Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 23 Jul 2022 18:29:57 +0200
Source: linux-signed-amd64
Architecture: source
Version: 5.18.14+1
Distribution: sid
Urgency: medium
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Ben Hutchings <benh@debian.org>
Changes:
linux-signed-amd64 (5.18.14+1) unstable; urgency=medium
.
* Sign kernel from linux 5.18.14-1
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.6
- Revert "drm/amd/display: Fix DCN3 B0 DP Alt Mapping" (regression in 5.16)
- [arm64] dts: imx8mm-beacon: Enable RTS-CTS on UART3
- [arm64] dts: imx8mn-beacon: Enable RTS-CTS on UART3
- io_uring: reinstate the inflight tracking (CVE-2022-1976)
- [arm64] ASoC: qcom: lpass-platform: Update VMA access permissions in mmap
callback
- drm/amd/display: Read Golden Settings Table from VBIOS
- drm/amdgpu: Resolve RAS GFX error count issue after cold boot on Arcturus
- [amd64] drm/amdkfd: Use mmget_not_zero in MMU notifier
- [x86] ASoC: Intel: cirrus-common: fix incorrect channel mapping
- [armel,armhf] ASoC: cs42l51: Correct minimum value for SX volume control
- [amd64] drm/amdkfd: add pinned BOs to kfd_bo_list
- ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
- quota: Prevent memory allocation recursion while holding dq_lock
- [armhf] ASoC: es8328: Fix event generation for deemphasis control
- [x86] ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put()
- [x86] ALSA: hda: MTL: add HD Audio PCI ID and HDMI codec vendor ID
- [x86] Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to
dmi_use_low_level_irq
- [x86] scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
- scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted
- scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology
- scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd
completion
- scsi: mpt3sas: Fix out-of-bounds compiler warning
- scsi: ipr: Fix missing/incorrect resource cleanup in error case
- scsi: pmcraid: Fix missing resource cleanup in error case
- ALSA: hda/realtek - Add HW8326 support
- virtio-mmio: fix missing put_device() when vm_cmdline_parent registration
failed
- ipv6: Fix signed integer overflow in __ip6_append_data
- ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
- random: credit cpu and bootloader seeds by default
- [x86] platform/x86/intel: pmc: Support Intel Raptorlake P
- [x86] platform/x86/intel: hid: Add Surface Go to VGBS allow list
- staging: r8188eu: fix rtw_alloc_hwxmits error detection for now
(regression in 5.18.4) (Closes: #1013895)
- staging: r8188eu: Fix warning of array overflow in ioctl_linux.c
(regression in 5.15)
- pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE
- pNFS: Avoid a live lock condition in pnfs_update_layout() (regression in
5.14)
- sunrpc: set cl_max_connect when cloning an rpc_clnt (regression in 5.15)
- i40e: Fix adding ADQ filter to TC0
- i40e: Fix calculating the number of queue pairs
- i40e: Fix call trace in setup_tx_descriptors
- iavf: Fix issue with MAC address of VF shown as zero (regression in 5.18)
- [x86,arm64] Drivers: hv: vmbus: Release cpu lock in error case
- [riscv64] dts: microchip: re-add pdma to mpfs device tree (regression in
5.18)
- io_uring: fix races with file table unregister
- io_uring: fix races with buffer table unregister
- [x86] drm/i915/reset: Fix error_state_read ptr + offset use
- [arm64] net: hns3: set port base vlan tbl_sta to false before removing
old vlan (regression in 5.18)
- [arm64] net: hns3: don't push link state to VF if unalive
- [arm64] net: hns3: restore tm priority/qset to default settings when tc
disabled
- [arm64] net: hns3: fix PF rss size initialization bug (regression in
5.17)
- [arm64] net: hns3: fix tm port shapping of fibre port is incorrect after
driver initialization
- ice: Fix PTP TX timestamp offset calculation
- ice: Sync VLAN filtering features for DVM
- ice: Fix queue config fail handling
- ice: Fix memory corruption in VF driver
- net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg
- [arm64] ftrace: fix branch range checks
- [arm64] ftrace: consistently handle PLTs.
