linux-ibm-5.15 (5.15.0-1047.50~20.04.1) focal; urgency=medium

  * focal/linux-ibm-5.15: 5.15.0-1047.50~20.04.1 -proposed tracker
    (LP: #2052238)

  [ Ubuntu: 5.15.0-1047.50 ]

  * jammy/linux-ibm: 5.15.0-1047.50 -proposed tracker (LP: #2052239)
  * jammy/linux: 5.15.0-97.107 -proposed tracker (LP: #2052600)
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
  * partproke is broken on empty loopback device (LP: #2049689)
    - block: Move checking GENHD_FL_NO_PART to bdev_add_partition()
  * CVE-2023-51781
    - appletalk: Fix Use-After-Free in atalk_ioctl
  * CVE-2023-51780
    - atm: Fix Use-After-Free in do_vcc_ioctl
  * CVE-2023-6915
    - ida: Fix crash in ida_free when the bitmap is empty
  * CVE-2024-0565
    - smb: client: fix OOB in receive_encrypted_standard()
  * CVE-2024-0646
    - net: tls, update curr on splice as well

 -- Kuba Pawlak <kuba.pawlak@canonical.com>  Tue, 13 Feb 2024 12:12:34 +0100

linux-ibm-5.15 (5.15.0-1046.49~20.04.1) focal; urgency=medium

  * focal/linux-ibm-5.15: 5.15.0-1046.49~20.04.1 -proposed tracker
    (LP: #2048302)

  [ Ubuntu: 5.15.0-1046.49 ]

