# changelog

author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.514.1.el7uek]
changelog:
  - uek: kabi: Correct kABI symbols (Saeed Mirzamohammadi)  [Orabug: 34162205]  
  - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls (Takashi Iwai)  [Orabug: 34007906]  {CVE-2022-1048} 
  - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls (Takashi Iwai)  [Orabug: 34007906]  {CVE-2022-1048} 
  - ALSA: pcm: Fix races among concurrent prealloc proc writes (Takashi Iwai)  [Orabug: 34007906]  {CVE-2022-1048} 
  - ALSA: pcm: Fix races among concurrent read/write and buffer changes (Takashi Iwai)  [Orabug: 34007906]  {CVE-2022-1048} 
  - Revert "net: micrel: fix KS8851_MLL Kconfig" (Marek Vasut)   
  - Revert "net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link" (Greg Kroah-Hartman)   
  - x86/cpu: Load microcode during restore_processor_state() (Borislav Petkov)   
  - ASoC: dmaengine: Restore NULL prepare_slave_config() callback (Codrin Ciubotariu)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.514.2.el7uek]
changelog:
  - perf: Fix sys_perf_event_open() race against self (Peter Zijlstra)  [Orabug: 34207044]  {CVE-2022-1729} 
  - debug: Lock down kgdb (Stephen Brennan)  [Orabug: 34207043]  {CVE-2022-21499}


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.514.4.el7uek]
changelog:
  - Add debugfs for controlling MMIO state data (Kanth Ghatraju)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21127} {CVE-2022-21125} {CVE-2022-21166} 
  - KVM: x86/speculation: Disable Fill buffer clear within guests (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation/srbds: Update SRBDS mitigation selection (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation: Add a common function for MD_CLEAR mitigation update (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - Documentation: Add documentation for Processor MMIO Stale Data (Pawan Gupta)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166} 
  - x86/speculation: Fix redundant MDS mitigation message (Waiman Long)  [Orabug: 34202260]  {CVE-2022-21123} {CVE-2022-21125} {CVE-2022-21127} {CVE-2022-21166}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.515.0.el7uek]
changelog:
  - net: ip: avoid OOM kills with large UDP sends over loopback (Venkat Venkatsubra)  [Orabug: 34066209]  
  - rdmaip: Flush ARP cache after address has been cleared (Gerd Rausch)  [Orabug: 34285241]  
  - rds: Include congested flag in rds_sock struct. (Rohit Nair)  [Orabug: 34261492]  
  - cpu/hotplug: Allow the CPU in CPU_UP_PREPARE state to be brought up again. (Longpeng(Mike))  [Orabug: 34234771]  
  - x86/xen: Allow to retry if cpu_initialize_context() failed. (Boris Ostrovsky)  [Orabug: 34234771]  
  - floppy: use a statically allocated error counter (Willy Tarreau)  [Orabug: 34218640]  {CVE-2022-1652} 
  - assoc_array: Fix BUG_ON during garbage collect (Stephen Brennan)  [Orabug: 34162064]  
  - exec, elf: fix reserve_va_range() sanity check (Anthony Yznaga)  [Orabug: 32387887]  
  - exec, elf: use already allocated notes data in reserve_va_range() (Anthony Yznaga)  [Orabug: 32387887]  
  - mm: madv_doexec_flag sysctl (Anthony Yznaga)  [Orabug: 32387887]  
  - mm: introduce MADV_DOEXEC (Anthony Yznaga)  [Orabug: 32387887]  
  - exec, elf: require opt-in for accepting preserved mem (Anthony Yznaga)  [Orabug: 32387887]  
  - mm: introduce VM_EXEC_KEEP (Anthony Yznaga)  [Orabug: 32387887]  
  - mm: fail exec if stack expansion will overlap another vma (Anthony Yznaga)  [Orabug: 32387887]  
  - mm: do not assume only the stack vma exists in setup_arg_pages() (Anthony Yznaga)  [Orabug: 32387887]  
  - ELF: when loading PIE binaries check for overlap with existing mappings (Anthony Yznaga)  [Orabug: 32387887]  
  - Linux 4.14.280 (Greg Kroah-Hartman)   
  - tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe() (Yang Yingliang)   
  - ping: fix address binding wrt vrf (Nicolas Dichtel)   
  - drm/vmwgfx: Initialize drm_mode_fb_cmd2 (Zack Rusin)   
  - cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() (Waiman Long)   
  - USB: serial: option: add Fibocom MA510 modem (Sven Schwermer)   
  - USB: serial: option: add Fibocom L610 modem (Sven Schwermer)   
  - USB: serial: qcserial: add support for Sierra Wireless EM7590 (Ethan Yang)   
  - USB: serial: pl2303: add device id for HP LM930 Display (Scott Chen)   
  - usb: cdc-wdm: fix reading stuck on device close (Sergey Ryazanov)   
  - tcp: resalt the secret every 10 seconds (Eric Dumazet)   
  - ASoC: ops: Validate input values in snd_soc_put_volsw_range() (Mark Brown)   
  - ASoC: max98090: Generate notifications on changes for custom control (Mark Brown)   
  - ASoC: max98090: Reject invalid values in custom control put() (Mark Brown)   
  - hwmon: (f71882fg) Fix negative temperature (Ji-Ze Hong (Peter Hong))   
  - net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe() (Taehee Yoo)   
  - net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending (Guangguan Wang)   
  - s390/lcs: fix variable dereferenced before check (Alexandra Winter)   
  - s390/ctcm: fix potential memory leak (Alexandra Winter)   
  - s390/ctcm: fix variable dereferenced before check (Alexandra Winter)   
  - hwmon: (ltq-cputemp) restrict it to SOC_XWAY (Randy Dunlap)   
  - mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection (Johannes Berg)   
  - netlink: do not reset transport header in netlink_recvmsg() (Eric Dumazet)   
  - ipv4: drop dst in multicast routing path (Lokesh Dhoundiyal)   
  - net: Fix features skip in for_each_netdev_feature() (Tariq Toukan)   
  - batman-adv: Don't skb_split skbuffs with frag_list (Sven Eckelmann)   
  - Linux 4.14.279 (Greg Kroah-Hartman)   
  - VFS: Fix memory leak caused by concurrently mounting fs with subtype (ChenXiaoSong)   
  - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock (Takashi Iwai)   
  - mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic() (Muchun Song)   
  - mm: hugetlb: fix missing cache flush in copy_huge_page_from_user() (Muchun Song)   
  - mmc: rtsx: add 74 Clocks in power on flow (Ricky WU)   
  - Bluetooth: Fix the creation of hdev->name (Itay Iellin)   
  - can: grcan: only use the NAPI poll budget for RX (Andreas Larsson)   
  - can: grcan: grcan_probe(): fix broken system id check for errata workaround needs (Andreas Larsson)   
  - block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit (Lee Jones)   
  - MIPS: Use address-of operator on section symbols (Nathan Chancellor)   
  - Linux 4.14.278 (Greg Kroah-Hartman)   
  - PCI: aardvark: Fix reading MSI interrupt number (Pali Rohár)   
  - PCI: aardvark: Clear all MSIs at setup (Pali Rohár)   
  - dm: interlock pending dm_io and dm_wait_for_bios_completion (Mike Snitzer)   
  - dm: fix mempool NULL pointer race when completing IO (Jiazi Li)   
  - net: ipv6: ensure we call ipv6_mc_down() at most once (j.nixdorf@avm.de)   
  - kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU (Sandipan Das)   
  - net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() (Eric Dumazet)   
  - btrfs: always log symlinks in full mode (Filipe Manana)   
  - smsc911x: allow using IRQ0 (Sergey Shtylyov)   
  - net: emaclite: Add error handling for of_address_to_resource() (Shravya Kumbham)   
  - hwmon: (adt7470) Fix warning on module removal (Armin Wolf)   
  - NFC: netlink: fix sleep in atomic bug when firmware download timeout (Duoming Zhou)   
  - nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs (Duoming Zhou)   
  - nfc: replace improper check device_is_registered() in netlink related functions (Duoming Zhou)   
  - can: grcan: use ofdev->dev when allocating DMA memory (Daniel Hellstrom)   
  - can: grcan: grcan_close(): fix deadlock (Duoming Zhou)   
  - ASoC: wm8958: Fix change notifications for DSP controls (Mark Brown)   
  - firewire: core: extend card->lock in fw_core_handle_bus_reset (Niels Dossche)   
  - firewire: remove check of list iterator against head past the loop body (Jakob Koschel)   
  - firewire: fix potential uaf in outbound_phy_packet_callback() (Chengfeng Ye)   
  - Revert "SUNRPC: attempt AF_LOCAL connect on setup" (Trond Myklebust)   
  - ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (Takashi Sakamoto)   
  - parisc: Merge model and model name into one line in /proc/cpuinfo (Helge Deller)   
  - MIPS: Fix CP0 counter erratum detection for R4k CPUs (Maciej W. Rozycki)   
  - tty: n_gsm: fix incorrect UA handling (Daniel Starke)   
  - tty: n_gsm: fix wrong command frame length field encoding (Daniel Starke)   
  - tty: n_gsm: fix wrong command retry handling (Daniel Starke)   
  - tty: n_gsm: fix missing explicit ldisc flush (Daniel Starke)   
  - tty: n_gsm: fix insufficient txframe size (Daniel Starke)   
  - tty: n_gsm: fix malformed counter for out of frame data (Daniel Starke)   
  - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 (Daniel Starke)   
  - drivers: net: hippi: Fix deadlock in rr_close() (Duoming Zhou)   
  - cifs: destage any unwritten data to the server before calling copychunk_write (Ronnie Sahlberg)   
  - x86: __memcpy_flushcache: fix wrong alignment if size > 2^32 (Mikulas Patocka)   
  - ASoC: wm8731: Disable the regulator when probing fails (Zheyu Ma)   
  - bnx2x: fix napi API usage sequence (Manish Chopra)   
  - net: bcmgenet: hide status block before TX timestamping (Jonathan Lemon)   
  - clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource() (Yang Yingliang)   
  - bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create() (Christophe JAILLET)   
  - tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT (Eric Dumazet)   
  - ip_gre: Make o_seqno start from 0 in native mode (Peilin Ye)   
  - pinctrl: pistachio: fix use of irq_of_parse_and_map() (Lv Ruyi)   
  - sctp: check asoc strreset_chunk in sctp_generate_reconf_event (Xin Long)   
  - mtd: rawnand: Fix return value check of wait_for_completion_timeout (Miaoqian Lin)   
  - ipvs: correctly print the memory size of ip_vs_conn_tab (Pengcheng Yang)   
  - ARM: dts: Fix mmc order for omap3-gta04 (H. Nikolaus Schaller)   
  - ARM: OMAP2+: Fix refcount leak in omap_gic_of_init (Miaoqian Lin)   
  - phy: samsung: exynos5250-sata: fix missing device put in probe error paths (Krzysztof Kozlowski)   
  - phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe (Miaoqian Lin)   
  - ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue (Fabio Estevam)   
  - USB: Fix xhci event ring dequeue pointer ERDP update issue (Weitao Wang)   
  - hex2bin: fix access beyond string end (Mikulas Patocka)   
  - hex2bin: make the function hex_to_bin constant-time (Mikulas Patocka)   
  - serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device (Maciej W. Rozycki)   
  - serial: 8250: Also set sticky MCR bits in console restoration (Maciej W. Rozycki)   
  - usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() (Vijayavardhan Vennapusa)   
  - usb: gadget: uvc: Fix crash when encoding data for usb request (Dan Vacura)   
  - usb: misc: fix improper handling of refcount in uss720_probe() (Hangyu Hua)   
  - iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on() (Zheyu Ma)   
  - iio: dac: ad5446: Fix read_raw not returning set value (Michael Hennerich)   
  - iio: dac: ad5592r: Fix the missing return value. (Zizhuang Deng)   
  - xhci: stop polling roothubs after shutdown (Henry Lin)   
  - USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions (Daniele Palmas)   
  - USB: serial: option: add support for Cinterion MV32-WA/MV32-WB (Slark Xiao)   
  - USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader (Bruno Thomsen)   
  - USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS (Kees Cook)   
  - USB: quirks: add STRING quirk for VCOM device (Oliver Neukum)   
  - USB: quirks: add a Realtek card reader (Oliver Neukum)   
  - usb: mtu3: fix USB 3.0 dual-role-switch from device to host (Macpaul Lin)   
  - lightnvm: disable the subsystem (Greg Kroah-Hartman)   
  - net/sched: cls_u32: fix netns refcount changes in u32_change() (Eric Dumazet)   
  - hamradio: remove needs_free_netdev to avoid UAF (Lin Ma)   
  - hamradio: defer 6pack kfree after unregister_netdev (Lin Ma)   
  - floppy: disable FDRAWCMD by default (Willy Tarreau)   
  - Linux 4.14.277 (Greg Kroah-Hartman)   
  - ax25: Fix UAF bugs in ax25 timers (Duoming Zhou)   
  - ax25: Fix NULL pointer dereferences in ax25 timers (Duoming Zhou)   
  - ax25: fix NPD bug in ax25_disconnect (Duoming Zhou)   
  - ax25: fix UAF bug in ax25_send_control() (Duoming Zhou)   
  - ax25: Fix refcount leaks caused by ax25_cb_del() (Duoming Zhou)   
  - ax25: fix UAF bugs of net_device caused by rebinding operation (Duoming Zhou)   
  - ax25: fix reference count leaks of ax25_dev (Duoming Zhou)   
  - ax25: add refcount in ax25_dev to avoid UAF bugs (Duoming Zhou)   
  - block/compat_ioctl: fix range check in BLKGETSIZE (Khazhismel Kumykov)   
  - staging: ion: Prevent incorrect reference counting behavour (Lee Jones)   
  - ext4: force overhead calculation if the s_overhead_cluster makes no sense (Theodore Ts'o)   
  - ext4: fix overhead calculation to account for the reserved gdt blocks (Theodore Ts'o)   
  - ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (Tadeusz Struk)   
  - ext4: fix symlink file size not match to file content (Ye Bin)   
  - ARC: entry: fix syscall_trace_exit argument (Sergey Matyukevich)   
  - e1000e: Fix possible overflow in LTR decoding (Sasha Neftin)   
  - ASoC: soc-dapm: fix two incorrect uses of list iterator (Xiaomeng Tong)   
  - openvswitch: fix OOB access in reserve_sfa_size() (Paolo Valerio)   
  - powerpc/perf: Fix power9 event alternatives (Athira Rajeev)   
  - dma: at_xdmac: fix a missing check on list iterator (Xiaomeng Tong)   
  - ata: pata_marvell: Check the 'bmdma_addr' beforing reading (Zheyu Ma)   
  - stat: fix inconsistency between struct stat and struct compat_stat (Mikulas Patocka)   
  - net: macb: Restart tx only if queue pointer is lagging (Tomas Melin)   
  - drm/msm/mdp5: check the return of kzalloc() (Xiaoke Wang)   
  - brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant (Borislav Petkov)   
  - cifs: Check the IOCB_DIRECT flag, not O_DIRECT (David Howells)   
  - vxlan: fix error return code in vxlan_fdb_append (Hongbin Wang)   
  - ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant (Borislav Petkov)   
  - platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative (Jiapeng Chong)   
  - ARM: vexpress/spc: Avoid negative array index when !SMP (Kees Cook)   
  - netlink: reset network and mac headers in netlink_dump() (Eric Dumazet)   
  - net/packet: fix packet_sock xmit return value checking (Hangbin Liu)   
  - dmaengine: imx-sdma: Fix error checking in sdma_event_remap (Miaoqian Lin)   
  - tcp: Fix potential use-after-free due to double kfree() (Kuniyuki Iwashima)   
  - tcp: fix race condition when creating child sockets from syncookies (Ricardo Dias)   
  - ALSA: usb-audio: Clear MIDI port active flag after draining (Takashi Iwai)   
  - gfs2: assign rgrp glock before compute_bitstructs (Bob Peterson)   
  - can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path (Hangyu Hua)   
  - tracing: Dump stacktrace trigger to the corresponding instance (Daniel Bristot de Oliveira)   
  - tracing: Have traceon and traceoff trigger honor the instance (Steven Rostedt (Google))   
  - mm: page_alloc: fix building error on -Werror=array-compare (Xiongwei Song)   
  - etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead (Kees Cook)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.515.1.el7uek]
changelog:
  - sched/rt: Disable RT_RUNTIME_SHARE by default (Daniel Bristot de Oliveira)  [Orabug: 34193333]  
  - mstflint_access: Update driver code to v4.20.1-1 from Github (Qing Huang)  [Orabug: 34286148]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.515.3.el7uek]
changelog:
  - uek-rpm: Enable Pensando EMMC reset controller (Thomas Tai)  [Orabug: 34325721]  
  - mfd: pensando_elbasr: Add Pensando Elba System Resource Chip (Brad Larson)  [Orabug: 34325721]  
  - dsc-drivers: update drivers for 1.15.9-C-65 (Shannon Nelson)  [Orabug: 34325721]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.516.0.el7uek]
changelog:
  - scsi: mpt3sas: Remove scsi_dma_map() error messages (Sreekanth Reddy)  [Orabug: 34328903]  
  - uek: kabi: new protected symbols for USM in OL7 (Saeed Mirzamohammadi)  [Orabug: 34233902]  
  - vfio/type1: add ioctl to check for correct pin accounting (Anthony Yznaga)  [Orabug: 32967885]  
  - vfio/type1: track pages pinned by vfio across exec (Anthony Yznaga)  [Orabug: 32967885]  
  - mm: track driver pinned pages across exec (Anthony Yznaga)  [Orabug: 32967885]  
  - vfio/type1: Fix vfio_find_dma_valid return (Anthony Yznaga)  [Orabug: 32967885]  
  - vfio/type1: fix unmap all on ILP32 (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: block on invalid vaddr (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: implement notify callback (Steve Sistare)  [Orabug: 32967885]  
  - vfio: iommu driver notify callback (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: implement interfaces to update vaddr (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: massage unmap iteration (Steve Sistare)  [Orabug: 32967885]  
  - vfio: interfaces to update vaddr (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: implement unmap all (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: unmap cleanup (Steve Sistare)  [Orabug: 32967885]  
  - vfio: option to unmap all (Steve Sistare)  [Orabug: 32967885]  
  - Linux 4.14.284 (Greg Kroah-Hartman)   
  - x86/speculation/mmio: Print SMT warning (Josh Poimboeuf)   
  - x86/cpu: Add another Alder Lake CPU to the Intel family (Gayatri Kammela)   
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family (Tony Luck)   
  - x86/cpu: Add Comet Lake to the Intel CPU models header (Kan Liang)   
  - x86/cpu: Add Cannonlake to Intel family (Rajneesh Bhardwaj)   
  - x86/cpu: Add Jasper Lake to Intel family (Zhang Rui)   
  - cpu/speculation: Add prototype for cpu_show_srbds() (Guenter Roeck)   
  - x86/cpu: Add Elkhart Lake to Intel family (Gayatri Kammela)   
  - Linux 4.14.283 (Greg Kroah-Hartman)   
  - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (Eric Dumazet)   
  - PCI: qcom: Fix unbalanced PHY init on probe errors (Johan Hovold)   
  - mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N (Tokunori Ikegami)   
  - mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write (Tokunori Ikegami)   
  - md/raid0: Ignore RAID0 layout if the second zone has only one device (Pascal Hambourg)   
  - powerpc/32: Fix overread/overwrite of thread_struct via ptrace (Michael Ellerman)   
  - Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (Mathias Nyman)   
  - ixgbe: fix unexpected VLAN Rx in promisc mode on VF (Olivier Matz)   
  - ixgbe: fix bcast packets Rx on VF after promisc removal (Olivier Matz)   
  - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling (Martin Faltesek)   
  - nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION (Martin Faltesek)   
  - ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files (Sergey Shtylyov)   
  - cifs: return errors during session setup during reconnects (Shyam Prasad N)   
  - ALSA: hda/conexant - Fix loopback issue with CX20632 (huangwenhui)   
  - vringh: Fix loop descriptors check in the indirect cases (Xie Yongji)   
  - nodemask: Fix return values to be unsigned (Kees Cook)   
  - nbd: fix io hung while disconnecting device (Yu Kuai)   
  - nbd: fix race between nbd_alloc_config() and module removal (Yu Kuai)   
  - nbd: call genl_unregister_family() first in nbd_cleanup() (Yu Kuai)   
  - modpost: fix undefined behavior of is_arm_mapping_symbol() (Masahiro Yamada)   
  - drm/radeon: fix a possible null pointer dereference (Gong Yuanjun)   
  - Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" (Michal Kubecek)   
  - md: protect md_unregister_thread from reentrancy (Guoqing Jiang)   
  - kernfs: Separate kernfs_pr_cont_buf and rename_lock. (Hao Luo)   
  - serial: msm_serial: disable interrupts in __msm_console_write() (John Ogness)   
  - staging: rtl8712: fix uninit-value in r871xu_drv_init() (Wang Cheng)   
  - clocksource/drivers/sp804: Avoid error on multiple instances (Andre Przywara)   
  - extcon: Modify extcon device to be created after driver data is set (bumwoo lee)   
  - misc: rtsx: set NULL intfdata when probe fails (Shuah Khan)   
  - usb: dwc2: gadget: don't reset gadget's driver->bus (Marek Szyprowski)   
  - USB: hcd-pci: Fully suspend across freeze/thaw cycle (Evan Green)   
  - drivers: usb: host: Fix deadlock in oxu_bus_suspend() (Duoming Zhou)   
  - drivers: tty: serial: Fix deadlock in sa1100_set_termios() (Duoming Zhou)   
  - USB: host: isp116x: check return value after calling platform_get_resource() (Zhen Ni)   
  - drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() (Duoming Zhou)   
  - tty: Fix a possible resource leak in icom_probe (Huang Guobin)   
  - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() (Zheyu Ma)   
  - lkdtm/usercopy: Expand size of "out of frame" object (Kees Cook)   
  - iio: dummy: iio_simple_dummy: check the return value of kstrdup() (Xiaoke Wang)   
  - drm: imx: fix compiler warning with gcc-12 (Linus Torvalds)   
  - net: altera: Fix refcount leak in altera_tse_mdio_create (Miaoqian Lin)   
  - net: ipv6: unexport __init-annotated seg6_hmac_init() (Masahiro Yamada)   
  - net: xfrm: unexport __init-annotated xfrm4_protocol_init() (Masahiro Yamada)   
  - net: mdio: unexport __init-annotated mdio_bus_init() (Masahiro Yamada)   
  - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() (Chuck Lever)   
  - net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure (Gal Pressman)   
  - ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe (Miaoqian Lin)   
  - xprtrdma: treat all calls not a bcall when bc_serv is NULL (Kinglong Mee)   
  - video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() (Yang Yingliang)   
  - m68knommu: fix undefined reference to `_init_sp' (Greg Ungerer)   
  - m68knommu: set ZERO_PAGE() to the allocated zeroed page (Greg Ungerer)   
  - i2c: cadence: Increase timeout per message if necessary (Lucas Tanure)   
  - tracing: Avoid adding tracer option before update_tracer_options (Mark-PK Tsai)   
  - tracing: Fix sleeping function called from invalid context on RT kernel (Jun Miao)   
  - mips: cpc: Fix refcount leak in mips_cpc_default_phys_base (Gong Yuanjun)   
  - perf c2c: Fix sorting in percent_rmt_hitm_cmp() (Leo Yan)   
  - tcp: tcp_rtx_synack() can be called from process context (Eric Dumazet)   
  - ubi: ubi_create_volume: Fix use-after-free when volume creation failed (Zhihao Cheng)   
  - jffs2: fix memory leak in jffs2_do_fill_super (Baokun Li)   
  - modpost: fix removing numeric suffixes (Alexander Lobakin)   
  - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (Miaoqian Lin)   
  - net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() (Dan Carpenter)   
  - clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (Miaoqian Lin)   
  - serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 (Ilpo Järvinen)   
  - serial: sh-sci: Don't allow CS5-6 (Ilpo Järvinen)   
  - serial: txx9: Don't allow CS5-6 (Ilpo Järvinen)   
  - serial: digicolor-usart: Don't allow CS5-6 (Ilpo Järvinen)   
  - serial: meson: acquire port->lock in startup() (John Ogness)   
  - rtc: mt6397: check return value after calling platform_get_resource() (Yang Yingliang)   
  - soc: rockchip: Fix refcount leak in rockchip_grf_init (Miaoqian Lin)   
  - coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier (Guilherme G. Piccoli)   
  - rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - pwm: lp3943: Fix duty calculation in case period was clamped (Uwe Kleine-König)   
  - USB: storage: karma: fix rio_karma_init return (Lin Ma)   
  - usb: usbip: add missing device lock on tweak configuration cmd (Niels Dossche)   
  - usb: usbip: fix a refcount leak in stub_probe() (Hangyu Hua)   
  - tty: goldfish: Use tty_port_destroy() to destroy port (Wang Weiyang)   
  - staging: greybus: codecs: fix type confusion of list iterator variable (Jakob Koschel)   
  - pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (Randy Dunlap)   
  - netfilter: nf_tables: disallow non-stateful expression in sets earlier (Pablo Neira Ayuso)   
  - MIPS: IP27: Remove incorrect `cpu_has_fpu' override (Maciej W. Rozycki)   
  - RDMA/rxe: Generate a completion for unsupported/invalid opcode (Xiao Yang)   
  - phy: qcom-qmp: fix reset-controller leak on probe errors (Johan Hovold)   
  - dt-bindings: gpio: altera: correct interrupt-cells (Dinh Nguyen)   
  - docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 (Akira Yokosawa)   
  - phy: qcom-qmp: fix struct clk leak on probe errors (Johan Hovold)   
  - arm64: dts: qcom: ipq8074: fix the sleep clock frequency (Kathiravan T)   
  - gma500: fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - carl9170: tx: fix an incorrect use of list iterator (Xiaomeng Tong)   
  - ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control (Mark Brown)   
  - rtl818x: Prevent using not initialized queues (Alexander Wetzel)   
  - hugetlb: fix huge_pmd_unshare address update (Mike Kravetz)   
  - nodemask.h: fix compilation error with GCC12 (Christophe de Dinechin)   
  - iommu/msm: Fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - um: Fix out-of-bounds read in LDT setup (Vincent Whitchurch)   
  - um: chan_user: Fix winch_tramp() return value (Johannes Berg)   
  - mac80211: upgrade passive scan to active scan on DFS channels after beacon rx (Felix Fietkau)   
  - irqchip: irq-xtensa-mx: fix initial IRQ affinity (Max Filippov)   
  - irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x (Pali Rohár)   
  - RDMA/hfi1: Fix potential integer multiplication overflow errors (Dennis Dalessandro)   
  - md: fix an incorrect NULL check in md_reload_sb (Xiaomeng Tong)   
  - md: fix an incorrect NULL check in does_sb_need_changing (Xiaomeng Tong)   
  - drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX (Brian Norris)   
  - drm/nouveau/clk: Fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. (Dave Airlie)   
  - scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled (Manivannan Sadhasivam)   
  - scsi: dc395x: Fix a missing check on list iterator (Xiaomeng Tong)   
  - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock (Junxiao Bi via Ocfs2-devel)   
  - dlm: fix missing lkb refcount handling (Alexander Aring)   
  - dlm: fix plock invalid read (Alexander Aring)   
  - ext4: avoid cycles in directory h-tree (Jan Kara)   
  - ext4: verify dir block before splitting it (Jan Kara)   
  - ext4: fix bug_on in ext4_writepages (Ye Bin)   
  - ext4: fix use-after-free in ext4_rename_dir_prepare (Ye Bin)   
  - fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages (Zhihao Cheng)   
  - iwlwifi: mvm: fix assert 1F04 upon reconfig (Emmanuel Grumbach)   
  - wifi: mac80211: fix use-after-free in chanctx code (Johannes Berg)   
  - perf jevents: Fix event syntax error caused by ExtSel (Zhengjun Xing)   
  - perf c2c: Use stdio interface if slang is not supported (Leo Yan)   
  - iommu/amd: Increase timeout waiting for GA log enablement (Joerg Roedel)   
  - video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup (Miaoqian Lin)   
  - iommu/mediatek: Add list_del in mtk_iommu_remove (Yong Wu)   
  - mailbox: forward the hrtimer if not queued and under a lock (Björn Ardö)   
  - powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup (Miaoqian Lin)   
  - powerpc/perf: Fix the threshold compare group constraint for power9 (Kajol Jain)   
  - Input: sparcspkr - fix refcount leak in bbc_beep_probe (Miaoqian Lin)   
  - tty: fix deadlock caused by calling printk() under tty_port->lock (Qi Zheng)   
  - powerpc/4xx/cpm: Fix return value of __setup() handler (Randy Dunlap)   
  - powerpc/idle: Fix return value of __setup() handler (Randy Dunlap)   
  - powerpc/8xx: export 'cpm_setbrg' for modules (Randy Dunlap)   
  - drivers/base/node.c: fix compaction sysfs file leak (Miaohe Lin)   
  - pinctrl: mvebu: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() (Gustavo A. R. Silva)   
  - mfd: ipaq-micro: Fix error check return value of platform_get_irq() (Lv Ruyi)   
  - ARM: dts: bcm2835-rpi-b: Fix GPIO line names (Stefan Wahren)   
  - ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT (Phil Elwell)   
  - soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc (Miaoqian Lin)   
  - soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc (Miaoqian Lin)   
  - rxrpc: Don't try to resend the request if we're receiving the reply (David Howells)   
  - rxrpc: Fix listen() setting the bar too high for the prealloc rings (David Howells)   
  - ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() (Yang Yingliang)   
  - sctp: read sk->sk_bound_dev_if once in sctp_rcv() (Eric Dumazet)   
  - m68k: math-emu: Fix dependencies of math emulation support (Geert Uytterhoeven)   
  - Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (Ying Hsu)   
  - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (Pavel Skripkin)   
  - media: exynos4-is: Change clk_disable to clk_disable_unprepare (Miaoqian Lin)   
  - media: st-delta: Fix PM disable depth imbalance in delta_probe (Miaoqian Lin)   
  - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt (Miaoqian Lin)   
  - ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe (Miaoqian Lin)   
  - media: uvcvideo: Fix missing check to determine if element is found in list (Xiaomeng Tong)   
  - drm/msm: return an error pointer in msm_gem_prime_get_sg_table() (Dan Carpenter)   
  - x86/mm: Cleanup the control_va_addr_alignment() __setup handler (Randy Dunlap)   
  - irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - x86: Fix return value of __setup handlers (Randy Dunlap)   
  - drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (Yang Yingliang)   
  - drm/msm/hdmi: check return value after calling platform_get_resource_byname() (Yang Yingliang)   
  - drm/msm/dsi: fix error checks and return values for DSI xmit functions (Dmitry Baryshkov)   
  - x86/pm: Fix false positive kmemleak report in msr_build_context() (Matthieu Baerts)   
  - fsnotify: fix wrong lockdep annotations (Amir Goldstein)   
  - inotify: show inotify mask flags in proc fdinfo (Amir Goldstein)   
  - ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (Dan Carpenter)   
  - spi: img-spfi: Fix pm_runtime_get_sync() error checking (Zheng Yongjun)   
  - HID: hid-led: fix maximum brightness for Dream Cheeky (Jonathan Teh)   
  - efi: Add missing prototype for efi_capsule_setup_info (Jan Kiszka)   
  - NFC: NULL out the dev->rfkill to prevent UAF (Lin Ma)   
  - spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout (Miaoqian Lin)   
  - drm/mediatek: Fix mtk_cec_mask() (Miles Chen)   
  - x86/delay: Fix the wrong asm constraint in delay_loop() (Ammar Faizi)   
  - ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe (Miaoqian Lin)   
  - ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe (Miaoqian Lin)   
  - ath9k: fix ar9003_get_eepmisc (Wenli Looi)   
  - drm: fix EDID struct for old ARM OABI format (Saeed Mirzamohammadi)   
  - RDMA/hfi1: Prevent panic when SDMA is disabled (Douglas Miller)   
  - macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled (Finn Thain)   
  - powerpc/xics: fix refcount leak in icp_opal_init() (Lv Ruyi)   
  - tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate (Vasily Averin)   
  - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (Yicong Yang)   
  - ARM: hisi: Add missing of_node_put after of_find_compatible_node (Peng Wu)   
  - ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM (Krzysztof Kozlowski)   
  - ARM: versatile: Add missing of_node_put in dcscb_init (Peng Wu)   
  - fat: add ratelimit to fat*_ent_bread() (OGAWA Hirofumi)   
  - ARM: OMAP1: clock: Fix UART rate reporting algorithm (Janusz Krzysztofik)   
  - fs: jfs: fix possible NULL pointer dereference in dbFree() (Zixuan Fu)   
  - ARM: dts: ox820: align interrupt controller node name with dtschema (Krzysztof Kozlowski)   
  - eth: tg3: silence the GCC 12 array-bounds warning (Jakub Kicinski)   
  - rxrpc: Return an error to sendmsg if call failed (David Howells)   
  - media: exynos4-is: Fix compile warning (Kwanghoon Son)   
  - net: phy: micrel: Allow probing without .driver_data (Fabio Estevam)   
  - ASoC: rt5645: Fix errorenous cleanup order (Lin Ma)   
  - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (Smith, Kyle Miller (Nimble Kernel))   
  - openrisc: start CPU timer early in boot (Jason A. Donenfeld)   
  - rtlwifi: Use pr_warn instead of WARN_ONCE (Dongliang Mu)   
  - ipmi:ssif: Check for NULL msg when handling events and messages (Corey Minyard)   
  - dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC (Mikulas Patocka)   
  - s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES (Heiko Carstens)   
  - ASoC: dapm: Don't fold register value changes into notifications (Mark Brown)   
  - ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL (jianghaoran)   
  - drm/amd/pm: fix the compile warning (Evan Quan)   
  - scsi: megaraid: Fix error check return value of register_chrdev() (Lv Ruyi)   
  - media: cx25821: Fix the warning when removing the module (Zheyu Ma)   
  - media: pci: cx23885: Fix the error handling in cx23885_initdev() (Zheyu Ma)   
  - media: venus: hfi: avoid null dereference in deinit (Luca Weiss)   
  - ath9k: fix QCA9561 PA bias level (Thibaut VARÈNE)   
  - drm/amd/pm: fix double free in si_parse_power_table() (Keita Suzuki)   
  - ALSA: jack: Access input_dev under mutex (Amadeusz Sławiński)   
  - ACPICA: Avoid cache flush inside virtual machines (Kirill A. Shutemov)   
  - ipw2x00: Fix potential NULL dereference in libipw_xmit() (Haowen Bai)   
  - b43: Fix assigning negative value to unsigned variable (Haowen Bai)   
  - b43legacy: Fix assigning negative value to unsigned variable (Haowen Bai)   
  - mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue (Niels Dossche)   
  - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes (Liu Zixian)   
  - btrfs: repair super block num_devices automatically (Qu Wenruo)   
  - btrfs: add "0x" prefix for unsupported optional features (Qu Wenruo)   
  - ptrace: Reimplement PTRACE_KILL by always sending SIGKILL (Eric W. Biederman)   
  - ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP (Eric W. Biederman)   
  - USB: new quirk for Dell Gen 2 devices (Monish Kumar R)   
  - USB: serial: option: add Quectel BG95 modem (Carl Yin(殷张成))   
  - binfmt_flat: do not stop relocating GOT entries prematurely on riscv (Niklas Cassel)   
  - Linux 4.14.282 (Greg Kroah-Hartman)   
  - bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes (Liu Jian)   
  - NFSD: Fix possible sleep during nfsd4_release_lockowner() (Chuck Lever)   
  - docs: submitting-patches: Fix crossref to 'The canonical patch format' (Akira Yokosawa)   
  - tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() (Xiu Jianfeng)   
  - dm verity: set DM_TARGET_IMMUTABLE feature flag (Sarthak Kukreti)   
  - dm stats: add cond_resched when looping over entries (Mikulas Patocka)   
  - dm crypt: make printing of the key constant-time (Mikulas Patocka)   
  - dm integrity: fix error code in dm_integrity_ctr() (Dan Carpenter)   
  - zsmalloc: fix races between asynchronous zspage free and page migration (Sultan Alsawaf)   
  - netfilter: conntrack: re-fetch conntrack after insertion (Florian Westphal)   
  - exec: Force single empty string when argv is empty (Kees Cook)   
  - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern (Haimin Zhang)   
  - drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() (Gustavo A. R. Silva)   
  - drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers (Piyush Malgujar)   
  - net: ftgmac100: Disable hardware checksum on AST2600 (Joel Stanley)   
  - net: af_key: check encryption module availability consistency (Thomas Bartschies)   
  - ACPI: sysfs: Fix BERT error region memory mapping (Lorenzo Pieralisi)   
  - ACPI: sysfs: Make sparse happy about address space in use (Andy Shevchenko)   
  - secure_seq: use the 64 bits of the siphash for port offset calculation (Willy Tarreau)   
  - tcp: change source port randomizarion at connect() time (Eric Dumazet)   
  - staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan() (Denis Efremov (Oracle))   
  - x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests (Thomas Gleixner)   
  - Linux 4.14.281 (Greg Kroah-Hartman)   
  - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE"" (Linus Torvalds)   
  - swiotlb: fix info leak with DMA_FROM_DEVICE (Halil Pasic)   
  - net: atlantic: verify hw_head_ lies within TX buffer ring (Grant Grundler)   
  - net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() (Yang Yingliang)   
  - ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one() (Yang Yingliang)   
  - mac80211: fix rx reordering with non explicit / psmp ack policy (Felix Fietkau)   
  - scsi: qla2xxx: Fix missed DMA unmap for aborted commands (Gleb Chesnokov)   
  - perf bench numa: Address compiler error on s390 (Thomas Richter)   
  - gpio: mvebu/pwm: Refuse requests with inverted polarity (Uwe Kleine-König)   
  - gpio: gpio-vf610: do not touch other bits when set the target bit (Haibo Chen)   
  - net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. (Andrew Lunn)   
  - igb: skip phy status check where unavailable (Kevin Mitchell)   
  - ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 (Ard Biesheuvel)   
  - ARM: 9196/1: spectre-bhb: enable for Cortex-A15 (Ard Biesheuvel)   
  - net: af_key: add check for pfkey_broadcast in function pfkey_process (Jiasheng Jiang)   
  - NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc (Duoming Zhou)   
  - net/qla3xxx: Fix a test in ql_reset_work() (Christophe JAILLET)   
  - clk: at91: generated: consider range when calculating best rate (Codrin Ciubotariu)   
  - net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() (Zixuan Fu)   
  - net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() (Zixuan Fu)   
  - mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch() (Ulf Hansson)   
  - mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD (Ulf Hansson)   
  - mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC (Ulf Hansson)   
  - drm/dp/mst: fix a possible memory leak in fetch_monitor_name() (Hangyu Hua)   
  - ALSA: wavefront: Proper check of get_user() error (Takashi Iwai)   
  - ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() (linyujun)   
  - drbd: remove usage of list iterator variable after loop (Jakob Koschel)   
  - MIPS: lantiq: check the return value of kzalloc() (Xiaoke Wang)   
  - Input: stmfts - fix reference leak in stmfts_input_open (Zheng Yongjun)   
  - Input: add bounds checking to input_set_capability() (Jeff LaBundy)   
  - um: Cleanup syscall_handler_t definition/cast, fix warning (David Gow)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.516.1.el7uek]
changelog:
  - KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() (Vitaly Kuznetsov)  [Orabug: 34323860]  {CVE-2022-2153} 
  - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq (Vitaly Kuznetsov)  [Orabug: 34323860]  {CVE-2022-2153} 
  - KVM: Add infrastructure and macro to mark VM as bugged (Sean Christopherson)  [Orabug: 34323860]  {CVE-2022-2153} 
  - xfs: don't use delalloc extents for COW on files with extsize hints (Christoph Hellwig)  [Orabug: 34180868]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.516.1.1.el7uek]
changelog:
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug: 34460938]  {CVE-2022-2588} {CVE-2022-2588}


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.516.1.1.el7uek]
changelog:
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug: 34460938]  {CVE-2022-2588}


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.516.2.el7uek]
changelog:
  - Restore "module, async: async_synchronize_full() on module init iff async is used" (Mridula Shastry)  [Orabug: 34480697]  
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug: 34480738]  {CVE-2022-2588}


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.516.2.1.el7uek]
changelog:
  - rds: copy_from_user only once per rds_sendmsg system call (Hans Westgaard Ry)  [Orabug: 33981856]  {CVE-2022-21385}


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.516.2.3.el7uek]
changelog:
  - KVM: x86: use raw clock values consistently (Paolo Bonzini)  [Orabug: 34630475]  
  - KVM: x86: reorganize pvclock_gtod_data members (Paolo Bonzini)  [Orabug: 34630475]  
  - KVM: x86: switch KVMCLOCK base to monotonic raw clock (Marcelo Tosatti)  [Orabug: 34630475]


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.516.2.el7uek]
changelog:
  - Restore "module, async: async_synchronize_full() on module init iff async is used" (Mridula Shastry)  [Orabug: 34480697]  
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug: 34480738]  {CVE-2022-2588} {CVE-2022-2588}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.517.0.el7uek]
changelog:
  - mpt3sas: Fix panic observed while accessing the hw ctx queue (Gulam Mohamed)  [Orabug: 34446738]  
  - driver: marvell: mmc: Add new bus modes overrides from DT (Wojciech Bartczak)  [Orabug: 34440004]  
  - octeontx2: mmc: Adds mechanism to modify all MMC bus modes timings (Wojciech Bartczak)  [Orabug: 34440004]  
  - rds/rdma: correctly assign the dest qp num in rds ib connection (Rohit Nair)  [Orabug: 34429478]  
  - Revert "uek-rpm: Enable config CONFIG_SCSI_MQ_DEFAULT" (Gulam Mohamed)  [Orabug: 34419153]  
  - net/rds : Adding support to print SCQ and RCQ completion vectors in rds-info. (Anand Khoje)  [Orabug: 34398210]  
  - IB/mlx5: Disable BME for unbound devices too (Håkon Bugge)  [Orabug: 34395378]  
  - net/mlx5: Rearm the FW tracer after each tracer event (Feras Daoud)  [Orabug: 34387281]  
  - net/mlx5: FW tracer, Add debug prints (Saeed Mahameed)  [Orabug: 34387281]  
  - perf script: Fix crash because of missing evsel->priv (Ravi Bangoria)  [Orabug: 34382257]  
  - net/rds: Fix a NULL dereference in rds_tcp_accept_one() (Harshit Mogalapalli)  [Orabug: 34371946]  
  - ocfs2: kill EBUSY from dlmfs_evict_inode (Junxiao Bi)  [Orabug: 34364338]  
  - ocfs2: dlmfs: don't clear USER_LOCK_ATTACHED when destroying lock (Junxiao Bi)  [Orabug: 34364338]  
  - rds: ib: Qualify RNR Retry Timer check with firmware version (Freddy Carrillo)  [Orabug: 33665743]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.517.1.el7uek]
changelog:
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug: 34480752]  {CVE-2022-2588} {CVE-2022-2588} 
  - Restore "module, async: async_synchronize_full() on module init iff async is used" (Mridula Shastry)  [Orabug: 34469834]  
  - net/rds: Replace #ifdef DEBUG with CONFIG_SLUB_DEBUG (Freddy Carrillo)  [Orabug: 34405766]  
  - ext4: Move to shared i_rwsem even without dioread_nolock mount opt (Ritesh Harjani)  [Orabug: 34295843]  
  - ext4: Start with shared i_rwsem in case of DIO instead of exclusive (Ritesh Harjani)  [Orabug: 34295843]  
  - ext4: further refactoring bufferio and dio helper (Junxiao Bi)  [Orabug: 34295843]  
  - ext4: refactor ext4_file_write_iter (Junxiao Bi)  [Orabug: 34295843]  
  - xen/manage: Use orderly_reboot() to reboot (Ross Lagerwall)  [Orabug: 34211118]  
  - xen/manage: revert "xen/manage: enable C_A_D to force reboot" (Dongli Zhang)  [Orabug: 34211118]  
  - Linux 4.14.288 (Greg Kroah-Hartman)   
  - dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate (Miaoqian Lin)   
  - dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (Miaoqian Lin)   
  - dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly (Michael Walle)   
  - ida: don't use BUG_ON() for debugging (Linus Torvalds)   
  - i2c: cadence: Unregister the clk notifier in error path (Satish Nagireddy)   
  - pinctrl: sunxi: a83t: Fix NAND function name for some pins (Samuel Holland)   
  - xfs: remove incorrect ASSERT in xfs_rename (Eric Sandeen)   
  - powerpc/powernv: delay rng platform device creation until later in boot (Jason A. Donenfeld)   
  - video: of_display_timing.h: include errno.h (Hsin-Yi Wang)   
  - fbcon: Disallow setting font bigger than screen size (Helge Deller)   
  - iommu/vt-d: Fix PCI bus rescan device hot add (Yian Chen)   
  - net: rose: fix UAF bug caused by rose_t0timer_expiry (Duoming Zhou)   
  - usbnet: fix memory leak in error case (Oliver Neukum)   
  - can: gs_usb: gs_usb_open/close(): fix memory leak (Rhett Aultman)   
  - can: grcan: grcan_probe(): remove extra of_node_get() (Liang He)   
  - mm/slub: add missing TID updates on slab deactivation (Jann Horn)   
  - esp: limit skb_page_frag_refill use to a single page (Sabrina Dubroca)   
  - Linux 4.14.287 (Greg Kroah-Hartman)   
  - xen/gntdev: Avoid blocking in unmap_grant_pages() (Demi Marie Obenour)   
  - net: usb: qmi_wwan: add Telit 0x1070 composition (Daniele Palmas)   
  - net: usb: qmi_wwan: add Telit 0x1060 composition (Carlo Lobrano)   
  - xen/arm: Fix race in RB-tree based P2M accounting (Oleksandr Tyshchenko)   {CVE-2022-33744} 
  - net: Rename and export copy_skb_header (Ilya Lesokhin)   
  - ipv6/sit: fix ipip6_tunnel_get_prl return value (katrinzhou)   
  - sit: use min (kernel test robot)   
  - hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails (Yang Yingliang)   
  - NFC: nxp-nci: Don't issue a zero length i2c_master_read() (Michael Walle)   
  - nfc: nfcmrvl: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - net: bonding: fix use-after-free after 802.3ad slave unbind (Yevhen Orlov)   
  - net: bonding: fix possible NULL deref in rlb code (Eric Dumazet)   
  - netfilter: nft_dynset: restore set element counter when failing to update (Pablo Neira Ayuso)   
  - caif_virtio: fix race between virtio_device_ready() and ndo_open() (Jason Wang)   
  - net: ipv6: unexport __init-annotated seg6_hmac_net_init() (YueHaibing)   
  - usbnet: fix memory allocation in helpers (Oliver Neukum)   
  - RDMA/qedr: Fix reporting QP timeout attribute (Kamal Heib)   
  - net: usb: ax88179_178a: Fix packet receiving (Jose Alonso)   
  - net: rose: fix UAF bugs caused by timer handler (Duoming Zhou)   
  - SUNRPC: Fix READ_PLUS crasher (Chuck Lever)   
  - s390/archrandom: simplify back to earlier design and initialize earlier (Jason A. Donenfeld)   
  - dm raid: fix KASAN warning in raid5_add_disks (Mikulas Patocka)   
  - dm raid: fix accesses beyond end of raid member array (Heinz Mauelshagen)   
  - nvdimm: Fix badblocks clear off-by-one error (Chris Ye)   
  - Linux 4.14.286 (Greg Kroah-Hartman)   
  - swiotlb: skip swiotlb_bounce when orig_addr is zero (Liu Shixin)   
  - kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] (Naveen N. Rao)   
  - fdt: Update CRC check for rng-seed (Hsin-Yi Wang)   
  - xen: unexport __init-annotated xen_xlate_map_ballooned_pages() (Masahiro Yamada)   
  - drm: remove drm_fb_helper_modinit (Christoph Hellwig)   
  - powerpc/pseries: wire up rng during setup_arch() (Jason A. Donenfeld)   
  - modpost: fix section mismatch check for exported init/exit sections (Masahiro Yamada)   
  - ARM: cns3xxx: Fix refcount leak in cns3xxx_init (Miaoqian Lin)   
  - ARM: Fix refcount leak in axxia_boot_secondary (Miaoqian Lin)   
  - ARM: exynos: Fix refcount leak in exynos_map_pmu (Miaoqian Lin)   
  - ARM: dts: imx6qdl: correct PU regulator ramp delay (Lucas Stach)   
  - powerpc/powernv: wire up rng during setup_arch (Jason A. Donenfeld)   
  - powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address (Andrew Donnellan)   
  - powerpc: Enable execve syscall exit tracepoint (Naveen N. Rao)   
  - xtensa: Fix refcount leak bug in time.c (Liang He)   
  - xtensa: xtfpga: Fix refcount leak bug in setup (Liang He)   
  - iio: adc: axp288: Override TS pin bias current for some models (Hans de Goede)   
  - iio: trigger: sysfs: fix use-after-free on remove (Vincent Whitchurch)   
  - iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up() (Zheyu Ma)   
  - iio: accel: mma8452: ignore the return value of reset operation (Haibo Chen)   
  - iio:accel:bma180: rearrange iio trigger get and register (Dmitry Rokosov)   
  - usb: chipidea: udc: check request status before setting device address (Xu Yang)   
  - iio: adc: vf610: fix conversion mode sysfs node name (Baruch Siach)   
  - igb: Make DMA faster when CPU is active on the PCIe link (Kai-Heng Feng)   
  - MIPS: Remove repetitive increase irq_err_count (huhai)   
  - x86/xen: Remove undefined behavior in setup_features() (Julien Grall)   
  - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers (Jay Vosburgh)   
  - USB: serial: option: add Quectel RM500K module support (Macpaul Lin)   
  - USB: serial: option: add Quectel EM05-G modem (Yonglin Tan)   
  - USB: serial: option: add Telit LE910Cx 0x1250 composition (Carlo Lobrano)   
  - random: quiet urandom warning ratelimit suppression message (Jason A. Donenfeld)   
  - dm era: commit metadata in postsuspend after worker stops (Nikos Tsironis)   
  - ata: libata: add qc->flags in ata_qc_complete_template tracepoint (Edward Wu)   
  - random: schedule mix_interrupt_randomness() less often (Jason A. Donenfeld)   
