Oracle Linux Security Advisory ELSA-2023-12858

https://linux.oracle.com/errata/ELSA-2023-12858.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
bpftool-5.15.0-106.131.4.el9uek.x86_64.rpm
kernel-uek-5.15.0-106.131.4.el9uek.x86_64.rpm
kernel-uek-core-5.15.0-106.131.4.el9uek.x86_64.rpm
kernel-uek-debug-5.15.0-106.131.4.el9uek.x86_64.rpm
kernel-uek-debug-core-5.15.0-106.131.4.el9uek.x86_64.rpm
kernel-uek-debug-devel-5.15.0-106.131.4.el9uek.x86_64.rpm
kernel-uek-debug-modules-5.15.0-106.131.4.el9uek.x86_64.rpm
kernel-uek-debug-modules-extra-5.15.0-106.131.4.el9uek.x86_64.rpm
kernel-uek-devel-5.15.0-106.131.4.el9uek.x86_64.rpm
kernel-uek-doc-5.15.0-106.131.4.el9uek.noarch.rpm
kernel-uek-modules-5.15.0-106.131.4.el9uek.x86_64.rpm
kernel-uek-modules-extra-5.15.0-106.131.4.el9uek.x86_64.rpm
kernel-uek-container-5.15.0-106.131.4.el9uek.x86_64.rpm
kernel-uek-container-debug-5.15.0-106.131.4.el9uek.x86_64.rpm



SRPMS:
https://oss.oracle.com/ol9/SRPMS-updates//kernel-uek-5.15.0-106.131.4.el9uek.src.rpm

Related CVEs:

CVE-2023-20588
CVE-2023-22024
CVE-2023-42753




Description of changes:

[5.15.0-106.131.4.el9uek]
- jbd2: check 'jh->b_transaction' before removing it from checkpoint (Zhihao Cheng) 
- jbd2: fix checkpoint cleanup performance regression (Zhang Yi) 
- scsi: qla2xxx: Fix TMF leak through (Quinn Tran) 
- scsi: qla2xxx: Fix command flush during TMF (Quinn Tran) 
- scsi: qla2xxx: Limit TMF to 8 per function (Quinn Tran) 
- Revert "drm/amdgpu: install stub fence into potential unused fence pointers" (Greg Kroah-Hartman) 
- dlm: fix plock lookup when using multiple lockspaces (Alexander Aring) 
- Revert "scsi: qla2xxx: Fix buffer overrun" (Nilesh Javali) 
- media: dvb: symbol fixup for dvb_attach() (Greg Kroah-Hartman) 
- PCI: rockchip: Use 64-bit mask on MSI 64-bit PCI address (Rick Wertenbroek) 
- x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (Dave Hansen) 
- clk: qcom: reset: Use the correct type of sleep/delay based on length (Konrad Dybcio) 
- ALSA: ac97: Fix possible error value of *rac97 (Su Hui) 
- md/raid0: Fix performance regression for large sequential writes (Jan Kara) 
- md/raid0: Factor out helper for mapping and submitting a bio (Jan Kara) 
- md: add error_handlers for raid0 and linear (Mariusz Tkaczyk) 
- md: Set MD_BROKEN for RAID1 and RAID10 (Mariusz Tkaczyk) 
- LTS version: v5.15.131 (Jack Vogel) 
- usb: typec: tcpci: clear the fault status bit (Marco Felsch) 
- usb: typec: tcpci: move tcpci.h to include/linux/usb/ (Xin Ji) 
- pinctrl: amd: Don't show Invalid config param errors (Mario Limonciello) 
- nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (Ryusuke Konishi) 
- nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi) 
- tcpm: Avoid soft reset when partner does not support get_status (Badhri Jagan Sridharan) 
- fsi: master-ast-cf: Add MODULE_FIRMWARE macro (Juerg Haefliger) 
- firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe (Wang Ming) 
- serial: sc16is7xx: fix bug when first setting GPIO direction (Hugo Villeneuve) 
- serial: sc16is7xx: fix broken port 0 uart init (Hugo Villeneuve) 
- serial: qcom-geni: fix opp vote on shutdown (Johan Hovold) 
- wifi: mt76: mt7921: do not support one stream on secondary antenna only (Deren Wu) 
- Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang) 
- staging: rtl8712: fix race condition (Nam Cao) 
- HID: wacom: remove the battery when the EKR is off (Aaron Armstrong Skomra) 
- usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0 (Xu Yang) 
- usb: dwc3: meson-g12a: do post init to fix broken usb after resumption (Luke Lu) 
- ALSA: usb-audio: Fix init call orders for UAC1 (Takashi Iwai) 
- USB: serial: option: add FOXCONN T99W368/T99W373 product (Slark Xiao) 
- USB: serial: option: add Quectel EM05G variant (0x030e) (Martin Kohn) 
- modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules (Christoph Hellwig) 
- rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff (Christoph Hellwig) 
- net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index (Christoph Hellwig) 
- mmc: au1xmmc: force non-modular build and remove symbol_get usage (Christoph Hellwig) 
- ARM: pxa: remove use of symbol_get() (Arnd Bergmann) 
- ksmbd: replace one-element array with flex-array member in struct smb2_ea_info (Namjae Jeon) 
- ksmbd: fix wrong DataOffset validation of create context (Namjae Jeon) 
- erofs: ensure that the post-EOF tails are all zeroed (Gao Xiang) 
- netfilter: nfnetlink_osf: avoid OOB read (Wander Lairson Costa)  [Orabug: 35824286]
- netfilter: nftables: exthdr: fix 4-byte stack OOB write (Florian Westphal)  [Orabug: 35824286]
- netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa)  [Orabug: 35824286]
- netfilter: xt_u32: validate user space input (Wander Lairson Costa)  [Orabug: 35824286]
- netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng)  [Orabug: 35824286]  {CVE-2023-42753}
- rds: Fix lack of reentrancy for connection reset with dst addr zero (HÃ¥kon Bugge)  [Orabug: 35655833]  {CVE-2023-22024}
- attr: use consistent sgid stripping checks (Christian Brauner)  [Orabug: 35520042]
- Revert "perf build-ids: Fall back to debuginfod query if debuginfo not found" (Samasth Norway Ananda)  [Orabug: 35617848]
- KEYS: use kfree_sensitive with key (Saeed Mirzamohammadi)  [Orabug: 35746757]
- kernfs: fix missing kernfs_iattr_rwsem locking (Ian Kent)  [Orabug: 35796770]
- scsi: megaraid_sas: Fix deadlock on firmware crashdump (Junxiao Bi)  [Orabug: 35819592]

[5.15.0-106.130.3.el9uek]
- KVM: arm64: Skip instruction after emulating write to TCR_EL1 (Oliver Upton)  [Orabug: 35677037]
- uek-rpm: aarch64: enable ACPI_AGDI (Mihai Carabas)  [Orabug: 35761254]
- arm64: sdei: abort running SDEI handlers during crash (D Scott Phillips)  [Orabug: 35761254]
- ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init() (Ilkka Koskinen)  [Orabug: 35761254]
- ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device (Ilkka Koskinen)  [Orabug: 35761254]
- ACPI: tables: Add AGDI to the list of known table signatures (Ilkka Koskinen)  [Orabug: 35761254]
- ACPICA: iASL: Add suppport for AGDI table (Ilkka Koskinen)  [Orabug: 35761254]
- net/rds: Avoid unpin_user_pages_dirty_lock() in tasklets (Gerd Rausch)  [Orabug: 35765163]
- x86/CPU/AMD: Fix the DIV(0) initial fix attempt (Borislav Petkov (AMD))  [Orabug: 35776935]  {CVE-2023-20588}
- x86/CPU/AMD: Do not leak quotient data after a division by 0 (Borislav Petkov (AMD))  [Orabug: 35776935]  {CVE-2023-20588}
- x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl (Andrea Arcangeli)  [Orabug: 35778852]