  * jammy/linux-ibm: 5.15.0-1046.49 -proposed tracker (LP: #2048303)
  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2024.01.08)
  * Add ODM driver rtc-pcf85263 (LP: #2045385)
    - [Config] ibm: updateconfigs for ODM drivers CONFIG_RTC_DRV_PCF85263
  * Add ODM driver gpio-m058ssan (LP: #2045386)
    - [Config] ibm: updateconfigs for ODM drivers CONFIG_GPIO_M058SSAN
  * jammy/linux: 5.15.0-94.104 -proposed tracker (LP: #2048777)
  * [SRU] Duplicate Device_dax ids Created and hence Probing is Failing.
    (LP: #2028158)
    - device-dax: Fix duplicate 'hmem' device registration
  * Add ODM driver f81604 usb-can (LP: #2045387)
    - can: usb: f81604: add Fintek F81604 support
    - [Config] updateconfigs for ODM drivers CONFIG_CAN_F81604
  * Add ODM driver gpio-m058ssan (LP: #2045386)
    - SAUCE: ODM: gpio: add M058SSAN gpio driver
    - [Config] updateconfigs for ODM drivers CONFIG_GPIO_M058SSAN
  * Add ODM driver rtc-pcf85263 (LP: #2045385)
    - SAUCE: ODM: rtc: add PCF85263 RTC driver
    - [Config] updateconfigs for ODM drivers CONFIG_RTC_DRV_PCF85263
  * AppArmor patch for mq-posix interface is missing in jammy (LP: #2045384)
    - SAUCE: (no-up) apparmor: reserve mediation classes
    - SAUCE: (no-up) apparmor: Add fine grained mediation of posix mqueues
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
  * jammy/linux: 5.15.0-93.103 -proposed tracker (LP: #2048330)
  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
    - [Packaging] resync update-dkms-versions helper
    - [Packaging] remove helper scripts
    - [Packaging] update annotations scripts
    - debian/dkms-versions -- update from kernel-versions (main/2024.01.08)
  * Hotplugging SCSI disk in QEMU VM fails (LP: #2047382)
    - Revert "PCI: acpiphp: Reassign resources on bridge if necessary"
  * CVE-2023-6622
    - netfilter: nf_tables: bail out on mismatching dynset and set expressions
  * CVE-2024-0193
    - netfilter: nf_tables: skip set commit for deleted/destroyed sets
  * CVE-2023-6040
    - netfilter: nf_tables: Reject tables of unsupported family
  * Patches needed for AmpereOne (arm64) (LP: #2044192)
    - clocksource/arm_arch_timer: Add build-time guards for unhandled register
      accesses
    - clocksource/drivers/arm_arch_timer: Drop CNT*_TVAL read accessors
    - clocksource/drivers/arm_arch_timer: Extend write side of timer register
      accessors to u64
    - clocksource/drivers/arm_arch_timer: Move system register timer programming
      over to CVAL
    - clocksource/drivers/arm_arch_timer: Move drop _tval from erratum function
      names
    - clocksource/drivers/arm_arch_timer: Fix MMIO base address vs callback
      ordering issue
    - clocksource/drivers/arm_arch_timer: Move MMIO timer programming over to CVAL
    - clocksource/drivers/arm_arch_timer: Advertise 56bit timer to the core code
    - clocksource/drivers/arm_arch_timer: Work around broken CVAL implementations
    - clocksource/drivers/arm_arch_timer: Remove any trace of the TVAL programming
      interface
    - clocksource/drivers/arm_arch_timer: Drop unnecessary ISB on CVAL programming
    - clocksource/drivers/arm_arch_timer: Fix masking for high freq counters
    - clocksource/drivers/arch_arm_timer: Move workaround synchronisation around
  * Add quirk to disable i915 fastboot on B&R PC (LP: #2047630)
    - SAUCE: i915: force disable fastboot quirk
  * Some machines can't pass the pm-graph test (LP: #2046217)
    - wifi: iwlwifi: pcie: rescan bus if no parent
  * Sound: Add rtl quirk of M90-Gen5 (LP: #2046105)
    - ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
  * linux tools packages for derived kernels refuse to install simultaneously
    due to libcpupower name collision (LP: #2035971)
    - [Packaging] Statically link libcpupower into cpupower tool
  * [Debian] autoreconstruct - Do not generate chmod -x for deleted  files
    (LP: #2045562)
    - [Debian] autoreconstruct - Do not generate chmod -x for deleted files
  * CVE-2023-6931
    - perf/core: Add a new read format to get a number of lost samples
    - perf: Fix perf_event_validate_size()
    - perf: Fix perf_event_validate_size() lockdep splat
  * CVE-2023-6932
    - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
  * CVE-2023-6606
    - smb: client: fix OOB in smbCalcSize()
  * CVE-2023-6817
    - netfilter: nft_set_pipapo: skip inactive elements during set walk
  * Jammy update: v5.15.136 upstream stable release (LP: #2046008)
    - iommu/vt-d: Avoid memory allocation in iommu_suspend()
    - scsi: core: Use a structure member to track the SCSI command submitter
    - scsi: core: Rename scsi_mq_done() into scsi_done() and export it
    - scsi: ib_srp: Call scsi_done() directly
    - RDMA/srp: Do not call scsi_done() from srp_abort()
    - RDMA/cxgb4: Check skb value for failure to allocate
    - perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7
    - of: overlay: Reorder struct fragment fields kerneldoc
    - platform/x86: think-lmi: Fix reference leak
    - platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section
      mismatch warning
    - lib/test_meminit: fix off-by-one error in test_pages()
    - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
    - quota: Fix slow quotaoff
    - net: prevent address rewrite in kernel_bind()
    - ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset
    - KEYS: trusted: allow use of kernel RNG for key material
    - KEYS: trusted: Remove redundant static calls usage
    - drm/msm/dp: do not reinitialize phy unless retry during link training
    - drm/msm/dsi: skip the wait for video mode done if not applicable
    - drm/msm/dsi: fix irq_of_parse_and_map() error checking
    - drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow
    - ravb: Fix up dma_free_coherent() call in ravb_remove()
    - ravb: Fix use-after-free issue in ravb_tx_timeout_work()
    - ieee802154: ca8210: Fix a potential UAF in ca8210_probe
    - mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type
    - eth: remove copies of the NAPI_POLL_WEIGHT define
    - xen-netback: use default TX queue size for vifs
    - riscv, bpf: Factor out emit_call for kernel and bpf context
    - riscv, bpf: Sign-extend return values
    - drm/vmwgfx: fix typo of sizeof argument
    - bpf: Fix verifier log for async callback return values
    - net: macsec: indicate next pn update when offloading
    - net: phy: mscc: macsec: reject PN update requests
    - ixgbe: fix crash with empty VF macvlan list
    - net/mlx5e: Again mutually exclude RX-FCS and RX-port-timestamp
    - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
    - pinctrl: renesas: rzn1: Enable missing PINMUX
    - nfc: nci: assert requested protocol is valid
    - workqueue: Override implicit ordered attribute in
      workqueue_apply_unbound_cpumask()
    - net: add sysctl accept_ra_min_rtr_lft
    - net: change accept_ra_min_rtr_lft to affect all RA lifetimes
    - net: release reference to inet6_dev pointer
    - media: mtk-jpeg: Fix use after free bug due to uncanceled work
    - dmaengine: stm32-mdma: abort resume if no ongoing transfer
    - xhci: Keep interrupt disabled in initialization until host is running.
    - usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
    - net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
    - usb: dwc3: Soft reset phy on probe for host
    - usb: cdns3: Modify the return value of cdns_set_active () to void when
      CONFIG_PM_SLEEP is disabled
    - usb: musb: Get the musb_qh poniter after musb_giveback
    - usb: musb: Modify the "HWVers" register address
    - iio: pressure: bmp280: Fix NULL pointer exception
    - iio: pressure: dps310: Adjust Timeout Settings
    - iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
    - drm/amdgpu: add missing NULL check
    - drm/amd/display: Don't set dpms_off for seamless boot
    - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
    - x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
    - mcb: remove is_added flag from mcb_device struct
    - thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple
      Ridge
    - thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding
    - libceph: use kernel_connect()
    - ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
    - ceph: fix type promotion bug on 32bit systems
    - Input: powermate - fix use-after-free in powermate_config_complete
    - Input: psmouse - fix fast_reconnect function for PS/2 mode
    - Input: xpad - add PXN V900 support
    - Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
    - Input: goodix - ensure int GPIO is in input for gpio_count == 1 &&
      gpio_int_idx == 0 case
    - tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
    - cgroup: Remove duplicates in cgroup v1 tasks file
    - counter: microchip-tcb-capture: Fix the use of internal GCLK logic
    - usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
    - usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
    - usb: cdnsp: Fixes issue with dequeuing not queued requests
    - x86/alternatives: Disable KASAN in apply_alternatives()
    - dmaengine: idxd: use spin_lock_irqsave before wait_event_lock_irq
    - dmaengine: mediatek: Fix deadlock caused by synchronize_irq()
    - powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE
    - powerpc/64e: Fix wrong test in __ptep_test_and_clear_young()
    - arm64: report EL1 UNDEFs better
    - arm64: die(): pass 'err' as long
    - arm64: consistently pass ESR_ELx to die()
    - arm64: rework FPAC exception handling
    - arm64: rework BTI exception handling
    - arm64: allow kprobes on EL0 handlers
    - arm64: split EL0/EL1 UNDEF handlers
    - arm64: factor out EL1 SSBS emulation hook
    - arm64: factor insn read out of call_undef_hook()
    - arm64: rework EL0 MRS emulation
    - arm64: armv8_deprecated: fold ops into insn_emulation
    - arm64: armv8_deprecated move emulation functions
    - arm64: armv8_deprecated: move aarch32 helper earlier
    - arm64: armv8_deprecated: rework deprected instruction handling
    - arm64: armv8_deprecated: fix unused-function error
    - usb: hub: Guard against accesses to uninitialized BOS descriptors
    - eth: remove remaining copies of the NAPI_POLL_WEIGHT define
    - Linux 5.15.136
  * Jammy update: v5.15.135 upstream stable release (LP: #2045809)
    - spi: zynqmp-gqspi: Convert to platform remove callback returning void
    - spi: zynqmp-gqspi: fix clock imbalance on probe failure
    - ASoC: soc-utils: Export snd_soc_dai_is_dummy() symbol
    - ASoC: tegra: Fix redundant PLLA and PLLA_OUT0 updates
    - NFS: Cleanup unused rpc_clnt variable
    - NFS: rename nfs_client_kset to nfs_kset
    - NFSv4: Fix a state manager thread deadlock regression
    - ring-buffer: remove obsolete comment for free_buffer_page()
    - ring-buffer: Fix bytes info in per_cpu buffer stats
    - arm64: Avoid repeated AA64MMFR1_EL1 register read on pagefault path
    - iommu/arm-smmu-v3: Set TTL invalidation hint better
    - iommu/arm-smmu-v3: Avoid constructing invalid range commands
    - rbd: move rbd_dev_refresh() definition
    - rbd: decouple header read-in from updating rbd_dev->header
    - rbd: decouple parent info read-in from updating rbd_dev
    - rbd: take header_rwsem in rbd_dev_refresh() only when updating
    - block: fix use-after-free of q->q_usage_counter
    - scsi: zfcp: Fix a double put in zfcp_port_enqueue()
    - qed/red_ll2: Fix undefined behavior bug in struct qed_ll2_info
    - wifi: mwifiex: Fix tlv_buf_left calculation
    - net: replace calls to sock->ops->connect() with kernel_connect()
    - net: prevent rewrite of msg_name in sock_sendmsg()
    - drm/amd: Fix detection of _PR3 on the PCIe root port
    - arm64: Add Cortex-A520 CPU part definition
    - HID: sony: Fix a potential memory leak in sony_probe()
    - ubi: Refuse attaching if mtd's erasesize is 0
    - wifi: iwlwifi: dbg_ini: fix structure packing
    - iwlwifi: avoid void pointer arithmetic
    - wifi: iwlwifi: mvm: Fix a memory corruption issue
    - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
    - bpf: Fix tr dereferencing
    - drivers/net: process the result of hdlc_open() and add call of hdlc_close()
      in uhdlc_close()
    - wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling
    - regmap: rbtree: Fix wrong register marked as in-cache when creating new node
    - ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig
    - [Config] updateconfigs for IMA_BLACKLIST_KEYRING
    - scsi: target: core: Fix deadlock due to recursive locking
    - ima: rework CONFIG_IMA dependency block
    - NFSv4: Fix a nfs4_state_manager() race
    - bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets
    - modpost: add missing else to the "of" check
    - net: fix possible store tearing in neigh_periodic_work()
    - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
    - ptp: ocp: Fix error handling in ptp_ocp_device_init
    - net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent
    - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
    - net: nfc: llcp: Add lock when modifying device list
    - net: ethernet: ti: am65-cpsw: Fix error code in
      am65_cpsw_nuss_init_tx_chns()
    - ibmveth: Remove condition to recompute TCP header checksum.
    - netfilter: handle the connecting collision properly in
      nf_conntrack_proto_sctp
    - netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure
    - ipv4: Set offload_failed flag in fibmatch results
    - net: stmmac: dwmac-stm32: fix resume on STM32 MCU
    - tipc: fix a potential deadlock on &tx->lock
    - tcp: fix quick-ack counting to count actual ACKs of new data
    - tcp: fix delayed ACKs for MSS boundary condition
    - sctp: update transport state when processing a dupcook packet
    - sctp: update hb timer immediately after users change hb_interval
    - HID: sony: remove duplicate NULL check before calling usb_free_urb()
    - HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit
    - dm zoned: free dmz->ddev array in dmz_put_zoned_devices
    - RDMA/core: Require admin capabilities to set system parameters
    - of: dynamic: Fix potential memory leak in of_changeset_action()
    - IB/mlx4: Fix the size of a buffer in add_port_entries()
    - gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config()
    - gpio: pxa: disable pinctrl calls for MMP_GPIO
    - RDMA/cma: Initialize ib_sa_multicast structure to 0 when join
    - RDMA/cma: Fix truncation compilation warning in make_cma_ports
    - RDMA/uverbs: Fix typo of sizeof argument
    - RDMA/siw: Fix connection failure handling
    - RDMA/mlx5: Fix NULL string error
    - ksmbd: fix uaf in smb20_oplock_break_ack
    - parisc: Restore __ldcw_align for PA-RISC 2.0 processors
    - xen/events: replace evtchn_rwlock with RCU
    - Linux 5.15.135
  * CVE-2023-46813
    - x86/sev: Disable MMIO emulation from user mode
    - x86/sev: Check IOBM for IOIO exceptions from user-space
    - x86/sev: Check for user-space IOIO pointing to kernel space
  * CVE-2023-6111
    - netfilter: nf_tables: remove catchall element in GC sync path
  * Change in trace file leads to test timeout in ftrace tests on 5.15 ARM64
    (LP: #2029405)
    - selftests/ftrace: Stop tracing while reading the trace file by default
  * Fix ADL: System enabled AHCI can't get into s0ix when attached ODD
    (LP: #2037493)
    - ata: ahci: Add Intel Alder Lake-P AHCI controller to low power chipsets list
  * Kernel doesn't compile with CONFIG_IMA (LP: #2041842)
    - SAUCE: LSM: Fix typo in ima_filter_rule_match struct argument
  * CVE-2023-32252
    - ksmbd: add smb-direct shutdown
    - ksmbd: Implements sess->ksmbd_chann_list as xarray
    - ksmbd: fix racy issue from session setup and logoff
  * Jammy update: v5.15.134 upstream stable release (LP: #2044023)
    - NFS: Use the correct commit info in nfs_join_page_group()
    - NFS: More fixes for nfs_direct_write_reschedule_io()
    - NFS/pNFS: Report EINVAL errors from connect() to the server
    - SUNRPC: Mark the cred for revalidation if the server rejects it
    - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server
    - NFSv4.1: fix pnfs MDS=DS session trunking
    - tracing: Make trace_marker{,_raw} stream-like
    - tracing: Increase trace array ref count on enable and filter files
    - ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones
    - ata: libahci: clear pending interrupt status
    - ext4: scope ret locally in ext4_try_to_trim_range()
    - ext4: change s_last_trim_minblks type to unsigned long
    - ext4: replace the traditional ternary conditional operator with with
      max()/min()
    - ext4: move setting of trimmed bit into ext4_try_to_trim_range()
    - ext4: do not let fstrim block system suspend
    - tracing: Have event inject files inc the trace array ref count
    - netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
    - netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC
    - netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation
      fails
    - netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
    - netfilter: nf_tables: fix memleak when more than 255 elements expired
    - ASoC: meson: spdifin: start hw on dai probe
    - netfilter: nf_tables: disallow element removal on anonymous sets
    - bpf: Avoid deadlock when using queue and stack maps from NMI
    - selftests: tls: swap the TX and RX sockets in some tests
    - net/core: Fix ETH_P_1588 flow dissector
    - ASoC: imx-audmix: Fix return error with devm_clk_get()
    - iavf: do not process adminq tasks when __IAVF_IN_REMOVE_TASK is set
    - i40e: Add VF VLAN pruning
    - i40e: Fix VF VLAN offloading when port VLAN is configured
    - ionic: fix 16bit math issue when PAGE_SIZE >= 64KB
    - igc: Fix infinite initialization loop with early XDP redirect
    - powerpc/perf/hv-24x7: Update domain value check
    - dccp: fix dccp_v4_err()/dccp_v6_err() again
    - platform/x86: intel_scu_ipc: Check status after timeout in busy_loop()
    - platform/x86: intel_scu_ipc: Check status upon timeout in
      ipc_wait_for_interrupt()
    - platform/x86: intel_scu_ipc: Don't override scu in
      intel_scu_ipc_dev_simple_command()
    - platform/x86: intel_scu_ipc: Fail IPC send if still busy
    - x86/srso: Fix srso_show_state() side effect
    - x86/srso: Fix SBPB enablement for spec_rstack_overflow=off
    - net: hns3: fix GRE checksum offload issue
    - net: hns3: only enable unicast promisc when mac table full
    - net: hns3: fix fail to delete tc flower rules during reset issue
    - net: hns3: add 5ms delay before clear firmware reset irq source
    - net: bridge: use DEV_STATS_INC()
    - team: fix null-ptr-deref when team device type is changed
    - net: rds: Fix possible NULL-pointer dereference
    - netfilter: nf_tables: disable toggling dormant table state more than once
    - locking/seqlock: Do the lockdep annotation before locking in
      do_write_seqcount_begin_nested()
    - net: ena: Flush XDP packets on error.
    - bnxt_en: Flush XDP for bnxt_poll_nitroa0()'s NAPI
    - igc: Expose tx-usecs coalesce setting to user
    - Fix up backport of 136191703038 ("interconnect: Teach lockdep about
      icc_bw_lock order")
    - gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
    - i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
    - i2c: mux: gpio: Replace custom acpi_get_local_address()
    - i2c: mux: gpio: Add missing fwnode_handle_put()
    - xfs: bound maximum wait time for inodegc work
    - xfs: introduce xfs_inodegc_push()
    - xfs: explicitly specify cpu when forcing inodegc delayed work to run
      immediately
    - xfs: check that per-cpu inodegc workers actually run on that cpu
    - xfs: disable reaping in fscounters scrub
    - xfs: fix xfs_inodegc_stop racing with mod_delayed_work
    - Input: i8042 - rename i8042-x86ia64io.h to i8042-acpipnpio.h
    - Input: i8042 - add quirk for TUXEDO Gemini 17 Gen1/Clevo PD70PN
    - netfilter: exthdr: add support for tcp option removal
    - netfilter: nft_exthdr: Fix non-linear header modification
    - ata: libata: Rename link flag ATA_LFLAG_NO_DB_DELAY
    - ata: ahci: Add support for AMD A85 FCH (Hudson D4)
    - ata: ahci: Rename board_ahci_mobile
    - ata: ahci: Add Elkhart Lake AHCI controller
    - scsi: qla2xxx: Select qpair depending on which CPU post_cmd() gets called
    - scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()
    - btrfs: reset destination buffer when read_extent_buffer() gets invalid range
    - MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled
    - drm/bridge: ti-sn65dsi83: Do not generate HFP/HBP/HSA and EOT packet
    - bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset()
    - bus: ti-sysc: Fix missing AM35xx SoC matching
    - clk: tegra: fix error return case for recalc_rate
    - treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE
      (part 1)
    - ARM: dts: omap: correct indentation
    - ARM: dts: ti: omap: Fix bandgap thermal cells addressing for omap3/4
    - ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot
    - bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up
    - power: supply: ucs1002: fix error code in ucs1002_get_property()
    - firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()
    - xtensa: add default definition for XCHAL_HAVE_DIV32
    - xtensa: iss/network: make functions static
    - xtensa: boot: don't add include-dirs
    - xtensa: boot/lib: fix function prototypes
    - soc: imx8m: Enable OCOTP clock for imx8mm before reading registers
    - gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip
    - i2c: npcm7xx: Fix callback completion ordering
    - dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
    - spi: sun6i: reduce DMA RX transfer width to single byte
    - spi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain
    - parisc: sba: Fix compile warning wrt list of SBA devices
    - parisc: iosapic.c: Fix sparse warnings
    - parisc: drivers: Fix sparse warning
    - parisc: irq: Make irq_stack_union static to avoid sparse warning
    - scsi: qedf: Add synchronization between I/O completions and abort
    - scsi: ufs: core: Move __ufshcd_send_uic_cmd() outside host_lock
    - selftests/ftrace: Correctly enable event in instance-event.tc
    - ring-buffer: Avoid softlockup in ring_buffer_resize()
    - btrfs: improve error message after failure to add delayed dir index item
    - selftests: fix dependency checker script
    - ring-buffer: Do not attempt to read past "commit"
    - platform/mellanox: mlxbf-bootctl: add NET dependency into Kconfig
    - drm/amd/display: Don't check registers, if using AUX BL control
    - drm/amdgpu: Handle null atom context in VBIOS info ioctl
    - scsi: pm80xx: Use phy-specific SAS address when sending PHY_START command
    - scsi: pm80xx: Avoid leaking tags when processing
      OPC_INB_SET_CONTROLLER_CONFIG command
    - smb3: correct places where ENOTSUPP is used instead of preferred EOPNOTSUPP
    - ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
    - spi: nxp-fspi: reset the FLSHxCR1 registers
    - spi: stm32: add a delay before SPI disable
    - ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag
    - bpf: Clarify error expectations from bpf_clone_redirect
    - ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link
    - media: vb2: frame_vector.c: replace WARN_ONCE with a comment
    - powerpc/watchpoints: Disable preemption in thread_change_pc()
    - powerpc/watchpoint: Disable pagefaults when getting user instruction
    - powerpc/watchpoints: Annotate atomic context in more places
    - ncsi: Propagate carrier gain/loss events to the NCSI controller
    - fbdev/sh7760fb: Depend on FB=y
    - perf build: Define YYNOMEM as YYNOABORT for bison < 3.81
    - sched/cpuacct: Optimize away RCU read lock
    - cgroup: Fix suspicious rcu_dereference_check() usage warning
    - nvme-pci: factor the iod mempool creation into a helper
    - nvme-pci: factor out a nvme_pci_alloc_dev helper
    - nvme-pci: do not set the NUMA node of device if it has none
    - watchdog: iTCO_wdt: No need to stop the timer in probe
    - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running
    - i40e: fix potential NULL pointer dereferencing of pf->vf
      i40e_sync_vsi_filters()
    - scsi: qla2xxx: Fix NULL pointer dereference in target mode
    - nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev
    - smack: Record transmuting in smk_transmuted
    - smack: Retrieve transmuting information in smack_inode_getsecurity()
    - Smack:- Use overlay inode label in smack_inode_copy_up()
    - iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
    - x86/srso: Add SRSO mitigation for Hygon processors
    - Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
    - serial: 8250_port: Check IRQ data before use
    - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
    - ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre
      M70q
    - ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES
    - i2c: i801: unregister tco_pdev in i801_probe() error path
    - sched/rt: Fix live lock between select_fallback_rq() and RT push
    - io_uring/fs: remove sqe->rw_flags checking from LINKAT
    - Revert "SUNRPC dont update timeout value on connection reset"
    - proc: nommu: /proc/<pid>/maps: release mmap read lock
    - ring-buffer: Update "shortest_full" in polling
    - btrfs: properly report 0 avail for very full file systems
    - bpf: Fix BTF_ID symbol generation collision
    - bpf: Fix BTF_ID symbol generation collision in tools/
    - net: thunderbolt: Fix TCPv6 GSO checksum calculation
    - ata: libata-core: Fix ata_port_request_pm() locking
    - ata: libata-core: Fix port and device removal
    - ata: libata-core: Do not register PM operations for SAS ports
    - ata: libata-sata: increase PMP SRST timeout to 10s
    - fs: binfmt_elf_efpic: fix personality for ELF-FDPIC
    - drm/meson: fix memory leak on ->hpd_notify callback
    - Linux 5.15.134
  * Jammy update: v5.15.133 upstream stable release (LP: #2043422)
    - autofs: fix memory leak of waitqueues in autofs_catatonic_mode
    - btrfs: output extra debug info if we failed to find an inline backref
    - locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock
    - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
    - kernel/fork: beware of __put_task_struct() calling context
    - rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to
      _idle()
    - scftorture: Forgive memory-allocation failure if KASAN
    - ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470
    - perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09
    - perf/imx_ddr: speed up overflow frequency of cycle
    - hw_breakpoint: fix single-stepping when using bpf_overflow_handler
    - ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects
    - devlink: remove reload failed checks in params get/set callbacks
    - crypto: lrw,xts - Replace strlcpy with strscpy
    - wifi: ath9k: fix fortify warnings
    - wifi: ath9k: fix printk specifier
    - wifi: mwifiex: fix fortify warning
    - wifi: wil6210: fix fortify warnings
    - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
    - tpm_tis: Resend command to recover from data transfer errors
    - mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450
    - alx: fix OOB-read compiler warning
    - wifi: mac80211: check S1G action frame size
    - netfilter: ebtables: fix fortify warnings in size_entry_mwt()
    - wifi: mac80211_hwsim: drop short frames
    - drm/bridge: tc358762: Instruct DSI host to generate HSE packets
    - arm64: dts: qcom: sm6125-pdx201: correct ramoops pmsg-size
    - arm64: dts: qcom: sm8150-kumano: correct ramoops pmsg-size
    - arm64: dts: qcom: sm8250-edo: correct ramoops pmsg-size
    - samples/hw_breakpoint: Fix kernel BUG 'invalid opcode: 0000'
    - ALSA: hda: intel-dsp-cfg: add LunarLake support
    - drm/amd/display: Blocking invalid 420 modes on HDMI TMDS for DCN31
    - drm/exynos: fix a possible null-pointer dereference due to data race in
      exynos_drm_crtc_atomic_disable()
    - bus: ti-sysc: Configure uart quirks for k3 SoC
    - md: raid1: fix potential OOB in raid1_remove_disk()
    - ext2: fix datatype of block number in ext2_xattr_set2()
    - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
    - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
    - ARM: 9317/1: kexec: Make smp stop calls asynchronous
    - powerpc/pseries: fix possible memory leak in ibmebus_bus_init()
    - PCI: fu740: Set the number of MSI vectors
    - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
    - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
    - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
    - media: anysee: fix null-ptr-deref in anysee_master_xfer
    - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
    - media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
    - media: tuners: qt1010: replace BUG_ON with a regular error
    - media: pci: cx23885: replace BUG with error return
    - usb: cdns3: Put the cdns set active part outside the spin lock
    - usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
    - tools: iio: iio_generic_buffer: Fix some integer type and calculation
    - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
    - serial: cpm_uart: Avoid suspicious locking
    - usb: ehci: add workaround for chipidea PORTSC.PEC bug
    - media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning
    - kobject: Add sanity check for kset->kobj.ktype in kset_register()
    - interconnect: Fix locking for runpm vs reclaim
    - printk: Consolidate console deferred printing
    - jbd2: refactor wait logic for transaction updates into a common function
    - jbd2: fix use-after-free of transaction_t race
    - jbd2: kill t_handle_lock transaction spinlock
    - jbd2: rename jbd_debug() to jbd2_debug()
    - jbd2: correct the end of the journal recovery scan range
    - mtd: rawnand: brcmnand: Allow SoC to provide I/O operations
    - mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller
    - MIPS: Use "grep -E" instead of "egrep"
    - perf test: Remove bash construct from stat_bpf_counters.sh test
    - perf test shell stat_bpf_counters: Fix test on Intel
    - btrfs: move btrfs_pinned_by_swapfile prototype into volumes.h
    - btrfs: add a helper to read the superblock metadata_uuid
    - btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super
    - drm: gm12u320: Fix the timeout usage for usb_bulk_msg()
    - scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir()
    - selftests: tracing: Fix to unmount tracefs for recovering environment
    - scsi: lpfc: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
    - x86/boot/compressed: Reserve more memory for page tables
    - x86/purgatory: Remove LTO flags
    - samples/hw_breakpoint: fix building without module unloading
    - md/raid1: fix error: ISO C90 forbids mixed declarations
    - attr: block mode changes of symlinks
    - ovl: fix failed copyup of fileattr on a symlink
    - ovl: fix incorrect fdput() on aio completion
    - btrfs: fix lockdep splat and potential deadlock after failure running
      delayed items
    - btrfs: release path before inode lookup during the ino lookup ioctl
    - tracing: Have tracing_max_latency inc the trace array ref count
    - tracing: Have current_trace inc the trace array ref count
    - tracing: Have option files inc the trace array ref count
    - nfsd: fix change_info in NFSv4 RENAME replies
    - tracefs: Add missing lockdown check to tracefs_create_dir()
    - i2c: aspeed: Reset the i2c controller when timeout occurs
    - ata: libata: disallow dev-initiated LPM transitions to unsupported states
    - scsi: megaraid_sas: Fix deadlock on firmware crashdump
    - scsi: pm8001: Setup IRQs on resume
    - ext4: fix rec_len verify error
    - drm/amd/display: fix the white screen issue when >= 64GB DRAM
    - drm/amdgpu: fix amdgpu_cs_p1_user_fence
    - drm/amd/display: enable cursor degamma for DCN3+ DRM legacy gamma
    - interconnect: Teach lockdep about icc_bw_lock order
    - Linux 5.15.133
  * Jammy update: v5.15.132 upstream stable release (LP: #2041702)
    - ARM: dts: imx: update sdma node name format
    - ARM: dts: imx7s: Drop dma-apb interrupt-names
    - ARM: dts: imx: Adjust dma-apbh node name
    - ARM: dts: imx: Set default tuning step for imx7d usdhc
    - phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code
    - media: pulse8-cec: handle possible ping error
    - media: pci: cx23885: fix error handling for cx23885 ATSC boards
    - 9p: virtio: make sure 'offs' is initialized in zc_request
    - ksmbd: fix out of bounds in smb3_decrypt_req()
    - ksmbd: no response from compound read
    - ASoC: da7219: Flush pending AAD IRQ when suspending
    - ASoC: da7219: Check for failure reading AAD IRQ events
    - ethernet: atheros: fix return value check in atl1c_tso_csum()
    - vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
    - m68k: Fix invalid .section syntax
    - s390/dasd: use correct number of retries for ERP requests
    - s390/dasd: fix hanging device after request requeue
    - fs/nls: make load_nls() take a const parameter
    - ASoC: rt5682-sdw: fix for JD event handling in ClockStop Mode0
    - ASoc: codecs: ES8316: Fix DMIC config
    - ASoC: rt711: fix for JD event handling in ClockStop Mode0
    - ASoC: rt711-sdca: fix for JD event handling in ClockStop Mode0
    - ASoC: atmel: Fix the 8K sample parameter in I2SC master
    - platform/x86: intel: hid: Always call BTNL ACPI method
    - platform/x86/intel/hid: Add HP Dragonfly G2 to VGBS DMI quirks
    - platform/x86: huawei-wmi: Silence ambient light sensor
    - drm/amd/display: Exit idle optimizations before attempt to access PHY
    - ovl: Always reevaluate the file signature for IMA
    - ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer()
    - security: keys: perform capable check only on privileged operations
    - kprobes: Prohibit probing on CFI preamble symbol
    - clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM
    - vmbus_testing: fix wrong python syntax for integer value comparison
    - net: usb: qmi_wwan: add Quectel EM05GV2
    - wifi: brcmfmac: Fix field-spanning write in brcmf_scan_params_v2_to_v1()
    - idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
    - scsi: lpfc: Remove reftag check in DIF paths
    - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
    - net: hns3: restore user pause configure when disable autoneg
    - drm/amdgpu: Match against exact bootloader status
    - netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
    - bnx2x: fix page fault following EEH recovery
    - sctp: handle invalid error codes without calling BUG()
    - scsi: storvsc: Always set no_report_opcodes
    - scsi: lpfc: Fix incorrect big endian type assignment in bsg loopback path
    - ALSA: seq: oss: Fix racy open/close of MIDI devices
    - tracing: Introduce pipe_cpumask to avoid race on trace_pipes
    - platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE
      notifications
    - arm64: lib: Import latest version of Arm Optimized Routines' strncmp
    - of: kexec: Mark ima_{free,stable}_kexec_buffer() as __init
    - udf: Check consistency of Space Bitmap Descriptor
    - udf: Handle error when adding extent to a file
    - Revert "net: macsec: preserve ingress frame ordering"
    - reiserfs: Check the return value from __getblk()
    - eventfd: prevent underflow for eventfd semaphores
    - fs: Fix error checking for d_hash_and_lookup()
    - tmpfs: verify {g,u}id mount options correctly
    - selftests/harness: Actually report SKIP for signal tests
    - ARM: ptrace: Restore syscall restart tracing
    - ARM: ptrace: Restore syscall skipping for tracers
    - refscale: Fix uninitalized use of wait_queue_head_t
    - OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd()
    - selftests/resctrl: Make resctrl_tests run using kselftest framework
    - selftests/resctrl: Add resctrl.h into build deps
    - selftests/resctrl: Don't leak buffer in fill_cache()
    - selftests/resctrl: Unmount resctrl FS if child fails to run benchmark
    - selftests/resctrl: Close perf value read fd on errors
    - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved
    - perf/imx_ddr: don't enable counter0 if none of 4 counters are used
    - selftests/futex: Order calls to futex_lock_pi
    - s390/pkey: fix/harmonize internal keyblob headers
    - s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs
    - ACPI: x86: s2idle: Post-increment variables when getting constraints
    - ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table
    - x86/efistub: Fix PCI ROM preservation in mixed mode
    - cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
    - bpftool: Use a local bpf_perf_event_value to fix accessing its fields
    - bpf: Clear the probe_addr for uprobe
    - tcp: tcp_enter_quickack_mode() should be static
    - hwrng: nomadik - keep clock enabled while hwrng is registered
    - hwrng: pic32 - use devm_clk_get_enabled
    - regmap: rbtree: Use alloc_flags for memory allocations
    - udp: re-score reuseport groups when connected sockets are present
    - bpf: reject unhashed sockets in bpf_sk_assign
    - ipv6: Add reasons for skb drops to __udp6_lib_rcv
    - wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH
    - spi: tegra20-sflash: fix to check return value of platform_get_irq() in
      tegra_sflash_probe()
    - can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also
      in case of OOM
    - wifi: mt76: mt7915: fix power-limits while chan_switch
    - wifi: mwifiex: Fix OOB and integer underflow when rx packets
    - wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
    - crypto: stm32 - Properly handle pm_runtime_get failing
    - crypto: api - Use work queue in crypto_destroy_instance
    - Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
    - Bluetooth: Fix potential use-after-free when clear keys
    - net: tcp: fix unexcepted socket die when snd_wnd is 0
    - selftests/bpf: Clean up fmod_ret in bench_rename test script
    - net-memcg: Fix scope of sockmem pressure indicators
    - ice: ice_aq_check_events: fix off-by-one check when filling buffer
    - crypto: caam - fix unchecked return value error
    - hwrng: iproc-rng200 - Implement suspend and resume calls
    - lwt: Fix return values of BPF xmit ops
    - lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
    - fs: ocfs2: namei: check return value of ocfs2_add_entry()
    - wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
    - wifi: mwifiex: Fix missed return in oob checks failed path
    - samples/bpf: fix broken map lookup probe
    - wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
    - wifi: ath9k: protect WMI command response buffer replacement with a lock
    - wifi: nl80211/cfg80211: add forgotten nla_policy for BSS color attribute
    - wifi: mwifiex: avoid possible NULL skb pointer dereference
    - Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave()
    - wifi: ath9k: use IS_ERR() with debugfs_create_dir()
    - net: arcnet: Do not call kfree_skb() under local_irq_disable()
    - mlxsw: i2c: Fix chunk size setting in output mailbox buffer
    - mlxsw: i2c: Limit single transaction buffer size
    - hwmon: (tmp513) Fix the channel number in tmp51x_is_visible()
    - netrom: Deny concurrent connect().
    - drm/bridge: tc358764: Fix debug print parameter order
    - quota: factor out dquot_write_dquot()
    - quota: rename dquot_active() to inode_quota_active()
    - quota: add new helper dquot_active()
    - quota: fix dqput() to follow the guarantees dquot_srcu should provide
    - ASoC: stac9766: fix build errors with REGMAP_AC97
    - soc: qcom: ocmem: Add OCMEM hardware version print
    - soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros
    - arm64: dts: qcom: sm8250: correct dynamic power coefficients
    - arm64: dts: qcom: sm8250-edo: Add gpio line names for TLMM
    - arm64: dts: qcom: sm8250-edo: Add GPIO line names for PMIC GPIOs
    - arm64: dts: qcom: sm8250-edo: Rectify gpio-keys
    - arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller
    - arm64: dts: qcom: sm8350: Add missing LMH interrupts to cpufreq
    - arm64: dts: qcom: sm8350: Use proper CPU compatibles
    - arm64: dts: qcom: pmk8350: fix ADC-TM compatible string
    - arm64: dts: qcom: sm8250: Mark PCIe hosts as DMA coherent
    - drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar()
    - ARM: dts: BCM53573: Add cells sizes to PCIe node
    - ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
    - arm64: dts: qcom: sm8250-sony-xperia: correct GPIO keys wakeup again
    - arm64: dts: qcom: pmi8998: Add node for WLED
    - arm64: dts: qcom: correct SPMI WLED register range encoding
    - arm64: dts: qcom: pm660l: Add missing short interrupt
    - arm64: dts: qcom: pmi8994: Remove hardcoded linear WLED enabled-strings
    - arm64: dts: qcom: Move WLED num-strings from pmi8994 to sony-xperia-tone
    - arm64: dts: qcom: pmi8994: Add missing OVP interrupt
    - drm/etnaviv: fix dumping of active MMU context
    - x86/mm: Fix PAT bit missing from page protection modify mask
    - ARM: dts: s3c64xx: align pinctrl with dtschema
    - ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
    - ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
    - ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
    - drm: adv7511: Fix low refresh rate register for ADV7533/5
    - ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
    - arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC
    - arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk"
    - drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl'
    - md/raid10: factor out dereference_rdev_and_rrdev()
    - md/raid10: use dereference_rdev_and_rrdev() to get devices
    - md/bitmap: don't set max_write_behind if there is no write mostly device
    - md/md-bitmap: hold 'reconfig_mutex' in backlog_store()
    - drm/msm: Update dev core dump to not print backwards
    - drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
    - of: unittest: fix null pointer dereferencing in
      of_unittest_find_node_by_name()
    - arm64: dts: qcom: sm8150: Fix the I2C7 interrupt
    - drm/armada: Fix off-by-one error in armada_overlay_get_property()
    - drm/panel: simple: Add missing connector type and pixel format for AUO
      T215HVN01
    - ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig
    - [Config] updateconfigs for IMA_TRUSTED_KEYRING
    - drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask
    - drm/msm/mdp5: Don't leak some plane state
    - firmware: meson_sm: fix to avoid potential NULL pointer dereference
    - smackfs: Prevent underflow in smk_set_cipso()
    - drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create()
    - drm/msm/a2xx: Call adreno_gpu_init() earlier
    - audit: fix possible soft lockup in __audit_inode_child()
    - io_uring: fix drain stalls by invalid SQE
    - bus: ti-sysc: Fix build warning for 64-bit build
    - drm/mediatek: Remove freeing not dynamic allocated memory
    - drm/mediatek: Fix potential memory leak if vmap() fail
    - arm64: dts: qcom: apq8016-sbc: Fix ov5640 regulator supply names
    - bus: ti-sysc: Fix cast to enum warning
    - md: Set MD_BROKEN for RAID1 and RAID10
    - md: add error_handlers for raid0 and linear
    - md/raid0: Factor out helper for mapping and submitting a bio
    - md/raid0: Fix performance regression for large sequential writes
    - md: raid0: account for split bio in iostat accounting
    - of: overlay: Call of_changeset_init() early
    - of: unittest: Fix overlay type in apply/revert check
    - ALSA: ac97: Fix possible error value of *rac97
    - ipmi:ssif: Add check for kstrdup
    - ipmi:ssif: Fix a memory leak when scanning for an adapter
    - drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
    - clk: sunxi-ng: Modify mismatched function name
    - clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src
    - EDAC/igen6: Fix the issue of no error events
    - ext4: correct grp validation in ext4_mb_good_group
    - ext4: avoid potential data overflow in next_linear_group
    - clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src
    - clk: qcom: reset: Use the correct type of sleep/delay based on length
    - clk: qcom: gcc-sm6350: Fix gcc_sdcc2_apps_clk_src
    - PCI: microchip: Correct the DED and SEC interrupt bit offsets
    - PCI: Mark NVIDIA T4 GPUs to avoid bus reset
    - pinctrl: mcp23s08: check return value of devm_kasprintf()
    - PCI: pciehp: Use RMW accessors for changing LNKCTL
    - PCI/ASPM: Use RMW accessors for changing LNKCTL
    - clk: imx8mp: fix sai4 clock
    - clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op
    - powerpc/radix: Move some functions into #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
    - vfio/type1: fix cap_migration information leak
    - powerpc/fadump: reset dump area size if fadump memory reserve fails
    - powerpc/perf: Convert fsl_emb notifier to state machine callbacks
    - drm/amdgpu: Use RMW accessors for changing LNKCTL
    - drm/radeon: Use RMW accessors for changing LNKCTL
    - net/mlx5: Use RMW accessors for changing LNKCTL
    - wifi: ath11k: Use RMW accessors for changing LNKCTL
    - wifi: ath10k: Use RMW accessors for changing LNKCTL
    - PCI: dwc: Add start_link/stop_link inlines
    - PCI: layerscape: Add the endpoint linkup notifier support
    - PCI: layerscape: Add workaround for lost link capabilities during reset
    - powerpc: Don't include lppaca.h in paca.h
    - powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
    - nfs/blocklayout: Use the passed in gfp flags
    - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
    - ext4: fix unttached inode after power cut with orphan file feature enabled
    - jfs: validate max amount of blocks before allocation.
    - fs: lockd: avoid possible wrong NULL parameter
    - NFSD: da_addr_body field missing in some GETDEVICEINFO replies
    - NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN
    - NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ
    - pNFS: Fix assignment of xprtdata.cred
    - RDMA/qedr: Remove a duplicate assignment in irdma_query_ah()
    - media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables
    - media: i2c: tvp5150: check return value of devm_kasprintf()
    - media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
    - iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid
      unbind
    - iommu: rockchip: Fix directory table address encoding
    - drivers: usb: smsusb: fix error handling code in smsusb_init_device
    - media: dib7000p: Fix potential division by zero
    - media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
    - media: cx24120: Add retval check for cx24120_message_send()
    - scsi: hisi_sas: Modify v3 HW SSP underflow error processing
    - scsi: hisi_sas: Modify v3 HW SATA completion error processing
    - scsi: hisi_sas: Fix warnings detected by sparse
    - scsi: hisi_sas: Fix normally completed I/O analysed as failed
    - media: rkvdec: increase max supported height for H.264
    - media: mediatek: vcodec: Return NULL if no vdec_fb is found
    - usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
    - scsi: RDMA/srp: Fix residual handling
    - scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param()
    - scsi: iscsi: Add length check for nlattr payload
    - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
    - scsi: be2iscsi: Add length check when parsing nlattrs
    - scsi: qla4xxx: Add length check when parsing nlattrs
    - serial: sprd: Assign sprd_port after initialized to avoid wrong access
    - serial: sprd: Fix DMA buffer leak issue
    - x86/APM: drop the duplicate APM_MINOR_DEV macro
    - scsi: qedf: Do not touch __user pointer in
      qedf_dbg_stop_io_on_error_cmd_read() directly
    - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read()
      directly
    - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read()
      directly
    - RDMA/irdma: Replace one-element array with flexible-array member
    - coresight: tmc: Explicit type conversions to prevent integer overflow
    - dma-buf/sync_file: Fix docs syntax
    - driver core: test_async: fix an error code
    - iommu/sprd: Add missing force_aperture
    - RDMA/hns: Fix port active speed
    - RDMA/hns: Fix incorrect post-send with direct wqe of wr-list
    - RDMA/hns: Fix CQ and QP cache affinity
    - IB/uverbs: Fix an potential error pointer dereference
    - fsi: aspeed: Reset master errors after CFAM reset
    - iommu/qcom: Disable and reset context bank before programming
    - iommu/vt-d: Fix to flush cache of PASID directory table
    - platform/x86: dell-sysman: Fix reference leak
    - media: go7007: Remove redundant if statement
    - media: venus: hfi_venus: Only consider sys_idle_indicator on V1
    - USB: gadget: f_mass_storage: Fix unused variable warning
    - media: ov5640: Enable MIPI interface in ov5640_set_power_mipi()
    - media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
    - media: ov2680: Remove auto-gain and auto-exposure controls
    - media: ov2680: Fix ov2680_bayer_order()
    - media: ov2680: Fix vflip / hflip set functions
    - media: ov2680: Remove VIDEO_V4L2_SUBDEV_API ifdef-s
    - media: ov2680: Don't take the lock for try_fmt calls
    - media: ov2680: Add ov2680_fill_format() helper function
    - media: ov2680: Fix ov2680_set_fmt() which == V4L2_SUBDEV_FORMAT_TRY not
      working
    - media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors
    - media: i2c: rdacm21: Fix uninitialized value
    - cgroup:namespace: Remove unused cgroup_namespaces_init()
    - scsi: core: Use 32-bit hostnum in scsi_host_lookup()
    - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
    - serial: tegra: handle clk prepare error in tegra_uart_hw_init()
    - amba: bus: fix refcount leak
    - Revert "IB/isert: Fix incorrect release of isert connection"
    - HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()
    - HID: multitouch: Correct devm device reference for hidinput input_dev name
    - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS
    - tracing: Remove extra space at the end of hwlat_detector/mode
    - tracing: Fix race issue between cpu buffer write and swap
    - mtd: rawnand: brcmnand: Fix mtd oobsize
    - phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328
    - phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate
    - phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write
    - rpmsg: glink: Add check for kstrdup
    - leds: pwm: Fix error code in led_pwm_create_fwnode()
    - leds: multicolor: Use rounded division when calculating color components
    - leds: trigger: tty: Do not use LED_ON/OFF constants, use
      led_blink_set_oneshot instead
    - mtd: spi-nor: Check bus width while setting QE bit
    - mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume()
    - um: Fix hostaudio build errors
    - dmaengine: ste_dma40: Add missing IRQ check in d40_probe
    - cpufreq: Fix the race condition while updating the transition_task of policy
    - virtio_ring: fix avail_wrap_counter in virtqueue_add_packed
    - skbuff: skb_segment, Call zero copy functions before using skbuff frags
    - PM / devfreq: Fix leak in devfreq_dev_release()
    - ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
    - rcu: dump vmalloc memory info safely
    - printk: ringbuffer: Fix truncating buffer size min_t cast
    - scsi: core: Fix the scsi_set_resid() documentation
    - mm/vmalloc: add a safer version of find_vm_area() for debug
    - media: i2c: ccs: Check rules is non-NULL
    - PCI: rockchip: Use 64-bit mask on MSI 64-bit PCI address
    - ipmi_si: fix a memleak in try_smi_init()
    - ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
    - backlight/gpio_backlight: Compare against struct fb_info.device
    - backlight/bd6107: Compare against struct fb_info.device
    - backlight/lv5207lp: Compare against struct fb_info.device
    - xtensa: PMU: fix base address for the newer hardware
    - i3c: master: svc: fix probe failure when no i3c device exist
    - arm64: csum: Fix OoB access in IP checksum code for negative lengths
    - media: dvb: symbol fixup for dvb_attach()
    - media: venus: hfi_venus: Write to VIDC_CTRL_INIT after unmasking interrupts
    - Revert "scsi: qla2xxx: Fix buffer overrun"
    - scsi: mpt3sas: Perform additional retries if doorbell read returns 0
    - ntb: Drop packets when qp link is down
    - ntb: Clean up tx tail index on link down
    - ntb: Fix calculation ntb_transport_tx_free_entry()
    - Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
    - procfs: block chmod on /proc/thread-self/comm
    - parisc: Fix /proc/cpuinfo output for lscpu
    - dlm: fix plock lookup when using multiple lockspaces
    - dccp: Fix out of bounds access in DCCP error handler
    - X.509: if signature is unsupported skip validation
    - net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
    - fsverity: skip PKCS#7 parser when keyring is empty
    - mmc: renesas_sdhi: register irqs before registering controller
    - pstore/ram: Check start of empty przs during init
    - arm64: sdei: abort running SDEI handlers during crash
    - s390/ipl: add missing secure/has_secure file to ipl type 'unknown'
    - crypto: stm32 - fix loop iterating through scatterlist for DMA
    - cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
    - usb: typec: tcpm: set initial svdm version based on pd revision
    - usb: typec: bus: verify partner exists in typec_altmode_attention
    - x86/sgx: Break up long non-preemptible delays in sgx_vepc_release()
    - perf/x86/uncore: Correct the number of CHAs on EMR
    - tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY
    - md/md-bitmap: remove unnecessary local variable in backlog_store()
    - udf: initialize newblock to 0
    - net/ipv6: SKB symmetric hash should incorporate transport ports
    - io_uring: always lock in io_apoll_task_func
    - io_uring: break out of iowq iopoll on teardown
    - io_uring: break iopolling on signal
    - scsi: qla2xxx: Adjust IOCB resource on qpair create
    - scsi: qla2xxx: Limit TMF to 8 per function
    - scsi: qla2xxx: Fix deletion race condition
    - scsi: qla2xxx: fix inconsistent TMF timeout
    - scsi: qla2xxx: Fix command flush during TMF
    - scsi: qla2xxx: Fix erroneous link up failure
    - scsi: qla2xxx: Turn off noisy message log
    - scsi: qla2xxx: Fix session hang in gnl
    - scsi: qla2xxx: Fix TMF leak through
    - scsi: qla2xxx: Remove unsupported ql2xenabledif option
    - scsi: qla2xxx: Flush mailbox commands on chip reset
    - scsi: qla2xxx: Fix smatch warn for qla_init_iocb_limit()
    - scsi: qla2xxx: Error code did not return to upper layer
    - scsi: qla2xxx: Fix firmware resource tracking
    - fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
    - clk: qcom: camcc-sc7180: fix async resume during probe
    - drm/ast: Fix DRAM init on AST2200
    - clk: qcom: turingcc-qcs404: fix missing resume during probe
    - lib/test_meminit: allocate pages up to order MAX_ORDER
    - parisc: led: Fix LAN receive and transmit LEDs
    - parisc: led: Reduce CPU overhead for disk & lan LED computation
    - pinctrl: cherryview: fix address_space_handler() argument
    - dt-bindings: clock: xlnx,versal-clk: drop select:false
    - clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
    - soc: qcom: qmi_encdec: Restrict string length in decode
    - clk: qcom: q6sstop-qcs404: fix missing resume during probe
    - clk: qcom: mss-sc7180: fix missing resume during probe
    - NFS: Fix a potential data corruption
    - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
    - bus: mhi: host: Skip MHI reset if device is in RDDM
    - kbuild: do not run depmod for 'make modules_sign'
    - gfs2: Switch to wait_event in gfs2_logd
    - gfs2: low-memory forced flush fixes
    - kconfig: fix possible buffer overflow
    - perf trace: Use zfree() to reduce chances of use after free
    - perf trace: Really free the evsel->priv area
    - pwm: atmel-tcb: Convert to platform remove callback returning void
    - pwm: atmel-tcb: Harmonize resource allocation order
    - pwm: atmel-tcb: Fix resource freeing in error path and remove
    - backlight: gpio_backlight: Drop output GPIO direction check for initial
      power state
    - Input: tca6416-keypad - always expect proper IRQ number in i2c client
    - Input: tca6416-keypad - fix interrupt enable disbalance
    - perf annotate bpf: Don't enclose non-debug code with an assert()
    - x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm()
    - perf vendor events: Update the JSON/events descriptions for power10 platform
    - perf vendor events: Drop some of the JSON/events for power10 platform
    - perf top: Don't pass an ERR_PTR() directly to perf_session__delete()
    - watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
    - pwm: lpc32xx: Remove handling of PWM channels
    - net/sched: fq_pie: avoid stalls in fq_pie_timer()
    - sctp: annotate data-races around sk->sk_wmem_queued
    - ipv4: annotate data-races around fi->fib_dead
    - net: read sk->sk_family once in sk_mc_loop()
    - net: fib: avoid warn splat in flow dissector
    - xsk: Fix xsk_diag use-after-free error during socket cleanup
    - drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt()
    - ipv4: ignore dst hint for multipath routes
    - igb: disable virtualization features on 82580
    - veth: Fixing transmit return status for dropped packets
    - net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
    - net: phy: micrel: Correct bit assignments for phy_device flags
    - af_unix: Fix data-races around user->unix_inflight.
    - af_unix: Fix data-race around unix_tot_inflight.
    - af_unix: Fix data-races around sk->sk_shutdown.
    - af_unix: Fix data race around sk->sk_err.
    - kcm: Destroy mutex in kcm_exit_net()
    - octeontx2-af: Fix truncation of smq in CN10K NIX AQ enqueue mbox handler
    - igc: Change IGC_MIN to allow set rx/tx value between 64 and 80
    - igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
    - igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
    - s390/zcrypt: don't leak memory if dev_set_name() fails
    - idr: fix param name in idr_alloc_cyclic() doc
    - ip_tunnels: use DEV_STATS_INC()
    - net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and
      offload
    - net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times
    - net: dsa: sja1105: complete tc-cbs offload support on SJA1110
    - net: hns3: fix byte order conversion issue in hclge_dbg_fd_tcam_read()
    - net: hns3: fix debugfs concurrency issue between kfree buffer and read
    - net: hns3: fix invalid mutex between tc qdisc and dcb ets command issue
    - net: hns3: fix the port information display when sfp is absent
    - net: hns3: remove GSO partial feature bit
    - sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()
    - net/mlx5: Free IRQ rmap and notifier on kernel shutdown
    - ARC: atomics: Add compiler barrier to atomic operations...
    - dmaengine: sh: rz-dmac: Fix destination and source data size setting
    - jbd2: fix checkpoint cleanup performance regression
    - jbd2: check 'jh->b_transaction' before removing it from checkpoint
    - ext4: add correct group descriptors and reserved GDT blocks to system zone
    - lib: test_scanf: Add explicit type cast to result initialization in
      test_number_prefix()
    - ata: pata_falcon: fix IO base selection for Q40
    - ata: sata_gemini: Add missing MODULE_DESCRIPTION
    - ata: pata_ftide010: Add missing MODULE_DESCRIPTION
    - fuse: nlookup missing decrement in fuse_direntplus_link
    - btrfs: free qgroup rsv on io failure
    - btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART
    - btrfs: use the correct superblock to compare fsid in btrfs_validate_super
    - mtd: rawnand: brcmnand: Fix crash during the panic_write
    - mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
    - mtd: rawnand: brcmnand: Fix potential false time out warning
    - drm/amd/display: prevent potential division by zero errors
    - MIPS: Fix CONFIG_CPU_DADDI_WORKAROUNDS `modules_install' regression
    - perf hists browser: Fix hierarchy mode header
    - perf tools: Handle old data in PERF_RECORD_ATTR
    - perf hists browser: Fix the number of entries for 'e' key
    - pcd: move the identify buffer into pcd_identify
    - pcd: cleanup initialization
    - block: move GENHD_FL_NATIVE_CAPACITY to disk->state
    - block: move GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE to disk->event_flags
    - block: rename GENHD_FL_NO_PART_SCAN to GENHD_FL_NO_PART
    - block: don't add or resize partition on the disk with GENHD_FL_NO_PART
    - ARM: dts: samsung: exynos4210-i9100: Fix LCD screen's physical size
    - ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2
    - net: ipv4: fix one memleak in __inet_del_ifa()
    - kselftest/runner.sh: Propagate SIGTERM to runner child
    - net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in
      smcr_port_add
    - net: ethernet: mvpp2_main: fix possible OOB write in
      mvpp2_ethtool_get_rxnfc()
    - net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in
      mtk_hwlro_get_fdir_all()
    - hsr: Fix uninit-value access in fill_frame_info()
    - net: dsa: sja1105: hide all multicast addresses from "bridge fdb show"
    - r8152: check budget for r8152_poll()
    - kcm: Fix memory leak in error path of kcm_sendmsg()
    - platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors
    - platform/mellanox: mlxbf-tmfifo: Drop jumbo frames
    - platform/mellanox: mlxbf-pmc: Fix potential buffer overflows
    - platform/mellanox: mlxbf-pmc: Fix reading of unprogrammed events
    - ipv6: fix ip6_sock_set_addr_preferences() typo
    - ixgbe: fix timestamp configuration code
    - kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
    - MIPS: Only fiddle with CHECKFLAGS if `need-compiler'
    - drm/amd/display: Fix a bug when searching for insert_above_mpcc
    - pcd: fix error codes in pcd_init_unit()
    - Linux 5.15.132
  * CVE-2023-6176
    - net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
  * CVE-2023-6039
    - timers: Use del_timer_sync() even on UP
    - timers: Update kernel-doc for various functions
    - timers: Rename del_timer_sync() to timer_delete_sync()
    - timers: Rename del_timer() to timer_delete()
    - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode
    - timers: Add shutdown mechanism to the internal functions
    - timers: Provide timer_shutdown[_sync]()
    - clocksource/drivers/arm_arch_timer: Do not use timer namespace for
      timer_shutdown() function
    - clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown()
      function
    - ARM: spear: Do not use timer namespace for timer_shutdown() function
    - net: usb: lan78xx: reorder cleanup operations to avoid UAF bugs

