SUSE-SU-2021:3207-1

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3759: Unaccounted ipc objects in Linux kernel could have lead to breaking memcg limits and DoS attacks (bsc#1190115).
• CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117)
• CVE-2021-3640: Fixed a Use-After-Free vulnerability in function scosocksendmsg() in the bluetooth stack (bsc#1188172).
• CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025).
• CVE-2021-3743: Fixed OOB Read in qrtrendpointpost (bsc#1189883).
• CVE-2021-3739: Fixed a NULL pointer dereference when deleting device by invalid id (bsc#1189832 ).
• CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706).
• CVE-2021-3653: Missing validation of the int_ctl VMCB field and allows a malicious L1 guest to enable AVIC support for the L2 guest. (bsc#1189399).
• CVE-2021-3656: Missing validation of the the virt_ext VMCB field and allows a malicious L1 guest to disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400).
• CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault (bnc#1189262).
• CVE-2021-38207: drivers/net/ethernet/xilinx/lltemacmain.c allowed remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about ten minutes (bnc#1189298).
• CVE-2021-38205: drivers/net/ethernet/xilinx/xilinx_emaclite.c made it easier for attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM pointer) (bnc#1189292).
• CVE-2021-38204: drivers/usb/host/max3421-hcd.c allowed physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations (bnc#1189291).
• CVE-2021-3679: A lack of CPU resource in tracing module functionality was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAPSYSADMIN capability) could use this flaw to starve the resources causing denial of service (bnc#1189057).
• CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program that could have obtain sensitive information from kernel memory (bsc#1188983).
• CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of arbitrary kernel memory (bsc#1188985).

The following non-security bugs were fixed:

• ACPI: NFIT: Fix support for virtual SPA ranges (git-fixes).
• ACPI: processor: Clean up acpiprocessorevaluate_cst() (bsc#1175543)
• ACPI: processor: Export acpiprocessorevaluate_cst() (bsc#1175543)
• ACPI: processor: Export function to claim _CST control (bsc#1175543)
• ACPI: processor: Introduce acpiprocessorevaluate_cst() (bsc#1175543)
• ACPI: processor: Make ACPIPROCESSORCSTATE depend on ACPI_PROCESSOR (bsc#1175543)
• ALSA: hda - fix the 'Capture Switch' value change notifications (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9510 laptop (git-fixes).
• ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256) (git-fixes).
• ALSA: hda/realtek: add mic quirk for Acer SF314-42 (git-fixes).
• ALSA: hda/via: Apply runtime PM workaround for ASUS B23E (git-fixes).
• ALSA: hda: Add quirk for ASUS Flow x13 (git-fixes).
• ALSA: pcm: fix divide error in sndpcmlib_ioctl (git-fixes).
• ALSA: seq: Fix racy deletion of subscriber (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum 600 (git-fixes).
• ALSA: usb-audio: Fix regression on Sony WALKMAN NW-A45 DAC (git-fixes).
• ALSA: usb-audio: Fix superfluous autosuspend recovery (git-fixes).
• ALSA: usb-audio: fix incorrect clock source setting (git-fixes).
• ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs (git-fixes).
• ASoC: cs42l42: Correct definition of ADC Volume control (git-fixes).
• ASoC: cs42l42: Do not allow SNDSOCDAIFMTLEFTJ (git-fixes).
• ASoC: cs42l42: Fix LRCLK frame start edge (git-fixes).
• ASoC: cs42l42: Fix inversion of ADC Notch Switch control (git-fixes).
• ASoC: cs42l42: Remove duplicate control for WNF filter frequency (git-fixes).
• ASoC: intel: atom: Fix breakage for PCM buffer address setup (git-fixes).
• ASoC: intel: atom: Fix reference to PCM buffer address (git-fixes).
• ASoC: ti: delete some dead code in omapabeprobe() (git-fixes).
• ASoC: tlv320aic31xx: Fix jack detection after suspend (git-fixes).
• ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits (git-fixes).
• ASoC: wcd9335: Disable irq on slave ports in the remove function (git-fixes).
• ASoC: wcd9335: Fix a double irq free in the remove function (git-fixes).
• ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function (git-fixes).
• ASoC: xilinx: Fix reference to PCM buffer address (git-fixes).
• Bluetooth: add timeout sanity check to hci_inquiry (git-fixes).
• Bluetooth: defer cleanup of resources in hciunregisterdev() (git-fixes).
• Bluetooth: fix repeated calls to scosockkill (git-fixes).
• Bluetooth: hidp: use correct wait queue when removing ctrl_wait (git-fixes).
• Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow (git-fixes).
• Bluetooth: sco: prevent information leak in scoconndefer_accept() (git-fixes).
• Documentation: admin-guide: PM: Add intel_idle document (bsc#1175543)
• Drop watchdog iTCO_wdt patch that causes incompatible behavior (bsc#1189449) Also blacklisted
• Fix breakage of swap over NFS (bsc#1188924).
• Fix kabi of preparetowait_exclusive() (bsc#1189575).
• HID: i2c-hid: Fix Elan touchpad regression (git-fixes).
• HID: input: do not report stylus battery state as 'full' (git-fixes).
• KVM: VMX: Drop guest CPUID check for VMXE in vmxsetcr4() (bsc#1188786).
• KVM: VMX: Enable machine check support for 32bit targets (bsc#1188787).
• KVM: VMX: Explicitly clear RFLAGS.CF and RFLAGS.ZF in VM-Exit RSB path (bsc#1188788).
