Accepted linux 6.1.90-1~bpo11+1 (source) into bullseye-backports

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 06 May 2024 16:52:31 +0200
Source: linux
Architecture: source
Version: 6.1.90-1~bpo11+1
Distribution: bullseye-backports
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Ben Hutchings <benh@debian.org>
Closes: 1024149 1054514 1056056 1061521 1063338 1063422 1065320 1068675 1068770 1069092 1069102
Changes:
 linux (6.1.90-1~bpo11+1) bullseye-backports; urgency=medium
 .
   * Rebuild for bullseye-backports:
     - Set ABI to 0.deb11.21
 .
 linux (6.1.90-1) bookworm-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.86
     - amdkfd: use calloc instead of kzalloc to avoid integer overflow
       (CVE-2024-26817)
     - wifi: ath9k: fix LNA selection in ath_ant_try_scan()
     - bnx2x: Fix firmware version string character counts
     - wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor
     - [x86] VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
     - wifi: iwlwifi: pcie: Add the PCI device id for new hardware
     - panic: Flush kernel log buffer at the end
     - cpuidle: Avoid potential overflow in integer multiplication
     - [arm64] dts: rockchip: fix rk3328 hdmi ports node
     - [arm64] dts: rockchip: fix rk3399 hdmi ports node
     - ionic: set adminq irq affinity
     - net: skbuff: add overflow debug check to pull/push helpers
     - wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro
     - pstore/zone: Add a null pointer check to the psz_kmsg_read
     - net: pcs: xpcs: Return EINVAL in the internal methods
     - dma-direct: Leak pages on dma_set_decrypted() failure
     - wifi: ath11k: decrease MHI channel buffer length to 8KB
     - cpufreq: Don't unregister cpufreq cooling on CPU hotplug
     - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
     - btrfs: export: handle invalid inode or root reference in
       btrfs_get_parent()
     - btrfs: send: handle path ref underflow in header iterate_inode_ref()
     - ice: use relative VSI index for VFs instead of PF VSI number
     - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
     - Bluetooth: btintel: Fix null ptr deref in btintel_read_version
     - Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922
     - [arm64,armhf] drm/vc4: don't check if plane->state->fb == state->fb
     - Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
     - drm: panel-orientation-quirks: Add quirk for GPD Win Mini
     - pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs
     - sysv: don't call sb_bread() with pointers_lock held
     - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
     - isofs: handle CDs with bad root inode but good Joliet root directory
     - ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710)
       laptops
     - rcu-tasks: Repair RCU Tasks Trace quiescence check
     - Julia Lawall reported this null pointer dereference, this should fix it.
     - media: sta2x11: fix irq handler cast
     - ALSA: firewire-lib: handle quirk to calculate payload quadlets as data
       block counter
     - ext4: add a hint for block bitmap corrupt state in mb_groups
     - ext4: forbid commit inconsistent quota data when errors=remount-ro
     - drm/amd/display: Fix nanosec stat overflow
     - drm/amd/amdgpu: Fix potential ioremap() memory leaks in
       amdgpu_device_init()
     - SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to
       unsigned int
     - Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
     - libperf evlist: Avoid out-of-bounds access
     - input/touchscreen: imagis: Correct the maximum touch area value
     - block: prevent division by zero in blk_rq_stat_sum()
     - RDMA/cm: add timeout to cm_destroy_id wait
     - Input: imagis - use FIELD_GET where applicable
     - Input: allocate keycode for Display refresh rate toggle
     - platform/x86: touchscreen_dmi: Add an extra entry for a variant of the
       Chuwi Vi8 tablet
     - [x86] perf/x86/amd/lbr: Discard erroneous branch entries
     - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent
       environment
     - bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state
     - usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR
     - [x86] thunderbolt: Keep the domain powered when USB4 port is in redrive
       mode
     - usb: typec: tcpci: add generic tcpci fallback compatible
     - usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
     - thermal/of: Assume polling-delay(-passive) 0 when absent
     - ASoC: soc-core.c: Skip dummy codec when adding platforms
     - fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
     - io_uring: clear opcode specific data for an early failure
     - drivers/nvme: Add quirks for device 126f:2262
     - fbmon: prevent division by zero in fb_videomode_from_videomode()
     - netfilter: nf_tables: release batch on table validation from abort path
     - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
       (CVE-2024-26925)
     - netfilter: nf_tables: discard table flag update with pending basechain
       deletion
     - gcc-plugins/stackleak: Avoid .head.text section
     - virtio: reenable config if freezing device failed
     - randomize_kstack: Improve entropy diffusion
     - [x86] platform/x86: intel-vbtn: Update tablet mode switch at end of probe
     - Bluetooth: btintel: Fixe build regression
     - net: mpls: error out if inner headers are not set
     - [x86] VMCI: Fix possible memcpy() run-time warning in
       vmci_datagram_invoke_guest_handler()
     - Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in
       amdgpu_device_init()"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.87
     - smb3: fix Open files on server counter going negative
     - ata: libata-scsi: Fix ata_scsi_dev_rescan() error path
     - batman-adv: Avoid infinite loop trying to resize local TT
     - ring-buffer: Only update pages_touched when a new page is touched
     - Bluetooth: Fix memory leak in hci_req_sync_complete()
     - drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11
     - PM: s2idle: Make sure CPUs will wakeup directly on resume
     - media: cec: core: remove length check of Timer Status
     - Revert "drm/qxl: simplify qxl_fence_wait" (Closes: #1054514)
     - nouveau: fix function cast warning
     - scsi: hisi_sas: Modify the deadline for ata_wait_after_reset()
     - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()
     - net: openvswitch: fix unwanted error log on timeout policy probing
     - u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one
       file
     - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
     - geneve: fix header validation in geneve[6]_xmit_skb
     - bnxt_en: Reset PTP tx_avail after possible firmware reset
     - af_unix: Clear stale u->oob_skb.
     - ipv6: fib: hide unused 'pn' variable
     - ipv4/route: avoid unused-but-set-variable warning
     - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
     - Bluetooth: SCO: Fix not validating setsockopt user input
     - Bluetooth: L2CAP: Fix not validating setsockopt user input
     - netfilter: complete validation of user input
     - net/mlx5: Properly link new fs rules into the tree
     - net/mlx5e: Fix mlx5e_priv_init() cleanup flow
     - net/mlx5e: HTB, Fix inconsistencies with QoS SQs number
     - af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
     - af_unix: Fix garbage collector racing against connect() (CVE-2024-26923)
     - net: ena: Fix potential sign extension issue
     - net: ena: Wrong missing IO completions check order
     - net: ena: Fix incorrect descriptor free behavior
     - tracing: hide unused ftrace_event_id_fops
     - [amd64] iommu/vt-d: Allocate local memory for page request queue
     - btrfs: qgroup: correctly model root qgroup rsv in convert
     - btrfs: record delayed inode root in transaction
     - btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans
     - io_uring/net: restore msg_control on sendzc retry
     - kprobes: Fix possible use-after-free issue on kprobe registration
     - [x86] drm/i915/vrr: Disable VRR when using bigjoiner
     - drm/ast: Fix soft lockup
     - drm/client: Fully protect modes[] with dev->mode_config.mutex
     - vhost: Add smp_rmb() in vhost_vq_avail_empty()
     - vhost: Add smp_rmb() in vhost_enable_notify()
     - [x86] perf/x86: Fix out of range data
     - [x86] cpu: Actually turn off mitigations by default for
       SPECULATION_MITIGATIONS=n
     - [x86] apic: Force native_apic_mem_read() to use the MOV instruction
     - irqflags: Explicitly ignore lockdep_hrtimer_exit() argument
     - [x86] bugs: Fix return type of spectre_bhi_state()
     - [x86] bugs: Fix BHI documentation
     - [x86] bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES
     - [x86] bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr'
     - [x86] bugs: Fix BHI handling of RRSBA
     - [x86] bugs: Clarify that syscall hardening isn't a BHI mitigation
     - [x86] bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto
     - [x86] bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with
       CONFIG_MITIGATION_SPECTRE_BHI
     - [x86] drm/i915/cdclk: Fix CDCLK programming order when pipes are active
     - [x86] drm/i915: Disable port sync when bigjoiner is used
     - drm/amdgpu: Reset dGPU if suspend got aborted
     - drm/amdgpu: always force full reset for SOC21
     - drm/amd/display: fix disable otg wa logic in DCN316
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.88
     - drm/vmwgfx: Enable DMA mappings with SEV
     - drm/amdgpu: fix incorrect active rb bitmap for gfx11
     - drm/amdgpu: fix incorrect number of active RBs for gfx11
     - drm/amd/display: Do not recursively call manual trigger programming
     - io_uring: Fix io_cqring_wait() not restoring sigmask on get_timespec64()
       failure
     - SUNRPC: Fix rpcgss_context trace event acceptor field
     - random: handle creditable entropy from atomic process context
     - net: usb: ax88179_178a: avoid writing the mac address before first reading
     - [x86] drm/i915/vma: Fix UAF on destroy against retire race
     - [x86] efi: Drop EFI stub .bss from .data section
     - [x86] efi: Disregard setup header of loaded image
     - [x86] efistub: Reinstate soft limit for initrd loading
     - [x86] efi: Drop alignment flags from PE section headers
     - [x86] boot: Remove the 'bugger off' message
     - [x86] boot: Omit compression buffer from PE/COFF image memory footprint
     - [x86] boot: Drop redundant code setting the root device
     - [x86] boot: Drop references to startup_64
     - [x86] boot: Grab kernel_info offset from zoffset header directly
     - [x86] boot: Set EFI handover offset directly in header asm
     - [x86] boot: Define setup size in linker script
     - [x86] boot: Derive file size from _edata symbol
     - [x86] boot: Construct PE/COFF .text section from assembler
     - [x86] boot: Drop PE/COFF .reloc section
     - [x86] boot: Split off PE/COFF .data section
     - [x86] boot: Increase section and file alignment to 4k/512
     - [x86] efistub: Use 1:1 file:memory mapping for PE/COFF .compat section
     - [x86] mm: Remove P*D_PAGE_MASK and P*D_PAGE_SIZE macros
     - [x86] head/64: Add missing __head annotation to startup_64_load_idt()
     - [x86] head/64: Move the __head definition to <asm/init.h>
     - [x86] sme: Move early SME kernel encryption handling into .head.text
     - [x86] sev: Move early startup code into .head.text section
     - [x86] efistub: Remap kernel text read-only before dropping NX attribute
     - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
     - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
     - netfilter: br_netfilter: skip conntrack input hook for promisc packets
     - netfilter: nft_set_pipapo: do not free live element (CVE-2024-26924)
     - netfilter: flowtable: validate pppoe header
     - netfilter: flowtable: incorrect pppoe tuple
     - af_unix: Call manage_oob() for every skb in unix_stream_read_generic().
     - af_unix: Don't peek OOB data without MSG_OOB.
     - net/mlx5: Lag, restore buckets number to default after hash LAG
       deactivation
     - net/mlx5e: Prevent deadlock while disabling aRFS
     - ice: tc: allow zero flags in parsing tc flower
     - tun: limit printing rate when illegal packet received by tun dev
     - [arm64] net: ethernet: ti: am65-cpsw-nuss: cleanup DMA Channels before
       using them
     - RDMA/rxe: Fix the problem "mutex_destroy missing"
     - RDMA/cm: Print the old state when cm_destroy_id gets timeout
     - RDMA/mlx5: Fix port number for counter query in multi-port configuration
     - [s390x] qdio: handle deferred cc1
     - [s390x] cio: fix race condition during online processing
     - drm: nv04: Fix out of bounds access
     - [armhf] omap2: n8x0: stop instantiating codec platform data
     - PCI: Avoid FLR for SolidRun SNET DPU rev 1
     - HID: kye: Sort kye devices
     - usb: pci-quirks: Reduce the length of a spinlock section in
       usb_amd_find_chipset_info()
     - PCI: Delay after FLR of Solidigm P44 Pro NVMe
     - [x86] quirks: Include linux/pnp.h for arch_pnpbios_disabled()
     - [x86] thunderbolt: Log function name of the called quirk
     - [x86] thunderbolt: Add debug log for link controller power quirk
     - PCI: Execute quirk_enable_clear_retrain_link() earlier
     - ALSA: scarlett2: Move USB IDs out from device_info struct
     - ALSA: scarlett2: Add support for Clarett 8Pre USB
     - ASoC: ti: Convert Pandora ASoC to GPIO descriptors
     - ALSA: scarlett2: Default mixer driver to enabled
     - ALSA: scarlett2: Add correct product series name to messages
     - ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support
     - ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support
     - PCI/DPC: Use FIELD_GET()
     - PCI: Simplify pcie_capability_clear_and_set_word() to ..._clear_word()
     - ALSA: scarlett2: Rename scarlett_gen2 to scarlett2
     - drm: panel-orientation-quirks: Add quirk for Lenovo Legion Go
     - usb: xhci: Add timeout argument in address_device USB HCD callback
     - usb: new quirk to reduce the SET_ADDRESS request timeout
     - clk: Remove prepare_lock hold assertion in __clk_release()
     - clk: Print an info line before disabling unused clocks
     - clk: Initialize struct clk_core kref earlier
     - clk: Get runtime PM before walking tree during disable_unused
     - clk: remove unnecessary (void*) conversions
     - clk: Show active consumers of clocks in debugfs
     - clk: Get runtime PM before walking tree for clk_summary
     - [x86] bugs: Fix BHI retpoline check
     - [x86] cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
     - ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC
     - [arm*] binder: check offset alignment in binder_get_object()
       (CVE-2024-26926)
     - [x86] thunderbolt: Avoid notify PM core about runtime PM resume
     - [x86] thunderbolt: Fix wake configurations after device unplug
     - [x86] comedi: vmk80xx: fix incomplete endpoint checking
     - [armhf] serial: stm32: Return IRQ_NONE in the ISR if no handling happend
     - [armhf] serial: stm32: Reset .throttled state in .startup()
     - USB: serial: option: add Fibocom FM135-GL variants
     - USB: serial: option: add support for Fibocom FM650/FG650
     - USB: serial: option: add Lonsung U8300/U9300 product
     - USB: serial: option: support Quectel EM060K sub-models
     - USB: serial: option: add Rolling RW101-GL and RW135-GL support
     - USB: serial: option: add Telit FN920C04 rmnet compositions
     - Revert "usb: cdc-wdm: close race between read and workqueue"
     - [arm64,armhf] usb: dwc2: host: Fix dereference issue in DDMA completion
       flow.