  - vt: drop old FONT ioctls (Jiri Slaby)   
  - Linux 4.14.285 (Greg Kroah-Hartman)   
  - tcp: drop the hash_32() part from the index calculation (Willy Tarreau)   
  - tcp: increase source port perturb table to 2^16 (Willy Tarreau)   
  - tcp: dynamically allocate the perturb table used by source ports (Willy Tarreau)   
  - tcp: add small random increments to the source port (Willy Tarreau)   
  - tcp: use different parts of the port_offset for index and offset (Willy Tarreau)   
  - tcp: add some entropy in __inet_hash_connect() (Eric Dumazet)   
  - xprtrdma: fix incorrect header size calculations (Colin Ian King)   
  - usb: gadget: u_ether: fix regression in setting fixed MAC address (Marian Postevca)   
  - s390/mm: use non-quiescing sske for KVM switch to keyed guest (Christian Borntraeger)   
  - virtio-pci: Remove wrong address verification in vp_del_vqs() (Murilo Opsfelder Araujo)   
  - ext4: add reserved GDT blocks check (Zhang Yi)   
  - ext4: make variable "count" signed (Ding Xiang)   
  - ext4: fix bug_on ext4_mb_use_inode_pa (Baokun Li)   
  - serial: 8250: Store to lsr_save_flags after lsr read (Ilpo Järvinen)   
  - usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe (Miaoqian Lin)   
  - usb: dwc2: Fix memory leak in dwc2_hcd_init (Miaoqian Lin)   
  - USB: serial: io_ti: add Agilent E5805A support (Robert Eckelmann)   
  - USB: serial: option: add support for Cinterion MV31 with new baseline (Slark Xiao)   
  - comedi: vmk80xx: fix expression for tx buffer size (Ian Abbott)   
  - irqchip/gic/realview: Fix refcount leak in realview_gic_of_init (Miaoqian Lin)   
  - certs/blacklist_hashes.c: fix const confusion in certs blacklist (Masahiro Yamada)   
  - arm64: ftrace: fix branch range checks (Mark Rutland)   
  - net: bgmac: Fix an erroneous kfree() in bgmac_remove() (Christophe JAILLET)   
  - misc: atmel-ssc: Fix IRQ check in ssc_probe (Miaoqian Lin)   
  - tty: goldfish: Fix free_irq() on remove (Vincent Whitchurch)   
  - i40e: Fix call trace in setup_tx_descriptors (Aleksandr Loktionov)   
  - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE (Trond Myklebust)   
  - random: credit cpu and bootloader seeds by default (Jason A. Donenfeld)   
  - net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag (Chen Lin)   
  - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (Wang Yufen)   
  - nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (Xiaohui Zhang)   
  - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed (chengkaitao)   
  - scsi: pmcraid: Fix missing resource cleanup in error case (Chengguang Xu)   
  - scsi: ipr: Fix missing/incorrect resource cleanup in error case (Chengguang Xu)   
  - scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology (James Smart)   
  - scsi: vmw_pvscsi: Expand vcpuHint to 16 bits (Wentao Wang)   
  - ASoC: wm8962: Fix suspend while playing music (Adam Ford)   
  - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (Sergey Shtylyov)   
  - ASoC: cs42l56: Correct typo in minimum level for SX volume controls (Charles Keepax)   
  - ASoC: cs42l52: Correct TLV for Bypass Volume (Charles Keepax)   
  - ASoC: cs53l30: Correct number of volume levels on SX controls (Charles Keepax)   
  - ASoC: cs42l52: Fix TLV scales for mixer controls (Charles Keepax)   
  - random: account for arch randomness in bits (Jason A. Donenfeld)   
  - random: mark bootloader randomness code as __init (Jason A. Donenfeld)   
  - random: avoid checking crng_ready() twice in random_init() (Jason A. Donenfeld)   
  - crypto: drbg - make reseeding from get_random_bytes() synchronous (Nicolai Stange)   
  - crypto: drbg - always try to free Jitter RNG instance (Stephan Müller)   
  - crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed() (Nicolai Stange)   
  - crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() (Nicolai Stange)   
  - crypto: drbg - prepare for more fine-grained tracking of seeding state (Nicolai Stange)   
  - crypto: drbg - always seeded with SP800-90B compliant noise source (Stephan Müller)   
  - crypto: drbg - add FIPS 140-2 CTRNG for noise source (Stephan Mueller)   
  - Revert "random: use static branch for crng_ready()" (Jason A. Donenfeld)   
  - random: check for signals after page of pool writes (Jason A. Donenfeld)   
  - random: wire up fops->splice_{read,write}_iter() (Jens Axboe)   
  - random: convert to using fops->write_iter() (Jens Axboe)   
  - random: move randomize_page() into mm where it belongs (Jason A. Donenfeld)   
  - random: move initialization functions out of hot pages (Jason A. Donenfeld)   
  - random: use proper jiffies comparison macro (Jason A. Donenfeld)   
  - random: use symbolic constants for crng_init states (Jason A. Donenfeld)   
  - siphash: use one source of truth for siphash permutations (Jason A. Donenfeld)   
  - random: help compiler out with fast_mix() by using simpler arguments (Jason A. Donenfeld)   
  - random: do not use input pool from hard IRQs (Saeed Mirzamohammadi)   
  - random: order timer entropy functions below interrupt functions (Jason A. Donenfeld)   
  - random: do not pretend to handle premature next security model (Jason A. Donenfeld)   
  - random: do not use batches when !crng_ready() (Jason A. Donenfeld)   
  - random: insist on random_get_entropy() existing in order to simplify (Jason A. Donenfeld)   
  - xtensa: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - sparc: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - um: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - x86/tsc: Use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - nios2: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - arm: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - mips: use fallback for random_get_entropy() instead of just c0 random (Jason A. Donenfeld)   
  - m68k: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - timekeeping: Add raw clock fallback for random_get_entropy() (Jason A. Donenfeld)   
  - powerpc: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - alpha: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - parisc: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - s390: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - ia64: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - init: call time_init() before rand_initialize() (Jason A. Donenfeld)   
  - random: fix sysctl documentation nits (Jason A. Donenfeld)   
  - random: document crng_fast_key_erasure() destination possibility (Jason A. Donenfeld)   
  - random: make random_get_entropy() return an unsigned long (Jason A. Donenfeld)   
  - random: check for signals every PAGE_SIZE chunk of /dev/[u]random (Jason A. Donenfeld)   
  - random: check for signal_pending() outside of need_resched() check (Jann Horn)   
  - random: do not allow user to keep crng key around on stack (Jason A. Donenfeld)   
  - random: do not split fast init input in add_hwgenerator_randomness() (Jan Varho)   
  - random: mix build-time latent entropy into pool at init (Jason A. Donenfeld)   
  - random: re-add removed comment about get_random_{u32,u64} reseeding (Jason A. Donenfeld)   
  - random: treat bootloader trust toggle the same way as cpu trust toggle (Jason A. Donenfeld)   
  - random: skip fast_init if hwrng provides large chunk of entropy (Jason A. Donenfeld)   
  - random: check for signal and try earlier when generating entropy (Jason A. Donenfeld)   
  - random: reseed more often immediately after booting (Jason A. Donenfeld)   
  - random: make consistent usage of crng_ready() (Jason A. Donenfeld)   
  - random: use SipHash as interrupt entropy accumulator (Jason A. Donenfeld)   
  - random: replace custom notifier chain with standard one (Jason A. Donenfeld)   
  - random: don't let 644 read-only sysctls be written to (Jason A. Donenfeld)   
  - random: give sysctl_random_min_urandom_seed a more sensible value (Jason A. Donenfeld)   
  - random: do crng pre-init loading in worker rather than irq (Jason A. Donenfeld)   
  - random: unify cycles_t and jiffies usage and types (Jason A. Donenfeld)   
  - random: cleanup UUID handling (Jason A. Donenfeld)   
  - random: only wake up writers after zap if threshold was passed (Jason A. Donenfeld)   
  - random: round-robin registers as ulong, not u32 (Jason A. Donenfeld)   
  - random: pull add_hwgenerator_randomness() declaration into random.h (Jason A. Donenfeld)   
  - random: check for crng_init == 0 in add_device_randomness() (Jason A. Donenfeld)   
  - random: unify early init crng load accounting (Jason A. Donenfeld)   
  - random: do not take pool spinlock at boot (Jason A. Donenfeld)   
  - random: defer fast pool mixing to worker (Jason A. Donenfeld)   
  - random: rewrite header introductory comment (Jason A. Donenfeld)   
  - random: group sysctl functions (Jason A. Donenfeld)   
  - random: group userspace read/write functions (Jason A. Donenfeld)   
  - random: group entropy collection functions (Jason A. Donenfeld)   
  - random: group entropy extraction functions (Jason A. Donenfeld)   
  - random: remove useless header comment (Jason A. Donenfeld)   
  - random: introduce drain_entropy() helper to declutter crng_reseed() (Jason A. Donenfeld)   
  - random: deobfuscate irq u32/u64 contributions (Jason A. Donenfeld)   
  - random: add proper SPDX header (Jason A. Donenfeld)   
  - random: remove unused tracepoints (Jason A. Donenfeld)   
  - random: remove ifdef'd out interrupt bench (Jason A. Donenfeld)   
  - random: tie batched entropy generation to base_crng generation (Jason A. Donenfeld)   
  - random: zero buffer after reading entropy from userspace (Jason A. Donenfeld)   
  - random: remove outdated INT_MAX >> 6 check in urandom_read() (Jason A. Donenfeld)   
  - random: use hash function for crng_slow_load() (Jason A. Donenfeld)   
  - random: absorb fast pool into input pool after fast load (Jason A. Donenfeld)   
  - random: do not xor RDRAND when writing into /dev/random (Jason A. Donenfeld)   
  - random: ensure early RDSEED goes through mixer on init (Jason A. Donenfeld)   
  - random: inline leaves of rand_initialize() (Jason A. Donenfeld)   
  - random: use RDSEED instead of RDRAND in entropy extraction (Jason A. Donenfeld)   
  - random: fix locking in crng_fast_load() (Dominik Brodowski)   
  - random: remove batched entropy locking (Jason A. Donenfeld)   
  - random: remove use_input_pool parameter from crng_reseed() (Eric Biggers)   
  - random: make credit_entropy_bits() always safe (Jason A. Donenfeld)   
  - random: always wake up entropy writers after extraction (Jason A. Donenfeld)   
  - random: use linear min-entropy accumulation crediting (Jason A. Donenfeld)   
  - random: simplify entropy debiting (Jason A. Donenfeld)   
  - random: use computational hash for entropy extraction (Jason A. Donenfeld)   
  - random: only call crng_finalize_init() for primary_crng (Dominik Brodowski)   
  - random: access primary_pool directly rather than through pointer (Dominik Brodowski)   
  - random: continually use hwgenerator randomness (Dominik Brodowski)   
  - random: simplify arithmetic function flow in account() (Jason A. Donenfeld)   
  - random: access input_pool_data directly rather than through pointer (Jason A. Donenfeld)   
  - random: cleanup fractional entropy shift constants (Jason A. Donenfeld)   
  - random: prepend remaining pool constants with POOL_ (Jason A. Donenfeld)   
  - random: de-duplicate INPUT_POOL constants (Jason A. Donenfeld)   
  - random: remove unused OUTPUT_POOL constants (Jason A. Donenfeld)   
  - random: rather than entropy_store abstraction, use global (Jason A. Donenfeld)   
  - random: try to actively add entropy rather than passively wait for it (Linus Torvalds)   
  - random: remove unused extract_entropy() reserved argument (Jason A. Donenfeld)   
  - random: remove incomplete last_data logic (Jason A. Donenfeld)   
  - random: cleanup integer types (Jason A. Donenfeld)   
  - crypto: chacha20 - Fix chacha20_block() keystream alignment (again) (Eric Biggers)   
  - random: cleanup poolinfo abstraction (Jason A. Donenfeld)   
  - random: fix typo in comments (Schspa Shi)   
  - random: don't reset crng_init_cnt on urandom_read() (Jann Horn)   
  - random: avoid superfluous call to RDRAND in CRNG extraction (Jason A. Donenfeld)   
  - random: early initialization of ChaCha constants (Dominik Brodowski)   
  - random: initialize ChaCha20 constants with correct endianness (Eric Biggers)   
  - random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs (Jason A. Donenfeld)   
  - random: harmonize "crng init done" messages (Dominik Brodowski)   
  - random: mix bootloader randomness into pool (Jason A. Donenfeld)   
  - random: do not re-init if crng_reseed completes before primary init (Jason A. Donenfeld)   
  - random: do not sign extend bytes for rotation when mixing (Jason A. Donenfeld)   
  - random: use BLAKE2s instead of SHA1 in extraction (Jason A. Donenfeld)   
  - random: remove unused irq_flags argument from add_interrupt_randomness() (Saeed Mirzamohammadi)   
  - random: document add_hwgenerator_randomness() with other input functions (Mark Brown)   
  - crypto: blake2s - adjust include guard naming (Eric Biggers)   
  - crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h> (Eric Biggers)   
  - MAINTAINERS: co-maintain random.c (Jason A. Donenfeld)   
  - random: remove dead code left over from blocking pool (Eric Biggers)   
  - random: avoid arch_get_random_seed_long() when collecting IRQ randomness (Ard Biesheuvel)   
  - random: add arch_get_random_*long_early() (Mark Rutland)   
  - powerpc: Use bool in archrandom.h (Richard Henderson)   
  - linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check (Richard Henderson)   
  - linux/random.h: Use false with bool (Richard Henderson)   
  - linux/random.h: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - s390: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - powerpc: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - x86: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - random: avoid warnings for !CONFIG_NUMA builds (Mark Rutland)   
  - random: split primary/secondary crng init paths (Mark Rutland)   
  - random: remove some dead code of poolinfo (Yangtao Li)   
  - random: fix typo in add_timer_randomness() (Yangtao Li)   
  - random: Add and use pr_fmt() (Yangtao Li)   
  - random: convert to ENTROPY_BITS for better code readability (Yangtao Li)   
  - random: remove unnecessary unlikely() (Yangtao Li)   
  - random: remove kernel.random.read_wakeup_threshold (Andy Lutomirski)   
  - random: delete code to pull data into pools (Andy Lutomirski)   
  - random: remove the blocking pool (Andy Lutomirski)   
  - random: fix crash on multiple early calls to add_bootloader_randomness() (Dominik Brodowski)   
  - char/random: silence a lockdep splat with printk() (Sergey Senozhatsky)   
  - random: make /dev/random be almost like /dev/urandom (Andy Lutomirski)   
  - random: ignore GRND_RANDOM in getentropy(2) (Andy Lutomirski)   
  - random: add GRND_INSECURE to return best-effort non-cryptographic bytes (Andy Lutomirski)   
  - random: Add a urandom_read_nowait() for random APIs that don't warn (Andy Lutomirski)   
  - random: Don't wake crng_init_wait when crng_init == 1 (Andy Lutomirski)   
  - lib/crypto: sha1: re-roll loops to reduce code size (Jason A. Donenfeld)   
  - lib/crypto: blake2s: move hmac construction into wireguard (Jason A. Donenfeld)   
  - crypto: blake2s - generic C library implementation and selftest (Jason A. Donenfeld)   
  - crypto: Deduplicate le32_to_cpu_array() and cpu_to_le32_array() (Andy Shevchenko)   
  - Revert "hwrng: core - Freeze khwrng thread during suspend" (Herbert Xu)   
  - char/random: Add a newline at the end of the file (Borislav Petkov)   
  - random: Use wait_event_freezable() in add_hwgenerator_randomness() (Stephen Boyd)   
  - fdt: add support for rng-seed (Hsin-Yi Wang)   
  - random: Support freezable kthreads in add_hwgenerator_randomness() (Stephen Boyd)   
  - random: fix soft lockup when trying to read from an uninitialized blocking pool (Theodore Ts'o)   
  - latent_entropy: avoid build error when plugin cflags are not set (Vasily Gorbik)   
  - random: document get_random_int() family (George Spelvin)   
  - random: move rand_initialize() earlier (Kees Cook)   
  - random: only read from /dev/random after its pool has received 128 bits (Theodore Ts'o)   
  - drivers/char/random.c: make primary_crng static (Rasmus Villemoes)   
  - drivers/char/random.c: remove unused stuct poolinfo::poolbits (Rasmus Villemoes)   
  - drivers/char/random.c: constify poolinfo_table (Rasmus Villemoes)   
  - random: make CPU trust a boot parameter (Kees Cook)   
  - random: Make crng state queryable (Jason A. Donenfeld)   
  - random: remove preempt disabled region (Ingo Molnar)   
  - random: add a config option to trust the CPU's hwrng (Theodore Ts'o)   
  - random: Return nbytes filled from hw RNG (Tobin C. Harding)   
  - random: Fix whitespace pre random-bytes work (Tobin C. Harding)   
  - drivers/char/random.c: remove unused dont_count_entropy (Rasmus Villemoes)   
  - random: optimize add_interrupt_randomness (Andi Kleen)   
  - random: always fill buffer in get_random_bytes_wait (Jason A. Donenfeld)   
  - crypto: chacha20 - Fix keystream alignment for chacha20_block() (Eric Biggers)   
  - 9p: missing chunk of "fs/9p: Don't update file type when updating file attributes" (Al Viro)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.517.1.el7uek]
changelog:
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug: 34480752]  {CVE-2022-2588} 
  - Restore "module, async: async_synchronize_full() on module init iff async is used" (Mridula Shastry)  [Orabug: 34469834]  
  - net/rds: Replace #ifdef DEBUG with CONFIG_SLUB_DEBUG (Freddy Carrillo)  [Orabug: 34405766]  
  - ext4: Move to shared i_rwsem even without dioread_nolock mount opt (Ritesh Harjani)  [Orabug: 34295843]  
  - ext4: Start with shared i_rwsem in case of DIO instead of exclusive (Ritesh Harjani)  [Orabug: 34295843]  
  - ext4: further refactoring bufferio and dio helper (Junxiao Bi)  [Orabug: 34295843]  
  - ext4: refactor ext4_file_write_iter (Junxiao Bi)  [Orabug: 34295843]  
  - xen/manage: Use orderly_reboot() to reboot (Ross Lagerwall)  [Orabug: 34211118]  
  - xen/manage: revert "xen/manage: enable C_A_D to force reboot" (Dongli Zhang)  [Orabug: 34211118]  
  - Linux 4.14.288 (Greg Kroah-Hartman)   
  - dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate (Miaoqian Lin)   
  - dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (Miaoqian Lin)   
  - dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly (Michael Walle)   
  - ida: don't use BUG_ON() for debugging (Linus Torvalds)   
  - i2c: cadence: Unregister the clk notifier in error path (Satish Nagireddy)   
  - pinctrl: sunxi: a83t: Fix NAND function name for some pins (Samuel Holland)   
  - xfs: remove incorrect ASSERT in xfs_rename (Eric Sandeen)   
  - powerpc/powernv: delay rng platform device creation until later in boot (Jason A. Donenfeld)   
  - video: of_display_timing.h: include errno.h (Hsin-Yi Wang)   
  - fbcon: Disallow setting font bigger than screen size (Helge Deller)   
  - iommu/vt-d: Fix PCI bus rescan device hot add (Yian Chen)   
  - net: rose: fix UAF bug caused by rose_t0timer_expiry (Duoming Zhou)   
  - usbnet: fix memory leak in error case (Oliver Neukum)   
  - can: gs_usb: gs_usb_open/close(): fix memory leak (Rhett Aultman)   
  - can: grcan: grcan_probe(): remove extra of_node_get() (Liang He)   
  - mm/slub: add missing TID updates on slab deactivation (Jann Horn)   
  - esp: limit skb_page_frag_refill use to a single page (Sabrina Dubroca)   
  - Linux 4.14.287 (Greg Kroah-Hartman)   
  - xen/gntdev: Avoid blocking in unmap_grant_pages() (Demi Marie Obenour)   
  - net: usb: qmi_wwan: add Telit 0x1070 composition (Daniele Palmas)   
  - net: usb: qmi_wwan: add Telit 0x1060 composition (Carlo Lobrano)   
  - xen/arm: Fix race in RB-tree based P2M accounting (Oleksandr Tyshchenko)   
  - net: Rename and export copy_skb_header (Ilya Lesokhin)   
  - ipv6/sit: fix ipip6_tunnel_get_prl return value (katrinzhou)   
  - sit: use min (kernel test robot)   
  - hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails (Yang Yingliang)   
  - NFC: nxp-nci: Don't issue a zero length i2c_master_read() (Michael Walle)   
  - nfc: nfcmrvl: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - net: bonding: fix use-after-free after 802.3ad slave unbind (Yevhen Orlov)   
  - net: bonding: fix possible NULL deref in rlb code (Eric Dumazet)   
  - netfilter: nft_dynset: restore set element counter when failing to update (Pablo Neira Ayuso)   
  - caif_virtio: fix race between virtio_device_ready() and ndo_open() (Jason Wang)   
  - net: ipv6: unexport __init-annotated seg6_hmac_net_init() (YueHaibing)   
  - usbnet: fix memory allocation in helpers (Oliver Neukum)   
  - RDMA/qedr: Fix reporting QP timeout attribute (Kamal Heib)   
  - net: usb: ax88179_178a: Fix packet receiving (Jose Alonso)   
  - net: rose: fix UAF bugs caused by timer handler (Duoming Zhou)   
  - SUNRPC: Fix READ_PLUS crasher (Chuck Lever)   
  - s390/archrandom: simplify back to earlier design and initialize earlier (Jason A. Donenfeld)   
  - dm raid: fix KASAN warning in raid5_add_disks (Mikulas Patocka)   
  - dm raid: fix accesses beyond end of raid member array (Heinz Mauelshagen)   
  - nvdimm: Fix badblocks clear off-by-one error (Chris Ye)   
  - Linux 4.14.286 (Greg Kroah-Hartman)   
  - swiotlb: skip swiotlb_bounce when orig_addr is zero (Liu Shixin)   
  - kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] (Naveen N. Rao)   
  - fdt: Update CRC check for rng-seed (Hsin-Yi Wang)   
  - xen: unexport __init-annotated xen_xlate_map_ballooned_pages() (Masahiro Yamada)   
  - drm: remove drm_fb_helper_modinit (Christoph Hellwig)   
  - powerpc/pseries: wire up rng during setup_arch() (Jason A. Donenfeld)   
  - modpost: fix section mismatch check for exported init/exit sections (Masahiro Yamada)   
  - ARM: cns3xxx: Fix refcount leak in cns3xxx_init (Miaoqian Lin)   
  - ARM: Fix refcount leak in axxia_boot_secondary (Miaoqian Lin)   
  - ARM: exynos: Fix refcount leak in exynos_map_pmu (Miaoqian Lin)   
  - ARM: dts: imx6qdl: correct PU regulator ramp delay (Lucas Stach)   
  - powerpc/powernv: wire up rng during setup_arch (Jason A. Donenfeld)   
  - powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address (Andrew Donnellan)   
  - powerpc: Enable execve syscall exit tracepoint (Naveen N. Rao)   
  - xtensa: Fix refcount leak bug in time.c (Liang He)   
  - xtensa: xtfpga: Fix refcount leak bug in setup (Liang He)   
  - iio: adc: axp288: Override TS pin bias current for some models (Hans de Goede)   
  - iio: trigger: sysfs: fix use-after-free on remove (Vincent Whitchurch)   
  - iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up() (Zheyu Ma)   
  - iio: accel: mma8452: ignore the return value of reset operation (Haibo Chen)   
  - iio:accel:bma180: rearrange iio trigger get and register (Dmitry Rokosov)   
  - usb: chipidea: udc: check request status before setting device address (Xu Yang)   
  - iio: adc: vf610: fix conversion mode sysfs node name (Baruch Siach)   
  - igb: Make DMA faster when CPU is active on the PCIe link (Kai-Heng Feng)   
  - MIPS: Remove repetitive increase irq_err_count (huhai)   
  - x86/xen: Remove undefined behavior in setup_features() (Julien Grall)   
  - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers (Jay Vosburgh)   
  - USB: serial: option: add Quectel RM500K module support (Macpaul Lin)   
  - USB: serial: option: add Quectel EM05-G modem (Yonglin Tan)   
  - USB: serial: option: add Telit LE910Cx 0x1250 composition (Carlo Lobrano)   
  - random: quiet urandom warning ratelimit suppression message (Jason A. Donenfeld)   
  - dm era: commit metadata in postsuspend after worker stops (Nikos Tsironis)   
  - ata: libata: add qc->flags in ata_qc_complete_template tracepoint (Edward Wu)   
  - random: schedule mix_interrupt_randomness() less often (Jason A. Donenfeld)   
  - vt: drop old FONT ioctls (Jiri Slaby)   
  - Linux 4.14.285 (Greg Kroah-Hartman)   
  - tcp: drop the hash_32() part from the index calculation (Willy Tarreau)   
  - tcp: increase source port perturb table to 2^16 (Willy Tarreau)   
  - tcp: dynamically allocate the perturb table used by source ports (Willy Tarreau)   
  - tcp: add small random increments to the source port (Willy Tarreau)   
  - tcp: use different parts of the port_offset for index and offset (Willy Tarreau)   
  - tcp: add some entropy in __inet_hash_connect() (Eric Dumazet)   
  - xprtrdma: fix incorrect header size calculations (Colin Ian King)   
  - usb: gadget: u_ether: fix regression in setting fixed MAC address (Marian Postevca)   
  - s390/mm: use non-quiescing sske for KVM switch to keyed guest (Christian Borntraeger)   
  - virtio-pci: Remove wrong address verification in vp_del_vqs() (Murilo Opsfelder Araujo)   
  - ext4: add reserved GDT blocks check (Zhang Yi)   
  - ext4: make variable "count" signed (Ding Xiang)   
  - ext4: fix bug_on ext4_mb_use_inode_pa (Baokun Li)   
  - serial: 8250: Store to lsr_save_flags after lsr read (Ilpo Järvinen)   
  - usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe (Miaoqian Lin)   
  - usb: dwc2: Fix memory leak in dwc2_hcd_init (Miaoqian Lin)   
  - USB: serial: io_ti: add Agilent E5805A support (Robert Eckelmann)   
  - USB: serial: option: add support for Cinterion MV31 with new baseline (Slark Xiao)   
  - comedi: vmk80xx: fix expression for tx buffer size (Ian Abbott)   
  - irqchip/gic/realview: Fix refcount leak in realview_gic_of_init (Miaoqian Lin)   
  - certs/blacklist_hashes.c: fix const confusion in certs blacklist (Masahiro Yamada)   
  - arm64: ftrace: fix branch range checks (Mark Rutland)   
  - net: bgmac: Fix an erroneous kfree() in bgmac_remove() (Christophe JAILLET)   
  - misc: atmel-ssc: Fix IRQ check in ssc_probe (Miaoqian Lin)   
  - tty: goldfish: Fix free_irq() on remove (Vincent Whitchurch)   
  - i40e: Fix call trace in setup_tx_descriptors (Aleksandr Loktionov)   
  - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE (Trond Myklebust)   
  - random: credit cpu and bootloader seeds by default (Jason A. Donenfeld)   
  - net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag (Chen Lin)   
  - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (Wang Yufen)   
  - nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (Xiaohui Zhang)   
  - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed (chengkaitao)   
  - scsi: pmcraid: Fix missing resource cleanup in error case (Chengguang Xu)   
  - scsi: ipr: Fix missing/incorrect resource cleanup in error case (Chengguang Xu)   
  - scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology (James Smart)   
  - scsi: vmw_pvscsi: Expand vcpuHint to 16 bits (Wentao Wang)   
  - ASoC: wm8962: Fix suspend while playing music (Adam Ford)   
  - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (Sergey Shtylyov)   
  - ASoC: cs42l56: Correct typo in minimum level for SX volume controls (Charles Keepax)   
  - ASoC: cs42l52: Correct TLV for Bypass Volume (Charles Keepax)   
  - ASoC: cs53l30: Correct number of volume levels on SX controls (Charles Keepax)   
  - ASoC: cs42l52: Fix TLV scales for mixer controls (Charles Keepax)   
  - random: account for arch randomness in bits (Jason A. Donenfeld)   
  - random: mark bootloader randomness code as __init (Jason A. Donenfeld)   
  - random: avoid checking crng_ready() twice in random_init() (Jason A. Donenfeld)   
  - crypto: drbg - make reseeding from get_random_bytes() synchronous (Nicolai Stange)   
  - crypto: drbg - always try to free Jitter RNG instance (Stephan Müller)   
  - crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed() (Nicolai Stange)   
  - crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() (Nicolai Stange)   
  - crypto: drbg - prepare for more fine-grained tracking of seeding state (Nicolai Stange)   
  - crypto: drbg - always seeded with SP800-90B compliant noise source (Stephan Müller)   
  - crypto: drbg - add FIPS 140-2 CTRNG for noise source (Stephan Mueller)   
  - Revert "random: use static branch for crng_ready()" (Jason A. Donenfeld)   
  - random: check for signals after page of pool writes (Jason A. Donenfeld)   
  - random: wire up fops->splice_{read,write}_iter() (Jens Axboe)   
  - random: convert to using fops->write_iter() (Jens Axboe)   
  - random: move randomize_page() into mm where it belongs (Jason A. Donenfeld)   
  - random: move initialization functions out of hot pages (Jason A. Donenfeld)   
  - random: use proper jiffies comparison macro (Jason A. Donenfeld)   
  - random: use symbolic constants for crng_init states (Jason A. Donenfeld)   
  - siphash: use one source of truth for siphash permutations (Jason A. Donenfeld)   
  - random: help compiler out with fast_mix() by using simpler arguments (Jason A. Donenfeld)   
  - random: do not use input pool from hard IRQs (Saeed Mirzamohammadi)   
  - random: order timer entropy functions below interrupt functions (Jason A. Donenfeld)   
  - random: do not pretend to handle premature next security model (Jason A. Donenfeld)   
  - random: do not use batches when !crng_ready() (Jason A. Donenfeld)   
  - random: insist on random_get_entropy() existing in order to simplify (Jason A. Donenfeld)   
  - xtensa: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - sparc: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - um: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - x86/tsc: Use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - nios2: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - arm: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - mips: use fallback for random_get_entropy() instead of just c0 random (Jason A. Donenfeld)   
  - m68k: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - timekeeping: Add raw clock fallback for random_get_entropy() (Jason A. Donenfeld)   
  - powerpc: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - alpha: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - parisc: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - s390: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - ia64: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - init: call time_init() before rand_initialize() (Jason A. Donenfeld)   
  - random: fix sysctl documentation nits (Jason A. Donenfeld)   
  - random: document crng_fast_key_erasure() destination possibility (Jason A. Donenfeld)   
  - random: make random_get_entropy() return an unsigned long (Jason A. Donenfeld)   
  - random: check for signals every PAGE_SIZE chunk of /dev/[u]random (Jason A. Donenfeld)   
  - random: check for signal_pending() outside of need_resched() check (Jann Horn)   
  - random: do not allow user to keep crng key around on stack (Jason A. Donenfeld)   
  - random: do not split fast init input in add_hwgenerator_randomness() (Jan Varho)   
  - random: mix build-time latent entropy into pool at init (Jason A. Donenfeld)   
  - random: re-add removed comment about get_random_{u32,u64} reseeding (Jason A. Donenfeld)   
  - random: treat bootloader trust toggle the same way as cpu trust toggle (Jason A. Donenfeld)   
  - random: skip fast_init if hwrng provides large chunk of entropy (Jason A. Donenfeld)   
  - random: check for signal and try earlier when generating entropy (Jason A. Donenfeld)   
  - random: reseed more often immediately after booting (Jason A. Donenfeld)   
  - random: make consistent usage of crng_ready() (Jason A. Donenfeld)   
  - random: use SipHash as interrupt entropy accumulator (Jason A. Donenfeld)   
  - random: replace custom notifier chain with standard one (Jason A. Donenfeld)   
  - random: don't let 644 read-only sysctls be written to (Jason A. Donenfeld)   
  - random: give sysctl_random_min_urandom_seed a more sensible value (Jason A. Donenfeld)   
  - random: do crng pre-init loading in worker rather than irq (Jason A. Donenfeld)   
  - random: unify cycles_t and jiffies usage and types (Jason A. Donenfeld)   
  - random: cleanup UUID handling (Jason A. Donenfeld)   
  - random: only wake up writers after zap if threshold was passed (Jason A. Donenfeld)   
  - random: round-robin registers as ulong, not u32 (Jason A. Donenfeld)   
  - random: pull add_hwgenerator_randomness() declaration into random.h (Jason A. Donenfeld)   
  - random: check for crng_init == 0 in add_device_randomness() (Jason A. Donenfeld)   
  - random: unify early init crng load accounting (Jason A. Donenfeld)   
  - random: do not take pool spinlock at boot (Jason A. Donenfeld)   
  - random: defer fast pool mixing to worker (Jason A. Donenfeld)   
  - random: rewrite header introductory comment (Jason A. Donenfeld)   
  - random: group sysctl functions (Jason A. Donenfeld)   
  - random: group userspace read/write functions (Jason A. Donenfeld)   
  - random: group entropy collection functions (Jason A. Donenfeld)   
  - random: group entropy extraction functions (Jason A. Donenfeld)   
  - random: remove useless header comment (Jason A. Donenfeld)   
  - random: introduce drain_entropy() helper to declutter crng_reseed() (Jason A. Donenfeld)   
  - random: deobfuscate irq u32/u64 contributions (Jason A. Donenfeld)   
  - random: add proper SPDX header (Jason A. Donenfeld)   
  - random: remove unused tracepoints (Jason A. Donenfeld)   
  - random: remove ifdef'd out interrupt bench (Jason A. Donenfeld)   
  - random: tie batched entropy generation to base_crng generation (Jason A. Donenfeld)   
  - random: zero buffer after reading entropy from userspace (Jason A. Donenfeld)   
  - random: remove outdated INT_MAX >> 6 check in urandom_read() (Jason A. Donenfeld)   
  - random: use hash function for crng_slow_load() (Jason A. Donenfeld)   
  - random: absorb fast pool into input pool after fast load (Jason A. Donenfeld)   
  - random: do not xor RDRAND when writing into /dev/random (Jason A. Donenfeld)   
  - random: ensure early RDSEED goes through mixer on init (Jason A. Donenfeld)   
  - random: inline leaves of rand_initialize() (Jason A. Donenfeld)   
  - random: use RDSEED instead of RDRAND in entropy extraction (Jason A. Donenfeld)   
  - random: fix locking in crng_fast_load() (Dominik Brodowski)   
  - random: remove batched entropy locking (Jason A. Donenfeld)   
  - random: remove use_input_pool parameter from crng_reseed() (Eric Biggers)   
  - random: make credit_entropy_bits() always safe (Jason A. Donenfeld)   
  - random: always wake up entropy writers after extraction (Jason A. Donenfeld)   
  - random: use linear min-entropy accumulation crediting (Jason A. Donenfeld)   
  - random: simplify entropy debiting (Jason A. Donenfeld)   
  - random: use computational hash for entropy extraction (Jason A. Donenfeld)   
  - random: only call crng_finalize_init() for primary_crng (Dominik Brodowski)   
  - random: access primary_pool directly rather than through pointer (Dominik Brodowski)   
  - random: continually use hwgenerator randomness (Dominik Brodowski)   
  - random: simplify arithmetic function flow in account() (Jason A. Donenfeld)   
  - random: access input_pool_data directly rather than through pointer (Jason A. Donenfeld)   
  - random: cleanup fractional entropy shift constants (Jason A. Donenfeld)   
  - random: prepend remaining pool constants with POOL_ (Jason A. Donenfeld)   
  - random: de-duplicate INPUT_POOL constants (Jason A. Donenfeld)   
  - random: remove unused OUTPUT_POOL constants (Jason A. Donenfeld)   
  - random: rather than entropy_store abstraction, use global (Jason A. Donenfeld)   
  - random: try to actively add entropy rather than passively wait for it (Linus Torvalds)   
  - random: remove unused extract_entropy() reserved argument (Jason A. Donenfeld)   
  - random: remove incomplete last_data logic (Jason A. Donenfeld)   
  - random: cleanup integer types (Jason A. Donenfeld)   
  - crypto: chacha20 - Fix chacha20_block() keystream alignment (again) (Eric Biggers)   
  - random: cleanup poolinfo abstraction (Jason A. Donenfeld)   
  - random: fix typo in comments (Schspa Shi)   
  - random: don't reset crng_init_cnt on urandom_read() (Jann Horn)   
  - random: avoid superfluous call to RDRAND in CRNG extraction (Jason A. Donenfeld)   
  - random: early initialization of ChaCha constants (Dominik Brodowski)   
  - random: initialize ChaCha20 constants with correct endianness (Eric Biggers)   
  - random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs (Jason A. Donenfeld)   
  - random: harmonize "crng init done" messages (Dominik Brodowski)   
  - random: mix bootloader randomness into pool (Jason A. Donenfeld)   
  - random: do not re-init if crng_reseed completes before primary init (Jason A. Donenfeld)   
  - random: do not sign extend bytes for rotation when mixing (Jason A. Donenfeld)   
  - random: use BLAKE2s instead of SHA1 in extraction (Jason A. Donenfeld)   
  - random: remove unused irq_flags argument from add_interrupt_randomness() (Saeed Mirzamohammadi)   
  - random: document add_hwgenerator_randomness() with other input functions (Mark Brown)   
  - crypto: blake2s - adjust include guard naming (Eric Biggers)   
  - crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h> (Eric Biggers)   
  - MAINTAINERS: co-maintain random.c (Jason A. Donenfeld)   
  - random: remove dead code left over from blocking pool (Eric Biggers)   
  - random: avoid arch_get_random_seed_long() when collecting IRQ randomness (Ard Biesheuvel)   
  - random: add arch_get_random_*long_early() (Mark Rutland)   
  - powerpc: Use bool in archrandom.h (Richard Henderson)   
  - linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check (Richard Henderson)   
  - linux/random.h: Use false with bool (Richard Henderson)   
  - linux/random.h: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - s390: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - powerpc: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - x86: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - random: avoid warnings for !CONFIG_NUMA builds (Mark Rutland)   
  - random: split primary/secondary crng init paths (Mark Rutland)   
  - random: remove some dead code of poolinfo (Yangtao Li)   
  - random: fix typo in add_timer_randomness() (Yangtao Li)   
  - random: Add and use pr_fmt() (Yangtao Li)   
  - random: convert to ENTROPY_BITS for better code readability (Yangtao Li)   
  - random: remove unnecessary unlikely() (Yangtao Li)   
  - random: remove kernel.random.read_wakeup_threshold (Andy Lutomirski)   
  - random: delete code to pull data into pools (Andy Lutomirski)   
  - random: remove the blocking pool (Andy Lutomirski)   
  - random: fix crash on multiple early calls to add_bootloader_randomness() (Dominik Brodowski)   
  - char/random: silence a lockdep splat with printk() (Sergey Senozhatsky)   
  - random: make /dev/random be almost like /dev/urandom (Andy Lutomirski)   
  - random: ignore GRND_RANDOM in getentropy(2) (Andy Lutomirski)   
  - random: add GRND_INSECURE to return best-effort non-cryptographic bytes (Andy Lutomirski)   
  - random: Add a urandom_read_nowait() for random APIs that don't warn (Andy Lutomirski)   
  - random: Don't wake crng_init_wait when crng_init == 1 (Andy Lutomirski)   
  - lib/crypto: sha1: re-roll loops to reduce code size (Jason A. Donenfeld)   
  - lib/crypto: blake2s: move hmac construction into wireguard (Jason A. Donenfeld)   
  - crypto: blake2s - generic C library implementation and selftest (Jason A. Donenfeld)   
  - crypto: Deduplicate le32_to_cpu_array() and cpu_to_le32_array() (Andy Shevchenko)   
  - Revert "hwrng: core - Freeze khwrng thread during suspend" (Herbert Xu)   
  - char/random: Add a newline at the end of the file (Borislav Petkov)   
  - random: Use wait_event_freezable() in add_hwgenerator_randomness() (Stephen Boyd)   
  - fdt: add support for rng-seed (Hsin-Yi Wang)   
  - random: Support freezable kthreads in add_hwgenerator_randomness() (Stephen Boyd)   
  - random: fix soft lockup when trying to read from an uninitialized blocking pool (Theodore Ts'o)   
  - latent_entropy: avoid build error when plugin cflags are not set (Vasily Gorbik)   
  - random: document get_random_int() family (George Spelvin)   
  - random: move rand_initialize() earlier (Kees Cook)   
  - random: only read from /dev/random after its pool has received 128 bits (Theodore Ts'o)   
  - drivers/char/random.c: make primary_crng static (Rasmus Villemoes)   
  - drivers/char/random.c: remove unused stuct poolinfo::poolbits (Rasmus Villemoes)   
  - drivers/char/random.c: constify poolinfo_table (Rasmus Villemoes)   
  - random: make CPU trust a boot parameter (Kees Cook)   
  - random: Make crng state queryable (Jason A. Donenfeld)   
  - random: remove preempt disabled region (Ingo Molnar)   
  - random: add a config option to trust the CPU's hwrng (Theodore Ts'o)   
  - random: Return nbytes filled from hw RNG (Tobin C. Harding)   
  - random: Fix whitespace pre random-bytes work (Tobin C. Harding)   
  - drivers/char/random.c: remove unused dont_count_entropy (Rasmus Villemoes)   
  - random: optimize add_interrupt_randomness (Andi Kleen)   
  - random: always fill buffer in get_random_bytes_wait (Jason A. Donenfeld)   
  - crypto: chacha20 - Fix keystream alignment for chacha20_block() (Eric Biggers)   
  - 9p: missing chunk of "fs/9p: Don't update file type when updating file attributes" (Al Viro)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.517.2.el7uek]
changelog:
  - kernfs: Replace global kernfs_open_file_mutex with hashed mutexes. (Imran Khan)  [Orabug: 34476942]  
  - kernfs: Introduce interface to access global kernfs_open_file_mutex. (Imran Khan)  [Orabug: 34476942]  
  - kernfs: make ->attr.open RCU protected. (Imran Khan)  [Orabug: 34476942]  
  - kernfs: Rename kernfs_put_open_node to kernfs_unlink_open_file. (Imran Khan)  [Orabug: 34476942]  
  - kernfs: Remove reference counting for kernfs_open_node. (Imran Khan)  [Orabug: 34476942]  
  - rds/ib: handle posted ACK during connection shutdown (Rohit Nair)  [Orabug: 34465810]  
  - rds/ib: reap tx completions during connection shutdown (Rohit Nair)  [Orabug: 34465810]  
  - scsi: target: Fix WRITE_SAME No Data Buffer crash (Mike Christie)  [Orabug: 34419972]  {CVE-2022-21546} 
  - rds/rdma: destroy CQs during user initiated rds connection resets (Rohit Nair)  [Orabug: 34414240]  
  - rds: copy_from_user only once per rds_sendmsg system call (Hans Westgaard Ry)  [Orabug: 34510858]  {CVE-2022-21385}


author: John Donnelly <john.p.donnelly@oracle.com> [4.14.35-2047.517.3.el7uek]
changelog:
  - KVM: x86: use raw clock values consistently (Paolo Bonzini)  [Orabug: 34575637]  
  - KVM: x86: reorganize pvclock_gtod_data members (Paolo Bonzini)  [Orabug: 34575637]  
  - KVM: x86: switch KVMCLOCK base to monotonic raw clock (Marcelo Tosatti)  [Orabug: 34575637]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.518.0.el7uek]
changelog:
  - lockdown: also lock down previous kgdb use (Daniel Thompson)  [Orabug: 34543517]  {CVE-2022-21499} 
  - Revert "debug: Lock down kgdb" (Alok Tiwari)  [Orabug: 34543517]  {CVE-2022-21499} 
  - vmcoreinfo: add kallsyms_num_syms symbol (Stephen Brennan)  [Orabug: 34475880]  
  - vmcoreinfo: include kallsyms symbols (Stephen Brennan)  [Orabug: 34475880]  
  - kallsyms: move declarations to internal header (Stephen Brennan)  [Orabug: 34475880]  
  - mpt3sas: avoid SOFT_RESET on shutdown (John Donnelly)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Update driver version to 39.100.00.00 (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Use firmware recommended queue depth (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Transition IOC to Ready state during shutdown (Sreekanth Reddy)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix fall-through warnings for Clang (Gustavo A. R. Silva)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Handle firmware faults during first half of IOC init (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix deadlock while cancelling the running firmware event (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Documentation cleanup (Randy Dunlap)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix timeouts observed while reenabling IRQ (Sreekanth Reddy)  [Orabug: 34408138]  
  - scsi: mpt3sas: Fix two kernel-doc headers (Bart Van Assche)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix out-of-bounds warnings in _ctl_addnl_diag_query (Gustavo A. R. Silva)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix endianness for ActiveCablePowerRequirement (Sreekanth Reddy)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Only one vSES is present even when IOC has multi vSES (Sreekanth Reddy)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix a typo (Bhaskar Chowdhury)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix a few kernel-doc issues (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force reply post buffer allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force reply buffer allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force sense buffer allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force chain buffer allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Replace unnecessary dynamic allocation with a static one (Gustavo A. R. Silva)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Do not use GFP_KERNEL in atomic context (Christophe JAILLET)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix some kernel-doc misnaming issues (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix a couple of misdocumented functions/params (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix a bunch of potential naming doc-rot (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Move a little data from the stack onto the heap (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix misspelling of _base_put_smid_default_atomic() (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Additional diagnostic buffer query interface (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix ReplyPostFree pool allocation (Sreekanth Reddy)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Simplify bool comparison (YANG LI)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix spelling mistake in Kconfig "compatiblity" -> "compatibility" (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Signedness bug in _base_get_diag_triggers() (Dan Carpenter)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Block PCI config access from userspace during reset (Sreekanth Reddy)  [Orabug: 34408138]  
  - Linux 4.14.290 (Greg Kroah-Hartman)   
  - PCI: hv: Fix interrupt mapping for multi-MSI (Jeffrey Hugo)   
  - PCI: hv: Reuse existing IRTE allocation in compose_msi_msg() (Jeffrey Hugo)   
  - PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI (Jeffrey Hugo)   
  - PCI: hv: Fix multi-MSI to allow more than one MSI vector (Jeffrey Hugo)   
  - net: usb: ax88179_178a needs FLAG_SEND_ZLP (Jose Alonso)   
  - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() (Jiri Slaby)   
  - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push() (Jiri Slaby)   
  - tty: drop tty_schedule_flip() (Jiri Slaby)   
  - tty: the rest, stop using tty_schedule_flip() (Jiri Slaby)   
  - tty: drivers/tty/, stop using tty_schedule_flip() (Jiri Slaby)   
  - Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks (Luiz Augusto von Dentz)   
  - Bluetooth: SCO: Fix sco_send_frame returning skb->len (Luiz Augusto von Dentz)   
  - Bluetooth: Fix passing NULL to PTR_ERR (Luiz Augusto von Dentz)   
  - Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg (Luiz Augusto von Dentz)   
  - Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg (Luiz Augusto von Dentz)   
  - Bluetooth: Add bt_skb_sendmmsg helper (Luiz Augusto von Dentz)   
  - Bluetooth: Add bt_skb_sendmsg helper (Luiz Augusto von Dentz)   
  - ALSA: memalloc: Align buffer allocations in page size (Takashi Iwai)   
  - tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - drm/tilcdc: Remove obsolete crtc_mode_valid() hack (Jyri Sarha)   
  - bpf: Make sure mac_header was set before using it (Eric Dumazet)   
  - mm/mempolicy: fix uninit-value in mpol_rebind_policy() (Wang Cheng)   
  - Revert "Revert "char/random: silence a lockdep splat with printk()"" (Jason A. Donenfeld)   
  - be2net: Fix buffer overflow in be_get_module_eeprom (Hristo Venev)   
  - tcp: Fix a data-race around sysctl_tcp_notsent_lowat. (Kuniyuki Iwashima)   
  - igmp: Fix a data-race around sysctl_igmp_max_memberships. (Kuniyuki Iwashima)   
  - igmp: Fix data-races around sysctl_igmp_llm_reports. (Kuniyuki Iwashima)   
  - net: stmmac: fix dma queue left shift overflow issue (Junxiao Chang)   
  - i2c: cadence: Change large transfer count reset logic to be unconditional (Robert Hancock)   
  - tcp: Fix a data-race around sysctl_tcp_probe_interval. (Kuniyuki Iwashima)   
  - tcp: Fix a data-race around sysctl_tcp_probe_threshold. (Kuniyuki Iwashima)   
  - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. (Kuniyuki Iwashima)   
