• linux-signed-i386_6.1.98+1_source.changes ACCEPTED into proposed-update

    From Debian FTP Masters@21:1/5 to All on Thu Jul 18 23:00:02 2024
    Thank you for your contribution to Debian.



    Accepted:

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    Format: 1.8
    Date: Sun, 14 Jul 2024 09:22:50 +0200
    Source: linux-signed-i386
    Architecture: source
    Version: 6.1.98+1
    Distribution: bookworm-security
    Urgency: high
    Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
    Changed-By: Salvatore Bonaccorso <carnil@debian.org>
    Changes:
    linux-signed-i386 (6.1.98+1) bookworm-security; urgency=high
    .
    * Sign kernel from linux 6.1.98-1
    .
    * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.95
    - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
    - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
    - wifi: cfg80211: fully move wiphy work to unbound workqueue
    - wifi: cfg80211: Lock wiphy in cfg80211_get_station
    - wifi: cfg80211: pmsr: use correct nla_get_uX functions
    - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
    - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
    - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
    - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
    - wifi: mac80211: correctly parse Spatial Reuse Parameter Set element
    - ax25: Fix refcount imbalance on inbound connections
    - ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()
    - [armhf] net/ncsi: Simplify Kconfig/dts control flow
    - [armhf] net/ncsi: Fix the multi thread manner of NCSI driver
    - ipv6: ioam: block BH from ioam6_output()
    - ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
    - bpf: Set run context for rawtp test_run callback
    - net/smc: avoid overwriting when adjusting sock bufsizes
    - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
    (CVE-2024-36978)
    - vxlan: Fix regression when dropping packets due to invalid src addresses
    - tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB
    - net/mlx5: Stop waiting for PCI up if teardown was triggered
    - net/mlx5: Stop waiting for PCI if pci channel is offline
    - net/mlx5: Split function_setup() to enable and open functions
    - net/mlx5: Always stop health timer during driver removal
    - net/mlx5: Fix tainted pointer delete is case of flow rules creation fail
    - ptp: Fix error message on failed pin verification
    - ice: fix iteration of TLVs in Preserved Fields Area
    - ice: Introduce new parameters in ice_sched_node
    - ice: remove null checks before devm_kfree() calls
    - ice: remove af_xdp_zc_qps bitmap
    - net: wwan: iosm: Fix tainted pointer delete is case of region creation
    fail
    - af_unix: Set sk->sk_state under unix_state_lock() for truly disconencted
    peer.
    - af_unix: Annodate data-races around sk->sk_state for writers.
    - af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
    - af_unix: Annotate data-races around sk->sk_state in unix_write_space() and
    poll().
    - af_unix: Annotate data-race of sk->sk_state in unix_stream_connect().
    - af_unix: Annotate data-races around sk->sk_state in sendmsg() and
    recvmsg().
    - af_unix: Annotate data-race of sk->sk_state in unix_stream_read_skb().
    - af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG.
    - af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen.
    - af_unix: Use unix_recvq_full_lockless() in unix_stream_connect().
    - af_unix: annotate lockless accesses to sk->sk_err
    - af_unix: Use skb_queue_empty_lockless() in unix_release_sock().
    - af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen().