- init: Initialize noop_backing_dev_info early (regression in 5.18.4)
- block: Fix handling of offline queues in blk_mq_alloc_request_hctx()
- [x86] ftrace: Remove OBJECT_FILES_NON_STANDARD usage
- [arm64,armhf] irqchip/gic-v3: Fix error handling in
gic_populate_ppi_partitions
- sched: Fix balance_push() vs __sched_setscheduler()
- i2c: designware: Use standard optional ref clock implementation
- [x86] mei: hbm: drop capability response on early shutdown
- [x86] mei: me: add raptor lake point S DID
- [x86] comedi: vmk80xx: fix expression for tx buffer size
- USB: serial: option: add support for Cinterion MV31 with new baseline
- USB: serial: io_ti: add Agilent E5805A support
- [arm64] mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
- [arm64,armhf] usb: dwc2: Fix memory leak in dwc2_hcd_init
- [arm64,armhf] usb: dwc3: gadget: Fix IN endpoint max packet size
allocation
- [arm64,armhf] usb: dwc3: pci: Restore line lost in merge conflict
resolution (regression in 5.18)
- usb: gadget: u_ether: fix regression in setting fixed MAC address
(regression in 5.16)
- usb: gadget: f_fs: change ep->status safe in ffs_epfile_io()
- usb: gadget: f_fs: change ep->ep safe in ffs_epfile_io()
- tty: n_gsm: Debug output allocation must use GFP_ATOMIC (regression in
5.18.3)
- serial: 8250: Store to lsr_save_flags after lsr read
- [arm64] bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
- md/raid5-ppl: Fix argument order in bio_alloc_bioset() (regression in
5.18)
- dm: fix race in dm_start_io_acct (regression in 5.18)
- dm mirror log: round up region bitmap size to BITS_PER_LONG
- drm/amdgpu: Fix GTT size reporting in amdgpu_ioctl (regression in 5.18)
- drm/amd/display: Cap OLED brightness per max frame-average luminance
- audit: free module name (regression in 5.16)
- fs: account for group membership
- selinux: free contexts previously transferred in selinux_add_opt()
(regression in 5.18)
- ext4: fix super block checksum incorrect after mount
- ext4: fix bug_on ext4_mb_use_inode_pa
- ext4: make variable "count" signed
- ext4: add reserved GDT blocks check
- [arm64] KVM: arm64: Always start with clearing SVE flag on load
(regression in 5.17)
- [arm64] KVM: arm64: Don't read a HW interrupt pending state in user
context (regression in 5.17)
- netfs: Fix gcc-12 warning by embedding vfs inode in netfs_i_context
- [x86] drm/i915/uc: remove accidental static from a local variable
(regression in 5.17)
- bpf: Use safer kvmalloc_array() where possible
- dm: fix bio_set allocation
- [arm64] clk: imx8mp: fix usb_root_clk parent
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.7
- [s390x] mm: use non-quiescing sske for KVM switch to keyed guest
- zonefs: fix zonefs_iomap_begin() for reads
- [x86] boot: Wrap literal addresses in absolute_pointer()
- fsnotify: consistent behavior for parent not watching children
- bpf: Fix calling global functions from BPF_PROG_TYPE_EXT programs
(regression in 5.17)
- io_uring: use original request task for inflight tracking
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.8
- random: schedule mix_interrupt_randomness() less often
- random: quiet urandom warning ratelimit suppression message
- [x86] ALSA: memalloc: Drop x86-specific hack for WC allocations
- ALSA: hda/via: Fix missing beep setup
- [x86] ALSA: hda: Fix discovery of i915 graphics PCI device (regression in
5.18)
- ALSA: hda/conexant: Fix missing beep setup
- [x86] ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop
- ALSA: hda/realtek - ALC897 headset MIC no sound
- [x86] ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly
- [x86] ALSA: hda/realtek: Add quirk for Clevo PD70PNT
- [x86] ALSA: hda/realtek: Add quirk for Clevo NS50PU
- net: openvswitch: fix parsing of nw_proto for IPv6 fragments
- ipv4: ping: fix bind address validity check (regression in 5.17)
- 9p: Fix refcounting during full path walks for fid lookups
- 9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl
- 9p: fix fid refcount leak in v9fs_vfs_get_link
- 9p: fix EBADF errors in cached mode (regression in 5.16)
- btrfs: fix hang during unmount when block group reclaim task is running
(regression in 5.13)
- btrfs: prevent remounting to v1 space cache for subpage mount
- btrfs: add error messages to all unrecognized mount options
