The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set . - CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to cause DoS . - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices . - CVE-2022-2978: Fixed use-after-free in the NILFS file system that could lead to local privilege escalation or DoS . - CVE-2022-3176: Fixed use-after-free in io_uring when using POLLFREE . - CVE-2022-3424: Fixed use-after-free in gru_set_context_option, gru_fault and gru_handle_user_call_os that could lead to kernel panic . - CVE-2022-3521: Fixed race condition in kcm_tx_work in net/kcm/kcmsock.c . - CVE-2022-3524: Fixed memory leak in ipv6_renew_options in the IPv6 handler . - CVE-2022-3535: Fixed memory leak in mvpp2_dbgfs_port_init in drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c . - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c . - CVE-2022-3545: Fixed use-after-free in area_cache_get in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c . - CVE-2022-3565: Fixed use-after-free in del_timer in drivers/isdn/mISDN/l1oip_core.c . - CVE-2022-3577: Fixed out-of-bounds memory write flaw in bigben device driver that could lead to local privilege escalation or DoS . - CVE-2022-3586: Fixed use-after-free in socket buffer that could allow a local unprivileged user to cause a denial of service . - CVE-2022-3594: Fixed excessive data logging in intr_callback in drivers/net/usb/r8152.c . - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level in fs/nilfs2/inode.c . - CVE-2022-3625: Fixed use-after-free in devlink_param_set/devlink_param_get in net/core/devlink.c . - CVE-2022-3629: Fixed memory leak in vsock_connect in net/vmw_vsock/af_vsock.c . - CVE-2022-3640: Fixed use-after-free in l2cap_conn_del in net/bluetooth/l2cap_core.c . - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer in fs/nilfs2/segment.c . - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode in fs/nilfs2/inode.c . - CVE-2022-39189: Fixed a flaw in the x86 KVM subsystem that could allow unprivileged guest users to compromise the guest kernel via TLB flush operations on preempted vCPU . - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse . - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor"s internal memory . The following non-security bugs were fixed: - ACPI: APEI: do not add task_work to kernel thread to avoid memory leak . - ACPI: HMAT: Release platform device in case of platform_device_add_data fails . - ACPI: extlog: Handle multiple records . - ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems . - ACPI: video: Add Toshiba Satellite/Portege Z830 quirk . - ALSA: Use del_timer_sync before freeing timer . - ALSA: ac97: fix possible memory leak in snd_ac97_dev_register . - ALSA: aoa: Fix I2S device accounting . - ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev . - ALSA: asihpi - Remove useless code in hpi_meter_get_peak . - ALSA: au88x0: use explicitly signed char . - ALSA: dmaengine: increment buffer pointer atomically . - ALSA: hda/hdmi: Do not skip notification handling during PM operation . - ALSA: hda/realtek: Add Intel Reference SSID to support headset keys . - ALSA: hda/realtek: Add pincfg for ASUS G513 HP jack . - ALSA: hda/realtek: Add pincfg for ASUS G533Z HP jack . - ALSA: hda/realtek: Add quirk for ASUS GA503R laptop . - ALSA: hda/realtek: Add quirk for ASUS GV601R laptop . - ALSA: hda/realtek: Add quirk for Huawei WRT-WX9 . - ALSA: hda/realtek: Correct pin configs for ASUS G533Z . - ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5530 laptop . - ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530 . - ALSA: hda/sigmatel: Fix unused variable warning for beep power change . - ALSA: hda/sigmatel: Keep power up while beep is enabled . - ALSA: hda/tegra: Align BDL entry to 4KB boundary . - ALSA: hda: Fix position reporting on Poulsbo . - ALSA: hda: add Intel 5 Series / 3400 PCI DID . - ALSA: oss: Fix potential deadlock at unregistration . - ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free . - ALSA: rme9652: use explicitly signed char . - ALSA: usb-audio: Fix NULL dererence at error path . - ALSA: usb-audio: Fix potential memory leaks . - ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API . - ASoC: fsl_sai: Remove unnecessary FIFO reset in ISR . - ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe . - ASoC: nau8824: Fix semaphore unbalance at error paths . - ASoC: rsnd: Add check for rsnd_mod_power_on . - ASoC: