_stream_formats()
      (CVE-2025-68346)
    - NFS: Fix missing unlock in nfs_unlink()
    - netfilter: nf_conncount: garbage collection is not skipped when jiffies
      wrap around
    - netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
    - [arm64] bpf, arm64: Do not audit capability check in do_jit()
    - btrfs: fix memory leak of fs_devices in degraded seed device path
    - ACPICA: Avoid walking the Namespace if start_node is NULL
      (CVE-2025-71118)
    - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
    - hfsplus: fix volume corruption issue for generic/070
    - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
      (CVE-2025-68774)
    - hfsplus: Verify inode mode when loading from disk (CVE-2025-68767)
    - hfsplus: fix volume corruption issue for generic/073
    - btrfs: scrub: always update btrfs_scrub_progress::last_physical
    - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
    - netrom: Fix memory leak in nr_sendmsg() (CVE-2025-68787)
    - net/sched: ets: Always remove class from active list before deleting in
      ets_qdisc_change (CVE-2025-71066)
    - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
    - mlxsw: spectrum_router: Fix neighbour use-after-free (CVE-2025-68801)
    - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route
      stats (CVE-2025-68800)
    - net: openvswitch: fix middle attribute validation in push_nsh() action
      (CVE-2025-68785)
    - [x86] broadcom: b44: prevent uninitialized value usage
    - netfilter: nf_conncount: fix leaked ct in error paths
    - ipvs: fix ipv4 null-ptr-deref in route error path (CVE-2025-68813)
    - caif: fix integer underflow in cffrml_receive() (CVE-2025-68799)
    - net/sched: ets: Remove drr class from the active list if it changes to
      strict (CVE-2025-68815)
    - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
    - net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers
    - ethtool: Avoid overflowing userspace buffer on stats query
      (CVE-2025-68795)
    - net/mlx5: fw_tracer, Add support for unrecognized string
    - net/mlx5: fw_tracer, Validate format string parameters (CVE-2025-68816)
    - net/mlx5: fw_tracer, Handle escaped percent properly
    - net: hns3: using the num_tqps in the vf driver to apply for resources
      (CVE-2025-71064)
    - net: hns3: add VLAN id validation before using (CVE-2025-71112)
    - hwmon: (ibmpex) fix use-after-free in high/low store (CVE-2025-68789)
    - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
    - [arm*] Input: ti_am335x_tsc - fix off-by-one error in wire_order
      validation (CVE-2025-68777)
    - [x86] Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk
      table
    - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
    - [arm*] spi: fsl-cpm: Check length parity before switching to 16 bit mode
      (CVE-2025-68773)
    - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
      (CVE-2025-68776)
    - [x86] ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
    - [x86] ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
    - ALSA: usb-mixer: us16x08: validate meter packet indices (CVE-2025-68783)
    - ipmi: Fix the race between __scan_channels() and deliver_response()
    - ipmi: Fix __scan_channels() failing to rescan channels
    - [armhf] ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
    - [arm64] clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
      pcie_x4
    - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
    - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
    - [x86] via_wdt: fix critical boot hang due to unnamed resource allocation
      (CVE-2025-71114)
    - exfat: fix remount failure in different process environments
    - [rt] usbip: Fix locking bug in RT-enabled kernels
    - usb: typec: ucsi: Handle incorrect num_connectors capability
      (CVE-2025-71108)
    - usb: xhci: limit run_graceperiod for only usb 3.0 devices
    - usb: usb-storage: No additional quirks need to be added to the EL-R12
      optical drive.
    - nvme-fc: don't hold rport lock when putting ctrl
    - vhost/vsock: improve RCU read sections around vhost_vsock_get()
    - [amd64] lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
    - ext4: xattr: fix null pointer deref in ext4_raw_inode() (CVE-2025-68820)
    - ext4: fix incorrect group number assertion in mb_check_buddy
    - jbd2: use a weaker annotation in journal handling
    - usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
    - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
      (CVE-2025-68819)
    - [arm*] usb: dwc3: of-simple: fix clock resource leak in
      dwc3_of_simple_probe
    - char: applicom: fix NULL pointer dereference in ac_ioctl (CVE-2025-68797)
    - [x86] intel_th: Fix error handling in intel_th_output_open
    - [i386] cpufreq: nforce2: fix reference count leak in nforce2
    - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort
      path" (CVE-2025-68818) (regression in 5.10.177)
    - scsi: aic94xx: fix use-after-free in device removal path (CVE-2025-71075)
    - NFSD: use correct reservation type in nfsd4_scsi_fence_client
    - scsi: target: Reset t_task_cdb pointer in error case (CVE-2025-68782)
    - f2fs: invalidate dentry cache on failed whiteout creation
      (CVE-2025-71069)
    - f2fs: fix return value of f2fs_recover_fsync_data() (CVE-2025-68769)
    - media: vidtv: initialize local pointers upon transfer of memory ownership
      (CVE-2025-68808)
    - ocfs2: fix kernel BUG in ocfs2_find_victim_chain (CVE-2025-68771)
    - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
      (CVE-2025-68804)
    - [arm64] scs: fix a wrong parameter in __scs_magic (CVE-2025-71102)
    - libceph: make decode_pool() more resilient against corrupted osdmaps
      (CVE-2025-71116)
    - [x86] KVM: x86: WARN if hrtimer callback for periodic APIC timer fires
      with period=0
    - [x86] KVM: x86: Explicitly set new periodic hrtimer expiration in
      apic_timer_fn()
    - [x86] KVM: x86: Fix VM hard lockup after prolonged inactivity with
      periodic HV timer (CVE-2025-71104)
    - [x86] KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW
      emulation
    - [x86] KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR
      (failed VMRUN)
    - tracing: Do not register unsupported perf events (CVE-2025-71125)
    - PM: runtime: Do not clear needs_force_resume with enabled runtime PM
    - fsnotify: do not generate ACCESS/MODIFY events on child for special files
      (CVE-2025-68788)
    - nfsd: Mark variable __maybe_unused to avoid W=1 build break
    - io_uring: fix filename leak in __io_openat_prep()
    - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
    - [arm*] amba: tegra-ahb: Fix device leak on SMMU enable
    - [arm64] soc: amlogic: canvas: fix device leak on lookup
    - [arm64] rpmsg: glink: fix rpmsg device leak
    - [x86] i2c: amd-mp2: fix reference leak in MP2 PCI device
    - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
      (CVE-2025-71111)
    - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
    - i40e: fix scheduling in set_rx_mode
    - iavf: fix off-by-one issues in iavf_config_rss_reg() (CVE-2025-71087)
    - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
      (CVE-2025-71131)
    - [armhf] net: mdio: aspeed: move reg accessing part into separate
      functions
    - [armhf] net: mdio: aspeed: add dummy read to avoid read-after-write issue
    - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
    - ip6_gre: make ip6gre_header() robust (CVE-2025-71098)
    - [x86] platform/x86: msi-laptop: add missing sysfs_remove_group()
    - [x86] platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
    - team: fix check for port enabled in
      team_queue_override_port_prio_changed() (CVE-2025-71091)
    - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
      (CVE-2025-71154)
    - firewire: nosy: switch from 'pci_' to 'dma_' API
    - firewire: nosy: Fix dma_free_coherent() size
    - [armhf] net: dsa: b53: skip multicast entries for fdb_dump()
    - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
    - [arm64] octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
      (CVE-2025-71137)
    - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
      (CVE-2025-71085)
    - ipv4: Fix reference count leak when using error routes with nexthop
      objects (CVE-2025-71097)
    - net: rose: fix invalid array index in rose_kill_by_device()
      (CVE-2025-71086)
    - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
    - [armhf] ASoC: stm32: sai: fix device leak on probe
    - [armhf] iommu/omap: fix device leaks on probe_device()
    - HID: logitech-dj: Remove duplicate error logging
    - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
    - [arm64] mfd: max77620: Fix potential IRQ chip conflict when probing two
      devices
    - media: adv7842: Avoid possible out-of-bounds array accesses in
      adv7842_cp_log_status() (CVE-2025-71136)
    - media: cec: Fix debugfs leak on bus_register() failure
    - media: msp3400: Avoid possible out-of-bounds array accesses in
      msp3400c_thread()
    - idr: fix idr_alloc() returning an ID out of range
    - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
      (CVE-2025-71096)
    - RDMA/cm: Fix leaking the multicast GID table reference (CVE-2025-71084)
    - e1000: fix OOB in e1000_tbi_should_accept() (CVE-2025-71093)
    - [amd64] fjes: Add missing iounmap in fjes_hw_init()
    - nfsd: Drop the client reference in client_states_open()
    - net: usb: sr9700: fix incorrect command used to write single register
    - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
      (CVE-2025-71079)
    - [arm64] drm/msm/a6xx: Fix out of bound IO access in
      a6xx_get_gmu_registers
    - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in
      prepare_fb
    - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device"
      problem (CVE-2025-38022)
    - virtio_console: fix order of fields cols and rows
    - console: Delete unused con_font_copy() callback implementations
    - console: Delete dummy con_font_set() and con_font_default() callback
      implementations
    - Fonts: Add charcount field to font_desc
    - fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount
      (Closes: #1123750)
    - [x86] drm/vmwgfx: Fix a null-ptr access in the cursor snooper
      (CVE-2025-40110)
    - usb: xhci: move link chain bit quirk checks into one helper function.
    - usb: xhci: Apply the link chain quirk on NEC isoc endpoints
      (CVE-2025-22022)
    - ipv6: Fix potential uninit-value access in __ip6_make_skb()
      (CVE-2024-36903)
    - ipv4: Fix uninit-value access in __ip_make_skb() (CVE-2024-36927)
    - HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)
    - usb: gadget: udc: fix use-after-free in usb_gadget_state_work
      (CVE-2025-68282)
    - net/mlx5e: Avoid field-overflowing memcpy() (CVE-2022-48744)
    - [i386] ALSA: wavefront: Clear substream pointers on close
    - [i386] ALSA: wavefront: Fix integer overflow in sample size validation
      (CVE-2025-68344)
    - ext4: fix string copying in parse_apply_sb_mount_options()
      (CVE-2025-71123)
    - btrfs: don't rewrite ret from inode_permission
    - xfs: fix a memory leak in xfs_buf_item_init()
    - f2fs: use global inline_xattr_slab instead of per-sb slab cache
      (CVE-2025-71105)
    - f2fs: fix to detect recoverable inode during dryrun of
      find_fsync_dnodes()
    - f2fs: fix to propagate error from f2fs_enable_checkpoint()
    - f2fs: fix to avoid updating zero-sized extent in extent cache
      (CVE-2025-68796)
    - [arm*] usb: dwc3: keep susphy enabled during exit to avoid controller
      faults
    - jbd2: fix the inconsistency between checksum and data in memory for
      journal sb
    - tpm: Cap the number of PCR banks (CVE-2025-71077)
    - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
    - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in
      gss_read_proxy_verf (CVE-2025-71120)
    - hwmon: replace snprintf in show functions with sysfs_emit
    - hwmon: (max16065) Use local variable to avoid TOCTOU
    - crypto: af_alg - zero initialize memory allocated via sock_kmalloc
      (CVE-2025-71113)
    - [arm64] iommu/qcom: fix device leak on of_xlate()
    - [arm64] PCI: brcmstb: Fix disabling L0s capability
    - [armhf] ASoC: stm: Use dev_err_probe() helper
    - [armhf] ASoC: stm32: sai: Use the devm_clk_get_optional() helper
    - [armhf] ASoC: stm32: sai: fix clk prepare imbalance on probe failure
    - mm/balloon_compaction: make balloon page compaction callbacks static
    - mm/balloon_compaction: we cannot have isolated pages in the balloon list
    - mm/balloon_compaction: convert balloon_page_delete() to
      balloon_page_finalize()
    - lockd: fix vfs_test_lock() calls
    - [x86] drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
    - wifi: mac80211: Discard Beacon frames to non-broadcast address
      (CVE-2025-71127)
    - NFSD: NFSv4 file creation neglects setting ACL (CVE-2025-68803)
    - scsi: iscsi: Move pool freeing
    - scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
      (CVE-2023-52975)
    - [arm*] cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
      (CVE-2025-37830)
    - ovl: Use "buf" flexible array for memcpy() destination (CVE-2022-49743)
    - btrfs: do not clean up repair bio if submit fails (CVE-2022-49168)
    - [arm64] bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
      (CVE-2022-49711)
    - [amd64] Revert "iommu/amd: Skip enabling command/event buffers for kdump"
      (regression in 5.10.247)
    - scsi: core: ufs: Fix a hang in the error handler (CVE-2025-38119)
    - net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()
    - [x86] atm: Fix dma_free_coherent() size
    - net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
      (CVE-2026-23020)
    - [x86] mei: me: add nova lake point S DID
    - lib/crypto: aes: Fix missing MMU protection for AES S-box
    - wifi: avoid kernel-infoleak from struct iw_point (CVE-2026-22978)
    - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
      (CVE-2026-22990)
    - libceph: make free_choose_arg_map() resilient to partial allocation
      (CVE-2026-22991)
    - libceph: make calc_target() set t->paused, not just clear it
      (CVE-2026-23047)
    - ext4: introduce ITAIL helper
    - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
      (CVE-2025-22121)
    - bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself
    - [rt][armhf] 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
    - NFSv4: ensure the open stateid seqid doesn't go backwards
    - NFS: Fix up the automount fs_context to use the correct cred
    - [x86] scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
    - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
      failure scanned in again after probe failed" (regression in 5.10.223)
    - [armhf] dts: imx6q-ba16: fix RTC interrupt level
    - netfilter: nft_synproxy: avoid possible data-race on update operation
    - netfilter: nf_conncount: update last_gc only when GC has been performed
    - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
    - inet: ping: Fix icmp out counting
    - net: sock: fix hardened usercopy panic in sock_recv_errqueue
      (CVE-2026-22977)
    - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
    - net/mlx5e: Don't print error message due to invalid module
    - eth: bnxt: move and rename reset helpers
    - bnxt_en: Fix potential data corruption with HW GRO/LRO
    - HID: quirks: work around VID/PID conflict for appledisplay
    - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate
      in qfq_reset (CVE-2026-22976)
    - net: usb: pegasus: fix memory leak in update_eth_regs_async()
      (CVE-2026-23021)
    - arp: do not assume dev_hard_header() does not change skb->head
    - blk-throttle: Set BIO_THROTTLED when bio has been throttled
      (CVE-2022-49465)
    - nfsd: provide locking for v4_end_grace (CVE-2026-22980)
    - [x86] powercap: fix race condition in register_control_type()
    - [x86] powercap: fix sscanf() error return value handling
    - can: j1939: make j1939_session_activate() fail if device is no longer
      registered (CVE-2025-71182)
    - [arm64] ASoC: fsl_sai: Add missing registers to cache default
    - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
    - efi/cper: Fix cper_bits_to_str buffer handling and return value
    - NFS: unlink/rmdir shouldn't call d_delete() twice on ENOENT
    - NFS: add barriers when testing for NFS_FSDATA_BLOCKED
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.249
    - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
      (CVE-2026-23038)
    - nvmet-tcp: remove boilerplate code
    - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
      (CVE-2026-22998)
    - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
      (CVE-2026-23003)
    - macvlan: Add nodst option to macvlan type source
    - macvlan: Use 'hash' iterators to simplify code
    - macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)
    - ipv4: ip_gre: make ipgre_header() robust (CVE-2026-23011)
    - net/sched: sch_qfq: do not free existing class in qfq_change_class()
      (CVE-2026-22999)
    - [arm*] dmaengine: tegra-adma: Fix use-after-free (CVE-2025-71162)
    - [armhf] phy: stm32-usphyc: Fix off by one in probe() (CVE-2025-71196)
    - [armhf] dmaengine: omap-dma: fix dma_pool resource leak in error paths
      (CVE-2026-23033)
    - HID: usbhid: paper over wrong bNumDescriptor field (Closes: #1122193)
    - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
    - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session
      upon receiving the second rts (CVE-2026-22997)
    - [arm64] phy: rockchip: inno-usb2: fix disconnection in gadget mode
    - [arm64] phy: rockchip: inno-usb2: fix communication disruption in gadget
      mode
    - [arm*] usb: dwc3: Check for USB4 IP_NAME
    - [arm*] USB: OHCI/UHCI: Add soft dependencies on ehci_platform
    - USB: serial: option: add Telit LE910 MBIM composition
    - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
    - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
    - [x86] EDAC/x38: Fix a resource leak in x38_probe1()
    - [x86] EDAC/i3200: Fix a resource leak in i3200_probe1()
    - [x86] resctrl: Fix memory bandwidth counter width for Hygon
    - [x86] resctrl: Add missing resctrl initialization for Hygon
    - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
    - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
      (CVE-2026-23049)
    - [x86] drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
    - [armhf] dmaengine: at_hdmac: fix device leak on of_dma_xlate()
      (CVE-2025-71191)
    - [arm64] dmaengine: bcm-sba-raid: fix device leak on probe
      (CVE-2025-71190)
    - [armhf] dmaengine: ti: dma-crossbar: fix device leak on dra7x route
      allocation
    - [armhf] dmaengine: ti: dma-crossbar: fix device leak on am335x route
      allocation (CVE-2025-71185)
    - [arm64] dmaengine: ti: k3-udma: fix device leak on udma lookup
    - btrfs: fix deadlock in wait_current_trans() due to ignored transaction
      type (CVE-2025-71194)
    - macvlan: Fix leaking skb in source mode with nodst option
    - posix-clock: introduce posix_clock_context concept
    - Fix memory leak in posix_clock_open()
    - posix-clock: Store file pointer in struct posix_clock_context
    - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
    - net: usb: dm9601: remove broken SR9700 support
    - sctp: sm_statefuns: Fix spelling mistakes
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
    - amd-xgbe: avoid misleading per-packet error log
    - gue: Fix skb memleak with inner IP protocol 0. (CVE-2026-23095)
    - netlink: add a proto specification for FOU
    - net: fou: use policy and operation tables generated from the spec
    - fou: Don't allow 0 for FOU_ATTR_IPPROTO. (CVE-2026-23083)
    - l2tp: avoid one data-race in l2tp_tunnel_del_work()
    - ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
    - net/sched: Enforce that teql can only be used as root qdisc
      (CVE-2026-23074)
    - net/sched: qfq: Use cl_is_active to determine whether class is active in
      qfq_rm_from_ag (CVE-2026-23105)
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN
      spec (CVE-2026-23060)
    - [i386] comedi: dmm32at: serialize use of paged registers
    - w1: fix redundant counter decrement in w1_attach_slave_device()
    - [x86] Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
    - [x86] Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
    - [x86] scsi: storvsc: Process unsupported MODE_SENSE_10
    - regmap: Fix race condition in hwspinlock irqsave routine (CVE-2026-23071)
    - scsi: core: Wake up the error handler when final completions race against
      each other (CVE-2026-23110)
    - ALSA: usb: Increase volume range that triggers a warning
    - [arm64] net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
    - [arm64] net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
    - [x86] mISDN: annotate data-race around dev->work
    - usbnet: limit max_mtu based on device's hard_mtu
    - drm/amd/pm: Don't clear SI SMC table when setting power limit
    - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
      (CVE-2026-23084)
    - bonding: provide a net pointer to __skb_flow_dissect()
    - net/sched: act_ife: avoid possible NULL deref (CVE-2026-23064)
    - leds: led-class: Only Add LED to leds_list when it is fully ready
      (CVE-2026-23101)
    - of: fix reference count leak in of_alias_scan()
    - iio: adc: ad9467: fix ad9434 vref mask
    - [armhf] iio: adc: at91-sama5d2_adc: Fix potential use-after-free in
      sama5d2_adc driver (CVE-2025-71199)
    - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling
      (CVE-2026-23076)
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
      (CVE-2026-23089)
    - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
    - wifi: ath10k: fix dma_free_coherent() pointer
    - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
    - wifi: rsi: Fix memory corruption due to not set vif driver data size
      (CVE-2026-23073)
    - slimbus: core: fix runtime PM imbalance on report present
    - slimbus: core: fix device reference leak on report present
      (CVE-2026-23090)
    - [x86] intel_th: fix device leak on output open() (CVE-2026-23091)
    - uacce: fix cdev handling in the cleanup path (CVE-2026-23096)
    - uacce: implement mremap in uacce_vm_ops to return -EPERM (CVE-2026-23056)
    - uacce: ensure safe queue release with state management (CVE-2026-23063)
    - netrom: fix double-free in nr_route_frame() (CVE-2026-23098)
    - [x86] perf/x86/intel: Do not enable BTS for guests
    - [armhf] irqchip/gic-v3-its: Avoid truncating memory addresses
      (CVE-2026-23085)
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
      (CVE-2026-23058)
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
      (CVE-2026-23061)
    - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
      (CVE-2026-23080)
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
      (CVE-2026-23108)
    - migrate: correct lock ordering for hugetlb file folios (CVE-2026-23097)
    - bpf: Do not let BPF test infra emit invalid GSO types to stack
      (CVE-2025-68725)
    - bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)
    - fbdev: fbcon: Properly revert changes when vc_resize() failed
    - fbdev: fbcon: release buffer when fbcon_do_set_font() failed
    - fbcon: always restore the old font data in fbcon_do_set_font()
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
    - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
    - [arm*] net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
    - rocker: fix memory leak in rocker_world_port_post_fini()
    - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
    - ice: stop counting UDP csum mismatch as rx_errors
    - net/mlx5: Add HW definitions of vport debug counters
    - net/mlx5e: Expose rx_oversize_pkts_buffer counter
    - net/mlx5e: Report rx_discards_phy via rx_dropped
    - net/mlx5e: Account for netdev stats in ndo_get_stats64
    - nfc: nci: Fix race between rfkill and nci_unregister_device().
    - net: bridge: fix static key check
    - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
    - dma/pool: distinguish between missing and exhausted atomic pools
    - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
    - net/sched: act_ife: convert comma to semicolon
    - nvme-fc: rename free_ctrl callback to match name pattern
    - nvme-pci: do not directly handle subsys reset fallout
    - nvme: fix PCIe subsystem reset controller state transition
    - xfs: set max_agbno to allow sparse alloc of last full inode chunk
    - [armhf] dmaengine: stm32: dmamux: fix OF node leak on route allocation
      failure
    - [armhf] dmaengine: stm32: dmamux: fix device leak on route allocation
      (CVE-2025-71186)
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
      (CVE-2026-23087)
    - w1: w1_therm: use swap() to make code cleaner
    - w1: therm: Fix off-by-one buffer overflow in alarms_store
      (CVE-2025-71197)
    - [x86] mei: trace: treat reg parameter as string
    - driver core: fix potential null-ptr-deref in device_add()
      (CVE-2023-54321)
    - mm/pagewalk: add walk_page_range_vma()
    - ksm: use range-walk function to jump over holes in
      scan_get_next_rmap_item (CVE-2025-68211)
    - drm/amdkfd: fix a memory leak in device_queue_manager_init()
    - comedi: Fix getting range information for subdevices 16 to 255
    - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
      (CVE-2026-23075)
    - of: platform: Use default match table for /firmware
    - ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)
    - netfilter: nf_tables: typo NULL check in _clone() function
    - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
    - [arm*] pinctrl: meson: mark the GPIO controller as sleeping
    - HID: uclogic: Correct devm device reference for hidinput input_dev name
      (CVE-2023-54207)
    - HID: uclogic: Add NULL check in uclogic_input_configured()

  [ Ben Hutchings ]
  * [rt] Update to 5.10.247-rt141

  [ Bastian Blank ]
  * Only include all dpkg default.mk in rules.real

 -- Ben Hutchings <benh@debian.org>  Tue, 10 Feb 2026 18:16:32 +0100

linux (5.10.247-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.245
    - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
      (CVE-2025-23143)
    - mtd: Add check for devm_kcalloc()
    - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
    - NFSv4: Don't clear capabilities that won't be reset
    - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
    - tracing: Fix tracing_marker may trigger page fault during preempt_disable
    - NFSv4/flexfiles: Fix layout merge mirror check.
    - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate
      psock->cork. (CVE-2025-39913)
    - compiler.h: drop fallback overflow checkers
    - overflow: Allow mixed type arguments
    - EDAC/altera: Delete an inappropriate dma_free_coherent() call
    - ocfs2: fix recursive semaphore deadlock in fiemap call (CVE-2025-39885)
    - [armhf] mtd: rawnand: stm32_fmc2: fix ECC overwrite
    - fuse: check if copy_file_range() returns larger than requested size
    - fuse: prevent overflow in copy_file_range return value
    - mm/khugepaged: fix the address passed to notifier on testing young
    - [armhf] mtd: rawnand: stm32_fmc2: Fix dma_map_sg error check
    - [armhf] mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC
      buffer (CVE-2025-39907)
    - [x86] Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk
      table
    - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
    - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
    - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
    - [arm*] net: fec: Fix possible NPD in
      fec_enet_phy_reset_after_clk_enable() (CVE-2025-39876)
    - tunnels: reset the GSO metadata before reusing the skb
    - igb: fix link test skipping when interface is admin down
    - genirq/affinity: Add irq_update_affinity_desc()
    - genirq: Export affinity setter for modules
    - genirq: Provide new interfaces for affinity hints
    - i40e: Use irq_update_affinity_hint()
    - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
      (CVE-2025-39911)
    - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when
      j1939_local_ecu_get() failed
    - can: j1939: j1939_local_ecu_get(): undo increment when
      j1939_local_ecu_get() fails
    - [armhf] dmaengine: ti: edma: Fix memory allocation size for
      queue_priority_map (CVE-2025-39869)
    - [arm*] dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/
      ees (CVE-2025-39923)
    - [armhf] phy: ti-pipe3: fix device leak at unbind
    - [arm64] soc: qcom: mdt_loader: Deal with zero e_shentsize
    - [x86] drm/i915/power: fix size for for_each_set_bit() in abox iteration
    - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison
      memory (CVE-2025-39883)
    - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is
      not supported
    - wifi: mac80211: fix incorrect type for ret
    - cgroup: split cgroup_destroy_wq into 3 workqueues (CVE-2025-39953)
    - um: virtio_uml: Fix use-after-free after put_device in probe
      (CVE-2025-39951)
    - qed: Don't collect too many protection override GRC elements
      (CVE-2025-39949)
    - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
    - i40e: remove redundant memory barrier when cleaning Tx descs
    - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (CVE-2025-39955)
    - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
    - net: liquidio: fix overflow in octeon_init_instr_queue()
    - cnic: Fix use-after-free bugs in cnic_delete_task (CVE-2025-39945)
    - power: supply: bq27xxx: fix error return in case of no bq27000 hdq
      battery
    - power: supply: bq27xxx: restrict no-battery detection to bq27000
    - [armhf] mmc: mvsdio: Fix dma_unmap_sg() nents value
    - [x86] KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is
      active
    - rds: ib: Increment i_fastreg_wrs before bailing out
    - [x86] ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
      message
    - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
    - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
      (CVE-2025-39964)
    - usb: gadget: dummy_hcd: remove usage of list iterator past the loop body
    - [rt] USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
    - [armhf] phy: ti: convert to devm_platform_ioremap_resource(_byname)
    - phy: Use device_get_match_data()
    - [armhf] phy: ti: omap-usb2: fix device leak at unbind
    - net: rfkill: gpio: add DT support
    - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
      (CVE-2025-39937)
    - btrfs: tree-checker: fix the incorrect inode ref size check
    - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
    - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
    - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
    - usb: core: Add 0x prefix to quirks debug output
    - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
    - [arm64] dts: imx8mp: Correct thermal sensor index
    - cpufreq: Initialize cpufreq-based invariance before subsys
    - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
      (CVE-2025-39987)
    - [armhf] can: sun4i_can: populate ndo_change_mtu() to prevent buffer
      overflow (CVE-2025-39986)
    - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
      (CVE-2025-39985)
    - can: peak_usb: fix shift-out-of-bounds issue (CVE-2025-40020)
    - bnxt_en: correct offset handling for IPv6 destination address
    - nexthop: Pass extack to nexthop notifier
    - rtnetlink: Add RTNH_F_TRAP flag
    - nexthop: Emit a notification when a nexthop is added
    - nexthop: Emit a notification when a single nexthop is replaced
    - nexthop: Forbid FDB status change while nexthop is in a group
      (CVE-2025-39980)
    - [x86] drm/gma500: Fix null dereference in hdmi teardown (CVE-2025-40011)
    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
      (CVE-2025-40022)
    - i40e: fix idx validation in i40e_validate_queue_map (CVE-2025-39972)
    - i40e: fix input validation logic for action_meta (CVE-2025-39970)
    - i40e: add max boundary check for VF filters (CVE-2025-39968)
    - i40e: add mask to apply valid bits for itr_idx
    - tracing: dynevent: Add a missing lockdown check on dynevent
      (CVE-2025-40021)
    - fbcon: fix integer overflow in fbcon_do_set_font (CVE-2025-39967)
    - fbcon: Fix OOB access in font allocation
    - mm/migrate_device: don't add folio to be freed to LRU in
      migrate_device_finalize() (CVE-2025-21861)
    - i40e: increase max descriptors for XL710
    - i40e: add validation for ring_len param (CVE-2025-39973)
    - i40e: fix idx validation in config queues msg (CVE-2025-39971)
    - i40e: fix validation of VF state in get resources (CVE-2025-39969)
    - mm/hugetlb: fix folio is still mapped when deleted (CVE-2025-40006)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.246
    - scsi: target: target_core_configfs: Add length check to avoid buffer
      overflow (CVE-2025-39998)
    - media: b2c2: Fix use-after-free causing by irq_check_work in
      flexcop_pci_remove (CVE-2025-39996)
    - media: rc: fix races with imon_disconnect() (CVE-2025-39993)
    - udp: Fix memory accounting leak. (CVE-2025-22058)
    - media: tunner: xc5000: Refactor firmware load
    - media: tuner: xc5000: Fix use-after-free in xc5000_release
      (CVE-2025-39994)
    - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in
      probe (CVE-2025-39995)
    - USB: serial: option: add SIMCom 8230C compositions
    - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
    - dm-integrity: limit MAX_TAG_SIZE to 255
    - perf subcmd: avoid crash in exclude_cmds when excludes is empty
    - hid: fix I2C read buffer overflow in raw_event() for mcp2221
    - driver core/PM: Set power.no_callbacks along with power.no_pm
    - drm/amd/display: Remove redundant safeguards for dmub-srv destroy()
    - drm/amd/display: Fix potential null dereference (CVE-2023-53498)
    - crypto: rng - Ensure set_ent is always present (CVE-2025-40109)
    - filelock: add FL_RECLAIM to show_fl_flags() macro
    - [arm64] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
      (CVE-2025-40081)
    - [x86] vdso: Fix output operand size of RDPID
    - regmap: Remove superfluous check for !config in __regmap_init()
    - libbpf: Fix reuse of DEVMAP
    - ACPI: processor: idle: Fix memory leak when register cpuidle device
      failed
    - [arm64] pinctrl: meson-gxl: add missing i2c_d pinmux
    - blk-mq: check kobject state_in_sysfs before deleting in
      blk_mq_unregister_hctx (CVE-2025-40125)
    - block: use int to store blk_stack_limits() return value
    - PM: sleep: core: Clear power.must_resume in noirq suspend error path
    - [armhf] pwm: tiehrpwm: Fix corner case in clock divisor calculation
    - bpf: Explicitly check accesses to bpf_sock_addr (CVE-2025-40078)
    - i2c: designware: Add disabling clocks when probe fails
    - drm/radeon/r600_cs: clean up of dead code in r600_cs
    - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
      (CVE-2025-40116)
    - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (CVE-2025-40118)
    - [x86] scsi: myrs: Fix dma_alloc_coherent() error check
    - media: rj54n1cb0c: Fix memleak in rj54n1_probe()
    - ALSA: lx_core: use int type to store negative error codes
    - drm/amdgpu: Power up UVD 3 for FW validation (v2)
    - wifi: mwifiex: send world regulatory domain to driver
    - tcp: fix __tcp_close() to only send RST when required
    - [armhf] usb: phy: twl6030: Fix incorrect type for ret
    - usb: gadget: configfs: Correctly set use_os_string at bind
    - pps: fix warning in pps_register_cdev when register device fail
      (CVE-2025-40070)
    - [x86] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
    - [x86] ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
      (CVE-2025-40154)
    - [x86] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
      (CVE-2025-40121)
    - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
    - netfilter: ipset: Remove unused htable_bits in macro ahash_region
    - drivers/base/node: handle error properly in register_one_node()
    - RDMA/cm: Rate limit destroy CM ID timeout error message
    - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
    - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
    - RDMA/core: Resolve MAC of next-hop device without ARP support
    - IB/sa: Fix sa_local_svc_timeout_ms read race
    - NFSv4.1: fix backchannel max_resp_sz verification check
    - ipvs: Defer ip_vs_ftp unregister during netns cleanup (CVE-2025-40018)
    - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
      (CVE-2025-40115)
    - usb: vhci-hcd: Prevent suspending virtually attached devices
    - RDMA/siw: Always report immediate post SQ errors
    - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
      (CVE-2025-40140)
    - Bluetooth: MGMT: Fix not exposing debug UUID on
      MGMT_OP_READ_EXP_FEATURES_INFO
    - [armhf] hwrng: ks-sa - fix division by zero in ks_sa_rng_init
      (CVE-2025-40127)
    - ocfs2: fix double free in user_cluster_connect() (CVE-2025-40055)
    - drivers/base/node: fix double free in register_one_node()
    - nfp: fix RSS hash key size when RSS is not supported
    - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not
      configurable
    - net: dlink: handle copy_thresh allocation failure (CVE-2025-40053)
    - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (regression in
      5.10.242)
    - Squashfs: fix uninit-value in squashfs_get_parent (CVE-2025-40049)
    - [x86] uio_hv_generic: Let userspace take care of interrupt mask
      (CVE-2025-40048)
    - [arm*] mfd: vexpress-sysreg: Check the return value of
      devm_gpiochip_add_data()
    - mm: hugetlb: avoid soft lockup when mprotect to large memory area
      (CVE-2025-40153)
    - Input: atmel_mxt_ts - allow reset GPIO to sleep
    - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info
      leak (CVE-2025-40035)
    - pinctrl: check the return value of pinmux_ops::get_function_name()
      (CVE-2025-40030)
    - [arm64] bus: fsl-mc: Check return value of platform_get_resource()
      (CVE-2025-40029)
    - fs: always return zero on success from replace_fd()
    - clocksource/drivers/clps711x: Fix resource leaks in error paths
    - libperf event: Ensure tracing data is multiple of 8 sized
    - perf util: Fix compression checks returning -1 as bool
    - perf session: Fix handling when buffer exceeds 2 GiB
    - scsi: libsas: Add sas_task_find_rq()
    - scsi: mvsas: Delete mvs_tag_init()
    - scsi: mvsas: Use sas_task_find_rq() for tagging
    - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (CVE-2025-40001)
    - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
    - [x86] drm/vmwgfx: Fix Use-after-free in validation (CVE-2025-40111)
    - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
      (CVE-2025-40187)
    - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
      (CVE-2025-40186)
    - [arm*] net: fsl_pq_mdio: Fix device node reference leak in
      fsl_pq_mdio_probe
    - [arm64] mailbox: zynqmp-ipi: Remove redundant
      mbox_controller_unregister() call
    - [arm64] mailbox: zynqmp-ipi: Remove dev.parent check in
      zynqmp_ipi_free_mboxes
    - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (CVE-2025-40183)
    - drm/amdgpu: Add additional DCE6 SCL registers
    - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
    - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
    - drm/amd/display: Properly disable scaling on DCE6
    - crypto: essiv - Check ssize for decryption and in-place encryption
      (CVE-2025-40019)
    - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
    - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
    - [arm64] dts: qcom: msm8916: Add missing MDSS reset
    - [armhf] OMAP2+: pm33xx-core: ix device node reference leaks in
      amx3_idle_init
    - xen/events: Cleanup find_virq() return codes
    - xen/manage: Fix suspend error path
    - [arm64] firmware: meson_sm: fix device leak at probe
    - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
    - [armhf,i386] copy_sighand: Handle architectures where sizeof(unsigned
      long) < sizeof(u64)
    - [x86] cpufreq: intel_pstate: Fix object lifecycle issue in
      update_qos_request() (CVE-2025-40194)
    - iio: dac: ad5360: use int type to store negative error codes
    - iio: dac: ad5421: use int type to store negative error codes
    - init: handle bootloader identifier in kernel parameters
    - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in
      resume
    - lib/genalloc: fix device leak in of_gen_pool_get()
    - openat2: don't trigger automounts with RESOLVE_NO_XDEV
    - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
    - sctp: Fix MAC comparison to be constant-time (CVE-2025-40204)
    - mmc: core: SPI mode remove cmd7
    - [armhf] memory: samsung: exynos-srom: Fix of_iomap leak in
      exynos_srom_probe
    - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
    - rtc: interface: Fix long-standing race when setting alarm
    - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
      (CVE-2025-40219)
    - PCI/ERR: Fix uevent on failure to recover
    - PCI/AER: Fix missing uevent on recovery when a reset is requested
    - PCI/AER: Support errors introduced by PCIe r6.0
    - [x86] umip: Check that the instruction opcode is at least two bytes
    - [x86] umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT
      aliases)
    - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
    - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
    - ext4: increase i_disksize to offset + len in
      ext4_update_disksize_before_punch()
    - ext4: correctly handle queries for metadata mappings
    - ext4: guard against EA inode refcount underflow in xattr update
      (CVE-2025-40190)
    - [arm64] dts: qcom: sdm845: Fix slimbam num-channels/ees
    - tracing: Fix race condition in kprobe initialization causing NULL pointer
      dereference (CVE-2025-40042)
    - dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)
    - [x86] mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config
      max_register value
    - [x86] mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for
      cache_type
    - [x86] mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config
      flag
    - media: mc: Clear minor number before put device (CVE-2025-40197)
    - Squashfs: add additional inode sanity checking
    - Squashfs: reject negative file sizes in squashfs_read_inode()
      (CVE-2025-40200)
    - udf: fix uninit-value use in udf_get_fileshortad (CVE-2024-50143)
    - fs: udf: fix OOB read in lengthAllocDescs handling (CVE-2025-40044)
    - [x86] KVM: x86: Don't (re)check L1 intercepts when completing userspace
      I/O (CVE-2025-40026)
    - net/9p: fix double req put in p9_fd_cancelled (CVE-2025-40027)
    - minixfs: Verify inode mode when loading from disk
    - pid: Add a judgment for ns null in pid_nr_ns (CVE-2025-40178)
    - fs: Add 'initramfs_options' to set initramfs mount options
    - cramfs: Verify inode mode when loading from disk
    - locking: Introduce __cleanup() based infrastructure
    - fscontext: do not consume log entries when returning -EMSGSIZE
    - [arm64] mte: Do not flag the zero page as PG_mte_tagged
    - overflow, tracing: Define the is_signed_type() macro once
    - btrfs: remove duplicated in_range() macro
    - Update <linux/minmax.h> to the version in 6.17
    - media: pci/ivtv: switch from 'pci_' to 'dma_' API
    - media: pci: ivtv: Add missing check after DMA map
    - media: cx18: Add missing check after DMA map
    - media: pci: ivtv: Add check for DMA map result
    - mm/slab: make __free(kfree) accept error pointers
    - wifi: rt2x00: use explicitly signed or unsigned types
    - jbd2: ensure that all ongoing I/O complete before freeing blocks
    - ext4: detect invalid INLINE_DATA + EXTENTS flag combination
      (CVE-2025-40167)
    - [arm*] pwm: berlin: Fix wrong register in suspend/resume (CVE-2025-40188)
    - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
      (CVE-2025-40205)
    - bus: mhi: host: Do not use uninitialized 'dev' pointer in
      mhi_init_irq_setup()
    - media: rc: Directly use ida_free()
    - media: lirc: Fix error handling in lirc_register()
    - xen/events: Update virq_to_irq on migration
    - HID: multitouch: fix sticky fingers
    - iomap: add the new iomap_iter model
    - fsdax: switch dax_iomap_rw to use iomap_iter
    - dax: skip read lock assertion for read-only filesystems
    - net: dlink: handle dma_map_single() failure properly
    - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
    - net/ip6_tunnel: Prevent perpetual tunnel growth (CVE-2025-40173)
    - amd-xgbe: Avoid spurious link down messages during interface toggle
    - tcp: fix tcp_tso_should_defer() vs large RTT
    - tg3: prevent use of uninitialized remote_adv and local_adv variables
    - net: usb: use eth_hw_addr_set() instead of ether_addr_copy()
    - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
    - net: usb: lan78xx: fix use of improperly initialized dev->chipid in
      lan78xx_reset
    - drm/amd/powerplay: Fix CIK shutdown temperature
    - sched/fair: Trivial correction of the newidle_balance() comment
    - sched/balancing: Rename newidle_balance() => sched_balance_newidle()
    - sched/fair: Fix pelt lost idle time detection
    - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
      (CVE-2025-40088)
    - exec: Fix incorrect type for ret
    - hfs: clear offset and space out of valid records in b-tree node
    - hfs: make proper initalization of struct hfs_find_data
    - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
      (CVE-2025-40244)
    - hfs: validate record offset in hfsplus_bmap_alloc
    - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
    - dlm: check for defined force value in dlm_lockspace_release
    - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
      (CVE-2025-40243)
    - hfsplus: return EIO when type of hidden directory mismatch in
      hfsplus_fill_super()
    - net: rtnetlink: add msg kind names
    - net: rtnetlink: add helper to extract msg type's kind
    - net: rtnetlink: use BIT for flag values
    - net: netlink: add NLM_F_BULK delete request modifier
    - net: rtnetlink: add bulk delete support flag
    - net: add ndo_fdb_del_bulk
    - net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
    - rtnetlink: Allow deleting FDB entries in user namespace
    - [arm64] net: enetc: correct the value of ENETC_RXB_TRUESIZE
    - [arm64] dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
    - [arm64] mm: avoid always making PTE dirty in pte_mkwrite()
    - sctp: avoid NULL dereference when chunk data buffer is missing
      (CVE-2025-40240)
    - net: bonding: fix possible peer notify event loss or dup issue
    - Revert "cpuidle: menu: Avoid discarding useful information"
    - ocfs2: clear extent cache after moving/defragmenting extents
      (CVE-2025-40233)
    - net: usb: rtl8150: Fix frame padding
    - USB: serial: option: add UNISOC UIS7720
    - USB: serial: option: add Quectel RG255C
    - USB: serial: option: add Telit FN920C04 ECM compositions
    - usb/core/quirks: Add Huawei ME906S to wakeup quirk
    - binder: remove "invalid inc weak" check
    - comedi: fix divide-by-zero in comedi_buf_munge() (CVE-2025-40106)
    - [x86] mei: me: add wildcat lake P DID
    - most: usb: Fix use-after-free in hdm_disconnect (CVE-2025-40223)
    - most: usb: hdm_probe: Fix calling put_device() before device
      initialization
    - serial: 8250_exar: add support for Advantech 2 port card with Device ID
      0x0018
    - [arm64] cputype: Add Neoverse-V3AE definitions
    - [arm64] errata: Apply workarounds for Neoverse-V3AE
    - vsock: fix lock inversion in vsock_assign_transport() (CVE-2025-40231)
    - padata: Reset next CPU when reorder sequence wraps around
    - iio: imu: inv_icm42600: use = { } instead of memset()
    - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
    - PM: runtime: Add new devm functions
    - iio: imu: inv_icm42600: Simplify pm_runtime setup
    - NFSD: Rework encoding and decoding of nfsd4_deviceid
    - NFSD: Minor cleanup in layoutcommit processing
    - NFSD: Fix last write offset handling in layoutcommit
    - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
    - PCI: Add sysfs attribute for device power state
    - PCI/sysfs: Use sysfs_emit() and sysfs_emit_at() in "show" functions
    - PCI/sysfs: Ensure devices are powered for config reads
    - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
      (CVE-2025-40198)
    - drm/amdgpu: use atomic functions with memory barriers for vm fault info
    - vfs: Don't leak disconnected dentries on umount (CVE-2025-40105)
    - NFSD: Define a proc_layoutcommit for the FlexFiles layout type
      (CVE-2025-40087)
    - fuse: fix livelock in synchronous file put from fuseblk workers
      (CVE-2025-40220)
    - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
    - net: rtnetlink: fix module reference count leak issue in
      rtnetlink_rcv_msg
    - fsdax: Fix infinite loop in dax_iomap_rw()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.247
    - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083)
    - [x86] bugs: Fix reporting of LFENCE retpoline
    - btrfs: always drop log root tree reference in btrfs_replay_log()
    - btrfs: use smp_mb__after_atomic() when forcing COW in
      create_pending_snapshot()
    - NFSD: Fix crash in nfsd4_read_release() (CVE-2025-40324) (regression in
      5.10.220)
    - net: usb: asix_devices: Check return value of usbnet_get_endpoints
    - [x86] fbdev: atyfb: Check if pll_ops->init_pll failed
    - [x86] ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
      (CVE-2025-40211)
    - fbdev: bitblit: bound-check glyph index in bit_putcs* (CVE-2025-40322)
    - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP
      Mode (CVE-2025-40321)
    - wifi: ath10k: Fix memory leak on unsupported WMI command
    - [arm64] drm/msm/a6xx: Fix GMU firmware parser
    - ALSA: usb-audio: fix control pipe direction
    - bpf: Sync pending IRQ work before freeing ring buffer (CVE-2025-40319)
    - usbnet: Prevents free active kevent (regression in 5.10.137)
    - [armhf] drm/etnaviv: fix flush sequence logic
    - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
    - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
    - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
    - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
    - regmap: slimbus: fix bus_context pointer in regmap init calls
      (CVE-2025-40317)
    - net: phy: dp83867: Disable EEE support as not implemented
    - xfs: always warn about deprecated mount options
    - devcoredump: Fix circular locking dependency with devcd->mutex.
      (regression in 5.10.204)
    - can: gs_usb: increase max interface to U8_MAX
    - serial: 8250_dw: Use devm_add_action_or_reset()
    - serial: 8250_dw: handle reset control deassert error
    - [x86] resctrl: Fix miscount of bandwidth event when reactivating
      previously unavailable RMID
    - [x86] boot: Compile boot code with -std=gnu11 too
    - arch: back to -std=gnu89 in < v5.18
    - tracing: fix declaration-after-statement warning
    - usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
      (CVE-2025-40315)
    - block: make REQ_OP_ZONE_OPEN a write operation
    - bpf: Don't use %pK through printk
    - [arm*] pinctrl: single: fix bias pull up/down handling in pin_config_set
    - memstick: Add timeout to prevent indefinite waiting
    - [x86] ACPI: video: force native for Lenovo 82K8
    - [i386] cpufreq/longhaul: handle NULL policy in longhaul_exit
    - [arm*] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
    - [arm64] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
    - ACPICA: dispatcher: Use acpi_ds_clear_operands() in
      acpi_ds_call_control_method()
    - [arm64] tee: allow a driver to allocate a tee_device without a pool
    - nvme-fc: use lock accessing port_state and rport state (CVE-2025-40342)
    - [arm64] video: backlight: lp855x_bl: Set correct EPROM start for LP8556
    - cpuidle: Fail cpuidle device registration if there is one already
    - uprobe: Do not emulate/sstep original instruction when ip is changed
    - [x86] hwmon: (dell-smm) Add support for Dell OptiPlex 7040
    - tools/cpupower: Fix incorrect size in cpuidle_state_disable()
    - [x86] tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
    - [x86] tools/power x86_energy_perf_policy: Enhance HWP enable
    - [x86] tools/power x86_energy_perf_policy: Prefer driver HWP limits
    - [armhf] mfd: stmpe: Remove IRQ domain upon removal
    - [armhf] mfd: stmpe-i2c: Add missing MODULE_LICENSE
    - drm/amd/pm: Use cached metrics data on arcturus
    - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
    - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
    - [i386] PCI: Disable MSI on RDC PCI to PCIe bridges
    - [amd64] drm/amdkfd: return -ENOTTY for unsupported IOCTLs
    - media: pci: ivtv: Don't create fake v4l2_fh
    - [amd64] vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
    - net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
    - bridge: Redirect to backup port when port is administratively down
    - net: ipv6: fix field-spanning memcpy warning in AH output
    - media: imon: make send_packet() more robust
    - [armhf] drm/bridge: display-connector: don't set OP_DETECT for
      DisplayPorts
    - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
    - char: misc: Does not request module for miscdevice with dynamic minor
    - net: When removing nexthops, don't call synchronize_net if it is not
      necessary
    - net: Call trace_sock_exceed_buf_limit() for memcg failure with
      SK_MEM_RECV.
    - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
    - rds: Fix endianness annotation for RDS_MPATH_HASH
    - scsi: pm80xx: Fix race condition caused by static variables
    - [amd64] drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
    - media: fix uninitialized symbol warnings
    - scsi: pm8001: Use int instead of u32 to store error codes
    - [arm*] dmaengine: mv_xor: match alloc_wc and free_wc
    - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
    - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
    - ALSA: usb-audio: apply quirk for MOONDROP Quark2
    - net: call cond_resched() less often in __release_sock()
    - [amd64] iommu/amd: Skip enabling command/event buffers for kdump
    - usb: gadget: f_hid: Fix zero length packet transfer
    - net: phy: marvell: Fix 88e1510 downshift counter errata
    - media: redrat3: use int type to store negative error codes
    - [x86] kvm: Prefer native qspinlock for dedicated vCPUs irrespective of
      PV_UNHALT
    - udp_tunnel: use netdev_warn() instead of netdev_WARN()
    - net/cls_cgroup: Fix task_get_classid() during qdisc run
    - scsi: lpfc: Define size of debugfs entry for xri rebalancing
    - allow finish_no_open(file, ERR_PTR(-E...))
    - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
    - [arm*] usb: xhci: plat: Facilitate using autosuspend for xhci plat
      devices
    - ipv6: np->rxpmtu race annotation
    - jfs: Verify inode mode when loading from disk (CVE-2025-40312)
    - jfs: fix uninitialized waitqueue in transaction manager
    - wifi: ath10k: Fix connection after GTK rekeying
    - r8169: set EEE speed down ratio to 1
    - NFSv4: handle ERR_GRACE on delegation recalls
    - NFSv4.1: fix mount hang after CREATE_SESSION failure
    - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
      dereferencing
    - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
    - [arm64] net: macb: avoid dealing with endianness in macb_set_hwaddr()
    - Bluetooth: SCO: Fix UAF on sco_conn_free (CVE-2025-40309)
    - Bluetooth: bcsp: receive data only if registered (CVE-2025-40308)
    - ALSA: usb-audio: add mono main switch to Presonus S1824c
    - exfat: limit log print for IO error
    - page_pool: Clamp pool size to max 16K pages
    - orangefs: fix xattr related buffer overflow... (CVE-2025-40306)
    - ACPICA: Update dsmethod.c to get rid of unused variable warning
    - btrfs: mark dirty extent range for out of bound prealloc extents
    - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/
      symlink
    - 9p: fix /sys/fs/9p/caches overwriting itself
    - 9p: sysfs_init: don't hardcode error to ENOMEM
    - ACPI: property: Return present device nodes only on fwnode interface
    - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
      (CVE-2025-40304)
    - ceph: add checking of wait_for_completion_killable() return value
    - [x86] ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot
      again (regression in 5.10.231)
    - net: vlan: sync VLAN features with lower device
    - [armhf] net: dsa: b53: fix resetting speed and pause on forced link
    - [armhf] net: dsa: b53: fix enabling ip multicast
    - [armhf] net: dsa: b53: stop reading ARL entries if search is done
    - sctp: Hold RCU read lock while iterating over address list
    - sctp: Prevent TOCTOU out-of-bounds write (CVE-2025-40331)
    - net: sctp: Fix some typos
    - net: Use nlmsg_unicast() instead of netlink_unicast()
    - sctp: hold endpoint before calling cb in sctp_transport_lookup_process
    - sctp: Hold sock lock while iterating over address list
    - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
    - tracing: Fix memory leaks in create_field_var()
    - NFS4: Fix state renewals missing after boot
    - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
    - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
    - [arm*] net: fec: correct rx_bytes statistic for the case SHIFT16 is set
    - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
      (CVE-2025-40283)
    - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
      (CVE-2025-40282)
    - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
    - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
    - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
      (CVE-2025-40281)
    - net/smc: fix mismatch between CLC header and proposal
    - tipc: Fix use-after-free in tipc_mon_reinit_self(). (CVE-2025-40280)
    - net: mdio: fix resource leak in mdiobus_register_device()
    - wifi: mac80211: skip rate verification for not captured PSDUs
    - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-
      infoleak (CVE-2025-40278)
    - net/mlx5e: Fix maxrate wraparound in threshold between units
    - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
    - net_sched: limit try_bulk_dequeue_skb() batches
    - Bluetooth: L2CAP: export l2cap_chan_hold for modules
    - acpi,srat: Fix incorrect device handle check for Generic Initiator
    - regulator: fixed: use dev_err_probe for register
    - regulator: fixed: fix GPIO descriptor leak on register failure
    - [x86] drm/vmwgfx: Validate command header size against
      SVGA_CMD_MAX_DATASIZE (CVE-2025-40277)
    - ALSA: usb-audio: Fix NULL pointer dereference in
      snd_usb_mixer_controls_badd (CVE-2025-40275)
    - fsdax: mark the iomap argument to dax_iomap_sector as const
    - mm/ksm: fix flag-dropping behavior in ksm_madvise
    - netfilter: nf_tables: reject duplicate device on updates (CVE-2025-38678)
    - HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
    - NFSD: free copynotify stateid in nfs4_free_ol_stateid() (CVE-2025-40273)
    - strparser: Fix signed/unsigned mismatch bug
    - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
      (regression in 5.10.65)
    - fs/proc: fix uaf in proc_readdir_de() (CVE-2025-40271)
    - spi: Try to get ACPI GPIO IRQ earlier (regression in 5.10.231)
    - [x86] isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
    - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (regression
      in 5.10.240) (Closes: #1114557)
    - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
    - be2net: pass wrb_params in case of OS2BMC (CVE-2025-40264)
    - Input: cros_ec_keyb - fix an invalid memory access (CVE-2025-40263)
    - [arm*] Input: imx_sc_key - fix memory corruption on unload
      (CVE-2025-40262)
    - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
      (CVE-2025-40261)
    - scsi: sg: Do not sleep in atomic context (CVE-2025-40259)
    - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
    - [arm*] drm/tegra: dc: Fix reference leak in tegra_dc_couple()
      (regression in 5.10.28)
    - net: openvswitch: remove never-working support for setting nsh fields
      (CVE-2025-40254)
    - vsock: Ignore signal/timeout on connect() if already established
      (CVE-2025-40248)
    - scsi: core: Fix a regression triggered by scsi_host_busy()
    - kconfig/mconf: Initialize the default locale at startup
    - kconfig/nconf: Initialize the default locale at startup
    - mm/mm_init: fix hash table order logging in alloc_large_system_hash()
    - ALSA: usb-audio: fix uac2 clock source at terminal parser
    - [x86] uio_hv_generic: Set event for all channels on the device
    - Makefile.compiler: replace cc-ifversion with compiler-specific macros
    - Revert "NFS: Don't set NFS_INO_REVAL_PAGECACHE in the inode cache
      validity" (regression in 5.10.241)
    - net: netpoll: fix incorrect refcount handling causing incorrect cleanup
    - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
      (CVE-2025-40269)
    - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_remove
    - ata: libata-scsi: Fix system suspend for a security locked drive
      (regression in 5.10.241)
    - mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)
    - mptcp: fix a race in mptcp_pm_del_add_timer() (CVE-2025-40257)
    - usb: deprecate the third argument of usb_maxpacket()
    - Input: remove third argument of usb_maxpacket()
    - Input: pegasus-notetaker - fix potential out-of-bounds access
    - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
    - Bluetooth: SMP: Fix not generating mackey and ltk when repairing
    - net: aquantia: Add missing descriptor cache invalidation on ATL2
    - net/mlx5e: Fix validation logic in rate limiting
    - net: atlantic: fix fragment overflow handling in RX path
    - [x86] Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
    - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
    - atm/fore200e: Fix possible data race in fore200e_open()
    - can: sja1000: fix max irq loop handling
    - [armhf] can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
    - dm-verity: fix unreliable memory allocation
    - [x86] thunderbolt: Add support for Intel Wildcat Lake
    - [arm*] serial: amba-pl011: prefer dma_mapping_error() over explicit
      address checking (regression in 5.10.204)
    - most: usb: fix double free on late probe failure
    - usb: cdns3: Fix double resource release in cdns3_pci_probe
    - usb: gadget: f_eem: Fix memory leak in eem_unwrap (regression in 5.10.50)
    - usb: storage: Fix memory leak in USB bulk transport
    - USB: storage: Remove subclass and protocol overrides from Novatek quirk
    - usb: storage: sddr55: Reject out-of-bound new_pba
    - [arm*] usb: dwc3: Fix race condition between concurrent
      dwc3_remove_requests() call paths
    - USB: serial: ftdi_sio: add support for u-blox EVK-M101
    - USB: serial: option: add support for Rolling RW101R-GL
    - drm/amd/display: Check NULL before accessing
    - libceph: fix potential use-after-free in have_mon_and_osd_map()
    - fs: writeback: fix use-after-free in __mark_inode_dirty()
      (CVE-2025-39866)
    - Bluetooth: Add more enc key size check
    - netfilter: nf_set_pipapo: fix initial map fill (CVE-2024-57947)
    - scsi: pm80xx: Set phy->enable_completion only when we wait for it
      (CVE-2024-47666)
    - smb: client: fix memory leak in cifs_construct_tcon()
    - usb: typec: ucsi: psy: Set max current to zero when disconnected
      (regression in 5.10.241)
    - usb: uas: fix urb unmapping issue when the uas device is remove during
      ongoing data transfer
    - ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
      (CVE-2025-21887) (regression in 5.10.188)
    - [amd64] netfilter: nf_set_pipapo_avx2: fix initial map fill

  [ Uwe Kleine-König ]
  * Disable CONFIG_CDROM_PKTCDVD for all archs as this driver is
    orphaned, buggy and not needed. (Closes: #1107479)

  [ Ben Hutchings ]
  * d/b/genorig.py, d/rules, d/salsa-ci.yml: Put orig tarballs directly in ..
  * d/salsa-ci.yml: Adjust filenames to allow source package name suffix
  * d/salsa-ci.yml: Fix cache configuration for build job
  * d/salsa-ci.yml: Move orig tarball generation to a separate job again
  * d/salsa-ci.yml: Restore lintian checking of source package
  * [rt] Update to 5.10.246-rt140
  * [rt] net/sched: act_ife: convert comma to semicolon

 -- Ben Hutchings <benh@debian.org>  Thu, 11 Dec 2025 18:55:57 +0100

linux (5.10.244-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.238
    - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset
    - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (CVE-2025-37930)
    - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum
      offload
    - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
      (CVE-2025-37990)
    - dm-integrity: fix a warning on invalid table line
    - dm: always update the array size in realloc_argv on success
    - [amd64] iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
      (CVE-2025-37927)
    - [x86] iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57)
    - tracing: Fix oob write in trace_seq_to_buffer() (CVE-2025-37923)
    - net/sched: act_mirred: don't override retval if we already lost the skb
      (CVE-2024-26739)
    - net/mlx5: E-Switch, Initialize MAC Address for Default GID
    - net/mlx5: Remove return statement exist at the end of void function
    - net/mlx5: E-switch, Fix error handling for enabling roce
    - net_sched: drr: Fix double list add in class with netem as child qdisc
      (CVE-2025-37915)
    - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child
      qdisc (CVE-2025-37890)
    - net_sched: ets: Fix double list add in class with netem as child qdisc
      (CVE-2025-37914)
    - net_sched: qfq: Fix double list add in class with netem as child qdisc
      (CVE-2025-37913)
    - net: ipv6: fix UDPv6 GSO segmentation with NAT
    - bnxt_en: Fix ethtool -d byte order for 32-bit values
    - nvme-tcp: fix premature queue removal and I/O failover
    - net: lan743x: Fix memleak issue when GSO enabled (CVE-2025-37909)
    - [arm*] net: fec: ERR007885 Workaround for conventional TX
    - [armhf] PCI: imx6: Skip controller_id generation logic for i.MX7D
    - of: module: add buffer overflow check in of_modalias() (CVE-2024-38541)
    - [arm64] Revert "drm/meson: vclk: fix calculation of 59.94 fractional
      rates" (regression in 5.10.219)
    - [arm*] irqchip/gic-v2m: Add const to of_device_id
    - [arm*] irqchip/gic-v2m: Mark a few functions __init
    - [arm*] irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
      (CVE-2025-37819)
    - [arm*] usb: chipidea: ci_hdrc_imx: use dev_err_probe()
    - [arm*] usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error
      handling
    - dm: fix copying after src array boundaries
    - scsi: target: Fix WRITE_SAME No Data Buffer crash (CVE-2022-21546)
    - openvswitch: Fix unsafe attribute parsing in output_userspace()
      (CVE-2025-37998)
    - can: gw: use call_rcu() instead of costly synchronize_rcu()
    - rcu/kvfree: Add kvfree_rcu_mightsleep() and kfree_rcu_mightsleep()
    - can: gw: fix RCU/BH usage in cgw_create_job()
    - netfilter: ipset: fix region locking in hash types (CVE-2025-37997)
    - [armhf] net: dsa: b53: allow leaky reserved multicast
    - [armhf] net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave
    - [armhf] net: dsa: b53: fix learning on VLAN unaware bridges
    - [x86] Input: synaptics - enable InterTouch on Dynabook Portege X30-D
    - [x86] Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
    - [x86] Input: synaptics - enable InterTouch on Dell Precision M3800
    - [x86] Input: synaptics - enable SMBus for HP Elitebook 850 G1
    - [x86] Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14
      v5
    - iio: adc: ad7606: fix serial register access
    - iio: adis16201: Correct inclinometer channel resolution
    - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
      (CVE-2025-37970)
    - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
      (CVE-2025-37969)
    - [armhf] usb: uhci-platform: Make the clock really optional
    - xenbus: Use kref to track req lifetime (CVE-2025-37949)
    - module: ensure that kobject_put() is safe for module type kobjects
      (CVE-2025-37995)
    - ocfs2: switch osb->disable_recovery to enum
    - ocfs2: implement handshaking with ocfs2 recovery thread
    - ocfs2: stop quota recovery before disabling quotas
    - [arm*] usb: host: tegra: Prevent host controller crash when OTG port is
      used
    - usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
    - usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)
    - USB: usbtmc: use interruptible sleep in usbtmc_read
    - usb: usbtmc: Fix erroneous get_stb ioctl error returns
    - usb: usbtmc: Fix erroneous wait_srq ioctl return
    - usb: usbtmc: Fix erroneous generic_read ioctl return
    - types: Complement the aligned types with signed 64-bit one
    - [arm*] drm/panel: simple: Update timings for AUO G101EVN010
    - nvme: unblock ctrl state transition for firmware update
    - do_umount(): add missing barrier before refcount checks in sync case
    - [x86] platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
    - iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
    - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
      (CVE-2025-38024)
    - nfs: handle failure of nfs_get_lock_context in unlock path
      (CVE-2025-38023)
    - net_sched: Flush gso_skb list too during ->change() (CVE-2025-37992)
    - [arm64] net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
      (CVE-2025-38094)
    - qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
    - NFSv4/pnfs: Reset the layout state after a layoutreturn
    - [arm64] ACPI: PPTT: Fix processor subtable walk
    - [x86] ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
    - [arm*] phy: Fix error handling in tegra_xusb_port_init
    - wifi: mt76: disable napi on driver removal (CVE-2025-38009)
    - [arm64] dmaengine: ti: k3-udma: Add missing locking (CVE-2025-38005)
    - [x86] clocksource/i8253: Use raw_spinlock_irqsave() in
      clockevent_i8253_disable()
    - [arm*] ASoC: q6afe-clocks: fix reprobing of the driver (CVE-2021-47037)
    - [x86] drm/vmwgfx: Fix a deadlock in dma buf fence polling
      (CVE-2024-43863)
    - usb: typec: altmodes/displayport: create sysfs nodes as driver's default
      device attribute group (CVE-2024-35790)
    - usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
      (CVE-2024-53203)
    - usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control()
    - btrfs: don't BUG_ON() when 0 reference count at
      btrfs_lookup_extent_info() (CVE-2024-46751)
    - netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
    - netfilter: nf_tables: wait for rcu grace period on net_device removal
    - netfilter: nf_tables: do not defer rule destruction via call_rcu
    - ice: arfs: fix use-after-free when freeing @rx_cpu_rmap (CVE-2022-49063)
    - scsi: target: iscsi: Fix timeout on deleted connection (CVE-2025-38075)
    - dma-mapping: avoid potential unused data compilation warning
    - cgroup: Fix compilation issue due to cgroup_mutex not being exported
    - NFSv4: Check for delegation validity in
      nfs_start_delegation_return_locked()
    - mailbox: use error ret code of of_parse_phandle_with_args()
    - fbcon: Use correct erase colour for clearing in fbcon
    - fbdev: core: tileblit: Implement missing margin clearing for tileblit
    - NFSv4: Treat ENETUNREACH errors as fatal for state recovery
    - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
    - SUNRPC: rpcbind should never reset the port to the value '0'
    - [arm64] thermal/drivers/qoriq: Power down TMU on system suspend
    - dql: Fix dql->limit value when reset.
    - pNFS/flexfiles: Report ENETDOWN as a connection error
    - libnvdimm/labels: Fix divide error in nd_label_data_init()
      (CVE-2025-38072)
    - [x86] mmc: host: Wait for Vdd to settle on card power off
    - [arm64] i2c: qup: Vote for interconnect bandwidth to DRAM
    - i2c: pxa: fix call balance of i2c->clk handling routines
    - btrfs: avoid linker error in btrfs_find_create_tree_block()
    - btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
    - ext4: reorder capability check last
    - scsi: st: Tighten the page format heuristics with MODE SELECT
    - scsi: st: ERASE does not change tape location
    - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
    - dm: restrict dm device size to 2^63-512 bytes
    - [x86] xen: Add support for XenServer 6.1 platform device
    - posix-timers: Add cond_resched() to posix_timer_add() search loop
    - netfilter: conntrack: Bound nf_conntrack sysctl writes
    - [arm64] mm: Check PUD_TYPE_TABLE in pud_bad()
    - [arm64] tegra: p2597: Fix gpio for vdd-1v8-dis regulator
    - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
    - [arm*] rtc: ds1307: stop disabling alarms on probe
    - [armhf] tegra: Switch DSI-B clock parent to PLLD on Tegra114
    - dm cache: prevent BUG_ON by blocking retries on failed device resumes
      (CVE-2025-38066)
    - orangefs: Do not truncate file size (CVE-2025-38065)
    - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
    - media: cx231xx: set device_caps for 417 (CVE-2025-38044)
    - [armhf] net: ethernet: ti: cpsw_new: populate netdev of_node
    - net: pktgen: fix mpls maximum labels list parsing
    - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
    - [arm64] clk: imx8mp: inform CCF of maximum frequency of clocks
    - [armhf] hwmon: (gpio-fan) Add missing mutex locks
    - [arm64] PCI: brcmstb: Expand inbound window size up to 64GB
    - [arm64] PCI: brcmstb: Add a softdep to MIP MSI-X driver
    - net/mlx5: Avoid report two health errors on same syndrome
    - [amd64] drm/amdkfd: KFD release_work possible circular locking
    - [arm64] net: xgene-v2: remove incorrect ACPI_PTR annotation
    - bonding: report duplicate MAC address in all situations
    - [x86] nmi: Add an emergency handler in nmi_desc & use it in
      nmi_shootdown_cpus()
    - cpuidle: menu: Avoid discarding useful information
    - libbpf: Fix out-of-bound read
    - scsi: mpt3sas: Send a diag reset if target reset fails
    - wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
    - wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
    - wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
    - net: pktgen: fix access outside of user given buffer in
      pktgen_thread_write() (CVE-2025-38061)
    - [x86] EDAC/ie31200: work around false positive build warning
    - [armhf] can: c_can: Use of_property_present() to test existence of DT
      property
    - eth: mlx4: don't try to complete XDP frames in netpoll
    - PCI: Fix old_size lower bound in calculate_iosize() too
    - ACPI: HED: Always initialize before evged
    - net/mlx5: Modify LSB bitmask in temperature event to include only the
      first bit
    - net/mlx5: Apply rate-limiting to high temperature warning
    - ASoC: ops: Enforce platform maximum on initial value
    - ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
    - pinctrl: devicetree: do not goto err when probing hogs in
      pinctrl_dt_to_map
    - media: v4l: Memset argument to 0 before calling get_mbus_config pad op
    - net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
    - phy: core: don't require set_mode() callback for phy_get_mode() to work
    - drm/amd/display: Initial psr_version with correct setting
    - net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
    - net/mlx5e: set the tx_queue_len for pfifo_fast
    - net/mlx5e: reduce rep rxq depth to 256 for ECPF
    - ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
    - wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
    - [arm64] hwmon: (xgene-hwmon) use appropriate type for the latency value
    - vxlan: Annotate FDB data races (CVE-2025-38037)
    - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
    - scsi: st: Restore some drive settings after reset
    - drm/ast: Find VBIOS mode from regular display size
    - bpftool: Fix readlink usage in get_fd_type
    - [x86] perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
    - wifi: rtw88: Don't use static local variable in
      rtw8822b_set_tx_power_index_by_rate
    - drm: Add valid clones check
    - [arm*] pinctrl: meson: define the pull up/down resistor value as 60 kOhm
    - [x86] ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
    - [x86] ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
    - nvmet-tcp: don't restore null sk_state_change (CVE-2025-38035)
    - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
      (CVE-2025-38034)
    - xenbus: Allow PVH dom0 a non-local xenstore
    - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
      (CVE-2025-38058)
    - xfrm: Sanitize marks before insert
    - bridge: netfilter: Fix forwarding of fragmented packets
    - [arm*] net: dwmac-sun8i: Use parsed internal PHY address instead of 1
    - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
      (CVE-2025-38000)
    - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
      (CVE-2025-38052)
    - crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079)
    - padata: do not leak refcount in reorder_work (CVE-2025-38031)
    - can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)
    - can: bcm: add missing rcu read protection for procfs content
      (CVE-2025-38003)
    - ALSA: pcm: Fix race of buffer access at PCM OSS layer (CVE-2025-38078)
    - llc: fix data loss when reading from a socket in llc_ui_recvmsg()
    - drm/edid: fixed the bug that hdr metadata was not reset
    - memcg: always call cond_resched() after fn()
    - mm/page_alloc.c: avoid infinite retries caused by cpuset race
    - [arm64] spi: spi-fsl-dspi: restrict register range for regmap access
    - [arm64] spi: spi-fsl-dspi: Halt the module after a new message transfer
    - [arm64] spi: spi-fsl-dspi: Reset SR flags before sending a new message
    - [x86] drm/i915/gvt: fix unterminated-string-initialization warning
    - smb: client: Fix use-after-free in cifs_fill_dirent (CVE-2025-38051)
    - smb: client: Reset all search buffer pointers when releasing buffer
    - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
      (CVE-2025-38001)
    - coredump: fix error handling for replace_fd()
    - pid: add pidfd_prepare()
    - fork: use pidfd_prepare()
    - coredump: hand a pidfd to the usermode coredump helper (dependency for
      fixing CVE-2025-4598 in systemd)
    - HID: quirks: Add ADATA XPG alpha wireless mouse support
    - nfs: don't share pNFS DS connections between net namespaces
    - [x86] platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
    - spi: spi-sun4i: fix early activation
    - tpm: tis: Double the timeout B to 4s
    - [x86] platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
    - [x86] platform/x86: thinkpad_acpi: Ignore battery threshold change event
      notification
    - xen/swiotlb: relax alignment requirements
    - [arm64] perf/arm-cmn: Initialise cmn->cpu earlier
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.239
    - [arm64] pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs
      > 31
    - [arm64] pinctrl: armada-37xx: set GPIO output value before setting
      direction
    - [x86] acpi-cpufreq: Fix nominal_freq units to KHz in
      get_max_boost_ratio()
    - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
    - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
    - usb: usbtmc: Fix timeout value in get_stb
    - [x86] thunderbolt: Do not double dequeue a configuration request
      (CVE-2025-38174)
    - netfilter: nft_socket: fix sk refcount leaks (CVE-2024-46855)
    - gfs2: gfs2_create_inode error handling fix
    - perf/core: Fix broken throttling when max_samples_per_tick=1
    - [x86] cpu: Sanitize CPUID(0x80000000) output
    - [arm*] crypto: marvell/cesa - Handle zero-length skcipher requests
      (CVE-2025-38173)
    - [arm*] crypto: marvell/cesa - Avoid empty transfer descriptor
    - crypto: lrw - Only add ecb if it is not already there
    - crypto: xts - Only add ecb if it is not already there
    - [arm64] crypto: sun8i-ce - move fallback ahash_request to the end of the
      struct
    - [amd64] EDAC/skx_common: Fix general protection fault (CVE-2025-38298)
    - [x86] mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
    - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
    - [x86] drm/vmwgfx: Add seqno waiter for sync_files
    - [arm*] firmware: psci: Fix refcount leak in psci_dt_init
    - [arm*] drm/tegra: rgb: Fix the unbound reference count
    - [arm64] firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
    - wifi: ath11k: fix node corruption in ar->arvifs list (CVE-2025-38293)
    - f2fs: fix to do sanity check on sbi->total_valid_block_count
      (CVE-2025-38163)
    - [armhf] net: ncsi: Fix GCPS 64-bit member variables
    - wifi: rtw88: do not ignore hardware read error during DPK
    - f2fs: clean up w/ fscrypt_is_bounce_page()
    - netfilter: bridge: Move specific fragmented packet to slow_path instead
      of dropping it
    - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
      (CVE-2025-38161)
    - [arm*] clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
      (CVE-2025-38160)
    - libbpf: Use proper errno value in nlattr
    - [armhf] pinctrl: at91: Fix possible out-of-boundary access
      (CVE-2025-38286)
    - bpf: Fix WARN() in get_bpf_raw_tp_regs (CVE-2025-38285)
    - wifi: ath9k_htc: Abort software beacon handling if disabled
      (CVE-2025-38157)
    - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
    - vfio/type1: Fix error unwind in migration dirty bitmap allocation
    - netfilter: nft_tunnel: fix geneve_opt dump
    - net: usb: aqc111: fix error handling of usbnet read calls
      (CVE-2025-38153)
    - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
    - calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)
    - net: openvswitch: Fix the dead loop of MPLS parse (CVE-2025-38146)
    - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames
    - f2fs: use d_inode(dentry) cleanup dentry->d_inode
    - f2fs: fix to correct check conditions in f2fs_cross_rename
    - [arm64] dts: imx8mm-beacon: Fix RTC capacitive load
    - Squashfs: check return result of sb_min_blocksize (CVE-2025-38415)
    - nilfs2: add pointer check for nilfs_direct_propagate()
    - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
    - [arm64] bus: fsl-mc: fix double-free on mc_dev (CVE-2025-38313)
    - [arm64] dts: rockchip: disable unrouted USB controllers and PHY on
      RK3399 Puma with Haikou
    - [armhf] soc: aspeed: lpc: Fix impossible judgment condition
    - [armhf] soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
      (CVE-2025-38145)
    - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
      (CVE-2025-38312)
    - perf ui browser hists: Set actions->thread before calling
      do_zoom_thread()
    - backlight: pm8941: Add NULL check in wled_configure() (CVE-2025-38143)
    - perf scripts python: exported-sql-viewer.py: Fix pattern matching with
      Python 3
    - perf tests switch-tracking: Fix timestamp comparison
    - perf record: Fix incorrect --user-regs comments
    - nfs: clear SB_RDONLY before getting superblock
    - nfs: ignore SB_RDONLY when remounting nfs
    - [arm64] dmaengine: ti: Add NULL check in udma_probe() (CVE-2025-38138)
    - PCI/DPC: Initialize aer_err_info before using it
    - rtc: Fix offset calculation for .start_secs < 0
    - [arm*] usb: renesas_usbhs: Reorder clock handling and power management in
      probe (CVE-2025-38136)
    - [armhf] serial: Fix potential null-ptr-deref in mlb_usio_probe()
      (CVE-2025-38135)
    - iio: adc: ad7124: Fix 3dB filter frequency reading
    - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
    - net: stmmac: platform: guarantee uniqueness of bus_id
    - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
    - net: tipc: fix refcount warning in tipc_aead_encrypt (CVE-2025-38273)
    - net/mlx4_en: Prevent potential integer overflow calculating Hz
    - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
    - ice: create new Tx scheduler nodes for new queues only
    - [x86] vmxnet3: correctly report gso type for UDP tunnels
    - PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
    - do_change_type(): refuse to operate on unmounted/not ours mounts
      (CVE-2025-38498)
    - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
    - Input: synaptics-rmi4 - convert to use sysfs_emit() APIs
    - Input: synaptics-rmi - fix crash with unsupported versions of F34
    - ath10k: add atomic protection for device recovery
    - ath10k: prevent deinitializing NAPI twice
    - ath10k: snoc: fix unbalanced IRQ enable in crash recovery
    - scsi: iscsi: Fix incorrect error path labels for flashnode operations
    - net_sched: sch_sfq: fix a potential crash on gso_skb handling
      (CVE-2025-38115)
    - i40e: return false from i40e_reset_vf if reset is in progress
    - i40e: retry VFLR handling if there is ongoing VF reset
    - tcp: factorize logic into tcp_epollin_ready()
    - bpf: Clean up sockmap related Kconfigs
    - net: Rename ->stream_memory_read to ->sock_is_readable
    - net: Fix TOCTOU issue in sk_is_readable() (CVE-2025-38112)
    - macsec: MACsec SCI assignment for ES = 0
    - net: mdio: C22 is now optional, EOPNOTSUPP if not provided
    - net/mdiobus: Fix potential out-of-bounds read/write access
      (CVE-2025-38111)
    - net/mlx5: Ensure fw pages are always allocated on same NUMA
    - net/mlx5: Fix return value when searching for existing flow group
    - net_sched: prio: fix a race in prio_tune() (CVE-2025-38083)
    - net_sched: red: fix a race in __red_change() (CVE-2025-38108)
    - net_sched: tbf: fix a race in tbf_change()
    - sch_ets: make est_qlen_notify() idempotent
    - net_sched: ets: fix a race in ets_qdisc_change() (CVE-2025-38107)
    - fs/filesystems: Fix potential unsigned integer underflow in fs_name()
    - posix-cpu-timers: fix race between handle_posix_cpu_timers() and
      posix_cpu_timer_del() (CVE-2025-38352)
    - [x86] boot/compressed: prefer cc-option for CFLAGS additions
    - kbuild: Update assembler calls to use proper flags and language target
    - kbuild: Add KBUILD_CPPFLAGS to as-option invocation
    - usb: Flush altsetting 0 endpoints before reinitializating them after
      reset.
    - [arm64] xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
    - [x86] iopl: Cure TIF_IO_BITMAP inconsistencies (CVE-2025-38100)
    - calipso: unlock rcu before returning -EAFNOSUPPORT
    - net: usb: aqc111: debug info before sanitation
    - tcp: tcp_data_ready() must look at SOCK_DONE
    - configfs: Do not override creating attribute file failure in
      populate_attrs()
    - [arm*] crypto: marvell/cesa - Do not chain submitted requests
    - gfs2: move msleep to sleepable context
    - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
    - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
    - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
      (CVE-2025-38348)
    - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
      (CVE-2025-38430)
    - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
      (CVE-2025-38231)
    - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
      (CVE-2025-38337)
    - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
    - media: cxusb: no longer judge rbuf when the write fails (CVE-2025-38229)
    - media: gspca: Add error handling for stv06xx_read_sensor()
    - media: v4l2-dev: fix error handling in __video_register_device()
    - [arm64] media: venus: Fix probe error handling
    - media: videobuf2: use sgtable-based scatterlist wrappers
    - media: vidtv: Terminating the subsequent process of initialization
      failure (CVE-2025-38227)
    - media: vivid: Change the siize of the composing (CVE-2025-38226)
    - [armhf] 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
    - [armhf] omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
    - bus: mhi: host: Fix conflict between power_up and SYSERR
    - [x86] ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
      (CVE-2025-38336)
    - [arm64] bus: fsl-mc: do not add a device-link for the UAPI used DPMCP
      device
    - ext4: inline: fix len overflow in ext4_prepare_inline_data
      (CVE-2025-38222)
    - ext4: fix calculation of credits for extent tree modification
    - ext4: factor out ext4_get_maxbytes()
    - ext4: ensure i_size is smaller than maxbytes
    - Input: ims-pcu - check record size in ims_pcu_flash_firmware()
      (CVE-2025-38428)
    - f2fs: prevent kernel warning due to negative i_nlink from corrupted image
      (CVE-2025-38219)
    - f2fs: fix to do sanity check on sit_bitmap_size (CVE-2025-38218)
    - NFC: nci: uart: Set tty->disc_data only in success path (CVE-2025-38416)
    - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
      (CVE-2025-38214)
    - [arm64] clk: meson-g12a: add missing fclk_div2 to spicc
    - ipc: fix to protect IPCS lookups using RCU (CVE-2025-38212)
    - mm: fix ratelimit_pages update error in dirty_ratio_handler()
    - [armhf] mtd: rawnand: sunxi: Add randomizer configuration in
      sunxi_nfc_hw_ecc_write_chunk
    - [armhf] mtd: nand: sunxi: Add randomizer configuration before randomizer
      enable
    - dm-mirror: fix a tiny race condition
    - ftrace: Fix UAF when lookup kallsym after ftrace disabled
      (CVE-2025-38346)
    - net: ch9200: fix uninitialised access during mii_nway_restart
      (CVE-2025-38086)
    - [x86] uio_hv_generic: Use correct size for interrupt and monitor pages
    - PCI: Fix lock symmetry in pci_slot_unlock()
    - iio: imu: inv_icm42600: Fix temperature calculation
    - iio: adc: ad7606_spi: fix reg write value mask
    - ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)
    - clocksource: Fix the CPUs' choice in the watchdog per CPU verification
    - ACPICA: Avoid sequence overread in call to strncmp()
    - ACPICA: fix acpi parse and parseext cache leaks (CVE-2025-38344)
    - power: supply: bq27xxx: Retrieve again when busy
    - ACPICA: utilities: Fix overflow check in vsnprintf()
    - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
    - drm/amdgpu/gfx6: fix CSIB handling
    - sunrpc: update nextcheck time when adding new cache entries
    - [arm*] drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of
      calling disable_irq()
    - exfat: fix double free in delayed_free (CVE-2025-38206)
    - [arm64] drm/msm/hdmi: add runtime PM calls to DDC transfer function
    - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
    - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
    - [arm64] drm/msm/a6xx: Increase HFI response timeout
    - drm/amdgpu/gfx10: fix CSIB handling
    - media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition
    - drm/amdgpu/gfx7: fix CSIB handling
    - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space()
    - jfs: fix array-index-out-of-bounds read in add_missing_indices
      (CVE-2025-38204)
    - sunrpc: fix race in cache cleanup causing stale nextcheck time
    - ext4: prevent stale extent cache entries caused by concurrent get
      es_cache
    - drm/amdgpu/gfx8: fix CSIB handling
    - drm/amdgpu/gfx9: fix CSIB handling
    - jfs: Fix null-ptr-deref in jfs_ioc_trim (CVE-2025-38203)
    - [arm64] drm/msm/dpu: don't select single flush for active CTL blocks
    - [amd64] drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
    - [arm*] media: platform: exynos4-is: Add hardware sync wait to
      fimc_is_hw_change_mode() (CVE-2025-38237)
    - [arm64] thermal/drivers/qcom/tsens: Update conditions to strictly
      evaluate for IP v2+
    - cpufreq: Force sync policy boost with global boost on sysfs update
    - [arm64] net: macb: Check return value of dma_set_mask_and_coherent()
    - tipc: use kfree_sensitive() for aead cleanup
    - emulex/benet: correct command version selection in be_cmd_get_stats()
    - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
    - sctp: Do not wake readers in __sctp_write_space()
    - net: dlink: add synchronization for stats update
    - tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
    - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
    - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
    - net: atlantic: generate software timestamp just before the doorbell
    - [arm64] pinctrl: armada-37xx: propagate error from
      armada_37xx_pmx_set_by_name()
    - [arm64] pinctrl: armada-37xx: propagate error from
      armada_37xx_gpio_get_direction()
    - [arm64] pinctrl: armada-37xx: propagate error from
      armada_37xx_pmx_gpio_set_direction()
    - [arm64] pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
    - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
    - wifi: mac80211: do not offer a mesh path if forwarding is disabled
    - [arm*] clk: rockchip: rk3036: mark ddrphy as critical
    - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
    - [amd64] iommu/amd: Ensure GA log notifier callbacks finish running before
      module unload
    - vxlan: Do not treat dst cache initialization errors as fatal
    - software node: Correct a OOB check in software_node_get_reference_args()
      (CVE-2025-38342)
    - scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)
    - sock: Correct error checking condition for (assign|release)_proto_idx()
    - i40e: fix MMIO write access to an invalid page in i40e_clear_hw
      (CVE-2025-38200)
    - [armhf] watchdog: da9052_wdt: respect TWDMIN
    - [arm64] bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
    - [armhf] OMAP2+: Fix l4ls clk domain handling in STANDBY
    - [arm*] tee: Prevent size calculation wraparound on 32-bit kernels
    - [armhf] Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect
      devices first" 
    - [x86] platform/x86: dell_rbu: Fix list usage (CVE-2025-38197)
    - [x86] platform/x86: dell_rbu: Stop overwriting data buffer
    - drivers/rapidio/rio_cm.c: prevent possible heap overwrite
      (CVE-2025-38090)
    - jffs2: check that raw node were preallocated before writing summary
      (CVE-2025-38194)
    - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
      (CVE-2025-38328)
    - [x86] scsi: storvsc: Increase the timeouts to storvsc_timeout
    - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
    - atm: Revert atm_account_tx() if copy_from_iter_full() fails.
      (CVE-2025-38190)
    - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
      (CVE-2025-38103)
    - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound
      card
    - [x86] ALSA: hda/intel: Add Thinkpad E15 to PM deny list
    - [x86] ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
    - hugetlb: unshare some PMDs when splitting VMAs
    - mm/hugetlb: unshare page tables during VMA split, not before
      (CVE-2025-38084)
    - mm: hugetlb: independent PMD page table shared count (CVE-2024-57883)
    - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)
    - drm/nouveau/bl: increase buffer size to avoid truncate warning
    - [armhf] hwmon: (occ) Add new temperature sensor type
    - [armhf] hwmon: (occ) Add soft minimum power cap attribute
    - [armhf] hwmon: (occ) Rework attribute registration for stack usage
    - [armhf] hwmon: (occ) fix unaligned accesses
    - aoe: clean device rq_list in aoedev_downdev() (CVE-2025-38326)
    - net: ice: Perform accurate aRFS flow match
    - wifi: carl9170: do not ping device which has failed to load firmware
      (CVE-2025-38420)
    - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
      (CVE-2025-38324)
    - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (CVE-2025-38185)
    - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen()
      behavior
    - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
      (CVE-2025-38184)
    - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
      (CVE-2025-38181)
    - net: atm: add lec_mutex (CVE-2025-38323)
    - net: atm: fix /proc/net/atm/lec handling (CVE-2025-38180)
    - [armhf] dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
    - [armhf] dts: am335x-bone-common: Increase MDIO reset deassert time
    - [armhf] dts: am335x-bone-common: Increase MDIO reset deassert delay to
      50ms
    - [arm64] insn: Add barrier encodings
    - [arm64] move AARCH64_BREAK_FAULT into insn-def.h
    - [arm64] insn: add encoders for atomic operations
    - [arm64] insn: Add support for encoding DSB
    - [arm64] proton-pack: Expose whether the platform is mitigated by firmware
    - [arm64] errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB
    - [arm64] errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe
      list
    - [arm64] errata: Add newer ARM cores to the spectre_bhb_loop_affected()
      lists
    - [arm64] errata: Add missing sentinels to Spectre-BHB MIDR arrays
    - [arm64] proton-pack: Expose whether the branchy loop k value
    - [arm64] spectre: increase parameters that can be used to turn off bhb
      mitigation individually
    - [arm64] bpf: Add BHB mitigation to the epilogue for cBPF programs
      (CVE-2025-37948)
    - [arm64] bpf: Only mitigate cBPF programs loaded by unprivileged users
      (CVE-2025-37963)
    - [arm64] proton-pack: Add new CPUs 'k' values for branch mitigation
    - net/ipv4: fix type mismatch in inet_ehash_locks_alloc() causing build
      failure
    - net: Fix checksum update for ILA adj-transport
    - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
    - rtc: Improve performance of rtc_time64_to_tm(). Add tests.
    - rtc: Make rtc_time64_to_tm() support dates before 1970
    - net_sched: sch_sfq: annotate data-races around q->perturb_period
    - net_sched: sch_sfq: handle bigger packets
    - net_sched: sch_sfq: don't allow 1 packet limit (CVE-2024-57996)
    - net_sched: sch_sfq: use a temporary work area for validating
      configuration
    - net_sched: sch_sfq: move the limit validation
    - mm/huge_memory: fix dereferencing invalid pmd migration entry
      (CVE-2025-37958)
    - [armhf] hwmon: (occ) Fix P10 VRM temp sensors
    - perf: Fix sample vs do_exit() (CVE-2025-38424)
    - [arm64] ptrace: Fix stack-out-of-bounds read in
      regs_get_kernel_stack_nth() (CVE-2025-38320)
    - bpf: fix precision backtracking instruction iteration
    - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.240
    - cifs: Fix cifs_query_path_info() for Windows NT servers
    - NFSv4.2: fix listxattr to return selinux security label
    - mailbox: Not protect module_put with spin_lock_irqsave
    - md/md-bitmap: fix dm-raid max_write_behind setting
    - bcache: fix NULL pointer in cache_set_flush() (CVE-2025-38263)
    - iio: pressure: zpa2326: Use aligned_s64 for the timestamp
    - [arm*] usb: common: usb-conn-gpio: use a unique name for usb connector
      device
    - usb: Add checks for snprintf() calls in usb_alloc_dev()
    - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
    - usb: typec: displayport: Receive DP Status Update NAK request exit dp
      altmode
    - ALSA: hda: Ignore unsol events for cards being shut down
    - ALSA: hda: Add new pci id for AMD GPU display HD audio controller
    - ceph: fix possible integer overflow in ceph_zero_objects()
    - ovl: Check for NULL d_inode() in ovl_dentry_upper()
    - [x86] VMCI: check context->notify_page after call to
      get_user_pages_fast() to avoid GPF (CVE-2023-53259)
    - [x86] VMCI: fix race between vmci_host_setup_notify and
      vmci_ctx_unset_notify (CVE-2025-38102)
    - fs/jfs: consolidate sanity checking in dbMount
    - jfs: validate AG parameters in dbMount() to prevent crashes
      (CVE-2025-38230)
    - [armhf] media: omap3isp: use sgtable-based scatterlist wrappers
    - f2fs: don't over-report free space or inodes in statvfs
    - RDMA/core: Use refcount_t instead of atomic_t on refcount of
      iwcm_id_private
    - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
      (CVE-2025-38211)
    - [x86] uio: uio_hv_generic: use devm_kzalloc() for private data alloc
    - [x86] Drivers: hv: vmbus: Fix duplicate CPU assignments within a device
    - [x86] Drivers: hv: Rename 'alloced' to 'allocated'
    - [x86] Drivers: hv: vmbus: Add utility function for querying ring size
    - [x86] uio_hv_generic: Query the ringbuffer size for device
    - [x86] uio_hv_generic: Align ring size to system page
    - net_sched: sch_sfq: reject invalid perturb period (CVE-2025-38193)
    - i2c: tiny-usb: disable zero-length read messages
    - i2c: robotfuzz-osif: disable zero-length read messages
    - atm: clip: prevent NULL deref in clip_push() (CVE-2025-38251)
    - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
      (CVE-2025-38249)
    - attach_recursive_mnt(): do not lock the covering tree when sliding
      something under it
    - libbpf: Fix null pointer dereference in btf_dump__free on allocation
      failure
    - wifi: mac80211: fix beacon interval calculation overflow
    - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
    - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
      (CVE-2025-38245)
    - Bluetooth: L2CAP: Fix L2CAP MTU negotiation
    - dm-raid: fix variable in journal device check
    - btrfs: update superblock's device bytes_used when dropping chunk
    - HID: wacom: fix memory leak on kobject creation failure
    - HID: wacom: fix memory leak on sysfs attribute creation failure
    - HID: wacom: fix kobject reference count leak
    - [arm*] drm/tegra: Assign plane type before registration
    - [arm*] drm/tegra: Fix a possible null pointer dereference
      (CVE-2025-38363)
    - drm/udl: Unregister device before cleaning up on disconnect
    - [amd64] drm/amdkfd: Fix race in GWS queue scheduling
    - [amd64] PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time
    - [arm64] Restrict pagetable teardown to avoid false warning
    - rtc: cmos: use spin_lock_irqsave in cmos_interrupt
    - [x86] vsock/vmci: Clear the vmci transport packet properly when
      initializing it (CVE-2025-38403)
    - mmc: sdhci: Add a helper function for dump register in dynamic debug mode
    - usb: typec: altmodes/displayport: do not index invalid pin_assignments
      (CVE-2025-38391)
    - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
      (CVE-2025-38387)
    - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
      (CVE-2025-38400)
    - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (CVE-2025-38393)
    - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
    - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
    - scsi: ufs: core: Fix spelling of a sysfs attribute name
    - RDMA/mlx5: Fix CC counters query for MPV
    - btrfs: fix missing error handling when searching for inode refs during
      log replay
    - [armhf] drm/exynos: fimd: Guard display clock control with runtime PM
      calls
    - [arm64] spi: spi-fsl-dspi: Clear completion counter before initiating
      transfer
    - [x86] drm/i915/gt: Fix timeline left held on VMA alloc error
      (CVE-2025-38389)
    - amd-xgbe: align CL37 AN sequence as per databook
    - enic: fix incorrect MTU comparison in enic_change_mtu()
    - rose: fix dangling neighbour pointers in rose_rt_device_down()
      (CVE-2025-38377)
    - nui: Fix dma_mapping_error() check
    - net/sched: Always pass notifications when child class becomes empty
      (CVE-2025-38350)
    - [i386] ALSA: sb: Force to disable DMAs once when DMA mode is changed
    - scsi: target: Fix NULL pointer dereference in
      core_scsi3_decode_spec_i_port() (CVE-2025-38399)
    - wifi: mac80211: drop invalid source address OCB frames
    - wifi: ath6kl: remove WARN on bad firmware input (CVE-2025-38406)
    - ACPICA: Refuse to evaluate a method if arguments are missing
      (CVE-2025-38386)
    - rcu: Return early if callback is not specified
    - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
      (CVE-2025-38395)
    - mtk-sd: Prevent memory corruption from DMA map failure (CVE-2025-38401)
    - [armhf] drm/v3d: Disable interrupts before resetting the GPU
      (CVE-2025-38371)
    - RDMA/mlx5: Fix vport loopback for MPV device
    - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes
    - NFSv4/flexfiles: Fix handling of NFS level errors in I/O
    - btrfs: propagate last_unlink_trans earlier when doing a rmdir
    - btrfs: use btrfs_record_snapshot_destroy() during rmdir
    - [arm64] dpaa2-eth: rename dpaa2_eth_xdp_release_buf into
      dpaa2_eth_recycle_buf
    - [arm64] dpaa2-eth: Update dpni_get_single_step_cfg command
    - [arm64] dpaa2-eth: Update SINGLE_STEP register access
    - [arm64] net: dpaa2-eth: rearrange variable in dpaa2_eth_get_ethtool_stats
    - [arm64] dpaa2-eth: fix xdp_rxq_info leak
    - Logitech C-270 even more broken
    - usb: typec: displayport: Fix potential deadlock (CVE-2025-38404)
    - [x86] ACPI: PAD: fix crash in exit_round_robin() (CVE-2024-49935)
    - media: uvcvideo: Return the number of processed controls
    - media: uvcvideo: Send control events for partial succeeds
    - media: uvcvideo: Rollback non processed entities on error
    - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
    - [arm*] drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
      (CVE-2025-38467)
    - perf: Revert to requiring CAP_SYS_ADMIN for uprobes (CVE-2025-38466)
    - fix proc_sys_compare() handling of in-lookup dentries
    - netlink: Fix wraparounds of sk->sk_rmem_alloc. (CVE-2025-38465)
    - tipc: Fix use-after-free in tipc_conn_close(). (CVE-2025-38464)
    - vsock: Fix transport_{g2h,h2g} TOCTOU (CVE-2025-38462)
    - vm_sockets: Add flags field in the vsock address data structure
    - vm_sockets: Add VMADDR_FLAG_TO_HOST vsock flag
    - af_vsock: Set VMADDR_FLAG_TO_HOST flag on the receive path
    - af_vsock: Assign the vsock transport considering the vsock address flags
    - vsock: Fix transport_* TOCTOU (CVE-2025-38461)
    - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
    - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
    - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
    - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (CVE-2025-38460)
    - atm: clip: Fix memory leak of struct clip_vcc. (CVE-2025-38546)
    - atm: clip: Fix infinite recursive call of clip_push(). (CVE-2025-38459)
    - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (CVE-2025-38458)
    - net/sched: Abort __tc_modify_qdisc if parent class does not exist
      (CVE-2025-38457)
    - fs/proc: do_task_stat: use __for_each_thread()
    - rxrpc: Fix oops due to non-existence of prealloc backlog struct
      (CVE-2025-38514)
    - [amd64] Mitigate Indirect Target Selection (CVE-2024-28956):
      + Documentation: x86/bugs/its: Add ITS documentation
      + x86/bhi: Define SPEC_CTRL_BHI_DIS_S
      + x86/its: Enumerate Indirect Target Selection (ITS) bug
      + x86/alternatives: Introduce int3_emulate_jcc()
      + x86/alternatives: Teach text_poke_bp() to patch Jcc.d32 instructions
      + x86/its: Add support for ITS-safe indirect thunk
      + x86/alternative: Optimize returns patching
      + x86/alternatives: Remove faulty optimization
      + x86/its: Add support for ITS-safe return thunk
      + x86/its: Fix undefined reference to cpu_wants_rethunk_at()
      + x86/its: Enable Indirect Target Selection mitigation
      + x86/its: Add "vmexit" option to skip mitigation on some CPUs
      + x86/modules: Set VM_FLUSH_RESET_PERMS in module_alloc()
      + x86/its: Use dynamic thunks for indirect branches
      + x86/its: Fix build errors when CONFIG_MODULES=n
      + x86/its: FineIBT-paranoid vs ITS
    - [x86] mce/amd: Fix threshold limit reset
    - [x86] mce: Don't remove sysfs if thresholding sysfs init fails
    - [x86] mce: Make sure CMCI banks are cleared during shutdown on Intel
    - [arm64] pinctrl: qcom: msm: mark certain pins as invalid for interrupts
      (CVE-2025-38516)
    - drm/sched: Increment job count before swapping tail spsc queue
      (CVE-2025-38515)
    - usb: gadget: u_serial: Fix race condition in TTY wakeup (CVE-2025-38448)
    - ethernet: atl1: Add missing DMA mapping error checks and count errors
    - netlink: Fix rmem check in netlink_broadcast_deliver().
    - netlink: make sure we allow at least one dump skb
    - [x86] Input: xpad - add support for Amazon Game Controller
    - [x86] Input: xpad - add VID for Turtle Beach controllers
    - [x86] Input: xpad - support Acer NGR 200 Controller
    - dma-buf: fix timeout handling in dma_resv_wait_timeout v2
    - wifi: zd1211rw: Fix potential NULL pointer dereference in
      zd_mac_tx_to_dev() (CVE-2025-38513)
    - md/raid1: Fix stack memory use after return in raid1_reshape
      (CVE-2025-38445)
    - net: appletalk: Fix device refcount leak in atrtr_create()
      (CVE-2025-38542)
    - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
    - bnxt_en: Fix DCB ETS validation
    - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (CVE-2025-38439)
    - [x86] atm: idt77252: Add missing `dma_map_error()`
    - net: usb: qmi_wwan: add SIMCom 8230C composition
    - vt: add missing notification when switching back to text mode
    - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
    - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
      (CVE-2025-38540)
    - Input: atkbd - do not skip atkbd_deactivate() when skipping
      ATKBD_CMD_GETID
    - vhost-scsi: protect vq->log_used with vq->mutex (CVE-2025-38074)
    - [i386] mm: Disable hugetlb page table sharing on 32-bit
    - [x86] Mitigate Transient Scheduler Attacks (CVE-2024-36350,
      CVE-2024-36357):
      - x86/bugs: Rename MDS machinery to something more generic
      - x86/bugs: Add a Transient Scheduler Attacks mitigation
      - KVM: x86: add support for CPUID leaf 0x80000021
      - KVM: SVM: Advertise TSA CPUID bits to guests
      - x86/process: Move the buffer clearing before MONITOR
    - rseq: Fix segfault on registration when rseq_cs is non-zero
      (CVE-2025-38067)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.241
    - [arm64] phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY
      mode (CVE-2025-38535)
    - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
    - USB: serial: option: add Foxconn T99W640
    - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
    - usb: gadget: configfs: Fix OOB read on empty string write
      (CVE-2025-38497)
    - [armhf] i2c: stm32: fix the device used for the DMA map
    - [x86] thunderbolt: Fix bit masking in tb_dp_port_set_hops()
    - [x86] Input: xpad - set correct controller type for Acer NGR200
    - [i386] pch_uart: Fix dma_sync_sg_for_device() nents value
    - HID: core: ensure the allocated report buffer can contain the reserved
      report ID (CVE-2025-38495)
    - HID: core: ensure __hid_request reserves the report ID as the first byte
    - HID: core: do not bypass hid_hw_raw_request (CVE-2025-38494)
    - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in
      pep_sock_accept()
    - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
    - af_packet: fix soft lockup issue caused by tpacket_snd()
    - [armhf] dmaengine: nbpfaxi: Fix memory corruption in probe()
      (CVE-2025-38538)
    - isofs: Verify inode mode when loading from disk
    - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
    - [arm*] mmc: bcm2835: Fix dma_unmap_sg() nents value
    - [x86] mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based
      Positivo models
    - [armhf] soc: aspeed: lpc-snoop: Cleanup resources in stack-order
    - [armhf] soc: aspeed: lpc-snoop: Don't disable channels that aren't
      enabled (CVE-2025-38487)
    - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
    - iio: adc: max1363: Reorder mode_list[] entries
    - [i386] comedi: pcl812: Fix bit shift out of bounds (CVE-2025-38530)
    - [i386] comedi: aio_iiro_16: Fix bit shift out of bounds (CVE-2025-38529)
    - [i386] comedi: das16m1: Fix bit shift out of bounds (CVE-2025-38483)
    - [i386] comedi: das6402: Fix bit shift out of bounds (CVE-2025-38482)
    - [x86] comedi: Fix some signed shift left operations
    - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
      (CVE-2025-38480)
    - comedi: Fix initialization of data for instructions that write to
      subdevice (CVE-2025-38478)
    - net/sched: sch_qfq: Fix race condition on qfq_aggregate
      (CVE-2025-38477)
    - rpl: Fix use-after-free in rpl_do_srh_inline(). (CVE-2025-38476)
    - hwmon: (corsair-cpro) Validate the size of the received input buffer
      (CVE-2025-38548)
    - usb: net: sierra: check for no status endpoint (CVE-2025-38474)
    - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (CVE-2025-38473)
    - Bluetooth: SMP: If an unallowed command is received consider it a failure
    - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
    - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
    - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during
      runtime (CVE-2025-38470)
    - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
      (CVE-2025-38468)
    - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
    - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime
      pm
    - usb: hub: Fix flushing of delayed work used for post resume purposes
    - [arm*] usb: musb: Add and use inline functions musb_{get,set}_state
    - [arm*] usb: musb: fix gadget state on disconnect
    - [arm64] usb: dwc3: qcom: Don't leave BCR asserted
    - [arm64] ASoC: fsl_sai: Force a software reset when starting in consumer
      mode
    - mm/vmalloc: leave lazy MMU mode on PTE mapping error
    - virtio-net: ensure the received length does not exceed allocated size
      (CVE-2025-38375)
    - [arm*] xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
    - regulator: core: fix NULL dereference on unbind due to stale coupling
      data (CVE-2025-38668)
    - RDMA/core: Rate limit GID cache warning messages
    - i40e: Add rx_missed_errors for buffer exhaustion
    - i40e: report VF tx_dropped with tx_errors instead of tx_discards
    - net: appletalk: Fix use-after-free in AARP proxy probe (CVE-2025-38666)
    - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in
      qfq_delete_class
    - [arm64] net: hns3: refine the struct hane3_tc_info
    - [arm64] net: hns3: fixed vf get max channels bug
    - [arm64] i2c: qup: jump out of the loop in case of timeout
      (CVE-2025-38671)
    - [x86] ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
    - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
    - e1000e: ignore uninitialized checksum word on tgp
    - gve: Fix stuck TX queue for DQ queue format
    - nilfs2: reject invalid file types when reading inodes (CVE-2025-38663)
    - [amd64] x86/bugs: Fix use of possibly uninit value in
      amd_check_tsa_microcode()
    - comedi: comedi_test: Fix possible deletion of uninitialized timers
    - ALSA: hda: Add missing NVIDIA HDA codec IDs
    - [arm*] usb: chipidea: add USB PHY event
    - [armhf] usb: phy: mxs: disconnect line when USB charger is attached
    - fs_context: fix parameter name in infofc() macro
    - hfsplus: remove mutex_lock check in hfsplus_free_extents (CVE-2025-38650)
    - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
    - ASoC: ops: dynamically allocate struct snd_ctl_elem_value
    - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
      (CVE-2025-38612)
    - pps: fix poll support
    - [armhf] dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485
      interface
    - [arm64] dts: imx8mm-beacon: Fix HS400 USDHC clock speed
    - cpufreq: Initialize cpufreq-based frequency-invariance later
    - cpufreq: Init policy->rwsem before it may be possibly used
    - [arm*] drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
    - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
      (CVE-2025-38608)
    - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
    - wifi: rtl818x: Kill URBs before clearing tx status queue (CVE-2025-38604)
    - wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
    - iwlwifi: Add missing check for alloc_ordered_workqueue
      (CVE-2025-38602)
    - wifi: ath11k: clear initialized flag for deinit-ed srng lists
      (CVE-2025-38601)
    - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
    - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
    - netfilter: nf_tables: adjust lockdep assertions handling
    - net/sched: Restrict conditions for adding duplicating netems to qdisc
      tree (CVE-2025-38553)
    - net_sched: act_ctinfo: use atomic64_t for three counters
    - xen/gntdev: remove struct gntdev_copy_batch from stack
    - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
    - mwl8k: Add missing check after DMA map
    - wifi: mac80211: Check 802.11 encaps offloading in
      ieee80211_tx_h_select_key()
    - Reapply "wifi: mac80211: Update skb's control block key in
      ieee80211_tx_dequeue()"
    - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P
      IE
    - can: kvaser_usb: Assign netdev.dev_port based on device channel index
    - netfilter: xt_nfacct: don't assume acct name is null-terminated
      (CVE-2025-38639)
    - vrf: Drop existing dst reference in vrf_ip6_input_dst
    - [arm64] PCI: rockchip-host: Fix "Unexpected Completion" log message
    - [arm*] crypto: marvell/cesa - Fix engine load inaccuracy
    - mtd: fix possible integer overflow in erase_xfer()
    - [armhf] clk: davinci: Add NULL check in davinci_lpsc_clk_register()
      (CVE-2025-38635)
    - [arm*] pinctrl: sunxi: Fix memory leak on krealloc failure
    - [arm64] crypto: inside-secure - Fix `dma_unmap_sg()` nents value
    - crypto: ccp - Fix crash when rebind ccp device for ccp.ko
      (CVE-2025-38581)
    - [armhf] clk: sunxi-ng: v3s: Fix de clock definition
    - scsi: mvsas: Fix dma_unmap_sg() nents value
    - [x86] scsi: isci: Fix dma_unmap_sg() nents value
    - soundwire: stream: restore params when prepare ports fail
    - fs/orangefs: Allow 2 more characters in do_c_string()
    - [arm*] dmaengine: mv_xor: Fix missing check after DMA map and missing
      unmap
    - [x86] crypto: qat - fix seq_file position update in adf_ring_next()
    - jfs: fix metapage reference count leak in dbAllocCtl
    - vhost-scsi: Fix log flooding with target does not exist errors
    - bpf: Check flow_dissector ctx accesses are aligned
    - apparmor: ensure WB_HISTORY_SIZE value is a power of 2
    - module: Restore the moduleparam prefix length check
    - [arm*] rtc: ds1307: fix incorrect maximum clock rate handling
    - [arm64] rtc: pcf85063: fix incorrect maximum clock rate handling
    - [arm*] rtc: pcf8563: fix incorrect maximum clock rate handling
    - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (CVE-2025-38578)
    - f2fs: fix to avoid panic in f2fs_evict_inode (CVE-2025-38577)
    - f2fs: fix to avoid out-of-boundary access in devs.path (CVE-2025-38652)
    - scsi: ufs: core: Use link recovery when h8 exit fails during runtime
      resume
    - pNFS/flexfiles: Avoid spurious layout returns in
      ff_layout_choose_ds_for_read
    - pNFS/flexfiles: don't attempt pnfs on fatal DS errors
    - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
      (CVE-2025-39730)
    - NFSv4.2: another fix for listxattr
    - mm: extract might_alloc() debug check
    - XArray: Add calls to might_alloc()
    - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
    - netpoll: prevent hanging NAPI when netcons gets enabled
    - phy: mscc: Fix parsing of unicast frames
    - pptp: ensure minimal skb length in pptp_xmit() (CVE-2025-38574)
    - ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572)
    - net: drop UFO packets in udp_rcv_segment() (CVE-2025-38622)
    - benet: fix BUG when creating VFs (CVE-2025-38569) (regression in
      5.10.235)
    - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
    - smb: client: let recv_done() cleanup before notifying the callers.
    - pptp: fix pptp_xmit() error path
    - perf/core: Don't leak AUX buffer refcount on allocation failure
    - perf/core: Exit early on perf_mmap() fail (CVE-2025-38565)
    - perf/core: Prevent VMA split of buffer mappings (CVE-2025-38563)
    - net/packet: fix a race in packet_set_ring() and packet_notifier()
      (CVE-2025-38617)
    - vsock: Do not allow binding to VMADDR_PORT_ANY (CVE-2025-38618)
    - USB: serial: option: add Foxconn T99W709
    - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
    - usb: gadget : fix use-after-free in composite_dev_cleanup()
      (CVE-2025-38555)
    - io_uring: don't use int for ABI
    - ALSA: usb-audio: Validate UAC3 power domain descriptors, too
      (CVE-2025-38729)
    - ALSA: usb-audio: Validate UAC3 cluster segment descriptors
      (CVE-2025-39757)
    - netlink: avoid infinite retry looping in netlink_unicast()
      (CVE-2025-38727)
    - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
      (CVE-2025-38724)
    - NFSD: detect mismatch of file handle and delegation stateid in OPEN op
    - fs: Prevent file descriptor table allocations exceeding INT_MAX
      (CVE-2025-39756)
    - ACPI: processor: perflib: Fix initial _PPC limit application
    - ACPI: processor: perflib: Move problematic pr->performance check
    - udp: also consider secpath when evaluating ipsec use for checksumming
    - netfilter: ctnetlink: fix refcount leak on table dump (CVE-2025-38721)
    - sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)
    - [x86] intel_idle: Allow loading ACPI tables for any family
    - cpuidle: governors: menu: Avoid using invalid recent intervals data
    - hfs: fix slab-out-of-bounds in hfs_bnode_read() (CVE-2025-38715)
    - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (CVE-2025-38714)
    - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
      (CVE-2025-38713)
    - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
      (CVE-2025-38712)
    - udf: Verify partition map count
    - drbd: add missing kref_get in handle_write_conflicts (CVE-2025-38708)
    - hfs: fix not erasing deleted b-tree node issue
    - ata: libata-sata: Disallow changing LPM state if not supported
    - securityfs: don't pin dentries twice, once is enough...
    - usb: xhci: print xhci->xhc_state when queue_command failed
    - [arm64] cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
    - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
    - usb: xhci: Avoid showing warnings for dying controller
    - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
    - usb: xhci: Avoid showing errors during surprise removal
    - cpufreq: Exit governor when failed to start old governor
    - [armhf] rockchip: fix kernel hang during smp initialization
      (CVE-2025-39752)
    - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was
      successed
    - [armhf] tegra: Use I/O memcpy to write to IRAM (CVE-2025-39794)
    - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
    - thermal: sysfs: Return ENODATA instead of EAGAIN for reads
    - PM: sleep: console: Fix the black screen issue
    - ACPI: processor: fix acpi_object initialization
    - [arm64] mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
    - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
    - [x86] bugs: Avoid warning when overriding return thunk
    - [x86] ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
    - [x86] ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
    - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
      (CVE-2025-38706)
    - usb: core: usb_submit_urb: downgrade type check
    - [x86] pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in
      mperf_stop()
    - [arm64] platform/chrome: cros_ec_typec: Defer probe on missing EC parent
    - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
      (CVE-2025-39751)
    - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
    - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
    - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
    - ASoC: codecs: rt5640: Retry DEVICE_ID verification
    - xen/netfront: Fix TX response spurious interrupts
    - wifi: cfg80211: reject HTC bit for management frames
    - be2net: Use correct byte order and format string for TCP seq and ack_seq
    - et131x: Add missing check after DMA map
    - rcu: Protect ->defer_qs_iw_pending from data race (CVE-2025-39749)
    - wifi: cfg80211: Fix interface type validation
    - net: ipv4: fix incorrect MTU in broadcast routes
    - [arm64] net: thunderx: Fix format-truncation warning in
      bgx_acpi_match_id()
    - wifi: iwlwifi: mvm: fix scan request validation
    - [arm*] net: fec: allow disable coalescing
    - drm/amd/display: Separate set_gsl from set_gsl_source_select
    - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
    - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
    - drm/amd/display: Fix 'failed to blank crtc!'
    - wifi: rtlwifi: fix possible skb memory leak in
      `_rtl_pci_rx_interrupt()`.
    - netmem: fix skb_frag_address_safe with unreadable skbs
    - wifi: iwlegacy: Check rate_idx range after addition
    - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
    - gve: Return error for unknown admin queue command
    - [armhf] net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
    - [armhf] net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
    - [armhf] net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
    - wifi: rtlwifi: fix possible skb memory leak in
      _rtl_pci_init_one_rxdesc()
    - [armhf] net: ncsi: Fix buffer overflow in fetching version id
    - drm/ttm: Should to return the evict error
    - uapi: in6: restore visibility of most IPv6 socket options
    - [amrhf] net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
    - vhost: fail early when __vhost_add_used() fails
    - cifs: Fix calling CIFSFindFirst() for root path without msearch
    - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
      (CVE-2025-38701)
    - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is
      allocated (CVE-2025-38700)
    - fs/orangefs: use snprintf() instead of sprintf()
    - [arm*] watchdog: dw_wdt: Fix default timeout
    - scsi: bfa: Double-free fix (CVE-2025-38699)
    - jfs: truncate good inode pages when hard link is 0 (CVE-2025-39743)
    - jfs: Regular file corruption check (CVE-2025-38698)
    - jfs: upper bound check of tree index in dbAllocAG (CVE-2025-38697)
    - [amd64] RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
      (CVE-2025-39742)
    - RDMA/core: reduce stack using in nldev_stat_get_doit()
    - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
      (CVE-2025-38695)
    - scsi: mpt3sas: Correctly handle ATA device errors
    - [armhf] pinctrl: stm32: Manage irq affinity settings
    - media: usb: hdpvr: disable zero-length read messages
    - media: dvb-frontends: dib7090p: fix null-ptr-deref in
      dib7090p_rw_on_apb() (CVE-2025-38694)
    - media: dvb-frontends: w7090p: fix null-ptr-deref in
      w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (CVE-2025-38693)
    - media: uvcvideo: Fix bandwidth issue for Alcor camera
    - md: dm-zoned-target: Initialize return variable r to avoid uninitialized
      use
    - [arm*] rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
    - dm-mpath: don't print the "loaded" message if registering fails
    - i2c: Force DLL0945 touchpad i2c freq to 100khz
    - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
    - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
    - ipmi: Use dev_warn_ratelimited() for incorrect message warnings
    - ipmi: Fix strcpy source and destination the same
    - net: phy: smsc: add proper reset flags for LAN8710A
    - block: avoid possible overflow for chunk_sectors check in
      blk_stack_limits() (CVE-2025-39795)
    - pNFS: Fix stripe mapping in block/scsi layout
    - pNFS: Fix disk addr range check in block/scsi layout
    - pNFS: Handle RPC size limit for layoutcommits
    - pNFS: Fix uninited ptr deref in block/scsi layout (CVE-2025-38691)
    - [arm*] rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
    - scsi: lpfc: Remove redundant assignment to avoid memory leak
    - ASoC: soc-dai.c: add missing flag check at snd_soc_pcm_dai_probe()
    - [arm64] ASoC: fsl_sai: replace regmap_write with regmap_update_bits
    - drm/amdgpu: fix incorrect vm flags to map bo
    - usb: core: config: Prevent OOB read in SS endpoint companion parsing
      (CVE-2025-39760)
    - misc: rtsx: usb: Ensure mmc child device is active when card is present
    - usb: typec: ucsi: Update power_supply on power role change
    - comedi: fix race between polling and detaching (CVE-2025-38687)
    - [x86] thunderbolt: Fix copy+paste error in match_service_id()
    - btrfs: fix log tree replay failure due to file with 0 links and extents
    - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
      (CVE-2025-39737)
    - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
      (CVE-2025-39736)
    - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
      (CVE-2025-38680)
    - media: uvcvideo: Do not mark valid metadata as invalid
    - serial: 8250: fix panic due to PSLVERR (CVE-2025-39724)
    - [x86] usb: atm: cxacru: Merge cxacru_upload_firmware() into
      cxacru_heavy_init()
    - [arm*] usb: dwc3: meson-g12a: fix device leaks at unbind
    - bus: mhi: host: Fix endianness of BHI vector table
    - vt: keyboard: Don't process Unicode characters in K_OFF mode
    - vt: defkeymap: Map keycodes above 127 to K_HOLE
    - ext4: check fast symlink for ea_inode correctly
    - ext4: fix fsmap end of range reporting with bigalloc
    - ext4: fix reserved gdt blocks handling in fsmap
    - ata: libata-scsi: Fix ata_to_sense_error() status handling
    - wifi: brcmsmac: Remove const from tbl_ptr parameter in
      wlc_lcnphy_common_read_table()
    - wifi: ath11k: fix source ring-buffer corruption
    - PCI: endpoint: Fix configfs group list head handling (CVE-2025-39783)
    - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (CVE-2025-39782)
    - [arm*] soc/tegra: pmc: Ensure power-domains are in a known state
    - media: gspca: Add bounds checking to firmware parser
    - [armhf] media: imx: fix a potential memory leak in
      imx_media_csc_scaler_device_init()
    - media: usbtv: Lock resolution while streaming (CVE-2025-39714)
    - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
      (CVE-2025-39713)
    - [arm*] media: venus: Add a check for packet size after reading from
      shared memory (CVE-2025-39710)
    - drm/amd: Restore cached power limit during resume
    - net, hsr: reject HSR frame if skb can't hold tag (CVE-2025-39703)
    - sch_htb: make htb_qlen_notify() idempotent (CVE-2025-37932)
    - sch_drr: make drr_qlen_notify() idempotent
    - sch_hfsc: make hfsc_qlen_notify() idempotent (CVE-2025-38177)
    - sch_qfq: make qfq_qlen_notify() idempotent
    - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
      (CVE-2025-37798)
    - sch_htb: make htb_deactivate() idempotent
    - memstick: Fix deadlock by moving removing flag earlier
    - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
    - squashfs: fix memory leak in squashfs_fill_super
    - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook
      830 G6
    - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
    - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
    - drm/amd/display: Find first CRTC and its line time in
      dce110_fill_display_configs
    - drm/amd/display: Fill display clock and vblank time in
      dce110_fill_display_configs
    - fs/buffer: fix use-after-free when call bh_read() helper (CVE-2025-39691)
    - move_mount: allow to add a mount into an existing group
    - use uniform permission checks for all mount propagation changes
    - ftrace: Also allocate and copy hash for reading of filter files
      (CVE-2025-39689)
    - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
    - iio: proximity: isl29501: fix buffered read on big-endian systems
    - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
    - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
    - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
    - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
    - [arm*] usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
    - f2fs: fix to do sanity check on ino and xnid (CVE-2025-38347)
    - iio: hid-sensor-prox: Fix incorrect OFFSET calculation
    - [x86] mce/amd: Add default names for MCA banks and blocks
    - usb: hub: avoid warm port reset during USB3 disconnect
    - usb: hub: Don't try to recover devices lost during warm reset.
    - smb: client: fix use-after-free in crypt_message when using async crypto
      (CVE-2025-38488)
    - tracing: Add down_write(trace_event_sem) when adding trace event
      (CVE-2025-38539)
    - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
    - ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
      (CVE-2025-38664)
    - drm/sched: Remove optimization that causes hang when killing dependent
      jobs
    - mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage()
    - [x86] fpu: Delay instruction pointer fixup until after warning
    - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
    - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
    - usb: typec: fusb302: cache PD RX state
    - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
    - block: Make REQ_OP_ZONE_FINISH a write operation
    - [x86] hv_netvsc: Fix panic during namespace deletion with VF
      (CVE-2025-38683)
    - USB: cdc-acm: do not log successful probe on later errors
    - cdc-acm: fix race between initial clearing halt and open
    - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
      (CVE-2025-38481)
    - ptp: Fix possible memory leak in ptp_clock_register() (CVE-2021-47455)
    - block: don't call rq_qos_ops->done_bio if the bio isn't tracked
      (CVE-2021-47412)
    - btrfs: fix deadlock when cloning inline extents and using qgroups
      (CVE-2021-46987)
    - [armhf] 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
    - [arm64] dpaa2-mac: split up initializing the MAC object from connecting
      to it
    - [arm64] dpaa2-mac: export MAC counters even when in TYPE_FIXED
    - [arm64] dpaa2-eth: retry the probe when the MAC is not yet discovered on
      the bus
    - [arm64] dpaa2-eth: Fix device reference count leak in MAC endpoint
      handling
    - mm: drop the assumption that VM_SHARED always implies writable
    - mm: update memfd seal write check to include F_SEAL_WRITE
    - mm: reinstate ability to map write-sealed memfd mappings read-only
    - dma-buf: insert memory barrier before updating num_fences
      (CVE-2025-38095)
    - drm/amdgpu: handle the case of pci_channel_io_frozen only in
      amdgpu_pci_resume (CVE-2021-47421)
    - RDMA/rxe: Return CQE error if invalid lkey was supplied (CVE-2021-47076)
    - scsi: lpfc: Fix link down processing to address NULL pointer dereference
      (CVE-2021-47183)
    - scsi: pm80xx: Fix memory leak during rmmod (CVE-2021-47193)
    - NFS: Don't set NFS_INO_REVAL_PAGECACHE in the inode cache validity
    - NFSv4: Fix nfs4_bitmap_copy_adjust()
    - NFS: Create an nfs4_server_set_init_caps() function
    - NFS: Fix the setting of capabilities when automounting a new filesystem
      (CVE-2025-39798)
    - net/sched: sch_ets: properly init all active DRR list handles
    - net_sched: sch_ets: implement lockless ets_dump()
    - net/sched: ets: use old 'nbands' while purging unused classes
      (CVE-2025-38684)
    - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
      (CVE-2025-38681)
    - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
    - [arm*] scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
      (CVE-2025-39788)
    - iio: adc: ad_sigma_delta: change to buffer predisable
    - [arm64] soc: qcom: mdt_loader: Ensure we don't read past the ELF header
      (CVE-2025-39787)
    - [armhf] usb: musb: omap2430: fix device leak at unbind
    - btrfs: populate otime when logging an inode item
    - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
      (CVE-2022-50327)
    - minmax: add umin(a, b) and umax(a, b)
    - ext4: fix hole length calculation overflow in non-extent inodes
    - [arm*] platform/chrome: cros_ec: Make cros_ec_unregister() return void
    - [arm*] platform/chrome: cros_ec: Use per-device lockdep key
    - [arm*] platform/chrome: cros_ec: remove unneeded label and if-condition
    - [arm*] platform/chrome: cros_ec: Unregister notifier in
      cros_ec_unregister()
    - locking/barriers, kcsan: Support generic instrumentation
    - asm-generic: Add memory barrier dma_mb()
    - wifi: ath11k: fix dest ring-buffer corruption when ring is full
    - media: v4l2-ctrls: always copy the controls on completion
    - media: v4l2-ctrls: Don't reset handler's error in
      v4l2_ctrl_handler_free()
    - [arm*} media: venus: don't de-reference NULL pointers at IRQ time
    - [arm*} media: venus: hfi: explicitly release IRQ during teardown
    - [arm*} media: venus: Add support for SSR trigger using fault injection
    - [arm*} media: venus: protect against spurious interrupts during probe
      (CVE-2025-39709)
    - drm/amd/display: Don't overclock DCE 6 by 15%
    - f2fs: fix to avoid out-of-boundary access in dnode page (CVE-2025-38677)
    - [arm*] media: venus: vdec: Clamp param smaller than 1fps and bigger than
      240.
    - [x86] uio_hv_generic: Fix another memory leak in error handling paths
      (CVE-2021-47070)
    - dm: rearrange core declarations for extended use from dm-zone.c
    - dm rq: don't queue request to blk-mq during DM suspend (CVE-2021-47498)
    - [arm*] usb: dwc3: Remove DWC3 locking during gadget suspend/resume
    - [arm*] usb: dwc3: core: remove lock of otg mode during gadget suspend/
      resume to avoid deadlock
    - [arm*] gpio: rcar: Use raw_spinlock to protect register access
      (CVE-2025-21912)
    - net: usbnet: Fix the wrong netif_carrier_on() call
    - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
    - usb: xhci: Fix slot_id resource race conflict
    - iio: imu: inv_icm42600: change invalid data error to -EBUSY
    - tracing: Remove unneeded goto out logic
    - tracing: Limit access to parser->buffer when trace_get_user failed
      (CVE-2025-39683)
    - iio: light: as73211: Ensure buffer holes are zeroed (CVE-2025-39687)
    - mm/page_alloc: detect allocation forbidden by cpuset and bail out early
    - cgroup/cpuset: Use static_branch_enable_cpuslocked() on
      cpusets_insane_config_key
    - scsi: qla4xxx: Prevent a potential error pointer dereference
      (CVE-2025-39676)
    - [amd64] iommu/amd: Avoid stack buffer overflow from kernel cmdline
      (CVE-2025-38676)
    - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
    - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
    - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
    - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
    - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
      (CVE-2025-39766)
    - net/sched: Remove unnecessary WARNING condition for empty child qdisc in
      htb_activate
    - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
    - netfilter: nft_reject: unify reject init and dump into nft_reject
    - netfilter: nft_reject_inet: allow to use reject from inet ingress
    - netfilter: nf_reject: don't leak dst refcount for loopback packets
      (CVE-2025-38732)
    - alloc_fdtable(): change calling conventions.
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.242
    - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
      (CVE-2025-39813)
    - scsi: core: sysfs: Correct sysfs attributes access rights
    - [x86] cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
      (CVE-2025-39681)
    - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests
    - NFS: Fix a race when updating an existing write (CVE-2025-39697)
    - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
    - net: ipv4: fix regression in local-broadcast routes
    - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
    - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
      (CVE-2025-39828)
    - [x86] net: dlink: fix multicast stats being counted incorrectly
    - net/mlx5e: Update and set Xon/Xoff upon MTU set
    - net/mlx5e: Update and set Xon/Xoff upon port speed set
    - net/mlx5e: Set local Xoff after FW update
    - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
    - sctp: initialize more fields in sctp_v6_from_sk() (CVE-2025-39812)
    - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)
    - [x86] KVM: x86: use array_index_nospec with indices that come from guest
      (CVE-2025-39823)
    - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (CVE-2025-39824)
    - HID: wacom: Add a new Art Pen 2
    - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
      (CVE-2025-39808)
    - Revert "drm/amdgpu: fix incorrect vm flags to map bo"
    - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
    - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
    - drm/nouveau/disp: Always accept linear modifier
    - [x86] ASoC: Intel: bxt_da7219_max98357a: shrink platform_id below 20
      characters
    - [x86] ASoC: Intel: sof_rt5682: shrink platform_id names below 20
      characters
    - [x86] ASoC: Intel: glk_rt5682_max98357a: shrink platform_id below 20
      characters
    - [x86] ASoC: Intel: sof_da7219_max98373: shrink platform_id below 20
      characters
    - xfs: do not propagate ENODATA disk errors into xattr code
      (CVE-2025-39835)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.243
    - drm/amd/display: Don't warn when missing DCE encoder caps
    - tee: fix NULL pointer dereference in tee_shm_put (CVE-2025-39865)
    - [arm64] dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
    - wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)
    - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
    - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
      (CVE-2025-39860)
    - [x86] xirc2ps_cs: fix register access when enabling FullDuplex
    - [x86] mISDN: Fix memory leak in dsp_hwec_enable()
    - icmp: fix icmp_ndo_send address translation for reply direction
    - i40e: Fix potential invalid access when MAC list is empty
      (CVE-2025-39853)
    - wifi: libertas: cap SSID len in lbs_associate()
    - [arm64] net: thunder_bgx: add a missing of_node_put
    - [arm64] net: thunder_bgx: decrement cleanup index before use
    - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
    - ax25: properly unshare skbs in ax25_kiss_rcv() (CVE-2025-39848)
    - net: atm: fix memory leak in atm_register_sysfs when device_register fail
    - ppp: fix memory leak in pad_compress_skb (CVE-2025-39847)
    - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
    - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
      (CVE-2025-39846)
    - wifi: mwifiex: Initialize the chan_stats array to zero
    - drm/amdgpu: drop hw access in non-DC audio fini
    - scsi: lpfc: Fix buffer free/clear order in deferred receive path
      (CVE-2025-39841)
    - batman-adv: fix OOB read/write in network-coding decode (CVE-2025-39839)
    - e1000e: fix heap overflow in e1000_set_eeprom
    - mm/khugepaged: fix ->anon_vma race (CVE-2023-52935)
    - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
    - cpufreq/sched: Explicitly synchronize limits_changed flag handling
    - [x86] KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
    - iio: light: opt3001: fix deadlock due to concurrent flag access
      (CVE-2025-37968)
    - [arm*] gpio: pca953x: fix IRQ storm on system wake up
    - [x86] ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
    - [x86] vmxnet3: update MTU after device quiesce
    - [arm64] dts: marvell: uDPU: define pinctrl state for alarm LEDs
    - net: phy: microchip: implement generic .handle_interrupt() callback
    - net: phy: microchip: remove the use of .ack_interrupt()
    - net: phy: microchip: force IRQ polling mode for lan88xx
    - [x86] ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
    - [x86] pcmcia: Add error handling for add_interval() in do_validate_mem()
    - [arm64] clk: qcom: gdsc: Set retain_ff before moving to HW CTRL
    - cifs: fix integer overflow in match_server()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.244
    - [x86] Mitigate VMScape vulnerability (CVE-2025-40300):
      + Documentation/hw-vuln: Add VMSCAPE documentation
      + x86/vmscape: Enumerate VMSCAPE bug
      + x86/vmscape: Add conditional IBPB mitigation
      + x86/vmscape: Enable the mitigation
      + x86/bugs: Move cpu_bugs_smt_update() down
      + x86/vmscape: Warn when STIBP is disabled with SMT
      + x86/vmscape: Add old Intel CPUs to affected list

  [ Ben Hutchings ]
  * Drop "Revert "xen/swiotlb: add alignment check for dma buffers"" which
    should not be needed after "xen/swiotlb: relax alignment requirements"
  * [x86] ACPI: Make ACPI_HED built-in since it can no longer be modular
  * Bump ABI to 36
  * d/b/buildcheck.py, d/rules.real: Run buildcheck.py in setup as well
  * d/b/buildcheck.py: Check config of kernel to be signed
  * d/rules: Include target suite as an input to gencontrol.py
  * Generate kernel ABI name suffix automatically if not configured
  * d/c/defines: Delete ABI name suffix
  * d/salsa-ci.yml: Ignore pycodestyle error E241
  * d/rules.real: Move module installation to the image build rule
  * certs: check-in the default x509 config file
  * [rt] Update to 5.10.241-rt135
  * d/b/gencontrol.py: Extend the effect of $DEBIAN_KERNEL_DISABLE_INSTALLER

  [ Bastian Blank ]
  * [arm64] Enable hyperv-daemons package. (Closes: #1109891)
  * Drop not needed extra step to add debug links
  * Sign modules using an ephemeral key: (closes: #1040901)
    - Set MODULE_SIG_ALL to sign all modules.
    - Not longer request Secure Boot signing for modules.
    - Don't trust Secure Boot key any longer.
  * Use abi name 0 for everything before unstable.
  * Store build time signing key encrypted.
  * Sign modules and support lockdown always.

  [ Santiago Ruano Rincón ]
  * d/salsa-ci.yml: Merge the extract-source job into the build's job script
  * d/salsa-ci.yml: Early move orig tarballs back where they can be cached

 -- Ben Hutchings <benh@debian.org>  Mon, 29 Sep 2025 13:28:35 +0200

linux (5.10.237-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.235
    - afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY
    - afs: Fix directory format encoding struct
    - nbd: don't allow reconnect after disconnect (CVE-2025-21731)
    - nvme: Add error check for xa_store in nvme_get_effects_log
    - afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call
    - [armhf] drm/etnaviv: Fix page property being used for non writecombine
      buffers
    - drm/amdgpu: Fix potential NULL pointer dereference in
      atomctrl_get_smc_sclk_range_table (CVE-2024-58052)
    - [arm*] genirq: Make handle_enforce_irqctx() unconditionally available
    - ipmi: ipmb: Add check devm_kasprintf() returned value (CVE-2024-58051)
    - wifi: rtlwifi: do not complete firmware loading needlessly
    - wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last
      step
    - rtlwifi: remove redundant assignment to variable err
    - wifi: rtlwifi: wait for firmware loading before releasing memory
    - wifi: rtlwifi: fix init_sw_vars leak when probe fails
    - wifi: rtlwifi: usb: fix workqueue leak when probe fails
    - rtlwifi: replace usage of found with dedicated list iterator variable
    - wifi: rtlwifi: remove unused timer and related code
    - wifi: rtlwifi: remove unused dualmac control leftovers
    - wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)
    - wifi: rtlwifi: destroy workqueue at rtl_deinit_core
    - wifi: rtlwifi: fix memory leaks and invalid access at probe error path
      (CVE-2024-58063)
    - wifi: rtlwifi: pci: wait for firmware loading before releasing memory
    - ACPI: fan: cleanup resources in the error path of .probe()
    - [x86] cpupower: fix TSC MHz calculation (regression in 5.10.181)
    - cpufreq: schedutil: Simplify sugov_update_next_freq()
    - cpufreq: schedutil: Fix superfluous updates caused by need_freq_update
    - [arm64] clk: imx8mp: Fix clkout1/2 support
    - team: prevent adding a device which is already a team device lower
      (CVE-2024-58071)
    - regulator: of: Implement the unwind path of of_regulator_match()
    - [arm*] wifi: wlcore: fix unbalanced pm_runtime calls
    - net/smc: fix data error when recvmsg with MSG_PEEK flag
    - wifi: mt76: mt76u_vendor_request: Do not print error messages when
      -EPROTO
    - [x86] cpufreq: ACPI: Fix max-frequency computation
    - wifi: cfg80211: Handle specific BSSID in 6GHz scanning
    - wifi: cfg80211: adjust allocation of colocated AP data
    - net: let net.core.dev_weight always be non-zero (CVE-2025-21806)
    - net/mlxfw: Drop hard coded max FW flash image size
    - net: sched: Disallow replacing of child qdisc from one parent to another
      (CVE-2025-21700)
    - net: ethernet: ti: am65-cpsw: fix freeing IRQ in
      am65_cpsw_nuss_remove_tx_chns() (CVE-2025-21799)
    - net/rose: prevent integer overflows in rose_setsockopt() (CVE-2025-21711)
    - [armhf] ASoC: sun4i-spdif: Add clock multiplier settings
    - perf header: Fix one memory leakage in process_bpf_btf()
    - perf header: Fix one memory leakage in process_bpf_prog_info()
    - perf env: Conditionally compile BPF support code on having
      HAVE_LIBBPF_SUPPORT
    - perf bpf: Fix two memory leakages when calling
      perf_env__insert_bpf_prog_info()
    - padata: fix sysfs store callback check
    - perf top: Don't complain about lack of vmlinux when not resolving some
      kernel samples
    - perf report: Fix misleading help message about --demangle
    - bpf: Send signals asynchronously if !preemptible (CVE-2025-21728)
    - padata: fix UAF in padata_reorder (CVE-2025-21727)
    - padata: add pd get/put refcnt helper
    - padata: avoid UAF for reorder_work (CVE-2025-21726)
    - RDMA/mlx4: Avoid false error about access to uninitialized gids array
    - rdma/cxgb4: Prevent potential integer overflow on 32bit (CVE-2024-57973)
    - [arm64] dts: qcom: msm8916: correct sleep clock frequency
    - [arm64] dts: qcom: msm8994: correct sleep clock frequency
    - [arm64] dts: qcom: sm8250: correct sleep clock frequency
    - media: rc: iguanair: handle timeouts
    - media: lmedm04: Use GFP_KERNEL for URB allocation/submission.
    - media: lmedm04: Handle errors for lme2510_int_read
    - media: marvell: Add check for clk_enable()
    - media: uvcvideo: Propagate buf->error to userspace
    - [armhf] staging: media: imx: fix OF node leak in
      imx_media_add_of_subdevs()
    - [arm*] PCI: rcar-ep: Fix incorrect variable used when calling
      devm_request_mem_region() (CVE-2025-21804)
    - scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
    - ocfs2: mark dquot as inactive if failed to start trans while releasing
      dquot
    - module: Extend the preempt disabled section in
      dereference_symbol_descriptor().
    - NFSv4.2: fix COPY_NOTIFY xdr buf size calculation
    - xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO
    - [armhf] dmaengine: ti: edma: fix OF node reference leaks in edma_driver
    - [arm64] rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
      (CVE-2024-58069)
    - ubifs: skip dumping tnc tree when zroot is null (CVE-2024-58058)
    - [arm64] net: hns3: fix oops when unload drivers paralleling
      (CVE-2025-21802) (regression in 5.10.76)
    - [arm*] net: fec: implement TSO descriptor cleanup
    - ipmr: do not call mr_mfc_uses_dev() for unres entries (CVE-2025-21719)
    - PM: hibernate: Add error handling for syscore_suspend()
    - net: rose: fix timer races against user threads (CVE-2025-21718)
    - [armhf] net: davicom: fix UAF in dm9000_drv_remove (CVE-2025-21715)
    - perf trace: Fix runtime error of index out of bounds
    - vsock: Allow retrying on connect() failure
    - net: hsr: fix fill_frame_info() regression vs VLAN packets (regression in
      5.10.231)
    - NFSD: Reset cb_seq_status after NFS4ERR_DELAY
    - netfilter: nf_tables: reject mismatching sum of field_len with set key
      length (CVE-2025-21826)
    - usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to
      PD_T_SENDER_RESPONSE
    - HID: core: Fix assumption that Resolution Multipliers must be in Logical
      Collections (CVE-2024-57986)
    - media: uvcvideo: Fix double free in error path (CVE-2024-57980)
    - usb: gadget: f_tcm: Don't free command immediately (CVE-2024-58055)
    - btrfs: output the reason for open_ctree() failure
    - btrfs: fix use-after-free when attempting to join an aborted transaction
      (CVE-2025-21753)
    - btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
    - sched: Don't try to catch up excess steal time.
    - [x86] amd_nb: Restrict init function to AMD-based systems
    - printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
      (CVE-2024-58017)
    - safesetid: check size of policy writes (CVE-2024-58016)
    - tun: fix group permission check
    - mmc: core: Respect quirk_max_rate for non-UHS SDIO card
    - wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
      (CVE-2024-58014)
    - tomoyo: don't emit warning in tomoyo_write_control() (CVE-2024-58085)
    - [x86] mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
    - HID: Wacom: Add PCI Wacom device support
    - net/mlx5: use do_aux_work for PHC overflow checks
    - i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
    - APEI: GHES: Have GHES honor the panic= setting
    - [arm64] mmc: sdhci-msm: Correctly set the load for the regulator
    - tipc: re-order conditions in tipc_crypto_key_rcv()
    - Input: allocate keycode for phone linking
    - [amd64] mm: Don't disable PCID when INVLPG has been fixed by microcode
    - net: usb: rtl8150: use new tasklet API
    - net: usb: rtl8150: enable basic endpoint checking (CVE-2025-21708)
    - usb: xhci: Add timeout argument in address_device USB HCD callback
    - usb: xhci: Fix NULL pointer dereference on certain command aborts
      (CVE-2024-57981)
    - nvme: handle connectivity loss in nvme_set_queue_count
    - [x86] gpu: drm_dp_cec: fix broken CEC adapter properties check
    - [x86] tg3: Disable tg3 PCIe AER on system reboot (regression in 5.10.201)
    - udp: gso: do not drop small packets when PMTU reduces
    - [arm*] gpio: pca953x: Improve interrupt support
    - net: atlantic: fix warning during hot unplug
    - net: rose: lock the socket in rose_bind() (CVE-2025-21749)
    - tun: revert fix group permission check
    - drm/modeset: Handle tiled displays in pan_display_atomic.
    - [armhf,i386] binfmt_flat: Fix integer overflow bug on 32 bit systems
      (CVE-2024-58010)
    - [arm64] dts: rockchip: increase gmac rx_delay on rk3399-puma
    - KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
      (CVE-2024-58083)
    - Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection
    - [arm64] clk: sunxi-ng: a100: enable MMC clock reparenting
    - [arm64] clk: qcom: clk-alpha-pll: fix alpha mode configuration
    - blk-cgroup: Fix class @block_class's subsystem refcount leakage
      (CVE-2025-21745)
    - efi: libstub: Use '-std=gnu11' to fix build with GCC 15
    - perf bench: Fix undefined behavior in cmpworker()
    - of: Correct child specifier used as input of the 2nd nexus node
    - of: Fix of_find_node_opts_by_path() handling of alias+path+options
    - HID: hid-sensor-hub: don't use stale platform-data on remove
    - wifi: rtlwifi: rtl8821ae: Fix media status report
    - wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
      (CVE-2025-21744)
    - [arm*] soc: qcom: socinfo: Avoid out of bounds read of serial number
      (CVE-2024-58007)
    - dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit()
    - dm-crypt: track tag_offset in convert_context
    - [x86] ALSA: hda/realtek: Enable headset mic on Positivo C6400
    - scsi: qla2xxx: Move FCE Trace buffer allocation to user control
    - [x86] scsi: storvsc: Set correct data length for sending SCSI command
      without payload
    - [x86] boot: Use '-std=gnu11' to fix build with GCC 15
    - iio: light: as73211: fix channel handling in only-color triggered buffer
    - media: mc: fix endpoint iteration
    - media: uvcvideo: Fix event flags in uvc_ctrl_send_events
    - media: uvcvideo: Remove redundant NULL assignment
    - [arm64] crypto: qce - fix goto jump in error path
    - [arm64] crypto: qce - unregister previously registered algos in error
      path
    - nvmem: core: improve range check for nvmem_cell_write()
    - vfio/platform: check the bounds of read/write syscalls
    - pnfs/flexfiles: retry getting layout segment for reads
    - ocfs2: handle a symlink read error correctly (CVE-2024-58001)
    - nilfs2: fix possible int overflows in nilfs_fiemap() (CVE-2025-21736)
    - NFC: nci: Add bounds checking in nci_hci_create_pipe() (CVE-2025-21735)
    - mtd: onenand: Fix uninitialized retlen in do_otp_read()
    - [armhf] net/ncsi: wait for the last response to Deselect Package before
      configuring channel
    - ptp: Ensure info->enable callback is always set (CVE-2025-21814)
    - ocfs2: check dir i_size in ocfs2_find_entry
    - nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)
    - NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)
    - HID: multitouch: Add NULL check in mt_input_configured (CVE-2024-58020)
      (regression in 5.10.195)
    - ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
    - vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)
    - team: better TEAM_OPTION_TYPE_STRING validation (CVE-2025-21787)
    - [arm64] cacheinfo: Avoid out-of-bounds write to cacheinfo array
      (CVE-2025-21785)
    - [x86] xen: allow larger contiguous memory regions in PV guests
    - media: cxd2841er: fix 64-bit division on gcc-9
    - media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
      (CVE-2024-57834)
    - [x86] PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P
    - vfio/pci: Enable iowrite64 and ioread64 for vfio pci
    - [x86] xen: Grab mm lock before grabbing pt lock
    - orangefs: fix a oob in orangefs_debug_write (CVE-2025-21782)
    - [x86] ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10
      tablet 5V
    - batman-adv: fix panic during interface removal (CVE-2025-21781)
    - batman-adv: Ignore neighbor throughput metrics in error case
    - [x86] perf/x86/intel: Ensure LBRs are disabled when a CPU is starting
    - usb: roles: set switch registered flag early on (regression in 5.10.211)
    - [arm*] usb: dwc2: gadget: remove of_node reference upon udc_stop
    - usb: core: fix pipe creation for get_bMaxPacketSize0
    - USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
    - USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
    - usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
      (CVE-2025-21835)
    - USB: hub: Ignore non-compliant devices with too many configs or
      interfaces (CVE-2025-21776)
    - USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
    - usb: cdc-acm: Check control transfer buffer size before access
      (CVE-2025-21704)
    - usb: cdc-acm: Fix handling of oversized fragments
    - USB: serial: option: add MeiG Smart SLM828
    - USB: serial: option: add Telit Cinterion FN990B compositions
    - USB: serial: option: fix Telit Cinterion FN990A name
    - USB: serial: option: drop MeiG Smart defines
    - [armhf] can: c_can: fix unbalanced runtime PM disable in error path
    - can: j1939: j1939_sk_send_loop(): fix unable to send messages with data
      length zero
    - efi: Avoid cold plugged memory for placing the kernel
    - serial: 8250: Fix fifo underflow on flush
    - [x86] partitions: mac: fix handling of bogus partition table
      (CVE-2025-21772)
    - regmap-irq: Add missing kfree()
    - [arm64] Handle .ARM.attributes section in linker scripts
    - clocksource: Limit number of CPUs checked for clock synchronization
    - clocksource: Replace deprecated CPU-hotplug functions.
    - clocksource: Replace cpumask_weight() with cpumask_empty()
    - clocksource: Use pr_info() for "Checking clocksource synchronization"
      message
    - clocksource: Use migrate_disable() to avoid calling get_random_u32() in
      atomic context (CVE-2025-21767)
    - net: treat possible_net_t net pointer as an RCU one and add
      read_pnet_rcu()
    - net: add dev_net_rcu() helper
    - ipv4: use RCU protection in rt_is_expired()
    - ipv4: use RCU protection in inet_select_addr()
    - ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)
    - ndisc: use RCU protection in ndisc_alloc_skb() (CVE-2025-21764)
    - neighbour: delete redundant judgment statements
    - neighbour: use RCU protection in __neigh_notify() (CVE-2025-21763)
    - arp: use RCU protection in arp_xmit() (CVE-2025-21762)
    - openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
      (CVE-2025-21761)
    - ndisc: extend RCU protection in ndisc_send_skb() (CVE-2025-21760)
    - nilfs2: do not output warnings when clearing dirty buffers
    - nilfs2: do not force clear folio if buffer is referenced (CVE-2025-21722)
    - nilfs2: protect access to buffers with no active references
      (CVE-2025-21811)
    - serial: 8250_pci: add support for ASIX AX99100
    - parport_pc: add support for ASIX AX99100
    - f2fs: fix to wait dio completion (CVE-2024-47726)
    - [x86] i8253: Disable PIT timer 0 when not in use
    - Revert "btrfs: avoid monopolizing a core when activating a swap file"
      (regression in 5.10.233)
    - btrfs: avoid monopolizing a core when activating a swap file
    - pps: Fix a use-after-free (CVE-2024-57979)
    - ima: Fix use-after-free on a dentry's dname.name (CVE-2024-39494)
    - vlan: introduce vlan_dev_free_egress_priority
    - vlan: move dev_put into vlan_dev_uninit (regression in 5.10.80)
    - nvme-pci: fix multiple races in nvme_setup_io_queues
    - [arm64] mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings
    - crypto: testmgr - fix wrong key length for pkcs1pad
    - crypto: testmgr - Fix wrong test case of RSA
    - crypto: testmgr - fix version number of RSA tests
    - crypto: testmgr - populate RSA CRT parameters in RSA test vectors
    - crypto: testmgr - some more fixes to RSA test vectors
    - mm: update mark_victim tracepoints fields
    - memcg: fix soft lockup in the OOM process (CVE-2024-57977)
    - drm/probe-helper: Create a HPD IRQ event helper for a single connector
    - [arm64] drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event()
    - tpm: Use managed allocation for bios event log
    - tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005)
    - batman-adv: Add new include for min/max helpers
    - batman-adv: Drop initialization of flexible ethtool_link_ksettings
    - batman-adv: Drop unmanaged ELP metric worker (CVE-2025-21823)
    - [arm*] usb: dwc3: Increase DWC3 controller halt timeout
    - [arm*] usb: dwc3: Fix timeout issue during controller enter/exit from
      halt state
    - usb/gadget: f_midi: Replace tasklet with work
    - USB: gadget: f_midi: f_midi_complete to call queue_work (CVE-2025-21859)
    - geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)
    - geneve: Suppress list corruption splat in geneve_destroy_tunnels().
    - net: extract port range fields from fl_flow_key
    - flow_dissector: Fix handling of mixed port and port-range keys
    - flow_dissector: Fix port range key handling in BPF conversion
    - bpf: skip non exist keys in generic_map_lookup_batch
    - [arm64] tee: optee: Fix supplicant wait loop (CVE-2025-21871)
    - nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (CVE-2025-21848)
    - [x86] ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
    - acct: block access to kernel internal filesystems
    - [x86] cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
    - IB/mlx5: Set and get correct qp_num for a DCT QP
    - RDMA/mlx5: Fix bind QP error cleanup flow
    - sunrpc: suppress warnings for unused procfs functions
    - ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports
      (regression in 5.10.121)
    - Bluetooth: L2CAP: Fix L2CAP_ECRED_CONN_RSP response (regression in
      5.10.177)
    - net: loopback: Avoid sending IP packets without an Ethernet header
      (regression in 5.10.229)
    - [arm64] net: cadence: macb: Synchronize stats calculations
    - [armhf] ASoC: es8328: fix route from DAC to output
    - ipvs: Always clear ipvs_property flag in skb_scrub_packet()
    - tcp: Defer ts_recent changes until req is owned
    - [arm*] net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow defination.
    - net: use indirect call helpers for dst_input
    - net: use indirect call helpers for dst_output
    - include: net: add static inline dst_dev_overhead() to dst.h
    - net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
    - net: ipv6: fix dst ref loop on input in rpl lwt
    - [i386] CPU: Fix warm boot hang regression on AMD SC1100 SoC systems
    - ftrace: Avoid potential division by zero in function_stat_show()
      (CVE-2025-21898)
    - perf/core: Fix low freq setting via IOC_PERIOD
    - [armhf] i2c: npcm: disable interrupt enable bit before devm_request_irq
      (CVE-2025-21878)
    - usbnet: gl620a: fix endpoint checking in genelink_bind() (CVE-2025-21877)
    - [armhf] phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks
      in refclk
    - mptcp: always handle address removal under msk socket lock
      (CVE-2025-21875)
    - vmlinux.lds: Ensure that const vars with relocations are mapped R/O
    - sched/core: Prevent rescheduling when interrupts are disabled
      (CVE-2024-58090)
    - [x86] intel_idle: Handle older CPUs, which stop the TSC in deeper C
      states, correctly
    - pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)
    - drop_monitor: fix incorrect initialization order (CVE-2025-21862)
    - kernel/acct.c: use dedicated helper to access rlimit values
    - acct: perform last write from workqueue (CVE-2025-21846)
    - smb: client: Add check for next_buffer in receive_encrypted_standard()
      (CVE-2025-21844)
    - drm/amdgpu: Check extended configuration space register when system uses
      large bar
    - drm/amdgpu: disable BAR resize on Dell G5 SE
    - efi: Don't map the entire mokvar table to determine its size
      (CVE-2025-21872)
    - HID: appleir: Fix potential NULL dereference at raw event handle
      (CVE-2025-21948)
    - gpio: aggregator: protect driver attr handlers against module unload
      (CVE-2025-21943)
    - [x86] ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
    - ALSA: hda/realtek: update ALC222 depop optimize
    - drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
    - [x86] platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
    - [x86] cacheinfo: Validate CPUID leaf 0x2 EDX output
    - [x86] cpu: Validate CPUID leaf 0x2 EDX output
    - [x86] cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
    - wifi: cfg80211: regulatory: improve invalid hints checking
      (CVE-2025-21910)
    - wifi: nl80211: reject cooked mode if it is set along with other flags
      (CVE-2025-21909)
    - rapidio: add check for rio_add_net() in rio_scan_alloc_net()
      (CVE-2025-21935)
    - rapidio: fix an API misues when rio_add_net() fails (CVE-2025-21934)
    - block: fix conversion of GPT partition name to 7-bit
    - mm/page_alloc: fix uninitialized variable
    - wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905)
    - [amd64] HID: intel-ish-hid: Fix use-after-free issue in
      ishtp_hid_remove() (CVE-2025-21928)
    - nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch
    - net: gso: fix ownership in __udp_gso_segment (CVE-2025-21926)
    - caif_virtio: fix wrong pointer check in cfv_probe() (CVE-2025-21904)
    - [armhf] hwmon: (pmbus) Initialise page count in pmbus_identify()
    - hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
    - [x86] ALSA: usx2y: validate nrpacks module parameter on probe
    - llc: do not use skb_get() before dev_queue_xmit() (CVE-2025-21925)
    - [arm64] hwmon: fix a NULL vs IS_ERR_OR_NULL() check in
      xgene_hwmon_probe()
    - be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
    - ppp: Fix KMSAN uninit-value warning with bpf (CVE-2025-21922)
    - vlan: enforce underlying device type (CVE-2025-21920)
    - net-timestamp: support TCP GSO case for a few missing flags
    - net: ipv6: fix dst ref loop in ila lwtunnel
    - net: ipv6: fix missing dst ref drop in ila lwtunnel
    - usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card
      Reader
    - usb: renesas_usbhs: Flush the notify_hotplug_work (CVE-2025-21917)
    - [x86] usb: atm: cxacru: fix a flaw in existing endpoint checks
      (CVE-2025-21916)
    - usb: typec: ucsi: increase timeout for PPM reset operations
    - usb: gadget: Set self-powered based on MaxPower and bmAttributes
    - usb: gadget: Fix setting self-powered state on suspend
    - usb: gadget: Check bmAttributes only if configuration is valid
    - xhci: pci: Fix indentation in the PCI device ID definitions
    - Squashfs: check the inode number is not the invalid value of zero
      (CVE-2024-26982)
    - [x86] mei: me: add panther lake P DID
    - [x86] intel_th: pci: Add Arrow Lake support
    - [x86] intel_th: pci: Add Panther Lake-H support
    - [x86] intel_th: pci: Add Panther Lake-P/U support
    - slimbus: messaging: Free transaction ID in delayed interrupt scenario
      (CVE-2025-21914)
    - nilfs2: move page release outside of nilfs_delete_entry and
      nilfs_set_link
    - nilfs2: eliminate staggered calls to kunmap in nilfs_rename
    - nilfs2: handle errors that nilfs_prepare_chunk() may return
      (CVE-2025-21721)
    - media: uvcvideo: Only save async fh if success
    - media: uvcvideo: Remove dangling pointers (CVE-2024-58002)
    - Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
      (regression in 5.10.231)
    - bpf, vsock: Invoke proto::close on close()
    - vsock: Keep the binding until socket destruction (CVE-2025-21756)
    - vsock: Orphan socket after transport release
    - sched: sch_cake: add bounds checks to host bulk flow fairness counts
      (CVE-2025-21647)
    - crypto: hisilicon/qm - inject error before stopping queue
      (CVE-2024-47730)
    - btrfs: bring back the incorrectly removed extent buffer lock recursion
      support
    - usb: xhci: Enable the TRB overfetch quirk on VIA VL805
    - udf: Fix use of check_add_overflow() with mixed type arguments
    - net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.236
    - vlan: fix memory leak in vlan_newlink()
    - [x86] clockevents/drivers/i8253: Fix stop sequence for timer 0
    - ipv6: Fix signed integer overflow in __ip6_append_data (CVE-2022-49728)
    - [x86] KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't
      in-kernel (CVE-2025-21779)
    - [x86] kexec: fix memory leak of elf header buffer (CVE-2022-49546)
    - [x86] fbdev: hyperv_fb: iounmap() the correct memory when removing a
      device
    - netfilter: conntrack: convert to refcount_t api
    - netfilter: nft_ct: fix use after free when attaching zone template
    - netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
    - ice: fix memory leak in aRFS after reset (CVE-2025-21981)
    - netpoll: hold rcu read lock in __netpoll_send_skb()
    - [x86] Drivers: hv: vmbus: Don't release fb_mmio resource in
      vmbus_free_mmio()
    - net/mlx5: handle errors in mlx5_chains_create_table() (CVE-2025-21975)
    - netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in
      insert_tree() (CVE-2025-21959)
    - ipvs: prevent integer overflow in do_ip_vs_get_ctl()
    - net_sched: Prevent creation of classes with TC_H_ROOT (CVE-2025-21971)
    - netfilter: nft_exthdr: fix offset with ipv4_find_option()
    - net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed
      devices
    - nvme-fc: go straight to connecting state when initializing
    - hrtimers: Mark is_migration_base() with __always_inline
    - [x86] powercap: call put_device() on an error path in
      powercap_register_control_type()
    - [x86] iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in
      ibft_attr_show_nic() (CVE-2025-21993)
    - scsi: qla1280: Fix kernel oops when debug level > 2 (CVE-2025-21957)
    - [x86] ACPI: resource: IRQ override for Eluktronics MECH-17
    - [amd64] HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in
      doorbell
    - HID: ignore non-functional sensor in HP 5MP Camera (CVE-2025-21992)
    - [x86] ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
    - nvmet-rdma: recheck queue state is LIVE in state lock in recv done
    - sctp: Fix undefined behavior in left shift operation
    - nvme: only allow entering LIVE from CONNECTING state
    - fuse: don't truncate cached, mutated symlink
    - [x86] irq: Define trace events conditionally
    - drm/nouveau: Do not override forced connector status
    - block: fix 'kmem_cache of name 'bio-108' already exists'
    - USB: serial: ftdi_sio: add support for Altera USB Blaster 3
    - USB: serial: option: add Telit Cinterion FE990B compositions
    - USB: serial: option: fix Telit Cinterion FE990A name
    - USB: serial: option: match on interface class for Telit FN990B
    - [x86] microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA
      nodes (CVE-2025-21991)
    - drm/atomic: Filter out redundant DPMS calls
    - drm/amd/display: Assign normalized_pix_clk when color depth = 14
      (CVE-2025-21956)
    - drm/amd/display: Fix slab-use-after-free on hdcp_work (CVE-2025-21968)
    - qlcnic: fix memory leak issues in qlcnic_sriov_common.c
    - [x86] drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
    - [x86] i2c: ali1535: Fix an error handling path in ali1535_probe()
    - [x86] i2c: ali15x3: Fix an error handling path in ali15x3_probe()
    - [x86] i2c: sis630: Fix an error handling path in sis630_probe()
    - drm/amd/display: Check plane scaling against format specific hw plane
      caps.
    - drm/amd/display/dc/core/dc_resource: Staticify local functions
    - drm/amd/display: Reject too small viewport size when validating plane
    - drm/amd/display: fix odm scaling
    - drm/amd/display: Check for invalid input params when building scaling
      params
    - drm/amd/display: Fix null check for pipe_ctx->plane_state in
      resource_build_scaling_params (CVE-2025-21941)
    - xfrm_output: Force software GSO only in tunnel mode
    - [arm*] dts: bcm2711: PL011 UARTs are actually r1p5
    - ]arm*] dts: bcm2711: Don't mark timer regs unconfigured
    - [arm64] RDMA/hns: Remove redundant 'phy_addr' in
      hns_roce_hem_list_find_mtt()
    - [arm64] RDMA/hns: Fix soft lockup during bt pages loop (CVE-2025-22010)
    - [arm64] RDMA/hns: Fix wrong value of max_sge_rd
    - Bluetooth: Fix error code in chan_alloc_skb_cb() (CVE-2025-22007)
    - ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
      (CVE-2025-22005)
    - ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
    - net: atm: fix use after free in lec_send() (CVE-2025-22004)
    - net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
    - [armhf] i2c: omap: fix IRQ storms
    - regulator: check that dummy regulator has been probed before using it
      (CVE-2025-22008)
    - proc: fix UAF in proc_get_inode() (CVE-2025-21999)
    - drm/amdgpu: Fix even more out of bound writes from debugfs
      (CVE-2021-47489)
    - Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
      (CVE-2024-53144)
    - bpf, sockmap: Fix race between element replace and close()
      (CVE-2024-56664)
    - batman-adv: Ignore own maximum aggregation size during RX
    - [arm*] soc: qcom: pdr: Fix the potential deadlock (CVE-2025-22014)
    - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
      (CVE-2025-21996)
    - ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
    - HID: hid-plantronics: Add mic mute mapping and generalize quirks
    - atm: Fix NULL pointer dereference (CVE-2025-22018)
    - [armhf] 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
    - [armhf] 9351/1: fault: Add "cut here" line for prefetch aborts
    - netfilter: socket: Lookup orig tuple for IPv6 SNAT (CVE-2025-22021)
    - [x86] ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx
    - tty: serial: 8250: Add some more device IDs
    - net: usb: qmi_wwan: add Telit Cinterion FN990B composition
    - net: usb: qmi_wwan: add Telit Cinterion FE990B composition
    - net: usb: usbnet: restore usb%d name exception for local mac addresses
      (regression in 5.10.229)
    - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
      (CVE-2025-22020)
    - serial: 8250_dma: terminate correct DMA in tx_dma_flush()
    - media: i2c: et8ek8: Don't strip remove function when driver is builtin
      (CVE-2024-38611)
    - i2c: dev: check return value when calling dev_set_name() (CVE-2022-49046)
    - watch_queue: fix pipe accounting mismatch (CVE-2025-23138)
    - cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
    - [x86] fpu: Avoid copying dynamic FP state from init_task in
      arch_dup_task_struct()
    - [x86] platform: Only allow CONFIG_EISA for 32-bit
    - PM: sleep: Adjust check before setting power.must_resume
    - [x86] EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
    - [x86] EDAC/ie31200: Fix the DIMM size mask for several SoCs
    - [x86] EDAC/ie31200: Fix the error path order of ie31200_init()
    - [x96] thermal: int340x: Add NULL check for adev (CVE-2025-23136)
    - PM: sleep: Fix handling devices with direct_complete set on errors
    - perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
    - ALSA: hda/realtek: Always honor no_shutup_pins
    - drm/dp_mst: Fix drm RAD print
    - PCI/ASPM: Fix link state exit during switch upstream function removal
    - [arm64] PCI: brcmstb: Use internal register to change link capability
    - PCI/portdrv: Only disable pciehp interrupts early when needed
    - drm/amd/display: fix type mismatch in
      CalculateDynamicMetadataParameters()
    - PCI: Remove stray put_device() in pci_register_host_bridge()
    - PCI: pciehp: Don't enable HPIE when resuming in poll mode
    - [arm64] clk: amlogic: gxbb: drop incorrect flag on 32k clock
    - [arm*] clk: samsung: Fix UBSAN panic in samsung_clk_init()
      (CVE-2025-39728)
    - bpf: Use preempt_count() directly in bpf_send_signal_common()
    - [arm*] clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
    - IB/mad: Check available slots before posting receive WRs
    - [arm*] pinctrl: tegra: Set SFIO mode to Mux Register
    - [arm64] clk: amlogic: g12b: fix cluster A parent data
    - [arm64] clk: amlogic: gxbb: drop non existing 32k clock parent
    - [arm64] clk: amlogic: g12a: fix mmc A peripheral clock
    - [amd64] entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
    - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (CVE-2025-22086)
    - [x86] dumpstack: Fix inaccurate unwinding from exception stacks due to
      misplaced assignment
    - isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
    - iio: accel: mma8452: Ensure error return on failure to matching
      oversampling ratio
    - perf units: Fix insufficient array space
    - kexec: initialize ELF lowest address to ULONG_MAX
    - ocfs2: validate l_tree_depth to avoid out-of-bounds access
      (CVE-2025-22079)
    - NFSv4: Don't trigger uneccessary scans for return-on-close delegations
    - perf python: Fixup description of sample.id event member
    - perf python: Decrement the refcount of just created event on failure
    - perf python: Don't keep a raw_data pointer to consumed ring buffer space
    - perf python: Check if there is space to copy all the event
    - objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
    - exfat: fix the infinite loop in exfat_find_last_cluster()
    - rtnetlink: Allocate vfinfo size for VF GUIDs when supported
      (CVE-2025-22075)
    - ring-buffer: Fix bytes_dropped calculation issue
    - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are
      invalid
    - sched/smt: Always inline sched_smt_active()
    - wifi: iwlwifi: fw: allocate chained SG tables for dump
    - nvme-tcp: fix possible UAF in nvme_tcp_poll
    - nvme-pci: clean up CMBMSC when registering CMB fails
    - nvme-pci: skip CMB blocks incompatible with PCI P2P DMA
    - affs: generate OFS sequence numbers starting at 1
    - affs: don't write overlarge OFS data block size fields
    - [x86] platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go
      4 tablet
    - sched/deadline: Use online cpus for validating runtime
    - locking/semaphore: Use wake_q to wake up processes outside lock critical
      section
    - [x86] ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360
      14-dy1xxx
    - can: statistics: use atomic access in hot path
    - hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}
    - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
      (CVE-2023-53034)
    - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
      (CVE-2025-22063)
    - net_sched: skbprio: Remove overly strict queue assertions
      (CVE-2025-38637)
    - vsock: avoid timeout during connect() if the socket is closing
    - tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().
    - netfilter: nft_tunnel: fix geneve_opt type confusion addition
      (CVE-2025-22056)
    - ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
    - [arm*] net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on
      destroy
    - net: fix geneve_opt length integer overflow (CVE-2025-22055)
    - arcnet: Add NULL check in com20020pci_probe() (CVE-2025-22054)
    - can: flexcan: only change CAN state when link up in system PM
    - [arm64] tty: serial: fsl_lpuart: use UARTMODIR register bits for lpuart32
      platform
    - [arm64] tty: serial: fsl_lpuart: disable transmitter before changing
      RS485 related registers
    - drm/amd/pm: Fix negative array index read (CVE-2024-46821)
    - drm/amd/display: Skip inactive planes within
      ModeSupportAndSystemConfiguration (CVE-2024-46812)
    - btrfs: handle errors from btrfs_dec_ref() properly (CVE-2024-46753)
    - [x86] tsc: Always save/restore TSC sched_clock() on suspend/resume
    - [x86] mm: Fix flush_tlb_range() when used for zapping normal PMDs
      (CVE-2025-22045)
    - acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (CVE-2025-22044)
    - [x86] ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
    - [armhf] mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
    - tracing: Fix use-after-free in print_graph_function_flags during tracer
      switching (CVE-2025-22035)
    - tracing: Ensure module defining synth event cannot be unloaded while
      tracing
    - ext4: don't over-report free space or inodes in statvfs
    - ext4: fix OOB read when checking dotdot dir (CVE-2025-37785)
    - jfs: fix slab-out-of-bounds read in ea_get() (CVE-2025-39735)
    - jfs: add index corruption check to DT_GETPAGE()
    - nfsd: put dl_stid if fail to queue dl_recall (CVE-2025-22025)
    - NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up
    - netfilter: conntrack: fix crash due to confirmed bit load reordering
    - [x86] kexec: Fix double-free of elf header buffer
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.237
    - tipc: fix memory leak in tipc_link_xmit (CVE-2025-37757)
    - net: tls: explicitly disallow disconnect (CVE-2025-37756)
    - ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining
      ones
    - ata: sata_sx4: Add error handling in pdc20621_i2c_read()
    - net: ppp: Add bound checking for skb data on ppp_sync_txmung
      (CVE-2025-37749)
    - [amd64] nft_set_pipapo: fix incorrect avx2 match of 5th field octet
    - umount: Allow superblock owners to force umount
    - pm: cpupower: bench: Prevent NULL dereference on malloc failure
      (CVE-2025-37841)
    - [amd64] cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD
      when running in a virtual machine
    - [arm*] perf: arm_pmu: Don't disable counter in armpmu_add()
    - HID: pidff: Convert infinite length from Linux API to PID standard
    - HID: pidff: Do not send effect envelope if it's empty
    - HID: pidff: Fix null pointer dereference in pidff_find_fields
      (CVE-2025-37862)
    - [x86] ALSA: hda: intel: Fix Optimus when GPU has no sound
    - ALSA: usb-audio: Fix CME quirk for UF series keyboards
    - page_pool: avoid infinite loop to schedule delayed worker
      (CVE-2025-37859)
    - fs/jfs: cast inactags to s64 to prevent potential overflow
    - fs/jfs: Prevent integer overflow in AG size calculation (CVE-2025-37858)
    - jfs: Prevent copying of nlink with value 0 from disk inode
      (CVE-2025-37741)
    - jfs: add sanity check for agwidth in dbMount (CVE-2025-37740)
    - ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
    - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
      (CVE-2025-37739)
    - ahci: add PCI ID for Marvell 88SE9215 SATA Controller
    - ext4: protect ext4_release_dquot against freezing
    - ext4: ignore xattrs past end (CVE-2025-37738)
    - scsi: st: Fix array overflow in st_setup() (CVE-2025-37857)
    - wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
    - net: vlan: don't propagate flags on open (CVE-2025-23163)
    - tracing: fix return value in __ftrace_event_enable_disable for
      TRACE_REG_UNREGISTER
    - Bluetooth: hci_uart: fix race during initialization
    - drm: allow encoder mode_set even when connectors change for crtc
    - [x86] drm: panel-orientation-quirks: Add support for AYANEO 2S
    - [x86] drm: panel-orientation-quirks: Add new quirk for GPD Win 2
    - drm/bridge: panel: forbid initializing a panel with unknown connector
      type
    - [amd64] drm/amdkfd: clamp queue size to minimum
    - [amd64] drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
    - [armhf] fbdev: omapfb: Add 'plane' value check (CVE-2025-37851)
    - [arm*] pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
      (CVE-2025-37850)
    - bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
    - ext4: reject casefold inode flag without casefold feature
    - ext4: don't treat fhandle lookup of ea_inode as FS corruption
      (regression in 5.10.183)
    - [arm64] media: venus: hfi: add a check to handle OOB in sfr region
      (CVE-2025-23159)
    - [arm64] media: venus: hfi: add check to handle incorrect queue size
      (CVE-2025-23158)
    - media: siano: Fix error handling in smsdvb_module_init()
    - [amd64] xenfs/xensyms: respect hypervisor's "next" indication
    - [arm64] errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list
    - [arm*] mtd: rawnand: brcmnand: fix PM resume warning (CVE-2025-37840)
    - media: streamzap: prevent processing IR data on URB failure
    - media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
    - [arm64] media: venus: hfi_parser: add check to avoid out of bound access
      (CVE-2025-23157)
    - [arm*] net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for
      6320 family
    - wifi: mac80211: fix integer overflow in hwmp_route_info_get()
    - ext4: fix off-by-one error in do_split (CVE-2025-23150)
    - i3c: Add NULL pointer check in i3c_master_queue_ibi() (CVE-2025-23147)
    - jbd2: remove wrong sb->s_sequence check (CVE-2025-37839)
    - [armhf] mfd: ene-kb3930: Fix a potential NULL pointer dereference
      (CVE-2025-23146)
    - lib: scatterlist: fix sg_split_phys to preserve original scatterlist
      offsets
    - [x86] mtd: inftlcore: Add error check for inftl_read_oob()
    - mtd: rawnand: Add status chack in r852_ready()
    - mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
    - sctp: detect and prevent references to a freed transport in sendmsg
      (CVE-2025-23142)
    - [arm*] thermal/drivers/rockchip: Add missing rk3328 mapping entry
    - [x86] crypto: ccp - Fix check for the primary ASP device
    - dm-integrity: set ti->error on memory allocation failure
    - ftrace: Add cond_resched() to ftrace_graph_set_hash()
    - [arm64] gpio: zynq: Fix wakeup source leaks on device unbind
    - of/irq: Fix device node refcount leakages in of_irq_count()
    - of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
    - of/irq: Fix device node refcount leakages in of_irq_init()
    - [arm64] PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe()
    - PCI: Fix reference leak in pci_alloc_child_bus()
    - [arm64] pinctrl: qcom: Clear latched interrupt status when changing IRQ
      type
    - [x86] e820: Fix handling of subpage regions when calculating nosave
      ranges in e820__register_nosave_regions()
    - Bluetooth: hci_uart: Fix another race during initialization
    - [armhf] HSI: ssi_protocol: Fix use after free vulnerability in
      ssi_protocol
      Driver Due to Race Condition (CVE-2025-37838)
    - wifi: at76c50x: fix use after free access in at76_disconnect
      (CVE-2025-37796)
    - wifi: mac80211: Purge vif txq in ieee80211_do_stop() (CVE-2025-37794)
    - [arm*] wifi: wl1251: fix memory leak in wl1251_tx_work
    - scsi: iscsi: Fix missing scsi_host_put() in error path
    - [amd64] RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
    - [arm64] RDMA/hns: Fix wrong maximum DMA segment size
    - RDMA/core: Silence oversized kvmalloc() warning (CVE-2025-37867)
    - Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid
      address
    - Bluetooth: btrtl: Prevent potential NULL dereference (CVE-2025-37792)
    - igc: handle the IGC_PTP_ENABLED flag correctly
    - igc: cleanup PTP module if probe fails
    - net: openvswitch: fix nested key length validation in the set() action
      (CVE-2025-37789)
    - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
      (CVE-2025-37788)
    - [armhf] net: b53: enable BPDU reception for management port
    - cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
    - writeback: fix false warning in inode_to_wb()
    - [x86] asus-laptop: Fix an uninitialized variable
    - nfsd: decrease sc_count directly if fail to queue dl_recall
      (CVE-2025-37871)
    - btrfs: correctly escape subvol in btrfs_show_options()
    - hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
      (CVE-2025-37782)
    - [arm*] i2c: cros-ec-tunnel: defer probe if parent EC is not present
      (CVE-2025-37781)
    - isofs: Prevent the use of too small fid (CVE-2025-37780)
    - tracing: Fix filter string testing (regression in 5.10.104)
    - virtiofs: add filesystem context source name check (CVE-2025-37773)
    - [x86] perf/x86/intel: Allow to update user space GPRs from PEBS records
    - [x86] perf/x86/intel/uncore: Fix the scale of IIO free running counters
      on SNR
    - [x86] perf/x86/intel/uncore: Fix the scale of IIO free running counters
      on ICX
    - module: sign with sha512 instead of sha1 by default
    - drm/amd/pm/powerplay: Prevent division by zero (CVE-2025-37770)
    - drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
      (CVE-2025-37768)
    - drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
      (CVE-2025-37766)
    - drm/nouveau: prime: fix ttm_bo_delayed_delete oops (CVE-2025-37765)
    - cpufreq: Reference count policy in cpufreq_update_limits()
    - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
      (CVE-2024-50154)
    - mptcp: fix NULL pointer in can_accept_new_subflow (CVE-2025-23145)
    - misc: pci_endpoint_test: Avoid issue of interrupts remaining after
      request_irq error (CVE-2025-23140)
    - [amd64] pvh: Call C code via the kernel virtual mapping
    - nvme: avoid double free special payload (CVE-2024-41073)
    - [aem*] phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node
      function
    - wifi: ath10k: avoid NULL pointer error during sdio remove
      (CVE-2024-56599)
    - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than
      max_links (CVE-2024-46816)
    - [x86] drm/amd/display: Fix out-of-bounds access in
      'dcn21_link_encoder_create' (CVE-2024-56608)
    - smb: client: fix potential UAF in cifs_debug_files_proc_show()
      (CVE-2024-26928)
    - smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
      (CVE-2023-52752)
    - cifs: Fix UAF in cifs_demultiplex_thread() (CVE-2023-52572)
    - smb: client: fix potential deadlock when releasing mids (CVE-2023-52757)
    - smb: client: fix potential UAF in cifs_stats_proc_show() (CVE-2024-35867)
    - smb: client: fix UAF in async decryption (CVE-2024-50047)
    - smb: client: fix NULL ptr deref in crypto_aead_setkey()
    - bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)
    - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
      (CVE-2023-52621)
    - blk-cgroup: support to track if policy is online
    - blk-iocost: do not WARN if iocg was already offlined (CVE-2024-36908)
    - ext4: fix timer use-after-free on failed mount (CVE-2024-49960)
    - net/mlx5e: Fix use-after-free of encap entry in neigh update handler
      (CVE-2021-47247)
    - ipvs: properly dereference pe in ip_vs_add_service (CVE-2024-42322)
    - net: openvswitch: fix race on port output
    - openvswitch: fix lockup on tx to unregistering netdev with carrier
    - scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan()
    - scsi: ufs: bsg: Set bsg_queue to NULL after removal (CVE-2024-54458)
    - net: defer final 'struct net' free in netns dismantle (CVE-2024-56658)
    - jfs: Fix shift-out-of-bounds in dbDiscardAG (CVE-2024-44938)
    - dm cache: fix flushing uninitialized delayed_work on cache_ctr error
      (CVE-2024-50280) (regression in 5.10.163)
    - vfio/pci: fix memory leak during D3hot to D0 transition (CVE-2022-49219)
    - kernel/resource: fix kfree() of bootmem memory again (CVE-2022-49190)
    - [x86] drm/i915/gt: Cleanup partial engine discovery failures
      (CVE-2022-48893)
    - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children
      stats (CVE-2024-26686)
    - mm: fix apply_to_existing_page_range()
    - [x86] drivers: staging: rtl8723bs: Fix deadlock in
      rtw_surveydone_event_callback() (CVE-2022-49309)
    - [armhf] pmdomain: ti: Add a null pointer check to the
      omap_prm_domain_init (CVE-2024-35943)
    - [x86] drivers: staging: rtl8723bs: Fix locking in
      rtw_scan_timeout_handler()
    - tracing: Allow synthetic events to pass around stacktraces
    - tracing: Fix synth event printk format for str fields
    - media: streamzap: remove unnecessary ir_raw_event_reset and handle
    - media: streamzap: no need for usb pid/vid in device name
    - media: streamzap: less chatter
    - media: streamzap: remove unused struct members
    - media: streamzap: fix race between device disconnection and urb callback
      (CVE-2025-22027)
    - [arm64] media: venus: venc: Init the session only once in queue_setup
    - [arm64] media: venus: Limit HFI sessions to the maximum supported
    - [arm64] media: venus: hfi: Correct session init return error
    - [arm64] media: venus: pm_helpers: Check instance state when calculate
      instance frequency
    - [arm64] media: venus: Create hfi platform and move vpp/vsp there
    - [arm64] media: venus: Rename venus_caps to hfi_plat_caps
    - [arm64] media: venus: hfi_plat: Add codecs and capabilities ops
    - [arm64] media: venus: Get codecs and capabilities from hfi platform
    - [arm64] media: venus: hfi_parser: refactor hfi packet parsing logic
      (CVE-2025-23156)
    - [arm*] net: dsa: mv88e6xxx: fix VTU methods for 6320 family
    - [armhf] soc: samsung: exynos-chipid: initialize later - with
      arch_initcall
    - [armhf] soc: samsung: exynos-chipid: convert to driver and merge
      exynos-asv
    - [armhf] soc: samsung: exynos-chipid: avoid soc_device_to_device()
    - [armhf] soc: samsung: exynos-chipid: Pass revision reg offsets
    - [armhf] soc: samsung: exynos-chipid: Add NULL pointer check in
      exynos_chipid_probe() (CVE-2025-23148)
    - iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary
      return value check
    - iio: adc: ad7768-1: Fix conversion result sign
    - backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
      (CVE-2025-23144)
    - cifs: print TIDs as hex
    - cifs: avoid NULL pointer dereference in dbg call (CVE-2025-37844)
    - PCI: Introduce domain_nr in pci_host_bridge
    - PCI: Coalesce host bridge contiguous apertures
    - PCI: Assign PCI domain IDs by ida_alloc()
    - PCI: Fix reference leak in pci_register_host_bridge() (CVE-2025-37836)
    - drm/amd/amdgpu/amdgpu_vram_mgr: Add missing descriptions for 'dev' and
      'dir'
    - drm/amdgpu: Remove amdgpu_device arg from free_sgt api (v2)
    - drm/amdgpu/dma_buf: fix page_link check
    - [arm*] cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
      (CVE-2025-37829)
    - net: phy: leds: fix memory leak
    - tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
      (CVE-2025-37824)
    - net_sched: hfsc: Fix a UAF vulnerability in class handling
      (CVE-2025-37797)
    - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
      (CVE-2025-37823)
    - [amd64] iommu/amd: Return an error if vCPU affinity is set for non-vCPU
      IRTE
    - virtio_console: fix missing byte order handling for cols and rows
    - [x86] KVM: SVM: Allocate IR data using atomic allocation
    - mcb: fix a double free bug in chameleon_parse_gdd() (CVE-2025-37817)
    - USB: storage: quirk for ADATA Portable HDD CH94
    - [x86] mei: me: add panther lake H DID
    - [x86] KVM: x86: Reset IRTE to host control if *new* route isn't postable
      (CVE-2025-37885)
    - USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
    - USB: serial: option: add Sierra Wireless EM9291
    - USB: serial: simple: add OWON HDS200 series oscilloscope support
    - usb: cdns3: Fix deadlock when using NCM gadget (CVE-2025-37812)
    - [arm*] usb: dwc3: gadget: check that event count does not exceed event
      buffer length (CVE-2025-37810)
    - usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
    - usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
    - USB: VLI disk crashes if LPM is used
    - crypto: null - Use spin lock instead of mutex (CVE-2025-37808)
    - clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
    - [armhf] usb: gadget: aspeed: Add NULL pointer check in
      ast_vhub_init_dev() (CVE-2025-37881)
    - [amd64] qibfs: fix _another_ leak
    - udmabuf: fix a buf size overflow issue during udmabuf creation
      (CVE-2025-37803)
    - nvme: requeue namespace scan on missed AENs
    - [arm64] ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
    - nvme: re-read ANA log page after ns scan completes
    - [amd64] objtool: Stop UNRET validation on UD2
    - [x86] bugs: Use SBPB in write_ibpb() if applicable
    - [x86] bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
    - ext4: make block validity check resistent to sb bh corruption
    - scsi: pm80xx: Set phy_attached to zero when device is gone
    - md/raid1: Add check for missing source disk in process_checks()
    - [x86] comedi: jr3_pci: Fix synchronous deletion of timer
    - xdp: Reset bpf_redirect_info before running a xdp's BPF prog.
    - nvme: fixup scan failure for non-ANA multipath controllers
    - PCI: Fix use-after-free in pci_bus_release_domain_nr()
    - [armhf] soc: samsung: exynos-chipid: correct helpers __init annotation
    - [arm64] media: venus: Fix uninitialized variable count being checked for
      zero
    - [arm64] media: venus: hfi_parser: Check for instance after hfi platform
      get

  [ Ben Hutchings ]
  * Bump ABI to 35
  * d/b/genpatch-rt: Fix subprocess cleanup with Python 3.13
  * [rt] Update to 5.10.237-rt131:
    - u64_stats: Introduce u64_stats_set()
    - netfilter: nft_counter: Use u64_stats_t for statistic.
    - rt: fix build issue in at_hdmac
    - rt: fix build issue in be2net
  * d/salsa-ci.yml: Run lintian from the target release, not always unstable
  * Revert "d/salsa-ci.yml: Suppress aliased-location lintian errors"
  * linux-signed-*: lintian: Correct overrides for bullseye:
    - Adjust override of version-substvar-for-external-package
    - Add override for copyright-excludes-files-in-native-package

  [ Salvatore Bonaccorso ]
  * d/b/genpatch-rt: Drop now unused 'io' module.

 -- Ben Hutchings <benh@debian.org>  Mon, 19 May 2025 19:24:37 +0200

linux (5.10.234-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.227
    - [arm*] usb: dwc3: Decouple USB 2.0 L1 & L2 events
    - [arm*] usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error
      after resume bug
    - [arm*] usb: dwc3: core: update LC timer as per USB Spec V3.2
    - usbnet: ipheth: fix carrier detection in modes 1 and 4
    - net: phy: vitesse: repair vsc73xx autonegotiation
    - btrfs: update target inode's ctime on unlink
    - Input: ads7846 - ratelimit the spi_sync error message
    - [x86] Input: synaptics - enable SMBus for HP Elitebook 840 G2
    - [arm64] drm/msm/adreno: Fix error return if missing firmware-name
    - [x86] Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
    - NFS: Avoid unnecessary rescanning of the per-server delegation list
    - [arm64] dts: rockchip: override BIOS_DISABLE signal via GPIO hog on
      RK3399 Puma
    - hwmon: (pmbus) Introduce and use write_byte_data callback
    - hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev
      >= 1.2
    - ice: fix accounting for filters shared by multiple VSIs
    - net/mlx5: Update the list of the PCI supported devices
    - net/mlx5e: Add missing link modes to ptys2ethtool_map
    - fou: fix initialization of grc (CVE-2024-46865)
    - [armhf] net: ftgmac100: Enable TX interrupt to avoid TX timeout
    - [arm64] net: dpaa: Pad packets to ETH_ZLEN (CVE-2024-46854)
    - [arm64] spi: nxp-fspi: fix the KASAN report out-of-bounds bug
      (CVE-2024-46853)
    - soundwire: stream: Revert "soundwire: stream: fix programming slave ports
      for non-continous port maps" (regression in 5.10.225)
    - [arm*] ASoC: meson: axg-card: fix 'use-after-free' (CVE-2024-46849)
    - dma-buf: heaps: Fix off-by-one in CMA heap fault handler
    - ALSA: hda/realtek - Fixed ALC256 headphone no sound
    - ALSA: hda/realtek - FIxed ALC285 headphone no sound
    - [armhf] net: ftgmac100: Ensure tx descriptor updates are visible
    - wifi: iwlwifi: lower message level for FW buffer destination
    - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
      (CVE-2024-47672)
    - [x86] hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides
      frequency
    - ocfs2: add bounds checking to ocfs2_xattr_find_entry() (CVE-2024-47670)
    - ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
      (CVE-2024-41016)
    - netfilter: nft_set_pipapo: walk over current view on netlink dump
      (CVE-2024-27017)
    - netfilter: nf_tables: missing iterator type in lookup walk
    - gpio: prevent potential speculation leaks in gpio_device_get_desc()
      (CVE-2024-44931)
    - mptcp: pm: Fix uaf in __timer_delete_sync (CVE-2024-46858)
    - inet: inet_defrag: prevent sk release while still in use (CVE-2024-26921)
    - [x86] ibt,ftrace: Search for __fentry__ location
    - ftrace: Fix possible use-after-free issue in ftrace_location()
      (CVE-2024-38588)
    - gpiolib: cdev: Ignore reconfiguration without direction
    - USB: serial: pl2303: add device id for Macrosilicon MS3020
    - USB: usbtmc: prevent kernel-usb-infoleak (CVE-2024-47671)
    - wifi: rtw88: always wait for both firmware loading attempts
      (CVE-2024-47718)
    - fs: explicitly unregister per-superblock BDIs
    - mount: warn only once about timestamp range expiration
    - fs/namespace: fnic: Switch to use %ptTd
    - mount: handle OOM on mnt_warn_timestamp_expiry
    - padata: Honor the caller's alignment in case of chunk_size 0
    - can: j1939: use correct function name in comment
    - netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
    - netfilter: nf_tables: reject element expiration with no timeout
    - netfilter: nf_tables: reject expiration higher than timeout
    - [armhf] cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails
      appropriately
    - wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
    - wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
    - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
      (CVE-2024-47713)
    - wifi: wilc1000: fix potential RCU dereference issue in
      wilc_parse_join_bss_param (CVE-2024-47712)
    - sock_map: Add a cond_resched() in sock_hash_free() (CVE-2024-47710)
    - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
      (CVE-2024-47709)
    - Bluetooth: btusb: Fix not handling ZPL/short-transfer
    - net: geneve: support IPv4/IPv6 as inner protocol
    - geneve: Fix incorrect inner network header offset when innerprotoinherit
      is set
    - [arm64] net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
    - r8169: disable ALDPS per default for RTL8125
    - net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
    - net: tipc: avoid possible garbage value
    - block, bfq: fix possible UAF for bfqq->bic with merge chain
      (CVE-2024-47706)
    - block, bfq: choose the last bfqq from merge chain in
      bfq_setup_cooperator()
    - block, bfq: don't break merge chain in bfq_split_bfqq()
    - block: print symbolic error name instead of error code
    - block: fix potential invalid pointer dereference in blk_add_partition
      (CVE-2024-47705)
    - hwmon: (max16065) Fix overflows seen when writing limits
    - device property: Add const qualifier to device_get_match_data() parameter
    - i2c: Add i2c_get_match_data()
    - hwmon: (max16065) Remove use of i2c_match_id()
    - hwmon: (max16065) Fix alarm attributes
    - [x86] mtd: slram: insert break after errors in parsing the map
    - hwmon: (ntc_thermistor) fix module autoloading
    - [arm*] power: supply: axp20x_battery: allow disabling battery charging
    - [arm*] power: supply: axp20x_battery: Remove design from min and max
      voltage
    - [x86] power: supply: max17042_battery: Fix SOC threshold calc w/ no
      current sense
    - [armhf] drm/stm: Fix an error handling path in stm_drm_platform_probe()
    - drm/amdgpu: Replace one-element array with flexible-array member
    - drm/amdgpu: properly handle vbios fake edid sizing
    - drm/radeon: Replace one-element array with flexible-array member
    - drm/radeon: properly handle vbios fake edid sizing
    - [arm*] drm/rockchip: vop: Allow 4096px width scaling
    - [arm*] drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
    - drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
    - jfs: fix out-of-bounds in dbNextAG() and diAlloc() (CVE-2024-47723)
    - [arm64] drm/msm: Fix incorrect file name output in adreno_request_fw()
    - [arm64] drm/msm/a5xx: disable preemption in submits by default
    - [arm64] drm/msm/a5xx: properly clear preemption records on resume
    - [arm64] drm/msm/a5xx: fix races in preemption evaluation stage
    - [arm64] drm/msm: Add priv->mm_lock to protect active/inactive lists
    - [arm64] drm/msm: Drop priv->lastctx
    - [arm64] drm/msm/a5xx: workaround early ring-buffer emptiness check
    - [arm64] drm/msm: fix %s null argument error
    - [x86] xen: use correct end address of kernel for conflict checking
    - xen/swiotlb: add alignment check for dma buffers
    - tpm: Clean up TPM space after command failure (CVE-2024-49851)
    - xz: cleanup CRC32 edits from 2018
    - kthread: add kthread_work tracepoints
    - kthread: fix task state in kthread worker if being frozen
    - ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
    - ext4: avoid buffer_head leak in ext4_mark_inode_used()
    - ext4: avoid potential buffer_head leak in __ext4_new_inode()
    - ext4: avoid negative min_clusters in find_group_orlov()
    - ext4: return error on ext4_find_inline_entry
    - ext4: avoid OOB when system.data xattr changes underneath the filesystem
      (CVE-2024-47701)
    - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
      (CVE-2024-47699)
    - nilfs2: determine empty node blocks as corrupted
    - nilfs2: fix potential oob read in nilfs_btree_check_delete()
      (CVE-2024-47757)
    - bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
    - perf sched timehist: Fix missing free of session in
      perf_sched__timehist()
    - perf sched timehist: Fixed timestamp error when unable to confirm event
      sched_in time
    - perf time-utils: Fix 32-bit nsec parsing
    - [arm64] clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
    - [arm*] clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
    - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
      (CVE-2024-47698)
    - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
      (CVE-2024-47697)
    - [arm*] PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
      (CVE-2024-47756)
    - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
      (CVE-2024-47696)
    - [arm*] pinctrl: single: fix missing error code in pcs_probe()
    - [armhf] clk: ti: dra7-atl: Fix leak of of_nodes
    - nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
    - nfsd: fix refcount leak when file is unhashed after being found
    - [armhf] pinctrl: mvebu: Use devm_platform_get_and_ioremap_resource()
    - [armhf] pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
    - [arm64] RDMA/hns: Add mapped page count checking for MTR
    - [arm64] RDMA/hns: Refactor root BT allocation for MTR
    - [arm64] RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
    - [arm64] RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
      (CVE-2024-47735)
    - [arm64] RDMA/hns: Optimize hem allocation performance
    - RDMA/cxgb4: Added NULL check for lookup_atid (CVE-2024-47749)
    - nfsd: call cache_put if xdr_reserve_space returns NULL (CVE-2024-47737)
    - nfsd: return -EINVAL when namelen is 0 (CVE-2024-47692)
    - f2fs: enhance to update i_mode and acl atomically in f2fs_setattr()
    - f2fs: fix to update i_ctime in __f2fs_setxattr()
    - f2fs: remove unneeded check condition in __f2fs_setxattr()
    - f2fs: reduce expensive checkpoint trigger frequency
    - iio: adc: ad7606: fix oversampling gpio array
    - iio: adc: ad7606: fix standby gpio state to match the documentation
    - vdpa: Add eventfd for the vdpa callback
    - vhost_vdpa: assign irq bypass producer token correctly (CVE-2024-47748)
    - Revert "dm: requeue IO if mapping table not yet available" (regression in
      5.10.111)
    - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
      (CVE-2024-47685)
    - tcp: check skb is non-NULL in tcp_rto_delta_us() (CVE-2024-47684)
    - net: qrtr: Update packets cloning when broadcasting
    - netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
    - drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
    - selinux,smack: don't bypass permissions check in inode_setsecctx hook
      (CVE-2024-46695)
    - ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
    - [x86] Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk
      table
    - [x86] Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk
      table
    - [x86] Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD
      line
    - drm/amd/display: Round calculated vtotal
    - USB: appledisplay: close race between probe and completion handler
    - USB: misc: cypress_cy7c63: check for short transfer
    - USB: class: CDC-ACM: fix race between get_serial and set_serial
    - firmware_loader: Block path traversal (CVE-2024-47742)
    - tty: rp2: Fix reset with non forgiving PCIe host bridges
    - [amd64] crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS
      failure
    - drbd: Fix atomicity violation in drbd_uuid_set_bm()
    - drbd: Add NULL check for net_conf to prevent dereference in state
      validation
    - ACPI: sysfs: validate return type of _STR method (CVE-2024-49860)
    - [x86] ACPI: resource: Add another DMI match for the TongFang GMxXGxx
    - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
      (CVE-2024-49858)
    - [x86] perf/x86/intel/pt: Fix sampling synchronization
    - wifi: rtw88: 8822c: Fix reported RX band width
    - f2fs: prevent possible int overflow in dir_block_index()
    - f2fs: avoid potential int overflow in sanity_check_area_boundary()
    - [arm64] dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency
    - [arm64] dts: rockchip: Correct the Pinebook Pro battery design capacity
    - vfs: fix race between evice_inodes() and find_inode()&iput()
      (CVE-2024-47679)
    - fs: Fix file_set_fowner LSM hook inconsistencies
    - nfs: fix memory leak in error path of nfs4_do_reclaim
    - padata: use integer wrap around to prevent deadlock on seq_nr overflow
      (CVE-2024-47739)
    - [arm64] PCI: xilinx-nwl: Use irq_data_get_irq_chip_data()
    - [arm64] PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
    - USB: misc: yurex: fix race between read and write
    - pps: remove usage of the deprecated ida_simple_xx() API
    - pps: add an error check in parport_attach
    - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.
    - [armhf] i2c: aspeed: Update the stop sw state when the bus recovery
      occurs
    - i2c: isch: Add missed 'else'
    - usb: yurex: Fix inconsistent locking bug in yurex_read()
    - [arm*] mailbox: bcm2835: Fix timeout during suspend mode (CVE-2024-49963)
    - ceph: remove the incorrect Fw reference check when dirtying pages
      (CVE-2024-50179)
    - net/mlx5: Fix error path in multi-packet WQE transmit (CVE-2024-50001)
    - net/mlx5: Added cond_resched() to crdump collection
    - netfilter: nf_tables: prevent nf_skb_duplicated corruption
      (CVE-2024-49952)
    - Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
    - net: avoid potential underflow in qdisc_pkt_len_init() with UFO
      (CVE-2024-49949) (regression in 5.10.82)
    - net: add more sanity checks to qdisc_pkt_len_init() (CVE-2024-49948)
    - ipv4: ip_gre: Fix drops of small packets in ipgre_xmit (regresion in
      5.10.204)
    - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
      (CVE-2024-49944)
    - media: usbtv: Remove useless locks in usbtv_video_free() (CVE-2024-27072)
    - Bluetooth: L2CAP: Fix not validating setsockopt user input
      (CVE-2024-35965)
    - ALSA: mixer_oss: Remove some incorrect kfree_const() usages
    - ALSA: hda/realtek: Fix the push button function for the ALC257
    - ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
    - [x86] ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
      (regression in 5.10.226)
    - f2fs: Require FMODE_WRITE for atomic write ioctls (CVE-2024-47740)
    - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
      (CVE-2024-49938)
    - ice: Adjust over allocation of memory in ice_sched_add_root_node() and
      ice_sched_add_node()
    - net/xen-netback: prevent UAF in xenvif_flush_hash() (CVE-2024-49936)
    - [arm64] net: hisilicon: hip04: fix OF node leak in probe()
    - [arm64] net: hisilicon: hns_dsaf_mac: fix OF node leak in
      hns_mac_get_info()
    - [arm64] net: hisilicon: hns_mdio: fix OF node leak in probe()
    - ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
    - ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
    - net: sched: consistently use rcu_replace_pointer() in taprio_change()
      (CVE-2024-50127)
    - blk_iocost: fix more out of bound shifts (CVE-2024-49933)
    - wifi: ath11k: fix array out-of-bound access in SoC stats (CVE-2024-49930)
    - ACPI: EC: Do not release locks during operation region accesses
    - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in
      acpi_db_convert_to_package() (CVE-2024-49962)
    - tipc: guard against string buffer overrun (CVE-2024-49995)
    - [arm*] net: mvpp2: Increase size of queue_name buffer
    - ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
    - ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
    - net: atlantic: Avoid warning about potential string truncation
    - tcp: avoid reusing FIN_WAIT2 when trying to find port in connect()
      process
    - ACPICA: iasl: handle empty connection_node
    - proc: add config & param to block forcing mem writes
    - wifi: mwifiex: Fix memcpy() field-spanning write warning in
      mwifiex_cmd_802_11_scan_ext() (CVE-2024-50008)
    - nfp: Use IRQF_NO_AUTOEN flag in request_irq()
    - signal: Replace BUG_ON()s
    - ALSA: usb-audio: Add logitech Audio profile quirk
    - [x86] ALSA: asihpi: Fix potential OOB array access (CVE-2024-50007)
    - ALSA: hdsp: Break infinite MIDI input flush loop
    - [i386] syscall: Avoid memcpy() for ia32 syscall_get_arguments()
    - [arm*] iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
    - [amd64] iommu/vt-d: Always reserve a domain ID for identity setup
    - [amd64] iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0
      count
    - drm/amd/display: Add null check for top_pipe_to_program in
      commit_planes_for_stream (CVE-2024-49913)
    - ata: sata_sil: Rename sil_blacklist to sil_quirks
    - drm/amd/display: Check null pointers before using dc->clk_mgr
      (CVE-2024-49907)
    - jfs: UBSAN: shift-out-of-bounds in dbFindBits
    - jfs: Fix uaf in dbFreeBits (CVE-2024-49903)
    - jfs: check if leafidx greater than num leaves per dmap tree
      (CVE-2024-49902)
    - jfs: Fix uninit-value access of new_ea in ea_buffer (CVE-2024-49900)
    - [x86] drm/amdgpu: add raven1 gfxoff quirk
    - [x86] drm/amdgpu: enable gfxoff quirk on HP 705G4
    - drm/amd/display: Check stream before comparing them (CVE-2024-49896)
    - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format
      translation (CVE-2024-49895)
    - drm/amd/display: Fix index out of bounds in degamma hardware format
      translation (CVE-2024-49894)
    - drm/amd/display: Fix index out of bounds in DCN30 color transformation
      (CVE-2024-49969)
    - drm/amd/display: Initialize get_bytes_per_element's default to 1
      (CVE-2024-49892_
    - drm/printer: Allow NULL data in devcoredump printer
    - scsi: aacraid: Rearrange order of struct aac_srb_unit
    - drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
    - drm/amd/pm: ensure the fw_info is not null before using it
      (CVE-2024-49890)
    - of/irq: Refer to actual buffer size in of_irq_parse_one()
    - ext4: ext4_search_dir should return a proper error
    - ext4: avoid use-after-free in ext4_ext_show_leaf() (CVE-2024-49889)
    - ext4: fix i_data_sem unlock order in ext4_ind_migrate() (CVE-2024-50006)
    - [armhf] spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm
      enabled
    - [armhf] i2c: stm32f7: Do not prepare/unprepare clock during runtime
      suspend/resume (CVE-2024-49985)
    - perf/core: Fix small negative period being ignored
    - drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
    - ALSA: core: add isascii() check to card ID generator
    - ALSA: line6: add hw monitor volume control to POD HD500X
    - [x86] ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
    - ext4: no need to continue when the number of entries is 1
    - ext4: fix slab-use-after-free in ext4_split_extent_at() (CVE-2024-49884)
    - ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
    - ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
    - ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
      (CVE-2024-49983)
    - ext4: aovid use-after-free in ext4_ext_insert_extent() (CVE-2024-49883)
    - ext4: fix double brelse() the buffer of the extents path (CVE-2024-49882)
    - ext4: update orig_path in ext4_find_extent() (CVE-2024-49881)
    - ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
    - of/irq: Support #msi-cells=<0> in of_msi_get_domain
    - [armhf] drm: omapdrm: Add missing check for alloc_ordered_workqueue
      (CVE-2024-49879)
    - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns
      error (CVE-2024-49959)
    - jbd2: correctly compare tids with tid_geq function in
      jbd2_fc_begin_commit
    - mm: krealloc: consider spare memory for __GFP_ZERO
    - ocfs2: fix uninit-value in ocfs2_get_block()
    - ocfs2: reserve space for inline xattr before attaching reflink tree
      (CVE-2024-49958)
    - ocfs2: cancel dqi_sync_work before freeing oinfo (CVE-2024-49966)
    - ocfs2: remove unreasonable unlock in ocfs2_read_blocks (CVE-2024-49965)
    - ocfs2: fix null-ptr-deref when journal load failed. (CVE-2024-49957)
    - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
      (CVE-2024-49877)
    - exfat: fix memory leak in exfat_load_bitmap() (CVE-2024-50013)
    - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
    - nfsd: map the EBADMSG to nfserr_io to avoid warning (CVE-2024-49875)
    - NFSD: Fix NFSv4's PUTPUBFH operation
    - aoe: fix the potential use-after-free problem in more places
      (CVE-2024-49982)
    - [arm*] clk: rockchip: fix error for unknown clocks
    - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
    - [arm64] media: venus: fix use after free bug in venus_remove due to race
      condition (CVE-2024-49981)
    - iio: magnetometer: ak8975: Fix reading for ak099xx sensors
    - tomoyo: fallback to realpath if symlink's pathname does not exist
      (Closes: #1082001)
    - net: stmmac: Fix zero-division error when disabling tc cbs
      (CVE-2024-49977)
    - [x86] ACPI: resource: Add Asus Vivobook X1704VAP to
      irq1_level_low_skip_override[]
    - [x86] ACPI: resource: Add Asus ExpertBook B2502CVA to
      irq1_level_low_skip_override[]
    - btrfs: fix a NULL pointer dereference when failed to start a new
      trasacntion (CVE-2024-49868)
    - btrfs: wait for fixup workers before stopping cleaner kthread during
      umount (CVE-2024-49867)
    - drm/sched: Add locking to drm_sched_entity_modify_sched
    - kconfig: qconf: fix buffer overflow in debug links
    - ext4: properly sync file size update after O_SYNC direct IO
    - ext4: dax: fix overflowing extents beyond inode size when partially
      writing (CVE-2024-50015)
    - [arm64] Add Cortex-715 CPU part definition
    - [arm64] cputype: Add Neoverse-N3 definitions
    - [arm64] errata: Expand speculative SSBS workaround once more
    - uprobes: fix kernel info leak via "[uprobes]" vma (CVE-2024-49975)
    - [arm64] drm/rockchip: define gamma registers for RK3399
    - [arm64] drm/rockchip: support gamma control on RK3399
    - [armhf] drm/rockchip: vop: clear DMA stop bit on RK3066
    - r8169: add tally counter fields added with RTL8125 (CVE-2024-49973)
    - ACPI: battery: Simplify battery hook locking
    - ACPI: battery: Fix possible crash when unregistering a battery hook
      (CVE-2024-49955)
    - ext4: fix inode tree inconsistency caused by ENOMEM
    - vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() (CVE-2024-49863)
    - tracing: Remove precision vsnprintf() check from print event
    - drm/crtc: fix uninitialized variable use even harder (regression in
      5.10.209)
    - tracing: Have saved_cmdlines arrays all in one allocation
    - virtio_console: fix misc probe bugs
    - kallsyms: Make kallsyms_on_each_symbol generally available
    - kallsyms: Make module_kallsyms_on_each_symbol generally available
    - tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols
    - tracing/kprobes: Fix symbol counting logic by looking at modules as well
    - Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
    - bpf: Check percpu map value size first
    - ext4: nested locking for xattr inode
    - RDMA/mad: Improve handling of timed out WRs of mad agent (CVE-2024-50095)
    - PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
    - [arm64] PCI: Add ACS quirk for Qualcomm SA8775P
    - [x86] i2c: i801: Use a different adapter-name for IDF adapters
    - PCI: Mark Creative Labs EMU20k2 INTx masking as broken
    - ntb: ntb_hw_switchtec: Fix use after free vulnerability in
      switchtec_ntb_remove due to race condition (CVE-2024-50059)
    - media: videobuf2-core: clear memory related fields in
      __vb2_plane_dmabuf_put()
    - [armhf] clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
      (CVE-2024-50181)
    - [arm*] usb: chipidea: udc: enable suspend interrupt after usb reset
    - [arm*] usb: dwc2: Adjust the timing of USB Driver Interrupt Registration
      in the Crashkernel Scenario
    - virtio_pmem: Check device status before requesting flush (CVE-2024-50184)
    - driver core: bus: Return -EIO instead of 0 when show/store invalid bus
      attribute
    - drm/amd/display: Check null pointer before dereferencing se
      (CVE-2024-50049)
    - [x86] fbdev: sisfb: Fix strbuf array overflow (CVE-2024-50180)
    - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (CVE-2024-38544)
    - NFSD: Mark filecache "down" if init fails
    - ice: fix VLAN replay after reset
    - SUNRPC: Fix integer overflow in decode_rc_list()
    - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
      (CVE-2024-50046)
    - net: phy: dp83869: fix memory corruption when enabling fiber
      (CVE-2024-50188)
    - tcp: fix to allow timestamp undo if no retransmits were sent
    - tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
    - netfilter: br_netfilter: fix panic with metadata_dst skb (CVE-2024-50045)
    - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
      (CVE-2024-50044)
    - [armhf] net: dsa: b53: fix jumbo frame mtu check
    - [armhf] net: dsa: b53: fix max MTU for 1g switches
    - [armhf] net: dsa: b53: fix max MTU for BCM5325/BCM5365
    - [armhf] net: dsa: b53: allow lower MTUs on BCM5325/5365
    - [armhf] net: dsa: b53: fix jumbo frames on 10/100 ports
    - [armhf] gpio: aspeed: Add the flush write to ensure the write complete.
    - [armhf] gpio: aspeed: Use devm_clk api to manage clock source
    - igb: Do not bring the device up after non-fatal error (CVE-2024-50040)
    - net/sched: accept TCA_STAB only for root qdisc (CVE-2024-50039)
    - sctp: ensure sk_state is set to CLOSED if hashing fails in
      sctp_listen_start
    - net: Add l3mdev index to flow struct and avoid oif reset for port devices
    - netfilter: rpfilter/fib: Populate flowic_l3mdev field
    - netfilter: rpfilter/fib: Set ->flowic_uid correctly for user namespaces.
    - netfilter: fib: check correct rtable in vrf setups
    - ppp: fix ppp_async_encode() illegal access (CVE-2024-50035)
    - slip: make slhc_remember() more robust against malicious packets
      (CVE-2024-50033)
    - resource: fix region_intersects() vs add_memory_driver_managed()
      (CVE-2024-49878)
    - HID: plantronics: Workaround for an unexcepted opposite volume key
    - [arm*] usb: dwc3: core: Stop processing of pending events if controller
      is halted
    - usb: xhci: Fix problem with xhci resume from suspend
    - usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
    - net: Fix an unsafe loop on the list (CVE-2024-50024)
    - nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
      (CVE-2024-50096)
    - net: geneve: add missing netlink policy and size for
      IFLA_GENEVE_INNER_PROTO_INHERIT
    - xfrm: Pass flowi_oif or l3mdev as oif to xfrm_dst_lookup
    - net: Handle l3mdev in ip_tunnel_init_flow
    - net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using
      flowi_l3mdev
    - net: vrf: determine the dst using the original ifindex for multicast
    - netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
    - ext4: fix warning in ext4_dio_write_end_io()
    - [arm64] RDMA/hns: Fix uninitialized variable
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.228
    - [x86] ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2
    - posix-clock: Fix missing timespec64 check in pc_clock_settime()
      (CVE-2024-50195)
    - [arm64] probes: Remove broken LDR (literal) uprobe support
      (CVE-2024-50099)
    - [arm64] probes: Fix simulate_ldr*_literal()
    - [arm64] net: macb: Avoid 20s boot delay by skipping MDIO bus registration
      for fixed-link PHY
    - [arm*] irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC
      v4.1
    - fat: fix uninitialized variable
    - mm/swapfile: skip HugeTLB pages for unuse_vma (CVE-2024-50199)
    - wifi: mac80211: fix potential key use-after-free (CVE-2023-52530)
    - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
      (CVE-2024-40953)
    - io_uring/sqpoll: do not allow pinning outside of cpuset
    - io_uring/sqpoll: retain test for whether the CPU is valid
    - io_uring/sqpoll: do not put cpumask on stack
    - [x86] cpufeatures: Define X86_FEATURE_AMD_IBPB_RET
    - [x86] cpufeatures: Add a IBPB_NO_RET BUG flag
    - [x86] entry: Have entry_ibpb() invalidate return predictions
    - [x86] bugs: Skip RSB fill at VMEXIT
    - [x86] bugs: Do not use UNTRAIN_RET with IBPB on entry
    - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
      (CVE-2024-50082)
    - io_uring/sqpoll: close race on waiting for sqring entries
    - drm/radeon: Fix encoder->possible_clones (CVE-2024-50201)
    - [x86] drm/vmwgfx: Handle surface check failure correctly
    - iio: hid-sensors: Fix an error handling path in
      _hid_sensor_set_report_latency()
    - iio: light: veml6030: fix ALS sensor resolution
    - iio: light: veml6030: fix IIO device retrieval from embedded device
      (CVE-2024-50198)
    - iio: light: opt3001: add missing full-scale range value
    - Bluetooth: Remove debugfs directory on module init failure
    - Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001
    - xhci: Fix incorrect stream context type macro
    - USB: serial: option: add support for Quectel EG916Q-GL
    - USB: serial: option: add Telit FN920C04 MBIM compositions
    - parport: Proper fix for array out-of-bounds access (CVE-2024-50074)
    - [x86] resctrl: Annotate get_mem_config() functions as __init
    - [x86] apic: Always explicitly disarm TSC-deadline timer
    - [i386] x86/entry_32: Do not clobber user EFLAGS.ZF (regression in
      5.10.215)
    - [i386] x86/entry_32: Clear CPU buffers after register restore in NMI
      return (CVE-2024-50193)
    - [arm*] irqchip/gic-v4: Don't allow a VMOVP on a dying VPE
      (CVE-2024-50192)
    - mptcp: handle consistently DSS corruption (CVE-2024-50185)
    - tcp: fix mptcp DSS corruption due to large pmtu xmit (CVE-2024-50083)
    - nilfs2: propagate directory read errors from nilfs_find_entry()
      (CVE-2024-50202)
    - [x86] ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP
      EliteOne 1000 G2
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.229
    - [amd64,arm64] RDMA/bnxt_re: Add a check for memory allocation
      (CVE-2024-50209)
    - [arm*] dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
    - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
    - ipv4: give an IPv4 dev to blackhole_netdev
    - [amd64,arm64] RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
      (CVE-2024-50208)
    - [arm64] drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate
      calculation
    - macsec: don't increment counters for an unrelated SA
    - net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid
    - net: systemport: fix potential memory leak in bcm_sysport_xmit()
      (CVE-2024-50171)
    - genetlink: hold RCU in genlmsg_mcast()
    - scsi: target: core: Fix null-ptr-deref in target_alloc_device()
      (CVE-2024-50153)
    - smb: client: fix OOBs when building SMB2_IOCTL request (CVE-2024-50151)
    - usb: typec: altmode should keep reference to parent (CVE-2024-50150)
    - Bluetooth: bnep: fix wild-memory-access in proto_unregister
      (CVE-2024-50148)
    - [arm64] uprobe fix the uprobe SWBP_INSN in big-endian
    - [arm64] probes: Fix uprobes for big-endian kernels (CVE-2024-50194)
    - block, bfq: fix procress reference leakage for bfqq in merge chain
    - exec: don't WARN for racy path_noexec check (CVE-2024-50010)
    - iomap: update ki_pos a little later in iomap_dio_complete
    - [x86] drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape
      with real VLA (CVE-2024-50134)
    - [arm64] ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit
    - [arm64] Force position-independent veneers
    - jfs: Fix sanity check in dbMount
    - tracing: Consider the NULL character when validating the event length
      (CVE-2024-50131)
    - xfrm: extract dst lookup parameters into a struct
    - xfrm: respect ip protocols rules criteria when performing dst lookups
    - be2net: fix potential memory leak in be_xmit() (CVE-2024-50167)
    - net: usb: usbnet: fix name regression
    - net: sched: fix use-after-free in taprio_change()
    - r8169: avoid unsolicited interrupts
    - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
      (CVE-2024-50210)
    - ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
      (CVE-2024-50205)
    - [armhf] ASoC: stm32: spdifrx: fix dma channel release in
      stm32_spdifrx_remove (CVE-2024-50292)
    - [arm*] media: s5p-jpeg: prevent buffer overflows (CVE-2024-53061)
    - ALSA: hda/realtek: Update default depop procedure
    - drm/amd: Guard against bad data for ATIF ACPI method (CVE-2024-50117)
    - [x86] ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
    - [arm64] ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix
      initial lid detection issue
    - nilfs2: fix kernel bug due to missing clearing of buffer delay flag
      (CVE-2024-50116)
    - openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)
    - [x86] KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
      (CVE-2024-50115)
    - [x86] ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
    - [x86] hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER
      event
    - selinux: improve error checking in sel_write_load()
    - serial: protect uart_port_dtr_rts() in uart_shutdown() too
      (CVE-2024-50058)
    - net: phy: dp83822: Fix reset pin definitions
    - [arm64] ASoC: qcom: Fix NULL Dereference in
      asoc_qcom_lpass_cpu_platform_probe() (CVE-2024-50103)
    - xfrm: validate new SA's prefixlen using SA family when sel.family is
      unset (CVE-2024-50142)
    - cgroup: Fix potential overflow issue when checking max_depth
    - wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
    - RDMA/cxgb4: Dump vendor specific QP details
    - RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down
    - mac80211: do drv_reconfig_complete() before restarting all
    - mac80211: Add support to trigger sta disconnect on hardware restart
    - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
    - wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
      (CVE-2024-53059)
    - [armhf] ASoC: cs42l51: Fix some error handling paths in cs42l51_probe()
    - ipv4: ip_tunnel: Fix suspicious RCU usage warning in
      ip_tunnel_init_flow() (CVE-2024-53042)
    - gtp: allow -1 to be specified as file description from userspace
    - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (CVE-2024-53057)
    - bpf: Fix out-of-bounds write in trie_get_next_key() (CVE-2024-50262)
    - net: support ip generic csum processing in skb_csum_hwoffload_help
    - net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
    - netfilter: nft_payload: sanitize offset and length before calling
      skb_checksum() (CVE-2024-50251)
    - NFS: remove revoked delegation from server's delegation list
    - usbip: tools: Fix detach_port() invalid port error path
    - usb: phy: Fix API devm_usb_put_phy() can not release the phy
    - xhci: Fix Link TRB DMA in command ring stopped completion event
    - xhci: Use pm_runtime_get to prevent RPM on unsupported systems
    - Revert "driver core: Fix uevent_show() vs driver detach race" (regression
      in 5.10.224)
    - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
      (CVE-2024-50237)
    - wifi: ath10k: Fix memory leak in management tx (CVE-2024-50236)
    - wifi: iwlegacy: Clear stale interrupts before resuming device
      (CVE-2024-50234)
    - staging: iio: frequency: ad9832: fix division by zero in
      ad9832_calc_freqreg() (CVE-2024-50233)
    - iio: light: veml6030: fix microlux value calculation
    - nilfs2: fix potential deadlock with newly created symlinks
      (CVE-2024-50229)
    - mm: add remap_pfn_range_notrack
    - mm: avoid leaving partial pfn mappings around in error case
      (CVE-2024-47674)
    - ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow (CVE-2024-50218)
    - [i386] bugs: Use code segment selector for VERW operand (CVE-2024-50072)
    - nilfs2: fix kernel bug due to missing clearing of checked flag
      (CVE-2024-50230)
    - mm: shmem: fix data-race in shmem_getattr()
    - Revert "drm/mipi-dsi: Set the fwnode for mipi_dsi_device" (regression
      in 5.10.181)
    - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
      (CVE-2024-39497)
    - vt: prevent kernel-infoleak in con_font_get()
    - mac80211: always have ieee80211_sta_restart()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.230
    - [arm64] dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-
      excavator
    - [arm64] dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
    - [arm64] dts: rockchip: Fix bluetooth properties on Rock960 boards
    - [arm64] dts: rockchip: Remove #cooling-cells from fan on Theobroma lion
    - [arm64] dts: rockchip: Fix LED triggers on rk3308-roc-cc
    - [arm64] dts: imx8mp: correct sdhc ipg clk
    - [armhf] dts: rockchip: fix rk3036 acodec node
    - [armhf] dts: rockchip: drop grf reference from rk3036 hdmi
    - [armhf] dts: rockchip: Fix the spi controller on rk3036
    - [armhf] dts: rockchip: Fix the realtek audio codec on rk3036-kylin
    - HID: core: zero-initialize the report buffer (CVE-2024-50302)
    - security/keys: fix slab-out-of-bounds in key_task_permission
      (CVE-2024-50301)
    - [arm64] net: enetc: set MAC address to the VF net_device
    - sctp: properly validate chunk size in sctp_sf_ootb() (CVE-2024-50299)
    - [armhf] can: c_can: fix {rx,tx}_errors statistics
    - [arm64] net: hns3: fix kernel crash when uninstalling driver
      (CVE-2024-50296)
    - net: phy: export phy_error and phy_trigger_machine
    - net: phy: ti: implement generic .handle_interrupt() callback
    - net: phy: ti: add PHY_RST_AFTER_CLK_EN flag
    - [arm*] net: arc: fix the device for dma_map_single/dma_unmap_single
      (CVE-2024-50295)
    - Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown"
      (regression in 5.10.226)
    - media: stb0899_algo: initialize cfr before using it
    - media: dvbdev: prevent the risk of out of memory access (CVE-2024-53063)
    - media: dvb_frontend: don't play tricks with underflow values
    - scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer
    - ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
    - [armhf] ASoC: stm32: spdifrx: fix dma channel release in
      stm32_spdifrx_remove
    - media: cx24116: prevent overflows on SNR calculus (CVE-2024-50290)
    - media: pulse8-cec: fix data timestamp at pulse8_setup()
    - media: v4l2-tpg: prevent the risk of a division by zero (CVE-2024-50287)
    - drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
      (CVE-2024-50282)
    - drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
      (CVE-2024-53060)
    - dm cache: correct the number of origin blocks to match the target length
    - dm cache: fix out-of-bounds access to the dirty bitset when resizing
      (CVE-2024-50279)
    - dm cache: optimize dirty bit checking with find_next_bit when resizing
    - dm cache: fix potential out-of-bounds access on the first resume
      (CVE-2024-50278)
    - dm-unstriped: cast an operand to sector_t to prevent potential uint32_t
      overflow
    - io_uring: rename kiocb_end_write() local helper
    - fs: create kiocb_{start,end}_write() helpers
    - io_uring: use kiocb_{start,end}_write() helpers
    - io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
      (CVE-2024-53052)
    - nfs: Fix KMSAN warning in decode_getfattr_attrs() (CVE-2024-53066)
    - btrfs: reinitialize delayed ref list after deleting it from the list
      (CVE-2024-50273)
    - splice: don't generate zero-len segement bvecs
    - spi: Fix deadlock when adding SPI controllers on SPI buses
      (CVE-2021-47469)
    - spi: fix use-after-free of the add_lock mutex
    - net: bridge: xmit: make sure we have at least eth header len bytes
      (CVE-2024-38538)
    - Revert "perf hist: Add missing puts to hist__account_cycles" (regression
      in 5.10.201)
    - perf session: Add missing evlist__delete when deleting a session
    - net: do not delay dst_entries_add() in dst_release() (CVE-2024-50036)
    - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in
      uvc_parse_format (CVE-2024-53104)
    - [arm*] usb: musb: sunxi: Fix accessing an released usb phy
      (CVE-2024-50269)
    - usb: typec: fix potential out of bounds in
      ucsi_ccg_update_set_new_cam_cmd() (CVE-2024-50268)
    - USB: serial: io_edgeport: fix use after free in debug printk
      (CVE-2024-50267)
    - USB: serial: qcserial: add support for Sierra Wireless EM86xx
    - USB: serial: option: add Fibocom FG132 0x0112 composition
    - USB: serial: option: add Quectel RG650V
    - [arm*] irqchip/gic-v3: Force propagation of the active state with a read-
      back
    - ocfs2: remove entry once instead of null-ptr-dereference in
      ocfs2_xa_remove() (CVE-2024-50265)
    - ALSA: usb-audio: Support jack detection on Dell dock
    - ALSA: usb-audio: Add quirks for Dell WD19 dock
    - [x86] hv_sock: Initializing vsk->trans to NULL to prevent a dangling
      pointer (CVE-2024-53103)
    - vsock/virtio: Initialization of the dangling pointer occurring in vsk->
      trans (CVE-2024-50264)
    - net: phy: ti: take into account all possible interrupt sources
    - 9p: Avoid creating multiple slab caches with the same name
    - HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
    - bpf: use kvzmalloc to allocate BPF verifier environment
    - [arm*] crypto: marvell/cesa - Disable hash algorithms
    - fs: Fix uninitialized value issue in from_kuid and from_kgid
      (CVE-2024-53101)
    - net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
    - md/raid10: improve code of mrdev in raid10_sync_request
    - io_uring: fix possible deadlock in io_register_iowq_max_workers()
      (CVE-2024-41080)
    - mm: krealloc: Fix MTE false alarm in __do_krealloc (CVE-2024-53097)
    - 9p: fix slab cache name creation for real
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.231
    - [arm64] dts: allwinner: pinephone: Add mount matrix to accelerometer
    - media: i2c: tc358743: Fix crash in the probe error path when using
      polling (CVE-2024-56576)
    - media: ts2020: fix null-ptr-deref in ts2020_probe() (CVE-2024-56574)
    - [arm64] media: venus: Fix pm_runtime_set_suspended() with runtime pm
      enabled
    - media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
    - media: uvcvideo: Stop stream during unregister
    - ovl: Filter invalid inodes with missing lookup function (CVE-2024-56570)
    - ftrace: Fix regression with module command in stack_trace_filter
      (CVE-2024-56569)
    - netlink: terminate outstanding dump on socket close (CVE-2024-53140)
    - net/mlx5: fs, lock FTE when checking if active (CVE-2024-53121)
    - net/mlx5e: kTLS, Fix incorrect page refcounting (CVE-2024-53138)
    - [x86] mm: Fix a kdump kernel failure on SME system when
      CONFIG_IMA_KEXEC=y
    - ocfs2: uncache inode which has failed entering the group (CVE-2024-53112)
    - [x86] KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind
      CONFIG_BROKEN (CVE-2024-53135)
    - nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
      (CVE-2024-53131)
    - ocfs2: fix UBSAN warning in ocfs2_verify_volume()
    - nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
      (CVE-2024-53130)
    - [arm*] Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than
      4K" (CVE-2024-53127) (regression in 5.10.226)
    - mmc: core: fix return value check in devm_mmc_alloc_host()
    - NFSD: initialize copy->cp_clp early in nfsd4_copy for use by trace point
    - NFSD: Async COPY result needs to return a write verifier
    - NFSD: Limit the number of concurrent async COPY operations
      (CVE-2024-49974)
    - NFSD: Initialize struct nfsd4_copy earlier
    - NFSD: Never decrement pending_async_copies on error
    - mm: revert "mm: shmem: fix data-race in shmem_getattr()" (CVE-2024-53136)
    - mm: avoid unsafe VMA hook invocation when error arises on mmap hook
    - mm: unconditionally close VMAs on error
    - mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling
    - mm: resolve faulty mmap_region() error path behaviour (CVE-2024-53096)
    - [x86] ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10
      tablet
    - mac80211: fix user-power when emulating chanctx
    - [x86] ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
    - net: usb: qmi_wwan: add Quectel RG650V
    - [arm*] regulator: rk808: Add apply_bit for BUCK3 on RK809
    - [armhf] ASoC: stm: Prevent potential division by zero in
      stm32_sai_mclk_round_rate()
    - [armhf] ASoC: stm: Prevent potential division by zero in
      stm32_sai_get_clk_div()
    - proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
    - ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry
    - ipmr: Fix access to mfc_cache_list without lock held
    - rcu-tasks: Idle tasks on offline CPUs are in quiescent states
    - cifs: Fix buffer overflow when parsing NFS reparse points
      (CVE-2024-49996)
    - nvme: fix metadata handling in nvme-passthrough
    - [x86] barrier: Do not serialize MSR accesses on AMD
    - [x86] xen/pvh: Annotate indirect branch as safe
    - initramfs: avoid filename buffer overrun (CVE-2024-53142)
    - nvme-pci: fix freeing of the HMB descriptor table (CVE-2024-56756)
    - [arm64] fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
    - [arm64] acpi/arm64: Adjust error handling procedure in
      gtdt_parse_timer_block()
    - hfsplus: don't query the device logical block size multiple times
      (CVE-2024-56548)
    - [arm64] crypto: caam - Fix the pointer passed to caam_qi_shutdown()
      (CVE-2024-56754)
    - [arm64] EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)
    - crypto: pcrypt - Call crypto layer directly when padata_do_parallel()
      return -EBUSY (CVE-2024-56690)
    - [arm64] crypto: cavium - Fix the if condition to exit loop after timeout
    - [arm64] crypto: caam - add error check to caam_rsa_set_priv_key_form
    - [arm*] crypto: bcm - add error check in the ahash_hmac_init function
      (CVE-2024-56681)
    - [arm64] crypto: cavium - Fix an error handling path in
      cpt_ucode_load_fw()
    - time: Fix references to _msecs_to_jiffies() handling of values
    - [armhf] soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
    - [arm*] soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
      (CVE-2024-53158)
    - [arm*] mmc: mmc_spi: drop buggy snprintf()
    - tpm: fix signed/unsigned bug when checking event logs
    - Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
    - cgroup/bpf: only cgroup v2 can be attached by bpf programs
    - [armhf] pwm: imx27: Workaround of the pwm output bug when decrease the
      duty cycle
    - [armhf] dts: cubieboard4: Fix DCDC5 regulator constraints
    - [arm*] firmware: arm_scpi: Check the DVFS OPP count returned by the
      firmware (CVE-2024-53157)
    - [x86] media: atomisp: Add check for rgby_data memory allocation failure
      (CVE-2024-56705)
    - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
      (CVE-2024-53156)
    - [armhf] drm/omap: Fix locking in omap_gem_new_dmabuf()
    - wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
    - wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
    - [armhf] drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
    - wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1
    - wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2
    - xfrm: rename xfrm_state_offload struct to allow reuse
    - xfrm: store and rely on direction to construct offload flags
    - wifi: mwifiex: Fix memcpy() field-spanning write warning in
      mwifiex_config_scan() (CVE-2024-56539)
    - [arm64] octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
      (CVE-2024-56728)
    - [arm*] drm/panfrost: Remove unused id_mask from struct panfrost_model
    - [arm64] drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
    - [armhf] drm/etnaviv: rework linear window offset calculation
    - [armhf] drm/etnaviv: Request pages from DMA32 zone on addressing_limited
    - [armhf] drm/etnaviv: dump: fix sparse warnings
    - [armhf] drm/etnaviv: fix power register offset on GC300
    - [armhf] drm/etnaviv: hold GPU lock across perfmon sampling
    - [arm64] drm/msm/dpu: cast crtc_clk calculation to u64 in
      _dpu_core_perf_calc_clk()
    - netlink: typographical error in nlmsg_type constants definition
    - bpf, sockmap: Several fixes to bpf_msg_push_data
    - bpf, sockmap: Several fixes to bpf_msg_pop_data (CVE-2024-56720)
    - bpf, sockmap: Fix sk_msg_reset_curr
    - [amd64] drm/amdkfd: Fix wrong usage of INIT_WORK()
    - ALSA: usx2y: Fix spaces
    - ALSA: usx2y: Coding style fixes
    - ALSA: usx2y: Cleanup probe and disconnect callbacks
    - ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
      (CVE-2024-56533)
    - ALSA: us122l: Use snd_card_free_when_closed() at disconnection
      (CVE-2024-56532)
    - ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
      (CVE-2024-56531)
    - ALSA: 6fire: Release resources at card release (CVE-2024-53239)
    - driver core: Introduce device_find_any_child() helper
    - Bluetooth: fix use-after-free in device_for_each_child() (CVE-2024-53237)
    - netpoll: Use rcu_access_pointer() in netpoll_poll_lock
    - trace/trace_event_perf: remove duplicate samples on the first tracepoint
      event
    - [armhf] mfd: da9052-spi: Change read-mask to write-mask
    - [x86] mfd: intel_soc_pmic_bxtwc: Use dev_err_probe()
    - [x86] mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
      (CVE-2024-56691)
    - [x86] mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
      (CVE-2024-56724)
    - [x86] mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
      (CVE-2024-56723)
    - scsi: bfa: Fix use-after-free in bfad_im_module_exit() (CVE-2024-53227)
    - scsi: fusion: Remove unused variable 'rc'
    - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
      (CVE-2024-56748)
    - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
      (CVE-2024-56747)
    - [arm64] RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
      (CVE-2024-53226)
    - ocfs2: fix uninitialized value in ocfs2_file_read_iter() (CVE-2024-53155)
    - perf cs-etm: Don't flush when packet_queue fills up
    - perf probe: Fix libdw memory leak
    - perf probe: Correct demangled symbols in C++ program
    - [i386] PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
    - [i386] PCI: cpqphp: Fix PCIBIOS_* return value confusion
    - f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block
    - f2fs: avoid using native allocate_segment_by_default()
    - f2fs: remove struct segment_allocation default_salloc_ops
    - f2fs: open code allocate_segment_by_default
    - f2fs: remove the unused flush argument to change_curseg
    - f2fs: check curseg->inited before write_sum_page in change_curseg
    - perf trace: avoid garbage when not printing a trace event's arguments
    - perf trace: Do not lose last events in a race
    - perf trace: Avoid garbage when not printing a syscall's arguments
    - [arm64] rpmsg: glink: Add TX_DATA_CONT command while sending
    - [arm64] rpmsg: glink: Send READ_NOTIFY command in FIFO full case
    - [arm64] rpmsg: glink: Fix GLINK command prefix
    - [arm64] rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name
      length
    - NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
      (CVE-2024-53217)
    - NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
    - NFSD: Fix nfsd4_shutdown_copy()
    - vfio/pci: Properly hide first-in-list PCIe extended capability
      (CVE-2024-53214)
    - power: supply: core: Remove might_sleep() from power_supply_put()
    - power: supply: bq27xxx: Support CHARGE_NOW for bq27z561/bq28z610/bq34z100
    - power: supply: bq27xxx: Fix registers of bq27426
    - net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
    - tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
    - net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL
      configuration
    - [armhf] net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
    - net: introduce a netdev feature for UDP GRO forwarding
    - bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down
    - ipmr: convert /proc handlers to rcu_read_lock()
    - ipmr: fix tables suspicious RCU usage
    - iio: light: al3010: Fix an error handling path in al3010_probe()
    - usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
    - usb: yurex: make waiting on yurex_write interruptible
    - USB: chaoskey: fail open after removal
    - USB: chaoskey: Fix possible deadlock chaoskey_list_lock
    - misc: apds990x: Fix missing pm_runtime_disable()
    - ALSA: hda/realtek - Add type for ALC287
    - ALSA: hda/realtek: Update ALC256 depop procedure
    - apparmor: fix 'Do simple duplicate message elimination'
    - xen: Fix the issue of resource not being properly released in
      xenbus_dev_probe() (CVE-2024-53198)
    - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox
      devices (CVE-2024-53197)
    - ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
    - ext4: fix FS_IOC_GETFSMAP handling
    - jfs: xattr: check invalid xattr size more strictly
    - ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
    - [x86] perf/x86/intel/pt: Fix buffer full but size is 0 case
    - [amd64] crypto: x86/aegis128 - access 32-bit arguments as 32-bit
    - [arm64] KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow
      status
    - PCI: Fix use-after-free of slot->bus on hot remove (CVE-2024-53194)
    - fsnotify: fix sending inotify event with unexpected filename
    - [x86] comedi: Flush partial mappings in error case (CVE-2024-53148)
    - tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
    - exfat: fix uninit-value in __exfat_get_dentry_set
    - Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
    - driver core: bus: Fix double free in driver API bus_register()
      (CVE-2024-50055)
    - Revert "usb: gadget: composite: fix OS descriptors w_value logic"
      (regression in 5.10.217)
    - netfilter: ipset: add missing range check in bitmap_ip_uadt
      (CVE-2024-53141)
    - spi: Fix acpi deferred irq probe
    - [arm64] platform/chrome: cros_ec_typec: fix missing fwnode reference
      decrement
    - ubi: wl: Put source PEB into correct list if trying locking LEB failed
    - [um] ubd: Do not use drvdata in release (CVE-2024-53184)
    - [um] net: Do not use drvdata in release (CVE-2024-53183)
    - [um] vector: Do not use drvdata in release (CVE-2024-53181)
    - [arm64] tls: Fix context-switching of tpidrro_el0 when kpti is enabled
    - block: fix ordering between checking BLK_MQ_S_STOPPED request adding
    - HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
    - [armhf] media: wl128x: Fix atomicity violation in fmc_send_cmd()
      (CVE-2024-56700)
    - media: v4l2-core: v4l2-dv-timings: check cvt/gtf result
    - ALSA: hda/realtek: Update ALC225 depop procedure
    - ALSA: hda/realtek: Set PCBeep to default value for ALC274
    - [x86] ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4
      Max
    - [x86] ALSA: hda/realtek: Apply quirk for Medion E15433
    - [arm*] usb: dwc3: gadget: Fix checking for number of TRBs left
    - [arm*] usb: dwc3: gadget: Fix looping of queued SG entries
      (CVE-2024-56698)
    - lib: string_helpers: silence snprintf() output truncation warning
    - NFSD: Prevent a potential integer overflow (CVE-2024-53146)
    - SUNRPC: make sure cache entry active before cache_show (CVE-2024-53174)
    - [arm64] rpmsg: glink: Propagate TX failures in intentless mode as well
    - [um] Fix potential integer overflow during physmem setup
      (CVE-2024-53145)
    - NFSv4.0: Fix a use-after-free problem in the asynchronous open()
      (CVE-2024-53173)
    - rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
      (CVE-2024-56739)
    - ubifs: Correct the total block count by deducting journal reservation
    - ubi: fastmap: Fix duplicate slab cache names while attaching
      (CVE-2024-53172)
    - ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
      (CVE-2024-53171)
    - jffs2: fix use of uninitialized variable
    - block: return unsigned int from bdev_io_min
    - 9p/xen: fix init sequence
    - 9p/xen: fix release of IRQ (CVE-2024-56704)
    - nfs: ignore SB_RDONLY when mounting nfs
    - SUNRPC: correct error code comment in xs_tcp_setup_socket()
    - SUNRPC: Convert rpc_client refcount to use refcount_t
    - sunrpc: remove unnecessary test in rpc_task_set_client()
    - SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE
    - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (CVE-2024-56688)
    - quota: flush quota_release_work upon quota writeback (CVE-2024-56780)
    - btrfs: ref-verify: fix use-after-free after invalid ref action
      (CVE-2024-56581)
    - ad7780: fix division by zero in ad7780_write_raw() (CVE-2024-56567)
    - util_macros.h: fix/rework find_closest() macros
    - i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
      (CVE-2024-56562)
    - dm thin: Add missing destroy_work_on_stack()
    - nfsd: make sure exp active before svc_export_show (CVE-2024-56558)
    - nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
      (CVE-2024-56779)
    - btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in
      walk_down_proc() (CVE-2024-46841)
    - [armhf] drm/etnaviv: flush shader L1 cache after user commandstream
    - [x86] iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
    - [armhf] can: sun4i_can: sun4i_can_err(): call can_change_state() even if
      cf is NULL
    - [armhf] can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
    - ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
      (CVE-2024-53680)
    - netfilter: x_tables: fix LED ID check in led_tg_check() (CVE-2024-56650)
    - ptp: Add error handling for adjfine callback in ptp_clock_adjtime
    - net/sched: tbf: correct backlog statistic for GSO packets
    - net: hsr: avoid potential out-of-bound access in fill_frame_info()
      (CVE-2024-56648)
    - can: j1939: j1939_session_new(): fix skb reference counting
      (CVE-2024-56645)
    - net/ipv6: release expired exception dst cached in socket (CVE-2024-56644)
    - dccp: Fix memory leak in dccp_feat_change_recv (CVE-2024-56643)
    - tipc: Fix use-after-free of kernel socket in cleanup_bearer().
      (CVE-2024-56642)
    - net/qed: allow old cards not supporting "num_images" to work
    - igb: Fix potential invalid memory access in igb_init_module()
      (CVE-2024-52332)
    - net: sched: fix erspan_opt settings in cls_flower
    - netfilter: ipset: Hold module reference while requesting a module
      (CVE-2024-56637)
    - netfilter: nft_set_hash: skip duplicated elements pending gc run
    - ethtool: Fix wrong mod state in case of verbose and no_mask bitset
    - geneve: do not assume mac header is set in geneve_xmit_skb()
      (CVE-2024-56636)
    - gpio: grgpio: Add NULL check in grgpio_probe (CVE-2024-56634)
    - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
      (CVE-2024-56633)
    - ocfs2: free inode when ocfs2_get_init_inode() fails (CVE-2024-56630)
    - bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
    - bpf: Fix exact match conditions in trie_get_next_key()
    - HID: wacom: fix when get product name maybe null pointer (CVE-2024-56629)
    - tracing: Fix cmp_entries_dup() to respect sort() comparison rules
    - [arm64] ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
      (CVE-2024-57874)
    - ALSA: usb-audio: add mixer mapping for Corsair HS80
    - [x86] ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8
    - [x86] ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360
      (NP730QFG)
    - scsi: qla2xxx: Fix NVMe and NPIV connect issue
    - scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
    - scsi: qla2xxx: Fix use after free on unload (CVE-2024-56623)
    - scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
    - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
      (CVE-2024-56619)
    - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
      (CVE-2024-48881) (regression in 5.10.188)
    - bpf: fix OOB devmap writes when deleting elements (CVE-2024-56615)
    - dma-buf: fix dma_fence_array_signaled v4
    - regmap: detach regmap from dev on regmap_exit
    - [x86] mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla
      10 tablet
    - mmc: core: Further prevent card detect during shutdown
    - ocfs2: update seq_file index in ocfs2_dlm_seq_next
    - [arm*] iommu/arm-smmu: Defer probe of clients after smmu device bound
      (CVE-2024-56568)
    - btrfs: avoid unnecessary device path update for the same device
    - kcsan: Turn report_filterlist_lock into a raw_spinlock (CVE-2024-56610)
    - media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
    - media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
    - [arm*] drm/vc4: hvs: Set AXI panic modes for the HVS
    - drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
    - drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
    - r8169: don't apply UDP padding quirk on RTL8126A
    - net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
    - af_packet: avoid erroring out after sock_init_data() in packet_create()
      (CVE-2024-56606)
    - Bluetooth: L2CAP: do not leave dangling sk pointer on error in
      l2cap_sock_create() (CVE-2024-56605)
    - net: af_can: do not leave a dangling sk pointer in can_create()
      (CVE-2024-56603)
    - net: ieee802154: do not leave a dangling sk pointer in
      ieee802154_create() (CVE-2024-56602)
    - net: inet: do not leave a dangling sk pointer in inet_create()
      (CVE-2024-56601)
    - net: inet6: do not leave a dangling sk pointer in inet6_create()
      (CVE-2024-56600)
    - wifi: ath5k: add PCI ID for SX76X
    - wifi: ath5k: add PCI ID for Arcadyan devices
    - drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
    - dma-debug: fix a possible deadlock on radix_lock (CVE-2024-47143)
    - jfs: array-index-out-of-bounds fix in dtReadFirst (CVE-2024-56598)
    - jfs: fix shift-out-of-bounds in dbSplit (CVE-2024-56597)
    - jfs: fix array-index-out-of-bounds in jfs_readdir (CVE-2024-56596)
    - jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
      (CVE-2024-56595)
    - drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
    - drm/amdgpu: set the right AMDGPU sg segment limitation (CVE-2024-56594)
    - wifi: ipw2x00: libipw_rx_any(): fix bad alignment
    - wifi: brcmfmac: Fix oops due to NULL pointer dereference in
      brcmf_sdiod_sglist_rw() (CVE-2024-56593)
    - Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
    - ASoC: hdmi-codec: reorder channel allocation list
    - net/neighbor: clear error in case strict check is not set
    - netpoll: Use rcu_access_pointer() in __netpoll_setup
    - tracing: Use atomic64_inc_return() in trace_clock_counter()
    - [arm64] scsi: hisi_sas: Add cond_resched() for no forced preemption model
      (CVE-2024-56589)
    - leds: class: Protect brightness_show() with led_cdev->led_access mutex
      (CVE-2024-56587)
    - scsi: st: Don't modify unknown block number in MTIOCGET
    - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
    - [arm64] pinctrl: qcom-pmic-gpio: add support for PM8937
    - nvdimm: rectify the illogical code within nd_dax_probe()
    - f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
      (CVE-2024-56586)
    - PCI: Add 'reset_subordinate' to reset hierarchy below bridge
    - PCI: Add ACS quirk for Wangxun FF5xxx NICs
    - i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to
      avoid deadlock (CVE-2024-43098)
    - [arm*] usb: chipidea: udc: handle USB Error Interrupt if IOC not set
    - misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
    - sched/core: Remove the unnecessary need_resched() check in
      nohz_csd_func()
    - sched/fair: Remove update of blocked load from newidle_balance
    - sched/fair: Remove unused parameter of update_nohz_stats
    - sched/fair: Merge for each idle cpu loop of ILB
    - sched/fair: Trigger the update of blocked load on newly idle cpu
    - sched/fair: Add NOHZ balancer flag for nohz.next_balance updates
    - sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU
      turning busy
    - sched/core: Prevent wakeup of ksoftirqd during idle load balance
    - btrfs: fix missing snapshot drew unlock when root is dead during swap
      activation
    - [arm64] KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
    - [arm64] KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
    - [arm64] KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
    - jffs2: Prevent rtime decompress memory corruption (CVE-2024-57850)
    - jffs2: Fix rtime decompressor
    - drm/amd/display: Check BIOS images before it is used (CVE-2024-46809)
    - modpost: Add .irqentry.text to OTHER_SECTIONS
    - scsi: sd: Fix sd_do_mode_sense() buffer length handling
    - scsi: core: Fix scsi_mode_select() buffer length handling
    - ALSA: usb-audio: Fix out of bounds reads when finding clock sources
      (CVE-2024-53150)
    - media: uvcvideo: Require entities to have a non-zero unique ID
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.232
    - tcp: check space before adding MPTCP SYN options
    - [armhf] ata: sata_highbank: fix OF node reference leak in
      highbank_initialize_phys()
    - [arm*] usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
    - usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to
      accessing null pointer (CVE-2024-56670)
    - xfs: don't drop errno values when we fail to ficlone the entire range
    - xfs: fix scrub tracepoints when inode-rooted btrees are involved
    - bpf, sockmap: Fix update element with same
    - virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119)
    - exfat: fix potential deadlock on __exfat_get_dentry_set (CVE-2024-42315)
    - [amd64,arm64] acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
      (CVE-2024-56662)
    - batman-adv: Do not send uninitialized TT changes
    - batman-adv: Remove uninitialized data in full table TT response
    - batman-adv: Do not let TT changes list grows indefinitely
    - tipc: fix NULL deref in cleanup_bearer() (CVE-2024-56661)
    - [x86] net: lapb: increase LAPB_HEADER_LEN (CVE-2024-56659)
    - ACPI: resource: Fix memory resource type union access
    - cxgb4: use port number to set mac addr
    - net/sched: netem: account for backlog updates from child qdisc
      (CVE-2024-56770)
    - net: bonding, dummy, ifb, team: advertise NETIF_F_GSO_SOFTWARE
    - bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
    - team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
    - ACPICA: events/evxfregn: don't release the ContextMutex that was never
      acquired
    - blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
    - bpf: sync_linked_regs() must preserve subreg_def (CVE-2024-53125)
    - tracing/kprobes: Skip symbol counting logic for module symbols in
      create_local_trace_kprobe()
    - [x86] drm/i915: Fix memory leak by correcting cache object name in error
      handler
    - xen/netfront: fix crash when removing device (CVE-2024-53240)
    - [x86] make get_cpu_vendor() accessible from Xen code
    - [x86] objtool/x86: allow syscall instruction
    - [x86] static-call: provide a way to do very early static-call updates
    - [x86] xen: don't do PV iret hypercall through hypercall page
      (CVE-2024-53241)
    - [x86] xen: add central hypercall functions
    - [x86] xen: use new hypercall functions instead of hypercall page
    - [x86] xen: remove hypercall page (CVE-2024-53241)
    - ALSA: usb-audio: Fix a DMA to stack memory bug
    - [i386] static-call: fix 32-bit build
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.233
    - net: sched: fix ordering of qlen adjustment (CVE-2024-53164)
    - PCI/AER: Disable AER service on suspend
    - ALSA: usb: Fix UBSAN warning in parse_audio_unit()
    - PCI: Add ACS quirk for Broadcom BCM5760X NIC
    - [arm*] usb: dwc2: gadget: Don't write invalid mapped sg entries into
      dma_desc with iommu enabled
    - erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
    - erofs: fix incorrect symlink detection in fast symlink
    - net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
    - net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving
      proposal msg
    - net/smc: check return value of sock_recvmsg when draining clc data
      (CVE-2024-57791)
    - netdevsim: prevent bad user input in nsim_dev_health_break_write()
      (CVE-2024-56716)
    - net: hinic: Fix cleanup in create_rxqs/txqs()
    - netfilter: ipset: Fix for recursive locking warning
    - [arm*] mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC
      quirk
    - efivarfs: Fix error on non-existent file
    - USB: serial: option: add TCL IK512 MBIM & ECM
    - USB: serial: option: add MeiG Smart SLM770A
    - USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
    - USB: serial: option: add MediaTek T7XX compositions
    - USB: serial: option: add Telit FE910C04 rmnet compositions
    - zram: refuse to use zero sized block device as backing device
    - btrfs: tree-checker: reject inline extent items with 0 ref count
    - [x86] Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
      (CVE-2024-55916)
    - NFS/pnfs: Fix a live lock between recalled layouts and layoutget
    - of/irq: Fix using uninitialized variable @addr_len in API of
      _irq_parse_one()
    - nilfs2: prevent use of deleted inode (CVE-2024-53690)
    - of: Fix error path in of_parse_phandle_with_args_map()
    - of: Fix refcount leakage for OF node returned by __of_get_dma_parent()
    - ceph: validate snapdirname option length when mounting
    - epoll: Add synchronous wakeup support for ep_poll_callback
    - media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
      (CVE-2024-56769)
    - tcp_bpf: Charge receive socket buffer in bpf_tcp_ingress()
    - bpf: Check negative offsets in __bpf_skb_min_len()
    - nfsd: restore callback functionality for NFSv4.0
    - [x86] mtd: diskonchip: Cast an operand to prevent potential overflow
    - phy: core: Fix an OF node refcount leakage in _of_phy_get()
    - phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup()
    - phy: core: Fix that API devm_phy_put() fails to release the phy
    - phy: core: Fix that API devm_of_phy_provider_unregister() fails to
      unregister the phy provider
    - phy: core: Fix that API devm_phy_destroy() fails to destroy the phy
    - [arm*] dmaengine: mv_xor: fix child node refcount handling in early exit
    - [armhf] dmaengine: at_xdmac: avoid null_prt_deref in
      at_xdmac_prep_dma_memset (CVE-2024-56767)
    - [armhf] mtd: rawnand: fix double free in atmel_pmecc_create_user()
      (CVE-2024-56766)
    - tracing/kprobe: Make trace_kprobe's module callback called after
      jump_label update
    - [x86] watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04
    - [x86] scsi: qla1280: Fix hw revision numbering for ISP1020/1040
    - scsi: megaraid_sas: Fix for a potential deadlock (CVE-2024-57807)
    - ALSA: hda/conexant: fix Z60MR100 startup pop issue
    - regmap: Use correct format specifier for logging range errors
    - [x86] platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
    - scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver
      load time
    - [x86] scsi: storvsc: Do not flag MAINTENANCE_IN return of
      SRB_STATUS_DATA_OVERRUN as an error
    - virtio-blk: don't keep queue frozen during system suspend
      (CVE-2024-57946)
    - skbuff: introduce skb_expand_head()
    - ipv6: use skb_expand_head in ip6_finish_output2
    - ipv6: use skb_expand_head in ip6_xmit
    - ipv6: fix possible UAF in ip6_finish_output2()
    - bpf: Check validity of link->type in bpf_link_show_fdinfo()
      (CVE-2024-53099)
    - bpf: fix recursive lock when verdict program return SK_PASS
      (CVE-2024-56694)
    - drm/dp_mst: Fix MST sideband message body length check (CVE-2024-56616)
    - [arm64] mm: Rename asid2idx() to ctxid2asid()
    - [arm64] Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit
      ASIDs
    - [arm*] power: supply: gpio-charger: Fix set charge current limits
      (CVE-2024-57792)
    - btrfs: avoid monopolizing a core when activating a swap file
    - nfsd: cancel nfsd_shrinker_work using sync mode in
      nfs4_state_shutdown_net (CVE-2024-50121)
    - skb_expand_head() adjust skb->truesize incorrectly
    - ipv6: prevent possible UAF in ip6_xmit()
    - [x86] hyperv: Fix hv tsc page based sched_clock for hibernation
    - selinux: ignore unknown extended permissions (CVE-2024-57931)
    - [x86] thunderbolt: Add support for Intel Alder Lake
    - [x86] thunderbolt: Add support for Intel Raptor Lake
    - [x86] thunderbolt: Add support for Intel Meteor Lake
    - [x86] thunderbolt: Add Intel Barlow Ridge PCI ID
    - [x86] thunderbolt: Add support for Intel Lunar Lake
    - [x86] thunderbolt: Add support for Intel Panther Lake-M/P
    - RDMA/mlx5: Enforce same type port association for multiport RoCE
    - [arm64] drm/bridge: adv7511_audio: Update Audio InfoFrame properly
    - netrom: check buffer length before accessing it (CVE-2024-57802)
    - netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
      (CVE-2024-54031)
    - net: llc: reset skb->transport_header
    - ALSA: usb-audio: US16x08: Initialize array before use
    - RDMA/rtrs: Ensure 'ib_sge list' is accessible (CVE-2024-36476)
    - af_packet: fix vlan_get_tci() vs MSG_PEEK (CVE-2024-57902)
    - af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK (CVE-2024-57901)
    - ila: serialize calls to nf_register_net_hooks() (CVE-2024-57900)
    - [x86] dmaengine: dw: Select only supported masters for ACPI devices
    - btrfs: switch extent buffer tree lock to rw_semaphore
    - btrfs: locking: remove all the blocking helpers
    - btrfs: rename and export __btrfs_cow_block()
    - btrfs: fix use-after-free when COWing tree bock and tracing is enabled
      (CVE-2024-56759)
    - kernel: Initialize cpumask before parsing
    - tracing: Prevent bad count for tracing_cpumask_write (CVE-2024-56763)
    - wifi: mac80211: wake the queues in case of failure in resume
    - btrfs: flush delalloc workers queue before stopping cleaner kthread
      during unmount (CVE-2024-57896)
    - sound: usb: format: don't warn that raw DSD is unsupported
    - bpf: fix potential error return
    - net: usb: qmi_wwan: add Telit FE910C04 compositions
    - [arm*] irqchip/gic: Correct declaration of *percpu_base pointer in union
      gic_base
    - btrfs: locking: remove the recursion handling code
    - btrfs: don't set lock_owner when locking extent buffer for reading
    - modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
    - modpost: fix the missed iteration for the max bit in do_input()
    - RDMA/uverbs: Prevent integer overflow issue (CVE-2024-57890)
    - [armhf] pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap
      locking (CVE-2024-57889)
    - sky2: Add device ID 11ab:4373 for Marvell 88E8075
    - net/sctp: Prevent autoclose integer overflow in sctp_association_init()
      (CVE-2024-57938)
    - [arm64] drm: adv7511: Drop dsi single lane support
    - mm: vmscan: account for free pages to prevent infinite Loop in
      throttle_direct_reclaim() (CVE-2024-57884)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.234
    - ceph: give up on paths longer than PATH_MAX (CVE-2024-53685)
    - jbd2: flush filesystem device before updating tail sequence
    - dm array: fix releasing a faulty array block twice in dm_array_cursor_end
      (CVE-2024-57929)
    - dm array: fix unreleased btree blocks on closing a faulty array cursor
    - dm array: fix cursor index when skipping across block boundaries
    - exfat: fix the infinite loop in exfat_readdir() (CVE-2024-57940)
    - netfilter: nft_dynset: honor stateful expressions in set definition
    - ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
    - net: 802: LLC+SNAP OID:PID lookup on start of skb data
    - tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
    - tcp/dccp: allow a connection when sk_max_ack_backlog is zero
    - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute (CVE-2025-21653)
    - cxgb4: Avoid removal of uninserted tid
    - netfilter: nf_tables: imbalance in flowtable binding
    - netfilter: conntrack: clamp maximum hashtable size to INT_MAX
      (CVE-2025-21648)
    - afs: Fix the maximum cell name length (CVE-2025-21646)
    - dm thin: make get_first_thin use rcu-safe list first function
      (CVE-2025-21664)
    - sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
      (CVE-2025-21640)
    - sctp: sysctl: auth_enable: avoid using current->nsproxy (CVE-2025-21638)
    - drm/amd/display: Add check for granularity in dml ceil/floor helpers
      (CVE-2024-57922)
    - [x86] ACPI: resource: Add TongFang GM5HG0A to
      irq1_edge_low_force_override[]
    - [x86] ACPI: resource: Add Asus Vivobook X1504VAP to
      irq1_level_low_skip_override[]
    - drm/amd/display: increase MAX_SURFACES to the value supported by hw
    - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and
      transitivity
    - md/raid5: fix atomicity violation in raid5_cache_count
    - USB: serial: option: add MeiG Smart SRM815
    - USB: serial: option: add Neoway N723-EA support
    - usb-storage: Add max sectors quirk for Nokia 208
    - USB: serial: cp210x: add Phoenix Contact UPS Device
    - [arm*] usb: dwc3: gadget: fix writing NYET threshold
    - USB: usblp: return error when setting unsupported protocol
    - USB: core: Disable LPM only for non-suspended ports
    - usb: fix reference leak in usb_new_device()
    - usb: gadget: f_fs: Remove WARN_ON in functionfs_bind (CVE-2024-57913)
    - iio: pressure: zpa2326: fix information leak in triggered buffer
      (CVE-2024-57912)
    - iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered
      buffer (CVE-2024-57911)
    - iio: light: vcnl4035: fix information leak in triggered buffer
      (CVE-2024-57910)
    - iio: imu: kmx61: fix information leak in triggered buffer
      (CVE-2024-57908)
    - iio: adc: ti-ads8688: fix information leak in triggered buffer
      (CVE-2024-57906)
    - iio: gyro: fxas21002c: Fix missing data update in trigger handler
    - iio: adc: at91: call input_free_device() on allocated iio_dev
      (CVE-2024-57904)
    - iio: inkern: call iio_device_put() only on mapped devices
    - [arm64] dts: rockchip: add #power-domain-cells to power domain nodes
    - [arm64] dts: rockchip: add hevc power domain clock to rk3328
    - loop: let set_capacity_revalidate_and_notify update the bdev size
    - nvme: let set_capacity_revalidate_and_notify update the bdev size
    - sd: update the bdev size in sd_revalidate_disk
    - block: remove the update_bdev parameter to
      set_capacity_revalidate_and_notify
    - ocfs2: correct return value of ocfs2_local_free_info()
    - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
      (CVE-2024-57892)
    - [arm64] drm: bridge: adv7511: Remove redundant null check before
      clk_disable_unprepare
    - drm/mipi-dsi: Create devm device registration
    - drm/mipi-dsi: Create devm device attachment
    - [arm64] drm/bridge: adv7533: Switch to devm MIPI-DSI helpers
    - [arm64] drm: bridge: adv7511: unregister cec i2c device after cec adapter
    - [arm64] drm: bridge: adv7511: use dev_err_probe in probe function
    - [arm64] drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
      (CVE-2024-57887)
    - sctp: sysctl: rto_min/max: avoid using current->nsproxy (CVE-2025-21639)
    - [armhf] net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
    - bpf: Fix bpf_sk_select_reuseport() memory leak (CVE-2025-21683)
    - net: net_namespace: Optimize the code
    - net: add exit_batch_rtnl() method
    - gtp: use exit_batch_rtnl() method
    - gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
    - gtp: Destroy device along with udp socket's netns dismantle.
      (CVE-2025-21678)
    - nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
    - net/mlx5: Add priorities for counters in RDMA namespaces
    - net/mlx5: Refactor mlx5_get_flow_namespace
    - net/mlx5: Fix RDMA TX steering prio
    - [armhf] drm/v3d: Ensure job pointer is set to NULL after job completion
      (CVE-2025-21697)
    - mac802154: check local interfaces before deleting sdata list
      (CVE-2024-57948)
    - hfs: Sanity check the root record
    - fs: fix missing declaration of init_files
    - kheaders: Ignore silly-rename files
    - poll_wait: add mb() to fix theoretical race between waitqueue_active()
      and .poll()
    - nvmet: propagate npwg topology
    - [x86] asm: Make serialize() always_inline
    - [amd64,arm64] net: ethernet: xgbe: re-add aneg to supported features in
      PHY quirks
    - vsock/virtio: cancel close work in the destructor
    - vsock: reset socket state when de-assigning the transport
    - fs/proc: fix softlockup in __read_vmcore (part 2) (CVE-2025-21694)
    - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
      (CVE-2024-36899)
    - [arm*] irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
    - hrtimers: Handle CPU state correctly on hotplug (CVE-2024-57951)
    - iio: imu: inv_icm42600: fix spi burst write not supported
    - iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
    - [arm*] iio: adc: rockchip_saradc: fix information leak in triggered
      buffer (CVE-2024-57907)
    - drm/radeon: check bo_va->bo is non-NULL before using it (CVE-2024-41060)
    - vmalloc: fix accounting with i915
    - [arm64] RDMA/hns: Fix deadlock on SRQ async events. (CVE-2024-38591)
    - blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672)
    - ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
      (CVE-2024-47707)
    - nfsd: add list_head nf_gc to struct nfsd_file
    - fou: remove warn in gue_gro_receive on unsupported protocol
      (CVE-2024-44940)
    - vsock/virtio: discard packets if the transport changes (CVE-2025-21669)
    - vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
      (CVE-2025-21666)
    - [x86] xen: fix SLS mitigation in xen_hypercall_iret()
    - scsi: sg: Fix slab-use-after-free read in sg_release() (CVE-2024-56631)
    - net: fix data-races around sk->sk_forward_alloc (CVE-2024-53124)
    - scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS
      request
    - [arm*] irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
    - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
      (CVE-2025-21699)
    - net: sched: fix ets qdisc OOB Indexing (CVE-2025-21692)
    - vfio/platform: check the bounds of read/write syscalls (CVE-2025-21687)
    - Bluetooth: RFCOMM: Fix not validating setsockopt user input
      (CVE-2024-35966)
    - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
      (CVE-2024-50304)
    - wifi: iwlwifi: add a few rate index validity checks
    - USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
      (CVE-2025-21689)
    - Input: atkbd - map F23 key to support default copilot shortcut
    - [x86] Input: xpad - add unofficial Xbox 360 wireless receiver clone
    - [x86] Input: xpad - add support for wooting two he (arm)
    - [armhf] drm/v3d: Assign job pointer to NULL before signaling the fence
      (CVE-2025-21688)
    - xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals
    - Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM
      conditionals

  [ Ben Hutchings ]
  * Bump ABI to 34
  * [rt] Update to 5.10.234-rt126
  * perf cs-etm: Add missing variable in cs_etm__process_queues()
  * xen: Fix regressions in 5.10.227 and 5.10.232:
    - [x86] xen: fix xen_hypercall_hvm() to not clobber %rbx
    - [x86] xen: add FRAME_END to xen_hypercall_hvm()
    - [x86] static-call: Remove early_boot_irqs_disabled check to fix Xen PVH
      dom0
    - Revert "xen/swiotlb: add alignment check for dma buffers"
  * netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (regression in
    5.10.232)
  * Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc (regression
    in 5.10.231)
  * ALSA: hda/realtek: Fixup ALC225 depop procedure (regression in 5.10.231)
  * gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
    (regression in 5.10.234)

  [ Salvatore Bonaccoros ]
  * d/salsa-ci.yml: Suppress aliased-location lintian errors
  * debian/salsa-ci.yml: Include run of .build-after-script from common
    pipeline.
  * debian/salsa-ci.yml: Reference .build-after-script from after_script
    section