- [powerpc*] scsi: ibmvfc: Store vhost pointer during subcrq allocation
- [powerpc*] scsi: ibmvfc: Allocate/free queue resource only during probe/
remove
- mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing
- xen/gntdev: Avoid blocking in unmap_grant_pages()
- dm era: commit metadata in postsuspend after worker stops
- dm: do not return early from dm_io_complete if BLK_STS_AGAIN without
polling (regression in 5.18)
- dm mirror log: clear log bits up to BITS_PER_LONG boundary
- tracing/kprobes: Check whether get_kretprobe() returns NULL in
kretprobe_dispatcher()
- filemap: Handle sibling entries in filemap_get_read_batch()
- mm/slub: add missing TID updates on slab deactivation
- [x86] drm/i915: Implement w/a 22010492432 for adl-s
- amd/display/dc: Fix COLOR_ENCODING and COLOR_RANGE doing nothing for
DCN20+
- drm/amd/display: Fix typo in override_lane_settings
- USB: serial: pl2303: add support for more HXN (G) types
- USB: serial: option: add Telit LE910Cx 0x1250 composition
- USB: serial: option: add Quectel EM05-G modem
- USB: serial: option: add Quectel RM500K module support
- [arm64] drm/msm: Ensure mmap offset is initialized
- [arm64] drm/msm: Fix double pm_runtime_disable() call
- netfilter: use get_random_u32 instead of prandom
- scsi: scsi_debug: Fix zone transition to full condition
- [arm64] drm/msm: Switch ordering of runpm put vs devfreq_idle (regression
in 5.15)
- scsi: iscsi: Exclude zero from the endpoint ID range (regression in 5.18)
- xsk: Fix generic transmit when completion queue reservation fails
- [arm64] drm/msm: use for_each_sgtable_sg to iterate over scatterlist
- bpf: Fix request_sock leak in sk lookup helpers
- [arm64,armhf] drm/sun4i: Fix crash during suspend after component bind
failure
- [amd64] bpf, x86: Fix tail call count offset calculation on bpf2bpf call
- [x86,arm64] scsi: storvsc: Correct reporting of Hyper-V I/O size limits
- phy: aquantia: Fix AN when higher speeds than 1G are not advertised
- net: fix data-race in dev_isalive()
- veth: Add updating of trans_start
- tipc: fix use-after-free Read in tipc_named_reinit
- block: disable the elevator int del_gendisk
- rethook: Reject getting a rethook if RCU is not watching
- igb: fix a use-after-free issue in igb_clean_tx_ring
- bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
- ethtool: Fix get module eeprom fallback
- net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
- [arm64] drm/msm/dp: check core_initialized before disable interrupts at
dp_display_unbind() (regression in 5.18.3)
- [arm64] drm/msm/dp: force link training for display resolution change
- net: phy: at803x: fix NULL pointer dereference on AR9331 PHY (regression
in 5.18)
- perf arm-spe: Don't set data source if it's not a memory operation
- erspan: do not assume transport header is always set
- net/tls: fix tls_sk_proto_close executed repeatedly
- netfilter: nf_dup_netdev: do not push mac header a second time
- netfilter: nf_dup_netdev: add and use recursion counter
- xen-blkfront: Handle NULL gendisk (regression in 5.14)
- afs: Fix dynamic root getattr (regression in 5.18)
- block: pop cached rq before potentially blocking rq_qos_throttle()
(regression in 5.17)
- ice: ignore protocol field in GTP offload
- ice: Fix switchdev rules book keeping
- ice: ethtool: advertise 1000M speeds properly
- ice: ethtool: Prohibit improper channel config for DCB
- io_uring: fail links when poll fails (regression in 5.17)
- regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips
- regmap-irq: Fix offset/index mismatch in read_sub_irq_data()
- drm/amd: Revert "drm/amd/display: keep eDP Vdd on when eDP stream is
already enabled" (regression in 5.18)
- igb: Make DMA faster when CPU is active on the PCIe link
- virtio_net: fix xdp_rxq_info bug after suspend/resume
- Revert "net/tls: fix tls_sk_proto_close executed repeatedly"
- sock: redo the psock vs ULP protection check
- nvme: move the Samsung X5 quirk entry to the core quirks
- gpio: winbond: Fix error code in winbond_gpio_get()
- [s390x] cpumf: Handle events cycles and instructions identical
- filemap: Fix serialization adding transparent huge pages to page cache
(regression in 5.18)
- [x86] KVM: SEV: Init target VMCBs in sev_migrate_from
- iio: mma8452: fix probe fail when device tree compatible is used.
