Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 03 Feb 2022 19:49:50 +0100
Source: linux
Architecture: source
Version: 5.10.92-1~bpo10+1
Distribution: buster-backports
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Ben Hutchings <benh@debian.org>
Closes: 988044 989285 994050 995425 995927 996672 996974 1000900
Changes:
linux (5.10.92-1~bpo10+1) buster-backports; urgency=medium
.
* Rebuild for buster-backports:
- Change ABI number to 0.bpo.11
.
linux (5.10.92-1) bullseye-security; urgency=high
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.85
- usb: gadget: uvc: fix multiple opens
- gcc-plugins: simplify GCC plugin-dev capability test
- gcc-plugins: fix gcc 11 indigestion with plugins...
- HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
- HID: add hid_is_usb() function to make it simpler for USB detection
- HID: bigbenff: prevent null pointer dereference
- HID: wacom: fix problems when device is not a valid USB device
- HID: check for valid USB device for many HID drivers
- [amd64] nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six
8-bit groups
- [amd64] IB/hfi1: Insure use of smp_processor_id() is preempt disabled
- [amd64] IB/hfi1: Fix early init panic
- [amd64] IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr
- can: kvaser_usb: get CAN clock frequency from device
- [x86] can: sja1000: fix use after free in ems_pcmcia_add_card()
- drm/amdgpu: move iommu_resume before ip init/resume
- drm/amdgpu: init iommu after amdkfd device init
- nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
- vrf: don't run conntrack on vrf with !dflt qdisc
- bpf, x86: Fix "no previous prototype" warning
- bpf: Fix the off-by-two error in range markings
- ice: ignore dropped packets during init
- bonding: make tx_rebalance_counter an atomic
- nfp: Fix memory leak in nfp_cpp_area_cache_add()
- seg6: fix the iif in the IPv6 socket control block
- udp: using datalen to cap max gso segments
- netfilter: conntrack: annotate data-races around ct->timeout
- iavf: restore MSI state on reset
- iavf: Fix reporting when setting descriptor count
- [amd64] IB/hfi1: Correct guard on eager buffer deallocation
- devlink: fix netns refcount leak in devlink_nl_cmd_reload()
- net/sched: fq_pie: prevent dismantle issue
- [x86] KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB
flush hypercall
- mm: bdi: initialize bdi_min_ratio when bdi is unregistered
- ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform
- ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1
- ALSA: pcm: oss: Fix negative period/buffer sizes
- ALSA: pcm: oss: Limit the period size to 16MB
- ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
- scsi: qla2xxx: Format log strings only if needed
- btrfs: clear extent buffer uptodate when we fail to write it
- btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling
- md: fix update super 1.0 on rdev size change
- nfsd: fix use-after-free due to delegation race (Closes: #988044)
- nfsd: Fix nsfd startup race (again)
- tracefs: Have new files inherit the ownership of their parent
- [arm64] clk: qcom: regmap-mux: fix parent clock lookup
- drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence.
- [i386] can: pch_can: pch_can_rx_normal: fix use after free
- libata: add horkage for ASMedia 1092
- wait: add wake_up_pollfree()
- binder: use wake_up_pollfree()
- signalfd: use wake_up_pollfree()
- aio: keep poll requests on waitqueue until completed
- aio: fix use-after-free due to missing POLLFREE handling
- [arm64,armhf] net: mvpp2: fix XDP rx queues registering
- tracefs: Set all files to the same group ownership as the mount option
- block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
- scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()
- scsi: scsi_debug: Fix buffer size of REPORT ZONES command
- qede: validate non LSO skb length
- PM: runtime: Fix pm_runtime_active() kerneldoc comment
- ASoC: rt5682: Fix crash due to out of scope stack vars
- [arm64] RDMA/hns: Do not halt commands during reset until later
- [arm64] RDMA/hns: Do not destroy QP resources in the hw resetting phase
- i40e: Fix failed opcode appearing if handling messages from VF
- i40e: Fix pre-set max number of queues for VF
- i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
- [arm64] Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on
emulated bridge"
- Documentation/locking/locktypes: Update migrate_disable() bits.