     - usb: Disable USB3 LPM at shutdown
     - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport
       error
     - mei: me: disable RPL-S on SPS and IGN firmwares
     - speakup: Avoid crash on very long word
     - fs: sysfs: Fix reference leak in sysfs_break_active_protection()
     - [x86] KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel
       compatible
     - [x86] KVM: x86/pmu: Disable support for adaptive PEBS
     - [x86] KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms
     - [arm64] hibernate: Fix level3 translation fault in swsusp_save()
     - init/main.c: Fix potential static_command_line memory overflow
     - mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled
     - drm/amdgpu: validate the parameters of bo mapping operations more clearly
       (CVE-2024-26922)
     - drm/vmwgfx: Sort primary plane formats by order of preference
     - drm/vmwgfx: Fix crtc's atomic check conditional
     - nouveau: fix instmem race condition around ptr stores
     - bootconfig: use memblock_free_late to free xbc memory to buddy
     - nilfs2: fix OOB in nilfs_set_de_type
     - net: dsa: introduce preferred_default_local_cpu_port and use on MT7530
     - ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
     - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
     - ksmbd: clear RENAME_NOREPLACE before calling vfs_rename
     - ksmbd: common: use struct_group_attr instead of struct_group for
       network_open_info
     - PCI/ASPM: Fix deadlock when enabling ASPM (CVE-2024-26605)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.89
     - Revert "ASoC: ti: Convert Pandora ASoC to GPIO descriptors"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.90
     - smb: client: fix rename(2) regression against samba
     - cifs: reinstate original behavior again for forceuid/forcegid
     - [amd64] HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized
       dev->devc
     - HID: logitech-dj: allow mice to use all types of reports
     - wifi: iwlwifi: mvm: remove old PASN station when adding a new one
     - wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd
     - vxlan: drop packets from invalid src-address
     - icmp: prevent possible NULL dereferences from icmp_build_probe()
     - bridge/br_netlink.c: no need to return void function
     - bnxt_en: refactor reset close code
     - bnxt_en: Fix the PCI-AER routines
     - NFC: trf7970a: disable all regulators on removal
     - ax25: Fix netdev refcount issue
     - net: make SK_MEMORY_PCPU_RESERV tunable
     - net: fix sk_memory_allocated_{add|sub} vs softirqs
     - ipv4: check for NULL idev in ip_route_use_hint()
     - net: usb: ax88179_178a: stop lying about skb->truesize
     - net: gtp: Fix Use-After-Free in gtp_dellink
     - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID
     - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor
     - Bluetooth: qca: set power_ctrl_enabled on NULL returned by
       gpiod_get_optional()
     - ipvs: Fix checksumming on GSO of SCTP packets
     - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
     - eth: bnxt: fix counting packets discarded due to OOM and netpoll
     - netfilter: nf_tables: honor table dormant flag from netdev release event
       path
     - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
     - i40e: Report MFS in decimal base instead of hex
     - iavf: Fix TC config comparison with existing adapter TC config
     - net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets
     - af_unix: Suppress false-positive lockdep splat for spin_lock() in
       __unix_gc().
     - cifs: Replace remaining 1-element arrays (Closes: #1069102, #1069092)
     - Revert "crypto: api - Disallow identical driver names"
     - virtio_net: Do not send RSS key if it is not supported
     - fork: defer linking file vma until vma is fully initialized
       (CVE-2024-27022)
     - [x86] cpu: Fix check for RDPKRU in __show_regs()
     - Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
     - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
     - Bluetooth: qca: fix NULL-deref on non-serdev suspend
     - [arm64] mmc: sdhci-msm: pervent access to suspended controller
     - smb: client: Fix struct_group() usage in __packed structs
     - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result
     - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
     - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
     - cpu: Re-enable CPU mitigations by default for !X86 architectures
     - drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3
     - drm/amdgpu: Fix leak when GPU memory allocation fails
     - irqchip/gic-v3-its: Prevent double free on error
     - ACPI: CPPC: Use access_width over bit_width for system memory accesses
     - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
     - ACPI: CPPC: Fix access width used for PCC registers
     - ethernet: Add helper for assigning packet type when dest address does not
       match device address
     - net: b44: set pause params only when interface is up
     - stackdepot: respect __GFP_NOLOCKDEP allocation flag
     - fbdev: fix incorrect address computation in deferred IO
     - udp: preserve the connected status if only UDP cmsg
     - mtd: diskonchip: work around ubsan link failure
     - [x86] tdx: Preserve shared bit on mprotect()
     - [x86] idma64: Don't try to serve interrupts when device is powered off
     - [arm64,armhf] phy: marvell: a3700-comphy: Fix out of bounds read
     - [arm64,armhf] phy: marvell: a3700-comphy: Fix hardcoded array size
     - [arm64] phy: rockchip-snps-pcie3: fix bifurcation on rk3588
     - [arm64] phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits
     - [amd64] dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
     - i2c: smbus: fix NULL function pointer dereference
     - bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
     - macsec: Enable devices to advertise whether they update sk_buff md_dst
       during offloads
     - macsec: Detect if Rx skb is macsec-related for offloading devices that
       update md_dst
     - net/mlx5e: Advertise mlx5 ethernet driver updates sk_buff md_dst for
       MACsec
 .
   [ Salvatore Bonaccorso ]
   * Bump ABI to 21
   * drivers/tty: Disable N_GSM
   * tipc: fix UAF in error path
   * tipc: fix a possible memleak in tipc_buf_append
 .
 linux (6.1.85-1) bookworm-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.83
     - md: fix data corruption for raid456 when reshape restart while grow up
     - md/raid10: prevent soft lockup while flush writes
     - io_uring/unix: drop usage of io_uring socket
     - io_uring: drop any code related to SCM_RIGHTS
     - nfsd: allow nfsd_file_get to sanely handle a NULL pointer
     - nfsd: don't open-code clear_and_wake_up_bit
     - nfsd: NFSD_FILE_KEY_INODE only needs to find GC'ed entries
     - nfsd: simplify test_bit return in NFSD_FILE_KEY_FULL comparator
     - nfsd: don't kill nfsd_files because of lease break error
     - nfsd: add some comments to nfsd_file_do_acquire
     - nfsd: don't take/put an extra reference when putting a file
     - nfsd: update comment over __nfsd_file_cache_purge
     - nfsd: allow reaping files still under writeback
     - NFSD: Convert filecache to rhltable
     - nfsd: simplify the delayed disposal list code
     - NFSD: Fix problem of COMMIT and NFS4ERR_DELAY in infinite loop
     - NFSD: Add an nfsd4_encode_nfstime4() helper
     - nfsd: Fix creation time serialization order
     - [arm64] media: rkisp1: Fix IRQ handling due to shared interrupts
     - perf/arm-cmn: Workaround AmpereOneX errata AC04_MESH_1 (incorrect child
       count)
     - ASoC: rt5645: Make LattePanda board DMI match more precise
     - [x86] ASoC: amd: yc: Fix non-functional mic on Lenovo 82UU
     - [x86] xen: Add some null pointer checking to smp.c
     - [mips*] Clear Cause.BD in instruction_pointer_set
     - HID: multitouch: Add required quirk for Synaptics 0xcddc device
     - gen_compile_commands: fix invalid escape sequence warning
     - [arm64] sve: Lower the maximum allocation for the SVE ptrace regset
     - soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt
     - RDMA/mlx5: Fix fortify source warning while accessing Eth segment
     - RDMA/mlx5: Relax DEVX access upon modify commands
     - [x86] mm: Move is_vsyscall_vaddr() into asm/vsyscall.h
     - [x86] mm: Disallow vsyscall page read for copy_from_kernel_nofault()
     - net/iucv: fix the allocation size of iucv_path_table array
     - block: sed-opal: handle empty atoms when parsing response
     - dm-verity, dm-crypt: align "struct bvec_iter" correctly
     - [arm64] dts: Fix dtc interrupt_provider warnings
     - btrfs: fix data races when accessing the reserved amount of block reserves
     - btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
     - net: smsc95xx: add support for SYS TEC USB-SPEmodule1
     - wifi: mac80211: only call drv_sta_rc_update for uploaded stations
     - [x86] ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table
     - scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
     - ALSA: hda/realtek - ALC285 reduce pop noise from Headphone port
     - drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series
     - [x86] ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2
     - Bluetooth: mgmt: Fix limited discoverable off timeout
     - firewire: core: use long bus reset on gap count error
     - [arm64] tegra: Set the correct PHY mode for MGBE
     - [x86] ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8
       tablet
     - Input: gpio_keys_polled - suppress deferred probe error for gpio
     - [x86] ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
     - [x86] ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
     - [x86] ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
     - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
     - fs: Fix rw_hint validation
     - [s390x] dasd: add autoquiesce feature
     - [s390x] dasd: Use dev_*() for device log messages
     - [s390x] dasd: fix double module refcount decrement
     - rcu/exp: Fix RCU expedited parallel grace period kworker allocation
       failure recovery
     - rcu/exp: Handle RCU expedited grace period kworker allocation failure
     - nbd: null check for nla_nest_start
     - fs/select: rework stack allocation hack for clang
     - md: Don't clear MD_CLOSING when the raid is about to stop
     - lib/cmdline: Fix an invalid format specifier in an assertion msg
     - lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg
     - time: test: Fix incorrect format specifier
     - rtc: test: Fix invalid format specifier.
     - io_uring/net: unify how recvmsg and sendmsg copy in the msghdr
     - io_uring/net: move receive multishot out of the generic msghdr path
     - io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
     - [x86] resctrl: Implement new mba_MBps throttling heuristic
     - [x86] sme: Fix memory encryption setting if enabled by default and not
       overridden
     - timekeeping: Fix cross-timestamp interpolation on counter wrap
     - timekeeping: Fix cross-timestamp interpolation corner case decision
     - timekeeping: Fix cross-timestamp interpolation for non-x86
     - sched/fair: Take the scheduling domain into account in select_idle_smt()
     - sched/fair: Take the scheduling domain into account in select_idle_core()
     - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
     - wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
     - wifi: b43: Stop correct queue in DMA worker when QoS is disabled
     - wifi: b43: Disable QoS for bcm4331
     - wifi: wilc1000: fix declarations ordering
     - wifi: wilc1000: fix RCU usage in connect path
     - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
     - wifi: wilc1000: do not realloc workqueue everytime an interface is added
     - wifi: wilc1000: fix multi-vif management when deleting a vif
     - wifi: mwifiex: debugfs: Drop unnecessary error check for
       debugfs_create_dir()
     - cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
     - cpufreq: Explicitly include correct DT includes
     - cpufreq: mediatek-hw: Wait for CPU supplies before probing
     - sock_diag: annotate data-races around sock_diag_handlers[family]
     - inet_diag: annotate data-races around inet_diag_table[]
     - bpftool: Silence build warning about calloc()
     - libbpf: Apply map_set_def_max_entries() for inner_maps on creation
     - af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
     - cpufreq: mediatek-hw: Don't error out if supply is not found
     - libbpf: Fix faccessat() usage on Android
     - pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl
     - [arm64] dts: imx8mm-kontron: Disable pullups for I2C signals on OSM-S
       i.MX8MM
     - [arm64] dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL
       i.MX8MM
     - [arm64] dts: imx8mm-kontron: Disable pullups for onboard UART signals on
       BL OSM-S board
     - [arm64] dts: imx8mm-kontron: Disable pullups for onboard UART signals on
       BL board
     - [arm64] dts: imx8mm-kontron: Disable pull resistors for SD card signals on
       BL OSM-S board
     - [arm64] dts: imx8mm-kontron: Disable pull resistors for SD card signals on
       BL board
     - [arm64] dts: imx8mm-kontron: Fix interrupt for RTC on OSM-S i.MX8MM module
     - libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API
     - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
     - wifi: iwlwifi: mvm: report beacon protection failures
     - wifi: iwlwifi: dbg-tlv: ensure NUL termination
     - wifi: iwlwifi: fix EWRD table validity check
     - gpio: vf610: allow disabling the vf610 driver
     - [arm64] dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
     - net: blackhole_dev: fix build warning for ethh set but not used
     - wifi: ath11k: initialize rx_mcs_80 and rx_mcs_160 before use
     - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
     - wifi: wfx: fix memory leak when starting AP
     - printk: Disable passing console lock owner completely during panic()
     - pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan
     - tools/resolve_btfids: Refactor set sorting with types from btf_ids.h
     - tools/resolve_btfids: Fix cross-compilation to non-host endianness
     - wifi: iwlwifi: mvm: don't set replay counters to 0xff
     - [s390x] pai: fix attr_event_free upper limit for pai device drivers
     - [s390x] vdso: drop '-fPIC' from LDFLAGS
     - ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
     - [arm64] dts: mt8183: kukui: Split out keyboard node and describe
       detachables
     - [arm64] dts: mt8183: Move CrosEC base detection node to kukui-based DTs
     - [arm64] dts: mediatek: mt7986: add "#reset-cells" to infracfg
     - [arm64] dts: mediatek: mt8192-asurada: Remove CrosEC base detection node
     - [arm64] dts: mediatek: mt8192: fix vencoder clock name