tas2770: Reinit regcache on reset . - ASoC: wcd9335: fix order of Slimbus unprepare/disable . - ASoC: wcd934x: fix order of Slimbus unprepare/disable . - ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe . - ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe . - ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe . - Bluetooth: L2CAP: Fix user-after-free . - Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create . - Bluetooth: hci_core: Fix not handling link timeouts propertly . - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times . - HID: hidraw: fix memory leak in hidraw_release . - HID: magicmouse: Do not set BTN_MOUSE on double report . - HID: multitouch: Add memory barriers . - HID: roccat: Fix use-after-free in roccat_read . - HSI: omap_ssi: Fix refcount leak in ssi_probe . - HSI: omap_ssi_port: Fix dma_map_sg error check . - IB/cm: Cancel mad on the DREQ event when the state is MRA_REP_RCVD - IB/cma: Allow XRC INI QPs to set their local ACK timeout - IB/core: Only update PKEY and GID caches on respective events - IB/hfi1: Adjust pkey entry in index 0 - IB/hfi1: Fix abba locking issue with sc_disable - IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs - IB/mlx4: Add support for REJ due to timeout - IB/mlx4: Use port iterator and validation APIs - IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields - IB/rdmavt: Add __init/__exit annotations to module init/exit funcs - IB/srpt: Remove redundant assignment to ret - Input: i8042 - fix refount leak on sparc . - Input: xpad - add supported devices as contributed on github . - Input: xpad - fix wireless 360 controller breaking after suspend . - KVM: nVMX: Unconditionally purge queued/injected events on nested "exit" . - KVM: s390: Clarify SIGP orders versus STOP/RESTART . - KVM: s390: VSIE: fix MVPG handling for prefixing and MSO . - KVM: s390: clear kicked_mask before sleeping again . - KVM: s390: preserve deliverable_mask in __airqs_kick_single_vcpu . - KVM: s390: pv: do not present the ecall interrupt twice . - KVM: s390: split kvm_s390_real_to_abs . - KVM: s390x: fix SCK locking . - KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility . - PCI: Dynamically map ECAM regions . - PCI: Fix used_buses calculation in pci_scan_child_bus_extend . - PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge . - PM: domains: Fix handling of unavailable/disabled idle states . - PM: hibernate: Allow hybrid sleep to work with s2idle . - RDMA/bnxt_re: Add missing spin lock initialization - RDMA/bnxt_re: Fix query SRQ failure - RDMA/cm: Fix memory leak in ib_cm_insert_listen - RDMA/cma: Ensure rdma_addr_cancel happens before issuing more requests - RDMA/cma: Fix arguments order in net device validation - RDMA/core: Sanitize WQ state received from the userspace - RDMA/cxgb4: Remove MW support - RDMA/efa: Free IRQ vectors on error flow - RDMA/efa: Remove double QP type assignment - RDMA/efa: Use ib_umem_num_dma_pages - RDMA/hfi1: Fix potential integer multiplication overflow errors - RDMA/hns: Remove unnecessary check for the sgid_attr when modifying QP - RDMA/i40iw: Use ib_umem_num_dma_pages - RDMA/iwcm: Release resources if iw_cm module initialization fails - RDMA/mlx4: Return missed an error if device does not support steering - RDMA/mlx5: Add missing check for return value in get namespace flow - RDMA/mlx5: Block FDB rules when not in switchdev mode - RDMA/mlx5: Fix memory leak in error flow for subscribe event routine - RDMA/mlx5: Make mkeys always owned by the kernel"s PD when not enabled - RDMA/mlx5: Set user priority for DCT - RDMA/mlx5: Use set_mkc_access_pd_addr_fields in reg_create - RDMA/qedr: Fix NULL deref for query_qp on the GSI QP - RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr - RDMA/qedr: Fix reporting QP timeout attribute - RDMA/qib: Remove superfluous fallthrough statements - RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL - RDMA/rxe: Do not overwrite errno from ib_umem_get - RDMA/rxe: Fix "kernel NULL pointer dereference" error - RDMA/rxe: Fix error unwind in rxe_create_qp - RDMA/rxe: Fix extra copies in build_rdma_network_hdr - RDMA/rxe: Fix extra copy in prepare_ack_packet - RDMA/rxe: Fix failure during driver load - RDMA/rxe: Fix over copying in get_srq_wqe - RDMA/rxe: Fix redundant call to ip_send_check - RDMA/rxe: Fix redundant skb_put_zero - RDMA/rxe: Fix rnr retry behavior - RDMA/rxe: Fix the error caused by qp-greater than sk - RDMA/rxe: Fix wrong port_cap_flags - RDMA/rxe: Generate a completion for unsupported/invalid opcode - RDMA/rxe: Remove unused pkt-greater than offset - RDMA/rxe: Return CQE error if invalid lkey was supplied - RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string - RDMA/siw: Always consume all skbuf data in sk_data_ready upcall. - RDMA/siw: Fix a condition race issue in MPA request processing - RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event - RDMA/siw: Pass a pointer to virt_to_page - RDMA/usnic: fix set-but-not-unused variable "flags" warning - RDMA: Verify port when creating flow rule - RDMA: remove useless condition in siw_create_cq - RDMa/mthca: Work around -Wenum-conversion warning - Revert "drivers/video/backlight/platform_lcd.c: add support for - Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time" . - Revert "usb: add quirks for Lenovo OneLink+ Dock" . - Revert "usb: storage: Add quirk for Samsung Fit flash" . - Revert "usb: storage: Add quirk for Samsung Fit flash" . - USB: serial: console: move mutex_unlock before usb_serial_put . - USB: serial: ftdi_sio: fix 300 bps rate for SIO . - USB: serial: option: add Quectel BG95 0x0203 composition . - USB: serial: option: add Quectel BG95 0x0203 composition . - USB: serial: option: add Quectel RM520N . - USB: serial: option: add Quectel RM520N . - USB: serial: qcserial: add new usb-id for Dell branded EM7455 . - USB: serial: qcserial: add new usb-id for Dell branded EM7455 . - arm64: assembler: add cond_yield macro - ata: fix ata_id_has_devslp . - ata: fix ata_id_has_dipm . - ata: fix ata_id_has_ncq_autosense . - ata: fix ata_id_sense_reporting_enabled and ata_id_has_sense_reporting . - ata: libahci_platform: Sanity check the DT child nodes number . - can: bcm: check the result of can_send in bcm_can_tx . - can: gs_usb: gs_can_open: fix race dev-greater than can.state condition . - can: kvaser_usb: Fix possible completions during init_completion . - can: kvaser_usb: Fix use of uninitialized completion . - can: kvaser_usb_leaf: Fix CAN state after restart . - can: kvaser_usb_leaf: Fix TX queue out of sync after restart . - can: mscan: mpc5xxx: mpc5xxx_can_probe: add missing put_clock in error path . - cgroup/cpuset: Enable update_tasks_cpumask on top_cpuset . - clk: bcm2835: Make peripheral PLLC critical . - clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration . - clk: berlin: Add of_node_put for of_get_parent . - clk: imx: imx6sx: remove the SET_RATE_PARENT flag for QSPI clocks . - clk: iproc: Do not rely on node name for correct PLL setup . - clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent . - clk: oxnas: Hold reference returned by of_get_parent . - clk: qcom: gcc-msm8916: use ARRAY_SIZE instead of specifying num_parents . - clk: qoriq: Hold reference returned by of_get_parent . - clk: tegra20: Fix refcount leak in tegra20_clock_init . - clk: tegra: Fix refcount leak in tegra114_clock_init . - clk: tegra: Fix refcount leak in tegra210_clock_init . - clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe . - clk: zynqmp: Fix stack-out-of-bounds in strncpy` . - clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate . - crypto: akcipher - default implementation for setting a private key . - crypto: arm64/sha - fix function types - crypto: arm64/sha1-ce - simplify NEON yield - crypto: arm64/sha2-ce - simplify NEON yield - crypto: arm64/sha3-ce - simplify NEON yield - crypto: arm64/sha512-ce - simplify NEON yield - crypto: cavium - prevent integer overflow loading firmware . - crypto: ccp - Release dma channels before dmaengine unrgister . - crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr . - device property: Fix documentation for *_match_string APIs . - dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup . - dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure . - dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property . - docs: update mediator information in CoC docs . - drivers: serial: jsm: fix some leaks in probe . - drm/amd/display: Limit user regamma to a valid value . - drm/amdgpu: do not register a dirty callback for non-atomic . - drm/amdgpu: fix initial connector audio value . - drm/amdgpu: use dirty framebuffer helper . - drm/bridge: Avoid uninitialized variable warning . - drm/bridge: megachips: Fix a null pointer dereference bug . - drm/bridge: parade-ps8640: Fix regulator supply order . - drm/i915/gvt: fix a