  - ip: Fix a data-race around sysctl_fwmark_reflect. (Kuniyuki Iwashima)   
  - perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() (Peter Zijlstra)   
  - power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe (Miaoqian Lin)   
  - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup() (Hangyu Hua)   
  - xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE (Demi Marie Obenour)   
  - Linux 4.14.289 (Greg Kroah-Hartman)   
  - can: m_can: m_can_tx_handler(): fix use after free of skb (Marc Kleine-Budde)   
  - mm: invalidate hwpoison page cache page in fault path (Rik van Riel)   
  - serial: 8250: fix return error code in serial8250_request_std_resource() (Yi Yang)   
  - tty: serial: samsung_tty: set dma burst_size to 1 (Chanho Park)   
  - usb: dwc3: gadget: Fix event pending check (Thinh Nguyen)   
  - USB: serial: ftdi_sio: add Belimo device ids (Lucien Buchmann)   
  - signal handling: don't use BUG_ON() for debugging (Linus Torvalds)   
  - x86: Clear .brk area at early boot (Juergen Gross)   
  - irqchip: or1k-pic: Undefine mask_ack for level triggered hardware (Stafford Horne)   
  - ASoC: wm5110: Fix DRE control (Charles Keepax)   
  - ASoC: ops: Fix off by one in range control validation (Mark Brown)   
  - net: sfp: fix memory leak in sfp_probe() (Jianglei Nie)   
  - NFC: nxp-nci: don't print header length mismatch on i2c error (Michael Walle)   
  - net: tipc: fix possible refcount leak in tipc_sk_create() (Hangyu Hua)   
  - platform/x86: hp-wmi: Ignore Sanitization Mode event (Kai-Heng Feng)   
  - cpufreq: pmac32-cpufreq: Fix refcount leak bug (Liang He)   
  - netfilter: br_netfilter: do not skip all hooks with 0 priority (Florian Westphal)   
  - virtio_mmio: Restore guest page size on resume (Stephan Gerhold)   
  - virtio_mmio: Add missing PM calls to freeze/restore (Stephan Gerhold)   
  - sfc: fix kernel panic when creating VF (Íñigo Huguet)   
  - seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors (Andrea Mayer)   
  - seg6: fix skb checksum evaluation in SRH encapsulation/insertion (Andrea Mayer)   
  - sfc: fix use after free when disabling sriov (Íñigo Huguet)   
  - ipv4: Fix data-races around sysctl_ip_dynaddr. (Kuniyuki Iwashima)   
  - icmp: Fix a data-race around sysctl_icmp_ratemask. (Kuniyuki Iwashima)   
  - icmp: Fix a data-race around sysctl_icmp_ratelimit. (Kuniyuki Iwashima)   
  - ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero (Michal Suchanek)   
  - icmp: Fix data-races around sysctl. (Kuniyuki Iwashima)   
  - cipso: Fix data-races around sysctl. (Kuniyuki Iwashima)   
  - net: Fix data-races around sysctl_mem. (Kuniyuki Iwashima)   
  - inetpeer: Fix data-races around sysctl. (Kuniyuki Iwashima)   
  - ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (Ard Biesheuvel)   
  - xhci: make xhci_handshake timeout for xhci_reset() adjustable (Mathias Nyman)   
  - xhci: bail out early if driver can't accress host in resume (Mathias Nyman)   
  - net: dsa: bcm_sf2: force pause link settings (Doug Berger)   
  - nilfs2: fix incorrect masking of permission flags for symlinks (Ryusuke Konishi)   
  - cgroup: Use separate src/dst nodes when preloading css_sets for migration (Tejun Heo)   
  - ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction (Ard Biesheuvel)   
  - ARM: 9213/1: Print message about disabled Spectre workarounds only once (Dmitry Osipenko)   
  - net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer (Steven Rostedt (Google))   
  - xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue (Juergen Gross)   
  - ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (Meng Tang)   
  - ALSA: hda - Add fixup for Dell Latitidue E5430 (Meng Tang)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.518.0.el7uek]
changelog:
  - lockdown: also lock down previous kgdb use (Daniel Thompson)  [Orabug: 34543517]  {CVE-2022-21499} 
  - Revert "debug: Lock down kgdb" (Alok Tiwari)  [Orabug: 34543517]  
  - vmcoreinfo: add kallsyms_num_syms symbol (Stephen Brennan)  [Orabug: 34475880]  
  - vmcoreinfo: include kallsyms symbols (Stephen Brennan)  [Orabug: 34475880]  
  - kallsyms: move declarations to internal header (Stephen Brennan)  [Orabug: 34475880]  
  - mpt3sas: avoid SOFT_RESET on shutdown (John Donnelly)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Update driver version to 39.100.00.00 (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Use firmware recommended queue depth (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Transition IOC to Ready state during shutdown (Sreekanth Reddy)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix fall-through warnings for Clang (Gustavo A. R. Silva)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Handle firmware faults during first half of IOC init (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix deadlock while cancelling the running firmware event (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Documentation cleanup (Randy Dunlap)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix timeouts observed while reenabling IRQ (Sreekanth Reddy)  [Orabug: 34408138]  
  - scsi: mpt3sas: Fix two kernel-doc headers (Bart Van Assche)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix out-of-bounds warnings in _ctl_addnl_diag_query (Gustavo A. R. Silva)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix endianness for ActiveCablePowerRequirement (Sreekanth Reddy)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Only one vSES is present even when IOC has multi vSES (Sreekanth Reddy)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix a typo (Bhaskar Chowdhury)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix a few kernel-doc issues (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force reply post buffer allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force reply buffer allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force sense buffer allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force chain buffer allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Replace unnecessary dynamic allocation with a static one (Gustavo A. R. Silva)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Do not use GFP_KERNEL in atomic context (Christophe JAILLET)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix some kernel-doc misnaming issues (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix a couple of misdocumented functions/params (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix a bunch of potential naming doc-rot (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Move a little data from the stack onto the heap (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix misspelling of _base_put_smid_default_atomic() (Lee Jones)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Additional diagnostic buffer query interface (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix ReplyPostFree pool allocation (Sreekanth Reddy)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Simplify bool comparison (YANG LI)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Fix spelling mistake in Kconfig "compatiblity" -> "compatibility" (Suganath Prabu S)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Signedness bug in _base_get_diag_triggers() (Dan Carpenter)  [Orabug: 33666018] [Orabug: 34408138]  
  - scsi: mpt3sas: Block PCI config access from userspace during reset (Sreekanth Reddy)  [Orabug: 34408138]  
  - Linux 4.14.290 (Greg Kroah-Hartman)   
  - PCI: hv: Fix interrupt mapping for multi-MSI (Jeffrey Hugo)   
  - PCI: hv: Reuse existing IRTE allocation in compose_msi_msg() (Jeffrey Hugo)   
  - PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI (Jeffrey Hugo)   
  - PCI: hv: Fix multi-MSI to allow more than one MSI vector (Jeffrey Hugo)   
  - net: usb: ax88179_178a needs FLAG_SEND_ZLP (Jose Alonso)   
  - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() (Jiri Slaby)   
  - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push() (Jiri Slaby)   
  - tty: drop tty_schedule_flip() (Jiri Slaby)   
  - tty: the rest, stop using tty_schedule_flip() (Jiri Slaby)   
  - tty: drivers/tty/, stop using tty_schedule_flip() (Jiri Slaby)   
  - Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks (Luiz Augusto von Dentz)   
  - Bluetooth: SCO: Fix sco_send_frame returning skb->len (Luiz Augusto von Dentz)   
  - Bluetooth: Fix passing NULL to PTR_ERR (Luiz Augusto von Dentz)   
  - Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg (Luiz Augusto von Dentz)   
  - Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg (Luiz Augusto von Dentz)   
  - Bluetooth: Add bt_skb_sendmmsg helper (Luiz Augusto von Dentz)   
  - Bluetooth: Add bt_skb_sendmsg helper (Luiz Augusto von Dentz)   
  - ALSA: memalloc: Align buffer allocations in page size (Takashi Iwai)   
  - tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - drm/tilcdc: Remove obsolete crtc_mode_valid() hack (Jyri Sarha)   
  - bpf: Make sure mac_header was set before using it (Eric Dumazet)   
  - mm/mempolicy: fix uninit-value in mpol_rebind_policy() (Wang Cheng)   
  - Revert "Revert "char/random: silence a lockdep splat with printk()"" (Jason A. Donenfeld)   
  - be2net: Fix buffer overflow in be_get_module_eeprom (Hristo Venev)   
  - tcp: Fix a data-race around sysctl_tcp_notsent_lowat. (Kuniyuki Iwashima)   
  - igmp: Fix a data-race around sysctl_igmp_max_memberships. (Kuniyuki Iwashima)   
  - igmp: Fix data-races around sysctl_igmp_llm_reports. (Kuniyuki Iwashima)   
  - net: stmmac: fix dma queue left shift overflow issue (Junxiao Chang)   
  - i2c: cadence: Change large transfer count reset logic to be unconditional (Robert Hancock)   
  - tcp: Fix a data-race around sysctl_tcp_probe_interval. (Kuniyuki Iwashima)   
  - tcp: Fix a data-race around sysctl_tcp_probe_threshold. (Kuniyuki Iwashima)   
  - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. (Kuniyuki Iwashima)   
  - ip: Fix a data-race around sysctl_fwmark_reflect. (Kuniyuki Iwashima)   
  - perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() (Peter Zijlstra)   
  - power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe (Miaoqian Lin)   
  - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup() (Hangyu Hua)   
  - xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE (Demi Marie Obenour)   
  - Linux 4.14.289 (Greg Kroah-Hartman)   
  - can: m_can: m_can_tx_handler(): fix use after free of skb (Marc Kleine-Budde)   
  - mm: invalidate hwpoison page cache page in fault path (Rik van Riel)   
  - serial: 8250: fix return error code in serial8250_request_std_resource() (Yi Yang)   
  - tty: serial: samsung_tty: set dma burst_size to 1 (Chanho Park)   
  - usb: dwc3: gadget: Fix event pending check (Thinh Nguyen)   
  - USB: serial: ftdi_sio: add Belimo device ids (Lucien Buchmann)   
  - signal handling: don't use BUG_ON() for debugging (Linus Torvalds)   
  - x86: Clear .brk area at early boot (Juergen Gross)   
  - irqchip: or1k-pic: Undefine mask_ack for level triggered hardware (Stafford Horne)   
  - ASoC: wm5110: Fix DRE control (Charles Keepax)   
  - ASoC: ops: Fix off by one in range control validation (Mark Brown)   
  - net: sfp: fix memory leak in sfp_probe() (Jianglei Nie)   
  - NFC: nxp-nci: don't print header length mismatch on i2c error (Michael Walle)   
  - net: tipc: fix possible refcount leak in tipc_sk_create() (Hangyu Hua)   
  - platform/x86: hp-wmi: Ignore Sanitization Mode event (Kai-Heng Feng)   
  - cpufreq: pmac32-cpufreq: Fix refcount leak bug (Liang He)   
  - netfilter: br_netfilter: do not skip all hooks with 0 priority (Florian Westphal)   
  - virtio_mmio: Restore guest page size on resume (Stephan Gerhold)   
  - virtio_mmio: Add missing PM calls to freeze/restore (Stephan Gerhold)   
  - sfc: fix kernel panic when creating VF (Íñigo Huguet)   
  - seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors (Andrea Mayer)   
  - seg6: fix skb checksum evaluation in SRH encapsulation/insertion (Andrea Mayer)   
  - sfc: fix use after free when disabling sriov (Íñigo Huguet)   
  - ipv4: Fix data-races around sysctl_ip_dynaddr. (Kuniyuki Iwashima)   
  - icmp: Fix a data-race around sysctl_icmp_ratemask. (Kuniyuki Iwashima)   
  - icmp: Fix a data-race around sysctl_icmp_ratelimit. (Kuniyuki Iwashima)   
  - ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero (Michal Suchanek)   
  - icmp: Fix data-races around sysctl. (Kuniyuki Iwashima)   
  - cipso: Fix data-races around sysctl. (Kuniyuki Iwashima)   
  - net: Fix data-races around sysctl_mem. (Kuniyuki Iwashima)   
  - inetpeer: Fix data-races around sysctl. (Kuniyuki Iwashima)   
  - ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (Ard Biesheuvel)   
  - xhci: make xhci_handshake timeout for xhci_reset() adjustable (Mathias Nyman)   
  - xhci: bail out early if driver can't accress host in resume (Mathias Nyman)   
  - net: dsa: bcm_sf2: force pause link settings (Doug Berger)   
  - nilfs2: fix incorrect masking of permission flags for symlinks (Ryusuke Konishi)   
  - cgroup: Use separate src/dst nodes when preloading css_sets for migration (Tejun Heo)   
  - ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction (Ard Biesheuvel)   
  - ARM: 9213/1: Print message about disabled Spectre workarounds only once (Dmitry Osipenko)   
  - net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer (Steven Rostedt (Google))   
  - xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue (Juergen Gross)   
  - ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (Meng Tang)   
  - ALSA: hda - Add fixup for Dell Latitidue E5430 (Meng Tang)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.518.1.el7uek]
changelog:
  - xfs: fix out of bound access (Junxiao Bi)  [Orabug: 33089469] [Orabug: 34535011]  
  - KVM: x86: use raw clock values consistently (Paolo Bonzini)  [Orabug: 34362737]  
  - KVM: x86: reorganize pvclock_gtod_data members (Paolo Bonzini)  [Orabug: 34362737]  
  - KVM: x86: switch KVMCLOCK base to monotonic raw clock (Marcelo Tosatti)  [Orabug: 34362737]  
  - netfilter: ebtables: reject blobs that don't provide all entry points (Florian Westphal)  [Orabug: 32176166]  
  - sysfs: turn WARN() into pr_warn() (Greg Kroah-Hartman)  [Orabug: 32176118]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.518.2.el7uek]
changelog:
  - af_key: Do not call xfrm_probe_algs in parallel (Herbert Xu)  [Orabug: 34566753]  {CVE-2022-3028} 
  - l2tp: fix tunnel lookup use-after-free race (James Chapman)  [Orabug: 32504113]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.517.1.el7uek]
changelog:
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug: 34480752]  {CVE-2022-2588} 
  - Restore "module, async: async_synchronize_full() on module init iff async is used" (Mridula Shastry)  [Orabug: 34469834]  
  - net/rds: Replace #ifdef DEBUG with CONFIG_SLUB_DEBUG (Freddy Carrillo)  [Orabug: 34405766]  
  - ext4: Move to shared i_rwsem even without dioread_nolock mount opt (Ritesh Harjani)  [Orabug: 34295843]  
  - ext4: Start with shared i_rwsem in case of DIO instead of exclusive (Ritesh Harjani)  [Orabug: 34295843]  
  - ext4: further refactoring bufferio and dio helper (Junxiao Bi)  [Orabug: 34295843]  
  - ext4: refactor ext4_file_write_iter (Junxiao Bi)  [Orabug: 34295843]  
  - xen/manage: Use orderly_reboot() to reboot (Ross Lagerwall)  [Orabug: 34211118]  
  - xen/manage: revert "xen/manage: enable C_A_D to force reboot" (Dongli Zhang)  [Orabug: 34211118]  
  - Linux 4.14.288 (Greg Kroah-Hartman)   
  - dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate (Miaoqian Lin)   
  - dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (Miaoqian Lin)   
  - dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly (Michael Walle)   
  - ida: don't use BUG_ON() for debugging (Linus Torvalds)   
  - i2c: cadence: Unregister the clk notifier in error path (Satish Nagireddy)   
  - pinctrl: sunxi: a83t: Fix NAND function name for some pins (Samuel Holland)   
  - xfs: remove incorrect ASSERT in xfs_rename (Eric Sandeen)   
  - powerpc/powernv: delay rng platform device creation until later in boot (Jason A. Donenfeld)   
  - video: of_display_timing.h: include errno.h (Hsin-Yi Wang)   
  - fbcon: Disallow setting font bigger than screen size (Helge Deller)   
  - iommu/vt-d: Fix PCI bus rescan device hot add (Yian Chen)   
  - net: rose: fix UAF bug caused by rose_t0timer_expiry (Duoming Zhou)   
  - usbnet: fix memory leak in error case (Oliver Neukum)   
  - can: gs_usb: gs_usb_open/close(): fix memory leak (Rhett Aultman)   
  - can: grcan: grcan_probe(): remove extra of_node_get() (Liang He)   
  - mm/slub: add missing TID updates on slab deactivation (Jann Horn)   
  - esp: limit skb_page_frag_refill use to a single page (Sabrina Dubroca)   
  - Linux 4.14.287 (Greg Kroah-Hartman)   
  - xen/gntdev: Avoid blocking in unmap_grant_pages() (Demi Marie Obenour)   
  - net: usb: qmi_wwan: add Telit 0x1070 composition (Daniele Palmas)   
  - net: usb: qmi_wwan: add Telit 0x1060 composition (Carlo Lobrano)   
  - xen/arm: Fix race in RB-tree based P2M accounting (Oleksandr Tyshchenko)   
  - net: Rename and export copy_skb_header (Ilya Lesokhin)   
  - ipv6/sit: fix ipip6_tunnel_get_prl return value (katrinzhou)   
  - sit: use min (kernel test robot)   
  - hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails (Yang Yingliang)   
  - NFC: nxp-nci: Don't issue a zero length i2c_master_read() (Michael Walle)   
  - nfc: nfcmrvl: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - net: bonding: fix use-after-free after 802.3ad slave unbind (Yevhen Orlov)   
  - net: bonding: fix possible NULL deref in rlb code (Eric Dumazet)   
  - netfilter: nft_dynset: restore set element counter when failing to update (Pablo Neira Ayuso)   
  - caif_virtio: fix race between virtio_device_ready() and ndo_open() (Jason Wang)   
  - net: ipv6: unexport __init-annotated seg6_hmac_net_init() (YueHaibing)   
  - usbnet: fix memory allocation in helpers (Oliver Neukum)   
  - RDMA/qedr: Fix reporting QP timeout attribute (Kamal Heib)   
  - net: usb: ax88179_178a: Fix packet receiving (Jose Alonso)   
  - net: rose: fix UAF bugs caused by timer handler (Duoming Zhou)   
  - SUNRPC: Fix READ_PLUS crasher (Chuck Lever)   
  - s390/archrandom: simplify back to earlier design and initialize earlier (Jason A. Donenfeld)   
  - dm raid: fix KASAN warning in raid5_add_disks (Mikulas Patocka)   
  - dm raid: fix accesses beyond end of raid member array (Heinz Mauelshagen)   
  - nvdimm: Fix badblocks clear off-by-one error (Chris Ye)   
  - Linux 4.14.286 (Greg Kroah-Hartman)   
  - swiotlb: skip swiotlb_bounce when orig_addr is zero (Liu Shixin)   
  - kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] (Naveen N. Rao)   
  - fdt: Update CRC check for rng-seed (Hsin-Yi Wang)   
  - xen: unexport __init-annotated xen_xlate_map_ballooned_pages() (Masahiro Yamada)   
  - drm: remove drm_fb_helper_modinit (Christoph Hellwig)   
  - powerpc/pseries: wire up rng during setup_arch() (Jason A. Donenfeld)   
  - modpost: fix section mismatch check for exported init/exit sections (Masahiro Yamada)   
  - ARM: cns3xxx: Fix refcount leak in cns3xxx_init (Miaoqian Lin)   
  - ARM: Fix refcount leak in axxia_boot_secondary (Miaoqian Lin)   
  - ARM: exynos: Fix refcount leak in exynos_map_pmu (Miaoqian Lin)   
  - ARM: dts: imx6qdl: correct PU regulator ramp delay (Lucas Stach)   
  - powerpc/powernv: wire up rng during setup_arch (Jason A. Donenfeld)   
  - powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address (Andrew Donnellan)   
  - powerpc: Enable execve syscall exit tracepoint (Naveen N. Rao)   
  - xtensa: Fix refcount leak bug in time.c (Liang He)   
  - xtensa: xtfpga: Fix refcount leak bug in setup (Liang He)   
  - iio: adc: axp288: Override TS pin bias current for some models (Hans de Goede)   
  - iio: trigger: sysfs: fix use-after-free on remove (Vincent Whitchurch)   
  - iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up() (Zheyu Ma)   
  - iio: accel: mma8452: ignore the return value of reset operation (Haibo Chen)   
  - iio:accel:bma180: rearrange iio trigger get and register (Dmitry Rokosov)   
  - usb: chipidea: udc: check request status before setting device address (Xu Yang)   
  - iio: adc: vf610: fix conversion mode sysfs node name (Baruch Siach)   
  - igb: Make DMA faster when CPU is active on the PCIe link (Kai-Heng Feng)   
  - MIPS: Remove repetitive increase irq_err_count (huhai)   
  - x86/xen: Remove undefined behavior in setup_features() (Julien Grall)   
  - bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers (Jay Vosburgh)   
  - USB: serial: option: add Quectel RM500K module support (Macpaul Lin)   
  - USB: serial: option: add Quectel EM05-G modem (Yonglin Tan)   
  - USB: serial: option: add Telit LE910Cx 0x1250 composition (Carlo Lobrano)   
  - random: quiet urandom warning ratelimit suppression message (Jason A. Donenfeld)   
  - dm era: commit metadata in postsuspend after worker stops (Nikos Tsironis)   
  - ata: libata: add qc->flags in ata_qc_complete_template tracepoint (Edward Wu)   
  - random: schedule mix_interrupt_randomness() less often (Jason A. Donenfeld)   
  - vt: drop old FONT ioctls (Jiri Slaby)   
  - Linux 4.14.285 (Greg Kroah-Hartman)   
  - tcp: drop the hash_32() part from the index calculation (Willy Tarreau)   
  - tcp: increase source port perturb table to 2^16 (Willy Tarreau) [Orabug: 34247937] {CVE-2022-32296}
  - tcp: dynamically allocate the perturb table used by source ports (Willy Tarreau)   
  - tcp: add small random increments to the source port (Willy Tarreau)   
  - tcp: use different parts of the port_offset for index and offset (Willy Tarreau)   
  - tcp: add some entropy in __inet_hash_connect() (Eric Dumazet)   
  - xprtrdma: fix incorrect header size calculations (Colin Ian King)   
  - usb: gadget: u_ether: fix regression in setting fixed MAC address (Marian Postevca)   
  - s390/mm: use non-quiescing sske for KVM switch to keyed guest (Christian Borntraeger)   
  - virtio-pci: Remove wrong address verification in vp_del_vqs() (Murilo Opsfelder Araujo)   
  - ext4: add reserved GDT blocks check (Zhang Yi)   
  - ext4: make variable "count" signed (Ding Xiang)   
  - ext4: fix bug_on ext4_mb_use_inode_pa (Baokun Li)   
  - serial: 8250: Store to lsr_save_flags after lsr read (Ilpo Järvinen)   
  - usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe (Miaoqian Lin)   
  - usb: dwc2: Fix memory leak in dwc2_hcd_init (Miaoqian Lin)   
  - USB: serial: io_ti: add Agilent E5805A support (Robert Eckelmann)   
  - USB: serial: option: add support for Cinterion MV31 with new baseline (Slark Xiao)   
  - comedi: vmk80xx: fix expression for tx buffer size (Ian Abbott)   
  - irqchip/gic/realview: Fix refcount leak in realview_gic_of_init (Miaoqian Lin)   
  - certs/blacklist_hashes.c: fix const confusion in certs blacklist (Masahiro Yamada)   
  - arm64: ftrace: fix branch range checks (Mark Rutland)   
  - net: bgmac: Fix an erroneous kfree() in bgmac_remove() (Christophe JAILLET)   
  - misc: atmel-ssc: Fix IRQ check in ssc_probe (Miaoqian Lin)   
  - tty: goldfish: Fix free_irq() on remove (Vincent Whitchurch)   
  - i40e: Fix call trace in setup_tx_descriptors (Aleksandr Loktionov)   
  - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE (Trond Myklebust)   
  - random: credit cpu and bootloader seeds by default (Jason A. Donenfeld)   
  - net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag (Chen Lin)   
  - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (Wang Yufen)   
  - nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (Xiaohui Zhang)   
  - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed (chengkaitao)   
  - scsi: pmcraid: Fix missing resource cleanup in error case (Chengguang Xu)   
  - scsi: ipr: Fix missing/incorrect resource cleanup in error case (Chengguang Xu)   
  - scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology (James Smart)   
  - scsi: vmw_pvscsi: Expand vcpuHint to 16 bits (Wentao Wang)   
  - ASoC: wm8962: Fix suspend while playing music (Adam Ford)   
  - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (Sergey Shtylyov)   
  - ASoC: cs42l56: Correct typo in minimum level for SX volume controls (Charles Keepax)   
  - ASoC: cs42l52: Correct TLV for Bypass Volume (Charles Keepax)   
  - ASoC: cs53l30: Correct number of volume levels on SX controls (Charles Keepax)   
  - ASoC: cs42l52: Fix TLV scales for mixer controls (Charles Keepax)   
  - random: account for arch randomness in bits (Jason A. Donenfeld)   
  - random: mark bootloader randomness code as __init (Jason A. Donenfeld)   
  - random: avoid checking crng_ready() twice in random_init() (Jason A. Donenfeld)   
  - crypto: drbg - make reseeding from get_random_bytes() synchronous (Nicolai Stange)   
  - crypto: drbg - always try to free Jitter RNG instance (Stephan Müller)   
  - crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed() (Nicolai Stange)   
  - crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() (Nicolai Stange)   
  - crypto: drbg - prepare for more fine-grained tracking of seeding state (Nicolai Stange)   
  - crypto: drbg - always seeded with SP800-90B compliant noise source (Stephan Müller)   
  - crypto: drbg - add FIPS 140-2 CTRNG for noise source (Stephan Mueller)   
  - Revert "random: use static branch for crng_ready()" (Jason A. Donenfeld)   
  - random: check for signals after page of pool writes (Jason A. Donenfeld)   
  - random: wire up fops->splice_{read,write}_iter() (Jens Axboe)   
  - random: convert to using fops->write_iter() (Jens Axboe)   
  - random: move randomize_page() into mm where it belongs (Jason A. Donenfeld)   
  - random: move initialization functions out of hot pages (Jason A. Donenfeld)   
  - random: use proper jiffies comparison macro (Jason A. Donenfeld)   
  - random: use symbolic constants for crng_init states (Jason A. Donenfeld)   
  - siphash: use one source of truth for siphash permutations (Jason A. Donenfeld)   
  - random: help compiler out with fast_mix() by using simpler arguments (Jason A. Donenfeld)   
  - random: do not use input pool from hard IRQs (Saeed Mirzamohammadi)   
  - random: order timer entropy functions below interrupt functions (Jason A. Donenfeld)   
  - random: do not pretend to handle premature next security model (Jason A. Donenfeld)   
  - random: do not use batches when !crng_ready() (Jason A. Donenfeld)   
  - random: insist on random_get_entropy() existing in order to simplify (Jason A. Donenfeld)   
  - xtensa: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - sparc: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - um: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - x86/tsc: Use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - nios2: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - arm: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - mips: use fallback for random_get_entropy() instead of just c0 random (Jason A. Donenfeld)   
  - m68k: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld)   
  - timekeeping: Add raw clock fallback for random_get_entropy() (Jason A. Donenfeld)   
  - powerpc: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - alpha: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - parisc: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - s390: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - ia64: define get_cycles macro for arch-override (Jason A. Donenfeld)   
  - init: call time_init() before rand_initialize() (Jason A. Donenfeld)   
  - random: fix sysctl documentation nits (Jason A. Donenfeld)   
  - random: document crng_fast_key_erasure() destination possibility (Jason A. Donenfeld)   
  - random: make random_get_entropy() return an unsigned long (Jason A. Donenfeld)   
  - random: check for signals every PAGE_SIZE chunk of /dev/[u]random (Jason A. Donenfeld)   
  - random: check for signal_pending() outside of need_resched() check (Jann Horn)   
  - random: do not allow user to keep crng key around on stack (Jason A. Donenfeld)   
  - random: do not split fast init input in add_hwgenerator_randomness() (Jan Varho)   
  - random: mix build-time latent entropy into pool at init (Jason A. Donenfeld)   
  - random: re-add removed comment about get_random_{u32,u64} reseeding (Jason A. Donenfeld)   
  - random: treat bootloader trust toggle the same way as cpu trust toggle (Jason A. Donenfeld)   
  - random: skip fast_init if hwrng provides large chunk of entropy (Jason A. Donenfeld)   
  - random: check for signal and try earlier when generating entropy (Jason A. Donenfeld)   
  - random: reseed more often immediately after booting (Jason A. Donenfeld)   
  - random: make consistent usage of crng_ready() (Jason A. Donenfeld)   
  - random: use SipHash as interrupt entropy accumulator (Jason A. Donenfeld)   
  - random: replace custom notifier chain with standard one (Jason A. Donenfeld)   
  - random: don't let 644 read-only sysctls be written to (Jason A. Donenfeld)   
  - random: give sysctl_random_min_urandom_seed a more sensible value (Jason A. Donenfeld)   
  - random: do crng pre-init loading in worker rather than irq (Jason A. Donenfeld)   
  - random: unify cycles_t and jiffies usage and types (Jason A. Donenfeld)   
  - random: cleanup UUID handling (Jason A. Donenfeld)   
  - random: only wake up writers after zap if threshold was passed (Jason A. Donenfeld)   
  - random: round-robin registers as ulong, not u32 (Jason A. Donenfeld)   
  - random: pull add_hwgenerator_randomness() declaration into random.h (Jason A. Donenfeld)   
  - random: check for crng_init == 0 in add_device_randomness() (Jason A. Donenfeld)   
  - random: unify early init crng load accounting (Jason A. Donenfeld)   
  - random: do not take pool spinlock at boot (Jason A. Donenfeld)   
  - random: defer fast pool mixing to worker (Jason A. Donenfeld)   
  - random: rewrite header introductory comment (Jason A. Donenfeld)   
  - random: group sysctl functions (Jason A. Donenfeld)   
  - random: group userspace read/write functions (Jason A. Donenfeld)   
  - random: group entropy collection functions (Jason A. Donenfeld)   
  - random: group entropy extraction functions (Jason A. Donenfeld)   
  - random: remove useless header comment (Jason A. Donenfeld)   
  - random: introduce drain_entropy() helper to declutter crng_reseed() (Jason A. Donenfeld)   
  - random: deobfuscate irq u32/u64 contributions (Jason A. Donenfeld)   
  - random: add proper SPDX header (Jason A. Donenfeld)   
  - random: remove unused tracepoints (Jason A. Donenfeld)   
  - random: remove ifdef'd out interrupt bench (Jason A. Donenfeld)   
  - random: tie batched entropy generation to base_crng generation (Jason A. Donenfeld)   
  - random: zero buffer after reading entropy from userspace (Jason A. Donenfeld)   
  - random: remove outdated INT_MAX >> 6 check in urandom_read() (Jason A. Donenfeld)   
  - random: use hash function for crng_slow_load() (Jason A. Donenfeld)   
  - random: absorb fast pool into input pool after fast load (Jason A. Donenfeld)   
  - random: do not xor RDRAND when writing into /dev/random (Jason A. Donenfeld)   
  - random: ensure early RDSEED goes through mixer on init (Jason A. Donenfeld)   
  - random: inline leaves of rand_initialize() (Jason A. Donenfeld)   
  - random: use RDSEED instead of RDRAND in entropy extraction (Jason A. Donenfeld)   
  - random: fix locking in crng_fast_load() (Dominik Brodowski)   
  - random: remove batched entropy locking (Jason A. Donenfeld)   
  - random: remove use_input_pool parameter from crng_reseed() (Eric Biggers)   
  - random: make credit_entropy_bits() always safe (Jason A. Donenfeld)   
  - random: always wake up entropy writers after extraction (Jason A. Donenfeld)   
  - random: use linear min-entropy accumulation crediting (Jason A. Donenfeld)   
  - random: simplify entropy debiting (Jason A. Donenfeld)   
  - random: use computational hash for entropy extraction (Jason A. Donenfeld)   
  - random: only call crng_finalize_init() for primary_crng (Dominik Brodowski)   
  - random: access primary_pool directly rather than through pointer (Dominik Brodowski)   
  - random: continually use hwgenerator randomness (Dominik Brodowski)   
  - random: simplify arithmetic function flow in account() (Jason A. Donenfeld)   
  - random: access input_pool_data directly rather than through pointer (Jason A. Donenfeld)   
  - random: cleanup fractional entropy shift constants (Jason A. Donenfeld)   
  - random: prepend remaining pool constants with POOL_ (Jason A. Donenfeld)   
  - random: de-duplicate INPUT_POOL constants (Jason A. Donenfeld)   
  - random: remove unused OUTPUT_POOL constants (Jason A. Donenfeld)   
  - random: rather than entropy_store abstraction, use global (Jason A. Donenfeld)   
  - random: try to actively add entropy rather than passively wait for it (Linus Torvalds)   
  - random: remove unused extract_entropy() reserved argument (Jason A. Donenfeld)   
  - random: remove incomplete last_data logic (Jason A. Donenfeld)   
  - random: cleanup integer types (Jason A. Donenfeld)   
  - crypto: chacha20 - Fix chacha20_block() keystream alignment (again) (Eric Biggers)   
  - random: cleanup poolinfo abstraction (Jason A. Donenfeld)   
  - random: fix typo in comments (Schspa Shi)   
  - random: don't reset crng_init_cnt on urandom_read() (Jann Horn)   
  - random: avoid superfluous call to RDRAND in CRNG extraction (Jason A. Donenfeld)   
  - random: early initialization of ChaCha constants (Dominik Brodowski)   
  - random: initialize ChaCha20 constants with correct endianness (Eric Biggers)   
  - random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs (Jason A. Donenfeld)   
  - random: harmonize "crng init done" messages (Dominik Brodowski)   
  - random: mix bootloader randomness into pool (Jason A. Donenfeld)   
  - random: do not re-init if crng_reseed completes before primary init (Jason A. Donenfeld)   
  - random: do not sign extend bytes for rotation when mixing (Jason A. Donenfeld)   
  - random: use BLAKE2s instead of SHA1 in extraction (Jason A. Donenfeld)   
  - random: remove unused irq_flags argument from add_interrupt_randomness() (Saeed Mirzamohammadi)   
  - random: document add_hwgenerator_randomness() with other input functions (Mark Brown)   
  - crypto: blake2s - adjust include guard naming (Eric Biggers)   
  - crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h> (Eric Biggers)   
  - MAINTAINERS: co-maintain random.c (Jason A. Donenfeld)   
  - random: remove dead code left over from blocking pool (Eric Biggers)   
  - random: avoid arch_get_random_seed_long() when collecting IRQ randomness (Ard Biesheuvel)   
  - random: add arch_get_random_*long_early() (Mark Rutland)   
  - powerpc: Use bool in archrandom.h (Richard Henderson)   
  - linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check (Richard Henderson)   
  - linux/random.h: Use false with bool (Richard Henderson)   
  - linux/random.h: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - s390: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - powerpc: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - x86: Remove arch_has_random, arch_has_random_seed (Richard Henderson)   
  - random: avoid warnings for !CONFIG_NUMA builds (Mark Rutland)   
  - random: split primary/secondary crng init paths (Mark Rutland)   
  - random: remove some dead code of poolinfo (Yangtao Li)   
  - random: fix typo in add_timer_randomness() (Yangtao Li)   
  - random: Add and use pr_fmt() (Yangtao Li)   
  - random: convert to ENTROPY_BITS for better code readability (Yangtao Li)   
  - random: remove unnecessary unlikely() (Yangtao Li)   
  - random: remove kernel.random.read_wakeup_threshold (Andy Lutomirski)   
  - random: delete code to pull data into pools (Andy Lutomirski)   
  - random: remove the blocking pool (Andy Lutomirski)   
  - random: fix crash on multiple early calls to add_bootloader_randomness() (Dominik Brodowski)   
  - char/random: silence a lockdep splat with printk() (Sergey Senozhatsky)   
  - random: make /dev/random be almost like /dev/urandom (Andy Lutomirski)   
  - random: ignore GRND_RANDOM in getentropy(2) (Andy Lutomirski)   
  - random: add GRND_INSECURE to return best-effort non-cryptographic bytes (Andy Lutomirski)   
  - random: Add a urandom_read_nowait() for random APIs that don't warn (Andy Lutomirski)   
  - random: Don't wake crng_init_wait when crng_init == 1 (Andy Lutomirski)   
  - lib/crypto: sha1: re-roll loops to reduce code size (Jason A. Donenfeld)   
  - lib/crypto: blake2s: move hmac construction into wireguard (Jason A. Donenfeld)   
  - crypto: blake2s - generic C library implementation and selftest (Jason A. Donenfeld)   
  - crypto: Deduplicate le32_to_cpu_array() and cpu_to_le32_array() (Andy Shevchenko)   
  - Revert "hwrng: core - Freeze khwrng thread during suspend" (Herbert Xu)   
  - char/random: Add a newline at the end of the file (Borislav Petkov)   
  - random: Use wait_event_freezable() in add_hwgenerator_randomness() (Stephen Boyd)   
  - fdt: add support for rng-seed (Hsin-Yi Wang)   
  - random: Support freezable kthreads in add_hwgenerator_randomness() (Stephen Boyd)   
  - random: fix soft lockup when trying to read from an uninitialized blocking pool (Theodore Ts'o)   
  - latent_entropy: avoid build error when plugin cflags are not set (Vasily Gorbik)   
  - random: document get_random_int() family (George Spelvin)   
  - random: move rand_initialize() earlier (Kees Cook)   
  - random: only read from /dev/random after its pool has received 128 bits (Theodore Ts'o)   
  - drivers/char/random.c: make primary_crng static (Rasmus Villemoes)   
  - drivers/char/random.c: remove unused stuct poolinfo::poolbits (Rasmus Villemoes)   
  - drivers/char/random.c: constify poolinfo_table (Rasmus Villemoes)   
  - random: make CPU trust a boot parameter (Kees Cook)   
  - random: Make crng state queryable (Jason A. Donenfeld)   
  - random: remove preempt disabled region (Ingo Molnar)   
  - random: add a config option to trust the CPU's hwrng (Theodore Ts'o)   
  - random: Return nbytes filled from hw RNG (Tobin C. Harding)   
  - random: Fix whitespace pre random-bytes work (Tobin C. Harding)   
  - drivers/char/random.c: remove unused dont_count_entropy (Rasmus Villemoes)   
  - random: optimize add_interrupt_randomness (Andi Kleen)   
  - random: always fill buffer in get_random_bytes_wait (Jason A. Donenfeld)   
  - crypto: chacha20 - Fix keystream alignment for chacha20_block() (Eric Biggers)   
  - 9p: missing chunk of "fs/9p: Don't update file type when updating file attributes" (Al Viro)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.518.4.1.el7uek]
changelog:
  - Revert "xfs: don't use delalloc extents for COW on files with extsize hints" (Saeed Mirzamohammadi)  [Orabug: 34716022]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.518.4.2.el7uek]
changelog:
  - EDAC: Drop duplicated array of strings for memory type names (Jane Chu)  [Orabug: 34765038]  
  - xfs: don't ever put nlink > 0 inodes on the unlinked list (Darrick J. Wong)  [Orabug: 34765034]  
  - xfs: trim IO to found COW extent limit (Eric Sandeen)  [Orabug: 34765017]  
  - xfs: don't use delalloc extents for COW on files with extsize hints (Christoph Hellwig)  [Orabug: 34765017]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.516.0.el7uek]
changelog:
  - scsi: mpt3sas: Remove scsi_dma_map() error messages (Sreekanth Reddy)  [Orabug: 34328903]  
  - uek: kabi: new protected symbols for USM in OL7 (Saeed Mirzamohammadi)  [Orabug: 34233902]  
  - vfio/type1: add ioctl to check for correct pin accounting (Anthony Yznaga)  [Orabug: 32967885]  
  - vfio/type1: track pages pinned by vfio across exec (Anthony Yznaga)  [Orabug: 32967885]  
  - mm: track driver pinned pages across exec (Anthony Yznaga)  [Orabug: 32967885]  
  - vfio/type1: Fix vfio_find_dma_valid return (Anthony Yznaga)  [Orabug: 32967885]  
  - vfio/type1: fix unmap all on ILP32 (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: block on invalid vaddr (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: implement notify callback (Steve Sistare)  [Orabug: 32967885]  
  - vfio: iommu driver notify callback (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: implement interfaces to update vaddr (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: massage unmap iteration (Steve Sistare)  [Orabug: 32967885]  
  - vfio: interfaces to update vaddr (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: implement unmap all (Steve Sistare)  [Orabug: 32967885]  
  - vfio/type1: unmap cleanup (Steve Sistare)  [Orabug: 32967885]  
  - vfio: option to unmap all (Steve Sistare)  [Orabug: 32967885]  
  - Linux 4.14.284 (Greg Kroah-Hartman)   
  - x86/speculation/mmio: Print SMT warning (Josh Poimboeuf)   
  - x86/cpu: Add another Alder Lake CPU to the Intel family (Gayatri Kammela)   
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family (Tony Luck)   
  - x86/cpu: Add Comet Lake to the Intel CPU models header (Kan Liang)   
  - x86/cpu: Add Cannonlake to Intel family (Rajneesh Bhardwaj)   
  - x86/cpu: Add Jasper Lake to Intel family (Zhang Rui)   
  - cpu/speculation: Add prototype for cpu_show_srbds() (Guenter Roeck)   
  - x86/cpu: Add Elkhart Lake to Intel family (Gayatri Kammela)   
  - Linux 4.14.283 (Greg Kroah-Hartman)   
  - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (Eric Dumazet)   
  - PCI: qcom: Fix unbalanced PHY init on probe errors (Johan Hovold)   
  - mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N (Tokunori Ikegami)   
  - mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write (Tokunori Ikegami)   
  - md/raid0: Ignore RAID0 layout if the second zone has only one device (Pascal Hambourg)   
  - powerpc/32: Fix overread/overwrite of thread_struct via ptrace (Michael Ellerman)   
  - Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (Mathias Nyman)   
  - ixgbe: fix unexpected VLAN Rx in promisc mode on VF (Olivier Matz)   
  - ixgbe: fix bcast packets Rx on VF after promisc removal (Olivier Matz)   
  - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling (Martin Faltesek)   
  - nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION (Martin Faltesek)   
  - ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files (Sergey Shtylyov)   
  - cifs: return errors during session setup during reconnects (Shyam Prasad N)   
  - ALSA: hda/conexant - Fix loopback issue with CX20632 (huangwenhui)   
  - vringh: Fix loop descriptors check in the indirect cases (Xie Yongji)   
  - nodemask: Fix return values to be unsigned (Kees Cook)   
  - nbd: fix io hung while disconnecting device (Yu Kuai)   
  - nbd: fix race between nbd_alloc_config() and module removal (Yu Kuai)   
  - nbd: call genl_unregister_family() first in nbd_cleanup() (Yu Kuai)   
  - modpost: fix undefined behavior of is_arm_mapping_symbol() (Masahiro Yamada)   
  - drm/radeon: fix a possible null pointer dereference (Gong Yuanjun)   
  - Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" (Michal Kubecek)   
  - md: protect md_unregister_thread from reentrancy (Guoqing Jiang)   
  - kernfs: Separate kernfs_pr_cont_buf and rename_lock. (Hao Luo)   
  - serial: msm_serial: disable interrupts in __msm_console_write() (John Ogness)   
  - staging: rtl8712: fix uninit-value in r871xu_drv_init() (Wang Cheng)   
  - clocksource/drivers/sp804: Avoid error on multiple instances (Andre Przywara)   
  - extcon: Modify extcon device to be created after driver data is set (bumwoo lee)   
  - misc: rtsx: set NULL intfdata when probe fails (Shuah Khan)   
  - usb: dwc2: gadget: don't reset gadget's driver->bus (Marek Szyprowski)   
  - USB: hcd-pci: Fully suspend across freeze/thaw cycle (Evan Green)   
  - drivers: usb: host: Fix deadlock in oxu_bus_suspend() (Duoming Zhou)   
  - drivers: tty: serial: Fix deadlock in sa1100_set_termios() (Duoming Zhou)   
  - USB: host: isp116x: check return value after calling platform_get_resource() (Zhen Ni)   
  - drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() (Duoming Zhou)   
  - tty: Fix a possible resource leak in icom_probe (Huang Guobin)   
  - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() (Zheyu Ma)   
  - lkdtm/usercopy: Expand size of "out of frame" object (Kees Cook)   
  - iio: dummy: iio_simple_dummy: check the return value of kstrdup() (Xiaoke Wang)   
  - drm: imx: fix compiler warning with gcc-12 (Linus Torvalds)   
  - net: altera: Fix refcount leak in altera_tse_mdio_create (Miaoqian Lin)   
  - net: ipv6: unexport __init-annotated seg6_hmac_init() (Masahiro Yamada)   
  - net: xfrm: unexport __init-annotated xfrm4_protocol_init() (Masahiro Yamada)   
  - net: mdio: unexport __init-annotated mdio_bus_init() (Masahiro Yamada)   
  - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() (Chuck Lever)   
  - net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure (Gal Pressman)   
  - ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe (Miaoqian Lin)   
  - xprtrdma: treat all calls not a bcall when bc_serv is NULL (Kinglong Mee)   
  - video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() (Yang Yingliang)   
  - m68knommu: fix undefined reference to `_init_sp' (Greg Ungerer)   
  - m68knommu: set ZERO_PAGE() to the allocated zeroed page (Greg Ungerer)   
  - i2c: cadence: Increase timeout per message if necessary (Lucas Tanure)   
  - tracing: Avoid adding tracer option before update_tracer_options (Mark-PK Tsai)   
  - tracing: Fix sleeping function called from invalid context on RT kernel (Jun Miao)   
  - mips: cpc: Fix refcount leak in mips_cpc_default_phys_base (Gong Yuanjun)   
  - perf c2c: Fix sorting in percent_rmt_hitm_cmp() (Leo Yan)   
  - tcp: tcp_rtx_synack() can be called from process context (Eric Dumazet)   
  - ubi: ubi_create_volume: Fix use-after-free when volume creation failed (Zhihao Cheng)   
  - jffs2: fix memory leak in jffs2_do_fill_super (Baokun Li)   
  - modpost: fix removing numeric suffixes (Alexander Lobakin)   
  - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (Miaoqian Lin)   
  - net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() (Dan Carpenter)   
  - clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (Miaoqian Lin)   
  - serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 (Ilpo Järvinen)   
  - serial: sh-sci: Don't allow CS5-6 (Ilpo Järvinen)   
  - serial: txx9: Don't allow CS5-6 (Ilpo Järvinen)   
  - serial: digicolor-usart: Don't allow CS5-6 (Ilpo Järvinen)   
  - serial: meson: acquire port->lock in startup() (John Ogness)   
  - rtc: mt6397: check return value after calling platform_get_resource() (Yang Yingliang)   
  - soc: rockchip: Fix refcount leak in rockchip_grf_init (Miaoqian Lin)   
  - coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier (Guilherme G. Piccoli)   
  - rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - pwm: lp3943: Fix duty calculation in case period was clamped (Uwe Kleine-König)   
  - USB: storage: karma: fix rio_karma_init return (Lin Ma)   
  - usb: usbip: add missing device lock on tweak configuration cmd (Niels Dossche)   
  - usb: usbip: fix a refcount leak in stub_probe() (Hangyu Hua)   
  - tty: goldfish: Use tty_port_destroy() to destroy port (Wang Weiyang)   
  - staging: greybus: codecs: fix type confusion of list iterator variable (Jakob Koschel)   
  - pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (Randy Dunlap)   
  - netfilter: nf_tables: disallow non-stateful expression in sets earlier (Pablo Neira Ayuso) [Orabug: 34247342] {CVE-2022-32250} {CVE-2022-1966}
  - MIPS: IP27: Remove incorrect `cpu_has_fpu' override (Maciej W. Rozycki)   
  - RDMA/rxe: Generate a completion for unsupported/invalid opcode (Xiao Yang)   
  - phy: qcom-qmp: fix reset-controller leak on probe errors (Johan Hovold)   
  - dt-bindings: gpio: altera: correct interrupt-cells (Dinh Nguyen)   
  - docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 (Akira Yokosawa)   
  - phy: qcom-qmp: fix struct clk leak on probe errors (Johan Hovold)   
  - arm64: dts: qcom: ipq8074: fix the sleep clock frequency (Kathiravan T)   
  - gma500: fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - carl9170: tx: fix an incorrect use of list iterator (Xiaomeng Tong)   
  - ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control (Mark Brown)   
  - rtl818x: Prevent using not initialized queues (Alexander Wetzel)   
  - hugetlb: fix huge_pmd_unshare address update (Mike Kravetz)   
  - nodemask.h: fix compilation error with GCC12 (Christophe de Dinechin)   
  - iommu/msm: Fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - um: Fix out-of-bounds read in LDT setup (Vincent Whitchurch)   
  - um: chan_user: Fix winch_tramp() return value (Johannes Berg)   
  - mac80211: upgrade passive scan to active scan on DFS channels after beacon rx (Felix Fietkau)   
  - irqchip: irq-xtensa-mx: fix initial IRQ affinity (Max Filippov)   
  - irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x (Pali Rohár)   
  - RDMA/hfi1: Fix potential integer multiplication overflow errors (Dennis Dalessandro)   