 -- John Cabaj <john.cabaj@canonical.com>  Tue, 16 Jan 2024 15:45:13 -0600

linux-ibm-5.15 (5.15.0-1045.48~20.04.1) focal; urgency=medium

  * focal/linux-ibm-5.15: 5.15.0-1045.48~20.04.1 -proposed tracker
    (LP: #2048586)

  [ Ubuntu: 5.15.0-1045.48 ]

  * jammy/linux-ibm: 5.15.0-1045.48 -proposed tracker (LP: #2048587)
  * Packaging resync (LP: #1786013)
    - [Packaging] resync update-dkms-versions helper
    - [Packaging] remove helper scripts
  * jammy/linux: 5.15.0-92.102 -proposed tracker (LP: #2048614)
  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
  * CVE-2024-0193
    - netfilter: nf_tables: skip set commit for deleted/destroyed sets
  * CVE-2023-6040
    - netfilter: nf_tables: Reject tables of unsupported family
  * CVE-2023-6606
    - smb: client: fix OOB in smbCalcSize()
  * CVE-2023-6817
    - netfilter: nft_set_pipapo: skip inactive elements during set walk
  * CVE-2023-6932
    - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
  * CVE-2023-6931
    - perf/core: Add a new read format to get a number of lost samples
    - perf: Fix perf_event_validate_size()
    - perf: Fix perf_event_validate_size() lockdep splat