     - [arm64] dts: mediatek: mt7622: add missing "device_type" to memory nodes
     - bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
     - wifi: wilc1000: prevent use-after-free on vif when cleaning up all
       interfaces
     - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
     - bus: tegra-aconnect: Update dependency to ARCH_TEGRA
     - [amd64] iommu/amd: Mark interrupt as managed
     - wifi: brcmsmac: avoid function pointer casts
     - [arm64] dts: qcom: sdm845-db845c: correct PCIe wake-gpios
     - [arm64] dts: qcom: sm8150: use 'gpios' suffix for PCI GPIOs
     - [arm64] dts: qcom: sm8150: correct PCIe wake-gpios
     - powercap: dtpm_cpu: Fix error check against freq_qos_add_request()
     - net: ena: Remove ena_select_queue
     - [arm64] dts: mt8195-cherry-tomato: change watchdog reset boot flow
     - firmware: arm_scmi: Fix double free in SMC transport cleanup path
     - wifi: wilc1000: revert reset line logic flip
     - net: mctp: copy skb ext data when fragmenting
     - pstore: inode: Convert mutex usage to guard(mutex)
     - pstore: inode: Only d_invalidate() is needed
     - [arm64] dts: allwinner: h6: Add RX DMA channel for SPDIF
     - ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override
     - ACPI: resource: Do IRQ override on Lunnen Ground laptops
     - ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override
     - ACPI: scan: Fix device check notification handling
     - [x86] relocs: Ignore relocations in .notes section (CVE-2024-26816)
     - SUNRPC: fix some memleaks in gssx_dec_option_array
     - mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the
       .remove function
     - ACPI: CPPC: enable AMD CPPC V2 support for family 17h processors
     - wifi: rtw88: 8821c: Fix beacon loss and disconnect
     - wifi: rtw88: 8821c: Fix false alarm count
     - PCI: Make pci_dev_is_disconnected() helper public for other drivers
     - [amd64] iommu/vt-d: Don't issue ATS Invalidation request when device is
       disconnected
     - igb: Fix missing time sync events
     - Bluetooth: Remove HCI_POWER_OFF_TIMEOUT
     - Bluetooth: mgmt: Remove leftover queuing of power_off work
     - Bluetooth: Remove superfluous call to hci_conn_check_pending()
     - Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()
     - Bluetooth: Cancel sync command before suspend and power off
     - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running
     - Bluetooth: hci_conn: Consolidate code for aborting connections
     - Bluetooth: hci_core: Cancel request on command timeout
     - Bluetooth: hci_sync: Fix overwriting request callback
     - Bluetooth: hci_core: Fix possible buffer overflow
     - Bluetooth: af_bluetooth: Fix deadlock
     - Bluetooth: fix use-after-free in accessing skb after sending it
     - [s390x] cache: prevent rebuild of shared_cpu_list
     - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
     - bpf: Fix hashtab overflow check on 32-bit arches
     - bpf: Fix stackmap overflow check on 32-bit arches
     - [amd64] iommu/vt-d: Retrieve IOMMU perfmon capability information
     - ipv6: fib6_rules: flush route cache when rule is changed
     - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
     - net: phy: fix phy_get_internal_delay accessing an empty array
     - [arm64] net: hns3: fix wrong judgment condition issue
     - [arm64] net: hns3: fix kernel crash when 1588 is received on HIP08 devices
     - [arm64] net: hns3: fix port duplex configure error in IMP reset
     - Bluetooth: MGMT: Fix always using HCI_MAX_AD_LENGTH
     - Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH
     - Bluetooth: Fix eir name length
     - net: phy: dp83822: Fix RGMII TX delay configuration
     - OPP: debugfs: Fix warning around icc_get_name()
     - tcp: fix incorrect parameter validation in the do_tcp_getsockopt()
       function
     - ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt()
       function
     - l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt()
       function
     - udp: fix incorrect parameter validation in the udp_lib_getsockopt()
       function
     - net: kcm: fix incorrect parameter validation in the kcm_getsockopt)
       function
     - nfp: flower: handle acti_netdevs allocation failure
     - bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes()
     - dm raid: fix false positive for requeue needed during reshape
     - dm: call the resume method on internal suspend
     - [arm64,armhf] drm/tegra: dsi: Add missing check for of_find_device_by_node
     - [arm64,armhf] drm/tegra: dpaux: Fix PM disable depth imbalance in
       tegra_dpaux_probe
     - [arm64,armhf] drm/tegra: dsi: Make use of the helper function
       dev_err_probe()
     - [arm64,armhf] drm/tegra: dsi: Fix some error handling paths in
       tegra_dsi_probe()
     - [arm64,armhf] drm/tegra: dsi: Fix missing pm_runtime_disable() in the
       error handling path of tegra_dsi_probe()
     - [arm64,armhf] drm/tegra: hdmi: Convert to devm_platform_ioremap_resource()
     - [arm64,armhf] drm/tegra: hdmi: Fix some error handling paths in
       tegra_hdmi_probe()
     - [arm64,armhf] drm/tegra: rgb: Fix some error handling paths in
       tegra_dc_rgb_probe()
     - [arm64,armhf] drm/tegra: rgb: Fix missing clk_put() in the error handling
       paths of tegra_dc_rgb_probe()
     - [arm64,armhf] drm/tegra: output: Fix missing i2c_put_adapter() in the
       error handling paths of tegra_output_probe()
     - drm: Don't treat 0 as -1 in drm_fixp2int_ceil
     - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
     - drm/panel-edp: use put_sync in unprepare
     - drm/lima: fix a memleak in lima_heap_alloc
     - [x86] ASoC: amd: acp: Add missing error handling in sof-mach
     - dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
     - media: tc358743: register v4l2 async device only after successful setup
     - PCI/DPC: Print all TLP Prefixes, not just the first
     - perf record: Fix possible incorrect free in record__switch_output()
     - HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
     - drm/amd/display: Fix a potential buffer overflow in
       'dp_dsc_clock_en_read()'
     - drm/amd/display: Fix potential NULL pointer dereferences in
       'dcn10_set_output_transfer_func()'
     - pinctrl: renesas: r8a779g0: Add Audio SSI pins, groups, and functions
     - pinctrl: renesas: r8a779g0: Add missing SCIF_CLK2 pin group/function
     - clk: samsung: exynos850: Propagate SPI IPCLK rate change
     - perf evsel: Fix duplicate initialization of data->id in
       evsel__parse_sample()
     - clk: meson: Add missing clocks to axg_clk_regmaps
     - media: em28xx: annotate unchecked call to media_device_register()
     - media: v4l2-tpg: fix some memleaks in tpg_alloc
     - media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
     - media: edia: dvbdev: fix a use-after-free
     - clk: qcom: reset: Commonize the de/assert functions
     - clk: qcom: reset: Ensure write completion on reset de/assertion
     - quota: simplify drop_dquot_ref()
     - quota: Fix potential NULL pointer dereference
     - quota: Fix rcu annotations of inode dquot pointers
     - PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
     - crypto: xilinx - call finalize with bh disabled
     - perf thread_map: Free strlist on normal path in
       thread_map__new_by_tid_str()
     - [arm64] drm/msm/dpu: fix the programming of INTF_CFG2_DATA_HCTL_EN
     - [arm64] drm/msm/dpu: Only enable DSC_MODE_MULTIPLEX if dsc_merge is
       enabled
     - drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
     - ALSA: seq: fix function cast warnings
     - perf stat: Avoid metric-only segv
     - [arm64,armhf] ASoC: meson: aiu: fix function pointer type mismatch
     - [arm64,armhf] ASoC: meson: t9015: fix function pointer type mismatch
     - [powerpc*] Force inlining of arch_vmap_p{u/m}d_supported()
     - [x86] ASoC: SOF: Introduce container struct for SOF firmware
     - [x86] ASoC: SOF: Add some bounds checking to firmware data
     - NTB: EPF: fix possible memory leak in pci_vntb_probe()
     - NTB: fix possible name leak in ntb_register_device()
     - media: cedrus: h265: Associate mv col buffers with buffer
     - media: cedrus: h265: Fix configuring bitstream size
     - media: sun8i-di: Fix coefficient writes
     - media: sun8i-di: Fix power on/off sequences
     - media: sun8i-di: Fix chroma difference threshold
     - media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
     - media: go7007: add check of return value of go7007_read_addr()
     - media: pvrusb2: remove redundant NULL check
     - media: pvrusb2: fix pvr2_stream_callback casts
     - clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
     - PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
     - clk: hisilicon: hi3519: Release the correct number of gates in
       hi3519_clk_unregister()
     - clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
     - [arm64,armhf] drm/tegra: put drm_gem_object ref on error in
       tegra_fb_create
     - mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
     - mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes
       a ref
     - crypto: jitter - fix CRYPTO_JITTERENTROPY help text
     - drm/tidss: Fix initial plane zpos values
     - drm/tidss: Fix sync-lost issue with two displays
     - mtd: maps: physmap-core: fix flash size larger than 32-bit
     - mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
     - [arm64,armhf] ASoC: meson: axg-tdm-interface: fix mclk setup without
       mclk-fs
     - [arm64,armhf] ASoC: meson: axg-tdm-interface: add frame rate constraint
     - HID: amd_sfh: Update HPD sensor structure elements
     - HID: amd_sfh: Avoid disabling the interrupt
     - drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
     - media: pvrusb2: fix uaf in pvr2_context_set_notify
     - media: dvb-frontends: avoid stack overflow warnings with clang
     - media: go7007: fix a memleak in go7007_load_encoder
     - media: ttpci: fix two memleaks in budget_av_attach
     - media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
     - gpio: nomadik: fix offset bug in nmk_pmx_set()
     - [powerpc*] pseries: Fix potential memleak in papr_get_attr()
     - [powerpc*] hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value
       checks
     - [arm64] drm/msm/dpu: add division of drm_display_mode's hskew parameter
     - modules: wait do_free_init correctly
     - powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
     - leds: aw2013: Unlock mutex before destroying it
     - leds: sgm3140: Add missing timer cleanup and flash gpio control
     - backlight: lm3630a: Initialize backlight_properties on init
     - backlight: lm3630a: Don't set bl->props.brightness in get_brightness
     - backlight: da9052: Fully initialize backlight_properties during probe
     - backlight: lm3639: Fully initialize backlight_properties during probe
     - backlight: lp8788: Fully initialize backlight_properties during probe
     - clk: Fix clk_core_get NULL dereference
     - clk: zynq: Prevent null pointer dereference caused by kmalloc failure
     - ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
     - ALSA: usb-audio: Stop parsing channels bits when all channels are found.
     - RDMA/irdma: Allow accurate reporting on QP max send/recv WR
     - RDMA/irdma: Remove duplicate assignment
     - RDMA/srpt: Do not register event handler until srpt device is fully setup
     - f2fs: reduce stack memory cost by using bitfield in struct f2fs_io_info
     - f2fs: compress: fix to guarantee persisting compressed blocks by CP
     - f2fs: compress: fix to cover normal cluster write with cp_rwsem
     - f2fs: compress: fix to check unreleased compressed cluster
     - f2fs: simplify __allocate_data_block
     - f2fs: delete obsolete FI_FIRST_BLOCK_WRITTEN
     - f2fs: delete obsolete FI_DROP_CACHE
     - f2fs: introduce get_dnode_addr() to clean up codes
     - f2fs: update blkaddr in __set_data_blkaddr() for cleanup
     - f2fs: compress: fix to avoid inconsistence bewteen i_blocks and dnode
     - f2fs: compress: fix to cover f2fs_disable_compressed_file() w/ i_sem
     - f2fs: fix to avoid potential panic during recovery
     - scsi: csiostor: Avoid function pointer casts
     - [arm64] RDMA/hns: Fix mis-modifying default congestion control algorithm
     - RDMA/device: Fix a race between mad_client and cm_client init
     - RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
     - scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
     - f2fs: compress: fix to check zstd compress level correctly in mount option
     - net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
     - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
     - NFSv4.2: fix listxattr maximum XDR buffer size
     - f2fs: compress: fix to check compress flag w/ .i_sem lock
     - f2fs: check number of blocks in a current section
     - watchdog: stm32_iwdg: initialize default timeout
     - f2fs: ro: compress: fix to avoid caching unaligned extent
     - NFS: Fix an off by one in root_nfs_cat()
     - f2fs: convert to use sbi directly
     - f2fs: compress: relocate some judgments in f2fs_reserve_compress_blocks
     - f2fs: compress: fix reserve_cblocks counting error when out of space
     - [x86] perf/x86/amd/core: Avoid register reset when CPU is dead
     - afs: Revert "afs: Hide silly-rename files from userspace"
     - nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
     - io_uring/net: correct the type of variable
     - comedi: comedi_test: Prevent timers rescheduling during deletion
     - [armhf] remoteproc: stm32: use correct format strings on 64-bit
     - [armhf] remoteproc: stm32: Fix incorrect type in assignment for va
     - [armhf] remoteproc: stm32: Fix incorrect type assignment returned by
       stm32_rproc_get_loaded_rsc_tablef
     - usb: phy: generic: Get the vbus supply
     - tty: vt: fix 20 vs 0x20 typo in EScsiignore
     - serial: max310x: fix syntax error in IRQ error message
     - tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
     - [arm64] dts: broadcom: bcmbca: bcm4908: drop invalid switch cells
     - hwtracing: hisi_ptt: Move type check to the beginning of
       hisi_ptt_pmu_event_init()
     - rtc: mt6397: select IRQ_DOMAIN instead of depending on it
     - serial: 8250_exar: Don't remove GPIO device on suspend
     - staging: greybus: fix get_channel_from_mode() failure path
     - usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
     - nouveau: reset the bo resource bus info after an eviction
     - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
     - rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
     - [s390x] vtime: fix average steal time calculation
     - net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check (CVE-2024-26815)
     - soc: fsl: dpio: fix kcalloc() argument order
     - tcp: Fix refcnt handling in __inet_hash_connect().