• KVM: nVMX: Really make emulated nested preemption timer pinned (bsc#1188780).
• KVM: nVMX: Reset the segment cache when stuffing guest segs (bsc#1188781).
• KVM: nVMX: Skip IBPB when switching between vmcs01 and vmcs02 (bsc#1188782).
• KVM: nVMX: Sync unsync'd vmcs02 state to vmcs12 on migration (bsc#1188783).
• KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit (bsc#1188784).
• KVM: x86: bit 8 of non-leaf PDPEs is not reserved (bsc#1188790).
• Move upstreamed BT fixes into sorted section
• NFS: Correct size calculation for create reply length (bsc#1189870).
• NFSv4.1: Do not rebind to the same source port when (bnc#1186264 bnc#1189021)
• NFSv4/pNFS: Do not call nfs4pnfsv3ds_connect multiple times (git-fixes).
• NFSv4: Initialise connection to the server in nfs4allocclient() (bsc#1040364).
• PCI/MSI: Correct misleading comments (git-fixes).
• PCI/MSI: Do not set invalid bits in MSI mask (git-fixes).
• PCI/MSI: Enable and mask MSI-X early (git-fixes).
• PCI/MSI: Enforce MSI[X] entry updates to be visible (git-fixes).
• PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes).
• PCI/MSI: Mask all unused MSI-X entries (git-fixes).
• PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes).
• PCI/MSI: Use msimaskirq() in pcimsishutdown() (git-fixes).
• PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI (git-fixes).
• PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes).
• PCI: PM: Enable PME if it can be signaled from D3cold (git-fixes).
• README: Modernize build instructions.
• Revert 'ACPICA: Fix memory leak caused by _CID repair function' (git-fixes).
• Revert 'USB: serial: ch341: fix character loss at high transfer rates' (git-fixes).
• Revert 'dmaengine: imx-sdma: refine to load context only once' (git-fixes).
• Revert 'gpio: eic-sprd: Use devmplatformioremap_resource()' (git-fixes).
• Revert 'mmc: sdhci-iproc: Set SDHCIQUIRKCAPCLOCKBASE_BROKEN on BCM2711' (git-fixes).
• SUNRPC: 'Directory with parent 'rpc_clnt' already present!' (bsc#1168202 bsc#1188924).
• SUNRPC: Fix the batch tasks count wraparound (git-fixes).
• SUNRPC: Should wake up the privileged task firstly (git-fixes).
• SUNRPC: defer slow parts of rpcfreeclient() to a workqueue (bsc#1168202 bsc#1188924).
• SUNRPC: fix use-after-free in rpcfreeclient_work() (bsc#1168202 bsc#1188924).
• SUNRPC: prevent port reuse on transports which do not request it (bnc#1186264 bnc#1189021).
• USB: core: Avoid WARNings for 0-length descriptor requests (git-fixes).
• USB: serial: ch341: fix character loss at high transfer rates (git-fixes).
• USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2 (git-fixes).
• USB: serial: option: add Telit FD980 composition 0x1056 (git-fixes).
• USB: serial: option: add new VID/PID to support Fibocom FG150 (git-fixes).
• USB: usbtmc: Fix RCU stall warning (git-fixes).
• USB:ehci:fix Kunpeng920 ehci hardware problem (git-fixes).
• Update patches.suse/ibmvnic-Allow-device-probe-if-the-device-is-not-read.patch (bsc#1167032 ltc#184087 bsc#1184114 ltc#192237).
• VMCI: fix NULL pointer dereference when unmapping queue pair (git-fixes).
• ath6kl: wmi: fix an error code in ath6klwmisync_point() (git-fixes).
• ath9k: Clear key cache explicitly on disabling hardware (git-fixes).
• ath: Use safer key clearing with key cache entries (git-fixes).
• bcma: Fix memory leak for internally-handled cores (git-fixes).
• bdi: Do not use freezable workqueue (bsc#1189573).
• blk-iolatency: error out if blkgetqueue() failed in iolatencysetlimit() (bsc#1189507).
• blk-mq-sched: Fix blkmqschedalloctags() error handling (bsc#1189506).
• blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled() (bsc#1189503).
• blk-wbt: make sure throttle is enabled properly (bsc#1189504).
• block: fix trace completion for chained bio (bsc#1189505).
• brcmfmac: pcie: fix oops on failure to resume and reprobe (git-fixes).
• btrfs: Rename _btrfsallocchunk to btrfsalloc_chunk (bsc#1189077).
• btrfs: account for new extents being deleted in totalbytespinned (bsc#1135481).
• btrfs: add a comment explaining the data flush steps (bsc#1135481).
• btrfs: add btrfsreservedata_bytes and use it (bsc#1135481).
• btrfs: add flushing states for handling data reservations (bsc#1135481).
• btrfs: add the data transaction commit logic into maycommittransaction (bsc#1135481).
• btrfs: call btrfstrygranting_tickets when freeing reserved bytes (bsc#1135481).
• btrfs: call btrfstrygranting_tickets when reserving space (bsc#1135481).
• btrfs: call btrfstrygranting_tickets when unpinning anything (bsc#1135481).
• btrfs: change nr to u64 in btrfsstartdelalloc_roots (bsc#1135481).
• btrfs: check tickets after waiting on ordered extents (bsc#1135481).
• btrfs: do async reclaim for data reservations (bsc#1135481).
• btrfs: don't force commit if we are data (bsc#1135481).
• btrfs: drop the commit_cycles stuff for data reservations (bsc#1135481).
• btrfs: factor out create_chunk() (bsc#1189077).
