This bug was fixed in the package linux-aws - 5.15.0-1002.4

---------------
linux-aws (5.15.0-1002.4) jammy; urgency=medium

  * jammy/linux-aws: 5.15.0-1002.4 -proposed tracker (LP: #1960330)

  * Miscellaneous Ubuntu changes
    - [Config] aws: toolchain version update
    - [Config] aws: CONFIG_SYSFB_SIMPLEFB=y

  [ Ubuntu: 5.15.0-22.22 ]

  * jammy/linux: 5.15.0-22.22 -proposed tracker (LP: #1960290)

  [ Ubuntu: 5.15.0-21.21 ]

  * jammy/linux: 5.15.0-21.21 -proposed tracker (LP: #1960211)
  * Miscellaneous Ubuntu changes
    - [packaging] unhook lowlatency flavours from the build

  [ Ubuntu: 5.15.0-20.20 ]

  * jammy/linux: 5.15.0-20.20 -proposed tracker (LP: #1959881)
  * Jammy update: v5.15.19 upstream stable release (LP: #1959879)
    - can: m_can: m_can_fifo_{read,write}: don't read or write from/to FIFO if
      length is 0
    - net: sfp: ignore disabled SFP node
    - net: stmmac: configure PTP clock source prior to PTP initialization
    - net: stmmac: skip only stmmac_ptp_register when resume from suspend
    - ARM: 9179/1: uaccess: avoid alignment faults in
      copy_[from|to]_kernel_nofault
    - ARM: 9180/1: Thumb2: align ALT_UP() sections in modules sufficiently
    - KVM: arm64: Use shadow SPSR_EL1 when injecting exceptions on !VHE
    - s390/hypfs: include z/VM guests with access control group set
    - s390/nmi: handle guarded storage validity failures for KVM guests
    - s390/nmi: handle vector validity failures for KVM guests
    - bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()
    - powerpc32/bpf: Fix codegen for bpf-to-bpf calls
    - powerpc/bpf: Update ldimm64 instructions during extra pass
    - scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP
      devices
    - udf: Restore i_lenAlloc when inode expansion fails
    - udf: Fix NULL ptr deref when converting from inline format
    - efi: runtime: avoid EFIv2 runtime services on Apple x86 machines
    - PM: wakeup: simplify the output logic of pm_show_wakelocks()
    - tracing/histogram: Fix a potential memory leak for kstrdup()
    - tracing: Don't inc err_log entry count if entry allocation fails
    - ceph: properly put ceph_string reference after async create attempt
    - ceph: set pool_ns in new inode layout for async creates
    - fsnotify: fix fsnotify hooks in pseudo filesystems
    - Revert "KVM: SVM: avoid infinite loop on NPF from bad address"
    - psi: Fix uaf issue when psi trigger is destroyed while being polled
    - powerpc/audit: Fix syscall_get_arch()
    - perf/x86/intel/uncore: Fix CAS_COUNT_WRITE issue for ICX
    - perf/x86/intel: Add a quirk for the calculation of the number of counters on
      Alder Lake
    - drm/etnaviv: relax submit size limits
    - drm/atomic: Add the crtc to affected crtc only if uapi.enable = true
    - drm/amd/display: Fix FP start/end for dcn30_internal_validate_bw.
    - KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
    - KVM: SVM: Never reject emulation due to SMAP errata for !SEV guests
    - KVM: SVM: Don't intercept #GP for SEV guests
    - KVM: x86: nSVM: skip eax alignment check for non-SVM instructions
    - KVM: x86: Forcibly leave nested virt when SMM state is toggled
    - KVM: x86: Keep MSR_IA32_XSS unchanged for INIT
    - KVM: x86: Update vCPU's runtime CPUID on write to MSR_IA32_XSS
    - KVM: x86: Sync the states size with the XCR0/IA32_XSS at, any time
    - KVM: PPC: Book3S HV Nested: Fix nested HFSCR being clobbered with multiple
      vCPUs
    - dm: revert partial fix for redundant bio-based IO accounting
    - block: add bio_start_io_acct_time() to control start_time
    - dm: properly fix redundant bio-based IO accounting
    - serial: pl011: Fix incorrect rs485 RTS polarity on set_mctrl
    - serial: 8250: of: Fix mapped region size when using reg-offset property
    - serial: stm32: fix software flow control transfer
    - tty: n_gsm: fix SW flow control encoding/handling
    - tty: Partially revert the removal of the Cyclades public API
    - tty: Add support for Brainboxes UC cards.
    - kbuild: remove include/linux/cyclades.h from header file check
    - usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge
    - usb: xhci-plat: fix crash when suspend if remote wake enable
    - usb: common: ulpi: Fix crash in ulpi_match()
    - usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS
    - usb: cdnsp: Fix segmentation fault in cdns_lost_power function
    - usb: dwc3: xilinx: Skip resets and USB3 register settings for USB2.0 mode
    - usb: dwc3: xilinx: Fix error handling when getting USB3 PHY
    - USB: core: Fix hang in usb_kill_urb by adding memory barriers
    - usb: typec: tcpci: don't touch CC line if it's Vconn source
    - usb: typec: tcpm: Do not disconnect while receiving VBUS off
    - usb: typec: tcpm: Do not disconnect when receiving VSAFE0V
    - ucsi_ccg: Check DEV_INT bit only when starting CCG4
    - mm, kasan: use compare-exchange operation to set KASAN page tag
    - jbd2: export jbd2_journal_[grab|put]_journal_head
    - ocfs2: fix a deadlock when commit trans
    - sched/membarrier: Fix membarrier-rseq fence command missing from query
      bitmask
    - PCI/sysfs: Find shadow ROM before static attribute initialization
    - x86/MCE/AMD: Allow thresholding interface updates after init
    - x86/cpu: Add Xeon Icelake-D to list of CPUs that support PPIN
    - powerpc/32s: Allocate one 256k IBAT instead of two consecutives 128k IBATs
    - powerpc/32s: Fix kasan_init_region() for KASAN
    - powerpc/32: Fix boot failure with GCC latent entropy plugin
    - i40e: Increase delay to 1 s after global EMP reset
    - i40e: Fix issue when maximum queues is exceeded
    - i40e: Fix queues reservation for XDP
    - i40e: Fix for failed to init adminq while VF reset
    - i40e: fix unsigned stat widths
    - usb: roles: fix include/linux/usb/role.h compile issue
    - rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
    - rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev
    - scsi: elx: efct: Don't use GFP_KERNEL under spin lock
    - scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()
    - ipv6_tunnel: Rate limit warning messages
    - ARM: 9170/1: fix panic when kasan and kprobe are enabled
    - net: fix information leakage in /proc/net/ptype
    - hwmon: (lm90) Mark alert as broken for MAX6646/6647/6649
    - hwmon: (lm90) Mark alert as broken for MAX6680
    - ping: fix the sk_bound_dev_if match in ping_lookup
    - ipv4: avoid using shared IP generator for connected sockets
    - hwmon: (lm90) Reduce maximum conversion rate for G781
    - NFSv4: Handle case where the lookup of a directory fails
    - NFSv4: nfs_atomic_open() can race when looking up a non-regular file
    - net-procfs: show net devices bound packet types
    - drm/msm: Fix wrong size calculation
    - drm/msm/dsi: Fix missing put_device() call in dsi_get_phy
    - drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable
    - ipv6: annotate accesses to fn->fn_sernum
    - NFS: Ensure the server has an up to date ctime before hardlinking
    - NFS: Ensure the server has an up to date ctime before renaming
    - KVM: arm64: pkvm: Use the mm_ops indirection for cache maintenance
    - SUNRPC: Use BIT() macro in rpc_show_xprt_state()
    - SUNRPC: Don't dereference xprt->snd_task if it's a cookie
    - powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06
    - netfilter: conntrack: don't increment invalid counter on NF_REPEAT
    - powerpc/64s: Mask SRR0 before checking against the masked NIP
    - perf: Fix perf_event_read_local() time
    - sched/pelt: Relax the sync of util_sum with util_avg
    - net: phy: broadcom: hook up soft_reset for BCM54616S
    - net: stmmac: dwmac-visconti: Fix bit definitions for ETHER_CLK_SEL
    - net: stmmac: dwmac-visconti: Fix clock configuration for RMII mode
    - phylib: fix potential use-after-free
    - octeontx2-af: Do not fixup all VF action entries
    - octeontx2-af: Fix LBK backpressure id count
    - octeontx2-af: Retry until RVU block reset complete
    - octeontx2-pf: cn10k: Ensure valid pointers are freed to aura
    - octeontx2-af: verify CQ context updates
    - octeontx2-af: Increase link credit restore polling timeout
    - octeontx2-af: cn10k: Do not enable RPM loopback for LPC interfaces
    - octeontx2-pf: Forward error codes to VF
    - rxrpc: Adjust retransmission backoff
    - efi/libstub: arm64: Fix image check alignment at entry
    - io_uring: fix bug in slow unregistering of nodes
    - Drivers: hv: balloon: account for vmbus packet header in max_pkt_size
    - hwmon: (lm90) Re-enable interrupts after alert clears
    - hwmon: (lm90) Mark alert as broken for MAX6654
    - hwmon: (lm90) Fix sysfs and udev notifications
    - hwmon: (adt7470) Prevent divide by zero in adt7470_fan_write()
    - powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if
      PMI is pending
    - ipv4: fix ip option filtering for locally generated fragments
    - ibmvnic: Allow extra failures before disabling
    - ibmvnic: init ->running_cap_crqs early
    - ibmvnic: don't spin in tasklet
    - net/smc: Transitional solution for clcsock race issue
    - video: hyperv_fb: Fix validation of screen resolution
    - can: tcan4x5x: regmap: fix max register value
    - drm/msm/hdmi: Fix missing put_device() call in msm_hdmi_get_phy
    - drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc
    - drm/msm/a6xx: Add missing suspend_count increment
    - yam: fix a memory leak in yam_siocdevprivate()
    - net: cpsw: Properly initialise struct page_pool_params
    - net: hns3: handle empty unknown interrupt for VF
    - sch_htb: Fail on unsupported parameters when offload is requested
    - Revert "drm/ast: Support 1600x900 with 108MHz PCLK"
    - KVM: selftests: Don't skip L2's VMCALL in SMM test for SVM guest
    - ceph: put the requests/sessions when it fails to alloc memory
    - gve: Fix GFP flags when allocing pages
    - Revert "ipv6: Honor all IPv6 PIO Valid Lifetime values"
    - net: bridge: vlan: fix single net device option dumping
    - ipv4: raw: lock the socket in raw_bind()
    - ipv4: tcp: send zero IPID in SYNACK messages
    - ipv4: remove sparse error in ip_neigh_gw4()
    - net: bridge: vlan: fix memory leak in __allowed_ingress
    - Bluetooth: refactor malicious adv data check
    - irqchip/realtek-rtl: Map control data to virq
    - irqchip/realtek-rtl: Fix off-by-one in routing
    - dt-bindings: can: tcan4x5x: fix mram-cfg RX FIFO config
    - perf/core: Fix cgroup event list management
    - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n
    - psi: fix "defined but not used" warnings when CONFIG_PROC_FS=n
    - usb: dwc3: xilinx: fix uninitialized return value
    - usr/include/Makefile: add linux/nfc.h to the compile-test coverage
    - fsnotify: invalidate dcache before IN_DELETE event
    - block: Fix wrong offset in bio_truncate()
    - mtd: rawnand: mpc5121: Remove unused variable in ads5121_select_chip()
    - Linux 5.15.19
  * Jammy update: v5.15.18 upstream stable release (LP: #1959878)
    - drm/i915: Flush TLBs before releasing backing store
    - drm/amd/display: reset dcn31 SMU mailbox on failures
    - io_uring: fix not released cached task refs
    - bnx2x: Utilize firmware 7.13.21.0
    - bnx2x: Invalidate fastpath HSI version for VFs
    - memcg: flush stats only if updated
    - memcg: unify memcg stat flushing
    - memcg: better bounds on the memcg stats updates
    - rcu: Tighten rcu_advance_cbs_nowake() checks
    - select: Fix indefinitely sleeping task in poll_schedule_timeout()
    - drm/amdgpu: Use correct VIEWPORT_DIMENSION for DCN2
    - arm64/bpf: Remove 128MB limit for BPF JIT programs
    - Linux 5.15.18
  * CVE-2022-22942
    - SAUCE: drm/vmwgfx: Fix stale file descriptors on failed usercopy
  * CVE-2022-24122
    - ucount: Make get_ucount a safe get_user replacement
  * CVE-2022-23222
    - bpf, selftests: Add verifier test for mem_or_null register with offset.
