SUSE-SU-2021:2643-1

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llseckeyalloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2020-0429: In l2tpsessiondelete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. (bsc#1176724).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hciextendedinquiryresultevt (bsc#1187038).
• CVE-2021-22543: Fixed an improper handling of VMIO|VMPFNMAP vmas in KVM that allows users to start and control a VM to read/write random pages of memory and can result in local privilege escalation. (bnc#1186482)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges. (bsc#1188062)
• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw which could allows a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: bus: Call kobjectput() in acpiinit() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platformgetirq() (git-fixes).
• ALSA: isa: Fix error return code in sndcmi8330probe() (git-fixes).
• ALSA: ppc: fix error return code in sndpmacprobe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
• ASoC: cs42l42: Correct definition of CS42L42ADCPDN_MASK (git-fixes).
• ASoC: hisilicon: fix missing clkdisableunprepare() on error in hi6210i2sstartup() (git-fixes).
• ASoC: soc-core: Fix the error return code in sndsocofparseaudio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• Bluetooth: mgmt: Fix slab-out-of-bounds in tlvdatais_valid (git-fixes).
• HID: Add BUSVIRTUAL to hidconnect logging (git-fixes).
• HID: gt683r: add missing MODULEDEVICETABLE (git-fixes).
• HID: hid-sensor-hub: Return error for hidsetfield() failure (git-fixes).
• HID: usbhid: fix info leak in hidsubmitctrl (git-fixes).
• HID: wacom: Correct base usage for capacitive ExpressKey status bits (git-fixes).
• Input: hilkbd - fix error return code in hildev_connect() (git-fixes).
• Input: usbtouchscreen - fix control-request directions (git-fixes).
• PCI/sysfs: Fix dsmlabelutf16stoutf8s() buffer overrun (git-fixes).
• PCI: Add ACS quirk for Broadcom BCM57414 NIC (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: Mark TI C667X to avoid bus reset (git-fixes).
• PCI: Mark some NVIDIA GPUs to avoid bus reset (git-fixes).
• PCI: Work around Huawei Intelligent NIC VF FLR erratum (git-fixes).
• PCI: quirks: fix false kABI positive (git-fixes).
• Revert 'ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro' (git-fixes).
• Revert 'PCI: PM: Do not read power state in pcienabledevice_flags()' (git-fixes).
• Revert 'USB: cdc-acm: fix rounding error in TIOCSSERIAL' (git-fixes).
• Revert 'hwmon: (lm80) fix a missing check of bus read in lm80 probe' (git-fixes).
• Revert 'ibmvnic: remove duplicate napi_schedule call in open function' (bsc#1065729).
• USB: cdc-acm: blacklist Heimann USB Appset device (git-fixes).
• USB: move many drivers to use DEVICEATTRWO (git-fixes).
• USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick (git-fixes).
• USB: serial: cp210x: fix comments for GE CS1000 (git-fixes).
• USB: serial: option: add support for u-blox LARA-R6 family (git-fixes).
• USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS (git-fixes).
• arm64/mm: Fix ttbr0 values stored in struct thread_info for software-pan (git-fixes).
• arm_pmu: Fix write counter incorrect in ARMv7 big-endian mode (git-fixes).
• ata: ahci_sunxi: Disable DIPM (git-fixes).
• ath10k: Fix an error code in ath10kaddinterface() (git-fixes).
• ath9k: Fix kernel NULL pointer dereference during athresetinternal() (git-fixes).
• brcmfmac: correctly report average RSSI in station info (git-fixes).
• brcmfmac: fix setting of station info chains bitmask (git-fixes).
• brcmsmac: mac80211_if: Fix a resource leak in an error handling path (git-fixes).
• can: ems_usb: fix memory leak (git-fixes).
• can: esd_usb2: fix memory leak (git-fixes).
• can: gw: synchronize rcu operations before removing gw job entry (git-fixes).
• can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
• can: hi311x: hi3110canprobe(): silence clang warning (git-fixes).
• can: mcbausbstart(): add missing urb->transfer_dma initialization (git-fixes).
• can: peakpciefd: pucanhandle_status(): fix a potential starvation issue in TX path (git-fixes).
• can: raw: rawsetsockopt(): fix rawrcv panic for sock UAF (git-fixes).
• can: sja1000: sja1000_err(): do not count arbitration lose as an error (git-fixes).
• can: sun4ican: sun4ican_err(): do not count arbitration lose as an error (git-fixes).