- io_uring: fix req->apoll_events (regression in 5.18)
- io_uring: fix wrong arm_poll error handling (regression in 5.17)
- vmcore: convert copy_oldmem_page() to take an iov_iter
- [s390x] crash: add missing iterator advance in copy_oldmem_page()
- [s390x] crash: make copy_oldmem_page() return number of bytes copied
- xhci: turn off port power in shutdown
- xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI
- xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI
- usb: gadget: uvc: fix list double add in uvcg_video_pump (regression in
5.16)
- usb: gadget: Fix non-unique driver names in raw-gadget driver
- USB: gadget: Fix double-free bug in raw_gadget driver
- [arm64,armhf] usb: chipidea: udc: check request status before setting
device address
- btrfs: fix race between reflinking and ordered extent completion
- btrfs: fix deadlock with fsync+fiemap+transaction commit
- f2fs: attach inline_data after setting compression (regression in 5.18.3)
- f2fs: fix iostat related lock protection (regression in 5.17)
- f2fs: do not count ENOENT for error case (regression in 5.18.4)
- iio:accel:kxcjk-1013: rearrange iio trigger get and register
- iio:accel:bma180: rearrange iio trigger get and register
- iio:accel:mxc4005: rearrange iio trigger get and register
- iio: accel: mma8452: ignore the return value of reset operation
- iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up()
- iio: trigger: sysfs: fix use-after-free on remove
- iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value)
- iio: adc: axp288: Override TS pin bias current for some models
- [hppa] Fix flush_anon_page on PA8800/PA8900 (regression in 5.18)
- [hppa] Enable ARCH_HAS_STRICT_MODULE_RWX
- [powerpc*] Enable execve syscall exit tracepoint
- [powerpc*] rtas: Allow ibm,platform-dump RTAS call with null buffer
address
- [powerpc*] powernv: wire up rng during setup_arch
- mm/memory-failure: disable unpoison once hw error happens
- mm: lru_cache_disable: use synchronize_rcu_expedited (regression in 5.18)
- [armhf] dts: imx6qdl: correct PU regulator ramp delay
- modpost: fix section mismatch check for exported init/exit sections
- [arm64] dts: bcm2711-rpi-400: Fix GPIO line names
- smb3: fix empty netname context on secondary channels (regression in
5.18.4)
- perf build-id: Fix caching files with a wrong build ID
- smb3: use netname when available on secondary channels
- dma-direct: use the correct size for dma_set_encrypted() (regression in
5.17)
- [powerpc*] pseries: wire up rng during setup_arch()
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.9
- bcache: memset on stack variables in bch_btree_check() and
bch_sectors_dirty_init()
- hinic: Replace memcpy() with direct assignment
- [powerpc*] ftrace: Remove ftrace init tramp once kernel init is complete
- io_uring: fix not locked access to fixed buf table
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.10
- drm/amdgpu: fix adev variable used in amdgpu_device_gpu_recover()
(regression in 5.17)
- Revert "drm/amdgpu/display: set vblank_disable_immediate for DC"
(regression in 5.17)
- drm/amdgpu: To flush tlb for MMHUB of RAVEN series
- ksmbd: set the range of bytes to zero without extending file size in
FSCTL_ZERO_DATA
- ksmbd: check invalid FileOffset and BeyondFinalZero in FSCTL_ZERO_DATA
- ksmbd: use vfs_llseek instead of dereferencing NULL
- ipv6: take care of disable_policy when restoring routes
- net: phy: Don't trigger state machine while in suspend
- [s390x] archrandom: simplify back to earlier design and initialize
earlier
- nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG SX6000LNP (AKA SPECTRIX
S40G)
- nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA IM2P33F8ABR1
- nvdimm: Fix badblocks clear off-by-one error
- ceph: wait on async create before checking caps for syncfs
(regression in 5.18)
- [hppa] Fix vDSO signal breakage on 32-bit kernel (regression in 5.18)
- [hppa] unaligned: Fix emulate_ldw() breakage (regression in 5.18)
- [powerpc*] prom_init: Fix kernel config grep
- [powerpc*] bpf: Fix use of user_pt_regs in uapi