[5.15.0-106.130.2.el9uek]
- LTS version: v5.15.130 (Jack Vogel) 
- rcu-tasks: Add trc_inspect_reader() checks for exiting critical section (Paul E. McKenney) 
- rcu-tasks: Wait for trc_read_check_handler() IPIs (Paul E. McKenney) 
- rcu-tasks: Fix IPI failure handling in trc_wait_for_one_reader (Neeraj Upadhyay) 
- rcu: Prevent expedited GP from enabling tick on offline CPU (Paul E. McKenney) 
- ARM: module: Use module_init_layout_section() to spot init sections (James Morse) 
- arm64: module: Use module_init_layout_section() to spot init sections (James Morse) 
- arm64: module-plts: inline linux/moduleloader.h (Arnd Bergmann) 
- module: Expose module_init_layout_section() (James Morse) 
- ACPI: thermal: Drop nocrt parameter (Mario Limonciello) 
- LTS version: v5.15.129 (Jack Vogel) 
- mm,ima,kexec,of: use memblock_free_late from ima_free_kexec_buffer (Rik van Riel) 
- mm: memory-failure: fix unexpected return value in soft_offline_page() (Miaohe Lin) 
- mm: memory-failure: kill soft_offline_free_page() (Kefeng Wang) 
- dma-buf/sw_sync: Avoid recursive lock during fence signal (Rob Clark) 
- pinctrl: renesas: rza2: Add lock around pinctrl_generic{{add,remove}_group,{add,remove}_function} (Biju Das) 
- clk: Fix undefined reference to clk_rate_exclusive_{get,put}' (Biju Das) 
- scsi: core: raid_class: Remove raid_component_add() (Zhu Wang) 
- scsi: snic: Fix double free in snic_tgt_create() (Zhu Wang) 
- can: raw: add missing refcount for memory leak fix (Oliver Hartkopp) 
- drm/i915: Fix premature release of request's reusable memory (Janusz Krzysztofik) 
- cgroup/cpuset: Free DL BW in case can_attach() fails (Dietmar Eggemann) 
- sched/deadline: Create DL BW alloc, free & check overflow interface (Dietmar Eggemann) 
- cgroup/cpuset: Iterate only if DEADLINE tasks are present (Juri Lelli) 
- sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets (Juri Lelli) 
- sched/cpuset: Bring back cpuset_mutex (Juri Lelli) 
- cgroup/cpuset: Rename functions dealing with DEADLINE accounting (Juri Lelli) 
- torture: Fix hang during kthread shutdown phase (Joel Fernandes (Google)) 
- nfsd: use vfs setgid helper (Christian Brauner) 
- nfs: use vfs setgid helper (Christian Brauner) 
- x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 (Feng Tang) 
- x86/fpu: Invalidate FPU state correctly on exec() (Rick Edgecombe) 
- drm/display/dp: Fix the DP DSC Receiver cap size (Ankit Nautiyal) 
- drm/vmwgfx: Fix shader stage validation (Zack Rusin) 
- PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus (Igor Mammedov) 
- media: vcodec: Fix potential array out-of-bounds in encoder queue_setup (Wei Chen) 
- of: dynamic: Refactor action prints to not use "%pOF" inside devtree_lock (Rob Herring) 
- of: unittest: Fix EXPECT for parse_phandle_with_args_map() test (Rob Herring) 
- radix tree: remove unused variable (Arnd Bergmann) 
- lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels (Helge Deller) 
- batman-adv: Hold rtnl lock during MTU update via netlink (Sven Eckelmann) 
- batman-adv: Fix batadv_v_ogm_aggr_send memory leak (Remi Pommarel) 
- batman-adv: Fix TT global entry leak when client roamed back (Remi Pommarel) 
- batman-adv: Do not get eth header before batadv_check_management_packet (Remi Pommarel) 
- batman-adv: Don't increase MTU when set by user (Sven Eckelmann) 
- batman-adv: Trigger events for auto adjusted MTU (Sven Eckelmann) 
- selinux: set next pointer before attaching to list (Christian Göttsche) 
- nfsd: Fix race to FREE_STATEID and cl_revoked (Benjamin Coddington) 
- NFS: Fix a use after free in nfs_direct_join_group() (Trond Myklebust) 
- mm: add a call to flush_cache_vmap() in vmap_pfn() (Alexandre Ghiti) 
- ALSA: ymfpci: Fix the missing snd_card_free() call at probe error (Takashi Iwai) 
- clk: Fix slab-out-of-bounds error in devm_clk_release() (Andrey Skvortsov) 
- NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) 
- ibmveth: Use dcbf rather than dcbfl (Michael Ellerman) 
- Revert "KVM: x86: enable TDP MMU by default" (Sean Christopherson) 
- net/ncsi: change from ndo_set_mac_address to dev_set_mac_address (Ivan Mikhaylov) 
- net/ncsi: make one oem_gma function for all mfr id (Ivan Mikhaylov) 
- bonding: fix macvlan over alb bond support (Hangbin Liu) 
- net: remove bond_slave_has_mac_rcu() (Jakub Kicinski) 
- rtnetlink: Reject negative ifindexes in RTM_NEWLINK (Ido Schimmel) 
- rtnetlink: return ENODEV when ifname does not exist and group is given (Florent Fourcot) 
- netfilter: nf_tables: fix out of memory error handling (Florian Westphal) 
- netfilter: nf_tables: flush pending destroy work before netlink notifier (Pablo Neira Ayuso) 
- net/sched: fix a qdisc modification with ambiguous command request (Jamal Hadi Salim) 
- igc: Fix the typo in the PTM Control macro (Sasha Neftin) 
- igb: Avoid starting unnecessary workqueues (Alessio Igor Bogani) 
- ice: fix receive buffer size miscalculation (Jesse Brandeburg) 
- net: validate veth and vxcan peer ifindexes (Jakub Kicinski) 
- net: bcmgenet: Fix return value check for fixed_phy_register() (Ruan Jinjie) 
- net: bgmac: Fix return value check for fixed_phy_register() (Ruan Jinjie) 
- ipvlan: Fix a reference count leak warning in ipvlan_ns_exit() (Lu Wei) 
- dccp: annotate data-races in dccp_poll() (Eric Dumazet) 
- sock: annotate data-races around prot->memory_pressure (Eric Dumazet) 
- octeontx2-af: SDP: fix receive link config (Hariprasad Kelam) 
- tracing: Fix memleak due to race between current_tracer and trace (Zheng Yejian) 
- tracing: Fix cpu buffers unavailable due to 'record_disabled' missed (Zheng Yejian) 
- can: raw: fix lockdep issue in raw_release() (Eric Dumazet) 
- drm/amd/display: check TG is non-null before checking if enabled (Taimur Hassan) 
- drm/amd/display: do not wait for mpc idle if tg is disabled (Josip Pavic) 
- can: raw: fix receiver memory leak (Ziyang Xuan) 
- jbd2: fix a race when checking checkpoint buffer busy (Zhang Yi) 
- jbd2: remove journal_clean_one_cp_list() (Zhang Yi) 
- jbd2: remove t_checkpoint_io_list (Zhang Yi) 
- ALSA: pcm: Fix potential data race at PCM memory allocation helpers (Takashi Iwai) 
- fbdev: fix potential OOB read in fast_imageblit() (Zhang Shurong) 
- fbdev: Fix sys_imageblit() for arbitrary image widths (Thomas Zimmermann) 
- fbdev: Improve performance of sys_imageblit() (Thomas Zimmermann) 
- MIPS: cpu-features: Use boot_cpu_type for CPU type based features (Jiaxun Yang) 
- MIPS: cpu-features: Enable octeon_cache by cpu_type (Jiaxun Yang) 
- fs: dlm: fix mismatch of plock results from userspace (Alexander Aring) 
- fs: dlm: use dlm_plock_info for do_unlock_close (Alexander Aring) 
- fs: dlm: change plock interrupted message to debug again (Alexander Aring) 
- fs: dlm: add pid to debug log (Alexander Aring) 
- dlm: replace usage of found with dedicated list iterator variable (Jakob Koschel) 
- dlm: improve plock logging if interrupted (Alexander Aring) 
- PCI: acpiphp: Reassign resources on bridge if necessary (Igor Mammedov) 
- xprtrdma: Remap Receive buffers after a reconnect (Chuck Lever) 
- NFSv4: fix out path in __nfs4_get_acl_uncached (Fedor Pchelkin) 
- NFSv4.2: fix error handling in nfs42_proc_getxattr (Fedor Pchelkin) 
- objtool/x86: Fix SRSO mess (Peter Zijlstra) 
- LTS version: v5.15.128 (Jack Vogel) 
- x86/srso: Correct the mitigation status when SMT is disabled (Borislav Petkov (AMD)) 
- objtool/x86: Fixup frame-pointer vs rethunk (Peter Zijlstra) 
- x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG (Petr Pavlu) 
- x86/srso: Disable the mitigation on unaffected configurations (Borislav Petkov (AMD)) 
- x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() (Sean Christopherson) 
- x86/static_call: Fix __static_call_fixup() (Peter Zijlstra) 
- x86/srso: Explain the untraining sequences a bit more (Borislav Petkov (AMD)) 
- x86/cpu: Cleanup the untrain mess (Peter Zijlstra) 
- x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 (Peter Zijlstra) 
- x86/cpu: Rename original retbleed methods (Peter Zijlstra) 
- x86/cpu: Clean up SRSO return thunk mess (Peter Zijlstra) 
- x86/ibt: Add ANNOTATE_NOENDBR (Peter Zijlstra) 
- objtool: Add frame-pointer-specific function ignore (Josh Poimboeuf) 
- x86/alternative: Make custom return thunk unconditional (Peter Zijlstra) 
- x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() (Peter Zijlstra) 
- x86/cpu: Fix __x86_return_thunk symbol type (Peter Zijlstra) 
- mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove (Yangtao Li) 
- net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled (Jason Xing) 
- virtio-net: set queues after driver_ok (Jason Wang) 
- af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima) 
- arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4 (Christopher Obbard) 
- exfat: check if filename entries exceeds max filename length (Namjae Jeon) 
- netfilter: set default timeout to 3 secs for sctp shutdown send and recv state (Xin Long) 
- drm/amd: flush any delayed gfxoff on suspend entry (Mario Limonciello) 
- drm/qxl: fix UAF on handle creation (Wander Lairson Costa) 
- mmc: block: Fix in_flight[issue_type] value error (Yibin Ding) 
- mmc: wbsd: fix double mmc_free_host() in wbsd_init() (Yang Yingliang) 
- cifs: Release folio lock on fscache read hit. (Russell Harmon via samba-technical) 
- ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. (dengxiang) 
- serial: 8250: Fix oops for port->pm on uart_change_pm() (Tony Lindgren) 
- riscv: uaccess: Return the number of bytes effectively not copied (Alexandre Ghiti) 
- ALSA: hda/realtek - Remodified 3k pull low procedure (Kailang Yang) 
- soc: aspeed: socinfo: Add kfree for kstrdup (Jiasheng Jiang) 
- ASoC: meson: axg-tdm-formatter: fix channel slot allocation (Jerome Brunet) 
- ASoC: rt5665: add missed regulator_bulk_disable (Zhang Shurong) 
- ARM: dts: imx: Set default tuning step for imx6sx usdhc (Xiaolei Wang) 
- arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (Dmitry Baryshkov) 
- bus: ti-sysc: Flush posted write on enable before reset (Tony Lindgren) 
- net: do not allow gso_size to be set to GSO_BY_FRAGS (Eric Dumazet) 
- sock: Fix misuse of sk_under_memory_pressure() (Abel Wu) 
- net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset (Alfred Lee) 
- i40e: fix misleading debug logs (Andrii Staikov) 
- iavf: fix FDIR rule fields masks validation (Piotr Gardocki) 
- team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan) 
- net: phy: broadcom: stub c45 read/write for 54810 (Justin Chen) 
- netfilter: nft_dynset: disallow object maps (Pablo Neira Ayuso) 
- ipvs: fix racy memcpy in proc_do_sync_threshold (Sishuai Gong) 
- netfilter: nf_tables: deactivate catchall elements in next generation (Florian Westphal) 
- netfilter: nf_tables: fix false-positive lockdep splat (Florian Westphal) 
- drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs (Luca Ceresoli) 
- selftests: mirror_gre_changes: Tighten up the TTL test match (Petr Machata) 
- net: phy: fix IRQ-based wake-on-lan over hibernate / power off (Russell King (Oracle)) 
- xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH (Lin Ma) 
- xfrm: add NULL check in xfrm_update_ae_params (Lin Ma) 
- ip_vti: fix potential slab-use-after-free in decode_session6 (Zhengchao Shao) 
- ip6_vti: fix slab-use-after-free in decode_session6 (Zhengchao Shao) 
- xfrm: fix slab-use-after-free in decode_session6 (Zhengchao Shao) 
- net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure (Lin Ma) 
- net: af_key: fix sadb_x_filter validation (Lin Ma) 
- net: xfrm: Fix xfrm_address_filter OOB read (Lin Ma) 
- i2c: designware: Handle invalid SMBus block data response length value (Tam Nguyen) 
- i2c: designware: Correct length byte validation logic (Quan Nguyen) 
- btrfs: fix BUG_ON condition in btrfs_cancel_balance (xiaoshoukui) 
- tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms (Sherry Sun) 
- tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux (Yi Yang) 
- powerpc/rtas_flash: allow user copy to flash block cache objects (Nathan Lynch) 
- fbdev: mmp: fix value check in mmphw_probe() (Yuanjun Gong) 
- i2c: hisi: Only handle the interrupt of the driver's transfer (Yicong Yang) 
- i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue (Chengfeng Ye) 
- cifs: fix potential oops in cifs_oplock_break (Steve French) 
- vduse: Use proper spinlock for IRQ injection (Maxime Coquelin) 
- virtio-mmio: don't break lifecycle of vm_dev (Wolfram Sang) 
- btrfs: move out now unused BG from the reclaim list (Naohiro Aota) 
- ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node (Xu Yang) 
- ARM: dts: imx6sll: fixup of operating points (Andreas Kemnade) 
- mmc: sunxi: fix deferred probing (Sergey Shtylyov) 
- mmc: bcm2835: fix deferred probing (Sergey Shtylyov) 
- USB: dwc3: fix use-after-free on core driver unbind (Johan Hovold) 
- USB: dwc3: qcom: fix NULL-deref on suspend (Johan Hovold) 
- tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A (Robert Hodaszi) 
- tty: serial: fsl_lpuart: make rx_watermark configurable for different platforms (Sherry Sun) 
- tty: serial: fsl_lpuart: Add i.MXRT1050 support (Jesse Taube) 
- usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume() (Roger Quadros) 
- USB: dwc3: gadget: drop dead hibernation code (Johan Hovold) 
- usb: dwc3: Fix typos in gadget.c (Kushagra Verma) 
- usb: dwc3: Remove DWC3 locking during gadget suspend/resume (Wesley Cheng) 
- usb: dwc3: gadget: Synchronize IRQ between soft connect/disconnect (Wesley Cheng) 
- drm/amd/display: fix access hdcp_workqueue assert (Hersen Wu) 
- drm/amd/display: phase3 mst hdcp for multiple displays (hersen wu) 
- drm/amd/display: save restore hdcp state when display is unplugged from mst hub (hersen wu) 
- ARM: dts: aspeed: asrock: Correct firmware flash SPI clocks (Zev Weiss) 
- igc: read before write to SRRCTL register (Song Yoong Siang) 
- iio: addac: stx104: Fix race condition when converting analog-to-digital (William Breathitt Gray) 
- iio: addac: stx104: Fix race condition for stx104_write_raw() (William Breathitt Gray) 
- iio: stx104: Move to addac subdirectory (William Breathitt Gray) 
- iio: adc: stx104: Implement and utilize register structures (William Breathitt Gray) 
- iio: adc: stx104: Utilize iomap interface (William Breathitt Gray) 
- iio: add addac subdirectory (Cosmin Tanislav) 
- ring-buffer: Do not swap cpu_buffer during resize process (Chen Lin) 
- powerpc/kasan: Disable KCOV in KASAN code (Benjamin Gray) 
- ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() (Tuo Li) 
- ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 (dengxiang) 
- fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted (Konstantin Komarov) 
- fs: ntfs3: Fix possible null-pointer dereferences in mi_read() (Jia-Ju Bai) 
- fs/ntfs3: Enhance sanity check while generating attr_list (Edward Lo) 
- drm/amdgpu: Fix potential fence use-after-free v2 (shanzhulig) 
- Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally (Matthew Anderson) 
- Bluetooth: L2CAP: Fix use-after-free (Zhengping Jiang) 
- watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub) (Yuechao Zhao) 
- firewire: net: fix use after free in fwnet_finish_incoming_packet() (Zhang Shurong) 
- pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() (Armin Wolf) 
- gfs2: Fix possible data races in gfs2_show_options() (Tuo Li) 
- usb: chipidea: imx: add missing USB PHY DPDM wakeup setting (Xu Yang) 
- usb: chipidea: imx: don't request QoS for imx8ulp (Xu Yang) 
- thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx() (Mika Westerberg) 
- media: platform: mediatek: vpu: fix NULL ptr dereference (Hans Verkuil) 
- usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push (Prashanth K) 
- media: v4l2-mem2mem: add lock to protect parameter num_rdy (Yunfei Dong) 
- smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) 
- ovl: check type and offset of struct vfsmount in ovl_entry (Christian Brauner) 
- RDMA/mlx5: Return the firmware result upon destroying QP/RQ (Patrisious Haddad) 
- HID: add quirk for 03f0:464a HP Elite Presenter Mouse (Marco Morandini) 
- drm/amdgpu: install stub fence into potential unused fence pointers (Lang Yu) 
- HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard (stuarthayhurst) 
- dma-remap: use kvmalloc_array/kvfree for larger dma memory remap (gaoxu) 
- ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion (Pierre-Louis Bossart) 
- iopoll: Call cpu_relax() in busy loops (Geert Uytterhoeven) 
- ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings (Oleksij Rempel) 
- PCI: tegra194: Fix possible array out of bounds access (Sumit Gupta) 
- net: tls: avoid discarding data on record close (Jakub Kicinski) 
- net/tls: Multi-threaded calls to TX tls_dev_del (Tariq Toukan) 
- net/tls: Perform immediate device ctx cleanup when possible (Tariq Toukan) 
- macsec: use DEV_STATS_INC() (Eric Dumazet) 
- macsec: Fix traffic counters/statistics (Clayton Yager) 
- selftests: forwarding: tc_actions: Use ncat instead of nc (Ido Schimmel) 