• can: tihecc: Fix memleak in tihecc_probe (git-fixes).
• can: usb_8dev: fix memory leak (git-fixes).
• ceph: do not WARN if we're still opening a session to an MDS (bsc#1188750).
• cfg80211: call cfg80211leaveocb when switching away from OCB (git-fixes).
• char: pcmcia: error out if 'numbytesread' is greater than 4 in set_protocol() (git-fixes).
• cifs: Fix preauth hash corruption (git-fixes).
• cifs: Return correct error code from smb2getenc_key (git-fixes).
• cifs: Set CIFSMOUNTUSEPREFIXPATH flag on setting cifs_sb->prepath (git-fixes).
• cifs: fix interrupted close commands (git-fixes).
• cifs: fix memory leak in smb2copychunkrange (git-fixes).
• cosa: Add missing kfree in error path of cosa_write (git-fixes).
• crypto: cavium/nitrox - Fix an error rhandling path in 'nitrox_probe()' (git-fixes).
• crypto: do not free algorithm before using (git-fixes).
• cw1200: add missing MODULEDEVICETABLE (git-fixes).
• cxgb4: fix wrong shift (git-fixes).
• dma-buf/sync_file: Do not leak fences on merge failure (git-fixes).
• drm/amd/amdgpu/sriov disable all ip hw status by default (git-fixes).
• drm/nouveau: wait for moving fence after pinning v2 (git-fixes).
• drm/panel: raspberrypi-touchscreen: Prevent double-free (git-fixes).
• drm/radeon: Add the missed drmgemobjectput() in radeonuserframebuffercreate() (git-fixes).
• drm/radeon: wait for moving fence after pinning (git-fixes).
• drm/rockchip: cdn-dp-core: add missing clkdisableunprepare() on error in cdndpgrf_write() (git-fixes).
• drm/virtio: Fix double free on probe failure (git-fixes).
• drm: Return -ENOTTY for non-drm ioctls (git-fixes).
• drm: qxl: ensure surf.data is ininitialized (git-fixes).
• e100: handle eeprom as little endian (git-fixes).
• extcon: max8997: Add missing modalias string (git-fixes).
• extcon: sm5502: Drop invalid register write in sm5502regdata (git-fixes).
• fpga: stratix10-soc: Add missing fpgamgrfree() call (git-fixes).
• fuse: check connected before queueing on fpq->io (bsc#1188273).
• fuse: reject internal errno (bsc#1188274).
• genirq/irqdomain: Do not try to free an interrupt that has no (git-fixes)
• genirq: Disable interrupts for force threaded handlers (git-fixes)
• genirq: Fix reference leaks on irq affinity notifiers (git-fixes)
• genirq: Let GENERICIRQIPI select IRQDOMAINHIERARCHY (git-fixes)
• gpio: zynq: Check return value of pmruntimeget_sync (git-fixes).
• gve: Add DQO fields for core data structures (bsc#1176940).
• gve: Add Gvnic stats AQ command and ethtool show/set-priv-flags (bsc#1176940).
• gve: Add NULL pointer checks when freeing irqs (bsc#1176940).
• gve: Add basic driver framework for Compute Engine Virtual NIC (jsc#SLE-10538).
• gve: Add dqo descriptors (bsc#1176940).
• gve: Add ethtool support (jsc#SLE-10538).
• gve: Add stats for gve (bsc#1176940).
• gve: Add support for DQO RX PTYPE map (bsc#1176940).
• gve: Add support for raw addressing device option (bsc#1176940).
• gve: Add support for raw addressing in the tx path (bsc#1176940).
• gve: Add support for raw addressing to the rx path (bsc#1176940).
• gve: Add workqueue and reset support (jsc#SLE-10538).
• gve: Batch AQ commands for creating and destroying queues (bsc#1176940).
• gve: Check TX QPL was actually assigned (bsc#1176940).
• gve: Copy and paste bug in gvegetstats() (jsc#SLE-10538).
• gve: Correct SKB queue index validation (bsc#1176940).
• gve: DQO: Add RX path (bsc#1176940).
• gve: DQO: Add TX path (bsc#1176940).
• gve: DQO: Add core netdev features (bsc#1176940).
• gve: DQO: Add ring allocation and initialization (bsc#1176940).
• gve: DQO: Configure interrupts on device up (bsc#1176940).
• gve: DQO: Fix off by one in gverxdqo() (bsc#1176940).
• gve: DQO: Remove incorrect prefetch (bsc#1176940).