    - af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
    - ipv6: fix possible race in __fib6_drop_pcpu_from()
    - Bluetooth: qca: fix invalid device address check
    - btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range()
    - usb: gadget: f_fs: use io_data->status consistently
    - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
    - iio: accel: mxc4005: allow module autoloading via OF compatible
    - iio: accel: mxc4005: Reset chip on probe() and resume()
    - xtensa: stacktrace: include <asm/ftrace.h> for prototype
    - xtensa: fix MAKE_PC_FROM_RA second argument
    - drm/amd/display: drop unnecessary NULL checks in debugfs
    - drm/amd/display: Fix incorrect DSC instance for MST
    - [arm64] dts: qcom: sm8150: align TLMM pin configuration with DT schema
    - [arm64] dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration
    - misc/pvpanic: deduplicate common code
    - misc/pvpanic-pci: register attributes via pci_driver
    - serial: sc16is7xx: replace hardcoded divisor value with BIT() macro
    - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
    - mmc: davinci: Don't strip remove function when driver is builtin
    - firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails
    - HID: i2c-hid: elan: Add ili9882t timing
    - HID: i2c-hid: elan: fix reset suspend current leakage
    - i2c: add fwnode APIs
    - i2c: acpi: Unbind mux adapters before delete
    - mm, vmalloc: fix high order __GFP_NOFAIL allocations
    - mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL
    - wifi: ath10k: fix QCOM_RPROC_COMMON dependency
    - btrfs: remove unnecessary prototype declarations at disk-io.c
    - btrfs: make btrfs_destroy_delayed_refs() return void
    - btrfs: fix leak of qgroup extent records after transaction abort
    - nilfs2: return the mapped address from nilfs_get_page()
    - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
    - io_uring: check for non-NULL file pointer in io_file_can_poll()
    - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
    - USB: xen-hcd: Traverse host/ when CONFIG_USB_XEN_HCD is selected
    - usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps
    - usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state
    - mei: me: release irq in mei_me_pci_resume error path
    - tty: n_tty: Fix buffer offsets when lookahead is used
    - landlock: Fix d_parent walk
    - jfs: xattr: fix buffer overflow for invalid xattr
    - xhci: Set correct transferred length for cancelled bulk transfers
    - xhci: Apply reset resume quirk to Etron EJ188 xHCI host
    - xhci: Handle TD clearing for multiple streams case
    - xhci: Apply broken streams quirk to Etron EJ188 xHCI host
    - [x86] thunderbolt: debugfs: Fix margin debugfs node creation condition
    - scsi: mpi3mr: Fix ATA NCQ priority support
    - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
    - scsi: sd: Use READ(16) when reading block zero on large capacity disks
    (Closes: #1067858)
    - gve: Clear napi->skb before dev_kfree_skb_any()
    - [powerpc*] uaccess: Fix build errors seen with GCC 13/14
    - Input: try trimming too long modalias strings (Closes: #983357)
    - cxl/test: Add missing vmalloc.h for tools/testing/cxl/test/mem.c
    - cachefiles: add output string to cachefiles_obj_[get|put]_ondemand_fd
    - cachefiles: remove requests from xarray during flushing requests
    - cachefiles: introduce object ondemand state
    - cachefiles: extract ondemand info field from cachefiles_object
    - cachefiles: resend an open request if the read request's object is closed
    - cachefiles: add spin_lock for cachefiles_ondemand_info
    - cachefiles: add restore command to recover inflight ondemand read requests
    - cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()
    - cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
    - cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read()
    - cachefiles: never get a new anonymous fd if ondemand_id is valid
    - cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
    - cachefiles: flush all requests after setting CACHEFILES_DEAD
    - selftests/ftrace: Fix to check required event file
    - clk: sifive: Do not register clkdevs for PRCI clocks
    - NFSv4.1 enforce rootpath check in fs_location query
    - SUNRPC: return proper error from gss_wrap_req_priv
    - NFS: add barriers when testing for NFS_FSDATA_BLOCKED (Closes: #1071501)
    - [x86] platform/x86: dell-smbios: Fix wrong token data in sysfs
    - gpio: tqmx86: fix typo in Kconfig label
    - gpio: tqmx86: remove unneeded call to platform_set_drvdata()
    - gpio: tqmx86: introduce shadow register for GPIO output value
    - gpio: tqmx86: Convert to immutable irq_chip
    - gpio: tqmx86: store IRQ trigger type and unmask status separately
    - gpio: tqmx86: fix broken IRQ_TYPE_EDGE_BOTH interrupt type
    - HID: core: remove unnecessary WARN_ON() in implement()
    - iommu/amd: Fix sysfs leak in iommu init
    - HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
    - drm/vmwgfx: Port the framebuffer code to drm fb helpers