• btrfs: factor out decidestripesize() (bsc#1189077).
• btrfs: factor out gatherdeviceinfo() (bsc#1189077).
• btrfs: factor out initallocchunk_ctl (bsc#1189077).
• btrfs: fix deadlock with concurrent chunk allocations involving system chunks (bsc#1189077).
• btrfs: fix possible infinite loop in data async reclaim (bsc#1135481).
• btrfs: flush delayed refs when trying to reserve data space (bsc#1135481).
• btrfs: handle U64MAX for shrinkdelalloc (bsc#1135481).
• btrfs: handle invalid profile in chunk allocation (bsc#1189077).
• btrfs: handle spaceinfo::totalbytes_pinned inside the delayed ref itself (bsc#1135481).
• btrfs: introduce allocchunkctl (bsc#1189077).
• btrfs: introduce chunk allocation policy (bsc#1189077).
• btrfs: make ALLOC_CHUNK use the space info flags (bsc#1135481).
• btrfs: make shrinkdelalloc take spaceinfo as an arg (bsc#1135481).
• btrfs: move the chunkmutex in btrfsreadchunktree (bsc#1189077).
• btrfs: parameterize devextentmin for chunk allocation (bsc#1189077).
• btrfs: refactor findfreedevextentstart() (bsc#1189077).
• btrfs: remove orig from shrink_delalloc (bsc#1135481).
• btrfs: rework chunk allocation to avoid exhaustion of the system chunk array (bsc#1189077).
• btrfs: run delayed iputs before committing the transaction for data (bsc#1135481).
• btrfs: serialize data reservations if we are flushing (bsc#1135481).
• btrfs: shrink delalloc pages instead of full inodes (bsc#1135481).
• btrfs: track ordered bytes instead of just dio ordered bytes (bsc#1135481).
• btrfs: use btrfsstartdelallocroots in shrinkdelalloc (bsc#1135481).
• btrfs: use the btrfsspaceinfofreebytesmayuse helper for delalloc (bsc#1135481).
• btrfs: use the same helper for data and metadata reservations (bsc#1135481).
• btrfs: use ticketing for data space reservations (bsc#1135481).
• can: tihecc: Fix memleak in tihecc_probe (git-fixes).
• can: usb: esdusb2: esdusb2rxevent(): fix the interchange of the CAN RX and TX error counters (git-fixes).
• ceph: clean up and optimize cephcheckdelayed_caps() (bsc#1187468).
• ceph: reduce contention in cephcheckdelayed_caps() (bsc#1187468).
• ceph: take snapemptylock atomically with snaprealm refcount change (bsc#1189427).
• cfg80211: Fix possible memory leak in function cfg80211bssupdate (git-fixes).
• cgroup1: fix leaked context root causing sporadic NULL deref in LTP (bsc#1190181).
• cgroup: verify that source is a string (bsc#1190131).
• cifs: Remove unused inline function issysvolor_netlogon() (bsc#1185902).
• cifs: avoid starvation when refreshing dfs cache (bsc#1185902).
• cifs: constify getnormalizedpath() properly (bsc#1185902).
• cifs: do not cargo-cult strndup() (bsc#1185902).
• cifs: do not send tree disconnect to ipc shares (bsc#1185902).
• cifs: do not share tcp servers with dfs mounts (bsc#1185902).
• cifs: do not share tcp sessions of dfs connections (bsc#1185902).
• cifs: fix check of dfs interlinks (bsc#1185902).
• cifs: fix path comparison and hash calc (bsc#1185902).
• cifs: get rid of @noreq param in _dfscache_find() (bsc#1185902).
• cifs: handle different charsets in dfs cache (bsc#1185902).
• cifs: keep referral server sessions alive (bsc#1185902).
• cifs: missing null pointer check in cifs_mount (bsc#1185902).
• cifs: prevent NULL deref in cifscomposemount_options() (bsc#1185902).
• cifs: set a minimum of 2 minutes for refreshing dfs cache (bsc#1185902).
• clk: fix leak on devmclkbulkgetall() unwind (git-fixes).
• clk: kirkwood: Fix a clocking boot regression (git-fixes).
• clk: stm32f4: fix post divisor setup for I2S/SAI PLLs (git-fixes).
• cpuidle: Allow idle states to be disabled by default (bsc#1175543)
• cpuidle: Consolidate disabled state checks (bsc#1175543)
• cpuidle: Drop disabled field from struct cpuidle_state (bsc#1175543)
• cpuidle: Fix cpuidledriverstate_disabled() (bsc#1175543)
• cpuidle: Introduce cpuidledriverstate_disabled() for driver quirks (bsc#1175543)
• cpuidle: cpuidle_state kABI fix (bsc#1175543)
• crypto: ccp - Annotate SEV Firmware file names (bsc#1189212).
• crypto: qat - use proper type for vf_mask (git-fixes).
• crypto: x86/curve25519 - fix cpu feature checking logic in mod_exit (git-fixes).
• dm integrity: fix missing goto in bitmapflushinterval error handling (git-fixes).
• dm rq: fix double free of blkmqtag_set in dev remove after table load fails (git-fixes).
• dm verity: fix DMVERITYOPTS_MAX value (git-fixes).
• dmaengine: imx-dma: configure the generic DMA type to make it work (git-fixes).
• dmaengine: imx-sdma: remove duplicated sdmaloadcontext (git-fixes).
• dmaengine: of-dma: routerxlate to return -EPROBEDEFER if controller is not yet available (git-fixes).