- dt-bindings: net: Reintroduce PHY no lane swap binding
- net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
- [arm64,armhf] net: fec: only clear interrupt of handling queue in
fec_enet_rx_queue()
- net, neigh: clear whole pneigh_entry at alloc time
- net/qla3xxx: fix an error code in ql_adapter_up()
- USB: gadget: detect too-big endpoint 0 requests (CVE-2021-39685)
- USB: gadget: zero allocate endpoint 0 buffers (CVE-2021-39685)
- usb: core: config: fix validation of wMaxPacketValue entries
- xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime
suspending
- usb: core: config: using bit mask instead of individual bits
- xhci: avoid race between disable slot command and host runtime suspend
- iio: gyro: adxrs290: fix data signedness
- iio: trigger: Fix reference counting
- iio: stk3310: Don't return error code in interrupt handler
- iio: mma8452: Fix trigger reference couting
- iio: ltr501: Don't return error code in trigger handler
- iio: kxsd9: Don't return error code in trigger handler
- iio: itg3200: Call iio_trigger_notify_done() on error
- iio: adc: axp20x_adc: fix charging current reporting on AXP22x
- iio: ad7768-1: Call iio_trigger_notify_done() on error
- iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
- [armhf] irqchip/aspeed-scu: Replace update_bits with write_bits.
- [armhf] irqchip/armada-370-xp: Fix return value of
armada_370_xp_msi_alloc()
- [armhf] irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
- [arm64,armhf] irqchip/irq-gic-v3-its.c: Force synchronisation when issuing
INVALL
- kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc
- doc: gcc-plugins: update gcc-plugins.rst
- MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal
- Documentation/Kbuild: Remove references to gcc-plugin.sh
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.86
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.87
- nfc: fix segfault in nfc_genl_dump_devices_done
- [arm64] drm/msm/dsi: set default num_data_lanes
- [arm64] KVM: arm64: Save PSTATE early on exit
- [arm64] Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
- net/mlx4_en: Update reported link modes for 1/10G
- ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
- ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P
- [arm64,armhf] i2c: rk3x: Handle a spurious start completion interrupt flag
- net: netlink: af_netlink: Prevent empty skb by adding a check on len.
- [x86] KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse IPI
req
- bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc
- fuse: make sure reclaim doesn't write the inode
- [x86] hwmon: (dell-smm) Fix warning on /proc/i8k creation error
- ethtool: do not perform operations on net devices being unregistered
- [armel,armhf] memblock: free_unused_memmap: use pageblock units instead of
MAX_ORDER
- [armel,armhf] memblock: align freed memory map on pageblock boundaries
with SPARSEMEM
- memblock: ensure there is no overflow in memblock_overlaps_region()
- [armel,armhf] arm: extend pfn_valid to take into account freed memory map
alignment
- [armel,armhf] arm: ioremap: don't abuse pfn_valid() to check if pfn is in
RAM
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.88
- KVM: downgrade two BUG_ONs to WARN_ON_ONCE
- mac80211: fix regression in SSN handling of addba tx
- mac80211: mark TX-during-stop for TX in in_reconfig
- mac80211: send ADDBA requests using the tid/queue of the aggregation
session
- mac80211: validate extended element ID is present
- bpf: Fix signed bounds propagation after mov32
- bpf: Make 32->64 bounds propagation slightly more robust
- virtio_ring: Fix querying of maximum DMA mapping size for virtio device
- dm btree remove: fix use after free in rebalance_children()
- audit: improve robustness of the audit queue handling
- [arm64] dts: imx8mp-evk: Improve the Ethernet PHY description
- [arm64] dts: rockchip: fix rk3308-roc-cc vcc-sd supply