    - drm/vmwgfx: Refactor drm connector probing for display modes
    - drm/vmwgfx: Filter modes which exceed graphics memory
    - drm/vmwgfx: 3D disabled should not effect STDU memory limits
    - drm/vmwgfx: Remove STDU logic from generic mode_valid function
    - net: sfp: Always call `sfp_sm_mod_remove()` on remove
    - net: hns3: fix kernel crash problem in concurrent scenario
    - net: hns3: add cond_resched() to hns3 ring buffer init process
    - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
    - drm/komeda: check for error-valued pointer
    - drm/bridge/panel: Fix runtime warning on panel bridge release
    - tcp: fix race in tcp_v6_syn_recv_sock()
    - geneve: Fix incorrect inner network header offset when innerprotoinherit
    is set
    - net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN)
    packets
    - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
    - netfilter: ipset: Fix race between namespace cleanup and gc in the
    list:set type
    - net: pse-pd: Use EOPNOTSUPP error code instead of ENOTSUPP
    - gve: ignore nonrelevant GSO type bits when processing TSO headers
    - net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs
    parameters
    - nvmet-passthru: propagate status from id override functions
    - net/ipv6: Fix the RT cache flush via sysctl using a previous delay
    - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state
    - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
    - ionic: fix use after netif_napi_del()
    - af_unix: Read with MSG_PEEK loops if the first unread byte is OOB
    - bnxt_en: Adjust logging of firmware messages in case of released token in
    __hwrm_send()
    - misc: microchip: pci1xxxx: fix double free in the error handling of
    gp_aux_bus_probe() (CVE-2024-36973)
    - [x86] boot: Don't add the EFI stub to targets, again
    - iio: adc: ad9467: fix scan type sign
    - iio: dac: ad5592r: fix temperature channel scaling value
    - iio: imu: inv_icm42600: delete unneeded update watermark call
    - drivers: core: synchronize really_probe() and dev_uevent()
    - drm/exynos/vidi: fix memory leak in .get_modes()
    - drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID
    found
    - mptcp: ensure snd_una is properly initialized on connect
    - mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID
    - irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update()
    - [x86] amd_nb: Check for invalid SMN reads
    - perf/core: Fix missing wakeup when waiting for context reference
    - riscv: fix overlap of allocated page and PTR_ERR
    - tracing/selftests: Fix kprobe event name test for .isra. functions
    - null_blk: Print correct max open zones limit in null_init_zoned_dev()
    - sock_map: avoid race between sock_map_close and sk_psock_put
    - vmci: prevent speculation leaks by sanitizing event in event_deliver()
    - spmi: hisi-spmi-controller: Do not override device identifier
    - knfsd: LOOKUP can return an illegal error value
    - fs/proc: fix softlockup in __read_vmcore
    - ocfs2: use coarse time for new created files
    - ocfs2: fix races between hole punching and AIO+DIO
    - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
    - dmaengine: axi-dmac: fix possible race in remove()
    - remoteproc: k3-r5: Wait for core0 power-up before powering up core1
    - remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs
    - [x86] drm/i915/gt: Disarm breadcrumbs if engines are already idle
    - [x86] drm/i915/dpt: Make DPT object unshrinkable
    - [x86] intel_th: pci: Add Granite Rapids support
    - [x86] intel_th: pci: Add Granite Rapids SOC support
    - [x86] intel_th: pci: Add Sapphire Rapids SOC support
    - [x86] intel_th: pci: Add Meteor Lake-S support
    - [x86] intel_th: pci: Add Lunar Lake support
    - btrfs: zoned: introduce a zone_info struct in
    btrfs_load_block_group_zone_info
    - btrfs: zoned: factor out per-zone logic from
    btrfs_load_block_group_zone_info
    - btrfs: zoned: factor out single bg handling from
    btrfs_load_block_group_zone_info
    - btrfs: zoned: factor out DUP bg handling from
    btrfs_load_block_group_zone_info
    - btrfs: zoned: fix use-after-free due to race with dev replace
    - nilfs2: fix potential kernel bug due to lack of writeback flag waiting
    - tick/nohz_full: Don't abuse smp_call_function_single() in
    tick_setup_device()
    - mm/huge_memory: don't unpoison huge_zero_folio
    - mm/memory-failure: fix handling of dissolved but not taken off from buddy
    pages
    - serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level
    - mptcp: pm: update add_addr counters after connect
    - Revert "fork: defer linking file vma until vma is fully initialized"
    - remoteproc: k3-r5: Jump to error handling labels in start/stop errors
    - cachefiles, erofs: Fix NULL deref in when cachefiles is not doing
    ondemand-mode
    - Bluetooth: qca: fix wcn3991 device address check
    - Bluetooth: qca: generalise device address check
    - greybus: Fix use-after-free bug in gb_interface_release due to race
    condition.