     - hsr: Fix uninit-value access in hsr_get_node()
     - nvme: only set reserved_tags in nvme_alloc_io_tag_set for fabrics
       controllers
     - nvme: add the Apple shared tag workaround to nvme_alloc_io_tag_set
     - nvme: fix reconnection fail due to reserved tag allocation
     - net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up
     - net: ethernet: mtk_eth_soc: fix PPE hanging issue
     - packet: annotate data-races around ignore_outgoing
     - net: veth: do not manipulate GRO when using XDP
     - net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
     - drm: Fix drm_fixp2int_round() making it add 0.5
     - vdpa_sim: reset must not run
     - vdpa/mlx5: Allow CVQ size changes
     - wireguard: receive: annotate data-race around receiving_counter.counter
     - rds: introduce acquire/release ordering in acquire/release_in_xmit()
     - hsr: Handle failures in module init
     - ipv4: raw: Fix sending packets from raw sockets via IPsec tunnels
     - net: phy: fix phy_read_poll_timeout argument type in genphy_loopback
     - dm-integrity: fix a memory leak when rechecking the data
     - net/bnx2x: Prevent access to a freed page in page_pool
     - netfilter: nft_set_pipapo: release elements in clone only from destroy
       path (CVE-2024-26809)
     - netfilter: nf_tables: do not compare internal table flags on updates
     - rcu: add a helper to report consolidated flavor QS
     - net: report RCU QS on threaded NAPI repolling
     - bpf: report RCU QS in cpumap kthread
     - net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports
     - net: dsa: mt7530: fix handling of all link-local frames
     - spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
     - dm: address indent/space issues
     - dm io: Support IO priority
     - dm-integrity: align the outgoing bio in integrity_recheck
     - [armhf] remoteproc: stm32: fix incorrect optional pointers
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.84
     - [x86] cpu: Support AMD Automatic IBRS
     - [x86] bugs: Use sysfs_emit()
     - [x86] KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only
       leafs
     - [x86] KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace
     - [x86] KVM: x86: Use a switch statement and macros in __feature_translate()
     - timers: Update kernel-doc for various functions
     - timers: Use del_timer_sync() even on UP
     - timers: Rename del_timer_sync() to timer_delete_sync()
     - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
     - media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
     - [arm64] dts: qcom: sc7280: Add additional MSI interrupts
     - [arm64,armhf] remoteproc: virtio: Fix wdg cannot recovery remote processor
     - [arm64] clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
     - [armhf] arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
     - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts
     - serial: max310x: fix NULL pointer dereference in I2C instantiation
     - pci_iounmap(): Fix MMIO mapping leak
     - media: xc4000: Fix atomicity violation in xc4000_get_frequency
     - media: mc: Add local pad to pipeline regardless of the link state
     - media: mc: Fix flags handling when creating pad links
     - media: mc: Add num_links flag to media_pad
     - media: mc: Rename pad variable to clarify intent
     - media: mc: Expand MUST_CONNECT flag to always require an enabled link
     - KVM: Always flush async #PF workqueue when vCPU is being destroyed
     - [x86] cpufreq: amd-pstate: Fix min_perf assignment in
       amd_pstate_adjust_perf()
     - [powerpc*] smp: Adjust nr_cpu_ids to cover all threads of a core
     - [powerpc*] smp: Increase nr_cpu_ids to include the boot CPU
     - [x86] crypto: qat - fix double free during reset
     - [x86] crypto: qat - resolve race condition during AER recovery
     - ext4: correct best extent lstart adjustment logic
     - block: Clear zone limits for a non-zoned stacked queue
     - bounds: support non-power-of-two CONFIG_NR_CPUS
     - fat: fix uninitialized field in nostale filehandles
     - ubifs: Set page uptodate in the correct place
     - ubi: Check for too small LEB size in VTBL code
     - ubi: correct the calculation of fastmap size
     - md/raid5: fix atomicity violation in raid5_cache_count
     - cpufreq: Limit resolving a frequency to policy min/max
     - PM: suspend: Set mem_sleep_current during kernel command line setup
     - usb: xhci: Add error handling in xhci_map_urb_for_dma
     - [powerpc*] fsl: Fix mfpmr build errors with newer binutils
     - USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
     - USB: serial: add device ID for VeriFone adapter
     - USB: serial: cp210x: add ID for MGP Instruments PDS100
     - USB: serial: option: add MeiG Smart SLM320 product
     - [x86] KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled
     - USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
     - PM: sleep: wakeirq: fix wake irq warning in system suspend
     - mmc: tmio: avoid concurrent runs of mmc_request_done()
     - fuse: fix root lookup with nonzero generation
     - fuse: don't unhash root
     - usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros
     - serial: Lock console when calling into driver before registration
     - btrfs: qgroup: always free reserved space for extent records
     - btrfs: fix off-by-one chunk length calculation at
       contains_pending_extent()
     - PCI/PM: Drain runtime-idle callbacks before driver removal
     - PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports
     - dm-raid: fix lockdep waring in "pers->hot_add_disk"
     - [powerpc*] xor_vmx: Add '-mhard-float' to CFLAGS
     - mac802154: fix llsec key resources release in mac802154_llsec_key_del
     - swap: comments get_swap_device() with usage rule
     - mm: swap: fix race between free_swap_and_cache() and swapoff()
     - mmc: core: Fix switch on gp3 partition
     - [arm64,armhf] drm/etnaviv: Restore some id values
     - landlock: Warn once if a Landlock action is requested while disabled
     - hwmon: (amc6821) add of_match table
     - ext4: fix corruption during on-line resize
     - nvmem: meson-efuse: fix function pointer type mismatch
     - slimbus: core: Remove usage of the deprecated ida_simple_xx() API
     - phy: tegra: xusb: Add API to retrieve the port number of phy
     - usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic
     - speakup: Fix 8bit characters from direct synth
     - PCI/AER: Block runtime suspend when handling errors
     - io_uring/net: correctly handle multishot recvmsg retry setup
     - nfs: fix UAF in direct writes
     - kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
     - [arm64] PCI: qcom: Rename qcom_pcie_config_sid_sm8250() to reflect IP
       version
     - [arm64] PCI: qcom: Enable BDF to SID translation properly
     - [amd64,arm64] PCI: hv: Fix ring buffer size calculation
     - vfio: Use GFP_KERNEL_ACCOUNT for userspace persistent allocations
     - vfio/pci: Consolidate irq cleanup on MSI/MSI-X disable
     - vfio/pci: Remove negative check on unsigned vector
     - vfio/pci: Lock external INTx masking ops (CVE-2024-26810)
     - vfio/platform: Disable virqfds on cleanup
     - ksmbd: retrieve number of blocks using vfs_getattr in
       set_file_allocation_info
     - ring-buffer: Fix waking up ring buffer readers
     - ring-buffer: Do not set shortest_full when full target is hit
     - ring-buffer: Fix resetting of shortest_full
     - ring-buffer: Fix full_waiters_pending in poll
     - ring-buffer: Use wait_event_interruptible() in ring_buffer_wait()
     - [s390x] zcrypt: fix reference counting on zcrypt card objects
     - drm/probe-helper: warn about negative .get_modes()
     - drm/panel: do not return negative error codes from drm_panel_get_modes()
     - [armhf] drm/exynos: do not return negative values from .get_modes()
     - [armhf] drm/imx/ipuv3: do not return negative values from .get_modes()
     - [arm64,armhf] drm/vc4: hdmi: do not return negative values from
       .get_modes()
     - memtest: use {READ,WRITE}_ONCE in memory scanning
     - Revert "block/mq-deadline: use correct way to throttling write requests"
     - f2fs: mark inode dirty for FI_ATOMIC_COMMITTED flag
     - f2fs: truncate page cache before clearing flags when aborting atomic write
     - nilfs2: fix failure to detect DAT corruption in btree and direct mappings
     - nilfs2: prevent kernel bug at submit_bh_wbc()
     - cifs: open_cached_dir(): add FILE_READ_EA to desired access
     - cpufreq: dt: always allocate zeroed cpumask
     - [amd64] x86/CPU/AMD: Update the Zenbleed microcode revisions
     - NFSD: Fix nfsd_clid_class use of __string_len() macro
     - net: hns3: tracing: fix hclgevf trace event strings
     - wireguard: netlink: check for dangling peer via is_dead instead of empty
       list
     - wireguard: netlink: access device through ctx instead of peer
     - ahci: asm1064: correct count of reported ports
     - ahci: asm1064: asm1166: don't limit reported ports
     - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
     - drm/amd/display: Return the correct HDCP error code
     - drm/amd/display: Fix noise issue on HDMI AV mute
     - dm snapshot: fix lockup in dm_exception_table_exit
     - [x86] pm: Work around false positive kmemleak report in
       msr_build_context()
     - cpufreq: brcmstb-avs-cpufreq: fix up "add check for cpufreq_cpu_get's
       return value"
     - [x86] platform/x86: p2sb: On Goldmont only cache P2SB and SPI devfn BAR
       (Closes: #1065320)
     - tls: fix race between tx work scheduling and socket close (CVE-2024-26585)
     - netfilter: nf_tables: mark set as dead when unbinding anonymous set with
       timeout (CVE-2024-26643)
     - netfilter: nf_tables: disallow anonymous set with timeout flag
       (CVE-2024-26642)
     - netfilter: nf_tables: reject constant set with timeout
     - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of
       memory
     - init/Kconfig: lower GCC version check for -Warray-bounds
     - [x86] KVM: x86: Mark target gfn of emulated atomic instruction as dirty
     - [x86] KVM: SVM: Flush pages under kvm->lock to fix UAF in
       svm_register_enc_region()
     - tracing: Use .flush() call to wake up readers
     - drm/amdgpu/pm: Fix the error of pwm1_enable setting
     - [x86] drm/i915: Check before removing mm notifier
     - ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo
       ALC897 platform
     - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
     - usb: gadget: ncm: Fix handling of zero block length packets
     - usb: port: Don't try to peer unused USB ports based on location
     - tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
     - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on
       suspend/resume
     - mei: me: add arrow lake point S DID
     - mei: me: add arrow lake point H DID
     - vt: fix unicode buffer corruption when deleting characters
     - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
     - ALSA: hda/realtek - Add Headset Mic supported Acer NB platform
     - ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook
     - tee: optee: Fix kernel panic caused by incorrect error handling
     - mm, vmscan: prevent infinite loop for costly GFP_NOIO |
       __GFP_RETRY_MAYFAIL allocations
     - iio: accel: adxl367: fix DEVID read after reset
     - iio: accel: adxl367: fix I2C FIFO data register
     - i2c: i801: Avoid potential double call to gpiod_remove_lookup_table
     - drm/amd/display: handle range offsets in VRR ranges
     - [x86] efistub: Call mixed mode boot services on the firmware's stack
     - net: tls: handle backlogging of crypto requests (CVE-2024-26584)
     - [x86] ASoC: amd: yc: Revert "Fix non-functional mic on Lenovo 21J2"
     - iommu: Avoid races around default domain allocations
     - clocksource/drivers/arm_global_timer: Fix maximum prescaler value
     - entry: Respect changes to system call number by trace_sys_enter()
     - minmax: add umin(a, b) and umax(a, b)
     - swiotlb: Fix alignment checks when both allocation and DMA masks are
       present
     - iommu/dma: Force swiotlb_max_mapping_size on an untrusted device
     - printk: Update @console_may_schedule in console_trylock_spinning()
     - irqchip/renesas-rzg2l: Implement restriction when writing ISCR register
     - irqchip/renesas-rzg2l: Flush posted write in irq_eoi()
     - irqchip/renesas-rzg2l: Add macro to retrieve TITSR register offset based
       on register's index
     - irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi()
     - irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi()
     - irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger
       type
     - [x86] kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe
       address
     - [x86] fpu: Keep xfd_state in sync with MSR_IA32_XFD
     - pwm: img: fix pwm clock lookup
     - tty: serial: imx: Fix broken RS485
     - block: Fix page refcounts for unaligned buffers in __bio_release_pages()
     - blk-mq: release scheduler resource when request completes
     - vfio/pci: Disable auto-enable of exclusive INTx IRQ (CVE-2024-27437)
     - vfio: Introduce interface to flush virqfd inject workqueue
     - vfio/pci: Create persistent INTx handler (CVE-2024-26812)
     - vfio/platform: Create persistent IRQ handlers (CVE-2024-26813)
     - vfio/fsl-mc: Block calling interrupt handler without trigger
       (CVE-2024-26814)
     - [x86] coco: Export cc_vendor
     - [x86] coco: Get rid of accessor functions
     - [x86] Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
     - [x86] sev: Fix position dependent variable references in startup code
     - mm/migrate: set swap entry values of THP tail pages properly.
     - init: open /initrd.image with O_LARGEFILE
     - [x86] efistub: Add missing boot_params for mixed mode compat entry
     - btrfs: zoned: don't skip block groups with 100% zone unusable
     - btrfs: zoned: use zone aware sb location for scrub
     - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
     - wifi: iwlwifi: fw: don't always use FW dump trig
     - exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
     - hexagon: vmlinux.lds.S: handle attributes section
     - mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc
       HS200 mode
     - mmc: core: Initialize mmc_blk_ioc_data
     - mmc: core: Avoid negative index with array access
     - block: Do not force full zone append completion in req_bio_endio()
     - thermal: devfreq_cooling: Fix perf state when calculate dfc res_util
     - nouveau/dmem: handle kcalloc() allocation failure
     - net: ll_temac: platform_get_resource replaced by wrong function
     - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed
     - [x86] drm/i915/bios: Tolerate devdata==NULL in
       intel_bios_encoder_supports_dp_dual_mode()
     - [x86] drm/i915/gt: Reset queue_priority_hint on parking
     - Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
     - Revert "usb: phy: generic: Get the vbus supply"
     - usb: cdc-wdm: close race between read and workqueue
     - USB: UAS: return ENODEV when submit urbs fail with device not attached
     - usb: dwc3-am62: Rename private data
     - usb: dwc3-am62: fix module unload/reload behavior
     - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
       (CVE-2024-26654)
     - scsi: core: Fix unremoved procfs host directory regression
     - staging: vc04_services: changen strncpy() to strscpy_pad()
     - staging: vc04_services: fix information leak in create_component()
     - USB: core: Add hub_get() and hub_put() routines
     - USB: core: Fix deadlock in port "disable" sysfs attribute
     - scsi: sd: Fix TCG OPAL unlock on system resume
     - usb: dwc2: host: Fix remote wakeup from hibernation
     - usb: dwc2: host: Fix hibernation flow
     - usb: dwc2: host: Fix ISOC flow in DDMA mode
     - usb: dwc2: gadget: Fix exiting from clock gating
     - usb: dwc2: gadget: LPM flow fix
     - usb: udc: remove warning when queue disabled ep
     - usb: typec: Return size of buffer if pd_set operation succeeds
     - usb: typec: ucsi: Clear EVENT_PENDING under PPM lock
     - usb: typec: ucsi: Ack unsupported commands
     - usb: typec: ucsi_acpi: Refactor and fix DELL quirk
     - usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset
     - scsi: qla2xxx: Prevent command send on chip reset
     - scsi: qla2xxx: Fix N2N stuck connection
     - scsi: qla2xxx: Split FCE|EFT trace control
     - scsi: qla2xxx: Update manufacturer detail
     - scsi: qla2xxx: NVME|FCP prefer flag not being honored
     - scsi: qla2xxx: Fix command flush on cable pull
     - scsi: qla2xxx: Fix double free of fcport
     - scsi: qla2xxx: Change debug message during driver unload
     - scsi: qla2xxx: Delay I/O Abort on PCI error
     - [x86] cpu: Enable STIBP on AMD if Automatic IBRS is enabled
     - tls: fix use-after-free on failed backlog decryption (CVE-2024-26800)
     - scsi: lpfc: Correct size for cmdwqe/rspwqe for memset()
     - scsi: lpfc: Correct size for wqe for memset()
     - scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
     - scsi: libsas: Fix disk not being scanned in after being removed
     - [x86] sev: Skip ROM range scans and validation for SEV-SNP guests
     - USB: core: Fix deadlock in usb_deauthorize_interface()
     - tools/resolve_btfids: fix build with musl libc
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.85
     - scripts/bpf_doc: Use silent mode when exec make cmd
     - dma-buf: Fix NULL pointer dereference in sanitycheck()
     - nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
     - mlxbf_gige: stop PHY during open() error paths
     - wifi: iwlwifi: mvm: rfi: fix potential response leaks
     - ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
     - [s390x] qeth: handle deferred cc1
     - tcp: properly terminate timers for kernel sockets
     - net: wwan: t7xx: Split 64bit accesses to fix alignment issues
     - [arm64] net: hns3: fix index limit to support all queue stats
     - [arm64] net: hns3: fix kernel crash when devlink reload during pf
       initialization
     - [arm64] net: hns3: mark unexcuted loopback test result as UNEXECUTED
     - tls: recv: process_rx_list shouldn't use an offset with kvec
     - tls: adjust recv return with async crypto and failed copy to userspace
     - tls: get psock ref after taking rxlock to avoid leak
     - mlxbf_gige: call request_irq() after NAPI initialized
     - bpf: Protect against int overflow for stack access size
     - cifs: Fix duplicate fscache cookie warnings
     - net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips
     - inet: inet_defrag: prevent sk release while still in use
     - dm integrity: fix out-of-range warning
     - [x86] cpufeatures: Add new word for scattered features
     - [x86] perf/x86/amd/lbr: Use freeze based on availability
     - [arm64] KVM: arm64: Fix host-programmed guest events in nVHE
     - r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
     - [x86] cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined
       word
     - Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT"
     - [arm64] dts: qcom: sc7180-trogdor: mark bluetooth address as broken
     - Bluetooth: qca: fix device-address endianness
     - Bluetooth: add quirk for broken address properties
     - Bluetooth: hci_event: set the conn encrypted before conn establishes
     - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CVE-2024-24857,
       CVE-2024-24858)
     - xen-netfront: Add missing skb_mark_for_recycle
     - net/rds: fix possible cp null dereference
     - net: usb: ax88179_178a: avoid the interface always configured as random
       address
     - vsock/virtio: fix packet delivery to tap device
     - Revert "x86/mm/ident_map: Use gbpages only where full GB page should be
       mapped."