- [arm64] dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply
- mac80211: track only QoS data frames for admission control
- ceph: fix duplicate increment of opened_inodes metric
- ceph: initialize pathlen variable in reconnect_caps_cb
- [armhf] socfpga: dts: fix qspi node compatible
- clk: Don't parent clks until the parent is fully registered
- [armhf] soc: imx: Register SoC device only on i.MX boards
- virtio/vsock: fix the transport to work with VMADDR_CID_ANY
- [s390x] kexec_file: fix error handling when applying relocations
- sch_cake: do not call cake_destroy() from cake_init()
- inet_diag: fix kernel-infoleak for UDP sockets
- [arm64] net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
- net/sched: sch_ets: don't remove idle classes from the round-robin list
- drm/ast: potential dereference of null pointer
- mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock
- mac80211: fix lookup when adding AddBA extension element
- flow_offload: return EOPNOTSUPP for the unsupported mpls action type
- rds: memory leak in __rds_conn_create() (CVE-2021-45480)
- [arm64,armhf] soc/tegra: fuse: Fix bitwise vs. logical OR warning
- igb: Fix removal of unicast MAC filters of VFs
- igbvf: fix double free in `igbvf_probe`
- igc: Fix typo in i225 LTR functions
- ixgbe: Document how to enable NBASE-T support
- ixgbe: set X550 MDIO speed before talking to PHY
- netdevsim: Zero-initialize memory for new map's value in function
nsim_bpf_map_alloc (CVE-2021-4135)
- net/packet: rx_owner_map depends on pg_vec
- sfc_ef100: potential dereference of null pointer
- net: Fix double 0x prefix print in SKB dump
- net/smc: Prevent smc_release() from long blocking
- sit: do not call ipip6_dev_free() from sit_init_net()
- USB: gadget: bRequestType is a bitfield, not a enum
- Revert "usb: early: convert to readl_poll_timeout_atomic()"
- [x86] KVM: x86: Drop guest CPUID check for host initiated writes to
MSR_IA32_PERF_CAPABILITIES
- [x86] tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous
- USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04)
- [arm*] usb: dwc2: fix STM ID/VBUS detection startup delay in
dwc2_driver_probe
- PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
- PCI/MSI: Mask MSI-X vectors only on success
- usb: xhci: Extend support for runtime power management for AMD's Yellow
carp.
- USB: serial: cp210x: fix CP2105 GPIO registration
- USB: serial: option: add Telit FN990 compositions
- btrfs: fix memory leak in __add_inode_ref()
- btrfs: fix double free of anon_dev after failure to create subvolume
- zonefs: add MODULE_ALIAS_FS
- iocost: Fix divide-by-zero on donation from low hweight cgroup
- [x86] serial: 8250_fintek: Fix garbled text for console
- timekeeping: Really make sure wall_to_monotonic isn't positive
- libata: if T_LENGTH is zero, dma direction should be DMA_NONE
- drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE
- Input: touchscreen - avoid bitwise vs logical OR warning
- xsk: Do not sleep in poll() when need_wakeup set
- media: mxl111sf: change mutex_init() location
- fuse: annotate lock in fuse_reverse_inval_entry()
- ovl: fix warning in ovl_create_real()
- scsi: scsi_debug: Don't call kcalloc() if size arg is zero
- scsi: scsi_debug: Fix type in min_t to avoid stack OOB
- scsi: scsi_debug: Sanity check block descriptor length in
resp_mode_select()
- rcu: Mark accesses to rcu_state.n_force_qs
- [armhf] bus: ti-sysc: Fix variable set but not used warning for
reinit_modules
- Revert "xsk: Do not sleep in poll() when need_wakeup set"
- xen/blkfront: harden blkfront against event channel storms
(CVE-2021-28711)
- xen/netfront: harden netfront against event channel storms
(CVE-2021-28712)
- xen/console: harden hvc_xen against event channel storms (CVE-2021-28713)
- xen/netback: fix rx queue stall detection (CVE-2021-28714)
- xen/netback: don't queue unlimited number of packages (CVE-2021-28715)