  - md: fix an incorrect NULL check in md_reload_sb (Xiaomeng Tong)   
  - md: fix an incorrect NULL check in does_sb_need_changing (Xiaomeng Tong)   
  - drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX (Brian Norris)   
  - drm/nouveau/clk: Fix an incorrect NULL check on list iterator (Xiaomeng Tong)   
  - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. (Dave Airlie)   
  - scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled (Manivannan Sadhasivam)   
  - scsi: dc395x: Fix a missing check on list iterator (Xiaomeng Tong)   
  - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock (Junxiao Bi via Ocfs2-devel)   
  - dlm: fix missing lkb refcount handling (Alexander Aring)   
  - dlm: fix plock invalid read (Alexander Aring)   
  - ext4: avoid cycles in directory h-tree (Jan Kara)   
  - ext4: verify dir block before splitting it (Jan Kara)   
  - ext4: fix bug_on in ext4_writepages (Ye Bin)   
  - ext4: fix use-after-free in ext4_rename_dir_prepare (Ye Bin)   
  - fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages (Zhihao Cheng)   
  - iwlwifi: mvm: fix assert 1F04 upon reconfig (Emmanuel Grumbach)   
  - wifi: mac80211: fix use-after-free in chanctx code (Johannes Berg)   
  - perf jevents: Fix event syntax error caused by ExtSel (Zhengjun Xing)   
  - perf c2c: Use stdio interface if slang is not supported (Leo Yan)   
  - iommu/amd: Increase timeout waiting for GA log enablement (Joerg Roedel)   
  - video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup (Miaoqian Lin)   
  - iommu/mediatek: Add list_del in mtk_iommu_remove (Yong Wu)   
  - mailbox: forward the hrtimer if not queued and under a lock (Björn Ardö)   
  - powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup (Miaoqian Lin)   
  - powerpc/perf: Fix the threshold compare group constraint for power9 (Kajol Jain)   
  - Input: sparcspkr - fix refcount leak in bbc_beep_probe (Miaoqian Lin)   
  - tty: fix deadlock caused by calling printk() under tty_port->lock (Qi Zheng)   
  - powerpc/4xx/cpm: Fix return value of __setup() handler (Randy Dunlap)   
  - powerpc/idle: Fix return value of __setup() handler (Randy Dunlap)   
  - powerpc/8xx: export 'cpm_setbrg' for modules (Randy Dunlap)   
  - drivers/base/node.c: fix compaction sysfs file leak (Miaohe Lin)   
  - pinctrl: mvebu: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() (Gustavo A. R. Silva)   
  - mfd: ipaq-micro: Fix error check return value of platform_get_irq() (Lv Ruyi)   
  - ARM: dts: bcm2835-rpi-b: Fix GPIO line names (Stefan Wahren)   
  - ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT (Phil Elwell)   
  - soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc (Miaoqian Lin)   
  - soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc (Miaoqian Lin)   
  - rxrpc: Don't try to resend the request if we're receiving the reply (David Howells)   
  - rxrpc: Fix listen() setting the bar too high for the prealloc rings (David Howells)   
  - ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() (Yang Yingliang)   
  - sctp: read sk->sk_bound_dev_if once in sctp_rcv() (Eric Dumazet)   
  - m68k: math-emu: Fix dependencies of math emulation support (Geert Uytterhoeven)   
  - Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (Ying Hsu)   
  - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (Pavel Skripkin)   
  - media: exynos4-is: Change clk_disable to clk_disable_unprepare (Miaoqian Lin)   
  - media: st-delta: Fix PM disable depth imbalance in delta_probe (Miaoqian Lin)   
  - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt (Miaoqian Lin)   
  - ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe (Miaoqian Lin)   
  - media: uvcvideo: Fix missing check to determine if element is found in list (Xiaomeng Tong)   
  - drm/msm: return an error pointer in msm_gem_prime_get_sg_table() (Dan Carpenter)   
  - x86/mm: Cleanup the control_va_addr_alignment() __setup handler (Randy Dunlap)   
  - irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value (Krzysztof Kozlowski)   
  - x86: Fix return value of __setup handlers (Randy Dunlap)   
  - drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (Yang Yingliang)   
  - drm/msm/hdmi: check return value after calling platform_get_resource_byname() (Yang Yingliang)   
  - drm/msm/dsi: fix error checks and return values for DSI xmit functions (Dmitry Baryshkov)   
  - x86/pm: Fix false positive kmemleak report in msr_build_context() (Matthieu Baerts)   
  - fsnotify: fix wrong lockdep annotations (Amir Goldstein)   
  - inotify: show inotify mask flags in proc fdinfo (Amir Goldstein)   
  - ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (Dan Carpenter)   
  - spi: img-spfi: Fix pm_runtime_get_sync() error checking (Zheng Yongjun)   
  - HID: hid-led: fix maximum brightness for Dream Cheeky (Jonathan Teh)   
  - efi: Add missing prototype for efi_capsule_setup_info (Jan Kiszka)   
  - NFC: NULL out the dev->rfkill to prevent UAF (Lin Ma)   
  - spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout (Miaoqian Lin)   
  - drm/mediatek: Fix mtk_cec_mask() (Miles Chen)   
  - x86/delay: Fix the wrong asm constraint in delay_loop() (Ammar Faizi)   
  - ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe (Miaoqian Lin)   
  - ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe (Miaoqian Lin)   
  - ath9k: fix ar9003_get_eepmisc (Wenli Looi)   
  - drm: fix EDID struct for old ARM OABI format (Saeed Mirzamohammadi)   
  - RDMA/hfi1: Prevent panic when SDMA is disabled (Douglas Miller)   
  - macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled (Finn Thain)   
  - powerpc/xics: fix refcount leak in icp_opal_init() (Lv Ruyi)   
  - tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate (Vasily Averin)   
  - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (Yicong Yang)   
  - ARM: hisi: Add missing of_node_put after of_find_compatible_node (Peng Wu)   
  - ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM (Krzysztof Kozlowski)   
  - ARM: versatile: Add missing of_node_put in dcscb_init (Peng Wu)   
  - fat: add ratelimit to fat*_ent_bread() (OGAWA Hirofumi)   
  - ARM: OMAP1: clock: Fix UART rate reporting algorithm (Janusz Krzysztofik)   
  - fs: jfs: fix possible NULL pointer dereference in dbFree() (Zixuan Fu)   
  - ARM: dts: ox820: align interrupt controller node name with dtschema (Krzysztof Kozlowski)   
  - eth: tg3: silence the GCC 12 array-bounds warning (Jakub Kicinski)   
  - rxrpc: Return an error to sendmsg if call failed (David Howells)   
  - media: exynos4-is: Fix compile warning (Kwanghoon Son)   
  - net: phy: micrel: Allow probing without .driver_data (Fabio Estevam)   
  - ASoC: rt5645: Fix errorenous cleanup order (Lin Ma)   
  - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (Smith, Kyle Miller (Nimble Kernel))   
  - openrisc: start CPU timer early in boot (Jason A. Donenfeld)   
  - rtlwifi: Use pr_warn instead of WARN_ONCE (Dongliang Mu)   
  - ipmi:ssif: Check for NULL msg when handling events and messages (Corey Minyard)   
  - dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC (Mikulas Patocka)   
  - s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES (Heiko Carstens)   
  - ASoC: dapm: Don't fold register value changes into notifications (Mark Brown)   
  - ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL (jianghaoran)   
  - drm/amd/pm: fix the compile warning (Evan Quan)   
  - scsi: megaraid: Fix error check return value of register_chrdev() (Lv Ruyi)   
  - media: cx25821: Fix the warning when removing the module (Zheyu Ma)   
  - media: pci: cx23885: Fix the error handling in cx23885_initdev() (Zheyu Ma)   
  - media: venus: hfi: avoid null dereference in deinit (Luca Weiss)   
  - ath9k: fix QCA9561 PA bias level (Thibaut VARÈNE)   
  - drm/amd/pm: fix double free in si_parse_power_table() (Keita Suzuki)   
  - ALSA: jack: Access input_dev under mutex (Amadeusz Sławiński)   
  - ACPICA: Avoid cache flush inside virtual machines (Kirill A. Shutemov)   
  - ipw2x00: Fix potential NULL dereference in libipw_xmit() (Haowen Bai)   
  - b43: Fix assigning negative value to unsigned variable (Haowen Bai)   
  - b43legacy: Fix assigning negative value to unsigned variable (Haowen Bai)   
  - mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue (Niels Dossche)   
  - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes (Liu Zixian)   
  - btrfs: repair super block num_devices automatically (Qu Wenruo)   
  - btrfs: add "0x" prefix for unsupported optional features (Qu Wenruo)   
  - ptrace: Reimplement PTRACE_KILL by always sending SIGKILL (Eric W. Biederman)   
  - ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP (Eric W. Biederman)   
  - USB: new quirk for Dell Gen 2 devices (Monish Kumar R)   
  - USB: serial: option: add Quectel BG95 modem (Carl Yin(殷张成))   
  - binfmt_flat: do not stop relocating GOT entries prematurely on riscv (Niklas Cassel)   
  - Linux 4.14.282 (Greg Kroah-Hartman)   
  - bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes (Liu Jian)   
  - NFSD: Fix possible sleep during nfsd4_release_lockowner() (Chuck Lever)   
  - docs: submitting-patches: Fix crossref to 'The canonical patch format' (Akira Yokosawa)   
  - tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() (Xiu Jianfeng)   
  - dm verity: set DM_TARGET_IMMUTABLE feature flag (Sarthak Kukreti)   
  - dm stats: add cond_resched when looping over entries (Mikulas Patocka)   
  - dm crypt: make printing of the key constant-time (Mikulas Patocka)   
  - dm integrity: fix error code in dm_integrity_ctr() (Dan Carpenter)   
  - zsmalloc: fix races between asynchronous zspage free and page migration (Sultan Alsawaf)   
  - netfilter: conntrack: re-fetch conntrack after insertion (Florian Westphal)   
  - exec: Force single empty string when argv is empty (Kees Cook)   
  - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern (Haimin Zhang)   
  - drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() (Gustavo A. R. Silva)   
  - drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers (Piyush Malgujar)   
  - net: ftgmac100: Disable hardware checksum on AST2600 (Joel Stanley)   
  - net: af_key: check encryption module availability consistency (Thomas Bartschies)   
  - ACPI: sysfs: Fix BERT error region memory mapping (Lorenzo Pieralisi)   
  - ACPI: sysfs: Make sparse happy about address space in use (Andy Shevchenko)   
  - secure_seq: use the 64 bits of the siphash for port offset calculation (Willy Tarreau)   
  - tcp: change source port randomizarion at connect() time (Eric Dumazet)   
  - staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan() (Denis Efremov (Oracle))   
  - x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests (Thomas Gleixner)   
  - Linux 4.14.281 (Greg Kroah-Hartman)   
  - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE"" (Linus Torvalds)   
  - swiotlb: fix info leak with DMA_FROM_DEVICE (Halil Pasic)   
  - net: atlantic: verify hw_head_ lies within TX buffer ring (Grant Grundler)   
  - net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() (Yang Yingliang)   
  - ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one() (Yang Yingliang)   
  - mac80211: fix rx reordering with non explicit / psmp ack policy (Felix Fietkau)   
  - scsi: qla2xxx: Fix missed DMA unmap for aborted commands (Gleb Chesnokov)   
  - perf bench numa: Address compiler error on s390 (Thomas Richter)   
  - gpio: mvebu/pwm: Refuse requests with inverted polarity (Uwe Kleine-König)   
  - gpio: gpio-vf610: do not touch other bits when set the target bit (Haibo Chen)   
  - net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. (Andrew Lunn)   
  - igb: skip phy status check where unavailable (Kevin Mitchell)   
  - ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 (Ard Biesheuvel)   
  - ARM: 9196/1: spectre-bhb: enable for Cortex-A15 (Ard Biesheuvel)   
  - net: af_key: add check for pfkey_broadcast in function pfkey_process (Jiasheng Jiang)   
  - NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc (Duoming Zhou)   
  - net/qla3xxx: Fix a test in ql_reset_work() (Christophe JAILLET)   
  - clk: at91: generated: consider range when calculating best rate (Codrin Ciubotariu)   
  - net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() (Zixuan Fu)   
  - net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() (Zixuan Fu)   
  - mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch() (Ulf Hansson)   
  - mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD (Ulf Hansson)   
  - mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC (Ulf Hansson)   
  - drm/dp/mst: fix a possible memory leak in fetch_monitor_name() (Hangyu Hua)   
  - ALSA: wavefront: Proper check of get_user() error (Takashi Iwai)   
  - ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() (linyujun)   
  - drbd: remove usage of list iterator variable after loop (Jakob Koschel)   
  - MIPS: lantiq: check the return value of kzalloc() (Xiaoke Wang)   
  - Input: stmfts - fix reference leak in stmfts_input_open (Zheng Yongjun)   
  - Input: add bounds checking to input_set_capability() (Jeff LaBundy)   
  - um: Cleanup syscall_handler_t definition/cast, fix warning (David Gow)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.519.0.el7uek]
changelog:
  - media: em28xx: initialize refcount before kref_get (Dongliang Mu)  [Orabug: 34619521]  {CVE-2022-3239} 
  - net: vlan: Avoid using BUG() in vlan_proto_idx() (Florian Fainelli)  [Orabug: 34625406]  
  - net/rds: Send congestion map updates only via path zero (Anand Khoje)  [Orabug: 34578052]  
  - rds: cong: Make rds_cong_wait an array to reduce lock contention (Håkon Bugge)  [Orabug: 34574094]  
  - rds: cong: Make rs_cong_notify and rs_cong_mask atomic64_t (Håkon Bugge)  [Orabug: 34574094]  
  - scsi: tcmu: track nl commands (Mike Christie)  [Orabug: 32011411]  
  - scsi: tcmu: remove useless code and clean up the code style. (Xiubo Li)  [Orabug: 32011411]  
  - Linux 4.14.295 (Greg Kroah-Hartman)   
  - ext4: make directory inode spreading reflect flexbg size (Jan Kara)   
  - Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region (Vitaly Kuznetsov)   
  - s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup (Stefan Haberland)   
  - serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting (Ilpo Järvinen)   
  - serial: Create uart_xmit_advance() (Ilpo Järvinen)   
  - net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD (Sean Anderson)   
  - perf kcore_copy: Do not check /proc/modules is unchanged (Adrian Hunter)   
  - can: gs_usb: gs_can_open(): fix race dev->can.state condition (Marc Kleine-Budde)   
  - netfilter: ebtables: fix memory leak when blob is malformed (Florian Westphal)   
  - of: mdio: Add of_node_put() when breaking out of for_each_xx (Liang He)   
  - MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko (Randy Dunlap)   
  - net: team: Unsync device addresses on ndo_stop (Benjamin Poirier)   
  - ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header (Lu Wei)   
  - iavf: Fix cached head and tail value for iavf_get_tx_pending (Brett Creeley)   
  - netfilter: nf_conntrack_irc: Tighten matching on DCC message (David Leadbeater)   
  - netfilter: nf_conntrack_sip: fix ct_sip_walk_headers (Igor Ryzhov)   
  - arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma (Fabio Estevam)   
  - mm/slub: fix to return errno if kmalloc() fails (Chao Yu)   
  - ALSA: hda: add Intel 5 Series / 3400 PCI DID (Kai Vehmanen)   
  - ALSA: hda/tegra: set depop delay for tegra (Mohan Kumar)   
  - USB: serial: option: add Quectel RM520N (jerry meng)   
  - USB: serial: option: add Quectel BG95 0x0203 composition (Carl Yin(殷张成))   
  - USB: core: Fix RST error in hub.c (Alan Stern)   
  - wifi: mac80211: Fix UAF in ieee80211_scan_rx() (Siddh Raman Pant)   
  - ALSA: hda/sigmatel: Fix unused variable warning for beep power change (Takashi Iwai)   
  - video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write (Hyunwoo Kim)   
  - mksysmap: Fix the mismatch of 'L0' symbols in System.map (Youling Tang)   
  - MIPS: OCTEON: irq: Fix octeon_irq_force_ciu_mapping() (Alexander Sverdlin)   
  - net: usb: qmi_wwan: add Quectel RM520N (jerry.meng)   
  - ALSA: hda/sigmatel: Keep power up while beep is enabled (Takashi Iwai)   
  - regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe() (Xiaolei Wang)   
  - ASoC: nau8824: Fix semaphore unbalance at error paths (Takashi Iwai)   
  - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Stefan Metzmacher)   
  - parisc: ccio-dma: Add missing iounmap in error path in ccio_probe() (Yang Yingliang)   
  - drm/meson: Correct OSD1 global alpha value (Stuart Menefy)   
  - gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx (Pali Rohár)   
  - of: fdt: fix off-by-one error in unflatten_dt_nodes() (Sergey Shtylyov)   
  - Linux 4.14.294 (Greg Kroah-Hartman)   
  - tracefs: Only clobber mode/uid/gid on remount if asked (Brian Norris)   
  - platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes (Hans de Goede)   
  - ieee802154: cc2520: add rc code in cc2520_tx() (Li Qiong)   
  - tg3: Disable tg3 device on system reboot to avoid triggering AER (Kai-Heng Feng)   
  - HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo (Jason Wang)   
  - drm/msm/rd: Fix FIFO-full deadlock (Rob Clark)   
  - mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() (Jann Horn)   
  - Linux 4.14.293 (Greg Kroah-Hartman)   
  - SUNRPC: use _bh spinlocking on ->transport_lock (NeilBrown)   
  - MIPS: loongson32: ls1c: Fix hang during startup (Yang Ling)   
  - USB: serial: ch341: fix disabled rx timer on older devices (Johan Hovold)   
  - USB: serial: ch341: fix lost character on LCR updates (Johan Hovold)   
  - usb: dwc3: fix PHY disable sequence (Johan Hovold)   
  - sch_sfb: Also store skb len before calling child enqueue (Toke Høiland-Jørgensen)   
  - tcp: fix early ETIMEDOUT after spurious non-SACK RTO (Neal Cardwell)   
  - ipv6: sr: fix out-of-bounds read when setting HMAC data. (David Lebrun)   
  - tipc: fix shift wrapping bug in map_get() (Dan Carpenter)   
  - sch_sfb: Don't assume the skb is still around after enqueueing to child (Toke Høiland-Jørgensen)   
  - netfilter: nf_conntrack_irc: Fix forged IP logic (David Leadbeater)   
  - netfilter: br_netfilter: Drop dst references before setting. (Harsh Modi)   
  - driver core: Don't probe devices after bus_type.match() probe deferral (Isaac J. Manjarres)   
  - scsi: mpt3sas: Fix use-after-free warning (Sreekanth Reddy)   
  - kprobes: Prohibit probes in gate area (Christian A. Ehrhardt)   
  - ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() (Dongxiang Ke)   
  - ALSA: aloop: Fix random zeros in capture data when using jiffies timer (Pattara Teerapong)   
  - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (Tasos Sahanidis)   
  - fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init() (Yang Yingliang)   
  - parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines (Helge Deller)   
  - parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources() (Li Qiong)   
  - drm/radeon: add a force flush to delay work when radeon (Zhenneng Li)   
  - drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup. (Candice Li)   
  - Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()" (Yee Lee)   
  - fs: only do a memory barrier for the first set_buffer_uptodate() (Linus Torvalds)   
  - wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd() (Stanislaw Gruszka)   
  - efi: capsule-loader: Fix use-after-free in efi_capsule_write (Hyunwoo Kim)   
  - ALSA: seq: Fix data-race at module auto-loading (Takashi Iwai)   
  - ALSA: seq: oss: Fix data-race for max_midi_devs access (Takashi Iwai)   
  - net: mac802154: Fix a condition in the receive path (Miquel Raynal)   
  - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected (Siddh Raman Pant)   
  - usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS (Krishna Kurapati)   
  - USB: core: Prevent nested device-reset calls (Alan Stern)   
  - s390: fix nospec table alignments (Josh Poimboeuf)   
  - s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages (Gerald Schaefer)   
  - usb-storage: Add ignore-residue quirk for NXP PN7462AU (Witold Lipieta)   
  - USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020) (Thierry GUIBERT)   
  - usb: dwc2: fix wrong order of phy_power_on and phy_init (Heiner Kallweit)   
  - USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode (Slark Xiao)   
  - USB: serial: option: add Quectel EM060K modem (Yonglin Tan)   
  - USB: serial: option: add support for OPPO R11 diag port (Yan Xinyu)   
  - USB: serial: cp210x: add Decagon UCA device id (Johan Hovold)   
  - xhci: Add grace period after xHC start to prevent premature runtime suspend. (Mathias Nyman)   
  - thunderbolt: Use the actual buffer in tb_async_error() (Mika Westerberg)   
  - hwmon: (gpio-fan) Fix array out of bounds access (Armin Wolf)   
  - Input: rk805-pwrkey - fix module autoloading (Peter Robinson)   
  - drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported" (Colin Ian King)   
  - binder: fix UAF of ref->proc caused by race condition (Carlos Llamas)   
  - USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id (Niek Nooijens)   
  - vt: Clear selection before changing the font (Helge Deller)   
  - staging: rtl8712: fix use after free bugs (Dan Carpenter)   
  - serial: fsl_lpuart: RS485 RTS polariy is inverse (Shenwei Wang)   
  - kcm: fix strp_init() order and cleanup (Cong Wang)   
  - ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler (Duoming Zhou)   
  - wifi: cfg80211: debugfs: fix return type in ht40allow_map_read() (Dan Carpenter)   
  - platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask (Andy Shevchenko)   
  - drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg (Douglas Anderson)   
  - bpf: Fix the off-by-two error in range markings (Maxim Mikityanskiy)   
  - selftests/bpf: Fix test_align verifier log patterns (Stanislav Fomichev)   
  - bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() (John Fastabend)   
  - Linux 4.14.292 (Greg Kroah-Hartman)   
  - net: neigh: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - kprobes: don't call disarm_kprobe() for disabled kprobes (Kuniyuki Iwashima)   
  - netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y (Geert Uytterhoeven)   
  - s390/hypfs: avoid error message under KVM (Juergen Gross)   
  - neigh: fix possible DoS due to net iface start/stop loop (Denis V. Lunev)   
  - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (Jann Horn)   
  - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (Yang Jihong)   
  - fbdev: fb_pm2fb: Avoid potential divide by zero error (Letu Ren)   
  - HID: hidraw: fix memory leak in hidraw_release() (Karthik Alapati)   
  - media: pvrusb2: fix memory leak in pvr_probe (Dongliang Mu)   
  - Bluetooth: L2CAP: Fix build errors in some archs (Luiz Augusto von Dentz)   
  - kbuild: Fix include path in scripts/Makefile.modpost (Jing Leng)   
  - x86/bugs: Add "unknown" reporting for MMIO Stale Data (Pawan Gupta)   
  - x86/cpu: Add Tiger Lake to Intel family (Gayatri Kammela)   
  - s390/mm: do not trigger write fault when vma does not allow VM_WRITE (Gerald Schaefer)   
  - arm64: map FDT as RW for early_init_dt_scan() (Hsin-Yi Wang)   
  - mm: Force TLB flush for PFNMAP mappings before unlink_file_vma() (Jann Horn)   
  - md: call __md_stop_writes in md_stop (Guoqing Jiang)   
  - mm/hugetlb: fix hugetlb not supporting softdirty tracking (David Hildenbrand)   
  - asm-generic: sections: refactor memory_intersects (Quanyang Wang)   
  - loop: Check for overflow while configuring loop (Siddh Raman Pant)   
  - btrfs: check if root is readonly while setting security xattr (Goldwyn Rodrigues)   
  - ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter (Jacob Keller)   
  - net: Fix a data-race around sysctl_somaxconn. (Kuniyuki Iwashima)   
  - net: Fix a data-race around netdev_budget_usecs. (Kuniyuki Iwashima)   
  - net: Fix a data-race around netdev_budget. (Kuniyuki Iwashima)   
  - net: Fix a data-race around sysctl_net_busy_read. (Kuniyuki Iwashima)   
  - net: Fix a data-race around sysctl_net_busy_poll. (Kuniyuki Iwashima)   
  - net: Fix a data-race around sysctl_tstamp_allow_data. (Kuniyuki Iwashima)   
  - ratelimit: Fix data-races in ___ratelimit(). (Kuniyuki Iwashima)   
  - net: Fix data-races around weight_p and dev_weight_[rt]x_bias. (Kuniyuki Iwashima)   
  - netfilter: nft_payload: do not truncate csum_offset and csum_type (Pablo Neira Ayuso)   
  - netfilter: nft_payload: report ERANGE for too long offset and length (Pablo Neira Ayuso)   
  - net: ipvtap - add __init/__exit annotations to module init/exit funcs (Maciej Żenczykowski)   
  - bonding: 802.3ad: fix no transmission of LACPDUs (Jonathan Toppins)   
  - rose: check NULL rose_loopback_neigh->loopback (Bernard Pidoux)   
  - xfrm: fix refcount leak in __xfrm_policy_check() (Xin Xiong)   
  - pinctrl: amd: Don't save/restore interrupt status and wake status bits (Basavaraj Natikar)   
  - parisc: Fix exception handler for fldw and fstw instructions (Helge Deller)   
  - audit: fix potential double free on error path from fsnotify_add_inode_mark (Gaosheng Cui)   
  - Linux 4.14.291 (Greg Kroah-Hartman)   
  - MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 (Nathan Chancellor)   
  - video: fbdev: i740fb: Check the argument of i740_calc_vclk() (Zheyu Ma)   
  - powerpc/64: Init jump labels before parse_early_param() (Zhouyi Zhou)   
  - smb3: check xattr value length earlier (Steve French)   
  - ALSA: timer: Use deferred fasync helper (Takashi Iwai)   
  - ALSA: core: Add async signal helpers (Takashi Iwai)   
  - mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start (Liang He)   
  - vfio: Clear the caps->buf to NULL after free (Schspa Shi)   
  - tty: serial: Fix refcount leak bug in ucc_uart.c (Liang He)   
  - ext4: avoid resizing to a partial cluster size (Kiselev, Oleg)   
  - ext4: avoid remove directory when directory is corrupted (Ye Bin)   
  - drivers:md:fix a potential use-after-free bug (Wentao_Liang)   
  - cxl: Fix a memory leak in an error handling path (Christophe JAILLET)   
  - gadgetfs: ep_io - wait until IRQ finishes (Jozef Martiniak)   
  - clk: qcom: ipq8074: dont disable gcc_sleep_clk_src (Robert Marko)   
  - usb: host: ohci-ppc-of: Fix refcount leak bug (Liang He)   
  - irqchip/tegra: Fix overflow implicit truncation warnings (Sai Prakash Ranjan)   
  - PCI: Add ACS quirk for Broadcom BCM5750x NICs (Pavan Chebbi)   
  - drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() (Liang He)   
  - btrfs: raid56: don't trust any cached sector in __raid56_parity_recover() (Qu Wenruo)   
  - btrfs: only write the sectors in the vertical stripe which has data stripes (Qu Wenruo)   
  - kbuild: clear LDFLAGS in the top Makefile (Masahiro Yamada)   
  - igb: Add lock to avoid data race (Lin Ma)   
  - fec: Fix timer capture timing in `fec_ptp_enable_pps()` (Csókás Bence)   
  - i40e: Fix to stop tx_timeout recovery if GLOBR fails (Alan Brady)   
  - powerpc/pci: Fix get_phb_number() locking (Michael Ellerman)   
  - netfilter: nf_tables: really skip inactive sets when allocating name (Pablo Neira Ayuso)   
  - nios2: add force_successful_syscall_return() (Al Viro)   
  - nios2: restarts apply only to the first sigframe we build... (Al Viro)   
  - nios2: fix syscall restart checks (Al Viro)   
  - nios2: traced syscall does need to check the syscall number (Al Viro)   
  - nios2: don't leave NULLs in sys_call_table[] (Al Viro)   
  - nios2: page fault et.al. are *not* restartable syscalls... (Al Viro)   
  - atm: idt77252: fix use-after-free bugs caused by tst_timer (Duoming Zhou)   
  - xen/xenbus: fix return type in xenbus_file_read() (Dan Carpenter)   
  - tools build: Switch to new openssl API for test-libcrypto (Roberto Sassu)   
  - vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout() (Peilin Ye)   
  - vsock: Fix memory leak in vsock_connect() (Peilin Ye)   
  - geneve: do not use RT_TOS for IPv6 flowlabel (Matthias May)   
  - ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool (Sakari Ailus)   
  - pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed (Nikita Travkin)   
  - pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map (Miaoqian Lin)   
  - SUNRPC: Reinitialise the backchannel request buffers before reuse (Trond Myklebust)   
  - NFSv4.1: RECLAIM_COMPLETE must handle EACCES (Zhang Xianwei)   
  - apparmor: fix reference count leak in aa_pivotroot() (Xin Xiong)   
  - apparmor: fix aa_label_asxprint return check (Tom Rix)   
  - apparmor: Fix failed mount permission check error message (John Johansen)   
  - apparmor: fix quiet_denied for file rules (John Johansen)   
  - can: ems_usb: fix clang's -Wunaligned-access warning (Marc Kleine-Budde)   
  - btrfs: fix lost error handling when looking up extended ref on log replay (Filipe Manana)   
  - ata: libata-eh: Add missing command name (Damien Le Moal)   
  - ALSA: info: Fix llseek return value when using callback (Amadeusz Sławiński)   
  - powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E (Christophe Leroy)   
  - net_sched: cls_route: disallow handle of 0 (Jamal Hadi Salim)   
  - net/9p: Initialize the iounit field during fid creation (Tyler Hicks)   
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression (Luiz Augusto von Dentz)   
  - Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" (Jose Alonso)   
  - scsi: sg: Allow waiting for commands to complete on removed device (Tony Battersby)   
  - tcp: fix over estimation in sk_forced_mem_schedule() (Eric Dumazet)   
  - btrfs: reject log replay if there is unsupported RO compat flag (Qu Wenruo)   
  - dm raid: fix address sanitizer warning in raid_status (Mikulas Patocka)   
  - dm raid: fix address sanitizer warning in raid_resume (Mikulas Patocka)   
  - intel_th: pci: Add Meteor Lake-P support (Alexander Shishkin)   
  - intel_th: pci: Add Raptor Lake-S PCH support (Alexander Shishkin)   
  - intel_th: pci: Add Raptor Lake-S CPU support (Alexander Shishkin)   
  - ext4: correct the misjudgment in ext4_iget_extra_inode (Baokun Li)   
  - ext4: correct max_inline_xattr_value_size computing (Baokun Li)   
  - ext4: fix extent status tree race in writeback error recovery path (Eric Whitney)   
  - ext4: update s_overhead_clusters in the superblock during an on-line resize (Theodore Ts'o)   
  - ext4: fix use-after-free in ext4_xattr_set_entry (Baokun Li)   
  - ext4: make sure ext4_append() always allocates new block (Lukas Czerner)   
  - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (Baokun Li)   
  - spmi: trace: fix stack-out-of-bound access in SPMI tracing functions (David Collins)   
  - x86/olpc: fix 'logical not is only applied to the left hand side' (Alexander Lobakin)   
  - scsi: zfcp: Fix missing auto port scan and thus missing target ports (Steffen Maier)   
  - video: fbdev: s3fb: Check the size of screen before memset_io() (Zheyu Ma)   
  - video: fbdev: arkfb: Check the size of screen before memset_io() (Zheyu Ma)   
  - video: fbdev: vt8623fb: Check the size of screen before memset_io() (Zheyu Ma)   
  - tools/thermal: Fix possible path truncations (Florian Fainelli)   
  - video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() (Zheyu Ma)   
  - x86/numa: Use cpumask_available instead of hardcoded NULL check (Siddh Raman Pant)   
  - genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO (Arnaldo Carvalho de Melo)   
  - powerpc/pci: Fix PHB numbering when using opal-phbid (Michael Ellerman)   
  - kprobes: Forbid probing on trampoline and BPF code areas (Chen Zhongjin)   
  - powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address (Miaoqian Lin)   
  - powerpc/xive: Fix refcount leak in xive_get_max_prio (Miaoqian Lin)   
  - powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader (Miaoqian Lin)   
  - powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias (Pali Rohár)   
  - video: fbdev: sis: fix typos in SiS_GetModeID() (Rustam Subkhankulov)   
  - video: fbdev: amba-clcd: Fix refcount leak bugs (Liang He)   
  - s390/zcore: fix race when reading from hardware system area (Alexander Gordeev)   
  - iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop (Liang He)   
  - mfd: t7l66xb: Drop platform disable callback (Uwe Kleine-König)   
  - kfifo: fix kfifo_to_user() return type (Dan Carpenter)   
  - iommu/exynos: Handle failed IOMMU device registration properly (Sam Protsenko)   
  - tty: n_gsm: fix DM command (Daniel Starke)   
  - tty: n_gsm: fix wrong T1 retry count handling (Daniel Starke)   
  - vfio/ccw: Do not change FSM state in subchannel event (Eric Farman)   
  - remoteproc: qcom: wcnss: Fix handling of IRQs (Sireesh Kodali)   
  - tty: n_gsm: fix race condition in gsmld_write() (Daniel Starke)   
  - tty: n_gsm: fix packet re-transmission without open control channel (Daniel Starke)   
  - tty: n_gsm: fix non flow control frames during mux flow off (Daniel Starke)   
  - profiling: fix shift too large makes kernel panic (Chen Zhongjin)   
  - ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe (Miaoqian Lin)   
  - ASoC: codecs: da7210: add check for i2c_add_driver (Jiasheng Jiang)   
  - ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe (Miaoqian Lin)   
  - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (Zhihao Cheng)   
  - ext4: recover csum seed of tmp_inode after migrating to extents (Li Lingfeng)   
  - RDMA/rxe: Fix error unwind in rxe_create_qp() (Zhu Yanjun)   
  - mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region (Miaohe Lin)   
  - platform/olpc: Fix uninitialized data in debugfs write (Dan Carpenter)   
  - USB: serial: fix tty-port initialized comments (Johan Hovold)   
  - mmc: cavium-thunderx: Add of_node_put() when breaking out of loop (Liang He)   
  - mmc: cavium-octeon: Add of_node_put() when breaking out of loop (Liang He)   
  - gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() (Liang He)   
  - RDMA/hfi1: fix potential memory leak in setup_base_ctxt() (Jianglei Nie)   
  - usb: gadget: udc: amd5536 depends on HAS_DMA (Randy Dunlap)   
  - scsi: smartpqi: Fix DMA direction for RAID requests (Mahesh Rajashekhara)   
  - mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R (Eugen Hristev)   
  - memstick/ms_block: Fix a memory leak (Christophe JAILLET)   
  - memstick/ms_block: Fix some incorrect memory allocation (Christophe JAILLET)   
  - mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch (Miaoqian Lin)   
  - misc: rtsx: Fix an error handling path in rtsx_pci_probe() (Christophe JAILLET)   
  - usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe (Miaoqian Lin)   
  - usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe (Miaoqian Lin)   
  - fpga: altera-pr-ip: fix unsigned comparison with less than zero (Marco Pagani)   
  - mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path (Uwe Kleine-König)   
  - mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release (Duoming Zhou)   
  - mtd: maps: Fix refcount leak in ap_flash_init (Miaoqian Lin)   
  - mtd: maps: Fix refcount leak in of_flash_probe_versatile (Miaoqian Lin)   
  - dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock (Hangyu Hua)   
  - net: rose: fix netdev reference changes (Eric Dumazet)   
  - wifi: libertas: Fix possible refcount leak in if_usb_probe() (Hangyu Hua)   
  - wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` (Ammar Faizi)   
  - i2c: mux-gpmux: Add of_node_put() when breaking out of loop (Liang He)   
  - i2c: cadence: Support PEC for SMBus block read (Lars-Peter Clausen)   
  - Bluetooth: hci_intel: Add check for platform_driver_register (Jiasheng Jiang)   
  - can: pch_can: pch_can_error(): initialize errc before using it (Vincent Mailhol)   
  - can: error: specify the values of data[5..7] of CAN error frames (Vincent Mailhol)   
  - can: usb_8dev: do not report txerr and rxerr during bus-off (Vincent Mailhol)   
  - can: sun4i_can: do not report txerr and rxerr during bus-off (Vincent Mailhol)   
  - can: hi311x: do not report txerr and rxerr during bus-off (Vincent Mailhol)   
  - can: sja1000: do not report txerr and rxerr during bus-off (Vincent Mailhol)   
  - can: rcar_can: do not report txerr and rxerr during bus-off (Vincent Mailhol)   
  - can: pch_can: do not report txerr and rxerr during bus-off (Vincent Mailhol)   
  - wifi: p54: add missing parentheses in p54_flush() (Rustam Subkhankulov)   
  - wifi: p54: Fix an error handling path in p54spi_probe() (Christophe JAILLET)   
  - wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() (Dan Carpenter)   
  - fs: check FMODE_LSEEK to control internal pipe splicing (Jason A. Donenfeld)   
  - selftests: timers: clocksource-switch: fix passing errors from child (Wolfram Sang)   
  - selftests: timers: valid-adjtimex: build fix for newer toolchains (Wolfram Sang)   
  - tcp: make retransmitted SKB fit into the send window (Yonglong Li)   
  - media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment (AngeloGioacchino Del Regno)   
  - drm: bridge: sii8620: fix possible off-by-one (Hangyu Hua)   
  - drm/mediatek: dpi: Remove output format of YUV (Bo-Chen Chen)   
  - drm/rockchip: vop: Don't crash for invalid duplicate_state() (Brian Norris)   
  - drm/vc4: dsi: Correct DSI divider calculations (Dave Stevenson)   
  - media: hdpvr: fix error value returns in hdpvr_read (Niels Dossche)   
  - drm: bridge: adv7511: Add check for mipi_dsi_driver_register (Jiasheng Jiang)   
  - wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd() (Alexey Kodanev)   
  - ath9k: fix use-after-free in ath9k_hif_usb_rx_cb (Pavel Skripkin)   
  - i2c: Fix a potential use after free (Xu Wang)   
  - drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function (Xinlei Lee)   
  - drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() (Alexey Kodanev)   
  - dm: return early from dm_pr_call() if DM device is suspended (Mike Snitzer)   
  - thermal/tools/tmon: Include pthread and time headers in tmon.h (Markus Mayer)   
  - regulator: of: Fix refcount leak bug in of_get_regulation_constraints() (Liang He)   
  - arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node (Sireesh Kodali)   
  - ARM: dts: qcom: pm8841: add required thermal-sensor-cells (Krzysztof Kozlowski)   
  - cpufreq: zynq: Fix refcount leak in zynq_get_revision (Miaoqian Lin)   
  - soc: fsl: guts: machine variable might be unset (Michael Walle)   
  - ARM: dts: ast2500-evb: fix board compatible (Krzysztof Kozlowski)   
  - x86/pmem: Fix platform-device leak in error path (Johan Hovold)   
  - ARM: bcm: Fix refcount leak in bcm_kona_smc_init (Miaoqian Lin)   
  - ARM: findbit: fix overflowing offset (Russell King (Oracle))   
  - selinux: Add boundary check in put_entry() (Xiu Jianfeng)   
  - PM: hibernate: defer device probing when resuming from hibernation (Tetsuo Handa)   
  - ACPI: LPSS: Fix missing check in register_device_clock() (huhai)   
  - ACPI: PM: save NVS memory for Lenovo G40-45 (Manyi Li)   
  - ARM: OMAP2+: display: Fix refcount leak bug (Liang He)   
  - ARM: dts: imx6ul: fix qspi node compatible (Alexander Stein)   
  - ARM: dts: imx6ul: add missing properties for sram (Alexander Stein)   
  - ext2: Add more validity checks for inode counts (Jan Kara)   
  - arm64: fix oops in concurrently setting insn_emulation sysctls (haibinzhang (张海斌))   
  - arm64: Do not forget syscall when starting a new thread. (Francis Laniel)   
  - netfilter: nf_tables: fix null deref due to zeroed list head (Florian Westphal)   
  - USB: HCD: Fix URB giveback issue in tasklet function (Weitao Wang)   
  - MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK (Huacai Chen)   
  - powerpc/powernv: Avoid crashing if rng is NULL (Michael Ellerman)   
  - powerpc/fsl-pci: Fix Class Code of PCIe Root Port (Pali Rohár)   
  - PCI: Add defines for normal and subtractive PCI bridges (Pali Rohár)   
  - ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() (Alexander Lobakin)   
  - md-raid10: fix KASAN warning (Mikulas Patocka)   
  - fuse: limit nsec (Miklos Szeredi)   
  - iio: light: isl29028: Fix the warning in isl29028_remove() (Zheyu Ma)   
  - drm/amdgpu: Check BO's requested pinning domains against its preferred_domains (Leo Li)   
  - drm/nouveau: fix another off-by-one in nvbios_addr (Timur Tabi)   
  - parisc: Fix device names in /proc/iomem (Helge Deller)   
  - usbnet: Fix linkwatch use-after-free on disconnect (Lukas Wunner)   
  - fs: Add missing umask strip in vfs_tmpfile (Yang Xu)   
  - vfs: Check the truncate maximum size in inode_newsize_ok() (David Howells)   
  - ALSA: hda/cirrus - support for iMac 12,1 model (Allen Ballway)   
  - ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model (Meng Tang)   
  - KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP (Sean Christopherson)   
  - KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks (Sean Christopherson)   
  - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (Maciej S. Szmigiero)   
  - HID: wacom: Don't register pad_input for touch switch (Ping Cheng)   
  - add barriers to buffer_uptodate and set_buffer_uptodate (Mikulas Patocka)   
  - ALSA: bcd2000: Fix a UAF bug on the error path of probing (Zheyu Ma)   
  - x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments (Nick Desaulniers)   
  - Makefile: link with -z noexecstack --no-warn-rwx-segments (Nick Desaulniers)   
  - macintosh/adb: fix oob read in do_adb_query() function (Ning Qiang)   
  - ACPI: video: Shortening quirk list by identifying Clevo by board_name only (Werner Sembach)   
  - ACPI: video: Force backlight native for some TongFang devices (Werner Sembach)   
  - mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle. (Wei Mingzhi)   
  - ARM: crypto: comment out gcc warning that breaks clang builds (Greg Kroah-Hartman)   
  - netfilter: nf_queue: do not allow packet truncation below transport header offset (Florian Westphal)   
  - net: sungem_phy: Add of_node_put() for reference returned by of_get_parent() (Liang He)   
  - net: ping6: Fix memleak in ipv6_renew_options(). (Kuniyuki Iwashima)   
  - scsi: ufs: host: Hold reference returned by of_parse_phandle() (Liang He)   
  - s390/archrandom: prevent CPACF trng invocations in interrupt context (Harald Freudenberger)   
  - ntfs: fix use-after-free in ntfs_ucsncmp() (ChenXiaoSong)   
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (Luiz Augusto von Dentz)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.519.1.el7uek]
changelog:
  - uek: kabi: update kABI files for new symbol (Saeed Mirzamohammadi)  [Orabug: 34595585]  
  - EDAC/mce_amd: Do not load edac_mce_amd module on guests (Smita Koralahalli)  [Orabug: 34484269]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.519.2.el7uek]
changelog:
  - Revert "xfs: don't use delalloc extents for COW on files with extsize hints" (Saeed Mirzamohammadi)  [Orabug: 34715947]  
  - uapi: Fix linux/rds.h userspace compilation issues (Ka-Cheong Poon)  [Orabug: 32392165] [Orabug: 34710962]  
  - uapi: Fix linux/rds.h userspace compilation errors. (Vinson Lee)  [Orabug: 34710962]  
  - uapi: fix linux/rds.h userspace compilation error (Dmitry V. Levin)  [Orabug: 34710962]  
  - uapi: fix linux/rds.h userspace compilation errors (Dmitry V. Levin)  [Orabug: 34710962]  
  - EDAC: Drop duplicated array of strings for memory type names (Jane Chu)  [Orabug: 34645040]  
  - xfs: don't ever put nlink > 0 inodes on the unlinked list (Darrick J. Wong)  [Orabug: 34431355]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.519.2.1.el7uek]
changelog:
  - xfs: trim IO to found COW extent limit (Eric Sandeen)  [Orabug: 34765284]  
  - xfs: don't use delalloc extents for COW on files with extsize hints (Christoph Hellwig)  [Orabug: 34765284]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.520.0.el7uek]
changelog:
  - uapi: Fix [rs]cq_vector data types in rds[6]_info_rdma_connection (Mark Haywood)  [Orabug: 34732042]  
  - uapi: Fix congested flag type in rds[6]_info_socket (Mark Haywood)  [Orabug: 34732042]  
  - scsi: target: core: Silence the message about unknown VPD pages (Konstantin Shelekhin)  [Orabug: 34728690]  
  - mISDN: fix use-after-free bugs in l1oip timer handlers (Duoming Zhou)  [Orabug: 34719782]  {CVE-2022-3565} 
  - uek-rpm: add aarch64 to list of vdso arches (Tom Saeger)  [Orabug: 34716203]  
  - xfs: trim IO to found COW extent limit (Eric Sandeen)  [Orabug: 34705398]  
  - xfs: don't use delalloc extents for COW on files with extsize hints (Christoph Hellwig)  [Orabug: 34705398]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.520.1.el7uek]
changelog:
  - rds: ib: Fix cleanup of rds_ib_cache_gc_worker (Håkon Bugge)  [Orabug: 34806078]  
  - scsi: stex: Properly zero out the passthrough command structure (Linus Torvalds)  [Orabug: 34670756]  {CVE-2022-40768} 
  - do_wait: make PIDTYPE_PID case O(1) instead of O(n) (Jim Newsome)  [Orabug: 34420117]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.520.2.el7uek]
changelog:
  - rds: Remove the cp_rdsinfo_pending flag (Håkon Bugge)  [Orabug: 34658891]  
  - RDMA/mlx5: Change debug log level for remote access error syndromes (Arumugam Kolappan)  [Orabug: 34798453]


author: Jack Vogel <jack.vogel@oracle.com> [4.14.35-2047.520.3.1.el7uek]
changelog:
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Linus Torvalds)  [Orabug: 34883027]  {CVE-2022-4378} 
  - proc: avoid integer type confusion in get_proc_long (Linus Torvalds)  [Orabug: 34883027]  {CVE-2022-4378} 
  - hugetlbfs: don't delete error page from pagecache (James Houghton)  [Orabug: 34883072]  
  - mm: shmem: don't truncate page if memory failure happens (Yang Shi)  [Orabug: 34883072]  
  - mm: hwpoison: refactor refcount check handling (Yang Shi)  [Orabug: 34883072]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.521.1.el7uek]
changelog:
  - net/mlx5: Use debug message instead of warn (Yishai Hadas)  [Orabug: 34834553]  
  - hugetlbfs: don't delete error page from pagecache (James Houghton)  [Orabug: 34772618]  
  - mm: shmem: don't truncate page if memory failure happens (Yang Shi)  [Orabug: 34772618]  
  - mm: hwpoison: refactor refcount check handling (Yang Shi)  [Orabug: 34772618]  
  - kvm: x86: limit the maximum number of vPMU fixed counters to 3 (Like Xu)  [Orabug: 34756992]  
  - LTS version: v4.14.298 (Saeed Mirzamohammadi)   
  - can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive (Biju Das)   
  - net: ehea: fix possible memory leak in ehea_register_port() (Yang Yingliang)   
  - openvswitch: switch from WARN to pr_warn (Aaron Conole)   
  - ALSA: aoa: Fix I2S device accounting (Takashi Iwai)   
  - ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() (Yang Yingliang)   
  - PM: domains: Fix handling of unavailable/disabled idle states (Sudeep Holla)   
  - net: ksz884x: fix missing pci_disable_device() on error in pcidev_init() (Yang Yingliang)   
  - i40e: Fix flow-type by setting GL_HASH_INSET registers (Slawomir Laba)   
  - i40e: Fix ethtool rx-flow-hash setting for X722 (Slawomir Laba)   
  - media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced' (Hans Verkuil)   
  - media: v4l2-dv-timings: add sanity checks for blanking values (Hans Verkuil)   
  - media: vivid: dev->bitmap_cap wasn't freed in all cases (Hans Verkuil)   
  - media: vivid: s_fbuf: add more sanity checks (Hans Verkuil)   
  - PM: hibernate: Allow hybrid sleep to work with s2idle (Mario Limonciello)   
  - can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path (Dongliang Mu)   
  - tcp: fix indefinite deferral of RTO with SACK reneging (Neal Cardwell)   
  - net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY (Zhang Changzhong)   
  - kcm: annotate data-races around kcm->rx_wait (Eric Dumazet)   
  - kcm: annotate data-races around kcm->rx_psock (Eric Dumazet)   
  - amd-xgbe: add the bit rate quirk for Molex cables (Raju Rangoju)   
  - amd-xgbe: fix the SFP compliance codes check for DAC cables (Raju Rangoju)   
  - x86/unwind/orc: Fix unreliable stack dump with gcov (Chen Zhongjin)   
  - ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() (Yang Yingliang)   
  - arc: iounmap() arg is volatile (Randy Dunlap)   
  - drm/msm: Fix return type of mdp4_lvds_connector_mode_valid (Nathan Huckleberry)   
  - net: ieee802154: fix error return code in dgram_bind() (Wei Yongjun)   
  - mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (Rik van Riel)   
  - xen/gntdev: Prevent leaking grants (M. Vefa Bicakci)   
  - Xen/gntdev: don't ignore kernel unmapping error (Jan Beulich)   
  - s390/futex: add missing EX_TABLE entry to __futex_atomic_op() (Heiko Carstens)   
  - kernfs: fix use-after-free in __kernfs_remove (Christian A. Ehrhardt)   
  - mmc: core: Fix kernel panic when remove non-standard SDIO card (Matthew Ma)   
  - drm/msm/hdmi: fix memory corruption with too many bridges (Johan Hovold)   
  - mac802154: Fix LQI recording (Miquel Raynal)   
  - fbdev: smscufx: Fix several use-after-free bugs (Hyunwoo Kim)   
  - iio: light: tsl2583: Fix module unloading (Shreeya Patel)   
  - tools: iio: iio_utils: fix digit calculation (Matti Vaittinen)   