 -- Ben Hutchings <benh@debian.org>  Mon, 24 Feb 2025 02:11:58 +0100

linux (5.10.226-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.224
    - [amd64] EDAC/skx_common: Add new ADXL components for 2-level memory
    - [amd64] EDAC, i10nm: make skx_common.o a separate module
    - [arm64] platform/chrome: cros_ec_debugfs: fix wrong EC message version
    - hfsplus: fix to avoid false alarm of circular locking
    - [i386] of: Return consistent error type from x86_of_pci_irq_enable()
    - [x86] pci/xen: Fix PCIBIOS_* return code handling
    - [x86] platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
    - hwmon: (adt7475) Fix default duty on fan is disabled
    - [arm64] dts: qcom: msm8996: specify UFS core_clk frequencies
    - [arm*] soc: qcom: pdr: protect locator_addr with the main mutex
      (CVE-2024-43849)
    - [arm64] dts: rockchip: Increase VOP clk rate on RK3328
    - [arm64] dts: amlogic: gx: correct hdmi clocks
    - [arm64] firmware: turris-mox-rwtm: Fix checking return value of
      wait_for_completion_timeout()
    - [arm64] firmware: turris-mox-rwtm: Initialize completion before mailbox
    - wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
    - net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
    - net/smc: Allow SMC-D 1MB DMB allocations
    - net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when
      CONFIG_ARCH_NO_SG_CHAIN is defined
    - lib: objagg: Fix general protection fault (CVE-2024-43846)
    - mlxsw: spectrum_acl_erp: Fix object nesting warning (CVE-2024-43880)
    - ath11k: dp: stop rx pktlog before suspend
    - wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
    - wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
    - wifi: cfg80211: handle 2x996 RU allocation in
      cfg80211_calculate_bitrate_he() (CVE-2024-43879)
    - [arm*] net: fec: Refactor: #define magic constants
    - [arm*] net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
    - ipvs: Avoid unnecessary calls to skb_is_gso_sctp
    - netfilter: nf_tables: rise cap on SELinux secmark context
    - [x86] perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
    - perf: Fix perf_aux_size() for greater-than 32-bit size
    - perf: Prevent passing zero nr_pages to rb_alloc_aux()
    - qed: Improve the stack space of filter_config()
    - wifi: virt_wifi: avoid reporting connection success with wrong SSID
      (CVE-2024-43841)
    - gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
    - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
      (CVE-2024-43839)
    - xdp: fix invalid wait context of page_pool_destroy() (CVE-2024-43834)
    - media: imon: Fix race getting ictx->lock
    - saa7134: Unchecked i2c_transfer function result fixed
    - media: uvcvideo: Allow entity-defined get_info and get_cur
    - media: uvcvideo: Override default flags
    - leds: trigger: Unregister sysfs attributes before calling deactivate()
      (CVE-2024-43830)
    - perf report: Fix condition in sort__sym_cmp()
    - [armhf] drm/etnaviv: fix DMA direction handling for cached RW buffers
    - drm/qxl: Add check for drm_cvt_mode (CVE-2024-43829)
    - Revert "leds: led-core: Fix refcount leak in of_led_get()"
      (regression in 5.10.173)
    - ext4: fix infinite loop when replaying fast_commit (CVE-2024-43828)
    - [arm64] media: venus: flush all buffers in output plane streamoff
    - [armhf] mfd: omap-usb-tll: Use struct_size to allocate tll
    - xprtrdma: Rename frwr_release_mr()
    - xprtrdma: Fix rpcrdma_reqs_reset()
    - SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
    - ext4: avoid writing unitialized memory to disk in EA inodes
    - SUNRPC: Fixup gss_status tracepoint error output
    - PCI: Fix resource double counting on remove & rescan
    - RDMA/mlx4: Fix truncated output warning in mad.c
    - RDMA/mlx4: Fix truncated output warning in alias_GUID.c
    - RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
    - RDMA/device: Return error earlier if port in not valid
    - Input: elan_i2c - do not leave interrupt disabled on suspend failure
    - [arm64] RDMA/hns: Fix missing pagesize and alignment check in FRMR
    - netfilter: ctnetlink: use helper function to calculate expect ID
      (CVE-2024-44944)
    - [arm*] net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU
      ports
    - [armhf] net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
    - [arm*] pinctrl: rockchip: update rk3308 iomux routes
    - pinctrl: core: fix possible memory leak when pinctrl_enable() fails
    - pinctrl: single: fix possible memory leak when pinctrl_enable() fails
    - [armhf] pinctrl: ti: ti-iodelay: Drop if block with always false
      condition
    - [armhf] pinctrl: ti: ti-iodelay: fix possible memory leak when
      pinctrl_enable() fails
    - fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
    - nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
    - rtc: interface: Add RTC offset to alarm after fix-up
    - tick/broadcast: Make takeover of broadcast hrtimer reliable
    - net: netconsole: Disable target before netpoll cleanup
    - af_packet: Handle outgoing VLAN packets without hardware offloading
    - ipv6: take care of scope when choosing the src addr
    - sched/fair: set_load_weight() must also call reweight_task() for
      SCHED_IDLE tasks
    - char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
    - [arm64] media: venus: fix use after free in vdec_close (CVE-2024-42313)
    - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
      (CVE-2024-42311)
    - ext2: Verify bitmap and itable block numbers before using them
    - [x86] drm/gma500: fix null pointer dereference in
      cdv_intel_lvds_get_modes (CVE-2024-42310)
    - [x86] drm/gma500: fix null pointer dereference in
      psb_intel_lvds_get_modes (CVE-2024-42309)
    - scsi: qla2xxx: Fix optrom version displayed in FDMI
    - drm/amd/display: Check for NULL pointer (CVE-2024-42308)
    - sched/fair: Use all little CPUs for CPU-bound workloads
    - apparmor: use kvfree_sensitive to free data->data
    - task_work: s/task_work_cancel()/task_work_cancel_func()/
    - task_work: Introduce task_work_cancel() again
    - udf: Avoid using corrupted block bitmap buffer (CVE-2024-42306)
    - ext4: check dot and dotdot of dx_root before making dir indexed
      (CVE-2024-42305)
    - ext4: make sure the first directory block is not a hole (CVE-2024-42304)
    - wifi: mwifiex: Fix interface type change
    - [x86] leds: ss4200: Convert PCIBIOS_* return codes to errnos
    - jbd2: make jbd2_journal_get_max_txn_bufs() internal
    - [x86] KVM: VMX: Split out the non-virtualization part of
      vmx_interrupt_blocked()
    - [x86] hwrng: amd - Convert PCIBIOS_* return codes to errnos
    - [amd64] PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
    - [arm64] PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
    - binder: fix hang of unregistered readers
    - dev/parport: fix the array out-of-bounds risk (CVE-2024-42301)
    - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
    - f2fs: fix to don't dirty inode for readonly filesystem (CVE-2024-42297)
    - ubi: eba: properly rollback inside self_check_eba
    - decompress_bunzip2: fix rare decompression failure
    - kobject_uevent: Fix OOB access within zap_modalias_env() (CVE-2024-42292)
    - devres: Fix devm_krealloc() wasting memory
    - rtc: cmos: Fix return value of nvmem callbacks
    - scsi: qla2xxx: During vport delete send async logout explicitly
      (CVE-2024-42289)
    - scsi: qla2xxx: Fix for possible memory corruption (CVE-2024-42288)
    - scsi: qla2xxx: Fix flash read failure
    - scsi: qla2xxx: Complete command early within lock (CVE-2024-42287)
    - scsi: qla2xxx: validate nvme_local_port correctly (CVE-2024-42286)
    - [x86] perf/x86/intel/pt: Fix topa_entry base length
    - [x86] perf/x86/intel/pt: Fix a topa_entry base address calculation
    - [x86] watchdog/perf: properly initialize the turbo mode timestamp and
      rearm counter
    - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
      (CVE-2024-42285)
    - rbd: don't assume rbd_is_lock_owner() for exclusive mappings
    - [arm*] drm/panfrost: Mark simple_ondemand governor as softdep
    - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
    - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
    - Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
    - nilfs2: handle inconsistent state in nilfs_btnode_create_block()
      (CVE-2024-42295)
    - io_uring/io-wq: limit retrying worker initialisation
    - kernel: rerun task_work while freezing in get_signal()
    - jfs: Fix array-index-out-of-bounds in diFree (CVE-2024-43858)
    - f2fs: fix start segno of large section
    - dma: fix call order in dmam_free_coherent (CVE-2024-43856)
    - ipv4: Fix incorrect source address in Record Route option
    - net: bonding: correctly annotate RCU in bond_should_notify_peers()
    - [amd64] netfilter: nft_set_pipapo_avx2: disable softinterrupts
    - tipc: Return non-zero value from tipc_udp_addr2str() on error
      (CVE-2024-42284)
    - net: stmmac: Correct byte order of perfect_match
    - net: nexthop: Initialize all fields in dumped nexthops (CVE-2024-42283)
    - bpf: Fix a segment issue when downgrading gso_size (CVE-2024-42281)
    - [x86] mISDN: Fix a use after free in hfcmulti_tx() (CVE-2024-42280)
    - apparmor: Fix null pointer deref when receiving skb during sock creation
      (CVE-2023-52889)
    - lirc: rc_dev_get_from_fd(): fix file leak
    - ceph: fix incorrect kmalloc size of pagevec mempool
    - nvme: split command copy into a helper
    - nvme-pci: add missing condition check for existence of mapped data
      (CVE-2024-42276)
    - fs: don't allow non-init s_user_ns for filesystems without
      FS_USERNS_MOUNT
    - fuse: verify {g,u}id mount options correctly
    - sysctl: always initialize i_uid/i_gid (CVE-2024-42312)
    - ext4: factor out a common helper to query extent map
    - ext4: check the extent status again before inserting delalloc block
    - [arm64] soc: xilinx: move PM_INIT_FINALIZE to zynqmp_pm_domains driver
    - [arm64] drivers: soc: xilinx: check return status of get_api_version()
    - devres: Fix memory leakage caused by driver API devm_free_percpu()
      (CVE-2024-43871)
    - genirq: Allow the PM device to originate from irq domain
    - [arm*] irqchip/imx-irqsteer: Constify irq_chip struct
    - [arm*] irqchip/imx-irqsteer: Add runtime PM support
    - [arm*] irqchip/imx-irqsteer: Handle runtime power management correctly
      (CVE-2024-42290)
    - remoteproc: imx_rproc: ignore mapping vdev regions (CVE-2024-43860)
    - drm/nouveau: prime: fix refcount underflow (CVE-2024-43867)
    - [x86] drm/vmwgfx: Fix overlay when using Screen Targets
    - sched: act_ct: take care of padding in struct zones_ht_key
      (CVE-2024-42272)
    - net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
    - ipv6: fix ndisc_is_useropt() handling for PIO
    - [arm*] platform/chrome: cros_ec_proto: Lock device when updating MKBP
      version
    - HID: wacom: Modify pen IDs
    - protect the fetch of ->fd[fd] in do_dup2() from mispredictions
      (CVE-2024-42265)
    - ALSA: usb-audio: Correct surround channels in UAC1 channel map
    - [x86] ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G
    - net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
    - r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY
    - genirq: Allow irq_chip registration functions to take a const irq_chip
    - [arm64] irqchip/mbigen: Fix mbigen node address layout
    - [i386] mm: Fix pti_clone_pgtable() alignment assumption (CVE-2024-44965)
    - [i386] mm: Fix pti_clone_entry_text() for i386
    - sctp: move hlist_node and hashent out of sctp_ep_common
    - sctp: Fix null-ptr-deref in reuseport_add_sock(). (CVE-2024-44935)
    - net: usb: qmi_wwan: fix memory leak for not ip packets (CVE-2024-43861)
    - net: linkwatch: use system_unbound_wq
    - Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
    - [armhf] net: dsa: bcm_sf2: Fix a possible memory leak in
      bcm_sf2_mdio_register() (CVE-2024-44971)
    - l2tp: fix lockdep splat
    - [arm*] net: fec: Stop PPS on driver remove
    - md: do not delete safemode_timer in mddev_suspend
    - md/raid5: avoid BUG_ON() while continue reshape after reassembling
      (CVE-2024-43914)
    - ACPI: battery: create alarm sysfs attribute atomically
    - [x86] ACPI: SBS: manage alarm sysfs attribute through psy core
    - udf: prevent integer overflow in udf_bitmap_free_blocks()
    - wifi: nl80211: don't give key data to userspace
    - btrfs: fix bitmap leak when loading free space cache on duplicate entry
    - drm/amdgpu: Fix the null pointer dereference to ras_manager
      (CVE-2024-43908)
    - drm/amdgpu/pm: Fix the null pointer dereference in
      apply_state_adjust_rules (CVE-2024-43907)
    - media: uvcvideo: Ignore empty TS packets
    - media: uvcvideo: Fix the bandwdith quirk on USB 3.x
    - jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
    - SUNRPC: Fix a race to wake a sync task
    - sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
    - ext4: fix wrong unit use in ext4_mb_find_by_goal
    - [arm64] cpufeature: Force HWCAP to be based on the sysreg visible to
      user-space
    - [arm64] Add Neoverse-V2 part
    - [arm64] cputype: Add Cortex-X4 definitions
    - [arm64] cputype: Add Neoverse-V3 definitions
    - [arm64] errata: Add workaround for Arm errata 3194386 and 3312417
    - [arm64] cputype: Add Cortex-X3 definitions
    - [arm64] cputype: Add Cortex-A720 definitions
    - [arm64] cputype: Add Cortex-X925 definitions
    - [arm64] errata: Unify speculative SSBS errata logic
    - [arm64] errata: Expand speculative SSBS workaround
    - [arm64] cputype: Add Cortex-X1C definitions
    - [arm64] cputype: Add Cortex-A725 definitions
    - [arm64] errata: Expand speculative SSBS workaround (again)
    - i2c: smbus: Improve handling of stuck alerts
    - i2c: smbus: Send alert notifications to all devices if source not found
    - kprobes: Fix to check symbol prefixes correctly
    - ALSA: usb-audio: Re-add ScratchAmp quirk entries
    - drm/client: fix null pointer dereference in drm_client_modeset_probe
      (CVE-2024-43894)
    - ALSA: line6: Fix racy access to midibuf (CVE-2024-44954)
    - [x86] ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
    - [x86] ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
    - usb: vhci-hcd: Do not drop references before new references are gained
      (CVE-2024-43883)
    - USB: serial: debug: do not echo input by default
    - usb: gadget: core: Check for unset descriptor (CVE-2024-44960)
    - usb: gadget: u_serial: Set start_delayed during suspend
    - scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
    - tick/broadcast: Move per CPU pointer access into the atomic section
      (CVE-2024-44968)
    - ntp: Clamp maxerror and esterror to operating range
    - driver core: Fix uevent_show() vs driver detach race (CVE-2024-44952)
    - ntp: Safeguard against time_constant overflow
    - scsi: mpt3sas: Remove scsi_dma_map() error messages
    - scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
    - [arm*] irqchip/meson-gpio: support more than 8 channels gpio irq
    - [arm*] irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to
      'raw_spinlock_t'
    - serial: core: check uartclk for zero to avoid divide by zero
      (CVE-2024-43893)
    - genirq/irqdesc: Honor caller provided affinity in alloc_desc()
    - padata: Fix possible divide-by-0 panic in padata_mt_helper()
      (CVE-2024-43889)
    - tracing: Fix overflow in get_free_elt() (CVE-2024-43890)
    - [x86] mtrr: Check if fixed MTRRs exist before saving them
      (CVE-2024-44948)
    - [arm*] drm/bridge: analogix_dp: properly handle zero sized AUX
      transactions
    - [x86] drm/mgag200: Set DDC timeout in milliseconds
    - PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
      (CVE-2024-42302)
    - netfilter: nf_tables: set element extended ACK reporting support
    - netfilter: nf_tables: use timestamp to check for set element timeout
      (CVE-2024-27397)
    - netfilter: nf_tables: allow clone callbacks to sleep
    - netfilter: nf_tables: prefer nft_chain_validate (CVE-2024-41042)
    - [x86] drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
      (CVE-2024-42259)
    - [arm64] cpufeature: Fix the visibility of compat hwcaps
    - media: uvcvideo: Use entity get_cur in uvc_ctrl_set
    - exec: Fix ToCToU between perm check and set-uid/gid usage
      (CVE-2024-43882)
    - [x86] nvme/pci: Add APST quirk for Lenovo N60z laptop
    - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (CVE-2024-42114)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.225
    - fuse: Initialize beyond-EOF page contents before setting uptodate
      (CVE-2024-44947)
    - ALSA: usb-audio: Support Yamaha P-125 quirk entry
    - [x86] xhci: Fix Panther point NULL pointer deref at full-speed re-
      enumeration (CVE-2024-45006)
    - [x86] thunderbolt: Mark XDomain as unplugged when router is removed
      (CVE-2024-46702)
    - [arm64] ACPI: NUMA: initialize all values of acpi_early_node_map to
      NUMA_NO_NODE
    - dm resume: don't return EINVAL when signalled
    - dm persistent data: fix memory allocation failure
    - vfs: Don't evict inode under the inode lru traversing context
      (CVE-2024-45003)
    - bitmap: introduce generic optimized bitmap_size()
    - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
      (CVE-2024-45025)
    - selinux: fix potential counting error in avc_add_xperms_decision()
    - btrfs: tree-checker: add dev extent item checks
    - drm/amdgpu: Actually check flags for all context ops.
    - memcg_write_event_control(): fix a user-triggerable oops (CVE-2024-45021)
    - drm/amdgpu/jpeg2: properly set atomics vmid field
    - btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
    - net/mlx5e: Correctly report errors for ethtool rx flows
    - [x86] atm: idt77252: prevent use after free in dequeue_rx()
      (CVE-2024-44998)
    - netfilter: flowtable: initialise extack before use (CVE-2024-45018)
    - [arm64] net: hns3: fix wrong use of semaphore up
    - [arm64] net: hns3: fix a deadlock problem when config TC during resetting
      (CVE-2024-44995)
    - ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
    - ssb: Fix division by zero issue in ssb_calc_clock_rate
    - wifi: mac80211: fix BA session teardown race
    - [i386] media: radio-isa: use dev_name to fill in bus_info
    - binfmt_misc: cleanup on filesystem umount
    - [arm64] media: qcom: venus: fix incorrect return value
    - scsi: spi: Fix sshdr use
    - gfs2: setattr_chown: Add missing initialization
    - wifi: iwlwifi: abort scan when rfkill on but device enabled
    - [amd64] IB/hfi1: Fix potential deadlock on &irq_src_lock and
      &dd->uctxt_lock
    - nvmet-trace: avoid dereferencing pointer too early
    - ext4: do not trim the group with corrupted block bitmap
    - quota: Remove BUG_ON from dqget()
    - media: pci: cx23885: check cx23885_vdev_init() return
    - scsi: lpfc: Initialize status local variable in
      lpfc_sli4_repost_sgl_list()
    - [arm*] drm/lima: set gp bus_stop bit before hard reset
    - virtiofs: forbid newlines in tags
    - netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
    - md: clean up invalid BUG_ON in md_ioctl
    - [x86] Increase brk randomness entropy for 64-bit systems
    - btrfs: change BUG_ON to assertion when checking for delayed_node root
    - btrfs: handle invalid root reference found in may_destroy_subvol()
    - btrfs: send: handle unexpected data in header buffer in begin_cmd()
    - btrfs: delete pointless BUG_ON check on quota root in
      btrfs_qgroup_account_extent()
    - f2fs: fix to do sanity check in update_sit_entry
    - usb: gadget: fsl: Increase size of name buffer for endpoints
    - Bluetooth: bnep: Fix out-of-bound access
    - [arm64] net: hns3: add checking for vf id of mailbox
    - nvmet-tcp: do not continue for invalid icreq
    - NFS: avoid infinite loop in pnfs_update_layout.
    - [arm*] usb: dwc3: core: Skip setting event buffers for host only
      controllers
    - usb: dwc3: st: fix probed platform device ref count on probe error path
      (CVE-2024-46674)
    - [arm*] irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
    - ext4: set the type of max_zeroout to unsigned int to avoid overflow
    - nvmet-rdma: fix possible bad dereference when freeing rsps
    - hrtimer: Prevent queuing of hrtimer without a function callback
    - gtp: pull network headers in gtp_dev_xmit() (CVE-2024-44999)
    - block: use "unsigned long" for blk_validate_block_size().
    - media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)
    - dm suspend: return -ERESTARTSYS instead of -EINTR
    - Bluetooth: hci_core: Fix LE quote calculation
    - Bluetooth: SMP: Fix assumption of Central always being Initiator
    - kcm: Serialise kcm_sendmsg() for the same socket. (CVE-2024-44946)
    - netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
    - ip6_tunnel: Fix broken GRO
    - bonding: fix bond_ipsec_offload_ok return type
    - bonding: fix null pointer deref in bond_ipsec_offload_ok (CVE-2024-44990)
    - bonding: fix xfrm real_dev null pointer dereference (CVE-2024-44989)
    - bonding: fix xfrm state handling when clearing active slave
    - ice: fix ICE_LAST_OFFSET formula
    - [arm*] net: dsa: mv88e6xxx: read FID when handling ATU violations
    - [arm*] net: dsa: mv88e6xxx: replace ATU violation prints with trace
      points
    - [arm*] net: dsa: mv88e6xxx: Fix out-of-bound access (CVE-2024-44988)
    - netem: fix return value if duplicate enqueue fails (CVE-2024-45016)
    - ipv6: prevent UAF in ip6_send_skb() (CVE-2024-44987)
    - [arm64] drm/msm/dpu: don't play tricks with debug macros
    - [arm64] drm/msm/dp: reset the link phy params before link training
    - mmc: mmc_test: Fix NULL dereference on allocation failure
      (CVE-2024-45028)
    - Bluetooth: MGMT: Add error handling to pair_device() (CVE-2024-43884)
    - binfmt_misc: pass binfmt_misc flags to the interpreter
    - HID: wacom: Defer calculation of resolution until resolution_code is
      known
    - HID: microsoft: Add rumble support to latest xbox controllers
    - cxgb4: add forgotten u64 ivlan cast before shift
    - [arm64] KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
      (CVE-2024-46707)
    - [arm*] mmc: dw_mmc: allow biu and ciu clocks to defer
    - ALSA: timer: Relax start tick time check for slave timer elements
    - nfsd: Don't call freezable_schedule_timeout() after each successful page
      allocation in svc_alloc_arg().
    - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
      (CVE-2023-31083)
    - Input: MT - limit max slots (CVE-2024-45008)
    - drm/amdgpu: Using uninitialized value *size when calling
      amdgpu_vce_cs_reloc (CVE-2024-42228)
    - [arm64] KVM: arm64: Don't use cbz/adr with external symbols
    - [arm64] pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B
      pins
    - [arm*] pinctrl: single: fix potential NULL dereference in
      pcs_get_function() (CVE-2024-46685)
    - wifi: mwifiex: duplicate static structs used in driver instances
    - ipc: replace costly bailout check in sysvipc_find_ipc() (CVE-2021-3669)
    - [amd64] drm/amdkfd: don't allow mapping the MMIO HDP page with large
      pages (CVE-2024-41011)
    - media: uvcvideo: Fix integer overflow calculating timestamp
    - ata: libata-core: Fix null pointer dereference on error (CVE-2024-41098)
    - cgroup/cpuset: Prevent UAF in proc_cpuset_show() (CVE-2024-43853)
    - net:rds: Fix possible deadlock in rds_message_put
    - ovl: do not fail because of O_NOATIME
    - soundwire: stream: fix programming slave ports for non-continous port
      maps
    - [x86] dmaengine: dw: Add peripheral bus width verification
    - [x86] dmaengine: dw: Add memory bus width verification
    - ethtool: check device is present when getting link settings
      (CVE-2024-46679)
    - gtp: fix a potential NULL pointer dereference (CVE-2024-46677)
    - net: busy-poll: use ktime_get_ns() instead of local_clock()
    - nfc: pn533: Add poll mod list filling check (CVE-2024-46676)
    - [arm64] soc: qcom: cmd-db: Map shared memory as WC, not WB
      (CVE-2024-46689)
    - cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
    - USB: serial: option: add MeiG Smart SRM825L
    - [armhf] usb: dwc3: omap: add missing depopulate in probe error path
    - [arm*] usb: dwc3: core: Prevent USB core invalid event buffer address
      access (CVE-2024-46675)
    - usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
      remove_power_attributes()
    - scsi: aacraid: Fix double-free on probe failure (CVE-2024-46673)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.226
    - [x86] drm: panel-orientation-quirks: Add quirk for OrangePi Neo
    - ALSA: hda/conexant: Mute speakers at suspend / shutdown
    - net: usb: qmi_wwan: add MeiG Smart SRM825L
    - drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
    - drm/amdgpu: fix overflowed array index read warning
    - drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
    - drm/amd/pm: fix warning using uninitialized value of max_vid_step
    - drm/amd/pm: fix the Out-of-bounds read warning (CVE-2024-46731)
    - drm/amdgpu: fix uninitialized scalar variable warning
    - drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
      (CVE-2024-43905)
    - drm/amdgpu: avoid reading vf2pf info size from FB
    - drm/amd/display: Check gpio_id before used as array index
      (CVE-2024-46818)
    - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than
      6 (CVE-2024-46817)
    - drm/amd/display: Add array index check for hdcp ddc access
      (CVE-2024-46804)
    - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
      (CVE-2024-46815)
    - drm/amd/display: Check msg_id before processing transcation
      (CVE-2024-46814)
    - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
      dal_gpio_service_create
    - drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
    - drm/amdgpu: Fix out-of-bounds write warning (CVE-2024-46725)
    - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
      (CVE-2024-46724)
    - drm/amdgpu: fix ucode out-of-bounds read warning (CVE-2024-46723)
    - drm/amdgpu: fix mc_data out-of-bounds read warning (CVE-2024-46722)
    - [amd64] drm/amdkfd: Reconcile the definition and use of oem_id in struct
      kfd_topology_device
    - apparmor: fix possible NULL pointer dereference (CVE-2024-46721)
    - drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on
      legacy SOCs
    - drm/amdgpu: the warning dereferencing obj for nbio_v7_4 (CVE-2024-46819)
    - drm/amd/pm: check negtive return for table entries
    - wifi: iwlwifi: remove fw_running op
    - [arm64] PCI: al: Check IORESOURCE_BUS existence during probe
    - hwspinlock: Introduce hwspin_lock_bust()
    - usbip: Don't submit special requests twice
    - usb: typec: ucsi: Fix null pointer dereference in trace (CVE-2024-46719)
    - fsnotify: clear PARENT_WATCHED flags lazily
    - [arm64] drm/meson: plane: Add error handling
    - wifi: cfg80211: make hash table duplicates more survivable
    - block: remove the blk_flush_integrity call in blk_integrity_unregister
    - drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
      (CVE-2024-46714)
    - media: uvcvideo: Enforce alignment of frame and interval
    - block: initialize integrity buffer to zero before writing it to media
      (CVE-2024-43854)
    - drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
    - bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode
    - net: set SOCK_RCU_FREE before inserting socket into hashtable
    - virtio_net: Fix napi_skb_cache_put warning (CVE-2024-43835)
    - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
      (CVE-2024-38577)
    - udf: Limit file size to 4TB
    - ext4: handle redirtying in ext4_bio_write_page()
    - bpf, cgroup: Assign cgroup in cgroup_sk_alloc when called from interrupt
    - sch/netem: fix use after free in netem_dequeue (CVE-2024-46800)
    - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object (CVE-2024-46798)
    - [x86] ALSA: hda/conexant: Add pincfg quirk to enable top speakers on
      Sirius devices
    - [x86] ALSA: hda/realtek: add patch for internal mic in Lenovo V145
    - [x86] ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
    - ata: libata: Fix memory leak for error path in ata_host_alloc()
    - [arm*] irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
    - Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/
      LE" (regresion in 5.10.206)
    - Bluetooth: MGMT: Ignore keys being loaded with invalid type
    - [arm*] mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
    - [armhf] mmc: sdhci-of-aspeed: fix module autoloading
    - fuse: update stats for pages in dropped aux writeback list
    - fuse: use unsigned type for getxattr/listxattr size truncation
    - [arm64] clk: qcom: clk-alpha-pll: Fix the pll post div mask
    - [arm64] clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
    - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
      (CVE-2024-46791)
    - tracing: Avoid possible softlockup in tracing_iter_reset()
    - ila: call nf_unregister_net_hooks() sooner (CVE-2024-46782)
    - sched: sch_cake: fix bulk flow accounting logic for host fairness
      (CVE-2024-46828)
    - nilfs2: fix missing cleanup on rollforward recovery error
      (CVE-2024-46781)
    - nilfs2: fix state management in error path of log writing function
    - btrfs: fix use-after-free after failure to create a snapshot
      (CVE-2022-48733)
    - mptcp: pm: avoid possible UaF when selecting endp (CVE-2024-44974)
    - nfsd: move reply cache initialization into nfsd startup
    - nfsd: move init of percpu reply_cache_stats counters back to
      nfsd_init_net
    - NFSD: Refactor nfsd_reply_cache_free_locked()
    - NFSD: Rename nfsd_reply_cache_alloc()
    - NFSD: Replace nfsd_prune_bucket()
    - NFSD: Refactor the duplicate reply cache shrinker
    - NFSD: simplify error paths in nfsd_svc()
    - NFSD: Fix frame size warning in svc_export_parse()
    - sunrpc: don't change ->sv_stats if it doesn't exist
    - nfsd: stop setting ->pg_stats for unused stats
    - sunrpc: pass in the sv_stats struct through svc_create_pooled
    - sunrpc: remove ->pg_stats from svc_program
    - sunrpc: use the struct net as the svc proc private
    - nfsd: rename NFSD_NET_* to NFSD_STATS_*
    - nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
    - nfsd: make all of the nfsd stats per-network namespace
    - nfsd: remove nfsd_stats, make th_cnt a global counter
    - nfsd: make svc_stat per-network namespace instead of global
    - ALSA: hda: Add input value sanity checks to HDMI channel map controls
    - [armhf] irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
    - af_unix: Remove put_pid()/put_cred() in copy_peercred().
    - netfilter: nf_conncount: fix wrong variable type
    - udf: Avoid excessive partition lengths (CVE-2024-46777)
    - media: vivid: fix wrong sizeimage value for mplane
    - wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
    - usb: uas: set host status byte on data completion error
    - media: vivid: don't set HDMI TX controls if there are no HDMI outputs
    - [x86] pcmcia: Use resource_size function on resource object
    - can: bcm: Remove proc entry when dev is unregistered. (CVE-2024-46771)
    - igb: Fix not clearing TimeSync interrupts for 82580
    - svcrdma: Catch another Reply chunk overflow case
    - [x86] platform/x86: dell-smbios: Fix error path in dell_smbios_init()
    - tcp_bpf: fix return value of tcp_bpf_sendmsg() (CVE-2024-46783)
    - igc: Unlock on error in igc_io_resume()
    - drivers/net/usb: Remove all strcpy() uses
    - net: usb: don't write directly to netdev->dev_addr
    - usbnet: modern method to get random MAC
    - gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers
    - gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers
    - fou: Fix null-ptr-deref in GRO. (CVE-2024-46763)
    - net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
    - ASoC: topology: Properly initialize soc_enum values
    - dm init: Handle minors larger than 255
    - [x86] iommu/vt-d: Handle volatile descriptor status read
    - cgroup: Protect css->cgroup write under css_set_lock
    - um: line: always fill *error_out in setup_one_line() (CVE-2024-46844)
    - devres: Initialize an uninitialized struct member
    - hwmon: (adc128d818) Fix underflows seen when writing limit attributes
      (CVE-2024-46759)
    - hwmon: (lm95234) Fix underflows seen when writing limit attributes
      (CVE-2024-46758)
    - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
      (CVE-2024-46757)
    - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
      (CVE-2024-46756)
    - libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
    - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
      (CVE-2024-46755)
    - btrfs: replace BUG_ON with ASSERT in walk_down_proc()
    - btrfs: clean up our handling of refs == 0 in snapshot delete
      (CVE-2024-46840)
    - PCI: Add missing bridge lock to pci_bus_lock() (CVE-2024-46750)
    - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
      (CVE-2024-46747)
    - Input: uinput - reject requests with unreasonable number of slots
      (CVE-2024-46745)
    - usbnet: ipheth: race between ipheth_close and error handling
    - Squashfs: sanity check symbolic link size (CVE-2024-46744)
    - of/irq: Prevent device address out-of-bounds read in interrupt map walk
      (CVE-2024-46743)
    - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
    - NFSv4: Add missing rescheduling points in
      nfs_client_return_marked_delegations
    - iio: buffer-dmaengine: fix releasing dma channel on error
    - iio: fix scale application in iio_convert_raw_to_processed_unlocked
    - iio: adc: ad7124: fix chip ID mismatch
    - binder: fix UAF caused by offsets overwrite (CVE-2024-46740)
    - nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
    - [x86] uio_hv_generic: Fix kernel NULL pointer dereference in
      hv_uio_rescind (CVE-2024-46739)
    - [x86] Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
    - [x86] VMCI: Fix use-after-free when removing resource in
      vmci_resource_remove() (CVE-2024-46738)
    - clocksource/drivers/timer-of: Remove percpu irq related code
    - uprobes: Use kzalloc to allocate xol area
    - perf/aux: Fix AUX buffer serialization (CVE-2024-46713)
    - nilfs2: replace snprintf in show functions with sysfs_emit
    - nilfs2: protect references to superblock parameters exposed in sysfs
      (CVE-2024-46780)
    - ACPI: processor: Return an error if acpi_processor_get_info() fails in
      processor_add()
    - ACPI: processor: Fix memory leaks in error paths of processor_add()
    - [arm64] acpi: Move get_cpu_for_acpi_id() to a header
    - [arm64] acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
      (CVE-2024-46822)
    - nvmet-tcp: fix kernel crash if commands allocation fails (CVE-2024-46737)
    - mmc: cqhci: Fix checking of CQHCI_HALT state
    - rtmutex: Drop rt_mutex::wait_lock before scheduling (CVE-2024-46829)
    - [i386] x86/mm: Fix PTI for i386 some more
    - net, sunrpc: Remap EPERM in case of connection failure in
      xs_tcp_setup_socket (CVE-2024-42246)
    - memcg: protect concurrent access to mem_cgroup_idr (CVE-2024-43892)

  [ Ben Hutchings ]
  * Drop "netfilter: ipset: Add list flush to cancel_gc", included in 5.10.224
  * Bump ABI to 33
  * debian/README.source: Tag signatures are automatically verified
  * d/bin/genorig.py, d/README.source: Only support Git as upstream
  * d/bin/genorig.py, d/README.source: Add support for remote upstream repos
  * lintian: Refresh lintian-overrides
  * d/bin/gencontrol.py, d/lib/python: Use classes for build restriction
    formulae
  * d/bin/gencontrol.py, d/rules.real: Replace DEBUG variable with if_package
  * Introduce pkg.linux.quick build profile for quicker CI builds
  * d/salsa-ci.yml: Add CI config using some of the common pipeline
  * d/salsa-ci.yml, d/tests/python: Only run static checks in CI
  * d/salsa-ci.yml: Run kconfigeditor2 as kconfig static check
  * d/salsa-ci.yml: Use per-release cache of orig tarballs
  * d/bin/gencontrol_signed.py: Add support for pkg.linux.quick profile
  * lintian: Add lintian-overrides to linux-signed-* for non-issues
  * d/salsa-ci.yml: Don't disable signed code
  * d/certs: Add certificate and key to enable test signing in CI
  * d/salsa-ci.yml: Add jobs to build and test the signed packages
  * d/tests: Remove obsolete dependencies of python test
  * d/tests: Add kbuild test that builds a trivial OOT module
  * lintian: Update overrides for lintian 2.115
  * d/tests: kbuild test case depends on python3
  * d/tests: Run kbuild test with default flavour if quick flavour not defined
  * d/lib/python/debian_linux/debian.py: Add Architecture field to TestsControl
  * d/tests: Restrict kbuild tests to architectures with default or quick
    flavour
  * d/tests/kbuild: Fix default-flavour lookup for arches with no featuresets
  * d/tests/kbuild: Make flavour lookup verbose
  * d/lib/python/debian_linux, d/templates: Use variable for binary package
    name
  * lintian: Update overrides in linux-image-*-dbg for lintian 2.115
  * [arm64] lintian: Override errors for vdso32.so in linux-image-*-dbg
  * d/salsa-ci.yml: Use !reference to include scripts from common pipeline
  * d/salsa-ci.yml: Remove obsolete lintian error suppressions
  * d/salsa-ci.yml: Run extract-source job in target release, not unstable
  * d/salsa-ci.yml: Set RELEASE to bullseye
  * d/config: Delete config settings for removed and automatic symbols
  * hyperv-daemons: Add lintian-override for depends-on-obsolete-package
  * [rt] Update to 5.10.225-rt117
  * [rt] Refresh patches:
    - Refresh "locking/rtmutex: Remove output from deadlock detector."
    - Refresh "locking/rtmutex: Provide rt_mutex_slowlock_locked()"
    - Refresh "locking/rtmutex: add ww_mutex addon for mutex-rt"
  * cgroup: Fix locking regression in 5.10.225:
    - cgroup: Make operations on the cgroup root_list RCU safe
    - cgroup: Move rcu_head up near the top of cgroup_roo
  * [x86] Fix CPU matching regression in 5.10.221:
    - Input: goodix - use the new soc_intel_is_byt() helper
    - powercap: RAPL: fix invalid initialization for pl4_supported field
    - x86/mm: Switch to new Intel CPU model defines
  * bpf: Fix memory accounting regression in 5.10.214:
    - Revert "bpf: Fix DEVMAP_HASH overflow check on 32-bit arches"
    - Revert "bpf: Eliminate rlimit-based memory accounting for devmap maps"
    - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches

  [ Mateusz Łukasik ]
  * d/salsa-ci.yml: Add linux-compiler-* packages to build-signed job artifacts

  [ Martyn Welch ]
  * Increase timeout of CI build stage to 3 hours to enable build to complete

 -- Ben Hutchings <benh@debian.org>  Thu, 03 Oct 2024 23:58:46 +0200

linux (5.10.223-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.222
    - Compiler Attributes: Add __uninitialized macro
    - [arm64,armhf] drm/lima: fix shared irq handling on driver remove
    - media: dvb: as102-fe: Fix as10x_register_addr packing
    - media: dvb-usb: dib0700_devices: Add missing release_firmware()
    - IB/core: Implement a limit on UMAD receive List
    - scsi: qedf: Make qedf_execute_tmf() non-preemptible
    - crypto: aead,cipher - zeroize key buffer after use
    - drm/amdgpu: Initialize timestamp for some legacy SOCs
    - drm/amd/display: Check index msg_id before read or write
    - drm/amd/display: Check pipe offset before setting vblank
    - drm/amd/display: Skip finding free audio for unknown engine_id
    - media: dw2102: Don't translate i2c read into write
    - sctp: prefer struct_size over open coded arithmetic
    - firmware: dmi: Stop decoding on broken entry
    - Input: ff-core - prefer struct_size over open coded arithmetic
    - [arm64,armhf] net: dsa: mv88e6xxx: Correct check for empty list
    - media: dvb-frontends: tda18271c2dd: Remove casting during div
    - media: s2255: Use refcount_t instead of atomic_t for num_channels
    - media: dvb-frontends: tda10048: Fix integer overflow
    - i2c: i801: Annotate apanel_addr as __ro_after_init
    - [powerpc*] 64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
    - orangefs: fix out-of-bounds fsid access
    - kunit: Fix timeout message
    - [powerpc*] xmon: Check cpu id in commands "c#", "dp#" and "dx#"
    - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
    - jffs2: Fix potential illegal address access in jffs2_free_inode
    - [s390x] pkey: Wipe sensitive data on failure
    - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
    - tcp_metrics: validate source addr length
    - wifi: wilc1000: fix ies_len type in connect path
    - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
      (CVE-2024-39487)
    - inet_diag: Initialize pad field in struct inet_diag_req_v2
    - nilfs2: fix inode number range checks
    - nilfs2: add missing check for inode numbers on directory entries
    - mm: optimize the redundant loop of mm_update_owner_next()
    - mm: avoid overflows in dirty throttling logic
    - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
    - can: kvaser_usb: Explicitly initialize family in leafimx driver_info
      struct
    - fsnotify: Do not generate events for O_PATH file descriptors
    - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(),
      again"
    - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
    - drm/amdgpu/atomfirmware: silence UBSAN warning
    - mtd: rawnand: Bypass a couple of sanity checks during NAND identification
    - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
    - bpf, sockmap: Fix sk->sk_forward_alloc warn_on in sk_stream_kill_queues
    - ima: Avoid blocking in RCU read-side critical section (CVE-2024-40947)
    - media: dw2102: fix a potential buffer overflow
    - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
    - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
    - nvme-multipath: find NUMA path only for online numa-node
    - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset
    - [x86] platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW
      11.6" tablet
    - [x86] platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro
    - nvmet: fix a possible leak when destroy a ctrl during qp establishment
    - kbuild: fix short log for AS in link-vmlinux.sh
    - nilfs2: fix incorrect inode allocation from reserved inodes
    - mm: prevent derefencing NULL ptr in pfn_section_valid()
    - filelock: fix potential use-after-free in posix_lock_inode
    - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
    - vfs: don't mod negative dentry count when on shrinker list
    - tcp: fix incorrect undo caused by DSACK of TLP retransmit
    - net: lantiq_etop: add blank line after declaration
    - net: ethernet: lantiq_etop: fix double free in detach
    - ppp: reject claimed-as-LCP but actually malformed packets
    - ethtool: netlink: do not return SQI value if link is down
    - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
    - net/sched: Fix UAF when resolving a clash
    - [s390x] Mark psw in __load_psw_mask() as __unitialized
    - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
    - tcp: avoid too many retransmit packets (CVE-2024-41007)
    - net: ks8851: Fix potential TX stall after interface reopen
    - USB: serial: option: add Telit generic core-dump composition
    - USB: serial: option: add Telit FN912 rmnet compositions
    - USB: serial: option: add Fibocom FM350-GL
    - USB: serial: option: add support for Foxconn T99W651
    - USB: serial: option: add Netprisma LCUK54 series modules
    - USB: serial: option: add Rolling RW350-GL variants
    - USB: serial: mos7840: fix crash on resume
    - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
    - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
    - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the
      descriptor
    - hpet: Support 32-bit userspace
    - nvmem: meson-efuse: Fix return value of nvmem callbacks
    - ALSA: hda/realtek: Enable Mute LED on HP 250 G7
    - ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
    - libceph: fix race between delayed_work() and ceph_monc_stop()
    - wireguard: allowedips: avoid unaligned 64-bit memory accesses
    - wireguard: queueing: annotate intentional data race in cpu round robin
    - wireguard: send: annotate intentional data race in checking empty queue
    - x86/retpoline: Move a NOENDBR annotation to the SRSO dummy return thunk
    - ipv6: annotate data-races around cnf.disable_ipv6
    - ipv6: prevent NULL dereference in ip6_output() (CVE-2024-36901)
    - bpf: Allow reads from uninit stack
    - nilfs2: fix kernel bug on rename operation of broken directory
    - i2c: mark HostNotify target address as used
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.223
    - gcc-plugins: Rename last_stmt() for GCC 14+
    - filelock: Remove locks reliably when fcntl/close race is detected
      (CVE-2024-41012)
    - scsi: qedf: Set qed_slowpath_params to zero before use
    - ACPI: EC: Abort address space access upon error
    - ACPI: EC: Avoid returning AE_OK on errors in address space handler
    - wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata
    - wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
    - Input: silead - Always support 10 fingers
    - net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()
    - ila: block BH in ila_output()
    - [arm64] armv8_deprecated: Fix warning in isndep cpuhp starting process
    - null_blk: fix validation of block size
    - kconfig: gconf: give a proper initial state to the Save button
    - kconfig: remove wrong expr_trans_bool()
    - fs/file: fix the check in find_next_fd()
    - mei: demote client disconnect warning on suspend to debug
    - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
    - [powerpc*] KVM: PPC: Book3S HV: Prevent UAF in
      kvm_spapr_tce_attach_iommu_group()
    - ALSA: hda/realtek: Add more codec ID to no shutup pins list
    - [mips*] fix compat_sys_lseek syscall
    - Input: elantech - fix touchpad state on resume for Lenovo N24
    - Input: i8042 - add Ayaneo Kun to i8042 quirk table
    - [x86] bytcr_rt5640 : inverse jack detect for Archos 101 cesium
    - [arm*] ALSA: dmaengine: Synchronize dma channel after drop()
    - [armhf] ASoC: ti: davinci-mcasp: Set min period size using FIFO config
    - can: kvaser_usb: fix return value for hif_usb_send_regout
    - [s390x] sclp: Fix sclp_init() cleanup on failure
    - btrfs: qgroup: fix quota root leak after quota disable failure
    - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx
    - ALSA: dmaengine_pcm: terminate dmaengine before synchronize
    - net: usb: qmi_wwan: add Telit FN912 compositions
    - net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and
      DEV_STATS_ADD()
    - [powerpc*] pseries: Whitelist dtl slub object for copying to userspace
    - [powerpc*] eeh: avoid possible crash when edev->pdev changes
    - scsi: libsas: Fix exp-attached device scan after probe failure scanned in
      again after probe failed
    - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
    - fs: better handle deep ancestor chains in is_subdir()
    - spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices
    - hfsplus: fix uninit-value in copy_name
    - spi: mux: set ctlr->bits_per_word_mask
    - [arm*] 9324/1: fix get_user() broken with veneer
    - ACPI: processor_idle: Fix invalid comparison with insertion sort for
      latency
    - bpf: Fix overrunning reservations in ringbuf (CVE-2024-41009)
    - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
      (CVE-2024-36938)
    - scsi: core: Fix a use-after-free (CVE-2022-48666)
    - ext4: fix error code saved on super block during file system abort
    - ext4: Send notifications on error
    - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
    - net: relax socket state check at accept time. (CVE-2024-36484)
    - ocfs2: add bounds checking to ocfs2_check_dir_entry()
    - jfs: don't walk off the end of ealist
    - ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
    - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360
    - [arm64] dts: qcom: msm8996: Disable SS instance in Parkmode for USB
    - [arm*] ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is
      paused
    - filelock: Fix fcntl/close race recovery compat path
    - tun: add missing verification for short frame (CVE-2024-41091)
    - tap: add missing verification for short frame (CVE-2024-41090)

  [ Salvatore Bonaccorso ]
  * Bump ABI to 32
  * fs/nfsd: Enable NFSD_V2 and NFSD_V2_ACL.
    Re-enable lost NFSv2 kernel support due to upstream backporting of
    2f3a4b2ac2f2 ("nfsd: allow disabling NFSv2 at compile time") in
    5.10.220. (Closes: #1076864)
  * netfilter: ipset: Add list flush to cancel_gc

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 10 Aug 2024 08:09:03 +0200

linux (5.10.221-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.219
    - [x86] tsc: Trust initial offset in architectural TSC-adjust MSRs
    - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016)
    - speakup: Fix sizeof() vs ARRAY_SIZE() bug
    - ring-buffer: Fix a race between readers and resize checks (CVE-2024-38601)
    - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
    - nilfs2: fix potential hang in nilfs_detach_log_writer() (CVE-2024-38582)
    - ALSA: core: Fix NULL module pointer assignment at card init
      (CVE-2024-38605)
    - wifi: cfg80211: fix the order of arguments for trace events of the
      tx_rx_evt class
    - net: usb: qmi_wwan: add Telit FN920C04 compositions
    - drm/amd/display: Set color_mgmt_changed to true on unsuspend
    - ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
    - ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
    - ASoC: rt715: add vendor clear control register
    - ASoC: da7219-aad: fix usage of device_get_named_child_node()
    - nvme: find numa distance only if controller has valid numa id
    - crypto: bcm - Fix pointer arithmetic (CVE-2024-38579)
    - firmware: raspberrypi: Use correct device for DMA mappings
    - ecryptfs: Fix buffer size for tag 66 packet (CVE-2024-38578)
    - nilfs2: fix out-of-range warning
    - [x86] crypto: ccp - drop platform ifdef checks
    - [x86] crypto: x86/nh-avx2 - add missing vzeroupper
    - [x86] crypto: x86/sha256-avx2 - add missing vzeroupper
    - [s390x] cio: fix tracepoint subchannel type field
    - jffs2: prevent xattr node from overflowing the eraseblock (CVE-2024-38599)
    - null_blk: Fix missing mutex_destroy() at module removal
    - md: fix resync softlockup when bitmap size is less than array size
      (CVE-2024-38598)
    - wifi: ath10k: poll service ready message before failing
    - [x86] boot: Ignore relocations in .notes sections in walk_relocs() too
    - qed: avoid truncating work queue length
    - scsi: ufs: qcom: Perform read back after writing reset bit
    - scsi: ufs-qcom: Fix ufs RST_n spec violation
    - scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
    - scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0
    - scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5
    - scsi: ufs: qcom: Perform read back after writing unipro mode
    - scsi: ufs: qcom: Perform read back after writing CGC enable
    - scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
    - scsi: ufs: core: Perform read back after disabling interrupts
    - scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
    - irqchip/alpine-msi: Fix off-by-one in allocation error path
    - ACPI: disable -Wstringop-truncation
    - gfs2: Fix "ignore unlock failures after withdraw"
    - cpufreq: Reorganize checks in cpufreq_offline()
    - cpufreq: Split cpufreq_offline()
    - cpufreq: Rearrange locking in cpufreq_remove_dev()
    - cpufreq: exit() callback is optional
    - net: export inet_lookup_reuseport and inet6_lookup_reuseport
    - net: remove duplicate reuseport_lookup functions
    - udp: Avoid call to compute_score on multiple sites
    - scsi: libsas: Fix the failure of adding phy with zero-address to port
    - scsi: hpsa: Fix allocation size for Scsi_Host private data
    - [x86] purgatory: Switch to the position-independent small code model
    - wifi: ath10k: Fix an error code problem in
      ath10k_dbg_sta_write_peer_debug_trigger()
    - wifi: ath10k: populate board data for WCN3990
    - tcp: avoid premature drops in tcp_add_backlog()
    - net: give more chances to rcu in netdev_wait_allrefs_any()
    - macintosh/via-macii: Fix "BUG: sleeping function called from invalid
      context" (CVE-2024-38607)
    - wifi: carl9170: add a proper sanity check for endpoints (CVE-2024-38567)
    - wifi: ar5523: enable proper endpoint verification (CVE-2024-38565)
    - Revert "sh: Handle calling csum_partial with misaligned data"
    - [amd64] HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
    - scsi: bfa: Ensure the copied buf is NUL terminated (CVE-2024-38560)
    - scsi: qedf: Ensure the copied buf is NUL terminated (CVE-2024-38559)
    - wifi: mwl8k: initialize cmd->addr[] properly
    - usb: aqc111: stop lying about skb->truesize
    - net: usb: sr9700: stop lying about skb->truesize
    - net: ipv6: fix wrong start position when receive hop-by-hop fragment
    - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
      (CVE-2024-38597)
    - net: ethernet: cortina: Locking fixes
    - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
      (CVE-2024-38596)
    - net: usb: smsc95xx: stop lying about skb->truesize
    - net: openvswitch: fix overwriting ct original tuple for ICMPv6
      (CVE-2024-38558)
    - ipv6: sr: add missing seg6_local_exit
    - ipv6: sr: fix incorrect unregister order
    - ipv6: sr: fix invalid unregister error path (CVE-2024-38612)
    - net/mlx5: Discard command completions in internal error (CVE-2024-38555)
    - drm/amd/display: Fix potential index out of bounds in color transformation
      function (CVE-2024-38552)
    - ASoC: soc-acpi: add helper to identify parent driver.
    - [x86] ASoC: Intel: Disable route checks for Skylake boards
    - mtd: rawnand: hynix: fixed typo
    - fbdev: shmobile: fix snprintf truncation
    - [arm64] drm/meson: vclk: fix calculation of 59.94 fractional rates
    - [powerpc*] fsl-soc: hide unused const variable
    - fbdev: sisfb: hide unused variables
    - media: ngene: Add dvb_ca_en50221_init return value check
    - media: radio-shark2: Avoid led_names truncations
    - drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
      (CVE-2024-38548)
    - fbdev: sh7760fb: allow modular build
    - media: atomisp: ssh_css: Fix a null-pointer dereference in
      load_video_binaries (CVE-2024-38547)
    - [arm64] drm/arm/malidp: fix a possible null pointer dereference
      (CVE-2024-36014)
    - [arm*] drm: vc4: Fix possible null pointer dereference (CVE-2024-38546)
    - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
    - drm/bridge: lt9611: Don't log an error when DSI host can't be found
    - drm/bridge: tc358775: Don't log an error when DSI host can't be found
    - drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
    - drm/mipi-dsi: use correct return type for the DSC functions
    - [arm64] RDMA/hns: Refactor the hns_roce_buf allocation flow
    - [arm64] RDMA/hns: Create QP with selected QPN for bank load balance
    - [arm64] RDMA/hns: Fix incorrect symbol types
    - [arm64] RDMA/hns: Fix return value in hns_roce_map_mr_sg
    - [arm64] RDMA/hns: Use complete parentheses in macros
    - [arm64] RDMA/hns: Modify the print level of CQE error (CVE-2024-38590)
    - clk: qcom: mmcc-msm8998: fix venus clock issue
    - [x86] insn: Fix PUSH instruction in x86 instruction decoder opcode map
    - ext4: avoid excessive credit estimate in ext4_tmpfile()
    - sunrpc: removed redundant procp check
    - ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple
    - ext4: fix unit mismatch in ext4_mb_new_blocks_simple
    - ext4: try all groups in ext4_mb_new_blocks_simple
    - ext4: remove unused parameter from ext4_mb_new_blocks_simple()
    - ext4: fix potential unnitialized variable
    - SUNRPC: Fix gss_free_in_token_pages()
    - RDMA/IPoIB: Fix format truncation compilation errors
    - net: qrtr: fix null-ptr-deref in qrtr_ns_remove
    - net: qrtr: ns: Fix module refcnt
    - netrom: fix possible dead-lock in nr_rt_ioctl() (CVE-2024-38589)
    - af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
    - sched/fair: Allow disabling sched_balance_newidle with
      sched_relax_domain_level
    - greybus: lights: check return of get_channel_from_mode (CVE-2024-38637)
    - f2fs: fix to wait on page writeback in __clone_blkaddrs()
    - soundwire: cadence: fix invalid PDI offset (CVE-2024-38635)
    - dmaengine: idma64: Add check for dma_set_max_seg_size
    - firmware: dmi-id: add a release callback function
    - serial: max3100: Lock port->lock when calling uart_handle_cts_change()
      (CVE-2024-38634)
    - serial: max3100: Update uart_driver_registered on driver removal
      (CVE-2024-38633)
    - serial: max3100: Fix bitwise types
    - greybus: arche-ctrl: move device table to its right location
    - serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
    - f2fs: compress: support chksum
    - f2fs: add compress_mode mount option
    - f2fs: compress: clean up parameter of __f2fs_cluster_blocks()
    - f2fs: compress: remove unneeded preallocation
    - f2fs: introduce FI_COMPRESS_RELEASED instead of using IMMUTABLE bit
    - f2fs: compress: fix to relocate check condition in
      f2fs_{release,reserve}_compress_blocks()
    - f2fs: add cp_error check in f2fs_write_compressed_pages
    - f2fs: fix to force keeping write barrier for strict fsync mode
    - f2fs: do not allow partial truncation on pinned file
    - f2fs: fix typos in comments
    - f2fs: fix to relocate check condition in f2fs_fallocate()
    - f2fs: fix to check pinfile flag in f2fs_move_file_range()
    - iio: pressure: dps310: support negative temperature values
    - fpga: region: change FPGA indirect article to an
    - fpga: region: Rename dev to parent for parent device
    - docs: driver-api: fpga: avoid using UTF-8 chars
    - fpga: region: Use standard dev_release for class driver
    - fpga: region: add owner module and take its refcount
    - usb: gadget: u_audio: Clear uac pointer when freed.
    - stm class: Fix a double free in stm_register_device() (CVE-2024-38627)
    - ppdev: Remove usage of the deprecated ida_simple_xx() API
    - ppdev: Add an error check in register_device (CVE-2024-36015)
    - extcon: max8997: select IRQ_DOMAIN instead of depending on it
    - PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
    - PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
    - f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/
      cp_rwsem lock
    - f2fs: fix to release node block count in error path of
      f2fs_new_node_page()
    - f2fs: compress: don't allow unaligned truncation on released compress
      inode
    - serial: sh-sci: protect invalidating RXDMA on shutdown
    - libsubcmd: Fix parse-options memory leak
    - [s390x] ipl: Fix incorrect initialization of len fields in nvme reipl
      block
    - [s390x] ipl: Fix incorrect initialization of nvme dump block
    - Input: ims-pcu - fix printf string overflow
    - Input: ioc3kbd - convert to platform remove callback returning void
    - Input: ioc3kbd - add device table
    - Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
    - drm/msm/dpu: Always flush the slave INTF on the CTL
    - drm/bridge: tc358775: fix support for jeida-18 and jeida-24
    - media: stk1160: fix bounds checking in stk1160_copy_video()
      (CVE-2024-38621)
    - scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
    - media: flexcop-usb: clean up endpoint sanity checks
    - media: flexcop-usb: fix sanity check of bNumEndpoints
    - [powerpc*] pseries: Add failure related checks for h_get_mpp and h_get_ppp
    - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
    - media: cec: cec-api: add locking in cec_release()
    - media: core headers: fix kernel-doc warnings
    - media: cec: fix a deadlock situation
    - media: cec: call enable_adap on s_log_addrs
    - media: cec: abort if the current transmit was canceled
    - media: cec: correctly pass on reply results
    - media: cec: use call_op and check for !unregistered
    - media: cec-adap.c: drop activate_cnt, use state info instead
    - media: cec: core: avoid recursive cec_claim_log_addrs
    - media: cec: core: avoid confusing "transmit timed out" message
    - null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
    - regulator: bd71828: Don't overwrite runtime voltages
    - [x86] kconfig: Select ARCH_WANT_FRAME_POINTERS again when
      UNWINDER_FRAME_POINTER=y
    - nfc: nci: Fix uninit-value in nci_rx_work (CVE-2024-38381)
    - ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
    - sunrpc: fix NFSACL RPC retry on soft mount
    - rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
    - ipv6: sr: fix memleak in seg6_hmac_init_algo
    - params: lift param_set_uint_minmax to common code
    - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CVE-2024-37356)).
    - openvswitch: Set the skbuff pkt_type for proper pmtud support.
    - [arm64] asm-bug: Add .align 2 to the end of __BUG_ENTRY
    - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
    - net: fec: avoid lock evasion when reading pps_enable
    - tls: fix missing memory barrier in tls_init (CVE-2024-36489)
    - nfc: nci: Fix kcov check in nci_rx_work()
    - nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
    - netfilter: nfnetlink_queue: acquire rcu_read_lock() in
      instance_destroy_rcu()
    - netfilter: nft_payload: restore vlan q-in-q match support
    - spi: Don't mark message DMA mapped when no transfer in it is
    - nvmet: fix ns enable/disable possible hang
    - net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer
      exhaustion
    - dma-buf/sw-sync: don't enable IRQ from sync_print_obj() (CVE-2024-38780)
    - bpf: Fix potential integer overflow in resolve_btfids
    - enic: Validate length of nl attributes in enic_set_vf_port
      (CVE-2024-38659)
    - net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
    - bpf: Allow delete from sockmap/sockhash only if update is allowed
      (CVE-2024-38662)
    - net:fec: Add fec_enet_deinit()
    - netfilter: tproxy: bail out if IP has been disabled on the device
      (CVE-2024-36270)
    - kconfig: fix comparison to constant symbols, 'm', 'n'
    - spi: stm32: Don't warn about spurious interrupts
    - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
    - hwmon: (shtc1) Fix property misspelling
    - ALSA: timer: Set lower bound of start tick time (CVE-2024-38618)
    - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
      (CVE-2024-31076)
    - media: cec: core: add adap_nb_transmit_canceled() callback
    - SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
      (CVE-2024-36288)
    - [arm*] binder: fix max_thread type inconsistency
    - mmc: core: Do not force a retune before RPMB switch
    - io_uring: fail NOP if non-zero op flags is passed in
    - afs: Don't cross .backup mountpoint from backup volume
    - nilfs2: fix use-after-free of timer for log writer thread (CVE-2024-38583)
    - vxlan: Fix regression when dropping packets due to invalid src addresses
    - [x86] mm: Remove broken vsyscall emulation code from the page fault code
    - netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
    - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
      (CVE-2024-27019)
    - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
    - media: lgdt3306a: Add a check against null-pointer-def
    - drm/amdgpu: add error handle to avoid out-of-bounds
    - ata: pata_legacy: make legacy_exit() work again
    - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
    - [arm64] tegra: Correct Tegra132 I2C alias
    - [arm64] dts: qcom: qcs404: fix bluetooth device address
    - md/raid5: fix deadlock that raid5d() wait for itself to clear
      MD_SB_CHANGE_PENDING
    - wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
    - wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE
    - wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path
    - [arm64] dts: hi3798cv200: fix the size of GICR
    - media: mc: mark the media devnode as registered from the, start
    - media: mxl5xx: Move xpt structures off stack
    - media: v4l2-core: hold videodev_lock until dev reg, finishes
    - mmc: core: Add mmc_gpiod_set_cd_config() function
    - mmc: sdhci-acpi: Sort DMI quirks alphabetically
    - mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working
    - mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A
    - fbdev: savage: Handle err return when savagefb_check_var failed
    - [arm64] KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
    - crypto: ecrdsa - Fix module auto-load on add_key
    - [x86] crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
    - net/ipv6: Fix route deleting failure when metric equals 0
    - net/9p: fix uninit-value in p9_client_rpc()
    - [x86] intel_th: pci: Add Meteor Lake-S CPU support
    - watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin
    - kdb: Fix buffer overflow during tab-complete
    - kdb: Use format-strings rather than '\0' injection in kdb_read()
    - kdb: Fix console handling when editing and tab-completing commands
    - kdb: Merge identical case statements in kdb_read()
    - kdb: Use format-specifiers rather than memset() for padding in kdb_read()
    - net: fix __dst_negative_advice() race
    - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
    - [s390x] ap: Fix crash in AP internal function modify_bitmap()
    - nfs: fix undefined behavior in nfs_block_bits()
    - NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS
    - scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5
    - f2fs: compress: fix compression chksum
    - [arm64] RDMA/hns: Use mutex instead of spinlock for ida allocation
    - [arm64] RDMA/hns: Fix CQ and QP cache affinity
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.220
    - SUNRPC: Rename svc_encode_read_payload()
    - NFSD: Invoke svc_encode_result_payload() in "read" NFSD encoders
    - NFSD: A semicolon is not needed after a switch statement.
    - nfsd/nfs3: remove unused macro nfsd3_fhandleres
    - NFSD: Clean up the show_nf_may macro
    - NFSD: Remove extra "0x" in tracepoint format specifier
    - NFSD: Add SPDX header for fs/nfsd/trace.c
    - nfsd: Fix error return code in nfsd_file_cache_init()
    - SUNRPC: Add xdr_set_scratch_page() and xdr_reset_scratch_buffer()
    - SUNRPC: Prepare for xdr_stream-style decoding on the server-side
    - NFSD: Add common helpers to decode void args and encode void results
    - NFSD: Add tracepoints in nfsd_dispatch()
    - NFSD: Add tracepoints in nfsd4_decode/encode_compound()
    - NFSD: Replace the internals of the READ_BUF() macro
    - NFSD: Replace READ* macros in nfsd4_decode_access()
    - NFSD: Replace READ* macros in nfsd4_decode_close()
    - NFSD: Replace READ* macros in nfsd4_decode_commit()
    - NFSD: Change the way the expected length of a fattr4 is checked
    - NFSD: Replace READ* macros that decode the fattr4 size attribute
    - NFSD: Replace READ* macros that decode the fattr4 acl attribute
    - NFSD: Replace READ* macros that decode the fattr4 mode attribute
    - NFSD: Replace READ* macros that decode the fattr4 owner attribute
    - NFSD: Replace READ* macros that decode the fattr4 owner_group attribute
    - NFSD: Replace READ* macros that decode the fattr4 time_set attributes
    - NFSD: Replace READ* macros that decode the fattr4 security label attribute
    - NFSD: Replace READ* macros that decode the fattr4 umask attribute
    - NFSD: Replace READ* macros in nfsd4_decode_fattr()
    - NFSD: Replace READ* macros in nfsd4_decode_create()
    - NFSD: Replace READ* macros in nfsd4_decode_delegreturn()
    - NFSD: Replace READ* macros in nfsd4_decode_getattr()
    - NFSD: Replace READ* macros in nfsd4_decode_link()
    - NFSD: Relocate nfsd4_decode_opaque()
    - NFSD: Add helpers to decode a clientid4 and an NFSv4 state owner
    - NFSD: Add helper for decoding locker4
    - NFSD: Replace READ* macros in nfsd4_decode_lock()
    - NFSD: Replace READ* macros in nfsd4_decode_lockt()
    - NFSD: Replace READ* macros in nfsd4_decode_locku()
    - NFSD: Replace READ* macros in nfsd4_decode_lookup()
    - NFSD: Add helper to decode NFSv4 verifiers
    - NFSD: Add helper to decode OPEN's createhow4 argument
    - NFSD: Add helper to decode OPEN's openflag4 argument
    - NFSD: Replace READ* macros in nfsd4_decode_share_access()
    - NFSD: Replace READ* macros in nfsd4_decode_share_deny()
    - NFSD: Add helper to decode OPEN's open_claim4 argument
    - NFSD: Replace READ* macros in nfsd4_decode_open()
    - NFSD: Replace READ* macros in nfsd4_decode_open_confirm()
    - NFSD: Replace READ* macros in nfsd4_decode_open_downgrade()
    - NFSD: Replace READ* macros in nfsd4_decode_putfh()
    - NFSD: Replace READ* macros in nfsd4_decode_read()
    - NFSD: Replace READ* macros in nfsd4_decode_readdir()
    - NFSD: Replace READ* macros in nfsd4_decode_remove()
    - NFSD: Replace READ* macros in nfsd4_decode_rename()
    - NFSD: Replace READ* macros in nfsd4_decode_renew()
    - NFSD: Replace READ* macros in nfsd4_decode_secinfo()
    - NFSD: Replace READ* macros in nfsd4_decode_setattr()
    - NFSD: Replace READ* macros in nfsd4_decode_setclientid()
    - NFSD: Replace READ* macros in nfsd4_decode_setclientid_confirm()
    - NFSD: Replace READ* macros in nfsd4_decode_verify()
    - NFSD: Replace READ* macros in nfsd4_decode_write()
    - NFSD: Replace READ* macros in nfsd4_decode_release_lockowner()
    - NFSD: Replace READ* macros in nfsd4_decode_cb_sec()
    - NFSD: Replace READ* macros in nfsd4_decode_backchannel_ctl()
    - NFSD: Replace READ* macros in nfsd4_decode_bind_conn_to_session()
    - NFSD: Add a separate decoder to handle state_protect_ops
    - NFSD: Add a separate decoder for ssv_sp_parms
    - NFSD: Add a helper to decode state_protect4_a
    - NFSD: Add a helper to decode nfs_impl_id4
    - NFSD: Add a helper to decode channel_attrs4
    - NFSD: Replace READ* macros in nfsd4_decode_create_session()
    - NFSD: Replace READ* macros in nfsd4_decode_destroy_session()
    - NFSD: Replace READ* macros in nfsd4_decode_free_stateid()
    - NFSD: Replace READ* macros in nfsd4_decode_getdeviceinfo()
    - NFSD: Replace READ* macros in nfsd4_decode_layoutcommit()
    - NFSD: Replace READ* macros in nfsd4_decode_layoutget()
    - NFSD: Replace READ* macros in nfsd4_decode_layoutreturn()
    - NFSD: Replace READ* macros in nfsd4_decode_secinfo_no_name()
    - NFSD: Replace READ* macros in nfsd4_decode_sequence()
    - NFSD: Replace READ* macros in nfsd4_decode_test_stateid()
    - NFSD: Replace READ* macros in nfsd4_decode_destroy_clientid()
    - NFSD: Replace READ* macros in nfsd4_decode_reclaim_complete()
    - NFSD: Replace READ* macros in nfsd4_decode_fallocate()
    - NFSD: Replace READ* macros in nfsd4_decode_nl4_server()
    - NFSD: Replace READ* macros in nfsd4_decode_copy()
    - NFSD: Replace READ* macros in nfsd4_decode_copy_notify()
    - NFSD: Replace READ* macros in nfsd4_decode_offload_status()
    - NFSD: Replace READ* macros in nfsd4_decode_seek()
    - NFSD: Replace READ* macros in nfsd4_decode_clone()
    - NFSD: Replace READ* macros in nfsd4_decode_xattr_name()
    - NFSD: Replace READ* macros in nfsd4_decode_setxattr()
    - NFSD: Replace READ* macros in nfsd4_decode_listxattrs()
    - NFSD: Make nfsd4_ops::opnum a u32
    - NFSD: Replace READ* macros in nfsd4_decode_compound()
    - NFSD: Remove macros that are no longer used
    - nfsd: only call inode_query_iversion in the I_VERSION case
    - nfsd: simplify nfsd4_change_info
    - nfsd: minor nfsd4_change_attribute cleanup
    - nfsd4: don't query change attribute in v2/v3 case
    - Revert "nfsd4: support change_attr_type attribute"
    - nfsd: add a new EXPORT_OP_NOWCC flag to struct export_operations
    - nfsd: allow filesystems to opt out of subtree checking
    - nfsd: close cached files prior to a REMOVE or RENAME that would replace
      target
    - exportfs: Add a function to return the raw output from fh_to_dentry()
    - nfsd: Fix up nfsd to ensure that timeout errors don't result in ESTALE
    - nfsd: Set PF_LOCAL_THROTTLE on local filesystems only
    - nfsd: Record NFSv4 pre/post-op attributes as non-atomic
    - exec: Don't open code get_close_on_exec
    - exec: Move unshare_files to fix posix file locking during exec
    - exec: Simplify unshare_files
    - exec: Remove reset_files_struct
    - kcmp: In kcmp_epoll_target use fget_task
    - bpf: In bpf_task_fd_query use fget_task
    - proc/fd: In proc_fd_link use fget_task
    - Revert "fget: clarify and improve __fget_files() implementation"
    - file: Rename __fcheck_files to files_lookup_fd_raw
    - file: Factor files_lookup_fd_locked out of fcheck_files
    - file: Replace fcheck_files with files_lookup_fd_rcu
    - file: Rename fcheck lookup_fd_rcu
    - file: Implement task_lookup_fd_rcu
    - proc/fd: In tid_fd_mode use task_lookup_fd_rcu
    - kcmp: In get_file_raw_ptr use task_lookup_fd_rcu
    - file: Implement task_lookup_next_fd_rcu
    - proc/fd: In proc_readfd_common use task_lookup_next_fd_rcu
    - proc/fd: In fdinfo seq_show don't use get_files_struct
    - file: Merge __fd_install into fd_install
    - file: In f_dupfd read RLIMIT_NOFILE once.
    - file: Merge __alloc_fd into alloc_fd
    - file: Rename __close_fd to close_fd and remove the files parameter
    - file: Replace ksys_close with close_fd
    - inotify: Increase default inotify.max_user_watches limit to 1048576
    - fs/lockd: convert comma to semicolon
    - NFSD: Fix sparse warning in nfssvc.c
    - NFSD: Restore NFSv4 decoding's SAVEMEM functionality
    - SUNRPC: Make trace_svc_process() display the RPC procedure symbolically
    - SUNRPC: Display RPC procedure names instead of proc numbers
    - SUNRPC: Move definition of XDR_UNIT
    - NFSD: Update GETATTR3args decoder to use struct xdr_stream
    - NFSD: Update ACCESS3arg decoder to use struct xdr_stream
    - NFSD: Update READ3arg decoder to use struct xdr_stream
    - NFSD: Update WRITE3arg decoder to use struct xdr_stream
    - NFSD: Update READLINK3arg decoder to use struct xdr_stream
    - NFSD: Fix returned READDIR offset cookie
    - NFSD: Add helper to set up the pages where the dirlist is encoded
    - NFSD: Update READDIR3args decoders to use struct xdr_stream
    - NFSD: Update COMMIT3arg decoder to use struct xdr_stream
    - NFSD: Update the NFSv3 DIROPargs decoder to use struct xdr_stream
    - NFSD: Update the RENAME3args decoder to use struct xdr_stream
    - NFSD: Update the LINK3args decoder to use struct xdr_stream
    - NFSD: Update the SETATTR3args decoder to use struct xdr_stream
    - NFSD: Update the CREATE3args decoder to use struct xdr_stream
    - NFSD: Update the MKDIR3args decoder to use struct xdr_stream
    - NFSD: Update the SYMLINK3args decoder to use struct xdr_stream
    - NFSD: Update the MKNOD3args decoder to use struct xdr_stream
    - NFSD: Update the NFSv2 GETATTR argument decoder to use struct xdr_stream
    - NFSD: Update the NFSv2 READ argument decoder to use struct xdr_stream
    - NFSD: Update the NFSv2 WRITE argument decoder to use struct xdr_stream
    - NFSD: Update the NFSv2 READLINK argument decoder to use struct xdr_stream
    - NFSD: Add helper to set up the pages where the dirlist is encoded
    - NFSD: Update the NFSv2 READDIR argument decoder to use struct xdr_stream
    - NFSD: Update NFSv2 diropargs decoding to use struct xdr_stream
    - NFSD: Update the NFSv2 RENAME argument decoder to use struct xdr_stream
    - NFSD: Update the NFSv2 LINK argument decoder to use struct xdr_stream
    - NFSD: Update the NFSv2 SETATTR argument decoder to use struct xdr_stream
    - NFSD: Update the NFSv2 CREATE argument decoder to use struct xdr_stream
    - NFSD: Update the NFSv2 SYMLINK argument decoder to use struct xdr_stream
    - NFSD: Remove argument length checking in nfsd_dispatch()
    - NFSD: Update the NFSv2 GETACL argument decoder to use struct xdr_stream
    - NFSD: Add an xdr_stream-based decoder for NFSv2/3 ACLs
    - NFSD: Update the NFSv2 SETACL argument decoder to use struct xdr_stream
    - NFSD: Update the NFSv2 ACL GETATTR argument decoder to use struct
      xdr_stream
    - NFSD: Update the NFSv2 ACL ACCESS argument decoder to use struct
      xdr_stream
    - NFSD: Clean up after updating NFSv2 ACL decoders
    - NFSD: Update the NFSv3 GETACL argument decoder to use struct xdr_stream
    - NFSD: Update the NFSv2 SETACL argument decoder to use struct xdr_stream
    - NFSD: Clean up after updating NFSv3 ACL decoders
    - nfsd: remove unused stats counters
    - nfsd: protect concurrent access to nfsd stats counters
    - nfsd: report per-export stats
    - nfsd4: simplify process_lookup1
    - nfsd: simplify process_lock
    - nfsd: simplify nfsd_renew
    - nfsd: rename lookup_clientid->set_client
    - nfsd: refactor set_client
    - nfsd: find_cpntf_state cleanup
    - nfsd: remove unused set_client argument
    - nfsd: simplify nfsd4_check_open_reclaim
    - nfsd: cstate->session->se_client -> cstate->clp
    - NFSv4_2: SSC helper should use its own config.
    - nfs: use change attribute for NFS re-exports
    - nfsd: skip some unnecessary stats in the v4 case
    - inotify, memcg: account inotify instances to kmemcg
    - module: unexport find_module and module_mutex
    - module: use RCU to synchronize find_module
    - kallsyms: refactor {,module_}kallsyms_on_each_symbol
    - kallsyms: only build {,module_}kallsyms_on_each_symbol when required
    - fs: add file and path permissions helpers
    - namei: introduce struct renamedata
    - NFSD: Extract the svcxdr_init_encode() helper
    - NFSD: Update the GETATTR3res encoder to use struct xdr_stream
    - NFSD: Update the NFSv3 ACCESS3res encoder to use struct xdr_stream
    - NFSD: Update the NFSv3 LOOKUP3res encoder to use struct xdr_stream
    - NFSD: Update the NFSv3 wccstat result encoder to use struct xdr_stream
    - NFSD: Update the NFSv3 READLINK3res encoder to use struct xdr_stream
    - NFSD: Update the NFSv3 READ3res encode to use struct xdr_stream
    - NFSD: Update the NFSv3 WRITE3res encoder to use struct xdr_stream
    - NFSD: Update the NFSv3 CREATE family of encoders to use struct xdr_stream
    - NFSD: Update the NFSv3 RENAMEv3res encoder to use struct xdr_stream
    - NFSD: Update the NFSv3 LINK3res encoder to use struct xdr_stream
    - NFSD: Update the NFSv3 FSSTAT3res encoder to use struct xdr_stream
    - NFSD: Update the NFSv3 FSINFO3res encoder to use struct xdr_stream
    - NFSD: Update the NFSv3 PATHCONF3res encoder to use struct xdr_stream
    - NFSD: Update the NFSv3 COMMIT3res encoder to use struct xdr_stream
    - NFSD: Add a helper that encodes NFSv3 directory offset cookies
    - NFSD: Count bytes instead of pages in the NFSv3 READDIR encoder
    - NFSD: Update the NFSv3 READDIR3res encoder to use struct xdr_stream
    - NFSD: Update NFSv3 READDIR entry encoders to use struct xdr_stream
    - NFSD: Remove unused NFSv3 directory entry encoders
    - NFSD: Reduce svc_rqst::rq_pages churn during READDIR operations
    - NFSD: Update the NFSv2 stat encoder to use struct xdr_stream
    - NFSD: Update the NFSv2 attrstat encoder to use struct xdr_stream
    - NFSD: Update the NFSv2 diropres encoder to use struct xdr_stream
    - NFSD: Update the NFSv2 READLINK result encoder to use struct xdr_stream
    - NFSD: Update the NFSv2 READ result encoder to use struct xdr_stream
    - NFSD: Update the NFSv2 STATFS result encoder to use struct xdr_stream
    - NFSD: Add a helper that encodes NFSv3 directory offset cookies
    - NFSD: Count bytes instead of pages in the NFSv2 READDIR encoder
    - NFSD: Update the NFSv2 READDIR result encoder to use struct xdr_stream
    - NFSD: Update the NFSv2 READDIR entry encoder to use struct xdr_stream
    - NFSD: Remove unused NFSv2 directory entry encoders
    - NFSD: Add an xdr_stream-based encoder for NFSv2/3 ACLs
    - NFSD: Update the NFSv2 GETACL result encoder to use struct xdr_stream
    - NFSD: Update the NFSv2 SETACL result encoder to use struct xdr_stream
    - NFSD: Update the NFSv2 ACL GETATTR result encoder to use struct xdr_stream
    - NFSD: Update the NFSv2 ACL ACCESS result encoder to use struct xdr_stream
    - NFSD: Clean up after updating NFSv2 ACL encoders
    - NFSD: Update the NFSv3 GETACL result encoder to use struct xdr_stream
    - NFSD: Update the NFSv3 SETACL result encoder to use struct xdr_stream
    - NFSD: Clean up after updating NFSv3 ACL encoders
    - NFSD: Add a tracepoint to record directory entry encoding
    - NFSD: Clean up NFSDDBG_FACILITY macro
    - nfsd: helper for laundromat expiry calculations
    - nfsd: Log client tracking type log message as info instead of warning
    - nfsd: Fix typo "accesible"
    - nfsd: COPY with length 0 should copy to end of file
    - nfsd: don't ignore high bits of copy count
    - nfsd: report client confirmation status in "info" file
    - SUNRPC: Export svc_xprt_received()
    - UAPI: nfsfh.h: Replace one-element array with flexible-array member
    - NFSD: Use DEFINE_SPINLOCK() for spinlock
    - fsnotify: allow fsnotify_{peek,remove}_first_event with empty queue
    - Revert "fanotify: limit number of event merge attempts"
    - fanotify: reduce event objectid to 29-bit hash
    - fanotify: mix event info and pid into merge key hash
    - fsnotify: use hash table for faster events merge
    - fanotify: limit number of event merge attempts
    - fanotify: configurable limits via sysfs
    - fanotify: support limited functionality for unprivileged users
    - fanotify_user: use upper_32_bits() to verify mask
    - nfsd: remove unused function
    - nfsd: removed unused argument in nfsd_startup_generic()
    - nfsd: hash nfs4_files by inode number
    - nfsd: track filehandle aliasing in nfs4_files
    - nfsd: reshuffle some code
    - nfsd: grant read delegations to clients holding writes
    - nfsd: Fix fall-through warnings for Clang
    - NFSv4.2: Remove ifdef CONFIG_NFSD from NFSv4.2 client SSC code.
    - NFS: fix nfs_fetch_iversion()
    - fanotify: fix permission model of unprivileged group
    - NFSD: Add an RPC authflavor tracepoint display helper
    - NFSD: Add nfsd_clid_cred_mismatch tracepoint
    - NFSD: Add nfsd_clid_verf_mismatch tracepoint
    - NFSD: Remove trace_nfsd_clid_inuse_err
    - NFSD: Add nfsd_clid_confirmed tracepoint
    - NFSD: Add nfsd_clid_reclaim_complete tracepoint
    - NFSD: Add nfsd_clid_destroyed tracepoint
    - NFSD: Add a couple more nfsd_clid_expired call sites
    - NFSD: Add tracepoints for SETCLIENTID edge cases
    - NFSD: Add tracepoints for EXCHANGEID edge cases
    - NFSD: Constify @fh argument of knfsd_fh_hash()
    - NFSD: Capture every CB state transition
    - NFSD: Drop TRACE_DEFINE_ENUM for NFSD4_CB_<state> macros
    - NFSD: Add cb_lost tracepoint
    - NFSD: Adjust cb_shutdown tracepoint
    - NFSD: Enhance the nfsd_cb_setup tracepoint
    - NFSD: Add an nfsd_cb_lm_notify tracepoint
    - NFSD: Add an nfsd_cb_offload tracepoint
    - NFSD: Replace the nfsd_deleg_break tracepoint
    - NFSD: Add an nfsd_cb_probe tracepoint
    - NFSD: Remove the nfsd_cb_work and nfsd_cb_done tracepoints
    - NFSD: Update nfsd_cb_args tracepoint
    - nfsd: Prevent truncation of an unlinked inode from blocking access to its
      directory
    - nfsd: move some commit_metadata()s outside the inode lock
    - NFSD add vfs_fsync after async copy is done
    - NFSD: delay unmount source's export after inter-server copy completed.
    - nfsd: move fsnotify on client creation outside spinlock
    - nfsd4: Expose the callback address and state of each NFS4 client
    - nfsd: fix kernel test robot warning in SSC code
    - NFSD: Fix error return code in nfsd4_interssc_connect()
    - nfsd: rpc_peeraddr2str needs rcu lock
    - lockd: Remove stale comments
    - lockd: Create a simplified .vs_dispatch method for NLM requests
    - lockd: Common NLM XDR helpers
    - lockd: Update the NLMv1 void argument decoder to use struct xdr_stream
    - lockd: Update the NLMv1 TEST arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv1 LOCK arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv1 CANCEL arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv1 UNLOCK arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv1 nlm_res arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv1 SM_NOTIFY arguments decoder to use struct
      xdr_stream
    - lockd: Update the NLMv1 SHARE arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv1 FREE_ALL arguments decoder to use struct
      xdr_stream
    - lockd: Update the NLMv1 void results encoder to use struct xdr_stream
    - lockd: Update the NLMv1 TEST results encoder to use struct xdr_stream
    - lockd: Update the NLMv1 nlm_res results encoder to use struct xdr_stream
    - lockd: Update the NLMv1 SHARE results encoder to use struct xdr_stream
    - lockd: Update the NLMv4 void arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv4 TEST arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv4 LOCK arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv4 CANCEL arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv4 UNLOCK arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv4 nlm_res arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv4 SM_NOTIFY arguments decoder to use struct
      xdr_stream
    - lockd: Update the NLMv4 SHARE arguments decoder to use struct xdr_stream
    - lockd: Update the NLMv4 FREE_ALL arguments decoder to use struct
      xdr_stream
    - lockd: Update the NLMv4 void results encoder to use struct xdr_stream
    - lockd: Update the NLMv4 TEST results encoder to use struct xdr_stream
    - lockd: Update the NLMv4 nlm_res results encoder to use struct xdr_stream
    - lockd: Update the NLMv4 SHARE results encoder to use struct xdr_stream
    - nfsd: remove redundant assignment to pointer 'this'
    - NFSD: Prevent a possible oops in the nfs_dirent() tracepoint
    - nfsd: fix NULL dereference in nfs3svc_encode_getaclres
    - kernel/pid.c: remove static qualifier from pidfd_create()
    - kernel/pid.c: implement additional checks upon pidfd_create() parameters
    - fanotify: minor cosmetic adjustments to fid labels
    - fanotify: introduce a generic info record copying helper
    - fanotify: add pidfd support to the fanotify API
    - fsnotify: replace igrab() with ihold() on attach connector
    - fsnotify: count s_fsnotify_inode_refs for attached connectors
    - fsnotify: count all objects with attached connectors
    - fsnotify: optimize the case of no marks of any type
    - NFSD: Clean up splice actor
    - SUNRPC: Add svc_rqst_replace_page() API
    - NFSD: Batch release pages during splice read
    - NFSD: remove vanity comments
    - sysctl: introduce new proc handler proc_dobool
    - lockd: change the proc_handler for nsm_use_hostnames
    - nlm: minor nlm_lookup_file argument change
    - nlm: minor refactoring
    - lockd: update nlm_lookup_file reexport comment
    - Keep read and write fds with each nlm_file
    - nfs: don't atempt blocking locks on nfs reexports
    - lockd: don't attempt blocking locks on nfs reexports
    - nfs: don't allow reexport reclaims
    - SUNRPC: Add svc_rqst::rq_auth_stat
    - SUNRPC: Set rq_auth_stat in the pg_authenticate() callout
    - SUNRPC: Eliminate the RQ_AUTHERR flag
    - NFS: Add a private local dispatcher for NFSv4 callback operations
    - NFS: Remove unused callback void decoder
    - fsnotify: fix sb_connectors leak
    - NLM: Fix svcxdr_encode_owner()
    - nfsd: Fix a warning for nfsd_file_close_inode
    - fsnotify: pass data_type to fsnotify_name()
    - fsnotify: pass dentry instead of inode data
    - fsnotify: clarify contract for create event hooks
    - fsnotify: Don't insert unmergeable events in hashtable
    - fanotify: Fold event size calculation to its own function
    - fanotify: Split fsid check from other fid mode checks
    - inotify: Don't force FS_IN_IGNORED
    - fsnotify: Add helper to detect overflow_event
    - fsnotify: Add wrapper around fsnotify_add_event
    - fsnotify: Retrieve super block from the data field
    - fsnotify: Protect fsnotify_handle_inode_event from no-inode events
    - fsnotify: Pass group argument to free_event
    - fanotify: Support null inode event in fanotify_dfid_inode
    - fanotify: Allow file handle encoding for unhashed events
    - fanotify: Encode empty file handle when no inode is provided
    - fanotify: Require fid_mode for any non-fd event
    - fsnotify: Support FS_ERROR event type
    - fanotify: Reserve UAPI bits for FAN_FS_ERROR
    - fanotify: Pre-allocate pool of error events
    - fanotify: Support enqueueing of error events
    - fanotify: Support merging of error events
    - fanotify: Wrap object_fh inline space in a creator macro
    - fanotify: Add helpers to decide whether to report FID/DFID
    - fanotify: WARN_ON against too large file handles
    - fanotify: Report fid info for file related file system errors
    - fanotify: Emit generic error info for error event
    - fanotify: Allow users to request FAN_FS_ERROR events
    - SUNRPC: Trace calls to .rpc_call_done
    - NFSD: Optimize DRC bucket pruning
    - NFSD: move filehandle format declarations out of "uapi".
    - NFSD: drop support for ancient filehandles
    - NFSD: simplify struct nfsfh
    - NFSD: Initialize pointer ni with NULL and not plain integer 0
    - NFSD: Have legacy NFSD WRITE decoders use xdr_stream_subsegment()
    - SUNRPC: Replace the "__be32 *p" parameter to .pc_decode
    - SUNRPC: Change return value type of .pc_decode
    - NFSD: Save location of NFSv4 COMPOUND status
    - SUNRPC: Replace the "__be32 *p" parameter to .pc_encode
    - SUNRPC: Change return value type of .pc_encode
    - nfsd: update create verifier comment
    - NFSD:fix boolreturn.cocci warning
    - nfsd4: remove obselete comment
    - NFSD: Fix exposure in nfsd4_decode_bitmap()
    - NFSD: Fix READDIR buffer overflow
    - fsnotify: clarify object type argument
    - fsnotify: separate mark iterator type from object type enum
    - fanotify: introduce group flag FAN_REPORT_TARGET_FID
    - fsnotify: generate FS_RENAME event with rich information
    - fanotify: use macros to get the offset to fanotify_info buffer
    - fanotify: use helpers to parcel fanotify_info buffer
    - fanotify: support secondary dir fh and name in fanotify_info
    - fanotify: record old and new parent and name in FAN_RENAME event
    - fanotify: record either old name new name or both for FAN_RENAME
    - fanotify: report old and/or new parent+name in FAN_RENAME event
    - fanotify: wire up FAN_RENAME event
    - exit: Implement kthread_exit
    - exit: Rename module_put_and_exit to module_put_and_kthread_exit
    - NFSD: Fix sparse warning
    - NFSD: handle errors better in write_ports_addfd()
    - SUNRPC: change svc_get() to return the svc.
    - SUNRPC/NFSD: clean up get/put functions.
    - SUNRPC: stop using ->sv_nrthreads as a refcount
    - nfsd: make nfsd_stats.th_cnt atomic_t
    - SUNRPC: use sv_lock to protect updates to sv_nrthreads.
    - NFSD: narrow nfsd_mutex protection in nfsd thread
    - NFSD: Make it possible to use svc_set_num_threads_sync
    - SUNRPC: discard svo_setup and rename svc_set_num_threads_sync()
    - NFSD: simplify locking for network notifier.
    - lockd: introduce nlmsvc_serv
    - lockd: simplify management of network status notifiers
    - lockd: move lockd_start_svc() call into lockd_create_svc()
    - lockd: move svc_exit_thread() into the thread
    - lockd: introduce lockd_put()
    - lockd: rename lockd_create_svc() to lockd_get()
    - SUNRPC: move the pool_map definitions (back) into svc.c
    - SUNRPC: always treat sv_nrpools==1 as "not pooled"
    - lockd: use svc_set_num_threads() for thread start and stop
    - NFS: switch the callback service back to non-pooled.
    - NFSD: Remove be32_to_cpu() from DRC hash function
    - NFSD: Fix inconsistent indenting
    - NFSD: simplify per-net file cache management
    - NFSD: Combine XDR error tracepoints
    - nfsd: improve stateid access bitmask documentation
    - NFSD: De-duplicate nfsd4_decode_bitmap4()
    - nfs: block notification on fs with its own ->lock
    - nfsd4: add refcount for nfsd4_blocked_lock
    - NFSD: Fix zero-length NFSv3 WRITEs
    - nfsd: map EBADF
    - nfsd: Add errno mapping for EREMOTEIO
    - nfsd: Retry once in nfsd_open on an -EOPENSTALE return
    - NFSD: Clean up nfsd_vfs_write()
    - NFSD: De-duplicate net_generic(SVC_NET(rqstp), nfsd_net_id)
    - NFSD: De-duplicate net_generic(nf->nf_net, nfsd_net_id)
    - nfsd: Add a tracepoint for errors in nfsd4_clone_file_range()
    - NFSD: Write verifier might go backwards
    - NFSD: Clean up the nfsd_net::nfssvc_boot field
    - NFSD: Rename boot verifier functions
    - NFSD: Trace boot verifier resets
    - Revert "nfsd: skip some unnecessary stats in the v4 case"
    - NFSD: Move fill_pre_wcc() and fill_post_wcc()
    - nfsd: fix crash on COPY_NOTIFY with special stateid
    - fanotify: remove variable set but not used
    - lockd: fix server crash on reboot of client holding lock
    - lockd: fix failure to cleanup client locks
    - NFSD: Fix the behavior of READ near OFFSET_MAX
    - NFSD: Fix ia_size underflow
    - NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
    - NFSD: COMMIT operations must not return NFS?ERR_INVAL
    - NFSD: Deprecate NFS_OFFSET_MAX
    - nfsd: Add support for the birth time attribute
    - NFSD: De-duplicate hash bucket indexing
    - NFSD: Skip extra computation for RC_NOCACHE case
    - NFSD: Streamline the rare "found" case
    - SUNRPC: Remove the .svo_enqueue_xprt method
    - SUNRPC: Merge svc_do_enqueue_xprt() into svc_enqueue_xprt()
    - SUNRPC: Remove svo_shutdown method
    - SUNRPC: Rename svc_create_xprt()
    - SUNRPC: Rename svc_close_xprt()
    - SUNRPC: Remove svc_shutdown_net()
    - NFSD: Remove svc_serv_ops::svo_module
    - NFSD: Move svc_serv_ops::svo_function into struct svc_serv
    - NFSD: Remove CONFIG_NFSD_V3
    - NFSD: Clean up _lm_ operation names
    - nfsd: fix using the correct variable for sizeof()
    - fsnotify: fix merge with parent's ignored mask
    - fsnotify: optimize FS_MODIFY events with no ignored masks
    - fsnotify: remove redundant parameter judgment
    - SUNRPC: Return true/false (not 1/0) from bool functions
    - nfsd: Fix a write performance regression
    - nfsd: Clean up nfsd_file_put()
    - fanotify: do not allow setting dirent events in mask of non-dir
    - fs/lock: documentation cleanup. Replace inode->i_lock with flc_lock.
    - inotify: move control flags from mask to mark flags
    - fsnotify: pass flags argument to fsnotify_alloc_group()
    - fsnotify: make allow_dups a property of the group
    - fsnotify: create helpers for group mark_mutex lock
    - inotify: use fsnotify group lock helpers
    - nfsd: use fsnotify group lock helpers
    - dnotify: use fsnotify group lock helpers
    - fsnotify: allow adding an inode mark without pinning inode
    - fanotify: create helper fanotify_mark_user_flags()
    - fanotify: factor out helper fanotify_mark_update_flags()
    - fanotify: implement "evictable" inode marks
    - fanotify: use fsnotify group lock helpers
    - fanotify: enable "evictable" inode marks
    - fsnotify: introduce mark type iterator
    - fsnotify: consistent behavior for parent not watching children
    - fanotify: fix incorrect fmode_t casts
    - NFSD: Clean up nfsd_splice_actor()
    - NFSD: add courteous server support for thread with only delegation
    - NFSD: add support for share reservation conflict to courteous server
    - NFSD: move create/destroy of laundry_wq to init_nfsd and exit_nfsd
    - fs/lock: add helper locks_owner_has_blockers to check for blockers
    - fs/lock: add 2 callbacks to lock_manager_operations to resolve conflict
    - NFSD: add support for lock conflict to courteous server
    - NFSD: Show state of courtesy client in client info
    - NFSD: Clean up nfsd3_proc_create()
    - NFSD: Avoid calling fh_drop_write() twice in do_nfsd_create()
    - NFSD: Refactor nfsd_create_setattr()
    - NFSD: Refactor NFSv3 CREATE
    - NFSD: Refactor NFSv4 OPEN(CREATE)
    - NFSD: Remove do_nfsd_create()
    - NFSD: Clean up nfsd_open_verified()
    - NFSD: Instantiate a struct file when creating a regular NFSv4 file
    - NFSD: Remove dprintk call sites from tail of nfsd4_open()
    - NFSD: Fix whitespace
    - NFSD: Move documenting comment for nfsd4_process_open2()
    - NFSD: Trace filecache opens
    - NFSD: Clean up the show_nf_flags() macro
    - SUNRPC: Use RMW bitops in single-threaded hot paths
    - nfsd: Unregister the cld notifier when laundry_wq create failed
    - nfsd: Fix null-ptr-deref in nfsd_fill_super()
    - nfsd: destroy percpu stats counters after reply cache shutdown
    - NFSD: Modernize nfsd4_release_lockowner()
    - NFSD: Add documenting comment for nfsd4_release_lockowner()
    - NFSD: nfsd_file_put() can sleep
    - NFSD: Fix potential use-after-free in nfsd_file_put()
    - SUNRPC: Optimize xdr_reserve_space()
    - fanotify: refine the validation checks on non-dir inode mask
    - NFS: restore module put when manager exits.
    - NFSD: Decode NFSv4 birth time attribute
    - lockd: set fl_owner when unlocking files
    - lockd: fix nlm_close_files
    - fs: inotify: Fix typo in inotify comment
    - fanotify: prepare for setting event flags in ignore mask
    - fanotify: cleanups for fanotify_mark() input validations
    - fanotify: introduce FAN_MARK_IGNORE
    - fsnotify: Fix comment typo
    - nfsd: eliminate the NFSD_FILE_BREAK_* flags
    - SUNRPC: Fix xdr_encode_bool()
    - NLM: Defend against file_lock changes after vfs_test_lock()
    - NFSD: Fix space and spelling mistake
    - nfsd: remove redundant assignment to variable len
    - NFSD: Demote a WARN to a pr_warn()
    - NFSD: Report filecache LRU size
    - NFSD: Report count of calls to nfsd_file_acquire()
    - NFSD: Report count of freed filecache items
    - NFSD: Report average age of filecache items
    - NFSD: Add nfsd_file_lru_dispose_list() helper
    - NFSD: Refactor nfsd_file_gc()
    - NFSD: Refactor nfsd_file_lru_scan()
    - NFSD: Report the number of items evicted by the LRU walk
    - NFSD: Record number of flush calls
    - NFSD: Zero counters when the filecache is re-initialized
    - NFSD: Hook up the filecache stat file
    - NFSD: WARN when freeing an item still linked via nf_lru
    - NFSD: Trace filecache LRU activity
    - NFSD: Leave open files out of the filecache LRU
    - NFSD: Fix the filecache LRU shrinker
    - NFSD: Never call nfsd_file_gc() in foreground paths
    - NFSD: No longer record nf_hashval in the trace log
    - NFSD: Remove lockdep assertion from unhash_and_release_locked()
    - NFSD: nfsd_file_unhash can compute hashval from nf->nf_inode
    - NFSD: Refactor __nfsd_file_close_inode()
    - NFSD: nfsd_file_hash_remove can compute hashval
    - NFSD: Remove nfsd_file::nf_hashval
    - NFSD: Replace the "init once" mechanism
    - NFSD: Set up an rhashtable for the filecache
    - NFSD: Convert the filecache to use rhashtable
    - NFSD: Clean up unused code after rhashtable conversion
    - NFSD: Separate tracepoints for acquire and create
    - NFSD: Move nfsd_file_trace_alloc() tracepoint
    - NFSD: NFSv4 CLOSE should release an nfsd_file immediately
    - NFSD: Ensure nf_inode is never dereferenced
    - NFSD: refactoring v4 specific code to a helper in nfs4state.c
    - NFSD: keep track of the number of v4 clients in the system
    - NFSD: limit the number of v4 clients to 1024 per 1GB of system memory
    - nfsd: silence extraneous printk on nfsd.ko insertion
    - NFSD: Optimize nfsd4_encode_operation()
    - NFSD: Optimize nfsd4_encode_fattr()
    - NFSD: Clean up SPLICE_OK in nfsd4_encode_read()
    - NFSD: Add an nfsd4_read::rd_eof field
    - NFSD: Optimize nfsd4_encode_readv()
    - NFSD: Simplify starting_len
    - NFSD: Use xdr_pad_size()
    - NFSD: Clean up nfsd4_encode_readlink()
    - NFSD: Fix strncpy() fortify warning
    - NFSD: nfserrno(-ENOMEM) is nfserr_jukebox
    - NFSD: Shrink size of struct nfsd4_copy_notify
    - NFSD: Shrink size of struct nfsd4_copy
    - NFSD: Reorder the fields in struct nfsd4_op
    - NFSD: Make nfs4_put_copy() static
    - NFSD: Replace boolean fields in struct nfsd4_copy
    - NFSD: Refactor nfsd4_cleanup_inter_ssc() (1/2)
    - NFSD: Refactor nfsd4_cleanup_inter_ssc() (2/2)
    - NFSD: Refactor nfsd4_do_copy()
    - NFSD: Remove kmalloc from nfsd4_do_async_copy()
    - NFSD: Add nfsd4_send_cb_offload()
    - NFSD: Move copy offload callback arguments into a separate structure
    - NFSD: drop fh argument from alloc_init_deleg
    - NFSD: verify the opened dentry after setting a delegation
    - NFSD: introduce struct nfsd_attrs
    - NFSD: set attributes when creating symlinks
    - NFSD: add security label to struct nfsd_attrs
    - NFSD: add posix ACLs to struct nfsd_attrs
    - NFSD: change nfsd_create()/nfsd_symlink() to unlock directory before
      returning.
    - NFSD: always drop directory lock in nfsd_unlink()
    - NFSD: only call fh_unlock() once in nfsd_link()
    - NFSD: reduce locking in nfsd_lookup()
    - NFSD: use explicit lock/unlock for directory ops
    - NFSD: use (un)lock_inode instead of fh_(un)lock for file operations
    - NFSD: discard fh_locked flag and fh_lock/fh_unlock
    - lockd: detect and reject lock arguments that overflow
    - NFSD: fix regression with setting ACLs.
    - nfsd_splice_actor(): handle compound pages
    - NFSD: move from strlcpy with unused retval to strscpy
    - lockd: move from strlcpy with unused retval to strscpy
    - NFSD enforce filehandle check for source file in COPY
    - NFSD: remove redundant variable status
    - nfsd: Avoid some useless tests
    - nfsd: Propagate some error code returned by memdup_user()
    - NFSD: Increase NFSD_MAX_OPS_PER_COMPOUND
    - NFSD: Protect against send buffer overflow in NFSv2 READDIR
      (CVE-2022-43945)
    - NFSD: Protect against send buffer overflow in NFSv3 READDIR
      (CVE-2022-43945)
    - NFSD: Protect against send buffer overflow in NFSv2 READ (CVE-2022-43945)
    - NFSD: Protect against send buffer overflow in NFSv3 READ (CVE-2022-43945)
    - NFSD: drop fname and flen args from nfsd_create_locked()
    - NFSD: Fix handling of oversized NFSv4 COMPOUND requests
    - nfsd: clean up mounted_on_fileid handling
    - nfsd: remove nfsd4_prepare_cb_recall() declaration
    - NFSD: Add tracepoints to report NFSv4 callback completions
    - NFSD: Add a mechanism to wait for a DELEGRETURN
    - NFSD: Refactor nfsd_setattr()
    - NFSD: Make nfsd4_setattr() wait before returning NFS4ERR_DELAY
    - NFSD: Make nfsd4_rename() wait before returning NFS4ERR_DELAY
    - NFSD: Make nfsd4_remove() wait before returning NFS4ERR_DELAY
    - NFSD: keep track of the number of courtesy clients in the system
    - NFSD: add shrinker to reap courtesy clients on low memory condition
    - SUNRPC: Parametrize how much of argsize should be zeroed
    - NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing
    - NFSD: Refactor common code out of dirlist helpers
    - NFSD: Use xdr_inline_decode() to decode NFSv3 symlinks
    - NFSD: Clean up WRITE arg decoders
    - NFSD: Clean up nfs4svc_encode_compoundres()
    - NFSD: Remove "inline" directives on op_rsize_bop helpers
    - NFSD: Remove unused nfsd4_compoundargs::cachetype field
    - NFSD: Pack struct nfsd4_compoundres
    - nfsd: use DEFINE_PROC_SHOW_ATTRIBUTE to define nfsd_proc_ops
    - nfsd: use DEFINE_SHOW_ATTRIBUTE to define export_features_fops and
      supported_enctypes_fops
    - nfsd: use DEFINE_SHOW_ATTRIBUTE to define client_info_fops
    - nfsd: use DEFINE_SHOW_ATTRIBUTE to define nfsd_reply_cache_stats_fops
    - nfsd: use DEFINE_SHOW_ATTRIBUTE to define nfsd_file_cache_stats_fops
    - NFSD: Rename the fields in copy_stateid_t
    - NFSD: Cap rsize_bop result based on send buffer size
    - nfsd: only fill out return pointer on success in nfsd4_lookup_stateid
    - nfsd: fix comments about spinlock handling with delegations
    - nfsd: make nfsd4_run_cb a bool return function
    - nfsd: extra checks when freeing delegation stateids
    - fs/notify: constify path
    - fsnotify: remove unused declaration
    - fanotify: Remove obsoleted fanotify_event_has_path()
    - nfsd: fix nfsd_file_unhash_and_dispose
    - nfsd: rework hashtable handling in nfsd_do_file_acquire
    - NFSD: unregister shrinker when nfsd_init_net() fails
    - nfsd: fix net-namespace logic in __nfsd_file_cache_purge
    - nfsd: fix use-after-free in nfsd_file_do_acquire tracepoint
    - nfsd: put the export reference in nfsd4_verify_deleg_dentry
    - NFSD: Fix reads with a non-zero offset that don't end on a page boundary
    - filelock: add a new locks_inode_context accessor function
    - lockd: use locks_inode_context helper
    - nfsd: use locks_inode_context helper
    - NFSD: Simplify READ_PLUS
    - NFSD: Remove redundant assignment to variable host_err
    - NFSD: Finish converting the NFSv2 GETACL result encoder
    - NFSD: Finish converting the NFSv3 GETACL result encoder
    - nfsd: ignore requests to disable unsupported versions
    - nfsd: move nfserrno() to vfs.c
    - nfsd: allow disabling NFSv2 at compile time
    - exportfs: use pr_debug for unreachable debug statements
    - NFSD: Pass the target nfsd_file to nfsd_commit()
    - NFSD: Revert "NFSD: NFSv4 CLOSE should release an nfsd_file immediately"
    - NFSD: Add an NFSD_FILE_GC flag to enable nfsd_file garbage collection
    - NFSD: Flesh out a documenting comment for filecache.c
    - NFSD: Clean up nfs4_preprocess_stateid_op() call sites
    - NFSD: Trace stateids returned via DELEGRETURN
    - NFSD: Trace delegation revocations
    - NFSD: Use const pointers as parameters to fh_ helpers
    - NFSD: Update file_hashtbl() helpers
    - NFSD: Clean up nfsd4_init_file()
    - NFSD: Add a nfsd4_file_hash_remove() helper
    - NFSD: Clean up find_or_add_file()
    - NFSD: Refactor find_file()
    - NFSD: Use rhashtable for managing nfs4_file objects
    - NFSD: Fix licensing header in filecache.c
    - nfsd: remove the pages_flushed statistic from filecache
    - nfsd: reorganize filecache.c
    - nfsd: fix up the filecache laundrette scheduling
    - NFSD: Add an nfsd_file_fsync tracepoint
    - lockd: set other missing fields when unlocking files
    - nfsd: return error if nfs4_setacl fails
    - NFSD: Use struct_size() helper in alloc_session()
    - lockd: set missing fl_flags field when retrieving args
    - lockd: ensure we use the correct file descriptor when unlocking
    - lockd: fix file selection in nlmsvc_cancel_blocked
    - NFSD: pass range end to vfs_fsync_range() instead of count
    - NFSD: refactoring courtesy_client_reaper to a generic low memory shrinker
    - NFSD: add support for sending CB_RECALL_ANY
    - NFSD: add delegation reaper to react to low memory condition
    - NFSD: Use only RQ_DROPME to signal the need to drop a reply
    - NFSD: Avoid clashing function prototypes
    - nfsd: rework refcounting in filecache
    - nfsd: fix handling of cached open files in nfsd4_open codepath
    - Revert "SUNRPC: Use RMW bitops in single-threaded hot paths"
    - NFSD: Use set_bit(RQ_DROPME)
    - NFSD: fix use-after-free in nfsd4_ssc_setup_dul()
    - NFSD: register/unregister of nfsd-client shrinker at nfsd startup/shutdown
      time
    - NFSD: replace delayed_work with work_struct for nfsd_client_shrinker
    - nfsd: don't free files unconditionally in __nfsd_file_cache_purge
    - nfsd: don't destroy global nfs4_file table in per-net shutdown
    - NFSD: enhance inter-server copy cleanup
    - nfsd: allow nfsd_file_get to sanely handle a NULL pointer
    - nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
    - NFSD: fix leaked reference count of nfsd4_ssc_umount_item
    - nfsd: don't hand out delegation on setuid files being opened for write
    - NFSD: fix problems with cleanup on errors in nfsd4_copy
    - nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open
    - nfsd: don't fsync nfsd_files on last close
    - NFSD: copy the whole verifier in nfsd_copy_write_verifier
    - NFSD: Protect against filesystem freezing
    - lockd: set file_lock start and end when decoding nlm4 testargs
    - nfsd: don't replace page in rq_pages if it's a continuation of last page
    - NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL
    - nfsd: call op_release, even when op_func returns an error
    - nfsd: don't open-code clear_and_wake_up_bit
    - nfsd: NFSD_FILE_KEY_INODE only needs to find GC'ed entries
    - nfsd: simplify test_bit return in NFSD_FILE_KEY_FULL comparator
    - nfsd: don't kill nfsd_files because of lease break error
    - nfsd: add some comments to nfsd_file_do_acquire
    - nfsd: don't take/put an extra reference when putting a file
    - nfsd: update comment over __nfsd_file_cache_purge
    - nfsd: allow reaping files still under writeback
    - NFSD: Convert filecache to rhltable
    - nfsd: simplify the delayed disposal list code
    - NFSD: Fix problem of COMMIT and NFS4ERR_DELAY in infinite loop
    - nfsd: make a copy of struct iattr before calling notify_change
    - nfsd: fix double fget() bug in __write_ports_addfd()
    - lockd: drop inappropriate svc_get() from locked_get()
    - NFSD: Add an nfsd4_encode_nfstime4() helper
    - nfsd: Fix creation time serialization order
    - nfsd: don't allow nfsd threads to be signalled.
    - nfsd: Simplify code around svc_exit_thread() call in nfsd()
    - nfsd: separate nfsd_last_thread() from nfsd_put()
    - Documentation: Add missing documentation for EXPORT_OP flags
    - NFSD: fix possible oops when nfsd/pool_stats is closed.
    - nfsd: call nfsd_last_thread() before final nfsd_put()
    - nfsd: drop the nfsd_put helper
    - nfsd: fix RELEASE_LOCKOWNER (CVE-2024-26629)
    - nfsd: don't take fi_lock in nfsd_break_deleg_cb()
    - nfsd: don't call locks_release_private() twice concurrently
    - nfsd: Fix a regression in nfsd_setattr()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.221
    - null_blk: Print correct max open zones limit in null_init_zoned_dev()
    - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
    - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
    - wifi: cfg80211: pmsr: use correct nla_get_uX functions
    - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
    - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
    - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
    - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
    - wifi: mac80211: correctly parse Spatial Reuse Parameter Set element
    - [armhf] net/ncsi: add NCSI Intel OEM command to keep PHY up
    - [armhf] net/ncsi: Simplify Kconfig/dts control flow
    - [armhf] net/ncsi: Fix the multi thread manner of NCSI driver
    - ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
    - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
      (CVE-2024-36978)
    - vxlan: Fix regression when dropping packets due to invalid src addresses
    - tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB
    - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
      (CVE-2024-36974)
    - ptp: Fix error message on failed pin verification
    - af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
    - af_unix: Annotate data-races around sk->sk_state in unix_write_space() and
      poll().
    - af_unix: Annotate data-races around sk->sk_state in sendmsg() and
      recvmsg().
    - af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG.
    - af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen.
    - af_unix: Use unix_recvq_full_lockless() in unix_stream_connect().
    - af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen().
    - af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
    - ipv6: fix possible race in __fib6_drop_pcpu_from()
    - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
    - drm/amd/display: Handle Y carry-over in VCP X.Y calculation
    - serial: sc16is7xx: replace hardcoded divisor value with BIT() macro
    - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
    - btrfs: fix leak of qgroup extent records after transaction abort
    - nilfs2: Remove check for PageError
    - nilfs2: return the mapped address from nilfs_get_page()
    - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
    - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
    - mei: me: release irq in mei_me_pci_resume error path
    - jfs: xattr: fix buffer overflow for invalid xattr
    - xhci: Set correct transferred length for cancelled bulk transfers
    - xhci: Apply reset resume quirk to Etron EJ188 xHCI host
    - xhci: Apply broken streams quirk to Etron EJ188 xHCI host
    - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
    - [powerpc*] uaccess: Fix build errors seen with GCC 13/14
    - Input: try trimming too long modalias strings
    - SUNRPC: return proper error from gss_wrap_req_priv
    - gpio: tqmx86: fix typo in Kconfig label
    - HID: core: remove unnecessary WARN_ON() in implement()
    - gpio: tqmx86: store IRQ trigger type and unmask status separately
    - [amd64] iommu/amd: Introduce pci segment structure
    - [amd64] iommu/amd: Fix sysfs leak in iommu init
    - iommu: Return right value in iommu_sva_bind_device()
    - HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
    - drm/vmwgfx: 3D disabled should not effect STDU memory limits
    - net: sfp: Always call `sfp_sm_mod_remove()` on remove
    - [arm64] net: hns3: add cond_resched() to hns3 ring buffer init process
    - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
    - drm/komeda: check for error-valued pointer
    - drm/bridge/panel: Fix runtime warning on panel bridge release
    - tcp: fix race in tcp_v6_syn_recv_sock()
    - net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN)
      packets
    - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
    - netfilter: ipset: Fix race between namespace cleanup and gc in the
      list:set type
    - net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs
      parameters
    - net/ipv6: Fix the RT cache flush via sysctl using a previous delay
    - ionic: fix use after netif_napi_del()
    - iio: adc: ad9467: fix scan type sign
    - iio: dac: ad5592r: fix temperature channel scaling value
    - iio: imu: inv_icm42600: delete unneeded update watermark call
    - drivers: core: synchronize really_probe() and dev_uevent()
    - [armhf] drm/exynos/vidi: fix memory leak in .get_modes()
    - [armhf] drm/exynos: hdmi: report safe 640x480 mode as a fallback when no
      EDID found
    - [x86] vmci: prevent speculation leaks by sanitizing event in
      event_deliver()
    - fs/proc: fix softlockup in __read_vmcore
    - ocfs2: use coarse time for new created files
    - ocfs2: fix races between hole punching and AIO+DIO
    - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
    - dmaengine: axi-dmac: fix possible race in remove()
    - remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs
    - [x86] intel_th: pci: Add Granite Rapids support
    - [x86] intel_th: pci: Add Granite Rapids SOC support
    - [x86] intel_th: pci: Add Sapphire Rapids SOC support
    - [x86] intel_th: pci: Add Meteor Lake-S support
    - [x86] intel_th: pci: Add Lunar Lake support
    - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
      (CVE-2024-37078)
    - tick/nohz_full: Don't abuse smp_call_function_single() in
      tick_setup_device()
    - serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level
    - hugetlb_encode.h: fix undefined behaviour (34 << 26)
    - mptcp: ensure snd_una is properly initialized on connect
    - mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID
    - mptcp: pm: update add_addr counters after connect
    - remoteproc: k3-r5: Jump to error handling labels in start/stop errors
    - greybus: Fix use-after-free bug in gb_interface_release due to race
      condition.
    - usb-storage: alauda: Check whether the media is initialized
      (CVE-2024-38619)
    - i2c: at91: Fix the functionality flags of the slave-only interface
    - i2c: designware: Fix the functionality flags of the slave-only interface
    - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
    - padata: Disable BH when taking works lock on MT path
    - rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
    - rcutorture: Fix invalid context warning when enable srcu barrier testing
    - block/ioctl: prefer different overflow check
    - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
    - wifi: ath9k: work around memset overflow warning
    - af_packet: avoid a false positive warning in packet_setsockopt()
    - drop_monitor: replace spin_lock by raw_spin_lock
    - scsi: qedi: Fix crash while reading debugfs attribute
    - netpoll: Fix race condition in netpoll_owner_active
    - HID: Add quirk for Logitech Casa touchpad
    - ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
    - Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
    - drm/amd/display: Exit idle optimizations before HDCP execution
    - [x86] ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
    - [arm64,armhf] drm/lima: add mask irq callback to gp and pp
    - [arm64,armhf] drm/lima: mask irqs in timeout path before hard reset
    - [powerpc*] pseries: Enforce hcall result buffer validity and size
    - [powerpc*] io: Avoid clang null pointer arithmetic warnings
    - power: supply: cros_usbpd: provide ID table for avoiding fallback match
    - f2fs: remove clear SB_INLINECRYPT flag in default_options
    - usb: misc: uss720: check for incompatible versions of the Belkin F5U002
    - udf: udftime: prevent overflow in udf_disk_stamp_to_time()
    - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
    - [mips*] Octeon: Add PCIe link status check
    - serial: exar: adding missing CTI and Exar PCI ids
    - [mips*] Routerboard 532: Fix vendor retry check code
    - [mips*] bmips: BCM6358: make sure CBR is correctly set
    - tracing: Build event generation tests only as modules
    - cipso: fix total option length computation
    - netrom: Fix a memory leak in nr_heartbeat_expiry()
    - ipv6: prevent possible NULL deref in fib6_nh_init()
    - ipv6: prevent possible NULL dereference in rt6_probe()
    - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
    - netns: Make get_net_ns() handle zero refcount net
    - qca_spi: Make interrupt remembering atomic
    - net/sched: act_api: rely on rcu in tcf_idr_check_alloc
    - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
    - tipc: force a dst refcount before doing decryption
    - net/sched: act_ct: set 'net' pointer when creating new nf_flow_table
    - sched: act_ct: add netns into the key of tcf_ct_flow_table
    - net: stmmac: No need to calculate speed divider when offload is disabled
    - virtio_net: checksum offloading handling fix
    - netfilter: ipset: Fix suspicious rcu_dereference_protected()
    - net: usb: rtl8150 fix unintiatilzed variables in
      rtl8150_get_link_ksettings
    - regulator: core: Fix modpost error "regulator_get_regmap" undefined
    - dmaengine: ioat: switch from 'pci_' to 'dma_' API
    - dmaengine: ioat: Drop redundant pci_enable_pcie_error_reporting()
    - dmaengine: ioatdma: Fix leaking on version mismatch
    - dmaengine: ioat: use PCI core macros for PCIe Capability
    - dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
    - dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
    - dmaengine: ioatdma: Fix missing kmem_cache_destroy()
    - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is
      fine."
    - RDMA/mlx5: Add check for srq max_sge attribute
    - ALSA: hda/realtek: Limit mic boost on N14AP7
    - drm/radeon: fix UBSAN warning in kv_dpm.c
    - gcov: add support for GCC 14
    - kcov: don't lose track of remote references during softirqs
    - i2c: ocores: set IACK bit after core is enabled
    - dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to
      i2c-controller schema
    - drm/amd/display: revert Exit idle optimizations before HDCP execution
    - [armhf] dts: samsung: smdkv310: fix keypad no-autorepeat
    - [armhf] dts: samsung: exynos4412-origen: fix keypad no-autorepeat
    - [armhf] dts: samsung: smdk4412: fix keypad no-autorepeat
    - rtlwifi: rtl8192de: Style clean-ups
    - wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power
    - pmdomain: ti-sci: Fix duplicate PD referrals
    - knfsd: LOOKUP can return an illegal error value
    - spmi: hisi-spmi-controller: Do not override device identifier
    - bcache: fix variable length array abuse in btree_iter (CVE-2024-39482)
    - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
    - [x86] cpu/vfm: Add new macros to work with (vendor/family/model) values
    - [x86] cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
    - r8169: remove unneeded memory barrier in rtl_tx
    - r8169: improve rtl_tx
    - r8169: improve rtl8169_start_xmit
    - r8169: remove nr_frags argument from rtl_tx_slots_avail
    - r8169: remove not needed check in rtl8169_start_xmit
    - r8169: Fix possible ring buffer corruption on fragmented Tx packets.
      (CVE-2024-38586)
    - Revert "kheaders: substituting --sort in archive creation"
    - kheaders: explicitly define file modes for archived headers
    - perf/core: Fix missing wakeup when waiting for context reference
    - PCI: Add PCI_ERROR_RESPONSE and related definitions
    - [x86] amd_nb: Check for invalid SMN reads
    - cifs: missed ref-counting smb session in find
    - smb: client: fix deadlock in smb2_find_smb_tcon() (CVE-2024-39468)
    - ACPI: Add quirks for AMD Renoir/Lucienne CPUs to force the D3 hint
    - [x86] ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for
      StorageD3Enable
    - [x86] ACPI: x86: Add another system to quirk list for forcing
      StorageD3Enable
    - [x86] ACPI: x86: utils: Add Cezanne to the list for forcing
      StorageD3Enable
    - [x86] ACPI: x86: utils: Add Picasso to the list for forcing
      StorageD3Enable
    - [x86] ACPI: x86: Force StorageD3Enable on more products
    - Input: ili210x - fix ili251x_read_touch_data() return value
    - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
    - [arm64,armhf] pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
    - [arm64,armhf] pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
    - [arm64,armhf] pinctrl/rockchip: separate struct rockchip_pin_bank to a
      head file
    - [arm64,armhf] pinctrl: rockchip: use dedicated pinctrl type for RK3328
    - [arm64,armhf] pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
    - drm/amdgpu: fix UBSAN warning in kv_dpm.c
    - netfilter: nf_tables: validate family when identifying table via handle
    - SUNRPC: Fix null pointer dereference in svc_rqst_free()
    - SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency()
    - SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation
    - SUNRPC: Fix svcxdr_init_encode's buflen calculation
    - nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
    - net: dsa: microchip: fix initial port flush problem
    - net: phy: micrel: add Microchip KSZ 9477 to the device table
    - xdp: Move the rxq_info.mem clearing to unreg_mem_model()
    - xdp: Allow registering memory model without rxq reference
    - xdp: Remove WARN() from __xdp_reg_mem_model()
    - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data
      registers
    - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
    - mtd: partitions: redboot: Added conversion of operands to a larger type
    - bpf: Add a check for struct bpf_fib_lookup size
    - net/iucv: Avoid explicit cpumask var allocation on stack
    - net/dpaa2: Avoid explicit cpumask var allocation on stack
    - ALSA: emux: improve patch ioctl data validation
    - media: dvbdev: Initialize sbuf
    - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
    - drm/radeon/radeon_display: Decrease the size of allocated memory
    - nvme: fixup comment for nvme RDMA Provider Type
    - drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
    - gpio: davinci: Validate the obtained number of IRQs
    - gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
    - [x86] stop playing stack games in profile_pc()
    - ocfs2: fix DIO failure due to insufficient transaction credits
    - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
    - mmc: sdhci: Do not invert write-protect twice
    - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
    - counter: ti-eqep: enable clock at probe
    - iio: adc: ad7266: Fix variable checking bug
    - net: usb: ax88179_178a: improve link status logs
    - usb: gadget: printer: SS+ support
    - usb: gadget: printer: fix races against disable (CVE-2024-25741)
    - usb: musb: da8xx: fix a resource leak in probe()
    - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
    - serial: 8250_omap: Implementation of Errata i2310
    - tty: mcf: MCF54418 has 10 UARTS
    - net: can: j1939: Initialize unused data in j1939_send_one()
    - net: can: j1939: recover socket queue on CAN bus error during BAM
      transmission
    - net: can: j1939: enhanced error handling for tightly received RTS messages
      in xtp_rx_rts_session_new
    - kbuild: Install dtb files as 0644 in Makefile.dtbinst
    - csky, hexagon: fix broken sys_sync_file_range
    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
    - [x86] drm/i915/gt: Fix potential UAF by revoke of fence registers
    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
    - batman-adv: Don't accept TT entries for out-of-spec VIDs
    - ata: ahci: Clean up sysfs file on error
    - ata: libata-core: Fix double free on error
    - ftruncate: pass a signed offset
    - syscalls: fix compat_sys_io_pgetevents_time64 usage
    - mtd: spinand: macronix: Add support for serial NAND flash
    - pwm: stm32: Refuse too small period requests
    - nfs: Leave pages in the pagecache if readpage failed
    - ipv6: annotate some data-races around sk->sk_prot
    - ipv6: Fix data races around sk->sk_prot.
    - tcp: Fix data races around icsk->icsk_af_ops.
    - drivers: fix typo in firmware/efi/memmap.c
    - efi: Correct comment on efi_memmap_alloc
    - efi: memmap: Move manipulation routines into x86 arch tree
    - efi: xen: Set EFI_PARAVIRT for Xen dom0 boot on all architectures
    - [x86] efi/x86: Free EFI memory map only when installing a new one.
    - [arm64] KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t
      preemption
    - [arm64] dts: rockchip: Add sound-dai-cells for RK3368
    - xdp: xdp_mem_allocator can be NULL in trace_mem_connect().
    - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
    - tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()

  [ Salvatore Bonaccorso ]
  * Bump ABI to 31
  * Refresh "fanotify: Taint on use of FANOTIFY_ACCESS_PERMISSIONS"
  * [rt] Refresh "sunrpc: Make svc_xprt_do_enqueue() use"
  * Refresh "firmware: Remove redundant log messages from drivers"
  * [rt] Update to 5.10.221-rt113

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 14 Jul 2024 10:11:44 +0200

linux (5.10.218-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.217
    - [arm64,armhf] dmaengine: pl330: issue_pending waits until WFP state
    - dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
    - wifi: nl80211: don't free NULL coalescing rule
    - eeprom: at24: Use dev_err_probe for nvmem register failure
    - eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
    - eeprom: at24: fix memory corruption race condition (CVE-2024-35848)
    - [armhf] pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of
      GPIOR-T
    - [arm64] pinctrl/meson: fix typo in PDM's pin name
    - pinctrl: core: delete incorrect free in pinctrl_enable()
    - sunrpc: add a struct rpc_stats arg to rpc_create_args
    - nfs: expose /proc/net/sunrpc/nfs in net namespaces
    - nfs: make the rpc_stat per net namespace
    - nfs: Handle error of rpc_proc_register() in nfs_net_init().
    - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
    - [s390x] mm: Fix storage key clearing for guest huge pages
    - [s390x] mm: Fix clearing storage keys for huge pages
    - bna: ensure the copied buf is NUL terminated
    - nsh: Restore skb->{protocol,data,mac_header} for outer header in
      nsh_gso_segment().
    - net l2tp: drop flow hash on forward
    - [s390x] vdso: Add CFI for RA register to asm macro vdso_func
    - net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
    - net: qede: use return from qede_parse_flow_attr() for flower
    - net: qede: use return from qede_parse_flow_attr() for flow_spec
    - net: qede: use return from qede_parse_actions()
    - cxgb4: Properly lock TX queue for the selftest.
    - [arm64,armhf] net: dsa: mv88e6xxx: Fix number of databases for 88E6141 /
      88E6341
    - net: bridge: fix multicast-to-unicast with fraglist GSO
    - net: core: reject skb_copy(_expand) for fraglist GSO skbs
    - net: gro: add flush check in udp_gro_receive_segment
    - [arm64] clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
    - [arm64] KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
    - [arm64] KVM: arm64: vgic-v2: Check for non-NULL vCPU in
      vgic_v2_parse_attr()
    - scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
    - gfs2: Fix invalid metadata access in punch_hole
    - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
    - wifi: cfg80211: fix rdev_dump_mpp() arguments order
    - net: mark racy access on sk->sk_rcvbuf
    - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
    - btrfs: return accurate error code on open failure in open_fs_devices()
    - ALSA: line6: Zero-initialize message buffers
    - net: bcmgenet: Reset RBUF on first open
    - ata: sata_gemini: Check clk_enable() result
    - firewire: ohci: mask bus reset interrupts between ISR and bottom half
    - btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
    - btrfs: always clear PERTRANS metadata during commit
    - scsi: target: Fix SELinux error when systemd-modules loads the target
      module
    - blk-iocost: avoid out of bounds shift
    - [arm64,armhf] gpu: host1x: Do not setup DMA for virtual devices
    - [mips64el,mipsel]: scall: Save thread_info.syscall unconditionally on
      entry (Closes: #1068365)
    - fs/9p: only translate RWX permissions for plain 9P2000
    - fs/9p: translate O_TRUNC into OTRUNC
    - 9p: explicitly deny setlease attempts
    - gpio: wcove: Use -ENOTSUPP consistently
    - gpio: crystalcove: Use -ENOTSUPP consistently
    - clk: Don't hold prepare_lock when calling kref_put()
    - fs/9p: drop inodes immediately on non-.L too
    - drm/nouveau/dp: Don't probe eDP ports twice harder
    - net:usb:qmi_wwan: support Rolling modules
    - xfrm: Preserve vlan tags for transport mode software GRO
    - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
    - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
    - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
      (CVE-2024-27398)
    - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
      (CVE-2024-27399)
    - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
    - [x86] hwmon: (corsair-cpro) Use a separate buffer for sending commands
    - [x86] hwmon: (corsair-cpro) Use complete_all() instead of complete() in
      ccp_raw_event()
    - [x86] hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
    - phonet: fix rtm_phonet_notify() skb allocation
    - kcov: Remove kcov include from sched.h and move it to its users.
    - net: bridge: fix corrupted ethernet header on multicast-to-unicast
    - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
    - [arm64] net: hns3: use appropriate barrier function after setting a bit
      value
    - btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()
    - firewire: nosy: ensure user_length is taken into account when fetching
      packet contents (CVE-2024-27401)
    - [arm64] dts: qcom: Fix 'interrupt-map' parent address cells
    - usb: typec: ucsi: Check for notifications after init
    - usb: typec: ucsi: Fix connector check on init
    - usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed
      device
    - usb: ohci: Prevent missed ohci interrupts
    - usb: gadget: composite: fix OS descriptors w_value logic
    - usb: gadget: f_fs: Fix a race condition when processing setup packets.
    - usb: xhci-plat: Don't include xhci.h
    - usb: dwc3: core: Prevent phy suspend during init
    - ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
    - iio:imu: adis16475: Fix sync mode setting
    - iio: accel: mxc4005: Interrupt handling fixes
    - net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
    - dyndbg: fix old BUG_ON in >control parser
    - mei: me: add lunar lake point M DID
    - drm/vmwgfx: Fix invalid reads in fence signaled events
    - net: fix out-of-bounds access in ops_init
    - regulator: core: fix debugfs creation regression
    - keys: Fix overwrite of key expiration on instantiation
    - md: fix kmemleak of rdev->serial (CVE-2024-26900)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.218
    - pinctrl: core: handle radix_tree_insert() errors in
      pinctrl_register_one_pin()
    - [x86] xen: Drop USERGS_SYSRET64 paravirt call
    - [arm64] net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
    - [arm64] net: bcmgenet: synchronize UMAC_CMD access
    - ima: fix deadlock when traversing "ima_default_rules".
    - netlink: annotate lockless accesses to nlk->max_recvmsg_len
    - [x86] KVM: x86: Clear "has_error_code", not "error_code", for RM exception
      injection
    - firmware: arm_scmi: Harden accesses to the reset domains (CVE-2022-48655)
    - mptcp: ensure snd_nxt is properly initialized on connect
    - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
    - drm/amdgpu: Fix possible NULL dereference in
      amdgpu_ras_query_error_status_helper() (CVE-2023-52585)
    - usb: typec: ucsi: displayport: Fix potential deadlock
    - serial: kgdboc: Fix NMI-safety problems from keyboard reset code
    - docs: kernel_include.py: Cope with docutils 0.21

  [ Salvatore Bonaccorso ]
  * Bump ABI to 30

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 01 Jun 2024 11:24:36 +0200

linux (5.10.216-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.210
    - units: change from 'L' to 'UL'
    - units: add the HZ macros
    - spi: introduce SPI_MODE_X_MASK macro
    - iio: adc: ad7091r: Set alert bit in config register
    - iio: adc: ad7091r: Allow users to configure device events
    - iio: adc: ad7091r: Enable internal vref if external vref is not supplied
    - dmaengine: fix NULL pointer in channel unregistration function
    - iio:adc:ad7091r: Move exports into IIO_AD7091R namespace.
    - ext4: allow for the last group to be marked as trimmed
    - crypto: api - Disallow identical driver names
    - PM: hibernate: Enforce ordering during image compression/decompression
    - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
    - [s390x] crypto: s390/aes - Fix buffer overread in CTR mode
    - bus: mhi: host: Drop chan lock before queuing buffers
    - async: Split async_schedule_node_domain()
    - async: Introduce async_schedule_dev_nocall()
    - [arm64] dts: qcom: sdm845: fix USB wakeup interrupt types
    - [arm64] dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
    - lsm: new security_file_ioctl_compat() hook
    - scripts/get_abi: fix source path leak
    - mmc: core: Use mrq.sbc in close-ended ffu
    - mmc: mmc_spi: remove custom DMA mapped buffers
    - rtc: Adjust failure return code for cmos_set_alarm()
    - nouveau/vmm: don't set addr on the fail path to avoid warning
    - ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
    - rename(): fix the locking of subdirectories
    - block: Remove special-casing of compound pages
    - mm: vmalloc: introduce array allocation functions
    - KVM: use __vcalloc for very large allocations
    - net/smc: fix illegal rmb_desc access in SMC-D connection dump
    - tcp: make sure init the accept_queue's spinlocks once
    - bnxt_en: Wait for FLR to complete during probe
    - vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
    - llc: make llc_ui_sendmsg() more robust against bonding changes
    - llc: Drop support for ETH_P_TR_802_2.
    - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
      (CVE-2024-23849)
    - tracing: Ensure visibility when inserting an element into tracing_map
    - afs: Hide silly-rename files from userspace
    - tcp: Add memory barrier to tcp_push()
    - netlink: fix potential sleeping issue in mqueue_flush_file
    - ipv6: init the accept_queue's spinlocks in inet6_create
    - net/mlx5: DR, Use the right GVMI number for drop action
    - net/mlx5e: fix a double-free in arfs_create_groups
    - netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
    - netfilter: nf_tables: validate NFPROTO_* family
    - net: mvpp2: clear BM pool before initialization
    - fjes: fix memleaks in fjes_hw_setup
    - net: fec: fix the unhandled context fault from smmu
    - btrfs: ref-verify: free ref cache before clearing mount opt
    - btrfs: tree-checker: fix inline ref size in error messages
    - btrfs: don't warn if discard range is not aligned to sector
    - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
    - btrfs: don't abort filesystem when attempting to snapshot deleted
      subvolume
    - rbd: don't move requests to the running list on errors
    - exec: Fix error handling in begin_new_exec()
    - wifi: iwlwifi: fix a memory corruption
    - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress
      basechain
    - gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
    - drm: Don't unref the same fb many times by mistake due to deadlock
      handling
    - drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
    - drm/tidss: Fix atomic_flush check
    - drm/bridge: nxp-ptn3460: simplify some error checking
    - PM: sleep: Use dev_printk() when possible
    - PM: sleep: Avoid calling put_device() under dpm_list_mtx
    - PM: core: Remove unnecessary (void *) conversions
    - PM: sleep: Fix possible deadlocks in core system-wide PM code
    - fs/pipe: move check to pipe_has_watch_queue()
    - pipe: wakeup wr_wait after setting max_usage
    - [arm64] dts: qcom: sc7180: Use pdc interrupts for USB instead of GIC
      interrupts
    - [arm64] dts: qcom: sc7180: fix USB wakeup interrupt types
    - mm: use __pfn_to_section() instead of open coding it
    - mm/sparsemem: fix race in accessing memory_section->usage
    - btrfs: remove err variable from btrfs_delete_subvolume
    - btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume
      being deleted
    - drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
    - [armhf] drm/exynos: fix accidental on-stack copy of exynos_drm_plane
    - [armhf] drm/exynos: gsc: minor fix for loop iteration in
      gsc_runtime_resume
    - gpio: eic-sprd: Clear interrupt after set the interrupt type
    - spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
    - [mips*] Call lose_fpu(0) before initializing fcr31 in
      mips_set_personality_nan
    - tick/sched: Preserve number of idle sleeps across CPU hotplug events
    - [x86] entry/ia32: Ensure s32 is sign extended to s64
    - [powerpc*] mm: Fix null-pointer dereference in pgtable_cache_add
    - drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
    - [powerpc*] Fix build error due to is_valid_bugaddr()
    - [powerpc*] mm: Fix build failures due to arch_reserved_kernel_pages()
    - [x86] boot: Ignore NMIs during very early boot
    - [powerpc*] pmd_move_must_withdraw() is only needed for
      CONFIG_TRANSPARENT_HUGEPAGE
    - [powerpc*] lib: Validate size for vector operations
    - [x86] mce: Mark fatal MCE's page as poison to avoid panic in the kdump
      kernel
    - perf/core: Fix narrow startup race when creating the perf nr_addr_filters
      sysfs file
    - debugobjects: Stop accessing objects after releasing hash bucket lock
    - regulator: core: Only increment use_count when enable_count changes
    - audit: Send netlink ACK before setting connection in auditd_set
    - ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
    - PNP: ACPI: fix fortify warning
    - ACPI: extlog: fix NULL pointer dereference check
    - PM / devfreq: Synchronize devfreq_monitor_[start/stop]
    - ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous
      events
    - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
    - jfs: fix slab-out-of-bounds Read in dtSearch
    - jfs: fix array-index-out-of-bounds in dbAdjTree
    - jfs: fix uaf in jfs_evict_inode
    - pstore/ram: Fix crash when setting number of cpus to an odd number
    - crypto: stm32/crc32 - fix parsing list of devices
    - afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
    - afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
    - rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
    - jfs: fix array-index-out-of-bounds in diNewExt
    - [s390x] ptrace: handle setting of fpc register correctly
    - [s390x] KVM: s390: fix setting of fpc register
    - SUNRPC: Fix a suspicious RCU usage warning
    - ecryptfs: Reject casefold directory inodes
    - ext4: fix inconsistent between segment fstrim and full fstrim
    - ext4: unify the type of flexbg_size to unsigned int
    - ext4: remove unnecessary check from alloc_flex_gd()
    - ext4: avoid online resizing failures due to oversized flex bg
    - wifi: rt2x00: restart beacon queue when hardware reset
    - scsi: lpfc: Fix possible file string name overflow when updating firmware
    - PCI: Add no PM reset quirk for NVIDIA Spectrum devices
    - bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
    - scsi: arcmsr: Support new PCI device IDs 1883 and 1886
    - wifi: ath9k: Fix potential array-index-out-of-bounds read in
      ath9k_htc_txstatus()
    - bpf: Add map and need_defer parameters to .map_fd_put_ptr()
    - scsi: libfc: Don't schedule abort twice
    - scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
    - bpf: Set uattr->batch.count as zero before batched update or deletion
    - ionic: pass opcode to devcmd_wait
    - block/rnbd-srv: Check for unlikely string overflow
    - [arm64,armhf] net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error
      path
    - block: prevent an integer overflow in bvec_try_merge_hw_page
    - md: Whenassemble the array, consult the superblock of the freshest device
    - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
    - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
    - wifi: cfg80211: free beacon_ies when overridden from hidden BSS
    - Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
    - Bluetooth: L2CAP: Fix possible multiple reject send
    - i40e: Fix VF disable behavior to block all traffic
    - f2fs: fix to check return value of f2fs_reserve_new_block()
    - ALSA: hda: Refer to correct stream index at loops
    - ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
    - fast_dput(): handle underflows gracefully
    - RDMA/IPoIB: Fix error code return in ipoib_mcast_join
    - drm/amd/display: Fix tiled display misalignment
    - f2fs: fix write pointers on zoned device after roll forward
    - drm/drm_file: fix use of uninitialized variable
    - drm/framebuffer: Fix use of uninitialized variable
    - drm/mipi-dsi: Fix detach call without attach
    - media: stk1160: Fixed high volume of stk1160_dbg messages
    - [x86] PCI: add INTEL_HDA_ARL to pci_ids.h
    - [x86] ALSA: hda: Intel: add HDA_ARL PCI ID support
    - [x86] ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL
    - [armhf] drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind
      time
    - IB/ipoib: Fix mcast list locking
    - media: ddbridge: fix an error code problem in ddb_probe
    - [arm64] drm/msm/dpu: Ratelimit framedone timeout msgs
    - clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
    - clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
    - watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
    - drm/amdgpu: Let KFD sync with VM fences
    - drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
    - leds: trigger: panic: Don't register panic notifier if creating the
      trigger failed
    - i3c: master: cdns: Update maximum prescaler value for i2c clock
    - xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
    - mfd: ti_am335x_tscadc: Fix TI SoC dependencies
    - PCI: Only override AMD USB controller if required
    - PCI: switchtec: Fix stdev_release() crash after surprise hot remove
    - usb: hub: Replace hardcoded quirk value with BIT() macro
    - tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
    - fs/kernfs/dir: obey S_ISGID
    - PCI/AER: Decode Requester ID when no error info found
    - libsubcmd: Fix memory leak in uniq()
    - virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a
      region of size 10" warnings
    - blk-mq: fix IO hang from sbitmap wakeup race
    - ceph: fix deadlock or deadcode of misusing dget()
    - drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in
      'get_platform_power_management_table()'
    - drm/amdgpu: Release 'adev->pm.fw' before return in
      'amdgpu_device_need_post()'
    - perf: Fix the nr_addr_filters fix
    - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
    - drm: using mul_u32_u32() requires linux/math64.h
    - scsi: isci: Fix an error code problem in isci_io_request_build()
    - scsi: core: Introduce enum scsi_disposition
    - scsi: core: Move scsi_host_busy() out of host lock for waking up EH
      handler
    - ip6_tunnel: use dev_sw_netstats_rx_add()
    - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
    - net-zerocopy: Refactor frag-is-remappable test.
    - tcp: add sanity checks to rx zerocopy
    - ixgbe: Remove non-inclusive language
    - ixgbe: Refactor returning internal error codes
    - ixgbe: Refactor overtemp event handling
    - ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
    - ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
    - llc: call sock_orphan() at release time
    - netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
    - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom
      expectations
    - net: ipv4: fix a memleak in ip_setup_cork
    - af_unix: fix lockdep positive in sk_diag_dump_icons()
    - net: sysfs: Fix /sys/class/net/<iface> path
    - HID: apple: Add support for the 2021 Magic Keyboard
    - HID: apple: Add 2021 magic keyboard FN key mapping
    - bonding: remove print in bond_verify_device_path
    - uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
    - PM: sleep: Fix error handling in dpm_prepare()
    - dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools
    - dmaengine: ti: k3-udma: Report short packet errors
    - dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
    - dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
    - dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
    - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
      (CVE-2024-26600)
    - [arm64] drm/msm/dp: return correct Colorimetry for
      DP_TEST_DYNAMIC_RANGE_CEA case
    - net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
    - tunnels: fix out of bounds access when building IPv6 PMTU error
    - atm: idt77252: fix a memleak in open_card_ubr0
    - hwmon: (aspeed-pwm-tacho) mutex for tach reading
    - [x86] hwmon: (coretemp) Fix out-of-bounds memory access
    - [x86] hwmon: (coretemp) Fix bogus core_id to attr name mapping
    - inet: read sk->sk_family once in inet_recv_error()
    - rxrpc: Fix response to PING RESPONSE ACKs to a dead call
    - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
    - ppp_async: limit MRU to 64K
    - netfilter: nft_compat: reject unused compat flag
    - netfilter: nft_compat: restrict match/target protocol to u16
    - netfilter: nft_ct: reject direction for ct id
    - netfilter: nft_set_pipapo: store index in scratch maps
    - netfilter: nft_set_pipapo: add helper to release pcpu scratch area
    - netfilter: nft_set_pipapo: remove scratch_aligned pointer
    - scsi: core: Move scsi_host_busy() out of host lock if it is for
      per-command
    - blk-iocost: Fix an UBSAN shift-out-of-bounds warning
    - net/af_iucv: clean up a try_then_request_module()
    - USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
    - USB: serial: option: add Fibocom FM101-GL variant
    - USB: serial: cp210x: add ID for IMST iM871A-USB
    - usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK
    - hrtimer: Report offline hrtimer enqueue
    - Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
    - Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
    - vhost: use kzalloc() instead of kmalloc() followed by memset()
    - clocksource: Skip watchdog check for large watchdog intervals
    - net: stmmac: xgmac: use #define for string constants
    - net: stmmac: xgmac: fix a typo of register name in DPP safety handling
    - netfilter: nft_set_rbtree: skip end interval element from gc
      (CVE-2024-26581)
    - btrfs: forbid creating subvol qgroups
    - btrfs: do not ASSERT() if the newly created subvolume already got read
      (CVE-2024-23850)
    - btrfs: forbid deleting live subvol qgroup
    - btrfs: send: return EOPNOTSUPP on unknown flags
    - of: unittest: Fix compile in the non-dynamic case
    - net: openvswitch: limit the number of recursions from action sets
      (CVE-2024-1151)
    - spi: ppc4xx: Drop write-only variable
    - ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
    - net: sysfs: Fix /sys/class/net/<iface> path for statistics
    - [mips*] Add 'memory' clobber to csum_ipv6_magic() inline assembler
    - i40e: Fix waiting for queues of all VSIs to be disabled
    - tracing/trigger: Fix to return error if failed to alloc snapshot
    - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
    - ALSA: hda/realtek: Fix the external mic not being recognised for Acer
      Swift 1 SF114-32
    - ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx
    - HID: wacom: generic: Avoid reporting a serial of '0' to userspace
    - HID: wacom: Do not register input devices until after hid_hw_start
    - usb: ucsi_acpi: Fix command completion handling
    - USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
    - usb: f_mass_storage: forbid async queue when shutdown happen
    - media: ir_toy: fix a memleak in irtoy_tx
    - i2c: i801: Remove i801_set_block_buffer_mode
    - i2c: i801: Fix block process call transactions (CVE-2024-26593)
    - modpost: trim leading spaces when processing source files list
    - scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
    - lsm: fix the logic in security_inode_getsecctx()
    - firewire: core: correct documentation of fw_csr_string() kernel API
    - kbuild: Fix changing ELF file type for output of gen_btf for big endian
    - nfc: nci: free rx_data_reassembly skb on NCI device cleanup
    - net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
    - xen-netback: properly sync TX responses
    - ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
    - [arm*] binder: signal epoll threads of self-work (CVE-2024-26606)
    - misc: fastrpc: Mark all sessions as invalid in cb_remove
    - ext4: fix double-free of blocks due to wrong extents moved_len
    - tracing: Fix wasted memory in saved_cmdlines logic
    - staging: iio: ad5933: fix type mismatch regression
    - iio: magnetometer: rm3100: add boundary check for the value read from
      RM3100_REG_TMRC
    - iio: accel: bma400: Fix a compilation problem
    - media: rc: bpf attach/detach requires write permission
    - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
    - ring-buffer: Clean ring_buffer_poll_wait() error return
    - serial: max310x: set default value when reading clock ready bit
    - serial: max310x: improve crystal stable clock detection
    - [x86] mm/ident_map: Use gbpages only where full GB page should be mapped.
    - mmc: slot-gpio: Allow non-sleeping GPIO ro
    - ALSA: hda/conexant: Add quirk for SWS JS201D
    - nilfs2: fix data corruption in dsync block recovery for small block sizes
    - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
    - crypto: ccp - Fix null pointer dereference in
      __sev_platform_shutdown_locked
    - nfp: use correct macro for LengthSelect in BAR config
    - nfp: flower: prevent re-adding mac index for bonded port
    - wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
    - irqchip/irq-brcmstb-l2: Add write memory barrier before exit
    - irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update
    - [s390x] qeth: Fix potential loss of L3-IP@ in case of network issues
    - ceph: prevent use-after-free in encode_cap_msg()
    - of: property: fix typo in io-channels
    - can: j1939: Fix UAF in j1939_sk_match_filter during
      setsockopt(SO_J1939_FILTER)
    - pmdomain: core: Move the unused cleanup to a _sync initcall
    - tracing: Inform kmemleak of saved_cmdlines allocation
    - Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
    - bus: moxtet: Add spi device table
    - PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
    - mips: Fix max_mapnr being uninitialized on early stages
    - crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
    - serial: Add rs485_supported to uart_port
    - serial: 8250_exar: Fill in rs485_supported
    - serial: 8250_exar: Set missing rs485_supported flag
    - scripts/decode_stacktrace.sh: silence stderr messages from addr2line/nm
    - scripts/decode_stacktrace.sh: support old bash version
    - scripts: decode_stacktrace: demangle Rust symbols
    - scripts/decode_stacktrace.sh: optionally use LLVM utilities
    - netfilter: ipset: fix performance regression in swap operation
    - netfilter: ipset: Missing gc cancellations fixed
    - hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range()
    - Revert "arm64: Stash shadow stack pointer in the task struct on interrupt"
    - net: prevent mss overflow in skb_segment() (CVE-2023-52435)
    - sched/membarrier: reduce the ability to hammer on sys_membarrier
      (CVE-2024-26602)
    - nilfs2: fix potential bug in end_buffer_async_write
    - nilfs2: replace WARN_ONs for invalid DAT metadata block requests
    - dm: limit the number of targets and parameter size area (CVE-2024-23851,
      CVE-2023-52429)
    - PM: runtime: add devm_pm_runtime_enable helper
    - PM: runtime: Have devm_pm_runtime_enable() handle
      pm_runtime_dont_use_autosuspend()
    - [arm64] drm/msm/dsi: Enable runtime PM
    - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
      (CVE-2024-0607)
    - net: bcmgenet: Fix EEE implementation
    - PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.211
    - net/sched: Retire CBQ qdisc
    - net/sched: Retire ATM qdisc
    - net/sched: Retire dsmark qdisc
    - smb: client: fix OOB in receive_encrypted_standard() (CVE-2024-0565)
    - smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)
    - smb: client: fix parsing of SMB3.1.1 POSIX create context
    - sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
    - userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
    - zonefs: Improve error handling
    - sched/rt: Fix sysctl_sched_rr_timeslice intial value
    - sched/rt: Disallow writing invalid values to sched_rt_period_us
    - scsi: target: core: Add TMF to tmr_list handling
    - [arm64] dmaengine: fsl-qdma: increase size of 'irq_name'
    - wifi: cfg80211: fix missing interfaces when dumping
    - wifi: mac80211: fix race condition on enabling fast-xmit
    - fbdev: savage: Error out if pixclock equals zero
    - fbdev: sis: Error out if pixclock equals zero
    - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
    - ahci: asm1166: correct count of reported ports
    - ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
    - ext4: avoid allocating blocks from corrupted group in
      ext4_mb_try_best_found()
    - ext4: avoid allocating blocks from corrupted group in
      ext4_mb_find_by_goal()
    - [armhf] dmaengine: ti: edma: Add some null pointer checks to the
      edma_probe
    - [arm64] regulator: pwm-regulator: Add validity checks in continuous
      .get_voltage
    - nvmet-tcp: fix nvme tcp ida memory leak
    - [armhf] ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
    - netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in
      sctp_new
    - nvme-fc: do not wait in vain when unloading module
    - nvmet-fcloop: swap the list_add_tail arguments
    - nvmet-fc: release reference on target port
    - nvmet-fc: abort command when there is no binding
    - ext4: correct the hole length returned by ext4_map_blocks()
    - Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table
    - efi: runtime: Fix potential overflow of soft-reserved region size
    - efi: Don't add memblocks for soft-reserved memory
    - [x86] hwmon: (coretemp) Enlarge per package core count limit
    - scsi: lpfc: Use unsigned type for num_sge
    - firewire: core: send bus reset promptly on gap count error
    - virtio-blk: Ensure no requests in virtqueues before deleting vqs.
    - [mips*] irqchip/mips-gic: Don't touch vl_map if a local interrupt is not
      routable
    - media: av7110: prevent underflow in write_ts_to_decoder()
    - hvc/xen: prevent concurrent accesses to the shared ring
    - [x86] uaccess: Implement macros for CMPXCHG on user addresses
    - seccomp: Invalidate seccomp mode to catch death failures
    - block: ataflop: fix breakage introduced at blk-mq refactoring
    - [powerpc*] watchpoint: Workaround P10 DD1 issue with VSX-32 byte
      instructions
    - [powerpc*] watchpoints: Annotate atomic context in more places
    - cifs: add a warning when the in-flight count goes negative
    - mtd: spinand: macronix: Add support for MX35LFxGE4AD
    - [x86] ASoC: Intel: boards: harden codec property handling
    - [x86] ASoC: Intel: boards: get codec device with ACPI instead of bus
      search
    - [x86] ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after
      use
    - task_stack, x86/cea: Force-inline stack helpers
    - btrfs: tree-checker: check for overlapping extent items
    - btrfs: introduce btrfs_lookup_match_dir
    - btrfs: unify lookup return value when dir entry is missing
    - btrfs: do not pin logs too early during renames
    - lan743x: fix for potential NULL pointer dereference with bare card
    - [x86] platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13
      x360 PC
    - iwlwifi: mvm: do more useful queue sync accounting
    - iwlwifi: mvm: write queue_sync_state only for sync
    - jbd2: remove redundant buffer io error checks
    - jbd2: recheck chechpointing non-dirty buffer
    - jbd2: Fix wrongly judgement for buffer head removing while doing
      checkpoint
    - [x86] drop bogus "cc" clobber from __try_cmpxchg_user_asm()
    - erofs: fix lz4 inplace decompression (CVE-2023-52497)
    - [amd64] IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
    - [s390x] cio: fix invalid -EBUSY on ccw_device_start
    - dm-crypt: don't modify the data when using authenticated encryption
    - [arm64] KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
    - [arm64] KVM: arm64: vgic-its: Test for valid IRQ in
      its_sync_lpi_pending_table()
    - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
    - PCI/MSI: Prevent MSI hardware interrupt number truncation
    - l2tp: pass correct message length to ip6_append_data
    - [x86] Revert "x86/ftrace: Use alternative RET encoding"
    - [x86] text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR
    - [x86] ibt,paravirt: Use text_gen_insn() for paravirt_patch()
    - [x86] ftrace: Use alternative RET encoding
    - [x86] returnthunk: Allow different return thunks
    - [x86] Revert "x86/alternative: Make custom return thunk unconditional"
    - [x86] alternative: Make custom return thunk unconditional
    - usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
    - mptcp: fix lockless access in subflow ULP diag
    - [amd64] IB/hfi1: Fix a memleak in init_credit_return
    - RDMA/bnxt_re: Return error for SRQ resize
    - RDMA/srpt: Support specifying the srpt_service_guid parameter
    - RDMA/qedr: Fix qedr_create_user_qp error flow
    - [arm64] dts: rockchip: set num-cs property for spi on px30
    - RDMA/srpt: fix function pointer cast warnings
    - bpf, scripts: Correct GPL license name
    - scsi: jazz_esp: Only build if SCSI core is builtin
    - nouveau: fix function cast warnings
    - ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
    - ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
    - afs: Increase buffer size in afs_update_volume_status()
    - ipv6: sr: fix possible use-after-free and null-ptr-deref
    - packet: move from strlcpy with unused retval to strscpy
    - net: dev: Convert sa_data to flexible array in struct sockaddr
    - [s390x] use the correct count for __iowrite64_copy()
    - netfilter: nf_tables: set dormant flag on hook register failure
    - drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
    - drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is
      set
    - drm/amd/display: Fix memory leak in dm_sw_fini()
    - block: ataflop: more blk-mq refactoring fixes
    - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
    - arp: Prevent overflow in arp_req_get().
    - ext4: regenerate buddy after block freeing failed if under fc replay
      (CVE-2024-26601)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.212
    - [x86] platform/x86: touchscreen_dmi: Allow partial (prefix) matches for
      ACPI names
    - crypto: virtio/akcipher - Fix stack overflow on memcpy
    - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
    - net: ip_tunnel: prevent perpetual headroom growth
    - tun: Fix xdp_rxq_info's queue_index when detaching
    - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
    - lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is
      detected
    - net: usb: dm9601: fix wrong return value in dm9601_mdio_read
    - Bluetooth: Avoid potential use-after-free in hci_error_reset
    - Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR
    - Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
    - Bluetooth: Enforce validation on max value of connection interval
    - netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
    - rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
    - efi/capsule-loader: fix incorrect allocation size
    - ALSA: Drop leftover snd-rtctimer stuff from Makefile
    - afs: Fix endless loop in directory parsing
    - tomoyo: fix UAF write bug in tomoyo_write_control() (CVE-2024-26622)
    - gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
    - wifi: nl80211: reject iftype change with mesh ID change
    - btrfs: dev-replace: properly validate device names
    - [arm64] dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
    - [arm64] dmaengine: fsl-qdma: init irq after reg initialization
    - mmc: core: Fix eMMC initialization with 1-bit bus connection
    - [arm64] mmc: sdhci-xenon: add timeout for PHY init complete
    - [arm64] mmc: sdhci-xenon: fix PHY init clock stability
    - [arm64] pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation
    - [x86] cpu/intel: Detect TME keyid bits before setting MTRR mask registers
    - mptcp: fix possible deadlock in subflow diag
    - ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks()
    - cachefiles: fix memory leak in cachefiles_add_cache()
    - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
      (CVE-2024-0841)
    - gpiolib: Fix the error path order in gpiochip_add_data_with_key()
    - gpio: fix resource unwinding order in error path
    - mptcp: fix double-free on socket dismantle
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.213
    - [arm64,armhf] mmc: mmci: stm32: use a buffer for unaligned DMA requests
    - [arm64,armhf] mmc: mmci: stm32: fix DMA API overlapping mappings warning
    - lan78xx: Fix white space and style issues
    - lan78xx: Add missing return code checks
    - lan78xx: Fix partial packet errors on suspend/resume
    - lan78xx: Fix race conditions in suspend/resume handling
    - net: lan78xx: fix runtime PM count underflow on link stop
    - ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
    - i40e: disable NAPI right after disabling irqs when handling xsk_pool
    - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string
    - geneve: make sure to pull inner header in geneve_rx()
    - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
    - net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
    - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
    - net/rds: fix WARNING in rds_conn_connect_if_down
    - netfilter: nft_ct: fix l3num expectations with inet pseudo family
    - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
    - netrom: Fix a data-race around sysctl_netrom_default_path_quality
    - netrom: Fix a data-race around
      sysctl_netrom_obsolescence_count_initialiser
    - netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
    - netrom: Fix a data-race around sysctl_netrom_transport_timeout
    - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
    - netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
    - netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
    - netrom: Fix a data-race around
      sysctl_netrom_transport_requested_window_size
    - netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
    - netrom: Fix a data-race around sysctl_netrom_routing_control
    - netrom: Fix a data-race around sysctl_netrom_link_fails_count
    - netrom: Fix data-races around sysctl_net_busy_read
    - xhci: remove extra loop in interrupt context
    - xhci: prevent double-fetch of transfer and transfer event TRBs
    - xhci: process isoc TD properly when there was a transaction error mid TD.
    - xhci: handle isoc Babble and Buffer Overrun events properly
    - net: Change sock_getsockopt() to take the sk ptr instead of the sock ptr
    - bpf: net: Change sk_getsockopt() to take the sockptr_t argument
    - lsm: make security_socket_getpeersec_stream() sockptr_t safe
    - lsm: fix default return value of the socket_getpeersec_*() hooks
    - ext4: make ext4_es_insert_extent() return void
    - ext4: refactor ext4_da_map_blocks()
    - ext4: convert to exclusive lock while inserting delalloc extents
    - [x86] Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus
      hardening
    - [x86] hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus
      hardening
    - [x86] hv_netvsc: Wait for completion on request SWITCH_DATA_PATH
    - [x86] hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove
    - [x86] hv_netvsc: Make netvsc/VF binding check both MAC and serial number
    - [x86] hv_netvsc: use netif_is_bond_master() instead of open code
    - [x86] hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
    - mm/hugetlb: change hugetlb_reserve_pages() to type bool
    - mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE
    - getrusage: add the "signal_struct *sig" local variable
    - getrusage: move thread_group_cputime_adjusted() outside of
      lock_task_sighand()
    - getrusage: use __for_each_thread()
    - getrusage: use sig->stats_lock rather than lock_task_sighand()
    - [x86] Drivers: hv: vmbus: Drop error message when 'No request id
      available'
    - regmap: allow to define reg_update_bits for no bus configuration
    - regmap: Add bulk read/write callbacks into regmap_config
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.214
    - io_uring/unix: drop usage of io_uring socket
    - io_uring: drop any code related to SCM_RIGHTS
    - rcu-tasks: Provide rcu_trace_implies_rcu_gp()
    - bpf: Defer the free of inner map when necessary (CVE-2023-52447)
    - ASoC: rt5645: Make LattePanda board DMI match more precise
    - [x86] xen: Add some null pointer checking to smp.c
    - [mips*] Clear Cause.BD in instruction_pointer_set
    - HID: multitouch: Add required quirk for Synaptics 0xcddc device
    - gen_compile_commands: fix invalid escape sequence warning
    - RDMA/mlx5: Fix fortify source warning while accessing Eth segment
    - RDMA/mlx5: Relax DEVX access upon modify commands
    - [x86] mm: Move is_vsyscall_vaddr() into asm/vsyscall.h
    - [x86] mm: Disallow vsyscall page read for copy_from_kernel_nofault()
    - net/iucv: fix the allocation size of iucv_path_table array
    - block: sed-opal: handle empty atoms when parsing response
    - dm-verity, dm-crypt: align "struct bvec_iter" correctly
    - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
    - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
      (CVE-2024-22099)
    - firewire: core: use long bus reset on gap count error
    - [x86] ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8
      tablet
    - Input: gpio_keys_polled - suppress deferred probe error for gpio
    - [x86] paravirt: Fix build due to __text_gen_insn() backport
    - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
    - nbd: null check for nla_nest_start
    - fs/select: rework stack allocation hack for clang
    - block: add a new set_read_only method
    - md: implement ->set_read_only to hook into BLKROSET processing
    - md: Don't clear MD_CLOSING when the raid is about to stop
    - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
      (CVE-2023-6270)
    - timekeeping: Fix cross-timestamp interpolation on counter wrap
    - timekeeping: Fix cross-timestamp interpolation corner case decision
    - timekeeping: Fix cross-timestamp interpolation for non-x86
    - wifi: ath10k: fix NULL pointer dereference in
      ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (CVE-2023-7042)
    - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
    - wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
    - wifi: b43: Stop correct queue in DMA worker when QoS is disabled
    - wifi: b43: Disable QoS for bcm4331
    - wifi: wilc1000: fix declarations ordering
    - wifi: wilc1000: fix RCU usage in connect path
    - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
    - wifi: wilc1000: fix multi-vif management when deleting a vif
    - wifi: mwifiex: debugfs: Drop unnecessary error check for
      debugfs_create_dir()
    - cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
    - sock_diag: annotate data-races around sock_diag_handlers[family]
    - inet_diag: annotate data-races around inet_diag_table[]
    - bpftool: Silence build warning about calloc()
    - af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
    - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
    - wifi: iwlwifi: dbg-tlv: ensure NUL termination
    - wifi: iwlwifi: fix EWRD table validity check
    - net: blackhole_dev: fix build warning for ethh set but not used
    - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
    - bpf: Factor out bpf_spin_lock into helpers.
    - bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
    - wireless: Remove redundant 'flush_workqueue()' calls
    - wifi: wilc1000: prevent use-after-free on vif when cleaning up all
      interfaces
    - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
    - [amd64] iommu/amd: Mark interrupt as managed
    - wifi: brcmsmac: avoid function pointer casts
    - net: ena: Remove ena_select_queue
    - ACPI: scan: Fix device check notification handling
    - [x86] relocs: Ignore relocations in .notes section (CVE-2024-26816)
    - SUNRPC: fix some memleaks in gssx_dec_option_array
    - mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the
      .remove function
    - wifi: rtw88: 8821c: Fix false alarm count
    - PCI: Make pci_dev_is_disconnected() helper public for other drivers
    - [amd64] iommu/vt-d: Don't issue ATS Invalidation request when device is
      disconnected
    - igb: move PEROUT and EXTTS isr logic to separate functions
    - igb: Fix missing time sync events
    - Bluetooth: Remove superfluous call to hci_conn_check_pending()
    - Bluetooth: hci_core: Fix possible buffer overflow
    - sr9800: Add check for usbnet_get_endpoints (CVE-2024-26651)
    - bpf: Eliminate rlimit-based memory accounting for devmap maps
    - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
    - bpf: Fix hashtab overflow check on 32-bit arches
    - bpf: Fix stackmap overflow check on 32-bit arches
    - ipv6: fib6_rules: flush route cache when rule is changed
    - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
    - net: phy: fix phy_get_internal_delay accessing an empty array
    - net: hns3: fix port duplex configure error in IMP reset
    - net: phy: DP83822: enable rgmii mode if phy_interface_is_rgmii
    - net: phy: dp83822: Fix RGMII TX delay configuration
    - OPP: debugfs: Fix warning around icc_get_name()
    - tcp: fix incorrect parameter validation in the do_tcp_getsockopt()
      function
    - net/ipv4: Replace one-element array with flexible-array member
    - net/ipv4: Revert use of struct_size() helper
    - net/ipv4/ipv6: Replace one-element arraya with flexible-array members
    - bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument
    - ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt()
      function
    - l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt()
      function
    - udp: fix incorrect parameter validation in the udp_lib_getsockopt()
      function
    - net: kcm: fix incorrect parameter validation in the kcm_getsockopt)
      function
    - nfp: flower: handle acti_netdevs allocation failure
    - dm raid: fix false positive for requeue needed during reshape
    - dm: call the resume method on internal suspend
    - [arm64,armhf] drm/tegra: dsi: Add missing check for of_find_device_by_node
    - [arm64,armhf] drm/tegra: dsi: Make use of the helper function
      dev_err_probe()
    - [arm64,armhf] drm/tegra: dsi: Fix some error handling paths in
      tegra_dsi_probe()
    - [arm64,armhf] drm/tegra: dsi: Fix missing pm_runtime_disable() in the
      error handling path of tegra_dsi_probe()
    - [arm64,armhf] drm/tegra: output: Fix missing i2c_put_adapter() in the
      error handling paths of tegra_output_probe()
    - drm/rockchip: inno_hdmi: Fix video timing
    - drm: Don't treat 0 as -1 in drm_fixp2int_ceil
    - drm/rockchip: lvds: do not overwrite error code
    - drm/rockchip: lvds: do not print scary message when probing defer
    - drm/lima: fix a memleak in lima_heap_alloc
    - dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
    - media: tc358743: register v4l2 async device only after successful setup
    - PCI/DPC: Print all TLP Prefixes, not just the first
    - perf record: Fix possible incorrect free in record__switch_output()
    - HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
    - drm/amd/display: Fix a potential buffer overflow in
      'dp_dsc_clock_en_read()'
    - drm/amd/display: Fix potential NULL pointer dereferences in
      'dcn10_set_output_transfer_func()'
    - perf evsel: Fix duplicate initialization of data->id in
      evsel__parse_sample()
    - media: em28xx: annotate unchecked call to media_device_register()
    - media: v4l2-tpg: fix some memleaks in tpg_alloc
    - media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
    - media: edia: dvbdev: fix a use-after-free
    - pinctrl: mediatek: Drop bogus slew rate register range for MT8192
    - [arm64] clk: qcom: reset: Commonize the de/assert functions
    - [arm64] clk: qcom: reset: Ensure write completion on reset de/assertion
    - quota: simplify drop_dquot_ref()
    - quota: Fix potential NULL pointer dereference
    - quota: Fix rcu annotations of inode dquot pointers
    - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
    - crypto: xilinx - call finalize with bh disabled
    - perf thread_map: Free strlist on normal path in
      thread_map__new_by_tid_str()
    - drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
    - ALSA: seq: fix function cast warnings
    - perf stat: Avoid metric-only segv
    - media: sun8i-di: Fix coefficient writes
    - media: sun8i-di: Fix power on/off sequences
    - media: sun8i-di: Fix chroma difference threshold
    - media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
    - media: go7007: add check of return value of go7007_read_addr()
    - media: pvrusb2: remove redundant NULL check
    - media: pvrusb2: fix pvr2_stream_callback casts
    - PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
    - [arm64] clk: hisilicon: hi3519: Release the correct number of gates in
      hi3519_clk_unregister()
    - [arm64,armhf] drm/tegra: put drm_gem_object ref on error in
      tegra_fb_create
    - mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
    - mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes
      a ref
    - crypto: arm/sha - fix function cast warnings
    - drm/tidss: Fix initial plane zpos values
    - mtd: maps: physmap-core: fix flash size larger than 32-bit
    - mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
    - drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
    - media: pvrusb2: fix uaf in pvr2_context_set_notify
    - media: dvb-frontends: avoid stack overflow warnings with clang
    - media: go7007: fix a memleak in go7007_load_encoder
    - media: ttpci: fix two memleaks in budget_av_attach
    - media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
    - powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
    - [arm64] drm/msm/dpu: add division of drm_display_mode's hskew parameter
    - [powerpc*] embedded6xx: Fix no previous prototype for avr_uart_send() etc.
    - leds: aw2013: Unlock mutex before destroying it
    - leds: sgm3140: Add missing timer cleanup and flash gpio control
    - backlight: lm3630a: Initialize backlight_properties on init
    - backlight: lm3630a: Don't set bl->props.brightness in get_brightness
    - backlight: da9052: Fully initialize backlight_properties during probe
    - backlight: lm3639: Fully initialize backlight_properties during probe
    - backlight: lp8788: Fully initialize backlight_properties during probe
    - clk: Fix clk_core_get NULL dereference
    - ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
    - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
    - RDMA/srpt: Do not register event handler until srpt device is fully setup
    - f2fs: compress: fix to check unreleased compressed cluster
    - scsi: csiostor: Avoid function pointer casts
    - RDMA/device: Fix a race between mad_client and cm_client init
    - scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
    - net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
    - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
    - NFSv4.2: fix listxattr maximum XDR buffer size
    - watchdog: stm32_iwdg: initialize default timeout
    - NFS: Fix an off by one in root_nfs_cat()
    - afs: Revert "afs: Hide silly-rename files from userspace"
    - [armhf] remoteproc: stm32: Constify st_rproc_ops
    - [armhf] remoteproc: Add new get_loaded_rsc_table() to rproc_ops
    - [armhf] remoteproc: stm32: Move resource table setup to rproc_ops
    - [armhf] remoteproc: stm32: use correct format strings on 64-bit
    - [armhf] remoteproc: stm32: Fix incorrect type in assignment for va
    - [armhf] remoteproc: stm32: Fix incorrect type assignment returned by
      stm32_rproc_get_loaded_rsc_tablef
    - tty: vt: fix 20 vs 0x20 typo in EScsiignore
    - serial: max310x: fix syntax error in IRQ error message
    - tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
    - kconfig: fix infinite loop when expanding a macro at the end of file
    - rtc: mt6397: select IRQ_DOMAIN instead of depending on it
    - serial: 8250_exar: Don't remove GPIO device on suspend
    - staging: greybus: fix get_channel_from_mode() failure path
    - usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
    - io_uring: don't save/restore iowait state
    - [s390x] vtime: fix average steal time calculation
    - soc: fsl: dpio: fix kcalloc() argument order
    - hsr: Fix uninit-value access in hsr_get_node()
    - packet: annotate data-races around ignore_outgoing
    - net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
    - wireguard: receive: annotate data-race around receiving_counter.counter
    - rds: introduce acquire/release ordering in acquire/release_in_xmit()
    - hsr: Handle failures in module init
    - net/bnx2x: Prevent access to a freed page in page_pool
    - netfilter: nft_set_pipapo: release elements in clone only from destroy
      path (CVE-2024-26809)
    - scsi: fc: Update formal FPIN descriptor definitions
    - netfilter: nf_tables: do not compare internal table flags on updates
    - rcu: add a helper to report consolidated flavor QS
    - bpf: report RCU QS in cpumap kthread
    - spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
    - regmap: Add missing map->bus check
    - [armhf] remoteproc: stm32: fix phys_addr_t format string
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.215
    - amdkfd: use calloc instead of kzalloc to avoid integer overflow
      (CVE-2024-26817)
    - Documentation/hw-vuln: Update spectre doc
    - [x86] cpu: Support AMD Automatic IBRS
    - [x86] bugs: Use sysfs_emit()
    - timers: Update kernel-doc for various functions
    - timers: Use del_timer_sync() even on UP
    - timers: Rename del_timer_sync() to timer_delete_sync()
    - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
      (CVE-2023-47233)
    - [armhf] dts: marvell: Fix maxium->maxim typo in brownstone dts
    - [x86] drm/vmwgfx: stop using ttm_bo_create v2
    - [x86] drm/vmwgfx: switch over to the new pin interface v2
    - [x86] drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret'
    - [x86] drm/vmwgfx: Fix some static checker warnings
    - [x86] drm/vmwgfx: Fix possible null pointer derefence with invalid
      contexts
    - media: xc4000: Fix atomicity violation in xc4000_get_frequency
      (CVE-2024-24861)
    - KVM: Always flush async #PF workqueue when vCPU is being destroyed
    - [x86] crypto: qat - fix double free during reset
    - [x86] crypto: qat - resolve race condition during AER recovery
    - ext4: correct best extent lstart adjustment logic
    - block: introduce zone_write_granularity limit
    - block: Clear zone limits for a non-zoned stacked queue
    - bounds: support non-power-of-two CONFIG_NR_CPUS
    - fat: fix uninitialized field in nostale filehandles
    - ubifs: Set page uptodate in the correct place
    - ubi: Check for too small LEB size in VTBL code
    - ubi: correct the calculation of fastmap size
    - mtd: rawnand: meson: fix scrambling mode value in command macro
    - PM: suspend: Set mem_sleep_current during kernel command line setup
    - [powerpc*] fsl: Fix mfpmr build errors with newer binutils
    - USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
    - USB: serial: add device ID for VeriFone adapter
    - USB: serial: cp210x: add ID for MGP Instruments PDS100
    - USB: serial: option: add MeiG Smart SLM320 product
    - USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
    - PM: sleep: wakeirq: fix wake irq warning in system suspend
    - mmc: tmio: avoid concurrent runs of mmc_request_done()
    - fuse: fix root lookup with nonzero generation
    - fuse: don't unhash root
    - usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros
    - printk/console: Split out code that enables default console
    - serial: Lock console when calling into driver before registration
    - btrfs: fix off-by-one chunk length calculation at
      contains_pending_extent()
    - PCI: Drop pci_device_remove() test of pci_dev->driver
    - PCI/PM: Drain runtime-idle callbacks before driver removal
    - PCI/ERR: Cache RCEC EA Capability offset in pci_init_capabilities()
    - PCI: Cache PCIe Device Capabilities register
    - PCI: Work around Intel I210 ROM BAR overlap defect
    - PCI/ASPM: Make Intel DG2 L1 acceptable latency unlimited
    - PCI/DPC: Quirk PIO log size for certain Intel Root Ports
    - PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports
    - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
    - dm-raid: fix lockdep waring in "pers->hot_add_disk"
    - mac802154: fix llsec key resources release in mac802154_llsec_key_del
    - mm: swap: fix race between free_swap_and_cache() and swapoff()
    - mmc: core: Fix switch on gp3 partition
    - [armhf] drm/etnaviv: Restore some id values
    - hwmon: (amc6821) add of_match table
    - ext4: fix corruption during on-line resize
    - nvmem: meson-efuse: fix function pointer type mismatch
    - slimbus: core: Remove usage of the deprecated ida_simple_xx() API
    - [arm64,armhf] phy: tegra: xusb: Add API to retrieve the port number of phy
    - usb: gadget: tegra-xudc: Use dev_err_probe()
    - usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic
    - speakup: Fix 8bit characters from direct synth
    - PCI/ERR: Clear AER status only when we control AER
    - PCI/AER: Block runtime suspend when handling errors
    - nfs: fix UAF in direct writes
    - kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
    - PCI: dwc: endpoint: Fix advertised resizable BAR size
    - vfio/platform: Disable virqfds on cleanup
    - ring-buffer: Fix waking up ring buffer readers
    - ring-buffer: Do not set shortest_full when full target is hit
    - ring-buffer: Fix resetting of shortest_full
    - ring-buffer: Fix full_waiters_pending in poll
    - [s390x] zcrypt: fix reference counting on zcrypt card objects
    - drm/panel: do not return negative error codes from drm_panel_get_modes()
    - [armhf] drm/exynos: do not return negative values from .get_modes()
    - drm/imx/ipuv3: do not return negative values from .get_modes()
    - drm/vc4: hdmi: do not return negative values from .get_modes()
    - nilfs2: fix failure to detect DAT corruption in btree and direct mappings
    - nilfs2: prevent kernel bug at submit_bh_wbc()
    - cpufreq: dt: always allocate zeroed cpumask
    - [x86] CPU/AMD: Update the Zenbleed microcode revisions
    - net: hns3: tracing: fix hclgevf trace event strings
    - wireguard: netlink: check for dangling peer via is_dead instead of empty
      list
    - wireguard: netlink: access device through ctx instead of peer
    - ahci: asm1064: correct count of reported ports
    - ahci: asm1064: asm1166: don't limit reported ports
    - drm/amd/display: Return the correct HDCP error code
    - drm/amd/display: Fix noise issue on HDMI AV mute
    - dm snapshot: fix lockup in dm_exception_table_exit
    - vxge: remove unnecessary cast in kfree()
    - [x86] stackprotector/32: Make the canary into a regular percpu variable
    - [x86] pm: Work around false positive kmemleak report in
      msr_build_context()
    - scripts: kernel-doc: Fix syntax error due to undeclared args variable
      (Closes: #1064035)
    - comedi: comedi_test: Prevent timers rescheduling during deletion
    - cpufreq: brcmstb-avs-cpufreq: fix up "add check for cpufreq_cpu_get's
      return value"
    - netfilter: nf_tables: mark set as dead when unbinding anonymous set with
      timeout (CVE-2024-26643)
    - netfilter: nf_tables: disallow anonymous set with timeout flag
      (CVE-2024-26642)
    - netfilter: nf_tables: reject constant set with timeout
    - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of
      memory
    - xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
    - [x86] KVM: SVM: Flush pages under kvm->lock to fix UAF in
      svm_register_enc_region()
    - ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo
      ALC897 platform
    - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
    - usb: gadget: ncm: Fix handling of zero block length packets
    - usb: port: Don't try to peer unused USB ports based on location
    - tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
    - mei: me: add arrow lake point S DID
    - mei: me: add arrow lake point H DID
    - vt: fix unicode buffer corruption when deleting characters
    - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
    - tee: optee: Fix kernel panic caused by incorrect error handling
    - xen/events: close evtchn after mapping cleanup (CVE-2024-26687)
    - printk: Update @console_may_schedule in console_trylock_spinning()
    - btrfs: allocate btrfs_ioctl_defrag_range_args on stack
    - [x86] asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix
    - [x86] bugs: Add asm helpers for executing VERW
    - [x86] entry_64: Add VERW just before userspace transition
    - [x86] entry_32: Add VERW just before userspace transition
    - [x86] bugs: Use ALTERNATIVE() instead of mds_user_clear static key
    - [x86] KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH
    - [x86] KVM/VMX: Move VERW closer to VMentry for MDS mitigation
    - [x86] Mitigate Register File Data Sampling (RFDS) vulnerability
      (CVE-2023-28746):
      + [x86] mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set
      + Documentation/hw-vuln: Add documentation for RFDS
      + [x86] rfds: Mitigate Register File Data Sampling (RFDS)
      + [x86] KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests
    - perf/core: Fix reentry problem in perf_output_read_group()
    - efivarfs: Request at most 512 bytes for variable names
    - [powerpc*] xor_vmx: Add '-mhard-float' to CFLAGS
    - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
      (CVE-2023-52488)
    - mm/memory-failure: fix an incorrect use of tail pages
    - mm/migrate: set swap entry values of THP tail pages properly.
    - init: open /initrd.image with O_LARGEFILE
    - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
    - exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
    - mmc: core: Initialize mmc_blk_ioc_data
    - mmc: core: Avoid negative index with array access
    - net: ll_temac: platform_get_resource replaced by wrong function
    - usb: cdc-wdm: close race between read and workqueue
    - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
      (CVE-2024-26654)
    - scsi: core: Fix unremoved procfs host directory regression
    - [arm*] staging: vc04_services: changen strncpy() to strscpy_pad()
    - [arm*] staging: vc04_services: fix information leak in create_component()
    - USB: core: Add hub_get() and hub_put() routines
    - [arm*] usb: dwc2: host: Fix remote wakeup from hibernation
    - [arm*] usb: dwc2: host: Fix hibernation flow
    - [arm*] usb: dwc2: host: Fix ISOC flow in DDMA mode
    - [arm*] usb: dwc2: gadget: LPM flow fix
    - usb: udc: remove warning when queue disabled ep
    - usb: typec: ucsi: Ack unsupported commands
    - usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset
    - scsi: qla2xxx: Split FCE|EFT trace control
    - scsi: qla2xxx: Fix command flush on cable pull
    - scsi: qla2xxx: Delay I/O Abort on PCI error
    - [x86] cpu: Enable STIBP on AMD if Automatic IBRS is enabled
    - PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports
    - scsi: lpfc: Correct size for wqe for memset()
    - USB: core: Fix deadlock in usb_deauthorize_interface()
    - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
    - ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
    - tcp: properly terminate timers for kernel sockets
    - ACPICA: debugger: check status of acpi_evaluate_object() in
      acpi_db_walk_for_fields()
    - bpf: Protect against int overflow for stack access size
    - dm integrity: fix out-of-range warning
    - r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
    - [x86] cpufeatures: Add new word for scattered features
    - Bluetooth: hci_event: set the conn encrypted before conn establishes
    - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CVE-2024-24857,
      CVE-2024-24858)
    - netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)
    - net/rds: fix possible cp null dereference
    - vfio/pci: Disable auto-enable of exclusive INTx IRQ (CVE-2024-27437)
    - vfio/pci: Lock external INTx masking ops (CVE-2024-26810)
    - vfio: Introduce interface to flush virqfd inject workqueue
    - vfio/pci: Create persistent INTx handler (CVE-2024-26812)
    - vfio/platform: Create persistent IRQ handlers (CVE-2024-26813)
    - vfio/fsl-mc: Block calling interrupt handler without trigger
      (CVE-2024-26814)
    - io_uring: ensure '0' is returned on file registration success
    - Revert "x86/mm/ident_map: Use gbpages only where full GB page should be
      mapped."
    - mm, vmscan: prevent infinite loop for costly GFP_NOIO |
      __GFP_RETRY_MAYFAIL allocations
    - [x86] srso: Add SRSO mitigation for Hygon processors (CVE-2023-52482)
    - block: add check that partition length needs to be aligned with block size
      (CVE-2023-52458)
    - netfilter: nf_tables: reject new basechain after table flag update
    - netfilter: nf_tables: flush pending destroy work before exit_net release
    - netfilter: nf_tables: Fix potential data-race in
      __nft_flowtable_type_get()
    - netfilter: validate user input for expected length
    - vboxsf: Avoid an spurious warning if load_nls_xxx() fails
    - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
    - net/sched: act_skbmod: prevent kernel-infoleak
    - net: stmmac: fix rx queue priority assignment
    - erspan: make sure erspan_base_hdr is present in skb->head
    - ipv6: Fix infinite recursion in fib6_dump_done().
    - udp: do not transition UDP GRO fraglist partial checksums to unnecessary
    - i40e: fix i40e_count_filters() to count only active/new filters
    - i40e: fix vf may be used uninitialized in this function warning
    - scsi: qla2xxx: Update manufacturer details
    - scsi: qla2xxx: Update manufacturer detail
    - Revert "usb: phy: generic: Get the vbus supply"
    - udp: do not accept non-tunnel GSO skbs landing in a tunnel
    - net: ravb: Always process TX descriptor ring
    - [arm64] dts: qcom: sc7180: Remove clock for bluetooth on Trogdor
    - [arm64] dts: qcom: sc7180-trogdor: mark bluetooth address as broken
    - ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
    - ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
    - scsi: mylex: Fix sysfs buffer lengths
    - ata: sata_mv: Fix PCI device ID table declaration compilation warning
    - ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with
      microphone
    - driver core: Introduce device_link_wait_removal()
    - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
    - [x86] mce: Make sure to grab mce_sysfs_mutex in set_bank()
    - [s390x] entry: align system call table on 8 bytes
    - [x86] bugs: Fix the SRSO mitigation on Zen3/4
    - [x86] retpoline: Do the necessary fixup to the Zen3/4 srso return thunk
      for !SRSO
    - mptcp: don't account accept() of non-MPC client as fallback to TCP
    - [x86] cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined
      word
    - objtool: Add asm version of STACK_FRAME_NON_STANDARD
    - wifi: ath9k: fix LNA selection in ath_ant_try_scan()
    - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
    - panic: Flush kernel log buffer at the end
    - [arm64] dts: rockchip: fix rk3328 hdmi ports node
    - [arm64] dts: rockchip: fix rk3399 hdmi ports node
    - ionic: set adminq irq affinity
    - pstore/zone: Add a null pointer check to the psz_kmsg_read
    - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
    - btrfs: export: handle invalid inode or root reference in
      btrfs_get_parent()
    - btrfs: send: handle path ref underflow in header iterate_inode_ref()
    - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
    - Bluetooth: btintel: Fix null ptr deref in btintel_read_version
    - Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
    - pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs
    - sysv: don't call sb_bread() with pointers_lock held
    - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
    - isofs: handle CDs with bad root inode but good Joliet root directory
    - media: sta2x11: fix irq handler cast
    - ext4: add a hint for block bitmap corrupt state in mb_groups
    - ext4: forbid commit inconsistent quota data when errors=remount-ro
    - drm/amd/display: Fix nanosec stat overflow
    - SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to
      unsigned int
    - Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
    - libperf evlist: Avoid out-of-bounds access
    - block: prevent division by zero in blk_rq_stat_sum()
    - RDMA/cm: add timeout to cm_destroy_id wait
    - Input: allocate keycode for Display refresh rate toggle
    - [x86] platform/x86: touchscreen_dmi: Add an extra entry for a variant of
      the Chuwi Vi8 tablet
    - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent
      environment
    - tools: iio: replace seekdir() in iio_generic_buffer
    - usb: typec: tcpci: add generic tcpci fallback compatible
    - usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
    - fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
    - drivers/nvme: Add quirks for device 126f:2262
    - fbmon: prevent division by zero in fb_videomode_from_videomode()
    - netfilter: nf_tables: release batch on table validation from abort path
    - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
      (CVE-2024-26925)
    - netfilter: nf_tables: discard table flag update with pending basechain
      deletion
    - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
    - virtio: reenable config if freezing device failed
    - [x86] mm/pat: fix VM_PAT handling in COW mappings
    - [x86] drm/i915/gt: Reset queue_priority_hint on parking
    - Bluetooth: btintel: Fixe build regression
    - [x86] VMCI: Fix possible memcpy() run-time warning in
      vmci_datagram_invoke_guest_handler()
    - kbuild: dummy-tools: adjust to stricter stackprotector check
    - scsi: sd: Fix wrong zone_write_granularity value during revalidate
    - [x86] retpoline: Add NOENDBR annotation to the SRSO dummy return thunk
    - [x86] head/64: Re-enable stack protection
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.216
    - batman-adv: Avoid infinite loop trying to resize local TT
    - Bluetooth: Fix memory leak in hci_req_sync_complete()
    - media: cec: core: remove length check of Timer Status
    - nouveau: fix function cast warning
    - net: openvswitch: fix unwanted error log on timeout policy probing
    - u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one
      file
    - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
    - geneve: fix header validation in geneve[6]_xmit_skb
    - ipv6: fib: hide unused 'pn' variable
    - ipv4/route: avoid unused-but-set-variable warning
    - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
    - Bluetooth: SCO: Fix not validating setsockopt user input
    - netfilter: complete validation of user input
    - net/mlx5: Properly link new fs rules into the tree
    - af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
    - af_unix: Fix garbage collector racing against connect() (CVE-2024-26923)
    - net: ena: Fix potential sign extension issue
    - net: ena: Wrong missing IO completions check order
    - net: ena: Fix incorrect descriptor free behavior
    - [amd64] iommu/vt-d: Allocate local memory for page request queue
    - [arm64] mailbox: imx: fix suspend failue
    - btrfs: qgroup: correctly model root qgroup rsv in convert
    - drm/client: Fully protect modes[] with dev->mode_config.mutex
    - vhost: Add smp_rmb() in vhost_vq_avail_empty()
    - [x86] cpu: Actually turn off mitigations by default for
      SPECULATION_MITIGATIONS=n
    - [x86] apic: Force native_apic_mem_read() to use the MOV instruction
    - irqflags: Explicitly ignore lockdep_hrtimer_exit() argument
    - btrfs: record delayed inode root in transaction
    - kprobes: Fix possible use-after-free issue on kprobe registration
    - Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
    - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
      (CVE-2024-27020)
    - netfilter: nft_set_pipapo: do not free live element (CVE-2024-26924)
    - tun: limit printing rate when illegal packet received by tun dev
      (CVE-2024-27013)
    - RDMA/rxe: Fix the problem "mutex_destroy missing"
    - RDMA/cm: Print the old state when cm_destroy_id gets timeout
    - RDMA/mlx5: Fix port number for counter query in multi-port configuration
    - drm: nv04: Fix out of bounds access (CVE-2024-27008)
    - drm/panel: visionox-rm69299: don't unregister DSI device
    - clk: Remove prepare_lock hold assertion in __clk_release()
    - clk: Mark 'all_lists' as const
    - clk: remove extra empty line
    - clk: Print an info line before disabling unused clocks
    - clk: Initialize struct clk_core kref earlier
    - clk: Get runtime PM before walking tree during disable_unused
      (CVE-2024-27004)
    - [x86] cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
    - [arm*] binder: check offset alignment in binder_get_object()
      (CVE-2024-26926)
    - [x86] thunderbolt: Avoid notify PM core about runtime PM resume
    - [x86] thunderbolt: Fix wake configurations after device unplug
    - [x86] comedi: vmk80xx: fix incomplete endpoint checking (CVE-2024-27001)
    - USB: serial: option: add Fibocom FM135-GL variants
    - USB: serial: option: add support for Fibocom FM650/FG650
    - USB: serial: option: add Lonsung U8300/U9300 product
    - USB: serial: option: support Quectel EM060K sub-models
    - USB: serial: option: add Rolling RW101-GL and RW135-GL support
    - USB: serial: option: add Telit FN920C04 rmnet compositions
    - Revert "usb: cdc-wdm: close race between read and workqueue"
    - usb: dwc2: host: Fix dereference issue in DDMA completion flow.
      (CVE-2024-26997)
    - usb: Disable USB3 LPM at shutdown
    - mei: me: disable RPL-S on SPS and IGN firmwares
    - speakup: Avoid crash on very long word (CVE-2024-26994)
    - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
      (CVE-2024-26993)
    - init/main.c: Fix potential static_command_line memory overflow
      (CVE-2024-26988)
    - drm/amdgpu: validate the parameters of bo mapping operations more clearly
      (CVE-2024-26922)
    - nouveau: fix instmem race condition around ptr stores (CVE-2024-26984)
    - nilfs2: fix OOB in nilfs_set_de_type (CVE-2024-26981)
    - wifi: iwlwifi: mvm: remove old PASN station when adding a new one
    - vxlan: drop packets from invalid src-address
    - ipv4: check for NULL idev in ip_route_use_hint()
    - net: usb: ax88179_178a: stop lying about skb->truesize
    - net: gtp: Fix Use-After-Free in gtp_dellink
    - ipvs: Fix checksumming on GSO of SCTP packets
    - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
    - netfilter: nf_tables: honor table dormant flag from netdev release event
      path
    - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
    - i40e: Report MFS in decimal base instead of hex
    - iavf: Fix TC config comparison with existing adapter TC config
    - net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets
    - af_unix: Suppress false-positive lockdep splat for spin_lock() in
      __unix_gc().
    - serial: core: Provide port lock wrappers
    - Revert "crypto: api - Disallow identical driver names"
    - net/mlx5e: Fix a race in command alloc flow
    - tracing: Show size of requested perf buffer
    - tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker
      together
    - PM / devfreq: Fix buffer overflow in trans_stat_show (CVE-2023-52614)
    - Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
    - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
    - cpu: Re-enable CPU mitigations by default for !X86 architectures
    - drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3
    - drm/amdgpu: Fix leak when GPU memory allocation fails
    - irqchip/gic-v3-its: Prevent double free on error
    - ethernet: Add helper for assigning packet type when dest address does not
      match device address
    - net: b44: set pause params only when interface is up
    - stackdepot: respect __GFP_NOLOCKDEP allocation flag
    - mtd: diskonchip: work around ubsan link failure
    - tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
    - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
    - [x86] idma64: Don't try to serve interrupts when device is powered off
    - i2c: smbus: fix NULL function pointer dereference
    - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
    - bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
    - udp: preserve the connected status if only UDP cmsg
    - serial: core: fix kernel-doc for uart_port_unlock_irqrestore()

  [ Salvatore Bonaccorso ]
  * Bump ABI to 29
  * [rt] Refresh "sched/vtime: Consolidate IRQ time accounting"
  * [rt] Update to 5.10.215-rt107
  * [rt] Refresh "u64_stats: Disable preemption on 32bit-UP/SMP with RT during
    updates"
  * drivers/tty: Disable N_GSM
  * tipc: fix UAF in error path
  * tipc: fix a possible memleak in tipc_buf_append

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 03 May 2024 14:40:24 +0200

linux (5.10.209-2) bullseye; urgency=medium

  * netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-1086)

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 31 Jan 2024 22:14:09 +0100

linux (5.10.209-1) bullseye; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.206
    - ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE
    - smb: client: fix OOB in smb2_query_reparse_point()
    - [armhf] OMAP2+: Fix null pointer dereference and memory leak in
      omap_soc_device_init
    - reset: Fix crash when freeing non-existent optional resets
    - [s390x] vx: fix save/restore of fpu kernel context
    - wifi: mac80211: mesh_plink: fix matches_local logic
    - Revert "net/mlx5e: fix double free of encap_header"
    - net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list()
    - net/mlx5: Fix fw tracer first block check
    - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used
      by representors
    - net: sched: ife: fix potential use-after-free
    - ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
    - net/rose: fix races in rose_kill_by_device()
    - net: check vlan filter feature in vlan_vids_add_by_dev() and
      vlan_vids_del_by_dev()
    - afs: Fix the dynamic root's d_delete to always delete unused dentries
    - afs: Fix dynamic root lookup DNS check
    - net: warn if gso_type isn't set for a GSO SKB
    - net: check dev->gso_max_size in gso_features_check()
    - keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
    - afs: Fix overwriting of result of DNS query
    - [armhf] i2c: aspeed: Handle the coalesced stop conditions with the start
      conditions.
    - ALSA: hda/hdmi: Add quirk to force pin connectivity on NUC10
    - ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB
    - smb: client: fix NULL deref in asn1_ber_decoder()
    - btrfs: do not allow non subvolume root targets for snapshot
    - iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
    - scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
    - iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time
      table
    - wifi: cfg80211: Add my certificate
    - wifi: cfg80211: fix certs build to not depend on file order
    - USB: serial: ftdi_sio: update Actisense PIDs constant names
    - USB: serial: option: add Quectel EG912Y module support
    - USB: serial: option: add Foxconn T99W265 with new baseline
    - USB: serial: option: add Quectel RM500Q R13 firmware support
    - Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
    - Bluetooth: L2CAP: Send reject on command corrupted request
    - [x86] Input: soc_button_array - add mapping for airplane mode button
    - net: 9p: avoid freeing uninit memory in p9pdu_vreadf
    - net: rfkill: gpio: set GPIO direction
    - tracing / synthetic: Disable events after testing in
      synth_event_gen_test_init()
    - bus: ti-sysc: Flush posted write only after srst_udelay
    - lib/vsprintf: Fix %pfwf when current node refcount == 0
    - [x86] alternatives: Sync core before enabling interrupts
    - 9p/net: fix possible memory leak in p9_check_errors()
    - ARM: dts: Fix occasional boot hang for am3 usb
    - Bluetooth: SMP: Convert BT_ERR/BT_DBG to bt_dev_err/bt_dev_dbg
    - Bluetooth: use inclusive language in SMP
    - Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE
    - usb: fotg210-hcd: delete an incorrect bounds test
    - smb: client: fix OOB in SMB2_query_info_init()
    - smb: client: fix OOB in smbCalcSize() (CVE-2023-6606)
    - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
      (CVE-2023-51779)
    - scsi: core: Add scsi_prot_ref_tag() helper
    - scsi: core: Introduce scsi_get_sector()
    - scsi: core: Make scsi_get_lba() return the LBA
    - scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
    - scsi: core: Use a structure member to track the SCSI command submitter
    - scsi: core: Always send batch on reset or error handling command
    - ring-buffer: Fix wake ups when buffer_percent is set to 100
    - tracing: Fix blocked reader of snapshot buffer
    - dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
    - Bluetooth: SMP: Fix crash when receiving new connection when debug is
      enabled
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.207
    - Revert "scsi: core: Always send batch on reset or error handling command"
    - Revert "scsi: core: Use a structure member to track the SCSI command
      submitter"
    - Revert "scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request"
    - Revert "scsi: core: Make scsi_get_lba() return the LBA"
    - Revert "scsi: core: Introduce scsi_get_sector()"
    - Revert "scsi: core: Add scsi_prot_ref_tag() helper"
    - scsi: core: Always send batch on reset or error handling command
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.208
    - keys, dns: Fix missing size check of V1 server-list header
    - block: Don't invalidate pagecache for invalid falloc modes
    - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6
    - nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to
      llcp_local
    - [x86] drm/i915/dp: Fix passing the correct DPCD_REV for
      drm_dp_set_phy_test_pattern
    - i40e: Fix filter input checks to prevent config with invalid values
    - net: sched: em_text: fix possible memory leak in em_text_destroy()
    - [armhf] sun9i: smp: Fix array-index-out-of-bounds read in
      sunxi_mc_smp_init
    - sfc: fix a double-free bug in efx_probe_filters
    - [arm64] net: bcmgenet: Fix FCS generation for fragmented skbuffs
    - netfilter: nftables: add loop check helper function
    - netfilter: nft_immediate: drop chain reference counter on error
    - net: Save and restore msg_namelen in sock_sendmsg
    - i40e: fix use-after-free in i40e_aqc_add_filters()
    - i40e: Restore VF MSI-X state during PCI reset
    - net/qla3xxx: switch from 'pci_' to 'dma_' API
    - net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues
    - asix: Add check for usbnet_get_endpoints
    - bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters()
    - net: Implement missing SO_TIMESTAMPING_NEW cmsg support
    - mm/memory-failure: check the mapcount of the precise page
    - firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines
      and ASM108x/VT630x PCIe cards
    - [x86] kprobes: fix incorrect return address calculation in
      kprobe_emulate_call_indirect
    - mm: fix unmap_mapping_range high bits shift bug
    - mmc: core: Cancel delayed work before releasing host
    - [powerpc*] update ppc_save_regs to save current r1 in pt_regs
    - net: tls, update curr on splice as well (CVE-2024-0646)
    - ipv6: remove max_size check inline with ipv4 (CVE-2023-52340)
    - drm/qxl: fix UAF on handle creation (CVE-2023-39198)
    - netfilter: nf_tables: Reject tables of unsupported family (CVE-2023-6040)
    - PCI: Extract ATS disabling to a helper function
    - PCI: Disable ATS for specific Intel IPU E2000 devices
    - Revert "nvme: use command_id instead of req->tag in
      trace_nvme_complete_rq()"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.209
    - f2fs: explicitly null-terminate the xattr list
    - ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
    - debugfs: fix automount d_fsdata usage
    - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
    - nvme-core: check for too small lba shift
    - [x86] ASoC: Intel: Skylake: Fix mem leak in few functions
    - [x86] ASoC: Intel: Skylake: mem leak in skl register function
    - ASoC: rt5650: add mutex to avoid the jack detection failure
    - nouveau/tu102: flush all pdbs on vmm flush
    - net/tg3: fix race condition in tg3_reset_task()
    - ASoC: da7219: Support low DC impedance headset
    - nvme: introduce helper function to get ctrl state
    - [armhf] drm/exynos: fix a potential error pointer dereference
    - [armhf] drm/exynos: fix a wrong error checking
    - [armhf] clk: rockchip: rk3128: Fix HCLK_OTG gate register
    - jbd2: correct the printing of write_flags in jbd2_write_superblock()
    - drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
    - neighbour: Don't let neigh_forced_gc() disable preemption for long
    - jbd2: fix soft lockup in journal_finish_inode_data_buffers()
    - tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
    - tracing: Add size check when printing trace_marker output
    - ring-buffer: Do not record in NMI if the arch does not support cmpxchg in
      NMI
    - [arm64] reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
    - Input: atkbd - skip ATKBD_CMD_GETID in translated mode
    - Input: i8042 - add nomux quirk for Acer P459-G2-M
    - [s390x] scm: fix virtual vs physical address confusion
    - Input: xpad - add Razer Wolverine V2 support
    - [arm64,armhf] i2c: rk3x: fix potential spinlock recursion on poll
    - ida: Fix crash in ida_free when the bitmap is empty (CVE-2023-6915)
    - net: qrtr: ns: Return 0 if server port is not present
    - [armhf] sun9i: smp: fix return code check of of_property_match_string
    - drm/crtc: fix uninitialized variable use
    - ACPI: resource: Add another DMI match for the TongFang GMxXGxx
    - [arm*] binder: use EPOLLERR from eventpoll.h
    - [arm*] binder: fix trivial typo of binder_free_buf_locked()
    - [arm*] binder: fix comment on binder_alloc_new_buf() return value
    - uio: Fix use-after-free in uio_open
    - parport: parport_serial: Add Brainboxes BAR details
    - parport: parport_serial: Add Brainboxes device IDs and geometry
    - PCI: Add ACS quirk for more Zhaoxin Root Ports
    - [x86] lib: Fix overflow when counting digits
    - [arm64] EDAC/thunderx: Fix possible out-of-bounds string access
    - [powerpc*] add crtsavres.o to always-y instead of extra-y
    - [powerpc*] Remove in_kernel_text()
    - [powerpc*] 44x: select I2C for CURRITUCK
    - [powerpc*] pseries/memhotplug: Quieten some DLPAR operations
    - [powerpc*] pseries/memhp: Fix access beyond end of drmem array
    - [powerpc*] powernv: Add a null pointer check to scom_debug_init_one()
    - [powerpc*] powernv: Add a null pointer check in opal_event_init()
    - [powerpc*] powernv: Add a null pointer check in opal_powercap_init()
    - [powerpc*] imc-pmu: Add a null pointer check in update_events_in_group()
    - spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
    - ACPI: video: check for error while searching for backlight device parent
    - [amd64] ACPI: LPIT: Avoid u32 multiplication overflow
    - of: property: define of_property_read_u{8,16,32,64}_array()
      unconditionally
    - of: Add of_property_present() helper
    - cpufreq: Use of_property_present() for testing DT property presence
    - cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
    - net: netlabel: Fix kerneldoc warnings
    - netlabel: remove unused parameter in netlbl_netlink_auditinfo()
    - calipso: fix memory leak in netlbl_calipso_add_pass()
    - efivarfs: force RO when remounting if SetVariable is not supported
    - ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the
      error
    - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
    - selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
    - virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
    - virtio-crypto: introduce akcipher service
    - virtio-crypto: implement RSA algorithm
    - virtio-crypto: change code style
    - virtio-crypto: use private buffer for control request
    - virtio-crypto: wait ctrl queue instead of busy polling
    - crypto: virtio - Handle dataq logic with tasklet
    - [x86] crypto: ccp - fix memleak in ccp_init_dm_workarea
    - crypto: af_alg - Disallow multiple in-flight AIO requests
    - pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
    - fs: indicate request originates from old mount API
    - Revert "gfs2: Don't reject a supposedly full bitmap if we have blocks
      reserved"
    - gfs2: Also reflect single-block allocations in rgd->rd_extfail_pt
    - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
    - crypto: virtio - Wait for tasklet to complete on device remove
    - crypto: scomp - fix req->dst buffer overflow
    - blocklayoutdriver: Fix reference leak of pnfs_device_node
    - NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
    - wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
    - bpf, lpm: Fix check prefixlen before walking trie
    - bpf: Add crosstask check to __bpf_get_stack
    - wifi: ath11k: Defer on rproc_get failure
    - wifi: libertas: stop selecting wext
    - ncsi: internal.h: Fix a spello
    - [armhf] net/ncsi: Fix netlink major/minor version numbers
    - [arm64] firmware: meson_sm: populate platform devices from sm device tree
      data
    - wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
    - bpf: fix check for attempt to corrupt spilled pointer
    - scsi: fnic: Return error if vmalloc() failed
    - [arm64] dts: qcom: qrb5165-rb5: correct LED panic indicator
    - [arm64] dts: qcom: sdm845-db845c: correct LED panic indicator
    - bpf: Fix verification of indirect var-off stack access
    - [arm64] scsi: hisi_sas: Replace with standard error code return value
    - virtio/vsock: fix logic which reduces credit update messages
    - dma-mapping: Add dma_release_coherent_memory to DMA API
    - dma-mapping: clear dev->dma_mem to NULL after freeing it
    - wifi: rtlwifi: add calculate_bit_shift()
    - wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
    - rtlwifi: rtl8192de: make arrays static const, makes object smaller
    - wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
    - wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
    - netfilter: nf_tables: mark newset as dead on transaction abort
    - Bluetooth: Fix bogus check for re-auth no supported with non-ssp
    - Bluetooth: btmtkuart: fix recv_buf() return value
    - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
    - RDMA/usnic: Silence uninitialized symbol smatch warnings
    - rcu: Create an unrcu_pointer() to remove __rcu from a pointer
    - drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer
    - drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
    - media: pvrusb2: fix use after free on context disconnection
    - drm/bridge: Fix typo in post_disable() description
    - f2fs: fix to avoid dirent corruption
    - drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
    - drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
    - drm/radeon: check return value of radeon_ring_lock()
    - [arm64] drm/msm/mdp4: flush vblank event on disable
    - [arm64] drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
    - drm/drv: propagate errors from drm_modeset_register_all()
    - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
    - drm/radeon/dpm: fix a memleak in sumo_parse_power_table
    - drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
    - drm/bridge: tc358767: Fix return value on error case
    - media: cx231xx: fix a memleak in cx231xx_init_isoc
    - f2fs: fix to check compress file in f2fs_move_file_range()
    - f2fs: fix to update iostat correctly in f2fs_filemap_fault()
    - media: dvbdev: drop refcount on error path in dvb_device_open()
    - media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling
      path of m88ds3103_probe()
    - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
    - drm/amd/pm: fix a double-free in si_dpm_init
    - drivers/amd/pm: fix a use-after-free in kv_parse_power_table
    - gpu/drm/radeon: fix two memleaks in radeon_vm_init
    - dt-bindings: clock: Update the videocc resets for sm8150
    - [arm64] drivers: clk: zynqmp: calculate closest mux rate
    - [arm64] clk: zynqmp: make bestdiv unsigned
    - [arm64] clk: zynqmp: Add a check for NULL pointer
    - [arm64] drivers: clk: zynqmp: update divider round rate logic
    - watchdog: set cdev owner before adding
    - watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
    - watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
    - watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused
    - clk: fixed-rate: add devm_clk_hw_register_fixed_rate
    - clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw
    - IB/iser: Prevent invalidating wrong MR
    - of: Fix double free in of_parse_phandle_with_args_map
    - of: unittest: Fix of_count_phandle_with_args() expected value message
    - keys, dns: Fix size check of V1 server-list header
    - [arm*] binder: fix async space check for 0-sized buffers
    - [arm*] binder: fix unused alloc->free_async_space
    - [arm*] binder: fix use-after-free in shinker's callback
    - Input: atkbd - use ab83 as id when skipping the getid command
    - dma-mapping: Fix build error unused-value
    - virtio-crypto: fix memory-leak
    - virtio-crypto: fix memory leak in
      virtio_crypto_alg_skcipher_close_session()
    - kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
    - xen-netback: don't produce zero-size SKB frags (CVE-2023-46838)
    - [arm*] binder: fix race between mmput() and do_exit()
    - tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
    - [armhf] usb: phy: mxs: remove CONFIG_USB_OTG condition for
      mxs_phy_is_otg_host()
    - [arm64,armhf] usb: dwc: ep0: Update request status in
      dwc3_ep0_stall_restart
    - [arm64,armhf] Revert "usb: dwc3: Soft reset phy on probe for host"
    - [arm64,armhf] Revert "usb: dwc3: don't reset device side if dwc3 was
      configured as host-only"
    - [arm64,armhf] usb: chipidea: wait controller resume finished for wakeup
      irq
    - Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
    - usb: typec: class: fix typec_altmode_put_partner to put plugs
    - usb: mon: Fix atomicity violation in mon_bin_vma_fault
    - [arm64,armhf] serial: imx: Ensure that imx_uart_rs485_config() is called
      with enabled clock
    - ALSA: oxygen: Fix right channel of capture volume mixer
    - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx
    - fbdev: flush deferred work in fb_deferred_io_fsync()
    - io_uring/rw: ensure io->bytes_done is always initialized
    - rootfs: Fix support for rootfstype= when root= is given
    - Bluetooth: Fix atomicity violation in {min,max}_key_size_set
    - [arm64,armhf] iommu/arm-smmu-qcom: Add missing GMU entry to match table
    - wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
    - wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
    - wifi: mwifiex: configure BSSID consistently when starting AP
    - [x86] kvm: Do not try to disable kvmclock if it was not enabled
    - [arm64] KVM: arm64: vgic-v4: Restore pending state on host userspace write
    - [arm64] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
    - iio: adc: ad7091r: Pass iio_dev to event handler
    - HID: wacom: Correct behavior when processing some confidence == false
      touches
    - mfd: syscon: Fix null pointer dereference in of_syscon_register()
    - [mips*] dmi: Fix early remap on MIPS32
    - [mips*] Fix incorrect max_low_pfn adjustment
    - [arm64] power: supply: cw2015: correct time_to_empty units in sysfs
    - libapi: Add missing linux/types.h header to get the __u64 type on io.h
    - acpi: property: Let args be NULL in __acpi_node_get_property_reference
    - software node: Let args be NULL in software_node_get_reference_args
    - [arm64,armhf] serial: imx: fix tx statemachine deadlock
    - iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify
    - iio: adc: ad9467: fix reset gpio handling
    - iio: adc: ad9467: don't ignore error codes
    - iio: adc: ad9467: fix scale setting
    - perf genelf: Set ELF program header addresses properly
    - tty: change tty_write_lock()'s ndelay parameter to bool
    - tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK
    - tty: don't check for signal_pending() in send_break()
    - tty: use 'if' in send_break() instead of 'goto'
    - usb: cdc-acm: return correct error code on unsupported break
    - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
    - nvmet-tcp: fix a crash in nvmet_req_complete()
    - perf env: Avoid recursively taking env->bpf_progs.lock
    - apparmor: avoid crash when parsed profile name is empty
    - [arm64,armhf] serial: imx: Correct clock error message in function probe()
    - nvmet-tcp: Fix the H2C expected PDU len calculation
    - [s390x] pci: fix max size calculation in zpci_memcpy_toio()
    - net: phy: micrel: populate .soft_reset for KSZ9131
    - netfilter: nf_tables: do not allow mismatch field size and set key length
    - netfilter: nf_tables: skip dead set elements in netlink dump
    - netfilter: nf_tables: reject NFT_SET_CONCAT with not field length
      description
    - ipvs: avoid stat macros calls from preemptible context
    - kdb: Fix a potential buffer overflow in kdb_local()
    - ethtool: netlink: Add missing ethnl_ops_begin/complete
    - [armhf] i2c: s3c24xx: fix read transfers in polling mode
    - [armhf] i2c: s3c24xx: fix transferring more than one message in polling
      mode
    - [arm64] dts: armada-3720-turris-mox: set irq type for RTC

  [ Salvatore Bonaccorso ]
  * Bump ABI to 28
  * stddef: Introduce DECLARE_FLEX_ARRAY() helper
  * smb3: Replace smb2pdu 1-element arrays with flex-arrays

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 31 Jan 2024 21:01:59 +0100

linux (5.10.205-2) bullseye-security; urgency=high

  * Revert "MIPS: Loongson64: Enable DMA noncoherent support" (fixes FTBFS)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 31 Dec 2023 16:46:35 +0100

linux (5.10.205-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.198
    - NFS: Use the correct commit info in nfs_join_page_group()
    - NFS/pNFS: Report EINVAL errors from connect() to the server
    - SUNRPC: Mark the cred for revalidation if the server rejects it
    - tracing: Increase trace array ref count on enable and filter files
    - ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones
    - ata: libahci: clear pending interrupt status
    - ext4: remove the 'group' parameter of ext4_trim_extent
    - ext4: add new helper interface ext4_try_to_trim_range()
    - ext4: scope ret locally in ext4_try_to_trim_range()
    - ext4: change s_last_trim_minblks type to unsigned long
    - ext4: mark group as trimmed only if it was fully scanned
    - ext4: replace the traditional ternary conditional operator with with
      max()/min()
    - ext4: move setting of trimmed bit into ext4_try_to_trim_range()
    - ext4: do not let fstrim block system suspend
    - tracing: Have event inject files inc the trace array ref count
    - bpf: Avoid deadlock when using queue and stack maps from NMI
    - i40e: Fix VF VLAN offloading when port VLAN is configured
    - [powerpc*] perf/hv-24x7: Update domain value check
    - dccp: fix dccp_v4_err()/dccp_v6_err() again
    - [x86] platform/x86: intel_scu_ipc: Check status after timeout in
      busy_loop()
    - [x86] platform/x86: intel_scu_ipc: Check status upon timeout in
      ipc_wait_for_interrupt()
    - [x86] platform/x86: intel_scu_ipc: Don't override scu in
      intel_scu_ipc_dev_simple_command()
    - [x86] platform/x86: intel_scu_ipc: Fail IPC send if still busy
    - [x86] srso: Fix srso_show_state() side effect
    - [x86] srso: Fix SBPB enablement for spec_rstack_overflow=off
    - [arm64] net: hns3: only enable unicast promisc when mac table full
    - [arm64] net: hns3: add 5ms delay before clear firmware reset irq source
    - net: bridge: use DEV_STATS_INC()
    - team: fix null-ptr-deref when team device type is changed
    - seqlock: avoid -Wshadow warnings
    - seqlock: Rename __seqprop() users
    - seqlock: Prefix internal seqcount_t-only macros with a "do_"
    - locking/seqlock: Do the lockdep annotation before locking in
      do_write_seqcount_begin_nested()
    - bnxt_en: Flush XDP for bnxt_poll_nitroa0()'s NAPI
    - net: rds: Fix possible NULL-pointer dereference
    - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
    - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
    - Input: i8042 - rename i8042-x86ia64io.h to i8042-acpipnpio.h
    - Input: i8042 - add quirk for TUXEDO Gemini 17 Gen1/Clevo PD70PN
    - [arm64] media: venus: core: Add io base variables for each block
    - [arm64] media: venus: hfi,pm,firmware: Convert to block relative
      addressing
    - [arm64] media: venus: hfi: Define additional 6xx registers
    - [arm64] media: venus: core: Add differentiator IS_V6(core)
    - [arm64] media: venus: hfi: Add a 6xx boot logic
    - [arm64] media: venus: hfi_venus: Write to VIDC_CTRL_INIT after unmasking
      interrupts
    - netfilter: use actual socket sk for REJECT action
    - netfilter: nft_exthdr: Support SCTP chunks
    - netfilter: nf_tables: add and use nft_sk helper
    - netfilter: nf_tables: add and use nft_thoff helper
    - netfilter: nft_exthdr: break evaluation if setting TCP option fails
    - netfilter: exthdr: add support for tcp option removal
    - netfilter: nft_exthdr: Fix non-linear header modification
    - ata: libata: Rename link flag ATA_LFLAG_NO_DB_DELAY
    - ata: ahci: Add support for AMD A85 FCH (Hudson D4)
    - ata: ahci: Rename board_ahci_mobile
    - ata: ahci: Add Elkhart Lake AHCI controller
    - btrfs: reset destination buffer when read_extent_buffer() gets invalid
      range
    - [armhf] bus: ti-sysc: Use fsleep() instead of usleep_range() in
      sysc_reset()
    - [armhf] bus: ti-sysc: Fix missing AM35xx SoC matching
    - [armhf] ARM: dts: omap: correct indentation
    - [armhf] bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart
      wake-up
    - gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip
    - i2c: npcm7xx: Fix callback completion ordering
    - scsi: qedf: Add synchronization between I/O completions and abort
    - ring-buffer: Avoid softlockup in ring_buffer_resize()
    - ring-buffer: Do not attempt to read past "commit"
    - scsi: pm80xx: Use phy-specific SAS address when sending PHY_START command
    - scsi: pm80xx: Avoid leaking tags when processing
      OPC_INB_SET_CONTROLLER_CONFIG command
    - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
    - bpf: Clarify error expectations from bpf_clone_redirect
    - media: vb2: frame_vector.c: replace WARN_ONCE with a comment
    - [powerpc*] watchpoints: Disable preemption in thread_change_pc()
    - [armhf] ncsi: Propagate carrier gain/loss events to the NCSI controller
    - sched/cpuacct: Fix user/system in shown cpuacct.usage*
    - sched/cpuacct: Fix charge percpu cpuusage
    - sched/cpuacct: Optimize away RCU read lock
    - cgroup: Fix suspicious rcu_dereference_check() usage warning
    - ACPI: Check StorageD3Enable _DSD property in ACPI code
    - nvme-pci: factor the iod mempool creation into a helper
    - nvme-pci: factor out a nvme_pci_alloc_dev helper
    - nvme-pci: do not set the NUMA node of device if it has none
    - watchdog: iTCO_wdt: No need to stop the timer in probe
    - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running
    - netfilter: nft_exthdr: Search chunks in SCTP packets only
    - netfilter: nft_exthdr: Fix for unsafe packet data read
    - nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev
    - Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
    - serial: 8250_port: Check IRQ data before use
    - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
    - netfilter: nf_tables: disallow rule removal from chain binding
      (CVE-2023-5197)
    - ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre
      M70q
    - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION
      CODES
    - i2c: i801: unregister tco_pdev in i801_probe() error path
    - Revert "SUNRPC dont update timeout value on connection reset"
    - proc: nommu: /proc/<pid>/maps: release mmap read lock
    - ring-buffer: Update "shortest_full" in polling
    - btrfs: properly report 0 avail for very full file systems
    - bpf: Fix BTF_ID symbol generation collision
    - bpf: Fix BTF_ID symbol generation collision in tools/
    - net: thunderbolt: Fix TCPv6 GSO checksum calculation
    - ata: libata-core: Fix ata_port_request_pm() locking
    - ata: libata-core: Fix port and device removal
    - ata: libata-core: Do not register PM operations for SAS ports
    - ata: libata-sata: increase PMP SRST timeout to 10s
    - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC
    - NFS: Cleanup unused rpc_clnt variable
    - NFS: rename nfs_client_kset to nfs_kset
    - NFSv4: Fix a state manager thread deadlock regression
    - ring-buffer: remove obsolete comment for free_buffer_page()
    - ring-buffer: Fix bytes info in per_cpu buffer stats
    - rbd: move rbd_dev_refresh() definition
    - rbd: decouple header read-in from updating rbd_dev->header
    - rbd: decouple parent info read-in from updating rbd_dev
    - rbd: take header_rwsem in rbd_dev_refresh() only when updating
    - block: fix use-after-free of q->q_usage_counter
    - Revert "clk: imx: pll14xx: dynamically configure PLL for
      393216000/361267200Hz"
    - Revert "PCI: qcom: Disable write access to read only registers for IP
      v2.3.3"
    - scsi: zfcp: Fix a double put in zfcp_port_enqueue()
    - wifi: mwifiex: Fix tlv_buf_left calculation
    - net: replace calls to sock->ops->connect() with kernel_connect()
    - net: prevent rewrite of msg_name in sock_sendmsg()
    - [arm64] Add Cortex-A520 CPU part definition
    - ubi: Refuse attaching if mtd's erasesize is 0
    - wifi: iwlwifi: dbg_ini: fix structure packing
    - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
    - bpf: Fix tr dereferencing
    - drivers/net: process the result of hdlc_open() and add call of
      hdlc_close() in uhdlc_close()
    - wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling
    - regmap: rbtree: Fix wrong register marked as in-cache when creating new
      node
    - ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig
    - scsi: target: core: Fix deadlock due to recursive locking
    - ima: rework CONFIG_IMA dependency block
    - NFSv4: Fix a nfs4_state_manager() race
    - modpost: add missing else to the "of" check
    - net: fix possible store tearing in neigh_periodic_work()
    - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
    - [arm64,armhf] net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is
      absent
    - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
    - net: nfc: llcp: Add lock when modifying device list
    - net: ethernet: ti: am65-cpsw: Fix error code in
      am65_cpsw_nuss_init_tx_chns()
    - netfilter: handle the connecting collision properly in
      nf_conntrack_proto_sctp
    - netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure
    - [armhf] net: stmmac: dwmac-stm32: fix resume on STM32 MCU
    - tipc: fix a potential deadlock on &tx->lock
    - tcp: fix quick-ack counting to count actual ACKs of new data
    - tcp: fix delayed ACKs for MSS boundary condition
    - sctp: update transport state when processing a dupcook packet
    - sctp: update hb timer immediately after users change hb_interval
    - cpupower: add Makefile dependencies for install targets
    - dm zoned: free dmz->ddev array in dmz_put_zoned_devices
    - RDMA/core: Require admin capabilities to set system parameters
    - of: dynamic: Fix potential memory leak in of_changeset_action()
    - IB/mlx4: Fix the size of a buffer in add_port_entries()
    - [armhf] gpio: aspeed: fix the GPIO number passed to
      pinctrl_gpio_set_config()
    - RDMA/cma: Initialize ib_sa_multicast structure to 0 when join
    - RDMA/cma: Fix truncation compilation warning in make_cma_ports
    - RDMA/uverbs: Fix typo of sizeof argument
    - RDMA/siw: Fix connection failure handling
    - RDMA/mlx5: Fix NULL string error
    - netfilter: nf_tables: fix kdoc warnings after gc rework
    - netfilter: nftables: exthdr: fix 4-byte stack OOB write
    - xen/events: replace evtchn_rwlock with RCU (CVE-2023-34324)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.199
    - RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent
    - RDMA/srp: Do not call scsi_done() from srp_abort()
    - RDMA/cxgb4: Check skb value for failure to allocate
    - [arm64] perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7
    - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
    - quota: Fix slow quotaoff
    - net: prevent address rewrite in kernel_bind()
    - [arm64] drm/msm/dp: do not reinitialize phy unless retry during link
      training
    - [arm64] drm/msm/dsi: skip the wait for video mode done if not applicable
    - [arm64] drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid
      overflow
    - xen-netback: use default TX queue size for vifs
    - [x86] drm/vmwgfx: fix typo of sizeof argument
    - net: macsec: indicate next pn update when offloading
    - net: phy: mscc: macsec: reject PN update requests
    - ixgbe: fix crash with empty VF macvlan list
    - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
    - nfc: nci: assert requested protocol is valid
    - workqueue: Override implicit ordered attribute in
      workqueue_apply_unbound_cpumask()
    - net: add sysctl accept_ra_min_rtr_lft
    - net: change accept_ra_min_rtr_lft to affect all RA lifetimes
    - net: release reference to inet6_dev pointer
    - [armhf] dmaengine: stm32-mdma: abort resume if no ongoing transfer
    - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
    - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
    - [arm64,armhf] usb: dwc3: Soft reset phy on probe for host
    - usb: musb: Get the musb_qh poniter after musb_giveback
    - usb: musb: Modify the "HWVers" register address
    - iio: pressure: bmp280: Fix NULL pointer exception
    - iio: pressure: dps310: Adjust Timeout Settings
    - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
    - [x86] cpu: Fix AMD erratum #1485 on Zen4-based CPUs
    - mcb: remove is_added flag from mcb_device struct
    - [x86] thunderbolt: Check that lane 1 is in CL0 before enabling lane
      bonding
    - libceph: use kernel_connect()
    - ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
    - ceph: fix type promotion bug on 32bit systems
    - Input: powermate - fix use-after-free in powermate_config_complete
    - Input: psmouse - fix fast_reconnect function for PS/2 mode
    - Input: xpad - add PXN V900 support
    - Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
    - Input: goodix - ensure int GPIO is in input for gpio_count == 1 &&
      gpio_int_idx == 0 case
    - tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
    - cgroup: Remove duplicates in cgroup v1 tasks file
    - pinctrl: avoid unsafe code pattern in find_pinctrl()
    - counter: microchip-tcb-capture: Fix the use of internal GCLK logic
    - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
    - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
    - [powerpc*] 8xx: Fix pte_access_permitted() for PAGE_NONE
    - [powerpc*] 64e: Fix wrong test in __ptep_test_and_clear_young()
    - [x86] alternatives: Disable KASAN in apply_alternatives()
    - [arm64] report EL1 UNDEFs better
    - [arm64] die(): pass 'err' as long
    - [arm64] consistently pass ESR_ELx to die()
    - [arm64] rework FPAC exception handling
    - [arm64] rework BTI exception handling
    - [arm64] allow kprobes on EL0 handlers
    - [arm64] split EL0/EL1 UNDEF handlers
    - [arm64] factor out EL1 SSBS emulation hook
    - [arm64] factor insn read out of call_undef_hook()
    - [arm64] rework EL0 MRS emulation
    - [arm64] armv8_deprecated: fold ops into insn_emulation
    - [arm64] armv8_deprecated move emulation functions
    - [arm64] armv8_deprecated: move aarch32 helper earlier
    - [arm64] armv8_deprecated: rework deprected instruction handling
    - [arm64] armv8_deprecated: fix unused-function error
    - RDMA/srp: Set scmnd->result only when scmnd is not NULL
    - RDMA/srp: Fix srp_abort()
    - ravb: Fix use-after-free issue in ravb_tx_timeout_work() (CVE-2023-35827)
    - dev_forward_skb: do not scrub skb mark within the same name space
    - lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default
    - mm/memory_hotplug: rate limit page migration warnings
    - Documentation: sysctl: align cells in second content column
    - usb: hub: Guard against accesses to uninitialized BOS descriptors
    - Bluetooth: hci_event: Ignore NULL link key
    - Bluetooth: Reject connection with the device which has same BD_ADDR
    - Bluetooth: Fix a refcnt underflow problem for hci_conn
    - Bluetooth: vhci: Fix race when opening vhci device
    - Bluetooth: hci_event: Fix coding style
    - Bluetooth: avoid memcmp() out of bounds warning
    - ice: fix over-shifted variable
    - ice: reset first in crash dump kernels
    - nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
    - regmap: fix NULL deref on lookup
    - [x86] KVM: x86: Mask LVTPC when handling a PMI
    - [x86] sev: Disable MMIO emulation from user mode (CVE-2023-46813)
    - [x86] sev: Check IOBM for IOIO exceptions from user-space (CVE-2023-46813)
    - [x86] sev: Check for user-space IOIO pointing to kernel space
      (CVE-2023-46813)
    - tcp: check mptcp-level constraints for backlog coalescing
    - netfilter: nft_payload: fix wrong mac header matching
    - nvmet-tcp: Fix a possible UAF in queue intialization setup (CVE-2023-5178)
    - [x86] drm/i915: Retry gtt fault when out of fence registers
    - qed: fix LL2 RX buffer allocation
    - xfrm: fix a data-race in xfrm_gen_index()
    - xfrm: interface: use DEV_STATS_INC()
    - net: ipv4: fix return value check in esp_remove_trailer
    - net: ipv6: fix return value check in esp_remove_trailer
    - net: rfkill: gpio: prevent value glitch during probe
    - tcp: fix excessive TLP and RACK timeouts from HZ rounding
    - tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single
      skb
    - tun: prevent negative ifindex
    - ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
    - net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
    - i40e: prevent crash on probe if hw registers have invalid values
    - net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register()
    - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
    - netfilter: nft_set_rbtree: .deactivate fails if element has expired
    - net: pktgen: Fix interface flags printing
    - [x86] thunderbolt: Workaround an IOMMU fault on certain systems with Intel
      Maple Ridge
    - resource: Add irqresource_disabled()
    - ACPI: Drop acpi_dev_irqresource_disabled()
    - ACPI: resources: Add DMI-based legacy IRQ override quirk
    - ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA
    - ACPI: resource: Add ASUS model S5402ZA to quirks
    - ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
    - ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
    - ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
    - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
    - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
    - usb: core: Track SuperSpeed Plus GenXxY
    - xhci: cleanup xhci_hub_control port references
    - xhci: move port specific items such as state completions to port structure
    - xhci: rename resume_done to resume_timestamp
    - xhci: clear usb2 resume related variables in one place.
    - xhci: decouple usb2 port resume and get_port_status request handling
    - xhci: track port suspend state correctly in unsuccessful resume cases
    - serial: 8250: omap: Fix imprecise external abort for omap_8250_pm()
    - serial: 8250_omap: Fix errors with no_console_suspend
    - drm/amd/display: only check available pipe to disable vbios mode.
    - drm/amd/display: Don't set dpms_off for seamless boot
    - drm/connector: Give connector sysfs devices there own device_type
    - drm/connector: Add a fwnode pointer to drm_connector and register with
      ACPI (v2)
    - drm/connector: Add drm_connector_find_by_fwnode() function (v3)
    - drm/connector: Add support for out-of-band hotplug notification (v3)
    - usb: typec: altmodes/displayport: Notify drm subsys of hotplug events
    - usb: typec: altmodes/displayport: Signal hpd low when exiting mode
    - ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
    - btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to
      1
    - btrfs: initialize start_slot in btrfs_log_prealloc_extents
    - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
    - overlayfs: set ctime when setting mtime and atime
    - gpio: timberdale: Fix potential deadlock on &tgpio->lock
    - ata: libata-eh: Fix compilation warning in ata_eh_link_report()
    - tracing: relax trace_event_eval_update() execution with cond_resched()
    - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
    - Bluetooth: Avoid redundant authentication
    - Bluetooth: hci_core: Fix build warnings
    - wifi: cfg80211: Fix 6GHz scan configuration
    - wifi: mac80211: allow transmitting EAPOL frames with tainted key
    - wifi: cfg80211: avoid leaking stack data into trace
    - regulator/core: Revert "fix kobject release warning and memory leak in
      regulator_register()"
    - sky2: Make sure there is at least one frag_addr available
    - ipv4/fib: send notify when delete source address routes
    - drm: panel-orientation-quirks: Add quirk for One Mix 2S
    - btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
    - HID: multitouch: Add required quirk for Synaptics 0xcd7e device
    - [x86] platform/x86: touchscreen_dmi: Add info for the Positivo C4128B
    - net/mlx5: Handle fw tracer change ownership event based on MTRC
    - Bluetooth: hci_event: Fix using memcmp when comparing keys
    - mtd: physmap-core: Restore map_rom fallback
    - mmc: core: sdio: hold retuning if sdio in 1-bit mode
    - mmc: core: Capture correct oemid-bits for eMMC cards
    - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
    - pNFS: Fix a hang in nfs4_evict_inode()
    - ACPI: irq: Fix incorrect return value in acpi_register_gsi()
    - nvme-pci: add BOGUS_NID for Intel 0a54 device
    - nvme-rdma: do not try to stop unallocated queues
    - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
    - USB: serial: option: add entry for Sierra EM9191 with new firmware
    - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
    - perf: Disallow mis-matched inherited group reads (CVE-2023-5717)
    - [s390x] pci: fix iommu bitmap allocation
    - [x86] platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to
      0x2e
    - [x86] platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events
    - Bluetooth: hci_sock: fix slab oob read in create_monitor_event
    - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
    - xfrm6: fix inet6_dev refcount underflow problem
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.200
    - virtio_balloon: Fix endless deflation and inflation on arm64
    - virtio-mmio: fix memory leak of vm_dev
    - mm/page_alloc: correct start page when guard page debug is enabled
    - drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
    - r8169: fix the KCSAN reported data-race in rtl_tx while reading
      TxDescArray[entry].opts1
    - r8169: fix the KCSAN reported data race in rtl_rx while reading
      desc->opts1
    - treewide: Spelling fix in comment
    - igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
    - neighbour: fix various data-races
    - igc: Fix ambiguity in the ethtool advertising
    - net: ieee802154: adf7242: Fix some potential buffer overflow in
      adf7242_stats_show()
    - net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
    - r8152: Increase USB control msg timeout to 5000ms as per spec
    - r8152: Run the unload routine if we have errors during probe
    - r8152: Cancel hw_phy_work if we have an error in probe
    - r8152: Release firmware if we have an error in probe
    - tcp: fix wrong RTO timeout when received SACK reneging
    - gtp: uapi: fix GTPA_MAX
    - gtp: fix fragmentation needed check with gso
    - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
    - [armhf] i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
    - [armhf] i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
    - [armhf] i2c: aspeed: Fix i2c bus hang in slave read
    - tracing/kprobes: Fix the description of variable length arguments
    - [arm64,armhf] nvmem: imx: correct nregs for i.MX6ULL
    - [arm64,armhf] nvmem: imx: correct nregs for i.MX6SLL
    - [arm64,armhf] nvmem: imx: correct nregs for i.MX6UL
    - perf/core: Fix potential NULL deref
    - clk: Sanitize possible_parent_show to Handle Return Value of
      of_clk_get_parent_name
    - [x86] i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
    - kobject: Fix slab-out-of-bounds in fill_kobj_path() (CVE-2023-45863)
    - f2fs: fix to do sanity check on inode type during garbage collection
      (CVE-2021-44879)
    - [x86] mm: Simplify RESERVE_BRK()
    - [x86] mm: Fix RESERVE_BRK() for older binutils
    - ext4: add two helper functions extent_logical_end() and pa_logical_end()
    - ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
    - ext4: avoid overlapping preallocations due to overflow
    - [x86] objtool/x86: add missing embedded_insn check
    - driver: platform: Add helper for safer setting of driver_override
    - [arm64] rpmsg: Constify local variable in field store macro
    - rpmsg: Fix kfree() of static memory on setting driver_override
    - rpmsg: Fix calling device_lock() on non-initialized device
    - [arm64] rpmsg: glink: Release driver_override
    - [arm64] rpmsg: Fix possible refcount leak in
      rpmsg_register_device_override()
    - [x86] Fix .brk attribute in linker script
    - net: sched: cls_u32: Fix allocation size in u32_init()
    - [armhf] irqchip/stm32-exti: add missing DT IRQ flag translation
    - Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
    - fbdev: atyfb: only use ioremap_uc() on i386 and ia64
    - netfilter: nfnetlink_log: silence bogus compiler warning
    - ASoC: rt5650: fix the wrong result of key button
    - [x86] fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
    - scsi: mpt3sas: Fix in error path
    - net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
    - [powerpc*] mm: Fix boot crash with FLATMEM
    - can: isotp: change error format from decimal to symbolic error names
    - can: isotp: add symbolic error message to isotp_module_init()
    - can: isotp: Add error message if txqueuelen is too small
    - can: isotp: set max PDU size to 64 kByte
    - can: isotp: isotp_bind(): return -EINVAL on incorrect CAN ID formatting
    - can: isotp: check CAN address family in isotp_bind()
    - can: isotp: handle wait_event_interruptible() return values
    - can: isotp: add local echo tx processing and tx without FC
    - can: isotp: isotp_bind(): do not validate unused address information
    - can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior
    - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
    - usb: storage: set 1.50 as the lower bcdDevice for older "Super Top"
      compatibility
    - usb: raw-gadget: properly handle interrupted requests
    - tty: 8250: Remove UC-257 and UC-431
    - tty: 8250: Add support for additional Brainboxes UC cards
    - tty: 8250: Add support for Brainboxes UP cards
    - tty: 8250: Add support for Intashield IS-100
    - ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.201
    - [x86] iov_iter, x86: Be consistent about the __user tag on
      copy_mc_to_user()
    - sched/uclamp: Ignore (util == 0) optimization in feec() when p_util_max =
      0
    - vfs: fix readahead(2) on block devices
    - [x86] srso: Fix SBPB enablement for (possible) future fixed HW
    - futex: Don't include process MM in futex key on no-MMU
    - [x86] boot: Fix incorrect startup_gdt_descr.size
    - pstore/platform: Add check for kstrdup
    - genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()
    - i40e: fix potential memory leaks in i40e_remove()
    - udp: add missing WRITE_ONCE() around up->encap_rcv
    - tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed
    - overflow: Implement size_t saturating arithmetic helpers
    - gve: Use size_add() in call to struct_size()
    - tipc: Use size_add() in calls to struct_size()
    - wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
    - tcp_metrics: add missing barriers on delete
    - tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics()
    - tcp_metrics: do not create an entry from tcp_init_metrics()
    - wifi: rtlwifi: fix EDCA limit set by BT coexistence
    - can: dev: can_restart(): don't crash kernel if carrier is OK
    - can: dev: can_restart(): fix race condition between controller restart and
      netif_carrier_on()
    - PM / devfreq: rockchip-dfi: Make pmu regmap mandatory
    - thermal: core: prevent potential string overflow
    - r8169: use tp_to_dev instead of open code
    - r8169: fix rare issue with broken rx after link-down on RTL8125
    - tcp: fix cookie_init_timestamp() overflows
    - ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias()
    - ipv6: avoid atomic fragment on GSO packets
    - net: add DEV_STATS_READ() helper
    - ipvlan: properly track tx_errors
    - regmap: debugfs: Fix a erroneous check after snprintf()
    - [arm64] clk: qcom: clk-rcg2: Fix clock rate overflow for high parent
      frequencies
    - [arm64] clk: qcom: mmcc-msm8998: Add hardware clockgating registers to
      some clks
    - [arm64] clk: qcom: mmcc-msm8998: Don't check halt bit on some branch clks
    - [arm64] clk: qcom: mmcc-msm8998: Set bimc_smmu_gdsc always on
    - [arm64] clk: qcom: mmcc-msm8998: Fix the SMMU GDSC
    - [arm64] clk: qcom: gcc-sm8150: use ARRAY_SIZE instead of specifying
      num_parents
    - [arm64] clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src
    - [arm64] clk: imx: imx8mq: correct error handling path
    - clk: asm9260: use parent index to link the reference clock
    - clk: linux/clk-provider.h: fix kernel-doc warnings and typos
    - [arm64] spi: nxp-fspi: use the correct ioremap function
    - [armhf] clk: ti: Add ti_dt_clk_name() helper to use clock-output-names
    - [armhf] clk: ti: Update pll and clockdomain clocks to use ti_dt_clk_name()
    - [armhf] clk: ti: Update component clocks to use ti_dt_clk_name()
    - [armhf] clk: ti: change ti_clk_register[_omap_hw]() API
    - [armhf] clk: ti: fix double free in of_ti_divider_clk_setup()
    - [x86] platform/x86: wmi: Fix probe failure when failing to register WMI
      devices
    - [x86] platform/x86: wmi: remove unnecessary initializations
    - [x86] platform/x86: wmi: Fix opening of char device
    - hwmon: (coretemp) Fix potentially truncated sysfs attribute name
    - [arm64,armhf] drm/rockchip: vop: Fix reset of state in duplicate state
      crtc funcs
    - [arm64,armhf] drm/rockchip: vop: Fix call to crtc reset helper
    - drm/radeon: possible buffer overflow
    - [arm64] drm/rockchip: cdn-dp: Fix some error handling paths in
      cdn_dp_probe()
    - [arm64,armhf] drm/rockchip: Fix type promotion bug in
      rockchip_gem_iommu_map()
    - xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled
    - [arm64] dts: qcom: msm8916: Fix iommu local address range
    - [arm64] dts: qcom: sdm845-mtp: fix WiFi configuration
    - [i386] hwrng: geode - fix accessing registers
    - libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its
      return value
    - nd_btt: Make BTT lanes preemptible
    - [arm64] crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure
    - [arm64] crypto: caam/jr - fix Chacha20 + Poly1305 self test failure
    - [x86] crypto: qat - mask device capabilities with soft straps
    - [x86] crypto: qat - increase size of buffers
    - hid: cp2112: Fix duplicate workqueue initialization
    - [armel,armhf] 9321/1: memset: cast the constant byte to unsigned char
    - ext4: move 'ix' sanity check to corrent position
    - IB/mlx5: Fix rdma counter binding for RAW QP
    - [arm64] RDMA/hns: Fix uninitialized ucmd in hns_roce_create_qp_common()
    - [arm64] RDMA/hns: Fix signed-unsigned mixed comparisons
    - scsi: ufs: core: Leave space for '\0' in utf8 desc string
    - [amd64] RDMA/hfi1: Workaround truncation compilation error
    - hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip
    - Revert "HID: logitech-hidpp: add a module parameter to keep firmware
      gestures"
    - HID: logitech-hidpp: Remove HIDPP_QUIRK_NO_HIDINPUT quirk
    - HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only
    - HID: logitech-hidpp: Revert "Don't restart communication if not necessary"
    - HID: logitech-hidpp: Move get_wireless_feature_index() check to
      hidpp_connect_event()
    - [x86] ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails
    - padata: Convert from atomic_t to refcount_t on parallel_data->refcnt
    - padata: Fix refcnt handling in padata_free_shell()
    - mfd: core: Un-constify mfd_cell.of_reg
    - mfd: core: Ensure disabled devices are skipped without aborting
    - mfd: dln2: Fix double put in dln2_probe
    - leds: pwm: Don't disable the PWM when the LED should be off
    - leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu'
    - tty: tty_jobctrl: fix pid memleak in disassociate_ctty()
    - usb: dwc2: fix possible NULL pointer dereference caused by driver
      concurrency
    - dmaengine: ti: edma: handle irq_of_parse_and_map() errors
    - misc: st_core: Do not call kfree_skb() under spin_lock_irqsave()
    - USB: usbip: fix stub_dev hub disconnect
    - dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc()
    - f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()
    - modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host
    - [powerpc*] 40x: Remove stale PTE_ATOMIC_UPDATES macro
    - [powerpc*] xive: Fix endian conversion size
    - [powerpc*] imc-pmu: Use the correct spinlock initializer.
    - [powerpc*] pseries: fix potential memory leak in init_cpu_associativity()
    - xhci: Loosen RPM as default policy to cover for AMD xHC 1.1
    - usb: host: xhci-plat: fix possible kernel oops while resuming
    - perf machine: Avoid out of bounds LBR memory read
    - perf hist: Add missing puts to hist__account_cycles
    - i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs
    - rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call
    - pcmcia: cs: fix possible hung task and memory leak pccardd()
    - pcmcia: ds: fix refcount leak in pcmcia_device_add()
    - pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()
    - media: i2c: max9286: Fix some redundant of_node_put() calls
    - media: bttv: fix use after free error due to btv->timeout timer
    - media: s3c-camif: Avoid inappropriate kfree()
    - media: vidtv: psi: Add check for kstrdup
    - media: vidtv: mux: Add check and kfree for kstrdup
    - media: cedrus: Fix clock/reset sequence
    - media: dvb-usb-v2: af9035: fix missing unlock
    - regmap: prevent noinc writes from clobbering cache
    - pwm: sti: Avoid conditional gotos
    - pwm: sti: Reduce number of allocations and drop usage of chip_data
    - pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume
    - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
    - llc: verify mac len before reading mac header
    - hsr: Prevent use after free in prp_create_tagged_frame()
    - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
    - inet: shrink struct flowi_common
    - dccp: Call security_inet_conn_request() after setting IPv4 addresses.
    - dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
    - net: r8169: Disable multicast filter for RTL8168H and RTL8107E
    - Fix termination state for idr_for_each_entry_ul()
    - net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs
    - net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT
    - net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc
    - net/smc: put sk reference if close work was canceled
    - tg3: power down device only on SYSTEM_POWER_OFF
    - r8169: respect userspace disabling IFF_MULTICAST
    - netfilter: xt_recent: fix (increase) ipv6 literal buffer length
    - netfilter: nft_redir: use `struct nf_nat_range2` throughout and
      deduplicate eval call-backs
    - netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
    - [x86] Share definition of __is_canonical_address()
    - [x86] sev-es: Allow copy_from_kernel_nofault() in earlier boot
    - drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE
    - fbdev: imsttfb: Fix error path of imsttfb_probe()
    - fbdev: imsttfb: fix a resource leak in probe
    - fbdev: fsl-diu-fb: mark wr_reg_wa() static
    - tracing/kprobes: Fix the order of argument descriptions
    - Revert "mmc: core: Capture correct oemid-bits for eMMC cards"
    - btrfs: use u64 for buffer sizes in the tree search ioctls
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.202
    - perf/core: Bail out early if the request AUX area is out of bound
    - [armhf] clocksource/drivers/timer-imx-gpt: Fix potential memory leak
    - [x86] mm: Drop the 4 MB restriction on minimal NUMA node memory size
    - wifi: mac80211_hwsim: fix clang-specific fortify warning
    - wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
    - bpf: Detect IP == ksym.end as part of BPF program
    - wifi: ath9k: fix clang-specific fortify warnings
    - wifi: ath10k: fix clang-specific fortify warning
    - net: annotate data-races around sk->sk_tx_queue_mapping
    - net: annotate data-races around sk->sk_dst_pending_confirm
    - wifi: ath10k: Don't touch the CE interrupt registers after power up
    - Bluetooth: btusb: Add date->evt_skb is NULL check
    - Bluetooth: Fix double free in hci_conn_cleanup
    - [x86] platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
    - [arm64] drm/msm/dp: skip validity check for DP CTS EDID checksum
    - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
    - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
    - drm/amdgpu: Fix potential null pointer derefernce
    - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
    - ASoC: soc-card: Add storage for PCI SSID
    - crypto: pcrypt - Fix hungtask for PADATA_RESET
    - [amd64] RDMA/hfi1: Use FIELD_GET() to extract Link Width
    - fs/jfs: Add check for negative db_l2nbperpage
    - fs/jfs: Add validity check for db_maxag and db_agpref
    - jfs: fix array-index-out-of-bounds in dbFindLeaf
    - jfs: fix array-index-out-of-bounds in diAlloc
    - HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround
    - [armel,armhf] 9320/1: fix stack depot IRQ stack filter
    - ALSA: hda: Fix possible null-ptr-deref when assigning a stream
    - atm: iphase: Do PCI error checks on own line
    - scsi: libfc: Fix potential NULL pointer dereference in
      fc_lport_ptp_setup()
    - HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
    - exfat: support handle zero-size directory
    - usb: gadget: f_ncm: Always set current gadget in ncm_bind()
    - 9p/trans_fd: Annotate data-racy writes to file::f_flags
    - [armhf] i2c: sun6i-p2wi: Prevent potential division by zero
    - media: gspca: cpia1: shift-out-of-bounds in set_flicker
    - media: vivid: avoid integer overflow
    - gfs2: ignore negated quota changes
    - gfs2: fix an oops in gfs2_permission
    - media: imon: fix access to invalid resource for the second interface
    - drm/amd/display: Avoid NULL dereference of timing generator
    - [armhf] ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
    - drm/amdgpu: fix software pci_unplug on some chips
    - pwm: Fix double shift bug
    - wifi: iwlwifi: Use FW rate for non-data frames
    - xhci: turn cancelled td cleanup to its own function
    - SUNRPC: ECONNRESET might require a rebind
    - SUNRPC: Add an IS_ERR() check back to where it was
    - NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
    - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
    - gfs2: Silence "suspicious RCU usage in gfs2_permission" warning
    - ipvlan: add ipvlan_route_v6_outbound() helper
    - tty: Fix uninit-value access in ppp_sync_receive()
    - [arm64] net: hns3: fix variable may not initialized problem in
      hns3_init_mac_addr()
    - [arm64] net: hns3: fix VF reset fail issue
    - tipc: Fix kernel-infoleak due to uninitialized TLV value
    - ppp: limit MRU to 64K
    - xen/events: fix delayed eoi list handling
    - ptp: annotate data-race around q->head and q->tail
    - bonding: stop the device in bond_setup_by_slave()
    - netfilter: nf_conntrack_bridge: initialize err to 0
    - net: stmmac: fix rx budget limit check
    - net/mlx5e: fix double free of encap_header
    - net/mlx5_core: Clean driver version and name
    - net/mlx5e: Check return value of snprintf writing to fw_version buffer for
      representors
    - macvlan: Don't propagate promisc change to lower dev in passthru
    - cifs: spnego: add ';' in HOST_KEY_LEN
    - cifs: fix check of rc in function generate_smb3signingkey
    - [arm64] media: venus: hfi: add checks to perform sanity on queue pointers
    - [powerpc*] perf: Fix disabling BHRB and instruction sampling
    - bpf: Fix check_stack_write_fixed_off() to correctly spill imm
    - bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
    - scsi: mpt3sas: Fix loop logic
    - scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for
      selected registers
    - [x86] cpu/hygon: Fix the CPU topology evaluation for real
    - [x86] KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space
    - [x86] KVM: x86: Ignore MSR_AMD64_TW_CFG access
    - audit: don't take task_lock() in audit_exe_compare() code path
    - audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
    - tty/sysrq: replace smp_processor_id() with get_cpu()
    - hvc/xen: fix console unplug
    - hvc/xen: fix error path in xen_hvc_init() to always register frontend
      driver
    - PCI/sysfs: Protect driver's D3cold preference from user space
    - watchdog: move softlockup_panic back to early_param
    - ACPI: resource: Do IRQ override on TongFang GMxXGxx
    - [arm64] Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
    - mmc: vub300: fix an error code
    - mmc: sdhci_am654: fix start loop index for TAP value parsing
    - PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common()
    - [arm64] dts: qcom: ipq6018: Fix hwlock index for SMEM
    - PM: hibernate: Use __get_safe_page() rather than touching the list
    - PM: hibernate: Clean up sync_read handling in snapshot_write_next()
    - rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects
    - btrfs: don't arbitrarily slow down delalloc if we're committing
    - [arm64] firmware: qcom_scm: use 64-bit calling convention only when client
      is 64-bit
    - ima: detect changes to the backing overlay file
    - wifi: ath11k: fix temperature event locking
    - wifi: ath11k: fix dfs radar event locking
    - wifi: ath11k: fix htt pktlog locking
    - mmc: meson-gx: Remove setting of CMD_CFG_ERROR
    - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
    - jbd2: fix potential data lost in recovering journal raced with
      synchronizing fs bdev
    - quota: explicitly forbid quota files from being encrypted
    - kernel/reboot: emergency_restart: Set correct system_state
    - i2c: core: Run atomic i2c xfer when !preemptible
    - mcb: fix error handling for different scenarios when parsing
    - [armhf] dmaengine: stm32-mdma: correct desc prep when channel running
    - mm/cma: use nth_page() in place of direct struct page manipulation
    - mm/memory_hotplug: use pfn math in place of direct struct page
      manipulation
    - mtd: cfi_cmdset_0001: Byte swap OTP info
    - xhci: Enable RPM on controllers that support low-power states
    - ALSA: info: Fix potential deadlock at disconnection
    - ALSA: hda/realtek - Add Dell ALC295 to pin fall back table
    - ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
    - serial: meson: remove redundant initialization of variable id
    - tty: serial: meson: retrieve port FIFO size from DT
    - serial: meson: Use platform_get_irq() to get the interrupt
    - tty: serial: meson: fix hard LOCKUP on crtscts mode
    - cpufreq: stats: Fix buffer overflow detection in trans_stats()
    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559
    - bluetooth: Add device 0bda:887b to device tables
    - bluetooth: Add device 13d3:3571 to device tables
    - Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables
    - Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE
    - Revert ncsi: Propagate carrier gain/loss events to the NCSI controller
    - lsm: fix default return value for vm_enough_memory
    - lsm: fix default return value for inode_getsecctx
    - i2c: designware: Disable TX_EMPTY irq while waiting for block length byte
    - net: phylink: initialize carrier state at creation
    - i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
    - f2fs: avoid format-overflow warning
    - media: lirc: drop trailing space from scancode transmit
    - media: sharp: fix sharp encoding
    - [arm64] media: venus: hfi_parser: Add check to keep the number of codecs
      within range
    - [arm64] media: venus: hfi: fix the check to handle session buffer
      requirement
    - [arm64] media: venus: hfi: add checks to handle capabilities from firmware
    - nfsd: fix file memleak on client_opens_release
    - mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors
    - Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
    - ext4: apply umask if ACL support is disabled
    - ext4: correct offset of gdb backup in non meta_bg group to update_backups
    - ext4: correct return value of ext4_convert_meta_bg
    - ext4: correct the start block of counting reserved clusters
    - ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
    - drm/amd/pm: Handle non-terminated overdrive commands.
    - drm/amdgpu: fix error handling in amdgpu_bo_list_get()
    - drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox
    - io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
      (CVE-2023-46862)
    - tracing: Have trace_event_file have ref counters
    - netfilter: nftables: update table flags from the commit phase
    - netfilter: nf_tables: fix table flag updates
    - netfilter: nf_tables: disable toggling dormant table state more than once
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.203
    - RDMA/irdma: Prevent zero-length STAG registration (CVE-2023-25775)
    - afs: Fix afs_server_list to be cleaned up with RCU
    - afs: Make error on cell lookup failure consistent with OpenAFS
    - [arm64,armhf] drm/panel: simple: Fix Innolux G101ICE-L01 bus flags
    - [arm64,armhf] drm/panel: simple: Fix Innolux G101ICE-L01 timings
    - wireguard: use DEV_STATS_INC()
    - ata: pata_isapnp: Add missing error check for devm_ioport_map()
    - [arm64,armhf] drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP
      full
    - HID: core: store the unique system identifier in hid_device
    - HID: fix HID device resource race between HID core and debugging support
    - ipv4: Correct/silence an endian warning in __ip_do_redirect
    - net: usb: ax88179_178a: fix failed operations during ax88179_reset
    - net/smc: avoid data corruption caused by decline
    - [armhf] xen: fix xen_vcpu_info allocation alignment
    - [amd64,arm64] amd-xgbe: handle corner-case during sfp hotplug
    - [amd64,arm64] amd-xgbe: handle the corner-case during tx completion
    - [amd64,arm64] amd-xgbe: propagate the correct speed and duplex status
    - afs: Return ENOENT if no cell DNS record can be found
    - afs: Fix file locking on R/O volumes to operate in local mode
    - nvmet: remove unnecessary ctrl parameter
    - nvmet: nul-terminate the NQNs passed in the connect command
      (CVE-2023-6121)
    - [arm64] USB: dwc3: qcom: fix resource leaks on probe deferral
    - [arm64] USB: dwc3: qcom: fix ACPI platform device leak
    - lockdep: Fix block chain corruption
    - ext4: add a new helper to check if es must be kept
    - ext4: factor out __es_alloc_extent() and __es_free_extent()
    - ext4: use pre-allocated es in __es_insert_extent()
    - ext4: use pre-allocated es in __es_remove_extent()
    - ext4: using nofail preallocation in ext4_es_remove_extent()
    - ext4: using nofail preallocation in ext4_es_insert_delayed_block()
    - ext4: using nofail preallocation in ext4_es_insert_extent()
    - ext4: fix slab-use-after-free in ext4_es_insert_extent()
    - ext4: make sure allocate pending entry not fail
    - nfsd: lock_rename() needs both directories to live on the same fs
    - [arm*] ASoC: simple-card: fixup asoc_simple_probe() error handling
    - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA
    - swiotlb-xen: provide the "max_mapping_size" method
    - bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in
      btree_gc_coalesce()
    - bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race
    - [s390x] dasd: protect device queue against concurrent access
    - USB: serial: option: add Luat Air72*U series products
    - [x86] hv_netvsc: Fix race of register_netdevice_notifier and VF register
    - [x86] hv_netvsc: Mark VF as slave before exposing it to user-mode
    - dm-delay: fix a race between delay_presuspend and delay_bio
    - bcache: check return value from btree_node_alloc_replacement()
    - bcache: prevent potential division by zero error
    - bcache: fixup init dirty data errors
    - bcache: fixup lock c->root error
    - USB: serial: option: add Fibocom L7xx modules
    - USB: serial: option: fix FM101R-GL defines
    - USB: serial: option: don't claim interface 4 for ZTE MF290
    - [arm*] USB: dwc2: write HCINT with INTMASK applied
    - [arm64,armhf] usb: dwc3: Fix default mode initialization
    - [arm64,armhf] usb: dwc3: set the dma max_seg_size
    - [arm64,armhf] USB: dwc3: qcom: fix wakeup after probe deferral
    - io_uring: fix off-by one bvec index
    - pinctrl: avoid reload of p state in list iteration
    - firewire: core: fix possible memory leak in create_units()
    - mmc: block: Do not lose cache flush during CQE error recovery
    - ALSA: hda: Disable power-save on KONTRON SinglePC
    - ALSA: hda/realtek: Headset Mic VREF to 100%
    - ALSA: hda/realtek: Add supported ALC257 for ChromeOS
    - dm-verity: align struct dm_verity_fec_io properly
    - dm verity: don't perform FEC for failed readahead IO
    - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
    - [amd64] iommu/vt-d: Add MTL to quirk list to skip TE disabling
    - [powerpc*] Don't clobber f0/vs0 during fp|altivec register save
      (Closes: #1032104)
    - btrfs: add dmesg output for first mount and last unmount of a filesystem
    - btrfs: ref-verify: fix memory leaks in btrfs_ref_tree_mod()
    - btrfs: fix off-by-one when checking chunk map includes logical address
    - btrfs: send: ensure send_fd is writable
    - btrfs: make error messages more clear when getting a chunk map
    - Input: xpad - add HyperX Clutch Gladiate Support
    - [x86] hv_netvsc: fix race of netvsc and VF register_netdevice
    - USB: core: Change configuration warnings to notices
    - usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
    - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
      (CVE-2023-6932)
    - [arm64] dpaa2-eth: increase the needed headroom to account for alignment
    - net: stmmac: xgmac: Disable FPE MMC interrupts
    - Revert "workqueue: remove unused cancel_work()"
    - r8169: prevent potential deadlock in rtl8169_close
    - smb3: fix touch -h of symlink
    - [x86] ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
    - [x86] ASoC: SOF: sof-pci-dev: use community key on all Up boards
    - [x86] ASoC: SOF: sof-pci-dev: add parameter to override topology filename
    - [x86] ASoC: SOF: sof-pci-dev: don't use the community key on APL
      Chromebooks
    - [x86] ASoC: SOF: sof-pci-dev: Fix community key quirk detection
    - [s390x] mm: fix phys vs virt confusion in mark_kernel_pXd() functions
      family
    - [s390x] cmma: fix detection of DAT pages
    - ima: annotate iint mutex to avoid lockdep false positive warnings
    - driver core: Move the "removable" attribute from USB to core
    - drm/amdgpu: don't use ATRM for external devices
    - fs: add ctime accessors infrastructure
    - smb3: fix caching of ctime on setxattr
    - scsi: core: Introduce the scsi_cmd_to_rq() function
    - scsi: qla2xxx: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
    - scsi: qla2xxx: Fix system crash due to bad pointer access
    - [armhf] cpufreq: imx6q: don't warn for disabling a non-existing frequency
    - [armhf] cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
    - mmc: cqhci: Increase recovery halt timeout
    - mmc: cqhci: Warn of halt or task clear failure
    - mmc: cqhci: Fix task clearing in CQE error recovery
    - mmc: core: convert comma to semicolon
    - mmc: block: Retry commands in CQE error recovery
    - mmc: core: add helpers mmc_regulator_enable/disable_vqmmc
    - r8169: disable ASPM in case of tx timeout
    - r8169: fix deadlock on RTL8125 in jumbo mtu mode
    - driver core: Release all resources during unbind before updating device
      links
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.204
    - hrtimers: Push pending hrtimers away from outgoing CPU earlier
    - i2c: designware: Fix corrupted memory seen in the ISR
    - netfilter: ipset: fix race condition between swap/destroy and kernel side
      add/del/test
    - tg3: Move the [rt]x_dropped counters to tg3_napi
    - tg3: Increment tx_dropped in tg3_tso_bug()
    - kconfig: fix memory leak from range properties
    - drm/amdgpu: correct chunk_ptr to a pointer to chunk.
    - [x86] platform/x86: asus-wmi: Add support for SW_TABLET_MODE on UX360
    - [x86] platform/x86: asus-nb-wmi: Allow configuring SW_TABLET_MODE method
      with a module option
    - [x86] platform/x86: asus-nb-wmi: Add tablet_mode_sw=lid-flip quirk for the
      TP200s
    - [x86] asus-wmi: Add dgpu disable method
    - [x86] platform/x86: asus-wmi: Adjust tablet/lidflip handling to use enum
    - [x86] platform/x86: asus-wmi: Add support for ROG X13 tablet mode
    - [x86] platform/x86: asus-wmi: Simplify tablet-mode-switch probing
    - [x86] platform/x86: asus-wmi: Simplify tablet-mode-switch handling
    - [x86] platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi
      code
    - of: base: Fix some formatting issues and provide missing descriptions
    - of: Fix kerneldoc output formatting
    - of: Add missing 'Return' section in kerneldoc comments
    - of: dynamic: Fix of_reconfig_get_state_change() return value documentation
    - ipv6: fix potential NULL deref in fib6_add()
    - hv_netvsc: rndis_filter needs to select NLS
    - net: arcnet: com20020 fix error handling
    - arcnet: restoring support for multiple Sohard Arcnet cards
    - i40e: Fix unexpected MFS warning message
    - net: bnxt: fix a potential use-after-free in bnxt_init_tc
    - ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
    - [arm64] net: hns: fix fake link up on xge port
    - netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
    - tcp: do not accept ACK of bytes we never sent
    - bpf: sockmap, updating the sg structure should also update curr
    - [arm64] tee: optee: Fix supplicant based device enumeration
    - RDMA/bnxt_re: Correct module description string
    - [x86] hwmon: (acpi_power_meter) Fix 4.29 MW bug
    - tracing: Fix a warning when allocating buffered events fails
    - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle()
    - [armhf] imx: Check return value of devm_kasprintf in imx_mmdc_perf_init
    - ALSA: pcm: fix out-of-bounds in snd_pcm_state_names
    - ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
    - nilfs2: fix missing error check for sb_set_blocksize call
    - nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
    - checkstack: fix printed address
    - tracing: Always update snapshot buffer size
    - tracing: Disable snapshot buffer when stopping instance tracers
    - tracing: Fix incomplete locking when disabling buffered events
    - tracing: Fix a possible race when disabling buffered events
    - packet: Move reference count in packet_sock to atomic_long_t
    - [x86] misc: mei: client.c: return negative error code in mei_cl_write
    - [x86] misc: mei: client.c: fix problem of return '-EOVERFLOW' in
      mei_cl_write
    - ring-buffer: Force absolute timestamp on discard of event
    - tracing: Set actual size after ring buffer resize
    - tracing: Stop current tracer when resizing buffer
    - perf/core: Add a new read format to get a number of lost samples
    - perf: Fix perf_event_validate_size() (CVE-2023-6931)
    - gpiolib: sysfs: Fix error handling on failed export
    - drm/amdgpu: correct the amdgpu runtime dereference usage count
    - usb: gadget: f_hid: fix report descriptor allocation
    - parport: Add support for Brainboxes IX/UC/PX parallel cards
    - Revert "xhci: Loosen RPM as default policy to cover for AMD xHC 1.1"
    - usb: typec: class: fix typec_altmode_put_partner to put plugs
    - [arm*] PL011: Fix DMA support
    - [x86] CPU/AMD: Check vendor in the AMD microcode callback
    - [s390x] KVM: s390/mm: Properly reset no-dat
    - [mips*] Loongson64: Reserve vgabios memory on boot
    - [mips*] Loongson64: Enable DMA noncoherent support
    - io_uring/af_unix: disable sending io_uring over sockets (CVE-2023-6531)
    - netlink: don't call ->netlink_bind with table lock held
    - genetlink: add CAP_NET_ADMIN test for multicast bind
    - psample: Require 'CAP_NET_ADMIN' when joining "packets" group
    - drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group
    - netfilter: nft_set_pipapo: skip inactive elements during set walk
      (CVE-2023-6817)
    - [x86] platform/x86: asus-wmi: Fix kbd_dock_devid tablet-switch reporting
    - [x86] platform/x86: asus-wmi: Document the dgpu_disable sysfs attribute
    - mmc: block: Be sure to wait while busy in CQE error recovery
    - Revert "btrfs: add dmesg output for first mount and last unmount of a
      filesystem"
    - cifs: Fix non-availability of dedup breaking generic/304
    - smb: client: fix potential NULL deref in parse_dfs_referrals()
    - devcoredump : Serialize devcd_del work
    - devcoredump: Send uevent once devcd is ready
    - r8169: fix rtl8125b PAUSE frames blasting when suspended
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.205
    - netfilter: nf_tables: fix 'exist' matching on bigendian arches
    - afs: Fix refcount underflow from error handling race (Closes: #1052304)
    - HID: lenovo: Restrict detection of patched firmware only to USB cptkbd
    - net: ipv6: support reporting otherwise unknown prefix flags in
      RTM_NEWPREFIX
    - atm: solos-pci: Fix potential deadlock on &cli_queue_lock
    - atm: solos-pci: Fix potential deadlock on &tx_queue_lock
    - net: vlan: introduce skb_vlan_eth_hdr()
    - net: fec: correct queue selection
    - atm: Fix Use-After-Free in do_vcc_ioctl (CVE-2023-51780)
    - net/rose: Fix Use-After-Free in rose_ioctl (CVE-2023-51782)
    - qed: Fix a potential use-after-free in qed_cxt_tables_alloc
    - net: Remove acked SYN flag from packet in the transmit queue correctly
    - net: ena: Destroy correct number of xdp queues upon failure
    - net: ena: Fix XDP redirection error
    - sign-file: Fix incorrect return values check
    - vsock/virtio: Fix unsigned integer wrap around in
      virtio_transport_has_space()
    - net: stmmac: use dev_err_probe() for reporting mdio bus registration
      failure
    - net: stmmac: Handle disabled MDIO busses from devicetree
    - appletalk: Fix Use-After-Free in atalk_ioctl (CVE-2023-51781)
    - net: atlantic: fix double free in ring reinit logic
    - cred: switch to using atomic_long_t
    - fuse: dax: set fc->dax to NULL in fuse_dax_conn_free()
    - ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants
    - ALSA: hda/realtek: Apply mute LED quirk for HP15-db
    - Revert "PCI: acpiphp: Reassign resources on bridge if necessary"
    - PCI: loongson: Limit MRRS to 256 (Closes: #1035587)
    - usb: aqc111: check packet for fixup for true limit
    - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock
      required!"
    - bcache: avoid oversize memory allocation by small stripe_size
    - bcache: remove redundant assignment to variable cur_idx
    - bcache: add code comments for bch_btree_node_get() and
      __bch_btree_node_alloc()
    - bcache: avoid NULL checking to c->root in run_cache_set()
    - [x86] platform/x86: intel_telemetry: Fix kernel doc descriptions
    - HID: glorious: fix Glorious Model I HID report
    - HID: add ALWAYS_POLL quirk for Apple kb
    - HID: hid-asus: reset the backlight brightness level on resume
    - HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad
    - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation
    - net: usb: qmi_wwan: claim interface 4 for ZTE MF290
    - HID: hid-asus: add const to read-only outgoing usb buffer
    - perf: Fix perf_event_validate_size() lockdep splat
    - soundwire: stream: fix NULL pointer dereference for multi_link
    - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS
    - [arm64] mm: Always make sw-dirty PTEs hw-dirty in pte_modify
    - team: Fix use-after-free when an option instance allocation fails
    - ring-buffer: Fix memory leak of free page
    - tracing: Update snapshot buffer on resize if it is allocated
    - ring-buffer: Have saved event hold the entire event
    - ring-buffer: Fix writing to the buffer with max_data_size
    - ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs
    - USB: gadget: core: adjust uevent timing on gadget unbind
    - tty: n_gsm: fix tty registration before control channel open
    - tty: n_gsm, remove duplicates of parameters
    - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()
    - [powerpc*] ftrace: Create a dummy stackframe to fix stack unwind
    - [powerpc*] ftrace: Fix stack teardown in ftrace_no_trace

  [ Salvatore Bonaccorso ]
  * Bump ABI to 27
  * [rt] Refresh "net: Properly annotate the try-lock for the seqlock"
    Adapt to changes from upstream a8dd21118b0f ("seqlock: Prefix internal
    seqcount_t-only macros with a "do_"") in 5.10.198.
  * Refresh "arm64: compat: Implement misalignment fixups for multiword loads"
  * Do not enable DEBUG_PREEMPT (not enabled by default since 5.10.199)
  * [rt] Update to 5.10.201-rt98
  * [rt] Update to 5.10.204-rt100
  * [arm64] drivers/vfio: Don't enable VFIO_NOIOMMU.
    This is a breach of the integrity lockdown requirement of secure boot
    and thus cannot be enabled.
    Thanks to Bastian Blank and Ben Hutchings
  * netfilter: nf_tables: skip set commit for deleted/destroyed sets

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 30 Dec 2023 10:41:34 +0100

linux (5.10.197-1) bullseye; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.192
    - [arm64] mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
    - macsec: Fix traffic counters/statistics
    - macsec: use DEV_STATS_INC()
    - net/mlx5: Refactor init clock function
    - net/mlx5: Move all internal timer metadata into a dedicated struct
    - net/mlx5: Skip clock update work when device is in error state
    - drm/radeon: Fix integer overflow in radeon_cs_parser_init
    - ALSA: emu10k1: roll up loops in DSP setup code for Audigy
    - [x86] ASoC: Intel: sof_sdw: add quirk for MTL RVP
    - [x86] ASoC: Intel: sof_sdw: add quirk for LNL RVP
    - [armhf] dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related
      warnings
    - [x86] ASoC: Intel: sof_sdw: Add support for Rex soundwire
    - iopoll: Call cpu_relax() in busy loops
    - quota: Properly disable quotas when add_dquot_ref() fails
    - quota: fix warning in dqgrab()
    - dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
    - drm/amdgpu: install stub fence into potential unused fence pointers
    - HID: add quirk for 03f0:464a HP Elite Presenter Mouse
    - RDMA/mlx5: Return the firmware result upon destroying QP/RQ
    - ovl: check type and offset of struct vfsmount in ovl_entry
    - udf: Fix uninitialized array access for some pathnames
    - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
    - FS: JFS: Fix null-ptr-deref Read in txBegin
    - FS: JFS: Check for read-only mounted filesystem in txBegin
    - media: v4l2-mem2mem: add lock to protect parameter num_rdy
    - usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
    - [arm64,armhf] usb: chipidea: imx: don't request QoS for imx8ulp
    - [arm64,armhf] usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
    - gfs2: Fix possible data races in gfs2_show_options()
    - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
    - Bluetooth: L2CAP: Fix use-after-free
    - Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
    - drm/amdgpu: Fix potential fence use-after-free v2
    - ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
    - ALSA: hda: fix a possible null-pointer dereference due to data race in
      snd_hdac_regmap_sync()
    - ring-buffer: Do not swap cpu_buffer during resize process
    - bus: mhi: Add MHI PCI support for WWAN modems
    - bus: mhi: Add MMIO region length to controller structure
    - bus: mhi: Move host MHI code to "host" directory
    - bus: mhi: host: Range check CHDBOFF and ERDBOFF
    - [mips*] irqchip/mips-gic: Get rid of the reliance on irq_cpu_online()
    - [mips*] irqchip/mips-gic: Use raw spinlock for gic_lock
    - usb: gadget: udc: core: Introduce check_config to verify USB configuration
    - usb: cdns3: allocate TX FIFO size according to composite EP number
    - usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM
    - [arm64] USB: dwc3: qcom: fix NULL-deref on suspend
    - [arm*] mmc: bcm2835: fix deferred probing
    - [arm64,armhf] mmc: sunxi: fix deferred probing
    - mmc: core: add devm_mmc_alloc_host
    - [arm64] mmc: meson-gx: use devm_mmc_alloc_host
    - [arm64] mmc: meson-gx: fix deferred probing
    - tracing/probes: Have process_fetch_insn() take a void * instead of pt_regs
    - tracing/probes: Fix to update dynamic data counter if fetcharg uses it
    - virtio-mmio: Use to_virtio_mmio_device() to simply code
    - virtio-mmio: don't break lifecycle of vm_dev
    - i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
    - fbdev: mmp: fix value check in mmphw_probe()
    - [powerpc*] rtas_flash: allow user copy to flash block cache objects
    - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
    - tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32
      platforms
    - btrfs: fix BUG_ON condition in btrfs_cancel_balance
    - i2c: designware: Handle invalid SMBus block data response length value
    - net: xfrm: Fix xfrm_address_filter OOB read
    - net: af_key: fix sadb_x_filter validation
    - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
    - xfrm: fix slab-use-after-free in decode_session6
    - ip6_vti: fix slab-use-after-free in decode_session6
    - ip_vti: fix potential slab-use-after-free in decode_session6
    - xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-3772)
    - xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH (CVE-2023-3773)
    - selftests: mirror_gre_changes: Tighten up the TTL test match
    - ipvs: fix racy memcpy in proc_do_sync_threshold
    - netfilter: nft_dynset: disallow object maps
    - net: phy: broadcom: stub c45 read/write for 54810
    - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
    - i40e: fix misleading debug logs
    - net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
    - sock: Fix misuse of sk_under_memory_pressure()
    - net: do not allow gso_size to be set to GSO_BY_FRAGS
    - bus: ti-sysc: Flush posted write on enable before reset
    - ALSA: hda/realtek - Remodified 3k pull low procedure
    - serial: 8250: Fix oops for port->pm on uart_change_pm()
    - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback
      interfaces.
    - cifs: Release folio lock on fscache read hit.
    - mmc: wbsd: fix double mmc_free_host() in wbsd_init()
    - mmc: block: Fix in_flight[issue_type] value error
    - netfilter: set default timeout to 3 secs for sctp shutdown send and recv
      state
    - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-4622)
    - virtio-net: set queues after driver_ok
    - net: fix the RTO timer retransmitting skb every 1ms if linear option is
      enabled
    - [arm64] mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
    - [x86] cpu: Fix __x86_return_thunk symbol type
    - [x86] cpu: Fix up srso_safe_ret() and __x86_return_thunk()
    - [x86] alternative: Make custom return thunk unconditional
    - objtool: Add frame-pointer-specific function ignore
    - [x86] ibt: Add ANNOTATE_NOENDBR
    - [x86] cpu: Clean up SRSO return thunk mess
    - [x86] cpu: Rename original retbleed methods
    - [x86] cpu: Rename srso_(.*)_alias to srso_alias_\1
    - [x86] cpu: Cleanup the untrain mess
    - [x86] srso: Explain the untraining sequences a bit more
    - [x86] static_call: Fix __static_call_fixup()
    - [x86] retpoline: Don't clobber RFLAGS during srso_safe_ret()
    - [x86] CPU/AMD: Fix the DIV(0) initial fix attempt (CVE-2023-20588)
    - [x86] srso: Disable the mitigation on unaffected configurations
    - [x86] retpoline,kprobes: Fix position of thunk sections with
      CONFIG_LTO_CLANG
    - [x86] objtool/x86: Fixup frame-pointer vs rethunk
    - [x86] srso: Correct the mitigation status when SMT is disabled
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.193
    - [x86] objtool/x86: Fix SRSO mess
    - NFSv4: fix out path in __nfs4_get_acl_uncached
    - xprtrdma: Remap Receive buffers after a reconnect
    - PCI: acpiphp: Reassign resources on bridge if necessary
    - dlm: improve plock logging if interrupted
    - dlm: replace usage of found with dedicated list iterator variable
    - fs: dlm: add pid to debug log
    - fs: dlm: change plock interrupted message to debug again
    - fs: dlm: use dlm_plock_info for do_unlock_close
    - fs: dlm: fix mismatch of plock results from userspace
    - [mips*] cpu-features: Enable octeon_cache by cpu_type
    - [mips*] cpu-features: Use boot_cpu_type for CPU type based features
    - fbdev: Improve performance of sys_imageblit()
    - fbdev: Fix sys_imageblit() for arbitrary image widths
    - fbdev: fix potential OOB read in fast_imageblit()
    - dm integrity: increase RECALC_SECTORS to improve recalculate speed
    - dm integrity: reduce vmalloc space footprint on 32-bit architectures
    - ALSA: pcm: Fix potential data race at PCM memory allocation helpers
    - drm/amd/display: do not wait for mpc idle if tg is disabled
    - drm/amd/display: check TG is non-null before checking if enabled
    - libceph, rbd: ignore addr->type while comparing in some cases
    - rbd: make get_lock_owner_info() return a single locker or NULL
    - rbd: retrieve and check lock owner twice before blocklisting
    - rbd: prevent busy loop when requesting exclusive lock
    - tracing: Fix cpu buffers unavailable due to 'record_disabled' missed
    - tracing: Fix memleak due to race between current_tracer and trace
    - sock: annotate data-races around prot->memory_pressure
    - dccp: annotate data-races in dccp_poll()
    - ipvlan: Fix a reference count leak warning in ipvlan_ns_exit()
    - [arm64] net: bcmgenet: Fix return value check for fixed_phy_register()
    - net: validate veth and vxcan peer ifindexes
    - ice: fix receive buffer size miscalculation
    - igb: Avoid starting unnecessary workqueues
    - net/sched: fix a qdisc modification with ambiguous command request
    - netfilter: nf_tables: fix out of memory error handling
    - rtnetlink: return ENODEV when ifname does not exist and group is given
    - rtnetlink: Reject negative ifindexes in RTM_NEWLINK
    - net: remove bond_slave_has_mac_rcu()
    - bonding: fix macvlan over alb bond support
    - [powerpc*] ibmveth: Use dcbf rather than dcbfl
    - NFSv4: Fix dropped lock for racing OPEN and delegation return
    - clk: Fix slab-out-of-bounds error in devm_clk_release()
    - mm: add a call to flush_cache_vmap() in vmap_pfn()
    - NFS: Fix a use after free in nfs_direct_join_group()
    - nfsd: Fix race to FREE_STATEID and cl_revoked
    - selinux: set next pointer before attaching to list
    - batman-adv: Trigger events for auto adjusted MTU
    - batman-adv: Don't increase MTU when set by user
    - batman-adv: Do not get eth header before batadv_check_management_packet
    - batman-adv: Fix TT global entry leak when client roamed back
    - batman-adv: Fix batadv_v_ogm_aggr_send memory leak
    - batman-adv: Hold rtnl lock during MTU update via netlink
    - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
    - [powerpc*] of: dynamic: Refactor action prints to not use "%pOF" inside
      devtree_lock
    - PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for
      non-root bus
    - [x86] drm/vmwgfx: Fix shader stage validation
    - drm/display/dp: Fix the DP DSC Receiver cap size
    - [x86] fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4
      (Closes: #1050622)
    - torture: Fix hang during kthread shutdown phase
    - tick: Detect and fix jiffies update stall
    - timers/nohz: Switch to ONESHOT_STOPPED in the low-res handler when the
      tick is stopped
    - cgroup/cpuset: Rename functions dealing with DEADLINE accounting
    - sched/cpuset: Bring back cpuset_mutex
    - sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets
    - cgroup/cpuset: Iterate only if DEADLINE tasks are present
    - sched/deadline: Create DL BW alloc, free & check overflow interface
    - cgroup/cpuset: Free DL BW in case can_attach() fails
    - [x86] drm/i915: Fix premature release of request's reusable memory
    - ASoC: rt711: add two jack detection modes
    - scsi: snic: Fix double free in snic_tgt_create()
    - scsi: core: raid_class: Remove raid_component_add()
    - mm,hwpoison: refactor get_any_page
    - mm: fix page reference leak in soft_offline_page()
    - mm: memory-failure: kill soft_offline_free_page()
    - mm: memory-failure: fix unexpected return value in soft_offline_page()
    - [x86] ASoC: Intel: sof_sdw: include rt711.h for RT711 JD mode
    - mm,hwpoison: fix printing of page flags
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.194
    - module: Expose module_init_layout_section()
    - [arm64] module-plts: inline linux/moduleloader.h
    - [arm64] module: Use module_init_layout_section() to spot init sections
    - [armel,armhf] module: Use module_init_layout_section() to spot init
      sections
    - mhi: pci_generic: Fix implicit conversion warning
    - Revert "drm/amdgpu: install stub fence into potential unused fence
      pointers"
    - rcu: Prevent expedited GP from enabling tick on offline CPU
    - rcu-tasks: Fix IPI failure handling in trc_wait_for_one_reader
    - rcu-tasks: Wait for trc_read_check_handler() IPIs
    - rcu-tasks: Add trc_inspect_reader() checks for exiting critical section
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.195
    - erofs: ensure that the post-EOF tails are all zeroed
    - mmc: au1xmmc: force non-modular build and remove symbol_get usage
    - net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
    - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
    - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
    - USB: serial: option: add Quectel EM05G variant (0x030e)
    - USB: serial: option: add FOXCONN T99W368/T99W373 product
    - [arm64,armhf] usb: dwc3: meson-g12a: do post init to fix broken usb after
      resumption
    - [arm64,armhf] usb: chipidea: imx: improve logic if samsung,picophy-*
      parameter is 0
    - HID: wacom: remove the battery when the EKR is off
    - staging: rtl8712: fix race condition
    - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race
      condition (CVE-2023-1989)
    - configfs: fix a race in configfs_lookup()
    - serial: qcom-geni: fix opp vote on shutdown
    - serial: sc16is7xx: fix broken port 0 uart init
    - serial: sc16is7xx: fix bug when first setting GPIO direction
    - firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
    - fsi: master-ast-cf: Add MODULE_FIRMWARE macro
    - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
    - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
    - pinctrl: amd: Don't show `Invalid config param` errors
    - ASoC: rt5682: Fix a problem with error handling in the io init function of
      the soundwire
    - phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code
    - media: pulse8-cec: handle possible ping error
    - media: pci: cx23885: fix error handling for cx23885 ATSC boards
    - 9p: virtio: make sure 'offs' is initialized in zc_request
    - ASoC: da7219: Flush pending AAD IRQ when suspending
    - ASoC: da7219: Check for failure reading AAD IRQ events
    - ethernet: atheros: fix return value check in atl1c_tso_csum()
    - vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
    - [s390x] dasd: use correct number of retries for ERP requests
    - [s390x] dasd: fix hanging device after request requeue
    - fs/nls: make load_nls() take a const parameter
    - ASoc: codecs: ES8316: Fix DMIC config
    - [x86] platform/x86: intel: hid: Always call BTNL ACPI method
    - [x86] platform/x86: huawei-wmi: Silence ambient light sensor
    - drm/amd/display: Exit idle optimizations before attempt to access PHY
    - ovl: Always reevaluate the file signature for IMA
    - ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer()
    - security: keys: perform capable check only on privileged operations
    - kprobes: Prohibit probing on CFI preamble symbol
    - clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM
    - net: usb: qmi_wwan: add Quectel EM05GV2
    - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
    - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
    - netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
    - bnx2x: fix page fault following EEH recovery
    - sctp: handle invalid error codes without calling BUG()
    - scsi: storvsc: Always set no_report_opcodes
    - ALSA: seq: oss: Fix racy open/close of MIDI devices
    - tracing: Introduce pipe_cpumask to avoid race on trace_pipes
    - net: Avoid address overwrite in kernel_connect
    - udf: Check consistency of Space Bitmap Descriptor
    - udf: Handle error when adding extent to a file
    - Revert "net: macsec: preserve ingress frame ordering"
    - reiserfs: Check the return value from __getblk()
    - eventfd: Export eventfd_ctx_do_read()
    - eventfd: prevent underflow for eventfd semaphores
    - fs: Fix error checking for d_hash_and_lookup()
    - tmpfs: verify {g,u}id mount options correctly
    - refscale: Fix uninitalized use of wait_queue_head_t
    - OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd()
    - [x86] decompressor: Don't rely on upper 32 bits of GPRs being preserved
    - perf/imx_ddr: don't enable counter0 if none of 4 counters are used
    - [s390x] pkey: fix/harmonize internal keyblob headers
    - [s390x] paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs
    - [x86] efistub: Fix PCI ROM preservation in mixed mode
    - [x86] cpufreq: powernow-k8: Use related_cpus instead of cpus in
      driver.exit()
    - bpftool: Use a local bpf_perf_event_value to fix accessing its fields
    - bpf: Clear the probe_addr for uprobe
    - tcp: tcp_enter_quickack_mode() should be static
    - regmap: rbtree: Use alloc_flags for memory allocations
    - udp: re-score reuseport groups when connected sockets are present
    - bpf: reject unhashed sockets in bpf_sk_assign
    - [arm64,armhf] spi: tegra20-sflash: fix to check return value of
      platform_get_irq() in tegra_sflash_probe()
    - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also
      in case of OOM
    - wifi: mwifiex: Fix OOB and integer underflow when rx packets
    - wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
    - [armhf] crypto: stm32 - Properly handle pm_runtime_get failing
    - crypto: api - Use work queue in crypto_destroy_instance
    - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
    - Bluetooth: Fix potential use-after-free when clear keys
    - net: tcp: fix unexcepted socket die when snd_wnd is 0
    - ice: ice_aq_check_events: fix off-by-one check when filling buffer
    - [arm64] crypto: caam - fix unchecked return value error
    - hwrng: iproc-rng200 - Implement suspend and resume calls
    - lwt: Fix return values of BPF xmit ops
    - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
    - fs: ocfs2: namei: check return value of ocfs2_add_entry()
    - wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
    - wifi: mwifiex: Fix missed return in oob checks failed path
    - samples/bpf: fix broken map lookup probe
    - wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
    - wifi: ath9k: protect WMI command response buffer replacement with a lock
    - wifi: mwifiex: avoid possible NULL skb pointer dereference
    - Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave()
    - wifi: ath9k: use IS_ERR() with debugfs_create_dir()
    - net: arcnet: Do not call kfree_skb() under local_irq_disable()
    - mlxsw: i2c: Fix chunk size setting in output mailbox buffer
    - mlxsw: i2c: Limit single transaction buffer size
    - hwmon: (tmp513) Fix the channel number in tmp51x_is_visible()
    - net/sched: sch_hfsc: Ensure inner classes have fsc curve (CVE-2023-4623)
    - netrom: Deny concurrent connect().
    - drm/bridge: tc358764: Fix debug print parameter order
    - quota: factor out dquot_write_dquot()
    - quota: rename dquot_active() to inode_quota_active()
    - quota: add new helper dquot_active()
    - quota: fix dqput() to follow the guarantees dquot_srcu should provide
    - ASoC: stac9766: fix build errors with REGMAP_AC97
    - [arm64] dts: qcom: msm8996: Add missing interrupt to the USB2 controller
    - drm/amdgpu: avoid integer overflow warning in
      amdgpu_device_resize_fb_bar()
    - [armel,armhf] dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name
    - [armel,armhf] dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
    - [armel,armhf] dts: BCM53573: Drop nonexistent #usb-cells
    - [armel,armhf] dts: BCM53573: Add cells sizes to PCIe node
    - [armel,armhf] dts: BCM53573: Use updated "spi-gpio" binding properties
    - [armhf] drm/etnaviv: fix dumping of active MMU context
    - [x86] mm: Fix PAT bit missing from page protection modify mask
    - [armel,armhf] dts: s3c64xx: align pinctrl with dtschema
    - [armel,armhf] dts: samsung: s3c6410-mini6410: correct ethernet reg
      addresses (split)
    - [armel,armhf] dts: s5pv210: adjust node names to DT spec
    - [armel,armhf] dts: s5pv210: add dummy 5V regulator for backlight on
      SMDKv210
    - [armel,armhf] dts: samsung: s5pv210-smdkv210: correct ethernet reg
      addresses (split)
    - drm: adv7511: Fix low refresh rate register for ADV7533/5
    - [armel,armhf] dts: BCM53573: Fix Ethernet info for Luxul devices
    - [arm64] dts: qcom: sdm845: Add missing RPMh power domain to GCC
    - [arm64] dts: qcom: sdm845: Fix the min frequency of "ice_core_clk"
    - drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl'
    - md/bitmap: don't set max_write_behind if there is no write mostly device
    - md/md-bitmap: hold 'reconfig_mutex' in backlog_store()
    - [arm64,armhf] drm/tegra: Remove superfluous error messages around
      platform_get_irq()
    - [arm64,armhf] drm/tegra: dpaux: Fix incorrect return value of
      platform_get_irq
    - of: unittest: fix null pointer dereferencing in
      of_unittest_find_node_by_name()
    - [arm64,armhf] drm/armada: Fix off-by-one error in
      armada_overlay_get_property()
    - drm/panel: simple: Add missing connector type and pixel format for AUO
      T215HVN01
    - ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig
    - drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask
    - [arm64] drm/msm/mdp5: Don't leak some plane state
    - firmware: meson_sm: fix to avoid potential NULL pointer dereference
    - smackfs: Prevent underflow in smk_set_cipso()
    - drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create()
    - [arm64] drm/msm/a2xx: Call adreno_gpu_init() earlier
    - audit: fix possible soft lockup in __audit_inode_child()
    - bus: ti-sysc: Fix build warning for 64-bit build
    - bus: ti-sysc: Fix cast to enum warning
    - of: unittest: Fix overlay type in apply/revert check
    - ALSA: ac97: Fix possible error value of *rac97
    - ipmi:ssif: Add check for kstrdup
    - ipmi:ssif: Fix a memory leak when scanning for an adapter
    - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
    - clk: sunxi-ng: Modify mismatched function name
    - clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents
    - clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src
    - ext4: correct grp validation in ext4_mb_good_group
    - clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents
    - clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src
    - clk: qcom: reset: Use the correct type of sleep/delay based on length
    - PCI: Mark NVIDIA T4 GPUs to avoid bus reset
    - pinctrl: mcp23s08: check return value of devm_kasprintf()
    - PCI: pciehp: Use RMW accessors for changing LNKCTL
    - PCI/ASPM: Use RMW accessors for changing LNKCTL
    - clk: imx8mp: fix sai4 clock
    - clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op
    - vfio/type1: fix cap_migration information leak
    - [powerpc*] fadump: reset dump area size if fadump memory reserve fails
    - [powerpc*] perf: Convert fsl_emb notifier to state machine callbacks
    - drm/amdgpu: Use RMW accessors for changing LNKCTL
    - drm/radeon: Use RMW accessors for changing LNKCTL
    - net/mlx5: Use RMW accessors for changing LNKCTL
    - wifi: ath10k: Use RMW accessors for changing LNKCTL
    - [powerpc*] pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
    - nfs/blocklayout: Use the passed in gfp flags
    - [powerpc*] iommu: Fix notifiers being shared by PCI and VIO buses
    - jfs: validate max amount of blocks before allocation.
    - fs: lockd: avoid possible wrong NULL parameter
    - NFSD: da_addr_body field missing in some GETDEVICEINFO replies
    - NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN
    - NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ
    - media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables
    - media: i2c: tvp5150: check return value of devm_kasprintf()
    - media: v4l2-core: Fix a potential resource leak in
      v4l2_fwnode_parse_link()
    - drivers: usb: smsusb: fix error handling code in smsusb_init_device
    - media: dib7000p: Fix potential division by zero
    - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
    - media: cx24120: Add retval check for cx24120_message_send()
    - [arm64] scsi: hisi_sas: Print SAS address for v3 hw erroneous completion
      print
    - scsi: libsas: Introduce more SAM status code aliases in enum exec_status
    - [arm64] scsi: hisi_sas: Modify v3 HW SSP underflow error processing
    - [arm64] scsi: hisi_sas: Modify v3 HW SATA completion error processing
    - [arm64] scsi: hisi_sas: Fix warnings detected by sparse
    - [arm64] scsi: hisi_sas: Fix normally completed I/O analysed as failed
    - media: rkvdec: increase max supported height for H.264
    - media: mediatek: vcodec: Return NULL if no vdec_fb is found
    - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
    - scsi: RDMA/srp: Fix residual handling
    - scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param()
    - scsi: iscsi: Add length check for nlattr payload
    - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
    - scsi: be2iscsi: Add length check when parsing nlattrs
    - scsi: qla4xxx: Add length check when parsing nlattrs
    - serial: sprd: Assign sprd_port after initialized to avoid wrong access
    - serial: sprd: Fix DMA buffer leak issue
    - [x86] APM: drop the duplicate APM_MINOR_DEV macro
    - scsi: qedf: Do not touch __user pointer in
      qedf_dbg_stop_io_on_error_cmd_read() directly
    - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read()
      directly
    - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read()
      directly
    - coresight: tmc: Explicit type conversions to prevent integer overflow
    - dma-buf/sync_file: Fix docs syntax
    - driver core: test_async: fix an error code
    - IB/uverbs: Fix an potential error pointer dereference
    - fsi: aspeed: Reset master errors after CFAM reset
    - iommu/qcom: Disable and reset context bank before programming
    - [amd64] iommu/vt-d: Fix to flush cache of PASID directory table
    - media: go7007: Remove redundant if statement
    - USB: gadget: f_mass_storage: Fix unused variable warning
    - media: ov5640: Enable MIPI interface in ov5640_set_power_mipi()
    - media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
    - media: ov2680: Remove auto-gain and auto-exposure controls
    - media: ov2680: Fix ov2680_bayer_order()
    - media: ov2680: Fix vflip / hflip set functions
    - media: ov2680: Fix regulators being left enabled on ov2680_power_on()
      errors
    - cgroup:namespace: Remove unused cgroup_namespaces_init()
    - scsi: core: Use 32-bit hostnum in scsi_host_lookup()
    - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
    - serial: tegra: handle clk prepare error in tegra_uart_hw_init()
    - [arm*] amba: bus: fix refcount leak
    - Revert "IB/isert: Fix incorrect release of isert connection"
    - RDMA/siw: Balance the reference of cep->kref in the error path
    - RDMA/siw: Correct wrong debug message
    - HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()
    - HID: multitouch: Correct devm device reference for hidinput input_dev name
    - [x86] speculation: Mark all Skylake CPUs as vulnerable to GDS
    - tracing: Fix race issue between cpu buffer write and swap
    - mtd: rawnand: brcmnand: Fix mtd oobsize
    - [arm64,armhf] phy/rockchip: inno-hdmi: use correct vco_div_5 macro on
      rk3328
    - [arm64,armhf] phy/rockchip: inno-hdmi: round fractal pixclock in rk3328
      recalc_rate
    - [arm64,armhf] phy/rockchip: inno-hdmi: do not power on rk3328 post pll on
      reg write
    - rpmsg: glink: Add check for kstrdup
    - mtd: spi-nor: Check bus width while setting QE bit
    - mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume()
    - um: Fix hostaudio build errors
    - dmaengine: ste_dma40: Add missing IRQ check in d40_probe
    - cpufreq: Fix the race condition while updating the transition_task of
      policy
    - virtio_ring: fix avail_wrap_counter in virtqueue_add_packed
    - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
    - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for
      ip_set_hash_netportnet.c (CVE-2023-42753)
    - netfilter: xt_u32: validate user space input
    - netfilter: xt_sctp: validate the flag_info count
    - skbuff: skb_segment, Call zero copy functions before using skbuff frags
    - igb: set max size RX buffer when store bad packet is enabled
    - PM / devfreq: Fix leak in devfreq_dev_release()
    - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
    - printk: ringbuffer: Fix truncating buffer size min_t cast
    - scsi: core: Fix the scsi_set_resid() documentation
    - ipmi_si: fix a memleak in try_smi_init()
    - [armhf] OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
    - backlight/gpio_backlight: Compare against struct fb_info.device
    - backlight/bd6107: Compare against struct fb_info.device
    - backlight/lv5207lp: Compare against struct fb_info.device
    - [arm64] csum: Fix OoB access in IP checksum code for negative lengths
    - media: dvb: symbol fixup for dvb_attach()
    - Revert "scsi: qla2xxx: Fix buffer overrun"
    - scsi: mpt3sas: Perform additional retries if doorbell read returns 0
    - ntb: Drop packets when qp link is down
    - ntb: Clean up tx tail index on link down
    - ntb: Fix calculation ntb_transport_tx_free_entry()
    - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
    - procfs: block chmod on /proc/thread-self/comm
    - dlm: fix plock lookup when using multiple lockspaces
    - dccp: Fix out of bounds access in DCCP error handler
    - X.509: if signature is unsupported skip validation
    - net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
    - fsverity: skip PKCS#7 parser when keyring is empty
    - pstore/ram: Check start of empty przs during init
    - [s390x] ipl: add missing secure/has_secure file to ipl type 'unknown'
    - [armhf] crypto: stm32 - fix loop iterating through scatterlist for DMA
    - cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
    - usb: typec: bus: verify partner exists in typec_altmode_attention
    - USB: core: Unite old scheme and new scheme descriptor reads
    - USB: core: Change usb_get_device_descriptor() API
    - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
    - USB: core: Fix oversight in SuperSpeed initialization
    - usb: typec: tcpci: clear the fault status bit
    - tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY
    - md/md-bitmap: remove unnecessary local variable in backlog_store()
    - udf: initialize newblock to 0
    - net/ipv6: SKB symmetric hash should incorporate transport ports
    - io_uring: always lock in io_apoll_task_func
    - io_uring: break out of iowq iopoll on teardown
    - io_uring: break iopolling on signal
    - scsi: qla2xxx: Fix deletion race condition
    - scsi: qla2xxx: fix inconsistent TMF timeout
    - scsi: qla2xxx: Fix erroneous link up failure
    - scsi: qla2xxx: Turn off noisy message log
    - scsi: qla2xxx: Remove unsupported ql2xenabledif option
    - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
    - drm/ast: Fix DRAM init on AST2200
    - pinctrl: cherryview: fix address_space_handler() argument
    - dt-bindings: clock: xlnx,versal-clk: drop select:false
    - clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz
    - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
    - soc: qcom: qmi_encdec: Restrict string length in decode
    - NFS: Fix a potential data corruption
    - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
    - backlight: gpio_backlight: Drop output GPIO direction check for initial
      power state
    - perf annotate bpf: Don't enclose non-debug code with an assert()
    - [x86] virt: Drop unnecessary check on extended CPUID level in
      cpu_has_svm()
    - perf top: Don't pass an ERR_PTR() directly to perf_session__delete()
    - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
    - pwm: lpc32xx: Remove handling of PWM channels
    - net/sched: fq_pie: avoid stalls in fq_pie_timer()
    - sctp: annotate data-races around sk->sk_wmem_queued
    - ipv4: annotate data-races around fi->fib_dead
    - net: read sk->sk_family once in sk_mc_loop()
    - [x86] drm/i915/gvt: Save/restore HW status to support GVT suspend/resume
    - [x86] drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt()
    - ipv4: ignore dst hint for multipath routes
    - igb: disable virtualization features on 82580
    - veth: Fixing transmit return status for dropped packets
    - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
    - af_unix: Fix data-races around user->unix_inflight.
    - af_unix: Fix data-race around unix_tot_inflight.
    - af_unix: Fix data-races around sk->sk_shutdown.
    - af_unix: Fix data race around sk->sk_err.
    - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (CVE-2023-4921)
    - kcm: Destroy mutex in kcm_exit_net()
    - igc: Change IGC_MIN to allow set rx/tx value between 64 and 80
    - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
    - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
    - [s390x] zcrypt: don't leak memory if dev_set_name() fails
    - idr: fix param name in idr_alloc_cyclic() doc
    - ip_tunnels: use DEV_STATS_INC()
    - netfilter: nfnetlink_osf: avoid OOB read
    - [arm64] net: hns3: fix the port information display when sfp is absent
    - sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()
    - ext4: add correct group descriptors and reserved GDT blocks to system zone
    - ata: sata_gemini: Add missing MODULE_DESCRIPTION
    - ata: pata_ftide010: Add missing MODULE_DESCRIPTION
    - fuse: nlookup missing decrement in fuse_direntplus_link
    - btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART
    - btrfs: use the correct superblock to compare fsid in btrfs_validate_super
    - mtd: rawnand: brcmnand: Fix crash during the panic_write
    - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
    - mtd: rawnand: brcmnand: Fix potential false time out warning
    - drm/amd/display: prevent potential division by zero errors
    - perf hists browser: Fix hierarchy mode header
    - perf tools: Handle old data in PERF_RECORD_ATTR
    - perf hists browser: Fix the number of entries for 'e' key
    - ACPI: APEI: explicit init of HEST and GHES in apci_init()
    - [arm64] sdei: abort running SDEI handlers during crash
    - scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry
    - scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe
    - scsi: qla2xxx: Fix crash in PCIe error handling
    - scsi: qla2xxx: Flush mailbox commands on chip reset
    - [armhf] dts: samsung: exynos4210-i9100: Fix LCD screen's physical size
    - net: ipv4: fix one memleak in __inet_del_ifa()
    - net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in
      smcr_port_add
    - net: ethernet: mvpp2_main: fix possible OOB write in
      mvpp2_ethtool_get_rxnfc()
    - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in
      mtk_hwlro_get_fdir_all()
    - hsr: Fix uninit-value access in fill_frame_info()
    - r8152: check budget for r8152_poll()
    - kcm: Fix memory leak in error path of kcm_sendmsg()
    - ipv6: fix ip6_sock_set_addr_preferences() typo
    - ixgbe: fix timestamp configuration code
    - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
    - drm/amd/display: Fix a bug when searching for insert_above_mpcc
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.196
    - Revert "configfs: fix a race in configfs_lookup()"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.197
    - autofs: fix memory leak of waitqueues in autofs_catatonic_mode
    - btrfs: output extra debug info if we failed to find an inline backref
    - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
    - kernel/fork: beware of __put_task_struct() calling context
    - rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to
      _idle()
    - [x86] ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470
    - [arm64] perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09
    - [x86] ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and
      iMac12,2
    - hw_breakpoint: fix single-stepping when using bpf_overflow_handler
    - devlink: remove reload failed checks in params get/set callbacks
    - crypto: lrw,xts - Replace strlcpy with strscpy
    - wifi: ath9k: fix fortify warnings
    - wifi: ath9k: fix printk specifier
    - wifi: mwifiex: fix fortify warning
    - wifi: wil6210: fix fortify warnings
    - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
    - tpm_tis: Resend command to recover from data transfer errors
    - [arm64,armhf] mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450
    - alx: fix OOB-read compiler warning
    - netfilter: ebtables: fix fortify warnings in size_entry_mwt()
    - wifi: mac80211_hwsim: drop short frames
    - ALSA: hda: intel-dsp-cfg: add LunarLake support
    - [armhf] drm/exynos: fix a possible null-pointer dereference due to data
      race in exynos_drm_crtc_atomic_disable()
    - [armhf] bus: ti-sysc: Configure uart quirks for k3 SoC
    - md: raid1: fix potential OOB in raid1_remove_disk()
    - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
    - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
    - [powerpc*] pseries: fix possible memory leak in ibmebus_bus_init()
    - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
    - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
    - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
    - media: anysee: fix null-ptr-deref in anysee_master_xfer
    - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
    - media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
    - media: tuners: qt1010: replace BUG_ON with a regular error
    - media: pci: cx23885: replace BUG with error return
    - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
    - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
    - serial: cpm_uart: Avoid suspicious locking
    - media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler
      warning
    - kobject: Add sanity check for kset->kobj.ktype in kset_register()
    - perf jevents: Make build dependency on test JSONs
    - perf tools: Add an option to build without libbfd
    - btrfs: move btrfs_pinned_by_swapfile prototype into volumes.h
    - btrfs: add a helper to read the superblock metadata_uuid
    - btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super
    - scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir()
    - scsi: lpfc: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
    - [x86] boot/compressed: Reserve more memory for page tables
    - md/raid1: fix error: ISO C90 forbids mixed declarations
    - attr: block mode changes of symlinks
    - ovl: fix incorrect fdput() on aio completion
    - btrfs: fix lockdep splat and potential deadlock after failure running
      delayed items
    - btrfs: release path before inode lookup during the ino lookup ioctl
    - drm/amdgpu: fix amdgpu_cs_p1_user_fence
    - net/sched: Retire rsvp classifier (CVE-2023-42755)
    - proc: fix a dentry lock race between release_task and lookup
    - mm/filemap: fix infinite loop in generic_file_buffered_read()
    - drm/amd/display: enable cursor degamma for DCN3+ DRM legacy gamma
    - tracing: Have current_trace inc the trace array ref count
    - tracing: Have option files inc the trace array ref count
    - nfsd: fix change_info in NFSv4 RENAME replies
    - tracefs: Add missing lockdown check to tracefs_create_dir()
    - [armhf] i2c: aspeed: Reset the i2c controller when timeout occurs
    - ata: libata: disallow dev-initiated LPM transitions to unsupported states
    - scsi: megaraid_sas: Fix deadlock on firmware crashdump
    - scsi: pm8001: Setup IRQs on resume
    - ext4: fix rec_len verify error