  * Miscellaneous Ubuntu changes
    - [Config] toolchain version update
  * Miscellaneous upstream changes
    - s390/module: fix loading modules with a lot of relocations

  [ Ubuntu: 5.15.0-19.19 ]

  * jammy/linux: 5.15.0-19.19 -proposed tracker (LP: #1959418)
  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/master)
  * Jammy update: v5.15.17 upstream stable release (LP: #1959376)
    - KVM: x86/mmu: Fix write-protection of PTs mapped by the TDP MMU
    - KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock
    - HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100
    - HID: uhid: Fix worker destroying device without any protection
    - HID: wacom: Reset expected and received contact counts at the same time
    - HID: wacom: Ignore the confidence flag when a touch is removed
    - HID: wacom: Avoid using stale array indicies to read contact count
    - ALSA: core: Fix SSID quirk lookup for subvendor=0
    - f2fs: fix to do sanity check on inode type during garbage collection
    - f2fs: fix to do sanity check in is_alive()
    - f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file
    - nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed
      bind()
    - mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
    - mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6
    - mtd: Fixed breaking list in __mtd_del_partition.
    - mtd: rawnand: davinci: Don't calculate ECC when reading page
    - mtd: rawnand: davinci: Avoid duplicated page read
    - mtd: rawnand: davinci: Rewrite function description
    - mtd: rawnand: Export nand_read_page_hwecc_oob_first()
    - mtd: rawnand: ingenic: JZ4740 needs 'oob_first' read page function
    - riscv: Get rid of MAXPHYSMEM configs
    - RISC-V: Use common riscv_cpuid_to_hartid_mask() for both SMP=y and SMP=n
    - riscv: try to allocate crashkern region from 32bit addressible memory
    - riscv: Don't use va_pa_offset on kdump
    - riscv: use hart id instead of cpu id on machine_kexec
    - riscv: mm: fix wrong phys_ram_base value for RV64
    - x86/gpu: Reserve stolen memory for first integrated Intel GPU
    - tools/nolibc: x86-64: Fix startup code bug
    - crypto: x86/aesni - don't require alignment of data
    - tools/nolibc: i386: fix initial stack alignment
    - tools/nolibc: fix incorrect truncation of exit code
    - rtc: cmos: take rtc_lock while reading from CMOS
    - net: phy: marvell: add Marvell specific PHY loopback
    - ksmbd: uninitialized variable in create_socket()
    - ksmbd: fix guest connection failure with nautilus
    - ksmbd: add support for smb2 max credit parameter
    - ksmbd: move credit charge deduction under processing request
    - ksmbd: limits exceeding the maximum allowable outstanding requests
    - ksmbd: add reserved room in ipc request/response
    - media: cec: fix a deadlock situation
    - media: ov8865: Disable only enabled regulators on error path
    - media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE
    - media: flexcop-usb: fix control-message timeouts
    - media: mceusb: fix control-message timeouts
    - media: em28xx: fix control-message timeouts
    - media: cpia2: fix control-message timeouts
    - media: s2255: fix control-message timeouts
    - media: dib0700: fix undefined behavior in tuner shutdown
    - media: redrat3: fix control-message timeouts
    - media: pvrusb2: fix control-message timeouts
    - media: stk1160: fix control-message timeouts
    - media: cec-pin: fix interrupt en/disable handling
    - can: softing_cs: softingcs_probe(): fix memleak on registration failure
    - mei: hbm: fix client dma reply status
    - iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs
    - iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046
    - lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()
    - bus: mhi: pci_generic: Graceful shutdown on freeze
    - bus: mhi: core: Fix reading wake_capable channel configuration
    - bus: mhi: core: Fix race while handling SYS_ERR at power up
    - cxl/pmem: Fix reference counting for delayed work
    - arm64: errata: Fix exec handling in erratum 1418040 workaround
    - ARM: dts: at91: update alternate function of signal PD20
    - iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
    - gpu: host1x: Add back arm_iommu_detach_device()
    - drm/tegra: Add back arm_iommu_detach_device()
    - virtio/virtio_mem: handle a possible NULL as a memcpy parameter
    - dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
    - PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
    - mm_zone: add function to check if managed dma zone exists
    - dma/pool: create dma atomic pool only if dma zone has managed pages
    - mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed
      pages
    - shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
    - drm/ttm: Put BO in its memory manager's lru list
    - Bluetooth: L2CAP: Fix not initializing sk_peer_pid
    - drm/bridge: display-connector: fix an uninitialized pointer in probe()
    - drm: fix null-ptr-deref in drm_dev_init_release()
    - drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure
    - drm/panel: innolux-p079zca: Delete panel on attach() failure
    - drm/rockchip: dsi: Fix unbalanced clock on probe error
    - drm/rockchip: dsi: Hold pm-runtime across bind/unbind
    - drm/rockchip: dsi: Disable PLL clock on bind error
    - drm/rockchip: dsi: Reconfigure hardware on resume()
    - Bluetooth: virtio_bt: fix memory leak in virtbt_rx_handle()
    - Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
    - clk: bcm-2835: Pick the closest clock rate
    - clk: bcm-2835: Remove rounding up the dividers
    - drm/vc4: hdmi: Set a default HSM rate
    - drm/vc4: hdmi: Move the HSM clock enable to runtime_pm
    - drm/vc4: hdmi: Make sure the controller is powered in detect
    - drm/vc4: hdmi: Make sure the controller is powered up during bind
    - drm/vc4: hdmi: Rework the pre_crtc_configure error handling
    - drm/vc4: crtc: Make sure the HDMI controller is powered when disabling
    - wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan
    - wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
    - drm/vc4: hdmi: Enable the scrambler on reconnection
    - libbpf: Free up resources used by inner map definition
    - wcn36xx: Fix DMA channel enable/disable cycle
    - wcn36xx: Release DMA channel descriptor allocations
    - wcn36xx: Put DXE block into reset before freeing memory
    - wcn36xx: populate band before determining rate on RX
    - wcn36xx: fix RX BD rate mapping for 5GHz legacy rates
    - ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware
    - bpftool: Fix memory leak in prog_dump()
    - mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init()
    - media: videobuf2: Fix the size printk format
    - media: atomisp: add missing media_device_cleanup() in
      atomisp_unregister_entities()
    - media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case
    - media: atomisp: fix inverted logic in buffers_needed()
    - media: atomisp: do not use err var when checking port validity for ISP2400
    - media: atomisp: fix inverted error check for
      ia_css_mipi_is_source_port_valid()
    - media: atomisp: fix ifdefs in sh_css.c
    - media: atomisp: add NULL check for asd obtained from atomisp_video_pipe
    - media: atomisp: fix enum formats logic
    - media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr()
    - media: aspeed: fix mode-detect always time out at 2nd run
    - media: em28xx: fix memory leak in em28xx_init_dev
    - media: aspeed: Update signal status immediately to ensure sane hw state
    - arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name
    - arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+
    - arm64: dts: meson-gxbb-wetek: fix HDMI in early boot
    - arm64: dts: meson-gxbb-wetek: fix missing GPIO binding
    - fs: dlm: don't call kernel_getpeername() in error_report()
    - memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails
    - Bluetooth: stop proccessing malicious adv data
    - ath11k: Fix ETSI regd with weather radar overlap
    - ath11k: clear the keys properly via DISABLE_KEY
    - ath11k: reset RSN/WPA present state for open BSS
    - spi: hisi-kunpeng: Fix the debugfs directory name incorrect
    - tee: fix put order in teedev_close_context()
    - fs: dlm: fix build with CONFIG_IPV6 disabled
    - drm/dp: Don't read back backlight mode in drm_edp_backlight_enable()
    - drm/vboxvideo: fix a NULL vs IS_ERR() check
    - arm64: dts: renesas: cat875: Add rx/tx delays
    - media: dmxdev: fix UAF when dvb_register_device() fails
    - crypto: atmel-aes - Reestablish the correct tfm context at dequeue
    - crypto: qce - fix uaf on qce_aead_register_one
    - crypto: qce - fix uaf on qce_ahash_register_one
    - crypto: qce - fix uaf on qce_skcipher_register_one
    - arm64: dts: qcom: sc7280: Fix incorrect clock name
    - mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove
    - cpufreq: qcom-cpufreq-hw: Update offline CPUs per-cpu thermal pressure
    - cpufreq: qcom-hw: Fix probable nested interrupt handling
    - ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429
      disco
    - libbpf: Fix potential misaligned memory access in btf_ext__new()
    - libbpf: Fix glob_syms memory leak in bpf_linker
    - libbpf: Fix using invalidated memory in bpf_linker
    - crypto: qat - remove unnecessary collision prevention step in PFVF
    - crypto: qat - make pfvf send message direction agnostic
    - crypto: qat - fix undetected PFVF timeout in ACK loop