    - serial: 8250_dw: fall back to poll if there's no interrupt
    - serial: core: Add UPIO_UNKNOWN constant for unknown port type
    - usb-storage: alauda: Check whether the media is initialized
    (CVE-2024-38619)
    - misc: microchip: pci1xxxx: Fix a memory leak in the error handling of
    gp_aux_bus_probe()
    - i2c: at91: Fix the functionality flags of the slave-only interface
    - i2c: designware: Fix the functionality flags of the slave-only interface
    - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.96
    - padata: Disable BH when taking works lock on MT path
    - io_uring/sqpoll: work around a potential audit memory leak
    - block/ioctl: prefer different overflow check
    - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
    - wifi: ath9k: work around memset overflow warning
    - af_packet: avoid a false positive warning in packet_setsockopt()
    - drop_monitor: replace spin_lock by raw_spin_lock
    - scsi: qedi: Fix crash while reading debugfs attribute
    - net/sched: fix false lockdep warning on qdisc root lock
    - net: dsa: realtek: keep default LED state in rtl8366rb
    - netpoll: Fix race condition in netpoll_owner_active
    - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
    - HID: Add quirk for Logitech Casa touchpad
    - HID: asus: fix more n-key report descriptors if n-key quirked
    - Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
    - drm/amd/display: Exit idle optimizations before HDCP execution
    - [x86] platform/x86: toshiba_acpi: Add quirk for buttons on Z830
    - [x86] ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
    - [arm64,armhf] drm/lima: add mask irq callback to gp and pp
    - [arm64,armhf] drm/lima: mask irqs in timeout path before hard reset
    - ALSA: hda/realtek: Add quirks for Lenovo 13X
    - [powerpc*] pseries: Enforce hcall result buffer validity and size
    - [powerpc*] io: Avoid clang null pointer arithmetic warnings
    - [x86] platform/x86: p2sb: Don't init until unassigned resources have been
    assigned
    - power: supply: cros_usbpd: provide ID table for avoiding fallback match
    - [arm64] iommu/arm-smmu-v3: Free MSIs in case of ENOMEM
    - f2fs: remove clear SB_INLINECRYPT flag in default_options
    - usb: misc: uss720: check for incompatible versions of the Belkin F5U002
    - [arm64] usb: dwc3: pci: Don't set "linux,phy_charger_detect" property on
    Lenovo Yoga Tab2 1380
    - udf: udftime: prevent overflow in udf_disk_stamp_to_time()
    - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
    - [arm64,armhf] serial: imx: Introduce timeout when waiting on transmitter
    empty
    - serial: exar: adding missing CTI and Exar PCI ids
    - usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API
    - tty: add the option to have a tty reject a new ldisc
    - tracing: Build event generation tests only as modules
    - ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
    - ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
    - ice: move RDMA init to ice_idc.c
    - ice: avoid IRQ collision to fix init failure on ACPI S3 resume
    - cipso: fix total option length computation
    - bpf: Avoid splat in pskb_pull_reason
    - ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM
    - netrom: Fix a memory leak in nr_heartbeat_expiry()
    - ipv6: prevent possible NULL deref in fib6_nh_init()
    - ipv6: prevent possible NULL dereference in rt6_probe()
    - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
    - netns: Make get_net_ns() handle zero refcount net
    - qca_spi: Make interrupt remembering atomic
    - net: lan743x: disable WOL upon resume to restore full data path operation
    - net: lan743x: Support WOL at both the PHY and MAC appropriately
    - net: phy: mxl-gpy: enhance delay time required by loopback disable
    function
    - net: phy: mxl-gpy: Remove interrupt mask clearing from config_init
    - net/sched: act_api: rely on rcu in tcf_idr_check_alloc
    - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
    - tipc: force a dst refcount before doing decryption
    - sched: act_ct: add netns into the key of tcf_ct_flow_table
    - ptp: fix integer overflow in max_vclocks_store
    - net: stmmac: No need to calculate speed divider when offload is disabled
    - virtio_net: checksum offloading handling fix