  - xhci: Remove device endpoints from bandwidth list when freeing the device (Mathias Nyman)   
  - usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller (Jens Glathe)   
  - usb: bdc: change state when port disconnected (Justin Chen)   
  - usb: dwc3: gadget: Don't set IMI for no_interrupt (Thinh Nguyen)   
  - USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM (Hannu Hartikainen)   
  - ALSA: au88x0: use explicitly signed char (Jason A. Donenfeld)   
  - ALSA: Use del_timer_sync() before freeing timer (Steven Rostedt (Google))   
  - ACPI: video: Force backlight native for more TongFang devices (Werner Sembach)   
  - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls (Chen-Yu Tsai)   
  - iommu/vt-d: Clean up si_domain in the init_dmars() error path (Jerry Snitselaar)   
  - net: hns: fix possible memory leak in hnae_ae_register() (Yang Yingliang)   
  - net/atm: fix proc_mpc_write incorrect return value (Xiaobo Liu)   
  - HID: magicmouse: Do not set BTN_MOUSE on double report (José Expósito)   
  - ACPI: extlog: Handle multiple records (Tony Luck)   
  - btrfs: fix processing of delayed data refs during backref walking (Filipe Manana)   
  - r8152: add PID for the Lenovo OneLink+ Dock (Jean-Francois Le Fillatre)   
  - arm64: errata: Remove AES hwcap for COMPAT tasks (James Morse)   
  - KVM: arm64: vgic: Fix exit condition in scan_its_table() (Eric Ren)   
  - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS (Kai-Heng Feng)   
  - ata: ahci-imx: Fix MODULE_ALIAS (Alexander Stein)   
  - x86/microcode/AMD: Apply the patch early on every logical thread (Borislav Petkov)   
  - ocfs2: fix BUG when iput after ocfs2_mknod fails (Joseph Qi)   
  - ocfs2: clear dinode links count in case of error (Joseph Qi)   
  - LTS version: v4.14.297 is skipped (Saeed Mirzamohammadi)   
  - LTS version: v4.14.296 (Saeed Mirzamohammadi)   
  - thermal: intel_powerclamp: Use first online CPU as control_cpu (Rafael J. Wysocki)   
  - inet: fully convert sk->sk_rx_dst to RCU rules (Eric Dumazet)   
  - efi: libstub: drop pointless get_memory_map() call (Ard Biesheuvel)   
  - md: Replace snprintf with scnprintf (Saurabh Sengar)   
  - ext4: continue to expand file system when the target size doesn't reach (Jerry Lee 李修賢)   
  - net/ieee802154: don't warn zero-sized raw_sendmsg() (Tetsuo Handa)   
  - net: ieee802154: return -EINVAL for unknown addr type (Alexander Aring)   
  - perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc (Adrian Hunter)   
  - usb: idmouse: fix an uninit-value in idmouse_open (Dongliang Mu)   
  - Revert "usb: storage: Add quirk for Samsung Fit flash" (sunghwan jung)   
  - usb: musb: Fix musb_gadget.c rxstate overflow bug (Robin Guo)   
  - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() (Jianglei Nie)   
  - md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d (Logan Gunthorpe)   
  - HID: roccat: Fix use-after-free in roccat_read() (Hyunwoo Kim)   
  - nbd: Fix hung when signal interrupts nbd_start_device_ioctl() (Shigeru Yoshida)   
  - scsi: 3w-9xxx: Avoid disabling device if failing to enable it (Letu Ren)   
  - media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (Zheyu Ma)   
  - ARM: dts: imx6sl: add missing properties for sram (Alexander Stein)   
  - ARM: dts: imx6qp: add missing properties for sram (Alexander Stein)   
  - ARM: dts: imx6dl: add missing properties for sram (Alexander Stein)   
  - ARM: dts: imx6q: add missing properties for sram (Alexander Stein)   
  - ARM: dts: imx7d-sdb: config the max pressure for tsc2046 (Haibo Chen)   
  - drm/amdgpu: fix initial connector audio value (hongao)   
  - platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading (Hans de Goede)   
  - drm/vc4: vec: Fix timings for VEC modes (Mateusz Kwiatkowski)   
  - drm: Prevent drm_copy_field() to attempt copying a NULL pointer (Javier Martinez Canillas)   
  - drm: Use size_t type for len variable in drm_copy_field() (Javier Martinez Canillas)   
  - r8152: Rate limit overflow messages (Andrew Gaul)   
  - Bluetooth: L2CAP: Fix user-after-free (Luiz Augusto von Dentz)   
  - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory (Liu Jian)   
  - wifi: rt2x00: correctly set BBP register 86 for MT7620 (Daniel Golle)   
  - wifi: rt2x00: set SoC wmac clock register (Daniel Golle)   
  - wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 (Daniel Golle)   
  - wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 (Daniel Golle)   
  - can: bcm: check the result of can_send() in bcm_can_tx() (Ziyang Xuan)   
  - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (Luiz Augusto von Dentz)   
  - Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() (Tetsuo Handa)   
  - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (Alexander Coffin)   
  - xfrm: Update ipcomp_scratches with NULL when freed (Khalid Masum)   
  - wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() (Tetsuo Handa)   
  - tcp: annotate data-race around tcp_md5sig_pool_populated (Eric Dumazet)   
  - openvswitch: Fix overreporting of drops in dropwatch (Mike Pattrick)   
  - openvswitch: Fix double reporting of drops in dropwatch (Mike Pattrick)   
  - wifi: brcmfmac: fix invalid address access when enabling SCAN log level (Wright Feng)   
  - NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data (Anna Schumaker)   
  - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash (Srinivas Pandruvada)   
  - powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue (Chao Qin)   
  - MIPS: BCM47XX: Cast memcmp() of function to (void *) (Kees Cook)   
  - ACPI: video: Add Toshiba Satellite/Portege Z830 quirk (Arvid Norlander)   
  - f2fs: fix race condition on setting FI_NO_EXTENT flag (Zhang Qilong)   
  - iommu/iova: Fix module config properly (Robin Murphy)   
  - iommu/omap: Fix buffer overflow in debugfs (Dan Carpenter)   
  - powerpc: Fix SPE Power ISA properties for e500v1 platforms (Pali Rohár)   
  - powerpc/powernv: add missing of_node_put() in opal_export_attrs() (Zheng Yongjun)   
  - powerpc/pci_dn: Add missing of_node_put() (Liang He)   
  - powerpc/sysdev/fsl_msi: Add missing of_node_put() (Liang He)   
  - powerpc/math_emu/efp: Include module.h (Nathan Chancellor)   
  - mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg (Jack Wang)   
  - clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe (Miaoqian Lin)   
  - clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration (Stefan Wahren)   
  - spmi: pmic-arb: correct duplicate APID to PPID mapping logic (David Collins)   
  - dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup() (Dave Jiang)   
  - mfd: sm501: Add check for platform_driver_register() (Jiasheng Jiang)   
  - mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init() (Christophe JAILLET)   
  - mfd: lp8788: Fix an error handling path in lp8788_probe() (Christophe JAILLET)   
  - mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq() (Christophe JAILLET)   
  - mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() (Christophe JAILLET)   
  - fsi: core: Check error number after calling ida_simple_get (Jiasheng Jiang)   
  - serial: 8250: Fix restoring termios speed after suspend (Pali Rohár)   
  - firmware: google: Test spinlock on panic path to avoid lockups (Guilherme G. Piccoli)   
  - phy: qualcomm: call clk_disable_unprepare in the error handling (Dongliang Mu)   
  - drivers: serial: jsm: fix some leaks in probe (Dan Carpenter)   
  - usb: gadget: function: fix dangling pnp_string in f_printer.c (Albert Briscoe)   
  - xhci: Don't show warning for reinit on known broken suspend (Mario Limonciello)   
  - md/raid5: Ensure stripe_fill happens on non-read IO with journal (Logan Gunthorpe)   
  - ata: fix ata_id_has_dipm() (Niklas Cassel)   
  - ata: fix ata_id_has_ncq_autosense() (Niklas Cassel)   
  - ata: fix ata_id_has_devslp() (Niklas Cassel)   
  - ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() (Niklas Cassel)   
  - dyndbg: let query-modname override actual module name (Jim Cromie)   
  - dyndbg: fix module.dyndbg handling (Jim Cromie)   
  - RDMA/rxe: Fix the error caused by qp->sk (Zhu Yanjun)   
  - RDMA/rxe: Fix "kernel NULL pointer dereference" error (Zhu Yanjun)   
  - media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init (Miaoqian Lin)   
  - tty: xilinx_uartps: Fix the ignore_status (Shubhrajyoti Datta)   
  - media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop (Liang He)   
  - HSI: omap_ssi_port: Fix dma_map_sg error check (Jack Wang)   
  - HSI: omap_ssi: Fix refcount leak in ssi_probe (Miaoqian Lin)   
  - clk: tegra20: Fix refcount leak in tegra20_clock_init (Miaoqian Lin)   
  - clk: tegra: Fix refcount leak in tegra114_clock_init (Miaoqian Lin)   
  - clk: tegra: Fix refcount leak in tegra210_clock_init (Miaoqian Lin)   
  - clk: oxnas: Hold reference returned by of_get_parent() (Liang He)   
  - iio: ABI: Fix wrong format of differential capacitance channel ABI. (Jonathan Cameron)   
  - iio: inkern: only release the device node when done with it (Nuno Sá)   
  - iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX (Claudiu Beznea)   
  - ARM: dts: exynos: fix polarity of VBUS GPIO of Origen (Dmitry Torokhov)   
  - ARM: Drop CMDLINE_* dependency on ATAGS (Geert Uytterhoeven)   
  - ARM: dts: kirkwood: lsxl: remove first ethernet port (Michael Walle)   
  - ARM: dts: kirkwood: lsxl: fix serial line (Michael Walle)   
  - ARM: dts: turris-omnia: Fix mpp26 pin name and comment (Marek Behún)   
  - soc: qcom: smem_state: Add refcounting for the 'state->of_node' (Liang He)   
  - soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() (Liang He)   
  - memory: of: Fix refcount leak bug in of_get_ddr_timings() (Liang He)   
  - mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe() (Christophe JAILLET)   
  - ALSA: dmaengine: increment buffer pointer atomically (Andreas Pape)   
  - ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API (Liang He)   
  - mmc: au1xmmc: Fix an error handling path in au1xmmc_probe() (Christophe JAILLET)   
  - drm/bridge: megachips: Fix a null pointer dereference bug (Zheyu Ma)   
  - platform/x86: msi-laptop: Fix resource cleanup (Hans de Goede)   
  - platform/x86: msi-laptop: Fix old-ec check for backlight registering (Hans de Goede)   
  - drm/mipi-dsi: Detach devices when removing the host (Maxime Ripard)   
  - bnx2x: fix potential memory leak in bnx2x_tpa_stop() (Jianglei Nie)   
  - tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited (Neal Cardwell)   
  - vhost/vsock: Use kvmalloc/kvfree for larger packets. (Junichi Uekawa)   
  - spi: s3c64xx: Fix large transfers with DMA (Vincent Whitchurch)   
  - netfilter: nft_fib: Fix for rpath check with VRF devices (Phil Sutter)   
  - spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe (Zhang Qilong)   
  - net: fs_enet: Fix wrong check in do_pd_setup (Zheng Yongjun)   
  - wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration (Bitterblue Smith)   
  - wifi: rtl8xxxu: Fix skb misuse in TX queue selection (Bitterblue Smith)   
  - spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime() (Xu Qiang)   
  - spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume() (Xu Qiang)   
  - wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse() (Dan Carpenter)   
  - wifi: mac80211: allow bw change during channel switch in mesh (Hari Chandrakanthan)   
  - wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() (Wen Gong)   
  - sh: machvec: Use char[] for section boundaries (Kees Cook)   
  - selinux: use "grep -E" instead of "egrep" (Greg Kroah-Hartman)   
  - gcov: support GCC 12.1 and newer compilers (Martin Liska)   
  - KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility (Michal Luczaj)   
  - ring-buffer: Fix race between reset page and reading page (Steven Rostedt (Google))   
  - ring-buffer: Check pending waiters when doing wake ups as well (Steven Rostedt (Google))   
  - ring-buffer: Allow splice to read previous partially read pages (Steven Rostedt (Google))   
  - ftrace: Properly unset FTRACE_HASH_FL_MOD (Zheng Yejian)   
  - livepatch: fix race between fork and KLP transition (Rik van Riel)   
  - ext4: place buffer head allocation before handle start (Jinke Han)   
  - ext4: make ext4_lazyinit_thread freezable (Lalith Rajendran)   
  - ext4: fix null-ptr-deref in ext4_write_info (Baokun Li)   
  - ext4: avoid crash when inline data creation follows DIO write (Jan Kara)   
  - nilfs2: fix lockdep warnings during disk space reclamation (Ryusuke Konishi)   
  - nilfs2: fix lockdep warnings in page operations for btree nodes (Ryusuke Konishi)   
  - nilfs2: fix use-after-free bug of struct nilfs_root (Ryusuke Konishi)   
  - fbdev: smscufx: Fix use-after-free in ufx_ops_open() (Hyunwoo Kim)   
  - PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge (Maciej W. Rozycki)   
  - UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK (Huacai Chen)   
  - parisc: fbdev/stifb: Align graphics memory size to 4MB (Helge Deller)   
  - Revert "fs: check FMODE_LSEEK to control internal pipe splicing" (Sasha Levin)   
  - regulator: qcom_rpm: Fix circular deferral regression (Linus Walleij)   
  - quota: Check next/prev free block number after reading from quota file (Zhihao Cheng)   
  - HID: multitouch: Add memory barriers (Andri Yngvason)   
  - fs: dlm: handle -EBUSY first in lock arg validation (Alexander Aring)   
  - fs: dlm: fix race between test_bit() and queue_work() (Alexander Aring)   
  - iio: dac: ad5593r: Fix i2c read protocol requirements (Michael Hennerich)   
  - ALSA: usb-audio: Fix NULL dererence at error path (Takashi Iwai)   
  - ALSA: usb-audio: Fix potential memory leaks (Takashi Iwai)   
  - ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() (Takashi Iwai)   
  - ALSA: oss: Fix potential deadlock at unregistration (Takashi Iwai)   
  - random: use expired timer rather than wq for mixing fast pool (Jason A. Donenfeld)   
  - Input: xpad - fix wireless 360 controller breaking after suspend (Cameron Gutman)   
  - Input: xpad - add supported devices as contributed on github (Pavel Rojtberg)   
  - wifi: mac80211_hwsim: avoid mac80211 warning on bad rate (Johannes Berg)   
  - random: avoid reading two cache lines on irq randomness (Jason A. Donenfeld)   
  - random: restore O_NONBLOCK support (Jason A. Donenfeld)   
  - USB: serial: qcserial: add new usb-id for Dell branded EM7455 (Frank Wunderlich)   
  - ALSA: hda: Fix position reporting on Poulsbo (Takashi Iwai)   
  - random: clamp credited irq bits to maximum mixed (Jason A. Donenfeld)   
  - ceph: don't truncate file in atomic_open (Hu Weiwen)   
  - nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure (Ryusuke Konishi)   
  - nilfs2: fix leak of nilfs_root in case of writer thread creation failure (Ryusuke Konishi)   
  - nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level() (Ryusuke Konishi)   
  - netfilter: nf_queue: fix socket leak (Vimal Agrawal)   
  - rpmsg: qcom: glink: replace strncpy() with strscpy_pad() (Krzysztof Kozlowski)   
  - mmc: core: Terminate infinite loop in SD-UHS voltage switch (Brian Norris)   
  - mmc: core: Replace with already defined values for readability (ChanWoo Lee)   
  - USB: serial: ftdi_sio: fix 300 bps rate for SIO (Johan Hovold)   
  - usb: mon: make mmapped memory read only (Tadeusz Struk)   
  - um: Cleanup compiler warning in arch/x86/um/tls_32.c (Lukas Straub)   
  - um: Cleanup syscall_handler_t cast in syscalls_32.h (Lukas Straub)   
  - net/ieee802154: fix uninit value bug in dgram_sendmsg (Haimin Zhang)   
  - ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer (Sergei Antonov)   
  - dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure (Swati Agarwal)   
  - dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property (Swati Agarwal)   
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Dongliang Mu)   
  - ARM: fix function graph tracer and unwinder dependencies (Russell King)   
  - i2c: dev: prevent ZERO_SIZE_PTR deref in i2cdev_ioctl_rdwr() (Alexander Popov)   
  - Makefile.extrawarn: Move -Wcast-function-type-strict to W=1 (Sami Tolvanen)   
  - clk: iproc: Do not rely on node name for correct PLL setup (Florian Fainelli)   
  - clk: iproc: Minor tidy up of iproc pll data structures (Lori Hikichi)   
  - selftests: Fix the if conditions of in test_extra_filter() (Wang Yufen)   
  - nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices (Michael Kelley)   
  - nvme: add new line after variable declatation (Chaitanya Kulkarni)   
  - usbnet: Fix memory leak in usbnet_disconnect() (Peilin Ye)   
  - Input: melfas_mip4 - fix return value check in mip4_probe() (Yang Yingliang)   
  - Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time" (Brian Norris)   
  - soc: sunxi: sram: Fix debugfs info for A64 SRAM C (Samuel Holland)   
  - soc: sunxi: sram: Actually claim SRAM regions (Samuel Holland)   
  - mm/migrate_device.c: flush TLB while holding PTL (Alistair Popple)   
  - mm: prevent page_frag_alloc() from corrupting the memory (Maurizio Lombardi)   
  - mm/page_alloc: fix race condition between build_all_zonelists and page allocation (Mel Gorman)   
  - mmc: moxart: fix 4-bit bus width and remove 8-bit bus width (Sergei Antonov)   
  - ntfs: fix BUG_ON in ntfs_lookup_inode_by_name() (ChenXiaoSong)   
  - net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 (Frank Wunderlich)   
  - uas: ignore UAS for Thinkplus chips (Hongling Zeng)   
  - usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS (Hongling Zeng)   
  - uas: add no-uas quirk for Hiksemi usb_disk (Hongling Zeng)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.521.2.el7uek]
changelog:
  - RDS/IB: Fix the misplaced counter update rdma dto path (Devesh Sharma)  [Orabug: 34865849]  
  - IB/ipoib: Do not warn if IPoIB debugfs doesn't exist (Alaa Hleihel)  [Orabug: 34780038]  
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Linus Torvalds)  [Orabug: 34882780]  {CVE-2022-4378} 
  - proc: avoid integer type confusion in get_proc_long (Linus Torvalds)  [Orabug: 34882780]  {CVE-2022-4378}


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.521.3.el7uek]
changelog:
  - Revert "random: use expired timer rather than wq for mixing fast pool" (Saeed Mirzamohammadi)  [Orabug: 34918228]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.522.1.el7uek]
changelog:
  - uek-rpm: ol7: Add enhanced kABI diagnostics (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: ol7: Add Symtypes files (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: ol7: Enable creation of Symtypes files (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: Add kabi tool and documentation (Stephen Brennan)  [Orabug: 34879138]  
  - xfs: don't reuse busy extents on extent trim (Brian Foster)  [Orabug: 34605583]  
  - RDMA/ucma: Put a lock around every call to the rdma_cm layer (Jason Gunthorpe)  [Orabug: 34106064]  
  - LTS version: v4.14.302 (Saeed Mirzamohammadi)   
  - net: mvneta: Fix an out of bounds check (Dan Carpenter)   
  - ipv6: avoid use-after-free in ip6_fragment() (Eric Dumazet)   
  - net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() (Yang Yingliang)   
  - ethernet: aeroflex: fix potential skb leak in greth_init_rings() (Zhang Changzhong)   
  - tipc: Fix potential OOB in tipc_link_proto_rcv() (YueHaibing)   
  - net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (Liu Jian)   
  - net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (Liu Jian)   
  - net: stmmac: fix "snps,axi-config" node property parsing (Jisheng Zhang)   
  - NFC: nci: Bounds check struct nfc_target arrays (Kees Cook)   
  - net: mvneta: Prevent out of bounds read in mvneta_config_rss() (Dan Carpenter)   
  - net: encx24j600: Fix invalid logic in reading of MISTAT register (Valentina Goncharenko)   
  - net: encx24j600: Add parentheses to fix precedence (Valentina Goncharenko)   
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (Wei Yongjun)   
  - Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() (Wang ShaoBo)   
  - igb: Allocate MSI-X vector when testing (Akihiko Odaki)   
  - e1000e: Fix TX dispatch condition (Akihiko Odaki)   
  - gpio: amd8111: Fix PCI device reference count leak (Xiongfeng Wang)   
  - ca8210: Fix crash by zero initializing data (Hauke Mehrtens)   
  - ieee802154: cc2520: Fix error return code in cc2520_hw_init() (Ziyang Xuan)   
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event (ZhangPeng)   
  - HID: hid-lg4ff: Add check for empty lbuf (Anastasia Belova)   
  - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (Thomas Huth)   
  - memcg: fix possible use-after-free in memcg_write_event_control() (Tejun Heo)   
  - media: v4l2-dv-timings.c: fix too strict blanking sanity checks (Hans Verkuil)   
  - xen/netback: do some code cleanup (Juergen Gross)   
  - net: usb: qmi_wwan: add u-blox 0x1342 composition (Davide Tronchin)   
  - regulator: twl6030: fix get status of twl6032 regulators (Andreas Kemnade)   
  - ASoC: soc-pcm: Add NULL check in BE reparenting (Srinivasa Rao Mandadapu)   
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (Kees Cook)   
  - ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 (Johan Jonker)   
  - ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation (Giulio Benetti)   
  - ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels (Tomislav Novak)   
  - ARM: dts: rockchip: fix ir-receiver node names (Johan Jonker)   
  - arm: dts: rockchip: fix node name for hym8563 rtc (Sebastian Reichel)   
  - LTS version: v4.14.301 (Saeed Mirzamohammadi)   
  - ipc/sem: Fix dangling sem_array access in semtimedop race (Jann Horn)   
  - v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails (Linus Torvalds)   
  - mmc: sdhci: Fix voltage switch delay (Adrian Hunter)   
  - mmc: sdhci: use FIELD_GET for preset value bit masks (Masahiro Yamada)   
  - x86/ioremap: Fix page aligned size calculation in __ioremap_caller() (Michael Kelley)   
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (Luiz Augusto von Dentz)   {CVE-2022-42896} 
  - x86/pm: Add enumeration check before spec MSRs save/restore setup (Saeed Mirzamohammadi)   
  - nvme: restrict management ioctls to admin (Keith Busch)   
  - tcp/udp: Fix memory leak in ipv6_renew_options(). (Kuniyuki Iwashima)  [Orabug: 34719346]  {CVE-2022-3524} 
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (Xiongfeng Wang)   
  - pinctrl: single: Fix potential division by zero (Maxim Korotkov)   
  - ASoC: ops: Fix bounds check for _sx controls (Mark Brown)   
  - efi: random: Properly limit the size of the random seed (Ben Hutchings)   
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (ZhangPeng)   
  - tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" (Tiezhu Yang)   
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (ChenXiaoSong)   
  - perf: Add sample_flags to indicate the PMU-filled sample data (Kan Liang)   
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (Yang Yingliang)   
  - hwmon: (coretemp) Check for null before removing sysfs attrs (Phil Auld)   
  - net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed (Yoshihiro Shimoda)   
  - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE (Willem de Bruijn)   
  - net: hsr: Fix potential use-after-free (YueHaibing)   
  - dsa: lan9303: Correct stat name (Jerry Ray)   
  - net/9p: Fix a potential socket leak in p9_socket_open (Wang Hai)   
  - net: net_netdev: Fix error handling in ntb_netdev_init_module() (Yuan Can)   
  - net: phy: fix null-ptr-deref while probe() failed (Yang Yingliang)   
  - qlcnic: fix sleep-in-atomic-context bugs caused by msleep (Duoming Zhou)   
  - can: cc770: cc770_isa_probe(): add missing free_cc770dev() (Zhang Changzhong)   
  - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() (Zhang Changzhong)   
  - net/mlx5: Fix uninitialized variable bug in outlen_write() (YueHaibing)   
  - of: property: decrement node refcount in of_fwnode_get_reference_args() (Yang Yingliang)   
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (Gaosheng Cui)   
  - hwmon: (i5500_temp) fix missing pci_disable_device() (Yang Yingliang)   
  - iio: light: rpr0521: add missing Kconfig dependencies (Paul Gazzillo)   
  - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw (Wei Yongjun)   
  - iio: health: afe4403: Fix oob read in afe4403_read_raw (Wei Yongjun)   
  - drm/amdgpu: always register an MMU notifier for userptr (Christian König)   
  - net: usb: qmi_wwan: add Telit 0x103a composition (Enrico Sau)   
  - tcp: configurable source port perturb table size (Gleb Mazovetskiy)   
  - platform/x86: hp-wmi: Ignore Smart Experience App event (Kai-Heng Feng)   
  - platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) (Hans de Goede)   
  - platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() (Xiongfeng Wang)   
  - xen/platform-pci: add missing free_irq() in error path (ruanjinjie)   
  - serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() (Lukas Wunner)   
  - Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode (Aman Dhoot)   
  - nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty (Chen Zhongjin)   
  - kconfig: display recursive dependency resolution hint just once (Masahiro Yamada)   
  - iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails (Chen Zhongjin)   
  - iio: light: apds9960: fix wrong register for gesture gain (Alejandro Concepción Rodríguez)   
  - arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency (Jakob Unterwurzacher)   
  - nios2: add FORCE for vmlinuz.gz (Randy Dunlap)   
  - s390/crashdump: fix TOD programmable field size (Heiko Carstens)   
  - net: thunderx: Fix the ACPI memory leak (Yu Liao)   
  - nfc: st-nci: fix memory leaks in EVT_TRANSACTION (Martin Faltesek)   
  - nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION (Martin Faltesek)   
  - s390/dasd: fix no record found for raw_track_access (Stefan Haberland)   
  - dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). (Kuniyuki Iwashima)   
  - NFC: nci: fix memory leak in nci_rx_data_packet() (Liu Shixin)   
  - xfrm: Fix ignored return value in xfrm6_init() (Chen Zhongjin)   
  - net/qla3xxx: fix potential memleak in ql3xxx_send() (Zhang Changzhong)   
  - net/mlx4: Check retval of mlx4_bitmap_init (Peter Kosyh)   
  - ARM: mxs: fix memory leak in mxs_machine_init() (Zheng Yongjun)   
  - 9p/fd: fix issue of list_del corruption in p9_fd_cancel() (Zhengchao Shao)   
  - net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() (Wang Hai)   
  - nfc/nci: fix race with opening and closing (Lin Ma)   
  - ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl (Michael Grzeschik)   
  - bus: sunxi-rsb: Support atomic transfers (Samuel Holland)   
  - ARM: dts: am335x-pcm-953: Define fixed regulators in root node (Dominik Haller)   
  - af_key: Fix send_acquire race with pfkey_register (Herbert Xu)   
  - MIPS: pic32: treat port as signed integer (Jason A. Donenfeld)   
  - spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run (Sean Nyekjaer)   
  - wifi: mac80211: Fix ack frame idr leak when mesh has no route (Nicolas Cavallari)   
  - audit: fix undefined behavior in bit shift for AUDIT_BIT (Gaosheng Cui)   
  - wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support (Jonas Jelonek)   
  - LTS version: v4.14.300 (Saeed Mirzamohammadi)   
  - ntfs: check overflow when iterating ATTR_RECORDs (Hawkins Jiawei)   
  - ntfs: fix out-of-bounds read in ntfs_attr_find() (Hawkins Jiawei)   
  - ntfs: fix use-after-free in ntfs_attr_find() (Hawkins Jiawei)   
  - mm: fs: initialize fsdata passed to write_begin/write_end interface (Alexander Potapenko)   
  - 9p/trans_fd: always use O_NONBLOCK read/write (Tetsuo Handa)   
  - gfs2: Switch from strlcpy to strscpy (Andreas Gruenbacher)   
  - gfs2: Check sb_bsize_shift after reading superblock (Andrew Price)   
  - 9p: trans_fd/p9_conn_cancel: drop client lock earlier (Dominique Martinet)   
  - kcm: close race conditions on sk_receive_queue (Cong Wang)   
  - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (Baisong Zhong)   
  - kcm: avoid potential race in kcm_tx_work (Eric Dumazet)   
  - tcp: cdg: allow tcp_cdg_release() to be called multiple times (Eric Dumazet)   
  - macvlan: enforce a consistent minimal mtu (Eric Dumazet)   
  - serial: 8250: Flush DMA Rx on RLSI (Ilpo Järvinen)   
  - nilfs2: fix use-after-free bug of ns_writer on remount (Ryusuke Konishi)   
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (Alexander Potapenko)   
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (Xiongfeng Wang)   
  - mmc: core: properly select voltage range without power cycle (Yann Gautier)   
  - serial: 8250_lpss: Configure DMA also w/o DMA filter (Ilpo Järvinen)   
  - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs (Ilpo Järvinen)   
  - dm ioctl: fix misbehavior if list_versions races with module loading (Mikulas Patocka)   
  - iio: pressure: ms5611: changed hardcoded SPI speed to value limited (Mitja Spes)   
  - iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() (Yang Yingliang)   
  - iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() (Yang Yingliang)   
  - usb: chipidea: fix deadlock in ci_otg_del_timer (Duoming Zhou)   
  - usb: add NO_LPM quirk for Realforce 87U Keyboard (Nicolas Dumazet)   
  - USB: serial: option: add Fibocom FM160 0x0111 composition (Reinhard Speyerer)   
  - USB: serial: option: add u-blox LARA-L6 modem (Davide Tronchin)   
  - USB: serial: option: add u-blox LARA-R6 00B modem (Davide Tronchin)   
  - USB: serial: option: remove old LARA-R6 PID (Davide Tronchin)   
  - USB: serial: option: add Sierra Wireless EM9191 (Benoît Monin)   
  - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (Takashi Iwai)   
  - ring_buffer: Do not deactivate non-existant pages (Daniil Tatianin)   
  - ftrace: Fix null pointer dereference in ftrace_add_mod() (Xiu Jianfeng)   
  - ftrace: Optimize the allocation for mcount entries (Wang Wensheng)   
  - ftrace: Fix the possible incorrect kernel message (Wang Wensheng)   
  - cifs: Fix wrong return value checking when GETFLAGS (Zhang Xiaoxu)   
  - net/x25: Fix skb leak in x25_lapb_receive_frame() (Wei Yongjun)   
  - drbd: use after free in drbd_create_device() (Dan Carpenter)   
  - xen/pcpu: fix possible memory leak in register_pcpu() (Yang Yingliang)   
  - net: caif: fix double disconnect client in chnl_net_open() (Zhengchao Shao)   
  - mISDN: fix misuse of put_device() in mISDN_register_device() (Wang ShaoBo)   
  - mISDN: fix possible memory leak in mISDN_dsp_element_register() (Yang Yingliang)   
  - net: bgmac: Drop free_netdev() from bgmac_enet_remove() (Wei Yongjun)   
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (Zeng Heng)   
  - parport_pc: Avoid FIFO port location truncation (Maciej W. Rozycki)   
  - block: sed-opal: kmalloc the cmd/resp buffers (Serge Semin)   
  - ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (Chen Zhongjin)   
  - tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send (Duoming Zhou)   
  - serial: 8250: omap: Flush PM QOS work on remove (Tony Lindgren)   
  - serial: 8250_omap: remove wait loop from Errata i202 workaround (Matthias Schiffer)   
  - ASoC: core: Fix use-after-free in snd_soc_exit() (Chen Zhongjin)   
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (Luiz Augusto von Dentz)   
  - drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid (Nathan Huckleberry)   
  - selftests/futex: fix build for clang (Ricardo Cañuelo)   
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Borislav Petkov)   
  - dmaengine: at_hdmac: Check return code of dma_async_device_register (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix impossible condition (Tudor Ambarus)   
  - dmaengine: at_hdmac: Don't allow CPU to reorder channel enable (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors (Tudor Ambarus)   
  - dmaengine: at_hdmac: Don't start transactions at tx_submit level (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix at_lli struct definition (Tudor Ambarus)   
  - cert host tools: Stop complaining about deprecated OpenSSL functions (Linus Torvalds)   
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (ZhangPeng)   
  - btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() (Zhang Xiaoxu)   
  - platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi (Jorge Lopez)   
  - drm/i915/dmabuf: fix sg_table handling in map_dma_buf (Matthew Auld)   
  - nilfs2: fix deadlock in nilfs_count_free_blocks() (Ryusuke Konishi)   
  - ALSA: usb-audio: Add quirk entry for M-Audio Micro (Takashi Iwai)   
  - ALSA: hda: fix potential memleak in 'add_widget_node' (Ye Bin)   
  - arm64: efi: Fix handling of misaligned runtime regions and drop warning (Ard Biesheuvel)   
  - net: macvlan: fix memory leaks of macvlan_common_newlink (Chuang Wang)   
  - net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open() (Zhengchao Shao)   
  - ethernet: s2io: disable napi when start nic failed in s2io_card_up() (Zhengchao Shao)   
  - net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() (Zhengchao Shao)   
  - drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() (Zhengchao Shao)   
  - dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() (Christophe JAILLET)   
  - tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header (Xin Long)   
  - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (Alexander Potapenko)   
  - drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register() (Yuan Can)   
  - hamradio: fix issue of dev reference count leakage in bpq_device_event() (Zhengchao Shao)   
  - net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event() (Zhengchao Shao)   
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK (Gaosheng Cui)   
  - net: fman: Unregister ethernet device on removal (Sean Anderson)   
  - bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer (Alex Barba)   
  - net: gso: fix panic on frag_list with mixed head alloc types (Jiri Benc)   
  - HID: hyperv: fix possible memory leak in mousevsc_probe() (Yang Yingliang)   
  - LTS version: v4.14.299 (Saeed Mirzamohammadi)   
  - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() (Dokyung Song)   {CVE-2022-3628} 
  - linux/const.h: move UL() macro to include/linux/const.h (Masahiro Yamada)   
  - linux/const.h: prefix include guard of uapi/linux/const.h with _UAPI (Masahiro Yamada)   
  - KVM: x86: emulator: update the emulation mode after CR0 write (Maxim Levitsky)   
  - KVM: x86: emulator: introduce emulator_recalc_and_set_mode (Maxim Levitsky)   
  - KVM: x86: emulator: em_sysexit should update ctxt->mode (Maxim Levitsky)   
  - KVM: x86: Mask off reserved bits in CPUID.80000008H (Jim Mattson)   
  - ext4: fix warning in 'ext4_da_release_space' (Ye Bin)   
  - parisc: Export iosapic_serial_irq() symbol for serial port driver (Helge Deller)   
  - parisc: Make 8250_gsc driver dependend on CONFIG_PARISC (Helge Deller)   
  - efi: random: reduce seed size to 32 bytes (Ard Biesheuvel)   
  - ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices (John Veness)   
  - capabilities: fix potential memleak on error path from vfs_getxattr_alloc() (Gaosheng Cui)   
  - tcp/udp: Make early_demux back namespacified. (Kuniyuki Iwashima)   
  - btrfs: fix type of parameter generation in btrfs_get_dentry (David Sterba)   
  - block, bfq: protect 'bfqd->queued' by 'bfqd->lock' (Yu Kuai)   
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (Luiz Augusto von Dentz)   {CVE-2022-42895} 
  - i2c: xiic: Add platform module alias (Martin Tůma)   
  - media: dvb-frontends/drxk: initialize err to 0 (Hans Verkuil)   
  - media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE (Hans Verkuil)   
  - net, neigh: Fix null-ptr-deref in neigh_table_clear() (Chen Zhongjin)   
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register (Gaosheng Cui)   
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (Zhengchao Shao)   
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Maxim Mikityanskiy)   
  - btrfs: fix ulist leaks in error paths of qgroup self tests (Filipe Manana)   
  - btrfs: fix inode list leak during backref walking at resolve_indirect_refs() (Filipe Manana)   
  - isdn: mISDN: netjet: fix wrong check of device registration (Yang Yingliang)   
  - mISDN: fix possible memory leak in mISDN_register_device() (Yang Yingliang)   
  - rose: Fix NULL pointer dereference in rose_send_frame() (Zhang Qilong)   
  - ipvs: use explicitly signed chars (Jason A. Donenfeld)   
  - net: sched: Fix use after free in red_enqueue() (Dan Carpenter)   
  - ata: pata_legacy: fix pdc20230_set_piomode() (Sergey Shtylyov)   
  - net: fec: fix improper use of NETDEV_TX_BUSY (Zhang Changzhong)   
  - nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() (Shang XiaoJing)   
  - nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() (Shang XiaoJing)   
  - net: dsa: Fix possible memory leaks in dsa_loop_init() (Chen Zhongjin)   
  - nfs4: Fix kmemleak when allocate slot failed (Zhang Xiaoxu)   
  - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot (Trond Myklebust)   
  - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors (Trond Myklebust)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.522.1.el7uek]
changelog:
  - uek-rpm: ol7: Add enhanced kABI diagnostics (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: ol7: Add Symtypes files (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: ol7: Enable creation of Symtypes files (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: Add kabi tool and documentation (Stephen Brennan)  [Orabug: 34879138]  
  - xfs: don't reuse busy extents on extent trim (Brian Foster)  [Orabug: 34605583]  
  - RDMA/ucma: Put a lock around every call to the rdma_cm layer (Jason Gunthorpe)  [Orabug: 34106064]  
  - LTS version: v4.14.302 (Saeed Mirzamohammadi)   
  - net: mvneta: Fix an out of bounds check (Dan Carpenter)   
  - ipv6: avoid use-after-free in ip6_fragment() (Eric Dumazet)   
  - net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() (Yang Yingliang)   
  - ethernet: aeroflex: fix potential skb leak in greth_init_rings() (Zhang Changzhong)   
  - tipc: Fix potential OOB in tipc_link_proto_rcv() (YueHaibing)   
  - net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (Liu Jian)   
  - net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (Liu Jian)   
  - net: stmmac: fix "snps,axi-config" node property parsing (Jisheng Zhang)   
  - NFC: nci: Bounds check struct nfc_target arrays (Kees Cook)   
  - net: mvneta: Prevent out of bounds read in mvneta_config_rss() (Dan Carpenter)   
  - net: encx24j600: Fix invalid logic in reading of MISTAT register (Valentina Goncharenko)   
  - net: encx24j600: Add parentheses to fix precedence (Valentina Goncharenko)   
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (Wei Yongjun)   
  - Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() (Wang ShaoBo)   
  - igb: Allocate MSI-X vector when testing (Akihiko Odaki)   
  - e1000e: Fix TX dispatch condition (Akihiko Odaki)   
  - gpio: amd8111: Fix PCI device reference count leak (Xiongfeng Wang)   
  - ca8210: Fix crash by zero initializing data (Hauke Mehrtens)   
  - ieee802154: cc2520: Fix error return code in cc2520_hw_init() (Ziyang Xuan)   
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event (ZhangPeng)   
  - HID: hid-lg4ff: Add check for empty lbuf (Anastasia Belova)   
  - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (Thomas Huth)   
  - memcg: fix possible use-after-free in memcg_write_event_control() (Tejun Heo)   
  - media: v4l2-dv-timings.c: fix too strict blanking sanity checks (Hans Verkuil)   
  - xen/netback: do some code cleanup (Juergen Gross)   
  - net: usb: qmi_wwan: add u-blox 0x1342 composition (Davide Tronchin)   
  - regulator: twl6030: fix get status of twl6032 regulators (Andreas Kemnade)   
  - ASoC: soc-pcm: Add NULL check in BE reparenting (Srinivasa Rao Mandadapu)   
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (Kees Cook)   
  - ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 (Johan Jonker)   
  - ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation (Giulio Benetti)   
  - ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels (Tomislav Novak)   
  - ARM: dts: rockchip: fix ir-receiver node names (Johan Jonker)   
  - arm: dts: rockchip: fix node name for hym8563 rtc (Sebastian Reichel)   
  - LTS version: v4.14.301 (Saeed Mirzamohammadi)   
  - ipc/sem: Fix dangling sem_array access in semtimedop race (Jann Horn)   
  - v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails (Linus Torvalds)   
  - mmc: sdhci: Fix voltage switch delay (Adrian Hunter)   
  - mmc: sdhci: use FIELD_GET for preset value bit masks (Masahiro Yamada)   
  - x86/ioremap: Fix page aligned size calculation in __ioremap_caller() (Michael Kelley)   
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (Luiz Augusto von Dentz)   {CVE-2022-42896} 
  - x86/pm: Add enumeration check before spec MSRs save/restore setup (Saeed Mirzamohammadi)   
  - nvme: restrict management ioctls to admin (Keith Busch)   
  - tcp/udp: Fix memory leak in ipv6_renew_options(). (Kuniyuki Iwashima)  [Orabug: 34719346]  {CVE-2022-3524} 
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (Xiongfeng Wang)   
  - pinctrl: single: Fix potential division by zero (Maxim Korotkov)   
  - ASoC: ops: Fix bounds check for _sx controls (Mark Brown)   
  - efi: random: Properly limit the size of the random seed (Ben Hutchings)   
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (ZhangPeng)   
  - tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" (Tiezhu Yang)   
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (ChenXiaoSong)   
  - perf: Add sample_flags to indicate the PMU-filled sample data (Kan Liang)   
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (Yang Yingliang)   
  - hwmon: (coretemp) Check for null before removing sysfs attrs (Phil Auld)   
  - net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed (Yoshihiro Shimoda)   
  - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE (Willem de Bruijn)   
  - net: hsr: Fix potential use-after-free (YueHaibing)   
  - dsa: lan9303: Correct stat name (Jerry Ray)   
  - net/9p: Fix a potential socket leak in p9_socket_open (Wang Hai)   
  - net: net_netdev: Fix error handling in ntb_netdev_init_module() (Yuan Can)   
  - net: phy: fix null-ptr-deref while probe() failed (Yang Yingliang)   
  - qlcnic: fix sleep-in-atomic-context bugs caused by msleep (Duoming Zhou)   
  - can: cc770: cc770_isa_probe(): add missing free_cc770dev() (Zhang Changzhong)   
  - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() (Zhang Changzhong)   
  - net/mlx5: Fix uninitialized variable bug in outlen_write() (YueHaibing)   
  - of: property: decrement node refcount in of_fwnode_get_reference_args() (Yang Yingliang)   
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (Gaosheng Cui)   
  - hwmon: (i5500_temp) fix missing pci_disable_device() (Yang Yingliang)   
  - iio: light: rpr0521: add missing Kconfig dependencies (Paul Gazzillo)   
  - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw (Wei Yongjun)   
  - iio: health: afe4403: Fix oob read in afe4403_read_raw (Wei Yongjun)   
  - drm/amdgpu: always register an MMU notifier for userptr (Christian König)   
  - net: usb: qmi_wwan: add Telit 0x103a composition (Enrico Sau)   
  - tcp: configurable source port perturb table size (Gleb Mazovetskiy)   
  - platform/x86: hp-wmi: Ignore Smart Experience App event (Kai-Heng Feng)   
  - platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) (Hans de Goede)   
  - platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() (Xiongfeng Wang)   
  - xen/platform-pci: add missing free_irq() in error path (ruanjinjie)   
  - serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() (Lukas Wunner)   
  - Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode (Aman Dhoot)   
  - nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty (Chen Zhongjin)   
  - kconfig: display recursive dependency resolution hint just once (Masahiro Yamada)   
  - iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails (Chen Zhongjin)   
  - iio: light: apds9960: fix wrong register for gesture gain (Alejandro Concepción Rodríguez)   
  - arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency (Jakob Unterwurzacher)   
  - nios2: add FORCE for vmlinuz.gz (Randy Dunlap)   
  - s390/crashdump: fix TOD programmable field size (Heiko Carstens)   
  - net: thunderx: Fix the ACPI memory leak (Yu Liao)   
  - nfc: st-nci: fix memory leaks in EVT_TRANSACTION (Martin Faltesek)   
  - nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION (Martin Faltesek)   
  - s390/dasd: fix no record found for raw_track_access (Stefan Haberland)   
  - dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). (Kuniyuki Iwashima)   
  - NFC: nci: fix memory leak in nci_rx_data_packet() (Liu Shixin)   
  - xfrm: Fix ignored return value in xfrm6_init() (Chen Zhongjin)   
  - net/qla3xxx: fix potential memleak in ql3xxx_send() (Zhang Changzhong)   
  - net/mlx4: Check retval of mlx4_bitmap_init (Peter Kosyh)   
  - ARM: mxs: fix memory leak in mxs_machine_init() (Zheng Yongjun)   
  - 9p/fd: fix issue of list_del corruption in p9_fd_cancel() (Zhengchao Shao)   
  - net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() (Wang Hai)   
  - nfc/nci: fix race with opening and closing (Lin Ma)   
  - ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl (Michael Grzeschik)   
  - bus: sunxi-rsb: Support atomic transfers (Samuel Holland)   
  - ARM: dts: am335x-pcm-953: Define fixed regulators in root node (Dominik Haller)   
  - af_key: Fix send_acquire race with pfkey_register (Herbert Xu)   
  - MIPS: pic32: treat port as signed integer (Jason A. Donenfeld)   
  - spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run (Sean Nyekjaer)   
  - wifi: mac80211: Fix ack frame idr leak when mesh has no route (Nicolas Cavallari)   
  - audit: fix undefined behavior in bit shift for AUDIT_BIT (Gaosheng Cui)   
  - wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support (Jonas Jelonek)   
  - LTS version: v4.14.300 (Saeed Mirzamohammadi)   
  - ntfs: check overflow when iterating ATTR_RECORDs (Hawkins Jiawei)   
  - ntfs: fix out-of-bounds read in ntfs_attr_find() (Hawkins Jiawei)   
  - ntfs: fix use-after-free in ntfs_attr_find() (Hawkins Jiawei)   
  - mm: fs: initialize fsdata passed to write_begin/write_end interface (Alexander Potapenko)   
  - 9p/trans_fd: always use O_NONBLOCK read/write (Tetsuo Handa)   
  - gfs2: Switch from strlcpy to strscpy (Andreas Gruenbacher)   
  - gfs2: Check sb_bsize_shift after reading superblock (Andrew Price)   
  - 9p: trans_fd/p9_conn_cancel: drop client lock earlier (Dominique Martinet)   
  - kcm: close race conditions on sk_receive_queue (Cong Wang)   
  - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (Baisong Zhong)   
  - kcm: avoid potential race in kcm_tx_work (Eric Dumazet)   
  - tcp: cdg: allow tcp_cdg_release() to be called multiple times (Eric Dumazet)   
  - macvlan: enforce a consistent minimal mtu (Eric Dumazet)   
  - serial: 8250: Flush DMA Rx on RLSI (Ilpo Järvinen)   
  - nilfs2: fix use-after-free bug of ns_writer on remount (Ryusuke Konishi)   
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (Alexander Potapenko)   
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (Xiongfeng Wang)   
  - mmc: core: properly select voltage range without power cycle (Yann Gautier)   
  - serial: 8250_lpss: Configure DMA also w/o DMA filter (Ilpo Järvinen)   
  - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs (Ilpo Järvinen)   
  - dm ioctl: fix misbehavior if list_versions races with module loading (Mikulas Patocka)   
  - iio: pressure: ms5611: changed hardcoded SPI speed to value limited (Mitja Spes)   
  - iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() (Yang Yingliang)   
  - iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() (Yang Yingliang)   
  - usb: chipidea: fix deadlock in ci_otg_del_timer (Duoming Zhou)   
  - usb: add NO_LPM quirk for Realforce 87U Keyboard (Nicolas Dumazet)   
  - USB: serial: option: add Fibocom FM160 0x0111 composition (Reinhard Speyerer)   
  - USB: serial: option: add u-blox LARA-L6 modem (Davide Tronchin)   
  - USB: serial: option: add u-blox LARA-R6 00B modem (Davide Tronchin)   
  - USB: serial: option: remove old LARA-R6 PID (Davide Tronchin)   
  - USB: serial: option: add Sierra Wireless EM9191 (Benoît Monin)   
  - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (Takashi Iwai)   
  - ring_buffer: Do not deactivate non-existant pages (Daniil Tatianin)   
  - ftrace: Fix null pointer dereference in ftrace_add_mod() (Xiu Jianfeng)   
  - ftrace: Optimize the allocation for mcount entries (Wang Wensheng)   
  - ftrace: Fix the possible incorrect kernel message (Wang Wensheng)   
  - cifs: Fix wrong return value checking when GETFLAGS (Zhang Xiaoxu)   
  - net/x25: Fix skb leak in x25_lapb_receive_frame() (Wei Yongjun)   
  - drbd: use after free in drbd_create_device() (Dan Carpenter)   
  - xen/pcpu: fix possible memory leak in register_pcpu() (Yang Yingliang)   
  - net: caif: fix double disconnect client in chnl_net_open() (Zhengchao Shao)   