- [x86] cpufreq: amd-pstate: Add resume and suspend callbacks
- dm raid: fix accesses beyond end of raid member array
- dm raid: fix KASAN warning in raid5_add_disks
- SUNRPC: Fix READ_PLUS crasher
- net: rose: fix UAF bugs caused by timer handler (CVE-2022-2318)
- net: usb: ax88179_178a: Fix packet receiving (regression in 5.17)
- virtio-net: fix race between ndo_open() and virtio_device_ready()
- [armhf] net: dsa: bcm_sf2: force pause link settings
- net: tun: unlink NAPI from device on destruction
- net: tun: stop NAPI when detaching queues
- net: fix IFF_TX_SKB_NO_LINEAR definition
- net: dp83822: disable false carrier interrupt
- net: dp83822: disable rx error interrupt
- RDMA/qedr: Fix reporting QP timeout attribute
- RDMA/cm: Fix memory leak in ib_cm_insert_listen
- linux/dim: Fix divide by 0 in RDMA DIM
- net: usb: asix: do not force pause frames support
- usbnet: fix memory allocation in helpers
- mptcp: fix race on unaccepted mptcp sockets (regression in 5.17)
- mptcp: fix conflict with <netinet/in.h> (regression in 5.16)
- [armhf] hwmon: (occ) Prevent power cap command overwriting poll response
- NFS: restore module put when manager exits. (regression in 5.18)
- NFSD: restore EINVAL error translation in nfsd_commit() (regression in
5.17)
- NFSv4: Add an fattr allocation to _nfs4_discover_trunking()
(regression in 5.18.3)
- vfs: fix copy_file_range() regression in cross-fs copies
- caif_virtio: fix race between virtio_device_ready() and ndo_open()
- io_uring: ensure that send/sendmsg and recv/recvmsg check sqe->ioprio
- PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events
- lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()
- vdpa/mlx5: Update Control VQ callback information
- netfilter: nft_dynset: restore set element counter when failing to update
- net/sched: act_api: Notify user space if any actions were flushed before
error
- net: asix: fix "can't send until first packet is send" issue
- net: bonding: fix possible NULL deref in rlb code
- net: phy: ax88772a: fix lost pause advertisement configuration
- net: bonding: fix use-after-free after 802.3ad slave unbind
- [arm64] net: dsa: felix: fix race between reading PSFP stats and port
stats
- [powerpc] memhotplug: Add add_pages override for PPC (regression in 5.18)
- [x86] platform/x86: thinkpad_acpi: Fix a memory leak of EFCH MMIO
resource (regression in 5.18)
- [x86] platform/x86: ideapad-laptop: Add Ideapad 5 15ITL05 to
ideapad_dytc_v4_allow_table[]
- tipc: move bc link creation back to tipc_node_create
- epic100: fix use after free on rmmod
- tcp: add a missing nf_reset_ct() in 3WHS handling
- nvmet-tcp: fix regression in data_digest calculation (regression in 5.12)
- ACPI: video: Change how we determine if brightness key-presses are handled
- tunnels: do not assume mac header is set in skb_tunnel_check_pmtu()
- fanotify: refine the validation checks on non-dir inode mask (regression
in 5.18)
- nvmet: add a clear_ids attribute for passthru targets
- ipv6/sit: fix ipip6_tunnel_get_prl return value
- ipv6: fix lockdep splat in in6_dump_addrs() (regression in 5.13)
- net: tun: avoid disabling NAPI twice
- [arm64] drm/msm/dpu: Increment vsync_cnt before waking up userspace
(regression in 5.16)
- [x86] platform/x86: ideapad-laptop: Add allow_v4_dytc module parameter
- [x86] drm/i915/gem: add missing else
- [x86] drm/i915/dgfx: Disable d3cold at gfx root port
- [arm64] drm/msm/gem: Fix error return on fence id alloc fail (regression
in 5.15)
- [x86] platform/x86: panasonic-laptop: revert "Resolve hotkey double
trigger bug"
- [x86] platform/x86: panasonic-laptop: don't report duplicate brightness
key-presses
- [x86] platform/x86: panasonic-laptop: filter out duplicate volume up/down
/mute keypresses
- drm/fourcc: fix integer type usage in uapi header
- hwmon: (ibmaem) don't call platform_device_del() if platform_device_add()
fails
- xen/blkfront: fix leaking data in shared pages (CVE-2022-26365)
- xen/netfront: fix leaking data in shared pages (CVE-2022-33740)