• dmaengine: usb-dmac: Fix PM reference leak in usbdmacprobe() (git-fixes).
• dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers (git-fixes).
• drivers/block/nullblk/main: Fix a double free in nullinit (git-fixes).
• drm/amdgpu/acp: Make PM domain really work (git-fixes).
• drm/msi/mdp4: populate priv->kms in mdp4kmsinit (git-fixes).
• drm/msm/dpu: make dpuhwctlclearall_blendstages clear necessary LMs (git-fixes).
• drm/msm/dsi: Fix some reference counted resource leaks (git-fixes).
• drm/nouveau/disp: power down unused DP links during init (git-fixes).
• drm/panfrost: Fix missing clkdisableunprepare() on error in panfrostclkinit() (git-fixes).
• drm: Copy drmwaitvblank to user before returning (git-fixes).
• ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle (bsc#1189568).
• ext4: correct the cachenr in tracepoint ext4esshrinkexit (bsc#1189564).
• ext4: fix avefreec in findgrouporlov (bsc#1189566).
• ext4: fix kernel infoleak via ext4extentheader (bsc#1189562).
• ext4: fix potential htree corruption when growing large_dir directories (bsc#1189576).
• ext4: remove check for zero nrtoscan in ext4esscan() (bsc#1189565).
• ext4: return error code when ext4fillflex_info() fails (bsc#1189563).
• ext4: use ext4grplockederror in mbfind_extent (bsc#1189567).
• fanotify: fix copyeventto_user() fid error clean up (bsc#1189574).
• firmwareloader: fix use-after-free in firmwarefallback_sysfs (git-fixes).
• firmwareloader: use -ETIMEDOUT instead of -EAGAIN in fwloadsysfsfallback (git-fixes).
• fpga: altera-freeze-bridge: Address warning about unused variable (git-fixes).
• fpga: xiilnx-spi: Address warning about unused variable (git-fixes).
• fpga: zynqmp-fpga: Address warning about unused variable (git-fixes).
• gpio: eic-sprd: break loop when getting NULL device resource (git-fixes).
• gpio: tqmx86: really make IRQ optional (git-fixes).
• i2c: dev: zero out array used for i2c reads from userspace (git-fixes).
• i2c: highlander: add IRQ check (git-fixes).
• i2c: iop3xx: fix deferred probing (git-fixes).
• i2c: mt65xx: fix IRQ check (git-fixes).
• i2c: s3c2410: fix IRQ check (git-fixes).
• iio: adc: Fix incorrect exit of for-loop (git-fixes).
• iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels (git-fixes).
• iio: humidity: hdc100x: Add margin to the conversion time (git-fixes).
• intel_idle: Add module parameter to prevent ACPI _CST from being used (bsc#1175543)
• intel_idle: Allow ACPI _CST to be used for selected known processors (bsc#1175543)
• intel_idle: Annotate init time data structures (bsc#1175543)
• intel_idle: Customize IceLake server support (bsc#1175543)
• intel_idle: Disable ACPI _CST on Haswell (bsc#1175543, bsc#1177399, bsc#1180347, bsc#1180141)
• intelidle: Fix maxcstate for processor models without C-state tables (bsc#1175543)
• intel_idle: Ignore _CST if control cannot be taken from the platform (bsc#1175543)
• intelidle: Refactor intelidlecpuidledriver_init() (bsc#1175543)
• intel_idle: Use ACPI _CST for processor models without C-state tables (bsc#1175543)
• intel_idle: Use ACPI _CST on server systems (bsc#1175543)
• iommu/amd: Fix extended features logging (bsc#1189213).
• iommu/arm-smmu-v3: Decrease the queue size of evtq and priq (bsc#1189210).
• iommu/arm-smmu-v3: add bit field SFM into GERRORERRMASK (bsc#1189209).
• iommu/dma: Fix IOVA reserve dma ranges (bsc#1189214).
• iommu/dma: Fix compile warning in 32-bit builds (bsc#1189229).
• iommu/vt-d: Check for allocation failure in auxdetachdevice() (bsc#1189215).
• iommu/vt-d: Define counter explicitly as unsigned int (bsc#1189216).
• iommu/vt-d: Do not set then clear private data in prqeventthread() (bsc#1189217).
• iommu/vt-d: Fix sysfs leak in alloc_iommu() (bsc#1189218).
• iommu/vt-d: Force to flush iotlb before creating superpage (bsc#1189219).
• iommu/vt-d: Global devTLB flush when present context entry changed (bsc#1189220).
• iommu/vt-d: Invalidate PASID cache when root/context entry changed (bsc#1189221).
• iommu/vt-d: Reject unsupported page request modes (bsc#1189222).
• iwlwifi: rs-fw: do not support stbc for HE 160 (git-fixes).
• kABI fix of usbdcdconfig_params (git-fixes).
• kABI: Fix kABI after fixing vcpu-id indexed arrays (git-fixes).
• kabi fix for NFSv4.1: Do not rebind to the same source port when reconnecting to the server (bnc#1186264 bnc#1189021)
• kabi fix for SUNRPC: defer slow parts of rpcfreeclient() to a workqueue (bsc#1168202 bsc#1188924).
• kernel, fs: Introduce and use setrestartfn() and archsetrestart_data() (bsc#1189153).
• lib/mpi: use kcalloc in mpi_resize (git-fixes).
• libata: fix atapiosector for CONFIG_HIGHMEM (git-fixes).
• mac80211: Fix insufficient headroom issue for AMSDU (git-fixes).