     - netfilter: nf_tables: reject new basechain after table flag update
     - netfilter: nf_tables: flush pending destroy work before exit_net release
     - netfilter: nf_tables: Fix potential data-race in
       __nft_flowtable_type_get()
     - netfilter: validate user input for expected length
     - vboxsf: Avoid an spurious warning if load_nls_xxx() fails
     - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
     - net/sched: act_skbmod: prevent kernel-infoleak
     - net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
     - net: stmmac: fix rx queue priority assignment
     - net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping
     - net: phy: micrel: Fix potential null pointer dereference
     - gro: fix ownership transfer
     - [x86] bugs: Fix the SRSO mitigation on Zen3/4
     - [x86] retpoline: Do the necessary fixup to the Zen3/4 srso return thunk
       for !SRSO
     - i40e: Fix VF MAC filter removal
     - erspan: make sure erspan_base_hdr is present in skb->head
     - ipv6: Fix infinite recursion in fib6_dump_done().
     - mlxbf_gige: stop interface during shutdown
     - r8169: skip DASH fw status checks when DASH is disabled
     - udp: do not accept non-tunnel GSO skbs landing in a tunnel
     - udp: do not transition UDP GRO fraglist partial checksums to unnecessary
     - udp: prevent local UDP tunnel packets from being GROed
     - i40e: fix i40e_count_filters() to count only active/new filters
     - i40e: fix vf may be used uninitialized in this function warning
     - drm/amd: Evict resources during PM ops prepare() callback
     - drm/amd: Add concept of running prepare_suspend() sequence for IP blocks
     - drm/amd: Flush GFXOFF requests in prepare stage
     - i40e: Store the irq number in i40e_q_vector
     - i40e: Remove _t suffix from enum type names
     - i40e: Enforce software interrupt during busy-poll exit
     - r8169: use spinlock to protect mac ocp register access
     - r8169: use spinlock to protect access to registers Config2 and Config5
     - r8169: prepare rtl_hw_aspm_clkreq_enable for usage in atomic context
     - tcp: Fix bind() regression for v6-only wildcard and v4(-mapped-v6)
       non-wildcard addresses.
     - drivers: net: convert to boolean for the mac_managed_pm flag
     - net: fec: Set mac_managed_pm during probe
     - [x86] KVM: SVM: enhance info printk's in SEV init
     - [x86] KVM: SVM: WARN, but continue, if misc_cg_set_capacity() fails
     - [x86] KVM: SVM: Use unsigned integers when dealing with ASIDs
     - [x86] KVM: SVM: Add support for allowing zero SEV ASIDs
     - fs/pipe: Fix lockdep false-positive in watchqueue pipe_write()
     - 9p: Fix read/write debug statements to report server reply
     - drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported
     - drm/panfrost: fix power transition timeout warnings
     - ASoC: rt5682-sdw: fix locking sequence
     - [x86] ASoC: rt711-sdca: fix locking sequence
     - ASoC: rt711-sdw: fix locking sequence
     - ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
     - ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
     - scsi: mylex: Fix sysfs buffer lengths
     - scsi: sd: Unregister device if device_add_disk() failed in sd_probe()
     - cifs: Fix caching to try to do open O_WRONLY as rdwr on server
     - ata: sata_mv: Fix PCI device ID table declaration compilation warning
     - nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
     - [x86] retpoline: Add NOENDBR annotation to the SRSO dummy return thunk
     - ksmbd: don't send oplock break if rename fails
     - ksmbd: validate payload size in ipc response (CVE-2024-26811)
     - ksmbd: do not set SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1
     - ALSA: hda/realtek - Fix inactive headset mic jack
     - ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with
       microphone
     - driver core: Introduce device_link_wait_removal()
     - of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
     - [x86] mm/pat: fix VM_PAT handling in COW mappings
     - [x86] mce: Make sure to grab mce_sysfs_mutex in set_bank()
     - [x86] coco: Require seeding RNG with RDRAND on CoCo systems
     - [s390x] entry: align system call table on 8 bytes
     - smb3: retrying on failed server close
     - smb: client: fix potential UAF in cifs_debug_files_proc_show()
     - smb: client: fix potential UAF in cifs_stats_proc_write()
     - smb: client: fix potential UAF in cifs_stats_proc_show()
     - smb: client: fix potential UAF in smb2_is_valid_oplock_break()
     - smb: client: fix potential UAF in smb2_is_valid_lease_break()
     - smb: client: fix potential UAF in is_valid_oplock_break()
     - smb: client: fix potential UAF in smb2_is_network_name_deleted()
     - smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
     - mptcp: don't account accept() of non-MPC client as fallback to TCP
     - mm/secretmem: fix GUP-fast succeeding on secretmem folios
     - nvme: fix miss command type check
     - [x86] bugs: Change commas to semicolons in 'spectre_v2' sysfs file
     - [x86] syscall: Don't force use of indirect calls for system calls
     - [x86] Mitigate Native Branch History Injection vulnerability
       (CVE-2024-2201):
       + [x86] bhi: Add support for clearing branch history at syscall entry
       + [x86] bhi: Define SPEC_CTRL_BHI_DIS_S
       + [x86] bhi: Enumerate Branch History Injection (BHI) bug
       + [x86] bhi: Add BHI mitigation knob
       + [x86] bhi: Mitigate KVM by default
       + [x86] KVM: x86: Add BHI_NO
       + [x86] set SPECTRE_BHI_ON as default
 .
   [ Salvatore Bonaccorso ]
   * Bump ABI to 20
   * Refresh "efi: Lock down the kernel if booted in secure boot mode" (context
     changes in 6.1.84)
   * [rt] Refresh "serial: 8250: implement write_atomic"
   * Refresh "x86: Make x32 syscall support conditional on a kernel parameter"
   * tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
     (Closes: #1068770)
   * Revert "scsi: sd: usb_storage: uas: Access media prior to querying device
     properties" (Closes: #1068675)
   * Revert "scsi: core: Add struct for args to execution functions"
   * scsi: sd: usb_storage: uas: Access media prior to querying device properties
 .
 linux (6.1.82-1) bookworm; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.77
     - asm-generic: make sparse happy with odd-sized put_unaligned_*()
     - [powerpc*] mm: Fix null-pointer dereference in pgtable_cache_add
     - [arm64] irq: set the correct node for VMAP stack
     - [arm64] drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
     - [powerpc*] Fix build error due to is_valid_bugaddr()
     - [powerpc*] mm: Fix build failures due to arch_reserved_kernel_pages()
     - [x86] boot: Ignore NMIs during very early boot
     - [powerpc*] pmd_move_must_withdraw() is only needed for
       CONFIG_TRANSPARENT_HUGEPAGE
     - [powerpc*] lib: Validate size for vector operations
     - [x86*] mce: Mark fatal MCE's page as poison to avoid panic in the kdump
       kernel
     - perf/core: Fix narrow startup race when creating the perf nr_addr_filters
       sysfs file
     - debugobjects: Stop accessing objects after releasing hash bucket lock
     - regulator: core: Only increment use_count when enable_count changes
     - audit: Send netlink ACK before setting connection in auditd_set
     - ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
     - PNP: ACPI: fix fortify warning
     - ACPI: extlog: fix NULL pointer dereference check
     - ACPI: NUMA: Fix the logic of getting the fake_pxm value
     - PM / devfreq: Synchronize devfreq_monitor_[start/stop]
     - ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous
       events
     - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
     - UBSAN: array-index-out-of-bounds in dtSplitRoot
     - jfs: fix slab-out-of-bounds Read in dtSearch
     - jfs: fix array-index-out-of-bounds in dbAdjTree
     - jfs: fix uaf in jfs_evict_inode
     - pstore/ram: Fix crash when setting number of cpus to an odd number
     - erofs: fix ztailpacking for subpage compressed blocks
     - [armhf] crypto: stm32/crc32 - fix parsing list of devices
     - afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
     - afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
     - rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
     - jfs: fix array-index-out-of-bounds in diNewExt
     - arch: consolidate arch_irq_work_raise prototypes
     - [s390x] vfio-ap: fix sysfs status attribute for AP queue devices
     - [s390x] ptrace: handle setting of fpc register correctly
     - [s390x] KVM: s390: fix setting of fpc register
     - SUNRPC: Fix a suspicious RCU usage warning (CVE-2023-52623)
     - ecryptfs: Reject casefold directory inodes
     - ext4: fix inconsistent between segment fstrim and full fstrim
     - ext4: unify the type of flexbg_size to unsigned int
     - ext4: remove unnecessary check from alloc_flex_gd()
     - ext4: avoid online resizing failures due to oversized flex bg
       (CVE-2023-52622)
     - wifi: rt2x00: restart beacon queue when hardware reset
     - wifi: rt2x00: correct wrong BBP register in RxDCOC calibration
     - [arm64] soc: xilinx: Fix for call trace due to the usage of
       smp_processor_id()
     - [arm64] soc: xilinx: fix unhandled SGI warning message
     - scsi: lpfc: Fix possible file string name overflow when updating firmware
     - PCI: Add no PM reset quirk for NVIDIA Spectrum devices
     - bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
     - net: usb: ax88179_178a: avoid two consecutive device resets
     - scsi: mpi3mr: Add PCI checks where SAS5116 diverges from SAS4116
     - scsi: arcmsr: Support new PCI device IDs 1883 and 1886
     - wifi: ath9k: Fix potential array-index-out-of-bounds read in
       ath9k_htc_txstatus()
     - wifi: ath11k: fix race due to setting ATH11K_FLAG_EXT_IRQ_ENABLED too
       early
     - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
       (CVE-2023-52621)
     - scsi: libfc: Don't schedule abort twice
     - scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
     - bpf: Set uattr->batch.count as zero before batched update or deletion
     - net: phy: at803x: fix passing the wrong reference for config_intr
     - [arm64] scsi: hisi_sas: Set .phy_attached before notifing phyup event
       HISI_PHYE_PHY_UP_PM
     - ice: fix ICE_AQ_VSI_Q_OPT_RSS_* register values
     - net: atlantic: eliminate double free in error handling logic
     - [arm64,armhf] net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error
       path
     - block: prevent an integer overflow in bvec_try_merge_hw_page
     - md: Whenassemble the array, consult the superblock of the freshest device
     - [arm64] dts: qcom: msm8996: Fix 'in-ports' is a required property
     - [arm64] dts: qcom: msm8998: Fix 'out-ports' is a required property
     - ice: fix pre-shifted bit usage
     - [arm64] dts: amlogic: fix format for s4 uart node
     - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
     - libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos
     - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
     - wifi: cfg80211: free beacon_ies when overridden from hidden BSS
     - Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
     - Bluetooth: hci_sync: fix BR/EDR wakeup bug
     - Bluetooth: L2CAP: Fix possible multiple reject send
     - net/smc: disable SEID on non-s390 archs where virtual ISM may be used
     - i40e: Fix VF disable behavior to block all traffic
     - net: dsa: qca8k: put MDIO bus OF node on qca8k_mdio_register() failure
     - f2fs: fix to check return value of f2fs_reserve_new_block()
     - ALSA: hda: Refer to correct stream index at loops
     - ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
     - fast_dput(): handle underflows gracefully
     - RDMA/IPoIB: Fix error code return in ipoib_mcast_join
     - [arm64,armhf] drm/panel-edp: Add override_edid_mode quirk for generic edp
     - drm/amd/display: Fix tiled display misalignment
     - f2fs: fix write pointers on zoned device after roll forward
     - [x86] ASoC: amd: Add new dmi entries for acp5x platform
     - drm/drm_file: fix use of uninitialized variable
     - drm/framebuffer: Fix use of uninitialized variable
     - drm/mipi-dsi: Fix detach call without attach
     - media: stk1160: Fixed high volume of stk1160_dbg messages
     - [arm64,armhf]  media: rockchip: rga: fix swizzling for RGB formats
     - PCI: add INTEL_HDA_ARL to pci_ids.h
     - [x86] ALSA: hda: Intel: add HDA_ARL PCI ID support
     - [arm64] media: rkisp1: Drop IRQF_SHARED
     - [arm64] media: rkisp1: Fix IRQ handler return values
     - [arm64] media: rkisp1: Store IRQ lines
     - [arm64] media: rkisp1: Fix IRQ disable race issue
     - hwmon: (nct6775) Fix fan speed set failure in automatic mode
     - f2fs: fix to tag gcing flag on page during block migration
     - [armhf] drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind
       time
     - IB/ipoib: Fix mcast list locking
     - media: ddbridge: fix an error code problem in ddb_probe
     - drm/amd/display: For prefetch mode > 0, extend prefetch if possible
     - [arm64] drm/msm/dpu: Ratelimit framedone timeout msgs
     - [arm64] drm/msm/dpu: fix writeback programming for YUV cases
     - drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap
     - [x86] watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
     - drm/amd/display: make flip_timestamp_in_us a 64-bit variable
     - drm/amdgpu: Fix ecc irq enable/disable unpaired
     - drm/amdgpu: Let KFD sync with VM fences
     - drm/amdgpu: Fix '*fw' from request_firmware() not released in
       'amdgpu_ucode_request()'
     - drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
     - ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140
     - leds: trigger: panic: Don't register panic notifier if creating the
       trigger failed
     - xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
     - PCI: Only override AMD USB controller if required
     - PCI: switchtec: Fix stdev_release() crash after surprise hot remove
     - perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is present
     - usb: hub: Replace hardcoded quirk value with BIT() macro
     - usb: hub: Add quirk to decrease IN-ep poll interval for Microchip USB491x
       hub
     - tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
     - fs/kernfs/dir: obey S_ISGID
     - PCI: Fix 64GT/s effective data rate calculation
     - PCI/AER: Decode Requester ID when no error info found
     - 9p: Fix initialisation of netfs_inode for 9p
     - libsubcmd: Fix memory leak in uniq()
     - virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a
       region of size 10" warnings
     - blk-mq: fix IO hang from sbitmap wakeup race
     - ceph: reinitialize mds feature bit even when session in open
     - ceph: fix deadlock or deadcode of misusing dget()
     - ceph: fix invalid pointer access if get_quota_realm return ERR_PTR
     - drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in
       'get_platform_power_management_table()'
     - drm/amdgpu: Fix with right return code '-EIO' in
       'amdgpu_gmc_vram_checking()'
     - drm/amdgpu: Release 'adev->pm.fw' before return in
       'amdgpu_device_need_post()'
     - perf: Fix the nr_addr_filters fix
     - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
     - drm: using mul_u32_u32() requires linux/math64.h
     - scsi: isci: Fix an error code problem in isci_io_request_build()
     - [armhf] regulator: ti-abb: don't use devm_platform_ioremap_resource_byname
       for shared interrupt register
     - scsi: core: Move scsi_host_busy() out of host lock for waking up EH
       handler
     - HID: hidraw: fix a problem of memory leak in hidraw_release()
     - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
     - ipv4: raw: add drop reasons
     - ipmr: fix kernel panic when forwarding mcast packets
     - tcp: add sanity checks to rx zerocopy
     - ixgbe: Refactor returning internal error codes
     - ixgbe: Refactor overtemp event handling
     - ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
     - ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
     - llc: call sock_orphan() at release time
     - bridge: mcast: fix disabled snooping after long uptime
     - netfilter: conntrack: correct window scaling with retransmitted SYN
     - netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
     - netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
     - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom
       expectations
     - net: ipv4: fix a memleak in ip_setup_cork
     - af_unix: fix lockdep positive in sk_diag_dump_icons()
     - net: sysfs: Fix /sys/class/net/<iface> path
     - [arm64] irq: set the correct node for shadow call stack
     - Revert "drm/amd/display: Disable PSR-SU on Parade 0803 TCON again"
     - [arm64] drm/msm/dsi: Enable runtime PM
     - gve: Fix use-after-free vulnerability
     - bonding: remove print in bond_verify_device_path
     - drm/amdgpu: Fix missing error code in 'gmc_v6/7/8/9_0_hw_init()'
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.78
     - ext4: regenerate buddy after block freeing failed if under fc replay
     - [arm64] dmaengine: ti: k3-udma: Report short packet errors
     - [arm64] dmaengine: fsl-qdma: Fix a memory leak related to the status queue
       DMA
     - [arm64] dmaengine: fsl-qdma: Fix a memory leak related to the queue
       command DMA
     - [arm64] phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
     - dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
     - [armhf] phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
     - cifs: failure to add channel on iface should bump up weight
     - [arm64] drm/msms/dp: fixed link clock divider bits be over written in BPC
       unknown case
     - [arm64] drm/msm/dp: return correct Colorimetry for
       DP_TEST_DYNAMIC_RANGE_CEA case
     - [arm64] drm/msm/dpu: check for valid hw_pp in
       dpu_encoder_helper_phys_cleanup
     - net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
     - wifi: mac80211: fix waiting for beacons logic
     - netdevsim: avoid potential loop in nsim_dev_trap_report_work()
     - net: atlantic: Fix DMA mapping for PTP hwts ring
     - tunnels: fix out of bounds access when building IPv6 PMTU error
     - atm: idt77252: fix a memleak in open_card_ubr0
     - [armhf] hwmon: (aspeed-pwm-tacho) mutex for tach reading
     - [x86] hwmon: (coretemp) Fix out-of-bounds memory access
     - [x86] hwmon: (coretemp) Fix bogus core_id to attr name mapping
     - inet: read sk->sk_family once in inet_recv_error()
     - [x86] drm/i915/gvt: Fix uninitialized variable in handle_mmio()
     - rxrpc: Fix response to PING RESPONSE ACKs to a dead call
     - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
     - af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.