memory leak in intel_gvt_init_vgpu_types . - drm/mipi-dsi: Detach devices when removing the host . - drm/msm/dpu: Fix comment typo . - drm/msm/dpu: index dpu_kms-greater than hw_vbif using vbif_idx . - drm/msm/dsi: fix memory corruption with too many bridges . - drm/msm/hdmi: fix memory corruption with too many bridges . - drm/msm: Fix return type of mdp4_lvds_connector_mode_valid . - drm/msm: Make .remove and .shutdown HW shutdown consistent . - drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc . - drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table . - drm/omap: dss: Fix refcount leak bugs . - drm/rockchip: Fix return type of cdn_dp_connector_mode_valid . - drm/scheduler: quieten kernel-doc warnings . - drm/udl: Restore display mode on resume . - drm: Prevent drm_copy_field to attempt copying a NULL pointer . - drm: Use size_t type for len variable in drm_copy_field . - drm: bridge: adv7511: fix CEC power down control register offset . - drm: fix drm_mipi_dbi build errors . - drm: panel-orientation-quirks: Add quirk for Anbernic Win600 . - drm:pl111: Add of_node_put when breaking out of for_each_available_child_of_node . - dyndbg: fix module.dyndbg handling . - dyndbg: let query-modname override actual module name . - efi: Correct Macmini DMI match in uefi cert quirk . - efi: libstub: drop pointless get_memory_map call . - exfat: Return ENAMETOOLONG consistently for oversized paths . - fbdev: cyber2000fb: fix missing pci_disable_device . - fbdev: da8xx-fb: Fix error handling in .remove . - firmware: arm_scmi: Add SCMI PM driver remove routine . - firmware: google: Test spinlock on panic path to avoid lockups . - fpga: prevent integer overflow in dfl_feature_ioctl_set_irq . - gpio: rockchip: request GPIO mux to pinctrl when setting direction . - hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event . - hwmon/coretemp: Handle large core ID value . - iio: ABI: Fix wrong format of differential capacitance channel ABI . - iio: adc: ad7923: fix channel readings for some variants . - iio: adc: at91-sama5d2_adc: check return status for pressure and touch . - iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX . - iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq . - iio: adc: mcp3911: use correct id bits . - iio: dac: ad5593r: Fix i2c read protocol requirements . - iio: inkern: only release the device node when done with it . - iio: light: tsl2583: Fix module unloading . - iio: pressure: dps310: Refactor startup procedure . - iio: pressure: dps310: Reset chip after timeout . - irqchip/ls-extirq: Fix invalid wait context by avoiding to use regmap . - kABI: arm64/crypto/sha512 Preserve function signature . - kbuild: Add skip_encoding_btf_enum64 option to pahole . - kbuild: remove the target in signal traps when interrupted . - kbuild: sink stdout from cmd for silent build . - kbuild: skip per-CPU BTF generation for pahole v1.18-v1.21 . - kthread: Extract KTHREAD_IS_PER_CPU . - lib/sg_pool: change module_init to subsys_initcall . - libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205 . - locking/csd_lock: Change csdlock_debug from early_param to __setup . - mISDN: fix use-after-free bugs in l1oip timer handlers . - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq . - mac802154: Fix LQI recording . - mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg . - media: aspeed-video: ignore interrupts that are not enabled . - media: cedrus: Set the platform driver data earlier . - media: coda: Add more H264 levels for CODA960 . - media: coda: Fix reported H264 profile . - media: cx88: Fix a null-ptr-deref bug in buffer_prepare . - media: dvb_vb2: fix possible out of bound access . - media: v4l2-dv-timings: add sanity checks for blanking values . - media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check "interlaced" . - media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init . - memory: of: Fix refcount leak bug in of_get_ddr_timings . - memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe . - mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq . - mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe . - mfd: lp8788: Fix an error handling path in lp8788_irq_init and lp8788_irq_init . - mfd: lp8788: Fix an error handling path in lp8788_probe . - mfd: sm501: Add check for platform_driver_register . - misc: ocxl: fix possible refcount leak in afu_ioctl . - mm, memcg: avoid stale protection values when