• mailbox: sti: quieten kernel-doc warnings (git-fixes).
• md/raid10: properly indicate failure when ending a failed write request (git-fixes).
• media: TDA1997x: enable EDID support (git-fixes).
• media: cxd2880-spi: Fix an error handling path (git-fixes).
• media: drivers/media/usb: fix memory leak in zr364xx_probe (git-fixes).
• media: dvb-usb: Fix error handling in dvbusbi2c_init (git-fixes).
• media: dvb-usb: fix uninit-value in dvbusbadapterdvbinit (git-fixes).
• media: dvb-usb: fix uninit-value in vp702xreadmac_addr (git-fixes).
• media: em28xx-input: fix refcount bug in em28xxusbdisconnect (git-fixes).
• media: go7007: fix memory leak in go7007usbprobe (git-fixes).
• media: go7007: remove redundant initialization (git-fixes).
• media: rtl28xxu: fix zero-length control request (git-fixes).
• media: stkwebcam: fix memory leak in stkcameraprobe (git-fixes).
• media: venus: venc: Fix potential null pointer dereference on pointer fmt (git-fixes).
• media: videobuf2-core: dequeue if start_streaming fails (git-fixes).
• media: zr364xx: fix memory leaks in probe() (git-fixes).
• media: zr364xx: propagate errors from zr364xxstartreadpipe() (git-fixes).
• memcg: enable accounting for file lock caches (bsc#1190115).
• misc: atmel-ssc: lock with mutex instead of spinlock (git-fixes).
• misc: rtsx: do not setting OCPOWERDOWN reg in rtsxpciinit_ocp() (git-fixes).
• mm, vmscan: guarantee dropslabnode() termination (VM Functionality, bsc#1189301).
• mm/thp: unmapmappingpage() to fix THP truncatecleanuppage() (bsc#1189569).
• mm: swap: properly update readahead statistics in unusepterange() (bsc#1187619).
• mmc: dw_mmc: Fix hang on data CRC error (git-fixes).
• mmc: dwmmc: Fix issue with uninitialized dmaslave_config (git-fixes).
• mmc: moxart: Fix issue with uninitialized dmaslaveconfig (git-fixes).
• mmc: sdhci-iproc: Cap min clock frequency on BCM2711 (git-fixes).
• mmc: sdhci-iproc: Set SDHCIQUIRKCAPCLOCKBASE_BROKEN on BCM2711 (git-fixes).
• mtd: cficmdset0002: fix crash when erasing/writing AMD cards (git-fixes).
• mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafenandprobe()' (git-fixes).
• nbd: Aovid double completion of a request (git-fixes).
• nbd: Fix NULL pointer in flush_workqueue (git-fixes).
• nbd: do not update block size after device is started (git-fixes).
• net/mlx5: Properly convey driver version to firmware (git-fixes).
• net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 (git-fixes).
• net: dsa: mv88e6xxx: also read STU state in mv88e6250g1vtu_getnext (git-fixes).
• net: stmmac: free tx skb buffer in stmmac_resume() (git-fixes).
• nfs: fix acl memory leak of posixaclcreate() (git-fixes).
• nvme-multipath: revalidate paths during rescan (bsc#1187211)
• nvme-pci: Use u32 for nvmedev.qdepth and nvmequeue.qdepth (bsc#1181972).
• nvme-pci: fix NULL req in completion handler (bsc#1181972).
• nvme-pci: limit maximum queue depth to 4095 (bsc#1181972).
• nvme-pci: use unsigned for io queue depth (bsc#1181972).
• nvme-tcp: Do not reset transport on data digest errors (bsc#1188418).
• nvme-tcp: do not check blkmqtagtorq when receiving pdu data (bsc#1181972).
• nvme: avoid possible double fetch in handling CQE (bsc#1181972).
• nvme: code command_id with a genctr for use-after-free validation (bsc#1181972).
• nvme: only call synchronize_srcu when clearing current path (bsc#1188067).
• nvmet: use NVMETMAXNAMESPACES to set nn value (bsc#1189384).
• ocfs2: fix snprintf() checking (bsc#1189581).
• ocfs2: fix zero out valid data (bsc#1189579).
• ocfs2: initialize ipnextorphan (bsc#1186731).
• ocfs2: issue zeroout to EOF blocks (bsc#1189582).
• ocfs2: ocfs2downconvertlock failure results in deadlock (bsc#1188439).
• overflow: Correct checkshloverflow() comment (git-fixes).
• ovl: allow upperdir inside lowerdir (bsc#1189323).
• ovl: expand warning in ovldreal() (bsc#1189323).
• ovl: fix missing revert_creds() on error path (bsc#1189323).
• ovl: perform vfs_getxattr() with mounter creds (bsc#1189323).
• ovl: skip getxattr of security labels (bsc#1189323).
• params: lift paramsetuint_minmax to common code (bsc#1181972).
• pcmcia: i82092: fix a null pointer dereference bug (git-fixes).
• pinctrl: samsung: Fix pinctrl bank pin count (git-fixes).
• pinctrl: single: Fix error return code in pcsparsebitsinpinctrl_entry() (git-fixes).
• pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast (git-fixes).
• platform/x86: pcengines-apuv2: Add missing terminating entries to gpio-lookup tables (git-fixes).
• power: supply: max17042: handle fails of reading status register (git-fixes).
• powerpc/paprscm: Make 'perfstats' invisible if perf-stats unavailable (bsc#1175052 jsc#SLE-13823 bsc#1174969 jsc#SLE-12769 git-fixes).