- xen/netfront: force data bouncing when backend is untrusted
(CVE-2022-33741)
- xen/blkfront: force data bouncing when backend is untrusted
(CVE-2022-33742)
- xen-netfront: restore __skb_queue_tail() positioning in
xennet_get_responses() (CVE-2022-33743)
- [arm64,armhf] xen/arm: Fix race in RB-tree based P2M accounting
(CVE-2022-33744)
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.11
- io_uring: fix provided buffer import (regression in 5.18)
- ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD
- [x86] ALSA: hda/realtek: Add quirk for Clevo L140PU
- can: bcm: use call_rcu() instead of costly synchronize_rcu()
- can: gs_usb: gs_usb_open/close(): fix memory leak
- can: kvaser_usb: replace run-time checks with struct
kvaser_usb_driver_info
- can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression
(regression in 5.16)
- can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits
- bpf: Fix incorrect verifier simulation around jmp32's jeq/jne
- bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals
- usbnet: fix memory leak in error case
- net: rose: fix UAF bug caused by rose_t0timer_expiry
- netfilter: nft_set_pipapo: release elements in clone from abort path
- netfilter: nf_tables: stricter validation of element data
(CVE-2022-34918)
- [x86] iommu/vt-d: Fix PCI bus rescan device hot add
- [x86] iommu/vt-d: Fix RID2PASID setup/teardown failure
- fbdev: Fix potential buffer overflow with silly screen sizes
(CVE-2021-33655):
+ fbmem: Check virtual screen sizes in fb_set_var()
+ fbcon: Disallow setting font bigger than screen size
+ fbcon: Prevent that screen size is smaller than font size
- PM: runtime: Redefine pm_runtime_release_supplier()
- PM: runtime: Fix supplier device management during consumer probe
- memregion: Fix memregion_free() fallback definition
- fscache: Fix invalidation/lookup race (regression in 5.17)
- fscache: Fix if condition in fscache_wait_on_volume_collision()
- [powerpc*] powernv: delay rng platform device creation until later in
boot
- [armhf] pinctrl: sunxi: a83t: Fix NAND function name for some pins
- srcu: Tighten cleanup_srcu_struct() GP checks
- ASoC: rt711: Add endianness flag in snd_soc_component_driver
- ASoC: rt711-sdca: Add endianness flag in snd_soc_component_driver
- ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect
- ASoC: SOF: ipc3-topology: Move and correct size checks in
sof_ipc3_control_load_bytes()
- [x86] ASoC: SOF: Intel: hda: Fix compressed stream position tracking
- [arm64] dts: qcom: sm8450: fix interconnects property of UFS node
- [arm64] dts: qcom: msm8994: Fix CPU6/7 reg values
- [arm64] dts: qcom: sdm845: use dispcc AHB clock for mdss node
- [arm64] dts: imx8mp-evk: correct mmc pad settings
- [arm64] dts: imx8mp-evk: correct the uart2 pinctl value
- [arm64] dts: imx8mp-evk: correct gpio-led pad settings
- [arm64] dts: imx8mp-evk: correct vbus pad settings
- [arm64] dts: imx8mp-evk: correct eqos pad settings
- [arm64] dts: imx8mp-evk: correct I2C5 pad settings
- [arm64] dts: imx8mp-evk: correct I2C1 pad settings
- [arm64] dts: imx8mp-evk: correct I2C3 pad settings
- [arm64] dts: imx8mp-phyboard-pollux-rdk: correct uart pad settings
- [arm64] dts: imx8mp-phyboard-pollux-rdk: correct eqos pad settings
- [arm64] dts: imx8mp-phyboard-pollux-rdk: correct i2c2 & mmc settings
- [arm64,armhf] pinctrl: sunxi: sunxi_pconf_set: use correct offset
- [arm64] dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo
- xsk: Clear page contiguity bit when unmapping pool
- i2c: piix4: Fix a memory leak in the EFCH MMIO support
- i40e: Fix dropped jumbo frames statistics
- i40e: Fix VF's MAC Address change on VM
- [armhf] dts: stm32: add missing usbh clock and fix clk order on stm32mp15
- ACPI: CPPC: Check _OSC for flexible address space
- ACPI: bus: Set CPPC _OSC bits for all and when CPPC_LIB is supported
- ACPI: CPPC: Only probe for _CPC if CPPC v2 is acked (regressions in
5.13, 5.18)
- [x86] ACPI: CPPC: Don't require _OSC if X86_FEATURE_CPPC is supported
- net/mlx5e: Fix matchall police parameters validation