     - ppp_async: limit MRU to 64K
     - selftests: cmsg_ipv6: repeat the exact packet
     - netfilter: nft_compat: narrow down revision to unsigned 8-bits
     - netfilter: nft_compat: reject unused compat flag
     - netfilter: nft_compat: restrict match/target protocol to u16
     - drm/amd/display: Implement bounds check for stream encoder creation in
       DCN301
     - netfilter: nft_ct: reject direction for ct id
     - netfilter: nft_set_pipapo: store index in scratch maps
     - netfilter: nft_set_pipapo: add helper to release pcpu scratch area
     - netfilter: nft_set_pipapo: remove scratch_aligned pointer
     - fs/ntfs3: Fix an NULL dereference bug
     - scsi: core: Move scsi_host_busy() out of host lock if it is for
       per-command
     - blk-iocost: Fix an UBSAN shift-out-of-bounds warning
     - fs: dlm: don't put dlm_local_addrs on heap (Closes: #1063338)
     - mtd: parsers: ofpart: add workaround for #size-cells 0
     - ALSA: usb-audio: Add delay quirk for MOTU M Series 2nd revision
     - ALSA: usb-audio: Add a quirk for Yamaha YIT-W12TX transmitter
     - ALSA: usb-audio: add quirk for RODE NT-USB+
     - USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
     - USB: serial: option: add Fibocom FM101-GL variant
     - USB: serial: cp210x: add ID for IMST iM871A-USB
     - [arm64,armhf] usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK
     - [arm64,armhf] usb: host: xhci-plat: Add support for
       XHCI_SG_TRB_CACHE_SIZE_QUIRK
     - hrtimer: Report offline hrtimer enqueue
     - Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
     - Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
       (Closes: #1061521)
     - io_uring/net: fix sr->len for IORING_OP_RECV with MSG_WAITALL and buffers
     - Revert "ASoC: amd: Add new dmi entries for acp5x platform"
     - vhost: use kzalloc() instead of kmalloc() followed by memset()
       (CVE-2024-0340)
     - RDMA/irdma: Fix support for 64k pages
     - f2fs: add helper to check compression level (Closes: #1063422)
     - block: treat poll queue enter similarly to timeouts
     - clocksource: Skip watchdog check for large watchdog intervals
     - net: stmmac: xgmac: use #define for string constants
     - ALSA: usb-audio: Sort quirk table entries
     - net: stmmac: xgmac: fix a typo of register name in DPP safety handling
     - netfilter: nft_set_rbtree: skip end interval element from gc
       (CVE-2024-26581)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.79
     - work around gcc bugs with 'asm goto' with outputs
     - update workarounds for gcc "asm goto" issue
     - btrfs: add and use helper to check if block group is used
     - btrfs: do not delete unused block group if it may be used soon
     - btrfs: forbid creating subvol qgroups
     - btrfs: do not ASSERT() if the newly created subvolume already got read
       (CVE-2024-23850)
     - btrfs: forbid deleting live subvol qgroup
     - btrfs: send: return EOPNOTSUPP on unknown flags
     - btrfs: don't reserve space for checksums when writing to nocow files
     - btrfs: reject encoded write if inode has nodatasum flag set
     - btrfs: don't drop extent_map for free space inode on write error
     - driver core: Fix device_link_flag_is_sync_state_only()
     - wifi: iwlwifi: Fix some error codes
     - wifi: iwlwifi: uninitialized variable in iwl_acpi_get_ppag_table()
     - of: property: Improve finding the supplier of a remote-endpoint property
     - net: openvswitch: limit the number of recursions from action sets
       (CVE-2024-1151)
     - lan966x: Fix crash when adding interface under a lag
     - tls/sw: Use splice_eof() to flush
     - tls: extract context alloc/initialization out of tls_set_sw_offload
     - net: tls: factor out tls_*crypt_async_wait()
     - tls: fix race between async notify and socket close (CVE-2024-26583)
     - net: tls: fix use-after-free with partial reads and async decrypt
       (CVE-2024-26582)
     - net: tls: fix returned read length with async decrypt
     - ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
     - net: sysfs: Fix /sys/class/net/<iface> path for statistics
     - nouveau/svm: fix kvcalloc() argument order
     - [mips*] Add 'memory' clobber to csum_ipv6_magic() inline assembler
     - i40e: Do not allow untrusted VF to remove administratively set MAC
     - i40e: Fix waiting for queues of all VSIs to be disabled
     - tracing/trigger: Fix to return error if failed to alloc snapshot
     - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
     - scsi: storvsc: Fix ring buffer size calculation
     - dm-crypt, dm-verity: disable tasklets
     - [x86] ASoC: amd: yc: Add DMI quirk for MSI Bravo 15 C7VF
     - ALSA: hda/realtek: Fix the external mic not being recognised for Acer
       Swift 1 SF114-32
     - ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx
     - HID: i2c-hid-of: fix NULL-deref on failed power up
     - HID: wacom: generic: Avoid reporting a serial of '0' to userspace
     - HID: wacom: Do not register input devices until after hid_hw_start
     - iio: hid-sensor-als: Return 0 for HID_USAGE_SENSOR_TIME_TIMESTAMP
     - usb: ucsi: Add missing ppm_lock
     - usb: ulpi: Fix debugfs directory leak
     - usb: ucsi_acpi: Fix command completion handling
     - USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
     - usb: f_mass_storage: forbid async queue when shutdown happen
     - usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend
     - driver core: fw_devlink: Improve detection of overlapping cycles
     - cifs: fix underflow in parse_server_interfaces()
     - i2c: qcom-geni: Correct I2C TRE sequence
     - irqchip/loongson-eiointc: Use correct struct type in
       eiointc_domain_alloc()
     - i2c: pasemi: split driver into two separate modules
     - i2c: i801: Fix block process call transactions (CVE-2024-26593)
     - modpost: trim leading spaces when processing source files list
     - mptcp: get rid of msk->subflow
     - mptcp: fix data re-injection from stale subflow
     - mptcp: drop the push_pending field
     - mptcp: check addrs list in userspace_pm_get_local_id
     - media: Revert "media: rkisp1: Drop IRQF_SHARED"
     - scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
     - Revert "drm/amd: flush any delayed gfxoff on suspend entry"
     - drm/virtio: Set segment size for virtio_gpu device
     - lsm: fix the logic in security_inode_getsecctx()
     - firewire: core: correct documentation of fw_csr_string() kernel API
     - ALSA: hda/realtek: Apply headset jack quirk for non-bass alc287 thinkpads
     - kbuild: Fix changing ELF file type for output of gen_btf for big endian
     - nfc: nci: free rx_data_reassembly skb on NCI device cleanup
     - net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
     - net: stmmac: do not clear TBS enable bit on link up/down
     - xen-netback: properly sync TX responses
     - modpost: propagate W=1 build option to modpost
     - modpost: Don't let "driver"s reference .exit.*
     - linux/init: remove __memexit* annotations
     - modpost: Include '.text.*' in TEXT_SECTIONS
     - modpost: Add '.ltext' and '.ltext.*' to TEXT_SECTIONS
     - ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
     - ASoC: codecs: wcd938x: handle deferred probe
     - ALSA: hda/cs8409: Suppress vmaster control for Dolphin models
     - ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power
     - [arm*] binder: signal epoll threads of self-work (CVE-2024-26606)
     - misc: fastrpc: Mark all sessions as invalid in cb_remove
     - ext4: fix double-free of blocks due to wrong extents moved_len
     - ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks()
     - tracing: Fix wasted memory in saved_cmdlines logic
     - staging: iio: ad5933: fix type mismatch regression
     - iio: magnetometer: rm3100: add boundary check for the value read from
       RM3100_REG_TMRC
     - iio: core: fix memleak in iio_device_register_sysfs
     - iio: commom: st_sensors: ensure proper DMA alignment
     - iio: accel: bma400: Fix a compilation problem
     - iio: adc: ad_sigma_delta: ensure proper DMA alignment
     - iio: imu: adis: ensure proper DMA alignment
     - iio: imu: bno055: serdev requires REGMAP
     - media: rc: bpf attach/detach requires write permission
     - ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails
     - xfrm: Remove inner/outer modes from output path
     - xfrm: Remove inner/outer modes from input path
     - [arm64] drm/msm: Wire up tlb ops
     - drm/prime: Support page array >= 4GB
     - drm/amd/display: Increase frame-larger-than for all display_mode_vba files
     - drm/amd/display: Preserve original aspect ratio in create stream
     - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
     - ring-buffer: Clean ring_buffer_poll_wait() error return
     - nfp: flower: fix hardware offload for the transfer layer port
     - [powerpc*] 64: Set task pt_regs->link to the LR value on scv entry
     - [powerpc*] cputable: Add missing PPC_FEATURE_BOOKE on PPC64 Book-E
     - [powerpc*] pseries: fix accuracy of stolen time
     - [x86] fpu: Stop relying on userspace for info to fault in xsave buffer
       (CVE-2024-26603)
     - [x86] KVM: x86/pmu: Fix type length error when reading pmu->fixed_ctr_ctrl
     - [x86] mm/ident_map: Use gbpages only where full GB page should be mapped.