• powerpc/papr_scm: Reduce error severity if nvdimm stats inaccessible (bsc#1189197 ltc#193906).
• powerpc/pseries: Fix regression while building external modules (bsc#1160010 ltc#183046 git-fixes).
• powerpc/pseries: Fix update of LPAR security flavor after LPM (bsc#1188885 ltc#193722 git-fixes)
• powerpc: Fix iskvmguest() / kvmparaavailable() (bsc#1181148 ltc#190702 git-fixes).
• regulator: rt5033: Fix n_voltages settings for BUCK and LDO (git-fixes).
• regulator: vctrl: Avoid lockdep warning in enable/disable ops (git-fixes).
• regulator: vctrl: Use locked regulatorgetvoltage in probe path (git-fixes).
• rpm/kernel-obs-build.spec.in: make builds reproducible (bsc#1189305)
• rpm: Abolish image suffix (bsc#1189841).
• rpm: Define $certs as rpm macro (bsc#1189841).
• rpm: Fold kernel-devel and kernel-source scriptlets into spec files (bsc#1189841).
• rpm: kernel-binary.spec: Define $image as rpm macro (bsc#1189841).
• rpm: support gz and zst compression methods Extend commit 18fcdff43a00 ('rpm: support compressed modules') for compression methods other than xz.
• rq-qos: fix missed wake-ups in rqqosthrottle try two (bsc#1189575).
• rsi: fix an error code in rsi_probe() (git-fixes).
• rsi: fix error code in rsiload9116_firmware() (git-fixes).
• s390/ap: Fix hanging ioctl caused by wrong msg counter (bsc#1188982 LTC#193817).
• s390/boot: fix use of expolines in the DMA code (bsc#1188878 ltc#193771).
• sched/fair: Correctly insert cfs_rq's to list on unthrottle (git-fixes)
• sched/rt: Fix RT utilization tracking during policy change (git-fixes)
• scsi: blkcg: Add app identifier support for blkcg (bsc#1189385 jsc#SLE-18970).
• scsi: blkcg: Fix application ID config options (bsc#1189385 jsc#SLE-18970).
• scsi: cgroup: Add cgroupgetfrom_id() (bsc#1189385 jsc#SLE-18970).
• scsi: core: Add scsiprotref_tag() helper (bsc#1189392).
• scsi: ibmvfc: Do not wait for initial device scan (bsc#1127650).
• scsi: libfc: Fix array index out of bound exception (bsc#1188616).
• scsi: lpfc: Add 256 Gb link speed support (bsc#1189385).
• scsi: lpfc: Add PCI ID support for LPe37000/LPe38000 series adapters (bsc#1189385).
• scsi: lpfc: Call discovery state machine when handling PLOGI/ADISC completions (bsc#1189385).
• scsi: lpfc: Clear outstanding active mailbox during PCI function reset (bsc#1189385).
• scsi: lpfc: Copyright updates for 12.8.0.11 patches (bsc#1189385).
• scsi: lpfc: Copyright updates for 14.0.0.0 patches (bsc#1189385).
• scsi: lpfc: Delay unregistering from transport until GIDFT or ADISC completes (bsc#1189385).
• scsi: lpfc: Discovery state machine fixes for LOGO handling (bsc#1189385).
• scsi: lpfc: Enable adisc discovery after RSCN by default (bsc#1189385).
• scsi: lpfc: Fix KASAN slab-out-of-bounds in lpfcunregrpi() routine (bsc#1189385).
• scsi: lpfc: Fix NULL ptr dereference with NPIV ports for RDF handling (bsc#1189385).
• scsi: lpfc: Fix NVMe support reporting in log message (bsc#1189385).
• scsi: lpfc: Fix build error in lpfc_scsi.c (bsc#1189385).
• scsi: lpfc: Fix cq_id truncation in rq create (bsc#1189385).
• scsi: lpfc: Fix function description comments for vmid routines (bsc#1189385).
• scsi: lpfc: Fix memory leaks in error paths while issuing ELS RDF/SCR request (bsc#1189385).
• scsi: lpfc: Fix possible ABBA deadlock in nvmetxriaborted() (bsc#1189385).
• scsi: lpfc: Fix target reset handler from falsely returning FAILURE (bsc#1189385).
• scsi: lpfc: Improve firmware download logging (bsc#1189385).
• scsi: lpfc: Keep NDLP reference until after freeing the IOCB after ELS handling (bsc#1189385).
• scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash (git-fixes).
• scsi: lpfc: Remove REG_LOGIN check requirement to issue an ELS RDF (bsc#1189385).
• scsi: lpfc: Remove redundant assignment to pointer pcmd (bsc#1189385).
• scsi: lpfc: Remove redundant assignment to pointer temp_hdr (bsc#1189385).
• scsi: lpfc: Remove use of kmalloc() in trace event logging (bsc#1189385).
• scsi: lpfc: Revise Topology and RAS support checks for new adapters (bsc#1189385).
• scsi: lpfc: Skip issuing ADISC when node is in NPR state (bsc#1189385).
• scsi: lpfc: Skip reg_vpi when link is down for SLI3 in ADISC cmpl path (bsc#1189385).
• scsi: lpfc: Update lpfc version to 12.8.0.11 (bsc#1189385).
• scsi: lpfc: Update lpfc version to 14.0.0.0 (bsc#1189385).
• scsi: lpfc: Use PBDE feature enabled bit to determine PBDE support (bsc#1189385).
• scsi: lpfc: Use listmovetail() instead of listdel()/listadd_tail() (bsc#1189385).