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.89
- net: usb: lan78xx: add Allied Telesis AT29M2-AF
- ext4: prevent partial update of the extent blocks
- ext4: check for out-of-order index extents in ext4_valid_extent_entries()
- ext4: check for inconsistent extents between index and leaf block
- HID: holtek: fix mouse probing
- [arm64] dts: allwinner: orangepi-zero-plus: fix PHY mode
- [arm64] spi: change clk_disable_unprepare to clk_unprepare
- [amd64] IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
- [arm64] RDMA/hns: Replace kfree() with kvfree()
- netfilter: fix regression in looped (broad|multi)cast's MAC handling
- qlcnic: potential dereference null pointer of rx_queue->page_ring
- net: accept UFOv6 packages in virtio_net_hdr_to_skb
- net: skip virtio_net_hdr_set_proto if protocol already set
- igb: fix deadlock caused by taking RTNL in RPM resume path
- ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
- bonding: fix ad_actor_system option setting to default
- [amd64] fjes: Check for error irq
- [armhf] drivers: net: smc911x: Check for error irq
- sfc: Check null pointer of rx_queue->page_ring
- sfc: falcon: Check null pointer of rx_queue->page_ring
- Input: elantech - fix stack out of bound access in
elantech_change_report_id()
- [arm*] pinctrl: bcm2835: Change init order for gpio hogs
- hwmon: (lm90) Fix usage of CONFIG2 register in detect function
- hwmon: (lm90) Add basic support for TI TMP461
- hwmon: (lm90) Introduce flag indicating extended temperature support
- hwmon: (lm90) Drop critical attribute support for MAX6654
- ALSA: jack: Check the return value of kstrdup()
- ALSA: drivers: opl3: Fix incorrect use of vp->state
- ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6
- ALSA: hda/realtek: Add new alc285-hp-amp-init model
- ALSA: hda/realtek: Fix quirk for Clevo NJ51CU
- Input: atmel_mxt_ts - fix double free in mxt_read_info_block
- ipmi: bail out if init_srcu_struct fails
- ipmi: ssif: initialize ssif_info->client early
- ipmi: fix initialization when workqueue allocation fails
- [arm64] tee: handle lookup of shm with reference count 0
- [x86] pkey: Fix undefined behaviour with PKRU_WD_BIT
- [x86] platform/x86: intel_pmc_core: fix memleak on registration failure
- [x86] KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this
vCPU
- [armhf] pinctrl: stm32: consider the GPIO offset to expose all the GPIO
lines
- [arm64,armhf] mmc: sdhci-tegra: Fix switch to HS400ES mode
- mmc: core: Disable card detect during shutdown
- [arm64,armhf] mmc: mmci: stm32: clear DLYB_CR after sending tuning command
- [armel,armhf] 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling
- mac80211: fix locking in ieee80211_start_ap error path
- mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
- [arm64] tee: optee: Fix incorrect page free bug
- f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
(CVE-2021-45469)
- ceph: fix up non-directory creation in SGID directories
- usb: gadget: u_ether: fix race in setting MAC address in setup phase
- [x86] KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state
- mm: mempolicy: fix THP allocations escaping mempolicy restrictions
- [arm64] Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312
- Input: goodix - add id->model mapping for the "9111" model
- ASoC: rt5682: fix the wrong jack type detected
- hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681
- hwmon: (lm90) Do not report 'busy' status bit as alarm
- ax25: NPD bug when detaching AX25 device
- hamradio: defer ax25 kfree after unregister_netdev
- hamradio: improve the incomplete fix to avoid NPD
- phonet/pep: refuse to enable an unbound pipe
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.90
- Input: i8042 - add deferred probe support
- Input: i8042 - enable deferred probe quirk for ASUS UM325UA
- tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok().