    - octeontx2-pf: Add error handling to VLAN unoffload handling
    - netfilter: ipset: Fix suspicious rcu_dereference_protected()
    - seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6
    behaviors
    - ice: Fix VSI list rule with ICE_SW_LKUP_LAST type
    - bnxt_en: Restore PTP tx_avail count in case of skb_pad() error
    - net: usb: rtl8150 fix unintiatilzed variables in
    rtl8150_get_link_ksettings
    - regulator: core: Fix modpost error "regulator_get_regmap" undefined
    - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
    - dmaengine: ioat: Drop redundant pci_enable_pcie_error_reporting()
    - dmaengine: ioatdma: Fix leaking on version mismatch
    - dmaengine: ioat: use PCI core macros for PCIe Capability
    - dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
    - dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
    - dmaengine: ioatdma: Fix missing kmem_cache_destroy()
    - regulator: bd71815: fix ramp values
    - [arm64] dts: imx93-11x11-evk: Remove the 'no-sdio' property
    - [arm64] dts: freescale: imx8mm-verdin: enable hysteresis on slow input pin
    - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is
    fine."
    - firmware: psci: Fix return value from psci_system_suspend()
    - RDMA/mlx5: Add check for srq max_sge attribute
    - net: stmmac: Assign configured channel value to EXTTS event
    - net: usb: ax88179_178a: improve reset check
    - net: do not leave a dangling sk pointer, when socket creation fails
    - btrfs: retry block group reclaim without infinite loop
    - cifs: fix typo in module parameter enable_gcm_256
    - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
    - [arm64] KVM: arm64: Disassociate vcpus from redistributor region on
    teardown
    - [x86] KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes
    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 445/465
    G11.
    - ALSA: hda/realtek: Limit mic boost on N14AP7
    - drm/i915/mso: using joiner is not possible with eDP MSO
    - drm/radeon: fix UBSAN warning in kv_dpm.c
    - drm/amdgpu: fix UBSAN warning in kv_dpm.c
    - gcov: add support for GCC 14
    - kcov: don't lose track of remote references during softirqs
    - mm: mmap: allow for the maximum number of bits for randomizing mmap_base
    by default
    - tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack()
    - mm/page_table_check: fix crash on ZONE_DEVICE
    - i2c: ocores: set IACK bit after core is enabled
    - dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to
    i2c-controller schema
    - [armhf] spi: stm32: qspi: Fix dual flash mode sanity test in
    stm32_qspi_setup()
    - [arm64] dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc
    - [armhf] spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to
    CCR_BUSWIDTH_4
    - perf: script: add raw|disasm arguments to --insn-trace option
    - perf script: Show also errors for --insn-trace option
    - [armhf] dts: samsung: smdkv310: fix keypad no-autorepeat
    - [armhf] dts: samsung: exynos4412-origen: fix keypad no-autorepeat
    - [armhf] dts: samsung: smdk4412: fix keypad no-autorepeat
    - pmdomain: ti-sci: Fix duplicate PD referrals
    - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
    - [x86] cpu/vfm: Add new macros to work with (vendor/family/model) values
    - [x86] cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
    - Revert "kheaders: substituting --sort in archive creation"
    - kheaders: explicitly define file modes for archived headers
    - drm/amd/display: revert Exit idle optimizations before HDCP execution
    - net/sched: unregister lockdep keys in qdisc_create/qdisc_alloc error path
    - hid: asus: asus_report_fixup: fix potential read out of bounds
    - Revert "mm: mmap: allow for the maximum number of bits for randomizing
    mmap_base by default"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.97
    - usb: typec: ucsi: Never send a lone connector change ack
    - usb: typec: ucsi: Ack also failed Get Error commands
    - [x86] ACPI: x86: utils: Add Picasso to the list for forcing
    StorageD3Enable
    - [x86] ACPI: x86: Force StorageD3Enable on more products
    - Input: ili210x - fix ili251x_read_touch_data() return value
    - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
    - [arm64,armhf] pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