    - ath11k: Use host CE parameters for CE interrupts configuration
    - arm64: dts: ti: k3-j721e: correct cache-sets info
    - tty: serial: atmel: Check return code of dmaengine_submit()
    - tty: serial: atmel: Call dma_async_issue_pending()
    - mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP
    - mfd: atmel-flexcom: Use .resume_noirq
    - bfq: Do not let waker requests skip proper accounting
    - libbpf: Silence uninitialized warning/error in btf_dump_dump_type_data
    - media: i2c: imx274: fix s_frame_interval runtime resume not requested
    - media: i2c: Re-order runtime pm initialisation
    - media: i2c: ov8865: Fix lockdep error
    - media: rcar-csi2: Correct the selection of hsfreqrange
    - media: imx-pxp: Initialize the spinlock prior to using it
    - media: si470x-i2c: fix possible memory leak in si470x_i2c_probe()
    - media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
    - media: hantro: Hook up RK3399 JPEG encoder output
    - media: coda: fix CODA960 JPEG encoder buffer overflow
    - media: venus: correct low power frequency calculation for encoder
    - media: venus: core: Fix a potential NULL pointer dereference in an error
      handling path
    - media: venus: core: Fix a resource leak in the error handling path of
      'venus_probe()'
    - net: stmmac: Add platform level debug register dump feature
    - thermal/drivers/imx: Implement runtime PM support
    - igc: AF_XDP zero-copy metadata adjust breaks SKBs on XDP_PASS
    - netfilter: bridge: add support for pppoe filtering
    - powerpc: Avoid discarding flags in system_call_exception()
    - arm64: dts: qcom: msm8916: fix MMC controller aliases
    - drm/vmwgfx: Remove the deprecated lower mem limit
    - drm/vmwgfx: Fail to initialize on broken configs
    - cgroup: Trace event cgroup id fields should be u64
    - ACPI: EC: Rework flushing of EC work while suspended to idle
    - thermal/drivers/imx8mm: Enable ADC when enabling monitor
    - drm/amdgpu: Fix a NULL pointer dereference in
      amdgpu_connector_lcd_native_mode()
    - drm/radeon/radeon_kms: Fix a NULL pointer dereference in
      radeon_driver_open_kms()
    - libbpf: Clean gen_loader's attach kind.
    - crypto: caam - save caam memory to support crypto engine retry mechanism.
    - arm64: dts: ti: k3-am642: Fix the L2 cache sets
    - arm64: dts: ti: k3-j7200: Fix the L2 cache sets
    - arm64: dts: ti: k3-j721e: Fix the L2 cache sets
    - arm64: dts: ti: k3-j7200: Correct the d-cache-sets info
    - tty: serial: uartlite: allow 64 bit address
    - serial: amba-pl011: do not request memory region twice
    - mtd: core: provide unique name for nvmem device
    - floppy: Fix hang in watchdog when disk is ejected
    - staging: rtl8192e: return error code from rtllib_softmac_init()
    - staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib()
    - Bluetooth: btmtksdio: fix resume failure
    - bpf: Fix the test_task_vma selftest to support output shorter than 1 kB
    - sched/fair: Fix detection of per-CPU kthreads waking a task
    - sched/fair: Fix per-CPU kthread and wakee stacking for asym CPU capacity
    - bpf: Adjust BTF log size limit.
    - bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD)
    - bpf: Remove config check to enable bpf support for branch records
    - arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1
    - arm64: mte: DC {GVA,GZVA} shouldn't be used when DCZID_EL0.DZP == 1
    - samples/bpf: Install libbpf headers when building
    - samples/bpf: Clean up samples/bpf build failes
    - samples: bpf: Fix xdp_sample_user.o linking with Clang
    - samples: bpf: Fix 'unknown warning group' build warning on Clang
    - media: dib8000: Fix a memleak in dib8000_init()
    - media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
    - media: si2157: Fix "warm" tuner state detection
    - wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma
    - sched/rt: Try to restart rt period timer when rt runtime exceeded
    - ath10k: Fix the MTU size on QCA9377 SDIO
    - Bluetooth: refactor set_exp_feature with a feature table
    - Bluetooth: MGMT: Use hci_dev_test_and_{set,clear}_flag
    - drm/amd/display: Fix bug in debugfs crc_win_update entry
    - drm/msm/gpu: Don't allow zero fence_id
    - drm/msm/dp: displayPort driver need algorithm rational
    - rcu/exp: Mark current CPU as exp-QS in IPI loop second pass
    - wcn36xx: Fix max channels retrieval
    - drm/msm/dsi: fix initialization in the bonded DSI case
    - mwifiex: Fix possible ABBA deadlock
    - xfrm: fix a small bug in xfrm_sa_len()
    - x86/uaccess: Move variable into switch case statement
    - selftests: clone3: clone3: add case CLONE3_ARGS_NO_TEST
    - selftests: harness: avoid false negatives if test has no ASSERTs
    - crypto: stm32/cryp - fix CTR counter carry
    - crypto: stm32/cryp - fix xts and race condition in crypto_engine requests
    - crypto: stm32/cryp - check early input data
    - crypto: stm32/cryp - fix double pm exit
    - crypto: stm32/cryp - fix lrw chaining mode
    - crypto: stm32/cryp - fix bugs and crash in tests
    - crypto: stm32 - Revert broken pm_runtime_resume_and_get changes
    - crypto: hisilicon/qm - fix incorrect return value of hisi_qm_resume()
    - ath11k: Fix deleting uninitialized kernel timer during fragment cache flush
    - spi: Fix incorrect cs_setup delay handling
    - ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors
    - perf/arm-cmn: Fix CPU hotplug unregistration
    - media: dw2102: Fix use after free
    - media: msi001: fix possible null-ptr-deref in msi001_probe()
    - media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes
    - ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan()
    - net: dsa: hellcreek: Fix insertion of static FDB entries
    - net: dsa: hellcreek: Add STP forwarding rule
    - net: dsa: hellcreek: Allow PTP P2P measurements on blocked ports
    - net: dsa: hellcreek: Add missing PTP via UDP rules
    - arm64: dts: qcom: c630: Fix soundcard setup
    - arm64: dts: qcom: ipq6018: Fix gpio-ranges property
    - drm/msm/dpu: fix safe status debugfs file
    - drm/bridge: ti-sn65dsi86: Set max register for regmap
    - gpu: host1x: select CONFIG_DMA_SHARED_BUFFER
    - drm/tegra: gr2d: Explicitly control module reset
    - drm/tegra: vic: Fix DMA API misuse
    - media: hantro: Fix probe func error path
    - xfrm: interface with if_id 0 should return error
    - xfrm: state and policy should fail if XFRMA_IF_ID 0
    - ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding
    - usb: ftdi-elan: fix memory leak on device disconnect
    - arm64: dts: marvell: cn9130: add GPIO and SPI aliases
    - arm64: dts: marvell: cn9130: enable CP0 GPIO controllers
    - ARM: dts: armada-38x: Add generic compatible to UART nodes
    - mt76: mt7921: drop offload_flags overwritten
    - wilc1000: fix double free error in probe()
    - rtw88: add quirk to disable pci caps on HP 250 G7 Notebook PC
    - iwlwifi: mvm: fix 32-bit build in FTM
    - iwlwifi: mvm: test roc running status bits before removing the sta
    - iwlwifi: mvm: perform 6GHz passive scan after suspend
    - iwlwifi: mvm: set protected flag only for NDP ranging
    - mmc: meson-mx-sdhc: add IRQ check
    - mmc: meson-mx-sdio: add IRQ check
    - block: fix error unwinding in device_add_disk
    - selinux: fix potential memleak in selinux_add_opt()
    - um: fix ndelay/udelay defines
    - um: rename set_signals() to um_set_signals()
    - um: virt-pci: Fix 32-bit compile
    - lib/logic_iomem: Fix 32-bit build
    - lib/logic_iomem: Fix operation on 32-bit
    - um: virtio_uml: Fix time-travel external time propagation
    - Bluetooth: L2CAP: Fix using wrong mode
    - bpftool: Enable line buffering for stdout
    - backlight: qcom-wled: Validate enabled string indices in DT
    - backlight: qcom-wled: Pass number of elements to read to read_u32_array
    - backlight: qcom-wled: Fix off-by-one maximum with default num_strings
    - backlight: qcom-wled: Override default length with qcom,enabled-strings
    - backlight: qcom-wled: Use cpu_to_le16 macro to perform conversion
    - backlight: qcom-wled: Respect enabled-strings in set_brightness
    - software node: fix wrong node passed to find nargs_prop
    - Bluetooth: hci_qca: Stop IBS timer during BT OFF
    - x86/boot/compressed: Move CLANG_FLAGS to beginning of KBUILD_CFLAGS
    - crypto: octeontx2 - prevent underflow in get_cores_bmap()
    - regulator: qcom-labibb: OCP interrupts are not a failure while disabled
    - hwmon: (mr75203) fix wrong power-up delay value
    - x86/mce/inject: Avoid out-of-bounds write when setting flags
    - io_uring: remove double poll on poll update
    - serial: 8250_bcm7271: Propagate error codes from brcmuart_probe()
    - ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes
    - pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in
      __nonstatic_find_io_region()
    - pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in
      nonstatic_find_mem_region()
    - power: reset: mt6397: Check for null res pointer
    - net/xfrm: IPsec tunnel mode fix inner_ipproto setting in sec_path
    - net: ethernet: mtk_eth_soc: fix return values and refactor MDIO ops
    - net: dsa: fix incorrect function pointer check for MRP ring roles
    - netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
    - bpf, sockmap: Fix return codes from tcp_bpf_recvmsg_parser()
    - bpf, sockmap: Fix double bpf_prog_put on error case in map_link
    - bpf: Don't promote bogus looking registers after null check.