- tomoyo: use hwight16() in tomoyo_domain_quota_is_ok()
- [x86] platform/x86: apple-gmux: use resource_size() with res
- memblock: fix memblock_phys_alloc() section mismatch error
- selinux: initialize proto variable in selinux_ip_postroute_compat()
- scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
- net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources
- net/mlx5e: Wrap the tx reporter dump callback to extract the sq
- net/mlx5e: Fix ICOSQ recovery flow for XSK
- udp: using datalen to cap ipv6 udp max gso segments
- sctp: use call_rcu to free endpoint
- net/smc: fix using of uninitialized completions
- net: usb: pegasus: Do not drop long Ethernet frames
- net/smc: improved fix wait on already cleared link
- net/smc: don't send CDC/LLC message if link not ready
- net/smc: fix kernel panic caused by race of smc_sock
- igc: Fix TX timestamp support for non-MSI-X platforms
- net/mlx5e: Fix wrong features assignment in case of error
- [armhf] net/ncsi: check for error return from call to nla_put_u32
- i2c: validate user data in compat ioctl
- nfc: uapi: use kernel size_t to fix user-space builds
- uapi: fix linux/nfc.h userspace compilation errors
- drm/amdgpu: When the VCN(1.0) block is suspended, powergating is
explicitly enabled
- drm/amdgpu: add support for IP discovery gc_info table v2
- xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set.
- usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
- [arm*] binder: fix async_free_space accounting for empty parcels
- [x86] scsi: vmw_pvscsi: Set residual data length conditionally
- Input: appletouch - initialize work before device registration
- Input: spaceball - fix parsing of movement data packets
- net: fix use-after-free in tw_timer_handler
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.91
- f2fs: quota: fix potential deadlock
- tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
- tracing: Tag trace_percpu_buffer as a percpu pointer
- ieee802154: atusb: fix uninit value in atusb_set_extended_addr
- i40e: Fix to not show opcode msg on unsuccessful VF MAC change
- iavf: Fix limit of total number of queues to active queues of VF
- RDMA/core: Don't infoleak GRH fields
- netrom: fix copying in user data in nr_setsockopt
- RDMA/uverbs: Check for null return of kmalloc_array
- mac80211: initialize variable have_higher_than_11mbit
- sfc: The RX page_ring is optional
- i40e: fix use-after-free in i40e_sync_filters_subtask()
- i40e: Fix for displaying message regarding NVM version
- i40e: Fix incorrect netdev's real number of RX/TX queues
- ipv4: Check attribute length for RTA_GATEWAY in multipath route
- ipv4: Check attribute length for RTA_FLOW in multipath route
- ipv6: Check attribute length for RTA_GATEWAY in multipath route
- ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
- lwtunnel: Validate RTA_ENCAP_TYPE attribute length
- batman-adv: mcast: don't send link-local multicast to mcast routers
- sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
- net: ena: Fix undefined state when tx request id is out of bounds
- net: ena: Fix error handling when calculating max IO queues number
- xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
(CVE-2021-4155)
- power: supply: core: Break capacity loop
- rndis_host: support Hytera digital radios
- phonet: refcount leak in pep_sock_accep (CVE-2021-45095)
- ipv6: Continue processing multipath route even if gateway attribute is
invalid
- ipv6: Do cleanup if attribute validation fails in multipath route
- scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
- ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
- net: udp: fix alignment problem in udp4_seq_show()
- [amd64,arm64] atlantic: Fix buff_ring OOB in aq_ring_rx_clean
- mISDN: change function names to avoid conflicts
- drm/amd/display: Added power down for DCN10
- ipv6: raw: check passed optlen before reading
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.92
- md: revert io stats accounting
- workqueue: Fix unbind_workers() VS wq_worker_running() race
- bpf: Fix out of bounds access from invalid *_or_null type verification
(CVE-2022-23222)
- Bluetooth: btusb: fix memory leak in btusb_mtk_submit_wmt_recv_urb()
- Bluetooth: btusb: Add two more Bluetooth parts for WCN6855
- Bluetooth: btusb: Add support for Foxconn MT7922A
- Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0
- Bluetooth: bfusb: fix division by zero in send path
- [armhf] dts: exynos: Fix BCM4330 Bluetooth reset polarity in I9100
- USB: core: Fix bug in resuming hub's handling of wakeup requests
- USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
- ath11k: Fix buffer overflow when scanning with extraie
- mmc: sdhci-pci: Add PCI ID for Intel ADL
- veth: Do not record rx queue hint in veth_xmit
- [x86] mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
- can: gs_usb: fix use of uninitialized variable, detach device on reception
of invalid USB data
- can: isotp: convert struct tpcon::{idx,len} to unsigned int
- can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved}
- random: fix data race on crng_node_pool
- random: fix data race on crng init time
- random: fix crash on multiple early calls to add_bootloader_randomness()
- media: Revert "media: uvcvideo: Set unique vdev name based in type"
- [x86] drm/i915: Avoid bitwise vs logical OR warning in
snb_wm_latency_quirk()
.