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "cpuset: Convert callback_lock to raw_spinlock_t"
  * Bump ABI to 26
  * [rt] Refresh "eventfd: Make signal recursion protection a task bit"
  * Drop now unknown config options for IPv4 and IPv6 Resource Reservation
    Protocol (RSVP, RSVP6)
  * netfilter: nf_tables: integrate pipapo into commit protocol
  * netfilter: nf_tables: don't skip expired elements during walk
    (CVE-2023-4244)
  * netfilter: nf_tables: GC transaction API to avoid race with control plane
    (CVE-2023-4244)
  * netfilter: nf_tables: adapt set backend to use GC transaction API
    (CVE-2023-4244)
  * netfilter: nft_set_hash: mark set element as dead when deleting from packet
    path (CVE-2023-4244)
  * netfilter: nf_tables: remove busy mark and gc batch API (CVE-2023-4244)
  * netfilter: nf_tables: don't fail inserts if duplicate has expired
  * netfilter: nf_tables: fix GC transaction races with netns and netlink event
    exit path (CVE-2023-4244)
  * netfilter: nf_tables: GC transaction race with netns dismantle
    (CVE-2023-4244)
  * netfilter: nf_tables: GC transaction race with abort path
  * netfilter: nf_tables: use correct lock to protect gc_list
  * netfilter: nf_tables: defer gc run if previous batch is still pending
  * netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
  * netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
  * netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation
    fails
  * netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
  * netfilter: nf_tables: fix memleak when more than 255 elements expired
  * netfilter: nf_tables: disallow element removal on anonymous sets
  * netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
    (CVE-2023-42756)
  * netfilter: nf_tables: unregister flowtable hooks on netns exit
  * netfilter: nf_tables: double hook unregistration in netns path
  * ipv4: fix null-deref in ipv4_link_failure

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 29 Sep 2023 06:25:15 +0200

linux (5.10.191-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.180
    - seccomp: Move copy_seccomp() to no failure path.
    - [arm64] KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg()
    - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
      (CVE-2023-1380)
    - drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var
    - bluetooth: Perform careful capability checks in hci_sock_ioctl()
      (CVE-2023-2002)
    - [x86] fpu: Prevent FPU state corruption
    - USB: serial: option: add UNISOC vendor and TOZED LT70C product
    - driver core: Don't require dynamic_debug for initcall_debug probe timing
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7
      B1-750
    - asm-generic/io.h: suppress endianness warnings for readq() and writeq()
    - wireguard: timers: cast enum limits members to int in prints
    - PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock
    - [arm64] PCI: qcom: Fix the incorrect register usage in v2.7.0 config
    - [arm64,armhf] USB: dwc3: fix runtime pm imbalance on probe errors
    - [arm64,armhf] USB: dwc3: fix runtime pm imbalance on unbind
    - [x86] hwmon: (k10temp) Check range scale when CUR_TEMP register is
      read-write
    - hwmon: (adt7475) Use device_property APIs when configuring polarity
    - posix-cpu-timers: Implement the missing timer_wait_running callback
    - perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into
      sysconf(__SC_THREAD_STACK_MIN_VALUE)
    - blk-mq: release crypto keyslot before reporting I/O complete
    - blk-crypto: make blk_crypto_evict_key() return void
    - blk-crypto: make blk_crypto_evict_key() more robust
    - ext4: use ext4_journal_start/stop for fast commit transactions
    - xhci: fix debugfs register accesses while suspended
    - tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem
    - [mips*] fw: Allow firmware to pass a empty env
    - ipmi:ssif: Add send_retries increment
    - ipmi: fix SSIF not responding under certain cond.
    - kheaders: Use array declaration instead of char
    - [arm64,armhf] pwm: meson: Fix axg ao mux parents
    - [arm64,armhf] pwm: meson: Fix g12a ao clk81 name
    - ring-buffer: Sync IRQ works before buffer destruction
    - crypto: api - Demote BUG_ON() in crypto_unregister_alg() to a WARN_ON()
    - [arm64] crypto: safexcel - Cleanup ring IRQ workqueues on load failure
    - rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being
      kprobe-ed
    - reiserfs: Add security prefix to xattr name in reiserfs_security_write()
    - [x86] KVM: nVMX: Emulate NOPs in L2, and PAUSE if it's not intercepted
    - relayfs: fix out-of-bounds access in relay_file_read (CVE-2023-3268)
    - writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs
    - [armhf] i2c: omap: Fix standard mode false ACK readings
    - [amd64] iommu/amd: Fix "Guest Virtual APIC Table Root Pointer"
      configuration in IRTE
    - Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path"
    - ubifs: Fix memleak when insert_old_idx() failed
    - ubi: Fix return value overwrite issue in try_write_vid_and_data()
    - ubifs: Free memory for tmpfile name
    - nilfs2: do not write dirty data after degenerating to read-only
    - nilfs2: fix infinite loop in nilfs_mdt_get_block()
    - md/raid10: fix null-ptr-deref in raid10_sync_request
    - [arm64] mailbox: zynqmp: Fix IPI isr handling
    - [arm64] mailbox: zynqmp: Fix typo in IPI documentation
    - wifi: rtl8xxxu: RTL8192EU always needs full init
    - [arm64,armhf] clk: rockchip: rk3399: allow clk_cifout to force
      clk_cifout_src to reparent
    - rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check
    - selinux: fix Makefile dependencies of flask.h
    - selinux: ensure av_permissions.h is built when needed
    - tpm, tpm_tis: Do not skip reset of original interrupt vector
    - tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register
    - tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed
    - tpm, tpm_tis: Claim locality before writing interrupt registers
    - tpm, tpm: Implement usage counter for locality
    - tpm, tpm_tis: Claim locality when interrupts are reenabled on resume
    - erofs: stop parsing non-compact HEAD index if clusterofs is invalid
    - erofs: fix potential overflow calculating xattr_isize
    - [arm64,armhf] drm/rockchip: Drop unbalanced obj unref
    - drm/vgem: add missing mutex_destroy
    - drm/probe-helper: Cancel previous job before starting new one
    - [arm64] drm/msm/disp/dpu: check for crtc enable rather than crtc active to
      release shared resources
    - [amd64] EDAC/skx: Fix overflows on the DRAM row address mapping arrays
    - [x86] MCE/AMD: Use an u64 for bank_map
    - [arm64] firmware: qcom_scm: Clear download bit during reboot
    - [arm64] drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and
      adv7535
    - [arm64] drm/msm/adreno: Defer enabling runpm until hw_init()
    - [arm64] drm/msm/adreno: drop bogus pm_runtime_set_active()
    - [arm64] drm: msm: adreno: Disable preemption on Adreno 510
    - [x86] ACPI: processor: Fix evaluating _PDC method when running as Xen dom0
    - [arm64] mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data
    - [arm64,armhf] drm/lima/lima_drv: Add missing unwind goto in
      lima_pdev_probe()
    - regulator: core: Consistently set mutex_owner when using
      ww_mutex_lock_slow()
    - regulator: core: Avoid lockdep reports when resolving supplies
    - media: dm1105: Fix use after free bug in dm1105_remove due to race
      condition (CVE-2023-35824)
    - media: saa7134: fix use after free bug in saa7134_finidev due to race
      condition (CVE-2023-35823)
    - [x86] apic: Fix atomic update of offset in reserve_eilvt_offset()
    - [x86] ioapic: Don't return 0 from arch_dynirq_lower_bound()
    - debugobject: Prevent init race with static objects
    - [x86] drm/i915: Make intel_get_crtc_new_encoder() less oopsy
    - tick/sched: Use tick_next_period for lockless quick check
    - tick/sched: Reduce seqcount held scope in tick_do_update_jiffies64()
    - tick/sched: Optimize tick_do_update_jiffies64() further
    - tick: Get rid of tick_period
    - tick/common: Align tick period with the HZ tick.
    - wifi: ath6kl: minor fix for allocation size
    - wifi: ath9k: hif_usb: fix memory leak of remain_skbs
    - wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list()
    - wifi: ath6kl: reduce WARN to dev_dbg() in callback
    - tools: bpftool: Remove invalid \' json escape
    - wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser()
    - wifi: rtw88: mac: Return the original error from rtw_mac_power_switch()
    - bpf: take into account liveness when propagating precision
    - bpf: fix precision propagation verbose logging
    - scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
    - bpf: Remove misleading spec_v1 check on var-offset stack read
    - vlan: partially enable SIOCSHWTSTAMP in container
    - net/packet: annotate accesses to po->xmit
    - net/packet: convert po->origdev to an atomic flag
    - net/packet: convert po->auxdata to an atomic flag
    - scsi: target: Rename struct sense_info to sense_detail
    - scsi: target: Rename cmd.bad_sector to cmd.sense_info
    - scsi: target: Make state_list per CPU
    - scsi: target: Fix multiple LUN_RESET handling
    - scsi: target: iscsit: Fix TAS handling during conn cleanup
    - scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS
    - f2fs: handle dqget error in f2fs_transfer_project_quota()
    - f2fs: enforce single zone capacity
    - f2fs: apply zone capacity to all zone type
    - f2fs: compress: fix to call f2fs_wait_on_page_writeback() in
      f2fs_write_raw_pages()
    - [arm64] crypto: caam - Clear some memory in instantiate_rng
    - wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()
    - wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_reg()
    - net: qrtr: correct types of trace event parameters
    - bpftool: Fix bug for long instructions in program CFG dumps
    - crypto: drbg - make drbg_prepare_hrng() handle jent instantiation errors
    - crypto: drbg - Only fail when jent is unavailable in FIPS mode
    - xsk: Fix unaligned descriptor validation
    - f2fs: fix to avoid use-after-free for cached IPU bio
    - scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
    - [arm64,armhf] net: ethernet: stmmac: dwmac-rk: fix optional phy regulator
      handling
    - bpf, sockmap: fix deadlocks in the sockhash and sockmap
    - nvme: handle the persistent internal error AER
    - nvme: fix async event trace event
    - bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap
    - md/raid10: fix leak of 'r10bio->remaining' for recovery
    - md/raid10: fix memleak for 'conf->bio_split'
    - md/raid10: fix memleak of md thread
    - wifi: iwlwifi: yoyo: Fix possible division by zero
    - wifi: iwlwifi: fw: move memset before early return
    - jdb2: Don't refuse invalidation of already invalidated buffers
    - wifi: iwlwifi: make the loop for card preparation effective
    - wifi: iwlwifi: mvm: check firmware response size
    - wifi: iwlwifi: fw: fix memory leak in debugfs
    - ixgbe: Allow flow hash to be set via ethtool
    - ixgbe: Enable setting RSS table to default values
    - bpf: Don't EFAULT for getsockopt with optval=NULL
    - netfilter: nf_tables: don't write table validation state without mutex
    - net/sched: sch_fq: fix integer overflow of "credit"
    - ipv4: Fix potential uninit variable access bug in __ip_make_skb()
    - Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to
      unfinished work"
    - netlink: Use copy_to_user() for optval in netlink_getsockopt().
    - net: amd: Fix link leak when verifying config failed
    - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
    - pstore: Revert pmsg_lock back to a normal mutex
    - [arm64,armhf] usb: dwc3: gadget: Change condition for processing suspend
      event
    - fpga: bridge: fix kernel-doc parameter description
    - iio: light: max44009: add missing OF device matching
    - [armhf] spi: spi-imx: using pm_runtime_resume_and_get instead of
      pm_runtime_get_sync
    - [armhf] spi: imx: Don't skip cleanup in remove's error path
    - [armhf] PCI: imx6: Install the fault handler only on compatible match
    - ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ
    - ASoC: es8316: Handle optional IRQ assignment
    - linux/vt_buffer.h: allow either builtin or modular for macros
    - [arm64] spi: qup: Don't skip cleanup in remove's error path
    - [x86] vmci_host: fix a race condition in vmci_host_poll() causing GPF
    - of: Fix modalias string generation
    - [arm64,armhf] usb: chipidea: fix missing goto in `ci_hdrc_probe`
    - [arm64] tty: serial: fsl_lpuart: adjust buffer length to the intended size
    - serial: 8250: Add missing wakeup event reporting
    - [x86] staging: rtl8192e: Fix W_DISABLE# does not work after stop/start
    - [arm64] spmi: Add a check for remove callback when removing a SPMI driver
    - [powerpc*] rtas: use memmove for potentially overlapping buffer copy
    - perf/core: Fix hardlockup failure caused by perf throttle
    - [amd64] RDMA/rdmavt: Delete unnecessary NULL check
    - workqueue: Rename "delayed" (delayed by active management) to "inactive"
    - workqueue: Fix hung time report of worker pools
    - [armhf] rtc: omap: include header for omap_rtc_power_off_program prototype
    - RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
    - [arm64,armhf] rtc: meson-vrtc: Use ktime_get_real_ts64() to get the
      current time
    - clk: add missing of_node_put() in "assigned-clocks" property parsing
    - RDMA/siw: Remove namespace check from siw_netdev_event()
    - RDMA/cm: Trace icm_send_rej event before the cm state is reset
    - RDMA/srpt: Add a check for valid 'mad_agent' pointer
    - [amd64] IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order
    - [amd64] IB/hfi1: Add AIP tx traces
    - [amd64] IB/hfi1: Add additional usdma traces
    - [amd64] IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA
      requests
    - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease
    - [arm*] firmware: raspberrypi: Introduce devm_rpi_firmware_get()
    - RDMA/mlx5: Fix flow counter query via DEVX
    - SUNRPC: remove the maximum number of retries in call_bind_status
    - RDMA/mlx5: Use correct device num_ports when modify DC
    - ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline
    - [arm64] dmaengine: mv_xor_v2: Fix an error code.
    - [armhf] leds: tca6507: Fix error handling of using
      fwnode_property_read_string
    - [arm64,armhf] phy: tegra: xusb: Add missing tegra_xusb_port_unregister for
      usb2_port and ulpi_port
    - afs: Fix updating of i_size with dv jump from server
    - btrfs: scrub: reject unsupported scrub flags
    - [s390x] dasd: fix hanging blockdevice after request requeue
    - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
    - dm flakey: fix a crash with invalid table line
    - dm ioctl: fix nested locking in table_clear() to remove deadlock concern
      (CVE-2023-2269)
    - perf auxtrace: Fix address filter entire kernel size
    - perf intel-pt: Fix CYC timestamps after standalone CBR
    - [arm64] Always load shadow stack pointer directly from the task struct
    - [arm64] Stash shadow stack pointer in the task struct on interrupt
    - debugobject: Ensure pool refill (again)
    - scsi: target: core: Avoid smp_processor_id() in preemptible code
    - tty: create internal tty.h file
    - tty: audit: move some local functions out of tty.h
    - tty: move some internal tty lock enums and functions out of tty.h
    - tty: move some tty-only functions to drivers/tty/tty.h
    - tty: clean include/linux/tty.h up
    - tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH
    - ring-buffer: Ensure proper resetting of atomic variables in
      ring_buffer_reset_online_cpus
    - [amd64] crypto: ccp - Clear PSP interrupt status register before calling
      handler
    - [arm64] mailbox: zynq: Switch to flexible array to simplify code
    - [arm64] mailbox: zynqmp: Fix counts of child nodes
    - dm verity: skip redundant verity_handle_err() on I/O errors
    - dm verity: fix error handling for check_at_most_once on FEC
    - scsi: qedi: Fix use after free bug in qedi_remove()
    - [armhf] net/ncsi: clear Tx enable mode when handling a Config required AEN
    - net/sched: cls_api: remove block_cb from driver_list before freeing
    - sit: update dev->needed_headroom in ipip6_tunnel_bind_dev()
    - [arm64,armhf] net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu
    - writeback: fix call of incorrect macro
    - [arm64,armhf] watchdog: dw_wdt: Fix the error handling path of
      dw_wdt_drv_probe()
    - net/sched: act_mirred: Add carrier check
    - sfc: Fix module EEPROM reporting for QSFP modules
    - rxrpc: Fix hard call timeout units
    - af_packet: Don't send zero-byte data in packet_sendmsg_spkt().
    - drm/amdgpu: add a missing lock for AMDGPU_SCHED
    - ALSA: caiaq: input: Add error handling for unsupported input methods in
      `snd_usb_caiaq_input_init`
    - virtio_net: split free_unused_bufs()
    - virtio_net: suppress cpu stall when free_unused_bufs
    - [arm64] net: enetc: check the index of the SFI rather than the handle
    - crypto: sun8i-ss - Fix a test in sun8i_ss_setup_ivs()
    - btrfs: fix btrfs_prev_leaf() to not return the same key twice
    - btrfs: don't free qgroup space unless specified
    - btrfs: print-tree: parent bytenr must be aligned to sector size
    - cifs: fix pcchunk length type in smb2_copychunk_range
    - inotify: Avoid reporting event with invalid wd
    - [armhf] remoteproc: stm32: Call of_node_put() on iteration error
    - [armhf] dts: exynos: fix WM8960 clock name in Itop Elite
    - f2fs: fix potential corruption when moving a directory
    - [armhf] drm/panel: otm8009a: Set backlight parent to panel device
    - drm/amdgpu: fix an amdgpu_irq_put() issue in gmc_v9_0_hw_fini()
    - drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy
      gfx ras
    - drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend
    - HID: wacom: Set a default resolution for older tablets
    - HID: wacom: insert timestamp to packed Bluetooth (BT) events
    - [x86] KVM: x86: do not report a vCPU as preempted outside instruction
      boundaries (CVE-2022-39189)
    - ext4: fix WARNING in mb_find_extent
    - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum
      (CVE-2023-34256)
    - ext4: fix data races when using cached status extents
    - ext4: check iomap type only if ext4_iomap_begin() does not fail
    - ext4: improve error recovery code paths in __ext4_remount()
    - ext4: fix deadlock when converting an inline directory in nojournal mode
    - ext4: add bounds checking in get_max_inline_xattr_value_size()
    - ext4: bail out of ext4_xattr_ibody_get() fails for any reason
    - ext4: remove a BUG_ON in ext4_mb_release_group_pa()
    - ext4: fix invalid free tracking in ext4_xattr_move_to_block()
    - serial: 8250: Fix serial8250_tx_empty() race with DMA Tx
    - drbd: correctly submit flush bio on barrier
    - [x86] KVM: x86: Ensure PV TLB flush tracepoint reflects KVM behavior
    - [x86] KVM: x86: Fix recording of guest steal time / preempted status
    - [x86] KVM: Fix steal time asm constraints
    - [x86] KVM: x86: Remove obsolete disabling of page faults in
      kvm_arch_vcpu_put()
    - [x86] KVM: x86: do not set st->preempted when going back to user space
    - [x86] KVM: x86: revalidate steal time cache if MSR value changes
    - [x86] KVM: x86: do not report preemption if the steal time cache is stale
    - [x86] KVM: x86: move guest_pv_has out of user_access section
    - printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h
    - [armhf] drm/exynos: move to use request_irq by IRQF_NO_AUTOEN flag
    - mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock
    - drm/amd/display: Fix hang when skipping modeset
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.181
    - driver core: add a helper to setup both the of_node and fwnode of a device
    - drm/mipi-dsi: Set the fwnode for mipi_dsi_device
    - linux/dim: Do nothing if no time delta between samples
    - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
    - netfilter: conntrack: fix possible bug_on with enable_hooks=1
    - netlink: annotate accesses to nlk->cb_running
    - net: annotate sk->sk_err write from do_recvmmsg()
    - net: deal with most data-races in sk_wait_event()
    - net: tap: check vlan with eth_type_vlan() method
    - net: add vlan_get_protocol_and_depth() helper
    - tcp: factor out __tcp_close() helper
    - tcp: add annotations around sk->sk_shutdown accesses
    - ipvlan:Fix out-of-bounds caused by unclear skb->cb (CVE-2023-3090)
    - net: datagram: fix data-races in datagram_poll()
    - af_unix: Fix a data race of sk->sk_receive_queue->qlen.
    - af_unix: Fix data races around sk->sk_shutdown.
    - [x86] drm/i915/dp: prevent potential div-by-zero
    - [x86] fbdev: arcfb: Fix error handling in arcfb_probe()
    - ext4: remove an unused variable warning with CONFIG_QUOTA=n
    - ext4: reflect error codes from ext4_multi_mount_protect() to its callers
    - ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled
    - ext4: fix lockdep warning when enabling MMP
    - ext4: remove redundant mb_regenerate_buddy()
    - ext4: drop s_mb_bal_lock and convert protected fields to atomic
    - ext4: add mballoc stats proc file
    - ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set
    - ext4: allow ext4_get_group_info() to fail
    - rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access
    - fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
    - drm/amd/display: Use DC_LOG_DC in the trasform pixel function
    - regmap: cache: Return error in cache sync operations for REGCACHE_NONE
    - memstick: r592: Fix UAF bug in r592_remove due to race condition
      (CVE-2023-3141)
    - firmware: arm_sdei: Fix sleep from invalid context BUG
    - ACPI: EC: Fix oops when removing custom query handlers
    - [armhf] remoteproc: stm32_rproc: Add mutex protection for workqueue
    - [arm64,armhf] drm/tegra: Avoid potential 32-bit integer overflow
    - ACPICA: Avoid undefined behavior: applying zero offset to null pointer
    - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in
      acpi_db_display_objects
    - wifi: ath: Silence memcpy run-time false positive warning
    - bpf: Annotate data races in bpf_local_storage
    - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
    - scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
    - net: Catch invalid index in XPS mapping
    - scsi: target: iscsit: Free cmds before session free
    - lib: cpu_rmap: Avoid use after free on rmap->obj array entries
    - scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to
      race condition
    - gfs2: Fix inode height consistency check
    - ext4: set goal start correctly in ext4_mb_normalize_request
    - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()
    - f2fs: fix to drop all dirty pages during umount() if cp_error is set
    - wifi: iwlwifi: pcie: fix possible NULL pointer dereference
    - wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
    - null_blk: Always check queue mode setting from configfs
    - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
    - wifi: ath11k: Fix SKB corruption in REO destination ring
    - ipvs: Update width of source for ip_vs_sync_conn_options
    - Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set
    - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
    - [x86] staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE
    - HID: logitech-hidpp: Don't use the USB serial for USB devices
    - HID: logitech-hidpp: Reconcile USB and Unifying serials
    - [armhf] spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3
    - HID: wacom: generic: Set battery quirk only when we see battery data
    - usb: typec: tcpm: fix multiple times discover svids error
    - serial: 8250: Reinit port->pm on port specific driver unbind
    - recordmcount: Fix memory leaks in the uwrite function
    - RDMA/core: Fix multiple -Warray-bounds warnings
    - [arm64,armhf] iommu/arm-smmu-qcom: Limit the SMR groups to 128
    - [arm64] iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any
    - Input: xpad - add constants for GIP interface numbers
    - btrfs: move btrfs_find_highest_objectid/btrfs_find_free_objectid to
      disk-io.c
    - btrfs: replace calls to btrfs_find_free_ino with btrfs_find_free_objectid
    - btrfs: fix space cache inconsistency after error loading it from disk
    - xfrm: don't check the default policy if the policy allows the packet
    - Revert "Fix XFRM-I support for nested ESP tunnels"
    - [arm64] drm/msm/dp: unregister audio driver during unbind
    - [arm64] drm/msm/dpu: Remove duplicate register defines from INTF
    - cpupower: Make TSC read per CPU for Mperf monitor
    - af_key: Reject optional tunnel/BEET mode templates in outbound policies
    - [arm64,armhf] net: fec: Better handle pm_runtime_get() failing in
      .remove()
    - net: phy: dp83867: add w/a for packet errors seen with short cables
    - ALSA: firewire-digi00x: prevent potential use after free
    - ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15
    - vsock: avoid to close connected socket after the timeout
    - ipv4/tcp: do not use per netns ctl sockets
    - net: Find dst with sk's xfrm policy not ctl_sk
    - tcp: fix possible sk_priority leak in tcp_v4_send_reset()
    - [armhf] serial: arc_uart: fix of_iomap leak in `arc_serial_probe`
    - erspan: get the proto with the md version for collect_md
    - [arm64] net: hns3: fix sending pfc frames after reset issue
    - [arm64] net: hns3: fix reset delay time to avoid configuration timeout
    - media: netup_unidvb: fix use-after-free at del_timer()
    - SUNRPC: Fix trace_svc_register() call site
    - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
    - net/tipc: fix tipc header files for kernel-doc
    - tipc: add tipc_bearer_min_mtu to calculate min mtu
    - tipc: do not update mtu if msg_max is too small in mtu negotiation
    - tipc: check the bearer min mtu properly when setting it by netlink
    - [arm64] net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
    - [arm64] net: bcmgenet: Restore phy_stop() depending upon suspend/close
    - wifi: mac80211: fix min center freq offset tracing
    - wifi: iwlwifi: mvm: don't trust firmware n_channels
    - [x86] scsi: storvsc: Don't pass unused PFNs to Hyper-V host
    - cassini: Fix a memory leak in the error handling path of cas_init_one()
    - igb: fix bit_shift to be in [1..8] range
    - vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
    - netfilter: nft_set_rbtree: fix null deref on element insertion
    - bridge: always declare tunnel functions
    - ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go
    - USB: usbtmc: Fix direction for 0-length ioctl control messages
    - usb-storage: fix deadlock when a scsi command timeouts more than once
    - [arm64,armhf] usb: dwc3: debugfs: Resume dwc3 before accessing registers
    - usb: gadget: u_ether: Fix host MAC address case
    - usb: typec: altmodes/displayport: fix pin_assignment_show
    - ALSA: hda: Fix Oops by 9.1 surround channel names
    - ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table
    - ALSA: hda/realtek: Add quirk for Clevo L140AU
    - ALSA: hda/realtek: Add a quirk for HP EliteDesk 805
    - ALSA: hda/realtek: Add quirk for 2nd ASUS GU603
    - can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag
    - can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag
    - statfs: enforce statfs[64] structure initialization
    - serial: Add support for Advantech PCI-1611U card
    - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid
      UAF
    - ceph: force updating the msg pointer in non-split case
    - tpm/tpm_tis: Disable interrupts for more Lenovo devices
    - [powerpc*] 64s/radix: Fix soft dirty tracking
    - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
    - HID: wacom: Force pen out of prox if no events have been received in a
      while
    - HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs
    - HID: wacom: add three styli to wacom_intuos_get_tool_type
    - [arm64] KVM: arm64: Link position-independent string routines into
      .hyp.text
    - serial: 8250_exar: derive nr_ports from PCI ID for Acces I/O cards
    - serial: exar: Add support for Sealevel 7xxxC serial cards
    - serial: 8250_exar: Add support for USR298x PCI Modems
    - [s390x] qdio: get rid of register asm
    - [s390x] qdio: fix do_sqbs() inline assembly constraint
    - [x86] watchdog: sp5100_tco: Immediately trigger upon starting.
    - writeback, cgroup: remove extra percpu_ref_exit()
    - net/sched: act_mirred: refactor the handle of xmit
    - net/sched: act_mirred: better wording on protection against excessive
      stack growth
    - act_mirred: use the backlog for nested calls to mirred ingress
      (CVE-2022-4269)
    - ocfs2: Switch to security_inode_init_security()
    - ALSA: hda/ca0132: add quirk for EVGA X299 DARK
    - ALSA: hda: Fix unhandled register update during auto-suspend period
    - ALSA: hda/realtek: Enable headset onLenovo M70/M90
    - net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
    - btrfs: use nofs when cleaning up aborted transactions
    - dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type
    - [x86] mm: Avoid incomplete Global INVLPG flushes
    - [x86] topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms
    - debugobjects: Don't wake up kswapd from fill_pool()
    - fbdev: udlfb: Fix endpoint check
    - net: fix stack overflow when LRO is disabled for virtual interfaces
    - udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
    - USB: core: Add routines for endpoint checks in old drivers
    - USB: sisusbvga: Add endpoint checks
    - media: radio-shark: Add endpoint checks
    - net: fix skb leak in __skb_tstamp_tx()
    - bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields
    - ipv6: Fix out-of-bounds access in ipv6_find_tlv()
    - power: supply: leds: Fix blink to LED on transition
    - power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition
    - power: supply: bq27xxx: Fix I2C IRQ race on remove
    - power: supply: bq27xxx: Fix poll_interval handling and races on remove
    - fs: fix undefined behavior in bit shift for SB_NOUSER
    - [x86] show_trace_log_lvl: Ensure stack pointer is aligned, again
    - [x86] ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg
    - [x86] forcedeth: Fix an error handling path in nv_probe()
    - net/mlx5e: do as little as possible in napi poll when budget is 0
    - net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs
    - net/mlx5: Fix error message when failing to allocate device memory
    - net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
    - [x86] 3c589_cs: Fix an error handling path in tc589_probe()
    - net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.182
    - [x86] cpu: Add Raptor Lake to Intel family
    - [x86] cpu: Drop spurious underscore from RAPTOR_LAKE #define
    - power: supply: bq27xxx: fix polarity of current_now
    - power: supply: bq27xxx: fix sign of current_now for newer ICs
    - power: supply: bq27xxx: make status more robust
    - power: supply: bq27xxx: Add cache parameter to
      bq27xxx_battery_current_and_status()
    - power: supply: bq27xxx: expose battery data when CI=1
    - power: supply: bq27xxx: Move bq27xxx_battery_update() down
    - power: supply: bq27xxx: Ensure power_supply_changed() is called on current
      sign changes
    - power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to
      stabilize
    - power: supply: core: Refactor
      power_supply_set_input_current_limit_from_supplier()
    - [x86] power: supply: bq24190: Call power_supply_changed() after updating
      input current
    - regulator: Add regmap helper for ramp-delay setting
    - net/mlx5: devcom only supports 2 ports
    - net/mlx5: Devcom, serialize devcom registration
    - net: phy: mscc: enable VSC8501/2 RGMII RX clock
    - bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
    - [arm*] binder: fix UAF caused by faulty buffer cleanup (CVE-2023-21255)
    - ipv{4,6}/raw: fix output xfrm lookup wrt protocol
    - netfilter: ctnetlink: Support offloaded conntrack entry deletion
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.183
    - [arm64,armhf] iommu/rockchip: Fix unwind goto issue
    - [amd64] iommu/amd: Don't block updates to GATag if guest mode is on
    - [arm64,armhf] dmaengine: pl330: rename _start to prevent build error
    - net/mlx5: fw_tracer, Fix event handling
    - netrom: fix info-leak in nr_write_internal()
    - af_packet: Fix data-races of pkt_sk(sk)->num.
    - [amd64,arm64] amd-xgbe: fix the false linkup in xgbe_phy_status
    - af_packet: do not use READ_ONCE() in packet_bind()
    - tcp: deny tcp_disconnect() when threads are waiting
    - tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
    - net/sched: sch_ingress: Only create under TC_H_INGRESS
    - net/sched: sch_clsact: Only create under TC_H_CLSACT
    - net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs
    - net/sched: Prohibit regrafting ingress or clsact Qdiscs
    - net: sched: fix NULL pointer dereference in mq_attach
    - net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report
    - udp6: Fix race condition in udp6_sendmsg & connect
    - net/mlx5: Read embedded cpu after init bit cleared
    - net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
      (CVE-2023-35788)
    - [arm64,armhf] net: dsa: mv88e6xxx: Increase wait after reset deactivation
    - [armhf] mtd: rawnand: marvell: ensure timing values are written
    - [armhf] mtd: rawnand: marvell: don't set the NAND frequency select
    - ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs.
    - btrfs: abort transaction when sibling keys check fails for leaves
    - [armel] ARM: 9295/1: unwind:fix unwind abort for uleb128 case
    - gfs2: Don't deref jdesc in evict (CVE-2023-3212)
    - fbdev: modedb: Add 1920x1080 at 60 Hz video mode
    - nbd: Fix debugfs_create_dir error checking
    - xfrm: Check if_id in inbound policy/secpath match
    - ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs
    - media: dvb_demux: fix a bug for the continuity counter
    - media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
    - media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
    - media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
    - media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
    - media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
    - media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
    - media: netup_unidvb: fix irq init by register it at the end of probe
    - media: dvb_ca_en50221: fix a size write bug
    - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
    - media: dvb-core: Fix use-after-free due on race condition at dvb_net
    - media: dvb-core: Fix kernel WARNING for blocking operation in
      wait_event*() (CVE-2023-31084)
    - media: dvb-core: Fix use-after-free due to race condition at
      dvb_ca_en50221
    - wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value
    - [arm64] mm: mark private VM_FAULT_X defines as vm_fault_t
    - scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed
    - netfilter: conntrack: define variables exp_nat_nla_policy and any_addr
      with CONFIG_NF_NAT
    - ALSA: oss: avoid missing-prototype warnings
    - [arm64] drm/msm: Be more shouty if per-process pgtables aren't working
    - atm: hide unused procfs functions
    - HID: google: add jewel USB id
    - HID: wacom: avoid integer overflow in wacom_intuos_inout()
    - iio: imu: inv_icm42600: fix timestamp reset
    - iio: light: vcnl4035: fixed chip ID check
    - iio: dac: mcp4725: Fix i2c_master_send() return value handling
    - iio: adc: ad7192: Change "shorted" channels to differential
    - net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818
    - usb: gadget: f_fs: Add unbind event before functionfs_unbind
    - ata: libata-scsi: Use correct device no in ata_find_dev()
    - x86/boot: Wrap literal addresses in absolute_pointer()
    - ACPI: thermal: drop an always true check
    - ath6kl: Use struct_group() to avoid size-mismatched casting
    - eth: sun: cassini: remove dead code
    - mmc: vub300: fix invalid response handling
    - [arm64] tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead
      of UARTCTRL_SBK
    - btrfs: fix csum_tree_block page iteration to avoid tripping on
      -Werror=array-bounds
    - selinux: don't use make's grouped targets feature yet
    - tracing/probe: trace_probe_primary_from_call(): checked list_first_entry
    - ext4: add EA_INODE checking to ext4_iget()
    - ext4: set lockdep subclass for the ea_inode in
      ext4_xattr_inode_cache_find()
    - ext4: disallow ea_inodes with extended attributes
    - ext4: add lockdep annotations for i_data_sem for ea_inode's
    - fbcon: Fix null-ptr-deref in soft_cursor
    - [arm64,armhf] serial: 8250_tegra: Fix an error handling path in
      tegra_uart_probe()
    - [x86] KVM: x86: Account fastpath-only VM-Exits in vCPU stats
    - KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
    - regmap: Account for register length when chunking
    - tpm, tpm_tis: Request threaded interrupt handler
    - [x86] scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD)
      (CVE-2023-2007)
    - [x86] scsi: dpt_i2o: Do not process completions with invalid addresses
    - [amd64] crypto: ccp: Reject SEV commands with mismatching command buffer
    - [amd64] crypto: ccp: Play nice with vmalloc'd memory for SEV command
      structs (Closes: #1036543)
    - ext4: enable the lazy init thread when remounting read/write
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.184
    - remove the sx8 block driver
    - f2fs: fix iostat lock protection
    - blk-iocost: avoid 64-bit division in ioc_timer_fn
    - i40iw: fix build warning in i40iw_manage_apbvt()
    - i40e: fix build warnings in i40e_alloc.h
    - i40e: fix build warning in ice_fltr_add_mac_to_list()
    - [arm*] staging: vchiq_core: drop vchiq_status from vchiq_initialise
    - [arm64] spi: qup: Request DMA before enabling clocks
    - afs: Fix setting of mtime when creating a file/dir/symlink
    - neighbour: fix unaligned access to pneigh_entry
    - net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT
    - net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values
    - Bluetooth: Fix l2cap_disconnect_req deadlock
    - Bluetooth: L2CAP: Add missing checks for invalid DCID
    - qed/qede: Fix scheduling while atomic
    - netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper
    - netfilter: ipset: Add schedule point in call_ad().
    - rfs: annotate lockless accesses to sk->sk_rxhash
    - rfs: annotate lockless accesses to RFS sock flow table
    - net: sched: move rtm_tca_policy declaration to include file
    - net: sched: fix possible refcount leak in tc_chain_tmplt_add()
    - bpf: Add extra path pointer check to d_path helper
    - lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
    - bnxt_en: Don't issue AP reset during ethtool's reset operation
    - bnxt_en: Query default VLAN before VNIC setup on a VF
    - bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
    - batman-adv: Broken sync while rescheduling delayed work
    - Input: xpad - delete a Razer DeathAdder mouse VID/PID entry
    - Input: psmouse - fix OOB access in Elantech protocol
    - ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01
    - ALSA: hda/realtek: Add Lenovo P3 Tower platform
    - drm/amdgpu: fix xclk freq on CHIP_STONEY
    - can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in
      J1939 Socket
    - can: j1939: change j1939_netdev_lock type to mutex
    - can: j1939: avoid possible use-after-free when j1939_can_rx_register fails
    - ceph: fix use-after-free bug for inodes when flushing capsnaps
    - [s390x] dasd: Use correct lock while counting channel queue length
    - Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk
    - Bluetooth: hci_qca: fix debugfs registration
    - rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting
    - rbd: get snapshot context after exclusive lock is ensured to be held
    - [arm64] pinctrl: meson-axg: add missing GPIOA_18 gpio group
    - usb: usbfs: Enforce page requirements for mmap
    - usb: usbfs: Use consistent mmap functions
    - [arm*] staging: vc04_services: fix gcc-13 build warning
    - vhost: support PACKED when setting-getting vring_base
    - Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is
      re-enabled"
    - ext4: only check dquot_initialize_needed() when debugging
    - tcp: fix tcp_min_tso_segs sysctl
    - xfs: verify buffer contents when we skip log replay (CVE-2023-2124)
    - drm/atomic: Don't pollute crtc_state->mode_blob with error pointers
    - btrfs: check return value of btrfs_commit_transaction in relocation
    - btrfs: unset reloc control if transaction commit fails in
      prepare_to_relocate() (CVE-2023-3111)
    - [x86] Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with
      PCI_DEVICE"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.185
    - lib: cleanup kstrto*() usage
    - kernel.h: split out kstrtox() and simple_strtox() to a separate header
    - power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() +
      schedule()
    - [armhf] dts: vexpress: add missing cache properties
    - power: supply: Ratelimit no data debug output
    - [x86] platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0
    - regulator: Fix error checking for debugfs_create_dir
    - [arm64,armhf] irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/
      firmware issues
    - power: supply: Fix logic checking if system is running from battery
    - btrfs: scrub: try harder to mark RAID56 block groups read-only
    - btrfs: handle memory allocation failure in btrfs_csum_one_bio
    - ASoC: soc-pcm: test if a BE can be prepared
    - [mips*] Move initrd_start check after initrd address sanitisation.
    - xen/blkfront: Only check REQ_FUA for writes
    - drm:amd:amdgpu: Fix missing buffer object unlock in failure path
    - [arm64,armhf] irqchip/gic: Correctly validate OF quirk descriptors
    - io_uring: hold uring mutex around poll removal (CVE-2023-3389)
    - epoll: ep_autoremove_wake_function should use list_del_init_careful
    - ocfs2: fix use-after-free when unmounting read-only filesystem
    - ocfs2: check new file size on fallocate call
    - nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key()
    - nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
    - kexec: support purgatories with .text.hot sections
    - [x86] purgatory: remove PGO flags
    - [powerpc*] purgatory: remove PGO flags
    - nouveau: fix client work fence deletion race
    - RDMA/uverbs: Restrict usage of privileged QKEYs
    - net: usb: qmi_wwan: add support for Compal RXM-G1
    - ALSA: hda/realtek: Add a quirk for Compaq N14JP6
    - Remove DECnet support from kernel (CVE-2023-3338)
    - USB: serial: option: add Quectel EM061KGL series
    - [arm64,armhf] usb: dwc3: gadget: Reset num TRBs before giving back the
      request
    - [arm64] spi: fsl-dspi: avoid SCK glitches with continuous transfers
    - netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
    - [arm64] net: enetc: correct the indexes of highest and 2nd highest TCs
    - ping6: Fix send to link-local addresses with VRF.
    - net/sched: cls_u32: Fix reference counter leak leading to overflow
      (CVE-2023-3609)
    - RDMA/rxe: Remove the unused variable obj
    - RDMA/rxe: Removed unused name from rxe_task struct
    - RDMA/rxe: Fix the use-before-initialization error of resp_pkts
    - iavf: remove mask from iavf_irq_enable_queues()
    - RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions
    - RDMA/cma: Always set static rate to 0 for RoCE
    - IB/uverbs: Fix to consider event queue closing also upon non-blocking mode
    - IB/isert: Fix dead lock in ib_isert
    - IB/isert: Fix possible list corruption in CMA handler
    - IB/isert: Fix incorrect release of isert connection
    - ipvlan: fix bound dev checking for IPv6 l3s mode
    - sctp: fix an error code in sctp_sf_eat_auth()
    - igb: fix nvm.ops.read() error handling
    - drm/nouveau: don't detect DSM for non-NVIDIA device
    - drm/nouveau/dp: check for NULL nv_connector->native_mode
    - drm/nouveau: add nv_encoder pointer check for NULL
    - ext4: drop the call to ext4_error() from ext4_get_group_info()
    - net/sched: cls_api: Fix lockup on flushing explicitly created chain
    - net: tipc: resize nlattr array to correct size
    - afs: Fix vlserver probe RTT handling
    - cgroup: always put cset in cgroup_css_set_put_fork
    - rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period
    - neighbour: Remove unused inline function neigh_key_eq16()
    - net: Remove unused inline function dst_hold_and_use()
    - net: Remove DECnet leftovers from flow.h.
    - neighbour: delete neigh_lookup_nodev as not used
    - batman-adv: Switch to kstrtox.h for kstrtou64
    - mmc: block: ensure error propagation for non-blk
    - mm/memory_hotplug: extend offline_and_remove_memory() to handle more than
      one memory block
    - nilfs2: reject devices with insufficient block count
    - media: dvbdev: Fix memleak in dvb_register_device
    - media: dvbdev: fix error logic at dvb_register_device()
    - media: dvb-core: Fix use-after-free due to race at dvb_register_device()
    - [x86] drm/i915/dg1: Wait for pcode/uncore handshake at startup
    - [x86] drm/i915/gen11+: Only load DRAM information from pcode
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.186
    - drm/amd/display: fix the system hang while disable PSR
    - net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs
    - tracing: Add tracing_reset_all_online_cpus_unlocked() function
    - tick/common: Align tick period during sched_timer setup
    - nilfs2: fix buffer corruption due to concurrent device reads
    - [x86] Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs
    - [x86] PCI: hv: Fix a race condition bug in hv_pci_query_relations()
    - [x86] Revert "PCI: hv: Fix a timing issue which causes kdump to fail
      occasionally"
    - [x86] PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev
    - [x86] PCI: hv: Fix a race condition in hv_irq_unmask() that can cause
      panic
    - cgroup: Do not corrupt task iteration when rebinding subsystem
    - [arm64] mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916
    - [arm64] mmc: meson-gx: remove redundant mmc_request_done() call from irq
      context
    - [arm64,armhf] mmc: mmci: stm32: fix max busy timeout calculation
    - ip_tunnels: allow VXLAN/GENEVE to inherit TOS/TTL from VLAN
    - regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK
    - writeback: fix dereferencing NULL mapping->host on writeback_page_template
    - io_uring/net: save msghdr->msg_control for retries
    - io_uring/net: clear msg_controllen on partial sendmsg retry
    - io_uring/net: disable partial retries for recvmsg with cmsg
    - nilfs2: prevent general protection fault in nilfs_clear_dirty_page()
    - [x86] mm: Avoid using set_pgd() outside of real PGD pages
    - mm/pagealloc: sysctl: change watermark_scale_factor max limit to 30%
    - sysctl: move some boundary constants from sysctl.c to sysctl_vals
    - memfd: check for non-NULL file_seals in memfd_create() syscall
    - ieee802154: hwsim: Fix possible memory leaks
    - xfrm: Treat already-verified secpath entries as optional
    - xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c
    - xfrm: Ensure policies always checked on XFRM-I input path
    - bpf: track immediate values written to stack by BPF_ST instruction
    - bpf: Fix verifier id tracking of scalars on spill
    - xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets
    - xfrm: Linearize the skb after offloading if needed.
    - [armel,armhf] mmc: mvsdio: fix deferred probing
    - [armhf] mmc: omap: fix deferred probing
    - [armhf] mmc: omap_hsmmc: fix deferred probing
    - mmc: sdhci-acpi: fix deferred probing
    - ipvs: align inner_mac_header for encapsulation
    - be2net: Extend xmit workaround to BE3 chip
    - netfilter: nft_set_pipapo: .walk does not deal with generations
    - netfilter: nf_tables: disallow element updates of bound anonymous sets
    - netfilter: nfnetlink_osf: fix module autoload
    - Revert "net: phy: dp83867: perform soft reset and retain established link"
    - sch_netem: acquire qdisc lock in netem_change()
    - gpio: Allow per-parent interrupt data
    - gpiolib: Fix GPIO chip IRQ initialization restriction
    - scsi: target: iscsi: Prevent login threads from racing between each other
    - HID: wacom: Add error check to wacom_parse_and_register()
    - [arm64] Add missing Set/Way CMO encodings
    - media: cec: core: don't set last_initiator if tx in progress
    - nfcsim.c: Fix error checking for debugfs_create_dir
    - [i386] usb: gadget: udc: fix NULL dereference in remove()
    - [x86] Input: soc_button_array - add invalid acpi_index DMI quirk handling
    - [s390x] cio: unregister device when the only path is gone
    - [arm*] ASoC: simple-card: Add missing of_node_put() in case of error
    - [x86] ASoC: nau8824: Add quirk to active-high jack-detect
    - [armhf] dts: Fix erroneous ADS touchscreen polarities
    - drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl
    - [x86] apic: Fix kernel panic when booting with intremap=off and
      x2apic_phys
    - bpf/btf: Accept function names that contain dots
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.187
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.188
    - media: atomisp: fix "variable dereferenced before check 'asd'"
    - [x86] smp: Use dedicated cache-line for mwait_play_dead()
    - can: isotp: isotp_sendmsg(): fix return error fix on TX path
    - video: imsttfb: check for ioremap() failures
    - fbdev: imsttfb: Fix use after free bug in imsttfb_probe
    - HID: wacom: Use ktime_t rather than int when dealing with timestamps
    - HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651.
    - drm/amdgpu: Validate VM ioctl flags.
    - nubus: Partially revert proc_create_single_data() conversion
    - fs: pipe: reveal missing function protoypes
    - [x86] resctrl: Only show tasks' pid in current pid namespace
    - blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
    - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
    - md/raid10: fix overflow of md/safe_mode_delay
    - md/raid10: fix wrong setting of max_corr_read_errors
    - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
    - md/raid10: fix io loss while replacement replace rdev
    - irqchip/jcore-aic: Kill use of irq_create_strict_mappings()
    - irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
    - posix-timers: Prevent RT livelock in itimer_delete()
    - tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
    - clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
    - PM: domains: fix integer overflow issues in genpd_parse_state()
    - perf/arm-cmn: Fix DTC reset
    - powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
    - cpufreq: intel_pstate: Fix energy_performance_preference for passive
    - thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe()
    - rcuscale: Console output claims too few grace periods
    - rcuscale: Always log error message
    - rcuscale: Move shutdown from wait_event() to wait_event_idle()
    - rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup()
    - rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale
    - perf/ibs: Fix interface via core pmu events
    - [x86] mm: Fix __swp_entry_to_pte() for Xen PV guests
    - evm: Complete description of evm_inode_setattr()
    - pstore/ram: Add check for kstrdup
    - igc: Enable and fix RX hash usage by netstack
    - wifi: ath9k: fix AR9003 mac hardware hang check register offset
      calculation
    - wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
    - spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
    - wifi: wilc1000: fix for absent RSN capabilities WFA testcase
    - wifi: mwifiex: Fix the size of a memory allocation in
      mwifiex_ret_802_11_scan()
    - bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE
    - sctp: add bpf_bypass_getsockopt proto callback
    - nfc: constify several pointers to u8, char and sk_buff
    - nfc: llcp: fix possible use of uninitialized variable in
      nfc_llcp_send_connect()
    - regulator: core: Fix more error checking for debugfs_create_dir()
    - regulator: core: Streamline debugfs operations
    - wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
    - wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
    - wifi: atmel: Fix an error handling path in atmel_probe()
    - wl3501_cs: Fix misspelling and provide missing documentation
    - net: create netdev->dev_addr assignment helpers
    - wl3501_cs: use eth_hw_addr_set()
    - wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
    - wifi: ray_cs: Utilize strnlen() in parse_addr()
    - wifi: ray_cs: Drop useless status variable in parse_addr()
    - wifi: ray_cs: Fix an error handling path in ray_probe()
    - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
    - wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled
    - wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
    - watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct
      config
    - watchdog/perf: more properly prevent false positives with turbo modes
    - kexec: fix a memory leak in crash_shrink_memory()
    - memstick r592: make memstick_debug_get_tpc_name() static
    - wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
    - rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
    - wifi: iwlwifi: pull from TXQs with softirqs disabled
    - wifi: cfg80211: rewrite merging of inherited elements
    - wifi: ath9k: convert msecs to jiffies where needed
    - igc: Fix race condition in PTP tx code
    - net: stmmac: fix double serdes powerdown
    - netlink: fix potential deadlock in netlink_set_err()
    - netlink: do not hard code device address lenth in fdb dumps
    - gtp: Fix use-after-free in __gtp_encap_destroy().
    - net: axienet: Move reset before 64-bit DMA detection
    - sfc: fix crash when reading stats while NIC is resetting
    - nfc: llcp: simplify llcp_sock_connect() error paths
    - net: nfc: Fix use-after-free caused by nfc_llcp_find_local (CVE-2023-3863)
    - lib/ts_bm: reset initial match offset for every block of text
    - netfilter: conntrack: dccp: copy entire header to stack buffer, not just
      basic one
    - netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return
      value.
    - ipvlan: Fix return value of ipvlan_queue_xmit()
    - netlink: Add __sock_i_ino() for __netlink_diag_dump().
    - radeon: avoid double free in ci_dpm_init()
    - drm/amd/display: Explicitly specify update type per plane info change
    - Input: drv260x - sleep between polling GO bit
    - drm/bridge: tc358768: always enable HS video mode
    - drm/bridge: tc358768: fix PLL parameters computation
    - drm/bridge: tc358768: fix PLL target frequency
    - drm/bridge: tc358768: fix TCLK_ZEROCNT computation
    - drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation
    - drm/bridge: tc358768: fix TCLK_TRAILCNT computation
    - drm/bridge: tc358768: fix THS_ZEROCNT computation
    - drm/bridge: tc358768: fix TXTAGOCNT computation
    - drm/bridge: tc358768: fix THS_TRAILCNT computation
    - drm/vram-helper: fix function names in vram helper doc
    - Input: adxl34x - do not hardcode interrupt trigger type
    - drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
    - drm/panel: sharp-ls043t1le01: adjust mode settings
    - bus: ti-sysc: Fix dispc quirk masking bool variables
    - [arm64] dts: microchip: sparx5: do not use PSCI on reference boards
    - RDMA/bnxt_re: Disable/kill tasklet only if it is enabled
    - RDMA/bnxt_re: Fix to remove unnecessary return labels
    - RDMA/bnxt_re: Use unique names while registering interrupts
    - RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid
    - RDMA/bnxt_re: Fix to remove an unnecessary log
    - ARM: dts: gta04: Move model property out of pinctrl node
    - [arm64] dts: qcom: msm8916: correct camss unit address
    - [arm64] dts: qcom: msm8994: correct SPMI unit address
    - [arm64] dts: qcom: msm8996: correct camss unit address
    - drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
    - ARM: ep93xx: fix missing-prototype warnings
    - ARM: omap2: fix missing tick_broadcast() prototype
    - [arm64] dts: qcom: apq8096: fix fixed regulator name property
    - ARM: dts: stm32: Shorten the AV96 HDMI sound card name
    - memory: brcmstb_dpfe: fix testing array offset after use
    - ASoC: es8316: Increment max value for ALC Capture Target Volume control
    - ASoC: es8316: Do not set rate constraints for unsupported MCLKs
    - ARM: dts: meson8: correct uart_B and uart_C clock references
    - soc/fsl/qe: fix usb.c build errors
    - IB/hfi1: Use bitmap_zalloc() when applicable
    - IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
    - IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate
    - RDMA: Remove uverbs_ex_cmd_mask values that are linked to functions
    - RDMA/hns: Fix coding style issues
    - RDMA/hns: Use refcount_t APIs for HEM
    - RDMA/hns: Clean the hardware related code for HEM
    - RDMA/hns: Fix hns_roce_table_get return value
    - ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier
    - fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
    - [arm64] dts: ti: k3-j7200: Fix physical address of pin
    - ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2
    - ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx
    - hwmon: (gsc-hwmon) fix fan pwm temperature scaling
    - hwmon: (adm1275) enable adm1272 temperature reporting
    - hwmon: (adm1275) Allow setting sample averaging
    - hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272
    - ARM: dts: BCM5301X: fix duplex-full => full-duplex
    - drm/radeon: fix possible division-by-zero errors
    - amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
    - RDMA/bnxt_re: wraparound mbox producer index
    - RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context
    - clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe
    - clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()
    - clk: tegra: tegra124-emc: Fix potential memory leak
    - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
    - drm/msm/dpu: do not enable color-management if DSPPs are not available
    - drm/msm/dp: Free resources after unregistering them
    - clk: vc5: check memory returned by kasprintf()
    - clk: cdce925: check return value of kasprintf()
    - clk: si5341: Allow different output VDD_SEL values
    - clk: si5341: Add sysfs properties to allow checking/resetting device
      faults
    - clk: si5341: return error if one synth clock registration fails
    - clk: si5341: check return value of {devm_}kasprintf()
    - clk: si5341: free unused memory on probe failure
    - clk: keystone: sci-clk: check return value of kasprintf()
    - clk: ti: clkctrl: check return value of kasprintf()
    - drivers: meson: secure-pwrc: always enable DMA domain
    - ovl: update of dentry revalidate flags after copy up
    - ASoC: imx-audmix: check return value of devm_kasprintf()
    - PCI: cadence: Fix Gen2 Link Retraining process
    - scsi: qedf: Fix NULL dereference in error handling
    - pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors
    - PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
    - scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
    - PCI: pciehp: Cancel bringup sequence if card is not present
    - PCI: ftpci100: Release the clock resources
    - PCI: Add pci_clear_master() stub for non-CONFIG_PCI
    - perf bench: Use unbuffered output when pipe/tee'ing to a file
    - perf bench: Add missing setlocale() call to allow usage of %'d style
      formatting
    - pinctrl: cherryview: Return correct value if pin in push-pull mode
    - perf dwarf-aux: Fix off-by-one in die_get_varname()
    - pinctrl: at91-pio4: check return value of devm_kasprintf()
    - [powerpc*] powernv/sriov: perform null check on iov before dereferencing
      iov
    - mm: rename pud_page_vaddr to pud_pgtable and make it return pmd_t *
    - mm: rename p4d_page_vaddr to p4d_pgtable and make it return pud_t *
    - [powerpc*] book3s64/mm: Fix DirectMap stats in /proc/meminfo
    - [powerpc*] mm/dax: Fix the condition when checking if altmap vmemap can
      cross-boundary
    - hwrng: virtio - add an internal buffer
    - hwrng: virtio - don't wait on cleanup
    - hwrng: virtio - don't waste entropy
    - hwrng: virtio - always add a pending request
    - hwrng: virtio - Fix race on data_avail and actual data
    - crypto: nx - fix build warnings when DEBUG_FS is not enabled
    - modpost: fix section mismatch message for R_ARM_ABS32
    - modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
    - crypto: marvell/cesa - Fix type mismatch warning
    - modpost: fix off by one in is_executable_section()
    - NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
    - dax: Fix dax_mapping_release() use after free
    - dax: Introduce alloc_dev_dax_id()
    - hwrng: st - keep clock enabled while hwrng is registered
    - io_uring: ensure IOPOLL locks around deferred work (CVE-2023-21400)
    - USB: serial: option: add LARA-R6 01B PIDs
    - usb: dwc3: gadget: Propagate core init errors to UDC during pullup
    - phy: tegra: xusb: Clear the driver reference in usb-phy dev
    - block: fix signed int overflow in Amiga partition support
    - block: change all __u32 annotations to __be32 in affs_hardblocks.h
    - SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
    - w1: w1_therm: fix locking behavior in convert_t
    - w1: fix loop in w1_fini()
    - serial: 8250: omap: Fix freeing of resources on failed register
    - clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks
    - media: usb: Check az6007_read() return value
    - media: videodev2.h: Fix struct v4l2_input tuner index comment
    - media: usb: siano: Fix warning due to null work_func_t function pointer
      (CVE-2023-4132)
    - clk: qcom: reset: Allow specifying custom reset delay
    - clk: qcom: reset: support resetting multiple bits
    - clk: qcom: ipq6018: fix networking resets
    - usb: dwc3: qcom: Fix potential memory leak
    - usb: gadget: u_serial: Add null pointer check in gserial_suspend
    - extcon: Fix kernel doc of property fields to avoid warnings
    - extcon: Fix kernel doc of property capability fields to avoid warnings
    - usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
    - usb: hide unused usbfs_notify_suspend/resume functions
    - serial: 8250: lock port for stop_rx() in omap8250_irq()
    - serial: 8250: lock port for UART_IER access in omap8250_irq()
    - kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR
    - coresight: Fix loss of connection info when a module is unloaded
    - mfd: rt5033: Drop rt5033-battery sub-device
    - media: venus: helpers: Fix ALIGN() of non power of two
    - media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var()
    - [s390x] KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
    - usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
    - usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe()
    - usb: common: usb-conn-gpio: Set last role to unknown before initial
      detection
    - usb: dwc3-meson-g12a: Fix an error handling path in
      dwc3_meson_g12a_probe()
    - mfd: intel-lpss: Add missing check for platform_get_resource
    - Revert "usb: common: usb-conn-gpio: Set last role to unknown before
      initial detection"
    - serial: 8250_omap: Use force_suspend and resume for system suspend
    - mfd: stmfx: Fix error path in stmfx_chip_init
    - mfd: stmfx: Nullify stmfx->vdd in case of error
    - [s390x] KVM: s390: vsie: fix the length of APCB bitmap
    - mfd: stmpe: Only disable the regulators if they are enabled
    - phy: tegra: xusb: check return value of devm_kzalloc()
    - pwm: imx-tpm: force 'real_period' to be zero in suspend
    - pwm: sysfs: Do not apply state to already disabled PWMs
    - rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
    - media: cec: i2c: ch7322: also select REGMAP
    - sctp: fix potential deadlock on &net->sctp.addr_wq_lock
    - Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
    - net: dsa: vsc73xx: fix MTU configuration
    - spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
    - mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
    - f2fs: fix error path handling in truncate_dnode()
    - octeontx2-af: Fix mapping for NIX block from CGX connection
    - [powerpc*] allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
    - net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
    - tcp: annotate data races in __tcp_oow_rate_limited()
    - xsk: Honor SO_BINDTODEVICE on bind
    - net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
    - pptp: Fix fib lookup calls.
    - net: dsa: tag_sja1105: fix MAC DA patching from meta frames
    - [s390x] qeth: Fix vipa deletion
    - apparmor: fix missing error check for rhashtable_insert_fast
    - i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process()
    - i2c: xiic: Don't try to handle more interrupt events after error
    - ALSA: jack: Fix mutex call in snd_jack_report()
    - i2c: qup: Add missing unwind goto in qup_i2c_probe()
    - NFSD: add encoding of op_recall flag for write delegation
    - io_uring: wait interruptibly for request completions on exit
    - mmc: core: disable TRIM on Kingston EMMC04G-M627
    - mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
    - mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS
    - mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is
      used.
    - bcache: fixup btree_cache_wait list damage
    - bcache: Remove unnecessary NULL point check in node allocations
    - bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
    - integrity: Fix possible multiple allocation in integrity_inode_get()
    - autofs: use flexible array in ioctl structure
    - shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs
    - jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
    - fs: avoid empty option when generating legacy mount string
    - ext4: Remove ext4 locking of moved directory
    - Revert "f2fs: fix potential corruption when moving a directory"
    - fs: Establish locking order for unrelated directories
    - fs: Lock moved directories
    - btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile
    - btrfs: fix race when deleting quota root from the dirty cow roots list
    - ARM: orion5x: fix d2net gpio initialization
    - leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename
    - fs: no need to check source
    - fanotify: disallow mount/sb marks on kernel internal pseudo fs
    - tpm, tpm_tis: Claim locality in interrupt handler
    - block: add overflow checks for Amiga partition support
    - netfilter: nf_tables: use net_generic infra for transaction data
    - netfilter: nf_tables: add rescheduling points during loop detection walks
    - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound
      set/chain
    - netfilter: nf_tables: reject unbound anonymous set before commit phase
    - netfilter: nf_tables: reject unbound chain set before commit phase
    - netfilter: nftables: rename set element data activation/deactivation
      functions
    - netfilter: nf_tables: drop map element references from preparation phase
    - netfilter: nf_tables: unbind non-anonymous set if rule construction fails
    - netfilter: nf_tables: fix scheduling-while-atomic splat
    - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
    - wireguard: queueing: use saner cpu selection wrapping
    - wireguard: netlink: send staged packets when setting initial private key
    - tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
    - rcu-tasks: Mark ->trc_reader_nesting data races
    - rcu-tasks: Mark ->trc_reader_special.b.need_qs data races
    - rcu-tasks: Simplify trc_read_check_handler() atomic operations
    - block/partition: fix signedness issue for Amiga partitions
    - io_uring: Use io_schedule* in cqring wait
    - io_uring: add reschedule point to handle_tw_list()
    - net: lan743x: Don't sleep in atomic context
    - workqueue: clean up WORK_* constant types, clarify masking
    - drm/panel: simple: Add connector_type for innolux_at043tn24
    - drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags
    - igc: Remove delay during TX ring configuration
    - net/mlx5e: fix double free in mlx5e_destroy_flow_table
    - net/mlx5e: Check for NOT_READY flag state after locking
    - igc: set TP bit in 'supported' and 'advertising' fields of
      ethtool_link_ksettings
    - scsi: qla2xxx: Fix error code in qla2x00_start_sp()
    - net: mvneta: fix txq_map in case of txq_number==1
    - net/sched: cls_fw: Fix improper refcount update leads to use-after-free
      (CVE-2023-3776)
    - gve: Set default duplex configuration to full
    - ionic: remove WARN_ON to prevent panic_on_warn
    - net: bgmac: postpone turning IRQs off to avoid SoC hangs
    - net: prevent skb corruption on frag list segmentation
    - icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
    - udp6: fix udp6_ehashfn() typo
    - ntb: idt: Fix error handling in idt_pci_driver_init()
    - NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
    - ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
    - NTB: ntb_transport: fix possible memory leak while device_register() fails
    - NTB: ntb_tool: Add check for devm_kcalloc
    - ipv6/addrconf: fix a potential refcount underflow for idev
    - [x86] platform/x86: wmi: remove unnecessary argument
    - [x86] platform/x86: wmi: use guid_t and guid_equal()
    - [x86] platform/x86: wmi: move variables
    - [x86] platform/x86: wmi: Break possible infinite loop when parsing GUID
    - igc: Fix launchtime before start of cycle
    - igc: Fix inserting of empty frame for launchtime
    - riscv: bpf: Move bpf_jit_alloc_exec() and bpf_jit_free_exec() to core
    - erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond
      EOF
    - wifi: airo: avoid uninitialized warning in airo_get_rate()
    - net/sched: flower: Ensure both minimum and maximum ports are specified
    - netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write()
    - net/sched: make psched_mtu() RTNL-less safe
    - net/sched: sch_qfq: refactor parsing of netlink parameters
    - net/sched: sch_qfq: account for stab overhead in qfq_enqueue
      (CVE-2023-3611)
    - nvme-pci: fix DMA direction of unmapping integrity data
    - f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
      (CVE-2023-2898)
    - pinctrl: amd: Fix mistake in handling clearing pins at startup
    - pinctrl: amd: Detect internal GPIO0 debounce handling
    - pinctrl: amd: Only use special debounce behavior for GPIO 0
    - tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
    - mtd: rawnand: meson: fix unaligned DMA buffers handling
    - net: bcmgenet: Ensure MDIO unregistration has clocks enabled
    - [powerpc*] Fail build if using recordmcount with binutils v2.37
    - misc: fastrpc: Create fastrpc scalar with correct buffer count
    - erofs: fix compact 4B support for 16k block size
    - ext4: Fix reusing stale buffer heads from last failed mounting
    - ext4: fix wrong unit use in ext4_mb_clear_bb
    - ext4: get block from bh in ext4_free_blocks for fast commit replay
    - ext4: fix wrong unit use in ext4_mb_new_blocks
    - ext4: only update i_reserved_data_blocks on successful block allocation
    - jfs: jfs_dmap: Validate db_l2nbperpage while mounting
    - hwrng: imx-rngc - fix the timeout for init and self check
    - PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold
    - PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
    - PCI: qcom: Disable write access to read only registers for IP v2.3.3
    - PCI: rockchip: Assert PCI Configuration Enable bit after probe
    - PCI: rockchip: Write PCI Device ID to correct register
    - PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked
    - PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core
    - PCI: rockchip: Use u32 variable to access 32-bit registers
    - PCI: rockchip: Set address alignment for endpoint mode
    - misc: pci_endpoint_test: Free IRQs before removing the device
    - misc: pci_endpoint_test: Re-init completion for every test
    - md/raid0: add discard support for the 'original' layout
    - fs: dlm: return positive pid value for F_GETLK
    - drm/atomic: Allow vblank-enabled + self-refresh "disable"
    - drm/rockchip: vop: Leave vblank enabled in self-refresh
    - drm/amd/display: Correct `DMUB_FW_VERSION` macro
    - serial: atmel: don't enable IRQs prematurely
    - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in
      case of error
    - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk()
      when iterating clk
    - firmware: stratix10-svc: Fix a potential resource leak in
      svc_create_memory_pool()
    - ceph: don't let check_caps skip sending responses for revoke msgs
    - xhci: Fix resume issue of some ZHAOXIN hosts
    - xhci: Fix TRB prefetch issue of ZHAOXIN hosts
    - xhci: Show ZHAOXIN xHCI root hub speed correctly
    - meson saradc: fix clock divider mask length
    - Revert "8250: add support for ASIX devices with a FIFO bug"
    - [s390x] decompressor: fix misaligned symbol build error
    - tracing/histograms: Add histograms to hist_vars if they have referenced
      variables
    - net: ena: fix shift-out-of-bounds in exponential backoff
    - ring-buffer: Fix deadloop issue on reading trace_pipe
    - tracing: Fix null pointer dereference in tracing_err_log_open()
    - tracing/probes: Fix not to count error code to total length
    - scsi: qla2xxx: Wait for io return on terminate rport
    - scsi: qla2xxx: Array index may go out of bound
    - scsi: qla2xxx: Fix buffer overrun
    - scsi: qla2xxx: Fix potential NULL pointer dereference
    - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
    - scsi: qla2xxx: Correct the index of array
    - scsi: qla2xxx: Pointer may be dereferenced
    - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
    - net/sched: sch_qfq: reintroduce lmax bound check for MTU
    - RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
    - drm/atomic: Fix potential use-after-free in nonblocking commits
    - ALSA: hda/realtek - remove 3k pull low procedure
    - ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx
    - keys: Fix linking a duplicate key to a keyring's assoc_array
    - perf probe: Add test for regression introduced by switch to
      die_get_decl_file()
    - btrfs: fix warning when putting transaction with qgroups enabled after
      abort
    - fuse: revalidate: don't invalidate if interrupted
    - regmap: Drop initial version of maximum transfer length fixes
    - regmap: Account for register length in SMBus I/O limits
    - can: bcm: Fix UAF in bcm_proc_show()
    - drm/client: Fix memory leak in drm_client_target_cloned
    - drm/client: Fix memory leak in drm_client_modeset_probe
    - ASoC: fsl_sai: Disable bit clock with transmitter
    - ext4: correct inline offset when handling xattrs in inode body
    - debugobjects: Recheck debug_objects_enabled before reporting
    - nbd: Add the maximum limit of allocated index in nbd_dev_add
    - md: fix data corruption for raid456 when reshape restart while grow up
    - md/raid10: prevent soft lockup while flush writes
    - posix-timers: Ensure timer ID search-loop limit is valid
    - btrfs: add xxhash to fast checksum implementations
    - ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A
    - ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3
    - ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e
      (3371 AMD version)
    - [arm64] set __exception_irq_entry with __irq_entry as a default
    - [arm64] mm: fix VA-range sanity check
    - sched/fair: Don't balance task to its current running CPU
    - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel
      range
    - bpf: Address KCSAN report on bpf_lru_list
    - devlink: report devlink_port_type_warn source device
    - wifi: wext-core: Fix -Wstringop-overflow warning in
      ioctl_standard_iw_point()
    - wifi: iwlwifi: mvm: avoid baid size integer overflow
    - igb: Fix igb_down hung on surprise removal
    - spi: bcm63xx: fix max prepend length
    - fbdev: imxfb: warn about invalid left/right margin
    - pinctrl: amd: Use amd_pinconf_set() for all config options
    - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
    - bridge: Add extack warning when enabling STP in netns.
    - iavf: Fix use-after-free in free_netdev
    - iavf: Fix out-of-bounds when setting channels on remove
    - security: keys: Modify mismatched function name
    - octeontx2-pf: Dont allocate BPIDs for LBK interfaces
    - tcp: annotate data-races around tcp_rsk(req)->ts_recent
    - net: ipv4: Use kfree_sensitive instead of kfree
    - net:ipv6: check return value of pskb_trim()
    - Revert "tcp: avoid the lookup process failing to get sk in ehash table"
    - fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
    - llc: Don't drop packet from non-root netns.
    - netfilter: nf_tables: fix spurious set element insertion failure
    - netfilter: nf_tables: can't schedule in nft_chain_validate
    - netfilter: nft_set_pipapo: fix improper element removal (CVE-2023-4004)
    - netfilter: nf_tables: skip bound chain in netns release path
    - netfilter: nf_tables: skip bound chain on rule flush
    - tcp: annotate data-races around tp->tcp_tx_delay
    - tcp: annotate data-races around tp->keepalive_time
    - tcp: annotate data-races around tp->keepalive_intvl
    - tcp: annotate data-races around tp->keepalive_probes
    - net: Introduce net.ipv4.tcp_migrate_req.
    - tcp: Fix data-races around sysctl_tcp_syn(ack)?_retries.
    - tcp: annotate data-races around icsk->icsk_syn_retries
    - tcp: annotate data-races around tp->linger2
    - tcp: annotate data-races around rskq_defer_accept
    - tcp: annotate data-races around tp->notsent_lowat
    - tcp: annotate data-races around icsk->icsk_user_timeout
    - tcp: annotate data-races around fastopenq.max_qlen
    - net: phy: prevent stale pointer dereference in phy_init()
    - tracing/histograms: Return an error if we fail to add histogram to
      hist_vars list
    - tracing: Fix memory leak of iter->temp when reading trace_pipe
    - ftrace: Store the order of pages allocated in ftrace_page
    - ftrace: Fix possible warning on checking all pages used in
      ftrace_process_locs()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.189
    - xen/netback: Fix buffer overrun triggered by unusual packet
      (CVE-2023-34319)
    - [x86] fix backwards merge of GDS/SRSO bit
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.190
    - [s390x] KVM: s390: pv: fix index value of replaced ASCE
    - io_uring: don't audit the capability check in io_uring_create()
    - btrfs: fix race between quota disable and relocation
    - btrfs: fix extent buffer leak after tree mod log failure at split_node()
    - i2c: Delete error messages for failed memory allocations
    - i2c: Improve size determinations
    - PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
    - PCI/ASPM: Factor out pcie_wait_for_retrain()
    - PCI/ASPM: Avoid link retraining race
    - dlm: cleanup plock_op vs plock_xop
    - dlm: rearrange async condition return
    - fs: dlm: interrupt posix locks only when process is killed
    - drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2
    - drm/ttm: never consider pinned BOs for eviction&swap
    - tracing: Show real address for trace event arguments
    - [arm64,armhf] pwm: meson: Simplify duplicated per-channel tracking
    - [arm64,armhf] pwm: meson: fix handling of period/duty if greater than
      UINT_MAX
    - ext4: fix to check return value of freeze_bdev() in ext4_shutdown()
    - i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
    - net: phy: marvell10g: fix 88x3310 power up
    - [arm64] net: hns3: reconstruct function hclge_ets_validate()
    - [arm64] net: hns3: fix wrong bw weight of disabled tc issue
    - vxlan: move to its own directory
    - vxlan: calculate correct header length for GPE
    - phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
    - ethernet: atheros: fix return value check in atl1e_tso_csum()
    - ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new
      temporary address
    - tcp: Reduce chance of collisions in inet6_hashfn(). (CVE-2023-1206)
    - ice: Fix memory management in ice_ethtool_fdir.c
    - bonding: reset bond's flags when down link is P2P device
    - team: reset team's flags when down link is P2P device
    - [x86] platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
    - netfilter: nft_set_rbtree: fix overlap expiration walk
    - netfilter: nftables: add helper function to validate set element data
    - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
    - netfilter: nf_tables: disallow rule addition to bound chain via
      NFTA_RULE_CHAIN_ID (CVE-2023-4147)
    - net/sched: mqprio: refactor nlattr parsing to a separate function
    - net/sched: mqprio: add extack to mqprio_parse_nlattr()
    - net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
    - benet: fix return value check in be_lancer_xmit_workarounds()
    - tipc: check return value of pskb_trim()
    - tipc: stop tipc crypto on failure in tipc_node_create
    - RDMA/mlx4: Make check for invalid flags stricter
    - drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
    - drm/msm/adreno: Fix snapshot BINDLESS_DATA size
    - RDMA/mthca: Fix crash when polling CQ for shared QPs
    - drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
    - [armhf] ASoC: fsl_spdif: Silence output on stop
    - block: Fix a source code comment in include/uapi/linux/blkzoned.h
    - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
    - dm raid: clean up four equivalent goto tags in raid_ctr()
    - dm raid: protect md_stop() with 'reconfig_mutex'
    - ata: pata_ns87415: mark ns87560_tf_read static
    - ring-buffer: Fix wrong stat of cpu_buffer->read
    - tracing: Fix warning in trace_buffered_event_disable()
    - Revert "usb: gadget: tegra-xudc: Fix error check in
      tegra_xudc_powerdomain_init()"
    - USB: gadget: Fix the memory leak in raw_gadget driver
    - serial: 8250_dw: Preserve original value of DLF register
    - USB: serial: option: support Quectel EM060K_128
    - USB: serial: option: add Quectel EC200A module support
    - USB: serial: simple: add Kaufmann RKS+CAN VCP
    - USB: serial: simple: sort driver entries
    - can: gs_usb: gs_can_close(): add missing set of CAN state to
      CAN_STATE_STOPPED
    - Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
    - usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
    - usb: dwc3: don't reset device side if dwc3 was configured as host-only
    - usb: ohci-at91: Fix the unhandle interrupt when resume
    - USB: quirks: add quirk for Focusrite Scarlett
    - usb: xhci-mtk: set the dma max_seg_size
    - Revert "usb: xhci: tegra: Fix error check"
    - Documentation: security-bugs.rst: update preferences when dealing with the
      linux-distros group
    - Documentation: security-bugs.rst: clarify CVE handling
    - staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
    - tty: n_gsm: fix UAF in gsm_cleanup_mux
    - ALSA: hda/relatek: Enable Mute LED on HP 250 G8
    - hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
    - btrfs: check for commit error at btrfs_attach_transaction_barrier()
    - file: always lock position for FMODE_ATOMIC_POS
    - nfsd: Remove incorrect check in nfsd4_validate_stateid
    - tpm_tis: Explicitly check for error code
    - [arm64,armhf] irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI
      invalidation
    - [x86] KVM: VMX: Invert handling of CR0.WP for EPT without unrestricted
      guest
    - [x86] KVM: VMX: Fold ept_update_paging_mode_cr0() back into vmx_set_cr0()
    - [x86] KVM: nVMX: Do not clear CR3 load/store exiting bits if L1 wants 'em
    - [x86] KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest
    - staging: rtl8712: Use constants from <linux/ieee80211.h>
    - staging: r8712: Fix memory leak in _r8712_init_xmit_priv()
    - btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
    - virtio-net: fix race between set queues and probe
    - [s390x] dasd: fix hanging device after quiesce/resume
    - [arm64] ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
    - ceph: never send metrics if disable_send_metrics is set
    - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
    - drm/ttm: make ttm_bo_unpin more defensive
    - ACPI: processor: perflib: Use the "no limit" frequency QoS
    - ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
    - [x86] cpufreq: intel_pstate: Drop ACPI _PSS states table patching
    - io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
    - [armel,armhf] ASoC: cs42l51: fix driver to properly autoload with
      automatic module loading
    - [x86] kprobes/x86: Fix fall-through warnings for Clang
    - [x86] kprobes: Do not decode opcode in resume_execution()
    - [x86] kprobes: Retrieve correct opcode for group instruction
    - [x86] kprobes: Identify far indirect JMP correctly
    - [x86] kprobes: Use int3 instead of debug trap for single-step
    - [x86] kprobes: Fix to identify indirect jmp and others using range case
    - [x86] kprobes: Move 'inline' to the beginning of the kprobe_is_ss()
      declaration
    - [x86] kprobes: Update kcb status flag after singlestepping
    - [x86] kprobes: Fix JNG/JNLE emulation
    - io_uring: gate iowait schedule on having pending requests
    - perf: Fix function pointer case
    - loop: Select I/O scheduler 'none' from inside add_disk()
    - [arm64] dts: imx8mn-var-som: add missing pull-up for onboard PHY reset
      pinmux
    - word-at-a-time: use the same return type for has_zero regardless of
      endianness
    - [s390x] KVM: s390: fix sthyi error handling
    - wifi: cfg80211: Fix return value in scan logic
    - net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
    - net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
    - bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing
    - rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length
    - [armhf] net: dsa: fix value check in bcm_sf2_sw_probe()
    - net: sched: cls_u32: Fix match key mis-addressing
    - mISDN: hfcpci: Fix potential deadlock on &hc->lock
    - net: annotate data-races around sk->sk_max_pacing_rate
    - net: add missing READ_ONCE(sk->sk_rcvlowat) annotation
    - net: add missing READ_ONCE(sk->sk_sndbuf) annotation
    - net: add missing READ_ONCE(sk->sk_rcvbuf) annotation
    - net: add missing data-race annotations around sk->sk_peek_off
    - net: add missing data-race annotation for sk_ll_usec
    - net/sched: cls_u32: No longer copy tcf_result on update to avoid
      use-after-free (CVE-2023-4128)
    - net/sched: cls_fw: No longer copy tcf_result on update to avoid
      use-after-free (CVE-2023-4128)
    - net/sched: cls_route: No longer copy tcf_result on update to avoid
      use-after-free (CVE-2023-4128)
    - bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire
    - net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode
    - net: dcb: choose correct policy to parse DCB_ATTR_BCN
    - [s390x] qeth: Don't call dev_close/dev_open (DOWN/UP)
    - ip6mr: Fix skb_under_panic in ip6mr_cache_report()
    - vxlan: Fix nexthop hash size
    - net/mlx5: fs_core: Make find_closest_ft more generic
    - net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio
    - tcp_metrics: fix addr_same() helper
    - tcp_metrics: annotate data-races around tm->tcpm_stamp
    - tcp_metrics: annotate data-races around tm->tcpm_lock
    - tcp_metrics: annotate data-races around tm->tcpm_vals[]
    - tcp_metrics: annotate data-races around tm->tcpm_net
    - tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
    - scsi: zfcp: Defer fc_rport blocking until after ADISC response
    - libceph: fix potential hang in ceph_osdc_notify()
    - USB: zaurus: Add ID for A-300/B-500/C-700
    - ceph: defer stopping mdsc delayed_work
    - exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree
    - exfat: release s_lock before calling dir_emit()
    - [arm64] dts: stratix10: fix incorrect I2C property for SCL signal
    - net: tun_chr_open(): set sk_uid from current_fsuid() (CVE-2023-4194)
    - net: tap_open(): set sk_uid from current_fsuid() (CVE-2023-4194)
    - bpf: Disable preemption in bpf_event_output
    - open: make RESOLVE_CACHED correctly test for O_TMPFILE
    - drm/ttm: check null pointer before accessing when swapping
    - file: reinstate f_pos locking optimization for regular files
    - tracing: Fix sleeping while atomic in kdb ftdump
    - fs/sysv: Null check to prevent null-ptr-deref bug
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
      (CVE-2023-40283)
    - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
    - fs: Protect reconfiguration of sb read-write from racing writes
    - [powerpc*] mm/altmap: Fix altmap boundary check
    - soundwire: bus: add better dev_dbg to track complete() calls
    - soundwire: bus: pm_runtime_request_resume on peripheral attachment
    - soundwire: fix enumeration completion
    - PM / wakeirq: support enabling wake-up irq after runtime_suspend called
    - PM: sleep: wakeirq: fix wake irq arming
    - exfat: speed up iterate/lookup by fixing start point of traversing cluster
      chain
    - exfat: support dynamic allocate bh for exfat_entry_set_cache
    - exfat: check if filename entries exceeds max filename length
      (CVE-2023-4273)
    - mt76: move band capabilities in mt76_phy
    - mt76: mt7615: Fix fall-through warnings for Clang
    - wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC)
    - [x86] CPU/AMD: Do not leak quotient data after a division by 0
      (CVE-2023-20588)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.191
    - wireguard: allowedips: expand maximum node depth
    - ipv6: adjust ndisc_is_useropt() to also return true for PIO
    - bpf: allow precision tracking for programs with subprogs
    - bpf: stop setting precise in current state
    - bpf: aggressively forget precise markings during state checkpointing
    - [arm64,armhf] dmaengine: pl330: Return DMA_PAUSED when transaction is
      paused
    - drm/nouveau/gr: enable memory loads on helper invocation on all channels
    - drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
    - drm/amd/display: check attr flag before set cursor degamma on DCN3+
    - [x86] x86/pkeys: Revert a5eff7259790 ("x86/pkeys: Add PKRU value to
      init_fpstate") (Closes: #1044518)
    - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
    - io_uring: correct check for O_TMPFILE
    - [arm64] iio: cros_ec: Fix the allocation size for cros_ec_command
    - [arm*] binder: fix memory leak in binder_init()
    - usb-storage: alauda: Fix uninit-value in alauda_check_media()
    - [arm64,armhf] usb: dwc3: Properly handle processing of pending events
    - [arm64,armhf] usb: common: usb-conn-gpio: Prevent bailing out if initial
      role is none
    - [x86] cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
    - [x86] mm: Fix VDSO and VVAR placement on 5-level paging machines
    - [x86] speculation: Add cpu_show_gds() prototype
    - [x86] Move gds_ucode_mitigated() declaration to header
    - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
    - mISDN: Update parameter type of dsp_cmx_send()
    - net/packet: annotate data-races around tp->status
    - tunnels: fix kasan splat when generating ipv4 pmtu error
    - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
    - dccp: fix data-race around dp->dccps_mss_cache
    - drivers: net: prevent tun_build_skb() to exceed the packet size limit
    - [amd64] IB/hfi1: Fix possible panic during hotplug remove
    - wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
    - net: phy: at803x: remove set/get wol callbacks for AR8032
    - [arm64] net: hns3: refactor hclge_mac_link_status_wait for interface reuse
    - [arm64] net: hns3: add wait until mac link down
    - net/mlx5: Allow 0 for total host VFs
    - btrfs: don't stop integrity writeback too early
    - btrfs: set cache_block_group_error if we find an error
    - nvme-tcp: fix potential unbalanced freeze & unfreeze
    - nvme-rdma: fix potential unbalanced freeze & unfreeze
    - netfilter: nf_tables: report use refcount overflow
    - scsi: core: Fix legacy /proc parsing buffer overflow
    - [x86] scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
    - scsi: snic: Fix possible memory leak if device_add() fails
    - scsi: core: Fix possible memory leak if device_add() fails
    - scsi: qedi: Fix firmware halt over suspend and resume
    - scsi: qedf: Fix firmware halt over suspend and resume
    - sch_netem: fix issues in netem_change() vs get_dist_table()

  [ Ben Hutchings ]
  * d/b/test-patches: Fix installability; improve robustness and efficiency
    (Closes: #871216, #1035359):
    - d/b/gencontrol.py: Add optional extra config dir debian/config.local
    - d/b/gencontrol.py: Add support for noudeb build profile
    - d/b/test-patches: Change ABI name to make packages co-installable
    - d/b/test-patches: Make debug info optional and disabled by default
    - d/b/test-patches: Build a linux-headers-common package as well
    - d/b/test-patches: Tolerate missing d/control, d/rules.gen, or d/p/test
    - d/b/test-patches: Detect flavour correctly when running backported kernel
    - Add pkg.linux.mintools profile for building minimal userland tools
    - d/b/test-patches: Build linux-{kbuild,bootwrapper} packages

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.10.180-rt88
  * Bump ABI to 25
  * Drop unknown config setting NET_CLS_TCINDEX
  * Drop unknown config setting BLK_DEV_SX8
  * [rt] Update to 5.10.184-rt90
  * Drop "decnet: Disable auto-loading as mitigation against local exploits"
  * Drop now unknown config options for DECnet support
  * [rt] Update to 5.10.186-rt91

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 16 Aug 2023 22:52:03 +0200

linux (5.10.179-5) bullseye-security; urgency=high

  * Fix "init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init()"
    backport

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 08 Aug 2023 13:22:46 +0200

linux (5.10.179-4) bullseye-security; urgency=high

  [ Salvatore Bonaccorso ]
  * [x86] Add mitigations for Gather Data Sampling (GDS) (CVE-2022-40982)
    - init: Provide arch_cpu_finalize_init()
    - x86/cpu: Switch to arch_cpu_finalize_init()
    - ARM: cpu: Switch to arch_cpu_finalize_init()
    - ia64/cpu: Switch to arch_cpu_finalize_init()
    - m68k/cpu: Switch to arch_cpu_finalize_init()
    - mips/cpu: Switch to arch_cpu_finalize_init()
    - sh/cpu: Switch to arch_cpu_finalize_init()
    - sparc/cpu: Switch to arch_cpu_finalize_init()
    - um/cpu: Switch to arch_cpu_finalize_init()
    - init: Remove check_bugs() leftovers
    - init: Invoke arch_cpu_finalize_init() earlier
    - init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init()
    - x86/fpu: Remove cpuinfo argument from init functions
    - x86/fpu: Mark init functions __init
    - x86/fpu: Move FPU initialization into arch_cpu_finalize_init()
    - x86/speculation: Add Gather Data Sampling mitigation
    - x86/speculation: Add force option to GDS mitigation
    - x86/speculation: Add Kconfig option for GDS
    - KVM: Add GDS_NO support to KVM
    - x86/xen: Fix secondary processors' FPU initialization
    - x86/mm: fix poking_init() for Xen PV guests
    - x86/mm: Use mm_alloc() in poking_init()
    - mm: Move mm_cachep initialization to mm_init()
    - x86/mm: Initialize text poking earlier

  [ Ben Hutchings ]
  * Documentation/x86: Fix backwards on/off logic about YMM support
  * [x86] Add a Speculative RAS Overflow (SRSO) mitigation (CVE-2023-20569)
    - x86/cpu: Add VM page flush MSR availablility as a CPUID feature
    - x86/cpufeatures: Assign dedicated feature word for CPUID_0x8000001F[EAX]
    - tools headers cpufeatures: Sync with the kernel sources
    - x86/bugs: Increase the x86 bugs vector size to two u32s
    - x86/cpu, kvm: Add support for CPUID_80000021_EAX
    - x86/srso: Add a Speculative RAS Overflow mitigation
    - x86/srso: Add IBPB_BRTYPE support
    - x86/srso: Add SRSO_NO support
    - x86/srso: Add IBPB
    - x86/srso: Add IBPB on VMEXIT
    - x86/srso: Fix return thunks in generated code
    - x86/srso: Tie SBPB bit setting to microcode patch detection
  * Bump ABI to 24

 -- Ben Hutchings <benh@debian.org>  Tue, 08 Aug 2023 02:33:54 +0200

linux (5.10.179-3) bullseye-security; urgency=high

  [ Salvatore Bonaccorso ]
  * [x86] microcode/AMD: Load late on both threads too
  * [x86] cpu/amd: Move the errata checking functionality up
  * [x86] cpu/amd: Add a Zenbleed fix (CVE-2023-20593)
  * netfilter: nftables: statify nft_parse_register()
  * netfilter: nf_tables: validate registers coming from userspace.
  * netfilter: nf_tables: hold mutex on netns pre_exit path
  * netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
    (CVE-2023-3390)
  * Ignore ABI changes for nft_parse_register (dropped with 08a01c11a5bb
    ("netfilter: nftables: statify nft_parse_register()"))

  [ Ben Hutchings ]
  * netfilter: nf_tables: fix chain binding transaction logic (CVE-2023-3610)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 28 Jul 2023 00:17:15 +0200

linux (5.10.179-2) bullseye-security; urgency=high

  * ipv6: rpl: Fix Route of Death. (CVE-2023-2156)
  * netfilter: nf_tables: do not ignore genmask when looking up chain by id
    (CVE-2023-31248)
  * netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
    (CVE-2023-35001)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 14 Jul 2023 22:24:08 +0200

linux (5.10.179-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.179
    - [arm64] dts: qcom: ipq8074-hk01: enable QMP device, not the PHY node
    - netfilter: br_netfilter: fix recent physdev match breakage
    - [arm64,armhf] regulator: fan53555: Explicitly include bits header
    - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
      (CVE-2023-31436)
    - virtio_net: bugfix overflow inside xdp_linearize_page()
    - sfc: Split STATE_READY in to STATE_NET_DOWN and STATE_NET_UP.
    - sfc: Fix use-after-free due to selftest_work
    - netfilter: nf_tables: fix ifdef to also consider nf_tables=m
    - i40e: fix accessing vsi->active_filters without holding lock
    - i40e: fix i40e_setup_misc_vector() error handling
    - mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
    - net: rpl: fix rpl header size calculation
    - bpf: Fix incorrect verifier pruning due to missing register precision
      taints
    - e1000e: Disable TSO on i219-LM card to increase speed
    - f2fs: Fix f2fs_truncate_partial_nodes ftrace event
    - Input: i8042 - add quirk for Fujitsu Lifebook A574/H
    - scsi: megaraid_sas: Fix fw_crash_buffer_show()
    - scsi: core: Improve scsi_vpd_inquiry() checks
    - [s390x] ptrace: fix PTRACE_GET_LAST_BREAK error handling
    - nvme-tcp: fix a possible UAF when failing to allocate an io queue
    - xen/netback: use same error messages for same errors
    - xfs: drop submit side trans alloc for append ioends
    - iio: light: tsl2772: fix reading proximity-diodes from device tree
    - nilfs2: initialize unused bytes in segment summary blocks
    - memstick: fix memory leak if card device is never registered
    - kernel/sys.c: fix and improve control flow in __sys_setres[ug]id()
    - mm/khugepaged: check again on anon uffd-wp during isolation
    - sched/uclamp: Make task_fits_capacity() use util_fits_cpu()
    - sched/uclamp: Fix fits_capacity() check in feec()
    - sched/uclamp: Make select_idle_capacity() use util_fits_cpu()
    - sched/uclamp: Make asym_fits_capacity() use util_fits_cpu()
    - sched/uclamp: Make cpu_overutilized() use util_fits_cpu()
    - sched/uclamp: Cater for uclamp in find_energy_efficient_cpu()'s early exit
      condition
    - sched/fair: Detect capacity inversion
    - sched/fair: Consider capacity inversion in util_fits_cpu()
    - sched/uclamp: Fix a uninitialized variable warnings
    - sched/fair: Fixes for capacity inversion detection
    - virtiofs: clean up error handling in virtio_fs_get_tree()
    - virtiofs: split requests that exceed virtqueue size
    - fuse: check s_root when destroying sb
    - fuse: fix attr version comparison in fuse_read_update_size()
    - fuse: always revalidate rename target dentry
    - fuse: fix deadlock between atomic O_TRUNC and page invalidation
    - Revert "ext4: fix use-after-free in ext4_xattr_set_entry"
    - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set()
    - ext4: fix use-after-free in ext4_xattr_set_entry
    - udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM).
    - tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
    - inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
    - dccp: Call inet6_destroy_sock() via sk->sk_destruct().
    - sctp: Call inet6_destroy_sock() via sk->sk_destruct().
    - [arm64,armhf] pwm: meson: Explicitly set .polarity in .get_state()
    - ASN.1: Fix check for strdup() success

  [ Salvatore Bonaccorso ]
  * netfilter: nf_tables: deactivate anonymous set from preparation phase
    (CVE-2023-32233)
  * [rt] Refresh "sched/hotplug: Ensure only per-cpu kthreads run during
    hotplug"
  * Bump ABI to 23
  * ovl: fail on invalid uid/gid mapping at copy up (CVE-2023-0386)
  * [x86] KVM: x86: hyper-v: Avoid calling kvm_make_vcpus_request_mask() with
    vcpu_mask==NULL (Closes: #1035779)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 12 May 2023 06:08:40 +0200

linux (5.10.178-3) bullseye; urgency=medium

  * [mips*] Define RUNTIME_DISCARD_EXIT in LD script

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 22 Apr 2023 14:24:15 +0200

linux (5.10.178-2) bullseye; urgency=medium

  * docs: futex: Fix kernel-doc references after code split-up preparation
  * powerpc/doc: Fix htmldocs errors

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 22 Apr 2023 00:51:39 +0200

linux (5.10.178-1) bullseye; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.163
    - [arm64,armhf] usb: musb: remove extra check in musb_gadget_vbus_draw
    - [arm64] dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins
    - [armhf] dts: stm32: Drop stm32mp15xc.dtsi from Avenger96
    - [arm64] perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
    - [arm64] dts: armada-3720-turris-mox: Add missing interrupt for RTC
    - pstore/ram: Fix error return code in ramoops_probe()
    - [armhf] mmp: fix timer_read delay
    - pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
    - sched/fair: Cleanup task_util and capacity type
    - sched/uclamp: Fix relationship between uclamp and migration margin
    - cpuidle: dt: Return the correct numbers of parsed idle states
    - PM: hibernate: Fix mistake in kerneldoc comment
    - fs: don't audit the capability check in simple_xattr_list()
    - perf: Fix possible memleak in pmu_dev_alloc()
    - [x86] platform/x86: huawei-wmi: fix return value calculation
    - timerqueue: Use rb_entry_safe() in timerqueue_getnext()
    - lib/fonts: fix undefined behavior in bit shift for get_default_font
    - ocfs2: fix memory leak in ocfs2_stack_glue_init()
    - PNP: fix name memory leak in pnp_alloc_dev()
    - [x86] perf/x86/intel/uncore: Fix reference count leak in
      hswep_has_limit_sbox()
    - [x86] perf/x86/intel/uncore: Fix reference count leak in
      snr_uncore_mmio_map()
    - [x86] perf/x86/intel/uncore: Fix reference count leak in
      __uncore_imc_init_box()
    - [arm64] platform/chrome: cros_usbpd_notify: Fix error handling in
      cros_usbpd_notify_init()
    - [arm64] irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
    - [amd64] EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
    - nfsd: don't call nfsd_file_put from client states seqfile display
    - genirq/irqdesc: Don't try to remove non-existing sysfs files
    - [x86] cpufreq: amd_freq_sensitivity: Add missing pci_dev_put()
    - libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
    - lib/notifier-error-inject: fix error when writing -errno to debugfs file
    - docs: fault-injection: fix non-working usage of negative values
    - debugfs: fix error when writing negative value to atomic_t debugfs file
    - ocfs2: ocfs2_mount_volume does cleanup job before return error
    - ocfs2: rewrite error handling of ocfs2_fill_super
    - ocfs2: fix memory leak in ocfs2_mount_volume()
    - rapidio: fix possible name leaks when rio_add_device() fails
    - rapidio: rio: fix possible name leak in rio_register_mport()
    - futex: Move to kernel/futex/
    - futex: Resend potentially swallowed owner death notification
    - cpu/hotplug: Make target_store() a nop when target == state
    - [armhf] clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare
      in dmtimer_systimer_init_clock()
    - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
    - [x86] uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix
    - [x86] xen: Fix memory leak in xen_smp_intr_init{_pv}()
    - [x86] xen: Fix memory leak in xen_init_lock_cpu()
    - xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()
    - PM: runtime: Improve path in rpm_idle() when no callback
    - PM: runtime: Do not call __rpm_callback() from rpm_idle()
    - [x86] platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
    - [x86] platform/x86: intel_scu_ipc: fix possible name leak in
      __intel_scu_ipc_register()
    - fs: sysv: Fix sysv_nblocks() returns wrong value
    - rapidio: fix possible UAF when kfifo_alloc() fails
    - eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
    - relay: fix type mismatch when allocating memory in relay_create_buf()
    - hfs: Fix OOB Write in hfs_asc2mac
    - rapidio: devices: fix missing put_device in mport_cdev_open
    - wifi: ath9k: hif_usb: fix memory leak of urbs in
      ath9k_hif_usb_dealloc_tx_urbs()
    - wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
    - wifi: rtl8xxxu: Fix reading the vendor of combo chips
    - [arm64] drm/bridge: adv7533: remove dynamic lane switching from adv7533
      bridge
    - [armhf] media: coda: jpeg: Add check for kmalloc
    - [arm64] venus: pm_helpers: Fix error check in vcodec_domains_get()
    - can: kvaser_usb: do not increase tx statistics when sending error message
      frames
    - can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device
    - can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to
      {leaf,usbcan}_cmd_can_error_event
    - can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT
    - can: kvaser_usb_leaf: Set Warning state even without bus errors
    - can: kvaser_usb_leaf: Fix improved state not being reported
    - can: kvaser_usb_leaf: Fix wrong CAN state after stopping
    - can: kvaser_usb_leaf: Fix bogus restart events
    - can: kvaser_usb: Add struct kvaser_usb_busparams
    - can: kvaser_usb: Compare requested bittiming parameters with actual
      parameters in do_set_{,data}_bittiming
    - spi: Update reference to struct spi_controller
    - ima: Fix fall-through warnings for Clang
    - ima: Handle -ESTALE returned by ima_filter_rule_match()
    - [arm64] drm/msm/hdmi: switch to drm_bridge_connector
    - [arm64] drm/msm/hdmi: drop unused GPIO support
    - bpf: Fix slot type check in check_stack_write_var_off
    - media: vivid: fix compose size exceed boundary
    - bpf: propagate precision in ALU/ALU64 operations
    - bpf: Check the other end of slot_type for STACK_SPILL
    - bpf: propagate precision across all frames, not just the last one
    - mtd: Fix device name leak when register device failed in add_mtd_device()
    - wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port
    - rxrpc: Fix ack.bufferSize to be 0 when generating an ack
    - drm/radeon: Add the missed acpi_put_table() to fix memory leak
    - regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()
    - amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
    - drm/fourcc: Add packed 10bit YUV 4:2:0 format
    - drm/fourcc: Fix vsub/hsub for Q410 and Q401
    - integrity: Fix memory leakage in keyring allocation error path
    - ima: Fix misuse of dereference of pointer in template_desc_init_fields()
    - wifi: ath10k: Fix return value in ath10k_pci_init()
    - mtd: lpddr2_nvm: Fix possible null-ptr-deref
    - Input: elants_i2c - properly handle the reset GPIO when power is off
    - media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()
    - media: solo6x10: fix possible memory leak in solo_sysfs_init()
    - inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict()
    - bpf: Move skb->len == 0 checks into __bpf_redirect
    - HID: hid-sensor-custom: set fixed size for custom attributes
    - ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT
    - ALSA: seq: fix undefined behavior in bit shift for
      SNDRV_SEQ_FILTER_USE_EVENT
    - regulator: core: use kfree_const() to free space conditionally
    - [arm64,armhf] clk: rockchip: Fix memory leak in
      rockchip_clk_register_pll()
    - drm/amdgpu: fix pci device refcount leak
    - bonding: fix link recovery in mode 2 when updelay is nonzero
    - drbd: fix an invalid memory access caused by incorrect use of list
      iterator
    - media: imon: fix a race condition in send_packet()
    - [arm64] clk: imx: replace osc_hdmi with dummy
    - pinctrl: pinconf-generic: add missing of_node_put()
    - media: dvb-core: Fix ignored return value in dvb_register_frontend()
    - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
      (CVE-2023-28328)
    - [arm64,armhf] drm/tegra: Add missing clk_disable_unprepare() in
      tegra_dc_probe()
    - ASoC: dt-bindings: wcd9335: fix reset line polarity in example
    - NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding
    - NFSv4.2: Fix a memory stomp in decode_attr_security_label
    - NFSv4.2: Fix initialisation of struct nfs4_label
    - NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn
    - NFS: Fix an Oops in nfs_d_automount()
    - [x86] ALSA: asihpi: fix missing pci_disable_device()
    - wifi: iwlwifi: mvm: fix double free on tx path.
    - drm/amd/pm/smu11: BACO is supported when it's in BACO state
    - drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
    - drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
    - netfilter: conntrack: set icmpv6 redirects as RELATED
    - bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
    - bpf, sockmap: Fix data loss caused by using apply_bytes on ingress
      redirect
    - bonding: uninitialized variable in bond_miimon_inspect()
    - spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE
    - wifi: mac80211: fix memory leak in ieee80211_if_add()
    - wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys()
      fails
    - regulator: core: fix module refcount leak in set_supply()
    - regulator: core: fix resource leak in regulator_register()
    - hwmon: (jc42) Convert register access and caching to regmap/regcache
    - hwmon: (jc42) Restore the min/max/critical temperatures on resume
    - bpf, sockmap: fix race in sock_map_free()
    - ALSA: pcm: Set missing stop_operating flag at undoing trigger start
    - media: saa7164: fix missing pci_disable_device()
    - ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
    - xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
    - SUNRPC: Fix missing release socket in rpc_sockname()
    - NFSv4.x: Fail client initialisation if state manager thread can't run
    - [armhf] media: coda: Add check for dcoda_iram_alloc
    - [armhf] media: coda: Add check for kmalloc
    - [armhf] clk: samsung: Fix memory leak in _samsung_clk_register_pll()
    - [armhf] spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode
    - wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h
    - wifi: rtl8xxxu: Fix the channel width reporting
    - wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware()
    - blktrace: Fix output non-blktrace event when blk_classic option enabled
    - [armhf] clk: socfpga: clk-pll: Remove unused variable 'rc'
    - [armhf] clk: socfpga: use clk_hw_register for a5/c5
    - [armhf] clk: socfpga: Fix memory leak in socfpga_gate_init()
    - [x86] net: vmw_vsock: vmci: Check memcpy_from_msg()
    - net: defxx: Fix missing err handling in dfx_init()
    - drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()
    - of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry()
      and find_dup_cset_prop()
    - ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave()
    - net: farsync: Fix kmemleak when rmmods farsync
    - net/tunnel: wait until all sk_user_data reader finish before releasing the
      sock
    - hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()
    - [i386] net: amd: lance: don't call dev_kfree_skb() under
      spin_lock_irqsave()
    - [amd64,arm64] net: amd-xgbe: Fix logic around active and passive cables
    - [amd64,arm64] net: amd-xgbe: Check only the minimum speed for
      active/passive cables
    - sctp: sysctl: make extra pointers netns aware
    - Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave()
    - Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
    - Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave()
    - Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()
    - Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
    - Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
    - Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave()
    - stmmac: fix potential division by 0
    - apparmor: fix a memleak in multi_transaction_new()
    - apparmor: fix lockdep warning when removing a namespace
    - apparmor: Fix abi check to include v8 abi
    - [arm64] crypto: nitrox - avoid double free on error path in
      nitrox_sriov_init()
    - scsi: core: Fix a race between scsi_done() and scsi_timeout()
    - apparmor: Use pointer to struct aa_label for lbs_cred
    - [arm64,armhf] PCI: dwc: Fix n_fts[] array overrun
    - RDMA/core: Fix order of nldev_exit call
    - f2fs: Fix the race condition of resize flag between resizefs
    - apparmor: Fix memleak in alloc_ns()
    - f2fs: fix normal discard process
    - RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port
    - scsi: scsi_debug: Fix a warning in resp_write_scat()
    - crypto: cryptd - Use request context instead of stack for sub-request
    - [arm64] RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data()
    - [arm64] RDMA/hns: Fix ext_sge num error when post send
    - PCI: Check for alloc failure in pci_request_irq()
    - [amd64] RDMA/hfi: Decrease PCI device reference count in error path
    - [arm64] RDMA/hns: fix memory leak in hns_roce_alloc_mr()
    - RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create
      failed
    - scsi: hpsa: Fix possible memory leak in hpsa_init_one()
    - crypto: tcrypt - Fix multibuffer skcipher speed test mem leak
    - padata: Always leave BHs disabled when running ->parallel()
    - padata: Fix list iterator in padata_do_serial()
    - scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
    - scsi: hpsa: Fix error handling in hpsa_add_sas_host()
    - scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
    - scsi: scsi_debug: Fix a warning in resp_verify()
    - scsi: scsi_debug: Fix a warning in resp_report_zones()
    - scsi: fcoe: Fix possible name leak when device_register() fails
    - scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper()
    - scsi: ipr: Fix WARNING in ipr_init()
    - scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
    - scsi: snic: Fix possible UAF in snic_tgt_create()
    - RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps()
    - f2fs: avoid victim selection from previous victim section
    - RDMA/nldev: Fix failure to send large messages
    - [arm64,armhf] crypto: amlogic - Remove kcalloc without check
    - [amd64] RDMA/hfi1: Fix error return code in parse_platform_config()
    - RDMA/srp: Fix error return code in srp_parse_options()
    - orangefs: Fix sysfs not cleanup when dev init failed
    - [arm64] RDMA/hns: Fix PBL page MTR find
    - [arm64] RDMA/hns: Fix page size cap from firmware
    - [x86] hwrng: amd - Fix PCI device refcount leak
    - [i386] hwrng: geode - Fix PCI device refcount leak
    - IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces
    - [arm64,armhf] serial: tegra: Read DMA status before terminating
    - class: fix possible memory leak in __class_register()
    - vfio: platform: Do not pass return buffer to ACPI _RST method
    - usb: typec: Check for ops->exit instead of ops->enter in altmode_exit
    - usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()
    - usb: typec: tipd: Fix spurious fwnode_handle_put in error path
    - [arm*] serial: amba-pl011: avoid SBSA UART accessing DMACR register
    - [arm*] serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle.
    - [i386] serial: pch: Fix PCI device refcount leak in pch_request_dma()
    - tty: serial: clean up stop-tx part in altera_uart_tx_chars()
    - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
    - misc: sgi-gru: fix use-after-free error in gru_set_context_option,
      gru_fault and gru_handle_user_call_os (CVE-2022-3424)
    - [arm*] firmware: raspberrypi: fix possible memory leak in
      rpi_firmware_probe()
    - iio: temperature: ltc2983: make bulk write buffer DMA-safe
    - genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()
    - iio:imu:adis: Use IRQF_NO_AUTOEN instead of irq request then disable
    - iio: adis: handle devices that cannot unmask the drdy pin
    - iio: adis: stylistic changes
    - iio:imu:adis: Move exports into IIO_ADISLIB namespace
    - iio: adis: add '__adis_enable_irq()' implementation
    - usb: roles: fix of node refcount leak in usb_role_switch_is_parent()
    - usb: gadget: f_hid: optional SETUP/SET_REPORT mode
    - usb: gadget: f_hid: fix f_hidg lifetime vs cdev
    - usb: gadget: f_hid: fix refcount leak on error path
    - chardev: fix error handling in cdev_device_add()
    - [i386] i2c: pxa-pci: fix missing pci_disable_device() on error in
      ce4100_i2c_probe
    - [x86] staging: rtl8192u: Fix use after free in ieee80211_rx()
    - [x86] staging: rtl8192e: Fix potential use-after-free in
      rtllib_rx_Monitor()
    - gpiolib: Get rid of redundant 'else'
    - gpiolib: cdev: fix NULL-pointer dereferences
    - usb: storage: Add check for kcalloc
    - tracing/hist: Fix issue of losting command info in error_log
    - fbdev: pm2fb: fix missing pci_disable_device()
    - [x86] fbdev: via: Fix error in via_core_init()
    - [x86] fbdev: vermilion: decrease reference count in error path
    - [x86] fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
    - [armhf] HSI: omap_ssi_core: fix unbalanced pm_runtime_disable()
    - [armhf] HSI: omap_ssi_core: fix possible memory leak in ssi_probe()
    - power: supply: fix residue sysfs file in error handle route of
      __power_supply_register()
    - perf trace: Return error if a system call doesn't exist
    - perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number
    - perf trace: Handle failure when trace point folder is missed
    - perf symbol: correction while adjusting symbol
    - [armhf] HSI: omap_ssi_core: Fix error handling in ssi_init()
    - power: supply: fix null pointer dereferencing in
      power_supply_get_battery_info
    - [arm64,armhf] pwm: tegra: Improve required rate calculation
    - dmaengine: idxd: Fix crc_val field for completion record
    - rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0
    - rtc: cmos: Fix event handler registration ordering issue
    - rtc: cmos: Fix wake alarm breakage
    - rtc: cmos: fix build on non-ACPI platforms
    - rtc: cmos: Call cmos_wake_setup() from cmos_do_probe()
    - rtc: cmos: Call rtc_wake_setup() from cmos_do_probe()
    - rtc: cmos: Eliminate forward declarations of some functions
    - rtc: cmos: Rename ACPI-related functions
    - rtc: cmos: Disable ACPI RTC event on removal
    - [armhf] rtc: snvs: Allow a time difference on clock register read
    - [arm64] rtc: pcf85063: Fix reading alarm
    - [amd64] iommu/amd: Fix pci device refcount leak in ppr_notifier()
    - [powerpc*] xmon: Enable breakpoints on 8xx
    - [powerpc*] xmon: Fix -Wswitch-unreachable warning in bpt_cmds
    - [powerpc*] xive: add missing iounmap() in error path in
      xive_spapr_populate_irq_data()
    - kbuild: remove unneeded mkdir for external modules_install
    - kbuild: unify modules(_install) for in-tree and external modules
    - kbuild: refactor single builds of *.ko
    - [powerpc*] perf: callchain validate kernel stack pointer bounds
    - [powerpc*] hv-gpci: Fix hv_gpci event list
    - [powerpc*] eeh: Drop redundant spinlock initialization
    - [powerpc*] pseries/eeh: use correct API for error log size
    - netfilter: flowtable: really fix NAT IPv6 offload
    - [arm64] rtc: pcf85063: fix pcf85063_clkout_control
    - NFSD: Remove spurious cb_setup_err tracepoint
    - nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
    - net: macsec: fix net device access prior to holding a lock
    - mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under
      spin_lock_irqsave()
    - mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under
      spin_lock_irqsave()
    - mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under
      spin_lock_irqsave()
    - nfc: pn533: Clear nfc_target before being used
    - r6040: Fix kmemleak in probe and remove
    - net: switch to storing KCOV handle directly in sk_buff
    - net: add inline function skb_csum_is_sctp
    - net: igc: use skb_csum_is_sctp instead of protocol check
    - net: add a helper to avoid issues with HW TX timestamping and SO_TXTIME
    - igc: Enhance Qbv scheduling by using first flag bit
    - igc: Use strict cycles for Qbv scheduling
    - igc: Add checking for basetime less than zero
    - igc: recalculate Qbv end_time by considering cycle time
    - igc: Lift TAPRIO schedule restriction
    - igc: Set Qbv start_time and end_time to end_time if not being configured
      in GCL
    - openvswitch: Fix flow lookup to use unmasked key
    - skbuff: Account for tail adjustment during pull operations
    - [arm64] mailbox: zynq-ipi: fix error handling while device_register()
      fails
    - net_sched: reject TCF_EM_SIMPLE case for complex ematch module
    - rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
    - myri10ge: Fix an error handling path in myri10ge_probe()
    - net: stream: purge sk_error_queue in sk_stream_kill_queues()
    - rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()
    - [arm64] make is_ttbrX_addr() noinstr-safe
    - video: hyperv_fb: Avoid taking busy spinlock on panic path
    - [x86] hyperv: Remove unregister syscore call from Hyper-V cleanup
    - binfmt_misc: fix shift-out-of-bounds in check_special_flags
    - fs: jfs: fix shift-out-of-bounds in dbAllocAG
    - udf: Avoid double brelse() in udf_rename()
    - fs: jfs: fix shift-out-of-bounds in dbDiscardAG
    - ACPICA: Fix error code path in acpi_ds_call_control_method()
    - nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
    - nilfs2: fix shift-out-of-bounds due to too large exponent of block size
    - acct: fix potential integer overflow in encode_comp_t()
    - hfs: fix OOB Read in __hfs_brec_find
    - [armhf] drm/etnaviv: add missing quirks for GC300
    - brcmfmac: return error when getting invalid max_flowrings from dongle
    - wifi: ath9k: verify the expected usb_endpoints are present
    - wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
    - ipmi: fix memleak when unload ipmi driver
    - drm/amd/display: prevent memory leak
    - qed (gcc13): use u16 for fid to be big enough
    - bpf: make sure skb->len != 0 when redirecting to a tunneling device
    - hamradio: baycom_epp: Fix return type of baycom_send_packet()
    - wifi: brcmfmac: Fix potential shift-out-of-bounds in
      brcmf_fw_alloc_request()
    - igb: Do not free q_vector unless new one was allocated
    - drm/amdgpu: Fix type of second parameter in trans_msg() callback
    - drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback
    - [s390x] ctcm: Fix return type of ctc{mp,}m_tx()
    - [s390x] netiucv: Fix return type of netiucv_tx()
    - [s390x] lcs: Fix return type of lcs_start_xmit()
    - [arm64] drm/msm: Use drm_mode_copy()
    - [arm64] drm/rockchip: Use drm_mode_copy()
    - drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
    - md/raid1: stop mdx_raid1 thread when raid1 array run failed
    - drm/amd/display: fix array index out of bound error in bios parser
    - net: add atomic_long_t to net_device_stats fields
    - mrp: introduce active flags to prevent UAF when applicant uninit
    - ppp: associate skb with a device at tx
    - bpf: Prevent decl_tag from being referenced in func_proto arg
    - ethtool: avoiding integer overflow in ethtool_phys_id()
    - media: dvb-frontends: fix leak of memory fw
    - media: dvbdev: adopts refcnt to avoid UAF
    - media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
    - blk-mq: fix possible memleak when register 'hctx' failed
    - regulator: core: fix use_count leakage when handling boot-on
    - [arm64] mmc: f-sdh30: Add quirks for broken timeout clock capability
    - media: si470x: Fix use-after-free in si470x_int_in_callback()
    - hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()
    - orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
    - orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()
    - hwmon: (jc42) Fix missing unlock on error in jc42_write()
    - ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c
    - ALSA: hda: add snd_hdac_stop_streams() helper
    - [x86] ASoC: Intel: Skylake: Fix driver hang during shutdown
    - ASoC: audio-graph-card: fix refcount leak of cpu_ep in
      __graph_for_each_link()
    - [x86] ASoC: rt5670: Remove unbalanced pm_runtime_put()
    - pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion
    - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct
      values in perf_quiet_option()
    - afs: Fix lost servers_outstanding count
    - pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES
    - ima: Simplify ima_lsm_copy_rule
    - ALSA: usb-audio: add the quirk for KT0206 device
    - ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB
    - ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list
    - [arm64,armhf] usb: dwc3: Fix race between dwc3_set_mode and
      __dwc3_set_mode
    - [arm64,armhf] usb: dwc3: core: defer probe on ulpi_read_id timeout
    - HID: wacom: Ensure bootloader PID is usable in hidraw mode
    - reiserfs: Add missing calls to reiserfs_security_free()
    - iio: adc: ad_sigma_delta: do not use internal iio_dev lock
    - iio: adc128s052: add proper .data members in adc128_of_match table
    - regulator: core: fix deadlock on regulator enable
    - ovl: fix use inode directly in rcu-walk mode
    - media: dvbdev: fix build warning due to comments
    - media: dvbdev: fix refcnt bug
    - [armhf] pwm: tegra: Fix 32 bit build
    - [arm64,armhf] usb: dwc3: qcom: Fix memory leak in
      dwc3_qcom_interconnect_init
    - cifs: fix oops during encryption
    - nvme-pci: fix doorbell buffer value endianness
    - nvme-pci: fix mempool alloc size
    - nvme-pci: fix page size checks
    - ata: ahci: Fix PCS quirk application for suspend
    - nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition
    - [powerpc*] rtas: avoid device tree lookups in rtas_os_term()
    - [powerpc*] rtas: avoid scheduling in rtas_os_term()
    - HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
    - HID: plantronics: Additional PIDs for double volume key presses quirk
    - pstore/zone: Use GFP_ATOMIC to allocate zone buffer
    - hfsplus: fix bug causing custom uid and gid being unable to be assigned
      with mount
    - binfmt: Fix error return code in load_elf_fdpic_binary()
    - ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
    - ALSA: line6: correct midi status byte when receiving data from podxt
    - ALSA: line6: fix stack overflow in line6_midi_transmit
    - pnode: terminate at peers of source
    - md: fix a crash in mempool_free
    - mm, compaction: fix fast_isolate_around() to stay within boundaries
    - f2fs: should put a page when checking the summary info
    - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
    - tpm: acpi: Call acpi_put_table() to fix memory leak
    - tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
    - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
    - SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails
    - net/mlx5e: Fix nullptr in mlx5e_tc_add_fdb_flow()
    - wifi: rtlwifi: remove always-true condition pointed out by GCC 12
    - wifi: rtlwifi: 8192de: correct checking of IQK reload
    - rcu: Prevent lockdep-RCU splats on lock acquisition/release
    - net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO
    - net/af_packet: make sure to pull mac header
    - media: stv0288: use explicitly signed char
    - jbd2: use the correct print format
    - [arm64] dts: qcom: sdm845-db845c: correct SPI2 pins drive strength
    - btrfs: fix resolving backrefs for inline extent followed by prealloc
    - [arm64] dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive
      strength
    - PM/devfreq: governor: Add a private governor_data for governor
    - cpufreq: Init completion before kobject_init_and_add()
    - ALSA: patch_realtek: Fix Dell Inspiron Plus 16
    - ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops
    - dm cache: Fix ABBA deadlock between shrink_slab and
      dm_cache_metadata_abort
    - dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
    - dm thin: Use last transaction's pmd->root when commit failed
    - dm thin: resume even if in FAIL mode
    - dm thin: Fix UAF in run_timer_softirq()
    - dm integrity: Fix UAF in dm_integrity_dtr()
    - dm cache: Fix UAF in destroy()
    - dm cache: set needs_check flag after aborting metadata
    - tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'
    - perf/core: Call LSM hook after copying perf_event_attr
    - [x86] KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check
      fails
    - [x86] microcode/intel: Do not retry microcode reloading on the APs
    - [x86] ftrace/x86: Add back ftrace_expected for ftrace bug reports
    - [x86] kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK
    - tracing/hist: Fix wrong return value in parse_action_params()
    - tracing: Fix infinite loop in tracing_read_pipe on overflowed
      print_trace_line
    - media: dvb-core: Fix double free in dvb_register_device()
    - cifs: fix confusing debug message
    - cifs: fix missing display of three mount options
    - md/bitmap: Fix bitmap chunk size overflow issues
    - efi: Add iMac Pro 2017 to uefi skip cert quirk
    - wifi: wilc1000: sdio: fix module autoloading
    - ipmi: fix long wait in unload when IPMI disconnect
    - mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type()
    - ima: Fix a potential NULL pointer access in ima_restore_measurement_list
    - ipmi: fix use after free in _ipmi_destroy_user()
    - PCI: Fix pci_device_is_present() for VFs by checking PF
    - PCI/sysfs: Fix double free in error path
    - driver core: Fix bus_type.match() error handling in __driver_attach()
    - [amd64] iommu/amd: Fix ivrs_acpihid cmdline parsing code
    - [armhf] remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
    - device_cgroup: Roll back to original exceptions after copy failure
    - drm/connector: send hotplug uevent on connector cleanup
    - [x86] drm/i915/dsi: fix VBT send packet port selection for dual link DSI
    - ext4: silence the warning when evicting inode with dioread_nolock
    - ext4: add inode table check in __ext4_get_inode_loc to aovid possible
      infinite loop
    - ext4: fix use-after-free in ext4_orphan_cleanup
    - ext4: fix undefined behavior in bit shift for ext4_check_flag_values
    - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
    - ext4: add helper to check quota inums
    - ext4: fix bug_on in __es_tree_search caused by bad quota inode
    - ext4: fix reserved cluster accounting in __es_remove_extent()
    - ext4: check and assert if marking an no_delete evicting inode dirty
    - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
    - ext4: init quota for 'old.inode' in 'ext4_rename'
    - ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline
    - ext4: fix corruption when online resizing a 1K bigalloc fs
    - ext4: fix error code return to user-space in ext4_get_branch()
    - ext4: avoid BUG_ON when creating xattrs
    - ext4: fix inode leak in ext4_xattr_inode_create() on an error path
    - ext4: initialize quota before expanding inode in setproject ioctl
    - ext4: avoid unaccounted block allocation when expanding inode
    - ext4: allocate extended attribute value in vmalloc area
    - drm/amdgpu: handle polaris10/11 overlap asics (v2)
    - drm/amdgpu: make display pinning more flexible (v2)
    - [armel,armhf] renumber bits related to _TIF_WORK_MASK
    - [x86] perf/x86/intel/uncore: Generalize I/O stacks to PMON mapping
      procedure
    - [x86] perf/x86/intel/uncore: Clear attr_update properly
    - btrfs: replace strncpy() with strscpy()
    - [x86] mce: Get rid of msr_ops
    - [x86] MCE/AMD: Clear DFR errors found in THR handler
    - perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor
    - perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged
      data
    - [x86] kprobes: Convert to insn_decode()
    - [x86] kprobes: Fix optprobe optimization check with CONFIG_RETHUNK
    - ext4: goto right label 'failed_mount3a'
    - ext4: correct inconsistent error msg in nojournal mode
    - mm/highmem: Lift memcpy_[to|from]_page to core
    - ext4: use memcpy_to_page() in pagecache_write()
    - fs: ext4: initialize fsdata in pagecache_write()
    - ext4: move functions in super.c
    - ext4: simplify ext4 error translation
    - ext4: fix various seppling typos
    - ext4: fix leaking uninitialized memory in fast-commit journal
    - ext4: use kmemdup() to replace kmalloc + memcpy
    - mbcache: don't reclaim used entries
    - mbcache: add functions to delete entry if unused
    - ext4: remove EA inode entry from mbcache on inode eviction
    - ext4: unindent codeblock in ext4_xattr_block_set()
    - ext4: fix race when reusing xattr blocks
    - mbcache: automatically delete entries from cache on freeing
    - ext4: fix deadlock due to mbcache entry corruption
    - SUNRPC: ensure the matching upcall is in-flight upon downcall
    - bpf: pull before calling skb_postpull_rcsum()
    - [arm64,armhf] drm/panfrost: Fix GEM handle creation ref-counting
    - [x86] vmxnet3: correctly report csum_level for encapsulated packet
    - veth: Fix race with AF_XDP exposing old or uninitialized descriptors
    - nfsd: shut down the NFSv4 state objects before the filecache
    - [arm64] net: hns3: add interrupts re-initialization while doing VF FLR
    - net: sched: fix memory leak in tcindex_set_parms
    - qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure
    - nfc: Fix potential resource leaks
    - vhost/vsock: Fix error handling in vhost_vsock_init()
    - vhost: fix range used in translate_desc()
    - net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path
    - net/mlx5: Avoid recovery in probe flows
    - net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default
    - net/mlx5e: Fix hw mtu initializing at XDP SQ allocation
    - [amd64,arm64] net: amd-xgbe: add missed tasklet_kill
    - RDMA/mlx5: Fix validation of max_rd_atomic caps for DC
    - [arm64] drm/meson: Reduce the FIFO lines held when AFBC is not used
    - filelock: new helper: vfs_inode_has_locks
    - ceph: switch to vfs_inode_has_locks() to fix file lock bug
    - netfilter: ipset: fix hash:net,port,net hang with /0 subnet
    - netfilter: ipset: Rework long task execution when adding/deleting entries
    - perf tools: Fix resources leak in perf_data__open_dir()
    - drivers/net/bonding/bond_3ad: return when there's no aggregator
    - usb: rndis_host: Secure rndis_query check against int overflow
    - [x86] drm/i915: unpin on error in intel_vgpu_shadow_mm_pin()
    - udf: Fix extension of the last extent in the file
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071
      tablet
    - nvme: fix multipath crash caused by flush request when blktrace is enabled
    - [x86] bugs: Flush IBP in ib_prctl_set() (CVE-2023-0045)
    - nfsd: fix handling of readdir in v4root vs. mount upcall timeout
    - fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB
    - [x86] drm/i915/gvt: fix gvt debugfs destroy
    - [x86] drm/i915/gvt: fix vgpu debugfs clean in remove
    - ext4: don't allow journal inode to have encrypt flag
    - hfs/hfsplus: use WARN_ON for sanity check
    - hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling
    - mbcache: Avoid nesting of cache->c_list_lock under bit locks
    - efi: random: combine bootloader provided RNG seed with RNG protocol output
    - io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res()
    - ext4: disable fast-commit of encrypted dir operations
    - ext4: don't set up encryption key during jbd2 transaction
    - [arm64] fsl_lpuart: Don't enable interrupts too early
    - serial: fixup backport of "serial: Deassert Transmit Enable on probe in
      driver-specific way"
    - net/ulp: prevent ULP without clone op from entering the LISTEN status
      (CVE-2023-0461)
    - ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list
    - ALSA: hda - Enable headset mic on another Dell laptop with ALC3254
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.164
    - ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx
    - [arm64] KVM: arm64: Fix S1PTW handling on RO memslots
    - efi: tpm: Avoid READ_ONCE() for accessing the event log
    - docs: Fix the docs build with Sphinx 6.0
    - perf auxtrace: Fix address filter duplicate symbol selection
    - [arm64] ASoC: qcom: lpass-cpu: Fix fallback SD line index handling
    - [s390x] cpum_sf: add READ_ONCE() semantics to compare and swap loops
    - [s390x] percpu: add READ_ONCE() to arch_this_cpu_to_op_simple()
    - cifs: Fix uninitialized memory read for smb311 posix symlink create
    - [arm64] drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for
      aux transfer
    - [x86] platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight
      during probe
    - ixgbe: fix pci device refcount leak
    - bus: mhi: host: Fix race between channel preparation and M0 event
    - [amd64] iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid]
      commands
    - [amd64] iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid
      options
    - [arm64] clk: imx8mp: Add DISP2 pixel clock
    - [arm64] clk: imx8mp: add clkout1/2 support
    - dt-bindings: clocks: imx8mp: Add ID for usb suspend clock
    - [arm64] clk: imx: imx8mp: add shared clk gate for usb suspend clk
    - xhci: Avoid parsing transfer events several times
    - xhci: get isochronous ring directly from endpoint structure
    - xhci: adjust parameters passed to cleanup_halted_endpoint()
    - xhci: Add xhci_reset_halted_ep() helper function
    - xhci: move xhci_td_cleanup so it can be called by more functions
    - xhci: store TD status in the td struct instead of passing it along
    - xhci: move and rename xhci_cleanup_halted_endpoint()
    - xhci: Prevent infinite loop in transaction errors recovery for streams
    - [arm64,armhf] usb: ulpi: defer ulpi_register on ulpi_read_id timeout
    - ext4: fix uninititialized value in 'ext4_evict_inode'
    - xfrm: fix rcu lock in xfrm_notify_userpolicy()
    - netfilter: ipset: Fix overflow before widen in the bitmap_ip_create()
      function.
    - [powerpc*] imc-pmu: Fix use of mutex in IRQs disabled section
    - [x86] boot: Avoid using Intel mnemonics in AT&T syntax asm
    - EDAC/device: Fix period calculation in edac_device_reset_delay_period()
    - [arm64] ASoC: wm8904: fix wrong outputs volume after power reactivation
    - tipc: fix unexpected link reset due to discovery messages
    - hvc/xen: lock console list traversal
    - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
    - net/sched: act_mpls: Fix warning during failed attribute validation
    - net/mlx5: Fix ptp max frequency adjustment range
    - net/mlx5e: Don't support encap rules with gbp option
    - mm: Always release pages to the buddy allocator in memblock_free_late().
    - Documentation: KVM: add API issues section
    - [x86] KVM: x86: Do not return host topology information from
      KVM_GET_SUPPORTED_CPUID
    - [x86] resctrl: Use task_curr() instead of task_struct->on_cpu to prevent
      unnecessary IPI
    - [x86] resctrl: Fix task CLOSID/RMID update race
    - [arm64] atomics: remove LL/SC trampolines
    - [arm64] cmpxchg_double*: hazard against entire exchange variable
    - efi: fix NULL-deref in init error path
    - drm/virtio: Fix GEM handle creation UAF
    - io_uring/io-wq: free worker if task_work creation is canceled
    - io_uring/io-wq: only free worker if it was allocated for creation
    - Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.165
    - btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
    - pNFS/filelayout: Fix coalescing test for single DS
    - net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
    - btrfs: always report error in run_one_delayed_ref()
    - [x86] asm: Fix an assembler warning with current binutils
    - f2fs: let's avoid panic if extent_tree is not created
    - wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
    - wifi: mac80211: sdata can be NULL during AMPDU start
    - zonefs: Detect append writes at invalid locations
    - nilfs2: fix general protection fault in nilfs_btree_insert()
    - efi: fix userspace infinite retry read efivars after EFI runtime services
      page fault
    - ALSA: hda/realtek - Turn on power early
    - [x86] drm/i915/gt: Reset twice
    - Bluetooth: hci_qca: Wait for timeout during suspend
    - Bluetooth: hci_qca: Fix driver shutdown on closed serdev
    - io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL
    - io_uring: improve send/recv error handling
    - io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly
    - io_uring: add flag for disabling provided buffer recycling
    - io_uring: support MSG_WAITALL for IORING_OP_SEND(MSG)
    - io_uring: allow re-poll if we made progress
    - io_uring: fix async accept on O_NONBLOCK sockets
    - io_uring: check for valid register opcode earlier
    - io_uring: lock overflowing for IOPOLL
    - io_uring: fix CQ waiting timeout handling
    - io_uring: ensure that cached task references are always put on exit
    - io_uring: remove duplicated calls to io_kiocb_ppos
    - io_uring: update kiocb->ki_pos at execution time
    - io_uring: do not recalculate ppos unnecessarily
    - io_uring/rw: defer fsnotify calls to task context
    - xhci-pci: set the dma max_seg_size
    - usb: xhci: Check endpoint is valid before dereferencing it
    - xhci: Fix null pointer dereference when host dies
    - xhci: Add update_hub_device override for PCI xHCI hosts
    - xhci: Add a flag to disable USB3 lpm on a xhci root port level.
    - usb: acpi: add helper to check port lpm capability using acpi _DSM
    - xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
    - prlimit: do_prlimit needs to have a speculation check (CVE-2023-0458)
    - USB: serial: option: add Quectel EM05-G (GR) modem
    - USB: serial: option: add Quectel EM05-G (CS) modem
    - USB: serial: option: add Quectel EM05-G (RS) modem
    - USB: serial: option: add Quectel EC200U modem
    - USB: serial: option: add Quectel EM05CN (SG) modem
    - USB: serial: option: add Quectel EM05CN modem
    - USB: misc: iowarrior: fix up header size for
      USB_DEVICE_ID_CODEMERCS_IOW100
    - usb: core: hub: disable autosuspend for TI TUSB8041
    - [x86] comedi: adv_pci1760: Fix PWM instruction handling
    - [arm64,armhf] mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
    - [arm64,armhf] mmc: sdhci-esdhc-imx: correct the tuning start tap and step
      setting
    - btrfs: fix race between quota rescan and disable leading to NULL pointer
      deref
    - cifs: do not include page data when checking signature
    - [x86] thunderbolt: Use correct function to calculate maximum USB3 link
      rate
    - USB: gadgetfs: Fix race between mounting and unmounting
    - USB: serial: cp210x: add SCALANCE LPE-9000 device id
    - usb: typec: altmodes/displayport: Add pin assignment helper
    - usb: typec: altmodes/displayport: Fix pin assignment calculation
    - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
    - usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
    - [i386] serial: pch_uart: Pass correct sg to dma_unmap_sg()
    - [arm64] dmaengine: tegra210-adma: fix global intr clear
    - [x86] mei: me: add meteor lake point M DID
    - [x86] drm/i915: re-disable RC6p on Sandy Bridge
    - drm/amd/display: Fix set scaling doesn's work
    - drm/amd/display: Calculate output_color_space after pixel encoding
      adjustment
    - drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
    - [arm64] efi: Execute runtime services from a dedicated stack
    - [arm64] efi: rt-wrapper: Add missing include
    - Revert "drm/amdgpu: make display pinning more flexible (v2)"
    - [x86] fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN
    - tracing: Use alignof__(struct {type b;}) instead of offsetof()
    - io_uring: io_kiocb_update_pos() should not touch file for non -1 offset
    - io_uring/net: fix fast_iov assignment in io_setup_async_msg()
    - net/ulp: use consistent error code when blocking ULP
    - net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work()
    - Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"
    - Bluetooth: hci_qca: Wait for SSR completion during suspend
    - Bluetooth: hci_qca: check for SSR triggered flag while suspend
    - Bluetooth: hci_qca: Fixed issue during suspend
    - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
    - io_uring: Clean up a false-positive warning from GCC 9.3.0
    - io_uring: fix double poll leak on repolling
    - io_uring/rw: ensure kiocb_end_write() is always called
    - io_uring/rw: remove leftover debug statement
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.166
    - clk: generalize devm_clk_get() a bit
    - clk: Provide new devm_clk helpers for prepared and enabled clocks
    - [armel,armhf] memory: mvebu-devbus: Fix missing clk_disable_unprepare in
      mvebu_devbus_probe()
    - [armhf] dts: imx6ul-pico-dwarf: Use 'clock-frequency'
    - [armhf] imx: add missing of_node_put()
    - [amd64] HID: intel_ish-hid: Add check for ishtp_dma_tx_map
    - tomoyo: fix broken dependency on *.conf.default
    - RDMA/core: Fix ib block iterator counter overflow
    - [amd64] IB/hfi1: Reject a zero-length user expected buffer
    - [amd64] IB/hfi1: Reserve user expected TIDs
    - [amd64] IB/hfi1: Fix expected receive setup error exit issues
    - [amd64] IB/hfi1: Immediately remove invalid memory from hardware
    - [amd64] IB/hfi1: Remove user expected buffer invalidate race
    - affs: initialize fsdata in affs_truncate()
    - [amd64,arm64] amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
    - [amd64,arm64] amd-xgbe: Delay AN timeout during KR training
    - bpf: Fix pointer-leak due to insufficient speculative store bypass
      mitigation
    - [arm64] phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in
      rockchip_usb2phy_power_on()
    - net: nfc: Fix use-after-free in local_cleanup()
    - [arm64,armhf] gpio: mxc: Always set GPIOs used as interrupt source to
      INPUT mode
    - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid
      (CVE-2023-23559)
    - net/sched: sch_taprio: fix possible use-after-free
    - l2tp: Serialize access to sk_user_data with sk_callback_lock
      (CVE-2022-4129)
    - l2tp: Don't sleep and disable BH under writer-side sk_callback_lock
      (CVE-2022-4129)
    - l2tp: convert l2tp_tunnel_list to idr
    - l2tp: close all race conditions in l2tp_tunnel_register()
    - net: usb: sr9700: Handle negative len
    - net: mdio: validate parameter addr in mdiobus_get_phy()
    - HID: check empty report_list in hid_validate_values() (CVE-2023-1073)
    - HID: check empty report_list in bigben_probe()
    - net: stmmac: fix invalid call to mdiobus_get_phy()
    - HID: revert CHERRY_MOUSE_000C quirk
    - usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
    - usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
    - net: mlx5: eliminate anonymous module_init & module_exit
    - dmaengine: Fix double increment of client_count in dma_chan_get()
    - [arm64] net: macb: fix PTP TX timestamp failure due to packet padding
    - l2tp: prevent lockdep issue in l2tp_tunnel_register()
    - HID: betop: check shape of output reports
    - nvme-pci: fix timeout request state check
    - tcp: avoid the lookup process failing to get sk in ehash table
    - w1: fix deadloop in __w1_remove_master_device()
    - w1: fix WARNING after calling w1_process()
    - driver core: Fix test_async_probe_init saves device in wrong array
    - tcp: fix rate_app_limited to default to 1
    - scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace
    - [arm64,armhf] cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist
    - drm: Add orientation quirk for Lenovo ideapad D330-10IGL
    - [arm64] cpufreq: armada-37xx: stop using 0 as NULL pointer
    - [armhf] ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97
      CODEC
    - spi: spidev: remove debug messages that access spidev->spi without locking
    - [s390x] KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
    - [arm64] scsi: hisi_sas: Set a port invalid only if there are no devices
      attached when refreshing port id
    - [x86] platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD
    - [x86] platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK
    - lockref: stop doing cpu_relax in the cmpxchg loop
    - netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state
    - [x86] ACPI: cstate: Optimize C3 entry on AMD CPUs
    - fs: reiserfs: remove useless new_opts in reiserfs_remount
    - sysctl: add a new register_sysctl_init() interface
    - kernel/panic: move panic sysctls to its own file
    - panic: unset panic_on_warn inside panic()
    - exit: Add and use make_task_dead.
    - objtool: Add a missing comma to avoid string concatenation
    - panic: Separate sysctl logic from CONFIG_SMP
    - exit: Put an upper limit on how often we can oops
    - exit: Expose "oops_count" to sysfs
    - exit: Allow oops_limit to be disabled
    - panic: Consolidate open-coded panic_on_warn checks
    - panic: Introduce warn_limit
    - panic: Expose "warn_count" to sysfs
    - docs: Fix path paste-o for /sys/kernel/warn_count
    - exit: Use READ_ONCE() for all oops/warn limit reads
    - Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
    - xhci: Set HCD flag to defer primary roothub registration
    - scsi: hpsa: Fix allocation size for scsi_host_alloc()
    - module: Don't wait for GOING modules
    - tracing: Make sure trace_printk() can output as soon as it can be used
    - trace_events_hist: add check for return value of 'create_hist_field'
    - ftrace/scripts: Update the instructions for ftrace-bisect.sh
    - cifs: Fix oops due to uncleared server->smbd_conn in reconnect
    - [x86] KVM: x86/vmx: Do not skip segment attributes if unusable bit is set
    - [x86] thermal: intel: int340x: Protect trip temperature from concurrent
      updates
    - EDAC/device: Respect any driver-supplied workqueue polling value
    - units: Add Watt units
    - units: Add SI metric prefix definitions
    - i2c: designware: Use DIV_ROUND_CLOSEST() macro
    - i2c: designware: use casting of u64 in clock multiplication to avoid
      overflow
    - netlink: prevent potential spectre v1 gadgets
    - net: fix UaF in netns ops registration error path
    - netfilter: nft_set_rbtree: Switch to node list walk for overlap detection
    - netfilter: nft_set_rbtree: skip elements in transaction from garbage
      collection
    - netlink: annotate data races around nlk->portid
    - netlink: annotate data races around dst_portid and dst_group
    - netlink: annotate data races around sk_state
    - ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
    - ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
    - netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
    - netrom: Fix use-after-free of a listening socket.
    - net/sched: sch_taprio: do not schedule in taprio_reset()
    - sctp: fail if no bound addresses can be used for a given scope
      (CVE-2023-1074)
    - [x86] thermal: intel: int340x: Add locking to
      int340x_thermal_get_trip_type()
    - net/tg3: resolve deadlock in tg3_reset_task() during EEH
    - [arm64,armhf] net: mdio-mux-meson-g12a: force internal PHY off on mux
      switch
    - Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI
      mode"
    - nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf
      (Closes: #989705)
    - nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted
    - block: fix and cleanup bio_check_ro
    - [x86] i8259: Mark legacy PIC interrupts with IRQ_LEVEL
    - netfilter: conntrack: unify established states for SCTP paths
    - [x86] perf/x86/amd: fix potential integer overflow on shift of a int
    - clk: Fix pointer casting to prevent oops in devm_clk_release()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.167
    - [armhf] dts: imx: Fix pca9547 i2c-mux node name
    - [arm64] dts: imx8mq-thor96: fix no-mmc property for SDHCI
    - bpf: Skip task with pid=1 in send_signal_common()
    - blk-cgroup: fix missing pd_online_fn() while activating policy
    - [armhf] dmaengine: imx-sdma: Fix a possible memory leak in
      sdma_transfer_init
    - ACPI: processor idle: Practically limit "Dummy wait" workaround to old
      Intel systems
    - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
    - net: fix NULL pointer in skb_segment_list
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.168
    - firewire: fix memory leak for payload of request subaction to IEC 61883-1
      FCP region
    - [arm64,armhf] bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
    - bpf: Fix incorrect state pruning for <8B spill/fill
    - [powerpc*] imc-pmu: Revert nest_init_lock to being a mutex
    - bpf: Fix a possible task gone issue with bpf_send_signal[_thread]()
      helpers
    - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
    - bpf: Support <8-byte scalar spill and refill
    - bpf: Fix to preserve reg parent/live fields when copying range info
    - bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
    - [arm*] drm/vc4: hdmi: make CEC adapter name unique
    - scsi: Revert "scsi: core: map PQ=1, PDT=other values to
      SCSI_SCAN_TARGET_PRESENT"
    - vhost/net: Clear the pending messages when the backend is removed
    - [armhf] WRITE is "data source", not destination...
    - fix iov_iter_bvec() "direction" argument
    - fix "direction" argument of iov_iter_kvec()
    - virtio-net: execute xdp_do_flush() before napi_complete_done()
    - sfc: correctly advertise tunneled IPv6 segmentation
    - net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices
    - netrom: Fix use-after-free caused by accept on already connected socket
    - netfilter: br_netfilter: disable sabotage_in hook after first suppression
    - squashfs: harden sanity check in squashfs_read_xattr_id_table
    - [arm64] net: phy: meson-gxl: Add generic dummy stubs for MMD register
      access
    - igc: return an error if the mac type is unknown in
      igc_ptp_systim_to_hwtstamp()
    - can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
    - ata: libata: Fix sata_down_spd_limit() when no link speed is reported
    - virtio-net: Keep stop() to follow mirror sequence of open()
    - net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
    - efi: fix potential NULL deref in efi_mem_reserve_persistent
    - qede: add netpoll support for qede driver
    - qede: execute xdp_do_flush() before napi_complete_done()
    - scsi: target: core: Fix warning on RT kernels
    - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
      (CVE-2023-2162)
    - [arm64,armhf] i2c: rk3x: fix a bunch of kernel-doc warnings
    - [x86] platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010
      table
    - [arm64] usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API
    - [arm64] usb: dwc3: qcom: enable vbus override when in OTG dr-mode
    - usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
    - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
    - Input: i8042 - move __initconst to fix code styling warning
    - Input: i8042 - merge quirk tables
    - Input: i8042 - add TUXEDO devices to i8042 quirk tables
    - Input: i8042 - add Clevo PCX0DX to i8042 quirk table
    - fbcon: Check font dimension limits
    - net: qrtr: free memory on error path in radix_tree_insert()
    - [s390x] watchdog: diag288_wdt: do not use stack buffers for hardware data
    - [s390x] watchdog: diag288_wdt: fix __diag288() inline assembly
    - ALSA: hda/realtek: Add Acer Predator PH315-54
    - efi: Accept version 2 of memory attributes table
    - iio: hid: fix the retval in accel_3d_capture_sample
    - iio: imu: fxos8700: fix ACCEL measurement range selection
    - iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback
    - iio: imu: fxos8700: fix IMU data bits returned to user space
    - iio: imu: fxos8700: fix map label of channel type to MAGN sensor
    - iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback
    - iio: imu: fxos8700: fix incorrect ODR mode readback
    - iio: imu: fxos8700: fix failed initialization ODR mode assignment
    - iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN
    - iio: imu: fxos8700: fix MAGN sensor scale and unit
    - mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
    - [x86] debug: Fix stack recursion caused by wrongly ordered DR7 accesses
    - mm/swapfile: add cond_resched() in get_swap_pages()
    - Squashfs: fix handling and sanity checking of xattr_ids count
    - [x86] drm/i915: Fix potential bit_17 double-free
    - nvmem: core: initialise nvmem->id early
    - nvmem: core: fix cell removal on error
    - serial: 8250_dma: Fix DMA Rx completion race
    - serial: 8250_dma: Fix DMA Rx rearm race
    - fbdev: smscufx: fix error handling code in ufx_usb_probe
    - f2fs: fix to do sanity check on i_extra_isize in is_alive()
    - wifi: brcmfmac: Check the count value of channel spec to prevent
      out-of-bounds reads
    - nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property
    - bpf: Do not reject when the stack read size is different from the tracked
      scalar size
    - mm/migration: return errno when isolate_huge_page failed
    - migrate: hugetlb: check for hugetlb shared PMD in node migration
    - btrfs: limit device extents to the device size
    - btrfs: zlib: zero-initialize zlib workspace
    - ALSA: hda/realtek: Add Positivo N14KP6-TG
    - ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
    - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360
    - tracing: Fix poll() and select() do not work on per_cpu trace_pipe and
      trace_pipe_raw
    - of/address: Return an error when no valid dma-ranges are found
      (Closes: #993612)
    - can: j1939: do not wait 250 ms if the same addr was already claimed
    - [amd64] IB/hfi1: Restore allocated resources on failed copyout
    - IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
    - [amd64] RDMA/usnic: use iommu_map_atomic() under spin_lock()
    - xfrm: fix bug with DSCP copy to v6 from v4 tunnel
    - bonding: fix error checking in bond_debug_reregister()
    - [arm64] net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal
      PHY
    - ice: Do not use WQ_MEM_RECLAIM flag for workqueue
    - [arm64] net: mscc: ocelot: fix VCAP filters not matching on MAC with
      "protocol 802.1Q"
    - net/mlx5e: IPoIB, Show unknown speed instead of error
    - net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers
    - net/mlx5: fw_tracer, Zero consumer index when reloading the tracer
    - rds: rds_rm_zerocopy_callback() use list_first_entry() (CVE-2023-1078)
    - ALSA: pci: lx6464es: fix a debug loop
    - [armhf] pinctrl: aspeed: Fix confusing types in return value
    - [arm64,armhf] pinctrl: single: fix potential NULL dereference
    - [x86] pinctrl: intel: Restore the pins that used to be in Direct IRQ mode
    - cifs: Fix use-after-free in rdata->read_into_pages()
    - net: USB: Fix wrong-direction WARNING in plusb.c
    - btrfs: free device in btrfs_close_devices for a single device filesystem
    - usb: core: add quirk for Alcor Link AK9563 smartcard reader
    - usb: typec: altmodes/displayport: Fix probe pin assign check
    - ceph: flush cap releases when the session is flushed
    - Fix page corruption caused by racy check in __free_pages
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.169
    - [x86] ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers
    - ALSA: hda: Do not unset preset when cleaning up codec
    - net/rose: Fix to not accept on connected socket
    - net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC
    - net: sched: sch: Bounds check priority
    - [s390x] decompressor: specify __decompress() buf len to avoid overflow
    - nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
    - nvmem: core: add error handling for dev_set_name
    - nvmem: core: remove nvmem_config wp_gpio
    - nvmem: core: fix cleanup after dev_set_name()
    - nvmem: core: fix registration vs use race
    - aio: fix mremap after fork null-deref
    - [s390x] signal: fix endless loop in do_signal (Closes: #1031753)
    - ovl: remove privs in ovl_copyfile()
    - ovl: remove privs in ovl_fallocate()
    - netfilter: nft_tproxy: restrict to prerouting hook
    - mmc: sdio: fix possible resource leaks in some error paths
    - [arm64,armhf] mmc: mmc_spi: fix error handling in mmc_spi_probe()
    - ALSA: hda/conexant: add a new hda codec SN6180
    - ALSA: hda/realtek - fixed wrong gpio assigned
    - sched/psi: Fix use-after-free in ep_remove_wait_queue()
    - hugetlb: check for undefined shift on 32 bit architectures
    - Revert "mm: Always release pages to the buddy allocator in
      memblock_free_late()."
    - net: Fix unwanted sign extension in netdev_stats_to_stats64()
    - revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
    - ixgbe: allow to increase MTU to 3K with XDP enabled
    - i40e: add double of VLAN header when computing the max MTU
    - sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list
    - net/sched: tcindex: update imperfect hash filters respecting rcu
      (CVE-2023-1281)
    - dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
    - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
    - net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
    - net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence
    - bnxt_en: Fix mqprio and XDP ring checking logic
    - net: stmmac: Restrict warning on disabling DMA store and fwd mode
    - net: mpls: fix stale pointer if allocation fails during device rename
      (CVE-2023-26545)
    - ixgbe: add double of VLAN header when computing the max MTU
    - ipv6: Fix datagram socket connection with DSCP.
    - ipv6: Fix tcp socket connection with DSCP.
    - nilfs2: fix underflow in second superblock position calculations
    - [x86] drm/i915/gen11: Moving WAs to icl_gt_workarounds_init()
    - [x86] drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list
    - flow_offload: fill flags to action structure
    - net/sched: act_ctinfo: use percpu stats
    - i40e: Add checking for null for nlmsg_find_attr()
    - net/sched: tcindex: search key must be 16 bits
    - [x86] kvm: initialize all of the kvm_debugregs structure before sending it
      to userspace (CVE-2023-1513)
    - alarmtimer: Prevent starvation by small intervals and SIG_IGN
    - [x86] ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak
    - net: sched: sch: Fix off by one in htb_activate_prios()
    - nvmem: core: fix return value
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.170
    - [armhf] drm/etnaviv: don't truncate physical page address
    - wifi: rtl8xxxu: gen2: Turn on the rate control
    - powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G
    - random: always mix cycle counter in add_latent_entropy()
    - [x86] KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception
    - [x86] KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid
    - [x86] KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
      (CVE-2022-2196)
    - [x86] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
      (CVE-2022-3707)
    - mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
    - uaccess: Add speculation barrier to copy_from_user() (CVE-2023-0459)
    - Revert "Revert "block: nbd: add sanity check for first_minor""
    - nbd: fix max value for 'first_minor'
    - nbd: fix possible overflow for 'first_minor' in nbd_dev_add()
    - nbd: fix possible overflow on 'first_minor' in nbd_dev_add()
    - wifi: mwifiex: Add missing compatible string for SD8787
    - audit: update the mailing list in MAINTAINERS
    - ext4: Fix function prototype mismatch for ext4_feat_ktype
    - Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue
      pfifo child qdiscs"
    - bpf: add missing header file include
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.171
    - Fix XFRM-I support for nested ESP tunnels
    - [arm64] dts: rockchip: drop unused LED mode property from rk3328-roc-cc
    - [amd64,arm64] ACPI: NFIT: fix a potential deadlock during NFIT teardown
    - btrfs: send: limit number of clones and allocated memory size
    - [amd64] IB/hfi1: Assign npages earlier
    - neigh: make sure used and confirmed times are valid
    - HID: core: Fix deadloop in hid_apply_multiplier.
    - bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
    - net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from
      sk_stream_kill_queues().
    - vc_screen: don't clobber return value in vcs_read
    - md: Flush workqueue md_rdev_misc_wq in md_alloc()
    - drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init
      (CVE-2023-22998)
    - drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling
      (CVE-2023-22998)
    - USB: serial: option: add support for VW/Skoda "Carstick LTE"
    - usb: gadget: u_serial: Add null pointer check in gserial_resume
    - USB: core: Don't hold device lock while reading the "descriptors" sysfs
      file
    - io_uring: add missing lock in io_get_file_fixed (CVE-2023-1872)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.172
    - io_uring: ensure that io_init_req() passes in the right issue_flags
      (CVE-2023-1872)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.173
    - HID: asus: Remove check for same LED brightness on set
    - HID: asus: use spinlock to protect concurrent accesses
    - HID: asus: use spinlock to safely schedule workers (CVE-2023-1079)
    - [powerpc*] mm: Rearrange if-else block to avoid clang warning
    - [armhf] OMAP2+: Fix memory leak in realtime_counter_init()
    - [arm64] dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
    - [armhf] imx: Call ida_simple_remove() for ida_simple_get
    - [armhf] dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
    - blk-mq: avoid sleep in blk_mq_alloc_request_hctx
    - blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
    - blk-mq: correct stale comment of .get_budget
    - [s390x] dasd: Prepare for additional path event handling
    - [s390x] dasd: Fix potential memleak in dasd_eckd_init()
    - sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
    - sched/rt: pick_next_rt_entity(): check list_entry (CVE-2023-1077)
    - [x86] perf/zhaoxin: Add stepping check for ZXC
    - block: bio-integrity: Copy flags when bio_integrity_payload is cloned
    - wifi: rsi: Fix memory leak in rsi_coex_attach()
    - wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: iwlegacy: common: don't call dev_kfree_skb() under
      spin_lock_irqsave()
    - wifi: libertas: fix memory leak in lbs_init_adapter()
    - wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
    - wifi: rtlwifi: Fix global-out-of-bounds bug in
      _rtl8812ae_phy_set_txpower_limit()
    - wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
    - wifi: ipw2200: fix memory leak in ipw_wdev_init()
    - wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
    - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
    - wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
    - wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
    - wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
    - [amd64] crypto: x86/ghash - fix unaligned access in ghash_setkey()
    - ACPICA: Drop port I/O validation for some regions
    - genirq: Fix the return type of kstat_cpu_irqs_sum()
    - rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
    - rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
    - rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
    - lib/mpi: Fix buffer overrun when SG is too long
    - [amd64] crypto: ccp: Use the stack for small SEV command buffers
    - [amd64] crypto: ccp: Use the stack and common buffer for status commands
    - [amd64] crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent
      kernel memory leak
    - [amd64] crypto: ccp - Avoid page allocation failure warning for
      SEV_GET_ID2
    - ACPICA: nsrepair: handle cases without a return value correctly
    - [arm64] thermal/drivers/tsens: Drop msm8976-specific defines
    - [arm64] thermal/drivers/qcom/tsens_v1: Enable sensor 3 on MSM8976
    - [arm64] thermal/drivers/tsens: Add compat string for the qcom,msm8960
    - [arm64] thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
    - wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
    - wifi: orinoco: check return value of hermes_write_wordrec()
    - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no
      callback function
    - ath9k: hif_usb: simplify if-if to if-else
    - ath9k: htc: clean up statistics macros
    - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
    - wifi: ath9k: Fix potential stack-out-of-bounds write in
      ath9k_wmi_rsp_callback()
    - wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
    - wifi: cfg80211: Fix extended KCK key length check in
      nl80211_set_rekey_data()
    - ACPI: battery: Fix missing NUL-termination with large strings
    - [amd64] crypto: ccp - Failure on re-initialization due to duplicate sysfs
      filename
    - crypto: essiv - Handle EBUSY correctly
    - crypto: seqiv - Handle EBUSY correctly
    - [x86] powercap: fix possible name leak in powercap_register_zone()
    - [x86] cpu: Init AP exception handling from cpu_init_secondary()
    - [x86] microcode: Replace deprecated CPU-hotplug functions.
    - [x86] Mark stop_this_cpu() __noreturn
    - [x86] microcode: Rip out the OLD_INTERFACE
    - [x86] microcode: Default-disable late loading
    - [x86] microcode: Print previous version of microcode after reload
    - [x86] microcode: Add a parameter to microcode_check() to store CPU
      capabilities
    - [x86] microcode: Check CPU capabilities after late microcode update
      correctly
    - [x86] microcode: Adjust late loading result reporting message
    - crypto: xts - Handle EBUSY correctly
    - leds: led-class: Add missing put_device() to led_put()
    - [amd64] crypto: ccp - Refactor out sev_fw_alloc()
    - [amd64] crypto: ccp - Flush the SEV-ES TMR memory before giving it to
      firmware
    - net/mlx5: Enhance debug print in page allocation failure
    - irqchip: Fix refcount leak in platform_irqchip_probe
    - irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
    - irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
    - irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
    - [s390x] vmem: fix empty page tables cleanup under KASAN
    - net: add sock_init_data_uid()
    - tun: tun_chr_open(): correctly initialize socket uid (CVE-2023-1076)
    - tap: tap_open(): correctly initialize socket uid (CVE-2023-1076)
    - OPP: fix error checking in opp_migrate_dentry()
    - Bluetooth: L2CAP: Fix potential user-after-free
    - rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
    - crypto: rsa-pkcs1pad - Use akcipher_request_complete
    - wifi: iwl3945: Add missing check for create_singlethread_workqueue
    - wifi: iwl4965: Add missing check for create_singlethread_workqueue()
    - wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
    - wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
    - [arm64] thermal/drivers/hisi: Drop second sensor hi3660
    - can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a
      bus error
    - bpf: Fix global subprog context argument resolution logic
    - l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
    - [arm64] net: bcmgenet: fix MoCA LED control
    - drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
    - drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
    - [arm*] drm/vc4: dpi: Add option for inverting pixel clock and output
      enable
    - [arm*] drm/vc4: dpi: Fix format mapping for RGB565
    - [armhf] gpu: ipu-v3: common: Add of_node_put() for reference returned by
      of_graph_get_port_by_id()
    - [arm64] drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
    - [armhf] pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
    - [arm64,armhf] pinctrl: rockchip: add support for rk3568
    - [arm64,armhf] pinctrl: rockchip: do coding style for mux route struct
    - [arm64,armhf] pinctrl: rockchip: Fix refcount leak in
      rockchip_pinctrl_parse_groups
    - [arm*] drm/vc4: hvs: Set AXI panic modes
    - [arm*] drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
    - [arm*] drm/vc4: hdmi: Correct interlaced timings again
    - [arm64] ASoC: fsl_sai: initialize is_dsp_mode flag
    - [arm64] drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
    - ALSA: hda/ca0132: minor fix for allocation size
    - [arm64] drm/msm/dpu: Disallow unallocated resources to be returned
    - drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
    - [arm64] drm/msm: use strscpy instead of strncpy
    - [arm64] drm/msm/dpu: Add check for cstate
    - [arm64] drm/msm/dpu: Add check for pstates
    - [arm64] drm/msm/mdp5: Add check for kzalloc
    - [arm*] pinctrl: bcm2835: Remove of_node_put() in
      bcm2835_of_gpio_ranges_fallback()
    - [x86] ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
    - drm/amdgpu: fix enum odm_combine_mode mismatch
    - scsi: mpt3sas: Fix a memory leak
    - scsi: aic94xx: Add missing check for dma_map_single()
    - dm: remove flush_scheduled_work() during local_exit()
    - NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode()
    - NFSv4: keep state manager thread active if swap is enabled
    - nfs4trace: fix state manager flag printing
    - NFS: fix disabling of swap
    - HID: bigben: use spinlock to protect concurrent accesses
    - HID: bigben_worker() remove unneeded check on report_field
    - HID: bigben: use spinlock to safely schedule workers (CVE-2023-25012)
    - hid: bigben_probe(): validate report count
    - nfsd: fix race to check ls_layouts
    - cifs: Fix lost destroy smbd connection when MR allocate failed
    - cifs: Fix warning and UAF when destroy the MR list
    - gfs2: jdata writepage fix
    - leds: led-core: Fix refcount leak in of_led_get()
    - [armhf] mtd: rawnand: sunxi: Fix the size of the last OOB region
    - [arm64,armhf] clk: imx: avoid memory leak
    - Input: ads7846 - don't report pressure for ads7845
    - Input: ads7846 - convert to full duplex
    - Input: ads7846 - convert to one message
    - Input: ads7846 - always set last command to PWRDOWN
    - Input: ads7846 - don't check penirq immediately for 7845
    - [powerpc*] powernv/ioda: Skip unallocated resources when mapping to PE
    - clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
    - [powerpc*] perf/hv-24x7: add missing RTAS retry status handling
    - [powerpc*] pseries/lpar: add missing RTAS retry status handling
    - [powerpc*] pseries/lparcfg: add missing RTAS retry status handling
    - [powerpc*] rtas: make all exports GPL
    - [powerpc*] rtas: ensure 4KB alignment for rtas_data_buf
    - [powerpc*] eeh: Small refactor of eeh_handle_normal_event()
    - [powerpc*] eeh: Set channel state after notifying the drivers
    - [armhf] media: platform: ti: Add missing check for devm_regulator_get
    - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
      (CVE-2023-1118)
    - media: usb: siano: Fix use after free bugs caused by do_submit_urb
    - media: saa7134: Use video_unregister_device for radio_dev
    - [arm64] rpmsg: glink: Avoid infinite loop on intent for missing channel
    - udf: Define EFSCORRUPTED error code
    - blk-iocost: fix divide by 0 error in calc_lcoefs()
    - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
    - wifi: brcmfmac: Fix potential stack-out-of-bounds in
      brcmf_c_preinit_dcmds()
    - rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
    - rcu: Suppress smp_processor_id() complaint in
      synchronize_rcu_expedited_wait()
    - rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
    - wifi: ath11k: debugfs: fix to work with multiple PCI devices
    - [x86] thermal: intel: Fix unsigned comparison with less than zero
    - timers: Prevent union confusion from unexpected restart_syscall()
    - [x86] bugs: Reset speculation control settings on init
    - wifi: brcmfmac: ensure CLM version is null-terminated to prevent
      stack-out-of-bounds
    - wifi: mt7601u: fix an integer underflow
    - inet: fix fast path in __inet_hash_connect()
    - ice: add missing checks for PF vsi type
    - ACPI: Don't build ACPICA with '-Os'
    - clocksource: Suspend the watchdog temporarily when high read latency
      detected
    - net: bcmgenet: Add a check for oversized packets
    - wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
    - ACPI: video: Fix Lenovo Ideapad Z570 DMI match
    - net/mlx5: fw_tracer: Fix debug print
    - coda: Avoid partial allocation of sig_inputArgs
    - uaccess: Add minimum bounds check on kernel buffer size
    - PM: EM: fix memory leak with using debugfs_lookup()
    - Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
    - drm/amd/display: Fix potential null-deref in dm_resume
    - [armhf] drm/omap: dsi: Fix excessive stack usage
    - HID: Add Mapping for System Microphone Mute
    - drm/radeon: free iio for atombios when driver shutdown
    - drm: amd: display: Fix memory leakage
    - [arm64] drm/msm/dsi: Add missing check for alloc_ordered_workqueue
    - [armel,armhf] ASoC: kirkwood: Iterate over array indexes instead of using
      pointer math
    - [armhf] regulator: s5m8767: Bounds check id indexing into arrays
    - gfs2: Improve gfs2_make_fs_rw error handling
    - [x86] hwmon: (coretemp) Simplify platform device handling
    - HID: logitech-hidpp: Don't restart communication if not necessary
    - drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
    - dm thin: add cond_resched() to various workqueue loops
    - dm cache: add cond_resched() to various workqueue loops
    - nfsd: zero out pointers after putting nfsd_files on COPY setup error
    - wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
    - firmware: coreboot: framebuffer: Ignore reserved pixel color bits
    - [arm64] rtc: pm8xxx: fix set-alarm race
    - ipmi_ssif: Rename idle state and check
    - [s390x] extmem: return correct segment type in __segment_load()
    - [s390x] discard .interp section
    - [s390x] kprobes: fix irq mask clobbering on kprobe reenter from
      post_handler
    - [s390x] kprobes: fix current_kprobe never cleared after kprobes reenter
    - cifs: Fix uninitialized memory read in smb3_qfs_tcon()
    - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
    - fs: hfsplus: fix UAF issue in hfsplus_put_super
    - exfat: fix reporting fs error when reading dir beyond EOF
    - exfat: fix unexpected EOF while reading dir
    - exfat: redefine DIR_DELETED as the bad cluster number
    - exfat: fix inode->i_blocks for non-512 byte sector size device
    - f2fs: fix information leak in f2fs_move_inline_dirents()
    - f2fs: fix cgroup writeback accounting with fs-layer encryption
    - ocfs2: fix defrag path triggering jbd2 ASSERT
    - ocfs2: fix non-auto defrag path not working issue
    - udf: Truncate added extents on failed expansion
    - udf: Do not bother merging very long extents
    - udf: Do not update file length for failed writes to inline files
    - udf: Preserve link count of system files
    - udf: Detect system inodes linked into directory hierarchy
    - udf: Fix file corruption when appending just after end of preallocated
      extent
    - KVM: Destroy target device if coalesced MMIO unregistration fails
    - [x86] KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
    - [s390x] KVM: s390: disable migration mode when dirty tracking is disabled
    - [x86] virt: Force GIF=1 prior to disabling SVM (for reboot flows)
    - [x86] crash: Disable virt in core NMI crash handler to avoid double
      shootdown
    - [x86] reboot: Disable virtualization in an emergency if SVM is supported
    - [x86] reboot: Disable SVM, not just VMX, when stopping CPUs
    - [x86] kprobes: Fix __recover_optprobed_insn check optimizing logic
    - [x86] kprobes: Fix arch_check_optimized_kprobe check within
      optimized_kprobe range
    - [x86] microcode/amd: Remove load_microcode_amd()'s bsp parameter
    - [x86] microcode/AMD: Add a @cpu parameter to the reloading functions
    - [x86] microcode/AMD: Fix mixed steppings support
    - [x86] speculation: Allow enabling STIBP with legacy IBRS (CVE-2023-1998)
    - Documentation/hw-vuln: Document the interaction between IBRS and STIBP
    - brd: return 0/-error from brd_insert_page()
    - ima: Align ima_file_mmap() parameters with mmap_file LSM hook
    - irqdomain: Fix association race
    - irqdomain: Fix disassociation race
    - irqdomain: Drop bogus fwspec-mapping error handling
    - io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
    - io_uring: mark task TASK_RUNNING before handling resume/task work
    - io_uring: add a conditional reschedule to the IOPOLL cancelation loop
    - io_uring/rsrc: disallow multi-source reg buffers
    - io_uring: remove MSG_NOSIGNAL from recvmsg
    - io_uring/poll: allow some retries for poll triggering spuriously
    - ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
    - ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
    - jbd2: fix data missing when reusing bh which is ready to be checkpointed
    - ext4: optimize ea_inode block expansion
    - ext4: refuse to create ea block when umounted
    - mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
    - dm: add cond_resched() to dm_wq_work()
    - wifi: rtl8xxxu: Use a longer retry limit of 48
    - wifi: cfg80211: Fix use after free for wext
    - [x86] thermal: intel: powerclamp: Fix cur_state for multi package system
    - dm flakey: fix logic when corrupting a bio
    - dm flakey: don't corrupt the zero page
    - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
    - dax/kmem: Fix leak of memory-hotplug resources
    - mm: memcontrol: deprecate charge moving
    - mm/thp: check and bail out if page in deferred queue already
    - ring-buffer: Handle race between rb_move_tail and rb_check_pages
    - scsi: qla2xxx: Fix link failure in NPIV environment
    - scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
    - scsi: qla2xxx: Fix erroneous link down
    - scsi: ses: Don't attach if enclosure has no components
    - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
    - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
    - scsi: ses: Fix possible desc_ptr out-of-bounds accesses
    - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
    - PCI/PM: Observe reset delay irrespective of bridge_d3
    - PCI: hotplug: Allow marking devices as disconnected during bind/unbind
    - PCI: Avoid FLR for AMD FCH AHCI adapters
    - vfio/type1: prevent underflow of locked_vm via exec()
    - [x86] drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
    - drm/radeon: Fix eDP for single-display iMac11,2
    - drm/edid: fix AVI infoframe aspect ratio handling
    - wifi: ath9k: use proper statements in conditionals
    - [arm64,armhf] pinctrl: rockchip: fix mux route data for rk3568
    - [arm64,armhf] pinctrl: rockchip: fix reading pull type on rk3568
    - net/sched: Retire tcindex classifier (CVE-2023-1829)
    - fs/jfs: fix shift exponent db_agl2size negative
    - objtool: Fix memory leak in create_static_call_sections()
    - [armhf] pwm: stm32-lp: fix the check on arr and cmp registers update
    - f2fs: use memcpy_{to,from}_page() where possible
    - fs: f2fs: initialize fsdata in pagecache_write()
    - ubi: ensure that VID header offset + VID header size <= alloc, size
    - ubifs: Fix build errors as symbol undefined
    - ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
    - ubifs: Rectify space budget for ubifs_xrename()
    - ubifs: Fix wrong dirty space budget for dirty inode
    - ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
    - ubifs: Reserve one leb for each journal head while doing budget
    - ubi: Fix use-after-free when volume resizing failed
    - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
    - ubifs: Fix memory leak in alloc_wbufs()
    - ubi: Fix possible null-ptr-deref in ubi_free_volume()
    - ubifs: Re-statistic cleaned znode count if commit failed
    - ubifs: dirty_cow_znode: Fix memleak in error handling path
    - ubifs: ubifs_writepage: Mark page dirty after writing inode failed
    - ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling
      fastmap
    - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
    - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
    - [x86] um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
    - watchdog: Fix kmemleak in watchdog_cdev_register
    - watchdog: pcwd_usb: Fix attempting to access uninitialized memory
    - netfilter: ctnetlink: fix possible refcount leak in
      ctnetlink_create_conntrack()
    - netfilter: ebtables: fix table blob use-after-free
    - ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
    - sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
    - net: fix __dev_kfree_skb_any() vs drop monitor
    - 9p/xen: fix version parsing
    - 9p/xen: fix connection sequence
    - 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
    - net/mlx5: Geneve, Fix handling of Geneve object id as error code
    - nfc: fix memory leak of se_io context in nfc_genl_se_io
    - net/sched: act_sample: fix action bind logic
    - tcp: tcp_check_req() can be called from process context
    - vc_screen: modify vcs_size() handling in vcs_read()
    - [arm64,armhf] rtc: sun6i: Always export the internal oscillator
    - scsi: ipr: Work around fortify-string warning
    - loop: loop_set_status_from_info() check before assignment
    - tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
    - [x86] firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
    - bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC
      support
    - [amd64] IB/hfi1: Update RMT size calculation
    - media: uvcvideo: Handle cameras with invalid descriptors
    - media: uvcvideo: Handle errors from calls to usb_string
    - media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
    - media: uvcvideo: Silence memcpy() run-time false positive warnings
    - tty: fix out-of-bounds access in tty_driver_lookup_tty()
    - tty: serial: fsl_lpuart: disable the CTS when send break signal
    - [x86] mei: bus-fixup:upon error print return values of send and receive
    - iio: accel: mma9551_core: Prevent uninitialized variable in
      mma9551_read_status_word()
    - iio: accel: mma9551_core: Prevent uninitialized variable in
      mma9551_read_config_word()
    - [arm64,armhf] usb: host: xhci: mvebu: Iterate over array indexes instead
      of using pointer math
    - USB: ene_usb6250: Allocate enough memory for full object
    - usb: uvc: Enumerate valid values for color matching
    - usb: gadget: uvc: Make bSourceID read/write
    - PCI: Align extra resources for hotplug bridges properly
    - PCI: Take other bus devices into account when distributing resources
    - kernel/fail_function: fix memory leak with using debugfs_lookup()
    - PCI: Add ACS quirk for Wangxun NICs
    - [arm64] phy: rockchip-typec: Fix unsigned comparison with less than zero
    - soundwire: cadence: Remove wasted space in response_buf
    - soundwire: cadence: Drain the RX FIFO after an IO timeout
    - [x86] resctrl: Apply READ_ONCE/WRITE_ONCE to task_struct.{rmid,closid}
    - [x86] resctl: fix scheduler confusion with 'current'
    - drm/display/dp_mst: Fix down/up message handling after sink disconnect
    - drm/display/dp_mst: Fix down message handling after a packet reception
      error
    - Bluetooth: hci_sock: purge socket queues in the destruct() callback
    - tcp: Fix listen() regression in 5.10.163
    - drm/virtio: Fix error code in virtio_gpu_object_shmem_init()
    - media: uvcvideo: Provide sync and async uvc_ctrl_status_event
    - media: uvcvideo: Fix race condition with usb_kill_urb
    - Revert "scsi: mpt3sas: Fix return value check of dma_get_required_mask()"
    - scsi: mpt3sas: Don't change DMA mask while reallocating pools
    - scsi: mpt3sas: re-do lost mpt3sas DMA mask fix
    - scsi: mpt3sas: Remove usage of dma_get_required_mask() API
      (Closes: #1022126)
    - malidp: Fix NULL vs IS_ERR() checking (CVE-2023-23004)
    - usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.174
    - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for
      wext"
    - [x86] staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a
      script
    - [x86] staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.175
    - fs: prevent out-of-bounds array speculation when closing a file descriptor
    - fork: allow CLONE_NEWTIME in clone3 flags
    - [x86] CPU/AMD: Disable XSAVES on AMD family 0x17
    - drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15
    - drm/connector: print max_requested_bpc in state debugfs
    - ext4: fix cgroup writeback accounting with fs-layer encryption
    - ext4: fix RENAME_WHITEOUT handling for inline directories
    - ext4: fix another off-by-one fsmap error on 1k block filesystems
    - ext4: move where set the MAY_INLINE_DATA flag is set
    - ext4: fix WARNING in ext4_update_inline_data
    - ext4: zero i_disksize when initializing the bootloader inode
    - nfc: change order inside nfc_se_io error path
    - udf: Fix off-by-one error when discarding preallocation
    - irq: Fix typos in comments
    - irqdomain: Look for existing mapping only once
    - irqdomain: Refactor __irq_domain_alloc_irqs()
    - irqdomain: Fix mapping-creation race
    - irqdomain: Change the type of 'size' in __irq_domain_add() to be
      consistent
    - irqdomain: Fix domain registration race
    - [amd64] iommu/vt-d: Fix lockdep splat in intel_pasid_get_entry()
    - [amd64] iommu/vt-d: Fix PASID directory pointer coherency
    - [arm64] efi: Make efi_rt_lock a raw_spinlock
    - scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
    - ext4: Fix possible corruption when moving a directory
    - drm/nouveau/kms/nv50-: remove unused functions
    - drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype
    - [arm64] drm/msm: Fix potential invalid ptr free
    - [arm64] drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register
    - [arm64] drm/msm: Document and rename preempt_lock
    - [arm64] drm/msm/a5xx: fix the emptyness check in the preempt code
    - [arm64] drm/msm/a5xx: fix context faults during ring switch
    - ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
    - net: usb: lan78xx: Remove lots of set but unused 'ret' variables
    - net: lan78xx: fix accessing the LAN7800's internal phy specific registers
      from the MAC driver
    - net: stmmac: add to set device wake up flag when stmmac init phy
    - net: phylib: get rid of unnecessary locking
    - bnxt_en: Avoid order-5 memory allocation for TPA data
    - netfilter: ctnetlink: revert to dumping mark regardless of event type
    - netfilter: tproxy: fix deadlock due to missing BH disable
    - btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR
    - scsi: megaraid_sas: Update max supported LD IDs to 240
    - net/smc: fix fallback failed while sendmsg with fastopen
    - SUNRPC: Fix a server shutdown leak
    - ext4: Fix deadlock during directory rename
    - [amd64] iommu/amd: Add a length limitation for the ivrs_acpihid
      command-line parameter
    - watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths
    - tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address
    - block, bfq: fix possible uaf for 'bfqq->bic'
    - block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq
    - block/bfq-iosched.c: use "false" rather than "BLK_RW_ASYNC"
    - block, bfq: replace 0/1 with false/true in bic apis
    - block, bfq: fix uaf for bfqq in bic_set_bfqq()
    - PCI: Add SolidRun vendor ID
    - [armhf] media: rc: gpio-ir-recv: add remove function
    - ipmi/watchdog: replace atomic_add() and atomic_sub()
    - ipmi:watchdog: Set panic count to proper value on a panic
    - skbuff: Fix nfct leak on napi stolen
    - [x86] drm/i915: Don't use BAR mappings for ring buffers with LLC
    - ext4: refactor ext4_free_blocks() to pull out ext4_mb_clear_bb()
    - ext4: add ext4_sb_block_valid() refactored out of ext4_inode_block_valid()
    - ext4: add strict range checks while freeing blocks
    - ext4: block range must be validated before use in ext4_mb_clear_bb()
    - arch: fix broken BuildID for arm64 and riscv
    - [powerpc*] vmlinux.lds: Define RUNTIME_DISCARD_EXIT
    - [powerpc*] vmlinux.lds: Don't discard .rela* for relocatable builds
    - [s390x] define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
    - [x86] KVM: nVMX: Don't use Enlightened MSR Bitmap for L3
    - [x86] KVM: VMX: Introduce vmx_msr_bitmap_l01_changed() helper
    - [x86] KVM: VMX: Fix crash due to uninitialized current_vmcs
    - [s390x] dasd: add missing discipline function
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.176
    - xfrm: Allow transport-mode states with AF_UNSPEC selector
    - [arm64,armhf] drm/panfrost: Don't sync rpm suspension after mmu flushing
    - cifs: Move the in_send statistic to __smb_send_rqst()
    - [arm64] drm/meson: fix 1px pink line on GXM when scaling video overlay
    - docs: Correct missing "d_" prefix for dentry_operations member
      d_weak_revalidate
    - scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
    - ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
    - netfilter: nft_nat: correct length for loading protocol registers
    - netfilter: nft_masq: correct length for loading protocol registers
    - netfilter: nft_redir: correct length for loading protocol registers
    - netfilter: nft_redir: correct value of inet type `.maxattrs`
    - scsi: core: Fix a comment in function scsi_host_dev_release()
    - scsi: core: Fix a procfs host directory removal regression
    - tcp: tcp_make_synack() can be called from process context
    - nfc: pn533: initialize struct pn533_out_arg properly
    - ipvlan: Make skb->skb_iif track skb->dev for l3s mode
    - i40e: Fix kernel crash during reboot when adapter is in recovery mode
    - net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
    - qed/qed_dev: guard against a possible division by zero
    - net: tunnels: annotate lockless accesses to dev->needed_headroom
    - net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status
      fails
    - net/smc: fix deadlock triggered by cancel_delayed_work_syn()
    - net: usb: smsc75xx: Limit packet length to skb->len
    - drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts
      kdoc
    - nvme: fix handling single range discard request
    - nvmet: avoid potential UAF in nvmet_req_complete()
    - ice: xsk: disable txq irq before flushing hw
    - net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290
    - ipv4: Fix incorrect table ID in IOCTL path
    - net: usb: smsc75xx: Move packet length check to prevent kernel panic in
      skb_pull
    - [s390x] net/iucv: Fix size of interrupt data
    - qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
    - hwmon: (adt7475) Display smoothing attributes in correct order
    - hwmon: (adt7475) Fix masking of hysteresis registers
    - [arm64] hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to
      race condition (CVE-2023-1855)
    - jffs2: correct logic when creating a hole in jffs2_write_begin
    - ext4: fail ext4_iget if special inode unallocated
    - ext4: fix task hung in ext4_xattr_delete_inode
    - drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
    - ext4: fix possible double unlock when moving a directory
    - [arm64] tty: serial: fsl_lpuart: skip waiting for transmission complete
      when UARTCTRL_SBK is asserted
    - [arm64] firmware: xilinx: don't make a sleepable memory allocation from an
      atomic context
    - tracing: Make splice_read available again
    - tracing: Check field value in hist_field_name()
    - tracing: Make tracepoint lockdep check actually test something
    - cifs: Fix smb2_set_path_size()
    - [x86] KVM: nVMX: add missing consistency checks for CR0 and CR4
      (CVE-2023-30456)
    - ALSA: hda: intel-dsp-config: add MTL PCI id
    - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
    - drm/shmem-helper: Remove another errant put in error path
    - ftrace: Fix invalid address access in lookup_rec() when index is 0
    - mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
    - [x86] mce: Make sure logged MCEs are processed after sysfs update
    - [x86] mm: Fix use of uninitialized buffer in sme_enable()
    - [x86] drm/i915: Don't use stolen memory for ring buffers with LLC
    - [x86] drm/i915/active: Fix misuse of non-idle barriers as fence trackers
    - io_uring: avoid null-ptr-deref in io_arm_poll_handler
    - [s390x] ipl: add missing intersection check to ipl_report handling
    - PCI: Unify delay handling for reset and resume
    - PCI/DPC: Await readiness of secondary bus after reset
    - xfs: don't assert fail on perag references on teardown
    - xfs: purge dquots after inode walk fails during quotacheck
    - xfs: don't leak btree cursor when insrec fails after a split
    - xfs: remove XFS_PREALLOC_SYNC
    - xfs: fallocate() should call file_modified()
    - xfs: set prealloc flag in xfs_alloc_file_space()
    - xfs: use setattr_copy to set vfs inode attributes
    - fs: add mode_strip_sgid() helper
    - fs: move S_ISGID stripping into the vfs_*() helpers
    - attr: add in_group_or_capable()
    - fs: move should_remove_suid()
    - attr: add setattr_should_drop_sgid()
    - attr: use consistent sgid stripping checks
    - fs: use consistent setgid checks in is_sxid()
    - xfs: remove xfs_setattr_time() declaration
    - HID: core: Provide new max_buffer_size attribute to over-ride the default
    - HID: uhid: Over-ride the default maximum data buffer value with our own
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.177
    - perf/core: Fix perf_output_begin parameter is incorrectly invoked in
      perf_event_bpf_output
    - perf: fix perf_event_context->time
    - ipmi:ssif: make ssif_i2c_send() void
    - ipmi:ssif: Increase the message retry time
    - ipmi:ssif: resend_msg() cannot fail
    - ipmi:ssif: Add a timer between request retries
    - KVM: Clean up benign vcpu->cpu data races when kicking vCPUs
    - KVM: KVM: Use cpumask_available() to check for NULL cpumask when kicking
      vCPUs
    - KVM: Optimize kvm_make_vcpus_request_mask() a bit
    - KVM: Pre-allocate cpumasks for kvm_make_all_cpus_request_except()
    - KVM: Register /dev/kvm as the _very_ last thing during initialization
    - [arm64] serial: fsl_lpuart: Fix comment typo
    - [arm64] tty: serial: fsl_lpuart: fix race on RX DMA shutdown
    - [arm64,armhf] drm/sun4i: fix missing component unbind on bind errors
    - net: tls: fix possible race condition between do_tls_getsockopt_conf() and
      do_tls_setsockopt_conf() (CVE-2023-28466)
    - [x86] power: supply: bq24190_charger: using pm_runtime_resume_and_get
      instead of pm_runtime_get_sync
    - [x86] power: supply: bq24190: Fix use after free bug in bq24190_remove due
      to race condition
    - [armhf] dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl
    - xsk: Add missing overflow check in xdp_umem_reg
    - iavf: fix inverted Rx hash condition leading to disabled hash
    - iavf: fix non-tunneled IPv6 UDP packet type and hashing
    - intel/igbvf: free irq on the error path in igbvf_request_msix()
    - igbvf: Regard vf reset nack as success
    - igc: fix the validation logic for taprio's gate list
    - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
    - net: usb: smsc95xx: Limit packet length to skb->len
    - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
    - [x86] xirc2ps_cs: Fix use after free bug in xirc2ps_detach (CVE-2023-1670)
    - net: phy: Ensure state transitions are processed from phy_stop()
    - net: mdio: fix owner field for mdio buses registered using device-tree
    - [arm64] net: qcom/emac: Fix use after free bug in emac_remove due to race
      condition
    - keys: Do not cache key in task struct if key is requested from kernel
      thread
    - bpf: Adjust insufficient default bpf_jit_limit
    - net/mlx5: Fix steering rules cleanup
    - net/mlx5: Read the TC mapping of all priorities on ETS query
    - net/mlx5: E-Switch, Fix an Oops in error handling code
    - atm: idt77252: fix kmemleak when rmmod idt77252
    - erspan: do not use skb_mac_header() in ndo_start_xmit()
    - nvme-tcp: fix nvme_tcp_term_pdu to match spec
    - [amd64,arm64] gve: Cache link_speed value from device
    - [arm64] net: mdio: thunder: Add missing fwnode_handle_put()
    - [arm64] Bluetooth: btqcomsmd: Fix command timeout after setting BD address
    - Bluetooth: L2CAP: Fix not checking for maximum number of DCID
    - Bluetooth: L2CAP: Fix responding with wrong PDU type
    - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to
      unfinished work (CVE-2023-1989)
    - [arm64] platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl
    - hwmon: fix potential sensor registration fail if of_node is missing
    - [x86] hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
    - scsi: qla2xxx: Perform lockless command completion in abort path
    - [x86] thunderbolt: Use scale field when allocating USB3 bandwidth
    - [x86] thunderbolt: Use const qualifier for `ring_interrupt_index`
    - HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded
    - scsi: target: iscsi: Fix an error message in iscsi_check_key()
    - [arm64] scsi: hisi_sas: Check devm_add_action() return value
    - scsi: ufs: core: Add soft dependency on governor_simpleondemand
    - scsi: lpfc: Avoid usage of list iterator variable after loop
    - [x86] scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file
    - net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
    - net: usb: qmi_wwan: add Telit 0x1080 composition
    - cifs: empty interface list when server doesn't support query interfaces
    - scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
    - [arm*] usb: dwc2: fix a devres leak in hw_enable upon suspend resume
    - usb: gadget: u_audio: don't let userspace block driver unbind
    - fsverity: Remove WQ_UNBOUND from fsverity read workqueue
    - igb: revert rtnl_lock() that causes deadlock
    - dm thin: fix deadlock when swapping to thin device
    - [arm64,armhf] usb: chipdea: core: fix return -EINVAL if request role is
      the same with current role
    - [arm64,armhf] usb: chipidea: core: fix possible concurrent when switch
      role
    - usb: ucsi: Fix NULL pointer deref in ucsi_connector_change()
    - wifi: mac80211: fix qos on mesh interfaces
    - nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
    - [x86] drm/i915/active: Fix missing debug object activation
    - [x86] drm/i915: Preserve crtc_state->inherited during state clearing
    - [arm64] i2c: xgene-slimpro: Fix out-of-bounds bug in
      xgene_slimpro_i2c_xfer() (CVE-2023-2194)
    - dm stats: check for and propagate alloc_percpu failure
    - dm crypt: add cond_resched() to dmcrypt_write()
    - sched/fair: sanitize vruntime of entity being placed
    - sched/fair: Sanitize vruntime of entity being migrated
    - ocfs2: fix data corruption after failed write
    - xfs: shut down the filesystem if we screw up quota reservation
    - xfs: don't reuse busy extents on extent trim
    - KVM: fix memoryleak in kvm_init()
    - NFSD: fix use-after-free in __nfs42_ssc_open() (CVE-2022-4379)
    - [arm64,armhf] usb: dwc3: gadget: move cmd_endtransfer to extra function
    - [arm64,armhf] usb: dwc3: gadget: Add 1ms delay after end transfer command
      without IOC
    - [arm64] drm/meson: Fix error handling when afbcd.ops->init fails
    - [arm64] drm/meson: fix missing component unbind on bind errors
    - dm crypt: avoid accessing uninitialized tasklet
    - fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY
    - md: avoid signed overflow in slot_store()
    - [x86] ALSA: asihpi: check pao in control_message()
    - ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
    - sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
    - tracing: Fix wrong return in kprobe_event_gen_test.c
    - sfc: ef10: don't overwrite offload features at NIC reset
    - scsi: megaraid_sas: Fix crash after a double completion
    - [arm64] ptp_qoriq: fix memory leak in probe()
    - r8169: fix RTL8168H and RTL8107E rx crc error
    - [arm*] regulator: Handle deferred clk
    - net/net_failover: fix txq exceeding warning
    - net: stmmac: don't reject VLANs when IFF_PROMISC is set
    - ALSA: ymfpci: Fix assignment in if condition
    - ALSA: ymfpci: Fix BUG_ON in probe function
    - i40e: fix registers dump after run ethtool adapter self test
    - bnxt_en: Fix typo in PCI id to device description string mapping
    - bnxt_en: Add missing 200G link speed reporting
    - [arm64,armhf] net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
    - Input: alps - fix compatibility with -funsigned-char
    - Input: focaltech - use explicitly signed char type
    - cifs: prevent infinite recursion in CIFSGetDFSRefer()
    - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
    - Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table
    - btrfs: fix race between quota disable and quota assign ioctls
      (CVE-2023-1611)
    - xen/netback: don't do grant copy across page boundary
    - pinctrl: amd: Disable and mask interrupts on resume
    - [powerpc*] Don't try to copy PPR for task with NULL pt_regs
    - NFSv4: Fix hangs when recovering open state after a server reboot
    - ALSA: hda/conexant: Partial revert of a quirk for Lenovo
    - ALSA: usb-audio: Fix regression on detection of Roland VS-100
    - ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z
    - rcu: Fix rcu_torture_read ftrace event
    - [armhf] drm/etnaviv: fix reference leak when mmaping imported buffer
    - drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub
    - [s390x] uaccess: add missing earlyclobber annotations to __clear_user()
    - btrfs: scan device in non-exclusive mode
    - zonefs: Fix error message in zonefs_file_dio_append()
    - ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
    - gfs2: Always check inode size of inline inodes
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.178
    - [x86] Drivers: vmbus: Check for channel allocation before looking up
      relids
    - [arm64] pwm: cros-ec: Explicitly set .polarity in .get_state()
    - [s390x] KVM: s390: pv: fix external interruption loop not always detected
    - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded
      sta
    - icmp: guard against too small mtu
    - net: don't let netpoll invoke NAPI if in xmit context
    - sctp: check send stream number after wait_for_sndbuf
    - ipv6: Fix an uninit variable access bug in __ip6_make_skb()
    - net: stmmac: fix up RX flow hash indirection table when setting channels
    - sunrpc: only free unix grouplist after RCU settles
    - NFSD: callback request does not use correct credential for AUTH_SYS
    - [arm64,armhf] usb: xhci: tegra: fix sleep in atomic call
    - xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu
    - USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs
    - usb: typec: altmodes/displayport: Fix configure initial pin assignment
    - USB: serial: option: add Telit FE990 compositions
    - USB: serial: option: add Quectel RM500U-CN modem
    - iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip
    - iio: light: cm32181: Unregister second I2C client if present
    - [arm64] tty: serial: fsl_lpuart: avoid checking for transfer complete when
      UARTCTRL_SBK is asserted in lpuart32_tx_empty
    - nilfs2: fix potential UAF of struct nilfs_sc_info in
      nilfs_segctor_thread()
    - nilfs2: fix sysfs interface lifetime
    - dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs
    - ALSA: hda/realtek: Add quirk for Clevo X370SNW
    - iio: adc: ad7791: fix IRQ flags
    - scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
    - perf/core: Fix the same task check in perf_event_set_output
    - ftrace: Mark get_lock_parent_ip() __always_inline
    - ftrace: Fix issue that 'direct->addr' not restored in
      modify_ftrace_direct()
    - can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access
    - can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events
    - tracing: Free error logs of tracing instances
    - ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots()
    - [arm64,armhf] drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error
      path
    - drm/nouveau/disp: Support more modes by checking with lower bpc
    - ring-buffer: Fix race while reader and writer are on the same page
    - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
    - ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown
    - bpftool: Print newline before '}' for struct with padding only fields
    - Revert "pinctrl: amd: Disable and mask interrupts on resume"
    - ALSA: emu10k1: fix capture interrupt handler unlinking
    - ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard
    - ALSA: i2c/cs8427: fix iec958 mixer control deactivation
    - ALSA: firewire-tascam: add missing unwind goto in
      snd_tscm_stream_start_duplex()
    - ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
    - Bluetooth: Fix race condition in hidp_session_thread
    - btrfs: print checksum type and implementation at mount time
    - btrfs: fix fast csum implementation detection
    - fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace
    - mtdblock: tolerate corrected bit-flips
    - [armhf] mtd: rawnand: stm32_fmc2: remove unsupported EDO mode
    - [armhf] mtd: rawnand: stm32_fmc2: use timings.mode instead of checking
      tRC_min
    - IB/mlx5: Add support for NDR link speed
    - IB/mlx5: Add support for 400G_8X lane speed
    - RDMA/cma: Allow UD qp_type to join multicast only
    - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race
      condition (CVE-2023-1859)
    - niu: Fix missing unwind goto in niu_alloc_channels()
    - sysctl: add proc_dou8vec_minmax()
    - ipv4: shrink netns_ipv4 with sysctl conversions
    - tcp: convert elligible sysctls to u8
    - tcp: restrict net.ipv4.tcp_app_win
    - [armhf] drm/armada: Fix a potential double free in an error handling path
    - qlcnic: check pci_reset_function result
    - sctp: fix a potential overflow in sctp_ifwdtsn_skip
    - RDMA/core: Fix GID entry ref leak when create_ah fails
    - udp6: fix potential access to stale information
    - [arm64] net: macb: fix a memory corruption in extended buffer descriptor
      mode
    - [arm64] power: supply: cros_usbpd: reclassify "default case!" as debug
    - wifi: mwifiex: mark OF related data as maybe unused
    - [x86] efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L
    - drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F
    - [amd64] verify_pefile: relax wrapper length check
    - asymmetric_keys: log on fatal failures in PE/pkcs7
    - net: sfp: initialize sfp->i2c_block_size at sfp allocation
    - scsi: ses: Handle enclosure with just a primary component gracefully
    - [x86] PCI: Add quirk for AMD XHCI controller that loses MSI-X state in
      D3hot
    - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()
    - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
    - mtd: ubi: wl: Fix a couple of kernel-doc issues
    - ubi: Fix deadlock caused by recursively holding work_sem
    - [powerpc*] pseries: rename min_common_depth to primary_domain_index
    - [powerpc*] pseries: Rename TYPE1_AFFINITY to FORM1_AFFINITY
    - [powerpc*] pseries: Consolidate different NUMA distance update code paths
    - [powerpc*] pseries: Add a helper for form1 cpu distance
    - [powerpc*] pseries: Add support for FORM2 associativity
    - [powerpc*] papr_scm: Update the NUMA distance table for the target node
    - sched/fair: Move calculate of avg_load to a better location
    - sched/fair: Fix imbalance overflow
    - [x86] rtc: Remove __init for runtime functions
    - i2c: ocores: generate stop condition after timeout in polling mode
    - [arm64] watchdog: sbsa_wdog: Make sure the timeout programming is within
      the limits
    - kbuild: check the minimum assembler version in Kconfig
    - kbuild: Switch to 'f' variants of integrated assembler flag
    - kexec: move locking into do_kexec_load
    - kexec: turn all kexec_mutex acquisitions into trylocks
    - panic, kexec: make __crash_kexec() NMI safe
    - sysctl: Fix data-races in proc_dou8vec_minmax().

  [ Salvatore Bonaccorso ]
  * Refresh "security,perf: Allow further restriction of perf_event_open"
  * [rt] Update to 5.10.165-rt81
  * Bump ABI to 22
  * [rt] Refresh "printk: add pr_flush()"
  * [rt] Update to 5.10.168-rt83
  * [rt] Update to 5.10.176-rt86

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 21 Apr 2023 13:24:45 +0200

linux (5.10.162-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.159
    - [armhf] dts: rockchip: fix node name for hym8563 rtc
    - [armhf] dts: rockchip: fix ir-receiver node names
    - [arm64] dts: rockchip: fix ir-receiver node names
    - [armel,armhf] 9266/1: mm: fix no-MMU ZERO_PAGE() implementation
    - 9p/fd: Use P9_HDRSZ for header size
    - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
    - btrfs: send: avoid unaligned encoded writes when attempting to clone range
    - ASoC: soc-pcm: Add NULL check in BE reparenting
    - [armhf] regulator: twl6030: fix get status of twl6032 regulators
    - fbcon: Use kzalloc() in fbcon_prepare_logo()
    - [arm64,armhf] usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End
      Transfer
    - 9p/xen: check logical size for buffer size
    - net: usb: qmi_wwan: add u-blox 0x1342 composition
    - mm/khugepaged: take the right locks for page table retraction
    - mm/khugepaged: fix GUP-fast interaction by sending IPI
    - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
    - rtc: mc146818: Prevent reading garbage
    - rtc: mc146818: Detect and handle broken RTCs
    - rtc: mc146818: Dont test for bit 0-5 in Register D
    - rtc: cmos: remove stale REVISIT comments
    - rtc: mc146818-lib: change return values of mc146818_get_time()
    - rtc: Check return value from mc146818_get_time()
    - rtc: mc146818-lib: fix RTC presence check
    - rtc: mc146818-lib: extract mc146818_avoid_UIP
    - rtc: cmos: avoid UIP when writing alarm time
    - rtc: cmos: avoid UIP when reading alarm time
    - rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ
    - rtc: mc146818: Reduce spinlock section in mc146818_set_time()
    - media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area()
    - media: v4l2-dv-timings.c: fix too strict blanking sanity checks
    - memcg: fix possible use-after-free in memcg_write_event_control()
    - mm/gup: fix gup_pud_range() for dax
    - Bluetooth: btusb: Add debug message for CSR controllers
    - Bluetooth: Fix crash when replugging CSR fake controllers
    - [s390x] KVM: s390: vsie: Fix the initialization of the epoch extension
      (epdx) field
    - [x86] drm/vmwgfx: Don't use screen objects when SEV is active
    - drm/shmem-helper: Remove errant put in error path
    - drm/shmem-helper: Avoid vm_open error paths
    - HID: usbhid: Add ALWAYS_POLL quirk for some mice
    - HID: hid-lg4ff: Add check for empty lbuf
    - HID: core: fix shift-out-of-bounds in hid_report_raw_event
    - can: af_can: fix NULL pointer dereference in can_rcv_filter
    - mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page
      (CVE-2022-3623)
    - rtc: cmos: Disable irq around direct invocation of cmos_interrupt()
    - rtc: mc146818-lib: fix locking in mc146818_set_time
    - rtc: mc146818-lib: fix signedness bug in mc146818_get_time()
    - netfilter: nft_set_pipapo: Actually validate intervals in fields after the
      first one
    - ieee802154: cc2520: Fix error return code in cc2520_hw_init()
    - netfilter: ctnetlink: fix compilation warning after data race fixes in ct
      mark
    - e1000e: Fix TX dispatch condition
    - igb: Allocate MSI-X vector when testing
    - [arm64,armhf] drm: bridge: dw_hdmi: fix preference of RGB modes over
      YUV420
    - af_unix: Get user_ns from in_skb in unix_diag_get_exact().
    - [x86] vmxnet3: correctly report encapsulated LRO packet
    - Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn()
    - Bluetooth: Fix not cleanup led when bt_init fails
    - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
    - xen-netfront: Fix NULL sring after live migration
    - [arm64,armhf] net: mvneta: Prevent out of bounds read in
      mvneta_config_rss()
    - i40e: Fix not setting default xps_cpus after reset
    - i40e: Fix for VF MAC address 0
    - i40e: Disallow ip4 and ip6 l4_4_bytes
    - nvme initialize core quirks before calling nvme_init_subsystem
    - net: stmmac: fix "snps,axi-config" node property parsing
    - ip_gre: do not report erspan version on GRE interface
    - [arm64] net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq
    - [arm64] net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
    - [arm64] net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
    - tipc: Fix potential OOB in tipc_link_proto_rcv()
    - ipv4: Fix incorrect route flushing when source address is deleted
    - ipv4: Fix incorrect route flushing when table ID 0 is used
    - tipc: call tipc_lxc_xmit without holding node_read_lock
    - [x86] net: plip: don't call kfree_skb/dev_kfree_skb() under
      spin_lock_irq()
    - ipv6: avoid use-after-free in ip6_fragment()
    - [arm64,armhf] net: mvneta: Fix an out of bounds check
    - macsec: add missing attribute validation for offload
    - can: esd_usb: Allow REC and TEC to return to zero
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.160
    - [x86] smpboot: Move rcu_cpu_starting() earlier
    - vfs: fix copy_file_range() regression in cross-fs copies
    - vfs: fix copy_file_range() averts filesystem freeze protection
    - nfp: fix use-after-free in area_cache_get() (CVE-2022-3545)
    - fuse: always revalidate if exclusive create
    - io_uring: add missing item types for splice request (CVE-2022-4696)
    - ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
    - can: mcba_usb: Fix termination command argument
    - [armel,armhf] ASoC: cs42l51: Correct PGA Volume minimum value
    - nvme-pci: clear the prp2 field when not used
    - ASoC: ops: Correct bounds check for second channel on SX controls
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.161
    - udf: Discard preallocation before extending file with a hole
    - udf: Fix preallocation discarding at indirect extent boundary
    - udf: Do not bother looking for prealloc extents if i_lenExtents matches
      i_size
    - udf: Fix extending file within last block
    - usb: gadget: uvc: Prevent buffer overflow in setup handler
    - USB: serial: option: add Quectel EM05-G modem
    - USB: serial: cp210x: add Kamstrup RF sniffer PIDs
    - USB: serial: f81232: fix division by zero on line-speed change
    - USB: serial: f81534: fix division by zero on line-speed change
    - xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N
    - igb: Initialize mailbox message for VF reset
    - HID: ite: Add support for Acer S1002 keyboard-dock
    - HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch 10E
    - HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10
    - HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk
    - Bluetooth: L2CAP: Fix u8 overflow (CVE-2022-45934)
    - net: loopback: use NET_NAME_PREDICTABLE for name_assign_type
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.162
    - kernel: provide create_io_thread() helper
    - iov_iter: add helper to save iov_iter state
    - saner calling conventions for unlazy_child()
    - fs: add support for LOOKUP_CACHED
    - fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy*
    - Make sure nd->path.mnt and nd->path.dentry are always valid pointers
    - fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED
    - tools headers UAPI: Sync openat2.h with the kernel sources
    - net: provide __sys_shutdown_sock() that takes a socket
    - net: add accept helper not installing fd
    - signal: Add task_sigpending() helper
    - fs: make do_renameat2() take struct filename
    - file: Rename __close_fd_get_file close_fd_get_file
    - fs: provide locked helper variant of close_fd_get_file()
    - entry: Add support for TIF_NOTIFY_SIGNAL
    - task_work: Use TIF_NOTIFY_SIGNAL if available
    - [x86] Wire up TIF_NOTIFY_SIGNAL
    - [arm64] add support for TIF_NOTIFY_SIGNAL
    - [powerpc*] add support for TIF_NOTIFY_SIGNAL
    - [mips*] add support for TIF_NOTIFY_SIGNAL
    - [s390x] add support for TIF_NOTIFY_SIGNAL
    - [armel,armhf] add support for TIF_NOTIFY_SIGNAL
    - task_work: remove legacy TWA_SIGNAL path
    - kernel: remove checking for TIF_NOTIFY_SIGNAL
    - coredump: Limit what can interrupt coredumps
    - kernel: allow fork with TIF_NOTIFY_SIGNAL pending
    - entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set
    - arch: setup PF_IO_WORKER threads like PF_KTHREAD
    - arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread()
    - [x86] process: setup io_threads more like normal user space threads
    - kernel: stop masking signals in create_io_thread()
    - kernel: don't call do_exit() for PF_IO_WORKER threads
    - task_work: add helper for more targeted task_work canceling
    - io_uring: import 5.15-stable io_uring
    - signal: kill JOBCTL_TASK_WORK
    - task_work: unconditionally run task_work from get_signal()
    - net: remove cmsg restriction from io_uring based send/recvmsg calls
    - Revert "proc: don't allow async path resolution of /proc/thread-self
      components"
    - Revert "proc: don't allow async path resolution of /proc/self components"
    - eventpoll: add EPOLL_URING_WAKE poll wakeup flag
    - eventfd: provide a eventfd_signal_mask() helper
    - io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups

  [ Salvatore Bonaccorso ]
  * linux-kbuild: Include scripts/pahole-flags.sh (Closes: #1008501)
  * Bump ABI to 21
  * Refresh "Export symbols needed by Android drivers"
  * ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio
    (Closes: #1027430, #1027483)
  * ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire
    (Closes: #1027430, #1027483)
  * [rt] Update to 5.10.162-rt78
  * i2c: ismt: Fix an out-of-bounds bug in ismt_access() (CVE-2022-2873)
  * [x86] drm/vmwgfx: Validate the box size for the snooped cursor
    (CVE-2022-36280)
  * media: dvb-core: Fix UAF due to refcount races at releasing (CVE-2022-41218)
  * net: sched: disallow noqueue for qdisc classes (CVE-2022-47929)
  * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
    (CVE-2023-0266)
  * net: sched: cbq: dont intepret cls results when asked to drop
    (CVE-2023-23454)
  * net: sched: atm: dont intepret cls results when asked to drop
    (CVE-2023-23455)
  * netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
    (CVE-2023-0179)
  * ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
    (CVE-2023-0394)
  * [rt] arm64: make _TIF_WORK_MASK bits contiguous

  [ Ben Hutchings ]
  * Disable SECURITY_LOCKDOWN_LSM and MODULE_SIG where we don't sign code
    (Closes: #825141)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 21 Jan 2023 15:35:48 +0100

linux (5.10.158-2) bullseye; urgency=medium

  * xen/netback: fix build warning

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 13 Dec 2022 21:46:50 +0100

linux (5.10.158-1) bullseye; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.150
    - ALSA: oss: Fix potential deadlock at unregistration
    - ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
    - ALSA: usb-audio: Fix potential memory leaks
    - ALSA: usb-audio: Fix NULL dererence at error path
    - ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
    - ALSA: hda/realtek: Correct pin configs for ASUS G533Z
    - ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
    - ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
    - cifs: destage dirty pages before re-reading them for cache=none
    - cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
    - iio: dac: ad5593r: Fix i2c read protocol requirements
    - iio: ltc2497: Fix reading conversion results
    - iio: adc: ad7923: fix channel readings for some variants
    - iio: pressure: dps310: Refactor startup procedure
    - iio: pressure: dps310: Reset chip after timeout
    - usb: add quirks for Lenovo OneLink+ Dock
    - can: kvaser_usb: Fix use of uninitialized completion
    - can: kvaser_usb_leaf: Fix overread with an invalid command
    - can: kvaser_usb_leaf: Fix TX queue out of sync after restart
    - can: kvaser_usb_leaf: Fix CAN state after restart
    - fs: dlm: fix race between test_bit() and queue_work()
    - fs: dlm: handle -EBUSY first in lock arg validation
    - HID: multitouch: Add memory barriers
    - quota: Check next/prev free block number after reading from quota file
    - [arm64,armhf] platform/chrome: cros_ec_proto: Update version on
      GET_NEXT_EVENT failure
    - [arm64] regulator: qcom_rpm: Fix circular deferral regression
    - nvme-pci: set min_align_mask before calculating max_hw_sectors
    - drm/virtio: Check whether transferred 2D BO is shmem
    - drm/udl: Restore display mode on resume
    - block: fix inflight statistics of part0
    - mm/mmap: undo ->mmap() when arch_validate_flags() fails
    - PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
    - [x86] powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL
      domain
    - scsi: qedf: Populate sysfs attributes for vport
    - fbdev: smscufx: Fix use-after-free in ufx_ops_open() (CVE-2022-41849)
    - btrfs: fix race between quota enable and quota rescan ioctl
    - f2fs: increase the limit for reserve_root
    - f2fs: fix to do sanity check on destination blkaddr during recovery
    - f2fs: fix to do sanity check on summary info
    - jbd2: wake up journal waiters in FIFO order, not LIFO
    - jbd2: fix potential buffer head reference count leak
    - jbd2: fix potential use-after-free in jbd2_fc_wait_bufs
    - jbd2: add miss release buffer head in fc_do_one_pass()
    - ext4: avoid crash when inline data creation follows DIO write
    - ext4: fix null-ptr-deref in ext4_write_info
    - ext4: make ext4_lazyinit_thread freezable
    - ext4: don't increase iversion counter for ea_inodes
    - ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
    - ext4: place buffer head allocation before handle start
    - ext4: fix miss release buffer head in ext4_fc_write_inode
    - ext4: fix potential memory leak in ext4_fc_record_modified_inode()
    - ext4: fix potential memory leak in ext4_fc_record_regions()
    - ext4: update 'state->fc_regions_size' after successful memory allocation
    - [amd64] livepatch: fix race between fork and KLP transition
    - ftrace: Properly unset FTRACE_HASH_FL_MOD
    - ring-buffer: Allow splice to read previous partially read pages
    - ring-buffer: Have the shortest_full queue be the shortest not longest
    - ring-buffer: Check pending waiters when doing wake ups as well
    - ring-buffer: Add ring_buffer_wake_waiters()
    - ring-buffer: Fix race between reset page and reading page
    - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
    - [x86] thunderbolt: Explicitly enable lane adapter hotplug events at
      startup
    - efi: libstub: drop pointless get_memory_map() call
    - [arm64,armhf] media: cedrus: Set the platform driver data earlier
    - [x86] KVM: x86/emulator: Fix handing of POP SS to correctly set
      interruptibility
    - [x86] KVM: nVMX: Unconditionally purge queued/injected events on nested
      "exit"
    - [x86] KVM: VMX: Drop bits 31:16 when shoving exception error code into
      VMCS
    - drm/nouveau/kms/nv140-: Disable interlacing
    - drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
    - [x86] drm/i915: Fix watermark calculations for gen12+ RC CCS modifier
    - [x86] drm/i915: Fix watermark calculations for gen12+ MC CCS modifier
    - smb3: must initialize two ACL struct fields to zero
    - selinux: use "grep -E" instead of "egrep"
    - userfaultfd: open userfaultfds with O_RDONLY
    - [armel,armhf] 9244/1: dump: Fix wrong pg_level in walk_pmd()
    - [armel,armhf] 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
    - objtool: Preserve special st_shndx indexes in elf_update_symbol
    - nfsd: Fix a memory leak in an error handling path
    - wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
    - wifi: mac80211: allow bw change during channel switch in mesh
    - bpftool: Fix a wrong type cast in btf_dumper_int
    - [x86] resctrl: Fix to restore to original value when re-enabling hardware
      prefetch register
    - Bluetooth: btusb: Fine-tune mt7663 mechanism.
    - Bluetooth: btusb: fix excessive stack usage
    - Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend
    - wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
    - [arm64] spi: qup: add missing clk_disable_unprepare on error in
      spi_qup_resume()
    - [arm64] spi: qup: add missing clk_disable_unprepare on error in
      spi_qup_pm_resume_runtime()
    - wifi: rtl8xxxu: Fix skb misuse in TX queue selection
    - [arm64,armhf] spi: meson-spicc: do not rely on busy flag in pow2 clk ops
    - bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
    - wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
    - wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask
    - bpf: Ensure correct locking around vulnerable function find_vpid()
    - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
    - wifi: ath11k: fix number of VHT beamformee spatial streams
    - [x86] microcode/AMD: Track patch allocation size explicitly
    - [x86] cpu: Include the header of init_ia32_feat_ctl()'s prototype
    - Bluetooth: hci_core: Fix not handling link timeouts propertly
    - netfilter: nft_fib: Fix for rpath check with VRF devices
    - wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM
    - vhost/vsock: Use kvmalloc/kvfree for larger packets.
    - mISDN: fix use-after-free bugs in l1oip timer handlers (CVE-2022-3565)
    - sctp: handle the error returned from sctp_auth_asoc_init_active_key
    - tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
    - spi: Ensure that sg_table won't be used after being freed
    - net: rds: don't hold sock lock when cancelling work from
      rds_tcp_reset_callbacks()
    - bnx2x: fix potential memory leak in bnx2x_tpa_stop() (CVE-2022-3542)
    - net/ieee802154: reject zero-sized raw_sendmsg()
    - once: add DO_ONCE_SLOW() for sleepable contexts
    - [arm64,armhf] net: mvpp2: fix mvpp2 debugfs leak (CVE-2022-3535)
    - [arm64] drm: bridge: adv7511: fix CEC power down control register offset
    - drm/bridge: Avoid uninitialized variable warning
    - drm/mipi-dsi: Detach devices when removing the host
    - drm/dp_mst: fix drm_dp_dpcd_read return value checks
    - [x86] platform/chrome: fix double-free in chromeos_laptop_prepare()
    - [arm64] platform/chrome: fix memory corruption in ioctl
    - [x86] platform/x86: msi-laptop: Fix old-ec check for backlight registering
    - [x86] platform/x86: msi-laptop: Fix resource cleanup
    - ALSA: hda: beep: Simplify keep-power-at-enable behavior
    - [armhf] drm/omap: dss: Fix refcount leak bugs
    - [armhf] ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
    - [arm64] drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
    - [arm64] drm/msm/dp: correct 1.62G link rate at
      dp_catalog_ctrl_config_msa()
    - ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
    - [arm*] ALSA: dmaengine: increment buffer pointer atomically
    - [armhf] mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
    - ALSA: hda/hdmi: Don't skip notification handling during PM operation
    - [armel,armhf] memory: pl353-smc: Fix refcount leak bug in
      pl353_smc_probe()
    - [armhf] memory: of: Fix refcount leak bug in of_get_ddr_timings()
    - [armhf] memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
    - [armhf] dts: turris-omnia: Fix mpp26 pin name and comment
    - [arm64] ftrace: fix module PLTs with mcount
    - [armhf] dts: exynos: fix polarity of VBUS GPIO of Origen
    - iio: inkern: only release the device node when done with it
    - iio: ABI: Fix wrong format of differential capacitance channel ABI.
    - usb: ch9: Add USB 3.2 SSP attributes
    - usb: common: Parse for USB SSP genXxY
    - usb: common: add function to get interval expressed in us unit
    - usb: common: move function's kerneldoc next to its definition
    - usb: common: debug: Check non-standard control requests
    - [arm64,armhf] clk: meson: Hold reference returned by of_get_parent()
    - [arm64] clk: qoriq: Hold reference returned by of_get_parent()
    - [arm64] clk: tegra: Fix refcount leak in tegra210_clock_init
    - [arm64] clk: tegra: Fix refcount leak in tegra114_clock_init
    - [armhf] HSI: omap_ssi: Fix refcount leak in ssi_probe
    - [armhf] HSI: omap_ssi_port: Fix dma_map_sg error check
    - [arm64] tty: xilinx_uartps: Fix the ignore_status
    - RDMA/rxe: Fix "kernel NULL pointer dereference" error
    - RDMA/rxe: Fix the error caused by qp->sk
    - ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
    - ata: fix ata_id_has_devslp()
    - ata: fix ata_id_has_ncq_autosense()
    - ata: fix ata_id_has_dipm()
    - md: Replace snprintf with scnprintf
    - md/raid5: Ensure stripe_fill happens on non-read IO with journal
    - RDMA/cm: Use SLID in the work completion as the DLID in responder side
    - IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
    - xhci: Don't show warning for reinit on known broken suspend
    - usb: gadget: function: fix dangling pnp_string in f_printer.c
    - drivers: serial: jsm: fix some leaks in probe
    - serial: 8250: Add an empty line and remove some useless {}
    - serial: 8250: Toggle IER bits on only after irq has been set up
    - [arm64] tty: serial: fsl_lpuart: disable dma rx/tx use flags in
      lpuart_dma_shutdown
    - [arm64] phy: qualcomm: call clk_disable_unprepare in the error handling
    - serial: 8250: Fix restoring termios speed after suspend
    - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
    - scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
    - [armhf] fsi: core: Check error number after calling ida_simple_get
    - [x86] mfd: intel_soc_pmic: Fix an error handling path in
      intel_soc_pmic_i2c_probe()
    - [mips*] mfd: sm501: Add check for platform_driver_register()
    - [amd64] dmaengine: ioat: stop mod_timer from resurrecting deleted timer in
      __cleanup()
    - [arm64] spmi: pmic-arb: correct duplicate APID to PPID mapping logic
    - [arm*] clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
    - [armhf] clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
    - [armhf] clk: ast2600: BCLK comes from EPLL
    - [powerpc*] pci_dn: Add missing of_node_put()
    - [powerpc*] powernv: add missing of_node_put() in opal_export_attrs()
    - [x86] hyperv: Fix 'struct hv_enlightened_vmcs' definition
    - [powerpc*] 64s: Fix GENERIC_CPU build flags for PPC970 / G5
    - [armhf] hwrng: imx-rngc - Moving IRQ handler registering after
      imx_rngc_irq_mask_clear()
    - cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
    - crypto: akcipher - default implementation for setting a private key
    - [x86] crypto: ccp - Release dma channels before dmaengine unrgister
    - [arm64] crypto: inside-secure - Change swab to swab32
    - [x86] crypto: qat - fix use of 'dma_map_single'
    - [x86] crypto: qat - use pre-allocated buffers in datapath
    - [x86] crypto: qat - fix DMA transfer direction
    - tracing: kprobe: Fix kprobe event gen test module on exit
    - tracing: kprobe: Make gen test module work in arm and riscv
    - [arm64] crypto: cavium - prevent integer overflow loading firmware
    - [arm64] thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id
    - ACPI: APEI: do not add task_work to kernel thread to avoid memory leak
    - f2fs: fix race condition on setting FI_NO_EXTENT flag
    - f2fs: fix to avoid REQ_TIME and CP_TIME collision
    - f2fs: fix to account FS_CP_DATA_IO correctly
    - rcu: Back off upon fill_page_cache_func() allocation failure
    - rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE()
    - [x86] ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
    - [x86] powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
    - [x86] thermal: intel_powerclamp: Use get_cpu() instead of
      smp_processor_id() to avoid crash
    - NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
    - NFSD: fix use-after-free on source server when doing inter-server copy
    - wifi: brcmfmac: fix invalid address access when enabling SCAN log level
    - bpftool: Clear errno after libcap's checks
    - openvswitch: Fix double reporting of drops in dropwatch
    - openvswitch: Fix overreporting of drops in dropwatch
    - tcp: annotate data-race around tcp_md5sig_pool_populated
    - wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
    - xfrm: Update ipcomp_scratches with NULL when freed
    - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
    - regulator: core: Prevent integer underflow
    - Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
    - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
    - can: bcm: check the result of can_send() in bcm_can_tx()
    - wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
    - wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
    - wifi: rt2x00: set VGC gain for both chains of MT7620
    - wifi: rt2x00: set SoC wmac clock register
    - wifi: rt2x00: correctly set BBP register 86 for MT7620
    - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
    - Bluetooth: L2CAP: Fix user-after-free
    - r8152: Rate limit overflow messages (CVE-2022-3594)
    - drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
    - drm: Use size_t type for len variable in drm_copy_field()
    - drm: Prevent drm_copy_field() to attempt copying a NULL pointer
    - drm/amd/display: fix overflow on MIN_I64 definition
    - [arm64,armhf] drm: bridge: dw_hdmi: only trigger hotplug event on link
      change
    - [arm*] drm/vc4: vec: Fix timings for VEC modes
    - drm: panel-orientation-quirks: Add quirk for Anbernic Win600
    - [arm64,armhf] platform/chrome: cros_ec: Notify the PM of wake events
      during resume
    - [x86] platform/x86: msi-laptop: Change DMI match / alias strings to fix
      module autoloading
    - [x86] ASoC: SOF: pci: Change DMI match info to support all Chrome
      platforms
    - drm/amdgpu: fix initial connector audio value
    - [arm64] drm/meson: explicitly remove aggregate driver at module unload
      time
    - [arm64] mmc: sdhci-msm: add compatible string check for sdm670
    - drm/dp: Don't rewrite link config when setting phy test pattern
    - drm/amd/display: Remove interface for periodic interrupt 1
    - btrfs: scrub: try to fix super block errors
    - [arm64] clk: zynqmp: Fix stack-out-of-bounds in strncpy`
    - media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
    - [arm64] clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
    - usb: host: xhci-plat: suspend and resume clocks
    - usb: host: xhci-plat: suspend/resume clks for brcm
    - scsi: 3w-9xxx: Avoid disabling device if failing to enable it
    - nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
    - blk-throttle: prevent overflow while calculating wait time
    - ata: libahci_platform: Sanity check the DT child nodes number
    - bcache: fix set_at_max_writeback_rate() for multiple attached devices
    - soundwire: cadence: Don't overwrite msg->buf during write commands
    - soundwire: intel: fix error handling on dai registration issues
    - HID: roccat: Fix use-after-free in roccat_read() (CVE-2022-41850)
    - md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
    - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
    - [arm64,armhf] usb: musb: Fix musb_gadget.c rxstate overflow bug
    - Revert "usb: storage: Add quirk for Samsung Fit flash"
    - staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
    - nvme: copy firmware_rev on each init
    - nvmet-tcp: add bounds check on Transfer Tag
    - usb: idmouse: fix an uninit-value in idmouse_open
    - [arm*] clk: bcm2835: Make peripheral PLLC critical
    - [arm64] topology: fix possible overflow in amu_fie_setup()
    - io_uring: correct pinned_vm accounting
    - mm: hugetlb: fix UAF in hugetlb_handle_userfault
    - net: ieee802154: return -EINVAL for unknown addr type
    - Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
    - net/ieee802154: don't warn zero-sized raw_sendmsg()
    - Revert "drm/amdgpu: use dirty framebuffer helper" (Closes: #1022806)
    - ext4: continue to expand file system when the target size doesn't reach
    - inet: fully convert sk->sk_rx_dst to RCU rules
    - [x86] thermal: intel_powerclamp: Use first online CPU as control_cpu
    - f2fs: fix wrong condition to trigger background checkpoint correctly
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.151
    - bpf: Generate BTF_KIND_FLOAT when linking vmlinux
    - kbuild: Quote OBJCOPY var to avoid a pahole call break the build
    - kbuild: skip per-CPU BTF generation for pahole v1.18-v1.21
    - kbuild: Unify options for BTF generation for vmlinux and modules
    - kbuild: Add skip_encoding_btf_enum64 option to pahole
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.152
    - ocfs2: clear dinode links count in case of error
    - ocfs2: fix BUG when iput after ocfs2_mknod fails
    - selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()
    - [x86] microcode/AMD: Apply the patch early on every logical thread
    - [x86] hwmon/coretemp: Handle large core ID value
    - [armhf] ata: ahci-imx: Fix MODULE_ALIAS
    - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
    - kvm: Add support for arch compat vm ioctls
    - [arm64] KVM: arm64: vgic: Fix exit condition in scan_its_table()
    - media: mceusb: set timeout to at least timeout provided
    - [arm64] media: venus: dec: Handle the case where find_format fails
    - block: wbt: Remove unnecessary invoking of wbt_update_limits in wbt_init
    - blk-wbt: call rq_qos_add() after wb_normal is initialized
    - [arm64] errata: Remove AES hwcap for COMPAT tasks
    - r8152: add PID for the Lenovo OneLink+ Dock
    - btrfs: fix processing of delayed data refs during backref walking
    - btrfs: fix processing of delayed tree block refs during backref walking
    - ACPI: extlog: Handle multiple records
    - tipc: Fix recognition of trial period
    - tipc: fix an information leak in tipc_topsrv_kern_subscr
    - i40e: Fix DMA mappings leak
    - HID: magicmouse: Do not set BTN_MOUSE on double report
    - sfc: Change VF mac via PF as first preference if available.
    - net/atm: fix proc_mpc_write incorrect return value
    - net: phy: dp83867: Extend RX strap quirk for SGMII mode
    - cifs: Fix xid leak in cifs_copy_file_range()
    - cifs: Fix xid leak in cifs_flock()
    - cifs: Fix xid leak in cifs_ses_add_channel()
    - nvme-hwmon: rework to avoid devm allocation
    - nvme-hwmon: Return error code when registration fails
    - nvme-hwmon: consistently ignore errors from nvme_hwmon_init
    - nvme-hwmon: kmalloc the NVME SMART log buffer
    - net: sched: cake: fix null pointer access issue when cake_init() fails
    - net: sched: delete duplicate cleanup of backlog and qlen
    - net: sched: sfb: fix null pointer access issue when sfb_init() fails
    - sfc: include vport_id in filter spec hash and equal()
    - [arm64] net: hns: fix possible memory leak in hnae_ae_register()
    - net: sched: fix race condition in qdisc_graft()
    - net: phy: dp83822: disable MDI crossover status change interrupt
    - [amd64] iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check()
    - [amd64] iommu/vt-d: Clean up si_domain in the init_dmars() error path
    - drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb()
    - [armhf] dmaengine: mxs-dma: Remove the unused .id_table
    - [armhf] dmaengine: mxs: use platform_driver_register
    - tracing: Simplify conditional compilation code in tracing_set_tracer()
    - tracing: Do not free snapshot if tracer is on cmdline
    - xen: assume XENFEAT_gnttab_map_avail_bits being set for pv guests
    - xen/gntdev: Accommodate VMA splitting
    - [arm64,armhf] mmc: sdhci-tegra: Use actual clock rate for SW tuning
      correction
    - fcntl: make F_GETOWN(EX) return 0 on dead owner task
    - fcntl: fix potential deadlocks for &fown_struct.lock
    - [arm64] topology: move store_cpu_topology() to shared code
    - [x86] hv_netvsc: Fix race between VF offering and VF association message
      from host
    - ACPI: video: Force backlight native for more TongFang devices
    - mmc: core: Add SD card quirk for broken discard
    - blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()
    - mm: /proc/pid/smaps_rollup: fix no vma's null-deref
    - udp: Update reuse->has_conns under reuseport_lock.
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.153
    - can: j1939: transport: j1939_session_skb_drop_old():
      spin_unlock_irqrestore() before kfree_skb()
    - can: kvaser_usb: Fix possible completions during init_completion
    - ALSA: Use del_timer_sync() before freeing timer
    - ALSA: au88x0: use explicitly signed char
    - ALSA: rme9652: use explicitly signed char
    - USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
    - [arm64,armhf] usb: dwc3: gadget: Stop processing more requests on IMI
    - [arm64,armhf] usb: dwc3: gadget: Don't set IMI for no_interrupt
    - usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96
      controller
    - [armhf] mtd: rawnand: marvell: Use correct logic for nand-keep-config
    - xhci: Add quirk to reset host back to default state at shutdown
    - xhci: Remove device endpoints from bandwidth list when freeing the device
    - iio: light: tsl2583: Fix module unloading
    - iio: temperature: ltc2983: allocate iio channels once
    - fbdev: smscufx: Fix several use-after-free bugs
    - fs/binfmt_elf: Fix memory leak in load_elf_binary()
    - exec: Copy oldsighand->action under spin-lock
    - mac802154: Fix LQI recording
    - scsi: qla2xxx: Use transport-defined speed mask for supported_speeds
    - [arm64] drm/msm/dsi: fix memory corruption with too many bridges
    - [arm64] drm/msm/hdmi: fix memory corruption with too many bridges
    - [arm64] drm/msm/dp: fix IRQ lifetime
    - mmc: core: Fix kernel panic when remove non-standard SDIO card
    - kernfs: fix use-after-free in __kernfs_remove
    - [s390x] futex: add missing EX_TABLE entry to __futex_atomic_op()
    - [s390x] pci: add missing EX_TABLE entries to
      __pcistg_mio_inuser()/__pcilg_mio_inuser()
    - Xen/gntdev: don't ignore kernel unmapping error
    - xen/gntdev: Prevent leaking grants
    - mm/memory: add non-anonymous page check in the copy_present_page()
    - mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
    - net: ieee802154: fix error return code in dgram_bind()
    - media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation
    - [arm64] drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
    - [arm64] ASoC: qcom: lpass-cpu: mark HDMI TX registers as volatile
    - [arm64] ASoC: qcom: lpass-cpu: Mark HDMI TX parity register as volatile
    - ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
    - [x86] perf/x86/intel/lbr: Use setup_clear_cpu_cap() instead of
      clear_cpu_cap()
    - tipc: fix a null-ptr-deref in tipc_topsrv_accept
    - [arm64] net: netsec: fix error handling in netsec_register_mdio()
    - net: hinic: fix incorrect assignment issue in hinic_set_interrupt_cfg()
    - net: hinic: fix memory leak when reading function table
    - net: hinic: fix the issue of CMDQ memory leaks
    - net: hinic: fix the issue of double release MBOX callback of VF
    - [x86] unwind/orc: Fix unreliable stack dump with gcov
    - [amd64,arm64] amd-xgbe: fix the SFP compliance codes check for DAC cables
    - [amd64,arm64] amd-xgbe: add the bit rate quirk for Molex cables
    - [amd64,arm64] atlantic: fix deadlock at aq_nic_stop
    - net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
    - tcp: minor optimization in tcp_add_backlog()
    - tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
    - tcp: fix indefinite deferral of RTO with SACK reneging
    - can: mcp251x: mcp251x_can_probe(): add missing unregister_candev() in
      error path
    - PM: hibernate: Allow hybrid sleep to work with s2idle
    - media: vivid: s_fbuf: add more sanity checks
    - media: vivid: dev->bitmap_cap wasn't freed in all cases
    - media: v4l2-dv-timings: add sanity checks for blanking values
    - media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced'
    - media: vivid: set num_in/outputs to 0 if not supported
    - ipv6: ensure sane device mtu in tunnels
    - i40e: Fix ethtool rx-flow-hash setting for X722
    - i40e: Fix VF hang when reset is triggered on another VF
    - i40e: Fix flow-type by setting GL_HASH_INSET registers
    - net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
    - PM: domains: Fix handling of unavailable/disabled idle states
    - [arm64,armhf] net: fec: limit register access on i.MX6UL
    - openvswitch: switch from WARN to pr_warn
    - nh: fix scope used to find saddr when adding non gw nh
    - net/mlx5e: Do not increment ESN when updating IPsec ESN state
    - net/mlx5: Fix possible use-after-free in async command interface
    - net/mlx5: Fix crash during sync firmware reset
    - [arm64] net: enetc: survive memory pressure without crashing
    - [arm64] Add AMPERE1 to the Spectre-BHB affected list
    - scsi: sd: Revert "scsi: sd: Remove a local variable"
    - [arm64] mm: Fix __enable_mmu() for new TGRAN range values
    - [arm64] kexec: Test page size support with new TGRAN range values
    - serial: core: move RS485 configuration tasks from drivers into core
    - serial: Deassert Transmit Enable on probe in driver-specific way
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.154
    - serial: 8250: Let drivers request full 16550A feature probing
    - [x86] KVM: nVMX: Pull KVM L0's desired controls directly from vmcs01
    - [x86] KVM: nVMX: Don't propagate vmcs12's PERF_GLOBAL_CTRL settings to
      vmcs02
    - [x86] KVM: x86: Trace re-injected exceptions
    - [x86] KVM: x86: Treat #DBs from the emulator as fault-like (code and
      DR7.GD=1)
    - [x86] topology: Set cpu_die_id only if DIE_TYPE found
    - [x86] topology: Fix multiple packages shown on a single-package system
    - [x86] topology: Fix duplicated core ID within a package
    - [x86] KVM: x86: Protect the unused bits in MSR exiting flags
    - [x86] KVM: x86: Copy filter arg outside kvm_vm_ioctl_set_msr_filter()
    - [x86] KVM: x86: Add compat handler for KVM_X86_SET_MSR_FILTER
    - RDMA/cma: Use output interface for net_dev check
    - [amd64] IB/hfi1: Correctly move list in sc_disable()
    - NFSv4: Fix a potential state reclaim deadlock
    - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
    - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
    - nfs4: Fix kmemleak when allocate slot failed
    - RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
    - RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
    - [arm64,armhf] net: fec: fix improper use of NETDEV_TX_BUSY
    - [i386] ata: pata_legacy: fix pdc20230_set_piomode()
    - net: sched: Fix use after free in red_enqueue()
    - net: tun: fix bugs for oversize packet when napi frags enabled
    - netfilter: nf_tables: release flow rule object from commit path
    - ipvs: use explicitly signed chars
    - ipvs: fix WARNING in __ip_vs_cleanup_batch()
    - ipvs: fix WARNING in ip_vs_app_net_cleanup()
    - rose: Fix NULL pointer dereference in rose_send_frame()
    - mISDN: fix possible memory leak in mISDN_register_device()
    - btrfs: fix inode list leak during backref walking at
      resolve_indirect_refs()
    - btrfs: fix inode list leak during backref walking at find_parent_nodes()
    - btrfs: fix ulist leaks in error paths of qgroup self tests
    - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
      (CVE-2022-3564)
    - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (CVE-2022-3640)
    - net: mdio: fix undefined behavior in bit shift for __mdiobus_register
    - net, neigh: Fix null-ptr-deref in neigh_table_clear()
    - ipv6: fix WARNING in ip6_route_net_exit_late()
    - [arm64] drm/msm/hdmi: Remove spurious IRQF_ONESHOT flag
    - [arm64] drm/msm/hdmi: fix IRQ lifetime
    - [arm64,armhf] mmc: sdhci-esdhc-imx: Propagate ESDHC_FLAG_HS400* only on
      8bit bus
    - mmc: sdhci-pci: Avoid comma separated statements
    - mmc: sdhci-pci-core: Disable ES for ASUS BIOS on Jasper Lake
    - xhci-pci: Set runtime PM as default policy on all xHC 1.2 or later devices
    - [s390x] boot: add secure boot trailer
    - media: dvb-frontends/drxk: initialize err to 0
    - ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()
    - scsi: core: Restrict legal sdev_state transitions via sysfs
    - HID: saitek: add madcatz variant of MMO7 mouse device ID
    - drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in SRIOV
      case
    - efi/tpm: Pass correct address to memblock_reserve
    - i2c: piix4: Fix adapter not be removed in piix4_remove()
    - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
      (CVE-2022-42896)
    - Bluetooth: L2CAP: Fix attempting to access uninitialized memory
      (CVE-2022-42895)
    - block, bfq: protect 'bfqd->queued' by 'bfqd->lock'
    - ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices
    - fscrypt: simplify master key locking
    - fscrypt: stop using keyrings subsystem for fscrypt_master_key
    - fscrypt: fix keyring memory leak on mount failure
    - tcp/udp: Fix memory leak in ipv6_renew_options(). (CVE-2022-3524)
    - [armhf] mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on
      program/erase times
    - memcg: enable accounting of ipc resources (CVE-2021-3759)
    - [arm*] binder: fix UAF of alloc->vma in race with munmap()
    - btrfs: fix type of parameter generation in btrfs_get_dentry
    - ftrace: Fix use-after-free for dynamic ftrace_ops
    - tcp/udp: Make early_demux back namespacified.
    - tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd()
    - kprobe: reverse kp->flags when arm_kprobe failed
    - tracing/histogram: Update document for KEYS_MAX size
    - capabilities: fix potential memleak on error path from
      vfs_getxattr_alloc()
    - fuse: add file_modified() to fallocate
    - efi: random: reduce seed size to 32 bytes
    - efi: random: Use 'ACPI reclaim' memory for random seed
    - [x86] perf/x86/intel: Fix pebs event constraints for ICL
    - [x86] perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[]
    - ext4: fix warning in 'ext4_da_release_space'
    - ext4: fix BUG_ON() when directory entry has invalid rec_len
    - [x86] KVM: x86: Mask off reserved bits in CPUID.80000006H
    - [x86] KVM: x86: Mask off reserved bits in CPUID.8000001AH
    - [x86] KVM: x86: Mask off reserved bits in CPUID.80000008H
    - [x86] KVM: x86: Mask off reserved bits in CPUID.80000001H
    - [x86] KVM: x86: emulator: em_sysexit should update ctxt->mode
    - [x86] KVM: x86: emulator: introduce emulator_recalc_and_set_mode
    - [x86] KVM: x86: emulator: update the emulation mode after CR0 write
    - ext4,f2fs: fix readahead of verity data
    - [arm64,armhf] drm/rockchip: dsi: Force synchronous probe
    - [x86] drm/i915/sdvo: Filter out invalid outputs more sensibly
    - [x86] drm/i915/sdvo: Setup DDC fully before output init
    - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
      (CVE-2022-3628)
    - ipc: remove memcg accounting for sops objects in do_semtimedop()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.155
    - fuse: fix readdir cache race
    - [armhf] phy: stm32: fix an error code in probe
    - wifi: cfg80211: silence a sparse RCU warning
    - wifi: cfg80211: fix memory leak in query_regdb_file()
    - bpf, sockmap: Fix the sk->sk_forward_alloc warning of
      sk_stream_kill_queues
    - bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without
      FILE
    - [x86] HID: hyperv: fix possible memory leak in mousevsc_probe()
    - bpf: Support for pointers beyond pkt_end.
    - bpf: Add helper macro bpf_for_each_reg_in_vstate
    - bpf: Fix wrong reg type conversion in release_reference()
    - net: gso: fix panic on frag_list with mixed head alloc types
    - macsec: delete new rxsc when offload fails
    - macsec: fix secy->n_rx_sc accounting
    - macsec: fix detection of RXSCs when toggling offloading
    - macsec: clear encryption keys from the stack after setting up offload
    - net: tun: Fix memory leaks of napi_get_frags
    - bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()
    - bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer
    - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
    - [s390x] KVM: s390x: fix SCK locking
    - [s390x] KVM: s390: pv: don't allow userspace to set the clock under PV
    - hamradio: fix issue of dev reference count leakage in bpq_device_event()
    - [arm*] drm/vc4: Fix missing platform_unregister_drivers() call in
      vc4_drm_register()
    - tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
    - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
    - can: af_can: fix NULL pointer dereference in can_rx_register()
    - [arm64,armhf] net: stmmac: dwmac-meson8b: fix
      meson8b_devm_clk_prepare_enable()
    - tipc: fix the msg->req tlv len check in
      tipc_nl_compat_name_table_dump_header
    - [arm64] dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()
    - [arm64] drivers: net: xgene: disable napi when register irq failed in
      xgene_enet_open()
    - net/mlx5: Allow async trigger completion execution on single CPU systems
    - net/mlx5e: E-Switch, Fix comparing termination table instance
    - [armhf] net: cpsw: disable napi in cpsw_ndo_open()
    - net: cxgb3_main: disable napi when bind qsets failed in cxgb_up()
    - cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in
      cxgb4vf_open()
    - net: phy: mscc: macsec: clear encryption keys when freeing a flow
    - [amd64,arm64] net: atlantic: macsec: clear encryption keys from the stack
    - ethernet: s2io: disable napi when start nic failed in s2io_card_up()
    - [armel,armhf] net: mv643xx_eth: disable napi when init rxq or txq failed
      in mv643xx_eth_open()
    - net: macvlan: fix memory leaks of macvlan_common_newlink
    - [arm64] efi: Fix handling of misaligned runtime regions and drop warning
    - [mips*] jump_label: Fix compat branch range check
    - [arm64] mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI
    - [arm64,armhf] mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI
    - ALSA: hda/hdmi - enable runtime pm for more AMD display audio
    - ALSA: hda/ca0132: add quirk for EVGA Z390 DARK
    - ALSA: hda: fix potential memleak in 'add_widget_node'
    - ALSA: hda/realtek: Add Positivo C6300 model quirk
    - ALSA: usb-audio: Add quirk entry for M-Audio Micro
    - ALSA: usb-audio: Add DSD support for Accuphase DAC-60
    - vmlinux.lds.h: Fix placement of '.data..decrypted' section
    - ata: libata-scsi: fix SYNCHRONIZE CACHE (16) command failure
    - nilfs2: fix deadlock in nilfs_count_free_blocks()
    - nilfs2: fix use-after-free bug of ns_writer on remount
    - [x86] drm/i915/dmabuf: fix sg_table handling in map_dma_buf
    - [x86] platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi
    - [arm64,armhf] mms: sdhci-esdhc-imx: Fix SDHCI_RESET_ALL for CQHCI
    - udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
    - mm/memremap.c: map FS_DAX device memory as decrypted
    - can: j1939: j1939_send_one(): fix missing CAN header initialization
    - net: tun: call napi_schedule_prep() to ensure we own a napi
    - [arm64,armhf] mmc: sdhci-esdhc-imx: Convert the driver to DT-only
    - [x86] cpu: Restore AMD's DE_CFG MSR after resume
    - io_uring: kill goto error handling in io_sqpoll_wait_sq()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.156
    - drm/amd/display: Remove wrong pipe control lock
    - NFSv4: Retry LOCK on OLD_STATEID during delegation return
    - [arm64,armhf] i2c: tegra: Allocate DMA memory for DMA engine
    - [x86] i2c: i801: add lis3lv02d's I2C address for Vostro 5568
    - btrfs: remove pointless and double ulist frees in error paths of qgroup
      tests
    - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
    - ALSA: hda/realtek: fix speakers and micmute on HP 855 G8
    - [x86] mtd: spi-nor: intel-spi: Disable write protection only if asked
    - [arm64,armhf] mmc: sdhci-esdhc-imx: use the correct host caps for
      MMC_CAP_8_BIT_DATA
    - drm/amd/pm: support power source switch on Sienna Cichlid
    - drm/amd/pm: Read BIF STRAP also for BACO check
    - drm/amd/pm: disable BACO entry/exit completely on several sienna cichlid
      cards
    - drm/amdgpu: disable BACO on special BEIGE_GOBY card
    - [armhf] spi: stm32: Print summary 'callbacks suppressed' message
    - ASoC: core: Fix use-after-free in snd_soc_exit()
    - serial: 8250: Remove serial_rs485 sanitization from em485
    - [arm64,armhf] serial: imx: Add missing .thaw_noirq hook
    - tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send
    - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
    - ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
    - sctp: remove the unnecessary sinfo_stream check in
      sctp_prsctp_prune_unsent
    - sctp: clear out_curr if all frag chunks of current msg are pruned
    - block: sed-opal: kmalloc the cmd/resp buffers
    - [arm64] Fix bit-shifting UB in the MIDR_CPU_MODEL() macro
    - parport_pc: Avoid FIFO port location truncation
    - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
    - [arm64,armhf] drm/panel: simple: set bpc field for logic technologies
      displays
    - drm/drv: Fix potential memory leak in drm_dev_init()
    - drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()
    - ata: libata-transport: fix double ata_host_put() in ata_tport_add()
    - ata: libata-transport: fix error handling in ata_tport_add()
    - ata: libata-transport: fix error handling in ata_tlink_add()
    - ata: libata-transport: fix error handling in ata_tdev_add()
    - bpf: Initialize same number of free nodes for each pcpu_freelist
    - mISDN: fix possible memory leak in mISDN_dsp_element_register()
    - net: hinic: Fix error handling in hinic_module_init()
    - net: liquidio: release resources when liquidio driver open failed
    - mISDN: fix misuse of put_device() in mISDN_register_device()
    - net: macvlan: Use built-in RCU list checking
    - net: caif: fix double disconnect client in chnl_net_open()
    - bnxt_en: Remove debugfs when pci_register_driver failed
    - xen/pcpu: fix possible memory leak in register_pcpu()
    - net: ena: Fix error handling in ena_init()
    - drbd: use after free in drbd_create_device()
    - [x86] platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when
      virtualized
    - cifs: add check for returning value of SMB2_close_init
    - cifs: Fix wrong return value checking when GETFLAGS
    - [x86] net: thunderbolt: Fix error handling in tbnet_init()
    - cifs: add check for returning value of SMB2_set_info_init
    - ftrace: Fix the possible incorrect kernel message
    - ftrace: Optimize the allocation for mcount entries
    - ftrace: Fix null pointer dereference in ftrace_add_mod()
    - ring_buffer: Do not deactivate non-existant pages
    - tracing/ring-buffer: Have polling block on watermark
    - tracing: Fix memory leak in test_gen_synth_cmd() and
      test_empty_synth_event()
    - tracing: Fix wild-memory-access in register_synth_event()
    - tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in
      kprobe_event_gen_test_exit()
    - tracing: kprobe: Fix potential null-ptr-deref on trace_array in
      kprobe_event_gen_test_exit()
    - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()
    - ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro
    - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360
    - [arm64,armhf] Revert "usb: dwc3: disable USB core PHY management"
    - slimbus: stream: correct presence rate frequencies
    - speakup: fix a segfault caused by switching consoles
    - USB: serial: option: add Sierra Wireless EM9191
    - USB: serial: option: remove old LARA-R6 PID
    - USB: serial: option: add u-blox LARA-R6 00B modem
    - USB: serial: option: add u-blox LARA-L6 modem
    - USB: serial: option: add Fibocom FM160 0x0111 composition
    - usb: add NO_LPM quirk for Realforce 87U Keyboard
    - dm ioctl: fix misbehavior if list_versions races with module loading
    - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs
    - serial: 8250: Flush DMA Rx on RLSI
    - [x86] serial: 8250_lpss: Configure DMA also w/o DMA filter
    - Input: iforce - invert valid length check when fetching device IDs
    - maccess: Fix writing offset in case of fault in
      strncpy_from_kernel_nofault()
    - [s390x] scsi: zfcp: Fix double free of FSF request when qdio send fails
    - [amd64] iommu/vt-d: Set SRE bit only when hardware has SRS cap
    - firmware: coreboot: Register bus in module init
    - mmc: core: properly select voltage range without power cycle
    - mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce
      timeout
    - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
    - docs: update mediator contact information in CoC doc
    - [x86] misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
    - [x86] perf/x86/intel/pt: Fix sampling using single range output
    - nvme: restrict management ioctls to admin
    - nvme: ensure subsystem reset is single threaded (CVE-2022-3169)
    - net: fix a concurrency bug in l2tp_tunnel_register()
    - ring-buffer: Include dropped pages in counting dirty patches
    - usbnet: smsc95xx: Fix deadlock on runtime resume
    - stddef: Introduce struct_group() helper macro
    - net: use struct_group to copy ip/ipv6 header addresses
    - scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()
    - scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper()
    - kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case
    - Input: i8042 - fix leaking of platform device on module removal
    - macvlan: enforce a consistent minimal mtu
    - tcp: cdg: allow tcp_cdg_release() to be called multiple times
    - kcm: avoid potential race in kcm_tx_work (CVE-2022-3521)
    - kcm: close race conditions on sk_receive_queue
    - 9p: trans_fd/p9_conn_cancel: drop client lock earlier
    - gfs2: Check sb_bsize_shift after reading superblock
    - gfs2: Switch from strlcpy to strscpy
    - 9p/trans_fd: always use O_NONBLOCK read/write
    - mm: fs: initialize fsdata passed to write_begin/write_end interface
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.157
    - scsi: scsi_transport_sas: Fix error handling in sas_phy_add()
    - ata: libata-scsi: simplify __ata_scsi_queuecmd()
    - ata: libata-core: do not issue non-internal commands once EH is pending
    - bridge: switchdev: Notify about VLAN protocol changes
    - bridge: switchdev: Fix memory leaks when changing VLAN protocol
    - drm/display: Don't assume dual mode adaptors support i2c sub-addressing
    - nvme: add a bogus subsystem NQN quirk for Micron MTFDKBA2T0TFH
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro
    - iio: ms5611: Simplify IO callback parameters
    - iio: pressure: ms5611: fixed value compensation bug
    - ceph: do not update snapshot context when there is no new snapshot
    - ceph: avoid putting the realm twice when decoding snaps fails
    - wifi: mac80211: fix memory free error when registering wiphy fail
    - wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
    - audit: fix undefined behavior in bit shift for AUDIT_BIT
    - wifi: airo: do not assign -1 to unsigned char
    - wifi: mac80211: Fix ack frame idr leak when mesh has no route
    - [armhf] spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for
      every run
    - Revert "net: macsec: report real_dev features when HW offloading is
      enabled"
    - [powerpc*] scsi: ibmvfc: Avoid path failures during live migration
    - scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC
    - drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017)
    - block, bfq: fix null pointer dereference in bfq_bio_bfqg()
    - [arm64] syscall: Include asm/ptrace.h in syscall_wrapper header.
    - [mips*] pic32: treat port as signed integer
    - xfrm: fix "disable_policy" on ipv4 early demux
    - xfrm: replay: Fix ESN wrap around for GSO
    - af_key: Fix send_acquire race with pfkey_register
    - [armhf] sgtl5000: Reset the CHIP_CLK_CTRL reg on remove
    - ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open()
    - [x86] scsi: storvsc: Fix handling of srb_status and capacity change events
    - regulator: core: fix kobject release warning and memory leak in
      regulator_register()
    - regulator: core: fix UAF in destroy_regulator()
    - [arm64,armhf] bus: sunxi-rsb: Support atomic transfers
    - [arm64] tee: optee: fix possible memory leak in optee_register_device()
    - net: liquidio: simplify if expression
    - rxrpc: Allow list of in-use local UDP endpoints to be viewed in /proc
    - rxrpc: Use refcount_t rather than atomic_t
    - rxrpc: Fix race between conn bundle lookup and bundle removal
      [ZDI-CAN-15975]
    - [i386] net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
    - 9p/fd: fix issue of list_del corruption in p9_fd_cancel()
    - netfilter: conntrack: Fix data-races around ct mark
    - [armhf] dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties
    - net/mlx4: Check retval of mlx4_bitmap_init
    - net/qla3xxx: fix potential memleak in ql3xxx_send()
    - [i386] net: pch_gbe: fix pci device refcount leak while module exiting
    - nfp: fill splittable of devlink_port_attrs correctly
    - nfp: add port from netdev validation for EEPROM access
    - macsec: Fix invalid error code set
    - [x86] Drivers: hv: vmbus: fix double free in the error path of
      vmbus_add_channel_work()
    - [x86] Drivers: hv: vmbus: fix possible memory leak in
      vmbus_device_register()
    - netfilter: ipset: Limit the maximal range of consecutive elements to
      add/delete
    - netfilter: ipset: regression in ip_set_hash_ip.c
    - net/mlx5: Fix FW tracer timestamp calculation
    - net/mlx5: Fix handling of entry refcount when command is not issued to FW
    - tipc: set con sock in tipc_conn_alloc
    - tipc: add an extra conn_get in tipc_conn_alloc
    - tipc: check skb_linearize() return value in tipc_disc_rcv()
    - xfrm: Fix ignored return value in xfrm6_init()
    - sfc: fix potential memleak in __ef100_hard_start_xmit()
    - net: sched: allow act_ct to be built without NF_NAT
    - [armhf] regulator: twl6030: re-add TWL6032_SUBCLASS
    - bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending()
    - netfilter: flowtable_offload: add missing locking
    - dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
    - ipv4: Fix error return code in fib_table_insert()
    - [s390x] dasd: fix no record found for raw_track_access
    - net: arcnet: Fix RESET flag handling
    - arcnet: fix potential memory leak in com20020_probe()
    - [arm64] net: thunderx: Fix the ACPI memory leak
    - [arm64] net: enetc: manage ENETC_F_QBV in priv->active_offloads only when
      enabled
    - [arm64] net: enetc: cache accesses to &priv->si->hw
    - [arm64] net: enetc: preserve TX ring priority across reconfiguration
    - lib/vdso: use "grep -E" instead of "egrep"
    - [armhf] usb: dwc3: exynos: Fix remove() function
    - ext4: fix use-after-free in ext4_ext_shift_extents
    - [arm64] dts: rockchip: lower rk3399-puma-haikou SD controller clock
      frequency
    - iio: light: apds9960: fix wrong register for gesture gain
    - ceph: make ceph_create_session_msg a global symbol
    - ceph: make iterate_sessions a global symbol
    - ceph: flush mdlog before umounting
    - ceph: flush the mdlog before waiting on unsafe reqs
    - ceph: fix off by one bugs in unsafe_request_wait()
    - ceph: put the requests/sessions when it fails to alloc memory
    - ceph: fix possible NULL pointer dereference for req->r_session
    - ceph: Use kcalloc for allocating multiple elements
    - ceph: fix NULL pointer dereference for req->r_session
    - [arm64,armhf] usb: dwc3: gadget: conditionally remove requests
    - [arm64,armhf] usb: dwc3: gadget: Return -ESHUTDOWN on ep disable
    - [arm64,armhf] usb: dwc3: gadget: Clear ep descriptor last
    - nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
    - mm: vmscan: fix extreme overreclaim and swap floods
    - [x86] KVM: x86: nSVM: leave nested mode on vCPU free
    - [x86] KVM: x86: remove exit_int_info warning in svm_handle_exit
    - [x86] ioremap: Fix page aligned size calculation in __ioremap_caller()
    - [arm*] binder: avoid potential data leakage when copying txn
    - [arm*] binder: read pre-translated fds from sender buffer
    - [arm*] binder: defer copies of pre-patched txn data
    - [arm*] binder: fix pointer cast warning
    - [arm*] binder: Address corner cases in deferred copy and fixup
    - [arm*] binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
    - Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode
    - [x86] ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01
    - Input: goodix - try resetting the controller when no config is set
    - [x86] Input: soc_button_array - add use_low_level_irq module parameter
    - [x86] Input: soc_button_array - add Acer Switch V 10 to
      dmi_use_low_level_irq[]
    - xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too
    - xen/platform-pci: add missing free_irq() in error path
    - [x86] platform/x86: asus-wmi: add missing pci_dev_put() in
      asus_wmi_set_xusb2pr()
    - [x86] platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10
      (SW5-017)
    - zonefs: fix zone report size in __zonefs_io_error()
    - [x86] platform/x86: hp-wmi: Ignore Smart Experience App event
    - tcp: configurable source port perturb table size
    - net: usb: qmi_wwan: add Telit 0x103a composition
    - [arm64,armhf] gpu: host1x: Avoid trying to use GART on Tegra20
    - dm integrity: flush the journal on suspend
    - dm integrity: clear the journal on suspend
    - genirq/msi: Shutdown managed interrupts with unsatifiable affinities
    - genirq: Always limit the affinity to online CPUs
    - [arm64,armhf] irqchip/gic-v3: Always trust the managed affinity provided
      by the core code
    - genirq: Take the proposed affinity at face value if force==true
    - btrfs: free btrfs_path before copying root refs to userspace
    - btrfs: free btrfs_path before copying fspath to userspace
    - btrfs: free btrfs_path before copying subvol info to userspace
    - btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()
    - drm/amdgpu: always register an MMU notifier for userptr
    - [x86] drm/i915: fix TLB invalidation for Gen12 video and compute engines
      (CVE-2022-4139)
    - fuse: lock inode unconditionally in fuse_fallocate()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.158
    - btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino
    - btrfs: free btrfs_path before copying inodes to userspace
    - [armhf] spi: spi-imx: Fix spi_bus_clk if requested clock is higher than
      input clock
    - btrfs: move QUOTA_ENABLED check to rescan_should_stop from
      btrfs_qgroup_rescan_worker
    - drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code
    - drm/amdgpu: update drm_display_info correctly when the edid is read
    - drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info
      correctly when the edid is read"
    - btrfs: qgroup: fix sleep from invalid context bug in
      btrfs_qgroup_inherit()
    - iio: health: afe4403: Fix oob read in afe4403_read_raw
    - bpf, perf: Use subprog name when reporting subprog ksymbol
    - scripts/faddr2line: Fix regression in name resolution on ppc64le
    - [x86] hwmon: (i5500_temp) fix missing pci_disable_device()
    - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
    - bpf: Do not copy spin lock field from user in bpf_selem_alloc
    - of: property: decrement node refcount in of_fwnode_get_reference_args()
    - ixgbevf: Fix resource leak in ixgbevf_init_module()
    - i40e: Fix error handling in i40e_init_module()
    - iavf: remove redundant ret variable
    - iavf: Fix error handling in iavf_init_module()
    - e100: switch from 'pci_' to 'dma_' API
    - e100: Fix possible use after free in e100_xmit_prepare
    - net/mlx5: Fix uninitialized variable bug in outlen_write()
    - net/mlx5e: Fix use-after-free when reverting termination table
    - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
    - [i386] can: cc770: cc770_isa_probe(): add missing free_cc770dev()
    - qlcnic: fix sleep-in-atomic-context bugs caused by msleep
    - [amd64,arm64] aquantia: Do not purge addresses when setting the number of
      rings
    - wifi: cfg80211: fix buffer overflow in elem comparison
    - wifi: cfg80211: don't allow multi-BSSID in S1G
    - wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
    - net: phy: fix null-ptr-deref while probe() failed
    - net/9p: Fix a potential socket leak in p9_socket_open
    - tipc: re-fetch skb cb after tipc_msg_validate
    - afs: Fix fileserver probe RTT handling
    - net: tun: Fix use-after-free in tun_detach()
    - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
    - sctp: fix memory leak in sctp_stream_outq_migrate()
    - [x86] hwmon: (coretemp) Check for null before removing sysfs attrs
    - [x86] hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
    - net/mlx5: DR, Fix uninitialized var warning
    - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
    - [x86] bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from
      S3
    - [x86] pinctrl: intel: Save and restore pins in "direct IRQ" mode
    - net: stmmac: Set MAC's flow control register to reflect current settings
    - mmc: core: Fix ambiguous TRIM and DISCARD arg
    - [arm64,armhf] mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check
    - mmc: sdhci: Fix voltage switch delay
    - drm/amdgpu: temporarily disable broken Clang builds due to blown
      stack-frame
    - [x86] drm/i915: Never return 0 if not all requests retired
    - tracing: Free buffers when a used dynamic event is removed
    - io_uring: don't hold uring_lock when calling io_run_task_work*
    - ASoC: ops: Fix bounds check for _sx controls
    - [arm64,armhf] pinctrl: single: Fix potential division by zero
    - [amd64] iommu/vt-d: Fix PCI device refcount leak in has_external_pci()
    - [amd64] iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
    - ipv4: Handle attempt to delete multipath route when fib_info contains an
      nh reference (CVE-2022-3435)
    - ipv4: Fix route deletion when nexthop info is not specified
    - Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
    - [x86] tsx: Add a feature bit for TSX control MSR support
    - [x86] pm: Add enumeration check before spec MSRs save/restore setup
    - [arm64,armhf] i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set
    - [amd64,arm64] ACPI: HMAT: remove unnecessary variable initialization
    - [amd64,arm64] ACPI: HMAT: Fix initiator registration for single-initiator
      systems
    - char: tpm: Protect tpm_pm_suspend with locks
    - block: unhash blkdev part inode when the part is deleted
    - proc: avoid integer type confusion in get_proc_long (CVE-2022-4378)
    - proc: proc_skip_spaces() shouldn't think it is working on C strings
      (CVE-2022-4378)
    - v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
    - ipc/sem: Fix dangling sem_array access in semtimedop race

  [ Salvatore Bonaccorso ]
  * Bump ABI to 20
  * [rt] Drop "net: arcnet: Fix RESET flag handling" (applied upstream)
  * [x86] Enable AMD_MEM_ENCRYPT (Closes: #1024697)
  * xen/netback: Ensure protocol headers don't fall in the non-linear area
    (XSA-423, CVE-2022-3643)
  * xen/netback: do some code cleanup
  * xen/netback: don't call kfree_skb() with interrupts disabled (XSA-424,
    CVE-2022-42328, CVE-2022-42329)
  * [rt] Update to 5.10.158-rt77

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 09 Dec 2022 18:14:20 +0100

linux (5.10.149-2) bullseye-security; urgency=high

  * Revert "drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega"
    (Closes: #1022025)
  * Revert "drm/amdgpu: make sure to init common IP before gmc"
    (Closes: #1022025)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 21 Oct 2022 22:24:21 +0200

linux (5.10.149-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.149
    - Revert "fs: check FMODE_LSEEK to control internal pipe splicing"

  [ Salvatore Bonaccorso ]
  * Replace patch for "io_uring/af_unix: defer registered files gc to io_uring
    release" with queued version

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 17 Oct 2022 21:44:25 +0200

linux (5.10.148-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.141
    - [s390x] mm: do not trigger write fault when vma does not allow VM_WRITE
    - kbuild: Fix include path in scripts/Makefile.modpost
    - Bluetooth: L2CAP: Fix build errors in some archs
    - HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
    - media: pvrusb2: fix memory leak in pvr_probe
    - HID: hidraw: fix memory leak in hidraw_release()
    - net: fix refcount bug in sk_psock_get (2)
    - fbdev: fb_pm2fb: Avoid potential divide by zero error
    - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace
      is dead
    - drm/amd/display: Avoid MPC infinite loop
    - drm/amd/display: For stereo keep "FLIP_ANY_FRAME"
    - drm/amd/display: clear optc underflow before turn off odm clock
    - neigh: fix possible DoS due to net iface start/stop loop
    - [s390x] hypfs: avoid error message under KVM
    - drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid
    - drm/amd/display: Fix pixel clock programming
    - drm/amdgpu: Increase tlb flush timeout for sriov
    - netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
    - lib/vdso: Mark do_hres_timens() and do_coarse_timens() __always_inline()
    - kprobes: don't call disarm_kprobe() for disabled kprobes
    - io_uring: disable polling pollfree files
    - xfs: remove infinite loop when reserving free block pool
    - xfs: always succeed at setting the reserve pool size
    - xfs: fix overfilling of reserve pool
    - xfs: fix soft lockup via spinning in filestream ag selection loop
    - xfs: revert "xfs: actually bump warning counts when we send warnings"
    - net: neigh: don't call kfree_skb() under spin_lock_irqsave()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.142
    - [arm64] drm/msm/dsi: fix the inconsistent indenting
    - [arm64] drm/msm/dp: delete DP_RECOVERED_CLOCK_OUT_EN to fix tps4
    - [arm64] drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg
    - [arm64] drm/msm/dsi: Fix number of regulators for SDM660
    - [x86] platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask
    - iio: adc: mcp3911: make use of the sign bit
    - bpf, cgroup: Fix kernel BUG in purge_effective_progs
    - ieee802154/adf7242: defer destroy_workqueue call
    - ALSA: hda: intel-nhlt: remove use of __func__ in dev_dbg
    - ALSA: hda: intel-nhlt: Correct the handling of fmt_config flexible array
    - wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
    - Revert "xhci: turn off port power in shutdown"
    - net: sched: tbf: don't call qdisc_put() while holding tree lock
    - net/sched: fix netdevice reference leaks in attach_default_qdiscs()
    - sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb
    - tcp: annotate data-race around challenge_timestamp
    - Revert "sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb"
    - net/smc: Remove redundant refcount increase
    - [arm64] serial: fsl_lpuart: RS485 RTS polariy is inverse
    - staging: rtl8712: fix use after free bugs
    - [powerpc*] align syscall table for ppc32
    - vt: Clear selection before changing the font
    - [arm64] tty: serial: lpuart: disable flow control while waiting for the
      transmit engine to complete
    - Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag
    - iio: ad7292: Prevent regulator double disable
    - iio: adc: mcp3911: use correct formula for AD conversion
    - USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id
    - [arm*] binder: fix UAF of ref->proc caused by race condition
      (CVE-2022-20421)
    - [x86] drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported"
    - clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops
    - Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops"
    - clk: core: Fix runtime PM sequence in clk_core_unprepare()
    - [arm64,armhf] clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate
    - [arm64,armhf] clk: bcm: rpi: Use correct order for the parameters of
      devm_kcalloc()
    - [arm64,armhf] clk: bcm: rpi: Prevent out-of-bounds access
    - [arm64,armhf] clk: bcm: rpi: Add missing newline
    - [armel,armhf] hwmon: (gpio-fan) Fix array out of bounds access
    - [arm64,armhf] gpio: pca953x: Add mutex_lock for regcache sync in PM
    - [x86] KVM: x86: Mask off unsupported and unknown bits of
      IA32_ARCH_CAPABILITIES
    - xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()
    - mm: pagewalk: Fix race between unmap and page walker
    - xen-blkback: Advertise feature-persistent as user requested
    - xen-blkfront: Advertise feature-persistent as user requested
    - [x86] thunderbolt: Use the actual buffer in tb_async_error()
    - media: mceusb: Use new usb_control_msg_*() routines
    - xhci: Add grace period after xHC start to prevent premature runtime
      suspend.
    - USB: serial: cp210x: add Decagon UCA device id
    - USB: serial: option: add support for OPPO R11 diag port
    - USB: serial: option: add Quectel EM060K modem
    - USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode
    - usb: typec: altmodes/displayport: correct pin assignment for UFP
      receptacles
    - [arm*] usb: dwc2: fix wrong order of phy_power_on and phy_init
    - USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020)
    - usb-storage: Add ignore-residue quirk for NXP PN7462AU
    - [s390x] hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages
    - [s390x] fix nospec table alignments
    - USB: core: Prevent nested device-reset calls
    - usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
    - driver core: Don't probe devices after bus_type.match() probe deferral
    - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
    - wifi: mac80211: Fix UAF in ieee80211_scan_rx()
    - ip: fix triggering of 'icmp redirect'
    - net: Use u64_stats_fetch_begin_irq() for stats fetch.
    - net: mac802154: Fix a condition in the receive path
    - ALSA: hda/realtek: Add speaker AMP init for Samsung laptops with ALC298
    - ALSA: seq: oss: Fix data-race for max_midi_devs access
    - ALSA: seq: Fix data-race at module auto-loading
    - [x86] drm/i915/glk: ECS Liva Q2 needs GLK HDMI port timing quirk
    - btrfs: harden identification of a stale device
    - mmc: core: Fix UHS-I SD 1.8V workaround branch
    - [arm64,armhf] usb: dwc3: fix PHY disable sequence
    - [arm64,armhf] usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup
    - [arm64,armhf] usb: dwc3: disable USB core PHY management
    - USB: serial: ch341: fix lost character on LCR updates
    - USB: serial: ch341: fix disabled rx timer on older devices
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.143
    - NFSD: Fix verifier returned in stable WRITEs
    - xen-blkfront: Cache feature_persistent value before advertisement
    - tty: n_gsm: initialize more members at gsm_alloc_mux()
    - tty: n_gsm: avoid call of sleeping functions from atomic context
    - efi: capsule-loader: Fix use-after-free in efi_capsule_write
      (CVE-2022-40307)
    - wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in
      il4965_rs_fill_link_cmd()
    - fs: only do a memory barrier for the first set_buffer_uptodate()
    - scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX
    - scsi: megaraid_sas: Fix double kfree()
    - drm/gem: Fix GEM handle release errors
    - drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to
      psp_hw_fini
    - drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup.
    - drm/radeon: add a force flush to delay work when radeon
    - [arm64] cacheinfo: Fix incorrect assignment of signed error value to
      unsigned fw_level
    - net/core/skbuff: Check the return value of skb_copy_bits()
    - drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly
    - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
    - ALSA: aloop: Fix random zeros in capture data when using jiffies timer
    - ALSA: usb-audio: Fix an out-of-bounds bug in
      __snd_usb_parse_audio_interface()
    - kprobes: Prohibit probes in gate area
    - debugfs: add debugfs_lookup_and_remove()
    - nvmet: fix a use-after-free
    - [x86] drm/i915: Implement WaEdpLinkRateDataReload
    - scsi: mpt3sas: Fix use-after-free warning
    - scsi: lpfc: Add missing destroy_workqueue() in error path
    - cgroup: Elide write-locking threadgroup_rwsem when updating csses on an
      empty subtree
    - cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
    - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl()
    - smb3: missing inode locks in punch hole
    - regulator: core: Clean up on enable failure
    - [arm64] tee: fix compiler warning in tee_shm_register()
    - RDMA/cma: Fix arguments order in net device validation
    - [arm64] RDMA/hns: Fix supported page size
    - [arm64] RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift
    - netfilter: br_netfilter: Drop dst references before setting.
    - netfilter: nf_tables: clean up hook list when offload flags check fails
    - netfilter: nf_conntrack_irc: Fix forged IP logic (CVE-2022-2663)
    - ALSA: usb-audio: Inform the delayed registration more properly
    - ALSA: usb-audio: Register card again for iface over delayed_register
      option
    - rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2()
    - afs: Use the operation issue time instead of the reply time for callbacks
    - sch_sfb: Don't assume the skb is still around after enqueueing to child
    - tipc: fix shift wrapping bug in map_get()
    - ice: use bitmap_free instead of devm_kfree
    - i40e: Fix kernel crash during module removal
    - xen-netback: only remove 'hotplug-status' when the vif is actually
      destroyed
    - ipv6: sr: fix out-of-bounds read when setting HMAC data.
    - IB/core: Fix a nested dead lock as part of ODP flow
    - RDMA/mlx5: Set local port to one when accessing counters
    - nvme-tcp: fix UAF when detecting digest errors
    - nvme-tcp: fix regression that causes sporadic requests to time out
    - tcp: fix early ETIMEDOUT after spurious non-SACK RTO
    - sch_sfb: Also store skb len before calling child enqueue
    - swiotlb: avoid potential left shift overflow
    - [amd64] iommu/amd: use full 64-bit value in build_completion_wait()
    - [arm64] errata: add detection for AMEVCNTR01 incrementing incorrectly
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.144
    - [armhf] dts: imx: align SPI NOR node name with dtschema
    - [amd64] iommu/vt-d: Correctly calculate sagaw value of IOMMU
    - tracefs: Only clobber mode/uid/gid on remount if asked
    - Input: goodix - add support for GT1158
    - [arm64] drm/msm/rd: Fix FIFO-full deadlock
    - [amd64] hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered
      message
    - tg3: Disable tg3 device on system reboot to avoid triggering AER
    - ieee802154: cc2520: add rc code in cc2520_tx()
    - Input: iforce - add support for Boeder Force Feedback Wheel
    - nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change()
    - drm/amd/amdgpu: skip ucode loading if ucode_size == 0
    - [arm*] perf/arm_pmu_platform: fix tests for platform_get_irq() failure
    - [x86] platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot
      keymap fixes
    - mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
    - [x86] Revert "x86/ftrace: Use alternative RET encoding"
    - [x86] ibt,ftrace: Make function-graph play nice
    - [x86] ftrace: Use alternative RET encoding
    - Input: goodix - add compatible string for GT1158
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.145
    - [ppc64el] KVM: PPC: Book3S HV: Context tracking exit guest context before
      enabling irqs
    - [ppc64el] KVM: PPC: Tick accounting should defer vtime accounting 'til
      after IRQ handling
    - serial: 8250: Fix reporting real baudrate value in c_ospeed field
    - [powerpc*] pseries/mobility: refactor node lookup during DT update
    - [powerpc*] pseries/mobility: ignore ibm, platform-facilities updates
    - [x86] platform/x86/intel: hid: add quirk to support Surface Go 3
    - [arm64,armhf] net: dsa: mv88e6xxx: allow use of PHYs on CPU and DSA ports
    - of: fdt: fix off-by-one error in unflatten_dt_nodes()
    - [arm64] pinctrl: sunxi: Fix name for A100 R_PIO
    - NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0
    - [arm64] gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in
      mpc85xx
    - [arm64] drm/meson: Correct OSD1 global alpha value
    - [arm64] drm/meson: Fix OSD1 RGB to YCbCr coefficient
    - tracing: hold caller_addr to hardirq_{enable,disable}_ip
    - of/device: Fix up of_dma_configure_id() stub
    - cifs: revalidate mapping when doing direct writes
    - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM
    - video: fbdev: i740fb: Error out if 'pixclock' equals zero (CVE-2022-3061)
    - Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field"
    - [x86] ASoC: nau8824: Fix semaphore unbalance at error paths
    - [armhf] regulator: pfuze100: Fix the global-out-of-bounds access in
      pfuze100_regulator_probe()
    - rxrpc: Fix local destruction being repeated
    - rxrpc: Fix calc of resend age
    - wifi: mac80211_hwsim: check length for virtio packets
    - ALSA: hda/sigmatel: Keep power up while beep is enabled
    - [arm64,armhf] ALSA: hda/tegra: Align BDL entry to 4KB boundary
    - net: usb: qmi_wwan: add Quectel RM520N
    - afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked
    - [misp64el,mipsel] OCTEON: irq: Fix octeon_irq_force_ciu_mapping()
    - mksysmap: Fix the mismatch of 'L0' symbols in System.map
    - video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write
      (CVE-2022-39842)
    - cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
    - ALSA: hda/sigmatel: Fix unused variable warning for beep power change
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.146
    - drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega
    - drm/amdgpu: indirect register access for nv12 sriov
    - drm/amdgpu: Separate vf2pf work item init from virt data exchange
    - drm/amdgpu: make sure to init common IP before gmc
    - [arm64,armhf] usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC
      unbind
    - [arm64,armhf] usb: dwc3: Issue core soft reset before enabling run/stop
    - [arm64,armhf] usb: dwc3: gadget: Prevent repeat pullup()
    - [arm64,armhf] usb: dwc3: gadget: Refactor pullup()
    - [arm64,armhf] usb: dwc3: gadget: Don't modify GEVNTCOUNT in pullup()
    - [arm64,armhf] usb: dwc3: gadget: Avoid duplicate requests to enable
      Run/Stop
    - mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch
      failure
    - vfio/type1: Change success value of vaddr_get_pfn()
    - vfio/type1: Prepare for batched pinning with struct vfio_batch
    - vfio/type1: Unpin zero pages
    - USB: core: Fix RST error in hub.c
    - USB: serial: option: add Quectel BG95 0x0203 composition
    - USB: serial: option: add Quectel RM520N
    - ALSA: hda/tegra: set depop delay for tegra
    - ALSA: hda: add Intel 5 Series / 3400 PCI DID
    - ALSA: hda/realtek: Add quirk for Huawei WRT-WX9
    - ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5570 laptop
    - ALSA: hda/realtek: Re-arrange quirk table entries
    - ALSA: hda/realtek: Add pincfg for ASUS G513 HP jack
    - ALSA: hda/realtek: Add pincfg for ASUS G533Z HP jack
    - ALSA: hda/realtek: Add quirk for ASUS GA503R laptop
    - ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5530 laptop
    - [amd64] iommu/vt-d: Check correct capability for sagaw determination
    - media: flexcop-usb: fix endpoint type check
    - [x86] efi: x86: Wipe setup_data on pure EFI boot
    - efi: libstub: check Shim mode using MokSBStateRT
    - gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully
    - [arm64,armhf] can: flexcan: flexcan_mailbox_read() fix return value for
      drop = true
    - mm/slub: fix to return errno if kmalloc() fails
    - KVM: SEV: add cache flush to solve SEV cache incoherency issues
      (CVE-2022-0171)
    - xfs: fix up non-directory creation in SGID directories (CVE-2021-4037)
    - xfs: reorder iunlink remove operation in xfs_ifree
    - xfs: validate inode fork size against fork format
    - [arm64] dts: rockchip: Pull up wlan wake# on Gru-Bob
    - netfilter: nf_conntrack_sip: fix ct_sip_walk_headers
    - netfilter: nf_conntrack_irc: Tighten matching on DCC message
      (CVE-2022-2663)
    - netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()
    - iavf: Fix cached head and tail value for iavf_get_tx_pending
    - ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
    - net: let flow have same hash in two directions
    - net: core: fix flow symmetric hash
    - net: phy: aquantia: wait for the suspend/resume operations to finish
    - scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB
      region
    - scsi: mpt3sas: Fix return value check of dma_get_required_mask()
    - net: bonding: Share lacpdu_mcast_addr definition
    - net: bonding: Unsync device addresses on ndo_stop
    - net: team: Unsync device addresses on ndo_stop
    - [arm64,armhf] drm/panel: simple: Fix innolux_g121i1_l01 bus_format
    - iavf: Fix bad page state
    - iavf: Fix set max MTU size with port VLAN and jumbo frames
    - i40e: Fix VF set max MTU size
    - i40e: Fix set max_tx_rate when it is lower than 1 Mbps
    - sfc: fix TX channel offset when using legacy interrupts
    - sfc: fix null pointer dereference in efx_hard_start_xmit
    - of: mdio: Add of_node_put() when breaking out of for_each_xx
    - wireguard: ratelimiter: disable timings test by default
    - wireguard: netlink: avoid variable-sized memcpy on sockaddr
    - [arm64] net: enetc: move enetc_set_psfp() out of the common
      enetc_set_features()
    - net: socket: remove register_gifconf
    - net/sched: taprio: avoid disabling offload when it was never enabled
    - net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child
      qdiscs
    - netfilter: nf_tables: fix nft_counters_enabled underflow at
      nf_tables_addchain()
    - netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain()
    - netfilter: ebtables: fix memory leak when blob is malformed
    - can: gs_usb: gs_can_open(): fix race dev->can.state condition
    - net/smc: Stop the CLC flow if no link to map buffers on
    - net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD
    - net: sched: fix possible refcount leak in tc_new_tfilter()
    - drm/amd/amdgpu: fixing read wrong pf2vf data in SRIOV
    - serial: Create uart_xmit_advance()
    - [arm64,armhf] serial: tegra: Use uart_xmit_advance(), fixes icount.tx
      accounting
    - [s390x] dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
    - vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external()
    - drm/amdgpu: Fix check for RAS support
    - cifs: use discard iterator to discard unneeded network data more
      efficiently
    - cifs: always initialize struct msghdr smb_msg completely
    - [x86] Drivers: hv: Never allocate anything besides framebuffer from
      framebuffer memory region
    - [x86] drm/gma500: Fix BUG: sleeping function called from invalid context
      errors
    - drm/amdgpu: use dirty framebuffer helper
    - drm/amd/display: Limit user regamma to a valid value
    - drm/amd/display: Mark dml30's UseMinimumDCFCLK() as noinline for stack
      usage
    - [arm64] drm/rockchip: Fix return type of cdn_dp_connector_mode_valid
    - workqueue: don't skip lockdep work dependency in cancel_work_sync()
    - [arm64,armhf] i2c: imx: If pm_runtime_get_sync() returned 1 device access
      is possible
    - [amd64,arm64] devdax: Fix soft-reservation memory description
    - ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0
    - ext4: limit the number of retries after discarding preallocations blocks
    - ext4: make directory inode spreading reflect flexbg size
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.147
    - [x86] thunderbolt: Add support for Intel Maple Ridge
    - [x86] thunderbolt: Add support for Intel Maple Ridge single port
      controller
    - [arm64,armhf] ALSA: hda/tegra: Use clk_bulk helpers
    - [arm64,armhf] ALSA: hda/tegra: Reset hardware
    - ALSA: hda/hdmi: let new platforms assign the pcm slot dynamically
    - ALSA: hda: Fix Nvidia dp infoframe
    - btrfs: fix hang during unmount when stopping a space reclaim worker
    - [arm64,x86] usb: typec: ucsi: Remove incorrect warning
    - [x86] thunderbolt: Explicitly reset plug events delay back to USB4 spec
      value
    - net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455
    - libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205
    - mm/page_alloc: fix race condition between build_all_zonelists and page
      allocation
    - mm: prevent page_frag_alloc() from corrupting the memory
    - mm/migrate_device.c: flush TLB while holding PTL
    - mm: fix madivse_pageout mishandling on non-LRU page
    - swiotlb: max mapping size takes min align mask into account
    - [arm64] scsi: hisi_sas: Revert "scsi: hisi_sas: Limit max hw sectors for
      v3 HW"
    - [arm64,armhf] soc: sunxi: sram: Actually claim SRAM regions
    - [arm64,armhf] soc: sunxi: sram: Prevent the driver from being unbound
    - [arm64,armhf] soc: sunxi_sram: Make use of the helper function
      devm_platform_ioremap_resource()
    - [arm64,armhf] soc: sunxi: sram: Fix probe function ordering issues
    - [arm64,armhf] soc: sunxi: sram: Fix debugfs info for A64 SRAM C
    - [arm64,armhf] Revert "drm: bridge: analogix/dp: add panel
      prepare/unprepare in suspend/resume time"
    - usbnet: Fix memory leak in usbnet_disconnect()
    - net: sched: act_ct: fix possible refcount leak in tcf_ct_init()
    - cxgb4: fix missing unlock on ETHOFLD desc collect fail path
    - nvme: add new line after variable declatation
    - nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
    - net: stmmac: power up/down serdes in stmmac_open/release
    - [armhf] clk: imx: imx6sx: remove the SET_RATE_PARENT flag for QSPI clocks
    - [x86] KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest
    - [x86] alternative: Fix race in try_get_desc()
    - ALSA: hda/hdmi: fix warning about PCM count when used with SOF
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.148
    - nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
    - nilfs2: fix use-after-free bug of struct nilfs_root
    - nilfs2: fix leak of nilfs_root in case of writer thread creation failure
    - nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
    - ceph: don't truncate file in atomic_open
    - docs: update mediator information in CoC docs
    - xsk: Inherit need_wakeup flag for shared sockets
    - ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC (CVE-2022-3303)
    - mm: gup: fix the fast GUP race against THP collapse
    - [powerpc*] 64s/radix: don't need to broadcast IPI for radix pmd collapse
      flush
    - fs: fix UAF/GPF bug in nilfs_mdt_destroy
    - compiler_attributes.h: move __compiletime_{error|warning}
    - scsi: qedf: Fix a UAF bug in __qedf_probe()
    - net/ieee802154: fix uninit value bug in dgram_sendmsg
    - ALSA: hda/hdmi: Fix the converter reuse for the silent stream
    - net: atlantic: fix potential memory leak in aq_ndev_close()
    - drm/amd/display: update gamut remap if plane has changed
    - drm/amd/display: skip audio setup when audio stream is enabled
    - mmc: core: Replace with already defined values for readability
    - mmc: core: Terminate infinite loop in SD-UHS voltage switch
    - usb: mon: make mmapped memory read only
    - USB: serial: ftdi_sio: fix 300 bps rate for SIO
    - [arm64] rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
    - Revert "clk: ti: Stop using legacy clkctrl names for omap4 and 5"
    - random: restore O_NONBLOCK support
    - random: clamp credited irq bits to maximum mixed
    - ALSA: hda: Fix position reporting on Poulsbo
    - efi: Correct Macmini DMI match in uefi cert quirk
    - scsi: stex: Properly zero out the passthrough command structure
    - USB: serial: qcserial: add new usb-id for Dell branded EM7455
    - random: avoid reading two cache lines on irq randomness
    - random: use expired timer rather than wq for mixing fast pool
    - wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans()
      (CVE-2022-41674)
    - wifi: cfg80211/mac80211: reject bad MBSSID elements
    - wifi: cfg80211: ensure length byte is present before access
    - wifi: cfg80211: fix BSS refcounting bugs (CVE-2022-42720)
    - wifi: cfg80211: avoid nontransmitted BSS list corruption (CVE-2022-42721)
    - wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
    - wifi: mac80211: fix crash in beacon protection for P2P-device
      (CVE-2022-42722)
    - wifi: cfg80211: update hidden BSSes to avoid WARN_ON
    - Input: xpad - add supported devices as contributed on github
    - Input: xpad - fix wireless 360 controller breaking after suspend

  [ Aurelien Jarno ]
  * [arm64] Add support for misalignment fixups for multiword loads from next
    branch. Enable COMPAT_ALIGNMENT_FIXUPS.