    - bpf: Fix verifier support for validation of async callbacks
    - bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt().
    - netfilter: nft_payload: do not update layer 4 checksum when mangling
      fragments
    - netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone
    - net: fix SOF_TIMESTAMPING_BIND_PHC to work with multiple sockets
    - ppp: ensure minimum packet size in ppp_write()
    - rocker: fix a sleeping in atomic bug
    - staging: greybus: audio: Check null pointer
    - fsl/fman: Check for null pointer after calling devm_ioremap
    - Bluetooth: hci_bcm: Check for error irq
    - Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe
    - net/smc: Reset conn->lgr when link group registration fails
    - usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe
    - usb: dwc2: do not gate off the hardware if it does not support clock gating
    - usb: dwc2: gadget: initialize max_speed from params
    - usb: gadget: u_audio: Subdevice 0 for capture ctls
    - HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init
    - HID: hid-uclogic-params: Invalid parameter check in
      uclogic_params_get_str_desc
    - HID: hid-uclogic-params: Invalid parameter check in
      uclogic_params_huion_init
    - HID: hid-uclogic-params: Invalid parameter check in
      uclogic_params_frame_init_v1_buttonpad
    - debugfs: lockdown: Allow reading debugfs files that are not world readable
    - drivers/firmware: Add missing platform_device_put() in sysfb_create_simplefb
    - serial: liteuart: fix MODULE_ALIAS
    - serial: stm32: move tx dma terminate DMA to shutdown
    - x86, sched: Fix undefined reference to init_freq_invariance_cppc() build
      error
    - net/mlx5e: Fix page DMA map/unmap attributes
    - net/mlx5e: Fix wrong usage of fib_info_nh when routes with nexthop objects
      are used
    - net/mlx5e: Don't block routes with nexthop objects in SW
    - Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels"
    - Revert "net/mlx5e: Block offload of outer header csum for GRE tunnel"
    - net/mlx5e: Fix matching on modified inner ip_ecn bits
    - net/mlx5: Fix access to sf_dev_table on allocation failure
    - net/mlx5e: Sync VXLAN udp ports during uplink representor profile change
    - net/mlx5: Set command entry semaphore up once got index free
    - lib/mpi: Add the return value check of kcalloc()
    - Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()
    - mptcp: fix per socket endpoint accounting
    - mptcp: fix opt size when sending DSS + MP_FAIL
    - mptcp: fix a DSS option writing error
    - spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
    - octeontx2-af: Increment ptp refcount before use
    - ax25: uninitialized variable in ax25_setsockopt()
    - netrom: fix api breakage in nr_setsockopt()
    - regmap: Call regmap_debugfs_exit() prior to _init()
    - net: mscc: ocelot: fix incorrect balancing with down LAG ports
    - can: mcp251xfd: add missing newline to printed strings
    - tpm: add request_locality before write TPM_INT_ENABLE
    - tpm_tis: Fix an error handling path in 'tpm_tis_core_init()'
    - can: softing: softing_startstop(): fix set but not used variable warning
    - can: xilinx_can: xcan_probe(): check for error irq
    - can: rcar_canfd: rcar_canfd_channel_probe(): make sure we free CAN network
      device
    - pcmcia: fix setting of kthread task states
    - net/sched: flow_dissector: Fix matching on zone id for invalid conns
    - net: openvswitch: Fix matching zone id for invalid conns arriving from tc
    - net: openvswitch: Fix ct_state nat flags for conns arriving from tc
    - iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing()
    - bnxt_en: Refactor coredump functions
    - bnxt_en: move coredump functions into dedicated file
    - bnxt_en: use firmware provided max timeout for messages
    - net: mcs7830: handle usb read errors properly
    - ext4: avoid trim error on fs with small groups
    - ASoC: Intel: sof_sdw: fix jack detection on HP Spectre x360 convertible
    - ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
    - ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
    - ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
    - ALSA: hda: Fix potential deadlock at codec unbinding
    - RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with
      pending cmd-bit"
    - RDMA/hns: Validate the pkey index
    - scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd()
    - clk: renesas: rzg2l: Check return value of pm_genpd_init()
    - clk: renesas: rzg2l: propagate return value of_genpd_add_provider_simple()
    - clk: imx8mn: Fix imx8mn_clko1_sels
    - powerpc/prom_init: Fix improper check of prom_getprop()
    - ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA
    - ASoC: codecs: wcd938x: add SND_SOC_WCD938_SDW to codec list instead
    - RDMA/rtrs-clt: Fix the initial value of min_latency
    - ALSA: hda: Make proper use of timecounter
    - dt-bindings: thermal: Fix definition of cooling-maps contribution property
    - powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an
      overflown PMC
    - powerpc/modules: Don't WARN on first module allocation attempt
    - powerpc/32s: Fix shift-out-of-bounds in KASAN init
    - clocksource: Avoid accidental unstable marking of clocksources
    - ALSA: oss: fix compile error when OSS_DEBUG is enabled
    - ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID
    - misc: at25: Make driver OF independent again
    - char/mwave: Adjust io port register size
    - binder: fix handling of error during copy
    - binder: avoid potential data leakage when copying txn
    - openrisc: Add clone3 ABI wrapper
    - iommu: Extend mutex lock scope in iommu_probe_device()
    - iommu/io-pgtable-arm: Fix table descriptor paddr formatting
    - scsi: core: Fix scsi_device_max_queue_depth()
    - scsi: ufs: Fix race conditions related to driver data
    - RDMA/qedr: Fix reporting max_{send/recv}_wr attrs
    - PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity()
    - powerpc/powermac: Add additional missing lockdep_register_key()
    - iommu/arm-smmu-qcom: Fix TTBR0 read
    - RDMA/core: Let ib_find_gid() continue search even after empty entry
    - RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry
    - ASoC: rt5663: Handle device_property_read_u32_array error codes
    - of: unittest: fix warning on PowerPC frame size warning
    - of: unittest: 64 bit dma address test requires arch support
    - clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system
      enter shell
    - mips: add SYS_HAS_CPU_MIPS64_R5 config for MIPS Release 5 support
    - mips: fix Kconfig reference to PHYS_ADDR_T_64BIT
    - dmaengine: pxa/mmp: stop referencing config->slave_id
    - iommu/amd: Restore GA log/tail pointer on host resume
    - iommu/amd: X2apic mode: re-enable after resume
    - iommu/amd: X2apic mode: setup the INTX registers on mask/unmask
    - iommu/amd: X2apic mode: mask/unmask interrupts on suspend/resume
    - iommu/amd: Remove useless irq affinity notifier
    - ASoC: Intel: catpt: Test dmaengine_submit() result before moving on
    - iommu/iova: Fix race between FQ timeout and teardown
    - ASoC: mediatek: mt8195: correct default value
    - of: fdt: Aggregate the processing of "linux,usable-memory-range"
    - efi: apply memblock cap after memblock_add()
    - scsi: block: pm: Always set request queue runtime active in
      blk_post_runtime_resume()
    - phy: uniphier-usb3ss: fix unintended writing zeros to PHY register
    - ASoC: mediatek: Check for error clk pointer
    - powerpc/64s: Mask NIP before checking against SRR0
    - powerpc/64s: Use EMIT_WARN_ENTRY for SRR debug warnings
    - phy: cadence: Sierra: Fix to get correct parent for mux clocks
    - ASoC: samsung: idma: Check of ioremap return value
    - misc: lattice-ecp3-config: Fix task hung when firmware load failed
    - ASoC: mediatek: mt8195: correct pcmif BE dai control flow
    - arm64: tegra: Remove non existent Tegra194 reset
    - mips: lantiq: add support for clk_set_parent()
    - mips: bcm63xx: add support for clk_set_parent()
    - powerpc/xive: Add missing null check after calling kmalloc
    - ASoC: fsl_mqs: fix MODULE_ALIAS
    - ALSA: hda/cs8409: Increase delay during jack detection
    - ALSA: hda/cs8409: Fix Jack detection after resume
    - RDMA/cxgb4: Set queue pair state when being queried
    - clk: qcom: gcc-sc7280: Mark gcc_cfg_noc_lpass_clk always enabled
    - ASoC: imx-card: Need special setting for ak4497 on i.MX8MQ
    - ASoC: imx-card: Fix mclk calculation issue for akcodec
    - ASoC: imx-card: improve the sound quality for low rate
    - ASoC: fsl_asrc: refine the check of available clock divider
    - clk: bm1880: remove kfrees on static allocations
    - of: base: Fix phandle argument length mismatch error message
    - of/fdt: Don't worry about non-memory region overlap for no-map
    - MIPS: boot/compressed/: add __ashldi3 to target for ZSTD compression
    - MIPS: compressed: Fix build with ZSTD compression
    - mailbox: fix gce_num of mt8192 driver data
    - ARM: dts: omap3-n900: Fix lp5523 for multi color
    - leds: lp55xx: initialise output direction from dts
    - Bluetooth: Fix debugfs entry leak in hci_register_dev()
    - Bluetooth: Fix memory leak of hci device
    - drm/panel: Delete panel on mipi_dsi_attach() failure
    - Bluetooth: Fix removing adv when processing cmd complete
    - fs: dlm: filter user dlm messages for kernel locks
    - drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y
    - selftests/bpf: Fix memory leaks in btf_type_c_dump() helper
    - selftests/bpf: Destroy XDP link correctly
    - selftests/bpf: Fix bpf_object leak in skb_ctx selftest
    - ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
    - drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR
    - drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR
    - media: atomisp: fix try_fmt logic
    - media: atomisp: set per-device's default mode
    - media: atomisp-ov2680: Fix ov2680_set_fmt() clobbering the exposure
    - media: atomisp: check before deference asd variable
    - ARM: shmobile: rcar-gen2: Add missing of_node_put()
    - batman-adv: allow netlink usage in unprivileged containers
    - media: atomisp: handle errors at sh_css_create_isp_params()
    - ath11k: Fix crash caused by uninitialized TX ring
    - usb: dwc3: meson-g12a: fix shared reset control use
    - USB: ehci_brcm_hub_control: Improve port index sanitizing
    - usb: gadget: f_fs: Use stream_open() for endpoint files
    - psi: Fix PSI_MEM_FULL state when tasks are in memstall and doing reclaim
    - drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L
    - HID: magicmouse: Report battery level over USB
    - HID: apple: Do not reset quirks when the Fn key is not found
    - media: b2c2: Add missing check in flexcop_pci_isr:
    - libbpf: Accommodate DWARF/compiler bug with duplicated structs
    - ethernet: renesas: Use div64_ul instead of do_div
    - EDAC/synopsys: Use the quirk for version instead of ddr version
    - arm64: dts: qcom: sm8350: Shorten camera-thermal-bottom name
    - soc: imx: gpcv2: Synchronously suspend MIX domains
    - ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART
    - drm/amd/display: check top_pipe_to_program pointer
    - drm/amdgpu/display: set vblank_disable_immediate for DC
    - soc: ti: pruss: fix referenced node in error message
    - mlxsw: pci: Add shutdown method in PCI driver
    - drm/amd/display: add else to avoid double destroy clk_mgr
    - drm/bridge: megachips: Ensure both bridges are probed before registration
    - mxser: keep only !tty test in ISR
    - tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of .shutdown()
    - gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
    - HSI: core: Fix return freed object in hsi_new_client
    - crypto: jitter - consider 32 LSB for APT
    - mwifiex: Fix skb_over_panic in mwifiex_usb_recv()
    - rsi: Fix use-after-free in rsi_rx_done_handler()
    - rsi: Fix out-of-bounds read in rsi_read_pkt()
    - ath11k: Avoid NULL ptr access during mgmt tx cleanup
    - media: venus: avoid calling core_clk_setrate() concurrently during
      concurrent video sessions
    - regulator: da9121: Prevent current limit change when enabled
    - drm/vmwgfx: Release ttm memory if probe fails
    - drm/vmwgfx: Introduce a new placement for MOB page tables
    - ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table
    - ACPI: Change acpi_device_always_present() into acpi_device_override_status()
    - ACPI / x86: Allow specifying acpi_device_override_status() quirks by path
    - ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD
      win
    - arm64: dts: ti: j7200-main: Fix 'dtbs_check' serdes_ln_ctrl node
    - arm64: dts: ti: j721e-main: Fix 'dtbs_check' in serdes_ln_ctrl node
    - usb: uhci: add aspeed ast2600 uhci support
    - floppy: Add max size check for user space request
    - x86/mm: Flush global TLB when switching to trampoline page-table
    - drm: rcar-du: Fix CRTC timings when CMM is used
    - media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds.