  - mISDN: fix misuse of put_device() in mISDN_register_device() (Wang ShaoBo)   
  - mISDN: fix possible memory leak in mISDN_dsp_element_register() (Yang Yingliang)   
  - net: bgmac: Drop free_netdev() from bgmac_enet_remove() (Wei Yongjun)   
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (Zeng Heng)   
  - parport_pc: Avoid FIFO port location truncation (Maciej W. Rozycki)   
  - block: sed-opal: kmalloc the cmd/resp buffers (Serge Semin)   
  - ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (Chen Zhongjin)   
  - tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send (Duoming Zhou)   
  - serial: 8250: omap: Flush PM QOS work on remove (Tony Lindgren)   
  - serial: 8250_omap: remove wait loop from Errata i202 workaround (Matthias Schiffer)   
  - ASoC: core: Fix use-after-free in snd_soc_exit() (Chen Zhongjin)   
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (Luiz Augusto von Dentz)   
  - drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid (Nathan Huckleberry)   
  - selftests/futex: fix build for clang (Ricardo Cañuelo)   
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Borislav Petkov)   
  - dmaengine: at_hdmac: Check return code of dma_async_device_register (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix impossible condition (Tudor Ambarus)   
  - dmaengine: at_hdmac: Don't allow CPU to reorder channel enable (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors (Tudor Ambarus)   
  - dmaengine: at_hdmac: Don't start transactions at tx_submit level (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix at_lli struct definition (Tudor Ambarus)   
  - cert host tools: Stop complaining about deprecated OpenSSL functions (Linus Torvalds)   
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (ZhangPeng)   
  - btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() (Zhang Xiaoxu)   
  - platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi (Jorge Lopez)   
  - drm/i915/dmabuf: fix sg_table handling in map_dma_buf (Matthew Auld)   
  - nilfs2: fix deadlock in nilfs_count_free_blocks() (Ryusuke Konishi)   
  - ALSA: usb-audio: Add quirk entry for M-Audio Micro (Takashi Iwai)   
  - ALSA: hda: fix potential memleak in 'add_widget_node' (Ye Bin)   
  - arm64: efi: Fix handling of misaligned runtime regions and drop warning (Ard Biesheuvel)   
  - net: macvlan: fix memory leaks of macvlan_common_newlink (Chuang Wang)   
  - net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open() (Zhengchao Shao)   
  - ethernet: s2io: disable napi when start nic failed in s2io_card_up() (Zhengchao Shao)   
  - net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() (Zhengchao Shao)   
  - drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() (Zhengchao Shao)   
  - dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() (Christophe JAILLET)   
  - tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header (Xin Long)   
  - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (Alexander Potapenko)   
  - drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register() (Yuan Can)   
  - hamradio: fix issue of dev reference count leakage in bpq_device_event() (Zhengchao Shao)   
  - net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event() (Zhengchao Shao)   
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK (Gaosheng Cui)   
  - net: fman: Unregister ethernet device on removal (Sean Anderson)   
  - bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer (Alex Barba)   
  - net: gso: fix panic on frag_list with mixed head alloc types (Jiri Benc)   
  - HID: hyperv: fix possible memory leak in mousevsc_probe() (Yang Yingliang)   
  - LTS version: v4.14.299 (Saeed Mirzamohammadi)   
  - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() (Dokyung Song)   
  - linux/const.h: move UL() macro to include/linux/const.h (Masahiro Yamada)   
  - linux/const.h: prefix include guard of uapi/linux/const.h with _UAPI (Masahiro Yamada)   
  - KVM: x86: emulator: update the emulation mode after CR0 write (Maxim Levitsky)   
  - KVM: x86: emulator: introduce emulator_recalc_and_set_mode (Maxim Levitsky)   
  - KVM: x86: emulator: em_sysexit should update ctxt->mode (Maxim Levitsky)   
  - KVM: x86: Mask off reserved bits in CPUID.80000008H (Jim Mattson)   
  - ext4: fix warning in 'ext4_da_release_space' (Ye Bin)   
  - parisc: Export iosapic_serial_irq() symbol for serial port driver (Helge Deller)   
  - parisc: Make 8250_gsc driver dependend on CONFIG_PARISC (Helge Deller)   
  - efi: random: reduce seed size to 32 bytes (Ard Biesheuvel)   
  - ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices (John Veness)   
  - capabilities: fix potential memleak on error path from vfs_getxattr_alloc() (Gaosheng Cui)   
  - tcp/udp: Make early_demux back namespacified. (Kuniyuki Iwashima)   
  - btrfs: fix type of parameter generation in btrfs_get_dentry (David Sterba)   
  - block, bfq: protect 'bfqd->queued' by 'bfqd->lock' (Yu Kuai)   
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (Luiz Augusto von Dentz)   {CVE-2022-42895} 
  - i2c: xiic: Add platform module alias (Martin Tůma)   
  - media: dvb-frontends/drxk: initialize err to 0 (Hans Verkuil)   
  - media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE (Hans Verkuil)   
  - net, neigh: Fix null-ptr-deref in neigh_table_clear() (Chen Zhongjin)   
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register (Gaosheng Cui)   
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (Zhengchao Shao)   
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Maxim Mikityanskiy)   
  - btrfs: fix ulist leaks in error paths of qgroup self tests (Filipe Manana)   
  - btrfs: fix inode list leak during backref walking at resolve_indirect_refs() (Filipe Manana)   
  - isdn: mISDN: netjet: fix wrong check of device registration (Yang Yingliang)   
  - mISDN: fix possible memory leak in mISDN_register_device() (Yang Yingliang)   
  - rose: Fix NULL pointer dereference in rose_send_frame() (Zhang Qilong)   
  - ipvs: use explicitly signed chars (Jason A. Donenfeld)   
  - net: sched: Fix use after free in red_enqueue() (Dan Carpenter)   
  - ata: pata_legacy: fix pdc20230_set_piomode() (Sergey Shtylyov)   
  - net: fec: fix improper use of NETDEV_TX_BUSY (Zhang Changzhong)   
  - nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() (Shang XiaoJing)   
  - nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() (Shang XiaoJing)   
  - net: dsa: Fix possible memory leaks in dsa_loop_init() (Chen Zhongjin)   
  - nfs4: Fix kmemleak when allocate slot failed (Zhang Xiaoxu)   
  - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot (Trond Myklebust)   
  - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors (Trond Myklebust)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.522.2.el7uek]
changelog:
  - tcp: fix ambiguity for SACKed TLP retransmits with RTT < min_rtt (Neal Cardwell)  [Orabug: 34961109]  
  - vhost-scsi: Fix max number of virtqueues (Mike Christie)  [Orabug: 34915131]  
  - net/rds: drop rs_transport module reference count on error (Gerd Rausch)  [Orabug: 34500808]  
  - scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts (Gulam Mohamed)  [Orabug: 34306796]  
  - IB/mlx5: Add a signature check to received EQEs and CQEs (Rohit Nair)  [Orabug: 34105979]  
  - net/rds: rds_tcp_accept_one ought to not discard messages (Gerd Rausch)  [Orabug: 34488377]  
  - net/rds: No shortcut out of RDS_CONN_ERROR (Gerd Rausch)  [Orabug: 34276065]  
  - net/rds: Don't force state RDS_CONN_RESETTING (Gerd Rausch)  [Orabug: 34276065]  
  - net/rds: Preserve essential connection state flags (Gerd Rausch)  [Orabug: 34276065]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.522.3.el7uek]
changelog:
  - ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC (Sasha Levin)  [Orabug: 34653896]  {CVE-2022-3303} 
  - net/rds: Fill in rds_exthdr_size gaps (Gerd Rausch)  [Orabug: 34979172]  
  - net/rds: Trigger rds_send_hs_ping() more than once (Gerd Rausch)  [Orabug: 34607787]  
  - Revert "RDS: TCP: Track peer's connection generation number" (Gerd Rausch)  [Orabug: 34700111]  
  - net/rds: Use the first lane until RDS_EXTHDR_NPATHS arrives (Gerd Rausch)  [Orabug: 28720880]  
  - net/rds: Kick-start TCP receiver after accept (Gerd Rausch)  [Orabug: 34600821]  
  - net/rds: rds_tcp_conn_path_shutdown must not discard messages (Gerd Rausch)  [Orabug: 34560682]  
  - net/rds: Encode cp_index in TCP source port (Gerd Rausch)  [Orabug: 34556027]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.521.1.el7uek]
changelog:
  - net/mlx5: Use debug message instead of warn (Yishai Hadas)  [Orabug: 34834553]  
  - hugetlbfs: don't delete error page from pagecache (James Houghton)  [Orabug: 34772618]  
  - mm: shmem: don't truncate page if memory failure happens (Yang Shi)  [Orabug: 34772618]  
  - mm: hwpoison: refactor refcount check handling (Yang Shi)  [Orabug: 34772618]  
  - kvm: x86: limit the maximum number of vPMU fixed counters to 3 (Like Xu)  [Orabug: 34756992]  
  - LTS version: v4.14.298 (Saeed Mirzamohammadi)   
  - can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive (Biju Das)   
  - net: ehea: fix possible memory leak in ehea_register_port() (Yang Yingliang)   
  - openvswitch: switch from WARN to pr_warn (Aaron Conole)   
  - ALSA: aoa: Fix I2S device accounting (Takashi Iwai)   
  - ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() (Yang Yingliang)   
  - PM: domains: Fix handling of unavailable/disabled idle states (Sudeep Holla)   
  - net: ksz884x: fix missing pci_disable_device() on error in pcidev_init() (Yang Yingliang)   
  - i40e: Fix flow-type by setting GL_HASH_INSET registers (Slawomir Laba)   
  - i40e: Fix ethtool rx-flow-hash setting for X722 (Slawomir Laba)   
  - media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced' (Hans Verkuil)   
  - media: v4l2-dv-timings: add sanity checks for blanking values (Hans Verkuil)   
  - media: vivid: dev->bitmap_cap wasn't freed in all cases (Hans Verkuil)   
  - media: vivid: s_fbuf: add more sanity checks (Hans Verkuil)   
  - PM: hibernate: Allow hybrid sleep to work with s2idle (Mario Limonciello)   
  - can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path (Dongliang Mu)   
  - tcp: fix indefinite deferral of RTO with SACK reneging (Neal Cardwell)   
  - net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY (Zhang Changzhong)   
  - kcm: annotate data-races around kcm->rx_wait (Eric Dumazet)   
  - kcm: annotate data-races around kcm->rx_psock (Eric Dumazet)   
  - amd-xgbe: add the bit rate quirk for Molex cables (Raju Rangoju)   
  - amd-xgbe: fix the SFP compliance codes check for DAC cables (Raju Rangoju)   
  - x86/unwind/orc: Fix unreliable stack dump with gcov (Chen Zhongjin)   
  - ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() (Yang Yingliang)   
  - arc: iounmap() arg is volatile (Randy Dunlap)   
  - drm/msm: Fix return type of mdp4_lvds_connector_mode_valid (Nathan Huckleberry)   
  - net: ieee802154: fix error return code in dgram_bind() (Wei Yongjun)   
  - mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (Rik van Riel)   
  - xen/gntdev: Prevent leaking grants (M. Vefa Bicakci)   
  - Xen/gntdev: don't ignore kernel unmapping error (Jan Beulich)   
  - s390/futex: add missing EX_TABLE entry to __futex_atomic_op() (Heiko Carstens)   
  - kernfs: fix use-after-free in __kernfs_remove (Christian A. Ehrhardt)   
  - mmc: core: Fix kernel panic when remove non-standard SDIO card (Matthew Ma)   
  - drm/msm/hdmi: fix memory corruption with too many bridges (Johan Hovold)   
  - mac802154: Fix LQI recording (Miquel Raynal)   
  - fbdev: smscufx: Fix several use-after-free bugs (Hyunwoo Kim)   
  - iio: light: tsl2583: Fix module unloading (Shreeya Patel)   
  - tools: iio: iio_utils: fix digit calculation (Matti Vaittinen)   
  - xhci: Remove device endpoints from bandwidth list when freeing the device (Mathias Nyman)   
  - usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller (Jens Glathe)   
  - usb: bdc: change state when port disconnected (Justin Chen)   
  - usb: dwc3: gadget: Don't set IMI for no_interrupt (Thinh Nguyen)   
  - USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM (Hannu Hartikainen)   
  - ALSA: au88x0: use explicitly signed char (Jason A. Donenfeld)   
  - ALSA: Use del_timer_sync() before freeing timer (Steven Rostedt (Google))   
  - ACPI: video: Force backlight native for more TongFang devices (Werner Sembach)   
  - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls (Chen-Yu Tsai)   
  - iommu/vt-d: Clean up si_domain in the init_dmars() error path (Jerry Snitselaar)   
  - net: hns: fix possible memory leak in hnae_ae_register() (Yang Yingliang)   
  - net/atm: fix proc_mpc_write incorrect return value (Xiaobo Liu)   
  - HID: magicmouse: Do not set BTN_MOUSE on double report (José Expósito)   
  - ACPI: extlog: Handle multiple records (Tony Luck)   
  - btrfs: fix processing of delayed data refs during backref walking (Filipe Manana)   
  - r8152: add PID for the Lenovo OneLink+ Dock (Jean-Francois Le Fillatre)   
  - arm64: errata: Remove AES hwcap for COMPAT tasks (James Morse)   
  - KVM: arm64: vgic: Fix exit condition in scan_its_table() (Eric Ren)   
  - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS (Kai-Heng Feng)   
  - ata: ahci-imx: Fix MODULE_ALIAS (Alexander Stein)   
  - x86/microcode/AMD: Apply the patch early on every logical thread (Borislav Petkov)   
  - ocfs2: fix BUG when iput after ocfs2_mknod fails (Joseph Qi)   
  - ocfs2: clear dinode links count in case of error (Joseph Qi)   
  - LTS version: v4.14.297 is skipped (Saeed Mirzamohammadi)   
  - LTS version: v4.14.296 (Saeed Mirzamohammadi)   
  - thermal: intel_powerclamp: Use first online CPU as control_cpu (Rafael J. Wysocki)   
  - inet: fully convert sk->sk_rx_dst to RCU rules (Eric Dumazet)   
  - efi: libstub: drop pointless get_memory_map() call (Ard Biesheuvel)   
  - md: Replace snprintf with scnprintf (Saurabh Sengar)   
  - ext4: continue to expand file system when the target size doesn't reach (Jerry Lee 李修賢)   
  - net/ieee802154: don't warn zero-sized raw_sendmsg() (Tetsuo Handa)   
  - net: ieee802154: return -EINVAL for unknown addr type (Alexander Aring)   
  - perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc (Adrian Hunter)   
  - usb: idmouse: fix an uninit-value in idmouse_open (Dongliang Mu)   
  - Revert "usb: storage: Add quirk for Samsung Fit flash" (sunghwan jung)   
  - usb: musb: Fix musb_gadget.c rxstate overflow bug (Robin Guo)   
  - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() (Jianglei Nie)   
  - md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d (Logan Gunthorpe)   
  - HID: roccat: Fix use-after-free in roccat_read() (Hyunwoo Kim) [Orabug: 34670788] {CVE-2022-41850}
  - nbd: Fix hung when signal interrupts nbd_start_device_ioctl() (Shigeru Yoshida)   
  - scsi: 3w-9xxx: Avoid disabling device if failing to enable it (Letu Ren)   
  - media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (Zheyu Ma)   
  - ARM: dts: imx6sl: add missing properties for sram (Alexander Stein)   
  - ARM: dts: imx6qp: add missing properties for sram (Alexander Stein)   
  - ARM: dts: imx6dl: add missing properties for sram (Alexander Stein)   
  - ARM: dts: imx6q: add missing properties for sram (Alexander Stein)   
  - ARM: dts: imx7d-sdb: config the max pressure for tsc2046 (Haibo Chen)   
  - drm/amdgpu: fix initial connector audio value (hongao)   
  - platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading (Hans de Goede)   
  - drm/vc4: vec: Fix timings for VEC modes (Mateusz Kwiatkowski)   
  - drm: Prevent drm_copy_field() to attempt copying a NULL pointer (Javier Martinez Canillas)   
  - drm: Use size_t type for len variable in drm_copy_field() (Javier Martinez Canillas)   
  - r8152: Rate limit overflow messages (Andrew Gaul) [Orabug: 34719939] {CVE-2022-3594}
  - Bluetooth: L2CAP: Fix user-after-free (Luiz Augusto von Dentz)   
  - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory (Liu Jian)   
  - wifi: rt2x00: correctly set BBP register 86 for MT7620 (Daniel Golle)   
  - wifi: rt2x00: set SoC wmac clock register (Daniel Golle)   
  - wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 (Daniel Golle)   
  - wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 (Daniel Golle)   
  - can: bcm: check the result of can_send() in bcm_can_tx() (Ziyang Xuan)   
  - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (Luiz Augusto von Dentz)   
  - Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() (Tetsuo Handa)   
  - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (Alexander Coffin)   
  - xfrm: Update ipcomp_scratches with NULL when freed (Khalid Masum)   
  - wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() (Tetsuo Handa)   
  - tcp: annotate data-race around tcp_md5sig_pool_populated (Eric Dumazet)   
  - openvswitch: Fix overreporting of drops in dropwatch (Mike Pattrick)   
  - openvswitch: Fix double reporting of drops in dropwatch (Mike Pattrick)   
  - wifi: brcmfmac: fix invalid address access when enabling SCAN log level (Wright Feng)   
  - NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data (Anna Schumaker)   
  - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash (Srinivas Pandruvada)   
  - powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue (Chao Qin)   
  - MIPS: BCM47XX: Cast memcmp() of function to (void *) (Kees Cook)   
  - ACPI: video: Add Toshiba Satellite/Portege Z830 quirk (Arvid Norlander)   
  - f2fs: fix race condition on setting FI_NO_EXTENT flag (Zhang Qilong)   
  - iommu/iova: Fix module config properly (Robin Murphy)   
  - iommu/omap: Fix buffer overflow in debugfs (Dan Carpenter)   
  - powerpc: Fix SPE Power ISA properties for e500v1 platforms (Pali Rohár)   
  - powerpc/powernv: add missing of_node_put() in opal_export_attrs() (Zheng Yongjun)   
  - powerpc/pci_dn: Add missing of_node_put() (Liang He)   
  - powerpc/sysdev/fsl_msi: Add missing of_node_put() (Liang He)   
  - powerpc/math_emu/efp: Include module.h (Nathan Chancellor)   
  - mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg (Jack Wang)   
  - clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe (Miaoqian Lin)   
  - clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration (Stefan Wahren)   
  - spmi: pmic-arb: correct duplicate APID to PPID mapping logic (David Collins)   
  - dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup() (Dave Jiang)   
  - mfd: sm501: Add check for platform_driver_register() (Jiasheng Jiang)   
  - mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init() (Christophe JAILLET)   
  - mfd: lp8788: Fix an error handling path in lp8788_probe() (Christophe JAILLET)   
  - mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq() (Christophe JAILLET)   
  - mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() (Christophe JAILLET)   
  - fsi: core: Check error number after calling ida_simple_get (Jiasheng Jiang)   
  - serial: 8250: Fix restoring termios speed after suspend (Pali Rohár)   
  - firmware: google: Test spinlock on panic path to avoid lockups (Guilherme G. Piccoli)   
  - phy: qualcomm: call clk_disable_unprepare in the error handling (Dongliang Mu)   
  - drivers: serial: jsm: fix some leaks in probe (Dan Carpenter)   
  - usb: gadget: function: fix dangling pnp_string in f_printer.c (Albert Briscoe)   
  - xhci: Don't show warning for reinit on known broken suspend (Mario Limonciello)   
  - md/raid5: Ensure stripe_fill happens on non-read IO with journal (Logan Gunthorpe)   
  - ata: fix ata_id_has_dipm() (Niklas Cassel)   
  - ata: fix ata_id_has_ncq_autosense() (Niklas Cassel)   
  - ata: fix ata_id_has_devslp() (Niklas Cassel)   
  - ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() (Niklas Cassel)   
  - dyndbg: let query-modname override actual module name (Jim Cromie)   
  - dyndbg: fix module.dyndbg handling (Jim Cromie)   
  - RDMA/rxe: Fix the error caused by qp->sk (Zhu Yanjun)   
  - RDMA/rxe: Fix "kernel NULL pointer dereference" error (Zhu Yanjun)   
  - media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init (Miaoqian Lin)   
  - tty: xilinx_uartps: Fix the ignore_status (Shubhrajyoti Datta)   
  - media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop (Liang He)   
  - HSI: omap_ssi_port: Fix dma_map_sg error check (Jack Wang)   
  - HSI: omap_ssi: Fix refcount leak in ssi_probe (Miaoqian Lin)   
  - clk: tegra20: Fix refcount leak in tegra20_clock_init (Miaoqian Lin)   
  - clk: tegra: Fix refcount leak in tegra114_clock_init (Miaoqian Lin)   
  - clk: tegra: Fix refcount leak in tegra210_clock_init (Miaoqian Lin)   
  - clk: oxnas: Hold reference returned by of_get_parent() (Liang He)   
  - iio: ABI: Fix wrong format of differential capacitance channel ABI. (Jonathan Cameron)   
  - iio: inkern: only release the device node when done with it (Nuno Sá)   
  - iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX (Claudiu Beznea)   
  - ARM: dts: exynos: fix polarity of VBUS GPIO of Origen (Dmitry Torokhov)   
  - ARM: Drop CMDLINE_* dependency on ATAGS (Geert Uytterhoeven)   
  - ARM: dts: kirkwood: lsxl: remove first ethernet port (Michael Walle)   
  - ARM: dts: kirkwood: lsxl: fix serial line (Michael Walle)   
  - ARM: dts: turris-omnia: Fix mpp26 pin name and comment (Marek Behún)   
  - soc: qcom: smem_state: Add refcounting for the 'state->of_node' (Liang He)   
  - soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() (Liang He)   
  - memory: of: Fix refcount leak bug in of_get_ddr_timings() (Liang He)   
  - mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe() (Christophe JAILLET)   
  - ALSA: dmaengine: increment buffer pointer atomically (Andreas Pape)   
  - ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API (Liang He)   
  - mmc: au1xmmc: Fix an error handling path in au1xmmc_probe() (Christophe JAILLET)   
  - drm/bridge: megachips: Fix a null pointer dereference bug (Zheyu Ma)   
  - platform/x86: msi-laptop: Fix resource cleanup (Hans de Goede)   
  - platform/x86: msi-laptop: Fix old-ec check for backlight registering (Hans de Goede)   
  - drm/mipi-dsi: Detach devices when removing the host (Maxime Ripard)   
  - bnx2x: fix potential memory leak in bnx2x_tpa_stop() (Jianglei Nie) [Orabug: 34719620] {CVE-2022-3542}
  - tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited (Neal Cardwell)   
  - vhost/vsock: Use kvmalloc/kvfree for larger packets. (Junichi Uekawa)   
  - spi: s3c64xx: Fix large transfers with DMA (Vincent Whitchurch)   
  - netfilter: nft_fib: Fix for rpath check with VRF devices (Phil Sutter)   
  - spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe (Zhang Qilong)   
  - net: fs_enet: Fix wrong check in do_pd_setup (Zheng Yongjun)   
  - wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration (Bitterblue Smith)   
  - wifi: rtl8xxxu: Fix skb misuse in TX queue selection (Bitterblue Smith)   
  - spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime() (Xu Qiang)   
  - spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume() (Xu Qiang)   
  - wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse() (Dan Carpenter)   
  - wifi: mac80211: allow bw change during channel switch in mesh (Hari Chandrakanthan)   
  - wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() (Wen Gong)   
  - sh: machvec: Use char[] for section boundaries (Kees Cook)   
  - selinux: use "grep -E" instead of "egrep" (Greg Kroah-Hartman)   
  - gcov: support GCC 12.1 and newer compilers (Martin Liska)   
  - KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility (Michal Luczaj)   
  - ring-buffer: Fix race between reset page and reading page (Steven Rostedt (Google))   
  - ring-buffer: Check pending waiters when doing wake ups as well (Steven Rostedt (Google))   
  - ring-buffer: Allow splice to read previous partially read pages (Steven Rostedt (Google))   
  - ftrace: Properly unset FTRACE_HASH_FL_MOD (Zheng Yejian)   
  - livepatch: fix race between fork and KLP transition (Rik van Riel)   
  - ext4: place buffer head allocation before handle start (Jinke Han)   
  - ext4: make ext4_lazyinit_thread freezable (Lalith Rajendran)   
  - ext4: fix null-ptr-deref in ext4_write_info (Baokun Li)   
  - ext4: avoid crash when inline data creation follows DIO write (Jan Kara)   
  - nilfs2: fix lockdep warnings during disk space reclamation (Ryusuke Konishi)   
  - nilfs2: fix lockdep warnings in page operations for btree nodes (Ryusuke Konishi)   
  - nilfs2: fix use-after-free bug of struct nilfs_root (Ryusuke Konishi)   
  - fbdev: smscufx: Fix use-after-free in ufx_ops_open() (Hyunwoo Kim)   
  - PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge (Maciej W. Rozycki)   
  - UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK (Huacai Chen)   
  - parisc: fbdev/stifb: Align graphics memory size to 4MB (Helge Deller)   
  - Revert "fs: check FMODE_LSEEK to control internal pipe splicing" (Sasha Levin)   
  - regulator: qcom_rpm: Fix circular deferral regression (Linus Walleij)   
  - quota: Check next/prev free block number after reading from quota file (Zhihao Cheng)   
  - HID: multitouch: Add memory barriers (Andri Yngvason)   
  - fs: dlm: handle -EBUSY first in lock arg validation (Alexander Aring)   
  - fs: dlm: fix race between test_bit() and queue_work() (Alexander Aring)   
  - iio: dac: ad5593r: Fix i2c read protocol requirements (Michael Hennerich)   
  - ALSA: usb-audio: Fix NULL dererence at error path (Takashi Iwai)   
  - ALSA: usb-audio: Fix potential memory leaks (Takashi Iwai)   
  - ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() (Takashi Iwai)   
  - ALSA: oss: Fix potential deadlock at unregistration (Takashi Iwai)   
  - random: use expired timer rather than wq for mixing fast pool (Jason A. Donenfeld)   
  - Input: xpad - fix wireless 360 controller breaking after suspend (Cameron Gutman)   
  - Input: xpad - add supported devices as contributed on github (Pavel Rojtberg)   
  - wifi: mac80211_hwsim: avoid mac80211 warning on bad rate (Johannes Berg)   
  - random: avoid reading two cache lines on irq randomness (Jason A. Donenfeld)   
  - random: restore O_NONBLOCK support (Jason A. Donenfeld)   
  - USB: serial: qcserial: add new usb-id for Dell branded EM7455 (Frank Wunderlich)   
  - ALSA: hda: Fix position reporting on Poulsbo (Takashi Iwai)   
  - random: clamp credited irq bits to maximum mixed (Jason A. Donenfeld)   
  - ceph: don't truncate file in atomic_open (Hu Weiwen)   
  - nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure (Ryusuke Konishi)   
  - nilfs2: fix leak of nilfs_root in case of writer thread creation failure (Ryusuke Konishi)   
  - nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level() (Ryusuke Konishi)   
  - netfilter: nf_queue: fix socket leak (Vimal Agrawal)   
  - rpmsg: qcom: glink: replace strncpy() with strscpy_pad() (Krzysztof Kozlowski)   
  - mmc: core: Terminate infinite loop in SD-UHS voltage switch (Brian Norris)   
  - mmc: core: Replace with already defined values for readability (ChanWoo Lee)   
  - USB: serial: ftdi_sio: fix 300 bps rate for SIO (Johan Hovold)   
  - usb: mon: make mmapped memory read only (Tadeusz Struk) [Orabug: 34820827] {CVE-2022-43750}
  - um: Cleanup compiler warning in arch/x86/um/tls_32.c (Lukas Straub)   
  - um: Cleanup syscall_handler_t cast in syscalls_32.h (Lukas Straub)   
  - net/ieee802154: fix uninit value bug in dgram_sendmsg (Haimin Zhang)   
  - ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer (Sergei Antonov)   
  - dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure (Swati Agarwal)   
  - dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property (Swati Agarwal)   
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Dongliang Mu)   
  - ARM: fix function graph tracer and unwinder dependencies (Russell King)   
  - i2c: dev: prevent ZERO_SIZE_PTR deref in i2cdev_ioctl_rdwr() (Alexander Popov)   
  - Makefile.extrawarn: Move -Wcast-function-type-strict to W=1 (Sami Tolvanen)   
  - clk: iproc: Do not rely on node name for correct PLL setup (Florian Fainelli)   
  - clk: iproc: Minor tidy up of iproc pll data structures (Lori Hikichi)   
  - selftests: Fix the if conditions of in test_extra_filter() (Wang Yufen)   
  - nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices (Michael Kelley)   
  - nvme: add new line after variable declatation (Chaitanya Kulkarni)   
  - usbnet: Fix memory leak in usbnet_disconnect() (Peilin Ye)   
  - Input: melfas_mip4 - fix return value check in mip4_probe() (Yang Yingliang)   
  - Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time" (Brian Norris)   
  - soc: sunxi: sram: Fix debugfs info for A64 SRAM C (Samuel Holland)   
  - soc: sunxi: sram: Actually claim SRAM regions (Samuel Holland)   
  - mm/migrate_device.c: flush TLB while holding PTL (Alistair Popple)   
  - mm: prevent page_frag_alloc() from corrupting the memory (Maurizio Lombardi)   
  - mm/page_alloc: fix race condition between build_all_zonelists and page allocation (Mel Gorman)   
  - mmc: moxart: fix 4-bit bus width and remove 8-bit bus width (Sergei Antonov)   
  - ntfs: fix BUG_ON in ntfs_lookup_inode_by_name() (ChenXiaoSong)   
  - net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 (Frank Wunderlich)   
  - uas: ignore UAS for Thinkplus chips (Hongling Zeng)   
  - usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS (Hongling Zeng)   
  - uas: add no-uas quirk for Hiksemi usb_disk (Hongling Zeng)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.522.1.el7uek]
changelog:
  - uek-rpm: ol7: Add enhanced kABI diagnostics (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: ol7: Add Symtypes files (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: ol7: Enable creation of Symtypes files (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: Add kabi tool and documentation (Stephen Brennan)  [Orabug: 34879138]  
  - xfs: don't reuse busy extents on extent trim (Brian Foster)  [Orabug: 34605583]  
  - RDMA/ucma: Put a lock around every call to the rdma_cm layer (Jason Gunthorpe)  [Orabug: 34106064]  
  - LTS version: v4.14.302 (Saeed Mirzamohammadi)   
  - net: mvneta: Fix an out of bounds check (Dan Carpenter)   
  - ipv6: avoid use-after-free in ip6_fragment() (Eric Dumazet)   
  - net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() (Yang Yingliang)   
  - ethernet: aeroflex: fix potential skb leak in greth_init_rings() (Zhang Changzhong)   
  - tipc: Fix potential OOB in tipc_link_proto_rcv() (YueHaibing)   
  - net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (Liu Jian)   
  - net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (Liu Jian)   
  - net: stmmac: fix "snps,axi-config" node property parsing (Jisheng Zhang)   
  - NFC: nci: Bounds check struct nfc_target arrays (Kees Cook)   
  - net: mvneta: Prevent out of bounds read in mvneta_config_rss() (Dan Carpenter)   
  - net: encx24j600: Fix invalid logic in reading of MISTAT register (Valentina Goncharenko)   
  - net: encx24j600: Add parentheses to fix precedence (Valentina Goncharenko)   
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (Wei Yongjun)   
  - Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() (Wang ShaoBo)   
  - igb: Allocate MSI-X vector when testing (Akihiko Odaki)   
  - e1000e: Fix TX dispatch condition (Akihiko Odaki)   
  - gpio: amd8111: Fix PCI device reference count leak (Xiongfeng Wang)   
  - ca8210: Fix crash by zero initializing data (Hauke Mehrtens)   
  - ieee802154: cc2520: Fix error return code in cc2520_hw_init() (Ziyang Xuan)   
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event (ZhangPeng)   
  - HID: hid-lg4ff: Add check for empty lbuf (Anastasia Belova)   
  - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (Thomas Huth)   
  - memcg: fix possible use-after-free in memcg_write_event_control() (Tejun Heo)   
  - media: v4l2-dv-timings.c: fix too strict blanking sanity checks (Hans Verkuil)   
  - xen/netback: do some code cleanup (Juergen Gross)   
  - net: usb: qmi_wwan: add u-blox 0x1342 composition (Davide Tronchin)   
  - regulator: twl6030: fix get status of twl6032 regulators (Andreas Kemnade)   
  - ASoC: soc-pcm: Add NULL check in BE reparenting (Srinivasa Rao Mandadapu)   
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (Kees Cook)   
  - ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 (Johan Jonker)   
  - ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation (Giulio Benetti)   
  - ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels (Tomislav Novak)   
  - ARM: dts: rockchip: fix ir-receiver node names (Johan Jonker)   
  - arm: dts: rockchip: fix node name for hym8563 rtc (Sebastian Reichel)   
  - LTS version: v4.14.301 (Saeed Mirzamohammadi)   
  - ipc/sem: Fix dangling sem_array access in semtimedop race (Jann Horn)   
  - v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails (Linus Torvalds)   
  - mmc: sdhci: Fix voltage switch delay (Adrian Hunter)   
  - mmc: sdhci: use FIELD_GET for preset value bit masks (Masahiro Yamada)   
  - x86/ioremap: Fix page aligned size calculation in __ioremap_caller() (Michael Kelley)   
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (Luiz Augusto von Dentz)   [Orabug: 34833306] {CVE-2022-42896} 
  - x86/pm: Add enumeration check before spec MSRs save/restore setup (Saeed Mirzamohammadi)   
  - nvme: restrict management ioctls to admin (Keith Busch)   
  - tcp/udp: Fix memory leak in ipv6_renew_options(). (Kuniyuki Iwashima)  [Orabug: 34719346]  {CVE-2022-3524} 
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (Xiongfeng Wang)   
  - pinctrl: single: Fix potential division by zero (Maxim Korotkov)   
  - ASoC: ops: Fix bounds check for _sx controls (Mark Brown)   
  - efi: random: Properly limit the size of the random seed (Ben Hutchings)   
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (ZhangPeng)   
  - tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" (Tiezhu Yang)   
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (ChenXiaoSong)   
  - perf: Add sample_flags to indicate the PMU-filled sample data (Kan Liang)   
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (Yang Yingliang)   
  - hwmon: (coretemp) Check for null before removing sysfs attrs (Phil Auld)   
  - net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed (Yoshihiro Shimoda)   
  - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE (Willem de Bruijn)   
  - net: hsr: Fix potential use-after-free (YueHaibing)   
  - dsa: lan9303: Correct stat name (Jerry Ray)   
  - net/9p: Fix a potential socket leak in p9_socket_open (Wang Hai)   
  - net: net_netdev: Fix error handling in ntb_netdev_init_module() (Yuan Can)   
  - net: phy: fix null-ptr-deref while probe() failed (Yang Yingliang)   
  - qlcnic: fix sleep-in-atomic-context bugs caused by msleep (Duoming Zhou)   
  - can: cc770: cc770_isa_probe(): add missing free_cc770dev() (Zhang Changzhong)   
  - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() (Zhang Changzhong)   
  - net/mlx5: Fix uninitialized variable bug in outlen_write() (YueHaibing)   
  - of: property: decrement node refcount in of_fwnode_get_reference_args() (Yang Yingliang)   
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (Gaosheng Cui)   
  - hwmon: (i5500_temp) fix missing pci_disable_device() (Yang Yingliang)   
  - iio: light: rpr0521: add missing Kconfig dependencies (Paul Gazzillo)   
  - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw (Wei Yongjun)   
  - iio: health: afe4403: Fix oob read in afe4403_read_raw (Wei Yongjun)   
  - drm/amdgpu: always register an MMU notifier for userptr (Christian König)   
  - net: usb: qmi_wwan: add Telit 0x103a composition (Enrico Sau)   
  - tcp: configurable source port perturb table size (Gleb Mazovetskiy)   
  - platform/x86: hp-wmi: Ignore Smart Experience App event (Kai-Heng Feng)   
  - platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) (Hans de Goede)   
  - platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() (Xiongfeng Wang)   
  - xen/platform-pci: add missing free_irq() in error path (ruanjinjie)   
  - serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() (Lukas Wunner)   
  - Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode (Aman Dhoot)   
  - nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty (Chen Zhongjin)   
  - kconfig: display recursive dependency resolution hint just once (Masahiro Yamada)   
  - iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails (Chen Zhongjin)   
  - iio: light: apds9960: fix wrong register for gesture gain (Alejandro Concepción Rodríguez)   
  - arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency (Jakob Unterwurzacher)   
  - nios2: add FORCE for vmlinuz.gz (Randy Dunlap)   
  - s390/crashdump: fix TOD programmable field size (Heiko Carstens)   
  - net: thunderx: Fix the ACPI memory leak (Yu Liao)   
  - nfc: st-nci: fix memory leaks in EVT_TRANSACTION (Martin Faltesek)   
  - nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION (Martin Faltesek)   
  - s390/dasd: fix no record found for raw_track_access (Stefan Haberland)   
  - dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). (Kuniyuki Iwashima)   
  - NFC: nci: fix memory leak in nci_rx_data_packet() (Liu Shixin)   
  - xfrm: Fix ignored return value in xfrm6_init() (Chen Zhongjin)   
  - net/qla3xxx: fix potential memleak in ql3xxx_send() (Zhang Changzhong)   
  - net/mlx4: Check retval of mlx4_bitmap_init (Peter Kosyh)   
  - ARM: mxs: fix memory leak in mxs_machine_init() (Zheng Yongjun)   
  - 9p/fd: fix issue of list_del corruption in p9_fd_cancel() (Zhengchao Shao)   
  - net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() (Wang Hai)   
  - nfc/nci: fix race with opening and closing (Lin Ma)   
  - ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl (Michael Grzeschik)   
  - bus: sunxi-rsb: Support atomic transfers (Samuel Holland)   
  - ARM: dts: am335x-pcm-953: Define fixed regulators in root node (Dominik Haller)   
  - af_key: Fix send_acquire race with pfkey_register (Herbert Xu)   
  - MIPS: pic32: treat port as signed integer (Jason A. Donenfeld)   
  - spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run (Sean Nyekjaer)   
  - wifi: mac80211: Fix ack frame idr leak when mesh has no route (Nicolas Cavallari)   
  - audit: fix undefined behavior in bit shift for AUDIT_BIT (Gaosheng Cui)   
  - wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support (Jonas Jelonek)   
  - LTS version: v4.14.300 (Saeed Mirzamohammadi)   
  - ntfs: check overflow when iterating ATTR_RECORDs (Hawkins Jiawei)   
  - ntfs: fix out-of-bounds read in ntfs_attr_find() (Hawkins Jiawei)   
  - ntfs: fix use-after-free in ntfs_attr_find() (Hawkins Jiawei)   
  - mm: fs: initialize fsdata passed to write_begin/write_end interface (Alexander Potapenko)   
  - 9p/trans_fd: always use O_NONBLOCK read/write (Tetsuo Handa)   
  - gfs2: Switch from strlcpy to strscpy (Andreas Gruenbacher)   
  - gfs2: Check sb_bsize_shift after reading superblock (Andrew Price)   
  - 9p: trans_fd/p9_conn_cancel: drop client lock earlier (Dominique Martinet)   
  - kcm: close race conditions on sk_receive_queue (Cong Wang)   
  - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (Baisong Zhong)   
  - kcm: avoid potential race in kcm_tx_work (Eric Dumazet)   
  - tcp: cdg: allow tcp_cdg_release() to be called multiple times (Eric Dumazet)   
  - macvlan: enforce a consistent minimal mtu (Eric Dumazet)   
  - serial: 8250: Flush DMA Rx on RLSI (Ilpo Järvinen)   
  - nilfs2: fix use-after-free bug of ns_writer on remount (Ryusuke Konishi)   
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (Alexander Potapenko)   
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (Xiongfeng Wang)   
  - mmc: core: properly select voltage range without power cycle (Yann Gautier)   
  - serial: 8250_lpss: Configure DMA also w/o DMA filter (Ilpo Järvinen)   
  - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs (Ilpo Järvinen)   
  - dm ioctl: fix misbehavior if list_versions races with module loading (Mikulas Patocka)   
  - iio: pressure: ms5611: changed hardcoded SPI speed to value limited (Mitja Spes)   
  - iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() (Yang Yingliang)   
  - iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() (Yang Yingliang)   
  - usb: chipidea: fix deadlock in ci_otg_del_timer (Duoming Zhou)   
  - usb: add NO_LPM quirk for Realforce 87U Keyboard (Nicolas Dumazet)   
  - USB: serial: option: add Fibocom FM160 0x0111 composition (Reinhard Speyerer)   
  - USB: serial: option: add u-blox LARA-L6 modem (Davide Tronchin)   
  - USB: serial: option: add u-blox LARA-R6 00B modem (Davide Tronchin)   
  - USB: serial: option: remove old LARA-R6 PID (Davide Tronchin)   
  - USB: serial: option: add Sierra Wireless EM9191 (Benoît Monin)   
  - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (Takashi Iwai)   
  - ring_buffer: Do not deactivate non-existant pages (Daniil Tatianin)   
  - ftrace: Fix null pointer dereference in ftrace_add_mod() (Xiu Jianfeng)   
  - ftrace: Optimize the allocation for mcount entries (Wang Wensheng)   
  - ftrace: Fix the possible incorrect kernel message (Wang Wensheng)   
  - cifs: Fix wrong return value checking when GETFLAGS (Zhang Xiaoxu)   
  - net/x25: Fix skb leak in x25_lapb_receive_frame() (Wei Yongjun)   
  - drbd: use after free in drbd_create_device() (Dan Carpenter)   
  - xen/pcpu: fix possible memory leak in register_pcpu() (Yang Yingliang)   
  - net: caif: fix double disconnect client in chnl_net_open() (Zhengchao Shao)   
  - mISDN: fix misuse of put_device() in mISDN_register_device() (Wang ShaoBo)   
  - mISDN: fix possible memory leak in mISDN_dsp_element_register() (Yang Yingliang)   
  - net: bgmac: Drop free_netdev() from bgmac_enet_remove() (Wei Yongjun)   
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (Zeng Heng)   
  - parport_pc: Avoid FIFO port location truncation (Maciej W. Rozycki)   
  - block: sed-opal: kmalloc the cmd/resp buffers (Serge Semin)   
  - ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (Chen Zhongjin)   
  - tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send (Duoming Zhou)   
  - serial: 8250: omap: Flush PM QOS work on remove (Tony Lindgren)   
  - serial: 8250_omap: remove wait loop from Errata i202 workaround (Matthias Schiffer)   
  - ASoC: core: Fix use-after-free in snd_soc_exit() (Chen Zhongjin)   
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (Luiz Augusto von Dentz)   
  - drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid (Nathan Huckleberry)   
  - selftests/futex: fix build for clang (Ricardo Cañuelo)   
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Borislav Petkov)   
  - dmaengine: at_hdmac: Check return code of dma_async_device_register (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix impossible condition (Tudor Ambarus)   
  - dmaengine: at_hdmac: Don't allow CPU to reorder channel enable (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors (Tudor Ambarus)   
  - dmaengine: at_hdmac: Don't start transactions at tx_submit level (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix at_lli struct definition (Tudor Ambarus)   
  - cert host tools: Stop complaining about deprecated OpenSSL functions (Linus Torvalds)   
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (ZhangPeng)   
  - btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() (Zhang Xiaoxu)   
  - platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi (Jorge Lopez)   
  - drm/i915/dmabuf: fix sg_table handling in map_dma_buf (Matthew Auld)   
  - nilfs2: fix deadlock in nilfs_count_free_blocks() (Ryusuke Konishi)   
  - ALSA: usb-audio: Add quirk entry for M-Audio Micro (Takashi Iwai)   
  - ALSA: hda: fix potential memleak in 'add_widget_node' (Ye Bin)   
  - arm64: efi: Fix handling of misaligned runtime regions and drop warning (Ard Biesheuvel)   
  - net: macvlan: fix memory leaks of macvlan_common_newlink (Chuang Wang)   
  - net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open() (Zhengchao Shao)   
  - ethernet: s2io: disable napi when start nic failed in s2io_card_up() (Zhengchao Shao)   
  - net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() (Zhengchao Shao)   
  - drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() (Zhengchao Shao)   
  - dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() (Christophe JAILLET)   
  - tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header (Xin Long)   
  - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (Alexander Potapenko)   
  - drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register() (Yuan Can)   
  - hamradio: fix issue of dev reference count leakage in bpq_device_event() (Zhengchao Shao)   
  - net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event() (Zhengchao Shao)   
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK (Gaosheng Cui)   
  - net: fman: Unregister ethernet device on removal (Sean Anderson)   
  - bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer (Alex Barba)   
  - net: gso: fix panic on frag_list with mixed head alloc types (Jiri Benc)   
  - HID: hyperv: fix possible memory leak in mousevsc_probe() (Yang Yingliang)   
  - LTS version: v4.14.299 (Saeed Mirzamohammadi)   
  - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() (Dokyung Song)   
  - linux/const.h: move UL() macro to include/linux/const.h (Masahiro Yamada)   
  - linux/const.h: prefix include guard of uapi/linux/const.h with _UAPI (Masahiro Yamada)   
  - KVM: x86: emulator: update the emulation mode after CR0 write (Maxim Levitsky)   
  - KVM: x86: emulator: introduce emulator_recalc_and_set_mode (Maxim Levitsky)   
  - KVM: x86: emulator: em_sysexit should update ctxt->mode (Maxim Levitsky)   
  - KVM: x86: Mask off reserved bits in CPUID.80000008H (Jim Mattson)   
  - ext4: fix warning in 'ext4_da_release_space' (Ye Bin)   
  - parisc: Export iosapic_serial_irq() symbol for serial port driver (Helge Deller)   
  - parisc: Make 8250_gsc driver dependend on CONFIG_PARISC (Helge Deller)   
  - efi: random: reduce seed size to 32 bytes (Ard Biesheuvel)   
  - ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices (John Veness)   
  - capabilities: fix potential memleak on error path from vfs_getxattr_alloc() (Gaosheng Cui)   
  - tcp/udp: Make early_demux back namespacified. (Kuniyuki Iwashima)   
  - btrfs: fix type of parameter generation in btrfs_get_dentry (David Sterba)   
  - block, bfq: protect 'bfqd->queued' by 'bfqd->lock' (Yu Kuai)   
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (Luiz Augusto von Dentz)   [Orabug: 34951661] {CVE-2022-42895} 
  - i2c: xiic: Add platform module alias (Martin Tůma)   
  - media: dvb-frontends/drxk: initialize err to 0 (Hans Verkuil)   
  - media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE (Hans Verkuil)   
  - net, neigh: Fix null-ptr-deref in neigh_table_clear() (Chen Zhongjin)   
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register (Gaosheng Cui)   
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (Zhengchao Shao) [Orabug: 34752621] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Maxim Mikityanskiy)   
  - btrfs: fix ulist leaks in error paths of qgroup self tests (Filipe Manana)   
  - btrfs: fix inode list leak during backref walking at resolve_indirect_refs() (Filipe Manana)   
  - isdn: mISDN: netjet: fix wrong check of device registration (Yang Yingliang)   
  - mISDN: fix possible memory leak in mISDN_register_device() (Yang Yingliang)   
  - rose: Fix NULL pointer dereference in rose_send_frame() (Zhang Qilong)   
  - ipvs: use explicitly signed chars (Jason A. Donenfeld)   
  - net: sched: Fix use after free in red_enqueue() (Dan Carpenter)   
  - ata: pata_legacy: fix pdc20230_set_piomode() (Sergey Shtylyov)   
  - net: fec: fix improper use of NETDEV_TX_BUSY (Zhang Changzhong)   
  - nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() (Shang XiaoJing)   
  - nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() (Shang XiaoJing)   
  - net: dsa: Fix possible memory leaks in dsa_loop_init() (Chen Zhongjin)   
  - nfs4: Fix kmemleak when allocate slot failed (Zhang Xiaoxu)   
  - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot (Trond Myklebust)   
  - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors (Trond Myklebust)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.1.el7uek]
changelog:
  - x86/kexec: Do not reserve EFI setup_data in the kexec e820 table (Dave Young)  [Orabug: 34966703]  
  - xfs: make COW fork unwritten extent conversions more robust (Christoph Hellwig)  [Orabug: 34390903]  
  - scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan (Chandrakanth patil)  [Orabug: 34242965]  
  - scsi: megaraid_sas: Early detection of VD deletion through RaidMap update (Kashyap Desai)  [Orabug: 34242965]  
  - LTS version: v4.14.304 (Saeed Mirzamohammadi)   
  - x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN (YingChi Long)   
  - gsmi: fix null-deref in gsmi_get_variable (Khazhismel Kumykov)   
  - serial: atmel: fix incorrect baudrate setup (Tobias Schramm)   