  [ Salvatore Bonaccorso ]
  * [x86] drivers/edac: Enable EDAC_I10NM as module (Closes: #1019248)
  * Bump ABI to 19
  * Refresh "Export symbols needed by Android drivers"
  * [rt] Update to 5.10.140-rt73
  * io_uring/af_unix: defer registered files gc to io_uring release
    (CVE-2022-2602)
  * ext4: fix check for block being out of directory size (CVE-2022-1184)

  [ Uwe Kleine-König ]
  * mac80211: mlme: find auth challenge directly
  * wifi: mac80211: don't parse mbssid in assoc response
  * wifi: mac80211: fix MBSSID parsing use-after-free (CVE-2022-42719)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 16 Oct 2022 23:18:41 +0200

linux (5.10.140-1) bullseye; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.137
    - Makefile: link with -z noexecstack --no-warn-rwx-segments
    - [x86] link vdso and boot with -z noexecstack --no-warn-rwx-segments
    - Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING"
    - scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover"
    - ALSA: bcd2000: Fix a UAF bug on the error path of probing
    - ALSA: hda/realtek: Add quirk for Clevo NV45PZ
    - ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx
    - wifi: mac80211_hwsim: fix race condition in pending packet
    - wifi: mac80211_hwsim: add back erroneously removed cast
    - wifi: mac80211_hwsim: use 32-bit skb cookie
    - add barriers to buffer_uptodate and set_buffer_uptodate
    - HID: wacom: Only report rotation for art pen
    - HID: wacom: Don't register pad_input for touch switch
    - [x86] KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending
      case
    - [x86] KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending
      case
    - [x86] KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
    - [s390x] KVM: s390: pv: don't present the ecall interrupt twice
    - [x86] KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value
    - [x86] KVM: x86: Mark TSS busy during LTR emulation _after_ all fault
      checks
    - [x86] KVM: x86: Set error code to segment selector on LLDT/LTR
      non-canonical #GP
    - [x86] KVM: x86: Tag kvm_mmu_x86_module_init() with __init
    - mm: Add kvrealloc()
    - xfs: only set IOMAP_F_SHARED when providing a srcmap to a write
    - xfs: fix I_DONTCACHE
    - mm/mremap: hold the rmap lock in write mode when moving page table
      entries.
    - ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
    - ALSA: hda/cirrus - support for iMac 12,1 model
    - ALSA: hda/realtek: Add quirk for another Asus K42JZ model
    - ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED
    - tty: vt: initialize unicode screen buffer
    - vfs: Check the truncate maximum size in inode_newsize_ok()
    - fs: Add missing umask strip in vfs_tmpfile
    - thermal: sysfs: Fix cooling_device_stats_setup() error code path
    - fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters
    - fbcon: Fix accelerated fbdev scrolling while logo is still shown
    - usbnet: Fix linkwatch use-after-free on disconnect
    - ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh()
    - drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error
    - [arm*] drm/vc4: hdmi: Disable audio if dmas property is present but empty
    - drm/nouveau: fix another off-by-one in nvbios_addr
    - drm/nouveau: Don't pm_runtime_put_sync(), only
      pm_runtime_put_autosuspend()
    - drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from
      pm_runtime
    - drm/amdgpu: Check BO's requested pinning domains against its
      preferred_domains
    - iio: light: isl29028: Fix the warning in isl29028_remove()
    - scsi: sg: Allow waiting for commands to complete on removed device
    - scsi: qla2xxx: Fix incorrect display of max frame size
    - scsi: qla2xxx: Zero undefined mailbox IN registers
    - fuse: limit nsec
    - [arm64] serial: mvebu-uart: uart2 error bits clearing
    - md-raid: destroy the bitmap after destroying the thread
    - md-raid10: fix KASAN warning
    - PCI: Add defines for normal and subtractive PCI bridges
    - [powerpc*] powernv: Avoid crashing if rng is NULL
    - [mips64el,mipsel] cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
    - usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion
    - USB: HCD: Fix URB giveback issue in tasklet function
    - [arm64,armhf] usb: dwc3: gadget: refactor dwc3_repare_one_trb
    - [arm64,armhf] usb: dwc3: gadget: fix high speed multiplier setting
    - netfilter: nf_tables: fix null deref due to zeroed list head
    - epoll: autoremove wakers even more aggressively
    - [x86] Handle idle=nomwait cmdline properly for x86_idle
    - [arm64] Do not forget syscall when starting a new thread.
    - [arm64] fix oops in concurrently setting insn_emulation sysctls
    - genirq: Don't return error on missing optional irq_request_resources()
    - [mips64el,mipsel] irqchip/mips-gic: Only register IPI domain when SMP is
      enabled
    - genirq: GENERIC_IRQ_IPI depends on SMP
    - [mips64el,mipsel] irqchip/mips-gic: Check the return value of ioremap() in
      gic_of_init()
    - wait: Fix __wait_event_hrtimeout for RT/DL tasks
    - [armhf] OMAP2+: display: Fix refcount leak bug
    - ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks
    - ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk
    - ACPI: PM: save NVS memory for Lenovo G40-45
    - ACPI: LPSS: Fix missing check in register_device_clock()
    - [arm64] dts: allwinner: a64: orangepi-win: Fix LED node name
    - PM: hibernate: defer device probing when resuming from hibernation
    - selinux: Add boundary check in put_entry()
    - [armel,armhf] findbit: fix overflowing offset
    - [arm64,armhf] meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
    - ACPI: processor/idle: Annotate more functions to live in cpuidle section
    - Input: atmel_mxt_ts - fix up inverted RESET handler
    - [arm64] soc: amlogic: Fix refcount leak in meson-secure-pwrc.c
    - [x86] pmem: Fix platform-device leak in error path
    - [armhf] dts: ast2500-evb: fix board compatible
    - [armhf] dts: ast2600-evb: fix board compatible
    - [arm64] cpufeature: Allow different PMU versions in ID_DFR0_EL1
    - locking/lockdep: Fix lockdep_init_map_*() confusion
    - [arm64] soc: fsl: guts: machine variable might be unset
    - block: fix infinite loop for invalid zone append
    - [armhf] OMAP2+: Fix refcount leak in omapdss_init_of
    - [armhf] OMAP2+: Fix refcount leak in omap3xxx_prm_late_init
    - [arm64] regulator: qcom_smd: Fix pm8916_pldo range
    - [arm64] ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP
    - [arm64] bus: hisi_lpc: fix missing platform_device_put() in
      hisi_lpc_acpi_probe()
    - erofs: avoid consecutive detection for Highmem memory
    - blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created
    - hwmon: (drivetemp) Add module alias
    - block: remove the request_queue to argument request based tracepoints
    - blktrace: Trace remapped requests correctly
    - regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
    - nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt()
    - dm: return early from dm_pr_call() if DM device is suspended
    - ath10k: do not enforce interrupt trigger type
    - wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c()
    - ath11k: fix netdev open race
    - drm/mipi-dbi: align max_chunk to 2 in spi_transfer
    - ath11k: Fix incorrect debug_mask mappings
    - drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
    - virtio-gpu: fix a missing check to avoid NULL dereference
    - [arm64] drm: adv7511: override i2c address of cec before accessing it
    - net: fix sk_wmem_schedule() and sk_rmem_schedule() errors
    - i2c: Fix a potential use after free
    - media: tw686x: Register the irq at the end of probe
    - ath9k: fix use-after-free in ath9k_hif_usb_rx_cb (CVE-2022-1679)
    - wifi: iwlegacy: 4965: fix potential off-by-one overflow in
      il4965_rs_fill_link_cmd()
    - drm/radeon: fix incorrrect SPDX-License-Identifiers
    - [amd64] crypto: ccp - During shutdown, check SEV data pointer before using
    - [arm64] drm: bridge: adv7511: Add check for mipi_dsi_driver_register
    - media: hdpvr: fix error value returns in hdpvr_read
    - [arm64,armhf] media: v4l2-mem2mem: prevent pollerr when
      last_buffer_dequeued is set
    - media: tw686x: Fix memory leak in tw686x_video_init
    - [arm*] drm/vc4: plane: Remove subpixel positioning check
    - [arm*] drm/vc4: plane: Fix margin calculations for the right/bottom edges
    - [arm*] drm/vc4: dsi: Correct DSI divider calculations
    - [arm*] drm/vc4: dsi: Correct pixel order for DSI0
    - [arm*] drm/vc4: drv: Remove the DSI pointer in vc4_drv
    - [arm*] drm/vc4: dsi: Use snprintf for the PHY clocks instead of an array
    - [arm*] drm/vc4: dsi: Introduce a variant structure
    - [arm*] drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type
    - [arm*] drm/vc4: dsi: Fix dsi0 interrupt support
    - [arm*] drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable
      iteration
    - [arm*] drm/vc4: hdmi: Remove firmware logic for MAI threshold setting
    - [arm*] drm/vc4: hdmi: Avoid full hdmi audio fifo writes
    - [arm*] drm/vc4: hdmi: Don't access the connector state in reset if kmalloc
      fails
    - [arm*] drm/vc4: hdmi: Limit the BCM2711 to the max without scrambling
    - [arm*] drm/vc4: hdmi: Fix timings for interlaced modes
    - [arm*] drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes
    - [arm64,armhf] drm/rockchip: vop: Don't crash for invalid duplicate_state()
    - [arm64,armhf] drm/rockchip: Fix an error handling path rockchip_dp_probe()
    - lib: bitmap: order includes alphabetically
    - lib: bitmap: provide devm_bitmap_alloc() and devm_bitmap_zalloc()
    - hinic: Use the bitmap API when applicable
    - net: hinic: fix bug that ethtool get wrong stats
    - net: hinic: avoid kernel hung in hinic_get_stats64()
    - [arm64] drm/msm/mdp5: Fix global state lock backoff
    - mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg
    - mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init()
    - tcp: make retransmitted SKB fit into the send window
    - bpf: Fix subprog names in stack traces.
    - fs: check FMODE_LSEEK to control internal pipe splicing
    - wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
    - [i386] can: pch_can: do not report txerr and rxerr during bus-off
    - can: sja1000: do not report txerr and rxerr during bus-off
    - [armhf] can: sun4i_can: do not report txerr and rxerr during bus-off
    - can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off
    - can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off
    - can: usb_8dev: do not report txerr and rxerr during bus-off
    - can: error: specify the values of data[5..7] of CAN error frames
    - [i386] can: pch_can: pch_can_error(): initialize errc before using it
    - Bluetooth: hci_intel: Add check for platform_driver_register
    - wifi: wil6210: debugfs: fix uninitialized variable use in
      `wil_write_file_wmi()`
    - wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue
    - wifi: libertas: Fix possible refcount leak in if_usb_probe()
    - [arm64,armhf] media: cedrus: hevc: Add check for invalid timestamp
    - net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS
      cipher/version
    - net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS
    - [arm64] crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of
    - inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH()
    - tcp: sk->sk_bound_dev_if once in inet_request_bound_dev_if()
    - ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH()
    - tcp: Fix data-races around sysctl_tcp_l3mdev_accept.
    - net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set
    - iavf: Fix max_rate limiting
    - net: rose: fix netdev reference changes
    - dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
    - wireguard: ratelimiter: use hrtimer in selftest
    - wireguard: allowedips: don't corrupt stack when detecting overflow
    - HID: cp2112: prevent a buffer overflow in cp2112_xfer()
    - mtd: partitions: Fix refcount leak in parse_redboot_of
    - [arm64,armhf] usb: xhci: tegra: Fix error check
    - netfilter: xtables: Bring SPDX identifier back
    - [arm64,armhf] platform/chrome: cros_ec: Always expose last resume result
    - KVM: Don't set Accessed/Dirty bits for ZERO_PAGE
    - mwifiex: Ignore BTCOEX events from the 88W8897 firmware
    - mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv
    - misc: rtsx: Fix an error handling path in rtsx_pci_probe()
    - driver core: fix potential deadlock in __driver_attach
    - usb: host: xhci: use snprintf() in xhci_decode_trb()
    - [arm64,armhf] PCI: dwc: Add unroll iATU space support to
      dw_pcie_disable_atu()
    - [arm64,armhf] PCI: dwc: Always enable CDM check if "snps,enable-cdm-check"
      exists
    - soundwire: bus_type: fix remove and shutdown support
    - [arm64] KVM: arm64: Don't return from void function
    - [x86] intel_th: Fix a resource leak in an error handling path
    - [x86] intel_th: msu-sink: Potential dereference of null pointer
    - [x86] intel_th: msu: Fix vmalloced buffers
    - [x86] staging: rtl8192u: Fix sleep in atomic context bug in
      dm_fsync_timer_callback
    - [arm64] mmc: sdhci-of-esdhc: Fix refcount leak in
      esdhc_signal_voltage_switch
    - mmc: block: Add single read for 4k sector cards
    - [s390x] KVM: s390: pv: leak the topmost page table when destroy fails
    - PCI/portdrv: Don't disable AER reporting in get_port_device_capability()
    - [arm64] PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks
    - scsi: smartpqi: Fix DMA direction for RAID requests
    - [armhf] usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc()
    - [arm64,armhf] usb: dwc3: core: Deprecate GCTL.CORESOFTRESET
    - [arm64,armhf] usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during
      bootup
    - [arm64,armhf] usb: dwc3: qcom: fix missing optional irq warnings
    - RDMA/qedr: Improve error logs for rdma_alloc_tid error return
    - RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()
    - [arm64] RDMA/hns: Fix incorrect clearing of interrupt status register
    - [amd64] RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
    - gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
    - [mips64el,mipsel] mmc: cavium-octeon: Add of_node_put() when breaking out
      of loop
    - HID: alps: Declare U1_UNICORN_LEGACY support
    - USB: serial: fix tty-port initialized comments
    - [armhf,i386] platform/olpc: Fix uninitialized data in debugfs write
    - RDMA/srpt: Duplicate port name members
    - RDMA/srpt: Introduce a reference count in struct srpt_device
    - RDMA/srpt: Fix a use-after-free
    - mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
    - RDMA/mlx5: Add missing check for return value in get namespace flow
    - RDMA/rxe: Fix error unwind in rxe_create_qp()
    - null_blk: fix ida error handling in null_add_dev()
    - nvme: use command_id instead of req->tag in trace_nvme_complete_rq()
    - jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction()
    - ext4: recover csum seed of tmp_inode after migrating to extents
    - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal
      aborted
    - opp: Fix error check in dev_pm_opp_attach_genpd()
    - serial: 8250: Export ICR access helpers for internal use
    - serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty()
    - profiling: fix shift too large makes kernel panic
    - tty: n_gsm: Delete gsmtty open SABM frame when config requester
    - tty: n_gsm: fix user open not possible at responder until initiator open
    - tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()
    - tty: n_gsm: fix non flow control frames during mux flow off
    - tty: n_gsm: fix packet re-transmission without open control channel
    - tty: n_gsm: fix race condition in gsmld_write()
    - [arm64] ASoC: qcom: Fix missing of_node_put() in
      asoc_qcom_lpass_cpu_platform_probe()
    - vfio: Remove extra put/gets around vfio_device->group
    - vfio: Simplify the lifetime logic for vfio_device
    - vfio: Split creation of a vfio_device into init and register ops
    - tty: n_gsm: fix wrong T1 retry count handling
    - tty: n_gsm: fix DM command
    - tty: n_gsm: fix missing corner cases in gsmld_poll()
    - kfifo: fix kfifo_to_user() return type
    - lib/smp_processor_id: fix imbalanced instrumentation_end() call
    - [arm64] mfd: max77620: Fix refcount leak in max77620_initialise_fps
    - [arm64] iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of
      loop
    - [s390x] dump: fix old lowcore virtual vs physical address confusion
    - fuse: Remove the control interface for virtio-fs
    - [armhf] ASoC: audio-graph-card: Add of_node_put() in fail path
    - [arm64] watchdog: armada_37xx_wdt: check the return value of
      devm_ioremap() in armada_37xx_wdt_probe()
    - [arm64,armhf] video: fbdev: amba-clcd: Fix refcount leak bugs
    - video: fbdev: sis: fix typos in SiS_GetModeID()
    - [powerpc*] pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and
      alias
    - f2fs: don't set GC_FAILURE_PIN for background GC
    - f2fs: write checkpoint during FG_GC
    - f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time
    - [powerpc*] xive: Fix refcount leak in xive_get_max_prio
    - kprobes: Forbid probing on trampoline and BPF code areas
    - [powerpc*] pci: Fix PHB numbering when using opal-phbid
    - sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy()
    - sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed
    - [amd64] x86/numa: Use cpumask_available instead of hardcoded NULL check
    - video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()
    - sched: Fix the check of nr_running at queue wakelist
    - video: fbdev: vt8623fb: Check the size of screen before memset_io()
    - video: fbdev: arkfb: Check the size of screen before memset_io()
    - video: fbdev: s3fb: Check the size of screen before memset_io()
    - [s390x] scsi: zfcp: Fix missing auto port scan and thus missing target
      ports
    - scsi: qla2xxx: Fix discovery issues in FC-AL topology
    - scsi: qla2xxx: Turn off multi-queue for 8G adapters
    - scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection
    - scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os
    - scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests
    - [x86] bugs: Enable STIBP for IBPB mitigated RETBleed
    - [x86] ftrace/x86: Add back ftrace_expected assignment
    - __follow_mount_rcu(): verify that mount_lock remains unchanged
    - spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
    - [x86] drm/i915/dg1: Update DMC_DEBUG3 register
    - HID: Ignore battery for Elan touchscreen on HP Spectre X360 15-df0xxx
    - HID: hid-input: add Surface Go battery quirk
    - [arm*] drm/vc4: drv: Adopt the dma configuration from the HVS or V3D
      component
    - usbnet: smsc95xx: Don't clear read-only PHY interrupt
    - usbnet: smsc95xx: Avoid link settings race on interrupt reception
    - [x86] intel_th: pci: Add Meteor Lake-P support
    - [x86] intel_th: pci: Add Raptor Lake-S PCH support
    - [x86] intel_th: pci: Add Raptor Lake-S CPU support
    - [x86] KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors
    - [x86] KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS)
    - [amd64] iommu/vt-d: avoid invalid memory access via
      node_online(NUMA_NO_NODE)
    - PCI/AER: Write AER Capability only when we control it
    - PCI/ERR: Bind RCEC devices to the Root Port driver
    - PCI/ERR: Rename reset_link() to reset_subordinates()
    - PCI/ERR: Simplify by using pci_upstream_bridge()
    - PCI/ERR: Simplify by computing pci_pcie_type() once
    - PCI/ERR: Use "bridge" for clarity in pcie_do_recovery()
    - PCI/ERR: Avoid negated conditional for clarity
    - PCI/ERR: Add pci_walk_bridge() to pcie_do_recovery()
    - PCI/ERR: Recover from RCEC AER errors
    - PCI/AER: Iterate over error counters instead of error strings
    - serial: 8250: Dissociate 4MHz Titan ports from Oxford ports
    - serial: 8250: Correct the clock for OxSemi PCIe devices
    - serial: 8250_pci: Refactor the loop in pci_ite887x_init()
    - serial: 8250_pci: Replace dev_*() by pci_*() macros
    - serial: 8250: Fold EndRun device support into OxSemi Tornado code
    - dm writecache: set a default MAX_WRITEBACK_JOBS
    - dm thin: fix use-after-free crash in dm_sm_register_threshold_callback
    - timekeeping: contribute wall clock to rng on time change
    - btrfs: reject log replay if there is unsupported RO compat flag
    - btrfs: reset block group chunk force if we have to wait
    - [amd64,arm64] ACPI: CPPC: Do not prevent CPPC from working in the future
    - [x86] KVM: VMX: Drop guest CPUID check for VMXE in vmx_set_cr4()
    - [x86] KVM: VMX: Drop explicit 'nested' check from vmx_set_cr4()
    - [x86] KVM: SVM: Drop VMXE check from svm_set_cr4()
    - [x86] KVM: x86: Move vendor CR4 validity check to dedicated kvm_x86_ops
      hook
    - [x86] KVM: nVMX: Inject #UD if VMXON is attempted with incompatible
      CR0/CR4
    - [x86] KVM: x86/pmu: preserve IA32_PERF_CAPABILITIES across CPUID refresh
    - [x86] KVM: x86/pmu: Use binary search to check filtered events
    - [x86] KVM: x86/pmu: Use different raw event masks for AMD and Intel
    - [x86] KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter
    - [x86] KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's
      no vPMU
    - [x86] KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support
      global_ctrl
    - xen-blkback: fix persistent grants negotiation
    - xen-blkback: Apply 'feature_persistent' parameter when connect
    - xen-blkfront: Apply 'feature_persistent' parameter when connect
    - KEYS: asymmetric: enforce SM2 signature use pkey algo
    - tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH
    - tracing: Use a struct alignof to determine trace event field alignment
    - ext4: check if directory block is within i_size (CVE-2022-1184)
    - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
    - ext4: fix warning in ext4_iomap_begin as race between bmap and write
    - ext4: make sure ext4_append() always allocates new block
    - ext4: fix use-after-free in ext4_xattr_set_entry
    - ext4: update s_overhead_clusters in the superblock during an on-line
      resize
    - ext4: fix extent status tree race in writeback error recovery path
    - ext4: correct max_inline_xattr_value_size computing
    - ext4: correct the misjudgment in ext4_iget_extra_inode
    - dm raid: fix address sanitizer warning in raid_resume
    - dm raid: fix address sanitizer warning in raid_status
    - KVM: Add infrastructure and macro to mark VM as bugged
    - [x86] KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC
      irq (CVE-2022-2153)
    - [x86] KVM: x86: Avoid theoretical NULL pointer dereference in
      kvm_irq_delivery_to_apic_fast() (CVE-2022-2153)
    - mac80211: fix a memory leak where sta_info is not freed
    - tcp: fix over estimation in sk_forced_mem_schedule()
    - Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv"
    - [arm*] drm/vc4: change vc4_dma_range_matches from a global to static
    - Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP"
    - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
    - [x86] kvm: x86/pmu: Fix the compare function used by the pmu event filter
    - [arm64] tee: add overflow check in register_shm_helper()
    - net/9p: Initialize the iounit field during fid creation
    - net_sched: cls_route: disallow handle of 0
    - sched/fair: Fix fault in reweight_entity
    - btrfs: only write the sectors in the vertical stripe which has data
      stripes
    - btrfs: raid56: don't trust any cached sector in __raid56_parity_recover()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.138
    - ALSA: info: Fix llseek return value when using callback
    - ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU
    - [x86] mm: Use proper mask when setting PUD mapping
    - rds: add missing barrier to release_refill
    - ata: libata-eh: Add missing command name
    - [arm64] mmc: meson-gx: Fix an error handling path in meson_mmc_probe()
    - btrfs: fix lost error handling when looking up extended ref on log replay
    - tracing: Have filter accept "common_cpu" to be consistent
    - ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II
    - can: ems_usb: fix clang's -Wunaligned-access warning
    - apparmor: fix quiet_denied for file rules
    - apparmor: fix absroot causing audited secids to begin with =
    - apparmor: Fix failed mount permission check error message
    - apparmor: fix aa_label_asxprint return check
    - apparmor: fix setting unconfined mode on a loaded profile
    - apparmor: fix overlapping attachment computation
    - apparmor: fix reference count leak in aa_pivotroot()
    - apparmor: Fix memleak in aa_simple_write_to_buffer()
    - Documentation: ACPI: EINJ: Fix obsolete example
    - NFSv4.1: Don't decrease the value of seq_nr_highest_sent
    - NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly
    - NFSv4: Fix races in the legacy idmapper upcall
    - NFSv4.1: RECLAIM_COMPLETE must handle EACCES
    - NFSv4/pnfs: Fix a use-after-free bug in open
    - bpf: Acquire map uref in .init_seq_private for array map iterator
    - bpf: Acquire map uref in .init_seq_private for hash map iterator
    - bpf: Acquire map uref in .init_seq_private for sock local storage map
      iterator
    - bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator
    - bpf: Check the validity of max_rdwr_access for sock local storage map
      iterator
    - can: mcp251x: Fix race condition on receive interrupt
    - [amd64,arm64] net: atlantic: fix aq_vec index out of range error
    - sunrpc: fix expiry of auth creds
    - SUNRPC: Reinitialise the backchannel request buffers before reuse
    - virtio_net: fix memory leak inside XPD_TX with mergeable
    - devlink: Fix use-after-free after a failed reload
    - [arm64] pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
    - [arm64,armhf] pinctrl: sunxi: Add I/O bias setting for H6 R-PIO
    - ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool
    - geneve: do not use RT_TOS for IPv6 flowlabel
    - ipv6: do not use RT_TOS for IPv6 flowlabel
    - [x86] plip: avoid rcu debug splat
    - vsock: Fix memory leak in vsock_connect()
    - vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout()
    - dt-bindings: arm: qcom: fix MSM8916 MTP compatibles
    - dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources
    - ceph: use correct index when encoding client supported features
    - ceph: don't leak snap_rwsem in handle_cap_grant
    - nfp: ethtool: fix the display error of `ethtool -m DEVNAME`
    - xen/xenbus: fix return type in xenbus_file_read()
    - atm: idt77252: fix use-after-free bugs caused by tst_timer
    - geneve: fix TOS inheriting for ipv4
    - [arm64] dpaa2-eth: trace the allocated address instead of page struct
    - iavf: Fix adminq error handling
    - netfilter: nf_tables: really skip inactive sets when allocating name
    - netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on
      NFT_SET_OBJECT flag
    - netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is
      specified
    - [powerpc*] pci: Fix get_phb_number() locking
    - [arm64,armhf] spi: meson-spicc: add local pow2 clock ops to preserve rate
      between messages
    - [arm64,armhf] net: dsa: mv88e6060: prevent crash on an unused port
    - [arm64] net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet
      counters
    - net: genl: fix error path memory leak in policy dumping
    - ice: Ignore EEXIST when setting promisc mode
    - [arm64,armhf] i2c: imx: Make sure to unregister adapter on remove()
    - regulator: pca9450: Remove restrictions for regulator-name
    - i40e: Fix to stop tx_timeout recovery if GLOBR fails
    - [arm64,armhf] fec: Fix timer capture timing in `fec_ptp_enable_pps()`
    - [x86] stmmac: intel: Add a missing clk_disable_unprepare() call in
      intel_eth_pci_remove()
    - igb: Add lock to avoid data race
    - kbuild: fix the modules order between drivers and libs
    - locking/atomic: Make test_and_*_bit() ordered on failure
    - [x86] ASoC: SOF: intel: move sof_intel_dsp_desc() forward
    - [arm64] drm/meson: Fix refcount bugs in
      meson_vpu_has_available_connectors()
    - audit: log nftables configuration change events once per table
    - netfilter: nftables: add helper function to set the base sequence number
    - netfilter: add helper function to set up the nfnetlink header and use it
    - [armhf] drm/sun4i: dsi: Prevent underflow when computing packet sizes
    - PCI: Add ACS quirk for Broadcom BCM5750x NICs
    - [arm64,armhf] platform/chrome: cros_ec_proto: don't show MKBP version if
      unsupported
    - usb: gadget: uvc: call uvc uvcg_warn on completed status instead of
      uvcg_info
    - [arm64,armhf] irqchip/tegra: Fix overflow implicit truncation warnings
    - [arm64] drm/meson: Fix overflow implicit truncation warnings
    - [armhf] clk: ti: Stop using legacy clkctrl names for omap4 and 5
    - [arm*] usb: dwc2: gadget: remove D+ pull-up while no vbus with
      usb-role-switch
    - [x86] vboxguest: Do not use devm for irq
    - uacce: Handle parent device removal or parent driver module rmmod
    - zram: do not lookup algorithm in backends table
    - [arm64] clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description
    - scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user
      input
    - gadgetfs: ep_io - wait until IRQ finishes
    - [x86] pinctrl: intel: Check against matching data instead of ACPI
      companion
    - [powerpc*] cxl: Fix a memory leak in an error handling path
    - [arm64] PCI/ACPI: Guard ARM64-specific mcfg_quirks
    - RDMA/rxe: Limit the number of calls to each tasklet
    - md: Notify sysfs sync_completed in md_reap_sync_thread()
    - nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue
      teardown
    - drivers:md:fix a potential use-after-free bug
    - ext4: avoid remove directory when directory is corrupted
    - ext4: avoid resizing to a partial cluster size
    - lib/list_debug.c: Detect uninitialized lists
    - vfio: Clear the caps->buf to NULL after free
    - [mips64el,mipsel] cavium-octeon: Fix missing of_node_put() in
      octeon2_usb_clocks_start
    - modules: Ensure natural alignment for .altinstructions and __bug_table
      sections
    - watchdog: export lockup_detector_reconfigure
    - ALSA: core: Add async signal helpers
    - ALSA: timer: Use deferred fasync helper
    - ALSA: control: Use deferred fasync helper
    - f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()
    - f2fs: fix to do sanity check on segment type in build_sit_entries()
    - smb3: check xattr value length earlier
    - [powerpc*] 64: Init jump labels before parse_early_param()
    - netfilter: nftables: fix a warning message in
      nf_tables_commit_audit_collect()
    - netfilter: nf_tables: fix audit memory leak in nf_tables_commit
    - tracing/probes: Have kprobes and uprobes use $COMM too
    - can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE
      with netdev_warn_once()
    - can: j1939: j1939_session_destroy(): fix memory leak of skbs
    - PCI/ERR: Retain status from error notification
    - qrtr: Convert qrtr_ports from IDR to XArray
    - bpf: Fix KASAN use-after-free Read in compute_effective_progs
    - [arm64] tee: fix memory leak in tee_shm_register()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.139
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.140
    - audit: fix potential double free on error path from
      fsnotify_add_inode_mark
    - pinctrl: amd: Don't save/restore interrupt status and wake status bits
    - xfs: prevent a WARN_ONCE() in xfs_ioc_attr_list()
    - xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP*
    - fs: remove __sync_filesystem
    - vfs: make sync_filesystem return errors from ->sync_fs
    - xfs: return errors in xfs_fs_sync_fs
    - xfs: only bother with sync_filesystem during readonly remount
    - kernel/sched: Remove dl_boosted flag comment
    - xfrm: fix refcount leak in __xfrm_policy_check()
    - xfrm: clone missing x->lastused in xfrm_do_migrate
    - af_key: Do not call xfrm_probe_algs in parallel (CVE-2022-3028)
    - xfrm: policy: fix metadata dst->dev xmit null pointer dereference
    - NFS: Don't allocate nfs_fattr on the stack in __nfs42_ssc_open()
    - NFSv4.2 fix problems with __nfs42_ssc_open
    - SUNRPC: RPC level errors should set task->tk_rpc_status
    - mm/huge_memory.c: use helper function migration_entry_to_page()
    - mm/smaps: don't access young/dirty bit if pte unpresent
    - rose: check NULL rose_loopback_neigh->loopback
    - ice: xsk: Force rings to be sized to power of 2
    - ice: xsk: prohibit usage of non-balanced queue id
    - net/mlx5e: Properly disable vlan strip on non-UL reps
    - bonding: 802.3ad: fix no transmission of LACPDUs
    - net: ipvtap - add __init/__exit annotations to module init/exit funcs
    - netfilter: ebtables: reject blobs that don't provide all entry points
    - bnxt_en: fix NQ resource accounting during vf creation on 57500 chips
    - netfilter: nft_payload: report ERANGE for too long offset and length
    - netfilter: nft_payload: do not truncate csum_offset and csum_type
    - netfilter: nf_tables: do not leave chain stats enabled on error
    - netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families
    - netfilter: nft_tunnel: restrict it to netdev family
    - netfilter: nftables: remove redundant assignment of variable err
    - netfilter: nf_tables: consolidate rule verdict trace call
    - netfilter: nft_cmp: optimize comparison for 16-bytes
    - netfilter: bitwise: improve error goto labels
    - netfilter: nf_tables: upfront validation of data via nft_data_init()
    - netfilter: nf_tables: disallow jump to implicit chain from set element
    - netfilter: nf_tables: disallow binding to already bound chain
      (CVE-2022-39190)
    - tcp: tweak len/truesize ratio for coalesce candidates
    - net: Fix data-races around sysctl_[rw]mem(_offset)?.
    - net: Fix data-races around sysctl_[rw]mem_(max|default).
    - net: Fix data-races around weight_p and dev_weight_[rt]x_bias.
    - net: Fix data-races around netdev_max_backlog.
    - net: Fix data-races around netdev_tstamp_prequeue.
    - ratelimit: Fix data-races in ___ratelimit().
    - bpf: Folding omem_charge() into sk_storage_charge()
    - net: Fix data-races around sysctl_optmem_max.
    - net: Fix a data-race around sysctl_tstamp_allow_data.
    - net: Fix a data-race around sysctl_net_busy_poll.
    - net: Fix a data-race around sysctl_net_busy_read.
    - net: Fix a data-race around netdev_budget.
    - net: Fix a data-race around netdev_budget_usecs.
    - net: Fix data-races around sysctl_fb_tunnels_only_for_init_net.
    - net: Fix data-races around sysctl_devconf_inherit_init_net.
    - net: Fix a data-race around sysctl_somaxconn.
    - ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter
    - rxrpc: Fix locking in rxrpc's sendmsg
    - btrfs: fix silent failure when deleting root reference
    - btrfs: replace: drop assert for suspended replace
    - btrfs: add info when mount fails due to stale replace target
    - btrfs: check if root is readonly while setting security xattr
    - [x86] perf/x86/lbr: Enable the branch type for the Arch LBR by default
    - [amd64] x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry
    - [x86] bugs: Add "unknown" reporting for MMIO Stale Data
    - loop: Check for overflow while configuring loop
    - asm-generic: sections: refactor memory_intersects
    - [s390x] fix double free of GS and RI CBs on fork() failure
    - [x86] ACPI: processor: Remove freq Qos request for all CPUs
    - xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
    - mm/hugetlb: fix hugetlb not supporting softdirty tracking
    - Revert "md-raid: destroy the bitmap after destroying the thread"
    - md: call __md_stop_writes in md_stop
    - [arm64] Fix match_list for erratum 1286807 on Arm Cortex-A76
    - Documentation/ABI: Mention retbleed vulnerability info file for sysfs
    - blk-mq: fix io hung due to missing commit_rqs
    - [x86] perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU
    - [x86] scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
    - bpf: Don't use tnum_range on array range checking for poke descriptors
      (CVE-2022-2905)

  [ Salvatore Bonaccorso ]
  * Bump ABI to 18
  * certs: Rotate to use the "Debian Secure Boot Signer 2022 - linux"
    certificate (Closes: #1018752)
  * [x86] nospec: Unwreck the RSB stuffing
  * [x86] nospec: Fix i386 RSB stuffing (Closes: #1017425)
  * mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
    (CVE-2022-39188)
  * Revert "PCI/portdrv: Don't disable AER reporting in
    get_port_device_capability()"
  * bpf: Don't redirect packets with invalid pkt_len
  * mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
  * net/af_packet: check len when min_header_len equals to 0

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 02 Sep 2022 15:54:53 +0200

linux (5.10.136-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.128
    - MAINTAINERS: add Amir as xfs maintainer for 5.10.y
    - drm: remove drm_fb_helper_modinit
    - tick/nohz: unexport __init-annotated tick_nohz_full_setup()
    - bcache: memset on stack variables in bch_btree_check() and
      bch_sectors_dirty_init()
    - xfs: use kmem_cache_free() for kmem_cache objects
    - xfs: punch out data fork delalloc blocks on COW writeback failure
    - xfs: Fix the free logic of state in xfs_attr_node_hasname
    - xfs: remove all COW fork extents when remounting readonly
    - xfs: check sb_meta_uuid for dabuf buffer recovery
    - [powerpc*] ftrace: Remove ftrace init tramp once kernel init is complete
    - [arm64] net: mscc: ocelot: allow unregistered IP multicast flooding
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.129
    - drm/amdgpu: To flush tlb for MMHUB of RAVEN series
    - ipv6: take care of disable_policy when restoring routes
    - nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG SX6000LNP (AKA SPECTRIX
      S40G)
    - nvdimm: Fix badblocks clear off-by-one error
    - [powerpc*] bpf: Fix use of user_pt_regs in uapi
    - dm raid: fix accesses beyond end of raid member array
    - [s390x] archrandom: simplify back to earlier design and initialize earlier
    - SUNRPC: Fix READ_PLUS crasher (Closes: #1014793)
    - net: usb: ax88179_178a: Fix packet receiving
    - virtio-net: fix race between ndo_open() and virtio_device_ready()
    - [armhf] net: dsa: bcm_sf2: force pause link settings
    - net: tun: unlink NAPI from device on destruction
    - net: tun: stop NAPI when detaching queues
    - net: dp83822: disable false carrier interrupt
    - net: dp83822: disable rx error interrupt
    - RDMA/qedr: Fix reporting QP timeout attribute
    - RDMA/cm: Fix memory leak in ib_cm_insert_listen
    - linux/dim: Fix divide by 0 in RDMA DIM
    - usbnet: fix memory allocation in helpers
    - net: ipv6: unexport __init-annotated seg6_hmac_net_init()
    - NFSD: restore EINVAL error translation in nfsd_commit()
    - netfilter: nft_dynset: restore set element counter when failing to update
    - net/sched: act_api: Notify user space if any actions were flushed before
      error
    - net: bonding: fix possible NULL deref in rlb code
    - net: bonding: fix use-after-free after 802.3ad slave unbind
    - tipc: move bc link creation back to tipc_node_create
    - epic100: fix use after free on rmmod
    - io_uring: ensure that send/sendmsg and recv/recvmsg check sqe->ioprio
    - tunnels: do not assume mac header is set in skb_tunnel_check_pmtu()
    - net: tun: avoid disabling NAPI twice
    - xfs: use current->journal_info for detecting transaction recursion
    - xfs: rename variable mp to parsing_mp
    - xfs: Skip repetitive warnings about mount options
    - xfs: ensure xfs_errortag_random_default matches XFS_ERRTAG_MAX
    - xfs: fix xfs_trans slab cache name
    - xfs: update superblock counters correctly for !lazysbcount
    - xfs: fix xfs_reflink_unshare usage of filemap_write_and_wait_range
    - tcp: add a missing nf_reset_ct() in 3WHS handling
    - xen/gntdev: Avoid blocking in unmap_grant_pages()
    - [arm64] drivers: cpufreq: Add missing of_node_put() in qoriq-cpufreq.c
    - sit: use min
    - ipv6/sit: fix ipip6_tunnel_get_prl return value
    - hwmon: (ibmaem) don't call platform_device_del() if platform_device_add()
      fails
    - net: usb: qmi_wwan: add Telit 0x1060 composition
    - net: usb: qmi_wwan: add Telit 0x1070 composition
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.130
    - mm/slub: add missing TID updates on slab deactivation
    - ALSA: hda/realtek: Add quirk for Clevo L140PU
    - can: bcm: use call_rcu() instead of costly synchronize_rcu()
    - can: gs_usb: gs_usb_open/close(): fix memory leak
    - bpf: Fix incorrect verifier simulation around jmp32's jeq/jne
    - bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals
    - usbnet: fix memory leak in error case
    - netfilter: nft_set_pipapo: release elements in clone from abort path
    - [amd64] iommu/vt-d: Fix PCI bus rescan device hot add
    - PM: runtime: Redefine pm_runtime_release_supplier()
    - memregion: Fix memregion_free() fallback definition
    - video: of_display_timing.h: include errno.h
    - [powerpc*] powernv: delay rng platform device creation until later in boot
    - can: kvaser_usb: replace run-time checks with struct
      kvaser_usb_driver_info
    - can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression
    - can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits
    - xfs: remove incorrect ASSERT in xfs_rename
    - [armhf] meson: Fix refcount leak in meson_smp_prepare_cpus
    - [armhf] pinctrl: sunxi: a83t: Fix NAND function name for some pins
    - [arm64] dts: imx8mp-evk: correct mmc pad settings
    - [arm64] dts: imx8mp-evk: correct the uart2 pinctl value
    - [arm64] dts: imx8mp-evk: correct gpio-led pad settings
    - [arm64] dts: imx8mp-evk: correct I2C3 pad settings
    - [arm64,armhf] pinctrl: sunxi: sunxi_pconf_set: use correct offset
    - [arm64] dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo
    - xsk: Clear page contiguity bit when unmapping pool
    - i40e: Fix dropped jumbo frames statistics
    - r8169: fix accessing unset transport header
    - [armhf] dmaengine: imx-sdma: Allow imx8m for imx7 FW revs
    - misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer
    - misc: rtsx_usb: use separate command and response buffers
    - misc: rtsx_usb: set return value in rsp_buf alloc err path
    - dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo
    - ida: don't use BUG_ON() for debugging
    - [arm64,armhf] dmaengine: pl330: Fix lockdep warning about non-static key
    - [armhf] dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
    - [armhf] dmaengine: ti: Add missing put_device in
      ti_dra7_xbar_route_allocate
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.131
    - [armhf] Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.132
    - [x86] ALSA: hda - Add fixup for Dell Latitidue E5430
    - [x86] ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model
    - [x86] ALSA: hda/realtek: Fix headset mic for Acer SF313-51
    - [x86] ALSA: hda/realtek - Fix headset mic problem for a HP machine with
      alc671
    - [x86] ALSA: hda/realtek - Fix headset mic problem for a HP machine with
      alc221
    - [x86] ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop
    - xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue
    - fix race between exit_itimers() and /proc/pid/timers
    - mm: split huge PUD on wp_huge_pud fallback
    - tracing/histograms: Fix memory leak problem
    - net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale
      pointer
    - ip: fix dflt addr selection for connected nexthop
    - [armhf] 9213/1: Print message about disabled Spectre workarounds only
      once
    - [armel,armhf] 9214/1: alignment: advance IT state after emulating Thumb
      instruction
    - wifi: mac80211: fix queue selection for mesh/OCB interfaces
    - cgroup: Use separate src/dst nodes when preloading css_sets for migration
    - btrfs: return -EAGAIN for NOWAIT dio reads/writes on compressed and
      inline extents
    - [arm64,armhf] drm/panfrost: Put mapping instead of shmem obj on
      panfrost_mmu_map_fault_addr() error
    - [arm64,armhf] drm/panfrost: Fix shrinker list corruption by madvise IOCTL
    - fs/remap: constrain dedupe of EOF blocks
    - nilfs2: fix incorrect masking of permission flags for symlinks
    - sh: convert nommu io{re,un}map() to static inline functions
    - Revert "evm: Fix memleak in init_desc"
    - ext4: fix race condition between ext4_write and ext4_convert_inline_data
    - [armhf] dts: imx6qdl-ts7970: Fix ngpio typo and count
    - [armhf] 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out
      of idle
    - [armel,armhf] 9210/1: Mark the FDT_FIXED sections as shareable
    - net/mlx5e: Fix capability check for updating vnic env counters
    - [x86] drm/i915: fix a possible refcount leak in
      intel_dp_add_mst_connector()
    - ima: Fix a potential integer overflow in ima_appraise_measurement
    - [arm64,armhf] ASoC: sgtl5000: Fix noise on shutdown/remove
    - [x86] ASoC: Intel: Skylake: Correct the ssp rate discovery in
      skl_get_ssp_clks()
    - [x86] ASoC: Intel: Skylake: Correct the handling of fmt_config flexible
      array
    - sysctl: Fix data races in proc_dointvec().
    - sysctl: Fix data races in proc_douintvec().
    - sysctl: Fix data races in proc_dointvec_minmax().
    - sysctl: Fix data races in proc_douintvec_minmax().
    - sysctl: Fix data races in proc_doulongvec_minmax().
    - sysctl: Fix data races in proc_dointvec_jiffies().
    - tcp: Fix a data-race around sysctl_tcp_max_orphans.
    - inetpeer: Fix data-races around sysctl.
    - net: Fix data-races around sysctl_mem.
    - cipso: Fix data-races around sysctl.
    - icmp: Fix data-races around sysctl.
    - ipv4: Fix a data-race around sysctl_fib_sync_mem.
    - [armhf] dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero
    - [x86] drm/i915/gt: Serialize TLB invalidates with GT resets
    - sysctl: Fix data-races in proc_dointvec_ms_jiffies().
    - icmp: Fix a data-race around sysctl_icmp_ratelimit.
    - icmp: Fix a data-race around sysctl_icmp_ratemask.
    - raw: Fix a data-race around sysctl_raw_l3mdev_accept.
    - ipv4: Fix data-races around sysctl_ip_dynaddr.
    - nexthop: Fix data-races around nexthop_compat_mode.
    - [armhf] net: ftgmac100: Hold reference returned by of_get_child_by_name()
    - ima: force signature verification when CONFIG_KEXEC_SIG is configured
    - ima: Fix potential memory leak in ima_init_crypto()
    - sfc: fix use after free when disabling sriov
    - seg6: fix skb checksum evaluation in SRH encapsulation/insertion
    - seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors
    - seg6: bpf: fix skb checksum in bpf_push_seg6_encap()
    - sfc: fix kernel panic when creating VF
    - net: atlantic: remove deep parameter on suspend/resume functions
    - net: atlantic: remove aq_nic_deinit() when resume
    - [x86] KVM: x86: Fully initialize 'struct kvm_lapic_irq' in
      kvm_pv_kick_cpu_op()
    - net/tls: Check for errors in tls_device_init
    - mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE
    - virtio_mmio: Add missing PM calls to freeze/restore
    - virtio_mmio: Restore guest page size on resume
    - netfilter: br_netfilter: do not skip all hooks with 0 priority
    - [arm64] scsi: hisi_sas: Limit max hw sectors for v3 HW
    - [powerpc*] cpufreq: pmac32-cpufreq: Fix refcount leak bug
    - [x86] platform/x86: hp-wmi: Ignore Sanitization Mode event
    - net: tipc: fix possible refcount leak in tipc_sk_create()
    - nvme-tcp: always fail a request when sending it failed
    - nvme: fix regression when disconnect a recovering ctrl
    - net: sfp: fix memory leak in sfp_probe()
    - ASoC: ops: Fix off by one in range control validation
    - [armhf] pinctrl: aspeed: Fix potential NULL dereference in
      aspeed_pinmux_set_mux()
    - [x86] ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow
    - ASoC: dapm: Initialise kcontrol data for mux/demux controls
    - [amd64] Clear .brk area at early boot
    - [armhf] dts: stm32: use the correct clock source for CEC on stm32mp151
    - Revert "can: xilinx_can: Limit CANFD brp to 2"
    - nvme-pci: phison e16 has bogus namespace ids
    - signal handling: don't use BUG_ON() for debugging
    - USB: serial: ftdi_sio: add Belimo device ids
    - usb: typec: add missing uevent when partner support PD
    - [arm64,armhf] usb: dwc3: gadget: Fix event pending check
    - [armhf] tty: serial: samsung_tty: set dma burst_size to 1
    - vt: fix memory overlapping when deleting chars in the buffer
    - serial: 8250: fix return error code in serial8250_request_std_resource()
    - [armhf] serial: stm32: Clear prev values before setting RTS delays
    - [arm*] serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle
    - serial: 8250: Fix PM usage_count for console handover
    - [x86] pat: Fix x86_has_pat_wp()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.133
    - [amd64] Preparation for mitigating RETbleed:
      + KVM/VMX: Use TEST %REG,%REG instead of CMP $0,%REG in vmenter.S
      + KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
      + objtool: Refactor ORC section generation
      + objtool: Add 'alt_group' struct
      + objtool: Support stack layout changes in alternatives
      + objtool: Support retpoline jump detection for vmlinux.o
      + objtool: Assume only ELF functions do sibling calls
      + objtool: Combine UNWIND_HINT_RET_OFFSET and UNWIND_HINT_FUNC
      + x86/xen: Support objtool validation in xen-asm.S
      + x86/xen: Support objtool vmlinux.o validation in xen-head.S
      + x86/alternative: Merge include files
      + x86/alternative: Support not-feature
      + x86/alternative: Support ALTERNATIVE_TERNARY
      + x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has()
      + x86/insn: Rename insn_decode() to insn_decode_from_regs()
      + x86/insn: Add a __ignore_sync_check__ marker
      + x86/insn: Add an insn_decode() API
      + x86/insn-eval: Handle return values from the decoder
      + x86/alternative: Use insn_decode()
      + x86: Add insn_decode_kernel()
      + x86/alternatives: Optimize optimize_nops()
      + x86/retpoline: Simplify retpolines
      + objtool: Correctly handle retpoline thunk calls
      + objtool: Handle per arch retpoline naming
      + objtool: Rework the elf_rebuild_reloc_section() logic
      + objtool: Add elf_create_reloc() helper
      + objtool: Create reloc sections implicitly
      + objtool: Extract elf_strtab_concat()
      + objtool: Extract elf_symbol_add()
      + objtool: Add elf_create_undef_symbol()
      + objtool: Keep track of retpoline call sites
      + objtool: Cache instruction relocs
      + objtool: Skip magical retpoline .altinstr_replacement
      + objtool/x86: Rewrite retpoline thunk calls
      + objtool: Support asm jump tables
      + x86/alternative: Optimize single-byte NOPs at an arbitrary position
      + objtool: Fix .symtab_shndx handling for elf_create_undef_symbol()
      + objtool: Only rewrite unconditional retpoline thunk calls
      + objtool/x86: Ignore __x86_indirect_alt_* symbols
      + objtool: Don't make .altinstructions writable
      + objtool: Teach get_alt_entry() about more relocation types
      + objtool: print out the symbol type when complaining about it
      + objtool: Remove reloc symbol type checks in get_alt_entry()
      + objtool: Make .altinstructions section entry size consistent
      + objtool: Introduce CFI hash
      + objtool: Handle __sanitize_cov*() tail calls
      + objtool: Classify symbols
      + objtool: Explicitly avoid self modifying code in .altinstr_replacement
      + objtool,x86: Replace alternatives with .retpoline_sites
      + x86/retpoline: Remove unused replacement symbols
      + x86/asm: Fix register order
      + x86/asm: Fixup odd GEN-for-each-reg.h usage
      + x86/retpoline: Move the retpoline thunk declarations to nospec-branch.h
      + x86/retpoline: Create a retpoline thunk array
      + x86/alternative: Implement .retpoline_sites support
      + x86/alternative: Handle Jcc __x86_indirect_thunk_\reg
      + x86/alternative: Try inline spectre_v2=retpoline,amd
      + x86/alternative: Add debug prints to apply_retpolines()
      + bpf,x86: Simplify computing label offsets
      + bpf,x86: Respect X86_FEATURE_RETPOLINE*
      + x86/lib/atomic64_386_32: Rename things
    - [amd64] Mitigate straight-line speculation:
      + x86: Prepare asm files for straight-line-speculation
      + x86: Prepare inline-asm for straight-line-speculation
      + x86/alternative: Relax text_poke_bp() constraint
      + objtool: Add straight-line-speculation validation
      + x86: Add straight-line-speculation mitigation
      + tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf
        bench mem memcpy'
      + kvm/emulate: Fix SETcc emulation function offsets with SLS
      + objtool: Default ignore INT3 for unreachable
      + crypto: x86/poly1305 - Fixup SLS
      + objtool: Fix SLS validation for kcov tail-call replacement
    - objtool: Fix code relocs vs weak symbols
    - objtool: Fix type of reloc::addend
    - objtool: Fix symbol creation
    - x86/entry: Remove skip_r11rcx
    - objtool: Fix objtool regression on x32 systems
    - x86/realmode: build with -D__DISABLE_EXPORTS
    - [amd64] Add mitigations for RETbleed on AMD/Hygon (CVE-2022-29900) and
      Intel (CVE-2022-29901) processors:
      + x86/kvm/vmx: Make noinstr clean
      + x86/cpufeatures: Move RETPOLINE flags to word 11
      + x86/retpoline: Cleanup some #ifdefery
      + x86/retpoline: Swizzle retpoline thunk
      + Makefile: Set retpoline cflags based on CONFIG_CC_IS_{CLANG,GCC}
      + x86/retpoline: Use -mfunction-return
      + x86: Undo return-thunk damage
      + x86,objtool: Create .return_sites
      + objtool: skip non-text sections when adding return-thunk sites
      + x86,static_call: Use alternative RET encoding
      + x86/ftrace: Use alternative RET encoding
      + x86/bpf: Use alternative RET encoding
      + x86/kvm: Fix SETcc emulation for return thunks
      + x86/vsyscall_emu/64: Don't use RET in vsyscall emulation
      + x86/sev: Avoid using __x86_return_thunk
      + x86: Use return-thunk in asm code
      + objtool: Treat .text.__x86.* as noinstr
      + x86: Add magic AMD return-thunk
      + x86/bugs: Report AMD retbleed vulnerability
      + x86/bugs: Add AMD retbleed= boot parameter
      + x86/bugs: Enable STIBP for JMP2RET
      + x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value
      + x86/entry: Add kernel IBRS implementation
      + x86/bugs: Optimize SPEC_CTRL MSR writes
      + x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS
      + x86/bugs: Split spectre_v2_select_mitigation() and
        spectre_v2_user_select_mitigation()
      + x86/bugs: Report Intel retbleed vulnerability
      + intel_idle: Disable IBRS during long idle
      + objtool: Update Retpoline validation
      + x86/xen: Rename SYS* entry points
      + x86/bugs: Add retbleed=ibpb
      + x86/bugs: Do IBPB fallback check only once
      + objtool: Add entry UNRET validation
      + x86/cpu/amd: Add Spectral Chicken
      + x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n
      + x86/speculation: Fix firmware entry SPEC_CTRL handling
      + x86/speculation: Fix SPEC_CTRL write on SMT state change
      + x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit
      + x86/speculation: Remove x86_spec_ctrl_mask
      + objtool: Re-add UNWIND_HINT_{SAVE_RESTORE}
      + KVM: VMX: Flatten __vmx_vcpu_run()
      + KVM: VMX: Convert launched argument to flags
      + KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
      + KVM: VMX: Fix IBRS handling after vmexit
      + x86/speculation: Fill RSB on vmexit for IBRS
      + x86/common: Stamp out the stepping madness
      + x86/cpu/amd: Enumerate BTC_NO
      + x86/retbleed: Add fine grained Kconfig knobs
      + x86/bugs: Add Cannon lake to RETBleed affected CPU list
      + x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
      + x86/kexec: Disable RET on kexec
      + x86/speculation: Disable RRSBA behavior
    - x86/static_call: Serialize __static_call_fixup() properly
    - tools/insn: Restore the relative include paths for cross building
    - x86, kvm: use proper ASM macros for kvm_vcpu_is_preempted
    - x86/xen: Fix initialisation in hypercall_page after rethunk
    - x86/ftrace: Add UNWIND_HINT_FUNC annotation for ftrace_stub
    - x86/asm/32: Fix ANNOTATE_UNRET_SAFE use on 32-bit
    - x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current
    - efi/x86: use naked RET on mixed mode call wrapper
    - x86/kvm: fix FASTOP_SIZE when return thunks are enabled
    - KVM: emulate: do not adjust size of fastop and setcc subroutines
    - tools arch x86: Sync the msr-index.h copy with the kernel sources
    - tools headers cpufeatures: Sync with the kernel sources
    - x86/bugs: Remove apostrophe typo
    - um: Add missing apply_returns()
    - x86: Use -mindirect-branch-cs-prefix for RETPOLINE builds
    - kvm: fix objtool relocation warning
    - objtool: Fix elf_create_undef_symbol() endianness
    - tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf
      bench mem memcpy' - again
    - tools headers: Remove broken definition of __LITTLE_ENDIAN
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.134
    - [armhf] pinctrl: stm32: fix optional IRQ support to gpios
    - lockdown: Fix kexec lockdown bypass with ima policy (CVE-2022-21505)
    - io_uring: Use original task for req identity in io_identity_cow()
    - xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE
    - docs: net: explain struct net_device lifetime
    - net: make free_netdev() more lenient with unregistering devices
    - net: make sure devices go through netdev_wait_all_refs
    - net: move net_set_todo inside rollback_registered()
    - net: inline rollback_registered()
    - net: move rollback_registered_many()
    - net: inline rollback_registered_many()
    - [amd64] PCI: hv: Fix multi-MSI to allow more than one MSI vector
    - [amd64] PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI
    - [amd64] PCI: hv: Reuse existing IRTE allocation in compose_msi_msg()
    - [amd64] PCI: hv: Fix interrupt mapping for multi-MSI
    - [arm64] serial: mvebu-uart: correctly report configured baudrate value
    - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in
      xfrm_bundle_lookup() (CVE-2022-36879)
    - perf/core: Fix data race between perf_event_set_output() and
      perf_mmap_close()
    - drm/amdgpu/display: add quirk handling for stutter mode
    - igc: Reinstate IGC_REMOVED logic and implement it properly
    - ip: Fix data-races around sysctl_ip_no_pmtu_disc.
    - ip: Fix data-races around sysctl_ip_fwd_use_pmtu.
    - ip: Fix data-races around sysctl_ip_fwd_update_priority.
    - ip: Fix data-races around sysctl_ip_nonlocal_bind.
    - ip: Fix a data-race around sysctl_ip_autobind_reuse.
    - ip: Fix a data-race around sysctl_fwmark_reflect.
    - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
    - tcp: Fix data-races around sysctl_tcp_mtu_probing.
    - tcp: Fix data-races around sysctl_tcp_base_mss.
    - tcp: Fix data-races around sysctl_tcp_min_snd_mss.
    - tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor.
    - tcp: Fix a data-race around sysctl_tcp_probe_threshold.
    - tcp: Fix a data-race around sysctl_tcp_probe_interval.
    - net: stmmac: fix unbalanced ptp clock issue in suspend/resume flow
    - net: stmmac: fix dma queue left shift overflow issue
    - igmp: Fix data-races around sysctl_igmp_llm_reports.
    - igmp: Fix a data-race around sysctl_igmp_max_memberships.
    - igmp: Fix data-races around sysctl_igmp_max_msf.
    - tcp: Fix data-races around keepalive sysctl knobs.
    - tcp: Fix data-races around sysctl_tcp_syncookies.
    - tcp: Fix data-races around sysctl_tcp_reordering.
    - tcp: Fix data-races around some timeout sysctl knobs.
    - tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
    - tcp: Fix a data-race around sysctl_tcp_tw_reuse.
    - tcp: Fix data-races around sysctl_max_syn_backlog.
    - tcp: Fix data-races around sysctl_tcp_fastopen.
    - tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout.
    - iavf: Fix handling of dummy receive descriptors
    - i40e: Fix erroneous adapter reinitialization during recovery process
    - ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero
    - [arm64,armhf] gpio: pca953x: only use single read/write for No AI mode
    - [arm64,armhf] gpio: pca953x: use the correct range when do regmap sync
    - [arm64,armhf] gpio: pca953x: use the correct register address when
      regcache sync during init
    - be2net: Fix buffer overflow in be_get_module_eeprom
    - ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.
    - ip: Fix data-races around sysctl_ip_prot_sock.
    - udp: Fix a data-race around sysctl_udp_l3mdev_accept.
    - tcp: Fix data-races around sysctl knobs related to SYN option.
    - tcp: Fix a data-race around sysctl_tcp_early_retrans.
    - tcp: Fix data-races around sysctl_tcp_recovery.
    - tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.
    - tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.
    - tcp: Fix a data-race around sysctl_tcp_retrans_collapse.
    - tcp: Fix a data-race around sysctl_tcp_stdurg.
    - tcp: Fix a data-race around sysctl_tcp_rfc1337.
    - tcp: Fix data-races around sysctl_tcp_max_reordering.
    - [arm*] spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for
      non DMA transfers
    - KVM: Don't null dereference ops->destroy
    - mm/mempolicy: fix uninit-value in mpol_rebind_policy()
    - bpf: Make sure mac_header was set before using it
    - sched/deadline: Fix BUG_ON condition for deboosted tasks
    - [x86] bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts
    - dlm: fix pending remove if msg allocation fails
    - bitfield.h: Fix "type of reg too small for mask" test
    - ALSA: memalloc: Align buffer allocations in page size
    - Bluetooth: Add bt_skb_sendmsg helper
    - Bluetooth: Add bt_skb_sendmmsg helper
    - Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg
    - Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg
    - Bluetooth: Fix passing NULL to PTR_ERR
    - Bluetooth: SCO: Fix sco_send_frame returning skb->len
    - Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks
    - [x86] amd: Use IBPB for firmware calls
    - [x86] alternative: Report missing return thunk details
    - watchqueue: make sure to serialize 'wqueue->defunct' properly
    - tty: drivers/tty/, stop using tty_schedule_flip()
    - tty: the rest, stop using tty_schedule_flip()
    - tty: drop tty_schedule_flip()
    - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
    - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
    - net: usb: ax88179_178a needs FLAG_SEND_ZLP
    - watch-queue: remove spurious double semicolon
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.135
    - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
    - Revert "ocfs2: mount shared volume without ha stack"
    - [s390x] archrandom: prevent CPACF trng invocations in interrupt context
    - watch_queue: Fix missing rcu annotation
    - watch_queue: Fix missing locking in add_watch_to_object()
    - tcp: Fix data-races around sysctl_tcp_dsack.
    - tcp: Fix a data-race around sysctl_tcp_app_win.
    - tcp: Fix a data-race around sysctl_tcp_adv_win_scale.
    - tcp: Fix a data-race around sysctl_tcp_frto.
    - tcp: Fix a data-race around sysctl_tcp_nometrics_save.
    - tcp: Fix data-races around sysctl_tcp_no_ssthresh_metrics_save.
    - ice: check (DD | EOF) bits on Rx descriptor rather than (EOP | RS)
    - ice: do not setup vlan for loopback VSI
    - Revert "tcp: change pingpong threshold to 3"
    - tcp: Fix data-races around sysctl_tcp_moderate_rcvbuf.
    - tcp: Fix a data-race around sysctl_tcp_limit_output_bytes.
    - tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit.
    - net: ping6: Fix memleak in ipv6_renew_options().
    - ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
    - igmp: Fix data-races around sysctl_igmp_qrv.
    - net: sungem_phy: Add of_node_put() for reference returned by
      of_get_parent()
    - tcp: Fix a data-race around sysctl_tcp_min_tso_segs.
    - tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen.
    - tcp: Fix a data-race around sysctl_tcp_autocorking.
    - tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit.
    - Documentation: fix sctp_wmem in ip-sysctl.rst
    - macsec: fix NULL deref in macsec_add_rxsa
    - macsec: fix error message in macsec_add_rxsa and _txsa
    - macsec: limit replay window size with XPN
    - macsec: always read MACSEC_SA_ATTR_PN as a u64
    - net: macsec: fix potential resource leak in macsec_add_rxsa() and
      macsec_add_txsa()
    - tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns.
    - tcp: Fix a data-race around sysctl_tcp_comp_sack_slack_ns.
    - tcp: Fix a data-race around sysctl_tcp_comp_sack_nr.
    - tcp: Fix data-races around sysctl_tcp_reflect_tos.
    - i40e: Fix interface init with MSI interrupts (no MSI-X)
    - sctp: fix sleep in atomic context bug in timer handlers
    - netfilter: nf_queue: do not allow packet truncation below transport header
      offset (CVE-2022-36946)
    - virtio-net: fix the race between refill work and close
    - sfc: disable softirqs for ptp TX
    - sctp: leave the err path free in sctp_stream_init to sctp_stream_free
    - page_alloc: fix invalid watermark check on a negative value
    - mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
    - [arm*] 9216/1: Fix MAX_DMA_ADDRESS overflow
    - docs/kernel-parameters: Update descriptions for "mitigations=" param with
      retbleed
    - xfs: refactor xfs_file_fsync
    - xfs: xfs_log_force_lsn isn't passed a LSN
    - xfs: prevent UAF in xfs_log_item_in_current_chkpt
    - xfs: fix log intent recovery ENOSPC shutdowns when inactivating inodes
    - xfs: force the log offline when log intent item recovery fails
    - xfs: hold buffer across unpin and potential shutdown processing
    - xfs: remove dead stale buf unpin handling code
    - xfs: logging the on disk inode LSN can make it go backwards
    - xfs: Enforce attr3 buffer recovery order
    - [x86] bugs: Do not enable IBPB at firmware entry when IBPB is not
      available
    - bpf: Consolidate shared test timing code
    - bpf: Add PROG_TEST_RUN support for sk_lookup programs
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.136
    - [x86] speculation: Make all RETbleed mitigations 64-bit only
    - ath9k_htc: fix NULL pointer dereference at ath9k_htc_rxep()
    - ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
    - tun: avoid double free in tun_free_netdev
    - [x86] ACPI: video: Force backlight native for some TongFang devices
    - [x86] ACPI: video: Shortening quirk list by identifying Clevo by
      board_name only
    - ACPI: APEI: Better fix to avoid spamming the console with old error logs
    - [arm64] crypto: arm64/poly1305 - fix a read out-of-bound
    - Bluetooth: hci_bcm: Add BCM4349B1 variant
    - Bluetooth: hci_bcm: Add DT compatible for CYW55572
    - Bluetooth: btusb: Add support of IMC Networks PID 0x3568
    - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04CA:0x4007
    - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04C5:0x1675
    - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0CB8:0xC558
    - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3587
    - Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3586
    - [x86] Add mitigations for Post-Barrier Return Stack Buffer Prediction
      (PBRSB) issue (CVE-2022-26373):
      + x86/speculation: Add RSB VM Exit protections
      + x86/speculation: Add LFENCE to RSB fill sequence

  [ Salvatore Bonaccorso ]
  * Bump ABI to 17
  * [rt] Update to 5.10.131-rt72
  * posix-cpu-timers: Cleanup CPU timers before freeing them during exec
    (CVE-2022-2585)
  * netfilter: nf_tables: do not allow SET_ID to refer to another table
    (CVE-2022-2586)
  * netfilter: nf_tables: do not allow CHAIN_ID to refer to another table
  * netfilter: nf_tables: do not allow RULE_ID to refer to another chain
  * net_sched: cls_route: remove from list when handle is 0 (CVE-2022-2588)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 13 Aug 2022 15:25:10 +0200

linux (5.10.127-2) bullseye-security; urgency=high

  * [amd64,arm64,armhf] wireguard: Clear keys after suspend despite
    CONFIG_ANDROID=y
  * netfilter: nf_tables: stricter validation of element data (CVE-2022-34918)
  * net: rose: fix UAF bugs caused by timer handler (CVE-2022-2318)
  * net: rose: fix UAF bug caused by rose_t0timer_expiry
  * xen/{blk,net}front: fix leaking data in shared pages (CVE-2022-26365,
    CVE-2022-33740)
  * xen/{blk,net}front: force data bouncing when backend is untrusted
    (CVE-2022-33741, CVE-2022-33742)
  * xen-netfront: restore __skb_queue_tail() positioning in
    xennet_get_responses() (CVE-2022-33743)
  * [arm64,armhf] xen/arm: Fix race in RB-tree based P2M accounting
    (CVE-2022-33744)
  * fbdev: fbmem: Fix logo center image dx issue
  * fbdev: Fix potential out-of-bounds writes (CVE-2021-33655):
    - fbmem: Check virtual screen sizes in fb_set_var()
    - fbcon: Disallow setting font bigger than screen size
    - fbcon: Prevent that screen size is smaller than font size

 -- Ben Hutchings <benh@debian.org>  Sun, 24 Jul 2022 00:32:10 +0200

linux (5.10.127-1) bullseye; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.121
    - ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop
    - ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS
    - ALSA: usb-audio: Cancel pending work at closing a MIDI substream
    - USB: serial: option: add Quectel BG95 modem
    - USB: new quirk for Dell Gen 2 devices
    - usb: dwc3: gadget: Move null pinter check to proper place
    - usb: core: hcd: Add support for deferring roothub registration
    - cifs: when extending a file with falloc we should make files not-sparse
    - xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI
    - Fonts: Make font size unsigned in font_desc
    - [x86] MCE/AMD: Fix memory leak when threshold_create_bank() fails
    - [w86] perf/x86/intel: Fix event constraints for ICL
    - ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
    - ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
    - btrfs: add "0x" prefix for unsupported optional features
    - btrfs: repair super block num_devices automatically
    - [amd64] iommu/vt-d: Add RPLS to quirk list to skip TE disabling
    - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
    - mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue
    - b43legacy: Fix assigning negative value to unsigned variable
    - b43: Fix assigning negative value to unsigned variable
    - ipw2x00: Fix potential NULL dereference in libipw_xmit()
    - ipv6: fix locking issues with loops over idev->addr_list
    - fbcon: Consistently protect deferred_takeover with console_lock()
    - [x86] platform/uv: Update TSC sync state for UV5
    - ACPICA: Avoid cache flush inside virtual machines
    - drm/komeda: return early if drm_universal_plane_init() fails.
    - rcu-tasks: Fix race in schedule and flush work
    - rcu: Make TASKS_RUDE_RCU select IRQ_WORK
    - sfc: ef10: Fix assigning negative value to unsigned variable
    - ALSA: jack: Access input_dev under mutex
    - spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA
      direction
    - drm/amd/pm: fix double free in si_parse_power_table()
    - ath9k: fix QCA9561 PA bias level
    - media: venus: hfi: avoid null dereference in deinit
    - media: pci: cx23885: Fix the error handling in cx23885_initdev()
    - media: cx25821: Fix the warning when removing the module
    - md/bitmap: don't set sb values if can't pass sanity check
    - mmc: jz4740: Apply DMA engine limits to maximum segment size
    - drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit
    - scsi: megaraid: Fix error check return value of register_chrdev()
    - scsi: ufs: Use pm_runtime_resume_and_get() instead of
      pm_runtime_get_sync()
    - scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()
    - ath11k: disable spectral scan during spectral deinit
    - ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408
    - drm/plane: Move range check for format_count earlier
    - drm/amd/pm: fix the compile warning
    - ath10k: skip ath10k_halt during suspend for driver state RESTARTING
    - [arm64] compat: Do not treat syscall number as ESR_ELx for a bad syscall
    - drm: msm: fix error check return value of irq_of_parse_and_map()
    - ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL
    - net/mlx5: fs, delete the FTE when there are no rules attached to it
    - ASoC: dapm: Don't fold register value changes into notifications
    - mlxsw: spectrum_dcb: Do not warn about priority changes
    - mlxsw: Treat LLDP packets as control
    - drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo
    - HID: bigben: fix slab-out-of-bounds Write in bigben_probe
    - ASoC: tscs454: Add endianness flag in snd_soc_component_driver
    - net: remove two BUG() from skb_checksum_help()
    - [s390x] preempt: disable __preempt_count_add() optimization for
      PROFILE_ALL_BRANCHES
    - perf/amd/ibs: Cascade pmu init functions' return value
    - spi: stm32-qspi: Fix wait_cmd timeout in APM mode
    - dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC
    - ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
    - ipmi:ssif: Check for NULL msg when handling events and messages
    - ipmi: Fix pr_fmt to avoid compilation issues
    - rtlwifi: Use pr_warn instead of WARN_ONCE
    - media: rga: fix possible memory leak in rga_probe
    - media: coda: limit frame interval enumeration to supported encoder frame
      sizes
    - media: imon: reorganize serialization
    - media: cec-adap.c: fix is_configuring state
    - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
    - ASoC: rt5645: Fix errorenous cleanup order
    - nbd: Fix hung on disconnect request if socket is closed before
    - net: phy: micrel: Allow probing without .driver_data
    - media: exynos4-is: Fix compile warning
    - ASoC: max98357a: remove dependency on GPIOLIB
    - ASoC: rt1015p: remove dependency on GPIOLIB
    - can: mcp251xfd: silence clang's -Wunaligned-access warning
    - [x86] microcode: Add explicit CPU vendor dependency
    - rxrpc: Return an error to sendmsg if call failed
    - rxrpc, afs: Fix selection of abort codes
    - eth: tg3: silence the GCC 12 array-bounds warning
    - gfs2: use i_lock spin_lock for inode qadata
    - IB/rdmavt: add missing locks in rvt_ruc_loopback
    - [arm64] dts: qcom: msm8994: Fix BLSP[12]_DMA channels count
    - PM / devfreq: rk3399_dmc: Disable edev on remove()
    - crypto: ccree - use fine grained DMA mapping dir
    - soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc
    - fs: jfs: fix possible NULL pointer dereference in dbFree()
    - [powerpc*] fadump: Fix fadump to work with a different endian capture
      kernel
    - fat: add ratelimit to fat*_ent_bread()
    - pinctrl: renesas: rzn1: Fix possible null-ptr-deref in
      sh_pfc_map_resources()
    - ARM: versatile: Add missing of_node_put in dcscb_init
    - ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM
    - ARM: hisi: Add missing of_node_put after of_find_compatible_node
    - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
    - tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate
    - [powerpc*] powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr
    - [powerpc*] xics: fix refcount leak in icp_opal_init()
    - [powerpc*] powernv: fix missing of_node_put in uv_init()
    - macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled
    - [powerpc*] iommu: Add missing of_node_put in iommu_init_early_dart
    - [amd64] RDMA/hfi1: Prevent panic when SDMA is disabled
    - drm: fix EDID struct for old ARM OABI format
    - dt-bindings: display: sitronix, st7735r: Fix backlight in example
    - ath11k: acquire ab->base_lock in unassign when finding the peer by addr
    - ath9k: fix ar9003_get_eepmisc
    - drm/edid: fix invalid EDID extension block filtering
    - drm/bridge: adv7511: clean up CEC adapter when probe fails
    - spi: qcom-qspi: Add minItems to interconnect-names
    - ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
    - ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
    - [x86] delay: Fix the wrong asm constraint in delay_loop()
    - drm/ingenic: Reset pixclock rate when parent clock rate changes
    - drm/mediatek: Fix mtk_cec_mask()
    - [arm*] drm/vc4: hvs: Reset muxes at probe time
    - [arm*] drm/vc4: txp: Don't set TXP_VSTART_AT_EOF
    - [arm*] drm/vc4: txp: Force alpha to be 0xff if it's disabled
    - bpf: Fix excessive memory allocation in stack_map_alloc()
    - nl80211: show SSID for P2P_GO interfaces
    - drm/komeda: Fix an undefined behavior bug in komeda_plane_add()
    - drm: mali-dp: potential dereference of null pointer
    - spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout
    - scftorture: Fix distribution of short handler delays
    - net: dsa: mt7530: 1G can also support 1000BASE-X link mode
    - NFC: NULL out the dev->rfkill to prevent UAF
    - efi: Add missing prototype for efi_capsule_setup_info
    - target: remove an incorrect unmap zeroes data deduction
    - drbd: fix duplicate array initializer
    - EDAC/dmc520: Don't print an error for each unconfigured interrupt line
    - mtd: rawnand: denali: Use managed device resources
    - HID: hid-led: fix maximum brightness for Dream Cheeky
    - HID: elan: Fix potential double free in elan_input_configured
    - drm/bridge: Fix error handling in analogix_dp_probe
    - sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq
    - spi: img-spfi: Fix pm_runtime_get_sync() error checking
    - cpufreq: Fix possible race in cpufreq online error path
    - ath9k_htc: fix potential out of bounds access with invalid
      rxstatus->rs_keyix
    - media: hantro: Empty encoder capture buffers by default
    - drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01
    - ALSA: pcm: Check for null pointer of pointer substream before
      dereferencing it
    - inotify: show inotify mask flags in proc fdinfo
    - fsnotify: fix wrong lockdep annotations
    - of: overlay: do not break notify on NOTIFY_{OK|STOP}
    - drm/msm/dpu: adjust display_v_end for eDP and DP
    - scsi: ufs: qcom: Fix ufs_qcom_resume()
    - scsi: ufs: core: Exclude UECxx from SFR dump list
    - mtd: spi-nor: core: Check written SR value in
      spi_nor_write_16bit_sr_and_check()
    - [x86] pm: Fix false positive kmemleak report in msr_build_context()
    - mtd: rawnand: cadence: fix possible null-ptr-deref in
      cadence_nand_dt_probe()
    - [x86] speculation: Add missing prototype for unpriv_ebpf_notify()
    - ASoC: rk3328: fix disabling mclk on pclk probe failure
    - perf tools: Add missing headers needed by util/data.h
    - drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory
      free during pm runtime resume
    - drm/msm/dp: stop event kernel thread when DP unbind
    - drm/msm/dp: fix error check return value of irq_of_parse_and_map()
    - drm/msm/dsi: fix error checks and return values for DSI xmit functions
    - drm/msm/hdmi: check return value after calling
      platform_get_resource_byname()
    - drm/msm/hdmi: fix error check return value of irq_of_parse_and_map()
    - drm/msm: add missing include to msm_drv.c
    - drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H
    - drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
    - perf tools: Use Python devtools for version autodetection rather than
      runtime
    - virtio_blk: fix the discard_granularity and discard_alignment queue limits
    - [x86] Fix return value of __setup handlers
    - irqchip/exiu: Fix acknowledgment of edge triggered interrupts
    - irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
    - irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value
    - [x86] mm: Cleanup the control_va_addr_alignment() __setup handler
    - [arm64] fix types in copy_highpage()
    - regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET
    - drm/msm/dp: fix event thread stuck in wait_event after kthread_stop()
    - drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is
      detected
    - drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is
      detected
    - drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
    - media: uvcvideo: Fix missing check to determine if element is found in
      list
    - iomap: iomap_write_failed fix
    - spi: spi-fsl-qspi: check return value after calling
      platform_get_resource_byname()
    - Revert "cpufreq: Fix possible race in cpufreq online error path"
    - regulator: qcom_smd: Fix up PM8950 regulator configuration
    - perf/amd/ibs: Use interrupt regs ip for stack unwinding
    - ath11k: Don't check arvif->is_started before sending management frames
    - ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe
    - ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
    - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
    - ASoC: samsung: Use dev_err_probe() helper
    - ASoC: samsung: Fix refcount leak in aries_audio_probe
    - scripts/faddr2line: Fix overlapping text section failures
    - media: aspeed: Fix an error handling path in aspeed_video_probe()
    - media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe
    - media: st-delta: Fix PM disable depth imbalance in delta_probe
    - media: exynos4-is: Change clk_disable to clk_disable_unprepare
    - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
    - media: vsp1: Fix offset calculation for plane cropping
    - Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
    - Bluetooth: Interleave with allowlist scan
    - Bluetooth: L2CAP: Rudimentary typo fixes
    - Bluetooth: LL privacy allow RPA
    - Bluetooth: use inclusive language in HCI role comments
    - Bluetooth: use inclusive language when filtering devices
    - Bluetooth: use hdev lock for accept_list and reject_list in conn req
    - nvme: set dma alignment to dword
    - lsm,selinux: pass flowi_common instead of flowi to the LSM hooks
    - sctp: read sk->sk_bound_dev_if once in sctp_rcv()
    - net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init
    - ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_*
    - media: ov7670: remove ov7670_power_off from ov7670_remove
    - media: staging: media: rkvdec: Make use of the helper function
      devm_platform_ioremap_resource()
    - media: rkvdec: h264: Fix dpb_valid implementation
    - media: rkvdec: h264: Fix bit depth wrap in pps packet
    - ext4: reject the 'commit' option on ext2 filesystems
    - drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init
    - drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
    - [x86] sev: Annotate stack change in the #VC handler
    - drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path
    - [x86] drm/i915: Fix CFI violation with show_dynamic_id()
    - thermal/drivers/bcm2711: Don't clamp temperature at zero
    - thermal/drivers/broadcom: Fix potential NULL dereference in
      sr_thermal_probe
    - thermal/drivers/core: Use a char pointer for the cooling device name
    - thermal/core: Fix memory leak in __thermal_cooling_device_register()
    - thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe
    - ASoC: wm2000: fix missing clk_disable_unprepare() on error in
      wm2000_anc_transition()
    - NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx
    - ASoC: max98090: Move check for invalid values before casting in
      max98090_put_enab_tlv()
    - net: stmmac: selftests: Use kcalloc() instead of kzalloc()
    - net: stmmac: fix out-of-bounds access in a selftest
    - hv_netvsc: Fix potential dereference of NULL pointer
    - rxrpc: Fix listen() setting the bar too high for the prealloc rings
    - rxrpc: Don't try to resend the request if we're receiving the reply
    - rxrpc: Fix overlapping ACK accounting
    - rxrpc: Don't let ack.previousPacket regress
    - rxrpc: Fix decision on when to generate an IDLE ACK
    - net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc()
    - hinic: Avoid some over memory allocation
    - net/smc: postpone sk_refcnt increment in connect()
    - arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399
    - memory: samsung: exynos5422-dmc: Avoid some over memory allocation
    - ARM: dts: suniv: F1C100: fix watchdog compatible
    - soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc
    - soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
    - PCI: cadence: Fix find_first_zero_bit() limit
    - PCI: rockchip: Fix find_first_zero_bit() limit
    - PCI: dwc: Fix setting error return on MSI DMA mapping failure
    - ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks
    - soc: qcom: llcc: Add MODULE_DEVICE_TABLE()
    - [x86] KVM: nVMX: Leave most VM-Exit info fields unmodified on failed
      VM-Entry
    - [x86] KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple
      fault
    - platform/chrome: cros_ec: fix error handling in cros_ec_register()
    - ARM: dts: imx6dl-colibri: Fix I2C pinmuxing
    - platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls
    - can: xilinx_can: mark bit timing constants as const
    - ARM: dts: stm32: Fix PHY post-reset delay on Avenger96
    - ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT
    - ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C
    - ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED
    - ARM: dts: bcm2835-rpi-b: Fix GPIO line names
    - misc: ocxl: fix possible double free in ocxl_file_register_afu
    - crypto: marvell/cesa - ECB does not IV
    - gpiolib: of: Introduce hook for missing gpio-ranges
    - pinctrl: bcm2835: implement hook for missing gpio-ranges
    - arm: mediatek: select arch timer for mt7629
    - powerpc/fadump: fix PT_LOAD segment for boot memory area
    - mfd: ipaq-micro: Fix error check return value of platform_get_irq()
    - scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()
    - firmware: arm_scmi: Fix list protocols enumeration in the base protocol
    - nvdimm: Fix firmware activation deadlock scenarios
    - nvdimm: Allow overwrite in the presence of disabled dimms
    - pinctrl: mvebu: Fix irq_of_parse_and_map() return value
    - drivers/base/node.c: fix compaction sysfs file leak
    - dax: fix cache flush on PMD-mapped pages
    - drivers/base/memory: fix an unlikely reference counting issue in
      __add_memory_block()
    - powerpc/8xx: export 'cpm_setbrg' for modules
    - pinctrl: renesas: core: Fix possible null-ptr-deref in
      sh_pfc_map_resources()
    - powerpc/idle: Fix return value of __setup() handler
    - powerpc/4xx/cpm: Fix return value of __setup() handler
    - ASoC: atmel-pdmic: Remove endianness flag on pdmic component
    - ASoC: atmel-classd: Remove endianness flag on class d component
    - proc: fix dentry/inode overinstantiating under /proc/${pid}/net
    - ipc/mqueue: use get_tree_nodev() in mqueue_get_tree()
    - PCI: imx6: Fix PERST# start-up sequence
    - tty: fix deadlock caused by calling printk() under tty_port->lock
    - crypto: sun8i-ss - rework handling of IV
    - crypto: sun8i-ss - handle zero sized sg
    - crypto: cryptd - Protect per-CPU resource by disabling BH.
    - Input: sparcspkr - fix refcount leak in bbc_beep_probe
    - PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits
    - hwrng: omap3-rom - fix using wrong clk_disable() in
      omap_rom_rng_runtime_resume()
    - [powerpc*] 64: Only WARN if __pa()/__va() called with bad addresses
    - [powerpc*] perf: Fix the threshold compare group constraint for power9
    - macintosh: via-pmu and via-cuda need RTC_LIB
    - powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
    - mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe()
    - mailbox: forward the hrtimer if not queued and under a lock
    - [amd64] RDMA/hfi1: Prevent use of lock before it is initialized
    - Input: stmfts - do not leave device disabled in stmfts_input_open
    - OPP: call of_node_put() on error path in _bandwidth_supported()
    - f2fs: fix dereference of stale list iterator after loop body
    - iommu/mediatek: Add list_del in mtk_iommu_remove
    - i2c: at91: use dma safe buffers
    - cpufreq: mediatek: add missing platform_driver_unregister() on error in
      mtk_cpufreq_driver_init
    - cpufreq: mediatek: Use module_init and add module_exit
    - cpufreq: mediatek: Unregister platform device on exit
    - [mips*] Loongson: Use hwmon_device_register_with_groups() to register
      hwmon
    - i2c: at91: Initialize dma_buf in at91_twi_xfer()
    - dmaengine: idxd: Fix the error handling path in idxd_cdev_register()
    - NFS: Do not report EINTR/ERESTARTSYS as mapping errors
    - NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS
    - NFS: Do not report flush errors in nfs_write_end()
    - NFS: Don't report errors from nfs_pageio_complete() more than once
    - NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout
    - video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
    - dmaengine: stm32-mdma: remove GISR1 register
    - dmaengine: stm32-mdma: rework interrupt handler
    - dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler()
    - iommu/amd: Increase timeout waiting for GA log enablement
    - i2c: npcm: Fix timeout calculation
    - i2c: npcm: Correct register access width
    - i2c: npcm: Handle spurious interrupts
    - i2c: rcar: fix PM ref counts in probe error paths
    - perf c2c: Use stdio interface if slang is not supported
    - perf jevents: Fix event syntax error caused by ExtSel
    - f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()
    - f2fs: fix to do sanity check on block address in f2fs_do_zero_range()
    - f2fs: fix to clear dirty inode in f2fs_evict_inode()
    - f2fs: fix deadloop in foreground GC
    - f2fs: don't need inode lock for system hidden quota
    - f2fs: fix to do sanity check on total_data_blocks
    - f2fs: fix fallocate to use file_modified to update permissions
      consistently
    - f2fs: fix to do sanity check for inline inode
    - wifi: mac80211: fix use-after-free in chanctx code
    - iwlwifi: mvm: fix assert 1F04 upon reconfig
    - fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped
      pages
    - efi: Do not import certificates from UEFI Secure Boot for T2 Macs
    - bfq: Split shared queues on move between cgroups
    - bfq: Update cgroup information before merging bio
    - bfq: Track whether bfq_group is still online
    - ext4: fix use-after-free in ext4_rename_dir_prepare
    - ext4: fix warning in ext4_handle_inode_extension
    - ext4: fix bug_on in ext4_writepages
    - ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state
    - ext4: fix bug_on in __es_tree_search
    - ext4: verify dir block before splitting it (CVE-2022-1184)
    - ext4: avoid cycles in directory h-tree (CVE-2022-1184)
    - ACPI: property: Release subnode properties with data nodes
    - tracing: Fix potential double free in create_var_ref()
    - PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299
    - PCI: qcom: Fix runtime PM imbalance on probe errors
    - PCI: qcom: Fix unbalanced PHY init on probe errors
    - mm, compaction: fast_find_migrateblock() should return pfn in the target
      zone
    - [s390x] perf: obtain sie_block from the right address
    - dlm: fix plock invalid read
    - dlm: fix missing lkb refcount handling
    - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
    - scsi: dc395x: Fix a missing check on list iterator
    - scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled
    - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
    - drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem
    - drm/nouveau/clk: Fix an incorrect NULL check on list iterator
    - drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator
    - drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX
    - [x86] drm/i915/dsi: fix VBT send packet port selection for ICL+
    - md: fix an incorrect NULL check in does_sb_need_changing
    - md: fix an incorrect NULL check in md_reload_sb
    - mtd: cfi_cmdset_0002: Move and rename
      chip_check/chip_ready/chip_good_for_write
    - mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
    - media: coda: Fix reported H264 profile
    - media: coda: Add more H264 levels for CODA960
    - [amd64] RDMA/hfi1: Fix potential integer multiplication overflow errors
    - csky: patch_text: Fixup last cpu should be master
    - irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375,
      A38x, A39x
    - irqchip: irq-xtensa-mx: fix initial IRQ affinity
    - cfg80211: declare MODULE_FIRMWARE for regulatory.db
    - mac80211: upgrade passive scan to active scan on DFS channels after beacon
      rx
    - um: chan_user: Fix winch_tramp() return value
    - um: Fix out-of-bounds read in LDT setup
    - kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
    - ftrace: Clean up hash direct_functions on register failures
    - iommu/msm: Fix an incorrect NULL check on list iterator
    - nodemask.h: fix compilation error with GCC12
    - hugetlb: fix huge_pmd_unshare address update
    - xtensa/simdisk: fix proc_read_simdisk()
    - rtl818x: Prevent using not initialized queues
    - ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control
    - carl9170: tx: fix an incorrect use of list iterator
    - stm: ltdc: fix two incorrect NULL checks on list iterator
    - bcache: improve multithreaded bch_btree_check()
    - bcache: improve multithreaded bch_sectors_dirty_init()
    - bcache: remove incremental dirty sector counting for
      bch_sectors_dirty_init()
    - bcache: avoid journal no-space deadlock by reserving 1 journal bucket
    - serial: pch: don't overwrite xmit->buf[0] by x_char
    - tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
    - gma500: fix an incorrect NULL check on list iterator
    - arm64: dts: qcom: ipq8074: fix the sleep clock frequency
    - phy: qcom-qmp: fix struct clk leak on probe errors
    - ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries
    - ARM: pxa: maybe fix gpio lookup tables
    - SMB3: EBADF/EIO errors in rename/open caused by race condition in
      smb2_compound_op
    - docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0
    - dt-bindings: gpio: altera: correct interrupt-cells
    - vdpasim: allow to enable a vq repeatedly
    - blk-iolatency: Fix inflight count imbalances and IO hangs on offline
    - coresight: core: Fix coresight device probe failure issue
    - phy: qcom-qmp: fix reset-controller leak on probe errors
    - net: ipa: fix page free in ipa_endpoint_trans_release()
    - net: ipa: fix page free in ipa_endpoint_replenish_one()
    - xfs: set inode size after creating symlink
    - xfs: sync lazy sb accounting on quiesce of read-only mounts
    - xfs: fix chown leaking delalloc quota blocks when fssetxattr fails
    - xfs: fix incorrect root dquot corruption error when switching
      group/project quota types
    - xfs: restore shutdown check in mapped write fault path
    - xfs: force log and push AIL to clear pinned inodes when aborting mount
    - xfs: consider shutdown in bmapbt cursor delete assert
    - xfs: assert in xfs_btree_del_cursor should take into account error
    - kseltest/cgroup: Make test_stress.sh work if run interactively
    - thermal/core: fix a UAF bug in __thermal_cooling_device_register()
    - thermal/core: Fix memory leak in the error path
    - bfq: Avoid merging queues with different parents
    - bfq: Drop pointless unlock-lock pair
    - bfq: Remove pointless bfq_init_rq() calls
    - bfq: Get rid of __bio_blkcg() usage
    - bfq: Make sure bfqg for which we are queueing requests is online
    - block: fix bio_clone_blkg_association() to associate with proper blkcg_gq
    - Revert "random: use static branch for crng_ready()"
    - RDMA/rxe: Generate a completion for unsupported/invalid opcode
    - [mips*] IP27: Remove incorrect `cpu_has_fpu' override
    - [mips*] IP30: Remove incorrect `cpu_has_fpu' override
    - ext4: only allow test_dummy_encryption when supported
    - md: bcache: check the return value of kzalloc() in
      detached_dev_do_request()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.122
    - pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
    - staging: greybus: codecs: fix type confusion of list iterator variable
    - iio: adc: ad7124: Remove shift from scan_type
    - tty: goldfish: Use tty_port_destroy() to destroy port
    - tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe
    - tty: n_tty: Restore EOF push handling behavior
    - tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id
      and ida_simple_get
    - usb: usbip: fix a refcount leak in stub_probe()
    - usb: usbip: add missing device lock on tweak configuration cmd
    - USB: storage: karma: fix rio_karma_init return
    - usb: musb: Fix missing of_node_put() in omap2430_probe
    - staging: fieldbus: Fix the error handling path in
      anybuss_host_common_probe()
    - pwm: lp3943: Fix duty calculation in case period was clamped
    - rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
    - usb: dwc3: pci: Fix pm_runtime_get_sync() error checking
    - misc: fastrpc: fix an incorrect NULL check on list iterator
    - firmware: stratix10-svc: fix a missing check on list iterator
    - usb: typec: mux: Check dev_set_name() return value
    - iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check
    - iio: proximity: vl53l0x: Fix return value check of
      wait_for_completion_timeout
    - iio: adc: sc27xx: fix read big scale voltage not right
    - iio: adc: sc27xx: Fine tune the scale calibration values
    - rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails
    - phy: qcom-qmp: fix pipe-clock imbalance on power-on failure
    - serial: sifive: Report actual baud base rather than fixed 115200
    - coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
    - extcon: ptn5150: Add queue work sync before driver release
    - soc: rockchip: Fix refcount leak in rockchip_grf_init
    - rtc: mt6397: check return value after calling platform_get_resource()
    - serial: meson: acquire port->lock in startup()
    - serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485
    - serial: digicolor-usart: Don't allow CS5-6
    - serial: rda-uart: Don't allow CS5-6
    - serial: txx9: Don't allow CS5-6
    - serial: sh-sci: Don't allow CS5-6
    - serial: sifive: Sanitize CSIZE and c_iflag
    - serial: st-asc: Sanitize CSIZE and correct PARENB for CS7
    - serial: stm32-usart: Correct CSIZE, bits, and parity
    - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
    - bus: ti-sysc: Fix warnings for unbind for serial
    - driver: base: fix UAF when driver_attach failed
    - driver core: fix deadlock in __device_attach
    - watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking
    - watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe
    - ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition
    - clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value
    - [s390x] crypto: fix scatterwalk_unmap() callers in AES-GCM
    - net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog
    - net: ethernet: mtk_eth_soc: out of bounds read in
      mtk_hwlro_get_fdir_entry()
    - net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks
    - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
    - modpost: fix removing numeric suffixes
    - jffs2: fix memory leak in jffs2_do_fill_super
    - ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not
      empty
    - ubi: ubi_create_volume: Fix use-after-free when volume creation failed
    - bpf: Fix probe read error in ___bpf_prog_run()
    - net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct
      smc_wr_tx_pend_priv *"
    - nfp: only report pause frame configuration for physical device
    - sfc: fix considering that all channels have TX queues
    - sfc: fix wrong tx channel offset with efx_separate_tx_channels
    - net/mlx5: Don't use already freed action pointer
    - net/mlx5: correct ECE offset in query qp output
    - net/mlx5e: Update netdev features after changing XDP state
    - net: sched: add barrier to fix packet stuck problem for lockless qdisc
    - tcp: tcp_rtx_synack() can be called from process context
    - gpio: pca953x: use the correct register address to do regcache sync
    - afs: Fix infinite loop found by xfstest generic/676
    - scsi: sd: Fix potential NULL pointer dereference
    - tipc: check attribute length for bearer name
    - driver core: Fix wait_for_device_probe() & deferred_probe_timeout
      interaction
    - perf c2c: Fix sorting in percent_rmt_hitm_cmp()
    - dmaengine: idxd: set DMA_INTERRUPT cap bit
    - mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
    - bootconfig: Make the bootconfig.o as a normal object file
    - tracing: Fix sleeping function called from invalid context on RT kernel
    - tracing: Avoid adding tracer option before update_tracer_options
    - iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe()
    - iommu/arm-smmu-v3: check return value after calling
      platform_get_resource()
    - f2fs: remove WARN_ON in f2fs_is_valid_blkaddr
    - i2c: cadence: Increase timeout per message if necessary
    - dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type
    - NFSv4: Don't hold the layoutget locks across multiple RPC calls
    - video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1
    - video: fbdev: pxa3xx-gcu: release the resources correctly in
      pxa3xx_gcu_probe/remove()
    - xprtrdma: treat all calls not a bcall when bc_serv is NULL
    - netfilter: nat: really support inet nat without l3 address
    - netfilter: nf_tables: delete flowtable hooks via transaction list
    - powerpc/kasan: Force thread size increase with KASAN
    - netfilter: nf_tables: always initialize flowtable hook list in transaction
    - ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
    - netfilter: nf_tables: release new hooks on unsupported flowtable flags
    - netfilter: nf_tables: memleak flow rule from commit path
    - netfilter: nf_tables: bail out early if hardware offload is not supported
    - xen: unexport __init-annotated xen_xlate_map_ballooned_pages()
    - af_unix: Fix a data-race in unix_dgram_peer_wake_me().
    - bpf, arm64: Clear prog->jited_len along prog->jited
    - net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list
    - net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure
    - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()
    - net: mdio: unexport __init-annotated mdio_bus_init()
    - net: xfrm: unexport __init-annotated xfrm4_protocol_init()
    - net: ipv6: unexport __init-annotated seg6_hmac_init()
    - net/mlx5: Rearm the FW tracer after each tracer event
    - net/mlx5: fs, fail conflicting actions
    - ip_gre: test csum_start instead of transport header
    - net: altera: Fix refcount leak in altera_tse_mdio_create
    - drm: imx: fix compiler warning with gcc-12
    - iio: dummy: iio_simple_dummy: check the return value of kstrdup()
    - staging: rtl8712: fix a potential memory leak in r871xu_drv_init()
    - iio: st_sensors: Add a local lock for protecting odr
    - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
    - tty: Fix a possible resource leak in icom_probe
    - drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
    - drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
    - USB: host: isp116x: check return value after calling
      platform_get_resource()
    - drivers: tty: serial: Fix deadlock in sa1100_set_termios()
    - drivers: usb: host: Fix deadlock in oxu_bus_suspend()
    - USB: hcd-pci: Fully suspend across freeze/thaw cycle
    - sysrq: do not omit current cpu when showing backtrace of all active CPUs
    - usb: dwc2: gadget: don't reset gadget's driver->bus
    - misc: rtsx: set NULL intfdata when probe fails
    - extcon: Modify extcon device to be created after driver data is set
    - clocksource/drivers/sp804: Avoid error on multiple instances
    - staging: rtl8712: fix uninit-value in usb_read8() and friends
    - staging: rtl8712: fix uninit-value in r871xu_drv_init()
    - serial: msm_serial: disable interrupts in __msm_console_write()
    - kernfs: Separate kernfs_pr_cont_buf and rename_lock.
    - watchdog: wdat_wdt: Stop watchdog when rebooting the system
    - md: protect md_unregister_thread from reentrancy
    - scsi: myrb: Fix up null pointer access on myrb_cleanup()
    - Revert "net: af_key: add check for pfkey_broadcast in function
      pfkey_process"
    - ceph: allow ceph.dir.rctime xattr to be updatable
    - drm/radeon: fix a possible null pointer dereference
    - modpost: fix undefined behavior of is_arm_mapping_symbol()
    - [x86] cpu: Elide KCSAN for cpu_has() and friends
    - jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds
    - nbd: call genl_unregister_family() first in nbd_cleanup()
    - nbd: fix race between nbd_alloc_config() and module removal
    - nbd: fix io hung while disconnecting device
    - [s390x] gmap: voluntarily schedule during key setting
    - cifs: version operations for smb20 unneeded when legacy support disabled
    - nodemask: Fix return values to be unsigned
    - vringh: Fix loop descriptors check in the indirect cases
    - scripts/gdb: change kernel config dumping method
    - ALSA: hda/conexant - Fix loopback issue with CX20632
    - ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo
      Yoga DuetITL 2021
    - cifs: return errors during session setup during reconnects
    - cifs: fix reconnect on smb3 mount types
    - ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
    - mmc: block: Fix CQE recovery reset success
    - net: phy: dp83867: retrigger SGMII AN when link change
    - nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION
    - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
    - nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION
    - ixgbe: fix bcast packets Rx on VF after promisc removal
    - ixgbe: fix unexpected VLAN Rx in promisc mode on VF
    - Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
    - drm/bridge: analogix_dp: Support PSR-exit to disable transition
    - drm/atomic: Force bridge self-refresh-exit on CRTC switch
    - [powerpc*] 32: Fix overread/overwrite of thread_struct via ptrace
      (CVE-2022-32981)
    - [powerpc*] mm: Switch obsolete dssall to .long
    - interconnect: qcom: sc7180: Drop IP0 interconnects
    - interconnect: Restore sync state by ignoring ipa-virt in provider count
    - md/raid0: Ignore RAID0 layout if the second zone has only one device
    - PCI: qcom: Fix pipe clock imbalance
    - zonefs: fix handling of explicit_open option on mount
    - dmaengine: idxd: add missing callback function to support DMA_INTERRUPT
    - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.123
    - [x86] Mitigate Processor MMIO Stale Data vulnerabilities
      (CVE-2022-21123, CVE-2022-21125, CVE-2022-21166):
      + Documentation: Add documentation for Processor MMIO Stale Data
      + x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug
      + x86/speculation: Add a common function for MD_CLEAR mitigation update
      + x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data
      + x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations
      + x86/speculation/mmio: Enable CPU Fill buffer clearing on idle
      + x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data
      + x86/speculation/srbds: Update SRBDS mitigation selection
      + x86/speculation/mmio: Reuse SRBDS mitigation for SBDS
      + KVM: x86/speculation: Disable Fill buffer clear within guests
      + x86/speculation/mmio: Print SMT warning
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.124
    - 9p: missing chunk of "fs/9p: Don't update file type when updating file
      attributes"
    - nfsd: Replace use of rwsem with errseq_t
    - bpf: Fix incorrect memory charge cost calculation in stack_map_alloc()
    - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
    - quota: Prevent memory allocation recursion while holding dq_lock
    - [armhf] ASoC: es8328: Fix event generation for deemphasis control
    - Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to
      dmi_use_low_level_irq
    - scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
    - scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology
    - scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd
      completion
    - scsi: ipr: Fix missing/incorrect resource cleanup in error case
    - scsi: pmcraid: Fix missing resource cleanup in error case
    - ALSA: hda/realtek - Add HW8326 support
    - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration
      failed
    - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
    - random: credit cpu and bootloader seeds by default
    - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE
    - pNFS: Avoid a live lock condition in pnfs_update_layout()
    - [x86] clocksource: hyper-v: unexport __init-annotated
      hv_init_clocksource()
    - i40e: Fix adding ADQ filter to TC0
    - i40e: Fix calculating the number of queue pairs
    - i40e: Fix call trace in setup_tx_descriptors
    - [x86] Drivers: hv: vmbus: Release cpu lock in error case
    - [x86] drm/i915/reset: Fix error_state_read ptr + offset use
    - nvme: use sysfs_emit instead of sprintf
    - nvme: add device name to warning in uuid_show()
    - net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg
    - [arm64] ftrace: fix branch range checks
    - [arm64] ftrace: consistently handle PLTs.
    - block: Fix handling of offline queues in blk_mq_alloc_request_hctx()
    - faddr2line: Fix overlapping text section failures, the sequel
    - [arm64,armhf] irqchip/gic-v3: Fix error handling in
      gic_populate_ppi_partitions
    - [arm64,armhf] irqchip/gic-v3: Fix refcount leak in
      gic_populate_ppi_partitions
    - i2c: designware: Use standard optional ref clock implementation
    - [x86] mei: me: add raptor lake point S DID
    - [x86] comedi: vmk80xx: fix expression for tx buffer size
    - USB: serial: option: add support for Cinterion MV31 with new baseline
    - USB: serial: io_ti: add Agilent E5805A support
    - [arm*] usb: dwc2: Fix memory leak in dwc2_hcd_init
    - serial: 8250: Store to lsr_save_flags after lsr read
    - dm mirror log: round up region bitmap size to BITS_PER_LONG
    - drm/amd/display: Cap OLED brightness per max frame-average luminance
    - ext4: fix bug_on ext4_mb_use_inode_pa
    - ext4: make variable "count" signed
    - ext4: add reserved GDT blocks check
    - [arm64] KVM: arm64: Don't read a HW interrupt pending state in user
      context
    - [x86] KVM: x86: Account a variety of miscellaneous allocations
    - [x86] KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel
      data leak
    - ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine
    - virtio-pci: Remove wrong address verification in vp_del_vqs()
    - dma-direct: don't over-decrypt memory
    - net/sched: act_police: more accurate MTU policing
    - net: openvswitch: fix misuse of the cached connection on tuple changes
    - Revert "PCI: Make pci_enable_ptm() private"
    - igc: Enable PCIe PTM
    - [arm64] clk: imx8mp: fix usb_root_clk parent
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.125
    - [s390x] mm: use non-quiescing sske for KVM switch to keyed guest
    - zonefs: fix zonefs_iomap_begin() for reads
    - usb: gadget: u_ether: fix regression in setting fixed MAC address
    - tcp: add some entropy in __inet_hash_connect()
    - tcp: use different parts of the port_offset for index and offset
      (CVE-2022-1012)
    - tcp: add small random increments to the source port (CVE-2022-1012)
    - tcp: dynamically allocate the perturb table used by source ports
      (CVE-2022-1012)
    - tcp: increase source port perturb table to 2^16 (CVE-2022-1012,
      CVE-2022-32296)
    - tcp: drop the hash_32() part from the index calculation (CVE-2022-1012)
    - serial: core: Initialize rs485 RTS polarity already on probe
    - [arm64] mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
    - io_uring: add missing item types for various requests
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.126
    - io_uring: use separate list entry for iopoll requests
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.127
    - vt: drop old FONT ioctls
    - random: schedule mix_interrupt_randomness() less often
    - random: quiet urandom warning ratelimit suppression message
    - ALSA: hda/via: Fix missing beep setup
    - ALSA: hda/conexant: Fix missing beep setup
    - ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop
    - ALSA: hda/realtek - ALC897 headset MIC no sound
    - ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly
    - ALSA: hda/realtek: Add quirk for Clevo PD70PNT
    - ALSA: hda/realtek: Add quirk for Clevo NS50PU
    - net: openvswitch: fix parsing of nw_proto for IPv6 fragments
    - btrfs: add error messages to all unrecognized mount options
    - mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing
    - [armhf] mtd: rawnand: gpmi: Fix setting busy timeout setting
    - ata: libata: add qc->flags in ata_qc_complete_template tracepoint
    - dm era: commit metadata in postsuspend after worker stops
    - dm mirror log: clear log bits up to BITS_PER_LONG boundary
    - USB: serial: option: add Telit LE910Cx 0x1250 composition
    - USB: serial: option: add Quectel EM05-G modem
    - USB: serial: option: add Quectel RM500K module support
    - [arm64] drm/msm: Fix double pm_runtime_disable() call
    - netfilter: nftables: add nft_parse_register_load() and use it
    - netfilter: nftables: add nft_parse_register_store() and use it
    - netfilter: use get_random_u32 instead of prandom
    - scsi: scsi_debug: Fix zone transition to full condition
    - [arm64] drm/msm: use for_each_sgtable_sg to iterate over scatterlist
    - bpf: Fix request_sock leak in sk lookup helpers
    - [arm64,armhf] drm/sun4i: Fix crash during suspend after component bind
      failure
    - [amd64] bpf, x86: Fix tail call count offset calculation on bpf2bpf call
    - phy: aquantia: Fix AN when higher speeds than 1G are not advertised
    - tipc: simplify the finalize work queue
    - tipc: fix use-after-free Read in tipc_named_reinit
    - igb: fix a use-after-free issue in igb_clean_tx_ring
    - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
    - net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
    - [arm64] drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf
    - [arm64] drm/msm/dp: check core_initialized before disable interrupts at
      dp_display_unbind()
    - [arm64] drm/msm/dp: fixes wrong connection state caused by failure of link
      train
    - [arm64] drm/msm/dp: deinitialize mainlink if link training failed
    - [arm64] drm/msm/dp: promote irq_hpd handle to handle link training
      correctly
    - [arm64] drm/msm/dp: fix connect/disconnect handled at irq_hpd
    - erspan: do not assume transport header is always set
    - x86/xen: Remove undefined behavior in setup_features()
    - afs: Fix dynamic root getattr
    - ice: ethtool: advertise 1000M speeds properly
    - regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips
    - igb: Make DMA faster when CPU is active on the PCIe link
    - virtio_net: fix xdp_rxq_info bug after suspend/resume
    - nvme: centralize setting the timeout in nvme_alloc_request
    - nvme: split nvme_alloc_request()
    - nvme: mark nvme_setup_passsthru() inline
    - nvme: don't check nvme_req flags for new req
    - nvme-pci: allocate nvme_command within driver pdu
    - nvme-pci: add NO APST quirk for Kioxia device
    - nvme: move the Samsung X5 quirk entry to the core quirks
    - [s390x] cpumf: Handle events cycles and instructions identical
    - iio: mma8452: fix probe fail when device tree compatible is used.
    - iio: adc: vf610: fix conversion mode sysfs node name
    - xhci: turn off port power in shutdown
    - xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI
    - xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI
    - [arm64,armhf] usb: chipidea: udc: check request status before setting
      device address
    - f2fs: attach inline_data after setting compression
    - iio:accel:bma180: rearrange iio trigger get and register
    - iio:accel:mxc4005: rearrange iio trigger get and register
    - iio: accel: mma8452: ignore the return value of reset operation
    - iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up()
    - iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value)
    - iio: adc: axp288: Override TS pin bias current for some models
    - iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client
    - [powerpc*] Enable execve syscall exit tracepoint
    - [powerpc*] rtas: Allow ibm,platform-dump RTAS call with null buffer
      address
    - [powerpc*] powernv: wire up rng during setup_arch
    - [armhf] exynos: Fix refcount leak in exynos_map_pmu
    - modpost: fix section mismatch check for exported init/exit sections
    - random: update comment from copy_to_user() -> copy_to_iter()
    - [powerpc*] pseries: wire up rng during setup_arch()

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.10.120-rt70
  * [rt] Drop "crypto: cryptd - add a lock instead
    preempt_disable/local_bh_disable" patch
  * Bump ABI to 16

  [ Ben Hutchings ]
  * random: Enable RANDOM_TRUST_BOOTLOADER. This can be reverted using the
    kernel parameter: random.trust_bootloader=off
  * [armel,armhf] crypto: Enable optimised implementations (see #922204):
    - Enable CRYPTO_SHA256_ARM, CRYPTO_SHA512_ARM as modules
    - [armhf] Enable SHA1_ARM_NEON, CRYPTO_SHA1_ARM_CE, CRYPTO_SHA2_ARM_CE,
      CRYPTO_AES_ARM_BS, CRYPTO_AES_ARM_CE, CRYPTO_GHASH_ARM_CE,
      CRYPTO_CRCT10DIF_ARM_CE, CRYPTO_CRC32_ARM_CE as modules

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 30 Jun 2022 21:31:30 +0200

linux (5.10.120-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.114
    - USB: quirks: add a Realtek card reader
    - USB: quirks: add STRING quirk for VCOM device
    - USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
    - USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader
    - USB: serial: option: add support for Cinterion MV32-WA/MV32-WB
    - USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions
    - xhci: Enable runtime PM on second Alderlake controller
    - xhci: stop polling roothubs after shutdown
    - xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms
    - iio: dac: ad5592r: Fix the missing return value.
    - iio: dac: ad5446: Fix read_raw not returning set value
    - iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on()
    - iio: imu: inv_icm42600: Fix I2C init possible nack
    - usb: misc: fix improper handling of refcount in uss720_probe()
    - [arm64,x86] usb: typec: ucsi: Fix reuse of completion structure
    - [arm64,x86] usb: typec: ucsi: Fix role swapping
    - usb: gadget: uvc: Fix crash when encoding data for usb request
    - usb: gadget: configfs: clear deactivation flag in
      configfs_composite_unbind()
    - [arm64,armhf] usb: dwc3: Try usb-role-switch first in dwc3_drd_init
    - [arm64,armhf] usb: dwc3: core: Fix tx/rx threshold settings
    - [arm64,armhf] usb: dwc3: core: Only handle soft-reset in DCTL
    - [arm64,armhf] usb: dwc3: gadget: Return proper request status
    - [arm*] usb: phy: generic: Get the vbus supply
    - [arm64,armhf] serial: imx: fix overrun interrupts in DMA mode
    - serial: 8250: Also set sticky MCR bits in console restoration
    - serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
    - [arm64,armhf] arch_topology: Do not set llc_sibling if llc_id is invalid
    - hex2bin: make the function hex_to_bin constant-time
    - hex2bin: fix access beyond string end
    - iocost: don't reset the inuse weight of under-weighted debtors
    - video: fbdev: udlfb: properly check endpoint type
    - iio:imu:bmi160: disable regulator in error path
    - USB: Fix xhci event ring dequeue pointer ERDP update issue
    - [armhf] phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe
    - [armhf] phy: samsung: exynos5250-sata: fix missing device put in probe
      error paths
    - [armhf] OMAP2+: Fix refcount leak in omap_gic_of_init
    - [armhf] bus: ti-sysc: Make omap3 gpt12 quirk handling SoC specific
    - [armhf] phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks
    - [armhf] dts: am3517-evm: Fix misc pinmuxing
    - [armhf] dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35
    - ipvs: correctly print the memory size of ip_vs_conn_tab
    - [armhf] pinctrl: stm32: Do not call stm32_gpio_get() for edge triggered
      IRQs in EOI
    - [arm64,armhf] net: dsa: Add missing of_node_put() in
      dsa_port_link_register_of
    - netfilter: nft_set_rbtree: overlap detection with element re-addition
      after deletion
    - bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt
      hook
    - [arm64,armhf] pinctrl: rockchip: fix RK3308 pinmux bits
    - tcp: md5: incorrect tcp_header_len for incoming connections
    - [armhf] pinctrl: stm32: Keep pinctrl block clock enabled when LEVEL IRQ
      requested
    - tcp: ensure to use the most recently sent skb when filling the rate sample
    - wireguard: device: check for metadata_dst with skb_valid_dst()
    - sctp: check asoc strreset_chunk in sctp_generate_reconf_event
    - [arm64] dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock
    - [arm64] net: hns3: modify the return code of hclge_get_ring_chain_from_mbx
    - [arm64] net: hns3: add validity check for message data length
    - [arm64] net: hns3: add return value for mailbox handling in PF
    - net/smc: sync err code when tcp connection was refused
    - ip_gre: Make o_seqno start from 0 in native mode
    - ip6_gre: Make o_seqno start from 0 in native mode
    - ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode
    - tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
    - tcp: make sure treq->af_specific is initialized
    - [arm64,armhf] bus: sunxi-rsb: Fix the return value of
      sunxi_rsb_device_create()
    - [arm64,armhf] clk: sunxi: sun9i-mmc: check return value after calling
      platform_get_resource()
    - [arm64] net: bcmgenet: hide status block before TX timestamping
    - net: phy: marvell10g: fix return value on error
    - bnx2x: fix napi API usage sequence
    - [arm64,armhf] net: fec: add missing of_node_put() in
      fec_enet_init_stop_mode()
    - ixgbe: ensure IPsec VF<->PF compatibility
    - tcp: fix F-RTO may not work correctly when receiving DSACK
    - [x86] ASoC: Intel: soc-acpi: correct device endpoints for max98373
    - ext4: fix bug_on in start_this_handle during umount filesystem
    - [amd64] x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
    - cifs: destage any unwritten data to the server before calling
      copychunk_write
    - [x86] drivers: net: hippi: Fix deadlock in rr_close()
    - zonefs: Fix management of open zones
    - zonefs: Clear inode information flags on inode creation
    - [x86] drm/i915: Fix SEL_FETCH_PLANE_*(PIPE_B+) register addresses
    - [armhf] net: ethernet: stmmac: fix write to sgmii_adapter_base
    - [x86] thermal: int340x: Fix attr.show callback prototype
    - [x86] cpu: Load microcode during restore_processor_state()
    - tty: n_gsm: fix restart handling via CLD command
    - tty: n_gsm: fix decoupled mux resource
    - tty: n_gsm: fix mux cleanup after unregister tty device
    - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
    - tty: n_gsm: fix malformed counter for out of frame data
    - netfilter: nft_socket: only do sk lookups when indev is available
    - tty: n_gsm: fix insufficient txframe size
    - tty: n_gsm: fix wrong DLCI release order
    - tty: n_gsm: fix missing explicit ldisc flush
    - tty: n_gsm: fix wrong command retry handling
    - tty: n_gsm: fix wrong command frame length field encoding
    - tty: n_gsm: fix reset fifo race condition
    - tty: n_gsm: fix incorrect UA handling
    - tty: n_gsm: fix software flow control handling
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.115
    - [mips*] Fix CP0 counter erratum detection for R4k CPUs
    - ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers
    - ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
    - [arm64] mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC
    - mmc: core: Set HS clock speed before sending HS CMD13
    - gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
    - [x86] KVM: x86/svm: Account for family 17h event renumberings in
      amd_pmc_perf_hw_id
    - [amd64] iommu/vt-d: Calculate mask for non-aligned flushes
    - Revert "SUNRPC: attempt AF_LOCAL connect on setup"
    - firewire: fix potential uaf in outbound_phy_packet_callback()
    - firewire: remove check of list iterator against head past the loop body
    - firewire: core: extend card->lock in fw_core_handle_bus_reset
    - net: stmmac: disable Split Header (SPH) for Intel platforms
    - genirq: Synchronize interrupt thread startup
    - ASoC: da7219: Fix change notifications for tone generator frequency
    - [s390x] dasd: fix data corruption for ESE devices
    - [s390x] dasd: prevent double format of tracks for ESE devices
    - [s390x] dasd: Fix read for ESE with blksize < 4k
    - [s390x] dasd: Fix read inconsistency for ESE DASD devices
    - can: isotp: remove re-binding of bound socket
    - nfc: replace improper check device_is_registered() in netlink related
      functions (CVE-2022-1974)
    - NFC: netlink: fix sleep in atomic bug when firmware download timeout
      (CVE-2022-1975)
    - [arm64,armhf] gpio: pca953x: fix irq_stat not updated when irq is disabled
      (irq_mask not set)
    - hwmon: (adt7470) Fix warning on module removal
    - [arm*] ASoC: dmaengine: Restore NULL prepare_slave_config() callback
    - net/mlx5e: Fix trust state reset in reload
    - net/mlx5e: Don't match double-vlan packets if cvlan is not set
    - net/mlx5e: CT: Fix queued up restore put() executing after relevant ft
      release
    - net/mlx5e: Fix the calling of update_buffer_lossy() API
    - net/mlx5: Avoid double clear or set of sync reset requested
    - NFSv4: Don't invalidate inode attributes on delegation return
    - [arm64,armhf] net: stmmac: dwmac-sun8i: add missing of_node_put() in
      sun8i_dwmac_register_mdio_mux()
    - [armhf] net: cpsw: add missing of_node_put() in cpsw_probe_dt()
    - hinic: fix bug of wq out of bound access
    - bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag
    - bnxt_en: Fix unnecessary dropping of RX packets
    - [arm64,armhf] smsc911x: allow using IRQ0
    - btrfs: always log symlinks in full mode
    - net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
    - [x86] kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
      architectural PMU
    - net/mlx5: Fix slab-out-of-bounds while reading resource dump menu
    - [x86] kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume
    - [x86] KVM: x86: Do not change ICR on write to APIC_SELF_IPI
    - [x86] KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs
    - [x86] KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is
      advertised
    - rcu: Fix callbacks processing time limit retaining cond_resched()
    - rcu: Apply callbacks processing time limit only on softirq
    - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
      (CVE-2022-0494)
    - dm: interlock pending dm_io and dm_wait_for_bios_completion
    - [arm64] PCI: aardvark: Clear all MSIs at setup
    - [arm64] PCI: aardvark: Fix reading MSI interrupt number
    - mmc: rtsx: add 74 Clocks in power on flow
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.116
    - regulator: consumer: Add missing stubs to regulator/consumer.h
    - block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
    - nfp: bpf: silence bitwise vs. logical OR warning
    - Bluetooth: Fix the creation of hdev->name
    - mm: fix missing cache flush for all tail pages of compound page
    - mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
    - mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and
      __mcopy_atomic()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.117
    - batman-adv: Don't skb_split skbuffs with frag_list
    - iwlwifi: iwl-dbg: Use del_timer_sync() before freeing
    - hwmon: (tmp401) Add OF device ID table
    - mac80211: Reset MBSSID parameters upon connection
    - net: Fix features skip in for_each_netdev_feature()
    - [arm64] net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in
      hardware when deleted
    - [arm64] net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups
    - [arm64] net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0
    - [arm64] net: mscc: ocelot: avoid corrupting hardware counters when moving
      VCAP filters
    - ipv4: drop dst in multicast routing path
    - drm/nouveau: Fix a potential theorical leak in
      nouveau_get_backlight_name()
    - netlink: do not reset transport header in netlink_recvmsg()
    - sfc: Use swap() instead of open coding it
    - net: sfc: fix memory leak due to ptp channel
    - mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
    - nfs: fix broken handling of the softreval mount option
    - dim: initialize all struct fields
    - [s390x] ctcm: fix variable dereferenced before check
    - [s390x] ctcm: fix potential memory leak
    - [s390x] lcs: fix variable dereferenced before check
    - net/sched: act_pedit: really ensure the skb is writable
    - [arm64] net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral
    - [armhf] net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down()
    - net/smc: non blocking recvmsg() return -EAGAIN when no data and
      signal_pending
    - net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
    - gfs2: Fix filesystem block deallocation for short writes
    - hwmon: (f71882fg) Fix negative temperature
    - ASoC: max98090: Reject invalid values in custom control put()
    - ASoC: max98090: Generate notifications on changes for custom control
    - ASoC: ops: Validate input values in snd_soc_put_volsw_range()
    - net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT
    - tcp: resalt the secret every 10 seconds (CVE-2022-1012)
    - firmware_loader: use kernel credentials when reading firmware
    - tty: n_gsm: fix mux activation issues in gsm_config()
    - usb: cdc-wdm: fix reading stuck on device close
    - USB: serial: pl2303: add device id for HP LM930 Display
    - USB: serial: qcserial: add support for Sierra Wireless EM7590
    - USB: serial: option: add Fibocom L610 modem
    - USB: serial: option: add Fibocom MA510 modem
    - ceph: fix setting of xattrs on async created inodes
    - drm/nouveau/tegra: Stop using iommu_present()
    - i40e: i40e_main: fix a missing check on list iterator
    - [amd64,arm64] net: atlantic: always deep reset on pm op, fixing up my null
      deref regression
    - cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
    - [x86] drm/vmwgfx: Initialize drm_mode_fb_cmd2
    - SUNRPC: Clean up scheduling of autoclose
    - SUNRPC: Prevent immediate close+reconnect
    - SUNRPC: Don't call connect() more than once on a TCP socket
    - SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
      (CVE-2022-28893)
    - net: phy: Fix race condition on link status change
    - [arm*] arm[64]/memremap: don't abuse pfn_valid() to ensure presence of
      linear map
    - ping: fix address binding wrt vrf
    - usb: gadget: uvc: rename function to be more consistent
    - usb: gadget: uvc: allow for application to cleanly shutdown
    - io_uring: always use original task when preparing req identity
      (CVE-2022-1786)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.118
    - io_uring: always grab file table for deferred statx
    - floppy: use a statically allocated error counter
    - [x86] Revert "drm/i915/opregion: check port number bounds for SWSCI
      display power state"
    - igc: Remove _I_PHY_ID checking
    - igc: Remove phy->type checking
    - igc: Update I226_K device ID
    - rtc: fix use-after-free on device removal
    - [arm64] rtc: pcf2127: fix bug when reading alarm registers
    - Input: add bounds checking to input_set_capability()
    - nvme-pci: add quirks for Samsung X5 SSDs
    - gfs2: Disable page faults during lockless buffered reads
    - [arm64,armhf] rtc: sun6i: Fix time overflow handling
    - [armhf] crypto: stm32 - fix reference leak in stm32_crc_remove
    - [amd64] crypto: x86/chacha20 - Avoid spurious jumps to other functions
    - ALSA: hda/realtek: Enable headset mic on Lenovo P360
    - [s390x] pci: improve zpci_dev reference counting
    - nvme-multipath: fix hang when disk goes live over reconnect
    - rtc: mc146818-lib: Fix the AltCentury for AMD platforms
    - fs: fix an infinite loop in iomap_fiemap
    - drbd: remove usage of list iterator variable after loop
    - [arm64] platform/chrome: cros_ec_debugfs: detach log reader wq from devm
    - [armel,armhf] 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in
      unwind_frame()
    - nilfs2: fix lockdep warnings in page operations for btree nodes
    - nilfs2: fix lockdep warnings during disk space reclamation
    - Revert "swiotlb: fix info leak with DMA_FROM_DEVICE"
    - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
      (CVE-2022-0854)
    - ALSA: usb-audio: Restore Rane SL-1 quirk
    - [i386] ALSA: wavefront: Proper check of get_user() error
    - ALSA: hda/realtek: Add quirk for TongFang devices with pop noise
    - perf: Fix sys_perf_event_open() race against self (CVE-2022-1729)
    - selinux: fix bad cleanup on error in hashtab_duplicate()
    - Fix double fget() in vhost_net_set_backend()
    - PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold
    - [x86] KVM: x86/mmu: Update number of zapped pages even if page list is
      stable
    - [arm64] paravirt: Use RCU read locks to guard stolen_time
    - [arm64] mte: Ensure the cleared tags are visible before setting the PTE
    - [arm64] crypto: qcom-rng - fix infinite loop on requests not multiple of
      WORD_SZ
    - libceph: fix potential use-after-free on linger ping and resends
    - drm/dp/mst: fix a possible memory leak in fetch_monitor_name()
    - dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace
    - [armhf] pinctrl: pinctrl-aspeed-g6: remove FWQSPID group in pinctrl
    - [arm64] net: macb: Increment rx bd head after allocating skb and buffer
    - net: evaluate net.ipvX.conf.all.disable_policy and disable_xfrm
    - xfrm: Add possibility to set the default to block if we have no policy
    - net: xfrm: fix shift-out-of-bounce
    - xfrm: make user policy API complete
    - xfrm: notify default policy on update
    - xfrm: fix dflt policy check when there is no policy configured
    - xfrm: rework default policy structure
    - xfrm: fix "disable_policy" flag use when arriving from different devices
    - net/sched: act_pedit: sanitize shift argument before usage
    - [x86] net: vmxnet3: fix possible use-after-free bugs in
      vmxnet3_rq_alloc_rx_buf()
    - [x86] net: vmxnet3: fix possible NULL pointer dereference in
      vmxnet3_rq_cleanup()
    - ice: fix possible under reporting of ethtool Tx and Rx statistics
    - net/qla3xxx: Fix a test in ql_reset_work()
    - net/mlx5e: Properly block LRO when XDP is enabled
    - net: af_key: add check for pfkey_broadcast in function pfkey_process
    - [armhf] 9196/1: spectre-bhb: enable for Cortex-A15
    - [armel,armhf] 9197/1: spectre-bhb: fix loop8 sequence for Thumb2
    - igb: skip phy status check where unavailable
    - net: bridge: Clear offload_fwd_mark when passing frame up bridge
      interface.
    - [arm*] gpio: mvebu/pwm: Refuse requests with inverted polarity
    - scsi: qla2xxx: Fix missed DMA unmap for aborted commands
    - mac80211: fix rx reordering with non explicit / psmp ack policy
    - nl80211: validate S1G channel width
    - nl80211: fix locking in nl80211_set_tx_bitrate_mask()
    - ethernet: tulip: fix missing pci_disable_device() on error in
      tulip_init_one()
    - [amd64,arm64] net: atlantic: fix "frag[0] not initialized"
    - [amd64,arm64] net: atlantic: reduce scope of is_rsc_complete
    - [amd64,arm64] net: atlantic: add check for MAX_SKB_FRAGS
    - [amd64,arm64] net: atlantic: verify hw_head_ lies within TX buffer ring
    - [arm64] Enable repeat tlbi workaround on KRYO4XX gold CPUs
    - dt-bindings: pinctrl: aspeed-g6: remove FWQSPID group
    - afs: Fix afs_getattr() to refetch file status if callback break occurred
    - include/uapi/linux/xfrm.h: Fix XFRM_MSG_MAPPING ABI breakage
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.119
    - lockdown: also lock down previous kgdb use (CVE-2022-21499)
    - staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
    - [x86] KVM: x86: Properly handle APF vs disabled LAPIC situation
    - [x86] KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID
      (CVE-2022-1789)
    - tcp: change source port randomizarion at connect() time
    - secure_seq: use the 64 bits of the siphash for port offset calculation
      (CVE-2022-1012)
    - ACPI: sysfs: Make sparse happy about address space in use
    - ACPI: sysfs: Fix BERT error region memory mapping
    - random: avoid arch_get_random_seed_long() when collecting IRQ randomness
    - random: remove dead code left over from blocking pool
    - MAINTAINERS: co-maintain random.c
    - MAINTAINERS: add git tree for random.c
    - crypto: lib/blake2s - Move selftest prototype into header file
    - crypto: blake2s - define shash_alg structs using macros
    - [amd64] crypto: x86/blake2s - define shash_alg structs using macros
    - crypto: blake2s - remove unneeded includes
    - crypto: blake2s - move update and final logic to internal/blake2s.h
    - crypto: blake2s - share the "shash" API boilerplate code
    - crypto: blake2s - optimize blake2s initialization
    - crypto: blake2s - add comment for blake2s_state fields
    - crypto: blake2s - adjust include guard naming
    - crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h>
    - lib/crypto: blake2s: include as built-in
    - lib/crypto: blake2s: move hmac construction into wireguard
    - lib/crypto: sha1: re-roll loops to reduce code size
    - lib/crypto: blake2s: avoid indirect calls to compression function for
      Clang CFI
    - random: document add_hwgenerator_randomness() with other input functions
    - random: remove unused irq_flags argument from add_interrupt_randomness()
    - random: use BLAKE2s instead of SHA1 in extraction
    - random: do not sign extend bytes for rotation when mixing
    - random: do not re-init if crng_reseed completes before primary init
    - random: mix bootloader randomness into pool
    - random: harmonize "crng init done" messages
    - random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs
    - random: early initialization of ChaCha constants
    - random: avoid superfluous call to RDRAND in CRNG extraction
    - random: don't reset crng_init_cnt on urandom_read()
    - random: fix typo in comments
    - random: cleanup poolinfo abstraction
    - random: cleanup integer types
    - random: remove incomplete last_data logic
    - random: remove unused extract_entropy() reserved argument
    - random: rather than entropy_store abstraction, use global
    - random: remove unused OUTPUT_POOL constants
    - random: de-duplicate INPUT_POOL constants
    - random: prepend remaining pool constants with POOL_
    - random: cleanup fractional entropy shift constants
    - random: access input_pool_data directly rather than through pointer
    - random: selectively clang-format where it makes sense
    - random: simplify arithmetic function flow in account()
    - random: continually use hwgenerator randomness
    - random: access primary_pool directly rather than through pointer
    - random: only call crng_finalize_init() for primary_crng
    - random: use computational hash for entropy extraction
    - random: simplify entropy debiting
    - random: use linear min-entropy accumulation crediting
    - random: always wake up entropy writers after extraction
    - random: make credit_entropy_bits() always safe
    - random: remove use_input_pool parameter from crng_reseed()
    - random: remove batched entropy locking
    - random: fix locking in crng_fast_load()
    - random: use RDSEED instead of RDRAND in entropy extraction
    - random: get rid of secondary crngs
    - random: inline leaves of rand_initialize()
    - random: ensure early RDSEED goes through mixer on init
    - random: do not xor RDRAND when writing into /dev/random
    - random: absorb fast pool into input pool after fast load
    - random: use simpler fast key erasure flow on per-cpu keys
    - random: use hash function for crng_slow_load()
    - random: make more consistent use of integer types
    - random: remove outdated INT_MAX >> 6 check in urandom_read()
    - random: zero buffer after reading entropy from userspace
    - random: fix locking for crng_init in crng_reseed()
    - random: tie batched entropy generation to base_crng generation
    - random: remove ifdef'd out interrupt bench
    - random: remove unused tracepoints
    - random: add proper SPDX header
    - random: deobfuscate irq u32/u64 contributions
    - random: introduce drain_entropy() helper to declutter crng_reseed()
    - random: remove useless header comment
    - random: remove whitespace and reorder includes
    - random: group initialization wait functions
    - random: group crng functions
    - random: group entropy extraction functions
    - random: group entropy collection functions
    - random: group userspace read/write functions
    - random: group sysctl functions
    - random: rewrite header introductory comment
    - random: defer fast pool mixing to worker
    - random: do not take pool spinlock at boot
    - random: unify early init crng load accounting
    - random: check for crng_init == 0 in add_device_randomness()
    - random: pull add_hwgenerator_randomness() declaration into random.h
    - random: clear fast pool, crng, and batches in cpuhp bring up
    - random: round-robin registers as ulong, not u32
    - random: only wake up writers after zap if threshold was passed
    - random: cleanup UUID handling
    - random: unify cycles_t and jiffies usage and types
    - random: do crng pre-init loading in worker rather than irq
    - random: give sysctl_random_min_urandom_seed a more sensible value
    - random: don't let 644 read-only sysctls be written to
    - random: replace custom notifier chain with standard one
    - random: use SipHash as interrupt entropy accumulator
    - random: make consistent usage of crng_ready()
    - random: reseed more often immediately after booting
    - random: check for signal and try earlier when generating entropy
    - random: skip fast_init if hwrng provides large chunk of entropy
    - random: treat bootloader trust toggle the same way as cpu trust toggle
    - random: re-add removed comment about get_random_{u32,u64} reseeding
    - random: mix build-time latent entropy into pool at init
    - random: do not split fast init input in add_hwgenerator_randomness()
    - random: do not allow user to keep crng key around on stack
    - random: check for signal_pending() outside of need_resched() check
    - random: check for signals every PAGE_SIZE chunk of /dev/[u]random
    - random: allow partial reads if later user copies fail
    - random: make random_get_entropy() return an unsigned long
    - random: document crng_fast_key_erasure() destination possibility
    - random: fix sysctl documentation nits
    - init: call time_init() before rand_initialize()
    - [s390x] define get_cycles macro for arch-override
    - [powerpc*] define get_cycles macro for arch-override
    - timekeeping: Add raw clock fallback for random_get_entropy()
    - [mips*] use fallback for random_get_entropy() instead of just c0 random
    - [arm*] use fallback for random_get_entropy() instead of zero
    - [x86] tsc: Use fallback for random_get_entropy() instead of zero
    - random: insist on random_get_entropy() existing in order to simplify
    - random: do not use batches when !crng_ready()
    - random: use first 128 bits of input as fast init
    - random: do not pretend to handle premature next security model
    - random: order timer entropy functions below interrupt functions
    - random: do not use input pool from hard IRQs
    - random: help compiler out with fast_mix() by using simpler arguments
    - siphash: use one source of truth for siphash permutations
    - random: use symbolic constants for crng_init states
    - random: avoid initializing twice in credit race
    - random: move initialization out of reseeding hot path
    - random: remove ratelimiting for in-kernel unseeded randomness
    - random: use proper jiffies comparison macro
    - random: handle latent entropy and command line from random_init()
    - random: credit architectural init the exact amount
    - random: use static branch for crng_ready()
    - random: remove extern from functions in header
    - random: use proper return types on get_random_{int,long}_wait()
    - random: make consistent use of buf and len
    - random: move initialization functions out of hot pages
    - random: move randomize_page() into mm where it belongs
    - random: unify batched entropy implementations
    - random: convert to using fops->read_iter()
    - random: convert to using fops->write_iter()
    - random: wire up fops->splice_{read,write}_iter()
    - random: check for signals after page of pool writes
    - ALSA: ctxfi: Add SB046x PCI ID
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.120
    - percpu_ref_init(): clean ->percpu_count_ref on failure
    - net: af_key: check encryption module availability consistency
    - nfc: pn533: Fix buggy cleanup order
    - [armhf] net: ftgmac100: Disable hardware checksum on AST2600
    - [x86] i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
    - [arm64] drivers: i2c: thunderx: Allow driver to work with ACPI defined
      TWSI controllers
    - netfilter: nf_tables: disallow non-stateful expression in sets earlier
      (CVE-2022-1966)
    - pipe: make poll_usage boolean and annotate its access
    - pipe: Fix missing lock in pipe_resize_ring() (ZDI-CAN-17291)
    - cfg80211: set custom regdomain after wiphy registration
    - assoc_array: Fix BUG_ON during garbage collect
    - io_uring: don't re-import iovecs from callbacks
    - io_uring: fix using under-expanded iters
    - xfs: detect overflows in bmbt records
    - xfs: show the proper user quota options
    - xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks
    - xfs: fix an ABBA deadlock in xfs_rename
    - xfs: Fix CIL throttle hang when CIL space used going backwards
    - exfat: check if cluster num is valid
    - crypto: drbg - prepare for more fine-grained tracking of seeding state
    - crypto: drbg - track whether DRBG was seeded with !rng_is_initialized()
    - crypto: drbg - move dynamic ->reseed_threshold adjustments to
      __drbg_seed()
    - crypto: drbg - make reseeding from get_random_bytes() synchronous
    - netfilter: nf_tables: sanitize nft_set_desc_concat_parse() (CVE-2022-1972)
    - netfilter: conntrack: re-fetch conntrack after insertion
    - [x86] kvm: Alloc dummy async #PF token outside of raw spinlock
    - [x86] kvm: use correct GFP flags for preemption disabled
    - [x86] KVM: x86: avoid calling x86 emulator without a decoded instruction
      (CVE-2022-1852)
    - [arm64] crypto: caam - fix i.MX6SX entropy delay value
    - crypto: ecrdsa - Fix incorrect use of vli_cmp
    - zsmalloc: fix races between asynchronous zspage free and page migration
    - Bluetooth: hci_qca: Use del_timer_sync() before freeing
    - dm integrity: fix error code in dm_integrity_ctr()
    - dm crypt: make printing of the key constant-time
    - dm stats: add cond_resched when looping over entries
    - dm verity: set DM_TARGET_IMMUTABLE feature flag
    - raid5: introduce MD_BROKEN
    - HID: multitouch: Add support for Google Whiskers Touchpad
    - HID: multitouch: add quirks to enable Lenovo X12 trackpoint
    - tpm: Fix buffer access in tpm2_get_tpm_pt()
    - docs: submitting-patches: Fix crossref to 'The canonical patch format'
    - NFS: Memory allocation failures are not server fatal errors
    - NFSD: Fix possible sleep during nfsd4_release_lockowner()
    - bpf: Fix potential array overflow in bpf_trampoline_get_progs()
    - bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.10.115-rt67
  * Bump ABI to 15
  * [rt] Drop "random: Make it work on rt"

  [ Mateusz Łukasik ]
  * [armhf] drivers/thermal: Enable SUN8I_THERMAL as module (Closes: #1007799)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 09 Jun 2022 23:37:36 +0200

linux (5.10.113-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.107
    - Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0"
      (Closes: #1008299)
    - xfrm: Check if_id in xfrm_migrate
    - xfrm: Fix xfrm migrate issues when address family changes
    - mac80211: refuse aggregations sessions before authorized
    - [mips64el,mipsel] smp: fill in sibling and core maps earlier
    - [x86] atm: firestream: check the return value of ioremap() in fs_init()
    - iwlwifi: don't advertise TWT support
    - drm/vrr: Set VRR capable prop only if it is attached to connector
    - nl80211: Update bss channel on channel switch for P2P_CLIENT
    - sfc: extend the locking on mcdi->seqno
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.108
    - [arm64] crypto: qcom-rng - ensure buffer for generate is completely filled
    - ocfs2: fix crash when initialize filecheck kobj fails
    - mm: swap: get rid of livelock in swapin readahead
    - efi: fix return value of __setup handlers
    - vsock: each transport cycles only on its own sockets
    - esp6: fix check on ipv6_skip_exthdr's return value
    - net: phy: marvell: Fix invalid comparison in the resume and suspend
      functions
    - net/packet: fix slab-out-of-bounds access in packet_recvmsg()
    - atm: eni: Add check for dma_map_single
    - [x86] hv_netvsc: Add check for kvmalloc_array
    - [armhf] drm/imx: parallel-display: Remove bus flags check in
      imx_pd_bridge_atomic_check()
    - [arm64,armhf] drm/panel: simple: Fix Innolux G070Y2-L01 BPP settings
    - net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
    - [arm64,armhf] net: dsa: Add missing of_node_put() in dsa_port_parse_of
    - net: phy: mscc: Add MODULE_FIRMWARE macros
    - bnx2x: fix built-in kernel driver load failure
    - [arm64] net: bcmgenet: skip invalid partial checksums
    - [arm64] net: mscc: ocelot: fix backwards compatibility with single-chain
      tc-flower offload
    - usb: gadget: rndis: prevent integer overflow in rndis_set_response()
    - usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
    - usb: usbtmc: Fix bug in pipe direction for control transfers
    - scsi: mpt3sas: Page fault in reply q processing
    - Input: aiptek - properly check endpoint type
    - perf symbols: Fix symbol size calculation condition
    - net: usb: Correct PHY handling of smsc95xx
    - net: usb: Correct reset handling of smsc95xx
    - smsc95xx: Ignore -ENODEV errors when device is unplugged
    - esp: Fix possible buffer overflow in ESP transformation (CVE-2022-27666)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.109
    - nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
      (CVE-2022-26490)
    - net: ipv6: fix skb_over_panic in __ip6_append_data
    - exfat: avoid incorrectly releasing for root inode
    - cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
      (CVE-2021-4197)
    - cgroup: Use open-time cgroup namespace for process migration perm checks
      (CVE-2021-4197)
    - cgroup-v1: Correct privileges check in release_agent writes
    - tpm: Fix error handling in async work
    - llc: fix netdevice reference leaks in llc_ui_bind() (CVE-2022-28356)
    - ALSA: oss: Fix PCM OSS buffer allocation overflow
    - ALSA: hda/realtek: Add quirk for Clevo NP70PNJ
    - ALSA: hda/realtek: Add quirk for Clevo NP50PNJ
    - ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671
    - ALSA: hda/realtek: Add quirk for ASUS GA402
    - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
      (CVE-2022-1048)
    - ALSA: pcm: Fix races among concurrent read/write and buffer changes
      (CVE-2022-1048)
    - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
      (CVE-2022-1048)
    - ALSA: pcm: Fix races among concurrent prealloc proc writes (CVE-2022-1048)
    - ALSA: pcm: Add stream lock during PCM reset ioctl operations
    - ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB
    - ALSA: cmipci: Restore aux vol on suspend/resume
    - ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
    - [arm64] drivers: net: xgene: Fix regression in CRC stripping
    - netfilter: nf_tables: initialize registers in nft_do_chain()
      (CVE-2022-1016)
    - [x86] ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board
    - ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3
    - [x86] ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU
    - [x86] crypto: qat - disable registration of algorithms
    - Revert "ath: add support for special 0x0 regulatory domain"
    - rcu: Don't deboost before reporting expedited quiescent state
    - mac80211: fix potential double free on mesh join
    - tpm: use try_get_ops() in tpm-space.c
    - [arm64] wcn36xx: Differentiate wcn3660 from wcn3620
    - llc: only change llc->dev when bind() succeeds
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.110
    - swiotlb: fix info leak with DMA_FROM_DEVICE (CVE-2022-0854)
    - USB: serial: pl2303: add IBM device IDs
    - USB: serial: simple: add Nokia phone driver
    - netdevice: add the case if dev is NULL
    - HID: logitech-dj: add new lightspeed receiver id
    - xfrm: fix tunnel model fragmentation behavior
    - virtio_console: break out of buf poll on remove
    - ethernet: sun: Free the coherent when failing in probing
    - gpio: Revert regression in sysfs-gpio (gpiolib.c)
    - spi: Fix invalid sgs value
    - Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"
    - spi: Fix erroneous sgs value with min_t()
    - af_key: add __GFP_ZERO flag for compose_sadb_supported in function
      pfkey_register (CVE-2022-1353)
    - [arm*] iommu/iova: Improve 32-bit free space estimate
    - tpm: fix reference counting for struct tpm_chip
    - virtio-blk: Use blk_validate_block_size() to validate block size
    - USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
    - xhci: fix garbage USBSTS being logged in some cases
    - xhci: fix runtime PM imbalance in USB2 resume
    - xhci: make xhci_handshake timeout for xhci_reset() adjustable
    - xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx()
    - [x86] mei: me: add Alder Lake N device id.
    - [x86] mei: avoid iterator usage outside of list_for_each_entry
    - iio: inkern: apply consumer scale on IIO_VAL_INT cases
    - iio: inkern: apply consumer scale when no channel scale is available
    - iio: inkern: make a best effort on offset calculation
    - ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
    - KEYS: fix length validation in keyctl_pkey_params_get_2()
    - Documentation: add link to stable release candidate tree
    - Documentation: update stable tree link
    - firmware: stratix10-svc: add missing callback parameter on RSU
    - SUNRPC: avoid race between mod_timer() and del_timer_sync()
    - NFSD: prevent underflow in nfssvc_decode_writeargs()
    - NFSD: prevent integer overflow on 32 bit systems
    - f2fs: fix to unlock page correctly in error path of is_alive()
    - f2fs: quota: fix loop condition at f2fs_quota_sync()
    - f2fs: fix to do sanity check on .cp_pack_total_block_count
    - [armhf] remoteproc: Fix count check in rproc_coredump_write()
    - [armhf] pinctrl: samsung: drop pin banks references on error paths
    - mtd: rawnand: protect access to rawnand devices while in suspend
    - can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error
      path (CVE-2022-28390)
    - jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
    - jffs2: fix memory leak in jffs2_do_mount_fs
    - jffs2: fix memory leak in jffs2_scan_medium
    - mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
    - mm: invalidate hwpoison page cache page in fault path
    - mempolicy: mbind_range() set_policy() after vma_merge()
    - scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
    - qed: display VF trust config
    - qed: validate and restrict untrusted VFs vlan promisc mode
    - Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
    - cifs: prevent bad output lengths in smb2_ioctl_query_info()
    - cifs: fix NULL ptr dereference in smb2_ioctl_query_info()
      (CVE-2022-0168)
    - [i386] ALSA: cs4236: fix an incorrect NULL check on list iterator
    - ALSA: hda: Avoid unsol event during RPM suspending
    - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
    - ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020
    - mm: madvise: skip unmapped vma holes passed to process_madvise
    - mm: madvise: return correct bytes advised with process_madvise
    - Revert "mm: madvise: skip unmapped vma holes passed to process_madvise"
    - mm,hwpoison: unmap poisoned page before invalidation
    - dm integrity: set journal entry unused when shrinking device
    - drbd: fix potential silent data corruption
    - can: isotp: sanitize CAN ID checks in isotp_bind()
    - [powerpc*] kvm: Fix kvm_use_magic_page
    - udp: call udp_encap_enable for v6 sockets when enabling encap
    - [arm64] signal: nofpsimd: Do not allocate fp/simd context when not
      available
    - ACPI: properties: Consistently return -ENOENT if there are no more
      references
    - coredump: Also dump first pages of non-executable ELF libraries
    - ext4: fix ext4_fc_stats trace point
    - ext4: fix fs corruption when tring to remove a non-empty directory with IO
      error
    - drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
      (CVE-2022-1198)
    - block: limit request dispatch loop duration
    - block: don't merge across cgroup boundaries if blkcg is enabled
    - drm/edid: check basic audio support on CEA extension block
    - [armhf] dts: exynos: add missing HDMI supplies on SMDK5250
    - [armhf] dts: exynos: add missing HDMI supplies on SMDK5420
    - [x86] mgag200 fix memmapsl configuration in GCTL6 register
    - carl9170: fix missing bit-wise or operator for tx_params
    - pstore: Don't use semaphores in always-atomic-context code
    - [x86] thermal: int340x: Increase bitmap size
    - exec: Force single empty string when argv is empty
    - crypto: rsa-pkcs1pad - only allow with rsa
    - crypto: rsa-pkcs1pad - correctly get hash from source scatterlist
    - crypto: rsa-pkcs1pad - restore signature length check
    - crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete()
    - bcache: fixup multiple threads crash
    - DEC: Limit PMAX memory probing to R3k systems
    - brcmfmac: firmware: Allocate space for default boardrev in nvram
    - brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path
    - brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
    - brcmfmac: pcie: Fix crashes due to early IRQs
    - [x86] drm/i915/opregion: check port number bounds for SWSCI display power
      state
    - [x86] drm/i915/gem: add missing boundary check in vm_access
    - PCI: pciehp: Clear cmd_busy bit in polling mode
    - [arm64] PCI: xgene: Revert "PCI: xgene: Fix IB window setup"
    - [arm64] regulator: qcom_smd: fix for_each_child.cocci warnings
    - selinux: check return value of sel_make_avc_files
    - [arm64] hwrng: cavium - Check health status while reading random data
    - [arm64] hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER
    - crypto: authenc - Fix sleep in atomic context in decrypt_tail
    - [x86] thermal: int340x: Check for NULL after calling kmemdup()
    - [arm64,armhf] spi: tegra114: Add missing IRQ check in tegra_spi_probe
    - [arm64] mm: avoid fixmap race condition when create pud mapping
    - audit: log AUDIT_TIME_* records only from rules
    - spi: pxa2xx-pci: Balance reference count for PCI DMA device
    - [armhf] hwmon: (pmbus) Add mutex to regulator ops
    - hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
    - nvme: cleanup __nvme_check_ids
    - block: don't delete queue kobject before its children
    - PM: hibernate: fix __setup handler error handling
    - PM: suspend: fix return value of __setup handler
    - [arm64] crypto: sun8i-ce - call finalize with bh disabled
    - [arm64,armhf] crypto: amlogic - call finalize with bh disabled
    - [armhf] clocksource/drivers/timer-ti-dm: Fix regression from errata i940
      fix
    - [armhf] clocksource/drivers/exynos_mct: Refactor resources allocation
    - [armhf] clocksource/drivers/exynos_mct: Handle DTS with higher number of
      interrupts
    - clocksource/drivers/timer-of: Check return value of of_iomap in
      timer_of_base_init()
    - ACPI: APEI: fix return value of __setup handlers
    - [x86] crypto: ccp - ccp_dmaengine_unregister release dma channels
    - [arm*] amba: Make the remove callback return void
    - [armhf] hwmon: (pmbus) Add Vin unit off handling
    - [x86] clocksource: acpi_pm: fix return value of __setup handler
    - io_uring: terminate manual loop iterator loop correctly for non-vecs
    - watch_queue: Fix NULL dereference in error cleanup
    - watch_queue: Actually free the watch
    - f2fs: fix to enable ATGC correctly via gc_idle sysfs interface
    - sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
    - sched/core: Export pelt_thermal_tp
    - rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs()
    - rseq: Remove broken uapi field layout on 32-bit little endian
    - perf/core: Fix address filter parser for multiple filters
    - [x86] perf/x86/intel/pt: Fix address filter config for 32-bit kernel
    - f2fs: fix missing free nid in f2fs_handle_failed_inode
    - nfsd: more robust allocation failure handling in nfsd_file_cache_init
    - f2fs: fix to avoid potential deadlock
    - btrfs: fix unexpected error path when reflinking an inline extent
    - f2fs: compress: remove unneeded read when rewrite whole cluster
    - f2fs: fix compressed file start atomic write may cause data corruption
    - [arm64,armhf] media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP
      buffers across ioctls
    - media: bttv: fix WARNING regression on tunerless devices
    - [arm*] ASoC: generic: simple-card-utils: remove useless assignment
    - [armhf] media: coda: Fix missing put_device() call in coda_get_vdoa_data
    - [armhf] media: aspeed: Correct value for h-total-pixels
    - video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to
      avoid black screen
    - video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
    - video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
    - [arm64] firmware: qcom: scm: Remove reassignment to desc following
      initializer
    - firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is
      not defined
    - [armhf] dts: imx: Add missing LVDS decoder on M53Menlo
    - media: em28xx: initialize refcount before kref_get
    - media: usb: go7007: s2250-board: fix leak in probe()
    - [arm64,armhf] media: cedrus: H265: Fix neighbour info buffer size
    - [arm64,armhf] media: cedrus: h264: Fix neighbour info buffer size
    - [x86] ASoC: rt5663: check the return value of devm_kzalloc() in
      rt5663_parse_dp()
    - printk: fix return value of printk.devkmsg __setup handler
    - [x86] ASoC: soc-compress: prevent the potentially use of null pointer
    - [armhf] memory: emif: Add check for setup_interrupts
    - [armhf] memory: emif: check the pointer temp in get_device_details()
    - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
    - [arm64] dts: rockchip: Fix SDIO regulator supply properties on
      rk3399-firefly
    - media: stk1160: If start stream fails, return buffers with
      VB2_BUF_STATE_QUEUED
    - media: saa7134: convert list_for_each to entry variant
    - media: saa7134: fix incorrect use to determine if list is empty
    - ivtv: fix incorrect device_caps for ivtvfb
    - [arm64,armhf] ASoC: rockchip: i2s: Use
      devm_platform_get_and_ioremap_resource()
    - [arm64,armhf] ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in
      rockchip_i2s_probe
    - ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
    - [armhf] ASoC: fsl_spdif: Disable TX clock when stop
    - [armhf] ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
    - [arm64] drm/meson: osd_afbcd: Add an exit callback to struct
      meson_afbcd_ops
    - [arm64,armhf] drm/bridge: Add missing pm_runtime_disable() in
      __dw_mipi_dsi_probe
    - [arm64] drm: bridge: adv7511: Fix ADV7535 HPD enablement
    - ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern
    - [arm64,armhf] drm/panfrost: Check for error num after setting mask
    - Bluetooth: hci_serdev: call init_rwsem() before p->open()
    - [armhf] mtd: rawnand: gpmi: fix controller timings setting
    - drm/edid: Don't clear formats if using deep color
    - drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl()
    - drm/amd/display: Fix a NULL pointer dereference in
      amdgpu_dm_connector_add_common_modes()
    - drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function
    - ath9k_htc: fix uninit value bugs
    - RDMA/core: Set MR type in ib_reg_user_mr
    - [powerpc*] KVM: PPC: Fix vmx/vsx mixup in mmio emulation
    - i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
    - i40e: respect metadata on XSK Rx to skb
    - [x86] ray_cs: Check ioremap return value
    - [powerpc*] KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init
    - [powerpc*] perf: Don't use perf_hw_context for trace IMC PMU
    - [arm64,armhf] net: dsa: mv88e6xxx: Enable port policy support on 6097
    - [arm64] PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated
      bridge
    - [arm64,armhf] drm/bridge: dw-hdmi: use safe format when first in bridge
      chain
    - HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
    - drm/amd/pm: enable pm sysfs write for one VF mode
    - drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug
    - IB/cma: Allow XRC INI QPs to set their local ACK timeout
    - dax: make sure inodes are flushed before destroy cache
    - iwlwifi: Fix -EIO error code that is never returned
    - iwlwifi: mvm: Fix an error code in iwl_mvm_up()
    - [arm64] drm/msm/dp: populate connector of struct dp_panel
    - [arm64] drm/msm/dpu: add DSPP blocks teardown
    - [arm64] drm/msm/dpu: fix dp audio condition
    - scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
    - scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
    - scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
    - scsi: pm8001: Fix le32 values handling in
      pm80xx_set_sas_protocol_timer_config()
    - scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update()
    - scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req()
    - scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req()
    - scsi: pm8001: Fix NCQ NON DATA command task initialization
    - scsi: pm8001: Fix NCQ NON DATA command completion handling
    - scsi: pm8001: Fix abort all task initialization
    - RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR
    - drm/amd/display: Remove vupdate_int_entry definition
    - TOMOYO: fix __setup handlers return values
    - [arm64,armhf] drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
    - [x86] power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong
      false return
    - [arm64] scsi: hisi_sas: Change permission of parameter prot_mask
    - [arm64] bpf, arm64: Call build_prologue() first in first JIT pass
    - [arm64] bpf, arm64: Feed byte-offset into bpf line info
    - [arm64,armhf] gpu: host1x: Fix a memory leak in 'host1x_remove()'
    - [powerpc*] mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties()
    - [x86] KVM: x86: Fix emulation in writing cr8
    - [x86] KVM: x86/emulator: Defer not-present segment check in
      __load_segment_descriptor()
    - [x86] hv_balloon: rate-limit "Unhandled message" warning
    - [amd64] IB/hfi1: Allow larger MTU without AIP
    - PCI: Reduce warnings on possible RW1C corruption
    - [armhf] mfd: mc13xxx: Add check for mc13xxx_irq_request
    - [x86] platform/x86: huawei-wmi: check the return value of
      device_create_file()
    - vxcan: enable local echo for sent CAN frames
    - ath10k: Fix error handling in ath10k_setup_msa_resources
    - [mips*] pgalloc: fix memory leak caused by pgd_free()
    - RDMA/mlx5: Fix memory leak in error flow for subscribe event routine
    - bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full
    - bpf, sockmap: Fix more uncharged while msg has more_data
    - bpf, sockmap: Fix double uncharge the mem of sk_msg
    - USB: storage: ums-realtek: fix error code in rts51x_read_mem()
    - can: isotp: return -EADDRNOTAVAIL when reading from unbound socket
    - can: isotp: support MSG_TRUNC flag when reading from socket
    - Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed
    - ipv4: Fix route lookups when handling ICMP redirects and PMTU updates
    - af_netlink: Fix shift out of bounds in group mask calculation
    - [arm64,armhf] i2c: meson: Fix wrong speed use from probe
    - PCI: Avoid broken MSI on SB600 USB devices
    - [arm64] net: bcmgenet: Use stronger register read/writes to assure
      ordering
    - tcp: ensure PMTU updates are processed during fastopen
    - openvswitch: always update flow key after nat
    - tipc: fix the timer expires after interval 100ms
    - [x86] mxser: fix xmit_buf leak in activate when LSR == 0xff
    - [armhf] fsi: aspeed: convert to devm_platform_ioremap_resource
    - [armhf] fsi: Aspeed: Fix a potential double free
    - soundwire: intel: fix wrong register name in intel_shim_wake
    - iio: mma8452: Fix probe failing when an i2c_device_id is used
    - [arm64,armhf] phy: dphy: Correct lpx parameter and its
      derivatives(ta_{get,go,sure})
    - [x86] serial: 8250_mid: Balance reference count for PCI DMA device
    - [x86] serial: 8250_lpss: Balance reference count for PCI DMA device
    - NFS: Use of mapping_set_error() results in spurious errors
    - serial: 8250: Fix race condition in RTS-after-send handling
    - NFS: Return valid errors from nfs2/3_decode_dirent()
    - [arm64] clk: qcom: clk-rcg2: Update logic to calculate D value for RCG
    - [arm64] clk: qcom: clk-rcg2: Update the frac table for pixel clock
    - nvdimm/region: Fix default alignment for small regions
    - [armhf] clk: tegra: tegra124-emc: Fix missing put_device() call in
      emc_ensure_emc_driver
    - NFS: remove unneeded check in decode_devicenotify_args()
    - [arm64,armhf] pinctrl/rockchip: Add missing of_node_put() in
      rockchip_pinctrl_probe
    - [s390x] tty: hvc: fix return value of __setup handler
    - serial: 8250: fix XOFF/XON sending when DMA is used
    - driver core: dd: fix return value of __setup handler
    - jfs: fix divide error in dbNextAG
    - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
    - NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error
    - kdb: Fix the putarea helper function
    - clk: Initialize orphan req_rate
    - [amd64] xen: fix is_xen_pmu()
    - [arm64] net: enetc: report software timestamping via SO_TIMESTAMPING
    - [arm64] net: hns3: fix bug when PF set the duplicate MAC address for VFs
    - net: phy: broadcom: Fix brcm_fet_config_init()
    - NFSv4/pNFS: Fix another issue with a list iterator pointing to the head
    - [armhf] net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list
      iterator
    - fs: fd tables have to be multiples of BITS_PER_LONG
    - fs: fix fd table size alignment properly
    - LSM: general protection fault in legacy_parse_param
    - block, bfq: don't move oom_bfqq
    - selinux: use correct type for context length
    - selinux: allow FIOCLEX and FIONCLEX with policy capability
    - loop: use sysfs_emit() in the sysfs xxx show()
    - Fix incorrect type in assignment of ipv6 port for audit
    - fs/binfmt_elf: Fix AT_PHDR for unusual ELF files
    - bfq: fix use-after-free in bfq_dispatch_request
    - ACPICA: Avoid walking the ACPI Namespace if it is not there
    - Revert "Revert "block, bfq: honor already-setup queue merges""
    - ACPI/APEI: Limit printable size of BERT table data
    - PM: core: keep irq flags in device_pm_check_callbacks()
    - nvme-tcp: lockdep: annotate in-kernel sockets
    - [arm64] spi: tegra20: Use of_device_get_match_data()
    - ext4: correct cluster len and clusters changed accounting in
      ext4_mb_mark_bb
    - ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit
    - ext4: don't BUG if someone dirty pages without asking ext4 first
    - f2fs: fix to do sanity check on curseg->alloc_type
    - NFSD: Fix nfsd_breaker_owns_lease() return values
    - f2fs: compress: fix to print raw data size in error path of lz4
      decompression
    - video: fbdev: cirrusfb: check pixclock to avoid divide by zero
    - [armel,armhf] ftrace: avoid redundant loads or clobbering IP
    - video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit
    - ASoC: soc-core: skip zero num_dai component in searching dai name
    - media: cx88-mpeg: clear interrupt status register before streaming video
    - uaccess: fix type mismatch warnings from access_ok()
    - media: Revert "media: em28xx: add missing em28xx_close_extension"
    - media: hdpvr: initialize dev->worker at hdpvr_register_videodev
    - mmc: host: Return an error when ->enable_sdio_irq() ops is missing
    - ALSA: hda/realtek: Add alc256-samsung-headphone fixup
    - [x86] KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP
      MMU
    - [powerpc*] lib/sstep: Fix 'sthcx' instruction
    - [powerpc*] lib/sstep: Fix build errors with newer binutils
    - scsi: qla2xxx: Fix stuck session in gpdb
    - scsi: qla2xxx: Fix scheduling while atomic
    - scsi: qla2xxx: Fix wrong FDMI data for 64G adapter
    - scsi: qla2xxx: Fix warning for missing error code
    - scsi: qla2xxx: Fix device reconnect in loop topology
    - scsi: qla2xxx: Add devids and conditionals for 28xx
    - scsi: qla2xxx: Check for firmware dump already collected
    - scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
    - scsi: qla2xxx: Fix disk failure to rediscover
    - scsi: qla2xxx: Fix incorrect reporting of task management failure
    - scsi: qla2xxx: Fix hang due to session stuck
    - scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests
    - scsi: qla2xxx: Fix N2N inconsistent PLOGI
    - scsi: qla2xxx: Reduce false trigger to login
    - scsi: qla2xxx: Use correct feature type field during RFF_ID processing
    - [arm64] platform: chrome: Split trace include file
    - [x86] KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't
      activated
    - KVM: Prevent module exit until all VMs are freed
    - [x86] KVM: x86: fix sending PV IPI
    - [x86] KVM: SVM: fix panic on out-of-bounds guest IRQ
    - [x86] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
    - ubifs: rename_whiteout: Fix double free for whiteout_ui->data
    - ubifs: Fix deadlock in concurrent rename whiteout and inode writeback
    - ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
    - ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
    - ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()
    - ubifs: Fix to add refcount once page is set private
    - ubifs: rename_whiteout: correct old_dir size computing
    - wireguard: queueing: use CFI-safe ptr_ring cleanup function
    - wireguard: socket: free skb in send6 when ipv6 is disabled
    - wireguard: socket: ignore v6 endpoints when ipv6 is disabled
    - XArray: Fix xas_create_range() when multi-order entry present
    - can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error
      path (CVE-2022-28389)
    - can: mcba_usb: properly check endpoint type
    - XArray: Update the LRU list in xas_split()
    - rtc: check if __rtc_read_time was successful
    - gfs2: Make sure FITRIM minlen is rounded up to fs block size
    - [arm64] net: hns3: fix software vlan talbe of vlan 0 inconsistent with
      hardware
    - rxrpc: Fix call timer start racing with call destruction
    - [arm64] mailbox: imx: fix wakeup failure from freeze mode
    - watch_queue: Free the page array when watch_queue is dismantled
    - pinctrl: pinconf-generic: Print arguments for bias-pull-*
    - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
    - [arm*] iop32x: offset IRQ numbers by 1
    - io_uring: fix memory leak of uid in files registration
    - [amd64,arm64] ACPI: CPPC: Avoid out of bounds access when parsing _CPC
      data
    - [arm64] platform/chrome: cros_ec_typec: Check for EC device
    - can: isotp: restore accidentally removed MSG_PEEK feature
    - proc: bootconfig: Add null pointer check
    - [x86] ASoC: soc-compress: Change the check for codec_dai
    - batman-adv: Check ptr for NULL before reducing its refcnt
    - mm/mmap: return 1 from stack_guard_gap __setup() handler
    - mm/memcontrol: return 1 from cgroup.memory __setup() handler
    - mm/usercopy: return 1 from hardened_usercopy __setup() handler
    - bpf: Adjust BPF stack helper functions to accommodate skip > 0
    - bpf: Fix comment for helper bpf_current_task_under_cgroup()
    - dt-bindings: mtd: nand-controller: Fix the reg property description
    - dt-bindings: mtd: nand-controller: Fix a comment in the examples
    - dt-bindings: spi: mxic: The interrupt property is not mandatory
    - [x86] ASoC: topology: Allow TLV control to be either read or write
    - docs: sysctl/kernel: add missing bit to panic_print
    - openvswitch: Fixed nd target mask field in the flow dump.
    - [x86] KVM: x86/mmu: do compare-and-exchange of gPTE via the user address
      (CVE-2022-1158)
    - can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error
      path (CVE-2022-28388)
    - coredump: Snapshot the vmas in do_coredump
    - coredump: Remove the WARN_ON in dump_vma_snapshot
    - coredump/elf: Pass coredump_params into fill_note_info
    - coredump: Use the vma snapshot in fill_files_note
    - [arm64] Do not defer reserve_crashkernel() for platforms with no DMA
      memory zones
    - [arm64] PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.111
    - ubifs: Rectify space amount budget for mkdir/tmpfile operations
    - gfs2: Check for active reservation in gfs2_release
    - gfs2: Fix gfs2_release for non-writers regression
    - gfs2: gfs2_setattr_size error path fix
    - [x86] KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs
    - [x86] KVM: x86/emulator: Emulate RDPID only if it is enabled in guest
    - drm: Add orientation quirk for GPD Win Max
    - ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
    - drm/amd/display: Add signal type check when verify stream backends same
    - drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
    - ptp: replace snprintf with sysfs_emit
    - [armhf] ath11k: fix kernel panic during unload/load ath11k modules
    - ath11k: mhi: use mhi_sync_power_up()
    - bpf: Make dst_port field in struct bpf_sock 16-bit wide
    - scsi: mvsas: Replace snprintf() with sysfs_emit()
    - scsi: bfa: Replace snprintf() with sysfs_emit()
    - [arm64,armhf] power: supply: axp20x_battery: properly report current when
      discharging
    - mt76: dma: initialize skip_unmap in mt76_dma_rx_fill
    - cfg80211: don't add non transmitted BSS to 6GHz scanned channels
    - ipv6: make mc_forwarding atomic
    - [powerpc*] Set crashkernel offset to mid of RMA region
    - drm/amdgpu: Fix recursive locking warning
    - [arm64] PCI: aardvark: Fix support for MSI interrupts
    - [arm64] iommu/arm-smmu-v3: fix event handling soft lockup
    - usb: ehci: add pci device support for Aspeed platforms
    - tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH.
    - PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
    - iwlwifi: mvm: Correctly set fragmented EBS
    - ipv4: Invalidate neighbour for broadcast address upon address addition
    - dm ioctl: prevent potential spectre v1 gadget
    - dm: requeue IO if mapping table not yet available
    - scsi: pm8001: Fix pm80xx_pci_mem_copy() interface
    - scsi: pm8001: Fix pm8001_mpi_task_abort_resp()
    - scsi: pm8001: Fix task leak in pm8001_send_abort_all()
    - scsi: pm8001: Fix tag leaks on error
    - scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req()
    - scsi: aha152x: Fix aha152x_setup() __setup handler return value
    - [arm64] scsi: hisi_sas: Free irq vectors in order for v3 HW
    - net/smc: correct settings of RMB window update limit
    - macvtap: advertise link netns via netlink
    - tuntap: add sanity checks about msg_controllen in sendmsg
    - Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg}
    - Bluetooth: use memset avoid memory leaks
    - bnxt_en: Eliminate unintended link toggle during FW reset
    - [mps64el,mipsel] fix fortify panic when copying asm exception handlers
    - scsi: libfc: Fix use after free in fc_exch_abts_resp()
    - can: isotp: set default value for N_As to 50 micro seconds
    - net: account alternate interface name memory
    - net: limit altnames to 64k total
    - net: sfp: add 2500base-X quirk for Lantech SFP module
    - [armhf] usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on
      omap5evm
    - Bluetooth: Fix use after free in hci_send_acl
    - netlabel: fix out-of-bounds memory accesses
    - ceph: fix memory leak in ceph_readdir when note_last_dentry returns error
    - init/main.c: return 1 from handled __setup() functions
    - minix: fix bug when opening a file with O_DIRECT
    - [arm*] staging: vchiq_core: handle NULL result of find_service_by_handle
    - [arm64,armhf] phy: amlogic: meson8b-usb2: Use dev_err_probe()
    - w1: w1_therm: fixes w1_seq for ds28ea00 sensors
    - NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify()
    - NFSv4: Protect the state recovery thread against direct reclaim
    - xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32
    - [armhf] clk: ti: Preserve node in ti_dt_clocks_register()
    - clk: Enforce that disjoints limits are invalid
    - SUNRPC/call_alloc: async tasks mustn't block waiting for memory
    - SUNRPC/xprt: async tasks mustn't block waiting for memory
    - SUNRPC: remove scheduling boost for "SWAPPER" tasks.
    - NFS: swap IO handling is slightly different for O_DIRECT IO
    - NFS: swap-out must always use STABLE writes.
    - [armhf] serial: samsung_tty: do not unlock port->lock for
      uart_write_wakeup()
    - virtio_console: eliminate anonymous module_init & module_exit
    - jfs: prevent NULL deref in diFree
    - SUNRPC: Fix socket waits for write buffer space
    - NFS: nfsiod should not block forever in mempool_alloc()
    - NFS: Avoid writeback threads getting stuck in mempool_alloc()
    - mm: fix race between MADV_FREE reclaim and blkdev direct IO read
    - drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire()
    - [x86] Drivers: hv: vmbus: Fix potential crash on module unload
    - Revert "NFSv4: Handle the special Linux file open access mode"
    - NFSv4: fix open failure with O_ACCMODE flag
    - ice: Clear default forwarding VSI during VSI release
    - net: ipv4: fix route with nexthop object delete warning
    - net: stmmac: Fix unset max_speed difference between DT and non-DT
      platforms
    - [armhf] drm/imx: imx-ldb: Check for null pointer after calling kmemdup
    - [armhf] drm/imx: Fix memory leak in imx_pd_connector_get_modes
    - sfc: Do not free an empty page_ring
    - RDMA/mlx5: Don't remove cache MRs when a delay is needed
    - [amd64] IB/rdmavt: add lock to call to rvt_error_qp to prevent a race
      condition
    - [arm64] dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe
    - ice: Set txq_teid to ICE_INVAL_TEID on ring creation
    - ice: Do not skip not enabled queues in ice_vc_dis_qs_msg
    - ipv6: Fix stats accounting in ip6_pkt_drop
    - ice: synchronize_rcu() when terminating rings
    - net: openvswitch: don't send internal clone attribute to the userspace.
    - net: openvswitch: fix leak of nested actions
    - rxrpc: fix a race in rxrpc_exit_net()
    - qede: confirm skb is allocated before using
    - bpf: Support dual-stack sockets in bpf_tcp_check_syncookie
    - drbd: Fix five use after free bugs in get_initial_state
    - io_uring: don't touch scm_fp_list after queueing skb
    - SUNRPC: Handle ENOMEM in call_transmit_status()
    - SUNRPC: Handle low memory situations in call_status()
    - SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec()
    - [armhf] iommu/omap: Fix regression in probe for NULL pointer dereference
    - [arm64] Add part number for Arm Cortex-A78AE
    - [arm64] Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning"
    - [arm64,armhf] mmc: mmci: stm32: correctly check all elements of sg list
    - lz4: fix LZ4_decompress_safe_partial read out of bound
    - mmmremap.c: avoid pointless invalidate_range_start/end on
      mremap(old_size=0)
    - mm/mempolicy: fix mpol_new leak in shared_policy_replace
    - io_uring: fix race between timeout flush and removal (CVE-2022-29582)
    - [x86] pm: Save the MSR validity status at context setup
    - [x86] speculation: Restore speculation related MSRs during S3 resume
    - btrfs: fix qgroup reserve overflow the qgroup limit
    - btrfs: prevent subvol with swapfile from being deleted
    - [arm64] patch_text: Fixup last cpu should be master
    - [amd64] RDMA/hfi1: Fix use-after-free bug for mm struct
    - gpio: Restrict usage of GPIO chip irq members before initialization
    - [arm64] perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator
    - [arm64,armhf] irqchip/gic-v3: Fix GICR_CTLR.RWP polling
    - drm/nouveau/pmu: Add missing callbacks for Tegra devices
    - mm: don't skip swap entry even if zap_details specified
    - cgroup: Use open-time credentials for process migraton perm checks
      (CVE-2021-4197)
    - [x86] Drivers: hv: vmbus: Replace smp_store_mb() with virt_store_mb()
    - [arm64,armhf] irqchip/gic, gic-v3: Prevent GSI to SGI translations
    - [powerpc*] Fix virt_addr_valid() for 64-bit Book3E & 32-bit
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.112
    - [amd64] drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu
    - hamradio: defer 6pack kfree after unregister_netdev (CVE-2022-1195)
    - hamradio: remove needs_free_netdev to avoid UAF (CVE-2022-1195)
    - [arm64] cpuidle: PSCI: Move the `has_lpi` check to the beginning of the
      function
    - ACPI: processor idle: Check for architectural support for LPI
    - btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups()
    - [arm64] drm/msm: Add missing put_task_struct() in debugfs path
    - SUNRPC: Fix the svc_deferred_event trace class
    - net/sched: flower: fix parsing of ethertype following VLAN header
    - veth: Ensure eth header is in skb's linear part
    - gpiolib: acpi: use correct format characters
    - net: mdio: Alphabetically sort header inclusion
    - net/sched: fix initialization order when updating chain 0 head
    - [arm64] net: dsa: felix: suppress -EPROBE_DEFER errors
    - [armhf] net: ethernet: stmmac: fix altr_tse_pcs function when using a
      fixed-link
    - net/sched: taprio: Check if socket flags are valid
    - cfg80211: hold bss_lock while updating nontrans_list
    - [arm64] drm/msm: Fix range size vs end confusion
    - [arm64] drm/msm/dsi: Use connector directly in
      msm_dsi_manager_connector_init()
    - net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()
    - scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63
    - scsi: pm80xx: Enable upper inbound, outbound queues
    - scsi: iscsi: Stop queueing during ep_disconnect
    - scsi: iscsi: Force immediate failure during shutdown
    - scsi: iscsi: Use system_unbound_wq for destroy_work
    - scsi: iscsi: Rel ref after iscsi_lookup_endpoint()
    - scsi: iscsi: Fix in-kernel conn failure handling
    - scsi: iscsi: Move iscsi_ep_disconnect()
    - scsi: iscsi: Fix offload conn cleanup when iscsid restarts
    - scsi: iscsi: Fix conn cleanup and stop race during iscsid restart
    - sctp: Initialize daddr on peeled off socket
    - cifs: potential buffer overflow in handling symlinks
    - [arm64] net: bcmgenet: Revert "Use stronger register read/writes to assure
      ordering"
    - drm/amd: Add USBC connector ID
    - btrfs: fix fallocate to use file_modified to update permissions
      consistently
    - btrfs: do not warn for free space inode in cow_file_range
    - drm/amd/display: fix audio format not updated after edid updated
    - drm/amd/display: FEC check in timing validation
    - drm/amd/display: Update VTEM Infopacket definition
    - drm/amdkfd: Fix Incorrect VMIDs passed to HWS
    - drm/amdgpu/vcn: improve vcn dpg stop procedure
    - [x86] Drivers: hv: vmbus: Prevent load re-ordering when reading ring
      buffer
    - scsi: target: tcmu: Fix possible page UAF
    - scsi: lpfc: Fix queue failures when recovering from PCI parity error
    - [powerpc*] scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
    - ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs
    - [armhf] gpu: ipu-v3: Fix dev_dbg frequency output
    - [arm64] alternatives: mark patch_alternative() as `noinstr`
    - tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry
    - net: usb: aqc111: Fix out-of-bounds accesses in RX fixup
    - myri10ge: fix an incorrect free for skb in myri10ge_sw_tso
    - drm/amd/display: Revert FEC check in validation
    - drm/amd/display: Fix allocate_mst_payload assert on resume
    - scsi: mvsas: Add PCI ID of RocketRaid 2640
    - scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan
    - drivers: net: slip: fix NPD bug in sl_tx_timeout()
    - mm, page_alloc: fix build_zonerefs_node()
    - mm: fix unexpected zeroed page mapping with zram swap
    - [x86] KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded
    - ath9k: Properly clear TX status area before reporting to mac80211
    - ath9k: Fix usage of driver-private space in tx_info
    - btrfs: fix root ref counts in error handling in btrfs_get_root_ref
    - btrfs: mark resumed async balance as writing
    - ALSA: hda/realtek: Add quirk for Clevo PD50PNT
    - ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers
    - ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
    - nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size
    - ipv6: fix panic when forwarding a pkt with no in6 dev
    - drm/amd/display: don't ignore alpha property on pre-multiplied mode
    - drm/amdgpu: Enable gfxoff quirk on MacBook Pro
    - genirq/affinity: Consider that CPUs on nodes can be unbalanced
    - tick/nohz: Use WARN_ON_ONCE() to prevent console saturation
    - dm integrity: fix memory corruption when tag_size is less than digest size
    - smp: Fix offline cpu check in flush_smp_call_function_queue()
    - timers: Fix warning condition in __run_timers()
    - dma-direct: avoid redundant memory sync for swiotlb
    - scsi: iscsi: Fix endpoint reuse regression
    - scsi: iscsi: Fix unbound endpoint error handling
    - ax25: add refcount in ax25_dev to avoid UAF bugs (CVE-2022-1204)
    - ax25: fix reference count leaks of ax25_dev (CVE-2022-1204)
    - ax25: fix UAF bugs of net_device caused by rebinding operation
      (CVE-2022-1204)
    - ax25: Fix refcount leaks caused by ax25_cb_del() (CVE-2022-1204)
    - ax25: fix UAF bug in ax25_send_control()
    - ax25: fix NPD bug in ax25_disconnect (CVE-2022-1199)
    - ax25: Fix NULL pointer dereferences in ax25 timers (CVE-2022-1205)
    - ax25: Fix UAF bugs in ax25 timers (CVE-2022-1205)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.113
    - tracing: Dump stacktrace trigger to the corresponding instance
    - gfs2: assign rgrp glock before compute_bitstructs
    - net/sched: cls_u32: fix netns refcount changes in u32_change()
    - ALSA: usb-audio: Clear MIDI port active flag after draining
    - ALSA: hda/realtek: Add quirk for Clevo NP70PNP
    - dm: fix mempool NULL pointer race when completing IO
    - [armhf] dmaengine: imx-sdma: Fix error checking in sdma_event_remap
    - esp: limit skb_page_frag_refill use to a single page
    - igc: Fix infinite loop in release_swfw_sync
    - igc: Fix BUG: scheduling while atomic
    - rxrpc: Restore removed timer deletion
    - net/smc: Fix sock leak when release after smc_shutdown()
    - net/packet: fix packet_sock xmit return value checking
    - ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit()
    - ip6_gre: Fix skb_under_panic in __gre6_xmit()
    - net/sched: cls_u32: fix possible leak in u32_init_knode()
    - l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using
      netdev_master_upper_dev_get_rcu
    - ipv6: make ip6_rt_gc_expire an atomic_t
    - netlink: reset network and mac headers in netlink_dump()
    - net: stmmac: Use readl_poll_timeout_atomic() in atomic state
    - [arm64] mm: Remove [PUD|PMD]_TABLE_BIT from [pud|pmd]_bad()
    - [arm64] mm: fix p?d_leaf()
    - [x86] platform/x86: samsung-laptop: Fix an unsigned comparison which can
      never be negative
    - ALSA: usb-audio: Fix undefined behavior due to shift overflowing the
      constant
    - vxlan: fix error return code in vxlan_fdb_append
    - cifs: Check the IOCB_DIRECT flag, not O_DIRECT
    - [amd64,arm64] net: atlantic: Avoid out-of-bounds indexing
    - mt76: Fix undefined behavior due to shift overflowing the constant
    - brcmfmac: sdio: Fix undefined behavior due to shift overflowing the
      constant
    - [arm64] drm/msm/mdp5: check the return of kzalloc()
    - [arm64] net: macb: Restart tx only if queue pointer is lagging
    - scsi: qedi: Fix failed disconnect handling
    - stat: fix inconsistency between struct stat and struct compat_stat
    - nvme: add a quirk to disable namespace identifiers
    - nvme-pci: disable namespace identifiers for Qemu controllers
    - mm, hugetlb: allow for "high" userspace addresses
    - oom_kill.c: futex: delay the OOM reaper to allow time for proper futex
      cleanup
    - mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove()
    - ata: pata_marvell: Check the 'bmdma_addr' beforing reading
    - [amd64,arm64] net: atlantic: invert deep par in pm functions, preventing
      null derefs
    - openvswitch: fix OOB access in reserve_sfa_size()
    - gpio: Request interrupts after IRQ is initialized
    - ASoC: soc-dapm: fix two incorrect uses of list iterator
    - e1000e: Fix possible overflow in LTR decoding
    - [arm*] arm_pmu: Validate single/group leader events
    - sched/pelt: Fix attach_entity_load_avg() corner case
    - [arm64,armhf] drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not
      initialised
    - [arm64,armhf] drm/panel/raspberrypi-touchscreen: Initialise the bridge in
      prepare
    - [powerpc*] KVM: PPC: Fix TCE handling for VFIO
    - [arm*] drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync()
      usage
    - [powerpc*] perf: Fix power9 event alternatives
    - ext4: fix fallocate to use file_modified to update permissions
      consistently
    - ext4: fix symlink file size not match to file content
    - ext4: fix use-after-free in ext4_search_dir
    - ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
    - ext4, doc: fix incorrect h_reserved size
    - ext4: fix overhead calculation to account for the reserved gdt blocks
    - ext4: force overhead calculation if the s_overhead_cluster makes no sense
    - can: isotp: stop timeout monitoring when no first frame was sent
    - jbd2: fix a potential race while discarding reserved buffers after an
      abort
    - block/compat_ioctl: fix range check in BLKGETSIZE

  [ Salvatore Bonaccorso ]
  * Bump ABI to 14
  * [rt] Drop "tcp: Remove superfluous BH-disable around"
  * [rt] Update "tracing: Merge irqflags + preempt counter." for upstream
    changes in 5.10.113
  * [x86] pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests
    (Closes: #1006346)
  * floppy: disable FDRAWCMD by default

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 29 Apr 2022 11:36:50 +0200

linux (5.10.106-1) bullseye; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.104
    - mac80211_hwsim: report NOACK frames in tx_status
    - mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work
    - [arm*] i2c: bcm2835: Avoid clock stretching timeouts
    - ASoC: rt5682: do not block workqueue if card is unbound
    - regulator: core: fix false positive in regulator_late_cleanup()
    - Input: clear BTN_RIGHT/MIDDLE on buttonpads
    - [arm64] KVM: arm64: vgic: Read HW interrupt pending state from the HW
    - tipc: fix a bit overflow in tipc_crypto_key_rcv()
    - cifs: fix double free race when mount fails in cifs_get_root()
    - net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990
    - usb: gadget: don't release an existing dev->buf (CVE-2022-24958)
    - usb: gadget: clear related members when goto fail (CVE-2022-24958)
    - exfat: reuse exfat_inode_info variable instead of calling EXFAT_I()
    - exfat: fix i_blocks for files truncated over 4 GiB
    - tracing: Add test for user space strings when filtering on string pointers
    - [armhf] serial: stm32: prevent TDR register overwrite when sending x_char
    - ata: pata_hpt37x: fix PCI clock detection
    - drm/amdgpu: check vm ready by amdgpu_vm->evicting flag
    - tracing: Add ustring operation to filtering string pointers
    - [x86] ALSA: intel_hdmi: Fix reference to PCM buffer address
    - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min
    - [amd64] iommu/amd: Recover from event log overflow
    - [x86] drm/i915: s/JSP2/ICP2/ PCH
    - xen/netfront: destroy queues before real_num_tx_queues is zeroed
    - mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls
    - xfrm: fix MTU regression
    - netfilter: fix use-after-free in __nf_register_net_hook()
    - bpf, sockmap: Do not ignore orig_len parameter
    - xfrm: fix the if_id check in changelink
    - xfrm: enforce validity of offload input flags
    - e1000e: Correct NVM checksum verification flow
    - net: fix up skbs delta_truesize in UDP GRO frag_list
    - netfilter: nf_queue: don't assume sk is full socket
    - netfilter: nf_queue: fix possible use-after-free
    - netfilter: nf_queue: handle socket prefetch
    - batman-adv: Request iflink once in batadv-on-batadv check
    - batman-adv: Request iflink once in batadv_get_real_netdevice
    - batman-adv: Don't expect inter-netns unique iflink indices
    - net: ipv6: ensure we call ipv6_mc_down() at most once
    - net: dcb: flush lingering app table entries for unregistered devices
    - net/smc: fix connection leak
    - net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error generated by client
    - net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server
    - rcu/nocb: Fix missed nocb_timer requeue
    - ice: Fix race conditions between virtchnl handling and VF ndo ops
    - ice: fix concurrent reset and removal of VFs
    - sched/topology: Make sched_init_numa() use a set for the deduplicating
      sort
    - sched/topology: Fix sched_domain_topology_level alloc in sched_init_numa()
    - mac80211: fix forwarded mesh frames AC & queue selection
    - net: stmmac: fix return value of __setup handler
    - mac80211: treat some SAE auth steps as final
    - iavf: Fix missing check for running netdev
    - net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
    - ixgbe: xsk: change !netif_carrier_ok() handling in ixgbe_xmit_zc()
    - efivars: Respect "block" flag in efivar_entry_set_safe()
    - can: gs_usb: change active_channels's type from atomic_t to u8
    - igc: igc_read_phy_reg_gpy: drop premature return
    - [armel,armhf] 9182/1: mmu: fix returns from early_param() and __setup()
      functions
    - [arm64,armhf] pinctrl: sunxi: Use unique lockdep classes for IRQs
    - igc: igc_write_phy_reg_gpy: drop premature return
    - memfd: fix F_SEAL_WRITE after shmem huge page allocated
    - [armhf] dts: switch timer config to common devkit8000 devicetree
    - [armhf] dts: Use 32KiHz oscillator on devkit8000
    - [arm64] soc: fsl: guts: Revert commit 3c0d64e867ed
    - [arm64] soc: fsl: guts: Add a missing memory allocation failure check
    - [armhf] tegra: Move panels to AUX bus
    - net: chelsio: cxgb3: check the return value of pci_find_capability()
    - iavf: Refactor iavf state machine tracking
    - nl80211: Handle nla_memdup failures in handle_nan_filter
    - drm/amdgpu: fix suspend/resume hang regression
    - net: dcb: disable softirqs in dcbnl_flush_dev()
    - Input: elan_i2c - move regulator_[en|dis]able() out of
      elan_[en|dis]able_power()
    - Input: elan_i2c - fix regulator enable count imbalance after
      suspend/resume
    - HID: add mapping for KEY_DICTATE
    - HID: add mapping for KEY_ALL_APPLICATIONS
    - tracing/histogram: Fix sorting on old "cpu" value
    - tracing: Fix return value of __setup handlers
    - btrfs: fix lost prealloc extents beyond eof after full fsync
    - btrfs: qgroup: fix deadlock between rescan worker and remove qgroup
    - btrfs: add missing run of delayed items after unlink during log replay
    - Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6"
    - hamradio: fix macro redefine warning
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.105
    - [x86] bugs: Unconditionally allow spectre_v2=retpoline,amd
    - [armhf] report Spectre v2 status through sysfs
    - [armel,armhf] early traps initialisation
    - [armel,armhf] use LOADADDR() to get load address of sections
    - [armel,armhf] Spectre-BHB workaround
    - [armel,armhf] include unprivileged BPF status in Spectre V2 reporting
    - [arm64] cputype: Add CPU implementor & types for the Apple M1 cores
    - [arm64] Add Neoverse-N2, Cortex-A710 CPU part definition
    - [arm64] Add Cortex-X2 CPU part definition
    - [arm64] Add Cortex-A510 CPU part definition
    - [arm64] Add HWCAP for self-synchronising virtual counter
    - [arm64] add ID_AA64ISAR2_EL1 sys register
    - [arm64] cpufeature: add HWCAP for FEAT_AFP
    - [arm64] cpufeature: add HWCAP for FEAT_RPRES
    - [arm64] entry.S: Add ventry overflow sanity checks
    - [arm64] spectre: Rename spectre_v4_patch_fw_mitigation_conduit
    - [arm64] entry: Make the trampoline cleanup optional
    - [arm64] entry: Free up another register on kpti's tramp_exit path
    - [arm64] entry: Move the trampoline data page before the text page
    - [arm64] entry: Allow tramp_alias to access symbols after the 4K boundary
    - [arm64] entry: Don't assume tramp_vectors is the start of the vectors
    - [arm64] entry: Move trampoline macros out of ifdef'd section
    - [arm64] entry: Make the kpti trampoline's kpti sequence optional
    - [arm64] entry: Allow the trampoline text to occupy multiple pages
    - [arm64] entry: Add non-kpti __bp_harden_el1_vectors for mitigations
    - [arm64] entry: Add vectors that have the bhb mitigation sequences
    - [arm64] entry: Add macro for reading symbol addresses from the trampoline
    - [arm64] Add percpu vectors for EL1
    - [arm64] proton-pack: Report Spectre-BHB vulnerabilities as part of
      Spectre-v2
    - [arm64] KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A
    - [arm64] Mitigate spectre style branch history side channels
    - [arm64] KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and
      migrated
    - [arm64] Use the clearbhb instruction in mitigations
    - [arm64] proton-pack: Include unprivileged eBPF status in Spectre v2
      mitigation reporting
    - [armel,armhf] fix co-processor register typo
    - [armel,armhf] Do not use NOCROSSREFS directive with ld.lld
    - [armhf] fix build warning in proc-v7-bugs.c
    - xen/xenbus: don't let xenbus_grant_ring() remove grants in error case
      (CVE-2022-23040, XSA-396)
    - xen/grant-table: add gnttab_try_end_foreign_access() (CVE-2022-23036,
      CVE-2022-23038, XSA-396)
    - xen/blkfront: don't use gnttab_query_foreign_access() for mapped status
      (CVE-2022-23036, XSA-396)
    - xen/netfront: don't use gnttab_query_foreign_access() for mapped status
      (CVE-2022-23037, XSA-396)
    - xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
      (CVE-2022-23038, XSA-396)
    - xen/gntalloc: don't use gnttab_query_foreign_access() (CVE-2022-23039,
      XSA-396)
    - xen: remove gnttab_query_foreign_access()
    - xen/9p: use alloc/free_pages_exact() (CVE-2022-23041, XSA-396)
    - xen/pvcalls: use alloc/free_pages_exact() (CVE-2022-23041, XSA-396)
    - xen/gnttab: fix gnttab_end_foreign_access() without page specified
      (CVE-2022-23041, XSA-396)
    - xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
      (CVE-2022-23042, XSA-396)
    - Revert "ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.106
    - [arm64] clk: qcom: gdsc: Add support to update GDSC transition delay
    - [arm64] dts: armada-3720-turris-mox: Add missing ethernet0 alias
    - tipc: fix kernel panic when enabling bearer
    - mISDN: Remove obsolete PIPELINE_DEBUG debugging information
    - mISDN: Fix memory leak in dsp_pipeline_build()
    - virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero
    - isdn: hfcpci: check the return value of dma_set_mask() in setup_hw()
    - net: qlogic: check the return value of dma_alloc_coherent() in
      qed_vf_hw_prepare()
    - esp: Fix BEET mode inter address family tunneling on GSO
    - qed: return status of qed_iov_get_link
    - i40e: stop disabling VFs due to PF error responses
    - ice: stop disabling VFs due to PF error responses
    - ice: Align macro names to the specification
    - ice: Remove unnecessary checker loop
    - ice: Rename a couple of variables
    - ice: Fix curr_link_speed advertised speed
    - tipc: fix incorrect order of state message data sanity check
    - [armhf] net: ethernet: ti: cpts: Handle error for clk_enable
    - ax25: Fix NULL pointer dereference in ax25_kill_by_device
    - net/mlx5: Fix size field in bufferx_reg struct
    - net/mlx5: Fix a race on command flush flow
    - net/mlx5e: Lag, Only handle events from highest priority multipath entry
    - NFC: port100: fix use-after-free in port100_send_complete
    - net: phy: DP83822: clear MISR2 register to disable interrupts
    - sctp: fix kernel-infoleak for SCTP sockets
    - [arm64] net: bcmgenet: Don't claim WOL when its not available
    - [arm64,armhf] spi: rockchip: Fix error in getting num-cs property
    - [arm64,armhf] spi: rockchip: terminate dma transmission when slave abort
    - net-sysfs: add check for netdevice being present to speed_show
    - [armhf] hwmon: (pmbus) Clear pmbus fault/warning bits after read
    - gpio: Return EPROBE_DEFER if gc->to_irq is NULL
    - Revert "xen-netback: remove 'hotplug-status' once it has served its
      purpose"
    - Revert "xen-netback: Check for hotplug-status existence before watching"
    - ipv6: prevent a possible race condition with lifetimes
    - tracing: Ensure trace buffer is at least 4096 bytes large
    - fuse: fix pipe buffer lifetime for direct_io
    - staging: rtl8723bs: Fix access-point mode deadlock
    - [arm64] net: macb: Fix lost RX packet wakeup race in NAPI receive
    - [arm64] mmc: meson: Fix usage of meson_mmc_post_req()
    - [arm64] dts: marvell: armada-37xx: Remap IO space to bus address 0x0
    - virtio: unexport virtio_finalize_features
    - virtio: acknowledge all features before access
    - watch_queue, pipe: Free watchqueue state after clearing pipe ring
      (CVE-2022-0995)
    - watch_queue: Fix to release page in ->release() (CVE-2022-0995)
    - watch_queue: Fix to always request a pow-of-2 pipe ring size
      (CVE-2022-0995)
    - watch_queue: Fix the alloc bitmap size to reflect notes allocated
      (CVE-2022-0995)
    - watch_queue: Free the alloc bitmap when the watch_queue is torn down
      (CVE-2022-0995)
    - watch_queue: Fix lack of barrier/sync/lock between post and read
      (CVE-2022-0995)
    - watch_queue: Make comment about setting ->defunct more accurate
      (CVE-2022-0995)
    - [x86] boot: Fix memremap of setup_indirect structures
    - [x86] boot: Add setup_indirect support in early_memremap_is_setup_data()
    - [x86] traps: Mark do_int3() NOKPROBE_SYMBOL
    - ext4: add check to prevent attempting to resize an fs with sparse_super2
    - [armel,armhf] fix Thumb2 regression with Spectre BHB
    - watch_queue: Fix filter limit check ((CVE-2022-0995)

  [ Salvatore Bonaccorso ]
  * Bump ABI to 13
  * [rt] Update to 5.10.104-rt63
  * [rt] Update to 5.10.106-rt64
  * sctp: fix the processing for INIT chunk (CVE-2021-3772)
  * tcp: make tcp_read_sock() more robust
  * io_uring: return back safer resurrect
  * [arm64] kvm: Fix copy-and-paste error in bhb templates for v5.10 stable

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 17 Mar 2022 16:40:47 +0100

linux (5.10.103-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.93
    - kbuild: Add $(KBUILD_HOSTLDFLAGS) to 'has_libelf' test
    - devtmpfs regression fix: reconfigure on each mount
    - orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()
    - perf: Protect perf_guest_cbs with RCU
    - [x86] KVM: Register Processor Trace interrupt hook iff PT enabled in guest
    - [s390x] KVM: Clarify SIGP orders versus STOP/RESTART
    - 9p: only copy valid iattrs in 9P2000.L setattr implementation
    - [x86] video: vga16fb: Only probe for EGA and VGA 16 color graphic cards
    - media: uvcvideo: fix division by zero at stream start
    - rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with
      interrupts enabled
    - firmware: qemu_fw_cfg: fix sysfs information leak
    - firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries
    - firmware: qemu_fw_cfg: fix kobject leak in probe error path
    - [x86] KVM: remove PMU FIXED_CTR3 from msrs_to_save_all
    - ALSA: hda/realtek: Add speaker fixup for some Yoga 15ITL5 devices
    - ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after
      reboot from Windows
    - ALSA: hda: ALC287: Add Lenovo IdeaPad Slim 9i 14ITL5 speaker quirk
    - ALSA: hda/realtek: Add quirk for Legion Y9000X 2020
    - ALSA: hda/realtek: Re-order quirk entries for Lenovo
    - [powerpc*] pseries: Get entry and uaccess flush required bits from
      H_GET_CPU_CHARACTERISTICS
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.94
    - [x86] KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock
    - HID: uhid: Fix worker destroying device without any protection
    - HID: wacom: Reset expected and received contact counts at the same time
    - HID: wacom: Ignore the confidence flag when a touch is removed
    - HID: wacom: Avoid using stale array indicies to read contact count
    - f2fs: fix to do sanity check in is_alive()
    - nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed
      bind()
    - [armhf] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
    - [armhf] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for
      i.MX6
    - mtd: Fixed breaking list in __mtd_del_partition.
    - [x86] gpu: Reserve stolen memory for first integrated Intel GPU
    - rtc: cmos: take rtc_lock while reading from CMOS
    - media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE
    - media: flexcop-usb: fix control-message timeouts
    - media: mceusb: fix control-message timeouts
    - media: em28xx: fix control-message timeouts
    - media: cpia2: fix control-message timeouts
    - media: s2255: fix control-message timeouts
    - media: dib0700: fix undefined behavior in tuner shutdown
    - media: redrat3: fix control-message timeouts
    - media: pvrusb2: fix control-message timeouts
    - media: stk1160: fix control-message timeouts
    - [armhf] media: cec-pin: fix interrupt en/disable handling
    - [x86] can: softing_cs: softingcs_probe(): fix memleak on registration
      failure
    - iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs
    - [arm64,armhf] gpu: host1x: Add back arm_iommu_detach_device()
    - dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
    - PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
    - mm_zone: add function to check if managed dma zone exists
    - [arm64] dma/pool: create dma atomic pool only if dma zone has managed
      pages
    - mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed
      pages
    - shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
    - drm/ttm: Put BO in its memory manager's lru list
    - Bluetooth: L2CAP: Fix not initializing sk_peer_pid
    - [armhf] drm/bridge: display-connector: fix an uninitialized pointer in
      probe()
    - drm: fix null-ptr-deref in drm_dev_init_release()
    - [arm64,armhf] drm/rockchip: dsi: Fix unbalanced clock on probe error
    - [arm64,armhf] drm/rockchip: dsi: Hold pm-runtime across bind/unbind
    - [arm64,armhf] drm/rockchip: dsi: Disable PLL clock on bind error
    - [arm64,armhf] drm/rockchip: dsi: Reconfigure hardware on resume()
    - Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
    - [arm*] clk: bcm-2835: Pick the closest clock rate
    - [arm*] clk: bcm-2835: Remove rounding up the dividers
    - [arm*] drm/vc4: hdmi: Set a default HSM rate
    - [arm64] wcn36xx: ensure pairing of init_scan/finish_scan and
      start_scan/end_scan
    - [arm64] wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
    - [arm64] wcn36xx: Fix DMA channel enable/disable cycle
    - [arm64] wcn36xx: Release DMA channel descriptor allocations
    - [arm64] wcn36xx: Put DXE block into reset before freeing memory
    - [arm64] wcn36xx: populate band before determining rate on RX
    - [arm64] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates
    - ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware
    - media: videobuf2: Fix the size printk format
    - [armhf] media: aspeed: fix mode-detect always time out at 2nd run
    - media: em28xx: fix memory leak in em28xx_init_dev
    - [armhf] media: aspeed: Update signal status immediately to ensure sane hw
      state
    - fs: dlm: use sk->sk_socket instead of con->sock
    - fs: dlm: don't call kernel_getpeername() in error_report()
    - Bluetooth: stop proccessing malicious adv data
    - ath11k: Fix ETSI regd with weather radar overlap
    - ath11k: clear the keys properly via DISABLE_KEY
    - ath11k: reset RSN/WPA present state for open BSS
    - [arm64] tee: fix put order in teedev_close_context()
    - [x86] drm/vboxvideo: fix a NULL vs IS_ERR() check
    - media: dmxdev: fix UAF when dvb_register_device() fails
    - [arm64] crypto: qce - fix uaf on qce_ahash_register_one
    - [arm64] crypto: qce - fix uaf on qce_skcipher_register_one
    - [armhf] dts: stm32: fix dtbs_check warning on ili9341 dts binding on
      stm32f429 disco
    - [x86] crypto: qat - fix spelling mistake: "messge" -> "message"
    - [x86] crypto: qat - remove unnecessary collision prevention step in PFVF
    - [x86] crypto: qat - make pfvf send message direction agnostic
    - [x86] crypto: qat - fix undetected PFVF timeout in ACK loop
    - ath11k: Use host CE parameters for CE interrupts configuration
    - [armhf] media: imx-pxp: Initialize the spinlock prior to using it
    - [armhf] media: coda: fix CODA960 JPEG encoder buffer overflow
    - [arm64] media: venus: pm_helpers: Control core power domain manually
    - [arm64] media: venus: core, venc, vdec: Fix probe dependency error
    - [arm64] media: venus: core: Fix a potential NULL pointer dereference in an
      error handling path
    - [arm64] media: venus: core: Fix a resource leak in the error handling path
      of 'venus_probe()'
    - [armhf] thermal/drivers/imx: Implement runtime PM support
    - netfilter: bridge: add support for pppoe filtering
    - cgroup: Trace event cgroup id fields should be u64
    - ACPI: EC: Rework flushing of EC work while suspended to idle
    - drm/amdgpu: Fix a NULL pointer dereference in
      amdgpu_connector_lcd_native_mode()
    - drm/radeon/radeon_kms: Fix a NULL pointer dereference in
      radeon_driver_open_kms()
    - [arm*] serial: amba-pl011: do not request memory region twice
    - floppy: Fix hang in watchdog when disk is ejected
    - [x86] staging: rtl8192e: return error code from rtllib_softmac_init()
    - [x86] staging: rtl8192e: rtllib_module: fix error handle case in
      alloc_rtllib()
    - sched/fair: Fix detection of per-CPU kthreads waking a task
    - sched/fair: Fix per-CPU kthread and wakee stacking for asym CPU capacity
    - bpf: Adjust BTF log size limit.
    - bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD)
    - bpf: Remove config check to enable bpf support for branch records
    - [arm64] lib: Annotate {clear, copy}_page() as position-independent
    - [arm64] clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1
    - media: dib8000: Fix a memleak in dib8000_init()
    - media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
    - media: si2157: Fix "warm" tuner state detection
    - wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma
    - sched/rt: Try to restart rt period timer when rt runtime exceeded
    - rcu/exp: Mark current CPU as exp-QS in IPI loop second pass
    - mwifiex: Fix possible ABBA deadlock
    - xfrm: fix a small bug in xfrm_sa_len()
    - [x86] uaccess: Move variable into switch case statement
    - [armhf] crypto: stm32 - Fix last sparse warning in
      stm32_cryp_check_ctr_counter
    - [armhf] crypto: stm32/cryp - fix CTR counter carry
    - [armhf] crypto: stm32/cryp - fix xts and race condition in crypto_engine
      requests
    - [armhf] crypto: stm32/cryp - check early input data
    - [armhf] crypto: stm32/cryp - fix double pm exit
    - [armhf] crypto: stm32/cryp - fix lrw chaining mode
    - [armhf] crypto: stm32/cryp - fix bugs and crash in tests
    - [armhf] crypto: stm32 - Revert broken pm_runtime_resume_and_get changes
    - ath11k: Fix deleting uninitialized kernel timer during fragment cache
      flush
    - media: dw2102: Fix use after free
    - media: msi001: fix possible null-ptr-deref in msi001_probe()
    - [armhf] media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes
    - ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan()
    - [arm64] dts: qcom: c630: Fix soundcard setup
    - [arm64] drm/msm/dpu: fix safe status debugfs file
    - [arm64,armhf] drm/tegra: vic: Fix DMA API misuse
    - xfrm: interface with if_id 0 should return error
    - xfrm: state and policy should fail if XFRMA_IF_ID 0
    - [armel,armhf] 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding
    - usb: ftdi-elan: fix memory leak on device disconnect
    - iwlwifi: mvm: fix 32-bit build in FTM
    - iwlwifi: mvm: test roc running status bits before removing the sta
    - [armhf] mmc: meson-mx-sdio: add IRQ check
    - selinux: fix potential memleak in selinux_add_opt()
    - Bluetooth: L2CAP: Fix using wrong mode
    - bpftool: Enable line buffering for stdout
    - software node: fix wrong node passed to find nargs_prop
    - Bluetooth: hci_qca: Stop IBS timer during BT OFF
    - [x86] mce/inject: Avoid out-of-bounds write when setting flags
    - ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes
    - [x86] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in
      __nonstatic_find_io_region()
    - [x86] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in
      nonstatic_find_mem_region()
    - netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
    - bpf: Don't promote bogus looking registers after null check.
    - bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt().
    - netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
    - ppp: ensure minimum packet size in ppp_write()
    - Bluetooth: hci_bcm: Check for error irq
    - Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe
    - [arm64] usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe
    - HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init
    - HID: hid-uclogic-params: Invalid parameter check in
      uclogic_params_get_str_desc
    - HID: hid-uclogic-params: Invalid parameter check in
      uclogic_params_huion_init
    - HID: hid-uclogic-params: Invalid parameter check in
      uclogic_params_frame_init_v1_buttonpad
    - debugfs: lockdown: Allow reading debugfs files that are not world readable
    - net/mlx5e: Fix page DMA map/unmap attributes
    - net/mlx5e: Don't block routes with nexthop objects in SW
    - Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels"
    - net/mlx5: Set command entry semaphore up once got index free
    - lib/mpi: Add the return value check of kcalloc()
    - Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
    - [arm64,armhf] spi: spi-meson-spifc: Add missing pm_runtime_disable() in
      meson_spifc_probe
    - ax25: uninitialized variable in ax25_setsockopt()
    - netrom: fix api breakage in nr_setsockopt()
    - regmap: Call regmap_debugfs_exit() prior to _init()
    - tpm: add request_locality before write TPM_INT_ENABLE
    - tpm_tis: Fix an error handling path in 'tpm_tis_core_init()'
    - can: softing: softing_startstop(): fix set but not used variable warning
    - pcmcia: fix setting of kthread task states
    - iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing()
    - net: mcs7830: handle usb read errors properly
    - ext4: avoid trim error on fs with small groups
    - ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
    - ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
    - ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
    - RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with
      pending cmd-bit"
    - [arm64] RDMA/hns: Validate the pkey index
    - scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd()
    - [arm64] clk: imx8mn: Fix imx8mn_clko1_sels
    - [powerpc*] prom_init: Fix improper check of prom_getprop()
    - dt-bindings: thermal: Fix definition of cooling-maps contribution property
    - [powerpc*] 64s: Convert some cpu_setup() and cpu_restore() functions to C
    - [powerpc*] perf: MMCR0 control for PMU registers under PMCC=00
    - [powerpc*] perf: move perf irq/nmi handling details into traps.c
    - [powerpc*] irq: Add helper to set regs->softe
    - [powerpc*] perf: Fix PMU callbacks to clear pending PMI before resetting
      an overflown PMC
    - clocksource: Reduce clocksource-skew threshold
    - clocksource: Avoid accidental unstable marking of clocksources
    - ALSA: oss: fix compile error when OSS_DEBUG is enabled
    - ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID
    - [arm*] binder: fix handling of error during copy
    - [arm64,armhf] iommu/io-pgtable-arm: Fix table descriptor paddr formatting
    - scsi: ufs: Fix race conditions related to driver data
    - RDMA/qedr: Fix reporting max_{send/recv}_wr attrs
    - PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity()
    - RDMA/core: Let ib_find_gid() continue search even after empty entry
    - RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry
    - [x86] ASoC: rt5663: Handle device_property_read_u32_array error codes
    - [amd64] iommu/amd: Remove iommu_init_ga()
    - [amd64] iommu/amd: Restore GA log/tail pointer on host resume
    - [x86] ASoC: Intel: catpt: Test dmaengine_submit() result before moving on
    - iommu/iova: Fix race between FQ timeout and teardown
    - scsi: block: pm: Always set request queue runtime active in
      blk_post_runtime_resume()
    - [powerpc*] xive: Add missing null check after calling kmalloc
    - RDMA/cxgb4: Set queue pair state when being queried
    - of: base: Fix phandle argument length mismatch error message
    - [armhf] dts: omap3-n900: Fix lp5523 for multi color
    - Bluetooth: Fix debugfs entry leak in hci_register_dev()
    - fs: dlm: filter user dlm messages for kernel locks
    - [arm64,armhf] drm/lima: fix warning when CONFIG_DEBUG_SG=y &
      CONFIG_DMA_API_DEBUG=y
    - ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
    - [arm64,armhf] drm/bridge: dw-hdmi: handle ELD when
      DRM_BRIDGE_ATTACH_NO_CONNECTOR
    - drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR
    - batman-adv: allow netlink usage in unprivileged containers
    - ath11k: Fix crash caused by uninitialized TX ring
    - usb: gadget: f_fs: Use stream_open() for endpoint files
    - drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L
    - HID: apple: Do not reset quirks when the Fn key is not found
    - media: b2c2: Add missing check in flexcop_pci_isr:
    - drm/amdgpu/display: set vblank_disable_immediate for DC
    - [arm64,armhf] tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of
      .shutdown()
    - gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
    - [armhf] HSI: core: Fix return freed object in hsi_new_client
    - crypto: jitter - consider 32 LSB for APT
    - rsi: Fix use-after-free in rsi_rx_done_handler()
    - rsi: Fix out-of-bounds read in rsi_read_pkt()
    - ath11k: Avoid NULL ptr access during mgmt tx cleanup
    - [arm64] media: venus: avoid calling core_clk_setrate() concurrently during
      concurrent video sessions
    - [x86] ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present
      table
    - ACPI: Change acpi_device_always_present() into
      acpi_device_override_status()
    - [x86] ACPI / x86: Allow specifying acpi_device_override_status() quirks by
      path
    - [x86] ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on
      the GPD win
    - floppy: Add max size check for user space request
    - [x86] mm: Flush global TLB when switching to trampoline page-table
    - media: saa7146: hexium_orion: Fix a NULL pointer dereference in
      hexium_attach()
    - media: m920x: don't use stack on USB reads
    - [x86] thunderbolt: Runtime PM activate both ends of the device link
    - iwlwifi: mvm: synchronize with FW after multicast commands
    - iwlwifi: mvm: avoid clearing a just saved session protection id
    - ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work
    - ath10k: Fix tx hanging
    - net-sysfs: update the queue counts in the unregistration path
    - net: phy: prefer 1000baseT over 1000baseKX
    - [armhf] gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock
    - ath11k: Avoid false DEADLOCK warning reported by lockdep
    - [x86] mce: Allow instrumentation during task work queueing
    - [x86] mce: Mark mce_panic() noinstr
    - [x86] mce: Mark mce_end() noinstr
    - [x86] mce: Mark mce_read_aux() noinstr
    - net: bonding: debug: avoid printing debug logs when bond is not notifying
      peers
    - bpf: Do not WARN in bpf_warn_invalid_xdp_action()
    - HID: quirks: Allow inverting the absolute X/Y values
    - media: igorplugusb: receiver overflow should be reported
    - media: saa7146: hexium_gemini: Fix a NULL pointer dereference in
      hexium_attach()
    - mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO
    - audit: ensure userspace is penalized the same as the kernel when under
      pressure
    - [arm64] dts: ls1028a-qds: move rtc node to the correct i2c bus
    - PM: runtime: Add safety net to supplier device release
    - cpufreq: Fix initialization of min and max frequency QoS requests
    - usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
    - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
    - rtw88: 8822c: update rx settings to prevent potential hw deadlock
    - iwlwifi: fix leaks/bad data after failed firmware load
    - iwlwifi: remove module loading failure message
    - iwlwifi: mvm: Fix calculation of frame length
    - iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ
    - ath11k: Fix napi related hang
    - Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES
    - xfrm: rate limit SA mapping change message to user space
    - [armhf] drm/etnaviv: consider completed fence seqno in hang check
    - jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
    - ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions
    - ACPICA: Utilities: Avoid deleting the same object twice in a row
    - ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
    - ACPICA: Fix wrong interpretation of PCC address
    - ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5
    - drm/amdgpu: fixup bad vram size on gmc v8
    - ACPI: battery: Add the ThinkPad "Not Charging" quirk
    - btrfs: remove BUG_ON() in find_parent_nodes()
    - btrfs: remove BUG_ON(!eie) in find_parent_nodes
    - net: mdio: Demote probed message to debug print
    - mac80211: allow non-standard VHT MCS-10/11
    - dm btree: add a defensive bounds check to insert_at()
    - dm space map common: add bounds check to sm_ll_lookup_bitmap()
    - net: phy: marvell: configure RGMII delays for 88E1118
    - [arm64] regulator: qcom_smd: Align probe function with rpmh-regulator
    - [arm64,armhf] serial: pl010: Drop CR register reset on set_termios
    - serial: core: Keep mctrl register state and cached copy in sync
    - random: do not throw away excess input to crng_fast_load
    - [powerpc*] powernv: add missing of_node_put
    - [powerpc*] btext: add missing of_node_put
    - [powerpc*] watchdog: Fix missed watchdog reset due to memory ordering race
    - [x86] i2c: i801: Don't silently correct invalid transfer size
    - [powerpc*] smp: Move setup_profiling_timer() under CONFIG_PROFILING
    - [powerpc*] i2c: mpc: Correct I2C reset procedure
    - [arm64] clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB
    - [powerpc*] KVM: PPC: Book3S: Suppress warnings when allocating too big
      memory slots
    - [powerpc*] KVM: PPC: Book3S: Suppress failed alloc warning in
      H_COPY_TOFROM_GUEST
    - w1: Misuse of get_user()/put_user() reported by sparse
    - nvmem: core: set size for sysfs bin file
    - dm: fix alloc_dax error handling in alloc_dev
    - scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup
    - ALSA: seq: Set upper limit of processed events
    - [powerpc*] handle kdump appropriately with crash_kexec_post_notifiers
      option
    - [powerpc*] fadump: Fix inaccurate CPU state info in vmcore generated with
      panic
    - udf: Fix error handling in udf_new_inode()
    - [mips64el,mipsel] OCTEON: add put_device() after of_find_device_by_node()
    - [arm64,armhf] irqchip/gic-v4: Disable redistributors' view of the VPE
      table at boot time
    - [x86] i2c: designware-pci: Fix to change data types of hcnt and lcnt
      parameters
    - scsi: sr: Don't use GFP_DMA
    - [arm64] rpmsg: core: Clean up resources on announce_create failure.
    - [armhf] crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
    - [arm64] crypto: caam - replace this_cpu_ptr with raw_cpu_ptr
    - ubifs: Error path in ubifs_remount_rw() seems to wrongly free write
      buffers
    - tpm: fix NPE on probe for missing device
    - xen/gntdev: fix unmap notification order
    - fuse: Pass correct lend value to filemap_write_and_wait_range()
    - serial: Fix incorrect rs485 polarity on uart open
    - cputime, cpuacct: Include guest time in user time in cpuacct.stat
    - tracing/kprobes: 'nmissed' not showed correctly for kretprobe
    - iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
    - [s390x] mm: fix 2KB pgtable release race
    - device property: Fix fwnode_graph_devcon_match() fwnode leak
    - [armhf] drm/etnaviv: limit submit sizes
    - drm/nouveau/kms/nv04: use vzalloc for nv04_display
    - [arm64,armhf] drm/bridge: analogix_dp: Make PSR-exit block less
    - [powerpc*] 64s/radix: Fix huge vmap false positive
    - [arm64] PCI: xgene: Fix IB window setup
    - PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors
    - [arm*] PCI: pci-bridge-emul: Make expansion ROM Base Address register
      read-only
    - [arm*] PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI
      config space
    - [arm*] PCI: pci-bridge-emul: Fix definitions of reserved bits
    - [arm*] PCI: pci-bridge-emul: Correctly set PCIe capabilities
    - [arm*] PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device
    - xfrm: fix policy lookup for ipv6 gre packets
    - btrfs: fix deadlock between quota enable and other quota operations
    - btrfs: check the root node for uptodate before returning it
    - btrfs: respect the max size in the header when activating swap file
    - ext4: make sure to reset inode lockdep class when quota enabling fails
    - ext4: make sure quota gets properly shutdown on error
    - ext4: fix a possible ABBA deadlock due to busy PA
    - ext4: initialize err_blk before calling __ext4_get_inode_loc
    - ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE
    - ext4: set csum seed in tmp inode while migrating to extents
    - ext4: Fix BUG_ON in ext4_bread when write quota data
    - ext4: use ext4_ext_remove_space() for fast commit replay delete range
    - ext4: fast commit may miss tracking unwritten range during ftruncate
    - ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal
    - ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits'
    - ext4: don't use the orphan list when migrating an inode
    - drm/radeon: fix error handling in radeon_driver_open_kms
    - of: base: Improve argument length mismatch error
    - firmware: Update Kconfig help text for Google firmware
    - [arm*] drm/vc4: hdmi: Make sure the device is powered with CEC
    - Documentation: dmaengine: Correctly describe dmatest with channel unset
    - Documentation: ACPI: Fix data node reference documentation
    - Documentation: refer to config RANDOMIZE_BASE for kernel address-space
      randomization
    - Documentation: fix firewire.rst ABI file path error
    - Bluetooth: hci_sync: Fix not setting adv set duration
    - scsi: core: Show SCMD_LAST in text form
    - [arm64] RDMA/hns: Modify the mapping attribute of doorbell to device
    - RDMA/rxe: Fix a typo in opcode name
    - [armhf] dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK
    - Revert "net/mlx5: Add retry mechanism to the command entry index
      allocation"
    - block: Fix fsync always failed if once failed
    - bpftool: Remove inclusion of utilities.mak from Makefiles
    - xdp: check prog type before updating BPF link
    - ipv4: update fib_info_cnt under spinlock protection
    - ipv4: avoid quadratic behavior in netns dismantle
    - [arm64] net/fsl: xgmac_mdio: Add workaround for erratum A-009885
    - [arm64] net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module
    - f2fs: compress: fix potential deadlock of compress file
    - f2fs: fix to reserve space for IO align feature
    - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
    - clk: Emit a stern warning with writable debugfs enabled
    - net/smc: Fix hung_task when removing SMC-R devices
    - virtio_ring: mark ring unused on error
    - taskstats: Cleanup the use of task->exit_code
    - inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
    - netns: add schedule point in ops_exit_list()
    - xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
    - gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst()
    - libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
    - perf script: Fix hex dump character output
    - perf probe: Fix ppc64 'perf probe add events failed' case
    - devlink: Remove misleading internal_flags from health reporter dump
    - net: bonding: fix bond_xmit_broadcast return value error bug
    - net_sched: restore "mpu xxx" handling
    - [arm64] bcmgenet: add WOL IRQ check
    - net: sfp: fix high power modules without diagnostic monitoring
    - [arm64] net: mscc: ocelot: fix using match before it is set
    - dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix
      property
    - dt-bindings: display: meson-vpu: Add missing amlogic,canvas property
    - dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7
    - mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault
    - mtd: nand: bbt: Fix corner case in bad block table handling
    - ath10k: Fix the MTU size on QCA9377 SDIO
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.95
    - bnx2x: Utilize firmware 7.13.21.0
    - bnx2x: Invalidate fastpath HSI version for VFs
    - rcu: Tighten rcu_advance_cbs_nowake() checks
    - [x86] KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU
    - select: Fix indefinitely sleeping task in poll_schedule_timeout()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.96
    - Bluetooth: refactor malicious adv data check
    - [arm64] media: venus: core: Drop second v4l2 device unregister
    - net: sfp: ignore disabled SFP node
    - net: stmmac: skip only stmmac_ptp_register when resume from suspend
    - [s390x] module: fix loading modules with a lot of relocations
    - [s390x] hypfs: include z/VM guests with access control group set
    - bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()
    - [s390x] scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV
      FCP devices
    - udf: Restore i_lenAlloc when inode expansion fails (CVE-2022-0617)
    - udf: Fix NULL ptr deref when converting from inline format (CVE-2022-0617)
    - efi: runtime: avoid EFIv2 runtime services on Apple x86 machines
    - tracing: Don't inc err_log entry count if entry allocation fails
    - ceph: properly put ceph_string reference after async create attempt
    - ceph: set pool_ns in new inode layout for async creates
    - fsnotify: fix fsnotify hooks in pseudo filesystems
    - Revert "KVM: SVM: avoid infinite loop on NPF from bad address"
    - [x86] perf/x86/intel/uncore: Fix CAS_COUNT_WRITE issue for ICX
    - [armhf] drm/etnaviv: relax submit size limits
    - [x86] KVM: x86: Update vCPU's runtime CPUID on write to MSR_IA32_XSS
    - [arm64] errata: Fix exec handling in erratum 1418040 workaround
    - netfilter: nft_payload: do not update layer 4 checksum when mangling
      fragments
    - serial: 8250: of: Fix mapped region size when using reg-offset property
    - [armhf] serial: stm32: fix software flow control transfer
    - tty: n_gsm: fix SW flow control encoding/handling
    - tty: Add support for Brainboxes UC cards.
    - usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge
    - [arm64,armhf] usb: xhci-plat: fix crash when suspend if remote wake enable
    - [arm64,armhf] usb: common: ulpi: Fix crash in ulpi_match()
    - usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS
    - USB: core: Fix hang in usb_kill_urb by adding memory barriers
    - usb: typec: tcpm: Do not disconnect while receiving VBUS off
    - jbd2: export jbd2_journal_[grab|put]_journal_head
    - ocfs2: fix a deadlock when commit trans
    - sched/membarrier: Fix membarrier-rseq fence command missing from query
      bitmask
    - [x86] MCE/AMD: Allow thresholding interface updates after init
    - i40e: Increase delay to 1 s after global EMP reset
    - i40e: Fix issue when maximum queues is exceeded
    - i40e: Fix queues reservation for XDP
    - i40e: Fix for failed to init adminq while VF reset
    - i40e: fix unsigned stat widths
    - scsi: bnx2fc: Flush destroy_work queue before calling
      bnx2fc_interface_put()
    - ipv6_tunnel: Rate limit warning messages
    - net: fix information leakage in /proc/net/ptype
    - hwmon: (lm90) Mark alert as broken for MAX6646/6647/6649
    - hwmon: (lm90) Mark alert as broken for MAX6680
    - ping: fix the sk_bound_dev_if match in ping_lookup
    - ipv4: avoid using shared IP generator for connected sockets
    - hwmon: (lm90) Reduce maximum conversion rate for G781
    - NFSv4: nfs_atomic_open() can race when looking up a non-regular file
    - net-procfs: show net devices bound packet types
    - [arm64] drm/msm: Fix wrong size calculation
    - [arm64] drm/msm/dsi: Fix missing put_device() call in dsi_get_phy
    - [arm64] drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable
    - ipv6: annotate accesses to fn->fn_sernum
    - NFS: Ensure the server has an up to date ctime before hardlinking
    - NFS: Ensure the server has an up to date ctime before renaming
    - [powerpc*] powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA
      v2.06
    - netfilter: conntrack: don't increment invalid counter on NF_REPEAT
    - kernel: delete repeated words in comments
    - perf: Fix perf_event_read_local() time
    - sched/pelt: Relax the sync of util_sum with util_avg
    - net: phy: broadcom: hook up soft_reset for BCM54616S
    - phylib: fix potential use-after-free
    - rxrpc: Adjust retransmission backoff
    - [arm64] efi/libstub: arm64: Fix image check alignment at entry
    - hwmon: (lm90) Mark alert as broken for MAX6654
    - [powerpc*] perf: Fix power_pmu_disable to call clear_pmi_irq_pending only
      if PMI is pending
    - net: ipv4: Move ip_options_fragment() out of loop
    - net: ipv4: Fix the warning for dereference
    - ipv4: fix ip option filtering for locally generated fragments
    - [x86] video: hyperv_fb: Fix validation of screen resolution
    - [arm64] drm/msm/hdmi: Fix missing put_device() call in msm_hdmi_get_phy
    - [arm64] drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc
    - [armhf] net: cpsw: Properly initialise struct page_pool_params
    - [arm64] net: hns3: handle empty unknown interrupt for VF
    - Revert "ipv6: Honor all IPv6 PIO Valid Lifetime values"
    - net: bridge: vlan: fix single net device option dumping
    - ipv4: raw: lock the socket in raw_bind()
    - ipv4: tcp: send zero IPID in SYNACK messages
    - ipv4: remove sparse error in ip_neigh_gw4()
    - net: bridge: vlan: fix memory leak in __allowed_ingress
    - dt-bindings: can: tcan4x5x: fix mram-cfg RX FIFO config
    - fsnotify: invalidate dcache before IN_DELETE event
    - block: Fix wrong offset in bio_truncate()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.97
    - PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
    - [x86] KVM: x86: Forcibly leave nested virt when SMM state is toggled
    - psi: Fix uaf issue when psi trigger is destroyed while being polled
    - [x86] mce: Add Xeon Sapphire Rapids to list of CPUs that support PPIN
    - [x86] cpu: Add Xeon Icelake-D to list of CPUs that support PPIN
    - [arm*] drm/vc4: hdmi: Make sure the device is powered with CEC
    - cgroup-v1: Require capabilities to set release_agent (CVE-2022-0492)
    - net/mlx5e: Fix handling of wrong devices during bond netevent
    - net/mlx5: Use del_timer_sync in fw reset flow of halting poll
    - net/mlx5: E-Switch, Fix uninitialized variable modact
    - ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback
    - [amd64,arm64] net: amd-xgbe: ensure to reset the tx_timer_active flag
    - [amd64,arm64] net: amd-xgbe: Fix skb data length underflow
    - fanotify: Fix stale file descriptor in copy_event_to_user()
    - net: sched: fix use-after-free in tc_new_tfilter()
    - rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
    - cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask()
    - af_packet: fix data-race in packet_setsockopt / packet_setsockopt
    - tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.98
    - [arm*] Revert "drm/vc4: hdmi: Make sure the device is powered with CEC"
    - [arm*] Revert "drm/vc4: hdmi: Make sure the device is powered with CEC"
      again
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.99
    - selinux: fix double free of cond_list on error paths
    - audit: improve audit queue handling when "audit=1" on cmdline
    - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
    - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()
    - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx()
    - ALSA: usb-audio: Correct quirk for VF0770
    - ALSA: hda: Fix UAF of leds class devs at unbinding
    - ALSA: hda: realtek: Fix race at concurrent COEF updates
    - ALSA: hda/realtek: Add quirk for ASUS GU603
    - ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220
      quirks
    - ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer
      chipset)
    - ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after
      reboot from Windows
    - btrfs: fix deadlock between quota disable and qgroup rescan worker
    - drm/nouveau: fix off by one in BIOS boundary checking
    - mm/pgtable: define pte_index so that preprocessor could recognize it
    - block: bio-integrity: Advance seed correctly for larger interval sizes
    - dma-buf: heaps: Fix potential spectre v1 gadget
    - [amd64] IB/hfi1: Fix AIP early init panic
    - memcg: charge fs_context and legacy_fs_context
    - RDMA/cma: Use correct address when leaving multicast group
    - RDMA/ucma: Protect mc during concurrent multicast leaves
    - [amd64] IB/rdmavt: Validate remote_addr during loopback atomic tests
    - RDMA/mlx4: Don't continue event handler after memory allocation failure
    - [amd64] iommu/vt-d: Fix potential memory leak in
      intel_setup_irq_remapping()
    - [amd64] iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
    - [arm64,armhf] spi: meson-spicc: add IRQ check in meson_spicc_probe
    - net: ieee802154: hwsim: Ensure proper channel selection at probe time
    - net: ieee802154: Return meaningful error codes from the netlink helpers
    - net: macsec: Fix offload support for NETDEV_UNREGISTER event
    - net: macsec: Verify that send_sci is on when setting Tx sci explicitly
    - net: stmmac: dump gmac4 DMA registers correctly
    - net: stmmac: ensure PTP time register reads are consistent
    - [x86] drm/i915/overlay: Prevent divide by zero bugs in scaling
    - [x86] pinctrl: intel: Fix a glitch when updating IRQ flags on a
      preconfigured line
    - [x86] pinctrl: intel: fix unexpected interrupt
    - [arm*] pinctrl: bcm2835: Fix a few error paths
    - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
    - nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client.
    - [amd64,arm64] gve: fix the wrong AdminQ buffer queue index check
    - bpf: Use VM_MAP instead of VM_ALLOC for ringbuf
    - rtc: cmos: Evaluate century appropriate
    - Revert "fbcon: Disable accelerated scrolling"
    - fbcon: Add option to enable legacy hardware acceleration
    - perf stat: Fix display of grouped aliased events
    - [x86] perf/x86/intel/pt: Fix crash with stop filters in single-range mode
    - [x86] perf: Default set FREEZE_ON_SMI for all
    - [arm64] EDAC/xgene: Fix deferred probing
    - ext4: prevent used blocks from being allocated during fast commit replay
    - ext4: modify the logic of ext4_mb_new_blocks_simple
    - ext4: fix error handling in ext4_restore_inline_data()
    - ext4: fix error handling in ext4_fc_record_modified_inode()
    - ext4: fix incorrect type issue during replay_del_range
    - cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.100
    - moxart: fix potential use-after-free on remove path (CVE-2022-0487)
    - crypto: api - Move cryptomgr soft dependency into algapi
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.101
    - integrity: check the return value of audit_log_start()
    - [arm64] mmc: sdhci-of-esdhc: Check for error num after setting mask
    - can: isotp: fix potential CAN frame reception race in isotp_rcv()
    - net: phy: marvell: Fix RGMII Tx/Rx delays setting in 88e1121-compatible
      PHYs
    - net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs
    - NFS: Fix initialisation of nfs_client cl_flags field
    - NFSD: Clamp WRITE offsets
    - NFSD: Fix offset type in I/O trace points
    - drm/amdgpu: Set a suitable dev_info.gart_page_size (Closes: #990279)
    - NFS: change nfs_access_get_cached to only report the mask
    - NFSv4 only print the label when its queried
    - nfs: nfs4clinet: check the return value of kstrdup()
    - NFSv4.1: Fix uninitialised variable in devicenotify
    - NFSv4 remove zero number of fs_locations entries error check
    - NFSv4 expose nfs_parse_server_name function
    - NFSv4 handle port presence in fs_location server string
    - [x86] perf: Avoid warning for Arch LBR without XSAVE
    - drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer
    - net: sched: Clarify error message when qdisc kind is unknown
    - [powerpc*] fixmap: Fix VM debug warning on unmap
    - scsi: target: iscsi: Make sure the np under each tpg is unique
    - scsi: qedf: Add stag_work to all the vports
    - scsi: qedf: Fix refcount issue when LOGO is received during TMF
    - scsi: pm8001: Fix bogus FW crash for maxcpus=1
    - scsi: ufs: Treat link loss as fatal error
    - scsi: myrs: Fix crash in error case
    - PM: hibernate: Remove register_nosave_region_late()
    - [arm*] usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend
    - perf: Always wake the parent event
    - nvme-pci: add the IGNORE_DEV_SUBNQN quirk for Intel P4500/P4600 SSDs
    - [arm64,armhf] net: stmmac: dwmac-sun8i: use return val of
      readl_poll_timeout()
    - KVM: eventfd: Fix false positive RCU usage warning
    - [x86] KVM: nVMX: eVMCS: Filter out VM_EXIT_SAVE_VMX_PREEMPTION_TIMER
    - [x86] KVM: nVMX: Also filter MSR_IA32_VMX_TRUE_PINBASED_CTLS when eVMCS
    - [x86] KVM: SVM: Don't kill SEV guest if SMAP erratum triggers in usermode
    - [x86] KVM: VMX: Set vmcs.PENDING_DBG.BS on #DB in STI/MOVSS blocking
      shadow
    - nvme-tcp: fix bogus request completion when failing to send AER
    - [arm64] ACPI/IORT: Check node revision for PMCG resources
    - PM: s2idle: ACPI: Fix wakeup interrupts handling
    - [arm64,armhf] drm/rockchip: vop: Correct RK3399 VOP register fields
    - [armhf] ARM: dts: Fix timer regression for beagleboard revision c
    - usb: f_fs: Fix use-after-free for epfile
    - [arm*] drm/vc4: hdmi: Allow DBLCLK modes even if horz timing is odd.
    - netfilter: ctnetlink: disable helper autoassign
    - ixgbevf: Require large buffers for build_skb on 82599VF
    - [arm64,armhf] drm/panel: simple: Assign data from panel_dpi_probe()
      correctly
    - ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE
    - bonding: pair enable_port with slave_arr_updates
    - [arm64,armhf] net: dsa: mv88e6xxx: don't use devres for mdiobus
    - [armhf] net: dsa: bcm_sf2: don't use devres for mdiobus
    - [arm64] net: dsa: felix: don't use devres for mdiobus
    - ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure
      path
    - nfp: flower: fix ida_idx not being released
    - net: do not keep the dst cache when uncloning an skb dst and its metadata
    - net: fix a memleak when uncloning an skb dst and its metadata
    - veth: fix races around rq->rx_notify_masked
    - [armhf] net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE
    - tipc: rate limit warning for received illegal binding update
    - [amd64,arm64] net: amd-xgbe: disable interrupts during pci removal
    - [arm64] dpaa2-eth: unregister the netdev before disconnecting from the PHY
    - ice: fix an error code in ice_cfg_phy_fec()
    - ice: fix IPIP and SIT TSO offload
    - [arm64] net: mscc: ocelot: fix mutex lock error during ethtool stats read
    - [arm64,armhf] net: dsa: mv88e6xxx: fix use-after-free in
      mv88e6xxx_mdios_unregister
    - vt_ioctl: fix array_index_nospec in vt_setactivate
    - vt_ioctl: add array_index_nospec to VT_ACTIVATE
    - n_tty: wake up poll(POLLRDNORM) on receiving data
    - eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
    - [arm*] usb: dwc2: drd: fix soft connect when gadget is unconfigured
    - [arm*] Revert "usb: dwc2: drd: fix soft connect when gadget is
      unconfigured"
    - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
    - [arm64,armhf] usb: ulpi: Move of_node_put to ulpi_dev_release
    - [arm64,armhf] usb: ulpi: Call of_node_put correctly
    - [arm64,armhf] usb: dwc3: gadget: Prevent core from processing stale TRBs
    - usb: gadget: f_uac2: Define specific wTerminalType
    - USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320
    - USB: serial: option: add ZTE MF286D modem
    - USB: serial: ch341: add support for GW Instek USB2.0-Serial devices
    - USB: serial: cp210x: add NCR Retail IO box id
    - USB: serial: cp210x: add CPI Bulk Coin Recycler id
    - speakup-dectlk: Restore pitch setting
    - [x86] hwmon: (dell-smm) Speed up setting of fan speed
    - can: isotp: fix error path in isotp_sendmsg() to unlock wait queue
    - scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled
    - scsi: lpfc: Reduce log messages seen after firmware download
    - perf: Fix list corruption in perf_cgroup_switch()
    - iommu: Fix potential use-after-free during probe
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.102
    - drm/nouveau/pmu/gm200-: use alternate falcon reset sequence
    - mm: memcg: synchronize objcg lists with a dedicated spinlock
    - rcu: Do not report strict GPs for outgoing CPUs
    - fget: clarify and improve __fget_files() implementation
    - fs/proc: task_mmu.c: don't read mapcount for migration entry
    - can: isotp: prevent race between isotp_bind() and isotp_setsockopt()
    - can: isotp: add SF_BROADCAST support for functional addressing
    - scsi: lpfc: Fix mailbox command failure during driver initialization
    - HID:Add support for UGTABLET WP5540
    - [x86] Revert "svm: Add warning message for AVIC IPI invalid target"
    - mmc: block: fix read single on recovery logic
    - mm: don't try to NUMA-migrate COW pages that have other uses
    - [amd64] PCI: hv: Fix NUMA node assignment when kernel boots with custom
      NUMA topology
    - btrfs: send: in case of IO error log it
    - net: ieee802154: at86rf230: Stop leaking skb's
    - ax25: improve the incomplete fix to avoid UAF and NPD bugs
    - vfs: make freeze_super abort when sync_filesystem returns error
    - quota: make dquot_quota_sync return errors from ->sync_fs
    - scsi: pm8001: Fix use-after-free for aborted TMF sas_task
    - scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
    - nvme: fix a possible use-after-free in controller reset during load
    - nvme-tcp: fix possible use-after-free in transport error_recovery work
    - nvme-rdma: fix possible use-after-free in transport error_recovery work
    - drm/amdgpu: fix logic inversion in check
    - [amd64] x86/Xen: streamline (and fix) PV CPU enumeration
    - Revert "module, async: async_synchronize_full() on module init iff async
      is used"
    - random: wake up /dev/random writers after zap
    - iwlwifi: fix use-after-free
    - drm/radeon: Fix backlight control on iMac 12,1
    - [x86] drm/i915/opregion: check port number bounds for SWSCI display power
      state
    - vsock: remove vsock from connected table when connect is interrupted by a
      signal
    - [x86] drm/i915/gvt: Make DRM_I915_GVT depend on X86
    - iwlwifi: pcie: fix locking when "HW not ready"
    - iwlwifi: pcie: gen2: fix locking when "HW not ready"
    - netfilter: nft_synproxy: unregister hooks on init error path
    - ipv6: per-netns exclusive flowlabel checks
    - net: dsa: lantiq_gswip: fix use after free in gswip_remove()
    - ping: fix the dif and sdif check in ping_lookup
    - bonding: force carrier update when releasing slave
    - drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
    - net_sched: add __rcu annotation to netdev->qdisc
    - bonding: fix data-races around agg_select_timer
    - libsubcmd: Fix use-after-free for realloc(..., 0)
    - [arm64] dpaa2-eth: Initialize mutex used in one step timestamping path
    - ALSA: hda/realtek: Add quirk for Legion Y9000X 2019
    - ALSA: hda/realtek: Fix deadlock by COEF mutex
    - ALSA: hda: Fix regression on forced probe mask option
    - ALSA: hda: Fix missing codec probe on Shenker Dock 15
    - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw()
    - ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range()
    - [powerpc*[ lib/sstep: fix 'ptesync' build error
    - [armhf] mtd: rawnand: gpmi: don't leak PM reference in error path
    - [x86] KVM: SVM: Never reject emulation due to SMAP errata for !SEV guests
      (CVE-2020-36310)
    - block/wbt: fix negative inflight counter when remove scsi device
    - NFS: LOOKUP_DIRECTORY is also ok with symlinks
    - NFS: Do not report writeback errors in nfs_getattr()
    - tty: n_tty: do not look ahead for EOL character past the end of the buffer
    - [x86] Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
    - [x86] KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id()
    - [x86] KVM: x86/pmu: Don't truncate the PerfEvtSeln MSR when creating a
      perf event
    - [x86] KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
    - NFS: Don't set NFS_INO_INVALID_XATTR if there is no xattr cache
    - [armhf] OMAP2+: hwmod: Add of_node_put() before break
    - [armhf] OMAP2+: adjust the location of put_device() call in
      omapdss_init_of
    - netfilter: conntrack: don't refresh sctp entries in closed state
    - kconfig: let 'shell' return enough output for deep path names
    - ata: libata-core: Disable TRIM on M88V29
    - [armhf] soc: aspeed: lpc-ctrl: Block error printing on probe defer cases
    - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
    - [arm64,armhf] drm/rockchip: dw_hdmi: Do not leave clock enabled in error
      case
    - tracing: Fix tp_printk option related with tp_printk_stop_on_boot
    - net: usb: qmi_wwan: Add support for Dell DW5829e
    - [arm64] net: macb: Align the dma and coherent dma masks
    - kconfig: fix failing to generate auto.conf
    - scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop
    - EDAC: Fix calculation of returned address and next offset in
      edac_align_ptr()
    - net: sched: limit TC_ACT_REPEAT loops
    - [armhf] dmaengine: stm32-dmamux: Fix PM disable depth imbalance in
      stm32_dmamux_probe
    - copy_process(): Move fd_install() out of sighand->siglock critical section
    - [arm*] i2c: brcmstb: fix support for DSL and CM variants
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.103
    - cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug
    - btrfs: tree-checker: check item_size for inode_item
    - btrfs: tree-checker: check item_size for dev_item
    - vhost/vsock: don't check owner in vhost_vsock_stop() while releasing
    - [x86] KVM: x86/mmu: make apf token non-zero to fix bug
    - drm/amdgpu: disable MMHUB PG for Picasso
    - [x86] drm/i915: Correctly populate use_sagv_wm for all pipes
    - sr9700: sanity check for packet length
    - USB: zaurus: support another broken Zaurus
    - CDC-NCM: avoid overflow in sanity checking
    - netfilter: nf_tables_offload: incorrect flow offload action array size
      (CVE-2022-25636)
    - [x86] fpu: Correct pkru/xstate inconsistency
    - [arm64] tee: export teedev_open() and teedev_close_context()
    - [arm64] optee: use driver internal tee_context for some rpc
    - ping: remove pr_err from ping_lookup
    - perf data: Fix double free in perf_session__delete()
    - bnx2x: fix driver load from initrd
    - bnxt_en: Fix active FEC reporting to ethtool
    - hwmon: Handle failure to register sensor with thermal zone correctly
    - bpf: Do not try bpf_msg_push_data with len 0
    - bpf: Add schedule points in batch ops
    - io_uring: add a schedule point in io_add_buffers()
    - net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends
    - tipc: Fix end of loop tests for list_for_each_entry()
    - gso: do not skip outer ip header in case of ipip and net_failover
    - openvswitch: Fix setting ipv6 fields causing hw csum failure
    - drm/edid: Always set RGB444
    - net/mlx5e: Fix wrong return value on ioctl EEPROM query failure
    - net/sched: act_ct: Fix flow table lookup after ct clear or switching zones
    - net: Force inlining of checksum functions in net/checksum.h
    - nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()
    - netfilter: nf_tables: fix memory leak during stateful obj update
    - net/smc: Use a mutex for locking "struct smc_pnettable"
    - udp_tunnel: Fix end of loop test in udp_tunnel_nic_unregister()
    - net/mlx5: Fix possible deadlock on rule deletion
    - net/mlx5: Fix wrong limitation of metadata match on ecpf
    - net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets
    - regmap-irq: Update interrupt clear register for proper reset
    - configfs: fix a race in configfs_{,un}register_subsystem()
    - RDMA/ib_srp: Fix a deadlock
    - tracing: Have traceon and traceoff trigger honor the instance
    - iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits
    - iio: imu: st_lsm6dsx: wait for settling time in st_lsm6dsx_read_oneshot
    - iio: Fix error handling for PM
    - ata: pata_hpt37x: disable primary channel on HPT371
    - Revert "USB: serial: ch341: add new Product ID for CH341A"
    - usb: gadget: rndis: add spinlock for rndis response list
    - tracefs: Set the group ownership in apply_options() not parse_options()
    - USB: serial: option: add support for DW5829e
    - USB: serial: option: add Telit LE910R1 compositions
    - [arm*] usb: dwc2: drd: fix soft connect when gadget is unconfigured
    - [arm64] usb: dwc3: pci: Fix Bay Trail phy GPIO mappings
    - [arm64,armhf] usb: dwc3: gadget: Let the interrupt handler disable bottom
      halves.
    - xhci: re-initialize the HC during resume if HCE was set
    - xhci: Prevent futile URB re-submissions due to incorrect return value.
    - driver core: Free DMA range map when device is released
    - RDMA/cma: Do not change route.addr.src_addr outside state checks
    - [x86] thermal: int340x: fix memory leak in int3400_notify()
    - tty: n_gsm: fix encoding of control signal octet bit DV
    - tty: n_gsm: fix proper link termination after failed open
    - tty: n_gsm: fix NULL pointer access due to DLCI release
    - tty: n_gsm: fix wrong tty control line for flow control
    - tty: n_gsm: fix deadlock in gsmtty_open()
    - memblock: use kfree() to release kmalloced memblock regions

  [ Salvatore Bonaccorso ]
  * Refresh "Makefile: Do not check for libelf when building OOT module"
  * Bump ABI to 12
  * Refresh "firmware: Remove redundant log messages from drivers"
  * [rt] Refresh "locking/rtmutex: add sleeping lock implementation"
  * [rt] Refresh "cpuset: Convert callback_lock to raw_spinlock_t"
  * [rt] Update to 5.10.100-rt62
  * Mitigate Spectre v2-type Branch History Buffer attacks (CVE-2022-0001,
    CVE-2022-0002)
    - [x86] bugs: Unconditionally allow spectre_v2=retpoline,amd
    - [x86] speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
    - [x86] speculation: Add eIBRS + Retpoline options
    - Documentation/hw-vuln: Update spectre doc
    - [x86] speculation: Include unprivileged eBPF status in Spectre v2
      mitigation reporting
    - [x86] speculation: Use generic retpoline by default on AMD
    - [x86] speculation: Update link to AMD speculation whitepaper
    - [x86] speculation: Warn about Spectre v2 LFENCE mitigation
    - [x86] speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 07 Mar 2022 22:06:21 +0100

linux (5.10.92-2) bullseye-security; urgency=high

  * lib/iov_iter: initialize "flags" in new pipe_buffer
  * [x86] mwifiex: Fix skb_over_panic in mwifiex_usb_recv() (CVE-2021-43976)
  * [x86] drm/i915: Flush TLBs before releasing backing store (CVE-2022-0330)
  * [x86] drm/vmwgfx: Fix stale file descriptors on failed usercopy
    (CVE-2022-22942)
  * NFSv4: Handle case where the lookup of a directory fails (CVE-2022-24448)
  * yam: fix a memory leak in yam_siocdevprivate() (CVE-2022-24959)
  * tipc: improve size validations for received domain records (CVE-2022-0435)
  * [s390x] KVM: s390: Return error on SIDA memop on normal guest
    (CVE-2022-0516)
  * USB: gadget: validate interface OS descriptor requests (CVE-2022-25258)
  * usb: gadget: rndis: check size of RNDIS_MSG_SET command (CVE-2022-25375)

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 28 Feb 2022 12:23:03 +0100

linux (5.10.92-1) bullseye-security; urgency=high

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.85
    - usb: gadget: uvc: fix multiple opens
    - gcc-plugins: simplify GCC plugin-dev capability test
    - gcc-plugins: fix gcc 11 indigestion with plugins...
    - HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
    - HID: add hid_is_usb() function to make it simpler for USB detection
    - HID: bigbenff: prevent null pointer dereference
    - HID: wacom: fix problems when device is not a valid USB device
    - HID: check for valid USB device for many HID drivers
    - [amd64] nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six
      8-bit groups
    - [amd64] IB/hfi1: Insure use of smp_processor_id() is preempt disabled
    - [amd64] IB/hfi1: Fix early init panic
    - [amd64] IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr
    - can: kvaser_usb: get CAN clock frequency from device
    - [x86] can: sja1000: fix use after free in ems_pcmcia_add_card()
    - drm/amdgpu: move iommu_resume before ip init/resume
    - drm/amdgpu: init iommu after amdkfd device init
    - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
    - vrf: don't run conntrack on vrf with !dflt qdisc
    - bpf, x86: Fix "no previous prototype" warning
    - bpf: Fix the off-by-two error in range markings
    - ice: ignore dropped packets during init
    - bonding: make tx_rebalance_counter an atomic
    - nfp: Fix memory leak in nfp_cpp_area_cache_add()
    - seg6: fix the iif in the IPv6 socket control block
    - udp: using datalen to cap max gso segments
    - netfilter: conntrack: annotate data-races around ct->timeout
    - iavf: restore MSI state on reset
    - iavf: Fix reporting when setting descriptor count
    - [amd64] IB/hfi1: Correct guard on eager buffer deallocation
    - devlink: fix netns refcount leak in devlink_nl_cmd_reload()
    - net/sched: fq_pie: prevent dismantle issue
    - [x86] KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB
      flush hypercall
    - mm: bdi: initialize bdi_min_ratio when bdi is unregistered
    - ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform
    - ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1
    - ALSA: pcm: oss: Fix negative period/buffer sizes
    - ALSA: pcm: oss: Limit the period size to 16MB
    - ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
    - scsi: qla2xxx: Format log strings only if needed
    - btrfs: clear extent buffer uptodate when we fail to write it
    - btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling
    - md: fix update super 1.0 on rdev size change
    - nfsd: fix use-after-free due to delegation race (Closes: #988044)
    - nfsd: Fix nsfd startup race (again)
    - tracefs: Have new files inherit the ownership of their parent
    - [arm64] clk: qcom: regmap-mux: fix parent clock lookup
    - drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence.
    - [i386] can: pch_can: pch_can_rx_normal: fix use after free
    - libata: add horkage for ASMedia 1092
    - wait: add wake_up_pollfree()
    - binder: use wake_up_pollfree()
    - signalfd: use wake_up_pollfree()
    - aio: keep poll requests on waitqueue until completed
    - aio: fix use-after-free due to missing POLLFREE handling
    - [arm64,armhf] net: mvpp2: fix XDP rx queues registering
    - tracefs: Set all files to the same group ownership as the mount option
    - block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
    - scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()
    - scsi: scsi_debug: Fix buffer size of REPORT ZONES command
    - qede: validate non LSO skb length
    - PM: runtime: Fix pm_runtime_active() kerneldoc comment
    - ASoC: rt5682: Fix crash due to out of scope stack vars
    - [arm64] RDMA/hns: Do not halt commands during reset until later
    - [arm64] RDMA/hns: Do not destroy QP resources in the hw resetting phase
    - i40e: Fix failed opcode appearing if handling messages from VF
    - i40e: Fix pre-set max number of queues for VF
    - i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
    - [arm64] Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on
      emulated bridge"
    - Documentation/locking/locktypes: Update migrate_disable() bits.
    - dt-bindings: net: Reintroduce PHY no lane swap binding
    - net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
    - [arm64,armhf] net: fec: only clear interrupt of handling queue in
      fec_enet_rx_queue()
    - net, neigh: clear whole pneigh_entry at alloc time
    - net/qla3xxx: fix an error code in ql_adapter_up()
    - USB: gadget: detect too-big endpoint 0 requests (CVE-2021-39685)
    - USB: gadget: zero allocate endpoint 0 buffers (CVE-2021-39685)
    - usb: core: config: fix validation of wMaxPacketValue entries
    - xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime
      suspending
    - usb: core: config: using bit mask instead of individual bits
    - xhci: avoid race between disable slot command and host runtime suspend
    - iio: gyro: adxrs290: fix data signedness
    - iio: trigger: Fix reference counting
    - iio: stk3310: Don't return error code in interrupt handler
    - iio: mma8452: Fix trigger reference couting
    - iio: ltr501: Don't return error code in trigger handler
    - iio: kxsd9: Don't return error code in trigger handler
    - iio: itg3200: Call iio_trigger_notify_done() on error
    - iio: adc: axp20x_adc: fix charging current reporting on AXP22x
    - iio: ad7768-1: Call iio_trigger_notify_done() on error
    - iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
    - [armhf] irqchip/aspeed-scu: Replace update_bits with write_bits.
    - [armhf] irqchip/armada-370-xp: Fix return value of
      armada_370_xp_msi_alloc()
    - [armhf] irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
    - [arm64,armhf] irqchip/irq-gic-v3-its.c: Force synchronisation when issuing
      INVALL
    - kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc
    - doc: gcc-plugins: update gcc-plugins.rst
    - MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal
    - Documentation/Kbuild: Remove references to gcc-plugin.sh
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.86
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.87
    - nfc: fix segfault in nfc_genl_dump_devices_done
    - [arm64] drm/msm/dsi: set default num_data_lanes
    - [arm64] KVM: arm64: Save PSTATE early on exit
    - [arm64] Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
    - net/mlx4_en: Update reported link modes for 1/10G
    - ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
    - ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P
    - [arm64,armhf] i2c: rk3x: Handle a spurious start completion interrupt flag
    - net: netlink: af_netlink: Prevent empty skb by adding a check on len.
    - [x86] KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse IPI
      req
    - bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc
    - fuse: make sure reclaim doesn't write the inode
    - [x86] hwmon: (dell-smm) Fix warning on /proc/i8k creation error
    - ethtool: do not perform operations on net devices being unregistered
    - [armel,armhf] memblock: free_unused_memmap: use pageblock units instead of
      MAX_ORDER
    - [armel,armhf] memblock: align freed memory map on pageblock boundaries
      with SPARSEMEM
    - memblock: ensure there is no overflow in memblock_overlaps_region()
    - [armel,armhf] arm: extend pfn_valid to take into account freed memory map
      alignment
    - [armel,armhf] arm: ioremap: don't abuse pfn_valid() to check if pfn is in
      RAM
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.88
    - KVM: downgrade two BUG_ONs to WARN_ON_ONCE
    - mac80211: fix regression in SSN handling of addba tx
    - mac80211: mark TX-during-stop for TX in in_reconfig
    - mac80211: send ADDBA requests using the tid/queue of the aggregation
      session
    - mac80211: validate extended element ID is present
    - bpf: Fix signed bounds propagation after mov32
    - bpf: Make 32->64 bounds propagation slightly more robust
    - virtio_ring: Fix querying of maximum DMA mapping size for virtio device
    - dm btree remove: fix use after free in rebalance_children()
    - audit: improve robustness of the audit queue handling
    - [arm64] dts: imx8mp-evk: Improve the Ethernet PHY description
    - [arm64] dts: rockchip: fix rk3308-roc-cc vcc-sd supply
    - [arm64] dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
    - mac80211: track only QoS data frames for admission control
    - ceph: fix duplicate increment of opened_inodes metric
    - ceph: initialize pathlen variable in reconnect_caps_cb
    - [armhf] socfpga: dts: fix qspi node compatible
    - clk: Don't parent clks until the parent is fully registered
    - [armhf] soc: imx: Register SoC device only on i.MX boards
    - virtio/vsock: fix the transport to work with VMADDR_CID_ANY
    - [s390x] kexec_file: fix error handling when applying relocations
    - sch_cake: do not call cake_destroy() from cake_init()
    - inet_diag: fix kernel-infoleak for UDP sockets
    - [arm64] net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
    - net/sched: sch_ets: don't remove idle classes from the round-robin list
    - drm/ast: potential dereference of null pointer
    - mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock
    - mac80211: fix lookup when adding AddBA extension element
    - flow_offload: return EOPNOTSUPP for the unsupported mpls action type
    - rds: memory leak in __rds_conn_create() (CVE-2021-45480)
    - [arm64,armhf] soc/tegra: fuse: Fix bitwise vs. logical OR warning
    - igb: Fix removal of unicast MAC filters of VFs
    - igbvf: fix double free in `igbvf_probe`
    - igc: Fix typo in i225 LTR functions
    - ixgbe: Document how to enable NBASE-T support
    - ixgbe: set X550 MDIO speed before talking to PHY
    - netdevsim: Zero-initialize memory for new map's value in function
      nsim_bpf_map_alloc (CVE-2021-4135)
    - net/packet: rx_owner_map depends on pg_vec
    - sfc_ef100: potential dereference of null pointer
    - net: Fix double 0x prefix print in SKB dump
    - net/smc: Prevent smc_release() from long blocking
    - sit: do not call ipip6_dev_free() from sit_init_net()
    - USB: gadget: bRequestType is a bitfield, not a enum
    - Revert "usb: early: convert to readl_poll_timeout_atomic()"
    - [x86] KVM: x86: Drop guest CPUID check for host initiated writes to
      MSR_IA32_PERF_CAPABILITIES
    - [x86] tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous
    - USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04)
    - [arm*] usb: dwc2: fix STM ID/VBUS detection startup delay in
      dwc2_driver_probe
    - PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
    - PCI/MSI: Mask MSI-X vectors only on success
    - usb: xhci: Extend support for runtime power management for AMD's Yellow
      carp.
    - USB: serial: cp210x: fix CP2105 GPIO registration
    - USB: serial: option: add Telit FN990 compositions
    - btrfs: fix memory leak in __add_inode_ref()
    - btrfs: fix double free of anon_dev after failure to create subvolume
    - zonefs: add MODULE_ALIAS_FS
    - iocost: Fix divide-by-zero on donation from low hweight cgroup
    - [x86] serial: 8250_fintek: Fix garbled text for console
    - timekeeping: Really make sure wall_to_monotonic isn't positive
    - libata: if T_LENGTH is zero, dma direction should be DMA_NONE
    - drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE
    - Input: touchscreen - avoid bitwise vs logical OR warning
    - xsk: Do not sleep in poll() when need_wakeup set
    - media: mxl111sf: change mutex_init() location
    - fuse: annotate lock in fuse_reverse_inval_entry()
    - ovl: fix warning in ovl_create_real()
    - scsi: scsi_debug: Don't call kcalloc() if size arg is zero
    - scsi: scsi_debug: Fix type in min_t to avoid stack OOB
    - scsi: scsi_debug: Sanity check block descriptor length in
      resp_mode_select()
    - rcu: Mark accesses to rcu_state.n_force_qs
    - [armhf] bus: ti-sysc: Fix variable set but not used warning for
      reinit_modules
    - Revert "xsk: Do not sleep in poll() when need_wakeup set"
    - xen/blkfront: harden blkfront against event channel storms
      (CVE-2021-28711)
    - xen/netfront: harden netfront against event channel storms
      (CVE-2021-28712)
    - xen/console: harden hvc_xen against event channel storms (CVE-2021-28713)
    - xen/netback: fix rx queue stall detection (CVE-2021-28714)
    - xen/netback: don't queue unlimited number of packages (CVE-2021-28715)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.89
    - net: usb: lan78xx: add Allied Telesis AT29M2-AF
    - ext4: prevent partial update of the extent blocks
    - ext4: check for out-of-order index extents in ext4_valid_extent_entries()
    - ext4: check for inconsistent extents between index and leaf block
    - HID: holtek: fix mouse probing
    - [arm64] dts: allwinner: orangepi-zero-plus: fix PHY mode
    - [arm64] spi: change clk_disable_unprepare to clk_unprepare
    - [amd64] IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
    - [arm64] RDMA/hns: Replace kfree() with kvfree()
    - netfilter: fix regression in looped (broad|multi)cast's MAC handling
    - qlcnic: potential dereference null pointer of rx_queue->page_ring
    - net: accept UFOv6 packages in virtio_net_hdr_to_skb
    - net: skip virtio_net_hdr_set_proto if protocol already set
    - igb: fix deadlock caused by taking RTNL in RPM resume path
    - ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
    - bonding: fix ad_actor_system option setting to default
    - [amd64] fjes: Check for error irq
    - [armhf] drivers: net: smc911x: Check for error irq
    - sfc: Check null pointer of rx_queue->page_ring
    - sfc: falcon: Check null pointer of rx_queue->page_ring
    - Input: elantech - fix stack out of bound access in
      elantech_change_report_id()
    - [arm*] pinctrl: bcm2835: Change init order for gpio hogs
    - hwmon: (lm90) Fix usage of CONFIG2 register in detect function
    - hwmon: (lm90) Add basic support for TI TMP461
    - hwmon: (lm90) Introduce flag indicating extended temperature support
    - hwmon: (lm90) Drop critical attribute support for MAX6654
    - ALSA: jack: Check the return value of kstrdup()
    - ALSA: drivers: opl3: Fix incorrect use of vp->state
    - ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6
    - ALSA: hda/realtek: Add new alc285-hp-amp-init model
    - ALSA: hda/realtek: Fix quirk for Clevo NJ51CU
    - Input: atmel_mxt_ts - fix double free in mxt_read_info_block
    - ipmi: bail out if init_srcu_struct fails
    - ipmi: ssif: initialize ssif_info->client early
    - ipmi: fix initialization when workqueue allocation fails
    - [arm64] tee: handle lookup of shm with reference count 0
    - [x86] pkey: Fix undefined behaviour with PKRU_WD_BIT
    - [x86] platform/x86: intel_pmc_core: fix memleak on registration failure
    - [x86] KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this
      vCPU
    - [armhf] pinctrl: stm32: consider the GPIO offset to expose all the GPIO
      lines
    - [arm64,armhf] mmc: sdhci-tegra: Fix switch to HS400ES mode
    - mmc: core: Disable card detect during shutdown
    - [arm64,armhf] mmc: mmci: stm32: clear DLYB_CR after sending tuning command
    - [armel,armhf] 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling
    - mac80211: fix locking in ieee80211_start_ap error path
    - mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
    - [arm64] tee: optee: Fix incorrect page free bug
    - f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
      (CVE-2021-45469)
    - ceph: fix up non-directory creation in SGID directories
    - usb: gadget: u_ether: fix race in setting MAC address in setup phase
    - [x86] KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state
    - mm: mempolicy: fix THP allocations escaping mempolicy restrictions
    - [arm64] Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312
    - Input: goodix - add id->model mapping for the "9111" model
    - ASoC: rt5682: fix the wrong jack type detected
    - hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681
    - hwmon: (lm90) Do not report 'busy' status bit as alarm
    - ax25: NPD bug when detaching AX25 device
    - hamradio: defer ax25 kfree after unregister_netdev
    - hamradio: improve the incomplete fix to avoid NPD
    - phonet/pep: refuse to enable an unbound pipe
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.90
    - Input: i8042 - add deferred probe support
    - Input: i8042 - enable deferred probe quirk for ASUS UM325UA
    - tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok().
    - tomoyo: use hwight16() in tomoyo_domain_quota_is_ok()
    - [x86] platform/x86: apple-gmux: use resource_size() with res
    - memblock: fix memblock_phys_alloc() section mismatch error
    - selinux: initialize proto variable in selinux_ip_postroute_compat()
    - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
    - net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources
    - net/mlx5e: Wrap the tx reporter dump callback to extract the sq
    - net/mlx5e: Fix ICOSQ recovery flow for XSK
    - udp: using datalen to cap ipv6 udp max gso segments
    - sctp: use call_rcu to free endpoint
    - net/smc: fix using of uninitialized completions
    - net: usb: pegasus: Do not drop long Ethernet frames
    - net/smc: improved fix wait on already cleared link
    - net/smc: don't send CDC/LLC message if link not ready
    - net/smc: fix kernel panic caused by race of smc_sock
    - igc: Fix TX timestamp support for non-MSI-X platforms
    - net/mlx5e: Fix wrong features assignment in case of error
    - [armhf] net/ncsi: check for error return from call to nla_put_u32
    - i2c: validate user data in compat ioctl
    - nfc: uapi: use kernel size_t to fix user-space builds
    - uapi: fix linux/nfc.h userspace compilation errors
    - drm/amdgpu: When the VCN(1.0) block is suspended, powergating is
      explicitly enabled
    - drm/amdgpu: add support for IP discovery gc_info table v2
    - xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set.
    - usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
    - [arm*] binder: fix async_free_space accounting for empty parcels
    - [x86] scsi: vmw_pvscsi: Set residual data length conditionally
    - Input: appletouch - initialize work before device registration
    - Input: spaceball - fix parsing of movement data packets
    - net: fix use-after-free in tw_timer_handler
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.91
    - f2fs: quota: fix potential deadlock
    - tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
    - tracing: Tag trace_percpu_buffer as a percpu pointer
    - ieee802154: atusb: fix uninit value in atusb_set_extended_addr
    - i40e: Fix to not show opcode msg on unsuccessful VF MAC change
    - iavf: Fix limit of total number of queues to active queues of VF
    - RDMA/core: Don't infoleak GRH fields
    - netrom: fix copying in user data in nr_setsockopt
    - RDMA/uverbs: Check for null return of kmalloc_array
    - mac80211: initialize variable have_higher_than_11mbit
    - sfc: The RX page_ring is optional
    - i40e: fix use-after-free in i40e_sync_filters_subtask()
    - i40e: Fix for displaying message regarding NVM version
    - i40e: Fix incorrect netdev's real number of RX/TX queues
    - ipv4: Check attribute length for RTA_GATEWAY in multipath route
    - ipv4: Check attribute length for RTA_FLOW in multipath route
    - ipv6: Check attribute length for RTA_GATEWAY in multipath route
    - ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
    - lwtunnel: Validate RTA_ENCAP_TYPE attribute length
    - batman-adv: mcast: don't send link-local multicast to mcast routers
    - sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
    - net: ena: Fix undefined state when tx request id is out of bounds
    - net: ena: Fix error handling when calculating max IO queues number
    - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
      (CVE-2021-4155)
    - power: supply: core: Break capacity loop
    - rndis_host: support Hytera digital radios
    - phonet: refcount leak in pep_sock_accep (CVE-2021-45095)
    - ipv6: Continue processing multipath route even if gateway attribute is
      invalid
    - ipv6: Do cleanup if attribute validation fails in multipath route
    - scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
    - ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
    - net: udp: fix alignment problem in udp4_seq_show()
    - [amd64,arm64] atlantic: Fix buff_ring OOB in aq_ring_rx_clean
    - mISDN: change function names to avoid conflicts
    - drm/amd/display: Added power down for DCN10
    - ipv6: raw: check passed optlen before reading
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.92
    - md: revert io stats accounting
    - workqueue: Fix unbind_workers() VS wq_worker_running() race
    - bpf: Fix out of bounds access from invalid *_or_null type verification
      (CVE-2022-23222)
    - Bluetooth: btusb: fix memory leak in btusb_mtk_submit_wmt_recv_urb()
    - Bluetooth: btusb: Add two more Bluetooth parts for WCN6855
    - Bluetooth: btusb: Add support for Foxconn MT7922A
    - Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0
    - Bluetooth: bfusb: fix division by zero in send path
    - [armhf] dts: exynos: Fix BCM4330 Bluetooth reset polarity in I9100
    - USB: core: Fix bug in resuming hub's handling of wakeup requests
    - USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
    - ath11k: Fix buffer overflow when scanning with extraie
    - mmc: sdhci-pci: Add PCI ID for Intel ADL
    - veth: Do not record rx queue hint in veth_xmit
    - [x86] mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
    - can: gs_usb: fix use of uninitialized variable, detach device on reception
      of invalid USB data
    - can: isotp: convert struct tpcon::{idx,len} to unsigned int
    - can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved}
    - random: fix data race on crng_node_pool
    - random: fix data race on crng init time
    - random: fix crash on multiple early calls to add_bootloader_randomness()
    - media: Revert "media: uvcvideo: Set unique vdev name based in type"
    - [x86] drm/i915: Avoid bitwise vs logical OR warning in
      snb_wm_latency_quirk()

  [ Salvatore Bonaccorso ]
  * [arm64] drivers/net/ethernet/google: Enable GVE as module (Closes: #996974)
  * Refresh "Export symbols needed by Android drivers"
  * [rt] Update to 5.10.87-rt59
  * Bump ABI to 11
  * [rt] Update to 5.10.90-rt60
  * vfs: fs_context: fix up param length parsing in legacy_parse_param
    (CVE-2022-0185)

  [ Andrew Balmos ]
  * net/can: Enable CONFIG_CAN_MCP251X as module

  [ Cyril Brulebois ]
  * arm64: dts: Add support for Raspberry Pi Compute Module 4 IO Board,
    producing a DTB that's almost entirely identical to what a v5.16-rc8
    build produces, with lots of thanks to Uwe Kleine-König for the heavy
    lifting!