- selftests: forwarding: tc_actions: cleanup temporary files when test is aborted (Davide Caratti) 
- mmc: sdhci-f-sdh30: Replace with sdhci_pltfm (Kunihiko Hayashi) 
- LTS version: v5.15.127 (Jack Vogel) 
- timers/nohz: Last resort update jiffies on nohz_full IRQ entry (Frederic Weisbecker) 
- timers/nohz: Switch to ONESHOT_STOPPED in the low-res handler when the tick is stopped (Nicholas Piggin) 
- tick: Detect and fix jiffies update stall (Frederic Weisbecker) 
- sch_netem: fix issues in netem_change() vs get_dist_table() (Eric Dumazet) 
- alpha: remove __init annotation from exported page_is_ram() (Masahiro Yamada) 
- scsi: qedf: Fix firmware halt over suspend and resume (Nilesh Javali) 
- scsi: qedi: Fix firmware halt over suspend and resume (Nilesh Javali) 
- scsi: fnic: Replace return codes in fnic_clean_pending_aborts() (Karan Tilak Kumar) 
- scsi: core: Fix possible memory leak if device_add() fails (Zhu Wang) 
- scsi: snic: Fix possible memory leak if device_add() fails (Zhu Wang) 
- scsi: 53c700: Check that command slot is not NULL (Alexandra Diupina) 
- scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Michael Kelley) 
- scsi: core: Fix legacy /proc parsing buffer overflow (Tony Battersby) 
- netfilter: nf_tables: report use refcount overflow (Pablo Neira Ayuso) 
- nvme-rdma: fix potential unbalanced freeze & unfreeze (Ming Lei) 
- nvme-tcp: fix potential unbalanced freeze & unfreeze (Ming Lei) 
- btrfs: set cache_block_group_error if we find an error (Josef Bacik) 
- btrfs: reject invalid reloc tree root keys with stack dump (Qu Wenruo) 
- btrfs: exit gracefully if reloc roots don't match (Qu Wenruo) 
- btrfs: don't stop integrity writeback too early (Christoph Hellwig) 
- ibmvnic: Handle DMA unmapping of login buffs in release functions (Nick Child) 
- ibmvnic: Unmap DMA login rsp buffer on send login fail (Nick Child) 
- ibmvnic: Enforce stronger sanity checks on login response (Nick Child) 
- net/mlx5: Skip clock update work when device is in error state (Moshe Shemesh) 
- net/mlx5: Allow 0 for total host VFs (Daniel Jurgens) 
- dmaengine: mcf-edma: Fix a potential un-allocated memory access (Christophe JAILLET) 
- nexthop: Fix infinite nexthop bucket dump when using maximum nexthop ID (Ido Schimmel) 
- nexthop: Make nexthop bucket dump more efficient (Ido Schimmel) 
- nexthop: Fix infinite nexthop dump when using maximum nexthop ID (Ido Schimmel) 
- net: hns3: add wait until mac link down (Jie Wang) 
- net: hns3: refactor hclge_mac_link_status_wait for interface reuse (Jie Wang) 
- net: phy: at803x: remove set/get wol callbacks for AR8032 (Li Yang) 
- RDMA/umem: Set iova in ODP flow (Michael Guralnik) 
- wifi: cfg80211: fix sband iftype data lookup for AP_VLAN (Felix Fietkau) 
- drm/rockchip: Don't spam logs in atomic check (Daniel Stone) 
- IB/hfi1: Fix possible panic during hotplug remove (Douglas Miller) 
- iavf: fix potential races for FDIR filters (Piotr Gardocki) 
- drivers: net: prevent tun_build_skb() to exceed the packet size limit (Andrew Kanner) 
- dccp: fix data-race around dp->dccps_mss_cache (Eric Dumazet) 
- bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan) 
- xsk: fix refcount underflow in error path (Magnus Karlsson) 
- tunnels: fix kasan splat when generating ipv4 pmtu error (Florian Westphal) 
- net/packet: annotate data-races around tp->status (Eric Dumazet) 
- mISDN: Update parameter type of dsp_cmx_send() (Nathan Chancellor) 
- bpf, sockmap: Fix bug that strp_done cannot be called (Xu Kuohai) 
- bpf, sockmap: Fix map type error in sock_map_del_link (Xu Kuohai) 
- net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() (Andrew Kanner) 
- selftests: forwarding: tc_flower: Relax success criterion (Ido Schimmel) 
- selftests: forwarding: Switch off timeout (Ido Schimmel) 
- selftests: forwarding: Skip test when no interfaces are specified (Ido Schimmel) 
- selftests: forwarding: ethtool_extended_state: Skip when using veth pairs (Ido Schimmel) 
- selftests: forwarding: ethtool: Skip when using veth pairs (Ido Schimmel) 
- selftests: forwarding: Add a helper to skip test when using veth pairs (Ido Schimmel) 
- selftests/rseq: Fix build with undefined __weak (Mark Brown) 
- drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes (Karol Herbst) 
- x86: Move gds_ucode_mitigated() declaration to header (Arnd Bergmann) 
- x86/speculation: Add cpu_show_gds() prototype (Arnd Bergmann) 
- x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Kirill A. Shutemov) 
- x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (Cristian Ciocaltea) 
- x86/srso: Fix build breakage with the LLVM linker (Nick Desaulniers) 
- usb: typec: tcpm: Fix response to vsafe0V event (Badhri Jagan Sridharan) 
- usb: common: usb-conn-gpio: Prevent bailing out if initial role is none (Prashanth K) 
- usb: dwc3: Properly handle processing of pending events (Elson Roy Serrao) 
- usb-storage: alauda: Fix uninit-value in alauda_check_media() (Alan Stern) 
- misc: rtsx: judge ASPM Mode to set PETXCFG Reg (Ricky WU) 
- binder: fix memory leak in binder_init() (Qi Zheng) 
- iio: adc: ina2xx: avoid NULL pointer dereference on OF device match (Alvin Å ipraga) 
- iio: cros_ec: Fix the allocation size for cros_ec_command (Yiyuan Guo) 
- io_uring: correct check for O_TMPFILE (Aleksa Sarai) 
- selftests/bpf: Fix sk_assign on s390x (Ilya Leoshkevich) 
- selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code (Yonghong Song) 
- selftests/bpf: make test_align selftest more robust (Andrii Nakryiko) 
- bpf: aggressively forget precise markings during state checkpointing (Andrii Nakryiko) 
- bpf: stop setting precise in current state (Andrii Nakryiko) 
- bpf: allow precision tracking for programs with subprogs (Andrii Nakryiko) 
- nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (Ryusuke Konishi) 
- radix tree test suite: fix incorrect allocation size for pthreads (Colin Ian King) 
- hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100 (Tao Ren) 
- drm/amd/display: check attr flag before set cursor degamma on DCN3+ (Melissa Wen) 
- drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap() (Boris Brezillon) 
- drm/nouveau/gr: enable memory loads on helper invocation on all channels (Karol Herbst) 
- riscv,mmio: Fix readX()-to-delay() ordering (Andrea Parri) 
- dmaengine: pl330: Return DMA_PAUSED when transaction is paused (Ilpo Järvinen) 
- ipv6: adjust ndisc_is_useropt() to also return true for PIO (Maciej Żenczykowski) 
- mmc: moxart: read scr register without changing byte order (Sergei Antonov) 
- wireguard: allowedips: expand maximum node depth (Jason A. Donenfeld) 
- ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() (Namjae Jeon) 
- ksmbd: validate command request size (Long Li) 
- LTS version v5.15.126 (Jack Vogel) 
- PM: sleep: wakeirq: fix wake irq arming (Johan Hovold) 
- PM / wakeirq: support enabling wake-up irq after runtime_suspend called (Chunfeng Yun) 
- soundwire: fix enumeration completion (Johan Hovold) 
- soundwire: bus: pm_runtime_request_resume on peripheral attachment (Pierre-Louis Bossart) 
- selftests/rseq: Play nice with binaries statically linked against glibc 2.35+ (Sean Christopherson) 
- selftests/rseq: check if libc rseq support is registered (Michael Jeanson) 
- drm/imx/ipuv3: Fix front porch adjustment upon hactive aligning (Alexander Stein) 
- powerpc/mm/altmap: Fix altmap boundary check (Aneesh Kumar K.V) 
- mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() (Christophe JAILLET) 
- mtd: rawnand: rockchip: Align hwecc vs. raw page helper layouts (Johan Jonker) 
- mtd: rawnand: rockchip: fix oobfree offset and description (Johan Jonker) 
- mtd: rawnand: omap_elm: Fix incorrect type in assignment (Roger Quadros) 
- ext2: Drop fragment support (Jan Kara) 
- fs: Protect reconfiguration of sb read-write from racing writes (Jan Kara) 
- net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (Alan Stern) 
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim) 
- fs/sysv: Null check to prevent null-ptr-deref bug (Prince Kumar Maurya) 
- fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_load_attr_list() (Tetsuo Handa) 
- file: reinstate f_pos locking optimization for regular files (Linus Torvalds) 
- bpf, cpumap: Make sure kthread is running before map update returns (Hou Tao) 
- drm/ttm: check null pointer before accessing when swapping (Guchun Chen) 
- open: make RESOLVE_CACHED correctly test for O_TMPFILE (Aleksa Sarai) 
- bpf: Disable preemption in bpf_event_output (Jiri Olsa) 
- rbd: prevent busy loop when requesting exclusive lock (Ilya Dryomov) 
- wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC) (Paul Fertser) 
- net: tap_open(): set sk_uid from current_fsuid() (Laszlo Ersek) 
- net: tun_chr_open(): set sk_uid from current_fsuid() (Laszlo Ersek) 
- arm64: dts: stratix10: fix incorrect I2C property for SCL signal (Dinh Nguyen) 
- mtd: rawnand: meson: fix OOB available bytes for ECC (Arseniy Krasnov) 
- mtd: spinand: toshiba: Fix ecc_get_status (Olivier Maignial) 
- exfat: release s_lock before calling dir_emit() (Sungjong Seo) 
- exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree (gaoming) 
- firmware: arm_scmi: Drop OF node reference in the transport channel setup (Krzysztof Kozlowski) 
- ceph: defer stopping mdsc delayed_work (Xiubo Li) 
- USB: zaurus: Add ID for A-300/B-500/C-700 (Ross Maynard) 
- libceph: fix potential hang in ceph_osdc_notify() (Ilya Dryomov) 
- scsi: storvsc: Limit max_sectors for virtual Fibre Channel devices (Michael Kelley) 
- scsi: zfcp: Defer fc_rport blocking until after ADISC response (Steffen Maier) 
- tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen (Eric Dumazet) 
- tcp_metrics: annotate data-races around tm->tcpm_net (Eric Dumazet) 
- tcp_metrics: annotate data-races around tm->tcpm_vals[] (Eric Dumazet) 
- tcp_metrics: annotate data-races around tm->tcpm_lock (Eric Dumazet) 
- tcp_metrics: annotate data-races around tm->tcpm_stamp (Eric Dumazet) 
- tcp_metrics: fix addr_same() helper (Eric Dumazet) 
- prestera: fix fallback to previous version on same major version (Jonas Gorski) 
- net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio (Jianbo Liu) 
- net/mlx5: fs_core: Make find_closest_ft more generic (Jianbo Liu) 
- vxlan: Fix nexthop hash size (Benjamin Poirier) 
- ip6mr: Fix skb_under_panic in ip6mr_cache_report() (Yue Haibing) 
- s390/qeth: Don't call dev_close/dev_open (DOWN/UP) (Alexandra Winter) 
- net: dcb: choose correct policy to parse DCB_ATTR_BCN (Lin Ma) 
- net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode (Mark Brown) 
- net: korina: handle clk prepare error in korina_probe() (Yuanjun Gong) 
- net: ll_temac: fix error checking of irq_of_parse_and_map() (Dan Carpenter) 
- net: ll_temac: Switch to use dev_err_probe() helper (Yang Yingliang) 
- bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire (Tomas Glozar) 
- net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (valis) 
- net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis) 
- net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (valis) 
- bpf, cpumap: Handle skb as well when clean up ptr_ring (Hou Tao) 
- net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. (Kuniyuki Iwashima) 
- net: add missing data-race annotation for sk_ll_usec (Eric Dumazet) 
- net: add missing data-race annotations around sk->sk_peek_off (Eric Dumazet) 
- net: add missing READ_ONCE(sk->sk_rcvbuf) annotation (Eric Dumazet) 
- net: add missing READ_ONCE(sk->sk_sndbuf) annotation (Eric Dumazet) 
- net: add missing READ_ONCE(sk->sk_rcvlowat) annotation (Eric Dumazet) 
- net: annotate data-races around sk->sk_max_pacing_rate (Eric Dumazet) 
- qed: Fix scheduling in a tasklet while getting stats (Konstantin Khorenko) 
- mISDN: hfcpci: Fix potential deadlock on &hc->lock (Chengfeng Ye) 
- net: sched: cls_u32: Fix match key mis-addressing (Jamal Hadi Salim) 
- perf test uprobe_from_different_cu: Skip if there is no gcc (Georg Müller) 
- net: dsa: fix value check in bcm_sf2_sw_probe() (Yuanjun Gong) 
- rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length (Lin Ma) 
- bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing (Lin Ma) 
- net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() (Yuanjun Gong) 
- net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx (Zhengchao Shao) 
- wifi: cfg80211: Fix return value in scan logic (Ilan Peer) 
- KVM: s390: fix sthyi error handling (Heiko Carstens) 
- word-at-a-time: use the same return type for has_zero regardless of endianness (ndesaulniers@google.com) 
- arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux (Hugo Villeneuve) 
- iommu/arm-smmu-v3: Document nesting-related errata (Robin Murphy) 
- iommu/arm-smmu-v3: Add explicit feature for nesting (Robin Murphy) 
- iommu/arm-smmu-v3: Document MMU-700 erratum 2812531 (Robin Murphy) 
- iommu/arm-smmu-v3: Work around MMU-600 erratum 1076982 (Robin Murphy) 
- net/mlx5: Free irqs only on shutdown callback (Shay Drory) 
- perf: Fix function pointer case (Peter Zijlstra) 
- io_uring: gate iowait schedule on having pending requests (Jens Axboe) 
- net: mana: Use the correct WQE count for ringing RQ doorbell (Long Li)  [Orabug: 35555552]
- net: mana: Batch ringing RX queue doorbell on receiving packets (Long Li)  [Orabug: 35555552]
- devlink: report devlink_port_type_warn source device (Petr Oros)  [Orabug: 35727899]
- scsi: mpi3mr: Update driver version to 8.5.0.0.0 (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Enhance handling of devices removed after controller reset (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: WRITE SAME implementation (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Add support for more than 1MB I/O (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Update MPI Headers to version 3.00.28 (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Invoke soft reset upon TSU or event ack time out (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Propagate sense data for admin queue SCSI I/O (Sathya Prakash)  [Orabug: 35729632]
- scsi: mpi3mr: Fix the type used for pointers to bitmap (Christophe JAILLET)  [Orabug: 35729632]
- scsi: mpi3mr: Use -ENOMEM instead of -1 in mpi3mr_expander_add() (Harshit Mogalapalli)  [Orabug: 35729632]
- scsi: mpi3mr: Use IRQ save variants of spinlock to protect chain frame allocation (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Handle soft reset in progress fault code (0xF002) (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Update copyright year (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Fix W=1 compilation warnings (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Update MPI Headers to revision 27 (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Modify MUR timeout value to 120 seconds (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Fix admin queue memory leak upon soft reset (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Successive VD delete and add causes FW fault (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Fix expander node leak in mpi3mr_remove() (Tomas Henzl)  [Orabug: 35729632]
- scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc() (Tomas Henzl)  [Orabug: 35729632]
- scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove() (Tomas Henzl)  [Orabug: 35729632]
- scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() (Tomas Henzl)  [Orabug: 35729632]
- scsi: mpi3mr: Fix config page DMA memory leak (Tomas Henzl)  [Orabug: 35729632]
- scsi: mpi3mr: Fix throttle_groups memory leak (Tomas Henzl)  [Orabug: 35729632]
- scsi: mpi3mr: Bad drive in topology results kernel crash (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: NVMe command size greater than 8K fails (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Return proper values for failures in firmware init path (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Wait for diagnostic save during controller init (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt (Ranjan Kumar)  [Orabug: 35729632]
- scsi: mpi3mr: Remove unneeded version.h include (Jesper Juhl)  [Orabug: 35729632]
- scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization (Shin'ichiro Kawasaki)  [Orabug: 35729632]
- scsi: mpi3mr: Use number of bits to manage bitmap sizes (Shin'ichiro Kawasaki)  [Orabug: 35729632]
- scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi (Shin'ichiro Kawasaki)  [Orabug: 35729632]
- scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() (Shin'ichiro Kawasaki)  [Orabug: 35729632]
- scsi: mpi3mr: Fix an issue found by KASAN (Tomas Henzl)  [Orabug: 35729632]
- scsi: mpi3mr: Remove usage of dma_get_required_mask() API (Sreekanth Reddy)  [Orabug: 35729632]
- scsi: mpi3mr: Suppress command reply debug prints (Shin'ichiro Kawasaki)  [Orabug: 35729632]
- scsi: mpi3mr: Select CONFIG_SCSI_SAS_ATTRS (Michal Kubecek)  [Orabug: 35729632]
- vhost-scsi: Fix alignment handling with windows (Mike Christie)  [Orabug: 35769316]
- selftests/bpf: fix static assert compilation issue for test_cls_*.c (Alan Maguire)  [Orabug: 35773339]