     - io_uring/net: fix multishot accept overflow handling
     - mmc: slot-gpio: Allow non-sleeping GPIO ro
     - ALSA: hda/realtek: fix mute/micmute LED For HP mt645
     - ALSA: hda/conexant: Add quirk for SWS JS201D
     - nilfs2: fix data corruption in dsync block recovery for small block sizes
     - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
     - crypto: ccp - Fix null pointer dereference in
       __sev_platform_shutdown_locked
     - nfp: use correct macro for LengthSelect in BAR config
     - nfp: flower: prevent re-adding mac index for bonded port
     - wifi: cfg80211: fix wiphy delayed work queueing
     - wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
     - irqchip/irq-brcmstb-l2: Add write memory barrier before exit
     - irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update
     - zonefs: Improve error handling
     - mmc: sdhci-pci-o2micro: Fix a warm reboot issue that disk can't be
       detected by BIOS (Closes: #1056056)
     - [x86] ASoC: amd: yc: Add DMI quirk for Lenovo Ideapad Pro 5 16ARP8
     - fs: relax mount_setattr() permission checks
     - net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio
     - [s390x] qeth: Fix potential loss of L3-IP@ in case of network issues
     - net: ethernet: ti: cpsw_new: enable mac_managed_pm to fix mdio
     - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
     - ceph: prevent use-after-free in encode_cap_msg()
     - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
       (CVE-2024-0841)
     - mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE
     - of: property: fix typo in io-channels
     - can: netlink: Fix TDCO calculation using the old data bittiming
     - can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock
     - can: j1939: Fix UAF in j1939_sk_match_filter during
       setsockopt(SO_J1939_FILTER)
     - pmdomain: core: Move the unused cleanup to a _sync initcall
     - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of
       lock_task_sighand()
     - tracing: Inform kmemleak of saved_cmdlines allocation
     - xfrm: Use xfrm_state selector for BEET input
     - xfrm: Silence warnings triggerable by bad packets
     - tls: fix NULL deref on tls_sw_splice_eof() with empty record
     - md: bypass block throttle for superblock update
     - wifi: mwifiex: Support SD8978 chipset
     - wifi: mwifiex: add extra delay for firmware ready
     - bus: moxtet: Add spi device table
     - [arm64] dts: qcom: msm8916: Enable blsp_dma by default
     - [arm64] dts: qcom: msm8916: Make blsp_dma controlled-remotely
     - [arm64] dts: qcom: sdm845: fix USB SS wakeup
     - [arm64] dts: qcom: sm8150: fix USB SS wakeup
     - wifi: mwifiex: fix uninitialized firmware_stat
     - crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
     - block: fix partial zone append completion handling in req_bio_endio()
     - netfilter: ipset: fix performance regression in swap operation
     - netfilter: ipset: Missing gc cancellations fixed
     - nfsd: fix RELEASE_LOCKOWNER
     - nfsd: don't take fi_lock in nfsd_break_deleg_cb()
     - hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range()
     - RDMA/irdma: Ensure iWarp QP queue memory is OS paged aligned
     - smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)
     - smb: client: fix parsing of SMB3.1.1 POSIX create context
     - net: prevent mss overflow in skb_segment() (CVE-2023-52435)
     - bpf: Add struct for bin_args arg in bpf_bprintf_prepare
     - bpf: Do cleanup in bpf_bprintf_cleanup only when needed
     - bpf: Remove trace_printk_lock
     - userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
     - dmaengine: ioat: Free up __cleanup() name
     - apparmor: Free up __cleanup() name
     - locking: Introduce __cleanup() based infrastructure
     - kbuild: Drop -Wdeclaration-after-statement
     - sched/membarrier: reduce the ability to hammer on sys_membarrier
       (CVE-2024-26602)
     - of: property: Add in-ports/out-ports support to of_graph_get_port_parent()
     - nilfs2: fix potential bug in end_buffer_async_write
     - nilfs2: replace WARN_ONs for invalid DAT metadata block requests
     - dm: limit the number of targets and parameter size area (CVE-2024-23851,
       CVE-2023-52429)
     - [arm64:]Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata
     - mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.80
     - net/sched: Retire CBQ qdisc
     - net/sched: Retire ATM qdisc
     - net/sched: Retire dsmark qdisc
     - sched/rt: Disallow writing invalid values to sched_rt_period_us
     - sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
     - scsi: target: core: Add TMF to tmr_list handling
     - cifs: open_cached_dir should not rely on primary channel
     - wifi: cfg80211: fix missing interfaces when dumping
     - wifi: mac80211: fix race condition on enabling fast-xmit
     - fbdev: savage: Error out if pixclock equals zero
     - fbdev: sis: Error out if pixclock equals zero
     - block: Fix WARNING in _copy_from_iter
     - smb: Work around Clang __bdos() type confusion
     - cifs: translate network errors on send to -ECONNABORTED
     - ahci: asm1166: correct count of reported ports
     - aoe: avoid potential deadlock at set_capacity
     - ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
     - [mips*] reserve exception vector space ONLY ONCE
     - [x86] platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus
       tablet
     - ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block
       bitmap corrupt
     - ext4: avoid allocating blocks from corrupted group in
       ext4_mb_try_best_found()
     - ext4: avoid allocating blocks from corrupted group in
       ext4_mb_find_by_goal()
     - Input: goodix - accept ACPI resources with gpio_count == 3 && gpio_int_idx
       == 0
     - [armhf] dmaengine: ti: edma: Add some null pointer checks to the
       edma_probe
     - [arm64] regulator: pwm-regulator: Add validity checks in continuous
       .get_voltage
     - nvmet-tcp: fix nvme tcp ida memory leak
     - usb: ucsi_acpi: Quirk to ack a connector change ack cmd
     - ALSA: usb-audio: Check presence of valid altsetting control
     - [armhf] ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
     - Input: xpad - add Lenovo Legion Go controllers
     - netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in
       sctp_new
     - drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz
     - [x86] ASoC: wm_adsp: Don't overwrite fwf_name with the default
     - ALSA: usb-audio: Ignore clock selector errors for single connection
     - nvme-fc: do not wait in vain when unloading module
     - nvmet-fcloop: swap the list_add_tail arguments
     - nvmet-fc: release reference on target port
     - nvmet-fc: defer cleanup using RCU properly
     - nvmet-fc: hold reference on hostport match
     - nvmet-fc: abort command when there is no binding
     - nvmet-fc: avoid deadlock on delete association path
     - nvmet-fc: take ref count on tgtport before delete assoc
     - smb: client: increase number of PDUs allowed in a compound request
     - ext4: correct the hole length returned by ext4_map_blocks()
     - Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table
     - wifi: mac80211: set station RX-NSS on reconfig
     - wifi: mac80211: adding missing drv_mgd_complete_tx() call
     - efi: runtime: Fix potential overflow of soft-reserved region size
     - efi: Don't add memblocks for soft-reserved memory
     - [x86] hwmon: (coretemp) Enlarge per package core count limit
     - scsi: lpfc: Use unsigned type for num_sge
     - scsi: ufs: core: Remove the ufshcd_release() in
       ufshcd_err_handling_prepare()
     - firewire: core: send bus reset promptly on gap count error
     - drm/amdgpu: skip to program GFXDEC registers for suspend abort
     - drm/amdgpu: reset gpu for s3 suspend abort case
     - smb: client: set correct d_type for reparse points under DFS mounts
     - virtio-blk: Ensure no requests in virtqueues before deleting vqs.
     - smb3: clarify mount warning
     - [amd64] IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
     - drm/ttm: Fix an invalid freeing on already freed page in error path
     - [s390x] cio: fix invalid -EBUSY on ccw_device_start
     - ata: libata-core: Do not try to set sleeping devices to standby
     - dm-crypt: recheck the integrity tag after a failure
     - dm-integrity: recheck the integrity tag after a failure
     - dm-crypt: don't modify the data when using authenticated encryption
     - dm-verity: recheck the hash after a failure
     - cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS
       window
     - scsi: target: pscsi: Fix bio_put() for error case
     - scsi: core: Consult supported VPD page list prior to fetching page
     - mm/swap: fix race when skipping swapcache
     - mm: memcontrol: clarify swapaccount=0 deprecation warning
     - [x86] platform/x86: intel-vbtn: Stop calling "VBDL" from notify_handler
     - [x86] platform/x86: touchscreen_dmi: Allow partial (prefix) matches for
       ACPI names
     - cachefiles: fix memory leak in cachefiles_add_cache()
     - md: Fix missing release of 'active_io' for flush
     - [arm64] KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
     - [arm64] KVM: arm64: vgic-its: Test for valid IRQ in
       its_sync_lpi_pending_table()
     - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
     - crypto: virtio/akcipher - Fix stack overflow on memcpy
     - irqchip/gic-v3-its: Do not assume vPE tables are preallocated
     - irqchip/sifive-plic: Enable interrupt if needed before EOI
     - PCI/MSI: Prevent MSI hardware interrupt number truncation
     - l2tp: pass correct message length to ip6_append_data
     - [x86] returnthunk: Allow different return thunks
     - [x86] Revert "x86/alternative: Make custom return thunk unconditional"
     - [x86] alternative: Make custom return thunk unconditional
     - dm-integrity, dm-verity: reduce stack usage for recheck
     - erofs: fix refcount on the metabuf used for inode lookup
     - serial: amba-pl011: Fix DMA transmission in RS485 mode
     - [arm64,armhf] usb: dwc3: gadget: Don't disconnect if not started
     - usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
     - usb: roles: fix NULL pointer issue when put module's reference
     - usb: roles: don't get/set_role() when usb_role_switch is unregistered
     - mptcp: make userspace_pm_append_new_local_addr static
     - mptcp: add needs_id for userspace appending addr
     - mptcp: fix lockless access in subflow ULP diag
     - Revert "drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz"
     - [amd64] IB/hfi1: Fix a memleak in init_credit_return
     - RDMA/bnxt_re: Return error for SRQ resize
     - RDMA/irdma: Fix KASAN issue with tasklet
     - RDMA/irdma: Validate max_send_wr and max_recv_wr
     - RDMA/irdma: Set the CQ read threshold for GEN 1
     - RDMA/irdma: Add AE for too many RNRS
     - RDMA/srpt: Support specifying the srpt_service_guid parameter
     - iommufd/iova_bitmap: Bounds check mapped::pages access
     - iommufd/iova_bitmap: Switch iova_bitmap::bitmap to an u8 array
     - iommufd/iova_bitmap: Consider page offset for the pages to be pinned
     - RDMA/qedr: Fix qedr_create_user_qp error flow
     - [arm64] dts: rockchip: set num-cs property for spi on px30
     - RDMA/srpt: fix function pointer cast warnings
     - bpf, scripts: Correct GPL license name
     - scsi: smartpqi: Fix disable_managed_interrupts
     - net: bridge: switchdev: Skip MDB replays of deferred events on offload
     - net: bridge: switchdev: Ensure deferred event delivery on unoffload
     - dccp/tcp: Unhash sk from ehash for tb2 alloc failure after
       check_estalblished().
     - nouveau: fix function cast warnings
     - [x86] numa: Fix the address overlap check in numa_fill_memblks()
     - [x86] numa: Fix the sort compare func used in numa_fill_memblks()
     - net: stmmac: Fix incorrect dereference in interrupt handlers
     - ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
     - ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
     - ata: ahci_ceva: fix error handling for Xilinx GT PHY support
     - bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel
     - afs: Increase buffer size in afs_update_volume_status()
     - ipv6: sr: fix possible use-after-free and null-ptr-deref
     - net: dev: Convert sa_data to flexible array in struct sockaddr
     - [arm64] sme: Restore SME registers on exit from suspend
     - [x86] platform/x86: thinkpad_acpi: Only update profile if successfully
       converted
     - [s390x] use the correct count for __iowrite64_copy()
     - bpf, sockmap: Fix NULL pointer dereference in
       sk_psock_verdict_data_ready()
     - tls: break out of main loop when PEEK gets a non-data record
     - tls: stop recv() if initial process_rx_list gave us non-DATA
     - tls: don't skip over different type records from the rx_list
     - netfilter: nf_tables: set dormant flag on hook register failure
     - netfilter: flowtable: simplify route logic
     - netfilter: nft_flow_offload: reset dst in route object after setting up
       flow
     - netfilter: nft_flow_offload: release dst in case direct xmit path is used
     - netfilter: nf_tables: rename function to destroy hook list
     - netfilter: nf_tables: register hooks last when adding new chain/flowtable
     - netfilter: nf_tables: use kzalloc for hook allocation
     - net: mctp: put sock on tag allocation failure
     - Fix write to cloned skb in ipv6_hop_ioam()
     - net: phy: realtek: Fix rtl8211f_config_init() for RTL8211F(D)(I)-VD-CG PHY
     - drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is
       set
     - drm/amd/display: Fix memory leak in dm_sw_fini()
     - [arm64,armhf] i2c: imx: when being a target, mark the last read as
       processed
     - erofs: simplify compression configuration parser
     - erofs: fix inconsistent per-file compression format (CVE-2024-26590)
     - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
     - mm: zswap: fix missing folio cleanup in writeback race path
     - mptcp: userspace pm send RM_ADDR for ID 0
     - mptcp: add needs_id for netlink appending addr
     - ata: ahci: add identifiers for ASM2116 series adapters
     - ahci: Extend ASM1061 43-bit DMA address quirk to other ASM106x parts
     - arp: Prevent overflow in arp_req_get().
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.81
     - netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)
     - [arm64] drm/meson: fix unbind path if HDMI fails to bind
     - [arm64] drm/meson: Don't remove bridges which are created by other drivers
     - scsi: core: Add struct for args to execution functions
     - scsi: sd: usb_storage: uas: Access media prior to querying device
       properties
     - af_unix: Fix task hung while purging oob_skb in GC.
     - of: overlay: Reorder struct fragment fields kerneldoc
     - usb: gadget: Properly configure the device for remote wakeup
     - Input: xpad - add constants for GIP interface numbers
     - [arm64] iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any
     - [arm64] iommu/arm-smmu-qcom: Limit the SMR groups to 128
     - RDMA/core: Fix multiple -Warray-bounds warnings
     - mm: huge_memory: don't force huge page alignment on 32 bit
       (CVE-2024-26621) (Closes: #1024149)
     - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
     - netlink: add nla be16/32 types to minlen array
     - net: ip_tunnel: prevent perpetual headroom growth
     - net: mctp: take ownership of skb in mctp_local_output
     - tun: Fix xdp_rxq_info's queue_index when detaching
     - cpufreq: intel_pstate: fix pstate limits enforcement for adjust_perf call
       back
     - net: veth: clear GRO when clearing XDP even when down
     - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
     - lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is
       detected
     - veth: try harder when allocating queue memory
     - net: usb: dm9601: fix wrong return value in dm9601_mdio_read
     - net: lan78xx: fix "softirq work is pending" error
     - uapi: in6: replace temporary label with rfc9486
     - stmmac: Clear variable when destroying workqueue
     - Bluetooth: hci_sync: Check the correct flag before starting a scan
     - Bluetooth: Avoid potential use-after-free in hci_error_reset
     - Bluetooth: hci_sync: Fix accept_list when attempting to suspend
     - Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR
     - Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
     - Bluetooth: Enforce validation on max value of connection interval
     - Bluetooth: qca: Fix wrong event type for patch config command
     - Bluetooth: hci_qca: mark OF related data as maybe unused
     - Bluetooth: hci_qca: Add support for QTI Bluetooth chip wcn6855
     - Bluetooth: btqca: use le32_to_cpu for ver.soc_id
     - Bluetooth: btqca: Add WCN3988 support
     - Bluetooth: qca: use switch case for soc type behavior
     - Bluetooth: qca: add support for WCN7850
     - Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT
     - netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
     - netfilter: let reset rules clean out conntrack entries
     - netfilter: bridge: confirm multicast packets before passing them up the
       stack
     - rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
     - igb: extend PTP timestamp adjustments to i211
     - net: hsr: Use correct offset for HSR TLV values in supervisory HSR frames
     - tls: decrement decrypt_pending if no async completion will be called
     - tls: fix peeking with sync+async decryption
     - efi/capsule-loader: fix incorrect allocation size
     - ALSA: Drop leftover snd-rtctimer stuff from Makefile
     - [arm64,armhf] drm/tegra: Remove existing framebuffer only if we support
       display
     - fbcon: always restore the old font data in fbcon_do_set_font()
     - afs: Fix endless loop in directory parsing
     - of: property: fw_devlink: Fix stupid bug in remote-endpoint parsing
     - tomoyo: fix UAF write bug in tomoyo_write_control() (CVE-2024-26622)
     - ALSA: firewire-lib: fix to check cycle continuity
     - ALSA: hda/realtek: Enable Mute LED on HP 840 G8 (MB 8AB8)
     - ALSA: hda/realtek: fix mute/micmute LED For HP mt440
     - landlock: Fix asymmetric private inodes referring
     - gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
     - wifi: nl80211: reject iftype change with mesh ID change
     - btrfs: fix double free of anonymous device after snapshot creation failure
     - btrfs: dev-replace: properly validate device names
     - btrfs: send: don't issue unnecessary zero writes for trailing hole
     - Revert "drm/amd/pm: resolve reboot exception for si oland"
     - drm/buddy: fix range bias
     - [arm64] dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
     - [arm64] crypto: arm64/neonbs - fix out-of-bounds access on short input
     - [arm64] dmaengine: fsl-qdma: init irq after reg initialization
     - [arm64,armhf] mmc: mmci: stm32: fix DMA API overlapping mappings warning
     - mmc: core: Fix eMMC initialization with 1-bit bus connection
     - [arm64] mmc: sdhci-xenon: add timeout for PHY init complete
     - [arm64] mmc: sdhci-xenon: fix PHY init clock stability
     - efivarfs: Request at most 512 bytes for variable names
     - [arm64] pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation
     - [x86] e820: Don't reserve SETUP_RNG_SEED in e820
     - [x86] cpu/intel: Detect TME keyid bits before setting MTRR mask registers
     - mptcp: fix data races on local_id
     - mptcp: fix data races on remote_id
     - mptcp: fix duplicate subflow creation
     - mptcp: continue marking the first subflow as UNCONNECTED
     - mptcp: map v4 address to v6 when destroying subflow
     - mptcp: push at DSS boundaries
     - mptcp: fix snd_wnd initialization for passive socket
     - mptcp: fix double-free on socket dismantle
     - mptcp: fix possible deadlock in subflow diag
     - RDMA/core: Refactor rdma_bind_addr (CVE-2023-2176)
     - RDMA/core: Update CMA destination address on rdma_resolve_addr
     - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory
     - [x86] boot/compressed: Rename efi_thunk_64.S to efi-mixed.S
     - [x86] boot/compressed: Move 32-bit entrypoint code into .text section
     - [x86] boot/compressed: Move bootargs parsing out of 32-bit startup code
     - [x86] boot/compressed: Move efi32_pe_entry into .text section
     - [x86] boot/compressed: Move efi32_entry out of head_64.S
     - [x86] boot/compressed: Move efi32_pe_entry() out of head_64.S
     - [x86] boot/compressed, efi: Merge multiple definitions of image_offset
       into one
     - [x86] boot/compressed: Simplify IDT/GDT preserve/restore in the EFI thunk
     - [x86] boot/compressed: Avoid touching ECX in startup32_set_idt_entry()
     - [x86] boot/compressed: Pull global variable reference into
       startup32_load_idt()
     - [x86] boot/compressed: Move startup32_load_idt() into .text section
     - [x86] boot/compressed: Move startup32_load_idt() out of head_64.S
     - [x86] boot/compressed: Move startup32_check_sev_cbit() into .text
     - [x86] boot/compressed: Move startup32_check_sev_cbit() out of head_64.S
     - [x86] boot/compressed: Adhere to calling convention in
       get_sev_encryption_bit()
     - [x86] boot/compressed: Only build mem_encrypt.S if AMD_MEM_ENCRYPT=y
     - efi: verify that variable services are supported
     - [x86] efi: Make the deprecated EFI handover protocol optional
     - [x86] boot: Robustify calling startup_{32,64}() from the decompressor code
     - [x86] efistub: Branch straight to kernel entry point from C code
     - [x86] decompressor: Store boot_params pointer in callee save register
     - [x86] decompressor: Assign paging related global variables earlier
     - [x86] decompressor: Call trampoline as a normal function
     - [x86] decompressor: Use standard calling convention for trampoline
     - [x86] decompressor: Avoid the need for a stack in the 32-bit trampoline
     - [x86] decompressor: Call trampoline directly from C code
     - [x86] decompressor: Only call the trampoline when changing paging levels
     - [x86] decompressor: Pass pgtable address to trampoline directly
     - [x86] decompressor: Merge trampoline cleanup with switching code
     - [x86] decompressor: Move global symbol references to C code
     - decompress: Use 8 byte alignment
     - drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml
     - NFS: Fix data corruption caused by congestion.