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 18 Jan 2022 16:54:31 +0100

linux (5.10.84-1) bullseye; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.71
    - tty: Fix out-of-bound vmalloc access in imageblit
    - cpufreq: schedutil: Use kobject release() method to free sugov_tunables
    - scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS
    - cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
    - ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i
      15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.
    - [amd64,arm64] ACPI: NFIT: Use fallback node id when numa info in NFIT
      table is incorrect
    - fs-verity: fix signed integer overflow with i_size near S64_MAX
    - hwmon: (tmp421) handle I2C errors
    - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary
      structure field
    - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary
      structure field
    - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary
      structure field
    - [arm64,armhf] gpio: pca953x: do not ignore i2c errors
    - scsi: ufs: Fix illegal offset in UPIU event trace
    - mac80211: fix use-after-free in CCMP/GCMP RX
    - [x86] kvmclock: Move this_cpu_pvti into kvmclock.h
    - [x86] KVM: x86: Fix stack-out-of-bounds memory access from
      ioapic_write_indirect()
    - [x86] KVM: x86: nSVM: don't copy virt_ext from vmcb12
    - [x86] KVM: nVMX: Filter out all unsupported controls when eVMCS was
      activated
    - KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest
    - RDMA/cma: Do not change route.addr.src_addr.ss_family
    - drm/amd/display: Pass PCI deviceid into DC
    - drm/amdgpu: correct initial cp_hqd_quantum for gfx9
    - ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
    - bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog
    - IB/cma: Do not send IGMP leaves for sendonly Multicast groups
    - RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure
    - mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
    - mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
    - mac80211: mesh: fix potentially unaligned access
    - mac80211-hwsim: fix late beacon hrtimer handling
    - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
    - hwmon: (tmp421) report /PVLD condition as fault
    - hwmon: (tmp421) fix rounding for negative values
    - [arm64] net: enetc: fix the incorrect clearing of IF_MODE bits
    - net: ipv4: Fix rtnexthop len when RTA_FLOW is present
    - smsc95xx: fix stalled rx after link change
    - [x86] drm/i915/request: fix early tracepoints
    - [arm64,armhf] dsa: mv88e6xxx: 6161: Use chip wide MAX MTU
    - [arm64,armhf] dsa: mv88e6xxx: Fix MTU definition
    - [arm64,armhf] dsa: mv88e6xxx: Include tagger overhead when setting MTU for
      DSA and CPU ports
    - e100: fix length calculation in e100_get_regs_len
    - e100: fix buffer overrun in e100_get_regs
    - [arm64] RDMA/hns: Fix inaccurate prints
    - bpf: Exempt CAP_BPF from checks against bpf_jit_limit
    - Revert "block, bfq: honor already-setup queue merges"
    - scsi: csiostor: Add module softdep on cxgb4
    - ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
    - [arm64] net: hns3: do not allow call hns3_nic_net_open repeatedly
    - [arm64] net: hns3: keep MAC pause mode when multiple TCs are enabled
    - [arm64] net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and
      HCLGE_FLAG_DCB_ENABLE
    - [arm64] net: hns3: fix show wrong state when add existing uc mac address
    - [arm64] net: hns3: fix prototype warning
    - [arm64] net: hns3: reconstruct function hns3_self_test
    - [arm64] net: hns3: fix always enable rx vlan filter problem after selftest
    - [arm64,armhf] net: phy: bcm7xxx: Fixed indirect MMD operations
    - net: sched: flower: protect fl_walk() with rcu
    - af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
    - [x86] perf/x86/intel: Update event constraints for ICX
    - nvme: add command id quirk for apple controllers
    - elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings
    - debugfs: debugfs_create_file_size(): use IS_ERR to check for error
    - ext4: fix loff_t overflow in ext4_max_bitmap_size()
    - ext4: limit the number of blocks in one ADD_RANGE TLV (Closes: #995425)
    - ext4: fix reserved space counter leakage
    - ext4: add error checking to ext4_ext_replay_set_iblocks()
    - ext4: fix potential infinite loop in ext4_dx_readdir()
    - HID: u2fzero: ignore incomplete packets without data
    - net: udp: annotate data race around udp_sk(sk)->corkflag
    - ASoC: dapm: use component prefix when checking widget names
    - usb: hso: remove the bailout parameter
    - [x86] crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
      (CVE-2021-3744, CVE-2021-3764)
    - HID: betop: fix slab-out-of-bounds Write in betop_probe
    - netfilter: ipset: Fix oversized kvmalloc() calls
    - mm: don't allow oversized kvmalloc() calls
    - HID: usbhid: free raw_report buffers in usbhid_stop
    - [x86] KVM: x86: Handle SRCU initialization failure during page track init
    - netfilter: conntrack: serialize hash resizes and cleanups
    - netfilter: nf_tables: Fix oversized kvmalloc() calls
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.72
    - [arm64,armhf] spi: rockchip: handle zero length transfers without timing
      out
    - nfsd: back channel stuck in SEQ4_STATUS_CB_PATH_DOWN
    - btrfs: replace BUG_ON() in btrfs_csum_one_bio() with proper error handling
    - btrfs: fix mount failure due to past and transient device flush error
    - net: mdio: introduce a shutdown method to mdio device drivers
    - xen-netback: correct success/error reporting for the SKB-with-fraglist
      case
    - scsi: sd: Free scsi_disk device via put_device()
    - [arm*] usb: dwc2: check return value after calling platform_get_resource()
    - nvme-fc: update hardware queues before using them
    - nvme-fc: avoid race between time out and tear down
    - [arm64] thermal/drivers/tsens: Fix wrong check for tzd in irq handlers
    - scsi: ses: Retry failed Send/Receive Diagnostic commands
    - [arm64,armhf] irqchip/gic: Work around broken Renesas integration
    - smb3: correct smb3 ACL security descriptor
    - KVM: do not shrink halt_poll_ns below grow_start
    - [x86] kvm: Add AMD PMU MSRs to msrs_to_save_all[]
    - [x86] KVM: nSVM: restore int_vector in svm_clear_vintr
    - [x86] perf/x86: Reset destroy callback on event init failure
    - libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD.
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.73
    - [arm64,armhf] usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle
    - USB: cdc-acm: fix racy tty buffer accesses
    - USB: cdc-acm: fix break reporting
    - usb: typec: tcpm: handle SRC_STARTUP state if cc changes
    - drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows
    - xen/privcmd: fix error handling in mmap-resource processing
    - [arm64] mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk
    - ovl: fix missing negative dentry check in ovl_rename() (CVE-2021-20321)
    - ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO
    - nfsd: fix error handling of register_pernet_subsys() in init_nfsd()
    - nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero
    - SUNRPC: fix sign error causing rpcsec_gss drops
    - xen/balloon: fix cancelled balloon action
    - [armhf] dts: omap3430-sdp: Fix NAND device node
    - [armhf] bus: ti-sysc: Add break in switch statement in sysc_init_soc()
    - [arm64] soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment
    - [armhf] dts: imx: Add missing pinctrl-names for panel on M53Menlo
    - [armhf] dts: imx: Fix USB host power regulator polarity on M53Menlo
    - [amd64] PCI: hv: Fix sleep while in non-sleep context when removing child
      devices from the bus
    - iwlwifi: pcie: add configuration of a Wi-Fi adapter on Dell XPS 15
    - [armel,armhf] bpf, arm: Fix register clobbering in div/mod implementation
    - [armhf] soc: ti: omap-prm: Fix external abort for am335x pruss
    - bpf: Fix integer overflow in prealloc_elems_and_freelist()
      (CVE-2021-41864)
    - net/mlx5e: IPSEC RX, enable checksum complete
    - net/mlx5: E-Switch, Fix double allocation of acl flow counter
    - phy: mdio: fix memory leak
    - net_sched: fix NULL deref in fifo_set_limit()
    - [i386] ptp_pch: Load module automatically if ID matches
    - [armhf] imx6: disable the GIC CPU interface before calling stby-poweroff
      sequence
    - net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size()
    - net: bridge: fix under estimation in br_get_linkxstats_size()
    - net/sched: sch_taprio: properly cancel timer from taprio_destroy()
    - net: sfp: Fix typo in state machine debug string
    - netlink: annotate data races around nlk->bound
    - perf jevents: Tidy error handling
    - [armhf] bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
    - [arm64,armhf] drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup
    - drm/nouveau: avoid a use-after-free when BO init fails
    - drm/nouveau/kms/nv50-: fix file release memory leak
    - drm/nouveau/debugfs: fix file release memory leak
    - [amd64] gve: Correct available tx qpl check
    - [amd64] gve: Avoid freeing NULL pointer
    - rtnetlink: fix if_nlmsg_stats_size() under estimation
    - [amd64] gve: fix gve_get_stats()
    - [amd64] gve: report 64bit tx_bytes counter from gve_handle_report_stats()
    - i40e: fix endless loop under rtnl
    - i40e: Fix freeing of uninitialized misc IRQ vector
    - net: prefer socket bound to interface when not in VRF
    - [powerpc*] iommu: Report the correct most efficient DMA mask for PCI
      devices
    - i2c: acpi: fix resource leak in reconfiguration device addition
    - [s390x] bpf, s390: Fix potential memory leak about jit_data
    - [powerpc*] bpf: Fix BPF_SUB when imm == 0x80000000
    - [powerpc*] pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init
    - [i386] x86/platform/olpc: Correct ifdef symbol to intended
      CONFIG_OLPC_XO15_SCI
    - [x86] entry: Correct reference to intended CONFIG_64_BIT
    - [x86] hpet: Use another crystalball to evaluate HPET usability
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.74
    - ext4: check and update i_disksize properly
    - ext4: correct the error path of ext4_write_inline_data_end()
    - [x86] ASoC: Intel: sof_sdw: tag SoundWire BEs as non-atomic
    - HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS
    - netfilter: ip6_tables: zero-initialize fragment offset
    - HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs
    - [x86] ASoC: SOF: loader: release_firmware() on load failure to avoid
      batching
    - netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic
    - netfilter: nf_nat_masquerade: defer conntrack walk to work queue
    - mac80211: Drop frames from invalid MAC address in ad-hoc mode
    - net: prevent user from passing illegal stab size
    - mac80211: check return value of rhashtable_init
    - [x86] vboxfs: fix broken legacy mount signature checking
    - drm/amdgpu: fix gart.bo pin_count leak
    - scsi: ses: Fix unsigned comparison with less than zero
    - scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
    - perf/core: fix userpage->time_enabled of inactive events
    - sched: Always inline is_percpu_thread()
    - [armhf] hwmon: (pmbus/ibm-cffps) max_power_out swap changes
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.75
    - ALSA: usb-audio: Add quirk for VF0770
    - ALSA: pcm: Workaround for a wrong offset in SYNC_PTR compat ioctl
    - ALSA: seq: Fix a potential UAF by wrong private_free call order
    - ALSA: hda/realtek: Enable 4-speaker output for Dell Precision 5560 laptop
    - ALSA: hda - Enable headphone mic on Dell Latitude laptops with ALC3254
    - ALSA: hda/realtek: Complete partial device name to avoid ambiguity
    - ALSA: hda/realtek: Add quirk for Clevo X170KM-G
    - ALSA: hda/realtek - ALC236 headset MIC recording issue
    - ALSA: hda/realtek: Add quirk for TongFang PHxTxX1
    - ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo
      13s Gen2
    - ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW
    - [s390x] fix strrchr() implementation
    - [arm64] hugetlb: fix CMA gigantic page order for non-4K PAGE_SIZE
    - drm/msm: Avoid potential overflow in timeout_to_jiffies()
    - btrfs: unlock newly allocated extent buffer after error
    - btrfs: deal with errors when replaying dir entry during log replay
    - btrfs: deal with errors when adding inode reference during log replay
    - btrfs: check for error when looking up inode during dir entry replay
    - btrfs: update refs for any root except tree log roots
    - btrfs: fix abort logic in btrfs_replace_file_extents
    - [x86] resctrl: Free the ctrlval arrays when domain_setup_mon_state() fails
    - [x86] mei: me: add Ice Lake-N device id.
    - xhci: guard accesses to ep_state in xhci_endpoint_reset()
    - xhci: Fix command ring pointer corruption while aborting a command
    - xhci: Enable trust tx length quirk for Fresco FL11 USB controller
    - cb710: avoid NULL pointer subtraction
    - [arm64,x86] efi/cper: use stack buffer for error record decoding
    - efi: Change down_interruptible() in virt_efi_reset_system() to
      down_trylock()
    - [armhf] usb: musb: dsps: Fix the probe error path (Closes: 1000900)
    - Input: xpad - add support for another USB ID of Nacon GC-100
    - USB: serial: qcserial: add EM9191 QDL support
    - USB: serial: option: add Quectel EC200S-CN module support
    - USB: serial: option: add Telit LE910Cx composition 0x1204
    - USB: serial: option: add prod. id for Quectel EG91
    - virtio: write back F_VERSION_1 before validate
    - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
    - [powerpc*] xive: Discard disabled interrupts in get_irqchip_state()
    - driver core: Reject pointless SYNC_STATE_ONLY device links
    - iio: adc: ad7192: Add IRQ flag
    - iio: adc: ad7780: Fix IRQ flag
    - iio: adc: ad7793: Fix IRQ flag
    - iio: adc128s052: Fix the error handling path of 'adc128_probe()'
    - iio: adc: max1027: Fix wrong shift with 12-bit devices
    - iio: light: opt3001: Fixed timeout error when 0 lux
    - iio: adc: max1027: Fix the number of max1X31 channels
    - iio: dac: ti-dac5571: fix an error code in probe()
    - [arm64] tee: optee: Fix missing devices unregister during optee_remove
    - [armel,armhf] dts: bcm2711-rpi-4-b: Fix usb's unit address
    - [armel,armhf] dts: bcm2711-rpi-4-b: fix sd_io_1v8_reg regulator states
    - [armel,armhf] dts: bcm2711-rpi-4-b: Fix pcie0's unit address formatting
    - nvme-pci: Fix abort command id
    - sctp: account stream padding length for reconf chunk
    - [arm64,armhf] gpio: pca953x: Improve bias setting
    - net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path
    - net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp
    - net: stmmac: fix get_hw_feature() on old hardware
    - ethernet: s2io: fix setting mac address during resume
    - nfc: fix error handling of nfc_proto_register()
    - NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
    - NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
    - [i386] pata_legacy: fix a couple uninitialized variable bugs
    - ata: ahci_platform: fix null-ptr-deref in
      ahci_platform_enable_regulators()
    - drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read
    - [arm64] drm/msm: Fix null pointer dereference on pointer edp
    - [arm64] drm/msm/mdp5: fix cursor-related warnings
    - [arm64] drm/msm/a6xx: Track current ctx by seqno
    - [arm64] drm/msm/dsi: Fix an error code in msm_dsi_modeset_init()
    - [arm64] drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
    - [arm64] acpi/arm64: fix next_platform_timer() section mismatch error
    - [x86] platform/x86: intel_scu_ipc: Fix busy loop expiry time
    - mqprio: Correct stats in mqprio_dump_class_stats().
    - qed: Fix missing error code in qed_slowpath_start()
    - nfp: flow_offload: move flow_indr_dev_register from app init to app start
    - [arm64] net: mscc: ocelot: warn when a PTP IRQ is raised for an unknown
      skb
    - [arm64,armhf] net: dsa: mv88e6xxx: don't use PHY_DETECT on internal PHY's
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.76
    - xhci: add quirk for host controllers that don't update endpoint DCS
    - io_uring: fix splice_fd_in checks backport typo
    - [armhf] dts: vexpress-v2p-ca9: Fix the SMB unit-address
    - block: decode QUEUE_FLAG_HCTX_ACTIVE in debugfs output
    - [x86] xen/x86: prevent PVH type from getting clobbered
    - NFSD: Keep existing listeners on portlist error
    - netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage
      value
    - ice: fix getting UDP tunnel entry
    - netfilter: ip6t_rt: fix rt0_hdr parsing in rt_mt6
    - netfilter: ipvs: make global sysctl readonly in non-init netns
    - tcp: md5: Fix overlap between vrf and non-vrf keys
    - ipv6: When forwarding count rx stats on the orig netdev
    - [powerpc*] smp: do not decrement idle task preempt count in CPU offline
    - [arm64] net: hns3: reset DWRR of unused tc to zero
    - [arm64] net: hns3: add limit ets dwrr bandwidth cannot be 0
    - [arm64] net: hns3: schedule the polling again when allocation fails
    - [arm64] net: hns3: fix vf reset workqueue cannot exit
    - [arm64] net: hns3: disable sriov before unload hclge layer
    - net: stmmac: Fix E2E delay mechanism
    - e1000e: Fix packet loss on Tiger Lake and later
    - ice: Add missing E810 device ids
    - [arm64] net: enetc: fix ethtool counter name for PM0_TERR
    - can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state
      notification
    - can: peak_pci: peak_pci_remove(): fix UAF
    - can: isotp: isotp_sendmsg(): fix return error on FC timeout on TX path
    - can: isotp: isotp_sendmsg(): add result check for
      wait_event_interruptible()
    - can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer
    - can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
    - can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with
      error length
    - can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes
    - ceph: skip existing superblocks that are blocklisted or shut down when
      mounting
    - ceph: fix handling of "meta" errors
    - ocfs2: fix data corruption after conversion from inline format
    - ocfs2: mount fails with buffer overflow in strlen
    - userfaultfd: fix a race between writeprotect and exit_mmap()
    - vfs: check fd has read access in kernel_read_file_from_fd()
    - ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
    - ALSA: hda/realtek: Add quirk for Clevo PC50HS
    - ASoC: DAPM: Fix missing kctl change notifications
    - audit: fix possible null-pointer dereference in audit_filter_rules
    - [powerpc*] powerpc64/idle: Fix SP offsets when saving GPRs
    - [powerpc*] KVM: PPC: Book3S HV: Fix stack handling in
      idle_kvm_start_guest()
    - [powerpc*] KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it
      went to guest (CVE-2021-43056)
    - [powerpc*] idle: Don't corrupt back chain when going idle
    - mm, slub: fix mismatch between reconstructed freelist depth and cnt
    - mm, slub: fix potential memoryleak in kmem_cache_open()
    - mm, slub: fix incorrect memcg slab count for bulk free
    - [x86] KVM: nVMX: promptly process interrupts delivered while in guest mode
    - nfc: nci: fix the UAF of rf_conn_info object (CVE-2021-3760)
    - isdn: cpai: check ctr->cnr to avoid array index out of bound
      (CVE-2021-43389)
    - [arm64] net: hns3: fix the max tx size according to user manual
    - ALSA: hda: intel: Allow repeatedly probing on codec configuration errors
    - btrfs: deal with errors when checking if a dir entry exists during log
      replay
    - net: stmmac: add support for dwmac 3.40a
    - isdn: mISDN: Fix sleeping function called from invalid context
    - [x86] platform/x86: intel_scu_ipc: Update timeout value in comment
    - ALSA: hda: avoid write to STATESTS if controller is in reset
    - [x86] perf/x86/msr: Add Sapphire Rapids CPU support
    - scsi: iscsi: Fix set_param() handling
    - scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()
    - sched/scs: Reset the shadow stack when idle_task_exit
    - [arm64] net: hns3: fix for miscalculation of rx unused desc
    - scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
    - can: isotp: isotp_sendmsg(): fix TX buffer concurrent access in
      isotp_sendmsg()
    - [s390x] pci: fix zpci_zdev_put() on reserve
    - net: mdiobus: Fix memory leak in __mdiobus_register
    - tracing: Have all levels of checks prevent recursion
    - e1000e: Separate TGP board type from SPT
    - [armhf] pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.77
    - [armel,armhf] 9139/1: kprobes: fix arch_init_kprobes() prototype
    - io_uring: don't take uring_lock during iowq cancel
    - [powerpc*] bpf: Fix BPF_MOD when imm == 1
    - [arm64] Avoid premature usercopy failure
    - ext4: fix possible UAF when remounting r/o a mmp-protected file system
    - usbnet: sanity check for maxpacket
    - usbnet: fix error return code in usbnet_probe()
    - pinctrl: amd: disable and mask interrupts on probe
    - ata: sata_mv: Fix the error handling of mv_chip_id()
    - tipc: fix size validations for the MSG_CRYPTO type (CVE-2021-43267)
    - nfc: port100: fix using -ERRNO as command type mask
    - Revert "net: mdiobus: Fix memory leak in __mdiobus_register"
    - mmc: vub300: fix control-message timeouts
    - mmc: cqhci: clear HALT state after CQE enable
    - [armhf] mmc: dw_mmc: exynos: fix the finding clock sample value
    - mmc: sdhci: Map more voltage level to SDHCI_POWER_330
    - [arm64,armhf] mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset
      standard tuning circuit
    - ocfs2: fix race between searching chunks and release journal_head from
      buffer_head
    - nvme-tcp: fix H2CData PDU send accounting (again)
    - cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
    - cfg80211: fix management registrations locking
    - net: lan78xx: fix division by zero in send path
    - mm, thp: bail out early in collapse_file for writeback page
    - drm/ttm: fix memleak in ttm_transfered_destroy
    - drm/amdgpu: fix out of bounds write (CVE-2021-42327)
    - cgroup: Fix memory leak caused by missing cgroup_bpf_offline
    - tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function
    - bpf: Fix potential race in tail call compatibility check
    - bpf: Fix error usage of map_fd and fdget() in generic_map_update_batch()
    - [amd64] IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt
      fields
    - [amd64] IB/hfi1: Fix abba locking issue with sc_disable()
    - nvmet-tcp: fix data digest pointer calculation
    - nvme-tcp: fix data digest pointer calculation
    - nvme-tcp: fix possible req->offset corruption
    - RDMA/mlx5: Set user priority for DCT
    - [arm64] dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node
    - regmap: Fix possible double-free in regcache_rbtree_exit()
    - net: batman-adv: fix error handling
    - net-sysfs: initialize uid and gid before calling net_ns_get_ownership
    - cfg80211: correct bridge/4addr mode check
    - net: Prevent infinite while loop in skb_tx_hash()
    - RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string
    - net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume
      fails
    - net: ethernet: microchip: lan743x: Fix dma allocation failure by using
      dma_set_mask_and_coherent
    - phy: phy_ethtool_ksettings_get: Lock the phy for consistency
    - phy: phy_ethtool_ksettings_set: Move after phy_start_aneg
    - phy: phy_start_aneg: Add an unlocked version
    - phy: phy_ethtool_ksettings_set: Lock the PHY while changing settings
    - sctp: use init_tag from inithdr for ABORT chunk (CVE-2021-3772)
    - sctp: fix the processing for INIT_ACK chunk (CVE-2021-3772)
    - sctp: fix the processing for COOKIE_ECHO chunk (CVE-2021-3772)
    - sctp: add vtag check in sctp_sf_violation (CVE-2021-3772)
    - sctp: add vtag check in sctp_sf_do_8_5_1_E_sa (CVE-2021-3772)
    - sctp: add vtag check in sctp_sf_ootb (CVE-2021-3772)
    - lan743x: fix endianness when accessing descriptors
    - [s390x] KVM: clear kicked_mask before sleeping again
    - [s390x] KVM: preserve deliverable_mask in __airqs_kick_single_vcpu
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.78
    - scsi: core: Put LLD module refcnt after SCSI device is released
    - Revert "io_uring: reinforce cancel on flush during exit"
    - sfc: Fix reading non-legacy supported link modes
    - vrf: Revert "Reset skb conntrack connection..."
    - net: ethernet: microchip: lan743x: Fix skb allocation failure
    - media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
      (CVE-2021-42739)
    - Revert "xhci: Set HCD flag to defer primary roothub registration"
    - Revert "usb: core: hcd: Add support for deferring roothub registration"
    - mm: khugepaged: skip huge page collapse for special files
    - Revert "drm/ttm: fix memleak in ttm_transfered_destroy"
    - [arm*] 9120/1: Revert "amba: make use of -1 IRQs warn"
    - [arm64] Revert "wcn36xx: Disable bmps when encryption is disabled"
    - ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table
    - ALSA: usb-audio: Add Audient iD14 to mixer map quirk table
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.79
    - [x86] Revert "x86/kvm: fix vcpu-id indexed array sizes"
    - [arm64,armhf] usb: musb: Balance list entry in musb_gadget_queue
    - usb-storage: Add compatibility quirk flags for iODD 2531/2541
    - [arm*] binder: don't detect sender/target during buffer cleanup
    - printk/console: Allow to disable console output by using console="" or
      console=null
    - staging: rtl8712: fix use-after-free in rtl8712_dl_fw
    - isofs: Fix out of bound access for corrupted isofs image
    - [x86] comedi: dt9812: fix DMA buffers on stack
    - [x86] comedi: ni_usb6501: fix NULL-deref in command paths
    - [x86] comedi: vmk80xx: fix transfer-buffer overflows
    - [x86] comedi: vmk80xx: fix bulk-buffer overflow
    - [x86] comedi: vmk80xx: fix bulk and interrupt message timeouts
    - staging: r8712u: fix control-message timeout
    - [x86] staging: rtl8192u: fix control-message timeouts
    - rsi: fix control-message timeout
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.80
    - xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good
      delay
    - usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform
    - [arm*] binder: use euid from cred instead of using task
    - [arm*] binder: use cred instead of task for selinux checks
    - [arm*] binder: use cred instead of task for getsecid
    - Input: iforce - fix control-message timeout
    - Input: elantench - fix misreporting trackpoint coordinates
      (Closes: #989285)
    - libata: fix read log timeout value
    - ocfs2: fix data corruption on truncate
    - scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd()
    - scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file
    - scsi: qla2xxx: Fix use after free in eh_abort path
    - [arm64,armhf] mmc: dw_mmc: Dont wait for DRTO on Write RSP error
    - exfat: fix incorrect loading of i_blocks for large files
    - tpm: Check for integer overflow in tpm2_map_response_body()
    - media: ite-cir: IR receiver stop working after receive overflow
      (Closes: #996672)
    - media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers
      (Closes: #994050)
    - media: v4l2-ioctl: Fix check_ext_ctrls
    - ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14
    - ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED
    - ALSA: hda/realtek: Add quirk for Clevo PC70HS
    - ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ
    - ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N
    - ALSA: hda/realtek: Add quirk for ASUS UX550VE
    - ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED
    - ALSA: ua101: fix division by zero at probe
    - ALSA: 6fire: fix control and bulk message timeouts
    - ALSA: line6: fix control and interrupt message timeouts
    - ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk
    - ALSA: usb-audio: Add registration quirk for JBL Quantum 400
    - ALSA: hda: Free card instance properly at probe errors
    - ALSA: synth: missing check for possible NULL after the call to kstrdup
    - ALSA: timer: Fix use-after-free problem
    - ALSA: timer: Unconditionally unlink slave instances, too
    - ext4: fix lazy initialization next schedule time computation in more
      granular unit
    - ext4: ensure enough credits in ext4_ext_shift_path_extents
    - ext4: refresh the ext4_ext_path struct after dropping i_data_sem.
    - fuse: fix page stealing
    - [x86] cpu: Fix migration safety with X86_BUG_NULL_SEL
    - [x86] irq: Ensure PI wakeup handler is unregistered before module unload
    - ASoC: soc-core: fix null-ptr-deref in snd_soc_del_component_unlocked()
    - ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers
    - [arm64] cavium: Return negative value when pci_alloc_irq_vectors() fails
    - scsi: qla2xxx: Return -ENOMEM if kzalloc() fails
    - scsi: qla2xxx: Fix unmap of already freed sgl
    - mISDN: Fix return values of the probe function
    - [arm64] cavium: Fix return values of the probe function
    - sfc: Export fibre-specific supported link modes
    - sfc: Don't use netif_info before net_device setup
    - [armhf] reset: socfpga: add empty driver allowing consumers to probe
    - drm: panel-orientation-quirks: Add quirk for Aya Neo 2021
    - bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT
    - bpf: Prevent increasing bpf_jit_limit above max
    - xen/netfront: stop tx queues during live migration
    - nvmet-tcp: fix a memory leak when releasing a queue
    - [armhf] spi: spl022: fix Microwire full duplex mode
    - net: multicast: calculate csum of looped-back and forwarded packets
    - [armhf] watchdog: Fix OMAP watchdog early handling
    - drm: panel-orientation-quirks: Add quirk for GPD Win3
    - block: schedule queue restart after BLK_STS_ZONE_RESOURCE
    - nvmet-tcp: fix header digest verification
    - r8169: Add device 10ec:8162 to driver r8169
    - [x86] vmxnet3: do not stop tx queues after netif_device_detach()
    - nfp: bpf: relax prog rejection for mtu check through max_pkt_offset
    - net/smc: Fix smc_link->llc_testlink_time overflow
    - net/smc: Correct spelling mistake to TCPF_SYN_RECV
    - rds: stop using dmapool
    - btrfs: clear MISSING device status bit in btrfs_close_one_device
    - btrfs: fix lost error handling when replaying directory deletes
    - btrfs: call btrfs_check_rw_degradable only if there is a missing device
    - [x86] KVM: VMX: Unregister posted interrupt wakeup handler on hardware
      unsetup
    - selinux: fix race condition when computing ocontext SIDs
    - [armhf] regulator: s5m8767: do not use reset value as DVS voltage if GPIO
      DVS is disabled
    - [amd64] EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
    - [x86] mwifiex: fix division by zero in fw download path
    - ath6kl: fix division by zero in send path
    - ath6kl: fix control-message timeout
    - ath10k: fix control-message timeout
    - ath10k: fix division by zero in send path
    - PCI: Mark Atheros QCA6174 to avoid bus reset
    - rtl8187: fix control-message timeouts
    - [arm64] wcn36xx: Fix HT40 capability for 2Ghz band
    - [arm64] wcn36xx: Fix tx_status mechanism
    - [arm64] wcn36xx: Fix (QoS) null data frame bitrate/modulation
    - PM: sleep: Do not let "syscore" devices runtime-suspend during system
      transitions
    - mwifiex: Read a PCI register after writing the TX ring write pointer
    - mwifiex: Try waking the firmware until we get an interrupt
    - libata: fix checking of DMA state
    - [arm64] wcn36xx: handle connection loss indication
    - rsi: fix occasional initialisation failure with BT coex
    - rsi: fix key enabled check causing unwanted encryption for vap_id > 0
    - rsi: fix rate mask set leading to P2P failure
    - rsi: Fix module dev_oper_mode parameter description
    - [x86] perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server
    - [x86] perf/x86/intel/uncore: Fix Intel ICX IIO event constraints
    - RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
    - signal: Remove the bogus sigkill_pending in ptrace_stop
    - [mips*] signal/mips: Update (_save|_restore)_fp_context to fail with
      -EFAULT
    - [arm64] soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id
    - [arm64] soc: fsl: dpio: use the combined functions to protect critical
      zone
    - [x86] power: supply: max17042_battery: Prevent int underflow in
      set_soc_threshold
    - [x86] power: supply: max17042_battery: use VFSOC for capacity when no rsns
    - [arm64] KVM: arm64: Extract ESR_ELx.EC only
    - [x86] KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in
      use
    - can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport
    - can: j1939: j1939_can_recv(): ignore messages with invalid source address
    - ring-buffer: Protect ring_buffer_reset() from reentrancy
    - serial: core: Fix initializing and restoring termios speed
    - ifb: fix building without CONFIG_NET_CLS_ACT
    - ALSA: mixer: oss: Fix racy access to slots
    - ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
    - xen/balloon: add late_initcall_sync() for initial ballooning done
    - ovl: fix use after free in struct ovl_aio_req
    - [arm*] PCI: pci-bridge-emul: Fix emulation of W1C bits
    - [arm64] PCI: aardvark: Do not clear status bits of masked interrupts
    - [arm64] PCI: aardvark: Fix checking for link up via LTSSM state
    - [arm64] PCI: aardvark: Do not unmask unused interrupts
    - [arm64] PCI: aardvark: Fix reporting Data Link Layer Link Active
    - [arm64] PCI: aardvark: Fix configuring Reference clock
    - [arm64] PCI: aardvark: Fix return value of MSI domain .alloc() method
    - [arm64] PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
    - [arm64] PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on
      emulated bridge
    - [arm64] PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on
      emulated bridge
    - [arm64] PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge
    - [arm64] PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge
    - quota: check block number when reading the block in quota file
    - quota: correct error number in free_dqentry()
    - pinctrl: core: fix possible memory leak in pinctrl_enable()
    - iio: dac: ad5446: Fix ad5622_write() return value
    - iio: ad5770r: make devicetree property reading consistent
    - USB: serial: keyspan: fix memleak on probe errors
    - serial: 8250: fix racy uartclk update
    - USB: iowarrior: fix control-message timeouts
    - [arm64,armhf] USB: chipidea: fix interrupt deadlock
    - [x86] power: supply: max17042_battery: Clear status bits in interrupt
      handler
    - dma-buf: WARN on dmabuf release with pending attachments
    - drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2)
    - drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1
    - drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6
    - Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
      (CVE-2021-3640)
    - Bluetooth: fix use-after-free error in lock_sock_nested()
    - drm/panel-orientation-quirks: add Valve Steam Deck
    - [x86] platform/x86: wmi: do not fail if disabling fails
    - locking/lockdep: Avoid RCU-induced noinstr fail
    - net: sched: update default qdisc visibility after Tx queue cnt changes
    - rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop
    - ath11k: Align bss_chan_info structure with firmware
    - [x86] Increase exception stack sizes
    - mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
    - mwifiex: Properly initialize private structure on interface type changes
    - fscrypt: allow 256-bit master keys with AES-256-XTS
    - drm/amdgpu: Fix MMIO access page fault
    - ath11k: Avoid reg rules update during firmware recovery
    - ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED
    - ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected
      packets
    - ath10k: high latency fixes for beacon buffer
    - media: netup_unidvb: handle interrupt properly according to the firmware
    - media: uvcvideo: Set capability in s_param
    - media: uvcvideo: Return -EIO for control errors
    - media: uvcvideo: Set unique vdev name based in type
    - [armhf] media: imx: set a media_device bus_info string
    - media: mceusb: return without resubmitting URB in case of -EPROTO error.
    - rtw88: fix RX clock gate setting while fifo dump
    - brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet
    - ipmi: Disable some operations during a panic
    - fs/proc/uptime.c: Fix idle time reporting in /proc/uptime
    - ACPICA: Avoid evaluating methods too early during system resume
    - media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
    - net-sysfs: try not to restart the syscall if it will fail eventually
    - tracefs: Have tracefs directories not set OTH permission bits by default
    - ath: dfs_pattern_detector: Fix possible null-pointer dereference in
      channel_detector_create()
    - iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value
    - ACPI: battery: Accept charges over the design capacity as full
    - net: phy: micrel: make *-skew-ps check more lenient
    - [arm64] drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture()
    - block: bump max plugged deferred size from 16 to 32
    - md: update superblock after changing rdev flags in state_store
    - memstick: r592: Fix a UAF bug when removing the driver
    - lib/xz: Avoid overlapping memcpy() with invalid input with in-place
      decompression
    - lib/xz: Validate the value before assigning it to an enum variable
    - workqueue: make sysfs of unbound kworker cpumask more clever
    - mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
    - block: remove inaccurate requeue check
    - nvmet: fix use-after-free when a port is removed
    - nvmet-rdma: fix use-after-free when a port is removed
    - nvmet-tcp: fix use-after-free when a port is removed
    - nvme: drop scan_lock and always kick requeue list when removing namespaces
    - PM: hibernate: Get block device exclusively in swsusp_check()
    - iwlwifi: mvm: disable RX-diversity in powersave
    - gre/sit: Don't generate link-local addr if addr_gen_mode is
      IN6_ADDR_GEN_MODE_NONE
    - gfs2: Cancel remote delete work asynchronously
    - gfs2: Fix glock_hash_walk bugs
    - vrf: run conntrack only in context of lower/physdev for locally generated
      packets
    - net: annotate data-race in neigh_output()
    - ACPI: AC: Quirk GK45 to skip reading _PSR
    - btrfs: reflink: initialize return value to 0 in btrfs_extent_same()
    - btrfs: do not take the uuid_mutex in btrfs_rm_device
    - [arm64] wcn36xx: Correct band/freq reporting on RX
    - [x86] hyperv: Protect set_hv_tscchange_cb() against getting preempted
    - drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled
    - task_stack: Fix end_of_stack() for architectures with upwards-growing
      stack
    - erofs: don't trigger WARN() when decompression fails
    - netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream
      state
    - Bluetooth: fix init and cleanup of sco_conn.timeout_work
    - rcu: Fix existing exp request check in sync_sched_exp_online_cleanup()
    - objtool: Add xen_start_kernel() to noreturn list
    - [x86] xen: Mark cpu_bringup_and_idle() as dead_end_function
    - objtool: Fix static_call list generation
    - virtio-gpu: fix possible memory allocation failure
    - lockdep: Let lock_is_held_type() detect recursive read as read
    - net: net_namespace: Fix undefined member in key_remove_domain()
    - cgroup: Make rebind_subsystems() disable v2 controllers all at once
    - [arm64] wcn36xx: Fix Antenna Diversity Switching
    - Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
    - [arm64] crypto: caam - disable pkc for non-E SoCs
    - rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()
    - ath11k: fix some sleeping in atomic bugs
    - ath11k: Avoid race during regd updates
    - ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status
    - ath11k: Fix memory leak in ath11k_qmi_driver_event_work
    - ath10k: Fix missing frame timestamp for beacon/probe-resp
    - ath10k: sdio: Add missing BH locking around napi_schdule()
    - drm/ttm: stop calling tt_swapin in vm_access
    - [arm64] mm: update max_pfn after memory hotplug
    - drm/amdgpu: fix warning for overflow check
    - media: em28xx: add missing em28xx_close_extension
    - media: dvb-usb: fix ununit-value in az6027_rc_query
    - media: v4l2-ioctl: S_CTRL output the right value
    - media: si470x: Avoid card name truncation
    - [x86] media: tm6000: Avoid card name truncation
    - media: cx23885: Fix snd_card_free call on null card pointer
    - kprobes: Do not use local variable when creating debugfs file
    - cpuidle: Fix kobject memory leaks in error paths
    - media: em28xx: Don't use ops->suspend if it is NULL
    - ath9k: Fix potential interrupt storm on queue reset
    - PM: EM: Fix inefficient states detection
    - [amd64] EDAC/amd64: Handle three rank interleaving mode
    - rcu: Always inline rcu_dynticks_task*_{enter,exit}()
    - netfilter: nft_dynset: relax superfluous check on set updates
    - [x86] crypto: qat - detect PFVF collision after ACK
    - [x86] crypto: qat - disregard spurious PFVF interrupts
    - b43legacy: fix a lower bounds test
    - b43: fix a lower bounds test
    - [amd64] gve: Recover from queue stall due to missed IRQ
    - [armhf] mmc: sdhci-omap: Fix NULL pointer exception if regulator is not
      configured
    - [armhf] mmc: sdhci-omap: Fix context restore
    - memstick: jmb38x_ms: use appropriate free function in
      jmb38x_ms_alloc_host()
    - net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE
    - hwmon: Fix possible memleak in __hwmon_device_register()
    - ath10k: fix max antenna gain unit
    - kernel/sched: Fix sched_fork() access an invalid sched_task_group
    - tcp: switch orphan_count to bare per-cpu counters
    - [arm64] drm/msm: potential error pointer dereference in init()
    - [arm64] drm/msm: uninitialized variable in msm_gem_import()
    - net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
    - [x86] platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
    - mt76: mt76x02: fix endianness warnings in mt76x02_mac.c
    - rsi: stop thread firstly in rsi_91x_init() error handling
    - mwifiex: Send DELBA requests according to spec
    - [arm64] net: enetc: unmap DMA in enetc_send_cmd()
    - phy: micrel: ksz8041nl: do not use power down mode
    - nvme-rdma: fix error code in nvme_rdma_setup_ctrl
    - PM: hibernate: fix sparse warnings
    - [arm64] drm/msm: Fix potential NULL dereference in DPU SSPP
    - bpftool: Avoid leaking the JSON writer prepared for program metadata
    - [s390x] gmap: don't unconditionally call pte_unmap_unlock() in
      __gmap_zap()
    - [s390x] KVM: pv: avoid double free of sida page
    - [s390x] KVM: pv: avoid stalls for kvm_s390_pv_init_vm
    - tpm: fix Atmel TPM crash caused by too frequent queries
    - tpm_tis_spi: Add missing SPI ID
    - tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()
    - [s390x] KVM: Fix handle_sske page fault handling
    - libertas_tf: Fix possible memory leak in probe and disconnect
    - libertas: Fix possible memory leak in probe and disconnect
    - [arm64] wcn36xx: add proper DMA memory barriers in rx path
    - [arm64] wcn36xx: Fix discarded frames due to wrong sequence number
    - drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits
    - [amd64,arm64] net: amd-xgbe: Toggle PLL settings during rate change
    - net: phylink: avoid mvneta warning when setting pause parameters
    - crypto: pcrypt - Delay write to padata->info
    - udp6: allow SO_MARK ctrl msg to affect routing
    - cgroup: Fix rootcg cpu.stat guest double counting
    - bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and
      var_off.
    - bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit.
    - iio: st_sensors: Call st_sensors_power_enable() from bus drivers
    - iio: st_sensors: disable regulators after device unregistration
    - RDMA/bnxt_re: Fix query SRQ failure
    - [arm64] dts: meson-g12a: Fix the pwm regulator supply properties
    - [armhf] bus: ti-sysc: Fix timekeeping_suspended warning on resume
    - scsi: dc395: Fix error case unwinding
    - JFS: fix memleak in jfs_mount
    - ALSA: hda: Reduce udelay() at SKL+ position reporting
    - ALSA: hda: Release controller display power during shutdown/reboot
    - ALSA: hda: Fix hang during shutdown due to link reset
    - ALSA: hda: Use position buffer for SKL+ again
    - soundwire: debugfs: use controller id and link_id for debugfs
    - scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp()
    - driver core: Fix possible memory leak in device_link_add()
    - [x86] ASoC: SOF: topology: do not power down primary core during topology
      removal
    - [arm64,armhf] soc/tegra: Fix an error handling path in
      tegra_powergate_power_up()
    - [powerpc*] Refactor is_kvm_guest() declaration to new header
    - [powerpc*] Rename is_kvm_guest() to check_kvm_guest()
    - [powerpc*] Reintroduce is_kvm_guest() as a fast-path check
    - [powerpc*] Fix is_kvm_guest() / kvm_para_available()
    - [powerpc*] fix unbalanced node refcount in check_kvm_guest()
    - serial: 8250_dw: Drop wrong use of ACPI_PTR()
    - scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
    - RDMA/mlx4: Return missed an error if device doesn't support steering
    - iio: adis: do not disabe IRQs in 'adis_init()'
    - scsi: ufs: Refactor ufshcd_setup_clocks() to remove skip_ref_clk
    - [arm64,armhf] serial: imx: fix detach/attach of serial console
    - [arm*] usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init
    - [arm*] usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be
      disabled
    - [arm*] usb: dwc2: drd: reset current session before setting the new one
    - [arm64] firmware: qcom_scm: Fix error retval in
      __qcom_scm_is_call_available()
    - [arm64] phy: qcom-qusb2: Fix a memory leak on probe
    - [armhf] phy: ti: gmii-sel: check of_get_address() for failure
    - [arm64] serial: xilinx_uartps: Fix race condition causing stuck TX
    - HID: u2fzero: clarify error check and length calculations
    - HID: u2fzero: properly handle timeouts in usb_submit_urb
    - virtio_ring: check desc == NULL when using indirect with packed
    - [mips*] cm: Convert to bitfield API to fix out-of-bounds access
    - apparmor: fix error check
    - rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
    - nfsd: don't alloc under spinlock in rpc_parse_scope_id
    - NFS: Fix dentry verifier races
    - pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
    - drm/plane-helper: fix uninitialized variable reference
    - [arm64] PCI: aardvark: Don't spam about PIO Response Status
    - [arm64] PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on
      emulated bridge
    - opp: Fix return in _opp_add_static_v2()
    - NFS: Fix deadlocks in nfs_scan_commit_list()
    - fs: orangefs: fix error return code of orangefs_revalidate_lookup()
    - [arm64] mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
    - mtd: core: don't remove debugfs directory if device is in use
    - [armhf] remoteproc: Fix a memory leak in an error handling path in
      'rproc_handle_vdev()'
    - NFS: Fix up commit deadlocks
    - NFS: Fix an Oops in pnfs_mark_request_commit()
    - Fix user namespace leak
    - [arm64] soc: fsl: dpaa2-console: free buffer before returning from
      dpaa2_console_read
    - netfilter: nfnetlink_queue: fix OOB when mac header was cleared
    - [x86] watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
    - scsi: qla2xxx: Changes to support FCP2 Target
    - scsi: qla2xxx: Relogin during fabric disturbance
    - scsi: qla2xxx: Fix gnl list corruption
    - scsi: qla2xxx: Turn off target reset during issue_lip
    - NFSv4: Fix a regression in nfs_set_open_stateid_locked()
    - xen-pciback: Fix return in pm_ctrl_init()
    - [armhf] net: davinci_emac: Fix interrupt pacing disable
    - ethtool: fix ethtool msg len calculation for pause stats
    - net: vlan: fix a UAF in vlan_dev_real_dev()
    - ice: Fix replacing VF hardware MAC to existing MAC filter
    - ice: Fix not stopping Tx queues for VFs
    - [x86] ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
    - net: phy: fix duplex out of sync problem while changing settings
    - bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
    - mfd: core: Add missing of_node_put for loop iteration
    - mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and
      zs_unregister_migration()
    - zram: off by one in read_block_state()
    - llc: fix out-of-bound array index in llc_sk_dev_hash()
    - nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
    - [arm64] pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
    - bpf, sockmap: Remove unhash handler for BPF sockmap usage
    - bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
    - [amd64] gve: Fix off by one in gve_tx_timeout()
    - seq_file: fix passing wrong private data
    - net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any
    - [arm64] net: hns3: fix kernel crash when unload VF while it is being reset
    - [arm64] net: hns3: allow configure ETS bandwidth of all TCs
    - net: stmmac: allow a tc-taprio base-time of zero
    - vsock: prevent unnecessary refcnt inc for nonblocking connect
    - net/smc: fix sk_refcnt underflow on linkdown and fallback
    - cxgb4: fix eeprom len when diagnostics not implemented
    - [armel,armhf] 9155/1: fix early early_iounmap()
    - [armhf] 9156/1: drop cc-option fallbacks for architecture selection
    - [x86] mce: Add errata workaround for Skylake SKX37
    - posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()
    - f2fs: should use GFP_NOFS for directory inodes
    - net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
    - 9p/net: fix missing error check in p9_check_errors
    - memcg: prohibit unconditional exceeding the limit of dying tasks
    - [powerpc*] lib: Add helper to check if offset is within conditional branch
      range
    - [powerpc*] bpf: Validate branch ranges
    - [powerpc*] security: Add a helper to query stf_barrier type
    - [powerpc*] bpf: Emit stf barrier instruction sequences for BPF_NOSPEC
    - mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
    - mm, oom: do not trigger out_of_memory from the #PF
    - video: backlight: Drop maximum brightness override for brightness zero
    - [s390x] cio: check the subchannel validity for dev_busid
    - [s390x] tape: fix timer initialization in tape_std_assign()
    - [s390x] ap: Fix hanging ioctl caused by orphaned replies
    - [s390x] cio: make ccw_device_dma_* more robust
    - [powerpc*] powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module
      unload
    - [arm64,armhf] drm/sun4i: Fix macros in sun8i_csc.h
    - PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
    - [arm64] PCI: aardvark: Fix PCIe Max Payload Size setting
    - SUNRPC: Partial revert of commit 6f9f17287e78
    - ath10k: fix invalid dma_addr_t token assignment
    - arch/cc: Introduce a function to check for confidential computing features
    - [arm64,armhf] soc/tegra: pmc: Fix imbalanced clock disabling in error code
      path
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.81
    - block: Add a helper to validate the block size
    - loop: Use blk_validate_block_size() to validate block size
    - bootconfig: init: Fix memblock leak in xbc_make_cmdline()
    - net: stmmac: add clocks management for gmac driver
    - net: stmmac: fix missing unlock on error in stmmac_suspend()
    - net: stmmac: fix system hang if change mac address after interface ifdown
    - net: stmmac: fix issue where clk is being unprepared twice
    - [arm64,armhf] net: stmmac: dwmac-rk: fix unbalanced pm_runtime_enable
      warnings
    - [x86] iopl: Fake iopl(3) CLI/STI usage
    - PCI/MSI: Destroy sysfs before freeing entries
    - PCI/MSI: Deal with devices lying about their MSI mask capability
    - PCI: Add MSI masking quirk for Nvidia ION AHCI
    - erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()
    - erofs: fix unsafe pagevec reuse of hooked pclusters
    - scripts/lld-version.sh: Rewrite based on upstream ld-version.sh
    - perf/core: Avoid put_page() when GUP fails
    - thermal: Fix NULL pointer dereferences in of_thermal_ functions
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.82
    - [arm64] zynqmp: Do not duplicate flash partition label property
    - [arm64] zynqmp: Fix serial compatible string
    - scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
    - [armhf] bus: ti-sysc: Add quirk handling for reinit on context lost
    - [armhf] bus: ti-sysc: Use context lost quirk for otg
    - [armhf] usb: musb: tusb6010: check return value after calling
      platform_get_resource()
    - [x86] usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
    - staging: rtl8723bs: remove possible deadlock when disconnect (v2)
    - [x86] ASoC: SOF: Intel: hda-dai: fix potential locking issue
    - [armhf] clk: imx: imx6ul: Move csi_sel mux to correct base register
    - [x86] ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect
    - scsi: advansys: Fix kernel pointer leak
    - ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336
      codec
    - firmware_loader: fix pre-allocated buf built-in firmware use
    - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
    - scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
    - scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
    - scsi: target: Fix ordered tag handling
    - scsi: target: Fix alua_tg_pt_gps_count tracking
    - iio: imu: st_lsm6dsx: Avoid potential array overflow in
      st_lsm6dsx_set_odr()
    - [i386] ALSA: gus: fix null pointer dereference on pointer block
    - maple: fix wrong return value of maple_bus_init().
    - f2fs: fix up f2fs_lookup tracepoints
    - f2fs: fix to use WHINT_MODE
    - f2fs: compress: disallow disabling compress on non-empty compressed file
    - f2fs: fix incorrect return value in f2fs_sanity_check_ckpt()
    - [armhf] clk/ast2600: Fix soc revision for AHB
    - [arm64] clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk
    - sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
    - [x86] perf/x86/vlbr: Add c->flags to vlbr event constraints
    - blkcg: Remove extra blkcg_bio_issue_init
    - perf bpf: Avoid memory leak from perf_env__insert_btf()
    - perf bench futex: Fix memory leak of perf_cpu_map__new()
    - perf tests: Remove bash construct from record+zstd_comp_decomp.sh
    - drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame
    - net-zerocopy: Copy straggler unaligned data for TCP Rx. zerocopy.
    - net-zerocopy: Refactor skb frag fast-forward op.
    - tcp: Fix uninitialized access in skb frags array for Rx 0cp.
    - tracing: Add length protection to histogram string copies
    - bnxt_en: reject indirect blk offload when hw-tc-offload is off
    - tipc: only accept encrypted MSG_CRYPTO msgs
    - net: reduce indentation level in sk_clone_lock()
    - sock: fix /proc/net/sockstat underflow in sk_clone_lock()
    - net/smc: Make sure the link_id is unique
    - iavf: Fix return of set the new channel count
    - iavf: check for null in iavf_fix_features
    - iavf: free q_vectors before queues in iavf_disable_vf
    - iavf: Fix failure to exit out from last all-multicast mode
    - iavf: prevent accidental free of filter structure
    - iavf: validate pointers
    - iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
    - iavf: Fix for setting queues to 0
    - [x86] platform/x86: hp_accel: Fix an error handling path in
      'lis3lv02d_probe()'
    - net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()
    - net/mlx5: Lag, update tracker when state change event received
    - net/mlx5: E-Switch, Change mode lock from mutex to rw semaphore
    - net/mlx5: E-Switch, return error if encap isn't supported
    - scsi: core: sysfs: Fix hang when device state is set via sysfs
    - net: sched: act_mirred: drop dst for the direction from egress to ingress
    - [arm64] net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
    - net: virtio_net_hdr_to_skb: count transport header in UFO
    - i40e: Fix correct max_pkt_size on VF RX queue
    - i40e: Fix NULL ptr dereference on VSI filter sync
    - i40e: Fix changing previously set num_queue_pairs for PFs
    - i40e: Fix ping is lost after configuring ADq on VF
    - i40e: Fix warning message and call stack during rmmod i40e driver
    - i40e: Fix creation of first queue by omitting it if is not power of two
    - i40e: Fix display error code in dmesg
    - e100: fix device suspend/resume (Closes: #995927)
    - [powerpc*] KVM: PPC: Book3S HV: Use GLOBAL_TOC for
      kvmppc_h_set_dabr/xdabr()
    - [x86] perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake
      Server
    - [x86] perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
    - [s390x] kexec: fix return code handling
    - [arm64,armhf] net: stmmac: dwmac-rk: Fix ethernet on rk3399 based devices
    - tun: fix bonding active backup with arp monitoring
    - tipc: check for null after calling kmemdup
    - ipc: WARN if trying to remove ipc object which is absent
    - [x86] hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup
      fails
    - scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id()
    - [s390x] kexec: fix memory leak of ipl report buffer
    - block: Check ADMIN before NICE for IOPRIO_CLASS_RT
    - [x86] KVM: nVMX: don't use vcpu->arch.efer when checking host state on
      nested state load
    - udf: Fix crash after seekdir
    - [armhf] net: stmmac: socfpga: add runtime suspend/resume callback for
      stratix10 platform
    - btrfs: fix memory ordering between normal and ordered work functions
    - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
    - drm/udl: fix control-message timeout
    - drm/nouveau: Add a dedicated mutex for the clients list (CVE-2020-27820)
    - drm/nouveau: use drm_dev_unplug() during device removal (CVE-2020-27820)
    - drm/nouveau: clean up all clients on device removal (CVE-2020-27820)
    - [x86] drm/i915/dp: Ensure sink rate values are always valid
    - drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga
      and dvi connectors
    - scsi: ufs: core: Fix task management completion
    - scsi: ufs: core: Fix task management completion timeout race
    - hugetlbfs: flush TLBs correctly after huge_pmd_unshare (CVE-2021-4002)
    - RDMA/netlink: Add __maybe_unused to static inline in C file
    - selinux: fix NULL-pointer dereference when hashtab allocation fails
    - ASoC: DAPM: Cover regression by kctl change notification fix
    - ice: Delete always true check of PF pointer
    - fs: export an inode_update_time helper
    - btrfs: update device path inode time instead of bd_inode
    - [x86] ALSA: hda: hdac_ext_stream: fix potential locking issues
    - ALSA: hda: hdac_stream: fix potential locking issue in
      snd_hdac_stream_assign()
    - Revert "perf: Rework perf_event_exit_event()"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.83
    - bpf: Fix toctou on read-only map's constant scalar tracking
      (CVE-2021-4001)
    - ACPI: Get acpi_device's parent from the parent field
    - USB: serial: option: add Telit LE910S1 0x9200 composition
    - USB: serial: option: add Fibocom FM101-GL variants
    - [arm*] usb: dwc2: gadget: Fix ISOC flow for elapsed frames
    - [arm*] usb: dwc2: hcd_queue: Fix use of floating point literal
    - [arm64,armhf] usb: dwc3: gadget: Ignore NoStream after End Transfer
    - [arm64,armhf] usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer
    - [arm64,armhf] usb: dwc3: gadget: Fix null pointer exception
    - net: nexthop: fix null pointer dereference when IPv6 is not enabled
    - [arm64,armhf] usb: chipidea: ci_hdrc_imx: fix potential error pointer
      dereference in probe
    - usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts
    - usb: hub: Fix usb enumeration issue due to address0 race
    - usb: hub: Fix locking issues with address0_mutex
    - [arm*] binder: fix test regression due to sender_euid change
    - ALSA: ctxfi: Fix out-of-range access
    - ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100
    - ALSA: hda/realtek: Fix LED on HP ProBook 435 G7
    - media: cec: copy sequence field for the reply
    - HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts
    - [x86] staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
    - fuse: release pipe buf after last use
    - xen: don't continue xenstore initialization in case of errors
    - xen: detect uninitialized xenbus in xenbus_init
    - [powerpc*] KVM: PPC: Book3S HV: Prevent POWER7/8 TLB flush flushing SLB
    - tracing/uprobe: Fix uprobe_perf_open probes iteration
    - tracing: Fix pid filtering when triggers are attached
    - [arm64,armhf] mmc: sdhci-esdhc-imx: disable CMDQ support
    - mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB
    - [armhf] mdio: aspeed: Fix "Link is Down" issue
    - [arm64] PCI: aardvark: Deduplicate code in advk_pcie_rd_conf()
    - [arm64] PCI: aardvark: Update comment about disabling link training
    - [arm64] PCI: aardvark: Implement re-issuing config requests on CRS
      response
    - [arm64] PCI: aardvark: Simplify initialization of rootcap on virtual
      bridge
    - [arm64] PCI: aardvark: Fix link training
    - proc/vmcore: fix clearing user buffer by properly using clear_user()
    - netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY
    - netfilter: ctnetlink: do not erase error code with EINVAL
    - netfilter: ipvs: Fix reuse connection if RS weight is 0
    - netfilter: flowtable: fix IPv6 tunnel addr match
    - [x86] ASoC: topology: Add missing rwsem around snd_ctl_remove() calls
    - net: ieee802154: handle iftypes as u32
    - NFSv42: Don't fail clone() unless the OP_CLONE operation failed
    - [armhf] socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
    - drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks
    - scsi: mpt3sas: Fix kernel panic during drive powercycle test
    - [arm*] drm/vc4: fix error code in vc4_create_object()
    - iavf: Prevent changing static ITR values if adaptive moderation is on
    - ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336 codec
    - [arm64,armhf] firmware: smccc: Fix check for ARCH_SOC_ID not implemented
    - ipv6: fix typos in __ip6_finish_output()
    - nfp: checking parameter process for rx-usecs/tx-usecs is invalid
    - net: stmmac: fix system hang caused by eee_ctrl_timer during
      suspend/resume
    - net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls
    - net: ipv6: add fib6_nh_release_dsts stub
    - net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group
    - ice: fix vsi->txq_map sizing
    - ice: avoid bpf_prog refcount underflow
    - scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
    - scsi: scsi_debug: Zero clear zones at reset write pointer
    - erofs: fix deadlock when shrink erofs slab
    - net/smc: Ensure the active closing peer first closes clcsock
    - [arm64,armhf] net: marvell: mvpp2: increase MTU limit when XDP enabled
    - nvmet-tcp: fix incomplete data digest send
    - [armhf] net/ncsi : Add payload to be 32-bit aligned to fix dropped packets
    - PM: hibernate: use correct mode for swsusp_close()
    - drm/amd/display: Set plane update flags for all planes in reset
    - tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited
      flows
    - lan743x: fix deadlock in lan743x_phy_link_status_change()
    - net: phylink: Force link down and retrigger resolve on interface change
    - net: phylink: Force retrigger in case of latched link-fail indicator
    - net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
    - net/smc: Fix loop in smc_listen
    - nvmet: use IOCB_NOWAIT only if the filesystem supports it
    - igb: fix netpoll exit with traffic
    - [mips*] loongson64: fix FTLB configuration
    - [mips*] use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48
    - net/sched: sch_ets: don't peek at classes beyond 'nbands'
    - net: vlan: fix underflow for the real_dev refcnt
    - net/smc: Don't call clcsock shutdown twice when smc shutdown
    - [arm64] net: hns3: fix VF RSS failed problem after PF enable multi-TCs
    - [arm64] net: mscc: ocelot: don't downgrade timestamping RX filters in
      SIOCSHWTSTAMP
    - [arm64] net: mscc: ocelot: correctly report the timestamping RX filters in
      ethtool
    - tcp: correctly handle increased zerocopy args struct size
    - sched/scs: Reset task stack state in bringup_cpu()
    - f2fs: set SBI_NEED_FSCK flag when inconsistent node block found
    - ceph: properly handle statfs on multifs setups
    - smb3: do not error on fsync when readonly
    - [amd64] iommu/amd: Clarify AMD IOMMUv2 initialization messages
    - vhost/vsock: fix incorrect used length reported to the guest
    - tracing: Check pid filtering when creating events
    - xen: sync include/xen/interface/io/ring.h with Xen's newest version
    - xen/blkfront: read response from backend only once
    - xen/blkfront: don't take local copy of a request from the ring page
    - xen/blkfront: don't trust the backend response data blindly
    - xen/netfront: read response from backend only once
    - xen/netfront: don't read data from request on the ring page
    - xen/netfront: disentangle tx_skb_freelist
    - xen/netfront: don't trust the backend response data blindly
    - tty: hvc: replace BUG_ON() with negative return value
    - [s390x] mm: validate VMA in PGSTE manipulation functions
    - shm: extend forced shm destroy to support objects from several IPC nses
    - net: stmmac: platform: fix build warning when with !CONFIG_PM_SLEEP
    - drm/amdgpu/gfx9: switch to golden tsc registers for renoir+
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.84
    - NFSv42: Fix pagecache invalidation after COPY/CLONE
    - can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
    - ovl: simplify file splice
    - ovl: fix deadlock in splice write
    - gfs2: release iopen glock early in evict
    - gfs2: Fix length of holes reported at end-of-file
    - [powerpc*] pseries/ddw: Revert "Extend upper limit for huge DMA window for
      persistent memory"
    - mac80211: do not access the IV when it was stripped
    - net/smc: Transfer remaining wait queue entries during fallback
    - [amd64,arm64] atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait
      (CVE-2021-43975)
    - net: return correct error code
    - [x86] platform/x86: thinkpad_acpi: Add support for dual fan control
    - [x86] platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3
      deep
    - [s390x] setup: avoid using memblock_enforce_memory_limit
    - btrfs: check-integrity: fix a warning on write caching disabled disk
    - thermal: core: Reset previous low and high trip during thermal zone init
    - scsi: iscsi: Unblock session then wake up error handler
    - drm/amd/amdgpu: fix potential memleak
    - ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile
    - [arm64] ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array
      overflow in hns_dsaf_ge_srst_by_port()
    - ipv6: check return value of ipv6_skip_exthdr
    - net/smc: Avoid warning of possible recursive locking
    - ACPI: Add stubs for wakeup handler functions
    - vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
    - kprobes: Limit max data_size of the kretprobe instances
    - rt2x00: do not mark device gone on EPROTO errors during start
    - ipmi: Move remove_work to dedicated workqueue
    - cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink()
    - [s390x] pci: move pseudo-MMIO to prevent MIO overlap
    - fget: check that the fd still exists after getting a ref to it
    - ipv6: fix memory leak in fib6_rule_suppress
    - drm/amd/display: Allow DSC on supported MST branch devices
    - KVM: Disallow user memslot with size that exceeds "unsigned long"
    - [x86] KVM: nVMX: Flush current VPID (L1 vs. L2) for
      KVM_REQ_TLB_FLUSH_GUEST
    - [x86] KVM: x86: Use a stable condition around all VT-d PI paths
    - [arm64] KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and
      CPTR_EL2 to 1
    - [x86] KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg()
    - wireguard: allowedips: add missing __rcu annotation to satisfy sparse
    - wireguard: device: reset peer src endpoint when netns exits
    - wireguard: receive: use ring buffer for incoming handshakes
    - wireguard: receive: drop handshakes if queue lock is contended
    - wireguard: ratelimiter: use kvcalloc() instead of kvzalloc()
    - [armhf] i2c: stm32f7: flush TX FIFO upon transfer errors
    - [armhf] i2c: stm32f7: recover the bus on access timeout
    - [armhf] i2c: stm32f7: stop dma transfer in case of NACK
    - tcp: fix page frag corruption on page fault
    - net: qlogic: qlcnic: Fix a NULL pointer dereference in
      qlcnic_83xx_add_rings()
    - net: mpls: Fix notifications when deleting a device
    - siphash: use _unaligned version by default
    - [arm64] ftrace: add missing BTIs
    - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
    - rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
    - rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
    - ALSA: intel-dsp-config: add quirk for CML devices based on ES8336 codec
    - net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no
      IRQ is available
    - [arm64,armhf] net: marvell: mvpp2: Fix the computation of shared CPUs
    - [arm64] dpaa2-eth: destroy workqueue at the end of remove function
    - net: annotate data-races on txq->xmit_lock_owner
    - ipv4: convert fib_num_tclassid_users to atomic_t
    - net/smc: fix wrong list_del in smc_lgr_cleanup_early
    - net/rds: correct socket tunable error in rds_tcp_tune()
    - net/smc: Keep smc_close_final rc during active close
    - [arm64] drm/msm/a6xx: Allocate enough space for GMU registers
    - [arm64] drm/msm: Do hw_init() before capturing GPU state
    - [amd64,arm64] atlantic: Increase delay for fw transactions
    - [amd64,arm64] atlatnic: enable Nbase-t speeds with base-t
    - [amd64,arm64] atlantic: Fix to display FW bundle version instead of FW mac
      version.
    - [amd64,arm64] atlantic: Add missing DIDs and fix 115c.
    - [amd64,arm64] Remove Half duplex mode speed capabilities.
    - [amd64,arm64] atlantic: Fix statistics logic for production hardware
    - [amd64,arm64] atlantic: Remove warn trace message.
    - [x86] KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register
    - [x86] KVM: VMX: Set failure code in prepare_vmcs02()
    - [x86] entry: Use the correct fence macro after swapgs in kernel CR3
    - [x86] xen: Add xenpv_restore_regs_and_return_to_usermode()
    - sched/uclamp: Fix rq->uclamp_max not set on first enqueue
    - [x86] pv: Switch SWAPGS to ALTERNATIVE
    - [x86] entry: Add a fence for kernel entry SWAPGS in paranoid_entry()
    - vgacon: Propagate console boot parameters before calling `vc_resize'
    - xhci: Fix commad ring abort, write all 64 bits to CRCR register.
    - USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub
    - usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
    - [x86] tsc: Add a timer to make sure TSC_adjust is always checked
    - [x86] tsc: Disable clocksource watchdog for TSC on qualified platorms
    - [x86] 64/mm: Map all kernel memory into trampoline_pgd
    - [arm64] tty: serial: msm_serial: Deactivate RX DMA for polling support
    - [arm*] serial: pl011: Add ACPI SBSA UART match id
    - [arm64,armhf] serial: tegra: Change lower tolerance baud rate limit for
      tegra20 and tegra30
    - serial: core: fix transmit-buffer reset and memleak
    - serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array
    - serial: 8250_pci: rewrite pericom_do_set_divisor()
    - serial: 8250: Fix RTS modem control while in rs485 mode
    - iwlwifi: mvm: retry init flow if failed
    - ipmi: msghandler: Make symbol 'remove_work_wq' static

  [ Salvatore Bonaccorso ]
  * integrity: Drop "MODSIGN: load blacklist from MOKx" as redundant after
    5.10.47.
  * Bump ABI to 10
  * Refresh "tools/perf: pmu-events: Fix reproducibility"
  * [rt] Update to 5.10.73-rt54
  * [rt] Refresh "tracing: Merge irqflags + preempt counter."
  * Refresh "Export symbols needed by Android drivers"
  * [rt] Refresh "printk: introduce kernel sync mode"
  * [rt] Refresh "printk: move console printing to kthreads"
  * [rt] Drop "rcutorture: Avoid problematic critical section nesting on RT"
  * [rt] Add new signing key for Luis Claudio R. Goncalves
  * [rt] Update to 5.10.83-rt58

  [ Ben Hutchings ]
  * tools/perf: Fix warning introduced by "tools/perf: pmu-events: Fix
    reproducibility"

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 08 Dec 2021 17:21:12 +0100

linux (5.10.70-1) bullseye; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.47
    - module: limit enabling module.sig_enforce (CVE-2021-35039)
    - drm: add a locked version of drm_is_current_master
    - drm/nouveau: wait for moving fence after pinning v2
    - drm/radeon: wait for moving fence after pinning
    - drm/amdgpu: wait for moving fence after pinning
    - [arm64] mmc: meson-gx: use memcpy_to/fromio for dram-access-quirk
    - [arm64] Ignore any DMA offsets in the max_zone_phys() calculation
    - [arm64] Force NO_BLOCK_MAPPINGS if crashkernel reservation is required
    - [arm64] spi: spi-nxp-fspi: move the register operation after the clock
      enable
    - [arm*] drm/vc4: hdmi: Move the HSM clock enable to runtime_pm
    - [arm*] drm/vc4: hdmi: Make sure the controller is powered in detect
    - [x86] entry: Fix noinstr fail in __do_fast_syscall_32()
    - [amd64] x86/xen: Fix noinstr fail in exc_xen_unknown_trap()
    - locking/lockdep: Improve noinstr vs errors
    - [x86] perf/x86/lbr: Remove cpuc->lbr_xsave allocation from atomic context
    - [x86] perf/x86/intel/lbr: Zero the xstate buffer on allocation
    - [armhf] dmaengine: stm32-mdma: fix PM reference leak in
      stm32_mdma_alloc_chan_resourc()
    - mac80211: remove warning in ieee80211_get_sband()
    - mac80211_hwsim: drop pending frames on stop
    - cfg80211: call cfg80211_leave_ocb when switching away from OCB
    - net: ipv4: Remove unneed BUG() function
    - mac80211: drop multicast fragments
    - net: ethtool: clear heap allocations for ethtool function
    - inet: annotate data race in inet_send_prepare() and inet_dgram_connect()
    - ping: Check return value of function 'ping_queue_rcv_skb'
    - net: annotate data race in sock_error()
    - inet: annotate date races around sk->sk_txhash
    - net/packet: annotate data race in packet_sendmsg()
    - net: phy: dp83867: perform soft reset and retain established link
    - net/packet: annotate accesses to po->bind
    - net/packet: annotate accesses to po->ifindex
    - r8152: Avoid memcpy() over-reading of ETH_SS_STATS
    - r8169: Avoid memcpy() over-reading of ETH_SS_STATS
    - net: qed: Fix memcpy() overflow of qed_dcbx_params()
    - mac80211: reset profile_periodicity/ema_ap
    - mac80211: handle various extensible elements correctly
    - [x86] PCI: Add AMD RS690 quirk to enable 64-bit DMA
    - [x86] perf/x86: Track pmu in per-CPU cpu_hw_events
    - [armhf] pinctrl: stm32: fix the reported number of GPIO lines per bank
    - i2c: i801: Ensure that SMBHSTSTS_INUSE_STS is cleared when leaving
      i801_access
    - gpiolib: cdev: zero padding during conversion to gpioline_info_changed
    - scsi: sd: Call sd_revalidate_disk() for ioctl(BLKRRPART)
    - nilfs2: fix memory leak in nilfs_sysfs_delete_device_group
    - [s390x] stack: fix possible register corruption with stack switch helper
    - i2c: robotfuzz-osif: fix control-request directions
    - ceph: must hold snap_rwsem when filling inode for async create
    - kthread_worker: split code for canceling the delayed work timer
    - kthread: prevent deadlock when kthread_mod_delayed_work() races with
      kthread_cancel_delayed_work_sync()
    - [x86] fpu: Preserve supervisor states in sanitize_restored_user_xstate()
    - [x86] fpu: Make init_fpstate correct with optimized XSAVE
    - mm: add VM_WARN_ON_ONCE_PAGE() macro
    - mm/rmap: remove unneeded semicolon in page_not_mapped()
    - mm/rmap: use page_not_mapped in try_to_unmap()
    - mm, thp: use head page in __migration_entry_wait()
    - mm/thp: fix __split_huge_pmd_locked() on shmem migration entry
    - mm/thp: make is_huge_zero_pmd() safe and quicker
    - mm/thp: try_to_unmap() use TTU_SYNC for safe splitting
    - mm/thp: fix vma_address() if virtual address below file offset
    - mm/thp: fix page_address_in_vma() on file THP tails
    - mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page()
    - mm: thp: replace DEBUG_VM BUG with VM_WARN when unmap fails for split
    - mm: page_vma_mapped_walk(): use page for pvmw->page
    - mm: page_vma_mapped_walk(): settle PageHuge on entry
    - mm: page_vma_mapped_walk(): use pmde for *pvmw->pmd
    - mm: page_vma_mapped_walk(): prettify PVMW_MIGRATION block
    - mm: page_vma_mapped_walk(): crossing page table boundary
    - mm: page_vma_mapped_walk(): add a level of indentation
    - mm: page_vma_mapped_walk(): use goto instead of while (1)
    - mm: page_vma_mapped_walk(): get vma_address_end() earlier
    - mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes
    - mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk()
    - mm, futex: fix shared futex pgoff on shmem huge page
    - [x86] KVM: SVM: Call SEV Guest Decommission if ASID binding fails
    - netfs: fix test for whether we can skip read when writing beyond EOF
    - Revert "drm: add a locked version of drm_is_current_master"
    - certs: Add EFI_CERT_X509_GUID support for dbx entries (CVE-2020-26541)
    - certs: Move load_system_certificate_list to a common function
    - certs: Add ability to preload revocation certs
    - integrity: Load mokx variables into the blacklist keyring
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.48
    - scsi: sr: Return appropriate error code when disk is ejected
    - [arm64,armhf] gpio: mxc: Fix disabled interrupt wake-up support
    - drm/nouveau: fix dma_address check for CPU/GPU sync
    - RDMA/mlx5: Block FDB rules when not in switchdev mode
    - [x86] Revert "KVM: x86/mmu: Drop kvm_mmu_extended_role.cr4_la57 hack"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.49
    - [powerpc*] KVM: PPC: Book3S HV: Save and restore FSCR in the P9 path
    - media: uvcvideo: Support devices that report an OT as an entity source
    - xen/events: reset active flag for lateeoi events later
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.50
    - Bluetooth: hci_qca: fix potential GPF
    - Bluetooth: btqca: Don't modify firmware contents in-place
    - Bluetooth: Remove spurious error message
    - ALSA: usb-audio: fix rate on Ozone Z90 USB headset
    - ALSA: usb-audio: Fix OOB access at proc output
    - ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire
    - ALSA: usb-audio: scarlett2: Fix wrong resume call
    - ALSA: intel8x0: Fix breakage at ac97 clock measurement
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8
    - ALSA: hda/realtek: Add another ALC236 variant support
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8
    - ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx
    - ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D
    - ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook
      PC
    - media: dvb-usb: fix wrong definition
    - Input: usbtouchscreen - fix control-request directions
    - net: can: ems_usb: fix use-after-free in ems_usb_disconnect()
    - usb: gadget: eem: fix echo command packet response issue
    - USB: cdc-acm: blacklist Heimann USB Appset device
    - [arm64,armhf] usb: dwc3: Fix debugfs creation flow
    - usb: typec: Add the missed altmode_id_remove() in typec_register_altmode()
    - xhci: solve a double free problem while doing s4
    - gfs2: Fix underflow in gfs2_page_mkwrite
    - gfs2: Fix error handling in init_statfs
    - copy_page_to_iter(): fix ITER_DISCARD case
    - iov_iter_fault_in_readable() should do nothing in xarray case
    - [powerpc*] crypto: nx - Fix memcpy() over-reading in nonce
    - [amd64] crypto: ccp - Annotate SEV Firmware file names
    - [armel,armhf] arm_pmu: Fix write counter incorrect in ARMv7 big-endian
      mode
    - btrfs: send: fix invalid path for unlink operations after parent
      orphanization
    - btrfs: compression: don't try to compress if we don't have enough pages
    - btrfs: clear defrag status of a root if starting transaction fails
    - ext4: cleanup in-core orphan list if ext4_truncate() failed to get a
      transaction handle
    - ext4: fix kernel infoleak via ext4_extent_header
    - ext4: fix overflow in ext4_iomap_alloc()
    - ext4: return error code when ext4_fill_flex_info() fails
    - ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit
    - ext4: remove check for zero nr_to_scan in ext4_es_scan()
    - ext4: fix avefreec in find_group_orlov
    - ext4: use ext4_grp_locked_error in mb_find_extent
    - can: gw: synchronize rcu operations before removing gw job entry
    - can: isotp: isotp_release(): omit unintended hrtimer restart on socket
      release
    - can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after
      RCU is done
    - can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue
      in TX path
    - mac80211: remove iwlwifi specific workaround that broke sta NDP tx
    - SUNRPC: Fix the batch tasks count wraparound.
    - SUNRPC: Should wake up the privileged task firstly.
    - bus: mhi: Wait for M2 state during system resume
    - mm/gup: fix try_grab_compound_head() race with split_huge_page()
    - [arm64] perf/smmuv3: Don't trample existing events with global filter
    - [x86] KVM: nVMX: Handle split-lock #AC exceptions that happen in L2
    - [x86] KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow
      MMUs
    - [x86] KVM: x86/mmu: Use MMU's role to detect CR4.SMEP value in nested NPT
      walk
    - [s390x] cio: dont call css_wait_for_slow_path() inside a lock
    - [s390x] mm: Fix secure storage access exception handling
    - f2fs: Prevent swap file in LFS mode
    - [armhf] rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error
      path
    - iio: light: tcs3472: do not free unallocated IRQ
    - iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and
      PS_DATA as volatile, too
    - iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR
    - iio: ltr501: ltr501_read_ps(): add missing endianness conversion
    - iio: accel: bma180: Fix BMA25x bandwidth register values
    - [arm64] serial: mvebu-uart: fix calculation of clock divisor
    - [sh4] serial: sh-sci: Stop dmaengine transfer in sci_stop_tx()
    - serial_cs: Add Option International GSM-Ready 56K/ISDN modem
    - serial_cs: remove wrong GLOBETROTTER.cis entry
    - ath9k: Fix kernel NULL pointer dereference during ath_reset_internal()
    - ssb: sdio: Don't overwrite const buffer if block_write fails
    - rsi: Assign beacon rate settings to the correct rate_info descriptor field
    - rsi: fix AP mode with WPA failure due to encrypted EAPOL
    - tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
    - seq_buf: Make trace_seq_putmem_hex() support data longer than 8
    - [powerpc*] stacktrace: Fix spurious "stale" traces in
      raise_backtrace_ipi()
    - loop: Fix missing discard support when using LOOP_CONFIGURE
    - fuse: Fix crash in fuse_dentry_automount() error path
    - fuse: Fix crash if superblock of submount gets killed early
    - fuse: Fix infinite loop in sget_fc()
    - fuse: ignore PG_workingset after stealing
    - fuse: check connected before queueing on fpq->io
    - fuse: reject internal errno
    - [arm*] thermal/cpufreq_cooling: Update offline CPUs per-cpu
      thermal_pressure
    - spi: Make of_register_spi_device also set the fwnode
    - Add a reference to ucounts for each cred
    - media: marvel-ccic: fix some issues when getting pm_runtime
    - [i386] spi: spi-topcliff-pch: Fix potential double free in
      pch_spi_process_messages()
    - sched/core: Initialize the idle task with preemption disabled
    - [armhf] hwrng: exynos - Fix runtime PM imbalance on error
    - [powerpc*] crypto: nx - add missing MODULE_DEVICE_TABLE
    - media: cpia2: fix memory leak in cpia2_usb_probe
    - [arm64,armhf] media: hevc: Fix dependent slice segment flags
    - media: pvrusb2: fix warning in pvr2_i2c_core_done
    - [armhf] media: imx: imx7_mipi_csis: Fix logging of only error event
      counters
    - [x86] crypto: qat - check return code of qat_hal_rd_rel_reg()
    - [x86] crypto: qat - remove unused macro in FW loader
    - [arm64] crypto: qce: skcipher: Fix incorrect sg count for dma transfers
    - [arm64] perf: Convert snprintf to sysfs_emit
    - sched/fair: Fix ascii art by relpacing tabs
    - media: bt878: do not schedule tasklet when it is not setup
    - media: em28xx: Fix possible memory leak of em28xx struct
    - media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release
    - media: bt8xx: Fix a missing check bug in bt878_probe
    - media: dvd_usb: memory leak in cinergyt2_fe_attach
    - memstick: rtsx_usb_ms: fix UAF
    - mmc: via-sdmmc: add a check against NULL pointer dereference
    - [arm64,armhf] spi: meson-spicc: fix a wrong goto jump for avoiding memory
      leak.
    - [arm64,armhf] spi: meson-spicc: fix memory leak in meson_spicc_probe
    - crypto: shash - avoid comparing pointers to exported functions under CFI
    - media: dvb_net: avoid speculation from net slot
    - media: siano: fix device register error path
    - [armhf] media: imx-csi: Skip first few frames from a BT.656 source
    - [powerpc*] KVM: PPC: Book3S HV: Fix TLB management on SMT8 POWER9 and
      POWER10 processors
    - btrfs: fix error handling in __btrfs_update_delayed_inode
    - btrfs: abort transaction if we fail to update the delayed inode
    - btrfs: sysfs: fix format string for some discard stats
    - btrfs: don't clear page extent mapped if we're not invalidating the full
      page
    - btrfs: disable build on platforms having page size 256K
    - [s390x] KVM: get rid of register asm usage
    - [armhf] regulator: da9052: Ensure enough delay time for
      .set_voltage_time_sel
    - [x86] ACPI: video: use native backlight for GA401/GA502/GA503
    - HID: do not use down_interruptible() when unbinding devices
    - ACPI: processor idle: Fix up C-state latency if not ordered
    - [x86] hv_utils: Fix passing zero to 'PTR_ERR' warning
    - lib: vsprintf: Fix handling of number field widths in vsscanf
    - ACPI: EC: Make more Asus laptops use ECDT _GPE
    - block_dump: remove block_dump feature in mark_inode_dirty()
    - blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter
    - blk-mq: clear stale request in tags->rq[] before freeing one request pool
    - fs: dlm: cancel work sync othercon
    - random32: Fix implicit truncation warning in prandom_seed_state()
    - open: don't silently ignore unknown O-flags in openat2()
    - [x86] drivers: hv: Fix missing error code in vmbus_connect()
    - fs: dlm: fix memory leak when fenced
    - ACPICA: Fix memory leak caused by _CID repair function
    - ACPI: bus: Call kobject_put() in acpi_init() error path
    - ACPI: resources: Add checks for ACPI IRQ override
    - block: fix race between adding/removing rq qos and normal IO
    - [x86] platform/x86: asus-nb-wmi: Revert "Drop duplicate DMI quirk
      structures"
    - [x86] platform/x86: asus-nb-wmi: Revert "add support for ASUS ROG Zephyrus
      G14 and G15"
    - [x86] platform/x86: toshiba_acpi: Fix missing error code in
      toshiba_acpi_setup_keyboard()
    - nvme-pci: fix var. type for increasing cq_head
    - nvmet-fc: do not check for invalid target port in
      nvmet_fc_handle_fcp_rqst()
    - [amd64] EDAC/Intel: Do not load EDAC driver when running as a guest
    - [amd64] PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv()
    - cifs: improve fallocate emulation
    - ACPI: EC: trust DSDT GPE for certain HP laptop
    - clocksource: Retry clock read if long delays detected
    - clocksource: Check per-CPU clock synchronization when marked unstable
    - tpm_tis_spi: add missing SPI device ID entries
    - ACPI: tables: Add custom DSDT file as makefile prerequisite
    - HID: wacom: Correct base usage for capacitive ExpressKey status bits
    - cifs: fix missing spinlock around update to ses->status
    - [arm64] mailbox: qcom: Use PLATFORM_DEVID_AUTO to register platform device
    - block: fix discard request merge
    - kthread_worker: fix return value when kthread_mod_delayed_work() races
      with kthread_cancel_delayed_work_sync()
    - [ia64] mca_drv: fix incorrect array size calculation
    - writeback, cgroup: increment isw_nr_in_flight before grabbing an inode
    - spi: Allow to have all native CSs in use along with GPIOs
    - spi: Avoid undefined behaviour when counting unused native CSs
    - [arm64] media: venus: Rework error fail recover logic
    - [armhf] sata_highbank: fix deferred probing
    - sched/uclamp: Fix wrong implementation of cpu.uclamp.min
    - sched/uclamp: Fix locking around cpu_util_update_eff()
    - [mips*] pata_octeon_cf: avoid WARN_ON() in ata_host_activate()
    - [x86] elf: Use _BITUL() macro in UAPI headers
    - [x86] crypto: ccp - Fix a resource leak in an error handling path
    - media: rc: i2c: Fix an error message
    - media: au0828: fix a NULL vs IS_ERR() check
    - media: gspca/gl860: fix zero-length control requests
    - media: siano: Fix out-of-bounds warnings in
      smscore_load_firmware_family2()
    - [arm64] crypto: nitrox - fix unchecked variable in
      nitrox_register_interrupts
    - [amd64] crypto: x86/curve25519 - fix cpu feature checking logic in
      mod_exit
    - [arm64[ consistently use reserved_pg_dir
    - [arm64] mm: Fix ttbr0 values stored in struct thread_info for software-pan
    - media: subdev: remove VIDIOC_DQEVENT_TIME32 handling
    - hwmon: (lm70) Use device_get_match_data()
    - hwmon: (lm70) Revert "hwmon: (lm70) Add support for ACPI"
    - [x86] KVM: nVMX: Sync all PGDs on nested transition with shadow paging
    - [x86] KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap
    - [x86] KVM: nVMX: Don't clobber nested MMU's A/D status on EPTP switch
    - [x86] KVM: x86/mmu: Fix return value in tdp_mmu_map_handle_target_level()
    - [arm64] perf/arm-cmn: Fix invalid pointer when access dtc object sharing
      the same IRQ number
    - [arm64] KVM: arm64: Don't zero the cycle count register when PMCR_EL0.P is
      set
    - [arm64] regulator: hi655x: Fix pass wrong pointer to config.driver_data
    - btrfs: clear log tree recovering status if starting transaction fails
    - sched/rt: Fix RT utilization tracking during policy change
    - sched/rt: Fix Deadline utilization tracking during policy change
    - sched/uclamp: Fix uclamp_tg_restrict()
    - [armhf] spi: spi-sun6i: Fix chipselect/clock bug
    - [powerpc*] crypto: nx - Fix RCU warning in nx842_OF_upd_status
    - psi: Fix race between psi_trigger_create/destroy
    - media: v4l2-async: Clean v4l2_async_notifier_add_fwnode_remote_subdev
    - [armhf] media: video-mux: Skip dangling endpoints
    - PM / devfreq: Add missing error code in devfreq_add_device()
    - ACPI: PM / fan: Put fan device IDs into separate header file
    - block: avoid double io accounting for flush request
    - nvme-pci: look for StorageD3Enable on companion ACPI device instead
    - ACPI: sysfs: Fix a buffer overrun problem with description_show()
    - mark pstore-blk as broken
    - [armhf] clocksource/drivers/timer-ti-dm: Save and restore timer TIOCP_CFG
    - ACPI: APEI: fix synchronous external aborts in user-mode
    - blk-wbt: introduce a new disable state to prevent false positive by
      rwb_enabled()
    - blk-wbt: make sure throttle is enabled properly
    - ACPI: Use DEVICE_ATTR_<RW|RO|WO> macros
    - ACPI: bgrt: Fix CFI violation
    - cpufreq: Make cpufreq_online() call driver->offline() on errors
    - blk-mq: update hctx->dispatch_busy in case of real scheduler
    - ocfs2: fix snprintf() checking
    - dax: fix ENOMEM handling in grab_mapping_entry()
    - swap: fix do_swap_page() race with swapoff
    - mm/shmem: fix shmem_swapin() race with swapoff
    - mm: memcg/slab: properly set up gfp flags for objcg pointer array
    - mm: page_alloc: refactor setup_per_zone_lowmem_reserve()
    - mm/page_alloc: fix counting of managed_pages
    - xfrm: xfrm_state_mtu should return at least 1280 for ipv6
    - drm/bridge: Fix the stop condition of drm_bridge_chain_pre_enable()
    - drm/ast: Fix missing conversions to managed API
    - [arm64,armhf] net: mvpp2: Put fwnode in error case during ->probe()
    - [i386] net: pch_gbe: Propagate error from devm_gpio_request_one()
    - [x86] drm/vmwgfx: Mark a surface gpu-dirty after the SVGA3dCmdDXGenMips
      command
    - [x86] drm/vmwgfx: Fix cpu updates of coherent multisample surfaces
    - net: qrtr: ns: Fix error return code in qrtr_ns_init()
    - [arm64] clk: meson: g12a: fix gp0 and hifi ranges
    - [armhf] net: ftgmac100: add missing error return code in ftgmac100_probe()
    - [arm64,armhf] drm: rockchip: set alpha_en to 0 if it is not used
    - [arm64] drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on
      error in cdn_dp_grf_write()
    - [arm64,armhf] drm/rockchip: dsi: move all lane config except LCDC mux to
      bind()
    - [arm64] drm/rockchip: cdn-dp: fix sign extension on an int multiply for a
      u64 result
    - RDMA/srp: Fix a recently introduced memory leak
    - [powerpc*] ehea: fix error return code in ehea_restart_qps()
    - xfrm: remove the fragment check for ipv6 beet mode
    - net/sched: act_vlan: Fix modify to allow 0
    - RDMA/core: Sanitize WQ state received from the userspace
    - RDMA/rxe: Fix failure during driver load
    - [arm*] drm/vc4: hdmi: Fix error path of hpd-gpios
    - drm: qxl: ensure surf.data is ininitialized
    - tools/bpftool: Fix error return code in do_batch()
    - ath10k: go to path err_unsupported when chip id is not supported
    - ath10k: add missing error return code in ath10k_pci_probe()
    - wireless: carl9170: fix LEDS build errors & warnings
    - ieee802154: hwsim: Fix possible memory leak in hwsim_subscribe_all_others
    - [arm64] clk: imx8mq: remove SYS PLL 1/2 clock gates
    - [arm64] wcn36xx: Move hal_buf allocation to devm_kmalloc in probe
    - ssb: Fix error return code in ssb_bus_scan()
    - brcmfmac: fix setting of station info chains bitmask
    - brcmfmac: correctly report average RSSI in station info
    - brcmfmac: Fix a double-free in brcmf_sdio_bus_reset
    - brcmsmac: mac80211_if: Fix a resource leak in an error handling path
    - ath11k: Fix an error handling path in ath11k_core_fetch_board_data_api_n()
    - ath10k: Fix an error code in ath10k_add_interface()
    - ath11k: send beacon template after vdev_start/restart during csa
    - netlabel: Fix memory leak in netlbl_mgmt_add_common
    - RDMA/mlx5: Don't add slave port to unaffiliated list
    - netfilter: nft_exthdr: check for IPv6 packet before further processing
    - netfilter: nft_osf: check for TCP packet before further processing
    - netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols
    - RDMA/rxe: Fix qp reference counting for atomic ops
    - xsk: Fix missing validation for skb and unaligned mode
    - xsk: Fix broken Tx ring validation
    - bpf: Fix libelf endian handling in resolv_btfids
    - mt76: fix possible NULL pointer dereference in mt76_tx
    - vrf: do not push non-ND strict packets with a source LLA through packet
      taps again
    - net: sched: add barrier to ensure correct ordering for lockless qdisc
    - netfilter: nf_tables_offload: check FLOW_DISSECTOR_KEY_BASIC in VLAN
      transfer logic
    - pkt_sched: sch_qfq: fix qfq_change_class() error path
    - xfrm: Fix xfrm offload fallback fail case
    - iwlwifi: increase PNVM load timeout
    - rtw88: 8822c: fix lc calibration timing
    - vxlan: add missing rcu_read_lock() in neigh_reduce()
    - ip6_tunnel: fix GRE6 segmentation
    - net/ipv4: swap flow ports when validating source
    - ieee802154: hwsim: Fix memory leak in hwsim_add_one
    - ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl()
    - bpf: Fix null ptr deref with mixed tail calls and subprogs
    - [arm64] drm/msm: Fix error return code in msm_drm_init()
    - [arm64] drm/msm/dpu: Fix error return code in dpu_mdss_init()
    - mac80211: remove iwlwifi specific workaround NDPs of null_response
    - net: bcmgenet: Fix attaching to PYH failed on RPi 4B
    - ipv6: exthdrs: do not blindly use init_net
    - can: j1939: j1939_sk_setsockopt(): prevent allocation of j1939 filter for
      optlen == 0
    - bpf: Do not change gso_size during bpf_skb_change_proto()
    - i40e: Fix error handling in i40e_vsi_open
    - i40e: Fix autoneg disabling for non-10GBaseT links
    - i40e: Fix missing rtnl locking when setting up pf switch
    - RDMA/cma: Protect RMW with qp_mutex
    - net: macsec: fix the length used to copy the key for offloading
    - net: phy: mscc: fix macsec key length
    - ipv6: fix out-of-bound access in ip6_parse_tlv()
    - e1000e: Check the PCIm state
    - RDMA/cma: Fix incorrect Packet Lifetime calculation
    - [amd64] gve: Fix swapped vars when fetching max queues
    - Revert "be2net: disable bh with spin_lock in be_process_mcc"
    - Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid
    - Bluetooth: Fix not sending Set Extended Scan Response
    - Bluetooth: Fix Set Extended (Scan Response) Data
    - Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event
    - [arm64] clk: qcom: clk-alpha-pll: fix CAL_L write in
      alpha_pll_fabia_prepare
    - writeback: fix obtain a reference to a freeing memcg css
    - net: lwtunnel: handle MTU calculation in forwading
    - net: sched: fix warning in tcindex_alloc_perfect_hash
    - net: tipc: fix FB_MTU eat two pages
    - RDMA/mlx5: Don't access NULL-cleared mpi pointer
    - RDMA/core: Always release restrack object
    - [mips*] Fix PKMAP with 32-bit MIPS huge page support
    - [x86] ASoC: rt5682: Disable irq on shutdown
    - rcu: Invoke rcu_spawn_core_kthreads() from rcu_spawn_gp_kthread()
    - [arm64] serial: fsl_lpuart: don't modify arbitrary data on lpuart32
    - [arm64] serial: fsl_lpuart: remove RTSCTS handling from get_mctrl()
    - tty: nozomi: Fix a resource leak in an error handling function
    - mwifiex: re-fix for unaligned accesses
    - iio: adis_buffer: do not return ints in irq handlers
    - iio: adis16475: do not return ints in irq handlers
    - [arm64] ASoC: hisilicon: fix missing clk_disable_unprepare() on error in
      hi6210_i2s_startup()
    - mtd: partitions: redboot: seek fis-index-block in the right node
    - [arm*] staging: mmal-vchiq: Fix incorrect static vchiq_instance.
    - char: pcmcia: error out if 'num_bytes_read' is greater than 4 in
      set_protocol()
    - leds: class: The -ENOTSUPP should never be seen by user space
    - scsi: FlashPoint: Rename si_flags field
    - scsi: iscsi: Flush block work before unblock
    - [armhf] fsi: core: Fix return of error values on failures
    - [armhf] fsi: scom: Reset the FSI2PIB engine for any error
    - [armhf] fsi: occ: Don't accept response from un-initialized OCC
    - [armhf] fsi/sbefifo: Clean up correct FIFO when receiving reset request
      from SBE
    - [armhf] fsi/sbefifo: Fix reset timeout
    - [amd64] iommu/amd: Fix extended features logging
    - [s390x] irq: select HAVE_IRQ_EXIT_ON_IRQ_STACK
    - [s390x] enable HAVE_IOREMAP_PROT
    - [s390x] appldata depends on PROC_SYSCTL
    - [amd64,arm64] iommu/dma: Fix IOVA reserve dma ranges
    - ASoC: max98373-sdw: use first_hw_init flag on resume
    - ASoC: rt1308-sdw: use first_hw_init flag on resume
    - ASoC: rt5682-sdw: use first_hw_init flag on resume
    - ASoC: rt700-sdw: use first_hw_init flag on resume
    - ASoC: rt711-sdw: use first_hw_init flag on resume
    - ASoC: rt715-sdw: use first_hw_init flag on resume
    - ASoC: rt5682: fix getting the wrong device id when the suspend_stress_test
    - ASoC: rt5682-sdw: set regcache_cache_only false before reading
      RT5682_DEVICE_ID
    - usb: gadget: f_fs: Fix setting of device and driver data cross-references
    - [arm*] usb: dwc2: Don't reset the core after setting turnaround time
    - [armhf] ASoC: fsl_spdif: Fix error handler with pm_runtime_enable
    - staging: rtl8712: fix error handling in r871xu_drv_init
    - staging: rtl8712: fix memory leak in rtl871x_load_fw_cb
    - serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates
    - of: Fix truncation of memory sizes on 32-bit platforms
    - [armhf] mtd: rawnand: marvell: add missing clk_disable_unprepare() on
      error in marvell_nfc_resume()
    - scsi: mpt3sas: Fix error return value in _scsih_expander_add()
    - soundwire: stream: Fix test for DP prepare complete
    - [powerpc*] powernv: Fix machine check reporting of async store errors
    - configfs: fix memleak in configfs_release_bin_file
    - [x86] ASoC: Intel: sof_sdw: add SOF_RT715_DAI_ID_FIX for AlderLake
    - [armhf] ASoC: fsl_spdif: Fix unexpected interrupt after suspend
    - [powerpc*] Offline CPU in stop_this_cpu()
    - [powerpc*] papr_scm: Properly handle UUID types and API
    - [powerpc*] 64s: Fix copy-paste data exposure into newly created tasks
    - [powerpc*] papr_scm: Make 'perf_stats' invisible if perf-stats unavailable
    - ALSA: firewire-lib: Fix 'amdtp_domain_start()' when no AMDTP_OUT_STREAM
      stream is found
    - [arm64] serial: mvebu-uart: do not allow changing baudrate when uartclk is
      not available
    - [arm64] serial: mvebu-uart: correctly calculate minimal possible baudrate
    - vfio/pci: Handle concurrent vma faults
    - mm/pmem: avoid inserting hugepage PTE entry with fsdax if hugepage support
      is disabled
    - mm/huge_memory.c: remove dedicated macro HPAGE_CACHE_INDEX_MASK
    - mm/huge_memory.c: add missing read-only THP checking in
      transparent_hugepage_enabled()
    - mm/huge_memory.c: don't discard hugepage if other processes are mapping it
    - mm/hugetlb: use helper huge_page_order and pages_per_huge_page
    - mm/hugetlb: remove redundant check in preparing and destroying gigantic
      page
    - hugetlb: remove prep_compound_huge_page cleanup
    - include/linux/huge_mm.h: remove extern keyword
    - mm/z3fold: fix potential memory leak in z3fold_destroy_pool()
    - mm/z3fold: use release_z3fold_page_locked() to release locked z3fold page
    - lib/math/rational.c: fix divide by zero
    - exfat: handle wrong stream entry size in exfat_readdir()
    - scsi: fc: Correct RHBA attributes length
    - scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd()
    - fscrypt: don't ignore minor_hash when hash is 0
    - fscrypt: fix derivation of SipHash keys on big endian CPUs
    - tpm: Replace WARN_ONCE() with dev_err_once() in tpm_tis_status()
    - erofs: fix error return code in erofs_read_superblock()
    - io_uring: fix blocking inline submission
    - mmc: block: Disable CMDQ on the ioctl path
    - mmc: vub3000: fix control-request direction
    - scsi: core: Retry I/O for Notify (Enable Spinup) Required error
    - [arm64] crypto: qce - fix error return code in
      qce_skcipher_async_req_handle()
    - [s390x] preempt: Fix preempt_count initialization
    - cred: add missing return error code when set_cred_ucounts() failed
    - [amd64,arm64] iommu/dma: Fix compile warning in 32-bit builds
    - [powerpc*] preempt: Don't touch the idle task's preempt_count during
      hotplug
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.51
    - drm/ast: Fixed CVE for DP501
    - drm/amd/amdgpu/sriov disable all ip hw status by default
    - [arm*] drm/vc4: fix argument ordering in vc4_crtc_get_margins()
    - [i386] net: pch_gbe: Use proper accessors to BE data in pch_ptp_match()
    - hugetlb: clear huge pte during flush function on mips platform
    - atm: iphase: fix possible use-after-free in ia_module_exit()
    - mISDN: fix possible use-after-free in HFC_cleanup()
    - atm: nicstar: Fix possible use-after-free in nicstar_cleanup()
    - net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT
    - reiserfs: add check for invalid 1st journal block
    - drm/virtio: Fix double free on probe failure
    - net: mdio: provide shim implementation of devm_of_mdiobus_register
    - net/sched: cls_api: increase max_reclassify_loop
    - drm/scheduler: Fix hang when sched_entity released
    - drm/sched: Avoid data corruptions
    - udf: Fix NULL pointer dereference in udf_symlink function
    - [arm*] drm/vc4: Fix clock source for VEC PixelValve on BCM2711
    - [arm*] drm/vc4: hdmi: Fix PM reference leak in
      vc4_hdmi_encoder_pre_crtc_co()
    - e100: handle eeprom as little endian
    - igb: handle vlan types with checker enabled
    - igb: fix assignment on big endian machines
    - net/mlx5e: IPsec/rep_tc: Fix rep_tc_update_skb drops IPsec packet
    - net/mlx5: Fix lag port remapping logic
    - [arm64,armhf] drm: rockchip: add missing registers for RK3188
    - [arm64,armhf] drm: rockchip: add missing registers for RK3066
    - net: stmmac: the XPCS obscures a potential "PHY not found" error
    - [arm64,armhf] clk: tegra: Fix refcounting of gate clocks
    - [arm64,armhf] clk: tegra: Ensure that PLLU configuration is applied
      properly
    - virtio-net: Add validation for used length
    - ipv6: use prandom_u32() for ID generation
    - [mips*] cpu-probe: Fix FPU detection on Ingenic JZ4760(B)
    - drm/amdgpu: remove unsafe optimization to drop preamble ib
    - net: tcp better handling of reordering then loss cases
    - RDMA/cxgb4: Fix missing error code in create_qp()
    - dm space maps: don't reset space map allocation cursor when committing
    - dm writecache: don't split bios when overwriting contiguous cache content
    - dm: Fix dm_accept_partial_bio() relative to zone management commands
    - [armhf] pinctrl: mcp23s08: fix race condition in irq handler
    - ice: set the value of global config lock timeout longer
    - virtio_net: Remove BUG() to avoid machine dead
    - [arm64] net: bcmgenet: check return value after calling
      platform_get_resource()
    - [arm64,armhf] net: mvpp2: check return value after calling
      platform_get_resource()
    - net: phy: realtek: add delay to fix RXC generation issue
    - [amd64] drm/amdkfd: use allowed domain for vmbo validation
    - [amd64] fjes: check return value after calling platform_get_resource()
    - selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC
    - r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM
    - xfrm: Fix error reporting in xfrm_state_construct.
    - dm writecache: commit just one block, not a full page
    - [arm64,armhf] wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP
    - [arm64,armhf] wl1251: Fix possible buffer overflow in wl1251_cmd_scan
    - ice: fix incorrect payload indicator on PTYPE
    - ice: mark PTYPE 2 as reserved
    - mt76: mt7615: fix fixed-rate tx status reporting
    - net: fix mistake path for netdev_features_strings
    - net: sched: fix error return code in tcf_del_walker()
    - io_uring: fix false WARN_ONCE
    - drm/amdgpu: fix bad address translation for sienna_cichlid
    - rtl8xxxu: Fix device info for RTL8192EU devices
    - [mips*] add PMD table accounting into MIPS'pmd_alloc_one
    - [arm64,armhf] net: fec: add ndo_select_queue to fix TX bandwidth
      fluctuations
    - atm: nicstar: use 'dma_free_coherent' instead of 'kfree'
    - atm: nicstar: register the interrupt handler in the right place
    - vsock: notify server to shutdown when client has pending signal
    - RDMA/rxe: Don't overwrite errno from ib_umem_get()
    - iwlwifi: mvm: don't change band on bound PHY contexts
    - iwlwifi: mvm: fix error print when session protection ends
    - iwlwifi: pcie: free IML DMA memory allocation
    - iwlwifi: pcie: fix context info freeing
    - sfc: avoid double pci_remove of VFs
    - sfc: error code if SRIOV cannot be disabled
    - wireless: wext-spy: Fix out-of-bounds warning
    - cfg80211: fix default HE tx bitrate mask in 2G band
    - mac80211: consider per-CPU statistics if present
    - mac80211_hwsim: add concurrent channels scanning support over virtio
    - IB/isert: Align target max I/O size to initiator size
    - net: ip: avoid OOM kills with large UDP sends over loopback
    - RDMA/cma: Fix rdma_resolve_route() memory leak
    - Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip.
    - Bluetooth: Fix the HCI to MGMT status conversion table
    - Bluetooth: Fix alt settings for incoming SCO with transparent coding
      format
    - Bluetooth: Shutdown controller after workqueues are flushed or cancelled
    - Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500)
    - Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails
    - Bluetooth: L2CAP: Fix invalid access on ECRED Connection response
    - Bluetooth: btusb: Add support USB ALT 3 for WBS
    - Bluetooth: mgmt: Fix the command returns garbage parameter value
    - Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
    - sched/fair: Ensure _sum and _avg values stay consistent
    - bpf: Fix false positive kmemleak report in bpf_ringbuf_area_alloc()
    - flow_offload: action should not be NULL when it is referenced
    - [mips*] loongsoon64: Reserve memory below starting pfn to prevent Oops
    - [mips*] set mips32r5 for virt extensions
    - [mips*] MT extensions are not available on MIPS32r1
    - ath11k: unlock on error path in ath11k_mac_op_add_interface()
    - [arm64] dts: rockchip: Enable USB3 for rk3328 Rock64
    - loop: fix I/O error on fsync() in detached loop devices
    - mm,hwpoison: return -EBUSY when migration fails
    - io_uring: simplify io_remove_personalities()
    - io_uring: Convert personality_idr to XArray
    - io_uring: convert io_buffer_idr to XArray
    - scsi: iscsi: Fix race condition between login and sync thread
    - scsi: iscsi: Fix iSCSI cls conn state
    - [powerpc*] mm: Fix lockup on kernel exec fault
    - [powerpc*] barrier: Avoid collision with clang's __lwsync macro
    - [powerpc*] powernv/vas: Release reference to tgid during window close
    - drm/amdgpu: enable sdma0 tmz for Raven/Renoir(V2)
    - drm/radeon: Add the missed drm_gem_object_put() in
      radeon_user_framebuffer_create()
    - drm/radeon: Call radeon_suspend_kms() in radeon_pci_shutdown() for
      Loongson64
    - [arm*] drm/vc4: txp: Properly set the possible_crtcs mask
    - [arm*] drm/vc4: crtc: Skip the TXP
    - [arm*] drm/vc4: hdmi: Prevent clock unbalance
    - drm/dp: Handle zeroed port counts in drm_dp_read_downstream_info()
    - [arm64,armhf] drm/rockchip: dsi: remove extra component_del() call
    - pinctrl/amd: Add device HID for new AMD GPIO controller
    - drm/amd/display: Reject non-zero src_y and src_x for video planes
    - [arm64,armhf] drm/tegra: Don't set allow_fb_modifiers explicitly
    - [arm64] drm/msm/mdp4: Fix modifier support enabling
    - [arm64] drm/arm/malidp: Always list modifiers
    - drm/nouveau: Don't set allow_fb_modifiers explicitly
    - [x86] drm/i915/display: Do not zero past infoframes.vsc
    - mmc: sdhci-acpi: Disable write protect detection on Toshiba Encore 2 WT8-B
    - mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode
    - mmc: core: clear flags before allowing to retune
    - mmc: core: Allow UHS-I voltage switch for SDSC cards if supported
    - [armhf] ata: ahci_sunxi: Disable DIPM
    - [arm64] tlb: fix the TTL value of tlb_get_level
    - cpu/hotplug: Cure the cpusets trainwreck
    - [arm64,armhf] clocksource/arm_arch_timer: Improve Allwinner A64 timer
      workaround
    - [arm64,armhf] ASoC: tegra: Set driver_name=tegra for all machine drivers
    - i40e: fix PTP on 5Gb links
    - qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute
    - ipmi/watchdog: Stop watchdog timer when the current action is 'none'
    - [x86] thermal/drivers/int340x/processor_thermal: Fix tcc setting
    - ubifs: Fix races between xattr_{set|get} and listxattr operations
    - power: supply: ab8500: Fix an old bug
    - mfd: syscon: Free the allocated name field of struct regmap_config
    - nvmem: core: add a missing of_node_put
    - seq_buf: Fix overflow in seq_buf_putmem_hex()
    - rq-qos: fix missed wake-ups in rq_qos_throttle try two
    - tracing: Simplify & fix saved_tgids logic
    - tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT
    - dm zoned: check zone capacity
    - dm writecache: flush origin device when writing and cache is full
    - dm btree remove: assign new_root only when removal succeeds
    - PCI: Leave Apple Thunderbolt controllers on for s2idle or standby
    - [arm64] PCI: aardvark: Fix checking for PIO Non-posted Request
    - [arm64] PCI: aardvark: Implement workaround for the readback value of
      VEND_ID
    - media: subdev: disallow ioctl for saa6588/davinci
    - media: dtv5100: fix control-request directions
    - media: zr364xx: fix memory leak in zr364xx_start_readpipe
    - media: gspca/sq905: fix control-request direction
    - media: gspca/sunplus: fix zero-length control requests
    - media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K
    - io_uring: fix clear IORING_SETUP_R_DISABLED in wrong function
    - dm writecache: write at least 4k when committing
    - [armhf] pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq()
    - drm/ast: Remove reference to struct drm_device.pdev
    - jfs: fix GPF in diFree
    - ext4: fix memory leak in ext4_fill_super
    - f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem
      instances
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.52
    - cifs: handle reconnect of tcon when there is no cached dfs referral
    - KVM: mmio: Fix use-after-free Read in
      kvm_vm_ioctl_unregister_coalesced_mmio
    - [x86] KVM: x86: Use guest MAXPHYADDR from CPUID.0x8000_0008 iff TDP is
      enabled
    - [x86] KVM: x86/mmu: Do not apply HPA (memory encryption) mask to GPAs
    - [x86] KVM: nSVM: Check the value written to MSR_VM_HSAVE_PA
    - [x86] KVM: X86: Disable hardware breakpoints unconditionally before
      kvm_x86->run()
    - scsi: core: Fix bad pointer dereference when ehandler kthread is invalid
    - [s390x] scsi: zfcp: Report port fc_security as unknown early during remote
      cable pull
    - tracing: Do not reference char * as a string in histograms
    - [x86] drm/i915/gtt: drop the page table optimisation
    - [x86] drm/i915/gt: Fix -EDEADLK handling regression
    - cgroup: verify that source is a string
    - fbmem: Do not delete the mode that is still in use
    - drm/dp_mst: Do not set proposed vcpi directly
    - drm/dp_mst: Avoid to mess up payload table by ports in stale topology
    - drm/dp_mst: Add missing drm parameters to recently added call to
      drm_dbg_kms()
    - Revert "drm/ast: Remove reference to struct drm_device.pdev"
    - net: bridge: multicast: fix PIM hello router port marking race
    - net: bridge: multicast: fix MRD advertisement router port marking race
    - [x86] ASoC: Intel: sof_sdw: add mutual exclusion between PCH DMIC and
      RT715
    - [arm64] dmaengine: fsl-qdma: check dma_set_mask return value
    - scsi: arcmsr: Fix the wrong CDB payload report to IOP
    - srcu: Fix broken node geometry after early ssp init
    - rcu: Reject RCU_LOCKDEP_WARN() false positives
    - [arm64] tty: serial: fsl_lpuart: fix the potential risk of division or
      modulo by zero
    - [arm64] serial: fsl_lpuart: disable DMA for console and fix sysrq
    - [x86] misc/libmasm/module: Fix two use after free in ibmasm_init_one
    - [x86] ASoC: intel/boards: add missing MODULE_DEVICE_TABLE
    - partitions: msdos: fix one-byte get_unaligned()
    - iio: gyro: fxa21002c: Balance runtime pm + use
      pm_runtime_resume_and_get().
    - iio: magn: bmc150: Balance runtime pm + use pm_runtime_resume_and_get()
    - Revert "ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro"
    - [arm64,armhf] usb: common: usb-conn-gpio: fix NULL pointer dereference of
      charger
    - w1: ds2438: fixing bug that would always get page0
    - scsi: arcmsr: Fix doorbell status being updated late on ARC-1886
    - [arm64] scsi: hisi_sas: Propagate errors in interrupt_init_v1_hw()
    - scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology
    - scsi: lpfc: Fix crash when lpfc_sli4_hba_setup() fails to initialize the
      SGLs
    - scsi: core: Cap scsi_host cmd_per_lun at can_queue
    - tty: serial: 8250: serial_cs: Fix a memory leak in error handling path
    - scsi: mpt3sas: Fix deadlock while cancelling the running firmware event
    - scsi: core: Fixup calling convention for scsi_mode_sense()
    - scsi: scsi_dh_alua: Check for negative result value
    - fs/jfs: Fix missing error code in lmLogInit()
    - scsi: megaraid_sas: Fix resource leak in case of probe failure
    - scsi: megaraid_sas: Early detection of VD deletion through RaidMap update
    - scsi: megaraid_sas: Handle missing interrupts while re-enabling IRQs
    - scsi: iscsi: Add iscsi_cls_conn refcount helpers
    - scsi: iscsi: Fix conn use after free during resets
    - scsi: iscsi: Fix shost->max_id use
    - scsi: qedi: Fix null ref during abort handling
    - scsi: qedi: Fix race during abort timeouts
    - scsi: qedi: Fix TMF session block/unblock use
    - scsi: qedi: Fix cleanup session block/unblock use
    - [armhf] mfd: da9052/stmpe: Add and modify MODULE_DEVICE_TABLE
    - [armhf] fsi: Add missing MODULE_DEVICE_TABLE
    - [s390x] disable SSP when needed
    - [i386] ALSA: sb: Fix potential double-free of CSP mixer elements
    - [powerpc*] ps3: Add dma_mask to ps3_dma_region
    - [arm64,armhf] iommu/arm-smmu: Fix arm_smmu_device refcount leak when
      arm_smmu_rpm_get fails
    - [arm64,armhf] iommu/arm-smmu: Fix arm_smmu_device refcount leak in address
      translation
    - ASoC: soc-pcm: fix the return value in dpcm_apply_symmetry()
    - [arm64] gpio: zynq: Check return value of pm_runtime_get_sync
    - [arm64] gpio: zynq: Check return value of irq_get_irq_data
    - [x86] scsi: storvsc: Correctly handle multiple flags in srb_status
    - [powerpc*] ALSA: ppc: fix error return code in snd_pmac_probe()
    - [arm64,armhf] gpio: pca953x: Add support for the On Semi pca9655
    - [powerpc*] mm/book3s64: Fix possible build error
    - ASoC: soc-core: Fix the error return code in
      snd_soc_of_parse_audio_routing()
    - [s390x] processor: always inline stap() and __load_psw_mask()
    - [s390x] ipl_parm: fix program check new psw handling
    - [s390x] mem_detect: fix diag260() program check new psw handling
    - [s390x] mem_detect: fix tprot() program check new psw handling
    - ALSA: bebob: add support for ToneWeal FW66
    - ALSA: usb-audio: scarlett2: Fix 18i8 Gen 2 PCM Input count
    - ALSA: usb-audio: scarlett2: Fix data_mutex lock
    - ALSA: usb-audio: scarlett2: Fix scarlett2_*_ctl_put() return values
    - usb: gadget: f_hid: fix endianness issue with descriptors
    - [powerpc*] boot: Fixup device-tree on little endian
    - [x86] ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20
      characters
    - [arm64,armhf] ALSA: hda: Add IRQ check for platform_get_irq()
    - ALSA: usb-audio: scarlett2: Fix 6i6 Gen 2 line out descriptions
    - ALSA: firewire-motu: fix detection for S/PDIF source on optical interface
      in v2 protocol
    - staging: rtl8723bs: fix macro value for 2.4Ghz only device
    - [x86] intel_th: Wait until port is in reset before programming it
    - i2c: core: Disable client irq on reboot/shutdown
    - lib/decompress_unlz4.c: correctly handle zero-padding around initrds.
    - kcov: add __no_sanitize_coverage to fix noinstr for all architectures
    - [amd64] PCI: hv: Fix a race condition when removing the device
    - [x86] power: supply: max17042: Do not enforce (incorrect) interrupt
      trigger type
    - power: reset: gpio-poweroff: add missing MODULE_DEVICE_TABLE
    - PCI/P2PDMA: Avoid pci_get_slot(), which may sleep
    - NFSv4: Fix delegation return in cases where we have to retry
    - PCI: pciehp: Ignore Link Down/Up caused by DPC
    - [x86] watchdog: Fix possible use-after-free in wdt_startup()
    - [x86] watchdog: Fix possible use-after-free by calling del_timer_sync()
    - watchdog: iTCO_wdt: Account for rebooting on second timeout
    - [x86] fpu: Return proper error codes from user access functions
    - [armhf] remoteproc: core: Fix cdev remove and rproc del
    - [arm64,armhf] PCI: tegra: Add missing MODULE_DEVICE_TABLE
    - orangefs: fix orangefs df output.
    - ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty
    - [x86] drm/gma500: Add the missed drm_gem_object_put() in
      psb_user_framebuffer_create()
    - NFS: nfs_find_open_context() may only select open files
    - [arm64,armhf] pwm: tegra: Don't modify HW state in .remove callback
    - [arm64] ACPI: AMBA: Fix resource name in /proc/iomem
    - [x86] ACPI: video: Add quirk for the Dell Vostro 3350
    - [arm64] PCI: rockchip: Register IRQ handlers after device and data are
      ready
    - virtio-blk: Fix memory leak among suspend/resume procedure
    - virtio_net: Fix error handling in virtnet_restore()
    - f2fs: atgc: fix to set default age threshold
    - NFSD: Fix TP_printk() format specifier in nfsd_clid_class
    - [x86] signal: Detect and prevent an alternate signal stack overflow
    - f2fs: add MODULE_SOFTDEP to ensure crc32 is included in the initramfs
    - f2fs: compress: fix to disallow temp extension
    - PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun
    - NFSv4: Fix an Oops in pnfs_mark_request_commit() when doing O_DIRECT
    - ubifs: Fix off-by-one error
    - ubifs: journal: Fix error return code in ubifs_jnl_write_inode()
    - [armhf] watchdog: aspeed: fix hardware timeout calculation
    - SUNRPC: prevent port reuse on transports which don't request it.
    - nfs: fix acl memory leak of posix_acl_create()
    - ubifs: Set/Clear I_LINKABLE under i_lock for whiteout inode
    - f2fs: fix to avoid adding tab before doc section
    - [x86] fpu: Fix copy_xstate_to_kernel() gap handling
    - [x86] fpu: Limit xstate copy size in xstateregs_set()
    - virtio_net: move tx vq operation under tx queue lock
    - nvme-tcp: can't set sk_user_data without write_lock
    - nfsd: Reduce contention for the nfsd_file nf_rwsem
    - [i386] ALSA: isa: Fix error return code in snd_cmi8330_probe()
    - vdpa/mlx5: Clear vq ready indication upon device reset
    - NFSv4/pnfs: Fix the layout barrier update
    - NFSv4/pnfs: Fix layoutget behaviour after invalidation
    - NFSv4/pNFS: Don't call _nfs4_pnfs_v3_ds_connect multiple times
    - [armhf] exynos: add missing of_node_put for loop iteration
    - [armhf] dts: exynos: fix PWM LED max brightness on Odroid HC1
    - [armhf] dts: exynos: fix PWM LED max brightness on Odroid XU4
    - [armel,armhf] memory: pl353: Fix error return code in pl353_smc_probe()
    - rtc: fix snprintf() checking in is_rtc_hctosys()
    - dt-bindings: i2c: at91: fix example for scl-gpios
    - [arm64] dts: allwinner: a64-sopine-baseboard: change RGMII mode to TXID
    - [armhf] dts: am335x: align ti,pindir-d0-out-d1-in property with dt-shema
    - [arm64] firmware: turris-mox-rwtm: fix reply status decoding function
    - [arm64] firmware: turris-mox-rwtm: report failures better
    - [arm64] firmware: turris-mox-rwtm: fail probing when firmware does not
      support hwrng
    - [arm64] firmware: turris-mox-rwtm: show message about HWRNG registration
    - scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe()
    - jump_label: Fix jump_label_text_reserved() vs __init
    - static_call: Fix static_call_text_reserved() vs __init
    - [mips*] always link byteswap helpers into decompressor
    - [mips*] disable branch profiling in boot/decompress.o
    - [mips*] vdso: Invalid GIC access through VDSO
    - scsi: scsi_dh_alua: Fix signedness bug in alua_rtpg()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.53
    - [armhf] dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and
      rk3288
    - [armhf] imx: pm-imx5: Fix references to imx5_cpu_suspend_info
    - [arm64] dts: rockchip: fix regulator-gpio states array
    - [armhf] dts: imx6dl-riotboard: configure PHY clock and set proper EEE
      value
    - [armhf] dts: am57xx-cl-som-am57x: fix ti,no-reset-on-init flag for gpios
    - [armhf] dts: am335x: fix ti,no-reset-on-init flag for gpios
    - [armhf] dts: OMAP2+: Replace underscores in sub-mailbox node names
    - [arm64] dts: qcom: sc7180: Move rmtfs memory region
    - [armhf] memory: tegra: Fix compilation warnings on 64bit platforms
    - [armel,armhf] dts: bcm283x: Fix up GPIO LED node names
    - [armhf] dts: rockchip: fix supply properties in io-domains nodes
    - [armhf] OMAP2+: Block suspend for am3 and am4 if PM is not configured
    - [arm64,armhf] soc/tegra: fuse: Fix Tegra234-only builds
    - thermal/core: Correct function name thermal_zone_device_unregister()
    - [arm64] arch/arm64/boot/dts/marvell: fix NAND partitioning scheme
    - [arm64,armhf] rtc: max77686: Do not enforce (incorrect) interrupt trigger
      type
    - scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
    - scsi: libsas: Add LUN number check in .slave_alloc callback
    - scsi: libfc: Fix array index out of bound exception
    - scsi: qedf: Add check to synchronize abort and flush
    - sched/fair: Fix CFS bandwidth hrtimer expiry type
    - [x86] perf/x86/intel/uncore: Clean up error handling path of iio mapping
    - thermal/core/thermal_of: Stop zone device before unregistering it
    - [s390x] traps: do not test MONITOR CALL without CONFIG_BUG
    - [s390x] introduce proper type handling call_on_stack() macro
    - cifs: prevent NULL deref in cifs_compose_mount_options()
    - [arm64] firmware: turris-mox-rwtm: add marvell,armada-3700-rwtm-firmware
      compatible string
    - [arm64] dts: marvell: armada-37xx: move firmware node to generic dtsi file
    - Revert "swap: fix do_swap_page() race with swapoff"
    - f2fs: Show casefolding support only when supported
    - mm/thp: simplify copying of huge zero page pmd when fork
    - mm/userfaultfd: fix uffd-wp special cases for fork()
    - mm/page_alloc: fix memory map initialization for descending nodes
    - [arm64] net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear
    - [arm64,armhf] net: dsa: mv88e6xxx: enable .port_set_policy() on Topaz
    - [arm64,armhf] net: dsa: mv88e6xxx: use correct .stats_set_histogram() on
      Topaz
    - [arm64,armhf] net: dsa: mv88e6xxx: enable .rmu_disable() on Topaz
    - [arm64,armhf] net: dsa: mv88e6xxx: enable devlink ATU hash param for Topaz
    - net: ipv6: fix return value of ip6_skb_dst_mtu
    - netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo
    - net/sched: act_ct: fix err check for nf_conntrack_confirm
    - [x86] vmxnet3: fix cksum offload issues for tunnels with non-default udp
      ports
    - net/sched: act_ct: remove and free nf_table callbacks
    - net: bridge: sync fdb to new unicast-filtering ports
    - [arm64] net: bcmgenet: Ensure all TX/RX queues DMAs are disabled
    - net: ip_tunnel: fix mtu calculation for ETHER tunnel devices
    - [arm64] net: qcom/emac: fix UAF in emac_remove
    - net: ti: fix UAF in tlan_remove_one
    - net: send SYNACK packet with accepted fwmark
    - net: validate lwtstate->data before returning from skb_tunnel_info()
    - Revert "mm/shmem: fix shmem_swapin() race with swapoff"
    - [arm64,armhf] net: dsa: properly check for the bridge_leave methods in
      dsa_switch_bridge_leave()
    - dma-buf/sync_file: Don't leak fences on merge failure
    - [armhf] dts: aspeed: Fix AST2600 machines line names
    - [armhf] dts: tacoma: Add phase corrections for eMMC
    - tcp: annotate data races around tp->mtu_info
    - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized
    - ipv6: tcp: drop silly ICMPv6 packet too big messages
    - tcp: call sk_wmem_schedule before sk_mem_charge in zerocopy path
    - bpf: Track subprog poke descriptors correctly and fix use-after-free
    - udp: annotate data races around unix_sk(sk)->gso_size
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.54
    - igc: Fix use-after-free error during reset
    - igb: Fix use-after-free error during reset
    - igc: change default return of igc_read_phy_reg()
    - ixgbe: Fix an error handling path in 'ixgbe_probe()'
    - igc: Fix an error handling path in 'igc_probe()'
    - igb: Fix an error handling path in 'igb_probe()'
    - e1000e: Fix an error handling path in 'e1000_probe()'
    - iavf: Fix an error handling path in 'iavf_probe()'
    - igb: Check if num of q_vectors is smaller than max before array access
    - igb: Fix position of assignment to *ring
    - [amd64] gve: Fix an error handling path in 'gve_probe()'
    - bonding: fix suspicious RCU usage in bond_ipsec_add_sa()
    - bonding: fix null dereference in bond_ipsec_add_sa()
    - ixgbevf: use xso.real_dev instead of xso.dev in callback functions of
      struct xfrmdev_ops
    - bonding: fix suspicious RCU usage in bond_ipsec_del_sa()
    - bonding: disallow setting nested bonding + ipsec offload
    - bonding: Add struct bond_ipesc to manage SA
    - bonding: fix suspicious RCU usage in bond_ipsec_offload_ok()
    - bonding: fix incorrect return value of bond_ipsec_offload_ok()
    - ipv6: fix 'disable_policy' for fwd packets
    - stmmac: platform: Fix signedness bug in stmmac_probe_config_dt()
    - cxgb4: fix IRQ free race during driver unload
    - nvme-pci: do not call nvme_dev_remove_admin from nvme_remove
    - [x86] KVM: x86/pmu: Clear anythread deprecated bit when 0xa leaf is
      unsupported on the SVM
    - [armhf] spi: imx: add a check for speed_hz before calculating the clock
    - [armhf] spi: stm32: fixes pm_runtime calls in probe/remove
    - bpf, test: fix NULL pointer dereference on invalid expected_attach_type
    - bpf: Fix tail_call_reachable rejection for interpreter when jit failed
    - xdp, net: Fix use-after-free in bpf_xdp_link_release
    - timers: Fix get_next_timer_interrupt() with no timers pending
    - liquidio: Fix unintentional sign extension issue on left shift of u16
    - [s390x] bpf: Perform r1 range checking before accessing jit->seen_reg[r1]
    - bpf, sockmap: Fix potential memory leak on unlikely error case
    - bpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats
    - bpf, sockmap, udp: sk_prot needs inuse_idx set for proc stats
    - bpftool: Check malloc return value in mount_bpffs_for_pin
    - net: fix uninit-value in caif_seqpkt_sendmsg
    - usb: hso: fix error handling code of hso_create_net_device
      (CVE-2021-37159)
    - dma-mapping: handle vmalloc addresses in dma_common_{mmap,get_sgtable}
    - efi/tpm: Differentiate missing and invalid final event log table.
    - net: decnet: Fix sleeping inside in af_decnet
    - [powerpc*] KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
    - net: sched: fix memory leak in tcindex_partial_destroy_work
    - sctp: trim optlen when it's a huge value in sctp_setsockopt
    - netrom: Decrease sock refcount when sock timers expire
    - scsi: iscsi: Fix iface sysfs attr detection
    - scsi: target: Fix protect handling in WRITE SAME(32)
    - bnxt_en: don't disable an already disabled PCI device
    - bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
    - bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task()
    - bnxt_en: Validate vlan protocol ID on RX packets
    - bnxt_en: Check abort error state in bnxt_half_open_nic()
    - net/tcp_fastopen: fix data races around tfo_active_disable_stamp
    - ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID
    - [arm64] net: hns3: fix possible mismatches resp of mailbox
    - [arm64] net: hns3: fix rx VLAN offload state inconsistent issue
    - [arm*] spi: spi-bcm2835: Fix deadlock
    - net/sched: act_skbmod: Skip non-Ethernet packets
    - ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions
    - ceph: don't WARN if we're still opening a session to an MDS
    - nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
    - Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem"
    - afs: Fix tracepoint string placement with built-in AFS
    - r8169: Avoid duplicate sysfs entry creation error
    - nvme: set the PRACT bit when using Write Zeroes with T10 PI
    - sctp: update active_key for asoc when old key is being replaced
    - tcp: disable TFO blackhole logic by default
    - net: sched: cls_api: Fix the the wrong parameter
    - [arm64,armhf] drm/panel: raspberrypi-touchscreen: Prevent double-free
    - cifs: only write 64kb at a time when fallocating a small region of a file
    - cifs: fix fallocate when trying to allocate a hole.
    - proc: Avoid mixing integer types in mem_rw()
    - mmc: core: Don't allocate IDA for OF aliases
    - [s390x] ftrace: fix ftrace_update_ftrace_func implementation
    - [s390x] boot: fix use of expolines in the DMA code
    - ALSA: usb-audio: Add missing proc text entry for BESPOKEN type
    - ALSA: usb-audio: Add registration quirk for JBL Quantum headsets
    - [i386] ALSA: sb: Fix potential ABBA deadlock in CSP driver
    - ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine
    - ALSA: hdmi: Expose all pins on MSI MS-7C94 board
    - ALSA: pcm: Call substream ack() method upon compat mmap commit
    - ALSA: pcm: Fix mmap capability check
    - xhci: Fix lost USB 2 remote wake
    - [powerpc*] KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state
    - usb: hub: Disable USB 3 device initiated lpm if exit latency is too high
    - usb: hub: Fix link power management max exit latency (MEL) calculations
    - USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS
    - USB: serial: option: add support for u-blox LARA-R6 family
    - USB: serial: cp210x: fix comments for GE CS1000
    - USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
    - [arm*] usb: dwc2: gadget: Fix GOUTNAK flow for Slave mode.
    - [arm*] usb: dwc2: gadget: Fix sending zero length packet in DDMA mode.
    - firmware/efi: Tell memblock about EFI iomem reservations
    - tracepoints: Update static_call before tp_funcs when adding a tracepoint
    - tracing/histogram: Rename "cpu" to "common_cpu"
    - tracing: Synthetic event field_pos is an index not a boolean
    - btrfs: check for missing device in btrfs_trim_fs
    - media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
    - ixgbe: Fix packet corruption due to missing DMA sync
    - bus: mhi: core: Validate channel ID when processing command completions
    - posix-cpu-timers: Fix rearm racing against process tick
    - io_uring: explicitly count entries for poll reqs
    - io_uring: remove double poll entry on arm failure
    - userfaultfd: do not untag user pointers
    - memblock: make for_each_mem_range() traverse MEMBLOCK_HOTPLUG regions
    - hugetlbfs: fix mount mode command line processing
    - rbd: don't hold lock_rwsem while running_list is being drained
    - rbd: always kick acquire on "acquired" and "released" notifications
    - misc: eeprom: at24: Always append device id even if label property is set.
    - driver core: Prevent warning when removing a device link from unregistered
      consumer
    - drm: Return -ENOTTY for non-drm ioctls
    - drm/amdgpu: update golden setting for sienna_cichlid
    - [arm64,armhf] net: dsa: mv88e6xxx: enable SerDes RX stats for Topaz
    - [arm64,armhf] net: dsa: mv88e6xxx: enable SerDes PCS register dump via
      ethtool -d on Topaz
    - PCI: Mark AMD Navi14 GPU ATS as broken
    - skbuff: Release nfct refcount on napi stolen or re-used skbs
    - Documentation: Fix intiramfs script name
    - usb: ehci: Prevent missed ehci interrupts with edge-triggered MSI
    - [amd64] drm/i915/gvt: Clear d3_entered on elsp cmd submission.
    - sfc: ensure correct number of XDP queues
    - xhci: add xhci_get_virt_ep() helper
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.55
    - io_uring: fix link timeout refs
    - [x86] KVM: determine if an exception has an error code only when injecting
      it.
    - af_unix: fix garbage collect vs MSG_PEEK
    - workqueue: fix UAF in pwq_unbound_release_workfn()
    - cgroup1: fix leaked context root causing sporadic NULL deref in LTP
    - net/802/mrp: fix memleak in mrp_request_join()
    - net/802/garp: fix memleak in garp_request_join()
    - net: annotate data race around sk_ll_usec
    - sctp: move 198 addresses from unusable to private scope
    - rcu-tasks: Don't delete holdouts within trc_inspect_reader()
    - rcu-tasks: Don't delete holdouts within trc_wait_for_one_reader()
    - ipv6: allocate enough headroom in ip6_finish_output2()
    - drm/ttm: add a check against null pointer dereference
    - hfs: add missing clean-up in hfs_fill_super
    - hfs: fix high memory mapping in hfs_bnode_read
    - hfs: add lock nesting notation to hfs_find_init
    - cifs: fix the out of range assignment to bit fields in
      parse_server_interfaces
    - iomap: remove the length variable in iomap_seek_data
    - iomap: remove the length variable in iomap_seek_hole
    - ipv6: ip6_finish_output2: set sk into newly allocated nskb
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.56
    - io_uring: fix null-ptr-deref in io_sq_offload_start()
    - [x86] asm: Ensure asm/proto.h can be included stand-alone
    - pipe: make pipe writes always wake up readers
    - btrfs: fix rw device counting in __btrfs_free_extra_devids
    - btrfs: mark compressed range uptodate only if all bio succeed
    - Revert "ACPI: resources: Add checks for ACPI IRQ override"
    - [x86] kvm: fix vcpu-id indexed array sizes
    - KVM: add missing compat KVM_CLEAR_DIRTY_LOG
    - ocfs2: fix zero out valid data
    - ocfs2: issue zeroout to EOF blocks
    - can: j1939: j1939_xtp_rx_dat_one(): fix rxtimer value between consecutive
      TP.DT to 750ms
    - can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
    - can: peak_usb: pcan_usb_handle_bus_evt(): fix reading rxerr/txerr values
    - can: mcba_usb_start(): add missing urb->transfer_dma initialization
      (Closes: #990850)
    - can: usb_8dev: fix memory leak
    - can: ems_usb: fix memory leak
    - can: esd_usb2: fix memory leak
    - HID: wacom: Re-enable touch by default for Cintiq 24HDT / 27QHDT
    - NIU: fix incorrect error return, missed in previous revert
    - drm/amdgpu: Avoid printing of stack contents on firmware load error
    - drm/amdgpu: Fix resource leak on probe error path
    - blk-iocost: fix operation ordering in iocg_wake_fn()
    - nfc: nfcsim: fix use after free during module unload
    - cfg80211: Fix possible memory leak in function cfg80211_bss_update
    - bpf: Fix OOB read when printing XDP link fdinfo
    - mac80211: fix enabling 4-address mode on a sta vif after assoc
    - netfilter: conntrack: adjust stop timestamp to real expiry value
    - netfilter: nft_nat: allow to specify layer 4 protocol NAT only
    - i40e: Fix logic of disabling queues
    - i40e: Fix firmware LLDP agent related warning
    - i40e: Fix queue-to-TC mapping on Tx
    - i40e: Fix log TC creation failure when max num of queues is exceeded
    - tipc: fix implicit-connect for SYN+
    - tipc: fix sleeping in tipc accept routine
    - net: Set true network header for ECN decapsulation
    - net: qrtr: fix memory leaks
    - tipc: do not write skb_shinfo frags when doing decrytion
    - mlx4: Fix missing error code in mlx4_load_one()
    - [x86] KVM: x86: Check the right feature bit for MSR_KVM_ASYNC_PF_ACK
      access
    - net: llc: fix skb_over_panic
    - [arm64] drm/msm/dpu: Fix sm8250_mdp register length
    - [arm64] drm/msm/dp: Initialize the INTF_CONFIG register
    - skmsg: Make sk_psock_destroy() static
    - net/mlx5: Fix flow table chaining
    - net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev()
    - tulip: windbond-840: Fix missing pci_disable_device() in probe and remove
    - sis900: Fix missing pci_disable_device() in probe and remove
    - SMB3: fix readpage for large swap cache
    - [powerpc*] pseries: Fix regression while building external modules
    - Revert "perf map: Fix dso->nsinfo refcounting"
    - i40e: Add additional info to PHY type error
    - can: j1939: j1939_session_deactivate(): clarify lifetime of session object
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.57
    - [x86] drm/i915: Revert "drm/i915/gem: Asynchronous cmdparser"
    - [x86] Revert "drm/i915: Propagate errors on awaiting already signaled
      fences"
    - btrfs: fix race causing unnecessary inode logging during link and rename
    - btrfs: fix lost inode on log replay after mix of fsync, rename and inode
      eviction
    - [armhf] spi: stm32h7: fix full duplex irq handler handling
    - r8152: Fix potential PM refcount imbalance
    - qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union()
    - ASoC: rt5682: Fix the issue of garbled recording after powerd_dbus_suspend
    - net: Fix zero-copy head len calculation.
    - efi/mokvar: Reserve the table only if it is in boot services data
    - nvme: fix nvme_setup_command metadata trace event
    - ACPI: fix NULL pointer dereference
    - Revert "Bluetooth: Shutdown controller after workqueues are flushed or
      cancelled"
    - Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.58
    - Revert "ACPICA: Fix memory leak caused by _CID repair function"
    - ALSA: seq: Fix racy deletion of subscriber
    - [armhf] bus: ti-sysc: Fix gpt12 system timer issue with reserved status
    - net: xfrm: fix memory leak in xfrm_user_rcv_msg
    - [armhf] imx: add missing iounmap()
    - [armhf] imx: add missing clk_disable_unprepare()
    - [arm64] dts: ls1028: sl28: fix networking for variant 2
    - [armhf] imx: fix missing 3rd argument in macro imx_mmdc_perf_init
    - [armhf] dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out
      pins
    - [arm64] dts: armada-3720-turris-mox: fixed indices for the SDHC
      controllers
    - [arm64] dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode
    - ALSA: usb-audio: fix incorrect clock source setting
    - [arm64,armhf] clk: tegra: Implement disable_unused() of
      tegra_clk_sdmmc_mux_ops
    - [armhf] dmaengine: stm32-dma: Fix PM usage counter imbalance in stm32 dma
      ops
    - [armhf] dmaengine: stm32-dmamux: Fix PM usage counter unbalance in stm32
      dmamux ops
    - [armhf] spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay
    - [armhf] spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation
    - scsi: sr: Return correct event when media event code is 3
    - media: videobuf2-core: dequeue if start_streaming fails
    - [armhf] dmaengine: imx-dma: configure the generic DMA type to make it work
    - net, gro: Set inner transport header offset in tcp/udp GRO hook
    - net: phy: micrel: Fix detection of ksz87xx switch
    - net: natsemi: Fix missing pci_disable_device() in probe and remove
    - RDMA/mlx5: Delay emptying a cache entry when a new MR is added to it
      recently
    - sctp: move the active_key update after sh_keys is added
    - nfp: update ethtool reporting of pauseframe control
    - net: ipv6: fix returned variable type in ip6_skb_dst_mtu
    - net: sched: fix lockdep_set_class() typo error for sch->seqlock
    - [mips*] check return value of pgtable_pmd_page_ctor
    - bnx2x: fix an error code in bnx2x_nic_load()
    - net: pegasus: fix uninit-value in get_interrupt_interval
    - [arm64,armhf] net: fec: fix use-after-free in fec_drv_remove
    - net: vxge: fix use-after-free in vxge_device_unregister
    - Bluetooth: defer cleanup of resources in hci_unregister_dev()
    - USB: usbtmc: Fix RCU stall warning
    - USB: serial: option: add Telit FD980 composition 0x1056
    - USB: serial: ch341: fix character loss at high transfer rates
    - USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2
    - [x86] firmware_loader: use -ETIMEDOUT instead of -EAGAIN in
      fw_load_sysfs_fallback
    - [x86] firmware_loader: fix use-after-free in firmware_fallback_sysfs
    - ALSA: pcm - fix mmap capability check for the snd-dummy driver
    - ALSA: hda/realtek: add mic quirk for Acer SF314-42
    - ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256)
    - ALSA: usb-audio: Fix superfluous autosuspend recovery
    - ALSA: usb-audio: Add registration quirk for JBL Quantum 600
    - [arm64,armhf] usb: dwc3: gadget: Avoid runtime resume if disabling pullup
    - usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers
    - usb: gadget: f_hid: fixed NULL pointer dereference
    - usb: gadget: f_hid: idle uses the highest byte for duration
    - usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus
      events
    - clk: fix leak on devm_clk_bulk_get_all() unwind
    - tracing: Fix NULL pointer dereference in start_creating
    - tracepoint: static call: Compare data on transition from 2->1 callees
    - tracepoint: Fix static call function vs data state mismatch
    - [arm64] stacktrace: avoid tracing arch_stack_walk()
    - [arm64] optee: Clear stale cache entries during initialization
    - [arm64] tee: add tee_shm_alloc_kernel_buf()
    - [arm64] optee: Fix memory leak when failing to register shm pages
    - [arm64] optee: Refuse to load the driver under the kdump kernel
    - [arm64] optee: fix tee out of memory failure seen during kexec reboot
    - staging: rtl8723bs: Fix a resource leak in sd_int_dpc
    - staging: rtl8712: get rid of flush_scheduled_work
    - staging: rtl8712: error handling refactoring
    - drivers core: Fix oops when driver probe fails
    - media: rtl28xxu: fix zero-length control request
    - pipe: increase minimum default pipe size to 2 pages
    - ext4: fix potential htree corruption when growing large_dir directories
    - [arm64,armhf] serial: tegra: Only print FIFO error message when an error
      occurs
    - serial: 8250: Mask out floating 16/32-bit bus bits
    - [mips*] Malta: Do not byte-swap accesses to the CBUS UART
    - serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver
    - serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts.
    - timers: Move clearing of base::timer_running under base:: Lock
    - xfrm: Fix RCU vs hash_resize_mutex lock inversion
    - pcmcia: i82092: fix a null pointer dereference bug
    - selinux: correct the return value when loads initial sids
    - [armhf] bus: ti-sysc: AM3: RNG is GP only
    - [arm64] Revert "gpio: mpc8xxx: change the gpio interrupt flags."
    - [armhf] omap2+: hwmod: fix potential NULL pointer access
    - md/raid10: properly indicate failure when ending a failed write request
    - [x86] KVM: accept userspace interrupt only if no event is injected
    - KVM: Do not leak memory for duplicate debugfs directories
    - [x86] KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds
    - [arm64] vdso: Avoid ISB after reading from cntvct_el0
    - [arm64,armhf] spi: meson-spicc: fix memory leak in meson_spicc_remove
    - [x86] drm/i915: Correct SFC_DONE register offset
    - sched/rt: Fix double enqueue caused by rt_effective_prio
    - [x86] drm/i915: avoid uninitialised var in eb_parse()
    - libata: fix ata_pio_sector for CONFIG_HIGHMEM
    - reiserfs: add check for root_inode in reiserfs_fill_super
    - reiserfs: check directory items on read from disk
    - net: qede: Fix end of loop tests for list_for_each_entry
    - net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and
      ql_adapter_reset
    - smb3: rc uninitialized in one fallocate path
    - drm/amdgpu/display: only enable aux backlight control for OLED panels
    - [arm64] fix compat syscall return truncation
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.59
    - [x86] KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB
    - [arm64] tee: Correct inappropriate usage of TEE_SHM_DMA_BUF flag
    - bpf: Add lockdown check for probe_write_user helper
    - mm: make zone_to_nid() and zone_set_nid() available for DISCONTIGMEM
    - [x86] vboxsf: Honor excl flag to the dir-inode create op
    - [x86] vboxsf: Make vboxsf_dir_create() return the handle for the created
      file
    - USB:ehci:fix Kunpeng920 ehci hardware problem
    - ALSA: pcm: Fix mmap breakage without explicit buffer setup
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 650 G8 Notebook PC
    - ALSA: hda: Add quirk for ASUS Flow x13
    - ppp: Fix generating ppp unit id when ifname is not specified
    - net: xilinx_emaclite: Do not print real IOMEM pointer (CVE-2021-38205)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.60
    - iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels
    - iio: adis: set GPIO reset pin direction
    - [x86] ASoC: amd: Fix reference to PCM buffer address
    - [x86] ASoC: intel: atom: Fix reference to PCM buffer address
    - i2c: dev: zero out array used for i2c reads from userspace
    - cifs: create sd context must be a multiple of 8
    - scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash
    - seccomp: Fix setting loaded filter count during TSYNC
    - [armhf] net: ethernet: ti: cpsw: fix min eth packet size for non-switch
      use-cases
    - ceph: reduce contention in ceph_check_delayed_caps()
    - [amd64,arm64] ACPI: NFIT: Fix support for virtual SPA ranges
    - libnvdimm/region: Fix label activation vs errors
    - drm/amd/display: use GFP_ATOMIC in amdgpu_dm_irq_schedule_work
    - drm/amdgpu: don't enable baco on boco platforms in runpm
    - ieee802154: hwsim: fix GPF in hwsim_set_edge_lqi
    - ieee802154: hwsim: fix GPF in hwsim_new_edge_nl
    - [x86] ASoC: SOF: Intel: hda-ipc: fix reply size checking
    - netfilter: nf_conntrack_bridge: Fix memory leak when error
    - [x86] pinctrl: tigerlake: Fix GPIO mapping for newer version of software
    - [x86] platform/x86: pcengines-apuv2: Add missing terminating entries to
      gpio-lookup tables
    - net: phy: micrel: Fix link detection on ksz87xx switch"
    - ppp: Fix generating ifname when empty IFLA_IFNAME is specified
    - net/smc: fix wait on already cleared link
    - net: sched: act_mirred: Reset ct info when mirror/redirect skb
    - ice: Prevent probing virtual functions
    - ice: don't remove netdev->dev_addr from uc sync list
    - iavf: Set RSS LUT and key in reset handle path
    - net/mlx5: Synchronize correct IRQ when destroying CQ
    - net/mlx5: Fix return value from tracer initialization
    - [arm64] drm/meson: fix colour distortion from HDR set during vendor u-boot
    - net: Fix memory leak in ieee802154_raw_deliver
    - net: igmp: fix data-race in igmp_ifc_timer_expire()
    - net: bridge: validate the NUD_PERMANENT bit when adding an extern_learn
      FDB entry
    - net: bridge: fix flags interpretation for extern learn fdb entries
    - net: bridge: fix memleak in br_add_if()
    - net: linkwatch: fix failure to restore device state across suspend/resume
    - tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B
      packets
    - net: igmp: increase size of mr_ifc_count
    - [x86] drm/i915: Only access SFC_DONE when media domain is not fused off
    - xen/events: Fix race in set_evtchn_to_irq
    - vsock/virtio: avoid potential deadlock when vsock device remove
    - nbd: Aovid double completion of a request
    - [arm64] efi/libstub: arm64: Force Image reallocation if BSS was not
      reserved
    - [arm64] efi/libstub: arm64: Relax 2M alignment again for relocatable
      kernels
    - [powerpc*] kprobes: Fix kprobe Oops happens in booke
    - genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP
    - [x86] msi: Force affinity setup before startup
    - [x86] ioapic: Force affinity setup before startup
    - [x86] resctrl: Fix default monitoring groups reporting
    - genirq/msi: Ensure deactivation on teardown
    - PCI/MSI: Enable and mask MSI-X early
    - PCI/MSI: Mask all unused MSI-X entries
    - PCI/MSI: Enforce that MSI-X table entry is masked for update
    - PCI/MSI: Enforce MSI[X] entry updates to be visible
    - PCI/MSI: Do not set invalid bits in MSI mask
    - PCI/MSI: Correct misleading comments
    - PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()
    - PCI/MSI: Protect msi_desc::masked for multi-MSI
    - [powerpc*] smp: Fix OOPS in topology_init()
    - [arm64] efi/libstub: arm64: Double check image alignment at entry
    - [x86] KVM: VMX: Use current VMCS to query WAITPKG support for MSR
      emulation
    - [x86] KVM: nVMX: Use vmx_need_pf_intercept() when deciding if L0 wants a
      #PF
    - [x86] vboxsf: Add vboxsf_[create|release]_sf_handle() helpers
    - [x86] vboxsf: Add support for the atomic_open directory-inode op
    - ceph: add some lockdep assertions around snaprealm handling
    - ceph: clean up locking annotation for ceph_get_snap_realm and
      __lookup_snap_realm
    - ceph: take snap_empty_lock atomically with snaprealm refcount change
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.61
    - mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards
    - media: zr364xx: propagate errors from zr364xx_start_readpipe()
    - media: zr364xx: fix memory leaks in probe()
    - media: drivers/media/usb: fix memory leak in zr364xx_probe
    - [x86] KVM: Factor out x86 instruction emulation with decoding
    - [x86] KVM: Fix warning caused by stale emulation context
    - USB: core: Avoid WARNings for 0-length descriptor requests
    - USB: core: Fix incorrect pipe calculation in do_proc_control()
    - dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers
    - net: xfrm: Fix end of loop tests for list_for_each_entry
    - dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is
      not yet available
    - scsi: pm80xx: Fix TMF task completion race condition
    - scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()
    - scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()
    - scsi: core: Avoid printing an error if target_alloc() returns -ENXIO
    - scsi: core: Fix capacity set to zero after offlinining device
    - drm/amdgpu: fix the doorbell missing when in CGPG issue for renoir.
    - qede: fix crash in rmmod qede while automatic debug collection
    - net: usb: pegasus: Check the return value of get_geristers() and friends;
    - net: usb: lan78xx: don't modify phy_device state concurrently
    - Bluetooth: hidp: use correct wait queue when removing ctrl_wait
      (Closes: #992121)
    - [arm64] dts: qcom: c630: fix correct powerdown pin for WSA881x
    - [arm64] dts: qcom: msm8992-bullhead: Remove PSCI
    - iommu: Check if group is NULL before remove device
    - [arm64] cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant
    - virtio: Protect vqs list access
    - [armhf] bus: ti-sysc: Fix error handling for sysc_check_active_timer()
    - vhost: Fix the calculation in vhost_overflow()
    - bpf: Clear zext_dst of dead insns
    - bnxt: don't lock the tx queue from napi poll
    - bnxt: disable napi before canceling DIM
    - bnxt: make sure xmit_more + errors does not miss doorbells
    - bnxt: count Tx drops
    - net: 6pack: fix slab-out-of-bounds in decode_data
    - bnxt_en: Disable aRFS if running on 212 firmware
    - bnxt_en: Add missing DMA memory barriers
    - vrf: Reset skb conntrack connection on VRF rcv
    - virtio-net: support XDP when not more queues
    - virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO
    - net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
    - ixgbe, xsk: clean up the resources in ixgbe_xsk_pool_enable error path
    - sch_cake: fix srchost/dsthost hashing mode
    - [arm64,armhf] net: mdio-mux: Don't ignore memory allocation errors
    - [arm64,armhf] net: mdio-mux: Handle -EPROBE_DEFER correctly
    - ovs: clear skb->tstamp in forwarding path
    - [amd64] iommu/vt-d: Consolidate duplicate cache invaliation code
    - [amd64] iommu/vt-d: Fix incomplete cache flush in
      intel_pasid_tear_down_entry()
    - r8152: fix writing USB_BP2_EN
    - i40e: Fix ATR queue selection
    - iavf: Fix ping is lost after untrusted VF had tried to change MAC
    - Revert "flow_offload: action should not be NULL when it is referenced"
    - [arm64,armhf] mmc: dw_mmc: Fix hang on data CRC error
    - [arm64,armhf] mmc: mmci: stm32: Check when the voltage switch procedure
      should be done
    - [arm64] mmc: sdhci-msm: Update the software timeout value for sdhc
    - [armhf] clk: imx6q: fix uart earlycon unwork
    - [arm64] clk: qcom: gdsc: Ensure regulator init state matches GDSC state
    - ALSA: hda - fix the 'Capture Switch' value change notifications
    - slimbus: messaging: start transaction ids from 1 instead of zero
    - slimbus: messaging: check for valid transaction id
    - ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9510 laptop
    - [arm*] mmc: sdhci-iproc: Cap min clock frequency on BCM2711
    - [arm*] mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711
    - btrfs: prevent rename2 from exchanging a subvol with a directory from
      different parents
    - ALSA: hda/via: Apply runtime PM workaround for ASUS B23E
    - [s390x] pci: fix use after free of zpci_dev
    - PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI
    - ALSA: hda/realtek: Limit mic boost on HP ProBook 445 G8
    - [x86] ASoC: intel: atom: Fix breakage for PCM buffer address setup
    - mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim
    - fs: warn about impending deprecation of mandatory locks
    - io_uring: fix xa_alloc_cycle() error return value check
    - io_uring: only assign io_uring_enter() SQPOLL error in actual error case
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.62
    - bpf: Fix ringbuf helper function compatibility
    - bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper
    - ASoC: rt5682: Adjust headset volume button threshold
    - ASoC: component: Remove misplaced prefix handling in pin control functions
    - netfilter: conntrack: collect all entries in one cycle
    - once: Fix panic when module unload
    - blk-iocost: fix lockdep warning on blkcg->lock
    - ovl: fix uninitialized pointer read in ovl_lookup_real_one()
    - [arm64] net: mscc: Fix non-GPL export of regmap APIs
    - can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX
      and TX error counters
    - ceph: correctly handle releasing an embedded cap flush
    - Revert "btrfs: compression: don't try to compress if we don't have enough
      pages"
    - drm/amdgpu: Cancel delayed work when GFXOFF is disabled
    - Revert "USB: serial: ch341: fix character loss at high transfer rates"
    - USB: serial: option: add new VID/PID to support Fibocom FG150
    - [arm64,armhf] usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
    - [arm64,armhf] usb: dwc3: gadget: Stop EP0 transfers during pullup disable
    - scsi: core: Fix hang of freezing queue between blocking and running device
    - [amd64] IB/hfi1: Fix possible null-pointer dereference in
      _extend_sdma_tx_descs()
    - ice: do not abort devlink info if board identifier can't be found
    - net: usb: pegasus: fixes of set_register(s) return value evaluation;
    - igc: fix page fault when thunderbolt is unplugged
    - igc: Use num_tx_queues when iterating over tx_ring queue
    - e1000e: Fix the max snoop/no-snoop latency for 10M
    - e1000e: Do not take care about recovery NVM checksum
    - ip_gre: add validation for csum_start
    - [arm64] xgene-v2: Fix a resource leak in the error handling path of
      'xge_probe()'
    - [arm64,armhf] net: marvell: fix MVNETA_TX_IN_PRGRS bit number
    - ucounts: Increase ucounts reference counter before the security hook
    - net/sched: ets: fix crash when flipping from 'strict' to 'quantum'
    - ipv6: use siphash in rt6_exception_hash()
    - ipv4: use siphash instead of Jenkins in fnhe_hashfun()
    - cxgb4: dont touch blocked freelist bitmap after free
    - rtnetlink: Return correct error on changing device netns
    - [arm64] net: hns3: clear hardware resource when loading driver
    - [arm64] net: hns3: add waiting time before cmdq memory is released
    - [arm64] net: hns3: fix duplicate node in VLAN list
    - [arm64] net: hns3: fix get wrong pfc_en when query PFC configuration
    - [arm*] Revert "mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on
      BCM2711"
    - net: stmmac: add mutex lock to protect est parameters
    - net: stmmac: fix kernel panic due to NULL pointer dereference of plat->est
    - [x86] drm/i915: Fix syncmap memory leak
    - usb: gadget: u_audio: fix race condition on endpoint stop
    - [x86] perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of
      a u32
    - iwlwifi: pnvm: accept multiple HW-type TLVs
    - opp: remove WARN when no valid OPPs remain
    - [arm64,armhf] cpufreq: blocklist Qualcomm sm8150 in cpufreq-dt-platdev
    - virtio: Improve vq->broken access to avoid any compiler optimization
    - virtio_pci: Support surprise removal of virtio pci device
    - qed: qed ll2 race condition fixes
    - qed: Fix null-pointer dereference in qed_rdma_create_qp()
    - blk-mq: don't grab rq's refcount in blk_mq_check_expired()
    - drm: Copy drm_wait_vblank to user before returning
    - drm/nouveau/disp: power down unused DP links during init
    - drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences
    - net/rds: dma_map_sg is entitled to merge entries
    - btrfs: fix race between marking inode needs to be logged and log syncing
    - pipe: avoid unnecessary EPOLLET wakeups under normal loads
    - pipe: do FASYNC notifications for every pipe IO, not just state changes
    - tipc: call tipc_wait_for_connect only when dlen is not 0
    - Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
    - [powerpc*] perf: Invoke per-CPU variable access with disabled interrupts
    - srcu: Provide internal interface to start a Tree SRCU grace period
    - srcu: Provide polling interfaces for Tree SRCU grace periods
    - srcu: Provide internal interface to start a Tiny SRCU grace period
    - srcu: Make Tiny SRCU use multi-bit grace-period counter
    - srcu: Provide polling interfaces for Tiny SRCU grace periods
    - tracepoint: Use rcu get state and cond sync for static call updates
    - usb: typec: ucsi: acpi: Always decode connector change information
      (Closes: #992004)
    - usb: typec: ucsi: Work around PPM losing change information
    - usb: typec: ucsi: Clear pending after acking connector change
    - [arm64] dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88
    - kthread: Fix PF_KTHREAD vs to_kthread() race
    - Revert "floppy: reintroduce O_NDELAY fix"
    - net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
    - audit: move put_tree() to avoid trim_trees refcount underflow and UAF
    - bpf: Fix potentially incorrect results with bpf_get_local_storage()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.63
    - fscrypt: add fscrypt_symlink_getattr() for computing st_size
    - ext4: report correct st_size for encrypted symlinks
    - f2fs: report correct st_size for encrypted symlinks
    - ubifs: report correct st_size for encrypted symlinks
    - Revert "ucounts: Increase ucounts reference counter before the security
      hook"
    - Revert "cred: add missing return error code when set_cred_ucounts()
      failed"
    - Revert "Add a reference to ucounts for each cred"
    - [armhf] gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar
      U/V formats
    - qed: Fix the VF msix vectors flow
    - [arm64] net: macb: Add a NULL check on desc_ptp
    - qede: Fix memset corruption
    - [x86] perf/x86/intel/pt: Fix mask of num_address_ranges
    - ceph: fix possible null-pointer dereference in ceph_mdsmap_decode()
    - [x86] perf/x86/amd/ibs: Work around erratum #1197
    - [x86] perf/x86/amd/power: Assign pmu.module
    - ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup
    - ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17
    - ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
    - spi: Switch to signed types for *_native_cs SPI controller fields
    - new helper: inode_wrong_type()
    - fuse: fix illegal access to inode with reused nodeid
    - media: stkwebcam: fix memory leak in stk_camera_probe
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.64
    - igmp: Add ip_mc_list lock in ip_check_mc_rcu
    - USB: serial: mos7720: improve OOM-handling in read_mos_reg()
    - mm/page_alloc: speed up the iteration of max_order
    - Revert "r8169: avoid link-up interrupt issue on RTL8106e if user enables
      ASPM"
    - [amd64] x86/events/amd/iommu: Fix invalid Perf result due to IOMMU PMC
      power-gating
    - blk-mq: fix kernel panic during iterating over flush request
    - blk-mq: fix is_flush_rq
    - blk-mq: clearing flush request reference in tags->rqs[]
    - ALSA: usb-audio: Add registration quirk for JBL Quantum 800
    - xhci: fix even more unsafe memory usage in xhci tracing
    - xhci: fix unsafe memory usage in xhci tracing
    - [x86] reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
    - PCI: Call Max Payload Size-related fixup quirks early
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.65
    - locking/mutex: Fix HANDOFF condition
    - regmap: fix the offset of register error log
    - sched/deadline: Fix reset_on_fork reporting of DL tasks
    - power: supply: axp288_fuel_gauge: Report register-address on readb /
      writeb errors
    - sched/deadline: Fix missing clock update in migrate_task_rq_dl()
    - rcu/tree: Handle VM stoppage in stall detection
    - [x86] EDAC/mce_amd: Do not load edac_mce_amd module on guests
    - posix-cpu-timers: Force next expiration recalc after itimer reset
    - hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
    - hrtimer: Ensure timerfd notification for HIGHRES=n
    - udf: Check LVID earlier
    - udf: Fix iocharset=utf8 mount option
    - isofs: joliet: Fix iocharset=utf8 mount option
    - bcache: add proper error unwinding in bcache_device_init
    - blk-throtl: optimize IOPS throttle for large IO scenarios
    - nvme-tcp: don't update queue count when failing to set io queues
    - nvme-rdma: don't update queue count when failing to set io queues
    - nvmet: pass back cntlid on successful completion
    - [x86] power: supply: max17042_battery: fix typo in MAx17042_TOFF
    - [s390x] cio: add dev_busid sysfs entry for each subchannel
    - [s390x] zcrypt: fix wrong offset index for APKA master key valid state
    - libata: fix ata_host_start()
    - [x86] crypto: qat - do not ignore errors from enable_vf2pf_comms()
    - [x86] crypto: qat - handle both source of interrupt in VF ISR
    - [x86] crypto: qat - fix reuse of completion variable
    - [x86] crypto: qat - fix naming for init/shutdown VF to PF notifications
    - [x86] crypto: qat - do not export adf_iov_putmsg()
    - fcntl: fix potential deadlock for &fasync_struct.fa_lock
    - udf_get_extendedattr() had no boundary checks.
    - [s390x] pci: fix misleading rc in clp_set_pci_fn()
    - [s390x] debug: keep debug data on resize
    - [s390x] debug: fix debug area life cycle
    - [s390x] ap: fix state machine hang after failure to enable irq
    - [arm64] power: supply: cw2015: use dev_err_probe to allow deferred probe
    - sched/numa: Fix is_core_idle()
    - sched: Fix UCLAMP_FLAG_IDLE setting
    - rcu: Fix to include first blocked task in stall warning
    - rcu: Add lockdep_assert_irqs_disabled() to rcu_sched_clock_irq() and
      callees
    - rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock
    - block: return ELEVATOR_DISCARD_MERGE if possible
    - [arm64] spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
    - genirq/timings: Fix error return code in irq_timings_test_irqs()
    - [mips64el,mipsel] irqchip/loongson-pch-pic: Improve edge triggered
      interrupt support
    - lib/mpi: use kcalloc in mpi_resize
    - block: nbd: add sanity check for first_minor
    - [arm64,armhf] irqchip/gic-v3: Fix priority comparison when non-secure
      priorities are used
    - [x86] crypto: qat - use proper type for vf_mask
    - [x86] mce: Defer processing of early errors
    - [arm64] regulator: vctrl: Use locked regulator_get_voltage in probe path
    - [arm64] regulator: vctrl: Avoid lockdep warning in enable/disable ops
    - [arm64,armhf] drm/panfrost: Fix missing clk_disable_unprepare() on error
      in panfrost_clk_init()
    - [x86] drm/gma500: Fix end of loop tests for list_for_each_entry
    - drm/of: free the right object
    - bpf: Fix a typo of reuseport map in bpf.h.
    - bpf: Fix potential memleak and UAF in the verifier.
    - drm/of: free the iterator object on failure
    - [amd64] gve: fix the wrong AdminQ buffer overflow check
    - i40e: improve locking of mac_filter_hash
    - gfs2: Fix memory leak of object lsi on error return path
    - firmware: fix theoretical UAF race with firmware cache and resume
    - driver core: Fix error return code in really_probe()
    - media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
    - media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
    - media: dvb-usb: Fix error handling in dvb_usb_i2c_init
    - media: go7007: fix memory leak in go7007_usb_probe
    - media: go7007: remove redundant initialization
    - [armhf] media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
    - Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
    - [x86] drm/amdgpu/acp: Make PM domain really work
    - tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
    - [armhf] dts: meson8b: odroidc1: Fix the pwm regulator supply properties
    - [armhf] dts: meson8b: mxq: Fix the pwm regulator supply properties
    - [armhf] dts: meson8b: ec100: Fix the pwm regulator supply properties
    - net/mlx5e: Prohibit inner indir TIRs in IPoIB
    - net/mlx5e: Block LRO if firmware asks for tunneled LRO
    - cgroup/cpuset: Fix a partition bug with hotplug
    - net: cipso: fix warnings in netlbl_cipsov4_add_std
    - Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd
    - devlink: Break parameter notification sequence to be before/after
      unload/load driver
    - net/mlx5: Fix missing return value in
      mlx5_devlink_eswitch_inline_mode_set()
    - leds: lt3593: Put fwnode in any case during ->probe()
    - leds: trigger: audio: Add an activate callback to ensure the initial
      brightness is set
    - media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
    - [arm64] media: venus: venc: Fix potential null pointer dereference on
      pointer fmt
    - PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
    - PCI: PM: Enable PME if it can be signaled from D3cold
    - debugfs: Return error during {full/open}_proxy_open() on rmmod
    - Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
    - PM: EM: Increase energy calculation precision
    - [arm64] drm/msm/mdp4: refactor HW revision detection into
      read_mdp_hw_revision
    - [arm64] drm/msm/mdp4: move HW revision detection to earlier phase
    - [arm64] drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary
      LMs
    - cgroup/cpuset: Miscellaneous code cleanup
    - cgroup/cpuset: Fix violation of cpuset locking rule
    - [x86] ASoC: Intel: Fix platform ID matching
    - Bluetooth: fix repeated calls to sco_sock_kill
    - [arm64] drm/msm/dsi: Fix some reference counted resource leaks
    - net/mlx5: Register to devlink ingress VLAN filter trap
    - net/mlx5: Fix unpublish devlink parameters
    - [x86] ASoC: rt5682: Implement remove callback
    - [x86] ASoC: rt5682: Properly turn off regulators if wrong device ID
    - [arm64,armhf] usb: dwc3: meson-g12a: add IRQ check
    - [arm64] usb: dwc3: qcom: add IRQ check
    - [armhf] usb: phy: twl6030: add IRQ checks
    - devlink: Clear whole devlink_flash_notify struct
    - Bluetooth: Move shutdown callback before flushing tx and rx queue
    - PM: cpu: Make notifier chain use a raw_spinlock_t
    - mac80211: Fix insufficient headroom issue for AMSDU
    - locking/lockdep: Mark local_lock_t
    - locking/local_lock: Add missing owner initialization
    - lockd: Fix invalid lockowner cast after vfs_test_lock
    - nfsd4: Fix forced-expiry locking
    - [arm64] dts: marvell: armada-37xx: Extend PCIe MEM space
    - [arm*] firmware: raspberrypi: Keep count of all consumers
    - [arm*] firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()'
    - mm/swap: consider max pages in iomap_swapfile_add_extent
    - Bluetooth: add timeout sanity check to hci_inquiry
    - [armhf] i2c: s3c2410: fix IRQ check
    - gfs2: init system threads before freeze lock
    - rsi: fix error code in rsi_load_9116_firmware()
    - rsi: fix an error code in rsi_probe()
    - [x86] ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
    - [x86] ASoC: Intel: Skylake: Fix module resource and format selection
    - mmc: sdhci: Fix issue with uninitialized dma_slave_config
    - [arm64,armhf] mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
    - bpf: Fix possible out of bound write in narrow load handling
    - CIFS: Fix a potencially linear read overflow
    - [arm64] i2c: xlp9xx: fix main IRQ check
    - [arm*] usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
    - [arm64] tty: serial: fsl_lpuart: fix the wrong mapbase value
    - iwlwifi: follow the new inclusive terminology
    - iwlwifi: skip first element in the WTAS ACPI table
    - ice: Only lock to update netdev dev_addr
    - ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
    - [amd64,arm64] atlantic: Fix driver resume flow.
    - bcma: Fix memory leak for internally-handled cores
    - brcmfmac: pcie: fix oops on failure to resume and reprobe
    - ipv6: make exception cache less predictible
    - ipv4: make exception cache less predictible
    - net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
    - ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
    - [x86] ASoC: rt5682: Remove unused variable in rt5682_i2c_remove()
    - iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha
    - f2fs: guarantee to write dirty data when enabling checkpoint back
    - time: Handle negative seconds correctly in timespec64_to_ns()
    - io_uring: IORING_OP_WRITE needs hash_reg_file set
    - bio: fix page leak bio_add_hw_page failure
    - tty: Fix data race between tiocsti() and flush_to_ldisc()
    - [x86] perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op
    - [x86] resctrl: Fix a maybe-uninitialized build warning treated as error
    - [x86] Revert "KVM: x86: mmu: Add guest physical address check in
      translate_gpa()"
    - [s390x] KVM: index kvm->arch.idle_mask by vcpu_idx
    - [x86] KVM: x86: Update vCPU's hv_clock before back to guest when
      tsc_offset is adjusted
    - [x86] KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation
    - [x86] KVM: nVMX: Unconditionally clear nested.pi_pending on nested
      VM-Enter
    - fuse: truncate pagecache on atomic_o_trunc
    - fuse: flush extending writes
    - fbmem: don't allow too huge resolutions
    - backlight: pwm_bl: Improve bootloader/kernel device handover
    - [armel] clk: kirkwood: Fix a clocking boot regression
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.66
    - Revert "Bluetooth: Move shutdown callback before flushing tx and rx queue"
    - Revert "block: nbd: add sanity check for first_minor"
    - Revert "posix-cpu-timers: Force next expiration recalc after itimer reset"
    - Revert "time: Handle negative seconds correctly in timespec64_to_ns()"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.67
    - io_uring: limit fixed table size by RLIMIT_NOFILE
    - io_uring: place fixed tables under memcg limits
    - io_uring: add ->splice_fd_in checks
    - io_uring: fail links of cancelled timeouts
    - io-wq: fix wakeup race when adding new work
    - btrfs: wake up async_delalloc_pages waiters after submit
    - btrfs: reset replace target device to allocation state on close
    - blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
    - blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
    - PCI/MSI: Skip masking MSI-X on Xen PV
    - [powerpc*] perf/hv-gpci: Fix counter value parsing
    - xen: fix setting of max_pfn in shared_info
    - 9p/xen: Fix end of loop tests for list_for_each_entry
    - ceph: fix dereference of null pointer cf
    - [armhf] soc: aspeed: lpc-ctrl: Fix boundary check for mmap
    - [armhf] soc: aspeed: p2a-ctrl: Fix boundary check for mmap
    - [arm64] mm: Fix TLBI vs ASID rollover
    - [arm64] head: avoid over-mapping in map_memory
    - iio: ltc2983: fix device probe
    - [arm64] wcn36xx: Ensure finish scan is not requested before start scan
    - block: bfq: fix bfq_set_next_ioprio_data()
    - [x86] power: supply: max17042: handle fails of reading status register
    - dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()
    - [x86] crypto: ccp - shutdown SEV firmware on kexec
    - [x86] VMCI: fix NULL pointer dereference when unmapping queue pair
    - media: uvc: don't do DMA on stack
    - media: rc-loopback: return number of emitters rather than error
    - [s390x] qdio: fix roll-back after timeout on ESTABLISH ccw
    - [s390x] qdio: cancel the ESTABLISH ccw after timeout
    - [armhf] Revert "dmaengine: imx-sdma: refine to load context only once"
    - [armhf] dmaengine: imx-sdma: remove duplicated sdma_load_context
    - libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
    - f2fs: fix to do sanity check for sb/cp fields correctly
    - PCI/portdrv: Enable Bandwidth Notification only if port supports it
    - PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
    - PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
    - [arm64] PCI: xilinx-nwl: Enable the clock through CCF
    - [arm64] PCI: aardvark: Configure PCIe resources from 'ranges' DT property
    - PCI: Export pci_pio_to_address() for module use
    - [arm64] PCI: aardvark: Fix checking for PIO status
    - [arm64] PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
    - HID: input: do not report stylus battery state as "full"
    - f2fs: quota: fix potential deadlock
    - [arm64] pinctrl: armada-37xx: Correct PWM pins definitions
    - scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND
    - [arm64,armhf] clk: rockchip: drop GRF dependency for rk3328/rk3036 pll
      types
    - [amd64] IB/hfi1: Adjust pkey entry in index 0
    - RDMA/iwcm: Release resources if iw_cm module initialization fails
    - docs: Fix infiniband uverbs minor number
    - scsi: BusLogic: Use %X for u32 sized integer rather than %lX
    - [armhf] pinctrl: samsung: Fix pinctrl bank pin count
    - scsi: ufs: Fix memory corruption by ufshcd_read_desc_param()
    - [powerpc*] cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards
    - [powerpc*] stacktrace: Include linux/delay.h
    - RDMA/mlx5: Delete not-available udata check
    - [powerpc*] cpuidle: pseries: Mark pseries_idle_proble() as __init
    - f2fs: reduce the scope of setting fsck tag when de->name_len is zero
    - NFSv4/pNFS: Fix a layoutget livelock loop
    - NFSv4/pNFS: Always allow update of a zero valued layout barrier
    - NFSv4/pnfs: The layout barrier indicate a minimal value for the seqid
    - SUNRPC: Fix potential memory corruption
    - SUNRPC/xprtrdma: Fix reconnection locking
    - SUNRPC query transport's source port
    - sunrpc: Fix return value of get_srcport()
    - [arm64,armhf] pinctrl: single: Fix error return code in
      pcs_parse_bits_in_pinctrl_entry()
    - [powerpc*] numa: Consider the max NUMA node for migratable LPAR
    - scsi: smartpqi: Fix an error code in pqi_get_raid_map()
    - scsi: qedi: Fix error codes in qedi_alloc_global_queues()
    - scsi: qedf: Fix error codes in qedf_alloc_global_queues()
    - iommu/vt-d: Update the virtual command related registers
    - HID: i2c-hid: Fix Elan touchpad regression
    - [arm64,armhf] clk: imx8m: fix clock tree update of TF-A managed clocks
    - [powerpc*] KVM: PPC: Book3S HV: Fix copy_tofrom_guest routines
    - [powerpc*] KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when
      guest SPRs are live
    - [x86] platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from
      run_smbios_call
    - [powerpc*] smp: Update cpu_core_map on all PowerPc systems
    - [arm64] RDMA/hns: Fix QP's resp incomplete assignment
    - fscache: Fix cookie key hashing
    - [powerpc*] KVM: PPC: Fix clearing never mapped TCEs in realmode
    - f2fs: fix to account missing .skipped_gc_rwsem
    - f2fs: fix unexpected ENOENT comes from f2fs_map_blocks()
    - f2fs: fix to unmap pages from userspace process in punch_hole()
    - f2fs: deallocate compressed pages when error happens
    - f2fs: should put a page beyond EOF when preparing a write
    - [mips64el,mipsel] Malta: fix alignment of the devicetree buffer
    - userfaultfd: prevent concurrent API initialization
    - [arm*] drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET
    - drm/amdgpu: Fix amdgpu_ras_eeprom_init()
    - media: dib8000: rewrite the init prbs logic
    - [x86] hyperv: fix for unwanted manipulation of sched_clock when TSC marked
      unstable
    - PCI: Use pci_update_current_state() in pci_enable_device_flags()
    - tipc: keep the skb in rcv queue until the whole data is read
    - net: phy: Fix data type in DP83822 dp8382x_disable_wol()
    - iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
    - iavf: do not override the adapter state in the watchdog task
    - iavf: fix locking of critical sections
    - video: fbdev: kyro: fix a DoS bug by restricting user input
    - netlink: Deal with ESRCH error in nlmsg_notify()
    - drm: avoid blocking in drm_clients_info's rcu section
    - drm: serialize drm_file.master with a new spinlock
    - drm: protect drm_master pointers in drm_lease.c
    - rcu: Fix macro name CONFIG_TASKS_RCU_TRACE
    - igc: Check if num of q_vectors is smaller than max before array access
    - usb: gadget: u_ether: fix a potential null pointer dereference
    - [armhf] USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable()
    - usb: gadget: composite: Allow bMaxPower=0 if self-powered
    - tty: serial: jsm: hold port lock when reporting modem line changes
    - [arm64] bus: fsl-mc: fix mmio base address for child DPRCs
    - nfp: fix return statement in nfp_net_parse_meta()
    - ethtool: improve compat ioctl handling
    - drm/amdgpu: Fix a printing message
    - [arm64] dts: allwinner: h6: tanix-tx6: Fix regulator node names
    - video: fbdev: kyro: Error out if 'pixclock' equals zero
    - ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
    - flow_dissector: Fix out-of-bounds warnings
    - [s390x] jump_label: print real address in a case of a jump label bug
    - [s390x] make PCI mio support a machine flag
    - serial: 8250: Define RX trigger levels for OxSemi 950 devices
    - serial: 8250_pci: make setup_port() parameters explicitly unsigned
    - Bluetooth: skip invalid hci_sync_conn_complete_evt
    - workqueue: Fix possible memory leaks in wq_numa_init()
    - bonding: 3ad: fix the concurrency between __bond_release_one() and
      bond_3ad_state_machine_handler()
    - [x86] ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps
      for the matching in-/output
    - [x86] ASoC: Intel: update sof_pcm512x quirks
    - media: v4l2-dv-timings.c: fix wrong condition in two for-loops
    - gfs2: Fix glock recursion in freeze_go_xmote_bh
    - [armhf] dts: imx53-ppd: Fix ACHC entry
    - [arm64] nvmem: qfprom: Fix up qfprom_disable_fuse_blowing() ordering
    - [arm64] net: ethernet: stmmac: Do not use unreachable() in
      ipq806x_gmac_probe()
    - [arm64] drm/msm: mdp4: drop vblank get/put from prepare/complete_commit
    - [arm64] drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660
    - [x86] thunderbolt: Fix port linking by checking all adapters
    - [x86] drm/vmwgfx: fix potential UAF in vmwgfx_surface.c
    - Bluetooth: schedule SCO timeouts with delayed_work
    - Bluetooth: avoid circular locks in sco_sock_connect
    - [arm64] drm/msm/dp: return correct edid checksum after corrupted edid
      checksum read
    - net/mlx5: Fix variable type to match 64bit
    - gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable
      access in amdgpu_i2c_router_select_ddc_port()
    - mac80211: Fix monitor MTU limit so that A-MSDUs get through
    - [arm64] dts: ls1046a: fix eeprom entries
    - nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data
    - nvme: code command_id with a genctr for use-after-free validation
    - Bluetooth: Fix handling of LE Enhanced Connection Complete
    - opp: Don't print an error if required-opps is missing
    - iomap: pass writeback errors to the mapping
    - tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD
    - rpc: fix gss_svc_init cleanup on failure
    - [armhf] hwmon: (pmbus/ibm-cffps) Fix write bits for LED control
    - [x86] staging: rts5208: Fix get_ms_information() heap buffer size
    - net: Fix offloading indirect devices dependency on qdisc order creation
    - gfs2: Don't call dlm after protocol is unmounted
    - [arm64,armhf] usb: chipidea: host: fix port index underflow and UBSAN
      complains
    - lockd: lockd server-side shouldn't set fl_ops
    - [armhf] drm/exynos: Always initialize mapping in exynos_drm_register_dma()
    - rtl8xxxu: Fix the handling of TX A-MPDU aggregation
    - rtw88: use read_poll_timeout instead of fixed sleep
    - rtw88: wow: build wow function only if CONFIG_PM is on
    - rtw88: wow: fix size access error of probe request
    - btrfs: tree-log: check btrfs_lookup_data_extent return value
    - soundwire: intel: fix potential race condition during power down
    - [x86] ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER
    - [x86] ASoC: Intel: Skylake: Fix passing loadable flag for module
    - of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS
    - [arm64] mmc: sdhci-of-arasan: Modified SD default speed to 19MHz for
      ZynqMP
    - [arm64] mmc: sdhci-of-arasan: Check return value of non-void funtions
    - mmc: rtsx_pci: Fix long reads when clock is prescaled
    - mmc: core: Return correct emmc response in case of ioctl error
    - cifs: fix wrong release in sess_alloc_buffer() failed path
    - Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST
      quirk set"
    - [armhf] usb: musb: musb_dsps: request_irq() after initializing musb
    - usbip: give back URBs for unsent unlink requests during cleanup
    - usbip:vhci_hcd USB port can get stuck in the disabled state
    - [arm64,armhf] ASoC: rockchip: i2s: Fix regmap_ops hang
    - [arm64,armhf] ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B
    - nfsd: fix crash on LOCKT on reexported NFSv3
    - iwlwifi: pcie: free RBs during configure
    - iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed
    - iwlwifi: mvm: avoid static queue number aliasing
    - iwlwifi: mvm: fix access to BSS elements
    - iwlwifi: fw: correctly limit to monitor dump
    - iwlwifi: mvm: Fix scan channel flags settings
    - net/mlx5: DR, fix a potential use-after-free bug
    - net/mlx5: DR, Enable QP retransmission
    - parport: remove non-zero check on count
    - [arm64] wcn36xx: Fix missing frame timestamp for beacon/probe-resp
    - ath9k: fix OOB read ar9300_eeprom_restore_internal
    - ath9k: fix sleeping in atomic context
    - net: fix NULL pointer reference in cipso_v4_doi_free
    - fix array-index-out-of-bounds in taprio_change
    - [arm64] net: hns3: clean up a type mismatch warning
    - fs/io_uring Don't use the return value from import_iovec().
    - io_uring: remove duplicated io_size from rw
    - ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup()
    - scsi: BusLogic: Fix missing pr_cont() use
    - scsi: qla2xxx: Changes to support kdump kernel
    - scsi: qla2xxx: Sync queue idx with queue_pair_map idx
    - [powerpc*] cpufreq: powernv: Fix init_chip_info initialization in numa=off
    - [s390x] pv: fix the forcing of the swiotlb
    - hugetlb: fix hugetlb cgroup refcounting during vma split
    - mm/hmm: bypass devmap pte when all pfn requested flags are fulfilled
    - mm/hugetlb: initialize hugetlb_usage in mm_init
    - mm,vmscan: fix divide by zero in get_scan_count
    - memcg: enable accounting for pids in nested pid namespaces
    - libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind
    - [arm64,armhf] platform/chrome: cros_ec_proto: Send command again when
      timeout occurs
    - [x86] drm/mgag200: Select clock in PLL update functions
    - [arm64] drm/msi/mdp4: populate priv->kms in mdp4_kms_init
    - drm/dp_mst: Fix return code on sideband message failure
    - [arm64,armhf] drm/panfrost: Make sure MMU context lifetime is not bound to
      panfrost_priv
    - drm/amdgpu: Fix BUG_ON assert
    - [arm64,armhf] drm/panfrost: Simplify lock_region calculation
    - [arm64,armhf] drm/panfrost: Use u64 for size in lock_region
    - [arm64,armhf] drm/panfrost: Clamp lock region to Bifrost minimum
    - fanotify: limit number of event merge attempts
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.68
    - btrfs: fix upper limit for max_inline for page size 64K
    - [amd64] xen: reset legacy rtc flag for PV domU
    - [arm64] sve: Use correct size when reinitialising SVE state
    - PCI: Add AMD GPU multi-function power dependencies
    - drm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10
    - [armhf] drm/etnaviv: return context from etnaviv_iommu_context_get
    - [armhf] drm/etnaviv: put submit prev MMU context when it exists
    - [armhf] drm/etnaviv: stop abusing mmu_context as FE running marker
    - [armhf] drm/etnaviv: keep MMU context across runtime suspend/resume
    - [armhf] drm/etnaviv: exec and MMU state is lost when resetting the GPU
    - [armhf] drm/etnaviv: fix MMU context leak on GPU reset
    - [armhf] drm/etnaviv: reference MMU context when setting up hardware state
    - [armhf] drm/etnaviv: add missing MMU context put when reaping MMU mapping
    - [s390x] sclp: fix Secure-IPL facility detection
    - [x86] pat: Pass valid address to sanitize_phys()
    - [x86] mm: Fix kern_addr_valid() to cope with existing but not present
      entries
    - tipc: fix an use-after-free issue in tipc_recvmsg
    - ethtool: Fix rxnfc copy to user buffer overflow
    - net/{mlx5|nfp|bnxt}: Remove unnecessary RTNL lock assert
    - net/l2tp: Fix reference count leak in l2tp_udp_recv_core
    - r6040: Restore MDIO clock frequency after MAC reset
    - tipc: increase timeout in tipc_sk_enqueue()
    - [arm64] drm/rockchip: cdn-dp-core: Make cdn_dp_core_resume __maybe_unused
    - net/mlx5: FWTrace, cancel work on alloc pd error flow
    - net/mlx5: Fix potential sleeping in atomic context
    - nvme-tcp: fix io_work priority inversion
    - events: Reuse value read using READ_ONCE instead of re-reading it
    - vhost_net: fix OoB on sendmsg() failure.
    - net/af_unix: fix a data-race in unix_dgram_poll
    - [arm64,armhf] net: dsa: destroy the phylink instance on any error in
      dsa_slave_phy_setup
    - [x86] uaccess: Fix 32-bit __get_user_asm_u64() when
      CC_HAS_ASM_GOTO_OUTPUT=y
    - tcp: fix tp->undo_retrans accounting in tcp_sacktag_one()
    - qed: Handle management FW error
    - udp_tunnel: Fix udp_tunnel_nic work-queue type
    - dt-bindings: arm: Fix Toradex compatible typo
    - [powerpc*] KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode
      changing registers
    - bnxt_en: make bnxt_free_skbs() safe to call after bnxt_free_mem()
    - [arm64] net: hns3: pad the short tunnel frame before sending to hardware
    - [arm64] net: hns3: change affinity_mask to numa node range
    - [arm64] net: hns3: disable mac in flr process
    - [arm64] net: hns3: fix the timing issue of VF clearing interrupt sources
    - mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range()
    - dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation
    - PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms
    - fuse: fix use after free in fuse_read_interrupt()
    - [arm64,armhf] PCI: tegra: Fix OF node reference leak
    - [armhf] mfd: Don't use irq_create_mapping() to resolve a mapping
    - tracing/probes: Reject events which have the same name of existing one
    - PCI: Add ACS quirks for Cavium multi-function devices
    - watchdog: Start watchdog in watchdog_set_last_hw_keepalive only if
      appropriate
    - Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6
    - net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920
    - block, bfq: honor already-setup queue merges
    - [i386] PCI: ibmphp: Fix double unmap of io_mem
    - ethtool: Fix an error code in cxgb2.c
    - [s390x] bpf: Fix optimizing out zero-extensions
    - [s390x] bpf: Fix 64-bit subtraction of the -0x80000000 constant
    - [s390x] bpf: Fix branch shortening during codegen pass
    - mfd: axp20x: Update AXP288 volatile ranges
    - PCI: of: Don't fail devm_pci_alloc_host_bridge() on missing 'ranges'
    - netfilter: nft_ct: protect nft_ct_pcpu_template_refcnt with mutex
    - [arm64] KVM: Restrict IPA size to maximum 48 bits on 4K and 16K page size
    - PCI: Fix pci_dev_str_match_path() alloc while atomic bug
    - mtd: mtdconcat: Judge callback existence based on the master
    - mtd: mtdconcat: Check _read, _write callbacks existence before assignment
    - [arm64] KVM: Fix read-side race on updates to vcpu reset state
    - [arm64] KVM: Handle PSCI resets before userspace touches vCPU state
    - mtd: rawnand: cafe: Fix a resource leak in the error handling path of
      'cafe_nand_probe()'
    - perf unwind: Do not overwrite
      FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64}
    - [arm64] gpio: mpc8xxx: Fix a resources leak in the error handling path of
      'mpc8xxx_probe()'
    - [arm64] gpio: mpc8xxx: Use 'devm_gpiochip_add_data()' to simplify the code
      and avoid a leak
    - net: hso: add failure handler for add_net_device
    - [armhf] net: dsa: b53: Fix calculating number of switch ports
    - [armhf] net: dsa: b53: Set correct number of ports in the DSA struct
    - netfilter: socket: icmp6: fix use-after-scope
    - fq_codel: reject silly quantum parameters
    - qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom
    - ip_gre: validate csum_start only on pull
    - [armhf] net: dsa: b53: Fix IMP port setup on BCM5301x
    - bnxt_en: fix stored FW_PSID version masks
    - bnxt_en: Fix asic.rev in devlink dev info command
    - bnxt_en: log firmware debug notifications
    - bnxt_en: Consolidate firmware reset event logging.
    - bnxt_en: Convert to use netif_level() helpers.
    - bnxt_en: Improve logging of error recovery settings information.
    - bnxt_en: Fix possible unintended driver initiated error recovery
    - mfd: lpc_sch: Partially revert "Add support for Intel Quark X1000"
    - mfd: lpc_sch: Rename GPIOBASE to prevent build error
    - [x86] mce: Avoid infinite loop for copy from user recovery
    - bnxt_en: Fix error recovery regression
    - [armhf] net: dsa: bcm_sf2: Fix array overrun in bcm_sf2_num_active_ports()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.69
    - PCI: pci-bridge-emul: Add PCIe Root Capabilities Register
    - [arm64] PCI: aardvark: Fix reporting CRS value
    - console: consume APC, DM, DCS
    - [s390x] pci_mmio: fully validate the VMA before calling follow_pte()
    - [armel,armhf] Qualify enabling of swiotlb_init()
    - [armel,armhf] 9077/1: PLT: Move struct plt_entries definition to header
    - [armel,armhf] 9078/1: Add warn suppress parameter to arm_gen_branch_link()
    - [armel,armhf] 9079/1: ftrace: Add MODULE_PLTS support
    - [armel,armhf] 9098/1: ftrace: MODULE_PLT: Fix build problem without
      DYNAMIC_FTRACE
    - Revert "net/mlx5: Register to devlink ingress VLAN filter trap"
    - sctp: validate chunk size in __rcv_asconf_lookup (CVE-2021-3655)
    - sctp: add param size validation for SCTP_PARAM_SET_PRIMARY (CVE-2021-3655)
    - [x86] staging: rtl8192u: Fix bitwise vs logical operator in
      TranslateRxSignalStuff819xUsb()
    - coredump: fix memleak in dump_vma_snapshot()
    - dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
    - [armhf] thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
    - 9p/trans_virtio: Remove sysfs file on probe failure
    - prctl: allow to setup brk for et_dyn executables
    - nilfs2: use refcount_dec_and_lock() to fix potential UAF
    - profiling: fix shift-out-of-bounds bugs
    - PM: sleep: core: Avoid setting power.must_resume to false
    - platform/chrome: sensorhub: Add trace events for sample
    - platform/chrome: cros_ec_trace: Fix format warnings
    - ceph: allow ceph_put_mds_session to take NULL or ERR_PTR
    - ceph: cancel delayed work instead of flushing on mdsc teardown
    - thermal/core: Fix thermal_cooling_device_register() prototype
    - drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION()
    - dma-buf: DMABUF_MOVE_NOTIFY should depend on DMA_SHARED_BUFFER
    - [amd64] iommu/amd: Relocate GAMSup check to early_enable_iommus
    - ceph: request Fw caps before updating the mtime in ceph_write_iter
    - ceph: remove the capsnaps when removing caps
    - ceph: lockdep annotations for try_nonblocking_invalidate
    - btrfs: update the bdev time directly when closing
    - btrfs: fix lockdep warning while mounting sprout fs
    - nilfs2: fix memory leak in nilfs_sysfs_create_device_group
    - nilfs2: fix NULL pointer in nilfs_##name##_attr_release
    - nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group
    - nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group
    - nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group
    - nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
    - [arm64,armhf] pwm: rockchip: Don't modify HW state in .remove() callback
    - [armhf] pwm: stm32-lp: Don't modify HW state in .remove() callback
    - blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
    - blk-mq: allow 4x BLK_MAX_REQUEST_COUNT at blk_plug for multiple_queues
    - sched/idle: Make the idle timer expire in hard interrupt context
    - drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.70
    - [arm64] PCI: aardvark: Increase polling delay to 1.5s while waiting for
      PIO response
    - ocfs2: drop acl cache for directories too
    - mm: fix uninitialized use in overcommit_policy_handler
    - [arm*] usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave
    - [arm*] usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA
    - [armhf] usb: musb: tusb6010: uninitialized data in
      tusb_fifo_write_unaligned()
    - cifs: fix incorrect check for null pointer in header_assemble
    - [x86] xen/x86: fix PV trap handling on secondary processors
    - usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
    - USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter
    - USB: cdc-acm: fix minor-number release
    - [arm*] binder: make sure fd closes complete
    - [arm64,armhf] usb: dwc3: core: balance phy init and exit
    - usb: core: hcd: Add support for deferring roothub registration
    - USB: serial: mos7840: remove duplicated 0xac24 device ID
    - USB: serial: option: add Telit LN920 compositions
    - USB: serial: option: remove duplicate USB device ID
    - USB: serial: option: add device id for Foxconn T99W265
    - erofs: fix up erofs_lookup tracepoint
    - btrfs: prevent __btrfs_dump_space_info() to underflow its free space
    - xhci: Set HCD flag to defer primary roothub registration
    - [arm64] serial: mvebu-uart: fix driver's tx_empty callback
    - scsi: sd_zbc: Ensure buffer size is aligned to SECTOR_SIZE
    - net: hso: fix muxed tty registration
    - afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation
    - afs: Fix updating of i_blocks on file/dir extension
    - [arm64] enetc: Fix illegal access when reading affinity_hint
    - [arm64] enetc: Fix uninitialized struct dim_sample field usage
    - bnxt_en: Fix TX timeout when TX ring size is set to the smallest
    - [arm64] net: hns3: fix change RSS 'hfunc' ineffective issue
    - [arm64] net: hns3: check queue id range before using
    - net/smc: add missing error check in smc_clc_prfx_set()
    - net/smc: fix 'workqueue leaked lock' in smc_conn_abort_work
    - [arm64,armhf] net: dsa: don't allocate the slave_mii_bus using devres
    - [s390x] qeth: fix NULL deref in qeth_clear_working_pool_list()
    - qed: rdma - don't wait for resources under hw error recovery flow
    - net/mlx4_en: Don't allow aRFS for encapsulated packets
    - atlantic: Fix issue in the pm resume flow.
    - scsi: iscsi: Adjust iface sysfs attr detection
    - scsi: target: Fix the pgr/alua_support_store functions
    - [x86] tty: synclink_gt, drop unneeded forward declarations
    - [x86] tty: synclink_gt: rename a conflicting function name
    - nvme-tcp: fix incorrect h2cdata pdu offset accounting
    - treewide: Change list_sort to use const pointers
    - nvme: keep ctrl->namespaces ordered
    - thermal/core: Potential buffer overflow in
      thermal_build_list_of_policies()
    - cifs: fix a sign extension bug
    - scsi: qla2xxx: Restore initiator in dual mode
    - scsi: lpfc: Use correct scnprintf() limit
    - [arm64,armhf] irqchip/gic-v3-its: Fix potential VPE leak on error
    - md: fix a lock order reversal in md_alloc
    - [x86] asm: Add a missing __iomem annotation in enqcmds()
    - [x86] asm: Fix SETZ size enqcmds() build failure
    - io_uring: put provided buffer meta data under memcg accounting
    - blktrace: Fix uaf in blk_trace access after removing by sysfs
    - net: phylink: Update SFP selected interface on advertising changes
    - net: stmmac: allow CSR clock of 300MHz
    - blk-mq: avoid to iterate over stale request
    - ipv6: delay fib6_sernum increase in fib6_add
    - [x86] cpufreq: intel_pstate: Override parameters if HWP forced by BIOS
    - bpf: Add oversize check before call kvcalloc()
    - xen/balloon: use a kernel thread instead a workqueue
    - nvme-multipath: fix ANA state updates when a namespace is not present
    - nvme-rdma: destroy cm id before destroy qp to avoid use after free
    - amd/display: downgrade validation failure log level
    - block: check if a profile is actually registered in
      blk_integrity_unregister
    - block: flush the integrity workqueue in blk_integrity_unregister
    - blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd
    - qnx4: avoid stringop-overread errors
    - [arm64] Mark __stack_chk_guard as __ro_after_init
    - net: 6pack: Fix tx timeout and slot time
    - [x86] thermal/drivers/int340x: Do not set a wrong tcc offset on resume
    - USB: serial: cp210x: fix dropped characters with CP2102
    - xen/balloon: fix balloon kthread freezing

  [ Salvatore Bonaccorso ]
  * Refresh "MODSIGN: do not load mok when secure boot disabled"
  * Refresh "MODSIGN: load blacklist from MOKx"
  * [rt] Update to 5.10.47-rt46
    - sched: Fix migration_cpu_stop() requeueing
    - sched: Simplify migration_cpu_stop()
    - sched: Collate affine_move_task() stoppers
    - sched: Optimize migration_cpu_stop()
    - sched: Fix affine_move_task() self-concurrency
    - sched: Simplify set_affinity_pending refcounts
    - sched: Don't defer CPU pick to migration_cpu_stop()
  * Bump ABI to 9
  * Disalbe PSTORE_BLK (Marked broken upstream)
  * Refresh "fs: Add MODULE_SOFTDEP declarations for hard-coded crypto drivers"
  * [rt] Update to 5.10.52-rt47
  * [rt] Refresh "sched: Fix balance_callback()"
  * [rt] Drop "timers: Move clearing of base::timer_running under base::lock"
    (applied upstream)
  * [rt] Refresh "net/Qdisc: use a seqlock instead seqcount"
  * [rt] Refresh "net: xfrm: Use sequence counter with associated"
  * [rt] Update to 5.10.59-rt51
  * [rt] Update to 5.10.59-rt52
  * [rt] Update to 5.10.65-rt53
  * Refresh "Partially revert "net: socket: implement 64-bit timestamps""
  * [armhf] dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode
  * [mipsel] bpf, mips: Validate conditional branch offsets (CVE-2021-38300)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 30 Sep 2021 21:36:41 +0200

linux (5.10.46-5) bullseye-security; urgency=high

  * virtio_console: Assure used length from device is limited (CVE-2021-38160)
  * NFSv4: Initialise connection to the server in nfs4_alloc_client()
    (CVE-2021-38199)
  * tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
    (CVE-2021-3679)
  * [poewrpc*] KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow
    (CVE-2021-37576)
  * ovl: prevent private clone if bind mount is not allowed (CVE-2021-3732)
  * [x86] KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl
    (CVE-2021-3653)
  * [x86] KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656)
  * bpf: Fix integer overflow involving bucket_size (CVE-2021-38166)
  * ath: Use safer key clearing with key cache entries (CVE-2020-3702)
  * ath9k: Clear key cache explicitly on disabling hardware (CVE-2020-3702)
  * ath: Export ath_hw_keysetmac() (CVE-2020-3702)
  * ath: Modify ath_key_delete() to not need full key entry (CVE-2020-3702)
  * ath9k: Postpone key cache entry deletion for TXQ frames reference it
    (CVE-2020-3702)
  * btrfs: fix NULL pointer dereference when deleting device by invalid id
    (CVE-2021-3739)
  * net: qrtr: fix another OOB Read in qrtr_endpoint_post (CVE-2021-3743)
  * vt_kdsetmode: extend console locking (CVE-2021-3753)
  * ext4: fix race writing to an inline_data file while its xattrs are changing
    (CVE-2021-40490)
  * dccp: don't duplicate ccid when cloning dccp sock (CVE-2020-16119)
  * io_uring: ensure symmetry in handling iter types in loop_rw_iter()
    (CVE-2021-41073)
  * netfilter: nftables: avoid potential overflows on 32bit arches
  * netfilter: nf_tables: initialize set before expression setup
    (Closes: #993978)
  * netfilter: nftables: clone set element expression template
  * bnx2x: Fix enabling network interfaces without VFs (Closes: #993948)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 23 Sep 2021 22:35:21 +0200

linux (5.10.46-4) unstable; urgency=medium

  * bpf: Introduce BPF nospec instruction for mitigating Spectre v4
    (CVE-2021-34556, CVE-2021-35477)
  * bpf: Fix leakage due to insufficient speculative store bypass mitigation
    (CVE-2021-34556, CVE-2021-35477)
  * bpf: Remove superfluous aux sanitation on subprog rejection
  * Ignore ABI changes for bpf_offload_dev_create and bpf_verifier_log_write
  * bpf: Add kconfig knob for disabling unpriv bpf by default
  * init: Enable BPF_UNPRIV_DEFAULT_OFF (Closes: #990411)
  * linux-image: Add NEWS entry documenting that unprivileged calls to bpf() are
    disabled by default in Debian.
  * bpf: verifier: Allocate idmap scratch in verifier env
  * bpf: Fix pointer arithmetic mask tightening under state pruning

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 03 Aug 2021 07:50:50 +0200

linux (5.10.46-3) unstable; urgency=medium

  * [armhf] Add mdio-aspeed to nic-modules.
    Thanks to Joel Stanley <joel@jms.id.au> (Closes: #991262)
  * Revert "drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue."
    (Closes: #990312)
  * Revert "drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full
    doorbell." (Closes: #990312)
  * Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl
    (CVE-2021-3612)
  * sctp: validate from_addr_param return (CVE-2021-3655)
  * sctp: add size validation when walking chunks (CVE-2021-3655)
  * [s390x] sclp_vt220: fix console name to match device (Closes: #961056)
  * block: return the correct bvec when checking for gaps
  * sctp: fix return value check in __sctp_rcv_asconf_lookup

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 28 Jul 2021 07:55:40 +0200

linux (5.10.46-2) unstable; urgency=medium

  * swiotlb: manipulate orig_addr when tlb_addr has offset (Closes: #989778)
  * KVM: do not allow mapping valid but non-reference-counted pages
    (CVE-2021-22543)
  * [x86] platform/x86: toshiba_haps: Fix missing newline in pr_debug call in
    toshiba_haps_notify (Closes: #799193)
  * seq_file: Disallow extremely large seq buffer allocations (CVE-2021-33909)

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 20 Jul 2021 14:06:36 +0200

linux (5.10.46-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.41
    - context_tracking: Move guest exit context tracking to separate helpers
    - context_tracking: Move guest exit vtime accounting to separate helpers
    - [x86] KVM: Defer vtime accounting 'til after IRQ handling
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.42
    - ALSA: hda/realtek: the bass speaker can't output sound on Yoga 9i
    - ALSA: hda/realtek: Headphone volume is controlled by Front mixer
    - ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation P340
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
    - ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook G8
    - ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 15
      G8
    - ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 17
      G8
    - ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
    - ALSA: usb-audio: scarlett2: Improve driver startup messages
    - cifs: set server->cipher_type to AES-128-CCM for SMB3.0
    - NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()
    - iommu/vt-d: Fix sysfs leak in alloc_iommu()
    - proc: Check /proc/$pid/attr/ writes against file opener
    - net: hso: fix control-request directions
    - net/sched: fq_pie: re-factor fix for fq_pie endless loop
    - net/sched: fq_pie: fix OOB access in the traffic path
    - netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to
      non-AVX2 version
    - mac80211: assure all fragments are encrypted (CVE-2020-26147)
    - mac80211: prevent mixed key and fragment cache attacks (CVE-2020-24586,
      CVE-2020-24587)
    - mac80211: properly handle A-MSDUs that start with an RFC 1042 header
    - cfg80211: mitigate A-MSDU aggregation attacks (CVE-2020-24588)
    - mac80211: drop A-MSDUs on old ciphers (CVE-2020-24588)
    - mac80211: add fragment cache to sta_info
    - mac80211: check defrag PN against current frame
    - mac80211: prevent attacks on TKIP/WEP as well
    - mac80211: do not accept/forward invalid EAPOL frames (CVE-2020-26139)
    - mac80211: extend protection against mixed key and fragment cache attacks
      (CVE-2020-24586, CVE-2020-24587)
    - ath10k: add CCMP PN replay protection for fragmented frames for PCIe
    - ath10k: drop fragments with multicast DA for PCIe (CVE-2020-26145)
    - ath10k: drop fragments with multicast DA for SDIO (CVE-2020-26145)
    - ath10k: drop MPDU which has discard flag set by firmware for SDIO
      (CVE-2020-24588)
    - ath10k: Fix TKIP Michael MIC verification for PCIe (CVE-2020-26141)
    - ath10k: Validate first subframe of A-MSDU before processing the list
    - ath11k: Clear the fragment cache during key install (CVE-2020-24587)
    - dm snapshot: properly fix a crash when an origin has no snapshots
    - drm/amdgpu/vcn1: add cancel_delayed_work_sync before power gate
    - [amd64] drm/amdkfd: correct sienna_cichlid SDMA RLC register offset error
    - drm/amdgpu/vcn2.0: add cancel_delayed_work_sync before power gate
    - drm/amdgpu/vcn2.5: add cancel_delayed_work_sync before power gate
    - drm/amdgpu/jpeg2.0: add cancel_delayed_work_sync before power gate
    - Documentation: seccomp: Fix user notification documentation
    - seccomp: Refactor notification handler to prepare for new semantics
    - serial: core: fix suspicious security_locked_down() call
    - misc/uss720: fix memory leak in uss720_probe
    - [x86] thunderbolt: usb4: Fix NVM read buffer bounds and offset issue
    - [x86] thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
    - [x86] KVM: Fix vCPU preempted state from guest's point of view
    - [arm64] KVM: Prevent mixed-width VM creation
    - [x86] mei: request autosuspend after sending rx flow control
    - iio: gyro: fxas21002c: balance runtime power in error path
    - iio: dac: ad5770r: Put fwnode in error case during ->probe()
    - iio: adc: ad7768-1: Fix too small buffer passed to
      iio_push_to_buffers_with_timestamp()
    - iio: adc: ad7124: Fix missbalanced regulator enable / disable on error.
    - iio: adc: ad7124: Fix potential overflow due to non sequential channel
      numbers
    - iio: adc: ad7923: Fix undersized rx buffer.
    - iio: adc: ad7793: Add missing error code in ad7793_setup()
    - iio: adc: ad7192: Avoid disabling a clock that was never enabled.
    - iio: adc: ad7192: handle regulator voltage error first
    - serial: 8250: Add UART_BUG_TXRACE workaround for Aspeed VUART
    - serial: 8250_dw: Add device HID for new AMD UART controller
    - serial: 8250_pci: Add support for new HPE serial device
    - serial: 8250_pci: handle FL_NOIRQ board flag
    - USB: trancevibrator: fix control-request direction
    - Revert "irqbypass: do not start cons/prod when failed connect"
    - USB: usbfs: Don't WARN about excessively large memory allocations
    - drivers: base: Fix device link removal
    - [arm64,armhf] serial: tegra: Fix a mask operation that is always true
    - serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
    - USB: serial: ti_usb_3410_5052: add startech.com device id
    - USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011
    - USB: serial: ftdi_sio: add IDs for IDS GmbH Products
    - USB: serial: pl2303: add device id for ADLINK ND-6530 GC
    - [x86] thermal/drivers/intel: Initialize RW trip to THERMAL_TEMP_INVALID
    - [arm64,armhf] usb: dwc3: gadget: Properly track pending and queued SG
    - [arm64,x86] usb: typec: mux: Fix matching with typec_altmode_desc
    - net: usb: fix memory leak in smsc75xx_bind
    - Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
    - fs/nfs: Use fatal_signal_pending instead of signal_pending
    - NFS: fix an incorrect limit in filelayout_decode_layout()
    - NFS: Fix an Oopsable condition in __nfs_pageio_add_request()
    - NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()
    - NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config
    - [arm64] drm/meson: fix shutdown crash when component not probed
    - net/mlx5e: reset XPS on error flow if netdev isn't registered yet
    - net/mlx5e: Fix multipath lag activation
    - net/mlx5e: Fix error path of updating netdev queues
    - {net,vdpa}/mlx5: Configure interface MAC into mpfs L2 table
    - net/mlx5e: Fix nullptr in add_vlan_push_action()
    - net/mlx5: Set reformat action when needed for termination rules
    - net/mlx5e: Fix null deref accessing lag dev
    - net/mlx4: Fix EEPROM dump support
    - net/mlx5: Set term table as an unmanaged flow table
    - SUNRPC in case of backlog, hand free slots directly to waiting task
    - Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv"
    - tipc: wait and exit until all work queues are done
    - tipc: skb_linearize the head skb when reassembling msgs
    - [arm64] spi: spi-fsl-dspi: Fix a resource leak in an error handling path
    - netfilter: flowtable: Remove redundant hw refresh bit
    - [arm64,armhf] net: dsa: fix a crash if ->get_sset_count() fails
    - [armhf] i2c: s3c2410: fix possible NULL pointer deref on read message
      after write
    - [x86] i2c: i801: Don't generate an interrupt on bus reset
    - afs: Fix the nlink handling of dir-over-dir rename
    - nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response
    - [x86] platform/x86: hp_accel: Avoid invoking _INI to speed up resume
    - [arm64] Revert "crypto: cavium/nitrox - add an error message to explain
      the failure of pci_request_mem_regions"
    - Revert "media: usb: gspca: add a missed check for goto_low_power"
    - [i386] Revert "ALSA: sb: fix a missing check of snd_ctl_add"
    - Revert "net: fujitsu: fix a potential NULL pointer dereference"
    - net: fujitsu: fix potential null-ptr-deref
    - Revert "net/smc: fix a NULL pointer dereference"
    - net/smc: properly handle workqueue allocation failure
    - [x86] Revert "char: hpet: fix a missing check of ioremap"
    - [x86] char: hpet: add checks after calling ioremap
    - [i386] Revert "ALSA: gus: add a check of the status of snd_ctl_add"
    - Revert "isdn: mISDNinfineon: fix potential NULL pointer dereference"
    - isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io
    - Revert "ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd()"
    - ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd()
    - Revert "isdn: mISDN: Fix potential NULL pointer dereference of kzalloc"
    - isdn: mISDN: correctly handle ph_info allocation failure in
      hfcsusb_ph_info
    - [arm64] Revert "dmaengine: qcom_hidma: Check for driver register failure"
    - [arm64] dmaengine: qcom_hidma: comment platform_driver_register call
    - Revert "libertas: add checks for the return value of sysfs_create_group"
    - libertas: register sysfs groups properly
    - Revert "media: dvb: Add check on sp8870_readreg"
    - media: dvb: Add check on sp8870_readreg return
    - Revert "media: gspca: mt9m111: Check write_bridge for timeout"
    - media: gspca: mt9m111: Check write_bridge for timeout
    - Revert "media: gspca: Check the return value of write_bridge for timeout"
    - media: gspca: properly check for errors in po1030_probe()
    - Revert "net: liquidio: fix a NULL pointer dereference"
    - net: liquidio: Add missing null pointer checks
    - Revert "brcmfmac: add a check for the status of usb_register"
    - brcmfmac: properly check for bus register errors
    - btrfs: return whole extents in fiemap
    - [powerpc,x86] scsi: BusLogic: Fix 64-bit system enumeration error for
      Buslogic
    - scsi: pm80xx: Fix drives missing during rmmod/insmod loop
    - btrfs: release path before starting transaction when cloning inline extent
    - btrfs: do not BUG_ON in link_to_fixup_dir
    - [x86] platform/x86: hp-wireless: add AMD's hardware id to the supported
      list
    - SMB3: incorrect file id in requests compounded with open
    - drm/amd/amdgpu: fix refcount leak
    - drm/amdgpu: Fix a use-after-free
    - drm/amd/amdgpu: fix a potential deadlock in gpu reset
    - drm/amdgpu: stop touching sched.ready in the backend
    - block: fix a race between del_gendisk and BLKRRPART
    - linux/bits.h: fix compilation error with GENMASK
    - [arm64,armhf] net: dsa: fix error code getting shifted with 4 in
      dsa_slave_get_sset_count
    - net: stmmac: Fix MAC WoL not working if PHY does not support WoL
    - spi: Assume GPIO CS active high in ACPI case
    - net: really orphan skbs tied to closing sk
    - net: packetmmap: fix only tx timestamp on request
    - [arm64,armhf] net: fec: fix the potential memory leak in fec_enet_init()
    - [arm64] net: mdio: thunder: Fix a double free issue in the .remove
      function
    - [mips64el,mipsel] net: mdio: octeon: Fix some double free issues
    - cxgb4/ch_ktls: Clear resources when pf4 device is removed
    - openvswitch: meter: fix race when getting now_ms.
    - net: sched: fix packet stuck problem for lockless qdisc
    - net: sched: fix tx action rescheduling issue during deactivation
    - net: sched: fix tx action reschedule issue with stopped queue
    - net: hso: check for allocation failure in hso_create_bulk_serial_device()
    - net: bnx2: Fix error return code in bnx2_init_board()
    - bnxt_en: Include new P5 HV definition in VF check.
    - bnxt_en: Fix context memory setup for 64K page size.
    - mld: fix panic in mld_newpack()
    - net/smc: remove device from smcd_dev_list after failed device_add()
    - [amd64] gve: Check TX QPL was actually assigned
    - [amd64] gve: Update mgmt_msix_idx if num_ntfy changes
    - [amd64] gve: Add NULL pointer checks when freeing irqs.
    - [amd64] gve: Upgrade memory barrier in poll routine
    - [amd64] gve: Correct SKB queue index validation.
    - [arm64] net: hns3: fix incorrect resp_msg issue
    - [arm64] net: hns3: put off calling register_netdev() until client
      initialize complete
    - [amd64] iommu/vt-d: Use user privilege for RID2PASID translation
    - cxgb4: avoid accessing registers when clearing filters
    - bpf, offload: Reorder offload callback 'prepare' in verifier
    - bpf: Set mac_len in bpf_skb_change_head
    - ixgbe: fix large MTU request from VF
    - [arm64] ASoC: qcom: lpass-cpu: Use optional clk APIs
    - scsi: libsas: Use _safe() loop in sas_resume_port()
    - ipv6: record frag_max_size in atomic fragments in input path
    - ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create() can be
      static
    - sch_dsmark: fix a NULL deref in qdisc_reset()
    - net: zero-initialize tc skb extension on allocation
    - [arm64,armhf] net: mvpp2: add buffer header handling in RX
    - [x86] i915: fix build warning in intel_dp_get_link_status()
    - [arm64] net: hns3: check the return of skb_checksum_help()
    - bpftool: Add sock_release help info for cgroup attach/prog load command
    - SUNRPC: More fixes for backlog congestion
    - net: hso: bail out on interrupt URB allocation failure
    - neighbour: Prevent Race condition in neighbour subsytem
    - usb: core: reduce power-on-good delay time of root hub
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.43
    - btrfs: tree-checker: do not error out if extent ref hash doesn't match
    - net: usb: cdc_ncm: don't spew notifications (Closes: #989451)
    - [x86] hwmon: (dell-smm-hwmon) Fix index values
    - netfilter: conntrack: unregister ipv4 sockopts on error unwind
    - efi/fdt: fix panic when no valid fdt found
    - efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared
    - efi/libstub: prevent read overflow in find_file_option()
    - [arm64,x86] efi: cper: fix snprintf() use in cper_dimm_err_location()
    - vfio/pci: Fix error return code in vfio_ecap_init()
    - ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service
    - HID: logitech-hidpp: initialize level variable
    - HID: pidff: fix error return code in hid_pidff_init()
    - [arm64,x86] HID: i2c-hid: fix format string mismatch
    - devlink: Correct VIRTUAL port to not have phys_port attributes
    - net/sched: act_ct: Offload connections with commit action
    - net/sched: act_ct: Fix ct template allocation for zone 0
    - nvme-rdma: fix in-casule data send for chained sgls
    - ACPICA: Clean up context mutex during object deletion
    - perf probe: Fix NULL pointer dereference in convert_variable_location()
    - net: sock: fix in-kernel mark setting
    - net/mlx5e: Fix incompatible casting
    - net/mlx5: Check firmware sync reset requested is set before trying to
      abort it
    - net/mlx5e: Check for needed capability for cvlan matching
    - net/mlx5: DR, Create multi-destination flow table with level less than 64
    - nvmet: fix freeing unallocated p2pmem
    - netfilter: nft_ct: skip expectations for confirmed conntrack
    - netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches
    - bpf: Simplify cases in bpf_base_func_proto
    - bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks
    - ieee802154: fix error return code in ieee802154_add_iface()
    - ieee802154: fix error return code in ieee802154_llsec_getparams()
    - igb: add correct exception tracing for XDP
    - ixgbevf: add correct exception tracing for XDP
    - cxgb4: fix regression with HASH tc prio value update
    - ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions
    - ice: Fix allowing VF to request more/less queues via virtchnl
    - ice: Fix VFR issues for AVF drivers that expect ATQLEN cleared
    - ice: handle the VF VSI rebuild failure
    - ice: report supported and advertised autoneg using PHY capabilities
    - ice: Allow all LLDP packets from PF to Tx
    - cxgb4: avoid link re-train during TC-MQPRIO configuration
    - i40e: optimize for XDP_REDIRECT in xsk path
    - i40e: add correct exception tracing for XDP
    - ice: simplify ice_run_xdp
    - ice: optimize for XDP_REDIRECT in xsk path
    - ice: add correct exception tracing for XDP
    - ixgbe: optimize for XDP_REDIRECT in xsk path
    - ixgbe: add correct exception tracing for XDP
    - [arm64] optee: use export_uuid() to copy client UUID
    - [armhf] bus: ti-sysc: Fix am335x resume hang for usb otg module
    - [arm64] dts: freescale: sl28: var4: fix RGMII clock and voltage
    - [armhf] bus: ti-sysc: Fix flakey idling of uarts and stop using
      swsup_sidle_act
    - tipc: add extack messages for bearer/media failure
    - tipc: fix unique bearer names sanity check
    - [armhf] serial: stm32: fix threaded interrupt handling
    - io_uring: fix link timeout refs
    - io_uring: use better types for cflags
    - drm/amdgpu/vcn3: add cancel_delayed_work_sync before power gate
    - drm/amdgpu/jpeg2.5: add cancel_delayed_work_sync before power gate
    - drm/amdgpu/jpeg3: add cancel_delayed_work_sync before power gate
    - Bluetooth: fix the erroneous flush_work() order (CVE-2021-3564)
    - Bluetooth: use correct lock to prevent UAF of hdev object (CVE-2021-3573)
    - wireguard: do not use -O3
    - wireguard: peer: allocate in kmem_cache
    - wireguard: use synchronize_net rather than synchronize_rcu
    - wireguard: allowedips: initialize list head in selftest
    - wireguard: allowedips: remove nodes in O(1)
    - wireguard: allowedips: allocate nodes in kmem_cache
    - wireguard: allowedips: free empty intermediate nodes when removing single
      node
    - [arm64,x86] HID: i2c-hid: Skip ELAN power-on command after reset
    - HID: magicmouse: fix NULL-deref on disconnect
    - HID: multitouch: require Finger field to mark Win8 reports as MT
    - gfs2: fix scheduling while atomic bug in glocks
    - ALSA: timer: Fix master timer notification
    - ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx
    - ALSA: hda: update the power_state during the direct-complete
    - ext4: fix memory leak in ext4_fill_super
    - ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed
    - ext4: fix fast commit alignment issues
    - ext4: fix memory leak in ext4_mb_init_backend on error path.
    - ext4: fix accessing uninit percpu counter variable with fast_commit
    - [arm*] usb: dwc2: Fix build in periphal-only mode
    - pid: take a reference when initializing `cad_pid`
    - ocfs2: fix data corruption by fallocate
    - mm/page_alloc: fix counting of free pages after take off from buddy
    - [x86] cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
      update_pasid()
    - nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect
      (CVE-2021-3587)
    - drm/amdgpu: Don't query CE and UE errors
    - drm/amdgpu: make sure we unpin the UVD BO
    - [x86] apic: Mark _all_ legacy interrupts when IO/APIC is missing
    - [powerpc] kprobes: Fix validation of prefixed instructions across page
      boundary
    - btrfs: mark ordered extent and inode with error if we fail to finish
    - btrfs: fix error handling in btrfs_del_csums
    - btrfs: return errors from btrfs_del_csums in cleanup_ref_head
    - btrfs: fixup error handling in fixup_inode_link_counts
    - btrfs: abort in rename_exchange if we fail to insert the second ref
    - btrfs: fix deadlock when cloning inline extents and low on available space
    - mm, hugetlb: fix simple resv_huge_pages underflow on UFFDIO_COPY
    - [arm64] drm/msm/dpu: always use mdp device to scale bandwidth
    - btrfs: fix unmountable seed device after fstrim
    - [x86] KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode
    - [arm64] KVM: Fix debug register indexing
    - [x86] kvm: Teardown PV features on boot CPU as well
    - [x86] kvm: Disable kvmclock on all CPUs on shutdown
    - [x86] kvm: Disable all PV features on crash
    - lib/lz4: explicitly support in-place decompression
    - netfilter: nf_tables: missing error reporting for not selected expressions
    - xen-netback: take a reference to the RX task thread (CVE-2021-28691)
    - neighbour: allow NUD_NOARP entries to be forced GCed
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.44
    - proc: Track /proc/$pid/attr/ opener mm_struct
    - [amd64] ASoC: amd: fix for pcm_read() error
    - spi: Fix spi device unregister flow
    - bpf: Forbid trampoline attach for functions with variable arguments
    - net/nfc/rawsock.c: fix a permission check bug
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L
      tablet
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830
      tablet
    - [arm64,armhf] usb: chipidea: udc: assign interrupt number to USB gadget
      structure
    - bonding: init notify_work earlier to avoid uninitialized use
    - netlink: disable IRQs for netlink_lock_table()
    - net: mdiobus: get rid of a BUG_ON()
    - cgroup: disable controllers at parse time
    - wq: handle VM suspension in stall detection
    - net/qla3xxx: fix schedule while atomic in ql_sem_spinlock
    - RDS tcp loopback connection can hang
    - net:sfc: fix non-freed irq in legacy irq mode
    - scsi: bnx2fc: Return failure if io_req is already in ABTS processing
    - [x86] scsi: vmw_pvscsi: Set correct residual data length
    - [arm64] scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated
      irq
    - scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal
    - net: macb: ensure the device is available before accessing GEMGXL control
      registers
    - nvme-fabrics: decode host pathing error for connect
    - dm verity: fix require_signatures module_param permissions
    - bnx2x: Fix missing error code in bnx2x_iov_init_one()
    - nvmet: fix false keep-alive timeout when a controller is torn down
    - spi: Don't have controller clean up spi device before driver unbind
    - spi: Cleanup on failure of initial setup
    - [powerpc] i2c: mpc: Make use of i2c_recover_bus()
    - [powerpc] i2c: mpc: implement erratum A-004447 workaround
    - ALSA: seq: Fix race of snd_seq_timer_open()
    - ALSA: firewire-lib: fix the context to call snd_pcm_stop_xrun()
    - ALSA: hda/realtek: headphone and mic don't work on an Acer laptop
    - ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite
      Dragonfly G2
    - ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360
      1040 G8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
    - [arm*] spi: bcm2835: Fix out-of-bounds access with more than 4 slaves
    - Revert "ACPI: sleep: Put the FACS table after using it"
    - drm: Fix use-after-free read in drm_getunique()
    - drm: Lock pointer access in drm_master_release()
    - [x86] perf/x86/intel/uncore: Fix M2M event umask for Ice Lake server
    - [x86] KVM: X86: MMU: Use the correct inherited permissions to get shadow
      page
    - kvm: avoid speculation-based attacks from out-of-range memslot accesses
    - [arm64,x86] staging: rtl8723bs: Fix uninitialized variables
    - async_xor: check src_offs is not NULL before updating it
    - btrfs: return value from btrfs_mark_extent_written() in case of error
    - btrfs: promote debugging asserts to full-fledged checks in validate_super
    - cgroup1: don't allow '\n' in renaming
    - ftrace: Do not blindly read the ip address in ftrace_bug()
    - USB: f_ncm: ncm_bitrate (speed) is unsigned
    - usb: f_ncm: only first packet of aggregate needs to start timer
    - usb: pd: Set PD_T_SINK_WAIT_CAP to 310ms
    - [arm64,armhf] usb: dwc3-meson-g12a: fix usb2 PHY glue init when phy0 is
      disabled
    - [arm64,armhf] usb: dwc3: meson-g12a: Disable the regulator in the error
      handling path of the probe
    - [arm64,armhf] usb: dwc3: gadget: Bail from dwc3_gadget_exit() if
      dwc->gadget is NULL
    - [arm64,armhf] usb: dwc3: ep0: fix NULL pointer exception
    - [arm64,armhf] usb: musb: fix MUSB_QUIRK_B_DISCONNECT_99 handling
    - usb: typec: ucsi: Clear PPM capability data in ucsi_init() error path
    - usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind
    - USB: serial: ftdi_sio: add NovaTech OrionMX product ID
    - USB: serial: omninet: add device id for Zyxel Omni 56K Plus
    - USB: serial: quatech2: fix control-request directions
    - USB: serial: cp210x: fix alternate function for CP2102N QFN20
    - usb: gadget: eem: fix wrong eem header operation
    - usb: fix various gadgets null ptr deref on 10gbps cabling.
    - usb: fix various gadget panics on 10gbps cabling
    - usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister
      tcpm port
    - usb: typec: tcpm: cancel frs hrtimer when unregister tcpm port
    - regulator: core: resolve supply for boot-on/always-on regulators
    - [arm64] regulator: max77620: Use device_set_of_node_from_dev()
    - regulator: bd71828: Fix .n_voltages settings
    - [arm64,armhf] usb: dwc3: gadget: Disable gadget IRQ during pullup disable
    - usb: typec: mux: Fix copy-paste mistake in typec_mux_match
    - [arm64] drm/msm/a6xx: fix incorrectly set uavflagprd_inv field for A650
    - [arm64] drm/msm/a6xx: update/fix CP_PROTECT initialization
    - [arm64] drm/msm/a6xx: avoid shadow NULL reference in failure path
    - RDMA/ipoib: Fix warning caused by destroying non-initial netns
    - RDMA/mlx4: Do not map the core_clock page to user space unless enabled
    - ASoC: core: Fix Null-point-dereference in fmt_single_name()
    - perf: Fix data race between pin_count increment/decrement
    - sched/fair: Keep load_avg and load_sum synced
    - sched/fair: Make sure to update tg contrib for blocked load
    - sched/fair: Fix util_est UTIL_AVG_UNCHANGED handling
    - [x86] nmi_watchdog: Fix old-style NMI watchdog regression on old Intel
      CPUs
    - [x86] KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint
      message
    - IB/mlx5: Fix initializing CQ fragments buffer
    - NFS: Fix a potential NULL dereference in nfs_get_client()
    - NFSv4: Fix deadlock between nfs4_evict_inode() and
      nfs4_opendata_get_inode()
    - kvm: fix previous commit for 32-bit builds
    - NFS: Fix use-after-free in nfs4_init_client()
    - NFSv4: Fix second deadlock in nfs4_evict_inode()
    - NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error.
    - scsi: core: Fix error handling of scsi_host_alloc()
    - scsi: core: Fix failure handling of scsi_add_host_with_dma()
    - scsi: core: Put .shost_dev in failure path if host state changes to
      RUNNING
    - scsi: core: Only put parent device if host state differs from
      SHOST_CREATED
    - tracing: Correct the length check which causes memory corruption
    - proc: only require mm_struct for writing
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.45
    - net: ieee802154: fix null deref in parse dev addr
    - HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for Saitek X65
    - HID: a4tech: use A4_2WHEEL_MOUSE_HACK_B8 for A4TECH NB-95
    - HID: hid-input: add mapping for emoji picker key
    - HID: hid-sensor-hub: Return error for hid_set_field() failure
    - HID: quirks: Add quirk for Lenovo optical mouse
    - HID: multitouch: set Stylus suffix for Stylus-application devices, too
    - HID: Add BUS_VIRTUAL to hid_connect logging
    - HID: usbhid: fix info leak in hid_submit_ctrl
    - [arm64,armhf] drm/tegra: sor: Do not leak runtime PM reference
    - [arm64,armhf] gpu: host1x: Split up client initalization and registration
    - [arm64,armhf] drm/tegra: sor: Fully initialize SOR before registration
    - gfs2: Prevent direct-I/O write fallback errors from getting lost
    - gfs2: fix a deadlock on withdraw-during-mount
    - HID: gt683r: add missing MODULE_DEVICE_TABLE
    - gfs2: Fix use-after-free in gfs2_glock_shrink_scan
    - scsi: target: core: Fix warning on realtime kernels
    - ethernet: myri10ge: Fix missing error code in myri10ge_probe()
    - scsi: qedf: Do not put host in qedf_vport_create() unconditionally
    - Bluetooth: Add a new USB ID for RTL8822CE
    - scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V
    - net: ipconfig: Don't override command-line hostnames or domains
    - drm/amd/display: Allow bandwidth validation for 0 streams.
    - drm/amdgpu: refine amdgpu_fru_get_product_info
    - drm/amd/display: Fix potential memory leak in DMUB hw_init
    - drm/amd/amdgpu:save psp ring wptr to avoid attack
    - rtnetlink: Fix missing error code in rtnl_bridge_notify()
    - net: Return the correct errno code
    - fib: Return the correct errno code
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.46
    - afs: Fix an IS_ERR() vs NULL check
    - mm/memory-failure: make sure wait for page writeback in memory_failure
    - [x86] kvm: LAPIC: Restore guard to prevent illegal APIC register access
    - fanotify: fix copy_event_to_user() fid error clean up
    - batman-adv: Avoid WARN_ON timing related checks
    - mac80211: fix skb length check in ieee80211_scan_rx()
    - net: ipv4: fix memory leak in netlbl_cipsov4_add_std
    - vrf: fix maximum MTU
    - net: rds: fix memory leak in rds_recvmsg
    - [arm64] net: dsa: felix: re-enable TX flow control in ocelot_port_flush()
    - netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local
    - ice: add ndo_bpf callback for safe mode netdev ops
    - ice: parameterize functions responsible for Tx ring management
    - udp: fix race between close() and udp_abort()
    - rtnetlink: Fix regression in bridge VLAN configuration
    - net/sched: act_ct: handle DNAT tuple collision
    - net/mlx5e: Fix page reclaim for dead peer hairpin
    - net/mlx5: Consider RoCE cap before init RDMA resources
    - net/mlx5: DR, Allow SW steering for sw_owner_v2 devices
    - net/mlx5: DR, Don't use SW steering when RoCE is not supported
    - net/mlx5e: Block offload of outer header csum for UDP tunnels
    - netfilter: synproxy: Fix out of bounds when parsing TCP options
    - sch_cake: Fix out of bounds when parsing TCP options and header
    - alx: Fix an error handling path in 'alx_probe()'
    - cxgb4: fix endianness when flashing boot image
    - cxgb4: fix sleep in atomic when flashing PHY firmware
    - cxgb4: halt chip before flashing PHY firmware image
    - net: make get_net_ns return error if NET_NS is disabled
    - ethtool: strset: fix message length calculation
    - qlcnic: Fix an error handling path in 'qlcnic_probe()'
    - netxen_nic: Fix an error handling path in 'netxen_nic_probe()'
    - cxgb4: fix wrong ethtool n-tuple rule lookup
    - ipv4: Fix device used for dst_alloc with local routes
    - net: qrtr: fix OOB Read in qrtr_endpoint_post
    - bpf: Fix leakage under speculation on mispredicted branches
      (CVE-2021-33624)
    - ptp: improve max_adj check against unreasonable values
    - net: cdc_ncm: switch to eth%d interface naming
    - net: usb: fix possible use-after-free in smsc75xx_bind
    - [arm64,armhf] net: fec_ptp: fix issue caused by refactor the fec_devtype
    - net: ipv4: fix memory leak in ip_mc_add1_src
    - net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
    - net/mlx5: E-Switch, Read PF mac address
    - net/mlx5: E-Switch, Allow setting GUID for host PF vport
    - net/mlx5: Reset mkey index on creation
    - be2net: Fix an error handling path in 'be_probe()'
    - net: hamradio: fix memory leak in mkiss_close
    - net: cdc_eem: fix tx fixup skb leak
    - cxgb4: fix wrong shift.
    - bnxt_en: Rediscover PHY capabilities after firmware reset
    - bnxt_en: Fix TQM fastpath ring backing store computation
    - bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path
    - icmp: don't send out ICMP messages with a source address of 0.0.0.0
    - [x86] platform/x86: thinkpad_acpi: Add X1 Carbon Gen 9 second fan support
    - sched/pelt: Ensure that *_sum is always synced with *_avg
    - [armhf] spi: stm32-qspi: Always wait BUSY bit to be cleared in
      stm32_qspi_wait_cmd()
    - ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire
      mode
    - [arm64,armhf] drm/sun4i: dw-hdmi: Make HDMI PHY into a platform device
    - [arm64] ASoC: qcom: lpass-cpu: Fix pop noise during audio capture begin
    - radeon: use memcpy_to/fromio for UVD fw upload
    - mm: relocate 'write_protect_seq' in struct mm_struct
    - [arm64,armhf] irqchip/gic-v3: Workaround inconsistent PMR setting on NMI
      entry
    - bpf: Inherit expanded/patched seen count from old aux data
      (CVE-2021-33624)
    - bpf: Do not mark insn as seen under speculative path verification
      (CVE-2021-33624)
    - can: bcm: fix infoleak in struct bcm_msg_head (CVE-2021-34693)
    - can: bcm/raw/isotp: use per module netdevice notifier
    - can: j1939: fix Use-after-Free, hold skb ref while in use
    - can: mcba_usb: fix memory leak in mcba_usb
    - usb: core: hub: Disable autosuspend for Cypress CY7C65632
    - [arm64,armhf] usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
    - tracing: Do not stop recording cmdlines when tracing is off
    - tracing: Do not stop recording comms if the trace file is being read
    - tracing: Do no increment trace_clock_global() by one
    - PCI: Mark TI C667X to avoid bus reset
    - PCI: Mark some NVIDIA GPUs to avoid bus reset
    - [arm64] PCI: aardvark: Fix kernel panic during PIO transfer
    - PCI: Add ACS quirk for Broadcom BCM57414 NIC
    - PCI: Work around Huawei Intelligent NIC VF FLR erratum
    - [x86] KVM: x86: Immediately reset the MMU context when the SMM flag is
      cleared
    - [x86] KVM: x86/mmu: Calculate and check "full" mmu_role for nested MMU
    - [x86] KVM: X86: Fix x86_emulator slab cache leak
    - [s390x] mcck: fix calculation of SIE critical section size
    - [s390x] ap: Fix hanging ioctl caused by wrong msg counter
    - [amd64] x86/mm: Avoid truncating memblocks for SGX memory
    - [x86] process: Check PF_KTHREAD and not current->mm for kernel threads
    - [x86] ioremap: Map EFI-reserved memory as encrypted for SEV
    - [x86] pkru: Write hardware init value to PKRU when xstate is init
    - [x86] fpu: Prevent state corruption in __fpu__restore_sig()
    - [x86] fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
    - [x86] fpu: Reset state for all signal restore failures
    - crash_core, vmcoreinfo: append 'SECTION_SIZE_BITS' to vmcoreinfo
    - [arm64,armhf] dmaengine: pl330: fix wrong usage of spinlock flags in
      dma_cyclc
    - mac80211: Fix NULL ptr deref for injected rate info
    - cfg80211: avoid double free of PMSR request
    - drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full
      doorbell.
    - drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue.
    - net: ll_temac: Fix TX BD buffer overwrite
    - net: bridge: fix vlan tunnel dst null pointer dereference
    - net: bridge: fix vlan tunnel dst refcnt when egressing
    - mm/swap: fix pte_same_as_swp() not removing uffd-wp bit when compare
    - mm/slub: clarify verification reporting
    - mm/slub: fix redzoning for small allocations
    - mm/slub: actually fix freelist pointer vs redzoning
    - mm/slub.c: include swab.h
    - net: stmmac: disable clocks in stmmac_remove_config_dt()
    - [arm64,armhf] net: fec_ptp: add clock rate zero check
    - [arm64,armhf] usb: dwc3: debugfs: Add and remove endpoint dirs dynamically
    - [arm64,armhf] usb: dwc3: core: fix kernel panic when do reboot

  [ Josua Mayer ]
  * [armhf] drivers/bluetooth: Enable BT_HCIUART as a module, with support
    for all features already enabled in the generic config. (Closes: #987361)
  * [armhf] enable i.MX6 MIPI-CSI video capture device. (Closes: #987365)
    - drivers/mux: Enable MUX_MMIO as a module.
    - drivers/media/platform: Enable VIDEO_MUX as a module.
    - drivers/staging/media/imx: Enable VIDEO_IMX_MEDIA and VIDEO_IMX_CSI as
      modules.