• scsi: lpfc: vmid: Add QFPA and VMID timeout check in worker thread (bsc#1189385 jsc#SLE-18970).
• scsi: lpfc: vmid: Add datastructure for supporting VMID in lpfc (bsc#1189385 jsc#SLE-18970).
• scsi: lpfc: vmid: Add support for VMID in mailbox command (bsc#1189385 jsc#SLE-18970).
• scsi: lpfc: vmid: Append the VMID to the wqe before sending (bsc#1189385 jsc#SLE-18970).
• scsi: lpfc: vmid: Functions to manage VMIDs (bsc#1189385 jsc#SLE-18970).
• scsi: lpfc: vmid: Implement CT commands for appid (bsc#1189385 jsc#SLE-18970).
• scsi: lpfc: vmid: Implement ELS commands for appid (bsc#1189385 jsc#SLE-18970).
• scsi: lpfc: vmid: Introduce VMID in I/O path (bsc#1189385 jsc#SLE-18970).
• scsi: lpfc: vmid: Timeout implementation for VMID (bsc#1189385 jsc#SLE-18970).
• scsi: lpfc: vmid: VMID parameter initialization (bsc#1189385 jsc#SLE-18970).
• scsi: qla2xxx: Add heartbeat check (bsc#1189392).
• scsi: qla2xxx: Fix error return code in qla82xxwriteflash_dword() (bsc#1189392).
• scsi: qla2xxx: Fix spelling mistakes 'allloc' -> 'alloc' (bsc#1189392).
• scsi: qla2xxx: Fix use after free in debug code (bsc#1189392).
• scsi: qla2xxx: Log PCI address in qlanvmeunregisterremoteport() (bsc#1189392).
• scsi: qla2xxx: Remove duplicate declarations (bsc#1189392).
• scsi: qla2xxx: Remove redundant assignment to rval (bsc#1189392).
• scsi: qla2xxx: Remove redundant continue statement in a for-loop (bsc#1189392).
• scsi: qla2xxx: Remove redundant initialization of variable num_cnt (bsc#1189392).
• scsi: qla2xxx: Remove unused variable 'status' (bsc#1189392).
• scsi: qla2xxx: Update version to 10.02.00.107-k (bsc#1189392).
• scsi: qla2xxx: Use listmovetail() instead of listdel()/listadd_tail() (bsc#1189392).
• scsi: qla2xxx: Use the proper SCSI midlayer interfaces for PI (bsc#1189392).
• scsi: qla2xxx: edif: Add authentication pass + fail bsgs (bsc#1189392).
• scsi: qla2xxx: edif: Add detection of secure device (bsc#1189392).
• scsi: qla2xxx: edif: Add doorbell notification for app (bsc#1189392).
• scsi: qla2xxx: edif: Add encryption to I/O path (bsc#1189392).
• scsi: qla2xxx: edif: Add extraction of auth_els from the wire (bsc#1189392).
• scsi: qla2xxx: edif: Add getfcinfo and statistic bsgs (bsc#1189392).
• scsi: qla2xxx: edif: Add key update (bsc#1189392).
• scsi: qla2xxx: edif: Add send, receive, and accept for auth_els (bsc#1189392).
• scsi: qla2xxx: edif: Add start + stop bsgs (bsc#1189392).
• scsi: qla2xxx: edif: Increment command and completion counts (bsc#1189392).
• scsi: scsitransportsrp: Do not block target in SRPPORTLOST state (bsc#1184180).
• scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal (bsc#1189392).
• scsi: zfcp: Report port fc_security as unknown early during remote cable pull (git-fixes).
• serial: 8250: Mask out floating 16/32-bit bus bits (git-fixes).
• serial: 8250_mtk: fix uart corruption issue when rx power off (git-fixes).
• serial: tegra: Only print FIFO error message when an error occurs (git-fixes).
• slimbus: messaging: check for valid transaction id (git-fixes).
• slimbus: messaging: start transaction ids from 1 instead of zero (git-fixes).
• slimbus: ngd: reset dma setup during runtime pm (git-fixes).
• soc: aspeed: lpc-ctrl: Fix boundary check for mmap (git-fixes).
• soc: aspeed: p2a-ctrl: Fix boundary check for mmap (git-fixes).
• soc: ixp4xx/qmgr: fix invalid __iomem access (git-fixes).
• soc: ixp4xx: fix printing resources (git-fixes).
• soc: qcom: rpmhpd: Use corner in power_off (git-fixes).
• soc: qcom: smsm: Fix missed interrupts if state changes while masked (git-fixes).
• spi: imx: mx51-ecspi: Fix CONFIGREG delay comment (git-fixes).
• spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation (git-fixes).
• spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay (git-fixes).
• spi: mediatek: Fix fifo transfer (git-fixes).
• spi: meson-spicc: fix memory leak in mesonspiccremove (git-fixes).
• spi: spi-fsl-dspi: Fix issue with uninitialized dmaslaveconfig (git-fixes).
• spi: spi-pic32: Fix issue with uninitialized dmaslaveconfig (git-fixes).
• spi: sprd: Fix the wrong WDGLOADVAL (git-fixes).
• spi: stm32h7: fix full duplex irq handler handling (git-fixes).
• staging: rtl8192u: Fix bitwise vs logical operator in TranslateRxSignalStuff819xUsb() (git-fixes).
• staging: rtl8712: get rid of flushscheduledwork (git-fixes).
• staging: rtl8723bs: Fix a resource leak in sdintdpc (git-fixes).
• tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name (git-fixes).