• gve: Enable Link Speed Reporting in the driver (bsc#1176940).
• gve: Fix an error handling path in 'gve_probe()' (bsc#1176940).
• gve: Fix case where desccnt and datacnt can get out of sync (jsc#SLE-10538).
• gve: Fix error return code in gveallocqpls() (jsc#SLE-10538).
• gve: Fix swapped vars when fetching max queues (git-fixes).
• gve: Fix the queue page list allocated pages count (bsc#1176940).
• gve: Fix u64statssync to initialize start (jsc#SLE-10538).
• gve: Fix warnings reported for DQO patchset (bsc#1176940).
• gve: Fixes DMA synchronization (jsc#SLE-10538).
• gve: Get and set Rx copybreak via ethtool (bsc#1176940).
• gve: Introduce a new model for device options (bsc#1176940).
• gve: Introduce per netdev enum gve_queue_format (bsc#1176940).
• gve: Make gverxslotpageinfo.page_offset an absolute offset (bsc#1176940).
• gve: Move some static functions to a common file (bsc#1176940).
• gve: NIC stats for report-stats and for ethtool (bsc#1176940).
• gve: Propagate error codes to caller (bsc#1176940).
• gve: Remove the exporting of gve_probe (jsc#SLE-10538).
• gve: Replace zero-length array with flexible-array member (bsc#1176940).
• gve: Rx Buffer Recycling (bsc#1176940).
• gve: Simplify code and axe the use of a deprecated API (bsc#1176940).
• gve: Update adminq commands to support DQO queues (bsc#1176940).
• gve: Update mgmtmsixidx if num_ntfy changes (bsc#1176940).
• gve: Upgrade memory barrier in poll routine (bsc#1176940).
• gve: Use devinfo/err instead of netifinfo/err (bsc#1176940).
• gve: Use link status register to report link status (bsc#1176940).
• gve: adminq: DQO specific device descriptor logic (bsc#1176940).
• gve: fix -ENOMEM null check on a page allocation (jsc#SLE-10538).
• gve: fix dma sync bug where not all pages synced (bsc#1176940).
• gve: fix unused variable/label warnings (jsc#SLE-10538).
• gve: gverxcopy: Move padding to an argument (bsc#1176940).
• gve: replace kfree with kvfree (jsc#SLE-10538).
• hwmon: (max31722) Remove non-standard ACPI device IDs (git-fixes).
• hwmon: (max31790) Fix fan speed reporting for fan7..12 (git-fixes).
• i2c: robotfuzz-osif: fix control-request directions (git-fixes).
• ibmvnic: Allow device probe if the device is not ready at boot (bsc#1184114 ltc#192237).
• ibmvnic: Use listforeach_entry() to simplify code in ibmvnic.c (bsc#1184114 ltc#192237).
• ibmvnic: Use strscpy() instead of strncpy() (bsc#1184114 ltc#192237).
• ibmvnic: fix kernel build warning (bsc#1184114 ltc#192237).
• ibmvnic: fix kernel build warning in strncpy (bsc#1184114 ltc#192237).
• ibmvnic: fix kernel build warnings in buildhdrdescs_arr (bsc#1184114 ltc#192237).
• ibmvnic: fix sendrequestmap incompatible argument (bsc#1184114 ltc#192237).
• ibmvnic: free txpool if tsopool alloc fails (bsc#1085224 ltc#164363).
• ibmvnic: parenthesize a check (bsc#1184114 ltc#192237 bsc#1183871 ltc#192139 git-fixes).
• ibmvnic: retry reset if there are no other resets (bsc#1184350 ltc#191533).
• ibmvnic: set ltb->buff to NULL after freeing (bsc#1094840 ltc#167098).
• iio: accel: bma180: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: accel: bma180: Use explicit member assignment (git-fixes).
• iio: accel: bma220: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: accel: hid: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: accel: kxcjk-1013: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: accel: stk8312: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: accel: stk8ba50: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: adc: mxs-lradc: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: adc: ti-ads1015: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: adc: vf610: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: adis_buffer: do not return ints in irq handlers (git-fixes).
• iio: gyro: bmg160: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: humidity: am2315: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: light: isl29125: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: light: tcs3414: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iio: ltr501: ltr501readps(): add missing endianness conversion (git-fixes).
• iio: ltr501: ltr559: fix initialization of LTR501ALSCONTR (git-fixes).
• iio: ltr501: mark register holding upper 8 bits of ALSDATA{0,1} and PSDATA as volatile, too (git-fixes).