  [ Uwe Kleine-König ]
  * [arm64] Update device tree for Kobol's helios64 from next

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "net/Qdisc: use a seqlock instead seqcount"
  * Ignore some ABI changes that should not affect OOT modules
  * Bump ABI to 8
  * [rt] Refresh "tracing: Merge irqflags + preempt counter"
  * can: bcm: delay release of struct bcm_op after synchronize_rcu()
    (CVE-2021-3609)
  * Revert "PCI: PM: Do not read power state in pci_enable_device_flags()"
    (Closes: #990008)

  [ Vagrant Cascadian ]
  * [arm64] Add pwm-rockchip to fb-modules udeb.
  * [arm64] Add fusb302, tcpm and typec to usb-modules udeb.
  * [armhf] Add gpio-mxc to kernel-image udeb. Thanks to Rick Thomas.
    (Closes: #982270)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 24 Jun 2021 14:11:37 +0200

linux (5.10.40-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.39
    - [x86] msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes
    - [x86] drm/i915/display: fix compiler warning about array overrun
    - airo: work around stack usage warning
    - usb: sl811-hcd: improve misleading indentation
    - cxgb4: Fix the -Wmisleading-indentation warning
    - isdn: capi: fix mismatched prototypes
    - virtio_net: Do not pull payload in skb->head
    - [armel,armhf] 9066/1: ftrace: pause/unpause function graph tracer in
      cpu_suspend()
    - [arm64,x86] ACPI / hotplug / PCI: Fix reference count leak in
      enable_slot()
    - [arm64] Input: elants_i2c - do not bind to i2c-hid compatible ACPI
      instantiated devices
    - NFS: NFS_INO_REVAL_PAGECACHE should mark the change attribute invalid
    - [armel,armhf] 9075/1: kernel: Fix interrupted SMC calls
    - [arm64] platform/chrome: cros_ec_typec: Add DP mode check
    - scsi: lpfc: Fix illegal memory access on Abort IOCBs
    - ceph: fix fscache invalidation
    - ceph: don't clobber i_snap_caps on non-I_NEW inode
    - ceph: don't allow access to MDS-private inodes
    - scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not
      found
    - bridge: Fix possible races between assigning rx_handler_data and setting
      IFF_BRIDGE_PORT bit
    - nvmet: remove unsupported command noise
    - drm/amd/display: Fix two cursor duplication when using overlay
    - [arm64,x86] gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10
      Pro 5055
    - net:CXGB4: fix leak if sk_buff is not used
    - ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP
    - block: reexpand iov_iter after read/write
    - net: stmmac: Do not enable RX FIFO overflow interrupts
    - ip6_gre: proper dev_{hold|put} in ndo_[un]init methods
    - sit: proper dev_{hold|put} in ndo_[un]init methods
    - ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods
    - ipv6: remove extra dev_hold() for fallback tunnels
    - tweewide: Fix most Shebang lines
    - scripts: switch explicitly to Python 3
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.40
    - RDMA/core: Prevent divide-by-zero error triggered by the user
    - RDMA/rxe: Clear all QP fields if creation failed
    - scsi: ufs: core: Increase the usable queue depth
    - scsi: qedf: Add pointer checks in qedf_update_link_speed()
    - scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword()
    - RDMA/mlx5: Recover from fatal event in dual port mode
    - RDMA/core: Don't access cm_id after its destruction
    - nvmet: remove unused ctrl->cqs
    - nvmet: fix memory leak in nvmet_alloc_ctrl()
    - nvme-tcp: rerun io_work if req_list is not empty
    - nvme-fc: clear q_live at beginning of association teardown
    - [x86] platform/x86: intel_int0002_vgpio: Only call enable_irq_wake() when
      using s2idle
    - [x86] platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios
    - RDMA/mlx5: Fix query DCT via DEVX
    - RDMA/uverbs: Fix a NULL vs IS_ERR() bug
    - [powerpc*] pseries: Fix hcall tracing recursion in pv queued spinlocks
    - ptrace: make ptrace() fail if the tracee changed its pid unexpectedly
    - nvmet: seset ns->file when open fails
    - [x86] perf/x86: Avoid touching LBR_TOS MSR for Arch LBR
    - locking/lockdep: Correct calling tracepoints
    - locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to signal
    - [powerpc*] Fix early setup to make early_ioremap() work
    - btrfs: avoid RCU stalls while running delayed iputs
    - cifs: fix memory leak in smb2_copychunk_range
    - misc: eeprom: at24: check suspend status before disable regulator
    - ALSA: dice: fix stream format for TC Electronic Konnekt Live at high
      sampling transfer frequency
    - ALSA: intel8x0: Don't update period unless prepared
    - ALSA: firewire-lib: fix amdtp_packet tracepoints event for packet_index
      field
    - ALSA: line6: Fix racy initialization of LINE6 MIDI
    - ALSA: dice: fix stream format at middle sampling rate for Alesis iO 26
    - ALSA: firewire-lib: fix calculation for size of IR context payload
    - ALSA: usb-audio: Validate MS endpoint descriptors
    - ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro
    - ALSA: hda: fixup headset for ASUS GU502 laptop
    - Revert "ALSA: sb8: add a check for request_region"
    - ALSA: firewire-lib: fix check for the size of isochronous packet payload
    - ALSA: hda/realtek: reset eapd coeff to default value for alc287
    - ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293
    - ALSA: hda/realtek: Fix silent headphone output on ASUS UX430UA
    - ALSA: hda/realtek: Add fixup for HP OMEN laptop
    - ALSA: hda/realtek: Add fixup for HP Spectre x360 15-df0xxx
    - [x86] uio_hv_generic: Fix a memory leak in error handling paths
    - [arm64] Revert "serial: mvebu-uart: Fix to avoid a potential NULL pointer
      dereference"
    - nvme-tcp: fix possible use-after-completion
    - drm/amdgpu: Fix GPU TLB update error when PAGE_SIZE > AMDGPU_PAGE_SIZE
    - drm/amdgpu: disable 3DCGCG on picasso/raven1 to avoid compute hang
    - drm/amdgpu: update gc golden setting for Navi12
    - drm/amdgpu: update sdma golden setting for Navi12
    - [powerpc*] 64s/syscall: Use pt_regs.trap to distinguish syscall ABI
      difference between sc and scv syscalls
    - [powerpc*] 64s/syscall: Fix ptrace syscall info with scv syscalls
    - mmc: sdhci-pci-gli: increase 1.8V regulator wait
    - [x86] xen-pciback: redo VF placement in the virtual topology
    - [x86] xen-pciback: reconfigure also from backend watch handler
    - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry
    - dm snapshot: fix crash with transient storage and zero chunk size
    - Revert "video: hgafb: fix potential NULL pointer dereference"
    - [arm64,armhf] Revert "net: stmicro: fix a missing check of clk_prepare"
    - Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe"
    - Revert "ecryptfs: replace BUG_ON with error handling code"
    - Revert "rtlwifi: fix a potential NULL pointer dereference"
    - Revert "qlcnic: Avoid potential NULL pointer dereference"
    - Revert "niu: fix missing checks of niu_pci_eeprom_read"
    - ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read()
    - [arm64,armhf] net: stmicro: handle clk_prepare() failure during init
    - net: rtlwifi: properly check for alloc_workqueue() failure
    - ics932s401: fix broken handling of errors when word reading fails
    - qlcnic: Add null check after calling netdev_alloc_skb
    - [x86] video: hgafb: fix potential NULL pointer dereference
    - vgacon: Record video mode changes with VT_RESIZEX
    - vt_ioctl: Revert VT_RESIZEX parameter handling removal
    - vt: Fix character height handling with VT_RESIZEX
    - tty: vt: always invoke vc->vc_sw->con_resize callback
    - [x86] drm/i915/gt: Disable HiZ Raw Stall Optimization on broken gen7
    - [amd64] x86/Xen: swap NX determination and GDT setup on BSP
    - nvme-multipath: fix double initialization of ANA state
    - [arm64] rtc: pcf85063: fallback to parent of_node
    - nvmet: use new ana_log_size instead the old one
    - [x86] video: hgafb: correctly handle card detect failure during probe
    - Bluetooth: SMP: Fail if remote and local public keys are identical

  [ Salvatore Bonaccorso ]
  * bpf: Wrap aux data inside bpf_sanitize_info container (CVE-2021-33200)
  * bpf: Fix mask direction swap upon off reg sign change (CVE-2021-33200)
  * bpf: No need to simulate speculative domain for immediates (CVE-2021-33200)
  * [armhf] dts: sun8i: h3: orangepi-plus: Fix ethernet phy-mode
    (Closes: #988574)
  * [rt] Refresh "ptrace: fix ptrace vs tasklist_lock race"
  * Deal with vc_data ABI changes in 5.10.40

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 28 May 2021 10:31:38 +0200

linux (5.10.38-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.29
    - [armhf] bus: ti-sysc: Fix warning on unbind if reset is not deasserted
    - [x86] platform/x86: intel-hid: Support Lenovo ThinkPad X1 Tablet Gen 2
    - [amd64] bpf, x86: Use kvmalloc_array instead kmalloc_array in bpf_jit_comp
    - net/mlx5e: Enforce minimum value check for ICOSQ size
    - mISDN: fix crash in fritzpci
    - mac80211: Check crypto_aead_encrypt for errors
    - mac80211: choose first enabled channel for monitor
    - [arm64] drm/msm/dsi_pll_7nm: Fix variable usage for pll_lockdet_rate
    - [arm64] drm/msm/adreno: a5xx_power: Don't apply A540 lm_setup to other
      GPUs
    - [arm64] drm/msm: Ratelimit invalid-fence message
    - netfilter: conntrack: Fix gre tunneling over ipv6
    - netfilter: nftables: skip hook overlap logic if flowtable is stale
    - [x86] platform/x86: thinkpad_acpi: Allow the FnLock LED to change state
    - [arm64] drm/msm/disp/dpu1: icc path needs to be set before dpu runtime
      resume
    - block: clear GD_NEED_PART_SCAN later in bdev_disk_changed
    - [x86] platform/x86: intel_pmc_core: Ignore GBE LTR on Tiger Lake platforms
    - [arm64] ptp_qoriq: fix overflow in ptp_qoriq_adjfine() u64 calcalation
    - scsi: target: pscsi: Clean up after failure in pscsi_map_sg()
    - [ia64] mca: allocate early mca with GFP_ATOMIC
    - [ia64] fix format strings for err_inject
    - cifs: revalidate mapping when we open files for SMB1 POSIX
    - cifs: Silently ignore unknown oplock break handle
    - io_uring: fix timeout cancel return code
    - math: Export mul_u64_u64_div_u64
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.30
    - ALSA: aloop: Fix initialization of controls
    - ALSA: hda/realtek: Fix speaker amp setup on Acer Aspire E1
    - ALSA: hda/conexant: Apply quirk for another HP ZBook G5 model
    - [x86] ASoC: intel: atom: Stop advertising non working S24LE support
    - nfc: fix refcount leak in llcp_sock_bind() (CVE-2020-25670)
    - nfc: fix refcount leak in llcp_sock_connect() (CVE-2020-25671)
    - nfc: fix memory leak in llcp_sock_connect() (CVE-2020-25672)
    - nfc: Avoid endless loops caused by repeated llcp_sock_connect()
    - selinux: make nslot handling in avtab more robust
    - selinux: fix cond_list corruption when changing booleans
    - selinux: fix race between old and new sidtab
    - xen/evtchn: Change irq_info lock to raw_spinlock_t
    - net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh
    - [x86] drm/i915: Fix invalid access to ACPI _DSM objects
    - [amd64] IB/hfi1: Fix probe time panic when AIP is enabled with a buggy
      BIOS
    - LOOKUP_MOUNTPOINT: we are cleaning "jumped" flag too late
    - [ia64] fix user_stack_pointer() for ptrace()
    - ocfs2: fix deadlock between setattr and dio_end_io_write
    - fs: direct-io: fix missing sdio->boundary
    - ethtool: fix incorrect datatype in set_eee ops
    - of: property: fw_devlink: do not link ".*,nr-gpios"
    - [armhf] dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin
    - batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field
    - ice: Continue probe on link/PHY errors
    - ice: Increase control queue timeout
    - ice: prevent ice_open and ice_stop during reset
    - ice: fix memory allocation call
    - ice: remove DCBNL_DEVRESET bit from PF state
    - ice: Fix for dereference of NULL pointer
    - ice: Use port number instead of PF ID for WoL
    - ice: Cleanup fltr list in case of allocation issues
    - iwlwifi: pcie: properly set LTR workarounds on 22000 devices
    - ice: fix memory leak of aRFS after resuming from suspend
    - net: hso: fix null-ptr-deref during tty device unregistration
    - bpf: Enforce that struct_ops programs be GPL-only
    - bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET
    - ethernet/netronome/nfp: Fix a use after free in nfp_bpf_ctrl_msg_rx
    - bpf: Refcount task stack in bpf_get_task_stack
    - bpf, sockmap: Fix sk->prot unhash op reset
    - bpf, sockmap: Fix incorrect fwd_alloc accounting
    - net: ensure mac header is set in virtio_net_hdr_to_skb()
    - i40e: Fix sparse warning: missing error code 'err'
    - i40e: Fix sparse error: 'vsi->netdev' could be null
    - i40e: Fix sparse error: uninitialized symbol 'ring'
    - i40e: Fix sparse errors in i40e_txrx.c
    - net: sched: sch_teql: fix null-pointer dereference
    - net: sched: fix action overwrite reference counting
    - nl80211: fix beacon head validation
    - nl80211: fix potential leak of ACL params
    - cfg80211: check S1G beacon compat element length
    - mac80211: fix time-is-after bug in mlme
    - mac80211: fix TXQ AC confusion
    - net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind()
    - net: let skb_orphan_partial wake-up waiters.
    - [x86] thunderbolt: Fix a leak in tb_retimer_add()
    - [x86] thunderbolt: Fix off by one in tb_port_find_retimer()
    - usbip: add sysfs_lock to synchronize sysfs code paths
    - usbip: stub-dev synchronize sysfs code paths
    - usbip: vudc synchronize sysfs code paths
    - usbip: synchronize event handler with sysfs code paths
    - driver core: Fix locking bug in deferred_probe_timeout_work_func()
    - scsi: pm80xx: Fix chip initialization failure
    - scsi: target: iscsi: Fix zero tag inside a trace event
    - percpu: make pcpu_nr_empty_pop_pages per chunk type
    - i2c: turn recovery error on init to debug
    - [x86] KVM: x86/mmu: change TDP MMU yield function returns to match
      cond_resched
    - [x86] KVM: x86/mmu: Merge flush and non-flush tdp_mmu_iter_cond_resched
    - [x86] KVM: x86/mmu: Rename goal_gfn to next_last_level_gfn
    - [x86] KVM: x86/mmu: Ensure forward progress when yielding in TDP MMU iter
    - [x86] KVM: x86/mmu: Yield in TDU MMU iter even if no SPTES changed
    - [x86] KVM: x86/mmu: Ensure TLBs are flushed when yielding during GFN range
      zap
    - [x86] KVM: x86/mmu: Ensure TLBs are flushed for TDP MMU during NX zapping
    - [x86] KVM: x86/mmu: Don't allow TDP MMU to yield when recovering NX pages
    - [x86] KVM: x86/mmu: preserve pending TLB flush across calls to
      kvm_tdp_mmu_zap_sp
    - net: sched: fix err handler in tcf_action_init()
    - ice: Refactor DCB related variables out of the ice_port_info struct
    - ice: Recognize 860 as iSCSI port in CEE mode
    - xfrm: interface: fix ipv4 pmtu check to honor ip header df
    - xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume
    - [armhf] OMAP4: PM: update ROM return address for OSWR and OFF
    - net: xfrm: Localize sequence counter per network namespace
    - esp: delete NETIF_F_SCTP_CRC bit from features for esp offload
    - [x86] ASoC: SOF: Intel: HDA: fix core status verification
    - xfrm: Fix NULL pointer dereference on policy lookup
    - virtchnl: Fix layout of RSS structures
    - i40e: Added Asym_Pause to supported link modes
    - i40e: Fix kernel oops when i40e driver removes VF's
    - vxlan: do not modify the shared tunnel info when PMTU triggers an ICMP
      reply
    - geneve: do not modify the shared tunnel info when PMTU triggers an ICMP
      reply
    - sch_red: fix off-by-one checks in red_check_params()
    - drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit
    - xfrm: Provide private skb extensions for segmented and hw offloaded ESP
      packets
    - can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE
    - can: isotp: fix msg_namelen values depending on CAN_REQUIRED_SIZE
    - ethernet: myri10ge: Fix a use after free in myri10ge_sw_tso
    - gianfar: Handle error code at MAC address change
    - [arm64,armhf] net: dsa: Fix type was not set for devlink port
    - cxgb4: avoid collecting SGE_QBASE regs during traffic
    - net:tipc: Fix a double free in tipc_sk_mcast_rcv
    - [armhf] net/ncsi: Avoid channel_monitor hrtimer deadlock
    - net: qrtr: Fix memory leak on qrtr_tx_wait failure
    - nfp: flower: ignore duplicate merge hints from FW
    - net: phy: broadcom: Only advertise EEE for supported modes
    - [armhf] ASoC: sunxi: sun4i-codec: fill ASoC card owner (Closes: #980539)
    - net/mlx5e: Fix mapping of ct_label zero
    - net/mlx5e: Fix ethtool indication of connector type
    - net/mlx5: Don't request more than supported EQs
    - net/rds: Fix a use after free in rds_message_map_pages
    - xdp: fix xdp_return_frame() kernel BUG throw for page_pool memory model
    - i40e: Fix display statistics for veb_tc
    - [arm64] drm/msm: Set drvdata to NULL when msm_drm_init() fails
    - net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...);
    - scsi: ufs: core: Fix task management request completion timeout
    - scsi: ufs: core: Fix wrong Task Tag used in task management request UPIUs
    - net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb
    - [arm64,riscv64] net: macb: restore cmp registers on resume path
    - clk: fix invalid usage of list cursor in register
    - clk: fix invalid usage of list cursor in unregister
    - workqueue: Move the position of debug_work_activate() in __queue_work()
    - [s390x] cpcmd: fix inline assembly register clobbering
    - net: openvswitch: conntrack: simplify the return expression of
      ovs_ct_limit_get_default_limit()
    - openvswitch: fix send of uninitialized stack memory in ct limit reply
    - i2c: designware: Adjust bus_freq_hz when refuse high speed mode set
    - iwlwifi: fix 11ax disabled bit in the regulatory capability flags
    - tipc: increment the tmp aead refcnt before attaching it
    - [arm64] net: hns3: clear VF down state bit before request link status
    - net/mlx5: Fix placement of log_max_flow_counter
    - net/mlx5: Fix PPLM register mapping
    - net/mlx5: Fix PBMC register mapping
    - RDMA/cxgb4: check for ipv6 address properly while destroying listener
    - RDMA/qedr: Fix kernel panic when trying to access recv_cq
    - [arm*] drm/vc4: crtc: Reduce PV fifo threshold on hvs4
    - i40e: Fix parameters in aq_get_phy_register()
    - RDMA/addr: Be strict with gid size
    - [armhf] clk: socfpga: fix iomem pointer cast on 64-bit
    - dt-bindings: net: ethernet-controller: fix typo in NVMEM
    - net: sched: bump refcount for new action in ACT replace mode
    - gpiolib: Read "gpio-line-names" from a firmware node
    - cfg80211: remove WARN_ON() in cfg80211_sme_connect
    - net: tun: set tun->dev->addr_len during TUNSETLINK processing
    - drivers: net: fix memory leak in atusb_probe
    - drivers: net: fix memory leak in peak_usb_create_dev
    - net: mac802154: Fix general protection fault (CVE-2021-33033)
    - net: ieee802154: nl-mac: fix check on panid
    - net: ieee802154: fix nl802154 del llsec key
    - net: ieee802154: fix nl802154 del llsec dev
    - net: ieee802154: fix nl802154 add llsec key
    - net: ieee802154: fix nl802154 del llsec devkey
    - net: ieee802154: forbid monitor for set llsec params
    - net: ieee802154: forbid monitor for del llsec seclevel
    - net: ieee802154: stop dump llsec params for monitors
    - Revert "net: sched: bump refcount for new action in ACT replace mode"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.31
    - gfs2: Flag a withdraw if init_threads() fails
    - [arm64] KVM: Hide system instruction access to Trace registers
    - [arm64] KVM: Disable guest access to trace filter controls
    - [armhf] drm/imx: imx-ldb: fix out of bounds array access warning
    - gfs2: report "already frozen/thawed" errors
    - ftrace: Check if pages were allocated before calling free_pages()
    - [arm64,armhf] drm/tegra: dc: Don't set PLL clock to 0Hz
    - [arm64,armhf] gpu: host1x: Use different lock classes for each client
    - XArray: Fix splitting to non-zero orders
    - block: only update parent bi_status when bio fail
    - null_blk: fix command timeout completion handling
    - io_uring: don't mark S_ISBLK async work as unbounded
    - [riscv64] entry: fix misaligned base for excp_vect_table
    - block: don't ignore REQ_NOWAIT for direct IO
    - netfilter: x_tables: fix compat match/target pad out-of-bound write
    - net: sfp: relax bitrate-derived mode check
    - net: sfp: cope with SFPs that set both LOS normal and LOS inverted
    - xen/events: fix setting irq affinity
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.32
    - net/sctp: fix race condition in sctp_destroy_sock
    - gpio: sysfs: Obey valid_mask
    - dmaengine: Fix a double free in dma_async_device_register
    - [x86] ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade()
    - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd()
    - xfrm: BEET mode doesn't support fragments for inner packets
    - ASoC: max98373: Changed amp shutdown register as volatile
    - ASoC: max98373: Added 30ms turn on/off time delay
    - [x86] gpu/xen: Fix a use after free in xen_drm_drv_init
    - neighbour: Disregard DEAD dst in neigh_update
    - [arm64] drm/msm: Fix a5xx/a6xx timestamps
    - scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state
    - iwlwifi: add support for Qu with AX201 device
    - net: ieee802154: stop dump llsec keys for monitors
    - net: ieee802154: forbid monitor for add llsec key
    - net: ieee802154: forbid monitor for del llsec key
    - net: ieee802154: stop dump llsec devs for monitors
    - net: ieee802154: forbid monitor for add llsec dev
    - net: ieee802154: forbid monitor for del llsec dev
    - net: ieee802154: stop dump llsec devkeys for monitors
    - net: ieee802154: forbid monitor for add llsec devkey
    - net: ieee802154: forbid monitor for del llsec devkey
    - net: ieee802154: stop dump llsec seclevels for monitors
    - net: ieee802154: forbid monitor for add llsec seclevel
    - pcnet32: Use pci_resource_len to validate PCI resource
    - mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN
    - Input: i8042 - fix Pegatron C15B ID entry
    - HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices
    - readdir: make sure to verify directory entry for legacy interfaces too
    - [arm64] fix inline asm in load_unaligned_zeropad()
    - [arm64] alternatives: Move length validation in alternative_{insn, endif}
    - vfio/pci: Add missing range check in vfio_pci_mmap
    - scsi: libsas: Reset num_scatter if libata marks qc as NODATA
    - ixgbe: fix unbalanced device enable/disable in suspend/resume
    - netfilter: flowtable: fix NAT IPv6 offload mangling
    - netfilter: conntrack: do not print icmpv6 as unknown via /proc
    - ice: Fix potential infinite loop when using u8 loop counter
    - libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC
    - netfilter: bridge: add pre_exit hooks for ebtable unregistration
    - netfilter: arp_tables: add pre_exit hook for table unregister
    - [arm64,riscv64] net: macb: fix the restore of cmp registers
    - net/mlx5e: fix ingress_ifindex check in mlx5e_flower_parse_meta
    - netfilter: nft_limit: avoid possible divide error in nft_limit_init
    - net/mlx5e: Fix setting of RS FEC mode
    - net: sit: Unregister catch-all devices
    - net: ip6_tunnel: Unregister catch-all devices
    - mm: ptdump: fix build failure
    - net: Make tcp_allowed_congestion_control readonly in non-init netns
    - i40e: fix the panic when running bpf in xdpdrv mode
    - ethtool: pause: make sure we init driver stats
    - [ia64] tools: remove inclusion of ia64-specific version of errno.h header
    - gro: ensure frag0 meets IP header alignment
    - [armhf] OMAP2+: Fix warning for omap_init_time_of()
    - [armhf] OMAP2+: Fix uninitialized sr_inst
    - [arm64] dts: allwinner: Fix SD card CD GPIO for SOPine systems
    - [arm64] dts: allwinner: h6: beelink-gs1: Remove ext. 32 kHz osc reference
    - bpf: Use correct permission flag for mixed signed bounds arithmetic
      (CVE-2021-29155)
    - [x86] KVM: VMX: Convert vcpu_vmx.exit_reason to a union
    - [x86] KVM: VMX: Don't use vcpu->run->internal.ndata as an array index
      (CVE-2021-3501)
    - r8169: tweak max read request size for newer chips also in jumbo mtu mode
    - r8169: don't advertise pause in jumbo mode
    - bpf: Ensure off_reg has no mixed signed bounds for all types
      (CVE-2021-29155)
    - bpf: Move off_reg into sanitize_ptr_alu (CVE-2021-29155)
    - [armel,armhf] 9071/1: uprobes: Don't hook on thumb instructions
    - [arm64] mte: Ensure TIF_MTE_ASYNC_FAULT is set atomically
    - bpf: Rework ptr_limit into alu_limit and add common error path
      (CVE-2021-29155)
    - bpf: Improve verifier error messages for users (CVE-2021-29155)
    - bpf: Move sanitize_val_alu out of op switch
    - net: phy: marvell: fix detection of PHY on Topaz switches
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.33
    - [armhf] gpio: omap: Save and restore sysconfig
    - [x86] pinctrl: lewisburg: Update number of pins in community
    - block: return -EBUSY when there are open partitions in blkdev_reread_part
    - pinctrl: core: Show pin numbers for the controllers with base = 0
    - [arm64] dts: allwinner: Revert SD card CD GPIO for Pine64-LTS
    - bpf: Permits pointers on stack for helper calls
    - bpf: Allow variable-offset stack access
    - bpf: Refactor and streamline bounds check into helper (CVE-2021-29155)
    - bpf: Tighten speculative pointer arithmetic mask
    - locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
    - [x86] perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3
    - [x86] perf/x86/kvm: Fix Broadwell Xeon stepping in isolation_ucodes[]
    - HID: alps: fix error return code in alps_input_configured()
    - HID cp2112: fix support for multiple gpiochips
    - HID: wacom: Assign boolean values to a bool variable
    - net: geneve: check skb is large enough for IPv4/IPv6 header
    - [arm64,armhf] dmaengine: tegra20: Fix runtime PM imbalance on error
    - [s390x] entry: save the caller of psw_idle
    - [arm64] kprobes: Restore local irqflag if kprobes is cancelled
    - xen-netback: Check for hotplug-status existence before watching
    - [x86] crash: Fix crash_setup_memmap_entries() out-of-bounds access
    - net: hso: fix NULL-deref on disconnect regression
    - USB: CDC-ACM: fix poison/unpoison imbalance (Closes: #986995)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.34
    - iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()
    - [x86] mei: me: add Alder Lake P device id.
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.35
    - [mips*] Do not include hi and lo in clobber list for R6
    - netfilter: conntrack: Make global sysctls readonly in non-init netns
    - net: usb: ax88179_178a: initialize local variables before use
    - igb: Enable RSS for Intel I211 Ethernet Controller
    - bpf: Fix masking negation logic upon negative dst register
      (CVE-2021-31829)
    - bpf: Fix leakage of uninitialized bpf stack under speculation
      (CVE-2021-31829)
    - net: qrtr: Avoid potential use after free in MHI send
    - perf data: Fix error return code in perf_data__create_dir()
    - capabilities: require CAP_SETFCAP to map uid 0
    - perf ftrace: Fix access to pid in array when setting a pid filter
    - driver core: add a min_align_mask field to struct device_dma_parameters
    - swiotlb: add a IO_TLB_SIZE define
    - swiotlb: factor out an io_tlb_offset helper
    - swiotlb: factor out a nr_slots helper
    - swiotlb: clean up swiotlb_tbl_unmap_single
    - swiotlb: refactor swiotlb_tbl_map_single
    - swiotlb: don't modify orig_addr in swiotlb_tbl_sync_single
    - swiotlb: respect min_align_mask
    - nvme-pci: set min_align_mask
    - ovl: fix leaked dentry
    - ovl: allow upperdir inside lowerdir
    - ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX
    - USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet
    - USB: Add reset-resume quirk for WD19's Realtek Hub
    - [x86] platform/x86: thinkpad_acpi: Correct thermal sensor allocation
    - perf/core: Fix unconditional security_locked_down() call
    - vfio: Depend on MMU
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.36
    - bus: mhi: core: Fix check for syserr at power_up
    - bus: mhi: core: Clear configuration from channel context during reset
    - bus: mhi: core: Sanity check values from remote device before use
    - dyndbg: fix parsing file query without a line-range suffix
    - [s390x] disassembler: increase ebpf disasm buffer size
    - [s390x] zcrypt: fix zcard and zqueue hot-unplug memleak
    - [arm64,x86] tpm: acpi: Check eventlog signature before using it
    - ftrace: Handle commands when closing set_ftrace_filter file
    - ecryptfs: fix kernel panic with null dev_name
    - fs/epoll: restore waking from ep_done_scan()
    - mtd: spi-nor: core: Fix an issue of releasing resources during read/write
    - Revert "mtd: spi-nor: macronix: Add support for mx25l51245g"
    - erofs: add unsupported inode i_format check
    - [armhf] spi: stm32-qspi: fix pm_runtime usage_count counter
    - [armhf] spi: spi-ti-qspi: Free DMA resources
    - scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()
    - scsi: mpt3sas: Block PCI config access from userspace during reset
    - mmc: sdhci: Check for reset prior to DMA address unmap
    - mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based
      controllers
    - [arm64,armhf] mmc: sdhci-tegra: Add required callbacks to set/clear CQE_EN
      bit
    - mmc: block: Update ext_csd.cache_ctrl if it was written
    - mmc: block: Issue a cache flush only when it's enabled
    - mmc: core: Do a power cycle when the CMD11 fails
    - mmc: core: Set read only for SD cards with permanent write protect bit
    - mmc: core: Fix hanging on I/O during system suspend for removable cards
    - [arm64,armhf] irqchip/gic-v3: Do not enable irqs when handling spurious
      interrups
    - cifs: Return correct error code from smb2_get_enc_key
    - cifs: fix out-of-bound memory access when calling smb3_notify() at mount
      point
    - cifs: detect dead connections only when echoes are enabled.
    - smb2: fix use-after-free in smb2_ioctl_query_info()
    - btrfs: handle remount to no compress during compression
    - btrfs: fix metadata extent leak after failure to create subvolume
    - [x86] intel_th: pci: Add Rocket Lake CPU support
    - btrfs: fix race between transaction aborts and fsyncs leading to
      use-after-free
    - posix-timers: Preserve return value in clock_adjtime32()
    - fbdev: zero-fill colormap in fbcmap.c
    - [armhf] bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices
      first
    - staging: wimax/i2400m: fix byte-order issue
    - bus: mhi: core: Destroy SBL devices when moving to mission mode
    - crypto: api - check for ERR pointers in crypto_destroy_tfm()
    - [x86] crypto: qat - fix unmap invalid dma address
    - usb: gadget: uvc: add bInterval checking for HS mode
    - usb: webcam: Invalid size of Processing Unit Descriptor
    - [x86] genirq/matrix: Prevent allocation counter corruption
    - usb: gadget: f_uac2: validate input parameters
    - usb: gadget: f_uac1: validate input parameters
    - [arm64,armhf] usb: dwc3: gadget: Ignore EP queue requests during bus reset
    - usb: xhci: Fix port minor revision
    - PCI: PM: Do not read power state in pci_enable_device_flags()
    - [arm64,armhf] soc/tegra: pmc: Fix completion of power-gate toggling
    - [arm64] dts: imx8mq-librem5-r3: Mark buck3 as always on
    - [arm64] tee: optee: do not check memref size on return from Secure World
    - [arm64,x86] soundwire: cadence: only prepare attached devices on clock
      stop
    - [arm*] perf/arm_pmu_platform: Use dev_err_probe() for IRQ errors
    - [arm*] perf/arm_pmu_platform: Fix error handling
    - random: initialize ChaCha20 constants with correct endianness
    - xhci: check port array allocation was successful before dereferencing it
    - xhci: check control context is valid before dereferencing it.
    - xhci: fix potential array out of bounds with several interrupters
    - bus: mhi: core: Clear context for stopped channels from remove()
    - [arm64] spi: qup: fix PM reference leak in spi_qup_remove()
    - [arm64,armhf] usb: musb: fix PM reference leak in musb_irq_work()
    - usb: core: hub: Fix PM reference leak in usb_port_resume()
    - [arm64,armhf] usb: dwc3: gadget: Check for disabled LPM quirk
    - tty: n_gsm: check error while registering tty devices
    - [x86] intel_th: Consistency and off-by-one fix
    - [armhf] phy: phy-twl4030-usb: Fix possible use-after-free in
      twl4030_usb_remove()
    - [arm64] crypto: sun8i-ce - Fix PM reference leak in sun8i_ce_probe()
    - [armhf] crypto: stm32/hash - Fix PM reference leak on stm32-hash.c
    - [armhf] crypto: stm32/cryp - Fix PM reference leak on stm32-cryp.c
    - [x86] platform/x86: intel_pmc_core: Don't use global pmcdev in quirks
    - spi: sync up initial chipselect state
    - btrfs: do proper error handling in create_reloc_root
    - btrfs: do proper error handling in btrfs_update_reloc_root
    - btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s
    - drm: Added orientation quirk for OneGX1 Pro
    - drm/qxl: do not run release if qxl failed to init
    - drm/qxl: release shadow on shutdown
    - drm/ast: Fix invalid usage of AST_MAX_HWC_WIDTH in cursor atomic_check
    - drm/ast: fix memory leak when unload the driver
    - drm/amd/display: Check for DSC support instead of ASIC revision
    - drm/amdgpu/display: buffer INTERRUPT_LOW_IRQ_CONTEXT interrupt work
    - scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe
    - scsi: lpfc: Fix pt2pt connection does not recover after LOGO
    - drm/amdgpu: Fix some unload driver issues
    - sched/pelt: Fix task util_est update filtering
    - kvfree_rcu: Use same set of GFP flags as does single-argument
    - scsi: target: pscsi: Fix warning in pscsi_complete_cmd()
    - [x86] media: ite-cir: check for receive overflow
    - power: supply: bq27xxx: fix power_avg for newer ICs
    - media: media/saa7164: fix saa7164_encoder_register() memory leak bugs
    - media: gspca/sq905.c: fix uninitialized variable
    - drm/amdgpu: mask the xgmi number of hops reported from psp to kfd
    - drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f
    - drm/amd/display: Fix UBSAN warning for not a valid value for type '_Bool'
    - scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats()
    - scsi: qla2xxx: Fix use after free in bsg
    - [arm64,armhf] mmc: sdhci-esdhc-imx: validate pinctrl before use it
    - mmc: sdhci-pci: Add PCI IDs for Intel LKF
    - ata: ahci: Disable SXS for Hisilicon Kunpeng920
    - nvmet: return proper error code from discovery ctrl
    - scsi: smartpqi: Use host-wide tag space
    - scsi: smartpqi: Correct request leakage during reset operations
    - scsi: smartpqi: Add new PCI IDs
    - scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg()
    - media: em28xx: fix memory leak
    - media: vivid: update EDID
    - [arm64] drm/msm/dp: Fix incorrect NULL check kbot warnings in DP driver
    - [armhf] clk: socfpga: arria10: Fix memory leak of socfpga_clk on error
      return
    - media: dvb-usb: fix memory leak in dvb_usb_adapter_init
    - media: gscpa/stv06xx: fix memory leak
    - sched/fair: Ignore percpu threads for imbalance pulls
    - [arm64] drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal
    - [arm64] drm/msm/mdp5: Do not multiply vclk line count by 100
    - drm/amdgpu/ttm: Fix memory leak userptr pages
    - drm/radeon/ttm: Fix memory leak userptr pages
    - drm/amd/display: Try YCbCr420 color when YCbCr444 fails
    - drm/amdgpu: fix NULL pointer dereference
    - scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO
      response
    - scsi: lpfc: Fix error handling for mailboxes completed in MBX_POLL mode
    - scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic
    - mfd: intel-m10-bmc: Fix the register access range
    - mfd: da9063: Support SMBus and I2C mode
    - scsi: libfc: Fix a format specifier
    - perf: Rework perf_event_exit_event()
    - sched,fair: Alternative sched_slice()
    - [s390x] archrandom: add parameter check for s390_arch_random_generate
    - sched,psi: Handle potential task count underflow bugs more gracefully
    - [i386] ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer
    - ALSA: hda/conexant: Re-order CX5066 quirk table entries
    - [i386] ALSA: sb: Fix two use after free in snd_sb_qsound_build
    - ALSA: usb-audio: Explicitly set up the clock selector
    - ALSA: usb-audio: Add dB range mapping for Sennheiser Communications
      Headset PC 8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G7
    - ALSA: hda/realtek: GA503 use same quirks as GA401
    - ALSA: hda/realtek: fix mic boost on Intel NUC 8
    - ALSA: hda/realtek - Headset Mic issue on HP platform
    - ALSA: hda/realtek: fix static noise on ALC285 Lenovo laptops
    - ALSA: hda/realtek: Add quirk for Intel Clevo PCx0Dx
    - [x86] tools/power/turbostat: Fix turbostat for AMD Zen CPUs
      (Closes: #985681)
    - btrfs: fix race when picking most recent mod log operation for an old root
    - [arm64] vdso: Discard .note.gnu.property sections in vDSO
    - Makefile: Move -Wno-unused-but-set-variable out of GCC only block
    - fs: fix reporting supported extra file attributes for statx()
    - virtiofs: fix memory leak in virtio_fs_probe()
    - ubifs: Only check replay with inode type to judge if inode linked
    - f2fs: fix error handling in f2fs_end_enable_verity()
    - f2fs: fix to avoid out-of-bounds memory access (CVE-2021-3506)
    - openvswitch: fix stack OOB read while fragmenting IPv4 packets
    - [arm64] ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe
      failure
    - NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
    - NFS: Don't discard pNFS layout segments that are marked for return
    - NFSv4: Don't discard segments marked for return in _pnfs_return_layout()
    - jffs2: Fix kasan slab-out-of-bounds problem
    - jffs2: Hook up splice_write callback
    - [powerpc*] powernv: Enable HAIL (HV AIL) for ISA v3.1 processors
    - [powerpc*] eeh: Fix EEH handling for hugepages in ioremap space.
    - [x86] intel_th: pci: Add Alder Lake-M support
    - [arm64,x86] tpm: efi: Use local variable for calculating final log size
    - [arm64,x86] tpm: vtpm_proxy: Avoid reading host log when using a virtual
      device
    - [armhf] crypto: arm/curve25519 - Move '.fpu' after '.arch'
    - md/raid1: properly indicate failure when ending a failed write request
    - dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload
      sequences
    - fuse: fix write deadlock
    - exfat: fix erroneous discard when clear cluster bit
    - sfc: farch: fix TX queue lookup in TX flush done handling
    - sfc: farch: fix TX queue lookup in TX event handling
    - security: commoncap: fix -Wstringop-overread warning
    - Fix misc new gcc warnings
    - jffs2: check the validity of dstlen in jffs2_zlib_compress()
    - smb3: when mounting with multichannel include it in requested capabilities
    - smb3: do not attempt multichannel to server which does not support it
    - Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT
      op")
    - futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
    - [x86] cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported
    - ext4: annotate data race in start_this_handle()
    - ext4: annotate data race in jbd2_journal_dirty_metadata()
    - ext4: fix check to prevent false positive report of incorrect used inodes
    - ext4: do not set SB_ACTIVE in ext4_orphan_cleanup()
    - ext4: fix error code in ext4_commit_super
    - ext4: fix ext4_error_err save negative errno into superblock
    - ext4: fix error return code in ext4_fc_perform_commit()
    - ext4: allow the dax flag to be set and cleared on inline directories
    - ext4: Fix occasional generic/418 failure
    - media: dvbdev: Fix memory leak in dvb_media_device_free()
    - media: dvb-usb: Fix use-after-free access
    - media: dvb-usb: Fix memory leak at error in dvb_usb_device_init()
    - media: v4l2-ctrls: fix reference to freed memory
    - [arm64] media: venus: hfi_parser: Don't initialize parser on v1
    - usb: gadget: dummy_hcd: fix gpf in gadget_setup
    - usb: gadget: Fix double free of device descriptor pointers
    - usb: gadget/function/f_fs string table fix for multiple languages
    - [arm64,armhf] usb: dwc3: gadget: Remove FS bInterval_m1 limitation
    - [arm64,armhf] usb: dwc3: gadget: Fix START_TRANSFER link state check
    - [arm64,armhf] usb: dwc3: core: Do core softreset when switch mode
    - [arm*] usb: dwc2: Fix session request interrupt handler
    - tty: fix memory leak in vc_deallocate
    - [x86] tools/power turbostat: Fix offset overflow issue in index converting
    - tracing: Map all PIDs to command lines
    - tracing: Restructure trace_clock_global() to never block
    - dm space map common: fix division bug in sm_ll_find_free_block()
    - dm integrity: fix missing goto in bitmap_flush_interval error handling
    - dm rq: fix double free of blk_mq_tag_set in dev remove after table load
      fails
    - lib/vsprintf.c: remove leftover 'f' and 'F' cases from bstr_printf()
    - [arm*] thermal/drivers/cpufreq_cooling: Fix slab OOB issue
    - thermal/core/fair share: Lock the thermal zone while looping over
      instances
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.37
    - Bluetooth: verify AMP hci_chan before amp_destroy (CVE-2021-33034)
    - bluetooth: eliminate the potential race condition when removing the HCI
      controller (CVE-2021-32399)
    - net/nfc: fix use-after-free llcp_sock_bind/connect (CVE-2021-23134)
    - io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers
      (CVE-2021-3491)
    - Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL"
    - usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode()
    - [amd64] tty: moxa: fix TIOCSSERIAL jiffies conversions
    - USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions
    - USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check
    - [amd64] tty: moxa: fix TIOCSSERIAL permission check
    - [x86] usb: typec: tcpm: Address incorrect values of tcpm psy for fixed
      supply
    - [x86] usb: typec: tcpm: Address incorrect values of tcpm psy for pps
      supply
    - [x86] usb: typec: tcpm: update power supply once partner accepts
    - FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR
    - PCI: Allow VPD access for QLogic ISP2722
    - [x86] KVM: Defer the MMU unload to the normal path on an global INVPCID
    - [arm64] PCI: xgene: Fix cfg resource mapping
    - PM / devfreq: Unlock mutex and free devfreq struct in error path
    - iio: inv_mpu6050: Fully validate gyro and accel scale writes
    - iio:accel:adis16201: Fix wrong axis assignment that prevents loading
    - iio:adc:ad7476: Fix remove handling
    - misc: lis3lv02d: Fix false-positive WARN on various HP models
    - [x86] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct
    - [x86] misc: vmw_vmci: explicitly initialize vmci_datagram payload
    - selinux: add proper NULL termination to the secclass_map permissions
    - [x86] sched: Treat Intel SNC topology as default, COD as exception
    - async_xor: increase src_offs when dropping destination page
    - md/bitmap: wait for external bitmap writes to complete during tear down
    - md-cluster: fix use-after-free issue when removing rdev
    - md: split mddev_find
    - md: factor out a mddev_find_locked helper from mddev_find
    - md: md_open returns -EBUSY when entering racing area
    - md: Fix missing unused status line of /proc/mdstat
    - ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()
    - cfg80211: scan: drop entry from hidden_list on overflow
    - rtw88: Fix array overrun in rtw_get_tx_power_params()
    - mt76: fix potential DMA mapping leak
    - [amd64] drm/i915/gvt: Fix virtual display setup for BXT/APL
    - [amd64] drm/i915/gvt: Fix vfio_edid issue for BXT/APL
    - drm/qxl: use ttm bo priorities
    - [arm64,armhf] drm/panfrost: Clear MMU irqs before handling the fault
    - [arm64,armhf] drm/panfrost: Don't try to map pages that are already mapped
    - drm/radeon: fix copy of uninitialized variable back to userspace
    - drm/dp_mst: Revise broadcast msg lct & lcr
    - drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast
    - drm: bridge/panel: Cleanup connector on bridge detach
    - drm/amd/display: Reject non-zero src_y and src_x for video planes
    - drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2
    - ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries
    - ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries
    - ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 HP quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries
    - ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries
    - ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries
    - ALSA: hda/realtek: Re-order ALC662 quirk table entries
    - ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices
    - ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable
    - ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32
    - [s390x] KVM: VSIE: correctly handle MVPG when in VSIE
    - [s390x] KVM: split kvm_s390_logical_to_effective
    - [s390x] KVM: fix guarded storage control register handling
    - [s390x] fix detection of vector enhancements facility 1 vs. vector packed
      decimal facility
    - [s390x] KVM: VSIE: fix MVPG handling for prefixing and MSO
    - [s390x] KVM: split kvm_s390_real_to_abs
    - [s390x] KVM: extend kvm_s390_shadow_fault to return entry pointer
    - [x86] KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with
      64-bit
    - [x86] KVM: x86: Remove emulator's broken checks on CR0/CR3/CR4 loads
    - [x86] KVM: nSVM: Set the shadow root level to the TDP level for nested NPT
    - [x86] KVM: SVM: Don't strip the C-bit from CR2 on #PF interception
    - [x86] KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are
      created
    - [x86] KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP
      unsupported
    - [x86] KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch
    - [x86] KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in
      !64-bit
    - [x86] KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit
    - [arm64] KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read
    - KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
    - KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
    - [arm64] KVM: Fully zero the vcpu state on reset
    - [arm64] KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read
    - Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit"
    - Revert "i3c master: fix missing destroy_workqueue() on error in
      i3c_master_register"
    - ovl: fix missing revert_creds() on error path
    - Revert "drm/qxl: do not run release if qxl failed to init"
    - [x86] usb: gadget: pch_udc: Revert d3cb25a12138 completely
    - Revert "tools/power turbostat: adjust for temperature offset"
    - [arm64] firmware: xilinx: Fix dereferencing freed memory
    - [armhf] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
    - [armhf] ARM: dts: exynos: correct fuel gauge interrupt trigger level on
      GT-I9100
    - [armhf] ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250
    - [armhf] serial: stm32: fix code cleaning warnings and checks
    - [armhf] serial: stm32: add "_usart" prefix in functions name
    - [armhf] serial: stm32: fix probe and remove order for dma
    - [armhf] serial: stm32: Use of_device_get_match_data()
    - [armhf] serial: stm32: fix startup by enabling usart for reception
    - [armhf] serial: stm32: fix incorrect characters on console
    - [armhf] serial: stm32: fix TX and RX FIFO thresholds
    - [armhf] serial: stm32: fix a deadlock condition with wakeup event
    - [armhf] serial: stm32: fix wake-up flag handling
    - [armhf] serial: stm32: fix a deadlock in set_termios
    - [armhf] serial: stm32: fix tx dma completion, release channel
    - [armhf] serial: stm32: call stm32_transmit_chars locked
    - [armhf] serial: stm32: fix FIFO flush in startup and set_termios
    - [armhf] serial: stm32: add FIFO flush when port is closed
    - [armhf] serial: stm32: fix tx_empty condition
    - [x86] usb: typec: tps6598x: Fix return value check in tps6598x_probe()
    - regmap: set debugfs_name to NULL after it is freed
    - [arm64,armhf] spi: rockchip: avoid objtool warning
    - mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions()
    - mtd: don't lock when recursively deleting partitions
    - mtd: maps: fix error return code of physmap_flash_remove()
    - [arm64] dts: qcom: db845c: fix correct powerdown pin for WSA881x
    - [armhf] spi: stm32: drop devres version of spi_register_master
    - [armhf] spi: stm32: Fix use-after-free on unbind
    - [x86] microcode: Check for offline CPUs before requesting new microcode
    - devtmpfs: fix placement of complete() call
    - [x86] usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits()
    - [x86] usb: gadget: pch_udc: Check if driver is present before calling
      ->setup()
    - [x86] usb: gadget: pch_udc: Check for DMA mapping error
    - [x86] usb: gadget: pch_udc: Initialize device pointer before use
    - [x86] usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard
      (v1)
    - [amd64] crypto: ccp - fix command queuing to TEE ring buffer
    - [x86] crypto: qat - don't release uninitialized resources
    - [x86] crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
    - dt-bindings: serial: stm32: Use 'type: object' instead of false for
      'additionalProperties'
    - mtd: require write permissions for locking and badblock ioctls
    - [arm64] bus: qcom: Put child node before return
    - soundwire: bus: Fix device found flag correctly
    - NFSD: Fix sparse warning in nfs4proc.c
    - NFSv4.2: fix copy stateid copying for the async copy
    - crypto: poly1305 - fix poly1305_core_setkey() declaration
    - [x86] crypto: qat - fix error path in adf_isr_resource_alloc()
    - [armhf] usb: gadget: aspeed: fix dma map failure
    - [arm64] drivers: nvmem: Fix voltage settings for QTI qfprom-efuse
    - driver core: platform: Declare early_platform_cleanup() prototype
    - [armel,armhf] memory: pl353: fix mask of ECC page_size config register
    - soundwire: stream: fix memory leak in stream config error path
    - [arm64] firmware: qcom_scm: Make __qcom_scm_is_call_available() return
      bool
    - [arm64] firmware: qcom_scm: Reduce locking section for __get_convention()
    - [arm64] firmware: qcom_scm: Workaround lack of "is available" call on
      SC7180
    - [arm64,armhf] irqchip/gic-v3: Fix OF_BAD_ADDR error handling
    - [x86] staging: rtl8192u: Fix potential infinite loop
    - PM / devfreq: Use more accurate returned new_freq as resume_freq
    - [armhf] clocksource/drivers/timer-ti-dm: Fix posted mode status check
      order
    - [armhf] clocksource/drivers/timer-ti-dm: Add missing
      set_state_oneshot_stopped
    - spi: Fix use-after-free with devm_spi_alloc_*
    - [arm64] soc: qcom: mdt_loader: Validate that p_filesz < p_memsz
    - [arm64] soc: qcom: mdt_loader: Detect truncated read of segments
    - PM: runtime: Replace inline function pm_runtime_callbacks_present()
    - [amd64,arm64] ACPI: CPPC: Replace cppc_attr with kobj_attribute
    - [x86] crypto: qat - Fix a double free in adf_create_ring
    - [arm64] cpufreq: armada-37xx: Fix setting TBG parent for load levels
    - [arm64] clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU
      PM clock
    - [arm64] cpufreq: armada-37xx: Fix the AVS value for load L1
    - [arm64] clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250
      Mhz to 1 GHz
    - [arm64] clk: mvebu: armada-37xx-periph: Fix workaround for switching from
      L1 to L0
    - [arm64] cpufreq: armada-37xx: Fix driver cleanup when registration failed
    - [arm64] cpufreq: armada-37xx: Fix determining base CPU frequency
    - USB: cdc-acm: fix unprivileged TIOCCSERIAL
    - USB: cdc-acm: fix TIOCGSERIAL implementation
    - tty: actually undefine superseded ASYNC flags
    - tty: fix return value for unsupported ioctls
    - tty: fix return value for unsupported termiox ioctls
    - serial: core: return early on unsupported ioctls
    - node: fix device cleanups in error handling code
    - crypto: chelsio - Read rxchannel-id from firmware
    - usbip: vudc: fix missing unlock on error in usbip_sockfd_store()
    - security: keys: trusted: fix TPM2 authorizations
    - [x86] platform/x86: pmc_atom: Match all Beckhoff Automation baytrail
      boards with critclk_systems DMI table
    - [armhf] dts: aspeed: Rainier: Fix humidity sensor bus address
    - [x86] Drivers: hv: vmbus: Use after free in __vmbus_open()
    - [x86] Drivers: hv: vmbus: Increase wait time for VMbus unload
    - [x86] PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820
      integrity check
    - [arm*] usb: dwc2: Fix host mode hibernation exit with remote wakeup flow.
    - [arm*] usb: dwc2: Fix hibernation between host and device modes.
    - ttyprintk: Add TTY hangup callback.
    - [armhf] serial: omap: don't disable rs485 if rts gpio is missing
    - [armhf] serial: omap: fix rs485 half-duplex filtering
    - xen-blkback: fix compatibility bug with single page rings
    - [armhf] soc: aspeed: fix a ternary sign expansion bug
    - [armhf] drm/tilcdc: send vblank event when disabling crtc
    - [armhf] drm/stm: Fix bus_flags handling
    - drm/amd/display: Fix off by one in hdmi_14_process_transaction()
    - sched/fair: Fix shift-out-of-bounds in load_balance()
    - afs: Fix updating of i_mode due to 3rd party change
    - rcu: Remove spurious instrumentation_end() in rcu_nmi_enter()
    - media: vivid: fix assignment of dev->fbuf_out_flags
    - media: saa7134: use sg_dma_len when building pgtable
    - media: saa7146: use sg_dma_len when building pgtable
    - [armhf] media: aspeed: fix clock handling logic
    - drm/probe-helper: Check epoch counter in output_poll_execute()
    - [arm64] media: venus: core: Fix some resource leaks in the error path of
      'venus_probe()'
    - media: m88ds3103: fix return value check in m88ds3103_probe()
    - media: m88rs6000t: avoid potential out-of-bounds reads on arrays
    - [x86] kprobes: Fix to check non boostable prefixes correctly
    - sata_mv: add IRQ checks
    - ata: libahci_platform: fix IRQ check
    - seccomp: Fix CONFIG tests for Seccomp_filters
    - nvme-tcp: block BH in sk state_change sk callback
    - nvmet-tcp: fix incorrect locking in state_change sk callback
    - [armhf] clk: imx: Fix reparenting of UARTs not associated with stdout
    - nvme: retrigger ANA log update if group descriptor isn't found
    - media: v4l2-ctrls.c: fix race condition in hdl->requests list
    - vfio/pci: Move VGA and VF initialization to functions
    - vfio/pci: Re-order vfio_pci_probe()
    - [amd64] vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer
    - drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct
    - drm/radeon: Fix a missing check bug in radeon_dp_mst_detect()
    - scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check()
    - scsi: pm80xx: Fix potential infinite loop
    - scsi: ufs: ufshcd-pltfrm: Fix deferred probing
    - [amd64] scsi: hisi_sas: Fix IRQ checks
    - [powerpc*] scsi: ibmvfc: Fix invalid state machine BUG_ON()
    - nvmet-tcp: fix a segmentation fault during io parsing error
    - nvme-pci: don't simple map sgl when sgls are disabled
    - [armhf] HSI: core: fix resource leaks in hsi_add_client_from_dt()
    - [amd64] x86/events/amd/iommu: Fix sysfs type mismatch
    - [x86] perf/amd/uncore: Fix sysfs type mismatch
    - io_uring: fix overflows checks in provide buffers
    - sched/debug: Fix cgroup_path[] serialization
    - drivers/block/null_blk/main: Fix a double free in null_init.
    - xsk: Respect device's headroom and tailroom on generic xmit path
    - HID: plantronics: Workaround for double volume key presses
    - RDMA/mlx5: Fix mlx5 rates to IB rates map
    - [x86] KVM: x86/mmu: Retry page faults that hit an invalid memslot
    - Bluetooth: avoid deadlock between hci_dev->lock and socket lock
    - bpftool: Fix maybe-uninitialized warnings
    - iommu: Check dev->iommu in iommu_dev_xxx functions
    - [amd64] iommu/vt-d: Reject unsupported page request modes
    - [powerpc*] prom: Mark identical_pvr_fixup as __init
    - inet: use bigger hash table for IP ID generation
    - [arm64,armhf] pinctrl: pinctrl-single: remove unused parameter
    - [arm64,armhf] pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when
      bits_per_mux is not zero
    - [mips64el,mipsel] loongson64: fix bug when PAGE_SIZE > 16KB
    - RDMA/mlx5: Fix drop packet rule in egress table
    - IB/isert: Fix a use after free in isert_connect_request
    - gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP
    - ALSA: core: remove redundant spin_lock pair in snd_card_disconnect
    - net: phy: lan87xx: fix access to wrong register of LAN87xx
    - udp: never accept GSO_FRAGLIST packets
    - [powerpc*] pseries: Only register vio drivers if vio bus exists
    - net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start()
    - bug: Remove redundant condition check in report_bug
    - RDMA/core: Fix corrupted SL on passive side
    - nfc: pn533: prevent potential memory corruption
    - [arm64] net: hns3: Limiting the scope of vector_ring_chain variable
    - [amd64] iommu/vt-d: Don't set then clear private data in
      prq_event_thread()
    - iommu: Fix a boundary issue to avoid performance drop
    - [amd64] iommu/vt-d: Report right snoop capability when using FL for IOVA
    - [amd64] iommu/vt-d: Report the right page fault address
    - [amd64] iommu/vt-d: Preset Access/Dirty bits for IOVA over FL
    - [amd64] iommu/vt-d: Remove WO permissions on second-level paging entries
    - [amd64] iommu/vt-d: Invalidate PASID cache when root/context entry changed
    - ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls
    - HID: lenovo: Use brightness_set_blocking callback for setting LEDs
      brightness
    - HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling
    - HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event()
    - HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE
    - [arm64] KVM: Initialize VCPU mdcr_el2 before loading it
    - [arm*] ASoC: simple-card: fix possible uninitialized single_cpu local
      variable
    - [amd64] IB/hfi1: Use kzalloc() for mmu_rb_handler allocation
    - [powerpc*] 64s: Fix pte update for kernel memory on radix
    - [powerpc*] perf: Fix PMU constraint check for EBB events
    - mac80211: bail out if cipher schemes are invalid
    - perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric
    - xfs: fix return of uninitialized value in variable error
    - rtw88: Fix an error code in rtw_debugfs_set_rsvd_page()
    - mt7601u: fix always true expression
    - [powerpc*] KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit
    - ovl: invalidate readdir cache on changes to dir with origin
    - RDMA/qedr: Fix error return code in qedr_iw_connect()
    - [amd64] IB/hfi1: Fix error return code in parse_platform_config()
    - cxgb4: Fix unintentional sign extension issues
    - [arm64] net: thunderx: Fix unintentional sign extension issue
    - RDMA/srpt: Fix error return code in srpt_cm_req_recv()
    - [arm64,armhf] i2c: imx: fix reference leak when pm_runtime_get_sync fails
    - [armhf] i2c: omap: fix reference leak when pm_runtime_get_sync fails
    - [armhf] i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails
    - [powerpc*] xive: Drop check on irq_data in xive_core_debug_show()
    - [powerpc*] xive: Fix xmon command "dxi"
    - net/packet: make packet_fanout.arr size configurable up to 64K
    - net/packet: remove data races in fanout operations
    - [amd64] drm/i915/gvt: Fix error code in intel_gvt_init_device()
    - [amd64] iommu/amd: Put newline after closing bracket in warning
    - [mips64el,mipsel] pci-legacy: stop using of_pci_range_to_resource
    - [powerpc*] pseries: extract host bridge from pci_bus prior to bus removal
    - [powerpc*] smp: Reintroduce cpu_core_mask
    - [x86] KVM: dump_vmcs should not assume GUEST_IA32_EFER is valid
    - rtlwifi: 8821ae: upgrade PHY and RF parameters
    - [arm64,armhf] wlcore: fix overlapping snprintf arguments in debugfs
    - mwl8k: Fix a double Free in mwl8k_probe_hw
    - netfilter: nft_payload: fix C-VLAN offload support
    - netfilter: nftables_offload: VLAN id needs host byteorder in flow
      dissector
    - netfilter: nftables_offload: special ethertype handling for VLAN
    - [x86] vsock/vmci: log once the failed queue pair allocation
    - gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check
    - RDMA/cxgb4: add missing qpid increment
    - RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
    - ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails
    - sfc: ef10: fix TX queue lookup in TX event handling
    - vsock/virtio: free queued packets when closing socket
    - [armhf] net: davinci_emac: Fix incorrect masking of tx and rx error
      channel
    - [amd64] crypto: ccp: Detect and reject "invalid" addresses destined for
      PSP
    - nfp: devlink: initialize the devlink port attribute "lanes"
    - net: stmmac: fix TSO and TBS feature enabling during driver open
    - RDMA/rxe: Fix a bug in rxe_fill_ip_info()
    - RDMA/core: Add CM to restrack after successful attachment to a device
    - [powerpc*] 64: Fix the definition of the fixmap area
    - ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
    - ath10k: Fix a use after free in ath10k_htc_send_bundle
    - ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock
    - wlcore: Fix buffer overrun by snprintf due to incorrect buffer size
    - [powerpc*] perf: Fix the threshold event selection for memory events in
      power10
    - net: phy: marvell: fix m88e1011_set_downshift
    - net: phy: marvell: fix m88e1111_set_downshift
    - bnxt_en: fix ternary sign extension bug in bnxt_show_temp()
    - net: geneve: modify IP header check in geneve6_xmit_skb and
      geneve_xmit_skb
    - bnxt_en: Fix RX consumer index logic in the error path.
    - [x86] KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM
    - [arm64] net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
    - bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds
    - net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
    - net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
    - perf tools: Change fields type in perf_record_time_conv
    - perf jit: Let convert_timestamp() to be backwards-compatible
    - perf session: Add swap operation for event TIME_CONV
    - mm/sl?b.c: remove ctor argument from kmem_cache_flags
    - mm: memcontrol: slab: fix obtain a reference to a freeing memcg
    - mm/sparse: add the missing sparse_buffer_fini() in error branch
    - mm/memory-failure: unnecessary amount of unmapping
    - afs: Fix speculative status fetches
    - bpf: Fix alu32 const subreg bound tracking on bitwise operations
      (CVE-2021-3490)
    - bpf, ringbuf: Deny reserve of buffers larger than ringbuf (CVE-2021-3489)
    - bpf: Prevent writable memory-mapping of read-only ringbuf pages
    - [arm64] Remove arm64_dma32_phys_limit and its uses
    - net: Only allow init netns to set default tcp cong to a restricted algo
    - smp: Fix smp_call_function_single_async prototype
    - Revert "net/sctp: fix race condition in sctp_destroy_sock"
    - sctp: delay auto_asconf init until binding the first addr (CVE-2021-23133)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.38
    - [arm64,x86] tpm: fix error return code in tpm2_get_cc_attrs_tbl()
    - [arm64,x86] tpm, tpm_tis: Extend locality handling to TPM2 in
      tpm_tis_gen_interrupt()
    - [arm64,x86] tpm, tpm_tis: Reserve locality in tpm_tis_resume()
    - [x86] KVM: x86/mmu: Remove the defunct update_pte() paging hook
    - [x86] KVM/VMX: Invoke NMI non-IST entry instead of IST entry
    - ACPI: PM: Add ACPI ID of Alder Lake Fan
    - PM: runtime: Fix unpaired parent child_count for force_resume
    - [x86] cpufreq: intel_pstate: Use HWP if enabled by platform firmware
    - kvm: Cap halt polling at kvm->max_halt_poll_ns
    - ath11k: fix thermal temperature read
    - fs: dlm: fix debugfs dump
    - fs: dlm: add errno handling to check callback
    - fs: dlm: check on minimum msglen size
    - fs: dlm: flush swork on shutdown
    - tipc: convert dest node's address to network order
    - [x86] ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus
      T100TAF
    - net/mlx5e: Use net_prefetchw instead of prefetchw in MPWQE TX datapath
    - [arm64] net: stmmac: Set FIFO sizes for ipq806x
    - Bluetooth: Fix incorrect status handling in LE PHY UPDATE event
    - i2c: bail out early when RDWR parameters are wrong
    - ALSA: hdsp: don't disable if not enabled
    - ALSA: hdspm: don't disable if not enabled
    - ALSA: rme9652: don't disable if not enabled
    - ALSA: bebob: enable to deliver MIDI messages for multiple ports
    - Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default
    - Bluetooth: initialize skb_queue_head at l2cap_chan_create()
    - net/sched: cls_flower: use ntohs for struct flow_dissector_key_ports
    - net: bridge: when suppression is enabled exclude RARP packets
    - Bluetooth: check for zapped sk before connecting
    - [powerpc] 32: Statically initialise first emergency context
    - [arm64] net: hns3: remediate a potential overflow risk of bd_num_list
    - [arm64] net: hns3: add handling for xmit skb with recursive fraglist
    - ip6_vti: proper dev_{hold|put} in ndo_[un]init methods
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet
    - ice: handle increasing Tx or Rx ring sizes
    - Bluetooth: btusb: Enable quirk boolean flag for Mediatek Chip.
    - [x86] ASoC: rt5670: Add a quirk for the Dell Venue 10 Pro 5055
    - i2c: Add I2C_AQ_NO_REP_START adapter quirk
    - [mips64el,mipsel] MIPS: Loongson64: Use _CACHE_UNCACHED instead of
      _CACHE_UNCACHED_ACCELERATED
    - [amd64] IB/hfi1: Correct oversized ring allocation
    - mac80211: clear the beacon's CRC after channel switch
    - [armhf] pinctrl: samsung: use 'int' for register masks in Exynos
    - rtw88: 8822c: add LC calibration for RTL8822C
    - mt76: mt76x0: disable GTK offloading
    - fuse: invalidate attrs when page writeback completes
    - virtiofs: fix userns
    - cuse: prevent clone
    - iwlwifi: pcie: make cfg vs. trans_cfg more robust
    - [powerpc*] mm: Add cond_resched() while removing hpte mappings
    - Revert "iommu/amd: Fix performance counter initialization"
    - [amd64] iommu/amd: Remove performance counter pre-initialization test
    - ALSA: hda/realtek: Add quirk for Lenovo Ideapad S740
    - [x86] ASoC: Intel: sof_sdw: add quirk for new ADL-P Rvp
    - ALSA: hda/hdmi: fix race in handling acomp ELD notification at resume
    - sctp: Fix out-of-bounds warning in sctp_process_asconf_param()
    - flow_dissector: Fix out-of-bounds warning in __skb_flow_bpf_to_target()
    - [powerpc*] smp: Set numa node before updating mask
    - [x86] ASoC: rt286: Generalize support for ALC3263 codec
    - ethtool: ioctl: Fix out-of-bounds warning in
      store_link_ksettings_for_user()
    - net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule
    - [powerpc*] pseries: Stop calling printk in rtas_stop_self()
    - wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt
    - wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join
    - [powerpc*] iommu: Annotate nested lock for lockdep
    - iavf: remove duplicate free resources calls
    - kbuild: generate Module.symvers only when vmlinux exists
    - bnxt_en: Add PCI IDs for Hyper-V VF devices.
    - [ia64] module: fix symbolizer crash on fdescr
    - watchdog: rename __touch_watchdog() to a better descriptive name
    - watchdog: explicitly update timestamp when reporting softlockup
    - watchdog/softlockup: remove logic that tried to prevent repeated reports
    - watchdog: fix barriers when printing backtraces from all CPUs
    - [x86] ASoC: rt286: Make RT286_SET_GPIO_* readable and writable
    - thermal: thermal_of: Fix error return code of
      thermal_of_populate_bind_params()
    - f2fs: move ioctl interface definitions to separated file
    - f2fs: fix compat F2FS_IOC_{MOVE,GARBAGE_COLLECT}_RANGE
    - f2fs: fix to allow migrating fully valid segment
    - f2fs: fix panic during f2fs_resize_fs()
    - f2fs: fix a redundant call to f2fs_balance_fs if an error occurs
    - PCI: Release OF node in pci_scan_device()'s error path
    - [armel,armhf] 9064/1: hw_breakpoint: Do not directly check the event's
      overflow_handler hook
    - f2fs: fix to align to section for fallocate() on pinned file
    - f2fs: fix to update last i_size if fallocate partially succeeds
    - f2fs: fix to avoid touching checkpointed data in get_victim()
    - f2fs: fix to cover __allocate_new_section() with curseg_lock
    - f2fs: Fix a hungtask problem in atomic write
    - f2fs: fix to avoid accessing invalid fio in f2fs_allocate_data_block()
    - [arm64] rpmsg: qcom_glink_native: fix error return code of
      qcom_glink_rx_data()
    - NFS: nfs4_bitmask_adjust() must not change the server global bitmasks
    - NFS: Fix attribute bitmask in _nfs42_proc_fallocate()
    - NFSv4.2: Always flush out writes in nfs42_proc_fallocate()
    - NFS: Deal correctly with attribute generation counter overflow
    - pNFS/flexfiles: fix incorrect size check in decode_nfs_fh()
    - NFSv4.2 fix handling of sr_eof in SEEK's reply
    - SUNRPC: Move fault injection call sites
    - SUNRPC: Remove trace_xprt_transmit_queued
    - SUNRPC: Handle major timeout in xprt_adjust_timeout()
    - [arm64] thermal/drivers/tsens: Fix missing put_device error
    - NFSv4.x: Don't return NFS4ERR_NOMATCHING_LAYOUT if we're unmounting
    - nfsd: ensure new clients break delegations
    - SUNRPC: fix ternary sign expansion bug in tracing
    - xprtrdma: Avoid Receive Queue wrapping
    - xprtrdma: Fix cwnd update ordering
    - xprtrdma: rpcrdma_mr_pop() already does list_del_init()
    - swiotlb: Fix the type of index
    - ceph: fix inode leak on getattr error in __fh_to_dentry
    - scsi: qla2xxx: Prevent PRLI in target mode
    - scsi: ufs: core: Do not put UFS power into LPM if link is broken
    - scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend
    - scsi: ufs: core: Narrow down fast path in system suspend path
    - rtc: ds1307: Fix wday settings for rx8130
    - [arm64] net: hns3: fix incorrect configuration for igu_egu_hw_err
    - [arm64] net: hns3: initialize the message content in hclge_get_link_mode()
    - [arm64] net: hns3: add check for HNS3_NIC_STATE_INITED in
      hns3_reset_notify_up_enet()
    - [arm64] net: hns3: fix for vxlan gpe tx checksum bug
    - [arm64] net: hns3: use netif_tx_disable to stop the transmit queue
    - [arm64] net: hns3: disable phy loopback setting in hclge_mac_start_phy
    - sctp: do asoc update earlier in sctp_sf_do_dupcook_a
    - [riscv64] Fix error code returned by riscv_hartid_to_cpuid()
    - sunrpc: Fix misplaced barrier in call_decode
    - ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
    - sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b
    - netfilter: xt_SECMARK: add new revision to fix structure layout
    - net: stmmac: Clear receive all(RA) bit when promiscuous mode is off
    - drm/radeon: Fix off-by-one power_state index heap overwrite
    - drm/radeon: Avoid power table parsing memory leaks
    - [arm64] entry: factor irq triage logic into macros
    - [arm64] entry: always set GIC_PRIO_PSR_I_SET during entry
    - khugepaged: fix wrong result value for
      trace_mm_collapse_huge_page_isolate()
    - mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts()
    - mm/migrate.c: fix potential indeterminate pte entry in
      migrate_vma_insert_page()
    - ksm: fix potential missing rmap_item for stable_node
    - mm/gup: check every subpage of a compound page during isolation
    - mm/gup: return an error on migration failure
    - mm/gup: check for isolation errors
    - ethtool: fix missing NLM_F_MULTI flag when dumping
    - net: fix nla_strcmp to handle more then one trailing null character
    - smc: disallow TCP_ULP in smc_setsockopt()
    - netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check
    - netfilter: nftables: Fix a memleak from userdata error path in new objects
    - sched: Fix out-of-bound access in uclamp
    - sched/fair: Fix unfairness caused by missing load decay
    - fs/proc/generic.c: fix incorrect pde_is_permanent check
    - kernel: kexec_file: fix error return code of
      kexec_calculate_store_digests()
    - kernel/resource: make walk_system_ram_res() find all busy
      IORESOURCE_SYSTEM_RAM resources
    - kernel/resource: make walk_mem_res() find all busy IORESOURCE_MEM
      resources
    - netfilter: nftables: avoid overflows in nft_hash_buckets()
    - i40e: fix broken XDP support
    - i40e: Fix use-after-free in i40e_client_subtask()
    - i40e: fix the restart auto-negotiation after FEC modified
    - i40e: Fix PHY type identifiers for 2.5G and 5G adapters
    - f2fs: avoid unneeded data copy in f2fs_ioc_move_range()
    - [powerpc*] 64s: Fix crashes when toggling stf barrier
    - [powerpc*] 64s: Fix crashes when toggling entry flush barrier
    - hfsplus: prevent corruption in shrinking truncate
    - squashfs: fix divide error in calculate_skip()
    - userfaultfd: release page in error path to avoid BUG_ON
    - mm/hugetlb: fix F_SEAL_FUTURE_WRITE
    - blk-iocost: fix weight updates of inner active iocgs
    - [arm64] mte: initialize RGSR_EL1.SEED in __cpu_setup
    - [arm64] Fix race condition on PG_dcache_clean in __sync_icache_dcache()
    - btrfs: fix race leading to unpersisted data and metadata on fsync
    - drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors
      are connected
    - [x86] drm/i915: Avoid div-by-zero on gen2
    - kvm: exit halt polling on need_resched() as well
    - [x86] KVM: LAPIC: Accurately guarantee busy wait for timer to expire when
      using hv_timer
    - [arm64] drm/msm/dp: initialize audio_comp when audio starts
    - [x86] KVM: x86: Cancel pvclock_gtod_work on module removal
    - [x86] KVM: x86: Prevent deadlock against tk_core.seq
    - dax: Add an enum for specifying dax wakup mode
    - dax: Add a wakeup mode parameter to put_unlocked_entry()
    - dax: Wake up all waiters after invalidating dax entry
    - [amd64] xen/unpopulated-alloc: consolidate pgmap manipulation
    - [amd64] xen/unpopulated-alloc: fix error return code in fill_list()
    - [arm64,armhf] usb: dwc3: gadget: Free gadget structure only after freeing
      endpoints
    - iio: light: gp2ap002: Fix rumtime PM imbalance on error
    - iio: proximity: pulsedlight: Fix rumtime PM imbalance on error
    - [armhf] hwmon: (occ) Fix poll rate limiting
    - ACPI: scan: Fix a memory leak in an error handling path
    - kyber: fix out of bounds access when preempted
    - nvmet: add lba to sect conversion helpers
    - nvmet: fix inline bio check for bdev-ns
    - nvmet-rdma: Fix NULL deref when SEND is completed with error
    - f2fs: compress: fix to free compress page correctly
    - f2fs: compress: fix race condition of overwrite vs truncate
    - f2fs: compress: fix to assign cc.cluster_idx correctly
    - nbd: Fix NULL pointer in flush_workqueue
    - blk-mq: plug request for shared sbitmap
    - blk-mq: Swap two calls in blk_mq_exit_queue()
    - [armhf] usb: dwc3: omap: improve extcon initialization
    - [arm64] usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel
      Merrifield
    - usb: xhci: Increase timeout for HC halt
    - [arm*] usb: dwc2: Fix gadget DMA unmap direction
    - usb: core: hub: fix race condition about TRSMRCY of resume
    - [arm64,armhf] usb: dwc3: gadget: Enable suspend events
    - [arm64,armhf] usb: dwc3: gadget: Return success always for kick transfer
      in ep queue
    - [x86] usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4
    - [x86] usb: typec: ucsi: Put fwnode in any case during ->probe()
    - xhci-pci: Allow host runtime PM as default for Intel Alder Lake xHCI
    - xhci: Do not use GFP_KERNEL in (potentially) atomic context
    - xhci: Add reset resume quirk for AMD xhci controller.
    - iio: gyro: mpu3050: Fix reported temperature value
    - iio: tsl2583: Fix division by a zero lux_val
    - cdc-wdm: untangle a circular dependency between callback and softint
    - xen/gntdev: fix gntdev_mmap() error exit path
    - [x86] KVM: Emulate RDPID only if RDTSCP is supported
    - [x86] KVM: Move RDPID emulation intercept to its own enum
    - [x86] KVM: nVMX: Always make an attempt to map eVMCS after migration
    - [x86] KVM: VMX: Do not advertise RDPID if ENABLE_RDTSCP control is
      unsupported
    - [x86] KVM: VMX: Disable preemption when probing user return MSRs
    - Revert "iommu/vt-d: Remove WO permissions on second-level paging entries"
    - Revert "iommu/vt-d: Preset Access/Dirty bits for IOVA over FL"
    - iommu/vt-d: Preset Access/Dirty bits for IOVA over FL
    - iommu/vt-d: Remove WO permissions on second-level paging entries
    - mm: fix struct page layout on 32-bit systems
    - [mips*] Reinstate platform `__div64_32' handler
    - [mips*] Avoid DIVU in `__div64_32' is result would be zero
    - [mips*] Avoid handcoded DIVU in `__div64_32' altogether
    - [armhf] clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap
      issue
    - [armhf] clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata
      i940
    - [armel,armhf] 9011/1: centralize phys-to-virt conversion of DT/ATAGS
      address
    - [armel,armhf] 9012/1: move device tree mapping out of linear region
    - [armel,armhf] 9020/1: mm: use correct section size macro to describe the
      FDT virtual address
    - [armel,armhf] 9027/1: head.S: explicitly map DT even if it lives in the
      first physical section
    - [x86] usb: typec: tcpm: Fix error while calculating PPS out values
    - kobject_uevent: remove warning in init_uevent_argv()
    - [x86] drm/i915/gt: Fix a double free in gen8_preallocate_top_level_pdp
    - [x86] drm/i915: Read C0DRB3/C1DRB3 as 16 bits again
    - [x86] drm/i915/overlay: Fix active retire callback alignment
    - [x86] drm/i915: Fix crash in auto_retire
    - debugfs: Make debugfs_allow RO after init
    - ext4: fix debug format string warning
    - nvme: do not try to reconfigure APST when the controller is not live

  [ Vincent Blut ]
  * [x86] sound/soc/intel: Enable SND_SOC_INTEL_CATPT as module
    (Closes: #986822)
  * [x86] sound/soc/intel/boards: Enable SND_SOC_INTEL_BDW_RT5650_MACH as
    module
  * drivers/input/rmi4: Enable RMI4_F3A (Closes: #986848)
  * [armhf] drivers/gpio: Enable GPIO_MXC as module (Closes: #987019)
  * [x86] drivers/misc/mei: Enable INTEL_MEI_TXE, INTEL_MEI_HDCP as modules
    (Closes: #987281)

  [ Uwe Kleine-König ]
  * [arm64] Enable more options for NXP's i.MX8 (Closes: #985862)

  [ Salvatore Bonaccorso ]
  * vfs: move cap_convert_nscap() call into vfs_setxattr() (CVE-2021-3493)
  * Refresh "Makefile: Do not check for libelf when building OOT module"
  * Bump ABI to 7
  * Refresh "tools/include/uapi: Fix <asm/errno.h>"
  * [rt] Update to 5.10.35-rt39
  * [rt] Refresh "powerpc/mm/highmem: Switch to generic kmap atomic"
  * [arm64] udeb: Include mdio module for RPi4 ethernet in installer
    (Closes: #985956)

  [ Vagrant Cascadian ]
  * [arm64] Disable USB type-C DisplayPort in pinebook pro device-tree.
  * [arm64] Enable TYPEC_FUSB302, SND_SOC_ES8316, TYPEC and TYPEC_TCPM as
    modules. (Closes: #987638)

  [ Michal Simek ]
  * [arm64] Enable clock driver for Xilinx ZynqMP SoC

  [ Valentin Vidic ]
  * [s390x] udeb: Include standard scsi-modules containing the virtio_blk
    module (Closes: #988005)

  [ Ben Hutchings ]
  * kbuild: Abort build if SUBDIRS used (Closes: #987575)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 20 May 2021 07:47:35 +0200

linux (5.10.28-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.27
    - mm/memcg: rename mem_cgroup_split_huge_fixup to split_page_memcg and add
      nr_pages argument
    - mm/memcg: set memcg when splitting page
    - mt76: fix tx skb error handling in mt76_dma_tx_queue_skb
    - net: stmmac: fix dma physical address of descriptor when display ring
    - [arm64,armhf] net: fec: ptp: avoid register access when ipg clock is
      disabled
    - [powerpc*] 4xx: Fix build errors from mfdcr()
    - atm: eni: dont release is never initialized
    - atm: lanai: dont run lanai_dev_close if not open
    - Revert "r8152: adjust the settings about MAC clock speed down for RTL8153"
    - [x86] ALSA: hda: ignore invalid NHLT table
    - ixgbe: Fix memleak in ixgbe_configure_clsu32
    - blk-cgroup: Fix the recursive blkg rwstat
    - net: tehuti: fix error return code in bdx_probe()
    - net: intel: iavf: fix error return code of iavf_init_get_resources()
    - sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
    - gianfar: fix jumbo packets+napi+rx overrun crash (CVE-2021-29264)
    - cifs: ask for more credit on async read/write code paths
    - gfs2: fix use-after-free in trans_drain
    - [arm64,armhf] cpufreq: blacklist Arm Vexpress platforms in
      cpufreq-dt-platdev
    - gpiolib: acpi: Add missing IRQF_ONESHOT
    - nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
    - NFS: Correct size calculation for create reply length
    - [arm64] net: hisilicon: hns: fix error return code of
      hns_nic_clear_all_rx_fetch()
    - [arm64] net: enetc: set MAC RX FIFO to recommended value
    - atm: uPD98402: fix incorrect allocation
    - atm: idt77252: fix null-ptr-dereference
    - cifs: change noisy error message to FYI
    - kbuild: add image_name to no-sync-config-targets
    - umem: fix error return code in mm_pci_probe()
    - [sparc64] Fix opcode filtering in handling of no fault loads
    - u64_stats,lockdep: Fix u64_stats_init() vs lockdep
    - block: Fix REQ_OP_ZONE_RESET_ALL handling
    - drm/amdgpu: fb BO should be ttm_bo_type_device
    - drm/radeon: fix AGP dependency
    - nvme: simplify error logic in nvme_validate_ns()
    - nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request()
    - nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange()
    - nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted
    - nvme-core: check ctrl css before setting up zns
    - nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
    - nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a
    - nfs: we don't support removing system.nfs4_acl
    - block: Suppress uevent for hidden device when removed
    - mm/fork: clear PASID for new mm
    - [ia64] fix ia64_syscall_get_set_arguments() for break-based syscalls
    - [ia64] fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
    - static_call: Pull some static_call declarations to the type headers
    - [x86] static_call: Allow module use without exposing static_call_key
    - [x86] static_call: Fix the module key fixup
    - [x86] static_call: Fix static_call_set_init()
    - [x86] KVM: Protect userspace MSR filter with SRCU, and set atomically-ish
    - btrfs: fix sleep while in non-sleep context during qgroup removal
    - selinux: don't log MAC_POLICY_LOAD record on failed policy load
    - selinux: fix variable scope issue in live sidtab conversion
    - [arm64] netsec: restore phy power state after controller reset
    - [x86] platform/x86: intel-vbtn: Stop reporting SW_DOCK events
    - psample: Fix user API breakage
    - z3fold: prevent reclaim/free race for headless pages
    - squashfs: fix inode lookup sanity checks
    - squashfs: fix xattr id and id lookup sanity checks
    - hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared
      mappings
    - [x86] ACPI: video: Add missing callback back for Sony VPCEH3U1E
    - ACPICA: Always create namespace nodes using acpi_ns_create_node()
    - [arm64] stacktrace: don't trace arch_stack_walk()
    - integrity: double check iint_cache was initialized
    - [armhf] drm/etnaviv: Use FOLL_FORCE for userptr
    - drm/amdgpu: Add additional Sienna Cichlid PCI ID
    - [x86] drm/i915: Fix the GT fence revocation runtime PM logic
    - dm verity: fix DM_VERITY_OPTS_MAX value
    - dm ioctl: fix out of bounds array access when no devices
    - [armhf] bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
    - [armhf] OMAP2+: Fix smartreflex init regression after dropping legacy data
    - [armhf] soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7
      iva
    - veth: Store queue_mapping independently of XDP prog presence
    - bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF
    - net/mlx5e: RX, Mind the MPWQE gaps when calculating offsets
    - net/mlx5e: When changing XDP program without reset, take refs for XSK RQs
    - net/mlx5e: Don't match on Geneve options in case option masks are all zero
    - ipv6: fix suspecious RCU usage warning
    - drop_monitor: Perform cleanup upon probe registration failure
    - macvlan: macvlan_count_rx() needs to be aware of preemption
    - net: sched: validate stab values
    - [armhf] net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port
    - igc: reinit_locked() should be called with rtnl_lock
    - igc: Fix Pause Frame Advertising
    - igc: Fix Supported Pause Frame Link Setting
    - igc: Fix igc_ptp_rx_pktstamp()
    - e1000e: add rtnl_lock() to e1000_reset_task
    - e1000e: Fix error handling in e1000_set_d0_lplu_state_82571
    - net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
    - net: phy: broadcom: Add power down exit reset state delay
    - [armhf] ftgmac100: Restart MAC HW once
    - net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() (CVE-2021-29647)
    - flow_dissector: fix byteorder of dissected ICMP ID
    - netfilter: ctnetlink: fix dump of the expect mask attribute
    - net: phylink: Fix phylink_err() function name error in
      phylink_major_config
    - tipc: better validate user input in tipc_nl_retrieve_key()
      (CVE-2021-29646)
    - tcp: relookup sock for RST+ACK packets handled by obsolete req sock
    - can: isotp: isotp_setsockopt(): only allow to set low level TX flags for
      CAN-FD
    - can: isotp: TX-path: ensure that CAN frame flags are initialized
    - can: peak_usb: add forgotten supported devices
    - [arm64,armhf] can: flexcan: flexcan_chip_freeze(): fix chip freeze for
      missing bitrate
    - can: c_can_pci: c_can_pci_remove(): fix use-after-free
    - [armhf] can: c_can: move runtime PM enable/disable to c_can_platform
    - mac80211: fix rate mask reset
    - mac80211: Allow HE operation to be longer than expected.
    - nfp: flower: fix unsupported pre_tunnel flows
    - nfp: flower: add ipv6 bit to pre_tunnel control message
    - nfp: flower: fix pre_tun mask id allocation
    - ftrace: Fix modify_ftrace_direct.
    - [arm64] drm/msm/dsi: fix check-before-set in the 7nm dsi_pll code
    - net/sched: cls_flower: fix only mask bit check in the validate_ct_state
    - netfilter: nftables: report EOPNOTSUPP on unsupported flowtable flags
    - netfilter: nftables: allow to update flowtable flags
    - netfilter: flowtable: Make sure GC works periodically in idle system
    - [armhf] dts: imx6ull: fix ubi filesystem mount failed
    - ipv6: weaken the v4mapped source check
    - net: check all name nodes in __dev_alloc_name
    - net: cdc-phonet: fix data-interface release on probe failure
    - igb: check timestamp validity
    - r8152: limit the RX buffer size of RTL8153A for USB 2.0
    - [arm64,armhf] net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes
    - selinux: vsock: Set SID for socket returned by accept()
    - bpf: Fix umd memory leak in copy_process() (CVE-2021-29649)
    - can: isotp: tx-path: zero initialize outgoing CAN frames
    - [arm64] drm/msm: fix shutdown hook in case GPU components failed to bind
    - [arm64] drm/msm: Fix suspend/resume on i.MX5
    - [arm64] kdump: update ppos when reading elfcorehdr
    - PM: runtime: Defer suspending suppliers
    - net/mlx5: Add back multicast stats for uplink representor
    - net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP
    - net/mlx5e: Offload tuple rewrite for non-CT flows
    - net/mlx5e: Fix error path for ethtool set-priv-flag
    - PM: EM: postpone creating the debugfs dir till fs_initcall
    - net: bridge: don't notify switchdev for local FDB addresses
    - [amd64] xen/x86: make XEN_BALLOON_MEMORY_HOTPLUG_LIMIT depend on
      MEMORY_HOTPLUG
    - RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening
      server
    - bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs
    - net: Consolidate common blackhole dst ops
    - net, bpf: Fix ip6ip6 crash with collect_md populated skbs
    - igb: avoid premature Rx buffer reuse
    - net: phy: introduce phydev->port
    - net: phy: broadcom: Avoid forward for bcm54xx_config_clock_delay()
    - net: phy: broadcom: Set proper 1000BaseX/SGMII interface mode for
      BCM54616S
    - net: phy: broadcom: Fix RGMII delays for BCM50160 and BCM50610M
    - Revert "netfilter: x_tables: Switch synchronization to RCU"
    - netfilter: x_tables: Use correct memory barriers. (CVE-2021-29650)
    - dm table: Fix zoned model check and zone sectors check
    - mm/mmu_notifiers: ensure range_end() is paired with range_start()
    - Revert "netfilter: x_tables: Update remaining dereference to RCU"
    - ACPI: scan: Rearrange memory allocation in acpi_device_add()
    - ACPI: scan: Use unique number for instance_no
    - io_uring: fix provide_buffers sign extension
    - block: recalculate segment count for multi-segment discards correctly
    - scsi: Revert "qla2xxx: Make sure that aborted commands are freed"
    - scsi: qedi: Fix error return code of qedi_alloc_global_queues()
    - scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
    - smb3: fix cached file size problems in duplicate extents (reflink)
    - cifs: Adjust key sizes and key generation routines for AES256 encryption
    - locking/mutex: Fix non debug version of mutex_lock_io_nested()
    - mm/memcg: fix 5.10 backport of splitting page memcg
    - fs/cachefiles: Remove wait_bit_key layout dependency
    - can: dev: Move device back to init netns on owning netns delete
    - r8169: fix DMA being used after buffer free if WoL is enabled
    - [armhf] net: dsa: b53: VLAN filtering is global to all users
    - mac80211: fix double free in ibss_leave
    - ext4: add reclaim checks to xattr code
    - fs/ext4: fix integer overflow in s_log_groups_per_flex
    - [amd64] Revert "xen: fix p2m size in dom0 for disabled memory hotplug
      case"
    - Revert "net: bonding: fix error return code of bond_neigh_init()"
    - nvme: fix the nsid value to print in nvme_validate_or_alloc_ns
    - can: peak_usb: Revert "can: peak_usb: add forgotten supported devices"
    - xen-blkback: don't leak persistent grants from xen_blkbk_map()
      (CVE-2021-28688)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.28
    - [arm64] mm: correct the inside linear map range during hotplug check
    - bpf: Fix fexit trampoline.
    - virtiofs: Fail dax mount if device does not support it
    - ext4: shrink race window in ext4_should_retry_alloc()
    - ext4: fix bh ref count on error paths
    - rpc: fix NULL dereference on kmalloc failure
    - iomap: Fix negative assignment to unsigned sis->pages in
      iomap_swapfile_activate
    - [x86] ASoC: rt1015: fix i2c communication error
    - ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10
    - [x86] ASoC: rt5651: Fix dac- and adc- vol-tlv values being off by a factor
      of 10
    - [armhf] ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value
      on probe
    - [x86] ASoC: es8316: Simplify adc_pga_gain_tlv table
    - ASoC: soc-core: Prevent warning if no DMI table is present
    - NFSD: fix error handling in NFSv4.0 callbacks
    - kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for freezing
    - vhost: Fix vhost_vq_reset()
    - io_uring: fix ->flags races by linked timeouts
    - scsi: st: Fix a use after free in st_open()
    - scsi: qla2xxx: Fix broken #endif placement
    - [x86] staging: comedi: cb_pcidas: fix request_irq() warn
    - [x86] staging: comedi: cb_pcidas64: fix request_irq() warn
    - ASoC: rt711: add snd_soc_component remove callback
    - thermal/core: Add NULL pointer check before using cooling device stats
    - locking/ww_mutex: Simplify use_ww_ctx & ww_ctx handling
    - locking/ww_mutex: Fix acquire/release imbalance in
      ww_acquire_init()/ww_acquire_fini()
    - nvmet-tcp: fix kmap leak when data digest in use
    - io_uring: imply MSG_NOSIGNAL for send[msg]()/recv[msg]() calls
    - [x86] static_call: Align static_call_is_init() patching condition
    - ext4: do not iput inode under running transaction in ext4_rename()
    - io_uring: call req_set_fail_links() on short send[msg]()/recv[msg]() with
      MSG_WAITALL
    - [arm64,armhf] net: mvpp2: fix interrupt mask/unmask skip condition
    - flow_dissector: fix TTL and TOS dissection on IPv4 fragments
    - net: introduce CAN specific pointer in the struct net_device
    - brcmfmac: clear EAP/association status bits on linkdown events
    - ath11k: add ieee80211_unregister_hw to avoid kernel crash caused by NULL
      pointer
    - rtw88: coex: 8821c: correct antenna switch function
    - iwlwifi: pcie: don't disable interrupts for reg_lock
    - ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr()
    - [amd64,arm64] net: ethernet: aquantia: Handle error cleanup of start on
      open
    - appletalk: Fix skb allocation size in loopback case
    - net: wan/lmc: unregister device when no matching device is found
    - net: 9p: advance iov on empty read
    - bpf: Remove MTU check in __bpf_skb_max_len
    - ACPI: tables: x86: Reserve memory occupied by ACPI tables
    - ACPI: processor: Fix CPU0 wakeup in acpi_idle_play_dead()
    - ALSA: usb-audio: Apply sample rate quirk to Logitech Connect
    - ALSA: hda: Re-add dropped snd_poewr_change_state() calls
    - ALSA: hda: Add missing sanity checks in PM prepare/complete callbacks
    - ALSA: hda/realtek: fix a determine_headset_type issue for a Dell AIO
    - ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 640 G8
    - [x86] KVM: SVM: load control fields from VMCB12 before checking them
      (CVE-2021-29657)
    - [x86] KVM: SVM: ensure that EFER.SVME is set when running nested guest or
      on nested vmexit
    - PM: runtime: Fix race getting/putting suppliers at probe
    - PM: runtime: Fix ordering in pm_runtime_get_suppliers()
    - tracing: Fix stack trace event size
    - [s390x] vdso: copy tod_steering_delta value to vdso_data page
    - [s390x] vdso: fix tod_steering_delta type
    - mm: fix race by making init_zero_pfn() early_initcall
    - drm/amdgpu: fix offset calculation in amdgpu_vm_bo_clear_mappings()
    - drm/amdgpu: check alignment on CPU page for bo map
    - reiserfs: update reiserfs_xattrs_initialized() condition
    - [armhf] drm/imx: fix memory leak when fails to init
    - [arm64,armhf] drm/tegra: dc: Restore coupling of display controllers
    - [arm64,armhf] drm/tegra: sor: Grab runtime PM reference across reset
    - [arm64,armhf] pinctrl: rockchip: fix restore error in resume
    - extcon: Add stubs for extcon_register_notifier_all() functions
    - extcon: Fix error handling in extcon_dev_register
    - firmware: stratix10-svc: reset COMMAND_RECONFIG_FLAG_PARTIAL to 0
    - [arm64] usb: dwc3: pci: Enable dis_uX_susphy_quirk for Intel Merrifield
    - [x86] video: hyperv_fb: Fix a double free in hvfb_probe
    - firewire: nosy: Fix a use-after-free bug in nosy_ioctl() (CVE-2021-3483)
    - usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control()
    - USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem
    - [arm64,armhf] usb: musb: Fix suspend with devices connected for a64
    - cdc-acm: fix BREAK rx code path adding necessary calls
    - USB: cdc-acm: untangle a circular dependency between callback and softint
    - USB: cdc-acm: downgrade message to debug
    - USB: cdc-acm: fix double free on probe failure
    - USB: cdc-acm: fix use-after-free after probe failure
    - [i386] usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference
    - [arm*] usb: dwc2: Fix HPRT0.PrtSusp bit setting for HiKey 960 board.
    - [arm*] usb: dwc2: Prevent core suspend when port connection flag is 0
    - [arm64] usb: dwc3: qcom: skip interconnect init for ACPI probe
    - [arm64,armhf] usb: dwc3: gadget: Clear DEP flags after stop transfers in
      ep disable
    - soc: qcom-geni-se: Cleanup the code to remove proxy votes
    - [x86] staging: rtl8192e: Fix incorrect source in memcpy()
    - [x86] staging: rtl8192e: Change state information from u16 to u8
    - driver core: clear deferred probe reason on probe retry
    - drivers: video: fbcon: fix NULL dereference in fbcon_cursor()
    - [riscv64] evaluate put_user() arg before enabling user access
    - Revert "kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for
      freezing"
    - [amd64] bpf: Use NOP_ATOMIC5 instead of emit_nops(&prog, 5) for
      BPF_TRAMP_F_CALL_ORIG

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "u64_stats: Disable preemption on 32bit-UP/SMP with RT
    during updates"
  * Bump ABI to 6
  * [rt] Refresh "tracing: Merge irqflags + preempt counter."
  * bpf, x86: Validate computation of branch displacements for x86-64
    (CVE-2021-29154)
  * bpf, x86: Validate computation of branch displacements for x86-32
    (CVE-2021-29154)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 09 Apr 2021 20:17:58 +0200

linux (5.10.26-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.25
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.26
    - ALSA: dice: fix null pointer dereference when node is disconnected
    - ALSA: hda/realtek: apply pin quirk for XiaomiNotebook Pro
    - ALSA: hda: generic: Fix the micmute led init state
    - ALSA: hda/realtek: Apply headset-mic quirks for Xiaomi Redmibook Air
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 840 G8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 440 G8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 850 G8
    - Revert "PM: runtime: Update device status before letting suppliers
      suspend"
    - [s390x] vtime: fix increased steal time accounting
    - [s390x] pci: refactor zpci_create_device()
    - [s390x] pci: remove superfluous zdev->zbus check
    - [s390x] pci: fix leak of PCI device structure
    - zonefs: Fix O_APPEND async write handling
    - zonefs: prevent use of seq files as swap file
    - zonefs: fix to update .i_wr_refcnt correctly in zonefs_open_zone()
    - btrfs: fix race when cloning extent buffer during rewind of an old root
      (CVE-2021-28964)
    - btrfs: fix slab cache flags for free space tree bitmap
    - vhost-vdpa: fix use-after-free of v->config_ctx (CVE-2021-29266)
    - [armhf] ASoC: fsl_ssi: Fix TDM slot setup for I2S mode
    - [x86] ASoC: Intel: bytcr_rt5640: Fix HP Pavilion x2 10-p0XX OVCD current
      threshold
    - [x86] ASoC: SOF: Intel: unregister DMIC device on probe error
    - [x86] ASoC: SOF: intel: fix wrong poll bits in dsp power down
    - ASoC: qcom: sdm845: Fix array out of bounds access (CVE-2021-28952)
    - ASoC: qcom: sdm845: Fix array out of range on rx slim channels
    - [arm64] ASoC: qcom: lpass-cpu: Fix lpass dai ids parse
    - [arm*] ASoC: simple-card-utils: Do not handle device clock
    - afs: Fix accessing YFS xattrs on a non-YFS server
    - afs: Stop listxattr() from listing "afs.*" attributes
    - ALSA: usb-audio: Fix unintentional sign extension issue
    - nvme: fix Write Zeroes limitations
    - nvme-tcp: fix misuse of __smp_processor_id with preemption enabled
    - nvme-tcp: fix possible hang when failing to set io queues
    - nvme-tcp: fix a NULL deref when receiving a 0-length r2t PDU
    - nvmet: don't check iosqes,iocqes for discovery controllers
    - nfsd: Don't keep looking up unhashed files in the nfsd file cache
    - nfsd: don't abort copies early
    - NFSD: Repair misuse of sv_lock in 5.10.16-rt30.
    - NFSD: fix dest to src mount in inter-server COPY
    - svcrdma: disable timeouts on rdma backchannel
    - sunrpc: fix refcount leak for rpc auth modules
    - [x86] i915/perf: Start hrtimer only if sampling the OA buffer
    - pstore: Fix warning in pstore_kill_sb()
    - io_uring: ensure that SQPOLL thread is started for exit (CVE-2021-28951)
    - net/qrtr: fix __netdev_alloc_skb call
    - cifs: fix allocation size on newly created files
    - scsi: lpfc: Fix some error codes in debugfs
    - scsi: myrs: Fix a double free in myrs_cleanup()
    - [riscv64] correct enum sbi_ext_rfence_fid
    - gpiolib: Assign fwnode to parent's if no primary one provided
    - nvme-rdma: fix possible hang when failing to set io queues
    - [armhf] tty: serial: stm32-usart: Remove set but unused 'cookie' variables
    - [armhf] serial: stm32: fix DMA initialization error handling
    - bpf: Declare __bpf_free_used_maps() unconditionally
    - module: merge repetitive strings in module_sig_check()
    - module: avoid *goto*s in module_sig_check()
    - module: harden ELF info handling
    - scsi: pm80xx: Make mpi_build_cmd locking consistent
    - scsi: pm80xx: Make running_req atomic
    - scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition
    - scsi: pm8001: Neaten debug logging macros and uses
    - scsi: libsas: Remove notifier indirection
    - scsi: libsas: Introduce a _gfp() variant of event notifiers
    - scsi: mvsas: Pass gfp_t flags to libsas event notifiers
    - [x86] scsi: isci: Pass gfp_t flags in isci_port_link_down()
    - [x86] scsi: isci: Pass gfp_t flags in isci_port_link_up()
    - [x86] scsi: isci: Pass gfp_t flags in isci_port_bc_change_received()
    - RDMA/mlx5: Allow creating all QPs even when non RDMA profile is used
    - [powerpc*] sstep: Fix load-store and update emulation
    - [powerpc*] sstep: Fix darn emulation
    - i40e: Fix endianness conversions
    - net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8081
    - drm/amd/display: turn DPMS off on connector unplug
    - iwlwifi: Add a new card for MA family
    - io_uring: fix inconsistent lock state
    - [arm64,armhf] media: cedrus: h264: Support profile controls
    - [s390x] qeth: schedule TX NAPI on QAOB completion
    - io_uring: don't attempt IO reissue from the ring exit path
    - io_uring: clear IOCB_WAITQ for non -EIOCBQUEUED return
    - net: bonding: fix error return code of bond_neigh_init()
    - gfs2: Add common helper for holding and releasing the freeze glock
    - gfs2: move freeze glock outside the make_fs_rw and _ro functions
    - gfs2: bypass signal_our_withdraw if no journal
    - [powerpc*] Force inlining of cpu_has_feature() to avoid build failure
    - usb-storage: Add quirk to defeat Kindle's automatic unload
    - usbip: Fix incorrect double assignment to udc->ud.tcp_rx
    - usb: gadget: configfs: Fix KASAN use-after-free
    - [x86] usb: typec: Remove vdo[3] part of tps6598x_rx_identity_reg struct
    - [x86] usb: typec: tcpm: Invoke power_supply_changed for tcpm-source-psy-
    - [arm64,armhf] usb: dwc3: gadget: Allow runtime suspend if UDC unbinded
    - [arm64,armhf] usb: dwc3: gadget: Prevent EP queuing while stopping
      transfers
    - [x86] thunderbolt: Initialize HopID IDAs in tb_switch_alloc()
    - [x86] thunderbolt: Increase runtime PM reference count on DP tunnel
      discovery
    - iio: gyro: mpu3050: Fix error handling in mpu3050_trigger_handler
    - iio: adc: ad7949: fix wrong ADC result due to incorrect bit mask
    - iio: hid-sensor-prox: Fix scale not correct issue
    - iio: hid-sensor-temperature: Fix issues of timestamp channel
    - [powerpc*] PCI: rpadlpar: Fix potential drc_name corruption in store
      functions (CVE-2021-28972)
    - [x86] perf/x86/intel: Fix a crash caused by zero PEBS status
      (CVE-2021-28971)
    - [x86] perf/x86/intel: Fix unchecked MSR access error caused by VLBR_EVENT
    - [x86] ioapic: Ignore IRQ2 again
    - kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()
    - [x86] Move TS_COMPAT back to asm/thread_info.h
    - [x86] Introduce TS_COMPAT_RESTART to fix get_nr_restart_syscall()
    - efivars: respect EFI_UNSUPPORTED return from firmware
    - ext4: fix error handling in ext4_end_enable_verity()
    - ext4: find old entry again if failed to rename whiteout
    - ext4: stop inode update before return
    - ext4: do not try to set xattr into ea_inode if value is empty
    - ext4: fix potential error in ext4_do_update_inode
    - ext4: fix rename whiteout with fast commit
    - static_call: Fix static_call_update() sanity check
    - efi: use 32-bit alignment for efi_guid_t literals
    - firmware/efi: Fix a use after bug in efi_mem_reserve_persistent
    - genirq: Disable interrupts for force threaded handlers
    - [x86] apic/of: Fix CPU devicetree-node lookups
    - cifs: Fix preauth hash corruption

  [ Salvatore Bonaccorso ]
  * linux-image: Add Breaks: relation with old fwupdate versions
    (Closes: #985801)
  * [rt] Update to 5.10.25-rt35
  * Refresh "Include package version along with kernel release in stack
    traces"
  * Refresh "firmware: Remove redundant log messages from drivers"
  * Refresh "MODSIGN: checking the blacklisted hash before loading a kernel
    module"
  * libsas: Avoid ABI change for removal of notifier indirection

  [ Uwe Kleine-König ]
  * [arm64] Enable various configurations for i.MX8 (Closes: #985862)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 27 Mar 2021 15:14:11 +0100

linux (5.10.24-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.20
    - vmlinux.lds.h: add DWARF v5 sections
    - debugfs: be more robust at handling improper input in debugfs_lookup()
    - debugfs: do not attempt to create a new file before the filesystem is
      initalized
    - scsi: libsas: docs: Remove notify_ha_event()
    - scsi: qla2xxx: Fix mailbox Ch erroneous error
    - kdb: Make memory allocations more robust
    - w1: w1_therm: Fix conversion result for negative temperatures
    - [arm64] PCI: qcom: Use PHY_REFCLK_USE_PAD only for ipq8064
    - PCI: Decline to resize resources if boot config must be preserved
    - [x86] virt: vbox: Do not use wait_event_interruptible when called from
      kernel context
    - bfq: Avoid false bfq queue merging
    - ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode
    - [mips*] vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section
    - random: fix the RNDRESEEDCRNG ioctl
    - ALSA: pcm: Call sync_stop at disconnection
    - ALSA: pcm: Assure sync with the pending stop operation at suspend
    - ALSA: pcm: Don't call sync_stop if it hasn't been stopped
    - [arm64] Bluetooth: btqcomsmd: Fix a resource leak in error handling
      paths in the probe function
    - Bluetooth: hci_uart: Fix a race for write_work scheduling
    - Bluetooth: Fix initializing response id after clearing struct
    - [armhf] dts: exynos: correct PMIC interrupt trigger level on Spring
    - [armhf] dts: exynos: correct PMIC interrupt trigger level on Arndale
      Octa
    - Bluetooth: hci_qca: Fix memleak in qca_controller_memdump
    - [arm*] staging: vchiq: Fix bulk userdata handling
    - [arm*] staging: vchiq: Fix bulk transfers on 64-bit builds
    - [arm64,armhf] net: stmmac: dwmac-meson8b: fix enabling the
      timing-adjustment clock
    - bpf: Add bpf_patch_call_args prototype to include/linux/bpf.h
    - bpf: Avoid warning when re-casting __bpf_call_base into
      __bpf_call_base_args
    - [arm64] dts: allwinner: A64: properly connect USB PHY to port 0
    - [arm64] dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz
    - ACPICA: Fix exception code class checks
    - usb: gadget: u_audio: Free requests only after callback
    - Bluetooth: drop HCI device reference before return
    - Bluetooth: Put HCI device if inquiry procedure interrupts
    - [arm*] usb: dwc2: Do not update data length if it is 0 on inbound
      transfers
    - [arm*] usb: dwc2: Abort transaction after errors with unknown reason
    - [arm*] usb: dwc2: Make "trimming xfer length" a debug message
    - staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory
      rules
    - [x86] MSR: Filter MSR writes through X86_IOC_WRMSR_REGS ioctl too
    - [armhf] dts: armada388-helios4: assign pinctrl to LEDs
    - [armhf] dts: armada388-helios4: assign pinctrl to each fan
    - opp: Correct debug message in _opp_add_static_v2()
    - Bluetooth: btusb: Fix memory leak in btusb_mtk_wmt_recv
    - iwlwifi: mvm: set enabled in the PPAG command properly
    - [arm64] optee: simplify i2c access
    - ath10k: Fix suspicious RCU usage warning in
      ath10k_wmi_tlv_parse_peer_stats_info()
    - ath10k: Fix lockdep assertion warning in ath10k_sta_statistics
    - iwlwifi: mvm: fix the type we use in the PPAG table validity checks
    - iwlwifi: mvm: store PPAG enabled/disabled flag properly
    - iwlwifi: mvm: send stored PPAG command instead of local
    - iwlwifi: mvm: assign SAR table revision to the command later
    - iwlwifi: mvm: don't check if CSA event is running before removing
    - bpf_lru_list: Read double-checked variable once without lock
    - iwlwifi: pnvm: set the PNVM again if it was already loaded
    - iwlwifi: pnvm: increment the pointer before checking the TLV
    - bnxt_en: reverse order of TX disable and carrier off
    - bnxt_en: Fix devlink info's stored fw.psid version format.
    - xen/netback: fix spurious event detection for common event case
    - net: phy: consider that suspend2ram may cut off PHY power
    - net/mlx5e: Don't change interrupt moderation params when DIM is enabled
    - net/mlx5e: Change interrupt moderation channel params also when channels
      are closed
    - net/mlx5: Fix health error state handling
    - net/mlx5e: Replace synchronize_rcu with synchronize_net
    - net/mlx5e: kTLS, Use refcounts to free kTLS RX priv context
    - net/mlx5: Disable devlink reload for multi port slave device
    - net/mlx5: Disallow RoCE on multi port slave device
    - net/mlx5: Disallow RoCE on lag device
    - net/mlx5: Disable devlink reload for lag devices
    - net/mlx5e: CT: manage the lifetime of the ct entry object
    - net/mlx5e: Check tunnel offload is required before setting SWP
    - mac80211: fix potential overflow when multiplying to u32 integers
    - libbpf: Ignore non function pointer member in struct_ops
    - bpf: Fix an unitialized value in bpf_iter
    - bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation
    - bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx
    - tcp: fix SO_RCVLOWAT related hangs under mem pressure
    - cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in
      cxgb4 and ulds
    - b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
    - bpf: Clear subreg_def for global function return values
    - [amd64,arm64] net: amd-xgbe: Reset the PHY rx data path when mailbox
      command timeout
    - [amd64,arm64] net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout
      warning
    - [amd64,arm64] net: amd-xgbe: Reset link when the link never comes back
    - [amd64,arm64] net: amd-xgbe: Fix network fluctuations when using 1G
      BELFUSE SFP
    - [arm64,armhf] net: mvneta: Remove per-cpu queue mapping for Armada 3700
    - tty: convert tty_ldisc_ops 'read()' function to take a kernel pointer
    - tty: implement read_iter
    - [x86] drm/gma500: Fix error return code in psb_driver_load()
    - [x86] gma500: clean up error handling in init
    - drm/fb-helper: Add missed unlocks in setcmap_legacy()
    - [arm*] drm/vc4: hdmi: Take into account the clock doubling flag in
      atomic_check
    - [arm64] crypto: arm64/aes-ce - really hide slower algos when faster ones
      are enabled
    - [mips*] c-r4k: Fix section mismatch for loongson2_sc_init
    - drm/virtio: make sure context is created in gem open
    - media: em28xx: Fix use-after-free in em28xx_alloc_urbs
    - media: media/pci: Fix memleak in empress_init
    - [x86] media: tm6000: Fix memleak in tm6000_start_stream
    - sched/fair: Avoid stale CPU util_est value for schedutil in task dequeue
    - [arm64,armhf] drm/sun4i: tcon: fix inverted DCLK polarity
    - [mips*] properly stop .eh_frame generation
    - [arm64,armhf] drm/tegra: Fix reference leak when pm_runtime_get_sync()
      fails
    - bsg: free the request before return error code
    - media: lmedm04: Fix misuse of comma
    - media: qm1d1c0042: fix error return code in qm1d1c0042_init()
    - media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values
    - sched/eas: Don't update misfit status if the task is pinned
    - f2fs: compress: fix potential deadlock
    - [arm64] ASoC: qcom: lpass-cpu: Remove bit clock state check
    - perf/arm-cmn: Fix PMU instance naming
    - perf/arm-cmn: Move IRQs when migrating context
    - mm: proc: Invalidate TLB after clearing soft-dirty page state
    - f2fs: fix to avoid inconsistent quota data
    - f2fs: fix a wrong condition in __submit_bio
    - [arm64] ASoC: qcom: Fix typo error in HDMI regmap config callbacks
    - [x86] KVM: nSVM: Don't strip host's C-bit from guest's CR3 when reading
      PDPTRs
    - [x86] Drivers: hv: vmbus: Avoid use-after-free in
      vmbus_onoffer_rescind()
    - [x86] ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A5E
    - [x86] ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A3E
    - locking/lockdep: Avoid unmatched unlock
    - [arm64] ASoC: qcom: lpass: Fix i2s ctl register bit map
    - btrfs: clarify error returns values in __load_free_space_cache
    - btrfs: fix double accounting of ordered extent for subpage case in
      btrfs_invalidapge
    - [x86] KVM: Restore all 64 bits of DR6 and DR7 during RSM on x86-64
    - [s390x] zcrypt: return EIO when msg retry limit reached
    - [arm*] drm/vc4: hdmi: Move hdmi reset to bind
    - [arm*] drm/vc4: hdmi: Fix register offset with longer CEC messages
    - [arm*] drm/vc4: hdmi: Fix up CEC registers
    - [arm*] drm/vc4: hdmi: Restore cec physical address on reconnect
    - [arm*] drm/vc4: hdmi: Compute the CEC clock divider from the clock rate
    - [arm*] drm/vc4: hdmi: Update the CEC clock divider on HSM rate change
    - drm/dp_mst: Don't cache EDIDs for physical ports
    - crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key()
    - io_uring: fix possible deadlock in io_uring_poll
    - nvme-multipath: set nr_zones for zoned namespaces
    - nvmet: remove extra variable in identify ns
    - nvmet: set status to 0 in case for invalid nsid
    - [armel,armhf] ASoC: simple-card-utils: Fix device module clock
    - fs/jfs: fix potential integer overflow on shift of a int
    - jffs2: fix use after free in jffs2_sum_write_data()
    - smp: Process pending softirqs in flush_smp_call_function_from_idle()
    - capabilities: Don't allow writing ambiguous v3 file capabilities
    - [armhf] HSI: Fix PM usage counter unbalance in ssi_hw_init
    - [arm64,armhf] clk: meson: clk-pll: fix initializing the old rate
      (fallback) for a PLL
    - [arm64,armhf] clk: meson: clk-pll: make "ret" a signed integer
    - [arm64,armhf] clk: meson: clk-pll: propagate the error from
      meson_clk_pll_set_rate()
    - quota: Fix memory leak when handling corrupted quota file
    - [arm64] clk: sunxi-ng: h6: Fix CEC clock
    - HID: core: detect and skip invalid inputs to snto32()
    - fdt: Properly handle "no-map" field in the memory region
    - of/fdt: Make sure no-map does not remove already reserved regions
    - [armhf] spi: imx: Don't print error on -EPROBEDEFER
    - RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation
    - IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex
    - [arm64] clk: sunxi-ng: h6: Fix clock divider range on some clocks
    - [arm64,armhf] platform/chrome: cros_ec_proto: Use EC_HOST_EVENT_MASK not
      BIT
    - [arm64,armhf] platform/chrome: cros_ec_proto: Add LID and BATTERY to
      default mask
    - [arm64,armhf] regulator: axp20x: Fix reference cout leak
    - watch_queue: Drop references to /dev/watch_queue
    - certs: Fix blacklist flag type confusion
    - [armhf] regulator: s5m8767: Fix reference count leak
    - [armhf] regulator: s5m8767: Drop regulators OF node reference
    - [arm64,armhf] power: supply: axp20x_usb_power: Init work before enabling
      IRQs
    - regulator: core: Avoid debugfs: Directory ... already present! error
    - isofs: release buffer head before return
    - objtool: Fix error handling for STD/CLD warnings
    - objtool: Fix retpoline detection in asm code
    - objtool: Fix ".cold" section suffix check for newer versions of GCC
    - scsi: lpfc: Fix ancient double free
    - iommu: Switch gather->end to the inclusive end
    - IB/umad: Return EIO in case of when device disassociated
    - IB/umad: Return EPOLLERR in case of when device disassociated
    - [ppc64el] KVM: Make the VMX instruction emulation routines static
    - [powerpc*] time: Enable sched clock for irqtime
    - [armel,armhf] 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+
      cores
    - [arm*] amba: Fix resource leak for drivers without .remove
    - iommu: Move iotlb_sync_map out from __iommu_map
    - iommu: Properly pass gfp_t in _iommu_map() to avoid atomic sleeping
    - IB/mlx5: Return appropriate error code instead of ENOMEM
    - IB/cm: Avoid a loop when device has 255 ports
    - tracepoint: Do not fail unregistering a probe due to memory failure
    - perf tools: Fix DSO filtering when not finding a map for a sampled
      address
    - perf vendor events arm64: Fix Ampere eMag event typo
    - RDMA/rxe: Fix coding error in rxe_recv.c
    - RDMA/rxe: Fix coding error in rxe_rcv_mcast_pkt
    - RDMA/rxe: Correct skb on loopback path
    - [powerpc*] pseries/dlpar: handle ibm, configure-connector delay status
    - [arm64] RDMA/hns: Fixed wrong judgments in the goto branch
    - [arm64] RDMA/hns: Fix type of sq_signal_bits
    - [arm64] RDMA/hns: Disable RQ inline by default
    - clk: divider: fix initialization with parent_hw
    - [amd64] spi: pxa2xx: Fix the controller numbering for Wildcat Point
    - [powerpc*] uaccess: Avoid might_fault() when user access is enabled
    - [powerpc*] kuap: Restore AMR after replaying soft interrupts
    - perf symbols: Use (long) for iterator for bfd symbols
    - spi: Skip zero-length transfers in spi_transfer_one_message()
    - printk: avoid prb_first_valid_seq() where possible
    - perf symbols: Fix return value when loading PE DSO
    - nfsd: register pernet ops last, unregister first
    - svcrdma: Hold private mutex while invoking rdma_accept()
    - ceph: fix flush_snap logic after putting caps
    - [arm64] RDMA/hns: Fixes missing error code of CMDQ
    - RDMA/ucma: Fix use-after-free bug in ucma_create_uevent
    - Input: sur40 - fix an error code in sur40_probe()
    - perf record: Fix continue profiling after draining the buffer
    - perf intel-pt: Fix missing CYC processing in PSB
    - perf intel-pt: Fix premature IPC
    - perf intel-pt: Fix IPC with CYC threshold
    - perf test: Fix unaligned access in sample parsing test
    - Input: elo - fix an error code in elo_connect()
    - [arm64,armhf] phy: rockchip-emmc: emmc_phy_init() always return 0
    - [arm64,armhf] pwm: rockchip: Enable APB clock during register access
      while probing
    - [arm64,armhf] pwm: rockchip: rockchip_pwm_probe(): Remove superfluous
      clk_unprepare()
    - [arm64,armhf] pwm: rockchip: Eliminate potential race condition when
      probing
    - [x86] VMCI: Use set_page_dirty_lock() when unregistering guest memory
    - PCI: Align checking of syscall user config accessors
    - [x86] mei: hbm: call mei_set_devstate() on hbm stop response
    - [arm64] drm/msm: Fix MSM_INFO_GET_IOVA with carveout
    - [arm64] drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY)
    - [arm64] drm/msm/mdp5: Fix wait-for-commit for cmd panels
    - [arm64] drm/msm: Fix race of GPU init vs timestamp power management.
    - [arm64] drm/msm: Fix races managing the OOB state for timestamp vs
      timestamps.
    - [arm64] drm/msm/dp: trigger unplug event in msm_dp_display_disable
    - [amd64,arm64] vfio/iommu_type1: Populate full dirty when detach
      non-pinned group
    - [amd64,arm64] vfio/iommu_type1: Fix some sanity checks in detach group
    - ext4: fix potential htree index checksum corruption
    - nvmem: core: Fix a resource leak on error in nvmem_add_cells_from_of()
    - nvmem: core: skip child nodes not matching binding
    - soundwire: bus: use sdw_update_no_pm when initializing a device
    - soundwire: bus: use sdw_write_no_pm when setting the bus scale registers
    - soundwire: export sdw_write/read_no_pm functions
    - soundwire: bus: fix confusion on device used by pm_runtime
    - ext: EXT4_KUNIT_TESTS should depend on EXT4_FS instead of selecting it
    - PCI: pci-bridge-emul: Fix array overruns, improve safety
    - i40e: Fix flow for IPv6 next header (extension header)
    - i40e: Add zero-initialization of AQ command structures
    - i40e: Fix overwriting flow control settings during driver loading
    - i40e: Fix addition of RX filters after enabling FW LLDP agent
    - i40e: Fix VFs not created
    - Take mmap lock in cacheflush syscall
    - i40e: Fix add TC filter for IPv6
    - [amd64,arm64] vfio/type1: Use follow_pte()
    - ice: report correct max number of TCs
    - ice: Account for port VLAN in VF max packet size calculation
    - ice: Fix state bits on LLDP mode switch
    - ice: update the number of available RSS queues
    - [arm64,armhf] net: stmmac: fix CBS idleslope and sendslope calculation
    - net/mlx4_core: Add missed mlx4_free_cmd_mailbox()
    - [arm64] PCI: rockchip: Make 'ep-gpios' DT property optional
    - vxlan: move debug check after netdev unregister
    - wireguard: device: do not generate ICMP for non-IP packets
    - wireguard: kconfig: use arm chacha even with no neon
    - ocfs2: fix a use after free on error
    - mm: memcontrol: fix NR_ANON_THPS accounting in charge moving
    - mm: memcontrol: fix slub memory accounting
    - mm/memory.c: fix potential pte_unmap_unlock pte error
    - mm/hugetlb: fix potential double free in hugetlb_register_node() error
      path
    - mm/hugetlb: suppress wrong warning info when alloc gigantic page
    - mm/compaction: fix misbehaviors of fast_find_migrateblock()
    - NFSv4: Fixes for nfs4_bitmask_adjust()
    - [x86] KVM: SVM: Intercept INVPCID when it's disabled to inject #UD
    - [x86] KVM: x86/mmu: Expand collapsible SPTE zap for TDP MMU to
      ZONE_DEVICE and HugeTLB pages
    - [arm64] Add missing ISB after invalidating TLB in __primary_switch
    - [armhf] i2c: exynos5: Preserve high speed master code
    - mm,thp,shmem: make khugepaged obey tmpfs mount flags
    - mm: fix memory_failure() handling of dax-namespace metadata
    - mm/rmap: fix potential pte_unmap on an not mapped pte
    - proc: use kvzalloc for our kernel buffer
    - scsi: sd: sd_zbc: Don't pass GFP_NOIO to kvcalloc
    - block: reopen the device in blkdev_reread_part
    - scsi: sd: Fix Opal support
    - blk-settings: align max_sectors on "logical_block_size" boundary
    - ACPI: property: Fix fwnode string properties matching
    - ACPI: configfs: add missing check after
      configfs_register_default_group()
    - cpufreq: ACPI: Set cpuinfo.max_freq directly if max boost is known
    - HID: logitech-dj: add support for keyboard events in eQUAD step 4 Gaming
    - HID: wacom: Ignore attempts to overwrite the touch_max value from HID
    - Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox
      Series X|S
    - Input: joydev - prevent potential read overflow in ioctl
    - Input: i8042 - add ASUS Zenbook Flip to noselftest list
    - media: mceusb: Fix potential out-of-bounds shift
    - USB: serial: option: update interface mapping for ZTE P685M
    - [arm64,armhf] usb: musb: Fix runtime PM race in musb_queue_resume_work
    - [arm64,armhf] usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1
    - [arm64,armhf] usb: dwc3: gadget: Fix dep->interval for fullspeed
      interrupt
    - USB: serial: ftdi_sio: fix FTX sub-integer prescaler
    - USB: serial: pl2303: fix line-speed handling on newer chips
    - USB: serial: mos7840: fix error code in mos7840_write()
    - USB: serial: mos7720: fix error code in mos7720_write()
    - ALSA: hda: Add another CometLake-H PCI ID
    - ALSA: hda/hdmi: Drop bogus check at closing a stream
    - ALSA: hda/realtek: modify EAPD in the ALC886
    - ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup
    - [mips*] Ingenic: Disable HPTLB for D0 XBurst CPUs too
    - [mips*] Revert "MIPS: Octeon: Remove special handling of
      CONFIG_MIPS_ELF_APPENDED_DTB=y"
    - Revert "bcache: Kill btree_io_wq"
    - bcache: Give btree_io_wq correct semantics again
    - bcache: Move journal work to new flush wq
    - drm/amdgpu: Set reference clock to 100Mhz on Renoir (v2)
    - drm/nouveau/kms: handle mDP connectors
    - drm/modes: Switch to 64bit maths to avoid integer overflow
    - drm/sched: Cancel and flush all outstanding jobs before finish.
    - selinux: fix inconsistency between inode_getxattr and inode_listsecurity
    - tpm_tis: Fix check_locality for correct locality acquisition
    - tpm_tis: Clean up locality release
    - KEYS: trusted: Fix incorrect handling of tpm_get_random()
    - KEYS: trusted: Fix migratable=1 failing
    - KEYS: trusted: Reserve TPM for seal and unseal operations
    - btrfs: do not cleanup upper nodes in btrfs_backref_cleanup_node
    - btrfs: do not warn if we can't find the reloc root when looking up
      backref
    - btrfs: add asserts for deleting backref cache nodes
    - btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root
    - btrfs: fix reloc root leak with 0 ref reloc roots on recovery
    - btrfs: splice remaining dirty_bg's onto the transaction dirty bg list
    - btrfs: handle space_info::total_bytes_pinned inside the delayed ref
      itself
    - btrfs: account for new extents being deleted in total_bytes_pinned
    - btrfs: fix extent buffer leak on failure to copy root
    - [arm64] crypto: arm64/sha - add missing module aliases
    - [x86] crypto: aesni - prevent misaligned buffers on the stack
    - crypto: michael_mic - fix broken misalignment handling
    - seccomp: Add missing return in non-void function
    - [arm64] ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)
    - misc: rtsx: init of rts522a add OCP power off when no card is present
    - [x86] drivers/misc/vmw_vmci: restrict too big queue size in
      qp_host_alloc_queue
    - pstore: Fix typo in compression option name
    - staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table
    - floppy: reintroduce O_NDELAY fix
    - media: marvell-ccic: power up the device on mclk enable
    - media: smipcie: fix interrupt handling and IR timeout
    - [x86] virt: Eat faults on VMXOFF in reboot flows
    - [x86] reboot: Force all cpus to exit VMX root if VMX is supported
    - [x86] fault: Fix AMD erratum #91 errata fixup for user code
    - [x86] entry: Fix instrumentation annotation
    - [powerpc*] prom: Fix "ibm,arch-vec-5-platform-support" scan
    - rcu: Pull deferred rcuog wake up to rcu_eqs_enter() callers
    - rcu/nocb: Perform deferred wake up before last idle's need_resched()
      check
    - kprobes: Fix to delay the kprobes jump optimization
    - [arm64] Extend workaround for erratum 1024718 to all versions of
      Cortex-A55
    - [arm64] uprobe: Return EOPNOTSUPP for AARCH32 instruction probing
    - [arm64] module: set plt* section addresses to 0x0
    - [arm64] spectre: Prevent lockdep splat on v4 mitigation enable path
    - [arm64] watchdog: qcom: Remove incorrect usage of QCOM_WDT_ENABLE_IRQ
    - [x86] watchdog: mei_wdt: request stop on unregister
    - fs/affs: release old buffer head on error path
    - seq_file: document how per-entry resources are managed.
    - [x86] fix seq_file iteration for pat/memtype.c
    - mm: memcontrol: fix swap undercounting in cgroup2
    - mm: memcontrol: fix get_active_memcg return value
    - hugetlb: fix update_and_free_page contig page struct assumption
    - hugetlb: fix copy_huge_page_from_user contig page struct assumption
    - mm/vmscan: restore zone_reclaim_mode ABI
    - mm, compaction: make fast_isolate_freepages() stay within zone
    - [x86] KVM: nSVM: fix running nested guests when npt=0
    - nvmem: qcom-spmi-sdam: Fix uninitialized pdev pointer
    - module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols
    - [armhf] mmc: sdhci-esdhc-imx: fix kernel panic when remove module
    - mmc: sdhci-pci-o2micro: Bug fix for SDR104 HW tuning failure
    - [arm64] spmi: spmi-pmic-arb: Fix hw_irq overflow
    - [x86] mei: fix transfer over dma with extended header
    - [x86] mei: me: emmitsburg workstation DID
    - [x86] mei: me: add adler lake point S DID
    - [x86] mei: me: add adler lake point LP DID
    - [armhf] gpio: pcf857x: Fix missing first interrupt
    - printk: fix deadlock when kernel panic
    - exfat: fix shift-out-of-bounds in exfat_fill_super()
    - zonefs: Fix file size of zones in full condition
    - [x86] cpufreq: intel_pstate: Change intel_pstate_get_hwp_max() argument
    - [x86] cpufreq: intel_pstate: Get per-CPU max freq via
      MSR_HWP_CAPABILITIES if available
    - proc: don't allow async path resolution of /proc/thread-self components
    - [s390x] vtime: fix inline assembly clobber list
    - [s390x] virtio/s390: implement virtio-ccw revision 2 correctly
    - f2fs: fix out-of-repair __setattr_copy()
    - f2fs: enforce the immutable flag on open files
    - f2fs: flush data when enabling checkpoint back
    - gfs2: fix glock confusion in function signal_our_withdraw
    - gfs2: Don't skip dlm unlock if glock has an lvb
    - gfs2: Lock imbalance on error path in gfs2_recover_one
    - gfs2: Recursive gfs2_quota_hold in gfs2_iomap_end
    - dm: fix deadlock when swapping to encrypted device
    - dm table: fix iterate_devices based device capability checks
    - dm table: fix DAX iterate_devices based device capability checks
    - dm table: fix zoned iterate_devices based device capability checks
    - dm writecache: fix performance degradation in ssd mode
    - dm writecache: return the exact table values that were set
    - dm writecache: fix writing beyond end of underlying device when
      shrinking
    - dm era: Recover committed writeset after crash
    - dm era: Update in-core bitset after committing the metadata
    - dm era: Verify the data block size hasn't changed
    - dm era: Fix bitset memory leaks
    - dm era: Use correct value size in equality function of writeset tree
    - dm era: Reinitialize bitset cache before digesting a new writeset
    - dm era: only resize metadata in preresume
    - kgdb: fix to kill breakpoints on initmem after boot
    - ipv6: silence compilation warning for non-IPV6 builds
    - net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
    - wireguard: queueing: get rid of per-peer ring buffers
    - net: sched: fix police ext initialization
    - net_sched: fix RTNL deadlock again caused by request_module()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.21
    - net: usb: qmi_wwan: support ZTE P685M modem
    - Input: elantech - fix protocol errors for some trackpoints in SMBus mode
    - Input: elan_i2c - add new trackpoint report type 0x5F
    - drm/virtio: use kvmalloc for large allocations
    - [x86] build: Treat R_386_PLT32 relocation as R_386_PC32
    - JFS: more checks for invalid superblock
    - sched/core: Allow try_invoke_on_locked_down_task() with irqs disabled
    - udlfb: Fix memory leak in dlfb_usb_probe
    - media: mceusb: sanity check for prescaler value
    - erofs: fix shift-out-of-bounds of blkszbits
    - media: v4l2-ctrls.c: fix shift-out-of-bounds in std_validate
    - xfs: Fix assert failure in xfs_setattr_size()
    - [s390x] net/af_iucv: remove WARN_ONCE on malformed RX packets
    - tomoyo: ignore data race while checking quota
    - net: fix up truesize of cloned skb in skb_prepare_for_shift()
    - [riscv64] Get rid of MAX_EARLY_MAPPING_SIZE
    - nbd: handle device refs for DESTROY_ON_DISCONNECT properly
    - mm/hugetlb.c: fix unnecessary address expansion of pmd sharing
    - tcp: fix tcp_rmem documentation
    - net: bridge: use switchdev for port flags set through sysfs too
    - net/sched: cls_flower: Reject invalid ct_state flags rules
    - net: psample: Fix netlink skb length with tunnel info
    - net: fix dev_ifsioc_locked() race condition
    - dt-bindings: ethernet-controller: fix fixed-link specification
    - dt-bindings: net: btusb: DT fix s/interrupt-name/interrupt-names/
    - [arm64] ASoC: qcom: Remove useless debug print
    - rsi: Fix TX EAPOL packet handling against iwlwifi AP
    - rsi: Move card interrupt handling to RX thread
    - [x86] EDAC/amd64: Do not load on family 0x15, model 0x13
    - [x86] reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk
    - vt/consolemap: do font sum unsigned
    - [arm64,armhf] wlcore: Fix command execute failure 19 for wl12xx
    - Bluetooth: hci_h5: Set HCI_QUIRK_SIMULTANEOUS_DISCOVERY for btrtl
    - Bluetooth: btusb: fix memory leak on suspend and resume
    - pktgen: fix misuse of BUG_ON() in pktgen_thread_worker()
    - ath10k: fix wmi mgmt tx queue full due to race condition
    - net: sfp: add mode quirk for GPON module Ubiquiti U-Fiber Instant
    - Bluetooth: Add new HCI_QUIRK_NO_SUSPEND_NOTIFIER quirk
    - Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data
    - [arm*] staging: bcm2835-audio: Replace unsafe strcpy() with strscpy()
    - brcmfmac: Add DMI nvram filename quirk for Predia Basic tablet
    - brcmfmac: Add DMI nvram filename quirk for Voyo winpad A15 tablet
    - [arm64] drm/hisilicon: Fix use-after-free
    - crypto: tcrypt - avoid signed overflow in byte count
    - fs: make unlazy_walk() error handling consistent
    - drm/amdgpu: Add check to prevent IH overflow
    - PCI: Add a REBAR size quirk for Sapphire RX 5600 XT Pulse
    - [x86] ASoC: Intel: bytcr_rt5640: Add new BYT_RT5640_NO_SPEAKERS
      quirk-flag
    - media: uvcvideo: Allow entities with no pads
    - f2fs: handle unallocated section and zone on pinned/atgc
    - f2fs: fix to set/clear I_LINKABLE under i_lock
    - nvme-core: add cancel tagset helpers
    - nvme-rdma: add clean action for failed reconnection
    - nvme-tcp: add clean action for failed reconnection
    - ASoC: Intel: Add DMI quirk table to soc_intel_is_byt_cr()
    - btrfs: fix error handling in commit_fs_roots
    - [x86] perf/x86/kvm: Add Cascade Lake Xeon steppings to
      isolation_ucodes[]
    - [x86] ASoC: Intel: sof-sdw: indent and add quirks consistently
    - [x86] ASoC: Intel: sof_sdw: detect DMIC number based on mach params
    - sched/features: Fix hrtick reprogramming
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Estar Beauty HD MID
      7316R tablet
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Voyo Winpad A15
      tablet
    - [x86] ASoC: Intel: bytcr_rt5651: Add quirk for the Jumper EZpad 7 tablet
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Acer One S1002 tablet
    - scsi: iscsi: Restrict sessions and handles to admin capabilities
      (CVE-2021-27363, CVE-2021-27364)
    - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE
      (CVE-2021-27365)
    - scsi: iscsi: Verify lengths on passthrough PDUs (CVE-2021-27365)
    - Xen/gnttab: handle p2m update errors on a per-slot basis
      (CVE-2021-28038)
    - xen-netback: respect gnttab_map_refs()'s return value (CVE-2021-28038)
    - xen: fix p2m size in dom0 for disabled memory hotplug case
      (CVE-2021-28039)
    - zsmalloc: account the number of compacted pages correctly
    - swap: fix swapfile read/write offset
    - [powerpc*] sstep: Check instruction validity against ISA version before
      emulation
    - [powerpc*] sstep: Fix incorrect return from analyze_instr()
    - tty: fix up iterate_tty_read() EOVERFLOW handling
    - tty: fix up hung_up_tty_read() conversion
    - tty: clean up legacy leftovers from n_tty line discipline
    - tty: teach n_tty line discipline about the new "cookie continuations"
    - tty: teach the n_tty ICANON case about the new "cookie continuations"
      too
    - media: v4l: ioctl: Fix memory leak in video_usercopy
    - ALSA: hda/realtek: Add quirk for Clevo NH55RZQ
    - ALSA: hda/realtek: Add quirk for Intel NUC 10
    - ALSA: hda/realtek: Apply dual codec quirks for MSI Godlike X570 board
    - net: sfp: VSOL V2801F / CarlitoxxPro CPGOS03-0490 v2.0 workaround
    - net: sfp: add workaround for Realtek RTL8672 and RTL9601C chips
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.22
    - ALSA: hda/realtek: Enable headset mic of Acer SWIFT with ALC256
    - ALSA: usb-audio: Drop bogus dB range in too low level
    - tpm, tpm_tis: Decorate tpm_tis_gen_interrupt() with request_locality()
    - tpm, tpm_tis: Decorate tpm_get_timeouts() with request_locality()
    - btrfs: avoid double put of block group when emptying cluster
    - btrfs: fix raid6 qstripe kmap
    - btrfs: fix race between writes to swap files and scrub
    - btrfs: fix race between swap file activation and snapshot creation
    - btrfs: fix stale data exposure after cloning a hole with NO_HOLES
      enabled
    - btrfs: fix race between extent freeing/allocation when using bitmaps
    - btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl
    - btrfs: free correct amount of space in
      btrfs_delayed_inode_reserve_metadata
    - btrfs: unlock extents in btrfs_zero_range in case of quota reservation
      errors
    - btrfs: fix warning when creating a directory with smack enabled
    - PM: runtime: Update device status before letting suppliers suspend
    - ring-buffer: Force before_stamp and write_stamp to be different on
      discard
    - io_uring: ignore double poll add on the same waitqueue head
    - dm bufio: subtract the number of initial sectors in
      dm_bufio_get_device_size
    - drm/amdgpu:disable VCN for Navi12 SKU
    - drm/amdgpu: fix parameter error of RREG32_PCIE() in amdgpu_regs_pcie
    - [arm64] mm: Move reserve_crashkernel() into mem_init()
    - [arm64] mm: Move zone_dma_bits initialization into zone_sizes_init()
    - of/address: Introduce of_dma_get_max_cpu_address()
    - [arm64] mm: Set ZONE_DMA size based on devicetree's dma-ranges
    - [arm64] mm: Set ZONE_DMA size based on early IORT scan
    - ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits
    - RDMA/cm: Fix IRQ restore in ib_send_cm_sidr_rep
    - IB/mlx5: Add missing error code
    - ALSA: hda: intel-nhlt: verify config type
    - ftrace: Have recordmcount use w8 to read relp->r_info in
      arm64_is_fake_mcount
    - rsxx: Return -EFAULT if copy_to_user() fails
    - [amd64] iommu/vt-d: Fix status code for Allocate/Free PASID command
    - tomoyo: recognize kernel threads correctly
    - r8169: fix resuming from suspend on RTL8105e if machine runs on battery
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.23
    - ACPICA: Fix race in generic_serial_bus (I2C) and GPIO op_region
      parameter handling
    - nvme-pci: mark Kingston SKC2000 as not supporting the deepest power
      state
    - btrfs: export and rename qgroup_reserve_meta
    - btrfs: don't flush from btrfs_delayed_inode_reserve_metadata
    - [amd64] iommu/amd: Fix sleeping in atomic in increase_address_space()
    - Bluetooth: btqca: Add valid le states quirk
    - mwifiex: pcie: skip cancel_work_sync() on reset failure path
    - [x86] ASoC: Intel: sof_sdw: add quirk for new TigerLake-SDCA device
    - [armhf] bus: ti-sysc: Implement GPMC debug quirk to drop platform data
    - [x86] platform/x86: acer-wmi: Cleanup ACER_CAP_FOO defines
    - [x86] platform/x86: acer-wmi: Cleanup accelerometer device handling
    - [x86] platform/x86: acer-wmi: Add new force_caps module parameter
    - [x86] platform/x86: acer-wmi: Add ACER_CAP_SET_FUNCTION_MODE capability
      flag
    - [x86] platform/x86: acer-wmi: Add support for SW_TABLET_MODE on Switch
      devices
    - [x86] platform/x86: acer-wmi: Add ACER_CAP_KBD_DOCK quirk for the Aspire
      Switch 10E SW3-016
    - HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube
      Adapter
    - media: cx23885: add more quirks for reset DMA on some AMD IOMMU
    - [x86] ACPI: video: Add DMI quirk for GIGABYTE GB-BXBT-2807
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for ARCHOS Cesium 140
    - PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller
    - [x86] KVM: x86: Supplement __cr4_reserved_bits() with X86_FEATURE_PCID
      check
    - [x86] ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A32
    - scsi: ufs: Add a quirk to permit overriding UniPro defaults
    - misc: eeprom_93xx46: Add quirk to support Microchip 93LC46B eeprom
    - scsi: ufs: Introduce a quirk to allow only page-aligned sg entries
    - [arm64] drm/msm/a5xx: Remove overwriting A5XX_PC_DBG_ECO_CNTL register
    - HID: i2c-hid: Add I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for ITE8568 EC on
      Voyo Winpad A15
    - ALSA: usb-audio: Add DJM750 to Pioneer mixer quirk
    - ALSA: usb-audio: add mixer quirks for Pioneer DJM-900NXS2
    - [x86] ASoC: Intel: sof_sdw: reorganize quirks by generation
    - [x86] ASoC: Intel: sof_sdw: add quirk for HP Spectre x360 convertible
    - [x86] KVM: SVM: Clear the CR4 register on reset
    - nvme-pci: mark Seagate Nytro XM1440 as QUIRK_NO_NS_DESC_LIST.
    - nvme-pci: add quirks for Lexar 256GB SSD
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.24
    - uapi: nfnetlink_cthelper.h: fix userspace compilation error
    - [powerpc*] perf: Fix handling of privilege level checks in perf interrupt
      context
    - [powerpc*] pseries: Don't enforce MSI affinity with kdump
    - ethernet: alx: fix order of calls on resume (Closes: #983595)
    - [mips*] crypto: mips/poly1305 - enable for all MIPS processors
    - ath9k: fix transmitting to stations in dynamic SMPS mode
    - net: Fix gro aggregation for udp encaps with zero csum
    - net: check if protocol extracted by virtio_net_hdr_set_proto is correct
    - net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0
    - net: l2tp: reduce log level of messages in receive path, add counter
      instead
    - can: skb: can_skb_set_owner(): fix ref counting if socket was closed
      before setting skb ownership
    - [armhf] can: flexcan: assert FRZ bit in flexcan_chip_freeze()
    - [armhf] can: flexcan: enable RX FIFO after FRZ/HALT valid
    - [armhf] can: flexcan: invoke flexcan_chip_freeze() to enter freeze mode
    - tcp: Fix sign comparison bug in getsockopt(TCP_ZEROCOPY_RECEIVE)
    - tcp: add sanity tests to TCP_QUEUE_SEQ
    - netfilter: nf_nat: undo erroneous tcp edemux lookup
    - netfilter: x_tables: gpf inside xt_find_revision()
    - net: always use icmp{,v6}_ndo_send from ndo_start_xmit
    - net: phy: fix save wrong speed and duplex problem if autoneg is on
    - mt76: dma: do not report truncated frames to mac80211
    - [powerpc*] 603: Fix protection of user pages mapped with PROT_NONE
    - mount: fix mounting of detached mounts onto targets that reside on shared
      mounts
    - cifs: return proper error code in statfs(2)
    - Revert "mm, slub: consider rest of partial list if acquire_slab() fails"
    - docs: networking: drop special stable handling
    - [arm64] net: enetc: don't overwrite the RSS indirection table when
      initializing
    - [arm64] net: enetc: take the MDIO lock only once per NAPI poll cycle
    - [arm64] net: enetc: fix incorrect TPID when receiving 802.1ad tagged
      packets
    - [arm64] net: enetc: don't disable VLAN filtering in IFF_PROMISC mode
    - [arm64] net: enetc: force the RGMII speed and duplex instead of operating
      in inband mode
    - [arm64] net: enetc: remove bogus write to SIRXIDR from enetc_setup_rxbdr
    - [arm64] net: enetc: keep RX ring consumer index in sync with hardware
    - net/mlx4_en: update moderation when config reset
    - net: stmmac: fix incorrect DMA channel intr enable setting of EQoS v4.10
    - nexthop: Do not flush blackhole nexthops when loopback goes down
    - net: sched: avoid duplicates in classes dump
    - [arm64] net: mscc: ocelot: properly reject destination IP keys in VCAP IS1
    - net: usb: qmi_wwan: allow qmimux add/del with master up
    - cipso,calipso: resolve a number of problems with the DOI refcounts
    - net: stmmac: Fix VLAN filter delete timeout issue in Intel mGBE SGMII
    - [x86] stmmac: intel: Fixes clock registration error seen for multiple
      interfaces
    - [arm64] net: enetc: allow hardware timestamping on TX queues with tc-etf
      enabled
    - net: qrtr: fix error return code of qrtr_sendmsg()
    - [s390x] qeth: fix memory leak after failed TX Buffer allocation
    - r8169: fix r8168fp_adjust_ocp_cmd function
    - ixgbe: fail to create xfrm offload of IPsec tunnel mode SA
    - net: stmmac: stop each tx channel independently
    - net: stmmac: fix watchdog timeout during suspend/resume stress test
    - net: stmmac: fix wrongly set buffer2 valid when sph unsupport
    - ethtool: fix the check logic of at least one channel for RX/TX
    - net: phy: make mdio_bus_phy_suspend/resume as __maybe_unused
    - perf traceevent: Ensure read cmdlines are null terminated.
    - perf report: Fix -F for branch & mem modes
    - [arm64] net: hns3: fix query vlan mask value error for flow director
    - [arm64] net: hns3: fix bug when calculating the TCAM table info
    - bnxt_en: reliably allocate IRQ table on reset to avoid crash
    - gpiolib: acpi: Add ACPI_GPIO_QUIRK_ABSOLUTE_NUMBER quirk
    - gpiolib: acpi: Allow to find GpioInt() resource by name and index
    - [arm64,armhf] gpio: pca953x: Set IRQ type when handle Intel Galileo Gen 2
    - gpio: fix gpio-device list corruption
    - drm/compat: Clear bounce structures
    - drm/amd/display: Add a backlight module option
    - drm/amd/display: Fix nested FPU context in dcn21_validate_bandwidth()
    - drm/shmem-helper: Check for purged buffers in fault handler
    - drm/shmem-helper: Don't remove the offset in vm_area_struct pgoff
    - drm: Use USB controller's DMA mask when importing dmabufs
    - [arm64] drm: meson_drv add shutdown function
    - drm/shmem-helpers: vunmap: Don't put pages for dma-buf
    - [x86] drm/i915: Wedge the GPU if command parser setup fails
    - qxl: Fix uninitialised struct field head.surface_id
    - media: usbtv: Fix deadlock on suspend
    - media: rc: compile rc-cec.c into rc-core
    - cifs: fix credit accounting for extra channel
    - [arm64] net: hns3: fix error mask definition of flow director
    - [s390x] qeth: don't replace a fully completed async TX buffer
    - [s390x] qeth: remove QETH_QDIO_BUF_HANDLED_DELAYED state
    - [s390x] qeth: improve completion of pending TX buffers
    - [s390x] qeth: fix notification for pending buffers during teardown
    - [arm64,armhf] net: dsa: implement a central TX reallocation procedure
    - [arm64,armhf] net: dsa: trailer: don't allocate additional memory for
      padding/tagging
    - [arm64] net: dsa: tag_ocelot: let DSA core deal with TX reallocation
    - [arm64,armhf] net: dsa: tag_edsa: let DSA core deal with TX reallocation
    - [armhf] net: dsa: tag_brcm: let DSA core deal with TX reallocation
    - [arm64,armhf] net: dsa: tag_dsa: let DSA core deal with TX reallocation
    - [arm64] enetc: Fix unused var build warning for CONFIG_OF
    - [arm64] net: enetc: initialize RFS/RSS memories for unused ports too
    - ath11k: peer delete synchronization with firmware
    - ath11k: start vdev if a bss peer is already created
    - ath11k: fix AP mode for QCA6390
    - scsi: ufs: WB is only available on LUN #0 to #7
    - udf: fix silent AED tagLocation corruption
    - [amd64] iommu/vt-d: Clear PRQ overflow only when PRQ is empty
    - [arm*] mmc: sdhci-iproc: Add ACPI bindings for the RPi
    - Platform: OLPC: Fix probe error handling
    - [powerpc*] pci: Add ppc_md.discover_phbs()
    - [armhf] spi: stm32: make spurious and overrun interrupts visible
    - [powerpc] improve handling of unrecoverable system reset
    - [powerpc] perf: Record counter overflow always if SAMPLE_IP is unset
    - HID: logitech-dj: add support for the new lightspeed connection iteration
    - [powerpc*] 64: Fix stack trace not displaying final frame
    - [amd64] iommu/amd: Fix performance counter initialization
    - [arm64] clk: qcom: gdsc: Implement NO_RET_PERIPH flag
    - [x86] Input: applespi - don't wait for responses to commands indefinitely.
    - [arm64] PCI: xgene-msi: Fix race in installing chained irq handler
    - ext4: don't try to processed freed blocks until mballoc is initialized
    - kbuild: clamp SUBLEVEL to 255
    - PCI: Fix pci_register_io_range() memory leak
    - i40e: Fix memory leak in i40e_probe
    - [s390x] smp: __smp_rescan_cpus() - move cpumask away from stack
    - drivers/base/memory: don't store phys_device in memory blocks
    - sysctl.c: fix underflow value setting risk in vm_table
    - scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling
    - scsi: target: core: Add cmd length set before cmd complete
    - scsi: target: core: Prevent underflow for service actions
    - mmc: sdhci: Update firmware interface API
    - [arm*] assembler: introduce adr_l, ldr_l and str_l macros
    - [arm*] efistub: replace adrl pseudo-op with adr_l macro invocation
    - ALSA: usb: Add Plantronics C320-M USB ctrl msg delay quirk
    - ALSA: hda/hdmi: Cancel pending works before suspend
    - ALSA: hda/conexant: Add quirk for mute LED control on HP ZBook G5
    - ALSA: hda/ca0132: Add Sound BlasterX AE-5 Plus support
    - ALSA: hda: Drop the BATCH workaround for AMD controllers
    - ALSA: hda: Flush pending unsolicited events before suspend
    - ALSA: hda: Avoid spurious unsol event handling during S3/S4
    - ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar
    - ALSA: usb-audio: Apply the control quirk to Plantronics headsets
    - ALSA: usb-audio: Disable USB autosuspend properly in
      setup_disable_autosuspend()
    - ALSA: usb-audio: fix NULL ptr dereference in usb_audio_probe
    - ALSA: usb-audio: fix use after free in usb_audio_disconnect
    - Revert 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file
      capabilities")
    - block: Discard page cache of zone reset target range
    - block: Try to handle busy underlying device on discard
    - [arm64] mte: Map hotplugged memory as Normal Tagged
    - [arm64] perf: Fix 64-bit event counter read truncation
    - [s390x] dasd: fix hanging DASD driver unbind
    - [s390]x dasd: fix hanging IO request during DASD driver unbind
    - software node: Fix node registration
    - xen/events: reset affinity of 2-level event when tearing it down
    - [arm64,armhf] mmc: mmci: Add MMC_CAP_NEED_RSP_BUSY for the stm32 variants
    - mmc: core: Fix partition switch time for eMMC
    - mmc: cqhci: Fix random crash when remove mmc module/card
    - cifs: do not send close in compound create+close requests
    - Goodix Fingerprint device is not a modem
    - usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio
      slot
    - usb: gadget: f_uac1: stop playback on function disable
    - [arm64] usb: dwc3: qcom: Add missing DWC3 OF node refcount decrement
    - [arm64] usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot
    - [arm64] usb: dwc3: qcom: add ACPI device id for sc8180x
    - [arm64] usb: dwc3: qcom: Honor wakeup enabled/disabled state
    - USB: usblp: fix a hang in poll() if disconnected
    - usb: xhci: do not perform Soft Retry for some xHCI hosts
    - xhci: Improve detection of device initiated wake signal.
    - usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing
    - xhci: Fix repeated xhci wake after suspend due to uncleared internal wake
      state
    - USB: serial: io_edgeport: fix memory leak in edge_startup
    - USB: serial: ch341: add new Product ID
    - USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter
    - USB: serial: cp210x: add some more GE USB IDs
    - usbip: fix stub_dev to check for stream socket
    - usbip: fix vhci_hcd to check for stream socket
    - usbip: fix vudc to check for stream socket
    - usbip: fix stub_dev usbip_sockfd_store() races leading to gpf
    - usbip: fix vhci_hcd attach_store() races leading to gpf
    - usbip: fix vudc usbip_sockfd_store races leading to gpf
    - [x86] misc/pvpanic: Export module FDT device table
    - misc: fastrpc: restrict user apps from sending kernel RPC messages
      (CVE-2021-28375)
    - [x86] staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan()
    - staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan()
      (CVE-2021-28660)
    - staging: rtl8712: unterminated string leads to read overflow
    - staging: rtl8188eu: fix potential memory corruption in
      rtw_check_beacon_data()
    - staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd
    - [x86] staging: rtl8192e: Fix possible buffer overflow in
      _rtl92e_wx_set_scan
    - [x86] staging: comedi: addi_apci_1032: Fix endian problem for COS sample
    - [x86] staging: comedi: addi_apci_1500: Fix endian problem for command
      sample
    - [x86] staging: comedi: adv_pci1710: Fix endian problem for AI command data
    - [i386] staging: comedi: das6402: Fix endian problem for AI command data
    - [i386] staging: comedi: das800: Fix endian problem for AI command data
    - [i386] staging: comedi: dmm32at: Fix endian problem for AI command data
    - [x86] staging: comedi: me4000: Fix endian problem for AI command data
    - [i386] staging: comedi: pcl711: Fix endian problem for AI command data
    - [i386] staging: comedi: pcl818: Fix endian problem for AI command data
    - [arm64] mm: Fix pfn_valid() for ZONE_DEVICE based memory
    - SUNRPC: Set memalloc_nofs_save() for sync tasks
    - NFS: Don't revalidate the directory permissions on a lookup failure
    - NFS: Don't gratuitously clear the inode cache when lookup failed
    - NFSv4.2: fix return value of _nfs4_get_security_label()
    - block: rsxx: fix error return code of rsxx_pci_probe()
    - nvme-fc: fix racing controller reset and create association
    - configfs: fix a use-after-free in __configfs_open_file
    - [arm64] mm: use a 48-bit ID map when possible on 52-bit VA builds
    - perf/core: Flush PMU internal buffers for per-CPU events
    - [x86] perf/x86/intel: Set PERF_ATTACH_SCHED_CB for large PEBS and LBR
    - hrtimer: Update softirq_expires_next correctly after
      __hrtimer_get_next_event()
    - seqlock,lockdep: Fix seqcount_latch_init()
    - stop_machine: mark helpers __always_inline
    - include/linux/sched/mm.h: use rcu_dereference in in_vfork()
    - zram: fix return value on writeback_store
    - sched/membarrier: fix missing local execution of ipi_sync_rq_state()
    - efi: stub: omit SetVirtualAddressMap() if marked unsupported in RT_PROP
      table
    - [powerpc*] 64s: Fix instruction encoding for lis in ppc_function_entry()
    - [powerpc*] Fix inverted SET_FULL_REGS bitop
    - [powerpc*] Fix missing declaration of [en/dis]able_kernel_vsx()
    - binfmt_misc: fix possible deadlock in bm_register_write
    - [amd64] x86/unwind/orc: Disable KASAN checking in the ORC unwinder, part 2
    - [x86] entry: Move nmi entry/exit into common code
    - [x86] entry: Fix entry/exit mismatch on failed fast 32-bit syscalls
    - [x86] KVM: Ensure deadline timer has truly expired before posting its IRQ
    - [x86] KVM: kvmclock: Fix vCPUs > 64 can't be online/hotpluged
    - [arm64] KVM: Fix range alignment when walking page tables
    - [arm64] KVM: Avoid corrupting vCPU context register in guest exit
    - [arm64] KVM: nvhe: Save the SPE context early
    - [arm64] KVM: Reject VM creation when the default IPA size is unsupported
    - [arm64] KVM: Fix exclusive limit for IPA size
    - mm/userfaultfd: fix memory corruption due to writeprotect
    - mm/madvise: replace ptrace attach requirement for process_madvise
    - [arm64] KVM: Ensure I-cache isolation between vcpus of a same VM
    - mm/page_alloc.c: refactor initialization of struct page for holes in
      memory layout
    - xen/events: don't unmask an event channel when an eoi is pending
    - xen/events: avoid handling the same event on two cpus at the same time
    - [arm64] KVM: Fix nVHE hyp panic host context restore
    - RDMA/umem: Use ib_dma_max_seg_size instead of dma_get_max_seg_size

  [ Salvatore Bonaccorso ]
  * Bump ABI to 5
  * [rt] Refresh "printk: remove logbuf_lock"
  * [rt] Refresh "printk: remove safe buffers"
  * [rt] Refresh "printk: remove deferred printing"
  * [rt] Refresh "mm/memcontrol: Replace local_irq_disable with local locks"
  * [rt] Update to 5.10.21-rt34
  * Refresh "Include package version along with kernel release in stack
    traces"
  * bpf: Prohibit alu ops for pointer types not defining ptr_limit
    (CVE-2020-27170)
  * bpf: Fix off-by-one for area size in creating mask to left
    (CVE-2020-27171)
  * bpf: Simplify alu_limit masking for pointer arithmetic
  * bpf: Add sanity check for upper ptr_limit
  * bpf, selftests: Fix up some test_verifier cases for unprivileged
  * [x86] crypto: aesni - Use TEST %reg,%reg instead of CMP $0,%reg
  * [x86] crypto: x86/aes-ni-xts - use direct calls to and 4-way stride
  * RDMA/srp: Fix support for unpopulated and unbalanced NUMA nodes
  * fuse: fix live lock in fuse_iget()
  * Revert "nfsd4: remove check_conflicting_opens warning"
  * Revert "nfsd4: a client's own opens needn't prevent delegations"
  * ALSA: usb-audio: Don't avoid stopping the stream at disconnection
  * [armhf] net: dsa: b53: Support setting learning on port

  [ Wookey ]
  * [arm64] drivers/perf: Enable ARM_CMN as module (Closes: #981186)

  [ Vincent Blut ]
  * [arm64] drivers/perf: Enable ARM_SMMU_V3_PMU as module

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 19 Mar 2021 19:20:52 +0100

linux (5.10.19-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.14
    - [armhf] net: fec: put child node on error path
    - [x86] stmmac: intel: Configure EHL PSE0 GbE and PSE1 GbE to 32 bits DMA
      addressing
    - [armhf] net: dsa: bcm_sf2: put device node before return
    - net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP
    - [arm64,armhf] iommu/io-pgtable-arm: Support coherency for Mali LPAE
    - [arm64,armhf] drm/panfrost: Support cache-coherent integrations
    - [arm64] Fix kernel address detection of __is_lm_address()
    - [arm64] Do not pass tagged addresses to __is_lm_address()
    - Revert "x86/setup: don't remove E820_TYPE_RAM for pfn 0"
    - [amd64] iommu/vt-d: Do not use flush-queue when caching-mode is on
    - [x86] platform/x86: touchscreen_dmi: Add swap-x-y quirk for Goodix
      touchscreen on Estar Beauty HD tablet
    - [x86] platform/x86: intel-vbtn: Support for tablet mode on Dell Inspiron
      7352
    - [x86] __always_inline __{rd,wr}msr()
    - scsi: scsi_transport_srp: Don't block target in failfast state
    - scsi: libfc: Avoid invoking response handler twice if ep is already
      completed
    - [x86] scsi: fnic: Fix memleak in vnic_dev_init_devcmd2
    - [x86] ASoC: SOF: Intel: hda: Resume codec to do jack detection
    - ALSA: hda: Add AlderLake-P PCI ID and HDMI codec vid
    - mac80211: fix fast-rx encryption check
    - mac80211: fix encryption key selection for 802.3 xmit
    - [powerpc*] scsi: ibmvfc: Set default timeout to avoid crash during
      migration
    - ALSA: hda: Add Cometlake-R PCI ID
    - [arm64,armhf] i2c: tegra: Create i2c_writesl_vi() to use with VI I2C for
      filling TX FIFO
    - udf: fix the problem that the disc content is not displayed
    - nvme: check the PRINFO bit before deciding the host buffer length
    - nvme-rdma: avoid request double completion for concurrent
      nvme_rdma_timeout
    - nvme-tcp: avoid request double completion for concurrent
      nvme_tcp_timeout
    - nvme-pci: allow use of cmb on v1.4 controllers
    - nvmet: set right status on error in id-ns handler
    - [x86] platform/x86: thinkpad_acpi: Add P53/73 firmware to
      fan_quirk_table for dual fan control
    - objtool: Don't fail the kernel build on fatal errors
    - [x86] cpu: Add another Alder Lake CPU to the Intel family
    - kthread: Extract KTHREAD_IS_PER_CPU
    - workqueue: Restrict affinity change to rescuer
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.15
    - USB: serial: cp210x: add pid/vid for WSDA-200-USB
    - USB: serial: cp210x: add new VID/PID for supporting Teraoka AD2000
    - USB: serial: option: Adding support for Cinterion MV31
    - [arm64,armhf] usb: host: xhci: mvebu: make USB 3.0 PHY optional for
      Armada 3720
    - USB: gadget: legacy: fix an error code in eth_bind()
    - [armhf] usb: gadget: aspeed: add missing of_node_put
    - USB: usblp: don't call usb_set_interface if there's a single alt
    - [arm*] usb: dwc2: Fix endpoint direction check in ep_from_windex
    - [arm64,armhf] usb: dwc3: fix clock issue during resume in OTG mode
    - [arm64] dts: qcom: c630: keep both touchpad devices enabled
    - Input: i8042 - unbreak Pegatron C15B
    - [arm64] dts: rockchip: Use only supported PCIe link speed on Pinebook
      Pro
    - bpf, cgroup: Fix optlen WARN_ON_ONCE toctou (CVE-2021-20194)
    - bpf, cgroup: Fix problematic bounds check (CVE-2021-20194)
    - bpf, inode_storage: Put file handler if no storage was found
    - bpf, preload: Fix build when $(O) points to a relative path
    - [arm64] dts: meson: switch TFLASH_VDD_EN pin to open drain on Odroid-C4
    - r8169: work around RTL8125 UDP hw bug
    - rxrpc: Fix deadlock around release of dst cached on udp tunnel
    - SUNRPC: Fix NFS READs that start at non-page-aligned offsets
    - igc: set the default return value to -IGC_ERR_NVM in igc_write_nvm_srwr
    - igc: check return value of ret_val in igc_config_fc_after_link_up
    - i40e: Revert "i40e: don't report link up for a VF who hasn't enabled
      queues"
    - net/mlx5: Fix function calculation for page trees
    - net/mlx5: Fix leak upon failure of rule creation
    - net/mlx5e: Update max_opened_tc also when channels are closed
    - net/mlx5e: Release skb in case of failure in tc update skb
    - net: lapb: Copy the skb before sending a packet
    - [arm64,armhf] net: mvpp2: TCAM entry enable should be written after SRAM
      data
    - [armhf] dts: sun7i: a20: bananapro: Fix ethernet phy-mode
    - nvmet-tcp: fix out-of-bounds access when receiving multiple h2cdata PDUs
    - memblock: do not start bottom-up allocations with kernel_end
    - [x86] thunderbolt: Fix possible NULL pointer dereference in
      tb_acpi_add_link()
    - ovl: fix dentry leak in ovl_get_redirect
    - ovl: avoid deadlock on directory ioctl
    - ovl: implement volatile-specific fsync error behaviour
    - mac80211: fix station rate table updates on assoc
    - gpiolib: free device name on error path to fix kmemleak
    - fgraph: Initialize tracing_graph_pause at task creation
    - tracing/kprobe: Fix to support kretprobe events on unloaded modules
    - kretprobe: Avoid re-registration of the same kretprobe earlier
    - tracing: Use pause-on-trace with the latency tracers
    - tracepoint: Fix race between tracing and removing tracepoint
    - [arm64,x86] libnvdimm/namespace: Fix visibility of namespace resource
      attribute
    - [arm64,x86] libnvdimm/dimm: Avoid race between probe and
      available_slots_show()
    - genirq: Prevent [devm_]irq_alloc_desc from returning irq 0
    - genirq/msi: Activate Multi-MSI early when MSI_FLAG_ACTIVATE_EARLY is set
    - scripts: use pkg-config to locate libcrypto
    - xhci: fix bounce buffer usage for non-sg list case
    - cifs: report error instead of invalid when revalidating a dentry fails
    - iommu: Check dev->iommu in dev_iommu_priv_get() before dereferencing it
    - smb3: Fix out-of-bounds bug in SMB2_negotiate()
    - smb3: fix crediting for compounding when only one request in flight
    - mmc: core: Limit retries when analyse of SDIO tuples fails
    - [x86] Fix unsynchronized access to sev members through
      svm_register_enc_region
    - drm/dp/mst: Export drm_dp_get_vc_payload_bw()
    - [x86] drm/i915: Fix the MST PBN divider calculation
    - [x86] drm/i915/gem: Drop lru bumping on display unpinning
    - [x86] drm/i915/gt: Close race between enable_breadcrumbs and
      cancel_breadcrumbs
    - [x86] drm/i915/display: Prevent double YUV range correction on HDR
      planes
    - [x86] drm/i915: Extract intel_ddi_power_up_lanes()
    - [x86] drm/i915: Power up combo PHY lanes for for HDMI as well
    - drm/amd/display: Revert "Fix EDID parsing after resume from suspend"
    - io_uring: don't modify identity's files uncess identity is cowed
    - nvme-pci: avoid the deepest sleep state on Kingston A2000 SSDs
    - [x86] KVM: SVM: Treat SVM as unsupported when running as an SEV guest
    - [x86] KVM: x86/mmu: Fix TDP MMU zap collapsible SPTEs
    - [x86] KVM: x86: Allow guests to see MSR_IA32_TSX_CTRL even if tsx=off
    - [x86] KVM: x86: fix CPUID entries returned by KVM_GET_CPUID2 ioctl
    - [x86] KVM: x86: Update emulator context mode if SYSENTER xfers to 64-bit
      mode
    - [x86] KVM: x86: Set so called 'reserved CR3 bits in LM mask' at vCPU
      reset
    - mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page
    - mm: hugetlb: fix a race between freeing and dissolving the page
    - mm: hugetlb: fix a race between isolating and freeing page
    - mm: hugetlb: remove VM_BUG_ON_PAGE from page_huge_active
    - mm, compaction: move high_pfn to the for loop scope
    - mm/vmalloc: separate put pages and flush VM flags
    - mm: thp: fix MADV_REMOVE deadlock on shmem THP
    - mm/filemap: add missing mem_cgroup_uncharge() to
      __add_to_page_cache_locked()
    - [x86] build: Disable CET instrumentation in the kernel
    - [x86] debug: Fix DR6 handling
    - [x86] debug: Prevent data breakpoints on __per_cpu_offset
    - [x86] debug: Prevent data breakpoints on cpu_dr7
    - [x86] apic: Add extra serialization for non-serializing MSRs
    - Input: goodix - add support for Goodix GT9286 chip
    - Input: xpad - sync supported devices with fork on GitHub
    - md: Set prev_flush_start and flush_bio in an atomic way
    - igc: Report speed and duplex as unknown when device is runtime suspended
    - neighbour: Prevent a dead entry from updating gc_list
    - net: ip_tunnel: fix mtu calculation
    - udp: ipv4: manipulate network header of NATed UDP GRO fraglist
    - [arm64,armhf] net: dsa: mv88e6xxx: override existent unicast portvec in
      port_fdb_add
    - net: sched: replaced invalid qdisc tree flush helper in qdisc_replace
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.16
    - io_uring: simplify io_task_match()
    - io_uring: add a {task,files} pair matching helper
    - io_uring: don't iterate io_uring_cancel_files()
    - io_uring: pass files into kill timeouts/poll
    - io_uring: always batch cancel in *cancel_files()
    - io_uring: fix files cancellation
    - io_uring: account io_uring internal files as REQ_F_INFLIGHT
    - io_uring: if we see flush on exit, cancel related tasks
    - io_uring: fix __io_uring_files_cancel() with TASK_UNINTERRUPTIBLE
    - io_uring: replace inflight_wait with tctx->wait
    - io_uring: fix cancellation taking mutex while TASK_UNINTERRUPTIBLE
    - io_uring: fix flush cqring overflow list while TASK_INTERRUPTIBLE
    - io_uring: fix list corruption for splice file_get
    - io_uring: fix sqo ownership false positive warning
    - io_uring: reinforce cancel on flush during exit
    - io_uring: drop mm/files between task_work_submit
    - gpiolib: cdev: clear debounce period if line set to output
    - [powerpc*] 64/signal: Fix regression in __kernel_sigtramp_rt64()
      semantics
    - af_key: relax availability checks for skb size calculation
    - regulator: core: avoid regulator_resolve_supply() race condition
    - drm/nouveau/nvif: fix method count when pushing an array
    - mac80211: 160MHz with extended NSS BW in CSA
    - [x86] ASoC: Intel: Skylake: Zero snd_ctl_elem_value
    - pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()
    - pNFS/NFSv4: Improve rejection of out-of-order layouts
    - ALSA: hda: intel-dsp-config: add PCI id for TGL-H
    - [x86] ASoC: Intel: sof_sdw: set proper flags for Dell TGL-H SKU 0A5E
    - iwlwifi: mvm: skip power command when unbinding vif during CSA
    - iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap
    - iwlwifi: pcie: fix context info memory leak
    - iwlwifi: mvm: invalidate IDs of internal stations at mvm start
    - iwlwifi: pcie: add rules to match Qu with Hr2
    - iwlwifi: mvm: guard against device removal in reprobe
    - iwlwifi: queue: bail out on invalid freeing
    - SUNRPC: Move simple_get_bytes and simple_get_netobj into private header
    - SUNRPC: Handle 0 length opaque XDR object data properly
    - blk-cgroup: Use cond_resched() when destroy blkgs
    - regulator: Fix lockdep warning resolving supplies
    - bpf: Fix verifier jmp32 pruning decision logic
    - bpf: Fix 32 bit src register truncation on div/mod
    - bpf: Fix verifier jsgt branch analysis on max bound
    - [x86] drm/i915: Fix ICL MG PHY vswing handling
    - [x86] drm/i915: Skip vswing programming for TBT
    - nilfs2: make splice write available again
    - Revert "mm: memcontrol: avoid workload stalls when lowering memory.high"
    - squashfs: avoid out of bounds writes in decompressors
    - squashfs: add more sanity checks in id lookup
    - squashfs: add more sanity checks in inode lookup
    - squashfs: add more sanity checks in xattr id lookup
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.17
    - objtool: Fix seg fault with Clang non-section symbols
    - Revert "dts: phy: add GPIO number and active state used for phy reset"
    - tracing: Do not count ftrace events in top level enable output
    - tracing: Check length before giving out the filter buffer
    - [x86] drm/i915: Fix overlay frontbuffer tracking
    - arm/xen: Don't probe xenbus as part of an early initcall
    - cgroup: fix psi monitor for root cgroup
    - [x86] drm/i915/tgl+: Make sure TypeC FIA is powered up when initializing
      it
    - drm/dp_mst: Don't report ports connected if nothing is attached to them
    - dmaengine: move channel device_node deletion to driver
    - [armhf] soc: ti: omap-prm: Fix boot time errors for rst_map_012 bits 0
      and 1
    - [arm64] dts: qcom: sdm845: Reserve LPASS clocks in gcc
    - [x86] platform/x86: hp-wmi: Disable tablet-mode reporting by default
    - [arm64] dts: rockchip: Disable display for NanoPi R2S
    - ovl: perform vfs_getxattr() with mounter creds
    - cap: fix conversions on getxattr
    - ovl: skip getxattr of security labels
    - scsi: lpfc: Fix EEH encountering oops with NVMe traffic
    - [x86] split_lock: Enable the split lock feature on another Alder Lake
      CPU
    - nvme-pci: ignore the subsysem NQN on Phison E16
    - [riscv64] virt_addr_valid must check the address belongs to linear
      mapping
    - bfq-iosched: Revert "bfq: Fix computation of shallow depth"
    - kallsyms: fix nonconverging kallsyms table with lld
    - [armel,armhf] ensure the signal page contains defined contents
    - [armel,armhf] kexec: fix oops after TLB are invalidated
    - Revert "lib: Restrict cpumask_local_spread to houskeeping CPUs"
    - [amd64] x86/efi: Remove EFI PGD build time checks
    - [x86] KVM: x86: cleanup CR3 reserved bits checks
    - cgroup-v1: add disabled controller check in cgroup1_parse_param()
    - mt76: dma: fix a possible memory leak in mt76_add_fragment()
    - [arm*] drm/vc4: hvs: Fix buffer overflow with the dlist handling
    - bpf: Unbreak BPF_PROG_TYPE_KPROBE when kprobe is called via do_int3
    - bpf: Check for integer overflow when using roundup_pow_of_two()
    - netfilter: xt_recent: Fix attempt to update deleted entry
    - netfilter: nftables: fix possible UAF over chains from packet path in
      netns
    - netfilter: flowtable: fix tcp and udp header checksum update
    - xen/netback: avoid race in xenvif_rx_ring_slots_available()
    - [x86] hv_netvsc: Reset the RSC count if NVSP_STAT_FAIL in
      netvsc_receive()
    - [arm64] net: enetc: initialize the RFS and RSS memories
    - net: stmmac: set TxQ mode back to DCB after disabling CBS
    - netfilter: conntrack: skip identical origin tuple in same zone only
    - scsi: scsi_debug: Fix a memory leak
    - [x86] build: Disable CET instrumentation in the kernel for 32-bit too
    - [arm64] net: dsa: felix: implement port flushing on
      .phylink_mac_link_down
    - [arm64] net: hns3: add a check for queue_id in hclge_reset_vf_queue()
    - [arm64] net: hns3: add a check for tqp_index in
      hclge_get_ring_chain_from_mbx()
    - [arm64] net: hns3: add a check for index in hclge_get_rss_key()
    - firmware_loader: align .builtin_fw to 8
    - [arm64,armhf] drm/sun4i: tcon: set sync polarity for tcon1 channel
    - [arm64,armhf] drm/sun4i: dw-hdmi: always set clock rate
    - [arm64,armhf] drm/sun4i: Fix H6 HDMI PHY configuration
    - [arm64,armhf] drm/sun4i: dw-hdmi: Fix max. frequency for H6
    - [arm64,armhf] clk: sunxi-ng: mp: fix parent rate change flag check
    - [armhf] i2c: stm32f7: fix configuration of the digital filter
    - scripts: set proper OpenSSL include dir also for sign-file
    - [x86] pci: Create PCI/MSI irqdomain after x86_init.pci.arch_init()
    - arm64: mte: Allow PTRACE_PEEKMTETAGS access to the zero page
    - rxrpc: Fix clearance of Tx/Rx ring when releasing a call
    - udp: fix skb_copy_and_csum_datagram with odd segment sizes
    - [arm64,armhf] net: dsa: call teardown method on probe failure
    - [x86] cpufreq: ACPI: Extend frequency tables to cover boost frequencies
    - [x86] cpufreq: ACPI: Update arch scale-invariance max perf ratio if CPPC
      is not there
    - net: gro: do not keep too many GRO packets in napi->rx_list
    - net: fix iteration for sctp transport seq_files
    - net/vmw_vsock: fix NULL pointer dereference
    - net/vmw_vsock: improve locking in vsock_connect_timeout()
    - net: watchdog: hold device global xmit lock during tx disable
    - switchdev: mrp: Remove SWITCHDEV_ATTR_ID_MRP_PORT_STAT
    - vsock/virtio: update credit only if socket is not closed
    - vsock: fix locking in vsock_shutdown()
    - net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS
    - ovl: expand warning in ovl_d_real()
    - kcov, usb: only collect coverage from __usb_hcd_giveback_urb in softirq
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.18
    - IB/isert: add module param to set sg_tablesize for IO cmd
    - net: qrtr: Fix port ID for control messages
    - net/sched: fix miss init the mru in qdisc_skb_cb
    - net: openvswitch: fix TTL decrement exception action execution
    - net: bridge: Fix a warning when del bridge sysfs
    - net: fix proc_fs init handling in af_packet and tls
    - [amd64] Xen/x86: don't bail early from clear_foreign_p2m_mapping()
      (CVE-2021-26932)
    - [amd64] Xen/x86: also check kernel mapping in set_foreign_p2m_mapping()
      (CVE-2021-26932)
    - Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages()
      (CVE-2021-26932)
    - Xen/gntdev: correct error checking in gntdev_map_grant_pages()
      (CVE-2021-26932)
    - [armhf] xen/arm: don't ignore return errors from set_phys_to_machine
      (CVE-2021-26932)
    - xen-blkback: don't "handle" error by BUG() (CVE-2021-26931)
    - xen-netback: don't "handle" error by BUG() (CVE-2021-26931)
    - xen-scsiback: don't "handle" error by BUG() (CVE-2021-26931)
    - xen-blkback: fix error handling in xen_blkbk_map() (CVE-2021-26930)
    - tty: protect tty_write from odd low-level tty disciplines
    - Bluetooth: btusb: Always fallback to alt 1 for WBS
    - btrfs: fix crash after non-aligned direct IO write with O_DSYNC
    - media: pwc: Use correct device for DMA
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.19
    - bpf: Fix truncation handling for mod32 dst reg wrt zero
    - HID: make arrays usage and value to be the same
    - RDMA: Lift ibdev_to_node from rds to common code
    - nvme-rdma: Use ibdev_to_node instead of dereferencing ->dma_device
    - USB: quirks: sort quirk entries
    - usb: quirks: add quirk to start video capture on ELMO L-12F document
      camera reliable
    - ceph: downgrade warning from mdsmap decode to debug
    - Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working
      (Closes: #981005)
    - [x86] hwmon: (dell-smm) Add XPS 15 L502X to fan control blacklist
    - [x86] KVM: Zap the oldest MMU pages, not the newest
    - mm: unexport follow_pte_pmd
    - mm: simplify follow_pte{,pmd}
    - KVM: do not assume PTE is writable after follow_pfn
    - mm: provide a saner PTE walking API for modules
    - KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped()
    - NET: usb: qmi_wwan: Adding support for Cinterion MV31
    - cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath.

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.10.14-rt28
  * Ignore __udp_gso_segment to avoid ABI changes
  * Ignore xhci_init_driver to avoid ABI changes
  * [rt] Update to 5.10.16-rt30
  * [rt] Refresh "tracing: Merge irqflags + preempt counter." for context
    changes
  * [rt] Update to 5.10.17-rt32
  * [rt] Refresh "um: synchronize kmsg_dumper" for context changes
  * [rt] Refresh "printk: move console printing to kthreads" for context
    changes
  * Bump ABI to 4
  * soundwire: intel: fix possible crash when no device is detected
    (Closes: #981003)
  * drm/nouveau: bail out of nouveau_channel_new if channel init fails
    (CVE-2020-25639)
  * [x86] drm/i915/gt: One more flush for Baytrail clear residuals
  * [x86] drm/i915/gt: Flush before changing register state
  * [x86] drm/i915/gt: Correct surface base address for renderclear
  * certs: Rotate to use the "Debian Secure Boot Signer 2021 - linux"
    certificate

  [ Vincent Blut ]
  * [x86] Enable PWM_CRC (Closes: #982808)
  * net/can: Enable CAN_J1939 as module
  * misc/eeprom: Enable EEPROM_EE1004 as module (Closes: #983495)
  * [arm64] Enable DRM_DW_HDMI_CEC as module (Closes: #983759)

  [ Luca Boccassi ]
  * bpf: enable CONFIG_BPF_LSM on all architectures. Not active by default,
    by explicitly setting CONFIG_LSM to include all other LSMs but not bpf.

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 02 Mar 2021 17:49:25 +0100

linux (5.10.13-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.13
    - iwlwifi: provide gso_type to GSO packets
    - nbd: freeze the queue while we're adding connections (CVE-2021-3348)
    - tty: avoid using vfs_iocb_iter_write() for redirected console writes
    - ACPI: sysfs: Prefer "compatible" modalias
    - ACPI: thermal: Do not call acpi_thermal_check() directly
    - kernel: kexec: remove the lock operation of system_transition_mutex
    - ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256
    - ALSA: hda/via: Apply the workaround generically for Clevo machines
    - [arm64,armhf] media: cedrus: Fix H264 decoding
    - media: rc: fix timeout handling after switch to microsecond durations
    - [x86] media: rc: ite-cir: fix min_timeout calculation
    - media: rc: ensure that uevent can be read directly after rc device
      register
    - [armhf] dts: tbs2910: rename MMC node aliases
    - wext: fix NULL-ptr-dereference with cfg80211's lack of commit()
    - [amd64] ASoC: AMD Renoir - refine DMI entries for some Lenovo products
    - drm/nouveau/kms/gk104-gp1xx: Fix > 64x64 cursors
    - [x86] drm/i915: Always flush the active worker before returning from the
      wait
    - [x86] drm/i915/gt: Always try to reserve GGTT address 0x0
    - drivers/nouveau/kms/nv50-: Reject format modifiers for cursor planes
    - bcache: only check feature sets when sb->version >=
      BCACHE_SB_VERSION_CDEV_WITH_FEATURES
    - net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem
      family
    - [s390x] uv: Fix sysfs max number of VCPUs reporting
    - PM: hibernate: flush swap writer after marking
    - [x86] efi/apple-properties: Reinstate support for boolean properties
    - btrfs: fix lockdep warning due to seqcount_mutex on 32bit arch
    - btrfs: fix possible free space tree corruption with online conversion
    - [x86] KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in
      intel_arch_events[]
    - [x86] KVM: x86/pmu: Fix UBSAN shift-out-of-bounds warning in
      intel_pmu_refresh()
    - [arm64] KVM: Filter out v8.1+ events on v8.0 HW
    - [x86] KVM: nSVM: cancel KVM_REQ_GET_NESTED_STATE_PAGES on nested vmexit
    - [x86] KVM: x86: allow KVM_REQ_GET_NESTED_STATE_PAGES outside guest mode
      for VMX
    - [x86] KVM: nVMX: Sync unsync'd vmcs02 state to vmcs12 on migration
    - [x86] KVM: get smi pending status correctly
    - KVM: Forbid the use of tagged userspace addresses for memslots
    - io_uring: fix wqe->lock/completion_lock deadlock
    - leds: trigger: fix potential deadlock with libata
    - mt7601u: fix kernel crash unplugging the device
    - mt7601u: fix rx buffer refcounting
    - iwlwifi: Fix IWL_SUBDEVICE_NO_160 macro to use the correct bit.
    - [x86] drm/i915/gt: Clear CACHE_MODE prior to clearing residuals
    - [x86] drm/i915/pmu: Don't grab wakeref when enabling events
    - [arm*] drm/vc4: Correct lbm size and calculation
    - [arm*] drm/vc4: Correct POS1_SCL for hvs5
    - drm/nouveau/dispnv50: Restore pushing of all data.
    - [x86] drm/i915: Check for all subplatform bits
    - uapi: fix big endian definition of ipv6_rpl_sr_hdr
    - KVM: Documentation: Fix spec for KVM_CAP_ENABLE_CAP_VM
    - [arm64] tee: optee: replace might_sleep with cond_resched
    - xen-blkfront: allow discard-* nodes to be optional
    - blk-mq: test QUEUE_FLAG_HCTX_ACTIVE for sbitmap_shared in hctx_may_queue
    - [armhf] imx: build suspend-imx6.S with arm instruction set
    - netfilter: nft_dynset: add timeout extension to template
    - Revert "RDMA/mlx5: Fix devlink deadlock on net namespace deletion"
    - Revert "block: simplify set_init_blocksize" to regain lost performance
    - xfrm: Fix oops in xfrm_replay_advance_bmp
    - xfrm: fix disable_xfrm sysctl when used on xfrm interfaces
    - xfrm: Fix wraparound in xfrm_policy_addr_delta()
    - RDMA/cxgb4: Fix the reported max_recv_sge value
    - [arm64] ASoC: qcom: Fix incorrect volatile registers
    - [arm64] ASoC: qcom: Fix broken support to MI2S TERTIARY and QUATERNARY
    - [x86] ASoC: Intel: Skylake: skl-topology: Fix OOPs ib skl_tplg_complete
    - [powerpc*] 64s: prevent recursive replay_soft_interrupts causing
      superfluous interrupt
    - pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process()
    - pNFS/NFSv4: Update the layout barrier when we schedule a layoutreturn
    - ASoC: SOF: Intel: soundwire: fix select/depend unmet dependencies
    - ASoC: qcom: lpass: Fix out-of-bounds DAI ID lookup
    - iwlwifi: pcie: avoid potential PNVM leaks
    - iwlwifi: pnvm: don't skip everything when not reloading
    - iwlwifi: pnvm: don't try to load after failures
    - iwlwifi: pcie: set LTR on more devices
    - iwlwifi: pcie: use jiffies for memory read spin time limit
    - iwlwifi: pcie: reschedule in long-running memory reads
    - mac80211: pause TX while changing interface type
    - ice: fix FDir IPv6 flexbyte
    - ice: Implement flow for IPv6 next header (extension header)
    - ice: update dev_addr in ice_set_mac_address even if HW filter exists
    - ice: Don't allow more channels than LAN MSI-X available
    - ice: Fix MSI-X vector fallback logic
    - i40e: acquire VSI pointer only after VF is initialized
    - igc: fix link speed advertising
    - net/mlx5: Fix memory leak on flow table creation error flow
    - net/mlx5e: E-switch, Fix rate calculation for overflow
    - net/mlx5e: free page before return
    - net/mlx5e: Reduce tc unsupported key print level
    - net/mlx5: Maintain separate page trees for ECPF and PF functions
    - net/mlx5e: Disable hw-tc-offload when MLX5_CLS_ACT config is disabled
    - net/mlx5e: Fix CT rule + encap slow path offload and deletion
    - net/mlx5e: Correctly handle changing the number of queues when the
      interface is down
    - net/mlx5e: Revert parameters on errors when changing trust state without
      reset
    - net/mlx5e: Revert parameters on errors when changing MTU and LRO state
      without reset
    - can: dev: prevent potential information leak in can_fill_info()
    - [arm64] ACPI/IORT: Do not blindly trust DMA masks from firmware
    - of/device: Update dma_range_map only when dev has valid dma-ranges
    - [amd64] iommu/amd: Use IVHD EFR for early initialization of IOMMU
      features
    - [amd64] iommu/vt-d: Correctly check addr alignment in
      qi_flush_dev_iotlb_pasid()
    - nvme-multipath: Early exit if no path is available
    - rxrpc: Fix memory leak in rxrpc_lookup_local
    - NFC: fix resource leak when target index is invalid
    - NFC: fix possible resource leak
    - [x86] ASoC: topology: Properly unregister DAI on removal
    - [x86] ASoC: topology: Fix memory corruption in
      soc_tplg_denum_create_values()
    - scsi: qla2xxx: Fix description for parameter ql2xenforce_iocb_limit
    - team: protect features update by RCU to avoid deadlock
    - tcp: make TCP_USER_TIMEOUT accurate for zero window probes
    - tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN
    - vsock: fix the race conditions in multi-transport support
      (CVE-2021-26708)

  [ Salvatore Bonaccorso ]
  * arch/s390: uv_info: Ignore ABI changes

  [ Vincent Blut ]
  * [arm64] Enable CRYPTO_NHPOLY1305_NEON. (closes: #980214)
  * [armhf] Enable KERNEL_MODE_NEON.

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 06 Feb 2021 09:23:52 +0100

linux (5.10.12-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.10
    - [x86] hyperv: Initialize clockevents after LAPIC is initialized
    - bpf: Fix signed_{sub,add32}_overflows type handling
    - nfsd4: readdirplus shouldn't return parent of export (CVE-2021-3178)
    - bpf: Don't leak memory in bpf getsockopt when optlen == 0
    - bpf: Support PTR_TO_MEM{,_OR_NULL} register spilling
    - bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback
    - net: fix use-after-free when UDP GRO with shared fraglist
    - udp: Prevent reuseport_select_sock from reading uninitialized socks
    - netxen_nic: fix MSI/MSI-x interrupts
    - net: ipv6: Validate GSO SKB before finish IPv6 processing
    - tipc: fix NULL deref in tipc_link_xmit()
    - [arm64,armhf] net: mvpp2: Remove Pause and Asym_Pause support
    - rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
    - esp: avoid unneeded kmap_atomic call
    - net: dcb: Validate netlink message in DCB handler
    - net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
    - rxrpc: Call state should be read with READ_ONCE() under some
      circumstances
    - i40e: fix potential NULL pointer dereferencing
    - [arm64,armhf] net: stmmac: Fixed mtu channged by cache aligned
    - net: sit: unregister_netdevice on newlink's error path
    - [arm64,armhf] net: stmmac: fix taprio schedule configuration
    - [arm64,armhf] net: stmmac: fix taprio configuration when base_time is in
      the past
    - net: avoid 32 x truesize under-estimation for tiny skbs
    - net: phy: smsc: fix clk error handling
    - [arm64,armhf] net: dsa: clear devlink port type before unregistering
      slave netdevs
    - rxrpc: Fix handling of an unsupported token type in rxrpc_read()
    - [arm64,armhf] net: stmmac: use __napi_schedule() for PREEMPT_RT
    - [armhf] drm/panel: otm8009a: allow using non-continuous dsi clock
    - mac80211: do not drop tx nulldata packets on encrypted links
    - mac80211: check if atf has been disabled in __ieee80211_schedule_txq
    - [arm64,armhf] net: dsa: unbind all switches from tree when DSA master
      unbinds
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.11
    - scsi: target: tcmu: Fix use-after-free of se_cmd->priv
    - [armhf] mtd: rawnand: gpmi: fix dst bit offset when extracting raw
      payload
    - mtd: rawnand: nandsim: Fix the logic when selecting Hamming soft ECC
      engine
    - [arm64,armhf] i2c: tegra: Wait for config load atomically while in ISR
    - [x86] platform/x86: i2c-multi-instantiate: Don't create platform device
      for INT3515 ACPI nodes
    - [x86] platform/x86: ideapad-laptop: Disable touchpad_switch for ELAN0634
    - ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T
    - ALSA: hda/via: Add minimum mute flag
    - crypto: xor - Fix divide error in do_xor_speed()
    - dm crypt: fix copy and paste bug in crypt_alloc_req_aead
    - ACPI: scan: Make acpi_bus_get_device() clear return pointer on error
    - btrfs: don't get an EINTR during drop_snapshot for reloc
    - btrfs: do not double free backref nodes on error
    - btrfs: fix lockdep splat in btrfs_recover_relocation
    - btrfs: don't clear ret in btrfs_start_dirty_block_groups
    - btrfs: send: fix invalid clone operations when cloning from the same
      file and root
    - fs: fix lazytime expiration handling in __writeback_single_inode()
    - mmc: core: don't initialize block size from ext_csd if not present
    - [arm64] mmc: sdhci-xenon: fix 1.8v regulator stabilization
    - dm: avoid filesystem lookup in dm_get_dev_t()
    - dm integrity: fix a crash if "recalculate" used without "internal_hash"
    - dm integrity: conditionally disable "recalculate" feature
    - drm/atomic: put state on error path
    - drm/syncobj: Fix use-after-free
    - drm/amdgpu: remove gpu info firmware of green sardine
    - [x86] drm/i915/gt: Prevent use of engine->wa_ctx after error
    - [x86] drm/i915: Check for rq->hwsp validity after acquiring RCU lock
    - ASoC: rt711: mutex between calibration and power state changes
    - SUNRPC: Handle TCP socket sends with kernel_sendpage() again
    - HID: multitouch: Enable multi-input for Synaptics pointstick/touchpad
      device
    - dm integrity: select CRYPTO_SKCIPHER
    - [x86] hyperv: Fix kexec panic/hang issues
    - scsi: ufs: Relax the condition of UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL
    - scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback
    - scsi: qedi: Correct max length of CHAP secret
    - scsi: scsi_debug: Fix memleak in scsi_debug_init()
    - scsi: sd: Suppress spurious errors when WRITE SAME is being disabled
    - [riscv64] Fix kernel time_init()
    - [riscv64] Fix sifive serial driver
    - [riscv64] Enable interrupts during syscalls with M-Mode
    - HID: logitech-dj: add the G602 receiver
    - HID: Ignore battery for Elan touchscreen on ASUS UX550
    - [arm64,armhf] ALSA: hda/tegra: fix tegra-hda on tegra30 soc
    - [riscv64] cacheinfo: Fix using smp_processor_id() in preemptible
    - [arm64] make atomic helpers __always_inline
    - xen: Fix event channel callback via INTX/GSI
    - [x86] xen: Add xen_no_vector_callback option to test PCI INTX delivery
    - [x86] xen: Fix xen_hvm_smp_init() when vector callback not available
    - [riscv64] dts: phy: fix missing mdio device and probe failure of
      vsc8541-01 device
    - [riscv64] dts: phy: add GPIO number and active state used for phy reset
    - drm/amdgpu/psp: fix psp gfx ctrl cmds
    - HID: logitech-hidpp: Add product ID for MX Ergo in Bluetooth mode
    - drm/nouveau/bios: fix issue shadowing expansion ROMs
    - drm/nouveau/privring: ack interrupts the same way as RM
    - drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields
    - drm/nouveau/mmu: fix vram heap sizing
    - drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0
    - io_uring: flush timeouts that should already have expired
    - [riscv64] Set current memblock limit
    - [riscv64] Fix maximum allowed phsyical memory for RV32
    - nfsd: Fixes for nfsd4_encode_read_plus_data()
    - nfsd: Don't set eof on a truncated READ_PLUS
    - gpiolib: cdev: fix frame size warning in gpio_ioctl()
    - [armhf] pinctrl: aspeed: g6: Fix PWMG0 pinctrl setting
    - RDMA/ucma: Do not miss ctx destruction steps in some cases
    - btrfs: print the actual offset in btrfs_root_name
    - scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression
    - scsi: ufs: Fix tm request when non-fatal error happens
    - bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach
    - [powerpc*] Use the common INIT_DATA_SECTION macro in vmlinux.lds.S
    - [powerpc*] Fix alignment bug within the init sections
    - [arm64] entry: remove redundant IRQ flag tracing
    - bpf: Reject too big ctx_size_in for raw_tp test run
    - RDMA/umem: Avoid undefined behavior of rounddown_pow_of_two()
    - RDMA/cma: Fix error flow in default_roce_mode_store
    - printk: ringbuffer: fix line counting
    - printk: fix kmsg_dump_get_buffer length calulations
    - iov_iter: fix the uaccess area in copy_compat_iovec_from_user
    - [mips*] i2c: octeon: check correct size of maximum RECV_LEN packet
    - [armel,armhf] drm/vc4: Unify PCM card's driver_name
    - [x86] platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11
      from allow-list
    - [x86] platform/x86: hp-wmi: Don't log a warning on
      HPWMI_RET_UNKNOWN_COMMAND errors
    - ALSA: hda: Balance runtime/system PM if direct-complete is disabled
    - xsk: Clear pool even for inactive queues
    - can: dev: can_restart: fix use after free bug
    - can: vxcan: vxcan_xmit: fix use after free bug
    - can: peak_usb: fix use after free bugs
    - iio: common: st_sensors: fix possible infinite loop in
      st_sensors_irq_thread
    - iio: ad5504: Fix setting power-down state
    - drivers: iio: temperature: Add delay after the addressed reset command
      in mlx90632.c
    - [powerpc*] 64s: fix scv entry fallback flush vs interrupt
    - cifs: do not fail __smb_send_rqst if non-fatal signals are pending
    - [mips*] irqchip/mips-cpu: Set IPI domain parent chip
    - [x86] fpu: Add kernel_fpu_begin_mask() to selectively initialize state
    - [x86] topology: Make __max_die_per_package available unconditionally
    - [x86] mmx: Use KFPU_387 for MMX string operations
    - [x86] setup: don't remove E820_TYPE_RAM for pfn 0
    - proc_sysctl: fix oops caused by incorrect command parameters
    - mm: memcg/slab: optimize objcg stock draining
    - mm: memcg: fix memcg file_dirty numa stat
    - mm: fix numa stats for thp migration
    - io_uring: iopoll requests should also wake task ->in_idle state
    - io_uring: fix SQPOLL IORING_OP_CLOSE cancelation state
    - io_uring: fix short read retries for non-reg files
    - [x86] intel_th: pci: Add Alder Lake-P support
    - [arm64] serial: mvebu-uart: fix tx lost characters at power off
    - ehci: fix EHCI host controller initialization sequence
    - [armhf] usb: gadget: aspeed: fix stop dma register setting.
    - USB: gadget: dummy-hcd: Fix errors in port-reset handling
    - usb: udc: core: Use lock when write to soft_connect
    - xhci: make sure TRB is fully written before giving it to the controller
    - [arm64,armhf] xhci: tegra: Delay for disabling LFPS detector
    - drivers core: Free dma_range_map when driver probe failed
    - driver core: Fix device link device name collision
    - driver core: Extend device_is_dependent()
    - [x86] drm/i915: s/intel_dp_sink_dpms/intel_dp_set_power/
    - [x86] drm/i915: Only enable DFP 4:4:4->4:2:0 conversion when outputting
      YCbCr 4:4:4
    - [x86] entry: Fix noinstr fail
    - [x86] cpu/amd: Set __max_die_per_package on AMD
    - cls_flower: call nla_ok() before nla_next()
    - netfilter: rpfilter: mask ecn bits before fib lookup
    - [x86] drm/i915/hdcp: Update CP property in update_pipe
    - locking/lockdep: Cure noinstr fail
    - [x86] ASoC: SOF: Intel: fix page fault at probe if i915 init fails
    - [arm64,armhf] net: dsa: mv88e6xxx: also read STU state in
      mv88e6250_g1_vtu_getnext
    - nvme-pci: refactor nvme_unmap_data
    - nvme-pci: fix error unwind in nvme_map_data
    - cachefiles: Drop superfluous readpages aops NULL check
    - skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too
    - tcp: fix TCP socket rehash stats mis-accounting
    - net_sched: gen_estimator: support large ewma log
    - udp: mask TOS bits in udp_v4_early_demux()
    - ipv6: create multicast route with RTPROT_KERNEL
    - net_sched: avoid shift-out-of-bounds in tcindex_set_parms()
    - net_sched: reject silly cell_log in qdisc_get_rtab()
    - ipv6: set multicast flag on the multicast route
    - net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled
    - [armhf] net: dsa: b53: fix an off by one in checking "vlan->vid"
    - tcp: do not mess with cloned skbs in tcp_add_backlog()
    - tcp: fix TCP_USER_TIMEOUT with zero window
    - net: core: devlink: use right genl user_ptr when handling port param
      get/set
    - [arm64] pinctrl: qcom: Allow SoCs to specify a GPIO function that's not
      0
    - [arm64] pinctrl: qcom: No need to read-modify-write the interrupt status
    - [arm64] pinctrl: qcom: Properly clear "intr_ack_high" interrupts when
      unmasking
    - [arm64] pinctrl: qcom: Don't clear pending interrupts when enabling
    - tty: implement write_iter
    - tty: fix up hung_up_tty_write() conversion
    - tcp: Fix potential use-after-free due to double kfree()
    - [x86] ASoC: SOF: Intel: hda: Avoid checking jack on system suspend
    - [x86] drm/i915/hdcp: Get conn while content_type changed
    - bpf: Local storage helpers should check nullness of owner ptr passed
    - kernfs: implement ->read_iter
    - kernfs: implement ->write_iter
    - kernfs: wire up ->splice_read and ->splice_write
    - fs/pipe: allow sendfile() to pipe again
    - mm: fix initialization of struct page for holes in memory layout
    - Revert "mm: fix initialization of struct page for holes in memory
      layout"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.12
    - [arm*] gpio: mvebu: fix pwm .get_state period calculation
    - Revert "mm/slub: fix a memory leak in sysfs_slab_add()"
    - HID: wacom: Correct NULL dereference on AES pen proximity
    - HID: multitouch: Apply MT_QUIRK_CONFIDENCE quirk for multi-input devices
    - media: Revert "media: videobuf2: Fix length check for single plane
      dmabuf queueing"
    - media: v4l2-subdev.h: BIT() is not available in userspace
    - RDMA/vmw_pvrdma: Fix network_hdr_type reported in WC
    - iwlwifi: dbg: Don't touch the tlv data
    - kernel/io_uring: cancel io_uring before task works
    - io_uring: inline io_uring_attempt_task_drop()
    - io_uring: add warn_once for io_uring_flush()
    - io_uring: stop SQPOLL submit on creator's death
    - io_uring: fix null-deref in io_disable_sqo_submit
    - io_uring: do sqo disable on install_fd error
    - io_uring: fix false positive sqo warning on flush
    - io_uring: fix uring_flush in exit_files() warning
    - io_uring: fix skipping disabling sqo on exec
    - io_uring: dont kill fasync under completion_lock
    - io_uring: fix sleeping under spin in __io_clean_op
    - objtool: Don't fail on missing symbol table
    - mm/page_alloc: add a missing mm_page_alloc_zone_locked() tracepoint
    - mm: fix a race on nr_swap_pages
    - tools: Factor HOSTCC, HOSTLD, HOSTAR definitions
    - printk: fix buffer overflow potential for print_text()
    - printk: fix string termination for record_print_text()

  [ Salvatore Bonaccorso ]
  * Add set of PI futex fixes (CVE-2021-3347)
    - futex: Ensure the correct return value from futex_lock_pi()
    - futex: Replace pointless printk in fixup_owner()
    - futex: Provide and use pi_state_update_owner()
    - rtmutex: Remove unused argument from rt_mutex_proxy_unlock()
    - futex: Use pi_state_update_owner() in put_pi_state()
    - futex: Simplify fixup_pi_state_owner()
    - futex: Handle faults correctly for PI futexes
  * Bump ABI to 3
  * xen: Fix XenStore initialisation for XS_LOCAL
  * [rt] Refresh "printk: refactor kmsg_dump_get_buffer()"
  * [rt] Refresh "locking/rtmutex: Handle the various new futex race
    conditions"
  * [rt] Refresh "locking/rtmutex: add sleeping lock implementation"
  * [rt] Refresh "crypto: limit more FPU-enabled sections"
  * Unset CRYPTO_USER_API_ENABLE_OBSOLETE

  [ Ricardo Ribalda ]
  * Enable USB_NET_AQC111 as module (Closes: #968760)

  [ Vincent Blut ]
  * [arm64] Enable DRM_VC4 again. (Closes: #968181, #968188)
  * [arm64] Enable DRM_VC4_HDMI_CEC. (Closes: #977438)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 30 Jan 2021 21:38:57 +0100

linux (5.10.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
    - [arm64] rtc: pcf2127: move watchdog initialisation to a separate
      function
    - [arm64] rtc: pcf2127: only use watchdog when explicitly available
    - dt-bindings: rtc: add reset-source property
    - kdev_t: always inline major/minor helper functions
    - ALSA: hda/realtek - Modify Dell platform name
    - ALSA: hda/hdmi: Fix incorrect mutex unlock in silent_stream_disable()
    - [x86] drm/i915/tgl: Fix Combo PHY DPLL fractional divider for 38.4MHz
      ref clock
    - RDMA/core: remove use of dma_virt_ops
    - RDMA/siw,rxe: Make emulated devices virtual in the device tree
    - fuse: fix bad inode
    - perf: Break deadlock involving exec_update_mutex
    - rwsem: Implement down_read_killable_nested
    - rwsem: Implement down_read_interruptible
    - exec: Transform exec_update_mutex into a rw_semaphore
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.7
    - i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs
    - iavf: fix double-release of rtnl_lock
    - net/sched: sch_taprio: ensure to reset/destroy all child qdiscs
    - [arm64,armhf] net: mvpp2: Add TCAM entry to drop flow control pause
      frames
    - [arm64,armhf] net: mvpp2: prs: fix PPPoE with ipv6 packet parse
    - atm: idt77252: call pci_disable_device() on error path
    - [arm64,armhf] net: mvpp2: Fix GoP port 3 Networking Complex Control
      configurations
    - [arm64,armhf] net: stmmac: dwmac-meson8b: ignore the second clock input
    - [arm64,armhf] net: ethernet: mvneta: Fix error handling in mvneta_probe
    - qede: fix offload for IPIP tunnel packets
    - virtio_net: Fix recursive call to cpus_read_lock()
    - [armhf] net/ncsi: Use real net-device for response handler
    - net-sysfs: take the rtnl lock when storing xps_cpus
    - net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc
    - net-sysfs: take the rtnl lock when storing xps_rxqs
    - net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc
    - [armhf] net: ethernet: ti: cpts: fix ethtool output when no ptp_clock
      registered
    - tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS
    - e1000e: Only run S0ix flows if shutdown succeeded
    - e1000e: bump up timeout to wait when ME un-configures ULP mode
    - Revert "e1000e: disable s0ix entry and exit flows for ME systems"
    - e1000e: Export S0ix flags to ethtool
    - bnxt_en: Check TQM rings for maximum supported value.
    - [arm64,armhf] net: mvpp2: fix pkt coalescing int-threshold configuration
    - bnxt_en: Fix AER recovery.
    - ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst()
    - net: sched: prevent invalid Scell_log shift count
    - [arm64] net: hns: fix return value check in __lb_other_process()
    - erspan: fix version 1 check in gre_parse_header()
    - net: hdlc_ppp: Fix issues when mod_timer is called while timer is
      running
    - vhost_net: fix ubuf refcount incorrectly when sendmsg fails
    - r8169: work around power-saving bug on some chip versions
    - CDC-NCM: remove "connected" log message
    - net: usb: qmi_wwan: add Quectel EM160R-GL
    - block: add debugfs stanza for QUEUE_FLAG_NOWAIT
    - workqueue: Kick a worker based on the actual activation of delayed works
    - scsi: ufs: Fix wrong print message in dev_err()
    - scsi: ufs-pci: Fix restore from S4 for Intel controllers
    - scsi: ufs-pci: Ensure UFS device is in PowerDown mode for
      suspend-to-disk ->poweroff()
    - scsi: ufs-pci: Fix recovery from hibernate exit errors for Intel
      controllers
    - scsi: ufs-pci: Enable UFSHCD_CAP_RPM_AUTOSUSPEND for Intel controllers
    - scsi: block: Introduce BLK_MQ_REQ_PM
    - scsi: ide: Do not set the RQF_PREEMPT flag for sense requests
    - scsi: scsi_transport_spi: Set RQF_PM for domain validation commands
    - scsi: core: Only process PM requests if rpm_status != RPM_ACTIVE
    - lib/genalloc: fix the overflow when size is too big
    - scsi: ufs: Clear UAC for FFU and RPMB LUNs
    - Bluetooth: revert: hci_h5: close serdev device and free hu in h5_close
    - scsi: block: Remove RQF_PREEMPT and BLK_MQ_REQ_PREEMPT
    - scsi: block: Do not accept any requests while suspended
    - crypto: ecdh - avoid buffer overflow in ecdh_set_secret()
    - [powerpc*] Handle .text.{hot,unlikely}.* in linker script
    - [x86] Staging: comedi: Return -EFAULT if copy_to_user() fails
    - usb: gadget: enable super speed plus
    - USB: cdc-acm: blacklist another IR Droid device
    - USB: cdc-wdm: Fix use after free in service_outstanding_interrupt().
    - [arm64,armhf] usb: dwc3: meson-g12a: disable clk on error handling path
      in probe
    - [arm64,armhf] usb: dwc3: gadget: Restart DWC3 gadget when enabling
      pullup
    - [arm64,armhf] usb: dwc3: gadget: Clear wait flag on dequeue
    - [arm64] usb: dwc3: ulpi: Use VStsDone to detect PHY regs access
      completion
    - [arm64] usb: dwc3: ulpi: Replace CPU-based busyloop with Protocol-based
      one
    - [arm64] usb: dwc3: ulpi: Fix USB2.0 HS/FS/LS PHY suspend regression
    - [arm64,armhf] usb: chipidea: ci_hdrc_imx: add missing put_device() call
      in usbmisc_get_init_data()
    - USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk
      set
    - usb: usbip: vhci_hcd: protect shift size
    - usb: uas: Add PNY USB Portable SSD to unusual_uas
    - USB: serial: iuu_phoenix: fix DMA from stack
    - USB: serial: option: add LongSung M5710 module support
    - USB: serial: option: add Quectel EM160R-GL
    - USB: yurex: fix control-URB timeout handling
    - USB: usblp: fix DMA to stack
    - ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks
    - USB: Gadget: dummy-hcd: Fix shift-out-of-bounds bug
    - usb: gadget: f_uac2: reset wMaxPacketSize
    - usb: gadget: function: printer: Fix a memory leak for interface
      descriptor
    - usb: gadget: u_ether: Fix MTU size mismatch with RX packet size
    - usb: gadget: Fix spinlock lockup on usb_function_deactivate
    - usb: gadget: configfs: Preserve function ordering after bind failure
    - usb: gadget: configfs: Fix use-after-free issue with udc_name
    - USB: serial: keyspan_pda: remove unused variable
    - mm: make wait_on_page_writeback() wait for multiple pending writebacks
    - [x86] mm: Fix leak of pmd ptlock
    - [x86] KVM: mmu: Use -1 to flag an undefined spte in get_mmio_spte()
    - [x86] KVM: mmu: Get root level from walkers when retrieving MMIO SPTE
    - kvm: check tlbs_dirty directly
    - [x86] KVM: mmu: Ensure TDP MMU roots are freed after yield
    - [x86] resctrl: Use an IPI instead of task_work_add() to update PQR_ASSOC
      MSR
    - [x86] resctrl: Don't move a task to the same resource group
    - blk-iocost: fix NULL iocg deref from racing against initialization
    - ALSA: hda/via: Fix runtime PM for Clevo W35xSS
    - ALSA: hda/conexant: add a new hda codec CX11970
    - ALSA: hda/realtek - Fix speaker volume control on Lenovo C940
    - ALSA: hda/realtek: Add mute LED quirk for more HP laptops
    - ALSA: hda/realtek: Enable mute and micmute LED on HP EliteBook 850 G7
    - ALSA: hda/realtek: Add two "Intel Reference board" SSID in the ALC256.
    - [amd64] iommu/vt-d: Move intel_iommu info from struct intel_svm to
      struct intel_svm_dev
    - btrfs: qgroup: don't try to wait flushing if we're already holding a
      transaction
    - btrfs: send: fix wrong file path when there is an inode with a pending
      rmdir
    - Revert "device property: Keep secondary firmware node secondary by type"
    - dmabuf: fix use-after-free of dmabuf's file->f_inode
    - [x86] drm/i915: clear the shadow batch
    - [x86] drm/i915: clear the gpu reloc batch
    - bcache: check unsupported feature sets for bcache register
    - bcache: introduce BCH_FEATURE_INCOMPAT_LOG_LARGE_BUCKET_SIZE for large
      bucket
    - net/mlx5e: Fix SWP offsets when vlan inserted by driver
    - netfilter: x_tables: Update remaining dereference to RCU
    - netfilter: ipset: fix shift-out-of-bounds in htable_bits()
    - netfilter: xt_RATEEST: reject non-null terminated string from userspace
    - netfilter: nft_dynset: report EOPNOTSUPP on missing set feature
    - [x86] mtrr: Correct the range check before performing MTRR type lookups
    - xsk: Fix memory leak for failed bind
    - rtlwifi: rise completion at the last step of firmware callback
    - scsi: target: Fix XCOPY NAA identifier lookup (CVE-2020-28374)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.8
    - [powerpc] 32s: Fix RTAS machine check with VMAP stack
    - io_uring: synchronise IOPOLL on task_submit fail
    - io_uring: limit {io|sq}poll submit locking scope
    - io_uring: patch up IOPOLL overflow_flush sync
    - [arm64] RDMA/hns: Avoid filling sl in high 3 bits of vlan_id
    - [arm64,armhf] iommu/arm-smmu-qcom: Initialize SCTLR of the bypass
      context
    - [arm64,armhf] drm/panfrost: Don't corrupt the queue mutex on open/close
    - io_uring: Fix return value from alloc_fixed_file_ref_node
    - scsi: ufs: Fix -Wsometimes-uninitialized warning
    - btrfs: skip unnecessary searches for xattrs when logging an inode
    - btrfs: fix deadlock when cloning inline extent and low on free metadata
      space
    - btrfs: shrink delalloc pages instead of full inodes
    - [arm64] net: hns3: fix incorrect handling of sctp6 rss tuple
    - [arm64] net: hns3: fix the number of queues actually used by ARQ
    - [arm64] net: hns3: fix a phy loopback fail issue
    - [arm64,armhf] net: stmmac: dwmac-sun8i: Fix probe error handling
    - [arm64,armhf] net: stmmac: dwmac-sun8i: Balance internal PHY resource
      references
    - [arm64,armhf] net: stmmac: dwmac-sun8i: Balance internal PHY power
    - [arm64,armhf] net: stmmac: dwmac-sun8i: Balance syscon
      (de)initialization
    - net: vlan: avoid leaks on register_vlan_dev() failures
    - net: ipv6: fib: flush exceptions when purging route
    - net: fix pmtu check in nopmtudisc mode
    - net: ip: always refragment ip defragmented packets
    - nexthop: Fix off-by-one error in error path
    - nexthop: Unlink nexthop group entry in error path
    - nexthop: Bounce NHA_GATEWAY in FDB nexthop groups
    - [s390x] qeth: fix deadlock during recovery
    - [s390x] qeth: fix locking for discipline setup / removal
    - [s390x] qeth: fix L2 header access in qeth_l3_osa_features_check()
    - net/mlx5: Use port_num 1 instead of 0 when delete a RoCE address
    - net/mlx5e: ethtool, Fix restriction of autoneg with 56G
    - net/mlx5e: In skb build skip setting mark in switchdev mode
    - net/mlx5: Check if lag is supported before creating one
    - scsi: lpfc: Fix variable 'vport' set but not used in
      lpfc_sli4_abts_err_handler()
    - HID: wacom: Fix memory leakage caused by kfifo_alloc
    - fanotify: Fix sys_fanotify_mark() on native x86-32
    - [armhf] OMAP2+: omap_device: fix idling of devices during probe
    - [x86] cpufreq: powernow-k8: pass policy rather than use
      cpufreq_cpu_get()
    - [armhf] spi: stm32: FIFO threshold level - fix align packet size
    - i2c: i801: Fix the i2c-mux gpiod_lookup_table not being properly
      terminated
    - bcache: set bcache device into read-only mode for
      BCH_FEATURE_INCOMPAT_OBSO_LARGE_BUCKET
    - [amd64] iommu/vt-d: Fix misuse of ALIGN in qi_flush_piotlb()
    - [amd64] iommu/intel: Fix memleak in intel_irq_remapping_alloc
    - nvme-tcp: Fix possible race of io_work and direct send
    - net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups
    - net/mlx5e: Fix two double free cases
    - regmap: debugfs: Fix a memory leak when calling regmap_attach_dev
    - [arm64,armhf] net: mvpp2: disable force link UP during port init
      procedure
    - [x86] drm/i915/dp: Track pm_qos per connector
    - [arm64,armhf] net: mvneta: fix error message when MTU too large for XDP
    - [arm64] KVM: Don't access PMCR_EL0 when no PMU is available
    - xsk: Fix race in SKB mode transmit with shared cq
    - xsk: Rollback reservation at NETDEV_TX_BUSY
    - can: isotp: isotp_getname(): fix kernel information leak
    - block: fix use-after-free in disk_part_iter_next
    - net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of
      trimmed packet
    - regmap: debugfs: Fix a reversed if statement in regmap_debugfs_init()
    - [arm64,armhf] drm/panfrost: Remove unused variables in
      panfrost_job_close()
    - tools headers UAPI: Sync linux/fscrypt.h with the kernel sources
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.9
    - btrfs: reloc: fix wrong file extent type check to avoid false ENOENT
    - btrfs: prevent NULL pointer dereference in extent_io_tree_panic
    - ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP
      machines
    - ALSA: doc: Fix reference to mixart.rst
    - [amd64] ASoC: AMD Renoir - add DMI entry for Lenovo ThinkPad X395
    - ASoC: dapm: remove widget from dirty list on free
    - [x86] hyperv: check cpu mask after interrupt has been disabled
    - drm/amdgpu: add green_sardine device id (v2)
    - drm/amdgpu: fix DRM_INFO flood if display core is not supported (bug
      210921)
    - drm/amdgpu: add new device id for Renior
    - [x86] drm/i915: Allow the sysadmin to override security mitigations
    - [x86] drm/i915/gt: Limit VFE threads based on GT
    - [x86] drm/i915/backlight: fix CPU mode backlight takeover on LPT
    - [armhf] drm/bridge: sii902x: Refactor init code into separate function
    - dt-bindings: display: sii902x: Add supply bindings
    - [armhf] drm/bridge: sii902x: Enable I/O and core VCC supplies if present
    - tracing/kprobes: Do the notrace functions check without kprobes on
      ftrace
    - tools/bootconfig: Add tracing_on support to helper scripts
    - ext4: use IS_ERR instead of IS_ERR_OR_NULL and set inode null when
      IS_ERR
    - ext4: fix wrong list_splice in ext4_fc_cleanup
    - ext4: fix bug for rename with RENAME_WHITEOUT
    - cifs: check pointer before freeing
    - cifs: fix interrupted close commands
    - [riscv64] Drop a duplicated PAGE_KERNEL_EXEC
    - [riscv64] return -ENOSYS for syscall -1
    - [riscv64] Fixup CONFIG_GENERIC_TIME_VSYSCALL
    - [mips*] fix Section mismatch in reference
    - [mips*] lib: uncached: fix non-standard usage of variable 'sp'
    - [mips*] boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB
    - [mips*] Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps
    - [mips*] relocatable: fix possible boot hangup with KASLR enabled
    - RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd()
    - ACPI: scan: Harden acpi_device_add() against device ID overflows
    - xen/privcmd: allow fetching resource sizes
    - mm/vmalloc.c: fix potential memory leak
    - mm/hugetlb: fix potential missing huge page size info
    - mm/process_vm_access.c: include compat.h
    - dm raid: fix discard limits for raid1
    - dm snapshot: flush merged data before committing metadata
    - dm integrity: fix flush with external metadata device
    - dm integrity: fix the maximum number of arguments
    - dm crypt: use GFP_ATOMIC when allocating crypto requests from softirq
    - dm crypt: do not wait for backlogged crypto request completion in
      softirq
    - dm crypt: do not call bio_endio() from the dm-crypt tasklet
    - dm crypt: defer decryption to a tasklet if interrupts disabled
    - r8152: Add Lenovo Powered USB-C Travel Hub
    - btrfs: tree-checker: check if chunk item end overflows
    - ext4: don't leak old mountpoint samples
    - io_uring: don't take files/mm for a dead task
    - io_uring: drop mm and files after task_work_run
    - ath11k: fix crash caused by NULL rx_channel
    - netfilter: ipset: fixes possible oops in mtype_resize
    - ath11k: qmi: try to allocate a big block of DMA memory first
    - btrfs: fix async discard stall
    - btrfs: merge critical sections of discard lock in workfn
    - btrfs: fix transaction leak and crash after RO remount caused by qgroup
      rescan
    - ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram
    - [arm64,armhf] hwmon: (pwm-fan) Ensure that calculation doesn't discard
      big period values
    - spi: fix the divide by 0 error when calculating xfer waiting time
    - io_uring: drop file refs after task cancel
    - bfq: Fix computation of shallow depth
    - misdn: dsp: select CONFIG_BITREVERSE
    - net: ethernet: fs_enet: Add missing MODULE_LICENSE
    - nvme-pci: mark Samsung PM1725a as IGNORE_DEV_SUBNQN
    - nvme: avoid possible double fetch in handling CQE
    - nvmet-rdma: Fix list_del corruption on queue establishment failure
    - drm/amdgpu: fix a GPU hang issue when remove device
    - drm/amdgpu: fix potential memory leak during navi12 deinitialization
    - [amd64] iommu/vt-d: Fix lockdep splat in sva bind()/unbind()
    - ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI
    - [arm64] drm/msm: Call msm_init_vram before binding the gpu
    - poll: fix performance regression due to out-of-line __put_user()
    - rcu-tasks: Move RCU-tasks initialization to before early_initcall()
    - bpf: Simplify task_file_seq_get_next()
    - bpf: Save correct stopping point in file seq iteration
    - nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt
      context
    - [amd64] iommu/vt-d: Update domain geometry in iommu_ops.at(de)tach_dev
    - net/mlx5: Fix passing zero to 'PTR_ERR'
    - net/mlx5: E-Switch, fix changing vf VLANID
    - blk-mq-debugfs: Add decode for BLK_MQ_F_TAG_HCTX_SHARED
    - mm: fix clear_refs_write locking
    - mm: don't play games with pinned pages in clear_page_refs
    - mm: don't put pinned pages into the swap cache
    - perf intel-pt: Fix 'CPU too large' error
    - dump_common_audit_data(): fix racy accesses to ->d_name
    - [x86] ASoC: Intel: fix error code cnl_set_dsp_D0()
    - nvmet-rdma: Fix NULL deref when setting pi_enable and traddr INADDR_ANY
    - nvme: don't intialize hwmon for discovery controllers
    - nvme-tcp: fix possible data corruption with bio merges
    - nvme-tcp: Fix warning with CONFIG_DEBUG_PREEMPT
    - NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock
    - pNFS: We want return-on-close to complete when evicting the inode
    - pNFS: Mark layout for return if return-on-close was not sent
    - pNFS: Stricter ordering of layoutget and layoutreturn
    - NFS: Adjust fs_context error logging
    - NFS/pNFS: Don't call pnfs_free_bucket_lseg() before removing the request
    - NFS/pNFS: Don't leak DS commits in pnfs_generic_retry_commit()
    - NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter
    - NFS: nfs_delegation_find_inode_server must first reference the
      superblock
    - NFS: nfs_igrab_and_active must first reference the superblock
    - scsi: ufs: Fix possible power drain during system suspend
    - ext4: fix superblock checksum failure when setting password salt
    - RDMA/restrack: Don't treat as an error allocation ID wrapping
    - [amd64] RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp
    - bnxt_en: Improve stats context resource accounting with RDMA driver
      loaded.
    - RDMA/mlx5: Fix wrong free of blue flame register on error
    - IB/mlx5: Fix error unwinding when set_has_smi_cap fails
    - umount(2): move the flag validity checks first
    - [x86] drm/i915/dsi: Use unconditional msleep for the panel_on_delay when
      there is no reset-deassert MIPI-sequence
    - [x86] drm/i915/icl: Fix initing the DSI DSC power refcount during HW
      readout
    - [x86] drm/i915/gt: Restore clear-residual mitigations for Ivybridge,
      Baytrail
    - mm, slub: consider rest of partial list if acquire_slab() fails
    - [riscv64] Trace irq on only interrupt is enabled
    - [amd64] iommu/vt-d: Fix unaligned addresses for
      intel_flush_svm_range_dev()
    - net: sunrpc: interpret the return value of kstrtou32 correctly
    - dm: eliminate potential source of excessive kernel log noise
    - ALSA: fireface: Fix integer overflow in transmit_midi_msg()
    - ALSA: firewire-tascam: Fix integer overflow in midi_port_work()
    - netfilter: conntrack: fix reading nf_conntrack_buckets
    - netfilter: nf_nat: Fix memleak in nf_nat_init

  [ Aurelien Jarno ]
  * Ignore ABI change for dfltcc_* symbols.
  * [riscv64] PCI: Enable PCI_HOST_GENERIC.

  [ Salvatore Bonaccorso ]
  * Bump ABI to 2
  * [rt] Update to 5.10.8-rt24

  [ Bastian Blank ]
  * [arm64] Enable support for Marvell EBU SoC.
  * Enable remaining NET_ACT_*.
  * Enable ACPI_HMAT, EFI_SOFT_RESERVE.
  * Enable remaining THERMAL_GOV_*, ENERGY_MODEL.
  * Set SCTP_DEFAULT_COOKIE_HMAC_SHA1.
  * [x86] Enable SERIAL_8250_LPSS. (closes: #973985)
  * Enable CRYPTO_DEV_VIRTIO.
  * Enable DRM_AMD_DC_*.
  * [arm] Enable CRYPTO_NHPOLY1305_NEON. (closes: #980214)
  * [arm64] Enable MFD_AXP20X_I2C. (closes: #980114)
  * [amd64] Enable SENSORS_AMD_ENERGY. (closes: #970699)
  * [cloud] Enable SUSPEND. (closes: #964845)
  * [armhf] Enable GPIO_PCA953X_IRQ. (closes: #972221)
  * [arm] Enable DRM_VC4, DRM_VC4_HDMI_CEC. (closes: #956951)
  * [x86] Enable STMMAC_ETH, DWMAC_INTEL. (closes: #980180)

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 20 Jan 2021 17:40:43 +0100

linux (5.10.5-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.5
    - net/sched: sch_taprio: reset child qdiscs before freeing them
    - ethtool: fix error paths in ethnl_set_channels()
    - ethtool: fix string set id check
    - md/raid10: initialize r10_bio->read_slot before use.
    - io_uring: close a small race gap for files cancel
    - jffs2: Allow setting rp_size to zero during remounting
    - jffs2: Fix NULL pointer dereference in rp_size fs option parsing
    - opp: fix memory leak in _allocate_opp_table
    - opp: Call the missing clk_put() on error
    - scsi: block: Fix a race in the runtime power management code
    - mm/hugetlb: fix deadlock in hugetlb_cow error path
    - mm: memmap defer init doesn't work as expected
    - [s390x] lib/zlib: fix inflating zlib streams on s390
    - io_uring: don't assume mm is constant across submits
    - io_uring: use bottom half safe lock for fixed file data
    - io_uring: add a helper for setting a ref node
    - io_uring: fix io_sqe_files_unregister() hangs
    - uapi: move constants from <linux/kernel.h> to <linux/const.h>
    - tools headers UAPI: Sync linux/const.h with the kernel headers
    - cgroup: Fix memory leak when parsing multiple source parameters
    - [s390x] zlib: move EXPORT_SYMBOL() and MODULE_LICENSE() out of
      dfltcc_syms.c
    - Bluetooth: hci_h5: close serdev device and free hu in h5_close
    - fbcon: Disable accelerated scrolling
    - reiserfs: add check for an invalid ih_entry_count
    - [x86] misc: vmw_vmci: fix kernel info-leak by initializing dbells in
      vmci_ctx_get_chkpt_doorbells()
    - media: gp8psk: initialize stats at power control logic
    - f2fs: fix shift-out-of-bounds in sanity_check_raw_super()
    - ALSA: seq: Use bool for snd_seq_queue internal flags
    - ALSA: rawmidi: Access runtime->avail always in spinlock
    - bfs: don't use WARNING: string when it's just info.
    - ext4: check for invalid block size early when mounting a file system
    - fcntl: Fix potential deadlock in send_sig{io, urg}()
    - io_uring: check kthread stopped flag when sq thread is unparked
    - [arm64,armhf] rtc: sun6i: Fix memleak in sun6i_rtc_clk_init
    - module: set MODULE_STATE_GOING state when a module fails to load
    - quota: Don't overflow quota file offsets
    - [arm64,armhf] rtc: pl031: fix resource leak in pl031_probe
    - i3c master: fix missing destroy_workqueue() on error in
      i3c_master_register
    - NFSv4: Fix a pNFS layout related use-after-free race when freeing the
      inode
    - f2fs: avoid race condition for shrinker count
    - f2fs: fix race of pending_pages in decompression
    - module: delay kobject uevent until after module init call
    - [powerpc*] 64: irq replay remove decrementer overflow check
    - fs/namespace.c: WARN if mnt_count has become negative
    - ceph: fix inode refcount leak when ceph_fill_inode on non-I_NEW inode
      fails
    - tick/sched: Remove bogus boot "safety" check
    - [s390x] always clear kernel stack backchain before calling functions
    - io_uring: remove racy overflow list fast checks
    - ALSA: pcm: Clear the full allocated memory at hw_params
    - dm verity: skip verity work if I/O error when system is shutting down
    - ext4: avoid s_mb_prefetch to be zero in individual scenarios
    - device-dax: Fix range release

  [ Luca Boccassi ]
  * [amd64,arm64] Generate BTF debug info: (partially closes: #973870)
    - Enable DEBUG_INFO_BTF.
    - Build-Depend on dwarves >= 1.16~.

  [ Aurelien Jarno ]
  * usbip: depend on usb.ids instead of usbutils.
  * [mips*] Fix build with binutils configured with
    --enable-mips-fix-loongson3-llsc=yes.

  [ Salvatore Bonaccorso ]
  * Bluetooth: Fix attempting to set RPA timeout when unsupported
    (Closes: #972968)
  * net: cdc_ncm: correct overhead in delayed_ndp_size (Closes: #970736)
  * mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start
    (CVE-2020-36158)
  * [rt] Update to 5.10.4-rt22
  * X.509: Fix crash caused by NULL pointer (Closes: #979496)
  * Revert "drm/amd/display: Fix memory leaks in S3 resume"

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 09 Jan 2021 21:25:11 +0100

linux (5.10.4-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.3
    - net: ipconfig: Avoid spurious blank lines in boot log
    - [x86] split-lock: Avoid returning with interrupts enabled
    - exfat: Avoid allocating upcase table using kcalloc()
    - [arm64] soc/tegra: fuse: Fix index bug in get_process_id
    - USB: serial: option: add interface-number sanity check to flag handling
    - USB: gadget: f_acm: add support for SuperSpeed Plus
    - USB: gadget: f_midi: setup SuperSpeed Plus descriptors
    - usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
    - USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
    - [arm64,armhf] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING
      flag to imx6ul
    - [armhf] dts: exynos: fix roles of USB 3.0 ports on Odroid XU
    - [armhf] dts: exynos: fix USB 3.0 pins supply being turned off on Odroid
      XU
    - f2fs: fix to seek incorrect data offset in inline data file
    - f2fs: init dirty_secmap incorrectly
    - scsi: megaraid_sas: Check user-provided offsets
    - [arm64,x86] HID: i2c-hid: add Vero K147 to descriptor override
    - serial_core: Check for port state when tty is in error state
    - fscrypt: remove kernel-internal constants from UAPI header
    - fscrypt: add fscrypt_is_nokey_name()
    - ubifs: prevent creating duplicate encrypted filenames
    - ext4: prevent creating duplicate encrypted filenames
    - f2fs: prevent creating duplicate encrypted filenames
    - Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
    - quota: Sanity-check quota file headers on load
    - fs: quota: fix array-index-out-of-bounds bug by passing correct argument
      to vfs_cleanup_quota_inode()
    - media: msi2500: assign SPI bus number dynamically
    - crypto: af_alg - avoid undefined behavior accessing salg_name
    - nl80211: validate key indexes for cfg80211_registered_device
    - md: fix a warning caused by a race between concurrent md_ioctl()s
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.4
    - [x86] hwmon: (k10temp) Remove support for displaying voltage and current
      on Zen CPUs
    - [x86] drm/gma500: fix double free of gma_connector
    - [arm64] rtc: pcf2127: fix pcf2127_nvmem_read/write() returns
    - selinux: fix error initialization in inode_doinit_with_dentry()
    - [armhf] dts: aspeed: s2600wf: Fix VGA memory region location
    - RDMA/core: Fix error return in _ib_modify_qp()
    - RDMA/rxe: Compute PSN windows correctly
    - [x86] /mm/ident_map: Check for errors from ident_pud_init()
    - [armel,armhf] p2v: fix handling of LPAE translation in BE mode
    - [x86] apic: Fix x2apic enablement without interrupt remapping
    - sched/deadline: Fix sched_dl_global_validate()
    - sched: Reenable interrupts in do_sched_yield()
    - [arm64] crypto: inside-secure - Fix sizeof() mismatch
    - [arm64] ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified
      mode
    - drm/msm: Add missing stub definition
    - [armhf] dts: aspeed: tiogapass: Remove vuart
    - [powerpc*] 64: Set up a kernel stack for secondaries before
      cpu_restore()
    - f2fs: call f2fs_get_meta_page_retry for nat page
    - RDMA/mlx5: Fix corruption of reg_pages in mlx5_ib_rereg_user_mr()
    - [arm64] drm/msm/dp: DisplayPort PHY compliance tests fixup
    - [arm64] drm/msm/dsi_pll_7nm: restore VCO rate during restore_state
    - [arm64] drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
    - [arm64] drm/msm/dpu: fix clock scaling on non-sc7180 board
    - spi: spi-mem: fix reference leak in spi_mem_access_start
    - scsi: aacraid: Improve compat_ioctl handlers
    - ASoC: pcm: DRAIN support reactivation
    - [armhf] drm/bridge: tpd12s015: Fix irq registering in tpd12s015_probe
    - [arm64] crypto: arm64/poly1305-neon - reorder PAC authentication with SP
      update
    - [arm64] crypto: caam - fix printing on xts fallback allocation error
      path
    - selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
    - nl80211/cfg80211: fix potential infinite loop
    - [armhf] spi: stm32: fix reference leak in stm32_spi_resume
    - [x86] mce: Correct the detection of invalid notifier priorities
    - drm/edid: Fix uninitialized variable in drm_cvt_modes()
    - ath11k: Initialize complete alpha2 for regulatory change
    - ath11k: Fix number of rules in filtered ETSI regdomain
    - ath11k: fix wmi init configuration
    - brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free}
    - [arm64,armhf] drm/panel: simple: Add flags to boe_nv133fhm_n61
    - Bluetooth: Fix null pointer dereference in hci_event_packet()
    - Bluetooth: Fix: LL PRivacy BLE device fails to connect
    - Bluetooth: hci_h5: fix memory leak in h5_close
    - [armhf] spi: stm32-qspi: fix reference leak in stm32 qspi operations
    - [armhf] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
    - [arm64] spi: tegra20-slink: fix reference leak in slink ops of tegra20
    - [arm64,armhf] spi: tegra20-sflash: fix reference leak in
      tegra_sflash_resume
    - [arm64,armhf] spi: tegra114: fix reference leak in tegra spi ops
    - [armhf] spi: imx: fix reference leak in two imx operations
    - [arm64] ASoC: qcom: common: Fix refcounting in qcom_snd_parse_of()
    - ath11k: Handle errors if peer creation fails
    - mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
    - [arm64] drm/msm/a6xx: Clear shadow on suspend
    - [arm64] drm/msm/a5xx: Clear shadow on suspend
    - [arm64] drm/msm/dp: return correct connection status after suspend
    - [arm64] drm/msm/dp: skip checking LINK_STATUS_UPDATED bit
    - [arm64] drm/msm/dp: do not notify audio subsystem if sink doesn't
      support audio
    - virtiofs fix leak in setup
    - RDMa/mthca: Work around -Wenum-conversion warning
    - [armhf] soc: ti: omap-prm: Do not check rstst bit on deassert if already
      deasserted
    - [x86] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
    - drm/udl: Fix missing error code in udl_handle_damage()
    - [x86] media: tm6000: Fix sizeof() mismatches
    - media: v4l2-fwnode: Return -EINVAL for invalid bus-type
    - media: v4l2-fwnode: v4l2_fwnode_endpoint_parse caller must init vep
      argument
    - [arm64,armhf] media: cedrus: fix reference leak in
      cedrus_start_streaming
    - [arm64] media: venus: core: change clk enable and disable order in
      resume and suspend
    - [arm64] media: venus: core: vote for video-mem path
    - [arm64] media: venus: core: vote with average bandwidth and peak
      bandwidth as zero
    - RDMA/cma: Add missing error handling of listen_id
    - scsi: core: Fix VPD LUN ID designator priorities
    - [arm64] media: venus: put dummy vote on video-mem path after last
      session release
    - media: solo6x10: fix missing snd_card_free in error handling case
    - [arm64,armhf] mmc: sdhci: tegra: fix wrong unit with busy_timeout
    - [armhf] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
    - [arm64] drm/meson: Free RDMA resources after tearing down DRM
    - [arm64] drm/meson: Unbind all connectors on module removal
    - [arm64] drm/meson: dw-hdmi: Register a callback to disable the regulator
    - [arm64] drm/meson: dw-hdmi: Ensure that clocks are enabled before
      touching the TOP registers
    - [amd64] iommu/vt-d: include conditionally on CONFIG_INTEL_IOMMU_SVM
    - Input: ads7846 - fix race that causes missing releases
    - Input: ads7846 - fix integer overflow on Rt calculation
    - Input: ads7846 - fix unaligned access on 7845
    - bus: mhi: core: Remove double locking from mhi_driver_remove()
    - bus: mhi: core: Fix null pointer access when parsing MHI configuration
    - [powerpc*] Avoid broken GCC __attribute__((optimize))
    - [powerpc*] feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
    - [armhf] dts: tacoma: Fix node vs reg mismatch for flash memory
    - Revert "powerpc/pseries/hotplug-cpu: Remove double free in error path"
    - [powerpc*] powernv/sriov: fix unsigned int win compared to less than
      zero
    - [x86] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId
    - scsi: ufs: Avoid to call REQ_CLKS_OFF to CLKS_OFF
    - scsi: ufs: Fix clkgating on/off
    - rcu: Allow rcu_irq_enter_check_tick() from NMI
    - rcu,ftrace: Fix ftrace recursion
    - rcu/tree: Defer kvfree_rcu() allocation to a clean context
    - spi: fix resource leak for drivers without .remove callback
    - [arm64] drm/meson: dw-hdmi: Disable clocks on driver teardown
    - [arm64] drm/meson: dw-hdmi: Enable the iahb clock early enough
    - PCI: Disable MSI for Pericom PCIe-USB adapter
    - [arm64] PCI: brcmstb: Initialize "tmp" before use
    - [arm64] dts: qcom: sm8250: correct compatible for sm8250-mtp
    - [armhf] Input: omap4-keypad - fix runtime PM error handling
    - ath11k: Fix the rx_filter flag setting for peer rssi stats
    - RDMA/cxgb4: Validate the number of CQEs
    - [arm64] pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin
      controller
    - memstick: fix a double-free bug in memstick_check
    - brcmfmac: fix error return code in brcmf_cfg80211_connect()
    - orinoco: Move context allocation after processing the skb
    - rsi: fix error return code in rsi_reset_card()
    - [arm64] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
    - [armel] leds: netxbig: add missing put_device() call in
      netxbig_leds_get_of_pdata()
    - RDMA/cma: Fix deadlock on &lock in rdma_cma_listen_on_all() error unwind
    - media: siano: fix memory leak of debugfs members in smsdvb_hotplug
    - [x86] platform/x86: mlx-platform: Remove PSU EEPROM from default
      platform configuration
    - [x86] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x
      platform configuration
    - [arm64] RDMA/hns: Only record vlan info for HIP08
    - [arm64] RDMA/hns: Fix missing fields in address vector
    - [arm64] RDMA/hns: Avoid setting loopback indicator when smac is same as
      dmac
    - RDMA/core: Track device memory MRs
    - [armhf] HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
    - [arm64] dts: armada-3720-turris-mox: update ethernet-phy handle name
    - [arm64] dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
    - [x86] power: supply: max17042_battery: Fix current_{avg,now} hiding with
      no current sense
    - [x86] power: supply: bq24190_charger: fix reference leak
    - genirq/irqdomain: Don't try to free an interrupt that has no mapping
    - [arm64] dts: freescale: sl28: combine SPI MTD partitions
    - [arm64,armhf] phy: tegra: xusb: Fix usb_phy device driver field
    - [arm64] dts: qcom: c630: Polish i2c-hid devices
    - [arm64] dts: qcom: c630: Fix pinctrl pins properties
    - PCI: Bounds-check command-line resource alignment requests
    - PCI: Fix overflow in command-line resource alignment requests
    - [arm64] dts: meson: fix spi-max-frequency on Khadas VIM2
    - [arm64] soc: amlogic: canvas: add missing put_device() call in
      meson_canvas_get()
    - [arm64] scsi: hisi_sas: Fix up probe error handling for v3 hw
    - scsi: pm80xx: Do not sleep in atomic context
    - [arm64] spi: spi-fsl-dspi: Use max_native_cs instead of num_chipselect
      to set SPI_MCR
    - [arm64] RDMA/hns: Fix 0-length sge calculation error
    - [arm64] RDMA/hns: Bugfix for calculation of extended sge
    - soundwire: master: use pm_runtime_set_active() on add
    - [x86] platform/x86: dell-smbios-base: Fix error return code in
      dell_smbios_init
    - [x86] ASoC: Intel: Boards: tgl_max98373: update TDM slot_width
    - ath11k: Don't cast ath11k_skb_cb to ieee80211_tx_info.control
    - ath11k: Reset ath11k_skb_cb before setting new flags
    - ath11k: Fix an error handling path
    - ath10k: Fix the parsing error in service available event
    - ath10k: Fix an error handling path
    - ath10k: Release some resources in an error handling path
    - SUNRPC: rpc_wake_up() should wake up tasks in the correct order
    - NFSv4.2: condition READDIR's mask for security label based on LSM state
    - SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
    - NFSv4: Fix the alignment of page data in the getdeviceinfo reply
    - net: sunrpc: Fix 'snprintf' return value check in 'do_xprt_debugfs'
    - lockd: don't use interval-based rebinding over TCP
    - NFS: switch nfsiod to be an UNBOUND workqueue.
    - vfio-pci: Use io_remap_pfn_range() for PCI IO memory
    - f2fs: fix double free of unicode map
    - media: tvp5150: Fix wrong return value of tvp5150_parse_dt()
    - media: saa7146: fix array overflow in vidioc_s_audio()
    - [powerpc*] perf: Fix crash with is_sier_available when pmu is not set
    - [powerpc*] 64: Fix an EMIT_BUG_ENTRY in head_64.S
    - [powerpc*] xmon: Fix build failure for 8xx
    - [powerpc*] perf: Fix to update radix_scope_qual in power10
    - [powerpc*] perf: Update the PMU group constraints for l2l3 events in
      power10
    - [powerpc*] perf: Fix the PMU group constraints for threshold events in
      power10
    - [armel,armhf] clocksource/drivers/orion: Add missing
      clk_disable_unprepare() on error path
    - [arm64] mte: fix prctl(PR_GET_TAGGED_ADDR_CTRL) if TCF0=NONE
    - bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address()
    - [arm64,armhf] soc: rockchip: io-domain: Fix error return code in
      rockchip_iodomain_probe()
    - memstick: r592: Fix error return in r592_probe()
    - [mips64el] Don't round up kernel sections size for memblock_add()
    - mt76: dma: fix possible deadlock running mt76_dma_cleanup
    - net/mlx5: Properly convey driver version to firmware
    - mt76: fix memory leak if device probing fails
    - dm ioctl: fix error return code in target_message
    - [arm64] drm/msm: a5xx: Make preemption reset case reentrant
    - [arm64,armhf] clocksource/drivers/arm_arch_timer: Use stable count
      reader in erratum sne
    - [arm64,armhf] clocksource/drivers/arm_arch_timer: Correct fault
      programming of CNTKCTL_EL1.EVNTI
    - [m68k] macintosh/adb-iop: Always wait for reply message from IOP
    - [m68k] macintosh/adb-iop: Send correct poll command
    - Bluetooth: btusb: Add the missed release_firmware() in
      btusb_mtk_setup_firmware()
    - Bluetooth: btmtksdio: Add the missed release_firmware() in
      mtk_setup_firmware()
    - Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option
    - Bluetooth: btusb: Fix detection of some fake CSR controllers with a
      bcdDevice val of 0x0134
    - [x86] platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on
      some HP x360 models
    - adm8211: fix error return code in adm8211_probe()
    - mtd: spi-nor: sst: fix BPn bits for the SST25VF064C
    - mtd: spi-nor: ignore errors in spi_nor_unlock_all()
    - mtd: spi-nor: atmel: remove global protection flag
    - mtd: spi-nor: atmel: fix unlock_all() for AT25FS010/040
    - [arm64] dts: meson: fix PHY deassert timing requirements
    - [armhf] dts: meson: fix PHY deassert timing requirements
    - [arm64] dts: meson: g12a: x96-max: fix PHY deassert timing requirements
    - [arm64] clk: fsl-sai: fix memory leak
    - scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
    - scsi: pm80xx: Fix error return in pm8001_pci_probe()
    - scsi: iscsi: Fix inappropriate use of put_device()
    - seq_buf: Avoid type mismatch for seq_buf_init
    - [x86] scsi: fnic: Fix error return code in fnic_probe()
    - [x86] platform/x86: mlx-platform: Fix item counter assignment for
      MSN2700, MSN24xx systems
    - [x86] platform/x86: mlx-platform: Fix item counter assignment for
      MSN2700/ComEx system
    - [armel,armhf] 9030/1: entry: omit FP emulation for UND exceptions taken
      in kernel mode
    - [powerpc*] pseries/hibernation: drop pseries_suspend_begin() from
      suspend ops
    - [powerpc*] pseries/hibernation: remove redundant cacheinfo update
    - [powerpc*] powermac: Fix low_sleep_handler with CONFIG_VMAP_STACK
    - [x86] ASoC: amd: change clk_get() to devm_clk_get() and add missed
      checks
    - [x86] ASoC: max98390: Fix error codes in max98390_dsm_init()
    - [powerpc*] mm: sanity_check_fault() should work for all, not only BOOK3S
    - [armhf] usb: ehci-omap: Fix PM disable depth umbalance in
      ehci_hcd_omap_probe
    - speakup: fix uninitialized flush_lock
    - nfsd: Fix message level for normal termination
    - NFSD: Fix 5 seconds delay when doing inter server copy
    - nfs_common: need lock during iterate through the list
    - [x86] kprobes: Restore BTF if the single-stepping is cancelled
    - scsi: qla2xxx: Fix FW initialization error on big endian machines
    - scsi: qla2xxx: Fix N2N and NVMe connect retry failure
    - [arm64,armhf] platform/chrome: cros_ec_spi: Don't overwrite spi::mode
    - [arm64] bus: fsl-mc: add back accidentally dropped error check
    - [arm64] bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
    - [armhf] fsi: Aspeed: Add mutex to protect HW access
    - [s390x] cio: fix use-after-free in ccw_device_destroy_console
    - iwlwifi: dbg-tlv: fix old length in is_trig_data_contained()
    - iwlwifi: mvm: hook up missing RX handlers
    - erofs: avoid using generic_block_bmap
    - [powerpc*] sstep: Emulate prefixed instructions only when
      CPU_FTR_ARCH_31 is set
    - [powerpc*] sstep: Cover new VSX instructions under CONFIG_VSX
    - ALSA: hda/hdmi: fix silent stream for first playback to DP
    - RDMA/core: Do not indicate device ready when device enablement fails
    - RDMA/uverbs: Fix incorrect variable type
    - [arm64,armhf] clk: tegra: Fix duplicated SE clock entry
    - [armhf] mtd: rawnand: gpmi: fix reference count leak in gpmi ops
    - [armhf] mtd: rawnand: gpmi: Fix the random DMA timeout issue
    - samples/bpf: Fix possible hang in xdpsock with multiple threads
    - fs: Handle I_DONTCACHE in iput_final() instead of generic_drop_inode()
    - mac80211: don't set set TDLS STA bandwidth wider than possible
    - mac80211: fix a mistake check for rx_stats update
    - [arm64] irqchip/alpine-msi: Fix freeing of interrupts on allocation
      error path
    - [arm64] RDMA/hns: Limit the length of data copied between kernel and
      userspace
    - [arm64] RDMA/hns: Normalization the judgment of some features
    - [arm64] RDMA/hns: Do shift on traffic class when using RoCEv2
    - gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask
    - ath11k: Fix incorrect tlvs in scan start command
    - watchdog: Fix potential dereferencing of null pointer
    - sunrpc: fix xs_read_xdr_buf for partial pages receive
    - RDMA/mlx5: Fix MR cache memory leak
    - RDMA/cma: Don't overwrite sgid_attr after device is released
    - [powerpc*] perf: Fix Threshold Event Counter Multiplier width for P10
    - [powerpc*] ps3: use dma_mapping_error()
    - mm/gup: reorganize internal_get_user_pages_fast()
    - mm/gup: prevent gup_fast from racing with COW during fork
    - mm/gup: combine put_compound_head() and unpin_user_page()
    - mm: memcg/slab: fix return of child memcg objcg for root memcg
    - mm: memcg/slab: fix use after free in obj_cgroup_charge
    - mm/rmap: always do TTU_IGNORE_ACCESS
    - [sparc64] fix handling of page table constructor failure
    - mm/vmalloc: Fix unlock order in s_stop()
    - mm/vmalloc.c: fix kasan shadow poisoning size
    - mm,memory_failure: always pin the page in madvise_inject_error
    - hugetlb: fix an error code in hugetlb_reserve_pages()
    - mm: don't wake kswapd prematurely when watermark boosting is disabled
    - proc: fix lookup in /proc/net subdirectories after setns(2)
    - lan743x: fix rx_napi_poll/interrupt ping-pong
    - ice, xsk: clear the status bits for the next_to_use descriptor
    - i40e, xsk: clear the status bits for the next_to_use descriptor
    - [arm64] dpaa2-eth: fix the size of the mapped SGT buffer
    - [arm64] net: bcmgenet: Fix a resource leak in an error handling path in
      the probe functin
    - [armhf] net: allwinner: Fix some resources leak in the error handling
      path of the probe and in the remove function
    - NFS/pNFS: Fix a typo in ff_layout_resend_pnfs_read()
    - devlink: use _BITUL() macro instead of BIT() in the UAPI header
    - libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
    - [powerpc*] 32s: Fix cleanup_cpu_mmu_context() compile bug
    - [arm64] watchdog: qcom: Avoid context switch in restart handler
    - [armhf] clk: ti: Fix memleak in ti_fapll_synth_setup
    - [armhf] pwm: imx27: Fix overflow for bigger periods
    - [arm64,armhf] pwm: sun4i: Remove erroneous else branch
    - io_uring: cancel only requests of current task
    - perf record: Fix memory leak when using '--user-regs=?' to list
      registers
    - qlcnic: Fix error code in probe
    - nfp: move indirect block cleanup to flower app stop callback
    - virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed()
    - virtio_net: Fix error code in probe()
    - virtio_ring: Fix two use after free bugs
    - vhost scsi: fix error return code in vhost_scsi_set_endpoint()
    - epoll: check for events when removing a timed out thread from the wait
      queue
    - [arm*] clk: bcm: dvp: Add MODULE_DEVICE_TABLE()
    - [armhf] clk: s2mps11: Fix a resource leak in error handling paths in the
      probe function
    - [arm64,armhf] clk: sunxi-ng: Make sure divider tables have sentinel
    - [powerpc*] smp: Add __init to init_big_cores()
    - [armel,armhf] 9044/1: vfp: use undef hook for VFP support detection
    - [armel,armhf] 9036/1: uncompress: Fix dbgadtb size parameter name
    - perf probe: Fix memory leak when synthesizing SDT probes
    - io_uring: fix racy IOPOLL flush overflow
    - io_uring: cancel reqs shouldn't kill overflow list
    - proc mountinfo: make splice available again
    - io_uring: fix io_cqring_events()'s noflush
    - io_uring: fix racy IOPOLL completions
    - io_uring: always let io_iopoll_complete() complete polled io
    - vfio/pci: Move dummy_resources_list init in vfio_pci_probe()
    - media: gspca: Fix memory leak in probe
    - io_uring: fix io_wqe->work_list corruption
    - io_uring: fix 0-iov read buffer select
    - io_uring: hold uring_lock while completing failed polled io in
      io_wq_submit_work()
    - io_uring: fix ignoring xa_store errors
    - io_uring: fix double io_uring free
    - io_uring: make ctx cancel on exit targeted to actual ctx
    - [armhf] media: sunxi-cir: ensure IR is handled when it is continuous
    - media: netup_unidvb: Don't leak SPI master in probe error path
    - [x86] Input: cyapa_gen6 - fix out-of-bounds stack access
    - ALSA: hda/ca0132 - Change Input Source enum strings.
    - [amd64,arm64] ACPI: NFIT: Fix input validation of bus-family
    - PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
    - Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources
      walks"
    - ACPI: PNP: compare the string length in the matching_id()
    - ALSA: hda: Fix regressions on clear and reconfig sysfs
    - ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg.
    - ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop
    - ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
    - ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
    - ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button
    - ALSA: pcm: oss: Fix a few more UBSAN fixes
    - ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G
    - ALSA: hda/realtek: Add quirk for MSI-GP73
    - ALSA: hda/realtek: Apply jack fixup for Quanta NL3
    - ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658
    - ALSA: hda/realtek - Supported Dell fixed type headset
    - ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO
      devices
    - ALSA: usb-audio: Disable sample read check if firmware doesn't give back
    - ALSA: usb-audio: Add alias entry for ASUS PRIME TRX40 PRO-S
    - ALSA: core: memalloc: add page alignment for iram
    - [s390x] smp: perform initial CPU reset also for SMT siblings
    - [s390x] idle: add missing mt_cycles calculation
    - [s390x] idle: fix accounting with machine checks
    - [s390x] dasd: fix hanging device offline processing
    - [s390x] dasd: prevent inconsistent LCU device data
    - [s390x] dasd: fix list corruption of pavgroup group list
    - [s390x] dasd: fix list corruption of lcu list
    - binder: add flag to clear buffer on txn complete
    - [x86] ASoC: cx2072x: Fix doubly definitions of Playback and Capture
      streams
    - [amd64] ASoC: AMD Renoir - add DMI table to avoid the ACP mic probe
      (broken BIOS)
    - [amd64] ASoC: AMD Raven/Renoir - fix the PCI probe (PCI revision)
    - [x86] staging: comedi: mf6x4: Fix AI end-of-conversion detection
    - z3fold: simplify freeing slots
    - z3fold: stricter locking and more careful reclaim
    - [x86] perf/x86/intel: Add event constraint for
      CYCLE_ACTIVITY.STALLS_MEM_ANY
    - [x86] perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake
    - [x86] perf/x86/intel/lbr: Fix the return type of get_lbr_cycles()
    - [powerpc*] perf: Exclude kernel samples while counting events in user
      space.
    - [x86] cpufreq: intel_pstate: Use most recent guaranteed performance
      values
    - crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
    - [x86] EDAC/amd64: Fix PCI component registration
    - cpuset: fix race between hotplug work and later CPU offline
    - dyndbg: fix use before null check
    - USB: serial: mos7720: fix parallel-port state restore
    - USB: serial: digi_acceleport: fix write-wakeup deadlocks
    - USB: serial: keyspan_pda: fix dropped unthrottle interrupts
    - USB: serial: keyspan_pda: fix write deadlock
    - USB: serial: keyspan_pda: fix stalled writes
    - USB: serial: keyspan_pda: fix write-wakeup use-after-free
    - USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
    - USB: serial: keyspan_pda: fix write unthrottling
    - btrfs: do not shorten unpin len for caching block groups
    - btrfs: update last_byte_to_unpin in switch_commit_roots
    - btrfs: fix race when defragmenting leads to unnecessary IO
    - ext4: fix an IS_ERR() vs NULL check
    - ext4: fix a memory leak of ext4_free_data
    - ext4: fix deadlock with fs freezing and EA inodes
    - ext4: don't remount read-only with errors=continue on reboot
    - [riscv64] Fix usage of memblock_enforce_memory_limit
    - [arm64] KVM: Introduce handling of AArch32 TTBCR2 traps
    - [x86] KVM: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits
    - [x86] KVM: SVM: Remove the call to sev_platform_status() during setup
    - [arm64,armhf] iommu/arm-smmu: Allow implementation specific write_s2cr
    - [arm64,armhf] iommu/arm-smmu-qcom: Read back stream mappings
    - [arm64,armhf] iommu/arm-smmu-qcom: Implement S2CR quirk
    - [armhf] dts: pandaboard: fix pinmux for gpio user button of Pandaboard
      ES
    - xprtrdma: Fix XDRBUF_SPARSE_PAGES support
    - [powerpc*] 32: Fix vmap stack - Properly set r1 before activating MMU on
      syscall too
    - [powerpc*] Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
    - [powerpc*] rtas: Fix typo of ibm,open-errinjct in RTAS filter
    - [powerpc*] bitops: Fix possible undefined behaviour with fls() and
      fls64()
    - [powerpc*] feature: Add CPU_FTR_NOEXECUTE to G2_LE
    - [powerpc*] xmon: Change printk() to pr_cont()
    - [powerpc*] 8xx: Fix early debug when SMC1 is relocated
    - [powerpc*] mm: Fix verification of MMU_FTR_TYPE_44x
    - [powerpc*] powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU
    - [powerpc*] powernv/memtrace: Don't leak kernel memory to user space
    - [powerpc*] powernv/memtrace: Fix crashing the kernel when enabling
      concurrently
    - ovl: make ioctl() safe
    - ceph: fix race in concurrent __ceph_remove_cap invocations
    - SMB3: avoid confusing warning message on mount to Azure
    - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot
      rsp
    - SMB3.1.1: do not log warning message if server doesn't populate salt
    - ubifs: wbuf: Don't leak kernel memory to flash
    - jffs2: Fix GC exit abnormally
    - jffs2: Fix ignoring mounting options problem during remounting
    - fsnotify: generalize handle_inode_event()
    - inotify: convert to handle_inode_event() interface
    - fsnotify: fix events reported to watching parent and child
    - jfs: Fix array index bounds check in dbAdjTree (CVE-2020-27815)
    - [arm64,armhf] drm/panfrost: Fix job timeout handling
    - [arm64,armhf] drm/panfrost: Move the GPU reset bits outside the timeout
      handler
    - [x86] platform/x86: mlx-platform: remove an unused variable
    - drm/dp_aux_dev: check aux_dev before use in
      drm_dp_aux_dev_get_by_minor()
    - [x86] drm/i915: Fix mismatch between misplaced vma check and vma insert
    - iio: ad_sigma_delta: Don't put SPI transfer buffer on the stack
    - [arm64,armhf] spi: pxa2xx: Fix use-after-free on unbind
    - [armhf] spi: gpio: Don't leak SPI master in probe error path
    - [armel] mtd: parser: cmdline: Fix parsing of part-names with colons
    - mtd: core: Fix refcounting for unpartitioned MTDs
    - scsi: qla2xxx: Fix crash during driver load on big endian machines
    - scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
    - scsi: lpfc: Fix scheduling call while in softirq context in
      lpfc_unreg_rpi
    - scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
    - openat2: reject RESOLVE_BENEATH|RESOLVE_IN_ROOT
    - iio: buffer: Fix demux update
    - iio: imu: st_lsm6dsx: fix edge-trigger interrupts
    - iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
    - iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
    - iio:magnetometer:mag3110: Fix alignment and data leak issues.
    - iio:pressure:mpl3115: Force alignment of buffer
    - iio:imu:bmi160: Fix too large a buffer.
    - iio:imu:bmi160: Fix alignment and data leak issues
    - md/cluster: block reshape with remote resync job
    - md/cluster: fix deadlock when node is doing resync job
    - [arm64,armhf] pinctrl: sunxi: Always call chained_irq_{enter, exit} in
      sunxi_pinctrl_irq_handler
    - [arm64] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
    - [arm64,armhf] clk: tegra: Do not return 0 on failure
    - device-dax/core: Fix memory leak when rmmod dax.ko
    - dma-buf/dma-resv: Respect num_fences when initializing the shared fence
      list.
    - driver: core: Fix list corruption after device_del()
    - libnvdimm/namespace: Fix reaping of invalidated block-window-namespace
      labels
    - [x86] platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha
      12
    - tracing: Disable ftrace selftests when any tracer is running
    - mt76: add back the SUPPORTS_REORDERING_BUFFER flag
    - PCI: Fix pci_slot_release() NULL pointer dereference
    - [arm64,armhf] regulator: axp20x: Fix DLDO2 voltage control register mask
      for AXP22x
    - [arm*] thermal/drivers/cpufreq_cooling: Update cpufreq_state only if
      state has changed
    - null_blk: Fix zone size initialization
    - null_blk: Fail zone append to conventional zones
    - drm/edid: fix objtool warning in drm_cvt_modes()
    - [x86] CPU/AMD: Save AMD NodeId as cpu_die_id

  [ Uwe Kleine-König ]
  * [armhf] Enable VIDEO_CODA and VIDEO_IMX_PXP for i.MX6 platforms

  [ Vincent Blut ]
  * [x86] Enable SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES. (Closes: #976791)

  [ Salvatore Bonaccorso ]
  * [rt] Drop "z3fold: simplify freeing slots"
  * [rt] Drop "z3fold: stricter locking and more careful reclaim"
  * [rt] Refresh "sched: Move mmdrop to RCU on RT"
  * Set ABI to 1

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 31 Dec 2020 07:26:43 +0100

linux (5.10.2-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.2
    - ptrace: Prevent kernel-infoleak in ptrace_get_syscall_info()
    - USB: legotower: fix logical error in recent commit
    - USB: add RESET_RESUME quirk for Snapscan 1212
    - ALSA: usb-audio: Fix potential out-of-bounds shift
    - ALSA: usb-audio: Fix control 'access overflow' errors from chmap
    - xhci: Give USB2 ports time to enter U3 in bus suspend
    - usb: xhci: Set quirk for XHCI_SG_TRB_CACHE_SIZE_QUIRK
    - xhci-pci: Allow host runtime PM as default for Intel Alpine Ridge LP
    - xhci-pci: Allow host runtime PM as default for Intel Maple Ridge xHCI
    - USB: UAS: introduce a quirk to set no_write_same
    - ALSA: pcm: oss: Fix potential out-of-bounds shift

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.10.1-rt20
  * Revert "Generate BTF debug info" (fixes FTBFS on 32bit architectures)
    (Reopen: #973870) (Cf. #977715)
  * Enable USB_DUMMY_HCD as module (Closes: #868771)

 -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 22 Dec 2020 22:22:59 +0100

linux (5.10.1-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.10
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.1

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.10-rt17

  [ Ben Hutchings ]
  * userns: Enable unprivileged user namespaces by default (Closes: #898446)
    (sysctl: kernel.unprivileged_userns_clone)

  [ Bastian Blank ]
  * Enable all Industrial I/O accelerometers. (closes: #975572)
  * Enable all Industrial I/O ADC.
  * Enable all Industrial I/O DAC.
  * Enable all Industrial I/O digital gyroscopes.
  * Enable all Industrial I/O IMU.
  * Enable all Industrial I/O light sensors.
  * Enable all Industrial I/O magnetometers.
  * Enable all Industrial I/O pressure sensors.
  * Enable all Industrial I/O proximity sensors.
  * Enable all Industrial I/O temperatur sensors.
  * Enable BT_LEDS.
  * Enable remaining LEDS_TRIGGER_*.
  * Enable ZONEFS_FS.
  * Gemerate BTF debug info: (closes: #973870)
    - Enable DEBUG_INFO_BTF.
    - Build-depend on dwarves.
  * [amd64] Support high CPU counts:
    - Set MAXSMP.
    - Remove not longer modifiable NR_CPUS.
  * [armel/marvell] Disable uncompressed size check.
  * [x86] Enable INTEL_TXT. (closes: #960195)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 17 Dec 2020 10:06:31 +0100

linux (5.10~rc7-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Vincent Blut ]
  * net/sched: Enable NET_SCH_ETS and NET_SCH_FQ_PIE as modules.

  [ Bastian Blank ]
  * Enable SOUNDWIRE, SOUNDWIRE_INTEL, SOUNDWIRE_QCOM.
  * Enable SND_SOC_RT700_SDW, SND_SOC_RT711_SDW, SND_SOC_RT715_SDW.
    (closes: #976791)
  * [x86] Enable SND_SOC_SOF_INTEL_SOUNDWIRE_LINK.
  * [x86] Enable SND_SOC_SOF_COMETLAKE_LP_SUPPORT,
    SND_SOC_SOF_ELKHARTLAKE_SUPPORT, SND_SOC_SOF_JASPERLAKE_SUPPORT.
  * [cloud] Disable some further filesystems. (closes: #977005)
  * [cloud] Disable NET_VENDOR_MICROCHIP.
  * [cloud] Disable ICE, IGC.
  * [amd64] Make GVE module.
  * [x86] Enable X86_CPU_RESCTRL.
  * [amd64/cloud] Disable INFINIBAND_USNIC.
  * Enable PSTORE_BLK.
  * Set SQUASHFS_FILE_DIRECT, SQUASHFS_DECOMP_MULTI_PERCPU.
  * Disable EFI_VARS.
  * [x86] Enable APPLE_PROPERTIES.
  * Enable CRYPTO_ECRDSA, CRYPTO_CURVE25519, disable CRYPTO_SM2.
  * Enable CRYPTO_CFB, CRYPTO_OFB, CRYPTO_KEYWRAP, CRYPTO_ADIANTUM.
  * Enable CRYPTO_BLAKE2S, disable CRYPTO_SM3.
  * Enable CRYPTO_AES_TI, disable CRYPTO_SM4.
  * Enable CRYPTO_DRBG_HASH, CRYPTO_DRBG_CTR.
  * Enable SND_SOC_MAX98373_SDW, SND_SOC_RT1308_SDW, SND_SOC_RT5682_SDW.
  * Enable SND_SOC_INTEL_SOUNDWIRE_SOF_MACH.
  * Enable ATH11K. (closes: #977004)
  * [arm64] Enable most accelerated crypto modules. (closes: #976635)
  * [s390x] Disable IIO.
  * Enable BLK_CGROUP_IOCOST.
  * Enable CGROUP_HUGETLB.

  [ Ben Hutchings ]
  * Fix missing module.lds for building out-of-tree modules (Closes: #975571)
    - debian/rules.real: Install module.lds under arch directory
    - kbuild: Look for module.lds under arch directory too

 -- Bastian Blank <waldi@debian.org>  Fri, 11 Dec 2020 11:16:29 +0100

linux (5.10~rc6-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Romain Perier ]
  * Enable F2FS compression support (Closes: #969139)

  [ Uwe Kleine-König ]
  * [arm64] Enable support for Kontron's sl28cpld Board Management Controller
  * [arm64] Enable support for NXP's PCF85063 RTC (Closes: #972345)

  [ Salvatore Bonaccorso ]
  * udeb: Remove efivars from efi-modules.
  * [rt] Update to 5.10-rc6-rt13

  [ Aurelien Jarno ]
  * [mips*] Increase RELOCATION_TABLE_SIZE to 0x180000.

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 03 Dec 2020 15:42:50 +0100

linux (5.10~rc4-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Uwe Kleine-König ]
  * enable support for ISO 15765-2:2016 CAN (CAN_ISOTP)

  [ YunQiang Su ]
  * [mips/loongson-3]: enable some new features for 3A 4000
    - VIRTUALIZATION/KVM
    - HOTPLUG_PCI
    - RTC based on GOLDFISH
    - ieee754 to relaxed mode

  [ Madhu Adav M J ]
  * nvme: Enable NVME_TCP and NVME_TARGET_TCP as modules (Closes: #961573)

  [ Ben Hutchings ]
  * Rewrite "MODSIGN: load blacklist from MOKx" for 5.10
  * Revert "lockdown: Refer to Debian wiki until manual page exists";
    the page was added in man-pages 5.09

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.10-rc4-rt8
  * linux-cpupower: Add librt to turbostat linker flags

  [ Nicolas Dandrimont ]
  * udeb: add bonding driver to nic-modules

 -- Ben Hutchings <benh@debian.org>  Thu, 19 Nov 2020 12:58:26 +0000

linux (5.9.15-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.12
    - io_uring: get an active ref_node from files_data
    - io_uring: order refnode recycling
    - [arm*] spi: bcm2835: Fix use-after-free on unbind
    - ipv4: use IS_ENABLED instead of ifdef
    - [amd64] IB/hfi1: Ensure correct mm is used at all times (CVE-2020-27835)
    - RDMA/i40iw: Address an mmap handler exploit in i40iw
    - btrfs: fix missing delalloc new bit for new delalloc ranges
    - btrfs: tree-checker: add missing return after error in root_item
    - btrfs: tree-checker: add missing returns after data_ref alignment checks
    - btrfs: don't access possibly stale fs_info data for printing duplicate
      device
    - btrfs: fix lockdep splat when reading qgroup config on mount
    - [arm64] rtc: pcf2127: fix a bug when not specify interrupts property
    - [s390x] fix fpu restore in entry.S
    - mm: fix VM_BUG_ON(PageTail) and BUG_ON(PageWriteback)
    - smb3: Call cifs reconnect from demultiplex thread
    - smb3: Avoid Mid pending list corruption
    - smb3: Handle error case during offload read path
    - cifs: fix a memleak with modefromsid
    - [powerpc*] KVM: PPC: Book3S HV: XIVE: Fix possible oops when accessing
      ESB page
    - [arm64] KVM: vgic-v3: Drop the reporting of GICR_TYPER.Last for
      userspace
    - [x86] KVM: x86: handle !lapic_in_kernel case in kvm_cpu_*_extint
    - [x86] KVM: x86: Fix split-irqchip vs interrupt injection window request
    - [amd64] iommu/vt-d: Don't read VCCAP register unless it exists
    - [arm64] firmware: xilinx: Use hash-table for api feature check
    - drm/amdgpu: fix SI UVD firmware validate resume fail
    - io_uring: fix ITER_BVEC check
    - trace: fix potenial dangerous pointer
    - [arm64] pgtable: Fix pte_accessible()
    - [arm64] pgtable: Ensure dirty bit is preserved across pte_wrprotect()
    - drm/amdgpu: fix a page fault
    - drm/amdgpu: update golden setting for sienna_cichlid
    - drm/amd/amdgpu: fix null pointer in runtime pm
    - HID: uclogic: Add ID for Trust Flex Design Tablet
    - HID: ite: Replace ABS_MISC 120/121 events with touchpad on/off
      keypresses
    - HID: cypress: Support Varmilo Keyboards' media hotkeys
    - HID: add support for Sega Saturn
    - Input: i8042 - allow insmod to succeed on devices without an i8042
      controller
    - HID: hid-sensor-hub: Fix issue with devices with no report ID
    - HID: add HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE for Gamevice devices
    - [x86] xen: don't unbind uninitialized lock_kicker_irq
    - HID: logitech-hidpp: Add HIDPP_CONSUMER_VENDOR_KEYS quirk for the Dinovo
      Edge
    - HID: Add Logitech Dinovo Edge battery quirk
    - proc: don't allow async path resolution of /proc/self components
    - nvme: free sq/cq dbbuf pointers when dbbuf set fails
    - io_uring: handle -EOPNOTSUPP on path resolution
    - [arm64,armhf] net: stmmac: dwmac_lib: enlarge dma reset timeout
    - vhost: add helper to check if a vq has been setup
    - vhost scsi: alloc cmds per vq instead of session
    - vhost scsi: fix cmd completion race
    - [arm64,armhf] dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size
    - scsi: libiscsi: Fix NOP race condition
    - scsi: target: iscsi: Fix cmd abort fabric stop race
    - lockdep: Put graph lock/unlock under lock_recursion protection
    - [x86] perf/x86: fix sysfs type mismatches
    - [x86] dumpstack: Do not try to access user space code of other tasks
    - [arm64,armhf] net: dsa: mv88e6xxx: Wait for EEPROM done after HW reset
    - [armhf] bus: ti-sysc: Fix reset status check for modules with quirks
    - [armhf] bus: ti-sysc: Fix bogus resetdone warning on enable for cpsw
    - [arm64,armhf] phy: tegra: xusb: Fix dangling pointer on probe failure
    - iwlwifi: mvm: use the HOT_SPOT_CMD to cancel an AUX ROC
    - iwlwifi: mvm: properly cancel a session protection for P2P
    - iwlwifi: mvm: write queue_sync_state only for sync
    - [s390x] KVM: pv: Mark mm as protected after the set secure parameters
      and improve cleanup
    - [s390x] KVM: remove diag318 reset code
    - btrfs: qgroup: don't commit transaction when we already hold the handle
    - arch: pgtable: define MAX_POSSIBLE_PHYSMEM_BITS where needed
    - [armhf] bus: ti-sysc: suppress err msg for timers used as
      clockevent/source
    - scsi: ufs: Fix race between shutdown and runtime resume flow
    - bnxt_en: fix error return code in bnxt_init_one()
    - bnxt_en: fix error return code in bnxt_init_board()
    - [x86] video: hyperv_fb: Fix the cache type when mapping the VRAM
    - bnxt_en: Release PCI regions when DMA mask setup fails during probe.
    - cxgb4: fix the panic caused by non smac rewrite
    - [s390x] qeth: make af_iucv TX notification call more robust
    - [s390x] qeth: fix af_iucv notification race
    - [s390x] qeth: fix tear down of async TX buffers
    - bonding: wait for sysfs kobject destruction before freeing struct slave
    - [powerpc*] 64s: Fix allnoconfig build since uaccess flush
    - iommu: Check return of __iommu_attach_device()
    - IB/mthca: fix return value of error branch in mthca_init_cq()
    - i40e: Fix removing driver while bare-metal VFs pass traffic
    - [arm64] firmware: xilinx: Fix SD DLL node reset issue
    - [armhf] spi: imx: fix the unbalanced spi runtime pm management
    - io_uring: fix shift-out-of-bounds when round up cq size
    - [amd64,arm64] aquantia: Remove the build_skb path
    - net: ena: handle bad request id in ena_netdev
    - net: ena: set initial DMA width to avoid intel iommu issue
    - net: ena: fix packet's addresses for rx_offset feature
    - [arm64] optee: add writeback to valid memory type
    - efi/efivars: Set generic ops before loading SSDT
    - efivarfs: revert "fix memory leak in efivarfs_create()"
      (Closes:  #977048)
    - efi: EFI_EARLYCON should depend on EFI
    - [riscv64] Add missing jump label initialization
    - [riscv64] fix barrier() use in <vdso/processor.h>
    - [arm64,armhf] net: stmmac: fix incorrect merge of patch upstream
    - [arm64] enetc: Let the hardware auto-advance the taprio base-time of 0
    - drm/nouveau: fix relocations applying logic and a double-free
    - can: gs_usb: fix endianess problem with candleLight firmware
    - [x86] platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup
      time
    - [x86] platform/x86: toshiba_acpi: Fix the wrong variable assignment
    - [arm64] RDMA/hns: Fix retry_cnt and rnr_cnt when querying QP
    - [arm64] RDMA/hns: Bugfix for memory window mtpt configuration
    - perf record: Synthesize cgroup events only if needed
    - perf stat: Use proper cpu for shadow stats
    - perf probe: Fix to die_entrypc() returns error correctly
    - [arm*] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe
    - USB: core: Change %pK for __user pointers to %px
    - usb: gadget: f_midi: Fix memleak in f_midi_alloc
    - USB: core: Fix regression in Hercules audio card
    - USB: quirks: Add USB_QUIRK_DISCONNECT_SUSPEND quirk for Lenovo A630Z TIO
      built-in usb-audio card
    - usb: gadget: Fix memleak in gadgetfs_fill_super
    - [arm64] irqchip/exiu: Fix the index of fwspec for IRQ type
    - [x86] mce: Do not overwrite no_way_out if mce_end() fails
    - [x86] speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb
    - drm/amdgpu: add rlc iram and dram firmware support
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.13
    - devlink: Hold rtnl lock while reading netdev attributes
    - devlink: Make sure devlink instance and port are in same net namespace
    - ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init
    - [s390x] net/af_iucv: set correct sk_protocol for child sockets
    - net: openvswitch: fix TTL decrement action netlink message format
    - rose: Fix Null pointer dereference in rose_send_frame()
    - sock: set sk_err to ee_errno on dequeue from errq
    - tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control
    - tun: honor IOCB_NOWAIT flag
    - vsock/virtio: discard packets only when socket is really closed
    - net/packet: fix packet receive on L3 devices without visible hard header
    - netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING
      traversal
    - ipv4: Fix tos mask in inet_rtm_getroute()
    - dt-bindings: net: correct interrupt flags in examples
    - tipc: fix incompatible mtu of transmission
    - inet_ecn: Fix endianness of checksum update when setting ECT(1)
    - geneve: pull IP header before ECN decapsulation
    - net: ip6_gre: set dev->hard_header_len when using header_ops
    - cxgb3: fix error return code in t3_sge_alloc_qset()
    - [powerpc*] net: pasemi: fix error return code in pasemi_mac_open()
    - vxlan: fix error return code in __vxlan_dev_create()
    - [arm64,armhf] net: mvpp2: Fix error return code in mvpp2_open()
    - net: skbuff: ensure LSE is pullable before decrementing the MPLS ttl
    - net: openvswitch: ensure LSE is pullable before reading it
    - net/mlx5: DR, Proper handling of unsupported Connect-X6DX SW steering
    - net/mlx5: Fix wrong address reclaim when command interface is down
    - net: mlx5e: fix fs_tcp.c build when IPV6 is not enabled
    - ALSA: usb-audio: US16x08: fix value count for level meters
    - Input: xpad - support Ardwiino Controllers
    - Input: i8042 - add ByteSpeed touchpad to noloop table
    - Input: atmel_mxt_ts - fix lost interrupts
    - tracing: Fix alignment of static buffer
    - tracing: Remove WARN_ON in start_thread()
    - uapi: fix statx attribute value overlap for DAX & MOUNT_ROOT
    - [x86] drm/i915/gt: Fixup tgl mocs for PTE tracking
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.14
    - usb: gadget: f_fs: Use local copy of descriptors for userspace copy
    - USB: serial: kl5kusb105: fix memleak on open
    - USB: serial: ch341: add new Product ID for CH341A
    - USB: serial: ch341: sort device-id entries
    - USB: serial: option: add Fibocom NL668 variants
    - USB: serial: option: add support for Thales Cinterion EXS82
    - USB: serial: option: fix Quectel BG96 matching
    - tty: Fix ->pgrp locking in tiocspgrp() (CVE-2020-29661)
    - tty: Fix ->session locking (CVE-2020-29660)
    - speakup: Reject setting the speakup line discipline outside of speakup
      (CVE-2020-27830)
    - ALSA: hda/realtek: Fix bass speaker DAC assignment on Asus Zephyrus G14
    - ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model
    - ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294
    - ALSA: hda/realtek - Add new codec supported for ALC897
    - ALSA: hda/realtek - Fixed Dell AIO wrong sound tone
    - ALSA: hda/generic: Add option to enforce preferred_dacs pairs
    - ring-buffer: Update write stamp with the correct ts
    - ring-buffer: Set the right timestamp in the slow path of
      __rb_reserve_next()
    - ring-buffer: Always check to put back before stamp when crossing pages
    - ftrace: Fix updating FTRACE_FL_TRAMP
    - ftrace: Fix DYNAMIC_FTRACE_WITH_DIRECT_CALLS dependency
    - cifs: allow syscalls to be restarted in __smb_send_rqst()
    - cifs: fix potential use-after-free in cifs_echo_request()
    - cifs: refactor create_sd_buf() and and avoid corrupting the buffer
    - cifs: add NULL check for ses->tcon_ipc
    - gfs2: Upgrade shared glocks for atime updates
    - gfs2: Fix deadlock between gfs2_{create_inode,inode_lookup} and
      delete_work_func
    - [s390x] pci: fix CPU address in MSI for directed IRQ
    - [arm64,armhf] i2c: imx: Fix reset of I2SR_IAL flag
    - [arm64,armhf] i2c: imx: Check for I2SR_IAL after every byte
    - [arm64,armhf] i2c: imx: Don't generate STOP condition if arbitration has
      been lost
    - tracing: Fix userstacktrace option for instances
    - [x86] thunderbolt: Fix use-after-free in remove_unplugged_switch()
    - [armhf] drm/omap: sdi: fix bridge enable/disable
    - drm/amdgpu/vcn3.0: stall DPG when WPTR/RPTR reset
    - drm/amdgpu/vcn3.0: remove old DPG workaround
    - [x86] drm/i915/gt: Retain default context state across shrinking
    - [x86] drm/i915/gt: Limit frequency drop to RPe on parking
    - [x86] drm/i915/gt: Program mocs:63 for cache eviction on gen9
    - [powerpc*] KVM: PPC: Book3S HV: XIVE: Fix vCPU id sanity check
    - scsi: mpt3sas: Fix ioctl timeout
    - io_uring: fix recvmsg setup with compat buf-select
    - dm writecache: advance the number of arguments when reporting max_age
    - dm writecache: fix the maximum number of arguments
    - [powerpc*] 64s/powernv: Fix memory corruption when saving SLB entries on
      MCE
    - genirq/irqdomain: Add an irq_create_mapping_affinity() function
    - [powerpc*] pseries: Pass MSI affinity to irq_create_mapping()
    - dm: fix bug with RCU locking in dm_blk_report_zones
    - dm: fix double RCU unlock in dm_dax_zero_page_range() error path
    - dm: remove invalid sparse __acquires and __releases annotations
    - [x86] uprobes: Do not use prefixes.nbytes when looping over
      prefixes.bytes
    - coredump: fix core_pattern parse error
    - mm: list_lru: set shrinker map bit when child nr_items is not zero
    - mm/swapfile: do not sleep with a spin lock held
    - hugetlb_cgroup: fix offline of hugetlb cgroup with reservations
    - Revert "amd/amdgpu: Disable VCN DPG mode for Picasso"
    - iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
    - mm: memcg/slab: fix obj_cgroup_charge() return value handling
    - lib/syscall: fix syscall registers retrieval on 32-bit platforms
      (CVE-2020-28588)
    - can: af_can: can_rx_unregister(): remove WARN() statement from list
      operation sanity check
    - gfs2: check for empty rgrp tree in gfs2_ri_update
    - netfilter: ipset: prevent uninit-value in hash_ip6_add
    - tipc: fix a deadlock when flushing scheduled work
    - gfs2: Fix deadlock dumping resource group glocks
    - gfs2: Don't freeze the file system during unmount
    - rtw88: debug: Fix uninitialized memory in debugfs code
    - [arm64] i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc()
    - dm writecache: remove BUG() and fail gracefully instead
    - Input: i8042 - fix error return code in i8042_setup_aux()
    - netfilter: nf_tables: avoid false-postive lockdep splat
    - netfilter: nftables_offload: set address type in control dissector
    - netfilter: nftables_offload: build mask based from the matching bytes
    - [x86] insn-eval: Use new for_each_insn_prefix() macro to loop over
      prefixes bytes
    - Revert "geneve: pull IP header before ECN decapsulation"
    - bpf: Fix propagation of 32-bit signed bounds from 64-bit bounds.
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.15
    - mm/zsmalloc.c: drop ZSMALLOC_PGTABLE_MAPPING
    - kprobes: Remove NMI context check
    - kprobes: Tell lockdep about kprobe nesting
    - [x86] ASoC: Intel: bytcr_rt5640: Fix HP Pavilion x2 Detachable quirks
    - net, xsk: Avoid taking multiple skbuff references
    - bpftool: Fix error return value in build_btf_type_table
    - [powerpc*] 64s: Fix hash ISA v3.0 TLBIEL instruction generation
    - batman-adv: Consider fragmentation for needed_headroom
    - batman-adv: Reserve needed_*room for fragments
    - batman-adv: Don't always reallocate the fragmentation skb head
    - ipvs: fix possible memory leak in ip_vs_control_net_init
    - [armhf] drm/panel: sony-acx565akm: Fix race condition in probe
    - can: sja1000: sja1000_err(): don't count arbitration lose as an error
    - [armhf] can: sun4i_can: sun4i_can_err(): don't count arbitration lose as
      an error
    - [armhf] can: c_can: c_can_power_up(): fix error handling
    - [x86] scsi: storvsc: Fix error return in storvsc_probe()
    - iwlwifi: pcie: invert values of NO_160 device config entries
    - [x86] perf/x86/intel: Fix a warning on x86_pmu_stop() with large PEBS
    - [x390x] zlib: export S390 symbols for zlib modules
    - mm/mmap.c: fix mmap return value when vma is merged after call_mmap()
    - [arm64] dts: rockchip: Remove system-power-controller from pmic on
      Odroid Go Advance
    - iwlwifi: pcie: limit memory read spin time
    - iwlwifi: sta: set max HE max A-MPDU according to HE capa
    - iwlwifi: pcie: set LTR to avoid completion timeout
    - iwlwifi: mvm: fix kernel panic in case of assert during CSA
    - [powerpc*] Drop -me200 addition to build flags
    - scsi: ufs: Fix unexpected values from ufshcd_read_desc_param()
    - scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE
    - [arm64,armhf] irqchip/gic-v3-its: Unconditionally save/restore the ITS
      state on suspend
    - [arm64] spi: spi-nxp-fspi: fix fspi panic by unexpected interrupts
    - [arm64,armhf] arm-smmu-qcom: Ensure the qcom_scm driver has finished
      probing
    - btrfs: do nofs allocations when adding and removing qgroup relations
    - btrfs: fix lockdep splat when enabling and disabling qgroups
    - [arm64] soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)
    - sched/idle: Fix arch_cpu_idle() vs tracing
    - [x86] intel_idle: Fix intel_idle() vs tracing
    - [x86] platform/x86: thinkpad_acpi: add P1 gen3 second fan support
    - [x86] platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga
      11e
    - [x86] platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for
      Thinkpad Yoga 11e 4th gen
    - [x86] platform/x86: thinkpad_acpi: Whitelist P15 firmware for dual fan
      control
    - [x86] platform/x86: acer-wmi: add automatic keyboard background light
      toggle key as KEY_LIGHTS_TOGGLE
    - [x86] platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion
      13 x360 PC
    - [s390x] fix irq state tracing
    - [x86] intel_idle: Build fix
    - media: pulse8-cec: fix duplicate free at disconnect or probe error
    - media: pulse8-cec: add support for FW v10 and up
    - xen: add helpers for caching grant mapping pages
    - xen: don't use page->lru for ZONE_DEVICE memory
    - Input: cm109 - do not stomp on control URB
    - Input: i8042 - add Acer laptops to the i8042 reset list
    - pinctrl: amd: remove debounce filter setting in IRQ type setting
    - [arm64] mmc: sdhci-of-arasan: Fix clock registration error for Keem Bay
      SOC
    - mmc: block: Fixup condition for CMD13 polling for RPMB requests
    - [x86] drm/i915/gem: Propagate error from cancelled submit due to context
      closure
    - [x86] drm/i915/display/dp: Compute the correct slice count for VDSC on
      DP
    - [x86] drm/i915/gt: Declare gen9 has 64 mocs entries!
    - [x86] drm/i915/gt: Ignore repeated attempts to suspend request flow
      across reset
    - [x86] drm/i915/gt: Cancel the preemption timeout on responding to it
    - drm/amdgpu: fix sdma instance fw version and feature version init
    - kbuild: avoid static_assert for genksyms
    - proc: use untagged_addr() for pagemap_read addresses
    - mm/hugetlb: clear compound_nr before freeing gigantic pages
    - scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"
    - [x86] membarrier: Get rid of a dubious optimization
    - [x86] apic/vector: Fix ordering in vector assignment
    - [x86] kprobes: Fix optprobe to detect INT3 padding correctly

  [ Salvatore Bonaccorso ]
  * [x86] drm/i915: Update TGL and RKL DMC firmware versions (Closes: #974646)
  * [rt] Refresh "mm/zsmalloc: copy with get_cpu_var() and locking"
  * xen/xenbus: Allow watches discard events before queueing (CVE-2020-29568,
    XSA-349)
  * xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
    (CVE-2020-29568, XSA-349)
  * xen/xenbus/xen_bus_type: Support will_handle watch callback
    (CVE-2020-29568, XSA-349)
  * xen/xenbus: Count pending messages for each watch (CVE-2020-29568,
    XSA-349)
  * xenbus/xenbus_backend: Disallow pending watch messages (CVE-2020-29568,
    XSA-349)
  * xen-blkback: set ring->xenblkd to NULL after kthread_stop()
    (CVE-2020-29569, XSA-350)
  * Bump ABI to 5

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 17 Dec 2020 06:31:52 +0100

linux (5.9.11-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.10
    - [powerpc*] 64s: flush L1D on kernel entry (CVE-2020-4788)
    - [powerpc*] 64s: flush L1D after user accesses (CVE-2020-4788)
    - [powerpc*] Only include kup-radix.h for 64-bit Book3S
    - Input: sunkbd - avoid use-after-free in teardown paths (CVE-2020-25669)
    - mac80211: always wind down STA state
    - can: proc: can_remove_proc(): silence remove_proc_entry warning
    - [powerpc*] smp: Call rcu_cpu_starting() earlier
    - [x86] perf/x86/intel/uncore: Fix Add BW copypasta
    - [x86] KVM: clflushopt should be treated as a no-op by emulation
    - [arm64,x86] ACPI: GED: fix -Wformat
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.11
    - ah6: fix error return code in ah6_input()
    - atm: nicstar: Unmap DMA on send error
    - bnxt_en: read EEPROM A2h address using page 0
    - devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()
    - [arm64] enetc: Workaround for MDIO register access issue
    - Exempt multicast addresses from five-second neighbor lifetime
    - inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
    - ipv6: Fix error path to cancel the meseage
    - lan743x: fix issue causing intermittent kernel log warnings
    - lan743x: prevent entire kernel HANG on open, for some platforms
    - net: b44: fix error return code in b44_init_one()
    - net: bridge: add missing counters to ndo_get_stats64 callback
    - [arm64,armhf] net: dsa: mv88e6xxx: Avoid VTU corruption on 6097
    - [armhf] net: ethernet: ti: cpsw: fix cpts irq after suspend
    - [armhf] net: ethernet: ti: cpsw: fix error return code in cpsw_probe()
    - [armhf] net: ftgmac100: Fix crash when removing driver
    - net: Have netpoll bring-up DSA management interface
    - netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
    - netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
    - net/mlx4_core: Fix init_hca fields offset
    - [armhf] net/ncsi: Fix netlink registration
    - net: phy: mscc: remove non-MACSec compatible phy
    - net/smc: fix direct access to ib_gid_addr->ndev in
      smc_ib_determine_gid()
    - [arm64,armhf] net: stmmac: Use rtnl_lock/unlock on
      netif_set_real_num_rx_queues() call
    - page_frag: Recover from memory pressure
    - qed: fix error return code in qed_iwarp_ll2_start()
    - qed: fix ILT configuration of SRC block
    - qlcnic: fix error return code in qlcnic_83xx_restart_hw()
    - sctp: change to hold/put transport for proto_unreach_timer
    - tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
    - vsock: forward all packets to the host when no H2G is registered
    - net/mlx5e: Fix check if netdev is bond slave
    - net/mlx5: Add handling of port type in rule deletion
    - net/mlx5: Clear bw_share upon VF disable
    - net/mlx5: Disable QoS when min_rates on all VFs are zero
    - PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter
    - [armhf] net: fec: Fix reference count leak in fec series ops
    - bnxt_en: Fix counter overflow logic.
    - bnxt_en: Free port stats during firmware reset.
    - [arm64,armhf] net: mvneta: fix possible memory leak in
      mvneta_swbm_add_rx_fragment
    - net: usb: qmi_wwan: Set DTR quirk for MR400
    - [armhf] Revert "Revert "gpio: omap: Fix lost edge wake-up interrupts""
    - tools, bpftool: Avoid array index warnings.
    - [arm64,armhf] pinctrl: rockchip: enable gpio pclk for
      rockchip_gpio_to_irq
    - scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold()
    - scsi: ufs: Try to save power mode change and UIC cmd completion timeout
    - [armhf] pinctrl: mcp23s08: Print error message when regmap init fails
    - [x86] ACPI: button: Add DMI quirk for Medion Akoya E2228T
    - [arm64] errata: Fix handling of 1418040 with late CPU onlining
    - [arm64] psci: Avoid printing in cpu_psci_cpu_die()
    - [arm64] smp: Tell RCU about CPUs that fail to come online
    - vfs: remove lockdep bogosity in __sb_start_write
    - gfs2: fix possible reference leak in gfs2_check_blk_type
    - [arm64,armhf] hwmon: (pwm-fan) Fix RPM calculation
    - gfs2: Fix case in which ail writes are done to jdata holes
    - [arm64] Add MIDR value for KRYO2XX gold/silver CPU cores
    - [arm64] kpti: Add KRYO2XX gold/silver CPU cores to kpti safelist
    - [arm64] cpu_errata: Apply Erratum 845719 to KRYO2XX Silver
    - [arm64,armhf] usb: dwc2: Avoid leaving the error_debugfs label unused
    - [arm64] dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay
    - [arm64] dts: allwinner: Pine H64: Enable both RGMII RX/TX delay
    - [arm64] dts: allwinner: a64: OrangePi Win: Fix ethernet node
    - [arm64] dts: allwinner: a64: Pine64 Plus: Fix ethernet node
    - [arm64] dts: allwinner: h5: OrangePi PC2: Fix ethernet node
    - [armhf] dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node
    - [armhf] Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to
      active high"
    - [armhf] dts: sun6i: a31-hummingbird: Enable RGMII RX/TX delay on
      Ethernet PHY
    - [armhf] dts: sun7i: cubietruck: Enable RGMII RX/TX delay on Ethernet PHY
    - [armhf] dts: sun7i: bananapi-m1-plus: Enable RGMII RX/TX delay on
      Ethernet PHY
    - [armhf] dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on
      Ethernet PHY
    - [armhf] dts: sun9i: Enable both RGMII RX/TX delay on Ethernet PHY
    - [arm64] dts: allwinner: h5: libretech-all-h5-cc: Enable RGMII RX/TX
      delay on PHY
    - [arm64] dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on
      PHY
    - [mips64el,mipsel] export has_transparent_hugepage() for modules
    - [arm64] dts: allwinner: h5: OrangePi Prime: Fix ethernet node
    - [armhf] dts: imx6q-prti6q: fix PHY address
    - swiotlb: using SIZE_MAX needs limits.h included
    - [armhf] dmaengine: ti: omap-dma: Block PM if SDMA is busy to fix audio
    - rcu: Don't invoke try_invoke_on_locked_down_task() with irqs disabled
    - spi: fix client driver breakages when using GPIO descriptors
    - Input: elan_i2c - fix firmware update on newer ICs
    - rfkill: Fix use-after-free in rfkill_resume()
    - perf lock: Correct field name "flags"
    - perf lock: Don't free "lock_seq_stat" if read_count isn't zero
    - SUNRPC: Fix oops in the rpc_xdr_buf event class
    - [arm64,armhf] drm: bridge: dw-hdmi: Avoid resetting force in the detect
      function
    - tools, bpftool: Add missing close before bpftool net attach exit
    - [amd64] IB/hfi1: Fix error return code in hfi1_init_dd()
    - ip_tunnels: Set tunnel option flag when tunnel metadata is present
    - can: af_can: prevent potential access of uninitialized member in
      can_rcv()
    - can: af_can: prevent potential access of uninitialized member in
      canfd_rcv()
    - can: dev: can_restart(): post buffer from the right context
    - can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to
      can_put_echo_skb()
    - can: peak_usb: fix potential integer overflow on shift of a int
    - [armhf] can: flexcan: fix failure handling of pm_runtime_get_sync()
    - [arm64] ASoC: qcom: lpass-platform: Fix memory leak
    - [arm64,armhf] drm/sun4i: dw-hdmi: fix error return code in
      sun8i_dw_hdmi_bind()
    - net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled
    - bpf, sockmap: Fix partial copy_page_to_iter so progress can still be
      made
    - bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect
    - can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits
    - dmaengine: fix error codes in channel_register()
    - [amd64] iommu/vt-d: Move intel_iommu_gfx_mapped to Intel IOMMU header
    - [amd64] iommu/vt-d: Avoid panic if iommu init fails in tboot system
    - [armhf] can: flexcan: flexcan_chip_start(): fix erroneous
      flexcan_transceiver_enable() during bus-off recovery
    - xfs: ensure inobt record walks always make forward progress
    - xfs: return corresponding errcode if xfs_initialize_perag() fail
    - [x86] ASOC: Intel: kbl_rt5663_rt5514_max98927: Do not try to disable
      disabled clock
    - [armhf] regulator: ti-abb: Fix array out of bound read access on the
      first transition
    - lib/strncpy_from_user.c: Mask out bytes after NUL terminator.
    - xfs: revert "xfs: fix rmap key and record comparison functions"
    - bpf, sockmap: Skb verdict SK_PASS to self already checked rmem limits
    - bpf, sockmap: On receive programs try to fast track SK_PASS ingress
    - bpf, sockmap: Use truesize with sk_rmem_schedule()
    - bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to self
    - [armhf] efi/arm: set HSCTLR Thumb2 bit correctly for HVC calls from HYP
    - [amd64] efi/x86: Free efi_pgd with free_pages()
    - sched/fair: Fix overutilized update in enqueue_task_fair()
    - sched: Fix data-race in wakeup
    - sched: Fix rq->nr_iowait ordering
    - libfs: fix error cast of negative value in simple_attr_write()
    - afs: Fix speculative status fetch going out of order wrt to
      modifications
    - HID: logitech-hidpp: Add PID for MX Anywhere 2
    - HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin
      trackpad
    - HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver
    - speakup: Do not let the line discipline be used several times
      (CVE-2020-28941)
    - ALSA: firewire: Clean up a locking issue in copy_resp_to_buf()
    - ALSA: usb-audio: Add delay quirk for all Logitech USB devices
    - ALSA: ctl: fix error path at adding user-defined element set
    - ALSA: mixart: Fix mutex deadlock
    - ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button
    - ALSA: hda/realtek - Add supported mute Led for HP
    - ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220)
    - ALSA: hda/realtek - HP Headset Mic can't detect after boot
    - [armhf] tty: serial: imx: fix potential deadlock
    - [armhf] tty: serial: imx: keep console clocks always on
    - HID: logitech-dj: Fix an error in mse_bluetooth_descriptor
    - [arm64,armhf,x86] efivarfs: fix memory leak in efivarfs_create()
    - [arm64,x86] staging: rtl8723bs: Add 024c:0627 to the list of SDIO
      device-ids
    - xfs: fix forkoff miscalculation related to XFS_LITINO(mp)
    - [arm64,x86] ACPI: fan: Initialize performance state sysfs attribute
    - [x86] iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type
      enum
    - [x86] iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for
      setting tablet-mode
    - [arm64] iio: cros_ec: Use default frequencies when EC returns invalid
      information
    - spi: Introduce device-managed SPI controller allocation
    - [arm64,armhf] spi: bcm2835aux: Fix use-after-free on unbind
    - [armhf] regulator: pfuze100: limit pfuze-support-disable-sw to
      pfuze{100,200}
    - regulator: fix memory leak with repeated set_machine_constraints()
    - regulator: avoid resolve_supply() infinite recursion
    - regulator: workaround self-referent regulators
    - gfs2: Fix regression in freeze_go_sync
    - mac80211: minstrel: remove deferred sampling code
    - mac80211: minstrel: fix tx status processing corner case
    - mac80211: free sta in sta_info_insert_finish() on errors
    - [s390x] fix system call exit path
    - [s390x] cpum_sf.c: fix file permission for cpum_sfb_size
    - [s390x] dasd: fix null pointer dereference for ERP requests
    - [x86] Drivers: hv: vmbus: Allow cleanup of VMBUS_CONNECT_CPU if
      disconnected
    - [x86] drm/i915: Handle max_bpc==16
    - [x86] drm/i915/tgl: Fix Media power gate sequence.
    - io_uring: don't double complete failed reissue request
    - mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based
      Intel controllers
    - [arm64] mmc: sdhci-of-arasan: Allow configuring zero tap values
    - [arm64] mmc: sdhci-of-arasan: Use Mask writes for Tap delays
    - [arm64] mmc: sdhci-of-arasan: Issue DLL reset explicitly
    - blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats
    - ptrace: Set PF_SUPERPRIV when checking capability
    - seccomp: Set PF_SUPERPRIV when checking capability
    - fanotify: fix logic of reporting name info with watched parent
    - [x86] microcode/intel: Check patch signature before saving microcode for
      early loading
    - mm: never attempt async page lock if we've transferred data already
    - mm: fix readahead_page_batch for retry entries
    - mm: memcg/slab: fix root memcg vmstats
    - mm/userfaultfd: do not access vma->vm_mm after calling
      handle_userfault()

  [ Ben Hutchings ]
  * [arm64][rt] Disable KVM, which currently conflicts with PREEMPT_RT

  [ Yves-Alexis Perez ]
  * usbnet: ipheth: fix connectivity with iOS 14

  [ Salvatore Bonaccorso ]
  * Bump ABI to 4

  [ Julien Cristau ]
  * Disable NOUVEAU_LEGACY_CTX_SUPPORT, which was keeping DRM_LEGACY enabled
    for no good reason (closes: #975038)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 27 Nov 2020 22:02:14 +0100

linux (5.9.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.7
    - net: core: use list_del_init() instead of list_del() in
      netdev_run_todo()
    - tipc: fix use-after-free in tipc_bcast_get_mode
    - [x86] drm/i915/gem: Avoid implicit vmap for highmem on x86-32
    - [x86] drm/i915/gem: Prevent using pgprot_writecombine() if PAT is not
      supported
    - [x86] drm/i915/gem: Always test execution status on closing the context
    - [x86] drm/i915/gt: Always send a pulse down the engine after disabling
      heartbeat
    - [x86] drm/i915: Break up error capture compression loops with
      cond_resched()
    - [x86] drm/i915: Cancel outstanding work after disabling heartbeats on an
      engine
    - [x86] drm/i915: Avoid mixing integer types during batch copies
    - [x86] drm/i915: Fix TGL DKL PHY DP vswing handling
    - [x86] drm/i915/gt: Initialize reserved and unspecified MOCS indices
    - [x86] drm/i915/gt: Undo forced context restores after trivial
      preemptions
    - [x86] drm/i915/gt: Delay execlist processing for tgl
    - [x86] drm/i915: Drop runtime-pm assert from vgpu io accessors
    - [x86] drm/i915: Exclude low pages (128KiB) of stolen from use
    - [x86] drm/i915: Mark ininitial fb obj as WT on eLLC machines to avoid
      rcu lockup during fbdev init
    - [x86] drm/i915: Use the active reference on the vma while capturing
    - [x86] drm/i915: Reject 90/270 degree rotated initial fbs
    - [x86] drm/i915: Restore ILK-M RPS support
    - drm/nouveau/kms/nv50-: Program notifier offset before requesting disp
      caps
    - drm/nouveau/device: fix changing endianess code to work on older GPUs
    - ptrace: fix task_join_group_stop() for the case when current is traced
    - [arm64,riscv64] cadence: force nonlinear buffers to be cloned
    - ip_tunnel: fix over-mtu packet send fail without TUNNEL_DONT_FRAGMENT
      flags
    - [armhf] net: ethernet: ti: cpsw: disable PTPv1 hw timestamping
      advertisement
    - net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition
    - sctp: Fix COMM_LOST/CANT_STR_ASSOC err reporting on big-endian platforms
    - [arm64,armhf,riscv64] sfp: Fix error handing in sfp_probe()
    - ip6_tunnel: set inner ipproto before ip6_tnl_encap
    - [armhf] net: fec: fix MDIO probing for some FEC hardware blocks
    - net: openvswitch: silence suspicious RCU usage warning
    - r8169: work around short packet hw bug on RTL8125
    - drm/nouveau/kms/nv50-: Get rid of bogus nouveau_conn_mode_valid()
    - drm/nouveau/kms/nv50-: Fix clock checking algorithm in
      nv50_dp_mode_valid()
    - Fonts: Replace discarded const qualifier
    - ALSA: hda/realtek - Fixed HP headset Mic can't be detected
    - ALSA: hda/realtek - Enable headphone for ASUS TM420
    - ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2
    - ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices
    - ALSA: usb-audio: Add implicit feedback quirk for Qu-16
    - ALSA: usb-audio: Add implicit feedback quirk for MODX
    - hugetlb_cgroup: fix reservation accounting
    - mm: mempolicy: fix potential pte_unmap_unlock pte error
    - kthread_worker: prevent queuing delayed work from timer_fn when it is
      being canceled
    - mm: always have io_remap_pfn_range() set pgprot_decrypted()
    - gfs2: Wake up when sd_glock_disposal becomes zero
    - gfs2: Don't call cancel_delayed_work_sync from within delete work
      function
    - ring-buffer: Fix recursion protection transitions between interrupt
      context
    - drm/amdgpu: update golden setting for sienna_cichlid
    - drm/amdgpu: resolved ASD loading issue on sienna
    - [amd64] iommu/vt-d: Fix kernel NULL pointer dereference in find_domain()
    - mtd: spi-nor: Don't copy self-pointing struct around
    - ftrace: Fix recursion check for NMI test
    - ftrace: Handle tracing when switching between context
    - regulator: defer probe when trying to get voltage from unresolved supply
    - [arm*] spi: bcm2835: fix gpio cs level inversion
    - tracing: Fix out of bounds write in get_trace_buf
    - futex: Handle transient "ownerless" rtmutex state correctly
    - [amd64] x86/lib: Change .weak to SYM_FUNC_START_WEAK for
      arch/x86/lib/mem*_64.S
    - [x86] kexec: Use up-to-dated screen_info copy to fill boot params
    - [x86] hyperv_fb: Update screen_info after removing old framebuffer
    - io_uring: don't miss setting IO_WQ_WORK_CONCURRENT
    - of: Fix reserved-memory overlap detection
    - [arm64,armhf] drm/sun4i: frontend: Rework a bit the phase data
    - [arm64,armhf] drm/sun4i: frontend: Reuse the ch0 phase for RGB formats
    - [arm64,armhf] drm/sun4i: frontend: Fix the scaler phase on A33
    - blk-cgroup: Fix memleak on error path
    - blk-cgroup: Pre-allocate tree node on blkg_conf_prep
    - btrfs: drop the path before adding qgroup items when enabling qgroups
    - btrfs: add a helper to read the tree_root commit root for backref lookup
    - scsi: core: Don't start concurrent async scan on same host
    - drm/amdgpu: disable DCN and VCN for navi10 blockchain SKU(v3)
    - drm/amdgpu: add DID for navi10 blockchain SKU
    - [powerpc*] scsi: ibmvscsi: Fix potential race after loss of transport
    - vsock: use ns_capable_noaudit() on socket create
    - nvme-rdma: handle unexpected nvme completion data length
    - nvmet: fix a NULL pointer dereference when tracing the flush command
    - [arm*] staging: mmal-vchiq: Fix memory leak for vchiq_instance
    - [arm*] drm/vc4: drv: Add error handding for bind
    - [amd64,arm64] ACPI: NFIT: Fix comparison to '-ENXIO'
    - drm/nouveau/gem: fix "refcount_t: underflow; use-after-free"
    - [arm64] smp: Move rcu_cpu_starting() earlier
    - vt: Disable KD_FONT_OP_COPY
    - tty: fix crash in release_tty if tty->port is not set
    - fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
    - entry: Fix the incorrect ordering of lockdep and RCU check
    - [s390x] pci: fix hot-plug of PCI function missing bus
    - [s390x] mm: make pmd/pud_deref() large page aware
    - [s390x] pkey: fix paes selftest failure with paes and pkey static build
    - USB: serial: cyberjack: fix write-URB completion race
    - USB: serial: option: add Quectel EC200T module support
    - USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231
    - USB: serial: option: add Telit FN980 composition 0x1055
    - [arm64,armhf] usb: dwc3: ep0: Fix delay status handling
    - USB: Add NO_LPM quirk for Kingston flash drive
    - io_uring: fix link lookup racing with link timeout
    - mac80211: fix regression where EAPOL frames were sent in plaintext
    - [arm64,armhf] drm/panfrost: Fix a deadlock between the shrinker and
      madvise path
    - PM: runtime: Drop runtime PM references to supplier on link removal
    - PM: runtime: Drop pm_runtime_clean_up_links()
    - PM: runtime: Resume the device earlier in __device_release_driver()
    - [x86] drm/i915: Fix encoder lookup during PSR atomic check
    - [x86] drm/i915/gt: Use the local HWSP offset during submission
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.8
    - [x86] powercap: restrict energy meter to root access (CVE-2020-8694)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.9
    - [x86] drm/i915: Hold onto an explicit ref to i915_vma_work.pinned
    - [x86] drm/i915/gem: Flush coherency domains on first set-domain-ioctl
    - mm: memcg: link page counters to root if use_hierarchy is false
    - nbd: don't update block size after device is started
    - [arm64] KVM: Force PTE mapping on fault resulting in a device mapping
    - xfrm: interface: fix the priorities for ipip and ipv6 tunnels
    - [x86] ASoC: Intel: kbl_rt5663_max98927: Fix kabylake_ssp_fixup function
    - [x86] hv_balloon: disable warning when floor reached
    - net: xfrm: fix a race condition during allocing spi
    - [riscv64] irqchip/sifive-plic: Fix broken irq_set_affinity() callback
    - mtd: spi-nor: Fix address width on flash chips > 16MB
    - xfs: set xefi_discard when creating a deferred agfl free log intent item
    - mac80211: don't require VHT elements for HE on 2.4 GHz
    - netfilter: nftables: fix netlink report logic in flowtable and genid
    - netfilter: use actual socket sk rather than skb sk when routing harder
    - netfilter: nf_tables: missing validation from the abort path
    - PCI: Always enable ACS even if no ACS Capability
    - netfilter: ipset: Update byte and packet counters regardless of whether
      they match
    - [riscv64] irqchip/sifive-plic: Fix chip_data access within a hierarchy
    - [powerpc*] eeh_cache: Fix a possible debugfs deadlock
    - [arm*] drm/vc4: bo: Add a managed action to cleanup the cache
    - IB/srpt: Fix memory leak in srpt_add_one
    - mm: memcontrol: correct the NR_ANON_THPS counter of hierarchical memcg
    - [arm64,armhf] drm/panfrost: rename error labels in device_init
    - [arm64,armhf] drm/panfrost: move devfreq_init()/fini() in device
    - [arm64,armhf] drm/panfrost: Fix module unload
    - perf trace: Fix segfault when trying to trace events by cgroup
    - perf tools: Add missing swap for ino_generation
    - perf tools: Add missing swap for cgroup events
    - [x86] ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
    - [amd64] iommu/vt-d: Fix sid not set issue in intel_svm_bind_gpasid()
    - [amd64] iommu/vt-d: Fix a bug for PDP check in prq_event_thread
    - afs: Fix warning due to unadvanced marshalling pointer
    - afs: Fix incorrect freeing of the ACL passed to the YFS ACL store op
    - vfio/pci: Implement ioeventfd thread handler for contended memory lock
    - can: rx-offload: don't call kfree_skb() from IRQ context
    - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ
      context
    - can: dev: __can_get_echo_skb(): fix real payload length return value for
      RTR frames
    - can: can_create_echo_skb(): fix echo skb generation: always use
      skb_clone()
    - can: j1939: swap addr and pgn in the send example
    - can: j1939: j1939_sk_bind(): return failure if netdev is down
    - can: peak_usb: add range checking in decode operations
    - can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
    - can: peak_canfd: pucan_handle_can_rx(): fix echo management when
      loopback is on
    - [armhf] can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for
      LS1021A
    - [armhf] can: flexcan: flexcan_remove(): disable wakeup completely
    - xfs: flush new eof page on truncate to avoid post-eof corruption
    - xfs: fix missing CoW blocks writeback conversion retry
    - xfs: fix scrub flagging rtinherit even if there is no rt device
    - io_uring: ensure consistent view of original task ->mm from SQPOLL
    - [arm64] spi: fsl-dspi: fix wrong pointer in suspend/resume
    - [armel,armhf] PCI: mvebu: Fix duplicate resource requests
    - ceph: check session state after bumping session->s_seq
    - [x86] speculation: Allow IBPB to be conditionally enabled on CPUs with
      always-on STIBP
    - USB: apple-mfi-fastcharge: fix reference leak in
      apple_mfi_fc_set_property
    - [arm64,x86] tpm: efi: Don't create binary_bios_measurements file for an
      empty log
    - [arm64] KVM: ARM_SMCCC_ARCH_WORKAROUND_1 doesn't return
      SMCCC_RET_NOT_REQUIRED
    - ath9k_htc: Use appropriate rs_datalen type
    - scsi: ufs: Fix missing brace warning for old compilers
    - [arm64] usb: dwc3: pci: add support for the Intel Alder Lake-S
    - opp: Reduce the size of critical section in _opp_table_kref_release()
    - usb: raw-gadget: fix memory leak in gadget_setup
    - ALSA: hda: Separate runtime and system suspend
    - ALSA: hda: Reinstate runtime_allow() for all hda controllers
    - [amd64] x86/boot/compressed/64: Introduce sev_status
    - gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
    - gfs2: Add missing truncate_inode_pages_final for sd_aspace
    - gfs2: check for live vs. read-only file system in gfs2_fitrim
    - scsi: hpsa: Fix memory leak in hpsa_init_one()
    - drm/amdgpu: perform srbm soft reset always on SDMA resume
    - mac80211: fix use of skb payload instead of header
    - cfg80211: initialize wdev data earlier
    - cfg80211: regulatory: Fix inconsistent format argument
    - tracing: Fix the checking of stackidx in __ftrace_trace_stack
    - Revert "nvme-pci: remove last_sq_tail"
    - scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
    - scsi: mpt3sas: Fix timeouts observed while reenabling IRQ
    - nvme: introduce nvme_sync_io_queues
    - nvme-rdma: avoid race between time out and tear down
    - nvme-rdma: avoid repeated request completion
    - [amd64] iommu/amd: Increase interrupt remapping table limit to 512
      entries
    - [s390x] smp: move rcu_cpu_starting() earlier
    - vfio/pci: Bypass IGD init in case of -ENODEV
    - amd/amdgpu: Disable VCN DPG mode for Picasso
    - iomap: clean up writeback state logic on writepage error
    - [riscv64] Set text_offset correctly for M-Mode
    - tpm_tis: Disable interrupts on ThinkPad T490s
    - [arm*] spi: bcm2835: remove use of uninitialized gpio flags variable
    - [x86] pinctrl: intel: Fix 2 kOhm bias which is 833 Ohm
    - [x86] pinctrl: intel: Set default bias in case no particular value given
    - [armhf] gpio: aspeed: fix ast2600 bank properties
    - [armel,armhf] 9019/1: kprobes: Avoid fortify_panic() when copying
      optprobe template
    - bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE
    - libbpf, hashmap: Fix undefined behavior in hash_bits
    - [armhf] pinctrl: mcp23s08: Use full chunk of memory for regmap
      configuration
    - [armhf] pinctrl: aspeed: Fix GPI only function problem.
    - net/mlx5e: Fix modify header actions memory leak
    - net/mlx5e: Protect encap route dev from concurrent release
    - net/mlx5e: Use spin_lock_bh for async_icosq_lock
    - net/mlx5: Fix deletion of duplicate rules
    - net/mlx5: E-switch, Avoid extack error log for disabled vport
    - net/mlx5e: Fix VXLAN synchronization after function reload
    - net/mlx5e: Fix incorrect access of RCU-protected xdp_prog
    - SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow()
    - NFSD: Fix use-after-free warning when doing inter-server copy
    - NFSD: fix missing refcount in nfsd4_copy by nfsd4_do_async_copy
    - tools/bpftool: Fix attaching flow dissector
    - bpf: Zero-fill re-used per-cpu map element
    - r8169: fix potential skb double free in an error path
    - r8169: disable hw csum for short packets on all chip versions
    - [arm64] pinctrl: qcom: Move clearing pending IRQ to
      .irq_request_resources callback
    - nbd: fix a block_device refcount leak in nbd_release
    - i40e: Fix MAC address setting for a VF via Host/VM
    - igc: Fix returning wrong statistics (Closes: #970722)
    - lan743x: correctly handle chips with internal PHY
    - net: phy: realtek: support paged operations on RTL8201CP
    - xfs: fix flags argument to rmap lookup when converting shared file rmaps
    - xfs: set the unwritten bit in rmap lookup flags in
      xchk_bmap_get_rmapextents
    - xfs: fix rmap key and record comparison functions
    - xfs: fix brainos in the refcount scrubber's rmap fragment processor
    - lan743x: fix "BUG: invalid wait context" when setting rx mode
    - xfs: fix a missing unlock on error in xfs_fs_map_blocks
    - of/address: Fix of_node memory leak in of_dma_is_coherent
    - ch_ktls: Update cheksum information
    - ch_ktls: tcb update fails sometimes
    - [i386] cosa: Add missing kfree in error path of cosa_write
    - hwmon: (applesmc) Re-work SMC comms
    - NFS: Fix listxattr receive buffer size
    - vrf: Fix fast path output packet handling with async Netfilter rules
    - lan743x: fix use of uninitialized variable
    - [arm64] mm: Validate hotplug range before creating linear mapping
    - kernel/watchdog: fix watchdog_allowed_mask not used warning
    - mm: memcontrol: fix missing wakeup polling thread
    - afs: Fix afs_write_end() when called with copied == 0 [ver #3]
    - perf: Fix get_recursion_context()
    - nvme: factor out a nvme_configure_metadata helper
    - nvme: freeze the queue over ->lba_shift updates
    - nvme: fix incorrect behavior when BLKROSET is called by the user
    - perf: Simplify group_sched_in()
    - perf: Fix event multiplexing for exclusive groups
    - [arm64] firmware: xilinx: fix out-of-bounds access
    - erofs: fix setting up pcluster for temporary pages
    - erofs: derive atime instead of leaving it empty
    - ext4: correctly report "not supported" for {usr,grp}jquota when
      !CONFIG_QUOTA
    - ext4: unlock xattr_sem properly in ext4_inline_data_truncate()
    - btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch
    - btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod
    - btrfs: fix min reserved size calculation in merge_reloc_root
    - btrfs: dev-replace: fail mount if we don't have replace item with target
      device
    - [arm64] KVM: Don't hide ID registers from userspace
    - [x86] thunderbolt: Fix memory leak if ida_simple_get() fails in
      enumerate_services()
    - [x86] thunderbolt: Add the missed ida_simple_remove() in
      ring_request_msix()
    - block: add a return value to set_capacity_revalidate_and_notify
    - loop: Fix occasional uevent drop
    - uio: Fix use-after-free in uio_unregister_device()
    - Revert "usb: musb: convert to devm_platform_ioremap_resource_byname"
    - usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode
    - [x86] usb: typec: ucsi: Report power supply changes
    - virtio: virtio_console: fix DMA memory allocation for rproc serial
    - futex: Don't enable IRQs unconditionally in put_pi_state()
    - jbd2: fix up sparse warnings in checkpoint code
    - bootconfig: Extend the magic check range to the preceding 3 bytes
    - mm/compaction: count pages and stop correctly during page isolation
    - mm/compaction: stop isolation if too many pages are isolated and we have
      pages to migrate
    - mm/slub: fix panic in slab_alloc_node()
    - mm/vmscan: fix NR_ISOLATED_FILE corruption on 64-bit
    - mm/gup: use unpin_user_pages() in __gup_longterm_locked()
    - Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint"
    - reboot: fix overflow parsing reboot cpu number
    - hugetlbfs: fix anon huge page migration race
    - ocfs2: initialize ip_next_orphan
    - hwmon: (amd_energy) modify the visibility of the counters
      (CVE-2020-12912)
    - selinux: Fix error return code in sel_ib_pkey_sid_slow()
    - io_uring: round-up cq size before comparing with rounded sq size
    - [riscv64] gpio: sifive: Fix SiFive gpio probe
    - gpio: pcie-idio-24: Fix irq mask when masking
    - gpio: pcie-idio-24: Fix IRQ Enable Register value
    - gpio: pcie-idio-24: Enable PEX8311 interrupts
    - [arm64] mmc: sdhci-of-esdhc: Handle pulse width detection erratum for
      more SoCs
    - don't dump the threads that had been already exiting when zapped.
    - [x86] drm/i915: Correctly set SFC capability for video engines
    - [x86] drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]
    - NFSv4.2: fix failure to unregister shrinker
    - pinctrl: amd: use higher precision for 512 RtcClk
    - pinctrl: amd: fix incorrect way to disable debounce filter
    - swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"
    - cpufreq: Introduce governor flags
    - cpufreq: Introduce CPUFREQ_GOV_STRICT_TARGET
    - cpufreq: Add strict_target to struct cpufreq_policy
    - cpufreq: intel_pstate: Take CPUFREQ_GOV_STRICT_TARGET into account
    - ethtool: netlink: add missing netdev_features_change() call
    - IPv6: Set SIT tunnel hard_header_len to zero
    - [s390x] net/af_iucv: fix null pointer dereference on shutdown
    - net: udp: fix IP header access and skb lookup on Fast/frag0 UDP GRO
    - net: udp: fix UDP header access on Fast/frag0 UDP GRO
    - net: Update window_clamp if SOCK_RCVBUF is set
    - tipc: fix memory leak in tipc_topsrv_start()
    - devlink: Avoid overwriting port attributes of registered port
    - tunnels: Fix off-by-one in lower MTU bounds for ICMP/ICMPv6 replies
    - [powerpc*] 603: Always fault when _PAGE_ACCESSED is not set
    - null_blk: Fix scheduling in atomic with zoned mode
    - Convert trailing spaces and periods in path components

  [ Uwe Kleine-König ]
  * [amd64] Enable SND_SOC_AMD_ACP3x, SND_SOC_AMD_RENOIR and
    SND_SOC_AMD_RENOIR_MACH (Closes: #973252)
  * [arm64] Add device tree for Kobol helios64 from rockchip next branch.