[ Salvatore Bonaccorso ]
* [arm64] drivers/net/ethernet/google: Enable GVE as module (Closes: #996974)
* Refresh "Export symbols needed by Android drivers"
* [rt] Update to 5.10.87-rt59
* Bump ABI to 11
* [rt] Update to 5.10.90-rt60
* vfs: fs_context: fix up param length parsing in legacy_parse_param
(CVE-2022-0185)
.
[ Andrew Balmos ]
* net/can: Enable CONFIG_CAN_MCP251X as module
.
[ Cyril Brulebois ]
* arm64: dts: Add support for Raspberry Pi Compute Module 4 IO Board,
producing a DTB that's almost entirely identical to what a v5.16-rc8
build produces, with lots of thanks to Uwe Kleine-König for the heavy
lifting!
.
linux (5.10.84-1) bullseye; urgency=medium
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.71
- tty: Fix out-of-bound vmalloc access in imageblit
- cpufreq: schedutil: Use kobject release() method to free sugov_tunables
- scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS
- cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
- ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i
15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.
- [amd64,arm64] ACPI: NFIT: Use fallback node id when numa info in NFIT
table is incorrect
- fs-verity: fix signed integer overflow with i_size near S64_MAX
- hwmon: (tmp421) handle I2C errors
- hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary
structure field
- hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary
structure field
- hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary
structure field
- [arm64,armhf] gpio: pca953x: do not ignore i2c errors
- scsi: ufs: Fix illegal offset in UPIU event trace
- mac80211: fix use-after-free in CCMP/GCMP RX
- [x86] kvmclock: Move this_cpu_pvti into kvmclock.h
- [x86] KVM: x86: Fix stack-out-of-bounds memory access from
ioapic_write_indirect()
- [x86] KVM: x86: nSVM: don't copy virt_ext from vmcb12
- [x86] KVM: nVMX: Filter out all unsupported controls when eVMCS was
activated
- KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest
- RDMA/cma: Do not change route.addr.src_addr.ss_family
- drm/amd/display: Pass PCI deviceid into DC
- drm/amdgpu: correct initial cp_hqd_quantum for gfx9
- ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
- bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog
- IB/cma: Do not send IGMP leaves for sendonly Multicast groups
- RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure
- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
- mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
- mac80211: mesh: fix potentially unaligned access
- mac80211-hwsim: fix late beacon hrtimer handling
- sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
- hwmon: (tmp421) report /PVLD condition as fault
- hwmon: (tmp421) fix rounding for negative values
- [arm64] net: enetc: fix the incorrect clearing of IF_MODE bits
- net: ipv4: Fix rtnexthop len when RTA_FLOW is present
- smsc95xx: fix stalled rx after link change
- [x86] drm/i915/request: fix early tracepoints
- [arm64,armhf] dsa: mv88e6xxx: 6161: Use chip wide MAX MTU
- [arm64,armhf] dsa: mv88e6xxx: Fix MTU definition
- [arm64,armhf] dsa: mv88e6xxx: Include tagger overhead when setting MTU for
DSA and CPU ports
- e100: fix length calculation in e100_get_regs_len
- e100: fix buffer overrun in e100_get_regs
- [arm64] RDMA/hns: Fix inaccurate prints
- bpf: Exempt CAP_BPF from checks against bpf_jit_limit
- Revert "block, bfq: honor already-setup queue merges"
- scsi: csiostor: Add module softdep on cxgb4
- ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
- [arm64] net: hns3: do not allow call hns3_nic_net_open repeatedly