  - serial: pch_uart: Pass correct sg to dma_unmap_sg() (Ilpo Järvinen)   
  - usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 (Juhyung Park)   
  - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() (Maciej Żenczykowski)   
  - usb: gadget: g_webcam: Send color matching descriptor per frame (Daniel Scally)   
  - usb: host: ehci-fsl: Fix module alias (Alexander Stein)   
  - USB: serial: cp210x: add SCALANCE LPE-9000 device id (Michael Adler)   
  - usb: core: hub: disable autosuspend for TI TUSB8041 (Flavio Suligoi)   
  - USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 (Greg Kroah-Hartman)   
  - USB: serial: option: add Quectel EM05CN modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EM05CN (SG) modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EC200U modem (Ali Mirghasemi)   
  - USB: serial: option: add Quectel EM05-G (RS) modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EM05-G (CS) modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EM05-G (GR) modem (Duke Xin(辛安文))   
  - prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman)   
  - usb: xhci: Check endpoint is valid before dereferencing it (Jimmy Hu)   
  - xhci-pci: set the dma max_seg_size (Ricardo Ribalda)   
  - nilfs2: fix general protection fault in nilfs_btree_insert() (Ryusuke Konishi)   
  - f2fs: let's avoid panic if extent_tree is not created (Jaegeuk Kim)   
  - RDMA/srp: Move large values to a new enum for gcc13 (Jiri Slaby (SUSE))   
  - net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats (Daniil Tatianin)   
  - pNFS/filelayout: Fix coalescing test for single DS (Olga Kornievskaia)   
  - LTS version: v4.14.303 (Saeed Mirzamohammadi)   
  - Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" (Ferry Toth)   
  - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() (Minsuk Kang)   
  - hvc/xen: lock console list traversal (Roger Pau Monne)   
  - regulator: da9211: Use irq handler when ready (Ricardo Ribalda)   
  - EDAC/device: Fix period calculation in edac_device_reset_delay_period() (Eliav Farber)   
  - x86/boot: Avoid using Intel mnemonics in AT&T syntax asm (Peter Zijlstra)   
  - netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (Gavrilov Ilia)   
  - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (Herbert Xu)   
  - platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe (Hans de Goede)   
  - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (Clement Lecigne)   {CVE-2023-0266} 
  - net/ulp: prevent ULP without clone op from entering the LISTEN status (Paolo Abeni)   
  - s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() (Heiko Carstens)   
  - perf auxtrace: Fix address filter duplicate symbol selection (Adrian Hunter)   
  - docs: Fix the docs build with Sphinx 6.0 (Jonathan Corbet)   
  - net: sched: disallow noqueue for qdisc classes (Frederick Lawler)   
  - ravb: Fix "failed to switch device to config mode" message during unbind (Biju Das)   
  - driver core: Fix bus_type.match() error handling in __driver_attach() (Isaac J. Manjarres)   
  - parisc: Align parisc MADV_XXX constants with all other architectures (Helge Deller)   
  - hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling (Linus Torvalds)   
  - hfs/hfsplus: use WARN_ON for sanity check (Arnd Bergmann)   
  - nfsd: fix handling of readdir in v4root vs. mount upcall timeout (Jeff Layton)   
  - x86/bugs: Flush IBP in ib_prctl_set() (Rodrigo Branco)   
  - udf: Fix extension of the last extent in the file (Jan Kara)   
  - caif: fix memory leak in cfctrl_linkup_request() (Zhengchao Shao)   
  - usb: rndis_host: Secure rndis_query check against int overflow (Szymon Heidrich)   
  - net: sched: atm: dont intepret cls results when asked to drop (Jamal Hadi Salim)   
  - net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe (Miaoqian Lin)   
  - net: amd-xgbe: add missed tasklet_kill (Jiguang Xiao)   
  - nfc: Fix potential resource leaks (Miaoqian Lin)   
  - qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (Daniil Tatianin)   
  - bpf: pull before calling skb_postpull_rcsum() (Jakub Kicinski)   
  - SUNRPC: ensure the matching upcall is in-flight upon downcall (minoura makoto)   
  - ext4: allocate extended attribute value in vmalloc area (Ye Bin)   
  - ext4: avoid unaccounted block allocation when expanding inode (Jan Kara)   
  - ext4: initialize quota before expanding inode in setproject ioctl (Jan Kara)   
  - ext4: fix inode leak in ext4_xattr_inode_create() on an error path (Ye Bin)   
  - ext4: avoid BUG_ON when creating xattrs (Jan Kara)   
  - ext4: fix error code return to user-space in ext4_get_branch() (Luís Henriques)   
  - ext4: init quota for 'old.inode' in 'ext4_rename' (Ye Bin)   
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode (Baokun Li)   
  - ext4: fix undefined behavior in bit shift for ext4_check_flag_values (Gaosheng Cui)   
  - ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop (Baokun Li)   
  - drm/vmwgfx: Validate the box size for the snooped cursor (Zack Rusin)   
  - drm/connector: send hotplug uevent on connector cleanup (Simon Ser)   
  - device_cgroup: Roll back to original exceptions after copy failure (Wang Weiyang)   
  - parisc: led: Fix potential null-ptr-deref in start_task() (Shang XiaoJing)   
  - iommu/amd: Fix ivrs_acpihid cmdline parsing code (Kim Phillips)   
  - crypto: n2 - add missing hash statesize (Corentin Labbe)   
  - PCI/sysfs: Fix double free in error path (Sascha Hauer)   
  - PCI: Fix pci_device_is_present() for VFs by checking PF (Michael S. Tsirkin)   
  - ima: Fix a potential NULL pointer access in ima_restore_measurement_list (Huaxin Lu)   
  - cifs: fix confusing debug message (Paulo Alcantara)   
  - media: dvb-core: Fix UAF due to refcount races at releasing (Takashi Iwai)   {CVE-2022-41218} 
  - media: dvb-core: Fix double free in dvb_register_device() (Keita Suzuki)   
  - ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod (Nick Desaulniers)   
  - tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line (Yang Jihong)   
  - x86/microcode/intel: Do not retry microcode reloading on the APs (Ashok Raj)   
  - dm cache: set needs_check flag after aborting metadata (Mike Snitzer)   
  - dm cache: Fix UAF in destroy() (Luo Meng)   
  - dm thin: Fix UAF in run_timer_softirq() (Luo Meng)   
  - dm thin: Use last transaction's pmd->root when commit failed (Zhihao Cheng)   
  - dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort (Mike Snitzer)   
  - selftests: Use optional USERCFLAGS and USERLDFLAGS (Mickaël Salaün)   
  - ARM: ux500: do not directly dereference __iomem (Jason A. Donenfeld)   
  - ktest.pl minconfig: Unset configs instead of just removing them (Steven Rostedt)   
  - media: stv0288: use explicitly signed char (Jason A. Donenfeld)   
  - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo)   
  - tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo)   
  - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING (Deren Wu)   
  - md: fix a crash in mempool_free (Mikulas Patocka)   
  - pnode: terminate at peers of source (Christian Brauner)   
  - ALSA: line6: fix stack overflow in line6_midi_transmit (Artem Egorkine)   
  - ALSA: line6: correct midi status byte when receiving data from podxt (Artem Egorkine)   
  - hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount (Aditya Garg)   
  - HID: plantronics: Additional PIDs for double volume key presses quirk (Terry Junge)   
  - powerpc/rtas: avoid scheduling in rtas_os_term() (Nathan Lynch)   
  - powerpc/rtas: avoid device tree lookups in rtas_os_term() (Nathan Lynch)   
  - media: dvbdev: fix refcnt bug (Lin Ma)   
  - gcov: add support for checksum field (Rickard x Andersson)   
  - iio: adc: ad_sigma_delta: do not use internal iio_dev lock (Nuno Sá)   
  - reiserfs: Add missing calls to reiserfs_security_free() (Roberto Sassu)   
  - HID: wacom: Ensure bootloader PID is usable in hidraw mode (Jason Gerecke)   
  - usb: dwc3: core: defer probe on ulpi_read_id timeout (Ferry Toth)   
  - pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES (John Stultz)   
  - pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion (John Stultz)   
  - ASoC: rt5670: Remove unbalanced pm_runtime_put() (Hans de Goede)   
  - ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() (Wang Jingjin)   
  - ASoC: wm8994: Fix potential deadlock (Marek Szyprowski)   
  - ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() (Wang Jingjin)   
  - ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() (Wang Yufen)   
  - orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() (Zhang Xiaoxu)   
  - drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() (Nathan Chancellor)   
  - drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() (Nathan Chancellor)   
  - clk: st: Fix memory leak in st_of_quadfs_setup() (Xiu Jianfeng)   
  - media: si470x: Fix use-after-free in si470x_int_in_callback() (Shigeru Yoshida)   
  - mmc: f-sdh30: Add quirks for broken timeout clock capability (Kunihiko Hayashi)   
  - blk-mq: fix possible memleak when register 'hctx' failed (Ye Bin)   
  - media: dvb-usb: fix memory leak in dvb_usb_adapter_init() (Mazin Al Haddad)   
  - media: dvbdev: adopts refcnt to avoid UAF (Lin Ma)   
  - media: dvb-frontends: fix leak of memory fw (Yan Lei)   
  - ppp: associate skb with a device at tx (Stanislav Fomichev)   
  - mrp: introduce active flags to prevent UAF when applicant uninit (Schspa Shi)   
  - md/raid1: stop mdx_raid1 thread when raid1 array run failed (Jiang Li)   
  - drm/sti: Use drm_mode_copy() (Ville Syrjälä)   
  - s390/lcs: Fix return type of lcs_start_xmit() (Nathan Chancellor)   
  - s390/netiucv: Fix return type of netiucv_tx() (Nathan Chancellor)   
  - s390/ctcm: Fix return type of ctc{mp,}m_tx() (Nathan Chancellor)   
  - igb: Do not free q_vector unless new one was allocated (Kees Cook)   
  - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() (Minsuk Kang)   
  - hamradio: baycom_epp: Fix return type of baycom_send_packet() (Nathan Chancellor)   
  - net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() (Nathan Chancellor)   
  - bpf: make sure skb->len != 0 when redirecting to a tunneling device (Stanislav Fomichev)   
  - ipmi: fix memleak when unload ipmi driver (Zhang Yuchen)   
  - ASoC: codecs: rt298: Add quirk for KBL-R RVP platform (Amadeusz Sławiński)   
  - wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out (Shigeru Yoshida)   
  - wifi: ath9k: verify the expected usb_endpoints are present (Fedor Pchelkin)   
  - hfs: fix OOB Read in __hfs_brec_find (ZhangPeng)   
  - acct: fix potential integer overflow in encode_comp_t() (Zheng Yejian)   
  - nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() (Ryusuke Konishi)   
  - ACPICA: Fix error code path in acpi_ds_call_control_method() (Rafael J. Wysocki)   
  - fs: jfs: fix shift-out-of-bounds in dbDiscardAG (Hoi Pok Wu)   
  - udf: Avoid double brelse() in udf_rename() (Shigeru Yoshida)   
  - fs: jfs: fix shift-out-of-bounds in dbAllocAG (Dongliang Mu)   
  - binfmt_misc: fix shift-out-of-bounds in check_special_flags (Liu Shixin)   
  - net: stream: purge sk_error_queue in sk_stream_kill_queues() (Eric Dumazet)   
  - myri10ge: Fix an error handling path in myri10ge_probe() (Christophe JAILLET)   
  - net_sched: reject TCF_EM_SIMPLE case for complex ematch module (Cong Wang)   
  - skbuff: Account for tail adjustment during pull operations (Subash Abhinov Kasiviswanathan)   
  - openvswitch: Fix flow lookup to use unmasked key (Eelco Chaudron)   
  - r6040: Fix kmemleak in probe and remove (Li Zetao)   
  - nfc: pn533: Clear nfc_target before being used (Minsuk Kang)   
  - mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (Dan Aloni)   
  - rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() (Gaosheng Cui)   
  - selftests/powerpc: Fix resource leaks (Miaoqian Lin)   
  - powerpc/hv-gpci: Fix hv_gpci event list (Kajol Jain)   
  - powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() (Yang Yingliang)   
  - powerpc/perf: callchain validate kernel stack pointer bounds (Nicholas Piggin)   
  - powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() (Yang Yingliang)   
  - cxl: Fix refcount leak in cxl_calc_capp_routing (Miaoqian Lin)   
  - powerpc/52xx: Fix a resource leak in an error handling path (Christophe JAILLET)   
  - macintosh/macio-adb: check the return value of ioremap() (Xie Shaowen)   
  - macintosh: fix possible memory leak in macio_add_one_device() (Yang Yingliang)   
  - iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() (Yuan Can)   
  - iommu/amd: Fix pci device refcount leak in ppr_notifier() (Yang Yingliang)   
  - rtc: snvs: Allow a time difference on clock register read (Stefan Eichenberger)   
  - include/uapi/linux/swab: Fix potentially missing __always_inline (Matt Redfearn)   
  - HSI: omap_ssi_core: Fix error handling in ssi_init() (Yuan Can)   
  - power: supply: fix residue sysfs file in error handle route of __power_supply_register() (Zeng Heng)   
  - HSI: omap_ssi_core: fix possible memory leak in ssi_probe() (Yang Yingliang)   
  - HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() (Yang Yingliang)   
  - fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() (Christophe JAILLET)   
  - fbdev: vermilion: decrease reference count in error path (Xiongfeng Wang)   
  - fbdev: via: Fix error in via_core_init() (Shang XiaoJing)   
  - fbdev: pm2fb: fix missing pci_disable_device() (Yang Yingliang)   
  - fbdev: ssd1307fb: Drop optional dependency (Andy Shevchenko)   
  - usb: storage: Add check for kcalloc (Jiasheng Jiang)   
  - i2c: ismt: Fix an out-of-bounds bug in ismt_access() (Zheyu Ma)   
  - vme: Fix error not catched in fake_init() (Chen Zhongjin)   
  - staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() (YueHaibing)   
  - staging: rtl8192u: Fix use after free in ieee80211_rx() (Dan Carpenter)   
  - i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe (Hui Tang)   
  - chardev: fix error handling in cdev_device_add() (Yang Yingliang)   
  - mcb: mcb-parse: fix error handing in chameleon_parse_gdd() (Yang Yingliang)   
  - drivers: mcb: fix resource leak in mcb_probe() (Zhengchao Shao)   
  - cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (Yang Yingliang)   
  - cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() (Yang Yingliang)   
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (Zheng Wang)   
  - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (ruanjinjie)   
  - test_firmware: fix memory leak in test_firmware_init() (Zhengchao Shao)   
  - serial: sunsab: Fix error handling in sunsab_init() (Yuan Can)   
  - serial: pch: Fix PCI device refcount leak in pch_request_dma() (Xiongfeng Wang)   
  - serial: amba-pl011: avoid SBSA UART accessing DMACR register (Jiamei Xie)   
  - staging: vme_user: Fix possible UAF in tsi148_dma_list_add (Gaosheng Cui)   
  - usb: fotg210-udc: Fix ages old endianness issues (Linus Walleij)   
  - uio: uio_dmem_genirq: Fix deadlock between irq config and handling (Rafael Mendonca)   
  - uio: uio_dmem_genirq: Fix missing unlock in irq configuration (Rafael Mendonca)   
  - vfio: platform: Do not pass return buffer to ACPI _RST method (Rafael Mendonca)   
  - class: fix possible memory leak in __class_register() (Yang Yingliang)   
  - drivers: dio: fix possible memory leak in dio_init() (Yang Yingliang)   
  - IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces (Dragos Tatulea)   
  - hwrng: geode - Fix PCI device refcount leak (Xiongfeng Wang)   
  - hwrng: amd - Fix PCI device refcount leak (Xiongfeng Wang)   
  - crypto: img-hash - Fix variable dereferenced before check 'hdev->req' (Gaosheng Cui)   
  - orangefs: Fix sysfs not cleanup when dev init failed (Zhang Xiaoxu)   
  - RDMA/hfi1: Fix error return code in parse_platform_config() (Wang Yufen)   
  - scsi: snic: Fix possible UAF in snic_tgt_create() (Gaosheng Cui)   
  - scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails (Chen Zhongjin)   
  - scsi: ipr: Fix WARNING in ipr_init() (Shang XiaoJing)   
  - scsi: fcoe: Fix possible name leak when device_register() fails (Yang Yingliang)   
  - scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() (Yang Yingliang)   
  - scsi: hpsa: Fix error handling in hpsa_add_sas_host() (Yang Yingliang)   
  - RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (Zhang Xiaoxu)   
  - RDMA/hfi: Decrease PCI device reference count in error path (Xiongfeng Wang)   
  - PCI: Check for alloc failure in pci_request_irq() (Zeng Heng)   
  - apparmor: fix a memleak in multi_transaction_new() (Gaosheng Cui)   
  - stmmac: fix potential division by 0 (Piergiorgio Beruto)   
  - Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - ntb_netdev: Use dev_kfree_skb_any() in interrupt context (Eric Pilmore)   
  - net: lan9303: Fix read error execution path (Jerry Ray)   
  - net: amd-xgbe: Check only the minimum speed for active/passive cables (Tom Lendacky)   
  - net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net/tunnel: wait until all sk_user_data reader finish before releasing the sock (Hangbin Liu)   
  - net: farsync: Fix kmemleak when rmmods farsync (Li Zetao)   
  - ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (Yuan Can)   
  - net: defxx: Fix missing err handling in dfx_init() (Yongqiang Liu)   
  - net: vmw_vsock: vmci: Check memcpy_from_msg() (Artem Chernyshev)   
  - blktrace: Fix output non-blktrace event when blk_classic option enabled (Yang Jihong)   
  - wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() (Wang Yufen)   
  - wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h (Bitterblue Smith)   
  - clk: samsung: Fix memory leak in _samsung_clk_register_pll() (Xiu Jianfeng)   
  - media: coda: Add check for kmalloc (Jiasheng Jiang)   
  - media: coda: Add check for dcoda_iram_alloc (Jiasheng Jiang)   
  - media: c8sectpfe: Add of_node_put() when breaking out of loop (Liang He)   
  - mmc: mmci: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: wbsd: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: via-sdmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: wmt-sdmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: vub300: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: toshsd: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: mxcmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: moxart: fix return value check of mmc_add_host() (Yang Yingliang)   
  - NFSv4.x: Fail client initialisation if state manager thread can't run (Trond Myklebust)   
  - SUNRPC: Fix missing release socket in rpc_sockname() (Wang ShaoBo)   
  - ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (Gaosheng Cui)   
  - media: saa7164: fix missing pci_disable_device() (Liu Shixin)   
  - regulator: core: fix module refcount leak in set_supply() (Yang Yingliang)   
  - bonding: uninitialized variable in bond_miimon_inspect() (Dan Carpenter)   
  - ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe (Zhang Qilong)   
  - drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() (Xiongfeng Wang)   
  - drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() (Xiongfeng Wang)   
  - ALSA: asihpi: fix missing pci_disable_device() (Liu Shixin)   
  - NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn (Trond Myklebust)   
  - NFSv4.2: Fix a memory stomp in decode_attr_security_label (Trond Myklebust)   
  - media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC (Aakarsh Jain)   
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() (Baisong Zhong)   
  - pinctrl: pinconf-generic: add missing of_node_put() (ZhangPeng)   
  - media: imon: fix a race condition in send_packet() (Gautam Menghani)   
  - mtd: maps: pxa2xx-flash: fix memory leak in probe (Zheng Yongjun)   
  - clk: rockchip: Fix memory leak in rockchip_clk_register_pll() (Xiu Jianfeng)   
  - ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT (Baisong Zhong)   
  - HID: hid-sensor-custom: set fixed size for custom attributes (Marcus Folkesson)   
  - media: platform: exynos4-is: Fix error handling in fimc_md_init() (Yuan Can)   
  - media: solo6x10: fix possible memory leak in solo_sysfs_init() (Yang Yingliang)   
  - Input: elants_i2c - properly handle the reset GPIO when power is off (Douglas Anderson)   
  - mtd: lpddr2_nvm: Fix possible null-ptr-deref (Hui Tang)   
  - wifi: ath10k: Fix return value in ath10k_pci_init() (Xiu Jianfeng)   
  - ima: Fix misuse of dereference of pointer in template_desc_init_fields() (Xiu Jianfeng)   
  - regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() (Yang Yingliang)   
  - ASoC: pxa: fix null-pointer dereference in filter() (Zeng Heng)   
  - drm/radeon: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo)   
  - media: camss: Clean up received buffers on failed start of streaming (Vladimir Zapolskiy)   
  - mtd: Fix device name leak when register device failed in add_mtd_device() (Zhang Xiaoxu)   
  - media: vivid: fix compose size exceed boundary (Liu Shixin)   
  - spi: Update reference to struct spi_controller (Jonathan Neuschäfer)   
  - media: i2c: ad5820: Fix error path (Ricardo Ribalda)   
  - wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() (Fedor Pchelkin)   
  - wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() (Fedor Pchelkin)   
  - rapidio: devices: fix missing put_device in mport_cdev_open (Cai Xinchen)   
  - hfs: Fix OOB Write in hfs_asc2mac (ZhangPeng)   
  - eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD (Zhang Qilong)   
  - rapidio: fix possible UAF when kfifo_alloc() fails (Wang Weiyang)   
  - fs: sysv: Fix sysv_nblocks() returns wrong value (Chen Zhongjin)   
  - MIPS: BCM63xx: Add check for NULL for clk in clk_enable (Anastasia Belova)   
  - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() (Yu Liao)   
  - x86/xen: Fix memory leak in xen_init_lock_cpu() (Xiu Jianfeng)   
  - uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix (Oleg Nesterov)   
  - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (Li Zetao)   
  - rapidio: rio: fix possible name leak in rio_register_mport() (Yang Yingliang)   
  - rapidio: fix possible name leaks when rio_add_device() fails (Yang Yingliang)   
  - lib/notifier-error-inject: fix error when writing -errno to debugfs file (Akinobu Mita)   
  - libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value (Akinobu Mita)   
  - irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() (Shang XiaoJing)   
  - PNP: fix name memory leak in pnp_alloc_dev() (Yang Yingliang)   
  - MIPS: vpe-cmp: fix possible memory leak while module exiting (Yang Yingliang)   
  - MIPS: vpe-mt: fix possible memory leak while module exiting (Yang Yingliang)   
  - ocfs2: fix memory leak in ocfs2_stack_glue_init() (Shang XiaoJing)   
  - timerqueue: Use rb_entry_safe() in timerqueue_getnext() (Barnabás Pőcze)   
  - perf: Fix possible memleak in pmu_dev_alloc() (Chen Zhongjin)   
  - fs: don't audit the capability check in simple_xattr_list() (Ondrej Mosnacek)   
  - PM: hibernate: Fix mistake in kerneldoc comment (xiongxin)   
  - alpha: fix syscall entry in !AUDUT_SYSCALL case (Al Viro)   
  - cpuidle: dt: Return the correct numbers of parsed idle states (Ulf Hansson)   
  - tpm/tpm_crb: Fix error message in __crb_relinquish_locality() (Michael Kelley)   
  - pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP (Stephen Boyd)   
  - ARM: mmp: fix timer_read delay (Doug Brown)   
  - pstore/ram: Fix error return code in ramoops_probe() (Wang Yufen)   
  - ARM: dts: turris-omnia: Add switch port 6 node (Pali Rohár)   
  - ARM: dts: turris-omnia: Add ethernet aliases (Pali Rohár)   
  - ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name (AngeloGioacchino Del Regno)   
  - soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe (Zhang Qilong)   
  - arm: dts: spear600: Fix clcd interrupt (Kory Maincent)   
  - drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static (Chen Jiahao)   
  - ARM: dts: qcom: apq8064: fix coresight compatible (Luca Weiss)   
  - usb: musb: remove extra check in musb_gadget_vbus_draw (Ivaylo Dimitrov)   
  - net: loopback: use NET_NAME_PREDICTABLE for name_assign_type (Rasmus Villemoes)   
  - Bluetooth: L2CAP: Fix u8 overflow (Sungwoo Kim)   
  - igb: Initialize mailbox message for VF reset (Tony Nguyen)   
  - USB: serial: cp210x: add Kamstrup RF sniffer PIDs (Bruno Thomsen)   
  - USB: serial: option: add Quectel EM05-G modem (Duke Xin)   
  - usb: gadget: uvc: Prevent buffer overflow in setup handler (Szymon Heidrich)   
  - udf: Fix extending file within last block (Jan Kara)   
  - udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size (Jan Kara)   
  - udf: Fix preallocation discarding at indirect extent boundary (Jan Kara)   
  - udf: Drop unused arguments of udf_delete_aext() (Jan Kara)   
  - udf: Discard preallocation before extending file with a hole (Jan Kara)   
  - perf script python: Remove explicit shebang from tests/attr.c (Tony Jones)   
  - ASoC: ops: Correct bounds check for second channel on SX controls (Charles Keepax)   
  - can: mcba_usb: Fix termination command argument (Yasushi SHOJI)   
  - can: sja1000: fix size of OCR_MODE_MASK define (Heiko Schocher)   
  - ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() (Mark Brown)   
  - nfp: fix use-after-free in area_cache_get() (Jialiang Wang)   
  - block: unhash blkdev part inode when the part is deleted (Ming Lei)   
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (Jann Horn)   
  - mm/khugepaged: fix GUP-fast interaction by sending IPI (Jann Horn)   
  - once: add DO_ONCE_SLOW() for sleepable contexts (Eric Dumazet)   
  - libtraceevent: Fix build with binutils 2.35 (Ben Hutchings)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.1.el7uek]
changelog:
  - x86/kexec: Do not reserve EFI setup_data in the kexec e820 table (Dave Young)  [Orabug: 34966703]  
  - xfs: make COW fork unwritten extent conversions more robust (Christoph Hellwig)  [Orabug: 34390903]  
  - scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan (Chandrakanth patil)  [Orabug: 34242965]  
  - scsi: megaraid_sas: Early detection of VD deletion through RaidMap update (Kashyap Desai)  [Orabug: 34242965]  
  - LTS version: v4.14.304 (Saeed Mirzamohammadi)   
  - x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN (YingChi Long)   
  - gsmi: fix null-deref in gsmi_get_variable (Khazhismel Kumykov)   
  - serial: atmel: fix incorrect baudrate setup (Tobias Schramm)   
  - serial: pch_uart: Pass correct sg to dma_unmap_sg() (Ilpo Järvinen)   
  - usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 (Juhyung Park)   
  - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() (Maciej Żenczykowski)   
  - usb: gadget: g_webcam: Send color matching descriptor per frame (Daniel Scally)   
  - usb: host: ehci-fsl: Fix module alias (Alexander Stein)   
  - USB: serial: cp210x: add SCALANCE LPE-9000 device id (Michael Adler)   
  - usb: core: hub: disable autosuspend for TI TUSB8041 (Flavio Suligoi)   
  - USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 (Greg Kroah-Hartman)   
  - USB: serial: option: add Quectel EM05CN modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EM05CN (SG) modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EC200U modem (Ali Mirghasemi)   
  - USB: serial: option: add Quectel EM05-G (RS) modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EM05-G (CS) modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EM05-G (GR) modem (Duke Xin(辛安文))   
  - prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman)   
  - usb: xhci: Check endpoint is valid before dereferencing it (Jimmy Hu)   
  - xhci-pci: set the dma max_seg_size (Ricardo Ribalda)   
  - nilfs2: fix general protection fault in nilfs_btree_insert() (Ryusuke Konishi)   
  - f2fs: let's avoid panic if extent_tree is not created (Jaegeuk Kim)   
  - RDMA/srp: Move large values to a new enum for gcc13 (Jiri Slaby (SUSE))   
  - net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats (Daniil Tatianin)   
  - pNFS/filelayout: Fix coalescing test for single DS (Olga Kornievskaia)   
  - LTS version: v4.14.303 (Saeed Mirzamohammadi)   
  - Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" (Ferry Toth)   
  - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() (Minsuk Kang)   
  - hvc/xen: lock console list traversal (Roger Pau Monne)   
  - regulator: da9211: Use irq handler when ready (Ricardo Ribalda)   
  - EDAC/device: Fix period calculation in edac_device_reset_delay_period() (Eliav Farber)   
  - x86/boot: Avoid using Intel mnemonics in AT&T syntax asm (Peter Zijlstra)   
  - netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (Gavrilov Ilia)   
  - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (Herbert Xu)   
  - platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe (Hans de Goede)   
  - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (Clement Lecigne)   
  - net/ulp: prevent ULP without clone op from entering the LISTEN status (Paolo Abeni)   
  - s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() (Heiko Carstens)   
  - perf auxtrace: Fix address filter duplicate symbol selection (Adrian Hunter)   
  - docs: Fix the docs build with Sphinx 6.0 (Jonathan Corbet)   
  - net: sched: disallow noqueue for qdisc classes (Frederick Lawler)   
  - ravb: Fix "failed to switch device to config mode" message during unbind (Biju Das)   
  - driver core: Fix bus_type.match() error handling in __driver_attach() (Isaac J. Manjarres)   
  - parisc: Align parisc MADV_XXX constants with all other architectures (Helge Deller)   
  - hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling (Linus Torvalds)   
  - hfs/hfsplus: use WARN_ON for sanity check (Arnd Bergmann)   
  - nfsd: fix handling of readdir in v4root vs. mount upcall timeout (Jeff Layton)   
  - x86/bugs: Flush IBP in ib_prctl_set() (Rodrigo Branco)   
  - udf: Fix extension of the last extent in the file (Jan Kara)   
  - caif: fix memory leak in cfctrl_linkup_request() (Zhengchao Shao)   
  - usb: rndis_host: Secure rndis_query check against int overflow (Szymon Heidrich)   
  - net: sched: atm: dont intepret cls results when asked to drop (Jamal Hadi Salim)   
  - net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe (Miaoqian Lin)   
  - net: amd-xgbe: add missed tasklet_kill (Jiguang Xiao)   
  - nfc: Fix potential resource leaks (Miaoqian Lin)   
  - qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (Daniil Tatianin)   
  - bpf: pull before calling skb_postpull_rcsum() (Jakub Kicinski)   
  - SUNRPC: ensure the matching upcall is in-flight upon downcall (minoura makoto)   
  - ext4: allocate extended attribute value in vmalloc area (Ye Bin)   
  - ext4: avoid unaccounted block allocation when expanding inode (Jan Kara)   
  - ext4: initialize quota before expanding inode in setproject ioctl (Jan Kara)   
  - ext4: fix inode leak in ext4_xattr_inode_create() on an error path (Ye Bin)   
  - ext4: avoid BUG_ON when creating xattrs (Jan Kara)   
  - ext4: fix error code return to user-space in ext4_get_branch() (Luís Henriques)   
  - ext4: init quota for 'old.inode' in 'ext4_rename' (Ye Bin)   
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode (Baokun Li)   
  - ext4: fix undefined behavior in bit shift for ext4_check_flag_values (Gaosheng Cui)   
  - ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop (Baokun Li)   
  - drm/vmwgfx: Validate the box size for the snooped cursor (Zack Rusin)   
  - drm/connector: send hotplug uevent on connector cleanup (Simon Ser)   
  - device_cgroup: Roll back to original exceptions after copy failure (Wang Weiyang)   
  - parisc: led: Fix potential null-ptr-deref in start_task() (Shang XiaoJing)   
  - iommu/amd: Fix ivrs_acpihid cmdline parsing code (Kim Phillips)   
  - crypto: n2 - add missing hash statesize (Corentin Labbe)   
  - PCI/sysfs: Fix double free in error path (Sascha Hauer)   
  - PCI: Fix pci_device_is_present() for VFs by checking PF (Michael S. Tsirkin)   
  - ima: Fix a potential NULL pointer access in ima_restore_measurement_list (Huaxin Lu)   
  - cifs: fix confusing debug message (Paulo Alcantara)   
  - media: dvb-core: Fix UAF due to refcount races at releasing (Takashi Iwai)   
  - media: dvb-core: Fix double free in dvb_register_device() (Keita Suzuki)   
  - ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod (Nick Desaulniers)   
  - tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line (Yang Jihong)   
  - x86/microcode/intel: Do not retry microcode reloading on the APs (Ashok Raj)   
  - dm cache: set needs_check flag after aborting metadata (Mike Snitzer)   
  - dm cache: Fix UAF in destroy() (Luo Meng)   
  - dm thin: Fix UAF in run_timer_softirq() (Luo Meng)   
  - dm thin: Use last transaction's pmd->root when commit failed (Zhihao Cheng)   
  - dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort (Mike Snitzer)   
  - selftests: Use optional USERCFLAGS and USERLDFLAGS (Mickaël Salaün)   
  - ARM: ux500: do not directly dereference __iomem (Jason A. Donenfeld)   
  - ktest.pl minconfig: Unset configs instead of just removing them (Steven Rostedt)   
  - media: stv0288: use explicitly signed char (Jason A. Donenfeld)   
  - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo)   
  - tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo)   
  - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING (Deren Wu)   
  - md: fix a crash in mempool_free (Mikulas Patocka)   
  - pnode: terminate at peers of source (Christian Brauner)   
  - ALSA: line6: fix stack overflow in line6_midi_transmit (Artem Egorkine)   
  - ALSA: line6: correct midi status byte when receiving data from podxt (Artem Egorkine)   
  - hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount (Aditya Garg)   
  - HID: plantronics: Additional PIDs for double volume key presses quirk (Terry Junge)   
  - powerpc/rtas: avoid scheduling in rtas_os_term() (Nathan Lynch)   
  - powerpc/rtas: avoid device tree lookups in rtas_os_term() (Nathan Lynch)   
  - media: dvbdev: fix refcnt bug (Lin Ma)   
  - gcov: add support for checksum field (Rickard x Andersson)   
  - iio: adc: ad_sigma_delta: do not use internal iio_dev lock (Nuno Sá)   
  - reiserfs: Add missing calls to reiserfs_security_free() (Roberto Sassu)   
  - HID: wacom: Ensure bootloader PID is usable in hidraw mode (Jason Gerecke)   
  - usb: dwc3: core: defer probe on ulpi_read_id timeout (Ferry Toth)   
  - pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES (John Stultz)   
  - pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion (John Stultz)   
  - ASoC: rt5670: Remove unbalanced pm_runtime_put() (Hans de Goede)   
  - ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() (Wang Jingjin)   
  - ASoC: wm8994: Fix potential deadlock (Marek Szyprowski)   
  - ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() (Wang Jingjin)   
  - ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() (Wang Yufen)   
  - orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() (Zhang Xiaoxu)   
  - drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() (Nathan Chancellor)   
  - drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() (Nathan Chancellor)   
  - clk: st: Fix memory leak in st_of_quadfs_setup() (Xiu Jianfeng)   
  - media: si470x: Fix use-after-free in si470x_int_in_callback() (Shigeru Yoshida)   
  - mmc: f-sdh30: Add quirks for broken timeout clock capability (Kunihiko Hayashi)   
  - blk-mq: fix possible memleak when register 'hctx' failed (Ye Bin)   
  - media: dvb-usb: fix memory leak in dvb_usb_adapter_init() (Mazin Al Haddad)   
  - media: dvbdev: adopts refcnt to avoid UAF (Lin Ma)   
  - media: dvb-frontends: fix leak of memory fw (Yan Lei)   
  - ppp: associate skb with a device at tx (Stanislav Fomichev)   
  - mrp: introduce active flags to prevent UAF when applicant uninit (Schspa Shi)   
  - md/raid1: stop mdx_raid1 thread when raid1 array run failed (Jiang Li)   
  - drm/sti: Use drm_mode_copy() (Ville Syrjälä)   
  - s390/lcs: Fix return type of lcs_start_xmit() (Nathan Chancellor)   
  - s390/netiucv: Fix return type of netiucv_tx() (Nathan Chancellor)   
  - s390/ctcm: Fix return type of ctc{mp,}m_tx() (Nathan Chancellor)   
  - igb: Do not free q_vector unless new one was allocated (Kees Cook)   
  - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() (Minsuk Kang)   
  - hamradio: baycom_epp: Fix return type of baycom_send_packet() (Nathan Chancellor)   
  - net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() (Nathan Chancellor)   
  - bpf: make sure skb->len != 0 when redirecting to a tunneling device (Stanislav Fomichev)   
  - ipmi: fix memleak when unload ipmi driver (Zhang Yuchen)   
  - ASoC: codecs: rt298: Add quirk for KBL-R RVP platform (Amadeusz Sławiński)   
  - wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out (Shigeru Yoshida)   
  - wifi: ath9k: verify the expected usb_endpoints are present (Fedor Pchelkin)   
  - hfs: fix OOB Read in __hfs_brec_find (ZhangPeng)   
  - acct: fix potential integer overflow in encode_comp_t() (Zheng Yejian)   
  - nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() (Ryusuke Konishi)   
  - ACPICA: Fix error code path in acpi_ds_call_control_method() (Rafael J. Wysocki)   
  - fs: jfs: fix shift-out-of-bounds in dbDiscardAG (Hoi Pok Wu)   
  - udf: Avoid double brelse() in udf_rename() (Shigeru Yoshida)   
  - fs: jfs: fix shift-out-of-bounds in dbAllocAG (Dongliang Mu)   
  - binfmt_misc: fix shift-out-of-bounds in check_special_flags (Liu Shixin)   
  - net: stream: purge sk_error_queue in sk_stream_kill_queues() (Eric Dumazet)   
  - myri10ge: Fix an error handling path in myri10ge_probe() (Christophe JAILLET)   
  - net_sched: reject TCF_EM_SIMPLE case for complex ematch module (Cong Wang)   
  - skbuff: Account for tail adjustment during pull operations (Subash Abhinov Kasiviswanathan)   
  - openvswitch: Fix flow lookup to use unmasked key (Eelco Chaudron)   
  - r6040: Fix kmemleak in probe and remove (Li Zetao)   
  - nfc: pn533: Clear nfc_target before being used (Minsuk Kang)   
  - mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (Dan Aloni)   
  - rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() (Gaosheng Cui)   
  - selftests/powerpc: Fix resource leaks (Miaoqian Lin)   
  - powerpc/hv-gpci: Fix hv_gpci event list (Kajol Jain)   
  - powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() (Yang Yingliang)   
  - powerpc/perf: callchain validate kernel stack pointer bounds (Nicholas Piggin)   
  - powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() (Yang Yingliang)   
  - cxl: Fix refcount leak in cxl_calc_capp_routing (Miaoqian Lin)   
  - powerpc/52xx: Fix a resource leak in an error handling path (Christophe JAILLET)   
  - macintosh/macio-adb: check the return value of ioremap() (Xie Shaowen)   
  - macintosh: fix possible memory leak in macio_add_one_device() (Yang Yingliang)   
  - iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() (Yuan Can)   
  - iommu/amd: Fix pci device refcount leak in ppr_notifier() (Yang Yingliang)   
  - rtc: snvs: Allow a time difference on clock register read (Stefan Eichenberger)   
  - include/uapi/linux/swab: Fix potentially missing __always_inline (Matt Redfearn)   
  - HSI: omap_ssi_core: Fix error handling in ssi_init() (Yuan Can)   
  - power: supply: fix residue sysfs file in error handle route of __power_supply_register() (Zeng Heng)   
  - HSI: omap_ssi_core: fix possible memory leak in ssi_probe() (Yang Yingliang)   
  - HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() (Yang Yingliang)   
  - fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() (Christophe JAILLET)   
  - fbdev: vermilion: decrease reference count in error path (Xiongfeng Wang)   
  - fbdev: via: Fix error in via_core_init() (Shang XiaoJing)   
  - fbdev: pm2fb: fix missing pci_disable_device() (Yang Yingliang)   
  - fbdev: ssd1307fb: Drop optional dependency (Andy Shevchenko)   
  - usb: storage: Add check for kcalloc (Jiasheng Jiang)   
  - i2c: ismt: Fix an out-of-bounds bug in ismt_access() (Zheyu Ma)   
  - vme: Fix error not catched in fake_init() (Chen Zhongjin)   
  - staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() (YueHaibing)   
  - staging: rtl8192u: Fix use after free in ieee80211_rx() (Dan Carpenter)   
  - i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe (Hui Tang)   
  - chardev: fix error handling in cdev_device_add() (Yang Yingliang)   
  - mcb: mcb-parse: fix error handing in chameleon_parse_gdd() (Yang Yingliang)   
  - drivers: mcb: fix resource leak in mcb_probe() (Zhengchao Shao)   
  - cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (Yang Yingliang)   
  - cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() (Yang Yingliang)   
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (Zheng Wang)   
  - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (ruanjinjie)   
  - test_firmware: fix memory leak in test_firmware_init() (Zhengchao Shao)   
  - serial: sunsab: Fix error handling in sunsab_init() (Yuan Can)   
  - serial: pch: Fix PCI device refcount leak in pch_request_dma() (Xiongfeng Wang)   
  - serial: amba-pl011: avoid SBSA UART accessing DMACR register (Jiamei Xie)   
  - staging: vme_user: Fix possible UAF in tsi148_dma_list_add (Gaosheng Cui)   
  - usb: fotg210-udc: Fix ages old endianness issues (Linus Walleij)   
  - uio: uio_dmem_genirq: Fix deadlock between irq config and handling (Rafael Mendonca)   
  - uio: uio_dmem_genirq: Fix missing unlock in irq configuration (Rafael Mendonca)   
  - vfio: platform: Do not pass return buffer to ACPI _RST method (Rafael Mendonca)   
  - class: fix possible memory leak in __class_register() (Yang Yingliang)   
  - drivers: dio: fix possible memory leak in dio_init() (Yang Yingliang)   
  - IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces (Dragos Tatulea)   
  - hwrng: geode - Fix PCI device refcount leak (Xiongfeng Wang)   
  - hwrng: amd - Fix PCI device refcount leak (Xiongfeng Wang)   
  - crypto: img-hash - Fix variable dereferenced before check 'hdev->req' (Gaosheng Cui)   
  - orangefs: Fix sysfs not cleanup when dev init failed (Zhang Xiaoxu)   
  - RDMA/hfi1: Fix error return code in parse_platform_config() (Wang Yufen)   
  - scsi: snic: Fix possible UAF in snic_tgt_create() (Gaosheng Cui)   
  - scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails (Chen Zhongjin)   
  - scsi: ipr: Fix WARNING in ipr_init() (Shang XiaoJing)   
  - scsi: fcoe: Fix possible name leak when device_register() fails (Yang Yingliang)   
  - scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() (Yang Yingliang)   
  - scsi: hpsa: Fix error handling in hpsa_add_sas_host() (Yang Yingliang)   
  - RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (Zhang Xiaoxu)   
  - RDMA/hfi: Decrease PCI device reference count in error path (Xiongfeng Wang)   
  - PCI: Check for alloc failure in pci_request_irq() (Zeng Heng)   
  - apparmor: fix a memleak in multi_transaction_new() (Gaosheng Cui)   
  - stmmac: fix potential division by 0 (Piergiorgio Beruto)   
  - Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - ntb_netdev: Use dev_kfree_skb_any() in interrupt context (Eric Pilmore)   
  - net: lan9303: Fix read error execution path (Jerry Ray)   
  - net: amd-xgbe: Check only the minimum speed for active/passive cables (Tom Lendacky)   
  - net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net/tunnel: wait until all sk_user_data reader finish before releasing the sock (Hangbin Liu)   
  - net: farsync: Fix kmemleak when rmmods farsync (Li Zetao)   
  - ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (Yuan Can)   
  - net: defxx: Fix missing err handling in dfx_init() (Yongqiang Liu)   
  - net: vmw_vsock: vmci: Check memcpy_from_msg() (Artem Chernyshev)   
  - blktrace: Fix output non-blktrace event when blk_classic option enabled (Yang Jihong)   
  - wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() (Wang Yufen)   
  - wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h (Bitterblue Smith)   
  - clk: samsung: Fix memory leak in _samsung_clk_register_pll() (Xiu Jianfeng)   
  - media: coda: Add check for kmalloc (Jiasheng Jiang)   
  - media: coda: Add check for dcoda_iram_alloc (Jiasheng Jiang)   
  - media: c8sectpfe: Add of_node_put() when breaking out of loop (Liang He)   
  - mmc: mmci: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: wbsd: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: via-sdmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: wmt-sdmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: vub300: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: toshsd: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: mxcmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: moxart: fix return value check of mmc_add_host() (Yang Yingliang)   
  - NFSv4.x: Fail client initialisation if state manager thread can't run (Trond Myklebust)   
  - SUNRPC: Fix missing release socket in rpc_sockname() (Wang ShaoBo)   
  - ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (Gaosheng Cui)   
  - media: saa7164: fix missing pci_disable_device() (Liu Shixin)   
  - regulator: core: fix module refcount leak in set_supply() (Yang Yingliang)   
  - bonding: uninitialized variable in bond_miimon_inspect() (Dan Carpenter)   
  - ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe (Zhang Qilong)   
  - drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() (Xiongfeng Wang)   
  - drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() (Xiongfeng Wang)   
  - ALSA: asihpi: fix missing pci_disable_device() (Liu Shixin)   
  - NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn (Trond Myklebust)   
  - NFSv4.2: Fix a memory stomp in decode_attr_security_label (Trond Myklebust)   
  - media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC (Aakarsh Jain)   
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() (Baisong Zhong)   
  - pinctrl: pinconf-generic: add missing of_node_put() (ZhangPeng)   
  - media: imon: fix a race condition in send_packet() (Gautam Menghani)   
  - mtd: maps: pxa2xx-flash: fix memory leak in probe (Zheng Yongjun)   
  - clk: rockchip: Fix memory leak in rockchip_clk_register_pll() (Xiu Jianfeng)   
  - ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT (Baisong Zhong)   
  - HID: hid-sensor-custom: set fixed size for custom attributes (Marcus Folkesson)   
  - media: platform: exynos4-is: Fix error handling in fimc_md_init() (Yuan Can)   
  - media: solo6x10: fix possible memory leak in solo_sysfs_init() (Yang Yingliang)   
  - Input: elants_i2c - properly handle the reset GPIO when power is off (Douglas Anderson)   
  - mtd: lpddr2_nvm: Fix possible null-ptr-deref (Hui Tang)   
  - wifi: ath10k: Fix return value in ath10k_pci_init() (Xiu Jianfeng)   
  - ima: Fix misuse of dereference of pointer in template_desc_init_fields() (Xiu Jianfeng)   
  - regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() (Yang Yingliang)   
  - ASoC: pxa: fix null-pointer dereference in filter() (Zeng Heng)   
  - drm/radeon: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo)   
  - media: camss: Clean up received buffers on failed start of streaming (Vladimir Zapolskiy)   
  - mtd: Fix device name leak when register device failed in add_mtd_device() (Zhang Xiaoxu)   
  - media: vivid: fix compose size exceed boundary (Liu Shixin)   
  - spi: Update reference to struct spi_controller (Jonathan Neuschäfer)   
  - media: i2c: ad5820: Fix error path (Ricardo Ribalda)   
  - wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() (Fedor Pchelkin)   
  - wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() (Fedor Pchelkin)   
  - rapidio: devices: fix missing put_device in mport_cdev_open (Cai Xinchen)   
  - hfs: Fix OOB Write in hfs_asc2mac (ZhangPeng)   
  - eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD (Zhang Qilong)   
  - rapidio: fix possible UAF when kfifo_alloc() fails (Wang Weiyang)   
  - fs: sysv: Fix sysv_nblocks() returns wrong value (Chen Zhongjin)   
  - MIPS: BCM63xx: Add check for NULL for clk in clk_enable (Anastasia Belova)   
  - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() (Yu Liao)   
  - x86/xen: Fix memory leak in xen_init_lock_cpu() (Xiu Jianfeng)   
  - uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix (Oleg Nesterov)   
  - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (Li Zetao)   
  - rapidio: rio: fix possible name leak in rio_register_mport() (Yang Yingliang)   
  - rapidio: fix possible name leaks when rio_add_device() fails (Yang Yingliang)   
  - lib/notifier-error-inject: fix error when writing -errno to debugfs file (Akinobu Mita)   
  - libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value (Akinobu Mita)   
  - irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() (Shang XiaoJing)   
  - PNP: fix name memory leak in pnp_alloc_dev() (Yang Yingliang)   
  - MIPS: vpe-cmp: fix possible memory leak while module exiting (Yang Yingliang)   
  - MIPS: vpe-mt: fix possible memory leak while module exiting (Yang Yingliang)   
  - ocfs2: fix memory leak in ocfs2_stack_glue_init() (Shang XiaoJing)   