    - [arm64,armhf] pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
    - [arm64,armhf] pinctrl: rockchip: use dedicated pinctrl type for RK3328
    - [arm64,armhf] pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
    - [mips*] pci: lantiq: restore reset gpio polarity
    - dt-bindings: i2c: Drop unneeded quotes
    - dt-bindings: i2c: atmel,at91sam: correct path to i2c-controller schema
    - netfilter: nf_tables: use timestamp to check for set element timeout
    (CVE-2024-27397)
    - [arm64] ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on right
    mclk
    - [s390x] pci: Add missing virt_to_phys() for directed DIBV
    - ASoC: amd: acp: remove i2s configuration check in acp_i2s_probe()
    - [arm64] ASoC: fsl-asoc-card: set priv->pdev before using it
    - net: dsa: microchip: fix initial port flush problem
    - bpf: Fix overrunning reservations in ringbuf
    - ibmvnic: Free any outstanding tx skbs during scrq reset
    - net: phy: micrel: add Microchip KSZ 9477 to the device table
    - net: dsa: microchip: use collision based back pressure mode
    - xdp: Remove WARN() from __xdp_reg_mem_model()
    - Fix race for duplicate reqsk on identical SYN
    - net: dsa: microchip: fix wrong register write when masking interrupt
    - [powerpc*] restore some missing spu syscalls
    - tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO
    - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data
    registers
    - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
    - [x86] fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup
    - mtd: partitions: redboot: Added conversion of operands to a larger type
    - wifi: ieee80211: check for NULL in ieee80211_mle_size_ok()
    - bpf: Add a check for struct bpf_fib_lookup size
    - bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
    - RDMA/restrack: Fix potential invalid address access
    - net/iucv: Avoid explicit cpumask var allocation on stack
    - net/dpaa2: Avoid explicit cpumask var allocation on stack
    - crypto: ecdh - explicitly zeroize private_key
    - ALSA: emux: improve patch ioctl data validation
    - media: dvbdev: Initialize sbuf
    - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
    - drm/radeon/radeon_display: Decrease the size of allocated memory
    - nvme: fixup comment for nvme RDMA Provider Type
    - drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
    - [arm64] gpio: davinci: Validate the obtained number of IRQs
    - drm/amd/amdgpu: Fix style errors in amdgpu_drv.c & amdgpu_device.c
    - drm/amdgpu: Fix pci state save during mode-1 reset
    - gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
    - randomize_kstack: Remove non-functional per-arch entropy filtering
    - ima: Fix use-after-free on a dentry's dname.name
    - [x86] stop playing stack games in profile_pc()
    - Revert "MIPS: pci: lantiq: restore reset gpio polarity"
    - [arm64] pinctrl: qcom: spmi-gpio: drop broken pm8008 support
    - ocfs2: fix DIO failure due to insufficient transaction credits
    - nfs: drop the incorrect assertion in nfs_swap_rw()
    - mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
    - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
    - mmc: sdhci: Do not invert write-protect twice
    - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
    - iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
    - counter: ti-eqep: enable clock at probe
    - i2c: testunit: don't erase registers after STOP
    - i2c: testunit: discard write requests while old command is running
    - iio: adc: ad7266: Fix variable checking bug
    - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
    - net: usb: ax88179_178a: improve link status logs
    - usb: gadget: printer: SS+ support
    - usb: gadget: printer: fix races against disable (CVE-2024-25741)
    - usb: musb: da8xx: fix a resource leak in probe()
    - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
    - usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to
    avoid deadlock
    - usb: gadget: aspeed_udc: fix device address configuration
    - usb: ucsi: stm32: fix command completion handling
    - serial: 8250_omap: Implementation of Errata i2310
    - serial: imx: set receiver level before starting uart
    - ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook 645/665
    G11.