• iio: potentiostat: lmp91000: Fix alignment of buffer in iiopushtobufferswith_timestamp() (git-fixes).
• iio: prox: pulsed-light: Fix buffer alignment in iiopushtobufferswith_timestamp() (git-fixes).
• iwlwifi: mvm: do not change band on bound PHY contexts (git-fixes).
• kabi: fix nvmewaitfreeze_timeout() return type (bsc#1181161).
• kfifo: DECLAREKIFOPTR(fifo, u64) does not work on arm 32 bit (git-fixes).
• leds: ktd2692: Fix an error handling path (git-fixes).
• leds: trigger: fix potential deadlock with libata (git-fixes).
• lib/decompress_unlz4.c: correctly handle zero-padding around initrds (git-fixes).
• lib/decompressors: remove set but not used variabled 'level' (git-fixes).
• lpfc: Decouple porttemplate and vporttemplate (bsc#1185032).
• mISDN: fix possible use-after-free in HFC_cleanup() (git-fixes).
• mac80211: remove iwlwifi specific workaround NDPs of null_response (git-fixes).
• mac80211: remove warning in ieee80211getsband() (git-fixes).
• media: I2C: change 'RST' to 'RSET' to fix multiple build errors (git-fixes).
• media: bt8xx: Fix a missing check bug in bt878_probe (git-fixes).
• media: cobalt: fix race condition in setting HPD (git-fixes).
• media: cpia2: fix memory leak in cpia2usbprobe (git-fixes).
• media: dtv5100: fix control-request directions (git-fixes).
• media: dvb-usb: fix wrong definition (git-fixes).
• media: dvb_net: avoid speculation from net slot (git-fixes).
• media: dvdusb: memory leak in cinergyt2fe_attach (git-fixes).
• media: em28xx: Fix possible memory leak of em28xx struct (git-fixes).
• media: exynos4-is: Fix a use after free in ispvideorelease (git-fixes).
• media: gspca/gl860: fix zero-length control requests (git-fixes).
• media: gspca/sq905: fix control-request direction (git-fixes).
• media: gspca/sunplus: fix zero-length control requests (git-fixes).
• media: ngene: Fix out-of-bounds bug in ngenecommandconfigfreebuf() (git-fixes).
• media: pvrusb2: fix warning in pvr2i2ccore_done (git-fixes).
• media: rtl28xxu: fix zero-length control request (git-fixes).
• media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx (git-fixes).
• media: siano: Fix out-of-bounds warnings in smscoreloadfirmware_family2() (git-fixes).
• media: siano: fix device register error path (git-fixes).
• media: st-hva: Fix potential NULL pointer dereferences (git-fixes).
• media: tc358743: Fix error return code in tc358743probeof() (git-fixes).
• media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K (git-fixes).
• media: v4l2-core: Avoid the dangling pointer in v4l2fhrelease (git-fixes).
• media: zr364xx: fix memory leak in zr364xxstartreadpipe (git-fixes).
• memory: atmel-ebi: add missing ofnodeput for loop iteration (git-fixes).
• memory: fsl_ifc: fix leak of IO mapping on probe failure (git-fixes).
• memory: fsl_ifc: fix leak of private memory on probe failure (git-fixes).
• memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] (git-fixes).
• mfd: da9052/stmpe: Add and modify MODULEDEVICETABLE (git-fixes).
• mlxsw: core: Use variable timeout for EMAD retries (git-fixes).
• mmc: block: Disable CMDQ on the ioctl path (git-fixes).
• mmc: core: Allow UHS-I voltage switch for SDSC cards if supported (git-fixes).
• mmc: core: clear flags before allowing to retune (git-fixes).
• mmc: sdhci-esdhc-imx: remove unused isimx6qusdhc (git-fixes).
• mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode (git-fixes).
• mmc: usdhi6rol0: fix error return code in usdhi6_probe() (git-fixes).
• mmc: via-sdmmc: add a check against NULL pointer dereference (git-fixes).
• mmc: vub3000: fix control-request direction (git-fixes).
• mwifiex: re-fix for unaligned accesses (git-fixes).
• net/mlx5: Disable QoS when min_rates on all VFs are zero (git-fixes).
• net/mlx5: Query PPS pin operational status before registering it (git-fixes).
• net/mlx5: Verify Hardware supports requested ptp function on a given pin (git-fixes).
• net: Google gve: Remove dma_wmb() before ringing doorbell (bsc#1176940).