     - NFSD: Simplify READ_PLUS
     - NFSD: Remove redundant assignment to variable host_err
     - nfsd: ignore requests to disable unsupported versions
     - nfsd: move nfserrno() to vfs.c
     - nfsd: allow disabling NFSv2 at compile time
     - exportfs: use pr_debug for unreachable debug statements
     - NFSD: Flesh out a documenting comment for filecache.c
     - NFSD: Clean up nfs4_preprocess_stateid_op() call sites
     - NFSD: Trace stateids returned via DELEGRETURN
     - NFSD: Trace delegation revocations
     - NFSD: Use const pointers as parameters to fh_ helpers
     - NFSD: Update file_hashtbl() helpers
     - NFSD: Clean up nfsd4_init_file()
     - NFSD: Add a nfsd4_file_hash_remove() helper
     - NFSD: Clean up find_or_add_file()
     - NFSD: Refactor find_file()
     - NFSD: Use rhashtable for managing nfs4_file objects
     - NFSD: Fix licensing header in filecache.c
     - filelock: add a new locks_inode_context accessor function
     - lockd: use locks_inode_context helper
     - nfsd: use locks_inode_context helper
     - nfsd: fix up the filecache laundrette scheduling
     - NFSD: Use struct_size() helper in alloc_session()
     - lockd: set missing fl_flags field when retrieving args
     - lockd: ensure we use the correct file descriptor when unlocking
     - lockd: fix file selection in nlmsvc_cancel_blocked
     - trace: Relocate event helper files
     - NFSD: refactoring courtesy_client_reaper to a generic low memory shrinker
     - NFSD: add support for sending CB_RECALL_ANY
     - NFSD: add delegation reaper to react to low memory condition
     - NFSD: add CB_RECALL_ANY tracepoints
     - NFSD: Use only RQ_DROPME to signal the need to drop a reply
     - NFSD: Avoid clashing function prototypes
     - NFSD: Use set_bit(RQ_DROPME)
     - NFSD: register/unregister of nfsd-client shrinker at nfsd startup/shutdown
       time
     - NFSD: replace delayed_work with work_struct for nfsd_client_shrinker
     - nfsd: don't destroy global nfs4_file table in per-net shutdown
     - [arm64] efi: Limit allocations to 48-bit addressable physical region
     - efi: efivars: prevent double registration
     - [x86] efistub: Simplify and clean up handover entry code
     - [x86] decompressor: Avoid magic offsets for EFI handover entrypoint
     - [x86] efistub: Clear BSS in EFI handover protocol entrypoint
     - efi/libstub: Add memory attribute protocol definitions
     - efi/libstub: Add limit argument to efi_random_alloc()
     - [x86] efistub: Perform 4/5 level paging switch from the stub
     - [x86] decompressor: Factor out kernel decompression and relocation
     - [x86] efistub: Prefer EFI memory attributes protocol over DXE services
     - [x86] efistub: Perform SNP feature test while running in the firmware
     - [x86] efistub: Avoid legacy decompressor when doing EFI boot
     - [x86] efi/x86: Avoid physical KASLR on older Dell systems
     - [x86] efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR
     - [x86] boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr'
     - [x86] boot: efistub: Assign global boot_params variable
     - [x86] efi/x86: Fix the missing KASLR_FLAG bit in
       boot_params->hdr.loadflags
     - af_unix: Drop oob_skb ref before purging queue in GC.
     - [arm64] phy: freescale: phy-fsl-imx8-mipi-dphy: Fix alias name to use
       dashes
     - [powerpc*] pseries/iommu: IOMMU table is not initialized for kdump over
       SR-IOV
     - gpio: 74x164: Enable output pins after registers are reset
     - gpiolib: Fix the error path order in gpiochip_add_data_with_key()
     - gpio: fix resource unwinding order in error path
     - block: define bvec_iter as __packed __aligned(4)
     - [arm64,armhf] Revert "interconnect: Fix locking for runpm vs reclaim"
     - [arm64,armhf] Revert "interconnect: Teach lockdep about icc_bw_lock order"
     - [x86] bugs: Add asm helpers for executing VERW
     - [x86] entry_64: Add VERW just before userspace transition
     - [x86] entry_32: Add VERW just before userspace transition
     - [x86] bugs: Use ALTERNATIVE() instead of mds_user_clear static key
     - [x86] KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH
     - [x86] KVM/VMX: Move VERW closer to VMentry for MDS mitigation
     - bpf: Add table ID to bpf_fib_lookup BPF helper
     - bpf: Derive source IP addr via bpf_*_fib_lookup()
     - [x86] efistub: Give up if memory attribute protocol returns an error
     - xen/events: close evtchn after mapping cleanup
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.82
     - ceph: switch to corrected encoding of max_xattr_size in mdsmap
     - net: lan78xx: fix runtime PM count underflow on link stop
     - ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
     - i40e: disable NAPI right after disabling irqs when handling xsk_pool
     - ice: reorder disabling IRQ and NAPI in ice_qp_dis
     - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string
     - geneve: make sure to pull inner header in geneve_rx()
     - ice: virtchnl: stop pretending to support RSS over AQ or registers
     - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
     - igc: avoid returning frame twice in XDP_REDIRECT
     - net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
     - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
     - net: dsa: microchip: fix register write order in ksz8_ind_write8()
     - net/rds: fix WARNING in rds_conn_connect_if_down
     - netfilter: nft_ct: fix l3num expectations with inet pseudo family
     - netfilter: nf_conntrack_h323: Add protection for bmp length out of range
     - erofs: apply proper VMA alignment for memory mapped files on THP
     - netrom: Fix a data-race around sysctl_netrom_default_path_quality
     - netrom: Fix a data-race around
       sysctl_netrom_obsolescence_count_initialiser
     - netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
     - netrom: Fix a data-race around sysctl_netrom_transport_timeout
     - netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
     - netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
     - netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
     - netrom: Fix a data-race around
       sysctl_netrom_transport_requested_window_size
     - netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
     - netrom: Fix a data-race around sysctl_netrom_routing_control
     - netrom: Fix a data-race around sysctl_netrom_link_fails_count
     - netrom: Fix data-races around sysctl_net_busy_read
     - [s390x] KVM: s390: add stat counter for shadow gmap events
     - [s390x] KVM: s390: vsie: fix race during shadow creation
     - drm/amd/display: Fix uninitialized variable usage in core_link_
       'read_dpcd() & write_dpcd()' functions
     - nfp: flower: add goto_chain_index for ct entry
     - nfp: flower: add hardware offload check for post ct entry
     - readahead: avoid multiple marked readahead pages
     - xhci: process isoc TD properly when there was a transaction error mid TD.
     - xhci: handle isoc Babble and Buffer Overrun events properly
     - drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
     - [x86] Mitigate Register File Data Sampling (RFDS) vulnerability
       (CVE-2023-28746):
       + [x86] mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set
       + Documentation/hw-vuln: Add documentation for RFDS
       + [x86] rfds: Mitigate Register File Data Sampling (RFDS)
       + [x86] KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests
     - drm/amd/display: Wrong colorimetry workaround
     - drm/amd/display: Fix MST Null Ptr for RV
     - getrusage: add the "signal_struct *sig" local variable
     - getrusage: move thread_group_cputime_adjusted() outside of
       lock_task_sighand()
     - getrusage: use __for_each_thread()
     - getrusage: use sig->stats_lock rather than lock_task_sighand()
     - fs/proc: do_task_stat: use __for_each_thread()
     - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children
       stats
 .
   [ Salvatore Bonaccorso ]
   * Bump ABI to 19
   * [rt] Refresh "sched: avoid false lockdep splat in put_task_struct()"
   * Drop now unknown config options for retired CBQ, ATM and dsmark qdisc
   * [x86] efistub: Clear decompressor BSS in native EFI entrypoint
   * [x86] efistub: Don't clear BSS twice in mixed mode
   * efi: fix panic in kdump kernel
   * efi/libstub: fix efi_random_alloc() to allocate memory at alloc_min or
     higher address
   * efi/libstub: Cast away type warning in use of max()
   * aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
     (CVE-2023-6270)
   * wifi: ath10k: fix NULL pointer dereference in
     ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (CVE-2023-7042)
   * Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
     (CVE-2024-22099)
   * sr9800: Add check for usbnet_get_endpoints (CVE-2024-26651)
   * [rt] Update to 6.1.82-rt27
Checksums-Sha1:
 5b1e7775fb625af2660492674a3fba03dc4f95d7 313386 linux_6.1.90-1~bpo11+1.dsc
 954ea89e05e9279ad27d87884727059eaa1d3b89 137614748 linux_6.1.90.orig.tar.xz
 d151d313eec2ae348c468f2723dd5888a4b162aa 1633240 linux_6.1.90-1~bpo11+1.debian.tar.xz
 eb52807bb7fdb30f25857b9b6e57c717c6c748f0 6240 linux_6.1.90-1~bpo11+1_source.buildinfo
Checksums-Sha256:
 f50e526312f9554f7f0b6fbc020fcaab2f75b75238246e85e2cb4df81b04798b 313386 linux_6.1.90-1~bpo11+1.dsc
 74d8a50f82232eea2e4f3c017c307a4eee0bea10f0727aa3ef1cb866034f44ba 137614748 linux_6.1.90.orig.tar.xz
 dfe21926d74cabab14ddb747633646684a8a1d6f001c945423f7d4ebc50f34a4 1633240 linux_6.1.90-1~bpo11+1.debian.tar.xz
 46f1594c89b440079ae8fc5097aa2fd1223fff640d902961050680e6e720e524 6240 linux_6.1.90-1~bpo11+1_source.buildinfo
Files:
 d1ef71f1287061d58c693a6a95042259 313386 kernel optional linux_6.1.90-1~bpo11+1.dsc
 9fa5818eef2eca61a4af0f302f177c2b 137614748 kernel optional linux_6.1.90.orig.tar.xz
 c2cbfd549228a9054da9bf19f10b6527 1633240 kernel optional linux_6.1.90-1~bpo11+1.debian.tar.xz
 c1539a33d3b9b200793d062301d4eaac 6240 kernel optional linux_6.1.90-1~bpo11+1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmY5MXMACgkQ57/I7JWG
EQmlWxAA1PKVpkDbSrpB95zL2QToIK+ifBzsYD86jceTK6tsbT8MA8YwqzI4L4pf
2zTD3umX5kvavkqBqv3pdoJcKv89GYX5xzWQRAs4zJbMOd/mfFzl+QBaU1CWXfBe
MVM2UNoD4vIh2RKKKmVcAMA+fLh2wDXliwc+7rCXbLKiu/CRZ5C3lqND+jiTuPb6
uPvgjcmpPxq+L3n98k0pzmcp8mVrP9M8ZYU6O1fgb010kpB8JlbYZmMBBE8FNUdj
Ftj/vXpQRxT5ULnxXfGKpJ72c76jKd9Ebj8X3QamBREEako+gNTyjMiEuVP4YVsu
AF/94V7s8mABtT6XJqMhfcfaKbEXgal8oKd/nyhE8o+QyrVCN8GDkorHr5zzlxMA
mdh7q+yuXru1nnEVuf/ulTrU2uXbeNqV7DSjGgabd9F7RNxBpgEc3w+nkcLos0ML
quRl7EoymWYrh6HhXLdE/P3jAoFEePbNzYt2UV9Gs4O1FMOBVm4mNXUqlyh8YuGI
3i0q4VO+iGk7lkJwFLtMsAXQxxwGaRhesTNSth8wTmNZUN/p/t3RwMMtcLys5nvB
tEhZoBLa7FNne+uxTxy+J0ekso5qgcukQhJU3RAKnTVMWHwEbCV8egU+MnnC+0Yl
198Kfa/YAEzYxIGgNuthnUA6ElVunHNibzagR1AzcVuG96T3aFc=
=Tnus
-----END PGP SIGNATURE-----