    - media: rcar-vin: Update format alignment constraints
    - media: saa7146: hexium_orion: Fix a NULL pointer dereference in
      hexium_attach()
    - media: atomisp: fix "variable dereferenced before check 'asd'"
    - media: m920x: don't use stack on USB reads
    - thunderbolt: Runtime PM activate both ends of the device link
    - arm64: dts: renesas: Fix thermal bindings
    - iwlwifi: mvm: synchronize with FW after multicast commands
    - iwlwifi: mvm: avoid clearing a just saved session protection id
    - rcutorture: Avoid soft lockup during cpu stall
    - ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work
    - ath10k: Fix tx hanging
    - net-sysfs: update the queue counts in the unregistration path
    - net: phy: prefer 1000baseT over 1000baseKX
    - gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock
    - gpio: aspeed-sgpio: Convert aspeed_sgpio.lock to raw_spinlock
    - selftests/ftrace: make kprobe profile testcase description unique
    - ath11k: Avoid false DEADLOCK warning reported by lockdep
    - ARM: dts: qcom: sdx55: fix IPA interconnect definitions
    - x86/mce: Allow instrumentation during task work queueing
    - x86/mce: Mark mce_panic() noinstr
    - x86/mce: Mark mce_end() noinstr
    - x86/mce: Mark mce_read_aux() noinstr
    - net: bonding: debug: avoid printing debug logs when bond is not notifying
      peers
    - kunit: Don't crash if no parameters are generated
    - bpf: Do not WARN in bpf_warn_invalid_xdp_action()
    - drm/amdkfd: Fix error handling in svm_range_add
    - HID: quirks: Allow inverting the absolute X/Y values
    - HID: i2c-hid-of: Expose the touchscreen-inverted properties
    - media: igorplugusb: receiver overflow should be reported
    - media: rockchip: rkisp1: use device name for debugfs subdir name
    - media: saa7146: hexium_gemini: Fix a NULL pointer dereference in
      hexium_attach()
    - mmc: tmio: reinit card irqs in reset routine
    - mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO
    - drm/amd/amdgpu: fix psp tmr bo pin count leak in SRIOV
    - drm/amd/amdgpu: fix gmc bo pin count leak in SRIOV
    - audit: ensure userspace is penalized the same as the kernel when under
      pressure
    - arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus
    - arm64: tegra: Adjust length of CCPLEX cluster MMIO region
    - crypto: ccp - Move SEV_INIT retry for corrupted data
    - crypto: hisilicon/hpre - fix memory leak in hpre_curve25519_src_init()
    - PM: runtime: Add safety net to supplier device release
    - cpufreq: Fix initialization of min and max frequency QoS requests
    - mt76: mt7615: fix possible deadlock while mt7615_register_ext_phy()
    - mt76: do not pass the received frame with decryption error
    - mt76: mt7615: improve wmm index allocation
    - ath9k_htc: fix NULL pointer dereference at ath9k_htc_rxep()
    - ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
    - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
    - rtw88: 8822c: update rx settings to prevent potential hw deadlock
    - PM: AVS: qcom-cpr: Use div64_ul instead of do_div
    - iwlwifi: fix leaks/bad data after failed firmware load
    - iwlwifi: remove module loading failure message
    - iwlwifi: mvm: Fix calculation of frame length
    - iwlwifi: mvm: fix AUX ROC removal
    - iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ
    - mmc: sdhci-pci-gli: GL9755: Support for CD/WP inversion on OF platforms
    - block: check minor range in device_add_disk()
    - um: registers: Rename function names to avoid conflicts and build problems
    - ath11k: Fix napi related hang
    - Bluetooth: btintel: Add missing quirks and msft ext for legacy bootloader
    - Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES
    - xfrm: rate limit SA mapping change message to user space
    - drm/etnaviv: consider completed fence seqno in hang check
    - jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
    - ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions
    - ACPICA: Utilities: Avoid deleting the same object twice in a row
    - ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
    - ACPICA: Fix wrong interpretation of PCC address
    - ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5
    - mmc: mtk-sd: Use readl_poll_timeout instead of open-coded polling
    - drm/amdgpu: fixup bad vram size on gmc v8
    - amdgpu/pm: Make sysfs pm attributes as read-only for VFs
    - ACPI: battery: Add the ThinkPad "Not Charging" quirk
    - ACPI: CPPC: Check present CPUs for determining _CPC is valid
    - btrfs: remove BUG_ON() in find_parent_nodes()
    - btrfs: remove BUG_ON(!eie) in find_parent_nodes
    - net: mdio: Demote probed message to debug print
    - mac80211: allow non-standard VHT MCS-10/11
    - dm btree: add a defensive bounds check to insert_at()
    - dm space map common: add bounds check to sm_ll_lookup_bitmap()
    - bpf/selftests: Fix namespace mount setup in tc_redirect
    - mlxsw: pci: Avoid flow control for EMAD packets
    - net: phy: marvell: configure RGMII delays for 88E1118
    - net: gemini: allow any RGMII interface mode
    - regulator: qcom_smd: Align probe function with rpmh-regulator
    - serial: pl010: Drop CR register reset on set_termios
    - serial: pl011: Drop CR register reset on set_termios
    - serial: core: Keep mctrl register state and cached copy in sync
    - random: do not throw away excess input to crng_fast_load
    - net/mlx5: Update log_max_qp value to FW max capability
    - net/mlx5e: Unblock setting vid 0 for VF in case PF isn't eswitch manager
    - parisc: Avoid calling faulthandler_disabled() twice
    - can: flexcan: allow to change quirks at runtime
    - can: flexcan: rename RX modes
    - can: flexcan: add more quirks to describe RX path capabilities
    - x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs
    - powerpc/6xx: add missing of_node_put
    - powerpc/powernv: add missing of_node_put
    - powerpc/cell: add missing of_node_put
    - powerpc/btext: add missing of_node_put
    - powerpc/watchdog: Fix missed watchdog reset due to memory ordering race
    - ASoC: imx-hdmi: add put_device() after of_find_device_by_node()
    - i2c: i801: Don't silently correct invalid transfer size
    - powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING
    - i2c: mpc: Correct I2C reset procedure
    - clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB
    - powerpc/powermac: Add missing lockdep_register_key()
    - KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots
    - KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST
    - w1: Misuse of get_user()/put_user() reported by sparse
    - nvmem: core: set size for sysfs bin file
    - dm: fix alloc_dax error handling in alloc_dev
    - interconnect: qcom: rpm: Prevent integer overflow in rate
    - scsi: ufs: Fix a kernel crash during shutdown
    - scsi: lpfc: Fix leaked lpfc_dmabuf mbox allocations with NPIV
    - scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup
    - ALSA: seq: Set upper limit of processed events
    - MIPS: Loongson64: Use three arguments for slti
    - powerpc/40x: Map 32Mbytes of memory at startup
    - selftests/powerpc/spectre_v2: Return skip code when miss_percent is high
    - powerpc: handle kdump appropriately with crash_kexec_post_notifiers option
    - powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic
    - udf: Fix error handling in udf_new_inode()
    - MIPS: OCTEON: add put_device() after of_find_device_by_node()
    - irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time
    - i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
    - selftests/powerpc: Add a test of sigreturning to the kernel
    - MIPS: Octeon: Fix build errors using clang
    - scsi: sr: Don't use GFP_DMA
    - scsi: mpi3mr: Fixes around reply request queues
    - ASoC: mediatek: mt8192-mt6359: fix device_node leak
    - phy: phy-mtk-tphy: add support efuse setting
    - ASoC: mediatek: mt8173: fix device_node leak
    - ASoC: mediatek: mt8183: fix device_node leak
    - habanalabs: skip read fw errors if dynamic descriptor invalid
    - phy: mediatek: Fix missing check in mtk_mipi_tx_probe
    - mailbox: change mailbox-mpfs compatible string
    - seg6: export get_srh() for ICMP handling
    - icmp: ICMPV6: Examine invoking packet for Segment Route Headers.