  [ John L. Villalovos ]
  * [arm64] NUMA: Kconfig: Increase NODES_SHIFT to 4

  [ Salvatore Bonaccorso ]
  * [rt] Refresh "signals: Allow rt tasks to cache one sigqueue struct"
  * [armhf] dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY
    (Closes: #973369)
  * Bump ABI to 3

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 19 Nov 2020 08:19:18 +0100

linux (5.9.6-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.2
    - [powerpc*] ibmveth: Switch order of ibmveth_helper calls.
    - [powerpc*] ibmveth: Identify ingress large send packets.
    - cxgb4: handle 4-tuple PEDIT to NAT mode translation
    - ipv4: Restore flowi4_oif update before call to xfrm_lookup_route
    - mlx4: handle non-napi callers to napi_poll
    - net: dsa: microchip: fix race condition
    - net: fec: Fix phy_device lookup for phy_reset_after_clk_enable()
    - net: fec: Fix PHY init after phy_reset_after_clk_enable()
    - net: fix pos incrementment in ipv6_route_seq_next
    - net: ipa: skip suspend/resume activities if not set up
    - net: sched: Fix suspicious RCU usage while accessing tcf_tunnel_info
    - net/smc: fix use-after-free of delayed events
    - net/smc: fix valid DMBE buffer sizes
    - tipc: fix NULL pointer dereference in tipc_named_rcv
    - tipc: fix the skb_unshare() in tipc_buf_append()
    - socket: fix option SO_TIMESTAMPING_NEW
    - socket: don't clear SOCK_TSTAMP_NEW when SO_TIMESTAMPNS is disabled
    - can: m_can_platform: don't call m_can_class_suspend in runtime suspend
    - can: j1935: j1939_tp_tx_dat_new(): fix missing initialization of skbcnt
    - net: j1939: j1939_session_fresh_new(): fix missing initialization of
      skbcnt
    - binder: fix UAF when releasing todo list (CVE-2020-0423)
    - ALSA: bebob: potential info leak in hwdep_read()
    - ALSA: hda: fix jack detection with Realtek codecs when in D3
    - ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close
    - tipc: re-configure queue limit for broadcast link
    - tipc: fix incorrect setting window for bcast link
    - ibmvnic: save changed mac address to adapter->mac_addr
    - icmp: randomize the global rate limiter
    - net: ftgmac100: Fix Aspeed ast2600 TX hang issue
    - net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device
    - net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling
      ether_setup
    - net: Properly typecast int values to set sk_max_pacing_rate
    - net/sched: act_ct: Fix adding udp port mangle operation
    - net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels
    - netsec: ignore 'phy-mode' device property on ACPI systems
    - nexthop: Fix performance regression in nexthop deletion
    - nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in
      nfc_genl_fw_download()
    - r8169: fix operation under forced interrupt threading
    - tcp: fix to update snd_wl1 in bulk receiver fast path
    - net: ethernet: mtk-star-emac: select REGMAP_MMIO
    - net/sched: act_gate: Unlock ->tcfa_lock in tc_setup_flow_action()
    - ixgbe: fix probing of multi-port devices with one MDIO
    - net: openvswitch: fix to make sure flow_lookup() is not preempted
    - sfc: move initialisation of efx->filter_sem to efx_init_struct()
    - ALSA: hda - Don't register a cb func if it is registered already
    - ALSA: hda - Fix the return value if cb func is already registered
    - ALSA: usb-audio: Line6 Pod Go interface requires static clock rate quirk
    - ALSA: hda/realtek - The front Mic on a HP machine doesn't work
    - ALSA: hda/realtek - set mic to auto detect on a HP AIO machine
    - ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7
    - ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887
    - cifs: remove bogus debug code
    - cifs: Return the error from crypt_message when enc/dec key not found.
    - SMB3: Resolve data corruption of TCP server info fields
    - SMB3.1.1: Fix ids returned in POSIX query dir
    - smb3: do not try to cache root directory if dir leases not supported
    - smb3: fix stat when special device file and mounted with modefromsid
    - [arm64] Make use of ARCH_WORKAROUND_1 even when KVM is not enabled
    - [x86] KVM: nVMX: Morph notification vector IRQ on nested VM-Enter to
      pending PI
    - [x86] KVM: nVMX: Reset the segment cache when stuffing guest segs
    - [x86] KVM: nVMX: Reload vmcs01 if getting vmcs12's pages fails
    - [x86] KVM: x86/mmu: Commit zap of remaining invalid pages when
      recovering lpages
    - [x86] KVM: x86: Intercept LA57 to inject #GP fault when it's reserved
    - [x86] KVM: SVM: Initialize prev_ga_tag before use
    - crypto: caam - add xts check for block length equal to zero
    - crypto: algif_aead - Do not set MAY_BACKLOG on the async path
    - crypto: caam/qi - add fallback for XTS with more than 8B IV
    - crypto: caam/qi - add support for more XTS key lengths
    - crypto: caam/jr - add fallback for XTS with more than 8B IV
    - crypto: caam/jr - add support for more XTS key lengths
    - crypto: caam/qi2 - add fallback for XTS with more than 8B IV
    - crypto: caam/qi2 - add support for more XTS key lengths
    - RAS/CEC: Fix cec_init() prototype
    - sched/fair: Fix wrong negative conversion in find_energy_efficient_cpu()
    - microblaze: fix kbuild redundant file warning
    - [x86] EDAC/i5100: Fix error handling order in i5100_init_one()
    - [x86] perf/x86/intel/ds: Fix x86_pmu_stop warning for large PEBS
    - [x86] x86/fpu: Allow multiple bits in clearcpuid= parameter
    - irqchip/ti-sci-inta: Fix unsigned comparison to zero
    - irqchip/ti-sci-intr: Fix unsigned comparison to zero
    - [arm64] kprobe: add checks for ARMv8.3-PAuth combined instructions
    - seqlock: Unbreak lockdep
    - drivers/perf: xgene_pmu: Fix uninitialized resource struct
    - drivers/perf: thunderx2_pmu: Fix memory resource error handling
    - sched/fair: Fix wrong cpu selecting from isolated domain
    - sched/fair: Use dst group while checking imbalance for NUMA balancer
    - [arm64] perf: Add missing ISB in armv8pmu_enable_counter()
    - [x86] perf/x86/intel/uncore: Update Ice Lake uncore units
    - [x86] perf/x86/intel/uncore: Reduce the number of CBOX counters
    - [x86] perf/x86/intel/uncore: Fix for iio mapping on Skylake Server
    - [x86] perf/x86/intel/uncore: Fix the scale of the IMC free-running
      events
    - [x86] x86/nmi: Fix nmi_handle() duration miscalculation
    - [amd64] x86/events/amd/iommu: Fix sizeof mismatch
    - [arm64] pinctrl: qcom: Set IRQCHIP_SET_TYPE_MASKED and
      IRQCHIP_MASK_ON_SUSPEND flags
    - [arm64] pinctrl: qcom: Use return value from irq_set_wake() call
    - [x86] perf/x86: Fix n_pair for cancelled txn
    - lockdep: Fix usage_traceoverflow
    - lockdep: Fix lockdep recursion
    - lockdep: Revert "lockdep: Use raw_cpu_*() for per-cpu variables"
    - perf/core: Fix race in the perf_mmap_close() function (CVE-2020-14351)
    - crypto: algif_skcipher - EBUSY on aio should be an error
    - crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call
    - crypto: picoxcell - Fix potential race condition bug
    - media: vivid: Fix global-out-of-bounds read in precalculate_color()
    - crypto: ccree - fix runtime PM imbalance on error
    - media: hantro: h264: Get the correct fallback reference buffer
    - media: hantro: postproc: Fix motion vector space allocation
    - media: ov5640: Correct Bit Div register in clock tree diagram
    - media: i2c: fix error check on max9286_read call
    - media: m5mols: Check function pointer in m5mols_sensor_power
    - fscrypt: restrict IV_INO_LBLK_32 to ino_bits <= 32
    - media: uvcvideo: Set media controller entity functions
    - media: uvcvideo: Silence shift-out-of-bounds warning
    - media: staging/intel-ipu3: css: Correctly reset some memory
    - media: omap3isp: Fix memleak in isp_probe
    - media: i2c: ov5640: Remain in power down for DVP mode unless streaming
    - media: i2c: ov5640: Separate out mipi configuration from s_power
    - media: i2c: ov5640: Enable data pins on poweron for DVP mode
    - media: i2c: max9286: Allocate v4l2_async_subdev dynamically
    - crypto: sa2ul - fix compiler warning produced by clang
    - spi: fsi: Handle 9 to 15 byte transfers lengths
    - spi: fsi: Fix use of the bneq+ sequencer instruction
    - spi: fsi: Implement restricted size for certain controllers
    - spi: dw-pci: free previously allocated IRQs if desc->setup() fails
    - crypto: sa2ul - Select CRYPTO_AUTHENC
    - crypto: omap-sham - fix digcnt register handling with export/import
    - crypto: sa2ul - Fix pm_runtime_get_sync() error checking
    - regmap: debugfs: Fix more error path regressions
    - hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61}
    - hwmon: (w83627ehf) Fix a resource leak in probe
    - crypto: stm32/crc32 - Avoid lock if hardware is already used
    - crypto: sun8i-ce - handle endianness of t_common_ctl
    - media: mx2_emmaprp: Fix memleak in emmaprp_probe
    - media: mtk-mdp: Fix Null pointer dereference when calling list_add
    - media: tc358743: initialize variable
    - media: tc358743: cleanup tc358743_cec_isr
    - nvme: fix error handling in nvme_ns_report_zones
    - media: rcar-vin: Fix a reference count leak.
    - media: rockchip/rga: Fix a reference count leak.
    - media: platform: fcp: Fix a reference count leak.
    - media: camss: Fix a reference count leak.
    - media: s5p-mfc: Fix a reference count leak
    - media: stm32-dcmi: Fix a reference count leak
    - media: ti-vpe: Fix a missing check and reference count leak
    - regulator: resolve supply after creating regulator
    - hwmon: (bt1-pvt) Test sensor power supply on probe
    - hwmon: (bt1-pvt) Cache current update timeout
    - hwmon: (bt1-pvt) Wait for the completion with timeout
    - spi: imx: Fix freeing of DMA channels if spi_bitbang_start() fails
    - btrfs: add owner and fs_info to alloc_state io_tree
    - blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue
    - ath10k: provide survey info as accumulated data
    - Bluetooth: hci_uart: Cancel init work before unregistering
    - [arm64,armhf] drm: panel: Fix bus format for OrtusTech COM43H4M85ULC
      panel
    - ath6kl: prevent potential array overflow in ath6kl_add_new_sta()
    - ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb()
    - ath10k: Fix the size used in a 'dma_free_coherent()' call in an error
      handling path
    - wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680
    - [arm64] ASoC: qcom: lpass-platform: fix memory leak
    - [arm64] ASoC: qcom: lpass-cpu: fix concurrency issue
    - ath11k: Fix possible memleak in ath11k_qmi_init_service
    - brcmfmac: check ndev pointer
    - mwifiex: Do not use GFP_KERNEL in atomic context
    - [arm64] drm/malidp: Use struct drm_gem_object_funcs.get_sg_table
      internally
    - staging: rtl8192u: Do not use GFP_KERNEL in atomic context
    - drm/gma500: fix error check
    - scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()'
    - scsi: qla2xxx: Fix the size used in a 'dma_free_coherent()' call
    - scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg()
    - scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba()
    - scsi: csiostor: Fix wrong return value in csio_hw_prep_fw()
    - libbpf: Fix unintentional success return code in bpf_object__load
    - wilc1000: Fix memleak in wilc_sdio_probe
    - wilc1000: Fix memleak in wilc_bus_probe
    - rtw88: don't treat NULL pointer as an array
    - backlight: sky81452-backlight: Fix refcount imbalance on error
    - staging: wfx: fix frame reordering
    - staging: emxx_udc: Fix passing of NULL to dma_alloc_coherent()
    - [x86] VMCI: check return value of get_user_pages_fast() for errors
    - mm/error_inject: Fix allow_error_inject function signatures.
    - drm: panel: Fix bpc for OrtusTech COM43H4M85ULC panel
    - Bluetooth: Clear suspend tasks on unregister
    - scsi: ufs: Make ufshcd_print_trs() consider UFSHCD_QUIRK_PRDT_BYTE_GRAN
    - binder: Remove bogus warning on failed same-process transaction
    - drm/amdgpu: fix max_entries calculation v4
    - soundwire: stream: fix NULL/IS_ERR confusion
    - soundwire: intel: fix NULL/ERR_PTR confusion
    - tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup()
    - pty: do tty_flip_buffer_push without port->lock in pty_write
    - [x86] pwm: lpss: Fix off by one error in base_unit math in
      pwm_lpss_prepare()
    - [x86] pwm: lpss: Add range limit check for the base_unit register value
    - sfc: don't double-down() filters in ef100_reset()
    - ath11k: fix a double free and a memory leak
    - video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value
      error
    - video: fbdev: sis: fix null ptr dereference
    - video: fbdev: radeon: Fix memleak in radeonfb_pci_register
    - HID: roccat: add bounds checking in kone_sysfs_write_settings()
    - ath11k: fix uninitialized return in ath11k_spectral_process_data()
    - drm/msm: Avoid div-by-zero in dpu_crtc_atomic_check()
    - [arm64,armhf] drm/panfrost: Ensure GPU quirks are always initialised
    - iomap: Clear page error before beginning a write
    - iomap: Mark read blocks uptodate in write_begin
    - Bluetooth: Fix memory leak in read_adv_mon_features()
    - Bluetooth: Re-order clearing suspend tasks
    - [armhf] pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser
    - [armhf] pinctrl: mcp23s08: Fix mcp23x17 precious range
    - pinctrl: devicetree: Keep deferring even on timeout
    - [s390x] bpf: Fix multiple tail calls
    - net/mlx5: Fix uninitialized variable warning
    - net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow
    - scsi: mpt3sas: Fix sync irqs
    - [arm64,armhf] net: stmmac: Fix incorrect location to set
      real_num_rx|tx_queues
    - [arm64,armhf] net: stmmac: use netif_tx_start|stop_all_queues() function
    - xfs: force the log after remapping a synchronous-writes file
    - [arm64] cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE
    - ASoC: topology: disable size checks for bytes_ext controls if needed
    - ASoC: tlv320adcx140: Fix digital gain range
    - nvmem: core: fix missing of_node_put() in of_nvmem_device_get()
    - dmaengine: ti: k3-udma-glue: fix channel enable functions
    - Bluetooth: Fix auto-creation of hci_conn at Conn Complete event
    - xhci: don't create endpoint debugfs entry before ring buffer is set.
    - [arm64] drm/msm: Fix the a650 hw_apriv check
    - net: dsa: rtl8366: Check validity of passed VLANs
    - net: dsa: rtl8366: Refactor VLAN/PVID init
    - net: dsa: rtl8366: Skip PVID setting if not requested
    - net: wilc1000: clean up resource in error path of init mon interface
    - ASoC: tlv320aic32x4: Fix bdiv clock rate derivation
    - net: dsa: rtl8366rb: Support all 4096 VLANs
    - ASoC: SOF: control: add size checks for ext_bytes control .put()
    - ASoC: tas2770: Fix unbalanced calls to pm_runtime
    - [armhf] spi: omap2-mcspi: Improve performance waiting for CHSTAT
    - ath11k: Add checked value for ath11k_ahb_remove
    - ath6kl: wmi: prevent a shift wrapping bug in
      ath6kl_wmi_delete_pstream_cmd()
    - drm: rcar-du: Put reference to VSP device
    - phy: rockchip-dphy-rx0: Include linux/delay.h
    - dmaengine: dmatest: Check list for emptiness before access its last
      entry
    - ASoC: cros_ec_codec: fix kconfig dependency warning for
      SND_SOC_CROS_EC_CODEC
    - misc: mic: scif: Fix error handling path
    - ALSA: seq: oss: Avoid mutex lock for a long-time ioctl
    - net/mlx5e: IPsec: Use kvfree() for memory allocated with kvzalloc()
    - [arm*] usb: dwc2: Fix parameter type in function pointer prototype
    - [arm64,armhf] usb: dwc3: core: Properly default unspecified speed
    - [arm*] usb: dwc2: Add missing cleanups when usb_add_gadget_udc() fails
    - rtw88: Fix probe error handling race with firmware loading
    - rtw88: Fix potential probe error handling race with wow firmware loading
    - quota: clear padding in v2r1_mem2diskdqb()
    - [arm*] drm/vc4: crtc: Rework a bit the CRTC state code
    - ASoC: fsl_sai: Instantiate snd_soc_dai_driver
    - HID: hid-input: fix stylus battery reporting
    - tty: hvc: fix link error with CONFIG_SERIAL_CORE_CONSOLE=n
    - tty: serial: imx: fix link error with CONFIG_SERIAL_CORE_CONSOLE=n
    - nvmem: core: fix possibly memleak when use
      nvmem_cell_info_to_nvmem_cell()
    - [x86] hv: clocksource: Add notrace attribute to read_hv_sched_clock_*()
      functions
    - nl80211: fix OBSS PD min and max offset validation
    - iomap: Use kzalloc to allocate iomap_page
    - ibmvnic: set up 200GBPS speed
    - bpf: disallow attaching modify_return tracing functions to other BPF
      programs
    - qtnfmac: fix resource leaks on unsupported iftype error return path
    - pinctrl: aspeed: Use the right pinconf mask
    - [arm64] iommu/qcom: add missing put_device() call in
      qcom_iommu_of_xlate()
    - iio: adc: stm32-adc: fix runtime autosuspend delay when slow polling
    - net: enic: Cure the enic api locking trainwreck
    - pinctrl: tigerlake: Fix register offsets for TGL-H variant
    - serial: 8250: Discard RTS/DTS setting from clock update method
    - serial: 8250: Skip uninitialized TTY port baud rate update
    - serial: 8250_dw: Fix clk-notifier/port suspend deadlock
    - mfd: syscon: Don't free allocated name for regmap_config
    - mfd: sm501: Fix leaks in probe()
    - dm: fix missing imposition of queue_limits from dm_wq_work() thread
    - pinctrl: single: fix pinctrl_spec.args_count bounds check
    - pinctrl: single: fix debug output when #pinctrl-cells = 2
    - staging: rtl8712: Fix enqueue_reorder_recvframe()
    - ASoC: wm_adsp: Pass full name to snd_ctl_notify
    - iwlwifi: mvm: split a print to avoid a WARNING in ROC
    - iwlwifi: dbg: remove no filter condition
    - iwlwifi: dbg: run init_cfg function once per driver load
    - usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above.
    - usb: gadget: u_serial: clear suspended flag when disconnecting
    - usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well
    - bus: mhi: core: Fix the building of MHI module
    - ocxl: fix kconfig dependency warning for OCXL
    - nl80211: fix non-split wiphy information
    - [arm*] usb: dwc2: Fix INTR OUT transfers in DDMA mode.
    - scsi: target: tcmu: Fix warning: 'page' may be used uninitialized
    - scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs()
    - dmaengine: ioat: Allocate correct size for descriptor chunk
    - staging: qlge: fix build breakage with dumping enabled
    - ipmi_si: Fix wrong return value in try_smi_init()
    - tracing: Fix parse_synth_field() error handling
    - staging: wfx: fix BA sessions for older firmwares
    - [x86] platform/x86: mlx-platform: Remove PSU EEPROM configuration
    - dm: fix request-based DM to not bounce through indirect dm_submit_bio
    - mwifiex: fix double free
    - [arm64,armhf] drm/panfrost: increase readl_relaxed_poll_timeout values
    - drm/amdgpu: Fix invalid number of character '{' in amdgpu_acpi_init
    - ipvs: clear skb->tstamp in forwarding path
    - bpf, sockmap: Remove skb_orphan and let normal skb_kfree do cleanup
    - netfilter: nf_log: missing vlan offload tag and proto
    - mm/swapfile.c: fix potential memory leak in sys_swapon
    - mm: memcg/slab: fix racy access to page->mem_cgroup in
      mem_cgroup_from_obj()
    - mm/memcg: fix device private memcg accounting
    - mm/mmap.c: replace do_brk with do_brk_flags in comment of
      insert_vm_struct()
    - mm/page_alloc.c: fix freeing non-compound pages
    - mm, oom_adj: don't loop through tasks in __set_oom_adj when not
      necessary
    - fs: fix NULL dereference due to data race in prepend_path()
    - tracing: Handle synthetic event array field type checking correctly
    - i3c: master add i3c_master_attach_boardinfo to preserve boardinfo
    - IB/mlx4: Fix starvation in paravirt mux/demux
    - IB/mlx4: Adjust delayed work when a dup is observed
    - [powerpc*] pseries: Fix missing of_node_put() in rng_init()
    - [powerpc*] icp-hv: Fix missing of_node_put() in success path
    - rcu/tree: Force quiescent state on callback overload
    - rcutorture: Properly set rcu_fwds for OOM handling
    - refperf: Avoid null pointer dereference when buf fails to allocate
    - RDMA/ucma: Fix locking for ctx->events_reported
    - RDMA/ucma: Add missing locking around rdma_leave_multicast()
    - mtd: lpddr: fix excessive stack usage with clang
    - RDMA/hns: Add a check for current state before modifying QP
    - RDMA/umem: Fix signature of stub ib_umem_find_best_pgsz()
    - [powerpc*] pseries: explicitly reschedule during drmem_lmb list
      traversal
    - [powerpc*] pseries/drmem: don't cache node id in drmem_lmb struct
    - RDMA/mlx5: Fix potential race between destroy and CQE poll
    - mtd: mtdoops: Don't write panic data twice
    - perf tools: Make GTK2 support opt-in
    - [armel,armhf] 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using
      DT values
    - xfs: fix finobt btree block recovery ordering
    - m68knommu: include SDHC support only when hardware has it
    - xfs: limit entries returned when counting fsmap records
    - xfs: fix deadlock and streamline xfs_getfsmap performance
    - nfs: add missing "posix" local_lock constant table definition
    - xfs: fix high key handling in the rt allocator's query_range function
    - RDMA/rtrs-srv: Incorporate ib_register_client into rtrs server init
    - RDMA/core: Delete function indirection for alloc/free kernel CQ
    - RDMA: Allow fail of destroy CQ
    - RDMA: Change XRCD destroy return value
    - RDMA: Restore ability to return error for destroy WQ
    - RDMA/umem: Fix ib_umem_find_best_pgsz() for mappings that cross a page
      boundary
    - RDMA/umem: Prevent small pages from being returned by
      ib_umem_find_best_pgsz()
    - RDMA/qedr: Fix qp structure memory leak
    - RDMA/qedr: Fix doorbell setting
    - RDMA/qedr: Fix use of uninitialized field
    - RDMA/qedr: Fix return code if accept is called on a destroyed qp
    - RDMA/qedr: Fix inline size returned for iWARP
    - [powerpc*] pseries/svm: Allocate SWIOTLB buffer anywhere in memory
    - [powerpc*] watchpoint: Fix quadword instruction handling on p10
      predecessors
    - [powerpc*] watchpoint: Fix handling of vector instructions
    - [powerpc*] watchpoint: Add hw_len wherever missing
    - [powerpc*] book3s64/hash/4k: Support large linear mapping range with 4K
    - [powerpc*] 64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm
    - [powerpc*] papr_scm: Fix warning triggered by perf_stats_show()
    - RDMA/cma: Combine cma_ndev_work with cma_work
    - RDMA/cma: Remove dead code for kernel rdmacm multicast
    - RDMA/cma: Consolidate the destruction of a cma_multicast in one place
    - RDMA/cma: Fix use after free race in roce multicast join
    - perf intel-pt: Fix "context_switch event has no tid" error
    - perf metricgroup: Fix uncore metric expressions
    - RDMA/qedr: Fix resource leak in qedr_create_qp
    - RDMA/hns: Set the unsupported wr opcode
    - RDMA/mlx5: Use set_mkc_access_pd_addr_fields() in reg_create()
    - RDMA/mlx5: Make mkeys always owned by the kernel's PD when not enabled
    - RDMA/mlx5: Disable IB_DEVICE_MEM_MGT_EXTENSIONS if IB_WR_REG_MR can't
      work
    - i40iw: Add support to make destroy QP synchronous
    - perf stat: Skip duration_time in setup_system_wide
    - RDMA/hns: Add check for the validity of sl configuration
    - RDMA/hns: Solve the overflow of the calc_pg_sz()
    - RDMA/hns: Fix the wrong value of rnr_retry when querying qp
    - RDMA/hns: Fix configuration of ack_req_freq in QPC
    - RDMA/hns: Fix missing sq_sig_type when querying QP
    - RDMA/mlx5: Fix type warning of sizeof in __mlx5_ib_alloc_counters()
    - mtd: hyperbus: hbmc-am654: Fix direct mapping setup flash access
    - overflow: Include header file with SIZE_MAX declaration
    - mtd: parsers: bcm63xx: Do not make it modular
    - RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces
    - [powerpc*] 64: fix irq replay missing preempt
    - [powerpc*] 64: fix irq replay pt_regs->softe value
    - [powerpc*] perf: Exclude pmc5/6 from the irrelevant PMU group
      constraints
    - [powerpc*] perf/hv-gpci: Fix starting index value
    - perf stat: Fix out of bounds CPU map access when handling armv8_pmu
      events
    - i3c: master: Fix error return in cdns_i3c_master_probe()
    - [powerpc*] security: Fix link stack flush instruction
    - [powerpc*] book3s64/radix: Make radix_mem_block_size 64bit
    - [powerpc*] papr_scm: Add PAPR command family to pass-through command-set
    - [powerpc*] cpufreq: powernv: Fix frame-size-overflow in
      powernv_cpufreq_reboot_notifier
    - IB/rdmavt: Fix sizeof mismatch
    - RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast_pkt()
    - f2fs: reject CASEFOLD inode flag without casefold feature
    - um: vector: Use GFP_ATOMIC under spin lock
    - um: time-travel: Fix IRQ handling in time_travel_handle_message()
    - thermal: core: Adding missing nlmsg_free() in
      thermal_genl_sampling_temp()
    - perf trace: Fix off by ones in memset() after realloc() in arches using
      libaudit
    - f2fs: wait for sysfs kobject removal before freeing f2fs_sb_info
    - afs: Fix rapid cell addition/removal by not using RCU on cells tree
    - afs: Fix cell refcounting by splitting the usage counter
    - afs: Fix cell purging with aliases
    - afs: Fix cell removal
    - RDMA/rxe: Handle skb_clone() failure in rxe_recv.c
    - mm/page_owner: change split_page_owner to take a count
    - mm/huge_memory: fix split assumption of page size
    - mm: fix a race during THP splitting
    - lib/crc32.c: fix trivial typo in preprocessor condition
    - ramfs: fix nommu mmap with gaps in the page cache
    - rapidio: fix error handling path
    - rapidio: fix the missed put_device() for rio_mport_add_riodev
    - clk: meson: axg-audio: separate axg and g12a regmap tables
    - rtc: ds1307: Clear OSF flag on DS1388 when setting time
    - clk: meson: g12a: mark fclk_div2 as critical
    - PCI: designware-ep: Fix the Header Type check
    - PCI: aardvark: Fix compilation on s390
    - PCI: aardvark: Check for errors from pci_bridge_emul_init() call
    - PCI: iproc: Set affinity mask on MSI interrupts
    - PCI/IOV: Mark VFs as not implementing PCI_COMMAND_MEMORY
    - vfio: add a singleton check for vfio_group_pin_pages
    - [s390x] pci: Mark all VFs as not implementing PCI_COMMAND_MEMORY
    - vfio/pci: Decouple PCI_COMMAND_MEMORY bit checks from is_virtfn
    - vfio: fix a missed vfio group put in vfio_pin_pages
    - [x86,arm64] vfio/type1: fix dirty bitmap calculation in vfio_dma_rw
    - nfsd: Cache R, RW, and W opens separately
    - [x86] PCI: hv: Fix hibernation in case interrupts are not re-created
    - module: statically initialize init section freeing data
    - clk: at91: clk-main: update key before writing AT91_CKGR_MOR
    - clk: bcm2835: add missing release if devm_clk_hw_register fails
    - kbuild: deb-pkg: do not build linux-headers package if CONFIG_MODULES=n
    - watchdog: Fix memleak in watchdog_cdev_register
    - watchdog: Use put_device on error
    - watchdog: sp5100: Fix definition of EFCH_PM_DECODEEN3
    - clk: at91: sam9x60: support only two programmable clocks
    - svcrdma: fix bounce buffers for unaligned offsets and multiple pages
    - ext4: fix dead loop in ext4_mb_new_blocks
    - ext4: discard preallocations before releasing group lock
    - ext4: disallow modifying DAX inode flag if inline_data has been set
    - ext4: limit entries returned when counting fsmap records
    - vfio/pci: Clear token on bypass registration failure
    - [x86,arm64] vfio iommu type1: Fix memory leak in
      vfio_iommu_type1_pin_pages
    - clk: qcom: gdsc: Keep RETAIN_FF bit set if gdsc is already on
    - clk: imx8mq: Fix usdhc parents order
    - SUNRPC: fix copying of multiple pages in gss_read_proxy_verf()
    - NFSv4.2: Fix NFS4ERR_STALE error when doing inter server copy
    - platform/chrome: cros_ec_typec: Send enum values to
      usb_role_switch_set_role()
    - platform/chrome: cros_ec_lightbar: Reduce ligthbar get version command
    - Input: elants_i2c - fix typo for an attribute to show calibration count
    - Input: imx6ul_tsc - clean up some errors in imx6ul_tsc_resume()
    - Input: stmfts - fix a & vs && typo
    - Input: ep93xx_keypad - fix handling of platform_get_irq() error
    - Input: omap4-keypad - fix handling of platform_get_irq() error
    - Input: twl4030_keypad - fix handling of platform_get_irq() error
    - Input: sun4i-ps2 - fix handling of platform_get_irq() error
    - [x86] KVM: x86: emulating RDPID failure shall return #UD rather than #GP
    - [x86] KVM: nSVM: CR3 MBZ bits are only 63:52
    - scsi: bfa: Fix error return in bfad_pci_init()
    - [arm64] mm: use single quantity to represent the PA to VA translation
    - bpf: Enforce id generation for all may-be-null register type
    - net: dsa: seville: the packet buffer is 2 megabits, not megabytes
    - netfilter: conntrack: connection timeout after re-register
    - netfilter: ebtables: Fixes dropping of small packets in bridge nat
    - vdpa/mlx5: Make use of a specific 16 bit endianness API
    - vdpa/mlx5: Fix failure to bring link up
    - vdpa/mlx5: Setup driver only if VIRTIO_CONFIG_S_DRIVER_OK
    - netfilter: nf_fwd_netdev: clear timestamp in forwarding path
    - [arm64] soc: xilinx: Fix error code in zynqmp_pm_probe()
    - [arm64] arm64: dts: meson: vim3: correct led polarity
    - [armhf] dts: sun8i: r40: bananapi-m2-ultra: Fix dcdc1 regulator
    - [arm64] dts: allwinner: h5: remove Mali GPU PMU module
    - [armhf] memory: omap-gpmc: Fix a couple off by ones
    - [armhf] memory: omap-gpmc: Fix build error without CONFIG_OF
    - [arm64] dts: qcom: msm8992: Fix UART interrupt property
    - [arm64] dts: qcom: sdm845-db845c: Fix hdmi nodes
    - [arm64] dts: qcom: sm8150: fix up primary USB nodes
    - [arm64] dts: qcom: sc7180: Fix the LLCC base register size
    - memory: fsl-corenet-cf: Fix handling of platform_get_irq() error
    - firmware: arm_scmi: Fix NULL pointer dereference in mailbox_chan_free
    - [arm64] dts: mt8173-elm: fix supported values for
      regulator-allowed-modes of da9211
    - [arm64] dts: qcom: sm8250: Rename UART2 node to UART12
    - dmaengine: ti: k3-udma-glue: Fix parameters for rx ring pair request
    - [arm64] dts: imx8mq: Add missing interrupts to GPC
    - [arm64] dts: qcom: sc7180: Drop flags on mdss irqs
    - [arm64] dts: sdm845: Fixup OPP table for all qup devices
    - [arm64] dts: qcom: msm8916: Remove one more thermal trip point unit name
    - [arm64] dts: qcom: pm8916: Remove invalid reg size from wcd_codec
    - [arm64] dts: qcom: msm8916: Fix MDP/DSI interrupts
    - [arm64] dts: mt8173: elm: Fix nor_flash node property
    - [arm64] dts: ti: k3-j721e: Rename mux header and update macro names
    - [arm64] dts: actions: limit address range for pinctrl node
    - lightnvm: fix out-of-bounds write to array devices->info[]
    - [powerpc*] powernv/dump: Fix race while processing OPAL dump
    - [powerpc*] 64s: Remove TM from Power10 features
    - [powerpc*] pseries: Avoid using addr_to_pfn in real mode
    - nvmet: fix uninitialized work for zero kato
    - nvmet: limit passthru MTDS by BIO_MAX_PAGES
    - [x86] KVM: ioapic: break infinite recursion on lazy EOI (CVE-2020-27152)
    - NTB: hw: amd: fix an issue about leak system resources
    - sched/features: Fix !CONFIG_JUMP_LABEL case
    - perf: correct SNOOPX field offset
    - random32: make prandom_u32() output unpredictable
    - i2c: core: Restore acpi_walk_dep_device_list() getting called after
      registering the ACPI i2c devs
    - md/bitmap: fix memory leak of temporary bitmap
    - block: ratelimit handle_bad_sector() message
    - [x86] dumpstack: Fix misleading instruction pointer error message
    - crypto: ccp - fix error handling
    - [x86] asm: Replace __force_order with a memory clobber
    - [x86] mce: Add Skylake quirk for patrol scrub reported errors
    - media: firewire: fix memory leak
    - media: ati_remote: sanity check for both endpoints
    - media: st-delta: Fix reference count leak in delta_run_work
    - media: sti: Fix reference count leaks
    - media: exynos4-is: Fix several reference count leaks due to
      pm_runtime_get_sync
    - media: exynos4-is: Fix a reference count leak due to pm_runtime_get_sync
    - media: exynos4-is: Fix a reference count leak
    - media: vsp1: Fix runtime PM imbalance on error
    - media: platform: s3c-camif: Fix runtime PM imbalance on error
    - media: platform: sti: hva: Fix runtime PM imbalance on error
    - media: bdisp: Fix runtime PM imbalance on error
    - media: media/pci: prevent memory leak in bttv_probe
    - [x86] mce: Annotate mce_rd/wrmsrl() with noinstr
    - crypto: hisilicon - fixed memory allocation error
    - spi: fsi: Fix clock running too fast
    - blk-mq: always allow reserved allocation in hctx_may_queue
    - [x86] mce: Make mce_rdmsrl() panic on an inaccessible MSR
    - media: uvcvideo: Ensure all probed info is returned to v4l2
    - mmc: sdio: Check for CISTPL_VERS_1 buffer size
    - media: saa7134: avoid a shift overflow
    - media: atomisp: fix memleak in ia_css_stream_create
    - media: venus: fixes for list corruption
    - notifier: Fix broken error handling pattern
    - fs: dlm: fix configfs memory leak
    - media: venus: core: Fix error handling in probe
    - media: venus: core: Fix runtime PM imbalance in venus_probe
    - ntfs: add check for mft record size in superblock
    - ip_gre: set dev->hard_header_len and dev->needed_headroom properly
    - mac80211: handle lack of sband->bitrates in rates
    - staging: wfx: fix handling of MMIC error
    - libbpf: Close map fd if init map slots failed
    - bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI
    - PM: hibernate: remove the bogus call to get_gendisk() in
      software_resume()
    - scsi: mvumi: Fix error return in mvumi_io_attach()
    - scsi: target: core: Add CONTROL field for trace events
    - [amd64] mic: vop: copy data to kernel space then write to io memory
    - [amd64] misc: vop: add round_up(x,4) for vring_size to avoid kernel
      panic
    - [arm64,armhf] usb: dwc3: Add splitdisable quirk for Hisilicon Kirin Soc
    - usb: gadget: function: printer: fix use-after-free in __lock_acquire
    - rtw88: pci: Power cycle device during shutdown
    - udf: Limit sparing table size
    - udf: Avoid accessing uninitialized data on failed inode read
    - rtw88: increse the size of rx buffer size
    - USB: cdc-acm: handle broken union descriptors
    - [arm64,armhf] usb: dwc3: simple: add support for Hikey 970
    - can: flexcan: flexcan_chip_stop(): add error handling and propagate
      error value
    - HID: multitouch: Lenovo X1 Tablet Gen3 trackpoint and buttons
    - ath9k: hif_usb: fix race condition between usb_get_urb() and
      usb_kill_anchored_urbs()
    - [arm64,armhf] drm/panfrost: add Amlogic GPU integration quirks
    - [arm64,armhf] drm/panfrost: add amlogic reset quirk callback
    - [arm64,armhf] drm/panfrost: add support for vendor quirk
    - bpf: Limit caller's stack depth 256 for subprogs with tailcalls
    - dma-direct: Fix potential NULL pointer dereference
    - misc: rtsx: Fix memory leak in rtsx_pci_probe
    - reiserfs: only call unlock_new_inode() if I_NEW
    - opp: Prevent memory leak in dev_pm_opp_attach_genpd()
    - xfs: make sure the rt allocator doesn't run off the end
    - usb: ohci: Default to per-port over-current protection
    - drm: fix double free for gbo in drm_gem_vram_init and
      drm_gem_vram_create
    - Bluetooth: Only mark socket zapped after unlocking
    - drm/msm/a6xx: fix a potential overflow issue
    - drm/xlnx: Use devm_drm_dev_alloc
    - iomap: fix WARN_ON_ONCE() from unprivileged users
    - scsi: ibmvfc: Fix error return in ibmvfc_probe()
    - scsi: qla2xxx: Warn if done() or free() are called on an already freed
      srb
    - soundwire: cadence: fix race condition between suspend and Slave device
      alerts
    - brcmsmac: fix memory leak in wlc_phy_attach_lcnphy
    - rtl8xxxu: prevent potential memory leak
    - Fix use after free in get_capset_info callback.
    - HID: ite: Add USB id match for Acer One S1003 keyboard dock
    - scsi: qedf: Return SUCCESS if stale rport is encountered
    - scsi: qedi: Mark all connections for recovery on link down event
    - scsi: qedi: Protect active command list to avoid list corruption
    - scsi: qedi: Fix list_del corruption while removing active I/O
    - fbmem: add margin check to fb_check_caps()
    - tty: ipwireless: fix error handling
    - Bluetooth: btusb: Fix memleak in btusb_mtk_submit_wmt_recv_urb
    - ipvs: Fix uninit-value in do_ip_vs_set_ctl()
    - reiserfs: Fix memory leak in reiserfs_parse_options()
    - [s390x] qeth: strictly order bridge address events
    - mwifiex: don't call del_timer_sync() on uninitialized timer
    - ALSA: hda/ca0132 - Add AE-7 microphone selection commands.
    - ALSA: hda/ca0132 - Add new quirk ID for SoundBlaster AE-7.
    - [x86] ASoC: SOF: Add topology filename override based on dmi data match
    - [x86] ASoC: Intel: sof_rt5682: override quirk data for
      tgl_max98373_rt5682
    - scsi: smartpqi: Avoid crashing kernel for controller issues
    - brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach
    - usb: core: Solve race condition in anchor cleanup functions
    - soundwire: intel: reinitialize IP+DSP in .prepare(), but only when
      resuming
    - scsi: ufs: ufs-qcom: Fix race conditions caused by
      ufs_qcom_testbus_config()
    - dmaengine: dw: Add DMA-channels mask cell support
    - dmaengine: dw: Activate FIFO-mode for memory peripherals only
    - drm/hisilicon: Code refactoring for hibmc_drv_de
    - [arm64,armhf] drm/panfrost: perfcnt: fix ref count leak in
      panfrost_perfcnt_enable_locked
    - ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n()
    - [s390x] qeth: don't let HW override the configured port role
    - tty: serial: lpuart: fix lpuart32_write usage
    - tty: serial: fsl_lpuart: fix lpuart32_poll_get_char
    - usb: gadget: bcm63xx_udc: fix up the error of undeclared usb_debug_root
    - usb: cdc-acm: add quirk to blacklist ETAS ES58X devices
    - USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync().
    - usb: cdns3: gadget: free interrupt after gadget has deleted
    - eeprom: at25: set minimum read/write access stride to 1
    - usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.3
    - cpufreq: Improve code around unlisted freq check
    - netfilter: nftables_offload: KASAN slab-out-of-bounds Read in
      nft_flow_rule_create
    - io_uring: allow timeout/poll/files killing to take task into account
    - io_uring: move dropping of files into separate helper
    - io_uring: stash ctx task reference for SQPOLL
    - io_uring: unconditionally grab req->task
    - io_uring: return cancelation status from poll/timeout/files handlers
    - io_uring: enable task/files specific overflow flushing
    - io_uring: don't rely on weak ->files references
    - io_uring: reference ->nsproxy for file table commands
    - io_wq: Make io_wqe::lock a raw_spinlock_t
    - io-wq: fix use-after-free in io_wq_worker_running
    - io_uring: no need to call xa_destroy() on empty xarray
    - io_uring: Fix use of XArray in __io_uring_files_cancel
    - io_uring: Fix XArray usage in io_uring_add_task_file
    - io_uring: Convert advanced XArray uses to the normal API
    - scripts/setlocalversion: make git describe output more reliable
    - [arm64] efi/arm64: libstub: Deal gracefully with EFI_RNG_PROTOCOL
      failure
    - fs/kernel_read_file: Remove FIRMWARE_EFI_EMBEDDED enum
    - [arm64] Run ARCH_WORKAROUND_1 enabling code on all CPUs
    - [arm64] Run ARCH_WORKAROUND_2 enabling code on all CPUs
    - [arm64] link with -z norelro regardless of CONFIG_RELOCATABLE
    - [x86] PCI: Fix intel_mid_pci.c build error when ACPI is not enabled
    - efivarfs: Replace invalid slashes with exclamation marks in dentries.
    - bnxt_en: Check abort error state in bnxt_open_nic().
    - bnxt_en: Fix regression in workqueue cleanup logic in bnxt_remove_one().
    - bnxt_en: Invoke cancel_delayed_work_sync() for PFs also.
    - bnxt_en: Re-write PCI BARs after PCI fatal error.
    - bnxt_en: Send HWRM_FUNC_RESET fw command unconditionally.
    - cxgb4: set up filter action after rewrites
    - gtp: fix an use-before-init in gtp_newlink()
    - ibmveth: Fix use of ibmveth in a bridge.
    - ibmvnic: fix ibmvnic_set_mac
    - mlxsw: core: Fix memory leak on module removal
    - mlxsw: Only advertise link modes supported by both driver and device
    - netem: fix zero division in tabledist
    - net: hns3: Clear the CMDQ registers before unmapping BAR region
    - net: ipa: command payloads already mapped
    - net/sched: act_mpls: Add softdep on mpls_gso.ko
    - r8169: fix issue with forced threading in combination with shared
      interrupts
    - ravb: Fix bit fields checking in ravb_hwtstamp_get()
    - tcp: Prevent low rmem stalls with SO_RCVLOWAT.
    - tipc: fix memory leak caused by tipc_buf_append()
    - net/smc: fix invalid return code in smcd_new_buf_create()
    - net/smc: fix suppressed return code
    - net: protect tcf_block_unbind with block lock
    - erofs: avoid duplicated permission check for "trusted." xattrs
    - [x86] arch/x86/amd/ibs: Fix re-arming IBS Fetch
    - [x86] traps: Fix #DE Oops message regression
    - [x86] xen: disable Firmware First mode for correctable memory errors
    - PCI: aardvark: Fix initialization with old Marvell's Arm Trusted
      Firmware
    - ata: ahci: mvebu: Make SATA PHY optional for Armada 3720
    - fuse: fix page dereference after free
    - bpf: Fix comment for helper bpf_current_task_under_cgroup()
    - evm: Check size of security.evm before using it
    - p54: avoid accessing the data mapped to streaming DMA
    - cxl: Rework error message for incompatible slots
    - RDMA/addr: Fix race with netevent_callback()/rdma_addr_cancel()
    - mtd: lpddr: Fix bad logic in print_drs_error
    - [x86] drm/i915/gem: Serialise debugfs i915_gem_objects with ctx->mutex
    - serial: qcom_geni_serial: To correct QUP Version detection logic
    - serial: pl011: Fix lockdep splat when handling magic-sysrq interrupt
    - PM: runtime: Fix timer_expires data type on 32-bit arches
    - ata: sata_rcar: Fix DMA boundary mask
    - mm: mark async iocb read as NOWAIT once some data has been copied
    - xen/gntdev.c: Mark pages as dirty
    - io_uring: don't reuse linked_timeout
    - misc: rtsx: do not setting OC_POWER_DOWN reg in rtsx_pci_init_ocp()
    - phy: marvell: comphy: Convert internal SMCC firmware return codes to
      errno
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.4
    - [x86,powerpc] Rename memcpy_mcsafe() to copy_mc_to_{user, kernel}()
    - [x86] copy_mc: Introduce copy_mc_enhanced_fast_string()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.5
    - xen/events: avoid removing an event channel while handling it
      (CVE-2020-27675)
    - xen/events: add a proper barrier to 2-level uevent unmasking
      (CVE-2020-27673)
    - xen/events: fix race in evtchn_fifo_unmask() (CVE-2020-27673)
    - xen/events: add a new "late EOI" evtchn framework (CVE-2020-27673)
    - xen/blkback: use lateeoi irq binding (CVE-2020-27673)
    - xen/netback: use lateeoi irq binding (CVE-2020-27673)
    - xen/scsiback: use lateeoi irq binding (CVE-2020-27673)
    - xen/pvcallsback: use lateeoi irq binding (CVE-2020-27673)
    - xen/pciback: use lateeoi irq binding (CVE-2020-27673)
    - xen/events: switch user event channels to lateeoi model (CVE-2020-27673)
    - xen/events: use a common cpu hotplug hook for event channels
      (CVE-2020-27673)
    - xen/events: defer eoi in case of excessive number of events
      (CVE-2020-27673)
    - xen/events: block rogue events for some time (CVE-2020-27673)
    - [arm64] tee: client UUID: Skip REE kernel login method as well
    - [x86] unwind/orc: Fix inactive tasks with stack pointer in %sp on GCC 10
      compiled kernels
    - [x86] alternative: Don't call text_poke() in lazy TLB mode
    - RDMA/mlx5: Fix devlink deadlock on net namespace deletion
    - afs: Fix a use after free in afs_xattr_get_acl()
    - afs: Fix afs_launder_page to not clear PG_writeback
    - RDMA/qedr: Fix memory leak in iWARP CM
    - ata: sata_nv: Fix retrieving of active qcs
    - [arm64] efi: increase EFI PE/COFF header padding to 64 KB
    - afs: Fix to take ref on page when PG_private is set
    - afs: Fix page leak on afs_write_begin() failure
    - afs: Fix where page->private is set during write
    - afs: Wrap page->private manipulations in inline functions
    - afs: Alter dirty range encoding in page->private
    - afs: Fix afs_invalidatepage to adjust the dirty region
    - afs: Fix dirty-region encoding on ppc32 with 64K pages
    - lockdep: Fix preemption WARN for spurious IRQ-enable
    - [arm64,armhf] usb: host: ehci-tegra: Fix error handling in
      tegra_ehci_probe()
    - futex: Fix incorrect should_fail_futex() handling
    - [powerpc*] vmemmap: Fix memory leak with vmemmap list allocation
      failures.
    - [powerpc*] powernv/smp: Fix spurious DBG() warning
    - RDMA/core: Change how failing destroy is handled during uobj abort
    - f2fs: allocate proper size memory for zstd decompress
    - mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race
    - [powerpc*] select ARCH_WANT_IRQS_OFF_ACTIVATE_MM
    - [sparc64] remove mm_cpumask clearing to fix kthread_use_mm race
    - f2fs: add trace exit in exception path
    - f2fs: do sanity check on zoned block device path
    - f2fs: fix uninit-value in f2fs_lookup
    - f2fs: fix to check segment boundary during SIT page readahead
    - [s390x] startup: avoid save_area_sync overflow
    - f2fs: compress: fix to disallow enabling compress on non-empty file
    - [s390x] ap/zcrypt: revisit ap and zcrypt error handling
    - f2fs: handle errors of f2fs_get_meta_page_nofail
    - afs: Don't assert on unpurgeable server records
    - [powerpc*] 64s: handle ISA v3.1 local copy-paste context switches
    - [armel,armhf] 8997/2: hw_breakpoint: Handle inexact watchpoint addresses
    - NFS4: Fix oops when copy_file_range is attempted with NFS4.0 source
    - xfs: Set xfs_buf type flag when growing summary/bitmap files
    - xfs: Set xfs_buf's b_ops member when zeroing bitmap/summary files
    - xfs: log new intent items created as part of finishing recovered intent
      items
    - power: supply: bq27xxx: report "not charging" on all types
    - xfs: change the order in which child and parent defer ops are finished
    - xfs: fix realtime bitmap/summary file truncation when growing rt volume
    - io_uring: don't set COMP_LOCKED if won't put
    - ath10k: fix retry packets update in station dump
    - [x86] kaslr: Initialize mem_limit to the real maximum address
    - drm/ast: Separate DRM driver from PCI code
    - drm/amdgpu: restore ras flags when user resets eeprom(v2)
    - ath10k: start recovery process when payload length exceeds max htc
      length for sdio
    - ath10k: fix VHT NSS calculation when STBC is enabled
    - drm/scheduler: Scheduler priority fixes (v2)
    - [x86] ASoC: SOF: fix a runtime pm issue in SOF when HDMI codec doesn't
      work
    - drm/bridge_connector: Set default status connected for eDP connectors
    - media: videodev2.h: RGB BT2020 and HSV are always full range
    - [x86] usb: typec: tcpm: During PR_SWAP, source caps should be sent only
      after tSwapSourceStart
    - mmc: via-sdmmc: Fix data race bug
    - brcmfmac: increase F2 watermark for BCM4329
    - [arm64] topology: Stop using MPIDR for topology information
    - printk: reduce LOG_BUF_SHIFT range for H8300
    - [ia64] kprobes: Use generic kretprobe trampoline handler
    - bpf: Permit map_ptr arithmetic with opcode add and offset 0
    - [arm64,armhf] drm: lima: fix common struct sg_table related issues
    - [arm64,armhf] drm: panfrost: fix common struct sg_table related issues
    - media: uvcvideo: Fix dereference of out-of-bound list iterator
    - selinux: access policycaps with READ_ONCE/WRITE_ONCE
    - samples/bpf: Fix possible deadlock in xdpsock
    - [riscv64] Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
    - cpufreq: sti-cpufreq: add stih418 support
    - USB: adutux: fix debugging
    - mac80211: add missing queue/hash initialization to 802.3 xmit
    - usb: xhci: omit duplicate actions when suspending a runtime suspended
      host.
    - SUNRPC: Mitigate cond_resched() in xprt_transmit()
    - [arm64] mm: return cpu_all_mask when node is NUMA_NO_NODE
    - [armhf] can: flexcan: disable clocks during stop mode
    - xfs: don't free rt blocks when we're doing a REMAP bunmapi call
    - xfs: avoid LR buffer overrun due to crafted h_len
    - ACPI: Add out of bounds and numa_off protections to pxm_to_node()
    - brcmfmac: Fix warning message after dongle setup failed
    - ath11k: Use GFP_ATOMIC instead of GFP_KERNEL in
      ath11k_dp_htt_get_ppdu_desc
    - ath11k: fix warning caused by lockdep_assert_held
    - ath11k: change to disable softirqs for ath11k_regd_update to solve
      deadlock
    - drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values
    - [arm64,armhf] usb: dwc3: core: do not queue work if dr_mode is not
      USB_DR_MODE_OTG
    - [arm64] bus/fsl_mc: Do not rely on caller to provide non NULL mc_io
    - ACPI: HMAT: Fix handling of changes from ACPI 6.2 to ACPI 6.3
    - block: Consider only dispatched requests for inflight statistic
    - btrfs: fix replace of seed device
    - md/bitmap: md_bitmap_get_counter returns wrong blocks
    - f2fs: fix to set SBI_NEED_FSCK flag for inconsistent inode
    - bnxt_en: Log unknown link speed appropriately.
    - [arm64] rpmsg: glink: Use complete_all for open states
    - PCI/ACPI: Add Ampere Altra SOC MCFG quirk
    - [armhf] clk: ti: clockdomain: fix static checker warning
    - nfsd: rename delegation related tracepoints to make them less confusing
    - nfsd4: remove check_conflicting_opens warning
    - net: 9p: initialize sun_server.sun_path to have addr's value only when
      addr is valid
    - ceph: encode inodes' parent/d_name in cap reconnect message
    - jbd2: avoid transaction reuse after reformatting
    - ext4: Detect already used quota file early
    - [ppc64el] KVM: PPC: Book3S HV: Do not allocate HPT for a nested guest
    - scsi: core: Clean up allocation and freeing of sgtables
    - gfs2: call truncate_inode_pages_final for address space glocks
    - gfs2: Fix NULL pointer dereference in gfs2_rgrp_dump
    - gfs2: use-after-free in sysfs deregistration
    - gfs2: add validation checks for size of superblock
    - Handle STATUS_IO_TIMEOUT gracefully
    - cifs: handle -EINTR in cifs_setattr
    - [armhf] memory: emif: Remove bogus debugfs error handling
    - nbd: make the config put is called before the notifying the waiter
    - sgl_alloc_order: fix memory leak
    - nvme-rdma: fix crash when connect rejected
    - vmlinux.lds.h: Add PGO and AutoFDO input sections
    - [mips64el,mipsel] irqchip/loongson-htvec: Fix initial interrupt clearing
    - md: fix the checking of wrong work queue
    - md/raid5: fix oops during stripe resizing
    - mmc: sdhci: Add LTR support for some Intel BYT based controllers
    - mmc: sdhci-acpi: AMDI0040: Set SDHCI_QUIRK2_PRESET_VALUE_BROKEN
    - mm: memcg/slab: uncharge during kmem_cache_free_bulk()
    - seccomp: Make duplicate listener detection non-racy
    - [x86] perf/x86/intel: Fix Ice Lake event constraint table
    - [x86] perf/x86/amd: Fix sampling Large Increment per Cycle events
    - [x86] perf/amd/uncore: Set all slices and threads to restore perf stat
      -a behaviour
    - [x86] perf/x86/amd/ibs: Don't include randomized bits in
      get_ibs_op_count()
    - [x86] perf/x86/amd/ibs: Fix raw sample data accumulation
    - media: uvcvideo: Fix uvc_ctrl_fixup_xu_info() not having any effect
    - fs: Don't invalidate page buffers in block_write_full_page()
    - ACPI: configfs: Add missing config_item_put() to fix refcount leak
    - NFS: fix nfs_path in case of a rename retry
    - ACPI: button: fix handling lid state changes when input device closed
    - ACPI: video: use ACPI backlight for HP 635 Notebook
    - ACPI: debug: don't allow debugging when ACPI is disabled
    - PCI/ACPI: Whitelist hotplug ports for D3 if power managed by ACPI
    - ACPI: EC: PM: Flush EC work unconditionally after wakeup
    - ACPI: EC: PM: Drop ec_no_wakeup check from acpi_ec_dispatch_gpe()
    - acpi-cpufreq: Honor _PSD table setting on new AMD CPUs
    - io-wq: assign NUMA node locality if appropriate
    - w1: mxc_w1: Fix timeout resolution problem leading to bus error
    - fs/kernel_read_file: Remove FIRMWARE_PREALLOC_BUFFER enum
    - scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
    - scsi: qla2xxx: Fix MPI reset needed message
    - scsi: qla2xxx: Fix reset of MPI firmware
    - scsi: qla2xxx: Fix crash on session cleanup with unload
    - PM: runtime: Remove link state checks in rpm_get/put_supplier()
    - btrfs: qgroup: fix wrong qgroup metadata reserve for delayed inode
    - btrfs: improve device scanning messages
    - btrfs: qgroup: fix qgroup meta rsv leak for subvolume operations
    - btrfs: sysfs: init devices outside of the chunk_mutex
    - btrfs: tracepoints: output proper root owner for
      trace_find_free_extent()
    - btrfs: reschedule if necessary when logging directory items
    - btrfs: send, orphanize first all conflicting inodes when processing
      references
    - btrfs: send, recompute reference path after orphanization of a directory
    - btrfs: use kvzalloc() to allocate clone_roots in btrfs_ioctl_send()
    - btrfs: tree-checker: fix false alert caused by legacy btrfs root item
    - btrfs: reschedule when cloning lots of extents
    - btrfs: cleanup cow block on error
    - btrfs: skip devices without magic signature when mounting
    - btrfs: tree-checker: validate number of chunk stripes and parity
    - btrfs: fix use-after-free on readahead extent after failure to create it
    - btrfs: fix readahead hang and use-after-free after removing a device
    - btrfs: drop the path before adding block group sysfs files
    - usb: xhci: Workaround for S3 issue on AMD SNPS 3.0 xHC
    - [arm64] usb: dwc3: pci: Allow Elkhart Lake to utilize DSM method for PM
      functionality
    - [arm64,armhf] usb: dwc3: ep0: Fix ZLP for OUT ep0 requests
    - [arm64,armhf] usb: dwc3: gadget: Check MPS of the request length
    - [arm64,armhf] usb: dwc3: gadget: Reclaim extra TRBs after request
      completion
    - [arm64,armhf] usb: dwc3: core: add phy cleanup for probe error handling
    - [arm64,armhf] usb: dwc3: core: don't trigger runtime pm when remove
      driver
    - [arm64,armhf] usb: dwc3: gadget: Resume pending requests after
      CLEAR_STALL
    - [arm64,armhf] usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command
    - usb: cdc-acm: fix cooldown mechanism
    - [x86] usb: typec: tcpm: reset hard_reset_count for any disconnect
    - usbcore: Check both id_table and match() when both available
    - USB: apple-mfi-fastcharge: don't probe unhandled devices
    - [x86] drm/i915: Force VT'd workarounds when running as a guest OS
    - vt: keyboard, simplify vt_kdgkbsent
    - vt: keyboard, extend func_buf_lock to readers (CVE-2020-25656)
    - vt_ioctl: fix GIO_UNIMAP regression
    - HID: wacom: Avoid entering wacom_wac_pen_report for pad / battery
    - [x86] mce: Allow for copy_mc_fragile symbol checksum to be generated
    - [arm64] tty: serial: fsl_lpuart: LS1021A has a FIFO size of 16 words,
      like LS1028A
    - tracing: Fix race in trace_open and buffer resize call
    - [powerpc*] Fix random segfault when freeing hugetlb range
    - udf: Fix memory leak when mounting
    - rcu-tasks: Fix grace-period/unlock race in RCU Tasks Trace
    - rcu-tasks: Fix low-probability task_struct leak
    - rcu-tasks: Enclose task-list scan in rcu_read_lock()
    - [s390x] stp: add locking to sysfs functions
    - [powerpc*] rtas: Restrict RTAS requests from userspace
    - [powerpc*] Warn about use of smt_snooze_delay
    - [powerpc*] memhotplug: Make lmb size 64bit
    - [powerpc*] powernv/elog: Fix race while processing OPAL error log event.
    - [powerpc*] powermac: Fix low_sleep_handler with KUAP and KUEP
    - [powerpc*] mce: Avoid nmi_enter/exit in real mode on pseries hash
    - [powerpc*] Fix undetected data corruption with P9N DD2.1 VSX CI load
      emulation
    - [powerpc*] 32: Fix vmap stack - Do not activate MMU before reading task
      struct
    - [powerpc*] 32: Fix vmap stack - Properly set r1 before activating MMU
    - block: advance iov_iter on bio_add_hw_page failure
    - io_uring: use type appropriate io_kiocb handler for double poll
    - [armhf] remoteproc: Fixup coredump debugfs disable request
    - gfs2: Make sure we don't miss any delayed withdraws
    - gfs2: Only access gl_delete for iopen glocks
    - NFSv4: Wait for stateid updates after CLOSE/OPEN_DOWNGRADE
    - NFSv4.2: support EXCHGID4_FLAG_SUPP_FENCE_OPS 4.2 EXCHANGE_ID flag
    - NFSD: Add missing NFSv2 .pc_func methods
    - ubifs: dent: Fix some potential memory leaks while iterating entries
    - ubifs: xattr: Fix some potential memory leaks while iterating entries
    - ubifs: journal: Make sure to not dirty twice for auth nodes
    - ubifs: Fix a memleak after dumping authentication mount options
    - ubifs: Don't parse authentication mount options in remount process
    - ubifs: mount_ubifs: Release authentication resource in error handling
      path
    - perf vendor events amd: Add L2 Prefetch events for zen1
    - perf python scripting: Fix printable strings in python3 scripts
    - ubi: check kthread_should_stop() after the setting of task state
    - [arm64,armhf] i2c: imx: Fix external abort on interrupt in exit paths
    - drm/amdgpu: don't map BO in reserved region
    - drm/amdgpu: vcn and jpeg ring synchronization
    - drm/amdgpu: update golden setting for sienna_cichlid
    - drm/amdgpu: correct the gpu reset handling for job != NULL case
    - drm/amdgpu: add function to program pbb mode for sienna cichlid
    - drm/amdgpu: increase the reserved VM size to 2MB
    - ceph: promote to unsigned long long before shifting
    - libceph: clear con->out_msg on Policy::stateful_server faults
    - 9P: Cast to loff_t before multiplying
    - net/sunrpc: Fix return value for sysctl sunrpc.transports
    - [arm64] PCI: qcom: Make sure PCIe is reset before init for rev 2.1.0
    - ring-buffer: Return 0 on success from ring_buffer_resize()
    - [x86] intel_idle: Ignore _CST if control cannot be taken from the
      platform
    - [x86] intel_idle: Fix max_cstate for processor models without C-state
      tables
    - cpufreq: Avoid configuring old governors as default with intel_pstate
    - cpufreq: Introduce CPUFREQ_NEED_UPDATE_LIMITS driver flag
    - cpufreq: intel_pstate: Avoid missing HWP max updates in passive mode
    - [amd64] vringh: fix __vringh_iov() when riov and wiov are different
    - ext4: fix leaking sysfs kobject after failed mount
    - ext4: fix error handling code in add_new_gdb
    - ext4: implement swap_activate aops using iomap
    - ext4: fix invalid inode checksum
    - ext4: clear buffer verified flag if read meta block from disk
    - ext4: fix bdev write error check failed when mount fs with ro
    - ext4: fix bs < ps issue reported with dioread_nolock mount opt
    - ext4: do not use extent after put_bh
    - drm/ttm: fix eviction valuable range check.
    - [arm64] mmc: sdhci-of-esdhc: make sure delay chain locked for HS400
    - [arm64] mmc: sdhci-of-esdhc: set timeout to max before tuning
    - mmc: sdhci: Use Auto CMD Auto Select only when v4_mode is true
    - [arm64,armhf] memory: tegra: Remove GPU from DRM IOMMU group
    - futex: Adjust absolute futex timeouts with per time namespace offset
    - drm/amd/psp: Fix sysfs: cannot create duplicate filename
    - drm/amdgpu: correct the cu and rb info for sienna cichlid
    - tty: make FONTX ioctl use the tty pointer they were actually passed
      (CVE-2020-25668)
    - cachefiles: Handle readpage error correctly
    - [hppa] hil/parisc: Disable HIL driver when it gets stuck
    - [arm64] Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S
    - [arm64] dts: marvell: espressobin: Add ethernet switch aliases
    - null_blk: synchronization fix for zoned device
    - device property: Keep secondary firmware node secondary by type
    - device property: Don't clear secondary pointer for shared primary
      firmware node
    - [x86] KVM: Fix NULL dereference at kvm_msr_ignored_check()
    - [arm64] KVM: Fix AArch32 handling of DBGD{CCINT,SCRext} and DBGVCR
    - stop_machine, rcu: Mark functions as notrace
    - [x86] staging: comedi: cb_pcidas: Allow 2-channel commands for AO
      subdevice
    - [mips64el,mipsel] staging: octeon: repair "fixed-link" support
    - [mips64el,mipsel] staging: octeon: Drop on uncorrectable alignment or
      FCS error
    - cpufreq: Introduce cpufreq_driver_test_flags()
    - cpufreq: schedutil: Always call driver if CPUFREQ_NEED_UPDATE_LIMITS is
      set
    - time: Prevent undefined behaviour in timespec64_to_ns()
    - time/sched_clock: Mark sched_clock_read_begin/retry() as notrace
    - null_blk: Fix zone reset all tracing
    - null_blk: Fix locking in zoned mode
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.6
    - [x86] ASOC: SOF: Intel: hda-codec: move unused label to correct position

  [ Sudip Mukherjee ]
  * Remove libtraceevent. (See: #971976)

  [ Vagrant Cascadian ]
  * [arm64] Add i2c_mv64xxx i2c-modules udeb.
  * [arm64] Add drivers/pinctrl to kernel-image udeb.

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.9.1-rt20
  * [rt] Drop "io_wq: Make io_wqe::lock a raw_spinlock_t"
  * [rt] Refresh "kernel/sched: move stack + kprobe clean up to
    __put_task_struct()" for context changes in 5.9.3
  * Bump ABI to 2
  * [x86] media/cec: Enable MEDIA_CEC_SUPPORT; Enable CEC_SECO as module
    (Closes: #972973)
  * [rt] Drop "printk: reduce LOG_BUF_SHIFT range for H8300"
  * [rt] Drop "mm: fix exec activate_mm vs TLB shootdown and lazy tlb
    switching race"
  * [x86] pinctrl: Enable PINCTRL_TIGERLAKE (Closes: #973372)
  * [x86] sound/soc: Enable SND_SOC_SOF_TIGERLAKE_SUPPORT (Closes: #973879)
  * perf/core: Fix a memory leak in perf_event_parse_addr_filter()

  [ Ben Hutchings ]
  * [rt] Rebase seqlock patches on top of 5.9.6

  [ John Paul Adrian Glaubitz ]
  * [sh4] Update kernel configuration for sh7785lcr flavor
    - Compile CONFIG_HID, CONFIG_USB_HID, CONFIG_INPUT_EVDEV and
      CONFIG_R8169 as modules to reduce kernel image size
    - Disable CONFIG_KEYBOARD_ATKBD, CONFIG_MOUSE_PS2*, CONFIG_SERIO*
      and CONFIG_PARPORT_1284 as the SH-7785LCR board does not support
      PC-style keyboards, serial and parallel ports and mice

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 08 Nov 2020 13:40:04 +0100

linux (5.9.1-1) unstable; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.9
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.1
    - Bluetooth: A2MP: Fix not initializing all members (CVE-2020-12352)
    - Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel
      (CVE-2020-12351)
    - Bluetooth: MGMT: Fix not checking if BT_HS is enabled
    - media: usbtv: Fix refcounting mixup
    - USB: serial: option: add Cellient MPL200 card
    - USB: serial: option: Add Telit FT980-KS composition
    - [x86] staging: comedi: check validity of wMaxPacketSize of usb endpoints
      found
    - USB: serial: pl2303: add device-id for HP GC device
    - USB: serial: ftdi_sio: add support for FreeCalypso JTAG+UART adapters
    - vt_ioctl: make VT_RESIZEX behave like VT_RESIZE
    - reiserfs: Initialize inode keys properly
    - reiserfs: Fix oops during mount
    - Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers"
    - [x86] crypto: qat - check cipher length for aead AES-CBC-HMAC-SHA

  [ Romain Perier ]
  * [rt] Update to 5.9-rc8-rt12

  [ Uwe Kleine-König ]
  * [armhf,arm64] Enable CONFIG_VIDEO_SUNXI_CEDRUS (Closes: #972123)

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.9-rt16
  * [x86]  ACPI / extlog: Check for RDMSR failure (Closes: #971058)
  * Set ABI to 1

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 17 Oct 2020 15:14:43 +0200

linux (5.9~rc8-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Ben Hutchings ]
  * linux-doc: Correct index filename in package description
  * [amd64/cloud-amd64] Generalise the description of supported platforms

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.9-rc8-rt11

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 05 Oct 2020 23:17:12 +0200

linux (5.9~rc6-1~exp1) experimental; urgency=medium

  * New upstream release candidate:

  [ Ben Hutchings ]
  * linux-signed-*: Set Uploaders and Standards-Version to match linux
  * [rt] Update to 5.9-rc5-rt7 and re-enable

  [ Uwe Kleine-König ]
  * [arm64,generic] Enable configs used on SMARC-sAL28 board and its carriers.
    Patch by Michael Walle.

  [ Gianfranco Costamagna ]
  * Provide virtualbox-guest-modules now that the module is inside the kernel
    itself.

  [ Salvatore Bonaccorso ]
  * Set ABI to trunk
  * drivers/net/wireless: Enable RTW88_8821CE (Closes: #917941)

 -- Ben Hutchings <benh@debian.org>  Mon, 21 Sep 2020 03:23:41 +0100

linux (5.9~rc4-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Ben Hutchings ]
  * Un-export symbols no longer needed by the Android ashmem and binder drivers
  * aufs: Disable support patchset until it is updated for Linux 5.9
  * Makefile: Do not check for libelf when building OOT module
  * udeb: Move any compression modules to kernel-image; drop compress-modules
  * libtraceevent1: Update symbols list for functions added in 5.9
  * drm/virtio: Revert "drm/virtio: Call the right shmem helpers"

 -- Ben Hutchings <benh@debian.org>  Fri, 11 Sep 2020 04:20:59 +0100

linux (5.8.14-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.11
    - dt-bindings: spi: Fix spi-bcm-qspi compatible ordering
    - net: handle the return value of pskb_carve_frag_list() correctly
    - dt-bindings: PCI: intel,lgm-pcie: Fix matching on all snps,dw-pcie
      instances
    - [x86] hv_netvsc: Remove "unlikely" from netvsc_select_queue
    - loop: Set correct device size when using LOOP_CONFIGURE
    - firmware_loader: fix memory leak for paged buffer
    - xprtrdma: Release in-flight MRs on disconnect
    - NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation
      recall
    - [armhf] phy: omap-usb2-phy: disable PHY charger detect
    - scsi: pm8001: Fix memleak in pm8001_exec_internal_task_abort
    - scsi: libfc: Fix for double free()
    - scsi: lpfc: Fix FLOGI/PLOGI receive race condition in pt2pt discovery
    - scsi: lpfc: Extend the RDF FPIN Registration descriptor for additional
      events
    - [arm64] regulator: pwm: Fix machine constraints application
    - NFS: Zero-stateid SETATTR should first return delegation
    - SUNRPC: stop printk reading past end of string
    - cifs: fix DFS mount with cifsacl/modefromsid
    - nvme-fc: cancel async events before freeing event struct
    - nvme-rdma: cancel async events before freeing event struct
    - block: only call sched requeue_request() for scheduled requests
    - f2fs: fix indefinite loop scanning for free nid
    - f2fs: Return EOF on unaligned end of file DIO read
    - i2c: algo: pca: Reapply i2c bus settings after reset
    - spi: Fix memory leak on splited transfers
    - [mips*] KVM: Change the definition of kvm type
    - [arm64,armhf] clk: rockchip: Fix initialization of mux_pll_src_4plls_p
    - [x86] ASoC: Intel: skl_hda_dsp_generic: Fix NULLptr dereference in
      autosuspend delay
    - [arm64] ASoC: qcom: Set card->owner to avoid warnings
    - ASoC: qcom: common: Fix refcount imbalance on error
    - [powerpc*] book3s64/radix: Fix boot failure with large amount of guest
      memory
    - ASoC: soc-core: add snd_soc_find_dai_with_mutex()
    - [x86] ASoC: Intel: haswell: Fix power transition refactor
    - ASoC: core: Do not cleanup uninitialized dais on soc_pcm_open failure
    - [x86] Drivers: hv: vmbus: hibernation: do not hang forever in
      vmbus_bus_resume()
    - scsi: libsas: Fix error path in sas_notify_lldd_dev_found()
    - [arm64] Allow CPUs unffected by ARM erratum 1418040 to come in late
    - [x86] Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload
    - [x86] drm/i915/gem: Reduce context termination list iteration guard to
      RCU
    - fbcon: Fix user font detection test at fbcon_resize().
    - [arm64] bpf: Fix branch offset in JIT
    - [amd64] iommu/amd: Fix potential @entry null deref
    - [amd64] iommu/amd: Restore IRTE.RemapEn bit for
      amd_iommu_activate_guest_mode
    - [riscv64] Add sfence.vma after early page table changes
    - locking/lockdep: Fix "USED" <- "IN-NMI" inversions
    - efi: efibc: check for efivars write capability
    - locking/percpu-rwsem: Use this_cpu_{inc,dec}() for read_count
    - [x86] unwind/fp: Fix FP unwinding in ret_from_fork
    - [x86] drm/i915/gem: Delay tracking the GEM context until it is
      registered
    - [x86] drm/i915: Filter wake_flags passed to default_wake_function
    - USB: quirks: Add USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for BYD zhaoxin
      notebook
    - USB: UAS: fix disconnect by unplugging a hub
    - usblp: fix race between disconnect() and read()
    - [x86] usb: typec: ucsi: acpi: Increase command completion timeout value
    - [x86] usb: typec: ucsi: Prevent mode overrun
    - [x86] i2c: i801: Fix resume bug
    - Revert "ALSA: hda - Fix silent audio output and corrupted input on MSI
      X570-A PRO"
    - ALSA: hda: fixup headset for ASUS GX502 laptop
    - ALSA: hda/realtek - The Mic on a RedmiBook doesn't work
    - percpu: fix first chunk size calculation for populated bitmap
    - Input: trackpoint - add new trackpoint variant IDs
    - Input: i8042 - add Entroware Proteus EL07R4 to nomux and reset lists
    - [x86] thunderbolt: Retry DROM read once if parsing fails
    - serial: 8250_pci: Add Realtek 816a and 816b
    - serial: core: fix port-lock initialisation
    - serial: core: fix console port-lock regression
    - ksm: reinstate memcg charge on copied pages
    - kprobes: fix kill kprobe which has been marked as gone
    - mm/thp: fix __split_huge_pmd_locked() for migration PMD
    - [s390x] add 3f program exception handler
    - [s390x] pci: fix leak of DMA tables on hard unplug
    - [s390x] zcrypt: fix kmalloc 256k failure
    - ehci-hcd: Move include to keep CRC stable
    - [arm64] paravirt: Initialize steal time when cpu is online
    - [powerpc*] dma: Fix dma_map_ops::get_required_mask
    - dm/dax: Fix table reference counts
    - mm/memory_hotplug: drain per-cpu pages again during memory offline
    - dm: Call proper helper to determine dax support
    - dax: Fix compilation for CONFIG_DAX && !CONFIG_FS_DAX
    - mm: memcg: fix memcg reclaim soft lockup
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.12
    - act_ife: load meta modules before tcf_idr_check_alloc()
    - bnxt_en: Avoid sending firmware messages when AER error is detected.
    - bnxt_en: Fix NULL ptr dereference crash in bnxt_fw_reset_task()
    - cxgb4: fix memory leak during module unload
    - cxgb4: Fix offset when clearing filter byte counters
    - geneve: add transport ports in route lookup for geneve (CVE-2020-25645)
    - hdlc_ppp: add range checks in ppp_cp_parse_cr() (CVE-2020-25643)
    - [arm64,x86] hinic: bump up the timeout of SET_FUNC_STATE cmd
    - ip: fix tos reflection in ack and reset packets
    - ipv4: Initialize flowi4_multipath_hash in data path
    - ipv4: Update exception handling for multipath routes via same device
    - ipv6: avoid lockdep issue in fib6_del()
    - net: bridge: br_vlan_get_pvid_rcu() should dereference the VLAN group
      under RCU
    - net: DCB: Validate DCB_ATTR_DCB_BUFFER argument
    - net: Fix bridge enslavement failure
    - net: ipv6: fix kconfig dependency warning for IPV6_SEG6_HMAC
    - net/mlx5: Fix FTE cleanup
    - net: phy: call phy_disable_interrupts() in phy_attach_direct() instead
    - net: sched: initialize with 0 before setting erspan md->u
    - net: sch_generic: aviod concurrent reset and enqueue op for lockless
      qdisc
    - net: sctp: Fix IPv6 ancestor_size calc in sctp_copy_descendant
    - nfp: use correct define to return NONE fec
    - tipc: Fix memory leak in tipc_group_create_member()
    - tipc: fix shutdown() of connection oriented socket
    - tipc: use skb_unshare() instead in tipc_buf_append()
    - net/mlx5e: Enable adding peer miss rules only if merged eswitch is
      supported
    - bnxt_en: Use memcpy to copy VPD field info.
    - bnxt_en: return proper error codes in bnxt_show_temp
    - bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex.
    - net: phy: Avoid NPD upon phy_detach() when driver is unbound
    - net: phy: Do not warn in phy_stop() on PHY_DOWN
    - net: add __must_check to skb_put_padto()
    - [armhf] net: ethernet: ti: cpsw_new: fix suspend/resume
    - wireguard: noise: take lock when removing handshake entry from table
    - wireguard: peerlookup: take lock before checking hash in replace
      operation
    - net/mlx5e: Fix memory leak of tunnel info when rule under multipath not
      ready
    - [arm64,x86] hinic: fix rewaking txq after netif_tx_disable
    - [x86] hv_netvsc: Fix hibernation for mlx5 VF driver
    - [arm64,armhf] net: dsa: link interfaces with the DSA master to get rid
      of lockdep warnings
    - net: macb: fix for pause frame receive enable bit
    - Revert "netns: don't disable BHs when locking "nsid_lock""
    - net/mlx5e: Use RCU to protect rq->xdp_prog
    - net/mlx5e: Use synchronize_rcu to sync with NAPI
    - net/mlx5e: Fix endianness when calculating pedit mask first bit
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.13
    - device_cgroup: Fix RCU list debugging warning
    - [x86] ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1
    - [riscv64] Take text_mutex in ftrace_init_nop()
    - [armhf] i2c: aspeed: Mask IRQ status to relevant bits
    - [s390x] init: add missing __init annotations
    - lockdep: fix order in trace_hardirqs_off_caller()
    - i2c: core: Call i2c_acpi_install_space_handler() before
      i2c_acpi_register_devices()
    - objtool: Fix noreturn detection for ignored functions
    - mwifiex: Increase AES key storage size to 256 bits
    - batman-adv: bla: fix type misuse for backbone_gw hash indexing
    - libbpf: Fix build failure from uninitialized variable warning
    - atm: eni: fix the missed pci_disable_device() for eni_init_one()
    - batman-adv: mcast/TT: fix wrongly dropped or rerouted packets
    - netfilter: ctnetlink: add a range check for l3/l4 protonum
      (CVE-2020-25211)
    - netfilter: ctnetlink: fix mark based dump filtering regression
    - netfilter: conntrack: nf_conncount_init is failing with IPv6 disabled
    - netfilter: nft_meta: use socket user_ns to retrieve skuid and skgid
    - mac802154: tx: fix use-after-free
    - bpf: Fix clobbering of r2 in bpf_gen_ld_abs
    - tools/libbpf: Avoid counting local symbols in ABI check
    - [arm*] drm/vc4/vc4_hdmi: fill ASoC card owner
    - net: qed: Disable aRFS for NPAR and 100G
    - net: qede: Disable aRFS for NPAR and 100G
    - net: qed: RDMA personality shouldn't fail VF load
    - igc: Fix wrong timestamp latency numbers
    - igc: Fix not considering the TX delay for timestamps
    - [x86] hv_netvsc: Switch the data path at the right time during
      hibernation
    - RDMA/core: Fix ordering of CQ pool destruction
    - batman-adv: Add missing include for in_interrupt()
    - xsk: Fix number of pinned pages/umem size discrepancy
    - batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN
    - batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh
    - batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
    - bpf: Fix a rcu warning for bpffs map pretty-print
    - mac80211: do not disable HE if HT is missing on 2.4 GHz
    - cfg80211: fix 6 GHz channel conversion
    - mac80211: fix 80 MHz association to 160/80+80 AP on 6 GHz
    - [x86] ALSA: asihpi: fix iounmap in error handler
    - io_uring: fix openat/openat2 unified prep handling
    - SUNRPC: Fix svc_flush_dcache()
    - regmap: fix page selection for noinc reads
    - regmap: fix page selection for noinc writes
    - net/mlx5e: mlx5e_fec_in_caps() returns a boolean
    - [mips64el,mipsel] Loongson-3: Fix fp register access if MSA enabled
    - [armhf] PM / devfreq: tegra30: Disable clock on error in probe
    - [arm64,armhf] regulator: axp20x: fix LDO2/4 description
    - [x86] KVM: Reset MMU context if guest toggles CR4.SMAP or CR4.PKE
    - [x86] KVM: SVM: Add a dedicated INVD intercept routine
    - mm: validate pmd after splitting
    - [x86] arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache
      writeback
    - [x86] irq: Make run_on_irqstack_cond() typesafe
    - [x86] ioapic: Unbreak check_timer()
    - scsi: lpfc: Fix initial FLOGI failure due to BBSCN not supported
    - ALSA: usb-audio: Add delay quirk for H570e USB headsets
    - ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged
    - ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation
      P520
    - lib/string.c: implement stpcpy
    - tracing: fix double free
    - [s390x] dasd: Fix zero write for FBA devices
    - kprobes: Fix to check probe enabled before disarm_kprobe_ftrace()
    - kprobes: tracing/kprobes: Fix to kill kprobes on initmem after boot
    - btrfs: fix put of uninitialized kobject after seed device delete
    - btrfs: fix overflow when copying corrupt csums for a message
    - media: cec-adap.c: don't use flush_scheduled_work()
    - dmabuf: fix NULL pointer dereference in dma_buf_release()
    - mm, THP, swap: fix allocating cluster for swapfile by mistake
    - mm/gup: fix gup_fast with dynamic page table folding
    - mm: replace memmap_context by meminit_context
    - mm: don't rely on system state to detect hot-plug operations
    - [s390x] zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl
    - io_uring: ensure open/openat2 name is cleaned on cancelation
    - [arm64] KVM: Assume write fault on S1PTW permission fault on instruction
      fetch
    - dm: fix bio splitting and its bio completion order for regular IO
    - [armhf] clocksource/drivers/timer-ti-dm: Do reset before enable
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.14
    - io_uring: always delete double poll wait entry on match
    - btrfs: fix filesystem corruption after a device replace
    - mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS
      models
    - USB: gadget: f_ncm: Fix NDP16 datagram validation
    - Revert "usbip: Implement a match function to fix usbip"
    - usbcore/driver: Fix specific driver selection
    - usbcore/driver: Fix incorrect downcast
    - usbcore/driver: Accommodate usbip
    - [x86] gpio: amd-fch: correct logic of GPIO_LINE_DIRECTION
    - [armhf] clk: samsung: Keep top BPLL mux on Exynos542x enabled
    - scsi: iscsi: iscsi_tcp: Avoid holding spinlock while calling
      getpeername()
    - [arm64,x86] i2c: i801: Exclude device from suspend direct complete
      optimization
    - Input: i8042 - add nopnp quirk for Acer Aspire 5 A515
    - ftrace: Move RCU is watching check after recursion check
    - tracing: Fix trace_find_next_entry() accounting of temp buffer size
    - memstick: Skip allocating card when removing host
    - drm/amdgpu: restore proper ref count in amdgpu_display_crtc_set_config
    - xen/events: don't use chip_data for legacy IRQs
    - [x86] vboxsf: Fix the check for the old binary mount-arguments struct
    - drivers/net/wan/hdlc_fr: Add needed_headroom for PVC devices
    - Revert "wlcore: Adding suppoprt for IGTK key in wlcore driver"
    - [arm64,armhf] drm/sun4i: mixer: Extend regmap max_register
    - [x86] hv_netvsc: Cache the current data path to avoid duplicate call and
      message
    - net: dec: de2104x: Increase receive ring size for Tulip
    - rndis_host: increase sleep time in the query-response loop
    - nvme-pci: disable the write zeros command for Intel 600P/P3100
    - nvme-core: get/put ctrl and transport module in nvme_dev_open/release()
    - fuse: fix the ->direct_IO() treatment of iov_iter
    - drivers/net/wan/hdlc: Set skb->protocol before transmitting
    - mac80211: Fix radiotap header channel flag for 6GHz band
    - mac80211: do not allow bigger VHT MPDUs than the hardware supports
    - tracing: Make the space reserved for the pid wider
    - tools/io_uring: fix compile breakage
    - io_uring: mark statx/files_update/epoll_ctl as non-SQPOLL
    - cpuidle: psci: Fix suspicious RCU usage
    - nvme-pci: fix NULL req in completion handler
    - nvme-fc: fail new connections to a deleted host or remote port
    - scripts/kallsyms: skip ppc compiler stub *.long_branch.* /
      *.plt_branch.*
    - [armhf] pinctrl: mvebu: Fix i2c sda definition for 98DX3236
    - nfs: Fix security label length not being reset
    - NFSv4.2: fix client's attribute cache management for copy_file_range
    - pNFS/flexfiles: Ensure we initialise the mirror bsizes correctly on read
    - [arm64,armhf] clk: tegra: Always program PLL_E when enabled
    - [arm64,armhf] clk: tegra: Fix missing prototype for
      tegra210_clk_register_emc()
    - [armhf] clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED
    - scsi: target: Fix lun lookup for TARGET_SCF_LOOKUP_LUN_FROM_TAG case
    - [arm64,armhf] gpio: pca953x: Fix uninitialized pending variable
    - Input: trackpoint - enable Synaptics trackpoints
    - blk-mq: call commit_rqs while list empty but error happen
    - scripts/dtc: only append to HOST_EXTRACFLAGS instead of overwriting
    - autofs: use __kernel_write() for the autofs pipe writing
    - [arm64,armhf] gpio: pca953x: Correctly initialize registers 6 and 7 for
      PCA957x
    - [amd64] iommu/amd: Fix the overwritten field in IVMD header
    - pipe: remove pipe_wait() and fix wakeup race with splice
    - random32: Restore __latent_entropy attribute on net_rand_state
    - gpiolib: Fix line event handling in syscall compatible mode
    - [x86] drm/i915/gvt: Fix port number for BDW on EDID region setup
    - scsi: sd: sd_zbc: Fix handling of host-aware ZBC disks
    - scsi: sd: sd_zbc: Fix ZBC disk initialization
    - epoll: do not insert into poll queues until all sanity checks are done
    - epoll: replace ->visited/visited_list with generation count
    - epoll: EPOLL_CTL_ADD: close the race in decision to take fast path
    - ep_create_wakeup_source(): dentry name can change under you...

  [ Vagrant Cascadian ]
  * [armhf] Enable MFD_AXP20X_RSB as a built-in (Closes: #914813). Thanks
    to Bernhard.

  [ Salvatore Bonaccorso ]
  * [x86] Enable INTEL_PMC_CORE as module (Closes: #971017)
  * Bump ABI to 3

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 10 Oct 2020 21:40:31 +0200

linux (5.8.10-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.8
    - HID: quirks: Always poll three more Lenovo PixArt mice
    - [arm64] drm/msm/dpu: Fix reservation failures in modeset
    - [arm64] drm/msm/dpu: Fix scale params in plane validation
    - [arm64] drm/msm/dpu: fix unitialized variable error
    - [arm64] drm/msm: add shutdown support for display platform_driver
    - [x86] hwmon: (applesmc) check status earlier.
    - nvmet: Disable keep-alive timer when kato is cleared to 0h
    - [arm64] drm/msm: enable vblank during atomic commits
    - [arm64] drm/msm/a6xx: fix gmu start on newer firmware
    - gfs2: add some much needed cleanup for log flushes that fail
    - [x86] hv_utils: return error if host timesysnc update is stale
    - [x86] hv_utils: drain the timesync packets on onchannelcallback
    - ceph: don't allow setlease on cephfs
    - [armhf] drm/omap: fix incorrect lock state
    - cpuidle: Fixup IRQ state
    - nbd: restore default timeout when setting it to zero
    - [s390x] don't trace preemption in percpu macros
    - xen/xenbus: Fix granting of vmalloc'd memory
    - dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling
    - batman-adv: Avoid uninitialized chaddr when handling DHCP
    - batman-adv: Fix own OGM check in aggregated OGMs
    - batman-adv: bla: use netif_rx_ni when not in interrupt context
    - rxrpc: Keep the ACK serial in a var in rxrpc_input_ack()
    - rxrpc: Fix loss of RTT samples due to interposed ACK
    - rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
    - [mips*] mm: BMIPS5000 has inclusive physical caches
    - [arm64,x86] mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040
    - perf sched timehist: Fix use of CPU list with summary option
    - perf top: Skip side-band event setup if HAVE_LIBBPF_SUPPORT is not set
    - netfilter: nf_tables: add NFTA_SET_USERDATA if not null
    - netfilter: nf_tables: incorrect enum nft_list_attributes definition
    - netfilter: nf_tables: fix destination register zeroing
    - [arm64] net: hns: Fix memleak in hns_nic_dev_probe
    - bpf: Fix a buffer out-of-bound access when filling raw_tp link_info
    - [arm64,armhf] dmaengine: pl330: Fix burst length if burst size is
      smaller than bus width
    - gtp: add GTPA_LINK info to msg sent to userspace
    - [armhf] net: ethernet: ti: cpsw: fix clean up of vlan mc entries for
      host port
    - [armhf] net: ethernet: ti: cpsw_new: fix clean up of vlan mc entries for
      host port
    - bnxt_en: Don't query FW when netif_running() is false.
    - bnxt_en: Check for zero dir entries in NVRAM.
    - bnxt_en: Fix ethtool -S statitics with XDP or TCs enabled.
    - bnxt_en: Fix PCI AER error recovery flow
    - bnxt_en: Fix possible crash in bnxt_fw_reset_task().
    - bnxt_en: fix HWRM error when querying VF temperature
    - xfs: finish dfops on every insert range shift iteration
    - xfs: fix boundary test in xfs_attr_shortform_verify
    - bnxt: don't enable NAPI until rings are ready
    - [armhf] net: ethernet: ti: cpsw_new: fix error handling in
      cpsw_ndo_vlan_rx_kill_vid()
    - netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of
      ENOBUFS
    - nvmet-fc: Fix a missed _irqsave version of spin_lock in
      'nvmet_fc_fod_op_done()'
    - nvme: fix controller instance leak
    - netfilter: conntrack: do not auto-delete clash entries on reply
    - opp: Don't drop reference for an OPP table that was never parsed
    - cxgb4: fix thermal zone device registration
    - [mips*] perf: Fix wrong check condition of Loongson event IDs
    - block: fix locking in bdev_del_partition
    - perf top/report: Fix infinite loop in the TUI for grouped events
    - perf cs-etm: Fix corrupt data after perf inject from
    - perf intel-pt: Fix corrupt data after perf inject from
    - perf tools: Correct SNOOPX field offset
    - net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init()
    - fix regression in "epoll: Keep a reference on files added to the check
      list"
    - [arm64] net: bcmgenet: fix mask check in bcmgenet_validate_flow()
    - nfp: flower: fix ABI mismatch between driver and firmware
    - net: dp83867: Fix WoL SecureOn password
    - [mips*] add missing MSACSR and upper MSA initialization
    - xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt
      files
    - perf jevents: Fix suspicious code in fixregex()
    - perf stat: Turn off summary for interval mode by default
    - perf bench: The do_run_multi_threaded() function must use
      IS_ERR(perf_session__new())
    - tg3: Fix soft lockup when tg3_reset_task() fails.
    - [amd64] x86, fakenuma: Fix invalid starting node ID
    - [amd64] iommu/vt-d: Serialize IOMMU GCMD register modifications
    - [armhf] thermal: ti-soc-thermal: Fix bogus thermal shutdowns for
      omap4430
    - [arm64] thermal: qcom-spmi-temp-alarm: Don't suppress negative temp
    - [amd64] iommu/amd: Restore IRTE.RemapEn bit after programming IRTE
    - [amd64] iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE
    - [amd64] iommu/vt-d: Handle 36bit addressing for x86-32
    - [x86] tracing/kprobes, x86/ptrace: Fix regs argument order for i386
    - [x86] entry: Fix AC assertion
    - [x86] debug: Allow a single level of #DB recursion
    - ext2: don't update mtime on COW faults
    - xfs: don't update mtime on COW faults
    - btrfs: drop path before adding new uuid tree entry
    - btrfs: fix potential deadlock in the search ioctl
    - btrfs: allocate scrub workqueues outside of locks
    - btrfs: set the correct lockdep class for new nodes
    - btrfs: set the lockdep class for log tree extent buffers
    - btrfs: block-group: fix free-space bitmap threshold
    - btrfs: tree-checker: fix the error message for transid error
    - Bluetooth: Return NOTIFY_DONE for hci_suspend_notifier (Closes: #964839)
    - [x86] mm/32: Bring back vmalloc faulting on x86_32
    - Revert "ALSA: hda: Add support for Loongson 7A1000 controller"
    - ALSA: ca0106: fix error code handling
    - ALSA: usb-audio: Add basic capture support for Pioneer DJ DJM-250MK2
    - ALSA: usb-audio: Add implicit feedback quirk for UR22C
    - ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check
    - ALSA: hda/hdmi: always check pin power status in i915 pin fixup
    - ALSA: firewire-digi00x: exclude Avid Adrenaline from detection
    - ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A
      PRO
    - ALSA; firewire-tascam: exclude Tascam FE-8 from detection
    - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A
    - ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen
    - mmc: sdhci-pci: Fix SDHCI_RESET_ALL for CQHCI for Intel GLK-based
      controllers
    - media: rc: do not access device via sysfs after rc_unregister_device()
    - media: rc: uevent sysfs file races with rc_unregister_device()
    - affs: fix basic permission bits to actually work
    - block: allow for_each_bvec to support zero len bvec
    - block: ensure bdi->io_pages is always initialized
    - io_uring: set table->files[i] to NULL when io_sqe_file_register failed
    - io_uring: fix removing the wrong file in __io_sqe_files_update()
    - libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks
    - [mips*] oprofile: Fix fallthrough placement
    - blk-stat: make q->stats->lock irqsafe
    - [x86] drm/i915: Fix sha_text population code
    - dm writecache: handle DAX to partitions on persistent memory correctly
    - dm mpath: fix racey management of PG initialization
    - dm integrity: fix error reporting in bitmap mode after creation
    - dm crypt: Initialize crypto wait structures
    - dm cache metadata: Avoid returning cmd->bm wild pointer on error
    - dm thin metadata: Avoid returning cmd->bm wild pointer on error
    - dm thin metadata: Fix use-after-free in dm_bm_set_read_only
    - mm: slub: fix conversion of freelist_corrupted()
    - mm: track page table modifications in __apply_to_page_range()
    - mm: madvise: fix vma user-after-free
    - mm/rmap: fixup copying of soft dirty and uffd ptes
    - io_uring: no read/write-retry on -EAGAIN error and O_NONBLOCK marked
      file
    - perf record: Correct the help info of option "--no-bpf-event"
    - [arm64,armhf] sdhci: tegra: Add missing TMCLK for data timeout
    - mm/migrate: fixup setting UFFD_WP flag
    - mm/hugetlb: try preferred node first when alloc gigantic page from cma
    - mm/hugetlb: fix a race between hugetlb sysctl handlers (CVE-2020-25285)
    - mm/khugepaged.c: fix khugepaged's request size in collapse_file
    - cfg80211: regulatory: reject invalid hints
    - net: usb: Fix uninit-was-stored issue in asix_read_phy_addr()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.9
    - io_uring: fix cancel of deferred reqs with ->files
    - io_uring: fix linked deferred ->files cancellation
    - RDMA/cma: Simplify DEVICE_REMOVAL for internal_id
    - RDMA/cma: Using the standard locking pattern when delivering the removal
      event
    - RDMA/cma: Remove unneeded locking for req paths
    - RDMA/cma: Execute rdma_cm destruction from a handler properly
    - ipv4: Silence suspicious RCU usage warning
    - ipv6: Fix sysctl max for fib_multipath_hash_policy
    - netlabel: fix problems with mapping removal
    - net: usb: dm9601: Add USB ID of Keenetic Plus DSL
    - sctp: not disable bh in the whole sctp_get_port_local()
    - tipc: fix shutdown() of connectionless socket
    - tipc: fix using smp_processor_id() in preemptible
    - net: disable netpoll on fresh napis
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.10
    - [armhf] OMAP2+: Fix an IS_ERR() vs NULL check in _get_pwrdm()
    - regulator: push allocation in regulator_ena_gpio_request() out of lock
    - regulator: remove superfluous lock in regulator_resolve_coupling()
    - RDMA/rxe: Fix memleak in rxe_mem_init_user
    - RDMA/rxe: Drop pointless checks in rxe_init_ports
    - RDMA/rxe: Fix panic when calling kmem_cache_create()
    - [arm64,armhf] drm/sun4i: add missing put_device() call in
      sun8i_r40_tcon_tv_set_mux()
    - [armhf] drm/sun4i: Fix dsi dcs long write function
    - scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA
    - drm/virtio: fix unblank
    - RDMA/core: Fix unsafe linked list traversal after failing to allocate CQ
    - RDMA/core: Fix reported speed and width
    - scsi: megaraid_sas: Don't call disable_irq from process IRQ poll
    - scsi: mpt3sas: Don't call disable_irq from IRQ poll handler
    - padata: fix possible padata_works_lock deadlock
    - [arm64,armhf] drm/sun4i: Fix DE2 YVU handling
    - [arm64,armhf] drm/sun4i: backend: Support alpha property on lowest plane
    - [arm64,armhf] drm/sun4i: backend: Disable alpha on the lowest plane on
      the A20
    - [arm64] KVM: Update page shift if stage 2 block mapping not supported
    - [arm64,x86] mmc: sdhci-acpi: Clear amd_sdhci_host on reset
    - [arm64] mmc: sdhci-msm: Add retries when all tuning phases are found
      valid
    - [armhf] spi: stm32: Rate-limit the 'Communication suspended' message
    - btrfs: fix NULL pointer dereference after failure to create snapshot
    - block: restore a specific error code in bdev_del_partition
    - seccomp: don't leak memory when filter install races
    - nvme-fabrics: allow to queue requests for live queues
    - [armhf] spi: stm32: fix pm_runtime_get_sync() error checking
    - block: Set same_page to false in __bio_try_merge_page if ret is false
    - IB/isert: Fix unaligned immediate-data handling
    - [x86] KVM: nVMX: Fix the update value of nested load
      IA32_PERF_GLOBAL_CTRL control
    - [x86] KVM: always allow writing '0' to MSR_KVM_ASYNC_PF_EN
    - [arm64,x86] dmaengine: acpi: Put the CSRT table after using it
    - netfilter: conntrack: allow sctp hearbeat after connection re-use
    - netfilter: nft_set_rbtree: Detect partial overlap with start endpoint
      match
    - [x86] firestream: Fix memleak in fs_open
    - scsi: qedf: Fix null ptr reference in qedf_stag_change_work
    - [arm64,armhf] ALSA: hda: Fix 2 channel swapping for Tegra
    - [arm64,armhf] ALSA: hda/tegra: Program WAKEEN register for Tegra
    - [arm64] net: hns3: Fix for geneve tx checksum bug
    - xfs: fix off-by-one in inode alloc block reservation calculation
    - wireless: fix wrong 160/80+80 MHz setting
    - mac80211: reduce packet loss event false positives
    - cfg80211: Adjust 6 GHz frequency to channel conversion
    - xfs: initialize the shortform attr header padding entry
    - nvme-fabrics: don't check state NVME_CTRL_NEW for request acceptance
    - nvme: have nvme_wait_freeze_timeout return if it timed out
    - nvme-rdma: serialize controller teardown sequences
    - nvme-rdma: fix timeout handler
    - nvme-rdma: fix reset hang if controller died in the middle of a reset
    - nvme-pci: cancel nvme device request before disabling
    - HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for all Saitek X52 devices
    - HID: microsoft: Add rumble support for the 8bitdo SN30 Pro+ controller
    - drivers/net/wan/hdlc_cisco: Add hard_header_len
    - HID: elan: Fix memleak in elan_input_configured
    - [x86] cpufreq: intel_pstate: Refuse to turn off with HWP enabled
    - [x86] cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo
      disabled
    - [arm64] module: set trampoline section flags regardless of
      CONFIG_DYNAMIC_FTRACE
    - ALSA: hda: hdmi - add Rocketlake support
    - ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled
    - ALSA: hda: use consistent HDAudio spelling in comments/docs
    - drivers/net/wan/hdlc: Change the default of hard_header_len to 0
    - [amd64] iommu/amd: Do not force direct mapping when SME is active
    - [amd64] iommu/amd: Do not use IOMMUv2 functionality when SME is active
    - gcov: Disable gcov build with GCC 10
    - iio: adc: ti-ads1015: fix conversion when CONFIG_PM is not set
    - [arm64] iio: cros_ec: Set Gyroscope default frequency to 25Hz
    - [x86] iio:accel:bmc150-accel: Fix timestamp alignment and prevent data
      leak.
    - [x86] iio:magnetometer:ak8975 Fix alignment and data leak issues.
    - [armhf] iio:accel:mma8452: Fix timestamp alignment and prevent data
      leak.
    - [x86] staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb()
    - btrfs: require only sector size alignment for parent eb bytenr
    - btrfs: fix lockdep splat in add_missing_dev
    - btrfs: free data reloc tree on failed mount
    - btrfs: fix wrong address when faulting in pages in the search ioctl
    - [x86] thunderbolt: Disable ports that are not implemented
    - kobject: Restore old behaviour of kobject_del(NULL)
    - regulator: push allocation in regulator_init_coupling() outside of lock
    - regulator: push allocations in create_regulator() outside of lock
    - regulator: push allocation in set_consumer_device_supply() out of lock
    - regulator: plug of_node leak in regulator_register()'s error path
    - regulator: core: Fix slab-out-of-bounds in regulator_unlock_recursive()
    - misc: eeprom: at24: register nvmem only after eeprom is ready to use
    - scsi: target: iscsi: Fix data digest calculation
    - scsi: lpfc: Fix setting IRQ affinity with an empty CPU mask
    - scsi: target: iscsi: Fix hang in iscsit_access_np() when getting
      tpg->np_login_sem
    - [arm64] drm/msm: Split the a5xx preemption record
    - [arm64] drm/msm: Disable preemption on all 5xx targets
    - [arm64] drm/msm: Disable the RPTR shadow
    - mmc: sdio: Use mmc_pre_req() / mmc_post_req()
    - [arm64] mmc: sdhci-of-esdhc: Don't walk device-tree on every interrupt
    - nvme: Revert: Fix controller creation races with teardown flow
    - rbd: require global CAP_SYS_ADMIN for mapping and unmapping
      (CVE-2020-25284)
    - RDMA/rxe: Fix the parent sysfs read when the interface has 15 chars
    - RDMA/mlx4: Read pkey table length instead of hardcoded value
    - fbcon: remove soft scrollback code (CVE-2020-14390)
    - fbcon: remove now unusued 'softback_lines' cursor() argument
    - vgacon: remove software scrollback support
    - [x86] KVM: VMX: Don't freeze guest when event delivery causes an
      APIC-access exit
    - [arm64] KVM: Do not try to map PUDs when they are folded into PMD
    - [x86] kvm x86/mmu: use KVM_REQ_MMU_SYNC to sync when needed
    - KVM: fix memory leak in kvm_io_bus_unregister_dev()
    - [arm64,armhf] Revert "usb: dwc3: meson-g12a: fix shared reset control
      use"
    - debugfs: Fix module state check condition
    - test_firmware: Test platform fw loading on non-EFI systems
    - [x86] video: fbdev: fix OOB read in vga_8planes_imageblit()
    - [arm64] phy: qcom-qmp: Use correct values for ipq8074 PCIe Gen2 PHY init
    - usb: core: fix slab-out-of-bounds Read in read_descriptors
    - USB: serial: ftdi_sio: add IDs for Xsens Mti USB converter
    - USB: serial: option: support dynamic Quectel USB compositions
    - USB: serial: option: add support for SIM7070/SIM7080/SIM7090 modules
    - usb: Fix out of sync data toggle if a configured device is reconfigured
    - [x86] usb: typec: ucsi: acpi: Check the _DEP dependencies
    - [arm64] drm/msm/gpu: make ringbuffer readonly
    - gcov: add support for GCC 10.1

  [ Salvatore Bonaccorso ]
  * [x86] drivers/input/keyboard: Enable KEYBOARD_APPLESPI as module
    (Closes: #943337)
  * drivers/net/wireless: Enable RTW88_8723DE
  * Bump ABI to 2
  * udeb: Make input-modules depend on crc-modules.

  [ Vagrant Cascadian ]
  * [arm64] Enable BATTERY_CW2015 as a module.
  * [arm64] Apply patch from upstream to support battery status on
    Pinebook Pro.

  [ Ben Hutchings ]
  * [hppa] Set Build-Profiles for linux-image-parisc{,64}-smp (Closes: #970011)
  * Provide linux-{image,headers}-generic virtual packages on most
    architectures (Closes: #960209)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 19 Sep 2020 14:17:19 +0200

linux (5.8.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.4
    - ext4: fix potential negative array index in do_split() (CVE-2020-14314)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.5
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.6
    - nfsd: fix oops on mixed NFSv4/NFSv3 client access
    - [powerpc] 32s: Disable VMAP stack which CONFIG_ADB_PMU (Closes: #963689)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.7

  [ Ben Hutchings ]
  * [mips*] udeb: Drop hfs-modules (fixes FTBFS)
  * [m68k,powerpc,ppc64] udeb: Make hfs-modules depend on cdrom-core-modules
    (fixes FTBFS)
  * tools/include/uapi: Fix <asm/errno.h> (probably fixes FTBFS on ia64)
  * bpftool: Build with Debian recommended compiler options

  [ Salvatore Bonaccorso ]
  * iwlwifi: yoyo: don't print failure if debug firmware is missing
    (Closes: #966218)
  * debian/tests/python: pycodestyle: Increase max-line-length to 100.
  * net/packet: fix overflow in tpacket_rcv (CVE-2020-14386)
  * Set ABI to 1

  [ Uwe Kleine-König ]
  * [arm64] Enable a few options for Kobol's helios64

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 05 Sep 2020 16:52:44 +0200

linux (5.8.3-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.8
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.2
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.3

  [ Jeremy Stanley ]
  * [x86] PMIC operation region support (Closes: #925965)
    - Enable CONFIG_PMIC_OPREGION for general ACPI support of operation
      regions with Power Management Integrated Circuits. Turn on specific
      opregion support for:
      + CONFIG_BYTCRC_PMIC_OPREGION (Bay Trail Crystal Cove PMIC)
      + CONFIG_CHTCRC_PMIC_OPREGION (Cherry Trail Crystal Cove PMIC)
      + CONFIG_XPOWER_PMIC_OPREGION (XPower AXP288 PMIC)
      + CONFIG_BXT_WC_PMIC_OPREGION (BXT WhiskeyCove PMIC)
      + CONFIG_CHT_WC_PMIC_OPREGION (CHT Whiskey Cove PMIC)
      + CONFIG_CHT_DC_TI_PMIC_OPREGION (Dollar Cove TI PMIC)
      Additionally enable CONFIG_MFD_INTEL_PMC_BXT as a module (multi-function
      device driver for Intel Broxton Whiskey Cove PMIC), along with
      CONFIG_INTEL_SOC_PMIC (Crystal Cove PMIC) as a dependency for it.
  * [x86] Fix Cherry Trail power management regression (Closes: #949886)
    - Switch CONFIG_I2C_DESIGNWARE_PLATFORM from being compiled as a module to
      compiled into the kernel directly, since as of kernel version 5.1 this
      state became a dependency for CONFIG_INTEL_SOC_PMIC_CHTWC which is
      already enabled.
    - Enable CONFIG_USB_ROLES_INTEL_XHCI and CONFIG_TYPEC_MUX_PI3USB30532 as
      modules, which became dependencies for the already enabled
      CONFIG_INTEL_CHT_INT33FE as of kernel version 4.17.

  [ Romain Perier ]
  * Rebased patches onto 5.8.

  [ Uwe Kleine-König ]
  * [armhf] Enable BCM2835 auxiliar mini UART support found on Raspberry Pi
    (all models); patch by Marc Kleine-Budde. (Closes: #963619)
  * [arm64] Enable IR_MESON and SPI_MESON_SPICC.

  [ Helge Deller ]
  * [hppa] Build linux-image-parisc-smp and linux-image-parisc64-smp
    transition packages

  [ Yves-Alexis Perez ]
  * usb: Enable APPLE_MFI_FASTCHARGE as a module

  [ Salvatore Bonaccorso ]
  * Set ABI to trunk

  [ Bastian Blank ]
  * [x86] hyperv-daemons:
    - Rename services to remove "hyperv-daemons." prefix
    - Use debhelper for services.
    - Make systemd service bind to device.
    - Start kvp daemon way earlier in boot.
    - Specify some service restrictions.
  * udeb: Reverse order of cdrom-core and isofs/udf.
  * Fix build of documentation.
  * [amd64] Enable GVE. (closes: #964812)
  * Compile with gcc-10 on all architectures.
  * [cloud] Enable TARGET_CORE. (closes: #952108)
  * [cloud] Disable DLM, GFS2_FS, OCFS2_FS.
  * Move System.map into debug package and replace with pointer.

  [ Ben Hutchings ]
  * [x86] hyperv-daemons: Complete renaming of init scripts
  * [x86] hyperv-daemons: Correct old names in Conflicts field of unit files
  * [hppa] Use standard metadata for transitional packages
  * bpftool: Fix version string in recursive builds
  * Revert "linux-libc-dev: Re-add "Provides: linux-kernel-headers""
    (Closes: #959462)
  * mm: Enable INIT_ON_ALLOC_DEFAULT_ON. This can be reverted using the
    kernel parameter: init_on_alloc=0
  * libtraceevent1: Add new APIs to symbols file

  [ Christian Barcenas ]
  * bpftool: add packaging for tools/bpf/bpftool (Closes: #896165)
    - Thank you to Noah Meyerhans for the first iteration of packaging.

  [ Thomas W ]
  * [x86] Enable CONFIG_XIAOMI_WMI

  [ Matthew Gabeler-Lee ]
  * [x86] Re-enable APU2 LED control (Closes: 949448)

  [ Joel Stanley ]
  * [armhf] Enable NET_NCSI

  [ Walter Lozano ]
  * [armhf] Enable NVMEM_IMX_OCOTP (Closes: #968253)

  [ Philipp Kern ]
  * [s390x] Add virtio_net to nic-modules.

 -- Ben Hutchings <benh@debian.org>  Mon, 24 Aug 2020 01:23:22 +0100

linux (5.7.17-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.11
    - bpf: Set the number of exception entries properly for subprograms
    - mac80211: allow rx of mesh eapol frames with default rx key
    - scsi: scsi_transport_spi: Fix function pointer check
    - scsi: mpt3sas: Fix unlock imbalance
    - ALSA: hda/hdmi: fix failures at PCM open on Intel ICL and later
    - net: sky2: initialize return of gm_phy_read
    - drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout
    - scsi: mpt3sas: Fix error returns in BRM_status_show
    - scsi: dh: Add Fujitsu device to devinfo and dh lists
    - dm: use bio_uninit instead of bio_disassociate_blkg
    - fuse: fix weird page warning
    - [x86] irqdomain/treewide: Keep firmware node unconditionally allocated
    - SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct
      IO compeletion")
    - exfat: fix overflow issue in exfat_cluster_to_sector()
    - exfat: fix wrong hint_stat initialization in exfat_find_dir_entry()
    - exfat: fix wrong size update of stream entry by typo
    - exfat: fix name_hash computation on big endian systems
    - btrfs: reloc: clear DEAD_RELOC_TREE bit for orphan roots to prevent
      runaway balance
    - uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to
      fix GDB regression
    - ALSA: hda/realtek: Fixed ALC298 sound bug by adding quirk for Samsung
      Notebook Pen S
    - ALSA: info: Drop WARN_ON() from buffer NULL sanity check
    - [x86] ASoC: rt5670: Correct RT5670_LDO_SEL_MASK
    - [x86] ASoC: Intel: cht_bsw_rt5672: Change bus format to I2S 2 channel
    - [s390x] cpum_cf,perf: change DFLT_CCERROR counter name
    - btrfs: fix double free on ulist after backref resolution failure
    - btrfs: fix mount failure caused by race with umount
    - btrfs: fix page leaks after failure to lock page for delalloc
    - mt76: mt76x02: fix handling MCU timeouts during hw restart
    - efi/efivars: Expose RT service availability via efivars abstraction
    - bnxt_en: Fix race when modifying pause settings.
    - bnxt_en: Init ethtool link settings after reading updated PHY
      configuration.
    - bnxt_en: Fix completion ring sizing with TPA enabled.
    - [x86] hippi: Fix a size used in a 'pci_free_consistent()' in an error
      handling path
    - netfilter: nf_tables: fix nat hook table deletion
    - [arm64] dpaa2-eth: check fsl_mc_get_endpoint for IS_ERR_OR_NULL()
    - vsock/virtio: annotate 'the_virtio_vsock' RCU pointer
    - ax88172a: fix ax88172a_unbind() failures
    - RDMA/mlx5: Use xa_lock_irq when access to SRQ table
    - RDMA/core: Fix race in rdma_alloc_commit_uobject()
    - RDMA/cm: Protect access to remote_sidr_table
    - [armhf] net: fec: fix hardware time stamping by external devices
    - [x86] ASoC: Intel: bytcht_es8316: Add missed put_device()
    - ieee802154: fix one possible memleak in adf7242_probe
    - [arm64,armhf] drm: sun4i: hdmi: Fix inverted HPD result
    - [arm64,armhf] net: smc91x: Fix possible memory leak in smc_drv_probe()
    - [arm64,armhf] net: dsa: mv88e6xxx: fix in-band AN link establishment
    - [arm64] dts: clearfog-gt-8k: fix switch link configuration
    - bonding: check error value of register_netdevice() immediately
    - iwlwifi: Make some Killer Wireless-AC 1550 cards work again
    - [arm64] net: bcmgenet: fix error returns in bcmgenet_probe()
    - RDMA/mlx5: Prevent prefetch from racing with implicit destruction
    - [arm64] net: hns3: fix for not calculating TX BD send size correctly
    - [arm64] net: hns3: fix error handling for desc filling
    - [arm64] net: hns3: fix return value error when query MAC link status
      fail
    - qed: suppress "don't support RoCE & iWARP" flooding on HW init
    - qed: suppress false-positives interrupt error messages on HW init
    - ipvs: fix the connection sync failed in some cases
    - [arm64] iommu/qcom: Use domain rather than dev as tlb cookie
    - Revert "PCI/PM: Assume ports without DLL Link Active train links in 100
      ms"
    - nfsd4: fix NULL dereference in nfsd/clients display code
    - bonding: check return value of register_netdevice() in bond_newlink()
    - geneve: fix an uninitialized value in geneve_changelink()
    - serial: exar: Fix GPIO configuration for Sealevel cards based on
      XR17V35X
    - scripts/decode_stacktrace: strip basepath from all paths
    - scripts/gdb: fix lx-symbols 'gdb.error' while loading modules
    - [riscv64] Do not rely on initrd_start/end computed during early dt
      parsing
    - kbuild: fix single target builds for external modules
    - [arm64,x86] HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor
      override
    - HID: alps: support devices with report id 2
    - HID: steam: fixes race in handling device list.
    - dmaengine: idxd: fix hw descriptor fields for delta record
    - HID: apple: Disable Fn-key key-re-mapping on clone keyboards
    - [arm64] dmaengine: tegra210-adma: Fix runtime PM imbalance on error
    - [arm64,armhf] soc: amlogic: meson-gx-socinfo: Fix S905X3 and S905D3 ID's
    - Input: add `SW_MACHINE_COVER`
    - [armhf] dts: n900: remove mmc1 card detect gpio
    - regmap: dev_get_regmap_match(): fix string comparison
    - hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow
    - [amd64] dmaengine: ioat setting ioat timeout as module parameter
    - Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen
    - Input: elan_i2c - only increment wakeup count on touch
    - [arm64] usb: dwc3: pci: add support for the Intel Tiger Lake PCH -H
      variant
    - [arm64] usb: dwc3: pci: add support for the Intel Jasper Lake
    - drm/amdgpu/gfx10: fix race condition for kiq
    - drm/amdgpu: fix preemption unit test
    - hwmon: (nct6775) Accept PECI Calibration as temperature source for
      NCT6798D
    - [x86] platform: asus-wmi: allow BAT1 battery name
    - ALSA: hda/realtek - fixup for yet another Intel reference board
    - drivers/perf: Fix kernel panic when rmmod PMU modules during perf
      sampling
    - [arm64] Use test_tsk_thread_flag() for checking TIF_SINGLESTEP
    - asm-generic/mmiowb: Allow mmiowb_set_pending() when preemptible()
    - drivers/perf: Prevent forced unbinding of PMU drivers
    - [riscv64] Upgrade smp_mb__after_spinlock() to iorw,iorw
    - [x86] boot: Don't add the EFI stub to targets
    - [arm*] binder: Don't use mmput() from shrinker function.
    - [arm64,armhf] usb: tegra: Fix allocation for the FPCI context
    - usb: xhci: Fix ASM2142/ASM3142 DMA addressing
    - Revert "cifs: Fix the target file was deleted when rename failed."
      (Closes: #966917)
    - iwlwifi: mvm: don't call iwl_mvm_free_inactive_queue() under RCU
    - [arm64] tty: xilinx_uartps: Really fix id assignment
    - [x86] staging: wlan-ng: properly check endpoint types
    - [x86] staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG
      shift
    - [x86] staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support
    - [x86] staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG
      shift
    - [x86] staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG
      shift
    - [arm64,armhf] serial: tegra: fix CREAD handling for PIO
    - serial: 8250: fix null-ptr-deref in serial8250_start_tx()
    - /dev/mem: Add missing memory barriers for devmem_inode
    - fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
    - vt: Reject zero-sized screen buffer size.
    - mm/mmap.c: close race between munmap() and expand_upwards()/downwards()
    - vfs/xattr: mm/shmem: kernfs: release simple xattr entry in a right way
    - mm/memcg: fix refcount error while moving and swapping
    - mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
    - mm/hugetlb: avoid hardcoding while checking if cma is enabled
    - khugepaged: fix null-pointer dereference due to race
    - io-mapping: indicate mapping failure
    - [armhf] mmc: sdhci-of-aspeed: Fix clock divider calculation
    - drm/amdgpu: Fix NULL dereference in dpm sysfs handlers
    - [x86] vmlinux.lds: Page-align end of ..page_aligned sections
    - [x86] ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on
      the Lenovo Miix 2 10
    - [x86] ASoC: topology: fix kernel oops on route addition error
    - [x86] ASoC: topology: fix tlvs in error handling for widget_dmixer
    - [x86] ASoC: Intel: bdw-rt5677: fix non BE conversion
    - dm integrity: fix integrity recalculation that is improperly skipped
    - ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
    - ath9k: Fix regression with Atheros 9271
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.12
    - AX.25: Fix out-of-bounds read in ax25_connect()
    - AX.25: Prevent out-of-bounds read in ax25_sendmsg()
    - dev: Defer free of skbs in flush_backlog
    - ip6_gre: fix null-ptr-deref in ip6gre_init_net()
    - net-sysfs: add a newline when printing 'tx_timeout' by sysfs
    - net: udp: Fix wrong clean up for IS_UDPLITE macro
    - rtnetlink: Fix memory(net_device) leak when ->newlink fails
    - rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA
    - tcp: allow at most one TLP probe per flight
    - AX.25: Prevent integer overflows in connect and sendmsg
    - sctp: shrink stream outq only when new outcnt < old outcnt
    - sctp: shrink stream outq when fails to do addstream reconf
    - udp: Copy has_conns in reuseport_grow().
    - udp: Improve load balancing for SO_REUSEPORT.
    - tipc: allow to build NACK message in link timeout function
    - io_uring: ensure double poll additions work with both request types
    - regmap: debugfs: check count when read regmap file
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.13
    - sunrpc: check that domain table is empty at module unload.
    - PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge
    - ALSA: usb-audio: Add implicit feedback quirk for SSL2
    - ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502)
      series with ALC289
    - ALSA: hda/realtek: typo_fix: enable headset mic of ASUS ROG Zephyrus
      G14(GA401) series with ALC289
    - ALSA: hda/realtek: Fix add a "ultra_low_power" function for intel
      reference board (alc256)
    - ALSA: hda/realtek - Fixed HP right speaker no sound
    - ALSA: hda: Workaround for spurious wakeups on some Intel platforms
    - ALSA: hda/hdmi: Fix keep_power assignment for non-component devices
    - RDMA/mlx5: Fix prefetch memory leak if get_prefetchable_mr fails
    - [amd64] IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE
    - vhost/scsi: fix up req type endian-ness
    - 9p/trans_fd: Fix concurrency del of req_list in
      p9_fd_cancelled/p9_read_work
    - revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules
      present") (Closes: #966822)
    - [armel,armhf] 8986/1: hw_breakpoint: Don't invoke overflow handler on
      uaccess watchpoints
    - [armhf] 8987/1: VDSO: Fix incorrect clock_gettime64
    - [armhf] dts: imx6sx-sabreauto: Fix the phy-mode on fec2
    - virtio_balloon: fix up endian-ness for free cmd id
    - Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers"
    - drm/amd/display: Clear dm_state for fast updates (Closes: #963868)
    - drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
    - drm/dbi: Fix SPI Type 1 (9-bit) transfer
    - drm: hold gem reference until object is no longer accessed
    - drm: of: Fix double-free bug
    - rds: Prevent kernel-infoleak in rds_notify_queue_get()
    - xfrm: policy: match with both mark and mask on user interfaces
    - [arm64] pinctrl: qcom: Handle broken/missing PDC dual edge IRQs on
      sc7180
    - espintcp: recv() should return 0 when the peer socket is closed
    - xfrm: Fix crash when the hold queue is used.
    - [arm64] net: hns3: fix desc filling bug when skb is expanded or lineared
    - [arm64] net: hns3: fix a TX timeout issue
    - [arm64] net: hns3: add reset check for VF updating port based VLAN
    - [arm64] net: hns3: fix aRFS FD rules leftover after add a user FD rule
    - [arm64] net: hns3: fix for VLAN config when reset failed
    - net/mlx5: E-switch, Destroy TSAR when fail to enable the mode
    - net/mlx5: E-switch, Destroy TSAR after reload interface
    - net/mlx5e: Fix error path of device attach
    - net/mlx5: Fix a bug of using ptp channel index as pin index
    - net/mlx5: Verify Hardware supports requested ptp function on a given pin
    - net/mlx5: Query PPS pin operational status before registering it
    - net/mlx5e: Modify uplink state on interface up/down
    - net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev
    - net: lan78xx: add missing endpoint sanity check
    - net: lan78xx: fix transfer-buffer memory leak
    - rhashtable: Fix unprotected RCU dereference in __rht_ptr
    - mlx4: disable device on shutdown
    - nvme: add a Identify Namespace Identification Descriptor list quirk
    - bpf: Fix map leak in HASH_OF_MAPS map
    - espintcp: handle short messages instead of breaking the encap socket
    - mac80211: mesh: Free ie data when leaving mesh
    - mac80211: mesh: Free pending skb when destroying a mpath
    - RDMA/core: Stop DIM before destroying CQ
    - RDMA/core: Free DIM memory in error unwind
    - [arm64] alternatives: move length validation inside the subsection
    - [arm64] csum: Fix handling of bad packets
    - Bluetooth: fix kernel oops in store_pending_adv_report
    - net/mlx5e: E-Switch, Add misc bit when misc fields changed for mirroring
    - net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq
    - vxlan: fix memleak of fdb
    - iwlwifi: fix crash in iwl_dbg_tlv_alloc_trigger
    - qed: Disable "MFW indication via attention" SPAM every 5 minutes
    - io_uring: always allow drain/link/hardlink/async sqe flags
    - scsi: core: Run queue in case of I/O resource contention failure
    - [amd64] x86/unwind/orc: Fix ORC for newly forked tasks
    - [x86] stacktrace: Fix reliable check for empty user task stacks
    - cxgb4: add missing release on skb in uld_send()
    - xen-netfront: fix potential deadlock in xennet_remove()
    - [riscv64] Set maximum number of mapped pages correctly
    - [riscv64] Parse all memory blocks to remove unusable memory
    - [arm64] KVM: Don't inherit exec permission across page-table levels
    - [x86] KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is
      hw disabled
    - [x86] KVM: SVM: Fix disable pause loop exit/pause filtering capability
      on SVM
    - [x86] i8259: Use printk_deferred() to prevent deadlock
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.14
    - random32: update the net random state on interrupt and activity
      (CVE-2020-16166)
    - [armel] percpu.h: fix build error
    - [arm64] random: fix circular include dependency on arm64 after addition
      of percpu.h
    - random32: remove net_rand_state from the latent entropy gcc plugin
    - random32: move the pseudo-random 32-bit definitions to prandom.h
    - [arm64] Workaround circular dependency in pointer_auth.h
    - random: random.h should include archrandom.h, not the other way around
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.15
    - scsi: ufs: Fix and simplify setup_xfer_req variant operation
    - USB: serial: qcserial: add EM7305 QDL product ID
    - USB: iowarrior: fix up report size handling for some devices
    - usb: xhci: define IDs for various ASMedia host controllers
    - usb: xhci: Fix ASMedia ASM1142 DMA addressing
    - Revert "ALSA: hda: call runtime_allow() for all hda controllers"
    - ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops
    - ALSA: hda/ca0132 - Add new quirk ID for Recon3D.
    - ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value.
    - ALSA: hda/ca0132 - Fix AE-5 microphone selection commands.
    - ALSA: seq: oss: Serialize ioctls
    - [arm*] staging: android: ashmem: Fix lockdep warning for write operation
    - staging: rtl8712: handle firmware load failure
    - Staging: rtl8188eu: rtw_mlme: Fix uninitialized variable authmode
    - Bluetooth: Fix slab-out-of-bounds read in
      hci_extended_inquiry_result_evt()
    - Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt()
    - Bluetooth: Prevent out-of-bounds read in
      hci_inquiry_result_with_rssi_evt()
    - [arm*] binder: Prevent context manager from incrementing ref 0
    - Smack: fix use-after-free in smk_write_relabel_self()
    - vgacon: Fix for missing check in scrollback handling (CVE-2020-14331)
    - mtd: properly check all write ioctls for permissions
    - [arm64] gpio: max77620: Fix missing release of interrupt
    - bpf: Fix NULL pointer dereference in __btf_resolve_helper_id()
    - net/9p: validate fds in p9_fd_open
    - drm/nouveau/kms/tu102: wait for core update to complete when assigning
      windows
    - drm/nouveau/fbcon: fix module unload when fbcon init has failed for some
      reason
    - drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure
    - io_uring: fix lockup in io_fail_links()
    - nvme-pci: prevent SK hynix PC400 from using Write Zeroes command
    - [arm64] drm/bridge/adv7511: set the bridge type properly
    - [armhf] i2c: slave: improve sanity check when registering
    - [armhf] i2c: slave: add sanity check when unregistering
    - usb: hso: check for return value in hso_serial_common_create()
    - ALSA: hda: fix NULL pointer dereference during suspend
    - firmware: Fix a reference count leak.
    - cfg80211: check vendor command doit pointer before use
    - igb: reinit_locked() should be called with rtnl_lock
    - atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
    - tools lib traceevent: Fix memory leak in process_dynamic_array_len
    - xattr: break delegations in {set,remove}xattr
    - [arm64,armhf] PCI: tegra: Revert tegra124 raw_violation_fixup
    - ipv4: Silence suspicious RCU usage warning
    - ipv6: fix memory leaks on IPV6_ADDRFORM path
    - ipv6: Fix nexthop refcnt leak when creating ipv6 route info
    - rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
    - vxlan: Ensure FDB dump is performed under RCU
    - net: lan78xx: replace bogus endpoint lookup
    - rhashtable: Restore RCU marking on rhash_lock_head
    - devlink: ignore -EOPNOTSUPP errors on dumpit
    - appletalk: Fix atalk_proc_init() return path
    - [arm64] dpaa2-eth: Fix passing zero to 'PTR_ERR' warning
    - [x86] hv_netvsc: do not use VF device if link is down
    - net: bridge: clear bridge's private skb space on xmit
    - net: gre: recompute gre csum for sctp over gre tunnels
    - net: macb: Properly handle phylink on at91sam9x
    - [arm64,armhf] net: mvpp2: fix memory leak in mvpp2_rx
    - net/sched: act_ct: fix miss set mru for ovs after defrag in act_ct
    - [arm64] net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task()
    - openvswitch: Prevent kernel-infoleak in ovs_ct_put_key()
    - Revert "vxlan: fix tos value before xmit"
    - tcp: apply a floor of 1 for RTT samples from TCP timestamps
    - [arm64] kaslr: Use standard early random function
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.16
    - tracepoint: Mark __tracepoint_string's __used
    - io_uring: abstract out task work running
    - HID: input: Fix devices that return multiple bytes in battery report
    - [x86] mce/inject: Fix a wrong assignment of i_mce.status
    - [x86] perf/x86/intel/uncore: Fix oops when counting IMC uncore events on
      some TGL
    - [x86] sched: Bail out of frequency invariance if turbo frequency is
      unknown
    - [x86] sched: Bail out of frequency invariance if turbo_freq/base_freq
      gives 0
    - sched/fair: Fix NOHZ next idle balance
    - sched: correct SD_flags returned by tl->sd_flags()
    - EDAC: Fix reference count leaks
    - crc-t10dif: Fix potential crypto notify dead-lock
    - blktrace: fix debugfs use after free (CVE-2019-19770)
    - [armhf] exynos: MCPM: Restore big.LITTLE cpuidle support
    - rcu/tree: Repeat the monitor if any free channel is busy
    - sched/uclamp: Fix initialization of struct uclamp_rq
    - [x86] crypto: qat - allow xts requests not multiple of block
    - [x86] platform/x86: intel-hid: Fix return value check in
      check_acpi_dev()
    - [x86] platform/x86: intel-vbtn: Fix return value check in
      check_acpi_dev()
    - tpm: Require that all digests are present in TCG_PCR_EVENT2 structures
    - recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64.
    - regulator: fix memory leak on error path of regulator_register()
    - io_uring: fix sq array offset calculation
    - [arm64] dts: meson: fix mmc0 tuning error on Khadas VIM3
    - [arm64,armhf] spi: rockchip: Fix error in SPI slave pio read
    - seccomp: Fix ioctl number for SECCOMP_IOCTL_NOTIF_ID_VALID
    - md: raid0/linear: fix dereference before null check on pointer mddev
    - [mips64el,mipsel] irqchip/loongson-liointc: Fix potential dead lock
    - [arm64,armhf] irqchip/gic-v4.1: Use GFP_ATOMIC flag in
      allocate_vpe_l1_table()
    - nvme-tcp: fix controller reset hang during traffic
    - nvme-rdma: fix controller reset hang during traffic
    - nvme-multipath: fix logic for non-optimized paths
    - nvme-multipath: do not fall back to __nvme_find_path() for non-optimized
      paths
    - block: don't do revalidate zones on invalid devices
    - [armhf] drm/tilcdc: fix leak & null ref in panel_connector_get_modes
    - [armhf] exynos: clear L310_AUX_CTRL_FULL_LINE_ZERO in default
      l2c_aux_val
    - Bluetooth: add a mutex lock to avoid UAF in do_enale_set
    - loop: be paranoid on exit and prevent new additions / removals
    - io_uring: fix req->work corruption
    - fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls
    - drm/amdgpu: avoid dereferencing a NULL pointer
    - drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync
    - video: fbdev: savage: fix memory leak on error handling path in probe
    - video: fbdev: neofb: fix memory leak in neo_scan_monitor()
    - [armhf] bus: ti-sysc: Add missing quirk flags for usb_host_hs
    - md-cluster: fix wild pointer of unlock_all_bitmaps()
    - drm/nouveau/kms/nv50-: Fix disabling dithering
    - [arm64] dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT
      binding
    - [armhf] drm/etnaviv: fix ref count leak via pm_runtime_get_sync
    - drm/nouveau: fix reference count leak in nouveau_debugfs_strap_peek
    - drm/nouveau: fix multiple instances of reference count leaks
    - btrfs: fix lockdep splat from btrfs_dump_space_info
    - [arm64] drm: msm: a6xx: fix gpu failure after system resume
    - [arm64] drm/msm: Fix a null pointer access in msm_gem_shrinker_count()
    - drm/debugfs: fix plain echo to connector "force" attribute
    - drm/radeon: disable AGP by default
    - net: phy: mscc: restore the base page in vsc8514/8584_config_init
    - mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls
    - bpf: Fix fds_example SIGSEGV error
    - Bluetooth: hci_qca: Bug fixes for SSR
    - brcmfmac: keep SDIO watchdog running when console_interval is non-zero
    - brcmfmac: To fix Bss Info flag definition Bug
    - brcmfmac: set state of hanger slot to FREE when flushing PSQ
    - [x86] platform/x86: asus-nb-wmi: add support for ASUS ROG Zephyrus G14
      and G15
    - iwlegacy: Check the return value of pcie_capability_read_*()
    - [arm64,armhf] gpu: host1x: debug: Fix multiple channels emitting
      messages simultaneously
    - [x86] uaccess: Make __get_user_size() Clang compliant on 32-bit
    - mmc: sdhci-pci-o2micro: Bug fix for O2 host controller Seabird1
    - usb: gadget: net2280: fix memory leak on probe error handling paths
    - dyndbg: fix a BUG_ON in ddebug_describe_flags
    - bcache: fix super block seq numbers comparision in register_cache_set()
    - btrfs: allow btrfs_truncate_block() to fallback to nocow for data space
      reservation
    - btrfs: qgroup: free per-trans reserved space when a subvolume gets
      dropped
    - [arm64,x86] ACPICA: Do not increment operation_region reference counts
      for field units
    - io_uring: fix racy overflow count reporting
    - io_uring: fix stalled deferred requests
    - [arm64] crypto: caam - silence .setkey in case of bad key length
    - [arm64] drm/msm: ratelimit crtc event overflow error
    - drm/gem: Fix a leak in drm_gem_objects_lookup()
    - drm/amdgpu: use the unlocked drm_gem_object_put
    - [x86] agp/intel: Fix a memory leak on module initialisation failure
    - btmrvl: Fix firmware filename for sd8977 chipset
    - btmrvl: Fix firmware filename for sd8997 chipset
    - Bluetooth: hci_qca: Fix an error pointer dereference
    - Bluetooth: hci_qca: Only remove TX clock vote after TX is completed
    - Bluetooth: Allow suspend even when preparation has failed
    - ath10k: Acquire tx_lock in tx error paths
    - Bluetooth: hci_qca: Bug fix during SSR timeout
    - Bluetooth: hci_qca: Increase SoC idle timeout to 200ms
    - iio: improve IIO_CONCENTRATION channel type description
    - scsi: ufs: Fix imprecise load calculation in devfreq window
    - [armhf] drm/etnaviv: Fix error path on failure to enable bus clk
    - [arm64,armhf] drm/panfrost: Fix inbalance of devfreq record_busy/idle()
    - [arm64] drm/arm: fix unintentional integer overflow on left shift
    - Bluetooth: btusb: fix up firmware download sequence
    - Bluetooth: btmtksdio: fix up firmware download sequence
    - media: marvell-ccic: Add missed v4l2_async_notifier_cleanup()
    - [armhf] media: omap3isp: Add missed v4l2_ctrl_handler_free() for
      preview_init_entities()
    - [arm64] dpaa2-eth: fix condition for number of buffer acquire retries
    - drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline
    - [powerpc*] cxl: Fix kobject memleak
    - tracing: Move pipe reference to trace array instead of current_tracer
    - drm/amdgpu: ensure 0 is returned for success in jpeg_v2_5_wait_for_idle
    - drm/radeon: fix array out-of-bounds read and write issues
    - [arm*] staging: vchiq_arm: Add a matching unregister call
    - iavf: fix error return code in iavf_init_get_resources()
    - iavf: Fix updating statistics
    - RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued()
    - ipvs: allow connection reuse for unconfirmed conntrack
    - media: firewire: Using uninitialized values in node_probe()
    - media: tvp5150: Add missed media_entity_cleanup()
    - xfs: don't eat an EIO/ENOSPC writeback error when scrubbing data fork
    - xfs: fix reflink quota reservation accounting error
    - RDMA/rxe: Skip dgid check in loopback mode
    - PCI: Fix pci_cfg_wait queue locking problem
    - samples: bpf: Fix bpf programs with kprobe/sys_connect event
    - [armhf] drm/stm: repair runtime power management
    - kobject: Avoid premature parent object freeing in kobject_cleanup()
    - leds: core: Flush scheduled work for system suspend
    - [arm64,armhf] drm: panel: simple: Fix bpc for LG LB070WV8 panel
    - [armhf] phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY
    - [arm64] mmc: sdhci-of-arasan: Add missed checks for devm_clk_register()
    - scsi: scsi_debug: Add check for sdebug_max_queue during module init
    - mwifiex: Prevent memory corruption handling keys
    - kernfs: do not call fsnotify() with name without a parent
    - [powerpc*] pseries: remove cede offline state for CPUs
    - [powerpc*] rtas: don't online CPUs for partition suspend
    - [powerpc*] vdso: Fix vdso cpu truncation
    - RDMA/qedr: SRQ's bug fixes
    - RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send
      queue
    - [x86] staging: rtl8192u: fix a dubious looking mask before a shift
    - PCI/ASPM: Add missing newline in sysfs 'policy'
    - go7007: add sanity checking for endpoints
    - [powerpc*] book3s64/pkeys: Use PVR check instead of cpu feature
    - [armhf] drm/imx: fix use after free
    - [armhf] gpu: ipu-v3: Restore RGB32, BGR32
    - USB: serial: iuu_phoenix: fix led-activity helpers
    - usb: core: fix quirks_param_set() writing to a const pointer
    - [armhf] thermal: ti-soc-thermal: Fix reversed condition in
      ti_thermal_expose_sensor()
    - [powerpc*] perf: Fix missing is_sier_aviable() during build
    - [armhf] phy: armada-38x: fix NETA lockup when repeatedly switching
      speeds
    - [x86] ASoC: hdac_hda: fix deadlock after PCM open error
    - [mips64el,mipsel] OCTEON: add missing put_device() call in
      dwc3_octeon_device_init()
    - [x86] thermal: int340x: processor_thermal: fix: update Jasper Lake PCI
      id
    - [arm*] usb: dwc2: Fix error path in gadget registration
    - usb: gadget: f_uac2: fix AC Interface Header Descriptor wTotalLength
    - scsi: megaraid_sas: Clear affinity hint
    - [powerpc] scsi: mesh: Fix panic after host or bus reset
    - [arm64,armhf] net: dsa: mv88e6xxx: MV88E6097 does not support jumbo
      configuration
    - RDMA/core: Fix return error value in _ib_modify_qp() to negative
    - Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth
      controllers
    - Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags
    - Bluetooth: hci_serdev: Only unregister device if it was registered
    - Bluetooth: Fix suspend notifier race
    - Bluetooth: hci_qca: Stop collecting memdump again for command timeout
      during SSR
    - xfs: fix inode allocation block res calculation precedence
    - xfs: clear XFS_DQ_FREEING if we can't lock the dquot buffer to flush
    - RDMA/netlink: Remove CAP_NET_RAW check when dump a raw QP
    - PCI: Release IVRS table in AMD ACS quirk
    - [powerpc*] pseries/hotplug-cpu: Remove double free in error path
    - ASoC: soc-core: Fix regression causing sysfs entries to disappear
    - [s390x] qeth: tolerate pre-filled RX buffer
    - [s390x] qeth: don't process empty bridge port events
    - ice: Clear and free XLT entries on reset
    - ice: Graceful error handling in HW table calloc failure
    - netfilter: nft_meta: fix iifgroup matching
    - rtw88: fix LDPC field for RA info
    - rtw88: fix short GI capability based on current bandwidth
    - rtw88: coex: only skip coex triggered by BT info
    - [arm64,armhf] wl1251: fix always return 0 error
    - net/mlx5: DR, Change push vlan action sequence
    - net/mlx5: Delete extra dump stack that gives nothing
    - ftrace: Fix ftrace_trace_task return value
    - [amd64,arm64] net: ethernet: aquantia: Fix wrong return value
    - liquidio: Fix wrong return value in cn23xx_get_pf_num()
    - [powerpc] net: spider_net: Fix the size used in a 'dma_free_coherent()'
      call
    - gpio: don't use same lockdep class for all devm_gpiochip_add_data users
    - [arm64] net: thunderx: initialize VF's mailbox mutex before first usage
    - dlm: Fix kobject memleak
    - ocfs2: fix unbalanced locking
    - [arm64,armhf] pinctrl-single: fix pcs_parse_pinconf() return value
    - svcrdma: Fix page leak in svc_rdma_recv_read_chunk()
    - nfsd: avoid a NULL dereference in __cld_pipe_upcall()
    - SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()")
    - [amd64] x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task
    - [amd64] crypto: aesni - add compatibility with IAS
    - af_packet: TPACKET_V3: fix fill status rwlock imbalance
    - net: Fix potential memory leak in proto_register()
    - net/nfc/rawsock.c: add CAP_NET_RAW check.
    - net: phy: fix memory leak in device-create error path
    - net: Set fput_needed iff FDPUT_FPUT is set
    - tcp: correct read of TFO keys on big endian systems
    - [x86] vmxnet3: use correct tcp hdr length when packet is encapsulated
    - net: refactor bind_bucket fastreuse into helper
    - net: initialize fastreuse on inet_inherit_port
    - vsock: fix potential null pointer dereference in vsock_poll()
    - net: phy: marvell10g: fix null pointer dereference
    - USB: serial: cp210x: re-enable auto-RTS on open
    - USB: serial: cp210x: enable usb generic throttle/unthrottle
    - ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO
    - ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support
    - ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109
    - ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109
    - ALSA: usb-audio: add quirk for Pioneer DDJ-RB
    - [arm64,x86] tpm: Unify the mismatching TPM space buffer sizes
    - [x86] crypto: qat - fix double free in qat_uclo_create_batch_init_list
    - [x86] crypto: ccp - Fix use of merged scatterlists
    - [arm64] crypto: cpt - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not
      specified
    - tick/nohz: Narrow down noise while setting current task's tick
      dependency
    - bitfield.h: don't compile-time validate _val in FIELD_FIT
    - fs/minix: check return value of sb_getblk()
    - fs/minix: don't allow getting deleted inodes
    - fs/minix: reject too-large maximum file size
    - [x86] kvm: x86: replace kvm_spec_ctrl_test_value with runtime test on
      the host
    - 9p: Fix memory leak in v9fs_mount
    - driver core: Fix probe_count imbalance in really_probe()
    - media: media-request: Fix crash if memory allocation fails
    - drm/ttm/nouveau: don't call tt destroy callback on alloc failure.
    - io_uring: set ctx sq/cq entry count earlier
    - io_uring: use TWA_SIGNAL for task_work uncondtionally
    - io_uring: fail poll arm on queue proc failure
    - NFS: Don't move layouts to plh_return_segs list while in use
    - NFS: Don't return layout segments that are in use
    - cpufreq: Fix locking issues with governors
    - [arm64] cpufreq: dt: fix oops on armada37xx
    - include/asm-generic/vmlinux.lds.h: align ro_after_init
    - [arm64] PM / devfreq: rk3399_dmc: Fix kernel oops when rockchip,pmu is
      absent
    - PM / devfreq: Fix indentaion of devfreq_summary debugfs node
    - spi: spidev: Align buffers for DMA
    - erofs: fix extended inode could cross boundary
    - [arm64] firmware: qcom_scm: Fix legacy convention SCM accessors
    - [x86] irqdomain/treewide: Free firmware node after domain removal
    - xen/balloon: fix accounting in alloc_xenballooned_pages error path
    - xen/balloon: make the balloon wait interruptible
    - [x86] drm/xen-front: Fix misused IS_ERR_OR_NULL checks
    - [s390x] dasd: fix inability to use DASD with DIAG driver
    - [s390x] numa: set node distance to LOCAL_DISTANCE
    - [s390x] gmap: improve THP splitting
    - io_uring: sanitize double poll handling
    - io_uring: Fix NULL pointer dereference in loop_rw_iter()
    - task_work: only grab task signal lock when needed
    - io_uring: add missing REQ_F_COMP_LOCKED for nested requests
    - io_uring: enable lookup of links holding inflight files
    - io_uring: hold 'ctx' reference around task_work queue + execute
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.17
    - smb3: warn on confusing error scenario with sec=krb5
    - genirq/affinity: Make affinity setting if activated opt-in
    - genirq/PM: Always unlock IRQ descriptor in rearm_wake_irq()
    - [arm64,x86] PCI: hotplug: ACPI: Fix context refcounting in
      acpiphp_grab_context()
    - PCI/ATS: Add pci_pri_supported() to check device or associated PF
    - PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken
    - PCI: Add device even if driver attach failed
    - [arm64] PCI: qcom: Define some PARF params needed for ipq8064 SoC
    - [arm64] PCI: qcom: Add support for tx term offset for rev 2.1.0
    - btrfs: allow use of global block reserve for balance item deletion
    - btrfs: free anon block device right after subvolume deletion
    - btrfs: don't allocate anonymous block device for user invisible roots
    - btrfs: ref-verify: fix memory leak in add_block_entry
    - btrfs: only commit the delayed inode when doing a full fsync
    - btrfs: stop incremening log_batch for the log root tree when syncing log
    - btrfs: only commit delayed items at fsync if we are logging a directory
    - btrfs: remove no longer needed use of log_writers for the log root tree
    - btrfs: don't traverse into the seed devices in show_devname
    - btrfs: pass checksum type via BTRFS_IOC_FS_INFO ioctl
    - btrfs: open device without device_list_mutex
    - btrfs: move the chunk_mutex in btrfs_read_chunk_tree
    - btrfs: relocation: review the call sites which can be interrupted by
      signal
    - btrfs: add missing check for nocow and compression inode flags
    - btrfs: avoid possible signal interruption of btrfs_drop_snapshot() on
      relocation tree
    - btrfs: return EROFS for BTRFS_FS_STATE_ERROR cases
    - btrfs: sysfs: use NOFS for device creation
    - btrfs: don't WARN if we abort a transaction with EROFS
    - btrfs: fix race between page release and a fast fsync
    - btrfs: don't show full path of bind mounts in subvol=
    - btrfs: fix messages after changing compression level by remount
    - btrfs: only search for left_info if there is no right_info in
      try_merge_free_space
    - btrfs: inode: fix NULL pointer dereference if inode doesn't need
      compression
    - btrfs: fix memory leaks after failure to lookup checksums during inode
      logging
    - btrfs: trim: fix underflow in trim length to prevent access beyond
      device boundary
    - btrfs: make sure SB_I_VERSION doesn't get unset by remount
    - btrfs: fix return value mixup in btrfs_get_extent
    - [arm64] perf: Correct the event index in sysfs
    - cifs: Fix leak when handling lease break for cached root fid
    - [powerpc*] Allow 4224 bytes of stack expansion for the signal frame
    - [powerpc*] Fix circular dependency between percpu.h and mmu.h
    - [arm64] media: venus: fix multiple encoder crash
    - [arm64] net: ethernet: stmmac: Disable hardware multicast filter
    - [arm64,armhf] net: stmmac: dwmac1000: provide multicast filter fallback
    - [mips64el,mipsel] irqchip/loongson-liointc: Fix misuse of gc->mask_cache
    - [arm64,armhf] irqchip/gic-v4.1: Ensure accessing the correct RD when
      writing INVALLR
    - pidfd: Add missing sock updates for pidfd_getfd()
    - net/compat: Add missing sock updates for SCM_RIGHTS
    - md/raid5: Fix Force reconstruct-write io stuck in degraded raid5
    - bcache: allocate meta data pages as compound pages
    - bcache: fix overflow in offset_to_stripe()
    - mac80211: fix misplaced while instead of if
    - driver core: Avoid binding drivers to dead devices
    - [mips*] CPU#0 is not hotpluggable
    - ext2: fix missing percpu_counter_inc
    - khugepaged: collapse_pte_mapped_thp() flush the right range
    - mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
    - khugepaged: collapse_pte_mapped_thp() protect the pmd lock
    - hugetlbfs: remove call to huge_pte_alloc without i_mmap_rwsem
    - [amd64,arm64] mm/shuffle: don't move pages between zones and don't read
      garbage memmaps
    - ocfs2: change slot number type s16 to u16
    - mm/page_counter.c: fix protection usage propagation
    - cma: don't quit at first error when activating reserved areas
    - mm/memory_hotplug: fix unpaired mem_hotplug_begin/done
    - ftrace: Setup correct FTRACE_FL_REGS flags for module
    - kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler
    - tracing: Use trace_sched_process_free() instead of exit() for pid
      tracing
    - [x86] watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in
      watchdog_info.options
    - [x86] watchdog: f71808e_wdt: remove use of wrong watchdog_info option
    - [x86] watchdog: f71808e_wdt: clear watchdog timeout occurred flag
    - ceph: set sec_context xattr on symlink creation
    - ceph: handle zero-length feature mask in session messages
    - [powerpc*] pseries: Fix 64 bit logical memory block panic
    - dm: don't call report zones for more than the user requested
    - module: Correctly truncate sysfs sections output
    - bootconfig: Fix to find the initargs correctly
    - perf probe: Fix wrong variable warning when the probe point is not found
    - perf probe: Fix memory leakage when the probe point is not found
    - perf intel-pt: Fix FUP packet state
    - perf intel-pt: Fix duplicate branch after CBR
    - gfs2: Never call gfs2_block_zero_range with an open transaction
    - [armhf] drm/imx: imx-ldb: Disable both channels for split mode in
      enc->disable()
    - crypto: algif_aead - Only wake up when ctx->more is zero
    - RDMA/ipoib: Return void from ipoib_ib_dev_stop()
    - RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah()
    - rtc: cpcap: fix range
    - IB/uverbs: Set IOVA on IB MR in uverbs layer
    - sched/uclamp: Protect uclamp fast path code with static key
    - USB: serial: ftdi_sio: make process-packet buffer unsigned
    - USB: serial: ftdi_sio: clean up receive processing
    - crypto: af_alg - Fix regression on empty requests
    - devres: keep both device name and resource name in pretty name
    - RDMA/counter: Only bind user QPs in auto mode
    - RDMA/counter: Allow manually bind QPs with different pids to same
      counter
    - rtw88: pci: disable aspm for platform inter-op with module parameter
    - [arm64,armhf] rtc: pl031: fix set_alarm by adding back call to
      alarm_irq_enable
    - [armhf] gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq
      handlers
    - [armhf] gpu: ipu-v3: image-convert: Wait for all EOFs before completing
      a tile
    - dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue()
    - f2fs: compress: fix to avoid memory leak on cc->cpages
    - [arm64] clk: qcom: clk-alpha-pll: remove unused/incorrect PLL_CAL_VAL
    - iommu/vt-d: Enforce PASID devTLB field mask
    - f2fs: compress: fix to update isize when overwriting compressed file
    - nvme: fix deadlock in disconnect during scan_work and/or ana_work
    - sched/uclamp: Fix a deadlock when enabling uclamp static key
    - nfs: ensure correct writeback errors are returned on close()
    - ubifs: Fix wrong orphan node deletion in ubifs_jnl_update|rename
    - [arm*] clk: bcm2835: Do not use prediv with bcm2711's PLLs
    - scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying
      targetport
    - nfs: nfs_file_write() should check for writeback errors
    - watchdog: initialize device before misc_register
    - md-cluster: Fix potential error pointer dereference in resize_bitmaps()
    - [x86] tsr: Fix tsc frequency enumeration bug on Lightning Mountain SoC
    - [x86] bugs/multihit: Fix mitigation reporting when VMX is not in use
    - Input: sentelic - fix error return when fsp_reg_write fails
    - [x86] drm/vmwgfx: Use correct vmw_legacy_display_unit pointer
    - [x86] drm/vmwgfx: Fix two list_for_each loop exit tests
    - [arm64] net: qcom/emac: add missed clk_disable_unprepare in error path
      of emac_clks_phase1_init
    - nfs: Fix getxattr kernel panic and memory overflow
    - NFS: Fix flexfiles read failover
    - fs/minix: set s_maxbytes correctly
    - fs/minix: fix block limit check for V1 filesystems
    - fs/minix: remove expected error message in block_to_path()
    - fs/ufs: avoid potential u32 multiplication overflow
    - crypto: algif_aead - fix uninitialized ctx->init
    - perf bench mem: Always memset source before memcpy
    - [x86] perf/x86/rapl: Fix missing psys sysfs attributes
    - khugepaged: retract_page_tables() remember to test exit
    - [arm64,armhf] ASoC: tegra: Use device managed resource APIs to get the
      clock
    - [arm64,armhf] ASoC: tegra: Add audio mclk parent configuration
    - [arm64,armhf] ASoC: tegra: Enable audio mclk during
      tegra_asoc_utils_init()
    - [x86] drm/i915/gt: Force the GT reset on shutdown
    - [arm64,armhf] drm/panfrost: Use kvfree() to free bo->sgts
    - drm/dp_mst: Fix the DDC I2C device registration of an MST port
    - drm/amdgpu: fix ordering of psp suspend
    - [armhf] drm/omap: force runtime PM suspend on system suspend
    - drm: Added orientation quirk for ASUS tablet model T103HAF
    - drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
    - drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume

  [ Salvatore Bonaccorso ]
  * Bump ABI to 3

  [ Ben Hutchings ]
  * doc: Disable extension incompatible with Sphinx 3 (fixes FTBFS)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 23 Aug 2020 15:44:14 +0200

linux (5.7.10-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.7
    - block/bio-integrity: don't free 'buf' if bio_integrity_add_page() failed
    - ethtool: Fix check in ethtool_rx_flow_rule_create
    - geneve: allow changing DF behavior after creation
    - [powerpc*] ibmveth: Fix max MTU limit
    - mld: fix memory leak in ipv6_mc_destroy_dev()
    - [arm64,armhf] mvpp2: ethtool rxtx stats fix
    - net: bridge: enfore alignment for ethernet address
    - net: core: reduce recursion limit value
    - net: Do not clear the sock TX queue in sk_set_socket()
    - net: ethtool: add missing string for NETIF_F_GSO_TUNNEL_REMCSUM
    - net: fix memleak in register_netdevice()
    - net: Fix the arp error in some cases
    - net: increment xmit_recursion level in dev_direct_xmit()
    - net: usb: ax88179_178a: fix packet alignment padding
    - openvswitch: take into account de-fragmentation/gso_size in
      execute_check_pkt_len
    - rxrpc: Fix notification call on completion of discarded calls
    - sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket
    - tcp: don't ignore ECN CWR on pure ACK
    - tcp: grow window for OOO packets only for SACK flows
    - tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes
    - ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()
    - net: phy: Check harder for errors in get_phy_id()
    - ip_tunnel: fix use-after-free in ip_tunnel_lookup()
    - bnxt_en: Store the running firmware version code.
    - bnxt_en: Do not enable legacy TX push on older firmware.
    - bnxt_en: Fix statistics counters issue during ifdown with older firmware.
    - bnxt_en: Read VPD info only for PFs
    - net: phylink: fix ethtool -A with attached PHYs
    - net: phylink: ensure manual pause mode configuration takes effect
    - sch_cake: don't try to reallocate or unshare skb unconditionally
    - sch_cake: don't call diffserv parsing code when it is not needed
    - sch_cake: fix a few style nits
    - tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT
    - bpf: tcp: bpf_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT
    - [arm64,riscv64] net: macb: undo operations in case of failure
    - r8169: fix firmware not resetting tp->ocp_base
    - net: ethtool: add missing NETIF_F_GSO_FRAGLIST feature string
    - [arm64,riscv64] net: macb: call pm_runtime_put_sync on failure path
    - net: phy: mscc: avoid skcipher API for single block AES encryption
    - of: of_mdio: Correct loop scanning logic
    - wireguard: device: avoid circular netns references
    - bareudp: Fixed multiproto mode configuration
    - [armhf] net: dsa: bcm_sf2: Fix node reference count
    - net: phy: smsc: fix printing too many logs
    - genetlink: clean up family attributes allocations
    - nvmet: cleanups the loop in nvmet_async_events_process
    - nvmet: fail outstanding host posted AEN req
    - ALSA: usb-audio: Fix potential use-after-free of streams
    - [arm64,armhf] Revert "i2c: tegra: Fix suspending in active runtime PM
      state"
    - btrfs: fix a block group ref counter leak after failure to remove block
      group
    - binder: fix null deref of proc->context
    - [x86] mei: me: disable mei interface on Mehlow server platforms
    - [x86] mei: me: add tiger lake point device ids for H platforms.
    - [armhf] Revert "usb: dwc3: exynos: Add support for Exynos5422 suspend
      clk"
    - [mips*/*-malta,sh4] USB: ohci-sm501: Add missed iounmap() in remove
    - [arm64,armhf] usb: dwc2: Postponed gadget registration to the udc class
      driver
    - usb: add USB_QUIRK_DELAY_INIT for Logitech C922
    - USB: ehci: reopen solution for Synopsys HC bug
    - xhci: Poll for U0 after disabling USB2 LPM
    - [armhf] usb: host: ehci-exynos: Fix error check in exynos_ehci_probe()
    - ALSA: usb-audio: Add implicit feedback quirk for SSL2+.
    - ALSA: usb-audio: add quirk for Denon DCD-1500RE
    - ALSA: usb-audio: Set 48 kHz rate for Rodecaster
    - ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Flight S
    - ALSA: usb-audio: add quirk for Samsung USBC Headset (AKG)
    - ALSA: usb-audio: Fix OOB access of mixer element list
    - scsi: qla2xxx: Keep initiator ports after RSCN
    - [s390x] scsi: zfcp: Fix panic on ERP timeout for previously dismissed ERP
      action
    - cifs: Fix cached_fid refcnt leak in open_shroot
    - cifs/smb3: Fix data inconsistent when punch hole
    - cifs/smb3: Fix data inconsistent when zero file range
    - xhci: Fix incorrect EP_STATE_MASK
    - xhci: Fix enumeration issue when setting max packet size for FS devices.
    - xhci: Return if xHCI doesn't support LPM
    - cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip
    - loop: replace kill_bdev with invalidate_bdev
    - IB/mad: Fix use after free when destroying MAD agent
    - IB/hfi1: Fix module use count flaw due to leftover module put calls
    - [armhf] bus: ti-sysc: Flush posted write on enable and disable
    - [armhf] bus: ti-sysc: Use optional clocks on for enable and wait for
      softreset bit
    - [armhf] bus: ti-sysc: Ignore clockactivity unless specified as a quirk
    - [armhf] bus: ti-sysc: Fix uninitialized framedonetv_irq
    - [armhf] OMAP2+: Fix legacy mode dss_reset
    - xfrm: Fix double ESP trailer insertion in IPsec crypto offload.
    - [armhf] dts: Fix am33xx.dtsi USB ranges length
    - [armhf] dts: Fix am33xx.dtsi ti,sysc-mask wrong softreset flag
    - [x86] resctrl: Support CPUID enumeration of MBM counter width
    - [x86] resctrl: Fix memory bandwidth counter width for AMD
    - efi/tpm: Verify event log header before parsing
    - ASoC: soc-pcm: fix checks for multi-cpu FE dailinks
    - [arm64] ASoC: qcom: common: set correct directions for dailinks
    - [armhf] regualtor: pfuze100: correct sw1a/sw2 on pfuze3000
    - efi/libstub: Fix path separator regression
    - RDMA/siw: Fix pointer-to-int-cast warning in siw_rx_pbl()
    - [armhf] dts: am335x-pocketbeagle: Fix mmc0 Write Protect
    - [armhf] dts: Fix duovero smsc interrupt for suspend
    - dma-direct: re-encrypt memory if dma_direct_alloc_pages() fails
    - dma-direct: check return value when encrypting or decrypting memory
    - [x86] resctrl: Fix a NULL vs IS_ERR() static checker warning in
      rdt_cdp_peer_get()
    - [x86] efi/x86: Setup stack correctly for efi_pe_entry
    - regmap: Fix memory leak from regmap_register_patch
    - devmap: Use bpf_map_area_alloc() for allocating hash buckets
    - bpf: Don't return EINVAL from {get,set}sockopt when optlen > PAGE_SIZE
    - rxrpc: Fix handling of rwind from an ACK packet
    - RDMA/rvt: Fix potential memory leak caused by rvt_alloc_rq
    - RDMA/efa: Set maximum pkeys device attribute
    - RDMA/qedr: Fix KASAN: use-after-free in ucma_event_handler+0x532
    - RDMA/cma: Protect bind_list and listen_list while finding matching cm id
    - RDMA/core: Check that type_attrs is not NULL prior access
    - [arm64,armhf] ASoC: rockchip: Fix a reference count leak.
    - [s390x] qeth: fix error handling for isolation mode cmds
    - RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads()
    - [x86] Revert "KVM: VMX: Micro-optimize vmexit time when not exposing PMU"
    - [x86] iommu/vt-d: Set U/S bit in first level page table by default
    - [x86] iommu/vt-d: Enable PCI ACS for platform opt in hint
    - [x86] iommu/vt-d: Update scalable mode paging structure coherency
    - dma-direct: add missing set_memory_decrypted() for coherent mapping
    - net: qed: fix left elements count calculation
    - net: qed: fix async event callbacks unregistering
    - net: qede: stop adding events on an already destroyed workqueue
    - net: qed: fix NVMe login fails over VFs
    - net: qed: fix excessive QM ILT lines consumption
    - net: qede: fix PTP initialization on recovery
    - net: qede: fix use-after-free on recovery and AER handling
    - net: qed: reset ILT block sizes before recomputing to fix crashes
    - cxgb4: move handling L2T ARP failures to caller
    - cxgb4: move PTP lock and unlock to caller in Tx path
    - [armhf] imx5: add missing put_device() call in imx_suspend_alloc_ocram()
    - scsi: lpfc: Avoid another null dereference in lpfc_sli4_hba_unset()
    - usb: gadget: udc: Potential Oops in error handling code
    - nvme: don't protect ns mutation with ns->head->lock
    - qed: add missing error test for DBG_STATUS_NO_MATCHING_FRAMING_MODE
    - netfilter: ipset: fix unaligned atomic access
    - [arm64] net: bcmgenet: use hardware padding of runt frames
    - io_uring: fix hanging iopoll in case of -EAGAIN
    - [riscv64] clk: sifive: allocate sufficient memory for struct __prci_data
    - [armhf] i2c: fsi: Fix the port number field in status register
    - wireguard: receive: account for napi_gro_receive never returning GRO_DROP
    - [arm64] socionext: account for napi_gro_receive never returning GRO_DROP
    - wil6210: account for napi_gro_receive never returning GRO_DROP
    - i2c: core: check returned size of emulated smbus block read
    - afs: Fix storage of cell names
    - sched/deadline: Initialize ->dl_boosted
    - sched/core: Fix PI boosting between RT and DEADLINE tasks
    - sched/cfs: change initial value of runnable_avg
    - ata/libata: Fix usage of page address by page_address in
      ata_scsi_mode_select_xlat function
    - drm/amd/display: Use kfree() to free rgb_user in
      calculate_user_regamma_ramp()
    - [riscv64] atomic: Fix sign extension for RV64I
    - bcache: check and adjust logical block size for backing devices
    - net: alx: fix race condition in alx_remove
    - [arm64] pinctrl: qcom: spmi-gpio: fix warning about irq chip reusage
    - [arm64,armhf] pinctrl: tegra: Use noirq suspend/resume callbacks
    - [s390x] seccomp: pass syscall arguments via seccomp_data
    - [s390x] ptrace: return -ENOSYS when invalid syscall is supplied
    - [s390x] ptrace: pass invalid syscall numbers to tracing
    - [s390x] ptrace: fix setting syscall number
    - [s390x] vdso: Use $(LD) instead of $(CC) to link vDSO
    - [s390x] vdso: fix vDSO clock_getres()
    - [arm64] sve: Fix build failure when ARM64_SVE=y and SYSCTL=n
    - kbuild: improve cc-option to clean up all temporary files
    - recordmcount: support >64k sections
    - kprobes: Suppress the suspicious RCU warning on kprobes
    - blktrace: break out of blktrace setup on concurrent calls
    - nvdimm/region: always show the 'align' attribute
    - block: update hctx map when use multiple maps
    - [riscv64] Don't allow write+exec only page mapping request in mmap
    - syscalls: Fix offset type of ksys_ftruncate()
    - ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table
    - [x86] ALSA: hda/realtek - Add quirk for MSI GE63 laptop
    - [x86] ALSA: hda/realtek: Add mute LED and micmute LED support for HP
      systems
    - ACPI: sysfs: Fix pm_profile_attr type
    - ACPI: configfs: Disallow loading ACPI tables when locked down
      (CVE-2020-15780)
    - erofs: fix partially uninitialized misuse in z_erofs_onlinepage_fixup
    - [x86] KVM: X86: Fix MSR range of APIC registers in X2APIC mode
    - [x86] kvm: lapic: fix broken vcpu hotplug
    - [x86] KVM: nVMX: Plumb L2 GPA through to PML emulation
    - [x86] KVM: VMX: Stop context switching MSR_IA32_UMWAIT_CONTROL
    - [x86] cpu: Use pinning mask for CR4 bits needing to be 0
    - [x86] cpu: Reinitialize IA32_FEAT_CTL MSR on BSP during wakeup
    - [amd64] asm/64: Align start of __clear_user() loop to 16-bytes
    - btrfs: fix bytes_may_use underflow when running balance and scrub in
      parallel
    - btrfs: fix data block group relocation failure due to concurrent scrub
    - btrfs: check if a log root exists before locking the log_mutex on unlink
    - btrfs: fix hang on snapshot creation after RWF_NOWAIT write
    - btrfs: fix failure of RWF_NOWAIT write into prealloc extent beyond eof
    - btrfs: fix RWF_NOWAIT write not failling when we need to cow
    - mm, compaction: make capture control handling safe wrt interrupts
    - mm, slab: fix sign conversion problem in memcg_uncharge_slab()
    - mm/slab: use memzero_explicit() in kzfree()
    - ocfs2: avoid inode removal while nfsd is accessing it
    - ocfs2: load global_inode_alloc
    - ocfs2: fix value of OCFS2_INVALID_SLOT
    - ocfs2: fix panic on nfs server over ocfs2
    - mm: memcontrol: handle div0 crash race condition in memory.low
    - mm/memcontrol.c: add missed css_put()
    - mm/memory_hotplug.c: fix false softlockup during pfn range removal
    - [arm64] perf: Report the PC value in REGS_ABI_32 mode
    - tracing/boottime: Fix kprobe multiple events
    - tracing: Fix event trigger to accept redundant spaces
    - ring-buffer: Zero out time extend if it is nested and not absolute
    - drm/amd/display: Enable output_bpc property on all outputs
    - drm/amd: fix potential memleak in err branch
    - drm/radeon: fix fb_div check in ni_init_smc_spll_table()
    - drm/fb-helper: Fix vt restore
    - drm/amdgpu: add fw release for sdma v5_0
    - drm/amdgpu/display: Unlock mutex on error
    - drm/panel-simple: fix connector type for newhaven_nhd_43_480272ef_atxl
    - drm/panel-simple: fix connector type for LogicPD Type28 Display
    - [armhf] dts: imx6ul-kontron: Move watchdog from Kontron i.MX6UL/ULL board
      to SoM
    - [armhf] dts: imx6ul-kontron: Change WDOG_ANY signal from push-pull to
      open-drain
    - [x86,arm64] Staging: rtl8723bs: prevent buffer overflow in
      update_sta_support_rate()
    - sunrpc: fixed rollback in rpc_gssd_dummy_populate()
    - SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
    - pNFS/flexfiles: Fix list corruption if the mirror count changes
    - NFSv4 fix CLOSE not waiting for direct IO compeletion
    - [x86] EDAC/amd64: Read back the scrub rate PCI register on F15h
    - xprtrdma: Fix handling of RDMA_ERROR replies
    - dm writecache: correct uncommitted_block when discarding uncommitted entry
    - dm writecache: add cond_resched to loop in persistent_memory_claim()
    - Revert "tty: hvc: Fix data abort due to race in hvc_open"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.8
    - exfat: Set the unused characters of FileName field to the value 0000h
    - exfat: add missing brelse() calls on error paths
    - exfat: call sync_filesystem for read-only remount
    - exfat: move setting VOL_DIRTY over exfat_remove_entries()
    - exfat: flush dirty metadata in fsync
    - btrfs: block-group: refactor how we delete one block group item
    - btrfs: fix race between block group removal and block group creation
    - mm: fix swap cache node allocation mask
    - drm/amd/display: Fix incorrectly pruned modes with deep color
    - drm/amd/display: Fix ineffective setting of max bpc property
    - seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds
    - tipc: add test for Nagle algorithm effectiveness
    - tipc: fix kernel WARNING in tipc_msg_append()
    - usbnet: smsc95xx: Fix use-after-free after removal
    - tipc: Fix NULL pointer dereference in __tipc_sendstream()
    - [x86] drm/i915/gt: Mark timeline->cacheline as destroyed after rcu grace
      period
    - drm/amdgpu: disable ras query and iject during gpu reset
    - drm/amdgpu: fix non-pointer dereference for non-RAS supported
    - drm/amdgpu: fix kernel page fault issue by ras recovery on sGPU
    - sched/debug: Make sd->flags sysctl read-only
    - soc: ti: omap-prm: use atomic iopoll instead of sleeping one
    - [powerpc*] kvm/book3s: Add helper to walk partition scoped linux page
      table.
    - [powerpc*] book3s64/kvm: Fix secondary page table walk warning during
      migration
    - mm/slub.c: fix corrupted freechain in deactivate_slab()
    - mm/slub: fix stack overruns with SLUB_STATS
    - mm, dump_page(): do not crash with invalid mapping pointer
    - io_uring: fix {SQ,IO}POLL with unsupported opcodes
    - rxrpc: Fix race between incoming ACK parser and retransmitter
    - usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect
      (CVE-2020-15393)
    - tools lib traceevent: Add append() function helper for appending strings
    - tools lib traceevent: Handle __attribute__((user)) in field names
    - [s390x] debug: avoid kernel warning on too large number of pages
    - io_uring: fix io_sq_thread no schedule when busy
    - nvme-multipath: set bdi capabilities once
    - nvme: fix possible deadlock when I/O is blocked
    - nvme-multipath: fix deadlock between ana_work and scan_work
    - nvme-multipath: fix deadlock due to head->lock
    - nvme-multipath: fix bogus request queue reference put
    - io_uring: fix current->mm NULL dereference on exit
    - tpm: Fix TIS locality timeout problems
    - crypto: af_alg - fix use-after-free in af_alg_accept() due to
      bh_lock_sock()
    - task_work: teach task_work_add() to do signal_wake_up()
    - io_uring: use signal based task_work running
    - [arm64] drm/msm/dpu: fix error return code in dpu_encoder_init
    - btrfs: fix RWF_NOWAIT writes blocking on extent locks and waiting for IO
    - rxrpc: Fix afs large storage transmission performance drop
    - RDMA/counter: Query a counter before release
    - xfs: fix use-after-free on CIL context on shutdown
    - hsr: remove hsr interface if all slaves are removed
    - hsr: avoid to create proc file after unregister
    - cxgb4: use unaligned conversion for fetching timestamp
    - cxgb4: parse TC-U32 key values and masks natively
    - cxgb4: fix endian conversions for L4 ports in filters
    - cxgb4: use correct type for all-mask IP address comparison
    - cxgb4: fix SGE queue dump destination buffer context
    - security: Fix hook iteration and default value for inode_copy_up_xattr
    - [x86] hwmon: (acpi_power_meter) Fix potential memory leak in
      acpi_power_meter_add()
    - scsi: qla2xxx: Fix a condition in qla2x00_find_all_fabric_devs()
    - nfsd4: fix nfsdfs reference count loop
    - nfsd: fix nfsdfs inode reference count leak
    - [arm64,armhf] drm: sun4i: hdmi: Remove extra HPD polling
    - virtio-blk: free vblk-vqs in error path of virtblk_probe()
    - SMB3: Honor 'posix' flag for multiuser mounts
    - nvme: fix identify error status silent ignore
    - nvme: fix a crash in nvme_mpath_add_disk
    - [sh4] i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665
    - [x86,arm64] i2c: designware: platdrv: Set class based on DMI
    - io_uring: fix regression with always ignoring signals in io_cqring_wait()
    - Revert "ALSA: usb-audio: Improve frames size computation"
    - padata: upgrade smp_mb__after_atomic to smp_mb in padata_do_serial
    - SMB3: Honor 'seal' flag for multiuser mounts
    - SMB3: Honor persistent/resilient handle flags for multiuser mounts
    - SMB3: Honor lease disabling for multiuser mounts
    - SMB3: Honor 'handletimeout' flag for multiuser mounts
    - cifs: Fix the target file was deleted when rename failed.
    - [x86] Drivers: hv: Change flag to write log level in panic msg to false
    - hwmon: (pmbus) Fix page vs. register when accessing fans
    - [x86] ACPI: fan: Fix Tiger Lake ACPI device ID
    - gfs2: fix trans slab error when withdraw occurs inside log_flush
    - [x86] split_lock: Don't write MSR_TEST_CTRL on CPUs that aren't
      whitelisted
    - [mips*] Add missing EHB in mtc0 -> mfc0 sequence for DSPen
    - [x86] drm/i915: Include asm sources for {ivb, hsw}_clear_kernel.c
    - drm/amd/powerplay: Fix NULL dereference in lock_bus() on Vega20 w/o RAS
    - drm/amd/display: Only revalidate bandwidth on medium and fast updates
    - drm/amdgpu: use %u rather than %d for sclk/mclk
    - drm/amdgpu/atomfirmware: fix vram_info fetching for renoir
    - dma-buf: Move dma_buf_release() from fops to dentry_ops
    - [arm64,armhf] irqchip/gic: Atomically update affinity
    - mm/hugetlb.c: fix pages per hugetlb calculation
    - [arm*] mm/cma.c: use exact_nid true to fix possible per-numa cma leak
    - dm zoned: assign max_io_len correctly
    - efi: Make it possible to disable efivar_ssdt entirely
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.9
    - [s389x] KVM: s390: reduce number of IO pins to 1
    - regmap: fix alignment issue
    - [x86] perf/x86/rapl: Move RAPL support to common x86 code
    - [x86] perf/x86/rapl: Fix RAPL config variable bug
    - [armhf] dts: omap4-droid4: Fix spi configuration and increase rate
    - drm/ttm: Fix dma_fence refcnt leak in ttm_bo_vm_fault_reserved
    - drm/ttm: Fix dma_fence refcnt leak when adding move fence
    - [arm64,armhf] gpu: host1x: Clean up debugfs in error handling path
    - [arm64,armhf] drm/tegra: hub: Do not enable orphaned window group
    - [arm64,armhf] gpu: host1x: Detach driver on unregister
    - [x86] ASoC: SOF: Intel: add PCI ID for CometLake-S
    - ASoC: hdac_hda: fix memleak with regmap not freed on remove
    - [x86] ALSA: hda: Intel: add missing PCI IDs for ICL-H, TGL-H and EKL
    - spi: spidev: fix a race between spidev_release and spidev_remove
    - spi: spidev: fix a potential use-after-free in spidev_release()
    - [arm64,armhf] net: ethernet: mvneta: Fix Serdes configuration for SoCs
      without comphy
    - [arm64,armhf] net: ethernet: mvneta: Add 2500BaseX support for SoCs
      without comphy
    - ixgbe: protect ring accesses with READ- and WRITE_ONCE
    - i40e: protect ring accesses with READ- and WRITE_ONCE
    - ice: protect ring accesses with WRITE_ONCE
    - [powerpc*] kvm/book3s64: Fix kernel crash with nested kvm & DEBUG_VIRTUAL
    - xprtrdma: Prevent dereferencing r_xprt->rx_ep after it is freed
    - [x86] iommu/vt-d: Don't apply gfx quirks to untrusted devices
    - [x86] drm: panel-orientation-quirks: Add quirk for Asus T101HA panel
    - [x86] drm: panel-orientation-quirks: Use generic orientation-data for
      Acer S1003
    - [s390x] kasan: fix early pgm check handler execution
    - cifs: update ctime and mtime during truncate
    - [armhf] imx6: add missing put_device() call in imx6q_suspend_init()
    - scsi: qla2xxx: Fix MPI failure AEN (8200) handling
    - scsi: mptscsih: Fix read sense data size
    - [arm64,armhf] usb: dwc3: pci: Fix reference count leak in
      dwc3_pci_resume_work
    - [arm64] kpti: Add KRYO{3, 4}XX silver CPU cores to kpti safelist
    - block: release bip in a right way in error path
    - nvme-rdma: assign completion vector correctly
    - [x86] entry: Increase entry_stack size to a full page
    - [arm64] Add KRYO{3,4}XX silver CPU cores to SSB safelist
    - nfs: Fix memory leak of export_path
    - sched/core: Check cpus_mask, not cpus_ptr in __set_cpus_allowed_ptr(), to
      fix mask corruption
    - mtd: set master partition panic write flag
    - [arm64,armhf] gpio: pca953x: Synchronize interrupt handler properly
    - [arm64,armhf] gpio: pca953x: Fix direction setting when configure an IRQ
    - [arm64] KVM: arm64: vgic-v4: Plug race between non-residency and v4.1
      doorbell
    - mac80211: Fix dropping broadcast packets in 802.11 encap
    - bpf: Do not allow btf_ctx_access with __int128 types
    - nl80211: don't return err unconditionally in nl80211_start_ap()
    - nl80211: fix memory leak when parsing NL80211_ATTR_HE_BSS_COLOR
    - bpf, sockmap: RCU splat with redirect and strparser error or TLS
    - bpf, sockmap: RCU dereferenced psock may be used outside RCU block
    - netfilter: ipset: call ip_set_free() instead of kfree()
    - [arm64,armhf] net: mvneta: fix use of state->speed
    - net: cxgb4: fix return error value in t4_prep_fw
    - btrfs: fix reclaim_size counter leak after stealing from global reserve
    - [arm64] drm/meson: viu: fix setting the OSD burst length in
      VIU_OSD1_FIFO_CTRL_STAT
    - IB/sa: Resolv use-after-free in ib_nl_make_request()
    - netfilter: conntrack: refetch conntrack after nf_conntrack_update()
    - perf report TUI: Fix segmentation fault in perf_evsel__hists_browse()
    - [x86] perf intel-pt: Fix recording PEBS-via-PT with registers
    - [x86] perf intel-pt: Fix PEBS sample for XMM registers
    - smsc95xx: check return value of smsc95xx_reset
    - smsc95xx: avoid memory leak in smsc95xx_bind
    - [arm64] net: hns3: check reset pending after FLR prepare
    - [arm64] net: hns3: fix for mishandle of asserting VF reset fail
    - [arm64] net: hns3: add a missing uninit debugfs when unload driver
    - [arm64] net: hns3: fix use-after-free when doing self test
    - ALSA: compress: fix partial_drain completion state
    - net: qed: fix buffer overflow on ethtool -d
    - [powerpc*] 64s/exception: Fix 0x1500 interrupt handler crash
    - RDMA/siw: Fix reporting vendor_part_id
    - net: atlantic: fix ip dst and ipv6 address filters
    - nbd: Fix memory leak in nbd_add_socket
    - cxgb4: fix all-mask IP address comparison
    - IB/mlx5: Fix 50G per lane indication
    - qed: Populate nvm-file attributes while reading nvm config partition.
    - net/mlx5: Fix eeprom support for SFP module
    - net/mlx5e: Fix VXLAN configuration restore after function reload
    - net/mlx5e: Fix CPU mapping after function reload to avoid aRFS RX crash
    - net/mlx5e: Fix 50G per lane indication
    - net/mlx5e: CT: Fix memory leak in cleanup
    - bnxt_en: fix NULL dereference in case SR-IOV configuration fails
    - [arm64,riscv64] net: macb: fix wakeup test in runtime suspend/resume
      routines
    - [arm64,riscv64] net: macb: mark device wake capable when "magic-packet"
      property present
    - [arm64,riscv64] net: macb: fix macb_get/set_wol() when moving to phylink
    - [arm64,riscv64] net: macb: fix macb_suspend() by removing call to
      netif_carrier_off()
    - [arm64,riscv64] net: macb: fix call to pm_runtime in the suspend/resume
      functions
    - IB/hfi1: Do not destroy hfi1_wq when the device is shut down
    - IB/hfi1: Do not destroy link_wq when the device is shut down
    - [i386,alpha,hppa] ALSA: opl3: fix infoleak in opl3
    - ALSA: hda - let hs_mic be picked ahead of hp_mic
    - ALSA: usb-audio: add quirk for MacroSilicon MS2109
    - ALSA: usb-audio: Add implicit feedback quirk for RTX6001
    - [x86] ALSA: hda/realtek - Fix Lenovo Thinkpad X1 Carbon 7th quirk
      subdevice id
    - ALSA: hda/realtek - Enable audio jacks of Acer vCopperbox with ALC269VC
    - [x86] ALSA: hda/realtek: Enable headset mic of Acer C20-820 with ALC269VC
    - [x86] ALSA: hda/realtek: Enable headset mic of Acer Veriton N4660G with
      ALC269VC
    - [arm64] KVM: arm64: Fix definition of PAGE_HYP_DEVICE
    - [arm64] KVM: arm64: Stop clobbering x0 for HVC_SOFT_RESTART
    - [arm64] KVM: arm64: Annotate hyp NMI-related functions as __always_inline
    - [x86] KVM: x86: bit 8 of non-leaf PDPEs is not reserved
    - [x86] KVM: x86: Inject #GP if guest attempts to toggle CR4.LA57 in 64-bit
      mode
    - [x86] KVM: x86: Mark CR4.TSD as being possibly owned by the guest
    - [arm64] KVM: arm64: Fix kvm_reset_vcpu() return code being incorrect with
      SVE
    - io_uring: fix memleak in __io_sqe_files_update()
    - io_uring: account user memory freed when exit has been queued
    - io_uring: fix memleak in io_sqe_files_register()
    - io_uring: fix missing msg_name assignment
    - kallsyms: Refactor kallsyms_show_value() to take cred
    - module: Refactor section attr into bin attribute
    - module: Do not expose section addresses to non-CAP_SYSLOG
    - kprobes: Do not expose probe addresses to non-CAP_SYSLOG
    - bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok()
    - Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb"
      (Closes: #964153, #964480)
    - btrfs: fix fatal extent_buffer readahead vs releasepage race
    - btrfs: reset tree root pointer after error in init_tree_roots
    - btrfs: discard: add missing put when grabbing block group from unused list
    - btrfs: fix double put of block group with nocow
    - drm/radeon: fix double free
    - [x86] drm/i915/gt: Pin the rings before marking active
    - [x86] drm/i915: Skip stale object handle for debugfs per-file-stats
    - drm/amdgpu: don't do soft recovery if gpu_recovery=0
    - drm/amdgpu: add TMR destory function for psp
    - drm/amdgpu: asd function needs to be unloaded in suspend phase
    - [x86] drm/i915: Drop vm.ref for duplicate vma on construction
    - [x86] drm/i915: Also drop vm.ref along error paths for vma construction
    - cifs: fix reference leak for tlink
    - smb3: fix access denied on change notify request to some servers
    - smb3: fix unneeded error message on change notify
    - dm: use noio when sending kobject event
    - [arm64] mmc: meson-gx: limit segments to 1 when dram-access-quirk is
      needed
    - [x86] pinctrl: baytrail: Fix pin being driven low for a while on
      gpiod_get(..., GPIOD_OUT_HIGH)
    - [s390x] setup: init jump labels before command line parsing
    - [s390x] mm: fix huge pte soft dirty copying
    - [arm64] Introduce a way to disable the 32bit vdso
    - [arm64] arch_timer: Allow an workaround descriptor to disable compat vdso
    - [arm64] arch_timer: Disable the compat vdso for cores affected by
      ARM64_WORKAROUND_1418040
    - blk-mq: consider non-idle request as "inflight" in blk_mq_rq_inflight()
    - dm writecache: reject asynchronous pmem devices
    - perf scripts python: export-to-postgresql.py: Fix struct.pack() int
      argument
    - perf scripts python: exported-sql-viewer.py: Fix zero id in call graph
      'Find' result
    - perf scripts python: exported-sql-viewer.py: Fix zero id in call tree
      'Find' result
    - perf scripts python: exported-sql-viewer.py: Fix unexpanded 'Find' result
    - perf scripts python: exported-sql-viewer.py: Fix time chart call tree
    - [s390x] Change s390_kernel_write() return type to match memcpy()
    - [s390x] maccess: add no DAT mode to kernel_write
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.10
    - bridge: mcast: Fix MLD2 Report IPv6 payload length check
    - genetlink: remove genl_bind
    - ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
    - ipv6: fib6_select_path can not use out path for nexthop objects
    - ipv6: Fix use of anycast address with loopback
    - l2tp: remove skb_dst_set() from l2tp_xmit_skb()
    - llc: make sure applications use ARPHRD_ETHER
    - net: Added pointer check for dst->ops->neigh_lookup in
      dst_neigh_lookup_skb
    - net_sched: fix a memory leak in atm_tc_init()
    - net: usb: qmi_wwan: add support for Quectel EG95 LTE modem
    - sched: consistently handle layer3 header accesses in the presence of
      VLANs
    - tcp: fix SO_RCVLOWAT possible hangs under high mem pressure
    - tcp: make sure listeners don't initialize congestion-control state
    - tcp: md5: add missing memory barriers in tcp_md5_do_add()/
      tcp_md5_hash_key()
    - tcp: md5: do not send silly options in SYNCOOKIES
    - vlan: consolidate VLAN parsing code and limit max parsing depth
    - tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers
    - tcp: md5: allow changing MD5 keys in all socket states
    - cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
    - cgroup: Fix sock_cgroup_data on big-endian.
    - ip: Fix SO_MARK in RST, ACK and ICMP packets
    - genetlink: get rid of family->attrbuf
    - net: ipv4: Fix wrong type conversion from hint to rt in
      ip_route_use_hint()
    - ethtool: fix genlmsg_put() failure handling in ethnl_default_dumpit()
    - [arm64] drm/msm: fix potential memleak in error branch
    - [arm64] drm/msm/dpu: allow initialization of encoder locks during encoder
      init
    - [armhf] drm/exynos: Properly propagate return value in
      drm_iommu_attach_device()
    - [armhf] drm/exynos: fix ref count leak in mic_pre_enable
    - [x86] fpu: Reset MXCSR to default in kernel_fpu_begin()
    - [armhf] thermal/drivers: imx: Fix missing of_node_put() at probe time
    - [x86] ACPI: DPTF: Add battery participant for TigerLake
    - blk-mq-debugfs: update blk_queue_flag_name[] accordingly for new flags
    - [m68k] mm: fix node memblock init
    - cifs: prevent truncation from long to int in wait_for_free_credits
    - [arm64] alternatives: use subsections for replacement sequences
    - tpm_tis: extra chip->ops check on error path in tpm_tis_core_init
    - xen/xenbus: avoid large structs and arrays on the stack
    - xen/xenbus: let xenbus_map_ring_valloc() return errno values only
    - gfs2: eliminate GIF_ORDERED in favor of list_empty
    - gfs2: freeze should work on read-only mounts
    - gfs2: read-only mounts should grab the sd_freeze_gl glock
    - gfs2: When freezing gfs2, use GL_EXACT and not GL_NOCACHE
    - gfs2: The freeze glock should never be frozen
    - [arm64] Add MIDR value for KRYO4XX gold CPU cores
    - [arm64] Add KRYO4XX gold CPU cores to erratum list 1463225 and 1418040
    - [arm64] Add KRYO4XX silver CPU cores to erratum list 1530923 and 1024718
    - [i386,mips*/boston] i2c: eg20t: Load module automatically if ID matches
    - [arm64] alternatives: don't patch up internal branches
    - iio: core: add missing IIO_MOD_H2/ETHANOL string identifiers
    - [armhf] iio: mma8452: Add missed iio_device_unregister() call in
      mma8452_probe()
    - [arm64] Add missing sentinel to erratum_1463225
    - xen/xenbus: Fix a double free in xenbus_map_ring_pv()
    - [arm64,armhf] net: ethernet: mvneta: Do not error out in non serdes modes
    - [arm64,armhf] net: ethernet: mvneta: Add back interface mode validation
    - scsi: qla2xxx: make 1-bit bit-fields unsigned int
    - io_uring: fix recvmsg memory leak with buffer selection
    - [arm64,armhf] phy: rockchip: Fix return value of inno_dsidphy_probe()
    - [arm64,armhf] phy: sun4i-usb: fix dereference of pointer phy0 before it
      is null checked
    - [arm64] dts: meson: add missing gxl rng clock
    - [arm64] dts: meson-gxl-s805x: reduce initial Mali450 core frequency
    - [armhf] bus: ti-sysc: Fix wakeirq sleeping function called from invalid
      context
    - [armhf] bus: ti-sysc: Fix sleeping function called from invalid context
      for RTC quirk
    - [armhf] bus: ti-sysc: Do not disable on suspend for no-idle
    - [x86] dmaengine: dw: Initialize channel before each transfer
    - [armhf] spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock
      rate
    - [x86] staging: comedi: verify array index is correct before using it
    - serial: core: Initialise spin lock before use in uart_configure_port()
    - [arm64,armhf] clk: mvebu: ARMADA_AP_CPU_CLK needs to select
      ARMADA_AP_CP_HELPER
    - [armhf] clk: AST2600: Add mux for EMMC clock
    - xprtrdma: Fix double-free in rpcrdma_ep_create()
    - xprtrdma: Fix recursion into rpcrdma_xprt_disconnect()
    - xprtrdma: Fix return code from rpcrdma_xprt_connect()
    - xprtrdma: Fix handling of connect errors
    - NFS: Fix interrupted slots by sending a solo SEQUENCE operation
    - fuse: don't ignore errors from fuse_writepages_fill()
    - xprtrdma: fix incorrect header size calculations
    - [armhf] dts: socfpga: Align L2 cache-controller nodename with dtschema
    - keys: asymmetric: fix error return code in software_key_query()
    - nvme: explicitly update mpath disk capacity on revalidation
    - regmap: debugfs: Don't sleep while atomic for fast_io regmaps
    - copy_xstate_to_kernel: Fix typo which caused GDB regression
    - apparmor: ensure that dfa state tables have entries
    - RDMA/rxe: Set default vendor ID
    - PCI/PM: Call .bridge_d3() hook only if non-NULL
    - perf stat: Zero all the 'ena' and 'run' array slot stats for interval
      mode
    - RDMA/mlx5: Verify that QP is created with RQ or SQ
    - [arm64] clk: qcom: Add missing msm8998 ufs_unipro_core_clk_src
    - mtd: spi-nor: winbond: Fix 4-byte opcode support for w25q256
    - mtd: spi-nor: spansion: fix writes on S25FS512S
    - [armhf] mtd: rawnand: marvell: Fix the condition on a return code
    - [armhf] mtd: rawnand: marvell: Use nand_cleanup() when the device is not
      yet registered
    - [armhf] mtd: rawnand: marvell: Fix probe error path
    - mtd: rawnand: timings: Fix default tR_max and tCCS_min timings
    - [arm64] clk: qcom: gcc: Add GPU and NPU clocks for SM8150
    - [arm64] clk: qcom: gcc: Add missing UFS clocks for SM8150
    - [arm64] clk: qcom: gcc: Add support for a new frequency for SC7180
    - HID: logitech-hidpp: avoid repeated "multiplier = " log messages
    - HID: magicmouse: do not set up autorepeat
    - HID: quirks: Always poll Obins Anne Pro 2 keyboard
    - HID: quirks: Ignore Simply Automated UPB PIM
    - ALSA: line6: Perform sanity check for each URB creation
    - ALSA: line6: Sync the pending work cancel at disconnection
    - ALSA: usb-audio: Fix race against the error recovery URB submission
    - [x86] ALSA: hda/realtek - change to suitable link model for ASUS platform
    - [x86] ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus
      G14(G401) series with ALC289
    - [x86] ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31
      with ALC256
    - [x86] ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534
    - [x86] ALSA: hda/realtek - Enable Speaker for ASUS UX563
    - [x86] thunderbolt: Fix path indices used in USB3 tunnel discovery
    - [arm64,armhf] usb: dwc2: Fix shutdown callback in platform
    - [arm64,armh] usb: chipidea: core: add wakeup support for extcon
    - usb: gadget: function: fix missing spinlock in f_uac1_legacy
    - USB: serial: iuu_phoenix: fix memory corruption
    - USB: serial: cypress_m8: enable Simply Automated UPB PIM
    - USB: serial: ch341: add new Product ID for CH340
    - USB: serial: option: add GosunCn GM500 series
    - USB: serial: option: add Quectel EG95 LTE modem
    - [x86] virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers
      to match upstream
    - [x86] virt: vbox: Fix guest capabilities mask check
    - [arm64] Revert "tty: xilinx_uartps: Fix missing id assignment to the
      console"
    - virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc
      serial
    - [sh4] serial: sh-sci: Initialize spinlock for uart console
    - Revert "serial: core: Refactor uart_unlock_and_check_sysrq()"
    - serial: core: fix sysrq overhead regression
    - ovl: fix regression with re-formatted lower squashfs
    - ovl: inode reference leak in ovl_is_inuse true case.
    - ovl: relax WARN_ON() when decoding lower directory file handle
    - ovl: fix unneeded call to ovl_change_flags()
    - fuse: ignore 'data' argument of mount(..., MS_REMOUNT)
    - fuse: use ->reconfigure() instead of ->remount_fs()
    - fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS
    - Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()"
      (CVE-2020-10781)
    - [x86] mei: bus: don't clean driver pointer
    - [arm64] Revert "Input: elants_i2c - report resolution information for
      touch major"
    - [x86] Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list
    - [x86] Input: elan_i2c - add more hardware ID for Lenovo laptops
    - scsi: megaraid_sas: Remove undefined ENABLE_IRQ_POLL macro
    - timer: Prevent base->clk from moving backward
    - timer: Fix wheel index calculation on last level
    - [riscv64] use 16KB kernel stack on 64-bit
    - hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
    - hwmon: (drivetemp) Avoid SCT usage on Toshiba DT01ACA family drives
    - [powerpc*] book3s64/pkeys: Fix pkey_access_permitted() for execute
      disable pkey
    - [powerpc*] pseries/svm: Fix incorrect check for shared_lppaca_size
    - [x86] intel_th: pci: Add Jasper Lake CPU support
    - [x86] intel_th: pci: Add Tiger Lake PCH-H support
    - [x86] intel_th: pci: Add Emmitsburg PCH support
    - [x86] intel_th: Fix a NULL dereference when hub driver is not loaded
    - opp: Increase parsed_static_opps in _of_add_opp_table_v1()
    - dmabuf: use spinlock to access dmabuf->name
    - [x86] thermal: int3403_thermal: Downgrade error message
    - [armhf] dts: imx6qdl-gw551x: fix audio SSI
    - [arm64] ptrace: Override SPSR.SS when single-stepping is enabled
    - [arm64] ptrace: Consistently use pseudo-singlestep exceptions
    - [arm64] compat: Ensure upper 32 bits of x0 are zero on syscall return
    - sched: Fix unreliable rseq cpu_id for new tasks
    - sched/fair: handle case of task_h_load() returning 0
    - [x86] ioperm: Fix io bitmap invalidation on Xen PV
    - genirq/affinity: Handle affinity setting on inactive interrupts correctly
    - [x86] drm/vmwgfx: fix update of display surface when resolution changes
    - drm/amdgpu/powerplay: Modify SMC message name for setting power profile
      mode
    - drm/amdgpu/sdma5: fix wptr overwritten in ->get_wptr()
    - drm/amd/display: handle failed allocation during stream construction
    - drm/amd/display: OLED panel backlight adjust not work with external
      display connected
    - drm/amdgpu/display: create fake mst encoders ahead of time (v4)
    - [x86] drm/i915: Move cec_notifier to intel_hdmi_connector_unregister, v2.
    - [x86] drm/i915/gt: Ignore irq enabling on the virtual engines
    - [x86] drm/i915/gt: Only swap to a random sibling once upon creation
    - libceph: don't omit recovery_deletes in target_copy()
    - rxrpc: Fix trace string
    - [x86] iommu/vt-d: Make Intel SVM code 64-bit only
    - mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages()
    - [x86] drm/i915/gvt: Fix two CFL MMIO handling caused by regression.
    - [arm64,armhf] gpio: pca953x: disable regmap locking for automatic address
      incrementing
    - bpf: sockmap: Check value of unused args to BPF_PROG_ATTACH
    - bpf: sockmap: Require attach_bpf_fd when detaching a program
    - [x86] drm/i915/perf: Use GTT when saving/restoring engine GPR

  [ Aurelien Jarno ]
  * Enable perf on riscv64.

  [ Salvatore Bonaccorso ]
  * drivers/net/ethernet/intel: Enable IGC as module (Closes: #965931)
  * [x86] ioperm: Fix io bitmap invalidation on Xen PV (CVE-2020-15852,
    XSA-329)
  * certs: Rotate to use the Debian Secure Boot Signer 2020 certificate
  * perf cs-etm: Move definition of 'traceid_list' global variable from header
    file (Closes: #957491)
  * usbip: tools: fix build error for multiple definition

  [ Ben Hutchings ]
  * libtraceevent: Fix build with binutils 2.35
  * Bump ABI to 2

  [ John Paul Adrian Glaubitz ]
  * [sh4] Add patch to implement __get_user_u64()

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 26 Jul 2020 08:40:40 +0200

linux (5.7.6-1) unstable; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.7
    - [x86] syscalls: Revert "x86/syscalls: Make __X32_SYSCALL_BIT be unsigned
      long" (Closes: #954294)
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.2
    - vt: keyboard: avoid signed integer overflow in k_ascii (CVE-2020-13974)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.3
    - [x86] speculation: Prevent rogue cross-process SSBD shutdown
      (CVE-2020-10766)
    - [x86] speculation: Avoid force-disabling IBPB based on STIBP and
      enhanced IBRS. (CVE-2020-10767)
    - [x86] speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect
      branches. (CVE-2020-10768)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.4
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.5
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.6

  [ Ben Hutchings ]
  * fs: Enable EXFAT_FS as module (Closes: #959781)
  * Fix conversion of meta-package doc directories to symlinks
    (Closes: #942861)

  [ Vagrant Cascadian ]
  * [arm64] Enable DRM_ANALOGIX_ANX6345 as a module.
  * [arm64] Add analogix-anx6345, pwm-sun4i, sun4i-drm and sun8i-mixer to
    fb-modules udeb.

  [ Helge Deller ]
  * [hppa] Don't run dh_strip on vmlinuz (Closes: #961299)

  [ YunQiang Su ]
  * [mips/loongson-3] Enable SERIAL_OF_PLATFORM and OF (Closes: 961328)

  [ Aurelien Jarno ]
  * Enable CONFIG_NVME_HWMON (Closes: #961823)

  [ Romain Perier ]
  * [arm64] Enable PCIE_BRCMSTB
  * [arm64] Enable BCM2711_THERMAL

  [ Salvatore Bonaccorso ]
  * nfsd: apply umask on fs without ACL support (Closes: #962254)
  * [rt] Add new signing key for Tom Zanussi
  * Set ABI to 1
  * [arm64] Remove explicit setting of CONFIG_HNS
  * debian/config: Clean up with the help of kconfigeditor2

  [ Gianfranco Costamagna ]
  * [x86] Enable VBOXSF_FS as a module (Closes: #961516)

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 24 Jun 2020 20:56:57 +0200

linux (5.7~rc5-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Romain Perier ]
  * Enable support for fsverity

  [ Ben Hutchings ]
  * [rt] Disable until it is updated for 5.5 or later
  * lockdown: Update Secure Boot support patches for 5.7
  * [amd64] Update "x86: Make x32 syscall support conditional ..." for 5.7
  * Update "tools/perf: pmu-events: Fix reproducibility" for 5.7

 -- Ben Hutchings <benh@debian.org>  Sun, 10 May 2020 23:42:53 +0100

linux (5.6.14-2) unstable; urgency=medium

  [ Vagrant Cascadian ]
  * [arm64] Add pwm-sun4i to fb-modules udeb.

  [ Salvatore Bonaccorso ]
  * kernel/relay.c: handle alloc_percpu returning NULL in relay_open
    (CVE-2019-19462)
  * fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
    (CVE-2020-10732)
  * mm: Fix mremap not considering huge pmd devmap (CVE-2020-10757)

  [ Ben Hutchings ]
  * [x86] Add support for mitigation of Special Register Buffer Data Sampling
    (SRBDS) (CVE-2020-0543):
    - x86/cpu: Add 'table' argument to cpu_matches()
    - x86/speculation: Add Special Register Buffer Data Sampling (SRBDS)
      mitigation
    - x86/speculation: Add SRBDS vulnerability and mitigation documentation
    - x86/speculation: Add Ivy Bridge to affected list
  * [x86] speculation: Do not match steppings, to avoid an ABI change

 -- Ben Hutchings <benh@debian.org>  Tue, 09 Jun 2020 18:50:00 +0100

linux (5.6.14-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.8
    - mm: check that mm is still valid in madvise()
    - watchdog: reset last_hw_keepalive time at start
    - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
    - xfs: correctly acount for reclaimable slabs
    - scsi: lpfc: Fix crash after handling a pci error
    - scsi: lpfc: Fix crash in target side cable pulls hitting WAIT_FOR_UNREG
    - scsi: libfc: If PRLI rejected, move rport to PLOGI state
    - ceph: return ceph_mdsc_do_request() errors from __get_parent()
    - ceph: don't skip updating wanted caps when cap is stale
    - [armhf] pwm: imx27: Fix clock handling in pwm_imx27_apply()
    - nvme-tcp: fix possible crash in write_zeroes processing
    - scsi: iscsi: Report unbind session event when the target has been
      removed
    - [x86] ASoC: Intel: atom: Take the drv->lock mutex before calling
      sst_send_slot_map()
    - nvme: fix deadlock caused by ANA update wrong locking
    - drm/amd/display: Update stream adjust in dc_stream_adjust_vmin_vmax
    - dma-direct: fix data truncation in dma_direct_get_required_mask()
    - kernel/gcov/fs.c: gcov_seq_next() should increase position index
    - ipc/util.c: sysvipc_find_ipc() should increase position index
    - block: fix busy device checking in blk_drop_partitions
    - [s390x] cio: generate delayed uevent for vfio-ccw subchannels
    - [s390x] cio: avoid duplicated 'ADD' uevents
    - loop: Better discard support for block devices
    - [powerpc*] Revert "powerpc/64: irq_work avoid interrupt when called with
      hardware irqs enabled"
    - [powerpc*] pseries: Fix MCE handling on pseries
    - nvme: fix compat address handling in several ioctls
    - pwm: renesas-tpu: Fix late Runtime PM enablement
    - [armel, armhf, arm64] pwm: bcm2835: Dynamically allocate base
    - scsi: lpfc: Fix erroneous cpu limit of 128 on I/O statistics
    - scsi: lpfc: Fix lockdep error - register non-static key
    - perf/core: Disable page faults when getting phys address
    - drm/amd/display: Calculate scaling ratios on every medium/full update
    - ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN MPWIN895CL tablet
    - ALSA: usb-audio: Add Pioneer DJ DJM-250MK2 quirk
    - xhci: Ensure link state is U3 after setting USB_SS_PORT_LS_U3
    - xhci: Wait until link state trainsits to U0 after setting
      USB_SS_PORT_LS_U0
    - xhci: Finetune host initiated USB3 rootport link suspend and resume
    - block: fix busy device checking in blk_drop_partitions again
    - cxgb4: fix adapter crash due to wrong MC size
    - cxgb4: fix large delays in PTP synchronization
    - ipv4: Update fib_select_default to handle nexthop objects
    - ipv6: fix restrict IPV6_ADDRFORM operation
    - macsec: avoid to set wrong mtu
    - macvlan: fix null dereference in macvlan_device_event()
    - mlxsw: Fix some IS_ERR() vs NULL bugs
    - [arm64] net: bcmgenet: correct per TX/RX ring statistics
    - net/mlx4_en: avoid indirect call in TX completion
    - net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
    - net: openvswitch: ovs_ct_exit to be done under ovs_lock
    - [armhf, arm64] net: stmmac: dwmac-meson8b: Add missing boundary to RGMII
      TX clock array
    - net/x25: Fix x25_neigh refcnt leak when receiving frame
    - sched: etf: do not assume all sockets are full blown
    - tcp: cache line align MAX_TCP_HEADER
    - team: fix hang in team_mode_get()
    - tipc: Fix potential tipc_aead refcnt leak in tipc_crypto_rcv
    - tipc: Fix potential tipc_node refcnt leak in tipc_rcv
    - vrf: Fix IPv6 with qdisc and xfrm
    - net: dsa: b53: Lookup VID in ARL searches when VLAN is enabled
    - net: dsa: b53: Fix valid setting for MDB entries
    - net: dsa: b53: Fix ARL register definitions
    - net: dsa: b53: Rework ARL bin logic
    - net: dsa: b53: b53_arl_rw_op() needs to select IVL or SVL
    - vxlan: use the correct nlattr array in NL_SET_ERR_MSG_ATTR
    - geneve: use the correct nlattr array in NL_SET_ERR_MSG_ATTR
    - xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
    - vrf: Check skb for XFRM_TRANSFORMED flag
    - net: ethernet: ixp4xx: Add error handling in ixp4xx_eth_probe()
    - KEYS: Avoid false positive ENOMEM error on key read
    - ALSA: hda: Remove ASUS ROG Zenith from the blacklist
    - ALSA: usb-audio: Add static mapping table for ALC1220-VB-based mobos
    - ALSA: usb-audio: Add connector notifier delegation
    - mac80211: populate debugfs only after cfg80211 init
    - libbpf: Only check mode flags in get_xdp_id
    - iio: core: remove extra semi-colon from devm_iio_device_register() macro
    - iio: imu: st_lsm6dsx: flush hw FIFO before resetting the device
    - iio: st_sensors: rely on odr mask to know if odr can be set
    - iio: adc: stm32-adc: fix sleep in atomic context
    - iio: adc: ti-ads8344: properly byte swap value
    - USB: sisusbvga: Change port variable from signed to unsigned
    - USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair
      K70 RGB RAPIDFIRE
    - USB: early: Handle AMD's spec-compliant identifiers, too
    - USB: core: Fix free-while-in-use bug in the USB S-Glibrary
      (CVE-2020-12464)
    - USB: hub: Fix handling of connect changes during sleep
    - USB: hub: Revert commit bd0e6c9614b9 ("usb: hub: try old enumeration
      scheme first for high speed devices")
    - tty: serial: owl: add "much needed" clk_prepare_enable()
    - vmalloc: fix remap_vmalloc_range() bounds checks
    - staging: gasket: Fix incongruency in handling of sysfs entries creation
    - coredump: fix null pointer dereference on coredump
    - mm/hugetlb: fix a addressing exception caused by huge_pte_offset
    - mm/ksm: fix NULL pointer dereference when KSM zero page is enabled
    - ALSA: usx2y: Fix potential NULL dereference
    - ALSA: hda/realtek - Fix unexpected init_amp override
    - ALSA: hda/realtek - Add new codec supported for ALC245
    - ALSA: hda/hdmi: Add module option to disable audio component binding
    - ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif
    - ALSA: usb-audio: Filter out unsupported sample rates on Focusrite
      devices
    - tpm/tpm_tis: Free IRQ if probing fails
    - tpm: fix wrong return value in tpm_pcr_extend
    - tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send()
    - [s390x] KVM: Return last valid slot if approx index is out-of-bounds
    - KVM: Check validity of resolved slot when searching memslots
    - [x86] KVM: VMX: Enable machine check support for 32bit targets
    - tty: hvc: fix buffer overflow during hvc_alloc().
    - tty: rocket, avoid OOB access
    - usb-storage: Add unusual_devs entry for JMicron JMS566
    - signal: Avoid corrupting si_pid and si_uid in do_notify_parent
    - drm/dp_mst: Zero assigned PBN when releasing VCPI slots
    - audit: check the length of userspace generated audit records
    - ASoC: dapm: fixup dapm kcontrol widget
    - SUNRPC: Fix backchannel RPC soft lockups
    - iwlwifi: pcie: actually release queue memory in TVQM
    - iwlwifi: mvm: beacon statistics shouldn't go backwards
    - iwlwifi: pcie: indicate correct RB size to device
    - iwlwifi: mvm: limit maximum queue appropriately
    - iwlwifi: mvm: Do not declare support for ACK Enabled Aggregation
    - iwlwifi: mvm: fix inactive TID removal return value usage
    - iwlwifi: fix WGDS check when WRDS is disabled
    - cifs: fix uninitialised lease_key in open_shroot()
    - [armhf] imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y
    - [powerpc*] 8xx: Fix STRICT_KERNEL_RWX startup test failure
    - [powerpc*] setup_64: Set cache-line-size based on cache-block-size
    - [x86] staging: comedi: dt2815: fix writing hi byte of analog output
    - [x86] staging: comedi: Fix comedi_device refcnt leak in comedi_open
    - vt: don't hardcode the mem allocation upper bound
    - vt: don't use kmalloc() for the unicode screen buffer
    - [x86] staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by
      default.
    - [x86] staging: vt6656: Fix calling conditions of vnt_set_bss_mode
    - [x86] staging: vt6656: Fix drivers TBTT timing counter.
    - [x86] staging: vt6656: Fix pairwise key entry save.
    - [x86] staging: vt6656: Power save stop wake_up_count wrap around.
    - [x86] mei: me: fix irq number stored in hw struct
    - cdc-acm: close race betrween suspend() and acm_softint
    - cdc-acm: introduce a cool down
    - UAS: no use logging any details in case of ENODEV
    - UAS: fix deadlock in error handling and PM flushing work
    - fpga: dfl: pci: fix return value of cci_pci_sriov_configure
    - [armhf, arm64] usb: dwc3: gadget: Fix request completion check
    - usb: f_fs: Clear OS Extended descriptor counts to zero in
      ffs_data_reset()
    - [x86] usb: typec: tcpm: Ignore CC and vbus changes in PORT_RESET change
    - [x86] usb: typec: altmode: Fix typec_altmode_get_partner sometimes
      returning an invalid pointer
    - xhci: Fix handling halted endpoint even if endpoint ring appears empty
    - xhci: prevent bus suspend if a roothub port detected a over-current
      condition
    - xhci: Don't clear hub TT buffer on ep0 protocol stall
    - serial: sh-sci: Make sure status register SCxSR is read in correct
      sequence
    - Revert "serial: uartps: Fix uartps_major handling"
    - Revert "serial: uartps: Use the same dynamic major number for all ports"
    - Revert "serial: uartps: Fix error path when alloc failed"
    - Revert "serial: uartps: Do not allow use aliases >= MAX_UART_INSTANCES"
    - Revert "serial: uartps: Change uart ID port allocation"
    - Revert "serial: uartps: Move Port ID to device data structure"
    - Revert "serial: uartps: Register own uart console and driver structures"
    - [x86] drm/i915/gt: Update PMINTRMSK holding fw
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.9
    - ubifs: Fix ubifs_tnc_lookup() usage in do_kill_orphans()
    - printk: queue wake_up_klogd irq_work only if per-CPU areas are ready
    - [armhf] ASoC: stm32: sai: fix sai probe
    - [armhf, arm64] usb: dwc3: gadget: Do link recovery for SS and SSP
    - [armel, armhf] ARM: dts: bcm283x: Add cells encoding format to firmware
      bus
    - usb: gadget: udc: bdc: Remove unnecessary NULL checks in
      bdc_req_complete
    - usb: gadget: udc: atmel: Fix vbus disconnect handling
    - afs: Make record checking use TASK_UNINTERRUPTIBLE when appropriate
    - afs: Fix to actually set AFS_SERVER_FL_HAVE_EPOCH
    - iio:ad7797: Use correct attribute_group
    - iio: imu: st_lsm6dsx: fix read misalignment on untagged FIFO
    - iio: imu: st_lsm6dsx: specify slave odr in slv_odr
    - propagate_one(): mnt_set_mountpoint() needs mount_lock
    - counter: 104-quad-8: Add lock guards - generic interface
    - [s390x] ftrace: fix potential crashes when switching tracers
    - ASoC: q6dsp6: q6afe-dai: add missing channels to MI2S DAIs
    - iwlwifi: actually check allocated conf_tlv pointer
    - ASoC: tas571x: disable regulators on failed probe
    - [armhf, arm64] ASoC: meson: axg-card: fix codec-to-codec link setup
    - ASoC: wm8960: Fix wrong clock after suspend & resume
    - nfsd: memory corruption in nfsd4_lock()
    - [armhf] dts: OMAP3: disable RNG on N950/N9
    - bpf: Forbid XADD on spilled pointers for unprivileged users
    - brcmfmac: add stub for monitor interface xmit
    - i2c: altera: use proper variable to hold errno
    - clk: asm9260: fix __clk_hw_register_fixed_rate_with_accuracy typo
    - rtw88: avoid unused function warnings
    - hwmon: (drivetemp) Return -ENODATA for invalid temperatures
    - rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket
    - netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag
    - [x86] efi: Don't remap text<->rodata gap read-only for mixed mode
    - net/cxgb4: Check the return from t4_query_params properly
    - tipc: fix incorrect increasing of link window
    - xfs: acquire superblock freeze protection on eofblocks scans
    - svcrdma: Fix trace point use-after-free race
    - svcrdma: Fix leak of svc_rdma_recv_ctxt objects
    - [armhf, arm64] net/mlx5e: Don't trigger IRQ multiple times on XSK wakeup
      to avoid WQ overruns
    - [armhf, arm64] net/mlx5e: Get the latest values from counters in
      switchdev mode
    - PCI: Avoid ASMedia XHCI USB PME# from D0 defect
    - PCI: Add Zhaoxin Vendor ID
    - PCI: Add ACS quirk for Zhaoxin multi-function devices
    - PCI: Add ACS quirk for Zhaoxin Root/Downstream Ports
    - PCI: Move Apex Edge TPU class quirk to fix BAR assignment
    - ARM: dts: bcm283x: Disable dsi0 node
    - cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled
    - [s390x] pci: do not set affinity for floating irqs
    - remoteproc: mtk_scp: use dma_addr_t for DMA API
    - net/mlx5: Fix failing fw tracer allocation on s390
    - sched/core: Fix reset-on-fork from RT with uclamp
    - perf/core: fix parent pid/tid in task exit events
    - netfilter: nat: fix error handling upon registering inet hook
    - PM: sleep: core: Switch back to async_schedule_dev()
    - blk-iocost: Fix error on iocost_ioc_vrate_adj
    - bpf: Fix handling of XADD on BTF memory
    - [x86] bpf: Fix encoding for lower 8-bit registers in BPF_STX BPF_B
    - [x86] bpf: x32: Fix incorrect encoding in BPF_LDX zero-extension
    - [x86] bpf: x32: Fix clobbering of dst for BPF_JSET
    - [x86] bpf, x32: Fix logic error in BPF_LDX zero-extension
    - bpf: Propagate expected_attach_type when verifying freplace programs
    - mm: shmem: disable interrupt when acquiring info->lock in
      userfaultfd_copy path
    - xfs: clear PF_MEMALLOC before exiting xfsaild thread
    - libbpf: Initialize *nl_pid so gcc 10 is happy
    - [armhf] net: fec: set GPR bit on suspend by DT configuration.
    - [x86] hyperv: report value of misc_features
    - signal: check sig before setting info in kill_pid_usb_asyncio
    - afs: Fix length of dump of bad YFSFetchStatus record
    - xfs: fix partially uninitialized structure in xfs_reflink_remap_extent
    - ALSA: hda: Release resources at error in delayed probe
    - ALSA: hda: Keep the controller initialization even if no codecs found
    - ALSA: hda: Explicitly permit using autosuspend if runtime PM is
      supported
    - drm/amdgpu: fix wrong vram lost counter increment V2
    - scsi: target: fix PR IN / READ FULL STATUS for FC
    - scsi: target: tcmu: reset_ring should reset TCMU_DEV_BIT_BROKEN
    - objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings
    - objtool: Support Clang non-section symbols in ORC dump
    - xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
    - ALSA: hda: call runtime_allow() for all hda controllers
    - net: stmmac: socfpga: Allow all RGMII modes
    - mac80211: fix channel switch trigger from unknown mesh peer
    - sched/isolation: Allow "isolcpus=" to skip unknown sub-parameters
    - sched/vtime: Work around an unitialized variable warning
    - [arm64] Delete the space separator in __emit_inst
    - ext4: use matching invalidatepage in ext4_writepage
    - ext4: increase wait time needed before reuse of deleted inode numbers
    - ext4: convert BUG_ON's to WARN_ON's in mballoc.c
    - irqchip/gic-v4.1: Add support for VPENDBASER's Dirty+Valid signaling
    - blk-mq: Put driver tag in blk_mq_dispatch_rq_list() when no budget
    - irqchip/meson-gpio: Fix HARDIRQ-safe -> HARDIRQ-unsafe lock order
    - hwmon: (jc42) Fix name to have no illegal characters
    - sfc: fix XDP-redirect in this driver
    - taprio: do not use BIT() in TCA_TAPRIO_ATTR_FLAG_* definitions
    - tipc: Add a missing case of TIPC_DIRECT_MSG type
    - qed: Fix race condition between scheduling and destroying the slowpath
      workqueue
    - Crypto: chelsio - Fixes a hang issue during driver registration
    - net: use indirect call wrappers for skb_copy_datagram_iter()
    - qed: Fix use after free in qed_chain_free
    - ext4: check for non-zero journal inum in ext4_calculate_overhead
    - ASoC: soc-pcm: fix regression in soc_new_pcm()
    - ASoC: soc-core: disable route checks for legacy devices
    - [armhf] ASoC: stm32: spdifrx: fix regmap status check
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.10
    - Revert "ASoC: meson: axg-card: fix codec-to-codec link setup"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.11
    - drm/scheduler: fix drm_sched_get_cleanup_job
    - dma-buf: Fix SET_NAME ioctl uapi
    - drm/amdgpu: invalidate L2 before SDMA IBs (v2)
    - drm/edid: Fix off-by-one in DispID DTD pixel clock
    - drm/amd/display: Fix green screen issue after suspend
    - [x86] drm/i915/gem: Hold obj->vma.lock over for_each_ggtt_vma()
    - [x86] drm/i915/gt: Check cacheline is valid before acquiring
    - drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
    - drm/qxl: qxl_release leak in qxl_hw_surface_alloc()
    - drm/qxl: qxl_release use after free
    - NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION
    - btrfs: fix transaction leak in btrfs_recover_relocation
    - btrfs: fix block group leak when removing fails
    - btrfs: fix partial loss of prealloc extent past i_size after fsync
    - btrfs: transaction: Avoid deadlock due to bad initialization timing of
      fs_info::journal_info
    - mmc: cqhci: Avoid false "cqhci: CQE stuck on" by not open-coding timeout
      loop
    - [arm64] mmc: sdhci-xenon: fix annoying 1.8V regulator warning
    - mmc: sdhci-pci: Fix eMMC driver strength for BYT-based controllers
    - [arm64] mmc: sdhci-msm: Enable host capabilities pertains to R1b
      response
    - [armhf] mmc: meson-mx-sdio: Set MMC_CAP_WAIT_WHILE_BUSY
    - [armhf] mmc: meson-mx-sdio: remove the broken ->card_busy() op
    - ALSA: hda/realtek - Two front mics on a Lenovo ThinkCenter
    - ALSA: usb-audio: Correct a typo of NuPrime DAC-10 USB ID
    - ALSA: hda/hdmi: fix without unlocked before return
    - ALSA: line6: Fix POD HD500 audio playback
    - ALSA: pcm: oss: Place the plugin buffer overflow checks correctly
    - [x86] i2c: amd-mp2-pci: Fix Oops in amd_mp2_pci_init() error handling
    - [x86] hyperv: Suspend/resume the VP assist page for hibernation
    - [x86] Drivers: hv: vmbus: Fix Suspend-to-Idle for Generation-2 VM
    - dlmfs_file_write(): fix the bogosity in handling non-zero *ppos
    - selinux: properly handle multiple messages in selinux_netlink_send()
    - [amd64] IB/rdmavt: Always return ERR_PTR from rvt_create_mmap_info()
    - PM: ACPI: Output correct message on target power state
    - PM: hibernate: Freeze kernel threads in software_resume()
    - dm writecache: fix data corruption when reloading the target
    - dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath
    - block: remove the bd_openers checks in blk_drop_partitions
    - scsi: qla2xxx: set UNLOADING before waiting for session deletion
    - scsi: qla2xxx: check UNLOADING before posting async work
    - RDMA/mlx5: Set GRH fields in query QP on RoCE
    - RDMA/uverbs: Fix a race with disassociate and exit_mmap()
    - RDMA/mlx4: Initialize ib_spec on the stack
    - RDMA/core: Prevent mixed use of FDs between shared ufiles
    - RDMA/core: Fix overwriting of uobj in case of error
    - RDMA/core: Fix race between destroy and release FD object
    - RDMA/cm: Fix ordering of xa_alloc_cyclic() in ib_create_cm_id()
    - RDMA/cm: Fix an error check in cm_alloc_id_priv()
    - [arm64] dmaengine: hisilicon: Fix build error without PCI_MSI
    - [x86,arm64] vfio: avoid possible overflow in vfio_iommu_type1_pin_pages
    - [x86,arm64] vfio/type1: Fix VA->PA translation for PFNMAP VMAs in
      vaddr_get_pfn()
    - [arm64] iommu/qcom: Fix local_base status check
    - dmaengine: fix channel index enumeration
    - scsi: target/iblock: fix WRITE SAME zeroing
    - iommu: Properly export iommu_group_get_for_dev()
    - [amd64] iommu/vt-d: Use right Kconfig option name
    - [amd64] iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled
      system
    - [armhf] i2c: aspeed: Avoid i2c interrupt status clear race condition.
    - [i386] ALSA: opti9xx: shut up gcc-10 range warning
    - Fix use after free in get_tree_bdev()
    - nvme: prevent double free in nvme_alloc_ns() error handling
    - nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl
    - [x86] drm/i915: Use proper fault mask in interrupt postinstall too
    - [arm64] vdso: Add -fasynchronous-unwind-tables to cflags
    - io_uring: statx must grab the file table for valid fd
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.12
    - vhost: vsock: kick send_pkt worker once device is started
    - [arm64,armhf] drm/bridge: analogix_dp: Split bind() into probe() and
      real bind()
    - [x86] ASoC: topology: Add missing memory checks
    - [x86] ASoC: topology: Check return value of soc_tplg_create_tlv
    - [x86] ASoC: topology: Check return value of soc_tplg_*_create
    - [x86] ASoC: topology: Check soc_tplg_add_route return value
    - [x86] ASoC: topology: Check return value of pcm_new_ver
    - [x86] ASoC: topology: Check return value of soc_tplg_dai_config
    - SUNRPC/cache: Fix unsafe traverse caused double-free in cache_purge
    - scsi: sg: add sg_remove_request in sg_write (CVE-2020-12770)
    - [armhf] ASoC: sgtl5000: Fix VAG power-on handling
    - [x86] ASoC: topology: Fix endianness issue
    - [arm64,armhf] usb: dwc3: gadget: Properly set maxpacket limit
    - [x86] ASoC: codecs: hdac_hdmi: Fix incorrect use of list_for_each_entry
    - wimax/i2400m: Fix potential urb refcnt leak
    - [armhf] net: stmmac: fix enabling socfpga's ptp_ref_clock
    - [arm64,armhf] net: stmmac: Fix sub-second increment
    - cifs: protect updating server->dstaddr with a spinlock
    - cifs: do not share tcons with DFS
    - tracing: Fix memory leaks in trace_events_hist.c
    - ftrace: Fix memory leak caused by not freeing entry in
      unregister_ftrace_direct()
    - mac80211: sta_info: Add lockdep condition for RCU list usage
    - [arm64] net: bcmgenet: suppress warnings on failed Rx SKB allocations
    - sctp: Fix SHUTDOWN CTSN Ack in the peer restart case
    - drm/amdgpu: Fix oops when pp_funcs is unset in ACPI event
    - ALSA: hda: Match both PCI ID and SSID for driver blacklist
    - [x86] kvm: fix a missing-prototypes "vmread_error"
    - [x86] platform: GPD pocket fan: Fix error message when temp-limits are
      out of range
    - ACPI: PM: s2idle: Fix comment in acpi_s2idle_prepare_late()
    - mac80211: add ieee80211_is_any_nullfunc()
    - cgroup, netclassid: remove double cond_resched
    - mm/mremap: Add comment explaining the untagging behaviour of mremap()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.13
    - [x86] thunderbolt: Check return value of tb_sw_read() in
      usb4_switch_op()
    - USB: serial: qcserial: Add DW5816e support
    - drm/amdgpu: move kfd suspend after ip_suspend_phase1
    - drm/amdgpu: drop redundant cg/pg ungate on runpm enter
    - vt: fix unicode console freeing with a common interface
    - [arm64] tty: xilinx_uartps: Fix missing id assignment to the console
    - ext4: don't set dioread_nolock by default for blocksize < pagesize
    - ext4: disable dioread_nolock whenever delayed allocation is disabled
    - nvme: refactor nvme_identify_ns_descs error handling
    - nvme: fix possible hang when ns scanning fails during error recovery
    - tracing/kprobes: Fix a double initialization typo
    - [arm64,riscv64] net: macb: Fix runtime PM refcounting
    - cxgb4: fix EOTID leak when disabling TC-MQPRIO offload
    - devlink: Fix reporter's recovery condition
    - devlink: fix return value after hitting end in region read
    - fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks
    - ipv6: Use global sernum for dst validation with nexthop objects
    - neigh: send protocol value in neighbor create notification
    - net: bridge: vlan: Add a schedule point during VLAN processing
    - [arm64,armhf] net: dsa: Do not leave DSA master with NULL netdev_ops
    - [arm64,armhf] net: dsa: Do not make user port errors fatal
    - [arm64,riscv64] net: macb: fix an issue about leak related system
      resources
    - net: macsec: preserve ingress frame ordering
    - net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc()
    - net: phy: marvell10g: fix temperature sensor on 2110
    - net_sched: sch_skbprio: add message validation to skbprio_change()
    - net: stricter validation of untrusted gso packets
    - net: usb: qmi_wwan: add support for DW5816e
    - nfp: abm: fix a memory leak bug
    - sch_choke: avoid potential panic in choke_reset()
    - sch_sfq: validate silly quantum values
    - tipc: fix partial topology connection closure
    - tunnel: Propagate ECT(1) when decapsulating as recommended by RFC6040
    - bnxt_en: Fix VF anti-spoof filter setup.
    - bnxt_en: Reduce BNXT_MSIX_VEC_MAX value to supported CQs per PF.
    - bnxt_en: Improve AER slot reset.
    - bnxt_en: Return error when allocating zero size context memory.
    - bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features().
    - net/mlx5: DR, On creation set CQ's arm_db member to right value
    - net/mlx5: Fix forced completion access non initialized command entry
    - net/mlx5: Fix command entry leak in Internal Error State
    - net/mlx5e: Fix q counters on uplink representors
    - [arm64,armhf] net: mvpp2: prevent buffer overflow in mvpp22_rss_ctx()
    - [arm64,armhf] net: mvpp2: cls: Prevent buffer overflow in
      mvpp2_ethtool_cls_rule_del()
    - wireguard: queueing: cleanup ptr_ring in error path of packet_queue_init
    - wireguard: receive: use tunnel helpers for decapsulating ECN markings
    - wireguard: socket: remove errant restriction on looping to self
    - wireguard: send/receive: cond_resched() when processing worker
      ringbuffers
    - HID: wacom: Read HID_DG_CONTACTMAX directly for non-generic devices
    - sctp: Fix bundling of SHUTDOWN with COOKIE-ACK
    - Revert "HID: wacom: generic: read the number of expected touches on a
      per collection basis"
    - HID: usbhid: Fix race between usbhid_close() and usbhid_stop()
    - HID: wacom: Report 2nd-gen Intuos Pro S center button status over BT
    - USB: uas: add quirk for LaCie 2Big Quadra
    - [arm64,armhf] usb: chipidea: msm: Ensure proper controller reset using
      role switch API
    - USB: serial: garmin_gps: add sanity checking for data length
    - tracing/boottime: Fix kprobe event API usage
    - tracing/kprobes: Reject new event if loc is NULL
    - tracing: Wait for preempt irq delay thread to finish
    - tracing: Add a vmalloc_sync_mappings() for safe measure
    - crypto: arch/lib - limit simd usage to 4k chunks
    - [s390x] KVM: Remove false WARN_ON_ONCE for the PQAP instruction
    - [x86] KVM: VMX: Explicitly clear RFLAGS.CF and RFLAGS.ZF in VM-Exit RSB
      path
    - [arm64,armhf] KVM: vgic: Fix limit condition when writing to
      GICD_I[CS]ACTIVER
    - [arm64] KVM: Fix 32bit PC wrap-around
    - [arm64] hugetlb: avoid potential NULL dereference
    - driver core: platform: Initialize dma_parms for platform devices
    - [arm*] amba: Initialize dma_parms for amba devices
    - [x86] mei: me: disable mei interface on LBG servers.
    - ipc/mqueue.c: change __do_notify() to bypass check_kill_permission()
    - epoll: atomically remove wait entry on wake up
    - eventpoll: fix missing wakeup for ovflist in ep_poll_callback
    - mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous()
    - mm: limit boost_watermark on small zones
    - ceph: fix endianness bug when handling MDS session feature bits
    - ceph: demote quotarealm lookup warning to a debug message
    - coredump: fix crash when umh is disabled
    - [riscv64] set max_pfn to the PFN of the last page
    - batman-adv: fix batadv_nc_random_weight_tq
    - batman-adv: Fix refcnt leak in batadv_show_throughput_override
    - batman-adv: Fix refcnt leak in batadv_store_throughput_override
    - batman-adv: Fix refcnt leak in batadv_v_ogm_process
    - [x86] mm/cpa: Flush direct map alias during cpa
    - [x86] entry/64: Fix unwind hints in register clearing code
    - [x86] entry/64: Fix unwind hints in kernel exit path
    - [x86] entry/64: Fix unwind hints in __switch_to_asm()
    - [x86] entry/64: Fix unwind hints in rewind_stack_do_exit()
    - [amd64] x86/unwind/orc: Don't skip the first frame for inactive tasks
    - [amd64] x86/unwind/orc: Prevent unwinding before ORC initialization
    - [amd64] x86/unwind/orc: Fix error path for bad ORC entry type
    - [amd64] x86/unwind/orc: Fix premature unwind stoppage due to IRET frames
    - [x86] KVM: Fixes posted interrupt check for IRQs delivery modes
    - [x86] arch/x86/kvm/svm/sev.c: change flag passed to GUP fast in
      sev_pin_memory()
    - netfilter: nat: never update the UDP checksum when it's 0
    - netfilter: nf_osf: avoid passing pointer to local var
    - [x86] kvm: ioapic: Restrict lazy EOI update to edge-triggered interrupts
    - scripts/decodecode: fix trapping instruction formatting
    - mm, memcg: fix error return value of mem_cgroup_css_alloc()
    - bdi: move bdi_dev_name out of line
    - bdi: add a ->dev_name field to struct backing_dev_info
    - io_uring: don't use 'fd' for openat/openat2/statx
    - fsnotify: replace inode pointer with an object id
    - fanotify: merge duplicate events on parent and child
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.14
    - [x86] KVM: nVMX: Consolidate nested MTF checks to helper function
    - [x86] kvm: nVMX: reflect MTF VM-exits if injected by L1
    - xprtrdma: Clean up the post_send path
    - xprtrdma: Fix trace point use-after-free race
    - [x86] drm/i915/tgl: Add Wa_14010477008:tgl
    - [x86] drm/i915/tgl: TBT AUX should use TC power well ops
    - [x86] drm/i915/display: Load DP_TP_CTL/STATUS offset before use it
    - shmem: fix possible deadlocks on shmlock_user_lock
    - net: phy: microchip_t1: add lan87xx_phy_init to initialize the lan87xx
      phy.
    - [arm64,armhf] KVM: vgic: Synchronize the whole guest on
      GIC{D,R}_I{S,C}ACTIVER read
    - [arm64,armhf] KVM: vgic-v2: Only use the virtual state when userspace
      accesses pending bits
    - gpio: pca953x: Fix pca953x_gpio_set_config
    - SUNRPC: Add "@len" parameter to gss_unwrap()
    - SUNRPC: Fix GSS privacy computation of auth->au_ralign
    - [x86] hv_netvsc: Fix netvsc_start_xmit's return type
    - drop_monitor: work around gcc-10 stringop-overflow warning
    - virtio-blk: handle block_device_operations callbacks after hot unplug
    - net_sched: fix tcm_parent in tc filter dump
    - [arm64,armhf] net: stmmac: gmac5+: fix potential integer overflow on 32
      bit multiply
    - [amd64] iommu/amd: Fix race in increase_address_space()/fetch_pte()
    - [amd64] iommu/amd: Update Device Table in increase_address_space()
    - mmc: sdhci-acpi: Add SDHCI_QUIRK2_BROKEN_64_BIT_DMA for AMDI0040
    - [arm64] dpaa2-eth: properly handle buffer size restrictions
    - mptcp: set correct vfs info for subflows
    - net: fix a potential recursive NETDEV_FEAT_CHANGE
    - netlabel: cope with NULL catmap (CVE-2020-10711)
    - net: phy: fix aneg restart in phy_ethtool_set_eee
    - [arm64] net: stmmac: fix num_por initialization
    - pppoe: only process PADT targeted at local interfaces
    - Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu"
    - tcp: fix error recovery in tcp_zerocopy_receive()
    - tcp: fix SO_RCVLOWAT hangs with fat skbs
    - virtio_net: fix lockdep warning on 32 bit
    - [arm64] dpaa2-eth: prevent array underflow in update_cls_rule()
    - hinic: fix a bug of ndo_stop
    - net: ipv4: really enforce backoff for redirects
    - netprio_cgroup: Fix unlimited memory leak of v2 cgroups
    - net: tcp: fix rx timestamp behavior for tcp_recvmsg
    - nfp: abm: fix error return code in nfp_abm_vnic_alloc()
    - r8169: re-establish support for RTL8401 chip version
    - umh: fix memory leak on execve failure
    - [arm64] net: broadcom: Select BROADCOM_PHY for BCMGENET
    - [i386] dmaengine: pch_dma.c: Avoid data race between probe and irq
      handler
    - [x86] cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode
      once
    - ALSA: hda/hdmi: fix race in monitor detection during probe
    - drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()
    - fibmap: Warn and return an error in case of block > INT_MAX
    - io_uring: use cond_resched() in io_ring_ctx_wait_and_kill()
    - io_uring: check non-sync defer_list carefully
    - ipc/util.c: sysvipc_find_ipc() incorrectly updates position index
    - ALSA: hda/realtek - Fix S3 pop noise on Dell Wyse
    - gfs2: Another gfs2_walk_metadata fix
    - mmc: sdhci-pci-gli: Fix no irq handler from suspend
    - [amd64] IB/hfi1: Fix another case where pq is left on waitlist
    - ACPI: EC: PM: Avoid premature returns from acpi_s2idle_wake()
    - [x86] pinctrl: sunrisepoint: Fix PAD lock register offset for SPT-H
    - [x86] pinctrl: baytrail: Enable pin configuration setting for GPIO chip
    - [arm64] pinctrl: qcom: fix wrong write in update_dual_edge
    - [x86] pinctrl: cherryview: Add missing spinlock usage in
      chv_gpio_irq_handler
    - [arm64,armhf] drm/tegra: Fix SMMU support on Tegra124 and Tegra210
    - bpf: Fix error return code in map_lookup_and_delete_elem()
    - ALSA: firewire-lib: fix 'function sizeof not defined' error of
      tracepoints format
    - cachefiles: Fix corruption of the return value in
      cachefiles_read_or_alloc_pages()
    - i40iw: Fix error handling in i40iw_manage_arp_cache()
    - [x86] drm/i915/gt: Make timeslicing an explicit engine property
    - [x86] drm/i915: Don't enable WaIncreaseLatencyIPCEnabled when IPC is
      disabled
    - bpf, sockmap: msg_pop_data can incorrecty set an sge length
    - bpf, sockmap: bpf_tcp_ingress needs to subtract bytes from sg.size
    - [x86] drm/i915/gem: Remove object_is_locked assertion from
      unpin_from_display_plane
    - mmc: sdhci-pci-gli: Fix can not access GL9750 after reboot from Windows
      10
    - mmc: core: Check request type before completing the request
    - mmc: core: Fix recursive locking issue in CQE recovery path
    - mmc: block: Fix request completion in the CQE timeout path
    - gfs2: More gfs2_find_jhead fixes
    - fork: prevent accidental access to clone3 features
    - drm/amdgpu: force fbdev into vram
    - NFS: Fix fscache super_cookie index_key from changing after umount
    - NFS: Fix fscache super_cookie allocation
    - NFSv4: Fix fscache cookie aux_data to ensure change_attr is included
    - hwmon: (drivetemp) Fix SCT support if SCT data tables are not supported
    - netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
    - [x86] drm/i915/gvt: Fix kernel oops for 3-level ppgtt guest
    - [arm64] fix the flush_icache_range arguments in machine_kexec
    - netfilter: conntrack: fix infinite loop on rmmod
    - [x86] drm/i915: Mark concurrent submissions with a weak-dependency
    - nfs: fix NULL deference in nfs4_get_valid_delegation
    - SUNRPC: Signalled ASYNC tasks need to exit
    - tracing: Wait for preempt irq delay thread to execute
    - netfilter: flowtable: set NF_FLOW_TEARDOWN flag on entry expiration
    - netfilter: nft_set_rbtree: Add missing expired checks
    - RDMA/rxe: Always return ERR_PTR from rxe_create_mmap_info()
    - IB/mlx4: Test return value of calls to ib_get_cached_pkey
    - IB/core: Fix potential NULL pointer dereference in pkey cache
    - RDMA/core: Fix double put of resource
    - RDMA/iw_cxgb4: Fix incorrect function parameters
    - [x86] ftrace: Have ftrace trampolines turn read-only at the end of
      system boot up
    - [x86] drm/i915: Handle idling during i915_gem_evict_something busy loops
    - mm, memcg: fix inconsistent oom event behavior
    - epoll: call final ep_events_available() check under the lock
    - bpf: Fix bug in mmap() implementation for BPF array map
    - NFSv3: fix rpc receive buffer size for MOUNT call
    - pnp: Use list_for_each_entry() instead of open coding
    - net/rds: Use ERR_PTR for rds_message_alloc_sgs()
    - Stop the ad-hoc games with -Wno-maybe-initialized
    - gcc-10: disable 'zero-length-bounds' warning for now
    - gcc-10: disable 'array-bounds' warning for now
    - gcc-10: disable 'stringop-overflow' warning for now
    - gcc-10: disable 'restrict' warning for now
    - gcc-10 warnings: fix low-hanging fruit
    - gcc-10: mark more functions __init to avoid section mismatch warnings
    - gcc-10: avoid shadowing standard library 'free()' in crypto
    - bootconfig: Fix to remove bootconfig data from initrd while boot
    - bootconfig: Fix to prevent warning message if no bootconfig option
    - usb: usbfs: correct kernel->user page attribute mismatch
    - USB: usbfs: fix mmap dma mismatch
    - ALSA: hda/realtek - Limit int mic boost for Thinkpad T530
    - ALSA: hda/realtek - Add COEF workaround for ASUS ZenBook UX431DA
    - ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
    - ALSA: usb-audio: Add control message quirk delay for Kingston HyperX
      headset
    - usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B
    - [arm64,armhf,riscv64] usb: host: xhci-plat: keep runtime active when
      removing host
    - USB: gadget: fix illegal array access in binding with UDC
      (CVE-2020-13143)
    - usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg
      list
    - [x86] Make the "Reducing compressed framebufer size" message be
      DRM_INFO_ONCE()
    - [armhf] dts: imx6dl-yapp4: Fix Ursa board Ethernet connection
    - drm/amd/amdgpu: add raven1 part to the gfxoff quirk list
    - [x86] drm/i915/tgl+: Fix interrupt handling for DP AUX transactions
    - [powerpc*] vdso32: Fallback on getres syscall when clock is unknown
    - cifs: fix leaked reference on requeued write
    - [x86] KVM: Fix pkru save/restore when guest CR4.PKE=0, move it to x86.c
    - [x86] Fix early boot crash on gcc-10, third try
    - [amd64] x86/unwind/orc: Fix error handling in __unwind_start()
    - exec: Move would_dump into flush_old_exec
    - [arm64,armhf] clk: rockchip: fix incorrect configuration of rk3228
      aclk_gpu* clocks
    - [arm64,armhf] dwc3: Remove check for HWO flag in
      dwc3_gadget_ep_reclaim_trb_sg()
    - fanotify: fix merging marks masks with FAN_ONDIR
    - [arm64] dts: meson-g12b-ugoos-am6: fix usb vbus-supply
    - Revert "ALSA: hda/realtek: Fix pop noise on ALC225"
    - [armhf] clk: ti: clkctrl: Fix Bad of_node_put within clkctrl_get_name
    - clk: Unlink clock if failed to prepare or enable
    - [arm64] dts: rockchip: Replace RK805 PMIC node name with "pmic" on
      rk3328 boards
    - dt-bindings: dma: fsl-edma: fix ls1028a-edma compatible
    - SUNRPC: Revert 241b1f419f0e ("SUNRPC: Remove xdr_buf_trim()")
    - bpf: Fix sk_psock refcnt leak when receiving message
    - RDMA/uverbs: Do not discard the IB_EVENT_DEVICE_FATAL event
    - RDMA/uverbs: Move IB_EVENT_DEVICE_FATAL to destroy_uobj
    - [x86] KVM: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce
    - bpf: Enforce returning 0 for fentry/fexit progs
    - bpf: Restrict bpf_trace_printk()'s %s usage and add %pks, %pus specifier
    - Makefile: disallow data races on gcc-10 as well

  [ Ben Hutchings ]
  * linux-libc-dev: Re-add "Provides: linux-kernel-headers" as several
    source packages still have this in Build-Depends

  [ Luca Boccassi ]
  * [cloud] Enable INFINIBAND configs for HyperV/Azure (Closes: #958300)

  [ Bastian Blank ]
  * [cloud] Re-enable some FB drivers.

  [ Romain Perier ]
  * Enable support for fsverity

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.6.10-rt5 and re-enable
  * Bump ABI to 2.
  * xfs: add agf freeblocks verify in xfs_agf_verify (CVE-2020-12655)

  [ Domenico Andreoli ]
  * [arm64] udeb: Add armada_37xx_wdt to kernel-image (Closes: #961086)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 23 May 2020 16:29:21 +0200

linux (5.6.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.5
    - perf tools: Support Python 3.8+ in Makefile (Closes: #958165)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.6
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.7

  [ Ben Hutchings ]
  * [armhf,arm64] lockdown: Update arm Secure Boot patch for 5.6
    (fixes FTBFS)
  * Use debhelper compatibility level 12:
    - Build-Depend on debhelper-compat and remove debian/compat
    - hyperv-daemons: Use dh_installsystemd instead of
      dh_systemd_{enable,start}
    - hyperv-daemons: Add "Pre-Depends: ${misc:Pre-Depends}"
  * debian/README.source: Refer to upload checklist in kernel-team.git
  * [armel] Disable NETLABEL, since SECURITY_SELINUX is also disabled
  * Drop linux-headers-<ver>-all and linux-headers-<ver>-all-<arch> packages,
    which are no longer needed
  * linux-libc-dev: Drop "Provides: linux-kernel-headers" which is no longer
    needed
  * [s390x] mm: fix page table upgrade vs 2ndary address mode accesses
    (CVE-2020-11884)
  * Set ABI to 1

  [ Romain Perier ]
  *  Rebased patch firmware-remove-redundant-log-messages-from-drivers.patch
     onto 5.6.7.

  [ Philip Rinn ]
  * [arm64] Enable CRYPTO_DEV_SUN8I_CE (closes: #958037)
  * [arm64] Enable SUN8I_THERMAL

  [ Roberto Bampi ]
  * [arm64] Enable ARMADA_37XX_WATCHDOG as module

  [ Vagrant Cascadian ]
  * [arm64] Enable SENSORS_PWM_FAN as a module.

  [ Paul Tagliamonte ]
  * Enable CONFIG_NETLABEL (Closes: #958804)

 -- Ben Hutchings <benh@debian.org>  Wed, 29 Apr 2020 04:46:47 +0100

linux (5.6.4-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.6
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.2
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.3
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.4

  [ Ben Hutchings ]
  * Set ABI to trunk
  * [mips*] Revert "staging: octeon-usb: delete the octeon usb host controller
    driver"
  * [mips*] Revert "staging: octeon: delete driver"
  * [powerpc*] i2c: Enable I2C_PARPORT instead of I2C_PARPORT_LIGHT
  * aufs: Update support patchset to aufs5.x-rcN 20200302; no functional
    change
  * linux-signed-*: Build-Depend on kernel-wedge 2.102 for consistency
  * aufs: Update support patchset to aufs5.6 20200413; no functional change
  * [rt] Update to 5.6.4-rt3 and re-enable

  [ Aurelien Jarno ]
  * Enable SENSORS_DRIVETEMP
  * [riscv64] Enable SOC_VIRT
  * [riscv64] Enable GPIOLIB, GPIO_SIFIVE, POWER_RESET, POWER_RESET_GPIO,
    POWER_RESET_GPIO_RESTART, POWER_RESET_RESTART, CONFIG_PWM,
    CONFIG_PWM_SIFIVE, CONFIG_SIFIVE_L2

  [ Christian Barcenas ]
  * linux-kbuild: Stop building conmakehash
  * linux-cpupower: Add libcap to Build-Depends and turbostat linker flags
  * [x86] Drop EFI cold boot mitigation patch in favor of upstream
  * [amd64] Update "x86: Make x32 syscall support conditional ..." for 5.6

  [ Romain Perier ]
  * [x86] udeb: Add crc32_pclmul to crc-modules
  * udeb: Add crc32_generic to crc-modules

  [ Luca Boccassi ]
  * lockdown: set default (with Secure Boot) to LOCKDOWN_INTEGRITY_MAX
    (Closes: #956197)

 -- Ben Hutchings <benh@debian.org>  Fri, 17 Apr 2020 01:26:42 +0100

linux (5.5.17-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.14
    - mmc: core: Allow host controllers to require R1B for CMD6
    - mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard
    - mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command
    - [armhf] mmc: sdhci-omap: Fix busy detection by enabling
      MMC_CAP_NEED_RSP_BUSY
    - [armhf,arm64] mmc: sdhci-tegra: Fix busy detection by enabling
      MMC_CAP_NEED_RSP_BUSY
    - cxgb4: fix throughput drop during Tx backpressure
    - cxgb4: fix Txq restart check during backpressure
    - geneve: move debug check after netdev unregister
    - hsr: fix general protection fault in hsr_addr_is_self()
    - ipv4: fix a RCU-list lock in inet_dump_fib()
    - macsec: restrict to ethernet devices
    - net/bpfilter: fix dprintf usage for /dev/kmsg
    - net: cbs: Fix software cbs to consider packet sending time
    - [armhf,arm64] net: dsa: Fix duplicate frames flooded by learning
    - net: ena: Add PCI shutdown handler to allow safe kexec
    - [armhf] net: mvneta: Fix the case where the last poll did not process all
      rx
    - net/packet: tpacket_rcv: avoid a producer race condition
    - net: phy: dp83867: w/a for fld detect threshold bootstrapping issue
    - [armhf,arm64] net: phy: mdio-bcm-unimac: Fix clock handling
    - net: qmi_wwan: add support for ASKEY WWHC050
    - net/sched: act_ct: Fix leak of ct zone template on replace
    - net_sched: cls_route: remove the right filter from hashtable
    - net_sched: hold rtnl lock in tcindex_partial_destroy_work()
    - net_sched: keep alloc_hash updated after hash allocation
    - [armhf,arm64] net: stmmac: dwmac-rk: fix error path in rk_gmac_probe
    - r8169: re-enable MSI on RTL8168c
    - slcan: not call free_netdev before rtnl_unlock in slcan_open
    - tcp: also NULL skb->dev when copy was needed
    - tcp: ensure skb->dev is NULL before leaving TCP stack
    - tcp: repair: fix TCP_QUEUE_SEQ implementation
    - vxlan: check return value of gro_cells_init()
    - [arm64] Revert "net: bcmgenet: use RGMII loopback for MAC reset"
    - [arm64] net: bcmgenet: keep MAC in reset until PHY is up
    - bnxt_en: Fix Priority Bytes and Packets counters in ethtool -S.
    - bnxt_en: fix memory leaks in bnxt_dcbnl_ieee_getets()
    - bnxt_en: Return error if bnxt_alloc_ctx_mem() fails.
    - bnxt_en: Free context memory after disabling PCI in probe error path.
    - bnxt_en: Reset rings if ring reservation fails during open()
    - net: ena: fix incorrect setting of the number of msix vectors
    - net: ena: fix request of incorrect number of IRQ vectors
    - net: ena: avoid memory access violation by validating req_id properly
    - net: ena: fix continuous keep-alive resets
    - net: ip_gre: Separate ERSPAN newlink / changelink callbacks
    - net: ip_gre: Accept IFLA_INFO_DATA-less configuration
    - hsr: use rcu_read_lock() in hsr_get_node_{list/status}()
    - hsr: add restart routine into hsr_get_node_list()
    - hsr: set .netnsok flag
    - net/mlx5: DR, Fix postsend actions write length
    - net/mlx5e: Enhance ICOSQ WQE info fields
    - net/mlx5e: Fix missing reset of SW metadata in Striding RQ reset
    - net/mlx5e: Fix ICOSQ recovery flow with Striding RQ
    - net/mlx5e: Do not recover from a non-fatal syndrome
    - net/mlx5_core: Set IB capability mask1 to fix ib_srpt connection failure
    - net/mlx5e: kTLS, Fix TCP seq off-by-1 issue in TX resync flow
    - net/mlx5e: Fix endianness handling in pedit mask
    - cgroup-v1: cgroup_pidlist_next should update position index
    - nfs: add minor version to nfs_server_key for fscache
    - drivers/of/of_mdio.c:fix of_mdiobus_register()
    - cgroup1: don't call release_agent when it is ""
    - veth: ignore peer tx_dropped when counting local rx_dropped
    - drm/amd/display: update soc bb for nv14
    - drm/amdgpu: correct ROM_INDEX/DATA offset for VEGA20
    - [armhf] drm/exynos: Fix cleanup of IOMMU related objects
    - [x86] iommu/vt-d: Silence RCU-list debugging warnings
    - scsi: ipr: Fix softlockup when rescanning devices in petitboot
    - mac80211: Do not send mesh HWMP PREQ if HWMP is disabled
    - [x86] iommu/vt-d: Fix debugfs register reads
    - [x86] iommu/vt-d: Populate debugfs if IOMMUs are detected
    - Input: fix stale timestamp on key autorepeat events
    - [x86] Input: synaptics - enable RMI on HP Envy 13-ad105ng
    - Input: avoid BIT() macro usage in the serio.h UAPI header
    - IB/rdmavt: Free kernel completion queue when done
    - RDMA/core: Fix missing error check on dev_set_name()
    - RDMA/odp: Fix leaking the tgid for implicit ODP
    - gpiolib: Fix irq_disable() semantics
    - RDMA/nl: Do not permit empty devices names during
      RDMA_NLDEV_CMD_NEWLINK/SET
    - RDMA/mad: Do not crash if the rdma device does not have a umad interface
    - ceph: check POOL_FLAG_FULL/NEARFULL in addition to OSDMAP_FULL/NEARFULL
    - ceph: fix memory leak in ceph_cleanup_snapid_map()
    - [x86] KVM: SVM: Issue WBINVD after deactivating an SEV guest
    - [armhf] dts: dra7: Add bus_dma_limit for L3 bus
    - [armhf] dts: omap5: Add bus_dma_limit for L3 bus
    - perf probe: Fix to delete multiple probe event
    - perf probe: Do not depend on dwfl_module_addrsym()
    - rtlwifi: rtl8188ee: Fix regression due to commit d1d1a96bdb44
    - drm/prime: use dma length macro when mapping sg
    - drm/amdgpu: fix scatter-gather mapping with user pages
    - drm/radeon: fix scatter-gather mapping with user pages
    - [armhf] soc: samsung: chipid: Fix return value on non-Exynos platforms
    - scsi: sd: Fix optimal I/O size for devices that change reported values
    - nl80211: fix NL80211_ATTR_CHANNEL_WIDTH attribute type
    - mac80211: drop data frames without key on encrypted links
    - mac80211: mark station unauthorized before key removal
    - mm/swapfile.c: move inode_lock out of claim_swapfile
    - drivers/base/memory.c: indicate all memory blocks as removable
    - mm/sparse: fix kernel crash with pfn_section_valid check
    - mm: fork: fix kernel_stack memcg stats for various stack implementations
    - [x86] gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk
    - gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option
    - [x86] gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT +
      AXP288 model
    - bpf: Fix cgroup ref leak in cgroup_bpf_inherit on out-of-memory
    - RDMA/core: Ensure security pkey modify is not lost
    - afs: Fix handling of an abort from a service handler
    - genirq: Fix reference leaks on irq affinity notifiers
    - xfrm: handle NETDEV_UNREGISTER for xfrm device
    - vti[6]: fix packet tx through bpf_redirect() in XinY cases
    - RDMA/mlx5: Fix the number of hwcounters of a dynamic counter
    - RDMA/mlx5: Fix access to wrong pointer while performing flush due to
      error
    - RDMA/mlx5: Block delay drop to unprivileged users
    - xfrm: fix uctx len check in verify_sec_ctx_len
    - xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire
    - xfrm: policy: Fix doulbe free in xfrm_policy_timer
    - afs: Fix client call Rx-phase signal handling
    - afs: Fix some tracing details
    - afs: Fix unpinned address list during probing
    - ieee80211: fix HE SPR size calculation
    - mac80211: set IEEE80211_TX_CTRL_PORT_CTRL_PROTO for nl80211 TX
    - netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6}
    - netfilter: flowtable: populate addr_type mask
    - netfilter: nft_fwd_netdev: validate family and chain type
    - netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress
    - [i386] bpf, x32: Fix bug with JMP32 JSET BPF_X checking upper bits
    - bpf: Initialize storage pointers to NULL to prevent freeing garbage
      pointer
    - bpf/btf: Fix BTF verification of enum members in struct/union
    - bpf, sockmap: Remove bucket->lock from sock_{hash|map}_free
    - [armhf] dts: sun8i-a83t-tbs-a711: Fix USB OTG mode detection
    - vti6: Fix memory leak of skb if input policy check fails
    - r8169: fix PHY driver check on platforms w/o module softdeps
    - [x86] clocksource/drivers/hyper-v: Untangle stimers and timesync from
      clocksources
    - bpf: Undo incorrect __reg_bound_offset32 handling
    - USB: serial: option: add support for ASKEY WWHC050
    - USB: serial: option: add BroadMobi BM806U
    - USB: serial: option: add Wistron Neweb D19Q1
    - USB: cdc-acm: restore capability check order
    - USB: serial: io_edgeport: fix slab-out-of-bounds read in
      edge_interrupt_callback
    - [armhf,arm64] usb: musb: fix crash with highmen PIO and usbmon
    - media: flexcop-usb: fix endpoint sanity check
    - media: usbtv: fix control-message timeouts
    - staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
    - [x86] staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
    - [x86] staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
    - [x86] ahci: Add Intel Comet Lake H RAID PCI ID
    - libfs: fix infoleak in simple_attr_read()
    - media: ov519: add missing endpoint sanity checks (CVE-2020-11608)
    - media: dib0700: fix rc endpoint lookup
    - media: stv06xx: add missing descriptor sanity checks (CVE-2020-11609)
    - media: xirlink_cit: add missing descriptor sanity checks
      (CVE-2020-11668)
    - media: v4l2-core: fix a use-after-free bug of sd->devnode
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.15
    - bpf: update jmp32 test cases to fix range bound deduction
    - mac80211: Check port authorization in the ieee80211_tx_dequeue() case
    - mac80211: fix authentication with iwlwifi/mvm
    - vt: selection, introduce vc_is_sel
    - vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines
    - vt: switch vt_dont_switch to bool
    - vt: vt_ioctl: remove unnecessary console allocation checks
    - vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console
    - vt: vt_ioctl: fix use-after-free in vt_in_use()
    - [x86] platform: pmc_atom: Add Lex 2I385SW to critclk_systems DMI table
    - bpf: Explicitly memset the bpf_attr structure
    - bpf: Explicitly memset some bpf info structures declared on the stack
    - iwlwifi: don't send GEO_TX_POWER_LIMIT if no wgds table
    - [x86] gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT +
      AXP288 model
    - [armhf] clk: imx: Align imx sc clock msg structs to 4
    - [armhf] clk: imx: Align imx sc clock parent msg structs to 4
    - libceph: fix alloc_msg_with_page_vector() memory leaks
    - perf map: Fix off by one in strncpy() size argument
    - [armel,armhf] dts: bcm283x: Fix vc4's firmware bus DMA limitations
    - [armel] bcm2835-rpi-zero-w: Add missing pinctrl name
    - [armhf] dts: imx6: phycore-som: fix arm and soc minimum voltage
    - [armhf] dts: N900: fix onenand timings
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.16
    - ipv4: fix a RCU-list lock in fib_triestat_seq_show
    - net, ip_tunnel: fix interface lookup with no key
    - sctp: fix possibly using a bad saddr with a given dst
    - sctp: fix refcount bug in sctp_wfree
    - [arm64,riscv64] net: macb: Fix handling of fixed-link node
    - nvme-rdma: Avoid double freeing of async event data
    - drm/amdgpu: add fbdev suspend/resume on gpu reset
    - [x86] drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017
    - drm/bochs: downgrade pci_request_region failure from error to warning
    - initramfs: restore default compression behavior
    - drm/amdgpu: fix typo for vcn1 idle check
    - tools/power turbostat: Fix gcc build warnings
    - tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks
    - tools/power turbostat: Fix 32-bit capabilities warning
    - padata: fix uninitialized return value in padata_replace()
    - brcmfmac: abort and release host after error
    - XArray: Fix xa_find_next for large multi-index entries
    - misc: rtsx: set correct pcr_ops for rts522A
    - PCI: sysfs: Revert "rescan" file renames
    - [x86] mei: me: add cedar fork device ids
    - nvmem: check for NULL reg_read and reg_write before dereferencing
    - [armhf] extcon: axp288: Add wakeup support
    - Revert "dm: always call blk_queue_split() in dm_process_bio()"
    - [x86] ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on
      EVGA X99 Classified motherboard
    - iwlwifi: consider HE capability when setting LDPC
    - iwlwifi: yoyo: don't add TLV offset when reading FIFOs
    - iwlwifi: dbg: don't abort if sending DBGC_SUSPEND_RESUME fails
    - rxrpc: Fix sendmsg(MSG_WAITALL) handling
    - IB/hfi1: Ensure pq is not left on waitlist
    - sched: act: count in the size of action flags bitfield
    - tcp: fix TFO SYNACK undo to avoid double-timestamp-undo
    - [x86,ia64] watchdog: iTCO_wdt: Export vendorsupport
    - [x86,ia64] watchdog: iTCO_wdt: Make ICH_RES_IO_SMI optional
    - i2c: i801: Do not add ICH_RES_IO_SMI for the iTCO_wdt device
    - net: genetlink: return the error code when attribute parsing fails.
    - net: Fix Tx hash bound checking
    - net/smc: fix cleanup for linkgroup setup failures
    - padata: always acquire cpu_hotplug_lock before pinst->lock
    - mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
      (CVE-2020-11565)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.17
    - cxgb4: fix MPS index overwrite when setting MAC address
    - ipv6: don't auto-add link-local address to lag ports
    - [armhf] net: dsa: bcm_sf2: Do not register slave MDIO bus with OF
    - [armhf] net: dsa: bcm_sf2: Ensure correct sub-node is parsed
    - net: phy: micrel: kszphy_resume(): add delay after genphy_resume() before
      accessing PHY registers
    - net_sched: add a temporary refcnt for struct tcindex_data
    - net_sched: fix a missing refcnt in tcindex_init()
    - [armhf,arm64] net: stmmac: dwmac1000: fix out-of-bounds mac address reg
      setting
    - slcan: Don't transmit uninitialized stack data in padding
    - tun: Don't put_page() for all negative return values from XDP program
    - r8169: change back SG and TSO to be disabled by default
    - cxgb4: free MQPRIO resources in shutdown path
    - [s390x] prevent leaking kernel address in BEAR
    - random: always use batched entropy for get_random_u{32,64}
    - [armhf,arm64] usb: dwc3: gadget: Wrap around when skip TRBs
    - slub: improve bit diffusion for freelist ptr obfuscation
    - ubi: fastmap: Free unused fastmap anchor peb during detach
    - RDMA/ucma: Put a lock around every call to the rdma_cm layer
    - RDMA/cma: Teach lockdep about the order of rtnl and lock
    - RDMA/siw: Fix passive connection establishment
    - Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl
    - RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow
    - blk-mq: Keep set->nr_hw_queues and set->map[].nr_queues in sync
    - fbcon: fix null-ptr-deref in fbcon_switch
    - driver core: Reevaluate dev->links.need_for_probe as suppliers are added
    - [x86] iommu/vt-d: Allow devices with RMRRs to use identity domain
    - ACPI: PM: Add acpi_[un]register_wakeup_handler()
    - [x86] platform: intel_int0002_vgpio: Use acpi_register_wakeup_handler()
    - IB/hfi1: Call kobject_put() when kobject_init_and_add() fails
    - IB/hfi1: Fix memory leaks in sysfs registration and unregistration
    - IB/mlx5: Replace tunnel mpls capability bits for tunnel_offloads
    - [armhf] imx: Enable ARM_ERRATA_814220 for i.MX6UL and i.MX7D
    - [armhf] imx: only select ARM_ERRATA_814220 for ARMv7-A
    - ceph: remove the extra slashes in the server path
    - ceph: canonicalize server path in place

  [ Noah Meyerhans ]
  * Fix autopkgtest failure due to pycodestyle violation
  * [cloud] Re-enable kernel page merge functionality (Closes: #955366)
  * [cloud] Apply a number of additional optimizations (Closes: #947759)
    - Statically link nvme and ext4 drivers with the kernel
    - [amd64] Re-enable SCHED_MC_PRIO
    - Switch to LZ4 for compression
    - Disable a number of additional drivers unlikely to be found in
      cloud environments

  [ Ben Hutchings ]
  * drm: Disable DRM_LEGACY (DRI1)
  * Bump ABI to 2
  * WireGuard: Update for renaming of skb_reset_tc() to skb_reset_redirect()
  * lib/fonts: Enable FONTS, FONT_8x8, FONT_8x16, FONT_TER16x32 for most
    flavours (Closes: #956173)
  * keys: Enable PERSISTENT_KEYRINGS
  * mm: Enable DEFERRED_STRUCT_PAGE_INIT (Closes: #954025)
  * [armel/marvell] mm: Enable COMPACTION (Closes: #949171)
  * [x86} media/cec: Enable CEC_PLATFORM_DRIVERS; enable VIDEO_SECO_CEC as a
    module (Closes: #951543)
  * [x86] sound/soc/intel: Enable SND_SOC_INTEL_BYT_CHT_CX2072X_MACH as module
    (Closes: #951482)

  [ Sudip Mukherjee ]
  * Remove libbpf. (See: #948041)

  [ Jason A. Donenfeld ]
  * Provide wireguard-modules as stop-gap for packages.

  [ Christian Barcenas ]
  * linux-cpupower: Add libcap to Build-Depends and turbostat linker flags

  [ Joel Johnson ]
  * [armhf] Build PHY_MVEBU_A38X_COMPHY module (Closes: #951409)

  [ Josua Mayer ]
  * [arm64] enable support for the Honeycomb arm64 workstation
    (Closes: #948576)

 -- Ben Hutchings <benh@debian.org>  Wed, 15 Apr 2020 03:37:48 +0100

linux (5.5.13-2) unstable; urgency=medium

  * bpf: Undo incorrect __reg_bound_offset32 handling (CVE-2020-8835)

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 30 Mar 2020 23:06:57 +0200

linux (5.5.13-1) unstable; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.5
    (Closes: #953680)
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.2
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.3
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.4
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.5
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.6
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.7
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.8
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.9
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.10
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.11
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.12
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.13

  [ Ben Hutchings ]
  * aufs: Update support patchset to aufs5.x-rcN 20200120; no functional
    change
  * net: Enable NET_SWITCHDEV; disable on armel/marvell (Closes: #949863)
  * [armhf] net/ethernet/ti: Enable TI_CPSW_SWITCHDEV as module; enable TI_CPTS
  * wireless: Enable regulatory.db direct loading:
    - Drop "wireless: Disable regulatory.db direct loading"
    - linux-image: Add Breaks: relation with old wireless-regdb versions
    - Regenerate my wireless-regdb certificate with expected attributes
  * [x86] Drop "Add a SysRq option to lift kernel lockdown" (Closes: #947021)
    - This patch allowed remotely disabling lockdown using usbip
    - Lockdown can be disabled by running "mokutil --disable-validation",
      rebooting, and confirming the change when prompted
  * Set PYTHON=python3 for document build (fixes FTBFS)
  * [x86,arm64] Move linux-headers metapackages to src:linux-signed-*.
    This should ensure that src:linux and src:linux-signed-* transition to
    testing together.
  * debian/bin/gencontrol_signed.py: Generate valid versions in a linux binNMU
  * udeb: Drop zlib-modules packages, as zlib_deflate is now always built-in
    (fixes FTBFS on several architectures)
  * [mips*/octeon] Fix and re-enable the Octeon Ethernet driver
  * [mips*] Fix FTBFS:
    - Increase RELOCATION_TABLE_SIZE to 0x160000
    - Fix exception handler memcpy()
  * debian/config: Delete redundant arch/flavour-specific "debug-info: true"
  * linux-source: Suggest qtbase5-dev instead of the removed libqt4-dev
    (Closes: #953386)
  * Add WireGuard driver and required crypto changes from 5.6-rc7 and
    cryptodev-2.6, thanks to Jason A. Donenfeld (Closes: #953569)
  * drivers/net: Enable WIREGUARD as module
  * debian/control: Use my debian.org email in Uploaders field
  * debian/certs: Rename Romain Perier's certificate to match email address
  * security/integrity/platform_certs: Rebase db-mok-keyring patch set for
    5.5.9
  * [x86] Enable X86_UMIP (previously configured as X86_INTEL_UMIP)
  * Set ABI to 1
  * [amd64] Enable Intel GVT-g (except cloud-amd64) (Closes: #954088):
    - vfio: Enable VFIO_MDEV, VFIO_MDEV_DEVICE as modules
    - i915: Enable DRM_I915_GVT; enable DRM_I915_GVT_KVMGT as module
  * drivers/net/wireless: Enable MT76x0E as module (Closes: #953683)
  * bcmgenet: Backport ACPI support, supporting Raspberry Pi 4
    (Closes: #950578)

  [ Aurelien Jarno ]
  * [riscv64] Enable SECCOMP.

  [ Romain Perier ]
  * [arm64] Enable BCMGENET
  * [arm64] Fix CONFIG_INFINIBAND_HNS_HIP06 and CONFIG_INFINIBAND_HNS_HIP08
    from tristate to boolean
  * debian/certs: Add my own certificate for wireless-regdb
  * debian/patches/debian/wireless-add-debian-wireless-regdb-certificates.patch:
    Add the hexdump of my certificate to this patch, so the kernel can
    directly load the regulatory db and trust it if have I signed it.

  [ Noah Meyerhans ]
  * [arm64] Enable KVM_ARM_HOST and KVM_ARM_PMU
  * [arm64] Enable CONFIG_ARM64_ERRATUM_1418040
  * [arm64/cloud-arm64] Introduce cloud build flavour
  * [cloud] random: Enable RANDOM_TRUST_BOOTLOADER

  [ Mark Pearson ]
  * [amd64] ASoC: Enable SND_SOC_SOF_COMETLAKE_LP_SUPPORT,
    SND_SOC_SOF_COMETLAKE_H_SUPPORT

  [ Christian Barcenas ]
  * lockdown: honor LOCK_DOWN_IN_EFI_SECURE_BOOT=n (Closes: #945604)

  [ Salvatore Bonaccorso ]
  * libcpupower: Lower back soname version to 1 and add new
    cpufreq_{get,put}_boost_frequencies methods

  [ Joel Stanley ]
  * [armhf] Enable ASPEED AST2600 SoC family. This includes all ASPEED symbols
    for the AST2600 and FTGMAC100, the network device used by this SoC. The
    SoC has 5 UARTs so CONFIG_SERIAL_8250_NR_UARTS is bumped to 5 from 4
    in order to correctly register UART5, the boot console.

  [ Petr Stastny ]
  * [x86] i2c: Enable I2C_AMD_MP2 as module (Closes: #955004)

  [ Vagrant Cascadian ]
  * [arm64] Add patch from next-20200325 to enable device-tree for
    Pinebook Pro.