[5.15.0-106.125.1.el9uek]
- smp: Reduce NMI traffic from CSD waiters to CSD destination (Imran Khan)  [Orabug: 35752500]
- smp: Reduce logging due to dump_stack of CSD waiters (Imran Khan)  [Orabug: 35752500]
- block: Sysfs option to change ioticks granularity (Gulam Mohamed)  [Orabug: 34977356]
- uek: kabi: update x86_64 kABI files for new symbols (Saeed Mirzamohammadi)  [Orabug: 35501675]
- uek: kabi: update aarch64 kABI files for new symbols (Saeed Mirzamohammadi)  [Orabug: 35553840]
- rpmbuild: fixed missing _kernel_cc macros to allow alternate compilers (Mark Nicholson)  [Orabug: 35729326]
- scsi: megaraid_sas: Driver version update to 07.725.01.00-rc1 (Chandrakanth Patil)  [Orabug: 35729651]
- scsi: megaraid_sas: Add crash dump mode capability bit in MFI capabilities (Chandrakanth Patil)  [Orabug: 35729651]
- scsi: megaraid_sas: Add flexible array member for SGLs (Kees Cook)  [Orabug: 35729651]
- scsi: megaraid_sas: Fix some spelling mistakes in comment (Yu Zhe)  [Orabug: 35729651]
- scsi: megaraid_sas: Move megasas_dbg_lvl init to megasas_init() (Guixin Liu)  [Orabug: 35729651]
- scsi: megaraid_sas: Remove unnecessary memset() (Guixin Liu)  [Orabug: 35729651]
- scsi: megaraid_sas: Simplify megasas_update_device_list (Guixin Liu)  [Orabug: 35729651]
- scsi: megaraid_sas: Correct an error message (Guixin Liu)  [Orabug: 35729651]
- scsi: megaraid_sas: Correct value passed to scsi_device_lookup() (Guixin Liu)  [Orabug: 35729651]
- scsi: megaraid: Convert sysfs snprintf() to sysfs_emit() (Xuezhi Zhang)  [Orabug: 35729651]
- scsi: megaraid_sas: Use struct_size() in code related to struct MR_PD_CFG_SEQ_NUM_SYNC (Gustavo A. R. Silva)  [Orabug: 35729651]
- scsi: megaraid_sas: Use struct_size() in code related to struct MR_FW_RAID_MAP (Gustavo A. R. Silva)  [Orabug: 35729651]
- scsi: megaraid_sas: Replace one-element array with flexible-array member in MR_PD_CFG_SEQ_NUM_SYNC (Gustavo A. R. Silva)  [Orabug: 35729651]
- scsi: megaraid_sas: Replace one-element array with flexible-array member in MR_DRV_RAID_MAP (Gustavo A. R. Silva)  [Orabug: 35729651]
- scsi: megaraid_sas: Replace one-element array with flexible-array member in MR_FW_RAID_MAP_DYNAMIC (Gustavo A. R. Silva)  [Orabug: 35729651]
- scsi: megaraid_sas: Replace one-element array with flexible-array member in MR_FW_RAID_MAP (Gustavo A. R. Silva)  [Orabug: 35729651]
- scsi: megaraid: Remove redundant assignment to variable mfiStatus (Colin Ian King)  [Orabug: 35729651]
- scsi: megaraid_sas: Remove unnecessary kfree() (Guixin Liu)  [Orabug: 35729651]
- scsi: megaraid_sas: Remove redundant variable cmd_type (Colin Ian King)  [Orabug: 35729651]
- scsi: megaraid: Remove the static variable initialisation (Jason Wang)  [Orabug: 35729651]
- scsi: megaraid_sas: Clean up some inconsistent indenting (Jiapeng Chong)  [Orabug: 35729651]
- scsi: megaraid_sas: Remove redundant memset() statement (Harshit Mogalapalli)  [Orabug: 35729651]
- scsi: megaraid_sas: Remove unnecessary memset (Wan Jiabing)  [Orabug: 35729651]
- scsi: megasas: Clean up some inconsistent indenting (Yang Li)  [Orabug: 35729651]
- scsi: megasas: Stop using the SCSI pointer (Bart Van Assche)  [Orabug: 35729651]
- scsi: megaraid_sas: Use irq_set_affinity_and_hint() (Nitesh Narayan Lal)  [Orabug: 35729651]
- scsi: megaraid_sas: Driver version update to 07.719.03.00-rc1 (Sumit Saxena)  [Orabug: 35729651]
- scsi: megaraid_sas: Add helper functions for irq_context (Sumit Saxena)  [Orabug: 35729651]
- scsi: mpt3sas: Fix an issue when driver is being removed (Tomas Henzl)  [Orabug: 35729658]
- scsi: mpt3sas: Remove HBA BIOS version in the kernel log (Ranjan Kumar)  [Orabug: 35729658]
- scsi: mpt3sas: Drop redundant pci_enable_pcie_error_reporting() (Bjorn Helgaas)  [Orabug: 35729658]
- scsi: mpt3sas: Demote log level for trace buffer allocation to info (Paul Menzel)  [Orabug: 35729658]
- scsi: mpt3sas: Update driver version to 43.100.00.00 (Sreekanth Reddy)  [Orabug: 35729658]
- scsi: mpt3sas: Increase cmd_per_lun to 128 (Sreekanth Reddy)  [Orabug: 35729658]
- scsi: mpt3sas: Fix trace buffer registration failed (Sreekanth Reddy)  [Orabug: 35729658]
- scsi: mpt3sas: Disable MPI2_FUNCTION_FW_DOWNLOAD for ATTO devices (Bradley Grove)  [Orabug: 35729658]
- scsi: mpt3sas: Add support for ATTO ExpressSAS H12xx GT devices (Bradley Grove)  [Orabug: 35729658]
- scsi: mpt3sas: Remove flush_scheduled_work() call (Tetsuo Handa)  [Orabug: 35729658]
- scsi: mpt3sas: Fix whitespace and spelling mistake (Zhang Jiaming)  [Orabug: 35729658]
- scsi: mpt3sas: Fix typo in comment (Ren Yu)  [Orabug: 35729658]
- scsi: mpt3sas: Fix junk chars displayed while printing ChipName (Sreekanth Reddy)  [Orabug: 35729658]
- scsi: mpt3sas: Use cached ATA Information VPD page (Martin K. Petersen)  [Orabug: 35729658]
- scsi: mpt3sas: Fix adapter replyPostRegisterIndex declaration (Damien Le Moal)  [Orabug: 35729658]
- scsi: mpt3sas: Fix event callback log_code value handling (Damien Le Moal)  [Orabug: 35729658]
- scsi: mpt3sas: Fix _ctl_set_task_mid() TaskMID check (Damien Le Moal)  [Orabug: 35729658]
- scsi: mpt3sas: Fix mpt3sas_check_same_4gb_region() kdoc comment (Damien Le Moal)  [Orabug: 35729658]
- scsi: mpt3sas: Convert to flexible arrays (Kees Cook)  [Orabug: 35729658]
- scsi: mpt3sas: Update persistent trigger pages from sysfs interface (Suganath Prabu S)  [Orabug: 35729658]
- KVM: selftests: vmx_pmu_msrs_test: Drop tests mangling guest visible CPUIDs (Vitaly Kuznetsov)  [Orabug: 35730650]
- rds: Remove gratuitous include of time.h from rds.h (Mark Haywood)  [Orabug: 35742760]
- uek-rpm: Removing pre scriptlet to not allow firmware downgrade (Samasth Norway Ananda)  [Orabug: 35756462]