    - udp6: Use Segment Routing Header for dest address if present
    - rpmsg: core: Clean up resources on announce_create failure.
    - ifcvf/vDPA: fix misuse virtio-net device config size for blk dev
    - crypto: omap-aes - Fix broken pm_runtime_and_get() usage
    - crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
    - crypto: caam - replace this_cpu_ptr with raw_cpu_ptr
    - ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
    - tpm: fix potential NULL pointer access in tpm_del_char_device
    - tpm: fix NPE on probe for missing device
    - mfd: tps65910: Set PWR_OFF bit during driver probe
    - spi: uniphier: Fix a bug that doesn't point to private data correctly
    - xen/gntdev: fix unmap notification order
    - md: Move alloc/free acct bioset in to personality
    - HID: magicmouse: Fix an error handling path in magicmouse_probe()
    - fuse: Pass correct lend value to filemap_write_and_wait_range()
    - serial: Fix incorrect rs485 polarity on uart open
    - cputime, cpuacct: Include guest time in user time in cpuacct.stat
    - sched/cpuacct: Fix user/system in shown cpuacct.usage*
    - tracing/kprobes: 'nmissed' not showed correctly for kretprobe
    - tracing: Have syscall trace events use trace_event_buffer_lock_reserve()
    - remoteproc: imx_rproc: Fix a resource leak in the remove function
    - iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
    - s390/mm: fix 2KB pgtable release race
    - device property: Fix fwnode_graph_devcon_match() fwnode leak
    - drm/tegra: submit: Add missing pm_runtime_mark_last_busy()
    - drm/etnaviv: limit submit sizes
    - drm/amd/display: Fix the uninitialized variable in enable_stream_features()
    - drm/nouveau/kms/nv04: use vzalloc for nv04_display
    - drm/bridge: analogix_dp: Make PSR-exit block less
    - parisc: Fix lpa and lpa_user defines
    - powerpc/64s/radix: Fix huge vmap false positive
    - scsi: lpfc: Fix lpfc_force_rscn ndlp kref imbalance
    - drm/amdgpu: don't do resets on APUs which don't support it
    - drm/i915/display/ehl: Update voltage swing table
    - PCI: xgene: Fix IB window setup
    - PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors
    - PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only
    - PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space
    - PCI: pci-bridge-emul: Fix definitions of reserved bits
    - PCI: pci-bridge-emul: Correctly set PCIe capabilities
    - PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device
    - xfrm: fix policy lookup for ipv6 gre packets
    - xfrm: fix dflt policy check when there is no policy configured
    - btrfs: fix deadlock between quota enable and other quota operations
    - btrfs: check the root node for uptodate before returning it
    - btrfs: respect the max size in the header when activating swap file
    - ext4: make sure to reset inode lockdep class when quota enabling fails
    - ext4: make sure quota gets properly shutdown on error
    - ext4: fix a possible ABBA deadlock due to busy PA
    - ext4: initialize err_blk before calling __ext4_get_inode_loc
    - ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE
    - ext4: set csum seed in tmp inode while migrating to extents
    - ext4: Fix BUG_ON in ext4_bread when write quota data
    - ext4: use ext4_ext_remove_space() for fast commit replay delete range
    - ext4: fast commit may miss tracking unwritten range during ftruncate
    - ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal
    - ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits'
    - ext4: fix an use-after-free issue about data=journal writeback mode
    - ext4: don't use the orphan list when migrating an inode
    - tracing/osnoise: Properly unhook events if start_per_cpu_kthreads() fails
    - ath11k: qmi: avoid error messages when dma allocation fails
    - drm/radeon: fix error handling in radeon_driver_open_kms
    - of: base: Improve argument length mismatch error
    - firmware: Update Kconfig help text for Google firmware
    - can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message
    - media: rcar-csi2: Optimize the selection PHTW register
    - drm/vc4: hdmi: Make sure the device is powered with CEC
    - media: correct MEDIA_TEST_SUPPORT help text
    - Documentation: coresight: Fix documentation issue
    - Documentation: dmaengine: Correctly describe dmatest with channel unset
    - Documentation: ACPI: Fix data node reference documentation
    - Documentation, arch: Remove leftovers from raw device
    - Documentation, arch: Remove leftovers from CIFS_WEAK_PW_HASH
    - Documentation: refer to config RANDOMIZE_BASE for kernel address-space
      randomization
    - Documentation: fix firewire.rst ABI file path error
    - net: usb: Correct reset handling of smsc95xx
    - Bluetooth: hci_sync: Fix not setting adv set duration
    - scsi: core: Show SCMD_LAST in text form
    - scsi: ufs: ufs-mediatek: Fix error checking in ufs_mtk_init_va09_pwr_ctrl()
    - RDMA/cma: Remove open coding of overflow checking for private_data_len
    - dmaengine: uniphier-xdmac: Fix type of address variables
    - dmaengine: idxd: fix wq settings post wq disable
    - RDMA/hns: Modify the mapping attribute of doorbell to device
    - RDMA/rxe: Fix a typo in opcode name
    - dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK
    - Revert "net/mlx5: Add retry mechanism to the command entry index allocation"
    - powerpc/cell: Fix clang -Wimplicit-fallthrough warning
    - powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses
    - block: fix async_depth sysfs interface for mq-deadline
    - block: Fix fsync always failed if once failed
    - drm/vc4: crtc: Drop feed_txp from state
    - drm/vc4: Fix non-blocking commit getting stuck forever
    - drm/vc4: crtc: Copy assigned channel to the CRTC
    - bpftool: Remove inclusion of utilities.mak from Makefiles
    - bpftool: Fix indent in option lists in the documentation
    - xdp: check prog type before updating BPF link
    - bpf: Fix mount source show for bpffs
    - bpf: Mark PTR_TO_FUNC register initially with zero offset
    - perf evsel: Override attr->sample_period for non-libpfm4 events
    - ipv4: update fib_info_cnt under spinlock protection
    - ipv4: avoid quadratic behavior in netns dismantle
    - mlx5: Don't accidentally set RTO_ONLINK before mlx5e_route_lookup_ipv4_get()
    - net/fsl: xgmac_mdio: Add workaround for erratum A-009885
    - net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module
    - parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
    - riscv: dts: microchip: mpfs: Drop empty chosen node
    - drm/vmwgfx: Remove explicit transparent hugepages support
    - drm/vmwgfx: Remove unused compile options
    - f2fs: fix remove page failed in invalidate compress pages
    - f2fs: fix to avoid panic in is_alive() if metadata is inconsistent
    - f2fs: compress: fix potential deadlock of compress file
    - f2fs: fix to reserve space for IO align feature
    - f2fs: fix to check available space of CP area correctly in
      update_ckpt_flags()
    - crypto: octeontx2 - uninitialized variable in kvf_limits_store()
    - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
    - clk: Emit a stern warning with writable debugfs enabled
    - clk: si5341: Fix clock HW provider cleanup
    - pinctrl/rockchip: fix gpio device creation
    - gpio: mpc8xxx: Fix IRQ check in mpc8xxx_probe
    - gpio: idt3243x: Fix IRQ check in idt_gpio_probe
    - net/smc: Fix hung_task when removing SMC-R devices
    - net: axienet: increase reset timeout
    - net: axienet: Wait for PhyRstCmplt after core reset
    - net: axienet: reset core on initialization prior to MDIO access
    - net: axienet: add missing memory barriers
    - net: axienet: limit minimum TX ring size
    - net: axienet: Fix TX ring slot available check
    - net: axienet: fix number of TX ring slots for available check
    - net: axienet: fix for TX busy handling
    - net: axienet: increase default TX ring size to 128
    - bitops: protect find_first_{,zero}_bit properly
    - um: gitignore: Add kernel/capflags.c
    - HID: vivaldi: fix handling devices not using numbered reports
    - rtc: pxa: fix null pointer dereference
    - vdpa/mlx5: Fix wrong configuration of virtio_version_1_0
    - virtio_ring: mark ring unused on error
    - taskstats: Cleanup the use of task->exit_code
    - inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
    - netns: add schedule point in ops_exit_list()
    - iwlwifi: fix Bz NMI behaviour
    - xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
    - vdpa/mlx5: Restore cur_num_vqs in case of failure in change_num_qps()
    - gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst()
    - libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
    - perf script: Fix hex dump character output
    - dmaengine: at_xdmac: Don't start transactions at tx_submit level
    - dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending
    - dmaengine: at_xdmac: Print debug message after realeasing the lock
    - dmaengine: at_xdmac: Fix concurrency over xfers_list
    - dmaengine: at_xdmac: Fix lld view setting
    - dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
    - perf tools: Drop requirement for libstdc++.so for libopencsd check
    - perf probe: Fix ppc64 'perf probe add events failed' case
    - devlink: Remove misleading internal_flags from health reporter dump
    - arm64: dts: qcom: msm8996: drop not documented adreno properties
    - net: fix sock_timestamping_bind_phc() to release device
    - net: bonding: fix bond_xmit_broadcast return value error bug
    - net: ipa: fix atomic update in ipa_endpoint_replenish()
    - net_sched: restore "mpu xxx" handling
    - net: mscc: ocelot: don't let phylink re-enable TX PAUSE on the NPI port
    - bcmgenet: add WOL IRQ check
    - net: wwan: Fix MRU mismatch issue which may lead to data connection lost
    - net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config()
    - net: ocelot: Fix the call to switchdev_bridge_port_offload
    - net: sfp: fix high power modules without diagnostic monitoring
    - net: cpsw: avoid alignment faults by taking NET_IP_ALIGN into account