 -- John Cabaj <john.cabaj@canonical.com>  Fri, 12 Jan 2024 16:44:34 -0600

linux-ibm-5.15 (5.15.0-1044.47~20.04.1) focal; urgency=medium

  * focal/linux-ibm-5.15: 5.15.0-1044.47~20.04.1 -proposed tracker
    (LP: #2041575)

  [ Ubuntu: 5.15.0-1044.47 ]

  * jammy/linux-ibm: 5.15.0-1044.47 -proposed tracker (LP: #2041576)
  * jammy/linux: 5.15.0-91.101 -proposed tracker (LP: #2043452)
  * USB bus error after upgrading to proposed kernel on lunar and jammy
    (LP: #2043197)
    - USB: core: Fix oversight in SuperSpeed initialization
  * jammy/linux: 5.15.0-90.100 -proposed tracker (LP: #2041603)
  * CVE-2023-25775
    - RDMA/irdma: Remove irdma_uk_mw_bind()
    - RDMA/irdma: Remove irdma_sc_send_lsmm_nostag()
    - RDMA/irdma: Remove irdma_cqp_up_map_cmd()
    - RDMA/irdma: Remove irdma_get_hw_addr()
    - RDMA/irdma: Make irdma_uk_cq_init() return a void
    - RDMA/irdma: optimize rx path by removing unnecessary copy
    - RDMA/irdma: Remove enum irdma_status_code
    - RDMA/irdma: Remove excess error variables
    - RDMA/irdma: Prevent zero-length STAG registration
  * CVE-2023-39189
    - netfilter: nfnetlink_osf: avoid OOB read
  * SMC stats: Wrong bucket calculation for payload of exactly 4096 bytes
    (LP: #2039575)
    - net/smc: Fix pos miscalculation in statistics
  * CVE-2023-45871
    - igb: set max size RX buffer when store bad packet is enabled
  * CVE-2023-39193
    - netfilter: xt_sctp: validate the flag_info count
  * CVE-2023-39192
    - netfilter: xt_u32: validate user space input
  * CVE-2023-31085
    - ubi: Refuse attaching if mtd's erasesize is 0
  * CVE-2023-5717
    - perf: Disallow mis-matched inherited group reads
  * CVE-2023-5178
    - nvmet-tcp: Fix a possible UAF in queue intialization setup
  * CVE-2023-5158
    - vringh: don't use vringh_kiov_advance() in vringh_iov_xfer()
  * [SRU][J/L/M] UBUNTU: [Packaging] Make WWAN driver a loadable module
    (LP: #2033406)
    - [Packaging] Make WWAN driver loadable modules
  * HP ProBook 450 G8 Notebook fail to wifi test (LP: #2037513)
    - iwlwifi: mvm: Don't fail if PPAG isn't supported
    - wifi: iwlwifi: fw: skip PPAG for JF
  * usbip: error: failed to open /usr/share/hwdata//usb.ids (LP: #2039439)
    - [Packaging] Make linux-tools-common depend on hwdata
  * scripts/pahole-flags.sh change return to exit 0 (LP: #2035123)
    - SAUCE: scripts/pahole-flags.sh change return to exit 0
  * Unable to use nvme drive to install Ubuntu 23.10 (LP: #2040157)
    - misc: rtsx: Fix some platforms can not boot and move the l1ss judgment to
      probe
  * Jammy update: v5.15.131 upstream stable release (LP: #2039610)
    - erofs: ensure that the post-EOF tails are all zeroed
    - ksmbd: fix wrong DataOffset validation of create context
    - ksmbd: replace one-element array with flex-array member in struct
      smb2_ea_info
    - ARM: pxa: remove use of symbol_get()
    - mmc: au1xmmc: force non-modular build and remove symbol_get usage
    - net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
    - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
    - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
    - USB: serial: option: add Quectel EM05G variant (0x030e)
    - USB: serial: option: add FOXCONN T99W368/T99W373 product
    - ALSA: usb-audio: Fix init call orders for UAC1
    - usb: dwc3: meson-g12a: do post init to fix broken usb after resumption
    - usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0
    - HID: wacom: remove the battery when the EKR is off
    - staging: rtl8712: fix race condition
    - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race
      condition
    - wifi: mt76: mt7921: do not support one stream on secondary antenna only
    - serial: qcom-geni: fix opp vote on shutdown
    - serial: sc16is7xx: fix broken port 0 uart init
    - serial: sc16is7xx: fix bug when first setting GPIO direction
    - firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
    - fsi: master-ast-cf: Add MODULE_FIRMWARE macro
    - tcpm: Avoid soft reset when partner does not support get_status
    - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
    - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
    - pinctrl: amd: Don't show `Invalid config param` errors
    - usb: typec: tcpci: move tcpci.h to include/linux/usb/
    - usb: typec: tcpci: clear the fault status bit
    - Linux 5.15.131
  * Jammy update: v5.15.130 upstream stable release (LP: #2039608)
    - ACPI: thermal: Drop nocrt parameter
    - module: Expose module_init_layout_section()
    - arm64: module-plts: inline linux/moduleloader.h
    - arm64: module: Use module_init_layout_section() to spot init sections
    - ARM: module: Use module_init_layout_section() to spot init sections
    - rcu: Prevent expedited GP from enabling tick on offline CPU
    - rcu-tasks: Fix IPI failure handling in trc_wait_for_one_reader
    - rcu-tasks: Wait for trc_read_check_handler() IPIs
    - rcu-tasks: Add trc_inspect_reader() checks for exiting critical section
    - Linux 5.15.130
  * CVE-2023-42754
    - ipv4: fix null-deref in ipv4_link_failure
  * Jammy update: v5.15.129 upstream stable release (LP: #2039227)
    - NFSv4.2: fix error handling in nfs42_proc_getxattr
    - NFSv4: fix out path in __nfs4_get_acl_uncached
    - xprtrdma: Remap Receive buffers after a reconnect
    - PCI: acpiphp: Reassign resources on bridge if necessary
    - dlm: improve plock logging if interrupted
    - dlm: replace usage of found with dedicated list iterator variable
    - fs: dlm: add pid to debug log
    - fs: dlm: change plock interrupted message to debug again
    - fs: dlm: use dlm_plock_info for do_unlock_close
    - fs: dlm: fix mismatch of plock results from userspace
    - MIPS: cpu-features: Enable octeon_cache by cpu_type
    - MIPS: cpu-features: Use boot_cpu_type for CPU type based features
    - fbdev: Improve performance of sys_imageblit()
    - fbdev: Fix sys_imageblit() for arbitrary image widths
    - fbdev: fix potential OOB read in fast_imageblit()
    - ALSA: pcm: Fix potential data race at PCM memory allocation helpers
    - jbd2: remove t_checkpoint_io_list
    - jbd2: remove journal_clean_one_cp_list()
    - jbd2: fix a race when checking checkpoint buffer busy
    - can: raw: fix receiver memory leak
    - drm/amd/display: do not wait for mpc idle if tg is disabled
    - drm/amd/display: check TG is non-null before checking if enabled
    - can: raw: fix lockdep issue in raw_release()
    - tracing: Fix cpu buffers unavailable due to 'record_disabled' missed
    - tracing: Fix memleak due to race between current_tracer and trace
    - octeontx2-af: SDP: fix receive link config
    - sock: annotate data-races around prot->memory_pressure
    - dccp: annotate data-races in dccp_poll()
    - ipvlan: Fix a reference count leak warning in ipvlan_ns_exit()
    - net: bgmac: Fix return value check for fixed_phy_register()
    - net: bcmgenet: Fix return value check for fixed_phy_register()
    - net: validate veth and vxcan peer ifindexes
    - ice: fix receive buffer size miscalculation
    - igb: Avoid starting unnecessary workqueues
    - igc: Fix the typo in the PTM Control macro
    - net/sched: fix a qdisc modification with ambiguous command request
    - netfilter: nf_tables: flush pending destroy work before netlink notifier
    - netfilter: nf_tables: fix out of memory error handling
    - rtnetlink: return ENODEV when ifname does not exist and group is given
    - rtnetlink: Reject negative ifindexes in RTM_NEWLINK
    - net: remove bond_slave_has_mac_rcu()
    - bonding: fix macvlan over alb bond support
    - net/ncsi: make one oem_gma function for all mfr id
    - net/ncsi: change from ndo_set_mac_address to dev_set_mac_address
    - ibmveth: Use dcbf rather than dcbfl
    - NFSv4: Fix dropped lock for racing OPEN and delegation return
    - clk: Fix slab-out-of-bounds error in devm_clk_release()
    - ALSA: ymfpci: Fix the missing snd_card_free() call at probe error
    - mm: add a call to flush_cache_vmap() in vmap_pfn()
    - NFS: Fix a use after free in nfs_direct_join_group()
    - nfsd: Fix race to FREE_STATEID and cl_revoked
    - selinux: set next pointer before attaching to list
    - batman-adv: Trigger events for auto adjusted MTU
    - batman-adv: Don't increase MTU when set by user
    - batman-adv: Do not get eth header before batadv_check_management_packet
    - batman-adv: Fix TT global entry leak when client roamed back
    - batman-adv: Fix batadv_v_ogm_aggr_send memory leak
    - batman-adv: Hold rtnl lock during MTU update via netlink
    - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
    - radix tree: remove unused variable
    - of: unittest: Fix EXPECT for parse_phandle_with_args_map() test
    - of: dynamic: Refactor action prints to not use "%pOF" inside devtree_lock
    - media: vcodec: Fix potential array out-of-bounds in encoder queue_setup
    - PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root
      bus
    - drm/vmwgfx: Fix shader stage validation
    - drm/display/dp: Fix the DP DSC Receiver cap size
    - x86/fpu: Invalidate FPU state correctly on exec()
    - nfs: use vfs setgid helper
    - nfsd: use vfs setgid helper
    - torture: Fix hang during kthread shutdown phase
    - cgroup/cpuset: Rename functions dealing with DEADLINE accounting
    - sched/cpuset: Bring back cpuset_mutex
    - sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets
    - cgroup/cpuset: Iterate only if DEADLINE tasks are present
    - sched/deadline: Create DL BW alloc, free & check overflow interface
    - cgroup/cpuset: Free DL BW in case can_attach() fails
    - drm/i915: Fix premature release of request's reusable memory
    - can: raw: add missing refcount for memory leak fix
    - scsi: snic: Fix double free in snic_tgt_create()
    - scsi: core: raid_class: Remove raid_component_add()
    - clk: Fix undefined reference to `clk_rate_exclusive_{get,put}'
    - pinctrl: renesas: rza2: Add lock around
      pinctrl_generic{{add,remove}_group,{add,remove}_function}
    - dma-buf/sw_sync: Avoid recursive lock during fence signal
    - mm: memory-failure: kill soft_offline_free_page()
    - mm: memory-failure: fix unexpected return value in soft_offline_page()
    - mm,ima,kexec,of: use memblock_free_late from ima_free_kexec_buffer
    - Linux 5.15.129
  * Jammy update: v5.15.128 upstream stable release (LP: #2038486)
    - mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
    - selftests: forwarding: tc_actions: cleanup temporary files when test is
      aborted
    - selftests: forwarding: tc_actions: Use ncat instead of nc
    - macsec: Fix traffic counters/statistics
    - macsec: use DEV_STATS_INC()
    - net/tls: Perform immediate device ctx cleanup when possible
    - net/tls: Multi-threaded calls to TX tls_dev_del
    - net: tls: avoid discarding data on record close
    - PCI: tegra194: Fix possible array out of bounds access
    - ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
    - iopoll: Call cpu_relax() in busy loops
    - ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion
    - dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
    - HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL
      Keyboard
    - HID: add quirk for 03f0:464a HP Elite Presenter Mouse
    - RDMA/mlx5: Return the firmware result upon destroying QP/RQ
    - ovl: check type and offset of struct vfsmount in ovl_entry
    - smb: client: fix warning in cifs_smb3_do_mount()
    - media: v4l2-mem2mem: add lock to protect parameter num_rdy
    - usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
    - media: platform: mediatek: vpu: fix NULL ptr dereference
    - thunderbolt: Read retimer NVM authentication status prior
      tb_retimer_set_inbound_sbtx()
    - usb: chipidea: imx: don't request QoS for imx8ulp
    - usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
    - gfs2: Fix possible data races in gfs2_show_options()
    - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
    - firewire: net: fix use after free in fwnet_finish_incoming_packet()
    - watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)
    - Bluetooth: L2CAP: Fix use-after-free
    - Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
    - drm/amdgpu: Fix potential fence use-after-free v2
    - fs/ntfs3: Enhance sanity check while generating attr_list
    - fs: ntfs3: Fix possible null-pointer dereferences in mi_read()
    - fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted
    - ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
    - ALSA: hda: fix a possible null-pointer dereference due to data race in
      snd_hdac_regmap_sync()
    - powerpc/kasan: Disable KCOV in KASAN code
    - ring-buffer: Do not swap cpu_buffer during resize process
    - iio: add addac subdirectory
    - iio: adc: stx104: Utilize iomap interface
    - iio: adc: stx104: Implement and utilize register structures
    - iio: stx104: Move to addac subdirectory
    - iio: addac: stx104: Fix race condition for stx104_write_raw()
    - iio: addac: stx104: Fix race condition when converting analog-to-digital
    - igc: read before write to SRRCTL register
    - ARM: dts: aspeed: asrock: Correct firmware flash SPI clocks
    - drm/amd/display: save restore hdcp state when display is unplugged from mst
      hub
    - drm/amd/display: phase3 mst hdcp for multiple displays
    - drm/amd/display: fix access hdcp_workqueue assert
    - usb: dwc3: gadget: Synchronize IRQ between soft connect/disconnect
    - usb: dwc3: Remove DWC3 locking during gadget suspend/resume
    - usb: dwc3: Fix typos in gadget.c
    - USB: dwc3: gadget: drop dead hibernation code
    - usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume()
    - tty: serial: fsl_lpuart: Add i.MXRT1050 support
    - tty: serial: fsl_lpuart: make rx_watermark configurable for different
      platforms
    - tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A
    - USB: dwc3: qcom: fix NULL-deref on suspend
    - USB: dwc3: fix use-after-free on core driver unbind
    - mmc: bcm2835: fix deferred probing
    - mmc: sunxi: fix deferred probing
    - ARM: dts: imx6sll: fixup of operating points
    - ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
    - btrfs: move out now unused BG from the reclaim list
    - virtio-mmio: don't break lifecycle of vm_dev
    - vduse: Use proper spinlock for IRQ injection
    - cifs: fix potential oops in cifs_oplock_break
    - i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
    - i2c: hisi: Only handle the interrupt of the driver's transfer
    - fbdev: mmp: fix value check in mmphw_probe()
    - powerpc/rtas_flash: allow user copy to flash block cache objects
    - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
    - tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32
      platforms
    - btrfs: fix BUG_ON condition in btrfs_cancel_balance
    - i2c: designware: Correct length byte validation logic
    - i2c: designware: Handle invalid SMBus block data response length value
    - net: xfrm: Fix xfrm_address_filter OOB read
    - net: af_key: fix sadb_x_filter validation
    - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
    - xfrm: fix slab-use-after-free in decode_session6
    - ip6_vti: fix slab-use-after-free in decode_session6
    - ip_vti: fix potential slab-use-after-free in decode_session6
    - xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
    - net: phy: fix IRQ-based wake-on-lan over hibernate / power off
    - selftests: mirror_gre_changes: Tighten up the TTL test match
    - drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
    - netfilter: nf_tables: fix false-positive lockdep splat
    - ipvs: fix racy memcpy in proc_do_sync_threshold
    - net: phy: broadcom: stub c45 read/write for 54810
    - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
    - iavf: fix FDIR rule fields masks validation
    - i40e: fix misleading debug logs
    - net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
    - sock: Fix misuse of sk_under_memory_pressure()
    - net: do not allow gso_size to be set to GSO_BY_FRAGS
    - bus: ti-sysc: Flush posted write on enable before reset
    - arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict
    - ARM: dts: imx: Set default tuning step for imx6sx usdhc
    - ASoC: rt5665: add missed regulator_bulk_disable
    - ASoC: meson: axg-tdm-formatter: fix channel slot allocation
    - soc: aspeed: socinfo: Add kfree for kstrdup
    - ALSA: hda/realtek - Remodified 3k pull low procedure
    - riscv: uaccess: Return the number of bytes effectively not copied
    - serial: 8250: Fix oops for port->pm on uart_change_pm()
    - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback
      interfaces.
    - cifs: Release folio lock on fscache read hit.
    - mmc: wbsd: fix double mmc_free_host() in wbsd_init()
    - mmc: block: Fix in_flight[issue_type] value error
    - drm/qxl: fix UAF on handle creation
    - drm/amd: flush any delayed gfxoff on suspend entry
    - netfilter: set default timeout to 3 secs for sctp shutdown send and recv
      state
    - arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
    - virtio-net: set queues after driver_ok
    - net: fix the RTO timer retransmitting skb every 1ms if linear option is
      enabled
    - mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
    - Linux 5.15.128
  * Jammy update: v5.15.127 upstream stable release (LP: #2038382)
    - ksmbd: validate command request size
    - ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
    - wireguard: allowedips: expand maximum node depth
    - mmc: moxart: read scr register without changing byte order
    - ipv6: adjust ndisc_is_useropt() to also return true for PIO
    - dmaengine: pl330: Return DMA_PAUSED when transaction is paused
    - riscv,mmio: Fix readX()-to-delay() ordering
    - drm/nouveau/gr: enable memory loads on helper invocation on all channels
    - drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
    - drm/amd/display: check attr flag before set cursor degamma on DCN3+
    - hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100
    - radix tree test suite: fix incorrect allocation size for pthreads
    - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
    - bpf: allow precision tracking for programs with subprogs
    - bpf: stop setting precise in current state
    - bpf: aggressively forget precise markings during state checkpointing
    - selftests/bpf: make test_align selftest more robust
    - selftests/bpf: Workaround verification failure for
      fexit_bpf2bpf/func_replace_return_code
    - selftests/bpf: Fix sk_assign on s390x
    - io_uring: correct check for O_TMPFILE
    - iio: cros_ec: Fix the allocation size for cros_ec_command
    - iio: adc: ina2xx: avoid NULL pointer dereference on OF device match
    - binder: fix memory leak in binder_init()
    - misc: rtsx: judge ASPM Mode to set PETXCFG Reg
    - usb-storage: alauda: Fix uninit-value in alauda_check_media()
    - usb: dwc3: Properly handle processing of pending events
    - usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
    - usb: typec: tcpm: Fix response to vsafe0V event
    - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
    - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
    - x86/speculation: Add cpu_show_gds() prototype
    - x86: Move gds_ucode_mitigated() declaration to header
    - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
    - selftests/rseq: Fix build with undefined __weak
    - selftests: forwarding: Add a helper to skip test when using veth pairs
    - selftests: forwarding: ethtool: Skip when using veth pairs
    - selftests: forwarding: ethtool_extended_state: Skip when using veth pairs
    - selftests: forwarding: Skip test when no interfaces are specified
    - selftests: forwarding: Switch off timeout
    - selftests: forwarding: tc_flower: Relax success criterion
    - net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail()
    - bpf, sockmap: Fix map type error in sock_map_del_link
    - bpf, sockmap: Fix bug that strp_done cannot be called
    - mISDN: Update parameter type of dsp_cmx_send()
    - net/packet: annotate data-races around tp->status
    - tunnels: fix kasan splat when generating ipv4 pmtu error
    - xsk: fix refcount underflow in error path
    - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
    - dccp: fix data-race around dp->dccps_mss_cache
    - drivers: net: prevent tun_build_skb() to exceed the packet size limit
    - iavf: fix potential races for FDIR filters
    - IB/hfi1: Fix possible panic during hotplug remove
    - drm/rockchip: Don't spam logs in atomic check
    - wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
    - RDMA/umem: Set iova in ODP flow
    - net: phy: at803x: remove set/get wol callbacks for AR8032
    - net: hns3: refactor hclge_mac_link_status_wait for interface reuse
    - net: hns3: add wait until mac link down
    - nexthop: Fix infinite nexthop dump when using maximum nexthop ID
    - nexthop: Make nexthop bucket dump more efficient
    - nexthop: Fix infinite nexthop bucket dump when using maximum nexthop ID
    - dmaengine: mcf-edma: Fix a potential un-allocated memory access
    - net/mlx5: Allow 0 for total host VFs
    - net/mlx5: Skip clock update work when device is in error state
    - ibmvnic: Enforce stronger sanity checks on login response
    - ibmvnic: Unmap DMA login rsp buffer on send login fail
    - ibmvnic: Handle DMA unmapping of login buffs in release functions
    - btrfs: don't stop integrity writeback too early
    - btrfs: exit gracefully if reloc roots don't match
    - btrfs: reject invalid reloc tree root keys with stack dump
    - btrfs: set cache_block_group_error if we find an error
    - nvme-tcp: fix potential unbalanced freeze & unfreeze
    - nvme-rdma: fix potential unbalanced freeze & unfreeze
    - netfilter: nf_tables: report use refcount overflow
    - scsi: core: Fix legacy /proc parsing buffer overflow
    - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
    - scsi: 53c700: Check that command slot is not NULL
    - scsi: snic: Fix possible memory leak if device_add() fails
    - scsi: core: Fix possible memory leak if device_add() fails
    - scsi: fnic: Replace return codes in fnic_clean_pending_aborts()
    - scsi: qedi: Fix firmware halt over suspend and resume
    - scsi: qedf: Fix firmware halt over suspend and resume
    - alpha: remove __init annotation from exported page_is_ram()
    - sch_netem: fix issues in netem_change() vs get_dist_table()
    - tick: Detect and fix jiffies update stall
    - timers/nohz: Switch to ONESHOT_STOPPED in the low-res handler when the tick
      is stopped
    - timers/nohz: Last resort update jiffies on nohz_full IRQ entry
    - Linux 5.15.127
    - Upstream stable to v5.15.127
  * CVE-2023-37453
    - USB: core: Unite old scheme and new scheme descriptor reads
    - USB: core: Change usb_get_device_descriptor() API
    - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