_______________________________________________
El-errata mailing list
El-errata@oss.oracle.com
https://oss.oracle.com/mailman/listinfo/el-errata

Oracle9: ELSA-2023-12858: kernel Important Security Update

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

Summary

[5.15.0-106.131.4.el9uek] - jbd2: check 'jh->b_transaction' before removing it from checkpoint (Zhihao Cheng) - jbd2: fix checkpoint cleanup performance regression (Zhang Yi) - scsi: qla2xxx: Fix TMF leak through (Quinn Tran) - scsi: qla2xxx: Fix command flush during TMF (Quinn Tran) - scsi: qla2xxx: Limit TMF to 8 per function (Quinn Tran) - Revert "drm/amdgpu: install stub fence into potential unused fence pointers" (Greg Kroah-Hartman) - dlm: fix plock lookup when using multiple lockspaces (Alexander Aring) - Revert "scsi: qla2xxx: Fix buffer overrun" (Nilesh Javali) - media: dvb: symbol fixup for dvb_attach() (Greg Kroah-Hartman) - PCI: rockchip: Use 64-bit mask on MSI 64-bit PCI address (Rick Wertenbroek) - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (Dave Hansen) - clk: qcom: reset: Use the correct type of sleep/delay based on length (Konrad Dybcio) - ALSA: ac97: Fix possible error value of *rac97 (Su Hui) - md/raid0: Fix performance regression for large sequential writes (Jan Kara) - md/raid0: Factor out helper for mapping and submitting a bio (Jan Kara) - md: add error_handlers for raid0 and linear (Mariusz Tkaczyk) - md: Set MD_BROKEN for RAID1 and RAID10 (Mariusz Tkaczyk) - LTS version: v5.15.131 (Jack Vogel) - usb: typec: tcpci: clear the fault status bit (Marco Felsch) - usb: typec: tcpci: move tcpci.h to include/linux/usb/ (Xin Ji) - pinctrl: amd: Don't show Invalid config param errors (Mario Limonciello) - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (Ryusuke Konishi) - nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi) - tcpm: Avoid soft reset when partner does not support get_status (Badhri Jagan Sridharan) - fsi: master-ast-cf: Add MODULE_FIRMWARE macro (Juerg Haefliger) - firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe (Wang Ming) - serial: sc16is7xx: fix bug when first setting GPIO direction (Hugo Villeneuve) - serial: sc16is7xx: fix broken port 0 uart init (Hugo Villeneuve) - serial: qcom-geni: fix opp vote on shutdown (Johan Hovold) - wifi: mt76: mt7921: do not support one stream on secondary antenna only (Deren Wu) - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang) - staging: rtl8712: fix race condition (Nam Cao) - HID: wacom: remove the battery when the EKR is off (Aaron Armstrong Skomra) - usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0 (Xu Yang) - usb: dwc3: meson-g12a: do post init to fix broken usb after resumption (Luke Lu) - ALSA: usb-audio: Fix init call orders for UAC1 (Takashi Iwai) - USB: serial: option: add FOXCONN T99W368/T99W373 product (Slark Xiao) - USB: serial: option: add Quectel EM05G variant (0x030e) (Martin Kohn) - modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules (Christoph Hellwig) - rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff (Christoph Hellwig) - net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index (Christoph Hellwig) - mmc: au1xmmc: force non-modular build and remove symbol_get usage (Christoph Hellwig) - ARM: pxa: remove use of symbol_get() (Arnd Bergmann) - ksmbd: replace one-element array with flex-array member in struct smb2_ea_info (Namjae Jeon) - ksmbd: fix wrong DataOffset validation of create context (Namjae Jeon) - erofs: ensure that the post-EOF tails are all zeroed (Gao Xiang) - netfilter: nfnetlink_osf: avoid OOB read (Wander Lairson Costa) [Orabug: 35824286] - netfilter: nftables: exthdr: fix 4-byte stack OOB write (Florian Westphal) [Orabug: 35824286] - netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa) [Orabug: 35824286] - netfilter: xt_u32: validate user space input (Wander Lairson Costa) [Orabug: 35824286] - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng) [Orabug: 35824286] {CVE-2023-42753} - rds: Fix lack of reentrancy for connection reset with dst addr zero (HÃ¥kon Bugge) [Orabug: 35655833] {CVE-2023-22024} - attr: use consistent sgid stripping checks (Christian Brauner) [Orabug: 35520042] - Revert "perf build-ids: Fall back to debuginfod query if debuginfo not found" (Samasth Norway Ananda) [Orabug: 35617848] - KEYS: use kfree_sensitive with key (Saeed Mirzamohammadi) [Orabug: 35746757] - kernfs: fix missing kernfs_iattr_rwsem locking (Ian Kent) [Orabug: 35796770] - scsi: megaraid_sas: Fix deadlock on firmware crashdump (Junxiao Bi) [Orabug: 35819592] [5.15.0-106.130.3.el9uek] - KVM: arm64: Skip instruction after emulating write to TCR_EL1 (Oliver Upton) [Orabug: 35677037]

SRPMs

https://oss.oracle.com/ol9/SRPMS-updates//kernel-uek-5.15.0-106.131.4.el9uek.src.rpm

x86_64

bpftool-5.15.0-106.131.4.el9uek.x86_64.rpm kernel-uek-5.15.0-106.131.4.el9uek.x86_64.rpm kernel-uek-core-5.15.0-106.131.4.el9uek.x86_64.rpm kernel-uek-debug-5.15.0-106.131.4.el9uek.x86_64.rpm kernel-uek-debug-core-5.15.0-106.131.4.el9uek.x86_64.rpm kernel-uek-debug-devel-5.15.0-106.131.4.el9uek.x86_64.rpm kernel-uek-debug-modules-5.15.0-106.131.4.el9uek.x86_64.rpm kernel-uek-debug-modules-extra-5.15.0-106.131.4.el9uek.x86_64.rpm kernel-uek-devel-5.15.0-106.131.4.el9uek.x86_64.rpm kernel-uek-doc-5.15.0-106.131.4.el9uek.noarch.rpm kernel-uek-modules-5.15.0-106.131.4.el9uek.x86_64.rpm kernel-uek-modules-extra-5.15.0-106.131.4.el9uek.x86_64.rpm kernel-uek-container-5.15.0-106.131.4.el9uek.x86_64.rpm kernel-uek-container-debug-5.15.0-106.131.4.el9uek.x86_64.rpm