    - net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices
    - net: mscc: ocelot: fix using match before it is set
    - dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property
    - dt-bindings: display: meson-vpu: Add missing amlogic,canvas property
    - dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7
    - sch_api: Don't skip qdisc attach on ingress
    - scripts/dtc: dtx_diff: remove broken example from help text
    - lib82596: Fix IRQ check in sni_82596_probe
    - mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault
    - bonding: Fix extraction of ports from the packet headers
    - lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test
    - scripts: sphinx-pre-install: add required ctex dependency
    - scripts: sphinx-pre-install: Fix ctex support on Debian
    - Linux 5.15.17
  * rtw88_8821ce causes freeze (LP: #1927808) // Jammy update: v5.15.17 upstream
    stable release (LP: #1959376)
    - rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE
  * Jammy update: v5.15.16 upstream stable release (LP: #1958977)
    - devtmpfs regression fix: reconfigure on each mount
    - orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()
    - remoteproc: qcom: pil_info: Don't memcpy_toio more than is provided
    - perf: Protect perf_guest_cbs with RCU
    - KVM: x86: Register perf callbacks after calling vendor's hardware_setup()
    - KVM: x86: Register Processor Trace interrupt hook iff PT enabled in guest
    - KVM: x86: don't print when fail to read/write pv eoi memory
    - KVM: s390: Clarify SIGP orders versus STOP/RESTART
    - remoteproc: qcom: pas: Add missing power-domain "mxc" for CDSP
    - 9p: only copy valid iattrs in 9P2000.L setattr implementation
    - video: vga16fb: Only probe for EGA and VGA 16 color graphic cards
    - media: uvcvideo: fix division by zero at stream start
    - rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with
      interrupts enabled
    - firmware: qemu_fw_cfg: fix sysfs information leak
    - firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries
    - firmware: qemu_fw_cfg: fix kobject leak in probe error path
    - perf annotate: Avoid TUI crash when navigating in the annotation of
      recursive functions
    - KVM: x86: remove PMU FIXED_CTR3 from msrs_to_save_all
    - ALSA: hda/realtek: Add speaker fixup for some Yoga 15ITL5 devices
    - ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after
      reboot from Windows
    - ALSA: hda: ALC287: Add Lenovo IdeaPad Slim 9i 14ITL5 speaker quirk
    - ALSA: hda/tegra: Fix Tegra194 HDA reset failure
    - ALSA: hda/realtek: Add quirk for Legion Y9000X 2020
    - ALSA: hda/realtek: Re-order quirk entries for Lenovo
    - mtd: fixup CFI on ixp4xx
    - Linux 5.15.16
  * UBSAN: array-index-out-of-bounds in dcn31_resources on AMD yellow carp
    platform (LP: #1958229)
    - drm/amd/display: Fix out of bounds access on DNC31 stream encoder regs
  * Jammy update: v5.15.15 upstream stable release (LP: #1958418)
    - s390/kexec: handle R_390_PLT32DBL rela in arch_kexec_apply_relocations_add()
    - workqueue: Fix unbind_workers() VS wq_worker_running() race
    - staging: r8188eu: switch the led off during deinit
    - bpf: Fix out of bounds access from invalid *_or_null type verification
    - Bluetooth: btusb: Add protocol for MediaTek bluetooth devices(MT7922)
    - Bluetooth: btusb: Add the new support ID for Realtek RTL8852A
    - Bluetooth: btusb: Add support for IMC Networks Mediatek Chip(MT7921)
    - Bbluetooth: btusb: Add another Bluetooth part for Realtek 8852AE
    - Bluetooth: btusb: fix memory leak in btusb_mtk_submit_wmt_recv_urb()
    - Bluetooth: btusb: enable Mediatek to support AOSP extension
    - Bluetooth: btusb: Add one more Bluetooth part for the Realtek RTL8852AE
    - fget: clarify and improve __fget_files() implementation
    - Bluetooth: btusb: Add two more Bluetooth parts for WCN6855
    - Bluetooth: btusb: Add support for Foxconn MT7922A
    - Bluetooth: btintel: Fix broken LED quirk for legacy ROM devices
    - Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0
    - Bluetooth: bfusb: fix division by zero in send path
    - ARM: dts: exynos: Fix BCM4330 Bluetooth reset polarity in I9100
    - USB: core: Fix bug in resuming hub's handling of wakeup requests
    - USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
    - ath11k: Fix buffer overflow when scanning with extraie
    - mmc: sdhci-pci: Add PCI ID for Intel ADL
    - Bluetooth: add quirk disabling LE Read Transmit Power
    - Bluetooth: btbcm: disable read tx power for some Macs with the T2 Security
      chip
    - Bluetooth: btbcm: disable read tx power for MacBook Air 8,1 and 8,2
    - veth: Do not record rx queue hint in veth_xmit
    - mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
    - can: gs_usb: fix use of uninitialized variable, detach device on reception
      of invalid USB data
    - can: isotp: convert struct tpcon::{idx,len} to unsigned int
    - can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved}
    - random: fix data race on crng_node_pool
    - random: fix data race on crng init time
    - random: fix crash on multiple early calls to add_bootloader_randomness()
    - platform/x86/intel: hid: add quirk to support Surface Go 3
    - media: Revert "media: uvcvideo: Set unique vdev name based in type"
    - staging: wlan-ng: Avoid bitwise vs logical OR warning in
      hfa384x_usb_throttlefn()
    - drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk()
    - staging: greybus: fix stack size warning with UBSAN
    - Linux 5.15.15
  * UBSAN warning on unplugging USB4 DP alt mode from AMD Yellow Carp graphics
    card (LP: #1956497)
    - drm/amd/display: explicitly set is_dsc_supported to false before use
  * Support USB4 DP alt mode for AMD Yellow Carp graphics card (LP: #1953008)
    - drm/amd/display: Enable PSR by default on newer DCN
    - SAUCE: drm/amd/display: Fixup previous PSR policy commit
    - drm/amd/display: Fix USB4 hot plug crash issue
    - drm/amd/display: Creating a fw boot options bit for an upcoming feature
    - drm/amd/display: Enable dpia in dmub only for DCN31 B0
    - drm/amd/display: MST support for DPIA
    - drm/amd/display: Set phy_mux_sel bit in dmub scratch register
    - drm/amd/display: Don't lock connection_mutex for DMUB HPD
    - drm/amd/display: Add callbacks for DMUB HPD IRQ notifications
  * Jammy update: v5.15.14 upstream stable release (LP: #1957882)
    - fscache_cookie_enabled: check cookie is valid before accessing it
    - selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv()
    - tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
    - tracing: Tag trace_percpu_buffer as a percpu pointer
    - Revert "RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow"
    - ieee802154: atusb: fix uninit value in atusb_set_extended_addr
    - i40e: Fix to not show opcode msg on unsuccessful VF MAC change
    - iavf: Fix limit of total number of queues to active queues of VF
    - RDMA/core: Don't infoleak GRH fields
    - Revert "net: usb: r8152: Add MAC passthrough support for more Lenovo Docks"
    - netrom: fix copying in user data in nr_setsockopt
    - RDMA/uverbs: Check for null return of kmalloc_array
    - mac80211: initialize variable have_higher_than_11mbit
    - mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
    - sfc: The RX page_ring is optional
    - i40e: fix use-after-free in i40e_sync_filters_subtask()
    - i40e: Fix for displaying message regarding NVM version
    - i40e: Fix incorrect netdev's real number of RX/TX queues
    - ftrace/samples: Add missing prototypes direct functions
    - ipv4: Check attribute length for RTA_GATEWAY in multipath route
    - ipv4: Check attribute length for RTA_FLOW in multipath route
    - ipv6: Check attribute length for RTA_GATEWAY in multipath route
    - ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
    - lwtunnel: Validate RTA_ENCAP_TYPE attribute length
    - selftests: net: udpgro_fwd.sh: explicitly checking the available ping
      feature
    - sctp: hold endpoint before calling cb in sctp_transport_lookup_process
    - batman-adv: mcast: don't send link-local multicast to mcast routers
    - sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
    - net: ena: Fix undefined state when tx request id is out of bounds
    - net: ena: Fix wrong rx request id by resetting device
    - net: ena: Fix error handling when calculating max IO queues number
    - md/raid1: fix missing bitmap update w/o WriteMostly devices
    - EDAC/i10nm: Release mdev/mbase when failing to detect HBM
    - KVM: x86: Check for rmaps allocation
    - cgroup: Use open-time credentials for process migraton perm checks
    - cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
    - cgroup: Use open-time cgroup namespace for process migration perm checks
    - Revert "i2c: core: support bus regulator controlling in adapter"
    - i2c: mpc: Avoid out of bounds memory access
    - power: supply: core: Break capacity loop
    - power: reset: ltc2952: Fix use of floating point literals
    - reset: renesas: Fix Runtime PM usage
    - rndis_host: support Hytera digital radios
    - gpio: gpio-aspeed-sgpio: Fix wrong hwirq base in irq handler
    - net ticp:fix a kernel-infoleak in __tipc_sendmsg()
    - phonet: refcount leak in pep_sock_accep
    - fbdev: fbmem: add a helper to determine if an aperture is used by a fw fb
    - drm/amdgpu: disable runpm if we are the primary adapter
    - power: bq25890: Enable continuous conversion for ADC at charging
    - ipv6: Continue processing multipath route even if gateway attribute is
      invalid
    - ipv6: Do cleanup if attribute validation fails in multipath route
    - auxdisplay: charlcd: checking for pointer reference before dereferencing
    - drm/amdgpu: fix dropped backing store handling in amdgpu_dma_buf_move_notify
    - drm/amd/pm: Fix xgmi link control on aldebaran
    - usb: mtu3: fix interval value for intr and isoc
    - scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
    - ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
    - net: udp: fix alignment problem in udp4_seq_show()
    - atlantic: Fix buff_ring OOB in aq_ring_rx_clean