 -- John Cabaj <john.cabaj@canonical.com>  Wed, 15 Nov 2023 13:17:07 -0600

linux-ibm-5.15 (5.15.0-1043.46~20.04.1) focal; urgency=medium

  * focal/linux-ibm-5.15: 5.15.0-1043.46~20.04.1 -proposed tracker
    (LP: #2041921)

  [ Ubuntu: 5.15.0-1043.46 ]

  * jammy/linux-ibm: 5.15.0-1043.46 -proposed tracker (LP: #2041922)
  * jammy/linux: 5.15.0-89.99 -proposed tracker (LP: #2041949)
  * CVE-2023-31085
    - ubi: Refuse attaching if mtd's erasesize is 0
  * CVE-2023-45871
    - igb: set max size RX buffer when store bad packet is enabled
  * CVE-2023-25775
    - RDMA/irdma: Remove irdma_uk_mw_bind()
    - RDMA/irdma: Remove irdma_sc_send_lsmm_nostag()
    - RDMA/irdma: Remove irdma_cqp_up_map_cmd()
    - RDMA/irdma: Remove irdma_get_hw_addr()
    - RDMA/irdma: Make irdma_uk_cq_init() return a void
    - RDMA/irdma: optimize rx path by removing unnecessary copy
    - RDMA/irdma: Remove enum irdma_status_code
    - RDMA/irdma: Remove excess error variables
    - RDMA/irdma: Prevent zero-length STAG registration
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

 -- John Cabaj <john.cabaj@canonical.com>  Thu, 02 Nov 2023 14:53:32 -0500

linux-ibm-5.15 (5.15.0-1042.45~20.04.1) focal; urgency=medium

  * focal/linux-ibm-5.15: 5.15.0-1042.45~20.04.1 -proposed tracker
    (LP: #2038027)

  [ Ubuntu: 5.15.0-1042.45 ]

  * jammy/linux-ibm: 5.15.0-1042.45 -proposed tracker (LP: #2038028)
  * jammy/linux: 5.15.0-88.98 -proposed tracker (LP: #2038055)
  * CVE-2023-4244
    - netfilter: nf_tables: don't skip expired elements during walk
    - netfilter: nf_tables: adapt set backend to use GC transaction API
    - netfilter: nft_set_hash: mark set element as dead when deleting from packet
      path
    - netfilter: nf_tables: GC transaction API to avoid race with control plane
    - netfilter: nf_tables: remove busy mark and gc batch API
    - netfilter: nf_tables: don't fail inserts if duplicate has expired
    - netfilter: nf_tables: fix kdoc warnings after gc rework
    - netfilter: nf_tables: fix GC transaction races with netns and netlink event
      exit path
    - netfilter: nf_tables: GC transaction race with netns dismantle
    - netfilter: nf_tables: GC transaction race with abort path
    - netfilter: nf_tables: use correct lock to protect gc_list
    - netfilter: nf_tables: defer gc run if previous batch is still pending
    - netfilter: nft_dynset: disallow object maps
    - netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
  * CVE-2023-42756
    - netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
  * CVE-2023-4623
    - net/sched: sch_hfsc: Ensure inner classes have fsc curve
  * PCI BARs larger than 128GB are disabled (LP: #2037403)
    - PCI: Support BAR sizes up to 8TB
  * Fix unstable audio at low levels on Thinkpad P1G4 (LP: #2037077)
    - ALSA: hda/realtek - ALC287 I2S speaker platform support
  * Check for changes relevant for security certifications (LP: #1945989)
    - [Packaging] Add a new fips-checks script
  * Jammy update: v5.15.126 upstream stable release (LP: #2037593)
    - io_uring: gate iowait schedule on having pending requests
    - perf: Fix function pointer case
    - net/mlx5: Free irqs only on shutdown callback
    - arm64: errata: Add workaround for TSB flush failures
    - arm64: errata: Add detection for TRBE write to out-of-range
    - [Config] updateconfigs for ARM64_ERRATUM_ and
      ARM64_WORKAROUND_TSB_FLUSH_FAILURE
    - iommu/arm-smmu-v3: Work around MMU-600 erratum 1076982
    - iommu/arm-smmu-v3: Document MMU-700 erratum 2812531
    - iommu/arm-smmu-v3: Add explicit feature for nesting
    - iommu/arm-smmu-v3: Document nesting-related errata
    - arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux
    - word-at-a-time: use the same return type for has_zero regardless of
      endianness
    - KVM: s390: fix sthyi error handling
    - wifi: cfg80211: Fix return value in scan logic
    - net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
    - net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
    - bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing
    - rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length
    - net: dsa: fix value check in bcm_sf2_sw_probe()
    - perf test uprobe_from_different_cu: Skip if there is no gcc
    - net: sched: cls_u32: Fix match key mis-addressing
    - mISDN: hfcpci: Fix potential deadlock on &hc->lock
    - qed: Fix kernel-doc warnings
    - qed: Fix scheduling in a tasklet while getting stats
    - net: annotate data-races around sk->sk_max_pacing_rate
    - net: add missing READ_ONCE(sk->sk_rcvlowat) annotation
    - net: add missing READ_ONCE(sk->sk_sndbuf) annotation
    - net: add missing READ_ONCE(sk->sk_rcvbuf) annotation
    - net: add missing data-race annotations around sk->sk_peek_off
    - net: add missing data-race annotation for sk_ll_usec
    - net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX.
    - bpf, cpumap: Handle skb as well when clean up ptr_ring
    - bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire
    - net: ll_temac: Switch to use dev_err_probe() helper
    - net: ll_temac: fix error checking of irq_of_parse_and_map()
    - net: korina: handle clk prepare error in korina_probe()
    - net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode
    - net: dcb: choose correct policy to parse DCB_ATTR_BCN
    - s390/qeth: Don't call dev_close/dev_open (DOWN/UP)
    - ip6mr: Fix skb_under_panic in ip6mr_cache_report()
    - vxlan: Fix nexthop hash size
    - net/mlx5: fs_core: Make find_closest_ft more generic
    - net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio
    - prestera: fix fallback to previous version on same major version
    - tcp_metrics: fix addr_same() helper
    - tcp_metrics: annotate data-races around tm->tcpm_stamp
    - tcp_metrics: annotate data-races around tm->tcpm_lock
    - tcp_metrics: annotate data-races around tm->tcpm_vals[]
    - tcp_metrics: annotate data-races around tm->tcpm_net
    - tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
    - scsi: zfcp: Defer fc_rport blocking until after ADISC response
    - scsi: storvsc: Limit max_sectors for virtual Fibre Channel devices
    - libceph: fix potential hang in ceph_osdc_notify()
    - USB: zaurus: Add ID for A-300/B-500/C-700
    - ceph: defer stopping mdsc delayed_work
    - firmware: arm_scmi: Drop OF node reference in the transport channel setup
    - exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree
    - exfat: release s_lock before calling dir_emit()
    - mtd: spinand: toshiba: Fix ecc_get_status
    - mtd: rawnand: meson: fix OOB available bytes for ECC
    - arm64: dts: stratix10: fix incorrect I2C property for SCL signal
    - wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC)
    - rbd: prevent busy loop when requesting exclusive lock
    - bpf: Disable preemption in bpf_event_output
    - open: make RESOLVE_CACHED correctly test for O_TMPFILE
    - drm/ttm: check null pointer before accessing when swapping
    - bpf, cpumap: Make sure kthread is running before map update returns
    - file: reinstate f_pos locking optimization for regular files
    - fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_load_attr_list()
    - fs/sysv: Null check to prevent null-ptr-deref bug
    - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
    - fs: Protect reconfiguration of sb read-write from racing writes
    - ext2: Drop fragment support
    - mtd: rawnand: omap_elm: Fix incorrect type in assignment
    - mtd: rawnand: rockchip: fix oobfree offset and description
    - mtd: rawnand: rockchip: Align hwecc vs. raw page helper layouts
    - mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op()
    - powerpc/mm/altmap: Fix altmap boundary check
    - drm/imx/ipuv3: Fix front porch adjustment upon hactive aligning
    - selftests/rseq: check if libc rseq support is registered
    - selftests/rseq: Play nice with binaries statically linked against glibc
      2.35+
    - soundwire: bus: pm_runtime_request_resume on peripheral attachment
    - soundwire: fix enumeration completion
    - PM / wakeirq: support enabling wake-up irq after runtime_suspend called
    - PM: sleep: wakeirq: fix wake irq arming
    - Linux 5.15.126
  * Jammy update: v5.15.125 upstream stable release (LP: #2036843)
    - ia64/cpu: Switch to arch_cpu_finalize_init()
    - m68k/cpu: Switch to arch_cpu_finalize_init()
    - mips/cpu: Switch to arch_cpu_finalize_init()
    - sh/cpu: Switch to arch_cpu_finalize_init()
    - Linux 5.15.125
    - Upstream stable to v5.15.125
  * CVE-2023-42755
    - net/sched: Retire rsvp classifier
    - [Config] remove NET_CLS_RSVP and NET_CLS_RSVP6
  * CVE-2023-42753
    - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for
      ip_set_hash_netportnet.c
  * CVE-2023-34319
    - xen/netback: Fix buffer overrun triggered by unusual packet
  * CVE-2023-5197
    - netfilter: nf_tables: disallow rule removal from chain binding
  * CVE-2023-4921
    - net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  * CVE-2023-42752
    - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
  * Avoid address overwrite in kernel_connect (LP: #2035163)
    - net: Avoid address overwrite in kernel_connect
  * NULL Pointer Dereference During KVM MMU Page Invalidation (LP: #2035166)
    - KVM: x86/mmu: Track the number of TDP MMU pages, but not the actual pages
  * Fix suspend hang on Lenovo workstation (LP: #2034479)
    - igb: Fix igb_down hung on surprise removal
  * [regression] Unable to initialize SGX enclaves with XFRM other than 3
    (LP: #2034745)
    - x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4
  * CVE-2023-4881
    - netfilter: nftables: exthdr: fix 4-byte stack OOB write
  * CVE-2023-4622
    - af_unix: Fix null-ptr-deref in unix_stream_sendpage().
  * Jammy update: v5.15.124 upstream stable release (LP: #2035400)
    - jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
    - KVM: s390: pv: fix index value of replaced ASCE
    - io_uring: don't audit the capability check in io_uring_create()
    - gpio: tps68470: Make tps68470_gpio_output() always set the initial value
    - pwm: Add a stub for devm_pwmchip_add()
    - gpio: mvebu: Make use of devm_pwmchip_add
    - gpio: mvebu: fix irq domain leak
    - btrfs: fix race between quota disable and relocation
    - i2c: Delete error messages for failed memory allocations
    - i2c: Improve size determinations
    - i2c: nomadik: Remove unnecessary goto label
    - i2c: nomadik: Use devm_clk_get_enabled()
    - i2c: nomadik: Remove a useless call in the remove function
    - PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
    - PCI/ASPM: Factor out pcie_wait_for_retrain()
    - PCI/ASPM: Avoid link retraining race
    - PCI: rockchip: Remove writes to unused registers
    - PCI: rockchip: Fix window mapping and address translation for endpoint
    - PCI: rockchip: Don't advertise MSI-X in PCIe capabilities
    - dlm: cleanup plock_op vs plock_xop
    - dlm: rearrange async condition return
    - fs: dlm: interrupt posix locks only when process is killed
    - drm/ttm: Don't print error message if eviction was interrupted
    - drm/ttm: Don't leak a resource on eviction error
    - n_tty: Rename tail to old_tail in n_tty_read()
    - tty: fix hang on tty device with no_room set
    - drm/ttm: never consider pinned BOs for eviction&swap
    - cifs: missing directory in MAINTAINERS file
    - cifs: use fs_context for automounts
    - ksmbd: remove internal.h include
    - cifs: if deferred close is disabled then close files immediately
    - pwm: meson: Simplify duplicated per-channel tracking
    - pwm: meson: fix handling of period/duty if greater than UINT_MAX
    - tracing/probes: Add symstr type for dynamic events
    - tracing/probes: Fix to avoid double count of the string length on the array
    - tracing: Allow synthetic events to pass around stacktraces
    - Revert "tracing: Add "(fault)" name injection to kernel probes"
    - tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if
      fails
    - scsi: qla2xxx: Remove unused declarations for qla2xxx
    - scsi: qla2xxx: Multi-que support for TMF
    - scsi: qla2xxx: Fix task management cmd failure
    - scsi: qla2xxx: Fix task management cmd fail due to unavailable resource
    - scsi: qla2xxx: Add debug prints in the device remove path
    - scsi: qla2xxx: Fix hang in task management
    - drm/amdgpu: fix vkms crtc settings
    - drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel
    - phy: qcom-snps: Use dev_err_probe() to simplify code
    - phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc
    - phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend
    - phy: qcom-snps-femto-v2: properly enable ref clock
    - soundwire: qcom: update status correctly with mask
    - media: staging: atomisp: select V4L2_FWNODE
    - i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
    - iavf: fix potential deadlock on allocation failure
    - iavf: check for removal state before IAVF_FLAG_PF_COMMS_FAILED
    - net: phy: marvell10g: fix 88x3310 power up
    - net: hns3: fix wrong tc bandwidth weight data issue
    - net: hns3: fix wrong bw weight of disabled tc issue
    - vxlan: move to its own directory
    - vxlan: calculate correct header length for GPE
    - phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
    - ethernet: atheros: fix return value check in atl1e_tso_csum()
    - ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new
      temporary address
    - ice: Fix memory management in ice_ethtool_fdir.c
    - bonding: reset bond's flags when down link is P2P device
    - team: reset team's flags when down link is P2P device
    - net: stmmac: Apply redundant write work around on 4.xx too
    - platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
    - igc: Fix Kernel Panic during ndo_tx_timeout callback
    - netfilter: nft_set_rbtree: fix overlap expiration walk
    - net/sched: mqprio: refactor nlattr parsing to a separate function
    - net/sched: mqprio: add extack to mqprio_parse_nlattr()
    - net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
    - benet: fix return value check in be_lancer_xmit_workarounds()
    - tipc: check return value of pskb_trim()
    - tipc: stop tipc crypto on failure in tipc_node_create
    - RDMA/mlx4: Make check for invalid flags stricter
    - drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
    - drm/msm/adreno: Fix snapshot BINDLESS_DATA size
    - RDMA/irdma: Add missing read barriers
    - RDMA/irdma: Fix data race on CQP completion stats
    - RDMA/irdma: Fix data race on CQP request done
    - RDMA/mthca: Fix crash when polling CQ for shared QPs
    - RDMA/bnxt_re: Prevent handling any completions after qp destroy
    - drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
    - ASoC: fsl_spdif: Silence output on stop
    - block: Fix a source code comment in include/uapi/linux/blkzoned.h
    - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
    - dm raid: clean up four equivalent goto tags in raid_ctr()
    - dm raid: protect md_stop() with 'reconfig_mutex'
    - drm/amd: Fix an error handling mistake in psp_sw_init()
    - RDMA/irdma: Report correct WC error
    - ata: pata_ns87415: mark ns87560_tf_read static
    - ring-buffer: Fix wrong stat of cpu_buffer->read
    - tracing: Fix warning in trace_buffered_event_disable()
    - Revert "usb: gadget: tegra-xudc: Fix error check in
      tegra_xudc_powerdomain_init()"
    - usb: gadget: call usb_gadget_check_config() to verify UDC capability
    - USB: gadget: Fix the memory leak in raw_gadget driver
    - KVM: Grab a reference to KVM for VM and vCPU stats file descriptors
    - KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest
    - serial: qcom-geni: drop bogus runtime pm state update
    - serial: 8250_dw: Preserve original value of DLF register
    - serial: sifive: Fix sifive_serial_console_setup() section
    - USB: serial: option: support Quectel EM060K_128
    - USB: serial: option: add Quectel EC200A module support
    - USB: serial: simple: add Kaufmann RKS+CAN VCP
    - USB: serial: simple: sort driver entries
    - can: gs_usb: gs_can_close(): add missing set of CAN state to
      CAN_STATE_STOPPED
    - Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
    - usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
    - usb: dwc3: don't reset device side if dwc3 was configured as host-only
    - usb: ohci-at91: Fix the unhandle interrupt when resume
    - USB: quirks: add quirk for Focusrite Scarlett
    - usb: cdns3: fix incorrect calculation of ep_buf_size when more than one
      config
    - usb: xhci-mtk: set the dma max_seg_size
    - Revert "usb: xhci: tegra: Fix error check"
    - Documentation: security-bugs.rst: update preferences when dealing with the
      linux-distros group
    - Documentation: security-bugs.rst: clarify CVE handling
    - staging: r8712: Fix memory leak in _r8712_init_xmit_priv()
    - staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
    - tty: n_gsm: fix UAF in gsm_cleanup_mux
    - Revert "xhci: add quirk for host controllers that don't update endpoint DCS"
    - ALSA: hda/relatek: Enable Mute LED on HP 250 G8
    - hwmon: (k10temp) Enable AMD3255 Proc to show negative temperature
    - hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
    - btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
    - btrfs: check for commit error at btrfs_attach_transaction_barrier()
    - file: always lock position for FMODE_ATOMIC_POS
    - nfsd: Remove incorrect check in nfsd4_validate_stateid
    - tpm_tis: Explicitly check for error code
    - irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
    - irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation
    - locking/rtmutex: Fix task->pi_waiters integrity
    - KVM: x86: Disallow KVM_SET_SREGS{2} if incoming CR0 is invalid
    - virtio-net: fix race between set queues and probe
    - s390/dasd: fix hanging device after quiesce/resume
    - ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
    - ceph: never send metrics if disable_send_metrics is set
    - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
    - rbd: make get_lock_owner_info() return a single locker or NULL
    - rbd: harden get_lock_owner_info() a bit
    - rbd: retrieve and check lock owner twice before blocklisting
    - tracing: Fix trace_event_raw_event_synth() if else statement
    - ACPI: processor: perflib: Use the "no limit" frequency QoS
    - ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
    - cpufreq: intel_pstate: Drop ACPI _PSS states table patching
    - selftests: mptcp: sockopt: use 'iptables-legacy' if available
    - io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
    - ASoC: cs42l51: fix driver to properly autoload with automatic module loading
    - selftests: mptcp: join: only check for ip6tables if needed
    - Linux 5.15.124
  * Jammy update: v5.15.123 upstream stable release (LP: #2034612)
    - ALSA: hda/realtek - remove 3k pull low procedure
    - ALSA: hda/realtek: Add quirk for Clevo NS70AU
    - ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx
    - keys: Fix linking a duplicate key to a keyring's assoc_array
    - perf probe: Add test for regression introduced by switch to
      die_get_decl_file()
    - btrfs: fix warning when putting transaction with qgroups enabled after abort
    - fuse: revalidate: don't invalidate if interrupted
    - btrfs: zoned: fix memory leak after finding block group with super blocks
    - fuse: ioctl: translate ENOSYS in outarg
    - selftests: tc: set timeout to 15 minutes
    - selftests: tc: add 'ct' action kconfig dep
    - regmap: Drop initial version of maximum transfer length fixes
    - regmap: Account for register length in SMBus I/O limits
    - can: bcm: Fix UAF in bcm_proc_show()
    - selftests: tc: add ConnTrack procfs kconfig
    - drm/client: Fix memory leak in drm_client_target_cloned
    - drm/client: Fix memory leak in drm_client_modeset_probe
    - drm/amd/display: Disable MPC split by default on special asic
    - drm/amd/display: Keep PHY active for DP displays on DCN31
    - ASoC: fsl_sai: Disable bit clock with transmitter
    - ASoC: codecs: wcd938x: fix missing clsh ctrl error handling
    - ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove
    - ASoC: codecs: wcd938x: fix resource leaks on component remove
    - ASoC: codecs: wcd938x: fix missing mbhc init error handling
    - ASoC: codecs: wcd934x: fix resource leaks on component remove
    - ASoC: codecs: wcd938x: fix codec initialisation race
    - ASoC: codecs: wcd938x: fix soundwire initialisation race
    - ext4: correct inline offset when handling xattrs in inode body
    - drm/radeon: Fix integer overflow in radeon_cs_parser_init
    - ALSA: emu10k1: roll up loops in DSP setup code for Audigy
    - quota: Properly disable quotas when add_dquot_ref() fails
    - quota: fix warning in dqgrab()
    - udf: Fix uninitialized array access for some pathnames
    - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
    - MIPS: dec: prom: Address -Warray-bounds warning
    - FS: JFS: Fix null-ptr-deref Read in txBegin
    - FS: JFS: Check for read-only mounted filesystem in txBegin
    - spi: bcm63xx: fix max prepend length
    - fbdev: imxfb: warn about invalid left/right margin
    - perf build: Fix library not found error when using CSLIBS
    - pinctrl: amd: Use amd_pinconf_set() for all config options
    - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
    - bridge: Add extack warning when enabling STP in netns.
    - ethernet: use eth_hw_addr_set() instead of ether_addr_copy()
    - of: net: add a helper for loading netdev->dev_addr
    - ethernet: use of_get_ethdev_address()
    - net: ethernet: mtk_eth_soc: handle probe deferral
    - net: sched: cls_bpf: Undo tcf_bind_filter in case of an error
    - iavf: Fix use-after-free in free_netdev
    - iavf: Fix out-of-bounds when setting channels on remove
    - security: keys: Modify mismatched function name
    - octeontx2-pf: Dont allocate BPIDs for LBK interfaces
    - bpf: Fix subprog idx logic in check_max_stack_depth
    - igc: Prevent garbled TX queue with XDP ZEROCOPY
    - tcp: annotate data-races around tcp_rsk(req)->ts_recent
    - net: ipv4: Use kfree_sensitive instead of kfree
    - net:ipv6: check return value of pskb_trim()
    - Revert "tcp: avoid the lookup process failing to get sk in ehash table"
    - fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
    - llc: Don't drop packet from non-root netns.
    - netfilter: nf_tables: fix spurious set element insertion failure
    - netfilter: nf_tables: skip bound chain in netns release path
    - tcp: annotate data-races around tp->tcp_tx_delay
    - tcp: annotate data-races around tp->keepalive_time
    - tcp: annotate data-races around tp->keepalive_intvl
    - tcp: annotate data-races around tp->keepalive_probes
    - tcp: annotate data-races around icsk->icsk_syn_retries
    - tcp: annotate data-races around tp->linger2
    - tcp: annotate data-races around rskq_defer_accept
    - tcp: annotate data-races around tp->notsent_lowat
    - tcp: annotate data-races around icsk->icsk_user_timeout
    - tcp: annotate data-races around fastopenq.max_qlen
    - net: phy: prevent stale pointer dereference in phy_init()
    - jbd2: recheck chechpointing non-dirty buffer
    - tracing/histograms: Return an error if we fail to add histogram to hist_vars
      list
    - nixge: fix mac address error handling again
    - Linux 5.15.123
  * allow io_uring to be disabled in runtime (LP: #2035116)
    - io_uring: add a sysctl to disable io_uring system-wide
  * CVE-2023-31083
    - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
  * CVE-2023-3772
    - xfrm: add NULL check in xfrm_update_ae_params
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