    - tty: mcf: MCF54418 has 10 UARTS
    - net: can: j1939: Initialize unused data in j1939_send_one()
    - net: can: j1939: recover socket queue on CAN bus error during BAM
    transmission
    - net: can: j1939: enhanced error handling for tightly received RTS messages
    in xtp_rx_rts_session_new
    - cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing
    - cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked()
    - irqchip/loongson-liointc: Set different ISRs for different cores
    - kbuild: Install dtb files as 0644 in Makefile.dtbinst
    - btrfs: zoned: fix initial free space detection
    - csky, hexagon: fix broken sys_sync_file_range
    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
    - drm/amdgpu: avoid using null object of framebuffer
    - [x86] drm/i915/gt: Fix potential UAF by revoke of fence registers
    - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
    - drm/amdgpu/atomfirmware: fix parsing of vram_info
    - batman-adv: Don't accept TT entries for out-of-spec VIDs
    - can: mcp251xfd: fix infinite loop when xmit fails
    - ata: ahci: Clean up sysfs file on error
    - ata: libata-core: Fix double free on error
    - ftruncate: pass a signed offset
    - syscalls: fix compat_sys_io_pgetevents_time64 usage
    - syscalls: fix sys_fanotify_mark prototype
    - Revert "cpufreq: amd-pstate: Fix the inconsistency in max frequency units"
    - mm/page_alloc: Separate THP PCP into movable and non-movable categories
    - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (CVE-2023-52760)
    - efi: memmap: Move manipulation routines into x86 arch tree
    - efi: xen: Set EFI_PARAVIRT for Xen dom0 boot on all architectures
    - [x86] efi/x86: Free EFI memory map only when installing a new one.
    - [arm64] dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s
    - [arm64] dts: rockchip: Rename LED related pinctrl nodes on
    rk3308-rock-pi-s
    - [arm64] dts: rockchip: fix PMIC interrupt pin on ROCK Pi E
    - [arm64] dts: rockchip: Add sound-dai-cells for RK3368
    - serial: imx: only set receiver level if it is zero
    - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
    - tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.98
    - locking/mutex: Introduce devm_mutex_init()
    - crypto: hisilicon/debugfs - Fix debugfs uninit process issue
    - [arm64,armhf] drm/lima: fix shared irq handling on driver remove
    - [powerpc*] Avoid nmi_enter/nmi_exit in real mode interrupt.
    - media: dvb: as102-fe: Fix as10x_register_addr packing
    - media: dvb-usb: dib0700_devices: Add missing release_firmware()
    - IB/core: Implement a limit on UMAD receive List
    - scsi: qedf: Make qedf_execute_tmf() non-preemptible
    - crypto: aead,cipher - zeroize key buffer after use
    - drm/amdgpu: Fix uninitialized variable warnings
    - drm/amdgpu: Initialize timestamp for some legacy SOCs
    - drm/amd/display: Check index msg_id before read or write
    - drm/amd/display: Check pipe offset before setting vblank
    - drm/amd/display: Skip finding free audio for unknown engine_id
    - drm/amdgpu: fix uninitialized scalar variable warning
    - media: dw2102: Don't translate i2c read into write
    - sctp: prefer struct_size over open coded arithmetic
    - firmware: dmi: Stop decoding on broken entry
    - Input: ff-core - prefer struct_size over open coded arithmetic
    - usb: xhci: prevent potential failure in handle_tx_event() for Transfer

    [continued in next message]

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)