• net: b44: fix error return code in b44initone() (git-fixes).
• net: broadcom CNIC: requires MMU (git-fixes).
• net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 (git-fixes).
• net: gve: convert strlcpy to strscpy (bsc#1176940).
• net: gve: remove duplicated allowed (bsc#1176940).
• net: usb: fix possible use-after-free in smsc75xx_bind (git-fixes).
• netsec: restore phy power state after controller reset (git-fixes).
• nfc: nfcsim: fix use after free during module unload (git-fixes).
• nvme-core: add cancel tagset helpers (bsc#1181161).
• nvme-multipath: fix double initialization of ANA state (bsc#1181161).
• nvme-rdma: add clean action for failed reconnection (bsc#1181161).
• nvme-rdma: fix reset hang if controller died in the middle of a reset (bsc#1181161).
• nvme-rdma: use cancel tagset helper for tear down (bsc#1181161).
• nvme: have nvmewaitfreeze_timeout return if it timed out (bsc#1181161).
• nvme: verify MNAN value if ANA is enabled (bsc#1185791).
• nvmet: use new analogsize instead the old one (bsc#1181161).
• platform/x86: toshibaacpi: Fix missing error code in toshibaacpisetupkeyboard() (git-fixes).
• power: reset: gpio-poweroff: add missing MODULEDEVICETABLE (git-fixes).
• power: supply: ab8500: Avoid NULL pointers (git-fixes).
• power: supply: ab8500: add missing MODULEDEVICETABLE (git-fixes).
• power: supply: charger-manager: add missing MODULEDEVICETABLE (git-fixes).
• powerpc/64s: Move branch cache flushing bcctr variant to ppc-ops.h (bsc#1188885 ltc#193722).
• powerpc/64s: rename pnv|pseriessetuprfiflush to _setupsecurity_mitigations (bsc#1188885 ltc#193722).
• powerpc/papr_scm: Properly handle UUID types and API (bsc#1113295, git-fixes).
• powerpc/pesries: Get STF barrier requirement from HGETCPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
• powerpc/pseries/scm: Use a specific endian format for storing uuid from the device tree (bsc#1113295, git-fixes).
• powerpc/pseries: Get entry and uaccess flush required bits from HGETCPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
• powerpc/pseries: add new branch prediction security bits for link stack (bsc#1188885 ltc#193722).
• powerpc/pseries: export LPAR security flavor in lparcfg (bsc#1188885 ltc#193722).
• powerpc/security: Add a security feature for STF barrier (bsc#1188885 ltc#193722).
• powerpc/security: Allow for processors that flush the link stack using the special bcctr (bsc#1188885 ltc#193722).
• powerpc/security: Fix link stack flush instruction (bsc#1188885 ltc#193722).
• powerpc/security: change link stack flush state to the flush type enum (bsc#1188885 ltc#193722).
• powerpc/security: make display of branch cache flush more consistent (bsc#1188885 ltc#193722).
• powerpc/security: re-name count cache flush to branch cache flush (bsc#1188885 ltc#193722).
• powerpc/security: split branch cache flush toggle from code patching (bsc#1188885 ltc#193722).
• pwm: spear: Do not modify HW state in .remove callback (git-fixes).
• qlcnic: fix error return code in qlcnic83xxrestart_hw() (git-fixes).
• r8152: Avoid memcpy() over-reading of ETHSSSTATS (git-fixes).
• regulator: da9052: Ensure enough delay time for .setvoltagetime_sel (git-fixes).
• reset: a10sr: add missing ofmatchtable reference (git-fixes).
• reset: bail if trymoduleget() fails (git-fixes).
• reset: sti: reset-syscfg: fix struct description warnings (git-fixes).
• rtc: max77686: Do not enforce (incorrect) interrupt trigger type (git-fixes).
• sched/cpufreq/schedutil: Fix error path mutex unlock (git-fixes)
• sched/fair: Do not assign runtime for throttled cfs_rq (git-fixes)
• sched/fair: Fix unfairness caused by missing load decay (git-fixes)
• sched/numa: Fix a possible divide-by-zero (git-fixes)
• scripts/gitsort/gitsort.py: add bpf git repo
• scsi: fc: Add 256GBit speed setting to SCSI FC transport (bsc#1188101).
• scsi: mpt3sas: Fix kernel panic observed on soft HBA unplug (bsc#1185995).
• scsi: qedf: Do not put host in qedfvportcreate() unconditionally (bsc#1170511).