aarch64

- arm64: sdei: abort running SDEI handlers during crash (D Scott Phillips) [Orabug: 35761254] - ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init() (Ilkka Koskinen) [Orabug: 35761254] - ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device (Ilkka Koskinen) [Orabug: 35761254] - ACPI: tables: Add AGDI to the list of known table signatures (Ilkka Koskinen) [Orabug: 35761254] - ACPICA: iASL: Add suppport for AGDI table (Ilkka Koskinen) [Orabug: 35761254] - net/rds: Avoid unpin_user_pages_dirty_lock() in tasklets (Gerd Rausch) [Orabug: 35765163] - x86/CPU/AMD: Fix the DIV(0) initial fix attempt (Borislav Petkov (AMD)) [Orabug: 35776935] {CVE-2023-20588} - x86/CPU/AMD: Do not leak quotient data after a division by 0 (Borislav Petkov (AMD)) [Orabug: 35776935] {CVE-2023-20588} - x86: change default to spec_store_bypass_disable=prctl spectre_v2_user=prctl (Andrea Arcangeli) [Orabug: 35778852] [5.15.0-106.130.2.el9uek] - LTS version: v5.15.130 (Jack Vogel) - rcu-tasks: Add trc_inspect_reader() checks for exiting critical section (Paul E. McKenney) - rcu-tasks: Wait for trc_read_check_handler() IPIs (Paul E. McKenney) - rcu-tasks: Fix IPI failure handling in trc_wait_for_one_reader (Neeraj Upadhyay) - rcu: Prevent expedited GP from enabling tick on offline CPU (Paul E. McKenney) - ARM: module: Use module_init_layout_section() to spot init sections (James Morse) - arm64: module: Use module_init_layout_section() to spot init sections (James Morse) - arm64: module-plts: inline linux/moduleloader.h (Arnd Bergmann) - module: Expose module_init_layout_section() (James Morse) - ACPI: thermal: Drop nocrt parameter (Mario Limonciello) - LTS version: v5.15.129 (Jack Vogel) - mm,ima,kexec,of: use memblock_free_late from ima_free_kexec_buffer (Rik van Riel) - mm: memory-failure: fix unexpected return value in soft_offline_page() (Miaohe Lin) - mm: memory-failure: kill soft_offline_free_page() (Kefeng Wang) - dma-buf/sw_sync: Avoid recursive lock during fence signal (Rob Clark) - pinctrl: renesas: rza2: Add lock around pinctrl_generic{{add,remove}_group,{add,remove}_function} (Biju Das) - clk: Fix undefined reference to clk_rate_exclusive_{get,put}' (Biju Das) - scsi: core: raid_class: Remove raid_component_add() (Zhu Wang) - scsi: snic: Fix double free in snic_tgt_create() (Zhu Wang) - can: raw: add missing refcount for memory leak fix (Oliver Hartkopp) - drm/i915: Fix premature release of request's reusable memory (Janusz Krzysztofik) - cgroup/cpuset: Free DL BW in case can_attach() fails (Dietmar Eggemann) - sched/deadline: Create DL BW alloc, free & check overflow interface (Dietmar Eggemann) - cgroup/cpuset: Iterate only if DEADLINE tasks are present (Juri Lelli) - sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets (Juri Lelli) - sched/cpuset: Bring back cpuset_mutex (Juri Lelli) - cgroup/cpuset: Rename functions dealing with DEADLINE accounting (Juri Lelli) - torture: Fix hang during kthread shutdown phase (Joel Fernandes (Google)) - nfsd: use vfs setgid helper (Christian Brauner) - nfs: use vfs setgid helper (Christian Brauner) - x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 (Feng Tang) - x86/fpu: Invalidate FPU state correctly on exec() (Rick Edgecombe) - drm/display/dp: Fix the DP DSC Receiver cap size (Ankit Nautiyal) - drm/vmwgfx: Fix shader stage validation (Zack Rusin) - PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus (Igor Mammedov) - media: vcodec: Fix potential array out-of-bounds in encoder queue_setup (Wei Chen) - of: dynamic: Refactor action prints to not use "%pOF" inside devtree_lock (Rob Herring) - of: unittest: Fix EXPECT for parse_phandle_with_args_map() test (Rob Herring) - radix tree: remove unused variable (Arnd Bergmann) - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels (Helge Deller) - batman-adv: Hold rtnl lock during MTU update via netlink (Sven Eckelmann) - batman-adv: Fix batadv_v_ogm_aggr_send memory leak (Remi Pommarel) - batman-adv: Fix TT global entry leak when client roamed back (Remi Pommarel) - batman-adv: Do not get eth header before batadv_check_management_packet (Remi Pommarel) - batman-adv: Don't increase MTU when set by user (Sven Eckelmann) - batman-adv: Trigger events for auto adjusted MTU (Sven Eckelmann) - selinux: set next pointer before attaching to list (Christian Göttsche) - nfsd: Fix race to FREE_STATEID and cl_revoked (Benjamin Coddington) - NFS: Fix a use after free in nfs_direct_join_group() (Trond Myklebust) - mm: add a call to flush_cache_vmap() in vmap_pfn() (Alexandre Ghiti) - ALSA: ymfpci: Fix the missing snd_card_free() call at probe error (Takashi Iwai) - clk: Fix slab-out-of-bounds error in devm_clk_release() (Andrey Skvortsov) - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) - ibmveth: Use dcbf rather than dcbfl (Michael Ellerman) - Revert "KVM: x86: enable TDP MMU by default" (Sean Christopherson) - net/ncsi: change from ndo_set_mac_address to dev_set_mac_address (Ivan Mikhaylov) - net/ncsi: make one oem_gma function for all mfr id (Ivan Mikhaylov) - bonding: fix macvlan over alb bond support (Hangbin Liu) - net: remove bond_slave_has_mac_rcu() (Jakub Kicinski) - rtnetlink: Reject negative ifindexes in RTM_NEWLINK (Ido Schimmel) - rtnetlink: return ENODEV when ifname does not exist and group is given (Florent Fourcot) - netfilter: nf_tables: fix out of memory error handling (Florian Westphal) - netfilter: nf_tables: flush pending destroy work before netlink notifier (Pablo Neira Ayuso) - net/sched: fix a qdisc modification with ambiguous command request (Jamal Hadi Salim) - igc: Fix the typo in the PTM Control macro (Sasha Neftin) - igb: Avoid starting unnecessary workqueues (Alessio Igor Bogani) - ice: fix receive buffer size miscalculation (Jesse Brandeburg) - net: validate veth and vxcan peer ifindexes (Jakub Kicinski) - net: bcmgenet: Fix return value check for fixed_phy_register() (Ruan Jinjie) - net: bgmac: Fix return value check for fixed_phy_register() (Ruan Jinjie) - ipvlan: Fix a reference count leak warning in ipvlan_ns_exit() (Lu Wei) - dccp: annotate data-races in dccp_poll() (Eric Dumazet) - sock: annotate data-races around prot->memory_pressure (Eric Dumazet) - octeontx2-af: SDP: fix receive link config (Hariprasad Kelam) - tracing: Fix memleak due to race between current_tracer and trace (Zheng Yejian) - tracing: Fix cpu buffers unavailable due to 'record_disabled' missed (Zheng Yejian) - can: raw: fix lockdep issue in raw_release() (Eric Dumazet) - drm/amd/display: check TG is non-null before checking if enabled (Taimur Hassan) - drm/amd/display: do not wait for mpc idle if tg is disabled (Josip Pavic) - can: raw: fix receiver memory leak (Ziyang Xuan) - jbd2: fix a race when checking checkpoint buffer busy (Zhang Yi) - jbd2: remove journal_clean_one_cp_list() (Zhang Yi) - jbd2: remove t_checkpoint_io_list (Zhang Yi) - ALSA: pcm: Fix potential data race at PCM memory allocation helpers (Takashi Iwai) - fbdev: fix potential OOB read in fast_imageblit() (Zhang Shurong) - fbdev: Fix sys_imageblit() for arbitrary image widths (Thomas Zimmermann) - fbdev: Improve performance of sys_imageblit() (Thomas Zimmermann) - MIPS: cpu-features: Use boot_cpu_type for CPU type based features (Jiaxun Yang) - MIPS: cpu-features: Enable octeon_cache by cpu_type (Jiaxun Yang) - fs: dlm: fix mismatch of plock results from userspace (Alexander Aring) - fs: dlm: use dlm_plock_info for do_unlock_close (Alexander Aring) - fs: dlm: change plock interrupted message to debug again (Alexander Aring) - fs: dlm: add pid to debug log (Alexander Aring) - dlm: replace usage of found with dedicated list iterator variable (Jakob Koschel) - dlm: improve plock logging if interrupted (Alexander Aring) - PCI: acpiphp: Reassign resources on bridge if necessary (Igor Mammedov) - xprtrdma: Remap Receive buffers after a reconnect (Chuck Lever) - NFSv4: fix out path in __nfs4_get_acl_uncached (Fedor Pchelkin) - NFSv4.2: fix error handling in nfs42_proc_getxattr (Fedor Pchelkin) - objtool/x86: Fix SRSO mess (Peter Zijlstra) - LTS version: v5.15.128 (Jack Vogel) - x86/srso: Correct the mitigation status when SMT is disabled (Borislav Petkov (AMD)) - objtool/x86: Fixup frame-pointer vs rethunk (Peter Zijlstra) - x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG (Petr Pavlu) - x86/srso: Disable the mitigation on unaffected configurations (Borislav Petkov (AMD)) - x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() (Sean Christopherson) - x86/static_call: Fix __static_call_fixup() (Peter Zijlstra) - x86/srso: Explain the untraining sequences a bit more (Borislav Petkov (AMD)) - x86/cpu: Cleanup the untrain mess (Peter Zijlstra) - x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 (Peter Zijlstra) - x86/cpu: Rename original retbleed methods (Peter Zijlstra) - x86/cpu: Clean up SRSO return thunk mess (Peter Zijlstra) - x86/ibt: Add ANNOTATE_NOENDBR (Peter Zijlstra) - objtool: Add frame-pointer-specific function ignore (Josh Poimboeuf) - x86/alternative: Make custom return thunk unconditional (Peter Zijlstra) - x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() (Peter Zijlstra) - x86/cpu: Fix __x86_return_thunk symbol type (Peter Zijlstra) - mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove (Yangtao Li) - net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled (Jason Xing) - virtio-net: set queues after driver_ok (Jason Wang) - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima) - arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4 (Christopher Obbard) - exfat: check if filename entries exceeds max filename length (Namjae Jeon) - netfilter: set default timeout to 3 secs for sctp shutdown send and recv state (Xin Long) - drm/amd: flush any delayed gfxoff on suspend entry (Mario Limonciello) - drm/qxl: fix UAF on handle creation (Wander Lairson Costa) - mmc: block: Fix in_flight[issue_type] value error (Yibin Ding) - mmc: wbsd: fix double mmc_free_host() in wbsd_init() (Yang Yingliang) - cifs: Release folio lock on fscache read hit. (Russell Harmon via samba-technical) - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. (dengxiang) - serial: 8250: Fix oops for port->pm on uart_change_pm() (Tony Lindgren) - riscv: uaccess: Return the number of bytes effectively not copied (Alexandre Ghiti) - ALSA: hda/realtek - Remodified 3k pull low procedure (Kailang Yang) - soc: aspeed: socinfo: Add kfree for kstrdup (Jiasheng Jiang) - ASoC: meson: axg-tdm-formatter: fix channel slot allocation (Jerome Brunet) - ASoC: rt5665: add missed regulator_bulk_disable (Zhang Shurong) - ARM: dts: imx: Set default tuning step for imx6sx usdhc (Xiaolei Wang) - arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (Dmitry Baryshkov) - bus: ti-sysc: Flush posted write on enable before reset (Tony Lindgren) - net: do not allow gso_size to be set to GSO_BY_FRAGS (Eric Dumazet) - sock: Fix misuse of sk_under_memory_pressure() (Abel Wu) - net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset (Alfred Lee) - i40e: fix misleading debug logs (Andrii Staikov) - iavf: fix FDIR rule fields masks validation (Piotr Gardocki) - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan) - net: phy: broadcom: stub c45 read/write for 54810 (Justin Chen) - netfilter: nft_dynset: disallow object maps (Pablo Neira Ayuso) - ipvs: fix racy memcpy in proc_do_sync_threshold (Sishuai Gong) - netfilter: nf_tables: deactivate catchall elements in next generation (Florian Westphal) - netfilter: nf_tables: fix false-positive lockdep splat (Florian Westphal) - drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs (Luca Ceresoli) - selftests: mirror_gre_changes: Tighten up the TTL test match (Petr Machata) - net: phy: fix IRQ-based wake-on-lan over hibernate / power off (Russell King (Oracle)) - xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH (Lin Ma) - xfrm: add NULL check in xfrm_update_ae_params (Lin Ma) - ip_vti: fix potential slab-use-after-free in decode_session6 (Zhengchao Shao) - ip6_vti: fix slab-use-after-free in decode_session6 (Zhengchao Shao) - xfrm: fix slab-use-after-free in decode_session6 (Zhengchao Shao) - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure (Lin Ma) - net: af_key: fix sadb_x_filter validation (Lin Ma) - net: xfrm: Fix xfrm_address_filter OOB read (Lin Ma) - i2c: designware: Handle invalid SMBus block data response length value (Tam Nguyen) - i2c: designware: Correct length byte validation logic (Quan Nguyen) - btrfs: fix BUG_ON condition in btrfs_cancel_balance (xiaoshoukui) - tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms (Sherry Sun) - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux (Yi Yang) - powerpc/rtas_flash: allow user copy to flash block cache objects (Nathan Lynch) - fbdev: mmp: fix value check in mmphw_probe() (Yuanjun Gong) - i2c: hisi: Only handle the interrupt of the driver's transfer (Yicong Yang) - i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue (Chengfeng Ye) - cifs: fix potential oops in cifs_oplock_break (Steve French) - vduse: Use proper spinlock for IRQ injection (Maxime Coquelin) - virtio-mmio: don't break lifecycle of vm_dev (Wolfram Sang) - btrfs: move out now unused BG from the reclaim list (Naohiro Aota) - ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node (Xu Yang) - ARM: dts: imx6sll: fixup of operating points (Andreas Kemnade) - mmc: sunxi: fix deferred