 -- John Cabaj <john.cabaj@canonical.com>  Wed, 11 Oct 2023 12:46:17 -0500

linux-ibm-5.15 (5.15.0-1041.44~20.04.1) focal; urgency=medium

  * focal/linux-ibm-5.15: 5.15.0-1041.44~20.04.1 -proposed tracker
    (LP: #2038181)

  * CVE-2023-42755
    - [Config] remove NET_CLS_RSVP and NET_CLS_RSVP6

  [ Ubuntu: 5.15.0-1041.44 ]

  * jammy/linux-ibm: 5.15.0-1041.44 -proposed tracker (LP: #2038182)
  * CVE-2023-42755
    - [Config] remove NET_CLS_RSVP and NET_CLS_RSVP6
  * jammy/linux: 5.15.0-87.97 -proposed tracker (LP: #2038209)
  * CVE-2023-4623
    - net/sched: sch_hfsc: Ensure inner classes have fsc curve
  * CVE-2023-42755
    - net/sched: Retire rsvp classifier
    - [Config] remove NET_CLS_RSVP and NET_CLS_RSVP6
  * CVE-2023-34319
    - xen/netback: Fix buffer overrun triggered by unusual packet
  * CVE-2023-4921
    - net: sched: sch_qfq: Fix UAF in qfq_dequeue()
  * CVE-2023-42752
    - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
  * CVE-2023-4622
    - af_unix: Fix null-ptr-deref in unix_stream_sendpage().
  * CVE-2023-4244
    - netfilter: nft_set_rbtree: fix overlap expiration walk
    - netfilter: nf_tables: don't skip expired elements during walk
    - netfilter: nf_tables: adapt set backend to use GC transaction API
    - netfilter: nft_set_hash: mark set element as dead when deleting from packet
      path
    - netfilter: nf_tables: GC transaction API to avoid race with control plane
    - netfilter: nf_tables: remove busy mark and gc batch API
    - netfilter: nf_tables: don't fail inserts if duplicate has expired
    - netfilter: nf_tables: fix kdoc warnings after gc rework
    - netfilter: nf_tables: fix GC transaction races with netns and netlink event
      exit path
    - netfilter: nf_tables: GC transaction race with netns dismantle
    - netfilter: nf_tables: GC transaction race with abort path
    - netfilter: nf_tables: use correct lock to protect gc_list
    - netfilter: nf_tables: defer gc run if previous batch is still pending
    - netfilter: nft_dynset: disallow object maps
    - netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
  * CVE-2023-42756
    - netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
  * CVE-2023-42753
    - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for
      ip_set_hash_netportnet.c
  * CVE-2023-5197
    - netfilter: nf_tables: skip bound chain in netns release path
    - netfilter: nf_tables: disallow rule removal from chain binding
  * CVE-2023-4881
    - netfilter: nftables: exthdr: fix 4-byte stack OOB write

 -- John Cabaj <john.cabaj@canonical.com>  Tue, 10 Oct 2023 11:51:35 -0500

linux-ibm-5.15 (5.15.0-1040.43~20.04.1) focal; urgency=medium

  * focal/linux-ibm-5.15: 5.15.0-1040.43~20.04.1 -proposed tracker
    (LP: #2036545)

  [ Ubuntu: 5.15.0-1040.43 ]

  * jammy/linux-ibm: 5.15.0-1040.43 -proposed tracker (LP: #2036546)
  * jammy/linux: 5.15.0-86.96 -proposed tracker (LP: #2036575)
  * 5.15.0-85 live migration regression (LP: #2036675)
    - Revert "KVM: x86: Always enable legacy FP/SSE in allowed user XFEATURES"
    - Revert "x86/kvm/fpu: Limit guest user_xfeatures to supported bits of XCR0"
  * Regression for ubuntu_bpf test build on Jammy 5.15.0-85.95 (LP: #2035181)
    - selftests/bpf: fix static assert compilation issue for test_cls_*.c
  * `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
    (LP: #2034447)
    - crypto: rsa-pkcs1pad - Use helper to set reqsize

 -- Roxana Nicolescu <roxana.nicolescu@canonical.com>  Thu, 21 Sep 2023 13:47:47 +0200

linux-ibm-5.15 (5.15.0-1039.42~20.04.1) focal; urgency=medium

  * focal/linux-ibm-5.15: 5.15.0-1039.42~20.04.1 -proposed tracker
    (LP: #2033794)

  * Jammy update: v5.15.118 upstream stable release (LP: #2030239)
    - [Config] updateconfigs for DECNET

  * Jammy update: v5.15.117 upstream stable release (LP: #2030107)
    - [Config] updateconfigs for BLK_DEV_SX8

  [ Ubuntu: 5.15.0-1039.42 ]