cgroup is above protection . - mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page . - mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim . - mmc: au1xmmc: Fix an error handling path in au1xmmc_probe . - mmc: core: Fix kernel panic when remove non-standard SDIO card . - mmc: core: Replace with already defined values for readability . - mmc: core: Terminate infinite loop in SD-UHS voltage switch . - mmc: moxart: fix 4-bit bus width and remove 8-bit bus width . - mmc: sdhci-msm: add compatible string check for sdm670 . - mmc: sdhci-sprd: Fix minimum clock limit . - mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe . - mtd: devices: docg3: check the return value of devm_ioremap in the probe . - mtd: rawnand: atmel: Unmap streaming DMA mappings . - mtd: rawnand: marvell: Use correct logic for nand-keep-config . - mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct . - net/ieee802154: fix uninit value bug in dgram_sendmsg . - net: ieee802154: return -EINVAL for unknown addr type . - net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 . - net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 . - net: usb: qmi_wwan: add Quectel RM520N . - openvswitch: Fix double reporting of drops in dropwatch . - openvswitch: Fix overreporting of drops in dropwatch . - openvswitch: switch from WARN to pr_warn . - padata: introduce internal padata_get/put_pd helpers . - padata: make padata_free_shell to respect pd"s -greater than refcnt . - parisc/sticon: fix reverse colors Backporting notes: * context changes - parisc: parisc-agp requires SBA IOMMU driver - phy: qualcomm: call clk_disable_unprepare in the error handling . - pinctrl: armada-37xx: Add missing GPIO-only pins . - pinctrl: armada-37xx: Checks for errors in gpio_request_enable callback . - pinctrl: armada-37xx: Fix definitions for MPP pins 20-22 . - pinctrl: rockchip: add pinmux_ops.gpio_set_direction callback . - platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading . - platform/x86: msi-laptop: Fix old-ec check for backlight registering . - platform/x86: msi-laptop: Fix resource cleanup . - power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type . - powerpc/64: Remove unused SYS_CALL_TABLE symbol . - powerpc/fadump: align destination address to pagesize . - powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe . - powerpc/mm/64s: Drop pgd_huge . - powerpc/mm: remove pmd_huge/pud_huge stubs and include hugetlb.h . - powerpc/pci_dn: Add missing of_node_put . - powerpc/powernv: add missing of_node_put in opal_export_attrs . - powerpc/pseries: Interface to represent PAPR firmware attributes . - quota: widen timestamps for the fs_disk_quota structure . - regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe . - regulator: qcom_rpm: Fix circular deferral regression . - reset: imx7: Fix the iMX8MP PCIe PHY PERST support . - rpmsg: qcom: glink: replace strncpy with strscpy_pad . - rtc: stmp3xxx: Add failure handling for stmp3xxx_wdt_register . - s390/hypfs: avoid error message under KVM . - sbitmap: Avoid leaving waitqueue in invalid state in __sbq_wake_up . - sbitmap: fix possible io hung due to lost wakeup . - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg . - scsi: mpt3sas: Fix return value check of dma_get_required_mask . - scsi: qla2xxx: Fix disk failure to rediscover . - selftest/powerpc: Add PAPR sysfs attributes sniff test . - selftests/powerpc: Skip energy_scale_info test on older firmware . - serial: Create uart_xmit_advance . - serial: tegra-tcu: Use uart_xmit_advance, fixes icount.tx accounting . - serial: tegra: Use uart_xmit_advance, fixes icount.tx accounting . - soc: qcom: smem_state: Add refcounting for the "state-greater than of_node" . - soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe . - soc: sunxi: sram: Actually claim SRAM regions . - soc: sunxi: sram: Fix debugfs info for A64 SRAM C . - soc: sunxi: sram: Prevent the driver from being unbound . - soc: sunxi_sram: Make use of the helper function devm_platform_ioremap_resource . - spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe . - spi: mt7621: Fix an error message in mt7621_spi_probe . - spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime . - spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume . - spi: s3c64xx: Fix large transfers with DMA . - staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv . - staging: vt6655: fix potential memory leak . - staging: vt6655: fix some erroneous memory clean-up loops . - struct pci_config_window kABI workaround . - thermal: intel_powerclamp: Use first online CPU as control_cpu . - thermal: intel_powerclamp: Use get_cpu instead of smp_processor_id to avoid crash . - tty/serial: atmel: RS485 ISO7816: wait for TXRDY before sending data . - tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown . - tty: xilinx_uartps: Fix the ignore_status . - uas: add no-uas quirk for Hiksemi usb_disk . - uas: ignore UAS for Thinkplus chips . - usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS . - usb: add quirks for Lenovo OneLink+ Dock . - usb: add quirks for Lenovo OneLink+ Dock . - usb: bdc: change state when port disconnected . - usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind . - usb: dwc3: gadget: Do not set IMI for no_interrupt . - usb: dwc3: gadget: Prevent repeat pullup . - usb: dwc3: gadget: Stop processing more requests on IMI . - usb: gadget: function: fix dangling pnp_string in f_printer.c . - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info . - usb: idmouse: fix an uninit-value in idmouse_open . - usb: mon: make mmapped memory read only . - usb: musb: Fix musb_gadget.c rxstate overflow bug . - usb: typec: ucsi: Remove incorrect warning . - usb: xhci-mtk: add a function to load bandwidth info . - usb: xhci-mtk: add only one extra CS for FS/LS INTR . - usb: xhci-mtk: add some schedule error number . - usb: xhci-mtk: fix issue of out-of-bounds array access . - usb: xhci-mtk: get the microframe boundary for ESIT . - usb: xhci-mtk: use @sch_tt to check whether need do TT schedule . - vhost/vsock: Use kvmalloc/kvfree for larger packets . - video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write . - watchdog: armada_37xx_wdt: Fix .set_timeout callback . - watchdog: ftwdt010_wdt: fix test for platform_get_irq failure . - wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state . - wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg . - wifi: brcmfmac: fix invalid address access when enabling SCAN log level . - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit . - wifi: cfg80211: update hidden BSSes to avoid WARN_ON . - wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue . - wifi: mac80211: Fix UAF in ieee80211_scan_rx . - wifi: mac80211: allow bw change during channel switch in mesh . - wifi: mac80211: do not drop packets smaller than the LLC-SNAP header on fast-rx . - wifi: mac80211_hwsim: avoid mac80211 warning on bad rate . - wifi: rt2x00: correctly set BBP register 86 for MT7620 . - wifi: rt2x00: do not run Rt5592 IQ calibration on MT7620 . - wifi: rt2x00: set SoC wmac clock register . - wifi: rt2x00: set VGC gain for both chains of MT7620 . - wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 . - wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM . - wifi: rtl8xxxu: Fix skb misuse in TX queue selection . - wifi: rtl8xxxu: Improve rtl8xxxu_queue_select . - wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask . - wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration . - wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse . - xfs: add missing assert in xfs_fsmap_owner_from_rmap . - xfs: enable big timestamps . - xfs: enable new inode btree counters feature . - xfs: explicitly define inode timestamp range . - xfs: fix memory corruption during remote attr value buffer invalidation . - xfs: fix s_maxbytes computation on 32-bit kernels . - xfs: hoist out xfs_resizefs_init_new_ags . - xfs: move incore structures out of xfs_da_format.h . - xfs: quota: move to time64_t interfaces . - xfs: redefine xfs_ictimestamp_t . - xfs: redefine xfs_timestamp_t . - xfs: refactor remote attr value buffer invalidation . - xfs: remove obsolete AGF counter debugging . - xfs: rename `new" to `delta" in xfs_growfs_data_private . - xfs: reserve data and rt quota at the same time . - xfs: slightly tweak an assert in xfs_fs_map_blocks . - xfs: store inode btree block counts in AGI header . - xfs: streamline xfs_attr3_leaf_inactive . - xfs: use a struct timespec64 for the in-core crtime . - xfs: use the finobt block counts to speed up mount times . - xfs: widen ondisk inode timestamps to deal with y2038+ . - xfs: widen ondisk quota expiration timestamps to handle y2038+ . - xhci: Do not show warning for reinit on known broken suspend . Special Instructions and Notes: Please reboot the system after installing this update.