probing (Sergey Shtylyov) - mmc: bcm2835: fix deferred probing (Sergey Shtylyov) - USB: dwc3: fix use-after-free on core driver unbind (Johan Hovold) - USB: dwc3: qcom: fix NULL-deref on suspend (Johan Hovold) - tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A (Robert Hodaszi) - tty: serial: fsl_lpuart: make rx_watermark configurable for different platforms (Sherry Sun) - tty: serial: fsl_lpuart: Add i.MXRT1050 support (Jesse Taube) - usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume() (Roger Quadros) - USB: dwc3: gadget: drop dead hibernation code (Johan Hovold) - usb: dwc3: Fix typos in gadget.c (Kushagra Verma) - usb: dwc3: Remove DWC3 locking during gadget suspend/resume (Wesley Cheng) - usb: dwc3: gadget: Synchronize IRQ between soft connect/disconnect (Wesley Cheng) - drm/amd/display: fix access hdcp_workqueue assert (Hersen Wu) - drm/amd/display: phase3 mst hdcp for multiple displays (hersen wu) - drm/amd/display: save restore hdcp state when display is unplugged from mst hub (hersen wu) - ARM: dts: aspeed: asrock: Correct firmware flash SPI clocks (Zev Weiss) - igc: read before write to SRRCTL register (Song Yoong Siang) - iio: addac: stx104: Fix race condition when converting analog-to-digital (William Breathitt Gray) - iio: addac: stx104: Fix race condition for stx104_write_raw() (William Breathitt Gray) - iio: stx104: Move to addac subdirectory (William Breathitt Gray) - iio: adc: stx104: Implement and utilize register structures (William Breathitt Gray) - iio: adc: stx104: Utilize iomap interface (William Breathitt Gray) - iio: add addac subdirectory (Cosmin Tanislav) - ring-buffer: Do not swap cpu_buffer during resize process (Chen Lin) - powerpc/kasan: Disable KCOV in KASAN code (Benjamin Gray) - ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() (Tuo Li) - ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 (dengxiang) - fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted (Konstantin Komarov) - fs: ntfs3: Fix possible null-pointer dereferences in mi_read() (Jia-Ju Bai) - fs/ntfs3: Enhance sanity check while generating attr_list (Edward Lo) - drm/amdgpu: Fix potential fence use-after-free v2 (shanzhulig) - Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally (Matthew Anderson) - Bluetooth: L2CAP: Fix use-after-free (Zhengping Jiang) - watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub) (Yuechao Zhao) - firewire: net: fix use after free in fwnet_finish_incoming_packet() (Zhang Shurong) - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() (Armin Wolf) - gfs2: Fix possible data races in gfs2_show_options() (Tuo Li) - usb: chipidea: imx: add missing USB PHY DPDM wakeup setting (Xu Yang) - usb: chipidea: imx: don't request QoS for imx8ulp (Xu Yang) - thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx() (Mika Westerberg) - media: platform: mediatek: vpu: fix NULL ptr dereference (Hans Verkuil) - usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push (Prashanth K) - media: v4l2-mem2mem: add lock to protect parameter num_rdy (Yunfei Dong) - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) - ovl: check type and offset of struct vfsmount in ovl_entry (Christian Brauner) - RDMA/mlx5: Return the firmware result upon destroying QP/RQ (Patrisious Haddad) - HID: add quirk for 03f0:464a HP Elite Presenter Mouse (Marco Morandini) - drm/amdgpu: install stub fence into potential unused fence pointers (Lang Yu) - HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard (stuarthayhurst) - dma-remap: use kvmalloc_array/kvfree for larger dma memory remap (gaoxu) - ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion (Pierre-Louis Bossart) - iopoll: Call cpu_relax() in busy loops (Geert Uytterhoeven) - ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings (Oleksij Rempel) - PCI: tegra194: Fix possible array out of bounds access (Sumit Gupta) - net: tls: avoid discarding data on record close (Jakub Kicinski) - net/tls: Multi-threaded calls to TX tls_dev_del (Tariq Toukan) - net/tls: Perform immediate device ctx cleanup when possible (Tariq Toukan) - macsec: use DEV_STATS_INC() (Eric Dumazet) - macsec: Fix traffic counters/statistics (Clayton Yager) - selftests: forwarding: tc_actions: Use ncat instead of nc (Ido Schimmel) - selftests: forwarding: tc_actions: cleanup temporary files when test is aborted (Davide Caratti) - mmc: sdhci-f-sdh30: Replace with sdhci_pltfm (Kunihiko Hayashi) - LTS version: v5.15.127 (Jack Vogel) - timers/nohz: Last resort update jiffies on nohz_full IRQ entry (Frederic Weisbecker) - timers/nohz: Switch to ONESHOT_STOPPED in the low-res handler when the tick is stopped (Nicholas Piggin) - tick: Detect and fix jiffies update stall (Frederic Weisbecker) - sch_netem: fix issues in netem_change() vs get_dist_table() (Eric Dumazet) - alpha: remove __init annotation from exported page_is_ram() (Masahiro Yamada) - scsi: qedf: Fix firmware halt over suspend and resume (Nilesh Javali) - scsi: qedi: Fix firmware halt over suspend and resume (Nilesh Javali) - scsi: fnic: Replace return codes in fnic_clean_pending_aborts() (Karan Tilak Kumar) - scsi: core: Fix possible memory leak if device_add() fails (Zhu Wang) - scsi: snic: Fix possible memory leak if device_add() fails (Zhu Wang) - scsi: 53c700: Check that command slot is not NULL (Alexandra Diupina) - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Michael Kelley) - scsi: core: Fix legacy /proc parsing buffer overflow (Tony Battersby) - netfilter: nf_tables: report use refcount overflow (Pablo Neira Ayuso) - nvme-rdma: fix potential unbalanced freeze & unfreeze (Ming Lei) - nvme-tcp: fix potential unbalanced freeze & unfreeze (Ming Lei) - btrfs: set cache_block_group_error if we find an error (Josef Bacik) - btrfs: reject invalid reloc tree root keys with stack dump (Qu Wenruo) - btrfs: exit gracefully if reloc roots don't match (Qu Wenruo) - btrfs: don't stop integrity writeback too early (Christoph Hellwig) - ibmvnic: Handle DMA unmapping of login buffs in release functions (Nick Child) - ibmvnic: Unmap DMA login rsp buffer on send login fail (Nick Child) - ibmvnic: Enforce stronger sanity checks on login response (Nick Child) - net/mlx5: Skip clock update work when device is in error state (Moshe Shemesh) - net/mlx5: Allow 0 for total host VFs (Daniel Jurgens) - dmaengine: mcf-edma: Fix a potential un-allocated memory access (Christophe JAILLET) - nexthop: Fix infinite nexthop bucket dump when using maximum nexthop ID (Ido Schimmel) - nexthop: Make nexthop bucket dump more efficient (Ido Schimmel) - nexthop: Fix infinite nexthop dump when using maximum nexthop ID (Ido Schimmel) - net: hns3: add wait until mac link down (Jie Wang) - net: hns3: refactor hclge_mac_link_status_wait for interface reuse (Jie Wang) - net: phy: at803x: remove set/get wol callbacks for AR8032 (Li Yang) - RDMA/umem: Set iova in ODP flow (Michael Guralnik) - wifi: cfg80211: fix sband iftype data lookup for AP_VLAN (Felix Fietkau) - drm/rockchip: Don't spam logs in atomic check (Daniel Stone) - IB/hfi1: Fix possible panic during hotplug remove (Douglas Miller) - iavf: fix potential races for FDIR filters (Piotr Gardocki) - drivers: net: prevent tun_build_skb() to exceed the packet size limit (Andrew Kanner) - dccp: fix data-race around dp->dccps_mss_cache (Eric Dumazet) - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan) - xsk: fix refcount underflow in error path (Magnus Karlsson) - tunnels: fix kasan splat when generating ipv4 pmtu error (Florian Westphal) - net/packet: annotate data-races around tp->status (Eric Dumazet) - mISDN: Update parameter type of dsp_cmx_send() (Nathan Chancellor) - bpf, sockmap: Fix bug that strp_done cannot be called (Xu Kuohai) - bpf, sockmap: Fix map type error in sock_map_del_link (Xu Kuohai) - net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() (Andrew Kanner) - selftests: forwarding: tc_flower: Relax success criterion (Ido Schimmel) - selftests: forwarding: Switch off timeout (Ido Schimmel) - selftests: forwarding: Skip test when no interfaces are specified (Ido Schimmel) - selftests: forwarding: ethtool_extended_state: Skip when using veth pairs (Ido Schimmel) - selftests: forwarding: ethtool: Skip when using veth pairs (Ido Schimmel) - selftests: forwarding: Add a helper to skip test when using veth pairs (Ido Schimmel) - selftests/rseq: Fix build with undefined __weak (Mark Brown) - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes (Karol Herbst) - x86: Move gds_ucode_mitigated() declaration to header (Arnd Bergmann) - x86/speculation: Add cpu_show_gds() prototype (Arnd Bergmann) - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Kirill A. Shutemov) - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (Cristian Ciocaltea) - x86/srso: Fix build breakage with the LLVM linker (Nick Desaulniers) - usb: typec: tcpm: Fix response to vsafe0V event (Badhri Jagan Sridharan) - usb: common: usb-conn-gpio: Prevent bailing out if initial role is none (Prashanth K) - usb: dwc3: Properly handle processing of pending events (Elson Roy Serrao) - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Alan Stern) - misc: rtsx: judge ASPM Mode to set PETXCFG Reg (Ricky WU) - binder: fix memory leak in binder_init() (Qi Zheng) - iio: adc: ina2xx: avoid NULL pointer dereference on OF device match (Alvin Šipraga) - iio: cros_ec: Fix the allocation size for cros_ec_command (Yiyuan Guo) - io_uring: correct check for O_TMPFILE (Aleksa Sarai) - selftests/bpf: Fix sk_assign on s390x (Ilya Leoshkevich) - selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code (Yonghong Song) - selftests/bpf: make test_align selftest more robust (Andrii Nakryiko) - bpf: aggressively forget precise markings during state checkpointing (Andrii Nakryiko) - bpf: stop setting precise in current state (Andrii Nakryiko) - bpf: allow precision tracking for programs with subprogs (Andrii Nakryiko) - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (Ryusuke Konishi) - radix tree test suite: fix incorrect allocation size for pthreads (Colin Ian King) - hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100 (Tao Ren) - drm/amd/display: check attr flag before set cursor degamma on DCN3+ (Melissa Wen) - drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap() (Boris Brezillon) - drm/nouveau/gr: enable memory loads on helper invocation on all channels (Karol Herbst) - riscv,mmio: Fix readX()-to-delay() ordering (Andrea Parri) - dmaengine: pl330: Return DMA_PAUSED when transaction is paused (Ilpo Järvinen) - ipv6: adjust ndisc_is_useropt() to also return true for PIO (Maciej Żenczykowski) - mmc: moxart: read scr register without changing byte order (Sergei Antonov) - wireguard: allowedips: expand maximum node depth (Jason A. Donenfeld) - ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() (Namjae Jeon) - ksmbd: validate command request size (Long Li) - LTS version v5.15.126 (Jack Vogel) - PM: sleep: wakeirq: fix wake irq arming (Johan Hovold) - PM / wakeirq: support enabling wake-up irq after runtime_suspend called (Chunfeng Yun) - soundwire: fix enumeration completion (Johan Hovold) - soundwire: bus: pm_runtime_request_resume on peripheral attachment (Pierre-Louis Bossart) - selftests/rseq: Play nice with binaries statically linked against glibc 2.35+ (Sean Christopherson) - selftests/rseq: check if libc rseq support is registered (Michael Jeanson) - drm/imx/ipuv3: Fix front porch adjustment upon hactive aligning (Alexander Stein) - powerpc/mm/altmap: Fix altmap boundary check (Aneesh Kumar K.V) - mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() (Christophe JAILLET) - mtd: rawnand: rockchip: Align hwecc vs. raw page helper layouts (Johan Jonker) - mtd: rawnand: rockchip: fix oobfree offset and description (Johan Jonker) - mtd: rawnand: omap_elm: Fix incorrect type in assignment (Roger Quadros) - ext2: Drop fragment support (Jan Kara) - fs: Protect reconfiguration of sb read-write from racing writes (Jan Kara) - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (Alan Stern) - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim) - fs/sysv: Null check to prevent null-ptr-deref bug (Prince Kumar Maurya) - fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_load_attr_list() (Tetsuo Handa) - file: reinstate f_pos locking optimization for regular files (Linus Torvalds) - bpf, cpumap: Make sure kthread is running before map update returns (Hou Tao) - drm/ttm: check null pointer before accessing when swapping (Guchun Chen) - open: make RESOLVE_CACHED correctly test for O_TMPFILE (Aleksa Sarai) - bpf: Disable preemption in bpf_event_output (Jiri Olsa) - rbd: prevent busy loop when requesting exclusive lock (Ilya Dryomov) - wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC) (Paul Fertser) - net: tap_open(): set sk_uid from current_fsuid() (Laszlo Ersek) - net: tun_chr_open(): set sk_uid from current_fsuid() (Laszlo Ersek) - arm64: dts: stratix10: fix incorrect I2C property for SCL signal (Dinh Nguyen) - mtd: rawnand: meson: fix OOB available bytes for ECC (Arseniy Krasnov) - mtd: spinand: toshiba: Fix ecc_get_status (Olivier Maignial) - exfat: release s_lock before calling dir_emit() (Sungjong Seo) - exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree (gaoming) - firmware: arm_scmi: Drop OF node reference in the transport channel setup (Krzysztof Kozlowski) - ceph: defer stopping mdsc