 -- Ben Hutchings <benh@debian.org>  Mon, 30 Mar 2020 03:03:47 +0100

linux (5.5~rc5-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Romain Perier ]
  * [rt] Disable until it is updated for 5.5 or later
  * [mips*] Remove obsolete patch
    MIPS-Loongson-3-Add-Loongson-LS3A-RS780E-1-way-machi.patch
  * Retrieve the new aufs5 patches from the upstream tree, with an update in
    aufs5-standalone.patch (see its header).
  * Refreshed patches:
    - debian/dfsg/vs6624-disable.patch
    - bugfix/all/firmware_class-log-every-success-and-failure.patch
    - bugfix/all/
      radeon-amdgpu-firmware-is-required-for-drm-and-kms-on-r600-onward.patch
    - bugfix/all/disable-some-marvell-phys.patch
    - features/all/
      security-perf-allow-further-restriction-of-perf_event_open.patch
    - features/x86/x86-make-x32-syscall-support-conditional.patch
    - bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch
    - features/all/lockdown/
      efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch

  [ Ben Hutchings ]
  * udeb: Add f2fs-modules package
  * linux-kbuild: Stop building pnmtologo
  * linux-kbuild: Add new file to Makefile for kconfig

 -- Ben Hutchings <ben@decadent.org.uk>  Mon, 06 Jan 2020 04:26:45 +0000

linux (5.4.19-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.14
    - [arm64,armhf] soc: amlogic: meson-ee-pwrc: propagate PD provider
      registration errors
    - [arm64,armhf] soc: amlogic: meson-ee-pwrc: propagate errors from
      pm_genpd_init()
    - [armhf] bus: ti-sysc: Fix iterating over clocks
    - clk: Don't try to enable critical clocks if prepare failed
    - [armhf] ASoC: stm32: sai: fix possible circular locking
    - [armhf] ASoC: stm32: dfsdm: fix 16 bits record
    - [armhf] OMAP2+: Fix ti_sysc_find_one_clockdomain to check for
      to_clk_hw_omap
    - [armhf] dts: imx6q-dhcom: Fix SGTL5000 VDDIO regulator connection
    - [x86] ASoC: Intel: bytcht_es8316: Fix Irbis NB41 netbook quirk
    - ALSA: dice: fix fallback from protocol extension into limited
      functionality
    - ALSA: seq: Fix racy access for queue timer in proc read
    - ALSA: firewire-tascam: fix corruption due to spin lock without
      restoration in SoftIRQ context
    - ALSA: usb-audio: fix sync-ep altsetting sanity check
    - [arm64] dts: allwinner: a64: olinuxino: Fix SDIO supply regulator
    - [arm64] dts: allwinner: a64: olinuxino: Fix eMMC supply regulator
    - [armhf] clk: sunxi-ng: r40: Allow setting parent rate for external clock
      outputs
    - block: fix an integer overflow in logical block size
    - fuse: fix fuse_send_readpages() in the syncronous read case
    - io_uring: only allow submit from owning task
    - [armhf] dts: am571x-idk: Fix gpios property to have the correct gpio
      number
    - [armel] davinci: select CONFIG_RESET_CONTROLLER
    - perf: Correctly handle failed perf_get_aux_event()
    - iio: buffer: align the size of scan bytes to size of the largest element
    - USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx
    - USB: serial: option: Add support for Quectel RM500Q
    - USB: serial: opticon: fix control-message timeouts
    - USB: serial: option: add support for Quectel RM500Q in QDL mode
    - USB: serial: suppress driver bind attributes
    - USB: serial: ch341: handle unbound port at reset_resume
    - USB: serial: io_edgeport: handle unbound ports on URB completion
    - USB: serial: io_edgeport: add missing active-port sanity check
    - USB: serial: keyspan: handle unbound ports
    - USB: serial: quatech2: handle unbound ports
    - [x86] staging: comedi: ni_routes: fix null dereference in
      ni_find_route_source()
    - [x86] staging: comedi: ni_routes: allow partial routing information
    - [x86] scsi: fnic: fix invalid stack access
    - scsi: mptfusion: Fix double fetch bug in ioctl
    - ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()
    - [armhf] mtd: rawnand: gpmi: Fix suspend/resume problem
    - [armhf] mtd: rawnand: gpmi: Restore nfc timing setup after
      suspend/resume
    - usb: core: hub: Improved device recognition on remote wakeup
    - cpu/SMT: Fix x86 link error without CONFIG_SYSFS
    - [x86] CPU/AMD: Ensure clearing of SME/SEV features is maintained
    - locking/rwsem: Fix kernel crash when spinning on RWSEM_OWNER_UNKNOWN
    - [x86] perf/x86/intel/uncore: Fix missing marker for
      snr_uncore_imc_freerunning_events
    - [amd64] x86/efistub: Disable paging at mixed mode entry
    - [s390x] zcrypt: Fix CCA cipher key gen with clear key value function
    - [x86] scsi: storvsc: Correctly set number of hardware queues for IDE
      disk
    - mtd: spi-nor: Fix selection of 4-byte addressing opcodes on Spansion
    - [x86] efi/earlycon: Fix write-combine mapping on x86
    - [s390x] setup: Fix secure ipl message
    - [armhf] clk: samsung: exynos5420: Keep top G3D clocks enabled
    - perf hists: Fix variable name's inconsistency in hists__for_each() macro
    - locking/lockdep: Fix buffer overrun problem in stack_trace[]
    - perf report: Fix incorrectly added dimensions as switch perf data file
    - mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD
      alignment
    - mm/huge_memory.c: thp: fix conflict of above-47bit hint address and PMD
      alignment
    - mm: memcg/slab: fix percpu slab vmstats flushing
    - mm: memcg/slab: call flush_memcg_workqueue() only if memcg workqueue is
      valid
    - mm, debug_pagealloc: don't rely on static keys too early
    - btrfs: rework arguments of btrfs_unlink_subvol
    - btrfs: fix invalid removal of root ref
    - btrfs: do not delete mismatched root refs
    - btrfs: relocation: fix reloc_root lifespan and access
    - btrfs: fix memory leak in qgroup accounting
    - btrfs: check rw_devices, not num_devices for balance
    - Btrfs: always copy scrub arguments back to user space
    - mm/memory_hotplug: don't free usage map when removing a re-added early
      section
    - mm/page-writeback.c: avoid potential division by zero in
      wb_min_max_ratio()
    - mm: khugepaged: add trace status description for SCAN_PAGE_HAS_PRIVATE
    - [armhf] dts: imx6sx-sdb: Remove incorrect power supply assignment
    - [armhf] dts: imx6sl-evk: Remove incorrect power supply assignment
    - [armhf] dts: imx6sll-evk: Remove incorrect power supply assignment
    - [armhf] dts: imx6q-icore-mipi: Use 1.5 version of i.Core MX6DL
    - [arm64,armhf] net: stmmac: 16KB buffer must be 16 byte aligned
    - [arm64,armhf] net: stmmac: Enable 16KB buffer size
    - [arm*] reset: Fix {of,devm}_reset_control_array_get kerneldoc return
      types
    - tipc: fix potential hanging after b/rcast changing
    - tipc: fix retrans failure due to wrong destination
    - block: Fix the type of 'sts' in bsg_queue_rq()
    - bpf: Fix incorrect verifier simulation of ARSH under ALU32
    - bpf: Sockmap/tls, during free we may call tcp_bpf_unhash() in loop
    - bpf: Sockmap, ensure sock lock held during tear down
    - bpf: Sockmap/tls, push write_space updates through ulp updates
    - bpf: Sockmap, skmsg helper overestimates push, pull, and pop bounds
    - bpf: Sockmap/tls, msg_push_data may leave end mark in place
    - bpf: Sockmap/tls, tls_sw can create a plaintext buf > encrypt buf
    - bpf: Sockmap/tls, skmsg can have wrapped skmsg that needs extra chaining
    - bpf: Sockmap/tls, fix pop data with SK_DROP return code
    - [arm64,armhf] i2c: tegra: Fix suspending in active runtime PM state
    - [arm64,armhf] i2c: tegra: Properly disable runtime PM on driver's probe
      error
    - cfg80211: fix deadlocks in autodisconnect work
    - cfg80211: fix memory leak in nl80211_probe_mesh_link
    - cfg80211: fix memory leak in cfg80211_cqm_rssi_update
    - cfg80211: fix page refcount issue in A-MSDU decap
    - bpf/sockmap: Read psock ingress_msg before sk_receive_queue
    - netfilter: fix a use-after-free in mtype_destroy()
    - netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct
    - netfilter: nat: fix ICMP header corruption on ICMP errors
    - netfilter: nft_tunnel: fix null-attribute check
    - netfilter: nft_tunnel: ERSPAN_VERSION must not be null
    - netfilter: nf_tables: remove WARN and add NLA_STRING upper limits
    - netfilter: nf_tables: store transaction list locally while requesting
      module
    - netfilter: nf_tables: fix flowtable list del corruption
    - NFC: pn533: fix bulk-message timeout
    - net: bpf: Don't leak time wait and request sockets
    - bpftool: Fix printing incorrect pointer in btf_dump_ptr
    - batman-adv: Fix DAT candidate selection on little endian systems
    - macvlan: use skb_reset_mac_header() in macvlan_queue_xmit()
    - [x86] hv_netvsc: Fix memory leak when removing rndis device
    - net: avoid updating qdisc_xmit_lock_key in netdev_update_lockdep_key()
    - [arm64] net: hns3: pad the short frame before sending to the hardware
    - [arm64] net: hns: fix soft lockup when there is not enough memory
    - net: phy: dp83867: Set FORCE_LINK_GOOD to default after reset
    - net/sched: act_ife: initalize ife->metalist earlier
    - net: usb: lan78xx: limit size of local TSO packets
    - ptp: free ptp device pin descriptors properly
    - r8152: add missing endpoint sanity check
    - tcp: fix marked lost packets not being retransmitted
    - bnxt_en: Fix NTUPLE firmware command failures.
    - bnxt_en: Fix ipv6 RFS filter matching logic.
    - bnxt_en: Do not treat DSN (Digital Serial Number) read failure as fatal.
    - net: sched: act_ctinfo: fix memory leak
    - [armhf] net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec
    - i40e: prevent memory leak in i40e_setup_macvlans (CVE-2019-19043)
    - drm/amdgpu: allow direct upload save restore list for raven2
    - [arm64,armhf] net: stmmac: tc: Do not setup flower filtering if RSS is
      enabled
    - devlink: Wait longer before warning about unset port type
    - xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk
    - tcp: refine rule to allow EPOLLOUT generation under mem pressure
    - [arm64] dts: meson-gxl-s905x-khadas-vim: fix gpio-keys-polled node
    - cfg80211: check for set_wiphy_params
    - tick/sched: Annotate lockless access to last_jiffies_update
    - [armhf] dts: imx6ul-kontron-n6310-s: Disable the snvs-poweroff driver
    - mtd: cfi_cmdset_0002: only check errors when ready in
      cfi_check_err_status()
    - mtd: cfi_cmdset_0002: fix delayed error detection on HyperFlash
    - reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr
    - scsi: esas2r: unlock on error in esas2r_nvram_read_direct()
    - [arm64] scsi: hisi_sas: Don't create debugfs dump folder twice
    - [arm64] scsi: hisi_sas: Set the BIST init value before enabling BIST
    - scsi: qla4xxx: fix double free bug
    - scsi: bnx2i: fix potential use after free
    - scsi: target: core: Fix a pr_debug() argument
    - scsi: lpfc: fix: Coverity: lpfc_get_scsi_buf_s3(): Null pointer
      dereferences
    - [arm64] scsi: hisi_sas: Return directly if init hardware failed
    - scsi: scsi_transport_sas: Fix memory leak when removing devices
    - scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI
    - scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan
    - scsi: core: scsi_trace: Use get_unaligned_be*()
    - scsi: lpfc: Fix list corruption detected in lpfc_put_sgl_per_hdwq
    - scsi: lpfc: Fix hdwq sgl locks and irq handling
    - scsi: lpfc: Fix a kernel warning triggered by lpfc_get_sgl_per_hdwq()
    - rtw88: fix potential read outside array boundary
    - perf probe: Fix wrong address verification
    - perf script: Allow --time with --reltime
    - perf script: Fix --reltime with --time
    - scsi: lpfc: use hdwq assigned cpu for allocation
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.15
    - [x86] drm/i915: Fix pid leak with banned clients
    - libbpf: Fix compatibility for kernels without need_wakeup
    - libbpf: Fix memory leak/double free issue
    - libbpf: Fix potential overflow issue
    - libbpf: Fix another potential overflow issue in bpf_prog_linfo
    - libbpf: Make btf__resolve_size logic always check size error condition
    - bpf: Force .BTF section start to zero when dumping from vmlinux
    - [armhf] OMAP2+: Add missing put_device() call in omapdss_init_of()
    - xfs: Sanity check flags of Q_XQUOTARM call
    - [armhf] i2c: stm32f7: rework slave_id allocation
    - [armhf] i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop
    - [x86] mfd: intel-lpss: Add default I2C device properties for Gemini Lake
    - SUNRPC: Fix svcauth_gss_proxy_init()
    - SUNRPC: Fix backchannel latency metrics
    - [powerpc*] security: Fix debugfs data leak on 32-bit
    - [powerpc*] pseries: Enable support for ibm,drc-info property
    - tipc: reduce sensitive to retransmit failures
    - tipc: update mon's self addr when node addr generated
    - tipc: fix potential memory leak in __tipc_sendmsg()
    - tipc: fix wrong socket reference counter after tipc_sk_timeout() returns
    - tipc: fix wrong timeout input for tipc_wait_for_cond()
    - [arm64,armhf] net/mlx5e: Fix free peer_flow when refcount is 0
    - net: phy: broadcom: Fix RGMII delays configuration for BCM54210E
    - [armhf] phy: ti: gmii-sel: fix mac tx internal delay for rgmii-rxid
    - mt7601u: fix bbp version check in mt7601u_wait_bbp_ready
    - ice: fix stack leakage
    - [s390x] pkey: fix memory leak within _copy_apqns_from_user()
    - nfsd: depend on CRYPTO_MD5 for legacy client tracking
    - [armhf] crypto: sun4i-ss - fix big endian issues
    - perf map: No need to adjust the long name of modules
    - [arm64,armhf] soc/tegra: pmc: Fix crashes for hierarchical interrupts
    - watchdog: sprd: Fix the incorrect pointer getting from driver data
    - ipmi: Fix memory leak in __ipmi_bmc_register (CVE-2019-19046)
    - sched/core: Further clarify sched_class::set_next_task()
    - gpiolib: No need to call gpiochip_remove_pin_ranges() twice
    - rtw88: fix beaconing mode rsvd_page memory violation issue
    - rtw88: fix error handling when setup efuse info
    - [arm64,armhf] drm/panfrost: Add missing check for pfdev->regulator
    - drm/amdgpu: remove excess function parameter description
    - [armhf] hwrng: omap3-rom - Fix missing clock by probing with device tree
    - [arm64,armhf] drm/rockchip: Round up _before_ giving to the clock
      framework
    - software node: Get reference to parent swnode in get_parent op
    - [arm64] net: netsec: Correct dma sync for XDP_TX frames
    - ACPI: platform: Unregister stale platform devices
    - [arm64,armhf] pwm: sun4i: Fix incorrect calculation of duty_cycle/period
    - libbpf: Don't use kernel-side u32 type in xsk.c
    - scsi: ufs: delete redundant function ufshcd_def_desc_sizes()
    - net: openvswitch: don't unlock mutex when changing the user_features
      fails
    - [x86] hv_netvsc: flag software created hash value
    - rt2800: remove errornous duplicate condition
    - net: neigh: use long type to store jiffies delta
    - packet: fix data-race in fanout_flow_is_huge()
    - [armhf] i2c: stm32f7: report dma error during probe
    - [arm64] tee: optee: Fix dynamic shm pool allocations
    - [arm64] tee: optee: fix device enumeration error handling
    - workqueue: Add RCU annotation for pwq list walk
    - SUNRPC: Fix another issue with MIC buffer space
    - sched/cpufreq: Move the cfs_rq_util_change() call to
      cpufreq_update_util()
    - mt76: mt76u: rely on usb_interface instead of usb_dev
    - dma-direct: don't check swiotlb=force in dma_direct_map_resource
    - afs: Remove set but not used variables 'before', 'after'
    - [armhf] dmaengine: ti: edma: fix missed failure handling
    - drm/radeon: fix bad DMA from INTERRUPT_CNTL2
    - xdp: Fix cleanup on map free for devmap_hash map type
    - block: fix memleak of bio integrity data
    - [s390x] qeth: fix dangling IO buffers after halt/clear
    - net-sysfs: Call dev_hold always in netdev_queue_add_kobject
    - [arm64,armhf] phy/rockchip: inno-hdmi: round clock rate down to closest
      1000 Hz
    - [arm64] optee: Fix multi page dynamic shm pool alloc
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.16
    - can, slip: Protect tty->disc_data in write_wakeup and close with RCU
    - firestream: fix memory leaks
    - gtp: make sure only SOCK_DGRAM UDP sockets are accepted
    - ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions
    - net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM
    - net: ip6_gre: fix moving ip6gre between namespaces
    - net, ip6_tunnel: fix namespaces move
    - net, ip_tunnel: fix namespaces move
    - net: rtnetlink: validate IFLA_MTU attribute in rtnl_create_link()
    - net_sched: fix datalen for ematch
    - net_sched: use validated TCA_KIND attribute in tc_new_tfilter()
    - net-sysfs: Fix reference count leak
    - net: usb: lan78xx: Add .ndo_features_check
    - Revert "udp: do rmem bulk free even if the rx sk queue is empty"
    - tcp_bbr: improve arithmetic division in bbr_update_bw()
    - tcp: do not leave dangling pointers in tp->highest_sack
    - tun: add mutex_unlock() call and napi.skb clearing in tun_get_user()
    - airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
    - airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE
    - fou: Fix IPv6 netlink policy
    - net: Fix packet reordering caused by GRO and listified RX cooperation
    - [arm64,armhf] net/mlx5: Fix lowest FDB pool size
    - [arm64,armhf] net/mlx5: Update the list of the PCI supported devices
    - [arm64,armhf] net/mlx5: DR, Enable counter on non-fwd-dest objects
    - [arm64,armhf] net/mlx5: E-Switch, Prevent ingress rate configuration of
      uplink rep
    - [arm64,armhf] net/mlx5: DR, use non preemptible call to get the current
      cpu number
    - ipv4: Detect rollover in specific fib table dump
    - Revert "io_uring: only allow submit from owning task"
    - afs: Fix characters allowed into cell names
    - hwmon: (adt7475) Make volt2reg return same reg as reg2volt input
    - hwmon: (core) Do not use device managed functions for memory allocations
    - ceph: hold extra reference to r_parent over life of request
    - PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken
    - [arm64,armhf] drm/panfrost: Add the panfrost_gem_mapping concept
    - [x86] drm/i915: Align engine->uabi_class/instance with i915_drm.h
    - PM: hibernate: fix crashes with init_on_free=1
    - tracing: trigger: Replace unneeded RCU-list traversals
    - tracing/uprobe: Fix double perf_event linking on multiprobe uprobe
    - tracing: Do not set trace clock if tracefs lockdown is in effect
    - tracing: Fix histogram code when expression has same var as value
    - [powerpc*] xive: Discard ESB load value when interrupt is invalid
    - Revert "iwlwifi: mvm: fix scan config command size"
    - iwlwifi: mvm: don't send the IWL_MVM_RXQ_NSSN_SYNC notif to Rx queues
    - XArray: Fix infinite loop with entry at ULONG_MAX
    - XArray: Fix xa_find_after with multi-index entries
    - XArray: Fix xas_find returning too many entries
    - [x86] pinctrl: sunrisepoint: Add missing Interrupt Status register
      offset
    - [amd64] iommu/vt-d: Call __dmar_remove_one_dev_info with valid pointer
    - Input: keyspan-remote - fix control-message timeouts
    - [x86] Revert "Input: synaptics-rmi4 - don't increment rmiaddr for SMBus
      transfers"
    - [arm64,armhf] mmc: tegra: fix SDR50 tuning override
    - mmc: sdhci: fix minimum clock rate for v3 controller
    - Input: sur40 - fix interface sanity checks
    - Input: gtco - fix endpoint sanity check
    - Input: aiptek - fix endpoint sanity check
    - Input: pegasus_notetaker - fix endpoint sanity check
    - Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register
    - netfilter: nft_osf: add missing check for DREG attribute
    - [amd64] iommu/amd: Fix IOMMU perf counter clobbering during init
    - readdir: make user_access_begin() use the real access range
    - leds: gpio: Fix uninitialized gpio label for fwnode based probe
    - hwmon: (nct7802) Fix voltage limits to wrong registers
    - hwmon: (nct7802) Fix non-working alarm on voltages
    - scsi: RDMA/isert: Fix a recently introduced regression related to logout
    - tracing: xen: Ordered comparison of function pointers
    - iwlwifi: mvm: fix SKB leak on invalid queue
    - iwlwifi: mvm: fix potential SKB leak on TXQ TX
    - [x86] drm/i915/userptr: fix size calculation
    - xfrm: support output_mark for offload ESP packets
    - net, sk_msg: Don't check if sock is locked when tearing down psock
    - do_last(): fetch directory ->i_mode and ->i_uid before it's too late
      (CVE-2020-8428)
    - readdir: be more conservative with directory entry names
    - libertas: Fix two buffer overflows at parsing bss descriptor
      (CVE-2019-14896 CVE-2019-14897)
    - media: v4l2-ioctl.c: zero reserved fields for S/TRY_FMT
    - netfilter: ipset: use bitmap infrastructure completely
    - netfilter: nf_tables: add __nft_chain_type_get()
    - netfilter: nf_tables: autoload modules from the abort path
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.17
    - Bluetooth: btusb: fix non-atomic allocation in completion handler
    - orinoco_usb: fix interface sanity check
    - rsi_91x_usb: fix interface sanity check
    - usb: dwc3: pci: add ID for the Intel Comet Lake -V variant
    - [arm64,armhf] usb: host: xhci-tegra: set MODULE_FIRMWARE for tegra186
    - USB: serial: ir-usb: add missing endpoint sanity check
    - USB: serial: ir-usb: fix link-speed handling
    - USB: serial: ir-usb: fix IrLAP framing
    - [arm64,armhf] usb: dwc3: turn off VBUS when leaving host mode
    - [x86] usb: typec: fusb302: fix "op-sink-microwatt" default that was in
      mW
    - [x86] staging: vt6656: correct packet types for CTS protect, mode.
    - [x86] staging: vt6656: use NULLFUCTION stack on mac80211
    - [x86] staging: vt6656: Fix false Tx excessive retries reporting.
    - [arm64,armel] serial: 8250_bcm2835aux: Fix line mismatch on driver
      unbind
    - [armhf] serial: imx: fix a race condition in receive path
    - debugfs: Return -EPERM when locked down
    - component: do not dereference opaque pointer in debugfs
    - [arm*] binder: fix log spam for existing debugfs file creation.
    - [x86] mei: me: add comet point (lake) H device ids
    - crypto: chelsio - fix writing tfm flags to wrong place
    - CIFS: Fix task struct use-after-free on reconnect
    - cifs: set correct max-buffer-size for smb2_ioctl_init()
    - cifs: Fix memory allocation in __smb2_handle_cancelled_cmd()
    - ath9k: fix storage endpoint lookup
    - brcmfmac: fix interface sanity check
    - rtl8xxxu: fix interface sanity check
    - zd1211rw: fix storage endpoint lookup
    - net_sched: ematch: reject invalid TCF_EM_SIMPLE
    - net_sched: fix ops->bind_class() implementations
    - net_sched: walk through all child classes in tc_bind_tclass()
    - [arm64] net: socionext: fix possible user-after-free in
      netsec_process_rx
    - [arm64] net: socionext: fix xdp_result initialization in
      netsec_process_rx
    - udp: segment looped gso packets correctly
    - net: include struct nhmsg size in nh nlmsg size
    - rxrpc: Fix use-after-free in rxrpc_receive_data()
    - HID: multitouch: Add LG MELF0410 I2C touchscreen support
    - HID: Add quirk for Xin-Mo Dual Controller
    - HID: ite: Add USB id match for Acer SW5-012 keyboard dock
    - HID: asus: Ignore Asus vendor-page usage-code 0xff events
    - HID: Add quirk for incorrect input length on Lenovo Y720
    - HID: intel-ish-hid: ipc: add CMP device id
    - HID: wacom: Recognize new MobileStudio Pro PID
    - [x86] ASoC: SOF: fix fault at driver unload after failed probe
    - [x86] ASoC: SOF: Intel: hda: hda-dai: fix oops on hda_link .hw_free
    - drivers/hid/hid-multitouch.c: fix a possible null pointer access.
    - phy: qcom-qmp: Increase PHY ready timeout
    - [x86] ASoC: topology: Prevent use-after-free in
      snd_soc_get_pcm_runtime()
    - HID: intel-ish-hid: ipc: Add Tiger Lake PCI device ID
    - [arm64] watchdog: max77620_wdt: fix potential build errors
    - [armel,armhf] watchdog: orion: fix platform_get_irq() complaints
    - drivers/net/b44: Change to non-atomic bit operations on pwol_mask
    - [i386] net: wan: sdla: Fix cast from pointer to integer of different
      size
    - [arm64] gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP
    - [arm64] iommu/dma: fix variable 'cookie' set but not used
    - [arm64,armhf] stmmac: debugfs entry name is not be changed when udev
      rename device name.
    - atm: eni: fix uninitialized variable warning
    - HID: steam: Fix input device disappearing
    - [x86] ASoC: Intel: cht_bsw_rt5645: Add quirk for boards using
      pmc_plt_clk_0
    - drm/amdgpu/SRIOV: add navi12 pci id for SRIOV (v2)
    - libbpf: Fix BTF-defined map's __type macro handling of arrays
    - [x86] platform/x86: dell-laptop: disable kbd backlight on Inspiron 10xx
    - PCI: Add DMA alias quirk for Intel VCA NTB
    - media: dvbsky: add support for eyeTV Geniatech T2 lite
    - [armhf] bus: ti-sysc: Handle mstandby quirk and use it for musb
    - [armhf] bus: ti-sysc: Use swsup quirks also for am335x musb
    - [amd64,armhf] spi: pxa2xx: Add support for Intel Comet Lake-H
    - [amd64] iommu/amd: Support multiple PCI DMA aliases in device table
    - [amd64] iommu/amd: Support multiple PCI DMA aliases in IRQ Remapping
    - perf/imx_ddr: Add enhanced AXI ID filter support
    - [x86] mfd: intel-lpss: Add Intel Comet Lake PCH-H PCI IDs
    - mmc: sdhci-pci: Quirk for AMD SDHC Device 0x7906
    - mmc: sdhci-pci: Add support for Intel JSL
    - [armhf] bus: ti-sysc: Add module enable quirk for audio AESS
    - usb-storage: Disable UAS on JMicron SATA enclosure
    - ALSA: hda/realtek - Move some alc236 pintbls to fallback table
    - Bluetooth: Allow combination of BDADDR_PROPERTY and INVALID_BDADDR
      quirks
    - Bluetooth: btbcm: Use the BDADDR_PROPERTY quirk
    - [armhf] bus: ti-sysc: Fix missing force mstandby quirk handling
    - rsi: fix use-after-free on failed probe and unbind
    - rsi: fix use-after-free on probe errors
    - rsi: fix memory leak on failed URB submission
    - rsi: fix non-atomic allocation in completion handler
    - crypto: af_alg - Use bh_lock_sock in sk_destruct
    - [powerpc*] crypto: vmx - reject xts inputs that are too short
    - crypto: pcrypt - Fix user-after-free on module unload
    - [arm64] KVM: Write arch.mdcr_el2 changes since last vcpu_load on VHE
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.18
    - vfs: fix do_last() regression
    - cifs: fix soft mounts hanging in the reconnect code
    - e1000e: Drop unnecessary __E1000_DOWN bit twiddling
    - e1000e: Revert "e1000e: Make watchdog use delayed work"
    - gfs2: Another gfs2_find_jhead fix
    - perf c2c: Fix return type for histogram sorting comparision functions
    - PM / devfreq: Add new name attribute for sysfs
    - mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
    - reiserfs: Fix memory leak of journal device string
    - media: digitv: don't continue if remote control state can't be read
    - media: af9005: uninitialized variable printked
    - media: vp7045: do not read uninitialized values if usb transfer fails
    - media: gspca: zero usb_buf
    - media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0
    - tomoyo: Use atomic_t for statistics counter
    - ttyprintk: fix a potential deadlock in interrupt context issue
    - Bluetooth: Fix race condition in hci_release_sock()
    - cgroup: Prevent double killing of css when enabling threaded cgroup
    - [armhf] clk: sunxi-ng: v3s: Fix incorrect number of hw_clks.
    - [arm64] dts: meson-sm1-sei610: add gpio bluetooth interrupt
    - [armhf] dts: sun8i: a83t: Correct USB3503 GPIOs polarity
    - [armhf] dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint
      dt nodes
    - rseq: Unregister rseq for clone CLONE_VM
    - [arm64,armhf] clk: sunxi-ng: sun8i-r: Fix divider on APB0 clock
    - [arm64] clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order
    - mac80211: mesh: restrict airtime metric to peered established plinks
    - [armhf] clk: mmp2: Fix the order of timer mux parents
    - ASoC: rt5640: Fix NULL dereference on module unload
    - [s390x] zcrypt: move ap device reset from bus to driver code
    - i40e: Fix virtchnl_queue_select bitmap validation
    - ixgbevf: Remove limit of 10 entries for unicast filter list
    - ixgbe: Fix calculation of queue with VFs and flow director on interface
      flap
    - igb: Fix SGMII SFP module discovery for 100FX/LX.
    - iavf: remove current MAC address filter on VF reset
    - [x86] platform/x86: GPD pocket fan: Allow somewhat lower/higher
      temperature limits
    - [x86] platform/x86: intel_pmc_core: update Comet Lake platform driver
    - [x86] ASoC: SOF: Intel: fix HDA codec driver probe with multiple
      controllers
    - [x86] ASoC: hdac_hda: Fix error in driver removal after failed probe
    - qmi_wwan: Add support for Quectel RM500Q
    - [hppa/parisc] Use proper printk format for resource_size_t
    - wireless: fix enabling channel 12 for custom regulatory domain
    - cfg80211: Fix radar event during another phy CAC
    - mac80211: Fix TKIP replay protection immediately after key setup
    - [x86] perf/x86/intel/uncore: Add PCI ID of IMC for Xeon E3 V5 Family
    - [x86] perf/x86/intel/uncore: Remove PCIe3 unit for SNR
    - XArray: Fix xas_pause at ULONG_MAX
    - iwlwifi: pcie: allocate smaller dev_cmd for TX headers
    - iwlwifi: Don't ignore the cap field upon mcc update
    - iwlwifi: dbg: force stop the debug monitor HW
    - Input: evdev - convert kzalloc()/vzalloc() to kvzalloc()
    - vti[6]: fix packet tx through bpf_redirect()
    - xfrm interface: fix packet tx through bpf_redirect()
    - xfrm: interface: do not confirm neighbor when do pmtu update
    - [x86] scsi: fnic: do not queue commands during fwreset
    - [armhf] 8955/1: virt: Relax arch timer version check during early boot
    - r8152: get default setting of WOL before initializing
    - r8152: disable U2P3 for RTL8153B
    - r8152: Disable PLA MCU clock speed down
    - r8152: disable test IO for RTL8153B
    - r8152: avoid the MCU to clear the lanwake
    - r8152: disable DelayPhyPwrChg
    - qlcnic: Fix CPU soft lockup while collecting firmware dump
    - seq_tab_next() should increase position index
    - l2t_seq_next should increase position index
    - netfilter: conntrack: sctp: use distinct states for new SCTP connections
    - netfilter: nf_tables_offload: fix check the chain offload flag
    - net: Fix skb->csum update in inet_proto_csum_replace16().
    - btrfs: do not zero f_bavail if we have available space
    - flow_dissector: Fix to use new variables for port ranges in bpf hook
    - dm thin: fix use-after-free in metadata_pre_commit_callback
    - perf report: Fix no libunwind compiled warning break s390 issue
    - mm/migrate.c: also overwrite error when it is bigger than zero
    - [x86] ASoC: topology: fix soc_tplg_fe_link_create() - link->dobj
      initialization order
    - Revert "rsi: fix potential null dereference in rsi_probe()"
    - tracing/uprobe: Fix to make trace_uprobe_filter alignment safe
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.19
    - bnxt_en: Move devlink_register before registering netdev
    - gtp: use __GFP_NOWARN to avoid memalloc warning
    - l2tp: Allow duplicate session creation with UDP
    - net_sched: fix an OOB access in cls_tcindex
    - [arm64,armhf] net: stmmac: Delete txtimer in suspend()
    - bnxt_en: Fix TC queue mapping.
    - rxrpc: Fix use-after-free in rxrpc_put_local()
    - rxrpc: Fix insufficient receive notification generation
    - rxrpc: Fix missing active use pinning of rxrpc_local object
    - rxrpc: Fix NULL pointer deref due to call->conn being cleared on
      disconnect
    - tcp: clear tp->total_retrans in tcp_disconnect()
    - tcp: clear tp->delivered in tcp_disconnect()
    - tcp: clear tp->data_segs{in|out} in tcp_disconnect()
    - tcp: clear tp->segs_{in|out} in tcp_disconnect()
    - bnxt_en: Fix logic that disables Bus Master during firmware reset.
    - media: uvcvideo: Avoid cyclic entity chains due to malformed USB
      descriptors
    - netfilter: ipset: fix suspicious RCU usage in find_set_and_id
    - ipc/msg.c: consolidate all xxxctl_down() functions
    - tracing/kprobes: Have uname use __get_str() in print_fmt
    - tracing: Fix sched switch start/stop refcount racy updates
    - rcu: Use *_ONCE() to protect lockless ->expmask accesses
    - rcu: Avoid data-race in rcu_gp_fqs_check_wake()
    - srcu: Apply *_ONCE() to ->srcu_last_gp_end
    - rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special()
    - nvmet: Fix error print message at nvmet_install_queue function
    - nvmet: Fix controller use after free
    - Bluetooth: btusb: fix memory leak on fw
    - Bluetooth: btusb: Disable runtime suspend on Realtek devices
    - brcmfmac: Fix memory leak in brcmf_usbdev_qinit
    - [arm64,armhf] usb: dwc3: gadget: Check END_TRANSFER completion
    - [arm64,armhf] usb: dwc3: gadget: Delay starting transfer
    - usb: gadget: f_fs: set req->num_sgs as 0 for non-sg transfer
    - usb: gadget: legacy: set max_speed to super-speed
    - usb: gadget: f_ncm: Use atomic_t to track in-flight request
    - usb: gadget: f_ecm: Use atomic_t to track in-flight request
    - ALSA: usb-audio: Fix endianess in descriptor validation
    - ALSA: usb-audio: Annotate endianess in Scarlett gen2 quirk
    - ALSA: dummy: Fix PCM format loop in proc output
    - memcg: fix a crash in wb_workfn when a device disappears
    - mm/sparse.c: reset section's mem_map when fully deactivated
    - mmc: sdhci-pci: Make function amd_sdhci_reset static
    - utimes: Clamp the timestamps in notify_change()
    - mm/memory_hotplug: fix remove_memory() lockdep splat
    - mm: thp: don't need care deferred split queue in memcg charge move path
    - mm: move_pages: report the number of non-attempted pages
    - media/v4l2-core: set pages dirty upon releasing DMA buffers
    - media: v4l2-core: compat: ignore native command codes
    - media: v4l2-rect.h: fix v4l2_rect_map_inside() top/left adjustments
    - irqdomain: Fix a memory leak in irq_domain_push_irq()
    - [x86] cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
    - ALSA: hda: Apply aligned MMIO access only conditionally
    - ALSA: hda: Add Clevo W65_67SB the power_save blacklist
    - ALSA: hda: Add JasperLake PCI ID and codec vid
    - [arm64] acpi: fix DAIF manipulation with pNMI
    - [arm64] KVM: Correct PSTATE on exception entry
    - [arm64,armhf] KVM: Correct CPSR on exception entry
    - [arm64,armhf] KVM: Correct AArch32 SPSR on exception entry
    - [arm64] KVM: Only sign-extend MMIO up to register width
    - [s390x] mm: fix dynamic pagetable upgrade for hugetlbfs
    - [powerpc*] xmon: don't access ASDR in VMs
    - [powerpc*] pseries: Advance pfn if section is not present in
      lmb_is_removable()
    - tracing: Fix now invalid var_ref_vals assumption in trace action
    - [arm64,armhf] PCI: tegra: Fix return value check of
      pm_runtime_get_sync()
    - mmc: spi: Toggle SPI polarity, do not hardcode it
    - [x86] ACPI: video: Do not export a non working backlight interface on
      MSI MS-7721 boards
    - ACPI / battery: Deal with design or full capacity being reported as -1
    - ACPI / battery: Use design-cap for capacity calculations if full-cap is
      not available
    - ACPI / battery: Deal better with neither design nor full capacity not
      being reported
    - alarmtimer: Unregister wakeup source when module get fails
    - fscrypt: don't print name of busy file when removing key
    - ubifs: don't trigger assertion on invalid no-key filename
    - ubifs: Fix wrong memory allocation
    - ubifs: Fix FS_IOC_SETFLAGS unexpectedly clearing encrypt flag
    - ubifs: Fix deadlock in concurrent bulk-read and writepage
    - [x86] ASoC: SOF: core: free trace on errors
    - [x86] hv_balloon: Balloon up according to request page number
    - mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile
    - nvmem: core: fix memory abort in cleanup path
    - crypto: api - Check spawn->alg under lock in crypto_drop_spawn
    - padata: Remove broken queue flushing
    - fs: allow deduplication of eof block into the end of the destination
      file
    - erofs: fix out-of-bound read for shifted uncompressed block
    - scsi: megaraid_sas: Do not initiate OCR if controller is not in ready
      state
    - scsi: qla2xxx: Fix mtcp dump collection failure
    - cpupower: Revert library ABI changes from commit ae2917093fb60bdc1ed3e
    - [arm64,armhf] power: supply: axp20x_ac_power: Fix reporting online
      status
    - ovl: fix wrong WARN_ON() in ovl_cache_update_ino()
    - ovl: fix lseek overflow on 32bit
    - f2fs: choose hardlimit when softlimit is larger than hardlimit in
      f2fs_statfs_project()
    - f2fs: fix miscounted block limit in f2fs_statfs_project()
    - f2fs: code cleanup for f2fs_statfs_project()
    - f2fs: fix dcache lookup of !casefolded directories
    - f2fs: fix race conditions in ->d_compare() and ->d_hash()
    - PM: core: Fix handling of devices deleted during system-wide resume
    - cpufreq: Avoid creating excessively large stack frames
    - [armel,armhf] dma-api: fix max_pfn off-by-one error in __dma_supported()
    - dm zoned: support zone sizes smaller than 128MiB
    - dm space map common: fix to ensure new block isn't already in use
    - dm writecache: fix incorrect flush sequence when doing SSD mode commit
    - dm crypt: fix GFP flags passed to skcipher_request_alloc()
    - dm crypt: fix benbi IV constructor crash if used in authenticated mode
    - dm thin metadata: use pool locking at end of dm_pool_metadata_close
    - dm: fix potential for q->make_request_fn NULL pointer
    - scsi: qla2xxx: Fix stuck login session using prli_pend_timer
    - [x86] ASoC: SOF: Introduce state machine for FW boot
    - [x86] ASoC: SOF: core: release resources on errors in probe_continue
    - tracing: Annotate ftrace_graph_hash pointer with __rcu
    - tracing: Annotate ftrace_graph_notrace_hash pointer with __rcu
    - ftrace: Add comment to why rcu_dereference_sched() is open coded
    - ftrace: Protect ftrace_graph_hash with ftrace_sync
    - crypto: pcrypt - Avoid deadlock by using per-instance padata queues
    - btrfs: fix improper setting of scanned for range cyclic write cache
      pages
    - btrfs: Handle another split brain scenario with metadata uuid feature
    - [riscv64] bpf: Fix broken BPF tail calls
    - bpf, devmap: Pass lockdep expression to RCU lists
    - libbpf: Fix realloc usage in bpf_core_find_cands
    - crypto: api - fix unexpectedly getting generic implementation
    - [arm64] crypto: hisilicon - Use the offset fields in sqe to avoid need
      to split scatterlists
    - [x86] crypto: ccp - set max RSA modulus size for v3 platform devices as
      well
    - [arm64] crypto: arm64/ghash-neon - bump priority to 150
    - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request
    - crypto: api - Fix race condition in crypto_spawn_alg
    - [powerpc*] futex: Fix incorrect user access blocking
    - scsi: qla2xxx: Fix unbound NVME response length
    - NFS: Fix memory leaks and corruption in readdir
    - NFS: Directory page cache pages need to be locked when read
    - nfsd: fix filecache lookup
    - jbd2_seq_info_next should increase position index
    - ext4: fix deadlock allocating crypto bounce page from mempool
    - ext4: fix race conditions in ->d_compare() and ->d_hash()
    - Btrfs: fix missing hole after hole punching and fsync when using
      NO_HOLES
    - Btrfs: make deduplication with range including the last block work
    - Btrfs: fix infinite loop during fsync after rename operations
    - btrfs: set trans->drity in btrfs_commit_transaction
    - btrfs: drop log root for dropped roots
    - Btrfs: fix race between adding and putting tree mod seq elements and
      nodes
    - btrfs: flush write bio if we loop in extent_write_cache_pages
    - btrfs: Correctly handle empty trees in find_first_clear_extent_bit
    - [armhf] tegra: Enable PLLP bypass during Tegra124 LP1
    - iwlwifi: don't throw error when trying to remove IGTK
    - mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
    - sunrpc: expiry_time should be seconds not timeval
    - gfs2: fix gfs2_find_jhead that returns uninitialized jhead with seq 0
    - gfs2: move setting current->backing_dev_info
    - gfs2: fix O_SYNC write handling
    - drm/rect: Avoid division by zero
    - media: iguanair: fix endpoint sanity check
    - media: rc: ensure lirc is initialized before registering input device
    - xen/balloon: Support xend-based toolstack take two
    - watchdog: fix UAF in reboot notifier handling in watchdog core code
    - bcache: add readahead cache policy options via sysfs interface
    - eventfd: track eventfd_signal() recursion depth
    - aio: prevent potential eventfd recursion on poll
    - [x86] KVM: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
    - [x86] KVM: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
    - [x86] KVM: Protect pmu_intel.c from Spectre-v1/L1TF attacks
    - [x86] KVM: Protect DR-based index computations from Spectre-v1/L1TF
      attacks
    - [x86] KVM: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
    - [x86] KVM: Protect kvm_hv_msr_[get|set]_crash_data() from
      Spectre-v1/L1TF attacks
    - [x86] KVM: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
    - [x86] KVM: Protect MSR-based index computations in pmu.h from
      Spectre-v1/L1TF attacks
    - [x86] KVM: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
    - [x86] KVM: Protect MSR-based index computations from Spectre-v1/L1TF
      attacks in x86.c
    - [x86] KVM: Protect x86_decode_insn from Spectre-v1/L1TF attacks
    - [x86] KVM: Protect MSR-based index computations in
      fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks
    - [x86] KVM: Fix potential put_fpu() w/o load_fpu() on MPX platform
    - [powerpc*] KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails
    - [powerpc*] KVM: PPC: Book3S PR: Free shared page if mmu initialization
      fails
    - [x86] kvm/svm: PKU not currently supported
    - [x86] kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit
      (CVE-2019-3016)
    - [x86] kvm: Introduce kvm_(un)map_gfn() (CVE-2019-3016)
    - [x86] KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
      (CVE-2019-3016)
    - [x86] kvm: Cache gfn to pfn translation (CVE-2019-3016)
    - [x86] KVM: Clean up host's steal time structure (CVE-2019-3016)
    - [x86] KVM: VMX: Add non-canonical check on writes to RTIT address MSRs
    - [x86] KVM: Don't let userspace set host-reserved cr4 bits
    - [x86] KVM: Free wbinvd_dirty_mask if vCPU creation fails
    - [x86] KVM: Handle TIF_NEED_FPU_LOAD in kvm_{load,put}_guest_fpu()
    - [x86] KVM: Ensure guest's FPU state is loaded when accessing for
      emulation
    - [x86] KVM: Revert "KVM: X86: Fix fpu state crash in kvm guest"
    - [s390x] KVM: do not clobber registers during guest reset/store status
    - ocfs2: fix oops when writing cloned file
    - mm/page_alloc.c: fix uninitialized memmaps on a partially populated last
      section
    - mm/mmu_gather: invalidate TLB correctly on batch allocation failure and
      flush
    - [arm64,armhf] clk: tegra: Mark fuse clock as critical
    - virtio-balloon: initialize all vq callbacks
    - virtio-pci: check name when counting MSI-X vectors
    - fix up iter on short count in fuse_direct_io()
    - broken ping to ipv6 linklocal addresses on debian buster
    - percpu: Separate decrypted varaibles anytime encryption can be enabled
    - scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return
      type
    - scsi: csiostor: Adjust indentation in csio_device_reset
    - scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
    - scsi: ufs: Recheck bkops level if bkops is disabled
    - mtd: spi-nor: Split mt25qu512a (n25q512a) entry into two
    - [arm64] phy: qualcomm: Adjust indentation in read_poll_timeout
    - ext2: Adjust indentation in ext2_fill_super
    - [arm64] drm: msm: mdp4: Adjust indentation in mdp4_dsi_encoder_enable
    - [x86] NFC: pn544: Adjust indentation in pn544_hci_check_presence
    - ppp: Adjust indentation into ppp_async_input
    - [armhf] net: smc911x: Adjust indentation in smc911x_phy_configure
    - net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
    - IB/mlx5: Fix outstanding_pi index for GSI qps
    - IB/core: Fix ODP get user pages flow
    - nfsd: fix delay timer on 32-bit architectures
    - nfsd: fix jiffies/time_t mixup in LRU list
    - nfsd: Return the correct number of bytes written to the file
    - virtio-balloon: Fix memory leak when unloading while hinting is in
      progress
    - virtio_balloon: Fix memory leaks on errors in virtballoon_probe()
    - ubifs: Fix memory leak from c->sup_node
    - regulator: core: Add regulator_is_equal() helper
    - [armhf] ASoC: sgtl5000: Fix VDDA and VDDIO comparison
    - bonding/alb: properly access headers in bond_alb_xmit()
    - devlink: report 0 after hitting end in region read
    - [armhf] net: dsa: b53: Always use dev->vlan_enabled in
      b53_configure_vlan()
    - [armhf] net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port
    - [arm64,armhf] net: mvneta: move rx_dropped and rx_errors in per-cpu
      stats
    - net_sched: fix a resource leak in tcindex_set_parms()
    - [arm64] net: stmmac: fix a possible endless loop
    - [arm64,riscv64] net: macb: Remove unnecessary alignment check for TSO
    - [arm64,riscv64] net: macb: Limit maximum GEM TX length in TSO
    - ipv6/addrconf: fix potential NULL deref in inet6_set_link_af()
    - qed: Fix timestamping issue for L2 unicast ptp packets.
    - drop_monitor: Do not cancel uninitialized work item
    - net/mlx5: Fix deadlock in fs_core
    - net/mlx5: Deprecate usage of generic TLS HW capability bit
    - [x86] ASoC: Intel: skl_hda_dsp_common: Fix global-out-of-bounds bug
    - [x86] timer: Don't skip PIT setup when APIC is disabled or in legacy
      mode
    - btrfs: use bool argument in free_root_pointers()
    - btrfs: free block groups after free'ing fs trees
    - drm/dp_mst: Remove VCPI while disabling topology mgr
    - [x86] KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM
    - [x86] KVM: x86: use CPUID to locate host page table reserved bits
    - [x86] KVM: x86: Use gpa_t for cr2/gpa to fix TDP support on 32-bit KVM
    - [x86] KVM: x86: fix overlap between SPTE_MMIO_MASK and generation
    - [x86] KVM: nVMX: vmread should not set rflags to specify success in case
      of #PF
    - KVM: Use vcpu-specific gva->hva translation when querying host page size
    - KVM: Play nice with read-only memslots when querying host page size
    - cifs: fail i/o on soft mounts if sessionsetup errors out
    - [x86] apic/msi: Plug non-maskable MSI affinity race
    - clocksource: Prevent double add_timer_on() for watchdog_timer
    - perf/core: Fix mlock accounting in perf_mmap()
    - rxrpc: Fix service call disconnection

  [ Aurelien Jarno ]
  * [mips*/malta] Enable POWER_RESET_PIIX4_POWEROFF.

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.4.13-rt6
  * [rt] Update to 5.4.13-rt7
  * [rt] Update to 5.4.17-rt8
  * [rt] Update to 5.4.17-rt9
  * Bump ABI to 4.
  * Revert "cpupower: Revert library ABI changes from commit
    ae2917093fb60bdc1ed3e"

  [ Ben Hutchings ]
  * linux-perf: Build with CORESIGHT=1 (thanks to Wookey) (Closes: #924673)

  [ Steve McIntyre ]
  * [arm64] Include the Hisilicon Hibmc drm driver in fb-modules
    Closes: #944546)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 13 Feb 2020 06:14:49 +0100

linux (5.4.13-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.9
    - nvme_fc: add module to ops template to allow module references
    - nvme-fc: fix double-free scenarios on hw queues
    - drm/amdgpu: add check before enabling/disabling broadcast mode
    - drm/amdgpu: add header line for power profile on Arcturus
    - drm/amdgpu: add cache flush workaround to gfx8 emit_fence
    - nvme/pci: Fix write and poll queue types
    - nvme/pci: Fix read queue count
    - [armhf] iio: st_accel: Fix unused variable warning
    - PM / devfreq: Fix devfreq_notifier_call returning errno
    - PM / devfreq: Set scaling_max_freq to max on OPP notifier error
    - PM / devfreq: Don't fail devfreq_dev_release if not in list
    - afs: Fix afs_find_server lookups for ipv4 peers
    - afs: Fix SELinux setting security label on /afs
    - RDMA/cma: add missed unregister_pernet_subsys in init failure
    - rxe: correctly calculate iCRC for unaligned payloads
    - scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func
    - scsi: qla2xxx: Use explicit LOGO in target mode
    - scsi: qla2xxx: Drop superfluous INIT_WORK of del_work
    - scsi: qla2xxx: Don't call qlt_async_event twice
    - scsi: qla2xxx: Fix PLOGI payload and ELS IOCB dump length
    - scsi: qla2xxx: Configure local loop for N2N target
    - scsi: qla2xxx: Send Notify ACK after N2N PLOGI
    - scsi: qla2xxx: Don't defer relogin unconditonally
    - scsi: qla2xxx: Ignore PORT UPDATE after N2N PLOGI
    - scsi: iscsi: qla4xxx: fix double free in probe
    - scsi: libsas: stop discovering if oob mode is disconnected
      (CVE-2019-19965)
    - scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func
    - [x86] staging/wlan-ng: add CRC32 dependency in Kconfig
    - drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit
    - drm/nouveau: Fix drm-core using atomic code-paths on pre-nv50 hardware
    - drm/nouveau/kms/nv50-: fix panel scaling
    - usb: gadget: fix wrong endpoint desc
    - net: make socket read/write_iter() honor IOCB_NOWAIT
    - afs: Fix mountpoint parsing
    - afs: Fix creation calls in the dynamic root to fail with EOPNOTSUPP
    - raid5: need to set STRIPE_HANDLE for batch head
    - md: raid1: check rdev before reference in raid1_sync_request func
    - [s390x] cpum_sf: Adjust sampling interval to avoid hitting sample limits
    - [s390x] cpum_sf: Avoid SBD overflow condition in irq handler
    - RDMA/counter: Prevent auto-binding a QP which are not tracked with res
    - IB/mlx4: Follow mirror sequence of device add during device removal
    - IB/mlx5: Fix steering rule of drop and count
    - xen-blkback: prevent premature module unload
    - xen/balloon: fix ballooned page accounting without hotplug enabled
    - PM / hibernate: memory_bm_find_bit(): Tighten node optimisation
    - ALSA: hda/realtek - Add Bass Speaker and fixed dac for bass speaker
    - ALSA: hda/realtek - Enable the bass speaker of ASUS UX431FLC
    - PCI: Add a helper to check Power Resource Requirements _PR3 existence
    - ALSA: hda: Allow HDA to be runtime suspended when dGPU is not bound to a
      driver
    - PCI: Fix missing inline for pci_pr3_present()
    - ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen
    - tcp: fix data-race in tcp_recvmsg()
    - shmem: pin the file in shmem_fault() if mmap_sem is dropped
    - taskstats: fix data-race
    - ALSA: hda - Downgrade error message for single-cmd fallback
    - netfilter: nft_tproxy: Fix port selector on Big Endian
    - block: add bio_truncate to fix guard_bio_eod
    - mm: drop mmap_sem before calling balance_dirty_pages() in write fault
    - ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code
    - ALSA: usb-audio: fix set_format altsetting sanity check
    - ALSA: usb-audio: set the interface format after resume on Dell WD19
    - ALSA: hda - Apply sync-write workaround to old Intel platforms, too
    - ALSA: hda/realtek - Add headset Mic no shutup for ALC283
    - [arm64,armhf] drm/sun4i: hdmi: Remove duplicate cleanup calls
    - [mips*] BPF: Disable MIPS32 eBPF JIT
    - [mips*] BPF: eBPF JIT: check for MIPS ISA compliance in Kconfig
    - [mips*] Avoid VDSO ABI breakage due to global register variable
    - media: pulse8-cec: fix lost cec_transmit_attempt_done() call
    - media: cec: CEC 2.0-only bcast messages were ignored
    - media: cec: avoid decrementing transmit_queue_sz if it is 0
    - media: cec: check 'transmit_in_progress', not 'transmitting'
    - mm/memory_hotplug: shrink zones when offlining memory
    - mm/zsmalloc.c: fix the migrated zspage statistics.
    - memcg: account security cred as well to kmemcg
    - mm: move_pages: return valid node id in status if the page is already on
      the target node
    - mm/oom: fix pgtables units mismatch in Killed process message
    - ocfs2: fix the crash due to call ocfs2_get_dlm_debug once less
    - [x86,arm64] pstore/ram: Write new dumps to start of recycled zones
    - [x86,arm64] pstore/ram: Fix error-path memory leak in
      persistent_ram_new() callers
    - locks: print unsigned ino in /proc/locks
    - seccomp: Check that seccomp_notif is zeroed out by the user
    - Btrfs: fix infinite loop during nocow writeback due to race
    - compat_ioctl: block: handle Persistent Reservations
    - compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE
    - compat_ioctl: block: handle BLKGETZONESZ/BLKGETNRZONES
    - bpf: Fix precision tracking for unbounded scalars
    - ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys()
    - libata: Fix retrieving of active qcs
    - gpiolib: fix up emulated open drain outputs
    - [riscv64] clocksource: riscv: add notrace to riscv_sched_clock
    - [riscv64] ftrace: correct the condition logic in function graph tracer
    - tracing: Fix lock inversion in trace_event_enable_tgid_record()
    - tracing: Avoid memory leak in process_system_preds()
    - tracing: Have the histogram compare functions convert to u64 first
    - tracing: Fix endianness bug in histogram trigger
    - io_uring: use current task creds instead of allocating a new one
    - mm/gup: fix memory leak in __gup_benchmark_ioctl
    - apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock
    - dmaengine: virt-dma: Fix access after free in vchan_complete()
    - [i386] ALSA: cs4236: fix error return comparison of an unsigned integer
    - ALSA: pcm: Yet another missing check of non-cached buffer type
    - ALSA: firewire-motu: Correct a typo in the clock proc string
    - scsi: lpfc: Fix rpi release when deleting vport
    - exit: panic before exit_mm() on global init exit
    - [arm64] Revert support for execute-only user mappings
    - ftrace: Avoid potential division by zero in function profiler
    - [arm64] drm/msm: include linux/sched/task.h
    - PM / devfreq: Check NULL governor in available_governors_show
    - sunrpc: fix crash when cache_head become valid before update
    - nfsd4: fix up replay_matches_cache()
    - [powerpc*] Chunk calls to flush_dcache_range in arch_*_memory
    - [x86,arm64] HID: i2c-hid: Reset ALPS touchpads on resume
    - net/sched: annotate lockless accesses to qdisc->empty
    - kernel/module.c: wakeup processes in module_wq on module unload
    - ACPI: sysfs: Change ACPI_MASKABLE_GPE_MAX to 0x100
    - perf callchain: Fix segfault in thread__resolve_callchain_sample()
    - [amd64] iommu/vt-d: Remove incorrect PSI capability check
    - cifs: Fix potential softlockups while refreshing DFS cache
    - xfs: don't check for AG deadlock for realtime files in bunmapi
    - [x86] platform/x86: pmc_atom: Add Siemens CONNECT X300 to
      critclk_systems DMI table
    - netfilter: nf_queue: enqueue skbs with NULL dst
    - [arm64,armhf] regulator: axp20x: Fix axp20x_set_ramp_delay
    - [arm64,armhf] regulator: axp20x: Fix AXP22x ELDO2 regulator enable
      bitmask
    - [powerpc*] mm: Mark get_slice_psize() & slice_addr_is_low() as notrace
    - Bluetooth: btusb: fix PM leak in error case of setup
    - Bluetooth: delete a stray unlock
    - Bluetooth: Fix memory leak in hci_connect_le_scan
    - [arm64] dts: meson-gxl-s905x-khadas-vim: fix uart_A bluetooth node
    - [arm64] dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node
    - media: flexcop-usb: ensure -EIO is returned on error condition
    - media: usb: fix memory leak in af9005_identify_state (CVE-2019-18809)
    - [arm64] dts: meson: odroid-c2: Disable usb_otg bus to avoid power failed
      warning
    - [arm64] tty: serial: msm_serial: Fix lockup for sysrq and oops
    - cifs: Fix lookup of root ses in DFS referral cache
    - fs: cifs: Fix atime update check vs mtime
    - fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP
    - ath9k_htc: Modify byte order for an error message
    - ath9k_htc: Discard undersized packets
    - [x86] drm/i915/execlists: Fix annotation for decoupling virtual request
    - xfs: periodically yield scrub threads to the scheduler
    - net: add annotations on hh->hh_len lockless accesses
    - ubifs: ubifs_tnc_start_commit: Fix OOB in layout_in_gaps
    - btrfs: get rid of unique workqueue helper functions
    - Btrfs: only associate the locked page with one async_chunk struct
    - [s390x] smp: fix physical to logical CPU map for SMT
    - mm/sparse.c: mark populate_section_memmap as __meminit
    - xen/blkback: Avoid unmapping unmapped grant pages
    - lib/ubsan: don't serialize UBSAN report
    - [x86] perf/x86/intel/bts: Fix the use of page_private()
    - net: annotate lockless accesses to sk->sk_pacing_shift
    - mm/hugetlb: defer freeing of huge pages if in non-task context
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.10
    - [powerpc*] pmem: Fix kernel crash due to wrong range value usage in
      flush_dcache_range
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.11
    - bpf: Fix passing modified ctx to ld/abs/ind instruction
    - [x86] ASoC: rt5682: fix i2c arbitration lost issue
    - spi: pxa2xx: Add support for Intel Jasper Lake
    - regulator: fix use after free issue
    - ASoC: max98090: fix possible race conditions
    - gpio: Handle counting of Freescale chipselects
    - netfilter: ctnetlink: netns exit must wait for callbacks
    - [x86] intel: Disable HPET on Intel Ice Lake platforms
    - netfilter: nf_tables_offload: Check for the NETDEV_UNREGISTER event
    - mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
      (CVE-2019-14901)
    - regulator: core: fix regulator_register() error paths to properly
      release rdev
    - [x86] efi: Update e820 with reserved EFI boot services data to fix kexec
      breakage
    - [x86] ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89
    - efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs
    - efi/gop: Return EFI_SUCCESS if a usable GOP was found
    - efi/gop: Fix memory leak in __gop_query32/64()
    - [x86,arm64] efi/earlycon: Remap entire framebuffer after page
      initialization
    - netfilter: uapi: Avoid undefined left-shift in xt_sctp.h
    - netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in
      named sets
    - netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END
    - netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()
    - netfilter: nf_tables: skip module reference count bump on object updates
    - netfilter: nf_tables_offload: return EOPNOTSUPP if rule specifies no
      actions
    - [arm64] spi: spi-cavium-thunderx: Add missing pci_release_regions()
    - [arm*] reset: Do not register resource data for missing resets
    - [x86] ASoC: topology: Check return value for snd_soc_add_dai_link()
    - [x86] ASoC: topology: Check return value for soc_tplg_pcm_create()
    - [x86] ASoC: SOF: loader: snd_sof_fw_parse_ext_data log warning on
      unknown header
    - [x86] ASoC: SOF: Intel: split cht and byt debug window sizes
    - [armhf] dts: am335x-sancloud-bbe: fix phy mode
    - [riscv64] bpf, riscv: Limit to 33 tail calls
    - [mips64el,mipsel] bpf, mips: Limit to 33 tail calls
    - perf header: Fix false warning when there are no duplicate cache entries
    - [armhf] spi: spi-ti-qspi: Fix a bug when accessing non default CS
    - [armhf] bus: ti-sysc: Fix missing reset delay handling
    - clk: walk orphan list on clock provider registration
    - mac80211: fix TID field in monitor mode transmit
    - cfg80211: fix double-free after changing network namespace
    - pinctrl: pinmux: fix a possible null pointer in
      pinmux_can_be_used_for_gpio
    - [powerpc*] Ensure that swiotlb buffer is allocated from low memory
    - btrfs: Fix error messages in qgroup_rescan_init
    - Btrfs: fix cloning range with a hole when using the NO_HOLES feature
    - [powerpc*] vcpu: Assume dedicated processors as non-preempt
    - [powerpc*] spinlocks: Include correct header for static key
    - btrfs: handle error in btrfs_cache_block_group
    - Btrfs: fix hole extent items with a zero size after range cloning
    - [powerpc*] ocxl: Fix potential memory leak on context creation
    - bpf: Clear skb->tstamp in bpf_redirect when necessary
    - bnx2x: Do not handle requests from VFs after parity
    - bnx2x: Fix logic to get total no. of PFs per engine
    - cxgb4: Fix kernel panic while accessing sge_info
    - net: usb: lan78xx: Fix error message format specifier
    - [hppa/parisc] add missing __init annotation
    - rfkill: Fix incorrect check to avoid NULL pointer dereference
    - staging: axis-fifo: add unspecified HAS_IOMEM dependency
    - [arm*] iommu/iova: Init the struct iova to fix the possible memleak
    - [x86] perf/x86: Fix potential out-of-bounds access
    - [x86] perf/x86/intel: Fix PT PMI handling
    - sched/psi: Fix sampling error and rare div0 crashes with cgroups and
      high uptime
    - psi: Fix a division error in psi poll()
    - [x86] usb: typec: fusb302: Fix an undefined reference to
      'extcon_get_state'
    - block: end bio with BLK_STS_AGAIN in case of non-mq devs and REQ_NOWAIT
    - fs: avoid softlockups in s_inodes iterators
    - fs: call fsnotify_sb_delete after evict_inodes
    - [arm64] iommu/dma: Relax locking in iommu_dma_prepare_msi()
    - io_uring: don't wait when under-submitting
    - clk: Move clk_core_reparent_orphans() under CONFIG_OF
    - [arm64,armhf] net: stmmac: Determine earlier the size of RX buffer
    - [arm64,armhf] net: stmmac: Do not accept invalid MTU values
    - [arm64,armhf] net: stmmac: xgmac: Clear previous RX buffer size
    - [arm64,armhf] net: stmmac: RX buffer size must be 16 byte aligned
    - [arm64,armhf] net: stmmac: Always arm TX Timer at end of transmission
      start
    - xsk: Add rcu_read_lock around the XSK wakeup
    - net/mlx5e: Fix concurrency issues between config flow and XSK
    - net/i40e: Fix concurrency issues between config flow and XSK
    - net/ixgbe: Fix concurrency issues between config flow and XSK
    - [arm64] cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list
    - block: Fix a lockdep complaint triggered by request queue flushing
    - [s390x] dasd/cio: Interpret ccw_device_get_mdc return value correctly
    - [s390x] dasd: fix memleak in path handling error case
    - block: fix memleak when __blk_rq_map_user_iov() is failed
    - sbitmap: only queue kyber's wait callback if not already active
    - [s390x] qeth: handle error due to unsupported transport mode
    - [s390x] qeth: fix promiscuous mode after reset
    - [s390x] qeth: don't return -ENOTSUPP to userspace
    - llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and
      _test_c)
    - [x86] hv_netvsc: Fix unwanted rx_table reset
    - gtp: fix bad unlock balance in gtp_encap_enable_socket
    - macvlan: do not assume mac_header is set in macvlan_broadcast()
    - [arm64,armhf] net: dsa: mv88e6xxx: Preserve priority when setting CPU
      port.
    - [armhf] net: freescale: fec: Fix ethtool -d runtime PM
    - [arm64,armhf] net: stmmac: dwmac-sun8i: Allow all RGMII modes
    - [arm64,armhf] net: stmmac: dwmac-sunxi: Allow all RGMII modes
    - [arm64,armhf] net: stmmac: Fixed link does not need MDIO Bus
    - net: usb: lan78xx: fix possible skb leak
    - pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
    - sch_cake: avoid possible divide by zero in cake_enqueue()
    - sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY
    - tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK
    - vxlan: fix tos value before xmit
    - net: sch_prio: When ungrafting, replace with FIFO
    - vlan: fix memory leak in vlan_dev_set_egress_priority
    - vlan: vlan_changelink() should propagate errors
    - [arm64,riscv64] macb: Don't unregister clks unconditionally
    - net/mlx5: Move devlink registration before interfaces load
    - [arm64,armhf] net: dsa: mv88e6xxx: force cmode write on 6141/6341
    - net/mlx5e: Always print health reporter message to dmesg
    - net/mlx5: DR, No need for atomic refcount for internal SW steering
      resources
    - net/mlx5e: Fix hairpin RSS table size
    - net/mlx5: DR, Init lists that are used in rule's member
    - [arm64,armhf] usb: dwc3: gadget: Fix request complete check
    - USB: core: fix check for duplicate endpoints
    - USB: serial: option: add Telit ME910G1 0x110a composition
    - usb: missing parentheses in USE_NEW_SCHEME
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.12
    - chardev: Avoid potential use-after-free in 'chrdev_open()'
    - i2c: fix bus recovery stop mode timing
    - [x86] powercap: intel_rapl: add NULL pointer check to
      rapl_mmio_cpu_online()
    - [arm64,armhf] usb: chipidea: host: Disable port power only if previously
      enabled
    - ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5
    - ALSA: hda/realtek - Add new codec supported for ALCS1200A
    - ALSA: hda/realtek - Set EAPD control to default for ALC222
    - ALSA: hda/realtek - Add quirk for the bass speaker on Lenovo Yoga X1 7th
      gen
    - tpm: Revert "tpm_tis: reserve chip for duration of tpm_tis_core_init"
    - tpm: Revert "tpm_tis_core: Set TPM_CHIP_FLAG_IRQ before probing for
      interrupts"
    - tpm: Revert "tpm_tis_core: Turn on the TPM before probing IRQ's"
    - tpm: Handle negative priv->response_len in tpm_common_read()
    - [arm64,armhf] rtc: sun6i: Add support for RTC clocks on R40
    - kernel/trace: Fix do not unregister tracepoints when register
      sched_migrate_task fail
    - tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined
    - tracing: Change offset type to s32 in preempt/irq tracepoints
    - HID: Fix slab-out-of-bounds read in hid_field_extract
    - HID: uhid: Fix returning EPOLLOUT from uhid_char_poll
    - HID: hidraw: Fix returning EPOLLOUT from hidraw_poll
    - HID: hid-input: clear unmapped usages
    - Input: add safety guards to input_set_keycode()
    - [x86] drm/i915: Add Wa_1408615072 and Wa_1407596294 to icl,ehl
    - [arm64,armhf] drm/sun4i: tcon: Set RGB DCLK min. divider based on
      hardware model
    - drm/fb-helper: Round up bits_per_pixel if possible
    - drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ
    - [x86] drm/i915: Add Wa_1407352427:icl,ehl
    - [x86] drm/i915/gt: Mark up virtual engine uabi_instance
    - [amd64] IB/hfi1: Adjust flow PSN with the correct resync_psn
    - can: kvaser_usb: fix interface sanity check
    - can: gs_usb: gs_usb_probe(): use descriptors of current altsetting
    - gpiolib: acpi: Turn dmi_system_id table into a generic quirk table
    - gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism
    - pstore/ram: Regularize prz label allocation lifetime
    - [x86] staging: vt6656: set usb_set_intfdata on driver fail.
    - [x86] staging: vt6656: Fix non zero logical return of, usb_control_msg
    - USB: serial: option: add ZLP support for 0x1bc7/0x9010
    - [arm64,armhf] usb: musb: fix idling for suspend after disconnect
      interrupt
    - [arm64,armhf] usb: musb: Disable pullup at init
    - [arm64,armhf] usb: musb: dma: Correct parameter passed to IRQ handler
    - [x86] staging: comedi: adv_pci1710: fix AI channels 16-31 for PCI-1713
    - [x86] staging: vt6656: correct return of vnt_init_registers.
    - [x86] staging: vt6656: limit reg output to block size
    - staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21
    - serdev: Don't claim unsupported ACPI serial devices
    - [amd64] iommu/vt-d: Fix adding non-PCI devices to Intel IOMMU
    - tty: link tty and port before configuring it as console
    - tty: always relink the port
    - [arm64] Move __ARCH_WANT_SYS_CLONE3 definition to uapi headers
    - [arm64] Implement copy_thread_tls
    - [arm*] Implement copy_thread_tls
    - [hppa/parisc] Implement copy_thread_tls
    - [riscv64] Implement copy_thread_tls
    - clone3: ensure copy_thread_tls is implemented
    - um: Implement copy_thread_tls
    - [x86] staging: vt6656: remove bool from vnt_radio_power_on ret
    - mwifiex: fix possible heap overflow in mwifiex_process_country_ie()
      (CVE-2019-14895)
    - mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf
      (CVE-2019-19056)
    - rpmsg: char: release allocated memory (CVE-2019-19053)
    - scsi: bfa: release allocated memory in case of error (CVE-2019-19066)
    - rtl8xxxu: prevent leaking urb (CVE-2019-19068)
    - ath10k: fix memory leak (CVE-2019-19078)
    - HID: hiddev: fix mess in hiddev_open()
    - USB: Fix: Don't skip endpoint descriptors with maxpacket=0
    - netfilter: arp_tables: init netns pointer in xt_tgchk_param struct
    - netfilter: conntrack: dccp, sctp: handle null timeout argument
    - netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
    - [x86] drm/i915/gen9: Clear residual context state on context switch
      (CVE-2019-14615)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.13
    - HID: hidraw, uhid: Always report EPOLLOUT
    - [amd64] IB/hfi1: Don't cancel unused work item
    - [armhf] mtd: rawnand: stm32_fmc2: avoid to lock the CPU bus
    - [arm*] 2c: bcm2835: Store pointer to bus clock
    - ASoC: soc-core: Set dpcm_playback / dpcm_capture
    - [armhf] ASoC: stm32: spdifrx: fix inconsistent lock state
    - [armhf] ASoC: stm32: spdifrx: fix race condition in irq handler
    - [armhf] ASoC: stm32: spdifrx: fix input pin state management
    - netfilter: nft_flow_offload: fix underflow in flowtable reference
      counter
    - [armhf] mtd: onenand: omap2: Pass correct flags for prep_dma_memcpy
    - [arm64] gpio: zynq: Fix for bug in zynq_gpio_restore_context API
    - [arm64,armhf] pinctrl: meson: Fix wrong shift value when get
      drive-strength
    - [amd64] iommu/vt-d: Unlink device if failed to add to group
    - iommu: Remove device link to group on failure
    - bpf: cgroup: prevent out-of-order release of cgroup bpf
    - fs: move guard_bio_eod() after bio_set_op_attrs
    - scsi: mpt3sas: Fix double free in attach error handling
    - gpio: Fix error message on out-of-range GPIO in lookup table
    - [arm64,armhf] PM / devfreq: tegra: Add COMMON_CLK dependency
    - [arm64,armhf] drm/tegra: Fix ordering of cleanup code
    - [s390x] qeth: fix qdio teardown after early init error
    - [s390x] qeth: fix false reporting of VNIC CHAR config failure
    - [s390x] qeth: Fix vnicc_is_in_use if rx_bcast not set
    - [s390x] qeth: vnicc Fix init to default
    - [s390x] qeth: fix initialization on old HW
    - scsi: smartpqi: Update attribute name to `driver_version`
    - afs: Fix missing cell comparison in afs_test_super()
    - [x86] syscalls/x86: Wire up COMPAT_SYSCALL_DEFINE0
    - [x86] syscalls/x86: Use COMPAT_SYSCALL_DEFINE0 for IA32 (rt_)sigreturn
    - [x86] syscalls/x86: Use the correct function type for sys_ni_syscall
    - [x86] syscalls/x86: Fix function types in COND_SYSCALL
    - btrfs: simplify inode locking for RWF_NOWAIT
    - netfilter: nf_tables_offload: release flow_rule on error from commit
      path
    - netfilter: nft_meta: use 64-bit time arithmetic
    - [arm64] RDMA/hns: Prevent undefined behavior in
      hns_roce_set_user_sq_size()
    - [arm64] RDMA/hns: remove a redundant le16_to_cpu
    - [arm64] RDMA/hns: Modify return value of restrack functions
    - RDMA/counter: Prevent QP counter manual binding in auto mode
    - [arm64] RDMA/hns: Release qp resources when failed to destroy qp
    - xprtrdma: Add unique trace points for posting Local Invalidate WRs
    - xprtrdma: Connection becomes unstable after a reconnect
    - xprtrdma: Fix MR list handling
    - xprtrdma: Close window between waking RPC senders and posting Receives
    - [arm64] RDMA/hns: Fix to support 64K page for srq
    - [arm64] RDMA/hns: Bugfix for qpc/cqc timer configuration
    - RDMA/mlx5: Return proper error value
    - RDMA/srpt: Report the SCSI residual to the initiator
    - uaccess: Add non-pagefault user-space write function
    - bpf: Make use of probe_user_write in probe write helper
    - bpf: skmsg, fix potential psock NULL pointer dereference
    - libbpf: Fix Makefile' libbpf symbol mismatch diagnostic
    - afs: Fix use-after-loss-of-ref
    - afs: Fix afs_lookup() to not clobber the version on a new dentry
    - keys: Fix request_key() cache
    - scsi: enclosure: Fix stale device oops with hot replug
    - scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI
    - [x86] platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0
    - [x86] platform/x86: GPD pocket fan: Use default values when wrong
      modparams are given
    - Documentation/ABI: Fix documentation inconsistency for mlxreg-io sysfs
      interfaces
    - Documentation/ABI: Add missed attribute for mlxreg-io sysfs interfaces
    - xprtrdma: Fix create_qp crash on device unload
    - xprtrdma: Fix completion wait during device removal
    - xprtrdma: Fix oops in Receive handler after device removal
    - dm: add dm-clone to the documentation index
    - scsi: ufs: Give an unique ID to each ufs-bsg
    - [arm64] crypto: cavium/nitrox - fix firmware assignment to AE cores
    - crypto: virtio - implement missing support for output IVs
    - crypto: algif_skcipher - Use chunksize instead of blocksize
    - [i386] crypto: geode-aes - convert to skcipher API and make thread-safe
    - NFSv2: Fix a typo in encode_sattr()
    - nfsd: Fix cld_net->cn_tfm initialization
    - nfsd: v4 support requires CRYPTO_SHA256
    - NFSv4.x: Handle bad/dead sessions correctly in nfs41_sequence_process()
    - NFSv4.x: Drop the slot if nfs4_delegreturn_prepare waits for
      layoutreturn
    - mei: fix modalias documentation
    - [armhf] clk: samsung: exynos5420: Preserve CPU clocks configuration
      during suspend/resume
    - clk: Fix memory leak in clk_unregister()
    - [arm64,armhf] dmaengine: dw: platform: Mark 'hclk' clock optional
    - [armhf] clk: imx: pll14xx: Fix quick switch of S/K parameter
    - rsi: fix potential null dereference in rsi_probe()
    - affs: fix a memory leak in affs_remount
    - [armhf] pinctl: ti: iodelay: fix error checking on
      pinctrl_count_index_with_args call
    - [x86] pinctrl: lewisburg: Update pin list according to v1.1v6
    - PCI: pciehp: Do not disable interrupt twice on suspend
    - Revert "drm/virtio: switch virtio_gpu_wait_ioctl() to gem helper."
    - drm/amdgpu: cleanup creating BOs at fixed location
    - drm/amdgpu/discovery: reserve discovery data at the top of VRAM
    - scsi: sd: enable compat ioctls for sed-opal
    - gfs2: add compat_ioctl support
    - af_unix: add compat_ioctl support
    - compat_ioctl: handle SIOCOUTQNSD
    - [arm64] PCI: aardvark: Use LTSSM state to build link training flag
    - [arm64] PCI: aardvark: Fix PCI_EXP_RTCTL register configuration
    - [arm64,armhf] PCI: dwc: Fix find_next_bit() usage
    - PCI: Fix missing bridge dma_ranges resource list cleanup
    - PCI/PM: Clear PCIe PME Status even for legacy power management
    - PCI/PTM: Remove spurious "d" from granularity message
    - [powerpc*] powernv: Disable native PCIe port management
    - [mips64el,mipsel] Loongson: Fix return value of loongson_hwmon_init
    - [armhf] tty: serial: imx: use the sg count from dma_map_sg
    - [i386] tty: serial: pch_uart: correct usage of dma_unmap_sg
    - ARM: 8943/1: Fix topology setup in case of CPU hotplug for
      CONFIG_SCHED_MC
    - Revert "ubifs: Fix memory leak bug in alloc_ubifs_info() error path"
    - ubifs: Fixed missed le64_to_cpu() in journal
    - ubifs: do_kill_orphans: Fix a memory leak bug
    - mtd: spi-nor: fix silent truncation in spi_nor_read()
    - mtd: spi-nor: fix silent truncation in spi_nor_read_raw()
    - [arm64,armhf] spi: pxa2xx: Set controller->max_transfer_size in dma mode
    - iwlwifi: mvm: consider ieee80211 station max amsdu value
    - rtlwifi: Remove unnecessary NULL check in rtl_regd_init
    - iwlwifi: mvm: fix support for single antenna diversity
    - sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO
    - f2fs: fix potential overflow
    - NFSD fixing possible null pointer derefering in copy offload
    - scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy()
    - scsi: target/iblock: Fix protection error with blocks greater than 512B
    - [riscv64] export flush_icache_all to modules
    - [mips64el,mipsel] cacheinfo: report shared CPU map
    - [mips64el,mipsel] Fix gettimeofday() in the vdso library
    - tomoyo: Suppress RCU warning at list_for_each_entry_rcu().
    - [arm64] drm/arm/mali: make malidp_mw_connector_helper_funcs static
    - rxrpc: Unlock new call in rxrpc_new_incoming_call() rather than the
      caller
    - rxrpc: Don't take call->user_mutex in rxrpc_new_incoming_call()
    - rxrpc: Fix missing security check on incoming calls
    - [arm64] dmaengine: k3dma: Avoid null pointer traversal
    - [s390x] qeth: lock the card while changing its hsuid
    - [amd64] ioat: ioat_alloc_ring() failure handling.
    - drm/amdgpu: enable gfxoff for raven1 refresh
    - ocfs2: call journal flush to mark journal as empty after journal
      recovery when mount

  [ Salvatore Bonaccorso ]
  * signing_templates/rules.real: Include modules.builtin.modinfo file in
    image (Closes: #948427)
  * [rt] Drop "lib/ubsan: Don't seralize UBSAN report"
  * nvme: Ignore ABI changes
  * Drop "ARM: dts: bcm283x: Fix critical trip point"
  * Drop "tracing: Do not create directories if lockdown is in affect"
  * Drop "libtraceevent: Fix lib installation with O="
  * Drop "libtraceevent: Copy pkg-config file to output folder when using O="
  * Refresh "libbpf: fix readelf output parsing on powerpc with recent
    binutils"
  * Refresh "x86: Make x32 syscall support conditional on a kernel parameter"
  * Bump ABI to 3.

  [ Ben Hutchings ]
  * f2fs: Fix crypto softdep: it uses crc32, not crc32c

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 19 Jan 2020 10:22:58 +0100

linux (5.4.8-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.7
    - af_packet: set defaule value for tmo
    - [amd64] fjes: fix missed check in fjes_acpi_add
    - mod_devicetable: fix PHY module format
    - net: dst: Force 4-byte alignment of dst_metrics
    - [arm64] net: hisilicon: Fix a BUG trigered by wrong bytes_compl
    - net: phy: ensure that phy IDs are correctly typed
    - net: qlogic: Fix error paths in ql_alloc_large_buffers()
    - net-sysfs: Call dev_hold always in rx_queue_add_kobject
    - net: usb: lan78xx: Fix suspend/resume PHY register access error
    - [arm64,armhf] nfp: flower: fix stats id allocation
    - qede: Disable hardware gro when xdp prog is installed
    - qede: Fix multicast mac configuration
    - sctp: fix memleak on err handling of stream initialization
    - sctp: fully initialize v4 addr in some functions
    - neighbour: remove neigh_cleanup() method
    - bonding: fix bond_neigh_init()
    - net: ena: fix default tx interrupt moderation interval
    - net: ena: fix issues in setting interrupt moderation params in ethtool
    - [armhf] net: ethernet: ti: davinci_cpdma: fix warning "device driver
      frees DMA memory with different size"
    - [arm64,armhf] net: stmmac: platform: Fix MDIO init for platforms without
      PHY
    - [armhf] net: dsa: b53: Fix egress flooding settings
    - btrfs: don't double lock the subvol_sem for rename exchange
    - btrfs: do not call synchronize_srcu() in inode_tree_del
    - Btrfs: make tree checker detect checksum items with overlapping ranges
    - btrfs: return error pointer from alloc_test_extent_buffer
    - Btrfs: fix missing data checksums after replaying a log tree
    - btrfs: send: remove WARN_ON for readonly mount
    - btrfs: abort transaction after failed inode updates in create_subvol
    - btrfs: skip log replay on orphaned roots
    - btrfs: do not leak reloc root if we fail to read the fs root
    - btrfs: handle ENOENT in btrfs_uuid_tree_iterate
    - Btrfs: fix removal logic of the tree mod log that leads to
      use-after-free issues
    - ALSA: pcm: Avoid possible info leaks from PCM stream buffers
    - ALSA: hda/ca0132 - Keep power on during processing DSP response
    - ALSA: hda/ca0132 - Avoid endless loop
    - ALSA: hda/ca0132 - Fix work handling in delayed HP detection
    - [arm*] drm/vc4/vc4_hdmi: fill in connector info
    - drm/virtio: switch virtio_gpu_wait_ioctl() to gem helper.
    - drm: mst: Fix query_payload ack reply struct
    - [arm64,armhf] drm/panel: Add missing drm_panel_init() in panel drivers
    - [armhf] drm: exynos: exynos_hdmi: use cec_notifier_conn_(un)register
    - drm: Use EOPNOTSUPP, not ENOTSUPP
    - drm/amdgpu/sriov: add ring_stop before ring_create in psp v11 code
    - drm/amdgpu: grab the id mgr lock while accessing passid_mapping
    - drm/ttm: return -EBUSY on pipelining with no_gpu_wait (v2)
    - ath10k: add cleanup in ath10k_sta_state()
    - ath10k: Check if station exists before forwarding tx airtime report
    - spi: Add call to spi_slave_abort() function when spidev driver is
      released
    - [arm64] drm/meson: vclk: use the correct G12A frac max value
    - [x86] staging: rtl8192u: fix multiple memory leaks on error path
    - staging: rtl8188eu: fix possible null dereference
    - rtlwifi: prevent memory leak in rtl_usb_probe (CVE-2019-19063)
    - libertas: fix a potential NULL pointer dereference
    - ath10k: fix backtrace on coredump
    - IB/iser: bound protection_sg size by data_sg size
    - [armhf] spi: gpio: prevent memory leak in spi_gpio_probe
    - media: max2175: Fix build error without CONFIG_REGMAP_I2C
    - [arm64] media: venus: core: Fix msm8996 frequency table
    - ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq
    - pinctrl: devicetree: Avoid taking direct reference to device name string
    - [armhf] drm/sun4i: dsi: Fix TCON DRQ set bits
    - [arm64] media: venus: Fix occasionally failures to suspend
    - rtw88: fix NSS of hw_cap
    - [armhf] hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if
      not idled
    - media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
    - [arm64,armhf] drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the
      internal I2C controller
    - mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
      (CVE-2019-19057)
    - drm/drm_vblank: Change EINVAL by the correct errno
    - libbpf: Fix struct end padding in btf_dump
    - libbpf: Fix passing uninitialized bytes to setsockopt
    - net/smc: increase device refcount for added link group
    - team: call RCU read lock when walking the port_list
    - media: cx88: Fix some error handling path in 'cx8800_initdev()'
    - [arm64] crypto: inside-secure - Fix a maybe-uninitialized warning
    - [arm64] crypto: aegis128/simd - build 32-bit ARM for v8 architecture
      explicitly
    - [x86] ASoC: SOF: enable sync_write in hdac_bus
    - [armhf] media: ti-vpe: vpe: Fix Motion Vector vpdma stride
    - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid
      pixel format
    - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance failure about frame
      sequence number
    - [armhf] media: ti-vpe: vpe: Make sure YUYV is set as default format
    - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance failure causing a
      kernel panic
    - [armhf] media: ti-vpe: vpe: ensure buffers are cleaned up properly in
      abort cases
    - [armhf] media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid
      sizeimage
    - [x86] syscalls/x86: Use the correct function type in SYSCALL_DEFINE0
    - [x86] mm: Use the correct function type for native_set_fixmap()
    - ath10k: Correct error handling of dma_map_single()
    - rtw88: coex: Set 4 slot mode for A2DP
    - [arm64,armhf] drm/bridge: dw-hdmi: Restore audio when setting a mode
    - perf vendor events arm64: Fix Hisi hip08 DDRC PMU eventname
    - usb: usbfs: Suppress problematic bind and unbind uevents.
    - Bluetooth: btusb: avoid unused function warning
    - Bluetooth: missed cpu_to_le16 conversion in hci_init4_req
    - Bluetooth: Workaround directed advertising bug in Broadcom controllers
    - Bluetooth: hci_core: fix init for HCI_USER_CHANNEL
    - bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack()
    - [x86] mce: Lower throttling MCE messages' priority to warning
    - [arm64] net: hns3: log and clear hardware error after reset complete
    - [arm64] RDMA/hns: Fix wrong parameters when initial mtt of srq->idx_que
    - [x86] drm/gma500: fix memory disclosures due to uninitialized bytes
    - ASoC: soc-pcm: fixup dpcm_prune_paths() loop continue
    - rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot
    - ipmi: Don't allow device module unload when in use
    - [x86] ioapic: Prevent inconsistent state when moving an interrupt
    - media: cedrus: Fix undefined shift with a SHIFT_AND_MASK_BITS macro
    - drm/nouveau: Don't grab runtime PM refs for HPD IRQs
    - md: no longer compare spare disk superblock events in super_load
    - md/bitmap: avoid race window between md_bitmap_resize and
      bitmap_file_clear_bit
    - drm: Don't free jobs in wait_event_interruptible()
    - EDAC/amd64: Set grain per DIMM
    - [arm64] psci: Reduce the waiting time for cpu_psci_cpu_kill()
    - i40e: initialize ITRN registers with correct values
    - i40e: Wrong 'Advertised FEC modes' after set FEC to AUTO
    - net: phy: dp83867: enable robust auto-mdix
    - [arm64,armhf] drm/tegra: sor: Use correct SOR index on Tegra210
    - regulator: core: Release coupled_rdevs on regulator_init_coupling()
      error
    - ubsan, x86: Annotate and allow __ubsan_handle_shift_out_of_bounds() in
      uaccess regions
    - ACPI: button: Add DMI quirk for Medion Akoya E2215T
    - RDMA/qedr: Fix memory leak in user qp and mr
    - [arm64] RDMA/hns: Fix memory leak on 'context' on error return path
    - RDMA/qedr: Fix srqs xarray initialization
    - RDMA/core: Set DMA parameters correctly
    - [arm64,armhf] gpu: host1x: Allocate gather copy for host1x
    - [arm64,armhf] net: dsa: LAN9303: select REGMAP when LAN9303 enable
    - [arm64] phy: qcom-usb-hs: Fix extcon double register after power cycle
    - [s390x] time: ensure get_clock_monotonic() returns monotonic values
    - [s390x] add error handling to perf_callchain_kernel
    - [s390x] mm: add mm_pxd_folded() checks to pxd_free()
    - [arm64] net: hns3: add struct netdev_queue debug info for TX timeout
    - libata: Ensure ata_port probe has completed before detach
    - loop: fix no-unmap write-zeroes request behavior
    - [arm64,armhf] net/mlx5e: Verify that rule has at least one fwd/drop
      action
    - ALSA: bebob: expand sleep just after breaking connections for protocol
      version 1
    - libbpf: Fix error handling in bpf_map__reuse_fd()
    - Bluetooth: Fix advertising duplicated flags
    - ALSA: pcm: Fix missing check of the new non-cached buffer type
    - [riscv64] spi: sifive: disable clk when probe fails and remove
    - pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler()
    - ixgbe: protect TX timestamping from API misuse
    - media: rcar_drif: fix a memory disclosure (CVE-2019-18786)
    - media: v4l2-core: fix touch support in v4l_g_fmt
    - nvme: introduce "Command Aborted By host" status code
    - nvmem: core: fix nvmem_cell_write inline function
    - ASoC: SOF: topology: set trigger order for FE DAI link
    - media: vivid: media_device_cleanup was called too early
    - bnx2x: Fix PF-VF communication over multi-cos queues.
    - ALSA: timer: Limit max amount of slave instances
    - RDMA/core: Fix return code when modify_port isn't supported
    - [arm64] drm: msm: a6xx: fix debug bus register configuration
    - rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
    - perf probe: Fix to find range-only function instance
    - perf cs-etm: Fix definition of macro TO_CS_QUEUE_NR
    - perf probe: Fix to list probe event with correct line number
    - perf jevents: Fix resource leak in process_mapfile() and main()
    - perf probe: Walk function lines in lexical blocks
    - perf probe: Fix to probe an inline function which has no entry pc
    - perf probe: Fix to show ranges of variables in functions without
      entry_pc
    - perf probe: Fix to show inlined function callsite without entry_pc
    - perf probe: Fix to probe a function which has no entry pc
    - perf tools: Fix cross compile for ARM64
    - perf tools: Splice events onto evlist even on error
    - ice: Check for null pointer dereference when setting rings
    - perf parse: If pmu configuration fails free terms
    - perf probe: Skip overlapped location on searching variables
    - net: avoid potential false sharing in neighbor related code
    - perf probe: Return a better scope DIE if there is no best scope
    - perf probe: Fix to show calling lines of inlined functions
    - perf probe: Skip end-of-sequence and non statement lines
    - perf probe: Filter out instances except for inlined subroutine and
      subprogram
    - libbpf: Fix negative FD close() in xsk_setup_xdp_prog()
    - [s390x] bpf: Use kvcalloc for addrs array
    - cgroup: freezer: don't change task and cgroups status unnecessarily
    - ath10k: fix get invalid tx rate for Mesh metric
    - media: pvrusb2: Fix oops on tear-down when radio support is not present
    - ice: delay less
    - media: cedrus: Use helpers to access capture queue
    - [arm64,armhf] spi: pxa2xx: Add missed security checks
    - ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile
    - iio: dac: ad5446: Add support for new AD5600 DAC
    - [x86] ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format
      constraint
    - r8169: respect EEE user setting when restarting network
    - [s390x] disassembler: don't hide instruction addresses
    - [armhf] net: ethernet: ti: Add dependency for TI_DAVINCI_EMAC
    - nvme: Discard workaround for non-conformant devices
    - parport: load lowlevel driver if ports not found
    - bcache: fix static checker warning in bcache_device_free()
    - cpufreq: Register drivers only after CPU devices have been registered
    - [x86] crash: Add a forward declaration of struct kimage
    - tracing: use kvcalloc for tgid_map array allocation
    - tracing/kprobe: Check whether the non-suffixed symbol is notrace
    - bcache: fix deadlock in bcache_allocator
    - iwlwifi: mvm: fix unaligned read of rx_pkt_status
    - regulator: core: Let boot-on regulators be powered off
    - [arm64] spi: tegra20-slink: add missed clk_unprepare
    - tun: fix data-race in gro_normal_list()
    - xhci-pci: Allow host runtime PM as default also for Intel Ice Lake xHCI
    - crypto: virtio - deal with unsupported input sizes
    - btrfs: don't prematurely free work in end_workqueue_fn()
    - btrfs: don't prematurely free work in run_ordered_work()
    - sched/uclamp: Fix overzealous type replacement
    - perf/core: Fix the mlock accounting, again
    - bnxt_en: Return proper error code for non-existent NVM variable
    - net: phy: avoid matching all-ones clause 45 PHY IDs
    - [x86] ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012
      2-in-1
    - [x86] insn: Add some Intel instructions to the opcode map
    - brcmfmac: remove monitor interface when detaching
    - perf session: Fix decompression of PERF_RECORD_COMPRESSED records
    - perf probe: Fix to show function entry line as probe-able
    - [s390x] crypto: Fix unsigned variable compared with zero
    - [s390x] kasan: support memcpy_real with TRACE_IRQFLAGS
    - bnxt_en: Improve RX buffer error handling.
    - iwlwifi: check kasprintf() return value
    - ASoC: soc-pcm: check symmetry before hw_params
    - [armhf] net: ethernet: ti: ale: clean ale tbl on init and intf restart
    - [s390x] cpumf: Adjust registration of s390 PMU device drivers
    - [armhf] crypto: sun4i-ss - Fix 64-bit size_t warnings
    - [armhf] crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c
    - mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED
    - libtraceevent: Fix memory leakage in copy_filter_type
    - ice: Only disable VF state when freeing each VF resources
    - ice: Fix setting coalesce to handle DCB configuration
    - net: phy: initialise phydev speed and duplex sanely
    - tools, bpf: Fix build for 'make -s tools/bpf O=<dir>'
    - bpf: Provide better register bounds after jmp32 instructions
    - net: wireless: intel: iwlwifi: fix GRO_NORMAL packet stalling
    - btrfs: don't prematurely free work in reada_start_machine_worker()
    - btrfs: don't prematurely free work in scrub_missing_raid56_worker()
    - Revert "mmc: sdhci: Fix incorrect switch to HS mode"
    - tpm_tis: reserve chip for duration of tpm_tis_core_init
    - tpm: fix invalid locking in NONBLOCKING mode
    - iommu: fix KASAN use-after-free in iommu_insert_resv_region
    - iommu: set group default domain before creating direct mappings
    - iommu/vt-d: Fix dmar pte read access not set error
    - iommu/vt-d: Set ISA bridge reserved region as relaxable
    - iommu/vt-d: Allocate reserved region for ISA with correct permission
    - [armhf] can: flexcan: fix possible deadlock and out-of-order reception
      after wakeup
    - [armhf] can: flexcan: poll MCR_LPM_ACK instead of GPR ACK for stop mode
      acknowledgment
    - can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices
      (CVE-2019-19947)
    - usb: xhci: Fix build warning seen with CONFIG_PM=n
    - ath10k: Revert "ath10k: add cleanup in ath10k_sta_state()"
    - md: avoid invalid memory access for array sb->dev_roles
    - [s390x] ftrace: fix endless recursion in function_graph tracer
    - [armhf] can: flexcan: add low power enter/exit acknowledgment helper
    - usbip: Fix receive error in vhci-hcd when using scatter-gather
    - usbip: Fix error path of vhci_recv_ret_submit()
    - cpufreq: Avoid leaving stale IRQ work items during CPU offline
    - mm: vmscan: protect shrinker idr replace with CONFIG_MEMCG
    - [x86] intel_th: pci: Add Comet Lake PCH-V support
    - [x86] intel_th: pci: Add Elkhart Lake SOC support
    - [x86] intel_th: Fix freeing IRQs
    - [x86] intel_th: msu: Fix window switching without windows
    - [x86] platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128
      bytes
    - [x86] staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value
    - [x86] pinctrl: baytrail: Really serialize all register accesses
    - ext4: fix ext4_empty_dir() for directories with holes (CVE-2019-19037)
    - ext4: check for directory entries too close to block end
    - ext4: unlock on error in ext4_expand_extra_isize()
    - ext4: validate the debug_want_extra_isize mount option at parse time
    - [powerpc*] KVM: PPC: Book3S HV: Fix regression on big endian hosts
    - [x86] kvm: x86: Host feature SSBD doesn't imply guest feature
      SPEC_CTRL_SSBD
    - [x86] kvm: x86: Host feature SSBD doesn't imply guest feature AMD_SSBD
    - [arm64,armhf] KVM: arm/arm64: Properly handle faulting of device
      mappings
    - [arm64] KVM: arm64: Ensure 'params' is initialised when looking up sys
      register
    - [x86] intel: Disable HPET on Intel Coffee Lake H platforms
    - [x86] MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure()
    - [x86] MCE/AMD: Allow Reserved types to be overwritten in smca_banks[]
    - [x86] mce: Fix possibly incorrect severity calculation on AMD
    - [powerpc*] irq: fix stack overflow verification
    - [powerpc*] ocxl: Fix concurrent AFU open and device removal
    - [arm64] mmc: sdhci-msm: Correct the offset and value for DDR_CONFIG
      register
    - mmc: sdhci: Update the tuning failed messages to pr_debug level
    - mmc: sdhci: Workaround broken command queuing on Intel GLK
    - mmc: sdhci: Add a quirk for broken command queuing
    - nbd: fix shutdown and recv work deadlock v2
    - iwlwifi: pcie: move power gating workaround earlier in the flow
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.8
    - Revert "MIPS: futex: Restore \n after sync instructions"
    - Revert "MIPS: futex: Emit Loongson3 sync workarounds within asm"
    - scsi: lpfc: Fix spinlock_irq issues in lpfc_els_flush_cmd()
    - scsi: lpfc: Fix discovery failures when target device connectivity
      bounces
    - scsi: mpt3sas: Fix clear pending bit in ioctl status
    - scsi: lpfc: Fix locking on mailbox command completion
    - scsi: mpt3sas: Reject NVMe Encap cmnds to unsupported HBA
    - [armhf] gpio: mxc: Only get the second IRQ when there is more than one
      IRQ
    - scsi: lpfc: Fix list corruption in lpfc_sli_get_iocbq
    - Input: atmel_mxt_ts - disable IRQ across suspend
    - f2fs: fix to update time in lazytime mode
    - [x86] platform/x86: peaq-wmi: switch to using polled mode of input
      devices
    - [arm64,armhf] iommu: rockchip: Free domain on .domain_free
    - [arm64,armhf] iommu/tegra-smmu: Fix page tables in > 4 GiB memory
    - scsi: target: compare full CHAP_A Algorithm strings
    - scsi: lpfc: Fix hardlockup in lpfc_abort_handler
    - scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
    - scsi: csiostor: Don't enable IRQs too early
    - [arm64] scsi: hisi_sas: Replace in_softirq() check in
      hisi_sas_task_exec()
    - [arm64] scsi: hisi_sas: Delete the debugfs folder of hisi_sas when the
      probe fails
    - [powerpc*] pseries: Mark accumulate_stolen_time() as notrace
    - [powerpc*] pseries: Don't fail hash page table insert for bolted mapping
    - dma-mapping: Add vmap checks to dma_map_single()
    - dma-mapping: fix handling of dma-ranges for reserved memory (again)
    - clocksource/drivers/timer-of: Use unique device name instead of timer
    - [powerpc*] security/book3s64: Report L1TF status in sysfs
    - [powerpc*] book3s64/hash: Add cond_resched to avoid soft lockup warning
    - ext4: update direct I/O read lock pattern for IOCB_NOWAIT
    - ext4: iomap that extends beyond EOF should be marked dirty
    - jbd2: Fix statistics for the number of logged blocks
    - scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and
      WRITE(6)
    - scsi: lpfc: Fix unexpected error messages during RSCN handling
    - scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
    - f2fs: fix to update dir's i_pino during cross_rename
    - [arm64] clk: qcom: smd: Add missing pnoc clock
    - [arm64] clk: qcom: Allow constant ratio freq tables for rcg
    - clk: clk-gpio: propagate rate change to parent
    - dma-direct: check for overflows on 32 bit DMA addresses
    - fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned
      long
    - [arm64] iommu/arm-smmu-v3: Don't display an error when IRQ lines are
      missing
    - [armhf] i2c: stm32f7: fix & reorder remove & probe error handling
    - iomap: fix return value of iomap_dio_bio_actor on 32bit systems
    - scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer
      dereferences
    - [m68k] scsi: zorro_esp: Limit DMA transfers to 65536 bytes (except on
      Fastlane)
    - [powerpc*] PCI: rpaphp: Fix up pointer to first drc-info entry
    - scsi: ufs: fix potential bug which ends in system hang
    - [powerpc*] PCI: rpaphp: Don't rely on firmware feature to imply drc-info
      support
    - [powerpc*] PCI: rpaphp: Annotate and correctly byte swap DRC properties
    - [powerpc*] PCI: rpaphp: Correctly match ibm, my-drc-index to drc-name
      when using drc-info
    - [powerpc*] security: Fix wrong message when RFI Flush is disable
    - [powerpc*] eeh: differentiate duplicate detection message
    - [powerpc*] book3s/mm: Update Oops message to print the correct
      translation in use
    - bcache: at least try to shrink 1 node in bch_mca_scan()
    - HID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse
    - HID: logitech-hidpp: Silence intermittent get_battery_capacity errors
    - HID: i2c-hid: fix no irq after reset on raydium 3118
    - [armhf] 8937/1: spectre-v2: remove Brahma-B53 from hardening
    - libnvdimm/btt: fix variable 'rc' set but not used
    - HID: Improve Windows Precision Touchpad detection.
    - HID: rmi: Check that the RMI_STARTED bit is set before unregistering the
      RMI transport device
    - watchdog: prevent deferral of watchdogd wakeup on RT
    - watchdog: Fix the race between the release of watchdog_core_data and
      cdev
    - scsi: pm80xx: Fix for SATA device discovery
    - scsi: ufs: Fix error handing during hibern8 enter
    - scsi: scsi_debug: num_tgts must be >= 0
    - scsi: target: core: Release SPC-2 reservations when closing a session
    - scsi: ufs: Fix up auto hibern8 enablement
    - scsi: iscsi: Don't send data to unbound connection
    - scsi: target: iscsi: Wait for all commands to finish before freeing a
      session
    - f2fs: Fix deadlock in f2fs_gc() context during atomic files handling
    - [x86] Drivers: hv: vmbus: Fix crash handler reset of Hyper-V synic
    - apparmor: fix unsigned len comparison with less than zero
    - drm/amdgpu: Call find_vma under mmap_sem
    - cifs: Fix use-after-free bug in cifs_reconnect()
    - io_uring: io_allocate_scq_urings() should return a sane state
    - cdrom: respect device capabilities during opening action
    - cifs: move cifsFileInfo_put logic into a work-queue
    - perf diff: Use llabs() with 64-bit values
    - perf script: Fix brstackinsn for AUXTRACE
    - perf regs: Make perf_reg_name() return "unknown" instead of NULL
    - [s390x] zcrypt: handle new reply code FILTERED_BY_HYPERVISOR
    - [s390x] unwind: filter out unreliable bogus %r14
    - [s390x] cpum_sf: Check for SDBT and SDB consistency
    - ocfs2: fix passing zero to 'PTR_ERR' warning
    - [s390x] disable preemption when switching to nodat stack with
      CALL_ON_STACK
    - mm/hugetlbfs: fix error handling when setting up mounts
    - kernel: sysctl: make drop_caches write-only
    - userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
    - sctp: fix err handling of stream initialization
    - md: make sure desc_nr less than MD_SB_DISKS
    - Revert "iwlwifi: assign directly to iwl_trans->cfg in QuZ detection"
    - netfilter: ebtables: compat: reject all padding in matches/watchers
    - 6pack,mkiss: fix possible deadlock
    - [powerpc*] Fix __clear_user() with KUAP enabled
    - net/smc: add fallback check to connect()
    - netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
    - inetpeer: fix data-race in inet_putpeer / inet_putpeer
    - net: add a READ_ONCE() in skb_peek_tail()
    - net: icmp: fix data-race in cmp_global_allow()
    - hrtimer: Annotate lockless access to timer->state
    - tomoyo: Don't use nifty names on sockets.
    - uaccess: disallow > INT_MAX copy sizes
    - drm: limit to INT_MAX in create_blob ioctl
    - xfs: fix mount failure crash on invalid iclog memory access
    - cxgb4/cxgb4vf: fix flow control display for auto negotiation
    - [armhf] net: dsa: bcm_sf2: Fix IP fragment location and behavior
    - net/mlxfw: Fix out-of-memory error in mfa2 flash burning
    - net: phy: aquantia: add suspend / resume ops for AQR105
    - net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit
      device
    - net/sched: add delete_empty() to filters and use it in cls_flower
    - net_sched: sch_fq: properly set sk->sk_pacing_status
    - [arm64,armhf] net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on
      Meson8b/8m2 SoCs
    - ptp: fix the race between the release of ptp_clock and cdev
    - tcp: Fix highest_sack and highest_sack_seq
    - udp: fix integer overflow while computing available space in sk_rcvbuf
    - bnxt_en: Fix MSIX request logic for RDMA driver.
    - bnxt_en: Free context memory in the open path if firmware has been
      reset.
    - bnxt_en: Return error if FW returns more data than dump length
    - bnxt_en: Fix bp->fw_health allocation and free logic.
    - bnxt_en: Remove unnecessary NULL checks for fw_health
    - bnxt_en: Fix the logic that creates the health reporters.
    - bnxt_en: Add missing devlink health reporters for VFs.
    - net: add bool confirm_neigh parameter for dst_ops.update_pmtu
    - ip6_gre: do not confirm neighbor when do pmtu update
    - gtp: do not confirm neighbor when do pmtu update
    - net/dst: add new function skb_dst_update_pmtu_no_confirm
    - tunnel: do not confirm neighbor when do pmtu update
    - vti: do not confirm neighbor when do pmtu update
    - sit: do not confirm neighbor when do pmtu update
    - net/dst: do not confirm neighbor for vxlan and geneve pmtu update
    - [arm64,armhf] net: marvell: mvpp2: phylink requires the link interrupt
    - gtp: fix wrong condition in gtp_genl_dump_pdp()
    - gtp: avoid zero size hashtable
    - bonding: fix active-backup transition after link failure
    - tcp: do not send empty skb from tcp_write_xmit()
    - tcp/dccp: fix possible race __inet_lookup_established()
    - [x86] hv_netvsc: Fix tx_table init in rndis_set_subchannel()
    - gtp: fix an use-after-free in ipv4_pdp_find()
    - gtp: do not allow adding duplicate tid and ms_addr pdp context
    - bnxt: apply computed clamp value for coalece parameter
    - ipv6/addrconf: only check invalid header values when
      NETLINK_F_STRICT_CHK is set
    - [arm64,armhf] net: phylink: fix interface passed to mac_link_up
    - net: ena: fix napi handler misbehavior when the napi budget is zero
    - vhost/vsock: accept only packets with the right dst_cid
    - mm/hugetlbfs: fix for_each_hstate() loop in init_hugetlbfs_fs()

  [ Salvatore Bonaccorso ]
  * debian/lib/python/debian_linux/abi.py: Add one missing string replacement.
  * debian/lib/python/debian_linux/abi.py: strip whitespace characters in
    line.
  * [rt] Refresh lib-ubsan-Don-t-seralize-UBSAN-report.patch for context
    changes in 5.4.7
  * [rt] Drop x86-ioapic-Prevent-inconsistent-state-when-moving-an.patch
  * Enable EROFS filesystem support as module.
    Enable EROFS_FS as module, enable EROFS_FS_XATTR, EROFS_FS_POSIX_ACL,
    EROFS_FS_SECURITY, EROFS_FS_ZIP and EROFS_FS_CLUSTER_PAGE_LIMIT.
    Thanks to Gao Xiang <gaoxiang25@huawei.com> (Closes: #946569)
  * Enable additional netfilter modules.
    Enable NFT_BRIDGE_META, NF_CONNTRACK_BRIDGE, IP6_NF_MATCH_SRH, NFT_XFRM
    and NFT_SYNPROXY as modules.
    Thanks to Arturo Borrero Gonzalez (Closes: #948031)
  * [rt] Drop watchdog-prevent-deferral-of-watchdogd-wakeup-on-RT.patch
  * [rt] Refresh Use-CONFIG_PREEMPTION.patch (Context changes in 5.4.8)
  * Bump ABI to 2

  [ YunQiang Su ]
  * [mips*/octeon] Fix ftbfs on mips* due to octeon image-file:
        move "image-file: linux" to octeon_build from octeon_image.

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 05 Jan 2020 15:40:37 +0100

linux (5.4.6-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.3
    - rsi: release skb if rsi_prepare_beacon fails (CVE-2019-19071)
    - lp: fix sparc64 LPSETTIMEOUT ioctl
    - time: Zero the upper 32-bits in __kernel_timespec on 32-bit
    - usb: gadget: u_serial: add missing port entry locking
    - [arm64] tty: serial: msm_serial: Fix flow control
    - [arm64,armel,armhf] serial: pl011: Fix DMA ->flush_buffer()
    - serial: serial_core: Perform NULL checks for break_ctl ops
    - [armhf] serial: stm32: fix clearing interrupt error flags
    - serial: 8250_dw: Avoid double error messaging when IRQ absent
    - mwifiex: Re-work support for SDIO HW reset
    - io_uring: fix dead-hung for non-iter fixed rw
    - io_uring: transform send/recvmsg() -ERESTARTSYS to -EINTR
    - fuse: fix leak of fuse_io_priv
    - fuse: verify nlink
    - fuse: verify write return
    - fuse: verify attributes
    - io_uring: fix missing kmap() declaration on powerpc
    - io_uring: ensure req->submit is copied when req is deferred
    - SUNRPC: Avoid RPC delays when exiting suspend
    - ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC
    - ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop
    - ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236
    - ALSA: hda/realtek - Fix inverted bass GPIO pin on Acer 8951G
    - ALSA: pcm: oss: Avoid potential buffer overflows
    - ALSA: hda - Add mute led support for HP ProBook 645 G4
    - ALSA: hda: Modify stream stripe mask only when needed
    - Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus
    - Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash
    - [x86] Input: synaptics-rmi4 - don't increment rmiaddr for SMBus
      transfers
    - Input: goodix - add upside-down quirk for Teclast X89 tablet
    - media: rc: mark input device as pointing stick
    - [i386] x86/mm/32: Sync only to VMALLOC_END in vmalloc_sync_all()
    - [x86] PCI: Avoid AMD FCH XHCI USB PME# from D0 defect
    - CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks
    - CIFS: Fix SMB2 oplock break processing
    - tty: vt: keyboard: reject invalid keycodes
    - can: slcan: Fix use-after-free Read in slcan_open
    - nfsd: Ensure CLONE persists data and metadata changes to the target file
    - nfsd: restore NFSv3 ACL support
    - kernfs: fix ino wrap-around detection
    - jbd2: Fix possible overflow in jbd2_log_space_left()
    - [arm64] drm/msm: fix memleak on release
    - drm: damage_helper: Fix race checking plane->state->fb
    - [i386] drm/i810: Prevent underflow in ioctl
    - [arm64] Validate tagged addresses in access_ok() called from kernel
      threads
    - [powerpc*] KVM: PPC: Book3S HV: XIVE: Free previous EQ page when setting
      up a new one
    - [powerpc*] KVM: PPC: Book3S HV: XIVE: Fix potential page leak on error
      path
    - [powerpc*] KVM: PPC: Book3S HV: XIVE: Set kvm->arch.xive when VPs are
      allocated
    - [x86] KVM: nVMX: Always write vmcs02.GUEST_CR3 during nested VM-Enter
    - [arm64,armhf] KVM: vgic: Don't rely on the wrong pending table
    - [x86] KVM: do not modify masked bits of shared MSRs
    - [x86] KVM: fix presentation of TSX feature in ARCH_CAPABILITIES
    - [x86] KVM: Remove a spurious export of a static function
    - [x86] KVM: Grab KVM's srcu lock when setting nested state
    - crypto: af_alg - cast ki_complete ternary op to int
    - [i386] crypto: geode-aes - switch to skcipher for cbc(aes) fallback
    - [x86] crypto: ccp - fix uninitialized list head
    - crypto: ecdh - fix big endian bug in ECC library
    - crypto: user - fix memory leak in crypto_report (CVE-2019-19062)
    - [armhf] spi: stm32-qspi: Fix kernel oops when unbinding driver
    - spi: Fix SPI_CS_HIGH setting when using native and GPIO CS
    - spi: Fix NULL pointer when setting SPI_CS_HIGH for GPIO CS
    - can: ucan: fix non-atomic allocation in completion handler
    - [amd64] RDMA/qib: Validate ->show()/store() callbacks before calling
      them
    - rfkill: allocate static minor
    - bdev: Factor out bdev revalidation into a common helper
    - bdev: Refresh bdev size for disks without partitioning
    - iomap: Fix pipe page leakage during splicing
    - thermal: Fix deadlock in thermal thermal_zone_device_check
    - vcs: prevent write access to vcsu devices
    - Revert "serial/8250: Add support for NI-Serial PXI/PXIe+485 devices"
    - binder: Fix race between mmap() and binder_alloc_print_pages()
    - binder: Prevent repeated use of ->mmap() via NULL mapping
    - binder: Handle start==NULL in binder_update_page_range()
    - [x86] KVM: fix out-of-bounds write in KVM_GET_EMULATED_CPUID
      (CVE-2019-19332)
    - ALSA: hda - Fix pending unsol events at shutdown
    - md/raid0: Fix an error message in raid0_make_request()
    - drm/mcde: Fix an error handling path in 'mcde_probe()'
    - perf script: Fix invalid LBR/binary mismatch error
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.4
    - usb: gadget: configfs: Fix missing spin_lock_init()
    - [x86] usb: gadget: pch_udc: fix use after free
    - nvme: Namepace identification descriptor list is optional
    - Revert "nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T"
    - scsi: lpfc: Fix bad ndlp ptr in xri aborted handling
    - [s390x] scsi: zfcp: trace channel log even for FCP command responses
    - scsi: qla2xxx: Do command completion on abort timeout
    - scsi: qla2xxx: Fix driver unload hang
    - scsi: qla2xxx: Fix double scsi_done for abort path
    - scsi: qla2xxx: Fix memory leak when sending I/O fails
    - compat_ioctl: add compat_ptr_ioctl()
    - ceph: fix compat_ioctl for ceph_dir_operations
    - [arm64] media: venus: remove invalid compat_ioctl32 handler
    - USB: uas: honor flag to avoid CAPACITY16
    - USB: uas: heed CAPACITY_HEURISTICS
    - USB: documentation: flags on usb-storage versus UAS
    - usb: Allow USB device to be warm reset in suspended state
    - [arm64,armhf] usb: host: xhci-tegra: Correct phy enable sequence
    - binder: fix incorrect calculation for num_valid
    - staging: rtl8188eu: fix interface sanity check
    - staging: rtl8712: fix interface sanity check
    - [arm*] staging: vchiq: call unregister_chrdev_region() when driver
      registration fails
    - staging: gigaset: fix general protection fault on probe
    - staging: gigaset: fix illegal free on probe errors
    - staging: gigaset: add endpoint-type sanity check
    - usb: xhci: only set D3hot for pci device
    - xhci: Fix memory leak in xhci_add_in_port()
    - xhci: fix USB3 device initiated resume race with roothub autosuspend
    - xhci: Increase STS_HALT timeout in xhci_suspend()
    - xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default
      behaviour.
    - xhci: make sure interrupts are restored to correct state
    - [x86] iio: imu: inv_mpu6050: fix temperature reporting using bad unit
    - USB: atm: ueagle-atm: add missing endpoint check
    - USB: idmouse: fix interface sanity checks
    - USB: serial: io_edgeport: fix epic endpoint lookup
    - usb: roles: fix a potential use after free
    - USB: adutux: fix interface sanity check
    - usb: core: urb: fix URB structure initialization function
    - usb: mon: Fix a deadlock in usbmon between mmap and read
    - [arm64,amd64,i386] tpm: add check after commands attribs tab allocation
    - [arm64,amd64,i386] tpm: Switch to platform_get_irq_optional()
    - brcmfmac: disable PCIe interrupts before bus reset
    - mtd: rawnand: Change calculating of position page containing BBM
    - virtio-balloon: fix managed page counts when migrating pages between
      zones
    - usb: dwc3: pci: add ID for the Intel Comet Lake -H variant
    - [arm64,armhf] usb: dwc3: gadget: Fix logical condition
    - [arm64,armhf] usb: dwc3: gadget: Clear started flag for non-IOC
    - [arm64,armhf] usb: dwc3: ep0: Clear started flag on completion
    - [x86] usb: typec: fix use after free in typec_register_port()
    - iwlwifi: pcie: fix support for transmitting SKBs with fraglist
    - btrfs: check page->mapping when loading free space cache
    - btrfs: use btrfs_block_group_cache_done in update_block_group
    - btrfs: use refcount_inc_not_zero in kill_all_nodes
    - Btrfs: fix metadata space leak on fixup worker failure to set range as
      delalloc
    - Btrfs: fix negative subv_writers counter and data space leak after
      buffered write
    - btrfs: Avoid getting stuck during cyclic writebacks
    - btrfs: Remove btrfs_bio::flags member
    - Btrfs: send, skip backreference walking for extents with many references
    - btrfs: record all roots for rename exchange on a subvol
    - rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address
    - rtlwifi: rtl8192de: Fix missing callback that tests for hw release of
      buffer
    - rtlwifi: rtl8192de: Fix missing enable interrupt flag
    - ovl: fix lookup failure on multi lower squashfs
    - ovl: fix corner case of non-unique st_dev;st_ino
    - ovl: relax WARN_ON() on rename to self
    - [arm*] hwrng: omap - Fix RNG wait loop timeout
    - dm writecache: handle REQ_FUA
    - dm zoned: reduce overhead of backing device checks
    - workqueue: Fix spurious sanity check failures in destroy_workqueue()
    - workqueue: Fix pwq ref leak in rescuer_thread()
    - ASoC: rt5645: Fixed buddy jack support.
    - ASoC: rt5645: Fixed typo for buddy jack support.
    - ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report
    - md: improve handling of bio with REQ_PREFLUSH in md_flush_request()
    - blk-mq: avoid sysfs buffer overflow with too many CPU cores
    - cgroup: pids: use atomic64_t for pids->limit
    - wil6210: check len before memcpy() calls
    - ar5523: check NULL before memcpy() in ar5523_cmd()
    - [s390x] mm: properly clear _PAGE_NOEXEC bit when it is not supported
    - cpuidle: Do not unset the driver if it is there already
    - cpuidle: use first valid target residency as poll time
    - [arm64,armhf] drm/panfrost: Open/close the perfcnt BO
    - [powerpc*] perf: Disable trace_imc pmu
    - [x86] intel_th: Fix a double put_device() in error path
    - [x86] intel_th: pci: Add Ice Lake CPU support
    - [x86] intel_th: pci: Add Tiger Lake CPU support
    - PM / devfreq: Lock devfreq in trans_stat_show
    - [powerpc*] cpufreq: powernv: fix stack bloat and hard limit on number of
      CPUs
    - ALSA: fireface: fix return value in error path of isochronous resources
      reservation
    - ALSA: oxfw: fix return value in error path of isochronous resources
      reservation
    - ALSA: hda/realtek - Line-out jack doesn't work on a Dell AIO
    - ACPI / utils: Move acpi_dev_get_first_match_dev() under CONFIG_ACPI
    - ACPI: LPSS: Add LNXVIDEO -> BYT I2C7 to lpss_device_links
    - ACPI: LPSS: Add LNXVIDEO -> BYT I2C1 to lpss_device_links
    - ACPI: LPSS: Add dmi quirk for skipping _DEP check for some device-links
    - ACPI / hotplug / PCI: Allocate resources directly under the non-hotplug
      bridge
    - ACPI: OSL: only free map once in osl.c
    - ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data()
    - ACPI: EC: Rework flushing of pending work
    - ACPI: PM: Avoid attaching ACPI PM domain to certain devices
    - [arm64] pinctrl: armada-37xx: Fix irq mask access in
      armada_37xx_irq_set_type()
    - [armhf] pinctrl: samsung: Add of_node_put() before return in error path
    - [armhf] pinctrl: samsung: Fix device node refcount leaks in Exynos
      wakeup controller init
    - [armhf] pinctrl: samsung: Fix device node refcount leaks in init code
    - [armhf] mmc: host: omap_hsmmc: add code for special init of wl1251 to
      get rid of pandora_wl1251_init_card
    - RDMA/core: Fix ib_dma_max_seg_size()
    - ppdev: fix PPGETTIME/PPSETTIME ioctls
    - [powerpc*] Allow 64bit VDSO __kernel_sync_dicache to work across ranges
      >4GB
    - [powerpc*] xive: Prevent page fault issues in the machine crash handler
    - [powerpc*] Allow flush_icache_range to work across ranges >4GB
    - [powerpc*] xive: Skip ioremap() of ESB pages for LSI interrupts
    - video/hdmi: Fix AVI bar unpack
    - quota: Check that quota is not dirty before release
    - ext2: check err when partial != NULL
    - seccomp: avoid overflow in implicit constant conversion
    - quota: fix livelock in dquot_writeback_dquots
    - ext4: Fix credit estimate for final inode freeing
    - reiserfs: fix extended attributes on the root directory
    - scsi: qla2xxx: Fix SRB leak on switch command timeout
    - scsi: qla2xxx: Fix a dma_pool_free() call
    - Revert "scsi: qla2xxx: Fix memory leak when sending I/O fails"
    - [armhf] omap: pdata-quirks: revert pandora specific gpiod additions
    - [armhf] omap: pdata-quirks: remove openpandora quirks for mmc3 and
      wl1251
    - [powerpc*] Avoid clang warnings around setjmp and longjmp
    - [powerpc*] Fix vDSO clock_getres()
    - mm, memfd: fix COW issue on MAP_PRIVATE and F_SEAL_FUTURE_WRITE mappings
    - mm: memcg/slab: wait for !root kmem_cache refcnt killing on root
      kmem_cache destruction
    - ext4: work around deleting a file with i_nlink == 0 safely
    - [arm64] firmware: qcom: scm: Ensure 'a0' status code is treated as
      signed
    - [s390x] smp,vdso: fix ASCE handling
    - [s390x] kaslr: store KASLR offset for early dumps
    - mm/shmem.c: cast the type of unmap_start to u64
    - [powerpc*] Define arch_is_kernel_initmem_freed() for lockdep
    - rtc: disable uie before setting time and enable after
    - splice: only read in as much information as there is pipe buffer space
    - ext4: fix a bug in ext4_wait_for_tail_page_commit
    - ext4: fix leak of quota reservations
    - blk-mq: make sure that line break can be printed
    - workqueue: Fix missing kfree(rescuer) in destroy_workqueue()
    - r8169: fix rtl_hw_jumbo_disable for RTL8168evl
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.5
    - inet: protect against too small mtu values.
    - mqprio: Fix out-of-bounds access in mqprio_dump
    - net: bridge: deny dev_set_mac_address() when unregistering
    - net: dsa: fix flow dissection on Tx path
    - [armhf] net: ethernet: ti: cpsw: fix extra rx interrupt
    - net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues
    - net_sched: validate TCA_KIND attribute in tc_chain_tmplt_add()
    - [arm64] net: thunderx: start phy before starting autonegotiation
    - openvswitch: support asymmetric conntrack
    - tcp: md5: fix potential overestimation of TCP option space
    - tipc: fix ordering of tipc module init and exit routine
    - net/mlx5e: Query global pause state before setting prio2buffer
    - net: ipv6: add net argument to ip6_dst_lookup_flow
    - net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
    - tcp: fix rejected syncookies due to stale timestamps
    - tcp: tighten acceptance of ACKs not matching a child socket
    - tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE()
    - net: core: rename indirect block ingress cb function
    - net: sched: allow indirect blocks to bind to clsact in TC
    - cls_flower: Fix the behavior using port ranges with hw-offload
    - gre: refetch erspan header from skb->data after pskb_may_pull()
    - Fixed updating of ethertype in function skb_mpls_pop
    - net: Fixed updating of ethertype in skb_mpls_push()
    - net/mlx5e: Fix TXQ indices to be sequential
    - net/mlx5e: Fix SFF 8472 eeprom length
    - net/mlx5e: Fix freeing flow with kfree() and not kvfree()
    - net/mlx5e: Fix translation of link mode into speed
    - net/mlx5e: ethtool, Fix analysis of speed setting
    - page_pool: do not release pool until inflight == 0.
    - xdp: obtain the mem_id mutex before trying to remove an entry.
    - r8169: add missing RX enabling for WoL on RTL8125
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.6
    - USB: Fix incorrect DMA allocations for local memory pool drivers
    - mmc: block: Make card_busy_detect() a bit more generic
    - mmc: block: Add CMD13 polling for MMC IOCTLS with R1B response
    - mmc: core: Drop check for mmc_card_is_removable() in mmc_rescan()
    - mmc: core: Re-work HW reset for SDIO cards
    - PCI/PM: Always return devices to D0 when thawing
    - PCI: pciehp: Avoid returning prematurely from sysfs requests
    - PCI: Fix Intel ACS quirk UPDCR register address
    - PCI/MSI: Fix incorrect MSI-X masking on resume
    - PCI: Do not use bus number zero from EA capability
    - PCI: Apply Cavium ACS quirk to ThunderX2 and ThunderX3
    - PM / QoS: Redefine FREQ_QOS_MAX_DEFAULT_VALUE to S32_MAX
    - block: fix "check bi_size overflow before merge"
    - gfs2: Multi-block allocations in gfs2_page_mkwrite
    - gfs2: fix glock reference problem in gfs2_trans_remove_revoke
    - [arm64] rpmsg: glink: Fix reuse intents memory leak issue
    - [arm64] rpmsg: glink: Fix use after free in open_ack TIMEOUT case
    - [arm64] rpmsg: glink: Put an extra reference during cleanup
    - [arm64] rpmsg: glink: Fix rpmsg_register_device err handling
    - [arm64] rpmsg: glink: Don't send pending rx_done during remove
    - [arm64] rpmsg: glink: Free pending deferred work on remove
    - cifs: smbd: Return -EAGAIN when transport is reconnecting
    - cifs: smbd: Only queue work for error recovery on memory registration
    - cifs: smbd: Add messages on RDMA session destroy and reconnection
    - cifs: smbd: Return -EINVAL when the number of iovs exceeds
      SMBDIRECT_MAX_SGE
    - cifs: smbd: Return -ECONNABORTED when trasnport is not in connected
      state
    - cifs: Don't display RDMA transport on reconnect
    - CIFS: Respect O_SYNC and O_DIRECT flags during reconnect
    - CIFS: Close open handle after interrupted close
    - CIFS: Do not miss cancelled OPEN responses
    - CIFS: Fix NULL pointer dereference in mid callback
    - cifs: Fix retrieval of DFS referrals in cifs_mount()
    - [armhf] ARM: tegra: Fix FLOW_CTLR_HALT register clobbering by
      tegra_resume()
    - vfio/pci: call irq_bypass_unregister_producer() before freeing irq
    - dma-buf: Fix memory leak in sync_file_merge()
    - [arm64,armhf] drm/panfrost: Fix a race in panfrost_ioctl_madvise()
    - [arm64,armhf] drm/panfrost: Fix a BO leak in panfrost_ioctl_mmap_bo()
    - [arm64,armhf] drm/panfrost: Fix a race in panfrost_gem_free_object()
    - [x86] drm/mgag200: Extract device type from flags
    - [x86] drm/mgag200: Store flags from PCI driver data in device structure
    - [x86] drm/mgag200: Add workaround for HW that does not support
      'startadd'
    - [x86] drm/mgag200: Flag all G200 SE A machines as broken wrt <startadd>
    - [arm64] drm: meson: venc: cvbs: fix CVBS mode matching
    - dm mpath: remove harmful bio-based optimization
    - dm btree: increase rebalance threshold in __rebalance2()
    - dm clone metadata: Track exact changes per transaction
    - dm clone metadata: Use a two phase commit
    - dm clone: Flush destination device before committing metadata
    - dm thin metadata: Add support for a pre-commit callback
    - dm thin: Flush data device before committing metadata
    - scsi: ufs: Disable autohibern8 feature in Cadence UFS
    - scsi: iscsi: Fix a potential deadlock in the timeout handler
    - scsi: qla2xxx: Ignore NULL pointer in tcm_qla2xxx_free_mcmd
    - scsi: qla2xxx: Initialize free_work before flushing it
    - scsi: qla2xxx: Added support for MPI and PEP regions for ISP28XX
    - scsi: qla2xxx: Change discovery state before PLOGI
    - scsi: qla2xxx: Correctly retrieve and interpret active flash region
    - scsi: qla2xxx: Fix incorrect SFUB length used for Secure Flash Update MB
      Cmd
    - drm/nouveau/kms/nv50-: Call outp_atomic_check_view() before handling PBN
    - drm/nouveau/kms/nv50-: Store the bpc we're using in nv50_head_atom
    - drm/nouveau/kms/nv50-: Limit MST BPC to 8
    - [x86] drm/i915/fbc: Disable fbc by default on all glk+
    - drm/radeon: fix r1xx/r2xx register checker for POT textures
    - drm/dp_mst: Correct the bug in drm_dp_update_payload_part1()
    - drm/amdgpu: initialize vm_inv_eng0_sem for gfxhub and mmhub
    - drm/amdgpu: invalidate mmhub semaphore workaround in gmc9/gmc10
    - drm/amdgpu/gfx10: explicitly wait for cp idle after halt/unhalt
    - drm/amdgpu/gfx10: re-init clear state buffer after gpu reset
    - drm/amdgpu: avoid using invalidate semaphore for picasso
    - drm/amdgpu: add invalidate semaphore limit for SRIOV and picasso in gmc9
    - ALSA: hda: Fix regression by strip mask fix

  [ Joe Richey ]
  * [amd64/cloud-amd64] tpm: Enable TPM drivers for Cloud (Closes: #946237)

  [ Ben Hutchings ]
  * [armel/rpi,armhf,arm64] Enable DEBUG_WX
  * linux-cpupower: Fix grammar error in package description
  * debian/control: Make library package descriptions more consistent
  * Set ABI to 1
  * tracing: Do not create directories if lockdown is in affect

  [ Aurelien Jarno ]
  * [armhf,arm64] Fix critical trip point on RPI 3.

  [ Salvatore Bonaccorso ]
  * [rt] Update to 5.4.3-rt1 and re-enable
  * [rt] Enable PREEMPT_RT (instead of PREEMPT_RT_FULL) which is part of 5.4
  * [rt] Update to 5.4.5-rt3

  [ YunQiang Su ]
  * [mipsel,mips64el/loongson-3] Enable AMDGPU.
  * [mips*] switch to vmlinuz from vmlinux except octeon.
  * [mips*] enable CONFIG_MIPS_O32_FP64_SUPPORT.
  * [mips*] enable CONFIG_CPU_HAS_MSA except octeon.

  [ Vagrant Cascadian ]
  * [arm64] drivers/gpu/drm/sun4i: Enable DRM_SUN8I_MIXER as a module.
    (Closes: #946510). Thanks to Andrei POPESCU.

  [ Sudip Mukherjee ]
  * Add libtraceevent packages (Closes: #944138)

 -- Ben Hutchings <ben@decadent.org.uk>  Fri, 27 Dec 2019 22:17:44 +0000

linux (5.4.2-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.1
    - Bluetooth: Fix invalid-free in bcsp_close()
    - ath9k_hw: fix uninitialized variable data
    - ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe
      (CVE-2019-15099)
    - ath10k: Fix HOST capability QMI incompatibility
    - ath10k: restore QCA9880-AR1A (v1) detection
    - Revert "Bluetooth: hci_ll: set operational frequency earlier"
    - Revert "dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues"
    - md/raid10: prevent access of uninitialized resync_pages offset
    - [x86] insn: Fix awk regexp warnings
    - [x86] speculation: Fix incorrect MDS/TAA mitigation status
    - [x86] speculation: Fix redundant MDS mitigation message
    - nbd: prevent memory leak
    - [i386] x86/stackframe/32: Repair 32-bit Xen PV
    - [i386] x86/xen/32: Make xen_iret_crit_fixup() independent of frame
      layout
    - [i386] x86/xen/32: Simplify ring check in xen_iret_crit_fixup()
    - [i386] x86/doublefault/32: Fix stack canaries in the double fault
      handler
    - [i386] x86/pti/32: Size initial_page_table correctly
    - [i386] x86/cpu_entry_area: Add guard page for entry stack on 32bit
    - [i386] x86/entry/32: Fix IRET exception
    - [i386] x86/entry/32: Use %ss segment where required
    - [i386] x86/entry/32: Move FIXUP_FRAME after pushing %fs in SAVE_ALL
    - [i386] x86/entry/32: Unwind the ESPFIX stack earlier on exception entry
    - [i386] x86/entry/32: Fix NMI vs ESPFIX
    - [i386] x86/pti/32: Calculate the various PTI cpu_entry_area sizes
      correctly, make the CPU_ENTRY_AREA_PAGES assert precise
    - [i386] x86/entry/32: Fix FIXUP_ESPFIX_STACK with user CR3
    - futex: Prevent robust futex exit race
    - ALSA: usb-audio: Fix NULL dereference at parsing BADD
    - ALSA: usb-audio: Fix Scarlett 6i6 Gen 2 port data
    - media: vivid: Set vid_cap_streaming and vid_out_streaming to true
    - media: vivid: Fix wrong locking that causes race conditions on streaming
      stop (CVE-2019-18683)
    - media: usbvision: Fix invalid accesses after device disconnect
    - media: usbvision: Fix races among open, close, and disconnect
    - cpufreq: Add NULL checks to show() and store() methods of cpufreq
    - futex: Move futex exit handling into futex code
    - futex: Replace PF_EXITPIDONE with a state
    - exit/exec: Seperate mm_release()
    - futex: Split futex_mm_release() for exit/exec
    - futex: Set task::futex_state to DEAD right after handling futex exit
    - futex: Mark the begin of futex exit explicitly
    - futex: Sanitize exit state handling
    - futex: Provide state handling for exec() as well
    - futex: Add mutex around futex exit
    - futex: Provide distinct return value when owner is exiting
    - futex: Prevent exit livelock
    - media: uvcvideo: Fix error path in control parsing failure
    - media: b2c2-flexcop-usb: add sanity checking (CVE-2019-15291)
    - media: cxusb: detect cxusb_ctrl_msg error in query
    - media: imon: invalid dereference in imon_touch_event
    - media: mceusb: fix out of bounds read in MCE receiver buffer
    - ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs
    - usbip: tools: fix fd leakage in the function of read_attr_usbip_status
    - usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit()
    - usb-serial: cp201x: support Mark-10 digital force gauge
    - USB: chaoskey: fix error case of a timeout
    - appledisplay: fix error handling in the scheduled work
    - USB: serial: mos7840: add USB ID to support Moxa UPort 2210
    - USB: serial: mos7720: fix remote wakeup
    - USB: serial: mos7840: fix remote wakeup
    - USB: serial: option: add support for DW5821e with eSIM support
    - USB: serial: option: add support for Foxconn T77W968 LTE modules
    - [x86] staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
    - [powerpc*] powerpc/book3s64: Fix link stack flush on context switch
      (CVE-2019-18660)
    - [powerpc*] KVM: PPC: Book3S HV: Flush link stack on guest exit to host
      kernel
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2
    - io_uring: async workers should inherit the user creds
    - net: separate out the msghdr copy from ___sys_{send,recv}msg()
    - net: disallow ancillary data for __sys_{send,recv}msg_file()
    - [arm64] crypto: inside-secure - Fix stability issue with Macchiatobin
    - driver core: platform: use the correct callback type for bus_find_device
    - [arm64,armel,armhf] usb: dwc2: use a longer core rest timeout in
      dwc2_core_reset()
    - [x86] staging: rtl8192e: fix potential use after free
    - staging: rtl8723bs: Drop ACPI device ids
    - staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids
    - USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
    - [x86] mei: bus: prefix device names on bus with the bus name
    - [x86] mei: me: add comet point V device id
    - [x86] thunderbolt: Power cycle the router if NVM authentication fails
    - [x86] fpu: Don't cache access to fpu_fpregs_owner_ctx
    - macvlan: schedule bc_work even if error
    - mdio_bus: don't use managed reset-controller
    - net: macb: add missed tasklet_kill
    - net: psample: fix skb_over_panic
    - net: sched: fix `tc -s class show` no bstats on class with nolock
      subqueues
    - openvswitch: fix flow command message size
    - sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook
    - slip: Fix use-after-free Read in slip_open
    - sctp: cache netns in sctp_ep_common
    - openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
    - openvswitch: remove another BUG_ON()
    - net: skmsg: fix TLS 1.3 crash with full sk_msg
    - tipc: fix link name length check
    - r8169: fix jumbo configuration for RTL8168evl
    - r8169: fix resume on cable plug-in
    - ext4: add more paranoia checking in ext4_expand_extra_isize handling
    - Revert "jffs2: Fix possible null-pointer dereferences in
      jffs2_add_frag_to_fragtree()"
    - HID: core: check whether Usage Page item is after Usage ID items
    - [x86] platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
    - [x86] platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input
      size

  [ Ben Hutchings ]
  * [armel] udeb: Replace m25p80 with spi-nor in mtd-modules (fixes FTBFS)
  * [ia64] udeb: Remove SGI SN2 modules (fixes FTBFS)
  * iio: Enable TI_ADS1015 as module, replacing SENSORS_ADS1015
  * [armhf] regulator: Really enable REGULATOR_STM32_PWR
  * [armhf] drm/panel: Enable DRM_PANEL_{SONY_ACX565AKM,TPO_TD028TTEC1,
    TPO_TD043MTEA1} as modules, replacing the corresponding omapdrm options
  * [armhf,arm64] platform/chrome: Change chromeos drivers back to modules
  * Build-Depend on kernel-wedge 2.102; remove workaround in debian/rules.real
  * debian/bin: Add script to update taint list for bug reporting script
  * linux-image: bug: Update taint list and use upstream descriptions
  * btrfs,fanotify: Use TAINT_AUX instead of TAINT_USER for unsupported
    features

  [ Romain Perier ]
  * Enable VIRTIO_FS and VIRTIO_PMEM (Closes: #945853)

  [ Aurelien Jarno]
  * [ppc64el] Fix building libbpf with recent binutils versions (fixes FTBFS).

  [ Luca Boccassi ]
  * verity: enable DM_VERITY_VERIFY_ROOTHASH_SIG

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 05 Dec 2019 08:37:56 +0100

linux (5.4-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.4

  [ Ben Hutchings ]
  * lockdown: Rebase on upstream Lockdown LSM:
    - Refresh "efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode"
    - Update "efi: Lock down the kernel if booted in secure boot mode"
    - Update "Add a SysRq option to lift kernel lockdown"
    - Update "mtd: Disable slram and phram when locked down"
    - Update "arm64: add kernel config option to lock down when in Secure Boot
      mode"
    - Refresh "lockdown: Refer to Debian wiki until manual page exists"
    - Drop all other lockdown patches
    - Enable SECURITY_LOCKDOWN_LSM, LOCK_DOWN_KERNEL_FORCE_NONE,
      LOCK_DOWN_IN_EFI_SECURE_BOOT
  * [armel/marvell] lockdown: Disable Lockdown as it now selects MODULE_SIG
  * [amd64] Update "x86: Make x32 syscall support conditional …" for 5.4
  * debian/lib/python/debian_linux/abi.py: Add support for symbol namespaces
  * debian/bin/genpatch-rt: Fix series generation from git

  [ Romain Perier ]
  * Rebased the following patches onto 5.4.x:
    - debian/version.patch
    - debian/ia64-hardcode-arch-script-output.patch
    - bugfix/all/
      radeon-amdgpu-firmware-is-required-for-drm-and-kms-on-r600-onward.patch
    - features/all/aufs5/aufs5-mmap.patch
    - features/all/aufs5/aufs5-standalone.patch
    - features/x86/
      intel-iommu-add-kconfig-option-to-exclude-igpu-by-default.patch
    - bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch
    - debian/revert-objtool-fix-config_stack_validation-y-warning.patch
    - features/all/db-mok-keyring/
      0003-MODSIGN-checking-the-blacklisted-hash-before-loading-a-kernel-module
      .patch
    - bugfix/all/tools-perf-man-date.patch
    - bugfix/all/usbip-fix-misuse-of-strncpy.patch
    - bugfix/all/partially-revert-usb-kconfig-using-select-for-usb_co.patch

  [ John Paul Adrian Glaubitz ]
  * [m68k] Enable CONFIG_PATA_BUDDHA as module

  [ Aurelien Jarno ]
  * [armhf] Add support for STM32MP1 SoC: enable ARCH_STM32,
    CRYPTO_DEV_STM32_CRC, CRYPTO_DEV_STM32_CRYP, CRYPTO_DEV_STM32_HASH,
    DRM_PANEL_ORISETECH_OTM8009A, DRM_SII902X, DRM_STM, DRM_STM_DSI,
    HW_RANDOM_STM32, I2C_STM32F7, INPUT_STPMIC1_ONKEY, MFD_STM32_LPTIMER,
    MFD_STPMIC1, MTD_NAND_STM32_FMC2, PHY_STM32_USBPHYC, PWM_STM32_LP,
    REGULATOR_STM32_BOOSTER, REGULATOR_STM32_PWR, REGULATOR_STM32_VREFBUF,
    REGULATOR_STPMIC1, REMOTEPROC, RTC_DRV_STM32, SERIAL_STM32,
    SERIAL_STM32_CONSOLE, SND_AUDIO_GRAPH_CARD, SND_SOC_CS42L51_I2C,
    SND_SOC_STM32_DFSDM, SND_SOC_STM32_I2S, SND_SOC_STM32_SAI,
    SND_SOC_STM32_SPDIFRX, SPI_STM32, SPI_STM32_QSPI, STM32_DMA,
    STM32_DMAMUX, STM32_MDMA, STM32_RPROC, STPMIC1_WATCHDOG,
    TOUCHSCREEN_EDT_FT5X06.
  * [arm64] Re-enable BT_HCIUART_{BCM,LL} (arm64 version of #906048).
  * [arm64,armhf] Enable CLK_RASPBERRYPI and RASPBERRYPI_CPUFREQ.

  [ Salvatore Bonaccorso ]
  * md: Enable MD_CLUSTER as module (Closes: #927026)

 -- Ben Hutchings <ben@decadent.org.uk>  Tue, 26 Nov 2019 01:33:11 +0000

linux (5.3.15-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.10
    - regulator: of: fix suspend-min/max-voltage parsing
    - ASoC: topology: Fix a signedness bug in soc_tplg_dapm_widget_create()
    - [arm64] dts: allwinner: a64: pine64-plus: Add PHY regulator delay
    - [arm64] dts: allwinner: a64: Drop PMU node
    - [arm64] dts: allwinner: a64: sopine-baseboard: Add PHY regulator delay
    - [arm64] dts: Fix gpio to pinmux mapping
    - [x86] pinctrl: intel: Allocate IRQ chip dynamic
    - [amd64] ASoC: SOF: loader: fix kernel oops on firmware boot failure
    - [amd64] ASoC: SOF: topology: fix parse fail issue for byte/bool tuple
      types
    - [amd64] ASoC: SOF: Intel: hda: fix warnings during FW load
    - [amd64] ASoC: SOF: Intel: initialise and verify FW crash dump data.
    - [amd64] ASoC: SOF: Intel: hda: Disable DMI L1 entry during capture
    - [amd64] ASoC: rt5682: add NULL handler to set_jack function
    - [amd64] ASoC: intel: sof_rt5682: add remove function to disable jack
    - [x86] ASoC: intel: bytcr_rt5651: add null check to support_button_press
    - [armhf] regulator: pfuze100-regulator: Variable "val" in
      pfuze100_regulator_probe() could be uninitialized
    - [armhf,arm64] ASoc: rockchip: i2s: Fix RPM imbalance
    - [arm64] dts: rockchip: fix Rockpro64 RK808 interrupt line
    - [armhf] dts: logicpd-torpedo-som: Remove twl_keypad
    - [arm64] dts: rockchip: fix RockPro64 vdd-log regulator settings
    - [arm64] dts: rockchip: fix RockPro64 sdhci settings
    - [arm64] dts: zii-ultra: fix ARM regulator states
    - [armhf] dts: am3874-iceboard: Fix 'i2c-mux-idle-disconnect' usage
    - [armhf] dts: Use level interrupt for omap4 & 5 wlcore
    - [armel,armhf] mm: fix alignment handler faults under memory pressure
    - scsi: qla2xxx: fix a potential NULL pointer dereference
    - scsi: scsi_dh_alua: handle RTPG sense code correctly during state
      transitions
    - [armel,armhf] 8908/1: add __always_inline to functions called from
      __get_user_check()
    - [arm64] dts: rockchip: fix RockPro64 sdmmc settings
    - [arm64] dts: rockchip: Fix usb-c on Hugsun X99 TV Box
    - [armhf] dts: imx6q-logicpd: Re-Enable SNVS power key
    - perf tools: Fix resource leak of closedir() on the error paths
    - perf c2c: Fix memory leak in build_cl_output()
    - perf kmem: Fix memory leak in compact_gfp_flags()
    - drm/amdgpu: fix potential VM faults
    - drm/amdgpu: fix error handling in amdgpu_bo_list_create
    - scsi: target: core: Do not overwrite CDB byte 1
    - scsi: hpsa: add missing hunks in reset-patch
    - [x86] ASoC: Intel: sof-rt5682: add a check for devm_clk_get
    - [x86] ASoC: SOF: control: return true when kcontrol values change
    - tracing: Fix "gfp_t" format for synthetic events
    - [arm64] dts: bcm2837-rpi-cm3: Avoid leds-gpio probing issue
    - [x86] ALSA: hda: Add Tigerlake/Jasperlake PCI ID
    - [armhf,arm64] irqchip/gic-v3-its: Use the exact ITSList for VMOVP
    - cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs
    - [riscv64] irqchip/sifive-plic: Skip contexts except supervisor in
      plic_init()
    - nbd: protect cmd->status with cmd->lock
    - nbd: handle racing with error'ed out commands
    - cxgb4: fix panic when attaching to ULD fail
    - cxgb4: request the TX CIDX updates to status page
    - dccp: do not leak jiffies on the wire
    - erspan: fix the tun_info options_len check for erspan
    - inet: stop leaking jiffies on the wire
    - net: annotate accesses to sk->sk_incoming_cpu
    - net: annotate lockless accesses to sk->sk_napi_id
    - [armhf] net: dsa: bcm_sf2: Fix IMP setup for port different than 8
    - net: fix sk_page_frag() recursion from memory reclaim
    - [arm64] net: hisilicon: Fix ping latency when deal with high throughput
    - net/mlx4_core: Dynamically set guaranteed amount of counters per VF
    - netns: fix GFP flags in rtnl_net_notifyid()
    - net: rtnetlink: fix a typo fbd -> fdb
    - net: usb: lan78xx: Disable interrupts before calling generic_handle_irq()
    - net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()
    - udp: fix data-race in udp_set_dev_scratch()
    - vxlan: check tun_info options_len properly
    - net: add skb_queue_empty_lockless()
    - udp: use skb_queue_empty_lockless()
    - net: use skb_queue_empty_lockless() in poll() handlers
    - net: use skb_queue_empty_lockless() in busy poll contexts
    - net: add READ_ONCE() annotation in __skb_wait_for_more_packets()
    - ipv4: fix route update on metric change.
    - net/smc: fix closing of fallback SMC sockets
    - net/smc: keep vlan_id for SMC-R in smc_listen_work()
    - keys: Fix memory leak in copy_net_ns
    - net: phylink: Fix phylink_dbg() macro
    - rxrpc: Fix handling of last subpacket of jumbo packet
    - net/mlx5e: Determine source port properly for vlan push action
    - net/mlx5e: Remove incorrect match criteria assignment line
    - net/mlx5e: Initialize on stack link modes bitmap
    - net/mlx5: Fix flow counter list auto bits struct
    - net/smc: fix refcounting for non-blocking connect()
    - net/mlx5: Fix rtable reference leak
    - r8169: fix wrong PHY ID issue with RTL8168dp
    - net/mlx5e: Fix ethtool self test: link speed
    - net/mlx5e: Fix handling of compressed CQEs in case of low NAPI budget
    - ipv4: fix IPSKB_FRAG_PMTU handling with fragmentation
    - [armhf] net: dsa: b53: Do not clear existing mirrored port mask
    - net: dsa: fix switch tree list
    - net: ensure correct skb->tstamp in various fragmenters
    - [arm64] net: hns3: fix mis-counting IRQ vector numbers issue
    - net: netem: fix error path for corrupted GSO frames
    - net: reorder 'struct net' fields to avoid false sharing
    - net: usb: lan78xx: Connect PHY before registering MAC
    - [x86] r8152: add device id for Lenovo ThinkPad USB-C Dock Gen 2
    - net: netem: correct the parent's backlog when corrupted packet was
      dropped
    - net/flow_dissector: switch to siphash
    - CIFS: Fix retry mid list corruption on reconnects
    - usb: gadget: udc: core: Fix segfault if udc_bind_to_driver() for pending
      driver fails
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11
    - bonding: fix state transition issue in link monitoring
    - CDC-NCM: handle incomplete transfer of MTU
    - ipv4: Fix table id reference in fib_sync_down_addr
    - [mips*/octeon] net: ethernet: octeon_mgmt: Account for second possible
      VLAN header
    - net: fix data-race in neigh_event_send()
    - net: usb: qmi_wwan: add support for DW5821e with eSIM support
    - nfc: netlink: fix double device reference drop
    - qede: fix NULL pointer deref in __qede_remove()
    - ipv6: fixes rt6_probe() and fib6_nh->last_probe init
    - [arm64] net: hns: Fix the stray netpoll locks causing deadlock in NAPI
      path
    - net: prevent load/store tearing on sk->sk_stamp
    - net: sched: prevent duplicate flower rules from tcf_proto destroy race
    - net/smc: fix ethernet interface refcounting
    - vsock/virtio: fix sock refcnt holding during the shutdown
    - r8169: fix page read in r8168g_mdio_read
    - ALSA: timer: Fix incorrectly assigned timer instance
    - ALSA: bebob: fix to detect configured source of sampling clock for
      Focusrite Saffire Pro i/o series
    - ALSA: hda/ca0132 - Fix possible workqueue stall
    - mm: memcontrol: fix NULL-ptr deref in percpu stats flush
    - mm: memcontrol: fix network errors from failing __GFP_ATOMIC charges
    - mm, meminit: recalculate pcpu batch and high limits after init completes
    - mm: thp: handle page cache THP correctly in PageTransCompoundMap
    - mm, vmstat: hide /proc/pagetypeinfo from normal users
    - dump_stack: avoid the livelock of the dump_lock
    - mm: slab: make page_cgroup_ino() to recognize non-compound slab pages
      properly
    - btrfs: Consider system chunk array size for new SYSTEM chunks
    - btrfs: tree-checker: Fix wrong check on max devid
    - btrfs: save i_size to avoid double evaluation of i_size_read in
      compress_file_range
    - [x86] pinctrl: intel: Avoid potential glitches if pin is in GPIO mode
    - perf tools: Fix time sorting
    - perf map: Use zalloc for map_groups
    - drm/radeon: fix si_enable_smc_cac() failed issue
    - HID: wacom: generic: Treat serial number and related fields as unsigned
    - mm/khugepaged: fix might_sleep() warn with CONFIG_HIGHPTE=y
    - blkcg: make blkcg_print_stat() print stats only for online blkgs
    - [arm64] Do not mask out PTE_RDONLY in pte_same()
    - ceph: fix use-after-free in __ceph_remove_cap()
    - ceph: fix RCU case handling in ceph_d_revalidate()
    - ceph: add missing check in d_revalidate snapdir handling
    - ceph: don't try to handle hashed dentries in non-O_CREAT atomic_open
    - ceph: don't allow copy_file_range when stripe_count != 1
    - [x86] iio: imu: inv_mpu6050: fix no data on MPU6050
    - [armhf] sunxi: Fix CPU powerdown on A83T
    - [armhf] dts: imx6-logicpd: Re-enable SNVS power key
    - cpufreq: intel_pstate: Fix invalid EPB setting
    - clone3: validate stack arguments
    - netfilter: nf_tables: Align nft_expr private data to 64-bit
    - netfilter: ipset: Fix an error code in ip_set_sockfn_get()
    - [x86] intel_th: gth: Fix the window switching sequence
    - [x86] intel_th: pci: Add Comet Lake PCH support
    - [x86] intel_th: pci: Add Jasper Lake PCH support
    - [amd64] dumpstack: Don't evaluate exception stacks before setup
    - [i386] apic: Avoid bogus LDR warnings
    - SMB3: Fix persistent handles reconnect
    - can: usb_8dev: fix use-after-free on disconnect
    - [armhf] can: flexcan: disable completely the ECC mechanism
    - [armhf] can: c_can: c_can_poll(): only read status register after status
      IRQ
    - can: peak_usb: fix a potential out-of-sync while decoding packets
    - can: rx-offload: can_rx_offload_queue_sorted(): fix error handling, avoid
      skb mem leak
    - can: gs_usb: gs_can_open(): prevent memory leak (CVE-2019-19052)
    - can: dev: add missing of_node_put() after calling of_get_child_by_name()
    - can: mcba_usb: fix use-after-free on disconnect (CVE-2019-19529)
    - can: peak_usb: fix slab info leak (CVE-2019-19534)
    - configfs: fix a deadlock in configfs_symlink()
    - ALSA: usb-audio: More validations of descriptor units
    - ALSA: usb-audio: Simplify parse_audio_unit()
    - ALSA: usb-audio: Unify the release of usb_mixer_elem_info objects
    - ALSA: usb-audio: Remove superfluous bLength checks
    - ALSA: usb-audio: Clean up check_input_term()
    - ALSA: usb-audio: Fix possible NULL dereference at
      create_yamaha_midi_quirk()
    - ALSA: usb-audio: remove some dead code
    - ALSA: usb-audio: Fix copy&paste error in the validator
    - usbip: Implement SG support to vhci-hcd and stub driver
    - HID: google: add magnemite/masterball USB ids
    - bpf: lwtunnel: Fix reroute supplying invalid dst
    - [x86] HID: intel-ish-hid: fix wrong error handling in
      ishtp_cl_alloc_tx_ring()
    - [powerpc] fix allow/prevent_user_access() when crossing segment
      boundaries.
    - RDMA/mlx5: Clear old rate limit when closing QP
    - iw_cxgb4: fix ECN check on the passive accept
    - RDMA/siw: free siw_base_qp in kref release routine
    - RDMA/qedr: Fix reported firmware version
    - IB/core: Use rdma_read_gid_l2_fields to compare GID L2 fields
    - net/mlx5e: Tx, Fix assumption of single WQEBB of NOP in cleanup flow
    - net/mlx5e: TX, Fix consumer index of error cqe dump
    - net/mlx5: prevent memory leak in mlx5_fpga_conn_create_cq
      (CVE-2019-19045)
    - net/mlx5: fix memory leak in mlx5_fw_fatal_reporter_dump (CVE-2019-19047)
    - scsi: qla2xxx: fixup incorrect usage of host_byte
    - scsi: lpfc: Check queue pointer before use
    - scsi: ufs-bsg: Wake the device before sending raw upiu commands
    - RDMA/uverbs: Prevent potential underflow
    - bpf: Fix use after free in subprog's jited symbol removal
    - [armhf,arm64] net: stmmac: Fix the problem of tso_xmit
    - net: openvswitch: free vport unless register_netdevice() succeeds
    - scsi: lpfc: Honor module parameter lpfc_use_adisc
    - scsi: qla2xxx: Initialized mailbox to prevent driver load failure
    - bpf: Fix use after free in bpf_get_prog_name
    - iwlwifi: pcie: fix PCI ID 0x2720 configs that should be soc
    - iwlwifi: pcie: fix all 9460 entries for qnj
    - iwlwifi: pcie: 0x2720 is qu and 0x30DC is not
    - netfilter: nf_flow_table: set timeout before insertion into hashes
    - xsk: Fix registration of Rx-only sockets
    - net: phy: smsc: LAN8740: add PHY_RST_AFTER_CLK_EN flag
    - ipvs: don't ignore errors in case refcounting ip_vs module fails
    - ipvs: move old_secure_tcp into struct netns_ipvs
    - netfilter: nft_payload: fix missing check for matching length in offloads
    - RDMA/nldev: Skip counter if port doesn't match
    - bonding: fix unexpected IFF_BONDING bit unset
    - bonding: use dynamic lockdep key instead of subclass
    - macsec: fix refcnt leak in module exit routine
    - virt_wifi: fix refcnt leak in module exit routine
    - scsi: sd: define variable dif as unsigned int instead of bool
    - usb: gadget: composite: Fix possible double free memory bug
    - usb: gadget: configfs: fix concurrent issue between composite APIs
    - [armhf,arm64] usb: dwc3: remove the call trace of USBx_GFLADJ
    - [x86] perf/amd/ibs: Fix reading of the IBS OpData register and thus
      precise RIP validity
    - [x86] perf/amd/ibs: Handle erratum #420 only on the affected CPU family
      (10h)
    - [x86] perf/uncore: Fix event group support
    - USB: Skip endpoints with 0 maxpacket length
    - USB: ldusb: use unsigned size format specifiers
    - usbip: tools: Fix read_usb_vudc_device() error path handling
    - RDMA/iw_cxgb4: Avoid freeing skb twice in arp failure case
    - [arm64] RDMA/hns: Prevent memory leaks of eq->buf_list
    - scsi: qla2xxx: stop timer in shutdown path
    - sched/topology: Don't try to build empty sched domains
    - sched/topology: Allow sched_asym_cpucapacity to be disabled
    - nvme-multipath: fix possible io hang after ctrl reconnect
    - [amd64] fjes: Handle workqueue allocation failure
    - [arm64] net: hisilicon: Fix "Trying to free already-free IRQ"
    - wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle
      (CVE-2019-19051)
    - [x86] iommu/amd: Apply the same IVRS IOAPIC workaround to Acer Aspire
      A315-41
    - mt76: dma: fix buffer unmap with non-linear skbs
    - drm/amdgpu/sdma5: do not execute 0-sized IBs (v2)
    - drm/sched: Set error to s_fence if HW job submission failed.
    - drm/amdgpu: If amdgpu_ib_schedule fails return back the error.
    - drm/amd/display: do not synchronize "drr" displays
    - drm/amd/display: add 50us buffer as WA for pstate switch in active
    - drm/amd/display: Passive DP->HDMI dongle detection fix
    - drm/amd/display: dc.c:use kzalloc without test
    - SUNRPC: The TCP back channel mustn't disappear while requests are
      outstanding
    - SUNRPC: The RDMA back channel mustn't disappear while requests are
      outstanding
    - SUNRPC: Destroy the back channel when we destroy the host transport
    - [x86] hv_netvsc: Fix error handling in netvsc_attach()
    - efi/tpm: Return -EINVAL when determining tpm final events log size fails
    - efi: libstub/arm: Account for firmware reserved memory at the base of RAM
    - [x86] efi: Never relocate kernel below lowest acceptable address
    - [arm64] cpufeature: Enable Qualcomm Falkor errata 1009 for Kryo
    - usb: dwc3: gadget: fix race when disabling ep with cancelled xfers
    - [arm64] apply ARM64_ERRATUM_845719 workaround for Brahma-B53 core
    - [arm64] Brahma-B53 is SSB and spectre v2 safe
    - [arm64] apply ARM64_ERRATUM_843419 workaround for Brahma-B53 core
    - NFSv4: Don't allow a cached open with a revoked delegation
    - igb: Fix constant media auto sense switching when no cable is connected
    - e1000: fix memory leaks
    - ocfs2: protect extent tree in ocfs2_prepare_inode_for_write()
    - [x86] pinctrl: cherryview: Fix irq_valid_mask calculation
    - timekeeping/vsyscall: Update VDSO data unconditionally
    - mm/filemap.c: don't initiate writeback if mapping has no dirty pages
    - cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg
      is dead
    - [x86] ASoC: SOF: Intel: hda-stream: fix the CONFIG_ prefix missing
    - usbip: Fix free of unallocated memory in vhci tx
    - bonding: fix using uninitialized mode_lock
    - netfilter: ipset: Copy the right MAC address in hash:ip,mac IPv6 sets
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.12
    - scsi: core: Handle drivers which set sg_tablesize to zero
    - ax88172a: fix information leak on short answers
    - devlink: disallow reload operation during device cleanup
    - ipmr: Fix skb headroom in ipmr_get_route().
    - net/smc: fix fastopen for non-blocking connect()
    - net: usb: qmi_wwan: add support for Foxconn T77W968 LTE modules
    - slip: Fix memory leak in slip_open error path
    - tcp: remove redundant new line from tcp_event_sk_skb
    - devlink: Add method for time-stamp on reporter's dump
    - net/smc: fix refcount non-blocking connect() -part 2
    - ALSA: usb-audio: Fix missing error check at mixer resolution test
    - ALSA: usb-audio: not submit urb for stopped endpoint
    - ALSA: usb-audio: Fix incorrect NULL check in create_yamaha_midi_quirk()
    - ALSA: usb-audio: Fix incorrect size check for processing/extension units
    - Btrfs: fix log context list corruption after rename exchange operation
    - cgroup: freezer: call cgroup_enter_frozen() with preemption disabled in
      ptrace_stop()
    - Input: ff-memless - kill timer in destroy() (CVE-2019-19524)
    - Input: synaptics-rmi4 - fix video buffer size
    - Input: synaptics-rmi4 - disable the relative position IRQ in the F12
      driver
    - Input: synaptics-rmi4 - do not consume more data than we have (F11, F12)
    - Input: synaptics-rmi4 - clear IRQ enables for F54
    - Input: synaptics-rmi4 - destroy F54 poller workqueue when removing
    - KVM: MMU: Do not treat ZONE_DEVICE pages as being reserved
    - IB/hfi1: Ensure r_tid_ack is valid before building TID RDMA ACK packet
    - IB/hfi1: Calculate flow weight based on QP MTU for TID RDMA
    - IB/hfi1: TID RDMA WRITE should not return IB_WC_RNR_RETRY_EXC_ERR
    - IB/hfi1: Ensure full Gen3 speed in a Gen4 system
    - IB/hfi1: Use a common pad buffer for 9B and 16B packets
    - i2c: acpi: Force bus speed to 400KHz if a Silead touchscreen is present
    - [x86] quirks: Disable HPET on Intel Coffe Lake platforms
    - ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable
    - ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either
    - io_uring: ensure registered buffer import returns the IO length
    - [x86] drm/i915: update rawclk also on resume
    - [x86] Revert "drm/i915/ehl: Update MOCS table for EHL"
    - ntp/y2038: Remove incorrect time_t truncation
    - [x86] iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros
    - mm: mempolicy: fix the wrong return value and potential pages leak of
      mbind
    - mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm()
    - mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup()
    - mm: slub: really fix slab walking for init_on_free
    - mm/memory_hotplug: fix try_offline_node()
    - mm/page_io.c: do not free shared swap slots
    - mmc: sdhci-of-at91: fix quirk2 overwrite
    - slcan: Fix memory leak in error path
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.13
    - net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size()
    - block, bfq: deschedule empty bfq_queues not referred by any process
    - mm/memory_hotplug: don't access uninitialized memmaps in
      shrink_pgdat_span()
    - mm/memory_hotplug: fix updating the node span
    - [arm64] uaccess: Ensure PAN is re-enabled after unhandled uaccess fault
    - fbdev: Ditch fb_edid_add_monspecs
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.14
    - net/mlx4_en: fix mlx4 ethtool -N insertion
    - net/mlx4_en: Fix wrong limitation for number of TX rings
    - net: rtnetlink: prevent underflows in do_setvfinfo()
    - net/sched: act_pedit: fix WARN() in the traffic path
    - net: sched: ensure opts_len <= IP_TUNNEL_OPTS_MAX in act_tunnel_key
    - sfc: Only cancel the PPS workqueue if it exists
    - net/mlxfw: Verify FSM error code translation doesn't exceed array size
    - net/mlx5e: Fix set vf link state error flow
    - net/mlx5: Fix auto group size calculation
    - ipv6/route: return if there is no fib_nh_gw_family
    - taprio: don't reject same mqprio settings
    - net/ipv4: fix sysctl max for fib_multipath_hash_policy
    - net/mlx5e: Fix error flow cleanup in mlx5e_tc_tun_create_header_ipv4/6
    - net/mlx5e: Do not use non-EXT link modes in EXT mode
    - net/mlx5: Update the list of the PCI supported devices
    - vhost/vsock: split packets to send using multiple buffers
    - [arm64] gpio: max77620: Fixup debounce delays
    - fork: fix pidfd_poll()'s return type
    - nbd:fix memory leak in nbd_get_socket()
    - virtio_console: allocate inbufs in add_port() only if it is needed
    - virtio_ring: fix return code on DMA mapping fails
    - virtio_balloon: fix shrinker count
    - Revert "fs: ocfs2: fix possible null-pointer dereferences in
      ocfs2_xa_prepare_entry()"
    - mm/memory_hotplug: don't access uninitialized memmaps in
      shrink_zone_span()
    - mm/ksm.c: don't WARN if page is still mapped in remove_stable_node()
    - drm/amdgpu: disable gfxoff when using register read interface
    - drm/amdgpu: disable gfxoff on original raven
    - drm/amd/powerplay: issue no PPSMC_MSG_GetCurrPkgPwr on unsupported ASICs
    - [x86] drm/i915: Don't oops in dumb_create ioctl if we have no crtcs
    - [x86] drm/i915/pmu: "Frequency" is reported as accumulated cycles
    - [x86] drm/i915/userptr: Try to acquire the page lock around
      set_page_dirty()
    - Bluetooth: Fix invalid-free in bcsp_close()
    - ath10k: restore QCA9880-AR1A (v1) detection
    - ath10k: Fix HOST capability QMI incompatibility
    - ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe
      (CVE-2019-15099)
    - ath9k_hw: fix uninitialized variable data
    - Revert "Bluetooth: hci_ll: set operational frequency earlier"
    - Revert "dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues"
    - md/raid10: prevent access of uninitialized resync_pages offset
    - mdio_bus: Fix init if CONFIG_RESET_CONTROLLER=n
    - [armel,armhf] 8904/1: skip nomap memblocks while finding the lowmem/
      highmem boundary
    - [x86] insn: Fix awk regexp warnings
    - [x86] speculation: Fix incorrect MDS/TAA mitigation status
    - [x86] speculation: Fix redundant MDS mitigation message
    - nbd: prevent memory leak
    - [i386] stackframe: Repair 32-bit Xen PV
    - [i386] xen: Make xen_iret_crit_fixup() independent of frame layout
    - [i386] xen: Simplify ring check in xen_iret_crit_fixup()
    - [i386] doublefault: Fix stack canaries in the double fault handler
    - [i386] pti: Size initial_page_table correctly
    - [i386] cpu_entry_area: Add guard page for entry stack on 32bit
    - [i386] entry: Fix IRET exception
    - [i386] entry: Use %ss segment where required
    - [i386] entry: Move FIXUP_FRAME after pushing %fs in SAVE_ALL
    - [i386] entry: Unwind the ESPFIX stack earlier on exception entry
    - [i386] entry: Fix NMI vs ESPFIX
    - [i386] pti: Calculate the various PTI cpu_entry_area sizes correctly,
      make the CPU_ENTRY_AREA_PAGES assert precise
    - [i386] entry: Fix FIXUP_ESPFIX_STACK with user CR3
    - futex: Prevent robust futex exit race
    - ALSA: usb-audio: Fix NULL dereference at parsing BADD
    - nfc: port100: handle command failure cleanly
    - media: vivid: Set vid_cap_streaming and vid_out_streaming to true
    - media: vivid: Fix wrong locking that causes race conditions on streaming
      stop (CVE-2019-18683)
    - media: usbvision: Fix invalid accesses after device disconnect
    - media: usbvision: Fix races among open, close, and disconnect
    - cpufreq: Add NULL checks to show() and store() methods of cpufreq
    - media: uvcvideo: Fix error path in control parsing failure
    - media: b2c2-flexcop-usb: add sanity checking (CVE-2019-15291)
    - media: cxusb: detect cxusb_ctrl_msg error in query
    - media: imon: invalid dereference in imon_touch_event
    - media: mceusb: fix out of bounds read in MCE receiver buffer
    - mm/slub.c: init_on_free=1 should wipe freelist ptr for bulk allocations
    - usbip: tools: fix fd leakage in the function of read_attr_usbip_status
    - usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit()
    - usb-serial: cp201x: support Mark-10 digital force gauge
    - USB: chaoskey: fix error case of a timeout
    - appledisplay: fix error handling in the scheduled work
    - USB: serial: mos7840: add USB ID to support Moxa UPort 2210
    - USB: serial: mos7720: fix remote wakeup
    - USB: serial: mos7840: fix remote wakeup
    - USB: serial: option: add support for DW5821e with eSIM support
    - USB: serial: option: add support for Foxconn T77W968 LTE modules
    - [x86] staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
    - [powerpc*] 64s: support nospectre_v2 cmdline option
    - [powerpc*] book3s64: Fix link stack flush on context switch
      (CVE-2019-18660)
    - [powerpc*] KVM: Book3S HV: Flush link stack on guest exit to host kernel
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.15
    - io_uring: async workers should inherit the user creds
    - net: separate out the msghdr copy from ___sys_{send,recv}msg()
    - net: disallow ancillary data for __sys_{send,recv}msg_file()
    - XArray: Fix xas_next() with a single entry at 0
    - [arm64] clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate
    - [x86] thunderbolt: Read DP IN adapter first two dwords in one go
    - [x86] thunderbolt: Fix lockdep circular locking depedency warning
    - [x86] ASoC: compress: fix unsigned integer overflow check
    - [arm64,armel,armhf] reset: Fix memory leak in reset_control_array_put()
    - [armhf] clk: samsung: exynos542x: Move G3D subsystem clocks to its
      sub-CMU
    - [armel,armhf] ASoC: kirkwood: fix external clock probe defer
    - [armel,armhf] ASoC: kirkwood: fix device remove ordering
    - [armhf] clk: samsung: exynos5420: Preserve PLL configuration during
      suspend/resume
    - [x86] pinctrl: cherryview: Allocate IRQ chip dynamic
    - [armhf] soc: imx: gpc: fix initialiser format
    - ASoC: SOF: ipc: Fix memory leak in sof_set_get_large_ctrl_data
      (CVE-2019-18811)
    - [armhf] ASoC: ti: sdma-pcm: Add back the flags parameter for non
      standard dma names
    - [armhf] ASoC: rockchip: rockchip_max98090: Enable SHDN to fix headset
      detection
    - [arm64,armhf] clk: sunxi: Fix operator precedence in
      sunxi_divs_clk_setup
    - [armhf] clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18
    - [armhf] dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend
    - bpf: Allow narrow loads of bpf_sysctl fields with offset > 0
    - bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}()
    - [powerpc*] bpf: Fix tail call implementation
    - idr: Fix idr_get_next_ul race with idr_remove
    - idr: Fix integer overflow in idr_for_each_entry
    - idr: Fix idr_alloc_u32 on 32-bit systems
    - [amd64] ASoC: hdac_hda: fix race in device removal
    - [armhf] clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call
    - [armhf] clk: ti: clkctrl: Fix failed to enable error with double udelay
      timeout
    - [armhf] net: fec: add missed clk_disable_unprepare in remove
    - netfilter: ipset: Fix nla_policies to fully support NL_VALIDATE_STRICT
    - bridge: ebtables: don't crash when using dnat target in output chains
    - netfilter: nf_tables: bogus EOPNOTSUPP on basechain update
    - netfilter: nf_tables_offload: skip EBUSY on chain update
    - stacktrace: Don't skip first entry on noncurrent tasks
    - can: peak_usb: report bus recovery as well
    - [armhf] can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset
      on open
    - can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid
      skb mem leak
    - can: rx-offload: can_rx_offload_offload_one(): do not increase the
      skb_queue beyond skb_queue_len_max
    - can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors
      on queue overflow or OOM
    - can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to
      propagate error value in case of errors
    - can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on
      error
    - can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error
    - [armhf] can: flexcan: increase error counters if skb enqueueing via
      can_rx_offload_queue_sorted() fails
    - [x86] tsc: Respect tsc command line paraemeter for clocksource_tsc_early
    - nvme-rdma: fix a segmentation fault during module unload
    - nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths
    - [arm64] watchdog: meson: Fix the wrong value of left time
    - ALSA: hda: hdmi - add Tigerlake support
    - [amd64] ASoC: SOF: topology: Fix bytes control size checks
    - drm/amdgpu: dont schedule jobs while in reset
    - [arm64,armhf] net/mlx5e: Fix eswitch debug print of max fdb flow
    - net/mlx5e: Use correct enum to determine uplink port
    - drm/amdgpu: register gpu instance before fan boost feature enablment
    - drm/amdgpu: add warning for GRBM 1-cycle delay issue in gfx9
    - [arm64,armhf] net: stmmac: gmac4: bitrev32 returns u32
    - [arm64,armhf] net: stmmac: xgmac: bitrev32 returns u32
    - [arm64,armhf] net: stmmac: xgmac: Fix TSA selection
    - [arm64,armhf] net: stmmac: xgmac: Disable Flow Control when 1 or more
      queues are in AV
    - ceph: return -EINVAL if given fsc mount option on kernel w/o support
    - mac80211: fix ieee80211_txq_setup_flows() failure path
    - mac80211: fix station inactive_time shortly after boot
    - block: drbd: remove a stray unlock in __drbd_send_protocol()
    - ice: fix potential infinite loop because loop counter being too small
    - iavf: initialize ITRN registers with correct values
    - [arm64,armel,armhf] usb: dwc2: use a longer core rest timeout in
      dwc2_core_reset()
    - [x86] staging: rtl8192e: fix potential use after free
    - staging: rtl8723bs: Drop ACPI device ids
    - staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids
    - USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
    - [x86] mei: bus: prefix device names on bus with the bus name
    - [x86] mei: me: add comet point V device id
    - [x86] thunderbolt: Power cycle the router if NVM authentication fails
    - xfrm: Fix memleak on xfrm state destroy
    - [x86] fpu: Don't cache access to fpu_fpregs_owner_ctx (CVE-2019-19602)
    - macvlan: schedule bc_work even if error
    - mdio_bus: don't use managed reset-controller
    - net: macb: add missed tasklet_kill
    - net: psample: fix skb_over_panic
    - net: sched: fix `tc -s class show` no bstats on class with nolock
      subqueues
    - openvswitch: fix flow command message size
    - sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook
    - slip: Fix use-after-free Read in slip_open
    - sctp: cache netns in sctp_ep_common
    - openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
    - openvswitch: remove another BUG_ON()
    - net/tls: take into account that bpf_exec_tx_verdict() may free the
      record
    - net: skmsg: fix TLS 1.3 crash with full sk_msg
    - tipc: fix link name length check
    - ext4: add more paranoia checking in ext4_expand_extra_isize handling
    - HID: core: check whether Usage Page item is after Usage ID items
    - [x86] platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
    - [x86] platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input
      size
    - [armhf] net: fec: fix clock count mis-match

  [ Ben Hutchings ]
  * [amd64] sound/soc/sof: Disable SND_SOC_SOF_ACPI,
    SND_SOC_SOF_{BAYTRAIL,BROADWELL}_SUPPORT (Closes: #945914)
  * [amd64] sound/soc/intel/boarss: Disable Broxton drivers again
  * [i386] sound/soc: Enable same SOF drivers as on amd64
  * Bump ABI to 3

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 07 Dec 2019 13:24:06 +0100

linux (5.3.9-3) unstable; urgency=medium

  * [arm64,armhf,powerpc*,s390x] KVM: Add more exports to ABI ignore list
    (fixes FTBFS)

 -- Ben Hutchings <ben@decadent.org.uk>  Tue, 19 Nov 2019 01:43:33 +0000

linux (5.3.9-2) unstable; urgency=medium

  * [x86] Add mitigation for TSX Asynchronous Abort (CVE-2019-11135):
    - x86/msr: Add the IA32_TSX_CTRL MSR
    - x86/cpu: Add a helper function x86_read_arch_cap_msr()
    - x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default
    - x86/speculation/taa: Add mitigation for TSX Async Abort
    - x86/speculation/taa: Add sysfs reporting for TSX Async Abort
    - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled
    - x86/tsx: Add "auto" option to the tsx= cmdline parameter
    - x86/speculation/taa: Add documentation for TSX Async Abort
    - x86/tsx: Add config options to set tsx=on|off|auto
    - x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs
    TSX is now disabled by default; see
    Documentation/admin-guide/hw-vuln/tsx_async_abort.rst
  * [x86] KVM: Add mitigation for Machine Check Error on Page Size Change
    (aka iTLB multi-hit, CVE-2018-12207):
    - kvm: x86, powerpc: do not allow clearing largepages debugfs entry
    - x86/bugs: Add ITLB_MULTIHIT bug infrastructure
    - x86/cpu: Add Tremont to the cpu vulnerability whitelist
    - cpu/speculation: Uninline and export CPU mitigations helpers
    - kvm: mmu: ITLB_MULTIHIT mitigation
    - kvm: Add helper function for creating VM worker threads
    - kvm: x86: mmu: Recovery of shattered NX large pages
    - Documentation: Add ITLB_MULTIHIT documentation
  * [x86] i915: Mitigate local privilege escalation on gen9 (CVE-2019-0155):
    - drm/i915: Rename gen7 cmdparser tables
    - drm/i915: Disable Secure Batches for gen6+
    - drm/i915: Remove Master tables from cmdparser
    - drm/i915: Add support for mandatory cmdparsing
    - drm/i915: Support ro ppgtt mapped cmdparser shadow buffers
    - drm/i915: Allow parsing of unsized batches
    - drm/i915: Add gen9 BCS cmdparsing
    - drm/i915/cmdparser: Use explicit goto for error paths
    - drm/i915/cmdparser: Add support for backward jumps
    - drm/i915/cmdparser: Ignore Length operands during command matching
    - drm/i915/cmdparser: Fix jump whitelist clearing
  * [x86] i915: Mitigate local denial-of-service on gen8/gen9 (CVE-2019-0154):
    - drm/i915: Lower RM timeout to avoid DSI hard hangs
    - drm/i915/gen8+: Add RC6 CTX corruption WA

 -- Ben Hutchings <ben@decadent.org.uk>  Tue, 12 Nov 2019 15:44:08 +0000

linux (5.3.9-1) unstable; urgency=medium

  * New version hopefully closes: #942881
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.8
    - drm: Free the writeback_job when it with an empty fb
    - drm: Clear the fence pointer when writeback job signaled
    - [armhf] clk: ti: dra7: Fix mcasp8 clock bits
    - [armhf] dts: Fix wrong clocks for dra7 mcasp
    - nvme-pci: Fix a race in controller removal
    - scsi: ufs: skip shutdown if hba is not powered
    - scsi: megaraid: disable device when probe failed after enabled device
    - scsi: qla2xxx: Silence fwdump template message
    - scsi: qla2xxx: Fix unbound sleep in fcport delete path.
    - scsi: qla2xxx: Fix stale mem access on driver unload
    - scsi: qla2xxx: Fix N2N link reset
    - scsi: qla2xxx: Fix N2N link up fail
    - [armhf] dts: Fix gpio0 flags for am335x-icev2
    - [armhf] OMAP2+: Fix missing reset done flag for am3 and am43
    - [armhf] OMAP2+: Add missing LCDC midlemode for am335x
    - [armhf] OMAP2+: Fix warnings with broken omap2_set_init_voltage()
    - nvme-tcp: fix wrong stop condition in io_work
    - nvme-pci: Save PCI state before putting drive into deepest state
    - nvme: fix an error code in nvme_init_subsystem()
    - nvme-rdma: Fix max_hw_sectors calculation
    - nvme: Added QUIRKs for ADATA XPG SX8200 Pro 512GB
    - nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T
    - nvme-rdma: fix possible use-after-free in connect timeout
    - blk-mq: honor IO scheduler for multiqueue devices
    - xen/efi: Set nonblocking callbacks
    - loop: change queue block size to match when using DIO
    - nl80211: fix null pointer dereference
    - mac80211: fix txq null pointer dereference
    - netfilter: nft_connlimit: disable bh on garbage collection
    - [armhf,arm64] net: stmmac: xgmac: Not all Unicast addresses may be
      available
    - [armhf,arm64] net: stmmac: dwmac4: Always update the MAC Hash Filter
    - [armhf,arm64] net: stmmac: Correctly take timestamp for PTPv2
    - [armhf,arm64] net: stmmac: Do not stop PHY if WoL is enabled
    - drm/amdgpu: fix multiple memory leaks in acp_hw_init
    - drm/amd/display: memory leak
    - [mips*el/loongson-*] Fix the link time qualifier of 'serial_exit()'
    - [arm64] net: hisilicon: Fix usage of uninitialized variable in function
      mdio_sc_cfg_reg_write()
    - [armhf,arm64] net: stmmac: Avoid deadlock on suspend/resume
    - [s390x] mm: fix -Wunused-but-set-variable warnings
    - r8152: Set macpassthru in reset_resume callback
    - net: phy: allow for reset line to be tied to a sleepy GPIO controller
    - net: phy: fix write to mii-ctrl1000 register
    - vfs: Convert filldir[64]() from __put_user() to unsafe_put_user()
    - elf: don't use MAP_FIXED_NOREPLACE for elf executable mappings
      (regression in 4.17)
    - vfs: Make filldir[64]() verify the directory entry filename is valid
    - uaccess: implement a proper unsafe_copy_to_user() and switch filldir over
      to it
    - vfs: filldir[64]: remove WARN_ON_ONCE() for bad directory entries
    - net_sched: fix backward compatibility for TCA_KIND (regression in 5.3.4)
    - net_sched: fix backward compatibility for TCA_ACT_KIND (regression in
      5.3.4)
    - libata/ahci: Fix PCS quirk application (regression in 5.3.4)
    - md/raid0: fix warning message for parameter default_layout
    - Revert "drm/radeon: Fix EEH during kexec" (regression in 5.3.5)
    - ocfs2: fix panic due to ocfs2_wq is null
    - nvme-pci: Set the prp2 correctly when using more than 4k page
    - ipv4: fix race condition between route lookup and invalidation
    - ipv4: Return -ENETUNREACH if we can't create route but saddr is valid
    - net: avoid potential infinite loop in tc_ctl_action()
    - [hppa,m68k] net: i82596: fix dma_alloc_attr for sni_82596
    - net: ipv6: fix listify ip6_rcv_finish in case of forwarding
    - [armhf,arm64] net: stmmac: disable/enable ptp_ref_clk in suspend/resume
      flow
    - rxrpc: Fix possible NULL pointer access in ICMP handling
    - sched: etf: Fix ordering of packets with same txtime
    - sctp: change sctp_prot .no_autobind with true
    - net: aquantia: temperature retrieval fix
    - net: aquantia: when cleaning hw cache it should be toggled
    - net: aquantia: do not pass lro session with invalid tcp checksum
    - net: aquantia: correctly handle macvlan and multicast coexistence
    - net: phy: micrel: Discern KSZ8051 and KSZ8795 PHYs
    - net: phy: micrel: Update KSZ87xx PHY name
    - net: avoid errors when trying to pop MLPS header on non-MPLS packets
    - net/sched: fix corrupted L2 header with MPLS 'push' and 'pop' actions
    - netdevsim: Fix error handling in nsim_fib_init and nsim_fib_exit
    - net: ethernet: broadcom: have drivers select DIMLIB as needed
    - net: phy: Fix "link partner" information disappear issue
    - rxrpc: use rcu protection while reading sk->sk_user_data
    - io_uring: fix bad inflight accounting for SETUP_IOPOLL|SETUP_SQTHREAD
    - io_uring: Fix corrupted user_data
    - USB: legousbtower: fix memleak on disconnect
    - ALSA: hda/realtek - Add support for ALC711
    - [x86] ALSA: hda/realtek - Enable headset mic on Asus MJ401TA
    - ALSA: usb-audio: Disable quirks for BOSS Katana amplifiers
    - ALSA: hda - Force runtime PM on Nvidia HDMI codecs
    - USB: serial: ti_usb_3410_5052: fix port-close races
    - USB: ldusb: fix memleak on disconnect
    - USB: usblp: fix use-after-free on disconnect
    - USB: ldusb: fix read info leaks
    - binder: Don't modify VMA bounds in ->mmap handler
    - [mips*] tlbex: Fix build_restore_pagemask KScratch restore
    - staging: wlan-ng: fix exit return when sme->key_idx >= NUM_WEPKEYS
    - [s390x] scsi: zfcp: fix reaction on bit error threshold notification
    - scsi: sd: Ignore a failure to sync cache due to lack of authorization
    - scsi: core: save/restore command resid for error handling
    - scsi: core: try to get module before removing device
    - scsi: ch: Make it possible to open a ch device multiple times again
    - Revert "Input: elantech - enable SMBus on new (2018+) systems"
      (regression in 5.3)
    - Input: synaptics-rmi4 - avoid processing unknown IRQs
    - ACPI: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit()
    - ACPI: NFIT: Fix unlock on error in scrub_show()
    - iwlwifi: pcie: change qu with jf devices to use qu configuration
    - cfg80211: wext: avoid copying malformed SSIDs (CVE-2019-17133)
    - mac80211: Reject malformed SSID elements
    - drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50
    - drm/ttm: Restore ttm prefaulting
    - [armhf,arm64] drm/panfrost: Handle resetting on timeout better
    - drm/amdgpu: Bail earlier when amdgpu.cik_/si_support is not set to 1
    - drm/amdgpu/sdma5: fix mask value of POLL_REGMEM packet for pipe sync
    - [x86] drm/i915/userptr: Never allow userptr into the mappable GGTT
    - [x86] drm/i915: Favor last VBT child device with conflicting AUX ch/DDC
      pin
    - drm/amdgpu/vce: fix allocation size in enc ring test
    - drm/amdgpu/vcn: fix allocation size in enc ring test
    - drm/amdgpu/uvd6: fix allocation size in enc ring test (v2)
    - drm/amdgpu/uvd7: fix allocation size in enc ring test (v2)
    - drm/amdgpu: user pages array memory leak fix
    - drivers/base/memory.c: don't access uninitialized memmaps in
      soft_offline_page_store()
    - fs/proc/page.c: don't access uninitialized memmaps in fs/proc/page.c
    - io_uring: Fix broken links with offloading
    - io_uring: Fix race for sqes with userspace
    - io_uring: used cached copies of sq->dropped and cq->overflow
    - [armhf] mmc: sdhci-omap: Fix Tuning procedure for temperatures < -20C
    - mm/memory-failure.c: don't access uninitialized memmaps in
      memory_failure()
    - mm/slub: fix a deadlock in show_slab_objects()
    - mm/page_owner: don't access uninitialized memmaps when reading
      /proc/pagetypeinfo
    - mm/memunmap: don't access uninitialized memmap in memunmap_pages()
    - mm: memcg/slab: fix panic in __free_slab() caused by premature memcg
      pointer release
    - mm, compaction: fix wrong pfn handling in __reset_isolation_pfn()
    - mm: memcg: get number of pages on the LRU list in memcgroup base on
      lru_zone_size
    - mm: memblock: do not enforce current limit for memblock_phys* family
    - hugetlbfs: don't access uninitialized memmaps in
      pfn_range_valid_gigantic()
    - mm/memory-failure: poison read receives SIGKILL instead of SIGBUS if
      mmaped more than once
    - zram: fix race between backing_dev_show and backing_dev_store
    - [s390x] zcrypt: fix memleak at release
    - [s390x] kaslr: add support for R_390_GLOB_DAT relocation type
    - lib/vdso: Make clock_getres() POSIX compliant again
    - [hppa] Fix vmap memory leak in ioremap()/iounmap()
    - [arm64] KVM: Trap VM ops when ARM64_WORKAROUND_CAVIUM_TX2_219_TVM is set
    - [arm64] Avoid Cavium TX2 erratum 219 when switching TTBR
    - [arm64] Enable workaround for Cavium TX2 erratum 219 when running SMT
    - [arm64] Allow CAVIUM_TX2_ERRATUM_219 to be selected
    - CIFS: avoid using MID 0xFFFF
    - cifs: Fix missed free operations
    - CIFS: Fix use after free of file info structures
    - perf/aux: Fix AUX output stopping
    - tracing: Fix race in perf_trace_buf initialization
    - fs/dax: Fix pmd vs pte conflict detection
    - dm cache: fix bugs when a GFP_NOWAIT allocation fails
    - [riscv64] irqchip/sifive-plic: Switch to fasteoi flow
    - [amd64] boot: Make level2_kernel_pgt pages invalid outside kernel area
    - [x86] apic/x2apic: Fix a NULL pointer deref when handling a dying cpu
    - [x86] hyperv: Make vapic support x2apic mode
    - [x86] pinctrl: cherryview: restore Strago DMI workaround for all versions
    - [arm64] pinctrl: armada-37xx: fix control of pins 32 and up
    - [arm64] pinctrl: armada-37xx: swap polarity on LED group
    - btrfs: block-group: Fix a memory leak due to missing
      btrfs_put_block_group()
    - Btrfs: add missing extents release on file extent cluster relocation
      error
    - btrfs: don't needlessly create extent-refs kernel thread
    - Btrfs: fix qgroup double free after failure to reserve metadata for
      delalloc
    - Btrfs: check for the full sync flag while holding the inode lock during
      fsync
    - btrfs: tracepoints: Fix wrong parameter order for qgroup events
    - btrfs: tracepoints: Fix bad entry members of qgroup events
    - [ppc64*] KVM: Book3S HV: XIVE: Ensure VP isn't already in use
    - memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
    - cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown
    - ceph: just skip unrecognized info in ceph_reply_info_extra
    - xen/netback: fix error path of xenvif_connect_data()
    - PCI: PM: Fix pci_power_up()
    - opp: of: drop incorrect lockdep_assert_held()
    - of: reserved_mem: add missing of_node_put() for proper ref-counting
    - blk-rq-qos: fix first node deletion of rq_qos_del()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9
    - io_uring: fix up O_NONBLOCK handling for sockets
    - dm snapshot: introduce account_start_copy() and account_end_copy()
    - dm snapshot: rework COW throttling to fix deadlock
    - Btrfs: fix inode cache block reserve leak on failure to allocate data
      space
    - btrfs: qgroup: Always free PREALLOC META reserve in
      btrfs_delalloc_release_extents()
    - iio: fix center temperature of bmc150-accel-core
    - libsubcmd: Make _FORTIFY_SOURCE defines dependent on the feature
    - perf tests: Avoid raising SEGV using an obvious NULL dereference
    - perf map: Fix overlapped map handling
    - perf script brstackinsn: Fix recovery from LBR/binary mismatch
    - perf jevents: Fix period for Intel fixed counters
    - perf tools: Propagate get_cpuid() error
    - perf annotate: Propagate perf_env__arch() error
    - perf annotate: Fix the signedness of failure returns
    - perf annotate: Propagate the symbol__annotate() error return
    - perf annotate: Fix arch specific ->init() failure errors
    - perf annotate: Return appropriate error code for allocation failures
    - perf annotate: Don't return -1 for error when doing BPF disassembly
    - staging: rtl8188eu: fix null dereference when kzalloc fails
    - RDMA/hfi1: Prevent memory leak in sdma_init
    - RDMA/iw_cxgb4: fix SRQ access from dump_qp()
    - RDMA/iwcm: Fix a lock inversion issue
    - [x86] HID: hyperv: Use in-place iterator API in the channel callback
    - nfs: Fix nfsi->nrequests count error on nfs_inode_remove_request
    - [arm64] cpufeature: Effectively expose FRINT capability to userspace
    - [arm64] Fix incorrect irqflag restore for priority masking for compat
    - [arm64] ftrace: Ensure synchronisation in PLT setup for Neoverse-N1
      #1542419
    - [riscv64] serial/sifive: select SERIAL_EARLYCON
    - RDMA/core: Fix an error handling path in 'res_get_common_doit()'
    - RDMA/cm: Fix memory leak in cm_add/remove_one
    - RDMA/nldev: Reshuffle the code to avoid need to rebind QP in error path
    - RDMA/mlx5: Do not allow rereg of a ODP MR
    - RDMA/mlx5: Order num_pending_prefetch properly with synchronize_srcu
    - RDMA/mlx5: Add missing synchronize_srcu() for MW cases
    - [arm64] gpio: max77620: Use correct unit for debounce times
    - fs: cifs: mute -Wunused-const-variable message
    - [arm64] vdso32: Fix broken compat vDSO build warnings
    - [arm64] vdso32: Detect binutils support for dmb ishld
    - serial: mctrl_gpio: Check for NULL pointer
    - [armhf] serial: 8250_omap: Fix gpio check for auto RTS/CTS
    - [arm64] vdso32: Don't use KBUILD_CPPFLAGS unconditionally
    - efi/cper: Fix endianness of PCIe class code
    - [x86] efi: Do not clean dummy variable in kexec path
    - [mips*] include: Mark __cmpxchg as __always_inline
    - [riscv64] avoid kernel hangs when trapped in BUG()
    - [riscv64] avoid sending a SIGTRAP to a user thread trapped in WARN()
    - [riscv64] Correct the handling of unexpected ebreak in do_trap_break()
    - [x86] xen: Return from panic notifier
    - ocfs2: clear zero in unaligned direct IO
    - fs: ocfs2: fix possible null-pointer dereferences in
      ocfs2_xa_prepare_entry()
    - fs: ocfs2: fix a possible null-pointer dereference in
      ocfs2_write_end_nolock()
    - fs: ocfs2: fix a possible null-pointer dereference in
      ocfs2_info_scan_inode_alloc()
    - btrfs: silence maybe-uninitialized warning in clone_range
    - [arm64] armv8_deprecated: Checking return value for memory allocation
    - [x86] cpu: Add Comet Lake to the Intel CPU models header
    - sched/fair: Scale bandwidth quota and period without losing quota/period
      ratio precision
    - sched/vtime: Fix guest/system mis-accounting on task switch
    - perf/core: Rework memory accounting in perf_mmap()
    - perf/core: Fix corner case in perf_rotate_context()
    - [x86] perf/amd: Change/fix NMI latency mitigation to use a timestamp
    - drm/amdgpu: fix memory leak
    - [mips*] include: Mark __xchg as __always_inline
    - [mips*] fw: sni: Fix out of bounds init of o32 stack
    - [s390x] cio: fix virtio-ccw DMA without PV
    - [x86] virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr
    - nbd: fix possible sysfs duplicate warning
    - NFSv4: Fix leak of clp->cl_acceptor string
    - SUNRPC: fix race to sk_err after xs_error_report
    - [s390x] uaccess: avoid (false positive) compiler warnings
    - tracing: Initialize iter->seq after zeroing in tracing_read_pipe()
    - perf annotate: Fix multiple memory and file descriptor leaks
    - perf/aux: Fix tracking of auxiliary trace buffer allocation
    - USB: legousbtower: fix a signedness bug in tower_probe()
    - nbd: verify socket is supported during setup
    - [arm64] dts: qcom: Add Lenovo Miix 630
    - [arm64] dts: qcom: Add HP Envy x2
    - [arm64] dts: qcom: Add Asus NovaGo TP370QL
    - rtw88: Fix misuse of GENMASK macro
    - [s390x] pci: fix MSI message data
    - thunderbolt: Correct path indices for PCIe tunnel
    - thunderbolt: Use 32-bit writes when writing ring producer/consumer
    - fuse: flush dirty data/metadata before non-truncate setattr
    - fuse: truncate pending writes on O_TRUNC
    - ALSA: bebob: Fix prototype of helper function to return negative value
    - ALSA: timer: Fix mutex deadlock at releasing card
    - ALSA: hda/realtek - Fix 2 front mics of codec 0x623
    - ALSA: hda/realtek - Add support for ALC623
    - ath10k: fix latency issue for QCA988x
    - UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather
      segments") (regression in 5.2)
    - nl80211: fix validation of mesh path nexthop
    - USB: gadget: Reject endpoints with 0 maxpacket value
    - usb-storage: Revert commit 747668dbc061 ("usb-storage: Set
      virt_boundary_mask to avoid SG overflows") (regression in 5.2)
    - USB: ldusb: fix ring-buffer locking
    - USB: ldusb: fix control-message timeout
    - usb: xhci: fix Immediate Data Transfer endianness
    - USB: serial: whiteheat: fix potential slab corruption
    - USB: serial: whiteheat: fix line-speed endianness
    - xhci: Fix use-after-free regression in xhci clear hub TT implementation
    - scsi: qla2xxx: Fix partial flash write of MBI
    - scsi: target: cxgbit: Fix cxgbit_fw4_ack()
    - [x86] HID: i2c-hid: add Trekstor Primebook C11B to descriptor override
    - HID: Fix assumption that devices have inputs
    - HID: fix error message in hid_open_report()
    - HID: logitech-hidpp: split g920_get_config()
    - HID: logitech-hidpp: rework device validation
    - HID: logitech-hidpp: do all FF cleanup in hidpp_ff_destroy()
    - [s390x] unwind: fix mixing regs and sp
    - [s390x] cmm: fix information leak in cmm_timeout_handler()
    - [s390x] idle: fix cpu idle time calculation
    - IB/hfi1: Avoid excessive retry for TID RDMA READ request
    - [arm64] Ensure VM_WRITE|VM_SHARED ptes are clean by default
    - [arm64] cpufeature: Enable Qualcomm Falkor/Kryo errata 1003
    - virtio_ring: fix stalls for packed rings
    - rtlwifi: rtl_pci: Fix problem of too small skb->len
    - rtlwifi: Fix potential overflow on P2P code
    - [x86] KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is
      active
    - [arm64] dmaengine: qcom: bam_dma: Fix resource leak
    - [arm64] dmaengine: tegra210-adma: fix transfer failure
    - [armhf] dmaengine: imx-sdma: fix size check for sdma script_number
    - [armhf] dmaengine: cppi41: Fix cppi41_dma_prep_slave_sg() when idle
    - drm/amdgpu/gmc10: properly set BANK_SELECT and FRAGMENT_SIZE
    - [x86] drm/i915: Fix PCH reference clock for FDI on HSW/BDW
    - drm/amdgpu/gfx10: update gfx golden settings
    - drm/amdgpu/powerplay/vega10: allow undervolting in p7
    - drm/amdgpu: Fix SDMA hang when performing VKexample test
    - NFS: Fix an RCU lock leak in nfs4_refresh_delegation_stateid()
    - io_uring: ensure we clear io_kiocb->result before each issue
    - [x86] iommu/vt-d: Fix panic after kexec -p for kdump
    - batman-adv: Avoid free/alloc race when handling OGM buffer
    - llc: fix sk_buff leak in llc_sap_state_process()
    - llc: fix sk_buff leak in llc_conn_service()
    - rxrpc: Fix call ref leak
    - rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record
    - rxrpc: Fix trace-after-put looking at the put peer record
    - NFC: pn533: fix use-after-free and memleaks
    - bonding: fix potential NULL deref in bond_update_slave_arr
    - netfilter: conntrack: avoid possible false sharing
    - net: usb: sr9800: fix uninitialized local variable
    - sch_netem: fix rcu splat in netem_enqueue()
    - net: sched: sch_sfb: don't call qdisc_put() while holding tree lock
    - iwlwifi: exclude GEO SAR support for 3168
    - sched/fair: Fix low cpu usage with high throttling by removing expiration
      of cpu-local slices
    - ALSA: usb-audio: DSD auto-detection for Playback Designs
    - ALSA: usb-audio: Update DSD support quirks for Oppo and Rotel
    - ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB Interface
    - RDMA/mlx5: Use irq xarray locking for mkey_table
    - sched/fair: Fix -Wunused-but-set-variable warnings
    - [powerpc*] powernv: Fix CPU idle to be called with IRQs disabled
    - Revert "ALSA: hda: Flush interrupts on disabling" (regression in 5.3.4)

  [ Ben Hutchings ]
  * debian/bin/gencontrol_signed.py: Fix code style error
  * debian/bin/gencontrol.py: Skip linux-perf lintian-overrides if we won't
    build it
  * debian/bin/gencontrol{,_signed}.py: Use vars parameter instead of self.vars
  * debian/bin/gencontrol{,_signed}.py: Use %(name)s to format template vars
  * debian/.gitignore, debian/rules: Generalise patterns for generated files
  * gencontrol: Generalise substitution of debhelper config template
  * Add maint scripts to meta-packages to convert doc directories to symlinks
    (Closes: #942861)
  * debian/lib/python/debian_linux/utils.py: Use 'with' to manage file handles
  * debian/lib/python/debian_linux/utils.py: Store file mode for templates
  * Copy template file permissions to output files
  * debian/templates/headers.postinst.in: Set executable for consistency
  * debian/README.source: Document code signing and how to test it
  * debian/tests/control: Mark python test as superficial
  * [arm64] linux-headers: Disable check for a 32-bit compiler
    (Closes: #943953):
    - arm64: Kconfig: Make CONFIG_COMPAT_VDSO a proper Kconfig option
    - debian/bin/gencontrol.py: Optionally define $(CROSS_COMPILE_COMPAT) make
      variable
    - Enable COMPAT_VDSO and set $(CROSS_COMPILE_COMPAT) instead of setting
      CROSS_COMPILE_COMPAT_VDSO
  * crypto: Enable PKCS8_PRIVATE_KEY_PARSER as module (Closes: #924705)
  * Bump ABI to 2
  * [arm64] atmel_mxt_ts: Disable TOUCHSCREEN_ATMEL_MXT_T37 to avoid V4L
    dependency
  * random: try to actively add entropy rather than passively wait for it

  [ Bastian Blank ]
  * [amd64/cloud-amd64] Re-enable RTC drivers. (closes: #931341)

  [ Thomas W ]
  * [x86] Enable missing modules and setting:
    CONFIG_HUAWEI_WMI
    CONFIG_I2C_MULTI_INSTANTIATE
    CONFIG_INTEL_TURBO_MAX_3

  [ Alper Nebi Yasak ]
  * [arm64] udeb: Add i2c-rk3x to i2c-modules
  * [arm64,armhf] udeb: Add rockchip-io-domain to kernel-image
  * udeb: Add atmel_mxt_ts to input-modules

  [ Noah Meyerhans ]
  * drivers/net/ethernet/amazon: Backport driver fixes from v5.4-rc5

  [ Niv Sardi ]
  * KEYS: Make use of platform keyring for module signature verify
    (closes: #935945)

 -- Ben Hutchings <ben@decadent.org.uk>  Sat, 09 Nov 2019 15:42:49 +0000

linux (5.3.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.3
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4
    - mISDN: enforce CAP_NET_RAW for raw sockets (CVE-2019-17055)
    - appletalk: enforce CAP_NET_RAW for raw sockets (CVE-2019-17054)
    - ax25: enforce CAP_NET_RAW for raw sockets (CVE-2019-17052)
    - ieee802154: enforce CAP_NET_RAW for raw sockets (CVE-2019-17053)
    - nfc: enforce CAP_NET_RAW for raw sockets (CVE-2019-17056)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.5
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.6
    - nl80211: validate beacon head (CVE-2019-16746)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.7

  [ Aurelien Jarno ]
  * [riscv64] Enable SOC_SIFIVE. Do not select CLK_SIFIVE,
    CLK_SIFIVE_FU540_PRCI, SIFIVE_PLIC, SERIAL_SIFIVE and
    SERIAL_SIFIVE_CONSOLE as they are selected by SOC_SIFIVE.
  * [riscv64] Install DTBS using dtbs_install target.
  * [riscv64] Enable SPI_SIFIVE.
  * [riscv64] Enable SERIAL_EARLYCON_RISCV_SBI.
  * [riscv64] Enable MMC, MMC_SPI.
  * [riscv64] udeb: Add mmc-core-modules and mmc-modules.
  * [riscv64] Fix memblock reservation for device tree blob.
  * [riscv64] Clear load reservations while restoring hart contexts.

  [ Ben Hutchings ]
  * [mips*] Revert "Only define MAX_PHYSMEM_BITS on Loongson-3"
  * KEYS: Re-enable SECONDARY_TRUSTED_KEYRING, dropped in 5.2.6-1 by
    mis-merge (Closes: #935945)

  [ John Paul Adrian Glaubitz ]
  * [m68k] Enable CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
  * [hppa] Enable CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
  * [sh4] Enable CONFIG_CRYPTO_MANAGER_DISABLE_TESTS

  [ Salvatore Bonaccorso ]
  * RDMA/cxgb4: Do not dma memory off of the stack (CVE-2019-17075)
  * ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()
    (CVE-2019-15098)

  [ Romain Perier ]
  * [armel/rpi] Enable CONFIG_BRCMFMAC_SDIO (Closes: #940530)

  [ Héctor Orón Martínez ]
  * [x86] Enable ASoC: SOF sound driver (Closes: #940726)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 20 Oct 2019 00:56:32 +0200

linux (5.3.2-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.3
    - [armhf] select the dma-noncoherent symbols for all swiotlb builds
      (fixes FTBFS)
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.2

  [ Ben Hutchings ]
  * [hppa,sparc64] udeb: Delete osst from scsi-modules (fixes FTBFS)
  * Compile with gcc-9 on all architectures
  * Set KCFLAGS make variable instead of CFLAGS_{KERNEL,MODULE}
  * linux-image-dbg: Delete ./ from source file names in debug info
  * debian/rules: Make maintainerclean delete (almost) everything clean does
  * debian/rules: Make maintainerclean delete everything gencontrol.py creates
  * debian/.gitignore: Synchronise some patterns with clean target
  * Add the metapackages previously built by src:linux-latest:
    - Add template and NEWS files from linux-latest
    - Rename added templates to be consistent with existing templates
    - Fix some inconsistencies in metapackage templates
    - Define pkg.linux.nometa build profile to exclude the metapackages
    - Build the metapackages by default (Closes: #583849, #941042)
    - Make linux-perf an arch-dependent package
    - Require metapackage dependencies to be the same version, and link doc
      dirs

  [ Uwe Kleine-König ]
  * [arm64] enable I2C_QCOM_GENI for Lenovo C630

 -- Ben Hutchings <ben@decadent.org.uk>  Wed, 02 Oct 2019 05:31:27 +0100

linux (5.3~rc5-1~exp2) experimental; urgency=medium

  * tools/perf: pmu-events: Fix reproducibility
  * Fix FTBFS:
    - Update "kbuild: Make the toolchain variables easily overwritable" for 5.3
    - udeb: Make nic-wireless-modules depend on crypto-modules
  * debian/control: Remove build profile qual for rsync, needed for
    headers_install
  * debian/changelog: Move older entries to changelog.old

 -- Ben Hutchings <ben@decadent.org.uk>  Sun, 25 Aug 2019 16:28:41 +0100

linux (5.3~rc5-1~exp1) experimental; urgency=medium

  * New upstream release candidate

  [ Ben Hutchings ]
  * aufs: Update support patchset to aufs5.x-rcN 20190805
  * [rt] Disable until it is updated for 5.3 or later
  * [powerpcspe] Remove all support for powerpcspe, which is dead upstream
  * linux-headers: Change per-flavour Makefile to match upstream out-of-tree
    builds
  * debian/bin/genorig.py: Import debian.deb822 instead of deprecated deb822
  * [arm64] Use armhf cross-compiler for building compat vDSO
  * Documentation: Fix broken link to CIPSO draft

  [ Lubomir Rintel ]
  * udeb: input-modules: Add OLPC AP-SP keyboard
  * [armhf] Add camera, EC and battery drivers for OLPC XO-1.75 laptop.

 -- Ben Hutchings <ben@decadent.org.uk>  Sat, 24 Aug 2019 19:07:56 +0100

linux (5.2.17-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.10
    - KEYS: trusted: allow module init if TPM is inactive or deactivated
    - seq_file: fix problem when seeking mid-record
    - mm/hmm: fix bad subpage pointer in try_to_unmap_one
    - mm: mempolicy: make the behavior consistent when MPOL_MF_MOVE* and
      MPOL_MF_STRICT were specified
    - mm: mempolicy: handle vma with unmovable pages mapped correctly in mbind
    - mm/z3fold.c: fix z3fold_destroy_pool() ordering
    - mm/z3fold.c: fix z3fold_destroy_pool() race condition
    - mm/memcontrol.c: fix use after free in mem_cgroup_iter()
    - mm/usercopy: use memory range to be accessed for wraparound check
    - mm, vmscan: do not special-case slab reclaim when watermarks are boosted
    - [armhf,arm64] cpufreq: schedutil: Don't skip freq update when limits
      change
    - drm/amdgpu: fix gfx9 soft recovery
    - drm/nouveau: Only recalculate PBN/VCPI on mode/connector changes
    - [arm64] ftrace: Ensure module ftrace trampoline is coherent with I-side
    - [x86] ALSA: hda/realtek - Add quirk for HP Envy x360
    - ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
      (CVE-2019-15118)
    - ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
      (CVE-2019-15117)
    - [x86] ALSA: hda - Apply workaround for another AMD chip 1022:1487
    - ALSA: hda - Fix a memory leak bug
    - ALSA: hda - Add a generic reboot_notify
    - ALSA: hda - Let all conexant codec enter D3 when rebooting
    - HID: holtek: test for sanity of intfdata
    - HID: hiddev: avoid opening a disconnected device
    - HID: hiddev: do cleanup in failure of opening a device
    - Input: kbtab - sanity check for endpoint type
    - Input: iforce - add sanity checks
    - net: usb: pegasus: fix improper read if get_registers() fail
    - bpf: fix access to skb_shared_info->gso_segs
    - netfilter: ebtables: also count base chain policies
    - [riscv64] Correct the initialized flow of FP register
    - [riscv64] Make __fstate_clean() work correctly.
    - [armhf] Revert "i2c: imx: improve the error handling in
      i2c_imx_dma_request()"
    - blk-mq: move cancel of requeue_work to the front of blk_exit_queue
    - io_uring: fix manual setup of iov_iter for fixed buffers
    - [arm64] RDMA/hns: Fix sg offset non-zero issue
    - IB/mlx5: Replace kfree with kvfree
    - dma-mapping: check pfn validity in dma_common_{mmap,get_sgtable}
    - [x87] platform: intel_pmc_core: Add ICL-NNPI support to PMC Core
    - mm/hmm: always return EBUSY for invalid ranges in
      hmm_range_{fault,snapshot}
    - [armhf,arm64] irqchip/gic-v3-its: Free unused vpt_page when alloc vpe
      table fail
    - [armhf] irqchip/irq-imx-gpcv2: Forward irq type to parent
    - f2fs: fix to read source block before invalidating it
    - tools perf beauty: Fix usbdevfs_ioctl table generator to handle _IOC()
    - perf header: Fix divide by zero error if f_header.attr_size==0
    - perf header: Fix use of unitialized value warning
    - RDMA/qedr: Fix the hca_type and hca_rev returned in device attributes
    - ALSA: pcm: fix lost wakeup event scenarios in snd_pcm_drain
    - libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
    - Btrfs: fix deadlock between fiemap and transaction commits
    - scsi: hpsa: correct scsi command status issue after reset
    - scsi: qla2xxx: Fix possible fcport null-pointer dereferences
    - drm/amdkfd: Fix byte align on VegaM
    - drm/amd/powerplay: fix null pointer dereference around dpm state relates
    - drm/amdgpu: fix error handling in amdgpu_cs_process_fence_dep
    - drm/amdgpu: fix a potential information leaking bug
    - ata: libahci: do not complain in case of deferred probe
    - [riscv64] Fix perf record without libelf support
    - [arm64] Lower priority mask for GIC_PRIO_IRQON
    - [arm64] unwind: Prohibit probing on return_address()
    - IB/core: Add mitigation for Spectre V1 (CVE-2017-5753)
    - IB/mlx5: Fix MR registration flow to use UMR properly
    - RDMA/restrack: Track driver QP types in resource tracker
    - IB/mad: Fix use-after-free in ib mad completion handling
    - RDMA/mlx5: Release locks during notifier unregister
    - [arm64] drm: msm: Fix add_gpu_components
    - [arm64] RDMA/hns: Fix error return code in hns_roce_v1_rsv_lp_qp()
    - [armhf] drm/exynos: fix missing decrement of retry counter
    - [arm64] kprobes: Recover pstate.D in single-step exception handler
    - [arm64] Make debug exception handlers visible from RCU
    - Revert "kmemleak: allow to coexist with fault injection"
    - ocfs2: remove set but not used variable 'last_hash'
    - page flags: prioritize kasan bits over last-cpuid
    - asm-generic: fix -Wtype-limits compiler warnings
    - tpm: tpm_ibm_vtpm: Fix unallocated banks
    - [arm64] KVM: regmap: Fix unexpected switch fall-through
    - [x86] staging: comedi: dt3000: Fix signed integer overflow 'divider *
      base'
    - [x86] staging: comedi: dt3000: Fix rounding up of timer divisor
    - USB: core: Fix races in character device registration and deregistraion
    - usb: cdc-acm: make sure a refcount is taken early enough
    - USB: CDC: fix sanity checks in CDC union parser
    - USB: serial: option: add D-Link DWM-222 device ID
    - USB: serial: option: Add support for ZTE MF871A
    - USB: serial: option: add the BroadMobi BM818 card
    - USB: serial: option: Add Motorola modem UARTs
    - usb: setup authorized_default attributes using usb_bus_notify
    - netfilter: conntrack: Use consistent ct id hash calculation
    - iwlwifi: Add support for SAR South Korea limitation
    - Input: psmouse - fix build error of multiple definition
    - bnx2x: Fix VF's VLAN reconfiguration in reload.
    - bonding: Add vlan tx offload to hw_enc_features
    - [armhf,arm64] net: dsa: Check existence of .port_mdb_add callback before
      calling it
    - net/mlx4_en: fix a memory leak bug
    - net/packet: fix race in tpacket_snd()
    - net: sched: sch_taprio: fix memleak in error path for sched list parse
    - sctp: fix memleak in sctp_send_reset_streams
    - sctp: fix the transport error_count check
    - team: Add vlan tx offload to hw_enc_features
    - tipc: initialise addr_trail_end when setting node addresses
    - xen/netback: Reset nr_frags before freeing skb
    - net/mlx5e: Only support tx/rx pause setting for port owner
    - bnxt_en: Fix VNIC clearing logic for 57500 chips.
    - bnxt_en: Improve RX doorbell sequence.
    - bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails
    - bnxt_en: Suppress HWRM errors for HWRM_NVM_GET_VARIABLE command
    - bnxt_en: Use correct src_fid to determine direction of the flow
    - bnxt_en: Fix to include flow direction in L2 key
    - net sched: update skbedit action for batched events operations
    - netdevsim: Restore per-network namespace accounting for fib entries
    - net/mlx5e: ethtool, Avoid setting speed to 56GBASE when autoneg off
    - net/mlx5e: Fix false negative indication on tx reporter CQE recovery
    - net/mlx5e: Remove redundant check in CQE recovery flow of tx reporter
    - net/mlx5e: Use flow keys dissector to parse packets for ARFS
    - net/tls: prevent skb_orphan() from leaking TLS plain text with offload
    - net: phy: consider AN_RESTART status when reading link status
    - netlink: Fix nlmsg_parse as a wrapper for strict message parsing
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.11
    - ASoC: simple_card_utils.h: care NULL dai at asoc_simple_debug_dai()
    - ASoC: simple-card: fix an use-after-free in simple_dai_link_of_dpcm()
    - ASoC: simple-card: fix an use-after-free in simple_for_each_link()
    - ASoC: audio-graph-card: fix use-after-free in graph_dai_link_of_dpcm()
    - ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id()
    - ASoC: audio-graph-card: add missing const at graph_get_dai_id()
    - regulator: axp20x: fix DCDCA and DCDCD for AXP806
    - regulator: axp20x: fix DCDC5 and DCDC6 for AXP803
    - [armhf] ASoC: samsung: odroid: fix an use-after-free issue for codec
    - [armhf] ASoC: samsung: odroid: fix a double-free issue for cpu_dai
    - [x86] ASoC: Intel: bytcht_es8316: Add quirk for Irbis NB41 netbook
    - HID: logitech-hidpp: add USB PID for a few more supported mice
    - HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
    - [mips*] kernel: only use i8253 clocksource with periodic clockevent
    - [mips*] fix cacheinfo
    - libbpf: sanitize VAR to conservative 1-byte INT
    - netfilter: ebtables: fix a memory leak bug in compat
    - ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks
    - [amd64] spi: pxa2xx: Balance runtime PM enable/disable on error
    - bpf: sockmap, sock_map_delete needs to use xchg
    - bpf: sockmap, synchronize_rcu before free'ing map
    - bpf: sockmap, only create entry if ulp is not already enabled
    - ASoC: dapm: fix a memory leak bug
    - bonding: Force slave speed check after link state recovery for 802.3ad
    - [armhf,arm64] net: mvpp2: Don't check for 3 consecutive Idle frames for
      10G links
    - libbpf: fix using uninitialized ioctl results
    - can: dev: call netif_carrier_off() in register_candev()
    - can: gw: Fix error path of cgw_module_init
    - libbpf: silence GCC8 warning about string truncation
    - {nl,mac}80211: fix interface combinations on crypto controlled devices
    - [armhf] ASoC: ti: davinci-mcasp: Fix clk PDIR handling for i2s master
      mode
    - [armhf,arm64] ASoC: rockchip: Fix mono capture
    - [armhf] ASoC: ti: davinci-mcasp: Correct slot_width posed constraint
    - net: usb: qmi_wwan: Add the BroadMobi BM818 card
    - qed: RDMA - Fix the hw_ver returned in device attributes
    - isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in
      start_isoc_chain()
    - mac80211_hwsim: Fix possible null-pointer dereferences in
      hwsim_dump_radio_nl()
    - [armhf,arm64] net: stmmac: manage errors returned by of_get_mac_address()
    - netfilter: ipset: Actually allow destination MAC address for hash:ip,mac
      sets too
    - netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and
      hash:ip,mac sets
    - netfilter: ipset: Fix rename concurrency with listing
    - rxrpc: Fix potential deadlock
    - rxrpc: Fix the lack of notification when sendmsg() fails on a DATA packet
    - nvmem: Use the same permissions for eeprom as for nvmem
    - iwlwifi: mvm: avoid races in rate init and rate perform
    - iwlwifi: dbg_ini: move iwl_dbg_tlv_load_bin out of debug override ifdef
    - iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
    - iwlwifi: fix locking in delayed GTK setting
    - iwlwifi: mvm: send LQ command always ASYNC
    - isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the
      stack
    - net: phy: phy_led_triggers: Fix a possible null-pointer dereference in
      phy_led_trigger_change_speed()
    - perf bench numa: Fix cpu0 binding
    - [arm64] spi: pxa2xx: Add support for Intel Tiger Lake
    - can: sja1000: force the string buffer NULL-terminated
    - can: peak_usb: force the string buffer NULL-terminated
    - [x86] ASoC: amd: acp3x: use dma_ops of parent device for acp3x dma driver
    - net/ethernet/qlogic/qed: force the string buffer NULL-terminated
    - NFSv4: Fix a credential refcount leak in nfs41_check_delegation_stateid
    - NFSv4: When recovering state fails with EAGAIN, retry the same recovery
    - NFSv4.1: Fix open stateid recovery
    - NFSv4.1: Only reap expired delegations
    - NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()
    - NFS: Fix regression whereby fscache errors are appearing on 'nofsc'
      mounts
    - HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE quirk on Saitek X52
    - HID: input: fix a4tech horizontal wheel custom usage
    - [armhf,arm64] drm/rockchip: Suspend DP late
    - SMB3: Fix potential memory leak when processing compound chain
    - SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL
    - sched/deadline: Fix double accounting of rq/running bw in push & pull
    - sched/psi: Reduce psimon FIFO priority
    - sched/psi: Do not require setsched permission from the trigger creator
    - [s390x] protvirt: avoid memory sharing for diag 308 set/store
    - [s390x] mm: fix dump_pagetables top level page table walking
    - [s390x] put _stext and _etext into .text section
    - net: cxgb3_main: Fix a resource leak in a error path in 'init_one()'
    - [armhf,arm64] net: stmmac: Fix issues when number of Queues >= 4
    - [armhf,arm64] net: stmmac: tc: Do not return a fragment entry
    - drm/amdgpu: pin the csb buffer on hw init for gfx v8
    - [arm64] net: hisilicon: make hip04_tx_reclaim non-reentrant
    - [arm64] net: hisilicon: fix hip04-xmit never return TX_BUSY
    - [arm64] net: hisilicon: Fix dma_map_single failed on arm64
    - NFSv4: Ensure state recovery handles ETIMEDOUT correctly
    - libata: have ata_scsi_rw_xlat() fail invalid passthrough requests
    - libata: add SG safety checks in SFF pio transfers
    - [x86] lib/cpu: Address missing prototypes warning
    - [x86] drm/vmwgfx: fix memory leak when too many retries have occurred
    - block: aoe: Fix kernel crash due to atomic sleep when exiting
    - block, bfq: handle NULL return value by bfq_init_rq()
    - perf ftrace: Fix failure to set cpumask when only one cpu is present
    - perf cpumap: Fix writing to illegal memory in handling cpumap mask
    - perf pmu-events: Fix missing "cpu_clk_unhalted.core" event
    - [riscv64] dt-bindings: fix the schema compatible string for the HiFive
      Unleashed board
    - [arm64] KVM: Don't write junk to sysregs on reset
    - [armhf] KVM: Don't write junk to CP15 registers on reset
    - iwlwifi: mvm: disable TX-AMSDU on older NICs (Closes: #939853)
    - HID: wacom: correct misreported EKR ring values
    - HID: wacom: Correct distance scale for 2nd-gen Intuos devices
    - [x86] Revert "KVM: x86/mmu: Zap only the relevant pages when removing a
      memslot" (regression in 5.1)
    - Revert "dm bufio: fix deadlock with loop device" (regression in 5.2.3)
    - [armhf] clk: socfpga: stratix10: fix rate caclulationg for cnt_clks
    - ceph: clear page dirty before invalidate page
    - ceph: don't try fill file_lock on unsuccessful GETFILELOCK reply
    - libceph: fix PG split vs OSD (re)connect race
    - drm/amdgpu/gfx9: update pg_flags after determining if gfx off is possible
    - drm/nouveau: Don't retry infinitely when receiving no data on i2c over
      AUX
    - scsi: ufs: Fix NULL pointer dereference in ufshcd_config_vreg_hpm()
    - gpiolib: never report open-drain/source lines as 'input' to user-space
    - [x86] Drivers: hv: vmbus: Fix virt_to_hvpfn() for X86_PAE
    - userfaultfd_release: always remove uffd flags and clear
      vm_userfaultfd_ctx
    - [i386] retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386
    - [x86] apic: Handle missing global clockevent gracefully
    - [x86] CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h
    - [x86] boot: Save fields explicitly, zero out everything else
    - [x86] boot: Fix boot regression caused by bootparam sanitizing
    - IB/hfi1: Unsafe PSN checking for TID RDMA READ Resp packet
    - IB/hfi1: Add additional checks when handling TID RDMA READ RESP packet
    - IB/hfi1: Add additional checks when handling TID RDMA WRITE DATA packet
    - IB/hfi1: Drop stale TID RDMA packets that cause TIDErr
    - psi: get poll_work to run when calling poll syscall next time
    - dm kcopyd: always complete failed jobs
    - dm btree: fix order of block initialization in btree_split_beneath
    - dm integrity: fix a crash due to BUG_ON in __journal_read_write()
    - dm raid: add missing cleanup in raid_ctr()
    - dm space map metadata: fix missing store of apply_bops() return value
    - dm table: fix invalid memory accesses with too high sector number
    - dm zoned: improve error handling in reclaim
    - dm zoned: improve error handling in i/o map code
    - dm zoned: properly handle backing device failure
    - genirq: Properly pair kobject_del() with kobject_add()
    - mm/z3fold.c: fix race between migration and destruction
    - mm, page_alloc: move_freepages should not examine struct page of reserved
      memory
    - mm: memcontrol: flush percpu vmstats before releasing memcg
    - mm: memcontrol: flush percpu vmevents before releasing memcg
    - mm, page_owner: handle THP splits correctly
    - mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely
    - mm/zsmalloc.c: fix race condition in zs_destroy_pool
    - IB/hfi1: Drop stale TID RDMA packets
    - dm zoned: fix potential NULL dereference in dmz_do_reclaim()
    - io_uring: fix potential hang with polled IO
    - io_uring: don't enter poll loop if we have CQEs pending
    - io_uring: add need_resched() check in inner poll loop
    - [powerpc*] Allow flush_(inval_)dcache_range to work across ranges >4GB
    - rxrpc: Fix local endpoint refcounting
    - rxrpc: Fix read-after-free in rxrpc_queue_local()
    - rxrpc: Fix local endpoint replacement
    - rxrpc: Fix local refcounting
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.12
    - nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns
    - afs: Fix the CB.ProbeUuid service handler to reply correctly
    - afs: Fix loop index mixup in afs_deliver_vl_get_entry_by_name_u()
    - fs: afs: Fix a possible null-pointer dereference in afs_put_read()
    - afs: Fix off-by-one in afs_rename() expected data version calculation
    - afs: Only update d_fsdata if different in afs_d_revalidate()
    - afs: Fix missing dentry data version updating
    - nvmet: Fix use-after-free bug when a port is removed
    - nvmet-loop: Flush nvme_delete_wq when removing the port
    - nvmet-file: fix nvmet_file_flush() always returning an error
    - nvme-core: Fix extra device_put() call on error path
    - nvme: fix a possible deadlock when passthru commands sent to a multipath
      device
    - nvme-rdma: fix possible use-after-free in connect error flow
    - nvme: fix controller removal race with scan work
    - nvme-pci: Fix async probe remove race
    - btrfs: trim: Check the range passed into to prevent overflow
    - IB/mlx5: Fix implicit MR release flow
    - [armhf] omap-dma/omap_vout_vrfb: fix off-by-one fi value
    - iommu/dma: Handle SG length overflow better
    - dma-direct: don't truncate dma_required_mask to bus addressing
      capabilities
    - usb: gadget: composite: Clear "suspended" on reset/disconnect
    - usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt
    - xen/blkback: fix memory leaks
    - [arm64] cpufeature: Don't treat granule sizes as strict
    - [riscv64] fix flush_tlb_range() end address for flush_tlb_page()
    - drm/scheduler: use job count instead of peek
    - drm/ast: Fixed reboot test may cause system hanged
    - [x86] tools: hv: fix KVP and VSS daemons exit code
    - locking/rwsem: Add missing ACQUIRE to read_slowpath exit when queue is
      empty
    - lcoking/rwsem: Add missing ACQUIRE to read_slowpath sleep loop
    - [arm*] watchdog: bcm2835_wdt: Fix module autoload
    - mt76: usb: fix rx A-MSDU support
    - ipv6/addrconf: allow adding multicast addr if IFA_F_MCAUTOJOIN is set
    - ipv6: Fix return value of ipv6_mc_may_pull() for malformed packets
      (regression in 5.1)
    - [armhf] net: cpsw: fix NULL pointer exception in the probe error path
    - net: fix __ip_mc_inc_group usage
    - net/smc: make sure EPOLLOUT is raised
    - tcp: make sure EPOLLOUT wont be missed
    - ipv4: mpls: fix mpls_xmit for iptunnel
    - openvswitch: Fix conntrack cache with timeout
    - ipv4/icmp: fix rt dst dev null pointer dereference
    - xfrm/xfrm_policy: fix dst dev null pointer dereference in collect_md mode
    - mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
    - ALSA: usb-audio: Check mixer unit bitmap yet more strictly
    - ALSA: hda/ca0132 - Add new SBZ quirk
    - ALSA: line6: Fix memory leak at line6_init_pcm() error path
    - ALSA: hda - Fixes inverted Conexant GPIO mic mute led
    - ALSA: seq: Fix potential concurrent access to the deleted pool
    - ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate()
    - ALSA: usb-audio: Add implicit fb quirk for Behringer UFX1604
    - [x86] kvm: skip populating logical dest map if apic is not sw enabled
    - [x86] KVM: hyper-v: don't crash on KVM_GET_SUPPORTED_HV_CPUID when
      kvm_intel.nested is disabled
    - [x86] KVM: Don't update RIP or do single-step on faulting emulation
    - [x86] uprobes: Fix detection of 32-bit user mode
    - [x86] mm/cpa: Prevent large page split when ftrace flips RW on kernel text
    - [x86] apic: Do not initialize LDR and DFR for bigsmp
    - [x86] apic: Include the LDR when clearing out APIC registers
    - HID: logitech-hidpp: remove support for the G700 over USB
    - ftrace: Fix NULL pointer dereference in t_probe_next()
    - ftrace: Check for successful allocation of hash
    - ftrace: Check for empty hash and comment the race with registering probes
    - usbtmc: more sanity checking for packet size
    - usb-storage: Add new JMS567 revision to unusual_devs
    - USB: cdc-wdm: fix race between write and disconnect due to flag abuse
    - usb: hcd: use managed device resources
    - [armhf,arm64] usb: chipidea: udc: don't do hardware access if gadget has
      stopped
    - usb: host: ohci: fix a race condition between shutdown and irq
    - USB: storage: ums-realtek: Whitelist auto-delink support
    - [x86] tools/power turbostat: Fix caller parameter of get_tdp_amd()
    - [powerpc*] KVM: Book3S: Fix incorrect guest-to-user-translation error
      handling
    - [armhf,arm64] KVM: vgic: Fix potential deadlock when ap_list is long
    - [armhf,arm64] KVM: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
    - [x86] mei: me: add Tiger Lake point LP device ID
    - [armhf,arm64] Revert "mmc: sdhci-tegra: drop ->get_ro() implementation"
      (regression in 5.1)
    - mmc: core: Fix init of SD cards reporting an invalid VDD range
    - [x86] intel_th: pci: Add support for another Lewisburg PCH
    - [x86] intel_th: pci: Add Tiger Lake support
    - [x86] typec: tcpm: fix a typo in the comparison of pdo_max_voltage
    - NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
    - NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0
    - Revert "NFSv4/flexfiles: Abort I/O early if the layout segment was
      invalidated" (regression in 5.1)
    - lib: logic_pio: Fix RCU usage
    - lib: logic_pio: Avoid possible overlap for unregistering regions
    - lib: logic_pio: Add logic_pio_unregister_range()
    - drm/amdgpu: Add APTX quirk for Dell Latitude 5495
    - drm/amdgpu: fix GFXOFF on Picasso and Raven2
    - [x86] drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest
    - [x86] drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe()
    - i2c: piix4: Fix port selection for AMD Family 16h Model 30h
    - [arm64] bus: hisi_lpc: Unregister logical PIO range to avoid potential
      use-after-free
    - [arm64] bus: hisi_lpc: Add .remove method to avoid driver unbind crash
    - [x86] VMCI: Release resource if the work is already queued
    - [x86] crypto: ccp - Ignore unconfigured CCP device on suspend/resume
    - SUNRPC: Don't handle errors if the bind/connect succeeded
    - mt76: mt76x0u: do not reset radio on resume
    - mm, memcg: partially revert "mm/memcontrol.c: keep local VM counters in
      sync with the hierarchical ones" (regression in 5.2.7)
    - mm: memcontrol: fix percpu vmstats and vmevents flush
    - mac80211: fix possible sta leak
    - cfg80211: Fix Extended Key ID key install checks
    - mac80211: Don't memset RXCB prior to PAE intercept
    - mac80211: Correctly set noencrypt for PAE frames
    - iwlwifi: add new cards for 22000 and fix struct name
    - iwlwifi: add new cards for 22000 and change wrong structs
    - iwlwifi: add new cards for 9000 and 20000 series
    - iwlwifi: change 0x02F0 fw from qu to quz
    - iwlwifi: pcie: add support for qu c-step devices
    - iwlwifi: pcie: don't switch FW to qnj when ax201 is detected
    - iwlwifi: pcie: handle switching killer Qu B0 NICs to C0
    - [x86] drm/i915: Do not create a new max_bpc prop for MST connectors
    - [x86] drm/i915/dp: Fix DSC enable code to use cpu_transcoder instead of
      encoder->type
    - [x86] ptrace: fix up botched merge of spectrev1 fix
    - bpf: fix use after free in prog symbol exposure
    - hsr: implement dellink to clean up resources
    - hsr: fix a NULL pointer deref in hsr_dev_xmit()
    - hsr: switch ->dellink() to ->ndo_uninit()
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.13
    - Revert "Input: elantech - enable SMBus on new (2018+) systems"
      (regression in 5.2.9)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.14
    - mld: fix memory leak in mld_del_delrec()
    - net: fix skb use after free in netpoll
    - net: sched: act_sample: fix psample group handling on overwrite
    - net_sched: fix a NULL pointer deref in ipt action
    - [arm64, armhf] net: stmmac: dwmac-rk: Don't fail if phy regulator is
      absent
    - tcp: inherit timestamp on mtu probe
    - tcp: remove empty skb from write queue in error cases
    - Revert "r8152: napi hangup fix after disconnect"
    - r8152: remove calling netif_napi_del
    - net/sched: cbs: Set default link speed to 10 Mbps in cbs_set_port_rate
    - Add genphy_c45_config_aneg() function to phy-c45.c
    - net/sched: pfifo_fast: fix wrong dereference in pfifo_fast_enqueue
    - net/sched: pfifo_fast: fix wrong dereference when qdisc is reset
    - net/rds: Fix info leak in rds6_inc_info_copy() (CVE-2019-16714)
    - batman-adv: Fix netlink dumping of all mcast_flags buckets
    - libbpf: fix erroneous multi-closing of BTF FD
    - libbpf: set BTF FD for prog only when there is supported .BTF.ext data
    - netfilter: nf_flow_table: fix offload for flows that are subject to xfrm
    - net/mlx5e: Fix error flow of CQE recovery on tx reporter
    - [armhf] clk: samsung: Change signature of exynos5_subcmus_init() function
    - [armhf] clk: samsung: exynos5800: Move MAU subsystem clocks to MAU sub-CMU
    - [armhf] clk: samsung: exynos542x: Move MSCL subsystem clocks to its
      sub-CMU
    - netfilter: nf_tables: use-after-free in failing rule with bound set
    - netfilter: nf_flow_table: conntrack picks up expired flows
    - netfilter: nf_flow_table: teardown flow timeout race
    - tools: bpftool: fix error message (prog -> object)
    - ixgbe: fix possible deadlock in ixgbe_service_task()
    - [x86] hv_netvsc: Fix a warning of suspicious RCU usage
    - net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
    - Bluetooth: btqca: Add a short delay before downloading the NVM
    - Bluetooth: hci_qca: Send VS pre shutdown command.
    - [s390x] qeth: serialize cmd reply with concurrent timeout
    - ibmveth: Convert multicast list size for little-endian system
    - gpio: Fix build error of function redefinition
    - netfilter: nft_flow_offload: skip tcp rst and fin packets
    - scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure
    - scsi: target: tcmu: avoid use-after-free after command timeout
    - cxgb4: fix a memory leak bug
    - liquidio: add cleanup in octeon_setup_iq()
    - net: myri10ge: fix memory leaks
    - clk: Fix falling back to legacy parent string matching
    - clk: Fix potential NULL dereference in clk_fetch_parent_index()
    - lan78xx: Fix memory leaks
    - vfs: fix page locking deadlocks when deduping files
    - cx82310_eth: fix a memory leak bug
    - net: kalmia: fix memory leaks
    - net: cavium: fix driver name
    - wimax/i2400m: fix a memory leak bug
    - sched/core: Schedule new worker even if PI-blocked
    - kprobes: Fix potential deadlock in kprobe_optimizer()
    - [x86] HID: intel-ish-hid: ipc: add EHL device id
    - HID: cp2112: prevent sleeping function called from invalid context
    - [x86] boot/compressed/64: Fix boot on machines with broken E820 table
    - scsi: lpfc: Mitigate high memory pre-allocation by SCSI-MQ
    - [x86] Input: hyperv-keyboard: Use in-place iterator API in the channel
      callback
    - Tools: hv: kvp: eliminate 'may be used uninitialized' warning
    - nvme-multipath: fix possible I/O hang when paths are updated
    - nvme: Fix cntlid validation when not using NVMEoF
    - RDMA/cma: fix null-ptr-deref Read in cma_cleanup
    - IB/mlx4: Fix memory leaks
    - [x86] infiniband: hfi1: fix a memory leak bug
    - [x86] infiniband: hfi1: fix memory leaks
    - drm/amdgpu: prevent memory leaks in AMDGPU_CS ioctl
    - ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
    - ceph: fix buffer free while holding i_ceph_lock in
      __ceph_build_xattrs_blob()
    - ceph: fix buffer free while holding i_ceph_lock in fill_inode()
    - [arm64, armhf] KVM: Only skip MMIO insn once
    - afs: Fix leak in afs_lookup_cell_rcu()
    - afs: Fix possible oops in afs_lookup trace event
    - afs: use correct afs_call_type in yfs_fs_store_opaque_acl2
    - RDMA/bnxt_re: Fix stack-out-of-bounds in bnxt_qplib_rcfw_send_message
    - gpio: Fix irqchip initialization order
    - [arm64, armhf] KVM: VGIC: Properly initialise private IRQ affinity
    - [x86] boot/compressed/64: Fix missing initialization in
      find_trampoline_placement()
    - libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
    - [x86] Revert "x86/apic: Include the LDR when clearing out APIC registers"
    - [x86] boot: Preserve boot_params.secure_boot from sanitizing
    - Revert "mmc: core: do not retry CMD6 in __mmc_switch()"
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.15
    - gpio: pca953x: correct type of reg_direction
    - gpio: pca953x: use pca953x_read_regs instead of regmap_bulk_read
    - ALSA: hda - Fix potential endless loop at applying quirks
    - ALSA: hda/realtek - Fix overridden device-specific initialization
    - ALSA: hda/realtek - Add quirk for HP Pavilion 15
    - ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS UX431FL
    - ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre
    - sched/fair: Don't assign runtime for throttled cfs_rq
    - [x86] drm/vmwgfx: Fix double free in vmw_recv_msg()
    - drm/nouveau/sec2/gp102: add missing MODULE_FIRMWAREs
    - [powerpc*] 64e: Drop stale call to smp_processor_id() which hangs SMP
      startup
    - [powerpc*] tm: Fix restoring FP/VMX facility incorrectly on interrupts
      (CVE-2019-15031)
    - batman-adv: fix uninit-value in batadv_netlink_get_ifindex()
    - batman-adv: Only read OGM tvlv_len after buffer len check
    - bcache: only clear BTREE_NODE_dirty bit when it is set
    - bcache: add comments for mutex_lock(&b->write_lock)
    - bcache: fix race in btree_flush_write()
    - IB/rdmavt: Add new completion inline
    - IB/{rdmavt, qib, hfi1}: Convert to new completion API
    - IB/hfi1: Unreserve a flushed OPFN request
    - [x86] drm/i915: Disable SAMPLER_STATE prefetching on all Gen11 steppings.
    - [x86] drm/i915: Make sure cdclk is high enough for DP audio on VLV/CHV
    - mmc: sdhci-sprd: Fix the incorrect soft reset operation when runtime
      resuming
    - usb: chipidea: imx: add imx7ulp support
    - usb: chipidea: imx: fix EPROBE_DEFER support during driver probe
    - [s390x] virtio: fix race on airq_areas[]
    - [x86] drm/i915: Support flags in whitlist WAs
    - [x86] drm/i915: Support whitelist workarounds on all engines
    - [x86] drm/i915: whitelist PS_(DEPTH|INVOCATION)_COUNT
    - [x86] drm/i915: Add whitelist workarounds for ICL
    - [x86] drm/i915/icl: whitelist PS_(DEPTH|INVOCATION)_COUNT
    - Btrfs: fix unwritten extent buffers and hangs on future writeback
      attempts (Closes: #940105)
    - vhost: make sure log_num < in_num (CVE-2019-14835)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.16
    - bridge/mdb: remove wrong use of NLM_F_MULTI
    - cdc_ether: fix rndis support for Mediatek based smartphones
    - ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
    - isdn/capi: check message length in capi_write()
    - ixgbe: Fix secpath usage for IPsec TX offload.
    - ixgbevf: Fix secpath usage for IPsec Tx offload
    - net: Fix null de-reference of device refcount
    - net: gso: Fix skb_segment splat when splitting gso_size mangled skb
      having linear-headed frag_list
    - net: phylink: Fix flow control resolution
    - net: sched: fix reordering issues
    - sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
    - sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()'
    - sctp: use transport pf_retrans in sctp_do_8_2_transport_strike
    - tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
    - tipc: add NULL pointer check before calling kfree_rcu
    - tun: fix use-after-free when register netdev failed
    - net-ipv6: fix excessive RTF_ADDRCONF flag on ::1/128 local route (and
      others)
    - ipv6: addrconf_f6i_alloc - fix non-null pointer check to !IS_ERR()
    - net: fixed_phy: Add forward declaration for struct gpio_desc;
    - sctp: fix the missing put_user when dumping transport thresholds
    - net: sock_map, fix missing ulp check in sock hash case
    - gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and
      blacklist
    - gpio: mockup: add missing single_release()
    - gpio: fix line flag validation in linehandle_create
    - gpio: fix line flag validation in lineevent_create
    - Btrfs: fix assertion failure during fsync and use of stale transaction
    - cgroup: freezer: fix frozen state inheritance
    - Revert "mmc: bcm2835: Terminate timeout work synchronously"
    - Revert "mmc: sdhci: Remove unneeded quirk2 flag of O2 SD host controller"
    - mmc: tmio: Fixup runtime PM management during probe
    - mmc: tmio: Fixup runtime PM management during remove
    - drm/lima: fix lima_gem_wait() return value
    - [x86] drm/i915: Limit MST to <= 8bpc once again
    - [x86] drm/i915: Restore relaxed padding (OCL_OOB_SUPPRES_ENABLE) for skl+
    - ipc: fix semtimedop for generic 32-bit architectures
    - ipc: fix sparc64 ipc() wrapper
    - ixgbe: fix double clean of Tx descriptors with xdp
    - ixgbe: Prevent u8 wrapping of ITR value to something less than 10us
    - Revert "rt2800: enable TX_PIN_CFG_LNA_PE_ bits per band"
    - mt76: mt76x0e: disable 5GHz band for MT7630E
    - genirq: Prevent NULL pointer dereference in resend_irqs()
    - regulator: twl: voltage lists for vdd1/2 on twl4030
    - [s390x] KVM: kvm_s390_vm_start_migration: check dirty_bitmap before using
      it as target for memset()
    - [s390x] KVM: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl
    - [x86] KVM: work around leak of uninitialized stack contents
    - [x86] KVM: mmu: Reintroduce fast invalidate/zap for flushing memslot
    - [x86] KVM: nVMX: handle page fault in vmread
    - [x86] purgatory: Change compiler flags from -mcmodel=kernel to
      -mcmodel=large to fix kexec relocation errors
    - powerpc: Add barrier_nospec to raw_copy_in_user()
    - kernel/module: Fix mem leak in module_add_modinfo_attrs
    - x86/boot: Use efi_setup_data for searching RSDP on kexec-ed kernels
    - x86/ima: check EFI SetupMode too
    - drm/meson: Add support for XBGR8888 & ABGR8888 formats
    - clk: Fix debugfs clk_possible_parents for clks without parent string names
    - clk: Simplify debugfs printing and add a newline
    - mt76: Fix a signedness bug in mt7615_add_interface()
    - mt76: mt7615: Use after free in mt7615_mcu_set_bcn()
    - clk: rockchip: Don't yell about bad mmc phases when getting
    - mtd: rawnand: mtk: Fix wrongly assigned OOB buffer pointer issue
    - PCI: Always allow probing with driver_override
    - ubifs: Correctly use tnc_next() in search_dh_cookie()
    - driver core: Fix use-after-free and double free on glue directory
    - crypto: talitos - check AES key size
    - crypto: talitos - fix CTR alg blocksize
    - crypto: talitos - check data blocksize in ablkcipher.
    - crypto: talitos - fix ECB algs ivsize
    - crypto: talitos - Do not modify req->cryptlen on decryption.
    - crypto: talitos - HMAC SNOOP NO AFEU mode requires SW icv checking.
    - firmware: ti_sci: Always request response from firmware
    - drm: panel-orientation-quirks: Add extra quirk table entry for GPD MicroPC
    - drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
    - mm/z3fold.c: remove z3fold_migration trylock
    - mm/z3fold.c: fix lock/unlock imbalance in z3fold_page_isolate
    - Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
    - modules: fix BUG when load module with rodata=n
    - modules: fix compile error if don't have strict module rwx
    - modules: always page-align module section allocations
    - [x86] kvm: nVMX: Remove unnecessary sync_roots from handle_invept
    - [x86] KVM: SVM: Fix detection of AMD Errata 1096
    - [x86] platform: pmc_atom: Add CB4063 Beckhoff Automation board to
      critclk_systems DMI table
    - [x86] platform: pcengines-apuv2: use KEY_RESTART for front button
    - rsi: fix a double free bug in rsi_91x_deinit() (CVE-2019-15504)
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.17
    - USB: usbcore: Fix slab-out-of-bounds bug during device reset
    - media: tm6000: double free if usb disconnect while streaming
    - phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
    - net: hns3: adjust hns3_uninit_phy()'s location in the hns3_client_uninit()
    - netfilter: nf_flow_table: set default timeout after successful insertion
    - HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report
    - Input: elan_i2c - remove Lenovo Legion Y7000 PnpID
    - SUNRPC: Handle connection breakages correctly in call_status()
    - nfs: disable client side deduplication
    - [powerpc*] mm/radix: Use the right page size for vmemmap mapping
    - net: hns: fix LED configuration for marvell phy
    - net: aquantia: fix limit of vlan filters
    - ip6_gre: fix a dst leak in ip6erspan_tunnel_xmit
    - net/sched: fix race between deactivation and dequeue for NOLOCK qdisc
    - net_sched: let qdisc_put() accept NULL pointer
    - udp: correct reuseport selection with connected sockets
    - xen-netfront: do not assume sk_buff_head list is empty in error handling
    - net: dsa: Fix load order between DSA drivers and taggers
    - KVM: coalesced_mmio: add bounds checking (CVE-2019-14821)
    - firmware: google: check if size is valid when decoding VPD data
    - serial: sprd: correct the wrong sequence of arguments
    - tty/serial: atmel: reschedule TX after RX was started
    - mwifiex: Fix three heap overflow at parsing element in
      cfg80211_ap_settings (CVE-2019-14814, CVE-2019-14815, CVE-2019-14816)
    - nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
    - ieee802154: hwsim: Fix error handle path in hwsim_init_module
    - ieee802154: hwsim: unregister hw while hwsim_subscribe_all_others fails
    - [armhf] dts: am57xx: Disable voltage switching for SD card
    - [armhf] OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss
    - bus: ti-sysc: Fix handling of forced idle
    - bus: ti-sysc: Fix using configured sysc mask value
    - [armhf] dts: Fix flags for gpio7
    - [armhf] dts: Fix incorrect dcan register mapping for am3, am4 and dra7
    - [arm64] dts: meson-g12a: add missing dwc2 phy-names
    - [s390x] bpf: fix lcgr instruction encoding
    - [armhf] OMAP2+: Fix omap4 errata warning on other SoCs
    - [armhf] dts: am335x: Fix UARTs length
    - [armhf] dts: dra74x: Fix iodelay configuration for mmc3
    - bus: ti-sysc: Simplify cleanup upon failures in sysc_probe()
    - [armhf] dts: Fix incomplete dts data for am3 and am4 mmc
    - [s390x] bpf: use 32-bit index for tail calls
    - fpga: altera-ps-spi: Fix getting of optional confd gpio
    - netfilter: ebtables: Fix argument order to ADD_COUNTER
    - netfilter: nft_flow_offload: missing netlink attribute policy
    - netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info
    - NFSv4: Fix return values for nfs4_file_open()
    - NFSv4: Fix return value in nfs_finish_open()
    - NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup
    - NFS: On fatal writeback errors, we need to call
      nfs_inode_remove_request()
    - xdp: unpin xdp umem pages in error path
    - selftests/bpf: fix test_cgroup_storage on s390
    - selftests/bpf: add config fragment BPF_JIT
    - qed: Add cleanup in qed_slowpath_start()
    - drm/omap: Fix port lookup for SDI output
    - drm/virtio: use virtio_max_dma_size
    - [armel,armhf] 8874/1: mm: only adjust sections of valid mm structures
    - batman-adv: Only read OGM2 tvlv_len after buffer len check
    - flow_dissector: Fix potential use-after-free on BPF_PROG_DETACH
    - bpf: allow narrow loads of some sk_reuseport_md fields with offset > 0
    - r8152: Set memory to all 0xFFs on failed reg reads
    - x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines
    - pNFS/flexfiles: Don't time out requests on hard mounts
    - NFS: Fix spurious EIO read errors
    - NFS: Fix writepage(s) error handling to not report errors twice
    - drm/amdgpu: fix dma_fence_wait without reference
    - netfilter: xt_physdev: Fix spurious error message in physdev_mt_check
    - netfilter: nf_conntrack_ftp: Fix debug output
    - NFSv2: Fix eof handling
    - NFSv2: Fix write regression
    - NFS: remove set but not used variable 'mapping'
    - kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the
      first symbol
    - netfilter: conntrack: make sysctls per-namespace again
    - drm/amd/powerplay: correct Vega20 dpm level related settings
    - cifs: set domainName when a domain-key is used in multiuser
    - cifs: Use kzfree() to zero out the password
    - libceph: don't call crypto_free_sync_skcipher() on a NULL tfm
    - usb: host: xhci-tegra: Set DMA mask correctly
    - RISC-V: Fix FIXMAP area corruption on RV32 systems
    - [armel,armhf] 8901/1: add a criteria for pfn_valid of arm
    - ibmvnic: Do not process reset during or after device removal
    - sky2: Disable MSI on yet another ASUS boards (P6Xxxx)
    - i2c: designware: Synchronize IRQs when unregistering slave client
    - perf/x86/intel: Restrict period on Nehalem
    - perf/x86/amd/ibs: Fix sample bias for dispatched micro-ops
    - i2c: iproc: Stop advertising support of SMBUS quick cmd
    - i2c: mediatek: disable zero-length transfers for mt8183
    - amd-xgbe: Fix error path in xgbe_mod_init()
    - netfilter: nf_flow_table: clear skb tstamp before xmit
    - [x86] tools/power x86_energy_perf_policy: Fix argument parsing
    - [x86] tools/power turbostat: fix leak of file descriptor on error return
      path
    - [x86] tools/power turbostat: fix file descriptor leaks
    - [x86] tools/power turbostat: fix buffer overrun
    - [x86] tools/power turbostat: Fix Haswell Core systems
    - [x86] tools/power turbostat: Add Ice Lake NNPI support
    - [x86] tools/power turbostat: Fix CPU%C1 display value
    - net: aquantia: fix removal of vlan 0
    - net: aquantia: reapply vlan filters on up
    - net: aquantia: linkstate irq should be oneshot
    - net: aquantia: fix out of memory condition on rx side
    - net: dsa: microchip: add KSZ8563 compatibility string
    - enetc: Add missing call to 'pci_free_irq_vectors()' in probe and remove
      functions
    - net: seeq: Fix the function used to release some memory in an error
      handling path
    - dmaengine: ti: dma-crossbar: Fix a memory leak bug
    - dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe()
    - [x86] uaccess: Don't leak the AC flags into __get_user() argument
      evaluation
    - [x86] hyper-v: Fix overflow bug in fill_gva_list()
    - [x86] iommu/vt-d: Remove global page flush support
    - dmaengine: sprd: Fix the DMA link-list configuration
    - dmaengine: rcar-dmac: Fix DMACHCLR handling if iommu is mapped
    - keys: Fix missing null pointer check in request_key_auth_describe()
    - [x86] iommu/amd: Flush old domains in kdump kernel
    - [x86] iommu/amd: Fix race in increase_address_space()
    - [arm64] Revert "arm64: Remove unnecessary ISBs from set_{pte,pmd,pud}"
    - ovl: fix regression caused by overlapping layers detection
    - floppy: fix usercopy direction
    - media: technisat-usb2: break out of loop at end of buffer
      (CVE-2019-15505)
    - vfs: Fix refcounting of filenames in fs_parser

  [ Salvatore Bonaccorso ]
  * xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT
    (CVE-2019-15538)

  [ Romain Perier ]
  * [rt] Update to 5.2.14-rt7

  [ Ben Hutchings ]
  * Bump ABI to 3

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 26 Sep 2019 14:19:06 +0200

linux (5.2.9-2) unstable; urgency=medium

  [ Ben Hutchings ]
  * Partially revert "net: socket: implement 64-bit timestamps"
    (fixes build/test regressions for glibc, qemu, suricata)
  * [x86] intel-iommu: Exclude integrated GPUs by default (Closes: #935270):
    - intel-iommu: Add option to exclude integrated GPU only
    - intel-iommu: Add Kconfig option to exclude iGPU by default
    - Enable INTEL_IOMMU_DEFAULT_ON_INTGPU_OFF instead of
      INTEL_IOMMU_DEFAULT_ON

  [ Thomas W ]
  * [x86] Add various laptop modules. (Closes: #932086)
    CONFIG_ACER_WIRELESS
    CONFIG_LG_LAPTOP
    CONFIG_SURFACE3_WMI
    CONFIG_INTEL_WMI_THUNDERBOLT
    CONFIG_PEAQ_WMI
    CONFIG_TOSHIBA_WMI
    CONFIG_SURFACE_3_BUTTON

 -- Ben Hutchings <ben@decadent.org.uk>  Wed, 21 Aug 2019 13:48:11 +0100

linux (5.2.9-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.8
    - scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure
    - libnvdimm/bus: Prepare the nd_ioctl() path to be re-entrant
    - libnvdimm/bus: Fix wait_nvdimm_bus_probe_idle() ABBA deadlock
    - ALSA: usb-audio: Sanity checks for each pipe and EP types
    - ALSA: usb-audio: Fix gpf in snd_usb_pipe_sanity_check
    - HID: wacom: fix bit shift for Cintiq Companion 2
    - HID: Add quirk for HP X1200 PIXART OEM mouse
    - atm: iphase: Fix Spectre v1 vulnerability (CVE-2017-5753)
    - bnx2x: Disable multi-cos feature.
    - drivers/net/ethernet/marvell/mvmdio.c: Fix non OF case (Closes: #908712)
    - ife: error out when nla attributes are empty
    - ip6_gre: reload ipv6h in prepare_ip6gre_xmit_ipv6
    - ip6_tunnel: fix possible use-after-free on xmit
    - ipip: validate header length in ipip_tunnel_xmit
    - [armhf,arm64] mvpp2: fix panic on module removal
    - [armhf,arm64] mvpp2: refactor MTU change code
    - net: bridge: delete local fdb on device init failure
    - net: bridge: mcast: don't delete permanent entries when fast leave is
      enabled
    - net: bridge: move default pvid init/deinit to NETDEV_REGISTER/UNREGISTER
    - net: fix ifindex collision during namespace removal
    - net/mlx5e: always initialize frag->last_in_page
    - net/mlx5: Use reversed order when unregister devices
    - net: phy: fixed_phy: print gpio error only if gpio node is present
    - net: phy: mscc: initialize stats array
    - net: sched: Fix a possible null-pointer dereference in dequeue_func()
    - net sched: update vlan action for batched events operations
    - net: sched: use temporary variable for actions indexes
    - net/smc: do not schedule tx_work in SMC_CLOSED state
    - [armhf,arm64] net: stmmac: Use netif_tx_napi_add() for TX polling
      function
    - tipc: compat: allow tipc commands without arguments
    - tipc: fix unitilized skb list crash
    - tun: mark small packets as owned by the tap sock
    - net/mlx5: Fix modify_cq_in alignment
    - net/mlx5e: Prevent encap flow counter update async to user query
    - r8169: don't use MSI before RTL8168d
    - net: fix bpf_xdp_adjust_head regression for generic-XDP
    - [x86] hv_sock: Fix hang when a connection is closed
    - net: phy: fix race in genphy_update_link
    - net/smc: avoid fallback in case of non-blocking connect
    - rocker: fix memory leaks of fib_work on two error return paths
    - net/mlx5: Add missing RDMA_RX capabilities
    - net/mlx5e: Fix matching of speed to PRM link modes
    - compat_ioctl: pppoe: fix PPPOEIOCSFWD handling
    - [x86] drm/i915/vbt: Fix VBT parsing for the PSR section
    - Revert "mac80211: set NETIF_F_LLTX when using intermediate tx queues"
    - [armhf,arm64] spi: bcm2835: Fix 3-wire mode if DMA is enabled
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.9
    - Revert "PCI: Add missing link delays required by the PCIe spec"
    - [arm64] iio: cros_ec_accel_legacy: Fix incorrect channel setting
    - [x86] iio: imu: mpu6050: add missing available scan masks
    - [x86] crypto: ccp - Fix oops by properly managing allocated structures
    - [x86] crypto: ccp - Add support for valid authsize values less than 16
    - [x86] crypto: ccp - Ignore tag length when decrypting GCM ciphertext
    - driver core: platform: return -ENXIO for missing GpioInt
    - usb: usbfs: fix double-free of usb memory upon submiturb error
    - Revert "USB: rio500: simplify locking"
    - usb: iowarrior: fix deadlock on disconnect
    - sound: fix a memory leak bug
    - [arm64,mips/octeon] mmc: cavium: Set the correct dma max segment size for
      mmc_host
    - [arm64,mips/octeon] mmc: cavium: Add the missing dma unmap when the dma
      has finished.
    - loop: set PF_MEMALLOC_NOIO for the worker thread
    - bdev: Fixup error handling in blkdev_get() (Closes: #934378)
    - Input: usbtouchscreen - initialize PM mutex before using it
    - Input: elantech - enable SMBus on new (2018+) systems
    - [x86] Input: synaptics - enable RMI mode for HP Spectre X360
    - [x86] mm: Check for pfn instead of page in vmalloc_sync_one()
    - [x86] mm: Sync also unmappings in vmalloc_sync_all()
    - mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
    - [s390x] perf annotate: Fix s390 gap between kernel end and module start
    - perf db-export: Fix thread__exec_comm()
    - [s390x] perf record: Fix module size on s390
    - [x86] purgatory: Do not use __builtin_memcpy and __builtin_memset
    - [x86] purgatory: Use CFLAGS_REMOVE rather than reset KBUILD_CFLAGS
    - genirq/affinity: Create affinity mask for single vector
    - gfs2: gfs2_walk_metadata fix
    - usb: yurex: Fix use-after-free in yurex_delete
    - usb: typec: ucsi: ccg: Fix uninitilized symbol error
    - usb: typec: tcpm: free log buf memory when remove debug file
    - usb: typec: tcpm: remove tcpm dir if no children
    - usb: typec: tcpm: Add NULL check before dereferencing config
    - usb: typec: tcpm: Ignore unsupported/unknown alternate mode requests
    - [armhf] can: flexcan: fix stop mode acknowledgment
    - [armhf] can: flexcan: fix an use-after-free in flexcan_setup_stop_mode()
    - can: peak_usb: fix potential double kfree_skb()
    - [powerpc*] fix off by one in max_zone_pfn initialization for ZONE_DMA
    - netfilter: nfnetlink: avoid deadlock due to synchronous request_module
    - netfilter: Fix rpfilter dropping vrf packets by mistake
    - netfilter: nf_tables: fix module autoload for redir
    - netfilter: conntrack: always store window size un-scaled
    - netfilter: nft_hash: fix symhash with modulus one
    - rq-qos: don't reset has_sleepers on spurious wakeups
    - rq-qos: set ourself TASK_UNINTERRUPTIBLE after we schedule
    - rq-qos: use a mb for got_token
    - netfilter: nf_tables: Support auto-loading for inet nat
    - drm/amd/display: No audio endpoint for Dell MST display
    - drm/amd/display: Clock does not lower in Updateplanes
    - drm/amd/display: Wait for backlight programming completion in set
      backlight level
    - drm/amd/display: fix DMCU hang when going into Modern Standby
    - drm/amd/display: use encoder's engine id to find matched free audio
      device
    - drm/amd/display: put back front end initialization sequence
    - drm/amd/display: allocate 4 ddc engines for RV2
    - drm/amd/display: Fix dc_create failure handling and 666 color depths
    - drm/amd/display: Only enable audio if speaker allocation exists
    - drm/amd/display: Increase size of audios array
    - nl80211: fix NL80211_HE_MAX_CAPABILITY_LEN
    - mac80211: fix possible memory leak in ieee80211_assign_beacon
    - mac80211: don't warn about CW params when not using them
    - allocate_flower_entry: should check for null deref
    - hwmon: (nct6775) Fix register address and added missed tolerance for
      nct6106
    - [armhf] dts: imx6ul: fix clock frequency property name of I2C buses
    - [powerpc*] papr_scm: Force a scm-unbind if initial scm-bind fails
    - [arm64] Force SSBS on context switch
    - [arm64] entry: SP Alignment Fault doesn't write to FAR_EL1
    - [x86] iommu/vt-d: Check if domain->pgd was allocated
    - [arm64] drm/msm/dpu: Correct dpu encoder spinlock initialization
    - [ppc64] cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init()
    - [s390x] qdio: add sanity checks to the fast-requeue path
    - ALSA: compress: Fix regression on compressed capture streams
    - ALSA: compress: Prevent bypasses of set_params
    - ALSA: compress: Don't allow paritial drain operations on capture streams
    - ALSA: compress: Be more restrictive about when a drain is allowed
    - perf script: Fix off by one in brstackinsn IPC computation
    - perf tools: Fix proper buffer size for feature processing
    - perf stat: Fix segfault for event group in repeat mode
    - perf session: Fix loading of compressed data split across adjacent
      records
    - perf probe: Avoid calling freeing routine multiple times for same pointer
    - drbd: dynamically allocate shash descriptor
    - ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id()
    - nvme: ignore subnqn for ADATA SX6000LNP
    - nvme: fix memory leak caused by incorrect subsystem free
    - scsi: megaraid_sas: fix panic on loading firmware crashdump
    - scsi: ibmvfc: fix WARN_ON during event pool release
    - scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG
    - test_firmware: fix a memory leak bug
    - tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop
    - [x86] perf/intel: Fix SLOTS PEBS event constraint
    - [x86] perf/intel: Fix invalid Bit 13 for Icelake MSR_OFFCORE_RSP_x
      register
    - [x86] perf: Apply more accurate check on hypervisor platform
    - perf/core: Fix creating kernel counters for PMUs that override event->cpu
    - [s390x] dma: provide proper ARCH_ZONE_DMA_BITS value
    - HID: sony: Fix race condition between rumble and device remove.
    - ALSA: usb-audio: fix a memory leak bug
    - [x86] KVM/nSVM: properly map nested VMCB
    - can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices
    - can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices
    - hwmon: (nct7802) Fix wrong detection of in4 presence
    - hwmon: (lm75) Fixup tmp75b clr_mask
    - [x86] drm/i915: Fix wrong escape clock divisor init for GLK
    - ALSA: firewire: fix a memory leak bug
    - ALSA: hiface: fix multiple memory leak bugs
    - ALSA: hda - Don't override global PCM hw info flag
    - [x86] ALSA: hda - Workaround for crackled sound on AMD controller
      (1022:1457)
    - mac80211: don't WARN on short WMM parameters from AP
    - dax: dax_layout_busy_page() should not unmap cow pages
    - SMB3: Fix deadlock in validate negotiate hits reconnect
    - smb3: send CAP_DFS capability during session setup
    - NFSv4: Fix delegation state recovery
    - NFSv4: Check the return value of update_open_stateid()
    - NFSv4: Fix an Oops in nfs4_do_setattr
    - [x86] KVM: Fix leak vCPU's VMCS value into other pCPU
    - [armhf,arm64] KVM: Sync ICH_VMCR_EL2 back when about to block
    - mwifiex: fix 802.11n/WPA detection
    - iwlwifi: don't unmap as page memory that was mapped as single
    - iwlwifi: mvm: fix an out-of-bound access
    - iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment
    - iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT on version < 41
    - iwlwifi: mvm: fix version check for GEO_TX_POWER_LIMIT support

  [ Salvatore Bonaccorso ]
  * Enable Realtek 802.11ac wireless chips support (Closes: #933963)

  [ Ben Hutchings ]
  * [armel] fb-modules: Remove xgifb, which was removed upstream (fixes FTBFS)
  * tracefs: Fix potential null dereference in default_file_open()
    (Closes: #934304)
  * [arm64] hwrandom: Re-enable HW_RANDOM_OMAP as module (Closes: #931707)
  * ptp: Change CAVIUM_PTP from built-in to modular (Closes: #934848)
  * bug script: Check whether /e/n/interfaces exists (Closes: #934824)
  * bug script: Include network configuration from /e/n/interfaces.d
  * bug script: Check for unreadable /e/n/interfaces files
  * [x86] iommu: Enable INTEL_IOMMU_DEFAULT_ON (Closes: #934309)
  * HID: Enable HID_BIGBEN_FF, HID_MACALLY, HID_GFRM, HID_GT683R,
    HID_VIEWSONIC, HID_MALTRON, HID_U2FZERO as modules (Closes: #934091)
  * usbip: network: Fix unaligned member access (Closes: #925766)
  * libbpf: Fix cross-build
  * [rt] Update to 5.2.9-rt3:
    - i2c: exynos5: Remove IRQF_ONESHOT
    - i2c: hix5hd2: Remove IRQF_ONESHOT
    - sched/deadline: Ensure inactive_timer runs in hardirq context
    - thermal/x86_pkg_temp: make pkg_temp_lock a raw spinlock
    - dma-buf: Use seqlock_t instread disabling preemption
    - KVM: arm/arm64: Let the timer expire in hardirq context on RT
    - x86: preempt: Check preemption level before looking at lazy-preempt
    - arm64: preempt: Fixup lazy preempt
    - arm64: preempt: Check preemption level before looking at lazy-preempt

  [ Alper Nebi Yasak ]
  * [arm64] udeb: Add pl330 to kernel-image

 -- Ben Hutchings <ben@decadent.org.uk>  Sun, 18 Aug 2019 22:54:21 +0100

linux (5.2.7-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.7
    - [armhf] dts: rockchip: Make rk3288-veyron-minnie run at hs200
    - [armhf] dts: rockchip: Make rk3288-veyron-mickey's emmc work again
    - [arm64] clk: meson: mpll: properly handle spread spectrum
    - [armhf] dts: rockchip: Mark that the rk3288 timer might stop in suspend
    - ftrace: Enable trampoline when rec count returns back to one
    - [arm64] dts: qcom: qcs404-evb: fix l3 min voltage
    - [arm64] dts: marvell: mcbin: enlarge PCI memory window
    - [armhf,arm64] dmaengine: tegra-apb: Error out if DMA_PREP_INTERRUPT flag
      is unset
    - [arm64] dts: rockchip: fix isp iommu clocks and power domain
    - kernel/module.c: Only return -EEXIST for modules that have finished
      loading
    - PCI: OF: Initialize dev->fwnode appropriately
    - [armhf,arm64] firmware/psci: psci_checker: Park kthreads before stopping
      them
    - [arm64] qcom: qcs404: Add reset-cells to GCC node
    - swiotlb: fix phys_addr_t overflow warning
    - [arm64] clk: tegra210: fix PLLU and PLLU_OUT1
    - fs/adfs: super: fix use-after-free bug
    - [arm64] dts: rockchip: Fix USB3 Type-C on rk3399-sapphire
    - btrfs: tree-checker: Check if the file extent end overflows
    - btrfs: fix minimum number of chunk errors for DUP
    - btrfs: Flush before reflinking any extent to prevent NOCOW write falling
      back to COW without data reservation
    - [arm64] remoteproc: copy parent dma_pfn_offset for vdev
    - btrfs: qgroup: Don't hold qgroup_ioctl_lock in btrfs_qgroup_inherit()
    - cifs: Fix a race condition with cifs_echo_request
    - ceph: fix improper use of smp_mb__before_atomic()
    - ceph: fix dir_lease_is_valid()
    - ceph: return -ERANGE if virtual xattr value didn't fit in buffer
    - virtio-mmio: add error check for platform_get_irq
    - drm/amd/display: Expose audio inst from DC to DM
    - cifs: fix crash in cifs_dfs_do_automount
    - perf version: Fix segfault due to missing OPT_END()
    - [x86] kvm: avoid constant-conversion warning
    - ACPI: fix false-positive -Wuninitialized warning
    - [x86] KVM: nVMX: Ignore segment base for VMX memory operand when segment
      not FS or GS
    - bpf: fix BTF verifier size resolution logic
    - be2net: Signal that the device cannot transmit during reconfiguration
    - mm/z3fold: don't try to use buddy slots after free
    - mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones
    - mm/z3fold.c: reinitialize zhdr structs after migration
    - [x86] apic: Silence -Wtype-limits compiler warnings
    - [arm*] mm/cma.c: fail if fixed declaration can't be honored
    - mm/ioremap: check virtual address alignment while creating huge mappings
    - coda: add error handling for fget
    - uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side
      headers
    - ipc/mqueue.c: only perform resource calculation if user valid
    - device-dax: fix memory and resource leak if hotplug fails
    - mm/hotplug: make remove_memory() interface usable
    - stacktrace: Force USER_DS for stack_trace_save_user()
    - [x86] crypto: ccp - Fix SEV_VERSION_GREATER_OR_EQUAL
    - xen/pv: Fix a boot up hang revealed by int3 self test
    - [x86] kvm: Don't call kvm_spurious_fault() from .fixup
    - [x86] paravirt: Fix callee-saved function ELF sizes
    - [x86] boot: Remove multiple copy of static function sanitize_boot_params()
    - bpf: Disable GCC -fgcse optimization for ___bpf_prog_run()
    - drm/nouveau: fix memory leak in nouveau_conn_reset()
    - drm/nouveau/dmem: missing mutex_lock in error path
    - kconfig: Clear "written" flag to avoid data loss
    - tpm: Fix null pointer dereference on chip register error path
    - Btrfs: fix incremental send failure after deduplication
    - Btrfs: fix race leading to fs corruption after transaction abort
    - dax: Fix missed wakeup in put_unlocked_entry()
    - fgraph: Remove redundant ftrace_graph_notrace_addr() test
    - [armhf,arm64] mmc: dw_mmc: Fix occasional hang after tuning on eMMC
    - [armhf] mmc: meson-mx-sdio: Fix misuse of GENMASK macro
    - mmc: mmc_spi: Enable stable writes
    - gpiolib: Preserve desc->flags when setting state
    - gpio: don't WARN() on NULL descs if gpiolib is disabled
    - gpiolib: fix incorrect IRQ requesting of an active-low lineevent
    - IB/hfi1: Fix Spectre v1 vulnerability
    - drm/nouveau: Only release VCPI slots on mode changes
    - mtd: rawnand: micron: handle on-die "ECC-off" devices correctly
    - eeprom: at24: make spd world-readable again
    - [arm*] i2c: iproc: Fix i2c master read more than 63 bytes
    - selinux: fix memory leak in policydb_init()
    - [x86] ALSA: hda: Fix 1-minute detection delay when i915 module is not
      available (see #931507)
    - mm: vmscan: check if mem cgroup is disabled or not before calling memcg
      slab shrinker
    - mm: migrate: fix reference check race between __find_get_block() and
      migration
    - mm: compaction: avoid 100% CPU usage during compaction when a task is
      killed
    - mm/migrate.c: initialize pud_entry in migrate_vma()
    - loop: Fix mount(2) failure due to race with LOOP_SET_FD
    - [s390x] dasd: fix endless loop after read unit address configuration
    - cgroup: kselftest: relax fs_spec checks
    - [hppa] Add archclean Makefile target
    - [hppa] Strip debug info from kernel before creating compressed vmlinuz
    - [hppa] Fix build of compressed kernel even with debug enabled
    - drivers/perf: arm_pmu: Fix failure path in PM notifier
    - [arm64] compat: Allow single-byte watchpoints on all addresses
    - [arm64] cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG}
    - io_uring: fix KASAN use after free in io_sq_wq_submit_work
    - scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA
    - nbd: replace kill_bdev() with __invalidate_device() again
    - xen/swiotlb: fix condition for calling xen_destroy_contiguous_region()
    - xen/gntdev.c: Replace vm_map_pages() with vm_map_pages_zero()
    - RDMA/devices: Do not deadlock during client removal
    - IB/mlx5: Fix unreg_umr to ignore the mkey state
    - IB/mlx5: Use direct mkey destroy command upon UMR unreg failure
    - IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache
    - IB/mlx5: Fix clean_mr() to work in the expected order
    - IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification
    - IB/hfi1: Check for error on call to alloc_rsm_map_table
    - IB/hfi1: Drop all TID RDMA READ RESP packets after r_next_psn
    - IB/hfi1: Field not zero-ed when allocating TID flow memory
    - [x86] drm/i915/perf: fix ICL perf register offsets
    - [x86] drm/i915/gvt: fix incorrect cache entry for guest page mapping
    - [x86] cpufeatures: Carve out CQM features retrieval
    - [x86] cpufeatures: Combine word 11 and 12 into a new scattered features
      word
    - [x86] speculation: Prepare entry code for Spectre v1 swapgs mitigations
    - [x86] speculation: Enable Spectre v1 swapgs mitigations (CVE-2019-1125)
    - [amd64] entry: Use JMP instead of JMPQ
    - [x86] speculation/swapgs: Exclude ATOMs from speculation through SWAPGS
    - Documentation: Add swapgs description to the Spectre v1 documentation

  [ Ben Hutchings ]
  * [armhf] udeb: Remove davinci_cpdma from nic-modules (fixes FTBFS)
  * Bump ABI to 2
  * [armel/marvell] Increase maximum image size (fixes FTBFS):
    - This removes support for QNAP TS-109, TS-119, TS-209, TS-219, TS-409,
      and HP Media Vault mv2120
    - This may be reverted if we can disable or modularise some features

  [ Julien Cristau ]
  * Fix libcpupower-dev's Depends field to account for SONAME bump.

 -- Ben Hutchings <ben@decadent.org.uk>  Wed, 07 Aug 2019 14:50:10 +0100

linux (5.2.6-1) unstable; urgency=medium

  * New upstream release:
    https://kernelnewbies.org/Linux_5.1
    https://kernelnewbies.org/Linux_5.2

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.1
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.2
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.4
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.5
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.6

  [ Bastian Germann ]
  * [armhf] Enable C_CAN as a module. (Closes: #929968)

  [ Ben Hutchings ]
  * Drop "x86/boot: Add ACPI RSDP address to setup_header", which should
    not have been applied to 4.20 or later
  * Drop redundant part of "Install perf scripts non-executable"
  * Drop "kbuild: Use -nostdinc in compile tests", which is no longer needed
  * debian/rules.d/scripts/kconfig: Update for upstream file renaming
  * debian/rules.d/scripts/mod: Add uuid_t and UUID_STRING_LEN definitions
  * liblockdep: Disable until it can be built again
  * libcpupower: Bump soversion since 2 exported functions have been removed
  * libbpf: Stop overriding upstream soname; rename shlib package to libbpf0
  * vfs: Enable FS_ENCRYPTION as built-in; disable on armel/marvell
  * net: Enable NET_DEVLINK as built-in; disable on armel/marvell
  * aufs: Update support patchset to aufs5.2 20190805
  * lockdown: Update for 5.2:
    - Update "acpi: Ignore acpi_rsdp kernel param when the kernel ..."
    - Add "tracefs: Restrict tracefs when the kernel is locked down"
    - Add "efi: Restrict efivar_ssdt_load when the kernel is locked down"
    - Drop "MODSIGN: Import certificates from UEFI Secure Boot"
  * [rt] Rebase onto 5.2.6, and re-enable
  * [armhf,arm64] gpu: Enable DRM_LIMA, DRM_PANFROST as modules
  * sched: Enable PSI (Closes: #931247)
  * [armhf,arm64] power: Enable ENERGY_MODEL
  * [armhf,arm64] cpufreq: Enable CPU_FREQ_DEFAULT_GOV_SCHEDUTIL (instead of
    CPU_FREQ_DEFAULT_GOV_PERFORMANCE)
  * hamradio: Disable auto-loading as mitigation against local exploits
  * hamradio: Enable most options in top-level config:
    - [arm64,ia64,mips*,riscv64,s390x,sh4,sparc64] Enable AX25, NETROM, ROSE,
      and all possible drivers (Closes: #920651)
    - [alpha,amd64,armel] ax25: Enable AX25_DAMA_SLAVE
    - [armhf] Enable BPQETHER, BAYCOM_SER_FDX, BAYCOM_SER_HDX, BAYCOM_PAR,
      BAYCOM_EPP, YAM as modules
  * [armel/rpi,armhf] media: Enable VIDEO_BCM2835 as module
  * usb/typec: Enable TYPEC_DP_ALTMODE, TYPEC_NVIDIA_ALTMODE as modules
    (Closes: #931752)
  * [amd64/cloud-amd64] hwrandom: Enable HW_RANDOM_VIRTIO (Closes: #914511)
  * [ppc64*] crypto: Enable CRYPTO_DEV_NX, and CRYPTO_DEV_NX_ENCRYPT,
    CRYPTO_DEV_NX_COMPRESS, CRYPTO_DEV_NX_COMPRESS_PSERIES,
    CRYPTO_DEV_NX_COMPRESS_POWERNV as modules (Closes: #931374)
  * [ppc64*] Disable PPC_TRANSACTIONAL_MEM (Closes: #866122)

  [ Vagrant Cascadian ]
  * [arm64] Enable modules to support audio on pinebook: SND_SUN4I_I2S,
    SND_SUN8I_CODEC, SND_SUN50I_CODEC_ANALOG, SND_SIMPLE_CARD,
    SND_SOC_SIMPLE_AMPLIFIER. (Closes: #921019)

  [ Romain Perier ]
  * Refreshed patches:
    - debian/revert-objtool-fix-config_stack_validation-y-warning.patch
    - debian/dfsg/video-remove-nvidiafb-and-rivafb.patch
    - debian/gitignore.patch
    - debian/mips-disable-werror.patch
    - bugfix/all/firmware-remove-redundant-log-messages-from-drivers.patch
    - bugfix/arm/arm-mm-export-__sync_icache_dcache-for-xen-privcmd.patch
    - bugfix/powerpc/powerpc-lib-makefile-don-t-pull-in-quad.o-for-32-bit.patch
    - bugfix/all/
      radeon-amdgpu-firmware-is-required-for-drm-and-kms-on-r600-onward.patch
    - bugfix/all/disable-some-marvell-phys.patch
    - debian/overlayfs-permit-mounts-in-userns.patch
    - bugfix/all/tools-perf-remove-shebangs.patch
    - debian/ntfs-mark-it-as-broken.patch
    - features/all/db-mok-keyring/
      0003-MODSIGN-checking-the-blacklisted-hash-before-loading-a-kernel-module.patch
    - features/all/db-mok-keyring/
      0004-MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch
    - debian/android-enable-building-ashmem-and-binder-as-modules.patch
    - features/all/aufs5/aufs5-mmap.patch
    - features/all/aufs5/aufs5-standalone.patch
    - features/all/lockdown/
      0029-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch
  * Enable coreboot memconsole (Closes: #872069)
  * [rt] Update to 5.2-rt1

  [ Karsten Merker ]
  * [riscv64] Change the kernel image format from ELF to flat Image.
    (Closes: #928451)
  * [riscv64] Update config and image format (Closes: #933603):
    - Enable SiFive UART and UART console support
    - Enable clock drivers for the SiFive FU540
    - Backport kernel image header support from kernel 5.3

  [ Uwe Kleine-König ]
  * [armhf] Add support for all i.MX6 variants.
  * enable XFRM_STATISTICS (Closes: #929938)
  * [arm64] Add support for Raspberry Pi 3 camera host interface (Closes:
    #933228)
  * Enable CRYPTO_ZSTD for ZRAM with ZSTD compression (Closes: #932722)

  [ Lubomir Rintel ]
  * [armhf] Enable config items for OLPC XO-1.75 (Closes: #927791)

 -- Ben Hutchings <ben@decadent.org.uk>  Mon, 05 Aug 2019 02:27:14 +0100

linux (5.0.2-1~exp1) experimental; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.2

  [ Vagrant Cascadian ]
  * [arm64,armhf] Enable PHY_ROCKCHIP_INNO_HDMI as modules.

  [ Ben Hutchings ]
  * [amd64] kexec: Enable KEXEC_SIG, replacing KEXEC_VERIFY_SIG
  * [armel] MTD: Enable MTD_PHYSMAP as module and set MTD_PHYSMAP_OF=y
    - udeb: Include physmap instead of physmap_of in mtd-modules (fixes FTBFS)
  * [armhf] sound/soc/ti: Enable SND_SOC_DAVINCI_MCASP, SND_SOC_NOKIA_RX51,
    SND_SOC_OMAP3_PANDORA, SND_SOC_OMAP3_TWL4030, SND_SOC_OMAP_ABE_TWL6040
    as modules; replacing SND_DAVINCI_SOC_MCASP, SND_OMAP_SOC_RX51,
    SND_OMAP_SOC_OMAP3_PANDORA, SND_OMAP_SOC_OMAP_TWL4030,
    SND_OMAP_SOC_OMAP_ABE_TWL6040 respectively
  * udeb: Add thermal_sys to kernel-image (fixes FTBFS on mips*, ppc64*,
    riscv64)
  * [powerpc*] mm: Only define MAX_PHYSMEM_BITS in SPARSEMEM configurations
    (fixes FTBFS on powerpc, powerpcspe)
  * debian/source/lintian-overrides: Override license-problem-gfdl-invariants
    in more files
  * debian/rules: Remove debian/*.substvars in clean target
  * debian/source/lintian-overrides: Override
    orig-tarball-missing-upstream-signature

 -- Ben Hutchings <ben@decadent.org.uk>  Mon, 18 Mar 2019 04:01:01 +0000

linux (5.0.1-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_5.0
  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.1

  [ YunQiang Su ]
  * [mipsel, mips64el] Enable DRM_AST and FB_SM750 for loongson-3
    install ast and sm750fb to loongson-3's fb-modules
  * [mips r6] Disable JUMP_LABEL for now: it will cause Reserved Instruction.
    Enable SERIAL_OF_PLATFORM, if not, userland shows nothing.
    Enable CPU_HAS_MSA, HIGHMEM, CRYPTO_CRC32_MIPS, and NR_CPUS to 16.
    Support some boston drivers: IMG_ASCII_LCD, I2C_EG20T, PCH_PHUB, MMC,
      PCIE_XILINX, RTC_DRV_M41T80, SPI_TOPCLIFF_PCH.

  [ Hideki Yamane ]
  * [x86] Enable Touchpad support on Gemini Lake (Closes: #917388)

  [ Helge Deller ]
  * [hppa] Build only 32- and 64-bit SMP-kernel: Alternative
    live-patching code will patch kernel for UP at boot if necessary.

  [ Romain Perier ]
  * Refreshed debian/export-symbols-needed-by-android-drivers.patch to export
    __close_fd_get_file() and task_work_add(), both required by binder.
  * Refreshed debian/revert-objtool-fix-config_stack_validation-y-warning.patch,
    so this can be applied against 4.20.4
  * Refreshed patch for lockdown
    0028-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch, so this
    can be applied against >= 4.20.13

  [ Marcin Juszkiewicz ]
  * udeb: Add virtio-gpu into d-i to get graphical output in VM instances.

  [ Ben Hutchings ]
  * SCSI: Enable SCSI_MYRB, SCSI_MYRS as modules, replacing BLK_DEV_DAC960
  * [arm64] remoteproc: Enable QCOM_Q6V5_MSS, renamed version of
    QCOM_Q6V5_PIL
  * [x86] drivers/gpu/drm/amd: Re-enable HSA_AMD (Closes: #920454)
  * genpatch-aufs: Update to use aufs5-standalone
  * aufs: Update support patchset to aufs5.0 20190311
  * lockdown: Update patchset to 2019-02-18 version

 -- Ben Hutchings <ben@decadent.org.uk>  Tue, 12 Mar 2019 23:15:21 +0000

linux (4.20-1~exp1) experimental; urgency=medium

  * New upstream release: https://kernelnewbies.org/Linux_4.20

  [ Ben Hutchings ]
  * aufs: Update support patchset to aufs4.x-rcN 20181217
  * [rt] Disable until it is updated for 4.20 or later
  * [x86] udeb: Move rfkill to new rfkill-modules package to avoid duplication
  * debian/source/lintian-overrides: Update overrides for GFDL notices

 -- Ben Hutchings <ben@decadent.org.uk>  Mon, 24 Dec 2018 04:26:47 +0000

linux (4.19.37-6) unstable; urgency=high

  [ John Paul Adrian Glaubitz ]
  * [sh4]: Check for kprobe trap number before trying to handle a kprobe trap

  [ Salvatore Bonaccorso ]
  * tcp: refine memory limit test in tcp_fragment() (Closes: #930904)
  * ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME (CVE-2019-13272)

  [ Steve McIntyre ]
  * [arm64] Improve support for the Huawei TaiShan server platform
    (Closes: #930554):
    - Enable the HNS/ROCE Infiniband driver
    - Backport fixes from 4.20 and 4.21 for HNS3 networking, hisi_sas SAS
      and HNS/ROCE Infiniband
    - Add module:drivers/scsi/hisi_sas/* to the ABI ignore list

  [ Cyril Brulebois ]
  * [arm] Backport DTB support for Rasperry Pi Compute Module 3.
  * [arm64] Backport DTB support for Rasperry Pi Compute Module 3.

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 19 Jul 2019 00:23:17 +0200