• scsi: smartpqi: create module parameters for LUN reset (bsc#1179195).
• serial: mvebu-uart: clarify the baud rate derivation (git-fixes).
• serial: mvebu-uart: correctly calculate minimal possible baudrate (git-fixes).
• serial: mvebu-uart: do not allow changing baudrate when uartclk is not available (git-fixes).
• serial: mvebu-uart: fix calculation of clock divisor (git-fixes).
• smb3: Fix out-of-bounds bug in SMB2_negotiate() (git-fixes).
• spi: Make ofregisterspi_device also set the fwnode (git-fixes).
• spi: mediatek: fix fifo rx mode (git-fixes).
• spi: omap-100k: Fix the length judgment problem (git-fixes).
• spi: spi-loopback-test: Fix 'txbuf' might be 'rxbuf' (git-fixes).
• spi: spi-sun6i: Fix chipselect/clock bug (git-fixes).
• spi: spi-topcliff-pch: Fix potential double free in pchspiprocess_messages() (git-fixes).
• spi: tegra114: Fix an error message (git-fixes).
• ssb: sdio: Do not overwrite const buffer if block_write fails (git-fixes).
• staging: gdm724x: check for buffer overflow in gdmltemultisdupkt() (git-fixes).
• staging: gdm724x: check for overflow in gdmltenetif_rx() (git-fixes).
• tracing: Do not reference char * as a string in histograms (git-fixes).
• tty: nozomi: Fix a resource leak in an error handling function (git-fixes).
• tty: nozomi: Fix the error handling path of 'nozomicardinit()' (git-fixes).
• tty: serial: 8250: serial_cs: Fix a memory leak in error handling path (git-fixes).
• tty: serial: fsl_lpuart: fix the potential risk of division or modulo by zero (git-fixes).
• usb: dwc2: gadget: Fix sending zero length packet in DDMA mode (git-fixes).
• usb: hub: Disable USB 3 device initiated lpm if exit latency is too high (git-fixes).
• usb: max-3421: Prevent corruption of freed memory (git-fixes).
• usb: move many drivers to use DEVICEATTRWO (git-fixes).
• usb: typec: Add the missed altmodeidremove() in typecregisteraltmode() (git-fixes).
• usbip: Fix incorrect double assignment to udc->ud.tcp_rx (git-fixes).
• usbip: fix vudc usbipsockfdstore races leading to gpf (git-fixes).
• usbip: vudc synchronize sysfs code paths (git-fixes).
• usbip: vudc: fix missing unlock on error in usbipsockfdstore() (git-fixes).
• uuid: Add inline helpers to import / export UUIDs (bsc#1113295, git-fixes).
• virtio_console: Assure used length from device is limited (git-fixes).
• w1: ds2438: fixing bug that would always get page0 (git-fixes).
• watchdog: Fix possible use-after-free by calling deltimersync() (git-fixes).
• watchdog: Fix possible use-after-free in wdt_startup() (git-fixes).
• watchdog: aspeed: fix hardware timeout calculation (git-fixes).
• watchdog: iTCO_wdt: Account for rebooting on second timeout (git-fixes).
• watchdog: sc520wdt: Fix possible use-after-free in wdtturnoff() (git-fixes).
• watchdog: sp805: Fix kernel doc description (git-fixes).
• wcn36xx: Move halbuf allocation to devmkmalloc in probe (git-fixes).
• wireless: carl9170: fix LEDS build errors and warnings (git-fixes).
• wireless: wext-spy: Fix out-of-bounds warning (git-fixes).
• wl1251: Fix possible buffer overflow in wl1251cmdscan (git-fixes).
• wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP (git-fixes).
• workqueue: fix UAF in pwqunboundrelease_workfn() (bsc#1188973).
• x86/debug: Extend the lower bound of crash kernel low reservations (bsc#1153720).
• x86/kvm: Disable all PV features on crash (bsc#1185308).
• x86/kvm: Disable kvmclock on all CPUs on shutdown (bsc#1185308).
• x86/kvm: Fix pr_info() for async PF setup/teardown (bsc#1185308).
• x86/kvm: Teardown PV features on boot CPU as well (bsc#1185308).
• x86/kvm: Unify kvmpvguestcpureboot() with kvmguestcpu_offline() (bsc#1185308).
• xen-pciback: reconfigure also from backend watch handler (git-fixes).
• xfrm: xfrmstatemtu should return at least 1280 for ipv6 (bsc#1185377).
• xhci: Fix lost USB 2 remote wake (git-fixes).