delayed_work (Xiubo Li) - USB: zaurus: Add ID for A-300/B-500/C-700 (Ross Maynard) - libceph: fix potential hang in ceph_osdc_notify() (Ilya Dryomov) - scsi: storvsc: Limit max_sectors for virtual Fibre Channel devices (Michael Kelley) - scsi: zfcp: Defer fc_rport blocking until after ADISC response (Steffen Maier) - tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen (Eric Dumazet) - tcp_metrics: annotate data-races around tm->tcpm_net (Eric Dumazet) - tcp_metrics: annotate data-races around tm->tcpm_vals[] (Eric Dumazet) - tcp_metrics: annotate data-races around tm->tcpm_lock (Eric Dumazet) - tcp_metrics: annotate data-races around tm->tcpm_stamp (Eric Dumazet) - tcp_metrics: fix addr_same() helper (Eric Dumazet) - prestera: fix fallback to previous version on same major version (Jonas Gorski) - net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio (Jianbo Liu) - net/mlx5: fs_core: Make find_closest_ft more generic (Jianbo Liu) - vxlan: Fix nexthop hash size (Benjamin Poirier) - ip6mr: Fix skb_under_panic in ip6mr_cache_report() (Yue Haibing) - s390/qeth: Don't call dev_close/dev_open (DOWN/UP) (Alexandra Winter) - net: dcb: choose correct policy to parse DCB_ATTR_BCN (Lin Ma) - net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode (Mark Brown) - net: korina: handle clk prepare error in korina_probe() (Yuanjun Gong) - net: ll_temac: fix error checking of irq_of_parse_and_map() (Dan Carpenter) - net: ll_temac: Switch to use dev_err_probe() helper (Yang Yingliang) - bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire (Tomas Glozar) - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (valis) - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis) - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (valis) - bpf, cpumap: Handle skb as well when clean up ptr_ring (Hou Tao) - net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. (Kuniyuki Iwashima) - net: add missing data-race annotation for sk_ll_usec (Eric Dumazet) - net: add missing data-race annotations around sk->sk_peek_off (Eric Dumazet) - net: add missing READ_ONCE(sk->sk_rcvbuf) annotation (Eric Dumazet) - net: add missing READ_ONCE(sk->sk_sndbuf) annotation (Eric Dumazet) - net: add missing READ_ONCE(sk->sk_rcvlowat) annotation (Eric Dumazet) - net: annotate data-races around sk->sk_max_pacing_rate (Eric Dumazet) - qed: Fix scheduling in a tasklet while getting stats (Konstantin Khorenko) - mISDN: hfcpci: Fix potential deadlock on &hc->lock (Chengfeng Ye) - net: sched: cls_u32: Fix match key mis-addressing (Jamal Hadi Salim) - perf test uprobe_from_different_cu: Skip if there is no gcc (Georg Müller) - net: dsa: fix value check in bcm_sf2_sw_probe() (Yuanjun Gong) - rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length (Lin Ma) - bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing (Lin Ma) - net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() (Yuanjun Gong) - net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx (Zhengchao Shao) - wifi: cfg80211: Fix return value in scan logic (Ilan Peer) - KVM: s390: fix sthyi error handling (Heiko Carstens) - word-at-a-time: use the same return type for has_zero regardless of endianness (ndesaulniers@google.com) - arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux (Hugo Villeneuve) - iommu/arm-smmu-v3: Document nesting-related errata (Robin Murphy) - iommu/arm-smmu-v3: Add explicit feature for nesting (Robin Murphy) - iommu/arm-smmu-v3: Document MMU-700 erratum 2812531 (Robin Murphy) - iommu/arm-smmu-v3: Work around MMU-600 erratum 1076982 (Robin Murphy) - net/mlx5: Free irqs only on shutdown callback (Shay Drory) - perf: Fix function pointer case (Peter Zijlstra) - io_uring: gate iowait schedule on having pending requests (Jens Axboe) - net: mana: Use the correct WQE count for ringing RQ doorbell (Long Li) [Orabug: 35555552] - net: mana: Batch ringing RX queue doorbell on receiving packets (Long Li) [Orabug: 35555552] - devlink: report devlink_port_type_warn source device (Petr Oros) [Orabug: 35727899] - scsi: mpi3mr: Update driver version to 8.5.0.0.0 (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Enhance handling of devices removed after controller reset (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: WRITE SAME implementation (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Add support for more than 1MB I/O (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Update MPI Headers to version 3.00.28 (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Invoke soft reset upon TSU or event ack time out (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Propagate sense data for admin queue SCSI I/O (Sathya Prakash) [Orabug: 35729632] - scsi: mpi3mr: Fix the type used for pointers to bitmap (Christophe JAILLET) [Orabug: 35729632] - scsi: mpi3mr: Use -ENOMEM instead of -1 in mpi3mr_expander_add() (Harshit Mogalapalli) [Orabug: 35729632] - scsi: mpi3mr: Use IRQ save variants of spinlock to protect chain frame allocation (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Handle soft reset in progress fault code (0xF002) (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Update copyright year (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Fix W=1 compilation warnings (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Update MPI Headers to revision 27 (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Modify MUR timeout value to 120 seconds (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Fix admin queue memory leak upon soft reset (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Successive VD delete and add causes FW fault (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Fix expander node leak in mpi3mr_remove() (Tomas Henzl) [Orabug: 35729632] - scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc() (Tomas Henzl) [Orabug: 35729632] - scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove() (Tomas Henzl) [Orabug: 35729632] - scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() (Tomas Henzl) [Orabug: 35729632] - scsi: mpi3mr: Fix config page DMA memory leak (Tomas Henzl) [Orabug: 35729632] - scsi: mpi3mr: Fix throttle_groups memory leak (Tomas Henzl) [Orabug: 35729632] - scsi: mpi3mr: Bad drive in topology results kernel crash (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: NVMe command size greater than 8K fails (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Return proper values for failures in firmware init path (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Wait for diagnostic save during controller init (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt (Ranjan Kumar) [Orabug: 35729632] - scsi: mpi3mr: Remove unneeded version.h include (Jesper Juhl) [Orabug: 35729632] - scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization (Shin'ichiro Kawasaki) [Orabug: 35729632] - scsi: mpi3mr: Use number of bits to manage bitmap sizes (Shin'ichiro Kawasaki) [Orabug: 35729632] - scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi (Shin'ichiro Kawasaki) [Orabug: 35729632] - scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() (Shin'ichiro Kawasaki) [Orabug: 35729632] - scsi: mpi3mr: Fix an issue found by KASAN (Tomas Henzl) [Orabug: 35729632] - scsi: mpi3mr: Remove usage of dma_get_required_mask() API (Sreekanth Reddy) [Orabug: 35729632] - scsi: mpi3mr: Suppress command reply debug prints (Shin'ichiro Kawasaki) [Orabug: 35729632] - scsi: mpi3mr: Select CONFIG_SCSI_SAS_ATTRS (Michal Kubecek) [Orabug: 35729632] - vhost-scsi: Fix alignment handling with windows (Mike Christie) [Orabug: 35769316] - selftests/bpf: fix static assert compilation issue for test_cls_*.c (Alan Maguire) [Orabug: 35773339] [5.15.0-106.125.1.el9uek] - smp: Reduce NMI traffic from CSD waiters to CSD destination (Imran Khan) [Orabug: 35752500] - smp: Reduce logging due to dump_stack of CSD waiters (Imran Khan) [Orabug: 35752500] - block: Sysfs option to change ioticks granularity (Gulam Mohamed) [Orabug: 34977356] - uek: kabi: update x86_64 kABI files for new symbols (Saeed Mirzamohammadi) [Orabug: 35501675] - uek: kabi: update aarch64 kABI files for new symbols (Saeed Mirzamohammadi) [Orabug: 35553840] - rpmbuild: fixed missing _kernel_cc macros to allow alternate compilers (Mark Nicholson) [Orabug: 35729326] - scsi: megaraid_sas: Driver version update to 07.725.01.00-rc1 (Chandrakanth Patil) [Orabug: 35729651] - scsi: megaraid_sas: Add crash dump mode capability bit in MFI capabilities (Chandrakanth Patil) [Orabug: 35729651] - scsi: megaraid_sas: Add flexible array member for SGLs (Kees Cook) [Orabug: 35729651] - scsi: megaraid_sas: Fix some spelling mistakes in comment (Yu Zhe) [Orabug: 35729651] - scsi: megaraid_sas: Move megasas_dbg_lvl init to megasas_init() (Guixin Liu) [Orabug: 35729651] - scsi: megaraid_sas: Remove unnecessary memset() (Guixin Liu) [Orabug: 35729651] - scsi: megaraid_sas: Simplify megasas_update_device_list (Guixin Liu) [Orabug: 35729651] - scsi: megaraid_sas: Correct an error message (Guixin Liu) [Orabug: 35729651] - scsi: megaraid_sas: Correct value passed to scsi_device_lookup() (Guixin Liu) [Orabug: 35729651] - scsi: megaraid: Convert sysfs snprintf() to sysfs_emit() (Xuezhi Zhang) [Orabug: 35729651] - scsi: megaraid_sas: Use struct_size() in code related to struct MR_PD_CFG_SEQ_NUM_SYNC (Gustavo A. R. Silva) [Orabug: 35729651] - scsi: megaraid_sas: Use struct_size() in code related to struct MR_FW_RAID_MAP (Gustavo A. R. Silva) [Orabug: 35729651] - scsi: megaraid_sas: Replace one-element array with flexible-array member in MR_PD_CFG_SEQ_NUM_SYNC (Gustavo A. R. Silva) [Orabug: 35729651] - scsi: megaraid_sas: Replace one-element array with flexible-array member in MR_DRV_RAID_MAP (Gustavo A. R. Silva) [Orabug: 35729651] - scsi: megaraid_sas: Replace one-element array with flexible-array member in MR_FW_RAID_MAP_DYNAMIC (Gustavo A. R. Silva) [Orabug: 35729651] - scsi: megaraid_sas: Replace one-element array with flexible-array member in MR_FW_RAID_MAP (Gustavo A. R. Silva) [Orabug: 35729651] - scsi: megaraid: Remove redundant assignment to variable mfiStatus (Colin Ian King) [Orabug: 35729651] - scsi: megaraid_sas: Remove unnecessary kfree() (Guixin Liu) [Orabug: 35729651] - scsi: megaraid_sas: Remove redundant variable cmd_type (Colin Ian King) [Orabug: 35729651] - scsi: megaraid: Remove the static variable initialisation (Jason Wang) [Orabug: 35729651] - scsi: megaraid_sas: Clean up some inconsistent indenting (Jiapeng Chong) [Orabug: 35729651] - scsi: megaraid_sas: Remove redundant memset() statement (Harshit Mogalapalli) [Orabug: 35729651] - scsi: megaraid_sas: Remove unnecessary memset (Wan Jiabing) [Orabug: 35729651] - scsi: megasas: Clean up some inconsistent indenting (Yang Li) [Orabug: 35729651] - scsi: megasas: Stop using the SCSI pointer (Bart Van Assche) [Orabug: 35729651] - scsi: megaraid_sas: Use irq_set_affinity_and_hint() (Nitesh Narayan Lal) [Orabug: 35729651] - scsi: megaraid_sas: Driver version update to 07.719.03.00-rc1 (Sumit Saxena) [Orabug: 35729651] - scsi: megaraid_sas: Add helper functions for irq_context (Sumit Saxena) [Orabug: 35729651] - scsi: mpt3sas: Fix an issue when driver is being removed (Tomas Henzl) [Orabug: 35729658] - scsi: mpt3sas: Remove HBA BIOS version in the kernel log (Ranjan Kumar) [Orabug: 35729658] - scsi: mpt3sas: Drop redundant pci_enable_pcie_error_reporting() (Bjorn Helgaas) [Orabug: 35729658] - scsi: mpt3sas: Demote log level for trace buffer allocation to info (Paul Menzel) [Orabug: 35729658] - scsi: mpt3sas: Update driver version to 43.100.00.00 (Sreekanth Reddy) [Orabug: 35729658] - scsi: mpt3sas: Increase cmd_per_lun to 128 (Sreekanth Reddy) [Orabug: 35729658] - scsi: mpt3sas: Fix trace buffer registration failed (Sreekanth Reddy) [Orabug: 35729658] - scsi: mpt3sas: Disable MPI2_FUNCTION_FW_DOWNLOAD for ATTO devices (Bradley Grove) [Orabug: 35729658] - scsi: mpt3sas: Add support for ATTO ExpressSAS H12xx GT devices (Bradley Grove) [Orabug: 35729658] - scsi: mpt3sas: Remove flush_scheduled_work() call (Tetsuo Handa) [Orabug: 35729658] - scsi: mpt3sas: Fix whitespace and spelling mistake (Zhang Jiaming) [Orabug: 35729658] - scsi: mpt3sas: Fix typo in comment (Ren Yu) [Orabug: 35729658] - scsi: mpt3sas: Fix junk chars displayed while printing ChipName (Sreekanth Reddy) [Orabug: 35729658] - scsi: mpt3sas: Use cached ATA Information VPD page (Martin K. Petersen) [Orabug: 35729658] - scsi: mpt3sas: Fix adapter replyPostRegisterIndex declaration (Damien Le Moal) [Orabug: 35729658] - scsi: mpt3sas: Fix event callback log_code value handling (Damien Le Moal) [Orabug: 35729658] - scsi: mpt3sas: Fix _ctl_set_task_mid() TaskMID check (Damien Le Moal) [Orabug: 35729658] - scsi: mpt3sas: Fix mpt3sas_check_same_4gb_region() kdoc comment (Damien Le Moal) [Orabug: 35729658] - scsi: mpt3sas: Convert to flexible arrays (Kees Cook) [Orabug: 35729658] - scsi: mpt3sas: Update persistent trigger pages from sysfs interface (Suganath Prabu S) [Orabug: 35729658] - KVM: selftests: vmx_pmu_msrs_test: Drop tests mangling guest visible CPUIDs (Vitaly Kuznetsov) [Orabug: 35730650] - rds: Remove gratuitous include of time.h from rds.h (Mark Haywood) [Orabug: 35742760] - uek-rpm: Removing pre scriptlet to not allow firmware downgrade (Samasth Norway Ananda) [Orabug: 35756462]

i386

Severity
Related CVEs: CVE-2023-20588 CVE-2023-22024 CVE-2023-42753