  * jammy/linux-ibm: 5.15.0-1039.42 -proposed tracker (LP: #2033795)
  * Jammy update: v5.15.118 upstream stable release (LP: #2030239)
    - [Config] updateconfigs for DECNET
  * Jammy update: v5.15.117 upstream stable release (LP: #2030107)
    - [Config] updateconfigs for BLK_DEV_SX8
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
  * jammy/linux: 5.15.0-85.95 -proposed tracker (LP: #2033821)
  * Please enable Renesas RZ platform serial installer (LP: #2022361)
    - [Config] enable hihope RZ/G2M serial console
    - [Config] Mark sh-sci as built-in
  * Request backport of xen timekeeping performance improvements (LP: #2033122)
    - x86/xen/time: prefer tsc as clocksource when it is invariant
  * kdump doesn't work with UEFI secure boot and kernel lockdown enabled on
    ARM64 (LP: #2033007)
    - [Config]: Enable CONFIG_KEXEC_IMAGE_VERIFY_SIG
    - kexec, KEYS: make the code in bzImage64_verify_sig generic
    - arm64: kexec_file: use more system keyrings to verify kernel image signature
  * ubuntu_kernel_selftests:net:vrf-xfrm-tests.sh: 8 failed test cases on
    jammy/fips (LP: #2019880)
    - selftests: net: vrf-xfrm-tests: change authentication and encryption algos
  * ubuntu_kernel_selftests:net:tls: 88 failed test cases on jammy/fips
    (LP: #2019868)
    - selftests/harness: allow tests to be skipped during setup
    - selftests: net: tls: check if FIPS mode is enabled
  * A general-proteciton exception during guest migration to unsupported PKRU
    machine (LP: #2032164, reverted)
    - x86/kvm/fpu: Limit guest user_xfeatures to supported bits of XCR0
    - KVM: x86: Always enable legacy FP/SSE in allowed user XFEATURES
  * CVE-2023-4569
    - netfilter: nf_tables: deactivate catchall elements in next generation
  * CVE-2023-20569
    - x86/cpu, kvm: Add support for CPUID_80000021_EAX
    - x86/srso: Add a Speculative RAS Overflow mitigation
    - x86/srso: Add IBPB_BRTYPE support
    - x86/srso: Add SRSO_NO support
    - x86/srso: Add IBPB
    - x86/srso: Add IBPB on VMEXIT
    - x86/srso: Fix return thunks in generated code
    - x86/srso: Tie SBPB bit setting to microcode patch detection
    - x86: fix backwards merge of GDS/SRSO bit
    - x86/srso: Fix build breakage with the LLVM linker
    - x86/cpu: Fix __x86_return_thunk symbol type
    - x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
    - x86/alternative: Make custom return thunk unconditional
    - objtool: Add frame-pointer-specific function ignore
    - x86/ibt: Add ANNOTATE_NOENDBR
    - x86/cpu: Clean up SRSO return thunk mess
    - x86/cpu: Rename original retbleed methods
    - x86/cpu: Rename srso_(.*)_alias to srso_alias_1
    - x86/cpu: Cleanup the untrain mess
    - x86/srso: Explain the untraining sequences a bit more
    - x86/static_call: Fix __static_call_fixup()
    - x86/retpoline: Don't clobber RFLAGS during srso_safe_ret()
    - x86/srso: Disable the mitigation on unaffected configurations
    - x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG
    - objtool/x86: Fixup frame-pointer vs rethunk
    - x86/srso: Correct the mitigation status when SMT is disabled
    - objtool/x86: Fix SRSO mess
    - Ubuntu: [Config]: enable Speculative Return Stack Overflow mitigation
  * Fix unreliable ethernet cable detection on I219 NIC (LP: #2028122)
    - e1000e: Use PME poll to circumvent unreliable ACPI wake
  * Need to get fine-grained control for FAN(TFN) Participant. (LP: #2031333)
    - ACPI: fan: Separate file for attributes creation
    - ACPI: fan: Optimize struct acpi_fan_fif
    - ACPI: fan: Properly handle fine grain control
    - ACPI: fan: Add additional attributes for fine grain control
  * [SRU][Ubuntu 22.04.1] Unable to interpret the frequency values in
    cpuinfo_min_freq and cpuino_max_freq sysfs files. (LP: #2030924)
    - cpufreq: intel_pstate: Fix scaling for hybrid-capable
  * CVE-2023-40283
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
  * CVE-2023-20588
    - x86/bugs: Increase the x86 bugs vector size to two u32s
    - x86/CPU/AMD: Do not leak quotient data after a division by 0
    - x86/CPU/AMD: Fix the DIV(0) initial fix attempt
  * CVE-2023-4194
    - net: tun_chr_open(): set sk_uid from current_fsuid()
    - net: tap_open(): set sk_uid from current_fsuid()
  * CVE-2023-4155
    - KVM: SEV: Refactor out sev_es_state struct
    - KVM: SEV: Fall back to vmalloc for SEV-ES scratch area if necessary
    - KVM: SVM: Do not terminate SEV-ES guests on GHCB validation failure
    - KVM: SVM: Exit to userspace on ENOMEM/EFAULT GHCB errors
    - KVM: SEV: snapshot the GHCB before accessing it
    - KVM: SEV: only access GHCB fields once
  * CVE-2023-1206
    - tcp: Reduce chance of collisions in inet6_hashfn().
  * Crashing with CPU soft lock on GA kernel 5.15.0.79.76 and HWE kernel
    5.19.0-46.47-22.04.1 (LP: #2032176)
    - Revert "KVM: x86: enable TDP MMU by default"
  * Jammy update: v5.15.122 upstream stable release (LP: #2032690)
    - Linux 5.15.122
    - Upstream stable to v5.15.122
  * Jammy update: v5.15.121 upstream stable release (LP: #2032689)
    - netfilter: nf_tables: drop map element references from preparation phase
    - fs: pipe: reveal missing function protoypes
    - x86/resctrl: Only show tasks' pid in current pid namespace
    - blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
    - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
    - md/raid10: fix overflow of md/safe_mode_delay
    - md/raid10: fix wrong setting of max_corr_read_errors
    - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
    - md/raid10: fix io loss while replacement replace rdev
    - irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
    - svcrdma: Prevent page release when nothing was received
    - posix-timers: Prevent RT livelock in itimer_delete()
    - tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
    - clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
    - PM: domains: fix integer overflow issues in genpd_parse_state()
    - perf/arm-cmn: Fix DTC reset
    - powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
    - ARM: 9303/1: kprobes: avoid missing-declaration warnings
    - cpufreq: intel_pstate: Fix energy_performance_preference for passive
    - thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe()
    - rcutorture: Correct name of use_softirq module parameter
    - rcuscale: Always log error message
    - rcuscale: Move shutdown from wait_event() to wait_event_idle()
    - rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup()
    - rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale
    - kselftest: vDSO: Fix accumulation of uninitialized ret when CLOCK_REALTIME
      is undefined
    - perf/ibs: Fix interface via core pmu events
    - x86/mm: Fix __swp_entry_to_pte() for Xen PV guests
    - locking/atomic: arm: fix sync ops
    - evm: Complete description of evm_inode_setattr()
    - evm: Fix build warnings
    - ima: Fix build warnings
    - pstore/ram: Add check for kstrdup
    - igc: Enable and fix RX hash usage by netstack
    - wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation
    - wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
    - libbpf: btf_dump_type_data_check_overflow needs to consider
      BTF_MEMBER_BITFIELD_SIZE
    - samples/bpf: Fix buffer overflow in tcp_basertt
    - spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
    - wifi: wilc1000: fix for absent RSN capabilities WFA testcase
    - wifi: mwifiex: Fix the size of a memory allocation in
      mwifiex_ret_802_11_scan()
    - sctp: add bpf_bypass_getsockopt proto callback
    - libbpf: fix offsetof() and container_of() to work with CO-RE
    - bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen
    - spi: dw: Round of n_bytes to power of 2
    - nfc: llcp: fix possible use of uninitialized variable in
      nfc_llcp_send_connect()
    - bpftool: JIT limited misreported as negative value on aarch64
    - regulator: core: Fix more error checking for debugfs_create_dir()
    - regulator: core: Streamline debugfs operations
    - wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
    - wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
    - wifi: atmel: Fix an error handling path in atmel_probe()
    - wl3501_cs: use eth_hw_addr_set()
    - wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
    - wifi: ray_cs: Utilize strnlen() in parse_addr()
    - wifi: ray_cs: Drop useless status variable in parse_addr()
    - wifi: ray_cs: Fix an error handling path in ray_probe()
    - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
    - selftests/bpf: Fix check_mtu using wrong variable type
    - wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled
    - wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
    - watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct
      config
    - watchdog/perf: more properly prevent false positives with turbo modes
    - kexec: fix a memory leak in crash_shrink_memory()
    - memstick r592: make memstick_debug_get_tpc_name() static
    - wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
    - rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
    - wifi: iwlwifi: pull from TXQs with softirqs disabled
    - iwlwifi: don't dump_stack() when we get an unexpected interrupt
    - wifi: iwlwifi: pcie: fix NULL pointer dereference in
      iwl_pcie_irq_rx_msix_handler()
    - wifi: cfg80211: rewrite merging of inherited elements
    - wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection
    - wifi: ath9k: convert msecs to jiffies where needed
    - bpf: Omit superfluous address family check in __bpf_skc_lookup
    - bpf: Factor out socket lookup functions for the TC hookpoint.
    - bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC hookpoint
    - bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings
    - can: length: fix bitstuffing count
    - igc: Fix race condition in PTP tx code
    - net: stmmac: fix double serdes powerdown
    - netlink: fix potential deadlock in netlink_set_err()
    - netlink: do not hard code device address lenth in fdb dumps
    - bonding: do not assume skb mac_header is set
    - selftests: rtnetlink: remove netdevsim device after ipsec offload test
    - gtp: Fix use-after-free in __gtp_encap_destroy().
    - net: axienet: Move reset before 64-bit DMA detection
    - sfc: fix crash when reading stats while NIC is resetting
    - lib/ts_bm: reset initial match offset for every block of text
    - netfilter: conntrack: dccp: copy entire header to stack buffer, not just
      basic one
    - netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return
      value.
    - ipvlan: Fix return value of ipvlan_queue_xmit()
    - netlink: Add __sock_i_ino() for __netlink_diag_dump().
    - drm/amd/display: Add logging for display MALL refresh setting
    - radeon: avoid double free in ci_dpm_init()
    - drm/amd/display: Explicitly specify update type per plane info change
    - Input: drv260x - sleep between polling GO bit
    - drm/bridge: tc358768: always enable HS video mode
    - drm/bridge: tc358768: fix PLL parameters computation
    - drm/bridge: tc358768: fix PLL target frequency
    - drm/bridge: tc358768: fix TCLK_ZEROCNT computation
    - drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation
    - drm/bridge: tc358768: fix TCLK_TRAILCNT computation
    - drm/bridge: tc358768: fix THS_ZEROCNT computation
    - drm/bridge: tc358768: fix TXTAGOCNT computation
    - drm/bridge: tc358768: fix THS_TRAILCNT computation
    - drm/vram-helper: fix function names in vram helper doc
    - ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
    - ARM: dts: meson8b: correct uart_B and uart_C clock references
    - Input: adxl34x - do not hardcode interrupt trigger type
    - drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
    - drm/panel: sharp-ls043t1le01: adjust mode settings
    - ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards
    - bus: ti-sysc: Fix dispc quirk masking bool variables
    - arm64: dts: microchip: sparx5: do not use PSCI on reference boards
    - clk: imx: scu: use _safe list iterator to avoid a use after free
    - RDMA/bnxt_re: Disable/kill tasklet only if it is enabled
    - RDMA/bnxt_re: Fix to remove unnecessary return labels
    - RDMA/bnxt_re: Use unique names while registering interrupts
    - RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid
    - RDMA/bnxt_re: Fix to remove an unnecessary log
    - drm/msm/dsi: don't allow enabling 14nm VCO with unprogrammed rate
    - drm/msm/disp/dpu: get timing engine status from intf status register
    - drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK
    - ARM: dts: gta04: Move model property out of pinctrl node
    - arm64: dts: qcom: msm8916: correct camss unit address
    - arm64: dts: qcom: msm8994: correct SPMI unit address
    - arm64: dts: qcom: msm8996: correct camss unit address
    - arm64: dts: qcom: sdm630: correct camss unit address
    - arm64: dts: qcom: sdm845: correct camss unit address
    - arm64: dts: qcom: db820c: Move blsp1_uart2 pin states to msm8996.dtsi
    - arm64: dts: qcom: apq8016-sbc: Update modem and WiFi firmware path
    - arm64: dts: qcom: apq8016-sbc: Clarify firmware-names
    - arm64: dts: qcom: apq8016-sbc: fix mpps state names
    - arm64: dts: qcom: Drop unneeded extra device-specific includes
    - arm64: dts: qcom: apq8016-sbc: Fix regulator constraints
    - arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion
    - drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
    - ARM: ep93xx: fix missing-prototype warnings
    - ARM: omap2: fix missing tick_broadcast() prototype
    - arm64: dts: qcom: apq8096: fix fixed regulator name property
    - arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to kukui
    - ARM: dts: stm32: Shorten the AV96 HDMI sound card name
    - memory: brcmstb_dpfe: fix testing array offset after use
    - ASoC: es8316: Increment max value for ALC Capture Target Volume control
    - ASoC: es8316: Do not set rate constraints for unsupported MCLKs
    - ARM: dts: meson8: correct uart_B and uart_C clock references
    - soc/fsl/qe: fix usb.c build errors
    - RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes
    - IB/hfi1: Use bitmap_zalloc() when applicable
    - IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate
    - RDMA/hns: Fix hns_roce_table_get return value
    - ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier
    - arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
    - fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
    - arm64: dts: ti: k3-j7200: Fix physical address of pin
    - ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2
    - ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx
    - hwmon: (gsc-hwmon) fix fan pwm temperature scaling
    - hwmon: (adm1275) Allow setting sample averaging
    - hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272
    - ARM: dts: BCM5301X: fix duplex-full => full-duplex
    - drm/amdkfd: Fix potential deallocation of previously deallocated memory.
    - drm/amd/display: Fix artifacting on eDP panels when engaging freesync video
      mode
    - drm/radeon: fix possible division-by-zero errors
    - amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
    - drm/msm/a5xx: really check for A510 in a5xx_gpu_init
    - RDMA/bnxt_re: wraparound mbox producer index
    - RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context
    - clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe
    - clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()
    - arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k
    - clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider()
    - clk: tegra: tegra124-emc: Fix potential memory leak
    - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
    - drm/msm/dpu: do not enable color-management if DSPPs are not available
    - drm/msm/dp: Free resources after unregistering them
    - arm64: dts: mediatek: Add cpufreq nodes for MT8192
    - arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz
    - drm/msm/dpu: correct MERGE_3D length
    - clk: vc5: check memory returned by kasprintf()
    - clk: cdce925: check return value of kasprintf()
    - clk: si5341: return error if one synth clock registration fails
    - clk: si5341: check return value of {devm_}kasprintf()
    - clk: si5341: free unused memory on probe failure
    - clk: keystone: sci-clk: check return value of kasprintf()
    - clk: ti: clkctrl: check return value of kasprintf()
    - drivers: meson: secure-pwrc: always enable DMA domain
    - ovl: update of dentry revalidate flags after copy up
    - ASoC: imx-audmix: check return value of devm_kasprintf()
    - clk: Fix memory leak in devm_clk_notifier_register()
    - PCI: cadence: Fix Gen2 Link Retraining process
    - PCI: vmd: Reset VMD config register between soft reboots
    - scsi: qedf: Fix NULL dereference in error handling
    - pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors
    - PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
    - scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
    - PCI: pciehp: Cancel bringup sequence if card is not present
    - PCI: ftpci100: Release the clock resources
    - PCI: Add pci_clear_master() stub for non-CONFIG_PCI
    - perf bench: Use unbuffered output when pipe/tee'ing to a file
    - perf bench: Add missing setlocale() call to allow usage of %'d style
      formatting
    - pinctrl: cherryview: Return correct value if pin in push-pull mode
    - kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures
    - powerpc/interrupt: Don't read MSR from interrupt_exit_kernel_prepare()
    - powerpc/signal32: Force inlining of __unsafe_save_user_regs() and
      save_tm_user_regs_unsafe()
    - perf script: Fix allocation of evsel->priv related to per-event dump files
    - perf dwarf-aux: Fix off-by-one in die_get_varname()
    - powerpc/64s: Fix VAS mm use after free
    - pinctrl: microchip-sgpio: check return value of devm_kasprintf()
    - pinctrl: at91-pio4: check return value of devm_kasprintf()
    - powerpc/powernv/sriov: perform null check on iov before dereferencing iov
    - powerpc: simplify ppc_save_regs
    - powerpc: update ppc_save_regs to save current r1 in pt_regs
    - riscv: uprobes: Restore thread.bad_cause
    - powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo
    - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-
      boundary
    - hwrng: virtio - add an internal buffer
    - hwrng: virtio - don't wait on cleanup
    - hwrng: virtio - don't waste entropy
    - hwrng: virtio - always add a pending request
    - hwrng: virtio - Fix race on data_avail and actual data
    - modpost: remove broken calculation of exception_table_entry size
    - crypto: nx - fix build warnings when DEBUG_FS is not enabled
    - modpost: fix section mismatch message for R_ARM_ABS32
    - modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
    - crypto: marvell/cesa - Fix type mismatch warning
    - modpost: fix off by one in is_executable_section()
    - ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard
    - crypto: qat - honor CRYPTO_TFM_REQ_MAY_SLEEP flag
    - crypto: qat - replace get_current_node() with numa_node_id()
    - crypto: qat - use reference to structure in dma_map_single()
    - crypto: kpp - Add helper to set reqsize
    - crypto: qat - Use helper to set reqsize
    - crypto: qat - unmap buffer before free for DH
    - crypto: qat - unmap buffers before free for RSA
    - NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
    - SMB3: Do not send lease break acknowledgment if all file handles have been
      closed
    - dax: Fix dax_mapping_release() use after free
    - dax: Introduce alloc_dev_dax_id()
    - dax/kmem: Pass valid argument to memory_group_register_static
    - hwrng: st - keep clock enabled while hwrng is registered
    - kbuild: Disable GCOV for *.mod.o
    - efi/libstub: Disable PCI DMA before grabbing the EFI memory map
    - ksmbd: avoid field overflow warning
    - ACPI: utils: Fix acpi_evaluate_dsm_typed() redefinition error
    - bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page
    - USB: serial: option: add LARA-R6 01B PIDs
    - usb: dwc3: gadget: Propagate core init errors to UDC during pullup
    - phy: tegra: xusb: Clear the driver reference in usb-phy dev
    - iio: adc: ad7192: Fix null ad7192_state pointer access
    - iio: adc: ad7192: Fix internal/external clock selection
    - iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF
    - iio: accel: fxls8962af: fixup buffer scan element type
    - ALSA: hda/realtek: Add quirk for Clevo NPx0SNx
    - ALSA: jack: Fix mutex call in snd_jack_report()
    - block: fix signed int overflow in Amiga partition support
    - block: add overflow checks for Amiga partition support
    - block: change all __u32 annotations to __be32 in affs_hardblocks.h
    - block: increment diskseq on all media change events
    - SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
    - w1: w1_therm: fix locking behavior in convert_t
    - w1: fix loop in w1_fini()
    - sh: j2: Use ioremap() to translate device tree address into kernel memory
    - usb: dwc2: platform: Improve error reporting for problems during .remove()
    - usb: dwc2: Fix some error handling paths
    - serial: 8250: omap: Fix freeing of resources on failed register
    - clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs
    - clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks
    - media: usb: Check az6007_read() return value
    - media: videodev2.h: Fix struct v4l2_input tuner index comment
    - media: usb: siano: Fix warning due to null work_func_t function pointer
    - media: i2c: Correct format propagation for st-mipid02
    - clk: qcom: reset: Allow specifying custom reset delay
    - clk: qcom: reset: support resetting multiple bits
    - clk: qcom: ipq6018: fix networking resets
    - usb: dwc3: qcom: Fix potential memory leak
    - usb: gadget: u_serial: Add null pointer check in gserial_suspend
    - extcon: Fix kernel doc of property fields to avoid warnings
    - extcon: Fix kernel doc of property capability fields to avoid warnings
    - usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
    - usb: hide unused usbfs_notify_suspend/resume functions
    - serial: 8250: lock port for stop_rx() in omap8250_irq()
    - serial: 8250: lock port for UART_IER access in omap8250_irq()
    - kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR
    - coresight: Fix loss of connection info when a module is unloaded
    - mfd: rt5033: Drop rt5033-battery sub-device
    - media: venus: helpers: Fix ALIGN() of non power of two
    - media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var()
    - KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
    - usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
    - usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe()
    - usb: common: usb-conn-gpio: Set last role to unknown before initial
      detection
    - usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe()
    - mfd: intel-lpss: Add missing check for platform_get_resource
    - Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial
      detection"
    - serial: 8250_omap: Use force_suspend and resume for system suspend
    - test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation
    - nvmem: rmem: Use NVMEM_DEVID_AUTO
    - mfd: stmfx: Fix error path in stmfx_chip_init
    - mfd: stmfx: Nullify stmfx->vdd in case of error
    - KVM: s390: vsie: fix the length of APCB bitmap
    - KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler
    - mfd: stmpe: Only disable the regulators if they are enabled
    - phy: tegra: xusb: check return value of devm_kzalloc()
    - pwm: imx-tpm: force 'real_period' to be zero in suspend
    - pwm: sysfs: Do not apply state to already disabled PWMs
    - pwm: ab8500: Fix error code in probe()
    - pwm: mtk_disp: Fix the disable flow of disp_pwm
    - md/raid10: fix the condition to call bio_end_io_acct()
    - rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
    - drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake times
    - media: cec: i2c: ch7322: also select REGMAP
    - sctp: fix potential deadlock on &net->sctp.addr_wq_lock
    - net/sched: act_ipt: add sanity checks on table name and hook locations
    - Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
    - ibmvnic: Do not reset dql stats on NON_FATAL err
    - net: dsa: vsc73xx: fix MTU configuration
    - spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
    - mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
    - f2fs: fix error path handling in truncate_dnode()
    - octeontx2-af: Fix mapping for NIX block from CGX connection
    - octeontx2-af: Add validation before accessing cgx and lmac
    - ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
    - powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
    - net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
    - tcp: annotate data races in __tcp_oow_rate_limited()
    - xsk: Honor SO_BINDTODEVICE on bind
    - net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
    - riscv: move memblock_allow_resize() after linear mapping is ready
    - pptp: Fix fib lookup calls.
    - net: dsa: tag_sja1105: fix MAC DA patching from meta frames
    - octeontx-af: fix hardware timestamp configuration
    - s390/qeth: Fix vipa deletion
    - sh: dma: Fix DMA channel offset calculation
    - apparmor: fix missing error check for rhashtable_insert_fast
    - i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process()
    - i2c: xiic: Don't try to handle more interrupt events after error
    - extcon: usbc-tusb320: Convert to i2c's .probe_new()
    - btrfs: do not BUG_ON() on tree mod log failure at balance_level()
    - i2c: qup: Add missing unwind goto in qup_i2c_probe()
    - NFSD: add encoding of op_recall flag for write delegation
    - io_uring: wait interruptibly for request completions on exit
    - mmc: core: disable TRIM on Kingston EMMC04G-M627
    - mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
    - mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS
    - mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is
      used.
    - bcache: fixup btree_cache_wait list damage
    - bcache: Remove unnecessary NULL point check in node allocations
    - bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
    - um: Use HOST_DIR for mrproper
    - integrity: Fix possible multiple allocation in integrity_inode_get()
    - autofs: use flexible array in ioctl structure
    - shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs
    - ext4: Remove ext4 locking of moved directory
    - Revert "f2fs: fix potential corruption when moving a directory"
    - fs: Establish locking order for unrelated directories
    - fs: Lock moved directories
    - ipvs: increase ip_vs_conn_tab_bits range for 64BIT
    - jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
    - fs: avoid empty option when generating legacy mount string
    - btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile
    - btrfs: delete unused BGs while reclaiming BGs
    - btrfs: bail out reclaim process if filesystem is read-only
    - btrfs: reinsert BGs failed to reclaim
    - btrfs: fix race when deleting quota root from the dirty cow roots list
    - btrfs: fix extent buffer leak after tree mod log failure at split_node()
    - btrfs: do not BUG_ON() on tree mod log failure at __btrfs_cow_block()
    - ASoC: mediatek: mt8173: Fix irq error path
    - ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path
    - ARM: dts: qcom: ipq4019: fix broken NAND controller properties override
    - ARM: orion5x: fix d2net gpio initialization
    - leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename
    - fs: no need to check source
    - ovl: fix null pointer dereference in ovl_get_acl_rcu()
    - fanotify: disallow mount/sb marks on kernel internal pseudo fs
    - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
    - wireguard: queueing: use saner cpu selection wrapping
    - wireguard: netlink: send staged packets when setting initial private key
    - tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
    - block/partition: fix signedness issue for Amiga partitions
    - io_uring: Use io_schedule* in cqring wait
    - io_uring: add reschedule point to handle_tw_list()
    - net: lan743x: Don't sleep in atomic context
    - workqueue: clean up WORK_* constant types, clarify masking
    - ksmbd: use ksmbd_req_buf_next() in ksmbd_smb2_check_message()
    - ksmbd: validate command payload size
    - ksmbd: fix out-of-bound read in smb2_write
    - ksmbd: validate session id and tree id in the compound request
    - drm/panel: simple: Add connector_type for innolux_at043tn24
    - drm/bridge: ti-sn65dsi86: Fix auxiliary bus lifetime
    - drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags
    - igc: Remove delay during TX ring configuration
    - net/mlx5e: fix double free in mlx5e_destroy_flow_table
    - net/mlx5e: fix memory leak in mlx5e_ptp_open
    - net/mlx5e: Check for NOT_READY flag state after locking
    - igc: set TP bit in 'supported' and 'advertising' fields of
      ethtool_link_ksettings
    - igc: Handle PPS start time programming for past time values
    - scsi: qla2xxx: Fix error code in qla2x00_start_sp()
    - bpf: Fix max stack depth check for async callbacks
    - net: mvneta: fix txq_map in case of txq_number==1
    - gve: Set default duplex configuration to full
    - ionic: remove WARN_ON to prevent panic_on_warn
    - net: bgmac: postpone turning IRQs off to avoid SoC hangs
    - net: prevent skb corruption on frag list segmentation
    - icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
    - udp6: fix udp6_ehashfn() typo
    - ntb: idt: Fix error handling in idt_pci_driver_init()
    - NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
    - ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
    - NTB: ntb_transport: fix possible memory leak while device_register() fails
    - NTB: ntb_tool: Add check for devm_kcalloc
    - ipv6/addrconf: fix a potential refcount underflow for idev
    - platform/x86: wmi: remove unnecessary argument
    - platform/x86: wmi: use guid_t and guid_equal()
    - platform/x86: wmi: move variables
    - platform/x86: wmi: Break possible infinite loop when parsing GUID
    - kernel/trace: Fix cleanup logic of enable_trace_eprobe
    - igc: Fix launchtime before start of cycle
    - igc: Fix inserting of empty frame for launchtime
    - bpf, riscv: Support riscv jit to provide bpf_line_info
    - riscv, bpf: Fix inconsistent JIT image generation
    - drm/i915: Fix one wrong caching mode enum usage
    - octeontx2-pf: Add additional check for MCAM rules
    - erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF
    - erofs: decouple basic mount options from fs_context
    - erofs: fix fsdax unavailability for chunk-based regular files
    - wifi: airo: avoid uninitialized warning in airo_get_rate()
    - bpf: cpumap: Fix memory leak in cpu_map_update_elem
    - net/sched: flower: Ensure both minimum and maximum ports are specified
    - riscv: mm: fix truncation warning on RV32
    - netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write()
    - net/sched: make psched_mtu() RTNL-less safe
    - nvme-pci: remove nvme_queue from nvme_iod
    - nvme-pci: fix DMA direction of unmapping integrity data
    - pinctrl: amd: Fix mistake in handling clearing pins at startup
    - pinctrl: amd: Detect internal GPIO0 debounce handling
    - pinctrl: amd: Detect and mask spurious interrupts
    - pinctrl: amd: Only use special debounce behavior for GPIO 0
    - tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
    - mtd: rawnand: meson: fix unaligned DMA buffers handling
    - net: bcmgenet: Ensure MDIO unregistration has clocks enabled
    - mm/damon/ops-common: atomically test and clear young on ptes and pmds
    - powerpc: Fail build if using recordmcount with binutils v2.37
    - misc: fastrpc: Create fastrpc scalar with correct buffer count
    - powerpc/security: Fix Speculation_Store_Bypass reporting on Power10
    - arm64: errata: Add detection for TRBE overwrite in FILL mode
    - erofs: fix compact 4B support for 16k block size
    - MIPS: Loongson: Fix cpu_probe_loongson() again
    - MIPS: KVM: Fix NULL pointer dereference
    - ext4: Fix reusing stale buffer heads from last failed mounting
    - ext4: fix wrong unit use in ext4_mb_clear_bb
    - ext4: get block from bh in ext4_free_blocks for fast commit replay
    - ext4: fix wrong unit use in ext4_mb_new_blocks
    - ext4: fix to check return value of freeze_bdev() in ext4_shutdown()
    - ext4: turn quotas off if mount failed after enabling quotas
    - ext4: only update i_reserved_data_blocks on successful block allocation
    - jfs: jfs_dmap: Validate db_l2nbperpage while mounting
    - hwrng: imx-rngc - fix the timeout for init and self check
    - dm integrity: reduce vmalloc space footprint on 32-bit architectures
    - PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold
    - PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
    - PCI: qcom: Disable write access to read only registers for IP v2.3.3
    - PCI: rockchip: Assert PCI Configuration Enable bit after probe
    - PCI: rockchip: Write PCI Device ID to correct register
    - PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked
    - PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core
    - PCI: rockchip: Use u32 variable to access 32-bit registers
    - PCI: rockchip: Set address alignment for endpoint mode
    - misc: pci_endpoint_test: Free IRQs before removing the device
    - misc: pci_endpoint_test: Re-init completion for every test
    - mfd: pm8008: Fix module autoloading
    - md/raid0: add discard support for the 'original' layout
    - dm init: add dm-mod.waitfor to wait for asynchronously probed block devices
    - fs: dlm: return positive pid value for F_GETLK
    - drm/atomic: Allow vblank-enabled + self-refresh "disable"
    - drm/rockchip: vop: Leave vblank enabled in self-refresh
    - drm/amdgpu: fix clearing mappings for BOs that are always valid in VM
    - drm/amd/display: Correct `DMUB_FW_VERSION` macro
    - drm/amdgpu: avoid restore process run into dead loop.
    - drm/ttm: Don't leak a resource on swapout move error
    - serial: atmel: don't enable IRQs prematurely
    - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in
      case of error
    - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when
      iterating clk
    - tty: serial: imx: fix rs485 rx after tx
    - firmware: stratix10-svc: Fix a potential resource leak in
      svc_create_memory_pool()
    - libceph: harden msgr2.1 frame segment length checks
    - ceph: don't let check_caps skip sending responses for revoke msgs
    - xhci: Fix resume issue of some ZHAOXIN hosts
    - xhci: Fix TRB prefetch issue of ZHAOXIN hosts
    - xhci: Show ZHAOXIN xHCI root hub speed correctly
    - meson saradc: fix clock divider mask length
    - opp: Fix use-after-free in lazy_opp_tables after probe deferral
    - soundwire: qcom: fix storing port config out-of-bounds
    - Revert "8250: add support for ASIX devices with a FIFO bug"
    - bus: ixp4xx: fix IXP4XX_EXP_T1_MASK
    - s390/decompressor: fix misaligned symbol build error
    - tracing/histograms: Add histograms to hist_vars if they have referenced
      variables
    - tracing: Fix memory leak of iter->temp when reading trace_pipe
    - samples: ftrace: Save required argument registers in sample trampolines
    - net: ena: fix shift-out-of-bounds in exponential backoff
    - ring-buffer: Fix deadloop issue on reading trace_pipe
    - ftrace: Fix possible warning on checking all pages used in
      ftrace_process_locs()
    - xtensa: ISS: fix call to split_if_spec
    - tracing: Fix null pointer dereference in tracing_err_log_open()
    - selftests: mptcp: sockopt: return error if wrong mark
    - selftests: mptcp: depend on SYN_COOKIES
    - tracing/probes: Fix not to count error code to total length
    - tracing/probes: Fix to update dynamic data counter if fetcharg uses it
    - scsi: qla2xxx: Wait for io return on terminate rport
    - scsi: qla2xxx: Array index may go out of bound
    - scsi: qla2xxx: Avoid fcport pointer dereference
    - scsi: qla2xxx: Fix buffer overrun
    - scsi: qla2xxx: Fix potential NULL pointer dereference
    - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
    - scsi: qla2xxx: Correct the index of array
    - scsi: qla2xxx: Pointer may be dereferenced
    - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
    - MIPS: kvm: Fix build error with KVM_MIPS_DEBUG_COP0_COUNTERS enabled
    - net/sched: sch_qfq: reintroduce lmax bound check for MTU
    - drm/atomic: Fix potential use-after-free in nonblocking commits
    - Linux 5.15.121
  * Jammy update: v5.15.120 upstream stable release (LP: #2032688)
    - mptcp: fix possible divide by zero in recvmsg()
    - mptcp: consolidate fallback and non fallback state machine
    - mm, hwpoison: try to recover from copy-on write faults
    - mm, hwpoison: when copy-on-write hits poison, take page offline
    - drm/amdgpu: Set vmbo destroy after pt bo is created
    - x86/microcode/AMD: Load late on both threads too
    - x86/smp: Use dedicated cache-line for mwait_play_dead()
    - can: isotp: isotp_sendmsg(): fix return error fix on TX path
    - bpf: ensure main program has an extable
    - HID: wacom: Use ktime_t rather than int when dealing with timestamps
    - HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651.
    - Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak
      in mtk_thermal_probe"
    - perf symbols: Symbol lookup with kcore can fail if multiple segments match
      stext
    - scripts/tags.sh: Resolve gtags empty index generation
    - drm/amdgpu: Validate VM ioctl flags.
    - parisc: Delete redundant register definitions in <asm/assembly.h>
    - nubus: Partially revert proc_create_single_data() conversion
    - Linux 5.15.120
  * Jammy update: v5.15.119 upstream stable release (LP: #2032683)
    - drm/amd/display: fix the system hang while disable PSR
    - tracing: Add tracing_reset_all_online_cpus_unlocked() function
    - tpm, tpm_tis: Claim locality in interrupt handler
    - drm/amd/display: Add minimal pipe split transition state
    - drm/amd/display: Use dc_update_planes_and_stream
    - drm/amd/display: Add wrapper to call planes and stream update
    - tick/common: Align tick period during sched_timer setup
    - selftests: mptcp: lib: skip if missing symbol
    - selftests: mptcp: lib: skip if not below kernel version
    - selftests/mount_setattr: fix redefine struct mount_attr build error
    - selftests: mptcp: pm nl: remove hardcoded default limits
    - selftests: mptcp: join: use 'iptables-legacy' if available
    - selftests: mptcp: join: skip check if MIB counter not supported
    - nilfs2: fix buffer corruption due to concurrent device reads
    - ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep()
    - KVM: Avoid illegal stage2 mapping on invalid memory slot
    - Drivers: hv: vmbus: Call hv_synic_free() if hv_synic_alloc() fails
    - Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs
    - PCI: hv: Fix a race condition bug in hv_pci_query_relations()
    - Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally"
    - PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev
    - PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic
    - PCI: hv: Add a per-bus mutex state_lock
    - cgroup: Do not corrupt task iteration when rebinding subsystem
    - mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916
    - mmc: meson-gx: remove redundant mmc_request_done() call from irq context
    - mmc: mmci: stm32: fix max busy timeout calculation
    - ip_tunnels: allow VXLAN/GENEVE to inherit TOS/TTL from VLAN
    - regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK
    - regmap: spi-avmm: Fix regmap_bus max_raw_write
    - writeback: fix dereferencing NULL mapping->host on writeback_page_template
    - io_uring/net: save msghdr->msg_control for retries
    - io_uring/net: clear msg_controllen on partial sendmsg retry
    - io_uring/net: disable partial retries for recvmsg with cmsg
    - nilfs2: prevent general protection fault in nilfs_clear_dirty_page()
    - x86/mm: Avoid using set_pgd() outside of real PGD pages
    - memfd: check for non-NULL file_seals in memfd_create() syscall
    - mmc: meson-gx: fix deferred probing
    - ieee802154: hwsim: Fix possible memory leaks
    - xfrm: Treat already-verified secpath entries as optional
    - xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c
    - xfrm: Ensure policies always checked on XFRM-I input path
    - bpf: track immediate values written to stack by BPF_ST instruction
    - bpf: Fix verifier id tracking of scalars on spill
    - xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets
    - selftests: net: fcnal-test: check if FIPS mode is enabled
    - xfrm: Linearize the skb after offloading if needed.
    - net: qca_spi: Avoid high load if QCA7000 is not available
    - mmc: mtk-sd: fix deferred probing
    - mmc: mvsdio: fix deferred probing
    - mmc: omap: fix deferred probing
    - mmc: omap_hsmmc: fix deferred probing
    - mmc: owl: fix deferred probing
    - mmc: sdhci-acpi: fix deferred probing
    - mmc: sh_mmcif: fix deferred probing
    - mmc: usdhi60rol0: fix deferred probing
    - ipvs: align inner_mac_header for encapsulation
    - net: dsa: mt7530: fix trapping frames on non-MT7621 SoC MT7530 switch
    - net: dsa: mt7530: fix handling of BPDUs on MT7530 switch
    - be2net: Extend xmit workaround to BE3 chip
    - netfilter: nft_set_pipapo: .walk does not deal with generations
    - netfilter: nf_tables: disallow element updates of bound anonymous sets
    - netfilter: nf_tables: reject unbound anonymous set before commit phase
    - netfilter: nf_tables: reject unbound chain set before commit phase
    - netfilter: nf_tables: disallow updates of anonymous sets
    - netfilter: nfnetlink_osf: fix module autoload
    - Revert "net: phy: dp83867: perform soft reset and retain established link"
    - bpf/btf: Accept function names that contain dots
    - selftests: forwarding: Fix race condition in mirror installation
    - sch_netem: acquire qdisc lock in netem_change()
    - gpio: Allow per-parent interrupt data
    - gpiolib: Fix GPIO chip IRQ initialization restriction
    - gpio: sifive: add missing check for platform_get_irq
    - scsi: target: iscsi: Prevent login threads from racing between each other
    - HID: wacom: Add error check to wacom_parse_and_register()
    - arm64: Add missing Set/Way CMO encodings
    - media: cec: core: don't set last_initiator if tx in progress
    - nfcsim.c: Fix error checking for debugfs_create_dir
    - usb: gadget: udc: fix NULL dereference in remove()
    - nvme: double KA polling frequency to avoid KATO with TBKAS on
    - Input: soc_button_array - add invalid acpi_index DMI quirk handling
    - s390/cio: unregister device when the only path is gone
    - spi: lpspi: disable lpspi module irq in DMA mode
    - ASoC: simple-card: Add missing of_node_put() in case of error
    - soundwire: dmi-quirks: add new mapping for HP Spectre x360
    - ASoC: nau8824: Add quirk to active-high jack-detect
    - s390/purgatory: disable branch profiling
    - ARM: dts: Fix erroneous ADS touchscreen polarities
    - drm/exynos: vidi: fix a wrong error return
    - drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl
    - drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl
    - vhost_net: revert upend_idx only on retriable error
    - x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys
    - i2c: imx-lpi2c: fix type char overflow issue when calculating the clock
      cycle
    - act_mirred: remove unneded merge conflict markers
    - Linux 5.15.119
  * Jammy update: v5.15.118 upstream stable release (LP: #2030239)
    - test_firmware: Use kstrtobool() instead of strtobool()
    - test_firmware: prevent race conditions by a correct implementation of
      locking
    - test_firmware: fix a memory leak with reqs buffer
    - ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate
    - drm/amdgpu: fix Null pointer dereference error in amdgpu_device_recover_vram
    - of: overlay: rename variables to be consistent
    - of: overlay: rework overlay apply and remove kfree()s
    - of: overlay: Fix missing of_node_put() in error case of
      init_overlay_changeset()
    - power: supply: ab8500: Fix external_power_changed race
    - power: supply: sc27xx: Fix external_power_changed race
    - power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() +
      schedule()
    - ARM: dts: vexpress: add missing cache properties
    - tools: gpio: fix debounce_period_us output of lsgpio
    - power: supply: Ratelimit no data debug output
    - platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0
    - regulator: Fix error checking for debugfs_create_dir
    - irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues
    - power: supply: Fix logic checking if system is running from battery
    - btrfs: scrub: try harder to mark RAID56 block groups read-only
    - btrfs: handle memory allocation failure in btrfs_csum_one_bio
    - ASoC: soc-pcm: test if a BE can be prepared
    - parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu()
    - parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory()
    - MIPS: unhide PATA_PLATFORM
    - MIPS: Alchemy: fix dbdma2
    - mips: Move initrd_start check after initrd address sanitisation.
    - ASoC: dwc: move DMA init to snd_soc_dai_driver probe()
    - xen/blkfront: Only check REQ_FUA for writes
    - drm:amd:amdgpu: Fix missing buffer object unlock in failure path
    - NVMe: Add MAXIO 1602 to bogus nid list.
    - irqchip/gic: Correctly validate OF quirk descriptors
    - wifi: cfg80211: fix locking in regulatory disconnect
    - wifi: cfg80211: fix double lock bug in reg_wdev_chan_valid()
    - epoll: ep_autoremove_wake_function should use list_del_init_careful
    - ocfs2: fix use-after-free when unmounting read-only filesystem
    - ocfs2: check new file size on fallocate call
    - nios2: dts: Fix tse_mac "max-frame-size" property
    - nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key()
    - nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
    - kexec: support purgatories with .text.hot sections
    - x86/purgatory: remove PGO flags
    - powerpc/purgatory: remove PGO flags
    - ALSA: usb-audio: Add quirk flag for HEM devices to enable native DSD
      playback
    - dm thin metadata: check fail_io before using data_sm
    - nouveau: fix client work fence deletion race
    - RDMA/uverbs: Restrict usage of privileged QKEYs
    - net: usb: qmi_wwan: add support for Compal RXM-G1
    - drm/amdgpu: add missing radeon secondary PCI ID
    - ALSA: hda/realtek: Add a quirk for Compaq N14JP6
    - Remove DECnet support from kernel
    - [Config] updateconfigs for DECNET
    - thunderbolt: dma_test: Use correct value for absent rings when creating
      paths
    - thunderbolt: Mask ring interrupt on Intel hardware as well
    - USB: serial: option: add Quectel EM061KGL series
    - serial: lantiq: add missing interrupt ack
    - usb: dwc3: gadget: Reset num TRBs before giving back the request
    - RDMA/rtrs: Fix the last iu->buf leak in err path
    - RDMA/rtrs: Fix rxe_dealloc_pd warning
    - RDMA/rxe: Fix packet length checks
    - spi: fsl-dspi: avoid SCK glitches with continuous transfers
    - netfilter: nf_tables: integrate pipapo into commit protocol
    - netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
    - net: enetc: correct the indexes of highest and 2nd highest TCs
    - ping6: Fix send to link-local addresses with VRF.
    - net/sched: simplify tcf_pedit_act
    - net/sched: act_pedit: remove extra check for key type
    - net/sched: act_pedit: Parse L3 Header for L4 offset
    - RDMA/rxe: Remove the unused variable obj
    - RDMA/rxe: Removed unused name from rxe_task struct
    - RDMA/rxe: Fix the use-before-initialization error of resp_pkts
    - iavf: remove mask from iavf_irq_enable_queues()
    - octeontx2-af: fixed resource availability check
    - octeontx2-af: fix lbk link credits on cn10k
    - RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions
    - RDMA/cma: Always set static rate to 0 for RoCE
    - IB/uverbs: Fix to consider event queue closing also upon non-blocking mode
    - IB/isert: Fix dead lock in ib_isert
    - IB/isert: Fix possible list corruption in CMA handler
    - IB/isert: Fix incorrect release of isert connection
    - net: ethtool: correct MAX attribute value for stats
    - ipvlan: fix bound dev checking for IPv6 l3s mode
    - sctp: fix an error code in sctp_sf_eat_auth()
    - igc: Clean the TX buffer and TX descriptor ring
    - igb: fix nvm.ops.read() error handling
    - drm/nouveau: don't detect DSM for non-NVIDIA device
    - drm/nouveau/dp: check for NULL nv_connector->native_mode
    - drm/nouveau: add nv_encoder pointer check for NULL
    - cifs: fix lease break oops in xfstest generic/098
    - ext4: drop the call to ext4_error() from ext4_get_group_info()
    - net/sched: cls_api: Fix lockup on flushing explicitly created chain
    - net: lapbether: only support ethernet devices
    - dm: don't lock fs when the map is NULL during suspend or resume
    - net: tipc: resize nlattr array to correct size
    - selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET
    - afs: Fix vlserver probe RTT handling
    - cgroup: always put cset in cgroup_css_set_put_fork
    - rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period
    - neighbour: Remove unused inline function neigh_key_eq16()
    - net: Remove unused inline function dst_hold_and_use()
    - net: Remove DECnet leftovers from flow.h.
    - neighbour: delete neigh_lookup_nodev as not used
    - of: overlay: add entry to of_overlay_action_name[]
    - mmc: block: ensure error propagation for non-blk
    - nilfs2: reject devices with insufficient block count
    - Linux 5.15.118
  * Jammy update: v5.15.117 upstream stable release (LP: #2030107)
    - ata: ahci: fix enum constants for gcc-13
    - gcc-plugins: Reorganize gimple includes for GCC 13
    - remove the sx8 block driver
    - [Config] updateconfigs for BLK_DEV_SX8
    - sfc (gcc13): synchronize ef100_enqueue_skb()'s return type
    - i40e: Remove string printing for i40e_status
    - i40e: use int for i40e_status
    - i40e: fix build warning in ice_fltr_add_mac_to_list()
    - bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
    - f2fs: fix iostat lock protection
    - blk-iocost: avoid 64-bit division in ioc_timer_fn
    - platform/surface: aggregator: Allow completion work-items to be executed in
      parallel
    - spi: qup: Request DMA before enabling clocks
    - afs: Fix setting of mtime when creating a file/dir/symlink
    - wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll
    - neighbour: fix unaligned access to pneigh_entry
    - net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methods
    - bpf: Fix UAF in task local storage
    - net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down
    - net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT
    - net: enetc: correct the statistics of rx bytes
    - net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values
    - drm/i915: Explain the magic numbers for AUX SYNC/precharge length
    - drm/i915: Use 18 fast wake AUX sync len
    - Bluetooth: Fix l2cap_disconnect_req deadlock
    - Bluetooth: L2CAP: Add missing checks for invalid DCID
    - qed/qede: Fix scheduling while atomic
    - wifi: cfg80211: fix locking in sched scan stop work
    - selftests/bpf: Verify optval=NULL case
    - selftests/bpf: Fix sockopt_sk selftest
    - netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper
    - netfilter: ipset: Add schedule point in call_ad().
    - ipv6: rpl: Fix Route of Death.
    - rfs: annotate lockless accesses to sk->sk_rxhash
    - rfs: annotate lockless accesses to RFS sock flow table
    - drm/i915/selftests: Increase timeout for live_parallel_switch
    - drm/i915/selftests: Stop using kthread_stop()
    - drm/i915/selftests: Add some missing error propagation
    - net: sched: move rtm_tca_policy declaration to include file
    - net: sched: act_police: fix sparse errors in tcf_police_dump()
    - net: sched: fix possible refcount leak in tc_chain_tmplt_add()
    - bpf: Add extra path pointer check to d_path helper
    - lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
    - bnxt_en: Don't issue AP reset during ethtool's reset operation
    - bnxt_en: Query default VLAN before VNIC setup on a VF
    - bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
    - batman-adv: Broken sync while rescheduling delayed work
    - Input: xpad - delete a Razer DeathAdder mouse VID/PID entry
    - Input: psmouse - fix OOB access in Elantech protocol
    - Input: fix open count when closing inhibited device
    - ALSA: hda/realtek: Add quirk for Clevo NS50AU
    - ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01
    - drm/i915/gt: Use the correct error value when kernel_context() fails
    - drm/amd/pm: conditionally disable pcie lane switching for some
      sienna_cichlid SKUs
    - drm/amdgpu: fix xclk freq on CHIP_STONEY
    - drm/amd/pm: Fix power context allocation in SMU13
    - can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in
      J1939 Socket
    - can: j1939: change j1939_netdev_lock type to mutex
    - can: j1939: avoid possible use-after-free when j1939_can_rx_register fails
    - ceph: fix use-after-free bug for inodes when flushing capsnaps
    - s390/dasd: Use correct lock while counting channel queue length
    - Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk
    - Bluetooth: hci_qca: fix debugfs registration
    - tee: amdtee: Add return_origin to 'struct tee_cmd_load_ta'
    - rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting
    - rbd: get snapshot context after exclusive lock is ensured to be held
    - pinctrl: meson-axg: add missing GPIOA_18 gpio group
    - usb: usbfs: Enforce page requirements for mmap
    - usb: usbfs: Use consistent mmap functions
    - ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc
    - ASoC: codecs: wsa881x: do not set can_multi_write flag
    - arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified sc7180-lite
      boards
    - arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals
    - arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts
    - ASoC: mediatek: mt8195-afe-pcm: Convert to platform remove callback
      returning void
    - ASoC: mediatek: mt8195: fix use-after-free in driver remove path
    - arm64: dts: imx8mn-beacon: Fix SPI CS pinmux
    - i2c: mv64xxx: Fix reading invalid status value in atomic mode
    - firmware: arm_ffa: Set handle field to zero in memory descriptor
    - i2c: sprd: Delete i2c adapter in .remove's error path
    - eeprom: at24: also select REGMAP
    - riscv: fix kprobe __user string arg print fault issue
    - vduse: avoid empty string for dev name
    - vhost: support PACKED when setting-getting vring_base
    - vhost_vdpa: support PACKED when setting-getting vring_base
    - ext4: only check dquot_initialize_needed() when debugging
    - Linux 5.15.117
  * CVE-2023-4273
    - exfat: check if filename entries exceeds max filename length
  * CVE-2023-4128
    - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-
      free
    - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-
      free
    - net/sched: cls_route: No longer copy tcf_result on update to avoid use-
      after-free
  * CVE-2023-3863
    - nfc: llcp: simplify llcp_sock_connect() error paths
    - net: nfc: Fix use-after-free caused by nfc_llcp_find_local