- mptcp: Avoid acquiring PM lock for subflow priority changes
- mptcp: Acquire the subflow socket lock before modifying MP_PRIO flags
- mptcp: fix local endpoint accounting
- r8169: fix accessing unset transport header
- net/sched: act_api: Add extack to offload_act_setup() callback
- net/sched: act_police: Add extack messages for offload failure
- net/sched: act_police: allow 'continue' action offload
- [arm64] dmaengine: imx-sdma: Allow imx8m for imx7 FW revs
- [arm64,armhf] dmaengine: imx-sdma: only restart cyclic channel when
enabled (regression in 5.18)
- misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer
(Closes: #1015240, regression in 5.18)
- misc: rtsx_usb: use separate command and response buffers
- misc: rtsx_usb: set return value in rsp_buf alloc err path
- ida: don't use BUG_ON() for debugging
- [arm64,armhf] dmaengine: pl330: Fix lockdep warning about non-static key
- [armhf] dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
- [arm64] dmaengine: qcom: bam_dma: fix runtime PM underflow
- [armhf] dmaengine: ti: Add missing put_device in
ti_dra7_xbar_route_allocate
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.12
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.13
- USB: serial: ftdi_sio: add Belimo device ids
- usb: typec: add missing uevent when partner support PD
- [arm64,armhf] usb: dwc3: gadget: Fix event pending check
- gpio: sim: fix the chip_name configfs item
- [armhf] tty: serial: samsung_tty: set dma burst_size to 1
- [x86] xen: Use clear_bss() for Xen PV guests
- [x86] ALSA: hda - Add fixup for Dell Latitidue E5430
- [x86] ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model
- [x86] ALSA: hda/realtek: Fix headset mic for Acer SF313-51
- [x86] ALSA: hda/realtek - Fix headset mic problem for a HP machine with
alc671
- [x86] ALSA: hda/realtek: fix mute/micmute LEDs for HP machines
- [x86] ALSA: hda/realtek - Fix headset mic problem for a HP machine with
alc221
- [x86] ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop
- xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue
- fix race between exit_itimers() and /proc/pid/timers
- mm: userfaultfd: fix UFFDIO_CONTINUE on fallocated shmem pages
- mm: sparsemem: fix missing higher order allocation splitting (regression
in 5.18)
- mm: split huge PUD on wp_huge_pud fallback
- tracing/histograms: Fix memory leak problem
- net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale
pointer
- ip: fix dflt addr selection for connected nexthop
- [armhf] 9213/1: Print message about disabled Spectre workarounds only
once
- [armel,armhf] 9214/1: alignment: advance IT state after emulating Thumb
instruction
- wifi: mac80211: fix queue selection for mesh/OCB interfaces
- cgroup: Use separate src/dst nodes when preloading css_sets for migration
- btrfs: return -EAGAIN for NOWAIT dio reads/writes on compressed and
inline extents
- btrfs: zoned: fix a leaked bioc in read_zone_info
- [arm64,armhf] drm/panfrost: Put mapping instead of shmem obj on
panfrost_mmu_map_fault_addr() error
- [arm64,armhf] drm/panfrost: Fix shrinker list corruption by madvise IOCTL
- fs/remap: constrain dedupe of EOF blocks
- nilfs2: fix incorrect masking of permission flags for symlinks
- Revert "evm: Fix memleak in init_desc"
- reset: Fix devm bulk optional exclusive control getter
- [arm64] dts: ls1028a: Update SFP node to include clock
- [armhf] dts: imx6qdl-ts7970: Fix ngpio typo and count
- [riscv64] dts: microchip: hook up the mpfs' l2cache
- [armhf] 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out
of idle
- [armel,armhf] 9210/1: Mark the FDT_FIXED sections as shareable
- net/mlx5e: Fix enabling sriov while tc nic rules are offloaded
(regression in 5.14)
- net/mlx5e: CT: Use own workqueue instead of mlx5e priv (regression in
5.18)
- net/mlx5e: Fix capability check for updating vnic env counters
- net/mlx5e: Ring the TX doorbell on DMA errors
- drm/amdgpu: keep fbdev buffers pinned during suspend (regression in 5.17)

[continued in next message]

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)