- [arm64] net: hns3: keep MAC pause mode when multiple TCs are enabled
- [arm64] net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and
HCLGE_FLAG_DCB_ENABLE
- [arm64] net: hns3: fix show wrong state when add existing uc mac address
- [arm64] net: hns3: fix prototype warning
- [arm64] net: hns3: reconstruct function hns3_self_test
- [arm64] net: hns3: fix always enable rx vlan filter problem after selftest
- [arm64,armhf] net: phy: bcm7xxx: Fixed indirect MMD operations
- net: sched: flower: protect fl_walk() with rcu
- af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
- [x86] perf/x86/intel: Update event constraints for ICX
- nvme: add command id quirk for apple controllers
- elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings
- debugfs: debugfs_create_file_size(): use IS_ERR to check for error
- ext4: fix loff_t overflow in ext4_max_bitmap_size()
- ext4: limit the number of blocks in one ADD_RANGE TLV (Closes: #995425)
- ext4: fix reserved space counter leakage
- ext4: add error checking to ext4_ext_replay_set_iblocks()
- ext4: fix potential infinite loop in ext4_dx_readdir()
- HID: u2fzero: ignore incomplete packets without data
- net: udp: annotate data race around udp_sk(sk)->corkflag
- ASoC: dapm: use component prefix when checking widget names
- usb: hso: remove the bailout parameter
- [x86] crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
(CVE-2021-3744, CVE-2021-3764)
- HID: betop: fix slab-out-of-bounds Write in betop_probe
- netfilter: ipset: Fix oversized kvmalloc() calls
- mm: don't allow oversized kvmalloc() calls
- HID: usbhid: free raw_report buffers in usbhid_stop
- [x86] KVM: x86: Handle SRCU initialization failure during page track init
- netfilter: conntrack: serialize hash resizes and cleanups
- netfilter: nf_tables: Fix oversized kvmalloc() calls
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.72
- [arm64,armhf] spi: rockchip: handle zero length transfers without timing
out
- nfsd: back channel stuck in SEQ4_STATUS_CB_PATH_DOWN
- btrfs: replace BUG_ON() in btrfs_csum_one_bio() with proper error handling
- btrfs: fix mount failure due to past and transient device flush error
- net: mdio: introduce a shutdown method to mdio device drivers
- xen-netback: correct success/error reporting for the SKB-with-fraglist
case
- scsi: sd: Free scsi_disk device via put_device()
- [arm*] usb: dwc2: check return value after calling platform_get_resource()
- nvme-fc: update hardware queues before using them
- nvme-fc: avoid race between time out and tear down
- [arm64] thermal/drivers/tsens: Fix wrong check for tzd in irq handlers
- scsi: ses: Retry failed Send/Receive Diagnostic commands
- [arm64,armhf] irqchip/gic: Work around broken Renesas integration
- smb3: correct smb3 ACL security descriptor
- KVM: do not shrink halt_poll_ns below grow_start
- [x86] kvm: Add AMD PMU MSRs to msrs_to_save_all[]
- [x86] KVM: nSVM: restore int_vector in svm_clear_vintr
- [x86] perf/x86: Reset destroy callback on event init failure
- libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD.
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.73
- [arm64,armhf] usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle
- USB: cdc-acm: fix racy tty buffer accesses
- USB: cdc-acm: fix break reporting
- usb: typec: tcpm: handle SRC_STARTUP state if cc changes
- drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows
- xen/privcmd: fix error handling in mmap-resource processing
- [arm64] mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk

[continued in next message]

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)