  - timerqueue: Use rb_entry_safe() in timerqueue_getnext() (Barnabás Pőcze)   
  - perf: Fix possible memleak in pmu_dev_alloc() (Chen Zhongjin)   
  - fs: don't audit the capability check in simple_xattr_list() (Ondrej Mosnacek)   
  - PM: hibernate: Fix mistake in kerneldoc comment (xiongxin)   
  - alpha: fix syscall entry in !AUDUT_SYSCALL case (Al Viro)   
  - cpuidle: dt: Return the correct numbers of parsed idle states (Ulf Hansson)   
  - tpm/tpm_crb: Fix error message in __crb_relinquish_locality() (Michael Kelley)   
  - pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP (Stephen Boyd)   
  - ARM: mmp: fix timer_read delay (Doug Brown)   
  - pstore/ram: Fix error return code in ramoops_probe() (Wang Yufen)   
  - ARM: dts: turris-omnia: Add switch port 6 node (Pali Rohár)   
  - ARM: dts: turris-omnia: Add ethernet aliases (Pali Rohár)   
  - ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name (AngeloGioacchino Del Regno)   
  - soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe (Zhang Qilong)   
  - arm: dts: spear600: Fix clcd interrupt (Kory Maincent)   
  - drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static (Chen Jiahao)   
  - ARM: dts: qcom: apq8064: fix coresight compatible (Luca Weiss)   
  - usb: musb: remove extra check in musb_gadget_vbus_draw (Ivaylo Dimitrov)   
  - net: loopback: use NET_NAME_PREDICTABLE for name_assign_type (Rasmus Villemoes)   
  - Bluetooth: L2CAP: Fix u8 overflow (Sungwoo Kim)   
  - igb: Initialize mailbox message for VF reset (Tony Nguyen)   
  - USB: serial: cp210x: add Kamstrup RF sniffer PIDs (Bruno Thomsen)   
  - USB: serial: option: add Quectel EM05-G modem (Duke Xin)   
  - usb: gadget: uvc: Prevent buffer overflow in setup handler (Szymon Heidrich)   
  - udf: Fix extending file within last block (Jan Kara)   
  - udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size (Jan Kara)   
  - udf: Fix preallocation discarding at indirect extent boundary (Jan Kara)   
  - udf: Drop unused arguments of udf_delete_aext() (Jan Kara)   
  - udf: Discard preallocation before extending file with a hole (Jan Kara)   
  - perf script python: Remove explicit shebang from tests/attr.c (Tony Jones)   
  - ASoC: ops: Correct bounds check for second channel on SX controls (Charles Keepax)   
  - can: mcba_usb: Fix termination command argument (Yasushi SHOJI)   
  - can: sja1000: fix size of OCR_MODE_MASK define (Heiko Schocher)   
  - ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() (Mark Brown)   
  - nfp: fix use-after-free in area_cache_get() (Jialiang Wang)   
  - block: unhash blkdev part inode when the part is deleted (Ming Lei)   
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (Jann Horn)   
  - mm/khugepaged: fix GUP-fast interaction by sending IPI (Jann Horn)   
  - once: add DO_ONCE_SLOW() for sleepable contexts (Eric Dumazet)   
  - libtraceevent: Fix build with binutils 2.35 (Ben Hutchings)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.2.el7uek]
changelog:
  - RDMA/addr: Refresh neighbour entries upon rdma_resolve_addr() (Gerd Rausch)  [Orabug: 35060577]  
  - xfs: fix incorrect i_nlink caused by inode racing (Long Li)  [Orabug: 35040849]


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.522.1.el7uek]
changelog:
  - uek-rpm: ol7: Add enhanced kABI diagnostics (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: ol7: Add Symtypes files (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: ol7: Enable creation of Symtypes files (Stephen Brennan)  [Orabug: 34879138]  
  - uek-rpm: Add kabi tool and documentation (Stephen Brennan)  [Orabug: 34879138]  
  - xfs: don't reuse busy extents on extent trim (Brian Foster)  [Orabug: 34605583]  
  - RDMA/ucma: Put a lock around every call to the rdma_cm layer (Jason Gunthorpe)  [Orabug: 34106064]  
  - LTS version: v4.14.302 (Saeed Mirzamohammadi)   
  - net: mvneta: Fix an out of bounds check (Dan Carpenter)   
  - ipv6: avoid use-after-free in ip6_fragment() (Eric Dumazet)   
  - net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() (Yang Yingliang)   
  - ethernet: aeroflex: fix potential skb leak in greth_init_rings() (Zhang Changzhong)   
  - tipc: Fix potential OOB in tipc_link_proto_rcv() (YueHaibing)   
  - net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (Liu Jian)   
  - net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (Liu Jian)   
  - net: stmmac: fix "snps,axi-config" node property parsing (Jisheng Zhang)   
  - NFC: nci: Bounds check struct nfc_target arrays (Kees Cook)   
  - net: mvneta: Prevent out of bounds read in mvneta_config_rss() (Dan Carpenter)   
  - net: encx24j600: Fix invalid logic in reading of MISTAT register (Valentina Goncharenko)   
  - net: encx24j600: Add parentheses to fix precedence (Valentina Goncharenko)   
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (Wei Yongjun)   
  - Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() (Wang ShaoBo)   
  - igb: Allocate MSI-X vector when testing (Akihiko Odaki)   
  - e1000e: Fix TX dispatch condition (Akihiko Odaki)   
  - gpio: amd8111: Fix PCI device reference count leak (Xiongfeng Wang)   
  - ca8210: Fix crash by zero initializing data (Hauke Mehrtens)   
  - ieee802154: cc2520: Fix error return code in cc2520_hw_init() (Ziyang Xuan)   
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event (ZhangPeng)   
  - HID: hid-lg4ff: Add check for empty lbuf (Anastasia Belova)   
  - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (Thomas Huth)   
  - memcg: fix possible use-after-free in memcg_write_event_control() (Tejun Heo)   
  - media: v4l2-dv-timings.c: fix too strict blanking sanity checks (Hans Verkuil)   
  - xen/netback: do some code cleanup (Juergen Gross)   
  - net: usb: qmi_wwan: add u-blox 0x1342 composition (Davide Tronchin)   
  - regulator: twl6030: fix get status of twl6032 regulators (Andreas Kemnade)   
  - ASoC: soc-pcm: Add NULL check in BE reparenting (Srinivasa Rao Mandadapu)   
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (Kees Cook)   
  - ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 (Johan Jonker)   
  - ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation (Giulio Benetti)   
  - ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels (Tomislav Novak)   
  - ARM: dts: rockchip: fix ir-receiver node names (Johan Jonker)   
  - arm: dts: rockchip: fix node name for hym8563 rtc (Sebastian Reichel)   
  - LTS version: v4.14.301 (Saeed Mirzamohammadi)   
  - ipc/sem: Fix dangling sem_array access in semtimedop race (Jann Horn)   
  - v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails (Linus Torvalds)   
  - mmc: sdhci: Fix voltage switch delay (Adrian Hunter)   
  - mmc: sdhci: use FIELD_GET for preset value bit masks (Masahiro Yamada)   
  - x86/ioremap: Fix page aligned size calculation in __ioremap_caller() (Michael Kelley)   
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (Luiz Augusto von Dentz)   [Orabug: 34833306] {CVE-2022-42896} 
  - x86/pm: Add enumeration check before spec MSRs save/restore setup (Saeed Mirzamohammadi)   
  - nvme: restrict management ioctls to admin (Keith Busch) [Orabug: 34619367] {CVE-2022-3169}
  - tcp/udp: Fix memory leak in ipv6_renew_options(). (Kuniyuki Iwashima)  [Orabug: 34719346]  {CVE-2022-3524} 
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (Xiongfeng Wang)   
  - pinctrl: single: Fix potential division by zero (Maxim Korotkov)   
  - ASoC: ops: Fix bounds check for _sx controls (Mark Brown)   
  - efi: random: Properly limit the size of the random seed (Ben Hutchings)   
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (ZhangPeng)   
  - tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" (Tiezhu Yang)   
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (ChenXiaoSong)   
  - perf: Add sample_flags to indicate the PMU-filled sample data (Kan Liang)   
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (Yang Yingliang)   
  - hwmon: (coretemp) Check for null before removing sysfs attrs (Phil Auld)   
  - net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed (Yoshihiro Shimoda)   
  - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE (Willem de Bruijn)   
  - net: hsr: Fix potential use-after-free (YueHaibing)   
  - dsa: lan9303: Correct stat name (Jerry Ray)   
  - net/9p: Fix a potential socket leak in p9_socket_open (Wang Hai)   
  - net: net_netdev: Fix error handling in ntb_netdev_init_module() (Yuan Can)   
  - net: phy: fix null-ptr-deref while probe() failed (Yang Yingliang)   
  - qlcnic: fix sleep-in-atomic-context bugs caused by msleep (Duoming Zhou)   
  - can: cc770: cc770_isa_probe(): add missing free_cc770dev() (Zhang Changzhong)   
  - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() (Zhang Changzhong)   
  - net/mlx5: Fix uninitialized variable bug in outlen_write() (YueHaibing)   
  - of: property: decrement node refcount in of_fwnode_get_reference_args() (Yang Yingliang)   
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (Gaosheng Cui)   
  - hwmon: (i5500_temp) fix missing pci_disable_device() (Yang Yingliang)   
  - iio: light: rpr0521: add missing Kconfig dependencies (Paul Gazzillo)   
  - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw (Wei Yongjun)   
  - iio: health: afe4403: Fix oob read in afe4403_read_raw (Wei Yongjun)   
  - drm/amdgpu: always register an MMU notifier for userptr (Christian König)   
  - net: usb: qmi_wwan: add Telit 0x103a composition (Enrico Sau)   
  - tcp: configurable source port perturb table size (Gleb Mazovetskiy)   
  - platform/x86: hp-wmi: Ignore Smart Experience App event (Kai-Heng Feng)   
  - platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) (Hans de Goede)   
  - platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() (Xiongfeng Wang)   
  - xen/platform-pci: add missing free_irq() in error path (ruanjinjie)   
  - serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() (Lukas Wunner)   
  - Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode (Aman Dhoot)   
  - nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty (Chen Zhongjin)   
  - kconfig: display recursive dependency resolution hint just once (Masahiro Yamada)   
  - iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails (Chen Zhongjin)   
  - iio: light: apds9960: fix wrong register for gesture gain (Alejandro Concepción Rodríguez)   
  - arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency (Jakob Unterwurzacher)   
  - nios2: add FORCE for vmlinuz.gz (Randy Dunlap)   
  - s390/crashdump: fix TOD programmable field size (Heiko Carstens)   
  - net: thunderx: Fix the ACPI memory leak (Yu Liao)   
  - nfc: st-nci: fix memory leaks in EVT_TRANSACTION (Martin Faltesek)   
  - nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION (Martin Faltesek)   
  - s390/dasd: fix no record found for raw_track_access (Stefan Haberland)   
  - dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). (Kuniyuki Iwashima)   
  - NFC: nci: fix memory leak in nci_rx_data_packet() (Liu Shixin)   
  - xfrm: Fix ignored return value in xfrm6_init() (Chen Zhongjin)   
  - net/qla3xxx: fix potential memleak in ql3xxx_send() (Zhang Changzhong)   
  - net/mlx4: Check retval of mlx4_bitmap_init (Peter Kosyh)   
  - ARM: mxs: fix memory leak in mxs_machine_init() (Zheng Yongjun)   
  - 9p/fd: fix issue of list_del corruption in p9_fd_cancel() (Zhengchao Shao)   
  - net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() (Wang Hai)   
  - nfc/nci: fix race with opening and closing (Lin Ma)   
  - ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl (Michael Grzeschik)   
  - bus: sunxi-rsb: Support atomic transfers (Samuel Holland)   
  - ARM: dts: am335x-pcm-953: Define fixed regulators in root node (Dominik Haller)   
  - af_key: Fix send_acquire race with pfkey_register (Herbert Xu)   
  - MIPS: pic32: treat port as signed integer (Jason A. Donenfeld)   
  - spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run (Sean Nyekjaer)   
  - wifi: mac80211: Fix ack frame idr leak when mesh has no route (Nicolas Cavallari)   
  - audit: fix undefined behavior in bit shift for AUDIT_BIT (Gaosheng Cui)   
  - wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support (Jonas Jelonek)   
  - LTS version: v4.14.300 (Saeed Mirzamohammadi)   
  - ntfs: check overflow when iterating ATTR_RECORDs (Hawkins Jiawei)   
  - ntfs: fix out-of-bounds read in ntfs_attr_find() (Hawkins Jiawei)   
  - ntfs: fix use-after-free in ntfs_attr_find() (Hawkins Jiawei)   
  - mm: fs: initialize fsdata passed to write_begin/write_end interface (Alexander Potapenko)   
  - 9p/trans_fd: always use O_NONBLOCK read/write (Tetsuo Handa)   
  - gfs2: Switch from strlcpy to strscpy (Andreas Gruenbacher)   
  - gfs2: Check sb_bsize_shift after reading superblock (Andrew Price)   
  - 9p: trans_fd/p9_conn_cancel: drop client lock earlier (Dominique Martinet)   
  - kcm: close race conditions on sk_receive_queue (Cong Wang)   
  - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (Baisong Zhong)   
  - kcm: avoid potential race in kcm_tx_work (Eric Dumazet)   
  - tcp: cdg: allow tcp_cdg_release() to be called multiple times (Eric Dumazet)   
  - macvlan: enforce a consistent minimal mtu (Eric Dumazet)   
  - serial: 8250: Flush DMA Rx on RLSI (Ilpo Järvinen)   
  - nilfs2: fix use-after-free bug of ns_writer on remount (Ryusuke Konishi)   
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (Alexander Potapenko)   
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (Xiongfeng Wang)   
  - mmc: core: properly select voltage range without power cycle (Yann Gautier)   
  - serial: 8250_lpss: Configure DMA also w/o DMA filter (Ilpo Järvinen)   
  - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs (Ilpo Järvinen)   
  - dm ioctl: fix misbehavior if list_versions races with module loading (Mikulas Patocka)   
  - iio: pressure: ms5611: changed hardcoded SPI speed to value limited (Mitja Spes)   
  - iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() (Yang Yingliang)   
  - iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() (Yang Yingliang)   
  - usb: chipidea: fix deadlock in ci_otg_del_timer (Duoming Zhou)   
  - usb: add NO_LPM quirk for Realforce 87U Keyboard (Nicolas Dumazet)   
  - USB: serial: option: add Fibocom FM160 0x0111 composition (Reinhard Speyerer)   
  - USB: serial: option: add u-blox LARA-L6 modem (Davide Tronchin)   
  - USB: serial: option: add u-blox LARA-R6 00B modem (Davide Tronchin)   
  - USB: serial: option: remove old LARA-R6 PID (Davide Tronchin)   
  - USB: serial: option: add Sierra Wireless EM9191 (Benoît Monin)   
  - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (Takashi Iwai)   
  - ring_buffer: Do not deactivate non-existant pages (Daniil Tatianin)   
  - ftrace: Fix null pointer dereference in ftrace_add_mod() (Xiu Jianfeng)   
  - ftrace: Optimize the allocation for mcount entries (Wang Wensheng)   
  - ftrace: Fix the possible incorrect kernel message (Wang Wensheng)   
  - cifs: Fix wrong return value checking when GETFLAGS (Zhang Xiaoxu)   
  - net/x25: Fix skb leak in x25_lapb_receive_frame() (Wei Yongjun)   
  - drbd: use after free in drbd_create_device() (Dan Carpenter)   
  - xen/pcpu: fix possible memory leak in register_pcpu() (Yang Yingliang)   
  - net: caif: fix double disconnect client in chnl_net_open() (Zhengchao Shao)   
  - mISDN: fix misuse of put_device() in mISDN_register_device() (Wang ShaoBo)   
  - mISDN: fix possible memory leak in mISDN_dsp_element_register() (Yang Yingliang)   
  - net: bgmac: Drop free_netdev() from bgmac_enet_remove() (Wei Yongjun)   
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (Zeng Heng)   
  - parport_pc: Avoid FIFO port location truncation (Maciej W. Rozycki)   
  - block: sed-opal: kmalloc the cmd/resp buffers (Serge Semin)   
  - ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (Chen Zhongjin)   
  - tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send (Duoming Zhou)   
  - serial: 8250: omap: Flush PM QOS work on remove (Tony Lindgren)   
  - serial: 8250_omap: remove wait loop from Errata i202 workaround (Matthias Schiffer)   
  - ASoC: core: Fix use-after-free in snd_soc_exit() (Chen Zhongjin)   
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (Luiz Augusto von Dentz)   
  - drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid (Nathan Huckleberry)   
  - selftests/futex: fix build for clang (Ricardo Cañuelo)   
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Borislav Petkov)   
  - dmaengine: at_hdmac: Check return code of dma_async_device_register (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix impossible condition (Tudor Ambarus)   
  - dmaengine: at_hdmac: Don't allow CPU to reorder channel enable (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors (Tudor Ambarus)   
  - dmaengine: at_hdmac: Don't start transactions at tx_submit level (Tudor Ambarus)   
  - dmaengine: at_hdmac: Fix at_lli struct definition (Tudor Ambarus)   
  - cert host tools: Stop complaining about deprecated OpenSSL functions (Linus Torvalds)   
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (ZhangPeng)   
  - btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() (Zhang Xiaoxu)   
  - platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi (Jorge Lopez)   
  - drm/i915/dmabuf: fix sg_table handling in map_dma_buf (Matthew Auld)   
  - nilfs2: fix deadlock in nilfs_count_free_blocks() (Ryusuke Konishi)   
  - ALSA: usb-audio: Add quirk entry for M-Audio Micro (Takashi Iwai)   
  - ALSA: hda: fix potential memleak in 'add_widget_node' (Ye Bin)   
  - arm64: efi: Fix handling of misaligned runtime regions and drop warning (Ard Biesheuvel)   
  - net: macvlan: fix memory leaks of macvlan_common_newlink (Chuang Wang)   
  - net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open() (Zhengchao Shao)   
  - ethernet: s2io: disable napi when start nic failed in s2io_card_up() (Zhengchao Shao)   
  - net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() (Zhengchao Shao)   
  - drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() (Zhengchao Shao)   
  - dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() (Christophe JAILLET)   
  - tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header (Xin Long)   
  - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (Alexander Potapenko)   
  - drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register() (Yuan Can)   
  - hamradio: fix issue of dev reference count leakage in bpq_device_event() (Zhengchao Shao)   
  - net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event() (Zhengchao Shao)   
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK (Gaosheng Cui)   
  - net: fman: Unregister ethernet device on removal (Sean Anderson)   
  - bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer (Alex Barba)   
  - net: gso: fix panic on frag_list with mixed head alloc types (Jiri Benc)   
  - HID: hyperv: fix possible memory leak in mousevsc_probe() (Yang Yingliang)   
  - LTS version: v4.14.299 (Saeed Mirzamohammadi)   
  - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() (Dokyung Song) [Orabug: 34951545] {CVE-2022-3628}
  - linux/const.h: move UL() macro to include/linux/const.h (Masahiro Yamada)   
  - linux/const.h: prefix include guard of uapi/linux/const.h with _UAPI (Masahiro Yamada)   
  - KVM: x86: emulator: update the emulation mode after CR0 write (Maxim Levitsky)   
  - KVM: x86: emulator: introduce emulator_recalc_and_set_mode (Maxim Levitsky)   
  - KVM: x86: emulator: em_sysexit should update ctxt->mode (Maxim Levitsky)   
  - KVM: x86: Mask off reserved bits in CPUID.80000008H (Jim Mattson)   
  - ext4: fix warning in 'ext4_da_release_space' (Ye Bin)   
  - parisc: Export iosapic_serial_irq() symbol for serial port driver (Helge Deller)   
  - parisc: Make 8250_gsc driver dependend on CONFIG_PARISC (Helge Deller)   
  - efi: random: reduce seed size to 32 bytes (Ard Biesheuvel)   
  - ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices (John Veness)   
  - capabilities: fix potential memleak on error path from vfs_getxattr_alloc() (Gaosheng Cui)   
  - tcp/udp: Make early_demux back namespacified. (Kuniyuki Iwashima)   
  - btrfs: fix type of parameter generation in btrfs_get_dentry (David Sterba)   
  - block, bfq: protect 'bfqd->queued' by 'bfqd->lock' (Yu Kuai)   
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (Luiz Augusto von Dentz)   [Orabug: 34951661] {CVE-2022-42895} 
  - i2c: xiic: Add platform module alias (Martin Tůma)   
  - media: dvb-frontends/drxk: initialize err to 0 (Hans Verkuil)   
  - media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE (Hans Verkuil)   
  - net, neigh: Fix null-ptr-deref in neigh_table_clear() (Chen Zhongjin)   
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register (Gaosheng Cui)   
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (Zhengchao Shao) [Orabug: 34752621] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Maxim Mikityanskiy)   
  - btrfs: fix ulist leaks in error paths of qgroup self tests (Filipe Manana)   
  - btrfs: fix inode list leak during backref walking at resolve_indirect_refs() (Filipe Manana)   
  - isdn: mISDN: netjet: fix wrong check of device registration (Yang Yingliang)   
  - mISDN: fix possible memory leak in mISDN_register_device() (Yang Yingliang)   
  - rose: Fix NULL pointer dereference in rose_send_frame() (Zhang Qilong)   
  - ipvs: use explicitly signed chars (Jason A. Donenfeld)   
  - net: sched: Fix use after free in red_enqueue() (Dan Carpenter)   
  - ata: pata_legacy: fix pdc20230_set_piomode() (Sergey Shtylyov)   
  - net: fec: fix improper use of NETDEV_TX_BUSY (Zhang Changzhong)   
  - nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() (Shang XiaoJing)   
  - nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() (Shang XiaoJing)   
  - net: dsa: Fix possible memory leaks in dsa_loop_init() (Chen Zhongjin)   
  - nfs4: Fix kmemleak when allocate slot failed (Zhang Xiaoxu)   
  - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot (Trond Myklebust)   
  - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors (Trond Myklebust)


author: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [4.14.35-2047.523.1.el7uek]
changelog:
  - x86/kexec: Do not reserve EFI setup_data in the kexec e820 table (Dave Young)  [Orabug: 34966703]  
  - xfs: make COW fork unwritten extent conversions more robust (Christoph Hellwig)  [Orabug: 34390903]  
  - scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan (Chandrakanth patil)  [Orabug: 34242965]  
  - scsi: megaraid_sas: Early detection of VD deletion through RaidMap update (Kashyap Desai)  [Orabug: 34242965]  
  - LTS version: v4.14.304 (Saeed Mirzamohammadi)   
  - x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN (YingChi Long)   
  - gsmi: fix null-deref in gsmi_get_variable (Khazhismel Kumykov)   
  - serial: atmel: fix incorrect baudrate setup (Tobias Schramm)   
  - serial: pch_uart: Pass correct sg to dma_unmap_sg() (Ilpo Järvinen)   
  - usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 (Juhyung Park)   
  - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() (Maciej Żenczykowski)   
  - usb: gadget: g_webcam: Send color matching descriptor per frame (Daniel Scally)   
  - usb: host: ehci-fsl: Fix module alias (Alexander Stein)   
  - USB: serial: cp210x: add SCALANCE LPE-9000 device id (Michael Adler)   
  - usb: core: hub: disable autosuspend for TI TUSB8041 (Flavio Suligoi)   
  - USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 (Greg Kroah-Hartman)   
  - USB: serial: option: add Quectel EM05CN modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EM05CN (SG) modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EC200U modem (Ali Mirghasemi)   
  - USB: serial: option: add Quectel EM05-G (RS) modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EM05-G (CS) modem (Duke Xin(辛安文))   
  - USB: serial: option: add Quectel EM05-G (GR) modem (Duke Xin(辛安文))   
  - prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman)   
  - usb: xhci: Check endpoint is valid before dereferencing it (Jimmy Hu)   
  - xhci-pci: set the dma max_seg_size (Ricardo Ribalda)   
  - nilfs2: fix general protection fault in nilfs_btree_insert() (Ryusuke Konishi)   
  - f2fs: let's avoid panic if extent_tree is not created (Jaegeuk Kim)   
  - RDMA/srp: Move large values to a new enum for gcc13 (Jiri Slaby (SUSE))   
  - net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats (Daniil Tatianin)   
  - pNFS/filelayout: Fix coalescing test for single DS (Olga Kornievskaia)   
  - LTS version: v4.14.303 (Saeed Mirzamohammadi)   
  - Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" (Ferry Toth)   
  - nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() (Minsuk Kang)   
  - hvc/xen: lock console list traversal (Roger Pau Monne)   
  - regulator: da9211: Use irq handler when ready (Ricardo Ribalda)   
  - EDAC/device: Fix period calculation in edac_device_reset_delay_period() (Eliav Farber)   
  - x86/boot: Avoid using Intel mnemonics in AT&T syntax asm (Peter Zijlstra)   
  - netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (Gavrilov Ilia)   
  - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (Herbert Xu) [Orabug: 35005830] {CVE-2023-0394}
  - platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe (Hans de Goede)   
  - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (Clement Lecigne)   
  - net/ulp: prevent ULP without clone op from entering the LISTEN status (Paolo Abeni)   
  - s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() (Heiko Carstens)   
  - perf auxtrace: Fix address filter duplicate symbol selection (Adrian Hunter)   
  - docs: Fix the docs build with Sphinx 6.0 (Jonathan Corbet)   
  - net: sched: disallow noqueue for qdisc classes (Frederick Lawler) [Orabug: 35005793] {CVE-2022-47929}
  - ravb: Fix "failed to switch device to config mode" message during unbind (Biju Das)   
  - driver core: Fix bus_type.match() error handling in __driver_attach() (Isaac J. Manjarres)   
  - parisc: Align parisc MADV_XXX constants with all other architectures (Helge Deller)   
  - hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling (Linus Torvalds)   
  - hfs/hfsplus: use WARN_ON for sanity check (Arnd Bergmann)   
  - nfsd: fix handling of readdir in v4root vs. mount upcall timeout (Jeff Layton)   
  - x86/bugs: Flush IBP in ib_prctl_set() (Rodrigo Branco)   
  - udf: Fix extension of the last extent in the file (Jan Kara)   
  - caif: fix memory leak in cfctrl_linkup_request() (Zhengchao Shao)   
  - usb: rndis_host: Secure rndis_query check against int overflow (Szymon Heidrich)   
  - net: sched: atm: dont intepret cls results when asked to drop (Jamal Hadi Salim) [Orabug: 34983615] {CVE-2023-23455}
  - net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe (Miaoqian Lin)   
  - net: amd-xgbe: add missed tasklet_kill (Jiguang Xiao)   
  - nfc: Fix potential resource leaks (Miaoqian Lin)   
  - qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (Daniil Tatianin)   
  - bpf: pull before calling skb_postpull_rcsum() (Jakub Kicinski)   
  - SUNRPC: ensure the matching upcall is in-flight upon downcall (minoura makoto)   
  - ext4: allocate extended attribute value in vmalloc area (Ye Bin)   
  - ext4: avoid unaccounted block allocation when expanding inode (Jan Kara)   
  - ext4: initialize quota before expanding inode in setproject ioctl (Jan Kara)   
  - ext4: fix inode leak in ext4_xattr_inode_create() on an error path (Ye Bin)   
  - ext4: avoid BUG_ON when creating xattrs (Jan Kara)   
  - ext4: fix error code return to user-space in ext4_get_branch() (Luís Henriques)   
  - ext4: init quota for 'old.inode' in 'ext4_rename' (Ye Bin)   
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode (Baokun Li)   
  - ext4: fix undefined behavior in bit shift for ext4_check_flag_values (Gaosheng Cui)   
  - ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop (Baokun Li)   
  - drm/vmwgfx: Validate the box size for the snooped cursor (Zack Rusin)   
  - drm/connector: send hotplug uevent on connector cleanup (Simon Ser)   
  - device_cgroup: Roll back to original exceptions after copy failure (Wang Weiyang)   
  - parisc: led: Fix potential null-ptr-deref in start_task() (Shang XiaoJing)   
  - iommu/amd: Fix ivrs_acpihid cmdline parsing code (Kim Phillips)   
  - crypto: n2 - add missing hash statesize (Corentin Labbe)   
  - PCI/sysfs: Fix double free in error path (Sascha Hauer)   
  - PCI: Fix pci_device_is_present() for VFs by checking PF (Michael S. Tsirkin)   
  - ima: Fix a potential NULL pointer access in ima_restore_measurement_list (Huaxin Lu)   
  - cifs: fix confusing debug message (Paulo Alcantara)   
  - media: dvb-core: Fix UAF due to refcount races at releasing (Takashi Iwai) [Orabug: 34820630] {CVE-2022-41218}
  - media: dvb-core: Fix double free in dvb_register_device() (Keita Suzuki)   
  - ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod (Nick Desaulniers)   
  - tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line (Yang Jihong)   
  - x86/microcode/intel: Do not retry microcode reloading on the APs (Ashok Raj)   
  - dm cache: set needs_check flag after aborting metadata (Mike Snitzer)   
  - dm cache: Fix UAF in destroy() (Luo Meng)   
  - dm thin: Fix UAF in run_timer_softirq() (Luo Meng)   
  - dm thin: Use last transaction's pmd->root when commit failed (Zhihao Cheng)   
  - dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort (Mike Snitzer)   
  - selftests: Use optional USERCFLAGS and USERLDFLAGS (Mickaël Salaün)   
  - ARM: ux500: do not directly dereference __iomem (Jason A. Donenfeld)   
  - ktest.pl minconfig: Unset configs instead of just removing them (Steven Rostedt)   
  - media: stv0288: use explicitly signed char (Jason A. Donenfeld)   
  - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo)   
  - tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo)   
  - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING (Deren Wu)   
  - md: fix a crash in mempool_free (Mikulas Patocka)   
  - pnode: terminate at peers of source (Christian Brauner)   
  - ALSA: line6: fix stack overflow in line6_midi_transmit (Artem Egorkine)   
  - ALSA: line6: correct midi status byte when receiving data from podxt (Artem Egorkine)   
  - hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount (Aditya Garg)   
  - HID: plantronics: Additional PIDs for double volume key presses quirk (Terry Junge)   
  - powerpc/rtas: avoid scheduling in rtas_os_term() (Nathan Lynch)   
  - powerpc/rtas: avoid device tree lookups in rtas_os_term() (Nathan Lynch)   
  - media: dvbdev: fix refcnt bug (Lin Ma) [Orabug: 34983296] {CVE-2022-45886} {CVE-2022-45884} {CVE-2022-45919} {CVE-2022-45887} {CVE-2022-45885}
  - gcov: add support for checksum field (Rickard x Andersson)   
  - iio: adc: ad_sigma_delta: do not use internal iio_dev lock (Nuno Sá)   
  - reiserfs: Add missing calls to reiserfs_security_free() (Roberto Sassu)   
  - HID: wacom: Ensure bootloader PID is usable in hidraw mode (Jason Gerecke)   
  - usb: dwc3: core: defer probe on ulpi_read_id timeout (Ferry Toth)   
  - pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES (John Stultz)   
  - pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion (John Stultz)   
  - ASoC: rt5670: Remove unbalanced pm_runtime_put() (Hans de Goede)   
  - ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() (Wang Jingjin)   
  - ASoC: wm8994: Fix potential deadlock (Marek Szyprowski)   
  - ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() (Wang Jingjin)   
  - ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() (Wang Yufen)   
  - orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() (Zhang Xiaoxu)   
  - drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() (Nathan Chancellor)   
  - drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() (Nathan Chancellor)   
  - clk: st: Fix memory leak in st_of_quadfs_setup() (Xiu Jianfeng)   
  - media: si470x: Fix use-after-free in si470x_int_in_callback() (Shigeru Yoshida)   
  - mmc: f-sdh30: Add quirks for broken timeout clock capability (Kunihiko Hayashi)   
  - blk-mq: fix possible memleak when register 'hctx' failed (Ye Bin)   
  - media: dvb-usb: fix memory leak in dvb_usb_adapter_init() (Mazin Al Haddad)   
  - media: dvbdev: adopts refcnt to avoid UAF (Lin Ma) [Orabug: 34983296] {CVE-2022-45887} {CVE-2022-45885} {CVE-2022-45884} {CVE-2022-45886} {CVE-2022-45919}
  - media: dvb-frontends: fix leak of memory fw (Yan Lei)   
  - ppp: associate skb with a device at tx (Stanislav Fomichev)   
  - mrp: introduce active flags to prevent UAF when applicant uninit (Schspa Shi)   
  - md/raid1: stop mdx_raid1 thread when raid1 array run failed (Jiang Li)   
  - drm/sti: Use drm_mode_copy() (Ville Syrjälä)   
  - s390/lcs: Fix return type of lcs_start_xmit() (Nathan Chancellor)   
  - s390/netiucv: Fix return type of netiucv_tx() (Nathan Chancellor)   
  - s390/ctcm: Fix return type of ctc{mp,}m_tx() (Nathan Chancellor)   
  - igb: Do not free q_vector unless new one was allocated (Kees Cook)   
  - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() (Minsuk Kang)   
  - hamradio: baycom_epp: Fix return type of baycom_send_packet() (Nathan Chancellor)   
  - net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() (Nathan Chancellor)   
  - bpf: make sure skb->len != 0 when redirecting to a tunneling device (Stanislav Fomichev)   
  - ipmi: fix memleak when unload ipmi driver (Zhang Yuchen)   
  - ASoC: codecs: rt298: Add quirk for KBL-R RVP platform (Amadeusz Sławiński)   
  - wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out (Shigeru Yoshida)   
  - wifi: ath9k: verify the expected usb_endpoints are present (Fedor Pchelkin)   
  - hfs: fix OOB Read in __hfs_brec_find (ZhangPeng)   
  - acct: fix potential integer overflow in encode_comp_t() (Zheng Yejian)   
  - nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() (Ryusuke Konishi)   
  - ACPICA: Fix error code path in acpi_ds_call_control_method() (Rafael J. Wysocki)   
  - fs: jfs: fix shift-out-of-bounds in dbDiscardAG (Hoi Pok Wu)   
  - udf: Avoid double brelse() in udf_rename() (Shigeru Yoshida)   
  - fs: jfs: fix shift-out-of-bounds in dbAllocAG (Dongliang Mu)   
  - binfmt_misc: fix shift-out-of-bounds in check_special_flags (Liu Shixin)   
  - net: stream: purge sk_error_queue in sk_stream_kill_queues() (Eric Dumazet)   
  - myri10ge: Fix an error handling path in myri10ge_probe() (Christophe JAILLET)   
  - net_sched: reject TCF_EM_SIMPLE case for complex ematch module (Cong Wang)   
  - skbuff: Account for tail adjustment during pull operations (Subash Abhinov Kasiviswanathan)   
  - openvswitch: Fix flow lookup to use unmasked key (Eelco Chaudron)   
  - r6040: Fix kmemleak in probe and remove (Li Zetao)   
  - nfc: pn533: Clear nfc_target before being used (Minsuk Kang)   
  - mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (Dan Aloni)   
  - rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() (Gaosheng Cui)   
  - selftests/powerpc: Fix resource leaks (Miaoqian Lin)   
  - powerpc/hv-gpci: Fix hv_gpci event list (Kajol Jain)   
  - powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() (Yang Yingliang)   
  - powerpc/perf: callchain validate kernel stack pointer bounds (Nicholas Piggin)   
  - powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() (Yang Yingliang)   
  - cxl: Fix refcount leak in cxl_calc_capp_routing (Miaoqian Lin)   
  - powerpc/52xx: Fix a resource leak in an error handling path (Christophe JAILLET)   
  - macintosh/macio-adb: check the return value of ioremap() (Xie Shaowen)   
  - macintosh: fix possible memory leak in macio_add_one_device() (Yang Yingliang)   
  - iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() (Yuan Can)   
  - iommu/amd: Fix pci device refcount leak in ppr_notifier() (Yang Yingliang)   
  - rtc: snvs: Allow a time difference on clock register read (Stefan Eichenberger)   
  - include/uapi/linux/swab: Fix potentially missing __always_inline (Matt Redfearn)   
  - HSI: omap_ssi_core: Fix error handling in ssi_init() (Yuan Can)   
  - power: supply: fix residue sysfs file in error handle route of __power_supply_register() (Zeng Heng)   
  - HSI: omap_ssi_core: fix possible memory leak in ssi_probe() (Yang Yingliang)   
  - HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() (Yang Yingliang)   
  - fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() (Christophe JAILLET)   
  - fbdev: vermilion: decrease reference count in error path (Xiongfeng Wang)   
  - fbdev: via: Fix error in via_core_init() (Shang XiaoJing)   
  - fbdev: pm2fb: fix missing pci_disable_device() (Yang Yingliang)   
  - fbdev: ssd1307fb: Drop optional dependency (Andy Shevchenko)   
  - usb: storage: Add check for kcalloc (Jiasheng Jiang)   
  - i2c: ismt: Fix an out-of-bounds bug in ismt_access() (Zheyu Ma) [Orabug: 34555528] {CVE-2022-2873}
  - vme: Fix error not catched in fake_init() (Chen Zhongjin)   
  - staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() (YueHaibing)   
  - staging: rtl8192u: Fix use after free in ieee80211_rx() (Dan Carpenter)   
  - i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe (Hui Tang)   
  - chardev: fix error handling in cdev_device_add() (Yang Yingliang)   
  - mcb: mcb-parse: fix error handing in chameleon_parse_gdd() (Yang Yingliang)   
  - drivers: mcb: fix resource leak in mcb_probe() (Zhengchao Shao)   
  - cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() (Yang Yingliang)   
  - cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() (Yang Yingliang)   
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (Zheng Wang)   
  - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (ruanjinjie)   
  - test_firmware: fix memory leak in test_firmware_init() (Zhengchao Shao)   
  - serial: sunsab: Fix error handling in sunsab_init() (Yuan Can)   
  - serial: pch: Fix PCI device refcount leak in pch_request_dma() (Xiongfeng Wang)   
  - serial: amba-pl011: avoid SBSA UART accessing DMACR register (Jiamei Xie)   
  - staging: vme_user: Fix possible UAF in tsi148_dma_list_add (Gaosheng Cui)   
  - usb: fotg210-udc: Fix ages old endianness issues (Linus Walleij)   
  - uio: uio_dmem_genirq: Fix deadlock between irq config and handling (Rafael Mendonca)   
  - uio: uio_dmem_genirq: Fix missing unlock in irq configuration (Rafael Mendonca)   
  - vfio: platform: Do not pass return buffer to ACPI _RST method (Rafael Mendonca)   
  - class: fix possible memory leak in __class_register() (Yang Yingliang)   
  - drivers: dio: fix possible memory leak in dio_init() (Yang Yingliang)   
  - IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces (Dragos Tatulea)   
  - hwrng: geode - Fix PCI device refcount leak (Xiongfeng Wang)   
  - hwrng: amd - Fix PCI device refcount leak (Xiongfeng Wang)   
  - crypto: img-hash - Fix variable dereferenced before check 'hdev->req' (Gaosheng Cui)   
  - orangefs: Fix sysfs not cleanup when dev init failed (Zhang Xiaoxu)   
  - RDMA/hfi1: Fix error return code in parse_platform_config() (Wang Yufen)   
  - scsi: snic: Fix possible UAF in snic_tgt_create() (Gaosheng Cui)   
  - scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails (Chen Zhongjin)   
  - scsi: ipr: Fix WARNING in ipr_init() (Shang XiaoJing)   
  - scsi: fcoe: Fix possible name leak when device_register() fails (Yang Yingliang)   
  - scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() (Yang Yingliang)   
  - scsi: hpsa: Fix error handling in hpsa_add_sas_host() (Yang Yingliang)   
  - RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (Zhang Xiaoxu)   
  - RDMA/hfi: Decrease PCI device reference count in error path (Xiongfeng Wang)   
  - PCI: Check for alloc failure in pci_request_irq() (Zeng Heng)   
  - apparmor: fix a memleak in multi_transaction_new() (Gaosheng Cui)   
  - stmmac: fix potential division by 0 (Piergiorgio Beruto)   
  - Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - ntb_netdev: Use dev_kfree_skb_any() in interrupt context (Eric Pilmore)   
  - net: lan9303: Fix read error execution path (Jerry Ray)   
  - net: amd-xgbe: Check only the minimum speed for active/passive cables (Tom Lendacky)   
  - net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - net/tunnel: wait until all sk_user_data reader finish before releasing the sock (Hangbin Liu)   
  - net: farsync: Fix kmemleak when rmmods farsync (Li Zetao)   
  - ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)   
  - drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (Yuan Can)   
  - net: defxx: Fix missing err handling in dfx_init() (Yongqiang Liu)   
  - net: vmw_vsock: vmci: Check memcpy_from_msg() (Artem Chernyshev)   
  - blktrace: Fix output non-blktrace event when blk_classic option enabled (Yang Jihong)   
  - wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() (Wang Yufen)   
  - wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h (Bitterblue Smith)   
  - clk: samsung: Fix memory leak in _samsung_clk_register_pll() (Xiu Jianfeng)   
  - media: coda: Add check for kmalloc (Jiasheng Jiang)   
  - media: coda: Add check for dcoda_iram_alloc (Jiasheng Jiang)   
  - media: c8sectpfe: Add of_node_put() when breaking out of loop (Liang He)   
  - mmc: mmci: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: wbsd: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: via-sdmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: wmt-sdmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: vub300: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: toshsd: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: mxcmmc: fix return value check of mmc_add_host() (Yang Yingliang)   
  - mmc: moxart: fix return value check of mmc_add_host() (Yang Yingliang)   
  - NFSv4.x: Fail client initialisation if state manager thread can't run (Trond Myklebust)   
  - SUNRPC: Fix missing release socket in rpc_sockname() (Wang ShaoBo)   
  - ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (Gaosheng Cui)   
  - media: saa7164: fix missing pci_disable_device() (Liu Shixin)   
  - regulator: core: fix module refcount leak in set_supply() (Yang Yingliang)   
  - bonding: uninitialized variable in bond_miimon_inspect() (Dan Carpenter)   
  - ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe (Zhang Qilong)   
  - drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() (Xiongfeng Wang)   
  - drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() (Xiongfeng Wang)   
  - ALSA: asihpi: fix missing pci_disable_device() (Liu Shixin)   
  - NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn (Trond Myklebust)   
  - NFSv4.2: Fix a memory stomp in decode_attr_security_label (Trond Myklebust)   
  - media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC (Aakarsh Jain)   
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() (Baisong Zhong)   
  - pinctrl: pinconf-generic: add missing of_node_put() (ZhangPeng)   
  - media: imon: fix a race condition in send_packet() (Gautam Menghani)   
  - mtd: maps: pxa2xx-flash: fix memory leak in probe (Zheng Yongjun)   
  - clk: rockchip: Fix memory leak in rockchip_clk_register_pll() (Xiu Jianfeng)   
  - ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT (Baisong Zhong)   
  - HID: hid-sensor-custom: set fixed size for custom attributes (Marcus Folkesson)   
  - media: platform: exynos4-is: Fix error handling in fimc_md_init() (Yuan Can)   
  - media: solo6x10: fix possible memory leak in solo_sysfs_init() (Yang Yingliang)   
  - Input: elants_i2c - properly handle the reset GPIO when power is off (Douglas Anderson)   
  - mtd: lpddr2_nvm: Fix possible null-ptr-deref (Hui Tang)   
  - wifi: ath10k: Fix return value in ath10k_pci_init() (Xiu Jianfeng)   
  - ima: Fix misuse of dereference of pointer in template_desc_init_fields() (Xiu Jianfeng)   
  - regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() (Yang Yingliang)   
  - ASoC: pxa: fix null-pointer dereference in filter() (Zeng Heng)   
  - drm/radeon: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo)   
  - media: camss: Clean up received buffers on failed start of streaming (Vladimir Zapolskiy)   
  - mtd: Fix device name leak when register device failed in add_mtd_device() (Zhang Xiaoxu)   
  - media: vivid: fix compose size exceed boundary (Liu Shixin)   
  - spi: Update reference to struct spi_controller (Jonathan Neuschäfer)   
  - media: i2c: ad5820: Fix error path (Ricardo Ribalda)   
  - wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() (Fedor Pchelkin)   
  - wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() (Fedor Pchelkin)   
  - rapidio: devices: fix missing put_device in mport_cdev_open (Cai Xinchen)   
  - hfs: Fix OOB Write in hfs_asc2mac (ZhangPeng)   
  - eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD (Zhang Qilong)   
  - rapidio: fix possible UAF when kfifo_alloc() fails (Wang Weiyang)   
  - fs: sysv: Fix sysv_nblocks() returns wrong value (Chen Zhongjin)   
  - MIPS: BCM63xx: Add check for NULL for clk in clk_enable (Anastasia Belova)   
  - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() (Yu Liao)   
  - x86/xen: Fix memory leak in xen_init_lock_cpu() (Xiu Jianfeng)   
  - uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix (Oleg Nesterov)   
  - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (Li Zetao)   
  - rapidio: rio: fix possible name leak in rio_register_mport() (Yang Yingliang)   
  - rapidio: fix possible name leaks when rio_add_device() fails (Yang Yingliang)   
  - lib/notifier-error-inject: fix error when writing -errno to debugfs file (Akinobu Mita)   
  - libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value (Akinobu Mita)   
  - irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() (Shang XiaoJing)   
  - PNP: fix name memory leak in pnp_alloc_dev() (Yang Yingliang)   
  - MIPS: vpe-cmp: fix possible memory leak while module exiting (Yang Yingliang)   
  - MIPS: vpe-mt: fix possible memory leak while module exiting (Yang Yingliang)   
  - ocfs2: fix memory leak in ocfs2_stack_glue_init() (Shang XiaoJing)   
  - timerqueue: Use rb_entry_safe() in timerqueue_getnext() (Barnabás Pőcze)   
  - perf: Fix possible memleak in pmu_dev_alloc() (Chen Zhongjin)   
  - fs: don't audit the capability check in simple_xattr_list() (Ondrej Mosnacek)   
  - PM: hibernate: Fix mistake in kerneldoc comment (xiongxin)   
  - alpha: fix syscall entry in !AUDUT_SYSCALL case (Al Viro)   
  - cpuidle: dt: Return the correct numbers of parsed idle states (Ulf Hansson)   
  - tpm/tpm_crb: Fix error message in __crb_relinquish_locality() (Michael Kelley)   
  - pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP (Stephen Boyd)   
  - ARM: mmp: fix timer_read delay (Doug Brown)   
  - pstore/ram: Fix error return code in ramoops_probe() (Wang Yufen)   
  - ARM: dts: turris-omnia: Add switch port 6 node (Pali Rohár)   
  - ARM: dts: turris-omnia: Add ethernet aliases (Pali Rohár)   
  - ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port (Pali Rohár)   
  - arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name (AngeloGioacchino Del Regno)   
  - soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe (Zhang Qilong)   
  - arm: dts: spear600: Fix clcd interrupt (Kory Maincent)   
  - drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static (Chen Jiahao)   
  - ARM: dts: qcom: apq8064: fix coresight compatible (Luca Weiss)   
  - usb: musb: remove extra check in musb_gadget_vbus_draw (Ivaylo Dimitrov)   
  - net: loopback: use NET_NAME_PREDICTABLE for name_assign_type (Rasmus Villemoes)   
  - Bluetooth: L2CAP: Fix u8 overflow (Sungwoo Kim) [Orabug: 34880796] {CVE-2022-45934}
  - igb: Initialize mailbox message for VF reset (Tony Nguyen)   
  - USB: serial: cp210x: add Kamstrup RF sniffer PIDs (Bruno Thomsen)   
  - USB: serial: option: add Quectel EM05-G modem (Duke Xin)   
  - usb: gadget: uvc: Prevent buffer overflow in setup handler (Szymon Heidrich)   
  - udf: Fix extending file within last block (Jan Kara)   
  - udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size (Jan Kara)   
  - udf: Fix preallocation discarding at indirect extent boundary (Jan Kara)   
  - udf: Drop unused arguments of udf_delete_aext() (Jan Kara)   
  - udf: Discard preallocation before extending file with a hole (Jan Kara)   
  - perf script python: Remove explicit shebang from tests/attr.c (Tony Jones)   
  - ASoC: ops: Correct bounds check for second channel on SX controls (Charles Keepax)   
  - can: mcba_usb: Fix termination command argument (Yasushi SHOJI)   
  - can: sja1000: fix size of OCR_MODE_MASK define (Heiko Schocher)   
  - ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() (Mark Brown)   
  - nfp: fix use-after-free in area_cache_get() (Jialiang Wang) [Orabug: 34719740] {CVE-2022-3545}
  - block: unhash blkdev part inode when the part is deleted (Ming Lei)   
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (Jann Horn)   
  - mm/khugepaged: fix GUP-fast interaction by sending IPI (Jann Horn)   
  - once: add DO_ONCE_SLOW() for sleepable contexts (Eric Dumazet)   
  - libtraceevent: Fix build with binutils 2.35 (Ben Hutchings)