• tracing / histogram: Give calculation hist_fields a size (git-fixes).
• tracing: Reject string operand in the histogram expression (git-fixes).
• tty: serial: fsl_lpuart: fix the wrong mapbase value (git-fixes).
• ubifs: Fix error return code in alloc_wbufs() (bsc#1189585).
• ubifs: Fix memleak in ubifsinitauthentication (bsc#1189583).
• ubifs: Only check replay with inode type to judge if inode linked (bsc#1187455).
• ubifs: Set/Clear ILINKABLE under ilock for whiteout inode (bsc#1189587).
• ubifs: journal: Fix error return code in ubifsjnlwrite_inode() (bsc#1189586).
• usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available (git-fixes).
• usb: dwc2: Postponed gadget registration to the udc class driver (git-fixes).
• usb: dwc3: Add support for DWC_usb32 IP (git-fixes).
• usb: dwc3: Disable phy suspend after power-on reset (git-fixes).
• usb: dwc3: Separate field holding multiple properties (git-fixes).
• usb: dwc3: Stop active transfers before halting the controller (git-fixes).
• usb: dwc3: Use clkbulkprepare_enable() (git-fixes).
• usb: dwc3: Use devres to get clocks (git-fixes).
• usb: dwc3: core: Properly default unspecified speed (git-fixes).
• usb: dwc3: core: do not do suspend for device mode if already suspended (git-fixes).
• usb: dwc3: debug: Remove newline printout (git-fixes).
• usb: dwc3: gadget: Check MPS of the request length (git-fixes).
• usb: dwc3: gadget: Clear DCTL.ULSTCHNGREQ before set (git-fixes).
• usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable (git-fixes).
• usb: dwc3: gadget: Disable gadget IRQ during pullup disable (git-fixes).
• usb: dwc3: gadget: Do not send unintended link state change (git-fixes).
• usb: dwc3: gadget: Do not setup more than requested (git-fixes).
• usb: dwc3: gadget: Fix dwc3calctrbs_left() (git-fixes).
• usb: dwc3: gadget: Fix handling ZLP (git-fixes).
• usb: dwc3: gadget: Give back staled requests (git-fixes).
• usb: dwc3: gadget: Handle ZLP for sg requests (git-fixes).
• usb: dwc3: gadget: Prevent EP queuing while stopping transfers (git-fixes).
• usb: dwc3: gadget: Properly track pending and queued SG (git-fixes).
• usb: dwc3: gadget: Restart DWC3 gadget when enabling pullup (git-fixes).
• usb: dwc3: gadget: Set BESL config parameter (git-fixes).
• usb: dwc3: gadget: Set link state to RX_Detect on disconnect (git-fixes).
• usb: dwc3: gadget: Stop EP0 transfers during pullup disable (git-fixes).
• usb: dwc3: gadget: Workaround Mirosoft's BESL check (git-fixes).
• usb: dwc3: meson-g12a: add IRQ check (git-fixes).
• usb: dwc3: meson-g12a: check return of dwc3mesong12ausbinit (git-fixes).
• usb: dwc3: of-simple: add a shutdown (git-fixes).
• usb: dwc3: st: Add ofdevput() in probe function (git-fixes).
• usb: dwc3: st: Add ofnodeput() before return in probe function (git-fixes).
• usb: dwc3: support continuous runtime PM with dual role (git-fixes).
• usb: ehci-orion: Handle errors of clkprepareenable() in probe (git-fixes).
• usb: gadget: Export recommended BESL values (git-fixes).
• usb: gadget: fhid: added GETIDLE and SET_IDLE handlers (git-fixes).
• usb: gadget: f_hid: fixed NULL pointer dereference (git-fixes).
• usb: gadget: f_hid: idle uses the highest byte for duration (git-fixes).
• usb: gadget: mvu3d: requestirq() after initializing UDC (git-fixes).
• usb: gadget: udc: at91: add IRQ check (git-fixes).
• usb: gadget: udc: renesasusb3: Fix socdevice_match() abuse (git-fixes).
• usb: host: ohci-tmio: add IRQ check (git-fixes).
• usb: host: xhci-rcar: Do not reload firmware after the completion (git-fixes).
• usb: mtu3: fix the wrong HS mult value (git-fixes).
• usb: mtu3: use @mult for HS isoc or intr (git-fixes).
• usb: phy: fsl-usb: add IRQ check (git-fixes).
• usb: phy: tahvo: add IRQ check (git-fixes).
• usb: phy: twl6030: add IRQ checks (git-fixes).
• virt_wifi: fix error on connect (git-fixes).
• virtio_pci: Support surprise removal of virtio pci device (git-fixes).
• wireguard: allowedips: allocate nodes in kmem_cache (git-fixes).
• wireguard: allowedips: free empty intermediate nodes when removing single node (git-fixes).
• wireguard: allowedips: remove nodes in O(1) (git-fixes).
• writeback: fix obtain a reference to a freeing memcg css (bsc#1189577).
• x86/fpu: Limit xstate copy size in xstateregs_set() (bsc#1152489).
• x86/fpu: Make init_fpstate correct with optimized XSAVE (bsc#1152489).
• x86/fpu: Reset state for all signal restore failures (bsc#1152489).
• x86/kvm: fix vcpu-id indexed array sizes (git-fixes).
• x86/signal: Detect and prevent an alternate signal stack overflow (bsc#1152489).
• xen/events: Fix race in setevtchnto_irq (git-fixes).
• xprtrdma: Pad optimization, revisited (bsc#1189760).