    - drm/amd/pm: skip setting gfx cgpg in the s0ix suspend-resume
    - mISDN: change function names to avoid conflicts
    - drm/amd/display: fix B0 TMDS deepcolor no dislay issue
    - drm/amd/display: Added power down for DCN10
    - ipv6: raw: check passed optlen before reading
    - userfaultfd/selftests: fix hugetlb area allocations
    - ARM: dts: gpio-ranges property is now required
    - Input: zinitix - make sure the IRQ is allocated before it gets enabled
    - Revert "drm/amdgpu: stop scheduler when calling hw_fini (v2)"
    - drm/amd/pm: keep the BACO feature enabled for suspend
    - Linux 5.15.14
  * alsa/sdw: add sdw audio machine driver for several ADL machines
    (LP: #1951563)
    - ASoC: Intel: sof_sdw: Add support for SKU 0AF3 product
    - ASoC: Intel: soc-acpi: add SKU 0AF3 SoundWire configuration
    - ASoC: Intel: sof_sdw: Add support for SKU 0B00 and 0B01 products
    - ASoC: Intel: sof_sdw: Add support for SKU 0B11 product
    - ASoC: Intel: sof_sdw: Add support for SKU 0B13 product
    - ASoC: Intel: soc-acpi: add SKU 0B13 SoundWire configuration
    - ASoC: Intel: sof_sdw: Add support for SKU 0B29 product
    - ASoC: Intel: soc-acpi: add SKU 0B29 SoundWire configuration
    - ASoC: Intel: sof_sdw: Add support for SKU 0B12 product
    - ASoC: intel: sof_sdw: return the original error number
    - ASoC: intel: sof_sdw: rename be_index/link_id to link_index
    - ASoC: intel: sof_sdw: Use a fixed DAI link id for AMP
    - ASoC: intel: sof_sdw: move DMIC link id overwrite to create_sdw_dailink
    - ASoC: intel: sof_sdw: remove SOF_RT715_DAI_ID_FIX quirk
    - ASoC: intel: sof_sdw: remove sof_sdw_mic_codec_mockup_init
    - ASoC: intel: sof_sdw: remove get_next_be_id
    - ASoC: intel: sof_sdw: add link adr order check
  * Add basic Wifi support for Qualcomm WCN6856 (LP: #1955613)
    - ath11k: change to use dynamic memory for channel list of scan
    - ath11k: add string type to search board data in board-2.bin for WCN6855
  * Enable audio mute LED and mic mute LED on a new HP laptop (LP: #1956454)
    - ALSA: hda/realtek: Use ALC285_FIXUP_HP_GPIO_LED on another HP laptop
  * Add missing BT ID for Qualcomm WCN6856 (LP: #1956407)
    - Bluetooth: btusb: Add one more Bluetooth part for WCN6855
  * Add Bluetooth support for Qualcomm WCN6856 (LP: #1955689)
    - Bluetooth: btusb: Add support using different nvm for variant WCN6855
      controller
    - Bluetooth: btusb: re-definition for board_id in struct qca_version
    - Bluetooth: btusb: Add the new support IDs for WCN6855
  * Improve performance and idle power consumption (LP: #1941893)
    - x86: ACPI: cstate: Optimize C3 entry on AMD CPUs
  * [Yellow Carp] USB4 interdomain communication problems (LP: #1945361)
    - thunderbolt: Enable retry logic for intra-domain control packets
  * 1951111:
    - scsi: lpfc: Fix mailbox command failure during driver initialization
  * [Jammy] Update Broadcom Emulex FC HBA lpfc driver to 14.0.0.3 for Ubuntu
    22.04 (LP: #1951111)
    - scsi: lpfc: Fix premature rpi release for unsolicited TPLS and LS_RJT
    - scsi: lpfc: Fix hang on unload due to stuck fport node
    - scsi: lpfc: Fix rediscovery of tape device after LIP
    - scsi: lpfc: Don't remove ndlp on PRLI errors in P2P mode
    - scsi: lpfc: Fix EEH support for NVMe I/O
    - scsi: lpfc: Adjust bytes received vales during cmf timer interval
    - scsi: lpfc: Fix I/O block after enabling managed congestion mode
    - scsi: lpfc: Zero CGN stats only during initial driver load and stat reset
    - scsi: lpfc: Improve PBDE checks during SGL processing
    - scsi: lpfc: Update lpfc version to 14.0.0.2
  * smartpqi: Update 20.04.4 to latest kernel.org patch level (LP: #1953689)
    - scsi: smartpqi: Update device removal management
    - scsi: smartpqi: Capture controller reason codes
    - scsi: smartpqi: Update LUN reset handler
    - scsi: smartpqi: Add TEST UNIT READY check for SANITIZE operation
    - scsi: smartpqi: Avoid failing I/Os for offline devices
    - scsi: smartpqi: Add extended report physical LUNs
    - scsi: smartpqi: Fix boot failure during LUN rebuild
    - scsi: smartpqi: Fix duplicate device nodes for tape changers
    - scsi: smartpqi: Add 3252-8i PCI id
    - scsi: smartpqi: Update version to 2.1.12-055
  * Let VMD follow host bridge PCIe settings (LP: #1954611)
    - PCI: vmd: Honor ACPI _OSC on PCIe features
  * Fix spurious wakeup caused by Intel 7560 WWAN (LP: #1956443)
    - net: wwan: iosm: Keep device at D0 for s2idle case
  * [uacc-0623] hisi_sec2  fail to alloc uacce (LP: #1933301)
    - crypto: hisilicon/qm - modify the uacce mode check
  * Jammy update: v5.15.13 upstream stable release (LP: #1956926)
    - Input: i8042 - add deferred probe support
    - Input: i8042 - enable deferred probe quirk for ASUS UM325UA
    - tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok().
    - tomoyo: use hwight16() in tomoyo_domain_quota_is_ok()
    - net/sched: Extend qdisc control block with tc control block
    - parisc: Clear stale IIR value on instruction access rights trap
    - platform/mellanox: mlxbf-pmc: Fix an IS_ERR() vs NULL bug in
      mlxbf_pmc_map_counters
    - platform/x86: apple-gmux: use resource_size() with res
    - memblock: fix memblock_phys_alloc() section mismatch error
    - recordmcount.pl: fix typo in s390 mcount regex
    - powerpc/ptdump: Fix DEBUG_WX since generic ptdump conversion
    - efi: Move efifb_setup_from_dmi() prototype from arch headers
    - selinux: initialize proto variable in selinux_ip_postroute_compat()
    - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
    - net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources
    - net/mlx5: Fix error print in case of IRQ request failed
    - net/mlx5: Fix SF health recovery flow
    - net/mlx5: Fix tc max supported prio for nic mode
    - net/mlx5e: Wrap the tx reporter dump callback to extract the sq
    - net/mlx5e: Fix interoperability between XSK and ICOSQ recovery flow
    - net/mlx5e: Fix ICOSQ recovery flow for XSK
    - net/mlx5e: Use tc sample stubs instead of ifdefs in source file
    - net/mlx5e: Delete forward rule for ct or sample action
    - udp: using datalen to cap ipv6 udp max gso segments
    - selftests: Calculate udpgso segment count without header adjustment
    - sctp: use call_rcu to free endpoint
    - net/smc: fix using of uninitialized completions
    - net: usb: pegasus: Do not drop long Ethernet frames
    - net: ag71xx: Fix a potential double free in error handling paths
    - net: lantiq_xrx200: fix statistics of received bytes
    - NFC: st21nfca: Fix memory leak in device probe and remove
    - net/smc: don't send CDC/LLC message if link not ready
    - net/smc: fix kernel panic caused by race of smc_sock
    - igc: Do not enable crosstimestamping for i225-V models
    - igc: Fix TX timestamp support for non-MSI-X platforms
    - drm/amd/display: Send s0i2_rdy in stream_count == 0 optimization
    - drm/amd/display: Set optimize_pwr_state for DCN31
    - ionic: Initialize the 'lif->dbid_inuse' bitmap
    - net/mlx5e: Fix wrong features assignment in case of error
    - net: bridge: mcast: add and enforce query interval minimum
    - net: bridge: mcast: add and enforce startup query interval minimum
    - selftests/net: udpgso_bench_tx: fix dst ip argument
    - selftests: net: Fix a typo in udpgro_fwd.sh
    - net: bridge: mcast: fix br_multicast_ctx_vlan_global_disabled helper
    - net/ncsi: check for error return from call to nla_put_u32
    - selftests: net: using ping6 for IPv6 in udpgro_fwd.sh
    - fsl/fman: Fix missing put_device() call in fman_port_probe
    - i2c: validate user data in compat ioctl
    - nfc: uapi: use kernel size_t to fix user-space builds
    - uapi: fix linux/nfc.h userspace compilation errors
    - drm/nouveau: wait for the exclusive fence after the shared ones v2
    - drm/amdgpu: When the VCN(1.0) block is suspended, powergating is explicitly
      enabled
    - drm/amdgpu: add support for IP discovery gc_info table v2
    - drm/amd/display: Changed pipe split policy to allow for multi-display pipe
      split
    - xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set.
    - usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
    - usb: mtu3: add memory barrier before set GPD's HWO
    - usb: mtu3: fix list_head check warning
    - usb: mtu3: set interval of FS intr and isoc endpoint
    - nitro_enclaves: Use get_user_pages_unlocked() call to handle mmap assert
    - binder: fix async_free_space accounting for empty parcels
    - scsi: vmw_pvscsi: Set residual data length conditionally
    - Input: appletouch - initialize work before device registration
    - Input: spaceball - fix parsing of movement data packets
    - mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()'
    - net: fix use-after-free in tw_timer_handler
    - fs/mount_setattr: always cleanup mount_kattr
    - perf intel-pt: Fix parsing of VM time correlation arguments
    - perf script: Fix CPU filtering of a script's switch events
    - perf scripts python: intel-pt-events.py: Fix printing of switch events
    - Linux 5.15.13
  * Miscellaneous Ubuntu changes
    - [Packaging] getabis: Add fwinfo.builtin to the ABI
    - [Packaging] Add list of built-in firmwares to the ABI
    - [Config] x86-64: SYSFB_SIMPLEFB=y
    - [packaging] arm64: introduce the lowlatency and lowlatency-64k flavours
    - [packaging] arm64: updateconfigs
    - [Config] annotations: remove duplicates when arm64-generic ==
      arm64-generic-64k option
    - [Config] annotations: introduce arm64-lowlatency and arm64-lowlatency-64k
      kconfig options checks
    - [Packaging] Update dependency of pahole / dwarves
    - [Config] toolchain version update
  * Miscellaneous upstream changes
    - scsi: lpfc: Revert LOG_TRACE_EVENT back to LOG_INIT prior to
      driver_resource_setup()
    - scsi: lpfc: Correct sysfs reporting of loop support after SFP status change
    - scsi: lpfc: Allow PLOGI retry if previous PLOGI was aborted
    - scsi: lpfc: Update lpfc version to 14.0.0.3
    - Revert "rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE"

 -- Tim Gardner <email address hidden>  Tue, 08 Feb 2022 08:41:26 -0700