 -- John Cabaj <john.cabaj@canonical.com>  Fri, 08 Sep 2023 13:43:57 -0500

linux-ibm-5.15 (5.15.0-1038.41~20.04.1) focal; urgency=medium

  * focal/linux-ibm-5.15: 5.15.0-1038.41~20.04.1 -proposed tracker
    (LP: #2034174)

  [ Ubuntu: 5.15.0-1038.41 ]

  * jammy/linux-ibm: 5.15.0-1038.41 -proposed tracker (LP: #2034175)
  * jammy/linux: 5.15.0-84.93 -proposed tracker (LP: #2034202)
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
  * CVE-2023-4569
    - netfilter: nf_tables: deactivate catchall elements in next generation
  * CVE-2023-40283
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
  * CVE-2023-20588
    - x86/bugs: Increase the x86 bugs vector size to two u32s
    - x86/CPU/AMD: Do not leak quotient data after a division by 0
    - x86/CPU/AMD: Fix the DIV(0) initial fix attempt
  * CVE-2023-4128
    - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-
      free
    - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-
      free
    - net/sched: cls_route: No longer copy tcf_result on update to avoid use-
      after-free

 -- John Cabaj <john.cabaj@canonical.com>  Wed, 06 Sep 2023 14:26:49 -0500

# For older changelog entries, run 'apt-get changelog linux-modules-5.15.0-1047-ibm'
